@camstack/addon-post-analysis 1.2.52 → 1.2.54

package/dist/{dist-k21GqaWS.js → dist-BJ65Xxa1.js}

@@ -9652,12 +9652,34 @@ method(object({
 	kinds: array(EventMediaKindSchema).min(1).default(["mp4"]),
 	/** GIF geometry. The video keeps the source's own. */
 	gifMaxWidth: number().int().min(120).max(1280).default(640),
-	gifFps: number().int().min(1).max(15).default(8),
 	/**
-	* Playback rate, applied to EVERY container so they stay one clip.
-	* `1` is real time and is what allows the copy branch.
+	* The gif's own PLAYBACK rate in frames per second — what the finished
+	* gif runs at, not how many source frames feed it. The decimation that
+	* feeds it samples `gifFps / gifSpeed` source frames per second, so at
+	* the defaults a 12 fps gif is built out of 3 source frames a second.
 	*/
-	speed: number().min(1).max(8).default(1)
+	gifFps: number().int().min(1).max(15).default(12),
+	/**
+	* How fast the GIF plays against real time, independent of `speed`.
+	*
+	* 4× by default, by operator request: a notification gif is glanced at
+	* on a lock screen, so a ~12 s window has to be over in ~3 s. It stays
+	* a separate knob from `speed` even though both now default to 4 —
+	* a caller wanting a real-time video and a fast gif must not have to
+	* choose.
+	*/
+	gifSpeed: number().min(1).max(8).default(4),
+	/**
+	* Playback rate of the VIDEO. Also 4× by default, by operator decision.
+	*
+	* `1` is real time and is the ONLY value that allows the copy branch —
+	* anything else forces `libx264` over the window. That was priced
+	* before it was chosen: a per-event burst measured at 0.23 s and 254 KB
+	* on a real 615 720p cut, against 922 KB for the copy it replaces. A
+	* re-encode is capped at 720p (`EVENT_CLIP_ENCODE_MAX_WIDTH`), because
+	* once the decode is forced the width stops being free.
+	*/
+	speed: number().min(1).max(8).default(4)
 }), EventMediaProductionSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -9959,25 +9981,6 @@ var cameraStreamsCapability = {
 function kebabToCamel(s) {
 	return s.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
 }
-/**
-* core-blocks — user-authored TypeScript, stored in the kernel and executed in
-* its own process.
-*
-* Spec: `docs/superpowers/specs/2026-08-04-core-blocks-and-synthetic-devices-design.md`.
-*
-* The first use is **owning devices without being a device provider**: a block
-* declares devices under a system or custom integration and drives their state,
-* with the same `ctx` an addon gets. Automations come later; nothing here
-* models a trigger.
-*
-* **Stated plainly, because it does not change by being true:** a block has an
-* addon's powers — devices, storage, the event bus, `ctx.api`. It is a plugin
-* with no review step. What makes that survivable is not a sandbox, it is
-* PROCESS ISOLATION: one process per block, supervised by `CrashSupervisor`,
-* so a block that throws or never returns is marked `failed` and visible
-* instead of taking the hub with it (D6). Every method here is admin-only, and
-* must stay so.
-*/
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
@@ -10049,6 +10052,9 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 }), object({ block: CoreBlockSchema }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ blockId: string() }), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ code: string() }), CoreBlockCompileResultSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -10849,713 +10855,118 @@ var ExposeInputSchema = object({
 });
 var UnexposeInputSchema = object({ deviceId: string() });
 method(_void(), DeviceExportStatusSchema), method(_void(), array(DeviceKindSchema)), method(_void(), array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), { kind: "mutation" }), method(UnexposeInputSchema, _void(), { kind: "mutation" });
+var ProviderStatusSchema = object({
+	connected: boolean(),
+	deviceCount: number(),
+	error: string().optional()
+});
+object({
+	externalId: string(),
+	name: string(),
+	type: string(),
+	metadata: record(string(), unknown()).optional()
+});
 /**
-* Resource-bound constants for the safe expression engine.
-*
-* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
-* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
-* O(nodeCount) by construction. These caps merely put a hard ceiling on the
-* work a single author-supplied expression can request, so a hostile or
-* accidental pathological string can never spend unbounded CPU/memory.
+* Candidate handed back from discovery and accepted by
+* `adoptDiscoveredDevice`. Shape mirrors the in-process
+* `DiscoveredDevice` interface used by `DeviceDiscovery`.
 */
-/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
-*  rejected without allocation. */
-var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
-/** A legal binding / identifier name. */
-var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Binding names an author may NOT use: `now` is auto-injected; the literal
-*  keywords lex as values, not identifiers, so binding to them is meaningless. */
-var RESERVED_BINDING_NAMES = new Set([
-	"now",
-	"true",
-	"false",
-	"null"
-]);
+var DiscoveryCandidateSchema = object({
+	stableId: string(),
+	type: _enum(DeviceType),
+	suggestedName: string(),
+	prefilledConfig: record(string(), unknown()),
+	/**
+	* Optional upstream-system identity (HA entity_id, vendor MAC, …).
+	* Discovery pre-populates this for systems that know the upstream
+	* identity ahead of adoption. Rendering metadata (unit, precision)
+	* flows live through the cap STATUS SLICE after adoption.
+	*/
+	sourceInfo: SourceInfoSchema.optional()
+});
 /**
-* Error types for the safe expression engine. Two distinct classes so callers
-* can tell a compile-time (grammar) failure from a runtime (evaluation)
-* failure — both are non-fatal to the host: read paths degrade to "skip link".
+* Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
+* Mirrors `toDeviceShape()` output in `device-management.router.ts` so the
+* tRPC layer can pass it through without reshaping.
 */
-/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
-*  the failure is anchored to a character (author-facing inline feedback). */
-var ExpressionParseError = class extends Error {
-	position;
-	constructor(message, position) {
-		super(message);
-		this.name = "ExpressionParseError";
-		this.position = position;
-	}
-};
-/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
-*  result, unknown builtin, step-budget exceeded). */
-var ExpressionEvalError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ExpressionEvalError";
-	}
-};
+var DeviceSummarySchema = object({
+	id: number(),
+	stableId: string(),
+	addonId: string(),
+	type: string(),
+	name: string(),
+	parentDeviceId: number().nullable(),
+	online: boolean(),
+	features: array(string()),
+	config: record(string(), unknown()),
+	/** Optional upstream-system identity (dispatch key + system tag).
+	*  See `SourceInfo`. Present when the device has a non-synthetic
+	*  source identifier (HA entities, vendor MAC, …); omitted when the
+	*  synthetic backfill is in effect. */
+	sourceInfo: SourceInfoSchema.optional()
+});
 /**
-* Frozen, null-prototype builtin function table for the expression engine
-* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
-* parser rejects any callee not in it, and the evaluator gates each call on an
-* own-property check against it.
+* Result of a live field test (e.g. probing an RTSP URL during device
+* creation). Matches the UI-side `FieldProbeResult` in
+* `interfaces/config-ui.ts` — the admin `FormBuilder` renders the
+* returned `labels` as chips next to the input.
+*/
+var FieldProbeResultSchema = object({
+	status: _enum(["ok", "error"]),
+	labels: array(string()).optional(),
+	error: string().optional()
+});
+/**
+* The output of `getChildCreationSchema` is a UI schema tree. We store
+* it as `unknown` at the capability layer — the router just passes it
+* through and the admin UI renders it via `FormBuilder`. The actual
+* type is `ConfigUISchema` (see `packages/types/src/interfaces/config-ui.ts`),
+* but we deliberately avoid a Zod mirror because the union is large and
+* not meant for runtime validation at this seam.
+*/
+var CreationSchemaOutputSchema = unknown();
+method(_void(), _void(), { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), ProviderStatusSchema), method(_void(), array(object({
+	id: string(),
+	name: string(),
+	type: string()
+}))), method(object({}), boolean()), method(object({ params: record(string(), unknown()).optional() }), array(DiscoveryCandidateSchema), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), CreationSchemaOutputSchema), method(object({}), object({ deviceType: _enum(DeviceType).nullable() })), method(object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), boolean()), method(object({ type: _enum(DeviceType) }), CreationSchemaOutputSchema), method(object({
+	type: _enum(DeviceType),
+	config: record(string(), unknown())
+}), DeviceSummarySchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	type: _enum(DeviceType),
+	key: string(),
+	value: unknown(),
+	formValues: record(string(), unknown()).optional()
+}), FieldProbeResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* Device Manager capability — hub-side singleton that unifies device persistence,
+* live registry access, and all management operations into a single tRPC surface.
 *
-* Because the object has a NULL prototype AND is `Object.freeze`d:
-*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
-*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
-*    (there is no `Object.prototype` in the chain), so those names are not
-*    callable — they are simply "unknown function" at parse time.
+* Replaces:
+*   - `device-persistence` capability (persistence methods absorbed here)
+*   - `device-management.router.ts` (deleted in Phase 2)
+*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
 *
-* Every numeric argument is validated as a finite number and every numeric
-* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
-* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
-* closed rather than emitting a garbage value.
-*/
-function asFiniteNumber(value, name, index) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
-	return value;
-}
-function asString$1(value, name, index) {
-	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
-	return value;
-}
-function finiteResult(value, name) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
-	return value;
-}
-function allFiniteNumbers(args, name) {
-	return args.map((a, idx) => asFiniteNumber(a, name, idx));
-}
-var INF = Number.POSITIVE_INFINITY;
-var table = {
-	min: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
-	},
-	max: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
-	},
-	abs: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
-	},
-	floor: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
-	},
-	ceil: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
-	},
-	sqrt: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
-	},
-	round: {
-		minArgs: 1,
-		maxArgs: 2,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "round", 0);
-			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
-			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
-			const factor = 10 ** digits;
-			return finiteResult(Math.round(x * factor) / factor, "round");
-		}
-	},
-	pow: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
-	},
-	clamp: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "clamp", 0);
-			const lo = asFiniteNumber(args[1], "clamp", 1);
-			const hi = asFiniteNumber(args[2], "clamp", 2);
-			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
-			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
-		}
-	},
-	avg: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const nums = allFiniteNumbers(args, "avg");
-			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
-		}
-	},
-	sum: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
-	},
-	coalesce: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			for (const a of args) if (a !== null) return a;
-			return null;
-		}
-	},
-	age: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
-	},
-	convert: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args, hooks) => {
-			const x = asFiniteNumber(args[0], "convert", 0);
-			const from = asString$1(args[1], "convert", 1).trim();
-			const to = asString$1(args[2], "convert", 2).trim();
-			if (hooks.convert) {
-				const out = hooks.convert(x, from, to);
-				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
-				return finiteResult(out, "convert");
-			}
-			if (from === to) return x;
-			throw new ExpressionEvalError("convert: unit conversion table not installed");
-		}
-	}
-};
-Object.freeze(Object.assign(Object.create(null), table));
-/** The set of valid builtin names — used by the parser to reject unknown
-*  callees at parse time (immediate author feedback). */
-var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
-/**
-* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
-* zero-dependency. The grammar is deliberately boring: decimal numbers,
-* single/double-quoted strings with a tiny escape set, identifiers, the three
-* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
-* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
-* is a parse error with a source position, so member access / assignment /
-* template literals are lexically impossible.
-*/
-var KEYWORDS = new Set([
-	"true",
-	"false",
-	"null"
-]);
-function isDigit(ch) {
-	return ch >= "0" && ch <= "9";
-}
-function isIdentStart(ch) {
-	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
-}
-function isIdentPart(ch) {
-	return isIdentStart(ch) || isDigit(ch);
-}
-function isWhitespace(ch) {
-	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
-}
-/** Tokenize `source` into a flat token list ending with a single `eof` token.
-*  Throws `ExpressionParseError` on any illegal character or unterminated
-*  string. */
-function tokenize(source) {
-	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
-	const tokens = [];
-	let i = 0;
-	const n = source.length;
-	while (i < n) {
-		const ch = source[i];
-		if (isWhitespace(ch)) {
-			i += 1;
-			continue;
-		}
-		if (isDigit(ch)) {
-			const start = i;
-			while (i < n && isDigit(source[i])) i += 1;
-			if (i < n && source[i] === ".") {
-				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
-				i += 1;
-				while (i < n && isDigit(source[i])) i += 1;
-			}
-			const text = source.slice(start, i);
-			const value = Number(text);
-			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
-			tokens.push({
-				type: "number",
-				value,
-				pos: start
-			});
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			const quote = ch;
-			const start = i;
-			i += 1;
-			let out = "";
-			let closed = false;
-			while (i < n) {
-				const c = source[i];
-				if (c === "\\") {
-					const next = i + 1 < n ? source[i + 1] : "";
-					if (next === "\\" || next === "'" || next === "\"") {
-						out += next;
-						i += 2;
-						continue;
-					}
-					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
-				}
-				if (c === quote) {
-					closed = true;
-					i += 1;
-					break;
-				}
-				out += c;
-				i += 1;
-			}
-			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
-			tokens.push({
-				type: "string",
-				value: out,
-				pos: start
-			});
-			continue;
-		}
-		if (isIdentStart(ch)) {
-			const start = i;
-			while (i < n && isIdentPart(source[i])) i += 1;
-			const text = source.slice(start, i);
-			if (KEYWORDS.has(text)) tokens.push({
-				type: "keyword",
-				keyword: keywordOf(text),
-				pos: start
-			});
-			else tokens.push({
-				type: "identifier",
-				name: text,
-				pos: start
-			});
-			continue;
-		}
-		const two = i + 1 < n ? source.slice(i, i + 2) : "";
-		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
-			tokens.push({
-				type: "punct",
-				punct: two,
-				pos: i
-			});
-			i += 2;
-			continue;
-		}
-		if (isSinglePunct(ch)) {
-			tokens.push({
-				type: "punct",
-				punct: ch,
-				pos: i
-			});
-			i += 1;
-			continue;
-		}
-		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
-	}
-	tokens.push({
-		type: "eof",
-		pos: n
-	});
-	return tokens;
-}
-function keywordOf(text) {
-	if (text === "true") return "true";
-	if (text === "false") return "false";
-	return "null";
-}
-function isSinglePunct(ch) {
-	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
-}
-/**
-* Pratt (precedence-climbing) parser for the safe expression mini-language.
-*
-* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
-* → relational → additive → multiplicative → unary `! -` → call / primary.
-* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
-* string validated against the builtin table at parse time, so an unknown
-* function is rejected immediately (author feedback) and a persisted expression
-* that references a since-removed builtin degrades at read.
