@camstack/system 1.2.62 → 1.2.64

package/dist/{dist-DnKpFaP1.mjs → dist-CMb7aKS0.mjs}

@@ -5967,12 +5967,34 @@ var streamBrokerCapability = {
 			kinds: z.array(EventMediaKindSchema).min(1).default(["mp4"]),
 			/** GIF geometry. The video keeps the source's own. */
 			gifMaxWidth: z.number().int().min(120).max(1280).default(640),
-			gifFps: z.number().int().min(1).max(15).default(8),
 			/**
-			* Playback rate, applied to EVERY container so they stay one clip.
-			* `1` is real time and is what allows the copy branch.
+			* The gif's own PLAYBACK rate in frames per second — what the finished
+			* gif runs at, not how many source frames feed it. The decimation that
+			* feeds it samples `gifFps / gifSpeed` source frames per second, so at
+			* the defaults a 12 fps gif is built out of 3 source frames a second.
 			*/
-			speed: z.number().min(1).max(8).default(1)
+			gifFps: z.number().int().min(1).max(15).default(12),
+			/**
+			* How fast the GIF plays against real time, independent of `speed`.
+			*
+			* 4× by default, by operator request: a notification gif is glanced at
+			* on a lock screen, so a ~12 s window has to be over in ~3 s. It stays
+			* a separate knob from `speed` even though both now default to 4 —
+			* a caller wanting a real-time video and a fast gif must not have to
+			* choose.
+			*/
+			gifSpeed: z.number().min(1).max(8).default(4),
+			/**
+			* Playback rate of the VIDEO. Also 4× by default, by operator decision.
+			*
+			* `1` is real time and is the ONLY value that allows the copy branch —
+			* anything else forces `libx264` over the window. That was priced
+			* before it was chosen: a per-event burst measured at 0.23 s and 254 KB
+			* on a real 615 720p cut, against 922 KB for the copy it replaces. A
+			* re-encode is capped at 720p (`EVENT_CLIP_ENCODE_MAX_WIDTH`), because
+			* once the decode is forced the width stops being free.
+			*/
+			speed: z.number().min(1).max(8).default(4)
 		}), EventMediaProductionSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -6565,6 +6587,28 @@ function kebabToCamel(s) {
 * instead of taking the hub with it (D6). Every method here is admin-only, and
 * must stay so.
 */
+/**
+* Prefix for a block's generated addon id AND its runner id — one addon, one
+* process, so the two are the same string (D2).
+*
+* It lives on the CONTRACT rather than beside the code that materialises the
+* package, because it is not an implementation detail: the operator surface
+* reads a block's logs by asking `logs.query` for `addonId = core-block-<id>`,
+* with no cap and no store of its own. Two copies of this string is one copy
+* too many — a drift would show as a logs pane that is simply always empty.
+*/
+var CORE_BLOCK_ADDON_PREFIX = "core-block-";
+/** The addon/runner id a block's process runs under. */
+function coreBlockAddonId(blockId) {
+	return `${CORE_BLOCK_ADDON_PREFIX}${blockId}`;
+}
+/** The block id behind a generated addon/runner id, or null when the id belongs
+*  to something else. The inverse of {@link coreBlockAddonId}. */
+function coreBlockIdFromAddonId(addonId) {
+	if (!addonId.startsWith("core-block-")) return null;
+	const rest = addonId.slice(11);
+	return rest.length > 0 ? rest : null;
+}
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = z.union([z.literal("hub"), z.string().min(1)]);
@@ -6653,6 +6697,23 @@ var coreBlocksCapability = {
 			auth: "admin"
 		}),
 		/**
+		* Stop this block's runner and let the supervisor bring it back.
+		*
+		* **It stores nothing.** There is no "restart requested" flag and no second
+		* lifecycle field: the supervisor already stops and respawns a runner when
+		* the code hash changes, and this exposes that same path deliberately
+		* (D62 — a switch writes the authority that already owned the function).
+		* The next reconcile pass remains the authority, so a restart that lost a
+		* race is corrected within one pass rather than leaving a stale flag behind.
+		*
+		* Refused for a DISABLED block: nothing would come back, and a button that
+		* silently does nothing is worse than one that says why.
+		*/
+		restart: method(z.object({ blockId: z.string() }), z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Type-check without saving — what the editor calls as the author types, so
 		* the compiler's verdict is the same one the server will reach.
 		*/
@@ -7693,909 +7754,173 @@ var deviceExportCapability = {
 		unexposeDevice: method(UnexposeInputSchema, z.void(), { kind: "mutation" })
 	}
 };
+var ProviderStatusSchema = z.object({
+	connected: z.boolean(),
+	deviceCount: z.number(),
+	error: z.string().optional()
+});
+z.object({
+	externalId: z.string(),
+	name: z.string(),
+	type: z.string(),
+	metadata: z.record(z.string(), z.unknown()).optional()
+});
 /**
-* Resource-bound constants for the safe expression engine.
-*
-* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
-* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
-* O(nodeCount) by construction. These caps merely put a hard ceiling on the
-* work a single author-supplied expression can request, so a hostile or
-* accidental pathological string can never spend unbounded CPU/memory.
+* Candidate handed back from discovery and accepted by
+* `adoptDiscoveredDevice`. Shape mirrors the in-process
+* `DiscoveredDevice` interface used by `DeviceDiscovery`.
 */
-/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
-*  rejected without allocation. */
-var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
-/** A legal binding / identifier name. */
-var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Binding names an author may NOT use: `now` is auto-injected; the literal
-*  keywords lex as values, not identifiers, so binding to them is meaningless. */
-var RESERVED_BINDING_NAMES = new Set([
-	"now",
-	"true",
-	"false",
-	"null"
-]);
+var DiscoveryCandidateSchema = z.object({
+	stableId: z.string(),
+	type: z.enum(DeviceType),
+	suggestedName: z.string(),
+	prefilledConfig: z.record(z.string(), z.unknown()),
+	/**
+	* Optional upstream-system identity (HA entity_id, vendor MAC, …).
+	* Discovery pre-populates this for systems that know the upstream
+	* identity ahead of adoption. Rendering metadata (unit, precision)
+	* flows live through the cap STATUS SLICE after adoption.
+	*/
+	sourceInfo: SourceInfoSchema.optional()
+});
 /**
-* Error types for the safe expression engine. Two distinct classes so callers
-* can tell a compile-time (grammar) failure from a runtime (evaluation)
-* failure — both are non-fatal to the host: read paths degrade to "skip link".
+* Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
+* Mirrors `toDeviceShape()` output in `device-management.router.ts` so the
+* tRPC layer can pass it through without reshaping.
 */
-/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
-*  the failure is anchored to a character (author-facing inline feedback). */
-var ExpressionParseError = class extends Error {
-	position;
-	constructor(message, position) {
-		super(message);
-		this.name = "ExpressionParseError";
-		this.position = position;
-	}
-};
-/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
-*  result, unknown builtin, step-budget exceeded). */
-var ExpressionEvalError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ExpressionEvalError";
+var DeviceSummarySchema = z.object({
+	id: z.number(),
+	stableId: z.string(),
+	addonId: z.string(),
+	type: z.string(),
+	name: z.string(),
+	parentDeviceId: z.number().nullable(),
+	online: z.boolean(),
+	features: z.array(z.string()),
+	config: z.record(z.string(), z.unknown()),
+	/** Optional upstream-system identity (dispatch key + system tag).
+	*  See `SourceInfo`. Present when the device has a non-synthetic
+	*  source identifier (HA entities, vendor MAC, …); omitted when the
+	*  synthetic backfill is in effect. */
+	sourceInfo: SourceInfoSchema.optional()
+});
+/**
+* Result of a live field test (e.g. probing an RTSP URL during device
+* creation). Matches the UI-side `FieldProbeResult` in
+* `interfaces/config-ui.ts` — the admin `FormBuilder` renders the
+* returned `labels` as chips next to the input.
+*/
+var FieldProbeResultSchema = z.object({
+	status: z.enum(["ok", "error"]),
+	labels: z.array(z.string()).optional(),
+	error: z.string().optional()
+});
+/**
+* The output of `getChildCreationSchema` is a UI schema tree. We store
+* it as `unknown` at the capability layer — the router just passes it
+* through and the admin UI renders it via `FormBuilder`. The actual
+* type is `ConfigUISchema` (see `packages/types/src/interfaces/config-ui.ts`),
+* but we deliberately avoid a Zod mirror because the union is large and
+* not meant for runtime validation at this seam.
+*/
+var CreationSchemaOutputSchema = z.unknown();
+var deviceProviderCapability = {
+	name: "device-provider",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		start: method(z.void(), z.void(), { kind: "mutation" }),
+		stop: method(z.void(), z.void(), { kind: "mutation" }),
+		getStatus: method(z.void(), ProviderStatusSchema),
+		getDevices: method(z.void(), z.array(z.object({
+			id: z.string(),
+			name: z.string(),
+			type: z.string()
+		}))),
+		supportsDiscovery: method(z.object({}), z.boolean()),
+		/**
+		* Run a network scan. `params` carries optional provider-specific scan
+		* inputs (e.g. a broadcast address / subnet for cross-subnet discovery),
+		* shaped by `getDiscoveryParamsSchema`. Omitted for the generic scan
+		* (provider uses its local-network default).
+		*/
+		discoverDevices: method(z.object({ params: z.record(z.string(), z.unknown()).optional() }), z.array(DiscoveryCandidateSchema), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Optional form schema (`ConfigUISchema`) for the EXTRA per-scan inputs a
+		* provider accepts (e.g. Gree's broadcast address for a different subnet).
+		* `null` when the provider takes no extra scan params — the generic
+		* aggregated scan never renders this; the per-integration scan does.
+		*/
+		getDiscoveryParamsSchema: method(z.object({}), CreationSchemaOutputSchema),
+		/**
+		* The DeviceType this provider creates via manual add (Camera for
+		* Reolink/ONVIF, Container for Gree, Hub for Ecowitt). `null` when the
+		* provider does not support manual creation. Lets the Add-Device dialog
+		* pick the right type instead of assuming Camera.
+		*/
+		getManualCreationType: method(z.object({}), z.object({ deviceType: z.enum(DeviceType).nullable() })),
+		adoptDiscoveredDevice: method(z.object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		supportsManualCreation: method(z.object({}), z.boolean()),
+		/**
+		* Fetch the creation form schema for a given DeviceType. Returns
+		* `null` when the provider does not support manually creating
+		* devices of that type. The output is a `ConfigUISchema` — the
+		* router type-asserts it at the boundary.
+		*/
+		getChildCreationSchema: method(z.object({ type: z.enum(DeviceType) }), CreationSchemaOutputSchema),
+		createDevice: method(z.object({
+			type: z.enum(DeviceType),
+			config: z.record(z.string(), z.unknown())
+		}), DeviceSummarySchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Test a single field in the creation form before the device has
+		* been persisted. Typical use: probing an RTSP URL entered by the
+		* user. Providers that don't support field probing return
+		* `{ success: true, message: 'Field test not supported' }`.
