@camstack/addon-provider-homeassistant 1.2.145 → 1.2.146

package/dist/{dist-C_Vy4lAi.js → dist-BTJhdlL4.js}

@@ -1,4 +1,5 @@
-//#region ../types/dist/event-category-BVDXG4tB.mjs
+require("node:crypto");
+//#region ../types/dist/event-category-C5xZWqz6.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -362,6 +363,16 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["DeviceStateChanged"] = "device.state-changed";
 	/**
+	* The NATIVE shadow of a cap a composition has claimed fields of moved
+	* (D663). Payload: `{ deviceId, capName, native }` — what the provider
+	* wrote, BEFORE the owned fields are overlaid. Owner-only (D224): it is for
+	* the composer's native self-reads, and the public event routers refuse it
+	* (`isOwnerOnlyEventCategory`) so no consumer surface ever shows a second
+	* truth beside the merged `DeviceStateChanged.slice`. Emitted only under a
+	* `replace` claim, one per native write of that cap.
+	*/
+	EventCategory["DeviceNativeShadowChanged"] = "device.native-shadow-changed";
+	/**
 	* Frame occupancy for a camera CHANGED — a tracked object was gained or
 	* lost. Carries `{ deviceId, totalObjects, byClass, zones }`.
 	*
@@ -5359,7 +5370,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BXv0ZcRa.mjs
+//#region ../types/dist/sleep-jkRQgtSc.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7060,324 +7071,6 @@ function event(data) {
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
 method(_void(), StaticDirOutputSchema$1, { auth: "admin" }), method(_void(), VersionOutputSchema$1, { auth: "admin" });
-var DeviceType = /* @__PURE__ */ function(DeviceType) {
-	DeviceType["Camera"] = "camera";
-	DeviceType["Hub"] = "hub";
-	DeviceType["Light"] = "light";
-	DeviceType["Siren"] = "siren";
-	DeviceType["Switch"] = "switch";
-	DeviceType["Sensor"] = "sensor";
-	DeviceType["Thermostat"] = "thermostat";
-	/** Air-conditioner / heat-pump climate device (HVAC) — shares the
-	*  `climate-control` cap surface with `Thermostat` but renders a
-	*  dedicated AC-appropriate control UI (mode chips, fan speed,
-	*  independent vertical/horizontal swing). Sources: native Gree, and
-	*  reusable by other AC integrations. */
-	DeviceType["Climate"] = "climate";
-	DeviceType["Button"] = "button";
-	/** Generic stateless event emitter — carries a device's EXACT declared
-	*  event vocabulary verbatim (no normalization). Installed with the
-	*  `event-emitter` cap. Sources: HA `event.*` entities (structured) and
-	*  HA bus events (e.g. `zha_event`, generic). */
-	DeviceType["EventEmitter"] = "event-emitter";
-	/** Firmware/software update entity — current vs available version,
-	*  updatable flag, update state, and an install action. Installed with
-	*  the `update` cap. Sources: Homematic firmware-update channels (and
-	*  reusable by other providers, e.g. HA `update.*` entities). */
-	DeviceType["Update"] = "update";
-	DeviceType["Generic"] = "generic";
-	/** Generic notification delivery target (HA `notify.<service>`, future
-	*  Telegram / Discord / ntfy / SMTP, …). One device per delivery
-	*  endpoint; the `notifier` cap defines the send surface. */
-	DeviceType["Notifier"] = "notifier";
-	/** Pre-recorded action sequence with optional parameters
-	*  (HA `script.*`). Runnable via `script-runner` cap. */
-	DeviceType["Script"] = "script";
-	/** Automation rule (HA `automation.*`) — enable/disable + manual
-	*  trigger surface exposed via `automation-control` cap. */
-	DeviceType["Automation"] = "automation";
-	/** Door / smart lock device (HA `lock.*`). `lock-control` cap. */
-	DeviceType["Lock"] = "lock";
-	/** Window covering, blinds, garage door, valve, etc. (HA `cover.*`,
-	*  `valve.*`). `cover` cap with sub-roles for variant. */
-	DeviceType["Cover"] = "cover";
-	/** Pipe / water / gas valve with open/close/stop and optional
-	*  position (HA `valve.*`). `valve` cap — a cover-sibling actuator
-	*  modelled on the same open/closed lifecycle. */
-	DeviceType["Valve"] = "valve";
-	/** Humidifier / dehumidifier with on/off + target humidity + mode
-	*  (HA `humidifier.*`). `humidifier` cap — a climate-family actuator
-	*  modelled on the same target / mode lifecycle. */
-	DeviceType["Humidifier"] = "humidifier";
-	/** Water heater / boiler with target temperature + operation mode +
-	*  away mode (HA `water_heater.*`). `water-heater` cap — a
-	*  climate-family actuator. */
-	DeviceType["WaterHeater"] = "water-heater";
-	/** Ceiling / standing / exhaust fan (HA `fan.*`). `fan-control` cap. */
-	DeviceType["Fan"] = "fan";
-	/** Audio / video playback endpoint (HA `media_player.*`). Disjoint from
-	*  the camera surface — those use `Camera`. `media-player` cap. */
-	DeviceType["MediaPlayer"] = "media-player";
-	/** Security panel / alarm system (HA `alarm_control_panel.*`).
-	*  `alarm-panel` cap. */
-	DeviceType["AlarmPanel"] = "alarm-panel";
-	/** Generic user-settable input (HA `number` / `input_number` / `select`
-	*  / `input_select` / `text` / `input_text` / `input_datetime`).
-	*  Sub-type via `DeviceRole`: NumericControl / SelectControl /
-	*  TextControl / DateTimeControl. */
-	DeviceType["Control"] = "control";
-	/** Person / device-tracker presence (HA `person.*`, `device_tracker.*`).
-	*  `presence` cap. */
-	DeviceType["Presence"] = "presence";
-	/** Weather provider (HA `weather.*`). Tier-3, low MVP priority.
-	*  `weather` cap. */
-	DeviceType["Weather"] = "weather";
-	/** Robot vacuum (HA `vacuum.*`). Tier-3. `vacuum-control` cap. */
-	DeviceType["Vacuum"] = "vacuum";
-	/** Robotic lawn mower (HA `lawn_mower.*`). Tier-3.
-	*  `lawn-mower-control` cap. */
-	DeviceType["LawnMower"] = "lawn-mower";
-	/** Physical HA device group — parent container for entity-children
-	*  adopted from a single HA device entry. Not renderable as a
-	*  standalone device; exists only to anchor child entities. */
-	DeviceType["Container"] = "container";
-	/** Single still-image entity (HA `image.*`). Read-only display of an
-	*  `entity_picture` signed URL the browser loads directly. `image` cap. */
-	DeviceType["Image"] = "image";
-	/** Smart pet feeder — cloud-connected food dispenser with a bowl food
-	*  level, battery, desiccant life, feeding state and manual-feed /
-	*  call-pet / maintenance actions. Installed with the `pet-feeder` cap;
-	*  dual-hopper models (D4S/D4SH) expose per-hopper portions. Sources:
-	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
-	*  integrations sharing the same food/desiccant/hopper surface. */
-	DeviceType["PetFeeder"] = "pet-feeder";
-	return DeviceType;
-}({});
-var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
-	DeviceFeature["BatteryOperated"] = "battery-operated";
-	DeviceFeature["Rebootable"] = "rebootable";
-	/**
-	* Device supports an on-demand re-sync of its derived spec with its
-	* upstream source — drives the generic Re-sync button. The owning
-	* provider implements the action via the `device-adoption.resync` cap.
-	*/
-	DeviceFeature["Resyncable"] = "resyncable";
-	DeviceFeature["NativeSnapshot"] = "native-snapshot";
-	DeviceFeature["DoorbellButton"] = "doorbell-button";
-	DeviceFeature["TwoWayAudio"] = "two-way-audio";
-	DeviceFeature["PanTiltZoom"] = "pan-tilt-zoom";
-	/**
-	* Camera supports the on-firmware autotrack subsystem (subject-
-	* following). Distinct from `PanTiltZoom` because not every PTZ
-	* camera ships autotrack — the admin UI uses this flag to gate
-	* the autotrack toggle / settings card without re-deriving from
-	* the cap registry. Mirrors `ptz-autotrack` cap registration:
-	* driver sets this feature when probe confirms the firmware
-	* surface, and registers the cap in the same code path.
-	*/
-	DeviceFeature["PtzAutotrack"] = "ptz-autotrack";
-	/**
-	* Accessory exposes a "trigger on motion" toggle — the parent camera's
-	* motion detection automatically activates this device. Mirrors
-	* `motion-trigger` cap registration: drivers set this feature in the
-	* same code path that calls `ctx.registerNativeCap(motionTriggerCapability, ...)`.
-	*
-	* Used by admin UI (gate the in-hero `MotionTriggerToggle` against a
-	* fast scalar without binding fetch), notifier rules, and `listAll`
-	* filters that want "all devices with on-motion behaviour".
-	*/
-	DeviceFeature["MotionTrigger"] = "motion-trigger";
-	/** Light supports rgb-triplet color via `color` cap. */
-	DeviceFeature["LightColorRgb"] = "light-color-rgb";
-	/** Light supports HSV color via `color` cap. */
-	DeviceFeature["LightColorHsv"] = "light-color-hsv";
-	/** Light supports color-temperature (mired) via `color` cap. */
-	DeviceFeature["LightColorMired"] = "light-color-mired";
-	/** Thermostat supports a `heat_cool` dual setpoint (targetLow +
-	*  targetHigh). Gates the range slider UI. */
-	DeviceFeature["ClimateDualSetpoint"] = "climate-dual-setpoint";
-	/** Thermostat exposes target humidity and/or current humidity
-	*  readings. Gates the humidity controls. */
-	DeviceFeature["ClimateHumidity"] = "climate-humidity";
-	/** Thermostat exposes a fan-mode selector. */
-	DeviceFeature["ClimateFanMode"] = "climate-fan-mode";
-	/** Thermostat exposes preset modes (eco / away / sleep / vendor). */
-	DeviceFeature["ClimatePreset"] = "climate-preset";
-	/** Thermostat exposes a vertical louver swing toggle. Gates the
-	*  vertical-swing switch in the climate UI. Independent of horizontal. */
-	DeviceFeature["ClimateSwingVertical"] = "climate-swing-vertical";
-	/** Thermostat exposes a horizontal louver swing toggle. Gates the
-	*  horizontal-swing switch in the climate UI. Independent of vertical. */
-	DeviceFeature["ClimateSwingHorizontal"] = "climate-swing-horizontal";
-	/** Cover exposes intermediate position control (0..100). Gates the
-	*  position slider UI. */
-	DeviceFeature["CoverPositionable"] = "cover-positionable";
-	/** Cover exposes slat-tilt control. Gates the tilt slider UI. */
-	DeviceFeature["CoverTilt"] = "cover-tilt";
-	/** Valve exposes intermediate position control (0..100). Gates the
-	*  position slider / drag surface UI. */
-	DeviceFeature["ValvePositionable"] = "valve-positionable";
-	/** Fan exposes a speed-percentage setter. Gates the speed slider UI. */
-	DeviceFeature["FanSpeed"] = "fan-speed";
-	/** Fan exposes a preset mode selector. */
-	DeviceFeature["FanPreset"] = "fan-preset";
-	/** Fan exposes blade direction (forward/reverse) — typical of
-	*  ceiling fans. */
-	DeviceFeature["FanDirection"] = "fan-direction";
-	/** Fan exposes an oscillation toggle. */
-	DeviceFeature["FanOscillating"] = "fan-oscillating";
-	/** Lock requires a PIN code on lock/unlock. Gates the code-entry
-	*  field on the UI lock-controls panel. */
-	DeviceFeature["LockPinRequired"] = "lock-pin-required";
-	/** Lock supports a latch-release ("open door") action distinct from
-	*  unlock. Mirrors HA `LockEntityFeature.OPEN` (bit 1) in
-	*  `supported_features`. Gates the Open Door button in the UI. */
-	DeviceFeature["LockOpen"] = "lock-open";
-	/** Media player exposes a seek-to-position surface. */
-	DeviceFeature["MediaPlayerSeek"] = "media-player-seek";
-	/** Media player exposes a volume-level setter. */
-	DeviceFeature["MediaPlayerVolume"] = "media-player-volume";
-	/** Media player exposes a mute toggle distinct from volume=0. */
-	DeviceFeature["MediaPlayerMute"] = "media-player-mute";
-	/** Media player exposes a shuffle toggle. */
-	DeviceFeature["MediaPlayerShuffle"] = "media-player-shuffle";
-	/** Media player exposes a repeat mode (off / all / one). */
-	DeviceFeature["MediaPlayerRepeat"] = "media-player-repeat";
-	/** Media player exposes a source / input selector. */
-	DeviceFeature["MediaPlayerSelectSource"] = "media-player-select-source";
-	/** Media player exposes a play-arbitrary-media surface (URL / id). */
-	DeviceFeature["MediaPlayerPlayMedia"] = "media-player-play-media";
-	/** Media player exposes next-track. */
-	DeviceFeature["MediaPlayerNext"] = "media-player-next";
-	/** Media player exposes previous-track. */
-	DeviceFeature["MediaPlayerPrevious"] = "media-player-previous";
-	/** Media player exposes stop distinct from pause. */
-	DeviceFeature["MediaPlayerStop"] = "media-player-stop";
-	/** Alarm panel requires a PIN code on arm/disarm. */
-	DeviceFeature["AlarmPinRequired"] = "alarm-pin-required";
-	/** Presence device carries GPS coordinates (lat/lng/accuracy) in
-	*  addition to a textual location. */
-	DeviceFeature["PresenceGps"] = "presence-gps";
-	/** Notifier accepts an inline / URL image attachment. */
-	DeviceFeature["NotifierImage"] = "notifier-image";
-	/** Notifier accepts a priority hint (high/normal/low). */
-	DeviceFeature["NotifierPriority"] = "notifier-priority";
-	/** Notifier accepts a free-form `data` payload for platform-specific
-	*  fields. */
-	DeviceFeature["NotifierData"] = "notifier-data";
-	/** Notifier supports interactive action buttons / callbacks. */
-	DeviceFeature["NotifierActions"] = "notifier-actions";
-	/** Notifier supports per-call recipient targeting (multi-user). */
-	DeviceFeature["NotifierRecipients"] = "notifier-recipients";
-	/** Script runner accepts a variables map on each run invocation. */
-	DeviceFeature["ScriptVariables"] = "script-variables";
-	/** Automation `trigger` accepts a skipCondition flag — fires the
-	*  automation's actions while bypassing its condition block. */
-	DeviceFeature["AutomationSkipCondition"] = "automation-skip-condition";
-	/** Robot vacuum exposes a live cleaning map (image child). Gates the
-	*  map tile in the vacuum UI. */
-	DeviceFeature["VacuumHasMap"] = "vacuum-has-map";
-	/** Robot vacuum exposes AI obstacle-detection toggles. Gates the AI
-	*  switches group. */
-	DeviceFeature["VacuumHasAi"] = "vacuum-has-ai";
-	/** Robot mower exposes a live mowing map (SVG image child). Gates the
-	*  mower map tile. */
-	DeviceFeature["MowerHasMap"] = "mower-has-map";
-	/** Robot mower exposes targeted mowing (all-area / zones / edges /
-	*  spots) — gates the Mow action + map selectors. */
-	DeviceFeature["MowerHasTargetedMowing"] = "mower-has-targeted-mowing";
-	return DeviceFeature;
-}({});
-/**
-* Semantic role a device plays within its parent. Populated by driver
-* addons when creating accessory devices (Reolink siren/floodlight/
-* PIR/chime/autotrack/doorbell, ONVIF relay outputs, …). Used by the
-* admin UI to pick icons, labels, and widgets — a `Switch` with
-* `role: Floodlight` renders as a bulb with a brightness slider,
-* whereas a `Switch` with `role: Siren` renders as a klaxon.
-*
-* Undefined for top-level devices (cameras, NVRs, hubs). Persisted in
-* sqlite as a nullable TEXT column — old rows keep working unchanged.
