@camstack/addon-post-analysis 1.2.51 → 1.2.53

package/dist/{dist-CnSzKo7x.js → dist-DGdY1GSf.js}

@@ -19,7 +19,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	value: mod,
 	enumerable: true
 }) : target, mod));
-require("node:crypto");
+//#endregion
 //#region ../types/dist/event-category-41fKf-q9.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
@@ -7157,473 +7157,6 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }
 //#endregion
-//#region ../types/dist/fmp4-box-splitter-B53u9-Nu.mjs
-var AUDIO_ENCODER_BY_CODEC = {
-	opus: "libopus",
-	aac: "aac",
-	pcmu: "pcm_mulaw",
-	pcma: "pcm_alaw"
-};
-/**
-* Camera-microphone audio, per codec. Lives HERE rather than in
-* `encode-defaults.ts` only to avoid an import cycle (`encode-defaults` depends
-* on these types); it is re-exported from there, which is where to read it.
-*
-* Every source in this repo is a mono camera mic. The former broker preset
-* encoded Opus at `channels: 2`, spending bitrate duplicating one channel —
-* that is the value this consolidation changed.
-*/
-var AUDIO_PRESETS = {
-	aac: {
-		kind: "encode",
-		codec: "aac",
-		bitrateKbps: 128,
-		sampleRateHz: 48e3,
-		channels: 1
-	},
-	opus: {
-		kind: "encode",
-		codec: "opus",
-		bitrateKbps: 64,
-		sampleRateHz: 48e3,
-		channels: 1
-	},
-	pcmu: {
-		kind: "encode",
-		codec: "pcmu",
-		sampleRateHz: 8e3,
-		channels: 1
-	}
-};
-/** `-hide_banner -loglevel <level>` — every ffmpeg site opens with this. */
-function logBannerArgs(level) {
-	return [
-		"-hide_banner",
-		"-loglevel",
-		level
-	];
-}
-/** `true` when the resolved value means "decode in software" (⇒ no `-hwaccel`). */
-function isSoftwareDecode(decodeHwAccel) {
-	return !decodeHwAccel || decodeHwAccel === "none" || decodeHwAccel === "copy";
-}
-/**
-* Every INPUT option, in order, terminated by `-i <url>`. Nothing may be
-* appended to this list by a caller — that is the whole point of the function.
-*/
-function buildInputArgs(input, decodeHwAccel) {
-	const args = [];
-	if (!isSoftwareDecode(decodeHwAccel)) args.push("-hwaccel", String(decodeHwAccel));
-	if (input.extraArgs?.length) args.push(...input.extraArgs);
-	if (input.analyzeDurationUs !== void 0) args.push("-analyzeduration", String(input.analyzeDurationUs));
-	if (input.probeSizeBytes !== void 0) args.push("-probesize", String(input.probeSizeBytes));
-	if (input.fflags?.length) for (const flag of input.fflags) args.push("-fflags", flag);
-	if (input.rtspTransport) args.push("-rtsp_transport", input.rtspTransport);
-	args.push("-i", input.url);
-	return args;
-}
-/** The `-vf` filter args, or `[]` when a consumer `-vf` already claims the slot. */
-function buildVideoFilterArgs(scale, outputArgs) {
-	if (!scale) return [];
-	if (outputArgs.some((a) => a === "-vf")) return [];
-	if (scale.mode === "exact") return ["-vf", `scale=${scale.width}:${scale.height}`];
-	return ["-vf", `scale='min(${scale.width},iw)':'min(${scale.height},ih)':force_original_aspect_ratio=decrease:force_divisible_by=2`];
-}
-/** Rate-control args for an encode plan. */
-function buildRateControlArgs(video) {
-	const kbps = video.bitrateKbps;
-	if (kbps === void 0) return [];
-	const rc = video.rateControl ?? {
-		kind: "cap",
-		vbvSeconds: 2
-	};
-	const bufsize = Math.max(1, Math.round(kbps * rc.vbvSeconds));
-	return [
-		...rc.kind === "cbr" ? ["-b:v", `${kbps}k`] : [],
-		"-maxrate",
-		`${kbps}k`,
-		"-bufsize",
-		`${bufsize}k`
-	];
-}
-/** The whole video block (`-vf` … `-c:v` … knobs), after `-i`. */
-function buildVideoArgs(video, outputArgs) {
-	if (video.kind === "copy") return [
-		"-c:v",
-		"copy",
-		...video.bitstreamFilter ? ["-bsf:v", video.bitstreamFilter] : []
-	];
-	const args = [
-		...buildVideoFilterArgs(video.scale, outputArgs),
-		"-c:v",
-		video.encoder
-	];
-	if (video.preset !== void 0) args.push("-preset", video.preset);
-	if (video.tune !== void 0) args.push("-tune", video.tune);
-	if (video.profile !== void 0) args.push("-profile:v", video.profile);
-	if (video.level !== void 0) args.push("-level", video.level);
-	if (video.pixelFormat !== void 0) args.push("-pix_fmt", video.pixelFormat);
-	if (video.fps !== void 0) args.push("-r", String(video.fps));
-	if (video.gopFrames !== void 0) args.push("-g", String(video.gopFrames));
-	if (video.forceKeyFramesSeconds !== void 0) args.push("-force_key_frames", `expr:gte(t,n_forced*${video.forceKeyFramesSeconds})`);
-	if (video.bf !== void 0) args.push("-bf", String(video.bf));
-	args.push(...buildRateControlArgs(video));
-	if (video.bitstreamFilter !== void 0) args.push("-bsf:v", video.bitstreamFilter);
-	return args;
-}
-/** The whole audio block, after `-i`. */
-function buildAudioArgs(audio) {
-	if (audio.kind === "none") return ["-an"];
-	if (audio.kind === "copy") return ["-c:a", "copy"];
-	const args = [];
-	if (audio.filter !== void 0) args.push("-af", audio.filter);
-	args.push("-c:a", AUDIO_ENCODER_BY_CODEC[audio.codec]);
-	if (audio.application !== void 0) args.push("-application", audio.application);
-	if (audio.frameDurationMs !== void 0) args.push("-frame_duration", String(audio.frameDurationMs));
-	if (audio.globalHeader === true) args.push("-flags", "+global_header");
-	if (audio.sampleRateHz !== void 0) args.push("-ar", String(audio.sampleRateHz));
-	if (audio.bitrateKbps !== void 0) args.push("-b:a", `${audio.bitrateKbps}k`);
-	if (audio.vbvBufferKbits !== void 0) args.push("-bufsize", `${audio.vbvBufferKbits}k`);
-	if (audio.channels !== void 0) args.push("-ac", String(audio.channels));
-	return args;
-}
-/** RTP output-leg args (`-payload_type`, `-ssrc`, `-sdp_file`, `-f rtp <url>`). */
-function buildRtpOutputArgs(out) {
-	const args = [];
-	if (out.payloadType !== void 0) args.push("-payload_type", String(out.payloadType));
-	if (out.ssrc !== void 0) args.push("-ssrc", String(out.ssrc));
-	if (out.sdpFile !== void 0) args.push("-sdp_file", out.sdpFile);
-	args.push("-f", "rtp", out.url);
-	return args;
-}
-/** `true` when the sink is a raw elementary bytestream that cannot mux audio. */
-function isElementaryVideoSink(sink) {
-	return sink.kind === "stdout" && (sink.container === "h264" || sink.container === "hevc");
-}
-/**
-* The fragmented-MP4 muxer flags, in the order the recorder has proven them
-* (`recorder/addon/ffmpeg-args.ts` passes the same `movflags` string through
-* `-segment_format_options`, across every vendor in the fleet):
-*
-* - `frag_keyframe` — cut a fragment at each key frame, so every fragment
-*   opens on a sync sample. HKSV's whole requirement.
-* - `empty_moov` — write `ftyp`+`moov` up front with no samples in it, which
-*   is what makes the head a standalone INITIALISATION segment.
-* - `default_base_moof` — fragment offsets are self-relative, so a fragment is
-*   demuxable without the bytes that preceded it. D31's byte-range read path
-*   depends on exactly this property of the recorder's segments.
-*/
-var FMP4_MOVFLAGS = "+frag_keyframe+empty_moov+default_base_moof";
-/**
-* The terminal sink args for every non-`rtp-outputs` sink. Exhaustive over the
-* union so a new member cannot fall through to `['-f', container, 'pipe:1']`,
-* which is what a plain `container` read would have done for `mp4` — a valid
-* argv that writes a NON-fragmented, unseekable-to-a-pipe MP4 and produces one
-* unusable byte stream.
-*/
-function buildStdoutOrRtspSinkArgs(sink) {
-	if (sink.kind === "rtsp-listen") return [
-		"-f",
-		"rtsp",
-		"-rtsp_transport",
-		"tcp",
-		"-rtsp_flags",
-		"listen",
-		sink.url
-	];
-	if (sink.kind === "rtp-outputs") return [];
-	return sink.container === "mp4" ? buildFmp4SinkArgs(sink) : [
-		"-f",
-		sink.container,
-		"pipe:1"
-	];
-}
-/**
-* How far BELOW the negotiated fragment length `-min_frag_duration` is set.
-*
-* `-min_frag_duration` refuses to cut before that much media has accumulated,
-* and then waits for the next key frame. Set to exactly `fragmentMs`, the
-* commonest camera configuration in existence — a key-frame grid EQUAL to the
-* requested fragment length — lands the deadline on the same instant as the key
-* frame, loses the race, and skips to the following one: **every fragment comes
-* out at twice the requested length.**
-*
-* Measured on the live fleet 2026-08-07, camera 615, `-c:v copy` (D84):
-*
-* | slot | GOP | `-min_frag_duration` | median gap |
-* | --- | --- | --- | --- |
-* | 1280×720 | 40 f @ 10 fps = 4.0 s | 4000 ms | **7944 ms** |
-* | 1280×720 | 40 f @ 10 fps = 4.0 s | 3600 ms | 3973 ms |
-* | 3840×2160 | 100 f @ 25 fps = 4.0 s | 4000 ms | 8042 ms |
-* | 3840×2160 | 100 f @ 25 fps = 4.0 s | 3600 ms | 3998 ms |
-*
-* A doubled fragment is not a cosmetic overshoot: HKSV requires every fragment
-* to be no longer than the length the controller SELECTED, so the shipped-but-
-* inert phase-1 sink would have violated the contract on its first real clip.
-*
-* 10 % is chosen against the two failures either side of it. Too small and
-* ordinary jitter (measured spread 3953-4096 ms) re-loses the race; too large
-* and a source with a key frame slightly EARLY than the grid gets cut there,
-* yielding a short fragment for no reason.
-*/
-var FMP4_MIN_FRAG_MARGIN = .9;
-/** `-movflags … -min_frag_duration <us> -f mp4 pipe:1`. */
-function buildFmp4SinkArgs(sink) {
-	return [
-		"-movflags",
-		FMP4_MOVFLAGS,
-		"-min_frag_duration",
-		String(Math.max(0, Math.round(sink.fragmentMs * FMP4_MIN_FRAG_MARGIN * 1e3))),
-		"-f",
-		"mp4",
-		"pipe:1"
-	];
-}
-/**
-* A second output mapping source audio to RTP-over-UDP. `0:a:0?` makes the
-* audio optional so a source with no audio skips it instead of failing the
-* whole invocation.
-*/
-function buildAudioSidecarArgs(sidecar) {
-	return [
-		"-map",
-		"0:a:0?",
-		...buildAudioArgs(sidecar.codec === "pcma" ? {
-			kind: "encode",
-			codec: "pcma",
-			sampleRateHz: 8e3,
-			channels: 1
-		} : AUDIO_PRESETS[sidecar.codec]),
-		...buildRtpOutputArgs({
-			url: sidecar.rtpUrl,
-			sdpFile: sidecar.sdpFile
-		})
-	];
-}
-/**
-* Assemble the full ffmpeg argument list. Layout:
-*
-*   -hide_banner -loglevel <level>
-*   [-hwaccel <backend|auto>]        ─┐ INPUT options — strictly before -i.
-*   [<input.extraArgs>]               │
-*   [-fflags <flag>…]                 │
-*   [-rtsp_transport tcp]             │
-*   -i <url>                         ─┘
-*   <video block>  <threads>  <audio block>   ─┐ OUTPUT options.
