@camstack/system 1.2.62 → 1.2.64

package/dist/{dist-DgPUarcs.js → dist-DP3nHlNM.js}

@@ -5967,12 +5967,34 @@ var streamBrokerCapability = {
 			kinds: zod.z.array(EventMediaKindSchema).min(1).default(["mp4"]),
 			/** GIF geometry. The video keeps the source's own. */
 			gifMaxWidth: zod.z.number().int().min(120).max(1280).default(640),
-			gifFps: zod.z.number().int().min(1).max(15).default(8),
 			/**
-			* Playback rate, applied to EVERY container so they stay one clip.
-			* `1` is real time and is what allows the copy branch.
+			* The gif's own PLAYBACK rate in frames per second — what the finished
+			* gif runs at, not how many source frames feed it. The decimation that
+			* feeds it samples `gifFps / gifSpeed` source frames per second, so at
+			* the defaults a 12 fps gif is built out of 3 source frames a second.
 			*/
-			speed: zod.z.number().min(1).max(8).default(1)
+			gifFps: zod.z.number().int().min(1).max(15).default(12),
+			/**
+			* How fast the GIF plays against real time, independent of `speed`.
+			*
+			* 4× by default, by operator request: a notification gif is glanced at
+			* on a lock screen, so a ~12 s window has to be over in ~3 s. It stays
+			* a separate knob from `speed` even though both now default to 4 —
+			* a caller wanting a real-time video and a fast gif must not have to
+			* choose.
+			*/
+			gifSpeed: zod.z.number().min(1).max(8).default(4),
+			/**
+			* Playback rate of the VIDEO. Also 4× by default, by operator decision.
+			*
+			* `1` is real time and is the ONLY value that allows the copy branch —
+			* anything else forces `libx264` over the window. That was priced
+			* before it was chosen: a per-event burst measured at 0.23 s and 254 KB
+			* on a real 615 720p cut, against 922 KB for the copy it replaces. A
+			* re-encode is capped at 720p (`EVENT_CLIP_ENCODE_MAX_WIDTH`), because
+			* once the decode is forced the width stops being free.
+			*/
+			speed: zod.z.number().min(1).max(8).default(4)
 		}), EventMediaProductionSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -6565,6 +6587,28 @@ function kebabToCamel(s) {
 * instead of taking the hub with it (D6). Every method here is admin-only, and
 * must stay so.
 */
+/**
+* Prefix for a block's generated addon id AND its runner id — one addon, one
+* process, so the two are the same string (D2).
+*
+* It lives on the CONTRACT rather than beside the code that materialises the
+* package, because it is not an implementation detail: the operator surface
+* reads a block's logs by asking `logs.query` for `addonId = core-block-<id>`,
+* with no cap and no store of its own. Two copies of this string is one copy
+* too many — a drift would show as a logs pane that is simply always empty.
+*/
+var CORE_BLOCK_ADDON_PREFIX = "core-block-";
+/** The addon/runner id a block's process runs under. */
+function coreBlockAddonId(blockId) {
+	return `${CORE_BLOCK_ADDON_PREFIX}${blockId}`;
+}
+/** The block id behind a generated addon/runner id, or null when the id belongs
+*  to something else. The inverse of {@link coreBlockAddonId}. */
+function coreBlockIdFromAddonId(addonId) {
+	if (!addonId.startsWith("core-block-")) return null;
+	const rest = addonId.slice(11);
+	return rest.length > 0 ? rest : null;
+}
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = zod.z.union([zod.z.literal("hub"), zod.z.string().min(1)]);
@@ -6653,6 +6697,23 @@ var coreBlocksCapability = {
 			auth: "admin"
 		}),
 		/**
+		* Stop this block's runner and let the supervisor bring it back.
+		*
+		* **It stores nothing.** There is no "restart requested" flag and no second
+		* lifecycle field: the supervisor already stops and respawns a runner when
+		* the code hash changes, and this exposes that same path deliberately
+		* (D62 — a switch writes the authority that already owned the function).
+		* The next reconcile pass remains the authority, so a restart that lost a
+		* race is corrected within one pass rather than leaving a stale flag behind.
+		*
+		* Refused for a DISABLED block: nothing would come back, and a button that
+		* silently does nothing is worse than one that says why.
+		*/
+		restart: method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Type-check without saving — what the editor calls as the author types, so
 		* the compiler's verdict is the same one the server will reach.
 		*/
@@ -7693,909 +7754,173 @@ var deviceExportCapability = {
 		unexposeDevice: method(UnexposeInputSchema, zod.z.void(), { kind: "mutation" })
 	}
 };
+var ProviderStatusSchema = zod.z.object({
+	connected: zod.z.boolean(),
+	deviceCount: zod.z.number(),
+	error: zod.z.string().optional()
+});
+zod.z.object({
+	externalId: zod.z.string(),
+	name: zod.z.string(),
+	type: zod.z.string(),
+	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+});
 /**
-* Resource-bound constants for the safe expression engine.
-*
-* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
-* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
-* O(nodeCount) by construction. These caps merely put a hard ceiling on the
-* work a single author-supplied expression can request, so a hostile or
-* accidental pathological string can never spend unbounded CPU/memory.
+* Candidate handed back from discovery and accepted by
+* `adoptDiscoveredDevice`. Shape mirrors the in-process
+* `DiscoveredDevice` interface used by `DeviceDiscovery`.
 */
-/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
-*  rejected without allocation. */
-var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
-/** A legal binding / identifier name. */
-var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Binding names an author may NOT use: `now` is auto-injected; the literal
-*  keywords lex as values, not identifiers, so binding to them is meaningless. */
-var RESERVED_BINDING_NAMES = new Set([
-	"now",
-	"true",
-	"false",
-	"null"
-]);
+var DiscoveryCandidateSchema = zod.z.object({
+	stableId: zod.z.string(),
+	type: zod.z.enum(DeviceType),
+	suggestedName: zod.z.string(),
+	prefilledConfig: zod.z.record(zod.z.string(), zod.z.unknown()),
+	/**
+	* Optional upstream-system identity (HA entity_id, vendor MAC, …).
+	* Discovery pre-populates this for systems that know the upstream
+	* identity ahead of adoption. Rendering metadata (unit, precision)
+	* flows live through the cap STATUS SLICE after adoption.
+	*/
+	sourceInfo: SourceInfoSchema.optional()
+});
 /**
-* Error types for the safe expression engine. Two distinct classes so callers
-* can tell a compile-time (grammar) failure from a runtime (evaluation)
-* failure — both are non-fatal to the host: read paths degrade to "skip link".
+* Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
+* Mirrors `toDeviceShape()` output in `device-management.router.ts` so the
+* tRPC layer can pass it through without reshaping.
 */
-/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
-*  the failure is anchored to a character (author-facing inline feedback). */
-var ExpressionParseError = class extends Error {
-	position;
-	constructor(message, position) {
-		super(message);
-		this.name = "ExpressionParseError";
-		this.position = position;
-	}
-};
-/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
-*  result, unknown builtin, step-budget exceeded). */
-var ExpressionEvalError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ExpressionEvalError";
+var DeviceSummarySchema = zod.z.object({
+	id: zod.z.number(),
+	stableId: zod.z.string(),
+	addonId: zod.z.string(),
+	type: zod.z.string(),
+	name: zod.z.string(),
+	parentDeviceId: zod.z.number().nullable(),
+	online: zod.z.boolean(),
+	features: zod.z.array(zod.z.string()),
+	config: zod.z.record(zod.z.string(), zod.z.unknown()),
+	/** Optional upstream-system identity (dispatch key + system tag).
+	*  See `SourceInfo`. Present when the device has a non-synthetic
+	*  source identifier (HA entities, vendor MAC, …); omitted when the
+	*  synthetic backfill is in effect. */
+	sourceInfo: SourceInfoSchema.optional()
+});
+/**
+* Result of a live field test (e.g. probing an RTSP URL during device
+* creation). Matches the UI-side `FieldProbeResult` in
+* `interfaces/config-ui.ts` — the admin `FormBuilder` renders the
+* returned `labels` as chips next to the input.
+*/
+var FieldProbeResultSchema = zod.z.object({
+	status: zod.z.enum(["ok", "error"]),
+	labels: zod.z.array(zod.z.string()).optional(),
+	error: zod.z.string().optional()
+});
+/**
+* The output of `getChildCreationSchema` is a UI schema tree. We store
+* it as `unknown` at the capability layer — the router just passes it
+* through and the admin UI renders it via `FormBuilder`. The actual
+* type is `ConfigUISchema` (see `packages/types/src/interfaces/config-ui.ts`),
+* but we deliberately avoid a Zod mirror because the union is large and
+* not meant for runtime validation at this seam.
+*/
+var CreationSchemaOutputSchema = zod.z.unknown();
+var deviceProviderCapability = {
+	name: "device-provider",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		start: method(zod.z.void(), zod.z.void(), { kind: "mutation" }),
+		stop: method(zod.z.void(), zod.z.void(), { kind: "mutation" }),
+		getStatus: method(zod.z.void(), ProviderStatusSchema),
+		getDevices: method(zod.z.void(), zod.z.array(zod.z.object({
+			id: zod.z.string(),
+			name: zod.z.string(),
+			type: zod.z.string()
+		}))),
+		supportsDiscovery: method(zod.z.object({}), zod.z.boolean()),
+		/**
+		* Run a network scan. `params` carries optional provider-specific scan
+		* inputs (e.g. a broadcast address / subnet for cross-subnet discovery),
+		* shaped by `getDiscoveryParamsSchema`. Omitted for the generic scan
+		* (provider uses its local-network default).
+		*/
+		discoverDevices: method(zod.z.object({ params: zod.z.record(zod.z.string(), zod.z.unknown()).optional() }), zod.z.array(DiscoveryCandidateSchema), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Optional form schema (`ConfigUISchema`) for the EXTRA per-scan inputs a
+		* provider accepts (e.g. Gree's broadcast address for a different subnet).
+		* `null` when the provider takes no extra scan params — the generic
+		* aggregated scan never renders this; the per-integration scan does.
+		*/
+		getDiscoveryParamsSchema: method(zod.z.object({}), CreationSchemaOutputSchema),
+		/**
+		* The DeviceType this provider creates via manual add (Camera for
+		* Reolink/ONVIF, Container for Gree, Hub for Ecowitt). `null` when the
+		* provider does not support manual creation. Lets the Add-Device dialog
+		* pick the right type instead of assuming Camera.
+		*/
+		getManualCreationType: method(zod.z.object({}), zod.z.object({ deviceType: zod.z.enum(DeviceType).nullable() })),
+		adoptDiscoveredDevice: method(zod.z.object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		supportsManualCreation: method(zod.z.object({}), zod.z.boolean()),
+		/**
+		* Fetch the creation form schema for a given DeviceType. Returns
+		* `null` when the provider does not support manually creating
+		* devices of that type. The output is a `ConfigUISchema` — the
+		* router type-asserts it at the boundary.
