@camstack/addon-post-analysis 1.2.51 → 1.2.53

package/dist/{dist-DTeVOZBt.mjs → dist-Da97q0x6.mjs}

@@ -1,4 +1,3 @@
-import "node:crypto";
 //#region ../types/dist/event-category-41fKf-q9.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
@@ -7136,473 +7135,6 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }
 //#endregion
-//#region ../types/dist/fmp4-box-splitter-B53u9-Nu.mjs
-var AUDIO_ENCODER_BY_CODEC = {
-	opus: "libopus",
-	aac: "aac",
-	pcmu: "pcm_mulaw",
-	pcma: "pcm_alaw"
-};
-/**
-* Camera-microphone audio, per codec. Lives HERE rather than in
-* `encode-defaults.ts` only to avoid an import cycle (`encode-defaults` depends
-* on these types); it is re-exported from there, which is where to read it.
-*
-* Every source in this repo is a mono camera mic. The former broker preset
-* encoded Opus at `channels: 2`, spending bitrate duplicating one channel —
-* that is the value this consolidation changed.
-*/
-var AUDIO_PRESETS = {
-	aac: {
-		kind: "encode",
-		codec: "aac",
-		bitrateKbps: 128,
-		sampleRateHz: 48e3,
-		channels: 1
-	},
-	opus: {
-		kind: "encode",
-		codec: "opus",
-		bitrateKbps: 64,
-		sampleRateHz: 48e3,
-		channels: 1
-	},
-	pcmu: {
-		kind: "encode",
-		codec: "pcmu",
-		sampleRateHz: 8e3,
-		channels: 1
-	}
-};
-/** `-hide_banner -loglevel <level>` — every ffmpeg site opens with this. */
-function logBannerArgs(level) {
-	return [
-		"-hide_banner",
-		"-loglevel",
-		level
-	];
-}
-/** `true` when the resolved value means "decode in software" (⇒ no `-hwaccel`). */
-function isSoftwareDecode(decodeHwAccel) {
-	return !decodeHwAccel || decodeHwAccel === "none" || decodeHwAccel === "copy";
-}
-/**
-* Every INPUT option, in order, terminated by `-i <url>`. Nothing may be
-* appended to this list by a caller — that is the whole point of the function.
-*/
-function buildInputArgs(input, decodeHwAccel) {
-	const args = [];
-	if (!isSoftwareDecode(decodeHwAccel)) args.push("-hwaccel", String(decodeHwAccel));
-	if (input.extraArgs?.length) args.push(...input.extraArgs);
-	if (input.analyzeDurationUs !== void 0) args.push("-analyzeduration", String(input.analyzeDurationUs));
-	if (input.probeSizeBytes !== void 0) args.push("-probesize", String(input.probeSizeBytes));
-	if (input.fflags?.length) for (const flag of input.fflags) args.push("-fflags", flag);
-	if (input.rtspTransport) args.push("-rtsp_transport", input.rtspTransport);
-	args.push("-i", input.url);
-	return args;
-}
-/** The `-vf` filter args, or `[]` when a consumer `-vf` already claims the slot. */
-function buildVideoFilterArgs(scale, outputArgs) {
-	if (!scale) return [];
-	if (outputArgs.some((a) => a === "-vf")) return [];
-	if (scale.mode === "exact") return ["-vf", `scale=${scale.width}:${scale.height}`];
-	return ["-vf", `scale='min(${scale.width},iw)':'min(${scale.height},ih)':force_original_aspect_ratio=decrease:force_divisible_by=2`];
-}
-/** Rate-control args for an encode plan. */
-function buildRateControlArgs(video) {
-	const kbps = video.bitrateKbps;
-	if (kbps === void 0) return [];
-	const rc = video.rateControl ?? {
-		kind: "cap",
-		vbvSeconds: 2
-	};
-	const bufsize = Math.max(1, Math.round(kbps * rc.vbvSeconds));
-	return [
-		...rc.kind === "cbr" ? ["-b:v", `${kbps}k`] : [],
-		"-maxrate",
-		`${kbps}k`,
-		"-bufsize",
-		`${bufsize}k`
-	];
-}
-/** The whole video block (`-vf` … `-c:v` … knobs), after `-i`. */
-function buildVideoArgs(video, outputArgs) {
-	if (video.kind === "copy") return [
-		"-c:v",
-		"copy",
-		...video.bitstreamFilter ? ["-bsf:v", video.bitstreamFilter] : []
-	];
-	const args = [
-		...buildVideoFilterArgs(video.scale, outputArgs),
-		"-c:v",
-		video.encoder
-	];
-	if (video.preset !== void 0) args.push("-preset", video.preset);
-	if (video.tune !== void 0) args.push("-tune", video.tune);
-	if (video.profile !== void 0) args.push("-profile:v", video.profile);
-	if (video.level !== void 0) args.push("-level", video.level);
-	if (video.pixelFormat !== void 0) args.push("-pix_fmt", video.pixelFormat);
-	if (video.fps !== void 0) args.push("-r", String(video.fps));
-	if (video.gopFrames !== void 0) args.push("-g", String(video.gopFrames));
-	if (video.forceKeyFramesSeconds !== void 0) args.push("-force_key_frames", `expr:gte(t,n_forced*${video.forceKeyFramesSeconds})`);
-	if (video.bf !== void 0) args.push("-bf", String(video.bf));
-	args.push(...buildRateControlArgs(video));
-	if (video.bitstreamFilter !== void 0) args.push("-bsf:v", video.bitstreamFilter);
-	return args;
-}
-/** The whole audio block, after `-i`. */
-function buildAudioArgs(audio) {
-	if (audio.kind === "none") return ["-an"];
-	if (audio.kind === "copy") return ["-c:a", "copy"];
-	const args = [];
-	if (audio.filter !== void 0) args.push("-af", audio.filter);
-	args.push("-c:a", AUDIO_ENCODER_BY_CODEC[audio.codec]);
-	if (audio.application !== void 0) args.push("-application", audio.application);
-	if (audio.frameDurationMs !== void 0) args.push("-frame_duration", String(audio.frameDurationMs));
-	if (audio.globalHeader === true) args.push("-flags", "+global_header");
-	if (audio.sampleRateHz !== void 0) args.push("-ar", String(audio.sampleRateHz));
-	if (audio.bitrateKbps !== void 0) args.push("-b:a", `${audio.bitrateKbps}k`);
-	if (audio.vbvBufferKbits !== void 0) args.push("-bufsize", `${audio.vbvBufferKbits}k`);
-	if (audio.channels !== void 0) args.push("-ac", String(audio.channels));
-	return args;
-}
-/** RTP output-leg args (`-payload_type`, `-ssrc`, `-sdp_file`, `-f rtp <url>`). */
-function buildRtpOutputArgs(out) {
-	const args = [];
-	if (out.payloadType !== void 0) args.push("-payload_type", String(out.payloadType));
-	if (out.ssrc !== void 0) args.push("-ssrc", String(out.ssrc));
-	if (out.sdpFile !== void 0) args.push("-sdp_file", out.sdpFile);
-	args.push("-f", "rtp", out.url);
-	return args;
-}
-/** `true` when the sink is a raw elementary bytestream that cannot mux audio. */
-function isElementaryVideoSink(sink) {
-	return sink.kind === "stdout" && (sink.container === "h264" || sink.container === "hevc");
-}
-/**
-* The fragmented-MP4 muxer flags, in the order the recorder has proven them
-* (`recorder/addon/ffmpeg-args.ts` passes the same `movflags` string through
-* `-segment_format_options`, across every vendor in the fleet):
-*
-* - `frag_keyframe` — cut a fragment at each key frame, so every fragment
-*   opens on a sync sample. HKSV's whole requirement.
-* - `empty_moov` — write `ftyp`+`moov` up front with no samples in it, which
-*   is what makes the head a standalone INITIALISATION segment.
-* - `default_base_moof` — fragment offsets are self-relative, so a fragment is
-*   demuxable without the bytes that preceded it. D31's byte-range read path
-*   depends on exactly this property of the recorder's segments.
-*/
-var FMP4_MOVFLAGS = "+frag_keyframe+empty_moov+default_base_moof";
-/**
-* The terminal sink args for every non-`rtp-outputs` sink. Exhaustive over the
-* union so a new member cannot fall through to `['-f', container, 'pipe:1']`,
-* which is what a plain `container` read would have done for `mp4` — a valid
-* argv that writes a NON-fragmented, unseekable-to-a-pipe MP4 and produces one
-* unusable byte stream.
-*/
-function buildStdoutOrRtspSinkArgs(sink) {
-	if (sink.kind === "rtsp-listen") return [
-		"-f",
-		"rtsp",
-		"-rtsp_transport",
-		"tcp",
-		"-rtsp_flags",
-		"listen",
-		sink.url
-	];
-	if (sink.kind === "rtp-outputs") return [];
-	return sink.container === "mp4" ? buildFmp4SinkArgs(sink) : [
-		"-f",
-		sink.container,
-		"pipe:1"
-	];
-}
-/**
-* How far BELOW the negotiated fragment length `-min_frag_duration` is set.
-*
-* `-min_frag_duration` refuses to cut before that much media has accumulated,
-* and then waits for the next key frame. Set to exactly `fragmentMs`, the
-* commonest camera configuration in existence — a key-frame grid EQUAL to the
-* requested fragment length — lands the deadline on the same instant as the key
-* frame, loses the race, and skips to the following one: **every fragment comes
-* out at twice the requested length.**
-*
-* Measured on the live fleet 2026-08-07, camera 615, `-c:v copy` (D84):
-*
-* | slot | GOP | `-min_frag_duration` | median gap |
-* | --- | --- | --- | --- |
-* | 1280×720 | 40 f @ 10 fps = 4.0 s | 4000 ms | **7944 ms** |
-* | 1280×720 | 40 f @ 10 fps = 4.0 s | 3600 ms | 3973 ms |
-* | 3840×2160 | 100 f @ 25 fps = 4.0 s | 4000 ms | 8042 ms |
-* | 3840×2160 | 100 f @ 25 fps = 4.0 s | 3600 ms | 3998 ms |
-*
-* A doubled fragment is not a cosmetic overshoot: HKSV requires every fragment
-* to be no longer than the length the controller SELECTED, so the shipped-but-
-* inert phase-1 sink would have violated the contract on its first real clip.
-*
-* 10 % is chosen against the two failures either side of it. Too small and
-* ordinary jitter (measured spread 3953-4096 ms) re-loses the race; too large
-* and a source with a key frame slightly EARLY than the grid gets cut there,
-* yielding a short fragment for no reason.
-*/
-var FMP4_MIN_FRAG_MARGIN = .9;
-/** `-movflags … -min_frag_duration <us> -f mp4 pipe:1`. */
-function buildFmp4SinkArgs(sink) {
-	return [
-		"-movflags",
-		FMP4_MOVFLAGS,
-		"-min_frag_duration",
-		String(Math.max(0, Math.round(sink.fragmentMs * FMP4_MIN_FRAG_MARGIN * 1e3))),
-		"-f",
-		"mp4",
-		"pipe:1"
-	];
-}
-/**
-* A second output mapping source audio to RTP-over-UDP. `0:a:0?` makes the
-* audio optional so a source with no audio skips it instead of failing the
-* whole invocation.
-*/
-function buildAudioSidecarArgs(sidecar) {
-	return [
-		"-map",
-		"0:a:0?",
-		...buildAudioArgs(sidecar.codec === "pcma" ? {
-			kind: "encode",
-			codec: "pcma",
-			sampleRateHz: 8e3,
-			channels: 1
-		} : AUDIO_PRESETS[sidecar.codec]),
-		...buildRtpOutputArgs({
-			url: sidecar.rtpUrl,
-			sdpFile: sidecar.sdpFile
-		})
-	];
-}
-/**
-* Assemble the full ffmpeg argument list. Layout:
-*
-*   -hide_banner -loglevel <level>
-*   [-hwaccel <backend|auto>]        ─┐ INPUT options — strictly before -i.
-*   [<input.extraArgs>]               │
-*   [-fflags <flag>…]                 │
-*   [-rtsp_transport tcp]             │
-*   -i <url>                         ─┘
-*   <video block>  <threads>  <audio block>   ─┐ OUTPUT options.