-*/
-var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
-	DeviceRole["Siren"] = "siren";
-	DeviceRole["Floodlight"] = "floodlight";
-	DeviceRole["Spotlight"] = "spotlight";
-	DeviceRole["PirSensor"] = "pir-sensor";
-	DeviceRole["Chime"] = "chime";
-	DeviceRole["Autotrack"] = "autotrack";
-	DeviceRole["Nightvision"] = "nightvision";
-	DeviceRole["PrivacyMask"] = "privacy-mask";
-	DeviceRole["Doorbell"] = "doorbell";
-	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
-	*  real Switch device for UI rendering / export adapters. */
-	DeviceRole["BinaryHelper"] = "binary-helper";
-	/** Generic motion / occupancy / moving event source. Distinct from
-	*  the camera accessory PirSensor role: that one is a camera child;
-	*  this is a standalone HA / 3rd-party motion sensor. */
-	DeviceRole["MotionSensor"] = "motion-sensor";
-	DeviceRole["ContactSensor"] = "contact-sensor";
-	DeviceRole["LeakSensor"] = "leak-sensor";
-	DeviceRole["SmokeSensor"] = "smoke-sensor";
-	DeviceRole["COSensor"] = "co-sensor";
-	DeviceRole["GasSensor"] = "gas-sensor";
-	DeviceRole["TamperSensor"] = "tamper-sensor";
-	DeviceRole["VibrationSensor"] = "vibration-sensor";
-	DeviceRole["ConnectivitySensor"] = "connectivity-sensor";
-	DeviceRole["SoundSensor"] = "sound-sensor";
-	/** Fallback for `binary_sensor` without a known `device_class`. */
-	DeviceRole["BinarySensor"] = "binary-sensor";
-	DeviceRole["TemperatureSensor"] = "temperature-sensor";
-	DeviceRole["HumiditySensor"] = "humidity-sensor";
-	DeviceRole["AmbientLightSensor"] = "ambient-light-sensor";
-	DeviceRole["PressureSensor"] = "pressure-sensor";
-	/** Wind speed or direction (weather-station `wind-sensor` cap). */
-	DeviceRole["WindSensor"] = "wind-sensor";
-	/** Rain accumulation or rate (weather-station `rain-sensor` cap). */
-	DeviceRole["RainSensor"] = "rain-sensor";
-	/** UV index (weather-station `uv-sensor` cap). */
-	DeviceRole["UvSensor"] = "uv-sensor";
-	/** Solar irradiance W/m² (weather-station `solar-radiation-sensor` cap).
-	*  Distinct from AmbientLightSensor (lux). */
-	DeviceRole["SolarRadiationSensor"] = "solar-radiation-sensor";
-	/** Soil moisture % (garden/weather `soil-moisture-sensor` cap). */
-	DeviceRole["SoilMoistureSensor"] = "soil-moisture-sensor";
-	DeviceRole["PowerSensor"] = "power-sensor";
-	DeviceRole["EnergySensor"] = "energy-sensor";
-	DeviceRole["VoltageSensor"] = "voltage-sensor";
-	DeviceRole["CurrentSensor"] = "current-sensor";
-	DeviceRole["AirQualitySensor"] = "air-quality-sensor";
-	/** Battery level (numeric % via `sensor` OR low-bool via
-	*  `binary_sensor` — the cap distinguishes via the value type). */
-	DeviceRole["BatterySensor"] = "battery-sensor";
-	/** Fallback for `sensor` numeric without a known `device_class`. */
-	DeviceRole["NumericSensor"] = "numeric-sensor";
-	/** String / enum state (HA `sensor` with `state_class: enum` or
-	*  `attributes.options`). */
-	DeviceRole["EnumSensor"] = "enum-sensor";
-	/** Date / timestamp state (HA `sensor` with `device_class: timestamp`
-	*  or `date`). The slice carries the raw ISO string verbatim (hosted on
-	*  the `enum-sensor` cap); the UI renders it locale-formatted. */
-	DeviceRole["DateTimeSensor"] = "datetime-sensor";
-	/** Last-resort fallback when nothing else matches. */
-	DeviceRole["GenericSensor"] = "generic-sensor";
-	DeviceRole["NumericControl"] = "numeric-control";
-	DeviceRole["SelectControl"] = "select-control";
-	DeviceRole["TextControl"] = "text-control";
-	DeviceRole["DateTimeControl"] = "datetime-control";
-	/** Mobile push notifier (HA `notify.mobile_app_*`) — supports
-	*  rich features (image, priority, channel routing). */
-	DeviceRole["MobilePushNotifier"] = "mobile-push-notifier";
-	/** Chat / messaging service (HA `notify.telegram_*`,
-	*  `notify.discord_*`, etc.). */
-	DeviceRole["MessagingNotifier"] = "messaging-notifier";
-	/** Email-based delivery (HA `notify.smtp`, etc.). */
-	DeviceRole["EmailNotifier"] = "email-notifier";
-	/** Fallback when the notifier service name doesn't match a known
-	*  pattern. */
-	DeviceRole["GenericNotifier"] = "generic-notifier";
-	return DeviceRole;
-}({});
 var StaticDirOutputSchema = object({ staticDir: string() });
 var VersionOutputSchema = object({ version: string() });
 method(_void(), StaticDirOutputSchema, { auth: "admin" }), method(_void(), VersionOutputSchema, { auth: "admin" });
@@ -7445,7 +7138,325 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 	auth: "admin"
 }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
 //#endregion
-//#region ../types/dist/err-msg-IQTHeDzc.mjs
+//#region ../types/dist/err-msg-DX6i_MY4.mjs
+var DeviceType = /* @__PURE__ */ function(DeviceType) {
+	DeviceType["Camera"] = "camera";
+	DeviceType["Hub"] = "hub";
+	DeviceType["Light"] = "light";
+	DeviceType["Siren"] = "siren";
+	DeviceType["Switch"] = "switch";
+	DeviceType["Sensor"] = "sensor";
+	DeviceType["Thermostat"] = "thermostat";
+	/** Air-conditioner / heat-pump climate device (HVAC) — shares the
+	*  `climate-control` cap surface with `Thermostat` but renders a
+	*  dedicated AC-appropriate control UI (mode chips, fan speed,
+	*  independent vertical/horizontal swing). Sources: native Gree, and
+	*  reusable by other AC integrations. */
+	DeviceType["Climate"] = "climate";
+	DeviceType["Button"] = "button";
+	/** Generic stateless event emitter — carries a device's EXACT declared
+	*  event vocabulary verbatim (no normalization). Installed with the
+	*  `event-emitter` cap. Sources: HA `event.*` entities (structured) and
+	*  HA bus events (e.g. `zha_event`, generic). */
+	DeviceType["EventEmitter"] = "event-emitter";
+	/** Firmware/software update entity — current vs available version,
+	*  updatable flag, update state, and an install action. Installed with
+	*  the `update` cap. Sources: Homematic firmware-update channels (and
+	*  reusable by other providers, e.g. HA `update.*` entities). */
+	DeviceType["Update"] = "update";
+	DeviceType["Generic"] = "generic";
+	/** Generic notification delivery target (HA `notify.<service>`, future
+	*  Telegram / Discord / ntfy / SMTP, …). One device per delivery
+	*  endpoint; the `notifier` cap defines the send surface. */
+	DeviceType["Notifier"] = "notifier";
+	/** Pre-recorded action sequence with optional parameters
+	*  (HA `script.*`). Runnable via `script-runner` cap. */
+	DeviceType["Script"] = "script";
+	/** Automation rule (HA `automation.*`) — enable/disable + manual
+	*  trigger surface exposed via `automation-control` cap. */
+	DeviceType["Automation"] = "automation";
+	/** Door / smart lock device (HA `lock.*`). `lock-control` cap. */
+	DeviceType["Lock"] = "lock";
+	/** Window covering, blinds, garage door, valve, etc. (HA `cover.*`,
+	*  `valve.*`). `cover` cap with sub-roles for variant. */
+	DeviceType["Cover"] = "cover";
+	/** Pipe / water / gas valve with open/close/stop and optional
+	*  position (HA `valve.*`). `valve` cap — a cover-sibling actuator
+	*  modelled on the same open/closed lifecycle. */
+	DeviceType["Valve"] = "valve";
+	/** Humidifier / dehumidifier with on/off + target humidity + mode
+	*  (HA `humidifier.*`). `humidifier` cap — a climate-family actuator
+	*  modelled on the same target / mode lifecycle. */
+	DeviceType["Humidifier"] = "humidifier";
+	/** Water heater / boiler with target temperature + operation mode +
+	*  away mode (HA `water_heater.*`). `water-heater` cap — a
+	*  climate-family actuator. */
+	DeviceType["WaterHeater"] = "water-heater";
+	/** Ceiling / standing / exhaust fan (HA `fan.*`). `fan-control` cap. */
+	DeviceType["Fan"] = "fan";
+	/** Audio / video playback endpoint (HA `media_player.*`). Disjoint from
+	*  the camera surface — those use `Camera`. `media-player` cap. */
+	DeviceType["MediaPlayer"] = "media-player";
+	/** Security panel / alarm system (HA `alarm_control_panel.*`).
+	*  `alarm-panel` cap. */
+	DeviceType["AlarmPanel"] = "alarm-panel";
+	/** Generic user-settable input (HA `number` / `input_number` / `select`
+	*  / `input_select` / `text` / `input_text` / `input_datetime`).
+	*  Sub-type via `DeviceRole`: NumericControl / SelectControl /
+	*  TextControl / DateTimeControl. */
+	DeviceType["Control"] = "control";
+	/** Person / device-tracker presence (HA `person.*`, `device_tracker.*`).
+	*  `presence` cap. */
+	DeviceType["Presence"] = "presence";
+	/** Weather provider (HA `weather.*`). Tier-3, low MVP priority.
+	*  `weather` cap. */
+	DeviceType["Weather"] = "weather";
+	/** Robot vacuum (HA `vacuum.*`). Tier-3. `vacuum-control` cap. */
+	DeviceType["Vacuum"] = "vacuum";
+	/** Robotic lawn mower (HA `lawn_mower.*`). Tier-3.
+	*  `lawn-mower-control` cap. */
+	DeviceType["LawnMower"] = "lawn-mower";
+	/** Physical HA device group — parent container for entity-children
+	*  adopted from a single HA device entry. Not renderable as a
+	*  standalone device; exists only to anchor child entities. */
+	DeviceType["Container"] = "container";
+	/** Single still-image entity (HA `image.*`). Read-only display of an
+	*  `entity_picture` signed URL the browser loads directly. `image` cap. */
+	DeviceType["Image"] = "image";
+	/** Smart pet feeder — cloud-connected food dispenser with a bowl food
+	*  level, battery, desiccant life, feeding state and manual-feed /
+	*  call-pet / maintenance actions. Installed with the `pet-feeder` cap;
+	*  dual-hopper models (D4S/D4SH) expose per-hopper portions. Sources:
+	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
+	*  integrations sharing the same food/desiccant/hopper surface. */
+	DeviceType["PetFeeder"] = "pet-feeder";
+	return DeviceType;
+}({});
+var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
+	DeviceFeature["BatteryOperated"] = "battery-operated";
+	DeviceFeature["Rebootable"] = "rebootable";
+	/**
+	* Device supports an on-demand re-sync of its derived spec with its
+	* upstream source — drives the generic Re-sync button. The owning
+	* provider implements the action via the `device-adoption.resync` cap.
+	*/
+	DeviceFeature["Resyncable"] = "resyncable";
+	DeviceFeature["NativeSnapshot"] = "native-snapshot";
+	DeviceFeature["DoorbellButton"] = "doorbell-button";
+	DeviceFeature["TwoWayAudio"] = "two-way-audio";
+	DeviceFeature["PanTiltZoom"] = "pan-tilt-zoom";
+	/**
+	* Camera supports the on-firmware autotrack subsystem (subject-
+	* following). Distinct from `PanTiltZoom` because not every PTZ
+	* camera ships autotrack — the admin UI uses this flag to gate
+	* the autotrack toggle / settings card without re-deriving from
+	* the cap registry. Mirrors `ptz-autotrack` cap registration:
+	* driver sets this feature when probe confirms the firmware
+	* surface, and registers the cap in the same code path.
+	*/
+	DeviceFeature["PtzAutotrack"] = "ptz-autotrack";
+	/**
+	* Accessory exposes a "trigger on motion" toggle — the parent camera's
+	* motion detection automatically activates this device. Mirrors
+	* `motion-trigger` cap registration: drivers set this feature in the
+	* same code path that calls `ctx.registerNativeCap(motionTriggerCapability, ...)`.
+	*
+	* Used by admin UI (gate the in-hero `MotionTriggerToggle` against a
+	* fast scalar without binding fetch), notifier rules, and `listAll`
+	* filters that want "all devices with on-motion behaviour".
+	*/
+	DeviceFeature["MotionTrigger"] = "motion-trigger";
+	/** Light supports rgb-triplet color via `color` cap. */
+	DeviceFeature["LightColorRgb"] = "light-color-rgb";
+	/** Light supports HSV color via `color` cap. */
+	DeviceFeature["LightColorHsv"] = "light-color-hsv";
+	/** Light supports color-temperature (mired) via `color` cap. */
+	DeviceFeature["LightColorMired"] = "light-color-mired";
+	/** Thermostat supports a `heat_cool` dual setpoint (targetLow +
+	*  targetHigh). Gates the range slider UI. */
+	DeviceFeature["ClimateDualSetpoint"] = "climate-dual-setpoint";
+	/** Thermostat exposes target humidity and/or current humidity
+	*  readings. Gates the humidity controls. */
+	DeviceFeature["ClimateHumidity"] = "climate-humidity";
+	/** Thermostat exposes a fan-mode selector. */
+	DeviceFeature["ClimateFanMode"] = "climate-fan-mode";
+	/** Thermostat exposes preset modes (eco / away / sleep / vendor). */
+	DeviceFeature["ClimatePreset"] = "climate-preset";
+	/** Thermostat exposes a vertical louver swing toggle. Gates the
+	*  vertical-swing switch in the climate UI. Independent of horizontal. */
+	DeviceFeature["ClimateSwingVertical"] = "climate-swing-vertical";
+	/** Thermostat exposes a horizontal louver swing toggle. Gates the
+	*  horizontal-swing switch in the climate UI. Independent of vertical. */
+	DeviceFeature["ClimateSwingHorizontal"] = "climate-swing-horizontal";
+	/** Cover exposes intermediate position control (0..100). Gates the
+	*  position slider UI. */
+	DeviceFeature["CoverPositionable"] = "cover-positionable";
+	/** Cover exposes slat-tilt control. Gates the tilt slider UI. */
+	DeviceFeature["CoverTilt"] = "cover-tilt";
+	/** Valve exposes intermediate position control (0..100). Gates the
+	*  position slider / drag surface UI. */
+	DeviceFeature["ValvePositionable"] = "valve-positionable";
+	/** Fan exposes a speed-percentage setter. Gates the speed slider UI. */
+	DeviceFeature["FanSpeed"] = "fan-speed";
+	/** Fan exposes a preset mode selector. */
+	DeviceFeature["FanPreset"] = "fan-preset";
+	/** Fan exposes blade direction (forward/reverse) — typical of
+	*  ceiling fans. */
+	DeviceFeature["FanDirection"] = "fan-direction";
+	/** Fan exposes an oscillation toggle. */
+	DeviceFeature["FanOscillating"] = "fan-oscillating";
+	/** Lock requires a PIN code on lock/unlock. Gates the code-entry
+	*  field on the UI lock-controls panel. */
+	DeviceFeature["LockPinRequired"] = "lock-pin-required";
+	/** Lock supports a latch-release ("open door") action distinct from
+	*  unlock. Mirrors HA `LockEntityFeature.OPEN` (bit 1) in
+	*  `supported_features`. Gates the Open Door button in the UI. */
+	DeviceFeature["LockOpen"] = "lock-open";
+	/** Media player exposes a seek-to-position surface. */
+	DeviceFeature["MediaPlayerSeek"] = "media-player-seek";
+	/** Media player exposes a volume-level setter. */
+	DeviceFeature["MediaPlayerVolume"] = "media-player-volume";
+	/** Media player exposes a mute toggle distinct from volume=0. */
+	DeviceFeature["MediaPlayerMute"] = "media-player-mute";
+	/** Media player exposes a shuffle toggle. */
+	DeviceFeature["MediaPlayerShuffle"] = "media-player-shuffle";
+	/** Media player exposes a repeat mode (off / all / one). */
+	DeviceFeature["MediaPlayerRepeat"] = "media-player-repeat";
+	/** Media player exposes a source / input selector. */
+	DeviceFeature["MediaPlayerSelectSource"] = "media-player-select-source";
+	/** Media player exposes a play-arbitrary-media surface (URL / id). */
+	DeviceFeature["MediaPlayerPlayMedia"] = "media-player-play-media";
+	/** Media player exposes next-track. */
+	DeviceFeature["MediaPlayerNext"] = "media-player-next";
+	/** Media player exposes previous-track. */
+	DeviceFeature["MediaPlayerPrevious"] = "media-player-previous";
+	/** Media player exposes stop distinct from pause. */
+	DeviceFeature["MediaPlayerStop"] = "media-player-stop";
+	/** Alarm panel requires a PIN code on arm/disarm. */
+	DeviceFeature["AlarmPinRequired"] = "alarm-pin-required";
+	/** Presence device carries GPS coordinates (lat/lng/accuracy) in
+	*  addition to a textual location. */
+	DeviceFeature["PresenceGps"] = "presence-gps";
+	/** Notifier accepts an inline / URL image attachment. */
+	DeviceFeature["NotifierImage"] = "notifier-image";
+	/** Notifier accepts a priority hint (high/normal/low). */
+	DeviceFeature["NotifierPriority"] = "notifier-priority";
+	/** Notifier accepts a free-form `data` payload for platform-specific
+	*  fields. */
+	DeviceFeature["NotifierData"] = "notifier-data";
+	/** Notifier supports interactive action buttons / callbacks. */
+	DeviceFeature["NotifierActions"] = "notifier-actions";
+	/** Notifier supports per-call recipient targeting (multi-user). */
+	DeviceFeature["NotifierRecipients"] = "notifier-recipients";
+	/** Script runner accepts a variables map on each run invocation. */
+	DeviceFeature["ScriptVariables"] = "script-variables";
+	/** Automation `trigger` accepts a skipCondition flag — fires the
+	*  automation's actions while bypassing its condition block. */
+	DeviceFeature["AutomationSkipCondition"] = "automation-skip-condition";
+	/** Robot vacuum exposes a live cleaning map (image child). Gates the
+	*  map tile in the vacuum UI. */
+	DeviceFeature["VacuumHasMap"] = "vacuum-has-map";
+	/** Robot vacuum exposes AI obstacle-detection toggles. Gates the AI
+	*  switches group. */
+	DeviceFeature["VacuumHasAi"] = "vacuum-has-ai";
+	/** Robot mower exposes a live mowing map (SVG image child). Gates the
+	*  mower map tile. */
+	DeviceFeature["MowerHasMap"] = "mower-has-map";
+	/** Robot mower exposes targeted mowing (all-area / zones / edges /
+	*  spots) — gates the Mow action + map selectors. */
+	DeviceFeature["MowerHasTargetedMowing"] = "mower-has-targeted-mowing";
+	return DeviceFeature;
+}({});
+/**
+* Semantic role a device plays within its parent. Populated by driver
+* addons when creating accessory devices (Reolink siren/floodlight/
+* PIR/chime/autotrack/doorbell, ONVIF relay outputs, …). Used by the
+* admin UI to pick icons, labels, and widgets — a `Switch` with
+* `role: Floodlight` renders as a bulb with a brightness slider,
+* whereas a `Switch` with `role: Siren` renders as a klaxon.