+		*/
+		getChildCreationSchema: method(zod.z.object({ type: zod.z.enum(DeviceType) }), CreationSchemaOutputSchema),
+		createDevice: method(zod.z.object({
+			type: zod.z.enum(DeviceType),
+			config: zod.z.record(zod.z.string(), zod.z.unknown())
+		}), DeviceSummarySchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Test a single field in the creation form before the device has
+		* been persisted. Typical use: probing an RTSP URL entered by the
+		* user. Providers that don't support field probing return
+		* `{ success: true, message: 'Field test not supported' }`.
+		*
+		* `formValues` is the live snapshot of every field in the form at
+		* the moment the user clicked Test — useful for probes that depend
+		* on multiple fields together (e.g. Reolink autodetect needs host
+		* + credentials + UID + transport mode in a single call). Optional
+		* for backwards compatibility; providers free to ignore it.
+		*/
+		testCreationField: method(zod.z.object({
+			type: zod.z.enum(DeviceType),
+			key: zod.z.string(),
+			value: zod.z.unknown(),
+			formValues: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+		}), FieldProbeResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 /**
-* Frozen, null-prototype builtin function table for the expression engine
-* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
-* parser rejects any callee not in it, and the evaluator gates each call on an
-* own-property check against it.
+* Device Manager capability — hub-side singleton that unifies device persistence,
+* live registry access, and all management operations into a single tRPC surface.
 *
-* Because the object has a NULL prototype AND is `Object.freeze`d:
-*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
-*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
-*    (there is no `Object.prototype` in the chain), so those names are not
-*    callable — they are simply "unknown function" at parse time.
+* Replaces:
+*   - `device-persistence` capability (persistence methods absorbed here)
+*   - `device-management.router.ts` (deleted in Phase 2)
+*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
 *
-* Every numeric argument is validated as a finite number and every numeric
-* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
-* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
-* closed rather than emitting a garbage value.
-*/
-function asFiniteNumber(value, name, index) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
-	return value;
-}
-function asString$1(value, name, index) {
-	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
-	return value;
-}
-function finiteResult(value, name) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
-	return value;
-}
-function allFiniteNumbers(args, name) {
-	return args.map((a, idx) => asFiniteNumber(a, name, idx));
-}
-var INF = Number.POSITIVE_INFINITY;
-var table = {
-	min: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
-	},
-	max: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
-	},
-	abs: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
-	},
-	floor: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
-	},
-	ceil: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
-	},
-	sqrt: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
-	},
-	round: {
-		minArgs: 1,
-		maxArgs: 2,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "round", 0);
-			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
-			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
-			const factor = 10 ** digits;
-			return finiteResult(Math.round(x * factor) / factor, "round");
-		}
-	},
-	pow: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
-	},
-	clamp: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "clamp", 0);
-			const lo = asFiniteNumber(args[1], "clamp", 1);
-			const hi = asFiniteNumber(args[2], "clamp", 2);
-			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
-			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
-		}
-	},
-	avg: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const nums = allFiniteNumbers(args, "avg");
-			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
-		}
-	},
-	sum: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
-	},
-	coalesce: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			for (const a of args) if (a !== null) return a;
-			return null;
-		}
-	},
-	age: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
-	},
-	convert: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args, hooks) => {
-			const x = asFiniteNumber(args[0], "convert", 0);
-			const from = asString$1(args[1], "convert", 1).trim();
-			const to = asString$1(args[2], "convert", 2).trim();
-			if (hooks.convert) {
-				const out = hooks.convert(x, from, to);
-				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
-				return finiteResult(out, "convert");
-			}
-			if (from === to) return x;
-			throw new ExpressionEvalError("convert: unit conversion table not installed");
-		}
-	}
-};
-/** Frozen, null-prototype builtin table. */
-var EXPRESSION_BUILTINS = Object.freeze(Object.assign(Object.create(null), table));
-/** The set of valid builtin names — used by the parser to reject unknown
-*  callees at parse time (immediate author feedback). */
-var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
-/**
-* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
-* zero-dependency. The grammar is deliberately boring: decimal numbers,
-* single/double-quoted strings with a tiny escape set, identifiers, the three
-* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
-* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
-* is a parse error with a source position, so member access / assignment /
-* template literals are lexically impossible.
-*/
-var KEYWORDS = new Set([
-	"true",
-	"false",
-	"null"
-]);
-function isDigit(ch) {
-	return ch >= "0" && ch <= "9";
-}
-function isIdentStart(ch) {
-	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
-}
-function isIdentPart(ch) {
-	return isIdentStart(ch) || isDigit(ch);
-}
-function isWhitespace(ch) {
-	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
-}
-/** Tokenize `source` into a flat token list ending with a single `eof` token.
-*  Throws `ExpressionParseError` on any illegal character or unterminated
-*  string. */
-function tokenize(source) {
-	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
-	const tokens = [];
-	let i = 0;
-	const n = source.length;
-	while (i < n) {
-		const ch = source[i];
-		if (isWhitespace(ch)) {
-			i += 1;
-			continue;
-		}
-		if (isDigit(ch)) {
-			const start = i;
-			while (i < n && isDigit(source[i])) i += 1;
-			if (i < n && source[i] === ".") {
-				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
-				i += 1;
-				while (i < n && isDigit(source[i])) i += 1;
-			}
-			const text = source.slice(start, i);
-			const value = Number(text);
-			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
-			tokens.push({
-				type: "number",
-				value,
-				pos: start
-			});
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			const quote = ch;
-			const start = i;
-			i += 1;
-			let out = "";
-			let closed = false;
-			while (i < n) {
-				const c = source[i];
-				if (c === "\\") {
-					const next = i + 1 < n ? source[i + 1] : "";
-					if (next === "\\" || next === "'" || next === "\"") {
-						out += next;
-						i += 2;
-						continue;
-					}
-					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
-				}
-				if (c === quote) {
-					closed = true;
-					i += 1;
-					break;
-				}
-				out += c;
-				i += 1;
-			}
-			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
-			tokens.push({
-				type: "string",
-				value: out,
-				pos: start
-			});
-			continue;
-		}
-		if (isIdentStart(ch)) {
-			const start = i;
-			while (i < n && isIdentPart(source[i])) i += 1;
-			const text = source.slice(start, i);
-			if (KEYWORDS.has(text)) tokens.push({
-				type: "keyword",
-				keyword: keywordOf(text),
-				pos: start
-			});
-			else tokens.push({
-				type: "identifier",
-				name: text,
-				pos: start
-			});
-			continue;
-		}
-		const two = i + 1 < n ? source.slice(i, i + 2) : "";
-		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
-			tokens.push({
-				type: "punct",
-				punct: two,
-				pos: i
-			});
-			i += 2;
-			continue;
-		}
-		if (isSinglePunct(ch)) {
-			tokens.push({
-				type: "punct",
-				punct: ch,
-				pos: i
-			});
-			i += 1;
-			continue;
-		}
-		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
-	}
-	tokens.push({
-		type: "eof",
-		pos: n
-	});
-	return tokens;
-}
-function keywordOf(text) {
-	if (text === "true") return "true";
-	if (text === "false") return "false";
-	return "null";
-}
-function isSinglePunct(ch) {
-	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
-}
-/**
-* Pratt (precedence-climbing) parser for the safe expression mini-language.
-*
-* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
-* → relational → additive → multiplicative → unary `! -` → call / primary.
-* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
-* string validated against the builtin table at parse time, so an unknown
-* function is rejected immediately (author feedback) and a persisted expression
-* that references a since-removed builtin degrades at read.
-*
-* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
-* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
-*/
-/** Binary/logical operator precedence (higher binds tighter). */
-var BINARY_PRECEDENCE = {
-	"||": 1,
-	"&&": 2,
-	"==": 3,
-	"!=": 3,
-	"<": 4,
-	"<=": 4,
-	">": 4,
-	">=": 4,
-	"+": 5,
-	"-": 5,
-	"*": 6,
-	"/": 6,
-	"%": 6
-};
-function isLogicalOp(op) {
-	return op === "&&" || op === "||";
-}
-function isBinaryOp(op) {
-	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
-}
-var Parser = class {
-	tokens;
-	pos = 0;
-	nodeCount = 0;
-	identifiers = /* @__PURE__ */ new Set();
-	callees = /* @__PURE__ */ new Set();
-	constructor(tokens) {
-		this.tokens = tokens;
-	}
-	parse() {
-		const ast = this.parseTernary();
-		const tok = this.peek();
-		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
-		return {
-			ast,
-			identifiers: this.identifiers,
-			callees: this.callees,
-			nodeCount: this.nodeCount
-		};
-	}
-	peek() {
-		return this.tokens[this.pos];
-	}
-	next() {
-		return this.tokens[this.pos++];
-	}
-	/** Consume a punctuator token, erroring if the next token isn't it. */
-	expectPunct(punct) {
-		const tok = this.peek();
-		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
-		this.pos += 1;
-	}
-	matchPunct(punct) {
-		const tok = this.peek();
-		if (tok.type === "punct" && tok.punct === punct) {
-			this.pos += 1;
-			return true;
-		}
-		return false;
-	}
-	countNode() {
-		this.nodeCount += 1;
-		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
-	}
-	parseTernary() {
-		const test = this.parseBinary(1);
-		if (this.matchPunct("?")) {
-			const consequent = this.parseTernary();
-			this.expectPunct(":");
-			const alternate = this.parseTernary();
-			this.countNode();
-			return {
-				kind: "conditional",
-				test,
-				consequent,
-				alternate
-			};
-		}
-		return test;
-	}
-	parseBinary(minPrec) {
-		let left = this.parseUnary();
-		for (;;) {
-			const tok = this.peek();
-			if (tok.type !== "punct") break;
-			const prec = BINARY_PRECEDENCE[tok.punct];
-			if (prec === void 0 || prec < minPrec) break;
-			const op = tok.punct;
-			this.pos += 1;
-			const right = this.parseBinary(prec + 1);
-			this.countNode();
-			if (isLogicalOp(op)) left = {
-				kind: "logical",
-				op,
-				left,
-				right
-			};
-			else if (isBinaryOp(op)) left = {
-				kind: "binary",
-				op,
-				left,
-				right
-			};
-			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
-		}
-		return left;
-	}
-	parseUnary() {
-		const tok = this.peek();
-		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
-			const op = tok.punct;
-			this.pos += 1;
-			const operand = this.parseUnary();
-			this.countNode();
-			return {
-				kind: "unary",
-				op,
-				operand
-			};
-		}
-		return this.parsePrimary();
-	}
-	parsePrimary() {
-		const tok = this.next();
-		switch (tok.type) {
-			case "number":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "string":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "keyword":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.keyword === "null" ? null : tok.keyword === "true"
-				};
-			case "identifier": {
-				const nextTok = this.peek();
-				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
-				this.identifiers.add(tok.name);
-				this.countNode();
-				return {
-					kind: "identifier",
-					name: tok.name
-				};
-			}
-			case "punct":
-				if (tok.punct === "(") {
-					const inner = this.parseTernary();
-					this.expectPunct(")");
-					return inner;
-				}
-				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
-			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
-		}
-	}
-	parseCall(callee, pos) {
-		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
-		this.expectPunct("(");
-		const args = [];
-		if (!this.matchPunct(")")) for (;;) {
-			args.push(this.parseTernary());
-			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
-			if (this.matchPunct(",")) continue;
-			this.expectPunct(")");
-			break;
-		}
-		this.callees.add(callee);
-		this.countNode();
-		return {
-			kind: "call",
-			callee,
-			args
-		};
-	}
-};
-/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
-*  `ExpressionParseError` on any lexical or grammatical failure. */
-function parseExpression(source) {
-	return new Parser(tokenize(source)).parse();
-}
-/**
-* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
-* by expr"). The cache stores BOTH successes and failures (negative caching),
-* so a corrupt persisted string costs exactly one tokenize+parse total — not
-* one per read on a hot resolve path.