-*   <consumer outputArgs verbatim>             │
-*   <sink>                                    ─┘ terminal
-*/
-function buildFfmpegArgs(inv) {
-	const head = [...logBannerArgs(inv.logLevel), ...buildInputArgs(inv.input, inv.decodeHwAccel)];
-	const threadArgs = inv.threadCount > 0 ? ["-threads", String(inv.threadCount)] : [];
-	if (inv.sink.kind === "rtp-outputs") {
-		const videoLeg = inv.sink.video ? [
-			"-an",
-			"-map",
-			"0:v:0",
-			...buildVideoArgs(inv.video, inv.outputArgs),
-			...threadArgs,
-			...inv.outputArgs,
-			...buildRtpOutputArgs(inv.sink.video)
-		] : [];
-		const audioLeg = inv.sink.audio ? [
-			"-vn",
-			"-map",
-			"0:a:0?",
-			...buildAudioArgs(inv.audio),
-			...buildRtpOutputArgs(inv.sink.audio)
-		] : [];
-		return [
-			...head,
-			...videoLeg,
-			...audioLeg
-		];
-	}
-	const audioArgs = isElementaryVideoSink(inv.sink) ? ["-an"] : buildAudioArgs(inv.audio);
-	const sinkArgs = buildStdoutOrRtspSinkArgs(inv.sink);
-	return [
-		...head,
-		...buildVideoArgs(inv.video, inv.outputArgs),
-		...threadArgs,
-		...audioArgs,
-		...inv.outputArgs,
-		...sinkArgs,
-		...inv.audioSidecar ? buildAudioSidecarArgs(inv.audioSidecar) : []
-	];
-}
-var DEFAULT_MAX_UNIT_BYTES = 16 * 1024 * 1024;
-/** Header size for a normal box, and for one carrying a 64-bit `largesize`. */
-var BOX_HEADER_BYTES = 8;
-var LARGE_BOX_HEADER_BYTES = 16;
-var Fmp4BoxSplitter = class {
-	maxUnitBytes;
-	/** Bytes of the CURRENT unit plus any partial box after it. */
-	buffer = new Uint8Array(0);
-	/** Where the current unit starts inside {@link buffer}. */
-	unitStart = 0;
-	/** Where the box scanner has reached inside {@link buffer}. */
-	cursor = 0;
-	state = "init";
-	nextSequence = 0;
-	faultReason = null;
-	interstitial = /* @__PURE__ */ new Set();
-	constructor(options = {}) {
-		this.maxUnitBytes = options.maxUnitBytes ?? DEFAULT_MAX_UNIT_BYTES;
-	}
-	/**
-	* Non-null once the stream cannot be split. The splitter emits nothing
-	* further, so a caller polls this to kill the child rather than watching a
-	* silent stall — a fragmenter that quietly stops producing looks exactly like
-	* a camera with no motion.
-	*/
-	get fault() {
-		return this.faultReason;
-	}
-	/** Bytes currently held. The memory bound, observable rather than asserted. */
-	get pendingBytes() {
-		return this.buffer.length - this.unitStart;
-	}
-	/**
-	* Top-level box types seen BETWEEN fragments and discarded — `mfra`, `free`,
-	* a stray `sidx`. Reported rather than dropped in silence: they are legal and
-	* useless to a fragment consumer, but a type nobody expected showing up here
-	* is the first symptom of a muxer that is not writing what we think it is.
-	*/
-	get discardedInterstitialTypes() {
-		return [...this.interstitial];
-	}
-	/**
-	* Feed bytes; get back whatever units completed. Returns `[]` once faulted.
-	*/
-	push(chunk) {
-		if (this.faultReason !== null || chunk.length === 0) return [];
-		this.append(chunk);
-		if (this.pendingBytes > this.maxUnitBytes) return this.fail(`a single fMP4 unit exceeded ${this.maxUnitBytes} bytes — this stream is not fragmented`);
-		return this.drainBoxes();
-	}
-	append(chunk) {
-		if (this.buffer.length === 0) {
-			this.buffer = chunk.slice();
-			return;
-		}
-		const next = new Uint8Array(this.buffer.length + chunk.length);
-		next.set(this.buffer, 0);
-		next.set(chunk, this.buffer.length);
-		this.buffer = next;
-	}
-	/** Consume every COMPLETE top-level box now in the buffer. */
-	drainBoxes() {
-		const units = [];
-		for (;;) {
-			const header = this.readHeader();
-			if (this.faultReason !== null) return units;
-			if (header === null) break;
-			if (this.cursor + header.totalBytes > this.buffer.length) break;
-			const boxStart = this.cursor;
-			const boxEnd = boxStart + header.totalBytes;
-			this.cursor = boxEnd;
-			const unit = this.consumeBox(header.type, boxStart, boxEnd);
-			if (this.faultReason !== null) return units;
-			if (unit !== null) units.push(unit);
-		}
-		this.compact();
-		return units;
-	}
-	/**
-	* Apply one box to the state machine. Returns a unit when this box CLOSED
-	* one, `null` otherwise.
-	*/
-	consumeBox(type, boxStart, boxEnd) {
-		if (this.state === "init") {
-			if (type !== "moof") return null;
-			if (boxStart === this.unitStart) {
-				this.fail("a moof arrived before any initialisation box — there is no ftyp/moov to send");
-				return null;
-			}
-			const init = this.emit("init", this.unitStart, boxStart);
-			this.unitStart = boxStart;
-			this.state = "fragment";
-			return init;
-		}
-		if (this.state === "idle") {
-			if (type !== "moof") {
-				this.interstitial.add(type);
-				this.unitStart = boxEnd;
-				return null;
-			}
-			this.unitStart = boxStart;
-			this.state = "fragment";
-			return null;
-		}
-		if (type !== "mdat") return null;
-		const fragment = this.emit("fragment", this.unitStart, boxEnd);
-		this.unitStart = boxEnd;
-		this.state = "idle";
-		return fragment;
-	}
-	/**
-	* Parse the header at {@link cursor}, or `null` when too few bytes have
-	* arrived to know. Faults on a size the splitter cannot honour.
-	*/
-	readHeader() {
-		const available = this.buffer.length - this.cursor;
-		if (available < BOX_HEADER_BYTES) return null;
-		const view = new DataView(this.buffer.buffer, this.buffer.byteOffset, this.buffer.byteLength);
-		const size = view.getUint32(this.cursor);
-		const type = String.fromCharCode(this.buffer[this.cursor + 4] ?? 0, this.buffer[this.cursor + 5] ?? 0, this.buffer[this.cursor + 6] ?? 0, this.buffer[this.cursor + 7] ?? 0);
-		if (size === 0) {
-			this.fail(`box "${type}" declares size 0 (to EOF) — an unbounded box cannot be fragmented`);
-			return null;
-		}
-		if (size === 1) {
-			if (available < LARGE_BOX_HEADER_BYTES) return null;
-			const large = view.getBigUint64(this.cursor + BOX_HEADER_BYTES);
-			if (large > BigInt(this.maxUnitBytes)) {
-				this.fail(`box "${type}" declares ${large} bytes, over the ${this.maxUnitBytes} byte bound`);
-				return null;
-			}
-			return {
-				type,
-				totalBytes: Number(large)
-			};
-		}
-		if (size < BOX_HEADER_BYTES) {
-			this.fail(`box "${type}" declares an impossible size of ${size} bytes`);
-			return null;
-		}
-		return {
-			type,
-			totalBytes: size
-		};
-	}
-	emit(kind, start, end) {
-		const sequence = this.nextSequence;
-		this.nextSequence += 1;
-		return {
-			kind,
-			data: this.buffer.slice(start, end),
-			sequence
-		};
-	}
-	/**
-	* Drop everything already emitted or discarded. Without this the buffer is
-	* the whole stream and the process dies in hours, not minutes.
-	*/
-	compact() {
-		if (this.unitStart === 0) return;
-		this.buffer = this.buffer.slice(this.unitStart);
-		this.cursor -= this.unitStart;
-		this.unitStart = 0;
-	}
-	fail(reason) {
-		this.faultReason = reason;
-		this.buffer = new Uint8Array(0);
-		this.unitStart = 0;
-		this.cursor = 0;
-		return [];
-	}
-};
-//#endregion
 //#region ../types/dist/err-msg-IQTHeDzc.mjs
 /**
 import { errMsg } from '@camstack/types'
@@ -9624,6 +9156,69 @@ var StreamFormatSchema = _enum([
 	"mjpeg",
 	"rtsp"
 ]);
+/** A container `produceEventMedia` can emit. */
+var EventMediaKindSchema = _enum(["mp4", "gif"]);
+/**
+* One produced artifact, referenced by HANDLE.
+*
+* Never inline bytes: a produced clip is 200 KB–5 MB and every consumer of this
+* method is in another runner ([D9](../../../../docs/decisions/adr-0009.md),
+* [D18](../../../../docs/decisions/adr-0018.md) — cross-process media is fetched
+* on demand, compressed, by handle). `bytes` is here so a caller can decide
+* whether it wants the fetch at all.
+*/
+var EventMediaArtifactSchema = object({
+	kind: EventMediaKindSchema,
+	/** Opaque, single-camera, short-lived. Redeem with `fetchEventMedia`. */
+	handle: string(),
+	/**
+	* The node holding the bytes — the ROUTING key for `fetchEventMedia`.
+	*
+	* `stream-broker` is a singleton cap and an unpinned call never leaves the
+	* hub, so a handle produced on an agent's broker would be redeemed against
+	* the hub's store and come back `null`. Same contract, same field name and
+	* the same reason as `FrameHandleSchema.nodeId`: the producer stamps where it
+	* lives and the consumer pins to it.
+	*/
+	nodeId: string(),
+	mime: string(),
+	bytes: number().int(),
+	width: number().int(),
+	height: number().int()
+});
+/**
+* What a production actually covered — the answer to the only question an
+* operator asks about a notification clip.
+*
+* `fromTs`/`toTs` are WALL CLOCK, derived from the ring's own packet timeline,
+* so a caller can state "this clip starts 4.1 s before the event" instead of
+* inferring it from a duration. A production whose `fromTs` is later than the
+* event is a production with no pre-roll, and that is exactly the defect this
+* method exists to make visible rather than plausible.
+*/
+var EventMediaCoverageSchema = object({
+	fromTs: number(),
+	toTs: number(),
+	/** Encoded packets in the muxed window. */
+	packets: number().int()
+});
+/**
+* The result of ONE cut, in every container the caller asked for.
+*
+* Every artifact in `media` came out of the SAME window of the SAME rendition —
+* that is the whole reason this is one method rather than one call per format.
+* A consumer attaching a gif and a video can no longer show two different
+* moments, because it never chose two sources.
+*/
+var EventMediaProductionSchema = object({
+	media: array(EventMediaArtifactSchema).readonly(),
+	coverage: EventMediaCoverageSchema,
+	/** The rendition actually cut from — what the default or the fallback chose. */
+	profile: CamProfileSchema,
+	/** `copy` = the camera's own H.264, untouched. `encode` = re-encoded (H.265
+	*  source, a downscale, or a playback rate other than 1). */
+	video: _enum(["copy", "encode"])
+});
 var RtspRestreamEntrySchema = object({
 	brokerId: string(),
 	url: string(),
@@ -10023,6 +9618,56 @@ method(object({
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	/** Absent = the largest H.264 rendition at or below 1080p, which is
+	*  also the one that can be copied. Falls back to whatever the ring
+	*  actually retained, and the answer says which. */
+	profile: CamProfileSchema.optional(),
+	aroundMs: number(),
+	preSeconds: number().min(0).max(20).default(4),
+	postSeconds: number().min(0).max(20).default(6),
+	kinds: array(EventMediaKindSchema).min(1).default(["mp4"]),
+	/** GIF geometry. The video keeps the source's own. */
+	gifMaxWidth: number().int().min(120).max(1280).default(640),
+	/**
+	* The gif's own PLAYBACK rate in frames per second — what the finished
+	* gif runs at, not how many source frames feed it. The decimation that
+	* feeds it samples `gifFps / gifSpeed` source frames per second, so at
+	* the defaults a 12 fps gif is built out of 3 source frames a second.
+	*/
+	gifFps: number().int().min(1).max(15).default(12),
+	/**
+	* How fast the GIF plays against real time, independent of `speed`.
+	*
+	* 4× by default, by operator request: a notification gif is glanced at
+	* on a lock screen, so a ~12 s window has to be over in ~3 s. It stays
+	* a separate knob from `speed` even though both now default to 4 —
+	* a caller wanting a real-time video and a fast gif must not have to
+	* choose.
+	*/
+	gifSpeed: number().min(1).max(8).default(4),
+	/**
+	* Playback rate of the VIDEO. Also 4× by default, by operator decision.
+	*
+	* `1` is real time and is the ONLY value that allows the copy branch —
+	* anything else forces `libx264` over the window. That was priced
+	* before it was chosen: a per-event burst measured at 0.23 s and 254 KB
+	* on a real 615 720p cut, against 922 KB for the copy it replaces. A
+	* re-encode is capped at 720p (`EVENT_CLIP_ENCODE_MAX_WIDTH`), because
+	* once the decode is forced the width stops being free.
+	*/
+	speed: number().min(1).max(8).default(4)
+}), EventMediaProductionSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ handle: string() }), object({
+	base64: string(),
+	mime: string(),
+	bytes: number().int()
+}).nullable(), {
+	kind: "mutation",
+	auth: "admin"
 }), method(_void(), array(CameraStreamSchema).readonly()), method(_void(), array(ProfileSlotSchema).readonly()), method(object({ brokerId: string() }), BrokerStatsSchema), method(object({ brokerId: string() }), object({
 	probed: boolean(),
 	summary: string()
@@ -10314,25 +9959,6 @@ var cameraStreamsCapability = {
 function kebabToCamel(s) {
 	return s.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
 }
-/**
-* core-blocks — user-authored TypeScript, stored in the kernel and executed in
-* its own process.