-*   <consumer outputArgs verbatim>             │
-*   <sink>                                    ─┘ terminal
-*/
-function buildFfmpegArgs(inv) {
-	const head = [...logBannerArgs(inv.logLevel), ...buildInputArgs(inv.input, inv.decodeHwAccel)];
-	const threadArgs = inv.threadCount > 0 ? ["-threads", String(inv.threadCount)] : [];
-	if (inv.sink.kind === "rtp-outputs") {
-		const videoLeg = inv.sink.video ? [
-			"-an",
-			"-map",
-			"0:v:0",
-			...buildVideoArgs(inv.video, inv.outputArgs),
-			...threadArgs,
-			...inv.outputArgs,
-			...buildRtpOutputArgs(inv.sink.video)
-		] : [];
-		const audioLeg = inv.sink.audio ? [
-			"-vn",
-			"-map",
-			"0:a:0?",
-			...buildAudioArgs(inv.audio),
-			...buildRtpOutputArgs(inv.sink.audio)
-		] : [];
-		return [
-			...head,
-			...videoLeg,
-			...audioLeg
-		];
-	}
-	const audioArgs = isElementaryVideoSink(inv.sink) ? ["-an"] : buildAudioArgs(inv.audio);
-	const sinkArgs = buildStdoutOrRtspSinkArgs(inv.sink);
-	return [
-		...head,
-		...buildVideoArgs(inv.video, inv.outputArgs),
-		...threadArgs,
-		...audioArgs,
-		...inv.outputArgs,
-		...sinkArgs,
-		...inv.audioSidecar ? buildAudioSidecarArgs(inv.audioSidecar) : []
-	];
-}
-var DEFAULT_MAX_UNIT_BYTES = 16 * 1024 * 1024;
-/** Header size for a normal box, and for one carrying a 64-bit `largesize`. */
-var BOX_HEADER_BYTES = 8;
-var LARGE_BOX_HEADER_BYTES = 16;
-var Fmp4BoxSplitter = class {
-	maxUnitBytes;
-	/** Bytes of the CURRENT unit plus any partial box after it. */
-	buffer = new Uint8Array(0);
-	/** Where the current unit starts inside {@link buffer}. */
-	unitStart = 0;
-	/** Where the box scanner has reached inside {@link buffer}. */
-	cursor = 0;
-	state = "init";
-	nextSequence = 0;
-	faultReason = null;
-	interstitial = /* @__PURE__ */ new Set();
-	constructor(options = {}) {
-		this.maxUnitBytes = options.maxUnitBytes ?? DEFAULT_MAX_UNIT_BYTES;
-	}
-	/**
-	* Non-null once the stream cannot be split. The splitter emits nothing
-	* further, so a caller polls this to kill the child rather than watching a
-	* silent stall — a fragmenter that quietly stops producing looks exactly like
-	* a camera with no motion.
-	*/
-	get fault() {
-		return this.faultReason;
-	}
-	/** Bytes currently held. The memory bound, observable rather than asserted. */
-	get pendingBytes() {
-		return this.buffer.length - this.unitStart;
-	}
-	/**
-	* Top-level box types seen BETWEEN fragments and discarded — `mfra`, `free`,
-	* a stray `sidx`. Reported rather than dropped in silence: they are legal and
-	* useless to a fragment consumer, but a type nobody expected showing up here
-	* is the first symptom of a muxer that is not writing what we think it is.
-	*/
-	get discardedInterstitialTypes() {
-		return [...this.interstitial];
-	}
-	/**
-	* Feed bytes; get back whatever units completed. Returns `[]` once faulted.
-	*/
-	push(chunk) {
-		if (this.faultReason !== null || chunk.length === 0) return [];
-		this.append(chunk);
-		if (this.pendingBytes > this.maxUnitBytes) return this.fail(`a single fMP4 unit exceeded ${this.maxUnitBytes} bytes — this stream is not fragmented`);
-		return this.drainBoxes();
-	}
-	append(chunk) {
-		if (this.buffer.length === 0) {
-			this.buffer = chunk.slice();
-			return;
-		}
-		const next = new Uint8Array(this.buffer.length + chunk.length);
-		next.set(this.buffer, 0);
-		next.set(chunk, this.buffer.length);
-		this.buffer = next;
-	}
-	/** Consume every COMPLETE top-level box now in the buffer. */
-	drainBoxes() {
-		const units = [];
-		for (;;) {
-			const header = this.readHeader();
-			if (this.faultReason !== null) return units;
-			if (header === null) break;
-			if (this.cursor + header.totalBytes > this.buffer.length) break;
-			const boxStart = this.cursor;
-			const boxEnd = boxStart + header.totalBytes;
-			this.cursor = boxEnd;
-			const unit = this.consumeBox(header.type, boxStart, boxEnd);
-			if (this.faultReason !== null) return units;
-			if (unit !== null) units.push(unit);
-		}
-		this.compact();
-		return units;
-	}
-	/**
-	* Apply one box to the state machine. Returns a unit when this box CLOSED
-	* one, `null` otherwise.
-	*/
-	consumeBox(type, boxStart, boxEnd) {
-		if (this.state === "init") {
-			if (type !== "moof") return null;
-			if (boxStart === this.unitStart) {
-				this.fail("a moof arrived before any initialisation box — there is no ftyp/moov to send");
-				return null;
-			}
-			const init = this.emit("init", this.unitStart, boxStart);
-			this.unitStart = boxStart;
-			this.state = "fragment";
-			return init;
-		}
-		if (this.state === "idle") {
-			if (type !== "moof") {
-				this.interstitial.add(type);
-				this.unitStart = boxEnd;
-				return null;
-			}
-			this.unitStart = boxStart;
-			this.state = "fragment";
-			return null;
-		}
-		if (type !== "mdat") return null;
-		const fragment = this.emit("fragment", this.unitStart, boxEnd);
-		this.unitStart = boxEnd;
-		this.state = "idle";
-		return fragment;
-	}
-	/**
-	* Parse the header at {@link cursor}, or `null` when too few bytes have
-	* arrived to know. Faults on a size the splitter cannot honour.
-	*/
-	readHeader() {
-		const available = this.buffer.length - this.cursor;
-		if (available < BOX_HEADER_BYTES) return null;
-		const view = new DataView(this.buffer.buffer, this.buffer.byteOffset, this.buffer.byteLength);
-		const size = view.getUint32(this.cursor);
-		const type = String.fromCharCode(this.buffer[this.cursor + 4] ?? 0, this.buffer[this.cursor + 5] ?? 0, this.buffer[this.cursor + 6] ?? 0, this.buffer[this.cursor + 7] ?? 0);
-		if (size === 0) {
-			this.fail(`box "${type}" declares size 0 (to EOF) — an unbounded box cannot be fragmented`);
-			return null;
-		}
-		if (size === 1) {
-			if (available < LARGE_BOX_HEADER_BYTES) return null;
-			const large = view.getBigUint64(this.cursor + BOX_HEADER_BYTES);
-			if (large > BigInt(this.maxUnitBytes)) {
-				this.fail(`box "${type}" declares ${large} bytes, over the ${this.maxUnitBytes} byte bound`);
-				return null;
-			}
-			return {
-				type,
-				totalBytes: Number(large)
-			};
-		}
-		if (size < BOX_HEADER_BYTES) {
-			this.fail(`box "${type}" declares an impossible size of ${size} bytes`);
-			return null;
-		}
-		return {
-			type,
-			totalBytes: size
-		};
-	}
-	emit(kind, start, end) {
-		const sequence = this.nextSequence;
-		this.nextSequence += 1;
-		return {
-			kind,
-			data: this.buffer.slice(start, end),
-			sequence
-		};
-	}
-	/**
-	* Drop everything already emitted or discarded. Without this the buffer is
-	* the whole stream and the process dies in hours, not minutes.
-	*/
-	compact() {
-		if (this.unitStart === 0) return;
-		this.buffer = this.buffer.slice(this.unitStart);
-		this.cursor -= this.unitStart;
-		this.unitStart = 0;
-	}
-	fail(reason) {
-		this.faultReason = reason;
-		this.buffer = new Uint8Array(0);
-		this.unitStart = 0;
-		this.cursor = 0;
-		return [];
-	}
-};
-//#endregion
 //#region ../types/dist/err-msg-IQTHeDzc.mjs
 /**
 import { errMsg } from '@camstack/types'
@@ -9645,6 +9178,69 @@ var StreamFormatSchema = _enum([
 	"mjpeg",
 	"rtsp"
 ]);
+/** A container `produceEventMedia` can emit. */
+var EventMediaKindSchema = _enum(["mp4", "gif"]);
+/**
+* One produced artifact, referenced by HANDLE.
+*
+* Never inline bytes: a produced clip is 200 KB–5 MB and every consumer of this
+* method is in another runner ([D9](../../../../docs/decisions/adr-0009.md),
+* [D18](../../../../docs/decisions/adr-0018.md) — cross-process media is fetched
+* on demand, compressed, by handle). `bytes` is here so a caller can decide
+* whether it wants the fetch at all.
+*/
+var EventMediaArtifactSchema = object({
+	kind: EventMediaKindSchema,
+	/** Opaque, single-camera, short-lived. Redeem with `fetchEventMedia`. */
+	handle: string(),
+	/**
+	* The node holding the bytes — the ROUTING key for `fetchEventMedia`.
+	*
+	* `stream-broker` is a singleton cap and an unpinned call never leaves the
+	* hub, so a handle produced on an agent's broker would be redeemed against
+	* the hub's store and come back `null`. Same contract, same field name and
+	* the same reason as `FrameHandleSchema.nodeId`: the producer stamps where it
+	* lives and the consumer pins to it.
+	*/
+	nodeId: string(),
+	mime: string(),
+	bytes: number().int(),
+	width: number().int(),
+	height: number().int()
+});
+/**
+* What a production actually covered — the answer to the only question an
+* operator asks about a notification clip.
+*
+* `fromTs`/`toTs` are WALL CLOCK, derived from the ring's own packet timeline,
+* so a caller can state "this clip starts 4.1 s before the event" instead of
+* inferring it from a duration. A production whose `fromTs` is later than the
+* event is a production with no pre-roll, and that is exactly the defect this
+* method exists to make visible rather than plausible.
+*/
+var EventMediaCoverageSchema = object({
+	fromTs: number(),
+	toTs: number(),
+	/** Encoded packets in the muxed window. */
+	packets: number().int()
+});
+/**
+* The result of ONE cut, in every container the caller asked for.
+*
+* Every artifact in `media` came out of the SAME window of the SAME rendition —
+* that is the whole reason this is one method rather than one call per format.
+* A consumer attaching a gif and a video can no longer show two different
+* moments, because it never chose two sources.
+*/
+var EventMediaProductionSchema = object({
+	media: array(EventMediaArtifactSchema).readonly(),
+	coverage: EventMediaCoverageSchema,
+	/** The rendition actually cut from — what the default or the fallback chose. */
+	profile: CamProfileSchema,
+	/** `copy` = the camera's own H.264, untouched. `encode` = re-encoded (H.265
+	*  source, a downscale, or a playback rate other than 1). */
+	video: _enum(["copy", "encode"])
+});
 var RtspRestreamEntrySchema = object({
 	brokerId: string(),
 	url: string(),
@@ -10044,6 +9640,56 @@ method(object({
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	/** Absent = the largest H.264 rendition at or below 1080p, which is
+	*  also the one that can be copied. Falls back to whatever the ring
+	*  actually retained, and the answer says which. */
+	profile: CamProfileSchema.optional(),
+	aroundMs: number(),
+	preSeconds: number().min(0).max(20).default(4),
+	postSeconds: number().min(0).max(20).default(6),
+	kinds: array(EventMediaKindSchema).min(1).default(["mp4"]),
+	/** GIF geometry. The video keeps the source's own. */
+	gifMaxWidth: number().int().min(120).max(1280).default(640),
+	/**
+	* The gif's own PLAYBACK rate in frames per second — what the finished
+	* gif runs at, not how many source frames feed it. The decimation that
+	* feeds it samples `gifFps / gifSpeed` source frames per second, so at
+	* the defaults a 12 fps gif is built out of 3 source frames a second.
+	*/
+	gifFps: number().int().min(1).max(15).default(12),
+	/**
+	* How fast the GIF plays against real time, independent of `speed`.
+	*
+	* 4× by default, by operator request: a notification gif is glanced at
+	* on a lock screen, so a ~12 s window has to be over in ~3 s. It stays
+	* a separate knob from `speed` even though both now default to 4 —
+	* a caller wanting a real-time video and a fast gif must not have to
+	* choose.
+	*/
+	gifSpeed: number().min(1).max(8).default(4),
+	/**
+	* Playback rate of the VIDEO. Also 4× by default, by operator decision.