+*
+* Undefined for top-level devices (cameras, NVRs, hubs). Persisted in
+* sqlite as a nullable TEXT column — old rows keep working unchanged.
+*/
+var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
+	DeviceRole["Siren"] = "siren";
+	DeviceRole["Floodlight"] = "floodlight";
+	DeviceRole["Spotlight"] = "spotlight";
+	DeviceRole["PirSensor"] = "pir-sensor";
+	DeviceRole["Chime"] = "chime";
+	DeviceRole["Autotrack"] = "autotrack";
+	DeviceRole["Nightvision"] = "nightvision";
+	DeviceRole["PrivacyMask"] = "privacy-mask";
+	DeviceRole["Doorbell"] = "doorbell";
+	/** Virtual HA toggle (input_boolean.*) — distinguishable from a
+	*  real Switch device for UI rendering / export adapters. */
+	DeviceRole["BinaryHelper"] = "binary-helper";
+	/** Generic motion / occupancy / moving event source. Distinct from
+	*  the camera accessory PirSensor role: that one is a camera child;
+	*  this is a standalone HA / 3rd-party motion sensor. */
+	DeviceRole["MotionSensor"] = "motion-sensor";
+	DeviceRole["ContactSensor"] = "contact-sensor";
+	DeviceRole["LeakSensor"] = "leak-sensor";
+	DeviceRole["SmokeSensor"] = "smoke-sensor";
+	DeviceRole["COSensor"] = "co-sensor";
+	DeviceRole["GasSensor"] = "gas-sensor";
+	DeviceRole["TamperSensor"] = "tamper-sensor";
+	DeviceRole["VibrationSensor"] = "vibration-sensor";
+	DeviceRole["ConnectivitySensor"] = "connectivity-sensor";
+	DeviceRole["SoundSensor"] = "sound-sensor";
+	/** Fallback for `binary_sensor` without a known `device_class`. */
+	DeviceRole["BinarySensor"] = "binary-sensor";
+	DeviceRole["TemperatureSensor"] = "temperature-sensor";
+	DeviceRole["HumiditySensor"] = "humidity-sensor";
+	DeviceRole["AmbientLightSensor"] = "ambient-light-sensor";
+	DeviceRole["PressureSensor"] = "pressure-sensor";
+	/** Wind speed or direction (weather-station `wind-sensor` cap). */
+	DeviceRole["WindSensor"] = "wind-sensor";
+	/** Rain accumulation or rate (weather-station `rain-sensor` cap). */
+	DeviceRole["RainSensor"] = "rain-sensor";
+	/** UV index (weather-station `uv-sensor` cap). */
+	DeviceRole["UvSensor"] = "uv-sensor";
+	/** Solar irradiance W/m² (weather-station `solar-radiation-sensor` cap).
+	*  Distinct from AmbientLightSensor (lux). */
+	DeviceRole["SolarRadiationSensor"] = "solar-radiation-sensor";
+	/** Soil moisture % (garden/weather `soil-moisture-sensor` cap). */
+	DeviceRole["SoilMoistureSensor"] = "soil-moisture-sensor";
+	DeviceRole["PowerSensor"] = "power-sensor";
+	DeviceRole["EnergySensor"] = "energy-sensor";
+	DeviceRole["VoltageSensor"] = "voltage-sensor";
+	DeviceRole["CurrentSensor"] = "current-sensor";
+	DeviceRole["AirQualitySensor"] = "air-quality-sensor";
+	/** Battery level (numeric % via `sensor` OR low-bool via
+	*  `binary_sensor` — the cap distinguishes via the value type). */
+	DeviceRole["BatterySensor"] = "battery-sensor";
+	/** Fallback for `sensor` numeric without a known `device_class`. */
+	DeviceRole["NumericSensor"] = "numeric-sensor";
+	/** String / enum state (HA `sensor` with `state_class: enum` or
+	*  `attributes.options`). */
+	DeviceRole["EnumSensor"] = "enum-sensor";
+	/** Date / timestamp state (HA `sensor` with `device_class: timestamp`
+	*  or `date`). The slice carries the raw ISO string verbatim (hosted on
+	*  the `enum-sensor` cap); the UI renders it locale-formatted. */
+	DeviceRole["DateTimeSensor"] = "datetime-sensor";
+	/** Last-resort fallback when nothing else matches. */
+	DeviceRole["GenericSensor"] = "generic-sensor";
+	DeviceRole["NumericControl"] = "numeric-control";
+	DeviceRole["SelectControl"] = "select-control";
+	DeviceRole["TextControl"] = "text-control";
+	DeviceRole["DateTimeControl"] = "datetime-control";
+	/** Mobile push notifier (HA `notify.mobile_app_*`) — supports
+	*  rich features (image, priority, channel routing). */
+	DeviceRole["MobilePushNotifier"] = "mobile-push-notifier";
+	/** Chat / messaging service (HA `notify.telegram_*`,
+	*  `notify.discord_*`, etc.). */
+	DeviceRole["MessagingNotifier"] = "messaging-notifier";
+	/** Email-based delivery (HA `notify.smtp`, etc.). */
+	DeviceRole["EmailNotifier"] = "email-notifier";
+	/** Fallback when the notifier service name doesn't match a known
+	*  pattern. */
+	DeviceRole["GenericNotifier"] = "generic-notifier";
+	return DeviceRole;
+}({});
 /**
 import { errMsg } from '@camstack/types'
 * Extract a human-readable message from an unknown error value.
@@ -7456,6 +7467,757 @@ function errMsg(err) {
 	if (typeof err === "string") return err;
 	return String(err);
 }
+//#endregion
+//#region ../types/dist/composition-CPFIlFfw.mjs
+/**
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
+*/
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+function asBoolean(value, name, index) {
+	if (typeof value !== "boolean") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a boolean`);
+	return value;
+}
+/** A plain decimal (optional sign, fraction, exponent) — never hex, never `Infinity`, never a unit suffix. */
+var DECIMAL = /^[+-]?(\d+(\.\d*)?|\.\d+)([eE][+-]?\d+)?$/;
+/**
+* `number(x)`: a finite number, or a string that IS one, as a number; every
+* other value — `''`, `'unavailable'`, a boolean, null — is `null`
+* (unavailable, never 0: D393). The one bridge from a string-valued source (an
+* HA sensor with a unit and no device_class is an `enum-sensor`) to a number.
+*/
+function toNumberOrNull(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? value : null;
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	if (!DECIMAL.test(trimmed)) return null;
+	const parsed = Number(trimmed);
+	return Number.isFinite(parsed) ? parsed : null;
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString(args[1], "convert", 1).trim();
+			const to = asString(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
+	},
+	any: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => args.map((a, i) => asBoolean(a, "any", i)).some((b) => b)
+	},
+	all: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => args.map((a, i) => asBoolean(a, "all", i)).every((b) => b)
+	},
+	within: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args, hooks) => {
+			const windowMs = asFiniteNumber(args[1], "within", 1);
+			if (windowMs < 0) throw new ExpressionEvalError("within: the window must not be negative");
+			const at = args[0];
+			if (at === null) return false;
+			const ts = asFiniteNumber(at, "within", 0);
+			const now = hooks.now;
+			if (now === void 0 || !Number.isFinite(now)) throw new ExpressionEvalError("within: no clock was supplied to this evaluation");
+			const inside = now - ts <= windowMs;
+			if (inside) hooks.noteDeadline?.(ts + windowMs + 1);
+			return inside;
+		}
+	},
+	number: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => toNumberOrNull(args[0])
+	},
+	latest: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const present = args.flatMap((a, i) => a === null ? [] : [asFiniteNumber(a, "latest", i)]);
+			return present.length === 0 ? null : finiteResult(Math.max(...present), "latest");
+		}
+	}
+};
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
+/**
+* Resource-bound constants for the safe expression engine.
+*
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
+*/
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
+]);
+/**
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
+*/
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	}
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
+/**
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
+*
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
+*
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+*/
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
+		};
+	}
+	peek() {
+		return this.tokens[this.pos];
+	}
+	next() {
+		return this.tokens[this.pos++];
+	}
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
+	}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
+		}
+		return false;
+	}
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	}
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
+		}
+		return test;
+	}
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
+				};
+			}
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
+	}
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
+	}
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
+/**
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
+*
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
+*/
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
+	}
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
+	}
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
+	}
+	return result;
+}
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
+}
+Object.freeze({});
+/**
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
+	}
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	}
+	return null;
+}
+/** A composed device's stableId is this prefix plus the block id. */
+var COMPOSED_DEVICE_STABLE_ID_PREFIX = "composed-";
+/** Longest snippet a `code` source may carry (slice 4). */
+var MAX_COMPOSITION_CODE_LENGTH = 2e4;
+var CompositionSourceRefSchema = object({
+	/** The owning addon; `stableId` is unique only within it. */
+	addonId: string().min(1),
+	stableId: string().min(1)
+});
+/** One field of one capability of one source device. */
+var CompositionFieldReadSchema = object({
+	source: CompositionSourceRefSchema,
+	cap: string().min(1),
+	/** Dotted path into the source cap's runtime-state slice. */
+	fieldPath: string().min(1)
+});
+/** `from`: copy one source field verbatim. It is also an expression's `from` binding. */
+var CompositionFromSourceSchema = CompositionFieldReadSchema.extend({ kind: literal("from") });
+var CompositionBindingSchema = discriminatedUnion("kind", [CompositionFromSourceSchema, object({
+	kind: literal("literal"),
+	value: union([
+		string(),
+		number(),
+		boolean(),
+		_null()
+	])
+})]);
+/**
+* `expression`: a formula over named bindings, in the salvaged expression
+* engine. Validated at parse by the SAME function every other consumer runs,
+* so the editor and the store cannot disagree.
+*/
+var CompositionExpressionSourceSchema = object({
+	kind: literal("expression"),
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), CompositionBindingSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+/** `code`: RESERVED for slice 4 (own runner, one-way eject). */
+var CompositionCodeSourceSchema = object({
+	kind: literal("code"),
+	code: string().min(1).max(MAX_COMPOSITION_CODE_LENGTH)
+});
+var CompositionFieldSourceSchema = discriminatedUnion("kind", [
+	CompositionFromSourceSchema,
+	CompositionExpressionSourceSchema,
+	CompositionCodeSourceSchema
+]);
+var CompositionCommandTargetSchema = discriminatedUnion("kind", [object({
+	kind: literal("forward"),
+	source: CompositionSourceRefSchema,
+	cap: string().min(1),
+	method: string().min(1)
+}), CompositionCodeSourceSchema]);
+/** An item key inside an item-array cap (`consumables.items[<key>]`). */
+var COMPOSITION_ITEM_KEY_RE = /^[a-z0-9][a-z0-9-]{0,47}$/;
+/**
+* One item of an item-array cap (D663), addressed through the cap's
+* `status.itemArray` descriptor. `fields` are paths INSIDE the item, nested
+* allowed (`remaining.value`); the key and label come from the entry itself.
+*/
+var CompositionItemEntrySchema = object({
+	label: string().min(1).max(80),
+	fields: record(string().min(1), CompositionFieldSourceSchema)
+});
+var CompositionFeatureSchema = discriminatedUnion("kind", [object({
+	kind: literal("fields"),
+	cap: string().min(1),
+	fields: record(string().min(1), CompositionFieldSourceSchema).refine((fields) => Object.keys(fields).length <= 32, { message: `at most 32 fields per capability` }),
+	/**
+	* Items of the cap's item array, keyed by item key (D663). Naming `items`
+	* owns the WHOLE array field: the composed value holds exactly these items.
+	*/
+	items: record(string().regex(COMPOSITION_ITEM_KEY_RE), CompositionItemEntrySchema).refine((items) => Object.keys(items).length <= 16, { message: `at most 16 items` }).optional(),
+	/** RESERVED for slice 3; refused by the validator when non-empty. */
+	commands: record(string().min(1), CompositionCommandTargetSchema).optional()
+}), object({
+	kind: literal("passthrough"),
+	cap: string().min(1),
+	source: CompositionSourceRefSchema
+})]);
+var CompositionSchema = object({
+	target: discriminatedUnion("kind", [object({
+		kind: literal("new"),
+		type: _enum(DeviceType),
+		role: _enum(DeviceRole).optional()
+	}), object({
+		kind: literal("existing"),
+		device: CompositionSourceRefSchema
+	})]),
+	features: array(CompositionFeatureSchema).min(1).max(16)
+}).superRefine((composition, ctx) => {
+	const seen = /* @__PURE__ */ new Set();
+	composition.features.forEach((feature, index) => {
+		if (seen.has(feature.cap)) ctx.addIssue({
+			code: "custom",
+			message: `capability \`${feature.cap}\` is composed twice — one feature per capability`,
+			path: [
+				"features",
+				index,
+				"cap"
+			]
+		});
+		seen.add(feature.cap);
+	});
+});
 new Set([
 	"track",
 	"summary",
@@ -9507,1023 +10269,480 @@ var DecoderSessionConfigSchema = object({
 	*/
 	deviceId: number().int().nonnegative().optional(),
 	/**
-	* Free-form tag for log scoping. Stream-broker uses
-	* `broker:<deviceId>/<profile>`. Decoder session logger surfaces it
-	* on every line so `grep tag=broker:5/high` filters one camera
-	* profile cleanly.
-	*/
-	tag: string().optional(),
-	/**
-	* Where the session delivers decoded frames (Phase 5 / D9):
-	*
-	* - `'callback'` (default) — the legacy pixel path: decoded frames are
-	*   buffered as `DecodedFrame`s and drained via `pullFrames`.
-	* - `'shm'` — the shared-memory frame plane: decoded frames are written
-	*   into an OS shared-memory ring and drained as zero-pixel
-	*   `FrameHandle`s via `pullHandles`. A session is one mode or the
-	*   other — `pullFrames` returns nothing for an `'shm'` session and
-	*   `pullHandles` returns nothing for a `'callback'` session.
-	*/
-	frameSink: _enum(["callback", "shm"]).default("callback"),
-	/**
-	* Per-camera decoder DEBUG facility. When `true`, a pull-mode session emits
-	* a throttled (~1Hz) structured `decoder debug` line (effective/adaptive fps,
-	* real-time lag, dropped-frame delta, avg decode time, hwaccel). Mirrors the
-	* stream-broker's `streamingDebug` gate — off by default so production logs
-	* stay quiet and the emit path pays zero per-frame cost when disabled.
-	*/
-	debug: boolean().optional()
-});
-/**
-* Per-component log CHANNELS — the gate a hot path consults, and the registry
-* an addon declares its channels in.