-*
-* The cache is a module-level singleton: entries are pure, content-addressed
-* ASTs keyed by the raw source string, so sharing one instance across all
-* callers is safe and maximises hit rate.
-*/
-var cache = /* @__PURE__ */ new Map();
-function getCached(source) {
-	const hit = cache.get(source);
-	if (hit !== void 0) {
-		cache.delete(source);
-		cache.set(source, hit);
-		return hit;
-	}
-	let result;
-	try {
-		result = {
-			ok: true,
-			parsed: parseExpression(source)
-		};
-	} catch (err) {
-		result = {
-			ok: false,
-			error: err instanceof ExpressionParseError ? err.message : String(err)
-		};
-	}
-	cache.set(source, result);
-	if (cache.size > 256) {
-		const oldest = cache.keys().next().value;
-		if (oldest !== void 0) cache.delete(oldest);
-	}
-	return result;
-}
-/** Compile `source`, returning a discriminated result instead of throwing.
-*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
-function compileExpressionSafe(source) {
-	return getCached(source);
-}
-/**
-* Tree-walking evaluator for the safe expression mini-language.
-*
-* SECURITY (spec §4 rule 2/5):
-*  - The scope is an `Object.create(null)` copy of ONLY the caller's own
-*    enumerable binding entries, so `name in scope` is a pure own-key check and
-*    `constructor` / `__proto__` / `toString` are plain unknown identifiers.
-*  - Performs ZERO I/O and never touches `globalThis` / `Date` / `Math`
-*    directly — the only external calls are into the frozen builtin table.
-*  - The grammar has no loops/recursion/lambdas, so a walk is O(nodeCount) by
-*    construction; the step counter is defense-in-depth for a crafted max-size
-*    AST. Nothing blocks: there are no timers, awaits or unbounded loops.
-*/
-var EMPTY_HOOKS = Object.freeze({});
-/** Build a null-prototype scope from own-enumerable binding entries. Inherited
-*  keys of the input (e.g. from a `{__proto__: {...}}` payload) are NOT copied,
-*  so nothing smuggles in via the prototype chain. */
-function createExpressionScope(bindings) {
-	const scope = Object.create(null);
-	for (const key of Object.keys(bindings)) if (Object.prototype.hasOwnProperty.call(bindings, key)) scope[key] = bindings[key];
-	return scope;
-}
-function isFiniteNumber(value) {
-	return typeof value === "number" && Number.isFinite(value);
-}
-/** JS truthiness of a primitive value. */
-function truthy(value) {
-	return Boolean(value);
-}
-function requireFinite(value, context) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${context} produced a non-finite result`);
-	return value;
-}
-function step(ctx) {
-	ctx.steps += 1;
-	if (ctx.steps > ctx.maxSteps) throw new ExpressionEvalError("expression evaluation step budget exceeded");
-}
-function evalNode(node, ctx) {
-	step(ctx);
-	switch (node.kind) {
-		case "literal": return node.value;
-		case "identifier":
-			if (!(node.name in ctx.scope)) throw new ExpressionEvalError(`unknown identifier: ${node.name}`);
-			return ctx.scope[node.name];
-		case "unary": return evalUnary(node.op, evalNode(node.operand, ctx));
-		case "binary": return evalBinary(node.op, evalNode(node.left, ctx), evalNode(node.right, ctx));
-		case "logical": {
-			const left = evalNode(node.left, ctx);
-			if (node.op === "&&") return truthy(left) ? evalNode(node.right, ctx) : left;
-			return truthy(left) ? left : evalNode(node.right, ctx);
-		}
-		case "conditional": return truthy(evalNode(node.test, ctx)) ? evalNode(node.consequent, ctx) : evalNode(node.alternate, ctx);
-		case "call": return evalCall(node.callee, node.args.map((a) => evalNode(a, ctx)), ctx.hooks);
-	}
-}
-function evalUnary(op, operand) {
-	if (op === "!") return !truthy(operand);
-	if (!isFiniteNumber(operand)) throw new ExpressionEvalError("unary \"-\" requires a finite number");
-	return requireFinite(-operand, "unary \"-\"");
-}
-function evalBinary(op, left, right) {
-	switch (op) {
-		case "==": return left === right;
-		case "!=": return left !== right;
-		case "+":
-			if (typeof left === "string" && typeof right === "string") return left + right;
-			if (isFiniteNumber(left) && isFiniteNumber(right)) return requireFinite(left + right, "\"+\"");
-			throw new ExpressionEvalError("\"+\" requires two numbers or two strings");
-		case "-":
-		case "*":
-		case "/":
-		case "%":
-			if (!isFiniteNumber(left) || !isFiniteNumber(right)) throw new ExpressionEvalError(`"${op}" requires two finite numbers`);
-			return requireFinite(op === "-" ? left - right : op === "*" ? left * right : op === "/" ? left / right : left % right, `"${op}"`);
-		case "<":
-		case "<=":
-		case ">":
-		case ">=":
-			if (isFiniteNumber(left) && isFiniteNumber(right)) return op === "<" ? left < right : op === "<=" ? left <= right : op === ">" ? left > right : left >= right;
-			if (typeof left === "string" && typeof right === "string") return op === "<" ? left < right : op === "<=" ? left <= right : op === ">" ? left > right : left >= right;
-			throw new ExpressionEvalError(`"${op}" requires two numbers or two strings`);
-	}
-}
-function evalCall(callee, args, hooks) {
-	if (!Object.prototype.hasOwnProperty.call(EXPRESSION_BUILTINS, callee)) throw new ExpressionEvalError(`unknown function: ${callee}`);
-	const builtin = EXPRESSION_BUILTINS[callee];
-	if (args.length < builtin.minArgs || args.length > builtin.maxArgs) throw new ExpressionEvalError(`${callee}: wrong number of arguments (${args.length})`);
-	return builtin.apply(args, hooks);
-}
-/** Evaluate an AST node against a scope. Throws `ExpressionEvalError` on any
-*  runtime failure (unknown identifier, type mismatch, non-finite result,
-*  step-budget exhaustion). */
-function evaluateAst(node, scope, opts) {
-	return evalNode(node, {
-		scope,
-		hooks: opts?.hooks ?? EMPTY_HOOKS,
-		maxSteps: opts?.maxSteps ?? 4096,
-		steps: 0
-	});
-}
-/**
-* Coerce an untrusted `getByPath` / mirror read to an `ExpressionValue`.
-* Non-primitive values (objects, arrays, `undefined`, functions, bigint,
-* symbol) and non-finite numbers become `undefined` so the caller can apply
-* its binding-miss policy (→ `null`). `null` itself is a valid value.
-*/
-function toExpressionValue(raw) {
-	if (raw === null) return null;
-	if (typeof raw === "string") return raw;
-	if (typeof raw === "boolean") return raw;
-	if (typeof raw === "number") return Number.isFinite(raw) ? raw : void 0;
-}
-/**
-* Author-time validation. Returns `null` when the source is valid, else a
-* human-readable error message. Checks: the expression compiles; binding count
-* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
-* is not reserved (`now`/keywords) and does not shadow a builtin; and every
-* FREE identifier of the AST is covered by a binding or the injected `now`.
-*/
-function validateExpressionSource(src) {
-	const names = Object.keys(src.bindings);
-	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
-	for (const name of names) {
-		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
-		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
-		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
-	}
-	const compiled = compileExpressionSafe(src.expr);
-	if (!compiled.ok) return compiled.error;
-	const bound = new Set(names);
-	for (const id of compiled.parsed.identifiers) {
-		if (id === "now") continue;
-		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
-	}
-	return null;
-}
-/**
-* Shared read-path evaluation for BOTH resolver channels. Builds a null-proto
-* scope from `bindingValues` plus the injected `now` (supplied by the caller
-* for determinism/testability), compiles via the LRU, and evaluates. Any
-* failure (parse or eval) returns `{ ok: false }` — the caller treats that as
-* "skip this link".
-*/
-function evaluateLinkExpression(expr, bindingValues, now, opts) {
-	const compiled = compileExpressionSafe(expr);
-	if (!compiled.ok) return {
-		ok: false,
-		error: compiled.error
-	};
-	const scope = createExpressionScope({
-		...bindingValues,
-		["now"]: now
-	});
-	try {
-		return {
-			ok: true,
-			value: evaluateAst(compiled.parsed.ast, scope, opts)
-		};
-	} catch (err) {
-		return {
-			ok: false,
-			error: err instanceof ExpressionEvalError ? err.message : String(err)
-		};
-	}
-}
-var ProviderStatusSchema = zod.z.object({
-	connected: zod.z.boolean(),
-	deviceCount: zod.z.number(),
-	error: zod.z.string().optional()
-});
-zod.z.object({
-	externalId: zod.z.string(),
-	name: zod.z.string(),
-	type: zod.z.string(),
-	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-});
-/**
-* Candidate handed back from discovery and accepted by
-* `adoptDiscoveredDevice`. Shape mirrors the in-process
-* `DiscoveredDevice` interface used by `DeviceDiscovery`.
-*/
-var DiscoveryCandidateSchema = zod.z.object({
-	stableId: zod.z.string(),
-	type: zod.z.enum(DeviceType),
-	suggestedName: zod.z.string(),
-	prefilledConfig: zod.z.record(zod.z.string(), zod.z.unknown()),
-	/**
-	* Optional upstream-system identity (HA entity_id, vendor MAC, …).
-	* Discovery pre-populates this for systems that know the upstream
-	* identity ahead of adoption. Rendering metadata (unit, precision)
-	* flows live through the cap STATUS SLICE after adoption.
-	*/
-	sourceInfo: SourceInfoSchema.optional()
-});
-/**
-* Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
-* Mirrors `toDeviceShape()` output in `device-management.router.ts` so the
-* tRPC layer can pass it through without reshaping.