-*
-* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
-* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
-*/
-/** Binary/logical operator precedence (higher binds tighter). */
-var BINARY_PRECEDENCE = {
-	"||": 1,
-	"&&": 2,
-	"==": 3,
-	"!=": 3,
-	"<": 4,
-	"<=": 4,
-	">": 4,
-	">=": 4,
-	"+": 5,
-	"-": 5,
-	"*": 6,
-	"/": 6,
-	"%": 6
-};
-function isLogicalOp(op) {
-	return op === "&&" || op === "||";
-}
-function isBinaryOp(op) {
-	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
-}
-var Parser = class {
-	tokens;
-	pos = 0;
-	nodeCount = 0;
-	identifiers = /* @__PURE__ */ new Set();
-	callees = /* @__PURE__ */ new Set();
-	constructor(tokens) {
-		this.tokens = tokens;
-	}
-	parse() {
-		const ast = this.parseTernary();
-		const tok = this.peek();
-		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
-		return {
-			ast,
-			identifiers: this.identifiers,
-			callees: this.callees,
-			nodeCount: this.nodeCount
-		};
-	}
-	peek() {
-		return this.tokens[this.pos];
-	}
-	next() {
-		return this.tokens[this.pos++];
-	}
-	/** Consume a punctuator token, erroring if the next token isn't it. */
-	expectPunct(punct) {
-		const tok = this.peek();
-		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
-		this.pos += 1;
-	}
-	matchPunct(punct) {
-		const tok = this.peek();
-		if (tok.type === "punct" && tok.punct === punct) {
-			this.pos += 1;
-			return true;
-		}
-		return false;
-	}
-	countNode() {
-		this.nodeCount += 1;
-		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
-	}
-	parseTernary() {
-		const test = this.parseBinary(1);
-		if (this.matchPunct("?")) {
-			const consequent = this.parseTernary();
-			this.expectPunct(":");
-			const alternate = this.parseTernary();
-			this.countNode();
-			return {
-				kind: "conditional",
-				test,
-				consequent,
-				alternate
-			};
-		}
-		return test;
-	}
-	parseBinary(minPrec) {
-		let left = this.parseUnary();
-		for (;;) {
-			const tok = this.peek();
-			if (tok.type !== "punct") break;
-			const prec = BINARY_PRECEDENCE[tok.punct];
-			if (prec === void 0 || prec < minPrec) break;
-			const op = tok.punct;
-			this.pos += 1;
-			const right = this.parseBinary(prec + 1);
-			this.countNode();
-			if (isLogicalOp(op)) left = {
-				kind: "logical",
-				op,
-				left,
-				right
-			};
-			else if (isBinaryOp(op)) left = {
-				kind: "binary",
-				op,
-				left,
-				right
-			};
-			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
-		}
-		return left;
-	}
-	parseUnary() {
-		const tok = this.peek();
-		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
-			const op = tok.punct;
-			this.pos += 1;
-			const operand = this.parseUnary();
-			this.countNode();
-			return {
-				kind: "unary",
-				op,
-				operand
-			};
-		}
-		return this.parsePrimary();
-	}
-	parsePrimary() {
-		const tok = this.next();
-		switch (tok.type) {
-			case "number":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "string":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "keyword":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.keyword === "null" ? null : tok.keyword === "true"
-				};
-			case "identifier": {
-				const nextTok = this.peek();
-				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
-				this.identifiers.add(tok.name);
-				this.countNode();
-				return {
-					kind: "identifier",
-					name: tok.name
-				};
-			}
-			case "punct":
-				if (tok.punct === "(") {
-					const inner = this.parseTernary();
-					this.expectPunct(")");
-					return inner;
-				}
-				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
-			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
-		}
-	}
-	parseCall(callee, pos) {
-		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
-		this.expectPunct("(");
-		const args = [];
-		if (!this.matchPunct(")")) for (;;) {
-			args.push(this.parseTernary());
-			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
-			if (this.matchPunct(",")) continue;
-			this.expectPunct(")");
-			break;
-		}
-		this.callees.add(callee);
-		this.countNode();
-		return {
-			kind: "call",
-			callee,
-			args
-		};
-	}
-};
-/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
-*  `ExpressionParseError` on any lexical or grammatical failure. */
-function parseExpression(source) {
-	return new Parser(tokenize(source)).parse();
-}
-/**
-* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
-* by expr"). The cache stores BOTH successes and failures (negative caching),
-* so a corrupt persisted string costs exactly one tokenize+parse total — not
-* one per read on a hot resolve path.
-*
-* The cache is a module-level singleton: entries are pure, content-addressed
-* ASTs keyed by the raw source string, so sharing one instance across all
-* callers is safe and maximises hit rate.
-*/
-var cache = /* @__PURE__ */ new Map();
-function getCached(source) {
-	const hit = cache.get(source);
-	if (hit !== void 0) {
-		cache.delete(source);
-		cache.set(source, hit);
-		return hit;
-	}
-	let result;
-	try {
-		result = {
-			ok: true,
-			parsed: parseExpression(source)
-		};
-	} catch (err) {
-		result = {
-			ok: false,
-			error: err instanceof ExpressionParseError ? err.message : String(err)
-		};
-	}
-	cache.set(source, result);
-	if (cache.size > 256) {
-		const oldest = cache.keys().next().value;
-		if (oldest !== void 0) cache.delete(oldest);
-	}
-	return result;
-}
-/** Compile `source`, returning a discriminated result instead of throwing.
-*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
-function compileExpressionSafe(source) {
-	return getCached(source);
-}
-Object.freeze({});
-/**
-* Author-time validation. Returns `null` when the source is valid, else a
-* human-readable error message. Checks: the expression compiles; binding count
-* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
-* is not reserved (`now`/keywords) and does not shadow a builtin; and every
-* FREE identifier of the AST is covered by a binding or the injected `now`.
-*/
-function validateExpressionSource(src) {
-	const names = Object.keys(src.bindings);
-	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
-	for (const name of names) {
-		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
-		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
-		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
-	}
-	const compiled = compileExpressionSafe(src.expr);
-	if (!compiled.ok) return compiled.error;
-	const bound = new Set(names);
-	for (const id of compiled.parsed.identifiers) {
-		if (id === "now") continue;
-		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
-	}
-	return null;
-}
-var ProviderStatusSchema = object({
-	connected: boolean(),
-	deviceCount: number(),
-	error: string().optional()
-});
-object({
-	externalId: string(),
-	name: string(),
-	type: string(),
-	metadata: record(string(), unknown()).optional()
-});
-/**
-* Candidate handed back from discovery and accepted by
-* `adoptDiscoveredDevice`. Shape mirrors the in-process
-* `DiscoveredDevice` interface used by `DeviceDiscovery`.
-*/
-var DiscoveryCandidateSchema = object({
-	stableId: string(),
-	type: _enum(DeviceType),
-	suggestedName: string(),
-	prefilledConfig: record(string(), unknown()),
-	/**
-	* Optional upstream-system identity (HA entity_id, vendor MAC, …).
-	* Discovery pre-populates this for systems that know the upstream
-	* identity ahead of adoption. Rendering metadata (unit, precision)
-	* flows live through the cap STATUS SLICE after adoption.
-	*/
-	sourceInfo: SourceInfoSchema.optional()
-});
-/**
-* Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
-* Mirrors `toDeviceShape()` output in `device-management.router.ts` so the
-* tRPC layer can pass it through without reshaping.
-*/
-var DeviceSummarySchema = object({
-	id: number(),
-	stableId: string(),
-	addonId: string(),
-	type: string(),
-	name: string(),
-	parentDeviceId: number().nullable(),
-	online: boolean(),
-	features: array(string()),
-	config: record(string(), unknown()),
-	/** Optional upstream-system identity (dispatch key + system tag).
-	*  See `SourceInfo`. Present when the device has a non-synthetic
-	*  source identifier (HA entities, vendor MAC, …); omitted when the
-	*  synthetic backfill is in effect. */
-	sourceInfo: SourceInfoSchema.optional()
-});
-/**
-* Result of a live field test (e.g. probing an RTSP URL during device
-* creation). Matches the UI-side `FieldProbeResult` in
-* `interfaces/config-ui.ts` — the admin `FormBuilder` renders the
-* returned `labels` as chips next to the input.
-*/
-var FieldProbeResultSchema = object({
-	status: _enum(["ok", "error"]),
-	labels: array(string()).optional(),
-	error: string().optional()
-});
-/**
-* The output of `getChildCreationSchema` is a UI schema tree. We store
-* it as `unknown` at the capability layer — the router just passes it
-* through and the admin UI renders it via `FormBuilder`. The actual
-* type is `ConfigUISchema` (see `packages/types/src/interfaces/config-ui.ts`),
-* but we deliberately avoid a Zod mirror because the union is large and
-* not meant for runtime validation at this seam.
-*/
-var CreationSchemaOutputSchema = unknown();
-method(_void(), _void(), { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), ProviderStatusSchema), method(_void(), array(object({
-	id: string(),
-	name: string(),
-	type: string()
-}))), method(object({}), boolean()), method(object({ params: record(string(), unknown()).optional() }), array(DiscoveryCandidateSchema), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({}), CreationSchemaOutputSchema), method(object({}), object({ deviceType: _enum(DeviceType).nullable() })), method(object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({}), boolean()), method(object({ type: _enum(DeviceType) }), CreationSchemaOutputSchema), method(object({
-	type: _enum(DeviceType),
-	config: record(string(), unknown())
-}), DeviceSummarySchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	type: _enum(DeviceType),
-	key: string(),
-	value: unknown(),
-	formValues: record(string(), unknown()).optional()
-}), FieldProbeResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
-* Device Manager capability — hub-side singleton that unifies device persistence,
-* live registry access, and all management operations into a single tRPC surface.
-*
-* Replaces:
-*   - `device-persistence` capability (persistence methods absorbed here)
-*   - `device-management.router.ts` (deleted in Phase 2)
-*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
-*
-* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
-* fork into separate processes but never run on remote cluster agents. Therefore:
-*   - No nodeId routing needed — this is a pure hub singleton.
-*   - The hub's DeviceRegistry is the single source of truth for all live devices.
-*   - No shadow registry or cross-node aggregation required.
-*
-* Forked workers register devices back to the hub via `ctx.devices`
-* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
+* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
+* fork into separate processes but never run on remote cluster agents. Therefore:
+*   - No nodeId routing needed — this is a pure hub singleton.
+*   - The hub's DeviceRegistry is the single source of truth for all live devices.
+*   - No shadow registry or cross-node aggregation required.
+*
+* Forked workers register devices back to the hub via `ctx.devices`
+* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
 */
 /** One child-placement directive on a container's `childLayout`. Structurally
 *  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
@@ -11568,92 +10979,6 @@ var ChildLayoutEntrySchema = object({
 	order: number().optional(),
 	collapsed: boolean().optional()
 });
-/** Cap-wire shape of a DeviceLink — structurally mirrors `DeviceLink` in
-*  `device-management.ts`. Source is a union: a FIELD source copies a sibling
-*  accessory's status field (`kind` optional/absent for wire compat); a
-*  LITERAL source carries a per-device constant (no sibling is read); a
-*  GLOBAL source (P2e) copies ANY device's status field, addressed by the
-*  source device's full re-sync-stable `stableId`. */
-var DeviceLinkFieldSourceSchema = object({
-	kind: literal("field").optional(),
-	sourceKey: string(),
-	cap: string(),
-	fieldPath: string()
-});
-var DeviceLinkLiteralSourceSchema = object({
-	kind: literal("literal"),
-	value: union([
-		string(),
-		number(),
-		boolean(),
-		_null()
-	])
-});
-var DeviceLinkGlobalSourceSchema = object({
-	kind: literal("global"),
-	sourceStableId: string(),
-	cap: string(),
-	fieldPath: string()
-});
-/** Expression source (Stage X): compute the target field from N named bindings
-*  via the safe expression engine. Bindings are field | literal | global — never
-*  another expression (no nesting). The `superRefine` runs the SAME author-time
-*  validation as `validateExpressionSource` (compiles the expr, checks binding
-*  names + identifier coverage) so every wire boundary that parses a DeviceLink
-*  (tRPC mount, kernel create pre-seed, projection output) validates-at-write.
-*  Compiles are LRU-cached, so repeated validation of the same expr is a hit. */
-var DeviceLinkExpressionSourceSchema = object({
-	kind: literal("expression"),
-	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema
-	]))
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
-});
-var DeviceLinkSchema = object({
-	id: string(),
-	source: union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema,
-		DeviceLinkExpressionSourceSchema
-	]),
-	target: object({
-		cap: string(),
-		fieldPath: string(),
-		itemKey: string().optional()
-	}),
-	transform: discriminatedUnion("kind", [
-		object({ kind: literal("identity") }),
-		object({
-			kind: literal("enum-map"),
-			mapping: record(string(), union([
-				string(),
-				number(),
-				boolean()
-			])),
-			fallback: union([
-				string(),
-				number(),
-				boolean()
-			]).optional()
-		}),
-		object({
-			kind: literal("linear"),
-			scale: number(),
-			offset: number(),
-			clamp: tuple([number(), number()]).readonly().optional()
-		})
-	]).optional()
-});
 /** Cap-wire shape of a per-cap display refinement — mirrors
 *  `DeviceCapDisplayOverride` in `device-management.ts`. */
 var DeviceCapDisplayOverrideSchema = object({
@@ -11733,8 +11058,6 @@ var DeviceInfoSchema = object({
 	*  named accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
 	/** Operator-authored per-device display override. See `DeviceMeta.display`. */
 	display: DeviceDisplayOverrideSchema.optional()
 });
@@ -11743,7 +11066,7 @@ var ConfigEntrySchema = object({
 	value: unknown(),
 	description: string().optional()
 });
-var DeviceLinkModeSchema = _enum(["auto", "manual"]);
+var LinkedDevicesModeSchema = _enum(["auto", "manual"]);
 /** One resolved linked device — the compact projection consumers need. */
 var LinkedDeviceSchema = object({
 	deviceId: number(),
@@ -11806,8 +11129,6 @@ var DeviceMetaSchema = object({
 	*  accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
 	/** Semantic role string (`DeviceRole`) — propagated from the spawn pre-seed.
 	*  Optional: only present for accessory children that carry a known role. */
 	role: string().nullable().optional(),
@@ -11900,12 +11221,6 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	deviceLinks: array(DeviceLinkSchema).readonly()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	display: DeviceDisplayOverrideSchema.nullable()
@@ -11987,7 +11302,7 @@ method(object({
 	*  shipping 293 rows to find 12. */
 	isCamera: boolean().optional()
 }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
-	mode: DeviceLinkModeSchema,
+	mode: LinkedDevicesModeSchema,
 	devices: array(LinkedDeviceSchema)
 })), method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)), method(object({ deviceId: number() }), array(ConfigEntrySchema)), method(object({ deviceId: number() }), ConfigUISchemaOutput), method(object({
 	deviceId: number(),
@@ -12020,11 +11335,7 @@ method(object({
 	deviceId: number(),
 	entries: array(object({
 		capName: string(),
-		kind: _enum([
-			"native",
-			"wrapped",
-			"linked"
-		]),
+		kind: _enum(["native", "wrapped"]),
 		providerAddonId: string(),
 		providerNodeId: string(),
 		nativeAddonId: string()
@@ -12033,11 +11344,7 @@ method(object({
 	deviceId: number(),
 	entries: array(object({
 		capName: string(),
-		kind: _enum([
-			"native",
-			"wrapped",
-			"linked"
-		]),
+		kind: _enum(["native", "wrapped"]),
 		providerAddonId: string(),
 		providerNodeId: string(),
 		nativeAddonId: string()
@@ -12850,7 +12157,7 @@ var MotionAnalysisResultSchema = object({
 	frameHeight: number(),
 	analysisMs: number()
 });
-method(object({
+DeviceType.Camera, method(object({
 	deviceId: number(),
 	frame: FrameInputSchema.optional(),
 	frameHandle: FrameHandleSchema.optional()
@@ -15522,6 +14829,18 @@ var OauthIntegrationDescriptorSchema = object({
 	*  redirect_uri that does not start with one of these. Required —
 	*  an empty list means the integration can never complete linking. */
 	allowedRedirectPrefixes: array(string()).min(1),
+	/** Paths accepted as a `redirect_uri` when the host is PRIVATE — loopback,
+	*  RFC1918, CGNAT (100.64/10, Tailscale), link-local, IPv6 ULA, or an
+	*  `.local` / `.internal` / `.ts.net` name. Exists for self-hosted clients
+	*  whose address the hub cannot know in advance (a Home Assistant at
+	*  `http://<lan-ip>:8123/auth/external/callback`). The PATH must match
+	*  exactly; a public host never satisfies this branch, so it is not a
+	*  wildcard prefix by another name. */
+	allowedPrivateHostPaths: array(string()).optional(),
+	/** When true this is a PUBLIC client (source is published, no secret can be
+	*  protected) and PKCE is mandatory: `/authorize` refuses without an S256
+	*  `code_challenge`, `/token` refuses without the matching `code_verifier`. */
+	requiresPkce: boolean().optional(),
 	/** Optional public origin (no trailing slash) that this integration's
 	*  issued codes/tokens should carry as the `hubUrl` claim — typically the
 	*  operator-selected external-access endpoint resolved by the addon. When
@@ -15672,7 +14991,7 @@ var TrackEnvelopeSchema = object({
 * `snapshots[]` references — megabytes across a page of tracks. `slim`
 * keeps every scalar the list surfaces actually render (ids, class(es),
 * label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
-* zonesVisited, bestEventId, envelope) and returns `positions` /
+* zonesVisited, bestEventId, envelope, hasFace) and returns `positions` /
 * `snapshots` as EMPTY arrays — detail views re-fetch the full row via
 * `getTrack`. Mirrors the event-store `projection` convention
 * (`getObjectEvents` et al.).
@@ -15909,6 +15228,24 @@ var TrackSchema = object({
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
 	envelope: TrackEnvelopeSchema.optional(),
+	/**
+	* A face DETECTOR found a face on this track — nothing more. It says the
+	* detail plane produced a `face` detail; it does NOT say the face was
+	* embedded, matched, above `minFacePx`, or that the recognizer was even
+	* enabled. Set once and never cleared.