-*
-* ## Two axes, deliberately separated
-*
-* - **DECLARATION** — which channels exist. Only the addon knows:
-*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
-*   baichuan/handshake. A hand-wired central list rots at the first addition,
-*   and rots silently. So a channel is declared where it is consulted, and the
-*   `log-channels` capability enumerates the declarations.
-* - **VALUE** — at which level, for which scope, until when. That stays ONE
-*   thing: the logging settings document on the `system` cap. Two authorities
-*   over the values is the exact defect
-*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
-*   remove; re-introducing it from the cure side would be grotesque.
-*
-* Nothing in this file reads a clock, an env var or a store. The registry is
-* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
-* the hot path with a value somebody actually read, and by
-* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
-* never reaches here, so it can neither disarm an armed channel nor arm a
-* disarmed one (D49).
-*
-* ## The canonical call shape
-*
-* ```ts
-* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
-*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
-* }
-* ```
-*
-* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
-* read. Disarmed, a call site costs one load and one branch, and the `extras`
-* object literal is never constructed because it lives inside the branch. It
-* is the same shape already proven in production at `stream-broker.ts:1650`,
-* and the same discipline `LoggingGate.allowsDestination` uses for the
-* destination floor (measured at 1.93 ns/call when off).
-*
-* ## Why a channel emits at `info`
-*
-* `loki-logging.addon.ts` pins the destination default at `info` and
-* `loki-destination.ts` drops everything below it, so a line emitted at
-* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
-* minutes. A diagnostic that cannot be read an hour later is worse than no
-* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
-* emits at the channel's declared level, whose schema floor is `info`.
-*/
-/**
-* The level a channel writes at once armed.
-*
-* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
-* not leave the process for Loki, and the whole point of arming a channel is
-* to read it later.
-*/
-var LogChannelLevelSchema = _enum([
-	"info",
-	"warn",
-	"error"
-]);
-/**
-* What an addon declares about one channel. No value, no state — a
-* declaration is inert.
-*/
-var LogChannelDescriptorSchema = object({
-	/**
-	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
-	* the addon's short name so an operator reading a channel list can tell who
-	* owns it without a second lookup.
-	*/
-	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
-	/** One sentence: what the operator will SEE after arming it. */
-	description: string().min(1),
-	/** The level its lines are emitted at. Never below `info`. */
-	defaultLevel: LogChannelLevelSchema,
-	/**
-	* Whether this channel can be narrowed to a camera.
-	*
-	* `true` is a PROMISE with two halves, and both must hold: the gate is
-	* consulted with the numeric device id, AND every line the channel admits
-	* carries `tags: { deviceId }` with that same numeric id. The second half is
-	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
-	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
-	* the body is the only way to filter.
-	*
-	* A channel whose lines carry the device only in `meta` (or not at all) is
-	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
-	* the operator narrows to one camera, sees nothing, and concludes the code
-	* path was never taken.
-	*/
-	perDevice: boolean()
-});
-/**
-* An armed window over one channel, as the document hands it to a mirror.
-*
-* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
-* expires by itself, which is the one failure a boolean cannot avoid.
-*/
-var LogChannelWindowSchema = object({
-	channel: string().min(1),
-	/** Epoch ms the window closes at. */
-	armedUntilMs: number(),
-	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
-	deviceIds: array(number().int()).readonly().nullable()
-});
-var ClipModelMetaSchema = object({
-	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
-	textModelId: string().min(1),
-	/** Output dimension of BOTH towers. A vector of any other length is refused. */
-	embeddingDim: number().int().positive(),
-	/**
-	* The `vector-store` index this model's vectors live in. ONE feature space
-	* per index: two models share an index only when their vectors are ranked
-	* against each other, which for CLIP means never across families. MobileCLIP
-	* S1 and S2 share `object-clip` for history (separated by the row's
-	* `modelId`); any other model gets its own.
-	*/
-	vectorIndex: string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
-	/**
-	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
-	* must be unique per tokenizer: every model's siblings land in ONE flat
-	* models directory, so two different tokenizers under the same name would
-	* silently overwrite each other (whichever model downloaded last wins, and
-	* the other one tokenises with the wrong vocabulary).
-	*/
-	tokenizerFile: string().min(1),
-	/** Token window the text graph takes (SigLIP2: 64; CLIP BPE: 77). */
-	contextLength: number().int().positive(),
-	/** Id the tokenizer pads with. */
-	padId: number().int().nonnegative(),
-	/**
-	* The search cosine floor at `strictness: 'loose'` — calibrated per model,
-	* because cosine bands are a property of the model: 0.2 keeps 96% of matched
-	* COCO caption-image pairs on MobileCLIP S1 and 2.7% on SigLIP2.
-	*/
-	searchMinScore: number().min(0).max(1)
-});
-var ClipSearchStrictnessSchema = _enum([
-	"loose",
-	"balanced",
-	"strict"
-]);
-var MODEL_FORMATS = [
-	"onnx",
-	"coreml",
-	"openvino",
-	"tflite",
-	"pt",
-	"gguf"
-];
-/**
-* Multi-file format payload.
-*
-* - Directory formats (`isDirectory: true`, e.g. `.mlpackage`): files
-*   relative to the directory root — the downloader fetches each from
-*   `{url}/{file}` into `{modelDir}/{file}`. If omitted, it probes the
-*   HuggingFace API (slower).
-* - Single-file formats (no `isDirectory`, e.g. OpenVINO IR): sibling
-*   files fetched from the SAME remote directory as `url` and stored flat
-*   alongside the main file — e.g. `['camstack-yolov9t.bin']` for the IR
-*   weights next to `camstack-yolov9t.xml`.
-*/
-var ModelFormatEntrySchema = object({
-	url: string(),
-	sizeMB: number(),
-	/** Whether this format is a directory bundle (e.g., .mlpackage) rather than a single file */
-	isDirectory: boolean().optional(),
-	/** Multi-file payload (directory members or sibling files). */
-	files: array(string()).readonly().optional(),
-	/** Runtime(s) that can use this format. If omitted, inferred from ModelFormat key */
-	runtimes: array(_enum(["python"])).readonly().optional()
-});
-/**
-* Extra file that must be downloaded alongside the model (e.g., labels JSON, dict.txt).
-* The downloader fetches from `url` and saves to `{modelsDir}/{filename}`.
-*/
-var ModelExtraFileSchema = object({
-	url: string(),
-	filename: string(),
-	sizeMB: number()
-});
-/**
-* Per-format payload map. Modelled as an explicit object (one optional key
-* per `ModelFormat`) rather than `z.record(enum, …)` — zod v4's enum-keyed
-* record requires every key, but a catalog entry only ships a subset of
-* formats.
-*/
-var ModelFormatsSchema = object({
-	onnx: ModelFormatEntrySchema.optional(),
-	coreml: ModelFormatEntrySchema.optional(),
-	openvino: ModelFormatEntrySchema.optional(),
-	tflite: ModelFormatEntrySchema.optional(),
-	pt: ModelFormatEntrySchema.optional(),
-	gguf: ModelFormatEntrySchema.optional()
-});
-/**
-* Variant-selector grouping axes. Shared by the full `ModelCatalogEntry` and by
-* the reduced `PipelineModelOption` returned in `pipeline.getSchema()` so the
-* grouped Family→Tier→Variant picker renders identically in the config UI and
-* in the pipeline/device steppers. The flat `id` stays the source of truth for
-* resolution/download/persistence; this is a presentation overlay resolved back
-* to an `id`.
-*/
-var ModelVariantGroupSchema = object({
-	/** Top-level family, e.g. `yolo26` (later `d-fine`, `rf-detr`). */
-	family: string(),
-	/** Size within the family, e.g. `n` | `s` | `m` | `l`. */
-	tier: string(),
-	/** Quantization axis. Omit ⇒ the fp32 base build. */
-	precision: _enum(["fp32", "int8"]).optional(),
-	/**
-	* Speed-optimization axis. Omit ⇒ the standard build. `fast` marks a
-	* latency-optimized export (e.g. ReLU-activation variant) — the slot the
-	* future performance variants plug into.
-	*/
-	optimization: _enum(["standard", "fast"]).optional(),
-	/**
-	* Input-resolution axis (square input side, px). Omit ⇒ the family's native
-	* resolution (640 for yolo26). Reduced-input builds (320 / 256) are a big,
-	* cheap latency lever — especially on Apple ANE and the Intel N100 — at a
-	* small-object accuracy cost. Mirrors the model's `inputSize` but lifted onto
-	* the group so the selector can offer it as a variant axis.
-	*/
-	resolution: number().int().positive().optional()
-});
-var ModelProviderIdSchema = _enum([
-	"camstack",
-	"frigate",
-	"scrypted",
-	"custom"
-]);
-var ModelCatalogEntrySchema = object({
-	id: string(),
-	name: string(),
-	description: string(),
-	formats: ModelFormatsSchema,
-	inputSize: object({
-		width: number(),
-		height: number()
-	}),
-	/**
-	* Channel count of the model input tensor. Omit ⇒ 3 (RGB), the default for
-	* every detector / classifier / embedder. Set to 1 for a grayscale CTC text
-	* recognizer (EasyOCR VGG plate-OCR: input `[N,1,H,W]`) so the preprocess
-	* feeds a single-channel, EasyOCR-normalized tensor instead of the default
-	* 3-channel RGB one. Threaded through `PoolModelConfig.inputChannels` to the
-	* Python inference pool.
-	*/
-	inputChannels: number().int().positive().optional(),
-	labels: array(LabelDefinitionSchema).readonly(),
-	inputLayout: _enum(["nchw", "nhwc"]).optional(),
-	/**
-	* `'scrfd'` applies InsightFace's SCRFD input contract, `(x - 127.5) / 128`
-	* (upstream `insightface/model_zoo/scrfd.py`), instead of the historical
-	* plain `/255`. Measured against COCO GT: 188 → 196 faces found on the
-	* `scrfd-2.5g` catalog entry (2026-09-26 model-replacement spike, §2.4-2).
-	*/
-	inputNormalization: _enum([
-		"zero-one",
-		"imagenet",
-		"none",
-		"scrfd"
-	]).optional(),
-	/**
-	* The model already applies softmax IN-GRAPH — its raw output is a
-	* probability distribution, not logits. When set, the `softmax`
-	* postprocessor must NOT re-apply softmax: re-softmaxing an already-normalised
-	* probability vector collapses it toward uniform (top-1 score craters far
-	* below its true value, making every confidence gate meaningless). Absent ⇒
-	* the output is raw logits and the postprocessor applies softmax (the normal
-	* case). Set on the Google AIY Birds `bird-classifier` (softmax baked into the
-	* TF graph). Threaded to the Python pool via `PoolModelConfig.outputProbabilities`.
-	*/
-	outputProbabilities: boolean().optional(),
-	preprocessMode: _enum(["letterbox", "resize"]).optional(),
-	/**
-	* Per-MODEL postprocessor override. Absent ⇒ the step's own
-	* `StepDefinition.postprocessor` applies (the normal case — every model in a
-	* step shares its decode). Set it when a step hosts models with DIFFERENT raw
-	* output layouts under one slot: e.g. object-detection is `'yolo'` by default,
-	* but a Coral SSD MobileNet build emits the `TFLite_Detection_PostProcess`
-	* 4-tensor layout and needs `'ssd'`. Threaded into `PoolModelConfig.postprocessor`
-	* by the engine factory (`modelEntry.postprocessor ?? def.postprocessor`).
-	*/
-	postprocessor: custom().optional(),
-	/**
-	* When true, the executor produces a landmark-aligned crop (similarity warp
-	* onto the canonical template) before this step runs, instead of a plain
-	* axis-aligned bbox crop. Required for face-recognition embedders (ArcFace):
-	* their embeddings are only discriminative on an aligned input. The face
-	* detector that produced the parent detail must emit 5 landmarks.
-	*/
-	faceAlignment: boolean().optional(),
-	/**
-	* Auxiliary files required at runtime (labels JSON, charset dict, etc.).
-	* Downloaded into the same modelsDir alongside the model file.
-	*/
-	extraFiles: array(ModelExtraFileSchema).readonly().optional(),
-	/**
-	* LEGACY entry — retained in the catalog so a persisted operator selection
-	* still RESOLVES (and can be re-activated), but hidden from the selectable
-	* model list and excluded from the auto format-default pick. Set on the
-	* superseded / consolidated models (older lineages, redundant fp16 IRs) so
-	* the active lineup stays the coherent curated ladder without deleting a
-	* model anyone may still be pinned to. `resolveModelForFormat` keeps honoring
-	* an explicit legacy id that has a build for the node's format.
-	*/
-	legacy: boolean().optional(),
-	/**
-	* Measured quality/latency metadata — populated from the benchmark addon on
-	* the real node classes. Absent = not yet measured (most entries today; the
-	* catalog historically carried only `sizeMB`, a poor cross-architecture
-	* speed proxy). `p95LatencyMs` is keyed by node class (e.g. `n100`, `mac`).
-	*/
-	metrics: object({
-		map50: number().optional(),
-		p95LatencyMs: record(string(), number()).optional()
-	}).optional(),
-	/**
-	* SPDX-ish license id of the model weights (e.g. `AGPL-3.0` for Ultralytics
-	* YOLO26, `GPL-3.0` for YOLOv9, `Apache-2.0` for D-FINE/RF-DETR). Matters for
-	* the retraining addon and any future commercial distribution.
-	*/
-	license: string().optional(),
-	/**
-	* Variant-selector grouping. The UI groups models by `family` + `tier` and
-	* offers `precision` / `optimization` as variant axes WITHIN a tier — so all
-	* of a family's sizes and quantizations collapse into one grouped picker
-	* instead of a flat list of `yolo26s`, `yolo26s-int8`, … Absent ⇒ ungrouped
-	* (legacy / custom models) — never shown in the grouped selector. The flat
-	* `id` stays the source of truth for resolution/download/persistence; grouping
-	* is a presentation overlay resolved back to an `id`.
-	*/
-	group: ModelVariantGroupSchema.optional(),
-	/**
-	* Catalog source for the pipeline stepper's provider-first picker. Absent on
-	* built-in CamStack entries (treated as `camstack`) and on registry rows
-	* persisted before this field existed (`inferModelProvider` fills those).
+	* Free-form tag for log scoping. Stream-broker uses
+	* `broker:<deviceId>/<profile>`. Decoder session logger surfaces it
+	* on every line so `grep tag=broker:5/high` filters one camera
+	* profile cleanly.
 	*/
-	provider: ModelProviderIdSchema.optional(),
+	tag: string().optional(),
 	/**
-	* Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
-	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
-	* labels already ARE the CamStack macros (Scrypted identity map).
+	* Where the session delivers decoded frames (Phase 5 / D9):
+	*
+	* - `'callback'` (default) — the legacy pixel path: decoded frames are
+	*   buffered as `DecodedFrame`s and drained via `pullFrames`.
+	* - `'shm'` — the shared-memory frame plane: decoded frames are written
+	*   into an OS shared-memory ring and drained as zero-pixel
+	*   `FrameHandle`s via `pullHandles`. A session is one mode or the
+	*   other — `pullFrames` returns nothing for an `'shm'` session and
+	*   `pullHandles` returns nothing for a `'callback'` session.
 	*/
-	classMap: DetectionCatalogClassMapSchema.optional(),
+	frameSink: _enum(["callback", "shm"]).default("callback"),
 	/**
-	* The model's CLIP feature-space contract (text encoder, dimension, vector
-	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
-	* CLIP image encoder; its absence is what "not a CLIP model" means to the
-	* embedding encoder and the semantic-search store (D649).
+	* Per-camera decoder DEBUG facility. When `true`, a pull-mode session emits
+	* a throttled (~1Hz) structured `decoder debug` line (effective/adaptive fps,
+	* real-time lag, dropped-frame delta, avg decode time, hwaccel). Mirrors the
+	* stream-broker's `streamingDebug` gate — off by default so production logs
+	* stay quiet and the emit path pays zero per-frame cost when disabled.