-*
-* Spec: `docs/superpowers/specs/2026-08-04-core-blocks-and-synthetic-devices-design.md`.
-*
-* The first use is **owning devices without being a device provider**: a block
-* declares devices under a system or custom integration and drives their state,
-* with the same `ctx` an addon gets. Automations come later; nothing here
-* models a trigger.
-*
-* **Stated plainly, because it does not change by being true:** a block has an
-* addon's powers — devices, storage, the event bus, `ctx.api`. It is a plugin
-* with no review step. What makes that survivable is not a sandbox, it is
-* PROCESS ISOLATION: one process per block, supervised by `CrashSupervisor`,
-* so a block that throws or never returns is marked `failed` and visible
-* instead of taking the hub with it (D6). Every method here is admin-only, and
-* must stay so.
-*/
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
@@ -10404,6 +10030,9 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 }), object({ block: CoreBlockSchema }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ blockId: string() }), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ code: string() }), CoreBlockCompileResultSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -11204,840 +10833,159 @@ var ExposeInputSchema = object({
 });
 var UnexposeInputSchema = object({ deviceId: string() });
 method(_void(), DeviceExportStatusSchema), method(_void(), array(DeviceKindSchema)), method(_void(), array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), { kind: "mutation" }), method(UnexposeInputSchema, _void(), { kind: "mutation" });
+var ProviderStatusSchema = object({
+	connected: boolean(),
+	deviceCount: number(),
+	error: string().optional()
+});
+object({
+	externalId: string(),
+	name: string(),
+	type: string(),
+	metadata: record(string(), unknown()).optional()
+});
 /**
-* Resource-bound constants for the safe expression engine.
-*
-* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
-* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
-* O(nodeCount) by construction. These caps merely put a hard ceiling on the
-* work a single author-supplied expression can request, so a hostile or
-* accidental pathological string can never spend unbounded CPU/memory.
+* Candidate handed back from discovery and accepted by
+* `adoptDiscoveredDevice`. Shape mirrors the in-process
+* `DiscoveredDevice` interface used by `DeviceDiscovery`.
 */
-/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
-*  rejected without allocation. */
-var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
-/** A legal binding / identifier name. */
-var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Binding names an author may NOT use: `now` is auto-injected; the literal
-*  keywords lex as values, not identifiers, so binding to them is meaningless. */
-var RESERVED_BINDING_NAMES = new Set([
-	"now",
-	"true",
-	"false",
-	"null"
-]);
+var DiscoveryCandidateSchema = object({
+	stableId: string(),
+	type: _enum(DeviceType),
+	suggestedName: string(),
+	prefilledConfig: record(string(), unknown()),
+	/**
+	* Optional upstream-system identity (HA entity_id, vendor MAC, …).
+	* Discovery pre-populates this for systems that know the upstream
+	* identity ahead of adoption. Rendering metadata (unit, precision)
+	* flows live through the cap STATUS SLICE after adoption.
+	*/
+	sourceInfo: SourceInfoSchema.optional()
+});
 /**
-* Error types for the safe expression engine. Two distinct classes so callers
-* can tell a compile-time (grammar) failure from a runtime (evaluation)
-* failure — both are non-fatal to the host: read paths degrade to "skip link".
+* Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
+* Mirrors `toDeviceShape()` output in `device-management.router.ts` so the
+* tRPC layer can pass it through without reshaping.
 */
-/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
-*  the failure is anchored to a character (author-facing inline feedback). */
-var ExpressionParseError = class extends Error {
-	position;
-	constructor(message, position) {
-		super(message);
-		this.name = "ExpressionParseError";
-		this.position = position;
-	}
-};
-/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
-*  result, unknown builtin, step-budget exceeded). */
-var ExpressionEvalError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ExpressionEvalError";
-	}
-};
+var DeviceSummarySchema = object({
+	id: number(),
+	stableId: string(),
+	addonId: string(),
+	type: string(),
+	name: string(),
+	parentDeviceId: number().nullable(),
+	online: boolean(),
+	features: array(string()),
+	config: record(string(), unknown()),
+	/** Optional upstream-system identity (dispatch key + system tag).
+	*  See `SourceInfo`. Present when the device has a non-synthetic
+	*  source identifier (HA entities, vendor MAC, …); omitted when the
+	*  synthetic backfill is in effect. */
+	sourceInfo: SourceInfoSchema.optional()
+});
 /**
-* Frozen, null-prototype builtin function table for the expression engine
-* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
-* parser rejects any callee not in it, and the evaluator gates each call on an
-* own-property check against it.
+* Result of a live field test (e.g. probing an RTSP URL during device
+* creation). Matches the UI-side `FieldProbeResult` in
+* `interfaces/config-ui.ts` — the admin `FormBuilder` renders the
+* returned `labels` as chips next to the input.
+*/
+var FieldProbeResultSchema = object({
+	status: _enum(["ok", "error"]),
+	labels: array(string()).optional(),
+	error: string().optional()
+});
+/**
+* The output of `getChildCreationSchema` is a UI schema tree. We store
+* it as `unknown` at the capability layer — the router just passes it
+* through and the admin UI renders it via `FormBuilder`. The actual
+* type is `ConfigUISchema` (see `packages/types/src/interfaces/config-ui.ts`),
+* but we deliberately avoid a Zod mirror because the union is large and
+* not meant for runtime validation at this seam.
+*/
+var CreationSchemaOutputSchema = unknown();
+method(_void(), _void(), { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), ProviderStatusSchema), method(_void(), array(object({
+	id: string(),
+	name: string(),
+	type: string()
+}))), method(object({}), boolean()), method(object({ params: record(string(), unknown()).optional() }), array(DiscoveryCandidateSchema), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), CreationSchemaOutputSchema), method(object({}), object({ deviceType: _enum(DeviceType).nullable() })), method(object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), boolean()), method(object({ type: _enum(DeviceType) }), CreationSchemaOutputSchema), method(object({
+	type: _enum(DeviceType),
+	config: record(string(), unknown())
+}), DeviceSummarySchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	type: _enum(DeviceType),
+	key: string(),
+	value: unknown(),
+	formValues: record(string(), unknown()).optional()
+}), FieldProbeResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* Device Manager capability — hub-side singleton that unifies device persistence,
+* live registry access, and all management operations into a single tRPC surface.
 *
-* Because the object has a NULL prototype AND is `Object.freeze`d:
-*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
-*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
-*    (there is no `Object.prototype` in the chain), so those names are not
-*    callable — they are simply "unknown function" at parse time.
+* Replaces:
+*   - `device-persistence` capability (persistence methods absorbed here)
+*   - `device-management.router.ts` (deleted in Phase 2)
+*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
 *
-* Every numeric argument is validated as a finite number and every numeric
-* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
-* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
-* closed rather than emitting a garbage value.
+* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
+* fork into separate processes but never run on remote cluster agents. Therefore:
+*   - No nodeId routing needed — this is a pure hub singleton.
+*   - The hub's DeviceRegistry is the single source of truth for all live devices.
+*   - No shadow registry or cross-node aggregation required.
+*
+* Forked workers register devices back to the hub via `ctx.devices`
+* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
 */
-function asFiniteNumber(value, name, index) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
-	return value;
-}
-function asString$1(value, name, index) {
-	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
-	return value;
-}
-function finiteResult(value, name) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
-	return value;
-}
-function allFiniteNumbers(args, name) {
-	return args.map((a, idx) => asFiniteNumber(a, name, idx));
-}
-var INF = Number.POSITIVE_INFINITY;
-var table = {
-	min: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
-	},
-	max: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
-	},
-	abs: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
-	},
-	floor: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
-	},
-	ceil: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
-	},
-	sqrt: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
-	},
-	round: {
-		minArgs: 1,
-		maxArgs: 2,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "round", 0);
-			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
-			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
-			const factor = 10 ** digits;
-			return finiteResult(Math.round(x * factor) / factor, "round");
-		}
-	},
-	pow: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
-	},
-	clamp: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "clamp", 0);
-			const lo = asFiniteNumber(args[1], "clamp", 1);
-			const hi = asFiniteNumber(args[2], "clamp", 2);
-			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
-			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
-		}
-	},
-	avg: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const nums = allFiniteNumbers(args, "avg");
-			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
-		}
-	},
-	sum: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
-	},
-	coalesce: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			for (const a of args) if (a !== null) return a;
-			return null;
-		}
-	},
-	age: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
-	},
-	convert: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args, hooks) => {
-			const x = asFiniteNumber(args[0], "convert", 0);
-			const from = asString$1(args[1], "convert", 1).trim();
-			const to = asString$1(args[2], "convert", 2).trim();
-			if (hooks.convert) {
-				const out = hooks.convert(x, from, to);
-				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
-				return finiteResult(out, "convert");
-			}
-			if (from === to) return x;
-			throw new ExpressionEvalError("convert: unit conversion table not installed");
-		}
-	}
-};
-Object.freeze(Object.assign(Object.create(null), table));
-/** The set of valid builtin names — used by the parser to reject unknown
-*  callees at parse time (immediate author feedback). */
-var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
+/** One child-placement directive on a container's `childLayout`. Structurally
+*  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
+*  shape for the same field. The child is identified by its re-sync-stable
+*  accessory `stableIdSuffix` (`childKey`); listed children are grouped into
+*  named accordion sections (with optional intra-section order). */
+var ChildLayoutEntrySchema = object({
+	childKey: string(),
+	section: string(),
+	order: number().optional(),
+	collapsed: boolean().optional()
+});
+/** Cap-wire shape of a per-cap display refinement — mirrors
+*  `DeviceCapDisplayOverride` in `device-management.ts`. */
+var DeviceCapDisplayOverrideSchema = object({
+	unit: string().min(1).optional(),
+	precision: number().int().min(0).max(10).optional()
+});
+/** Cap-wire shape of an operator-authored per-device display override —
+*  mirrors `DeviceDisplayOverride` in `device-management.ts`. `precision`
+*  bounds mirror `numeric-sensor.cap.ts` (`int 0-10`). */
+var DeviceDisplayOverrideSchema = object({
+	icon: string().min(1).optional(),
+	label: string().min(1).optional(),
+	unit: string().min(1).optional(),
+	precision: number().int().min(0).max(10).optional(),
+	hidden: boolean().optional(),
+	perCap: record(string(), DeviceCapDisplayOverrideSchema).optional()
+});
+/** Cap-wire shape of a per-role display default — mirrors `RoleDisplayDefault`
+*  in `device-management.ts`. Keyed by `DeviceRole` string (role strings cross
+*  the wire as plain strings everywhere else — cf. `DeviceInfoSchema.role`). */
+var RoleDisplayDefaultSchema = object({
+	unit: string().min(1).optional(),
+	precision: number().int().min(0).max(10).optional(),
+	icon: string().min(1).optional()
+});
 /**
-* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
-* zero-dependency. The grammar is deliberately boring: decimal numbers,
-* single/double-quoted strings with a tiny escape set, identifiers, the three
-* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
-* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
-* is a parse error with a source position, so member access / assignment /
-* template literals are lexically impossible.
-*/
-var KEYWORDS = new Set([
-	"true",
-	"false",
-	"null"
-]);
-function isDigit(ch) {
-	return ch >= "0" && ch <= "9";
-}
-function isIdentStart(ch) {
-	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
-}
-function isIdentPart(ch) {
-	return isIdentStart(ch) || isDigit(ch);
-}
-function isWhitespace(ch) {
-	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
-}
-/** Tokenize `source` into a flat token list ending with a single `eof` token.
-*  Throws `ExpressionParseError` on any illegal character or unterminated
-*  string. */
-function tokenize(source) {
-	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
-	const tokens = [];
-	let i = 0;
-	const n = source.length;
-	while (i < n) {
-		const ch = source[i];
-		if (isWhitespace(ch)) {
-			i += 1;
-			continue;
-		}
-		if (isDigit(ch)) {
-			const start = i;
-			while (i < n && isDigit(source[i])) i += 1;
-			if (i < n && source[i] === ".") {
-				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
-				i += 1;
-				while (i < n && isDigit(source[i])) i += 1;
-			}
-			const text = source.slice(start, i);
-			const value = Number(text);
-			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
-			tokens.push({
-				type: "number",
-				value,
-				pos: start
-			});
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			const quote = ch;
-			const start = i;
-			i += 1;
-			let out = "";
-			let closed = false;
-			while (i < n) {
-				const c = source[i];
-				if (c === "\\") {
-					const next = i + 1 < n ? source[i + 1] : "";
-					if (next === "\\" || next === "'" || next === "\"") {
-						out += next;
-						i += 2;
-						continue;
-					}
-					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
-				}
-				if (c === quote) {
-					closed = true;
-					i += 1;
-					break;
-				}
-				out += c;
-				i += 1;
-			}
-			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
-			tokens.push({
-				type: "string",
-				value: out,
-				pos: start
-			});
-			continue;
-		}
-		if (isIdentStart(ch)) {
-			const start = i;
-			while (i < n && isIdentPart(source[i])) i += 1;
-			const text = source.slice(start, i);
-			if (KEYWORDS.has(text)) tokens.push({
-				type: "keyword",
-				keyword: keywordOf(text),
-				pos: start
-			});
-			else tokens.push({
-				type: "identifier",
-				name: text,
-				pos: start
-			});
-			continue;
-		}
-		const two = i + 1 < n ? source.slice(i, i + 2) : "";
-		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
-			tokens.push({
-				type: "punct",
-				punct: two,
-				pos: i
-			});
-			i += 2;
-			continue;
-		}
-		if (isSinglePunct(ch)) {
-			tokens.push({
-				type: "punct",
-				punct: ch,
-				pos: i
-			});
-			i += 1;
-			continue;
-		}
-		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
-	}
-	tokens.push({
-		type: "eof",
-		pos: n
-	});
-	return tokens;
-}
-function keywordOf(text) {
-	if (text === "true") return "true";
-	if (text === "false") return "false";
-	return "null";
-}
-function isSinglePunct(ch) {
-	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
-}
-/**
-* Pratt (precedence-climbing) parser for the safe expression mini-language.