+	*
+	* **This exists so "face present but not recognised" is expressible.** A
+	* recognised identity lands in `subLabel` (attributed to the face chain via
+	* `subLabelMeta.stepId`), so before this field a track with an unmatched face
+	* and a track with no face at all were byte-identical on the wire and no
+	* surface could tell them apart. The read is `hasFace === true && subLabel
+	* === undefined`.
+	*
+	* **Absent ≠ false.** Every row written before the column existed omits it,
+	* and so does every server that predates the field — a consumer must test
+	* `=== true` and render nothing otherwise, never infer "no face".
+	*/
+	hasFace: boolean().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -18977,6 +18314,10 @@ var SsoBridgeClaimsSchema = object({
 	integrationId: string().optional(),
 	/** JWT ID — unique per issued code; consumed-set enforces single-use. */
 	jti: string().optional(),
+	/** PKCE S256 challenge — set only on `oauth-code` tokens issued to a public
+	*  client. Its PRESENCE is what makes the verifier mandatory at exchange,
+	*  so the requirement travels with the code and not with mutable config. */
+	codeChallenge: string().optional(),
 	/** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
 	*  tokens so the verify path can check the session is not revoked. */
 	sessionId: string().optional()
@@ -19535,6 +18876,10 @@ var videoclipsCapability = {
 	mode: "singleton",
 	kind: "wrapper",
 	defaultActive: true,
+	/** A clip is a window over a camera's footage — the cap is meaningless on a
+	*  sensor, a button or an event emitter, and the `defaultActive` auto-bind
+	*  reads this to decide which devices it may claim. */
+	deviceTypes: [DeviceType.Camera],
 	methods: {
 		listClips: method(object({
 			deviceId: number(),
@@ -21608,7 +20953,29 @@ var FaceInfoSchema = object({
 	recognizedIdentityId: string().optional(),
 	identityName: string().optional(),
 	assigned: boolean(),
+	/**
+	* The crop, inline, base64.
+	*
+	* **Prefer {@link cropUrl}.** At the 500 rows the Faces view asks for this
+	* field alone is ~2.87 MiB, re-sent in full on every operator assign and
+	* every 30 s poll, base64-inflated over the msgpack socket and held in the
+	* query heap. It stays for callers that have not migrated; `includeCrops:
+	* false` turns it off once they have.
+	*/
 	base64: string().optional(),
+	/**
+	* Same crop, as a data-plane URL for `<img src>` — the move the admin
+	* snapshot surfaces made on 2026-08-08.
+	*
+	* Served by the `event-media` plane, which resolves a raw MediaStore key and
+	* is `access: 'authenticated'`: a bare `<img>` carries the `camstack_session`
+	* cookie, so no header plumbing is needed. The bytes then ride the browser's
+	* HTTP cache with an ETag and `immutable`, instead of the WebSocket.
+	*
+	* Absent when the face has no stored crop, or when the addon has no data
+	* plane — callers fall back to {@link base64}.
+	*/
+	cropUrl: string().optional(),
 	/** Design B: the face bbox (pixel space) on the key frame — lets a detail
 	*  view draw the box over the native `keyFrameMediaKey` frame. Absent on
 	*  legacy rows written before design B. */
@@ -21684,7 +21051,23 @@ var faceGalleryCapability = {
 		}),
 		listRecentFaces: method(object({
 			limit: number().int().positive().optional(),
-			filter: FaceFilterEnum.optional()
+			filter: FaceFilterEnum.optional(),
+			/**
+			* Inline the base64 crop on every row. Default `true` — the existing
+			* behaviour, kept so no caller breaks.
+			*
+			* Set `false` once the caller renders {@link FaceInfo.cropUrl}: that
+			* drops ~2.87 MiB per 500-row page to a few KiB of metadata and lets
+			* the browser cache the images.
+			*
+			* **This is an INPUT field, so it does not reach the addon until the
+			* next train.** The hub router validates cap inputs against its own
+			* compiled Zod, which strips a key it does not know — verified today
+			* on the OUTPUT side, where an additive field DOES arrive immediately
+			* (`Track.hasFace`). Until the train ships, sending `false` is
+			* harmless and simply keeps the crops inline.
+			*/
+			includeCrops: boolean().optional()
 		}).optional(), array(FaceInfoSchema).readonly()),
 		getFaceByTrack: method(object({
 			deviceId: number().int(),
@@ -26131,13 +25514,18 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	username: string(),
 	scopes: array(TokenScopeSchema),
 	redirectUri: string(),
-	hubUrl: string()
+	hubUrl: string(),
+	/** PKCE (RFC 7636) S256 challenge. Baked into the signed code; a code
+	*  that carries one can ONLY be exchanged with the matching verifier. */
+	codeChallenge: string().optional()
 }), object({ code: string() }), {
 	kind: "mutation",
 	access: "create"
 }), method(object({
 	code: string(),
-	redirectUri: string()
+	redirectUri: string(),
+	/** PKCE verifier. REQUIRED when the code carries a challenge. */
+	codeVerifier: string().optional()
 }), object({
 	accessToken: string(),
 	refreshToken: string(),
@@ -26616,1013 +26004,1850 @@ var HistoryPointSchema = object({
 * outside-any-zone). Crossing them with `className?` gives the full
 * combinatorial coverage the operator UI requested.
 */
-var zoneAnalyticsCapability = {
-	name: "zone-analytics",
+var zoneAnalyticsCapability = {
+	name: "zone-analytics",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		/** Latest computed occupancy snapshot for this camera. Null when
+		*  the analytics pipeline hasn't seen a frame for this device yet
+		*  (no inference result emitted since boot or since binding was
+		*  activated). */
+		getCurrentSnapshot: method(object({ deviceId: number() }), CameraOccupancySnapshotSchema.nullable()),
+		/** Time-series object count inside one zone. `className` optional —
+		*  omit to count every class in the zone. */
+		getZoneHistory: method(object({
+			deviceId: number(),
+			zoneId: string(),
+			className: string().optional()
+		}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly()),
+		/** Time-series frame-wide object count (everywhere). */
+		getCameraHistory: method(object({
+			deviceId: number(),
+			className: string().optional()
+		}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly()),
+		/** Time-series count of objects outside every zone. */
+		getUnzonedHistory: method(object({
+			deviceId: number(),
+			className: string().optional()
+		}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly())
+	},
+	/**
+	* Runtime-state slice — the latest occupancy snapshot mirrored by
+	* the analytics frame processor on every inference result. Consumers
+	* read via `device.state.zoneAnalytics.value` and stay in sync
+	* automatically; the explicit `getCurrentSnapshot` cap method is
+	* still useful for one-off polls without a subscription.
+	*/
+	runtimeState: CameraOccupancySnapshotSchema
+};
+/**
+* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
+* cap so a single CRUD surface backs every consumer; each stage has
+* its own dev-state mirror slice (`motion-zone-rules`,
+* `detection-zone-rules`, …) so consumer addons subscribe independently.
+*
+* Extend the enum here when a new gating consumer comes online (audio
+* gating, alert filtering, …) — no other surface needs to change.
+*/
+var ZoneRuleStageEnum = _enum([
+	"motion",
+	"detection",
+	"package"
+]);
+/**
+* Zone rules capability — per-camera CRUD over the {@link ZoneRule}
+* arrays that decide how each pipeline stage uses the polygon zones.
+*
+* Hosted by `addon-pipeline-orchestrator` alongside the zones provider
+* so the operator has a single hub-side source of truth for both
+* geometry and behaviour. Per-stage rules are stored under the
+* `zoneRules.<stage>` key in the orchestrator's per-device store and
+* mirrored to the device-state slice `<stage>-zone-rules` on every
+* mutation; consumer addons (analytics, motion-wasm, pipeline-executor)
+* subscribe to that slice and refresh their gating without
+* round-tripping the cap.
+*
+* Sets are bulk-replace — the operator UI sends the new rule list
+* wholesale, so reordering / batch enable-toggle / drag-drop CRUD lives
+* naturally in the rule editor without per-rule mutation chatter.
+*/
+var zoneRulesCapability = {
+	name: "zone-rules",
 	scope: "device",
 	mode: "singleton",
 	deviceTypes: [DeviceType.Camera],
 	methods: {
-		/** Latest computed occupancy snapshot for this camera. Null when
-		*  the analytics pipeline hasn't seen a frame for this device yet
-		*  (no inference result emitted since boot or since binding was
-		*  activated). */
-		getCurrentSnapshot: method(object({ deviceId: number() }), CameraOccupancySnapshotSchema.nullable()),
-		/** Time-series object count inside one zone. `className` optional —
-		*  omit to count every class in the zone. */
-		getZoneHistory: method(object({
-			deviceId: number(),
-			zoneId: string(),
-			className: string().optional()
-		}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly()),
-		/** Time-series frame-wide object count (everywhere). */
-		getCameraHistory: method(object({
+		/** Read the full rule list for a given stage (empty when no rules
+		*  are defined yet). */
+		listRules: method(object({
 			deviceId: number(),
-			className: string().optional()
-		}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly()),
-		/** Time-series count of objects outside every zone. */
-		getUnzonedHistory: method(object({
+			stage: ZoneRuleStageEnum
+		}), array(ZoneRuleSchema).readonly()),
+		/** Bulk-replace the rule list for one stage. The provider validates
+		*  each entry against {@link ZoneRuleSchema} (zoneIds non-empty,
+		*  thresholds in range) and rejects the whole patch if any entry
+		*  is invalid — partial writes are a configuration footgun. */
+		setRules: method(object({
 			deviceId: number(),
-			className: string().optional()
-		}).extend(HistoryRangeSchema.shape), array(HistoryPointSchema).readonly())
+			stage: ZoneRuleStageEnum,
+			rules: array(ZoneRuleSchema).readonly()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	},
 	/**
-	* Runtime-state slice — the latest occupancy snapshot mirrored by
-	* the analytics frame processor on every inference result. Consumers
-	* read via `device.state.zoneAnalytics.value` and stay in sync
-	* automatically; the explicit `getCurrentSnapshot` cap method is
-	* still useful for one-off polls without a subscription.
+	* Runtime-state slice — every stage mirrored together so consumers
+	* see one reactive handle (`device.state.zoneRules.value`) instead
+	* of one per stage. Bulk-replace mutations on any stage write the full
+	* `{motion, detection, package}` shape, so subscribers always get the
+	* complete current set. Consumers that only care about one stage
+	* just read the matching property.
+	*
+	* `package` backs the package-drop detector — a package zone is a
+	* `ZoneRule` on the `'package'` stage referencing drawn polygons
+	* (see docs/superpowers/specs/2026-07-17-package-zones-design.md §3.1).
+	* The orchestrator provider writes this stage as a first-class slice
+	* (Phase 4): every mutation mirrors the full `{motion, detection,
+	* package}` shape, so consumers read the current package rules directly
+	* off `device.state.zoneRules.value.package`.
 	*/
-	runtimeState: CameraOccupancySnapshotSchema
+	runtimeState: object({
+		motion: array(ZoneRuleSchema).readonly(),
+		detection: array(ZoneRuleSchema).readonly(),
+		package: array(ZoneRuleSchema).readonly()
+	})
+};
+/**
+* Most specific first. Extending this list is how a new device kind becomes
+* gateable; nothing else needs to change.
+*/
+var DEVICE_STATE_READERS = [
+	{
+		cap: "alarm-panel",
+		field: "state"
+	},
+	{
+		cap: "cover",
+		field: "state"
+	},
+	{
+		cap: "presence",
+		field: "state"
+	},
+	{
+		cap: "lock",
+		field: "locked",
+		booleanWords: ["locked", "unlocked"]
+	},
+	{
+		cap: "contact",
+		field: "entryOpen",
+		booleanWords: ["open", "closed"]
+	},
+	{
+		cap: "switch",
+		field: "on",
+		booleanWords: ["on", "off"]
+	},
+	{
+		cap: "binary",
+		field: "on",
+		booleanWords: ["on", "off"]
+	}
+];
+/**
+* Collapse a device's full runtime state to the one string a rule compares
+* against, or `undefined` when nothing in the table applies.
+*
+* `undefined` is the safe answer everywhere: the gate treats it as "does not
+* match", so a device whose kind we cannot read simply never arms a rule.
+*/
+function readDeviceStateFrom(runtimeState) {
+	for (const reader of DEVICE_STATE_READERS) {
+		const slice = runtimeState[reader.cap];
+		if (slice === null || typeof slice !== "object") continue;
+		const value = slice[reader.field];
+		if (typeof value === "string" && value.length > 0) return value;
+		if (typeof value === "boolean" && reader.booleanWords !== void 0) return value ? reader.booleanWords[0] : reader.booleanWords[1];
+	}
+}
+/**
+* Accessory device helpers — shared across drivers.
+*
+* Many vendor-specific drivers register accessory child devices on
+* top of a parent (Reolink: siren / floodlight / PIR / autotrack /
+* chime; ONVIF: relay outputs; future: Tapo Hub child devices). Each
+* driver picks the right `DeviceType` + `DeviceRole` explicitly when
+* spawning, builds a name derived from the parent, and produces a
+* stableId tied to the parent so boot-restore can reconstruct the
+* relationship.
+*
+* Centralised `(kind → DeviceType)` mapping was dropped on purpose:
+* drivers may reasonably disagree on the right type for an accessory
+* (a Reolink PIR exposes a switch on/off + sensitivity, while a hypothetical
+* read-only motion-only sensor might be `DeviceType.Sensor`). Forcing
+* one canonical mapping was over-prescriptive and added a layer of
+* indirection without saving meaningful code at call sites — the
+* driver knows its own hardware best.
+*/
+/**
+* Subset of `DeviceRole` values that drivers register as child
+* accessories of a parent device. Sourced verbatim from `DeviceRole`
+* — `AccessoryKind` is the alias drivers use when building accessory
+* children, so the call site reads as
+* `accessoryStableId(parent, AccessoryKind.Siren)` rather than
+* `accessoryStableId(parent, DeviceRole.Siren)` (which would imply
+* any role works, including non-accessory ones like Doorbell).
+*/
+var AccessoryKind = {
+	Siren: DeviceRole.Siren,
+	Floodlight: DeviceRole.Floodlight,
+	Spotlight: DeviceRole.Spotlight,
+	PirSensor: DeviceRole.PirSensor,
+	Chime: DeviceRole.Chime,
+	Autotrack: DeviceRole.Autotrack,
+	Nightvision: DeviceRole.Nightvision,
+	PrivacyMask: DeviceRole.PrivacyMask
+};
+AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
+var DeviceConfig = class DeviceConfig {
+	schema;
+	data;
+	persistFn;
+	constructor(schema, data, persist) {
+		this.schema = schema;
+		this.data = data;
+		this.persistFn = persist;
+	}
+	/**
+	* Build a `DeviceConfig` from a persisted blob, with automatic
+	* recovery from schema-validation failures. Boot must never be
+	* blocked by stale persisted values: if Zod rejects the blob,
+	* we drop every offending top-level field, retry, and persist
+	* the cleaned blob so the bad value is healed in the DB on next
+	* write. The most common trigger is a tightened range constraint
+	* (e.g. `max(100) → max(50)`) on a field that already has an
+	* out-of-range value persisted from the previous schema. Without
+	* this safety net, the device would fail to instantiate and end
+	* up with no caps registered — exactly the failure mode that
+	* stranded device 15 when `motionSensitivity: 90` no longer fit
+	* the new `1..50` schema.
+	*
+	* Recovery rules:
+	*  1. Try `safeParse(initialData)`. If it succeeds, done.
+	*  2. On failure, walk `error.issues`, collect the top-level path
+	*     of each issue, and drop those keys from `initialData`.
+	*  3. Re-run `safeParse`. If the cleaned blob now passes (Zod
+	*     fills the missing keys with schema defaults / undefined for
+	*     `.optional()`), persist it via `persist()` so the bad
+	*     values disappear from the DB, and return the device.
+	*  4. If the cleaned blob STILL fails (very rare — would require
+	*     a non-recoverable required field), fall back to
+	*     `schema.parse({})` so the device still boots with pure
+	*     schema defaults. Persist nothing in that path so the next
+	*     successful `setAll` still writes a coherent blob.
