@camstack/addon-provider-amcrest 0.2.10 → 0.2.12

package/dist/addon.mjs

@@ -5,7 +5,7 @@ import { networkInterfaces } from "node:os";
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
-//#region ../types/dist/event-category-41fKf-q9.mjs
+//#region ../types/dist/event-category-Cv9dO26A.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -21,6 +21,13 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
 	/**
+	* A newer addon or server-root package version was found by the
+	* authoritative registry check. Emitted once per
+	* `(target, packageName, currentVersion, latestVersion)` transition; repeated
+	* polling of the same result is deduplicated by the checker.
+	*/
+	EventCategory["UpdateAvailable"] = "update.available";
+	/**
 	* Readiness transition for a capability provider. Every producer emits
 	* this event on `onInitialize` completion, `onDestroy`, and
 	* `$node.reconnect`; every consumer that needs to gate on a cross-process
@@ -6467,7 +6474,20 @@ var BrokerStatsSchema = object({
 		sampleRate: number(),
 		channels: number(),
 		supported: boolean()
-	}).nullable().optional()
+	}).nullable().optional(),
+	/**
+	* BROKER-SIDE AUDIO MUTE (D83). `true` = this broker is deliberately
+	* distributing none of the device's audio, on live or recording.
+	*
+	* Present so a silent camera can be told apart from a broken one on the
+	* stream panel itself, without cross-referencing the switch group: a
+	* broker holding an `audio` track descriptor while `audioMuted` is true is
+	* working exactly as asked. `audioMutedDropped` counts the audio units
+	* thrown away since the current dial — it is how you confirm from stats
+	* alone that the mute is on the packet path and not merely persisted.
+	*/
+	audioMuted: boolean().optional(),
+	audioMutedDropped: number().optional()
 });
 /**
 * Exporter-facing "profile restream" entry. Returned by
@@ -7081,6 +7101,104 @@ object({
 	})
 });
 /**
+* Adoption job — the background form of `device-adoption.adopt`.
+*
+* ## Why this exists
+*
+* `adopt({childNativeIds: [...]})` materialises one CamStack device per
+* candidate PLUS every accessory child, and the whole array shares ONE UDS
+* request deadline (60s). Measured on the live hub against Home Assistant:
+* each device the kernel creates costs ~450 ms — `devices.create` pre-seeds
+* meta with up to eleven SEQUENTIAL round trips (`setName`, `setType`,
+* `setRole`, … `persistConfig`) before the class is constructed — and an
+* accessory child costs the same as its parent. So the real unit of work is
+* the CHILD, not the candidate:
+*
+* - 25 candidates averaging 6 children  → ~150 devices → **>60s, times out**
+* - ONE candidate with 217 children     → ~217 devices → **>60s, times out**
+*
+* That second line is why this is a job and not a smaller batch. No chunking,
+* no bounded concurrency over candidates and no per-call tuning can fix a
+* shape where **N=1 already exceeds the deadline** — the count that blows the
+* budget is the source system's accessory fan-out, which the operator does not
+* choose and cannot see. A design that only works below some N is the same bug
+* deferred.
+*
+* ## What the timeout did NOT do
+*
+* It did not stop the work. The UDS deadline ends the CALLER's wait; the
+* provider's loop runs to completion. Measured: a 25-candidate adopt that
+* "failed" at 60s had adopted 17 by 87s and all 25 by ~130s. The operator saw
+* an error and had no way to learn that. Every field below exists so that
+* question has an answer.
+*
+* ## Idempotency
+*
+* Jobs are in-RAM; a restart forgets them. That is safe here because adoption
+* is keyed by a stable id (`ha:<broker>:dev:<nativeId>` and equivalents), so
+* re-running a job re-adopts nothing: an already-adopted candidate is SKIPPED
+* by the engine before any provider call and lands in `alreadyAdopted`. It is
+* never a duplicate device, and never an error the operator has to interpret.
+*/
+var AdoptionJobStateSchema = _enum([
+	"running",
+	"done",
+	"failed",
+	"cancelled"
+]);
+/**
+* Per-candidate result. Every candidate the job was asked to adopt ends in
+* exactly one of these buckets — there is no silent drop, and the operator can
+* always answer "which of my 25 landed?".
+*
+* - `adopted` — created now by this job.
+* - `already-adopted` — a device for this candidate existed before the job
+*   reached it (a re-run, or a retry after a timeout). Not an error.
+* - `failed` — the provider threw; `error` carries the message.
+* - `cancelled` — the operator cancelled before this candidate was reached.
+*/
+var AdoptionOutcomeSchema = _enum([
+	"adopted",
+	"already-adopted",
+	"failed",
+	"cancelled"
+]);
+var AdoptionCandidateResultSchema = object({
+	childNativeId: string(),
+	outcome: AdoptionOutcomeSchema,
+	/** The materialised parent device id — null for `failed` / `cancelled`. */
+	parentDeviceId: number().int().nonnegative().nullable(),
+	/** Accessory children created for this candidate. */
+	accessoryCount: number().int().nonnegative(),
+	/** Failure message; null unless `outcome === 'failed'`. */
+	error: string().nullable()
+});
+var AdoptionJobSchema = object({
+	jobId: string(),
+	/** The integration provider this job adopts through (the `addonId` pin). */
+	addonId: string(),
+	integrationId: string(),
+	state: AdoptionJobStateSchema,
+	/** Candidates the job was asked to adopt. Known up front, so never null. */
+	total: number().int().nonnegative(),
+	/** Candidates that have reached a terminal bucket. */
+	processed: number().int().nonnegative(),
+	adopted: number().int().nonnegative(),
+	alreadyAdopted: number().int().nonnegative(),
+	failed: number().int().nonnegative(),
+	/** Accessory child devices created across every candidate — the real unit
+	*  of work, surfaced so a slow job is legible rather than mysterious. */
+	accessoriesCreated: number().int().nonnegative(),
+	/** The candidate currently being adopted; null when idle or finished. */
+	currentChildNativeId: string().nullable(),
+	/** One entry per candidate, in the order they were processed. */
+	results: array(AdoptionCandidateResultSchema).readonly(),
+	startedAt: number(),
+	finishedAt: number().nullable(),
+	/** Set only when the job itself broke (not a per-candidate failure). */
+	error: string().nullable()
+});
+/**
 * Per-camera FUNCTION SWITCHES — the one coherent on/off surface over the
 * pipeline functions an operator thinks in terms of.
 *
@@ -7100,6 +7218,19 @@ object({
 * | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
 * | `privacy-mask` | `privacyMask.setMask({ enabled })` → the CAMERA | the camera blanks the masked regions itself; every stream and recording carries the black boxes |
 * | `device-audio` | `privacyMask.setAudioEnabled` → the CAMERA | the camera stops encoding an audio track at all; every consumer sees silent video |
+* | `broker-audio` | `streamBroker.setDeviceAudioMute` → `DeviceOverride.audioMuted` | `StreamBroker.setAudioMuted` drops the audio plane at the source: no `type:'audio'` packet leaves `fanOutEncoded`, no RTP reaches the restreamer, and the restreamer serves the video-only SDP |
+*
+* ## `device-audio` and `broker-audio` are two functions, not two knobs
+*
+* They look adjacent and they are not the same control ([D83](../../../../docs/decisions/adr-0083.md)):
+* `device-audio` writes the CAMERA, so it is hardware privacy — the microphone
+* genuinely stops, it survives CamStack entirely, and it costs a multi-second
+* encoder restart on every flip. `broker-audio` writes THIS server, so it is
+* instant, vendor-independent and reversible without touching the camera, and
+* a camera that ignores or lacks the ISAPI/Reolink control is still silenced.
+* D62 forbids a second switch that *disagrees* with the first; these two
+* cannot disagree, because neither reads the other's store — the camera holds
+* one, the broker holds the other, and each reports its own fact.
 *
 * ## The two switches whose authority is not on this server
 *
@@ -7161,6 +7292,7 @@ var CameraSwitchIdSchema = _enum([
 	"object-detection",
 	"privacy-mask",
 	"device-audio",
+	"broker-audio",
 	"audio-analysis",
 	"recording",
 	"notifications"
@@ -7186,7 +7318,8 @@ var CameraSwitchAuthoritySchema = discriminatedUnion("kind", [
 	object({
 		kind: literal("camera-mask"),
 		capName: string()
-	})
+	}),
+	object({ kind: literal("broker-audio-mute") })
 ]);
 /**
 * Why a switch is not offered for this camera. Rendered instead of the
@@ -7885,408 +8018,1182 @@ var ConvertResultSchema = object({
 	})).readonly()
 });
 /**
-* `addon-pages` — system-scoped singleton aggregator cap. Public-facing
-* surface that admin-ui consumes through `useAddonPagesListPages()`.
-*
-* The provider iterates every `addon-pages-source` (collection) provider
-* and emits `AddonPageInfo[]` enriched with versioned `bundleUrl` strings
-* pointing at `/api/addon-pages/<addonId>/<bundle>?v=<mtime>`. The
-* filesystem `mtime` cache-buster lets the browser pick up addon
-* rebuilds without manual reload.
-*
-* The hub-local builtin `addon-pages-aggregator` (see
-* `@camstack/system/builtins/addon-pages-aggregator`) registers the
-* provider. Splitting the public aggregator from the raw collection
-* keeps both ends in codegen — there's no hand-written
-* `addon-pages.router.ts` wrapper anymore.
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
 */
-var AddonPageDeclarationSchema$1 = object({
-	id: string(),
-	label: string(),
-	icon: string(),
-	path: string(),
-	remoteName: string(),
-	bundle: string(),
-	section: string().optional(),
-	sectionLabel: string().optional()
-});
-var AddonPageInfoSchema = object({
-	addonId: string(),
-	page: AddonPageDeclarationSchema$1,
-	bundleUrl: string()
-});
-method(_void(), array(AddonPageInfoSchema).readonly());
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
 /**
-* `addon-pages-source` — collection cap exposing per-provider raw page
-* declarations. Every addon that contributes a UI page registers a
-* provider here. The hub-side singleton aggregator (`addon-pages` cap,
-* see `addon-pages.cap.ts`) walks this collection, stamps versioned
-* `bundleUrl` values, and returns the enriched `AddonPageInfo[]` list
-* that admin-ui consumes.
+* Frozen, null-prototype builtin function table for the expression engine
+* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
+* parser rejects any callee not in it, and the evaluator gates each call on an
+* own-property check against it.
 *
-* The split exists because the public listing has a different output
-* shape than the per-provider raw declarations, and we want both ends
-* to flow through codegen instead of relying on a hand-written wrapper.
-*/
-var AddonPageDeclarationSchema = object({
-	id: string(),
-	label: string(),
-	icon: string(),
-	path: string(),
-	/**
-	* Module Federation remote name — must match the `name` field on the
-	* page addon's `federation()` plugin config. Used by admin-ui's
-	* `<AddonPageLoader>` to call `loadRemote('<remoteName>/page')`.
-	* Conventionally `addon_<id>_page` (snake_case; MF names cannot
-	* contain hyphens).
-	*/
-	remoteName: string(),
-	/**
-	* Bundle filename inside the addon's `dist/` dir served at
-	* `/api/addon-pages/<addonId>/<bundle>`. With Module Federation this
-	* is always `'remoteEntry.js'`; the value is kept on the metadata so
-	* the static-file route can compute an mtime-based cache-buster URL
-	* without a separate filesystem stat.
-	*/
-	bundle: string(),
-	/**
-	* Sidebar section this page docks into. Well-known ids: `'detection'`,
-	* `'cluster'`, `'administration'` — the page renders inside that group.
-	* Any OTHER string creates (or joins) a custom section rendered after
-	* the built-in groups; its label comes from `sectionLabel` (first
-	* declaration wins), falling back to the id. Absent → the legacy
-	* "Addon Pages" group.
-	*/
-	section: string().optional(),
-	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
-	sectionLabel: string().optional()
-});
-method(_void(), array(AddonPageDeclarationSchema).readonly());
-var AddonHttpRouteSchema = object({
-	method: _enum([
-		"GET",
-		"POST",
-		"PUT",
-		"DELETE",
-		"PATCH"
-	]),
-	path: string(),
-	access: _enum([
-		"public",
-		"authenticated",
-		"admin"
-	]).optional(),
-	description: string().optional()
-});
-/**
-* Cross-process route invocation envelope. The hub captures the
-* request as plain data, ships it to the worker via Moleculer, and
-* the worker runs the local handler against a capturing reply. The
-* envelope returned describes what the handler intended (status,
-* headers, body, or a redirect) so the hub can translate it back to
-* the Fastify reply that's actually wired to the socket.
+* Because the object has a NULL prototype AND is `Object.freeze`d:
+*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
+*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
+*    (there is no `Object.prototype` in the chain), so those names are not
+*    callable — they are simply "unknown function" at parse time.
+*
+* Every numeric argument is validated as a finite number and every numeric
+* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
+* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
+* closed rather than emitting a garbage value.
 */
-var InvokeRequestSchema = object({
-	method: string(),
-	path: string(),
-	params: record(string(), string()),
-	query: record(string(), string()),
-	body: unknown(),
-	headers: record(string(), string()),
-	user: object({
-		id: string(),
-		username: string(),
-		isAdmin: boolean()
-	}).optional(),
-	scopedToken: unknown().optional()
-});
-var InvokeReplyEnvelopeSchema = object({
-	status: number().int(),
-	headers: record(string(), string()),
-	/** When set, the hub MUST `reply.redirect(redirectUrl)` instead of
-	*  sending `body`. Status defaults to 302 when this is set unless
-	*  the handler called `reply.code(...)` explicitly. */
-	redirectUrl: string().nullable(),
-	/** JSON-serializable body. `undefined` is treated as "no body". */
-	body: unknown().optional(),
-	/** Set when the handler called `reply.type(mime)`. */
-	contentType: string().optional()
-});
-method(_void(), array(AddonHttpRouteSchema)), method(InvokeRequestSchema, InvokeReplyEnvelopeSchema, { kind: "mutation" });
-var ConfigTabDeclarationSchema = object({
-	id: string(),
-	label: string(),
-	icon: string(),
-	order: number().optional()
-});
-var ConfigSectionWithValuesSchema = object({
-	id: string(),
-	title: string(),
-	description: string().optional(),
-	style: _enum(["card", "accordion"]).optional(),
-	defaultCollapsed: boolean().optional(),
-	columns: union([
-		literal(1),
-		literal(2),
-		literal(3),
-		literal(4)
-	]).optional(),
-	tab: string().optional(),
-	location: _enum(["settings", "top-tab"]).optional(),
-	order: number().optional(),
-	fields: array(any())
-});
-var SettingsSchemaWithValuesSchema = object({
-	tabs: array(ConfigTabDeclarationSchema).optional(),
-	sections: array(ConfigSectionWithValuesSchema)
-});
-/** Patch object — keys are field names, values are the new field values. */
-var SettingsPatchSchema = record(string(), unknown());
-/** Standard success response for update operations. */
-var SettingsUpdateResultSchema = object({ success: literal(true) });
-method(object({
-	addonId: string(),
-	nodeId: string().optional(),
-	overlay: record(string(), unknown()).optional(),
-	cap: string().optional()
-}), SettingsSchemaWithValuesSchema.nullable()), method(object({
-	addonId: string(),
-	nodeId: string().optional(),
-	patch: SettingsPatchSchema
-}), SettingsUpdateResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	addonId: string(),
-	deviceId: number(),
-	nodeId: string().optional()
-}), SettingsSchemaWithValuesSchema.nullable()), method(object({
-	addonId: string(),
-	deviceId: number(),
-	nodeId: string().optional(),
-	patch: SettingsPatchSchema
-}), SettingsUpdateResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString$1(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString$1(args[1], "convert", 1).trim();
+			const to = asString$1(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
+	}
+};
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
 /**
-* `addon-widgets-source` — collection cap exposing per-addon raw widget
-* declarations. Mirrors the addon-pages split: every addon shipping
-* widgets registers a provider on this collection cap; the hub-local
-* aggregator (`addon-widgets`, see `addon-widgets.cap.ts`) walks the
-* collection, stamps versioned `bundleUrl`s onto each declaration, and
-* exposes the public listing surface that admin-ui consumes.
-*
-* The split exists because the public listing has a different output
-* shape (flat enriched metadata with `addonId` + `bundleUrl`) than the
-* per-provider raw declarations. Both ends flow through codegen.
+* Resource-bound constants for the safe expression engine.
 *
-* Unified UI-contribution model (Task 10): a widget descriptor IS a
-* `UiContribution` with `kind:'remote'`. The host renders it through the
-* same `ContributionRenderer` / Module-Federation path as every other
-* contributed UI surface — no bespoke widget-rendering path. The widget-
-* only metadata (sizing hints, `requires`) lives as extra fields on the
-* descriptor; the `UiContribution` core (`tab` / `label` / `order` /
-* `kind` / `remote`) carries identity + placement + the MF remote.
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
 */
-/** Where the widget makes sense to render — maps to a contribution `tab`. */
-var WidgetHostEnum = _enum([
-	"device-tab",
-	"dashboard",
-	"integration-detail"
-]);
-var WidgetSizeEnum = _enum([
-	"xs",
-	"sm",
-	"md",
-	"lg",
-	"xl"
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
 ]);
 /**
-* MF remote descriptor — mirrors `UiContributionRemote` from
-* `capability-definition.ts`. Widget remotes expose a single
-* `'./widgets'` module whose default export is a
-* `Record<componentKey, Component>` map; `componentKey` (the widget
-* `stableId`) picks the entry the host mounts.
-*/
-var WidgetRemoteSchema = object({
-	remoteName: string(),
-	exposedModule: string(),
-	componentKey: string().optional()
-});
-/**
-* One widget declaration — a `UiContribution` (`kind:'remote'`) plus
-* widget-only metadata. The `UiContribution` core fields:
-*
-*  - `tab`     — where the widget hosts. A widget that runs on the
-*                dashboard declares `tab:'dashboard'`; a device-tab
-*                widget declares the target device-detail tab id.
-*  - `subTab`  — optional sub-tab within `tab`.
-*  - `label`   — operator-facing label.
-*  - `order`   — ordering within `(tab, subTab)`.
-*  - `kind`    — always `'remote'` for widgets.
-*  - `remote`  — the MF remote `{ remoteName, exposedModule, componentKey }`.
-*
-* Widget-only fields retained alongside the contribution core:
-*
-*  - `stableId`      — stable identity within the addon (the MF
-*                      `componentKey`; kept top-level so consumers have
-*                      a stable key without reaching into `remote`).
-*  - `description` / `icon` — picker metadata.
-*  - `bundle`        — entry filename inside the addon `dist/` dir; the
-*                      aggregator stamps a versioned `bundleUrl` from it.
-*  - `hosts`         — every host the widget supports (a widget can run
-*                      both on the dashboard and a device tab). `tab`
-*                      is the PRIMARY host; `hosts` is the full set the
-*                      picker filters on.
-*  - `requires`      — host-context requirements validated at mount.
-*  - `defaultSize` / `allowedSizes` / `defaultColumns` / `defaultRows`
-*                    — dashboard placement hints.