-*/
-var DeviceSummarySchema = zod.z.object({
-	id: zod.z.number(),
-	stableId: zod.z.string(),
-	addonId: zod.z.string(),
-	type: zod.z.string(),
-	name: zod.z.string(),
-	parentDeviceId: zod.z.number().nullable(),
-	online: zod.z.boolean(),
-	features: zod.z.array(zod.z.string()),
-	config: zod.z.record(zod.z.string(), zod.z.unknown()),
-	/** Optional upstream-system identity (dispatch key + system tag).
-	*  See `SourceInfo`. Present when the device has a non-synthetic
-	*  source identifier (HA entities, vendor MAC, …); omitted when the
-	*  synthetic backfill is in effect. */
-	sourceInfo: SourceInfoSchema.optional()
-});
-/**
-* Result of a live field test (e.g. probing an RTSP URL during device
-* creation). Matches the UI-side `FieldProbeResult` in
-* `interfaces/config-ui.ts` — the admin `FormBuilder` renders the
-* returned `labels` as chips next to the input.
-*/
-var FieldProbeResultSchema = zod.z.object({
-	status: zod.z.enum(["ok", "error"]),
-	labels: zod.z.array(zod.z.string()).optional(),
-	error: zod.z.string().optional()
-});
-/**
-* The output of `getChildCreationSchema` is a UI schema tree. We store
-* it as `unknown` at the capability layer — the router just passes it
-* through and the admin UI renders it via `FormBuilder`. The actual
-* type is `ConfigUISchema` (see `packages/types/src/interfaces/config-ui.ts`),
-* but we deliberately avoid a Zod mirror because the union is large and
-* not meant for runtime validation at this seam.
-*/
-var CreationSchemaOutputSchema = zod.z.unknown();
-var deviceProviderCapability = {
-	name: "device-provider",
-	scope: "system",
-	mode: "collection",
-	methods: {
-		start: method(zod.z.void(), zod.z.void(), { kind: "mutation" }),
-		stop: method(zod.z.void(), zod.z.void(), { kind: "mutation" }),
-		getStatus: method(zod.z.void(), ProviderStatusSchema),
-		getDevices: method(zod.z.void(), zod.z.array(zod.z.object({
-			id: zod.z.string(),
-			name: zod.z.string(),
-			type: zod.z.string()
-		}))),
-		supportsDiscovery: method(zod.z.object({}), zod.z.boolean()),
-		/**
-		* Run a network scan. `params` carries optional provider-specific scan
-		* inputs (e.g. a broadcast address / subnet for cross-subnet discovery),
-		* shaped by `getDiscoveryParamsSchema`. Omitted for the generic scan
-		* (provider uses its local-network default).
-		*/
-		discoverDevices: method(zod.z.object({ params: zod.z.record(zod.z.string(), zod.z.unknown()).optional() }), zod.z.array(DiscoveryCandidateSchema), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Optional form schema (`ConfigUISchema`) for the EXTRA per-scan inputs a
-		* provider accepts (e.g. Gree's broadcast address for a different subnet).
-		* `null` when the provider takes no extra scan params — the generic
-		* aggregated scan never renders this; the per-integration scan does.
-		*/
-		getDiscoveryParamsSchema: method(zod.z.object({}), CreationSchemaOutputSchema),
-		/**
-		* The DeviceType this provider creates via manual add (Camera for
-		* Reolink/ONVIF, Container for Gree, Hub for Ecowitt). `null` when the
-		* provider does not support manual creation. Lets the Add-Device dialog
-		* pick the right type instead of assuming Camera.
-		*/
-		getManualCreationType: method(zod.z.object({}), zod.z.object({ deviceType: zod.z.enum(DeviceType).nullable() })),
-		adoptDiscoveredDevice: method(zod.z.object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		supportsManualCreation: method(zod.z.object({}), zod.z.boolean()),
-		/**
-		* Fetch the creation form schema for a given DeviceType. Returns
-		* `null` when the provider does not support manually creating
-		* devices of that type. The output is a `ConfigUISchema` — the
-		* router type-asserts it at the boundary.
-		*/
-		getChildCreationSchema: method(zod.z.object({ type: zod.z.enum(DeviceType) }), CreationSchemaOutputSchema),
-		createDevice: method(zod.z.object({
-			type: zod.z.enum(DeviceType),
-			config: zod.z.record(zod.z.string(), zod.z.unknown())
-		}), DeviceSummarySchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Test a single field in the creation form before the device has
-		* been persisted. Typical use: probing an RTSP URL entered by the
-		* user. Providers that don't support field probing return
-		* `{ success: true, message: 'Field test not supported' }`.
-		*
-		* `formValues` is the live snapshot of every field in the form at
-		* the moment the user clicked Test — useful for probes that depend
-		* on multiple fields together (e.g. Reolink autodetect needs host
-		* + credentials + UID + transport mode in a single call). Optional
-		* for backwards compatibility; providers free to ignore it.
-		*/
-		testCreationField: method(zod.z.object({
-			type: zod.z.enum(DeviceType),
-			key: zod.z.string(),
-			value: zod.z.unknown(),
-			formValues: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-		}), FieldProbeResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		})
-	}
-};
-/**
-* Device Manager capability — hub-side singleton that unifies device persistence,
-* live registry access, and all management operations into a single tRPC surface.
-*
-* Replaces:
-*   - `device-persistence` capability (persistence methods absorbed here)
-*   - `device-management.router.ts` (deleted in Phase 2)
-*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
-*
-* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
-* fork into separate processes but never run on remote cluster agents. Therefore:
-*   - No nodeId routing needed — this is a pure hub singleton.
-*   - The hub's DeviceRegistry is the single source of truth for all live devices.
-*   - No shadow registry or cross-node aggregation required.
-*
-* Forked workers register devices back to the hub via `ctx.devices`
-* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
+* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
+* fork into separate processes but never run on remote cluster agents. Therefore:
+*   - No nodeId routing needed — this is a pure hub singleton.
+*   - The hub's DeviceRegistry is the single source of truth for all live devices.
+*   - No shadow registry or cross-node aggregation required.
+*
+* Forked workers register devices back to the hub via `ctx.devices`
+* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
 */
 /** One child-placement directive on a container's `childLayout`. Structurally
 *  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
@@ -8608,92 +7933,6 @@ var ChildLayoutEntrySchema = zod.z.object({
 	order: zod.z.number().optional(),
 	collapsed: zod.z.boolean().optional()
 });
-/** Cap-wire shape of a DeviceLink — structurally mirrors `DeviceLink` in
-*  `device-management.ts`. Source is a union: a FIELD source copies a sibling
-*  accessory's status field (`kind` optional/absent for wire compat); a
-*  LITERAL source carries a per-device constant (no sibling is read); a
-*  GLOBAL source (P2e) copies ANY device's status field, addressed by the
-*  source device's full re-sync-stable `stableId`. */
-var DeviceLinkFieldSourceSchema = zod.z.object({
-	kind: zod.z.literal("field").optional(),
-	sourceKey: zod.z.string(),
-	cap: zod.z.string(),
-	fieldPath: zod.z.string()
-});
-var DeviceLinkLiteralSourceSchema = zod.z.object({
-	kind: zod.z.literal("literal"),
-	value: zod.z.union([
-		zod.z.string(),
-		zod.z.number(),
-		zod.z.boolean(),
-		zod.z.null()
-	])
-});
-var DeviceLinkGlobalSourceSchema = zod.z.object({
-	kind: zod.z.literal("global"),
-	sourceStableId: zod.z.string(),
-	cap: zod.z.string(),
-	fieldPath: zod.z.string()
-});
-/** Expression source (Stage X): compute the target field from N named bindings
-*  via the safe expression engine. Bindings are field | literal | global — never
-*  another expression (no nesting). The `superRefine` runs the SAME author-time
-*  validation as `validateExpressionSource` (compiles the expr, checks binding
-*  names + identifier coverage) so every wire boundary that parses a DeviceLink
-*  (tRPC mount, kernel create pre-seed, projection output) validates-at-write.
-*  Compiles are LRU-cached, so repeated validation of the same expr is a hit. */
-var DeviceLinkExpressionSourceSchema = zod.z.object({
-	kind: zod.z.literal("expression"),
-	expr: zod.z.string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: zod.z.record(zod.z.string().regex(EXPRESSION_IDENTIFIER_RE), zod.z.union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema
-	]))
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
-});
-var DeviceLinkSchema = zod.z.object({
-	id: zod.z.string(),
-	source: zod.z.union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema,
-		DeviceLinkExpressionSourceSchema
-	]),
-	target: zod.z.object({
-		cap: zod.z.string(),
-		fieldPath: zod.z.string(),
-		itemKey: zod.z.string().optional()
-	}),
-	transform: zod.z.discriminatedUnion("kind", [
-		zod.z.object({ kind: zod.z.literal("identity") }),
-		zod.z.object({
-			kind: zod.z.literal("enum-map"),
-			mapping: zod.z.record(zod.z.string(), zod.z.union([
-				zod.z.string(),
-				zod.z.number(),
-				zod.z.boolean()
-			])),
-			fallback: zod.z.union([
-				zod.z.string(),
-				zod.z.number(),
-				zod.z.boolean()
-			]).optional()
-		}),
-		zod.z.object({
-			kind: zod.z.literal("linear"),
-			scale: zod.z.number(),
-			offset: zod.z.number(),
-			clamp: zod.z.tuple([zod.z.number(), zod.z.number()]).readonly().optional()
-		})
-	]).optional()
-});
 /** Cap-wire shape of a per-cap display refinement — mirrors
 *  `DeviceCapDisplayOverride` in `device-management.ts`. */
 var DeviceCapDisplayOverrideSchema = zod.z.object({
@@ -8773,8 +8012,6 @@ var DeviceInfoSchema = zod.z.object({
 	*  named accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: zod.z.array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: zod.z.array(DeviceLinkSchema).readonly().optional(),
 	/** Operator-authored per-device display override. See `DeviceMeta.display`. */
 	display: DeviceDisplayOverrideSchema.optional()
 });
@@ -8783,7 +8020,7 @@ var ConfigEntrySchema = zod.z.object({
 	value: zod.z.unknown(),
 	description: zod.z.string().optional()
 });
-var DeviceLinkModeSchema = zod.z.enum(["auto", "manual"]);
+var LinkedDevicesModeSchema = zod.z.enum(["auto", "manual"]);
 /** One resolved linked device — the compact projection consumers need. */
 var LinkedDeviceSchema = zod.z.object({
 	deviceId: zod.z.number(),
@@ -8846,8 +8083,6 @@ var DeviceMetaSchema = zod.z.object({
 	*  accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: zod.z.array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: zod.z.array(DeviceLinkSchema).readonly().optional(),
 	/** Semantic role string (`DeviceRole`) — propagated from the spawn pre-seed.