+	*
+	* `1` is real time and is the ONLY value that allows the copy branch —
+	* anything else forces `libx264` over the window. That was priced
+	* before it was chosen: a per-event burst measured at 0.23 s and 254 KB
+	* on a real 615 720p cut, against 922 KB for the copy it replaces. A
+	* re-encode is capped at 720p (`EVENT_CLIP_ENCODE_MAX_WIDTH`), because
+	* once the decode is forced the width stops being free.
+	*/
+	speed: number().min(1).max(8).default(4)
+}), EventMediaProductionSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ handle: string() }), object({
+	base64: string(),
+	mime: string(),
+	bytes: number().int()
+}).nullable(), {
+	kind: "mutation",
+	auth: "admin"
 }), method(_void(), array(CameraStreamSchema).readonly()), method(_void(), array(ProfileSlotSchema).readonly()), method(object({ brokerId: string() }), BrokerStatsSchema), method(object({ brokerId: string() }), object({
 	probed: boolean(),
 	summary: string()
@@ -10335,25 +9981,6 @@ var cameraStreamsCapability = {
 function kebabToCamel(s) {
 	return s.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
 }
-/**
-* core-blocks — user-authored TypeScript, stored in the kernel and executed in
-* its own process.
-*
-* Spec: `docs/superpowers/specs/2026-08-04-core-blocks-and-synthetic-devices-design.md`.
-*
-* The first use is **owning devices without being a device provider**: a block
-* declares devices under a system or custom integration and drives their state,
-* with the same `ctx` an addon gets. Automations come later; nothing here
-* models a trigger.
-*
-* **Stated plainly, because it does not change by being true:** a block has an
-* addon's powers — devices, storage, the event bus, `ctx.api`. It is a plugin
-* with no review step. What makes that survivable is not a sandbox, it is
-* PROCESS ISOLATION: one process per block, supervised by `CrashSupervisor`,
-* so a block that throws or never returns is marked `failed` and visible
-* instead of taking the hub with it (D6). Every method here is admin-only, and
-* must stay so.
-*/
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
@@ -10425,6 +10052,9 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 }), object({ block: CoreBlockSchema }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ blockId: string() }), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ code: string() }), CoreBlockCompileResultSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -11225,840 +10855,159 @@ var ExposeInputSchema = object({
 });
 var UnexposeInputSchema = object({ deviceId: string() });
 method(_void(), DeviceExportStatusSchema), method(_void(), array(DeviceKindSchema)), method(_void(), array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), { kind: "mutation" }), method(UnexposeInputSchema, _void(), { kind: "mutation" });
+var ProviderStatusSchema = object({
+	connected: boolean(),
+	deviceCount: number(),
+	error: string().optional()
+});
+object({
+	externalId: string(),
+	name: string(),
+	type: string(),
+	metadata: record(string(), unknown()).optional()
+});
 /**
-* Resource-bound constants for the safe expression engine.
-*
-* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
-* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
-* O(nodeCount) by construction. These caps merely put a hard ceiling on the
-* work a single author-supplied expression can request, so a hostile or
-* accidental pathological string can never spend unbounded CPU/memory.
+* Candidate handed back from discovery and accepted by
+* `adoptDiscoveredDevice`. Shape mirrors the in-process
+* `DiscoveredDevice` interface used by `DeviceDiscovery`.
 */
-/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
-*  rejected without allocation. */
-var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
-/** A legal binding / identifier name. */
-var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Binding names an author may NOT use: `now` is auto-injected; the literal
-*  keywords lex as values, not identifiers, so binding to them is meaningless. */
-var RESERVED_BINDING_NAMES = new Set([
-	"now",
-	"true",
-	"false",
-	"null"
-]);
+var DiscoveryCandidateSchema = object({
+	stableId: string(),
+	type: _enum(DeviceType),
+	suggestedName: string(),
+	prefilledConfig: record(string(), unknown()),
+	/**
+	* Optional upstream-system identity (HA entity_id, vendor MAC, …).
+	* Discovery pre-populates this for systems that know the upstream
+	* identity ahead of adoption. Rendering metadata (unit, precision)
+	* flows live through the cap STATUS SLICE after adoption.
+	*/
+	sourceInfo: SourceInfoSchema.optional()
+});
 /**
-* Error types for the safe expression engine. Two distinct classes so callers
-* can tell a compile-time (grammar) failure from a runtime (evaluation)
-* failure — both are non-fatal to the host: read paths degrade to "skip link".
+* Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
+* Mirrors `toDeviceShape()` output in `device-management.router.ts` so the
+* tRPC layer can pass it through without reshaping.
 */
-/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
-*  the failure is anchored to a character (author-facing inline feedback). */
-var ExpressionParseError = class extends Error {
-	position;
-	constructor(message, position) {
-		super(message);
-		this.name = "ExpressionParseError";
-		this.position = position;
-	}
-};
-/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
-*  result, unknown builtin, step-budget exceeded). */
-var ExpressionEvalError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ExpressionEvalError";
-	}
-};
+var DeviceSummarySchema = object({
+	id: number(),
+	stableId: string(),
+	addonId: string(),
+	type: string(),
+	name: string(),
+	parentDeviceId: number().nullable(),
+	online: boolean(),
+	features: array(string()),
+	config: record(string(), unknown()),
+	/** Optional upstream-system identity (dispatch key + system tag).
+	*  See `SourceInfo`. Present when the device has a non-synthetic
+	*  source identifier (HA entities, vendor MAC, …); omitted when the
+	*  synthetic backfill is in effect. */
+	sourceInfo: SourceInfoSchema.optional()
+});
 /**
-* Frozen, null-prototype builtin function table for the expression engine
-* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
-* parser rejects any callee not in it, and the evaluator gates each call on an
-* own-property check against it.
+* Result of a live field test (e.g. probing an RTSP URL during device
+* creation). Matches the UI-side `FieldProbeResult` in
+* `interfaces/config-ui.ts` — the admin `FormBuilder` renders the
+* returned `labels` as chips next to the input.
+*/
+var FieldProbeResultSchema = object({
+	status: _enum(["ok", "error"]),
+	labels: array(string()).optional(),
+	error: string().optional()
+});
+/**
+* The output of `getChildCreationSchema` is a UI schema tree. We store
+* it as `unknown` at the capability layer — the router just passes it
+* through and the admin UI renders it via `FormBuilder`. The actual
+* type is `ConfigUISchema` (see `packages/types/src/interfaces/config-ui.ts`),
+* but we deliberately avoid a Zod mirror because the union is large and
+* not meant for runtime validation at this seam.
+*/
+var CreationSchemaOutputSchema = unknown();
+method(_void(), _void(), { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), ProviderStatusSchema), method(_void(), array(object({
+	id: string(),
+	name: string(),
+	type: string()
+}))), method(object({}), boolean()), method(object({ params: record(string(), unknown()).optional() }), array(DiscoveryCandidateSchema), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), CreationSchemaOutputSchema), method(object({}), object({ deviceType: _enum(DeviceType).nullable() })), method(object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), boolean()), method(object({ type: _enum(DeviceType) }), CreationSchemaOutputSchema), method(object({
+	type: _enum(DeviceType),
+	config: record(string(), unknown())
+}), DeviceSummarySchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	type: _enum(DeviceType),
+	key: string(),
+	value: unknown(),
+	formValues: record(string(), unknown()).optional()
+}), FieldProbeResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* Device Manager capability — hub-side singleton that unifies device persistence,
+* live registry access, and all management operations into a single tRPC surface.
 *
-* Because the object has a NULL prototype AND is `Object.freeze`d:
-*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
-*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
-*    (there is no `Object.prototype` in the chain), so those names are not
-*    callable — they are simply "unknown function" at parse time.
+* Replaces:
+*   - `device-persistence` capability (persistence methods absorbed here)
+*   - `device-management.router.ts` (deleted in Phase 2)
+*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
 *
-* Every numeric argument is validated as a finite number and every numeric
-* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
-* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
-* closed rather than emitting a garbage value.
+* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
+* fork into separate processes but never run on remote cluster agents. Therefore:
+*   - No nodeId routing needed — this is a pure hub singleton.
+*   - The hub's DeviceRegistry is the single source of truth for all live devices.
+*   - No shadow registry or cross-node aggregation required.
+*
+* Forked workers register devices back to the hub via `ctx.devices`
+* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
 */
-function asFiniteNumber(value, name, index) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
-	return value;
-}
-function asString$1(value, name, index) {
-	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
-	return value;
-}
-function finiteResult(value, name) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
-	return value;
-}
-function allFiniteNumbers(args, name) {
-	return args.map((a, idx) => asFiniteNumber(a, name, idx));
-}
-var INF = Number.POSITIVE_INFINITY;
-var table = {
-	min: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
-	},
-	max: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
-	},
-	abs: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
-	},
-	floor: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
-	},
-	ceil: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
-	},
-	sqrt: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
-	},
-	round: {
-		minArgs: 1,
-		maxArgs: 2,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "round", 0);
-			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
-			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
-			const factor = 10 ** digits;
-			return finiteResult(Math.round(x * factor) / factor, "round");
-		}
-	},
-	pow: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
-	},
-	clamp: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "clamp", 0);
-			const lo = asFiniteNumber(args[1], "clamp", 1);
-			const hi = asFiniteNumber(args[2], "clamp", 2);
-			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
-			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
-		}
-	},
-	avg: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const nums = allFiniteNumbers(args, "avg");
-			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
-		}
-	},
-	sum: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
-	},
-	coalesce: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			for (const a of args) if (a !== null) return a;
-			return null;
-		}
-	},
-	age: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
-	},
-	convert: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args, hooks) => {
-			const x = asFiniteNumber(args[0], "convert", 0);
-			const from = asString$1(args[1], "convert", 1).trim();
-			const to = asString$1(args[2], "convert", 2).trim();
-			if (hooks.convert) {
-				const out = hooks.convert(x, from, to);
-				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
-				return finiteResult(out, "convert");
-			}
-			if (from === to) return x;
-			throw new ExpressionEvalError("convert: unit conversion table not installed");
-		}
-	}
-};
-Object.freeze(Object.assign(Object.create(null), table));
-/** The set of valid builtin names — used by the parser to reject unknown
-*  callees at parse time (immediate author feedback). */
-var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
+/** One child-placement directive on a container's `childLayout`. Structurally
+*  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
+*  shape for the same field. The child is identified by its re-sync-stable
+*  accessory `stableIdSuffix` (`childKey`); listed children are grouped into
+*  named accordion sections (with optional intra-section order). */
+var ChildLayoutEntrySchema = object({
+	childKey: string(),
+	section: string(),
+	order: number().optional(),
+	collapsed: boolean().optional()
+});
+/** Cap-wire shape of a per-cap display refinement — mirrors
+*  `DeviceCapDisplayOverride` in `device-management.ts`. */
+var DeviceCapDisplayOverrideSchema = object({
+	unit: string().min(1).optional(),
+	precision: number().int().min(0).max(10).optional()
+});
+/** Cap-wire shape of an operator-authored per-device display override —
+*  mirrors `DeviceDisplayOverride` in `device-management.ts`. `precision`
+*  bounds mirror `numeric-sensor.cap.ts` (`int 0-10`). */
+var DeviceDisplayOverrideSchema = object({
+	icon: string().min(1).optional(),
+	label: string().min(1).optional(),
+	unit: string().min(1).optional(),
+	precision: number().int().min(0).max(10).optional(),
+	hidden: boolean().optional(),
+	perCap: record(string(), DeviceCapDisplayOverrideSchema).optional()
+});
+/** Cap-wire shape of a per-role display default — mirrors `RoleDisplayDefault`
+*  in `device-management.ts`. Keyed by `DeviceRole` string (role strings cross
+*  the wire as plain strings everywhere else — cf. `DeviceInfoSchema.role`). */
+var RoleDisplayDefaultSchema = object({
+	unit: string().min(1).optional(),
+	precision: number().int().min(0).max(10).optional(),
+	icon: string().min(1).optional()
+});
 /**
-* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
-* zero-dependency. The grammar is deliberately boring: decimal numbers,
-* single/double-quoted strings with a tiny escape set, identifiers, the three
-* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
-* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
-* is a parse error with a source position, so member access / assignment /
-* template literals are lexically impossible.
-*/
-var KEYWORDS = new Set([
-	"true",
-	"false",
-	"null"
-]);
-function isDigit(ch) {
-	return ch >= "0" && ch <= "9";
-}
-function isIdentStart(ch) {
-	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
-}
-function isIdentPart(ch) {
-	return isIdentStart(ch) || isDigit(ch);
-}
-function isWhitespace(ch) {
-	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
-}
-/** Tokenize `source` into a flat token list ending with a single `eof` token.
