@camstack/addon-provider-homematic 1.2.10 → 1.2.11

package/dist/addon.mjs

@@ -7943,6 +7943,780 @@ var ConvertResultSchema = object({
 	})).readonly()
 });
 /**
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
+*/
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
+/**
+* Frozen, null-prototype builtin function table for the expression engine
+* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
+* parser rejects any callee not in it, and the evaluator gates each call on an
+* own-property check against it.
+*
+* Because the object has a NULL prototype AND is `Object.freeze`d:
+*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
+*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
+*    (there is no `Object.prototype` in the chain), so those names are not
+*    callable — they are simply "unknown function" at parse time.
+*
+* Every numeric argument is validated as a finite number and every numeric
+* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
+* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
+* closed rather than emitting a garbage value.
+*/
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString$1(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString$1(args[1], "convert", 1).trim();
+			const to = asString$1(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
+	}
+};
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
+/**
+* Resource-bound constants for the safe expression engine.
+*
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
+*/
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
+]);
+/**
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
+*/
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	}
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
+/**
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
+*
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
+*
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+*/
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
+		};
+	}
+	peek() {
+		return this.tokens[this.pos];
+	}
+	next() {
+		return this.tokens[this.pos++];
+	}
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
+	}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
+		}
+		return false;
+	}
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	}
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
+		}
+		return test;
+	}
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
+				};
+			}
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
+	}
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
+	}
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
+/**
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
+*
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
+*/
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
+	}
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
+	}
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
+	}
+	return result;
+}
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
+}
+Object.freeze({});
+/**
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
+	}
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	}
+	return null;
+}
+var ExpressionBindingSourceSchema = union([
+	object({
+		kind: literal("field").optional(),
+		sourceKey: string(),
+		cap: string(),
+		fieldPath: string()
+	}),
+	object({
+		kind: literal("literal"),
+		value: union([
+			string(),
+			number(),
+			boolean(),
+			_null()
+		])
+	}),
+	object({
+		kind: literal("global"),
+		sourceStableId: string(),
+		cap: string(),
+		fieldPath: string()
+	})
+]);
+object({
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+/** How a leaf compares a device field to a value. Derived from the field's
+*  `kind` in `deviceManager.getWireableFields`, never hand-maintained. */
+var AutomationConditionOperatorSchema = _enum([
+	"eq",
+	"ne",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"contains",
+	"in"
+]);
+var AutomationConditionLeafSchema = object({
+	kind: literal("condition"),
+	deviceId: number().int().nonnegative(),
+	cap: string().min(1),
+	fieldPath: string().min(1),
+	operator: AutomationConditionOperatorSchema,
+	value: union([
+		string(),
+		number(),
+		boolean(),
+		array(union([string(), number()]))
+	])
+});
+/**
+* The expression leaf, declared as a plain object rather than an intersection
+* with {@link ExpressionSourceSchema}: a discriminated union has to be able to
+* read `kind` off each option, and an intersection hides it. The author-time
+* validation is the SAME function `ExpressionSourceSchema` runs, so the two
+* cannot drift — an expression that one accepts, the other accepts.
+*/
+var AutomationConditionExpressionSchema = object({
+	kind: literal("expression"),
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+var AutomationConditionSchema = lazy(() => discriminatedUnion("kind", [
+	object({
+		kind: literal("all"),
+		children: array(AutomationConditionSchema)
+	}),
+	object({
+		kind: literal("any"),
+		children: array(AutomationConditionSchema)
+	}),
+	object({
+		kind: literal("not"),
+		child: AutomationConditionSchema
+	}),
+	AutomationConditionLeafSchema,
+	AutomationConditionExpressionSchema
+]));
+/**
+* What starts a run.
+*
+* D8 compliance, and it is the reason `device-state` is not merely an event
+* subscription: the trigger evaluates against the **state mirror**, which is
+* reconciled, and an event only WAKES the evaluation. A dropped event therefore
+* DELAYS a trigger; it does not lose it. `schedule` uses `croner` — the one
+* already in the repo — because `setInterval(24h)` drifts and "at 23:30" does
+* not.
+*/
+var AutomationTriggerSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("device-state"),
+		deviceId: number().int().nonnegative(),
+		cap: string().min(1),
+		fieldPath: string().min(1),
+		/** Fire when the field takes this value. Omit to fire on any change. */
+		becomes: union([
+			string(),
+			number(),
+			boolean()
+		]).optional(),
+		/** Only on a CHANGE of value, not on every re-report. */
+		edge: boolean().optional(),
+		/** The condition must hold this long before the run starts. */
+		forMs: number().int().min(0).max(864e5).optional(),
+		/** Collapse a burst into one run. */
+		debounceMs: number().int().min(0).max(6e5).optional()
+	}),
+	object({
+		kind: literal("device-event"),
+		/** An `EventCategory` value. */
+		category: string().min(1),
+		deviceId: number().int().nonnegative().optional()
+	}),
+	object({
+		kind: literal("schedule"),
+		cron: string().min(1).max(120)
+	}),
+	object({ kind: literal("manual") })
+]);
+/**
+* One action step.
+*
+* `wait` and `cap` are `NcRuleActionSchema`'s two members, kept structurally
+* identical so `NcRuleActionRunner` runs them unchanged — its device-scope
+* check, stop-at-first-failure and per-sequence throttle are the whole reason
+* to reuse it, and none of them are re-implemented here.
+*
+* **The one divergence, and it is forced.** `NcRuleActionSchema.cap.deviceId` is
+* a literal `z.number().int()`, and the NC runner's own `RunSequencesInput`
+* documents its subject device as *"for the log tag, never for routing"*. So an
+* NC action can never target the device that triggered it — which is fine for
+* the NC (its rules already scope to a device) and fatal for an automation
+* ("sound the siren of the camera that saw the person"). `deviceId` therefore
+* also accepts `{ $var }`, resolved from the run's `vars` bag BEFORE the runner
+* is called. The runner still receives a number and is untouched; the
+* resolution is the recipe's job, not the runner's.
+*/
+var AutomationActionSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("wait"),
+		seconds: number().min(0).max(300)
+	}),
+	object({
+		kind: literal("cap"),
+		deviceId: union([number().int(), object({ $var: string().min(1) })]),
+		cap: string().min(1),
+		method: string().min(1),
+		/** Values may carry `{{vars.x}}` slots, which SUBSTITUTE and do not
+		*  evaluate (§3.2.3). Anything beyond substitution is the expression leaf. */
+		args: record(string(), unknown()).optional()
+	}),
+	object({
+		kind: literal("code"),
+		/** Compiled into the automation's OWN block by esbuild — not a third
+		*  runtime, not a `vm`, and not dynamically evaluated. */
+		code: string().min(1).max(2e4)
+	})
+]);
+object({
+	triggers: array(AutomationTriggerSchema),
+	conditions: AutomationConditionSchema.optional(),
+	actions: array(AutomationActionSchema)
+});
+/**
 * `addon-pages` — system-scoped singleton aggregator cap. Public-facing
 * surface that admin-ui consumes through `useAddonPagesListPages()`.
 *
@@ -12054,7 +12828,7 @@ DeviceType.Camera, method(object({
 * Why: pub/sub routing over the system event-bus loses fidelity
 * (callback shape, QoS guarantees, will/retain semantics) and adds
 * refcount bookkeeping that addons would rather own themselves. The
-* canonical consumer (`addon-export-ha-mqtt`) needs raw `mqtt.js`
+* canonical consumer needs raw `mqtt.js`
 * features anyway — give it the connection config, get out of the way.
