@camstack/addon-post-analysis 1.2.25 → 1.2.27

package/dist/{dist-DsCSHZ9N.mjs → dist-D7FtjvAJ.mjs}

@@ -6513,6 +6513,109 @@ var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
 function nodePin(nodeId) {
 	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: nodeId } };
 }
+/**
+* AUTO-GENERATED by scripts/generate-device-scoped-caps.ts — DO NOT EDIT.
+*
+* Every `scope: 'device'` capability name, as plain data — so a forked runner
+* can answer "may a rule actuate this?" without importing the schema barrel
+* (~144MB RSS per runner, D28).
+*
+* Coverage: 80 device-scoped capabilities.
+*/
+var DEVICE_SCOPED_CAPS = new Set([
+	"accessories",
+	"air-quality-sensor",
+	"alarm-panel",
+	"ambient-light-sensor",
+	"audio-analysis",
+	"audio-metrics",
+	"automation-control",
+	"battery",
+	"binary",
+	"brightness",
+	"button",
+	"camera-credentials",
+	"camera-pipeline-config",
+	"camera-streams",
+	"carbon-monoxide",
+	"climate-control",
+	"color",
+	"connectivity",
+	"consumables",
+	"contact",
+	"control",
+	"cover",
+	"day-night",
+	"detection-pipeline",
+	"device-discovery",
+	"device-ops",
+	"device-status",
+	"doorbell",
+	"enum-sensor",
+	"event-emitter",
+	"events",
+	"fan-control",
+	"feature-probe",
+	"flood",
+	"gas",
+	"humidifier",
+	"humidity-sensor",
+	"image",
+	"image-settings",
+	"intercom",
+	"lawn-mower-control",
+	"lock-control",
+	"media-player",
+	"motion",
+	"motion-detection",
+	"motion-trigger",
+	"motion-zones",
+	"native-object-detection",
+	"notifier",
+	"numeric-sensor",
+	"osd",
+	"pet-feeder",
+	"pipeline-analytics",
+	"power-meter",
+	"presence",
+	"pressure-sensor",
+	"privacy-mask",
+	"ptz",
+	"ptz-autotrack",
+	"reboot",
+	"scene-monitor",
+	"script-runner",
+	"smoke",
+	"snapshot",
+	"stream-catalog",
+	"stream-params",
+	"switch",
+	"tamper",
+	"temperature-sensor",
+	"update",
+	"vacuum-control",
+	"valve",
+	"vibration",
+	"videoclips",
+	"water-heater",
+	"weather",
+	"webrtc-session",
+	"zone-analytics",
+	"zone-rules",
+	"zones"
+]);
+/**
+* True when `capName` is a device capability.
+*
+* This is the ONLY boundary on what a notification rule may actuate. A rule can
+* be authored by a non-admin and the runner executes with the addon's
+* privileges, so an unbounded action would be an arbitrary RPC channel with a
+* privilege escalation attached. Device scope excludes the system caps
+* (`device-manager.removeDevice` and friends) by construction.
+*/
+function isDeviceScopedCap(capName) {
+	return DEVICE_SCOPED_CAPS.has(capName);
+}
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -6898,6 +7001,10 @@ function systemMethod(input, output, options) {
 		systemOnly: true
 	};
 }
+/** Shorthand to define an event schema */
+function event(data) {
+	return { data };
+}
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
 method(_void(), StaticDirOutputSchema$1), method(_void(), VersionOutputSchema$1);
@@ -8392,6 +8499,60 @@ function buildNcTaxonomy() {
 /** The frozen NC taxonomy, derived once from the taxonomy dictionary. */
 var NC_TAXONOMY = Object.freeze(buildNcTaxonomy());
 /**
+* Most specific first. Extending this list is how a new device kind becomes
+* gateable; nothing else needs to change.
+*/
+var DEVICE_STATE_READERS = [
+	{
+		cap: "alarm-panel",
+		field: "state"
+	},
+	{
+		cap: "cover",
+		field: "state"
+	},
+	{
+		cap: "presence",
+		field: "state"
+	},
+	{
+		cap: "lock",
+		field: "locked",
+		booleanWords: ["locked", "unlocked"]
+	},
+	{
+		cap: "contact",
+		field: "entryOpen",
+		booleanWords: ["open", "closed"]
+	},
+	{
+		cap: "switch",
+		field: "on",
+		booleanWords: ["on", "off"]
+	},
+	{
+		cap: "binary",
+		field: "on",
+		booleanWords: ["on", "off"]
+	}
+];
+/**
+* Collapse a device's full runtime state to the one string a rule compares
+* against, or `undefined` when nothing in the table applies.
+*
+* `undefined` is the safe answer everywhere: the gate treats it as "does not
+* match", so a device whose kind we cannot read simply never arms a rule.
+*/
+function readDeviceStateFrom(runtimeState) {
+	for (const reader of DEVICE_STATE_READERS) {
+		const slice = runtimeState[reader.cap];
+		if (slice === null || typeof slice !== "object") continue;
+		const value = slice[reader.field];
+		if (typeof value === "string" && value.length > 0) return value;
+		if (typeof value === "boolean" && reader.booleanWords !== void 0) return value ? reader.booleanWords[0] : reader.booleanWords[1];
+	}
+}
+/**
 * Error types for the safe expression engine. Two distinct classes so callers
 * can tell a compile-time (grammar) failure from a runtime (evaluation)
 * failure — both are non-fatal to the host: read paths degrade to "skip link".
@@ -9026,6 +9187,249 @@ var AccessoryKind = {
 };
 AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
 DeviceFeature.BatteryOperated;
+var DeviceConfig = class DeviceConfig {
+	schema;
+	data;
+	persistFn;
+	constructor(schema, data, persist) {
+		this.schema = schema;
+		this.data = data;
+		this.persistFn = persist;
+	}
+	/**
+	* Build a `DeviceConfig` from a persisted blob, with automatic
+	* recovery from schema-validation failures. Boot must never be
+	* blocked by stale persisted values: if Zod rejects the blob,
+	* we drop every offending top-level field, retry, and persist
+	* the cleaned blob so the bad value is healed in the DB on next
+	* write. The most common trigger is a tightened range constraint
+	* (e.g. `max(100) → max(50)`) on a field that already has an
+	* out-of-range value persisted from the previous schema. Without
+	* this safety net, the device would fail to instantiate and end
+	* up with no caps registered — exactly the failure mode that
+	* stranded device 15 when `motionSensitivity: 90` no longer fit
+	* the new `1..50` schema.
+	*
+	* Recovery rules:
+	*  1. Try `safeParse(initialData)`. If it succeeds, done.
+	*  2. On failure, walk `error.issues`, collect the top-level path
+	*     of each issue, and drop those keys from `initialData`.
+	*  3. Re-run `safeParse`. If the cleaned blob now passes (Zod
+	*     fills the missing keys with schema defaults / undefined for
+	*     `.optional()`), persist it via `persist()` so the bad
+	*     values disappear from the DB, and return the device.
+	*  4. If the cleaned blob STILL fails (very rare — would require
+	*     a non-recoverable required field), fall back to
+	*     `schema.parse({})` so the device still boots with pure
+	*     schema defaults. Persist nothing in that path so the next
+	*     successful `setAll` still writes a coherent blob.
+	*/
+	static fromSchema(schema, persist, initialData = {}, onRecover) {
+		const first = schema.safeParse(initialData);
+		if (first.success) return new DeviceConfig(schema, first.data, persist);
+		const droppedKeys = /* @__PURE__ */ new Set();
+		for (const issue of first.error.issues) {
+			const top = issue.path[0];
+			if (typeof top === "string") droppedKeys.add(top);
+		}
+		const cleaned = { ...initialData };
+		for (const k of droppedKeys) delete cleaned[k];
+		const second = schema.safeParse(cleaned);
+		onRecover?.({
+			droppedKeys: [...droppedKeys],
+			issues: first.error.issues
+		});
+		if (second.success) {
+			persist(second.data).catch(() => {});
+			return new DeviceConfig(schema, second.data, persist);
+		}
+		return new DeviceConfig(schema, schema.parse({}), persist);
+	}
+	get values() {
+		return this.data;
+	}
+	get(key) {
+		return this.data[key];
+	}
+	async set(key, value) {
+		const next = this.schema.parse({
+			...this.data,
+			[key]: value
+		});
+		this.data = next;
+		await this.persistFn(this.data);
+	}
+	/**
+	* Merge an untyped patch onto the current config and persist. Accepts
+	* `Record<string, unknown>` because the patch typically comes from the
+	* UI form layer (a `ConfigField.key → value` map) where the caller
+	* doesn't hold the Zod schema's static type. Runtime validation is
+	* authoritative: `this.schema.parse` rejects unknown keys or invalid
+	* shapes before touching storage.
+	*/
+	async setAll(partial) {
+		const next = this.schema.parse({
+			...this.data,
+			...partial
+		});
+		this.data = next;
+		await this.persistFn(this.data);
+	}
+	async deleteKey(key) {
+		const { [key]: _, ...rest } = this.data;
+		const next = this.schema.parse(rest);
+		this.data = next;
+		await this.persistFn(this.data);
+	}
+	entries() {
+		const shape = this.schema.shape;
+		return Object.entries(shape).map(([key, fieldSchema]) => ({
+			key,
+			schema: fieldSchema,
+			value: this.data[key],
+			description: fieldSchema.description
+		}));
+	}
+};
+/**
+* Concrete implementation. Routes every successful write through
+* `writer(capName, slice)` — the kernel hooks this up to
+* `device-state.setCapSlice`, the canonical cross-layer write
+* entrypoint, which handles disk persistence (debounced on the hub)
+* and mirror updates.
+*
+* Schema validation runs in-process before the writer is called —
+* the round-trip should never carry an invalid slice. `flush()`
+* awaits any in-flight writer promises so shutdown is lossless.
+*
+* `initial` is the persisted blob loaded at boot. Slices for caps
+* whose schema hasn't been installed yet are kept in-memory verbatim
+* and validated when the cap registers later.
+*/
+var DeviceRuntimeState = class DeviceRuntimeState {
+	writer;
+	/** In-flight writer promises tracked so `flush()` can await them. */
+	pendingWrites = /* @__PURE__ */ new Set();
+	/** Per-cap committed slice — after schema validation when known. */
+	slices;
+	/** Per-cap registered schema (set by `installCapSchema`). */
+	schemas = /* @__PURE__ */ new Map();
+	listeners = /* @__PURE__ */ new Set();
+	capListeners = /* @__PURE__ */ new Map();
+	constructor(initial, writer) {
+		this.writer = writer;
+		this.slices = /* @__PURE__ */ new Map();
+		for (const [k, v] of Object.entries(initial)) if (v && typeof v === "object" && !Array.isArray(v)) this.slices.set(k, { ...v });
+	}
+	static fromInitial(initial, writer) {
+		return new DeviceRuntimeState(initial, writer);
+	}
+	installCapSchema(capName, schema) {
+		const existing = this.schemas.get(capName);
+		if (existing) {
+			if (existing !== schema) throw new Error(`[DeviceRuntimeState] capability "${capName}" registered a different runtime-state schema; each cap must declare ONE shape across every provider`);
+			return;
+		}
+		this.schemas.set(capName, schema);
+		const stored = this.slices.get(capName);
+		if (stored) {
+			const result = schema.safeParse(stored);
+			if (result.success) this.slices.set(capName, result.data);
+			else this.slices.delete(capName);
+		}
+	}
+	getCapState(capName) {
+		const slice = this.slices.get(capName);
+		if (!slice) return void 0;
+		return Object.freeze({ ...slice });
+	}
+	getCapField(capName, key) {
+		return this.slices.get(capName)?.[key];
+	}
+	setCapState(capName, value) {
+		this.applyCapWrite(capName, value, false);
+	}
+	patchCapState(capName, partial) {
+		this.applyCapWrite(capName, partial, true);
+	}
+	/**
+	* Internal worker. `merge` controls whether `value` replaces or
+	* shallow-merges into the existing slice. Schema validation runs
+	* on the FINAL composed object regardless.
+	*/
+	applyCapWrite(capName, value, merge) {
+		const schema = this.schemas.get(capName);
+		if (!schema) throw new Error(`[DeviceRuntimeState] no schema registered for cap "${capName}" — did the device register it via ctx.registerNativeCap before writing?`);
+		const current = this.slices.get(capName) ?? {};
+		const next = merge ? {
+			...current,
+			...value
+		} : { ...value };
+		const parsed = schema.parse(next);
+		if (shallowEqual(current, parsed)) return;
+		this.slices.set(capName, parsed);
+		this.fireListeners([capName]);
+		const writePromise = this.writer(capName, { ...parsed }).catch(() => {});
+		this.pendingWrites.add(writePromise);
+		writePromise.finally(() => {
+			this.pendingWrites.delete(writePromise);
+		});
+	}
+	fireListeners(changed) {
+		const snap = this.snapshot();
+		for (const cb of this.listeners) try {
+			cb(changed, snap);
+		} catch {}
+		for (const capName of changed) {
+			const subs = this.capListeners.get(capName);
+			if (!subs) continue;
+			const slice = this.getCapState(capName);
+			for (const cb of subs) try {
+				cb(slice);
+			} catch {}
+		}
+	}
+	subscribe(cb) {
+		this.listeners.add(cb);
+		return () => {
+			this.listeners.delete(cb);
+		};
+	}
+	subscribeCap(capName, cb) {
+		let subs = this.capListeners.get(capName);
+		if (!subs) {
+			subs = /* @__PURE__ */ new Set();
+			this.capListeners.set(capName, subs);
+		}
+		const adapter = (slice) => {
+			cb(slice);
+		};
+		subs.add(adapter);
+		return () => {
+			const set = this.capListeners.get(capName);
+			if (!set) return;
+			set.delete(adapter);
+			if (set.size === 0) this.capListeners.delete(capName);
+		};
+	}
+	snapshot() {
+		const out = {};
+		for (const [k, v] of this.slices) out[k] = Object.freeze({ ...v });
+		return Object.freeze(out);
+	}
+	async flush() {
+		if (this.pendingWrites.size === 0) return;
+		const inflight = [...this.pendingWrites];
+		await Promise.allSettled(inflight);
+	}
+};
+function shallowEqual(a, b) {
+	const ak = Object.keys(a);
+	const bk = Object.keys(b);
+	if (ak.length !== bk.length) return false;
+	for (const k of ak) if (a[k] !== b[k]) return false;
+	return true;
+}
 new Set(["devices", "classes"]);
 /**
 * Shared geometry vocabulary for on-frame shape caps — privacy-mask,
@@ -9218,7 +9622,68 @@ var NcZoneConditionSchema = object({
 * The P1 condition set — a flat AND of groups; absent group = pass;
 * membership lists are OR within the list (spec §2.3).
 */
+/**
+* What a rule may actuate.
+*
+* **No hand-maintained allowlist** (operator decision, and the right one — a
+* written list of methods is a third parallel map to keep aligned, and this
+* repo has paid for those). The boundary instead comes from a property the
+* capabilities already carry: an action may target only a **device-scoped**
+* capability method.
+*
+* That is not decoration. A rule can be authored by a NON-ADMIN — personal
+* rules are a supported flow — and the executor runs with the addon's
+* privileges, so an unbounded action is an arbitrary RPC channel with a
+* privilege escalation attached. Restricting to device scope excludes the
+* system caps (`device-manager.removeDevice` and friends) by construction,
+* costs nothing to maintain, and cannot rot: a cap that stops being
+* device-scoped stops being actuatable in the same change.
+*
+* The executor enforces it; {@link NcRuleActionSchema} carries the intent.
+*/
+/**
+* One step of a sequence.
+*
+* `wait` is a first-class step rather than a property of the next action: it is
+* what makes a sequence a SEQUENCE and not a list — "unlock, wait 5s, open"
+* cannot be expressed otherwise.
+*/
+var NcRuleActionSchema = discriminatedUnion("kind", [object({
+	kind: literal("wait"),
+	seconds: number().min(0).max(300)
+}), object({
+	kind: literal("cap"),
+	deviceId: number().int(),
+	/** Capability name, e.g. `alarm-panel`. */
+	cap: string().min(1),
+	/** Method on it. The executor refuses a non-device-scoped cap. */
+	method: string().min(1),
+	/** Method arguments, minus `deviceId` (the executor injects it). */
+	args: record(string(), unknown()).optional()
+})]);
+/**
+* Sequences a rule runs, by hook point.
+*
+* ONLY `onTrigger` is here, deliberately. The reference also has activation /
+* deactivation / reset / post-generation hooks, and they are wanted — but this
+* repo's expensive failure mode is declaring a surface nothing produces, so a
+* hook appears here in the same change that produces its edge, never before.
+*/
+var NcRuleActionsSchema = object({ 
+/** Runs when the rule MATCHES. */
+onTrigger: array(object({
+	name: string().min(1).max(120),
+	enabled: boolean(),
+	minDelaySec: number().int().min(0).max(86400).optional(),
+	actions: array(NcRuleActionSchema).min(1)
+})).optional() });
 var NcConditionsSchema = object({
+	/** Gate on ANOTHER device's current state (the alarm armed, a switch on). */
+	deviceState: object({
+		deviceId: number().int(),
+		/** Any of these matches. */
+		states: array(string().min(1)).min(1)
+	}).optional(),
 	/** Device scope — absent = all devices. */
 	devices: array(number()).optional(),
 	/** Detector class names (any overlap with the record's class set). */
@@ -9512,7 +9977,16 @@ var NcRuleInputSchema = object({
 	* read as `false` by {@link canSetGlobal} in the engine. Admins are not bound
 	* by this flag — see the scope rules on that function.
 	*/
-	snoozeAllowGlobal: boolean().optional()
+	snoozeAllowGlobal: boolean().optional(),
+	/**
+	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
+	*
+	* This is what makes the rule set the alarm's trigger set without the alarm
+	* being a special case: arming is
+	* `{ cap: 'alarm-panel', method: 'arm', args: { mode: 'away' } }`, the same
+	* shape as every other actuation.
+	*/
+	actions: NcRuleActionsSchema.optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -9583,7 +10057,8 @@ var NcConditionDescriptorSchema = object({
 		"packagePhase",
 		"crossingSelect",
 		"polygonDraw",
-		"occupancy"
+		"occupancy",
+		"deviceState"
 	]),
 	operator: _enum([
 		"in",
@@ -9842,6 +10317,21 @@ var NC_CONDITION_CATALOG = [
 		phase: "P1",
 		description: "pipeline / onboard / sensor; a record with no stamped source counts as pipeline."
 	},
+	{
+		id: "deviceState",
+		group: "scope",
+		label: "Device state",
+		valueType: "deviceState",
+		operator: "in",
+		appliesTo: [
+			"immediate",
+			"track-end",
+			"device-event",
+			"package-event"
+		],
+		phase: "P2",
+		description: "Only fire while another device is in one of the chosen states — the alarm armed, a switch on, a contact closed. A state that cannot be read does NOT fire."