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
 */
-var WidgetMetadataSchema = object({
-	/** Primary host tab — `'dashboard'`, `'device-tab'`, or a device-detail tab id. */
-	tab: string(),
-	/** Optional sub-tab within `tab`. */
-	subTab: string().optional(),
-	/** Operator-facing label. */
-	label: string(),
-	/** Ordering within `(tab, subTab)`, ascending. */
-	order: number().optional(),
-	/** Always `'remote'` — a widget is a Module Federation remote. */
-	kind: literal("remote"),
-	/** MF remote descriptor. */
-	remote: WidgetRemoteSchema,
-	/** Stable id within the addon — kebab-case. Equals `remote.componentKey`. */
-	stableId: string(),
-	description: string().optional(),
-	icon: string().optional(),
-	/**
-	* Bundle filename inside the addon's `dist/` dir served at
-	* `/api/addon-widgets/<addonId>/<bundle>`. With Module Federation
-	* this is always `'remoteEntry.js'` — the value is kept on the
-	* metadata so the static-file route can compute an mtime-based
-	* cache-buster URL without a separate filesystem stat.
-	*/
-	bundle: string(),
-	/** Every host the widget supports. The picker filters on this set. */
-	hosts: array(WidgetHostEnum).readonly(),
-	/** Required props the host must supply. Validated at `<WidgetSlot>` mount. */
-	requires: object({
-		deviceContext: boolean().default(false),
-		integrationContext: boolean().default(false)
-	}),
-	/**
-	* Loadable BEFORE authentication. The normal widget registry listing
-	* (`addon-widgets.listWidgets`) is auth-gated, so a pre-auth surface
-	* (the login page) cannot discover a widget through it. A widget that
-	* declares `preAuth: true` marks itself as safe to mount on a pre-auth
-	* screen — it is surfaced through the PUBLIC `auth.listLoginMethods`
-	* login-method contribution channel (see `login-method.cap.ts`) rather
-	* than the authenticated registry, and its bundle is served by the
-	* public `/api/addon-widgets/:addonId/*` static route. Defaults false.
-	*/
-	preAuth: boolean().optional().default(false),
-	/** Dashboard placement HINTS (operator can override per instance). */
-	defaultSize: WidgetSizeEnum.default("md"),
-	allowedSizes: array(WidgetSizeEnum).readonly().default([
-		"sm",
-		"md",
-		"lg"
-	]),
-	defaultColumns: number().int().min(1).max(12).default(6),
-	defaultRows: number().int().min(1).max(12).default(1)
-});
-method(_void(), array(WidgetMetadataSchema).readonly());
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	}
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
 /**
-* `addon-widgets` — system-scoped singleton aggregator cap. Public-facing
-* surface that admin-ui consumes through `useAddonWidgetsListWidgets()`.
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
 *
-* The provider iterates every `addon-widgets-source` (collection)
-* provider and emits `EnrichedWidgetMetadata[]` enriched with versioned
-* `bundleUrl` strings pointing at
-* `/api/addon-widgets/<addonId>/<bundle>?v=<mtime>`. The filesystem
-* `mtime` cache-buster lets the browser pick up addon rebuilds without
-* manual reload — same scheme used by `addon-pages`.
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
 *
-* The hub-local builtin `addon-widgets-aggregator` (see
-* `@camstack/system/builtins/addon-widgets-aggregator`) registers the
-* provider. Splitting the public aggregator from the raw collection
-* keeps both ends in codegen — there's no hand-written wrapper.
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
 */
-var EnrichedWidgetMetadataSchema = WidgetMetadataSchema.extend({
-	addonId: string(),
-	bundleUrl: string()
-});
-method(_void(), array(EnrichedWidgetMetadataSchema).readonly());
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
+		};
+	}
+	peek() {
+		return this.tokens[this.pos];
+	}
+	next() {
+		return this.tokens[this.pos++];
+	}
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
+	}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
+		}
+		return false;
+	}
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	}
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
+		}
+		return test;
+	}
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
+				};
+			}
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
+	}
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
+	}
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
 /**
-* Alerts capability — collection-based internal alert system.
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
 *
-* Multiple providers can register. Each provider filters by EventBus category
-* and creates/updates alerts. The built-in Alert Center addon persists alerts
-* in the DB and serves them to the admin UI.
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
 */
-var AlertSeveritySchema = _enum([
-	"info",
-	"success",
-	"warning",
-	"error"
-]);
-var AlertStatusSchema = _enum([
-	"active",
-	"in-progress",
-	"completed",
-	"failed",
-	"dismissed"
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
+	}
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
+	}
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
+	}
+	return result;
+}
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
+}
+Object.freeze({});
+/**
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
+	}
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	}
+	return null;
+}
+var ExpressionBindingSourceSchema = union([
+	object({
+		kind: literal("field").optional(),
+		sourceKey: string(),
+		cap: string(),
+		fieldPath: string()
+	}),
+	object({
+		kind: literal("literal"),
+		value: union([
+			string(),
+			number(),
+			boolean(),
+			_null()
+		])
+	}),
+	object({
+		kind: literal("global"),
+		sourceStableId: string(),
+		cap: string(),
+		fieldPath: string()
+	})
 ]);
-var AlertSourceSchema = object({
-	type: string(),
-	id: string()
-});
-var AlertSchema = object({
-	id: string(),
-	category: string(),
-	severity: AlertSeveritySchema,
-	title: string(),
-	message: string(),
-	status: AlertStatusSchema,
-	progress: number().optional(),
-	read: boolean(),
-	createdAt: number(),
-	updatedAt: number(),
-	source: AlertSourceSchema.optional(),
-	metadata: record(string(), unknown()).optional()
+object({
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
 });
-method(AlertSchema, _void(), { kind: "mutation" }), method(object({
-	alertId: string(),
-	patch: AlertSchema.partial()
-}), _void(), { kind: "mutation" }), method(object({
-	unreadOnly: boolean().optional(),
-	limit: number().optional()
-}).optional(), array(AlertSchema).readonly()), method(_void(), number()), method(object({ alertId: string() }), _void(), { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(object({ alertId: string() }), _void(), { kind: "mutation" });
-DeviceType.Camera, method(object({ deviceId: number() }), custom()), object({
-	deviceId: number(),
-	rms: number(),
-	dbfs: number()
+/** How a leaf compares a device field to a value. Derived from the field's
+*  `kind` in `deviceManager.getWireableFields`, never hand-maintained. */
+var AutomationConditionOperatorSchema = _enum([
+	"eq",
+	"ne",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"contains",
+	"in"
+]);
+var AutomationConditionLeafSchema = object({
+	kind: literal("condition"),
+	deviceId: number().int().nonnegative(),
+	cap: string().min(1),
+	fieldPath: string().min(1),
+	operator: AutomationConditionOperatorSchema,
+	value: union([
+		string(),
+		number(),
+		boolean(),
+		array(union([string(), number()]))
+	])
 });
-/** Shared Zod schemas used across detection capabilities. */
 /**
-* Canonical frame-format enum mirrored on `FrameFormat` in
-* `packages/types/src/types/io.ts`. Kept inline (vs imported) so the
-* Zod runtime schema and TypeScript type stay in sync at the call site
-* — adding a new format requires changing both this enum and the
-* `FrameFormat` type alias together.
+* The expression leaf, declared as a plain object rather than an intersection
+* with {@link ExpressionSourceSchema}: a discriminated union has to be able to
+* read `kind` off each option, and an intersection hides it. The author-time
+* validation is the SAME function `ExpressionSourceSchema` runs, so the two
+* cannot drift — an expression that one accepts, the other accepts.
 */
-var FrameFormatSchema = _enum([
-	"jpeg",
-	"rgb",
-	"bgr",
-	"yuv420",
-	"gray"
-]);
-var FrameInputSchema = object({
-	data: custom(),
-	format: FrameFormatSchema,
-	width: number(),
+var AutomationConditionExpressionSchema = object({
+	kind: literal("expression"),
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+var AutomationConditionSchema = lazy(() => discriminatedUnion("kind", [
+	object({
+		kind: literal("all"),
+		children: array(AutomationConditionSchema)
+	}),
+	object({
+		kind: literal("any"),
+		children: array(AutomationConditionSchema)
+	}),
+	object({
+		kind: literal("not"),
+		child: AutomationConditionSchema
+	}),
+	AutomationConditionLeafSchema,
+	AutomationConditionExpressionSchema
+]));
+/**
+* What starts a run.
+*
+* D8 compliance, and it is the reason `device-state` is not merely an event
+* subscription: the trigger evaluates against the **state mirror**, which is
+* reconciled, and an event only WAKES the evaluation. A dropped event therefore
+* DELAYS a trigger; it does not lose it. `schedule` uses `croner` — the one
+* already in the repo — because `setInterval(24h)` drifts and "at 23:30" does
+* not.
+*/
+var AutomationTriggerSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("device-state"),
+		deviceId: number().int().nonnegative(),
+		cap: string().min(1),
+		fieldPath: string().min(1),
+		/** Fire when the field takes this value. Omit to fire on any change. */
+		becomes: union([
+			string(),
+			number(),
+			boolean()
+		]).optional(),
+		/** Only on a CHANGE of value, not on every re-report. */
+		edge: boolean().optional(),
+		/** The condition must hold this long before the run starts. */
+		forMs: number().int().min(0).max(864e5).optional(),
+		/** Collapse a burst into one run. */
+		debounceMs: number().int().min(0).max(6e5).optional()
+	}),
+	object({
+		kind: literal("device-event"),
+		/** An `EventCategory` value. */
+		category: string().min(1),
+		deviceId: number().int().nonnegative().optional()
+	}),
+	object({
+		kind: literal("schedule"),
+		cron: string().min(1).max(120)
+	}),
+	object({ kind: literal("manual") })
+]);
+/**
+* One action step.
+*
+* `wait` and `cap` are `NcRuleActionSchema`'s two members, kept structurally
+* identical so `NcRuleActionRunner` runs them unchanged — its device-scope
+* check, stop-at-first-failure and per-sequence throttle are the whole reason
+* to reuse it, and none of them are re-implemented here.
+*
+* **The one divergence, and it is forced.** `NcRuleActionSchema.cap.deviceId` is
+* a literal `z.number().int()`, and the NC runner's own `RunSequencesInput`
+* documents its subject device as *"for the log tag, never for routing"*. So an
+* NC action can never target the device that triggered it — which is fine for
+* the NC (its rules already scope to a device) and fatal for an automation
+* ("sound the siren of the camera that saw the person"). `deviceId` therefore
+* also accepts `{ $var }`, resolved from the run's `vars` bag BEFORE the runner
+* is called. The runner still receives a number and is untouched; the
+* resolution is the recipe's job, not the runner's.
+*/
+var AutomationActionSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("wait"),
+		seconds: number().min(0).max(300)
+	}),
+	object({
+		kind: literal("cap"),
+		deviceId: union([number().int(), object({ $var: string().min(1) })]),
+		cap: string().min(1),
+		method: string().min(1),
+		/** Values may carry `{{vars.x}}` slots, which SUBSTITUTE and do not
+		*  evaluate (§3.2.3). Anything beyond substitution is the expression leaf. */
+		args: record(string(), unknown()).optional()
+	}),
+	object({
+		kind: literal("code"),
+		/** Compiled into the automation's OWN block by esbuild — not a third
+		*  runtime, not a `vm`, and not dynamically evaluated. */
+		code: string().min(1).max(2e4)
+	})
+]);
+object({
+	triggers: array(AutomationTriggerSchema),
+	conditions: AutomationConditionSchema.optional(),
+	actions: array(AutomationActionSchema)
+});
+/**
+* `addon-pages` — system-scoped singleton aggregator cap. Public-facing
+* surface that admin-ui consumes through `useAddonPagesListPages()`.
+*
+* The provider iterates every `addon-pages-source` (collection) provider
+* and emits `AddonPageInfo[]` enriched with versioned `bundleUrl` strings
+* pointing at `/api/addon-pages/<addonId>/<bundle>?v=<mtime>`. The
+* filesystem `mtime` cache-buster lets the browser pick up addon
+* rebuilds without manual reload.
+*
+* The hub-local builtin `addon-pages-aggregator` (see
+* `@camstack/system/builtins/addon-pages-aggregator`) registers the
+* provider. Splitting the public aggregator from the raw collection
+* keeps both ends in codegen — there's no hand-written
+* `addon-pages.router.ts` wrapper anymore.
+*/
+var AddonPageDeclarationSchema$1 = object({
+	id: string(),
+	label: string(),
+	icon: string(),
+	path: string(),
+	remoteName: string(),
+	bundle: string(),
+	section: string().optional(),
+	sectionLabel: string().optional()
+});
+var AddonPageInfoSchema = object({
+	addonId: string(),
+	page: AddonPageDeclarationSchema$1,
+	bundleUrl: string()
+});
+method(_void(), array(AddonPageInfoSchema).readonly());
+/**
+* `addon-pages-source` — collection cap exposing per-provider raw page
+* declarations. Every addon that contributes a UI page registers a
+* provider here. The hub-side singleton aggregator (`addon-pages` cap,
+* see `addon-pages.cap.ts`) walks this collection, stamps versioned
+* `bundleUrl` values, and returns the enriched `AddonPageInfo[]` list
+* that admin-ui consumes.
+*
+* The split exists because the public listing has a different output
+* shape than the per-provider raw declarations, and we want both ends
+* to flow through codegen instead of relying on a hand-written wrapper.
+*/
+var AddonPageDeclarationSchema = object({
+	id: string(),
+	label: string(),
+	icon: string(),
+	path: string(),
+	/**
+	* Module Federation remote name — must match the `name` field on the
+	* page addon's `federation()` plugin config. Used by admin-ui's
+	* `<AddonPageLoader>` to call `loadRemote('<remoteName>/page')`.
+	* Conventionally `addon_<id>_page` (snake_case; MF names cannot
+	* contain hyphens).
+	*/
+	remoteName: string(),
+	/**
+	* Bundle filename inside the addon's `dist/` dir served at
+	* `/api/addon-pages/<addonId>/<bundle>`. With Module Federation this
+	* is always `'remoteEntry.js'`; the value is kept on the metadata so
+	* the static-file route can compute an mtime-based cache-buster URL
+	* without a separate filesystem stat.
+	*/
+	bundle: string(),
+	/**
+	* Sidebar section this page docks into. Well-known ids: `'detection'`,
+	* `'cluster'`, `'administration'` — the page renders inside that group.
+	* Any OTHER string creates (or joins) a custom section rendered after
+	* the built-in groups; its label comes from `sectionLabel` (first
+	* declaration wins), falling back to the id. Absent → the legacy
+	* "Addon Pages" group.
+	*/
+	section: string().optional(),
+	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
+	sectionLabel: string().optional()
+});
+method(_void(), array(AddonPageDeclarationSchema).readonly());
+var AddonHttpRouteSchema = object({
+	method: _enum([
+		"GET",
+		"POST",
+		"PUT",
+		"DELETE",
+		"PATCH"
+	]),
+	path: string(),
+	access: _enum([
+		"public",
+		"authenticated",
+		"admin"
+	]).optional(),
+	description: string().optional()
+});
+/**
+* Cross-process route invocation envelope. The hub captures the
+* request as plain data, ships it to the worker via Moleculer, and
+* the worker runs the local handler against a capturing reply. The
+* envelope returned describes what the handler intended (status,
+* headers, body, or a redirect) so the hub can translate it back to
+* the Fastify reply that's actually wired to the socket.
+*/
+var InvokeRequestSchema = object({
+	method: string(),
+	path: string(),
+	params: record(string(), string()),
+	query: record(string(), string()),
+	body: unknown(),
+	headers: record(string(), string()),
+	user: object({
+		id: string(),
+		username: string(),
+		isAdmin: boolean()
+	}).optional(),
+	scopedToken: unknown().optional()
+});
+var InvokeReplyEnvelopeSchema = object({
+	status: number().int(),
+	headers: record(string(), string()),
+	/** When set, the hub MUST `reply.redirect(redirectUrl)` instead of
+	*  sending `body`. Status defaults to 302 when this is set unless
+	*  the handler called `reply.code(...)` explicitly. */
+	redirectUrl: string().nullable(),
+	/** JSON-serializable body. `undefined` is treated as "no body". */
+	body: unknown().optional(),
+	/** Set when the handler called `reply.type(mime)`. */
+	contentType: string().optional()
+});
+method(_void(), array(AddonHttpRouteSchema)), method(InvokeRequestSchema, InvokeReplyEnvelopeSchema, { kind: "mutation" });
+var ConfigTabDeclarationSchema = object({
+	id: string(),
+	label: string(),
+	icon: string(),
+	order: number().optional()
+});
+var ConfigSectionWithValuesSchema = object({
+	id: string(),
+	title: string(),
+	description: string().optional(),
+	style: _enum(["card", "accordion"]).optional(),
+	defaultCollapsed: boolean().optional(),
+	columns: union([
+		literal(1),
+		literal(2),
+		literal(3),
+		literal(4)
+	]).optional(),
+	tab: string().optional(),
+	location: _enum(["settings", "top-tab"]).optional(),
+	order: number().optional(),
+	fields: array(any())
+});
+var SettingsSchemaWithValuesSchema = object({
+	tabs: array(ConfigTabDeclarationSchema).optional(),
+	sections: array(ConfigSectionWithValuesSchema)
+});
+/** Patch object — keys are field names, values are the new field values. */
+var SettingsPatchSchema = record(string(), unknown());
+/** Standard success response for update operations. */
+var SettingsUpdateResultSchema = object({ success: literal(true) });
+method(object({
+	addonId: string(),
+	nodeId: string().optional(),
+	overlay: record(string(), unknown()).optional(),
+	cap: string().optional()
+}), SettingsSchemaWithValuesSchema.nullable()), method(object({
+	addonId: string(),
+	nodeId: string().optional(),
+	patch: SettingsPatchSchema
+}), SettingsUpdateResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	addonId: string(),
+	deviceId: number(),
+	nodeId: string().optional()
+}), SettingsSchemaWithValuesSchema.nullable()), method(object({
+	addonId: string(),
+	deviceId: number(),
+	nodeId: string().optional(),
+	patch: SettingsPatchSchema
+}), SettingsUpdateResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* `addon-widgets-source` — collection cap exposing per-addon raw widget
+* declarations. Mirrors the addon-pages split: every addon shipping
+* widgets registers a provider on this collection cap; the hub-local
+* aggregator (`addon-widgets`, see `addon-widgets.cap.ts`) walks the
+* collection, stamps versioned `bundleUrl`s onto each declaration, and
+* exposes the public listing surface that admin-ui consumes.
+*
+* The split exists because the public listing has a different output
+* shape (flat enriched metadata with `addonId` + `bundleUrl`) than the
+* per-provider raw declarations. Both ends flow through codegen.
+*
+* Unified UI-contribution model (Task 10): a widget descriptor IS a
+* `UiContribution` with `kind:'remote'`. The host renders it through the
+* same `ContributionRenderer` / Module-Federation path as every other
+* contributed UI surface — no bespoke widget-rendering path. The widget-
+* only metadata (sizing hints, `requires`) lives as extra fields on the
+* descriptor; the `UiContribution` core (`tab` / `label` / `order` /
+* `kind` / `remote`) carries identity + placement + the MF remote.
+*/
+/** Where the widget makes sense to render — maps to a contribution `tab`. */
+var WidgetHostEnum = _enum([
+	"device-tab",
+	"dashboard",
+	"integration-detail"
+]);
+var WidgetSizeEnum = _enum([
+	"xs",
+	"sm",
+	"md",
+	"lg",
+	"xl"
+]);
+/**
+* MF remote descriptor — mirrors `UiContributionRemote` from
+* `capability-definition.ts`. Widget remotes expose a single
+* `'./widgets'` module whose default export is a
+* `Record<componentKey, Component>` map; `componentKey` (the widget
+* `stableId`) picks the entry the host mounts.