 *
 * Consumer flow:
@@ -14622,8 +15396,26 @@ var TrackSchema = object({
 	/** Periodic snapshots at snapshotIntervalMs cadence (subject to
 	*  saveThumbnails policy). */
 	snapshots: array(TrackSnapshotSchema).readonly(),
-	/** Deduplicated zones the track has entered at least once. */
+	/** Deduplicated zones the track has entered at least once. Zone IDS. */
 	zonesVisited: array(string()).readonly(),
+	/**
+	* Human NAMES for {@link zonesVisited}, resolved at READ time against the
+	* `zones` capability.
+	*
+	* `zonesVisited` persists ids (`cfeec78c-8d69-…`), which no operator can type
+	* and no card can render — so every free-text search surface was structurally
+	* unable to answer "show me the tracks in Uscio", and did not fail loudly, it
+	* just returned nothing. Resolving here rather than in each client keeps ONE
+	* derivation and costs the clients no extra call (the `zones` cap is
+	* per-device, so a client-side resolve would be a per-camera fan-out on a
+	* surface built to avoid exactly that).
+	*
+	* Resolved, never invented: a zone deleted since the track was written has no
+	* name and is DROPPED, so this array can be shorter than `zonesVisited` — the
+	* two are not positionally aligned. Absent when the track visited no zone, or
+	* when the zone catalogue could not be read.
+	*/
+	zoneNames: array(string()).readonly().optional(),
 	/** Deduplicated set of detector classes observed for this track over its
 	*  life (a track may be reclassified, e.g. person→vehicle). Absent on
 	*  legacy rows written before class accumulation shipped. */
@@ -16726,6 +17518,23 @@ var CameraRecordingStatusSchema = object({
 	active: boolean(),
 	storageBytes: number()
 });
+/** One stage of the fan-out that could NOT be read, and how long it cost. */
+var CameraStatusDegradationSchema = object({
+	stage: _enum([
+		"source",
+		"broker",
+		"detection",
+		"recording",
+		"switches"
+	]),
+	reason: _enum([
+		"timeout",
+		"error",
+		"partial"
+	]),
+	/** Wall-clock ms spent on the stage before it was abandoned. */
+	elapsedMs: number()
+});
 /**
 * Aggregated per-camera pipeline status — server-composed, single call.
 *
@@ -16756,9 +17565,28 @@ var CameraStatusSchema = object({
 	* differently — a quiet camera that looks identical to a dead one is the
 	* silence-reads-as-never-happened trap this repo keeps paying for.
 	*
-	* Empty when nothing is off. Never contains a switch no provider offers.
+	* Empty when nothing is off, and never contains a switch no provider offers
+	* — but an empty list is only a POSITIVE claim when `degraded` does not name
+	* `'switches'`. When it does, the switch set could not be read and nothing
+	* here may be rendered as "the operator turned nothing off": that is the
+	* D62 failure (a camera we could not read painted as broken) in the very
+	* field that exists to prevent it.
 	*/
 	switchedOff: array(CameraSwitchIdSchema).readonly(),
+	/**
+	* Stages of the bounded fan-out that were CUT SHORT — a timeout or a
+	* rejection — and whose block is therefore `null` because we could not
+	* READ it, not because there is nothing there.
+	*
+	* Without this, three different facts arrive as the same `null`: "the stage
+	* timed out", "the stage failed", and "this camera legitimately has no
+	* decoder / no recording". Every surface that draws a conclusion from a null
+	* block (or from an empty `switchedOff`) must consult this first; a stage
+	* named here supports no conclusion at all, only "unknown".
+	*
+	* Empty on a clean read — the overwhelmingly common case.
+	*/
+	degraded: array(CameraStatusDegradationSchema).readonly(),
 	/** Unix timestamp (ms) when this snapshot was composed server-side. */
 	fetchedAt: number()
 });
@@ -17276,6 +18104,37 @@ DeviceType.Camera, method(object({
 	lastCapturedAt: number().nullable(),
 	cacheAgeMs: number().nullable(),
 	etag: string().nullable()
+}))), systemMethod(object({ 
+/** The tiles a surface is actually rendering. One entry per (device,
+*  width) the caller will paint — the width is snapped to the server's
+*  ladder and becomes part of the link's SIGNED identity. */
+targets: array(object({
+	deviceId: number(),
+	/** Target width in px. Omit for the frame as captured — correct
+	*  for a full-bleed surface, wrong (and expensive) for a grid. */
+	width: number().int().positive().optional()
+})).min(1).max(200) }), array(object({
+	deviceId: number(),
+	/** Root-relative signed path, or null when the link plane is not
+	*  served (no data-plane facility). Present even for a device that has
+	*  never captured — the request is what triggers the first one (D94). */
+	url: string().nullable(),
+	/** Epoch ms of the frame this link serves. Null = never captured.
+	*  THE honest age: the tRPC path carried none before this. */
+	capturedAt: number().nullable(),
+	/** Age of that frame at the moment the answer was built. */
+	ageMs: number().nullable(),
+	/** Epoch ms after which `url` stops verifying. */
+	expiresAt: number().nullable(),
+	/** Ladder rung the bytes are at; null = the frame as captured. */
+	width: number().nullable(),
+	/** The device has never produced a frame. An empty state, not a
+	*  failure — and never a reason to withhold the link (D94). */
+	neverCaptured: boolean(),
+	/** A sleeping battery camera: the frame is deliberately stale and will
+	*  NOT refresh in the background. A surface should say so rather than
+	*  present it as current. */
+	sleeping: boolean()
 })));
 /**
 * `sso-bridge` — internal hub-only cap that lets SSO-style auth
@@ -19940,7 +20799,29 @@ var FaceInfoSchema = object({
 	recognizedIdentityId: string().optional(),
 	identityName: string().optional(),
 	assigned: boolean(),
+	/**
+	* The crop, inline, base64.
+	*
+	* **Prefer {@link cropUrl}.** At the 500 rows the Faces view asks for this
+	* field alone is ~2.87 MiB, re-sent in full on every operator assign and
+	* every 30 s poll, base64-inflated over the msgpack socket and held in the
+	* query heap. It stays for callers that have not migrated; `includeCrops:
+	* false` turns it off once they have.
+	*/
 	base64: string().optional(),
+	/**
+	* Same crop, as a data-plane URL for `<img src>` — the move the admin
+	* snapshot surfaces made on 2026-08-08.
+	*
+	* Served by the `event-media` plane, which resolves a raw MediaStore key and
+	* is `access: 'authenticated'`: a bare `<img>` carries the `camstack_session`
+	* cookie, so no header plumbing is needed. The bytes then ride the browser's
+	* HTTP cache with an ETag and `immutable`, instead of the WebSocket.
+	*
+	* Absent when the face has no stored crop, or when the addon has no data
+	* plane — callers fall back to {@link base64}.
+	*/
+	cropUrl: string().optional(),
 	/** Design B: the face bbox (pixel space) on the key frame — lets a detail
 	*  view draw the box over the native `keyFrameMediaKey` frame. Absent on
 	*  legacy rows written before design B. */
@@ -20005,7 +20886,23 @@ method(_void(), array(IdentitySchema).readonly()), method(object({ name: string(
 	auth: "admin"
 }), method(object({
 	limit: number().int().positive().optional(),
-	filter: FaceFilterEnum.optional()
+	filter: FaceFilterEnum.optional(),
+	/**
+	* Inline the base64 crop on every row. Default `true` — the existing
+	* behaviour, kept so no caller breaks.