 	*  Optional: only present for accessory children that carry a known role. */
 	role: zod.z.string().nullable().optional(),
@@ -8999,16 +8234,6 @@ var deviceManagerCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Set (or replace) the cross-device field wirings on a device's meta row.
-		*  Mirrors `setChildLayout`; persisted, projected, preserved across
-		*  re-register/restore. Idempotent. */
-		setDeviceLinks: method(zod.z.object({
-			deviceId: zod.z.number(),
-			deviceLinks: zod.z.array(DeviceLinkSchema).readonly()
-		}), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
 		/** Set (or clear) the per-device display override on the meta row. Mirrors
 		*  `setChildLayout` persistence; `null` clears the override entirely. The
 		*  override unit(s) are normalized (`normalizeUnit`) at write so the render
@@ -9032,15 +8257,15 @@ var deviceManagerCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** List the wireable status-schema fields per cap bound to a device.
-		*  Powers the Wiring tab's field pickers. Caps without a status schema are
-		*  omitted. Item-array caps (`status.itemArray`, e.g. consumables) also
-		*  emit their per-item fields tagged `item: true` (a link targeting one
-		*  must carry a `target.itemKey`) plus the cap-level `itemArray`
-		*  descriptor. `includeSynthesizable: true` (TARGET pickers only) unions
-		*  in unbound device-scoped caps that declare `status.empty` and match
-		*  the device's type — so the FIRST link to a synthesize-only cap
-		*  (consumables on an HA vacuum) can be authored. */
+		/** The per-cap catalog of readable status-schema fields for one device.
+		*  This is the SOURCE PICKER — it outlived the Wiring tab that first
+		*  needed it (deleted 2026-08-08) and becomes the picker of a composition
+		*  recipe: every field the old tab could target, a composed device can
+		*  read. Caps without a status schema are omitted. Item-array caps
+		*  (`status.itemArray`, e.g. consumables) also emit their per-item fields
+		*  tagged `item: true` plus the cap-level `itemArray` descriptor.
+		*  `includeSynthesizable: true` unions in unbound device-scoped caps that
+		*  declare `status.empty` and match the device's type. */
 		getWireableFields: method(zod.z.object({
 			deviceId: zod.z.number(),
 			includeSynthesizable: zod.z.boolean().optional()
@@ -9182,7 +8407,7 @@ var deviceManagerCapability = {
 		* (see the module docblock) — there are no bespoke link mutations.
 		*/
 		getLinkedDevices: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.object({
-			mode: DeviceLinkModeSchema,
+			mode: LinkedDevicesModeSchema,
 			devices: zod.z.array(LinkedDeviceSchema)
 		})),
 		/** Get stream sources for a camera device. */
@@ -9246,11 +8471,7 @@ var deviceManagerCapability = {
 			deviceId: zod.z.number(),
 			entries: zod.z.array(zod.z.object({
 				capName: zod.z.string(),
-				kind: zod.z.enum([
-					"native",
-					"wrapped",
-					"linked"
-				]),
+				kind: zod.z.enum(["native", "wrapped"]),
 				providerAddonId: zod.z.string(),
 				providerNodeId: zod.z.string(),
 				nativeAddonId: zod.z.string()
@@ -9268,11 +8489,7 @@ var deviceManagerCapability = {
 			deviceId: zod.z.number(),
 			entries: zod.z.array(zod.z.object({
 				capName: zod.z.string(),
-				kind: zod.z.enum([
-					"native",
-					"wrapped",
-					"linked"
-				]),
+				kind: zod.z.enum(["native", "wrapped"]),
 				providerAddonId: zod.z.string(),
 				providerNodeId: zod.z.string(),
 				nativeAddonId: zod.z.string()
@@ -10480,6 +9697,10 @@ var motionDetectionCapability = {
 	mode: "singleton",
 	kind: "wrapper",
 	defaultActive: true,
+	/** Frame-differencing motion analysis over a video stream — only a camera
+	*  produces the frames. Read by the `defaultActive` auto-bind in
+	*  `device-manager.getBindings` to decide which devices it may claim. */
+	deviceTypes: [DeviceType.Camera],
 	exposesDeviceSettings: true,
 	methods: {
 		analyze: method(zod.z.object({
@@ -12873,6 +12094,18 @@ var OauthIntegrationDescriptorSchema = zod.z.object({
 	*  redirect_uri that does not start with one of these. Required —
 	*  an empty list means the integration can never complete linking. */
 	allowedRedirectPrefixes: zod.z.array(zod.z.string()).min(1),
+	/** Paths accepted as a `redirect_uri` when the host is PRIVATE — loopback,
+	*  RFC1918, CGNAT (100.64/10, Tailscale), link-local, IPv6 ULA, or an
+	*  `.local` / `.internal` / `.ts.net` name. Exists for self-hosted clients
+	*  whose address the hub cannot know in advance (a Home Assistant at
+	*  `http://<lan-ip>:8123/auth/external/callback`). The PATH must match
+	*  exactly; a public host never satisfies this branch, so it is not a
+	*  wildcard prefix by another name. */
+	allowedPrivateHostPaths: zod.z.array(zod.z.string()).optional(),
+	/** When true this is a PUBLIC client (source is published, no secret can be
+	*  protected) and PKCE is mandatory: `/authorize` refuses without an S256
+	*  `code_challenge`, `/token` refuses without the matching `code_verifier`. */
+	requiresPkce: zod.z.boolean().optional(),
 	/** Optional public origin (no trailing slash) that this integration's
 	*  issued codes/tokens should carry as the `hubUrl` claim — typically the
 	*  operator-selected external-access endpoint resolved by the addon. When
@@ -13029,7 +12262,7 @@ var TrackEnvelopeSchema = zod.z.object({
 * `snapshots[]` references — megabytes across a page of tracks. `slim`
 * keeps every scalar the list surfaces actually render (ids, class(es),
 * label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
-* zonesVisited, bestEventId, envelope) and returns `positions` /
+* zonesVisited, bestEventId, envelope, hasFace) and returns `positions` /
 * `snapshots` as EMPTY arrays — detail views re-fetch the full row via
 * `getTrack`. Mirrors the event-store `projection` convention
 * (`getObjectEvents` et al.).
@@ -13266,6 +12499,24 @@ var TrackSchema = zod.z.object({
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
 	envelope: TrackEnvelopeSchema.optional(),
+	/**
+	* A face DETECTOR found a face on this track — nothing more. It says the
+	* detail plane produced a `face` detail; it does NOT say the face was
+	* embedded, matched, above `minFacePx`, or that the recognizer was even
+	* enabled. Set once and never cleared.
+	*
+	* **This exists so "face present but not recognised" is expressible.** A
+	* recognised identity lands in `subLabel` (attributed to the face chain via
+	* `subLabelMeta.stepId`), so before this field a track with an unmatched face
+	* and a track with no face at all were byte-identical on the wire and no
+	* surface could tell them apart. The read is `hasFace === true && subLabel
+	* === undefined`.
+	*
+	* **Absent ≠ false.** Every row written before the column existed omits it,
+	* and so does every server that predates the field — a consumer must test
+	* `=== true` and render nothing otherwise, never infer "no face".
+	*/
+	hasFace: zod.z.boolean().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -17015,6 +16266,10 @@ var SsoBridgeClaimsSchema = zod.z.object({
 	integrationId: zod.z.string().optional(),
 	/** JWT ID — unique per issued code; consumed-set enforces single-use. */
 	jti: zod.z.string().optional(),
+	/** PKCE S256 challenge — set only on `oauth-code` tokens issued to a public
+	*  client. Its PRESENCE is what makes the verifier mandatory at exchange,
+	*  so the requirement travels with the code and not with mutable config. */
+	codeChallenge: zod.z.string().optional(),
 	/** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
 	*  tokens so the verify path can check the session is not revoked. */
 	sessionId: zod.z.string().optional()
@@ -17771,6 +17026,10 @@ var videoclipsCapability = {
 	mode: "singleton",
 	kind: "wrapper",
 	defaultActive: true,
+	/** A clip is a window over a camera's footage — the cap is meaningless on a
+	*  sensor, a button or an event emitter, and the `defaultActive` auto-bind
+	*  reads this to decide which devices it may claim. */
+	deviceTypes: [DeviceType.Camera],
 	methods: {
 		listClips: method(zod.z.object({
 			deviceId: zod.z.number(),
@@ -20266,7 +19525,29 @@ var FaceInfoSchema = zod.z.object({
 	recognizedIdentityId: zod.z.string().optional(),
 	identityName: zod.z.string().optional(),
 	assigned: zod.z.boolean(),
+	/**
+	* The crop, inline, base64.
+	*
+	* **Prefer {@link cropUrl}.** At the 500 rows the Faces view asks for this
+	* field alone is ~2.87 MiB, re-sent in full on every operator assign and
+	* every 30 s poll, base64-inflated over the msgpack socket and held in the
+	* query heap. It stays for callers that have not migrated; `includeCrops:
+	* false` turns it off once they have.
+	*/
 	base64: zod.z.string().optional(),
+	/**
+	* Same crop, as a data-plane URL for `<img src>` — the move the admin
+	* snapshot surfaces made on 2026-08-08.
+	*
+	* Served by the `event-media` plane, which resolves a raw MediaStore key and
+	* is `access: 'authenticated'`: a bare `<img>` carries the `camstack_session`
+	* cookie, so no header plumbing is needed. The bytes then ride the browser's
+	* HTTP cache with an ETag and `immutable`, instead of the WebSocket.
+	*
+	* Absent when the face has no stored crop, or when the addon has no data
+	* plane — callers fall back to {@link base64}.
+	*/
+	cropUrl: zod.z.string().optional(),
 	/** Design B: the face bbox (pixel space) on the key frame — lets a detail
 	*  view draw the box over the native `keyFrameMediaKey` frame. Absent on
 	*  legacy rows written before design B. */
@@ -20342,7 +19623,23 @@ var faceGalleryCapability = {
 		}),
 		listRecentFaces: method(zod.z.object({
 			limit: zod.z.number().int().positive().optional(),
-			filter: FaceFilterEnum.optional()
+			filter: FaceFilterEnum.optional(),
+			/**
+			* Inline the base64 crop on every row. Default `true` — the existing
+			* behaviour, kept so no caller breaks.
+			*
+			* Set `false` once the caller renders {@link FaceInfo.cropUrl}: that
+			* drops ~2.87 MiB per 500-row page to a few KiB of metadata and lets
+			* the browser cache the images.
+			*
+			* **This is an INPUT field, so it does not reach the addon until the
+			* next train.** The hub router validates cap inputs against its own
+			* compiled Zod, which strips a key it does not know — verified today
+			* on the OUTPUT side, where an additive field DOES arrive immediately
+			* (`Track.hasFace`). Until the train ships, sending `false` is
+			* harmless and simply keeps the crops inline.