 	*/
-	clip: ClipModelMetaSchema.optional()
-});
-var ConvertTargetSchema = discriminatedUnion("format", [object({
-	format: literal("openvino"),
-	precisions: array(_enum(["fp16", "int8"])).min(1).readonly()
-}), object({ format: literal("coreml") })]);
-var ModelConvertMetadataSchema = object({
-	id: string().regex(/^[a-zA-Z0-9._-]+$/),
-	name: string(),
-	labels: array(LabelDefinitionSchema).readonly(),
-	inputSize: object({
-		width: number(),
-		height: number()
-	}),
-	inputLayout: _enum(["nchw", "nhwc"]).optional(),
-	inputNormalization: _enum([
-		"zero-one",
-		"imagenet",
-		"none",
-		"scrfd"
-	]).optional(),
-	preprocessMode: _enum(["letterbox", "resize"]).optional(),
-	outputFormat: _enum([
-		"yolo",
-		"ssd",
-		"embedding",
-		"classification",
-		"ocr",
-		"segmentation"
-	]),
-	faceAlignment: boolean().optional(),
-	classMap: DetectionCatalogClassMapSchema.optional()
-});
-var ConvertResultSchema = object({
-	entry: ModelCatalogEntrySchema,
-	artifacts: array(object({
-		format: _enum(MODEL_FORMATS),
-		precision: _enum(["fp16", "int8"]).optional(),
-		sizeMB: number(),
-		validated: boolean(),
-		files: array(string()).readonly()
-	})).readonly()
+	debug: boolean().optional()
 });
 /**
-* Error types for the safe expression engine. Two distinct classes so callers
-* can tell a compile-time (grammar) failure from a runtime (evaluation)
-* failure — both are non-fatal to the host: read paths degrade to "skip link".
-*/
-/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
-*  the failure is anchored to a character (author-facing inline feedback). */
-var ExpressionParseError = class extends Error {
-	position;
-	constructor(message, position) {
-		super(message);
-		this.name = "ExpressionParseError";
-		this.position = position;
-	}
-};
-/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
-*  result, unknown builtin, step-budget exceeded). */
-var ExpressionEvalError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ExpressionEvalError";
-	}
-};
-/**
-* Frozen, null-prototype builtin function table for the expression engine
-* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
-* parser rejects any callee not in it, and the evaluator gates each call on an
-* own-property check against it.
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
+*
+* ## Two axes, deliberately separated
+*
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
+*
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
+*
+* ## The canonical call shape
+*
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
+*
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
 *
-* Because the object has a NULL prototype AND is `Object.freeze`d:
-*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
-*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
-*    (there is no `Object.prototype` in the chain), so those names are not
-*    callable — they are simply "unknown function" at parse time.
+* ## Why a channel emits at `info`
 *
-* Every numeric argument is validated as a finite number and every numeric
-* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
-* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
-* closed rather than emitting a garbage value.
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
 */
-function asFiniteNumber(value, name, index) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
-	return value;
-}
-function asString$1(value, name, index) {
-	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
-	return value;
-}
-function finiteResult(value, name) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
-	return value;
-}
-function allFiniteNumbers(args, name) {
-	return args.map((a, idx) => asFiniteNumber(a, name, idx));
-}
-var INF = Number.POSITIVE_INFINITY;
-var table = {
-	min: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
-	},
-	max: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
-	},
-	abs: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
-	},
-	floor: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
-	},
-	ceil: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
-	},
-	sqrt: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
-	},
-	round: {
-		minArgs: 1,
-		maxArgs: 2,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "round", 0);
-			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
-			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
-			const factor = 10 ** digits;
-			return finiteResult(Math.round(x * factor) / factor, "round");
-		}
-	},
-	pow: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
-	},
-	clamp: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "clamp", 0);
-			const lo = asFiniteNumber(args[1], "clamp", 1);
-			const hi = asFiniteNumber(args[2], "clamp", 2);
-			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
-			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
-		}
-	},
-	avg: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const nums = allFiniteNumbers(args, "avg");
-			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
-		}
-	},
-	sum: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
-	},
-	coalesce: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			for (const a of args) if (a !== null) return a;
-			return null;
-		}
-	},
-	age: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
-	},
-	convert: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args, hooks) => {
-			const x = asFiniteNumber(args[0], "convert", 0);
-			const from = asString$1(args[1], "convert", 1).trim();
-			const to = asString$1(args[2], "convert", 2).trim();
-			if (hooks.convert) {
-				const out = hooks.convert(x, from, to);
-				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
-				return finiteResult(out, "convert");
-			}
-			if (from === to) return x;
-			throw new ExpressionEvalError("convert: unit conversion table not installed");
-		}
-	}
-};
-Object.freeze(Object.assign(Object.create(null), table));
-/** The set of valid builtin names — used by the parser to reject unknown
-*  callees at parse time (immediate author feedback). */
-var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
 /**
-* Resource-bound constants for the safe expression engine.
+* The level a channel writes at once armed.
 *
-* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
-* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
-* O(nodeCount) by construction. These caps merely put a hard ceiling on the
-* work a single author-supplied expression can request, so a hostile or
-* accidental pathological string can never spend unbounded CPU/memory.
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
 */
-/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
-*  rejected without allocation. */
-var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
-/** A legal binding / identifier name. */
-var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Binding names an author may NOT use: `now` is auto-injected; the literal
-*  keywords lex as values, not identifiers, so binding to them is meaningless. */
-var RESERVED_BINDING_NAMES = new Set([
-	"now",
-	"true",
-	"false",
-	"null"
+var LogChannelLevelSchema = _enum([
+	"info",
+	"warn",
+	"error"
 ]);
 /**
-* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
-* zero-dependency. The grammar is deliberately boring: decimal numbers,
-* single/double-quoted strings with a tiny escape set, identifiers, the three
-* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
-* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
-* is a parse error with a source position, so member access / assignment /
-* template literals are lexically impossible.
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
 */
-var KEYWORDS = new Set([
-	"true",
-	"false",
-	"null"
-]);
-function isDigit(ch) {
-	return ch >= "0" && ch <= "9";
-}
-function isIdentStart(ch) {
-	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
-}
-function isIdentPart(ch) {
-	return isIdentStart(ch) || isDigit(ch);
-}
-function isWhitespace(ch) {
-	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
-}
-/** Tokenize `source` into a flat token list ending with a single `eof` token.
-*  Throws `ExpressionParseError` on any illegal character or unterminated
-*  string. */
-function tokenize(source) {
-	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
-	const tokens = [];
-	let i = 0;
-	const n = source.length;
-	while (i < n) {
-		const ch = source[i];
-		if (isWhitespace(ch)) {
-			i += 1;
-			continue;
-		}
-		if (isDigit(ch)) {
-			const start = i;
-			while (i < n && isDigit(source[i])) i += 1;
-			if (i < n && source[i] === ".") {
-				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
-				i += 1;
-				while (i < n && isDigit(source[i])) i += 1;
-			}
-			const text = source.slice(start, i);
-			const value = Number(text);
-			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
-			tokens.push({
-				type: "number",
-				value,
-				pos: start
-			});
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			const quote = ch;
-			const start = i;
-			i += 1;
-			let out = "";
-			let closed = false;
-			while (i < n) {
-				const c = source[i];
-				if (c === "\\") {
-					const next = i + 1 < n ? source[i + 1] : "";
-					if (next === "\\" || next === "'" || next === "\"") {
-						out += next;
-						i += 2;
-						continue;
-					}
-					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
-				}
-				if (c === quote) {
-					closed = true;
-					i += 1;
-					break;
-				}
-				out += c;
-				i += 1;
-			}
-			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
-			tokens.push({
-				type: "string",
-				value: out,
-				pos: start
-			});
-			continue;
-		}
-		if (isIdentStart(ch)) {
-			const start = i;
-			while (i < n && isIdentPart(source[i])) i += 1;
-			const text = source.slice(start, i);
-			if (KEYWORDS.has(text)) tokens.push({
-				type: "keyword",
-				keyword: keywordOf(text),
-				pos: start
-			});
-			else tokens.push({
-				type: "identifier",
-				name: text,
-				pos: start
-			});
-			continue;
-		}
-		const two = i + 1 < n ? source.slice(i, i + 2) : "";
-		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
-			tokens.push({
-				type: "punct",
-				punct: two,
-				pos: i
-			});
-			i += 2;
-			continue;
-		}
-		if (isSinglePunct(ch)) {
-			tokens.push({
-				type: "punct",
-				punct: ch,
-				pos: i
-			});
-			i += 1;
-			continue;
-		}
-		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
-	}
-	tokens.push({
-		type: "eof",
-		pos: n
-	});
-	return tokens;
-}
-function keywordOf(text) {
-	if (text === "true") return "true";
-	if (text === "false") return "false";
-	return "null";
-}
-function isSinglePunct(ch) {
-	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
-}
+var LogChannelDescriptorSchema = object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: boolean()
+});
 /**
-* Pratt (precedence-climbing) parser for the safe expression mini-language.
+* An armed window over one channel, as the document hands it to a mirror.
 *
-* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
-* → relational → additive → multiplicative → unary `! -` → call / primary.
-* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
-* string validated against the builtin table at parse time, so an unknown
-* function is rejected immediately (author feedback) and a persisted expression
-* that references a since-removed builtin degrades at read.
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
+*/
+var LogChannelWindowSchema = object({
+	channel: string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: array(number().int()).readonly().nullable()
+});
+var ClipModelMetaSchema = object({
+	/** The paired text encoder's catalog id (the embedding-encoder's text catalog). */
+	textModelId: string().min(1),
+	/** Output dimension of BOTH towers. A vector of any other length is refused. */
+	embeddingDim: number().int().positive(),
+	/**
+	* The `vector-store` index this model's vectors live in. ONE feature space
+	* per index: two models share an index only when their vectors are ranked
+	* against each other, which for CLIP means never across families. MobileCLIP
+	* S1 and S2 share `object-clip` for history (separated by the row's
+	* `modelId`); any other model gets its own.
+	*/
+	vectorIndex: string().regex(/^object-clip(-[a-z0-9][a-z0-9-]*)?$/),
+	/**
+	* The text encoder's tokenizer, a declared SIBLING file of its onnx. The name
+	* must be unique per tokenizer: every model's siblings land in ONE flat
+	* models directory, so two different tokenizers under the same name would
+	* silently overwrite each other (whichever model downloaded last wins, and
+	* the other one tokenises with the wrong vocabulary).
+	*/
+	tokenizerFile: string().min(1),
+	/** Token window the text graph takes (SigLIP2: 64; CLIP BPE: 77). */
+	contextLength: number().int().positive(),
+	/** Id the tokenizer pads with. */
+	padId: number().int().nonnegative(),
+	/**
+	* The search cosine floor at `strictness: 'loose'` — calibrated per model,
+	* because cosine bands are a property of the model: 0.2 keeps 96% of matched
+	* COCO caption-image pairs on MobileCLIP S1 and 2.7% on SigLIP2.
+	*/
+	searchMinScore: number().min(0).max(1)
+});
+var ClipSearchStrictnessSchema = _enum([
+	"loose",
+	"balanced",
+	"strict"
+]);
+var MODEL_FORMATS = [
+	"onnx",
+	"coreml",
+	"openvino",
+	"tflite",
+	"pt",
+	"gguf"
+];
+/**
+* Multi-file format payload.
 *
-* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
-* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+* - Directory formats (`isDirectory: true`, e.g. `.mlpackage`): files
+*   relative to the directory root — the downloader fetches each from
+*   `{url}/{file}` into `{modelDir}/{file}`. If omitted, it probes the
+*   HuggingFace API (slower).
+* - Single-file formats (no `isDirectory`, e.g. OpenVINO IR): sibling
+*   files fetched from the SAME remote directory as `url` and stored flat
+*   alongside the main file — e.g. `['camstack-yolov9t.bin']` for the IR
+*   weights next to `camstack-yolov9t.xml`.
 */
-/** Binary/logical operator precedence (higher binds tighter). */
-var BINARY_PRECEDENCE = {
-	"||": 1,
-	"&&": 2,
-	"==": 3,
-	"!=": 3,
-	"<": 4,
-	"<=": 4,
-	">": 4,
-	">=": 4,
-	"+": 5,
-	"-": 5,
-	"*": 6,
-	"/": 6,
-	"%": 6
-};
-function isLogicalOp(op) {
-	return op === "&&" || op === "||";
-}
-function isBinaryOp(op) {
-	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
-}
-var Parser = class {
-	tokens;
-	pos = 0;
-	nodeCount = 0;
-	identifiers = /* @__PURE__ */ new Set();
-	callees = /* @__PURE__ */ new Set();
-	constructor(tokens) {
-		this.tokens = tokens;
-	}
-	parse() {
-		const ast = this.parseTernary();
-		const tok = this.peek();
-		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
-		return {
-			ast,
-			identifiers: this.identifiers,
-			callees: this.callees,
-			nodeCount: this.nodeCount
-		};
-	}
-	peek() {
-		return this.tokens[this.pos];
-	}
-	next() {
-		return this.tokens[this.pos++];
-	}
-	/** Consume a punctuator token, erroring if the next token isn't it. */
-	expectPunct(punct) {
-		const tok = this.peek();
-		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
-		this.pos += 1;
-	}
-	matchPunct(punct) {
-		const tok = this.peek();
-		if (tok.type === "punct" && tok.punct === punct) {
-			this.pos += 1;
-			return true;
-		}
-		return false;
-	}
-	countNode() {
-		this.nodeCount += 1;
-		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
-	}
-	parseTernary() {
-		const test = this.parseBinary(1);
-		if (this.matchPunct("?")) {
-			const consequent = this.parseTernary();
-			this.expectPunct(":");
-			const alternate = this.parseTernary();
-			this.countNode();
-			return {
-				kind: "conditional",
-				test,
-				consequent,
-				alternate
-			};
-		}
-		return test;
-	}
-	parseBinary(minPrec) {
-		let left = this.parseUnary();
-		for (;;) {
-			const tok = this.peek();
-			if (tok.type !== "punct") break;
-			const prec = BINARY_PRECEDENCE[tok.punct];
-			if (prec === void 0 || prec < minPrec) break;
-			const op = tok.punct;
-			this.pos += 1;
-			const right = this.parseBinary(prec + 1);
-			this.countNode();
-			if (isLogicalOp(op)) left = {
-				kind: "logical",
-				op,
-				left,
-				right
-			};
-			else if (isBinaryOp(op)) left = {
-				kind: "binary",
-				op,
-				left,
-				right
-			};
-			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
-		}
-		return left;
-	}
-	parseUnary() {
-		const tok = this.peek();
-		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
-			const op = tok.punct;
-			this.pos += 1;
-			const operand = this.parseUnary();
-			this.countNode();
-			return {
-				kind: "unary",
-				op,
-				operand
-			};
-		}
-		return this.parsePrimary();
-	}
-	parsePrimary() {
-		const tok = this.next();
-		switch (tok.type) {
-			case "number":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "string":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "keyword":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.keyword === "null" ? null : tok.keyword === "true"
-				};
-			case "identifier": {
-				const nextTok = this.peek();
-				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
-				this.identifiers.add(tok.name);
-				this.countNode();
-				return {
-					kind: "identifier",
-					name: tok.name
-				};
-			}
-			case "punct":
-				if (tok.punct === "(") {
-					const inner = this.parseTernary();
-					this.expectPunct(")");
-					return inner;
-				}
-				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
-			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
-		}
-	}
-	parseCall(callee, pos) {
-		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
-		this.expectPunct("(");
-		const args = [];
-		if (!this.matchPunct(")")) for (;;) {
-			args.push(this.parseTernary());
-			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
-			if (this.matchPunct(",")) continue;
-			this.expectPunct(")");
-			break;
-		}
-		this.callees.add(callee);
-		this.countNode();
-		return {
-			kind: "call",
-			callee,
-			args
-		};
-	}
-};
-/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
-*  `ExpressionParseError` on any lexical or grammatical failure. */
-function parseExpression(source) {
-	return new Parser(tokenize(source)).parse();
-}
+var ModelFormatEntrySchema = object({
+	url: string(),
+	sizeMB: number(),
+	/** Whether this format is a directory bundle (e.g., .mlpackage) rather than a single file */
+	isDirectory: boolean().optional(),
+	/** Multi-file payload (directory members or sibling files). */
+	files: array(string()).readonly().optional(),
+	/** Runtime(s) that can use this format. If omitted, inferred from ModelFormat key */
+	runtimes: array(_enum(["python"])).readonly().optional()
+});
 /**
-* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
-* by expr"). The cache stores BOTH successes and failures (negative caching),
-* so a corrupt persisted string costs exactly one tokenize+parse total — not
-* one per read on a hot resolve path.
-*
-* The cache is a module-level singleton: entries are pure, content-addressed
-* ASTs keyed by the raw source string, so sharing one instance across all
-* callers is safe and maximises hit rate.
+* Extra file that must be downloaded alongside the model (e.g., labels JSON, dict.txt).
+* The downloader fetches from `url` and saves to `{modelsDir}/{filename}`.
 */
-var cache = /* @__PURE__ */ new Map();
-function getCached(source) {
-	const hit = cache.get(source);
-	if (hit !== void 0) {
-		cache.delete(source);
-		cache.set(source, hit);
-		return hit;
-	}
-	let result;
-	try {
-		result = {
-			ok: true,
-			parsed: parseExpression(source)
-		};
-	} catch (err) {
-		result = {
-			ok: false,
-			error: err instanceof ExpressionParseError ? err.message : String(err)
-		};
-	}
-	cache.set(source, result);
-	if (cache.size > 256) {
-		const oldest = cache.keys().next().value;
-		if (oldest !== void 0) cache.delete(oldest);
-	}
-	return result;
-}
-/** Compile `source`, returning a discriminated result instead of throwing.