+	*
+	* Set `false` once the caller renders {@link FaceInfo.cropUrl}: that
+	* drops ~2.87 MiB per 500-row page to a few KiB of metadata and lets
+	* the browser cache the images.
+	*
+	* **This is an INPUT field, so it does not reach the addon until the
+	* next train.** The hub router validates cap inputs against its own
+	* compiled Zod, which strips a key it does not know — verified today
+	* on the OUTPUT side, where an additive field DOES arrive immediately
+	* (`Track.hasFace`). Until the train ships, sending `false` is
+	* harmless and simply keeps the crops inline.
+	*/
+	includeCrops: boolean().optional()
 }).optional(), array(FaceInfoSchema).readonly()), method(object({
 	deviceId: number().int(),
 	trackId: string()
@@ -25733,987 +26630,358 @@ var BaseDevice = class {
 	* to reshape before `config.setAll`.
 	*/
 	async applySettingsPatch(patch) {
-		await this.config.setAll(patch);
-	}
-	/**
-	* Phase 3 — populate device-scoped state needed by downstream phases
-	* (accessory reconciliation, public `features` array, optional cap
-	* registration). Called ONCE per construction, after register but
-	* before `getAccessoryChildren()`.
-	*
-	* Drivers write the `feature-probe` runtime-state slice via
-	* `this.runtimeState.setCapState('feature-probe', {...})` — flag bag
-	* is open (Reolink writes `hasPtz/hasIntercom`, Hikvision writes
-	* `hasSupplementalLight/hasAlarmIo`, etc).
-	*
-	* Default: nothing to probe → mark the device PROBED (set `lastProbedAt`) so
-	* the kernel treats it as ready immediately. A device that derives its shape
-	* from a spec (a container, or an accessory sensor) rather than from a
-	* hardware probe has no probe to "complete"; without stamping `lastProbedAt`
-	* it would look perpetually un-probed — logging "Initial probe did not
-	* complete" on every boot and spinning a pointless retry chain. Drivers that
-	* DO probe override this and write their own `feature-probe` slice (including
-	* `lastProbedAt`) once their probe actually succeeds.
-	*/
-	async onProbe() {
-		const base = this.runtimeState.getCapState("feature-probe") ?? {
-			flags: {},
-			deviceType: null,
-			model: null,
-			channelCount: null,
-			lastProbedAt: 0,
-			lastFetchedAt: 0
-		};
-		this.runtimeState.setCapState("feature-probe", {
-			...base,
-			lastProbedAt: Date.now()
-		});
-	}
-	/**
-	* Phase 5 — fired after the device + its accessories are registered.
-	* Drivers publish streams to the broker, kick off background tasks,
-	* or subscribe to lib events that need a fully-registered device id.
-	*
-	* Default: no-op.
-	*
-	* RENAMED FROM `onCreated` (which still exists for back-compat in this
-	* pass). The new name reflects the post-probe, post-accessory contract.
-	*/
-	async onActivate() {}
-	/**
-	* Re-run the probe + reconcile accessories + refresh features meta.
-	* Drivers call this when device-side state changes (battery cam wakes,
-	* firmware update, manual operator trigger).
-	*
-	* The kernel injects `_kernelReprobe` on registration so this method
-	* delegates to the same orchestrator that runs the boot-time phase
-	* 3 + 4 sequence. Drivers should NOT override this — they override
-	* `onProbe()` instead.
-	*/
-	async reprobe() {
-		if (this._kernelReprobe) await this._kernelReprobe();
-		else await this.onProbe();
-	}
-	/**
-	* Kernel-injected callback that runs the full post-probe orchestration
-	* (onProbe → registerDevice meta refresh → accessory reconciliation).
-	* Set by `device-cap-proxy.register()`. Drivers should not touch this
-	* directly — call `reprobe()` instead.
-	*/
-	_kernelReprobe;
-	/**
-	* Declare accessory child devices the kernel should auto-spawn
-	* after `onProbe()` resolves. Each spec fully describes one child
-	* — stableId suffix (deterministic per kind for restore-safety),
-	* meta (type / name / location), config (initial blob the child
-	* self-hydrates), and a factory that constructs the concrete
-	* class with whatever closure-captured refs it needs (typically
-	* `this` for the parent reference).
-	*
-	* The kernel handles the rest: allocateDeviceId, persistInitialConfig
-	* (skipped on restore when the row already exists),
-	* persistInitialMeta, createContext, factory invocation, register,
-	* and recursive lifecycle (probe + accessories + activate).
-	*
-	* Implementations should derive children from
-	* `this.runtimeState.getCapState('feature-probe')` (post-probe truth).
-	* Drivers can use the `getProbeFlags()` helper to read the flag bag
-	* with a typed cast.
-	*
-	* Default: no children.
-	*/
-	getAccessoryChildren() {
-		return [];
-	}
-	/**
-	* Read the current feature-probe flag bag with a typed cast. Helper
-	* for `getAccessoryChildren()` and `features` getters that derive
-	* outputs from the probe results.
-	*/
-	getProbeFlags() {
-		return this.runtimeState.getCapState("feature-probe")?.flags ?? {};
-	}
-	/**
-	* Returns true once `onProbe` has completed at least once
-	* (`lastProbedAt > 0`). Drivers gate `getAccessoryChildren()` on this
-	* to avoid spawning stale accessories on a fresh device whose probe
-	* hasn't landed yet.
-	*/
-	hasProbed() {
-		return (this.runtimeState.getCapState("feature-probe")?.lastProbedAt ?? 0) > 0;
-	}
-};
-/**
-* Convert an IDevice to the flat DeviceSummary shape expected by the
-* device-provider cap router. Shared across all providers.
-*/
-function toDeviceSummary(device, addonId) {
-	const config = {};
-	for (const entry of device.config.entries()) config[entry.key] = entry.value;
-	return {
-		id: device.id,
-		stableId: device.stableId,
-		addonId,
-		type: String(device.type),
-		name: device.name,
-		parentDeviceId: device.parentDeviceId,
-		online: device.online,
-		features: [...device.features],
-		config,
-		sourceInfo: device.sourceInfo
-	};
-}
-/**
-* Base class for device-provider addons (rtsp, onvif, frigate).
-*
-* Provides default implementations for the common device-provider cap
-* methods (`start`, `stop`, `getStatus`, `getDevices`, `supportsDiscovery`,
-* `supportsManualCreation`, `toDeviceSummary`). Subclasses override the
-* methods that differ per provider.
-*
-* @example
-* ```ts
-* class RtspProvider extends BaseDeviceProvider {
-*   protected readonly addonId = 'provider-rtsp'
-*   protected readonly providerName = 'RTSP'
-*
-*   protected async onCreateDevice(input) { ... }
-*   protected async onGetCreationSchema(type) { ... }
-*   protected async onRestoreDevices(saved) { ... }
-* }
-* ```
-*/
-var BaseDeviceProvider = class extends BaseAddon {
-	async onInitialize() {
-		this.ctx.logger.info(`${this.providerName} Provider initialized`);
-		return [{
-			capability: deviceProviderCapability,
-			provider: this
-		}];
-	}
-	async onShutdown() {
-		const devices = await this.ctx.kernel.devices?.getAll() ?? [];
-		for (const device of devices) try {
-			await this.ctx.kernel.devices?.decommission(device.id);
-		} catch (err) {
-			this.ctx.logger.warn(`${this.providerName}: decommission failed`, {
-				tags: {
-					deviceId: device.id,
-					stableId: device.stableId
-				},
-				meta: { error: err instanceof Error ? err.message : String(err) }
-			});
-		}
-		this.ctx.logger.info(`${this.providerName} Provider shut down`, { meta: { decommissionedCount: devices.length } });
-	}
-	async start() {}
-	async stop() {}
-	async getStatus() {
-		return {
-			connected: true,
-			deviceCount: (await this.ctx.kernel.devices?.getAll() ?? []).length
-		};
-	}
-	async getDevices() {
-		return (await this.ctx.kernel.devices?.getAll() ?? []).map((d) => ({
-			id: d.stableId,
-			name: d.name,
-			type: String(d.type)
-		}));
-	}
-	async supportsDiscovery() {
-		return false;
-	}
-	async discoverDevices(_input) {
-		return [];
-	}
-	/** Extra per-scan input form (e.g. a broadcast address for another subnet).