+		*
+		* `formValues` is the live snapshot of every field in the form at
+		* the moment the user clicked Test — useful for probes that depend
+		* on multiple fields together (e.g. Reolink autodetect needs host
+		* + credentials + UID + transport mode in a single call). Optional
+		* for backwards compatibility; providers free to ignore it.
+		*/
+		testCreationField: method(z.object({
+			type: z.enum(DeviceType),
+			key: z.string(),
+			value: z.unknown(),
+			formValues: z.record(z.string(), z.unknown()).optional()
+		}), FieldProbeResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 /**
-* Frozen, null-prototype builtin function table for the expression engine
-* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
-* parser rejects any callee not in it, and the evaluator gates each call on an
-* own-property check against it.
+* Device Manager capability — hub-side singleton that unifies device persistence,
+* live registry access, and all management operations into a single tRPC surface.
 *
-* Because the object has a NULL prototype AND is `Object.freeze`d:
-*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
-*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
-*    (there is no `Object.prototype` in the chain), so those names are not
-*    callable — they are simply "unknown function" at parse time.
+* Replaces:
+*   - `device-persistence` capability (persistence methods absorbed here)
+*   - `device-management.router.ts` (deleted in Phase 2)
+*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
 *
-* Every numeric argument is validated as a finite number and every numeric
-* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
-* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
-* closed rather than emitting a garbage value.
-*/
-function asFiniteNumber(value, name, index) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
-	return value;
-}
-function asString$1(value, name, index) {
-	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
-	return value;
-}
-function finiteResult(value, name) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
-	return value;
-}
-function allFiniteNumbers(args, name) {
-	return args.map((a, idx) => asFiniteNumber(a, name, idx));
-}
-var INF = Number.POSITIVE_INFINITY;
-var table = {
-	min: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
-	},
-	max: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
-	},
-	abs: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
-	},
-	floor: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
-	},
-	ceil: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
-	},
-	sqrt: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
-	},
-	round: {
-		minArgs: 1,
-		maxArgs: 2,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "round", 0);
-			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
-			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
-			const factor = 10 ** digits;
-			return finiteResult(Math.round(x * factor) / factor, "round");
-		}
-	},
-	pow: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
-	},
-	clamp: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "clamp", 0);
-			const lo = asFiniteNumber(args[1], "clamp", 1);
-			const hi = asFiniteNumber(args[2], "clamp", 2);
-			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
-			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
-		}
-	},
-	avg: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const nums = allFiniteNumbers(args, "avg");
-			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
-		}
-	},
-	sum: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
-	},
-	coalesce: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			for (const a of args) if (a !== null) return a;
-			return null;
-		}
-	},
-	age: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
-	},
-	convert: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args, hooks) => {
-			const x = asFiniteNumber(args[0], "convert", 0);
-			const from = asString$1(args[1], "convert", 1).trim();
-			const to = asString$1(args[2], "convert", 2).trim();
-			if (hooks.convert) {
-				const out = hooks.convert(x, from, to);
-				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
-				return finiteResult(out, "convert");
-			}
-			if (from === to) return x;
-			throw new ExpressionEvalError("convert: unit conversion table not installed");
-		}
-	}
-};
-/** Frozen, null-prototype builtin table. */
-var EXPRESSION_BUILTINS = Object.freeze(Object.assign(Object.create(null), table));
-/** The set of valid builtin names — used by the parser to reject unknown
-*  callees at parse time (immediate author feedback). */
-var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
-/**
-* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
-* zero-dependency. The grammar is deliberately boring: decimal numbers,
-* single/double-quoted strings with a tiny escape set, identifiers, the three
-* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
-* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
-* is a parse error with a source position, so member access / assignment /
-* template literals are lexically impossible.
-*/
-var KEYWORDS = new Set([
-	"true",
-	"false",
-	"null"
-]);
-function isDigit(ch) {
-	return ch >= "0" && ch <= "9";
-}
-function isIdentStart(ch) {
-	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
-}
-function isIdentPart(ch) {
-	return isIdentStart(ch) || isDigit(ch);
-}
-function isWhitespace(ch) {
-	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
-}
-/** Tokenize `source` into a flat token list ending with a single `eof` token.
-*  Throws `ExpressionParseError` on any illegal character or unterminated
-*  string. */
-function tokenize(source) {
-	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
-	const tokens = [];
-	let i = 0;
-	const n = source.length;
-	while (i < n) {
-		const ch = source[i];
-		if (isWhitespace(ch)) {
-			i += 1;
-			continue;
-		}
-		if (isDigit(ch)) {
-			const start = i;
-			while (i < n && isDigit(source[i])) i += 1;
-			if (i < n && source[i] === ".") {
-				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
-				i += 1;
-				while (i < n && isDigit(source[i])) i += 1;
-			}
-			const text = source.slice(start, i);
-			const value = Number(text);
-			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
-			tokens.push({
-				type: "number",
-				value,
-				pos: start
-			});
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			const quote = ch;
-			const start = i;
-			i += 1;
-			let out = "";
-			let closed = false;
-			while (i < n) {
-				const c = source[i];
-				if (c === "\\") {
-					const next = i + 1 < n ? source[i + 1] : "";
-					if (next === "\\" || next === "'" || next === "\"") {
-						out += next;
-						i += 2;
-						continue;
-					}
-					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
-				}
-				if (c === quote) {
-					closed = true;
-					i += 1;
-					break;
-				}
-				out += c;
-				i += 1;
-			}
-			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
-			tokens.push({
-				type: "string",
-				value: out,
-				pos: start
-			});
-			continue;
-		}
-		if (isIdentStart(ch)) {
-			const start = i;
-			while (i < n && isIdentPart(source[i])) i += 1;
-			const text = source.slice(start, i);
-			if (KEYWORDS.has(text)) tokens.push({
-				type: "keyword",
-				keyword: keywordOf(text),
-				pos: start
-			});
-			else tokens.push({
-				type: "identifier",
-				name: text,
-				pos: start
-			});
-			continue;
-		}
-		const two = i + 1 < n ? source.slice(i, i + 2) : "";
-		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
-			tokens.push({
-				type: "punct",
-				punct: two,
-				pos: i
-			});
-			i += 2;
-			continue;
-		}
-		if (isSinglePunct(ch)) {
-			tokens.push({
-				type: "punct",
-				punct: ch,
-				pos: i
-			});
-			i += 1;
-			continue;
-		}
-		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
-	}
-	tokens.push({
-		type: "eof",
-		pos: n
-	});
-	return tokens;
-}
-function keywordOf(text) {
-	if (text === "true") return "true";
-	if (text === "false") return "false";
-	return "null";
-}
-function isSinglePunct(ch) {
-	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
-}
-/**
-* Pratt (precedence-climbing) parser for the safe expression mini-language.
-*
-* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
-* → relational → additive → multiplicative → unary `! -` → call / primary.
-* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
-* string validated against the builtin table at parse time, so an unknown
-* function is rejected immediately (author feedback) and a persisted expression
-* that references a since-removed builtin degrades at read.
-*
-* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
-* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
-*/
-/** Binary/logical operator precedence (higher binds tighter). */
-var BINARY_PRECEDENCE = {
-	"||": 1,
-	"&&": 2,
-	"==": 3,
-	"!=": 3,
-	"<": 4,
-	"<=": 4,
-	">": 4,
-	">=": 4,
-	"+": 5,
-	"-": 5,
-	"*": 6,
-	"/": 6,
-	"%": 6
-};
-function isLogicalOp(op) {
-	return op === "&&" || op === "||";
-}
-function isBinaryOp(op) {
-	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
-}
-var Parser = class {
-	tokens;
-	pos = 0;
-	nodeCount = 0;
-	identifiers = /* @__PURE__ */ new Set();
-	callees = /* @__PURE__ */ new Set();
-	constructor(tokens) {
-		this.tokens = tokens;
-	}
-	parse() {
-		const ast = this.parseTernary();
-		const tok = this.peek();
-		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
-		return {
-			ast,
-			identifiers: this.identifiers,
-			callees: this.callees,
-			nodeCount: this.nodeCount
-		};
-	}
-	peek() {
-		return this.tokens[this.pos];
-	}
-	next() {
-		return this.tokens[this.pos++];
-	}
-	/** Consume a punctuator token, erroring if the next token isn't it. */
-	expectPunct(punct) {
-		const tok = this.peek();
-		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
-		this.pos += 1;
-	}
-	matchPunct(punct) {
-		const tok = this.peek();
-		if (tok.type === "punct" && tok.punct === punct) {
-			this.pos += 1;
-			return true;
-		}
-		return false;
-	}
-	countNode() {
-		this.nodeCount += 1;
-		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
-	}
-	parseTernary() {
-		const test = this.parseBinary(1);
-		if (this.matchPunct("?")) {
-			const consequent = this.parseTernary();
-			this.expectPunct(":");
-			const alternate = this.parseTernary();
-			this.countNode();
-			return {
-				kind: "conditional",
-				test,
-				consequent,
-				alternate
-			};
-		}
-		return test;
-	}
-	parseBinary(minPrec) {
-		let left = this.parseUnary();
-		for (;;) {
-			const tok = this.peek();
-			if (tok.type !== "punct") break;
-			const prec = BINARY_PRECEDENCE[tok.punct];
-			if (prec === void 0 || prec < minPrec) break;
-			const op = tok.punct;
-			this.pos += 1;
-			const right = this.parseBinary(prec + 1);
-			this.countNode();
-			if (isLogicalOp(op)) left = {
-				kind: "logical",
-				op,
-				left,
-				right
-			};
-			else if (isBinaryOp(op)) left = {
-				kind: "binary",
-				op,
-				left,
-				right
-			};
-			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
-		}
-		return left;
-	}
-	parseUnary() {
-		const tok = this.peek();
-		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
-			const op = tok.punct;
-			this.pos += 1;
-			const operand = this.parseUnary();
-			this.countNode();
-			return {
-				kind: "unary",
-				op,
-				operand
-			};
-		}
-		return this.parsePrimary();
-	}
-	parsePrimary() {
-		const tok = this.next();
-		switch (tok.type) {
-			case "number":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "string":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "keyword":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.keyword === "null" ? null : tok.keyword === "true"
-				};
-			case "identifier": {
-				const nextTok = this.peek();
-				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
-				this.identifiers.add(tok.name);
-				this.countNode();
-				return {
-					kind: "identifier",
-					name: tok.name
-				};
-			}
-			case "punct":
-				if (tok.punct === "(") {
-					const inner = this.parseTernary();
-					this.expectPunct(")");
-					return inner;
-				}
-				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
-			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
-		}
-	}
-	parseCall(callee, pos) {
-		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
-		this.expectPunct("(");
-		const args = [];
-		if (!this.matchPunct(")")) for (;;) {
-			args.push(this.parseTernary());
-			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
-			if (this.matchPunct(",")) continue;
-			this.expectPunct(")");
-			break;
-		}
-		this.callees.add(callee);
-		this.countNode();
-		return {
-			kind: "call",
-			callee,
-			args
-		};
-	}
-};
-/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
-*  `ExpressionParseError` on any lexical or grammatical failure. */
-function parseExpression(source) {
-	return new Parser(tokenize(source)).parse();
-}
-/**
-* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
-* by expr"). The cache stores BOTH successes and failures (negative caching),
-* so a corrupt persisted string costs exactly one tokenize+parse total — not
-* one per read on a hot resolve path.