+*/
+var WidgetRemoteSchema = object({
+	remoteName: string(),
+	exposedModule: string(),
+	componentKey: string().optional()
+});
+/**
+* One widget declaration — a `UiContribution` (`kind:'remote'`) plus
+* widget-only metadata. The `UiContribution` core fields:
+*
+*  - `tab`     — where the widget hosts. A widget that runs on the
+*                dashboard declares `tab:'dashboard'`; a device-tab
+*                widget declares the target device-detail tab id.
+*  - `subTab`  — optional sub-tab within `tab`.
+*  - `label`   — operator-facing label.
+*  - `order`   — ordering within `(tab, subTab)`.
+*  - `kind`    — always `'remote'` for widgets.
+*  - `remote`  — the MF remote `{ remoteName, exposedModule, componentKey }`.
+*
+* Widget-only fields retained alongside the contribution core:
+*
+*  - `stableId`      — stable identity within the addon (the MF
+*                      `componentKey`; kept top-level so consumers have
+*                      a stable key without reaching into `remote`).
+*  - `description` / `icon` — picker metadata.
+*  - `bundle`        — entry filename inside the addon `dist/` dir; the
+*                      aggregator stamps a versioned `bundleUrl` from it.
+*  - `hosts`         — every host the widget supports (a widget can run
+*                      both on the dashboard and a device tab). `tab`
+*                      is the PRIMARY host; `hosts` is the full set the
+*                      picker filters on.
+*  - `requires`      — host-context requirements validated at mount.
+*  - `defaultSize` / `allowedSizes` / `defaultColumns` / `defaultRows`
+*                    — dashboard placement hints.
+*/
+var WidgetMetadataSchema = object({
+	/** Primary host tab — `'dashboard'`, `'device-tab'`, or a device-detail tab id. */
+	tab: string(),
+	/** Optional sub-tab within `tab`. */
+	subTab: string().optional(),
+	/** Operator-facing label. */
+	label: string(),
+	/** Ordering within `(tab, subTab)`, ascending. */
+	order: number().optional(),
+	/** Always `'remote'` — a widget is a Module Federation remote. */
+	kind: literal("remote"),
+	/** MF remote descriptor. */
+	remote: WidgetRemoteSchema,
+	/** Stable id within the addon — kebab-case. Equals `remote.componentKey`. */
+	stableId: string(),
+	description: string().optional(),
+	icon: string().optional(),
+	/**
+	* Bundle filename inside the addon's `dist/` dir served at
+	* `/api/addon-widgets/<addonId>/<bundle>`. With Module Federation
+	* this is always `'remoteEntry.js'` — the value is kept on the
+	* metadata so the static-file route can compute an mtime-based
+	* cache-buster URL without a separate filesystem stat.
+	*/
+	bundle: string(),
+	/** Every host the widget supports. The picker filters on this set. */
+	hosts: array(WidgetHostEnum).readonly(),
+	/** Required props the host must supply. Validated at `<WidgetSlot>` mount. */
+	requires: object({
+		deviceContext: boolean().default(false),
+		integrationContext: boolean().default(false)
+	}),
+	/**
+	* Loadable BEFORE authentication. The normal widget registry listing
+	* (`addon-widgets.listWidgets`) is auth-gated, so a pre-auth surface
+	* (the login page) cannot discover a widget through it. A widget that
+	* declares `preAuth: true` marks itself as safe to mount on a pre-auth
+	* screen — it is surfaced through the PUBLIC `auth.listLoginMethods`
+	* login-method contribution channel (see `login-method.cap.ts`) rather
+	* than the authenticated registry, and its bundle is served by the
+	* public `/api/addon-widgets/:addonId/*` static route. Defaults false.
+	*/
+	preAuth: boolean().optional().default(false),
+	/** Dashboard placement HINTS (operator can override per instance). */
+	defaultSize: WidgetSizeEnum.default("md"),
+	allowedSizes: array(WidgetSizeEnum).readonly().default([
+		"sm",
+		"md",
+		"lg"
+	]),
+	defaultColumns: number().int().min(1).max(12).default(6),
+	defaultRows: number().int().min(1).max(12).default(1)
+});
+method(_void(), array(WidgetMetadataSchema).readonly());
+/**
+* `addon-widgets` — system-scoped singleton aggregator cap. Public-facing
+* surface that admin-ui consumes through `useAddonWidgetsListWidgets()`.
+*
+* The provider iterates every `addon-widgets-source` (collection)
+* provider and emits `EnrichedWidgetMetadata[]` enriched with versioned
+* `bundleUrl` strings pointing at
+* `/api/addon-widgets/<addonId>/<bundle>?v=<mtime>`. The filesystem
+* `mtime` cache-buster lets the browser pick up addon rebuilds without
+* manual reload — same scheme used by `addon-pages`.
+*
+* The hub-local builtin `addon-widgets-aggregator` (see
+* `@camstack/system/builtins/addon-widgets-aggregator`) registers the
+* provider. Splitting the public aggregator from the raw collection
+* keeps both ends in codegen — there's no hand-written wrapper.
+*/
+var EnrichedWidgetMetadataSchema = WidgetMetadataSchema.extend({
+	addonId: string(),
+	bundleUrl: string()
+});
+method(_void(), array(EnrichedWidgetMetadataSchema).readonly());
+/**
+* Alerts capability — collection-based internal alert system.
+*
+* Multiple providers can register. Each provider filters by EventBus category
+* and creates/updates alerts. The built-in Alert Center addon persists alerts
+* in the DB and serves them to the admin UI.
+*/
+var AlertSeveritySchema = _enum([
+	"info",
+	"success",
+	"warning",
+	"error"
+]);
+var AlertStatusSchema = _enum([
+	"active",
+	"in-progress",
+	"completed",
+	"failed",
+	"dismissed"
+]);
+var AlertSourceSchema = object({
+	type: string(),
+	id: string()
+});
+var AlertSchema = object({
+	id: string(),
+	category: string(),
+	severity: AlertSeveritySchema,
+	title: string(),
+	message: string(),
+	status: AlertStatusSchema,
+	progress: number().optional(),
+	read: boolean(),
+	createdAt: number(),
+	updatedAt: number(),
+	source: AlertSourceSchema.optional(),
+	metadata: record(string(), unknown()).optional()
+});
+method(AlertSchema, _void(), { kind: "mutation" }), method(object({
+	alertId: string(),
+	patch: AlertSchema.partial()
+}), _void(), { kind: "mutation" }), method(object({
+	unreadOnly: boolean().optional(),
+	limit: number().optional()
+}).optional(), array(AlertSchema).readonly()), method(_void(), number()), method(object({ alertId: string() }), _void(), { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(object({ alertId: string() }), _void(), { kind: "mutation" });
+DeviceType.Camera, method(object({ deviceId: number() }), custom()), object({
+	deviceId: number(),
+	rms: number(),
+	dbfs: number()
+});
+/** Shared Zod schemas used across detection capabilities. */
+/**
+* Canonical frame-format enum mirrored on `FrameFormat` in
+* `packages/types/src/types/io.ts`. Kept inline (vs imported) so the
+* Zod runtime schema and TypeScript type stay in sync at the call site
+* — adding a new format requires changing both this enum and the
+* `FrameFormat` type alias together.
+*/
+var FrameFormatSchema = _enum([
+	"jpeg",
+	"rgb",
+	"bgr",
+	"yuv420",
+	"gray"
+]);
+var FrameInputSchema = object({
+	data: custom(),
+	format: FrameFormatSchema,
+	width: number(),
 	height: number(),
 	timestamp: number()
 });
@@ -8912,6 +9819,69 @@ var StreamFormatSchema = _enum([
 	"mjpeg",
 	"rtsp"
 ]);
+/** A container `produceEventMedia` can emit. */
+var EventMediaKindSchema = _enum(["mp4", "gif"]);
+/**
+* One produced artifact, referenced by HANDLE.
+*
+* Never inline bytes: a produced clip is 200 KB–5 MB and every consumer of this
+* method is in another runner ([D9](../../../../docs/decisions/adr-0009.md),
+* [D18](../../../../docs/decisions/adr-0018.md) — cross-process media is fetched
+* on demand, compressed, by handle). `bytes` is here so a caller can decide
+* whether it wants the fetch at all.
+*/
+var EventMediaArtifactSchema = object({
+	kind: EventMediaKindSchema,
+	/** Opaque, single-camera, short-lived. Redeem with `fetchEventMedia`. */
+	handle: string(),
+	/**
+	* The node holding the bytes — the ROUTING key for `fetchEventMedia`.
+	*
+	* `stream-broker` is a singleton cap and an unpinned call never leaves the
+	* hub, so a handle produced on an agent's broker would be redeemed against
+	* the hub's store and come back `null`. Same contract, same field name and
+	* the same reason as `FrameHandleSchema.nodeId`: the producer stamps where it
+	* lives and the consumer pins to it.
+	*/
+	nodeId: string(),
+	mime: string(),
+	bytes: number().int(),
+	width: number().int(),
+	height: number().int()
+});
+/**
+* What a production actually covered — the answer to the only question an
+* operator asks about a notification clip.
+*
+* `fromTs`/`toTs` are WALL CLOCK, derived from the ring's own packet timeline,
+* so a caller can state "this clip starts 4.1 s before the event" instead of
+* inferring it from a duration. A production whose `fromTs` is later than the
+* event is a production with no pre-roll, and that is exactly the defect this
+* method exists to make visible rather than plausible.
+*/
+var EventMediaCoverageSchema = object({
+	fromTs: number(),
+	toTs: number(),
+	/** Encoded packets in the muxed window. */
+	packets: number().int()
+});
+/**
+* The result of ONE cut, in every container the caller asked for.
+*
+* Every artifact in `media` came out of the SAME window of the SAME rendition —
+* that is the whole reason this is one method rather than one call per format.
+* A consumer attaching a gif and a video can no longer show two different
+* moments, because it never chose two sources.
+*/
+var EventMediaProductionSchema = object({
+	media: array(EventMediaArtifactSchema).readonly(),
+	coverage: EventMediaCoverageSchema,
+	/** The rendition actually cut from — what the default or the fallback chose. */
+	profile: CamProfileSchema,
+	/** `copy` = the camera's own H.264, untouched. `encode` = re-encoded (H.265
+	*  source, a downscale, or a playback rate other than 1). */
+	video: _enum(["copy", "encode"])
+});
 var RtspRestreamEntrySchema = object({
 	brokerId: string(),
 	url: string(),
@@ -9311,6 +10281,56 @@ method(object({
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	/** Absent = the largest H.264 rendition at or below 1080p, which is
+	*  also the one that can be copied. Falls back to whatever the ring
+	*  actually retained, and the answer says which. */
+	profile: CamProfileSchema.optional(),
+	aroundMs: number(),
+	preSeconds: number().min(0).max(20).default(4),
+	postSeconds: number().min(0).max(20).default(6),
+	kinds: array(EventMediaKindSchema).min(1).default(["mp4"]),
+	/** GIF geometry. The video keeps the source's own. */
+	gifMaxWidth: number().int().min(120).max(1280).default(640),
+	/**
+	* The gif's own PLAYBACK rate in frames per second — what the finished
+	* gif runs at, not how many source frames feed it. The decimation that
+	* feeds it samples `gifFps / gifSpeed` source frames per second, so at
+	* the defaults a 12 fps gif is built out of 3 source frames a second.
+	*/
+	gifFps: number().int().min(1).max(15).default(12),
+	/**
+	* How fast the GIF plays against real time, independent of `speed`.
+	*
+	* 4× by default, by operator request: a notification gif is glanced at
+	* on a lock screen, so a ~12 s window has to be over in ~3 s. It stays
+	* a separate knob from `speed` even though both now default to 4 —
+	* a caller wanting a real-time video and a fast gif must not have to
+	* choose.
+	*/
+	gifSpeed: number().min(1).max(8).default(4),
+	/**
+	* Playback rate of the VIDEO. Also 4× by default, by operator decision.
+	*
+	* `1` is real time and is the ONLY value that allows the copy branch —
+	* anything else forces `libx264` over the window. That was priced
+	* before it was chosen: a per-event burst measured at 0.23 s and 254 KB
+	* on a real 615 720p cut, against 922 KB for the copy it replaces. A
+	* re-encode is capped at 720p (`EVENT_CLIP_ENCODE_MAX_WIDTH`), because
+	* once the decode is forced the width stops being free.
+	*/
+	speed: number().min(1).max(8).default(4)
+}), EventMediaProductionSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ handle: string() }), object({
+	base64: string(),
+	mime: string(),
+	bytes: number().int()
+}).nullable(), {
+	kind: "mutation",
+	auth: "admin"
 }), method(_void(), array(CameraStreamSchema).readonly()), method(_void(), array(ProfileSlotSchema).readonly()), method(object({ brokerId: string() }), BrokerStatsSchema), method(object({ brokerId: string() }), object({
 	probed: boolean(),
 	summary: string()
@@ -9383,7 +10403,25 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ brokerId: string() }), boolean()), object({
+}), method(object({ brokerId: string() }), boolean()), method(object({ deviceId: number().int() }), object({
+	muted: boolean(),
+	/**
+	* How many live non-derived brokers currently hold the mute. Purely
+	* diagnostic: `muted` is the policy and is authoritative on its own
+	* (it applies to brokers that do not exist yet), while this says
+	* whether anything is presently being silenced.
+	*/
+	appliedBrokers: number().int().nonnegative()
+})), method(object({
+	deviceId: number().int(),
+	muted: boolean()
+}), object({
+	muted: boolean(),
+	appliedBrokers: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), object({
 	deviceId: number().int().nonnegative(),
 	camStreamId: string(),
 	profile: CamProfileSchema
@@ -9580,25 +10618,6 @@ var cameraStreamsCapability = {
 		lastChangedAt: number()
 	})
 };
-/**
-* core-blocks — user-authored TypeScript, stored in the kernel and executed in
-* its own process.
-*
-* Spec: `docs/superpowers/specs/2026-08-04-core-blocks-and-synthetic-devices-design.md`.
-*
-* The first use is **owning devices without being a device provider**: a block
-* declares devices under a system or custom integration and drives their state,
-* with the same `ctx` an addon gets. Automations come later; nothing here
-* models a trigger.
-*
-* **Stated plainly, because it does not change by being true:** a block has an
-* addon's powers — devices, storage, the event bus, `ctx.api`. It is a plugin
-* with no review step. What makes that survivable is not a sandbox, it is
-* PROCESS ISOLATION: one process per block, supervised by `CrashSupervisor`,
-* so a block that throws or never returns is marked `failed` and visible
-* instead of taking the hub with it (D6). Every method here is admin-only, and
-* must stay so.
-*/
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
@@ -9670,6 +10689,9 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 }), object({ block: CoreBlockSchema }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ blockId: string() }), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ code: string() }), CoreBlockCompileResultSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -10206,843 +11228,248 @@ var deviceDiscoveryCapability = {
 	}
 };
 /**
-* `device-adoption` — generic discovery + adoption surface,
-* system-scoped singleton. The de-HA-ified successor to `ha-discovery`:
-* keyed by `integrationId` (the addon resolves integrationId → broker
-* internally) rather than a connection-specific `brokerId`, and it
-* REUSES the shared `DiscoveredChildDevice` candidate type from
-* `device-discovery.cap.ts` so a single shared adoption panel renders
-* any integration's candidate tree.
-*
-* UI flow (Integrations page → integration detail):
-*   1. `listCandidates({integrationId, page, pageSize, filter})` →
-*      paginated candidate list, each row collapsed.
-*   2. User expands a row → `getCandidate({integrationId,
-*      childNativeId})` returns the single candidate (with its nested
-*      `children`) for the accordion render.
-*   3. User clicks "Adopt" on one or more candidates →
-*      `adopt({integrationId, childNativeIds, perCandidate?})`
-*      materialises one parent CamStack device per candidate plus its
-*      accessory children. `perCandidate[childNativeId]` carries an
-*      optional display-name override + a `hiddenChildIds` pre-hide set
-*      (the parent's `accessories.hiddenChildIds` gates UI visibility).
-*   4. User clicks "Release" → `release({integrationId, camDeviceId})`
-*      removes the parent + every child from the kernel registry.
-*/
-/**
-* Provider-declared discovery *granularity* filter (the keystone of the
-* single-entity-import design). A provider advertises which discovery
-* granularities it supports via `listCandidateFilters`; the operator picks
-* one and it is passed back as the opaque `filter` string on
-* `listCandidates`/`adopt`.
-*
-* - **`id`** is provider-defined and OPAQUE to the cap + UI layers — only the
-*   declaring provider interprets it. The reserved id `'devices'` is the
-*   universal default (every provider's current behavior IS the `devices`
-*   filter). A provider that declares no filters is treated as a single
-*   implicit `{ id:'devices', label:'Devices', isDefault:true }`.
-* - **`label`** is the human label for the UI selector.
-* - **`isDefault`** marks the default filter; exactly one SHOULD be default.
-*/
-var AdoptionFilterSchema = object({
-	id: string(),
-	label: string(),
-	isDefault: boolean().optional()
-});
-/**
-* Candidate-list TEXT/query filter. Mirrors the prior `ha-discovery` filter,
-* de-HA-ified — `area` / `manufacturer` stay free-form strings so any
-* integration can populate them from its own metadata. Distinct from the
-* granularity `AdoptionFilter` above: this narrows the candidate set within a
-* chosen granularity, whereas the granularity `filter` selects WHAT a
-* candidate is (a device vs an entity).
-*/
-var CandidateQueryFilterSchema = object({
-	/** Substring filter on name + manufacturer + model. */
-	search: string().optional(),
-	/** Area-name exact match. */
-	area: string().optional(),
-	/** Manufacturer exact match. */
-	manufacturer: string().optional(),
-	/** When true, only return candidates the operator already adopted. */
-	adoptedOnly: boolean().optional(),
-	/** When true, only return candidates the operator hasn't adopted yet. */
-	unadoptedOnly: boolean().optional()
-});
-var ListCandidatesInputSchema = object({
-	integrationId: string(),
-	page: number().int().positive().default(1),
-	pageSize: number().int().positive().max(2e4).default(50),
-	/**
-	* Optional provider-declared discovery GRANULARITY id (opaque; see
-	* `AdoptionFilterSchema`). Omitted = the reserved `'devices'` granularity =
-	* exactly the pre-existing behavior (fully back-compatible).
-	*/
-	filter: string().optional(),
-	/** Optional candidate-list text/query narrowing within the granularity. */
-	filterText: CandidateQueryFilterSchema.optional()
-});
-var ListCandidatesOutputSchema = object({
-	candidates: array(DiscoveredChildDeviceSchema).readonly(),
-	totalCount: number().int().nonnegative(),
-	page: number().int().positive(),
-	pageSize: number().int().positive()
-});
-var GetCandidateInputSchema = object({
-	integrationId: string(),
-	childNativeId: string()
-});
-var AdoptionStatusSchema = object({
-	/** Last refresh timestamp (ms epoch) — null when never refreshed. */
-	lastDiscoveryAt: number().int().nonnegative().nullable(),
-	/** Count of candidates in the discovery cache. */
-	candidateCount: number().int().nonnegative(),
-	/** Count of candidates the operator has already adopted. */
-	adoptedCount: number().int().nonnegative(),
-	/** Last error message from a refresh attempt. */
-	lastError: string().nullable()
-});
-var PerCandidateSchema = object({
-	/** Override the default display name for this candidate's parent. */
-	name: string().min(1).optional(),
-	/** Pre-hide a subset of entity-children — created (state still flows)
-	*  but listed in the parent's `accessories.hiddenChildIds`. */
-	hiddenChildIds: array(string()).optional()
-});
-var AdoptInputSchema = object({
-	integrationId: string(),
-	/**
-	* Candidate native ids to adopt. Their MEANING is filter-relative: under the
-	* default `'devices'` granularity these are device-native ids; under a
-	* provider-declared granularity (e.g. HA `'entities'`) they are that
-	* granularity's native ids (e.g. entity ids). The field name is kept stable
-	* to avoid a breaking rename.