-	*  Null = no extra params. Override in providers that support scoped scans. */
-	async getDiscoveryParamsSchema() {
-		return null;
-	}
-	/**
-	* The DeviceType this provider creates via manual add — derived from the
-	* `deviceClasses` map (first registered type). `null` when manual creation is
-	* unsupported. Lets the Add-Device dialog pick the right type per provider.
-	*/
-	async getManualCreationType() {
-		if (!await this.supportsManualCreation()) return { deviceType: null };
-		return { deviceType: Object.values(DeviceType).find((t) => this.deviceClasses[t] !== void 0) ?? null };
-	}
-	async adoptDiscoveredDevice(_input) {
-		throw new Error(`${this.providerName} provider does not support discovery-based adoption`);
-	}
-	async supportsManualCreation() {
-		return true;
-	}
-	async getChildCreationSchema(input) {
-		return this.onGetCreationSchema(input.type);
-	}
-	/**
-	* Default kernel-orchestrated `createDevice` implementation. The
-	* subclass's `onCreateDevice` returns a declarative
-	* `CreateDeviceSpec` (`{meta, config}`) — this method handles
-	* stableId generation, class lookup, kernel.devices.create
-	* dispatch, and DeviceSummary mapping. Subclasses should NOT
-	* override this method; override `onCreateDevice` and
-	* `deviceClasses` instead.
-	*/
-	async createDevice(input) {
-		const spec = await this.onCreateDevice(input.type, input.config);
-		const Class = this.deviceClasses[spec.meta.type];
-		if (!Class) throw new Error(`${this.providerName} provider: no device class registered for type "${spec.meta.type}" — add it to the deviceClasses map`);
-		const stableId = this.generateStableId(spec.meta.type, spec.config);
-		const device = await this.ctx.kernel.devices.create(stableId, Class, spec.config, null, spec.meta);
-		if (spec.onAfterCreate) try {
-			await spec.onAfterCreate(device);
-		} catch (err) {
-			this.ctx.logger.warn("createDevice: onAfterCreate hook threw — device is already registered", {
-				tags: {
-					deviceId: device.id,
-					stableId
-				},
-				meta: { error: err instanceof Error ? err.message : String(err) }
-			});
-		}
-		return this.toSummary(device);
+		await this.config.setAll(patch);
 	}
 	/**
-	* Generate a stableId for a newly-created device. Default uses the
-	* `${addonId}-${Date.now()}` pattern as a unique-but-opaque
-	* fallback; any provider that has access to durable hardware
-	* identity (UID, MAC, serial) should override and derive from it
-	* so re-adding the same physical device reuses its persisted row.
+	* Phase 3 — populate device-scoped state needed by downstream phases
+	* (accessory reconciliation, public `features` array, optional cap
+	* registration). Called ONCE per construction, after register but
+	* before `getAccessoryChildren()`.
 	*
-	* `config` is the parsed CreateDeviceSpec.config the subclass
-	* returned from `onCreateDevice` — the override has access to
-	* every operator-supplied + autodetect-resolved field. Optional
-	* for back-compat: existing overrides that take only `type`
-	* keep working unchanged.
+	* Drivers write the `feature-probe` runtime-state slice via
+	* `this.runtimeState.setCapState('feature-probe', {...})` — flag bag
+	* is open (Reolink writes `hasPtz/hasIntercom`, Hikvision writes
+	* `hasSupplementalLight/hasAlarmIo`, etc).
+	*
+	* Default: nothing to probe → mark the device PROBED (set `lastProbedAt`) so
+	* the kernel treats it as ready immediately. A device that derives its shape
+	* from a spec (a container, or an accessory sensor) rather than from a
+	* hardware probe has no probe to "complete"; without stamping `lastProbedAt`
+	* it would look perpetually un-probed — logging "Initial probe did not
+	* complete" on every boot and spinning a pointless retry chain. Drivers that
+	* DO probe override this and write their own `feature-probe` slice (including
+	* `lastProbedAt`) once their probe actually succeeds.
 	*/
-	generateStableId(_type, _config) {
-		return `${this.addonId}-${Date.now()}`;
-	}
-	async testCreationField(_input) {
-		return {
-			status: "ok",
-			labels: ["probe not implemented"]
+	async onProbe() {
+		const base = this.runtimeState.getCapState("feature-probe") ?? {
+			flags: {},
+			deviceType: null,
+			model: null,
+			channelCount: null,
+			lastProbedAt: 0,
+			lastFetchedAt: 0
 		};
-	}
-	async restoreDevices(savedDevices) {
-		await this.onRestoreDevices(savedDevices);
-		if (savedDevices.length > 0) this.ctx.logger.info(`Restored ${savedDevices.length} ${this.providerName} device(s)`);
+		this.runtimeState.setCapState("feature-probe", {
+			...base,
+			lastProbedAt: Date.now()
+		});
 	}
 	/**
-	* Restore devices from persisted state. Two-pass:
+	* Phase 5 — fired after the device + its accessories are registered.
+	* Drivers publish streams to the broker, kick off background tasks,
+	* or subscribe to lib events that need a fully-registered device id.
 	*
-	* 1. **Top-level pass** — invokes `kernel.devices.create()` for every
-	*    `parentDeviceId === null` row using the `deviceClasses` map.
-	*    The kernel's register flow handles `getAccessoryChildren()` for
-	*    each parent (siren / floodlight / PIR / etc).
+	* Default: no-op.
 	*
-	* 2. **Hub-adopted children pass** — for rows with
-	*    `parentDeviceId !== null` whose `type` IS in `deviceClasses`
-	*    (e.g. Reolink hub-adopted cameras under an NVR), spawn them
-	*    explicitly with the persisted `parentDeviceId`. These are
-	*    NOT accessory children — they're first-class adopted devices
-	*    that just happen to have a parent. Without this pass, every
-	*    server restart would lose hub-adopted cameras (their type is
-	*    in `deviceClasses` but parent's `getAccessoryChildren` doesn't
-	*    spawn them — that callback is only for purpose-built
-	*    accessory roles).
+	* RENAMED FROM `onCreated` (which still exists for back-compat in this
+	* pass). The new name reflects the post-probe, post-accessory contract.
+	*/
+	async onActivate() {}
+	/**
+	* Re-run the probe + reconcile accessories + refresh features meta.
+	* Drivers call this when device-side state changes (battery cam wakes,
+	* firmware update, manual operator trigger).
 	*
-	* Rows whose `type` is NOT in `deviceClasses` are skipped — those
-	* are accessory children (siren/light/sensor) that the kernel's
-	* accessory-spawn flow handles via the parent's
-	* `getAccessoryChildren()`. Override only when the default doesn't
-	* fit.