-*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
-function compileExpressionSafe(source) {
-	return getCached(source);
-}
-Object.freeze({});
+var ModelExtraFileSchema = object({
+	url: string(),
+	filename: string(),
+	sizeMB: number()
+});
 /**
-* Author-time validation. Returns `null` when the source is valid, else a
-* human-readable error message. Checks: the expression compiles; binding count
-* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
-* is not reserved (`now`/keywords) and does not shadow a builtin; and every
-* FREE identifier of the AST is covered by a binding or the injected `now`.
+* Per-format payload map. Modelled as an explicit object (one optional key
+* per `ModelFormat`) rather than `z.record(enum, …)` — zod v4's enum-keyed
+* record requires every key, but a catalog entry only ships a subset of
+* formats.
 */
-function validateExpressionSource(src) {
-	const names = Object.keys(src.bindings);
-	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
-	for (const name of names) {
-		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
-		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
-		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
-	}
-	const compiled = compileExpressionSafe(src.expr);
-	if (!compiled.ok) return compiled.error;
-	const bound = new Set(names);
-	for (const id of compiled.parsed.identifiers) {
-		if (id === "now") continue;
-		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
-	}
-	return null;
-}
+var ModelFormatsSchema = object({
+	onnx: ModelFormatEntrySchema.optional(),
+	coreml: ModelFormatEntrySchema.optional(),
+	openvino: ModelFormatEntrySchema.optional(),
+	tflite: ModelFormatEntrySchema.optional(),
+	pt: ModelFormatEntrySchema.optional(),
+	gguf: ModelFormatEntrySchema.optional()
+});
+/**
+* Variant-selector grouping axes. Shared by the full `ModelCatalogEntry` and by
+* the reduced `PipelineModelOption` returned in `pipeline.getSchema()` so the
+* grouped Family→Tier→Variant picker renders identically in the config UI and
+* in the pipeline/device steppers. The flat `id` stays the source of truth for
+* resolution/download/persistence; this is a presentation overlay resolved back
+* to an `id`.
+*/
+var ModelVariantGroupSchema = object({
+	/** Top-level family, e.g. `yolo26` (later `d-fine`, `rf-detr`). */
+	family: string(),
+	/** Size within the family, e.g. `n` | `s` | `m` | `l`. */
+	tier: string(),
+	/** Quantization axis. Omit ⇒ the fp32 base build. */
+	precision: _enum(["fp32", "int8"]).optional(),
+	/**
+	* Speed-optimization axis. Omit ⇒ the standard build. `fast` marks a
+	* latency-optimized export (e.g. ReLU-activation variant) — the slot the
+	* future performance variants plug into.
+	*/
+	optimization: _enum(["standard", "fast"]).optional(),
+	/**
+	* Input-resolution axis (square input side, px). Omit ⇒ the family's native
+	* resolution (640 for yolo26). Reduced-input builds (320 / 256) are a big,
+	* cheap latency lever — especially on Apple ANE and the Intel N100 — at a
+	* small-object accuracy cost. Mirrors the model's `inputSize` but lifted onto
+	* the group so the selector can offer it as a variant axis.
+	*/
+	resolution: number().int().positive().optional()
+});
+var ModelProviderIdSchema = _enum([
+	"camstack",
+	"frigate",
+	"scrypted",
+	"custom"
+]);
+/**
+* The licence of a model, as a record rather than a bare SPDX string: a
+* permissive CODE licence routinely sits on top of restrictive WEIGHTS or
+* DATA, and the obligations (attribution, modification notices, source offers)
+* are per upstream. A persisted custom-model row written when this field was a
+* string still parses — the string is lifted into `{ weights }`.
+*
+* Every licence surface (the admin "Models and licenses" page,
+* `THIRD_PARTY_MODELS.md`, the Hugging Face model table) is GENERATED from
+* these records by `scripts/gen-model-licenses.ts` (D661).
+*/
+var ModelLicenseSchema = preprocess((value) => typeof value === "string" ? { weights: value } : value, object({
+	/** SPDX id of the WEIGHTS' terms, a `LicenseRef-*` for non-SPDX terms, or `UNKNOWN`. */
+	weights: string().min(1),
+	/** SPDX id of the upstream code that defines / trained the network. */
+	code: string().min(1).optional(),
+	/** Training data whose terms add obligations (attribution, non-commercial). */
+	data: object({
+		name: string().min(1),
+		terms: string().min(1),
+		url: string().url().optional()
+	}).optional(),
+	/** The project the weights come from. Required on built-in entries (guard). */
+	upstream: object({
+		name: string().min(1),
+		url: string().url()
+	}).optional(),
+	/** Where the licence text governing the weights is published. */
+	url: string().url().optional(),
+	/** Attribution the licence REQUIRES, verbatim. */
+	attribution: string().min(1).optional(),
+	/** What CamStack changed. Required when `hosting` is `camstack-hf` (guard). */
+	modifications: string().min(1).optional(),
+	/** Who serves the file a node downloads. */
+	hosting: _enum([
+		"camstack-hf",
+		"third-party",
+		"built-in"
+	]).optional(),
+	/** True when the weights or their data forbid commercial use. */
+	nonCommercial: boolean().optional()
+}));
+var ModelCatalogEntrySchema = object({
+	id: string(),
+	name: string(),
+	description: string(),
+	formats: ModelFormatsSchema,
+	inputSize: object({
+		width: number(),
+		height: number()
+	}),
+	/**
+	* Channel count of the model input tensor. Omit ⇒ 3 (RGB), the default for
+	* every detector / classifier / embedder. Set to 1 for a grayscale CTC text
+	* recognizer (EasyOCR VGG plate-OCR: input `[N,1,H,W]`) so the preprocess
+	* feeds a single-channel, EasyOCR-normalized tensor instead of the default
+	* 3-channel RGB one. Threaded through `PoolModelConfig.inputChannels` to the
+	* Python inference pool.
+	*/
+	inputChannels: number().int().positive().optional(),
+	labels: array(LabelDefinitionSchema).readonly(),
+	inputLayout: _enum(["nchw", "nhwc"]).optional(),
+	/**
+	* `'scrfd'` applies InsightFace's SCRFD input contract, `(x - 127.5) / 128`
+	* (upstream `insightface/model_zoo/scrfd.py`), instead of the historical
+	* plain `/255`. Measured against COCO GT: 188 → 196 faces found on the
+	* `scrfd-2.5g` catalog entry (2026-09-26 model-replacement spike, §2.4-2).
+	*/
+	inputNormalization: _enum([
+		"zero-one",
+		"imagenet",
+		"none",
+		"scrfd"
+	]).optional(),
+	/**
+	* The model already applies softmax IN-GRAPH — its raw output is a
+	* probability distribution, not logits. When set, the `softmax`
+	* postprocessor must NOT re-apply softmax: re-softmaxing an already-normalised
+	* probability vector collapses it toward uniform (top-1 score craters far
+	* below its true value, making every confidence gate meaningless). Absent ⇒
+	* the output is raw logits and the postprocessor applies softmax (the normal
+	* case). Set on the Google AIY Birds `bird-classifier` (softmax baked into the
+	* TF graph). Threaded to the Python pool via `PoolModelConfig.outputProbabilities`.
+	*/
+	outputProbabilities: boolean().optional(),
+	preprocessMode: _enum(["letterbox", "resize"]).optional(),
+	/**
+	* Per-MODEL postprocessor override. Absent ⇒ the step's own
+	* `StepDefinition.postprocessor` applies (the normal case — every model in a
+	* step shares its decode). Set it when a step hosts models with DIFFERENT raw
+	* output layouts under one slot: e.g. object-detection is `'yolo'` by default,
+	* but a Coral SSD MobileNet build emits the `TFLite_Detection_PostProcess`
+	* 4-tensor layout and needs `'ssd'`. Threaded into `PoolModelConfig.postprocessor`
+	* by the engine factory (`modelEntry.postprocessor ?? def.postprocessor`).
+	*/
+	postprocessor: custom().optional(),
+	/**
+	* Per-MODEL default confidence floor. Absent ⇒ the step's
+	* `StepDefinition.defaultConfidence` applies. A score is a property of one
+	* model's output scale, not of the step slot it sits in: YuNet's
+	* `sqrt(cls·obj)` is not SCRFD's score, and inheriting SCRFD's 0.5 filled the
+	* face gallery with wheels and hands (D662, amends D645). An operator's
+	* explicit value still wins over it. Resolved in ONE place —
+	* `addon-pipeline/.../registry/effective-confidence.ts`.
+	*/
+	defaultConfidence: number().min(0).max(1).optional(),
+	/**
+	* When true, the executor produces a landmark-aligned crop (similarity warp
+	* onto the canonical template) before this step runs, instead of a plain
+	* axis-aligned bbox crop. Required for face-recognition embedders (ArcFace):
+	* their embeddings are only discriminative on an aligned input. The face
+	* detector that produced the parent detail must emit 5 landmarks.
+	*/
+	faceAlignment: boolean().optional(),
+	/**
+	* Auxiliary files required at runtime (labels JSON, charset dict, etc.).
+	* Downloaded into the same modelsDir alongside the model file.
+	*/
+	extraFiles: array(ModelExtraFileSchema).readonly().optional(),
+	/**
+	* LEGACY entry — retained in the catalog so a persisted operator selection
+	* still RESOLVES (and can be re-activated), but hidden from the selectable
+	* model list and excluded from the auto format-default pick. Set on the
+	* superseded / consolidated models (older lineages, redundant fp16 IRs) so
+	* the active lineup stays the coherent curated ladder without deleting a
+	* model anyone may still be pinned to. `resolveModelForFormat` keeps honoring
+	* an explicit legacy id that has a build for the node's format.
+	*/
+	legacy: boolean().optional(),
+	/**
+	* Measured quality/latency metadata — populated from the benchmark addon on
+	* the real node classes. Absent = not yet measured (most entries today; the
+	* catalog historically carried only `sizeMB`, a poor cross-architecture
+	* speed proxy). `p95LatencyMs` is keyed by node class (e.g. `n100`, `mac`).
+	*/
+	metrics: object({
+		map50: number().optional(),
+		p95LatencyMs: record(string(), number()).optional()
+	}).optional(),
+	/**
+	* The model's licence record — see {@link ModelLicenseSchema}. Optional in
+	* the schema (a custom model's author may state none); REQUIRED and complete
+	* on every built-in catalog entry (`scripts/check-catalog-licence.ts`).
+	*/
+	license: ModelLicenseSchema.optional(),
+	/**
+	* Variant-selector grouping. The UI groups models by `family` + `tier` and
+	* offers `precision` / `optimization` as variant axes WITHIN a tier — so all
+	* of a family's sizes and quantizations collapse into one grouped picker
+	* instead of a flat list of `yolo26s`, `yolo26s-int8`, … Absent ⇒ ungrouped
+	* (legacy / custom models) — never shown in the grouped selector. The flat
+	* `id` stays the source of truth for resolution/download/persistence; grouping
+	* is a presentation overlay resolved back to an `id`.
+	*/
+	group: ModelVariantGroupSchema.optional(),
+	/**
+	* Catalog source for the pipeline stepper's provider-first picker. Absent on
+	* built-in CamStack entries (treated as `camstack`) and on registry rows
+	* persisted before this field existed (`inferModelProvider` fills those).
+	*/
+	provider: ModelProviderIdSchema.optional(),
+	/**
+	* Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
+	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
+	* labels already ARE the CamStack macros (Scrypted identity map).
+	*/
+	classMap: DetectionCatalogClassMapSchema.optional(),
+	/**
+	* The model's CLIP feature-space contract (text encoder, dimension, vector
+	* index, token window, search floor) — see `clip-model.ts`. Present ONLY on a
+	* CLIP image encoder; its absence is what "not a CLIP model" means to the
+	* embedding encoder and the semantic-search store (D649).
+	*/
+	clip: ClipModelMetaSchema.optional()
+});
+var ConvertTargetSchema = discriminatedUnion("format", [object({
+	format: literal("openvino"),
+	precisions: array(_enum(["fp16", "int8"])).min(1).readonly()
+}), object({ format: literal("coreml") })]);
+var ModelConvertMetadataSchema = object({
+	id: string().regex(/^[a-zA-Z0-9._-]+$/),
+	name: string(),
+	labels: array(LabelDefinitionSchema).readonly(),
+	inputSize: object({
+		width: number(),
+		height: number()
+	}),
+	inputLayout: _enum(["nchw", "nhwc"]).optional(),
+	inputNormalization: _enum([
+		"zero-one",
+		"imagenet",
+		"none",
+		"scrfd"
+	]).optional(),
+	preprocessMode: _enum(["letterbox", "resize"]).optional(),
+	outputFormat: _enum([
+		"yolo",
+		"ssd",
+		"embedding",
+		"classification",
+		"ocr",
+		"segmentation"
+	]),
+	faceAlignment: boolean().optional(),
+	classMap: DetectionCatalogClassMapSchema.optional()
+});
+var ConvertResultSchema = object({
+	entry: ModelCatalogEntrySchema,
+	artifacts: array(object({
+		format: _enum(MODEL_FORMATS),
+		precision: _enum(["fp16", "int8"]).optional(),
+		sizeMB: number(),
+		validated: boolean(),
+		files: array(string()).readonly()
+	})).readonly()
+});
 var ExpressionBindingSourceSchema = union([
 	object({
 		kind: literal("field").optional(),
@@ -10698,7 +10917,7 @@ var AutomationActionSchema = discriminatedUnion("kind", [
 		code: string().min(1).max(2e4)
 	})
 ]);
-object({
+var AutomationRecipeSchema = object({
 	triggers: array(AutomationTriggerSchema),
 	conditions: AutomationConditionSchema.optional(),
 	actions: array(AutomationActionSchema)
@@ -11185,12 +11404,32 @@ var AudioClassificationLabelSchema = object({
 	originalClass: string().optional(),
 	score: number()
 });
+/**
+* Did the classifier RUN on this window? (D660)
+*
+* `classified` with no labels means the model heard nothing above the
+* camera's floor. `not-classified` means nobody listened — and until D660 the
+* two were the same shape (`classification` absent), so a window the global
+* busy gate threw away read downstream exactly like a quiet one (D393).
+*/
+var AudioClassifyOutcomeSchema = discriminatedUnion("state", [object({ state: literal("classified") }), object({
+	state: literal("not-classified"),
+	reason: _enum([
+		"superseded",
+		"error",
+		"timeout",
+		"disposed"
+	])
+})]);
 var AudioAnalysisResultSchema = object({
 	level: AudioLevelSchema,
+	/** Labels at or above the camera's floor. Absent = none — read `classifyOutcome` to know whether the model ran at all. */
 	classification: object({
 		labels: array(AudioClassificationLabelSchema).readonly(),
 		inferenceMs: number()
 	}).optional(),
+	/** Whether the classifier ran on this window (D660). */
+	classifyOutcome: AudioClassifyOutcomeSchema,
 	timestamp: number()
 });
 var AudioAnalysisSettingsSchema = object({
@@ -12899,15 +13138,157 @@ var cameraStreamsCapability = {
 	*/
 	durability: "session"
 };
+/** One refusal, named (D391). `path` points into the composition, e.g. `features[0].fields.celsius`. */
+var CompositionProblemSchema = object({
+	code: _enum([
+		"reserved-variant",
+		"unknown-capability",
+		"not-composable",
+		"wrong-device-type",
+		"has-commands",
+		"unknown-field",
+		"nested-field",
+		"missing-field",
+		"kind-mismatch",
+		"may-be-null",
+		"source-missing",
+		"source-unreadable",
+		"source-capability-missing",
+		"source-field-unknown",
+		"expression-invalid",
+		"cycle",
+		"duplicate-target",
+		"not-item-array",
+		"item-field-reserved",
+		"target-missing",
+		"target-unreadable",
+		"not-replaceable"
+	]),
+	path: string(),
+	message: string()
+});
+var CompositionFieldKindSchema = _enum([
+	"string",
+	"number",
+	"boolean",
+	"enum"
+]);
+/**
+* How a field says "unavailable" (D393, D663): `null` when its schema allows it;
+* `unknown` — the enum's own word — for an ADDED field that has one; `release`
+* for a REPLACED field of an existing device, whose claim is released so the
+* native provider's reading shows again; else the (composed) device goes offline.
+*/
+var CompositionUnavailableModeSchema = _enum([
+	"null",
+	"offline",
+	"unknown",
+	"release"
+]);
+/**
+* `derived` reads a source · `clock` reads only `now`, recomputed when a sibling
+* field of its cap changes value · `constant` reads nothing, computed once.