-	*/
-	childNativeIds: array(string()).min(1),
-	/**
-	* Optional provider-declared discovery GRANULARITY id (opaque; see
-	* `AdoptionFilterSchema`). Omitted = the reserved `'devices'` granularity =
-	* exactly the pre-existing behavior (fully back-compatible).
-	*/
-	filter: string().optional(),
-	/** When true, import each adopted device's source-system location (e.g. HA
-	*  area) into CamStack — fuzzy-match an existing location or create it, then
-	*  assign. Omitted/false = no location work (back-compat). */
-	importLocations: boolean().optional(),
-	perCandidate: record(string(), PerCandidateSchema).optional()
-});
-var AdoptResultSchema = object({ adopted: array(object({
-	childNativeId: string(),
-	parentDeviceId: number().int().nonnegative(),
-	accessoryDeviceIds: array(number().int().nonnegative()).readonly()
-})).readonly() });
-var ReleaseInputSchema = object({
-	integrationId: string(),
-	/** Parent CamStack device id (NOT an accessory child id). Removing
-	*  the parent cascades into every accessory. */
-	camDeviceId: number().int().nonnegative()
-});
-var ResyncInputSchema = object({
-	/** Parent CamStack device id of an adopted device. The provider resolves its
-	*  source (integration/broker + native id) and re-aligns the device's
-	*  structural spec (type/role/capabilities/units) with the live mapping,
-	*  rebuilding any child whose class changed while preserving operator edits. */
-	camDeviceId: number().int().nonnegative(),
-	/** "Resync from zero" (#19). When true, the kernel PURGES every accessory
-	*  child of `camDeviceId` BEFORE the provider re-derives the device, so the
-	*  children are rebuilt fresh from source — correct names, coords, and units —
-	*  instead of being preserved by the incremental reconcile. Use to recover from
-	*  legacy generic/placeholder names that the normal name-precedence keeps frozen
-	*  (the operator's explicit reset). Push-driven integrations (no-op resync)
-	*  rebuild on their next snapshot; pull/command integrations rebuild in `resync`.
-	*  Operator edits on the PARENT (its name, layout, primary-child pick) survive —
-	*  only the children are torn down. Omitted/false ⇒ the normal incremental
-	*  re-sync that preserves children. */
-	resetToSource: boolean().optional()
-});
-var ResyncResultSchema = object({
-	/** True when the persisted spec actually changed (children may have been rebuilt). */
-	changed: boolean(),
-	/** Number of child devices rebuilt into a new class by this re-sync. */
-	rebuiltChildren: number().int().nonnegative(),
-	/** Number of accessory children torn down by a `resetToSource` purge before the
-	*  provider re-derived the device. 0/absent for a normal incremental re-sync. */
-	removedChildren: number().int().nonnegative().optional()
-});
-method(object({ integrationId: string() }), object({ filters: array(AdoptionFilterSchema) }), { auth: "admin" }), method(ListCandidatesInputSchema, ListCandidatesOutputSchema, { auth: "admin" }), method(GetCandidateInputSchema, DiscoveredChildDeviceSchema.nullable(), { auth: "admin" }), method(object({ integrationId: string() }), AdoptionStatusSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(AdoptInputSchema, AdoptResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(ReleaseInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(ResyncInputSchema, ResyncResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
-* `device-export` — collection cap for addons that export camstack
-* devices to external ecosystems (HomeAssistant via MQTT discovery,
-* HomeKit/HAP, Alexa Smart Home, …).
-*
-* No `ecosystem` enum — the addon id identifies the export target.
-* Each addon owns its mapping logic in its own settings UI. The cap
-* exposes only the COMMON surface: link state, supported device
-* kinds (so the UI can filter the device picker), and per-device
-* expose/unexpose.
-*/
-var LinkStateSchema = _enum([
-	"unlinked",
-	"linked",
-	"error"
-]);
-/**
-* A single label/value row surfaced in the export panel's "Setup"
-* section. Rendered with a copy-to-clipboard button. `secret: true`
-* rows are masked by default with a reveal toggle (client ids,
-* secrets, …).
-*/
-var ExportSetupFieldSchema = object({
-	label: string(),
-	value: string(),
-	/** Mask the value by default + render a reveal toggle (client id, secrets). */
-	secret: boolean().optional()
-});
-/**
-* Generic, addon-agnostic pairing/account block. Any export addon can
-* surface a scannable QR, a set of copyable label/value rows, and a
-* free-form operator note — the `DeviceExportPanel` renders whatever
-* the provider supplies and skips the section entirely when `setup`
-* is unset.
-*/
-var ExportSetupSchema = object({
-	/** A string to render as a scannable QR — HAP `X-HM://…` URI, a pairing URL, etc. Omitted when there's nothing to scan. */
-	qr: string().optional(),
-	/** Label/value rows shown with a copy button (HAP setup code, OAuth URLs, client id, linked-account count, …). */
-	fields: array(ExportSetupFieldSchema).readonly().optional(),
-	/** Free-form operator instructions rendered above the fields. */
-	note: string().optional()
-});
-var DeviceExportStatusSchema = object({
-	linkState: LinkStateSchema,
-	exposedDeviceCount: number(),
-	error: string().optional(),
-	/**
-	* Optional pairing/account info the panel renders in a generic
-	* "Setup" section. Addon-agnostic — the addon id identifies the
-	* export target, never an `ecosystem` key here.
-	*/
-	setup: ExportSetupSchema.optional()
-});
-var DeviceKindSchema = string();
-var ExposedDeviceSchema = object({
-	deviceId: string(),
-	exposedAs: string().optional(),
-	capabilities: array(string()).optional()
-});
-var ExposeInputSchema = object({
-	deviceId: string(),
-	capabilities: array(string()).optional()
-});
-var UnexposeInputSchema = object({ deviceId: string() });
-method(_void(), DeviceExportStatusSchema), method(_void(), array(DeviceKindSchema)), method(_void(), array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), { kind: "mutation" }), method(UnexposeInputSchema, _void(), { kind: "mutation" });
-/**
-* Resource-bound constants for the safe expression engine.
-*
-* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
-* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
-* O(nodeCount) by construction. These caps merely put a hard ceiling on the
-* work a single author-supplied expression can request, so a hostile or
-* accidental pathological string can never spend unbounded CPU/memory.
-*/
-/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
-*  rejected without allocation. */
-var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
-/** A legal binding / identifier name. */
-var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Binding names an author may NOT use: `now` is auto-injected; the literal
-*  keywords lex as values, not identifiers, so binding to them is meaningless. */
-var RESERVED_BINDING_NAMES = new Set([
-	"now",
-	"true",
-	"false",
-	"null"
-]);
-/**
-* Error types for the safe expression engine. Two distinct classes so callers
-* can tell a compile-time (grammar) failure from a runtime (evaluation)
-* failure — both are non-fatal to the host: read paths degrade to "skip link".
-*/
-/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
-*  the failure is anchored to a character (author-facing inline feedback). */
-var ExpressionParseError = class extends Error {
-	position;
-	constructor(message, position) {
-		super(message);
-		this.name = "ExpressionParseError";
-		this.position = position;
-	}
-};
-/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
-*  result, unknown builtin, step-budget exceeded). */
-var ExpressionEvalError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ExpressionEvalError";
-	}
-};
-/**
-* Frozen, null-prototype builtin function table for the expression engine
-* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
-* parser rejects any callee not in it, and the evaluator gates each call on an
-* own-property check against it.
-*
-* Because the object has a NULL prototype AND is `Object.freeze`d:
-*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
-*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
-*    (there is no `Object.prototype` in the chain), so those names are not
-*    callable — they are simply "unknown function" at parse time.
-*
-* Every numeric argument is validated as a finite number and every numeric
-* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
-* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
-* closed rather than emitting a garbage value.
-*/
-function asFiniteNumber(value, name, index) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
-	return value;
-}
-function asString$1(value, name, index) {
-	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
-	return value;
-}
-function finiteResult(value, name) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
-	return value;
-}
-function allFiniteNumbers(args, name) {
-	return args.map((a, idx) => asFiniteNumber(a, name, idx));
-}
-var INF = Number.POSITIVE_INFINITY;
-var table = {
-	min: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
-	},
-	max: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
-	},
-	abs: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
-	},
-	floor: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
-	},
-	ceil: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
-	},
-	sqrt: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
-	},
-	round: {
-		minArgs: 1,
-		maxArgs: 2,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "round", 0);
-			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
-			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
-			const factor = 10 ** digits;
-			return finiteResult(Math.round(x * factor) / factor, "round");
-		}
-	},
-	pow: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
-	},
-	clamp: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "clamp", 0);
-			const lo = asFiniteNumber(args[1], "clamp", 1);
-			const hi = asFiniteNumber(args[2], "clamp", 2);
-			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
-			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
-		}
-	},
-	avg: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const nums = allFiniteNumbers(args, "avg");
-			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
-		}
-	},
-	sum: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
-	},
-	coalesce: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			for (const a of args) if (a !== null) return a;
-			return null;
-		}
-	},
-	age: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
-	},
-	convert: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args, hooks) => {
-			const x = asFiniteNumber(args[0], "convert", 0);
-			const from = asString$1(args[1], "convert", 1).trim();
-			const to = asString$1(args[2], "convert", 2).trim();
-			if (hooks.convert) {
-				const out = hooks.convert(x, from, to);
-				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
-				return finiteResult(out, "convert");
-			}
-			if (from === to) return x;
-			throw new ExpressionEvalError("convert: unit conversion table not installed");
-		}
-	}
-};
-Object.freeze(Object.assign(Object.create(null), table));
-/** The set of valid builtin names — used by the parser to reject unknown
-*  callees at parse time (immediate author feedback). */
-var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
-/**
-* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
-* zero-dependency. The grammar is deliberately boring: decimal numbers,
-* single/double-quoted strings with a tiny escape set, identifiers, the three
-* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
-* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
-* is a parse error with a source position, so member access / assignment /
-* template literals are lexically impossible.
-*/
-var KEYWORDS = new Set([
-	"true",
-	"false",
-	"null"
-]);
-function isDigit(ch) {
-	return ch >= "0" && ch <= "9";
-}
-function isIdentStart(ch) {
-	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
-}
-function isIdentPart(ch) {
-	return isIdentStart(ch) || isDigit(ch);
-}
-function isWhitespace(ch) {
-	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
-}
-/** Tokenize `source` into a flat token list ending with a single `eof` token.
-*  Throws `ExpressionParseError` on any illegal character or unterminated
-*  string. */
-function tokenize(source) {
-	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
-	const tokens = [];
-	let i = 0;
-	const n = source.length;
-	while (i < n) {
-		const ch = source[i];
-		if (isWhitespace(ch)) {
-			i += 1;
-			continue;
-		}
-		if (isDigit(ch)) {
-			const start = i;
-			while (i < n && isDigit(source[i])) i += 1;
-			if (i < n && source[i] === ".") {
-				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
-				i += 1;
-				while (i < n && isDigit(source[i])) i += 1;
-			}
-			const text = source.slice(start, i);
-			const value = Number(text);
-			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
-			tokens.push({
-				type: "number",
-				value,
-				pos: start
-			});
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			const quote = ch;
-			const start = i;
-			i += 1;
-			let out = "";
-			let closed = false;
-			while (i < n) {
-				const c = source[i];
-				if (c === "\\") {
-					const next = i + 1 < n ? source[i + 1] : "";
-					if (next === "\\" || next === "'" || next === "\"") {
-						out += next;
-						i += 2;
-						continue;
-					}
-					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
-				}
-				if (c === quote) {
-					closed = true;
-					i += 1;
-					break;
-				}
-				out += c;
-				i += 1;
-			}
-			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
-			tokens.push({
-				type: "string",
-				value: out,
-				pos: start
-			});
-			continue;
-		}
-		if (isIdentStart(ch)) {
-			const start = i;
-			while (i < n && isIdentPart(source[i])) i += 1;
-			const text = source.slice(start, i);
-			if (KEYWORDS.has(text)) tokens.push({
-				type: "keyword",
-				keyword: keywordOf(text),
-				pos: start
-			});
-			else tokens.push({
-				type: "identifier",
-				name: text,
-				pos: start
-			});
-			continue;
-		}
-		const two = i + 1 < n ? source.slice(i, i + 2) : "";
-		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
-			tokens.push({
-				type: "punct",
-				punct: two,
-				pos: i
-			});
-			i += 2;
-			continue;
-		}
-		if (isSinglePunct(ch)) {
-			tokens.push({
-				type: "punct",
-				punct: ch,
-				pos: i
-			});
-			i += 1;
-			continue;
-		}
-		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
-	}
-	tokens.push({
-		type: "eof",
-		pos: n
-	});
-	return tokens;
-}
-function keywordOf(text) {
-	if (text === "true") return "true";
-	if (text === "false") return "false";
-	return "null";
-}
-function isSinglePunct(ch) {
-	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
-}
-/**
-* Pratt (precedence-climbing) parser for the safe expression mini-language.
-*
-* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
-* → relational → additive → multiplicative → unary `! -` → call / primary.
-* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
-* string validated against the builtin table at parse time, so an unknown
-* function is rejected immediately (author feedback) and a persisted expression
-* that references a since-removed builtin degrades at read.
-*
-* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
-* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
-*/
-/** Binary/logical operator precedence (higher binds tighter). */
-var BINARY_PRECEDENCE = {
-	"||": 1,
-	"&&": 2,
-	"==": 3,
-	"!=": 3,
-	"<": 4,
-	"<=": 4,
-	">": 4,
-	">=": 4,
-	"+": 5,
-	"-": 5,
-	"*": 6,
-	"/": 6,
-	"%": 6
-};
-function isLogicalOp(op) {
-	return op === "&&" || op === "||";
-}
-function isBinaryOp(op) {
-	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
-}
-var Parser = class {
-	tokens;
-	pos = 0;
-	nodeCount = 0;
-	identifiers = /* @__PURE__ */ new Set();
-	callees = /* @__PURE__ */ new Set();
-	constructor(tokens) {
-		this.tokens = tokens;
-	}
-	parse() {
-		const ast = this.parseTernary();
-		const tok = this.peek();
-		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
-		return {
-			ast,
-			identifiers: this.identifiers,
-			callees: this.callees,
-			nodeCount: this.nodeCount
-		};
-	}
-	peek() {
-		return this.tokens[this.pos];
-	}
-	next() {
-		return this.tokens[this.pos++];
-	}
-	/** Consume a punctuator token, erroring if the next token isn't it. */
-	expectPunct(punct) {
-		const tok = this.peek();
-		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
-		this.pos += 1;
-	}
-	matchPunct(punct) {
-		const tok = this.peek();
-		if (tok.type === "punct" && tok.punct === punct) {
-			this.pos += 1;
-			return true;
-		}
-		return false;
-	}
-	countNode() {
-		this.nodeCount += 1;
-		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
-	}
-	parseTernary() {
-		const test = this.parseBinary(1);
-		if (this.matchPunct("?")) {
-			const consequent = this.parseTernary();
-			this.expectPunct(":");
-			const alternate = this.parseTernary();
-			this.countNode();
-			return {
-				kind: "conditional",
-				test,
-				consequent,
-				alternate
-			};
-		}
-		return test;
-	}
-	parseBinary(minPrec) {
-		let left = this.parseUnary();
-		for (;;) {
-			const tok = this.peek();
-			if (tok.type !== "punct") break;
-			const prec = BINARY_PRECEDENCE[tok.punct];
-			if (prec === void 0 || prec < minPrec) break;
-			const op = tok.punct;
-			this.pos += 1;
-			const right = this.parseBinary(prec + 1);
-			this.countNode();
-			if (isLogicalOp(op)) left = {
-				kind: "logical",
-				op,
-				left,
-				right
-			};
-			else if (isBinaryOp(op)) left = {
-				kind: "binary",
-				op,
-				left,
-				right
-			};
-			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
-		}
-		return left;
-	}
-	parseUnary() {
-		const tok = this.peek();
-		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
-			const op = tok.punct;
-			this.pos += 1;
-			const operand = this.parseUnary();
-			this.countNode();
-			return {
-				kind: "unary",
-				op,
-				operand
-			};
-		}
-		return this.parsePrimary();
-	}
-	parsePrimary() {
-		const tok = this.next();
-		switch (tok.type) {
-			case "number":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "string":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "keyword":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.keyword === "null" ? null : tok.keyword === "true"
-				};
-			case "identifier": {
-				const nextTok = this.peek();
-				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
-				this.identifiers.add(tok.name);
-				this.countNode();
-				return {
-					kind: "identifier",
-					name: tok.name
-				};
-			}
-			case "punct":
-				if (tok.punct === "(") {
-					const inner = this.parseTernary();
-					this.expectPunct(")");
-					return inner;
-				}
-				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
-			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
-		}
-	}
-	parseCall(callee, pos) {
-		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
-		this.expectPunct("(");
-		const args = [];
-		if (!this.matchPunct(")")) for (;;) {
-			args.push(this.parseTernary());
-			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
-			if (this.matchPunct(",")) continue;
-			this.expectPunct(")");
-			break;
-		}
-		this.callees.add(callee);
-		this.countNode();
-		return {
-			kind: "call",
-			callee,
-			args
-		};
-	}
-};
-/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
-*  `ExpressionParseError` on any lexical or grammatical failure. */
-function parseExpression(source) {
-	return new Parser(tokenize(source)).parse();
-}
+* `device-adoption` — generic discovery + adoption surface,
+* system-scoped singleton. The de-HA-ified successor to `ha-discovery`:
+* keyed by `integrationId` (the addon resolves integrationId → broker
+* internally) rather than a connection-specific `brokerId`, and it
+* REUSES the shared `DiscoveredChildDevice` candidate type from
+* `device-discovery.cap.ts` so a single shared adoption panel renders
+* any integration's candidate tree.
+*
+* UI flow (Integrations page → integration detail):
+*   1. `listCandidates({integrationId, page, pageSize, filter})` →
+*      paginated candidate list, each row collapsed.
+*   2. User expands a row → `getCandidate({integrationId,
+*      childNativeId})` returns the single candidate (with its nested
+*      `children`) for the accordion render.
+*   3. User clicks "Adopt" on one or more candidates →
+*      `adopt({integrationId, childNativeIds, perCandidate?})`
+*      materialises one parent CamStack device per candidate plus its
+*      accessory children. `perCandidate[childNativeId]` carries an
+*      optional display-name override + a `hiddenChildIds` pre-hide set
+*      (the parent's `accessories.hiddenChildIds` gates UI visibility).
+*   4. User clicks "Release" → `release({integrationId, camDeviceId})`
+*      removes the parent + every child from the kernel registry.
+*/
 /**
-* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
-* by expr"). The cache stores BOTH successes and failures (negative caching),
-* so a corrupt persisted string costs exactly one tokenize+parse total — not
-* one per read on a hot resolve path.