+	* The kernel injects `_kernelReprobe` on registration so this method
+	* delegates to the same orchestrator that runs the boot-time phase
+	* 3 + 4 sequence. Drivers should NOT override this — they override
+	* `onProbe()` instead.
 	*/
-	async onRestoreDevices(savedDevices) {
-		const restored = /* @__PURE__ */ new Set();
-		for (const saved of savedDevices) {
-			if (saved.parentDeviceId !== null) continue;
-			const Class = this.deviceClasses[saved.type];
-			if (!Class) {
-				this.ctx.logger.warn("No device class registered for restored type — skipping", {
-					tags: { stableId: saved.stableId },
-					meta: { type: saved.type }
-				});
-				continue;
-			}
-			try {
-				await this.ctx.kernel.devices.create(saved.stableId, Class, {});
-				restored.add(saved.id);
-			} catch (err) {
-				this.ctx.logger.warn("Failed to restore device", {
-					tags: { stableId: saved.stableId },
-					meta: {
-						type: saved.type,
-						error: err instanceof Error ? err.message : String(err)
-					}
-				});
-			}
-		}
-		const childRows = savedDevices.filter((s) => s.parentDeviceId !== null);
-		for (const saved of childRows) {
-			const Class = this.deviceClasses[saved.type];
-			if (!Class) continue;
-			if (saved.parentDeviceId === null) continue;
-			if (!restored.has(saved.parentDeviceId)) continue;
-			try {
-				await this.ctx.kernel.devices.create(saved.stableId, Class, {}, saved.parentDeviceId);
-				restored.add(saved.id);
-			} catch (err) {
-				this.ctx.logger.warn("Failed to restore hub-adopted child", {
-					tags: {
-						stableId: saved.stableId,
-						parentDeviceId: saved.parentDeviceId
-					},
-					meta: {
-						type: saved.type,
-						error: err instanceof Error ? err.message : String(err)
-					}
-				});
-			}
-		}
-	}
-	/** Convert an IDevice to the flat DeviceSummary for the cap router. */
-	toSummary(device) {
-		return toDeviceSummary(device, this.addonId);
-	}
-};
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
-new Set(Object.values(DeviceType));
-DeviceFeature.BatteryOperated;
-/**
-* Error types for the safe expression engine. Two distinct classes so callers
-* can tell a compile-time (grammar) failure from a runtime (evaluation)
-* failure — both are non-fatal to the host: read paths degrade to "skip link".
-*/
-/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
-*  the failure is anchored to a character (author-facing inline feedback). */
-var ExpressionParseError = class extends Error {
-	position;
-	constructor(message, position) {
-		super(message);
-		this.name = "ExpressionParseError";
-		this.position = position;
-	}
-};
-/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
-*  result, unknown builtin, step-budget exceeded). */
-var ExpressionEvalError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ExpressionEvalError";
+	async reprobe() {
+		if (this._kernelReprobe) await this._kernelReprobe();
+		else await this.onProbe();
 	}
-};
-/**
-* Frozen, null-prototype builtin function table for the expression engine
-* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
-* parser rejects any callee not in it, and the evaluator gates each call on an
-* own-property check against it.
-*
-* Because the object has a NULL prototype AND is `Object.freeze`d:
-*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
-*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
-*    (there is no `Object.prototype` in the chain), so those names are not
-*    callable — they are simply "unknown function" at parse time.
-*
-* Every numeric argument is validated as a finite number and every numeric
-* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
-* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
-* closed rather than emitting a garbage value.
-*/
-function asFiniteNumber(value, name, index) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
-	return value;
-}
-function asString$1(value, name, index) {
-	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
-	return value;
-}
-function finiteResult(value, name) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
-	return value;
-}
-function allFiniteNumbers(args, name) {
-	return args.map((a, idx) => asFiniteNumber(a, name, idx));
-}
-var INF = Number.POSITIVE_INFINITY;
-var table = {
-	min: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
-	},
-	max: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
-	},
-	abs: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
-	},
-	floor: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
-	},
-	ceil: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
-	},
-	sqrt: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
-	},
-	round: {
-		minArgs: 1,
-		maxArgs: 2,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "round", 0);
-			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
-			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
-			const factor = 10 ** digits;
-			return finiteResult(Math.round(x * factor) / factor, "round");
-		}
-	},
-	pow: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
-	},
-	clamp: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "clamp", 0);
-			const lo = asFiniteNumber(args[1], "clamp", 1);
-			const hi = asFiniteNumber(args[2], "clamp", 2);
-			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
-			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
-		}
-	},
-	avg: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const nums = allFiniteNumbers(args, "avg");
-			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
-		}
-	},
-	sum: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
-	},
-	coalesce: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			for (const a of args) if (a !== null) return a;
-			return null;
-		}
-	},
-	age: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
-	},
-	convert: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args, hooks) => {
-			const x = asFiniteNumber(args[0], "convert", 0);
-			const from = asString$1(args[1], "convert", 1).trim();
-			const to = asString$1(args[2], "convert", 2).trim();
-			if (hooks.convert) {
-				const out = hooks.convert(x, from, to);
-				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
-				return finiteResult(out, "convert");
-			}
-			if (from === to) return x;
-			throw new ExpressionEvalError("convert: unit conversion table not installed");
-		}
+	/**
+	* Kernel-injected callback that runs the full post-probe orchestration
+	* (onProbe → registerDevice meta refresh → accessory reconciliation).
+	* Set by `device-cap-proxy.register()`. Drivers should not touch this
+	* directly — call `reprobe()` instead.
+	*/
+	_kernelReprobe;
+	/**
+	* Declare accessory child devices the kernel should auto-spawn
+	* after `onProbe()` resolves. Each spec fully describes one child
+	* — stableId suffix (deterministic per kind for restore-safety),
+	* meta (type / name / location), config (initial blob the child
+	* self-hydrates), and a factory that constructs the concrete
+	* class with whatever closure-captured refs it needs (typically
+	* `this` for the parent reference).
+	*
+	* The kernel handles the rest: allocateDeviceId, persistInitialConfig
+	* (skipped on restore when the row already exists),
+	* persistInitialMeta, createContext, factory invocation, register,
+	* and recursive lifecycle (probe + accessories + activate).
+	*
+	* Implementations should derive children from
+	* `this.runtimeState.getCapState('feature-probe')` (post-probe truth).
+	* Drivers can use the `getProbeFlags()` helper to read the flag bag
+	* with a typed cast.
+	*
+	* Default: no children.
+	*/
+	getAccessoryChildren() {
+		return [];
 	}
-};
-Object.freeze(Object.assign(Object.create(null), table));
-/** The set of valid builtin names — used by the parser to reject unknown
-*  callees at parse time (immediate author feedback). */
-var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
-/**
-* Resource-bound constants for the safe expression engine.
-*
-* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
-* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
-* O(nodeCount) by construction. These caps merely put a hard ceiling on the
-* work a single author-supplied expression can request, so a hostile or
-* accidental pathological string can never spend unbounded CPU/memory.
-*/
-/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
-*  rejected without allocation. */
-var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
-/** A legal binding / identifier name. */
-var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Binding names an author may NOT use: `now` is auto-injected; the literal
-*  keywords lex as values, not identifiers, so binding to them is meaningless. */
-var RESERVED_BINDING_NAMES = new Set([
-	"now",
-	"true",
-	"false",
-	"null"
-]);
-/**
-* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
-* zero-dependency. The grammar is deliberately boring: decimal numbers,
-* single/double-quoted strings with a tiny escape set, identifiers, the three
-* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
-* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
-* is a parse error with a source position, so member access / assignment /
-* template literals are lexically impossible.