-*
-* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
-* → relational → additive → multiplicative → unary `! -` → call / primary.
-* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
-* string validated against the builtin table at parse time, so an unknown
-* function is rejected immediately (author feedback) and a persisted expression
-* that references a since-removed builtin degrades at read.
-*
-* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
-* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
-*/
-/** Binary/logical operator precedence (higher binds tighter). */
-var BINARY_PRECEDENCE = {
-	"||": 1,
-	"&&": 2,
-	"==": 3,
-	"!=": 3,
-	"<": 4,
-	"<=": 4,
-	">": 4,
-	">=": 4,
-	"+": 5,
-	"-": 5,
-	"*": 6,
-	"/": 6,
-	"%": 6
-};
-function isLogicalOp(op) {
-	return op === "&&" || op === "||";
-}
-function isBinaryOp(op) {
-	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
-}
-var Parser = class {
-	tokens;
-	pos = 0;
-	nodeCount = 0;
-	identifiers = /* @__PURE__ */ new Set();
-	callees = /* @__PURE__ */ new Set();
-	constructor(tokens) {
-		this.tokens = tokens;
-	}
-	parse() {
-		const ast = this.parseTernary();
-		const tok = this.peek();
-		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
-		return {
-			ast,
-			identifiers: this.identifiers,
-			callees: this.callees,
-			nodeCount: this.nodeCount
-		};
-	}
-	peek() {
-		return this.tokens[this.pos];
-	}
-	next() {
-		return this.tokens[this.pos++];
-	}
-	/** Consume a punctuator token, erroring if the next token isn't it. */
-	expectPunct(punct) {
-		const tok = this.peek();
-		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
-		this.pos += 1;
-	}
-	matchPunct(punct) {
-		const tok = this.peek();
-		if (tok.type === "punct" && tok.punct === punct) {
-			this.pos += 1;
-			return true;
-		}
-		return false;
-	}
-	countNode() {
-		this.nodeCount += 1;
-		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
-	}
-	parseTernary() {
-		const test = this.parseBinary(1);
-		if (this.matchPunct("?")) {
-			const consequent = this.parseTernary();
-			this.expectPunct(":");
-			const alternate = this.parseTernary();
-			this.countNode();
-			return {
-				kind: "conditional",
-				test,
-				consequent,
-				alternate
-			};
-		}
-		return test;
-	}
-	parseBinary(minPrec) {
-		let left = this.parseUnary();
-		for (;;) {
-			const tok = this.peek();
-			if (tok.type !== "punct") break;
-			const prec = BINARY_PRECEDENCE[tok.punct];
-			if (prec === void 0 || prec < minPrec) break;
-			const op = tok.punct;
-			this.pos += 1;
-			const right = this.parseBinary(prec + 1);
-			this.countNode();
-			if (isLogicalOp(op)) left = {
-				kind: "logical",
-				op,
-				left,
-				right
-			};
-			else if (isBinaryOp(op)) left = {
-				kind: "binary",
-				op,
-				left,
-				right
-			};
-			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
-		}
-		return left;
-	}
-	parseUnary() {
-		const tok = this.peek();
-		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
-			const op = tok.punct;
-			this.pos += 1;
-			const operand = this.parseUnary();
-			this.countNode();
-			return {
-				kind: "unary",
-				op,
-				operand
-			};
-		}
-		return this.parsePrimary();
-	}
-	parsePrimary() {
-		const tok = this.next();
-		switch (tok.type) {
-			case "number":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "string":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "keyword":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.keyword === "null" ? null : tok.keyword === "true"
-				};
-			case "identifier": {
-				const nextTok = this.peek();
-				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
-				this.identifiers.add(tok.name);
-				this.countNode();
-				return {
-					kind: "identifier",
-					name: tok.name
-				};
-			}
-			case "punct":
-				if (tok.punct === "(") {
-					const inner = this.parseTernary();
-					this.expectPunct(")");
-					return inner;
-				}
-				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
-			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
-		}
-	}
-	parseCall(callee, pos) {
-		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
-		this.expectPunct("(");
-		const args = [];
-		if (!this.matchPunct(")")) for (;;) {
-			args.push(this.parseTernary());
-			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
-			if (this.matchPunct(",")) continue;
-			this.expectPunct(")");
-			break;
-		}
-		this.callees.add(callee);
-		this.countNode();
-		return {
-			kind: "call",
-			callee,
-			args
-		};
-	}
-};
-/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
-*  `ExpressionParseError` on any lexical or grammatical failure. */
-function parseExpression(source) {
-	return new Parser(tokenize(source)).parse();
-}
-/**
-* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
-* by expr"). The cache stores BOTH successes and failures (negative caching),
-* so a corrupt persisted string costs exactly one tokenize+parse total — not
-* one per read on a hot resolve path.
-*
-* The cache is a module-level singleton: entries are pure, content-addressed
-* ASTs keyed by the raw source string, so sharing one instance across all
-* callers is safe and maximises hit rate.
-*/
-var cache = /* @__PURE__ */ new Map();
-function getCached(source) {
-	const hit = cache.get(source);
-	if (hit !== void 0) {
-		cache.delete(source);
-		cache.set(source, hit);
-		return hit;
-	}
-	let result;
-	try {
-		result = {
-			ok: true,
-			parsed: parseExpression(source)
-		};
-	} catch (err) {
-		result = {
-			ok: false,
-			error: err instanceof ExpressionParseError ? err.message : String(err)
-		};
-	}
-	cache.set(source, result);
-	if (cache.size > 256) {
-		const oldest = cache.keys().next().value;
-		if (oldest !== void 0) cache.delete(oldest);
-	}
-	return result;
-}
-/** Compile `source`, returning a discriminated result instead of throwing.
-*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
-function compileExpressionSafe(source) {
-	return getCached(source);
-}
-Object.freeze({});
-/**
-* Author-time validation. Returns `null` when the source is valid, else a
-* human-readable error message. Checks: the expression compiles; binding count
-* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
-* is not reserved (`now`/keywords) and does not shadow a builtin; and every
-* FREE identifier of the AST is covered by a binding or the injected `now`.
-*/
-function validateExpressionSource(src) {
-	const names = Object.keys(src.bindings);
-	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
-	for (const name of names) {
-		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
-		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
-		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
-	}
-	const compiled = compileExpressionSafe(src.expr);
-	if (!compiled.ok) return compiled.error;
-	const bound = new Set(names);
-	for (const id of compiled.parsed.identifiers) {
-		if (id === "now") continue;
-		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
-	}
-	return null;
-}
-var ProviderStatusSchema = object({
-	connected: boolean(),
-	deviceCount: number(),
-	error: string().optional()
-});
-object({
-	externalId: string(),
-	name: string(),
-	type: string(),
-	metadata: record(string(), unknown()).optional()
-});
-/**
-* Candidate handed back from discovery and accepted by
-* `adoptDiscoveredDevice`. Shape mirrors the in-process
-* `DiscoveredDevice` interface used by `DeviceDiscovery`.
-*/
-var DiscoveryCandidateSchema = object({
-	stableId: string(),
-	type: _enum(DeviceType),
-	suggestedName: string(),
-	prefilledConfig: record(string(), unknown()),
-	/**
-	* Optional upstream-system identity (HA entity_id, vendor MAC, …).
-	* Discovery pre-populates this for systems that know the upstream
-	* identity ahead of adoption. Rendering metadata (unit, precision)
-	* flows live through the cap STATUS SLICE after adoption.
-	*/
-	sourceInfo: SourceInfoSchema.optional()
-});
-/**
-* Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
-* Mirrors `toDeviceShape()` output in `device-management.router.ts` so the
-* tRPC layer can pass it through without reshaping.
-*/
-var DeviceSummarySchema = object({
-	id: number(),
-	stableId: string(),
-	addonId: string(),
-	type: string(),
-	name: string(),
-	parentDeviceId: number().nullable(),
-	online: boolean(),
-	features: array(string()),
-	config: record(string(), unknown()),
-	/** Optional upstream-system identity (dispatch key + system tag).
-	*  See `SourceInfo`. Present when the device has a non-synthetic
-	*  source identifier (HA entities, vendor MAC, …); omitted when the
-	*  synthetic backfill is in effect. */
-	sourceInfo: SourceInfoSchema.optional()
-});
-/**
-* Result of a live field test (e.g. probing an RTSP URL during device
-* creation). Matches the UI-side `FieldProbeResult` in
-* `interfaces/config-ui.ts` — the admin `FormBuilder` renders the
-* returned `labels` as chips next to the input.
-*/
-var FieldProbeResultSchema = object({
-	status: _enum(["ok", "error"]),
-	labels: array(string()).optional(),
-	error: string().optional()
-});
-/**
-* The output of `getChildCreationSchema` is a UI schema tree. We store
-* it as `unknown` at the capability layer — the router just passes it
-* through and the admin UI renders it via `FormBuilder`. The actual
-* type is `ConfigUISchema` (see `packages/types/src/interfaces/config-ui.ts`),
-* but we deliberately avoid a Zod mirror because the union is large and
-* not meant for runtime validation at this seam.
-*/
-var CreationSchemaOutputSchema = unknown();
-method(_void(), _void(), { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), ProviderStatusSchema), method(_void(), array(object({
-	id: string(),
-	name: string(),
-	type: string()
-}))), method(object({}), boolean()), method(object({ params: record(string(), unknown()).optional() }), array(DiscoveryCandidateSchema), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({}), CreationSchemaOutputSchema), method(object({}), object({ deviceType: _enum(DeviceType).nullable() })), method(object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({}), boolean()), method(object({ type: _enum(DeviceType) }), CreationSchemaOutputSchema), method(object({
-	type: _enum(DeviceType),
-	config: record(string(), unknown())
-}), DeviceSummarySchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	type: _enum(DeviceType),
-	key: string(),
-	value: unknown(),
-	formValues: record(string(), unknown()).optional()
-}), FieldProbeResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
-* Device Manager capability — hub-side singleton that unifies device persistence,
-* live registry access, and all management operations into a single tRPC surface.
-*
-* Replaces:
-*   - `device-persistence` capability (persistence methods absorbed here)
-*   - `device-management.router.ts` (deleted in Phase 2)
-*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
-*
-* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
-* fork into separate processes but never run on remote cluster agents. Therefore:
-*   - No nodeId routing needed — this is a pure hub singleton.
-*   - The hub's DeviceRegistry is the single source of truth for all live devices.
-*   - No shadow registry or cross-node aggregation required.
-*
-* Forked workers register devices back to the hub via `ctx.devices`
-* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
-*/
-/** One child-placement directive on a container's `childLayout`. Structurally
-*  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
-*  shape for the same field. The child is identified by its re-sync-stable
-*  accessory `stableIdSuffix` (`childKey`); listed children are grouped into
-*  named accordion sections (with optional intra-section order). */
-var ChildLayoutEntrySchema = object({
-	childKey: string(),
-	section: string(),
-	order: number().optional(),
-	collapsed: boolean().optional()
-});
-/** Cap-wire shape of a DeviceLink — structurally mirrors `DeviceLink` in
-*  `device-management.ts`. Source is a union: a FIELD source copies a sibling
-*  accessory's status field (`kind` optional/absent for wire compat); a
-*  LITERAL source carries a per-device constant (no sibling is read); a
-*  GLOBAL source (P2e) copies ANY device's status field, addressed by the
-*  source device's full re-sync-stable `stableId`. */
-var DeviceLinkFieldSourceSchema = object({
-	kind: literal("field").optional(),
-	sourceKey: string(),
-	cap: string(),
-	fieldPath: string()
-});
-var DeviceLinkLiteralSourceSchema = object({
-	kind: literal("literal"),
-	value: union([
-		string(),
-		number(),
-		boolean(),
-		_null()
-	])
-});
-var DeviceLinkGlobalSourceSchema = object({
-	kind: literal("global"),
-	sourceStableId: string(),
-	cap: string(),
-	fieldPath: string()
-});
-/** Expression source (Stage X): compute the target field from N named bindings
-*  via the safe expression engine. Bindings are field | literal | global — never
-*  another expression (no nesting). The `superRefine` runs the SAME author-time
-*  validation as `validateExpressionSource` (compiles the expr, checks binding
-*  names + identifier coverage) so every wire boundary that parses a DeviceLink
-*  (tRPC mount, kernel create pre-seed, projection output) validates-at-write.