+	*/
+	static fromSchema(schema, persist, initialData = {}, onRecover) {
+		const first = schema.safeParse(initialData);
+		if (first.success) return new DeviceConfig(schema, first.data, persist);
+		const droppedKeys = /* @__PURE__ */ new Set();
+		for (const issue of first.error.issues) {
+			const top = issue.path[0];
+			if (typeof top === "string") droppedKeys.add(top);
+		}
+		const cleaned = { ...initialData };
+		for (const k of droppedKeys) delete cleaned[k];
+		const second = schema.safeParse(cleaned);
+		onRecover?.({
+			droppedKeys: [...droppedKeys],
+			issues: first.error.issues
+		});
+		if (second.success) {
+			persist(second.data).catch(() => {});
+			return new DeviceConfig(schema, second.data, persist);
+		}
+		return new DeviceConfig(schema, schema.parse({}), persist);
+	}
+	get values() {
+		return this.data;
+	}
+	get(key) {
+		return this.data[key];
+	}
+	async set(key, value) {
+		const next = this.schema.parse({
+			...this.data,
+			[key]: value
+		});
+		this.data = next;
+		await this.persistFn(this.data);
+	}
+	/**
+	* Merge an untyped patch onto the current config and persist. Accepts
+	* `Record<string, unknown>` because the patch typically comes from the
+	* UI form layer (a `ConfigField.key → value` map) where the caller
+	* doesn't hold the Zod schema's static type. Runtime validation is
+	* authoritative: `this.schema.parse` rejects unknown keys or invalid
+	* shapes before touching storage.
+	*/
+	async setAll(partial) {
+		const next = this.schema.parse({
+			...this.data,
+			...partial
+		});
+		this.data = next;
+		await this.persistFn(this.data);
+	}
+	async deleteKey(key) {
+		const { [key]: _, ...rest } = this.data;
+		const next = this.schema.parse(rest);
+		this.data = next;
+		await this.persistFn(this.data);
+	}
+	entries() {
+		const shape = this.schema.shape;
+		return Object.entries(shape).map(([key, fieldSchema]) => ({
+			key,
+			schema: fieldSchema,
+			value: this.data[key],
+			description: fieldSchema.description
+		}));
+	}
 };
 /**
-* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
-* cap so a single CRUD surface backs every consumer; each stage has
-* its own dev-state mirror slice (`motion-zone-rules`,
-* `detection-zone-rules`, …) so consumer addons subscribe independently.
-*
-* Extend the enum here when a new gating consumer comes online (audio
-* gating, alert filtering, …) — no other surface needs to change.
-*/
-var ZoneRuleStageEnum = _enum([
-	"motion",
-	"detection",
-	"package"
-]);
-/**
-* Zone rules capability — per-camera CRUD over the {@link ZoneRule}
-* arrays that decide how each pipeline stage uses the polygon zones.
+* Concrete implementation. Routes every successful write through
+* `writer(capName, slice)` — the kernel hooks this up to
+* `device-state.setCapSlice`, the canonical cross-layer write
+* entrypoint, which handles disk persistence (debounced on the hub)
+* and mirror updates.
 *
-* Hosted by `addon-pipeline-orchestrator` alongside the zones provider
-* so the operator has a single hub-side source of truth for both
-* geometry and behaviour. Per-stage rules are stored under the
-* `zoneRules.<stage>` key in the orchestrator's per-device store and
-* mirrored to the device-state slice `<stage>-zone-rules` on every
-* mutation; consumer addons (analytics, motion-wasm, pipeline-executor)
-* subscribe to that slice and refresh their gating without
-* round-tripping the cap.
+* Schema validation runs in-process before the writer is called —
+* the round-trip should never carry an invalid slice. `flush()`
+* awaits any in-flight writer promises so shutdown is lossless.
 *
-* Sets are bulk-replace — the operator UI sends the new rule list
-* wholesale, so reordering / batch enable-toggle / drag-drop CRUD lives
-* naturally in the rule editor without per-rule mutation chatter.
+* `initial` is the persisted blob loaded at boot. Slices for caps
+* whose schema hasn't been installed yet are kept in-memory verbatim
+* and validated when the cap registers later.
 */
-var zoneRulesCapability = {
-	name: "zone-rules",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	methods: {
-		/** Read the full rule list for a given stage (empty when no rules
-		*  are defined yet). */
-		listRules: method(object({
-			deviceId: number(),
-			stage: ZoneRuleStageEnum
-		}), array(ZoneRuleSchema).readonly()),
-		/** Bulk-replace the rule list for one stage. The provider validates
-		*  each entry against {@link ZoneRuleSchema} (zoneIds non-empty,
-		*  thresholds in range) and rejects the whole patch if any entry
-		*  is invalid — partial writes are a configuration footgun. */
-		setRules: method(object({
-			deviceId: number(),
-			stage: ZoneRuleStageEnum,
-			rules: array(ZoneRuleSchema).readonly()
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
-	},
+var DeviceRuntimeState = class DeviceRuntimeState {
+	writer;
+	/** In-flight writer promises tracked so `flush()` can await them. */
+	pendingWrites = /* @__PURE__ */ new Set();
+	/** Per-cap committed slice — after schema validation when known. */
+	slices;
+	/** Per-cap registered schema (set by `installCapSchema`). */
+	schemas = /* @__PURE__ */ new Map();
+	listeners = /* @__PURE__ */ new Set();
+	capListeners = /* @__PURE__ */ new Map();
+	constructor(initial, writer) {
+		this.writer = writer;
+		this.slices = /* @__PURE__ */ new Map();
+		for (const [k, v] of Object.entries(initial)) if (v && typeof v === "object" && !Array.isArray(v)) this.slices.set(k, { ...v });
+	}
+	static fromInitial(initial, writer) {
+		return new DeviceRuntimeState(initial, writer);
+	}
+	installCapSchema(capName, schema) {
+		const existing = this.schemas.get(capName);
+		if (existing) {
+			if (existing !== schema) throw new Error(`[DeviceRuntimeState] capability "${capName}" registered a different runtime-state schema; each cap must declare ONE shape across every provider`);
+			return;
+		}
+		this.schemas.set(capName, schema);
+		const stored = this.slices.get(capName);
+		if (stored) {
+			const result = schema.safeParse(stored);
+			if (result.success) this.slices.set(capName, result.data);
+			else this.slices.delete(capName);
+		}
+	}
+	getCapState(capName) {
+		const slice = this.slices.get(capName);
+		if (!slice) return void 0;
+		return Object.freeze({ ...slice });
+	}
+	getCapField(capName, key) {
+		return this.slices.get(capName)?.[key];
+	}
+	setCapState(capName, value) {
+		this.applyCapWrite(capName, value, false);
+	}
+	patchCapState(capName, partial) {
+		this.applyCapWrite(capName, partial, true);
+	}
 	/**
-	* Runtime-state slice — every stage mirrored together so consumers
-	* see one reactive handle (`device.state.zoneRules.value`) instead
-	* of one per stage. Bulk-replace mutations on any stage write the full
-	* `{motion, detection, package}` shape, so subscribers always get the
-	* complete current set. Consumers that only care about one stage
-	* just read the matching property.
-	*
-	* `package` backs the package-drop detector — a package zone is a
-	* `ZoneRule` on the `'package'` stage referencing drawn polygons
-	* (see docs/superpowers/specs/2026-07-17-package-zones-design.md §3.1).
-	* The orchestrator provider writes this stage as a first-class slice
-	* (Phase 4): every mutation mirrors the full `{motion, detection,
-	* package}` shape, so consumers read the current package rules directly
-	* off `device.state.zoneRules.value.package`.
+	* Internal worker. `merge` controls whether `value` replaces or
+	* shallow-merges into the existing slice. Schema validation runs
+	* on the FINAL composed object regardless.
 	*/
-	runtimeState: object({
-		motion: array(ZoneRuleSchema).readonly(),
-		detection: array(ZoneRuleSchema).readonly(),
-		package: array(ZoneRuleSchema).readonly()
-	})
-};
-/**
-* Most specific first. Extending this list is how a new device kind becomes
-* gateable; nothing else needs to change.
-*/
-var DEVICE_STATE_READERS = [
-	{
-		cap: "alarm-panel",
-		field: "state"
-	},
-	{
-		cap: "cover",
-		field: "state"
-	},
-	{
-		cap: "presence",
-		field: "state"
-	},
-	{
-		cap: "lock",
-		field: "locked",
-		booleanWords: ["locked", "unlocked"]
-	},
-	{
-		cap: "contact",
-		field: "entryOpen",
-		booleanWords: ["open", "closed"]
-	},
-	{
-		cap: "switch",
-		field: "on",
-		booleanWords: ["on", "off"]
-	},
-	{
-		cap: "binary",
-		field: "on",
-		booleanWords: ["on", "off"]
+	applyCapWrite(capName, value, merge) {
+		const schema = this.schemas.get(capName);
+		if (!schema) throw new Error(`[DeviceRuntimeState] no schema registered for cap "${capName}" — did the device register it via ctx.registerNativeCap before writing?`);
+		const current = this.slices.get(capName) ?? {};
+		const next = merge ? {
+			...current,
+			...value
+		} : { ...value };
+		const parsed = schema.parse(next);
+		if (shallowEqual(current, parsed)) return;
+		this.slices.set(capName, parsed);
+		this.fireListeners([capName]);
+		const writePromise = this.writer(capName, { ...parsed }).catch(() => {});
+		this.pendingWrites.add(writePromise);
+		writePromise.finally(() => {
+			this.pendingWrites.delete(writePromise);
+		});
 	}
-];
-/**
-* Collapse a device's full runtime state to the one string a rule compares
-* against, or `undefined` when nothing in the table applies.
-*
-* `undefined` is the safe answer everywhere: the gate treats it as "does not
-* match", so a device whose kind we cannot read simply never arms a rule.
-*/
-function readDeviceStateFrom(runtimeState) {
-	for (const reader of DEVICE_STATE_READERS) {
-		const slice = runtimeState[reader.cap];
-		if (slice === null || typeof slice !== "object") continue;
-		const value = slice[reader.field];
-		if (typeof value === "string" && value.length > 0) return value;
-		if (typeof value === "boolean" && reader.booleanWords !== void 0) return value ? reader.booleanWords[0] : reader.booleanWords[1];
+	fireListeners(changed) {
+		const snap = this.snapshot();
+		for (const cb of this.listeners) try {
+			cb(changed, snap);
+		} catch {}
+		for (const capName of changed) {
+			const subs = this.capListeners.get(capName);
+			if (!subs) continue;
+			const slice = this.getCapState(capName);
+			for (const cb of subs) try {
+				cb(slice);
+			} catch {}
+		}
+	}
+	subscribe(cb) {
+		this.listeners.add(cb);
+		return () => {
+			this.listeners.delete(cb);
+		};
+	}
+	subscribeCap(capName, cb) {
+		let subs = this.capListeners.get(capName);
+		if (!subs) {
+			subs = /* @__PURE__ */ new Set();
+			this.capListeners.set(capName, subs);
+		}
+		const adapter = (slice) => {
+			cb(slice);
+		};
+		subs.add(adapter);
+		return () => {
+			const set = this.capListeners.get(capName);
+			if (!set) return;
+			set.delete(adapter);
+			if (set.size === 0) this.capListeners.delete(capName);
+		};
+	}
+	snapshot() {
+		const out = {};
+		for (const [k, v] of this.slices) out[k] = Object.freeze({ ...v });
+		return Object.freeze(out);
 	}
+	async flush() {
+		if (this.pendingWrites.size === 0) return;
+		const inflight = [...this.pendingWrites];
+		await Promise.allSettled(inflight);
+	}
+};
+function shallowEqual(a, b) {
+	const ak = Object.keys(a);
+	const bk = Object.keys(b);
+	if (ak.length !== bk.length) return false;
+	for (const k of ak) if (a[k] !== b[k]) return false;
+	return true;
 }
 /**
-* Accessory device helpers — shared across drivers.
-*
-* Many vendor-specific drivers register accessory child devices on
-* top of a parent (Reolink: siren / floodlight / PIR / autotrack /
-* chime; ONVIF: relay outputs; future: Tapo Hub child devices). Each
-* driver picks the right `DeviceType` + `DeviceRole` explicitly when
-* spawning, builds a name derived from the parent, and produces a
-* stableId tied to the parent so boot-restore can reconstruct the
-* relationship.
-*
-* Centralised `(kind → DeviceType)` mapping was dropped on purpose:
-* drivers may reasonably disagree on the right type for an accessory
-* (a Reolink PIR exposes a switch on/off + sensitivity, while a hypothetical
-* read-only motion-only sensor might be `DeviceType.Sensor`). Forcing
-* one canonical mapping was over-prescriptive and added a layer of
-* indirection without saving meaningful code at call sites — the
-* driver knows its own hardware best.
-*/
-/**
-* Subset of `DeviceRole` values that drivers register as child
-* accessories of a parent device. Sourced verbatim from `DeviceRole`
-* — `AccessoryKind` is the alias drivers use when building accessory
-* children, so the call site reads as
-* `accessoryStableId(parent, AccessoryKind.Siren)` rather than
-* `accessoryStableId(parent, DeviceRole.Siren)` (which would imply
-* any role works, including non-accessory ones like Doorbell).
+* Runtime registry: cap-property-name → cap definition. `BaseDevice`'s
+* `state` getter looks up the cap definition here to construct a
+* `sliceProxy()` lazily on first access. Generated alongside the type
+* so type and runtime registry can never drift apart.
 */
-var AccessoryKind = {
-	Siren: DeviceRole.Siren,
-	Floodlight: DeviceRole.Floodlight,
-	Spotlight: DeviceRole.Spotlight,
-	PirSensor: DeviceRole.PirSensor,
-	Chime: DeviceRole.Chime,
-	Autotrack: DeviceRole.Autotrack,
-	Nightvision: DeviceRole.Nightvision,
-	PrivacyMask: DeviceRole.PrivacyMask
+var DEVICE_LOCAL_STATE_CAPS = {
+	airQualitySensor: airQualitySensorCapability,
+	alarmPanel: alarmPanelCapability,
+	ambientLightSensor: ambientLightSensorCapability,
+	audioMetrics: audioMetricsCapability,
+	automationControl: automationControlCapability,
+	battery: batteryCapability,
+	binary: binaryCapability,
+	brightness: brightnessCapability,
+	cameraStreams: cameraStreamsCapability,
+	carbonMonoxide: carbonMonoxideCapability,
+	climateControl: climateControlCapability,
+	color: colorCapability,
+	connectivity: connectivityCapability,
+	consumables: consumablesCapability,
+	contact: contactCapability,
+	control: controlCapability,
+	cover: coverCapability,
+	dayNight: dayNightCapability,
+	deviceDiscovery: deviceDiscoveryCapability,
+	deviceStatus: deviceStatusCapability,
+	doorbell: doorbellCapability,
+	enumSensor: enumSensorCapability,
+	eventEmitter: eventEmitterCapability,
+	fanControl: fanControlCapability,
+	featureProbe: featureProbeCapability,
+	flood: floodCapability,
+	gas: gasCapability,
+	humidifier: humidifierCapability,
+	humiditySensor: humiditySensorCapability,
+	image: imageCapability,
+	imageSettings: imageSettingsCapability,
+	lawnMowerControl: lawnMowerControlCapability,
+	lockControl: lockControlCapability,
+	mediaPlayer: mediaPlayerCapability,
+	motion: motionCapability,
+	motionTrigger: motionTriggerCapability,
+	motionZones: motionZonesCapability,
+	nativeObjectDetection: nativeObjectDetectionCapability,
+	notifier: notifierCapability,
+	numericSensor: numericSensorCapability,
+	petFeeder: petFeederCapability,
+	powerMeter: powerMeterCapability,
+	presence: presenceCapability,
+	pressureSensor: pressureSensorCapability,
+	privacyMask: privacyMaskCapability,
+	ptzAutotrack: ptzAutotrackCapability,
+	sceneMonitor: sceneMonitorCapability,
+	scriptRunner: scriptRunnerCapability,
+	smoke: smokeCapability,
+	streamParams: streamParamsCapability,
+	switch: switchCapability,
+	tamper: tamperCapability,
+	temperatureSensor: temperatureSensorCapability,
+	update: updateCapability,
+	vacuumControl: vacuumControlCapability,
+	valve: valveCapability,
+	vibration: vibrationCapability,
+	waterHeater: waterHeaterCapability,
+	weather: weatherCapability,
+	zoneAnalytics: zoneAnalyticsCapability,
+	zoneRules: zoneRulesCapability,
+	zones: zonesCapability
 };
-AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
-var DeviceConfig = class DeviceConfig {
-	schema;
-	data;
-	persistFn;
-	constructor(schema, data, persist) {
-		this.schema = schema;
-		this.data = data;
-		this.persistFn = persist;
+var BaseDevice = class {
+	id;
+	stableId;
+	type;
+	name;
+	parentDeviceId;
+	role;
+	/**
+	* Cap-keyed runtime-state slice is the single source of truth for
+	* `online`. Both getter and setter proxy to the slice — drivers can
+	* write `this.online = true` ergonomically, and the cap event fires
+	* automatically through the runtime-state writer. `markOnline()` is
+	* kept as the explicit method form mandated by `IDevice`.