-*/
-var KEYWORDS = new Set([
-	"true",
-	"false",
-	"null"
-]);
-function isDigit(ch) {
-	return ch >= "0" && ch <= "9";
-}
-function isIdentStart(ch) {
-	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
-}
-function isIdentPart(ch) {
-	return isIdentStart(ch) || isDigit(ch);
-}
-function isWhitespace(ch) {
-	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
-}
-/** Tokenize `source` into a flat token list ending with a single `eof` token.
-*  Throws `ExpressionParseError` on any illegal character or unterminated
-*  string. */
-function tokenize(source) {
-	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
-	const tokens = [];
-	let i = 0;
-	const n = source.length;
-	while (i < n) {
-		const ch = source[i];
-		if (isWhitespace(ch)) {
-			i += 1;
-			continue;
-		}
-		if (isDigit(ch)) {
-			const start = i;
-			while (i < n && isDigit(source[i])) i += 1;
-			if (i < n && source[i] === ".") {
-				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
-				i += 1;
-				while (i < n && isDigit(source[i])) i += 1;
-			}
-			const text = source.slice(start, i);
-			const value = Number(text);
-			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
-			tokens.push({
-				type: "number",
-				value,
-				pos: start
-			});
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			const quote = ch;
-			const start = i;
-			i += 1;
-			let out = "";
-			let closed = false;
-			while (i < n) {
-				const c = source[i];
-				if (c === "\\") {
-					const next = i + 1 < n ? source[i + 1] : "";
-					if (next === "\\" || next === "'" || next === "\"") {
-						out += next;
-						i += 2;
-						continue;
-					}
-					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
-				}
-				if (c === quote) {
-					closed = true;
-					i += 1;
-					break;
-				}
-				out += c;
-				i += 1;
-			}
-			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
-			tokens.push({
-				type: "string",
-				value: out,
-				pos: start
-			});
-			continue;
-		}
-		if (isIdentStart(ch)) {
-			const start = i;
-			while (i < n && isIdentPart(source[i])) i += 1;
-			const text = source.slice(start, i);
-			if (KEYWORDS.has(text)) tokens.push({
-				type: "keyword",
-				keyword: keywordOf(text),
-				pos: start
-			});
-			else tokens.push({
-				type: "identifier",
-				name: text,
-				pos: start
-			});
-			continue;
-		}
-		const two = i + 1 < n ? source.slice(i, i + 2) : "";
-		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
-			tokens.push({
-				type: "punct",
-				punct: two,
-				pos: i
-			});
-			i += 2;
-			continue;
-		}
-		if (isSinglePunct(ch)) {
-			tokens.push({
-				type: "punct",
-				punct: ch,
-				pos: i
-			});
-			i += 1;
-			continue;
-		}
-		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	/**
+	* Read the current feature-probe flag bag with a typed cast. Helper
+	* for `getAccessoryChildren()` and `features` getters that derive
+	* outputs from the probe results.
+	*/
+	getProbeFlags() {
+		return this.runtimeState.getCapState("feature-probe")?.flags ?? {};
 	}
-	tokens.push({
-		type: "eof",
-		pos: n
-	});
-	return tokens;
-}
-function keywordOf(text) {
-	if (text === "true") return "true";
-	if (text === "false") return "false";
-	return "null";
-}
-function isSinglePunct(ch) {
-	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+	/**
+	* Returns true once `onProbe` has completed at least once
+	* (`lastProbedAt > 0`). Drivers gate `getAccessoryChildren()` on this
+	* to avoid spawning stale accessories on a fresh device whose probe
+	* hasn't landed yet.
+	*/
+	hasProbed() {
+		return (this.runtimeState.getCapState("feature-probe")?.lastProbedAt ?? 0) > 0;
+	}
+};
+/**
+* Convert an IDevice to the flat DeviceSummary shape expected by the
+* device-provider cap router. Shared across all providers.
+*/
+function toDeviceSummary(device, addonId) {
+	const config = {};
+	for (const entry of device.config.entries()) config[entry.key] = entry.value;
+	return {
+		id: device.id,
+		stableId: device.stableId,
+		addonId,
+		type: String(device.type),
+		name: device.name,
+		parentDeviceId: device.parentDeviceId,
+		online: device.online,
+		features: [...device.features],
+		config,
+		sourceInfo: device.sourceInfo
+	};
 }
 /**
-* Pratt (precedence-climbing) parser for the safe expression mini-language.
+* Base class for device-provider addons (rtsp, onvif, frigate).
 *
-* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
-* → relational → additive → multiplicative → unary `! -` → call / primary.
-* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
-* string validated against the builtin table at parse time, so an unknown
-* function is rejected immediately (author feedback) and a persisted expression
-* that references a since-removed builtin degrades at read.
+* Provides default implementations for the common device-provider cap
+* methods (`start`, `stop`, `getStatus`, `getDevices`, `supportsDiscovery`,
+* `supportsManualCreation`, `toDeviceSummary`). Subclasses override the
+* methods that differ per provider.
 *
-* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
-* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+* @example
+* ```ts
+* class RtspProvider extends BaseDeviceProvider {
+*   protected readonly addonId = 'provider-rtsp'
+*   protected readonly providerName = 'RTSP'
+*
+*   protected async onCreateDevice(input) { ... }
+*   protected async onGetCreationSchema(type) { ... }
+*   protected async onRestoreDevices(saved) { ... }
+* }
+* ```
 */
-/** Binary/logical operator precedence (higher binds tighter). */
-var BINARY_PRECEDENCE = {
-	"||": 1,
-	"&&": 2,
-	"==": 3,
-	"!=": 3,
-	"<": 4,
-	"<=": 4,
-	">": 4,
-	">=": 4,
-	"+": 5,
-	"-": 5,
-	"*": 6,
-	"/": 6,
-	"%": 6
-};
-function isLogicalOp(op) {
-	return op === "&&" || op === "||";
-}
-function isBinaryOp(op) {
-	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
-}
-var Parser = class {
-	tokens;
-	pos = 0;
-	nodeCount = 0;
-	identifiers = /* @__PURE__ */ new Set();
-	callees = /* @__PURE__ */ new Set();
-	constructor(tokens) {
-		this.tokens = tokens;
+var BaseDeviceProvider = class extends BaseAddon {
+	async onInitialize() {
+		this.ctx.logger.info(`${this.providerName} Provider initialized`);
+		return [{
+			capability: deviceProviderCapability,
+			provider: this
+		}];
 	}
-	parse() {
-		const ast = this.parseTernary();
-		const tok = this.peek();
-		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+	async onShutdown() {
+		const devices = await this.ctx.kernel.devices?.getAll() ?? [];
+		for (const device of devices) try {
+			await this.ctx.kernel.devices?.decommission(device.id);
+		} catch (err) {
+			this.ctx.logger.warn(`${this.providerName}: decommission failed`, {
+				tags: {
+					deviceId: device.id,
+					stableId: device.stableId
+				},
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+		}
+		this.ctx.logger.info(`${this.providerName} Provider shut down`, { meta: { decommissionedCount: devices.length } });
+	}
+	async start() {}
+	async stop() {}
+	async getStatus() {
 		return {
-			ast,
-			identifiers: this.identifiers,
-			callees: this.callees,
-			nodeCount: this.nodeCount
+			connected: true,
+			deviceCount: (await this.ctx.kernel.devices?.getAll() ?? []).length
 		};
 	}
-	peek() {
-		return this.tokens[this.pos];
-	}
-	next() {
-		return this.tokens[this.pos++];
-	}
-	/** Consume a punctuator token, erroring if the next token isn't it. */
-	expectPunct(punct) {
-		const tok = this.peek();
-		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
-		this.pos += 1;
+	async getDevices() {
+		return (await this.ctx.kernel.devices?.getAll() ?? []).map((d) => ({
+			id: d.stableId,
+			name: d.name,
+			type: String(d.type)
+		}));
 	}
-	matchPunct(punct) {
-		const tok = this.peek();
-		if (tok.type === "punct" && tok.punct === punct) {
-			this.pos += 1;
-			return true;
-		}
+	async supportsDiscovery() {
 		return false;
 	}
-	countNode() {
-		this.nodeCount += 1;
-		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	async discoverDevices(_input) {
+		return [];
 	}
-	parseTernary() {
-		const test = this.parseBinary(1);
-		if (this.matchPunct("?")) {
-			const consequent = this.parseTernary();
-			this.expectPunct(":");
-			const alternate = this.parseTernary();
-			this.countNode();
-			return {
-				kind: "conditional",
-				test,
-				consequent,
-				alternate
-			};
-		}
-		return test;
+	/** Extra per-scan input form (e.g. a broadcast address for another subnet).