+	},
 	{
 		id: "sensorKinds",
 		group: "device",
@@ -10294,10 +10784,25 @@ var DeviceStatusSchema = object({
 	*  apart "just came online" from "still online". */
 	lastChangedAt: number()
 });
-object({
-	deviceId: number(),
-	status: DeviceStatusSchema
-});
+var deviceStatusCapability = {
+	name: "device-status",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	methods: {},
+	events: { 
+	/** Emitted when `online` transitions. Mirrors the semantics of
+	*  `battery.onStatusChanged`. */
+onStatusChanged: { data: object({
+		deviceId: number(),
+		status: DeviceStatusSchema
+	}) } },
+	status: {
+		schema: DeviceStatusSchema,
+		kind: "push"
+	},
+	runtimeState: DeviceStatusSchema
+};
 /**
 * Per-device feature/identity probe slice. Holds the runtime-resolved
 * truth about what a device CAN do — which the kernel uses to:
@@ -10355,11 +10860,35 @@ var FeatureProbeStatusSchema = object({
 	*/
 	lastFetchedAt: number()
 });
-object({
-	deviceId: number(),
-	status: FeatureProbeStatusSchema
-});
-object({
+var featureProbeCapability = {
+	name: "feature-probe",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	methods: {},
+	events: { 
+	/** Fires whenever a fresh probe completes (kernel-driven `reprobe()`
+	*  or driver-initiated re-detect after a state change). */
+onProbeChanged: { data: object({
+		deviceId: number(),
+		status: FeatureProbeStatusSchema
+	}) } },
+	status: {
+		schema: FeatureProbeStatusSchema,
+		kind: "push"
+	},
+	runtimeState: FeatureProbeStatusSchema
+};
+/**
+* Multi-metric air-quality slice. Covers CO₂, total VOCs, particulate
+* matter at PM2.5 / PM10, and a derived AQI index — all optional so
+* a single-metric source populates only what it observes. Mirrors
+* the HA `sensor` device_class set (`co2`, `volatile_organic_compounds`,
+* `pm25`, `pm10`, `aqi`) collapsed into one cap because a typical
+* air-quality node reports several of these together; modelling them
+* as siblings keeps a single timestamp + one slice subscription.
+*/
+var AirQualitySensorStatusSchema = object({
 	/** Carbon dioxide concentration in ppm. */
 	co2Ppm: number().min(0).optional(),
 	/** Total volatile organic compounds in ppb. */
@@ -10383,7 +10912,19 @@ object({
 	*  auto-formatting when absent. */
 	precision: number().int().min(0).max(10).optional()
 });
-DeviceType.Sensor;
+var airQualitySensorCapability = {
+	name: "air-quality-sensor",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: AirQualitySensorStatusSchema,
+		kind: "push"
+	},
+	runtimeState: AirQualitySensorStatusSchema
+};
 /**
 * Alarm-panel cap. Models HA `alarm_control_panel.*` on
 * `DeviceType.AlarmPanel`. State follows HA's canonical lifecycle
@@ -10419,7 +10960,7 @@ var AlarmArmModeSchema = _enum([
 	"vacation",
 	"custom_bypass"
 ]);
-object({
+var AlarmPanelStatusSchema = object({
 	/** Current lifecycle state. */
 	state: AlarmStateSchema,
 	/** Subset of arm modes the panel accepts. UI renders one button per
@@ -10431,26 +10972,58 @@ object({
 	/** Ms epoch when the slice was last updated. */
 	lastChangedAt: number()
 });
-DeviceType.AlarmPanel, method(object({
-	deviceId: number().int().nonnegative(),
-	mode: AlarmArmModeSchema,
-	/** Optional PIN code. Required when `requiresCode === true`.
-	*  Passed through to the upstream service; never persisted. */
-	code: string().min(1).optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	code: string().min(1).optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-object({
+var alarmPanelCapability = {
+	name: "alarm-panel",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.AlarmPanel],
+	methods: {
+		arm: method(object({
+			deviceId: number().int().nonnegative(),
+			mode: AlarmArmModeSchema,
+			/** Optional PIN code. Required when `requiresCode === true`.
+			*  Passed through to the upstream service; never persisted. */
+			code: string().min(1).optional()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		disarm: method(object({
+			deviceId: number().int().nonnegative(),
+			code: string().min(1).optional()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Force the panel into the `triggered` state — used by HA
+		* automations to surface external sensor events through the panel
+		* (e.g. a Reolink camera intrusion event firing the security
+		* system). Provider rejects when the panel hardware doesn't
+		* support a software-initiated trigger.
+		*/
+		trigger: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: AlarmPanelStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI panel reads the
+	* full slice; renders an arm button per `availableModes` entry and
+	* a PIN field iff `requiresCode === true`.
+	*/
+	runtimeState: AlarmPanelStatusSchema
+};
+/**
+* Ambient illuminance reading in lux. Drives Home Assistant `sensor`
+* entries with `device_class: illuminance`.
+*/
+var AmbientLightSensorStatusSchema = object({
 	/** Current illuminance in lux (lx). */
 	lux: number().min(0),
 	/** Ms epoch when the slice was last updated. */
@@ -10465,7 +11038,19 @@ object({
 	*  auto-formatting when absent. */
 	precision: number().int().min(0).max(10).optional()
 });
-DeviceType.Sensor;
+var ambientLightSensorCapability = {
+	name: "ambient-light-sensor",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: AmbientLightSensorStatusSchema,
+		kind: "push"
+	},
+	runtimeState: AmbientLightSensorStatusSchema
+};
 /**
 * Per-class audio metrics aggregated over a sliding window.
 */
@@ -10584,7 +11169,18 @@ var audioMetricsCapability = {
 	/** Reactive runtime-state mirror — live `device.state.audioMetrics.value`. */
 	runtimeState: AudioMetricsSnapshotSchema
 };
-object({
+/**
+* Automation-control cap. Models HA `automation.*` entities on
+* `DeviceType.Automation`. An automation is a trigger+condition+
+* action rule that can be enabled / disabled and manually fired
+* via the `trigger` method.
+*
+* `trigger` accepts an optional `skipCondition` flag — when true,
+* the automation's action block runs WITHOUT evaluating its
+* condition block. Pair with `DeviceFeature.AutomationSkipCondition`
+* to gate the UI checkbox for the manual-trigger dialog.
+*/
+var AutomationControlStatusSchema = object({
 	/** Whether the automation is currently enabled. Disabled automations
 	*  ignore their trigger block — manual `trigger` still works. */
 	enabled: boolean(),
@@ -10598,22 +11194,43 @@ object({
 	/** Ms epoch when the slice was last updated. */
 	lastChangedAt: number()
 });
-DeviceType.Automation, method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	/** When true, fires the action block while bypassing the
-	*  automation's condition evaluation. Gated by
-	*  `DeviceFeature.AutomationSkipCondition`. */
-	skipCondition: boolean().optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
+var automationControlCapability = {
+	name: "automation-control",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Automation],
+	methods: {
+		enable: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		disable: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		trigger: method(object({
+			deviceId: number().int().nonnegative(),
+			/** When true, fires the action block while bypassing the
+			*  automation's condition evaluation. Gated by
+			*  `DeviceFeature.AutomationSkipCondition`. */
+			skipCondition: boolean().optional()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: AutomationControlStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI automation tile
+	* reads `enabled` (toggle) + `isRunning` (spinner) + `lastError`
+	* (badge) directly.
+	*/
+	runtimeState: AutomationControlStatusSchema
+};
 /**
 * Battery status snapshot. Emitted by providers whose device is
 * battery-operated (cameras with `DeviceFeature.BatteryOperated`,
@@ -10652,40 +11269,156 @@ var BatteryStatusSchema = object({
 	*/
 	binary: boolean().optional()
 });
-DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, method(object({
-	deviceId: number(),
-	/** Bound on the wait. Sensible range 3000–10000ms. */
-	timeoutMs: number().int().min(500).max(3e4).default(8e3)
-}), object({
-	awoke: boolean(),
-	durationMs: number()
-}), { kind: "mutation" }), object({
-	deviceId: number(),
-	status: BatteryStatusSchema
-});
-object({
+var batteryCapability = {
+	name: "battery",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [
+		DeviceType.Camera,
+		DeviceType.Sensor,
+		DeviceType.Button,
+		DeviceType.Switch
+	],
+	methods: { 
+	/**
+	* Explicitly wake the camera from low-power sleep ahead of a
+	* streaming session start. Consumers that initiate a stream
+	* against a sleeping battery cam (HomeKit Secure Video, Alexa
+	* RTCSession, snapshot wrappers) call this with a short timeout
+	* before establishing the media pipeline — the broker's own
+	* passive wake-on-dial works but adds 5–7 seconds to first-frame,
+	* during which the consumer renders a black screen. Pre-waking
+	* compresses that gap.
+	*
+	* Returns `awoke: true` when the firmware acknowledged the wake
+	* before `timeoutMs`. Returns `awoke: false` when it timed out OR
+	* the cap surface is unavailable (no Baichuan / firmware
+	* channel); the caller should still attempt the stream — the
+	* passive broker wake remains as fallback.
+	*/
+wakeForStream: method(object({
+		deviceId: number(),
+		/** Bound on the wait. Sensible range 3000–10000ms. */
+		timeoutMs: number().int().min(500).max(3e4).default(8e3)
+	}), object({
+		awoke: boolean(),
+		durationMs: number()
+	}), { kind: "mutation" }) },
+	events: { 
+	/**
+	* Emitted whenever the cached status changes (firmware push OR
+	* poll observes a delta). The DeviceEventPropagator mirrors this
+	* event on the parent chain — subscribing to a camera's source
+	* receives battery events from child accessories automatically.
+	*/
+onStatusChanged: { data: object({
+		deviceId: number(),
+		status: BatteryStatusSchema
+	}) } },
+	status: {
+		schema: BatteryStatusSchema,
+		kind: "push",
+		empty: {
+			percentage: 0,
+			charging: "none",
+			sleeping: false,
+			lastUpdated: 0
+		}
+	},
+	/**
+	* Runtime-state slice — every provider that registers this cap
+	* stores the same shape under `device.runtimeState[battery]`.
+	* Cross-provider uniformity: a Reolink Argus, a Frigate sensor
+	* proxy, an ONVIF battery cam all read/write the same keys.
+	* Consumers (BatteryBadge, snapshot wrapper sleep gate) read once
+	* via `device.runtimeState.getCapState('battery')` regardless of
+	* the underlying driver.
+	*/
+	runtimeState: BatteryStatusSchema
+};
+/**
+* Generic boolean sensor — last-resort fallback when no domain-
+* specific binary cap fits (Home Assistant `binary_sensor` without a
+* known `device_class`, or a domain we haven't typed yet). Pure
+* pass-through: just the bool + timestamp. Push-driven.
+*
+* Prefer the typed alternatives (`contact`, `flood`, `smoke`,
+* `carbon-monoxide`, `gas`, `tamper`, `vibration`, `connectivity`,
+* `motion`) when the semantics match — export adapters render those
+* with the right HomeKit / Alexa display category.
+*/
+var BinaryStatusSchema = object({
 	on: boolean(),
 	/** Ms epoch of the last transition. 0 if never observed. */
 	lastChangedAt: number()
 });
-DeviceType.Sensor;
-object({
+var binaryCapability = {
+	name: "binary",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: BinaryStatusSchema,
+		kind: "push"
+	},
+	runtimeState: BinaryStatusSchema
+};
+/**
+* Dimmable-light brightness control. Co-exists with `switch` on the
+* same device — the switch toggles on/off, this cap sets the level
+* applied when the light is on. Drivers map their per-vendor dim
+* controls to this single-method surface.
+*
+* The cap is intentionally minimal: a single `setBrightness({deviceId,
+* percentage})` mutation plus the auto-injected `getStatus`. Drivers
+* that expose richer controls (color temperature, scenes, schedules)
+* should surface those via the device's `getSettingsUISchema()`
+* instead of bloating this cap.
+*/
+var BrightnessStatusSchema = object({
 	/** Current level as 0..100 inclusive. Firmware-reported. */
 	percentage: number().min(0).max(100),
 	/** Ms epoch of the last operator-driven change. Useful for UI freshness. */
 	lastChangedAt: number()
 });
-DeviceType.Light, method(object({
-	deviceId: number().int().nonnegative(),
-	percentage: number().min(0).max(100)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), object({
-	deviceId: number(),
-	percentage: number().min(0).max(100),
-	lastChangedAt: number()
-});
+var brightnessCapability = {
+	name: "brightness",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Light],
+	methods: { setBrightness: method(object({
+		deviceId: number().int().nonnegative(),
+		percentage: number().min(0).max(100)
+	}), _void(), {
+		kind: "mutation",
+		auth: "admin"
+	}) },
+	events: { 
+	/**
+	* Emitted whenever the brightness changes — operator action OR
+	* firmware push. Subscribers (UI sliders, automation engines) react
+	* without polling.
+	*/
+onBrightnessChanged: { data: object({
+		deviceId: number(),
+		percentage: number().min(0).max(100),
+		lastChangedAt: number()
+	}) } },
+	status: {
+		schema: BrightnessStatusSchema,
+		kind: "command-driven"
+	},
+	/**
+	* Runtime-state slice — the last applied brightness level, mirrored
+	* by the kernel. Read via `device.state.brightness.value` so UI
+	* sliders surface the current level without polling the provider.
+	*/
+	runtimeState: BrightnessStatusSchema
+};
 /** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
 var StreamFormatSchema = _enum([
 	"webrtc",
@@ -11105,44 +11838,155 @@ var PickedCamStreamSchema = object({
 	/** One-line explanation of why this stream won — for logs / debug UI. */
 	reason: string()
 });
-DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), array(CameraStreamSchema).readonly()), method(object({ deviceId: number().int().nonnegative() }), array(ProfileSlotSchema).readonly()), method(object({
-	deviceId: number().int().nonnegative(),
-	/** Override hostname embedded in returned URLs. Defaults to the broker's bound address. */
-	hostname: string().optional()
-}), array(RtspRestreamEntrySchema).readonly()), method(object({
-	deviceId: number().int().nonnegative(),
-	/** Override hostname embedded in returned URLs. Defaults to the broker's bound address. */
-	hostname: string().optional()
-}), array(ProfileRtspEntrySchema).readonly()), method(object({
-	deviceId: number().int().nonnegative(),
-	requirements: PickStreamRequirementsSchema,
-	preferences: PickStreamPreferencesSchema.optional()
-}), PickedCamStreamSchema.nullable()), object({
-	deviceId: number().int().nonnegative(),
-	camStreams: array(CameraStreamSchema).readonly()
-}), object({
-	deviceId: number().int().nonnegative(),
-	profileSlots: array(ProfileSlotSchema).readonly()
-}), object({
-	online: boolean(),
-	slotStatuses: object({
-		high: ProfileSlotStatusSchema.optional(),
-		mid: ProfileSlotStatusSchema.optional(),
-		low: ProfileSlotStatusSchema.optional()
-	}),
-	slotErrors: object({
-		high: string().optional(),
-		mid: string().optional(),
-		low: string().optional()
-	}),
-	lastChangedAt: number()
-});
-object({
+/**
+* Camera streams — device-scoped facade over the system `stream-broker`.
+*
+* Mirrors the slice of broker state relevant to a single device:
+*   - `getCameraStreams()`: the pool of physical streams published for
+*     this device. UI uses it to populate the "Camera Stream" dropdown
+*     under each quality section.
+*   - `getBrokerStreams()`: the (up to 3) profile slots `high/mid/low`
+*     with their current assignment + runtime status. UI uses it for
+*     the WebRTC quality picker, recording target selection, etc.
+*
+* Registered for every camera device that has at least one published
+* cam stream. The provider is owned by the stream-broker addon; reads
+* go against the broker's in-memory registries. Mutations (assign /
+* unassign / publish / retract) do NOT live here — they stay on the
+* system `stream-broker` cap so cross-device / addon-driven flows keep
+* a single namespace.
+*/
+var cameraStreamsCapability = {
+	name: "camera-streams",
+	scope: "device",
+	mode: "singleton",
+	kind: "wrapper",
+	defaultActive: true,
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		getCameraStreams: method(object({ deviceId: number().int().nonnegative() }), array(CameraStreamSchema).readonly()),
+		getBrokerStreams: method(object({ deviceId: number().int().nonnegative() }), array(ProfileSlotSchema).readonly()),
+		/**
+		* Per-device RAW RTSP restream entries — one per published camStream
+		* that has RTSP restream enabled (`native:main`, `rtsp:sub`, …).
+		*
+		* LIVE-VIEW ONLY. This is the surface the device-details stream
+		* picker uses so an operator can hit each physical stream directly.
+		* Programmatic / external consumers (HAP, Alexa, ha-mqtt, recording)
+		* MUST use `getProfileRtspEntries` instead — picking from raw
+		* variants makes two consumers of the same camera land on two
+		* different physical pulls (e.g. Reolink `native:main` vs
+		* `rtsp:main`) and trips the camera's concurrent-session limit.
+		*/
+		getRtspEntries: method(object({
+			deviceId: number().int().nonnegative(),
+			/** Override hostname embedded in returned URLs. Defaults to the broker's bound address. */
+			hostname: string().optional()
+		}), array(RtspRestreamEntrySchema).readonly()),
+		/**
+		* Per-device PROFILE RTSP restream entries — one per ASSIGNED
+		* profile slot (high/mid/low). Each entry's `url` is a profile-keyed
+		* broker restream that aliases the profile's assigned source broker,
+		* so HAP / Alexa / recording / WebRTC all converge on the broker's
+		* single on-demand pull for that profile. This is the supported
+		* exporter-facing surface; the raw `getRtspEntries` is live-view
+		* only. Returns `[]` for a device with no assigned profiles
+		* (cold-start before first publish).
+		*/
+		getProfileRtspEntries: method(object({
+			deviceId: number().int().nonnegative(),
+			/** Override hostname embedded in returned URLs. Defaults to the broker's bound address. */
+			hostname: string().optional()
+		}), array(ProfileRtspEntrySchema).readonly()),
+		/**
+		* "Best source stream for these decode constraints". Returns the
+		* camStreamId the caller should dial (or null when no stream
+		* matches). See `PickStreamRequirementsSchema` for the filter shape
+		* and `PickStreamPreferencesSchema` for the ranking inputs.
+		*
+		* Returning null instructs the caller to fall back to its existing
+		* path (derived-broker transcode, profile-slot pick, etc.) — the
+		* picker NEVER ranks `derived:*` candidates as a "match" because
+		* its whole job is to avoid the transcode.
+		*/
+		pickStream: method(object({
+			deviceId: number().int().nonnegative(),
+			requirements: PickStreamRequirementsSchema,
+			preferences: PickStreamPreferencesSchema.optional()
+		}), PickedCamStreamSchema.nullable())
+	},
+	events: {
+		/** Fires on publishCameraStream / retractCameraStream. */
+		onCamStreamsChanged: event(object({
+			deviceId: number().int().nonnegative(),
+			camStreams: array(CameraStreamSchema).readonly()
+		})),
+		/** Fires on assignProfile / unassignProfile / runtime status change. */
+		onProfileSlotsChanged: event(object({
+			deviceId: number().int().nonnegative(),
+			profileSlots: array(ProfileSlotSchema).readonly()
+		}))
+	},
+	/**
+	* Per-device live stream-broker state. Persistent settings (RTSP
+	* tokens, profile assignments, pre-buffer config, RTSP-enabled toggles,
+	* streamingDebug) stay in the broker's addon store — they survive
+	* restarts. The slice below carries ONLY what's truly runtime:
+	*
+	*   - `online` — at least one profile slot is currently `'streaming'`.