+* Provider-declared discovery *granularity* filter (the keystone of the
+* single-entity-import design). A provider advertises which discovery
+* granularities it supports via `listCandidateFilters`; the operator picks
+* one and it is passed back as the opaque `filter` string on
+* `listCandidates`/`adopt`.
 *
-* The cache is a module-level singleton: entries are pure, content-addressed
-* ASTs keyed by the raw source string, so sharing one instance across all
-* callers is safe and maximises hit rate.
+* - **`id`** is provider-defined and OPAQUE to the cap + UI layers — only the
+*   declaring provider interprets it. The reserved id `'devices'` is the
+*   universal default (every provider's current behavior IS the `devices`
+*   filter). A provider that declares no filters is treated as a single
+*   implicit `{ id:'devices', label:'Devices', isDefault:true }`.
+* - **`label`** is the human label for the UI selector.
+* - **`isDefault`** marks the default filter; exactly one SHOULD be default.
 */
-var cache = /* @__PURE__ */ new Map();
-function getCached(source) {
-	const hit = cache.get(source);
-	if (hit !== void 0) {
-		cache.delete(source);
-		cache.set(source, hit);
-		return hit;
-	}
-	let result;
-	try {
-		result = {
-			ok: true,
-			parsed: parseExpression(source)
-		};
-	} catch (err) {
-		result = {
-			ok: false,
-			error: err instanceof ExpressionParseError ? err.message : String(err)
-		};
-	}
-	cache.set(source, result);
-	if (cache.size > 256) {
-		const oldest = cache.keys().next().value;
-		if (oldest !== void 0) cache.delete(oldest);
-	}
-	return result;
-}
-/** Compile `source`, returning a discriminated result instead of throwing.
-*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
-function compileExpressionSafe(source) {
-	return getCached(source);
-}
-Object.freeze({});
+var AdoptionFilterSchema = object({
+	id: string(),
+	label: string(),
+	isDefault: boolean().optional()
+});
 /**
-* Author-time validation. Returns `null` when the source is valid, else a
-* human-readable error message. Checks: the expression compiles; binding count
-* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
-* is not reserved (`now`/keywords) and does not shadow a builtin; and every
-* FREE identifier of the AST is covered by a binding or the injected `now`.
+* Candidate-list TEXT/query filter. Mirrors the prior `ha-discovery` filter,
+* de-HA-ified — `area` / `manufacturer` stay free-form strings so any
+* integration can populate them from its own metadata. Distinct from the
+* granularity `AdoptionFilter` above: this narrows the candidate set within a
+* chosen granularity, whereas the granularity `filter` selects WHAT a
+* candidate is (a device vs an entity).
 */
-function validateExpressionSource(src) {
-	const names = Object.keys(src.bindings);
-	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
-	for (const name of names) {
-		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
-		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
-		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
-	}
-	const compiled = compileExpressionSafe(src.expr);
-	if (!compiled.ok) return compiled.error;
-	const bound = new Set(names);
-	for (const id of compiled.parsed.identifiers) {
-		if (id === "now") continue;
-		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
-	}
-	return null;
-}
+var CandidateQueryFilterSchema = object({
+	/** Substring filter on name + manufacturer + model. */
+	search: string().optional(),
+	/** Area-name exact match. */
+	area: string().optional(),
+	/** Manufacturer exact match. */
+	manufacturer: string().optional(),
+	/** When true, only return candidates the operator already adopted. */
+	adoptedOnly: boolean().optional(),
+	/** When true, only return candidates the operator hasn't adopted yet. */
+	unadoptedOnly: boolean().optional()
+});
+var ListCandidatesInputSchema = object({
+	integrationId: string(),
+	page: number().int().positive().default(1),
+	pageSize: number().int().positive().max(2e4).default(50),
+	/**
+	* Optional provider-declared discovery GRANULARITY id (opaque; see
+	* `AdoptionFilterSchema`). Omitted = the reserved `'devices'` granularity =
+	* exactly the pre-existing behavior (fully back-compatible).
+	*/
+	filter: string().optional(),
+	/** Optional candidate-list text/query narrowing within the granularity. */
+	filterText: CandidateQueryFilterSchema.optional()
+});
+var ListCandidatesOutputSchema = object({
+	candidates: array(DiscoveredChildDeviceSchema).readonly(),
+	totalCount: number().int().nonnegative(),
+	page: number().int().positive(),
+	pageSize: number().int().positive()
+});
+var GetCandidateInputSchema = object({
+	integrationId: string(),
+	childNativeId: string()
+});
+var AdoptionStatusSchema = object({
+	/** Last refresh timestamp (ms epoch) — null when never refreshed. */
+	lastDiscoveryAt: number().int().nonnegative().nullable(),
+	/** Count of candidates in the discovery cache. */
+	candidateCount: number().int().nonnegative(),
+	/** Count of candidates the operator has already adopted. */
+	adoptedCount: number().int().nonnegative(),
+	/** Last error message from a refresh attempt. */
+	lastError: string().nullable()
+});
+var PerCandidateSchema = object({
+	/** Override the default display name for this candidate's parent. */
+	name: string().min(1).optional(),
+	/** Pre-hide a subset of entity-children — created (state still flows)
+	*  but listed in the parent's `accessories.hiddenChildIds`. */
+	hiddenChildIds: array(string()).optional()
+});
+var AdoptInputSchema = object({
+	integrationId: string(),
+	/**
+	* Candidate native ids to adopt. Their MEANING is filter-relative: under the
+	* default `'devices'` granularity these are device-native ids; under a
+	* provider-declared granularity (e.g. HA `'entities'`) they are that
+	* granularity's native ids (e.g. entity ids). The field name is kept stable
+	* to avoid a breaking rename.
+	*/
+	childNativeIds: array(string()).min(1),
+	/**
+	* Optional provider-declared discovery GRANULARITY id (opaque; see
+	* `AdoptionFilterSchema`). Omitted = the reserved `'devices'` granularity =
+	* exactly the pre-existing behavior (fully back-compatible).
+	*/
+	filter: string().optional(),
+	/** When true, import each adopted device's source-system location (e.g. HA
+	*  area) into CamStack — fuzzy-match an existing location or create it, then
+	*  assign. Omitted/false = no location work (back-compat). */
+	importLocations: boolean().optional(),
+	perCandidate: record(string(), PerCandidateSchema).optional()
+});
+var AdoptResultSchema = object({ adopted: array(object({
+	childNativeId: string(),
+	parentDeviceId: number().int().nonnegative(),
+	accessoryDeviceIds: array(number().int().nonnegative()).readonly()
+})).readonly() });
+var ReleaseInputSchema = object({
+	integrationId: string(),
+	/** Parent CamStack device id (NOT an accessory child id). Removing
+	*  the parent cascades into every accessory. */
+	camDeviceId: number().int().nonnegative()
+});
+var ResyncInputSchema = object({
+	/** Parent CamStack device id of an adopted device. The provider resolves its
+	*  source (integration/broker + native id) and re-aligns the device's
+	*  structural spec (type/role/capabilities/units) with the live mapping,
+	*  rebuilding any child whose class changed while preserving operator edits. */
+	camDeviceId: number().int().nonnegative(),
+	/** "Resync from zero" (#19). When true, the kernel PURGES every accessory
+	*  child of `camDeviceId` BEFORE the provider re-derives the device, so the
+	*  children are rebuilt fresh from source — correct names, coords, and units —
+	*  instead of being preserved by the incremental reconcile. Use to recover from
+	*  legacy generic/placeholder names that the normal name-precedence keeps frozen
+	*  (the operator's explicit reset). Push-driven integrations (no-op resync)
+	*  rebuild on their next snapshot; pull/command integrations rebuild in `resync`.
+	*  Operator edits on the PARENT (its name, layout, primary-child pick) survive —
+	*  only the children are torn down. Omitted/false ⇒ the normal incremental
+	*  re-sync that preserves children. */
+	resetToSource: boolean().optional()
+});
+var ResyncResultSchema = object({
+	/** True when the persisted spec actually changed (children may have been rebuilt). */
+	changed: boolean(),
+	/** Number of child devices rebuilt into a new class by this re-sync. */
+	rebuiltChildren: number().int().nonnegative(),
+	/** Number of accessory children torn down by a `resetToSource` purge before the
+	*  provider re-derived the device. 0/absent for a normal incremental re-sync. */
+	removedChildren: number().int().nonnegative().optional()
+});
+method(object({ integrationId: string() }), object({ filters: array(AdoptionFilterSchema) }), { auth: "admin" }), method(ListCandidatesInputSchema, ListCandidatesOutputSchema, { auth: "admin" }), method(GetCandidateInputSchema, DiscoveredChildDeviceSchema.nullable(), { auth: "admin" }), method(object({ integrationId: string() }), AdoptionStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(AdoptInputSchema, AdoptResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(ReleaseInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(ResyncInputSchema, ResyncResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* `device-export` — collection cap for addons that export camstack
+* devices to external ecosystems (HomeAssistant via MQTT discovery,
+* HomeKit/HAP, Alexa Smart Home, …).
+*
+* No `ecosystem` enum — the addon id identifies the export target.
+* Each addon owns its mapping logic in its own settings UI. The cap
+* exposes only the COMMON surface: link state, supported device
+* kinds (so the UI can filter the device picker), and per-device
+* expose/unexpose.
+*/
+var LinkStateSchema = _enum([
+	"unlinked",
+	"linked",
+	"error"
+]);
+/**
+* A single label/value row surfaced in the export panel's "Setup"
+* section. Rendered with a copy-to-clipboard button. `secret: true`
+* rows are masked by default with a reveal toggle (client ids,
+* secrets, …).
+*/
+var ExportSetupFieldSchema = object({
+	label: string(),
+	value: string(),
+	/** Mask the value by default + render a reveal toggle (client id, secrets). */
+	secret: boolean().optional()
+});
+/**
+* Generic, addon-agnostic pairing/account block. Any export addon can
+* surface a scannable QR, a set of copyable label/value rows, and a
+* free-form operator note — the `DeviceExportPanel` renders whatever
+* the provider supplies and skips the section entirely when `setup`
+* is unset.
+*/
+var ExportSetupSchema = object({
+	/** A string to render as a scannable QR — HAP `X-HM://…` URI, a pairing URL, etc. Omitted when there's nothing to scan. */
+	qr: string().optional(),
+	/** Label/value rows shown with a copy button (HAP setup code, OAuth URLs, client id, linked-account count, …). */
+	fields: array(ExportSetupFieldSchema).readonly().optional(),
+	/** Free-form operator instructions rendered above the fields. */
+	note: string().optional()
+});
+var DeviceExportStatusSchema = object({
+	linkState: LinkStateSchema,
+	exposedDeviceCount: number(),
+	error: string().optional(),
+	/**
+	* Optional pairing/account info the panel renders in a generic
+	* "Setup" section. Addon-agnostic — the addon id identifies the
+	* export target, never an `ecosystem` key here.
+	*/
+	setup: ExportSetupSchema.optional()
+});
+var DeviceKindSchema = string();
+var ExposedDeviceSchema = object({
+	deviceId: string(),
+	exposedAs: string().optional(),
+	capabilities: array(string()).optional()
+});
+var ExposeInputSchema = object({
+	deviceId: string(),
+	capabilities: array(string()).optional()
+});
+var UnexposeInputSchema = object({ deviceId: string() });
+method(_void(), DeviceExportStatusSchema), method(_void(), array(DeviceKindSchema)), method(_void(), array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), { kind: "mutation" }), method(UnexposeInputSchema, _void(), { kind: "mutation" });
 var ProviderStatusSchema = object({
 	connected: boolean(),
 	deviceCount: number(),
@@ -11222,92 +11649,6 @@ var ChildLayoutEntrySchema = object({
 	order: number().optional(),
 	collapsed: boolean().optional()
 });
-/** Cap-wire shape of a DeviceLink — structurally mirrors `DeviceLink` in
-*  `device-management.ts`. Source is a union: a FIELD source copies a sibling
-*  accessory's status field (`kind` optional/absent for wire compat); a
-*  LITERAL source carries a per-device constant (no sibling is read); a
-*  GLOBAL source (P2e) copies ANY device's status field, addressed by the
-*  source device's full re-sync-stable `stableId`. */
-var DeviceLinkFieldSourceSchema = object({
-	kind: literal("field").optional(),
-	sourceKey: string(),
-	cap: string(),
-	fieldPath: string()
-});
-var DeviceLinkLiteralSourceSchema = object({
-	kind: literal("literal"),
-	value: union([
-		string(),
-		number(),
-		boolean(),
-		_null()
-	])
-});
-var DeviceLinkGlobalSourceSchema = object({
-	kind: literal("global"),
-	sourceStableId: string(),
-	cap: string(),
-	fieldPath: string()
-});
-/** Expression source (Stage X): compute the target field from N named bindings
-*  via the safe expression engine. Bindings are field | literal | global — never
-*  another expression (no nesting). The `superRefine` runs the SAME author-time
-*  validation as `validateExpressionSource` (compiles the expr, checks binding
-*  names + identifier coverage) so every wire boundary that parses a DeviceLink
-*  (tRPC mount, kernel create pre-seed, projection output) validates-at-write.
-*  Compiles are LRU-cached, so repeated validation of the same expr is a hit. */
-var DeviceLinkExpressionSourceSchema = object({
-	kind: literal("expression"),
-	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema
-	]))
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
-});
-var DeviceLinkSchema = object({
-	id: string(),
-	source: union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema,
-		DeviceLinkExpressionSourceSchema
-	]),
-	target: object({
-		cap: string(),
-		fieldPath: string(),
-		itemKey: string().optional()
-	}),
-	transform: discriminatedUnion("kind", [
-		object({ kind: literal("identity") }),
-		object({
-			kind: literal("enum-map"),
-			mapping: record(string(), union([
-				string(),
-				number(),
-				boolean()
-			])),
-			fallback: union([
-				string(),
-				number(),
-				boolean()
-			]).optional()
-		}),
-		object({
-			kind: literal("linear"),
-			scale: number(),
-			offset: number(),
-			clamp: tuple([number(), number()]).readonly().optional()
-		})
-	]).optional()
-});
 /** Cap-wire shape of a per-cap display refinement — mirrors
 *  `DeviceCapDisplayOverride` in `device-management.ts`. */
 var DeviceCapDisplayOverrideSchema = object({
@@ -11387,8 +11728,6 @@ var DeviceInfoSchema = object({
 	*  named accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
 	/** Operator-authored per-device display override. See `DeviceMeta.display`. */
 	display: DeviceDisplayOverrideSchema.optional()
 });
@@ -11397,7 +11736,7 @@ var ConfigEntrySchema = object({
 	value: unknown(),
 	description: string().optional()
 });
-var DeviceLinkModeSchema = _enum(["auto", "manual"]);
+var LinkedDevicesModeSchema = _enum(["auto", "manual"]);
 /** One resolved linked device — the compact projection consumers need. */
 var LinkedDeviceSchema = object({
 	deviceId: number(),
@@ -11460,8 +11799,6 @@ var DeviceMetaSchema = object({
 	*  accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
 	/** Semantic role string (`DeviceRole`) — propagated from the spawn pre-seed.
 	*  Optional: only present for accessory children that carry a known role. */
 	role: string().nullable().optional(),
@@ -11554,12 +11891,6 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	deviceLinks: array(DeviceLinkSchema).readonly()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	display: DeviceDisplayOverrideSchema.nullable()
@@ -11641,7 +11972,7 @@ method(object({
 	*  shipping 293 rows to find 12. */
 	isCamera: boolean().optional()
 }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
-	mode: DeviceLinkModeSchema,
+	mode: LinkedDevicesModeSchema,
 	devices: array(LinkedDeviceSchema)
 })), method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)), method(object({ deviceId: number() }), array(ConfigEntrySchema)), method(object({ deviceId: number() }), ConfigUISchemaOutput), method(object({
 	deviceId: number(),
@@ -11674,11 +12005,7 @@ method(object({
 	deviceId: number(),
 	entries: array(object({
 		capName: string(),
-		kind: _enum([
-			"native",
-			"wrapped",
-			"linked"
-		]),
+		kind: _enum(["native", "wrapped"]),
 		providerAddonId: string(),
 		providerNodeId: string(),
 		nativeAddonId: string()
@@ -11687,11 +12014,7 @@ method(object({
 	deviceId: number(),
 	entries: array(object({
 		capName: string(),
-		kind: _enum([
-			"native",
-			"wrapped",
-			"linked"
-		]),
+		kind: _enum(["native", "wrapped"]),
 		providerAddonId: string(),
 		providerNodeId: string(),
 		nativeAddonId: string()
@@ -11792,6 +12115,15 @@ method(object({
 }), method(ReleaseInputSchema.extend({ addonId: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(AdoptInputSchema.extend({ addonId: string() }), object({ jobId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	addonId: string(),
+	integrationId: string().optional()
+}), array(AdoptionJobSchema).readonly(), { auth: "admin" }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(ResyncInputSchema, ResyncResultSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -12494,7 +12826,7 @@ var MotionAnalysisResultSchema = object({
 	frameHeight: number(),
 	analysisMs: number()
 });
-method(object({
+DeviceType.Camera, method(object({
 	deviceId: number(),
 	frame: FrameInputSchema.optional(),
 	frameHandle: FrameHandleSchema.optional()
@@ -12514,7 +12846,7 @@ method(object({
 * Why: pub/sub routing over the system event-bus loses fidelity
 * (callback shape, QoS guarantees, will/retain semantics) and adds
 * refcount bookkeeping that addons would rather own themselves. The
-* canonical consumer (`addon-export-ha-mqtt`) needs raw `mqtt.js`
+* canonical consumer needs raw `mqtt.js`
 * features anyway — give it the connection config, get out of the way.
 *
 * Consumer flow:
@@ -13707,8 +14039,35 @@ var NcDeliverySchema = _enum([
 	"immediate",
 	"track-end",
 	"device-event",
-	"package-event"
+	"package-event",
+	"system-event"
 ]);
+/**
+* Stable Notification Center vocabulary over infrastructure/liveness events.
+* Bus categories are normalized into these intent-level kinds so rules do not
+* depend on a provider's raw event name or payload shape.
+*/
+var NcSystemEventKindSchema = _enum([
+	"camera-online",
+	"camera-offline",
+	"stream-online",
+	"stream-offline",
+	"node-online",
+	"node-offline",
+	"addon-update-available",
+	"server-update-available"
+]);
+/**
+* One coherent system-event condition. `kinds` is the required opt-in safety
+* gate; the remaining lists are optional narrowing filters relevant to the
+* selected kinds.