+	*  Null = no extra params. Override in providers that support scoped scans. */
+	async getDiscoveryParamsSchema() {
+		return null;
 	}
-	parseBinary(minPrec) {
-		let left = this.parseUnary();
-		for (;;) {
-			const tok = this.peek();
-			if (tok.type !== "punct") break;
-			const prec = BINARY_PRECEDENCE[tok.punct];
-			if (prec === void 0 || prec < minPrec) break;
-			const op = tok.punct;
-			this.pos += 1;
-			const right = this.parseBinary(prec + 1);
-			this.countNode();
-			if (isLogicalOp(op)) left = {
-				kind: "logical",
-				op,
-				left,
-				right
-			};
-			else if (isBinaryOp(op)) left = {
-				kind: "binary",
-				op,
-				left,
-				right
-			};
-			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
-		}
-		return left;
+	/**
+	* The DeviceType this provider creates via manual add — derived from the
+	* `deviceClasses` map (first registered type). `null` when manual creation is
+	* unsupported. Lets the Add-Device dialog pick the right type per provider.
+	*/
+	async getManualCreationType() {
+		if (!await this.supportsManualCreation()) return { deviceType: null };
+		return { deviceType: Object.values(DeviceType).find((t) => this.deviceClasses[t] !== void 0) ?? null };
 	}
-	parseUnary() {
-		const tok = this.peek();
-		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
-			const op = tok.punct;
-			this.pos += 1;
-			const operand = this.parseUnary();
-			this.countNode();
-			return {
-				kind: "unary",
-				op,
-				operand
-			};
-		}
-		return this.parsePrimary();
+	async adoptDiscoveredDevice(_input) {
+		throw new Error(`${this.providerName} provider does not support discovery-based adoption`);
 	}
-	parsePrimary() {
-		const tok = this.next();
-		switch (tok.type) {
-			case "number":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "string":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "keyword":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.keyword === "null" ? null : tok.keyword === "true"
-				};
-			case "identifier": {
-				const nextTok = this.peek();
-				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
-				this.identifiers.add(tok.name);
-				this.countNode();
-				return {
-					kind: "identifier",
-					name: tok.name
-				};
-			}
-			case "punct":
-				if (tok.punct === "(") {
-					const inner = this.parseTernary();
-					this.expectPunct(")");
-					return inner;
-				}
-				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
-			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
-		}
+	async supportsManualCreation() {
+		return true;
 	}
-	parseCall(callee, pos) {
-		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
-		this.expectPunct("(");
-		const args = [];
-		if (!this.matchPunct(")")) for (;;) {
-			args.push(this.parseTernary());
-			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
-			if (this.matchPunct(",")) continue;
-			this.expectPunct(")");
-			break;
+	async getChildCreationSchema(input) {
+		return this.onGetCreationSchema(input.type);
+	}
+	/**
+	* Default kernel-orchestrated `createDevice` implementation. The
+	* subclass's `onCreateDevice` returns a declarative
+	* `CreateDeviceSpec` (`{meta, config}`) — this method handles
+	* stableId generation, class lookup, kernel.devices.create
+	* dispatch, and DeviceSummary mapping. Subclasses should NOT
+	* override this method; override `onCreateDevice` and
+	* `deviceClasses` instead.
+	*/
+	async createDevice(input) {
+		const spec = await this.onCreateDevice(input.type, input.config);
+		const Class = this.deviceClasses[spec.meta.type];
+		if (!Class) throw new Error(`${this.providerName} provider: no device class registered for type "${spec.meta.type}" — add it to the deviceClasses map`);
+		const stableId = this.generateStableId(spec.meta.type, spec.config);
+		const device = await this.ctx.kernel.devices.create(stableId, Class, spec.config, null, spec.meta);
+		if (spec.onAfterCreate) try {
+			await spec.onAfterCreate(device);
+		} catch (err) {
+			this.ctx.logger.warn("createDevice: onAfterCreate hook threw — device is already registered", {
+				tags: {
+					deviceId: device.id,
+					stableId
+				},
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
 		}
-		this.callees.add(callee);
-		this.countNode();
-		return {
-			kind: "call",
-			callee,
-			args
-		};
+		return this.toSummary(device);
 	}
-};
-/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
-*  `ExpressionParseError` on any lexical or grammatical failure. */
-function parseExpression(source) {
-	return new Parser(tokenize(source)).parse();
-}
-/**
-* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
-* by expr"). The cache stores BOTH successes and failures (negative caching),
-* so a corrupt persisted string costs exactly one tokenize+parse total — not
-* one per read on a hot resolve path.
-*
-* The cache is a module-level singleton: entries are pure, content-addressed
-* ASTs keyed by the raw source string, so sharing one instance across all
-* callers is safe and maximises hit rate.
-*/
-var cache = /* @__PURE__ */ new Map();
-function getCached(source) {
-	const hit = cache.get(source);
-	if (hit !== void 0) {
-		cache.delete(source);
-		cache.set(source, hit);
-		return hit;
+	/**
+	* Generate a stableId for a newly-created device. Default uses the
+	* `${addonId}-${Date.now()}` pattern as a unique-but-opaque
+	* fallback; any provider that has access to durable hardware
+	* identity (UID, MAC, serial) should override and derive from it
+	* so re-adding the same physical device reuses its persisted row.
+	*
+	* `config` is the parsed CreateDeviceSpec.config the subclass
+	* returned from `onCreateDevice` — the override has access to
+	* every operator-supplied + autodetect-resolved field. Optional
+	* for back-compat: existing overrides that take only `type`
+	* keep working unchanged.
+	*/
+	generateStableId(_type, _config) {
+		return `${this.addonId}-${Date.now()}`;
 	}
-	let result;
-	try {
-		result = {
-			ok: true,
-			parsed: parseExpression(source)
-		};
-	} catch (err) {
-		result = {
-			ok: false,
-			error: err instanceof ExpressionParseError ? err.message : String(err)
+	async testCreationField(_input) {
+		return {
+			status: "ok",
+			labels: ["probe not implemented"]
 		};
 	}
-	cache.set(source, result);
-	if (cache.size > 256) {
-		const oldest = cache.keys().next().value;
-		if (oldest !== void 0) cache.delete(oldest);
+	async restoreDevices(savedDevices) {
+		await this.onRestoreDevices(savedDevices);
+		if (savedDevices.length > 0) this.ctx.logger.info(`Restored ${savedDevices.length} ${this.providerName} device(s)`);
 	}
-	return result;
-}
-/** Compile `source`, returning a discriminated result instead of throwing.