+	*     Drivers without a firmware liveness signal (RTSP, ONVIF…) can
+	*     subscribe and mirror this into `state.deviceStatus.online`.
+	*   - `slotStatuses` — current `ProfileSlotStatus` per profile,
+	*     mirroring the runtime-mutable subset of `ProfileSlot`.
+	*   - `slotErrors` — last error message per profile (only set when the
+	*     corresponding slot is in `'error'`).
+	*   - `lastChangedAt` — freshness signal for consumers that want to
+	*     reason about how stale the slice is.
+	*
+	* Written by the stream-broker manager on every transition that
+	* affects these aggregates. Read via `device.state.cameraStreams.<field>`
+	* (BaseDevice proxy) or, cross-process, via
+	* `device-state.getCapSlice({deviceId, capName: 'camera-streams'})`.
+	* The cap's `onChanged` event fires automatically on each write so
+	* subscribers get push semantics for free.
+	*/
+	runtimeState: object({
+		online: boolean(),
+		slotStatuses: object({
+			high: ProfileSlotStatusSchema.optional(),
+			mid: ProfileSlotStatusSchema.optional(),
+			low: ProfileSlotStatusSchema.optional()
+		}),
+		slotErrors: object({
+			high: string().optional(),
+			mid: string().optional(),
+			low: string().optional()
+		}),
+		lastChangedAt: number()
+	})
+};
+/**
+* Carbon-monoxide alarm sensor. Drives Home Assistant `binary_sensor`
+* entries with `device_class: carbon_monoxide`. Push-driven.
+*/
+var CarbonMonoxideStatusSchema = object({
 	detected: boolean(),
 	/** Ms epoch of the last transition. 0 if never observed. */
 	lastChangedAt: number()
 });
-DeviceType.Sensor;
+var carbonMonoxideCapability = {
+	name: "carbon-monoxide",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: CarbonMonoxideStatusSchema,
+		kind: "push"
+	},
+	runtimeState: CarbonMonoxideStatusSchema
+};
 /**
 * HVAC / climate control cap. Models the full surface of a HA
 * `climate.*` entity (thermostat, A/C, heat pump, dehumidifier)
@@ -11183,7 +12027,7 @@ var HvacModeSchema = _enum([
 	"fan_only",
 	"dry"
 ]);
-object({
+var ClimateControlStatusSchema = object({
 	/** Active HVAC mode. */
 	mode: HvacModeSchema,
 	/** Available HVAC modes the device accepts. Subset of HvacMode. */
@@ -11227,56 +12071,82 @@ object({
 	/** Ms epoch when the slice was last updated (push or command). */
 	lastFetchedAt: number()
 });
-DeviceType.Thermostat, DeviceType.Climate, method(object({
-	deviceId: number().int().nonnegative(),
-	mode: HvacModeSchema
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	fanMode: string().min(1)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	preset: string().min(1)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	target: number()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	targetLow: number(),
-	targetHigh: number()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	targetHumidity: number().min(0).max(100)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	on: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	on: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
+var climateControlCapability = {
+	name: "climate-control",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Thermostat, DeviceType.Climate],
+	methods: {
+		setMode: method(object({
+			deviceId: number().int().nonnegative(),
+			mode: HvacModeSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setFanMode: method(object({
+			deviceId: number().int().nonnegative(),
+			fanMode: string().min(1)
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setPreset: method(object({
+			deviceId: number().int().nonnegative(),
+			preset: string().min(1)
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setTarget: method(object({
+			deviceId: number().int().nonnegative(),
+			target: number()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setTargetRange: method(object({
+			deviceId: number().int().nonnegative(),
+			targetLow: number(),
+			targetHigh: number()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setTargetHumidity: method(object({
+			deviceId: number().int().nonnegative(),
+			targetHumidity: number().min(0).max(100)
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setSwingVertical: method(object({
+			deviceId: number().int().nonnegative(),
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setSwingHorizontal: method(object({
+			deviceId: number().int().nonnegative(),
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: ClimateControlStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI thermostats read
+	* the full slice via `device.state.climate-control.value` and refresh
+	* on every push without re-querying the provider.
+	*/
+	runtimeState: ClimateControlStatusSchema
+};
 /**
 * Color-light cap. Coexists with `switch` (on/off) and `brightness`
 * (level) on the same device — `switch` toggles the bulb, `brightness`
@@ -11328,7 +12198,7 @@ var ColorInputSchema = discriminatedUnion("mode", [
 		mireds: number().int().min(50).max(1e3)
 	})
 ]);
-object({
+var ColorStatusSchema = object({
 	/** Active color mode — which of `rgb` / `hsv` / `mireds` reflects
 	*  the bulb's current state. */
 	mode: _enum([
@@ -11345,63 +12215,209 @@ object({
 	/** Ms epoch of the last operator-driven change. */
 	lastChangedAt: number()
 });
-DeviceType.Light, method(object({
-	deviceId: number().int().nonnegative(),
-	color: ColorInputSchema
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), object({
-	deviceId: number(),
-	mode: _enum([
-		"rgb",
-		"hsv",
-		"mired"
-	]),
-	rgb: RgbTripletSchema.optional(),
-	hsv: HsvTripletSchema.optional(),
-	mireds: number().int().optional(),
-	lastChangedAt: number()
-});
-object({
+var colorCapability = {
+	name: "color",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Light],
+	methods: { setColor: method(object({
+		deviceId: number().int().nonnegative(),
+		color: ColorInputSchema
+	}), _void(), {
+		kind: "mutation",
+		auth: "admin"
+	}) },
+	events: { 
+	/**
+	* Emitted whenever the color changes — operator action OR firmware
+	* push. Subscribers (UI color pickers, automation engines) react
+	* without polling.
+	*/
+onColorChanged: { data: object({
+		deviceId: number(),
+		mode: _enum([
+			"rgb",
+			"hsv",
+			"mired"
+		]),
+		rgb: RgbTripletSchema.optional(),
+		hsv: HsvTripletSchema.optional(),
+		mireds: number().int().optional(),
+		lastChangedAt: number()
+	}) } },
+	status: {
+		schema: ColorStatusSchema,
+		kind: "command-driven"
+	},
+	/**
+	* Runtime-state slice — the last applied color, mirrored by the
+	* kernel. Read via `device.state.color.value` so UI pickers surface
+	* the current chromaticity without polling the provider.
+	*/
+	runtimeState: ColorStatusSchema
+};
+/**
+* Upstream-system connectivity sensor — distinct from `device-status`,
+* which is the kernel-managed online/offline flag for the device's
+* own transport. This cap surfaces an external entity's view of
+* whether the device is reachable (typical use: HA's
+* `binary_sensor` with `device_class: connectivity` for a remote
+* gateway or bridge). Push-driven.
+*/
+var ConnectivityStatusSchema = object({
 	/** True when the upstream system considers the entity connected. */
 	connected: boolean(),
 	/** Ms epoch of the last transition. 0 if never observed. */
 	lastChangedAt: number()
 });
-DeviceType.Sensor;
+var connectivityCapability = {
+	name: "connectivity",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: ConnectivityStatusSchema,
+		kind: "push"
+	},
+	runtimeState: ConnectivityStatusSchema
+};
+/**
+* Generic device-consumables capability — surfaces a device's
+* maintenance items (vacuum filters/brushes, replaceable cartridges,
+* descaling cycles, …) with their remaining life and an optional
+* "Replaced" reset action. Device-agnostic: any provider that knows its
+* device tracks consumables can register it; the cap declares no
+* vocabulary of its own — the provider names each item verbatim.
+*
+* Like `childLayout`, the cap is INERT until a provider sets items: no
+* provider populates it by guessing (no HA inference). The UI renders a
+* "No consumables reported" placeholder when `items` is empty.
+*/
+/** A single consumable item. Either a continuous `level` (remaining
+*  life %) or a discrete `status` may be known — both may be null when a
+*  provider only knows the item exists. `level` and `status` are not
+*  mutually exclusive; a provider may report both. */
+var ConsumableItemSchema = object({
+	/** Stable id, e.g. 'main-brush'. */
+	key: string().min(1),
+	/** Display name. */
+	label: string().min(1),
+	/** Remaining life % when known (0..100). */
+	level: number().min(0).max(100).nullable(),
+	/** Discrete state when known (binary mode). */
+	status: _enum(["ok", "replace"]).nullable(),
+	/** Ms epoch of the last replace, when known. */
+	lastResetAt: number().nullable(),
+	/** Whether `reset()` is meaningful for this item. */
+	resettable: boolean()
+});
 var ConsumablesStatusSchema = object({
-	items: array(object({
-		/** Stable id, e.g. 'main-brush'. */
-		key: string().min(1),
-		/** Display name. */
-		label: string().min(1),
-		/** Remaining life % when known (0..100). */
-		level: number().min(0).max(100).nullable(),
-		/** Discrete state when known (binary mode). */
-		status: _enum(["ok", "replace"]).nullable(),
-		/** Ms epoch of the last replace, when known. */
-		lastResetAt: number().nullable(),
-		/** Whether `reset()` is meaningful for this item. */
-		resettable: boolean()
-	})),
+	items: array(ConsumableItemSchema),
 	lastChangedAt: number()
 });
-Object.values(DeviceType), method(object({
-	deviceId: number().int().nonnegative(),
-	key: string().min(1)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), ConsumablesStatusSchema.extend({ lastFetchedAt: number() });
-object({
+var consumablesCapability = {
+	name: "consumables",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: Object.values(DeviceType),
+	deviceConfig: { ui: {
+		kind: "widget",
+		widgetId: "host/consumables-panel",
+		tab: "consumables",
+		topTab: true,
+		label: "Consumables",
+		order: 5
+	} },
+	methods: { 
+	/** Mark a consumable as replaced — resets its remaining life. Only
+	*  meaningful when the item's `resettable` is true. */
+reset: method(object({
+		deviceId: number().int().nonnegative(),
+		key: string().min(1)
+	}), _void(), {
+		kind: "mutation",
+		auth: "admin"
+	}) },
+	status: {
+		schema: ConsumablesStatusSchema,
+		kind: "push",
+		empty: {
+			items: [],
+			lastChangedAt: 0
+		},
+		itemArray: {
+			path: "items",
+			keyField: "key",
+			labelField: "label",
+			itemSchema: ConsumableItemSchema,
+			emptyItem: {
+				key: "",
+				label: "",
+				level: null,
+				status: null,
+				lastResetAt: null,
+				resettable: false
+			}
+		}
+	},
+	runtimeState: ConsumablesStatusSchema.extend({ lastFetchedAt: number() })
+};
+/**
+* Door / window / opening / garage / valve contact sensor. Boolean
+* "is the entry currently open" with the timestamp of the last
+* transition. Drives Home Assistant `binary_sensor` entries whose
+* `device_class` is `door`, `window`, `opening`, `garage`, or
+* `garage_door` — and any future native integration that needs
+* the same semantics.
+*
+* Push-driven: providers update the slice on transition events from
+* the upstream source (HA WebSocket `state_changed`, ZWave
+* `notification` …). Consumers read the slice; no polling.
+*/
+var ContactStatusSchema = object({
 	/** True when the entry is open; false when closed. */
 	entryOpen: boolean(),
 	/** Ms epoch of the last open↔closed transition. 0 if never observed. */
 	lastChangedAt: number()
 });
-DeviceType.Sensor;
-object({
+var contactCapability = {
+	name: "contact",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: ContactStatusSchema,
+		kind: "push"
+	},
+	runtimeState: ContactStatusSchema
+};
+/**
+* Status slice — flat object (the framework's `runtimeState` contract
+* requires a `ZodObject`, not a discriminated union). The `kind`
+* field discriminates the value type at the type level via the
+* `ControlNumericValue` / `ControlStringValue` aliases; consumers
+* narrow with a kind check.
+*
+* The `value` field is typed as `number | string`:
+*   - `kind === 'numeric'` → `value` is `number`
+*   - `kind === 'select' | 'text' | 'datetime'` → `value` is `string`
+*
+* The `options` array is populated only when `kind === 'select'`
+* (empty array for the other kinds). It lives in the slice because
+* HA `select.*` entities may update their options at runtime.
+*
+* The `unit`/`min`/`max`/`step` fields are meaningful for
+* `kind === 'numeric'` and are absent (undefined) for all other
+* kinds. They are populated live from HA attributes on each state
+* push — consistent with `options` and the sensor-unit approach.
+*/
+var ControlStatusSchema = object({
 	kind: _enum([
 		"numeric",
 		"select",
@@ -11463,14 +12479,31 @@ var ControlSetValueInputSchema = discriminatedUnion("kind", [
 		value: string().min(1)
 	})
 ]);
-DeviceType.Control, method(object({
-	deviceId: number().int().nonnegative(),
-	control: ControlSetValueInputSchema
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-object({
+var controlCapability = {
+	name: "control",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Control],
+	methods: { setValue: method(object({
+		deviceId: number().int().nonnegative(),
+		control: ControlSetValueInputSchema
+	}), _void(), {
+		kind: "mutation",
+		auth: "admin"
+	}) },
+	status: {
+		schema: ControlStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI widgets (slider /
+	* dropdown / text field / date picker) read the slice's discriminant
+	* and value directly without polling the provider.
+	*/
+	runtimeState: ControlStatusSchema
+};
+var CoverStatusSchema = object({
 	/** Lifecycle state of the cover. */
 	state: _enum([
 		"open",
@@ -11487,28 +12520,50 @@ object({
 	/** Ms epoch when the slice was last updated. */
 	lastChangedAt: number()
 });
-DeviceType.Cover, method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	position: number().min(0).max(100)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	tiltPosition: number().min(0).max(100)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
+var coverCapability = {
+	name: "cover",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Cover],
+	methods: {
+		open: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		close: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		stop: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setPosition: method(object({
+			deviceId: number().int().nonnegative(),
+			position: number().min(0).max(100)
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setTiltPosition: method(object({
+			deviceId: number().int().nonnegative(),
+			tiltPosition: number().min(0).max(100)
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: CoverStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI controls watch
+	* the slice for live position changes during a move.
+	*/
+	runtimeState: CoverStatusSchema
+};
 /**
 * Vendor-neutral day/night (IR-cut) control — the per-camera config cap
 * shared by reolink / hikvision / amcrest. Models the common firmware
@@ -11538,7 +12593,12 @@ var NormalizedRangeSchema$1 = object({
 	max: number(),
 	step: number()
 });
-object({
+/**
+* Current day/night state. Optional fields are absent when the camera
+* does not expose that knob (a photocell-less model reports no
+* `sensitivity`). `lastFetchedAt` feeds the runtime-state bridge.
+*/
+var DayNightStatusSchema = object({
 	mode: DayNightModeSchema,
 	/** IR-cut trigger sensitivity, NORMALIZED 0–100 (higher = switches to night sooner). */
 	sensitivity: number().optional(),
@@ -11571,13 +12631,33 @@ var DayNightSettingsPatchSchema = object({
 	sensitivity: number().optional(),
 	switchDelaySec: number().optional()
 });
-DeviceType.Camera, method(object({ deviceId: number() }), DayNightOptionsSchema), method(object({
-	deviceId: number(),
-	settings: DayNightSettingsPatchSchema
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
+var dayNightCapability = {
+	name: "day-night",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	deviceConfig: { ui: {
+		kind: "derived-form",
+		builderId: "day-night",
+		tab: "image"
+	} },
+	methods: {
+		getOptions: method(object({ deviceId: number() }), DayNightOptionsSchema),
+		setSettings: method(object({
+			deviceId: number(),
+			settings: DayNightSettingsPatchSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: DayNightStatusSchema,
+		kind: "poll"
+	},
+	runtimeState: DayNightStatusSchema
+};
 /**
 * Identity envelope for a device's upstream-system metadata.
 *
@@ -11621,6 +12701,66 @@ var SourceInfoSchema = object({
 	raw: record(string(), unknown()).optional()
 });
 /**
+* Build the synthetic SourceInfo every existing provider falls back to
+* when no upstream value has been persisted. Keeps non-migrated providers
+* (Reolink / Hikvision / ONVIF / Frigate / RTSP) functional without code
+* changes — `id` reuses the CamStack stableId, `system` reuses the addon
+* id. Real upstream identity replaces this once a provider migrates and
+* calls `updateSourceInfo()` with concrete values.
+*/
+function synthesizeSourceInfo(input) {
+	return {
+		id: input.stableId,
+		system: input.addonId
+	};
+}
+/**
+* Shallow-merge a partial patch over a prior SourceInfo. `undefined`
+* patch values are ignored (no field clobber); to clear a field
+* explicitly, providers omit it from the patch and rebuild from scratch
+* via `updateSourceInfo({})` cycles — uncommon enough that we don't
+* bother with a `null`-means-delete sentinel.
+*
+* The `raw` field is also shallow-merged: passing `raw: { foo: 1 }`
+* merges over existing `raw` keys instead of replacing the whole bag.
+*/
+function mergeSourceInfo(prev, patch) {
+	const next = { ...prev };
+	for (const [k, v] of Object.entries(patch)) {
+		if (v === void 0) continue;
+		if (k === "raw" && typeof v === "object" && v !== null) {
+			next.raw = {
+				...prev.raw,
+				...v
+			};
+			continue;
+		}
+		next[k] = v;
+	}
+	return next;
+}
+/**
+* Key under which `SourceInfo` lives inside `DeviceMeta.metadata`. The
+* blob is a free-form `Record<string, unknown>` shared with hardware-
+* identity fields (`manufacturer`, `model`, `firmware`, …); SourceInfo
+* lives under a single nested key to keep it composable with those.
+*/
+var SOURCE_INFO_METADATA_KEY = "sourceInfo";
+/**
+* Extract a SourceInfo from a `DeviceMeta.metadata` blob, validating
+* with Zod. Returns `null` when the blob is missing or the nested
+* `sourceInfo` key fails validation — callers fall back to the
+* synthetic default in that case (see `synthesizeSourceInfo`).
+*/
+function extractSourceInfoFromMetadata(metadata) {
+	if (!metadata) return null;
+	const raw = metadata[SOURCE_INFO_METADATA_KEY];
+	if (!raw) return null;
+	const parsed = SourceInfoSchema.safeParse(raw);
+	if (!parsed.success) return null;
+	return parsed.data;
+}
+/**
 * device-discovery — device-scoped capability for parents that host /
 * enumerate child devices (Reolink Hub / NVR, ONVIF gateway, future
 * integrations). The parent advertises a list of discoverable children,
@@ -11707,38 +12847,129 @@ var DeviceDiscoveryStatusSchema = object({
 	/** Last error surfaced from the source (rendered as a banner). */
 	lastError: string().nullable()
 });
-DeviceType.Hub, DeviceDiscoveryStatusSchema.extend({ lastFetchedAt: number().int().nonnegative() }), method(object({ deviceId: number().int().nonnegative() }), array(DiscoveredChildDeviceSchema).readonly()), method(object({ deviceId: number().int().nonnegative() }), array(DiscoveredChildDeviceSchema).readonly(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	childNativeId: string(),
-	/** Optional override for the child's display name. */
-	name: string().optional()
-}), object({
-	deviceId: number().int().nonnegative(),
-	stableId: string()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	childDeviceId: number().int().nonnegative()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-object({
+var deviceDiscoveryCapability = {
+	name: "device-discovery",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Hub],
+	status: {
+		schema: DeviceDiscoveryStatusSchema,
+		kind: "poll"
+	},
+	runtimeState: DeviceDiscoveryStatusSchema.extend({ lastFetchedAt: number().int().nonnegative() }),
+	methods: {
+		/**
+		* Snapshot of the current `discovered` list. Returns the
+		* runtime-state cache — call `refreshDiscovery` first if a
+		* fresh round-trip to the source is required.