+	*/
+	get online() {
+		return this.runtimeState.getCapState("device-status")?.online ?? false;
+	}
+	set online(value) {
+		this.markOnline(value);
 	}
 	/**
-	* Build a `DeviceConfig` from a persisted blob, with automatic
-	* recovery from schema-validation failures. Boot must never be
-	* blocked by stale persisted values: if Zod rejects the blob,
-	* we drop every offending top-level field, retry, and persist
-	* the cleaned blob so the bad value is healed in the DB on next
-	* write. The most common trigger is a tightened range constraint
-	* (e.g. `max(100) → max(50)`) on a field that already has an
-	* out-of-range value persisted from the previous schema. Without
-	* this safety net, the device would fail to instantiate and end
-	* up with no caps registered — exactly the failure mode that
-	* stranded device 15 when `motionSensitivity: 90` no longer fit
-	* the new `1..50` schema.
+	* Generic per-cap runtime-state namespace. One entry per cap with
+	* `runtimeState:` declared, auto-generated by codegen — see
+	* `device-local-state.ts`. Drivers access via:
 	*
-	* Recovery rules:
-	*  1. Try `safeParse(initialData)`. If it succeeds, done.
-	*  2. On failure, walk `error.issues`, collect the top-level path
-	*     of each issue, and drop those keys from `initialData`.
-	*  3. Re-run `safeParse`. If the cleaned blob now passes (Zod
-	*     fills the missing keys with schema defaults / undefined for
-	*     `.optional()`), persist it via `persist()` so the bad
-	*     values disappear from the DB, and return the device.
-	*  4. If the cleaned blob STILL fails (very rare — would require
-	*     a non-recoverable required field), fall back to
-	*     `schema.parse({})` so the device still boots with pure
-	*     schema defaults. Persist nothing in that path so the next
-	*     successful `setAll` still writes a coherent blob.
+	*   `this.state.battery.sleeping = true`        // patches the battery slice
+	*   `const pct = this.state.battery.percentage` // reads the battery slice
+	*   `this.state.deviceStatus.online = true`     // mirrors `markOnline(true)`
+	*
+	* Adding a new cap with `runtimeState:` automatically extends this
+	* namespace — drivers don't have to declare proxies. Reads return
+	* `undefined` when the slice hasn't been seeded; writes patch via
+	* `runtimeState.patchCapState` and validate against the cap's schema
+	* (so partial writes need the slice to be seeded with the required
+	* fields first — drivers do this on cap registration).
+	*
+	* For caps not exposed in `DeviceLocalState`, drivers can build their
+	* own typed proxy via `this.sliceProxy(cap)`.
 	*/
-	static fromSchema(schema, persist, initialData = {}, onRecover) {
-		const first = schema.safeParse(initialData);
-		if (first.success) return new DeviceConfig(schema, first.data, persist);
-		const droppedKeys = /* @__PURE__ */ new Set();
-		for (const issue of first.error.issues) {
-			const top = issue.path[0];
-			if (typeof top === "string") droppedKeys.add(top);
+	get state() {
+		if (!this._stateProxyCache) {
+			const cache = {};
+			const handler = { get: (_target, key) => {
+				const k = key;
+				if (k in cache) return cache[k];
+				const cap = DEVICE_LOCAL_STATE_CAPS[k];
+				if (!cap) return void 0;
+				const proxy = this.sliceProxy(cap);
+				cache[k] = proxy;
+				return proxy;
+			} };
+			this._stateProxyCache = new Proxy(cache, handler);
 		}
-		const cleaned = { ...initialData };
-		for (const k of droppedKeys) delete cleaned[k];
-		const second = schema.safeParse(cleaned);
-		onRecover?.({
-			droppedKeys: [...droppedKeys],
-			issues: first.error.issues
+		return this._stateProxyCache;
+	}
+	_stateProxyCache;
+	config;
+	/**
+	* Per-device runtime state, cap-keyed. Always installed — slices
+	* for individual caps materialise as those caps register their
+	* native providers (`ctx.registerNativeCap`). The cap's own
+	* `runtimeState` schema is the source of truth for the slice
+	* shape; drivers don't redeclare it, they just write through.
+	*
+	* Read: `this.runtimeState.getCapState('battery')` →
+	*   `{percentage, charging, sleeping, lastUpdated}` for any
+	*   provider that registers `batteryCapability`.
+	* Write: `this.runtimeState.setCapState('battery', { … })`.
+	*
+	* Cross-process consumers reach this state through the
+	* `deviceState` cap router (or via cap-specific events the driver
+	* emits — e.g. `battery.onStatusChanged`). The local handle is
+	* accessed in-process by the driver to avoid roundtrips.
+	*/
+	runtimeState;
+	ctx;
+	/**
+	* Operator-organisational location label (room / area / zone).
+	* Read from `ctx.deviceMeta.location`; mutated via
+	* `kernel.devices.setLocation(id, value)`. Free-text — providers
+	* don't interpret it; the UI groups devices by this for filters
+	* like "show me all cameras in Kitchen". `null` when unset.
+	*/
+	location;
+	/**
+	* Soft-disabled flag. When `true`, the device class is still
+	* instantiated and visible in the UI (so the operator can flip
+	* back on without re-adding) but lifecycle hooks (publishToBroker,
+	* alarm-stream subscribe, …) MUST be gated by the driver to skip
+	* work. The `BaseDevice` enforces this by exposing the flag here;
+	* it does NOT mutate cap behaviour automatically — drivers consult
+	* `this.disabled` at the top of their lifecycle methods. Read from
+	* `ctx.deviceMeta.disabled`; mutated via
+	* `kernel.devices.setDisabled(id, value)`.
+	*/
+	disabled;
+	/**
+	* Cached materialised `SourceInfo` — either the value persisted under
+	* `metadata.sourceInfo` at construction time, or a synthetic
+	* `{ id: stableId, system: addonId }` for providers that haven't
+	* migrated yet. Lazily populated on first `sourceInfo` read so the
+	* cost of Zod-parsing the meta blob is paid once per device boot.
+	* Invalidated by `updateSourceInfo()` so providers see the new value
+	* back through the getter without a re-fetch from the meta surface.
+	*/
+	_sourceInfoCache = null;
+	constructor(ctx, schema, options) {
+		this.ctx = ctx;
+		this.id = ctx.id;
+		this.stableId = ctx.stableId;
+		this.type = options.type;
+		if (!ctx.deviceMeta) throw new Error(`BaseDevice constructor: ctx.deviceMeta is required (id=${ctx.id} stableId=${ctx.stableId})`);
+		this.name = ctx.deviceMeta.name;
+		this.location = ctx.deviceMeta.location;
+		this.disabled = ctx.deviceMeta.disabled;
+		this.role = options.role;
+		this.parentDeviceId = ctx.parentDeviceId;
+		const seedData = ctx.persistedConfig ?? {};
+		this.config = DeviceConfig.fromSchema(schema, (data) => ctx.persistConfig(data), seedData, ({ droppedKeys, issues }) => {
+			ctx.logger.warn("Device config recovery: dropping invalid persisted fields", {
+				tags: {
+					deviceId: ctx.id,
+					stableId: ctx.stableId
+				},
+				meta: {
+					droppedKeys: [...droppedKeys],
+					firstIssue: issues[0]?.message ?? null
+				}
+			});
+		});
+		let cachedProxy = null;
+		const writer = async (capName, slice) => {
+			if (!cachedProxy) cachedProxy = ctx.fetchDevice(ctx.id);
+			await (await cachedProxy).deviceState.setCapSlice({
+				capName,
+				slice
+			});
+		};
+		const initial = ctx.initialRuntimeState ?? {};
+		this.runtimeState = DeviceRuntimeState.fromInitial(initial, writer);
+		ctx.bindRuntimeState?.(this.runtimeState);
+		ctx.registerNativeCap?.(deviceStatusCapability, {});
+		const seed = {
+			online: true,
+			lastChangedAt: Date.now()
+		};
+		this.runtimeState.setCapState("device-status", seed);
+		ctx.registerNativeCap?.(featureProbeCapability, {});
+		this.runtimeState.setCapState("feature-probe", {
+			flags: {},
+			deviceType: null,
+			model: null,
+			channelCount: null,
+			lastProbedAt: 0,
+			lastFetchedAt: 0
 		});
-		if (second.success) {
-			persist(second.data).catch(() => {});
-			return new DeviceConfig(schema, second.data, persist);
-		}
-		return new DeviceConfig(schema, schema.parse({}), persist);
 	}
-	get values() {
-		return this.data;
+	deviceActions = /* @__PURE__ */ new Map();
+	/** Declare a device custom action + its typed handler. Idempotent per name. */
+	registerDeviceAction(name, spec, handler) {
+		this.deviceActions.set(name, {
+			spec,
+			handler
+		});
 	}
-	get(key) {
-		return this.data[key];
+	/** Invoke a registered device action. Validates input against the spec. */
+	async runDeviceAction(action, input) {
+		const entry = this.deviceActions.get(action);
+		if (!entry) throw new Error(`unknown device action "${action}" on device ${this.id}`);
+		const parsed = entry.spec.input.parse(input);
+		return entry.handler(parsed);
 	}
-	async set(key, value) {
-		const next = this.schema.parse({
-			...this.data,
-			[key]: value
-		});
-		this.data = next;
-		await this.persistFn(this.data);
+	async removeDevice() {}
+	/**
+	* Set the device's online flag. Called by `BaseDeviceProvider` after
+	* aggregating per-profile stream-broker health, or directly by drivers
+	* that have provider-side liveness signals (e.g. ONVIF heartbeats,
+	* Reolink Baichuan firmware push events). Mirrors the new value into
+	* the `device-status` runtime-state slice so cross-process consumers
+	* pick it up via the standard cap-state channel. Subclasses can
+	* override to gate side effects on the transition.
+	*/
+	markOnline(online) {
+		if (this.online === online) return;
+		const next = {
+			online,
+			lastChangedAt: Date.now()
+		};
+		this.runtimeState.setCapState("device-status", next);
 	}
 	/**
-	* Merge an untyped patch onto the current config and persist. Accepts
-	* `Record<string, unknown>` because the patch typically comes from the
-	* UI form layer (a `ConfigField.key → value` map) where the caller
-	* doesn't hold the Zod schema's static type. Runtime validation is
-	* authoritative: `this.schema.parse` rejects unknown keys or invalid
-	* shapes before touching storage.
+	* Upstream-system identity + rendering envelope for this device. See
+	* `SourceInfo` for the field contract. Always returns a valid object:
+	* if the persisted `metadata.sourceInfo` blob is absent or fails Zod
+	* validation, falls back to a synthetic `{ id: stableId, system: addonId }`
+	* so providers that haven't migrated keep working without code changes.
+	*
+	* The value is cached after the first read. `updateSourceInfo()`
+	* invalidates the cache so subsequent reads see the new patch. The
+	* returned object is frozen to prevent accidental in-place mutation —
+	* use `updateSourceInfo({ patch })` to change fields.
 	*/
-	async setAll(partial) {
-		const next = this.schema.parse({
-			...this.data,
-			...partial
+	get sourceInfo() {
+		if (this._sourceInfoCache) return this._sourceInfoCache;
+		const resolved = extractSourceInfoFromMetadata(this.ctx.deviceMeta.metadata) ?? synthesizeSourceInfo({
+			stableId: this.stableId,
+			addonId: this.ctx.deviceMeta.addonId
 		});
-		this.data = next;
-		await this.persistFn(this.data);
+		this._sourceInfoCache = Object.freeze({ ...resolved });
+		return this._sourceInfoCache;
 	}
-	async deleteKey(key) {
-		const { [key]: _, ...rest } = this.data;
-		const next = this.schema.parse(rest);
-		this.data = next;
-		await this.persistFn(this.data);
+	/**
+	* Convenience accessor for the upstream dispatch key. Equivalent to
+	* `this.sourceInfo.id` — providers use this to keep a
+	* `Map<sourceId, IDevice>` for routing inbound push events.
+	*/
+	get sourceId() {
+		return this.sourceInfo.id;
 	}
-	entries() {
-		const shape = this.schema.shape;
-		return Object.entries(shape).map(([key, fieldSchema]) => ({
-			key,
-			schema: fieldSchema,
-			value: this.data[key],
-			description: fieldSchema.description
+	/**
+	* Patch the device's `SourceInfo`. Shallow-merges `patch` over the
+	* current value, persists the merged result under
+	* `metadata.sourceInfo` via the `device-manager.setMetadata` cap, and
+	* emits `EventCategory.DeviceSourceInfoChanged` for live consumers.
+	*
+	* Safe to call from anywhere in the device's lifetime — the call is
+	* idempotent for `undefined` patch values (ignored) and best-effort
+	* for persistence (a transient device-manager error doesn't unwind
+	* the local cache update, so subsequent reads still see the patch).
+	*
+	* Drivers populate this on adoption + on every metadata change push
+	* from the upstream source. Subscribers (UI, export adapters) react
+	* via the `DeviceSourceInfoChanged` event without polling.
+	*/
+	async updateSourceInfo(patch) {
+		const next = mergeSourceInfo(this.sourceInfo, patch);
+		this._sourceInfoCache = Object.freeze({ ...next });
+		const action = this.ctx.api?.deviceManager?.setMetadata;
+		if (action) try {
+			await action.mutate({
+				deviceId: this.id,
+				patch: { [SOURCE_INFO_METADATA_KEY]: next }
+			});
+		} catch {}
+		this.ctx.eventBus.emit(createEvent("device.source-info-changed", {
+			type: "device",
+			id: this.stableId
+		}, {
+			deviceId: this.id,
+			sourceInfo: next
 		}));
 	}
-};
-/**
-* Concrete implementation. Routes every successful write through
-* `writer(capName, slice)` — the kernel hooks this up to
-* `device-state.setCapSlice`, the canonical cross-layer write
-* entrypoint, which handles disk persistence (debounced on the hub)
-* and mirror updates.
-*
-* Schema validation runs in-process before the writer is called —
-* the round-trip should never carry an invalid slice. `flush()`
-* awaits any in-flight writer promises so shutdown is lossless.
-*
-* `initial` is the persisted blob loaded at boot. Slices for caps
-* whose schema hasn't been installed yet are kept in-memory verbatim
-* and validated when the cap registers later.
-*/
-var DeviceRuntimeState = class DeviceRuntimeState {
-	writer;
-	/** In-flight writer promises tracked so `flush()` can await them. */
-	pendingWrites = /* @__PURE__ */ new Set();
-	/** Per-cap committed slice — after schema validation when known. */
-	slices;
-	/** Per-cap registered schema (set by `installCapSchema`). */
-	schemas = /* @__PURE__ */ new Map();
-	listeners = /* @__PURE__ */ new Set();
-	capListeners = /* @__PURE__ */ new Map();
-	constructor(initial, writer) {
-		this.writer = writer;
-		this.slices = /* @__PURE__ */ new Map();
-		for (const [k, v] of Object.entries(initial)) if (v && typeof v === "object" && !Array.isArray(v)) this.slices.set(k, { ...v });
-	}
-	static fromInitial(initial, writer) {
-		return new DeviceRuntimeState(initial, writer);
-	}
-	installCapSchema(capName, schema) {
-		const existing = this.schemas.get(capName);
-		if (existing) {
-			if (existing !== schema) throw new Error(`[DeviceRuntimeState] capability "${capName}" registered a different runtime-state schema; each cap must declare ONE shape across every provider`);
-			return;
-		}
-		this.schemas.set(capName, schema);
-		const stored = this.slices.get(capName);
-		if (stored) {
-			const result = schema.safeParse(stored);
-			if (result.success) this.slices.set(capName, result.data);
-			else this.slices.delete(capName);
-		}
-	}
-	getCapState(capName) {
-		const slice = this.slices.get(capName);
-		if (!slice) return void 0;
-		return Object.freeze({ ...slice });
-	}
-	getCapField(capName, key) {
-		return this.slices.get(capName)?.[key];
+	/**
+	* Re-publish the device's current `features` array to the persisted
+	* meta blob. Drivers call this after a probe finishes when the live
+	* `features` getter has gained new flags (e.g. `hasIntercom` flips
+	* to true → `DeviceFeature.TwoWayAudio` joins the list).