+*/
+var NcSystemEventConditionSchema = object({
+	kinds: array(NcSystemEventKindSchema).min(1),
+	deviceIds: array(number().int()).min(1).optional(),
+	nodeIds: array(string().min(1)).min(1).optional(),
+	packageNames: array(string().min(1)).min(1).optional()
+});
 /** Weekly schedule — OR of windows; absence on the rule = always active. */
 var NcScheduleSchema = object({
 	windows: array(object({
@@ -14013,6 +14372,8 @@ var NcConditionsSchema = object({
 		"picked-up",
 		"both"
 	]).optional(),
+	/** Infrastructure/liveness/update event matcher (`system-event` delivery). */
+	systemEvent: NcSystemEventConditionSchema.optional(),
 	/**
 	* PERSONAL-RULE custom zones (viewer-drawn). Inline normalized polygons
 	* (MaskShape vocabulary). A record passes when its bbox overlaps ANY
@@ -14232,7 +14593,8 @@ var NcTestResultSchema = object({
 		"object-event",
 		"track",
 		"device-event",
-		"package-event"
+		"package-event",
+		"system-event"
 	]),
 	deviceId: number(),
 	timestamp: number(),
@@ -14254,7 +14616,8 @@ var NcConditionDescriptorSchema = object({
 		"schedule",
 		"device",
 		"package",
-		"occupancy"
+		"occupancy",
+		"system"
 	]),
 	label: string(),
 	/** Editor widget the UI renders — never hardcode per-condition forms. */
@@ -14272,7 +14635,8 @@ var NcConditionDescriptorSchema = object({
 		"crossingSelect",
 		"polygonDraw",
 		"occupancy",
-		"deviceState"
+		"deviceState",
+		"systemEvent"
 	]),
 	operator: _enum([
 		"in",
@@ -14331,7 +14695,8 @@ var NcHistoryRecordKindSchema = _enum([
 	"object-event",
 	"track-end",
 	"device-event",
-	"package-event"
+	"package-event",
+	"system-event"
 ]);
 /** Subject summary frozen on the row at fire time (survives rule/record edits). */
 var NcHistorySubjectSchema = object({
@@ -14339,7 +14704,14 @@ var NcHistorySubjectSchema = object({
 	label: string().optional(),
 	confidence: number().optional(),
 	zones: array(string()),
-	timestamp: number()
+	timestamp: number(),
+	systemEvent: object({
+		kind: NcSystemEventKindSchema,
+		subject: string(),
+		title: string(),
+		body: string(),
+		data: record(string(), unknown())
+	}).optional()
 });
 /**
 * One delivery-history row. This is a read-only VIEW over the durable
@@ -14699,6 +15071,76 @@ object({
 * Each provider returns a static descriptor; the core enumerates them
 * to validate the `integration=` query param and resolve the consent
 * label + the scopes baked into the issued token.
+*
+* ## Declaring one
+*
+* An OAuth client is integration-specific knowledge — who the client is, what
+* it may ask for, where it may be sent — so it is declared by the ADDON that
+* owns the integration, never by the kernel and never as a branch inside
+* `oauth2-routes.ts` ([D101](../../../../docs/decisions/adr-0101.md)). Three
+* steps, no others:
+*
+* 1. Add `{ "name": "oauth-integration" }` to the addon's `camstack.addons[]`
+*    manifest entry. This is also what tells the hub, at addon-LOAD time, that
+*    a descriptor is owed — see "the boot window" below.
+* 2. Return a provider from `onInitialize()`:
+*
+*    ```ts
+*    const provider: IOauthIntegrationProvider = {
+*      getDescriptor: async () => ({
+*        integrationId: 'my-thing',      // the `integration=` query param
+*        displayName: 'My Thing',
+*        requestedScopes: [ … ],         // see below
+*        allowedRedirectPrefixes: ['https://callback.example/'],
+*      }),
+*    }
+*    return [{ capability: oauthIntegrationCapability, provider }]
+*    ```
+*
+*    The descriptor must be **static** — it is read on the authorize path, so
+*    never put an await on network or disk behind it, and never register it
+*    behind one either (a provider is registered only once `onInitialize`
+*    RETURNS, so anything awaited before the return delays linking).
+* 3. Nothing else. There is no allow-list to join, no id to register with the
+*    core, and no per-integration branch anywhere: `/api/oauth2/authorize` and
+*    `/api/oauth2/integrations` are built from this collection alone.
+*
+* **Scopes. `requestedScopes` has exactly ONE meaning: what the integration
+* NEEDS to function.** Not a blast radius, not a conservative
+* under-declaration, not a description of some other path the addon happens to
+* have. Derive it from what the client actually calls **with this token** —
+* every tRPC path against `METHOD_ACCESS_MAP`, plus an `addon:` grant for every
+* addon HTTP route it posts to — and write the call that justifies each entry
+* next to it. Two integrations once used this field to mean two different
+* things; the operator ruled there is one meaning, and any third integration
+* inherits it (2026-08-09).
+*
+* This is not documentation, it is the ENFORCEMENT INPUT. Since
+* [D103](../../../../docs/decisions/adr-0103.md) the `/addon/:addonId/*` gate
+* checks an integration token's grant before letting it reach an
+* `access: 'authenticated'` route, so an **under-declaration is an integration
+* that stops working** — a missing `addon:` entry means `403 Token scope
+* mismatch` on every control the client tries to actuate. Widen the descriptor
+* honestly rather than weakening a check to make a route pass.
+*
+* Prefer a narrow `capability:` scope to a `category:` one unless the client
+* genuinely needs a whole family; a category scope grants every future member
+* of that category too. `category:system [create]` has been rejected once and
+* should stay rejected: it hands `addons.installPackage` to an integration.
+*
+* Calls the ADDON itself makes over `ctx.api` run as the addon and are not
+* scope-checked, so they are not what this field describes — but reaching the
+* addon's route in the first place IS, and that is the entry to declare.
+*
+* **The boot window.** An addon registers its provider after its runner forks
+* and initialises, so between hub start and that moment this collection is
+* incomplete and an `integrationId` can be legitimately absent. The core does
+* not wait, poll or cache around this ([D3](../../../../docs/decisions/adr-0003.md)):
+* it compares the manifest declarers against the registered providers and
+* answers `503 temporarily_unavailable` (with `Retry-After` and the pending
+* addon ids) instead of `400 unknown integration`, and reports
+* `complete: false` on `GET /api/oauth2/integrations`. A client should retry
+* while the list is incomplete rather than conclude the hub cannot do OAuth.
 */
 var OauthIntegrationDescriptorSchema = object({
 	/** Stable id used as the `integration=` query param, e.g. 'export-alexa'. */
@@ -14711,13 +15153,48 @@ var OauthIntegrationDescriptorSchema = object({
 	*  redirect_uri that does not start with one of these. Required —
 	*  an empty list means the integration can never complete linking. */
 	allowedRedirectPrefixes: array(string()).min(1),
+	/** Paths accepted as a `redirect_uri` when the host is PRIVATE — loopback,
+	*  RFC1918, CGNAT (100.64/10, Tailscale), link-local, IPv6 ULA, or an
+	*  `.local` / `.internal` / `.ts.net` name. Exists for self-hosted clients
+	*  whose address the hub cannot know in advance (a Home Assistant at
+	*  `http://<lan-ip>:8123/auth/external/callback`). The PATH must match
+	*  exactly; a public host never satisfies this branch, so it is not a
+	*  wildcard prefix by another name. */
+	allowedPrivateHostPaths: array(string()).optional(),
+	/** When true this is a PUBLIC client (source is published, no secret can be
+	*  protected) and PKCE is mandatory: `/authorize` refuses without an S256
+	*  `code_challenge`, `/token` refuses without the matching `code_verifier`. */
+	requiresPkce: boolean().optional(),
 	/** Optional public origin (no trailing slash) that this integration's
 	*  issued codes/tokens should carry as the `hubUrl` claim — typically the
 	*  operator-selected external-access endpoint resolved by the addon. When
 	*  present, /api/oauth2/authorize bakes THIS into the code instead of the
 	*  hub-global `publicHubUrl()`, so a forked exporter addon (which can't set
 	*  the hub's env) drives the claim that its cloud Lambda routes back on. */
-	hubUrl: string().optional()
+	hubUrl: string().optional(),
+	/**
+	* How long a REFRESH token issued for this integration lives — seconds, or
+	* `'never'` for a token minted with no `exp` claim at all. Omit to keep the
+	* 30-day default, which is what every link used before this field existed.
+	*
+	* Declared here for the same reason `requestedScopes` is: the integration
+	* knows what it needs. Amazon's account linking and a Home Assistant config
+	* entry are both meant to survive indefinitely, and re-linking is a manual
+	* user action, so a 30-day expiry silently unlinks a working integration.
+	*
+	* **The security posture, stated so it is owned deliberately.** A refresh
+	* token that never expires is permanent access if it leaks. What bounds it is
+	* revocation, not time: `oauthRefresh` re-reads the session on every use and
+	* returns `null` once `revokedAt` is set, as does `oauthVerifyAccessToken`.
+	* The one gap is the ACCESS token — it is a plain signed JWT that nothing
+	* re-checks against the session on the `/trpc` and `/addon/*` paths, so
+	* revoking a link takes effect there only after its remaining hour. That hour
+	* is why the access TTL is not configurable.
+	*
+	* The value is baked into the authorization code at `/authorize` and travels
+	* on the tokens, so editing this field changes FUTURE links only.
+	*/
+	refreshTokenTtlSec: union([number().int().positive(), literal("never")]).optional()
 });
 method(_void(), OauthIntegrationDescriptorSchema);
 /**
@@ -14861,7 +15338,7 @@ var TrackEnvelopeSchema = object({
 * `snapshots[]` references — megabytes across a page of tracks. `slim`
 * keeps every scalar the list surfaces actually render (ids, class(es),
 * label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
-* zonesVisited, bestEventId, envelope) and returns `positions` /
+* zonesVisited, bestEventId, envelope, hasFace) and returns `positions` /
 * `snapshots` as EMPTY arrays — detail views re-fetch the full row via
 * `getTrack`. Mirrors the event-store `projection` convention
 * (`getObjectEvents` et al.).
@@ -14903,6 +15380,30 @@ var TrackSourceSchema = _enum([
 	"audio"
 ]);
 /**
+* Where a track sits in the RETRAIN lifecycle (D81).
+*
+*  - `none` — never marked, or un-marked. Evictable.
+*  - `staging` — the operator wants this track as training material and has not
+*    finished with it. **This is the only state retention holds**: the track and
+*    everything it owns (object events, crops, keyframes, CLIP vector) survive
+*    the device's age window.
+*  - `trained` — the retrain page has taken what it needed. The frames it chose
+*    were COPIED into the retrain dataset at selection time, so the dataset no
+*    longer depends on the track's media and the track becomes EVICTABLE again.
+*    Terminal for the plain `markForTrain` toggle: returning it to `staging` is
+*    a deliberate action of the retrain page, not a side effect of a checkbox.
+*
+* There is no `null`. The state is stored `TEXT NOT NULL DEFAULT 'none'` because
+* the store's filter language has only positive equality and `whereIn` — no
+* negation, no IS NULL — so a NULL would be unselectable by ANY predicate and
+* would make the entire pre-column history immortal in one deploy.
+*/
+var RetrainStatusSchema = _enum([
+	"none",
+	"staging",
+	"trained"
+]);
+/**
 * Per-track OPERATOR flags — set by hand from the admin UI or the viewer, never
 * by the pipeline. Spread into `TrackSchema` and `KeyEventSchema` from one place
 * so the two surfaces cannot drift.
@@ -14912,18 +15413,31 @@ var TrackSourceSchema = _enum([
 * columns existed read as absent, and a consumer that needs a boolean should say
 * `flag === true`, not `flag !== false`.
 *
-* What the flags DO is deliberately UNDEFINED at the time of writing: they are
-* operator curation, and the behaviour they drive will be specified separately.
-* In particular a `markForTrain` track is NOT pinned against retention — see
-* `docs/decisions/adr-0059.md` for why that is a store-level change, not a flag.
+* `markForTrain` is the WIRE FACE of {@link RetrainStatusSchema}, not a column:
+* it is exactly `retrainStatus === 'staging'`, in both directions. Writing
+* `true` moves `none → staging`, writing `false` moves `staging → none`, and a
+* `trained` track reports `false` while refusing both writes. The boolean is
+* kept because three surfaces drive a toggle off it; anything that needs to tell
+* "never marked" from "already trained" must read `retrainStatus`.
+*
+* `debug` does NOT pin; it is attention, not durability.
 */
 var TrackFlagFields = {
-	/** Operator marked this track as training material. */
+	/** Operator marked this track as training material — i.e. `retrainStatus` is
+	*  `'staging'`. */
 	markForTrain: boolean().optional(),
 	/** Operator marked this track for diagnostic attention. */
 	debug: boolean().optional()
 };
 /**
+* The lifecycle field itself, on the READ surfaces only (`Track`, `KeyEvent`).
+* Deliberately NOT part of {@link TrackFlagFields}: that group also builds the
+* write patch, and the status is not something the toggle sets — it is what the
+* toggle's boolean is derived from. Absent on an in-RAM track never touched;
+* always present on a persisted row (the column default materialises `'none'`).
+*/
+var TrackRetrainFields = { retrainStatus: RetrainStatusSchema.optional() };
+/**
 * The write half: a PARTIAL patch. An omitted key is left untouched, so setting
 * one flag can never clear the other — the toggles are independent and are
 * driven from three surfaces that do not know about each other.
@@ -14937,13 +15451,92 @@ var TrackFlagsPatchSchema = object(TrackFlagFields);
 var TrackFlagsSchema = object({
 	trackId: string(),
 	markForTrain: boolean(),
-	debug: boolean()
+	debug: boolean(),
+	/** The lifecycle state the boolean was derived from. Required here (unlike on
+	*  a track row) because this shape is only ever produced by the write body,
+	*  which always knows it — and a surface that has just written needs to render
+	*  `trained` without a re-fetch. */
+	retrainStatus: RetrainStatusSchema
+});
+union([literal(1), literal(2)]);
+/**
+* WHO decided a label, and when. Carried per tier so a value can be traced to
+* the step and model that produced it — which is what makes the write rule
+* arguable after the fact ("why is 592's label `dog` and not `Canis lupus`?")
+* and what lets a migrated, UNATTRIBUTED value be told apart from a real one.
+*
+* `stepId` is the pipeline step id (`animal-classifier`, `bird-classifier`,
+* `plate-ocr`, `face-embedding`, `object-detection`), or the sentinel
+* `migration:4g` for a value the 4g migration moved from the single-slot era —
+* that value has no provenance, and the write rule lets ANY properly-attributed
+* write of the same tier replace it regardless of score.
+*/
+var LabelAttributionSchema = object({
+	stepId: string(),
+	modelId: string().optional(),
+	decidedAt: number()
+});
+/**
+* The TIERED label model (roadmap 4g), spread into `TrackSchema` and
+* `ObjectEventSchema` from ONE place so the two surfaces cannot drift — a
+* track and its events always answer the same question the same way.
+*
+* Two scalar columns, not an array: every consumer wants "the coarse one" or
+* "the fine one", and an array made both a scan. `label` is tier 1, `subLabel`
+* is tier 2, and each carries its own score + attribution.
+*
+* **Reading it.** What a human should be shown is `subLabel ?? label` — the
+* finest thing known. Before 4g the single `label` column held the finest
+* value, so a consumer that has not been updated reads the tier-1 slot and
+* shows nothing on a species-only row; that is why the migration puts every
+* pre-4g value in tier 2 (it cannot regress a display that reads the fallback)
+* and why the read surfaces were changed in the same train.
+*
+* **Writing it.** The slots are independent, which is the whole point: a
+* tier-1 write (`bird`) can never overwrite a tier-2 value (`Turdus
+* migratorius`), so fineness cannot regress by construction. Within a tier the
+* higher score wins. One rule, one implementation — see
+* `pipeline/label-tier.ts` in addon-post-analysis.
+*/
+var TieredLabelFields = {
+	/** Tier 1 — the sub-class. See {@link LabelTierSchema}. */
+	label: string().optional(),
+	/** Confidence of the tier-1 value, as reported by the deciding step. */
+	labelScore: number().optional(),
+	/** Provenance of the tier-1 value. See {@link LabelAttributionSchema}. */
+	labelMeta: LabelAttributionSchema.optional(),
+	/** Tier 2 — the instance. See {@link LabelTierSchema}. */
+	subLabel: string().optional(),
+	/** Confidence of the tier-2 value, as reported by the deciding step. */
+	subLabelScore: number().optional(),
+	/** Provenance of the tier-2 value. See {@link LabelAttributionSchema}. */
+	subLabelMeta: LabelAttributionSchema.optional()
+};
+/** Per-camera slice of a training-export estimate. */
+var TrainingExportDeviceTotalsSchema = object({
+	deviceId: number(),
+	tracks: number().int(),
+	files: number().int(),
+	bytes: number().int()
+});
+/**
+* What a training export WOULD contain. Computed from media index rows only —
+* no blob is read to produce this.
+*/
+var TrainingExportSummarySchema = object({
+	generatedAt: number(),
+	trackCount: number().int(),
+	fileCount: number().int(),
+	byteCount: number().int(),
+	/** More marked tracks exist than a single pass carries. */
+	truncated: boolean(),
+	devices: array(TrainingExportDeviceTotalsSchema).readonly()
 });
 var TrackSchema = object({
 	trackId: string(),
 	deviceId: number(),
 	className: string(),
-	label: string().optional(),
+	...TieredLabelFields,
 	producingDeviceName: string().optional(),
 	/** Track provenance. Absent ⇒ `pipeline` (legacy rows). */
 	source: TrackSourceSchema.optional(),
@@ -14954,8 +15547,26 @@ var TrackSchema = object({
 	/** Periodic snapshots at snapshotIntervalMs cadence (subject to
 	*  saveThumbnails policy). */
 	snapshots: array(TrackSnapshotSchema).readonly(),
-	/** Deduplicated zones the track has entered at least once. */
+	/** Deduplicated zones the track has entered at least once. Zone IDS. */
 	zonesVisited: array(string()).readonly(),
+	/**
+	* Human NAMES for {@link zonesVisited}, resolved at READ time against the
+	* `zones` capability.
+	*
+	* `zonesVisited` persists ids (`cfeec78c-8d69-…`), which no operator can type
+	* and no card can render — so every free-text search surface was structurally
+	* unable to answer "show me the tracks in Uscio", and did not fail loudly, it
+	* just returned nothing. Resolving here rather than in each client keeps ONE
+	* derivation and costs the clients no extra call (the `zones` cap is
+	* per-device, so a client-side resolve would be a per-camera fan-out on a
+	* surface built to avoid exactly that).
+	*
+	* Resolved, never invented: a zone deleted since the track was written has no
+	* name and is DROPPED, so this array can be shorter than `zonesVisited` — the
+	* two are not positionally aligned. Absent when the track visited no zone, or
+	* when the zone catalogue could not be read.
+	*/
+	zoneNames: array(string()).readonly().optional(),
 	/** Deduplicated set of detector classes observed for this track over its
 	*  life (a track may be reclassified, e.g. person→vehicle). Absent on
 	*  legacy rows written before class accumulation shipped. */
@@ -14982,7 +15593,26 @@ var TrackSchema = object({
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
 	envelope: TrackEnvelopeSchema.optional(),
-	...TrackFlagFields
+	/**
+	* A face DETECTOR found a face on this track — nothing more. It says the
+	* detail plane produced a `face` detail; it does NOT say the face was
+	* embedded, matched, above `minFacePx`, or that the recognizer was even
+	* enabled. Set once and never cleared.
+	*
+	* **This exists so "face present but not recognised" is expressible.** A
+	* recognised identity lands in `subLabel` (attributed to the face chain via
+	* `subLabelMeta.stepId`), so before this field a track with an unmatched face
+	* and a track with no face at all were byte-identical on the wire and no
+	* surface could tell them apart. The read is `hasFace === true && subLabel
+	* === undefined`.
+	*
+	* **Absent ≠ false.** Every row written before the column existed omits it,
+	* and so does every server that predates the field — a consumer must test
+	* `=== true` and render nothing otherwise, never infer "no face".