-*  Throws `ExpressionParseError` on any illegal character or unterminated
-*  string. */
-function tokenize(source) {
-	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
-	const tokens = [];
-	let i = 0;
-	const n = source.length;
-	while (i < n) {
-		const ch = source[i];
-		if (isWhitespace(ch)) {
-			i += 1;
-			continue;
-		}
-		if (isDigit(ch)) {
-			const start = i;
-			while (i < n && isDigit(source[i])) i += 1;
-			if (i < n && source[i] === ".") {
-				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
-				i += 1;
-				while (i < n && isDigit(source[i])) i += 1;
-			}
-			const text = source.slice(start, i);
-			const value = Number(text);
-			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
-			tokens.push({
-				type: "number",
-				value,
-				pos: start
-			});
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			const quote = ch;
-			const start = i;
-			i += 1;
-			let out = "";
-			let closed = false;
-			while (i < n) {
-				const c = source[i];
-				if (c === "\\") {
-					const next = i + 1 < n ? source[i + 1] : "";
-					if (next === "\\" || next === "'" || next === "\"") {
-						out += next;
-						i += 2;
-						continue;
-					}
-					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
-				}
-				if (c === quote) {
-					closed = true;
-					i += 1;
-					break;
-				}
-				out += c;
-				i += 1;
-			}
-			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
-			tokens.push({
-				type: "string",
-				value: out,
-				pos: start
-			});
-			continue;
-		}
-		if (isIdentStart(ch)) {
-			const start = i;
-			while (i < n && isIdentPart(source[i])) i += 1;
-			const text = source.slice(start, i);
-			if (KEYWORDS.has(text)) tokens.push({
-				type: "keyword",
-				keyword: keywordOf(text),
-				pos: start
-			});
-			else tokens.push({
-				type: "identifier",
-				name: text,
-				pos: start
-			});
-			continue;
-		}
-		const two = i + 1 < n ? source.slice(i, i + 2) : "";
-		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
-			tokens.push({
-				type: "punct",
-				punct: two,
-				pos: i
-			});
-			i += 2;
-			continue;
-		}
-		if (isSinglePunct(ch)) {
-			tokens.push({
-				type: "punct",
-				punct: ch,
-				pos: i
-			});
-			i += 1;
-			continue;
-		}
-		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
-	}
-	tokens.push({
-		type: "eof",
-		pos: n
-	});
-	return tokens;
-}
-function keywordOf(text) {
-	if (text === "true") return "true";
-	if (text === "false") return "false";
-	return "null";
-}
-function isSinglePunct(ch) {
-	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
-}
-/**
-* Pratt (precedence-climbing) parser for the safe expression mini-language.
-*
-* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
-* → relational → additive → multiplicative → unary `! -` → call / primary.
-* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
-* string validated against the builtin table at parse time, so an unknown
-* function is rejected immediately (author feedback) and a persisted expression
-* that references a since-removed builtin degrades at read.
-*
-* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
-* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
-*/
-/** Binary/logical operator precedence (higher binds tighter). */
-var BINARY_PRECEDENCE = {
-	"||": 1,
-	"&&": 2,
-	"==": 3,
-	"!=": 3,
-	"<": 4,
-	"<=": 4,
-	">": 4,
-	">=": 4,
-	"+": 5,
-	"-": 5,
-	"*": 6,
-	"/": 6,
-	"%": 6
-};
-function isLogicalOp(op) {
-	return op === "&&" || op === "||";
-}
-function isBinaryOp(op) {
-	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
-}
-var Parser = class {
-	tokens;
-	pos = 0;
-	nodeCount = 0;
-	identifiers = /* @__PURE__ */ new Set();
-	callees = /* @__PURE__ */ new Set();
-	constructor(tokens) {
-		this.tokens = tokens;
-	}
-	parse() {
-		const ast = this.parseTernary();
-		const tok = this.peek();
-		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
-		return {
-			ast,
-			identifiers: this.identifiers,
-			callees: this.callees,
-			nodeCount: this.nodeCount
-		};
-	}
-	peek() {
-		return this.tokens[this.pos];
-	}
-	next() {
-		return this.tokens[this.pos++];
-	}
-	/** Consume a punctuator token, erroring if the next token isn't it. */
-	expectPunct(punct) {
-		const tok = this.peek();
-		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
-		this.pos += 1;
-	}
-	matchPunct(punct) {
-		const tok = this.peek();
-		if (tok.type === "punct" && tok.punct === punct) {
-			this.pos += 1;
-			return true;
-		}
-		return false;
-	}
-	countNode() {
-		this.nodeCount += 1;
-		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
-	}
-	parseTernary() {
-		const test = this.parseBinary(1);
-		if (this.matchPunct("?")) {
-			const consequent = this.parseTernary();
-			this.expectPunct(":");
-			const alternate = this.parseTernary();
-			this.countNode();
-			return {
-				kind: "conditional",
-				test,
-				consequent,
-				alternate
-			};
-		}
-		return test;
-	}
-	parseBinary(minPrec) {
-		let left = this.parseUnary();
-		for (;;) {
-			const tok = this.peek();
-			if (tok.type !== "punct") break;
-			const prec = BINARY_PRECEDENCE[tok.punct];
-			if (prec === void 0 || prec < minPrec) break;
-			const op = tok.punct;
-			this.pos += 1;
-			const right = this.parseBinary(prec + 1);
-			this.countNode();
-			if (isLogicalOp(op)) left = {
-				kind: "logical",
-				op,
-				left,
-				right
-			};
-			else if (isBinaryOp(op)) left = {
-				kind: "binary",
-				op,
-				left,
-				right
-			};
-			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
-		}
-		return left;
-	}
-	parseUnary() {
-		const tok = this.peek();
-		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
-			const op = tok.punct;
-			this.pos += 1;
-			const operand = this.parseUnary();
-			this.countNode();
-			return {
-				kind: "unary",
-				op,
-				operand
-			};
-		}
-		return this.parsePrimary();
-	}
-	parsePrimary() {
-		const tok = this.next();
-		switch (tok.type) {
-			case "number":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "string":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "keyword":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.keyword === "null" ? null : tok.keyword === "true"
-				};
-			case "identifier": {
-				const nextTok = this.peek();
-				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
-				this.identifiers.add(tok.name);
-				this.countNode();
-				return {
-					kind: "identifier",
-					name: tok.name
-				};
-			}
-			case "punct":
-				if (tok.punct === "(") {
-					const inner = this.parseTernary();
-					this.expectPunct(")");
-					return inner;
-				}
-				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
-			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
-		}
-	}
-	parseCall(callee, pos) {
-		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
-		this.expectPunct("(");
-		const args = [];
-		if (!this.matchPunct(")")) for (;;) {
-			args.push(this.parseTernary());
-			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
-			if (this.matchPunct(",")) continue;
-			this.expectPunct(")");
-			break;
-		}
-		this.callees.add(callee);
-		this.countNode();
-		return {
-			kind: "call",
-			callee,
-			args
-		};
-	}
-};
-/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
-*  `ExpressionParseError` on any lexical or grammatical failure. */
-function parseExpression(source) {
-	return new Parser(tokenize(source)).parse();
-}
-/**
-* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
-* by expr"). The cache stores BOTH successes and failures (negative caching),
-* so a corrupt persisted string costs exactly one tokenize+parse total — not
-* one per read on a hot resolve path.
-*
-* The cache is a module-level singleton: entries are pure, content-addressed
-* ASTs keyed by the raw source string, so sharing one instance across all
-* callers is safe and maximises hit rate.
-*/
-var cache = /* @__PURE__ */ new Map();
-function getCached(source) {
-	const hit = cache.get(source);
-	if (hit !== void 0) {
-		cache.delete(source);
-		cache.set(source, hit);
-		return hit;
-	}
-	let result;
-	try {
-		result = {
-			ok: true,
-			parsed: parseExpression(source)
-		};
-	} catch (err) {
-		result = {
-			ok: false,
-			error: err instanceof ExpressionParseError ? err.message : String(err)
-		};
-	}
-	cache.set(source, result);
-	if (cache.size > 256) {
-		const oldest = cache.keys().next().value;
-		if (oldest !== void 0) cache.delete(oldest);
-	}
-	return result;
-}
-/** Compile `source`, returning a discriminated result instead of throwing.
-*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
-function compileExpressionSafe(source) {
-	return getCached(source);
-}
-Object.freeze({});
-/**
-* Author-time validation. Returns `null` when the source is valid, else a
-* human-readable error message. Checks: the expression compiles; binding count
-* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
-* is not reserved (`now`/keywords) and does not shadow a builtin; and every
-* FREE identifier of the AST is covered by a binding or the injected `now`.
-*/
-function validateExpressionSource(src) {
-	const names = Object.keys(src.bindings);
-	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
-	for (const name of names) {
-		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
-		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
-		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
-	}
-	const compiled = compileExpressionSafe(src.expr);
-	if (!compiled.ok) return compiled.error;
-	const bound = new Set(names);
-	for (const id of compiled.parsed.identifiers) {
-		if (id === "now") continue;
-		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
-	}
-	return null;
-}
-var ProviderStatusSchema = object({
-	connected: boolean(),
-	deviceCount: number(),
-	error: string().optional()
-});
-object({
-	externalId: string(),
-	name: string(),
-	type: string(),
-	metadata: record(string(), unknown()).optional()
-});
-/**
-* Candidate handed back from discovery and accepted by
-* `adoptDiscoveredDevice`. Shape mirrors the in-process
-* `DiscoveredDevice` interface used by `DeviceDiscovery`.
-*/
-var DiscoveryCandidateSchema = object({
-	stableId: string(),
-	type: _enum(DeviceType),
-	suggestedName: string(),
-	prefilledConfig: record(string(), unknown()),
-	/**
-	* Optional upstream-system identity (HA entity_id, vendor MAC, …).
-	* Discovery pre-populates this for systems that know the upstream
-	* identity ahead of adoption. Rendering metadata (unit, precision)
-	* flows live through the cap STATUS SLICE after adoption.
-	*/
-	sourceInfo: SourceInfoSchema.optional()
-});
-/**
-* Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
-* Mirrors `toDeviceShape()` output in `device-management.router.ts` so the
-* tRPC layer can pass it through without reshaping.
-*/
-var DeviceSummarySchema = object({
-	id: number(),
-	stableId: string(),
-	addonId: string(),
-	type: string(),
-	name: string(),
-	parentDeviceId: number().nullable(),
-	online: boolean(),
-	features: array(string()),
-	config: record(string(), unknown()),
-	/** Optional upstream-system identity (dispatch key + system tag).
-	*  See `SourceInfo`. Present when the device has a non-synthetic
-	*  source identifier (HA entities, vendor MAC, …); omitted when the
-	*  synthetic backfill is in effect. */
-	sourceInfo: SourceInfoSchema.optional()
-});
-/**
-* Result of a live field test (e.g. probing an RTSP URL during device
-* creation). Matches the UI-side `FieldProbeResult` in
-* `interfaces/config-ui.ts` — the admin `FormBuilder` renders the
-* returned `labels` as chips next to the input.
-*/
-var FieldProbeResultSchema = object({
-	status: _enum(["ok", "error"]),
-	labels: array(string()).optional(),
-	error: string().optional()
-});
-/**
-* The output of `getChildCreationSchema` is a UI schema tree. We store
-* it as `unknown` at the capability layer — the router just passes it
-* through and the admin UI renders it via `FormBuilder`. The actual
-* type is `ConfigUISchema` (see `packages/types/src/interfaces/config-ui.ts`),
-* but we deliberately avoid a Zod mirror because the union is large and
-* not meant for runtime validation at this seam.
-*/
-var CreationSchemaOutputSchema = unknown();
-method(_void(), _void(), { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), ProviderStatusSchema), method(_void(), array(object({
-	id: string(),
-	name: string(),
-	type: string()
-}))), method(object({}), boolean()), method(object({ params: record(string(), unknown()).optional() }), array(DiscoveryCandidateSchema), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({}), CreationSchemaOutputSchema), method(object({}), object({ deviceType: _enum(DeviceType).nullable() })), method(object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({}), boolean()), method(object({ type: _enum(DeviceType) }), CreationSchemaOutputSchema), method(object({
-	type: _enum(DeviceType),
-	config: record(string(), unknown())
-}), DeviceSummarySchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	type: _enum(DeviceType),
-	key: string(),
-	value: unknown(),
-	formValues: record(string(), unknown()).optional()
-}), FieldProbeResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
-* Device Manager capability — hub-side singleton that unifies device persistence,
-* live registry access, and all management operations into a single tRPC surface.