+*/
+var CompositionFieldRoleSchema = _enum([
+	"derived",
+	"clock",
+	"constant"
+]);
+/** The item a planned field belongs to; its `path` is then the dotted path INSIDE the item. */
+var CompositionFieldItemSchema = object({
+	arrayPath: string(),
+	key: string(),
+	label: string()
+});
+var CompositionFieldPlanSchema = object({
+	cap: string(),
+	/** Top-level field, or — when `item` is set — the dotted path inside that item. */
+	path: string(),
+	item: CompositionFieldItemSchema.optional(),
+	/** Index into `composition.features` this field's capability came from —
+	*  lets a source/cycle problem name its path as `features[N].fields.<path>`
+	*  (the same convention `planComposition`'s own problems already use). */
+	featureIndex: number().int().nonnegative(),
+	kind: CompositionFieldKindSchema,
+	nullable: boolean(),
+	required: boolean(),
+	unavailable: CompositionUnavailableModeSchema,
+	role: CompositionFieldRoleSchema,
+	source: CompositionFieldSourceSchema,
+	reads: array(CompositionFieldReadSchema)
+});
+/**
+* What a feature does to its target (D663): `new` builds a capability on a new
+* device; on an existing device it `add`s a capability the device lacks, or
+* `replace`s named fields of one it has natively.
+*/
+var CompositionFeatureModeSchema = _enum([
+	"new",
+	"add",
+	"replace"
+]);
+var CompositionFeaturePlanSchema = object({
+	featureIndex: number().int().nonnegative(),
+	cap: string(),
+	mode: CompositionFeatureModeSchema
+});
+var CompositionValidationSchema = object({
+	ok: boolean(),
+	problems: array(CompositionProblemSchema),
+	fields: array(CompositionFieldPlanSchema),
+	features: array(CompositionFeaturePlanSchema)
+});
+/**
+* Mirrors `CoreBlockStatus`, pinned by `core-blocks-source.spec.ts`. `degraded`:
+* running, but a replaced field is released to the native provider while its
+* source is unavailable (ruling S1b, D663) — the reason names each such field.
+*/
+var CompositionRunStatusSchema = _enum([
+	"stopped",
+	"starting",
+	"running",
+	"degraded",
+	"failed"
+]);
+var CompositionFieldStateKindSchema = _enum([
+	"fresh",
+	"stale",
+	"unavailable"
+]);
+var CompositionFieldStateSchema = object({
+	cap: string(),
+	path: string(),
+	/** Same as the plan's: two items' `status` are told apart by it. */
+	item: CompositionFieldItemSchema.optional(),
+	state: CompositionFieldStateKindSchema,
+	/** `null` whenever `state === 'unavailable'`; never a plausible stand-in (D393). */
+	value: union([
+		string(),
+		number(),
+		boolean(),
+		_null()
+	]),
+	reason: string().optional()
+});
+var CompositionBlockStateSchema = object({
+	blockId: string(),
+	deviceId: number().nullable(),
+	status: CompositionRunStatusSchema,
+	reason: string().optional(),
+	fields: array(CompositionFieldStateSchema)
+});
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
 /** What a block's process is doing. Mirrors the addon runner's own lifecycle so
-*  a failing block reads the same way a failing addon does. */
+*  a failing block reads the same way a failing addon does. `degraded` is a
+*  composition on an existing device with a field handed back to the native
+*  provider while its source is unavailable (S1b, D663); the error names it. */
 var CoreBlockStatusSchema = _enum([
 	"stopped",
 	"starting",
 	"running",
+	"degraded",
 	"failed"
 ]);
 /** Client-authored fields. */
@@ -12925,6 +13306,37 @@ var CoreBlockInputSchema = object({
 	*/
 	integrationId: string().optional()
 });
+/**
+* What a block IS (D659). Absent means `code` — every row stored before this
+* union keeps working unchanged.
+*  - `code`: the TypeScript in `code`, compiled and run in its own runner;
+*  - `recipe`: RESERVED (automations), stored shape only; refused at run by name;
+*  - `composition`: declarative, run by the shared `composer`; `code` is `''`.
+*/
+var CoreBlockSourceSchema = discriminatedUnion("kind", [
+	object({ kind: literal("code") }),
+	object({
+		kind: literal("recipe"),
+		recipe: AutomationRecipeSchema
+	}),
+	object({
+		kind: literal("composition"),
+		composition: CompositionSchema
+	})
+]);
+/**
+* The client-authored half of a composition block. No `code`, no placement (hub-only; Phase 7).
+*
+* `name`: REQUIRED for a `new` target — the block's name IS the device's name
+* (D659). ABSENT for an `existing` target — a customization has no name of its
+* own; the server derives one (`customizationBlockName`, D663) and refuses a
+* client-sent name by name.
+*/
+var CompositionBlockInputSchema = object({
+	name: string().min(1).max(120).optional(),
+	enabled: boolean(),
+	composition: CompositionSchema
+});
 /** A stored block. */
 var CoreBlockSchema = CoreBlockInputSchema.extend({
 	id: string(),
@@ -12940,8 +13352,43 @@ var CoreBlockSchema = CoreBlockInputSchema.extend({
 	*/
 	lastError: string().optional(),
 	/** Ms epoch of the last state change. */
-	lastChangedAt: number()
+	lastChangedAt: number(),
+	/** What the block is. Absent means `code` (D659). */
+	source: CoreBlockSourceSchema.optional()
+});
+/** A stored composition block and what the composer says about it. */
+var CompositionViewSchema = object({
+	block: CoreBlockSchema,
+	state: discriminatedUnion("kind", [object({
+		kind: literal("answered"),
+		state: CompositionBlockStateSchema.nullable()
+	}), object({
+		kind: literal("unreachable"),
+		error: string()
+	})])
 });
+/**
+* A read of the stored compositions. `not-loaded` while the `core_blocks`
+* table has not been READ: an empty answer then would make "not yet known"
+* look like "none", and invite the operator to recreate what exists (D315).
+*/
+var CompositionsNotLoadedSchema = object({
+	state: literal("not-loaded"),
+	reason: string()
+});
+var CompositionListReadSchema = discriminatedUnion("state", [object({
+	state: literal("loaded"),
+	views: array(CompositionViewSchema)
+}), CompositionsNotLoadedSchema]);
+var CompositionGetReadSchema = discriminatedUnion("state", [object({
+	state: literal("loaded"),
+	view: CompositionViewSchema.nullable()
+}), CompositionsNotLoadedSchema]);
+/** The customization of one existing device, found by its TARGET, or `not-loaded` (D315). */
+var CompositionCustomizationReadSchema = discriminatedUnion("state", [object({
+	state: literal("loaded"),
+	view: CompositionViewSchema.nullable()
+}), CompositionsNotLoadedSchema]);
 /** What a compile attempt produced. */
 var CoreBlockCompileResultSchema = object({
 	ok: boolean(),
@@ -12979,7 +13426,75 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 }), method(object({}), object({ libs: array(object({
 	filePath: string(),
 	content: string()
-})) }), { auth: "admin" });
+})) }), { auth: "admin" }), method(object({ block: CompositionBlockInputSchema }), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({
+	blockId: string(),
+	expectedUpdatedAt: number(),
+	block: CompositionBlockInputSchema.partial()
+}), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ blockId: string() }), CompositionGetReadSchema, { auth: "admin" }), method(object({}), CompositionListReadSchema, { auth: "admin" }), method(object({
+	addonId: string().min(1),
+	stableId: string().min(1)
+}), CompositionCustomizationReadSchema, { auth: "admin" }), method(object({
+	composition: CompositionSchema,
+	blockId: string().optional()
+}), CompositionValidationSchema, {
+	kind: "mutation",
+	auth: "admin",
+	access: "view"
+});
+var ComposerBlockSchema = object({
+	id: string().min(1),
+	name: string().min(1).max(120),
+	enabled: boolean(),
+	updatedAt: number(),
+	composition: CompositionSchema
+});
+/**
+* A stored composition row that no longer PARSES — a schema a release
+* tightened, a row written by a newer build. Sent by id so the composer keeps
+* its device as a placeholder and reports the block `failed` naming the parse
+* error. Leaving it out would read, twice, exactly like a delete (D49).
+*/
+var ComposerUnreadableBlockSchema = object({
+	id: string().min(1),
+	/** The row's stored name column; null when even that is unreadable (the device keeps the name it has). */
+	name: string().nullable(),
+	/** The parse error, in the operator's words. */
+	error: string()
+});
+method(object({
+	/** The shared Blocks integration; null until `core-blocks` has reconciled it. */
+	integrationId: string().nullable(),
+	/** False when the `core_blocks` read failed: then nothing may be withdrawn (D49). */
+	storeLoaded: boolean(),
+	blocks: array(ComposerBlockSchema),
+	/** Operator restarts: rebuild these runtimes and re-resolve their sources. Stores nothing (D62). */
+	restartBlockIds: array(string()),
+	/** Composition rows that exist but do not parse: held, never withdrawn, reported failed. */
+	unreadableBlocks: array(ComposerUnreadableBlockSchema)
+}), object({
+	blocks: array(object({
+		blockId: string(),
+		status: CompositionRunStatusSchema,
+		reason: string().optional()
+	})),
+	/**
+	* False when the composer declared and withdrew NOTHING (store not loaded,
+	* integration unknown, its own rows unread or read empty once). An empty
+	* apply the caller owes is paid off only by one the composer acted on (D49).
+	*/
+	acted: boolean()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ blockIds: array(string()) }), object({ states: array(CompositionBlockStateSchema) }), { auth: "admin" });
 /**
 * `custom-model-registry` — collection cap exposing operator-registered
 * custom detection models. Each provider (today: `addon-model-studio`)
@@ -14700,8 +15215,22 @@ var LinkedDeviceSchema = object({
 * The `linked-devices` extension slot's editable value (D648): the operator's
 * pick list, exactly what `_linkedDeviceIds` persists. Tree children are NOT
 * in it — they are always linked and are not a pick.
-*/
-var LinkedDevicesSlotValueSchema = object({ deviceIds: array(number().int().positive()) });
+*
+* `trackedDeviceIds` (D655) is the tracked-event opt-in, exactly what
+* `_linkedDeviceTrackedIds` persists: which linked devices materialize a
+* synthetic tracked event on the camera. A read always carries it AS STORED
+* (an absent key reads as `[]`, which is what the resolver makes of it —
+* NONE). On a write it is optional: absent leaves the opt-in untouched, so a
+* card built before D655 cannot erase it by saving the pick list. A present
+* list REPLACES the opt-in; each id must be a pick, a device the camera links
+* by structure (the row's `impliedSources`: tree children, a picked
+* container's child) or already stored — so what was read can always be
+* written back unchanged, and a NEW opt-in outside the linked set is refused.
+*/
+var LinkedDevicesSlotValueSchema = object({
+	deviceIds: array(number().int().positive()),
+	trackedDeviceIds: array(number().int().positive()).optional()
+});
 DeviceType.Camera;
 /** One camera's resolved linked set, tagged with the camera it belongs to.
 *  The batch answer needs the tag; the single-device answer already has it
@@ -15205,6 +15734,52 @@ method(object({
 	deviceIds: array(number()).readonly(),
 	caps: array(string()).readonly().optional()
 }), record(string(), record(string(), unknown().nullable())));
+/**
+* Per-field ownership (D663). A composition may CLAIM fields of a native
+* cap's runtime-state slice on an existing device: `replace` overlays the
+* claimed fields on the native slice, `add` builds a slice the device does
+* not natively have. Declared here — once — so the hub mirror (Task 5) and
+* the claim methods (Task 6) share one union.
+*/
+var FieldClaimModeSchema = _enum(["replace", "add"]);
+/** What a claim, patch or release answers. A refusal always names its reason. */
+var ClaimOutcomeSchema = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	changed: boolean()
+}), object({
+	ok: literal(false),
+	code: _enum([
+		"owned-by-other",
+		"not-claimed",
+		"field-not-claimed",
+		"invalid-slice",
+		"unknown-device",
+		"row-unreadable",
+		"migration-in-flight"
+	]),
+	message: string()
+})]);
+/** One claim as `listClaims` reports it. `fields` is the PLANNED set, explicit (ruling S5). */
+var FieldClaimSchema = object({
+	deviceId: number(),
+	capName: string(),
+	owner: string().min(1),
+	mode: FieldClaimModeSchema,
+	fields: array(string().min(1)).min(1)
+});
+/**
+* What `listClaims` answers. The claims INDEX is a listing projection loaded
+* from the settings store at boot; until a load has succeeded it is
+* `not-loaded`, never `[]` — an unanswered question must not look like an
+* empty answer (D315).
+*/
+var ClaimsListingSchema = discriminatedUnion("state", [object({
+	state: literal("loaded"),
+	claims: array(FieldClaimSchema)
+}), object({
+	state: literal("not-loaded"),
+	reason: string()
+})]);
 method(object({ deviceId: number() }), record(string(), record(string(), unknown()))), method(object({
 	deviceId: number(),
 	capName: string()
@@ -15212,7 +15787,35 @@ method(object({ deviceId: number() }), record(string(), record(string(), unknown
 	deviceId: number(),
 	capName: string(),
 	slice: record(string(), unknown())
-}), _void(), { kind: "mutation" }), object({
+}), _void(), { kind: "mutation" }), method(object({
+	deviceId: number(),
+	capName: string(),
+	owner: string().min(1),
+	mode: FieldClaimModeSchema,
+	fields: array(string().min(1)).min(1),
+	values: record(string(), unknown())
+}), ClaimOutcomeSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	capName: string(),
+	owner: string().min(1),
+	values: record(string(), unknown())
+}), ClaimOutcomeSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	capName: string(),
+	owner: string().min(1)
+}), ClaimOutcomeSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ ownerPrefix: string().optional() }), ClaimsListingSchema, { auth: "admin" }), method(object({
+	deviceId: number(),
+	capName: string()
+}), record(string(), unknown()).nullable(), { auth: "admin" }), object({
 	deviceId: number(),
 	capName: string(),
 	slice: record(string(), unknown())
@@ -19184,8 +19787,8 @@ var NcTestResultSchema = object({
 	className: string().optional(),
 	label: string().optional()
 });
-/** The rule kinds, as data. `NcRuleKind` in `notification/rule-kinds.ts` is the
-*  same union; the template-vars spec pins the two together. `mixed` is DERIVED
+/** The rule kinds, as data. `NcRuleKind` in `notification/rule-kinds.ts` is
+*  `z.infer` of this schema — one shape, no twin. `mixed` is DERIVED
 *  (a stored system rule whose kinds span families, D637) and never authored. */
 var NcRuleKindSchema = _enum([
 	"detection",
@@ -21100,6 +21703,13 @@ var AudioEventSchema = object({
 		originalClass: string().optional(),
 		score: number()
 	}).optional(),
+	/**
+	* Whether the classifier RAN on the window behind this row (D660). Absent
+	* on rows written before D660 — unknown, NOT classified: until then a
+	* window the analyzer's busy gate threw away was stored exactly like one
+	* that heard nothing above the floor.
+	*/
+	classifyOutcome: AudioClassifyOutcomeSchema.optional(),
 	/** Populated by B5 (recording playback URL for this event). */
 	mediaUrl: string().optional()
 });
@@ -21812,7 +22422,15 @@ var RebuildObjectEmbeddingsInput = object({
 	* force is logged at start and finish so a deliberately slow pass reads
 	* differently from a stalled one.
 	*/
-	pacingMs: number().int().nonnegative().optional()
+	pacingMs: number().int().nonnegative().optional(),
+	/**
+	* Re-embed ONLY the tracks whose vector is ALREADY in the pinned model's
+	* space (D664) — the in-space skip inverted. It exists to redo vectors
+	* written from the wrong box, which a normal pass would skip as done
+	* forever. Requires `maxTracks`: a forced pass without a bound is refused
+	* (`force-requires-max-tracks`).
+	*/
+	force: boolean().optional()
 });
 /**
 * Result of emptying the CLIP index.
@@ -21848,6 +22466,7 @@ var WipeObjectEmbeddingsResultSchema = object({
 *    - `reads-disagree` — the two reads named different choices.
 *  - `not-a-clip-model` — the CONFIRMED id has no CLIP metadata, so there is no
 *    index to fill and no dimension to check against (D649).
+*  - `force-requires-max-tracks` — `force: true` with no `maxTracks` (D664).
 */
 var RebuildObjectEmbeddingsRefusalSchema = _enum([
 	"stores-unavailable",
@@ -21855,7 +22474,8 @@ var RebuildObjectEmbeddingsRefusalSchema = _enum([
 	"method-unavailable",
 	"read-failed",
 	"reads-disagree",
-	"not-a-clip-model"
+	"not-a-clip-model",
+	"force-requires-max-tracks"
 ]);
 /**
 * Acknowledgement that a rebuild STARTED.