+	*
+	* Without this, only the construction-time snapshot is written —
+	* `deviceManager.registerDevice` is invoked once per boot, so probe-
+	* driven additions don't reach the persisted index until the next
+	* server restart, and `getDevice` / `listAll` keep returning the
+	* stale list for forked-worker devices (whose live IDevice instance
+	* is invisible to the hub registry).
+	*
+	* Idempotent: re-calling with the same features just no-ops on the
+	* persisted meta. Best-effort: lookup or write failures are logged
+	* at debug and swallowed — the live `device.features` getter is
+	* still authoritative within this process, so callers never block
+	* device boot on a meta refresh.
+	*/
+	async refreshFeatures() {
+		const action = this.ctx.api?.deviceManager?.registerDevice;
+		if (!action) return;
+		try {
+			await action.mutate({
+				addonId: this.ctx.deviceMeta.addonId,
+				stableId: this.stableId,
+				id: this.id,
+				type: this.type,
+				name: this.name,
+				parentDeviceId: this.parentDeviceId,
+				features: [...this.features],
+				config: {}
+			});
+		} catch (err) {}
 	}
-	setCapState(capName, value) {
-		this.applyCapWrite(capName, value, false);
+	/**
+	* Typed read-through to a cap-keyed runtime-state slice. Drivers
+	* call `this.getCapSlice(batteryCapability)` and the return type
+	* is inferred from the cap's `runtimeState` Zod schema — no string
+	* key, no manual generic. Returns `null` when the slice hasn't
+	* been written yet (e.g. driver hasn't seeded battery yet).
+	*/
+	getCapSlice(cap) {
+		return this.runtimeState.getCapState(cap.name) ?? null;
 	}
-	patchCapState(capName, partial) {
-		this.applyCapWrite(capName, partial, true);
+	/**
+	* Typed writer to a cap-keyed runtime-state slice. Routes through
+	* the runtime-state writer (validate → persist → emit cap event).
+	* Equivalent to `this.runtimeState.setCapState(cap.name, value)`
+	* but with the cap's `runtimeState` schema enforcing the value
+	* shape at compile time. Mirrors the symmetry of
+	* `getCapSlice` / `setCapSlice` for cross-cap consistency.
+	*/
+	setCapSlice(cap, value) {
+		this.runtimeState.setCapState(cap.name, value);
 	}
 	/**
-	* Internal worker. `merge` controls whether `value` replaces or
-	* shallow-merges into the existing slice. Schema validation runs
-	* on the FINAL composed object regardless.
+	* Field-level read/write proxy over a cap's runtime-state slice.
+	* Drivers that want ergonomic per-field access declare:
+	*
+	* ```ts
+	* protected battery = this.sliceProxy(batteryCapability)
+	* // …
+	* this.battery.sleeping = true        // patches the slice
+	* const charging = this.battery.charging  // reads the slice
+	* ```
+	*
+	* Reads return `undefined` when the slice hasn't been seeded yet
+	* (cap not registered, or seeded but the field is absent). Writes
+	* route through `runtimeState.patchCapState` so the cap's `runtimeState`
+	* schema validates the merged result and the cap event fires.
+	*
+	* Pattern is generic — same shape works for `battery`, `device-status`,
+	* `motion`, `doorbell`, anything with a `runtimeState:` schema. Drivers
+	* declare one proxy per cap they read/write directly.
 	*/
-	applyCapWrite(capName, value, merge) {
-		const schema = this.schemas.get(capName);
-		if (!schema) throw new Error(`[DeviceRuntimeState] no schema registered for cap "${capName}" — did the device register it via ctx.registerNativeCap before writing?`);
-		const current = this.slices.get(capName) ?? {};
-		const next = merge ? {
-			...current,
-			...value
-		} : { ...value };
-		const parsed = schema.parse(next);
-		if (shallowEqual(current, parsed)) return;
-		this.slices.set(capName, parsed);
-		this.fireListeners([capName]);
-		const writePromise = this.writer(capName, { ...parsed }).catch(() => {});
-		this.pendingWrites.add(writePromise);
-		writePromise.finally(() => {
-			this.pendingWrites.delete(writePromise);
+	sliceProxy(cap) {
+		return new Proxy({}, {
+			get: (_, key) => {
+				return this.runtimeState.getCapState(cap.name)?.[key];
+			},
+			set: (_, key, value) => {
+				this.runtimeState.patchCapState(cap.name, { [key]: value });
+				return true;
+			},
+			has: (_, key) => {
+				const slice = this.runtimeState.getCapState(cap.name);
+				return slice ? key in slice : false;
+			},
+			ownKeys: () => {
+				const slice = this.runtimeState.getCapState(cap.name);
+				return slice ? Object.keys(slice) : [];
+			},
+			getOwnPropertyDescriptor: (_, key) => {
+				const slice = this.runtimeState.getCapState(cap.name);
+				if (!slice || !(key in slice)) return void 0;
+				return {
+					configurable: true,
+					enumerable: true,
+					value: slice[key]
+				};
+			}
 		});
 	}
-	fireListeners(changed) {
-		const snap = this.snapshot();
-		for (const cb of this.listeners) try {
-			cb(changed, snap);
-		} catch {}
-		for (const capName of changed) {
-			const subs = this.capListeners.get(capName);
-			if (!subs) continue;
-			const slice = this.getCapState(capName);
-			for (const cb of subs) try {
-				cb(slice);
-			} catch {}
-		}
+	/**
+	* Default empty settings UI. Drivers override this to expose an
+	* editable form in the device-details page. Returning an empty sections
+	* array signals "nothing to contribute" — the aggregator drops the
+	* contribution entirely rather than rendering a blank panel.
+	*/
+	getSettingsUISchema() {
+		return { sections: [] };
 	}
-	subscribe(cb) {
-		this.listeners.add(cb);
-		return () => {
-			this.listeners.delete(cb);
-		};
+	/**
+	* Default write path: forward the flat patch directly to storage.
+	* Drivers that project a UI shape different from storage (e.g. `RtspCamera`
+	* exposing `mainStreamUrl`/`subStreamUrl` over `streams[]`) override this
+	* to reshape before `config.setAll`.
+	*/
+	async applySettingsPatch(patch) {
+		await this.config.setAll(patch);
 	}
-	subscribeCap(capName, cb) {
-		let subs = this.capListeners.get(capName);
-		if (!subs) {
-			subs = /* @__PURE__ */ new Set();
-			this.capListeners.set(capName, subs);
-		}
-		const adapter = (slice) => {
-			cb(slice);
-		};
-		subs.add(adapter);
-		return () => {
-			const set = this.capListeners.get(capName);
-			if (!set) return;
-			set.delete(adapter);
-			if (set.size === 0) this.capListeners.delete(capName);
+	/**
+	* Phase 3 — populate device-scoped state needed by downstream phases
+	* (accessory reconciliation, public `features` array, optional cap
+	* registration). Called ONCE per construction, after register but
+	* before `getAccessoryChildren()`.
+	*
+	* Drivers write the `feature-probe` runtime-state slice via
+	* `this.runtimeState.setCapState('feature-probe', {...})` — flag bag
+	* is open (Reolink writes `hasPtz/hasIntercom`, Hikvision writes
+	* `hasSupplementalLight/hasAlarmIo`, etc).
+	*
+	* Default: nothing to probe → mark the device PROBED (set `lastProbedAt`) so
+	* the kernel treats it as ready immediately. A device that derives its shape
+	* from a spec (a container, or an accessory sensor) rather than from a
+	* hardware probe has no probe to "complete"; without stamping `lastProbedAt`
+	* it would look perpetually un-probed — logging "Initial probe did not
+	* complete" on every boot and spinning a pointless retry chain. Drivers that
+	* DO probe override this and write their own `feature-probe` slice (including
+	* `lastProbedAt`) once their probe actually succeeds.
+	*/
+	async onProbe() {
+		const base = this.runtimeState.getCapState("feature-probe") ?? {
+			flags: {},
+			deviceType: null,
+			model: null,
+			channelCount: null,
+			lastProbedAt: 0,
+			lastFetchedAt: 0
 		};
+		this.runtimeState.setCapState("feature-probe", {
+			...base,
+			lastProbedAt: Date.now()
+		});
 	}
-	snapshot() {
-		const out = {};
-		for (const [k, v] of this.slices) out[k] = Object.freeze({ ...v });
-		return Object.freeze(out);
+	/**
+	* Phase 5 — fired after the device + its accessories are registered.
+	* Drivers publish streams to the broker, kick off background tasks,
+	* or subscribe to lib events that need a fully-registered device id.
+	*
+	* Default: no-op.
+	*
+	* RENAMED FROM `onCreated` (which still exists for back-compat in this
+	* pass). The new name reflects the post-probe, post-accessory contract.
+	*/
+	async onActivate() {}
+	/**
+	* Re-run the probe + reconcile accessories + refresh features meta.
+	* Drivers call this when device-side state changes (battery cam wakes,
+	* firmware update, manual operator trigger).
+	*
+	* The kernel injects `_kernelReprobe` on registration so this method
+	* delegates to the same orchestrator that runs the boot-time phase
+	* 3 + 4 sequence. Drivers should NOT override this — they override
+	* `onProbe()` instead.
+	*/
+	async reprobe() {
+		if (this._kernelReprobe) await this._kernelReprobe();
+		else await this.onProbe();
 	}
-	async flush() {
-		if (this.pendingWrites.size === 0) return;
-		const inflight = [...this.pendingWrites];
-		await Promise.allSettled(inflight);
+	/**
+	* Kernel-injected callback that runs the full post-probe orchestration
+	* (onProbe → registerDevice meta refresh → accessory reconciliation).
+	* Set by `device-cap-proxy.register()`. Drivers should not touch this
+	* directly — call `reprobe()` instead.
+	*/
+	_kernelReprobe;
+	/**
+	* Declare accessory child devices the kernel should auto-spawn
+	* after `onProbe()` resolves. Each spec fully describes one child
+	* — stableId suffix (deterministic per kind for restore-safety),
+	* meta (type / name / location), config (initial blob the child
+	* self-hydrates), and a factory that constructs the concrete
+	* class with whatever closure-captured refs it needs (typically
+	* `this` for the parent reference).
+	*
+	* The kernel handles the rest: allocateDeviceId, persistInitialConfig
+	* (skipped on restore when the row already exists),
+	* persistInitialMeta, createContext, factory invocation, register,
+	* and recursive lifecycle (probe + accessories + activate).
+	*
+	* Implementations should derive children from
+	* `this.runtimeState.getCapState('feature-probe')` (post-probe truth).
+	* Drivers can use the `getProbeFlags()` helper to read the flag bag
+	* with a typed cast.
+	*
+	* Default: no children.
+	*/
+	getAccessoryChildren() {
+		return [];
 	}
-};
-function shallowEqual(a, b) {
-	const ak = Object.keys(a);
-	const bk = Object.keys(b);
-	if (ak.length !== bk.length) return false;
-	for (const k of ak) if (a[k] !== b[k]) return false;
-	return true;
+	/**
+	* Read the current feature-probe flag bag with a typed cast. Helper
+	* for `getAccessoryChildren()` and `features` getters that derive
+	* outputs from the probe results.
+	*/
+	getProbeFlags() {
+		return this.runtimeState.getCapState("feature-probe")?.flags ?? {};
+	}
+	/**
+	* Returns true once `onProbe` has completed at least once
+	* (`lastProbedAt > 0`). Drivers gate `getAccessoryChildren()` on this
+	* to avoid spawning stale accessories on a fresh device whose probe
+	* hasn't landed yet.
+	*/
+	hasProbed() {
+		return (this.runtimeState.getCapState("feature-probe")?.lastProbedAt ?? 0) > 0;
+	}
+};
+/** Marker written to a declared integration's `info`. */
+var DECLARED_INTEGRATION_FIXED_KEY = "fixed";
+/**
+* Strip the `<node>/<addon>` suffix a forked child carries.
+*
+* Comparing `ctx.kernel.localNodeId` raw skipped EVERY node — including the one
+* that was supposed to act — because on the hub it reads `hub/<addon>`.
+*/
+function declarationOwnerNodeId(localNodeId) {
+	const raw = localNodeId ?? "hub";
+	if (!raw.includes("/")) return raw;
+	return raw.split("/")[0] ?? "hub";
 }
 /**
-* Runtime registry: cap-property-name → cap definition. `BaseDevice`'s
-* `state` getter looks up the cap definition here to construct a
-* `sliceProxy()` lazily on first access. Generated alongside the type
-* so type and runtime registry can never drift apart.
+* The one way an addon owns a device it declares.
+*
+* Construct once with the addon's ports, then call {@link reconcile} on boot and
+* on every convergence tick. There is no second get-or-create helper — a guard
+* in `scripts/` enforces that.
 */
-var DEVICE_LOCAL_STATE_CAPS = {
-	airQualitySensor: airQualitySensorCapability,
-	alarmPanel: alarmPanelCapability,
-	ambientLightSensor: ambientLightSensorCapability,
-	audioMetrics: audioMetricsCapability,
-	automationControl: automationControlCapability,
-	battery: batteryCapability,
-	binary: binaryCapability,
-	brightness: brightnessCapability,
-	cameraStreams: cameraStreamsCapability,
-	carbonMonoxide: carbonMonoxideCapability,
-	climateControl: climateControlCapability,
-	color: colorCapability,
-	connectivity: connectivityCapability,
-	consumables: consumablesCapability,
-	contact: contactCapability,
-	control: controlCapability,
-	cover: coverCapability,
-	dayNight: dayNightCapability,
-	deviceDiscovery: deviceDiscoveryCapability,
-	deviceStatus: deviceStatusCapability,
-	doorbell: doorbellCapability,
-	enumSensor: enumSensorCapability,
-	eventEmitter: eventEmitterCapability,
-	fanControl: fanControlCapability,
-	featureProbe: featureProbeCapability,
-	flood: floodCapability,
-	gas: gasCapability,
-	humidifier: humidifierCapability,
-	humiditySensor: humiditySensorCapability,
-	image: imageCapability,
-	imageSettings: imageSettingsCapability,
-	lawnMowerControl: lawnMowerControlCapability,
-	lockControl: lockControlCapability,
-	mediaPlayer: mediaPlayerCapability,
-	motion: motionCapability,
-	motionTrigger: motionTriggerCapability,
-	motionZones: motionZonesCapability,
-	nativeObjectDetection: nativeObjectDetectionCapability,
-	notifier: notifierCapability,
-	numericSensor: numericSensorCapability,
-	petFeeder: petFeederCapability,
-	powerMeter: powerMeterCapability,
-	presence: presenceCapability,
-	pressureSensor: pressureSensorCapability,
-	privacyMask: privacyMaskCapability,
-	ptzAutotrack: ptzAutotrackCapability,
-	sceneMonitor: sceneMonitorCapability,
-	scriptRunner: scriptRunnerCapability,
-	smoke: smokeCapability,
-	streamParams: streamParamsCapability,
-	switch: switchCapability,
-	tamper: tamperCapability,
-	temperatureSensor: temperatureSensorCapability,
-	update: updateCapability,
-	vacuumControl: vacuumControlCapability,
-	valve: valveCapability,
-	vibration: vibrationCapability,
-	waterHeater: waterHeaterCapability,
-	weather: weatherCapability,
-	zoneAnalytics: zoneAnalyticsCapability,
-	zoneRules: zoneRulesCapability,
-	zones: zonesCapability
-};
-var BaseDevice = class {
-	id;
-	stableId;
-	type;
-	name;
-	parentDeviceId;
-	role;
+var DeclaredDevices = class {
+	ports;
+	constructor(ports) {
+		this.ports = ports;
+	}
 	/**
-	* Cap-keyed runtime-state slice is the single source of truth for
-	* `online`. Both getter and setter proxy to the slice — drivers can
-	* write `this.online = true` ergonomically, and the cap event fires
-	* automatically through the runtime-state writer. `markOnline()` is
-	* kept as the explicit method form mandated by `IDevice`.