+		*/
+		listDiscovered: method(object({ deviceId: number().int().nonnegative() }), array(DiscoveredChildDeviceSchema).readonly()),
+		/**
+		* Force the integration to re-enumerate and update the
+		* runtime-state slice. Returns the freshly-enumerated list (also
+		* available via `listDiscovered` post-call).
+		*/
+		refreshDiscovery: method(object({ deviceId: number().int().nonnegative() }), array(DiscoveredChildDeviceSchema).readonly(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Promote a discovered entry to a real child device. The framework
+		* creates the child via `kernel.devices.create()` with
+		* `parentDeviceId = parent.id` and seeds the child's config from
+		* `childInitialConfig` (driver-defined; usually carries channel +
+		* uid + parent reference). Returns the kernel-assigned numeric id.
+		*/
+		adoptDevice: method(object({
+			deviceId: number().int().nonnegative(),
+			childNativeId: string(),
+			/** Optional override for the child's display name. */
+			name: string().optional()
+		}), object({
+			deviceId: number().int().nonnegative(),
+			stableId: string()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Inverse of `adoptDevice`: removes the child device from the
+		* kernel registry. The discovered entry remains in the
+		* enumeration (status updates resume) so the operator can re-adopt
+		* it later without a fresh refresh.
+		*/
+		releaseDevice: method(object({
+			deviceId: number().int().nonnegative(),
+			childDeviceId: number().int().nonnegative()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
+* Doorbell button cap. Two kinds of providers coexist behind this cap
+* name (same pattern as `snapshot`):
+*
+*   - **Native** providers: registered per-device by device-driver
+*     addons via `ctx.registerNativeCap` — either on a
+*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
+*     or directly on the camera (Reolink registers at camera level).
+*     Emits an `onPressed` event every time the firmware pushes a
+*     ring; status tracks the last press and a pressCount since start
+*     (diagnostic).
+*
+*   - **Wrapper** provider: the `virtual-doorbell` system builtin
+*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
+*     device (contact / switch / event-emitter …) into a doorbell for
+*     a camera. `defaultActive: false` — the operator explicitly binds
+*     it per camera in the device-bindings UI, then picks the source
+*     device + trigger in the per-device settings.
+*
+* The DeviceEventPropagator re-emits `onPressed` on the camera parent
+* — subscribers listening at the camera level receive ring events
+* with `via[]` populated. No code on the parent needed.
+*/
+var DoorbellStatusSchema = object({
 	/** Ms epoch of the last press. null = never observed since this provider started. */
 	lastPressedAt: number().nullable(),
 	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
 	pressCountSinceStart: number()
 });
-object({
+var DoorbellPressEventSchema = object({
 	deviceId: number(),
 	timestamp: number()
 });
-DeviceType.Button, DeviceType.Camera;
+var doorbellCapability = {
+	name: "doorbell",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	kind: "wrapper",
+	defaultActive: false,
+	deviceTypes: [DeviceType.Button, DeviceType.Camera],
+	exposesDeviceSettings: true,
+	methods: {},
+	events: { 
+	/**
+	* Fires once per physical press. Reolink delivers via Baichuan
+	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
+	* release/duration — it's a pulse.
+	*/
+onPressed: { data: DoorbellPressEventSchema } },
+	status: {
+		schema: DoorbellStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — last press timestamp + lifetime press count.
+	* Mirrored by the kernel and readable via
+	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
+	* without subscribing.
+	*/
+	runtimeState: DoorbellStatusSchema
+};
 /**
 * Enum-state sensor — a string value picked from a finite option set.
 * Drives HA `sensor` entries with `state_class: enum` (HVAC action
@@ -11754,7 +12985,7 @@ var EnumSensorDateTimeFormatSchema = _enum([
 	"time",
 	"datetime"
 ]);
-object({
+var EnumSensorStatusSchema = object({
 	value: string(),
 	/**
 	* Set for `DateTimeSensor`-role sensors so the UI renders the ISO `value`
@@ -11766,7 +12997,19 @@ object({
 	/** Ms epoch when the slice was last updated. */
 	lastFetchedAt: number()
 });
-DeviceType.Sensor;
+var enumSensorCapability = {
+	name: "enum-sensor",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: EnumSensorStatusSchema,
+		kind: "push"
+	},
+	runtimeState: EnumSensorStatusSchema
+};
 /**
 * Generic stateless event emitter. Installed on a `DeviceType.EventEmitter`
 * device. Carries the device's EXACT declared event vocabulary verbatim
@@ -11784,12 +13027,25 @@ var EventFireSchema = object({
 	timestamp: number(),
 	seq: number()
 });
-object({
+var EventEmitterStatusSchema = object({
 	eventTypes: array(string()),
 	lastEvent: EventFireSchema.nullable(),
 	eventCountSinceStart: number()
 });
-DeviceType.EventEmitter;
+var eventEmitterCapability = {
+	name: "event-emitter",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.EventEmitter],
+	methods: {},
+	events: { onEvent: { data: EventFireSchema } },
+	status: {
+		schema: EventEmitterStatusSchema,
+		kind: "push"
+	},
+	runtimeState: EventEmitterStatusSchema
+};
 /**
 * Fan-control cap. Models HA `fan.*` entity-specific surfaces:
 * speed percentage, preset modes, ceiling-fan direction, and
@@ -11809,7 +13065,7 @@ DeviceType.EventEmitter;
 *   - `FanOscillating` — oscillation toggle
 */
 var FanDirectionSchema = _enum(["forward", "reverse"]);
-object({
+var FanControlStatusSchema = object({
 	/** Active speed as 0..100 inclusive. Null when the device has no
 	*  speed surface (single-speed fan). */
 	percentage: number().min(0).max(100).nullable(),
@@ -11830,45 +13086,118 @@ object({
 	/** Ms epoch when the slice was last updated. */
 	lastChangedAt: number()
 });
-DeviceType.Fan, method(object({
-	deviceId: number().int().nonnegative(),
-	percentage: number().min(0).max(100)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	preset: string().min(1)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	direction: FanDirectionSchema
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	oscillating: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-object({
+var fanControlCapability = {
+	name: "fan-control",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Fan],
+	methods: {
+		setPercentage: method(object({
+			deviceId: number().int().nonnegative(),
+			percentage: number().min(0).max(100)
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setPreset: method(object({
+			deviceId: number().int().nonnegative(),
+			preset: string().min(1)
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setDirection: method(object({
+			deviceId: number().int().nonnegative(),
+			direction: FanDirectionSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setOscillating: method(object({
+			deviceId: number().int().nonnegative(),
+			oscillating: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: FanControlStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI fan speed
+	* sliders read `percentage` for live updates.
+	*/
+	runtimeState: FanControlStatusSchema
+};
+/**
+* Water leak / moisture sensor. Boolean "is liquid currently
+* detected" with the timestamp of the last transition. Drives Home
+* Assistant `binary_sensor` entries with `device_class: moisture`,
+* and any future native flood sensor.
+*
+* Push-driven from the upstream source.
+*/
+var FloodStatusSchema = object({
 	/** True when leak is currently detected. */
 	flooded: boolean(),
 	/** Ms epoch of the last flooded↔dry transition. 0 if never observed. */
 	lastChangedAt: number()
 });
-DeviceType.Sensor;
-object({
+var floodCapability = {
+	name: "flood",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: FloodStatusSchema,
+		kind: "push"
+	},
+	runtimeState: FloodStatusSchema
+};
+/**
+* Combustible-gas (LPG / methane / hydrogen) alarm sensor. Drives
+* Home Assistant `binary_sensor` entries with `device_class: gas`.
+* Push-driven.
+*/
+var GasStatusSchema = object({
 	detected: boolean(),
 	/** Ms epoch of the last transition. 0 if never observed. */
 	lastChangedAt: number()
 });
-DeviceType.Sensor;
-object({
+var gasCapability = {
+	name: "gas",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: GasStatusSchema,
+		kind: "push"
+	},
+	runtimeState: GasStatusSchema
+};
+/**
+* Humidifier / dehumidifier cap. Models HA `humidifier.*` entities —
+* an on/off actuator with an optional target-humidity setpoint and an
+* optional vendor mode (`auto` / `normal` / `baby` / …).
+*
+* A climate-family sibling: the slice carries the on/off state, the
+* current + target relative humidity (0..100), the active mode and its
+* available set, plus HA's free-form `action` readout
+* (`humidifying` / `drying` / `idle` / `off`). `minHumidity` /
+* `maxHumidity` mirror HA's `min_humidity` / `max_humidity` attributes
+* (null → the UI falls back to a 0..100 range).
+*
+* Providers populate only what the hardware reports — `mode` and the
+* humidity fields stay null when the device has no such surface.
+*/
+var HumidifierStatusSchema = object({
 	/** Whether the humidifier is currently on. */
 	on: boolean(),
 	/** Current measured relative humidity (0..100). Null when not reported. */
@@ -11890,26 +13219,54 @@ object({
 	/** Ms epoch when the slice was last updated. */
 	lastChangedAt: number()
 });
-DeviceType.Humidifier, method(object({
-	deviceId: number().int().nonnegative(),
-	on: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	humidity: number().min(0).max(100)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	mode: string().min(1)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-object({
+var humidifierCapability = {
+	name: "humidifier",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Humidifier],
+	methods: {
+		setOn: method(object({
+			deviceId: number().int().nonnegative(),
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setTargetHumidity: method(object({
+			deviceId: number().int().nonnegative(),
+			humidity: number().min(0).max(100)
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setMode: method(object({
+			deviceId: number().int().nonnegative(),
+			mode: string().min(1)
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: HumidifierStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI controls watch the
+	* slice for live humidity / mode changes.
+	*/
+	runtimeState: HumidifierStatusSchema
+};
+/**
+* Single-metric humidity reading. Drives Home Assistant `sensor`
+* entries with `device_class: humidity`.
+*
+* Unit normalisation: percent. The canonical display unit (`%`) is a
+* descriptor constant in the UI (ROLE_DESCRIPTOR), not stored in
+* `sourceInfo`.
+*/
+var HumiditySensorStatusSchema = object({
 	/** Current relative humidity, 0..100. */
 	percent: number().min(0).max(100),
 	/** Ms epoch when the slice was last updated. */
@@ -11924,15 +13281,57 @@ object({
 	*  auto-formatting when absent. */
 	precision: number().int().min(0).max(10).optional()
 });
-DeviceType.Sensor, DeviceType.Thermostat;
-object({
+var humiditySensorCapability = {
+	name: "humidity-sensor",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor, DeviceType.Thermostat],
+	methods: {},
+	status: {
+		schema: HumiditySensorStatusSchema,
+		kind: "push"
+	},
+	runtimeState: HumiditySensorStatusSchema
+};
+/**
+* Image display cap. Models a single still image exposed by an integration —
+* a snapshot, a chart, a generated picture, or a robot's cleaning-map render.
+*
+* Read-only: there are no setters. The provider resolves whatever upstream
+* source it has into an ABSOLUTE URL the browser loads directly:
+*   - HA `image.*` entities → the `entity_picture` signed-token path
+*     (token stays in the query string, so no auth header is needed);
+*   - a Dreame/robot map → the cloud/OSS map-image URL (or an addon
+*     data-plane URL serving the rendered map bytes), exposed as its own
+*     Image child device grouped under the robot's container.
+* The slice carries that URL plus the upstream last-updated timestamp; the
+* image changes when the source's last-updated marker changes.
+*/
+var ImageStatusSchema = object({
 	/** Absolute signed URL the browser loads directly. Null when the
 	*  entity exposes no `entity_picture` (yet). */
 	url: string().nullable(),
 	/** Ms epoch of the upstream last-updated timestamp. Null at cold-start. */
 	lastUpdated: number().nullable()
 });
-DeviceType.Image;
+var imageCapability = {
+	name: "image",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Image],
+	methods: {},
+	status: {
+		schema: ImageStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. The UI reads `url`
+	* directly and renders the still image.
+	*/
+	runtimeState: ImageStatusSchema
+};
 /**
 * Vendor-neutral image / picture-adjustment cap — the per-camera config
 * cap shared by reolink / hikvision / amcrest. Models the common ISP
@@ -11984,7 +13383,12 @@ var NormalizedRangeSchema = object({
 	max: number(),
 	step: number()
 });
-object({
+/**
+* Current image-adjustment state. Every field optional — absent when the
+* camera does not expose that control. Slider values are NORMALIZED 0–100.
+* `lastFetchedAt` feeds the runtime-state bridge.
+*/
+var ImageSettingsStatusSchema = object({
 	/** Normalized 0–100. */
 	brightness: number().optional(),
 	/** Normalized 0–100. */
@@ -12050,13 +13454,33 @@ var ImageSettingsPatchSchema = object({
 	exposureMode: ExposureModeSchema.optional(),
 	backlightMode: BacklightModeSchema.optional()
 });
-DeviceType.Camera, method(object({ deviceId: number() }), ImageSettingsOptionsSchema), method(object({
-	deviceId: number(),
-	settings: ImageSettingsPatchSchema
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
+var imageSettingsCapability = {
+	name: "image-settings",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	deviceConfig: { ui: {
+		kind: "derived-form",
+		builderId: "image-settings",
+		tab: "image"
+	} },
+	methods: {
+		getOptions: method(object({ deviceId: number() }), ImageSettingsOptionsSchema),
+		setSettings: method(object({
+			deviceId: number(),
+			settings: ImageSettingsPatchSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: ImageSettingsStatusSchema,
+		kind: "poll"
+	},
+	runtimeState: ImageSettingsStatusSchema
+};
 /**
 * Robotic lawn-mower cap. Models HA `lawn_mower.*` entities — anything
 * with a mowing lifecycle plus a dock action.
@@ -12081,7 +13505,7 @@ var DeviceCodeSeveritySchema = _enum([
 	"warning",
 	"error"
 ]);
-object({
+var LawnMowerControlStatusSchema = object({
 	/** Lifecycle activity of the mower. */
 	activity: LawnMowerActivitySchema,
 	/** 0..100 battery percentage. Null when the device has no battery
@@ -12101,17 +13525,37 @@ object({
 	/** Ms epoch when the slice was last updated. */
 	lastChangedAt: number()
 });
-DeviceType.LawnMower, method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-object({
+var lawnMowerControlCapability = {
+	name: "lawn-mower-control",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.LawnMower],
+	methods: {
+		startMowing: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		pause: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		dock: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: LawnMowerControlStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI controls watch the
+	* slice for live activity + battery changes.
+	*/
+	runtimeState: LawnMowerControlStatusSchema
+};
+var LockControlStatusSchema = object({
 	/** Lifecycle state of the lock. `jammed` means the motor reported
 	*  failure to reach the target — operator intervention required. */
 	state: _enum([
@@ -12124,24 +13568,45 @@ object({
 	/** Ms epoch when the slice was last updated. */
 	lastChangedAt: number()
 });
-DeviceType.Lock, method(object({
-	deviceId: number().int().nonnegative(),
-	/** Optional PIN code required by some keypad locks. NOT
-	*  persisted — passed directly to the upstream service. */
-	code: string().min(1).optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	code: string().min(1).optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
+var lockControlCapability = {
+	name: "lock-control",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Lock],
+	methods: {
+		lock: method(object({
+			deviceId: number().int().nonnegative(),
+			/** Optional PIN code required by some keypad locks. NOT
+			*  persisted — passed directly to the upstream service. */
+			code: string().min(1).optional()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		unlock: method(object({
+			deviceId: number().int().nonnegative(),
+			code: string().min(1).optional()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		open: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: LockControlStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI lock buttons
+	* read `state` and disable themselves during `locking`/`unlocking`
+	* transitions.
+	*/
+	runtimeState: LockControlStatusSchema
+};
 /**
 * Media-player cap. Models HA `media_player.*` (Sonos, Chromecast,
 * Apple TV, Spotify, Roku, generic OTT receivers, …) on
@@ -12181,7 +13646,7 @@ var MediaInfoSchema = object({
 	/** Optional cover-art / thumbnail URL. */
 	imageUrl: string().optional()
 });
-object({
+var MediaPlayerStatusSchema = object({
 	/** Playback lifecycle state. */
 	state: MediaPlayerStateSchema,
 	/** Volume as 0..100 inclusive. Null when the device has no volume
@@ -12212,68 +13677,98 @@ object({
 	/** Ms epoch when the slice was last updated. */
 	lastChangedAt: number()
 });
-DeviceType.MediaPlayer, method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	positionMs: number().int().nonnegative()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	volumeLevel: number().min(0).max(100)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	muted: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	shuffle: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	repeat: MediaPlayerRepeatSchema
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	source: string().min(1)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	/** Media identifier / URL. */
-	mediaId: string().min(1),
-	/** Media kind (`music`, `tvshow`, `movie`, `app`, …) — provider
-	*  passes it through to the upstream service. */
-	mediaType: string().min(1)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
+var mediaPlayerCapability = {
+	name: "media-player",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.MediaPlayer],
+	methods: {
+		play: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		pause: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		stop: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		next: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		previous: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		seek: method(object({
+			deviceId: number().int().nonnegative(),
+			positionMs: number().int().nonnegative()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setVolume: method(object({
+			deviceId: number().int().nonnegative(),
+			volumeLevel: number().min(0).max(100)
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setMute: method(object({
+			deviceId: number().int().nonnegative(),
+			muted: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setShuffle: method(object({
+			deviceId: number().int().nonnegative(),
+			shuffle: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setRepeat: method(object({
+			deviceId: number().int().nonnegative(),
+			repeat: MediaPlayerRepeatSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		selectSource: method(object({
+			deviceId: number().int().nonnegative(),
+			source: string().min(1)
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		playMedia: method(object({
+			deviceId: number().int().nonnegative(),
+			/** Media identifier / URL. */
+			mediaId: string().min(1),
+			/** Media kind (`music`, `tvshow`, `movie`, `app`, …) — provider
+			*  passes it through to the upstream service. */
+			mediaType: string().min(1)
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: MediaPlayerStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI players read the
+	* full slice for live now-playing, volume, and progress updates
+	* without polling.