-*
-* Replaces:
-*   - `device-persistence` capability (persistence methods absorbed here)
-*   - `device-management.router.ts` (deleted in Phase 2)
-*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
-*
-* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
-* fork into separate processes but never run on remote cluster agents. Therefore:
-*   - No nodeId routing needed — this is a pure hub singleton.
-*   - The hub's DeviceRegistry is the single source of truth for all live devices.
-*   - No shadow registry or cross-node aggregation required.
-*
-* Forked workers register devices back to the hub via `ctx.devices`
-* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
-*/
-/** One child-placement directive on a container's `childLayout`. Structurally
-*  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
-*  shape for the same field. The child is identified by its re-sync-stable
-*  accessory `stableIdSuffix` (`childKey`); listed children are grouped into
-*  named accordion sections (with optional intra-section order). */
-var ChildLayoutEntrySchema = object({
-	childKey: string(),
-	section: string(),
-	order: number().optional(),
-	collapsed: boolean().optional()
-});
-/** Cap-wire shape of a DeviceLink — structurally mirrors `DeviceLink` in
-*  `device-management.ts`. Source is a union: a FIELD source copies a sibling
-*  accessory's status field (`kind` optional/absent for wire compat); a
-*  LITERAL source carries a per-device constant (no sibling is read); a
-*  GLOBAL source (P2e) copies ANY device's status field, addressed by the
-*  source device's full re-sync-stable `stableId`. */
-var DeviceLinkFieldSourceSchema = object({
-	kind: literal("field").optional(),
-	sourceKey: string(),
-	cap: string(),
-	fieldPath: string()
-});
-var DeviceLinkLiteralSourceSchema = object({
-	kind: literal("literal"),
-	value: union([
-		string(),
-		number(),
-		boolean(),
-		_null()
-	])
-});
-var DeviceLinkGlobalSourceSchema = object({
-	kind: literal("global"),
-	sourceStableId: string(),
-	cap: string(),
-	fieldPath: string()
-});
-/** Expression source (Stage X): compute the target field from N named bindings
-*  via the safe expression engine. Bindings are field | literal | global — never
-*  another expression (no nesting). The `superRefine` runs the SAME author-time
-*  validation as `validateExpressionSource` (compiles the expr, checks binding
-*  names + identifier coverage) so every wire boundary that parses a DeviceLink
-*  (tRPC mount, kernel create pre-seed, projection output) validates-at-write.
-*  Compiles are LRU-cached, so repeated validation of the same expr is a hit. */
-var DeviceLinkExpressionSourceSchema = object({
-	kind: literal("expression"),
-	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema
-	]))
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
-});
-var DeviceLinkSchema = object({
-	id: string(),
-	source: union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema,
-		DeviceLinkExpressionSourceSchema
-	]),
-	target: object({
-		cap: string(),
-		fieldPath: string(),
-		itemKey: string().optional()
-	}),
-	transform: discriminatedUnion("kind", [
-		object({ kind: literal("identity") }),
-		object({
-			kind: literal("enum-map"),
-			mapping: record(string(), union([
-				string(),
-				number(),
-				boolean()
-			])),
-			fallback: union([
-				string(),
-				number(),
-				boolean()
-			]).optional()
-		}),
-		object({
-			kind: literal("linear"),
-			scale: number(),
-			offset: number(),
-			clamp: tuple([number(), number()]).readonly().optional()
-		})
-	]).optional()
-});
-/** Cap-wire shape of a per-cap display refinement — mirrors
-*  `DeviceCapDisplayOverride` in `device-management.ts`. */
-var DeviceCapDisplayOverrideSchema = object({
-	unit: string().min(1).optional(),
-	precision: number().int().min(0).max(10).optional()
-});
-/** Cap-wire shape of an operator-authored per-device display override —
-*  mirrors `DeviceDisplayOverride` in `device-management.ts`. `precision`
-*  bounds mirror `numeric-sensor.cap.ts` (`int 0-10`). */
-var DeviceDisplayOverrideSchema = object({
-	icon: string().min(1).optional(),
-	label: string().min(1).optional(),
-	unit: string().min(1).optional(),
-	precision: number().int().min(0).max(10).optional(),
-	hidden: boolean().optional(),
-	perCap: record(string(), DeviceCapDisplayOverrideSchema).optional()
-});
-/** Cap-wire shape of a per-role display default — mirrors `RoleDisplayDefault`
-*  in `device-management.ts`. Keyed by `DeviceRole` string (role strings cross
-*  the wire as plain strings everywhere else — cf. `DeviceInfoSchema.role`). */
-var RoleDisplayDefaultSchema = object({
-	unit: string().min(1).optional(),
-	precision: number().int().min(0).max(10).optional(),
-	icon: string().min(1).optional()
-});
-/**
-* Serializable projection of a live IDevice.
-* Returned by listAll, getDevice, getChildren.
-* Live methods (getStreamSources, getConfigSchema) are separate calls.
+* Serializable projection of a live IDevice.
+* Returned by listAll, getDevice, getChildren.
+* Live methods (getStreamSources, getConfigSchema) are separate calls.
 */
 var DeviceInfoSchema = object({
 	/** Progressive, system-wide unique number. Allocated synchronously by
@@ -12109,8 +11058,6 @@ var DeviceInfoSchema = object({
 	*  named accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
 	/** Operator-authored per-device display override. See `DeviceMeta.display`. */
 	display: DeviceDisplayOverrideSchema.optional()
 });
@@ -12119,7 +11066,7 @@ var ConfigEntrySchema = object({
 	value: unknown(),
 	description: string().optional()
 });
-var DeviceLinkModeSchema = _enum(["auto", "manual"]);
+var LinkedDevicesModeSchema = _enum(["auto", "manual"]);
 /** One resolved linked device — the compact projection consumers need. */
 var LinkedDeviceSchema = object({
 	deviceId: number(),
@@ -12182,8 +11129,6 @@ var DeviceMetaSchema = object({
 	*  accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
 	/** Semantic role string (`DeviceRole`) — propagated from the spawn pre-seed.
 	*  Optional: only present for accessory children that carry a known role. */
 	role: string().nullable().optional(),
@@ -12276,12 +11221,6 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	deviceLinks: array(DeviceLinkSchema).readonly()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	display: DeviceDisplayOverrideSchema.nullable()
@@ -12363,7 +11302,7 @@ method(object({
 	*  shipping 293 rows to find 12. */
 	isCamera: boolean().optional()
 }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
-	mode: DeviceLinkModeSchema,
+	mode: LinkedDevicesModeSchema,
 	devices: array(LinkedDeviceSchema)
 })), method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)), method(object({ deviceId: number() }), array(ConfigEntrySchema)), method(object({ deviceId: number() }), ConfigUISchemaOutput), method(object({
 	deviceId: number(),
@@ -12396,11 +11335,7 @@ method(object({
 	deviceId: number(),
 	entries: array(object({
 		capName: string(),
-		kind: _enum([
-			"native",
-			"wrapped",
-			"linked"
-		]),
+		kind: _enum(["native", "wrapped"]),
 		providerAddonId: string(),
 		providerNodeId: string(),
 		nativeAddonId: string()
@@ -12409,11 +11344,7 @@ method(object({
 	deviceId: number(),
 	entries: array(object({
 		capName: string(),
-		kind: _enum([
-			"native",
-			"wrapped",
-			"linked"
-		]),
+		kind: _enum(["native", "wrapped"]),
 		providerAddonId: string(),
 		providerNodeId: string(),
 		nativeAddonId: string()
@@ -13226,7 +12157,7 @@ var MotionAnalysisResultSchema = object({
 	frameHeight: number(),
 	analysisMs: number()
 });
-method(object({
+DeviceType.Camera, method(object({
 	deviceId: number(),
 	frame: FrameInputSchema.optional(),
 	frameHandle: FrameHandleSchema.optional()
@@ -15898,6 +14829,18 @@ var OauthIntegrationDescriptorSchema = object({
 	*  redirect_uri that does not start with one of these. Required —
 	*  an empty list means the integration can never complete linking. */
 	allowedRedirectPrefixes: array(string()).min(1),
+	/** Paths accepted as a `redirect_uri` when the host is PRIVATE — loopback,
+	*  RFC1918, CGNAT (100.64/10, Tailscale), link-local, IPv6 ULA, or an
+	*  `.local` / `.internal` / `.ts.net` name. Exists for self-hosted clients
+	*  whose address the hub cannot know in advance (a Home Assistant at
+	*  `http://<lan-ip>:8123/auth/external/callback`). The PATH must match
+	*  exactly; a public host never satisfies this branch, so it is not a
+	*  wildcard prefix by another name. */
+	allowedPrivateHostPaths: array(string()).optional(),
+	/** When true this is a PUBLIC client (source is published, no secret can be
+	*  protected) and PKCE is mandatory: `/authorize` refuses without an S256
+	*  `code_challenge`, `/token` refuses without the matching `code_verifier`. */
+	requiresPkce: boolean().optional(),
 	/** Optional public origin (no trailing slash) that this integration's
 	*  issued codes/tokens should carry as the `hubUrl` claim — typically the
 	*  operator-selected external-access endpoint resolved by the addon. When
@@ -16048,7 +14991,7 @@ var TrackEnvelopeSchema = object({
 * `snapshots[]` references — megabytes across a page of tracks. `slim`
 * keeps every scalar the list surfaces actually render (ids, class(es),
 * label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
-* zonesVisited, bestEventId, envelope) and returns `positions` /
+* zonesVisited, bestEventId, envelope, hasFace) and returns `positions` /
 * `snapshots` as EMPTY arrays — detail views re-fetch the full row via
 * `getTrack`. Mirrors the event-store `projection` convention
 * (`getObjectEvents` et al.).
@@ -16285,6 +15228,24 @@ var TrackSchema = object({
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
 	envelope: TrackEnvelopeSchema.optional(),
+	/**
+	* A face DETECTOR found a face on this track — nothing more. It says the
+	* detail plane produced a `face` detail; it does NOT say the face was
+	* embedded, matched, above `minFacePx`, or that the recognizer was even
+	* enabled. Set once and never cleared.
+	*
+	* **This exists so "face present but not recognised" is expressible.** A
+	* recognised identity lands in `subLabel` (attributed to the face chain via
+	* `subLabelMeta.stepId`), so before this field a track with an unmatched face
+	* and a track with no face at all were byte-identical on the wire and no
+	* surface could tell them apart. The read is `hasFace === true && subLabel
+	* === undefined`.
+	*
+	* **Absent ≠ false.** Every row written before the column existed omits it,
+	* and so does every server that predates the field — a consumer must test
+	* `=== true` and render nothing otherwise, never infer "no face".
+	*/
+	hasFace: boolean().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -19353,6 +18314,10 @@ var SsoBridgeClaimsSchema = object({
 	integrationId: string().optional(),
 	/** JWT ID — unique per issued code; consumed-set enforces single-use. */
 	jti: string().optional(),
+	/** PKCE S256 challenge — set only on `oauth-code` tokens issued to a public
+	*  client. Its PRESENCE is what makes the verifier mandatory at exchange,
+	*  so the requirement travels with the code and not with mutable config. */
+	codeChallenge: string().optional(),
 	/** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
 	*  tokens so the verify path can check the session is not revoked. */
 	sessionId: string().optional()
@@ -19911,6 +18876,10 @@ var videoclipsCapability = {
 	mode: "singleton",
 	kind: "wrapper",
 	defaultActive: true,
+	/** A clip is a window over a camera's footage — the cap is meaningless on a
+	*  sensor, a button or an event emitter, and the `defaultActive` auto-bind
+	*  reads this to decide which devices it may claim. */
+	deviceTypes: [DeviceType.Camera],
 	methods: {
 		listClips: method(object({
 			deviceId: number(),
@@ -26507,13 +25476,18 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	username: string(),
 	scopes: array(TokenScopeSchema),
 	redirectUri: string(),
-	hubUrl: string()
+	hubUrl: string(),
+	/** PKCE (RFC 7636) S256 challenge. Baked into the signed code; a code
+	*  that carries one can ONLY be exchanged with the matching verifier. */
+	codeChallenge: string().optional()
 }), object({ code: string() }), {
 	kind: "mutation",
 	access: "create"
 }), method(object({
 	code: string(),
-	redirectUri: string()
+	redirectUri: string(),
+	/** PKCE verifier. REQUIRED when the code carries a challenge. */
+	codeVerifier: string().optional()
 }), object({
 	accessToken: string(),
 	refreshToken: string(),
@@ -27726,279 +26700,1116 @@ var BaseDevice = class {
 		return this._sourceInfoCache;
 	}
 	/**
-	* Convenience accessor for the upstream dispatch key. Equivalent to
-	* `this.sourceInfo.id` — providers use this to keep a
-	* `Map<sourceId, IDevice>` for routing inbound push events.