-	*/
-	get online() {
-		return this.runtimeState.getCapState("device-status")?.online ?? false;
+	* Converge the declared set. Idempotent, and safe to call repeatedly.
+	*
+	* Throws only what the ports throw on the FIRST index read; every other
+	* failure is per-device and logged, so one bad declaration never takes the
+	* others down.
+	*/
+	async reconcile(spec) {
+		if ((spec.placement ?? "hub") === "hub") {
+			const nodeId = declarationOwnerNodeId(this.ports.localNodeId);
+			if (nodeId !== "hub") {
+				this.ports.logger.info("declared devices are hub-owned — skipping on this node", { meta: {
+					nodeId,
+					rawNodeId: this.ports.localNodeId ?? null
+				} });
+				return {
+					integrationId: null,
+					devices: [],
+					removed: [],
+					owned: false
+				};
+			}
+		}
+		const integrationId = await this.ensureIntegration(spec.integrationName);
+		const index = await this.readIndex();
+		const outcomes = [];
+		for (const declaration of spec.devices) {
+			const outcome = await this.applyDeclaration(declaration, integrationId, index);
+			if (outcome !== null) outcomes.push(outcome);
+		}
+		return {
+			integrationId,
+			devices: outcomes,
+			removed: await this.sweepWithdrawn(spec.devices, integrationId, index),
+			owned: true
+		};
 	}
-	set online(value) {
-		this.markOnline(value);
+	/**
+	* Get-or-create the FIXED integration, and RE-ASSERT the flag every pass.
+	*
+	* The re-assertion is the fix for the defect the hand-rolled version shipped
+	* with: writing `info.fixed` only on the create path left every pre-existing
+	* install without it, and the kernel kept offering to delete an integration
+	* the addon owns.
+	*/
+	async ensureIntegration(integrationName) {
+		const existing = await this.ports.getIntegration(this.ports.addonId);
+		if (existing === null) {
+			const created = await this.ports.createIntegration({
+				addonId: this.ports.addonId,
+				name: integrationName,
+				info: { [DECLARED_INTEGRATION_FIXED_KEY]: true }
+			});
+			this.ports.logger.info("declared a fixed integration", { meta: {
+				integrationId: created.id,
+				name: integrationName
+			} });
+			return created.id;
+		}
+		if (existing.info?.["fixed"] !== true) {
+			await this.ports.updateIntegration({
+				id: existing.id,
+				info: { [DECLARED_INTEGRATION_FIXED_KEY]: true }
+			});
+			this.ports.logger.info("re-asserted `fixed` on a declared integration", { meta: { integrationId: existing.id } });
+		}
+		return existing.id;
+	}
+	async readIndex() {
+		const rows = await this.ports.listOwnDevices();
+		return new Map(rows.map((row) => [row.stableId, row]));
 	}
 	/**
-	* Generic per-cap runtime-state namespace. One entry per cap with
-	* `runtimeState:` declared, auto-generated by codegen — see
-	* `device-local-state.ts`. Drivers access via:
+	* One declaration: adopt what exists, create what does not.
 	*
-	*   `this.state.battery.sleeping = true`        // patches the battery slice
-	*   `const pct = this.state.battery.percentage` // reads the battery slice
-	*   `this.state.deviceStatus.online = true`     // mirrors `markOnline(true)`
+	* The create branch is the destructive one — it seeds `initialMeta`, and
+	* `initialMeta.name` lands as an unconditional `setName`. A transiently empty
+	* index therefore looks exactly like a first boot and would silently re-stamp
+	* the declared name over the operator's rename. D49: that branch needs a
+	* second read to agree.
+	*/
+	async applyDeclaration(declaration, integrationId, index) {
+		try {
+			let existing = index.get(declaration.stableId);
+			if (existing === void 0) {
+				existing = (await this.readIndex()).get(declaration.stableId);
+				if (existing !== void 0) this.ports.logger.warn("device index disagreed with itself — adopting instead of re-creating", {
+					tags: { deviceId: existing.id },
+					meta: {
+						stableId: declaration.stableId,
+						addonId: this.ports.addonId
+					}
+				});
+			}
+			if (existing !== void 0) {
+				const device = await this.ports.devices.create(declaration.stableId, declaration.DeviceClass, {}, null, void 0);
+				this.ports.logger.info("declared device adopted", {
+					tags: { deviceId: device.id },
+					meta: {
+						stableId: declaration.stableId,
+						integrationId
+					}
+				});
+				return {
+					stableId: declaration.stableId,
+					deviceId: device.id,
+					device,
+					created: false
+				};
+			}
+			const device = await this.ports.devices.create(declaration.stableId, declaration.DeviceClass, declaration.config ?? {}, null, {
+				type: declaration.type,
+				name: declaration.name,
+				integrationId,
+				...declaration.role === void 0 ? {} : { role: declaration.role }
+			});
+			this.ports.logger.info("declared device created", {
+				tags: { deviceId: device.id },
+				meta: {
+					stableId: declaration.stableId,
+					integrationId
+				}
+			});
+			return {
+				stableId: declaration.stableId,
+				deviceId: device.id,
+				device,
+				created: true
+			};
+		} catch (err) {
+			this.ports.logger.warn("a declared device could not be brought up", { meta: {
+				stableId: declaration.stableId,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+			return null;
+		}
+	}
+	/**
+	* Remove rows under the addon's FIXED integration whose declaration is gone.
 	*
-	* Adding a new cap with `runtimeState:` automatically extends this
-	* namespace — drivers don't have to declare proxies. Reads return
-	* `undefined` when the slice hasn't been seeded; writes patch via
-	* `runtimeState.patchCapState` and validate against the cap's schema
-	* (so partial writes need the slice to be seeded with the required
-	* fields first — drivers do this on cap registration).
+	* Bounded to that integration: a declared integration has no operator
+	* add-flow, so every row under it got there by declaration. Devices this
+	* addon owns OUTSIDE it (a provider's adopted devices) are never candidates.
 	*
-	* For caps not exposed in `DeviceLocalState`, drivers can build their
-	* own typed proxy via `this.sliceProxy(cap)`.
-	*/
-	get state() {
-		if (!this._stateProxyCache) {
-			const cache = {};
-			const handler = { get: (_target, key) => {
-				const k = key;
-				if (k in cache) return cache[k];
-				const cap = DEVICE_LOCAL_STATE_CAPS[k];
-				if (!cap) return void 0;
-				const proxy = this.sliceProxy(cap);
-				cache[k] = proxy;
-				return proxy;
-			} };
-			this._stateProxyCache = new Proxy(cache, handler);
+	* Bounded in count, and every deletion is logged with its `deviceId` — a
+	* withdrawal that removes an operator-visible row silently is the failure
+	* mode, not the removal itself.
+	*/
+	async sweepWithdrawn(declarations, integrationId, index) {
+		const declared = new Set(declarations.map((d) => d.stableId));
+		const candidates = [...index.values()].filter((row) => row.integrationId === integrationId && !declared.has(row.stableId));
+		if (candidates.length === 0) return [];
+		if (candidates.length > 32) {
+			this.ports.logger.warn("withdrawal sweep exceeded its bound — removing nothing", { meta: {
+				integrationId,
+				candidates: candidates.length,
+				bound: 32
+			} });
+			return [];
+		}
+		const removed = [];
+		for (const row of candidates) try {
+			await this.ports.devices.remove(row.id);
+			removed.push(row.id);
+			this.ports.logger.info("declared device removed — its declaration was withdrawn", {
+				tags: { deviceId: row.id },
+				meta: {
+					stableId: row.stableId,
+					integrationId
+				}
+			});
+		} catch (err) {
+			this.ports.logger.warn("a withdrawn declared device could not be removed", {
+				tags: { deviceId: row.id },
+				meta: {
+					stableId: row.stableId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
+		return removed;
+	}
+};
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
+new Set(Object.values(DeviceType));
+DeviceFeature.BatteryOperated;
+/**
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
+*/
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
+/**
+* Frozen, null-prototype builtin function table for the expression engine
+* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
+* parser rejects any callee not in it, and the evaluator gates each call on an
+* own-property check against it.
+*
+* Because the object has a NULL prototype AND is `Object.freeze`d:
+*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
+*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
+*    (there is no `Object.prototype` in the chain), so those names are not
+*    callable — they are simply "unknown function" at parse time.
+*
+* Every numeric argument is validated as a finite number and every numeric
+* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
+* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
+* closed rather than emitting a garbage value.
+*/
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString$1(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString$1(args[1], "convert", 1).trim();
+			const to = asString$1(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
 		}
-		return this._stateProxyCache;
 	}
-	_stateProxyCache;
-	config;
-	/**
-	* Per-device runtime state, cap-keyed. Always installed — slices
-	* for individual caps materialise as those caps register their
-	* native providers (`ctx.registerNativeCap`). The cap's own
-	* `runtimeState` schema is the source of truth for the slice
-	* shape; drivers don't redeclare it, they just write through.
-	*
-	* Read: `this.runtimeState.getCapState('battery')` →
-	*   `{percentage, charging, sleeping, lastUpdated}` for any
-	*   provider that registers `batteryCapability`.
-	* Write: `this.runtimeState.setCapState('battery', { … })`.
-	*
-	* Cross-process consumers reach this state through the
-	* `deviceState` cap router (or via cap-specific events the driver
-	* emits — e.g. `battery.onStatusChanged`). The local handle is
-	* accessed in-process by the driver to avoid roundtrips.
-	*/
-	runtimeState;
-	ctx;
-	/**
-	* Operator-organisational location label (room / area / zone).
-	* Read from `ctx.deviceMeta.location`; mutated via
-	* `kernel.devices.setLocation(id, value)`. Free-text — providers
-	* don't interpret it; the UI groups devices by this for filters
-	* like "show me all cameras in Kitchen". `null` when unset.
-	*/
-	location;
-	/**
-	* Soft-disabled flag. When `true`, the device class is still
-	* instantiated and visible in the UI (so the operator can flip
-	* back on without re-adding) but lifecycle hooks (publishToBroker,
-	* alarm-stream subscribe, …) MUST be gated by the driver to skip
-	* work. The `BaseDevice` enforces this by exposing the flag here;
-	* it does NOT mutate cap behaviour automatically — drivers consult
-	* `this.disabled` at the top of their lifecycle methods. Read from
-	* `ctx.deviceMeta.disabled`; mutated via
-	* `kernel.devices.setDisabled(id, value)`.
-	*/
-	disabled;
-	/**
-	* Cached materialised `SourceInfo` — either the value persisted under
-	* `metadata.sourceInfo` at construction time, or a synthetic
-	* `{ id: stableId, system: addonId }` for providers that haven't
-	* migrated yet. Lazily populated on first `sourceInfo` read so the
-	* cost of Zod-parsing the meta blob is paid once per device boot.
-	* Invalidated by `updateSourceInfo()` so providers see the new value
-	* back through the getter without a re-fetch from the meta surface.
-	*/
-	_sourceInfoCache = null;
-	constructor(ctx, schema, options) {
-		this.ctx = ctx;
-		this.id = ctx.id;
-		this.stableId = ctx.stableId;
-		this.type = options.type;
-		if (!ctx.deviceMeta) throw new Error(`BaseDevice constructor: ctx.deviceMeta is required (id=${ctx.id} stableId=${ctx.stableId})`);
-		this.name = ctx.deviceMeta.name;
-		this.location = ctx.deviceMeta.location;
-		this.disabled = ctx.deviceMeta.disabled;
-		this.role = options.role;
-		this.parentDeviceId = ctx.parentDeviceId;
-		const seedData = ctx.persistedConfig ?? {};
-		this.config = DeviceConfig.fromSchema(schema, (data) => ctx.persistConfig(data), seedData, ({ droppedKeys, issues }) => {
-			ctx.logger.warn("Device config recovery: dropping invalid persisted fields", {
-				tags: {
-					deviceId: ctx.id,
-					stableId: ctx.stableId
-				},
-				meta: {
-					droppedKeys: [...droppedKeys],
-					firstIssue: issues[0]?.message ?? null
+};
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
+/**
+* Resource-bound constants for the safe expression engine.
+*
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
+*/
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
+]);
+/**
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
+*/
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
 				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
 			});
-		});
-		let cachedProxy = null;
-		const writer = async (capName, slice) => {
-			if (!cachedProxy) cachedProxy = ctx.fetchDevice(ctx.id);
-			await (await cachedProxy).deviceState.setCapSlice({
-				capName,
-				slice
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
 			});
-		};
-		const initial = ctx.initialRuntimeState ?? {};
-		this.runtimeState = DeviceRuntimeState.fromInitial(initial, writer);
-		ctx.bindRuntimeState?.(this.runtimeState);
-		ctx.registerNativeCap?.(deviceStatusCapability, {});
-		const seed = {
-			online: true,
-			lastChangedAt: Date.now()
-		};
-		this.runtimeState.setCapState("device-status", seed);
-		ctx.registerNativeCap?.(featureProbeCapability, {});
-		this.runtimeState.setCapState("feature-probe", {
-			flags: {},
-			deviceType: null,
-			model: null,
-			channelCount: null,
-			lastProbedAt: 0,
-			lastFetchedAt: 0
-		});
-	}
-	deviceActions = /* @__PURE__ */ new Map();
-	/** Declare a device custom action + its typed handler. Idempotent per name. */
-	registerDeviceAction(name, spec, handler) {
-		this.deviceActions.set(name, {
-			spec,
-			handler
-		});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
 	}
-	/** Invoke a registered device action. Validates input against the spec. */
-	async runDeviceAction(action, input) {
-		const entry = this.deviceActions.get(action);
-		if (!entry) throw new Error(`unknown device action "${action}" on device ${this.id}`);
-		const parsed = entry.spec.input.parse(input);
-		return entry.handler(parsed);
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
+/**
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
+*
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
+*
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+*/
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
 	}
-	async removeDevice() {}
-	/**
-	* Set the device's online flag. Called by `BaseDeviceProvider` after
-	* aggregating per-profile stream-broker health, or directly by drivers
-	* that have provider-side liveness signals (e.g. ONVIF heartbeats,
-	* Reolink Baichuan firmware push events). Mirrors the new value into
-	* the `device-status` runtime-state slice so cross-process consumers
-	* pick it up via the standard cap-state channel. Subclasses can
-	* override to gate side effects on the transition.
-	*/
-	markOnline(online) {
-		if (this.online === online) return;
-		const next = {
-			online,
-			lastChangedAt: Date.now()
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
 		};
-		this.runtimeState.setCapState("device-status", next);
-	}
-	/**
-	* Upstream-system identity + rendering envelope for this device. See
-	* `SourceInfo` for the field contract. Always returns a valid object:
-	* if the persisted `metadata.sourceInfo` blob is absent or fails Zod
-	* validation, falls back to a synthetic `{ id: stableId, system: addonId }`
-	* so providers that haven't migrated keep working without code changes.
-	*
-	* The value is cached after the first read. `updateSourceInfo()`
-	* invalidates the cache so subsequent reads see the new patch. The
-	* returned object is frozen to prevent accidental in-place mutation —
-	* use `updateSourceInfo({ patch })` to change fields.
-	*/
-	get sourceInfo() {
-		if (this._sourceInfoCache) return this._sourceInfoCache;
-		const resolved = extractSourceInfoFromMetadata(this.ctx.deviceMeta.metadata) ?? synthesizeSourceInfo({
-			stableId: this.stableId,
-			addonId: this.ctx.deviceMeta.addonId
-		});
-		this._sourceInfoCache = Object.freeze({ ...resolved });
-		return this._sourceInfoCache;
-	}
-	/**
-	* Convenience accessor for the upstream dispatch key. Equivalent to
-	* `this.sourceInfo.id` — providers use this to keep a
-	* `Map<sourceId, IDevice>` for routing inbound push events.
-	*/
-	get sourceId() {
-		return this.sourceInfo.id;
-	}
-	/**
-	* Patch the device's `SourceInfo`. Shallow-merges `patch` over the
-	* current value, persists the merged result under
-	* `metadata.sourceInfo` via the `device-manager.setMetadata` cap, and
-	* emits `EventCategory.DeviceSourceInfoChanged` for live consumers.