+			*/
+			includeCrops: zod.z.boolean().optional()
 		}).optional(), zod.z.array(FaceInfoSchema).readonly()),
 		getFaceByTrack: method(zod.z.object({
 			deviceId: zod.z.number().int(),
@@ -25697,14 +24994,19 @@ var userManagementCapability = {
 			username: zod.z.string(),
 			scopes: zod.z.array(TokenScopeSchema),
 			redirectUri: zod.z.string(),
-			hubUrl: zod.z.string()
+			hubUrl: zod.z.string(),
+			/** PKCE (RFC 7636) S256 challenge. Baked into the signed code; a code
+			*  that carries one can ONLY be exchanged with the matching verifier. */
+			codeChallenge: zod.z.string().optional()
 		}), zod.z.object({ code: zod.z.string() }), {
 			kind: "mutation",
 			access: "create"
 		}),
 		oauthExchangeCode: method(zod.z.object({
 			code: zod.z.string(),
-			redirectUri: zod.z.string()
+			redirectUri: zod.z.string(),
+			/** PKCE verifier. REQUIRED when the code carries a challenge. */
+			codeVerifier: zod.z.string().optional()
 		}), zod.z.object({
 			accessToken: zod.z.string(),
 			refreshToken: zod.z.string(),
@@ -26246,277 +25548,872 @@ var zoneAnalyticsCapability = {
 	runtimeState: CameraOccupancySnapshotSchema
 };
 /**
-* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
-* cap so a single CRUD surface backs every consumer; each stage has
-* its own dev-state mirror slice (`motion-zone-rules`,
-* `detection-zone-rules`, …) so consumer addons subscribe independently.
-*
-* Extend the enum here when a new gating consumer comes online (audio
-* gating, alert filtering, …) — no other surface needs to change.
+* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
+* cap so a single CRUD surface backs every consumer; each stage has
+* its own dev-state mirror slice (`motion-zone-rules`,
+* `detection-zone-rules`, …) so consumer addons subscribe independently.
+*
+* Extend the enum here when a new gating consumer comes online (audio
+* gating, alert filtering, …) — no other surface needs to change.
+*/
+var ZoneRuleStageEnum = zod.z.enum([
+	"motion",
+	"detection",
+	"package"
+]);
+/**
+* Zone rules capability — per-camera CRUD over the {@link ZoneRule}
+* arrays that decide how each pipeline stage uses the polygon zones.
+*
+* Hosted by `addon-pipeline-orchestrator` alongside the zones provider
+* so the operator has a single hub-side source of truth for both
+* geometry and behaviour. Per-stage rules are stored under the
+* `zoneRules.<stage>` key in the orchestrator's per-device store and
+* mirrored to the device-state slice `<stage>-zone-rules` on every
+* mutation; consumer addons (analytics, motion-wasm, pipeline-executor)
+* subscribe to that slice and refresh their gating without
+* round-tripping the cap.
+*
+* Sets are bulk-replace — the operator UI sends the new rule list
+* wholesale, so reordering / batch enable-toggle / drag-drop CRUD lives
+* naturally in the rule editor without per-rule mutation chatter.
+*/
+var zoneRulesCapability = {
+	name: "zone-rules",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		/** Read the full rule list for a given stage (empty when no rules
+		*  are defined yet). */
+		listRules: method(zod.z.object({
+			deviceId: zod.z.number(),
+			stage: ZoneRuleStageEnum
+		}), zod.z.array(ZoneRuleSchema).readonly()),
+		/** Bulk-replace the rule list for one stage. The provider validates
+		*  each entry against {@link ZoneRuleSchema} (zoneIds non-empty,
+		*  thresholds in range) and rejects the whole patch if any entry
+		*  is invalid — partial writes are a configuration footgun. */
+		setRules: method(zod.z.object({
+			deviceId: zod.z.number(),
+			stage: ZoneRuleStageEnum,
+			rules: zod.z.array(ZoneRuleSchema).readonly()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	/**
+	* Runtime-state slice — every stage mirrored together so consumers
+	* see one reactive handle (`device.state.zoneRules.value`) instead
+	* of one per stage. Bulk-replace mutations on any stage write the full
+	* `{motion, detection, package}` shape, so subscribers always get the
+	* complete current set. Consumers that only care about one stage
+	* just read the matching property.
+	*
+	* `package` backs the package-drop detector — a package zone is a
+	* `ZoneRule` on the `'package'` stage referencing drawn polygons
+	* (see docs/superpowers/specs/2026-07-17-package-zones-design.md §3.1).
+	* The orchestrator provider writes this stage as a first-class slice
+	* (Phase 4): every mutation mirrors the full `{motion, detection,
+	* package}` shape, so consumers read the current package rules directly
+	* off `device.state.zoneRules.value.package`.
+	*/
+	runtimeState: zod.z.object({
+		motion: zod.z.array(ZoneRuleSchema).readonly(),
+		detection: zod.z.array(ZoneRuleSchema).readonly(),
+		package: zod.z.array(ZoneRuleSchema).readonly()
+	})
+};
+/**
+* Runtime defaults -- used by ConfigManager.get() for backward compatibility
+* until Plan B wires all runtime settings to the system_settings SQL table.
+*
+* Moved from @camstack/system/config-schema to @camstack/types so that
+* @camstack/system can reference it without a cross-package kernel import.
+*/
+var RUNTIME_DEFAULTS = {
+	"features.streaming": true,
+	"features.notifications": true,
+	"features.objectDetection": false,
+	"features.remoteAccess": true,
+	"features.agentCluster": false,
+	"features.smartHome": true,
+	"features.recordings": true,
+	"features.backup": true,
+	"features.repl": true,
+	"retention.detectionEventsDays": 30,
+	"retention.audioLevelsDays": 7,
+	"logging.level": "info",
+	"logging.retentionDays": 30,
+	"eventBus.ringBufferSize": 1e4,
+	"storage.provider": "sqlite-storage",
+	"storage.locations": {
+		data: "camstack-data/data",
+		media: "camstack-data/media",
+		recordings: "camstack-data/recordings",
+		cache: "/tmp/camstack-cache",
+		logs: "camstack-data/logs",
+		models: "camstack-data/models"
+	},
+	providers: [],
+	"ffmpeg.binaryPath": "ffmpeg",
+	"ffmpeg.hwAccel": "auto",
+	"ffmpeg.threadCount": 0,
+	"auth.tokenExpiry": "7d"
+};
+/**
+* Accessory device helpers — shared across drivers.
+*
+* Many vendor-specific drivers register accessory child devices on
+* top of a parent (Reolink: siren / floodlight / PIR / autotrack /
+* chime; ONVIF: relay outputs; future: Tapo Hub child devices). Each
+* driver picks the right `DeviceType` + `DeviceRole` explicitly when
+* spawning, builds a name derived from the parent, and produces a
+* stableId tied to the parent so boot-restore can reconstruct the
+* relationship.
+*
+* Centralised `(kind → DeviceType)` mapping was dropped on purpose:
+* drivers may reasonably disagree on the right type for an accessory
+* (a Reolink PIR exposes a switch on/off + sensitivity, while a hypothetical
+* read-only motion-only sensor might be `DeviceType.Sensor`). Forcing
+* one canonical mapping was over-prescriptive and added a layer of
+* indirection without saving meaningful code at call sites — the
+* driver knows its own hardware best.
+*/
+/**
+* Subset of `DeviceRole` values that drivers register as child
+* accessories of a parent device. Sourced verbatim from `DeviceRole`
+* — `AccessoryKind` is the alias drivers use when building accessory
+* children, so the call site reads as
+* `accessoryStableId(parent, AccessoryKind.Siren)` rather than
+* `accessoryStableId(parent, DeviceRole.Siren)` (which would imply
+* any role works, including non-accessory ones like Doorbell).
+*/
+var AccessoryKind = {
+	Siren: DeviceRole.Siren,
+	Floodlight: DeviceRole.Floodlight,
+	Spotlight: DeviceRole.Spotlight,
+	PirSensor: DeviceRole.PirSensor,
+	Chime: DeviceRole.Chime,
+	Autotrack: DeviceRole.Autotrack,
+	Nightvision: DeviceRole.Nightvision,
+	PrivacyMask: DeviceRole.PrivacyMask
+};
+AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
+new Set(Object.values(DeviceType));
+DeviceFeature.BatteryOperated;
+/** Unwrap ZodNullable / ZodOptional / ZodDefault wrappers to reach the inner type.
+*  Zod v4 exposes `.unwrap()` on all three wrapper classes. */
+function unwrap(schema) {
+	let s = schema;
+	while (s instanceof zod.z.ZodNullable || s instanceof zod.z.ZodOptional || s instanceof zod.z.ZodDefault) s = s.unwrap();
+	return s;
+}
+function leafKind(schema) {
+	const s = unwrap(schema);
+	if (s instanceof zod.z.ZodEnum) return {
+		kind: "enum",
+		enumValues: s.options
+	};
+	if (s instanceof zod.z.ZodNumber) return { kind: "number" };
+	if (s instanceof zod.z.ZodString) return { kind: "string" };
+	if (s instanceof zod.z.ZodBoolean) return { kind: "boolean" };
+	return null;
+}
+/** Walk a cap status schema into flat wireable leaf fields (dotted paths).
+*  Recurses into nested ZodObject (unwrapping nullable/optional/default first),
+*  so fields with null live values are still offered. Arrays / unknown shapes
+*  are skipped — never throws. */
+function enumerateSchemaFields(schema, prefix = "") {
+	const root = unwrap(schema);
+	if (!(root instanceof zod.z.ZodObject)) return [];
+	const out = [];
+	const shape = root.shape;
+	for (const [key, field] of Object.entries(shape)) {
+		const path = prefix ? `${prefix}.${key}` : key;
+		const inner = unwrap(field);
+		if (inner instanceof zod.z.ZodObject) {
+			out.push(...enumerateSchemaFields(inner, path));
+			continue;
+		}
+		const leaf = leafKind(field);
+		if (leaf) out.push({
+			path,
+			kind: leaf.kind,
+			...leaf.enumValues ? { enumValues: leaf.enumValues } : {}
+		});
+	}
+	return out;
+}
+/** Enumerate the per-item wireable fields of an item-array cap (see
+*  `CapabilityStatusItemArray`): the item schema's leaf fields, minus the
+*  `keyField` (the key comes from the link's `itemKey`, never from a wired
+*  source), each tagged `item: true` so the authoring UI collects an
+*  `itemKey` alongside the field. Never throws. */
+function enumerateItemArrayFields(itemArray) {
+	return enumerateSchemaFields(itemArray.itemSchema).filter((f) => f.path !== itemArray.keyField).map((f) => ({
+		...f,
+		item: true
+	}));
+}
+/**
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
 */
-var ZoneRuleStageEnum = zod.z.enum([
-	"motion",
-	"detection",
-	"package"
-]);
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
 /**
-* Zone rules capability — per-camera CRUD over the {@link ZoneRule}
-* arrays that decide how each pipeline stage uses the polygon zones.