+	*/
+	runtimeState: MediaPlayerStatusSchema
+};
 /** Shared Zod schemas used across detection capabilities. */
 /**
 * Canonical frame-format enum mirrored on `FrameFormat` in
@@ -12825,33 +14320,66 @@ var PolygonPointSchema = object({
 });
 /** A camera detection zone — pure geometry/identity. */
 var ZoneSchema = object({
-	id: string(),
-	name: string(),
-	kind: ZoneKindEnum.default("polygon"),
-	/** Polygon vertices, fraction of frame (0–1). */
-	polygon: array(PolygonPointSchema).readonly(),
-	/** Visual color for UI rendering. */
-	color: string().default("#3b82f6")
-});
-DeviceType.Camera, method(object({ deviceId: number() }), array(ZoneSchema).readonly()), method(object({
-	deviceId: number(),
-	zone: ZoneSchema
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	zoneId: string()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	zone: ZoneSchema
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), object({ zones: array(ZoneSchema).readonly() });
+	id: string(),
+	name: string(),
+	kind: ZoneKindEnum.default("polygon"),
+	/** Polygon vertices, fraction of frame (0–1). */
+	polygon: array(PolygonPointSchema).readonly(),
+	/** Visual color for UI rendering. */
+	color: string().default("#3b82f6")
+});
+/**
+* Zones capability — per-camera CRUD over polygon detection zones.
+*
+* Provider lives in `addon-pipeline-orchestrator` (hub-only). Persists
+* to per-device settings and mirrors into the `zones` device-state
+* slice on every mutation, so downstream consumers can subscribe via
+* `dev.state.zones.onChanged`.
+*
+* The cap surface only handles geometry + identity; filtering
+* behaviour (per-class, include/exclude, threshold) lives in the
+* consumer addons' rule arrays — see `ZoneRuleSchema` exported from
+* `capabilities/schemas/zone-rule.js`.
+*/
+var zonesCapability = {
+	name: "zones",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		listZones: method(object({ deviceId: number() }), array(ZoneSchema).readonly()),
+		addZone: method(object({
+			deviceId: number(),
+			zone: ZoneSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		removeZone: method(object({
+			deviceId: number(),
+			zoneId: string()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateZone: method(object({
+			deviceId: number(),
+			zone: ZoneSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	/**
+	* Runtime-state slice — the live zone catalogue mirrored by the
+	* orchestrator on every CRUD mutation. Consumers read via
+	* `device.state.zones.value` / `.watch(...)` without round-tripping
+	* the cap, and the codegen DeviceProxy auto-wires the reactive
+	* handle. Slice shape is `{ zones: Zone[] }` so future extensions
+	* (e.g. zone groupings) can sit alongside the polygon list.
+	*/
+	runtimeState: object({ zones: array(ZoneSchema).readonly() })
+};
 /**
 * A bounding box in NORMALIZED [0,1] frame coordinates for `getNativeCrop`. The
 * decode worker resolves it against the RETAINED native frame's real pixel dims,
@@ -13267,7 +14795,19 @@ method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mu
 	parent: DetailParentSchema,
 	steps: array(string()).optional()
 }), object({ details: array(DetailResultSchema) }).nullable(), { kind: "mutation" });
-object({
+/**
+* Hardware / firmware motion sensor cap — binary detected state plus
+* a timestamp of the last observation. Distinct from
+* `motion-detection.cap.ts` which owns the LOCAL ML motion pipeline;
+* `motion` is the lightweight readout from on-camera motion (Reolink
+* `GetMdState`, Baichuan push `type: motion`, ONVIF analytics).
+*
+* Native-motion providers also fan out to `detection.camera-native`
+* with `source: 'onboard'` so cross-cutting system services
+* (alert-center, advanced-notifier) can subscribe once and receive
+* motion from every camera.
+*/
+var MotionStatusSchema = object({
 	detected: boolean(),
 	/** Ms epoch of the last detected-true observation. Null if never detected. */
 	lastDetectedAt: number().nullable(),
@@ -13278,32 +14818,137 @@ object({
 	*/
 	autoClearAfterMs: number().nullable()
 });
-object({
+/**
+* Payload of `motion.onMotionChanged` event + the corresponding bus
+* event `EventCategory.MotionOnMotionChanged`. Single source of truth
+* — both the cap event surface and the bus payload type alias to this
+* schema.
+*/
+var MotionOnMotionChangedDataSchema = object({
 	deviceId: number(),
 	detected: boolean(),
 	timestamp: number(),
 	source: MotionSourceEnum,
 	regions: array(MotionRegionSchema).readonly().optional()
 });
-DeviceType.Camera, DeviceType.Sensor, method(object({ deviceId: number() }), boolean());
-object({
+var motionCapability = {
+	name: "motion",
+	scope: "device",
+	mode: "singleton",
+	/**
+	* Providers register per-device natives via `ctx.registerNativeCap`
+	* (Hikvision/Reolink/Amcrest/Wyze/HA/Homematic/Alexa/Matter) — there is
+	* NO system singleton provider. Without this flag `resolveCapMount`
+	* derived `{ kind: 'singleton' }`, so `motion.getStatus`/`isDetected`
+	* resolved via `registry.getSingleton('motion')` (always null) and every
+	* call 412'd "provider not available" while bindings listed a live
+	* `motion` native (2026-08-02). The flag routes the router through
+	* `requireDeviceScoped` → `getProviderForDevice`, like `motion-trigger`,
+	* `snapshot` and every other per-device native cap.
+	*/
+	deviceNative: true,
+	deviceTypes: [DeviceType.Camera, DeviceType.Sensor],
+	methods: { 
+	/**
+	* Pull the current motion state synchronously. Convenience shortcut
+	* for consumers that don't need the full status object; equivalent
+	* to `getStatus()?.detected ?? false`. Will likely be folded into
+	* `getStatus` once the auto-injected status surface lands in every
+	* consumer.
+	*/
+isDetected: method(object({ deviceId: number() }), boolean()) },
+	events: { 
+	/**
+	* Fires every time the runner transitions a camera between
+	* `watching` and `active` phases. `source` carries which motion
+	* path drove the transition; `regions` is populated only for
+	* `source: 'analyzer'` (frame-diff regions from the ML motion
+	* detector) — onboard sources don't carry per-frame regions
+	* here (camera-provided zones / AI metadata live in dedicated
+	* channels: `detection.camera-native`, future zone capability).
+	*
+	* Consumers that want all motion pushes (even with `detected`
+	* unchanged) should subscribe to the status subscription via
+	* `device-manager.subscribeDeviceStatusAggregate` instead.
+	*/
+onMotionChanged: { data: MotionOnMotionChangedDataSchema } },
+	status: {
+		schema: MotionStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — the last observed motion snapshot, mirrored
+	* by the kernel and readable cross-process via
+	* `device.state.motion.value`. Reads never invoke the provider, so
+	* UIs and other addons can poll the cached state safely.
+	*/
+	runtimeState: MotionStatusSchema
+};
+/**
+* Motion-trigger toggle for accessory devices.
+*
+* "Motion trigger" means: when the parent camera detects motion, the
+* accessory activates automatically. The cap exposes a single boolean
+* — `enabled` — that drivers map to the vendor-specific firmware
+* action (Reolink: `setSirenOnMotion`, `setFloodlightOnMotion`; ONVIF
+* relay: schedule binding; …).
+*
+* The accessory still has its own `switch` cap for direct on/off; this
+* cap is independent. Toggling motion-trigger on does NOT necessarily
+* toggle the switch on — it just instructs the firmware to flip the
+* switch when motion fires.
+*
+* Driver-specific knobs (motion duration window, brightness while
+* triggered, schedule windows) live in the device's
+* `getSettingsUISchema()` instead of bloating this cap — same
+* principle as `switch` and `brightness` keeping their surface
+* minimal.
+*/
+var MotionTriggerStatusSchema = object({
 	enabled: boolean(),
 	/** Ms epoch of the last operator-driven change. */
 	lastChangedAt: number()
-}).extend({ 
+});
+/**
+* Persistent slice mirrored across restarts. The provider writes here
+* on every successful firmware fetch / setMotionTrigger push; the cap
+* router and admin-ui hero read straight from this snapshot via
+* `device.state.motionTrigger.value` instead of re-issuing a firmware
+* round-trip on every UI mount. `lastFetchedAt` lets the framework
+* helper (`createRuntimeStateBridge`) stale-check before deciding
+* whether to refresh from the camera.
+*/
+var MotionTriggerRuntimeStateSchema = MotionTriggerStatusSchema.extend({ 
 /** Ms epoch of the last successful camera fetch (0 = never). */
 lastFetchedAt: number() });
-DeviceType.Light, DeviceType.Siren, DeviceType.Switch, method(object({
-	deviceId: number().int().nonnegative(),
-	enabled: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), object({
-	deviceId: number(),
-	enabled: boolean(),
-	lastChangedAt: number()
-});
+var motionTriggerCapability = {
+	name: "motion-trigger",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [
+		DeviceType.Light,
+		DeviceType.Siren,
+		DeviceType.Switch
+	],
+	methods: { setMotionTrigger: method(object({
+		deviceId: number().int().nonnegative(),
+		enabled: boolean()
+	}), _void(), {
+		kind: "mutation",
+		auth: "admin"
+	}) },
+	events: { onMotionTriggerChanged: { data: object({
+		deviceId: number(),
+		enabled: boolean(),
+		lastChangedAt: number()
+	}) } },
+	status: {
+		schema: MotionTriggerStatusSchema,
+		kind: "command-driven"
+	},
+	runtimeState: MotionTriggerRuntimeStateSchema
+};
 /**
 * Motion-zones share the same MaskShape vocabulary as privacy-mask — the
 * on-camera motion-detection mask is a single `grid` region (a row-major
@@ -13316,7 +14961,9 @@ var MotionZoneRegionSchema = object({
 	enabled: boolean(),
 	shape: MaskGridShapeSchema
 });
-object({
+/** Current on-camera motion-detection state — master enable + sensitivity +
+*  the grid region(s). */
+var MotionZoneStatusSchema = object({
 	enabled: boolean(),
 	sensitivity: number(),
 	/** Grid region(s). Today exactly one `grid` shape. */
@@ -13341,13 +14988,34 @@ var MotionZonePatchSchema = object({
 	sensitivity: number().optional(),
 	regions: array(MotionZoneRegionSchema).optional()
 });
-DeviceType.Camera, method(object({ deviceId: number() }), MotionZoneOptionsSchema), method(object({
-	deviceId: number(),
-	patch: MotionZonePatchSchema
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
+var motionZonesCapability = {
+	name: "motion-zones",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	deviceConfig: { ui: {
+		kind: "widget",
+		widgetId: "host/motion-zones-grid",
+		tab: "motion",
+		label: "Motion Zones"
+	} },
+	methods: {
+		getOptions: method(object({ deviceId: number() }), MotionZoneOptionsSchema),
+		setZone: method(object({
+			deviceId: number(),
+			patch: MotionZonePatchSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: MotionZoneStatusSchema,
+		kind: "poll"
+	},
+	runtimeState: MotionZoneStatusSchema
+};
 /**
 * On-camera AI object detection cap. Surfaces per-device the classes
 * the firmware can detect and the last-seen instance of each. The
@@ -13374,7 +15042,7 @@ var NativeDetectionSchema = object({
 	/** Firmware-provided confidence [0..1]. Reolink pushes don't carry it → undefined. */
 	confidence: number().min(0).max(1).optional()
 });
-object({
+var NativeObjectDetectionStatusSchema = object({
 	/**
 	* Last observed instance per class. Missing entries mean the class
 	* is supported but nothing has been seen since the provider started.
@@ -13395,19 +15063,33 @@ object({
 	* churn the tracker, so forwarding stays off until the operator enables it.
 	*/
 	enabled: boolean()
-}).extend({ 
+});
+var NativeObjectDetectionRuntimeStateSchema = NativeObjectDetectionStatusSchema.extend({ 
 /** Required by createRuntimeStateBridge — epoch ms of last refresh. */
 lastFetchedAt: number() });
-DeviceType.Camera, method(object({
-	deviceId: number(),
-	enabled: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), object({
-	deviceId: number(),
-	detection: NativeDetectionSchema
-});
+var nativeObjectDetectionCapability = {
+	name: "native-object-detection",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: { setEnabled: method(object({
+		deviceId: number(),
+		enabled: boolean()
+	}), _void(), {
+		kind: "mutation",
+		auth: "admin"
+	}) },
+	events: { onDetected: { data: object({
+		deviceId: number(),
+		detection: NativeDetectionSchema
+	}) } },
+	status: {
+		schema: NativeObjectDetectionStatusSchema,
+		kind: "push"
+	},
+	runtimeState: NativeObjectDetectionRuntimeStateSchema
+};
 /**
 * Notification delivery cap. Models HA `notify.<service>` plus future
 * native targets (Telegram / Discord / ntfy / SMTP, …). Designed at
@@ -13459,7 +15141,7 @@ var NotifierSupportsSchema = object({
 	*  Pair with `DeviceFeature.NotifierRecipients`. */
 	recipients: boolean()
 });
-object({
+var NotifierStatusSchema = object({
 	/** Ms epoch of the most recent successful send. 0 if none yet. */
 	lastSentAt: number(),
 	/** Failure description from the most recent send attempt. Null on
@@ -13500,23 +15182,67 @@ var NotifierSendResultSchema = object({
 	/** Ms epoch when the notifier accepted the send (not when delivered). */
 	acceptedAt: number()
 });
-DeviceType.Notifier, method(NotifierSendInputSchema, NotifierSendResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	notificationId: string().min(1)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), object({
-	deviceId: number(),
-	notificationId: string(),
-	success: boolean(),
-	error: string().nullable(),
-	acceptedAt: number()
-});
-object({
+var notifierCapability = {
+	name: "notifier",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Notifier],
+	methods: {
+		send: method(NotifierSendInputSchema, NotifierSendResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		cancel: method(object({
+			deviceId: number().int().nonnegative(),
+			notificationId: string().min(1)
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	events: { 
+	/**
+	* Emitted after every send attempt — success or failure. Subscribers
+	* (admin UI history pane, automation engines, retry workers) react
+	* without polling the provider's `lastSentAt`.
+	*/
+onSent: { data: object({
+		deviceId: number(),
+		notificationId: string(),
+		success: boolean(),
+		error: string().nullable(),
+		acceptedAt: number()
+	}) } },
+	status: {
+		schema: NotifierStatusSchema,
+		kind: "command-driven"
+	},
+	/**
+	* Runtime-state slice — diagnostics + supports matrix. UI compose
+	* form reads `supports` to gate optional fields; history pane reads
+	* `lastSentAt` / `lastError` / `queueDepth`.
+	*/
+	runtimeState: NotifierStatusSchema
+};
+/**
+* Generic numeric sensor — last-resort fallback when no typed numeric
+* cap fits (HA `sensor` whose `device_class` we don't have a typed cap
+* for: water flow, distance, weight, frequency, signal strength, …).
+*
+* The `unit` and `precision` fields carry the live display metadata that
+* the upstream source provides with each state push (HA
+* `attributes.unit_of_measurement` / `attributes.suggested_display_precision`).
+* The UI reads them directly from the slice — they are the single source
+* of truth for generic numeric rendering and do NOT live on `sourceInfo`.
+*
+* Prefer the typed alternatives (`temperature-sensor`, `humidity-sensor`,
+* `ambient-light-sensor`, `pressure-sensor`, `power-meter`,
+* `air-quality-sensor`, `battery`) when the metric matches — export
+* adapters render those with the right service / category. Generic
+* numeric values land here.
+*/
+var NumericSensorStatusSchema = object({
 	value: number(),
 	/** Display unit-of-measurement (e.g. 'dBm', 's', 'rpm', 'steps').
 	*  Populated live from the upstream source on each state push.
@@ -13529,7 +15255,19 @@ object({
 	/** Ms epoch when the slice was last updated. */
 	lastFetchedAt: number()
 });
-DeviceType.Sensor;
+var numericSensorCapability = {
+	name: "numeric-sensor",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: NumericSensorStatusSchema,
+		kind: "push"
+	},
+	runtimeState: NumericSensorStatusSchema
+};
 /**
 * Feeder connectivity / power status — mirrors the HA petkit device-status
 * enum: `normal` (online, mains), `offline` (not reaching PetKit cloud),
@@ -13541,7 +15279,7 @@ var PetFeederDeviceStatusSchema = _enum([
 	"on_batteries"
 ]);
 var gramsPortion = number().int().min(4).max(200);
-object({
+var PetFeederStatusSchema = object({
 	/** Food currently in the bowl (grams). Null when the device has not
 	*  reported a reading yet. On dual-hopper models this is the combined
 	*  bowl reading; per-hopper levels live in `food1`/`food2`. */
@@ -13586,58 +15324,117 @@ object({
 	/** Ms epoch when the slice was last refreshed from the cloud. */
 	lastFetchedAt: number()
 });
-DeviceType.PetFeeder, method(object({
-	deviceId: number().int().nonnegative(),
-	grams: gramsPortion.optional(),
-	hopper1: gramsPortion.optional(),
-	hopper2: gramsPortion.optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	soundId: number().int().nonnegative()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	on: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	on: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	on: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	level: number().int().nonnegative()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-object({
+var petFeederCapability = {
+	name: "pet-feeder",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.PetFeeder],
+	methods: {
+		/**
+		* Dispense food now. Single-hopper feeders take `grams`; dual-hopper
+		* feeders (D4S/D4SH) accept `hopper1`/`hopper2` to target one or both
+		* hoppers. All portions honour the 4–200 g hardware range. At least
+		* one of the three must be present — the provider rejects an empty
+		* request.
+		*/
+		feed: method(object({
+			deviceId: number().int().nonnegative(),
+			grams: gramsPortion.optional(),
+			hopper1: gramsPortion.optional(),
+			hopper2: gramsPortion.optional()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Cancel an in-progress manual feed. */
+		cancelFeed: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Reset the desiccant "days remaining" counter after replacing it. */
+		resetDesiccant: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Mark a hopper as refilled (D4H/D4S/D4SH). */
+		markFoodReplenished: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Call the pet with the recorded prompt (D3). */
+		callPet: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Play a stored sound by id (D3 / D4H / D4SH). */
+		playSound: method(object({
+			deviceId: number().int().nonnegative(),
+			soundId: number().int().nonnegative()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Toggle the child-lock (manual-lock) setting. */
+		setChildLock: method(object({
+			deviceId: number().int().nonnegative(),
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Toggle the front indicator light. */
+		setIndicatorLight: method(object({
+			deviceId: number().int().nonnegative(),
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Toggle the dispense chime. */
+		setFeedSound: method(object({
+			deviceId: number().int().nonnegative(),
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Set the speaker / prompt volume level. */
+		setVolume: method(object({
+			deviceId: number().int().nonnegative(),
+			level: number().int().nonnegative()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: PetFeederStatusSchema,
+		kind: "poll"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI feeder cards read
+	* the full slice via `device.state.petFeeder.value` and refresh on
+	* every poll without re-querying the provider.
+	*/
+	runtimeState: PetFeederStatusSchema
+};
+/**
+* Multi-metric electrical meter. One slice can carry any combination
+* of instantaneous power (W), cumulative energy (kWh), voltage (V),
+* and current (A) — all fields optional so a single-metric source
+* (HA `sensor` with `device_class: power`) populates only what it
+* has and aggregators (energy dashboards, billing exports) compose
+* across providers without needing one cap per metric.
+*
+* Trade-off acknowledged: a HomeKit export that wants to surface
+* "power" and "energy" as separate services has to crack open the
+* slice and emit two characteristics from one cap. Worth it to avoid
+* exploding the cap catalog with `power-w` / `energy-kwh` /
+* `voltage-v` / `current-a` quartets that always travel together
+* in real-world devices.