-*
-* The cache is a module-level singleton: entries are pure, content-addressed
-* ASTs keyed by the raw source string, so sharing one instance across all
-* callers is safe and maximises hit rate.
-*/
-var cache = /* @__PURE__ */ new Map();
-function getCached(source) {
-	const hit = cache.get(source);
-	if (hit !== void 0) {
-		cache.delete(source);
-		cache.set(source, hit);
-		return hit;
-	}
-	let result;
-	try {
-		result = {
-			ok: true,
-			parsed: parseExpression(source)
-		};
-	} catch (err) {
-		result = {
-			ok: false,
-			error: err instanceof ExpressionParseError ? err.message : String(err)
-		};
-	}
-	cache.set(source, result);
-	if (cache.size > 256) {
-		const oldest = cache.keys().next().value;
-		if (oldest !== void 0) cache.delete(oldest);
-	}
-	return result;
-}
-/** Compile `source`, returning a discriminated result instead of throwing.
-*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
-function compileExpressionSafe(source) {
-	return getCached(source);
-}
-/**
-* Tree-walking evaluator for the safe expression mini-language.
-*
-* SECURITY (spec §4 rule 2/5):
-*  - The scope is an `Object.create(null)` copy of ONLY the caller's own
-*    enumerable binding entries, so `name in scope` is a pure own-key check and
-*    `constructor` / `__proto__` / `toString` are plain unknown identifiers.
-*  - Performs ZERO I/O and never touches `globalThis` / `Date` / `Math`
-*    directly — the only external calls are into the frozen builtin table.
-*  - The grammar has no loops/recursion/lambdas, so a walk is O(nodeCount) by
-*    construction; the step counter is defense-in-depth for a crafted max-size
-*    AST. Nothing blocks: there are no timers, awaits or unbounded loops.
-*/
-var EMPTY_HOOKS = Object.freeze({});
-/** Build a null-prototype scope from own-enumerable binding entries. Inherited
-*  keys of the input (e.g. from a `{__proto__: {...}}` payload) are NOT copied,
-*  so nothing smuggles in via the prototype chain. */
-function createExpressionScope(bindings) {
-	const scope = Object.create(null);
-	for (const key of Object.keys(bindings)) if (Object.prototype.hasOwnProperty.call(bindings, key)) scope[key] = bindings[key];
-	return scope;
-}
-function isFiniteNumber(value) {
-	return typeof value === "number" && Number.isFinite(value);
-}
-/** JS truthiness of a primitive value. */
-function truthy(value) {
-	return Boolean(value);
-}
-function requireFinite(value, context) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${context} produced a non-finite result`);
-	return value;
-}
-function step(ctx) {
-	ctx.steps += 1;
-	if (ctx.steps > ctx.maxSteps) throw new ExpressionEvalError("expression evaluation step budget exceeded");
-}
-function evalNode(node, ctx) {
-	step(ctx);
-	switch (node.kind) {
-		case "literal": return node.value;
-		case "identifier":
-			if (!(node.name in ctx.scope)) throw new ExpressionEvalError(`unknown identifier: ${node.name}`);
-			return ctx.scope[node.name];
-		case "unary": return evalUnary(node.op, evalNode(node.operand, ctx));
-		case "binary": return evalBinary(node.op, evalNode(node.left, ctx), evalNode(node.right, ctx));
-		case "logical": {
-			const left = evalNode(node.left, ctx);
-			if (node.op === "&&") return truthy(left) ? evalNode(node.right, ctx) : left;
-			return truthy(left) ? left : evalNode(node.right, ctx);
-		}
-		case "conditional": return truthy(evalNode(node.test, ctx)) ? evalNode(node.consequent, ctx) : evalNode(node.alternate, ctx);
-		case "call": return evalCall(node.callee, node.args.map((a) => evalNode(a, ctx)), ctx.hooks);
-	}
-}
-function evalUnary(op, operand) {
-	if (op === "!") return !truthy(operand);
-	if (!isFiniteNumber(operand)) throw new ExpressionEvalError("unary \"-\" requires a finite number");
-	return requireFinite(-operand, "unary \"-\"");
-}
-function evalBinary(op, left, right) {
-	switch (op) {
-		case "==": return left === right;
-		case "!=": return left !== right;
-		case "+":
-			if (typeof left === "string" && typeof right === "string") return left + right;
-			if (isFiniteNumber(left) && isFiniteNumber(right)) return requireFinite(left + right, "\"+\"");
-			throw new ExpressionEvalError("\"+\" requires two numbers or two strings");
-		case "-":
-		case "*":
-		case "/":
-		case "%":
-			if (!isFiniteNumber(left) || !isFiniteNumber(right)) throw new ExpressionEvalError(`"${op}" requires two finite numbers`);
-			return requireFinite(op === "-" ? left - right : op === "*" ? left * right : op === "/" ? left / right : left % right, `"${op}"`);
-		case "<":
-		case "<=":
-		case ">":
-		case ">=":
-			if (isFiniteNumber(left) && isFiniteNumber(right)) return op === "<" ? left < right : op === "<=" ? left <= right : op === ">" ? left > right : left >= right;
-			if (typeof left === "string" && typeof right === "string") return op === "<" ? left < right : op === "<=" ? left <= right : op === ">" ? left > right : left >= right;
-			throw new ExpressionEvalError(`"${op}" requires two numbers or two strings`);
-	}
-}
-function evalCall(callee, args, hooks) {
-	if (!Object.prototype.hasOwnProperty.call(EXPRESSION_BUILTINS, callee)) throw new ExpressionEvalError(`unknown function: ${callee}`);
-	const builtin = EXPRESSION_BUILTINS[callee];
-	if (args.length < builtin.minArgs || args.length > builtin.maxArgs) throw new ExpressionEvalError(`${callee}: wrong number of arguments (${args.length})`);
-	return builtin.apply(args, hooks);
-}
-/** Evaluate an AST node against a scope. Throws `ExpressionEvalError` on any
-*  runtime failure (unknown identifier, type mismatch, non-finite result,
-*  step-budget exhaustion). */
-function evaluateAst(node, scope, opts) {
-	return evalNode(node, {
-		scope,
-		hooks: opts?.hooks ?? EMPTY_HOOKS,
-		maxSteps: opts?.maxSteps ?? 4096,
-		steps: 0
-	});
-}
-/**
-* Coerce an untrusted `getByPath` / mirror read to an `ExpressionValue`.
-* Non-primitive values (objects, arrays, `undefined`, functions, bigint,
-* symbol) and non-finite numbers become `undefined` so the caller can apply
-* its binding-miss policy (→ `null`). `null` itself is a valid value.
-*/
-function toExpressionValue(raw) {
-	if (raw === null) return null;
-	if (typeof raw === "string") return raw;
-	if (typeof raw === "boolean") return raw;
-	if (typeof raw === "number") return Number.isFinite(raw) ? raw : void 0;
-}
-/**
-* Author-time validation. Returns `null` when the source is valid, else a
-* human-readable error message. Checks: the expression compiles; binding count
-* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
-* is not reserved (`now`/keywords) and does not shadow a builtin; and every
-* FREE identifier of the AST is covered by a binding or the injected `now`.
-*/
-function validateExpressionSource(src) {
-	const names = Object.keys(src.bindings);
-	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
-	for (const name of names) {
-		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
-		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
-		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
-	}
-	const compiled = compileExpressionSafe(src.expr);
-	if (!compiled.ok) return compiled.error;
-	const bound = new Set(names);
-	for (const id of compiled.parsed.identifiers) {
-		if (id === "now") continue;
-		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
-	}
-	return null;
-}
-/**
-* Shared read-path evaluation for BOTH resolver channels. Builds a null-proto
-* scope from `bindingValues` plus the injected `now` (supplied by the caller
-* for determinism/testability), compiles via the LRU, and evaluates. Any
-* failure (parse or eval) returns `{ ok: false }` — the caller treats that as
-* "skip this link".
-*/
-function evaluateLinkExpression(expr, bindingValues, now, opts) {
-	const compiled = compileExpressionSafe(expr);
-	if (!compiled.ok) return {
-		ok: false,
-		error: compiled.error
-	};
-	const scope = createExpressionScope({
-		...bindingValues,
-		["now"]: now
-	});
-	try {
-		return {
-			ok: true,
-			value: evaluateAst(compiled.parsed.ast, scope, opts)
-		};
-	} catch (err) {
-		return {
-			ok: false,
-			error: err instanceof ExpressionEvalError ? err.message : String(err)
-		};
-	}
-}
-var ProviderStatusSchema = z.object({
-	connected: z.boolean(),
-	deviceCount: z.number(),
-	error: z.string().optional()
-});
-z.object({
-	externalId: z.string(),
-	name: z.string(),
-	type: z.string(),
-	metadata: z.record(z.string(), z.unknown()).optional()
-});
-/**
-* Candidate handed back from discovery and accepted by
-* `adoptDiscoveredDevice`. Shape mirrors the in-process
-* `DiscoveredDevice` interface used by `DeviceDiscovery`.
-*/
-var DiscoveryCandidateSchema = z.object({
-	stableId: z.string(),
-	type: z.enum(DeviceType),
-	suggestedName: z.string(),
-	prefilledConfig: z.record(z.string(), z.unknown()),
-	/**
-	* Optional upstream-system identity (HA entity_id, vendor MAC, …).
-	* Discovery pre-populates this for systems that know the upstream
-	* identity ahead of adoption. Rendering metadata (unit, precision)
-	* flows live through the cap STATUS SLICE after adoption.
-	*/
-	sourceInfo: SourceInfoSchema.optional()
-});
-/**
-* Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
-* Mirrors `toDeviceShape()` output in `device-management.router.ts` so the
-* tRPC layer can pass it through without reshaping.
-*/
-var DeviceSummarySchema = z.object({
-	id: z.number(),
-	stableId: z.string(),
-	addonId: z.string(),
-	type: z.string(),
-	name: z.string(),
-	parentDeviceId: z.number().nullable(),
-	online: z.boolean(),
-	features: z.array(z.string()),
-	config: z.record(z.string(), z.unknown()),
-	/** Optional upstream-system identity (dispatch key + system tag).
-	*  See `SourceInfo`. Present when the device has a non-synthetic
-	*  source identifier (HA entities, vendor MAC, …); omitted when the
-	*  synthetic backfill is in effect. */
-	sourceInfo: SourceInfoSchema.optional()
-});
-/**
-* Result of a live field test (e.g. probing an RTSP URL during device
-* creation). Matches the UI-side `FieldProbeResult` in
-* `interfaces/config-ui.ts` — the admin `FormBuilder` renders the
-* returned `labels` as chips next to the input.