+* Frozen, null-prototype builtin function table for the expression engine
+* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
+* parser rejects any callee not in it, and the evaluator gates each call on an
+* own-property check against it.
 *
-* Hosted by `addon-pipeline-orchestrator` alongside the zones provider
-* so the operator has a single hub-side source of truth for both
-* geometry and behaviour. Per-stage rules are stored under the
-* `zoneRules.<stage>` key in the orchestrator's per-device store and
-* mirrored to the device-state slice `<stage>-zone-rules` on every
-* mutation; consumer addons (analytics, motion-wasm, pipeline-executor)
-* subscribe to that slice and refresh their gating without
-* round-tripping the cap.
+* Because the object has a NULL prototype AND is `Object.freeze`d:
+*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
+*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
+*    (there is no `Object.prototype` in the chain), so those names are not
+*    callable — they are simply "unknown function" at parse time.
 *
-* Sets are bulk-replace — the operator UI sends the new rule list
-* wholesale, so reordering / batch enable-toggle / drag-drop CRUD lives
-* naturally in the rule editor without per-rule mutation chatter.
+* Every numeric argument is validated as a finite number and every numeric
+* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
+* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
+* closed rather than emitting a garbage value.
 */
-var zoneRulesCapability = {
-	name: "zone-rules",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	methods: {
-		/** Read the full rule list for a given stage (empty when no rules
-		*  are defined yet). */
-		listRules: method(zod.z.object({
-			deviceId: zod.z.number(),
-			stage: ZoneRuleStageEnum
-		}), zod.z.array(ZoneRuleSchema).readonly()),
-		/** Bulk-replace the rule list for one stage. The provider validates
-		*  each entry against {@link ZoneRuleSchema} (zoneIds non-empty,
-		*  thresholds in range) and rejects the whole patch if any entry
-		*  is invalid — partial writes are a configuration footgun. */
-		setRules: method(zod.z.object({
-			deviceId: zod.z.number(),
-			stage: ZoneRuleStageEnum,
-			rules: zod.z.array(ZoneRuleSchema).readonly()
-		}), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString$1(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
 	},
-	/**
-	* Runtime-state slice — every stage mirrored together so consumers
-	* see one reactive handle (`device.state.zoneRules.value`) instead
-	* of one per stage. Bulk-replace mutations on any stage write the full
-	* `{motion, detection, package}` shape, so subscribers always get the
-	* complete current set. Consumers that only care about one stage
-	* just read the matching property.
-	*
-	* `package` backs the package-drop detector — a package zone is a
-	* `ZoneRule` on the `'package'` stage referencing drawn polygons
-	* (see docs/superpowers/specs/2026-07-17-package-zones-design.md §3.1).
-	* The orchestrator provider writes this stage as a first-class slice
-	* (Phase 4): every mutation mirrors the full `{motion, detection,
-	* package}` shape, so consumers read the current package rules directly
-	* off `device.state.zoneRules.value.package`.
-	*/
-	runtimeState: zod.z.object({
-		motion: zod.z.array(ZoneRuleSchema).readonly(),
-		detection: zod.z.array(ZoneRuleSchema).readonly(),
-		package: zod.z.array(ZoneRuleSchema).readonly()
-	})
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString$1(args[1], "convert", 1).trim();
+			const to = asString$1(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
+	}
 };
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
 /**
-* Runtime defaults -- used by ConfigManager.get() for backward compatibility
-* until Plan B wires all runtime settings to the system_settings SQL table.
+* Resource-bound constants for the safe expression engine.
 *
-* Moved from @camstack/system/config-schema to @camstack/types so that
-* @camstack/system can reference it without a cross-package kernel import.
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
 */
-var RUNTIME_DEFAULTS = {
-	"features.streaming": true,
-	"features.notifications": true,
-	"features.objectDetection": false,
-	"features.remoteAccess": true,
-	"features.agentCluster": false,
-	"features.smartHome": true,
-	"features.recordings": true,
-	"features.backup": true,
-	"features.repl": true,
-	"retention.detectionEventsDays": 30,
-	"retention.audioLevelsDays": 7,
-	"logging.level": "info",
-	"logging.retentionDays": 30,
-	"eventBus.ringBufferSize": 1e4,
-	"storage.provider": "sqlite-storage",
-	"storage.locations": {
-		data: "camstack-data/data",
-		media: "camstack-data/media",
-		recordings: "camstack-data/recordings",
-		cache: "/tmp/camstack-cache",
-		logs: "camstack-data/logs",
-		models: "camstack-data/models"
-	},
-	providers: [],
-	"ffmpeg.binaryPath": "ffmpeg",
-	"ffmpeg.hwAccel": "auto",
-	"ffmpeg.threadCount": 0,
-	"auth.tokenExpiry": "7d"
-};
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
+]);
 /**
-* Accessory device helpers — shared across drivers.
-*
-* Many vendor-specific drivers register accessory child devices on
-* top of a parent (Reolink: siren / floodlight / PIR / autotrack /
-* chime; ONVIF: relay outputs; future: Tapo Hub child devices). Each
-* driver picks the right `DeviceType` + `DeviceRole` explicitly when
-* spawning, builds a name derived from the parent, and produces a
-* stableId tied to the parent so boot-restore can reconstruct the
-* relationship.
-*
-* Centralised `(kind → DeviceType)` mapping was dropped on purpose:
-* drivers may reasonably disagree on the right type for an accessory
-* (a Reolink PIR exposes a switch on/off + sensitivity, while a hypothetical
-* read-only motion-only sensor might be `DeviceType.Sensor`). Forcing
-* one canonical mapping was over-prescriptive and added a layer of
-* indirection without saving meaningful code at call sites — the
-* driver knows its own hardware best.
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
 */
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	}
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
 /**
-* Subset of `DeviceRole` values that drivers register as child
-* accessories of a parent device. Sourced verbatim from `DeviceRole`
-* — `AccessoryKind` is the alias drivers use when building accessory
-* children, so the call site reads as
-* `accessoryStableId(parent, AccessoryKind.Siren)` rather than
-* `accessoryStableId(parent, DeviceRole.Siren)` (which would imply
-* any role works, including non-accessory ones like Doorbell).
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
+*
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
+*
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
 */
-var AccessoryKind = {
-	Siren: DeviceRole.Siren,
-	Floodlight: DeviceRole.Floodlight,
-	Spotlight: DeviceRole.Spotlight,
-	PirSensor: DeviceRole.PirSensor,
-	Chime: DeviceRole.Chime,
-	Autotrack: DeviceRole.Autotrack,
-	Nightvision: DeviceRole.Nightvision,
-	PrivacyMask: DeviceRole.PrivacyMask
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
 };
-AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
-new Set(Object.values(DeviceType));
-/** Apply a link transform to a resolved source value. `identity`/undefined
-*  pass through; `enum-map` remaps strings (fallback or null when unknown);
-*  `linear` does scale*x+offset with optional clamp (null for non-numbers). */
-function applyTransform(value, transform) {
-	if (!transform || transform.kind === "identity") return value;
-	if (transform.kind === "enum-map") {
-		const key = String(value);
-		if (Object.prototype.hasOwnProperty.call(transform.mapping, key)) return transform.mapping[key];
-		return transform.fallback ?? null;
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
+		};
+	}
+	peek() {
+		return this.tokens[this.pos];
+	}
+	next() {
+		return this.tokens[this.pos++];
+	}
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
 	}
-	if (transform.kind === "linear") {
-		if (typeof value !== "number" || Number.isNaN(value)) return null;
-		let out = value * transform.scale + transform.offset;
-		if (transform.clamp) {
-			const min = transform.clamp[0];
-			const max = transform.clamp[1];
-			out = Math.min(max, Math.max(min, out));
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
 		}
-		return out;
+		return false;
 	}
-	return value;
-}
-DeviceFeature.BatteryOperated;
-/** Returns true when `x` is a non-null, non-array plain object. */
-function isRecord(x) {
-	return x !== null && typeof x === "object" && !Array.isArray(x);
-}
-/** Read a dot-path (`a.b.c`) out of an object. Returns `undefined` for any
-*  missing/non-object segment — never throws. */
-function getByPath(obj, path) {
-	const parts = path.split(".");
-	let cur = obj;
-	for (const part of parts) {
-		if (!isRecord(cur)) return void 0;
-		cur = cur[part];
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
 	}
-	return cur;
-}
-/** Immutably set a dot-path on an object, returning a new object. Intermediate
-*  objects are created when a segment is missing or null. Arrays are NOT
-*  traversed (P1 has no array-index syntax — see `itemKey` grouping in P2): if a
-*  segment resolves to an array it is replaced by a fresh object, so the array
-*  is discarded — the only caller (`mergeLinkedStatus`) re-validates the result
-*  with the target cap's Zod schema and rejects a malformed overlay.
-*  The return type `T` preserves the OUTER shape; the rewritten key is not
-*  narrowed, so callers should re-validate against the status schema. */
-function setByPath(obj, path, value) {
-	const dotIndex = path.indexOf(".");
-	if (dotIndex === -1) return {
-		...obj,
-		[path]: value
-	};
-	const head = path.slice(0, dotIndex);
-	const tail = path.slice(dotIndex + 1);
-	const child = obj[head];
-	const childObj = isRecord(child) ? child : {};
-	return {
-		...obj,
-		[head]: setByPath(childObj, tail, value)
-	};
-}
-/** Unwrap ZodNullable / ZodOptional / ZodDefault wrappers to reach the inner type.
-*  Zod v4 exposes `.unwrap()` on all three wrapper classes. */
-function unwrap(schema) {
-	let s = schema;
-	while (s instanceof zod.z.ZodNullable || s instanceof zod.z.ZodOptional || s instanceof zod.z.ZodDefault) s = s.unwrap();
-	return s;
-}
-function leafKind(schema) {
-	const s = unwrap(schema);
-	if (s instanceof zod.z.ZodEnum) return {
-		kind: "enum",
-		enumValues: s.options
-	};
-	if (s instanceof zod.z.ZodNumber) return { kind: "number" };
-	if (s instanceof zod.z.ZodString) return { kind: "string" };
-	if (s instanceof zod.z.ZodBoolean) return { kind: "boolean" };
-	return null;
-}
-/** Walk a cap status schema into flat wireable leaf fields (dotted paths).