-	*/
-	get sourceId() {
-		return this.sourceInfo.id;
+	* Convenience accessor for the upstream dispatch key. Equivalent to
+	* `this.sourceInfo.id` — providers use this to keep a
+	* `Map<sourceId, IDevice>` for routing inbound push events.
+	*/
+	get sourceId() {
+		return this.sourceInfo.id;
+	}
+	/**
+	* Patch the device's `SourceInfo`. Shallow-merges `patch` over the
+	* current value, persists the merged result under
+	* `metadata.sourceInfo` via the `device-manager.setMetadata` cap, and
+	* emits `EventCategory.DeviceSourceInfoChanged` for live consumers.
+	*
+	* Safe to call from anywhere in the device's lifetime — the call is
+	* idempotent for `undefined` patch values (ignored) and best-effort
+	* for persistence (a transient device-manager error doesn't unwind
+	* the local cache update, so subsequent reads still see the patch).
+	*
+	* Drivers populate this on adoption + on every metadata change push
+	* from the upstream source. Subscribers (UI, export adapters) react
+	* via the `DeviceSourceInfoChanged` event without polling.
+	*/
+	async updateSourceInfo(patch) {
+		const next = mergeSourceInfo(this.sourceInfo, patch);
+		this._sourceInfoCache = Object.freeze({ ...next });
+		const action = this.ctx.api?.deviceManager?.setMetadata;
+		if (action) try {
+			await action.mutate({
+				deviceId: this.id,
+				patch: { [SOURCE_INFO_METADATA_KEY]: next }
+			});
+		} catch {}
+		this.ctx.eventBus.emit(createEvent("device.source-info-changed", {
+			type: "device",
+			id: this.stableId
+		}, {
+			deviceId: this.id,
+			sourceInfo: next
+		}));
+	}
+	/**
+	* Re-publish the device's current `features` array to the persisted
+	* meta blob. Drivers call this after a probe finishes when the live
+	* `features` getter has gained new flags (e.g. `hasIntercom` flips
+	* to true → `DeviceFeature.TwoWayAudio` joins the list).
+	*
+	* Without this, only the construction-time snapshot is written —
+	* `deviceManager.registerDevice` is invoked once per boot, so probe-
+	* driven additions don't reach the persisted index until the next
+	* server restart, and `getDevice` / `listAll` keep returning the
+	* stale list for forked-worker devices (whose live IDevice instance
+	* is invisible to the hub registry).
+	*
+	* Idempotent: re-calling with the same features just no-ops on the
+	* persisted meta. Best-effort: lookup or write failures are logged
+	* at debug and swallowed — the live `device.features` getter is
+	* still authoritative within this process, so callers never block
+	* device boot on a meta refresh.
+	*/
+	async refreshFeatures() {
+		const action = this.ctx.api?.deviceManager?.registerDevice;
+		if (!action) return;
+		try {
+			await action.mutate({
+				addonId: this.ctx.deviceMeta.addonId,
+				stableId: this.stableId,
+				id: this.id,
+				type: this.type,
+				name: this.name,
+				parentDeviceId: this.parentDeviceId,
+				features: [...this.features],
+				config: {}
+			});
+		} catch (err) {}
+	}
+	/**
+	* Typed read-through to a cap-keyed runtime-state slice. Drivers
+	* call `this.getCapSlice(batteryCapability)` and the return type
+	* is inferred from the cap's `runtimeState` Zod schema — no string
+	* key, no manual generic. Returns `null` when the slice hasn't
+	* been written yet (e.g. driver hasn't seeded battery yet).
+	*/
+	getCapSlice(cap) {
+		return this.runtimeState.getCapState(cap.name) ?? null;
+	}
+	/**
+	* Typed writer to a cap-keyed runtime-state slice. Routes through
+	* the runtime-state writer (validate → persist → emit cap event).
+	* Equivalent to `this.runtimeState.setCapState(cap.name, value)`
+	* but with the cap's `runtimeState` schema enforcing the value
+	* shape at compile time. Mirrors the symmetry of
+	* `getCapSlice` / `setCapSlice` for cross-cap consistency.
+	*/
+	setCapSlice(cap, value) {
+		this.runtimeState.setCapState(cap.name, value);
+	}
+	/**
+	* Field-level read/write proxy over a cap's runtime-state slice.
+	* Drivers that want ergonomic per-field access declare:
+	*
+	* ```ts
+	* protected battery = this.sliceProxy(batteryCapability)
+	* // …
+	* this.battery.sleeping = true        // patches the slice
+	* const charging = this.battery.charging  // reads the slice
+	* ```
+	*
+	* Reads return `undefined` when the slice hasn't been seeded yet
+	* (cap not registered, or seeded but the field is absent). Writes
+	* route through `runtimeState.patchCapState` so the cap's `runtimeState`
+	* schema validates the merged result and the cap event fires.
+	*
+	* Pattern is generic — same shape works for `battery`, `device-status`,
+	* `motion`, `doorbell`, anything with a `runtimeState:` schema. Drivers
+	* declare one proxy per cap they read/write directly.
+	*/
+	sliceProxy(cap) {
+		return new Proxy({}, {
+			get: (_, key) => {
+				return this.runtimeState.getCapState(cap.name)?.[key];
+			},
+			set: (_, key, value) => {
+				this.runtimeState.patchCapState(cap.name, { [key]: value });
+				return true;
+			},
+			has: (_, key) => {
+				const slice = this.runtimeState.getCapState(cap.name);
+				return slice ? key in slice : false;
+			},
+			ownKeys: () => {
+				const slice = this.runtimeState.getCapState(cap.name);
+				return slice ? Object.keys(slice) : [];
+			},
+			getOwnPropertyDescriptor: (_, key) => {
+				const slice = this.runtimeState.getCapState(cap.name);
+				if (!slice || !(key in slice)) return void 0;
+				return {
+					configurable: true,
+					enumerable: true,
+					value: slice[key]
+				};
+			}
+		});
+	}
+	/**
+	* Default empty settings UI. Drivers override this to expose an
+	* editable form in the device-details page. Returning an empty sections
+	* array signals "nothing to contribute" — the aggregator drops the
+	* contribution entirely rather than rendering a blank panel.
+	*/
+	getSettingsUISchema() {
+		return { sections: [] };
+	}
+	/**
+	* Default write path: forward the flat patch directly to storage.
+	* Drivers that project a UI shape different from storage (e.g. `RtspCamera`
+	* exposing `mainStreamUrl`/`subStreamUrl` over `streams[]`) override this
+	* to reshape before `config.setAll`.
+	*/
+	async applySettingsPatch(patch) {
+		await this.config.setAll(patch);
+	}
+	/**
+	* Phase 3 — populate device-scoped state needed by downstream phases
+	* (accessory reconciliation, public `features` array, optional cap
+	* registration). Called ONCE per construction, after register but
+	* before `getAccessoryChildren()`.
+	*
+	* Drivers write the `feature-probe` runtime-state slice via
+	* `this.runtimeState.setCapState('feature-probe', {...})` — flag bag
+	* is open (Reolink writes `hasPtz/hasIntercom`, Hikvision writes
+	* `hasSupplementalLight/hasAlarmIo`, etc).
+	*
+	* Default: nothing to probe → mark the device PROBED (set `lastProbedAt`) so
+	* the kernel treats it as ready immediately. A device that derives its shape
+	* from a spec (a container, or an accessory sensor) rather than from a
+	* hardware probe has no probe to "complete"; without stamping `lastProbedAt`
+	* it would look perpetually un-probed — logging "Initial probe did not
+	* complete" on every boot and spinning a pointless retry chain. Drivers that
+	* DO probe override this and write their own `feature-probe` slice (including
+	* `lastProbedAt`) once their probe actually succeeds.
+	*/
+	async onProbe() {
+		const base = this.runtimeState.getCapState("feature-probe") ?? {
+			flags: {},
+			deviceType: null,
+			model: null,
+			channelCount: null,
+			lastProbedAt: 0,
+			lastFetchedAt: 0
+		};
+		this.runtimeState.setCapState("feature-probe", {
+			...base,
+			lastProbedAt: Date.now()
+		});
+	}
+	/**
+	* Phase 5 — fired after the device + its accessories are registered.
+	* Drivers publish streams to the broker, kick off background tasks,
+	* or subscribe to lib events that need a fully-registered device id.
+	*
+	* Default: no-op.
+	*
+	* RENAMED FROM `onCreated` (which still exists for back-compat in this
+	* pass). The new name reflects the post-probe, post-accessory contract.
+	*/
+	async onActivate() {}
+	/**
+	* Re-run the probe + reconcile accessories + refresh features meta.
+	* Drivers call this when device-side state changes (battery cam wakes,
+	* firmware update, manual operator trigger).
+	*
+	* The kernel injects `_kernelReprobe` on registration so this method
+	* delegates to the same orchestrator that runs the boot-time phase
+	* 3 + 4 sequence. Drivers should NOT override this — they override
+	* `onProbe()` instead.
+	*/
+	async reprobe() {
+		if (this._kernelReprobe) await this._kernelReprobe();
+		else await this.onProbe();
+	}
+	/**
+	* Kernel-injected callback that runs the full post-probe orchestration
+	* (onProbe → registerDevice meta refresh → accessory reconciliation).
+	* Set by `device-cap-proxy.register()`. Drivers should not touch this
+	* directly — call `reprobe()` instead.
+	*/
+	_kernelReprobe;
+	/**
+	* Declare accessory child devices the kernel should auto-spawn
+	* after `onProbe()` resolves. Each spec fully describes one child
+	* — stableId suffix (deterministic per kind for restore-safety),
+	* meta (type / name / location), config (initial blob the child
+	* self-hydrates), and a factory that constructs the concrete
+	* class with whatever closure-captured refs it needs (typically
+	* `this` for the parent reference).
+	*
+	* The kernel handles the rest: allocateDeviceId, persistInitialConfig
+	* (skipped on restore when the row already exists),
+	* persistInitialMeta, createContext, factory invocation, register,
+	* and recursive lifecycle (probe + accessories + activate).
+	*
+	* Implementations should derive children from
+	* `this.runtimeState.getCapState('feature-probe')` (post-probe truth).
+	* Drivers can use the `getProbeFlags()` helper to read the flag bag
+	* with a typed cast.
+	*
+	* Default: no children.
+	*/
+	getAccessoryChildren() {
+		return [];
+	}
+	/**
+	* Read the current feature-probe flag bag with a typed cast. Helper
+	* for `getAccessoryChildren()` and `features` getters that derive
+	* outputs from the probe results.
+	*/
+	getProbeFlags() {
+		return this.runtimeState.getCapState("feature-probe")?.flags ?? {};
+	}
+	/**
+	* Returns true once `onProbe` has completed at least once
+	* (`lastProbedAt > 0`). Drivers gate `getAccessoryChildren()` on this
+	* to avoid spawning stale accessories on a fresh device whose probe
+	* hasn't landed yet.
+	*/
+	hasProbed() {
+		return (this.runtimeState.getCapState("feature-probe")?.lastProbedAt ?? 0) > 0;
+	}
+};
+/** Marker written to a declared integration's `info`. */
+var DECLARED_INTEGRATION_FIXED_KEY = "fixed";
+/**
+* Strip the `<node>/<addon>` suffix a forked child carries.
+*
+* Comparing `ctx.kernel.localNodeId` raw skipped EVERY node — including the one
+* that was supposed to act — because on the hub it reads `hub/<addon>`.
+*/
+function declarationOwnerNodeId(localNodeId) {
+	const raw = localNodeId ?? "hub";
+	if (!raw.includes("/")) return raw;
+	return raw.split("/")[0] ?? "hub";
+}
+/**
+* The one way an addon owns a device it declares.
+*
+* Construct once with the addon's ports, then call {@link reconcile} on boot and
+* on every convergence tick. There is no second get-or-create helper — a guard
+* in `scripts/` enforces that.
+*/
+var DeclaredDevices = class {
+	ports;
+	constructor(ports) {
+		this.ports = ports;
+	}
+	/**
+	* Converge the declared set. Idempotent, and safe to call repeatedly.
+	*
+	* Throws only what the ports throw on the FIRST index read; every other
+	* failure is per-device and logged, so one bad declaration never takes the
+	* others down.