-*/
-var FieldProbeResultSchema = z.object({
-	status: z.enum(["ok", "error"]),
-	labels: z.array(z.string()).optional(),
-	error: z.string().optional()
-});
-/**
-* The output of `getChildCreationSchema` is a UI schema tree. We store
-* it as `unknown` at the capability layer — the router just passes it
-* through and the admin UI renders it via `FormBuilder`. The actual
-* type is `ConfigUISchema` (see `packages/types/src/interfaces/config-ui.ts`),
-* but we deliberately avoid a Zod mirror because the union is large and
-* not meant for runtime validation at this seam.
-*/
-var CreationSchemaOutputSchema = z.unknown();
-var deviceProviderCapability = {
-	name: "device-provider",
-	scope: "system",
-	mode: "collection",
-	methods: {
-		start: method(z.void(), z.void(), { kind: "mutation" }),
-		stop: method(z.void(), z.void(), { kind: "mutation" }),
-		getStatus: method(z.void(), ProviderStatusSchema),
-		getDevices: method(z.void(), z.array(z.object({
-			id: z.string(),
-			name: z.string(),
-			type: z.string()
-		}))),
-		supportsDiscovery: method(z.object({}), z.boolean()),
-		/**
-		* Run a network scan. `params` carries optional provider-specific scan
-		* inputs (e.g. a broadcast address / subnet for cross-subnet discovery),
-		* shaped by `getDiscoveryParamsSchema`. Omitted for the generic scan
-		* (provider uses its local-network default).
-		*/
-		discoverDevices: method(z.object({ params: z.record(z.string(), z.unknown()).optional() }), z.array(DiscoveryCandidateSchema), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Optional form schema (`ConfigUISchema`) for the EXTRA per-scan inputs a
-		* provider accepts (e.g. Gree's broadcast address for a different subnet).
-		* `null` when the provider takes no extra scan params — the generic
-		* aggregated scan never renders this; the per-integration scan does.
-		*/
-		getDiscoveryParamsSchema: method(z.object({}), CreationSchemaOutputSchema),
-		/**
-		* The DeviceType this provider creates via manual add (Camera for
-		* Reolink/ONVIF, Container for Gree, Hub for Ecowitt). `null` when the
-		* provider does not support manual creation. Lets the Add-Device dialog
-		* pick the right type instead of assuming Camera.
-		*/
-		getManualCreationType: method(z.object({}), z.object({ deviceType: z.enum(DeviceType).nullable() })),
-		adoptDiscoveredDevice: method(z.object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		supportsManualCreation: method(z.object({}), z.boolean()),
-		/**
-		* Fetch the creation form schema for a given DeviceType. Returns
-		* `null` when the provider does not support manually creating
-		* devices of that type. The output is a `ConfigUISchema` — the
-		* router type-asserts it at the boundary.
-		*/
-		getChildCreationSchema: method(z.object({ type: z.enum(DeviceType) }), CreationSchemaOutputSchema),
-		createDevice: method(z.object({
-			type: z.enum(DeviceType),
-			config: z.record(z.string(), z.unknown())
-		}), DeviceSummarySchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Test a single field in the creation form before the device has
-		* been persisted. Typical use: probing an RTSP URL entered by the
-		* user. Providers that don't support field probing return
-		* `{ success: true, message: 'Field test not supported' }`.
-		*
-		* `formValues` is the live snapshot of every field in the form at
-		* the moment the user clicked Test — useful for probes that depend
-		* on multiple fields together (e.g. Reolink autodetect needs host
-		* + credentials + UID + transport mode in a single call). Optional
-		* for backwards compatibility; providers free to ignore it.
-		*/
-		testCreationField: method(z.object({
-			type: z.enum(DeviceType),
-			key: z.string(),
-			value: z.unknown(),
-			formValues: z.record(z.string(), z.unknown()).optional()
-		}), FieldProbeResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		})
-	}
-};
-/**
-* Device Manager capability — hub-side singleton that unifies device persistence,
-* live registry access, and all management operations into a single tRPC surface.
-*
-* Replaces:
-*   - `device-persistence` capability (persistence methods absorbed here)
-*   - `device-management.router.ts` (deleted in Phase 2)
-*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
-*
-* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
-* fork into separate processes but never run on remote cluster agents. Therefore:
-*   - No nodeId routing needed — this is a pure hub singleton.
-*   - The hub's DeviceRegistry is the single source of truth for all live devices.
-*   - No shadow registry or cross-node aggregation required.
-*
-* Forked workers register devices back to the hub via `ctx.devices`
-* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
+* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
+* fork into separate processes but never run on remote cluster agents. Therefore:
+*   - No nodeId routing needed — this is a pure hub singleton.
+*   - The hub's DeviceRegistry is the single source of truth for all live devices.
+*   - No shadow registry or cross-node aggregation required.
+*
+* Forked workers register devices back to the hub via `ctx.devices`
+* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
 */
 /** One child-placement directive on a container's `childLayout`. Structurally
 *  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
@@ -8608,92 +7933,6 @@ var ChildLayoutEntrySchema = z.object({
 	order: z.number().optional(),
 	collapsed: z.boolean().optional()
 });
-/** Cap-wire shape of a DeviceLink — structurally mirrors `DeviceLink` in
-*  `device-management.ts`. Source is a union: a FIELD source copies a sibling
-*  accessory's status field (`kind` optional/absent for wire compat); a
-*  LITERAL source carries a per-device constant (no sibling is read); a
-*  GLOBAL source (P2e) copies ANY device's status field, addressed by the
-*  source device's full re-sync-stable `stableId`. */
-var DeviceLinkFieldSourceSchema = z.object({
-	kind: z.literal("field").optional(),
-	sourceKey: z.string(),
-	cap: z.string(),
-	fieldPath: z.string()
-});
-var DeviceLinkLiteralSourceSchema = z.object({
-	kind: z.literal("literal"),
-	value: z.union([
-		z.string(),
-		z.number(),
-		z.boolean(),
-		z.null()
-	])
-});
-var DeviceLinkGlobalSourceSchema = z.object({
-	kind: z.literal("global"),
-	sourceStableId: z.string(),
-	cap: z.string(),
-	fieldPath: z.string()
-});
-/** Expression source (Stage X): compute the target field from N named bindings
-*  via the safe expression engine. Bindings are field | literal | global — never
-*  another expression (no nesting). The `superRefine` runs the SAME author-time
-*  validation as `validateExpressionSource` (compiles the expr, checks binding
-*  names + identifier coverage) so every wire boundary that parses a DeviceLink
-*  (tRPC mount, kernel create pre-seed, projection output) validates-at-write.
-*  Compiles are LRU-cached, so repeated validation of the same expr is a hit. */
-var DeviceLinkExpressionSourceSchema = z.object({
-	kind: z.literal("expression"),
-	expr: z.string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: z.record(z.string().regex(EXPRESSION_IDENTIFIER_RE), z.union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema
-	]))
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
-});
-var DeviceLinkSchema = z.object({
-	id: z.string(),
-	source: z.union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema,
-		DeviceLinkExpressionSourceSchema
-	]),
-	target: z.object({
-		cap: z.string(),
-		fieldPath: z.string(),
-		itemKey: z.string().optional()
-	}),
-	transform: z.discriminatedUnion("kind", [
-		z.object({ kind: z.literal("identity") }),
-		z.object({
-			kind: z.literal("enum-map"),
-			mapping: z.record(z.string(), z.union([
-				z.string(),
-				z.number(),
-				z.boolean()
-			])),
-			fallback: z.union([
-				z.string(),
-				z.number(),
-				z.boolean()
-			]).optional()
-		}),
-		z.object({
-			kind: z.literal("linear"),
-			scale: z.number(),
-			offset: z.number(),
-			clamp: z.tuple([z.number(), z.number()]).readonly().optional()
-		})
-	]).optional()
-});
 /** Cap-wire shape of a per-cap display refinement — mirrors
 *  `DeviceCapDisplayOverride` in `device-management.ts`. */
 var DeviceCapDisplayOverrideSchema = z.object({
@@ -8773,8 +8012,6 @@ var DeviceInfoSchema = z.object({
 	*  named accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: z.array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: z.array(DeviceLinkSchema).readonly().optional(),
 	/** Operator-authored per-device display override. See `DeviceMeta.display`. */
 	display: DeviceDisplayOverrideSchema.optional()
 });
@@ -8783,7 +8020,7 @@ var ConfigEntrySchema = z.object({
 	value: z.unknown(),
 	description: z.string().optional()
 });
-var DeviceLinkModeSchema = z.enum(["auto", "manual"]);
+var LinkedDevicesModeSchema = z.enum(["auto", "manual"]);
 /** One resolved linked device — the compact projection consumers need. */
 var LinkedDeviceSchema = z.object({
 	deviceId: z.number(),
@@ -8846,8 +8083,6 @@ var DeviceMetaSchema = z.object({
 	*  accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: z.array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: z.array(DeviceLinkSchema).readonly().optional(),
 	/** Semantic role string (`DeviceRole`) — propagated from the spawn pre-seed.
 	*  Optional: only present for accessory children that carry a known role. */
 	role: z.string().nullable().optional(),
@@ -8999,16 +8234,6 @@ var deviceManagerCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Set (or replace) the cross-device field wirings on a device's meta row.
-		*  Mirrors `setChildLayout`; persisted, projected, preserved across
-		*  re-register/restore. Idempotent. */
-		setDeviceLinks: method(z.object({
-			deviceId: z.number(),
-			deviceLinks: z.array(DeviceLinkSchema).readonly()
-		}), z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
 		/** Set (or clear) the per-device display override on the meta row. Mirrors
 		*  `setChildLayout` persistence; `null` clears the override entirely. The
 		*  override unit(s) are normalized (`normalizeUnit`) at write so the render
@@ -9032,15 +8257,15 @@ var deviceManagerCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** List the wireable status-schema fields per cap bound to a device.
-		*  Powers the Wiring tab's field pickers. Caps without a status schema are
-		*  omitted. Item-array caps (`status.itemArray`, e.g. consumables) also
-		*  emit their per-item fields tagged `item: true` (a link targeting one
-		*  must carry a `target.itemKey`) plus the cap-level `itemArray`
-		*  descriptor. `includeSynthesizable: true` (TARGET pickers only) unions
-		*  in unbound device-scoped caps that declare `status.empty` and match
-		*  the device's type — so the FIRST link to a synthesize-only cap
-		*  (consumables on an HA vacuum) can be authored. */
+		/** The per-cap catalog of readable status-schema fields for one device.
+		*  This is the SOURCE PICKER — it outlived the Wiring tab that first
+		*  needed it (deleted 2026-08-08) and becomes the picker of a composition
+		*  recipe: every field the old tab could target, a composed device can
+		*  read. Caps without a status schema are omitted. Item-array caps
+		*  (`status.itemArray`, e.g. consumables) also emit their per-item fields
+		*  tagged `item: true` plus the cap-level `itemArray` descriptor.
+		*  `includeSynthesizable: true` unions in unbound device-scoped caps that
+		*  declare `status.empty` and match the device's type. */
 		getWireableFields: method(z.object({
 			deviceId: z.number(),
 			includeSynthesizable: z.boolean().optional()
@@ -9182,7 +8407,7 @@ var deviceManagerCapability = {
 		* (see the module docblock) — there are no bespoke link mutations.