@@ -21880,11 +22500,32 @@ var RebuildStatusSchema = object({
 	running: boolean(),
 	scanned: number(),
 	rebuilt: number(),
-	/** Tracks whose key frame is gone — nothing to re-embed from. */
+	/** Tracks whose key frame is gone — nothing to re-embed from. Pixels ONLY:
+	*  `missingEvent` is its own field since D664, never summed in. */
 	missingKeyFrame: number(),
-	/** Tracks with no usable detection box. */
+	/** Tracks with no object event at all (D664). */
+	missingEvent: number(),
+	/** Tracks with no box measured on the pixels to cut — see `boxSource.refused`. */
 	missingBbox: number(),
 	/**
+	* Which rule placed each judged track's box (D664): the key frame row's own
+	* `subjectBox`, `track.positions` at exactly its instant (older key frames),
+	* the event box (a key frame recovered from the recording, at the event's
+	* instant), or `refused` by name — the reasons are in the tagged log lines.
+	*/
+	boxSource: object({
+		subjectBox: number(),
+		positions: number(),
+		event: number(),
+		refused: number()
+	}),
+	/** Tracks skipped because their vector is already in the pinned space. */
+	alreadyInSpace: number(),
+	/** Whether the current / last pass was a `force` pass; `null` before any (D664). */
+	force: boolean().nullable(),
+	/** In-space tracks a `force` pass selected for re-embedding. */
+	forcedInSpace: number(),
+	/**
 	* Tracks an executing node REFUSED rather than broke on — an unreadable key
 	* frame, a step that threw. Separate from `failed` because the remedy is
 	* different, and because a whole camera silently contributing zero vectors
@@ -22389,7 +23030,8 @@ var PipelineModelOptionSchema = object({
 	})),
 	group: ModelVariantGroupSchema.optional(),
 	legacy: boolean().optional(),
-	provider: ModelProviderIdSchema.optional()
+	provider: ModelProviderIdSchema.optional(),
+	defaultConfidence: number().optional()
 });
 var ConfigFieldBridge = custom();
 var PipelineAddonSchemaSchema = object({
@@ -22691,7 +23333,14 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	height: number()
 }), { kind: "mutation" }), method(object({
 	stepId: string(),
-	frameId: number().int()
+	frameId: number().int(),
+	/**
+	* The model to time — REQUIRED (D658). Without it the pool answered the
+	* step's ACTIVE variant (the first loaded after boot), so a benchmark
+	* of model B silently timed model A. Callers pass the `rootModelId`
+	* their warmup `runPipeline` reported: the model that actually ran.
+	*/
+	modelId: string().min(1)
 }), record(string(), unknown()), { kind: "mutation" }), method(object({ frameId: number().int() }), _void(), { kind: "mutation" }), method(object({ deviceKey: string().optional() }), EffectiveTuningSchema), method(_void(), array(object({
 	engineKey: string(),
 	engine: PipelineEngineChoiceSchema,
@@ -26704,7 +27353,6 @@ var doorbellCapability = {
 	kind: "wrapper",
 	defaultActive: false,
 	deviceTypes: [DeviceType.Button, DeviceType.Camera],
-	exposesDeviceSettings: true,
 	extensionSlots: [DOORBELL_SOURCE_SLOT],
 	methods: {},
 	events: { 
@@ -26754,7 +27402,7 @@ var ExtensionSourceSchema = object({
 /**
 * How one picked source stands. `missing` — no such device (deleted, or an id
 * that never existed); `foreign` — a device the slot's owner cannot read from
-* (slice 2's cross-owner graft source); `unavailable` — it exists but is not a
+* (a source owned by another addon); `unavailable` — it exists but is not a
 * valid source now (a container, which is never a pick). A source in any of
 * these states is SHOWN, never silently dropped or re-pointed.
 */
@@ -26794,13 +27442,19 @@ var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
 	slot: ExtensionSlotIdSchema,
 	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
 	authority: string(),
-	/** graft: its switch. association: null — removing every source is "off". */
-	enabled: boolean().nullable(),
-	/** graft: the cap registered on the host. association: null. */
-	projects: string().nullable(),
 	activation: ExtensionSlotActivationSchema.nullable(),
 	value: ExtensionSlotValueSchema,
-	sources: array(ExtensionSlotSourceSchema)
+	sources: array(ExtensionSlotSourceSchema),
+	/**
+	* Devices the owner links to the host ON ITS OWN, by structure, and that
+	* are therefore not in `value` (D655): a camera's device-tree children, and
+	* the child a picked container stands for (D356 — a container is never a
+	* pick, its children are). Read-only; the editor shows them and may offer
+	* per-device options on them (the linked-devices tracked-event opt-in).
+	* Absent when the owner links nothing beyond the picks, and from an owner
+	* older than D655.
+	*/
+	impliedSources: array(ExtensionSlotSourceSchema).optional()
 }), object({
 	state: literal("unreachable"),
 	addonId: string(),
@@ -26821,7 +27475,8 @@ var ExtensionCandidatesSchema = object({ candidates: array(object({
 /**
 * What a write did. `none` — applied in place. `host` / `parent` — the owner
 * reloaded the host (or, for an accessory child, its parent) because the
-* write changed what the host REGISTERS (a graft switched on or off, slice 2).
+* write changed what the host REGISTERS. A slot never adds a capability to its
+* host — that is a composition (D663) — so today's owners answer `none`.
 */
 var ExtensionSetResultSchema = object({
 	applied: literal(true),
@@ -28101,7 +28756,9 @@ var batteryCapability = {
 		DeviceType.Camera,
 		DeviceType.Sensor,
 		DeviceType.Button,
-		DeviceType.Switch
+		DeviceType.Switch,
+		DeviceType.PetFeeder,
+		DeviceType.Container
 	],
 	methods: { 
 	/**
@@ -28128,6 +28785,19 @@ wakeForStream: method(object({
 		awoke: boolean(),
 		durationMs: number()
 	}), { kind: "mutation" }) },
+	/**
+	* A composed provider (battery ADDED to a pet feeder or container that has
+	* no wake surface) answers `wakeForStream` with the same "unavailable"
+	* result the contract already defines above: "Returns `awoke: false` when
+	* … the cap surface is unavailable." (D663).
+	*/
+	composedMethods: { wakeForStream: {
+		kind: "answer",
+		value: {
+			awoke: false,
+			durationMs: 0
+		}
+	} },
 	events: { 
 	/**
 	* Emitted whenever the cached status changes (firmware push OR
@@ -28143,7 +28813,7 @@ onStatusChanged: { data: object({
 		schema: BatteryStatusSchema,
 		kind: "push",
 		empty: {
-			percentage: 0,
+			percentage: null,
 			charging: "unknown",
 			sleeping: false,
 			lastUpdated: 0
@@ -28885,6 +29555,19 @@ var connectivityCapability = {
 * provider populates it by guessing (no HA inference). The UI renders a
 * "No consumables reported" placeholder when `items` is empty.
 */
+/** Units a remaining-life counter is reported in. Closed: the panel renders
+*  each. */
+var ConsumableRemainingUnitSchema = _enum([
+	"days",
+	"hours",
+	"cycles"
+]);
+/** Remaining life as a COUNT, not a percentage (the PetKit desiccant reports
+*  days). `value` null = unknown (D393). */
+var ConsumableRemainingSchema = object({
+	value: number().min(0).nullable(),
+	unit: ConsumableRemainingUnitSchema
+});
 /** A single consumable item. Either a continuous `level` (remaining
 *  life %) or a discrete `status` may be known — both may be null when a
 *  provider only knows the item exists. `level` and `status` are not
@@ -28901,7 +29584,10 @@ var ConsumableItemSchema = object({
 	/** Ms epoch of the last replace, when known. */
 	lastResetAt: number().nullable(),
 	/** Whether `reset()` is meaningful for this item. */
-	resettable: boolean()
+	resettable: boolean(),
+	/** Remaining life as a count (days/hours/cycles), when a provider reports
+	*  it that way instead of — or alongside — `level`. Absent = not reported. */
+	remaining: ConsumableRemainingSchema.optional()
 });
 var ConsumablesStatusSchema = object({
 	items: array(ConsumableItemSchema),
@@ -28931,6 +29617,16 @@ reset: method(object({
 		kind: "mutation",
 		auth: "admin"
 	}) },
+	/**
+	* A composed consumable (item added to a device with no native consumables
+	* provider) refuses `reset` by name: "Only meaningful when the item's
+	* `resettable` is true" — a composed item is never resettable until
+	* commands (`forward`) arrive in slice 3 (D663).
+	*/
+	composedMethods: { reset: {
+		kind: "refuse",
+		reason: "a composed consumable is not resettable until commands (forward) arrive — slice 3"
+	} },
 	status: {
 		schema: ConsumablesStatusSchema,
 		kind: "push",
@@ -38043,6 +38739,42 @@ var zoneRulesCapability = {
 	*/
 	durability: "restored"
 };
+var NUMBER = {
+	kind: "fixed",
+	result: ["number"]
+};
+var BOOLEAN = {
+	kind: "fixed",
+	result: ["boolean"]
+};
+Object.freeze({
+	min: NUMBER,
+	max: NUMBER,
+	abs: NUMBER,
+	floor: NUMBER,
+	ceil: NUMBER,
+	sqrt: NUMBER,
+	round: NUMBER,
+	pow: NUMBER,
+	clamp: NUMBER,
+	avg: NUMBER,
+	sum: NUMBER,
+	age: NUMBER,
+	convert: NUMBER,
+	coalesce: { kind: "coalesce" },
+	any: BOOLEAN,
+	all: BOOLEAN,
+	within: BOOLEAN,
+	latest: {
+		kind: "fixed",
+		result: ["number", "null"]
+	},
+	number: {
+		kind: "fixed",
+		result: ["number", "null"]
+	}
+});
+`${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
 /**
 * Accessory device helpers — shared across drivers.
 *
@@ -38186,38 +38918,31 @@ var DeviceConfig = class DeviceConfig {
 		}));
 	}
 };
-/**
-* Concrete implementation. Routes every successful write through
-* `writer(capName, slice)` — the kernel hooks this up to
-* `device-state.setCapSlice`, the canonical cross-layer write
-* entrypoint, which handles disk persistence (debounced on the hub)
-* and mirror updates.
-*
-* Schema validation runs in-process before the writer is called —
-* the round-trip should never carry an invalid slice. `flush()`
-* awaits any in-flight writer promises so shutdown is lossless.
-*
-* `initial` is the persisted blob loaded at boot. Slices for caps
-* whose schema hasn't been installed yet are kept in-memory verbatim
-* and validated when the cap registers later.
-*/
 var DeviceRuntimeState = class DeviceRuntimeState {
 	writer;
+	onWriteFailed;
 	/** In-flight writer promises tracked so `flush()` can await them. */
 	pendingWrites = /* @__PURE__ */ new Set();
+	/**
+	* Caps whose last write the hub refused. The equality gate in
+	* `applyCapWrite` is bypassed for these, so the SAME value is re-sent on the
+	* next write instead of being swallowed forever; a landing write clears it.
+	*/
+	failedWrites = /* @__PURE__ */ new Set();
 	/** Per-cap committed slice — after schema validation when known. */
 	slices;
 	/** Per-cap registered schema (set by `installCapSchema`). */
 	schemas = /* @__PURE__ */ new Map();
 	listeners = /* @__PURE__ */ new Set();
 	capListeners = /* @__PURE__ */ new Map();
-	constructor(initial, writer) {
+	constructor(initial, writer, onWriteFailed) {
 		this.writer = writer;
+		this.onWriteFailed = onWriteFailed;
 		this.slices = /* @__PURE__ */ new Map();
 		for (const [k, v] of Object.entries(initial)) if (v && typeof v === "object" && !Array.isArray(v)) this.slices.set(k, { ...v });
 	}
-	static fromInitial(initial, writer) {
-		return new DeviceRuntimeState(initial, writer);
+	static fromInitial(initial, writer, onWriteFailed) {
+		return new DeviceRuntimeState(initial, writer, onWriteFailed);
 	}
 	installCapSchema(capName, schema) {
 		const existing = this.schemas.get(capName);
@@ -38261,10 +38986,15 @@ var DeviceRuntimeState = class DeviceRuntimeState {
 			...value
 		} : { ...value };
 		const parsed = schema.parse(next);
-		if (shallowEqual(current, parsed)) return;
+		if (shallowEqual(current, parsed) && !this.failedWrites.has(capName)) return;
 		this.slices.set(capName, parsed);
 		this.fireListeners([capName]);
-		const writePromise = this.writer(capName, { ...parsed }).catch(() => {});
+		const writePromise = this.writer(capName, { ...parsed }).then(() => {
+			this.failedWrites.delete(capName);
+		}).catch((err) => {
+			this.failedWrites.add(capName);
+			this.onWriteFailed?.(capName, err instanceof Error ? err.message : String(err));
+		});
 		this.pendingWrites.add(writePromise);
 		writePromise.finally(() => {
 			this.pendingWrites.delete(writePromise);
@@ -38541,7 +39271,16 @@ var BaseDevice = class {
 			});
 		};
 		const initial = ctx.initialRuntimeState ?? {};
-		this.runtimeState = DeviceRuntimeState.fromInitial(initial, writer);
+		const onWriteFailed = (cap, error) => {
+			ctx.logger.warn("runtime-state write refused by the hub — the slice is not mirrored; it is re-sent on the next write", {
+				tags: { deviceId: ctx.id },
+				meta: {
+					cap,
+					error
+				}
+			});
+		};
+		this.runtimeState = DeviceRuntimeState.fromInitial(initial, writer, onWriteFailed);
 		ctx.bindRuntimeState?.(this.runtimeState);
 		ctx.registerNativeCap?.(deviceStatusCapability, {});
 		const seed = {
@@ -41809,6 +42548,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"composer.applyBlocks": {
+		capName: "composer",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"composer.getStates": {
+		capName: "composer",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"connectionTest.describeTest": {
 		capName: "connection-test",
 		capScope: "system",
@@ -41869,6 +42620,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"coreBlocks.createComposition": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.delete": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -41881,6 +42638,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.getComposition": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"coreBlocks.getCustomization": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"coreBlocks.getTypeDefs": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -41893,6 +42662,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.listCompositions": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"coreBlocks.restart": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -41911,6 +42686,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"coreBlocks.updateComposition": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"coreBlocks.validateComposition": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"cover.close": {
 		capName: "cover",
 		capScope: "device",
@@ -42397,12 +43184,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"deviceManager.applyDeviceSettingsPatch": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"deviceManager.applyInitialMeta": {
 		capName: "device-manager",
 		capScope: "system",
@@ -42505,12 +43286,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"deviceManager.getDeviceLiveContribution": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"deviceManager.getDeviceLiveInfoAggregate": {
 		capName: "device-manager",
 		capScope: "system",
@@ -42523,12 +43298,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"deviceManager.getDeviceSettingsContribution": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"deviceManager.getDeviceStatusAggregate": {
 		capName: "device-manager",
 		capScope: "system",
@@ -43003,6 +43772,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceState.claimFields": {
+		capName: "device-state",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceState.getAllSnapshots": {
 		capName: "device-state",
 		capScope: "system",
@@ -43015,38 +43790,44 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"deviceState.getSnapshot": {
+	"deviceState.getNativeCapSlice": {
 		capName: "device-state",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"deviceState.setCapSlice": {
+	"deviceState.getSnapshot": {
 		capName: "device-state",
 		capScope: "system",
 		addonId: null,
-		access: "create"
+		access: "view"
 	},
-	"deviceStatus.getStatus": {
-		capName: "device-status",
-		capScope: "device",
+	"deviceState.listClaims": {
+		capName: "device-state",
+		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"doorbell.applyDeviceSettingsPatch": {
-		capName: "doorbell",
-		capScope: "device",
+	"deviceState.patchOwnedFields": {
+		capName: "device-state",
+		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"doorbell.getDeviceLiveContribution": {
-		capName: "doorbell",
-		capScope: "device",
+	"deviceState.releaseClaim": {
+		capName: "device-state",
+		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
-	"doorbell.getDeviceSettingsContribution": {
-		capName: "doorbell",
+	"deviceState.setCapSlice": {
+		capName: "device-state",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceStatus.getStatus": {
+		capName: "device-status",
 		capScope: "device",
 		addonId: null,
 		access: "view"
@@ -48554,16 +49335,36 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceState.claimFields": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceState.getCapSlice": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"deviceState.getNativeCapSlice": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceState.getSnapshot": [{
 		name: "deviceId",
 		form: "single",
 		optional: false
 	}],
+	"deviceState.patchOwnedFields": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceState.releaseClaim": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceState.setCapSlice": [{
 		name: "deviceId",
 		form: "single",