+*/
+var PowerMeterStatusSchema = object({
 	/** Instantaneous power draw in watts. */
 	watts: number().optional(),
 	/** Cumulative energy in kilowatt-hours since the meter was reset. */
@@ -13664,7 +15461,19 @@ object({
 	*  auto-formatting when absent. */
 	precision: number().int().min(0).max(10).optional()
 });
-DeviceType.Sensor;
+var powerMeterCapability = {
+	name: "power-meter",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: PowerMeterStatusSchema,
+		kind: "push"
+	},
+	runtimeState: PowerMeterStatusSchema
+};
 /**
 * Presence cap. Models HA `person.*` and `device_tracker.*` entities
 * on `DeviceType.Presence`. Read-only — no setters: presence is
@@ -13689,7 +15498,7 @@ var GpsLocationSchema = object({
 	/** Reported accuracy in meters (lower = better). */
 	accuracyMeters: number().nonnegative()
 });
-object({
+var PresenceStatusSchema = object({
 	/** `home` / `not_home` / any user-defined zone name. */
 	state: string(),
 	/** Optional textual location label (zone name, city, address). Null
@@ -13703,8 +15512,34 @@ object({
 	/** Ms epoch when the slice was last updated. */
 	lastChangedAt: number()
 });
-DeviceType.Presence;
-object({
+var presenceCapability = {
+	name: "presence",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Presence],
+	methods: {},
+	status: {
+		schema: PresenceStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI presence card
+	* reads `state` + `location` for the text label; iff `gps !== null`
+	* the map pin is rendered (use `DeviceFeature.PresenceGps` for the
+	* pre-fetch fast-path check).
+	*/
+	runtimeState: PresenceStatusSchema
+};
+/**
+* Atmospheric pressure reading in hectopascals. Drives Home Assistant
+* `sensor` entries with `device_class: pressure`.
+*
+* Unit normalisation: hPa. The canonical display unit (`hPa`) is a
+* descriptor constant in the UI (ROLE_DESCRIPTOR), not stored in
+* `sourceInfo`.
+*/
+var PressureSensorStatusSchema = object({
 	/** Current pressure in hPa. */
 	hpa: number(),
 	/** Ms epoch when the slice was last updated. */
@@ -13719,7 +15554,19 @@ object({
 	*  auto-formatting when absent. */
 	precision: number().int().min(0).max(10).optional()
 });
-DeviceType.Sensor;
+var pressureSensorCapability = {
+	name: "pressure-sensor",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: PressureSensorStatusSchema,
+		kind: "push"
+	},
+	runtimeState: PressureSensorStatusSchema
+};
 /**
 * Privacy mask = up to `maxRegions` SHAPES the camera blanks out (NOT a
 * cell grid). Reolink `<shelterList>` zones are rectangles; Hikvision
@@ -13738,7 +15585,8 @@ var PrivacyMaskRegionSchema = object({
 	enabled: boolean(),
 	shape: PrivacyMaskShapeSchema
 });
-object({
+/** Current on-camera privacy-mask state — master enable + zones. */
+var PrivacyMaskStatusSchema = object({
 	enabled: boolean(),
 	/** Active zones (normalized 0..1). Length ≤ maxRegions. */
 	regions: array(PrivacyMaskRegionSchema),
@@ -13758,13 +15606,34 @@ var PrivacyMaskPatchSchema = object({
 	enabled: boolean().optional(),
 	regions: array(PrivacyMaskRegionSchema).optional()
 });
-DeviceType.Camera, method(object({ deviceId: number() }), PrivacyMaskOptionsSchema), method(object({
-	deviceId: number(),
-	patch: PrivacyMaskPatchSchema
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
+var privacyMaskCapability = {
+	name: "privacy-mask",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	deviceConfig: { ui: {
+		kind: "widget",
+		widgetId: "host/privacy-mask-grid",
+		tab: "image",
+		label: "Privacy Mask"
+	} },
+	methods: {
+		getOptions: method(object({ deviceId: number() }), PrivacyMaskOptionsSchema),
+		setMask: method(object({
+			deviceId: number(),
+			patch: PrivacyMaskPatchSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: PrivacyMaskStatusSchema,
+		kind: "poll"
+	},
+	runtimeState: PrivacyMaskStatusSchema
+};
 var PtzAutotrackSettingsSchema = object({
 	targetType: string().describe("Vendor target string (people/vehicle/pet); empty = camera default"),
 	stopDelaySeconds: number().int().min(0).max(300),
@@ -13804,19 +15673,85 @@ var PtzAutotrackStatusSchema = object({
 	*/
 	supportedTargetTypes: array(PtzAutotrackTargetOptionSchema)
 });
-PtzAutotrackStatusSchema.extend({ 
+/**
+* Runtime-state slice owned by this cap. Persists the last-known
+* camera-derived snapshot across restarts, so cold-start callers
+* have a meaningful baseline even before the first refresh round-trip.
+*
+* Adds `lastFetchedAt` on top of the status shape so the framework
+* (or the provider) can stale-check before deciding whether to
+* round-trip the camera again.
+*/
+var PtzAutotrackRuntimeStateSchema = PtzAutotrackStatusSchema.extend({ 
 /** Ms epoch of the last successful camera fetch (0 = never). */
 lastFetchedAt: number() });
-DeviceType.Camera, method(object({ deviceId: number() }), PtzAutotrackStatusSchema), method(object({
-	deviceId: number(),
-	enabled: boolean()
-}), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), PtzAutotrackSettingsSchema.nullable()), method(object({
-	deviceId: number(),
-	settings: PtzAutotrackSettingsSchema.partial()
-}), _void(), { kind: "mutation" }), object({
-	deviceId: number(),
-	status: PtzAutotrackStatusSchema
-});
+var ptzAutotrackCapability = {
+	name: "ptz-autotrack",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	deviceConfig: { ui: {
+		kind: "widget",
+		widgetId: "host/ptz-autotrack",
+		tab: "ptz",
+		topTab: true,
+		label: "Auto-Tracking",
+		order: 5
+	} },
+	methods: {
+		/**
+		* Read the current on/off state + last-applied settings.
+		* Drivers may serve from a cache + refresh on a schedule —
+		* callers should NOT poll faster than ~5s.
+		*/
+		getStatus: method(object({ deviceId: number() }), PtzAutotrackStatusSchema),
+		/**
+		* Arm or disarm autotrack. Resolves once the camera has
+		* acknowledged the transition; the `onStatusChanged` event
+		* fires shortly after with the live state.
+		*/
+		setEnabled: method(object({
+			deviceId: number(),
+			enabled: boolean()
+		}), _void(), { kind: "mutation" }),
+		/**
+		* Read settings (target type + delays). Mirrors the
+		* `getStatus().currentSettings` payload but exposes it as a
+		* standalone read for callers that want settings without the
+		* status surface around them. `null` until the driver has
+		* harvested the firmware state at least once.
+		*/
+		getSettings: method(object({ deviceId: number() }), PtzAutotrackSettingsSchema.nullable()),
+		/**
+		* Update one or more settings. Partial — keys that aren't
+		* supplied keep their last persisted value. The driver is
+		* responsible for clamping vendor-specific ranges if narrower
+		* than the cross-vendor max declared on the schema.
+		*/
+		setSettings: method(object({
+			deviceId: number(),
+			settings: PtzAutotrackSettingsSchema.partial()
+		}), _void(), { kind: "mutation" })
+	},
+	events: { onStatusChanged: { data: object({
+		deviceId: number(),
+		status: PtzAutotrackStatusSchema
+	}) } },
+	status: {
+		schema: PtzAutotrackStatusSchema,
+		kind: "command-driven"
+	},
+	/**
+	* Persistent slice mirrored across restarts. The provider writes
+	* here on every successful firmware fetch / settings push;
+	* `getStatus` and `getSettings` then read this snapshot synchronously
+	* with a stale-driven async refresh in the background. Keeps the
+	* fetch / cache / fallback logic out of the four cap methods —
+	* they become trampolines over `runtimeState`.
+	*/
+	runtimeState: PtzAutotrackRuntimeStateSchema
+};
 /**
 * scene-monitor — device-scoped reference-region state cap. An operator marks
 * a rect ROI on a camera frame and names one or more states; the engine
@@ -13886,72 +15821,108 @@ var SceneMonitorStatusSchema = object({
 	monitors: array(SceneMonitorSchema),
 	lastFetchedAt: number()
 });
-DeviceType.Camera, method(object({ deviceId: number() }), SceneMonitorStatusSchema), method(object({
-	deviceId: number(),
-	label: string(),
-	roi: MaskRectShapeSchema,
-	check: SceneCheckSchema,
-	triggerMode: _enum([
-		"periodic",
-		"on-motion",
-		"both"
-	]).optional(),
-	checkIntervalSec: number().optional()
-}), SceneMonitorSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	monitorId: string(),
-	patch: object({
-		label: string().optional(),
-		roi: MaskRectShapeSchema.optional(),
-		enabled: boolean().optional(),
-		triggerMode: _enum([
-			"periodic",
-			"on-motion",
-			"both"
-		]).optional(),
-		checkIntervalSec: number().optional(),
-		check: SceneCheckSchema.optional()
-	})
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	monitorId: string()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	monitorId: string(),
-	stateId: string().optional(),
-	label: string().optional(),
-	condition: SceneConditionSchema.optional()
-}), object({
-	stateId: string(),
-	referenceCount: number()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	monitorId: string(),
-	stateId: string(),
-	index: number()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	monitorId: string()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-object({
+var sceneMonitorCapability = {
+	name: "scene-monitor",
+	scope: "device",
+	mode: "singleton",
+	kind: "wrapper",
+	defaultActive: true,
+	deviceTypes: [DeviceType.Camera],
+	deviceConfig: { ui: {
+		kind: "widget",
+		widgetId: "host/scene-monitor-editor",
+		tab: "scenes",
+		label: "Scenes"
+	} },
+	methods: {
+		listScenes: method(object({ deviceId: number() }), SceneMonitorStatusSchema),
+		createScene: method(object({
+			deviceId: number(),
+			label: string(),
+			roi: MaskRectShapeSchema,
+			check: SceneCheckSchema,
+			triggerMode: _enum([
+				"periodic",
+				"on-motion",
+				"both"
+			]).optional(),
+			checkIntervalSec: number().optional()
+		}), SceneMonitorSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateScene: method(object({
+			deviceId: number(),
+			monitorId: string(),
+			patch: object({
+				label: string().optional(),
+				roi: MaskRectShapeSchema.optional(),
+				enabled: boolean().optional(),
+				triggerMode: _enum([
+					"periodic",
+					"on-motion",
+					"both"
+				]).optional(),
+				checkIntervalSec: number().optional(),
+				check: SceneCheckSchema.optional()
+			})
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteScene: method(object({
+			deviceId: number(),
+			monitorId: string()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		captureReference: method(object({
+			deviceId: number(),
+			monitorId: string(),
+			stateId: string().optional(),
+			label: string().optional(),
+			condition: SceneConditionSchema.optional()
+		}), object({
+			stateId: string(),
+			referenceCount: number()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteReference: method(object({
+			deviceId: number(),
+			monitorId: string(),
+			stateId: string(),
+			index: number()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		recheckNow: method(object({
+			deviceId: number(),
+			monitorId: string()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: SceneMonitorStatusSchema,
+		kind: "push"
+	},
+	runtimeState: SceneMonitorStatusSchema
+};
+/**
+* Script-runner cap. Models HA `script.*` entities on
+* `DeviceType.Script`. A Script is a pre-recorded action sequence
+* that can be invoked imperatively — optionally with a variables
+* map when the script declares input fields.
+*
+* Variable-support is signalled by `DeviceFeature.ScriptVariables`
+* so the UI gates a "with parameters" form without a slice fetch.
+*/
+var ScriptRunnerStatusSchema = object({
 	/** Whether the script is currently executing. */
 	isRunning: boolean(),
 	/** Ms epoch of the last invocation start. 0 when never run. */
@@ -13965,25 +15936,68 @@ object({
 	/** Ms epoch when the slice was last updated. */
 	lastChangedAt: number()
 });
-DeviceType.Script, method(object({
-	deviceId: number().int().nonnegative(),
-	/** Optional variables map — passed through to the upstream
-	*  script. Provider rejects when the script doesn't declare
-	*  input fields (gated by `DeviceFeature.ScriptVariables`). */
-	variables: record(string(), unknown()).optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-object({
+var scriptRunnerCapability = {
+	name: "script-runner",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Script],
+	methods: {
+		run: method(object({
+			deviceId: number().int().nonnegative(),
+			/** Optional variables map — passed through to the upstream
+			*  script. Provider rejects when the script doesn't declare
+			*  input fields (gated by `DeviceFeature.ScriptVariables`). */
+			variables: record(string(), unknown()).optional()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Cancel a running script. Provider rejects when the script
+		*  isn't currently running. */
+		stop: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: ScriptRunnerStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI script tile reads
+	* `isRunning` to render a spinner during execution and surfaces
+	* `lastError` / `lastRunSuccess` in the recent-runs panel.
+	*/
+	runtimeState: ScriptRunnerStatusSchema
+};
+/**
+* Smoke alarm sensor — boolean "is smoke currently detected" with
+* timestamp of the last transition. Drives Home Assistant
+* `binary_sensor` entries with `device_class: smoke`.
+*
+* Push-driven: a smoke event is critical, so the slice updates
+* immediately on the upstream signal. Auto-clearing back to false is
+* provider-controlled (some alarms latch until manually reset).
+*/
+var SmokeStatusSchema = object({
 	detected: boolean(),
 	/** Ms epoch of the last transition. 0 if never observed. */
 	lastChangedAt: number()
 });
-DeviceType.Sensor;
+var smokeCapability = {
+	name: "smoke",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: SmokeStatusSchema,
+		kind: "push"
+	},
+	runtimeState: SmokeStatusSchema
+};
 /** One of the camera's stream profiles. */
 var StreamProfileSchema = _enum([
 	"main",
@@ -14006,7 +16020,7 @@ var StreamProfileConfigSchema = object({
 	gop: number().optional(),
 	audio: boolean().optional()
 });
-object({
+var StreamParamsStatusSchema = object({
 	/** Per-profile current config. A profile absent = the camera doesn't have it. */
 	main: StreamProfileConfigSchema.optional(),
 	sub: StreamProfileConfigSchema.optional(),
@@ -14060,39 +16074,150 @@ var StreamProfilePatchSchema = object({
 	gop: number().optional(),
 	audio: boolean().optional()
 });
-DeviceType.Camera, method(object({ deviceId: number() }), StreamParamsOptionsSchema), method(object({
-	deviceId: number(),
-	profile: StreamProfileSchema,
-	patch: StreamProfilePatchSchema
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number() }), unknown().nullable());
-object({
+var streamParamsCapability = {
+	name: "stream-params",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	deviceConfig: { ui: {
+		kind: "derived-form",
+		builderId: "stream-params",
+		tab: "streaming"
+	} },
+	methods: {
+		getOptions: method(object({ deviceId: number() }), StreamParamsOptionsSchema),
+		setProfile: method(object({
+			deviceId: number(),
+			profile: StreamProfileSchema,
+			patch: StreamProfilePatchSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Build the `ConfigUISchema` (admin-ui `ConfigFormBuilder` input
+		* shape) for this camera's stream-encoder settings — one section per
+		* profile (main / sub / ext) with the resolution / codec / framerate
+		* / bitrate / bitrate-mode / encoder-profile / GOP controls the
+		* firmware actually exposes.
+		*
+		* Driven by `getOptions` (camera-probed availability) + `getStatus`
+		* (current per-profile config); each field's `default` is seeded
+		* from the live config so the form renders the camera state in one
+		* pass. Returns `null` when the camera exposes no configurable
+		* stream property — the renderer then shows the unsupported message.
+		*
+		* Output is `z.unknown().nullable()` — the same convention every
+		* other `ConfigUISchema`-returning cap method uses (`device-ops`,
+		* `device-manager`); `ConfigUISchema` is a TS-only type with no
+		* companion Zod schema, and a concrete object would collapse
+		* unrelated AppRouter branches to `unknown` during codegen.
+		*/
+		getConfigSchema: method(object({ deviceId: number() }), unknown().nullable())
+	},
+	status: {
+		schema: StreamParamsStatusSchema,
+		kind: "poll"
+	},
+	runtimeState: StreamParamsStatusSchema
+};
+/**
+* Generic on/off switch cap for accessory children (siren, floodlight,
+* spotlight, PIR toggle, chime silencer, autotrack enable, …). The cap
+* owns ONLY the boolean state — driver-specific settings (brightness,
+* sensitivity, schedule, duration) live on the device's own
+* `getSettingsUISchema()` surface.
+*/
+var SwitchStatusSchema = object({
 	on: boolean(),
 	/** Ms epoch of the last state change. Useful for UI "X minutes ago". */
 	lastChangedAt: number()
 });
-DeviceType.Switch, DeviceType.Siren, DeviceType.Light, method(object({
-	deviceId: number(),
-	on: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), object({
-	deviceId: number(),
-	on: boolean(),
-	lastChangedAt: number()
-});
-object({
+var switchCapability = {
+	name: "switch",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [
+		DeviceType.Switch,
+		DeviceType.Siren,
+		DeviceType.Light
+	],
+	methods: { setState: method(object({
+		deviceId: number(),
+		on: boolean()
+	}), _void(), {
+		kind: "mutation",
+		auth: "admin"
+	}) },
+	events: { onStateChanged: { data: object({
+		deviceId: number(),
+		on: boolean(),
+		lastChangedAt: number()
+	}) } },
+	status: {
+		schema: SwitchStatusSchema,
+		kind: "command-driven"
+	},
+	/**
+	* Runtime-state slice — the last applied on/off state, mirrored by
+	* the kernel. Read via `device.state.switch.value`; UI toggles do
+	* not need to re-query the provider after a setState mutation.
+	*/
+	runtimeState: SwitchStatusSchema,
+	settings: { bindings: [{
+		kind: "scalar",
+		statusPath: "on",
+		method: "setState",
+		valueArg: "on",
+		field: {
+			label: "On",
+			kind: "boolean"
+		}
+	}] }
+};
+/**
+* Tamper / case-open detection sensor. Drives Home Assistant
+* `binary_sensor` entries with `device_class: tamper`. Push-driven.
+*/
+var TamperStatusSchema = object({
 	/** True when the device's tamper switch / case-open contact is
 	*  currently triggered. */
 	tampered: boolean(),
 	/** Ms epoch of the last transition. 0 if never observed. */
 	lastChangedAt: number()
 });
-DeviceType.Sensor;
-object({
+var tamperCapability = {
+	name: "tamper",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: TamperStatusSchema,
+		kind: "push"
+	},
+	runtimeState: TamperStatusSchema
+};
+/**
+* Single-metric temperature reading. Drives Home Assistant `sensor`
+* entries with `device_class: temperature` and any future native
+* thermometer.
+*
+* Unit normalisation: providers convert to Celsius before storing.