 		*/
 		getLinkedDevices: method(z.object({ deviceId: z.number() }), z.object({
-			mode: DeviceLinkModeSchema,
+			mode: LinkedDevicesModeSchema,
 			devices: z.array(LinkedDeviceSchema)
 		})),
 		/** Get stream sources for a camera device. */
@@ -9246,11 +8471,7 @@ var deviceManagerCapability = {
 			deviceId: z.number(),
 			entries: z.array(z.object({
 				capName: z.string(),
-				kind: z.enum([
-					"native",
-					"wrapped",
-					"linked"
-				]),
+				kind: z.enum(["native", "wrapped"]),
 				providerAddonId: z.string(),
 				providerNodeId: z.string(),
 				nativeAddonId: z.string()
@@ -9268,11 +8489,7 @@ var deviceManagerCapability = {
 			deviceId: z.number(),
 			entries: z.array(z.object({
 				capName: z.string(),
-				kind: z.enum([
-					"native",
-					"wrapped",
-					"linked"
-				]),
+				kind: z.enum(["native", "wrapped"]),
 				providerAddonId: z.string(),
 				providerNodeId: z.string(),
 				nativeAddonId: z.string()
@@ -10480,6 +9697,10 @@ var motionDetectionCapability = {
 	mode: "singleton",
 	kind: "wrapper",
 	defaultActive: true,
+	/** Frame-differencing motion analysis over a video stream — only a camera
+	*  produces the frames. Read by the `defaultActive` auto-bind in
+	*  `device-manager.getBindings` to decide which devices it may claim. */
+	deviceTypes: [DeviceType.Camera],
 	exposesDeviceSettings: true,
 	methods: {
 		analyze: method(z.object({
@@ -12873,6 +12094,18 @@ var OauthIntegrationDescriptorSchema = z.object({
 	*  redirect_uri that does not start with one of these. Required —
 	*  an empty list means the integration can never complete linking. */
 	allowedRedirectPrefixes: z.array(z.string()).min(1),
+	/** Paths accepted as a `redirect_uri` when the host is PRIVATE — loopback,
+	*  RFC1918, CGNAT (100.64/10, Tailscale), link-local, IPv6 ULA, or an
+	*  `.local` / `.internal` / `.ts.net` name. Exists for self-hosted clients
+	*  whose address the hub cannot know in advance (a Home Assistant at
+	*  `http://<lan-ip>:8123/auth/external/callback`). The PATH must match
+	*  exactly; a public host never satisfies this branch, so it is not a
+	*  wildcard prefix by another name. */
+	allowedPrivateHostPaths: z.array(z.string()).optional(),
+	/** When true this is a PUBLIC client (source is published, no secret can be
+	*  protected) and PKCE is mandatory: `/authorize` refuses without an S256
+	*  `code_challenge`, `/token` refuses without the matching `code_verifier`. */
+	requiresPkce: z.boolean().optional(),
 	/** Optional public origin (no trailing slash) that this integration's
 	*  issued codes/tokens should carry as the `hubUrl` claim — typically the
 	*  operator-selected external-access endpoint resolved by the addon. When
@@ -13029,7 +12262,7 @@ var TrackEnvelopeSchema = z.object({
 * `snapshots[]` references — megabytes across a page of tracks. `slim`
 * keeps every scalar the list surfaces actually render (ids, class(es),
 * label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
-* zonesVisited, bestEventId, envelope) and returns `positions` /
+* zonesVisited, bestEventId, envelope, hasFace) and returns `positions` /
 * `snapshots` as EMPTY arrays — detail views re-fetch the full row via
 * `getTrack`. Mirrors the event-store `projection` convention
 * (`getObjectEvents` et al.).
@@ -13266,6 +12499,24 @@ var TrackSchema = z.object({
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
 	envelope: TrackEnvelopeSchema.optional(),
+	/**
+	* A face DETECTOR found a face on this track — nothing more. It says the
+	* detail plane produced a `face` detail; it does NOT say the face was
+	* embedded, matched, above `minFacePx`, or that the recognizer was even
+	* enabled. Set once and never cleared.
+	*
+	* **This exists so "face present but not recognised" is expressible.** A
+	* recognised identity lands in `subLabel` (attributed to the face chain via
+	* `subLabelMeta.stepId`), so before this field a track with an unmatched face
+	* and a track with no face at all were byte-identical on the wire and no
+	* surface could tell them apart. The read is `hasFace === true && subLabel
+	* === undefined`.
+	*
+	* **Absent ≠ false.** Every row written before the column existed omits it,
+	* and so does every server that predates the field — a consumer must test
+	* `=== true` and render nothing otherwise, never infer "no face".
+	*/
+	hasFace: z.boolean().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -17015,6 +16266,10 @@ var SsoBridgeClaimsSchema = z.object({
 	integrationId: z.string().optional(),
 	/** JWT ID — unique per issued code; consumed-set enforces single-use. */
 	jti: z.string().optional(),
+	/** PKCE S256 challenge — set only on `oauth-code` tokens issued to a public
+	*  client. Its PRESENCE is what makes the verifier mandatory at exchange,
+	*  so the requirement travels with the code and not with mutable config. */
+	codeChallenge: z.string().optional(),
 	/** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
 	*  tokens so the verify path can check the session is not revoked. */
 	sessionId: z.string().optional()
@@ -17771,6 +17026,10 @@ var videoclipsCapability = {
 	mode: "singleton",
 	kind: "wrapper",
 	defaultActive: true,
+	/** A clip is a window over a camera's footage — the cap is meaningless on a
+	*  sensor, a button or an event emitter, and the `defaultActive` auto-bind
+	*  reads this to decide which devices it may claim. */
+	deviceTypes: [DeviceType.Camera],
 	methods: {
 		listClips: method(z.object({
 			deviceId: z.number(),
@@ -20266,7 +19525,29 @@ var FaceInfoSchema = z.object({
 	recognizedIdentityId: z.string().optional(),
 	identityName: z.string().optional(),
 	assigned: z.boolean(),
+	/**
+	* The crop, inline, base64.
+	*
+	* **Prefer {@link cropUrl}.** At the 500 rows the Faces view asks for this
+	* field alone is ~2.87 MiB, re-sent in full on every operator assign and
+	* every 30 s poll, base64-inflated over the msgpack socket and held in the
+	* query heap. It stays for callers that have not migrated; `includeCrops:
+	* false` turns it off once they have.
+	*/
 	base64: z.string().optional(),
+	/**
+	* Same crop, as a data-plane URL for `<img src>` — the move the admin
+	* snapshot surfaces made on 2026-08-08.
+	*
+	* Served by the `event-media` plane, which resolves a raw MediaStore key and
+	* is `access: 'authenticated'`: a bare `<img>` carries the `camstack_session`
+	* cookie, so no header plumbing is needed. The bytes then ride the browser's
+	* HTTP cache with an ETag and `immutable`, instead of the WebSocket.
+	*
+	* Absent when the face has no stored crop, or when the addon has no data
+	* plane — callers fall back to {@link base64}.
+	*/
+	cropUrl: z.string().optional(),
 	/** Design B: the face bbox (pixel space) on the key frame — lets a detail
 	*  view draw the box over the native `keyFrameMediaKey` frame. Absent on
 	*  legacy rows written before design B. */
@@ -20342,7 +19623,23 @@ var faceGalleryCapability = {
 		}),
 		listRecentFaces: method(z.object({
 			limit: z.number().int().positive().optional(),
-			filter: FaceFilterEnum.optional()
+			filter: FaceFilterEnum.optional(),
+			/**
+			* Inline the base64 crop on every row. Default `true` — the existing
+			* behaviour, kept so no caller breaks.
+			*
+			* Set `false` once the caller renders {@link FaceInfo.cropUrl}: that
+			* drops ~2.87 MiB per 500-row page to a few KiB of metadata and lets
+			* the browser cache the images.
+			*
+			* **This is an INPUT field, so it does not reach the addon until the
+			* next train.** The hub router validates cap inputs against its own
+			* compiled Zod, which strips a key it does not know — verified today
+			* on the OUTPUT side, where an additive field DOES arrive immediately
+			* (`Track.hasFace`). Until the train ships, sending `false` is
+			* harmless and simply keeps the crops inline.
+			*/
+			includeCrops: z.boolean().optional()
 		}).optional(), z.array(FaceInfoSchema).readonly()),
 		getFaceByTrack: method(z.object({
 			deviceId: z.number().int(),
@@ -25697,14 +24994,19 @@ var userManagementCapability = {
 			username: z.string(),
 			scopes: z.array(TokenScopeSchema),
 			redirectUri: z.string(),
-			hubUrl: z.string()
+			hubUrl: z.string(),
+			/** PKCE (RFC 7636) S256 challenge. Baked into the signed code; a code
+			*  that carries one can ONLY be exchanged with the matching verifier. */
+			codeChallenge: z.string().optional()
 		}), z.object({ code: z.string() }), {
 			kind: "mutation",
 			access: "create"
 		}),
 		oauthExchangeCode: method(z.object({
 			code: z.string(),
-			redirectUri: z.string()
+			redirectUri: z.string(),
+			/** PKCE verifier. REQUIRED when the code carries a challenge. */
+			codeVerifier: z.string().optional()
 		}), z.object({
 			accessToken: z.string(),
 			refreshToken: z.string(),
@@ -26246,277 +25548,872 @@ var zoneAnalyticsCapability = {
 	runtimeState: CameraOccupancySnapshotSchema
 };
 /**
-* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
-* cap so a single CRUD surface backs every consumer; each stage has
-* its own dev-state mirror slice (`motion-zone-rules`,
-* `detection-zone-rules`, …) so consumer addons subscribe independently.
+* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
+* cap so a single CRUD surface backs every consumer; each stage has
+* its own dev-state mirror slice (`motion-zone-rules`,
+* `detection-zone-rules`, …) so consumer addons subscribe independently.
+*
+* Extend the enum here when a new gating consumer comes online (audio
+* gating, alert filtering, …) — no other surface needs to change.
+*/
+var ZoneRuleStageEnum = z.enum([
+	"motion",
+	"detection",
+	"package"
+]);
+/**
+* Zone rules capability — per-camera CRUD over the {@link ZoneRule}
+* arrays that decide how each pipeline stage uses the polygon zones.
+*
+* Hosted by `addon-pipeline-orchestrator` alongside the zones provider
+* so the operator has a single hub-side source of truth for both
+* geometry and behaviour. Per-stage rules are stored under the
+* `zoneRules.<stage>` key in the orchestrator's per-device store and
+* mirrored to the device-state slice `<stage>-zone-rules` on every
+* mutation; consumer addons (analytics, motion-wasm, pipeline-executor)
+* subscribe to that slice and refresh their gating without
+* round-tripping the cap.
+*
+* Sets are bulk-replace — the operator UI sends the new rule list
+* wholesale, so reordering / batch enable-toggle / drag-drop CRUD lives
+* naturally in the rule editor without per-rule mutation chatter.