-*  Compiles are LRU-cached, so repeated validation of the same expr is a hit. */
-var DeviceLinkExpressionSourceSchema = object({
-	kind: literal("expression"),
-	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema
-	]))
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
-});
-var DeviceLinkSchema = object({
-	id: string(),
-	source: union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema,
-		DeviceLinkExpressionSourceSchema
-	]),
-	target: object({
-		cap: string(),
-		fieldPath: string(),
-		itemKey: string().optional()
-	}),
-	transform: discriminatedUnion("kind", [
-		object({ kind: literal("identity") }),
-		object({
-			kind: literal("enum-map"),
-			mapping: record(string(), union([
-				string(),
-				number(),
-				boolean()
-			])),
-			fallback: union([
-				string(),
-				number(),
-				boolean()
-			]).optional()
-		}),
-		object({
-			kind: literal("linear"),
-			scale: number(),
-			offset: number(),
-			clamp: tuple([number(), number()]).readonly().optional()
-		})
-	]).optional()
-});
-/** Cap-wire shape of a per-cap display refinement — mirrors
-*  `DeviceCapDisplayOverride` in `device-management.ts`. */
-var DeviceCapDisplayOverrideSchema = object({
-	unit: string().min(1).optional(),
-	precision: number().int().min(0).max(10).optional()
-});
-/** Cap-wire shape of an operator-authored per-device display override —
-*  mirrors `DeviceDisplayOverride` in `device-management.ts`. `precision`
-*  bounds mirror `numeric-sensor.cap.ts` (`int 0-10`). */
-var DeviceDisplayOverrideSchema = object({
-	icon: string().min(1).optional(),
-	label: string().min(1).optional(),
-	unit: string().min(1).optional(),
-	precision: number().int().min(0).max(10).optional(),
-	hidden: boolean().optional(),
-	perCap: record(string(), DeviceCapDisplayOverrideSchema).optional()
-});
-/** Cap-wire shape of a per-role display default — mirrors `RoleDisplayDefault`
-*  in `device-management.ts`. Keyed by `DeviceRole` string (role strings cross
-*  the wire as plain strings everywhere else — cf. `DeviceInfoSchema.role`). */
-var RoleDisplayDefaultSchema = object({
-	unit: string().min(1).optional(),
-	precision: number().int().min(0).max(10).optional(),
-	icon: string().min(1).optional()
-});
-/**
-* Serializable projection of a live IDevice.
-* Returned by listAll, getDevice, getChildren.
-* Live methods (getStreamSources, getConfigSchema) are separate calls.
+* Serializable projection of a live IDevice.
+* Returned by listAll, getDevice, getChildren.
+* Live methods (getStreamSources, getConfigSchema) are separate calls.
 */
 var DeviceInfoSchema = object({
 	/** Progressive, system-wide unique number. Allocated synchronously by
@@ -12088,8 +11036,6 @@ var DeviceInfoSchema = object({
 	*  named accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
 	/** Operator-authored per-device display override. See `DeviceMeta.display`. */
 	display: DeviceDisplayOverrideSchema.optional()
 });
@@ -12098,7 +11044,7 @@ var ConfigEntrySchema = object({
 	value: unknown(),
 	description: string().optional()
 });
-var DeviceLinkModeSchema = _enum(["auto", "manual"]);
+var LinkedDevicesModeSchema = _enum(["auto", "manual"]);
 /** One resolved linked device — the compact projection consumers need. */
 var LinkedDeviceSchema = object({
 	deviceId: number(),
@@ -12161,8 +11107,6 @@ var DeviceMetaSchema = object({
 	*  accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
 	/** Semantic role string (`DeviceRole`) — propagated from the spawn pre-seed.
 	*  Optional: only present for accessory children that carry a known role. */
 	role: string().nullable().optional(),
@@ -12255,12 +11199,6 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	deviceLinks: array(DeviceLinkSchema).readonly()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	display: DeviceDisplayOverrideSchema.nullable()
@@ -12342,7 +11280,7 @@ method(object({
 	*  shipping 293 rows to find 12. */
 	isCamera: boolean().optional()
 }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
-	mode: DeviceLinkModeSchema,
+	mode: LinkedDevicesModeSchema,
 	devices: array(LinkedDeviceSchema)
 })), method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)), method(object({ deviceId: number() }), array(ConfigEntrySchema)), method(object({ deviceId: number() }), ConfigUISchemaOutput), method(object({
 	deviceId: number(),
@@ -12375,11 +11313,7 @@ method(object({
 	deviceId: number(),
 	entries: array(object({
 		capName: string(),
-		kind: _enum([
-			"native",
-			"wrapped",
-			"linked"
-		]),
+		kind: _enum(["native", "wrapped"]),
 		providerAddonId: string(),
 		providerNodeId: string(),
 		nativeAddonId: string()
@@ -12388,11 +11322,7 @@ method(object({
 	deviceId: number(),
 	entries: array(object({
 		capName: string(),
-		kind: _enum([
-			"native",
-			"wrapped",
-			"linked"
-		]),
+		kind: _enum(["native", "wrapped"]),
 		providerAddonId: string(),
 		providerNodeId: string(),
 		nativeAddonId: string()
@@ -13205,7 +12135,7 @@ var MotionAnalysisResultSchema = object({
 	frameHeight: number(),
 	analysisMs: number()
 });
-method(object({
+DeviceType.Camera, method(object({
 	deviceId: number(),
 	frame: FrameInputSchema.optional(),
 	frameHandle: FrameHandleSchema.optional()
@@ -15877,6 +14807,18 @@ var OauthIntegrationDescriptorSchema = object({
 	*  redirect_uri that does not start with one of these. Required —
 	*  an empty list means the integration can never complete linking. */
 	allowedRedirectPrefixes: array(string()).min(1),
+	/** Paths accepted as a `redirect_uri` when the host is PRIVATE — loopback,
+	*  RFC1918, CGNAT (100.64/10, Tailscale), link-local, IPv6 ULA, or an
+	*  `.local` / `.internal` / `.ts.net` name. Exists for self-hosted clients
+	*  whose address the hub cannot know in advance (a Home Assistant at
+	*  `http://<lan-ip>:8123/auth/external/callback`). The PATH must match
+	*  exactly; a public host never satisfies this branch, so it is not a
+	*  wildcard prefix by another name. */
+	allowedPrivateHostPaths: array(string()).optional(),
+	/** When true this is a PUBLIC client (source is published, no secret can be
+	*  protected) and PKCE is mandatory: `/authorize` refuses without an S256
+	*  `code_challenge`, `/token` refuses without the matching `code_verifier`. */
+	requiresPkce: boolean().optional(),
 	/** Optional public origin (no trailing slash) that this integration's
 	*  issued codes/tokens should carry as the `hubUrl` claim — typically the
 	*  operator-selected external-access endpoint resolved by the addon. When
@@ -16027,7 +14969,7 @@ var TrackEnvelopeSchema = object({
 * `snapshots[]` references — megabytes across a page of tracks. `slim`
 * keeps every scalar the list surfaces actually render (ids, class(es),
 * label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
-* zonesVisited, bestEventId, envelope) and returns `positions` /
+* zonesVisited, bestEventId, envelope, hasFace) and returns `positions` /
 * `snapshots` as EMPTY arrays — detail views re-fetch the full row via
 * `getTrack`. Mirrors the event-store `projection` convention
 * (`getObjectEvents` et al.).
@@ -16264,6 +15206,24 @@ var TrackSchema = object({
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
 	envelope: TrackEnvelopeSchema.optional(),
+	/**
+	* A face DETECTOR found a face on this track — nothing more. It says the
+	* detail plane produced a `face` detail; it does NOT say the face was
+	* embedded, matched, above `minFacePx`, or that the recognizer was even
+	* enabled. Set once and never cleared.
+	*
+	* **This exists so "face present but not recognised" is expressible.** A
+	* recognised identity lands in `subLabel` (attributed to the face chain via
+	* `subLabelMeta.stepId`), so before this field a track with an unmatched face
+	* and a track with no face at all were byte-identical on the wire and no
+	* surface could tell them apart. The read is `hasFace === true && subLabel
+	* === undefined`.
+	*
+	* **Absent ≠ false.** Every row written before the column existed omits it,
+	* and so does every server that predates the field — a consumer must test
+	* `=== true` and render nothing otherwise, never infer "no face".
+	*/
+	hasFace: boolean().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -19332,6 +18292,10 @@ var SsoBridgeClaimsSchema = object({
 	integrationId: string().optional(),
 	/** JWT ID — unique per issued code; consumed-set enforces single-use. */
 	jti: string().optional(),
+	/** PKCE S256 challenge — set only on `oauth-code` tokens issued to a public
+	*  client. Its PRESENCE is what makes the verifier mandatory at exchange,
+	*  so the requirement travels with the code and not with mutable config. */
+	codeChallenge: string().optional(),
 	/** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
 	*  tokens so the verify path can check the session is not revoked. */
 	sessionId: string().optional()
@@ -19890,6 +18854,10 @@ var videoclipsCapability = {
 	mode: "singleton",
 	kind: "wrapper",
 	defaultActive: true,
+	/** A clip is a window over a camera's footage — the cap is meaningless on a
+	*  sensor, a button or an event emitter, and the `defaultActive` auto-bind
+	*  reads this to decide which devices it may claim. */
+	deviceTypes: [DeviceType.Camera],
 	methods: {
 		listClips: method(object({
 			deviceId: number(),
@@ -26486,13 +25454,18 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	username: string(),
 	scopes: array(TokenScopeSchema),
 	redirectUri: string(),
-	hubUrl: string()
+	hubUrl: string(),
+	/** PKCE (RFC 7636) S256 challenge. Baked into the signed code; a code
+	*  that carries one can ONLY be exchanged with the matching verifier. */
+	codeChallenge: string().optional()
 }), object({ code: string() }), {
 	kind: "mutation",
 	access: "create"
 }), method(object({
 	code: string(),
-	redirectUri: string()
+	redirectUri: string(),
+	/** PKCE verifier. REQUIRED when the code carries a challenge. */
+	codeVerifier: string().optional()
 }), object({
 	accessToken: string(),
 	refreshToken: string(),
@@ -27684,300 +26657,1137 @@ var BaseDevice = class {
 		this.runtimeState.setCapState("device-status", next);
 	}
 	/**
-	* Upstream-system identity + rendering envelope for this device. See
-	* `SourceInfo` for the field contract. Always returns a valid object:
-	* if the persisted `metadata.sourceInfo` blob is absent or fails Zod
-	* validation, falls back to a synthetic `{ id: stableId, system: addonId }`
-	* so providers that haven't migrated keep working without code changes.
+	* Upstream-system identity + rendering envelope for this device. See
+	* `SourceInfo` for the field contract. Always returns a valid object:
+	* if the persisted `metadata.sourceInfo` blob is absent or fails Zod
+	* validation, falls back to a synthetic `{ id: stableId, system: addonId }`
+	* so providers that haven't migrated keep working without code changes.
+	*
+	* The value is cached after the first read. `updateSourceInfo()`
+	* invalidates the cache so subsequent reads see the new patch. The
+	* returned object is frozen to prevent accidental in-place mutation —
+	* use `updateSourceInfo({ patch })` to change fields.
+	*/
+	get sourceInfo() {
+		if (this._sourceInfoCache) return this._sourceInfoCache;
+		const resolved = extractSourceInfoFromMetadata(this.ctx.deviceMeta.metadata) ?? synthesizeSourceInfo({
+			stableId: this.stableId,
+			addonId: this.ctx.deviceMeta.addonId
+		});
+		this._sourceInfoCache = Object.freeze({ ...resolved });
+		return this._sourceInfoCache;
+	}
+	/**
+	* Convenience accessor for the upstream dispatch key. Equivalent to
+	* `this.sourceInfo.id` — providers use this to keep a
+	* `Map<sourceId, IDevice>` for routing inbound push events.
+	*/
+	get sourceId() {
+		return this.sourceInfo.id;
+	}
+	/**
+	* Patch the device's `SourceInfo`. Shallow-merges `patch` over the
+	* current value, persists the merged result under
+	* `metadata.sourceInfo` via the `device-manager.setMetadata` cap, and
+	* emits `EventCategory.DeviceSourceInfoChanged` for live consumers.
+	*
+	* Safe to call from anywhere in the device's lifetime — the call is
+	* idempotent for `undefined` patch values (ignored) and best-effort
+	* for persistence (a transient device-manager error doesn't unwind
+	* the local cache update, so subsequent reads still see the patch).