-	*
-	* Safe to call from anywhere in the device's lifetime — the call is
-	* idempotent for `undefined` patch values (ignored) and best-effort
-	* for persistence (a transient device-manager error doesn't unwind
-	* the local cache update, so subsequent reads still see the patch).
-	*
-	* Drivers populate this on adoption + on every metadata change push
-	* from the upstream source. Subscribers (UI, export adapters) react
-	* via the `DeviceSourceInfoChanged` event without polling.
-	*/
-	async updateSourceInfo(patch) {
-		const next = mergeSourceInfo(this.sourceInfo, patch);
-		this._sourceInfoCache = Object.freeze({ ...next });
-		const action = this.ctx.api?.deviceManager?.setMetadata;
-		if (action) try {
-			await action.mutate({
-				deviceId: this.id,
-				patch: { [SOURCE_INFO_METADATA_KEY]: next }
-			});
-		} catch {}
-		this.ctx.eventBus.emit(createEvent("device.source-info-changed", {
-			type: "device",
-			id: this.stableId
-		}, {
-			deviceId: this.id,
-			sourceInfo: next
-		}));
-	}
-	/**
-	* Re-publish the device's current `features` array to the persisted
-	* meta blob. Drivers call this after a probe finishes when the live
-	* `features` getter has gained new flags (e.g. `hasIntercom` flips
-	* to true → `DeviceFeature.TwoWayAudio` joins the list).
-	*
-	* Without this, only the construction-time snapshot is written —
-	* `deviceManager.registerDevice` is invoked once per boot, so probe-
-	* driven additions don't reach the persisted index until the next
-	* server restart, and `getDevice` / `listAll` keep returning the
-	* stale list for forked-worker devices (whose live IDevice instance
-	* is invisible to the hub registry).
-	*
-	* Idempotent: re-calling with the same features just no-ops on the
-	* persisted meta. Best-effort: lookup or write failures are logged
-	* at debug and swallowed — the live `device.features` getter is
-	* still authoritative within this process, so callers never block
-	* device boot on a meta refresh.
-	*/
-	async refreshFeatures() {
-		const action = this.ctx.api?.deviceManager?.registerDevice;
-		if (!action) return;
-		try {
-			await action.mutate({
-				addonId: this.ctx.deviceMeta.addonId,
-				stableId: this.stableId,
-				id: this.id,
-				type: this.type,
-				name: this.name,
-				parentDeviceId: this.parentDeviceId,
-				features: [...this.features],
-				config: {}
-			});
-		} catch (err) {}
 	}
-	/**
-	* Typed read-through to a cap-keyed runtime-state slice. Drivers
-	* call `this.getCapSlice(batteryCapability)` and the return type
-	* is inferred from the cap's `runtimeState` Zod schema — no string
-	* key, no manual generic. Returns `null` when the slice hasn't
-	* been written yet (e.g. driver hasn't seeded battery yet).
-	*/
-	getCapSlice(cap) {
-		return this.runtimeState.getCapState(cap.name) ?? null;
+	peek() {
+		return this.tokens[this.pos];
 	}
-	/**
-	* Typed writer to a cap-keyed runtime-state slice. Routes through
-	* the runtime-state writer (validate → persist → emit cap event).
-	* Equivalent to `this.runtimeState.setCapState(cap.name, value)`
-	* but with the cap's `runtimeState` schema enforcing the value
-	* shape at compile time. Mirrors the symmetry of
-	* `getCapSlice` / `setCapSlice` for cross-cap consistency.
-	*/
-	setCapSlice(cap, value) {
-		this.runtimeState.setCapState(cap.name, value);
+	next() {
+		return this.tokens[this.pos++];
 	}
-	/**
-	* Field-level read/write proxy over a cap's runtime-state slice.
-	* Drivers that want ergonomic per-field access declare:
-	*
-	* ```ts
-	* protected battery = this.sliceProxy(batteryCapability)
-	* // …
-	* this.battery.sleeping = true        // patches the slice
-	* const charging = this.battery.charging  // reads the slice
-	* ```
-	*
-	* Reads return `undefined` when the slice hasn't been seeded yet
-	* (cap not registered, or seeded but the field is absent). Writes
-	* route through `runtimeState.patchCapState` so the cap's `runtimeState`
-	* schema validates the merged result and the cap event fires.
-	*
-	* Pattern is generic — same shape works for `battery`, `device-status`,
-	* `motion`, `doorbell`, anything with a `runtimeState:` schema. Drivers
-	* declare one proxy per cap they read/write directly.
-	*/
-	sliceProxy(cap) {
-		return new Proxy({}, {
-			get: (_, key) => {
-				return this.runtimeState.getCapState(cap.name)?.[key];
-			},
-			set: (_, key, value) => {
-				this.runtimeState.patchCapState(cap.name, { [key]: value });
-				return true;
-			},
-			has: (_, key) => {
-				const slice = this.runtimeState.getCapState(cap.name);
-				return slice ? key in slice : false;
-			},
-			ownKeys: () => {
-				const slice = this.runtimeState.getCapState(cap.name);
-				return slice ? Object.keys(slice) : [];
-			},
-			getOwnPropertyDescriptor: (_, key) => {
-				const slice = this.runtimeState.getCapState(cap.name);
-				if (!slice || !(key in slice)) return void 0;
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
+	}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
+		}
+		return false;
+	}
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	}
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
+		}
+		return test;
+	}
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
 				return {
-					configurable: true,
-					enumerable: true,
-					value: slice[key]
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
 				};
 			}
-		});
-	}
-	/**
-	* Default empty settings UI. Drivers override this to expose an
-	* editable form in the device-details page. Returning an empty sections
-	* array signals "nothing to contribute" — the aggregator drops the
-	* contribution entirely rather than rendering a blank panel.
-	*/
-	getSettingsUISchema() {
-		return { sections: [] };
-	}
-	/**
-	* Default write path: forward the flat patch directly to storage.
-	* Drivers that project a UI shape different from storage (e.g. `RtspCamera`
-	* exposing `mainStreamUrl`/`subStreamUrl` over `streams[]`) override this
-	* to reshape before `config.setAll`.
-	*/
-	async applySettingsPatch(patch) {
-		await this.config.setAll(patch);
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
 	}
-	/**
-	* Phase 3 — populate device-scoped state needed by downstream phases
-	* (accessory reconciliation, public `features` array, optional cap
-	* registration). Called ONCE per construction, after register but
-	* before `getAccessoryChildren()`.
-	*
-	* Drivers write the `feature-probe` runtime-state slice via
-	* `this.runtimeState.setCapState('feature-probe', {...})` — flag bag
-	* is open (Reolink writes `hasPtz/hasIntercom`, Hikvision writes
-	* `hasSupplementalLight/hasAlarmIo`, etc).
-	*
-	* Default: nothing to probe → mark the device PROBED (set `lastProbedAt`) so
-	* the kernel treats it as ready immediately. A device that derives its shape
-	* from a spec (a container, or an accessory sensor) rather than from a
-	* hardware probe has no probe to "complete"; without stamping `lastProbedAt`
-	* it would look perpetually un-probed — logging "Initial probe did not
-	* complete" on every boot and spinning a pointless retry chain. Drivers that
-	* DO probe override this and write their own `feature-probe` slice (including
-	* `lastProbedAt`) once their probe actually succeeds.
-	*/
-	async onProbe() {
-		const base = this.runtimeState.getCapState("feature-probe") ?? {
-			flags: {},
-			deviceType: null,
-			model: null,
-			channelCount: null,
-			lastProbedAt: 0,
-			lastFetchedAt: 0
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
 		};
-		this.runtimeState.setCapState("feature-probe", {
-			...base,
-			lastProbedAt: Date.now()
-		});
 	}
-	/**
-	* Phase 5 — fired after the device + its accessories are registered.
-	* Drivers publish streams to the broker, kick off background tasks,
-	* or subscribe to lib events that need a fully-registered device id.
-	*
-	* Default: no-op.
-	*
-	* RENAMED FROM `onCreated` (which still exists for back-compat in this
-	* pass). The new name reflects the post-probe, post-accessory contract.
-	*/
-	async onActivate() {}
-	/**
-	* Re-run the probe + reconcile accessories + refresh features meta.
-	* Drivers call this when device-side state changes (battery cam wakes,
-	* firmware update, manual operator trigger).
-	*
-	* The kernel injects `_kernelReprobe` on registration so this method
-	* delegates to the same orchestrator that runs the boot-time phase
-	* 3 + 4 sequence. Drivers should NOT override this — they override
-	* `onProbe()` instead.
-	*/
-	async reprobe() {
-		if (this._kernelReprobe) await this._kernelReprobe();
-		else await this.onProbe();
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
+/**
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
+*
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
+*/
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
+	}
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
 	}
-	/**
-	* Kernel-injected callback that runs the full post-probe orchestration
-	* (onProbe → registerDevice meta refresh → accessory reconciliation).
-	* Set by `device-cap-proxy.register()`. Drivers should not touch this
-	* directly — call `reprobe()` instead.
-	*/
-	_kernelReprobe;
-	/**
-	* Declare accessory child devices the kernel should auto-spawn
-	* after `onProbe()` resolves. Each spec fully describes one child
-	* — stableId suffix (deterministic per kind for restore-safety),
-	* meta (type / name / location), config (initial blob the child
-	* self-hydrates), and a factory that constructs the concrete
-	* class with whatever closure-captured refs it needs (typically
-	* `this` for the parent reference).
-	*
-	* The kernel handles the rest: allocateDeviceId, persistInitialConfig
-	* (skipped on restore when the row already exists),
-	* persistInitialMeta, createContext, factory invocation, register,
-	* and recursive lifecycle (probe + accessories + activate).
-	*
-	* Implementations should derive children from
-	* `this.runtimeState.getCapState('feature-probe')` (post-probe truth).
-	* Drivers can use the `getProbeFlags()` helper to read the flag bag
-	* with a typed cast.
-	*
-	* Default: no children.
-	*/
-	getAccessoryChildren() {
-		return [];
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
 	}
-	/**
-	* Read the current feature-probe flag bag with a typed cast. Helper
-	* for `getAccessoryChildren()` and `features` getters that derive
-	* outputs from the probe results.
-	*/
-	getProbeFlags() {
-		return this.runtimeState.getCapState("feature-probe")?.flags ?? {};
+	return result;
+}
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
+}
+Object.freeze({});
+/**
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
 	}
-	/**
-	* Returns true once `onProbe` has completed at least once
-	* (`lastProbedAt > 0`). Drivers gate `getAccessoryChildren()` on this
-	* to avoid spawning stale accessories on a fresh device whose probe
-	* hasn't landed yet.
-	*/
-	hasProbed() {
-		return (this.runtimeState.getCapState("feature-probe")?.lastProbedAt ?? 0) > 0;
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
 	}
-};
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
-new Set(Object.values(DeviceType));
-DeviceFeature.BatteryOperated;
+	return null;
+}
+var ExpressionBindingSourceSchema = union([
+	object({
+		kind: literal("field").optional(),
+		sourceKey: string(),
+		cap: string(),
+		fieldPath: string()
+	}),
+	object({
+		kind: literal("literal"),
+		value: union([
+			string(),
+			number(),
+			boolean(),
+			_null()
+		])
+	}),
+	object({
+		kind: literal("global"),
+		sourceStableId: string(),
+		cap: string(),
+		fieldPath: string()
+	})
+]);
+object({
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
 Object.freeze({
 	"accessories.setChildHidden": {
 		capName: "accessories",
@@ -28446,6 +28671,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.restart": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.setEnabled": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -29082,12 +29313,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"deviceManager.setDeviceLinks": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"deviceManager.setDisabled": {
 		capName: "device-manager",
 		capScope: "system",
@@ -33185,51 +33410,6 @@ var TimelapseRuleSchema = TimelapseRuleInputSchema.extend({
 	createdAt: number(),
 	updatedAt: number()
 });
-/** Cosine similarity between two embedding vectors */
-function cosineSimilarity(a, b) {
-	if (a.length !== b.length) return 0;
-	let dotProduct = 0;
-	let normA = 0;
-	let normB = 0;
-	for (let i = 0; i < a.length; i++) {
-		dotProduct += a[i] * b[i];
-		normA += a[i] * a[i];
-		normB += b[i] * b[i];
-	}
-	const denom = Math.sqrt(normA) * Math.sqrt(normB);
-	return denom === 0 ? 0 : dotProduct / denom;
-}
-function hfModelUrl(repo, path) {
-	return `https://huggingface.co/${repo}/resolve/main/${path}`;
-}
-/**
-* Vector wire codec — base64 of little-endian Float32.
-*
-* The `vector-store` capability carries vectors as base64 rather than
-* `number[]` or a typed array, and both rejected alternatives have a scar here:
-*
-*  - a `Float32Array` does NOT survive msgpack across the UDS transport (it
-*    arrived as an empty object and froze audio dBFS until the payload was
-*    changed to carry bytes);
-*  - `number[]` is the ~5x-larger encoding the capability exists to stop paying
-*    — a 512-dim vector is 2,048 bytes raw and 2,732 as base64, against roughly
-*    10-12 KB rendered as JSON text.
-*
-* Endianness is pinned to little-endian explicitly instead of inheriting the
-* platform's, so a vector written on one node decodes correctly on another.
-*/
-/** Encode a vector as base64 of little-endian Float32. */
-function encodeVectorBase64(vector) {
-	const floats = vector instanceof Float32Array ? vector : Float32Array.from(vector);
-	const bytes = new Uint8Array(floats.length * 4);
-	const view = new DataView(bytes.buffer);
-	for (let i = 0; i < floats.length; i += 1) view.setFloat32(i * 4, floats[i] ?? 0, true);
-	return Buffer.from(bytes).toString("base64");
-}
-/** Vector length implied by a base64 payload, without decoding it. */
-function vectorDimFromBase64(encoded) {
-	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
-}
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -33336,6 +33516,51 @@ DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
+/** Cosine similarity between two embedding vectors */
+function cosineSimilarity(a, b) {
+	if (a.length !== b.length) return 0;
+	let dotProduct = 0;
+	let normA = 0;
+	let normB = 0;
+	for (let i = 0; i < a.length; i++) {
+		dotProduct += a[i] * b[i];
+		normA += a[i] * a[i];
+		normB += b[i] * b[i];
+	}
+	const denom = Math.sqrt(normA) * Math.sqrt(normB);
+	return denom === 0 ? 0 : dotProduct / denom;
+}
+function hfModelUrl(repo, path) {
+	return `https://huggingface.co/${repo}/resolve/main/${path}`;
+}
+/**
+* Vector wire codec — base64 of little-endian Float32.
+*
+* The `vector-store` capability carries vectors as base64 rather than
+* `number[]` or a typed array, and both rejected alternatives have a scar here:
+*
+*  - a `Float32Array` does NOT survive msgpack across the UDS transport (it
+*    arrived as an empty object and froze audio dBFS until the payload was
+*    changed to carry bytes);
+*  - `number[]` is the ~5x-larger encoding the capability exists to stop paying
+*    — a 512-dim vector is 2,048 bytes raw and 2,732 as base64, against roughly
+*    10-12 KB rendered as JSON text.
+*
+* Endianness is pinned to little-endian explicitly instead of inheriting the
+* platform's, so a vector written on one node decodes correctly on another.
+*/
+/** Encode a vector as base64 of little-endian Float32. */
+function encodeVectorBase64(vector) {
+	const floats = vector instanceof Float32Array ? vector : Float32Array.from(vector);
+	const bytes = new Uint8Array(floats.length * 4);
+	const view = new DataView(bytes.buffer);
+	for (let i = 0; i < floats.length; i += 1) view.setFloat32(i * 4, floats[i] ?? 0, true);
+	return Buffer.from(bytes).toString("base64");
+}
+/** Vector length implied by a base64 payload, without decoding it. */
+function vectorDimFromBase64(encoded) {
+	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
+}
 //#endregion
 Object.defineProperty(exports, "BaseAddon", {
 	enumerable: true,
@@ -33355,6 +33580,12 @@ Object.defineProperty(exports, "DEFAULT_EVENT_COLOR", {
 		return DEFAULT_EVENT_COLOR;
 	}
 });
+Object.defineProperty(exports, "DeclaredDevices", {
+	enumerable: true,
+	get: function() {
+		return DeclaredDevices;
+	}
+});
 Object.defineProperty(exports, "DeviceType", {
 	enumerable: true,
 	get: function() {