+* The slice value is always Celsius so cross-cap aggregators
+* (climate-control's `currentTemp`, energy analytics) can compose
+* without per-source unit fixups. The canonical display unit (`°C`) is
+* a descriptor constant in the UI (ROLE_DESCRIPTOR), not stored in
+* `sourceInfo`.
+*
+* Status `lastFetchedAt` lets staleness-aware consumers detect a
+* frozen feed (provider hung) distinct from a "temperature hasn't
+* changed" steady state.
+*/
+var TemperatureSensorStatusSchema = object({
 	/** Current temperature in Celsius. */
 	celsius: number(),
 	/** Ms epoch when the slice was last updated (push or poll). */
@@ -14108,8 +16233,29 @@ object({
 	*  auto-formatting when absent. */
 	precision: number().int().min(0).max(10).optional()
 });
-DeviceType.Sensor, DeviceType.Thermostat;
-object({
+var temperatureSensorCapability = {
+	name: "temperature-sensor",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor, DeviceType.Thermostat],
+	methods: {},
+	status: {
+		schema: TemperatureSensorStatusSchema,
+		kind: "push"
+	},
+	runtimeState: TemperatureSensorStatusSchema
+};
+/**
+* Firmware/software update entity. Installed on a `DeviceType.Update` device.
+* Surfaces current vs available version, whether an update is available, the
+* update state, and an install action. Read-mostly and POLL-driven: backends
+* such as the Homematic CCU do not broadcast firmware-descriptor changes, so
+* the client re-queries `getStatus` (which reads the live descriptor) rather
+* than relying on push delivery. `installUpdate` triggers the install
+* (best-effort — providers throw if the backend rejects it).
+*/
+var UpdateStatusSchema = object({
 	currentVersion: string().nullable(),
 	availableVersion: string().nullable(),
 	/**
@@ -14122,10 +16268,22 @@ object({
 	state: string().nullable(),
 	inProgress: boolean()
 });
-DeviceType.Update, method(_void(), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
+var updateCapability = {
+	name: "update",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Update],
+	methods: { installUpdate: method(_void(), _void(), {
+		kind: "mutation",
+		auth: "admin"
+	}) },
+	status: {
+		schema: UpdateStatusSchema,
+		kind: "poll"
+	},
+	runtimeState: UpdateStatusSchema
+};
 /**
 * Robot-vacuum cap. Models HA `vacuum.*` entities — anything with a
 * cleaning lifecycle plus a return-to-base / locate surface and an
@@ -14177,7 +16335,7 @@ var TankStatusSchema = object({
 		"full"
 	]).nullable()
 });
-object({
+var VacuumControlStatusSchema = object({
 	/** Lifecycle state of the vacuum. */
 	state: VacuumStateSchema,
 	/** 0..100 battery percentage. Null when the device has no battery
@@ -14189,45 +16347,68 @@ object({
 	/** Speed tokens the hardware accepts — drives the UI selector. */
 	availableFanSpeeds: array(string()),
 	/** Clean-water (mop) tank. Null when the hardware has no clean-water tank. */
-	cleanWater: TankStatusSchema.nullable(),
-	/** Dirty-water (recovery) tank. Null when the hardware has no dirty-water tank. */
-	dirtyWater: TankStatusSchema.nullable(),
-	/** Detergent tank. Null when the hardware has no detergent tank. */
-	detergent: TankStatusSchema.nullable(),
-	/** Dust bin. Null when the hardware has no dust bin. */
-	dustBin: TankStatusSchema.nullable(),
-	/** 0..100 cleaning-completion percentage of the current task, or null. */
-	progressPercent: number().min(0).max(100).nullable(),
-	/** Current error code (0 / null = no error). */
-	errorCode: number().nullable(),
-	/** Human label for {@link errorCode}, or null when none / undecodable. */
-	errorLabel: string().nullable(),
-	/** Ms epoch when the slice was last updated. */
-	lastChangedAt: number()
-});
-DeviceType.Vacuum, method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	speed: string().min(1)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
+	cleanWater: TankStatusSchema.nullable(),
+	/** Dirty-water (recovery) tank. Null when the hardware has no dirty-water tank. */
+	dirtyWater: TankStatusSchema.nullable(),
+	/** Detergent tank. Null when the hardware has no detergent tank. */
+	detergent: TankStatusSchema.nullable(),
+	/** Dust bin. Null when the hardware has no dust bin. */
+	dustBin: TankStatusSchema.nullable(),
+	/** 0..100 cleaning-completion percentage of the current task, or null. */
+	progressPercent: number().min(0).max(100).nullable(),
+	/** Current error code (0 / null = no error). */
+	errorCode: number().nullable(),
+	/** Human label for {@link errorCode}, or null when none / undecodable. */
+	errorLabel: string().nullable(),
+	/** Ms epoch when the slice was last updated. */
+	lastChangedAt: number()
 });
-object({
+var vacuumControlCapability = {
+	name: "vacuum-control",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Vacuum],
+	methods: {
+		start: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		pause: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		stop: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		returnToBase: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		locate: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setFanSpeed: method(object({
+			deviceId: number().int().nonnegative(),
+			speed: string().min(1)
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: VacuumControlStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI controls watch the
+	* slice for live state + battery + fan-speed changes.
+	*/
+	runtimeState: VacuumControlStatusSchema
+};
+var ValveStatusSchema = object({
 	/** Lifecycle state of the valve. */
 	state: _enum([
 		"open",
@@ -14242,29 +16423,80 @@ object({
 	/** Ms epoch when the slice was last updated. */
 	lastChangedAt: number()
 });
-DeviceType.Valve, method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	position: number().min(0).max(100)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-object({
+var valveCapability = {
+	name: "valve",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Valve],
+	methods: {
+		open: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		close: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		stop: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setPosition: method(object({
+			deviceId: number().int().nonnegative(),
+			position: number().min(0).max(100)
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: ValveStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI controls watch the
+	* slice for live position changes during a move.
+	*/
+	runtimeState: ValveStatusSchema
+};
+/**
+* Vibration / shake / impact sensor. Drives Home Assistant
+* `binary_sensor` entries with `device_class: vibration`. Push-driven.
+*/
+var VibrationStatusSchema = object({
 	detected: boolean(),
 	/** Ms epoch of the last transition. 0 if never observed. */
 	lastChangedAt: number()
 });
-DeviceType.Sensor;
-object({
+var vibrationCapability = {
+	name: "vibration",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: VibrationStatusSchema,
+		kind: "push"
+	},
+	runtimeState: VibrationStatusSchema
+};
+/**
+* Water heater / boiler cap. Models HA `water_heater.*` entities — a
+* climate-family actuator with a target temperature, an operation-mode
+* selector (`eco` / `electric` / `gas` / `heat_pump` / `high_demand` /
+* `performance` / `off`), and an optional away-mode toggle.
+*
+* The slice carries the current + target temperature, the active
+* operation mode (HA's `state`) and its available set (HA's
+* `operation_list`), the away flag (HA `away_mode` 'on'/'off' → bool,
+* null when unsupported), plus the `min_temp` / `max_temp` bounds.
+*
+* Providers populate only what the hardware reports — temperature and
+* away fields stay null when the device has no such surface.
+*/
+var WaterHeaterStatusSchema = object({
 	/** Current measured temperature. Null when not reported. */
 	currentTemp: number().nullable(),
 	/** Target temperature setpoint. Null when no setpoint surface. */
@@ -14285,26 +16517,65 @@ object({
 	/** Ms epoch when the slice was last updated. */
 	lastChangedAt: number()
 });
-DeviceType.WaterHeater, method(object({
-	deviceId: number().int().nonnegative(),
-	temp: number().finite()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	mode: string().min(1)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	on: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-object({
+var waterHeaterCapability = {
+	name: "water-heater",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.WaterHeater],
+	methods: {
+		setTargetTemp: method(object({
+			deviceId: number().int().nonnegative(),
+			temp: number().finite()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setOperationMode: method(object({
+			deviceId: number().int().nonnegative(),
+			mode: string().min(1)
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setAway: method(object({
+			deviceId: number().int().nonnegative(),
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: WaterHeaterStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI controls watch the
+	* slice for live temperature / mode / away changes.
+	*/
+	runtimeState: WaterHeaterStatusSchema
+};
+/**
+* Weather provider cap. Models HA `weather.*` entities — a read-only
+* snapshot of the CURRENT conditions a weather integration reports.
+*
+* Read-only: there are no setters. The slice is populated from upstream
+* pushes (the HA weather entity's state + attributes) and rendered by
+* the UI as a sky scene + readouts.
+*
+* `condition` is the verbatim HA state string (`sunny` / `cloudy` /
+* `rainy` / `snowy` / `partlycloudy` / `pouring` / `lightning` /
+* `lightning-rainy` / `fog` / `windy` / `windy-variant` / `hail` /
+* `clear-night` / `exceptional` / …). The UI maps it to a glyph + tint;
+* unknown strings fall back to a neutral cloud.
+*
+* Every numeric reading is nullable — a given weather integration only
+* populates the metrics it actually provides.
+*
+* Forecast deferred — current conditions only for v1.
+*/
+var WeatherStatusSchema = object({
 	/** Verbatim HA condition state (`sunny`, `cloudy`, `rainy`, …). Null
 	*  when no condition has been reported yet. */
 	condition: string().nullable(),
@@ -14327,7 +16598,23 @@ object({
 	/** Ms epoch when the slice was last updated. */
 	lastFetchedAt: number()
 });
-DeviceType.Weather;
+var weatherCapability = {
+	name: "weather",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Weather],
+	methods: {},
+	status: {
+		schema: WeatherStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. The UI reads the
+	* current conditions directly from the slice on each weather push.
+	*/
+	runtimeState: WeatherStatusSchema
+};
 /**
 * Per-zone occupancy aggregation produced by the analytics frame
 * processor on every inference result. Covers the full combinatorial
@@ -14590,21 +16877,604 @@ var ZoneRuleStageEnum = _enum([
 	"detection",
 	"package"
 ]);
-DeviceType.Camera, method(object({
-	deviceId: number(),
-	stage: ZoneRuleStageEnum
-}), array(ZoneRuleSchema).readonly()), method(object({
-	deviceId: number(),
-	stage: ZoneRuleStageEnum,
-	rules: array(ZoneRuleSchema).readonly()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), object({
-	motion: array(ZoneRuleSchema).readonly(),
-	detection: array(ZoneRuleSchema).readonly(),
-	package: array(ZoneRuleSchema).readonly()
-});
+/**
+* Runtime registry: cap-property-name → cap definition. `BaseDevice`'s
+* `state` getter looks up the cap definition here to construct a
+* `sliceProxy()` lazily on first access. Generated alongside the type
+* so type and runtime registry can never drift apart.
+*/
+var DEVICE_LOCAL_STATE_CAPS = {
+	airQualitySensor: airQualitySensorCapability,
+	alarmPanel: alarmPanelCapability,
+	ambientLightSensor: ambientLightSensorCapability,
+	audioMetrics: audioMetricsCapability,
+	automationControl: automationControlCapability,
+	battery: batteryCapability,
+	binary: binaryCapability,
+	brightness: brightnessCapability,
+	cameraStreams: cameraStreamsCapability,
+	carbonMonoxide: carbonMonoxideCapability,
+	climateControl: climateControlCapability,
+	color: colorCapability,
+	connectivity: connectivityCapability,
+	consumables: consumablesCapability,
+	contact: contactCapability,
+	control: controlCapability,
+	cover: coverCapability,
+	dayNight: dayNightCapability,
+	deviceDiscovery: deviceDiscoveryCapability,
+	deviceStatus: deviceStatusCapability,
+	doorbell: doorbellCapability,
+	enumSensor: enumSensorCapability,
+	eventEmitter: eventEmitterCapability,
+	fanControl: fanControlCapability,
+	featureProbe: featureProbeCapability,
+	flood: floodCapability,
+	gas: gasCapability,
+	humidifier: humidifierCapability,
+	humiditySensor: humiditySensorCapability,
+	image: imageCapability,
+	imageSettings: imageSettingsCapability,
+	lawnMowerControl: lawnMowerControlCapability,
+	lockControl: lockControlCapability,
+	mediaPlayer: mediaPlayerCapability,
+	motion: motionCapability,
+	motionTrigger: motionTriggerCapability,
+	motionZones: motionZonesCapability,
+	nativeObjectDetection: nativeObjectDetectionCapability,
+	notifier: notifierCapability,
+	numericSensor: numericSensorCapability,
+	petFeeder: petFeederCapability,
+	powerMeter: powerMeterCapability,
+	presence: presenceCapability,
+	pressureSensor: pressureSensorCapability,
+	privacyMask: privacyMaskCapability,
+	ptzAutotrack: ptzAutotrackCapability,
+	sceneMonitor: sceneMonitorCapability,
+	scriptRunner: scriptRunnerCapability,
+	smoke: smokeCapability,
+	streamParams: streamParamsCapability,
+	switch: switchCapability,
+	tamper: tamperCapability,
+	temperatureSensor: temperatureSensorCapability,
+	update: updateCapability,
+	vacuumControl: vacuumControlCapability,
+	valve: valveCapability,
+	vibration: vibrationCapability,
+	waterHeater: waterHeaterCapability,
+	weather: weatherCapability,
+	zoneAnalytics: zoneAnalyticsCapability,
+	zoneRules: {
+		name: "zone-rules",
+		scope: "device",
+		mode: "singleton",
+		deviceTypes: [DeviceType.Camera],
+		methods: {
+			/** Read the full rule list for a given stage (empty when no rules
+			*  are defined yet). */
+			listRules: method(object({
+				deviceId: number(),
+				stage: ZoneRuleStageEnum
+			}), array(ZoneRuleSchema).readonly()),
+			/** Bulk-replace the rule list for one stage. The provider validates
+			*  each entry against {@link ZoneRuleSchema} (zoneIds non-empty,
+			*  thresholds in range) and rejects the whole patch if any entry
+			*  is invalid — partial writes are a configuration footgun. */
+			setRules: method(object({
+				deviceId: number(),
+				stage: ZoneRuleStageEnum,
+				rules: array(ZoneRuleSchema).readonly()
+			}), _void(), {
+				kind: "mutation",
+				auth: "admin"
+			})
+		},
+		/**
+		* Runtime-state slice — every stage mirrored together so consumers
+		* see one reactive handle (`device.state.zoneRules.value`) instead
+		* of one per stage. Bulk-replace mutations on any stage write the full
+		* `{motion, detection, package}` shape, so subscribers always get the
+		* complete current set. Consumers that only care about one stage
+		* just read the matching property.
+		*
+		* `package` backs the package-drop detector — a package zone is a
+		* `ZoneRule` on the `'package'` stage referencing drawn polygons
+		* (see docs/superpowers/specs/2026-07-17-package-zones-design.md §3.1).
+		* The orchestrator provider writes this stage as a first-class slice
+		* (Phase 4): every mutation mirrors the full `{motion, detection,
+		* package}` shape, so consumers read the current package rules directly
+		* off `device.state.zoneRules.value.package`.
+		*/
+		runtimeState: object({
+			motion: array(ZoneRuleSchema).readonly(),
+			detection: array(ZoneRuleSchema).readonly(),
+			package: array(ZoneRuleSchema).readonly()
+		})
+	},
+	zones: zonesCapability
+};
+var BaseDevice = class {
+	id;
+	stableId;
+	type;
+	name;
+	parentDeviceId;
+	role;
+	/**
+	* Cap-keyed runtime-state slice is the single source of truth for
+	* `online`. Both getter and setter proxy to the slice — drivers can
+	* write `this.online = true` ergonomically, and the cap event fires
+	* automatically through the runtime-state writer. `markOnline()` is
+	* kept as the explicit method form mandated by `IDevice`.
+	*/
+	get online() {
+		return this.runtimeState.getCapState("device-status")?.online ?? false;
+	}
+	set online(value) {
+		this.markOnline(value);
+	}
+	/**
+	* Generic per-cap runtime-state namespace. One entry per cap with
+	* `runtimeState:` declared, auto-generated by codegen — see
+	* `device-local-state.ts`. Drivers access via:
+	*
+	*   `this.state.battery.sleeping = true`        // patches the battery slice
+	*   `const pct = this.state.battery.percentage` // reads the battery slice
+	*   `this.state.deviceStatus.online = true`     // mirrors `markOnline(true)`
+	*
+	* Adding a new cap with `runtimeState:` automatically extends this
+	* namespace — drivers don't have to declare proxies. Reads return
+	* `undefined` when the slice hasn't been seeded; writes patch via
+	* `runtimeState.patchCapState` and validate against the cap's schema
+	* (so partial writes need the slice to be seeded with the required
+	* fields first — drivers do this on cap registration).
+	*
+	* For caps not exposed in `DeviceLocalState`, drivers can build their
+	* own typed proxy via `this.sliceProxy(cap)`.
+	*/
+	get state() {
+		if (!this._stateProxyCache) {
+			const cache = {};
+			const handler = { get: (_target, key) => {
+				const k = key;
+				if (k in cache) return cache[k];
+				const cap = DEVICE_LOCAL_STATE_CAPS[k];
+				if (!cap) return void 0;
+				const proxy = this.sliceProxy(cap);
+				cache[k] = proxy;
+				return proxy;
+			} };
+			this._stateProxyCache = new Proxy(cache, handler);
+		}
+		return this._stateProxyCache;
+	}
+	_stateProxyCache;
+	config;
+	/**
+	* Per-device runtime state, cap-keyed. Always installed — slices
+	* for individual caps materialise as those caps register their
+	* native providers (`ctx.registerNativeCap`). The cap's own
+	* `runtimeState` schema is the source of truth for the slice
+	* shape; drivers don't redeclare it, they just write through.
+	*
+	* Read: `this.runtimeState.getCapState('battery')` →
+	*   `{percentage, charging, sleeping, lastUpdated}` for any
+	*   provider that registers `batteryCapability`.
+	* Write: `this.runtimeState.setCapState('battery', { … })`.
+	*
+	* Cross-process consumers reach this state through the
+	* `deviceState` cap router (or via cap-specific events the driver
+	* emits — e.g. `battery.onStatusChanged`). The local handle is
+	* accessed in-process by the driver to avoid roundtrips.
+	*/
+	runtimeState;
+	ctx;
+	/**
+	* Operator-organisational location label (room / area / zone).
+	* Read from `ctx.deviceMeta.location`; mutated via
+	* `kernel.devices.setLocation(id, value)`. Free-text — providers
+	* don't interpret it; the UI groups devices by this for filters
+	* like "show me all cameras in Kitchen". `null` when unset.
+	*/
+	location;
+	/**
+	* Soft-disabled flag. When `true`, the device class is still
+	* instantiated and visible in the UI (so the operator can flip
+	* back on without re-adding) but lifecycle hooks (publishToBroker,
+	* alarm-stream subscribe, …) MUST be gated by the driver to skip
+	* work. The `BaseDevice` enforces this by exposing the flag here;
+	* it does NOT mutate cap behaviour automatically — drivers consult
+	* `this.disabled` at the top of their lifecycle methods. Read from
+	* `ctx.deviceMeta.disabled`; mutated via
+	* `kernel.devices.setDisabled(id, value)`.