+	*
+	* Drivers populate this on adoption + on every metadata change push
+	* from the upstream source. Subscribers (UI, export adapters) react
+	* via the `DeviceSourceInfoChanged` event without polling.
+	*/
+	async updateSourceInfo(patch) {
+		const next = mergeSourceInfo(this.sourceInfo, patch);
+		this._sourceInfoCache = Object.freeze({ ...next });
+		const action = this.ctx.api?.deviceManager?.setMetadata;
+		if (action) try {
+			await action.mutate({
+				deviceId: this.id,
+				patch: { [SOURCE_INFO_METADATA_KEY]: next }
+			});
+		} catch {}
+		this.ctx.eventBus.emit(createEvent("device.source-info-changed", {
+			type: "device",
+			id: this.stableId
+		}, {
+			deviceId: this.id,
+			sourceInfo: next
+		}));
+	}
+	/**
+	* Re-publish the device's current `features` array to the persisted
+	* meta blob. Drivers call this after a probe finishes when the live
+	* `features` getter has gained new flags (e.g. `hasIntercom` flips
+	* to true → `DeviceFeature.TwoWayAudio` joins the list).
+	*
+	* Without this, only the construction-time snapshot is written —
+	* `deviceManager.registerDevice` is invoked once per boot, so probe-
+	* driven additions don't reach the persisted index until the next
+	* server restart, and `getDevice` / `listAll` keep returning the
+	* stale list for forked-worker devices (whose live IDevice instance
+	* is invisible to the hub registry).
+	*
+	* Idempotent: re-calling with the same features just no-ops on the
+	* persisted meta. Best-effort: lookup or write failures are logged
+	* at debug and swallowed — the live `device.features` getter is
+	* still authoritative within this process, so callers never block
+	* device boot on a meta refresh.
+	*/
+	async refreshFeatures() {
+		const action = this.ctx.api?.deviceManager?.registerDevice;
+		if (!action) return;
+		try {
+			await action.mutate({
+				addonId: this.ctx.deviceMeta.addonId,
+				stableId: this.stableId,
+				id: this.id,
+				type: this.type,
+				name: this.name,
+				parentDeviceId: this.parentDeviceId,
+				features: [...this.features],
+				config: {}
+			});
+		} catch (err) {}
+	}
+	/**
+	* Typed read-through to a cap-keyed runtime-state slice. Drivers
+	* call `this.getCapSlice(batteryCapability)` and the return type
+	* is inferred from the cap's `runtimeState` Zod schema — no string
+	* key, no manual generic. Returns `null` when the slice hasn't
+	* been written yet (e.g. driver hasn't seeded battery yet).
+	*/
+	getCapSlice(cap) {
+		return this.runtimeState.getCapState(cap.name) ?? null;
+	}
+	/**
+	* Typed writer to a cap-keyed runtime-state slice. Routes through
+	* the runtime-state writer (validate → persist → emit cap event).
+	* Equivalent to `this.runtimeState.setCapState(cap.name, value)`
+	* but with the cap's `runtimeState` schema enforcing the value
+	* shape at compile time. Mirrors the symmetry of
+	* `getCapSlice` / `setCapSlice` for cross-cap consistency.
+	*/
+	setCapSlice(cap, value) {
+		this.runtimeState.setCapState(cap.name, value);
+	}
+	/**
+	* Field-level read/write proxy over a cap's runtime-state slice.
+	* Drivers that want ergonomic per-field access declare:
+	*
+	* ```ts
+	* protected battery = this.sliceProxy(batteryCapability)
+	* // …
+	* this.battery.sleeping = true        // patches the slice
+	* const charging = this.battery.charging  // reads the slice
+	* ```
+	*
+	* Reads return `undefined` when the slice hasn't been seeded yet
+	* (cap not registered, or seeded but the field is absent). Writes
+	* route through `runtimeState.patchCapState` so the cap's `runtimeState`
+	* schema validates the merged result and the cap event fires.
+	*
+	* Pattern is generic — same shape works for `battery`, `device-status`,
+	* `motion`, `doorbell`, anything with a `runtimeState:` schema. Drivers
+	* declare one proxy per cap they read/write directly.
+	*/
+	sliceProxy(cap) {
+		return new Proxy({}, {
+			get: (_, key) => {
+				return this.runtimeState.getCapState(cap.name)?.[key];
+			},
+			set: (_, key, value) => {
+				this.runtimeState.patchCapState(cap.name, { [key]: value });
+				return true;
+			},
+			has: (_, key) => {
+				const slice = this.runtimeState.getCapState(cap.name);
+				return slice ? key in slice : false;
+			},
+			ownKeys: () => {
+				const slice = this.runtimeState.getCapState(cap.name);
+				return slice ? Object.keys(slice) : [];
+			},
+			getOwnPropertyDescriptor: (_, key) => {
+				const slice = this.runtimeState.getCapState(cap.name);
+				if (!slice || !(key in slice)) return void 0;
+				return {
+					configurable: true,
+					enumerable: true,
+					value: slice[key]
+				};
+			}
+		});
+	}
+	/**
+	* Default empty settings UI. Drivers override this to expose an
+	* editable form in the device-details page. Returning an empty sections
+	* array signals "nothing to contribute" — the aggregator drops the
+	* contribution entirely rather than rendering a blank panel.
+	*/
+	getSettingsUISchema() {
+		return { sections: [] };
+	}
+	/**
+	* Default write path: forward the flat patch directly to storage.
+	* Drivers that project a UI shape different from storage (e.g. `RtspCamera`
+	* exposing `mainStreamUrl`/`subStreamUrl` over `streams[]`) override this
+	* to reshape before `config.setAll`.
+	*/
+	async applySettingsPatch(patch) {
+		await this.config.setAll(patch);
+	}
+	/**
+	* Phase 3 — populate device-scoped state needed by downstream phases
+	* (accessory reconciliation, public `features` array, optional cap
+	* registration). Called ONCE per construction, after register but
+	* before `getAccessoryChildren()`.
+	*
+	* Drivers write the `feature-probe` runtime-state slice via
+	* `this.runtimeState.setCapState('feature-probe', {...})` — flag bag
+	* is open (Reolink writes `hasPtz/hasIntercom`, Hikvision writes
+	* `hasSupplementalLight/hasAlarmIo`, etc).
+	*
+	* Default: nothing to probe → mark the device PROBED (set `lastProbedAt`) so
+	* the kernel treats it as ready immediately. A device that derives its shape
+	* from a spec (a container, or an accessory sensor) rather than from a
+	* hardware probe has no probe to "complete"; without stamping `lastProbedAt`
+	* it would look perpetually un-probed — logging "Initial probe did not
+	* complete" on every boot and spinning a pointless retry chain. Drivers that
+	* DO probe override this and write their own `feature-probe` slice (including
+	* `lastProbedAt`) once their probe actually succeeds.
+	*/
+	async onProbe() {
+		const base = this.runtimeState.getCapState("feature-probe") ?? {
+			flags: {},
+			deviceType: null,
+			model: null,
+			channelCount: null,
+			lastProbedAt: 0,
+			lastFetchedAt: 0
+		};
+		this.runtimeState.setCapState("feature-probe", {
+			...base,
+			lastProbedAt: Date.now()
+		});
+	}
+	/**
+	* Phase 5 — fired after the device + its accessories are registered.
+	* Drivers publish streams to the broker, kick off background tasks,
+	* or subscribe to lib events that need a fully-registered device id.
+	*
+	* Default: no-op.
+	*
+	* RENAMED FROM `onCreated` (which still exists for back-compat in this
+	* pass). The new name reflects the post-probe, post-accessory contract.
+	*/
+	async onActivate() {}
+	/**
+	* Re-run the probe + reconcile accessories + refresh features meta.
+	* Drivers call this when device-side state changes (battery cam wakes,
+	* firmware update, manual operator trigger).
+	*
+	* The kernel injects `_kernelReprobe` on registration so this method
+	* delegates to the same orchestrator that runs the boot-time phase
+	* 3 + 4 sequence. Drivers should NOT override this — they override
+	* `onProbe()` instead.
+	*/
+	async reprobe() {
+		if (this._kernelReprobe) await this._kernelReprobe();
+		else await this.onProbe();
+	}
+	/**
+	* Kernel-injected callback that runs the full post-probe orchestration
+	* (onProbe → registerDevice meta refresh → accessory reconciliation).
+	* Set by `device-cap-proxy.register()`. Drivers should not touch this
+	* directly — call `reprobe()` instead.
+	*/
+	_kernelReprobe;
+	/**
+	* Declare accessory child devices the kernel should auto-spawn
+	* after `onProbe()` resolves. Each spec fully describes one child
+	* — stableId suffix (deterministic per kind for restore-safety),
+	* meta (type / name / location), config (initial blob the child
+	* self-hydrates), and a factory that constructs the concrete
+	* class with whatever closure-captured refs it needs (typically
+	* `this` for the parent reference).
+	*
+	* The kernel handles the rest: allocateDeviceId, persistInitialConfig
+	* (skipped on restore when the row already exists),
+	* persistInitialMeta, createContext, factory invocation, register,
+	* and recursive lifecycle (probe + accessories + activate).
+	*
+	* Implementations should derive children from
+	* `this.runtimeState.getCapState('feature-probe')` (post-probe truth).
+	* Drivers can use the `getProbeFlags()` helper to read the flag bag
+	* with a typed cast.
+	*
+	* Default: no children.
+	*/
+	getAccessoryChildren() {
+		return [];
+	}
+	/**
+	* Read the current feature-probe flag bag with a typed cast. Helper
+	* for `getAccessoryChildren()` and `features` getters that derive
+	* outputs from the probe results.
+	*/
+	getProbeFlags() {
+		return this.runtimeState.getCapState("feature-probe")?.flags ?? {};
+	}
+	/**
+	* Returns true once `onProbe` has completed at least once
+	* (`lastProbedAt > 0`). Drivers gate `getAccessoryChildren()` on this
+	* to avoid spawning stale accessories on a fresh device whose probe
+	* hasn't landed yet.
+	*/
+	hasProbed() {
+		return (this.runtimeState.getCapState("feature-probe")?.lastProbedAt ?? 0) > 0;
+	}
+};
+/** Marker written to a declared integration's `info`. */
+var DECLARED_INTEGRATION_FIXED_KEY = "fixed";
+/**
+* Strip the `<node>/<addon>` suffix a forked child carries.
+*
+* Comparing `ctx.kernel.localNodeId` raw skipped EVERY node — including the one
+* that was supposed to act — because on the hub it reads `hub/<addon>`.
+*/
+function declarationOwnerNodeId(localNodeId) {
+	const raw = localNodeId ?? "hub";
+	if (!raw.includes("/")) return raw;
+	return raw.split("/")[0] ?? "hub";
+}
+/**
+* The one way an addon owns a device it declares.
+*
+* Construct once with the addon's ports, then call {@link reconcile} on boot and
+* on every convergence tick. There is no second get-or-create helper — a guard
+* in `scripts/` enforces that.
+*/
+var DeclaredDevices = class {
+	ports;
+	constructor(ports) {
+		this.ports = ports;
+	}
+	/**
+	* Converge the declared set. Idempotent, and safe to call repeatedly.
 	*
-	* The value is cached after the first read. `updateSourceInfo()`
-	* invalidates the cache so subsequent reads see the new patch. The
-	* returned object is frozen to prevent accidental in-place mutation —
-	* use `updateSourceInfo({ patch })` to change fields.
-	*/
-	get sourceInfo() {
-		if (this._sourceInfoCache) return this._sourceInfoCache;
-		const resolved = extractSourceInfoFromMetadata(this.ctx.deviceMeta.metadata) ?? synthesizeSourceInfo({
-			stableId: this.stableId,
-			addonId: this.ctx.deviceMeta.addonId
-		});
-		this._sourceInfoCache = Object.freeze({ ...resolved });
-		return this._sourceInfoCache;
+	* Throws only what the ports throw on the FIRST index read; every other
+	* failure is per-device and logged, so one bad declaration never takes the
+	* others down.
+	*/
+	async reconcile(spec) {
+		if ((spec.placement ?? "hub") === "hub") {
+			const nodeId = declarationOwnerNodeId(this.ports.localNodeId);
+			if (nodeId !== "hub") {
+				this.ports.logger.info("declared devices are hub-owned — skipping on this node", { meta: {
+					nodeId,
+					rawNodeId: this.ports.localNodeId ?? null
+				} });
+				return {
+					integrationId: null,
+					devices: [],
+					removed: [],
+					owned: false
+				};
+			}
+		}
+		const integrationId = await this.ensureIntegration(spec.integrationName);
+		const index = await this.readIndex();
+		const outcomes = [];
+		for (const declaration of spec.devices) {
+			const outcome = await this.applyDeclaration(declaration, integrationId, index);
+			if (outcome !== null) outcomes.push(outcome);
+		}
+		return {
+			integrationId,
+			devices: outcomes,
+			removed: await this.sweepWithdrawn(spec.devices, integrationId, index),
+			owned: true
+		};
 	}
 	/**
-	* Convenience accessor for the upstream dispatch key. Equivalent to
-	* `this.sourceInfo.id` — providers use this to keep a
-	* `Map<sourceId, IDevice>` for routing inbound push events.