+	*/
+	hasFace: boolean().optional(),
+	...TrackFlagFields,
+	...TrackRetrainFields
 });
 var BaseEventFields = {
 	id: string(),
@@ -15055,7 +15685,7 @@ var ObjectEventSchema = object({
 	/** Omitted in slim projection. */
 	trackId: string().optional(),
 	className: string(),
-	label: string().optional(),
+	...TieredLabelFields,
 	/** Omitted in slim projection. */
 	confidence: number().optional(),
 	/** Heavy JSON — omitted in slim projection. */
@@ -15136,6 +15766,173 @@ var MediaFileSchema = object({
 * stored blob and a `?variant=thumb` rendering without fetching either.
 */
 var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
+/**
+* The MACRO tier of an annotation — a CLOSED set.
+*
+* This is what the exported detector predicts, so a typo here is a new class
+* with one example in it. `label` and `subLabel` are open strings by contrast:
+* the whole point of the page is teaching the model things it does not know
+* yet, and constraining that vocabulary would make it useless.
+*
+* A macro class is NEVER a label. The provider refuses a write whose `label` or
+* `subLabel` is one of these values, in any casing, because once `person`
+* exists in both tiers "every person box" stops being answerable without
+* knowing every string anyone ever typed — and the damage is retroactive.
+*/
+var RetrainMacroClassSchema = _enum([
+	"person",
+	"vehicle",
+	"animal",
+	"package",
+	"face",
+	"plate"
+]);
+/** A subject to learn, or a phantom to unlearn (taught by OMISSION). */
+var RetrainAnnotationKindSchema = _enum(["subject", "model_error"]);
+/** Did a human draw this box, or did the assist propose it? */
+var RetrainAnnotationSourceSchema = _enum(["operator", "assist"]);
+/** Normalised `[0,1]` rectangle against the FULL frame — the canonical form. */
+var RetrainBboxSchema = object({
+	x: number(),
+	y: number(),
+	w: number(),
+	h: number()
+});
+/**
+* One annotated subject.
+*
+* `bbox` is normalised against the full frame, ALWAYS. The per-model shapes
+* (letterboxed root / zone-cropped package / subject-cropped classifier) are
+* derived from it at export and never stored — storing them is how one feature
+* space ends up holding two crops of the same subject (D52).
+*/
+var RetrainAnnotationSchema = object({
+	id: string(),
+	trackId: string(),
+	deviceId: number(),
+	/** The COPY in retrain storage — never the source track's media key. */
+	mediaKey: string(),
+	bbox: RetrainBboxSchema,
+	macroClass: RetrainMacroClassSchema,
+	label: string().optional(),
+	subLabel: string().optional(),
+	kind: RetrainAnnotationKindSchema,
+	source: RetrainAnnotationSourceSchema,
+	/** Which model proposed this box — or, on a `model_error`, drew the phantom. */
+	assistModelId: string().optional(),
+	assistScore: number().optional(),
+	exportedInBatch: string().optional(),
+	createdAt: number()
+});
+/** The write form — the server owns `id`, `createdAt` and the frame binding. */
+var RetrainAnnotationDraftSchema = RetrainAnnotationSchema.omit({
+	id: true,
+	trackId: true,
+	deviceId: true,
+	mediaKey: true,
+	createdAt: true,
+	exportedInBatch: true
+});
+/** A track sitting in `staging`, with everything the worklist needs to rank it. */
+var RetrainTrackSchema = object({
+	trackId: string(),
+	deviceId: number(),
+	className: string(),
+	label: string().optional(),
+	firstSeen: number(),
+	lastSeen: number(),
+	/** How many frames the dataset already holds from this track. */
+	frameCount: number().int(),
+	/** How many subjects have been annotated on those frames. `0` with
+	*  `frameCount: 0` is exactly "staging, still to work". */
+	annotationCount: number().int()
+});
+/** A frame the picker may offer — an index row, no blob was read to produce it. */
+var RetrainFrameCandidateSchema = object({
+	mediaKey: string(),
+	kind: MediaFileKindEnum,
+	timestamp: number(),
+	sizeBytes: number().int(),
+	/** A copy of this original already exists — selecting it is free and cannot
+	*  fail, whatever became of the original. */
+	copied: boolean()
+});
+/** A frame the dataset OWNS: bytes copied at selection time. */
+var RetrainFrameSchema = object({
+	frameId: string(),
+	deviceId: number(),
+	trackId: string(),
+	/** Provenance only. It may already point at nothing — that is expected. */
+	sourceMediaKey: string(),
+	sourceKind: MediaFileKindEnum,
+	sizeBytes: number().int(),
+	width: number().int(),
+	height: number().int(),
+	copiedAt: number()
+});
+/** Why a copy-on-select could not be honoured — named, never a silent skip. */
+var RetrainCopyRefusalSchema = _enum([
+	"source-missing",
+	"unreadable-image",
+	"write-failed"
+]);
+var RetrainFrameSelectionSchema = object({
+	copied: array(RetrainFrameSchema).readonly(),
+	refused: array(object({
+		sourceMediaKey: string(),
+		reason: RetrainCopyRefusalSchema
+	})).readonly()
+});
+var RetrainFrameListSchema = object({
+	candidates: array(RetrainFrameCandidateSchema).readonly(),
+	copies: array(RetrainFrameSchema).readonly(),
+	/** What the page pre-selects — the native key frame when one survives. */
+	autoPickMediaKey: string().optional()
+});
+/** What the operator asked the assist to look for. */
+var RetrainAssistSubjectSchema = discriminatedUnion("kind", [object({
+	kind: literal("package"),
+	zone: RetrainBboxSchema.optional()
+}), object({
+	kind: literal("objects"),
+	modelId: string(),
+	minScore: number().optional()
+})]);
+/**
+* The assist's answer — a discriminated union, because "the model saw nothing"
+* and "this node cannot run that model" lead to different next moves and a
+* nullable result cannot tell them apart.
+*/
+var RetrainAssistResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("proposed"),
+	modelId: string(),
+	stepId: string(),
+	minScore: number(),
+	/** Drafts, ready to edit. `source: 'assist'` until the operator touches one. */
+	proposals: array(RetrainAnnotationDraftSchema).readonly(),
+	/** Returned by the runner but removed by the threshold. */
+	belowThreshold: number().int()
+}), object({
+	kind: literal("refused"),
+	/** `no-zone` is ours; the rest are the runner's own refusal vocabulary. */
+	reason: string(),
+	detail: string().optional()
+})]);
+/** The outcome of a lifecycle move owned by the retrain page. */
+var RetrainTransitionResultSchema = object({
+	trackId: string(),
+	/** Where the track ended up, whatever happened. */
+	retrainStatus: RetrainStatusSchema,
+	/** `false` ⇒ the move was refused or was a no-op; `reason` says which. */
+	changed: boolean(),
+	reason: _enum([
+		"unknown-track",
+		"no-frames-copied",
+		"not-staging",
+		"not-trained",
+		"unchanged"
+	]).optional()
+});
 var DEFAULT_EVENT_QUERY_LIMIT = 1e3;
 var MAX_EVENT_QUERY_LIMIT = 5e3;
 var DeviceEventQueryInput = object({
@@ -15190,13 +15987,14 @@ var KeyEventSchema = object({
 	/** Track start time (firstSeen). */
 	timestamp: number(),
 	className: string(),
-	label: string().optional(),
+	...TieredLabelFields,
 	importance: number(),
 	/** Highest-confidence ObjectEvent id for the track (empty when none). */
 	bestEventId: string(),
 	/** Track lifetime in ms (lastSeen - firstSeen). */
 	windowMs: number().optional(),
-	...TrackFlagFields
+	...TrackFlagFields,
+	...TrackRetrainFields
 });
 object({
 	trackId: string(),
@@ -15457,6 +16255,85 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
 	kind: "query",
 	auth: "admin"
+}), method(object({ deviceIds: array(number()).optional() }), TrainingExportSummarySchema, {
+	kind: "query",
+	auth: "admin"
+}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	/** Empty ⇒ every camera that has staging tracks. A LIST, not a single
+	*  `deviceId`, deliberately: `deviceId` would make this device-bound and
+	*  route it at one camera's owner, and "every camera" would stop being
+	*  expressible at all. */
+	deviceIds: array(number()).optional(),
+	limit: number().int().min(1).max(500).optional()
+}), array(RetrainTrackSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ trackId: string() }), RetrainFrameListSchema, {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	mediaKeys: array(string()).min(1)
+}), RetrainFrameSelectionSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	frameId: string()
+}), object({
+	removed: boolean(),
+	removedAnnotations: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ frameId: string() }), object({
+	base64: string(),
+	width: number().int(),
+	height: number().int()
+}), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	frameId: string(),
+	subject: RetrainAssistSubjectSchema,
+	/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
+	nodeId: string().optional()
+}), RetrainAssistResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ trackId: string() }), array(RetrainAnnotationSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	frameId: string(),
+	annotations: array(RetrainAnnotationDraftSchema)
+}), array(RetrainAnnotationSchema).readonly(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string()
+}), RetrainTransitionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string()
+}), RetrainTransitionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
+	kind: "query",
+	auth: "admin"
 }), method(object({
 	eventId: string(),
 	kind: MediaFileKindEnum.optional()
@@ -16069,6 +16946,22 @@ var DetailResultSchema = object({
 	bbox: NativeCropBboxSchema.optional(),
 	embedding: string().optional(),
 	label: string().optional(),
+	/**
+	* The tier `label` occupies, copied VERBATIM from the producing step's
+	* `StepDefinition.labelTier` (roadmap 4g). Present only when `label` is.
+	*
+	* It rides the wire rather than being resolved by the consumer because the
+	* declaration lives with the step definition, which only the executing node
+	* has: post-analysis holds no step registry, and re-deriving the tier from
+	* `className` there would be exactly the inference this model exists to
+	* forbid. A `label` that arrives WITHOUT this field is refused by the write
+	* rule and logged (`label tier undeclared`) — an older runner therefore
+	* stops enriching rather than guessing, which is why addon-pipeline is
+	* deployed BEFORE addon-post-analysis.
+	*/
+	labelTier: union([literal(1), literal(2)]).optional(),
+	/** Model that produced `label` — carried into the tier's attribution. */
+	labelModelId: string().optional(),
 	alignedCropJpeg: string().optional(),
 	/** Face short side (px) measured on the NATIVE crop surface. The `bbox`
 	*  above is detection-frame px (≈6× smaller on a 4K camera) — min-face-size
@@ -16776,6 +17669,23 @@ var CameraRecordingStatusSchema = object({
 	active: boolean(),
 	storageBytes: number()
 });
+/** One stage of the fan-out that could NOT be read, and how long it cost. */
+var CameraStatusDegradationSchema = object({
+	stage: _enum([
+		"source",
+		"broker",
+		"detection",
+		"recording",
+		"switches"
+	]),
+	reason: _enum([
+		"timeout",
+		"error",
+		"partial"
+	]),
+	/** Wall-clock ms spent on the stage before it was abandoned. */
+	elapsedMs: number()
+});
 /**
 * Aggregated per-camera pipeline status — server-composed, single call.
 *
@@ -16806,9 +17716,28 @@ var CameraStatusSchema = object({
 	* differently — a quiet camera that looks identical to a dead one is the
 	* silence-reads-as-never-happened trap this repo keeps paying for.
 	*
-	* Empty when nothing is off. Never contains a switch no provider offers.
+	* Empty when nothing is off, and never contains a switch no provider offers
+	* — but an empty list is only a POSITIVE claim when `degraded` does not name
+	* `'switches'`. When it does, the switch set could not be read and nothing
+	* here may be rendered as "the operator turned nothing off": that is the
+	* D62 failure (a camera we could not read painted as broken) in the very
+	* field that exists to prevent it.
 	*/
 	switchedOff: array(CameraSwitchIdSchema).readonly(),
+	/**
+	* Stages of the bounded fan-out that were CUT SHORT — a timeout or a
+	* rejection — and whose block is therefore `null` because we could not
+	* READ it, not because there is nothing there.
+	*
+	* Without this, three different facts arrive as the same `null`: "the stage
+	* timed out", "the stage failed", and "this camera legitimately has no
+	* decoder / no recording". Every surface that draws a conclusion from a null
+	* block (or from an empty `switchedOff`) must consult this first; a stage
+	* named here supports no conclusion at all, only "unknown".
+	*
+	* Empty on a clean read — the overwhelmingly common case.
+	*/
+	degraded: array(CameraStatusDegradationSchema).readonly(),
 	/** Unix timestamp (ms) when this snapshot was composed server-side. */
 	fetchedAt: number()
 });
@@ -17371,6 +18300,77 @@ var snapshotCapability = {
 			lastCapturedAt: number().nullable(),
 			cacheAgeMs: number().nullable(),
 			etag: string().nullable()
+		}))),
+		/**
+		* Signed, expiring links to a CLIENT-SIZED frame — and the demand signal
+		* that makes those frames current.
+		*
+		* ## The problem it replaces
+		*
+		* `getSnapshotOverview` is cache-only by contract: it answers from whatever
+		* the wrapper happens to hold and never captures. Under D93 the client
+		* versions its image URL on that answer, and an image REQUEST is what enrols
+		* a camera in the keep-warm loop. Both of those are satisfiable by the
+		* client's own image cache — `expo-image` is URL-keyed and never revalidates
+		* — so a URL painted in a previous session comes off disk with no network,
+		* no enrolment, and nothing warming. Measured on the live hub: reopening
+		* after two minutes idle painted 15 of 16 tiles at **168 s old** with zero
+		* HTTP requests, and the fleet only recovered because a later poll happened
+		* to observe a different identity.
+		*
+		* ## The two properties that fix it
+		*
+		* **It is an RPC, so no client cache can answer it.** The demand signal
+		* always reaches the wrapper. This method therefore MAY create keep-warm
+		* subscriptions, where `getSnapshotOverview` must never (D93) — the
+		* distinction is not "one is newer" but that the overview poll is app-wide
+		* (a creating overview would warm every camera on the install) while this is
+		* called by a rendered surface naming the tiles it is actually painting, at
+		* the width it is painting them.
+		*
+		* **It waits, briefly and boundedly, for the capture it triggered.** The
+		* returned `capturedAt` is the frame the link will serve, not the frame the
+		* cache held when the client asked, so a first paint is honest and current
+		* instead of a generation behind. A device that does not settle inside the
+		* bound still gets a link and its real (older) `capturedAt` — the next poll
+		* carries it forward.
+		*
+		* `force` is never set on behalf of a client here. A sleeping battery camera
+		* is reported with `sleeping: true` and the last frame it produced, however
+		* old; the wrapper's existing sleep gate owns that decision and this method
+		* adds no second one.
+		*/
+		getSnapshotLinks: systemMethod(object({ 
+		/** The tiles a surface is actually rendering. One entry per (device,
+		*  width) the caller will paint — the width is snapped to the server's
+		*  ladder and becomes part of the link's SIGNED identity. */
+targets: array(object({
+			deviceId: number(),
+			/** Target width in px. Omit for the frame as captured — correct
+			*  for a full-bleed surface, wrong (and expensive) for a grid. */
+			width: number().int().positive().optional()
+		})).min(1).max(200) }), array(object({
+			deviceId: number(),
+			/** Root-relative signed path, or null when the link plane is not
+			*  served (no data-plane facility). Present even for a device that has
+			*  never captured — the request is what triggers the first one (D94). */
+			url: string().nullable(),
+			/** Epoch ms of the frame this link serves. Null = never captured.
+			*  THE honest age: the tRPC path carried none before this. */
+			capturedAt: number().nullable(),
+			/** Age of that frame at the moment the answer was built. */
+			ageMs: number().nullable(),
+			/** Epoch ms after which `url` stops verifying. */
+			expiresAt: number().nullable(),
+			/** Ladder rung the bytes are at; null = the frame as captured. */
+			width: number().nullable(),
+			/** The device has never produced a frame. An empty state, not a
+			*  failure — and never a reason to withhold the link (D94). */
+			neverCaptured: boolean(),
+			/** A sleeping battery camera: the frame is deliberately stale and will
+			*  NOT refresh in the background. A surface should say so rather than
+			*  present it as current. */
+			sleeping: boolean()
 		})))
 	},
 	status: {
@@ -17416,13 +18416,35 @@ var SsoBridgeClaimsSchema = object({
 	integrationId: string().optional(),
 	/** JWT ID — unique per issued code; consumed-set enforces single-use. */
 	jti: string().optional(),
+	/** PKCE S256 challenge — set only on `oauth-code` tokens issued to a public
+	*  client. Its PRESENCE is what makes the verifier mandatory at exchange,
+	*  so the requirement travels with the code and not with mutable config. */
+	codeChallenge: string().optional(),
 	/** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
 	*  tokens so the verify path can check the session is not revoked. */
-	sessionId: string().optional()
+	sessionId: string().optional(),
+	/**
+	* The refresh lifetime this LINK was created with, in seconds, or `'never'`.
+	* Baked into the code at `/authorize` from the integration's descriptor and
+	* carried forward so `oauthRefresh` re-mints with the same lifetime. It rides
+	* on the token rather than being re-read from the descriptor on purpose:
+	* editing a descriptor must not retroactively extend or shorten a link the
+	* operator already consented to.
+	*/
+	refreshTtl: union([number().int().positive(), literal("never")]).optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
-	ttlSec: number().int().positive().optional()
+	/**
+	* Seconds, or `'never'` for a token minted with NO `exp` claim.
+	*
+	* `'never'` is a literal rather than `undefined`/`0` because omitting
+	* this field already means "the 5-minute SSO hand-off default", and
+	* `jwt.sign` THROWS on `{ expiresIn: undefined }` — a "no expiry" that
+	* went through the numeric path would fail at mint time and break
+	* linking rather than produce an eternal token.
+	*/
+	ttlSec: union([number().int().positive(), literal("never")]).optional()
 }), object({ token: string() })), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable());
 var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object({
 	providerId: string().min(1),
@@ -17968,7 +18990,7 @@ var ClipPlaybackSchema = object({
 	playbackEndpoints: array(string()).optional(),
 	token: string().optional()
 });
-method(object({
+DeviceType.Camera, method(object({
 	deviceId: number(),
 	since: number(),
 	until: number(),
@@ -19403,6 +20425,37 @@ onColorChanged: { data: object({
 	*/
 	runtimeState: ColorStatusSchema
 };
+var ConnectionTestOutcomeSchema = discriminatedUnion("outcome", [
+	object({
+		outcome: literal("validated"),
+		/** Round-trip of the sign-in, when the provider measured it. */
+		latencyMs: number().nonnegative().optional(),
+		/** Optional human detail worth showing next to the tick
+		*  ("3 devices visible on this account"). */
+		detail: string().optional()
+	}).strict(),
+	object({
+		outcome: literal("rejected"),
+		error: string()
+	}).strict(),
+	object({
+		outcome: literal("inconclusive"),
+		error: string()
+	}).strict()
+]);
+var ConnectionTestInputSchema = object({ 
+/** Candidate integration settings, exactly as the create form collected them. */
+settings: record(string(), unknown()) });
+/**
+* What the provider's test actually DOES, so the UI can say it in words before
+* the operator presses the button ("Signs in to the Dreo cloud"). Purely
+* descriptive — it never changes routing.
+*/
+var ConnectionTestDescriptorSchema = object({ label: string() });
+method(ConnectionTestInputSchema, ConnectionTestOutcomeSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), ConnectionTestDescriptorSchema, { auth: "admin" });
 /**
 * Upstream-system connectivity sensor — distinct from `device-status`,
 * which is the kernel-managed online/offline flag for the device's
@@ -20037,7 +21090,29 @@ var FaceInfoSchema = object({
 	recognizedIdentityId: string().optional(),
 	identityName: string().optional(),
 	assigned: boolean(),
+	/**
+	* The crop, inline, base64.