-*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
-function compileExpressionSafe(source) {
-	return getCached(source);
-}
-Object.freeze({});
-/**
-* Author-time validation. Returns `null` when the source is valid, else a
-* human-readable error message. Checks: the expression compiles; binding count
-* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
-* is not reserved (`now`/keywords) and does not shadow a builtin; and every
-* FREE identifier of the AST is covered by a binding or the injected `now`.
-*/
-function validateExpressionSource(src) {
-	const names = Object.keys(src.bindings);
-	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
-	for (const name of names) {
-		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
-		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
-		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
+	/**
+	* Restore devices from persisted state. Two-pass:
+	*
+	* 1. **Top-level pass** — invokes `kernel.devices.create()` for every
+	*    `parentDeviceId === null` row using the `deviceClasses` map.
+	*    The kernel's register flow handles `getAccessoryChildren()` for
+	*    each parent (siren / floodlight / PIR / etc).
+	*
+	* 2. **Hub-adopted children pass** — for rows with
+	*    `parentDeviceId !== null` whose `type` IS in `deviceClasses`
+	*    (e.g. Reolink hub-adopted cameras under an NVR), spawn them
+	*    explicitly with the persisted `parentDeviceId`. These are
+	*    NOT accessory children — they're first-class adopted devices
+	*    that just happen to have a parent. Without this pass, every
+	*    server restart would lose hub-adopted cameras (their type is
+	*    in `deviceClasses` but parent's `getAccessoryChildren` doesn't
+	*    spawn them — that callback is only for purpose-built
+	*    accessory roles).
+	*
+	* Rows whose `type` is NOT in `deviceClasses` are skipped — those
+	* are accessory children (siren/light/sensor) that the kernel's
+	* accessory-spawn flow handles via the parent's
+	* `getAccessoryChildren()`. Override only when the default doesn't
+	* fit.
+	*/
+	async onRestoreDevices(savedDevices) {
+		const restored = /* @__PURE__ */ new Set();
+		for (const saved of savedDevices) {
+			if (saved.parentDeviceId !== null) continue;
+			const Class = this.deviceClasses[saved.type];
+			if (!Class) {
+				this.ctx.logger.warn("No device class registered for restored type — skipping", {
+					tags: { stableId: saved.stableId },
+					meta: { type: saved.type }
+				});
+				continue;
+			}
+			try {
+				await this.ctx.kernel.devices.create(saved.stableId, Class, {});
+				restored.add(saved.id);
+			} catch (err) {
+				this.ctx.logger.warn("Failed to restore device", {
+					tags: { stableId: saved.stableId },
+					meta: {
+						type: saved.type,
+						error: err instanceof Error ? err.message : String(err)
+					}
+				});
+			}
+		}
+		const childRows = savedDevices.filter((s) => s.parentDeviceId !== null);
+		for (const saved of childRows) {
+			const Class = this.deviceClasses[saved.type];
+			if (!Class) continue;
+			if (saved.parentDeviceId === null) continue;
+			if (!restored.has(saved.parentDeviceId)) continue;
+			try {
+				await this.ctx.kernel.devices.create(saved.stableId, Class, {}, saved.parentDeviceId);
+				restored.add(saved.id);
+			} catch (err) {
+				this.ctx.logger.warn("Failed to restore hub-adopted child", {
+					tags: {
+						stableId: saved.stableId,
+						parentDeviceId: saved.parentDeviceId
+					},
+					meta: {
+						type: saved.type,
+						error: err instanceof Error ? err.message : String(err)
+					}
+				});
+			}
+		}
 	}
-	const compiled = compileExpressionSafe(src.expr);
-	if (!compiled.ok) return compiled.error;
-	const bound = new Set(names);
-	for (const id of compiled.parsed.identifiers) {
-		if (id === "now") continue;
-		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	/** Convert an IDevice to the flat DeviceSummary for the cap router. */
+	toSummary(device) {
+		return toDeviceSummary(device, this.addonId);
 	}
-	return null;
-}
-var ExpressionBindingSourceSchema = union([
-	object({
-		kind: literal("field").optional(),
-		sourceKey: string(),
-		cap: string(),
-		fieldPath: string()
-	}),
-	object({
-		kind: literal("literal"),
-		value: union([
-			string(),
-			number(),
-			boolean(),
-			_null()
-		])
-	}),
-	object({
-		kind: literal("global"),
-		sourceStableId: string(),
-		cap: string(),
-		fieldPath: string()
-	})
-]);
-object({
-	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
-});
+};
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
+new Set(Object.values(DeviceType));
+DeviceFeature.BatteryOperated;
 Object.freeze({
 	"accessories.setChildHidden": {
 		capName: "accessories",
@@ -31047,6 +31315,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"snapshot.getSnapshotLinks": {
+		capName: "snapshot",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"snapshot.getSnapshotOverview": {
 		capName: "snapshot",
 		capScope: "device",
@@ -56797,8 +57071,9 @@ var HmChildDevice = class extends BaseDevice {
 	}
 	/**
 	* Attach a facade `valueChanged` listener filtered to this child's device
-	* address. The subclass-supplied `handle` runs only for matching events.
-	* No-ops when no facade is present (the child reconnects on next reconcile).
+	* address AND — when the child owns one — to its channel. The
+	* subclass-supplied `handle` runs only for matching events. No-ops when no
+	* facade is present (the child reconnects on next reconcile).
 	*/
 	attachValueChangedListener(handle) {
 		this.valueHandler = handle;
@@ -56806,12 +57081,41 @@ var HmChildDevice = class extends BaseDevice {
 		if (!facade) return;
 		this.valueChangedUnsub = facade.on("valueChanged", (event) => {
 			if (event.device !== this.address) return;
+			if (!this.ownsEventChannel(event)) return;
 			handle(event);
 		});
 		this.seedTriggerUnsubs = [facade.on("ready", () => this.seedCurrentValues()), facade.on("connection", () => this.seedCurrentValues())];
 		this.seedCurrentValues();
 	}
 	/**
+	* Whether an inbound value event belongs to THIS child's channel.
+	*
+	* One CCU device address can host SEVERAL independent functional entities —
+	* an HmIP-BS2 carries two unrelated relays, on `<addr>:4` and `<addr>:8`, and
+	* BOTH emit `STATE`. Filtering on the device address alone let either relay's
+	* event write the other's slice: actuating one made both report ON while only
+	* one was physically on. The seed path (`seedCurrentValues`) has always been
+	* channel-scoped; this makes the live path agree with it.
+	*
+	* Channel-less children (event-emitter, firmware update) span the whole
+	* device by design and accept every channel.
+	*/
+	ownsEventChannel(event) {
+		const owned = this.channel;
+		if (owned === void 0) return true;
+		const channel = event.channel;
+		if (typeof channel === "string" && channel.length > 0) return channel === owned;
+		this.ctx.logger.warn("Homematic value event without a channel — dropped", {
+			tags: { deviceId: this.ctx.id },
+			meta: {
+				address: this.address,
+				ownedChannel: owned,
+				parameter: event.parameter
+			}
+		});
+		return false;
+	}
+	/**
 	* Replay this child's CURRENT cached datapoint values through the registered
 	* value handler. Reads the live `HmDevice` snapshot (the library backfills the
 	* seeded values onto its datapoints) and feeds each non-null value on THIS