-	*/
-	get sourceId() {
-		return this.sourceInfo.id;
+	* Get-or-create the FIXED integration, and RE-ASSERT the flag every pass.
+	*
+	* The re-assertion is the fix for the defect the hand-rolled version shipped
+	* with: writing `info.fixed` only on the create path left every pre-existing
+	* install without it, and the kernel kept offering to delete an integration
+	* the addon owns.
+	*/
+	async ensureIntegration(integrationName) {
+		const existing = await this.ports.getIntegration(this.ports.addonId);
+		if (existing === null) {
+			const created = await this.ports.createIntegration({
+				addonId: this.ports.addonId,
+				name: integrationName,
+				info: { [DECLARED_INTEGRATION_FIXED_KEY]: true }
+			});
+			this.ports.logger.info("declared a fixed integration", { meta: {
+				integrationId: created.id,
+				name: integrationName
+			} });
+			return created.id;
+		}
+		if (existing.info?.["fixed"] !== true) {
+			await this.ports.updateIntegration({
+				id: existing.id,
+				info: { [DECLARED_INTEGRATION_FIXED_KEY]: true }
+			});
+			this.ports.logger.info("re-asserted `fixed` on a declared integration", { meta: { integrationId: existing.id } });
+		}
+		return existing.id;
+	}
+	async readIndex() {
+		const rows = await this.ports.listOwnDevices();
+		return new Map(rows.map((row) => [row.stableId, row]));
 	}
 	/**
-	* Patch the device's `SourceInfo`. Shallow-merges `patch` over the
-	* current value, persists the merged result under
-	* `metadata.sourceInfo` via the `device-manager.setMetadata` cap, and
-	* emits `EventCategory.DeviceSourceInfoChanged` for live consumers.
-	*
-	* Safe to call from anywhere in the device's lifetime — the call is
-	* idempotent for `undefined` patch values (ignored) and best-effort
-	* for persistence (a transient device-manager error doesn't unwind
-	* the local cache update, so subsequent reads still see the patch).
+	* One declaration: adopt what exists, create what does not.
 	*
-	* Drivers populate this on adoption + on every metadata change push
-	* from the upstream source. Subscribers (UI, export adapters) react
-	* via the `DeviceSourceInfoChanged` event without polling.
+	* The create branch is the destructive one — it seeds `initialMeta`, and
+	* `initialMeta.name` lands as an unconditional `setName`. A transiently empty
+	* index therefore looks exactly like a first boot and would silently re-stamp
+	* the declared name over the operator's rename. D49: that branch needs a
+	* second read to agree.
 	*/
-	async updateSourceInfo(patch) {
-		const next = mergeSourceInfo(this.sourceInfo, patch);
-		this._sourceInfoCache = Object.freeze({ ...next });
-		const action = this.ctx.api?.deviceManager?.setMetadata;
-		if (action) try {
-			await action.mutate({
-				deviceId: this.id,
-				patch: { [SOURCE_INFO_METADATA_KEY]: next }
+	async applyDeclaration(declaration, integrationId, index) {
+		try {
+			let existing = index.get(declaration.stableId);
+			if (existing === void 0) {
+				existing = (await this.readIndex()).get(declaration.stableId);
+				if (existing !== void 0) this.ports.logger.warn("device index disagreed with itself — adopting instead of re-creating", {
+					tags: { deviceId: existing.id },
+					meta: {
+						stableId: declaration.stableId,
+						addonId: this.ports.addonId
+					}
+				});
+			}
+			if (existing !== void 0) {
+				const device = await this.ports.devices.create(declaration.stableId, declaration.DeviceClass, {}, null, void 0);
+				this.ports.logger.info("declared device adopted", {
+					tags: { deviceId: device.id },
+					meta: {
+						stableId: declaration.stableId,
+						integrationId
+					}
+				});
+				return {
+					stableId: declaration.stableId,
+					deviceId: device.id,
+					device,
+					created: false
+				};
+			}
+			const device = await this.ports.devices.create(declaration.stableId, declaration.DeviceClass, declaration.config ?? {}, null, {
+				type: declaration.type,
+				name: declaration.name,
+				integrationId,
+				...declaration.role === void 0 ? {} : { role: declaration.role }
 			});
-		} catch {}
-		this.ctx.eventBus.emit(createEvent("device.source-info-changed", {
-			type: "device",
-			id: this.stableId
-		}, {
-			deviceId: this.id,
-			sourceInfo: next
-		}));
+			this.ports.logger.info("declared device created", {
+				tags: { deviceId: device.id },
+				meta: {
+					stableId: declaration.stableId,
+					integrationId
+				}
+			});
+			return {
+				stableId: declaration.stableId,
+				deviceId: device.id,
+				device,
+				created: true
+			};
+		} catch (err) {
+			this.ports.logger.warn("a declared device could not be brought up", { meta: {
+				stableId: declaration.stableId,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+			return null;
+		}
 	}
 	/**
-	* Re-publish the device's current `features` array to the persisted
-	* meta blob. Drivers call this after a probe finishes when the live
-	* `features` getter has gained new flags (e.g. `hasIntercom` flips
-	* to true → `DeviceFeature.TwoWayAudio` joins the list).
+	* Remove rows under the addon's FIXED integration whose declaration is gone.
 	*
-	* Without this, only the construction-time snapshot is written —
-	* `deviceManager.registerDevice` is invoked once per boot, so probe-
-	* driven additions don't reach the persisted index until the next
-	* server restart, and `getDevice` / `listAll` keep returning the
-	* stale list for forked-worker devices (whose live IDevice instance
-	* is invisible to the hub registry).
+	* Bounded to that integration: a declared integration has no operator
+	* add-flow, so every row under it got there by declaration. Devices this
+	* addon owns OUTSIDE it (a provider's adopted devices) are never candidates.
 	*
-	* Idempotent: re-calling with the same features just no-ops on the
-	* persisted meta. Best-effort: lookup or write failures are logged
-	* at debug and swallowed — the live `device.features` getter is
-	* still authoritative within this process, so callers never block
-	* device boot on a meta refresh.
-	*/
-	async refreshFeatures() {
-		const action = this.ctx.api?.deviceManager?.registerDevice;
-		if (!action) return;
-		try {
-			await action.mutate({
-				addonId: this.ctx.deviceMeta.addonId,
-				stableId: this.stableId,
-				id: this.id,
-				type: this.type,
-				name: this.name,
-				parentDeviceId: this.parentDeviceId,
-				features: [...this.features],
-				config: {}
+	* Bounded in count, and every deletion is logged with its `deviceId` — a
+	* withdrawal that removes an operator-visible row silently is the failure
+	* mode, not the removal itself.
+	*/
+	async sweepWithdrawn(declarations, integrationId, index) {
+		const declared = new Set(declarations.map((d) => d.stableId));
+		const candidates = [...index.values()].filter((row) => row.integrationId === integrationId && !declared.has(row.stableId));
+		if (candidates.length === 0) return [];
+		if (candidates.length > 32) {
+			this.ports.logger.warn("withdrawal sweep exceeded its bound — removing nothing", { meta: {
+				integrationId,
+				candidates: candidates.length,
+				bound: 32
+			} });
+			return [];
+		}
+		const removed = [];
+		for (const row of candidates) try {
+			await this.ports.devices.remove(row.id);
+			removed.push(row.id);
+			this.ports.logger.info("declared device removed — its declaration was withdrawn", {
+				tags: { deviceId: row.id },
+				meta: {
+					stableId: row.stableId,
+					integrationId
+				}
 			});
-		} catch (err) {}
+		} catch (err) {
+			this.ports.logger.warn("a withdrawn declared device could not be removed", {
+				tags: { deviceId: row.id },
+				meta: {
+					stableId: row.stableId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
+		return removed;
+	}
+};
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
+new Set(Object.values(DeviceType));
+DeviceFeature.BatteryOperated;
+/**
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
+*/
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
+/**
+* Frozen, null-prototype builtin function table for the expression engine
+* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
+* parser rejects any callee not in it, and the evaluator gates each call on an
+* own-property check against it.
+*
+* Because the object has a NULL prototype AND is `Object.freeze`d:
+*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
+*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
+*    (there is no `Object.prototype` in the chain), so those names are not
+*    callable — they are simply "unknown function" at parse time.
+*
+* Every numeric argument is validated as a finite number and every numeric
+* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
+* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
+* closed rather than emitting a garbage value.
+*/
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString$1(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString$1(args[1], "convert", 1).trim();
+			const to = asString$1(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
+	}
+};
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
+/**
+* Resource-bound constants for the safe expression engine.
+*
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
+*/
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
+]);
+/**
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
+*/
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	}
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
+/**
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
+*
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
+*
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+*/
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
+		};
+	}
+	peek() {
+		return this.tokens[this.pos];
+	}
+	next() {
+		return this.tokens[this.pos++];
 	}
-	/**
-	* Typed read-through to a cap-keyed runtime-state slice. Drivers
-	* call `this.getCapSlice(batteryCapability)` and the return type
-	* is inferred from the cap's `runtimeState` Zod schema — no string
-	* key, no manual generic. Returns `null` when the slice hasn't
-	* been written yet (e.g. driver hasn't seeded battery yet).
-	*/
-	getCapSlice(cap) {
-		return this.runtimeState.getCapState(cap.name) ?? null;
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
 	}
-	/**
-	* Typed writer to a cap-keyed runtime-state slice. Routes through
-	* the runtime-state writer (validate → persist → emit cap event).
-	* Equivalent to `this.runtimeState.setCapState(cap.name, value)`
-	* but with the cap's `runtimeState` schema enforcing the value
-	* shape at compile time. Mirrors the symmetry of
-	* `getCapSlice` / `setCapSlice` for cross-cap consistency.
-	*/
-	setCapSlice(cap, value) {
-		this.runtimeState.setCapState(cap.name, value);
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
+		}
+		return false;
 	}
-	/**
-	* Field-level read/write proxy over a cap's runtime-state slice.
-	* Drivers that want ergonomic per-field access declare:
-	*
-	* ```ts
-	* protected battery = this.sliceProxy(batteryCapability)
-	* // …
-	* this.battery.sleeping = true        // patches the slice
-	* const charging = this.battery.charging  // reads the slice
-	* ```
-	*
-	* Reads return `undefined` when the slice hasn't been seeded yet
-	* (cap not registered, or seeded but the field is absent). Writes
-	* route through `runtimeState.patchCapState` so the cap's `runtimeState`
-	* schema validates the merged result and the cap event fires.
-	*
-	* Pattern is generic — same shape works for `battery`, `device-status`,
-	* `motion`, `doorbell`, anything with a `runtimeState:` schema. Drivers
-	* declare one proxy per cap they read/write directly.
-	*/
-	sliceProxy(cap) {
-		return new Proxy({}, {
-			get: (_, key) => {
-				return this.runtimeState.getCapState(cap.name)?.[key];
-			},
-			set: (_, key, value) => {
-				this.runtimeState.patchCapState(cap.name, { [key]: value });
-				return true;
-			},
-			has: (_, key) => {
-				const slice = this.runtimeState.getCapState(cap.name);
-				return slice ? key in slice : false;
-			},
-			ownKeys: () => {
-				const slice = this.runtimeState.getCapState(cap.name);
-				return slice ? Object.keys(slice) : [];
-			},
-			getOwnPropertyDescriptor: (_, key) => {
-				const slice = this.runtimeState.getCapState(cap.name);
-				if (!slice || !(key in slice)) return void 0;
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	}
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
+		}
+		return test;
+	}
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
 				return {
-					configurable: true,
-					enumerable: true,
-					value: slice[key]
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
 				};
 			}
-		});
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
 	}
-	/**
-	* Default empty settings UI. Drivers override this to expose an
-	* editable form in the device-details page. Returning an empty sections
-	* array signals "nothing to contribute" — the aggregator drops the
-	* contribution entirely rather than rendering a blank panel.
-	*/
-	getSettingsUISchema() {
-		return { sections: [] };
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
 	}
-	/**
-	* Default write path: forward the flat patch directly to storage.
-	* Drivers that project a UI shape different from storage (e.g. `RtspCamera`
-	* exposing `mainStreamUrl`/`subStreamUrl` over `streams[]`) override this
-	* to reshape before `config.setAll`.
-	*/
-	async applySettingsPatch(patch) {
-		await this.config.setAll(patch);
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
+/**
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
+*
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
+*/
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
 	}
-	/**
-	* Phase 3 — populate device-scoped state needed by downstream phases
-	* (accessory reconciliation, public `features` array, optional cap
-	* registration). Called ONCE per construction, after register but
-	* before `getAccessoryChildren()`.