+*/
+var zoneRulesCapability = {
+	name: "zone-rules",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		/** Read the full rule list for a given stage (empty when no rules
+		*  are defined yet). */
+		listRules: method(z.object({
+			deviceId: z.number(),
+			stage: ZoneRuleStageEnum
+		}), z.array(ZoneRuleSchema).readonly()),
+		/** Bulk-replace the rule list for one stage. The provider validates
+		*  each entry against {@link ZoneRuleSchema} (zoneIds non-empty,
+		*  thresholds in range) and rejects the whole patch if any entry
+		*  is invalid — partial writes are a configuration footgun. */
+		setRules: method(z.object({
+			deviceId: z.number(),
+			stage: ZoneRuleStageEnum,
+			rules: z.array(ZoneRuleSchema).readonly()
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	/**
+	* Runtime-state slice — every stage mirrored together so consumers
+	* see one reactive handle (`device.state.zoneRules.value`) instead
+	* of one per stage. Bulk-replace mutations on any stage write the full
+	* `{motion, detection, package}` shape, so subscribers always get the
+	* complete current set. Consumers that only care about one stage
+	* just read the matching property.
+	*
+	* `package` backs the package-drop detector — a package zone is a
+	* `ZoneRule` on the `'package'` stage referencing drawn polygons
+	* (see docs/superpowers/specs/2026-07-17-package-zones-design.md §3.1).
+	* The orchestrator provider writes this stage as a first-class slice
+	* (Phase 4): every mutation mirrors the full `{motion, detection,
+	* package}` shape, so consumers read the current package rules directly
+	* off `device.state.zoneRules.value.package`.
+	*/
+	runtimeState: z.object({
+		motion: z.array(ZoneRuleSchema).readonly(),
+		detection: z.array(ZoneRuleSchema).readonly(),
+		package: z.array(ZoneRuleSchema).readonly()
+	})
+};
+/**
+* Runtime defaults -- used by ConfigManager.get() for backward compatibility
+* until Plan B wires all runtime settings to the system_settings SQL table.
+*
+* Moved from @camstack/system/config-schema to @camstack/types so that
+* @camstack/system can reference it without a cross-package kernel import.
+*/
+var RUNTIME_DEFAULTS = {
+	"features.streaming": true,
+	"features.notifications": true,
+	"features.objectDetection": false,
+	"features.remoteAccess": true,
+	"features.agentCluster": false,
+	"features.smartHome": true,
+	"features.recordings": true,
+	"features.backup": true,
+	"features.repl": true,
+	"retention.detectionEventsDays": 30,
+	"retention.audioLevelsDays": 7,
+	"logging.level": "info",
+	"logging.retentionDays": 30,
+	"eventBus.ringBufferSize": 1e4,
+	"storage.provider": "sqlite-storage",
+	"storage.locations": {
+		data: "camstack-data/data",
+		media: "camstack-data/media",
+		recordings: "camstack-data/recordings",
+		cache: "/tmp/camstack-cache",
+		logs: "camstack-data/logs",
+		models: "camstack-data/models"
+	},
+	providers: [],
+	"ffmpeg.binaryPath": "ffmpeg",
+	"ffmpeg.hwAccel": "auto",
+	"ffmpeg.threadCount": 0,
+	"auth.tokenExpiry": "7d"
+};
+/**
+* Accessory device helpers — shared across drivers.
 *
-* Extend the enum here when a new gating consumer comes online (audio
-* gating, alert filtering, …) — no other surface needs to change.
+* Many vendor-specific drivers register accessory child devices on
+* top of a parent (Reolink: siren / floodlight / PIR / autotrack /
+* chime; ONVIF: relay outputs; future: Tapo Hub child devices). Each
+* driver picks the right `DeviceType` + `DeviceRole` explicitly when
+* spawning, builds a name derived from the parent, and produces a
+* stableId tied to the parent so boot-restore can reconstruct the
+* relationship.
+*
+* Centralised `(kind → DeviceType)` mapping was dropped on purpose:
+* drivers may reasonably disagree on the right type for an accessory
+* (a Reolink PIR exposes a switch on/off + sensitivity, while a hypothetical
+* read-only motion-only sensor might be `DeviceType.Sensor`). Forcing
+* one canonical mapping was over-prescriptive and added a layer of
+* indirection without saving meaningful code at call sites — the
+* driver knows its own hardware best.
 */
-var ZoneRuleStageEnum = z.enum([
-	"motion",
-	"detection",
-	"package"
-]);
 /**
-* Zone rules capability — per-camera CRUD over the {@link ZoneRule}
-* arrays that decide how each pipeline stage uses the polygon zones.
+* Subset of `DeviceRole` values that drivers register as child
+* accessories of a parent device. Sourced verbatim from `DeviceRole`
+* — `AccessoryKind` is the alias drivers use when building accessory
+* children, so the call site reads as
+* `accessoryStableId(parent, AccessoryKind.Siren)` rather than
+* `accessoryStableId(parent, DeviceRole.Siren)` (which would imply
+* any role works, including non-accessory ones like Doorbell).
+*/
+var AccessoryKind = {
+	Siren: DeviceRole.Siren,
+	Floodlight: DeviceRole.Floodlight,
+	Spotlight: DeviceRole.Spotlight,
+	PirSensor: DeviceRole.PirSensor,
+	Chime: DeviceRole.Chime,
+	Autotrack: DeviceRole.Autotrack,
+	Nightvision: DeviceRole.Nightvision,
+	PrivacyMask: DeviceRole.PrivacyMask
+};
+AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
+new Set(Object.values(DeviceType));
+DeviceFeature.BatteryOperated;
+/** Unwrap ZodNullable / ZodOptional / ZodDefault wrappers to reach the inner type.
+*  Zod v4 exposes `.unwrap()` on all three wrapper classes. */
+function unwrap(schema) {
+	let s = schema;
+	while (s instanceof z.ZodNullable || s instanceof z.ZodOptional || s instanceof z.ZodDefault) s = s.unwrap();
+	return s;
+}
+function leafKind(schema) {
+	const s = unwrap(schema);
+	if (s instanceof z.ZodEnum) return {
+		kind: "enum",
+		enumValues: s.options
+	};
+	if (s instanceof z.ZodNumber) return { kind: "number" };
+	if (s instanceof z.ZodString) return { kind: "string" };
+	if (s instanceof z.ZodBoolean) return { kind: "boolean" };
+	return null;
+}
+/** Walk a cap status schema into flat wireable leaf fields (dotted paths).
+*  Recurses into nested ZodObject (unwrapping nullable/optional/default first),
+*  so fields with null live values are still offered. Arrays / unknown shapes
+*  are skipped — never throws. */
+function enumerateSchemaFields(schema, prefix = "") {
+	const root = unwrap(schema);
+	if (!(root instanceof z.ZodObject)) return [];
+	const out = [];
+	const shape = root.shape;
+	for (const [key, field] of Object.entries(shape)) {
+		const path = prefix ? `${prefix}.${key}` : key;
+		const inner = unwrap(field);
+		if (inner instanceof z.ZodObject) {
+			out.push(...enumerateSchemaFields(inner, path));
+			continue;
+		}
+		const leaf = leafKind(field);
+		if (leaf) out.push({
+			path,
+			kind: leaf.kind,
+			...leaf.enumValues ? { enumValues: leaf.enumValues } : {}
+		});
+	}
+	return out;
+}
+/** Enumerate the per-item wireable fields of an item-array cap (see
+*  `CapabilityStatusItemArray`): the item schema's leaf fields, minus the
+*  `keyField` (the key comes from the link's `itemKey`, never from a wired
+*  source), each tagged `item: true` so the authoring UI collects an
+*  `itemKey` alongside the field. Never throws. */
+function enumerateItemArrayFields(itemArray) {
+	return enumerateSchemaFields(itemArray.itemSchema).filter((f) => f.path !== itemArray.keyField).map((f) => ({
+		...f,
+		item: true
+	}));
+}
+/**
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
+*/
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
+/**
+* Frozen, null-prototype builtin function table for the expression engine
+* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
+* parser rejects any callee not in it, and the evaluator gates each call on an
+* own-property check against it.
 *
-* Hosted by `addon-pipeline-orchestrator` alongside the zones provider
-* so the operator has a single hub-side source of truth for both
-* geometry and behaviour. Per-stage rules are stored under the
-* `zoneRules.<stage>` key in the orchestrator's per-device store and
-* mirrored to the device-state slice `<stage>-zone-rules` on every
-* mutation; consumer addons (analytics, motion-wasm, pipeline-executor)
-* subscribe to that slice and refresh their gating without
-* round-tripping the cap.
+* Because the object has a NULL prototype AND is `Object.freeze`d:
+*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
+*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
+*    (there is no `Object.prototype` in the chain), so those names are not
+*    callable — they are simply "unknown function" at parse time.
 *
-* Sets are bulk-replace — the operator UI sends the new rule list
-* wholesale, so reordering / batch enable-toggle / drag-drop CRUD lives
-* naturally in the rule editor without per-rule mutation chatter.
+* Every numeric argument is validated as a finite number and every numeric
+* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
+* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
+* closed rather than emitting a garbage value.
 */
-var zoneRulesCapability = {
-	name: "zone-rules",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	methods: {
-		/** Read the full rule list for a given stage (empty when no rules
-		*  are defined yet). */
-		listRules: method(z.object({
-			deviceId: z.number(),
-			stage: ZoneRuleStageEnum
-		}), z.array(ZoneRuleSchema).readonly()),
-		/** Bulk-replace the rule list for one stage. The provider validates
-		*  each entry against {@link ZoneRuleSchema} (zoneIds non-empty,
-		*  thresholds in range) and rejects the whole patch if any entry
-		*  is invalid — partial writes are a configuration footgun. */
-		setRules: method(z.object({
-			deviceId: z.number(),
-			stage: ZoneRuleStageEnum,
-			rules: z.array(ZoneRuleSchema).readonly()
-		}), z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString$1(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
 	},
-	/**
-	* Runtime-state slice — every stage mirrored together so consumers
-	* see one reactive handle (`device.state.zoneRules.value`) instead
-	* of one per stage. Bulk-replace mutations on any stage write the full
-	* `{motion, detection, package}` shape, so subscribers always get the
-	* complete current set. Consumers that only care about one stage
-	* just read the matching property.
-	*
-	* `package` backs the package-drop detector — a package zone is a
-	* `ZoneRule` on the `'package'` stage referencing drawn polygons
-	* (see docs/superpowers/specs/2026-07-17-package-zones-design.md §3.1).
-	* The orchestrator provider writes this stage as a first-class slice
-	* (Phase 4): every mutation mirrors the full `{motion, detection,
-	* package}` shape, so consumers read the current package rules directly
-	* off `device.state.zoneRules.value.package`.
-	*/
-	runtimeState: z.object({
-		motion: z.array(ZoneRuleSchema).readonly(),
-		detection: z.array(ZoneRuleSchema).readonly(),
-		package: z.array(ZoneRuleSchema).readonly()
-	})
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString$1(args[1], "convert", 1).trim();
+			const to = asString$1(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
+	}
 };
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
 /**
-* Runtime defaults -- used by ConfigManager.get() for backward compatibility
-* until Plan B wires all runtime settings to the system_settings SQL table.
+* Resource-bound constants for the safe expression engine.