+	*/
+	async reconcile(spec) {
+		if ((spec.placement ?? "hub") === "hub") {
+			const nodeId = declarationOwnerNodeId(this.ports.localNodeId);
+			if (nodeId !== "hub") {
+				this.ports.logger.info("declared devices are hub-owned — skipping on this node", { meta: {
+					nodeId,
+					rawNodeId: this.ports.localNodeId ?? null
+				} });
+				return {
+					integrationId: null,
+					devices: [],
+					removed: [],
+					owned: false
+				};
+			}
+		}
+		const integrationId = await this.ensureIntegration(spec.integrationName);
+		const index = await this.readIndex();
+		const outcomes = [];
+		for (const declaration of spec.devices) {
+			const outcome = await this.applyDeclaration(declaration, integrationId, index);
+			if (outcome !== null) outcomes.push(outcome);
+		}
+		return {
+			integrationId,
+			devices: outcomes,
+			removed: await this.sweepWithdrawn(spec.devices, integrationId, index),
+			owned: true
+		};
 	}
 	/**
-	* Patch the device's `SourceInfo`. Shallow-merges `patch` over the
-	* current value, persists the merged result under
-	* `metadata.sourceInfo` via the `device-manager.setMetadata` cap, and
-	* emits `EventCategory.DeviceSourceInfoChanged` for live consumers.
+	* Get-or-create the FIXED integration, and RE-ASSERT the flag every pass.
 	*
-	* Safe to call from anywhere in the device's lifetime — the call is
-	* idempotent for `undefined` patch values (ignored) and best-effort
-	* for persistence (a transient device-manager error doesn't unwind
-	* the local cache update, so subsequent reads still see the patch).
+	* The re-assertion is the fix for the defect the hand-rolled version shipped
+	* with: writing `info.fixed` only on the create path left every pre-existing
+	* install without it, and the kernel kept offering to delete an integration
+	* the addon owns.
+	*/
+	async ensureIntegration(integrationName) {
+		const existing = await this.ports.getIntegration(this.ports.addonId);
+		if (existing === null) {
+			const created = await this.ports.createIntegration({
+				addonId: this.ports.addonId,
+				name: integrationName,
+				info: { [DECLARED_INTEGRATION_FIXED_KEY]: true }
+			});
+			this.ports.logger.info("declared a fixed integration", { meta: {
+				integrationId: created.id,
+				name: integrationName
+			} });
+			return created.id;
+		}
+		if (existing.info?.["fixed"] !== true) {
+			await this.ports.updateIntegration({
+				id: existing.id,
+				info: { [DECLARED_INTEGRATION_FIXED_KEY]: true }
+			});
+			this.ports.logger.info("re-asserted `fixed` on a declared integration", { meta: { integrationId: existing.id } });
+		}
+		return existing.id;
+	}
+	async readIndex() {
+		const rows = await this.ports.listOwnDevices();
+		return new Map(rows.map((row) => [row.stableId, row]));
+	}
+	/**
+	* One declaration: adopt what exists, create what does not.
 	*
-	* Drivers populate this on adoption + on every metadata change push
-	* from the upstream source. Subscribers (UI, export adapters) react
-	* via the `DeviceSourceInfoChanged` event without polling.
+	* The create branch is the destructive one — it seeds `initialMeta`, and
+	* `initialMeta.name` lands as an unconditional `setName`. A transiently empty
+	* index therefore looks exactly like a first boot and would silently re-stamp
+	* the declared name over the operator's rename. D49: that branch needs a
+	* second read to agree.
 	*/
-	async updateSourceInfo(patch) {
-		const next = mergeSourceInfo(this.sourceInfo, patch);
-		this._sourceInfoCache = Object.freeze({ ...next });
-		const action = this.ctx.api?.deviceManager?.setMetadata;
-		if (action) try {
-			await action.mutate({
-				deviceId: this.id,
-				patch: { [SOURCE_INFO_METADATA_KEY]: next }
+	async applyDeclaration(declaration, integrationId, index) {
+		try {
+			let existing = index.get(declaration.stableId);
+			if (existing === void 0) {
+				existing = (await this.readIndex()).get(declaration.stableId);
+				if (existing !== void 0) this.ports.logger.warn("device index disagreed with itself — adopting instead of re-creating", {
+					tags: { deviceId: existing.id },
+					meta: {
+						stableId: declaration.stableId,
+						addonId: this.ports.addonId
+					}
+				});
+			}
+			if (existing !== void 0) {
+				const device = await this.ports.devices.create(declaration.stableId, declaration.DeviceClass, {}, null, void 0);
+				this.ports.logger.info("declared device adopted", {
+					tags: { deviceId: device.id },
+					meta: {
+						stableId: declaration.stableId,
+						integrationId
+					}
+				});
+				return {
+					stableId: declaration.stableId,
+					deviceId: device.id,
+					device,
+					created: false
+				};
+			}
+			const device = await this.ports.devices.create(declaration.stableId, declaration.DeviceClass, declaration.config ?? {}, null, {
+				type: declaration.type,
+				name: declaration.name,
+				integrationId,
+				...declaration.role === void 0 ? {} : { role: declaration.role }
 			});
-		} catch {}
-		this.ctx.eventBus.emit(createEvent("device.source-info-changed", {
-			type: "device",
-			id: this.stableId
-		}, {
-			deviceId: this.id,
-			sourceInfo: next
-		}));
+			this.ports.logger.info("declared device created", {
+				tags: { deviceId: device.id },
+				meta: {
+					stableId: declaration.stableId,
+					integrationId
+				}
+			});
+			return {
+				stableId: declaration.stableId,
+				deviceId: device.id,
+				device,
+				created: true
+			};
+		} catch (err) {
+			this.ports.logger.warn("a declared device could not be brought up", { meta: {
+				stableId: declaration.stableId,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+			return null;
+		}
 	}
 	/**
-	* Re-publish the device's current `features` array to the persisted
-	* meta blob. Drivers call this after a probe finishes when the live
-	* `features` getter has gained new flags (e.g. `hasIntercom` flips
-	* to true → `DeviceFeature.TwoWayAudio` joins the list).
+	* Remove rows under the addon's FIXED integration whose declaration is gone.
 	*
-	* Without this, only the construction-time snapshot is written —
-	* `deviceManager.registerDevice` is invoked once per boot, so probe-
-	* driven additions don't reach the persisted index until the next
-	* server restart, and `getDevice` / `listAll` keep returning the
-	* stale list for forked-worker devices (whose live IDevice instance
-	* is invisible to the hub registry).
+	* Bounded to that integration: a declared integration has no operator
+	* add-flow, so every row under it got there by declaration. Devices this
+	* addon owns OUTSIDE it (a provider's adopted devices) are never candidates.
 	*
-	* Idempotent: re-calling with the same features just no-ops on the
-	* persisted meta. Best-effort: lookup or write failures are logged
-	* at debug and swallowed — the live `device.features` getter is
-	* still authoritative within this process, so callers never block
-	* device boot on a meta refresh.
-	*/
-	async refreshFeatures() {
-		const action = this.ctx.api?.deviceManager?.registerDevice;
-		if (!action) return;
-		try {
-			await action.mutate({
-				addonId: this.ctx.deviceMeta.addonId,
-				stableId: this.stableId,
-				id: this.id,
-				type: this.type,
-				name: this.name,
-				parentDeviceId: this.parentDeviceId,
-				features: [...this.features],
-				config: {}
+	* Bounded in count, and every deletion is logged with its `deviceId` — a
+	* withdrawal that removes an operator-visible row silently is the failure
+	* mode, not the removal itself.
+	*/
+	async sweepWithdrawn(declarations, integrationId, index) {
+		const declared = new Set(declarations.map((d) => d.stableId));
+		const candidates = [...index.values()].filter((row) => row.integrationId === integrationId && !declared.has(row.stableId));
+		if (candidates.length === 0) return [];
+		if (candidates.length > 32) {
+			this.ports.logger.warn("withdrawal sweep exceeded its bound — removing nothing", { meta: {
+				integrationId,
+				candidates: candidates.length,
+				bound: 32
+			} });
+			return [];
+		}
+		const removed = [];
+		for (const row of candidates) try {
+			await this.ports.devices.remove(row.id);
+			removed.push(row.id);
+			this.ports.logger.info("declared device removed — its declaration was withdrawn", {
+				tags: { deviceId: row.id },
+				meta: {
+					stableId: row.stableId,
+					integrationId
+				}
 			});
-		} catch (err) {}
+		} catch (err) {
+			this.ports.logger.warn("a withdrawn declared device could not be removed", {
+				tags: { deviceId: row.id },
+				meta: {
+					stableId: row.stableId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
+		return removed;
+	}
+};
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
+new Set(Object.values(DeviceType));
+DeviceFeature.BatteryOperated;
+/**
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
+*/
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
+/**
+* Frozen, null-prototype builtin function table for the expression engine
+* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
+* parser rejects any callee not in it, and the evaluator gates each call on an
+* own-property check against it.
+*
+* Because the object has a NULL prototype AND is `Object.freeze`d:
+*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
+*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
+*    (there is no `Object.prototype` in the chain), so those names are not
+*    callable — they are simply "unknown function" at parse time.
+*
+* Every numeric argument is validated as a finite number and every numeric
+* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
+* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
+* closed rather than emitting a garbage value.
+*/
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString$1(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString$1(args[1], "convert", 1).trim();
+			const to = asString$1(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
+	}
+};
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
+/**
+* Resource-bound constants for the safe expression engine.
+*
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
+*/
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
+]);
+/**
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
+*/
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	}
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
+/**
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
+*
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
+*
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+*/
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
+		};
+	}
+	peek() {
+		return this.tokens[this.pos];
+	}
+	next() {
+		return this.tokens[this.pos++];
+	}
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
+	}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
+		}
+		return false;
 	}
-	/**
-	* Typed read-through to a cap-keyed runtime-state slice. Drivers
-	* call `this.getCapSlice(batteryCapability)` and the return type
-	* is inferred from the cap's `runtimeState` Zod schema — no string
-	* key, no manual generic. Returns `null` when the slice hasn't
-	* been written yet (e.g. driver hasn't seeded battery yet).
-	*/
-	getCapSlice(cap) {
-		return this.runtimeState.getCapState(cap.name) ?? null;
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
 	}
-	/**
-	* Typed writer to a cap-keyed runtime-state slice. Routes through
-	* the runtime-state writer (validate → persist → emit cap event).
-	* Equivalent to `this.runtimeState.setCapState(cap.name, value)`
-	* but with the cap's `runtimeState` schema enforcing the value
-	* shape at compile time. Mirrors the symmetry of
-	* `getCapSlice` / `setCapSlice` for cross-cap consistency.
-	*/
-	setCapSlice(cap, value) {
-		this.runtimeState.setCapState(cap.name, value);
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
+		}
+		return test;
 	}
-	/**
-	* Field-level read/write proxy over a cap's runtime-state slice.
-	* Drivers that want ergonomic per-field access declare:
-	*
-	* ```ts
-	* protected battery = this.sliceProxy(batteryCapability)
-	* // …
-	* this.battery.sleeping = true        // patches the slice
-	* const charging = this.battery.charging  // reads the slice
-	* ```
-	*
-	* Reads return `undefined` when the slice hasn't been seeded yet
-	* (cap not registered, or seeded but the field is absent). Writes
-	* route through `runtimeState.patchCapState` so the cap's `runtimeState`
-	* schema validates the merged result and the cap event fires.
-	*
-	* Pattern is generic — same shape works for `battery`, `device-status`,
-	* `motion`, `doorbell`, anything with a `runtimeState:` schema. Drivers
-	* declare one proxy per cap they read/write directly.
-	*/
-	sliceProxy(cap) {
-		return new Proxy({}, {
-			get: (_, key) => {
-				return this.runtimeState.getCapState(cap.name)?.[key];
-			},
-			set: (_, key, value) => {
-				this.runtimeState.patchCapState(cap.name, { [key]: value });
-				return true;
-			},
-			has: (_, key) => {
-				const slice = this.runtimeState.getCapState(cap.name);
-				return slice ? key in slice : false;
-			},
-			ownKeys: () => {
-				const slice = this.runtimeState.getCapState(cap.name);
-				return slice ? Object.keys(slice) : [];
-			},
-			getOwnPropertyDescriptor: (_, key) => {
-				const slice = this.runtimeState.getCapState(cap.name);
-				if (!slice || !(key in slice)) return void 0;
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
 				return {
-					configurable: true,
-					enumerable: true,
-					value: slice[key]
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
 				};
 			}
-		});
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
 	}
-	/**
-	* Default empty settings UI. Drivers override this to expose an
-	* editable form in the device-details page. Returning an empty sections
-	* array signals "nothing to contribute" — the aggregator drops the
-	* contribution entirely rather than rendering a blank panel.