+	*/
+	disabled;
+	/**
+	* Cached materialised `SourceInfo` — either the value persisted under
+	* `metadata.sourceInfo` at construction time, or a synthetic
+	* `{ id: stableId, system: addonId }` for providers that haven't
+	* migrated yet. Lazily populated on first `sourceInfo` read so the
+	* cost of Zod-parsing the meta blob is paid once per device boot.
+	* Invalidated by `updateSourceInfo()` so providers see the new value
+	* back through the getter without a re-fetch from the meta surface.
+	*/
+	_sourceInfoCache = null;
+	constructor(ctx, schema, options) {
+		this.ctx = ctx;
+		this.id = ctx.id;
+		this.stableId = ctx.stableId;
+		this.type = options.type;
+		if (!ctx.deviceMeta) throw new Error(`BaseDevice constructor: ctx.deviceMeta is required (id=${ctx.id} stableId=${ctx.stableId})`);
+		this.name = ctx.deviceMeta.name;
+		this.location = ctx.deviceMeta.location;
+		this.disabled = ctx.deviceMeta.disabled;
+		this.role = options.role;
+		this.parentDeviceId = ctx.parentDeviceId;
+		const seedData = ctx.persistedConfig ?? {};
+		this.config = DeviceConfig.fromSchema(schema, (data) => ctx.persistConfig(data), seedData, ({ droppedKeys, issues }) => {
+			ctx.logger.warn("Device config recovery: dropping invalid persisted fields", {
+				tags: {
+					deviceId: ctx.id,
+					stableId: ctx.stableId
+				},
+				meta: {
+					droppedKeys: [...droppedKeys],
+					firstIssue: issues[0]?.message ?? null
+				}
+			});
+		});
+		let cachedProxy = null;
+		const writer = async (capName, slice) => {
+			if (!cachedProxy) cachedProxy = ctx.fetchDevice(ctx.id);
+			await (await cachedProxy).deviceState.setCapSlice({
+				capName,
+				slice
+			});
+		};
+		const initial = ctx.initialRuntimeState ?? {};
+		this.runtimeState = DeviceRuntimeState.fromInitial(initial, writer);
+		ctx.bindRuntimeState?.(this.runtimeState);
+		ctx.registerNativeCap?.(deviceStatusCapability, {});
+		const seed = {
+			online: true,
+			lastChangedAt: Date.now()
+		};
+		this.runtimeState.setCapState("device-status", seed);
+		ctx.registerNativeCap?.(featureProbeCapability, {});
+		this.runtimeState.setCapState("feature-probe", {
+			flags: {},
+			deviceType: null,
+			model: null,
+			channelCount: null,
+			lastProbedAt: 0,
+			lastFetchedAt: 0
+		});
+	}
+	deviceActions = /* @__PURE__ */ new Map();
+	/** Declare a device custom action + its typed handler. Idempotent per name. */
+	registerDeviceAction(name, spec, handler) {
+		this.deviceActions.set(name, {
+			spec,
+			handler
+		});
+	}
+	/** Invoke a registered device action. Validates input against the spec. */
+	async runDeviceAction(action, input) {
+		const entry = this.deviceActions.get(action);
+		if (!entry) throw new Error(`unknown device action "${action}" on device ${this.id}`);
+		const parsed = entry.spec.input.parse(input);
+		return entry.handler(parsed);
+	}
+	async removeDevice() {}
+	/**
+	* Set the device's online flag. Called by `BaseDeviceProvider` after
+	* aggregating per-profile stream-broker health, or directly by drivers
+	* that have provider-side liveness signals (e.g. ONVIF heartbeats,
+	* Reolink Baichuan firmware push events). Mirrors the new value into
+	* the `device-status` runtime-state slice so cross-process consumers
+	* pick it up via the standard cap-state channel. Subclasses can
+	* override to gate side effects on the transition.
+	*/
+	markOnline(online) {
+		if (this.online === online) return;
+		const next = {
+			online,
+			lastChangedAt: Date.now()
+		};
+		this.runtimeState.setCapState("device-status", next);
+	}
+	/**
+	* Upstream-system identity + rendering envelope for this device. See
+	* `SourceInfo` for the field contract. Always returns a valid object:
+	* if the persisted `metadata.sourceInfo` blob is absent or fails Zod
+	* validation, falls back to a synthetic `{ id: stableId, system: addonId }`
+	* so providers that haven't migrated keep working without code changes.
+	*
+	* The value is cached after the first read. `updateSourceInfo()`
+	* invalidates the cache so subsequent reads see the new patch. The
+	* returned object is frozen to prevent accidental in-place mutation —
+	* use `updateSourceInfo({ patch })` to change fields.
+	*/
+	get sourceInfo() {
+		if (this._sourceInfoCache) return this._sourceInfoCache;
+		const resolved = extractSourceInfoFromMetadata(this.ctx.deviceMeta.metadata) ?? synthesizeSourceInfo({
+			stableId: this.stableId,
+			addonId: this.ctx.deviceMeta.addonId
+		});
+		this._sourceInfoCache = Object.freeze({ ...resolved });
+		return this._sourceInfoCache;
+	}
+	/**
+	* Convenience accessor for the upstream dispatch key. Equivalent to
+	* `this.sourceInfo.id` — providers use this to keep a
+	* `Map<sourceId, IDevice>` for routing inbound push events.
+	*/
+	get sourceId() {
+		return this.sourceInfo.id;
+	}
+	/**
+	* Patch the device's `SourceInfo`. Shallow-merges `patch` over the
+	* current value, persists the merged result under
+	* `metadata.sourceInfo` via the `device-manager.setMetadata` cap, and
+	* emits `EventCategory.DeviceSourceInfoChanged` for live consumers.
+	*
+	* Safe to call from anywhere in the device's lifetime — the call is
+	* idempotent for `undefined` patch values (ignored) and best-effort
+	* for persistence (a transient device-manager error doesn't unwind
+	* the local cache update, so subsequent reads still see the patch).
+	*
+	* Drivers populate this on adoption + on every metadata change push
+	* from the upstream source. Subscribers (UI, export adapters) react
+	* via the `DeviceSourceInfoChanged` event without polling.
+	*/
+	async updateSourceInfo(patch) {
+		const next = mergeSourceInfo(this.sourceInfo, patch);
+		this._sourceInfoCache = Object.freeze({ ...next });
+		const action = this.ctx.api?.deviceManager?.setMetadata;
+		if (action) try {
+			await action.mutate({
+				deviceId: this.id,
+				patch: { [SOURCE_INFO_METADATA_KEY]: next }
+			});
+		} catch {}
+		this.ctx.eventBus.emit(createEvent("device.source-info-changed", {
+			type: "device",
+			id: this.stableId
+		}, {
+			deviceId: this.id,
+			sourceInfo: next
+		}));
+	}
+	/**
+	* Re-publish the device's current `features` array to the persisted
+	* meta blob. Drivers call this after a probe finishes when the live
+	* `features` getter has gained new flags (e.g. `hasIntercom` flips
+	* to true → `DeviceFeature.TwoWayAudio` joins the list).
+	*
+	* Without this, only the construction-time snapshot is written —
+	* `deviceManager.registerDevice` is invoked once per boot, so probe-
+	* driven additions don't reach the persisted index until the next
+	* server restart, and `getDevice` / `listAll` keep returning the
+	* stale list for forked-worker devices (whose live IDevice instance
+	* is invisible to the hub registry).
+	*
+	* Idempotent: re-calling with the same features just no-ops on the
+	* persisted meta. Best-effort: lookup or write failures are logged
+	* at debug and swallowed — the live `device.features` getter is
+	* still authoritative within this process, so callers never block
+	* device boot on a meta refresh.
+	*/
+	async refreshFeatures() {
+		const action = this.ctx.api?.deviceManager?.registerDevice;
+		if (!action) return;
+		try {
+			await action.mutate({
+				addonId: this.ctx.deviceMeta.addonId,
+				stableId: this.stableId,
+				id: this.id,
+				type: this.type,
+				name: this.name,
+				parentDeviceId: this.parentDeviceId,
+				features: [...this.features],
+				config: {}
+			});
+		} catch (err) {}
+	}
+	/**
+	* Typed read-through to a cap-keyed runtime-state slice. Drivers
+	* call `this.getCapSlice(batteryCapability)` and the return type
+	* is inferred from the cap's `runtimeState` Zod schema — no string
+	* key, no manual generic. Returns `null` when the slice hasn't
+	* been written yet (e.g. driver hasn't seeded battery yet).
+	*/
+	getCapSlice(cap) {
+		return this.runtimeState.getCapState(cap.name) ?? null;
+	}
+	/**
+	* Typed writer to a cap-keyed runtime-state slice. Routes through
+	* the runtime-state writer (validate → persist → emit cap event).
+	* Equivalent to `this.runtimeState.setCapState(cap.name, value)`
+	* but with the cap's `runtimeState` schema enforcing the value
+	* shape at compile time. Mirrors the symmetry of
+	* `getCapSlice` / `setCapSlice` for cross-cap consistency.
+	*/
+	setCapSlice(cap, value) {
+		this.runtimeState.setCapState(cap.name, value);
+	}
+	/**
+	* Field-level read/write proxy over a cap's runtime-state slice.
+	* Drivers that want ergonomic per-field access declare:
+	*
+	* ```ts
+	* protected battery = this.sliceProxy(batteryCapability)
+	* // …
+	* this.battery.sleeping = true        // patches the slice
+	* const charging = this.battery.charging  // reads the slice
+	* ```
+	*
+	* Reads return `undefined` when the slice hasn't been seeded yet
+	* (cap not registered, or seeded but the field is absent). Writes
+	* route through `runtimeState.patchCapState` so the cap's `runtimeState`
+	* schema validates the merged result and the cap event fires.
+	*
+	* Pattern is generic — same shape works for `battery`, `device-status`,
+	* `motion`, `doorbell`, anything with a `runtimeState:` schema. Drivers
+	* declare one proxy per cap they read/write directly.
+	*/
+	sliceProxy(cap) {
+		return new Proxy({}, {
+			get: (_, key) => {
+				return this.runtimeState.getCapState(cap.name)?.[key];
+			},
+			set: (_, key, value) => {
+				this.runtimeState.patchCapState(cap.name, { [key]: value });
+				return true;
+			},
+			has: (_, key) => {
+				const slice = this.runtimeState.getCapState(cap.name);
+				return slice ? key in slice : false;
+			},
+			ownKeys: () => {
+				const slice = this.runtimeState.getCapState(cap.name);
+				return slice ? Object.keys(slice) : [];
+			},
+			getOwnPropertyDescriptor: (_, key) => {
+				const slice = this.runtimeState.getCapState(cap.name);
+				if (!slice || !(key in slice)) return void 0;
+				return {
+					configurable: true,
+					enumerable: true,
+					value: slice[key]
+				};
+			}
+		});
+	}
+	/**
+	* Default empty settings UI. Drivers override this to expose an
+	* editable form in the device-details page. Returning an empty sections
+	* array signals "nothing to contribute" — the aggregator drops the
+	* contribution entirely rather than rendering a blank panel.
+	*/
+	getSettingsUISchema() {
+		return { sections: [] };
+	}
+	/**
+	* Default write path: forward the flat patch directly to storage.
+	* Drivers that project a UI shape different from storage (e.g. `RtspCamera`
+	* exposing `mainStreamUrl`/`subStreamUrl` over `streams[]`) override this
+	* to reshape before `config.setAll`.
+	*/
+	async applySettingsPatch(patch) {
+		await this.config.setAll(patch);
+	}
+	/**
+	* Phase 3 — populate device-scoped state needed by downstream phases
+	* (accessory reconciliation, public `features` array, optional cap
+	* registration). Called ONCE per construction, after register but
+	* before `getAccessoryChildren()`.
+	*
+	* Drivers write the `feature-probe` runtime-state slice via
+	* `this.runtimeState.setCapState('feature-probe', {...})` — flag bag
+	* is open (Reolink writes `hasPtz/hasIntercom`, Hikvision writes
+	* `hasSupplementalLight/hasAlarmIo`, etc).
+	*
+	* Default: nothing to probe → mark the device PROBED (set `lastProbedAt`) so
+	* the kernel treats it as ready immediately. A device that derives its shape
+	* from a spec (a container, or an accessory sensor) rather than from a
+	* hardware probe has no probe to "complete"; without stamping `lastProbedAt`
+	* it would look perpetually un-probed — logging "Initial probe did not
+	* complete" on every boot and spinning a pointless retry chain. Drivers that
+	* DO probe override this and write their own `feature-probe` slice (including
+	* `lastProbedAt`) once their probe actually succeeds.
+	*/
+	async onProbe() {
+		const base = this.runtimeState.getCapState("feature-probe") ?? {
+			flags: {},
+			deviceType: null,
+			model: null,
+			channelCount: null,
+			lastProbedAt: 0,
+			lastFetchedAt: 0
+		};
+		this.runtimeState.setCapState("feature-probe", {
+			...base,
+			lastProbedAt: Date.now()
+		});
+	}
+	/**
+	* Phase 5 — fired after the device + its accessories are registered.
+	* Drivers publish streams to the broker, kick off background tasks,
+	* or subscribe to lib events that need a fully-registered device id.
+	*
+	* Default: no-op.
+	*
+	* RENAMED FROM `onCreated` (which still exists for back-compat in this
+	* pass). The new name reflects the post-probe, post-accessory contract.
+	*/
+	async onActivate() {}
+	/**
+	* Re-run the probe + reconcile accessories + refresh features meta.
+	* Drivers call this when device-side state changes (battery cam wakes,
+	* firmware update, manual operator trigger).
+	*
+	* The kernel injects `_kernelReprobe` on registration so this method
+	* delegates to the same orchestrator that runs the boot-time phase
+	* 3 + 4 sequence. Drivers should NOT override this — they override
+	* `onProbe()` instead.
+	*/
+	async reprobe() {
+		if (this._kernelReprobe) await this._kernelReprobe();
+		else await this.onProbe();
+	}
+	/**
+	* Kernel-injected callback that runs the full post-probe orchestration
+	* (onProbe → registerDevice meta refresh → accessory reconciliation).
+	* Set by `device-cap-proxy.register()`. Drivers should not touch this
+	* directly — call `reprobe()` instead.
+	*/
+	_kernelReprobe;
+	/**
+	* Declare accessory child devices the kernel should auto-spawn
+	* after `onProbe()` resolves. Each spec fully describes one child
+	* — stableId suffix (deterministic per kind for restore-safety),
+	* meta (type / name / location), config (initial blob the child
+	* self-hydrates), and a factory that constructs the concrete
+	* class with whatever closure-captured refs it needs (typically
+	* `this` for the parent reference).
+	*
+	* The kernel handles the rest: allocateDeviceId, persistInitialConfig
+	* (skipped on restore when the row already exists),
+	* persistInitialMeta, createContext, factory invocation, register,
+	* and recursive lifecycle (probe + accessories + activate).
+	*
+	* Implementations should derive children from
+	* `this.runtimeState.getCapState('feature-probe')` (post-probe truth).
+	* Drivers can use the `getProbeFlags()` helper to read the flag bag
+	* with a typed cast.
+	*
+	* Default: no children.
+	*/
+	getAccessoryChildren() {
+		return [];
+	}
+	/**
+	* Read the current feature-probe flag bag with a typed cast. Helper
+	* for `getAccessoryChildren()` and `features` getters that derive
+	* outputs from the probe results.
+	*/
+	getProbeFlags() {
+		return this.runtimeState.getCapState("feature-probe")?.flags ?? {};
+	}
+	/**
+	* Returns true once `onProbe` has completed at least once
+	* (`lastProbedAt > 0`). Drivers gate `getAccessoryChildren()` on this
+	* to avoid spawning stale accessories on a fresh device whose probe
+	* hasn't landed yet.
+	*/
+	hasProbed() {
+		return (this.runtimeState.getCapState("feature-probe")?.lastProbedAt ?? 0) > 0;
+	}
+};
 var ProviderStatusSchema = object({
 	connected: boolean(),
 	deviceCount: number(),
@@ -15688,6 +18558,10 @@ method(ListInputSchema, array(BrokerInfoSchema$1)), method(GetInputSchema, Broke
 	auth: "admin"
 }), method(GetStateInputSchema, unknown().nullable()), method(_void(), RegistryStatusSchema);
 DeviceType.Camera;
+/** kebab-case cap name → camelCase router-map key. */
+function kebabToCamel(s) {
+	return s.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+}
 /**
 * Identity — preserves literal types for downstream inference.
 *
@@ -27741,4 +30615,4 @@ Object.freeze({
 	"smtp-provider": "email"
 });
 //#endregion
-export { subKindsOf as A, array as B, defineCustomActions as C, notificationRulesCapability as D, hfModelUrl as E, DeviceType as F, string as G, literal as H, createEvent as I, EventCategory as K, hydrateSchema as L, zoneAnalyticsCapability as M, errMsg as N, pipelineAnalyticsCapability as O, BaseAddon as P, nodePin as R, customAction as S, faceGalleryCapability as T, number as U, boolean as V, object as W, TimelapseRuleSchema as _, NC_CONDITION_CATALOG as a, buildEventKindDescriptor as b, NcRuleInputSchema as c, NcSnoozeInputSchema as d, NcSnoozeSchema as f, TimelapseRuleInputSchema as g, OpsLogEntrySchema as h, MACRO_LABELS as i, videoclipsCapability as j, plateGalleryCapability as k, NcRulePatchSchema as l, NcTaxonomySchema as m, EVENT_KIND_BY_CAP as n, NC_TAXONOMY as o, NcSnoozeSuppressedSchema as p, EVENT_PAD_MS as r, NcConditionDescriptorSchema as s, DEFAULT_EVENT_COLOR as t, NcRuleSchema as u, addonWidgetsSourceCapability as v, embeddingEncoderCapability as w, cosineSimilarity as x, audioMetricsCapability as y, _enum as z };
+export { EventCategory as $, notificationRulesCapability as A, createEvent as B, cosineSimilarity as C, faceGalleryCapability as D, embeddingEncoderCapability as E, videoclipsCapability as F, array as G, isDeviceScopedCap as H, zoneAnalyticsCapability as I, number as J, boolean as K, errMsg as L, plateGalleryCapability as M, readDeviceStateFrom as N, hfModelUrl as O, subKindsOf as P, unknown as Q, BaseAddon as R, buildEventKindDescriptor as S, defineCustomActions as T, nodePin as U, hydrateSchema as V, _enum as W, record as X, object as Y, string as Z, TimelapseRuleInputSchema as _, MACRO_LABELS as a, alarmPanelCapability as b, NcConditionDescriptorSchema as c, NcRuleSchema as d, NcSnoozeInputSchema as f, OpsLogEntrySchema as g, NcTaxonomySchema as h, EVENT_PAD_MS as i, pipelineAnalyticsCapability as j, kebabToCamel as k, NcRuleInputSchema as l, NcSnoozeSuppressedSchema as m, DEFAULT_EVENT_COLOR as n, NC_CONDITION_CATALOG as o, NcSnoozeSchema as p, literal as q, EVENT_KIND_BY_CAP as r, NC_TAXONOMY as s, BaseDevice as t, NcRulePatchSchema as u, TimelapseRuleSchema as v, customAction as w, audioMetricsCapability as x, addonWidgetsSourceCapability as y, DeviceType as z };