+	*
+	* **Prefer {@link cropUrl}.** At the 500 rows the Faces view asks for this
+	* field alone is ~2.87 MiB, re-sent in full on every operator assign and
+	* every 30 s poll, base64-inflated over the msgpack socket and held in the
+	* query heap. It stays for callers that have not migrated; `includeCrops:
+	* false` turns it off once they have.
+	*/
 	base64: string().optional(),
+	/**
+	* Same crop, as a data-plane URL for `<img src>` — the move the admin
+	* snapshot surfaces made on 2026-08-08.
+	*
+	* Served by the `event-media` plane, which resolves a raw MediaStore key and
+	* is `access: 'authenticated'`: a bare `<img>` carries the `camstack_session`
+	* cookie, so no header plumbing is needed. The bytes then ride the browser's
+	* HTTP cache with an ETag and `immutable`, instead of the WebSocket.
+	*
+	* Absent when the face has no stored crop, or when the addon has no data
+	* plane — callers fall back to {@link base64}.
+	*/
+	cropUrl: string().optional(),
 	/** Design B: the face bbox (pixel space) on the key frame — lets a detail
 	*  view draw the box over the native `keyFrameMediaKey` frame. Absent on
 	*  legacy rows written before design B. */
@@ -20102,7 +21177,23 @@ method(_void(), array(IdentitySchema).readonly()), method(object({ name: string(
 	auth: "admin"
 }), method(object({
 	limit: number().int().positive().optional(),
-	filter: FaceFilterEnum.optional()
+	filter: FaceFilterEnum.optional(),
+	/**
+	* Inline the base64 crop on every row. Default `true` — the existing
+	* behaviour, kept so no caller breaks.
+	*
+	* Set `false` once the caller renders {@link FaceInfo.cropUrl}: that
+	* drops ~2.87 MiB per 500-row page to a few KiB of metadata and lets
+	* the browser cache the images.
+	*
+	* **This is an INPUT field, so it does not reach the addon until the
+	* next train.** The hub router validates cap inputs against its own
+	* compiled Zod, which strips a key it does not know — verified today
+	* on the OUTPUT side, where an additive field DOES arrive immediately
+	* (`Track.hasFace`). Until the train ships, sending `false` is
+	* harmless and simply keeps the crops inline.
+	*/
+	includeCrops: boolean().optional()
 }).optional(), array(FaceInfoSchema).readonly()), method(object({
 	deviceId: number().int(),
 	trackId: string()
@@ -20726,15 +21817,57 @@ var AvailableIntegrationTypeSchema = object({
 	*  flow can import (e.g. HA areas). Drives the adopt modal's "import
 	*  locations" checkbox. Provider-declared in the addon manifest. */
 	supportsLocationImport: boolean(),
+	/**
+	* True when this integration DECLARES a pre-creation test (the
+	* `connection-test` cap, or a broker whose settings it stores). Drives the
+	* Test button: an integration that cannot be tested must say so up front
+	* rather than offering a button that always answers the same nonsense.
+	*/
+	canTest: boolean(),
 	existingInstances: array(object({
 		id: string(),
 		name: string()
 	})),
 	canAdd: boolean()
 });
+/**
+* Why a test could not be answered as a plain boolean.
+*
+* `success` alone collapsed four different situations into one red box, and the
+* one that mattered most — "nobody ever asked the remote anything" — looked
+* exactly like "the remote said no". The status is the discriminator:
+*
+*   - `validated`    — a provider-declared test ran and the remote ACCEPTED.
+*   - `rejected`     — a provider-declared test ran and the remote REFUSED.
+*                      The only status that blocks `integrations.create`.
+*   - `inconclusive` — a test IS declared but could not complete (timeout,
+*                      DNS, 5xx). Nothing was observed; not a failure.
+*   - `unsupported`  — this integration declares NO test. Nothing was
+*                      observed either; not a failure, and not a pass.
+*
+* `unsupported` and `inconclusive` both carry `success: false` so an older
+* client can never read them as a green tick, and both carry an `error` string
+* that SAYS the test did not run rather than inventing a failure.
+*/
+var TestConnectionStatusEnum = _enum([
+	"validated",
+	"rejected",
+	"inconclusive",
+	"unsupported"
+]);
 var TestConnectionResultSchema$1 = object({
+	/** True ONLY for `validated`. Never true for a test that did not run. */
 	success: boolean(),
-	error: string().optional()
+	error: string().optional(),
+	/** Optional for wire back-compat with clients built before the tri-state;
+	*  the server always sets it. */
+	status: TestConnectionStatusEnum.optional(),
+	/** Addon id whose declared test answered — `null` when none did. Lets the UI
+	*  attribute a result instead of blaming "the integration". */
+	testedBy: string().nullable().optional(),
+	latencyMs: number().nonnegative().optional(),
+	/** Human detail from a `validated` result ("3 devices on this account"). */
+	detail: string().optional()
 });
 var CreateIntegrationInputSchema = object({
 	addonId: string(),
@@ -22268,6 +23401,173 @@ setOverlay: method(object({
 	}] }
 };
 /**
+* `osd-manager` — the ORCHESTRATOR over the device-scope `osd` cap.
+*
+* The `osd` cap is the firmware contract: it probes a camera's overlay
+* SLOTS and writes literal text into one. It has no idea WHERE that text
+* comes from, and it must not — a driver that grew a "show the temperature
+* here" feature would grow it once per vendor.
+*
+* This cap owns the other half: a per-(camera, slot) BINDING that says
+* which value feeds the slot, how it is formatted, and under which
+* conditions it is shown at all. One addon renders every binding on every
+* camera, so a new source costs zero driver code.
+*
+* Three deliberate choices, each with a rejected alternative:
+*
+*  1. A source is `(capName, valuePath)` over the kernel's device
+*     runtime-state mirror — NOT a closed enum of source kinds. Every
+*     cap-keyed slice a device publishes is bindable the day the cap
+*     ships. The rejected alternative (one enum member per source, with
+*     a resolver branch each) is what makes "add the humidity too" a
+*     code change.
+*  2. The display gate reuses `NcConditionsSchema` verbatim — the
+*     notification centre's condition vocabulary — rather than a parallel
+*     model. An operator who has learned one condition editor has learned
+*     both.
+*  3. Because the renderer's facts are device STATE and not a detection
+*     record, only a SUBSET of that vocabulary can be answered here.
+*     `setSlotBinding` REJECTS the rest at write time (see
+*     `getConditionSupport`). It does not accept-then-fail-closed: a
+*     condition that can never be true renders a permanently blank
+*     overlay, and a blank overlay looks exactly like a broken camera.
+*/
+/** Where a slot's value comes from. */
+var OsdSourceSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("static"),
+		text: string().max(64)
+	}),
+	object({
+		kind: literal("clock"),
+		/** Token pattern: `YYYY MM DD HH mm ss`. Everything else is literal. */
+		pattern: string().min(1).max(32).default("HH:mm"),
+		/** IANA zone. Omitted = the server's zone. */
+		timezone: string().min(1).max(64).optional()
+	}),
+	object({
+		kind: literal("device-state"),
+		deviceId: number().int().optional(),
+		capName: string().min(1).max(64),
+		/** Dot path inside the slice, e.g. `detected`, `value`, `mode`. */
+		valuePath: string().min(1).max(64)
+	})
+]);
+var OsdSlotBindingSchema = object({
+	/** Off = the manager stops driving this slot. It does NOT clear it. */
+	enabled: boolean().default(true),
+	source: OsdSourceSchema,
+	/** `${value}` and `${unit}` are substituted; every occurrence. */
+	template: string().max(96).default("${value}"),
+	/** Truncate with an ellipsis past this length. Absent = no limit. */
+	maxCharacters: number().int().min(4).max(64).optional(),
+	/**
+	* Decimal places for a numeric value. `0` yields an integer — the
+	* documented workaround for firmwares that reject `.` in overlay text.
+	*/
+	maxDecimals: number().int().min(0).max(4).default(1),
+	/** Appended via `${unit}`. The state mirror does not carry units. */
+	unitLabel: string().max(8).optional(),
+	/** Raw value → display text, e.g. `{"true":"MOTION","false":""}`. */
+	valueMap: record(string(), string()).optional(),
+	/** Time windows in which the slot is shown. Absent = always. */
+	schedule: NcScheduleSchema.optional(),
+	/**
+	* Display gate, in the notification centre's condition vocabulary.
+	* Only the keys reported by `getConditionSupport` are accepted.
+	*/
+	conditions: NcConditionsSchema.optional(),
+	/** Rendered when the gate is closed or the value unreadable. Empty = hide. */
+	fallbackText: string().max(64).default("")
+});
+/** One camera slot, as the operator sees it: firmware truth + our binding. */
+var OsdSlotViewSchema = object({
+	slotId: string(),
+	kind: OsdOverlayKindEnum,
+	/** Firmware refuses text edits (a timestamp, the channel name). */
+	readOnly: boolean(),
+	cameraEnabled: boolean(),
+	cameraText: string().optional(),
+	binding: OsdSlotBindingSchema.nullable()
+});
+/**
+* What happened to one slot on one render pass. `unchanged` exists so the
+* operator can tell "we are driving this and the value is steady" from
+* "we never got there" — and so the loop can prove it is not rewriting
+* identical text to the camera every tick.
+*/
+var OsdRenderOutcomeEnum = _enum([
+	"written",
+	"unchanged",
+	"gated",
+	"unreadable",
+	"disabled",
+	"unbound",
+	"failed"
+]);
+var OsdRenderResultSchema = object({
+	slotId: string(),
+	outcome: OsdRenderOutcomeEnum,
+	/** The text the slot should carry. Empty = the slot is switched off. */
+	text: string(),
+	/** Why, whenever the outcome is not a plain write. Never silent. */
+	reason: string().optional()
+});
+var OsdSourceValueTypeEnum = _enum([
+	"number",
+	"boolean",
+	"string",
+	"enum"
+]);
+/**
+* One bindable value, derived from a cap's `runtimeState` schema — never
+* hand-listed. The editor renders from this, so a cap that ships a new
+* state field becomes bindable with no UI change.
+*/
+var OsdSourceOptionSchema = object({
+	deviceId: number().int(),
+	deviceName: string(),
+	capName: string(),
+	valuePath: string(),
+	label: string(),
+	valueType: OsdSourceValueTypeEnum,
+	/** Present for `enum`; the editor offers these as `valueMap` keys. */
+	enumValues: array(string()).readonly().optional()
+});
+method(object({ deviceId: number().int() }), object({
+	supported: boolean(),
+	slots: array(OsdSlotViewSchema)
+}), { auth: "admin" }), method(object({ deviceId: number().int() }), object({ sources: array(OsdSourceOptionSchema) }), { auth: "admin" }), method(object({}), object({
+	supported: array(string()),
+	catalog: array(NcConditionDescriptorSchema)
+}), { auth: "admin" }), method(object({
+	deviceId: number().int(),
+	slotId: string().min(1),
+	binding: OsdSlotBindingSchema
+}), object({
+	slot: OsdSlotViewSchema,
+	render: OsdRenderResultSchema
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int(),
+	slotId: string().min(1)
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int(),
+	slotId: string().min(1),
+	binding: OsdSlotBindingSchema.optional()
+}), OsdRenderResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int() }), object({ results: array(OsdRenderResultSchema) }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * Feeder connectivity / power status — mirrors the HA petkit device-status
 * enum: `normal` (online, mains), `offline` (not reaching PetKit cloud),
 * `on_batteries` (running on battery backup). `null` until first reported.
@@ -24632,13 +25932,23 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	username: string(),
 	scopes: array(TokenScopeSchema),
 	redirectUri: string(),
-	hubUrl: string()
+	hubUrl: string(),
+	/** PKCE (RFC 7636) S256 challenge. Baked into the signed code; a code
+	*  that carries one can ONLY be exchanged with the matching verifier. */
+	codeChallenge: string().optional(),
+	/** The integration's declared refresh lifetime — seconds, or `'never'`.
+	*  From `OauthIntegrationDescriptor.refreshTokenTtlSec`. Baked into the
+	*  code so the link carries its own lifetime; omit for the 30-day
+	*  default. */
+	refreshTtlSec: union([number().int().positive(), literal("never")]).optional()
 }), object({ code: string() }), {
 	kind: "mutation",
 	access: "create"
 }), method(object({
 	code: string(),
-	redirectUri: string()
+	redirectUri: string(),
+	/** PKCE verifier. REQUIRED when the code carries a challenge. */
+	codeVerifier: string().optional()
 }), object({
 	accessToken: string(),
 	refreshToken: string(),
@@ -26377,11 +27687,52 @@ function startReachabilityPoll(options) {
 }
 var LAST_FETCHED_FIELD = "lastFetchedAt";
 function createRuntimeStateBridge(params) {
-	const { runtimeState, cap, ownDeviceId, refresh, staleMs, empty } = params;
+	const { runtimeState, cap, ownDeviceId, refresh, staleMs, empty, logger } = params;
+	const missCooldownMs = params.refreshMissCooldownMs ?? 6e4;
+	/** Epoch ms until which a refresh is not re-attempted. 0 = no cooldown. */
+	let missCooldownUntil = 0;
+	const readFetchedAt = () => {
+		const value = runtimeState.getCapState(cap.name)?.[LAST_FETCHED_FIELD];
+		return typeof value === "number" ? value : 0;
+	};
+	/**
+	* Stop re-reading this camera for `missCooldownMs`, and say so. The
+	* warn is the ONLY line an operator gets for a cap that has silently
+	* been answering with defaults, so it names the cap and carries
+	* `tags.deviceId` — a miss is always asked per-camera.
+	*/
+	const openMissCooldown = (err) => {
+		missCooldownUntil = Date.now() + missCooldownMs;
+		logger?.warn(`${cap.name}: refresh did not land — serving the last slice and not re-reading the camera for ${String(missCooldownMs)}ms`, {
+			tags: { deviceId: ownDeviceId },
+			meta: {
+				cooldownMs: missCooldownMs,
+				error: err === void 0 ? null : err instanceof Error ? err.message : String(err)
+			}
+		});
+	};
 	const ensureFresh = async () => {
 		const slice = runtimeState.getCapState(cap.name);
-		const fetchedAt = typeof slice?.[LAST_FETCHED_FIELD] === "number" ? slice[LAST_FETCHED_FIELD] : 0;
-		if (!slice || Date.now() - fetchedAt > staleMs) await refresh();
+		const fetchedAt = readFetchedAt();
+		if (slice && Date.now() - fetchedAt <= staleMs) {
+			missCooldownUntil = 0;
+			return;
+		}
+		if (Date.now() < missCooldownUntil) return;
+		try {
+			await refresh();
+		} catch (err) {
+			openMissCooldown(err);
+			throw err;
+		}
+		if (readFetchedAt() > fetchedAt) {
+			if (missCooldownUntil !== 0) {
+				missCooldownUntil = 0;
+				logger?.info(`${cap.name}: refresh landed again — resuming normal polling`, { tags: { deviceId: ownDeviceId } });
+			}
+			return;
+		}
+		openMissCooldown(void 0);
 	};
 	const projectStatus = () => {
 		const slice = runtimeState.getCapState(cap.name);
@@ -27174,6 +28525,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"connectionTest.describeTest": {
+		capName: "connection-test",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"connectionTest.testSettings": {
+		capName: "connection-test",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"consumables.reset": {
 		capName: "consumables",
 		capScope: "device",
@@ -27222,6 +28585,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.restart": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.setEnabled": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -27558,6 +28927,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.adoptionCancelJob": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.adoptionListCandidateFilters": {
 		capName: "device-manager",
 		capScope: "system",
@@ -27570,6 +28945,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.adoptionListJobs": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.adoptionRefresh": {
 		capName: "device-manager",
 		capScope: "system",
@@ -27588,6 +28969,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.adoptionStartJob": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.allocateDeviceId": {
 		capName: "device-manager",
 		capScope: "system",
@@ -27858,12 +29245,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"deviceManager.setDeviceLinks": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"deviceManager.setDisabled": {
 		capName: "device-manager",
 		capScope: "system",
@@ -29262,6 +30643,48 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"osdManager.clearSlotBinding": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"osdManager.getConditionSupport": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.getDeviceOsd": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.getSourceCatalog": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"osdManager.previewSlot": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"osdManager.renderDevice": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"osdManager.setSlotBinding": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"petFeeder.callPet": {
 		capName: "pet-feeder",
 		capScope: "device",
@@ -29334,6 +30757,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.completeRetrainTrack": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29346,6 +30775,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.deselectRetrainFrame": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.getActiveTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29406,6 +30841,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getRetrainExportUrl": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.getRetrainFrameImage": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getSensorEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29424,6 +30871,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getTrainingExportSummary": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.getTrainingExportUrl": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listEventKinds": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29448,6 +30907,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRetrainAnnotations": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainFrames": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainStaging": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listTrackMedia": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29460,6 +30937,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.proposeRetrainAnnotations": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.pruneEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29490,12 +30973,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.restageRetrainTrack": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"pipelineAnalytics.saveRetrainAnnotations": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.searchObjectEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.selectRetrainFrames": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -30612,6 +32113,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"snapshot.getSnapshotLinks": {
+		capName: "snapshot",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"snapshot.getSnapshotOverview": {
 		capName: "snapshot",
 		capScope: "device",
@@ -30888,6 +32395,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.fetchEventMedia": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.getAllRtspEntries": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -30900,6 +32413,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"streamBroker.getDeviceAudioMute": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"streamBroker.getPreBufferInfo": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -30966,6 +32485,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.produceEventMedia": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.publishCameraStream": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -31020,6 +32545,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"streamBroker.setDeviceAudioMute": {
+		capName: "stream-broker",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"streamBroker.setPreBufferDuration": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -33134,6 +34665,7 @@ var AmcrestCamera = class AmcrestCamera extends BaseDevice {
 			ownDeviceId: this.id,
 			refresh: refreshFromCamera,
 			staleMs: STALE_MS,
+			logger: this.ctx.logger,
 			empty: () => ({ lastFetchedAt: 0 })
 		});
 		const provider = {
@@ -33225,6 +34757,7 @@ var AmcrestCamera = class AmcrestCamera extends BaseDevice {
 				ownDeviceId: this.id,
 				refresh: refreshFromCamera,
 				staleMs: STALE_MS,
+				logger: this.ctx.logger,
 				empty: () => ({
 					enabled: false,
 					sensitivity: 0,
@@ -33327,6 +34860,7 @@ var AmcrestCamera = class AmcrestCamera extends BaseDevice {
 				ownDeviceId: this.id,
 				refresh: refreshFromCamera,
 				staleMs: STALE_MS,
+				logger: this.ctx.logger,
 				empty: () => ({
 					enabled: false,
 					regions: [],
@@ -33483,6 +35017,7 @@ var AmcrestCamera = class AmcrestCamera extends BaseDevice {
 				ownDeviceId: this.id,
 				refresh: refreshFromCamera,
 				staleMs: STALE_MS,
+				logger: this.ctx.logger,
 				empty: () => ({
 					mode: "auto",
 					lastFetchedAt: 0
@@ -33573,6 +35108,7 @@ var AmcrestCamera = class AmcrestCamera extends BaseDevice {
 				ownDeviceId: this.id,
 				refresh: refreshFromCamera,
 				staleMs: STALE_MS,
+				logger: this.ctx.logger,
 				empty: () => ({ lastFetchedAt: 0 })
 			}).getStatus,
 			getOptions: async ({ deviceId }) => {