 *
-* Moved from @camstack/system/config-schema to @camstack/types so that
-* @camstack/system can reference it without a cross-package kernel import.
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
 */
-var RUNTIME_DEFAULTS = {
-	"features.streaming": true,
-	"features.notifications": true,
-	"features.objectDetection": false,
-	"features.remoteAccess": true,
-	"features.agentCluster": false,
-	"features.smartHome": true,
-	"features.recordings": true,
-	"features.backup": true,
-	"features.repl": true,
-	"retention.detectionEventsDays": 30,
-	"retention.audioLevelsDays": 7,
-	"logging.level": "info",
-	"logging.retentionDays": 30,
-	"eventBus.ringBufferSize": 1e4,
-	"storage.provider": "sqlite-storage",
-	"storage.locations": {
-		data: "camstack-data/data",
-		media: "camstack-data/media",
-		recordings: "camstack-data/recordings",
-		cache: "/tmp/camstack-cache",
-		logs: "camstack-data/logs",
-		models: "camstack-data/models"
-	},
-	providers: [],
-	"ffmpeg.binaryPath": "ffmpeg",
-	"ffmpeg.hwAccel": "auto",
-	"ffmpeg.threadCount": 0,
-	"auth.tokenExpiry": "7d"
-};
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
+]);
+/**
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
+*/
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	}
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
 /**
-* Accessory device helpers — shared across drivers.
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
 *
-* Many vendor-specific drivers register accessory child devices on
-* top of a parent (Reolink: siren / floodlight / PIR / autotrack /
-* chime; ONVIF: relay outputs; future: Tapo Hub child devices). Each
-* driver picks the right `DeviceType` + `DeviceRole` explicitly when
-* spawning, builds a name derived from the parent, and produces a
-* stableId tied to the parent so boot-restore can reconstruct the
-* relationship.
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
 *
-* Centralised `(kind → DeviceType)` mapping was dropped on purpose:
-* drivers may reasonably disagree on the right type for an accessory
-* (a Reolink PIR exposes a switch on/off + sensitivity, while a hypothetical
-* read-only motion-only sensor might be `DeviceType.Sensor`). Forcing
-* one canonical mapping was over-prescriptive and added a layer of
-* indirection without saving meaningful code at call sites — the
-* driver knows its own hardware best.
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
 */
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
+		};
+	}
+	peek() {
+		return this.tokens[this.pos];
+	}
+	next() {
+		return this.tokens[this.pos++];
+	}
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
+	}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
+		}
+		return false;
+	}
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	}
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
+		}
+		return test;
+	}
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
+				};
+			}
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
+	}
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
+	}
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
 /**
-* Subset of `DeviceRole` values that drivers register as child
-* accessories of a parent device. Sourced verbatim from `DeviceRole`
-* — `AccessoryKind` is the alias drivers use when building accessory
-* children, so the call site reads as
-* `accessoryStableId(parent, AccessoryKind.Siren)` rather than
-* `accessoryStableId(parent, DeviceRole.Siren)` (which would imply
-* any role works, including non-accessory ones like Doorbell).
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
+*
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
 */
-var AccessoryKind = {
-	Siren: DeviceRole.Siren,
-	Floodlight: DeviceRole.Floodlight,
-	Spotlight: DeviceRole.Spotlight,
-	PirSensor: DeviceRole.PirSensor,
-	Chime: DeviceRole.Chime,
-	Autotrack: DeviceRole.Autotrack,
-	Nightvision: DeviceRole.Nightvision,
-	PrivacyMask: DeviceRole.PrivacyMask
-};
-AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
-new Set(Object.values(DeviceType));
-/** Apply a link transform to a resolved source value. `identity`/undefined
-*  pass through; `enum-map` remaps strings (fallback or null when unknown);
-*  `linear` does scale*x+offset with optional clamp (null for non-numbers). */
-function applyTransform(value, transform) {
-	if (!transform || transform.kind === "identity") return value;
-	if (transform.kind === "enum-map") {
-		const key = String(value);
-		if (Object.prototype.hasOwnProperty.call(transform.mapping, key)) return transform.mapping[key];
-		return transform.fallback ?? null;
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
 	}
-	if (transform.kind === "linear") {
-		if (typeof value !== "number" || Number.isNaN(value)) return null;
-		let out = value * transform.scale + transform.offset;
-		if (transform.clamp) {
-			const min = transform.clamp[0];
-			const max = transform.clamp[1];
-			out = Math.min(max, Math.max(min, out));
-		}
-		return out;
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
 	}
-	return value;
-}
-DeviceFeature.BatteryOperated;
-/** Returns true when `x` is a non-null, non-array plain object. */
-function isRecord(x) {
-	return x !== null && typeof x === "object" && !Array.isArray(x);
-}
-/** Read a dot-path (`a.b.c`) out of an object. Returns `undefined` for any
-*  missing/non-object segment — never throws. */
-function getByPath(obj, path) {
-	const parts = path.split(".");
-	let cur = obj;
-	for (const part of parts) {
-		if (!isRecord(cur)) return void 0;
-		cur = cur[part];
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
 	}
-	return cur;
-}
-/** Immutably set a dot-path on an object, returning a new object. Intermediate
-*  objects are created when a segment is missing or null. Arrays are NOT
-*  traversed (P1 has no array-index syntax — see `itemKey` grouping in P2): if a
-*  segment resolves to an array it is replaced by a fresh object, so the array
-*  is discarded — the only caller (`mergeLinkedStatus`) re-validates the result
-*  with the target cap's Zod schema and rejects a malformed overlay.
-*  The return type `T` preserves the OUTER shape; the rewritten key is not
-*  narrowed, so callers should re-validate against the status schema. */
-function setByPath(obj, path, value) {
-	const dotIndex = path.indexOf(".");
-	if (dotIndex === -1) return {
-		...obj,
-		[path]: value
-	};
-	const head = path.slice(0, dotIndex);
-	const tail = path.slice(dotIndex + 1);
-	const child = obj[head];
-	const childObj = isRecord(child) ? child : {};
-	return {
-		...obj,
-		[head]: setByPath(childObj, tail, value)
-	};
-}
-/** Unwrap ZodNullable / ZodOptional / ZodDefault wrappers to reach the inner type.
-*  Zod v4 exposes `.unwrap()` on all three wrapper classes. */
-function unwrap(schema) {
-	let s = schema;
-	while (s instanceof z.ZodNullable || s instanceof z.ZodOptional || s instanceof z.ZodDefault) s = s.unwrap();
-	return s;
+	return result;
 }
-function leafKind(schema) {
-	const s = unwrap(schema);
-	if (s instanceof z.ZodEnum) return {
-		kind: "enum",
-		enumValues: s.options
-	};
-	if (s instanceof z.ZodNumber) return { kind: "number" };
-	if (s instanceof z.ZodString) return { kind: "string" };
-	if (s instanceof z.ZodBoolean) return { kind: "boolean" };
-	return null;
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
 }
-/** Walk a cap status schema into flat wireable leaf fields (dotted paths).
-*  Recurses into nested ZodObject (unwrapping nullable/optional/default first),
-*  so fields with null live values are still offered. Arrays / unknown shapes
-*  are skipped — never throws. */
-function enumerateSchemaFields(schema, prefix = "") {
-	const root = unwrap(schema);
-	if (!(root instanceof z.ZodObject)) return [];
-	const out = [];
-	const shape = root.shape;
-	for (const [key, field] of Object.entries(shape)) {
-		const path = prefix ? `${prefix}.${key}` : key;
-		const inner = unwrap(field);
-		if (inner instanceof z.ZodObject) {
-			out.push(...enumerateSchemaFields(inner, path));
-			continue;
-		}
-		const leaf = leafKind(field);
-		if (leaf) out.push({
-			path,
-			kind: leaf.kind,
-			...leaf.enumValues ? { enumValues: leaf.enumValues } : {}
-		});
+Object.freeze({});
+/**
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
 	}
-	return out;
-}
-/** Enumerate the per-item wireable fields of an item-array cap (see
-*  `CapabilityStatusItemArray`): the item schema's leaf fields, minus the
-*  `keyField` (the key comes from the link's `itemKey`, never from a wired
-*  source), each tagged `item: true` so the authoring UI collects an
-*  `itemKey` alongside the field. Never throws. */
-function enumerateItemArrayFields(itemArray) {
-	return enumerateSchemaFields(itemArray.itemSchema).filter((f) => f.path !== itemArray.keyField).map((f) => ({
-		...f,
-		item: true
-	}));
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	}
+	return null;
 }
 /**
+* What an expression's named bindings READ from.
+*
+* Salvaged verbatim from the deleted device-link mechanism. Wiring's source
+* kinds were the one part of it worth keeping: addressing a device field by
+* re-sync-stable `stableId`, a per-device constant, and a sibling-accessory
+* read are the vocabulary any cross-device derivation needs, and they were
+* already correct. What wiring got wrong was the DESTINATION — a field on
+* somebody else's device, with no identity — not the source.
+*
+* These shapes are therefore kept, re-homed next to the engine that consumes
+* them, and are the binding type of a composition recipe (the source picker
+* stays `deviceManager.getWireableFields`). They deliberately do NOT nest: a
+* binding is a read, never another expression.
+*
+* Schemas are authoritative; every type is `z.infer` of one, so a wire shape and
+* a TypeScript shape cannot drift apart (`scripts/check-schema-type-twins.ts`).
+*/
+/** Read a sibling accessory's status field, addressed by the sibling's key.
+*  `kind` is optional for wire compatibility — absent means `'field'`. */
+var ExpressionFieldBindingSchema = z.object({
+	kind: z.literal("field").optional(),
+	sourceKey: z.string(),
+	cap: z.string(),
+	fieldPath: z.string()
+});
+/** A constant. No device is read. */
+var ExpressionLiteralBindingSchema = z.object({
+	kind: z.literal("literal"),
+	value: z.union([
+		z.string(),
+		z.number(),
+		z.boolean(),
+		z.null()
+	])
+});
+/** Read ANY device's status field, addressed by its re-sync-stable `stableId` —
+*  never by numeric id, which a re-adoption reissues. */
+var ExpressionGlobalBindingSchema = z.object({
+	kind: z.literal("global"),
+	sourceStableId: z.string(),
+	cap: z.string(),
+	fieldPath: z.string()
+});
+var ExpressionBindingSourceSchema = z.union([
+	ExpressionFieldBindingSchema,
+	ExpressionLiteralBindingSchema,
+	ExpressionGlobalBindingSchema
+]);
+z.object({
+	expr: z.string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: z.record(z.string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+/**
 * Runtime list of cap names with status. Used by the settings
 * aggregator to enumerate caps whose `status` should be polled +
 * streamed via `subscribeDeviceStatusAggregate`.
@@ -27572,6 +27469,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.restart": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.setEnabled": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -28208,12 +28111,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"deviceManager.setDeviceLinks": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"deviceManager.setDisabled": {
 		capName: "device-manager",
 		capScope: "system",
@@ -32250,60 +32147,6 @@ TimelapseRuleInputSchema.extend({
 	createdAt: z.number(),
 	updatedAt: z.number()
 });
-/**
-* The addon id as the REGISTRY, the wire and the durable stores spell it.