-	*/
-	getSettingsUISchema() {
-		return { sections: [] };
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
 	}
-	/**
-	* Default write path: forward the flat patch directly to storage.
-	* Drivers that project a UI shape different from storage (e.g. `RtspCamera`
-	* exposing `mainStreamUrl`/`subStreamUrl` over `streams[]`) override this
-	* to reshape before `config.setAll`.
-	*/
-	async applySettingsPatch(patch) {
-		await this.config.setAll(patch);
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
+/**
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
+*
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
+*/
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
 	}
-	/**
-	* Phase 3 — populate device-scoped state needed by downstream phases
-	* (accessory reconciliation, public `features` array, optional cap
-	* registration). Called ONCE per construction, after register but
-	* before `getAccessoryChildren()`.
-	*
-	* Drivers write the `feature-probe` runtime-state slice via
-	* `this.runtimeState.setCapState('feature-probe', {...})` — flag bag
-	* is open (Reolink writes `hasPtz/hasIntercom`, Hikvision writes
-	* `hasSupplementalLight/hasAlarmIo`, etc).
-	*
-	* Default: nothing to probe → mark the device PROBED (set `lastProbedAt`) so
-	* the kernel treats it as ready immediately. A device that derives its shape
-	* from a spec (a container, or an accessory sensor) rather than from a
-	* hardware probe has no probe to "complete"; without stamping `lastProbedAt`
-	* it would look perpetually un-probed — logging "Initial probe did not
-	* complete" on every boot and spinning a pointless retry chain. Drivers that
-	* DO probe override this and write their own `feature-probe` slice (including
-	* `lastProbedAt`) once their probe actually succeeds.
-	*/
-	async onProbe() {
-		const base = this.runtimeState.getCapState("feature-probe") ?? {
-			flags: {},
-			deviceType: null,
-			model: null,
-			channelCount: null,
-			lastProbedAt: 0,
-			lastFetchedAt: 0
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
 		};
-		this.runtimeState.setCapState("feature-probe", {
-			...base,
-			lastProbedAt: Date.now()
-		});
-	}
-	/**
-	* Phase 5 — fired after the device + its accessories are registered.
-	* Drivers publish streams to the broker, kick off background tasks,
-	* or subscribe to lib events that need a fully-registered device id.
-	*
-	* Default: no-op.
-	*
-	* RENAMED FROM `onCreated` (which still exists for back-compat in this
-	* pass). The new name reflects the post-probe, post-accessory contract.
-	*/
-	async onActivate() {}
-	/**
-	* Re-run the probe + reconcile accessories + refresh features meta.
-	* Drivers call this when device-side state changes (battery cam wakes,
-	* firmware update, manual operator trigger).
-	*
-	* The kernel injects `_kernelReprobe` on registration so this method
-	* delegates to the same orchestrator that runs the boot-time phase
-	* 3 + 4 sequence. Drivers should NOT override this — they override
-	* `onProbe()` instead.
-	*/
-	async reprobe() {
-		if (this._kernelReprobe) await this._kernelReprobe();
-		else await this.onProbe();
 	}
-	/**
-	* Kernel-injected callback that runs the full post-probe orchestration
-	* (onProbe → registerDevice meta refresh → accessory reconciliation).
-	* Set by `device-cap-proxy.register()`. Drivers should not touch this
-	* directly — call `reprobe()` instead.
-	*/
-	_kernelReprobe;
-	/**
-	* Declare accessory child devices the kernel should auto-spawn
-	* after `onProbe()` resolves. Each spec fully describes one child
-	* — stableId suffix (deterministic per kind for restore-safety),
-	* meta (type / name / location), config (initial blob the child
-	* self-hydrates), and a factory that constructs the concrete
-	* class with whatever closure-captured refs it needs (typically
-	* `this` for the parent reference).
-	*
-	* The kernel handles the rest: allocateDeviceId, persistInitialConfig
-	* (skipped on restore when the row already exists),
-	* persistInitialMeta, createContext, factory invocation, register,
-	* and recursive lifecycle (probe + accessories + activate).
-	*
-	* Implementations should derive children from
-	* `this.runtimeState.getCapState('feature-probe')` (post-probe truth).
-	* Drivers can use the `getProbeFlags()` helper to read the flag bag
-	* with a typed cast.
-	*
-	* Default: no children.
-	*/
-	getAccessoryChildren() {
-		return [];
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
 	}
-	/**
-	* Read the current feature-probe flag bag with a typed cast. Helper
-	* for `getAccessoryChildren()` and `features` getters that derive
-	* outputs from the probe results.
-	*/
-	getProbeFlags() {
-		return this.runtimeState.getCapState("feature-probe")?.flags ?? {};
+	return result;
+}
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
+}
+Object.freeze({});
+/**
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
 	}
-	/**
-	* Returns true once `onProbe` has completed at least once
-	* (`lastProbedAt > 0`). Drivers gate `getAccessoryChildren()` on this
-	* to avoid spawning stale accessories on a fresh device whose probe
-	* hasn't landed yet.
-	*/
-	hasProbed() {
-		return (this.runtimeState.getCapState("feature-probe")?.lastProbedAt ?? 0) > 0;
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
 	}
-};
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
-new Set(Object.values(DeviceType));
-DeviceFeature.BatteryOperated;
+	return null;
+}
+var ExpressionBindingSourceSchema = union([
+	object({
+		kind: literal("field").optional(),
+		sourceKey: string(),
+		cap: string(),
+		fieldPath: string()
+	}),
+	object({
+		kind: literal("literal"),
+		value: union([
+			string(),
+			number(),
+			boolean(),
+			_null()
+		])
+	}),
+	object({
+		kind: literal("global"),
+		sourceStableId: string(),
+		cap: string(),
+		fieldPath: string()
+	})
+]);
+object({
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
 Object.freeze({
 	"accessories.setChildHidden": {
 		capName: "accessories",
@@ -28822,6 +28633,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.restart": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.setEnabled": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -29458,12 +29275,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"deviceManager.setDeviceLinks": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"deviceManager.setDisabled": {
 		capName: "device-manager",
 		capScope: "system",
@@ -32608,6 +32419,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.fetchEventMedia": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.getAllRtspEntries": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -32692,6 +32509,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.produceEventMedia": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.publishCameraStream": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -33549,51 +33372,6 @@ var TimelapseRuleSchema = TimelapseRuleInputSchema.extend({
 	createdAt: number(),
 	updatedAt: number()
 });
-/** Cosine similarity between two embedding vectors */
-function cosineSimilarity(a, b) {
-	if (a.length !== b.length) return 0;
-	let dotProduct = 0;
-	let normA = 0;
-	let normB = 0;
-	for (let i = 0; i < a.length; i++) {
-		dotProduct += a[i] * b[i];
-		normA += a[i] * a[i];
-		normB += b[i] * b[i];
-	}
-	const denom = Math.sqrt(normA) * Math.sqrt(normB);
-	return denom === 0 ? 0 : dotProduct / denom;
-}
-function hfModelUrl(repo, path) {
-	return `https://huggingface.co/${repo}/resolve/main/${path}`;
-}
-/**
-* Vector wire codec — base64 of little-endian Float32.
-*
-* The `vector-store` capability carries vectors as base64 rather than
-* `number[]` or a typed array, and both rejected alternatives have a scar here:
-*
-*  - a `Float32Array` does NOT survive msgpack across the UDS transport (it
-*    arrived as an empty object and froze audio dBFS until the payload was
-*    changed to carry bytes);
-*  - `number[]` is the ~5x-larger encoding the capability exists to stop paying
-*    — a 512-dim vector is 2,048 bytes raw and 2,732 as base64, against roughly
-*    10-12 KB rendered as JSON text.
-*
-* Endianness is pinned to little-endian explicitly instead of inheriting the
-* platform's, so a vector written on one node decodes correctly on another.
-*/
-/** Encode a vector as base64 of little-endian Float32. */
-function encodeVectorBase64(vector) {
-	const floats = vector instanceof Float32Array ? vector : Float32Array.from(vector);
-	const bytes = new Uint8Array(floats.length * 4);
-	const view = new DataView(bytes.buffer);
-	for (let i = 0; i < floats.length; i += 1) view.setFloat32(i * 4, floats[i] ?? 0, true);
-	return Buffer.from(bytes).toString("base64");
-}
-/** Vector length implied by a base64 payload, without decoding it. */
-function vectorDimFromBase64(encoded) {
-	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
-}
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -33700,6 +33478,51 @@ DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
+/** Cosine similarity between two embedding vectors */
+function cosineSimilarity(a, b) {
+	if (a.length !== b.length) return 0;
+	let dotProduct = 0;
+	let normA = 0;
+	let normB = 0;
+	for (let i = 0; i < a.length; i++) {
+		dotProduct += a[i] * b[i];
+		normA += a[i] * a[i];
+		normB += b[i] * b[i];
+	}
+	const denom = Math.sqrt(normA) * Math.sqrt(normB);
+	return denom === 0 ? 0 : dotProduct / denom;
+}
+function hfModelUrl(repo, path) {
+	return `https://huggingface.co/${repo}/resolve/main/${path}`;
+}
+/**
+* Vector wire codec — base64 of little-endian Float32.
+*
+* The `vector-store` capability carries vectors as base64 rather than
+* `number[]` or a typed array, and both rejected alternatives have a scar here:
+*
+*  - a `Float32Array` does NOT survive msgpack across the UDS transport (it
+*    arrived as an empty object and froze audio dBFS until the payload was
+*    changed to carry bytes);
+*  - `number[]` is the ~5x-larger encoding the capability exists to stop paying
+*    — a 512-dim vector is 2,048 bytes raw and 2,732 as base64, against roughly
+*    10-12 KB rendered as JSON text.
+*
+* Endianness is pinned to little-endian explicitly instead of inheriting the
+* platform's, so a vector written on one node decodes correctly on another.
+*/
+/** Encode a vector as base64 of little-endian Float32. */
+function encodeVectorBase64(vector) {
+	const floats = vector instanceof Float32Array ? vector : Float32Array.from(vector);
+	const bytes = new Uint8Array(floats.length * 4);
+	const view = new DataView(bytes.buffer);
+	for (let i = 0; i < floats.length; i += 1) view.setFloat32(i * 4, floats[i] ?? 0, true);
+	return Buffer.from(bytes).toString("base64");
+}
+/** Vector length implied by a base64 payload, without decoding it. */
+function vectorDimFromBase64(encoded) {
+	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
+}
 //#endregion
 Object.defineProperty(exports, "BaseAddon", {
 	enumerable: true,
@@ -33719,6 +33542,12 @@ Object.defineProperty(exports, "DEFAULT_EVENT_COLOR", {
 		return DEFAULT_EVENT_COLOR;
 	}
 });
+Object.defineProperty(exports, "DeclaredDevices", {
+	enumerable: true,
+	get: function() {
+		return DeclaredDevices;
+	}
+});
 Object.defineProperty(exports, "DeviceType", {
 	enumerable: true,
 	get: function() {
@@ -33743,12 +33572,6 @@ Object.defineProperty(exports, "EventCategory", {
 		return EventCategory;
 	}
 });
-Object.defineProperty(exports, "Fmp4BoxSplitter", {
-	enumerable: true,
-	get: function() {
-		return Fmp4BoxSplitter;
-	}
-});
 Object.defineProperty(exports, "LabelAttributionSchema", {
 	enumerable: true,
 	get: function() {
@@ -33899,12 +33722,6 @@ Object.defineProperty(exports, "buildEventKindDescriptor", {
 		return buildEventKindDescriptor;
 	}
 });
-Object.defineProperty(exports, "buildFfmpegArgs", {
-	enumerable: true,
-	get: function() {
-		return buildFfmpegArgs;
-	}
-});
 Object.defineProperty(exports, "cosineSimilarity", {
 	enumerable: true,
 	get: function() {
@@ -33977,12 +33794,6 @@ Object.defineProperty(exports, "isScheduleActive", {
 		return isScheduleActive;
 	}
 });
-Object.defineProperty(exports, "isSoftwareDecode", {
-	enumerable: true,
-	get: function() {
-		return isSoftwareDecode;
-	}
-});
 Object.defineProperty(exports, "kebabToCamel", {
 	enumerable: true,
 	get: function() {