-	*
-	* Drivers write the `feature-probe` runtime-state slice via
-	* `this.runtimeState.setCapState('feature-probe', {...})` — flag bag
-	* is open (Reolink writes `hasPtz/hasIntercom`, Hikvision writes
-	* `hasSupplementalLight/hasAlarmIo`, etc).
-	*
-	* Default: nothing to probe → mark the device PROBED (set `lastProbedAt`) so
-	* the kernel treats it as ready immediately. A device that derives its shape
-	* from a spec (a container, or an accessory sensor) rather than from a
-	* hardware probe has no probe to "complete"; without stamping `lastProbedAt`
-	* it would look perpetually un-probed — logging "Initial probe did not
-	* complete" on every boot and spinning a pointless retry chain. Drivers that
-	* DO probe override this and write their own `feature-probe` slice (including
-	* `lastProbedAt`) once their probe actually succeeds.
-	*/
-	async onProbe() {
-		const base = this.runtimeState.getCapState("feature-probe") ?? {
-			flags: {},
-			deviceType: null,
-			model: null,
-			channelCount: null,
-			lastProbedAt: 0,
-			lastFetchedAt: 0
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
 		};
-		this.runtimeState.setCapState("feature-probe", {
-			...base,
-			lastProbedAt: Date.now()
-		});
-	}
-	/**
-	* Phase 5 — fired after the device + its accessories are registered.
-	* Drivers publish streams to the broker, kick off background tasks,
-	* or subscribe to lib events that need a fully-registered device id.
-	*
-	* Default: no-op.
-	*
-	* RENAMED FROM `onCreated` (which still exists for back-compat in this
-	* pass). The new name reflects the post-probe, post-accessory contract.
-	*/
-	async onActivate() {}
-	/**
-	* Re-run the probe + reconcile accessories + refresh features meta.
-	* Drivers call this when device-side state changes (battery cam wakes,
-	* firmware update, manual operator trigger).
-	*
-	* The kernel injects `_kernelReprobe` on registration so this method
-	* delegates to the same orchestrator that runs the boot-time phase
-	* 3 + 4 sequence. Drivers should NOT override this — they override
-	* `onProbe()` instead.
-	*/
-	async reprobe() {
-		if (this._kernelReprobe) await this._kernelReprobe();
-		else await this.onProbe();
 	}
-	/**
-	* Kernel-injected callback that runs the full post-probe orchestration
-	* (onProbe → registerDevice meta refresh → accessory reconciliation).
-	* Set by `device-cap-proxy.register()`. Drivers should not touch this
-	* directly — call `reprobe()` instead.
-	*/
-	_kernelReprobe;
-	/**
-	* Declare accessory child devices the kernel should auto-spawn
-	* after `onProbe()` resolves. Each spec fully describes one child
-	* — stableId suffix (deterministic per kind for restore-safety),
-	* meta (type / name / location), config (initial blob the child
-	* self-hydrates), and a factory that constructs the concrete
-	* class with whatever closure-captured refs it needs (typically
-	* `this` for the parent reference).
-	*
-	* The kernel handles the rest: allocateDeviceId, persistInitialConfig
-	* (skipped on restore when the row already exists),
-	* persistInitialMeta, createContext, factory invocation, register,
-	* and recursive lifecycle (probe + accessories + activate).
-	*
-	* Implementations should derive children from
-	* `this.runtimeState.getCapState('feature-probe')` (post-probe truth).
-	* Drivers can use the `getProbeFlags()` helper to read the flag bag
-	* with a typed cast.
-	*
-	* Default: no children.
-	*/
-	getAccessoryChildren() {
-		return [];
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
 	}
-	/**
-	* Read the current feature-probe flag bag with a typed cast. Helper
-	* for `getAccessoryChildren()` and `features` getters that derive
-	* outputs from the probe results.
-	*/
-	getProbeFlags() {
-		return this.runtimeState.getCapState("feature-probe")?.flags ?? {};
+	return result;
+}
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
+}
+Object.freeze({});
+/**
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
 	}
-	/**
-	* Returns true once `onProbe` has completed at least once
-	* (`lastProbedAt > 0`). Drivers gate `getAccessoryChildren()` on this
-	* to avoid spawning stale accessories on a fresh device whose probe
-	* hasn't landed yet.
-	*/
-	hasProbed() {
-		return (this.runtimeState.getCapState("feature-probe")?.lastProbedAt ?? 0) > 0;
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
 	}
-};
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
-new Set(Object.values(DeviceType));
-DeviceFeature.BatteryOperated;
+	return null;
+}
+var ExpressionBindingSourceSchema = union([
+	object({
+		kind: literal("field").optional(),
+		sourceKey: string(),
+		cap: string(),
+		fieldPath: string()
+	}),
+	object({
+		kind: literal("literal"),
+		value: union([
+			string(),
+			number(),
+			boolean(),
+			_null()
+		])
+	}),
+	object({
+		kind: literal("global"),
+		sourceStableId: string(),
+		cap: string(),
+		fieldPath: string()
+	})
+]);
+object({
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
 Object.freeze({
 	"accessories.setChildHidden": {
 		capName: "accessories",
@@ -28801,6 +28611,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.restart": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.setEnabled": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -29437,12 +29253,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"deviceManager.setDeviceLinks": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"deviceManager.setDisabled": {
 		capName: "device-manager",
 		capScope: "system",
@@ -32587,6 +32397,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.fetchEventMedia": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.getAllRtspEntries": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -32671,6 +32487,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.produceEventMedia": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.publishCameraStream": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -33528,51 +33350,6 @@ var TimelapseRuleSchema = TimelapseRuleInputSchema.extend({
 	createdAt: number(),
 	updatedAt: number()
 });
-/** Cosine similarity between two embedding vectors */
-function cosineSimilarity(a, b) {
-	if (a.length !== b.length) return 0;
-	let dotProduct = 0;
-	let normA = 0;
-	let normB = 0;
-	for (let i = 0; i < a.length; i++) {
-		dotProduct += a[i] * b[i];
-		normA += a[i] * a[i];
-		normB += b[i] * b[i];
-	}
-	const denom = Math.sqrt(normA) * Math.sqrt(normB);
-	return denom === 0 ? 0 : dotProduct / denom;
-}
-function hfModelUrl(repo, path) {
-	return `https://huggingface.co/${repo}/resolve/main/${path}`;
-}
-/**
-* Vector wire codec — base64 of little-endian Float32.
-*
-* The `vector-store` capability carries vectors as base64 rather than
-* `number[]` or a typed array, and both rejected alternatives have a scar here:
-*
-*  - a `Float32Array` does NOT survive msgpack across the UDS transport (it
-*    arrived as an empty object and froze audio dBFS until the payload was
-*    changed to carry bytes);
-*  - `number[]` is the ~5x-larger encoding the capability exists to stop paying
-*    — a 512-dim vector is 2,048 bytes raw and 2,732 as base64, against roughly
-*    10-12 KB rendered as JSON text.
-*
-* Endianness is pinned to little-endian explicitly instead of inheriting the
-* platform's, so a vector written on one node decodes correctly on another.
-*/
-/** Encode a vector as base64 of little-endian Float32. */
-function encodeVectorBase64(vector) {
-	const floats = vector instanceof Float32Array ? vector : Float32Array.from(vector);
-	const bytes = new Uint8Array(floats.length * 4);
-	const view = new DataView(bytes.buffer);
-	for (let i = 0; i < floats.length; i += 1) view.setFloat32(i * 4, floats[i] ?? 0, true);
-	return Buffer.from(bytes).toString("base64");
-}
-/** Vector length implied by a base64 payload, without decoding it. */
-function vectorDimFromBase64(encoded) {
-	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
-}
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -33679,5 +33456,50 @@ DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
+/** Cosine similarity between two embedding vectors */
+function cosineSimilarity(a, b) {
+	if (a.length !== b.length) return 0;
+	let dotProduct = 0;
+	let normA = 0;
+	let normB = 0;
+	for (let i = 0; i < a.length; i++) {
+		dotProduct += a[i] * b[i];
+		normA += a[i] * a[i];
+		normB += b[i] * b[i];
+	}
+	const denom = Math.sqrt(normA) * Math.sqrt(normB);
+	return denom === 0 ? 0 : dotProduct / denom;
+}
+function hfModelUrl(repo, path) {
+	return `https://huggingface.co/${repo}/resolve/main/${path}`;
+}
+/**
+* Vector wire codec — base64 of little-endian Float32.
+*
+* The `vector-store` capability carries vectors as base64 rather than
+* `number[]` or a typed array, and both rejected alternatives have a scar here:
+*
+*  - a `Float32Array` does NOT survive msgpack across the UDS transport (it
+*    arrived as an empty object and froze audio dBFS until the payload was
+*    changed to carry bytes);
+*  - `number[]` is the ~5x-larger encoding the capability exists to stop paying
+*    — a 512-dim vector is 2,048 bytes raw and 2,732 as base64, against roughly
+*    10-12 KB rendered as JSON text.
+*
+* Endianness is pinned to little-endian explicitly instead of inheriting the
+* platform's, so a vector written on one node decodes correctly on another.
+*/
+/** Encode a vector as base64 of little-endian Float32. */
+function encodeVectorBase64(vector) {
+	const floats = vector instanceof Float32Array ? vector : Float32Array.from(vector);
+	const bytes = new Uint8Array(floats.length * 4);
+	const view = new DataView(bytes.buffer);
+	for (let i = 0; i < floats.length; i += 1) view.setFloat32(i * 4, floats[i] ?? 0, true);
+	return Buffer.from(bytes).toString("base64");
+}
+/** Vector length implied by a base64 payload, without decoding it. */
+function vectorDimFromBase64(encoded) {
+	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
+}
 //#endregion
-export { sleep as $, encodeVectorBase64 as A, vectorDimFromBase64 as B, alarmPanelCapability as C, customAction as D, cosineSimilarity as E, notificationRulesCapability as F, buildFfmpegArgs as G, zoneAnalyticsCapability as H, pipelineAnalyticsCapability as I, DeviceType as J, isSoftwareDecode as K, plateGalleryCapability as L, hfModelUrl as M, isScheduleActive as N, defineCustomActions as O, kebabToCamel as P, nodePin as Q, readDeviceStateFrom as R, addonWidgetsSourceCapability as S, buildEventKindDescriptor as T, errMsg as U, videoclipsCapability as V, Fmp4BoxSplitter as W, hydrateSchema as X, createEvent as Y, isDeviceScopedCap as Z, OpsLogEntrySchema as _, LabelAttributionSchema as a, object as at, TimelapseRuleSchema as b, NC_TAXONOMY as c, unknown as ct, NcRulePatchSchema as d, _enum as et, NcRuleSchema as f, NcTaxonomySchema as g, NcSnoozeSuppressedSchema as h, EVENT_PAD_MS as i, number as it, faceGalleryCapability as j, embeddingEncoderCapability as k, NcConditionDescriptorSchema as l, EventCategory as lt, NcSnoozeSchema as m, DEFAULT_EVENT_COLOR as n, boolean as nt, MACRO_LABELS as o, record as ot, NcSnoozeInputSchema as p, BaseAddon as q, EVENT_KIND_BY_CAP as r, literal as rt, NC_CONDITION_CATALOG as s, string as st, BaseDevice as t, array as tt, NcRuleInputSchema as u, RetrainStatusSchema as v, audioMetricsCapability as w, TrackSourceSchema as x, TimelapseRuleInputSchema as y, subKindsOf as z };
+export { array as $, embeddingEncoderCapability as A, subKindsOf as B, addonWidgetsSourceCapability as C, cosineSimilarity as D, buildEventKindDescriptor as E, kebabToCamel as F, BaseAddon as G, videoclipsCapability as H, notificationRulesCapability as I, hydrateSchema as J, DeviceType as K, pipelineAnalyticsCapability as L, faceGalleryCapability as M, hfModelUrl as N, customAction as O, isScheduleActive as P, _enum as Q, plateGalleryCapability as R, TrackSourceSchema as S, audioMetricsCapability as T, zoneAnalyticsCapability as U, vectorDimFromBase64 as V, errMsg as W, nodePin as X, isDeviceScopedCap as Y, sleep as Z, NcTaxonomySchema as _, EVENT_PAD_MS as a, string as at, TimelapseRuleInputSchema as b, NC_CONDITION_CATALOG as c, NcRuleInputSchema as d, boolean as et, NcRulePatchSchema as f, NcSnoozeSuppressedSchema as g, NcSnoozeSchema as h, EVENT_KIND_BY_CAP as i, record as it, encodeVectorBase64 as j, defineCustomActions as k, NC_TAXONOMY as l, NcSnoozeInputSchema as m, DEFAULT_EVENT_COLOR as n, number as nt, LabelAttributionSchema as o, unknown as ot, NcRuleSchema as p, createEvent as q, DeclaredDevices as r, object as rt, MACRO_LABELS as s, EventCategory as st, BaseDevice as t, literal as tt, NcConditionDescriptorSchema as u, OpsLogEntrySchema as v, alarmPanelCapability as w, TimelapseRuleSchema as x, RetrainStatusSchema as y, readDeviceStateFrom as z };