-*
-* `AddonContext.id` does not agree with itself across the two context
-* factories:
-*
-*   - a FORKED addon gets the bare manifest id
-*     (`kernel/moleculer/addon-context-factory.ts` → `id: addonId`);
-*   - an addon co-located in hub-main gets it PREFIXED
-*     (`server/backend/src/core/addon/addon-registry.service.ts` →
-*      ``id: `addon:${addonId}` ``).
-*
-* Everything an addon might compare `ctx.id` AGAINST carries the bare form:
-* `DeviceBindingEntry.providerAddonId`, the `device-manager` bindings store's
-* `wrapperAddonId`, `CapabilityRegistry` provider keys, manifest ids.
-*
-* So `entry.providerAddonId === this.ctx.id` is silently, permanently false
-* for a builtin — and only for a builtin, which is why it survives a green
-* suite whose fake supplies the bare id. That is exactly how camera 615's
-* virtual doorbell latched `unbound` for twelve hours on 2026-08-07 while its
-* binding was intact ([D72](../../../../docs/decisions/adr-0072.md)).
-*
-* Route every comparison between `ctx.id` and a registry/store addon id
-* through {@link isSameAddonId}. `scripts/check-addon-id-comparison.ts`
-* enforces it in the processes where the prefix exists.
-*/
-/** The prefix the hub-main context factory prepends to the manifest id. */
-var ADDON_ID_PREFIX = "addon:";
-/** The manifest id, whichever spelling of `ctx.id` you were handed. */
-function bareAddonId(id) {
-	return id.startsWith(ADDON_ID_PREFIX) ? id.slice(6) : id;
-}
-/** True when both ids name the same addon, prefixed or not. */
-function isSameAddonId(a, b) {
-	return bareAddonId(a) === bareAddonId(b);
-}
-/**
-* Decode base64 little-endian Float32 back into a vector.
-*
-* Throws on a byte length that is not a multiple of 4 — a truncated vector
-* would otherwise silently rank against a shorter one and produce a plausible
-* score, which is worse than an error.
-*/
-function decodeVectorBase64(encoded) {
-	const buffer = Buffer.from(encoded, "base64");
-	if (buffer.byteLength % 4 !== 0) throw new Error(`decodeVectorBase64: ${buffer.byteLength} bytes is not a whole number of Float32 values`);
-	const out = new Float32Array(buffer.byteLength / 4);
-	for (let i = 0; i < out.length; i += 1) out[i] = buffer.readFloatLE(i * 4);
-	return out;
-}
-/** Vector length implied by a base64 payload, without decoding it. */
-function vectorDimFromBase64(encoded) {
-	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
-}
 z.object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -32411,6 +32254,60 @@ DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 /**
+* The addon id as the REGISTRY, the wire and the durable stores spell it.
+*
+* `AddonContext.id` does not agree with itself across the two context
+* factories:
+*
+*   - a FORKED addon gets the bare manifest id
+*     (`kernel/moleculer/addon-context-factory.ts` → `id: addonId`);
+*   - an addon co-located in hub-main gets it PREFIXED
+*     (`server/backend/src/core/addon/addon-registry.service.ts` →
+*      ``id: `addon:${addonId}` ``).
+*
+* Everything an addon might compare `ctx.id` AGAINST carries the bare form:
+* `DeviceBindingEntry.providerAddonId`, the `device-manager` bindings store's
+* `wrapperAddonId`, `CapabilityRegistry` provider keys, manifest ids.
+*
+* So `entry.providerAddonId === this.ctx.id` is silently, permanently false
+* for a builtin — and only for a builtin, which is why it survives a green
+* suite whose fake supplies the bare id. That is exactly how camera 615's
+* virtual doorbell latched `unbound` for twelve hours on 2026-08-07 while its
+* binding was intact ([D72](../../../../docs/decisions/adr-0072.md)).
+*
+* Route every comparison between `ctx.id` and a registry/store addon id
+* through {@link isSameAddonId}. `scripts/check-addon-id-comparison.ts`
+* enforces it in the processes where the prefix exists.
+*/
+/** The prefix the hub-main context factory prepends to the manifest id. */
+var ADDON_ID_PREFIX = "addon:";
+/** The manifest id, whichever spelling of `ctx.id` you were handed. */
+function bareAddonId(id) {
+	return id.startsWith(ADDON_ID_PREFIX) ? id.slice(6) : id;
+}
+/** True when both ids name the same addon, prefixed or not. */
+function isSameAddonId(a, b) {
+	return bareAddonId(a) === bareAddonId(b);
+}
+/**
+* Decode base64 little-endian Float32 back into a vector.
+*
+* Throws on a byte length that is not a multiple of 4 — a truncated vector
+* would otherwise silently rank against a shorter one and produce a plausible
+* score, which is worse than an error.
+*/
+function decodeVectorBase64(encoded) {
+	const buffer = Buffer.from(encoded, "base64");
+	if (buffer.byteLength % 4 !== 0) throw new Error(`decodeVectorBase64: ${buffer.byteLength} bytes is not a whole number of Float32 values`);
+	const out = new Float32Array(buffer.byteLength / 4);
+	for (let i = 0; i < out.length; i += 1) out[i] = buffer.readFloatLE(i * 4);
+	return out;
+}
+/** Vector length implied by a base64 payload, without decoding it. */
+function vectorDimFromBase64(encoded) {
+	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
+}
+/**
 * Scores all applicable inference backends for the given hardware.
 *
 * Rules (hardware-driven only — no Python import probes):
@@ -32524,4 +32421,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { procedureAuthKey as $, enumerateInferenceDevices as A, hydrateSchema as At, isSameAddonId as B, coreBlocksCapability as C, asJsonObject as Ct, deviceStateCapability as D, emitDownForOwnedCaps as Dt, deviceManagerCapability as E, createEvent as Et, filesystemBrowseCapability as F, readinessKey as Ft, logDestinationCapability as G, kebabToCamel as H, getByPath as I, resolveCapMount as It, metricsProviderCapability as J, logLevelAtMost as K, isArrayOutputSchema as L, scopeKey as Lt, enumerateSchemaFields as M, nodePin as Mt, evaluateLinkExpression as N, parseJsonObject as Nt, deviceStatusCapability as O, emitReadiness as Ot, extractNestedAddonId as P, parseJsonUnknown as Pt, platformProbeCapability as Q, isCollectionArrayMethod as R, sleep as Rt, buildStreamParamsConfigSchema as S, WELL_KNOWN_TAB_MAP as St, decodeVectorBase64 as T, asString as Tt, lifecycleJobSchema as U, isVoidInput as V, localNetworkCapability as W, objectInputDeclaresAddonId as X, normalizeUnit as Y, parseStreamParamsFormPatch as Z, alertsCapability as _, DeviceFeature as _t, CAP_NAMES_WITH_STATUS as a, storageProviderCapability as at, backupCapability as b, ReadinessRegistry as bt, METHOD_ACCESS_MAP as c, userManagementCapability as ct, ScopedTokenSchema as d, vectorStoreCapability as dt, scoreRuntimes as et, StorageLocationTypeSchema as f, errMsg as ft, addonWidgetsCapability as g, DEVICE_STATUS_METHOD as gt, addonSettingsCapability as h, DEVICE_SETTINGS_CONTRIBUTION_METHODS as ht, BatteryStatusSchema as i, storageCapability as it, enumerateItemArrayFields as j, isDeviceConfigCap as jt, doorbellCapability as k, expandCapMethods as kt, RUNTIME_DEFAULTS as l, validateExpressionSource as lt, addonPagesCapability as m, DATAPLANE_SECRET_HEADER as mt, AlertSchema as n, settingsStoreCapability as nt, CoreBlockSchema as o, streamQualityLabel as ot, UserRecordSchema as p, BaseAddon as pt, looseSchema as q, ApiKeyRecordSchema as r, snapshotCapability as rt, DeviceStatusSchema as s, toExpressionValue as st, ALL_CAPABILITY_DEFINITIONS as t, setByPath as tt, STREAM_PROFILE_META as u, vectorDimFromBase64 as ut, applyTransform as v, DeviceRole as vt, dataStoreProviderCapability as w, asNumber as wt, bareAddonId as x, ReadinessTimeoutError as xt, authProviderCapability as y, DeviceType as yt, isObjectInput as z, EventCategory as zt };
+export { platformProbeCapability as $, deviceStatusCapability as A, nodePin as At, isSameAddonId as B, coreBlockAddonId as C, asString as Ct, decodeVectorBase64 as D, expandCapMethods as Dt, dataStoreProviderCapability as E, emitReadiness as Et, extractNestedAddonId as F, scopeKey as Ft, logDestinationCapability as G, kebabToCamel as H, filesystemBrowseCapability as I, sleep as It, metricsProviderCapability as J, logLevelAtMost as K, isArrayOutputSchema as L, EventCategory as Lt, enumerateInferenceDevices as M, parseJsonUnknown as Mt, enumerateItemArrayFields as N, readinessKey as Nt, deviceManagerCapability as O, hydrateSchema as Ot, enumerateSchemaFields as P, resolveCapMount as Pt, parseStreamParamsFormPatch as Q, isCollectionArrayMethod as R, buildStreamParamsConfigSchema as S, asNumber as St, coreBlocksCapability as T, emitDownForOwnedCaps as Tt, lifecycleJobSchema as U, isVoidInput as V, localNetworkCapability as W, oauthIntegrationCapability as X, normalizeUnit as Y, objectInputDeclaresAddonId as Z, addonWidgetsCapability as _, DeviceType as _t, CAP_NAMES_WITH_STATUS as a, storageProviderCapability as at, backupCapability as b, WELL_KNOWN_TAB_MAP as bt, DeviceStatusSchema as c, vectorDimFromBase64 as ct, STREAM_PROFILE_META as d, BaseAddon as dt, procedureAuthKey as et, ScopedTokenSchema as f, DATAPLANE_SECRET_HEADER as ft, addonSettingsCapability as g, DeviceRole as gt, addonPagesCapability as h, DeviceFeature as ht, BatteryStatusSchema as i, storageCapability as it, doorbellCapability as j, parseJsonObject as jt, deviceStateCapability as k, isDeviceConfigCap as kt, METHOD_ACCESS_MAP as l, vectorStoreCapability as lt, UserRecordSchema as m, DEVICE_STATUS_METHOD as mt, AlertSchema as n, settingsStoreCapability as nt, CORE_BLOCK_ADDON_PREFIX as o, streamQualityLabel as ot, StorageLocationTypeSchema as p, DEVICE_SETTINGS_CONTRIBUTION_METHODS as pt, looseSchema as q, ApiKeyRecordSchema as r, snapshotCapability as rt, CoreBlockSchema as s, userManagementCapability as st, ALL_CAPABILITY_DEFINITIONS as t, scoreRuntimes as tt, RUNTIME_DEFAULTS as u, errMsg as ut, alertsCapability as v, ReadinessRegistry as vt, coreBlockIdFromAddonId as w, createEvent as wt, bareAddonId as x, asJsonObject as xt, authProviderCapability as y, ReadinessTimeoutError as yt, isObjectInput as z };