-*  Recurses into nested ZodObject (unwrapping nullable/optional/default first),
-*  so fields with null live values are still offered. Arrays / unknown shapes
-*  are skipped — never throws. */
-function enumerateSchemaFields(schema, prefix = "") {
-	const root = unwrap(schema);
-	if (!(root instanceof zod.z.ZodObject)) return [];
-	const out = [];
-	const shape = root.shape;
-	for (const [key, field] of Object.entries(shape)) {
-		const path = prefix ? `${prefix}.${key}` : key;
-		const inner = unwrap(field);
-		if (inner instanceof zod.z.ZodObject) {
-			out.push(...enumerateSchemaFields(inner, path));
-			continue;
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
 		}
-		const leaf = leafKind(field);
-		if (leaf) out.push({
-			path,
-			kind: leaf.kind,
-			...leaf.enumValues ? { enumValues: leaf.enumValues } : {}
-		});
+		return test;
+	}
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
+				};
+			}
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
+	}
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
+	}
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
+/**
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
+*
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
+*/
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
 	}
-	return out;
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
+	}
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
+	}
+	return result;
 }
-/** Enumerate the per-item wireable fields of an item-array cap (see
-*  `CapabilityStatusItemArray`): the item schema's leaf fields, minus the
-*  `keyField` (the key comes from the link's `itemKey`, never from a wired
-*  source), each tagged `item: true` so the authoring UI collects an
-*  `itemKey` alongside the field. Never throws. */
-function enumerateItemArrayFields(itemArray) {
-	return enumerateSchemaFields(itemArray.itemSchema).filter((f) => f.path !== itemArray.keyField).map((f) => ({
-		...f,
-		item: true
-	}));
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
+}
+Object.freeze({});
+/**
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
+	}
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	}
+	return null;
 }
 /**
+* What an expression's named bindings READ from.
+*
+* Salvaged verbatim from the deleted device-link mechanism. Wiring's source
+* kinds were the one part of it worth keeping: addressing a device field by
+* re-sync-stable `stableId`, a per-device constant, and a sibling-accessory
+* read are the vocabulary any cross-device derivation needs, and they were
+* already correct. What wiring got wrong was the DESTINATION — a field on
+* somebody else's device, with no identity — not the source.
+*
+* These shapes are therefore kept, re-homed next to the engine that consumes
+* them, and are the binding type of a composition recipe (the source picker
+* stays `deviceManager.getWireableFields`). They deliberately do NOT nest: a
+* binding is a read, never another expression.
+*
+* Schemas are authoritative; every type is `z.infer` of one, so a wire shape and
+* a TypeScript shape cannot drift apart (`scripts/check-schema-type-twins.ts`).
+*/
+/** Read a sibling accessory's status field, addressed by the sibling's key.
+*  `kind` is optional for wire compatibility — absent means `'field'`. */
+var ExpressionFieldBindingSchema = zod.z.object({
+	kind: zod.z.literal("field").optional(),
+	sourceKey: zod.z.string(),
+	cap: zod.z.string(),
+	fieldPath: zod.z.string()
+});
+/** A constant. No device is read. */
+var ExpressionLiteralBindingSchema = zod.z.object({
+	kind: zod.z.literal("literal"),
+	value: zod.z.union([
+		zod.z.string(),
+		zod.z.number(),
+		zod.z.boolean(),
+		zod.z.null()
+	])
+});
+/** Read ANY device's status field, addressed by its re-sync-stable `stableId` —
+*  never by numeric id, which a re-adoption reissues. */
+var ExpressionGlobalBindingSchema = zod.z.object({
+	kind: zod.z.literal("global"),
+	sourceStableId: zod.z.string(),
+	cap: zod.z.string(),
+	fieldPath: zod.z.string()
+});
+var ExpressionBindingSourceSchema = zod.z.union([
+	ExpressionFieldBindingSchema,
+	ExpressionLiteralBindingSchema,
+	ExpressionGlobalBindingSchema
+]);
+zod.z.object({
+	expr: zod.z.string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: zod.z.record(zod.z.string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+/**
 * Runtime list of cap names with status. Used by the settings
 * aggregator to enumerate caps whose `status` should be polled +
 * streamed via `subscribeDeviceStatusAggregate`.
@@ -27572,6 +27469,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.restart": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.setEnabled": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -28208,12 +28111,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"deviceManager.setDeviceLinks": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"deviceManager.setDisabled": {
 		capName: "device-manager",
 		capScope: "system",
@@ -32250,60 +32147,6 @@ TimelapseRuleInputSchema.extend({
 	createdAt: zod.z.number(),
 	updatedAt: zod.z.number()
 });
-/**
-* The addon id as the REGISTRY, the wire and the durable stores spell it.
-*
-* `AddonContext.id` does not agree with itself across the two context
-* factories:
-*
-*   - a FORKED addon gets the bare manifest id
-*     (`kernel/moleculer/addon-context-factory.ts` → `id: addonId`);
-*   - an addon co-located in hub-main gets it PREFIXED
-*     (`server/backend/src/core/addon/addon-registry.service.ts` →
-*      ``id: `addon:${addonId}` ``).
-*
-* Everything an addon might compare `ctx.id` AGAINST carries the bare form:
-* `DeviceBindingEntry.providerAddonId`, the `device-manager` bindings store's
-* `wrapperAddonId`, `CapabilityRegistry` provider keys, manifest ids.
-*
-* So `entry.providerAddonId === this.ctx.id` is silently, permanently false
-* for a builtin — and only for a builtin, which is why it survives a green
-* suite whose fake supplies the bare id. That is exactly how camera 615's
-* virtual doorbell latched `unbound` for twelve hours on 2026-08-07 while its
-* binding was intact ([D72](../../../../docs/decisions/adr-0072.md)).
-*
-* Route every comparison between `ctx.id` and a registry/store addon id
-* through {@link isSameAddonId}. `scripts/check-addon-id-comparison.ts`
-* enforces it in the processes where the prefix exists.
-*/
-/** The prefix the hub-main context factory prepends to the manifest id. */
-var ADDON_ID_PREFIX = "addon:";
-/** The manifest id, whichever spelling of `ctx.id` you were handed. */
-function bareAddonId(id) {
-	return id.startsWith(ADDON_ID_PREFIX) ? id.slice(6) : id;
-}
-/** True when both ids name the same addon, prefixed or not. */
-function isSameAddonId(a, b) {
-	return bareAddonId(a) === bareAddonId(b);
-}
-/**
-* Decode base64 little-endian Float32 back into a vector.
-*
-* Throws on a byte length that is not a multiple of 4 — a truncated vector
-* would otherwise silently rank against a shorter one and produce a plausible
-* score, which is worse than an error.
-*/
-function decodeVectorBase64(encoded) {
-	const buffer = Buffer.from(encoded, "base64");
-	if (buffer.byteLength % 4 !== 0) throw new Error(`decodeVectorBase64: ${buffer.byteLength} bytes is not a whole number of Float32 values`);
-	const out = new Float32Array(buffer.byteLength / 4);
-	for (let i = 0; i < out.length; i += 1) out[i] = buffer.readFloatLE(i * 4);
-	return out;
-}
-/** Vector length implied by a base64 payload, without decoding it. */
-function vectorDimFromBase64(encoded) {
-	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
-}
 zod.z.object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -32411,6 +32254,60 @@ DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 /**
+* The addon id as the REGISTRY, the wire and the durable stores spell it.
+*
+* `AddonContext.id` does not agree with itself across the two context
+* factories:
+*
+*   - a FORKED addon gets the bare manifest id
+*     (`kernel/moleculer/addon-context-factory.ts` → `id: addonId`);
+*   - an addon co-located in hub-main gets it PREFIXED
+*     (`server/backend/src/core/addon/addon-registry.service.ts` →
+*      ``id: `addon:${addonId}` ``).
+*
+* Everything an addon might compare `ctx.id` AGAINST carries the bare form:
+* `DeviceBindingEntry.providerAddonId`, the `device-manager` bindings store's
+* `wrapperAddonId`, `CapabilityRegistry` provider keys, manifest ids.
+*
+* So `entry.providerAddonId === this.ctx.id` is silently, permanently false
+* for a builtin — and only for a builtin, which is why it survives a green
+* suite whose fake supplies the bare id. That is exactly how camera 615's
+* virtual doorbell latched `unbound` for twelve hours on 2026-08-07 while its
+* binding was intact ([D72](../../../../docs/decisions/adr-0072.md)).
+*
+* Route every comparison between `ctx.id` and a registry/store addon id
+* through {@link isSameAddonId}. `scripts/check-addon-id-comparison.ts`
+* enforces it in the processes where the prefix exists.
+*/
+/** The prefix the hub-main context factory prepends to the manifest id. */
+var ADDON_ID_PREFIX = "addon:";
+/** The manifest id, whichever spelling of `ctx.id` you were handed. */
+function bareAddonId(id) {
+	return id.startsWith(ADDON_ID_PREFIX) ? id.slice(6) : id;
+}
+/** True when both ids name the same addon, prefixed or not. */
+function isSameAddonId(a, b) {
+	return bareAddonId(a) === bareAddonId(b);
+}
+/**
+* Decode base64 little-endian Float32 back into a vector.
+*
+* Throws on a byte length that is not a multiple of 4 — a truncated vector
+* would otherwise silently rank against a shorter one and produce a plausible
+* score, which is worse than an error.
+*/
+function decodeVectorBase64(encoded) {
+	const buffer = Buffer.from(encoded, "base64");
+	if (buffer.byteLength % 4 !== 0) throw new Error(`decodeVectorBase64: ${buffer.byteLength} bytes is not a whole number of Float32 values`);
+	const out = new Float32Array(buffer.byteLength / 4);
+	for (let i = 0; i < out.length; i += 1) out[i] = buffer.readFloatLE(i * 4);
+	return out;
+}
+/** Vector length implied by a base64 payload, without decoding it. */
+function vectorDimFromBase64(encoded) {
+	return Math.floor(Buffer.from(encoded, "base64").byteLength / 4);
+}
+/**
 * Scores all applicable inference backends for the given hardware.
 *
 * Rules (hardware-driven only — no Python import probes):
@@ -32560,6 +32457,12 @@ Object.defineProperty(exports, "CAP_NAMES_WITH_STATUS", {
 		return CAP_NAMES_WITH_STATUS;
 	}
 });
+Object.defineProperty(exports, "CORE_BLOCK_ADDON_PREFIX", {
+	enumerable: true,
+	get: function() {
+		return CORE_BLOCK_ADDON_PREFIX;
+	}
+});
 Object.defineProperty(exports, "CoreBlockSchema", {
 	enumerable: true,
 	get: function() {
@@ -32692,12 +32595,6 @@ Object.defineProperty(exports, "alertsCapability", {
 		return alertsCapability;
 	}
 });
-Object.defineProperty(exports, "applyTransform", {
-	enumerable: true,
-	get: function() {
-		return applyTransform;
-	}
-});
 Object.defineProperty(exports, "asJsonObject", {
 	enumerable: true,
 	get: function() {
@@ -32740,6 +32637,18 @@ Object.defineProperty(exports, "buildStreamParamsConfigSchema", {
 		return buildStreamParamsConfigSchema;
 	}
 });
+Object.defineProperty(exports, "coreBlockAddonId", {
+	enumerable: true,
+	get: function() {
+		return coreBlockAddonId;
+	}
+});
+Object.defineProperty(exports, "coreBlockIdFromAddonId", {
+	enumerable: true,
+	get: function() {
+		return coreBlockIdFromAddonId;
+	}
+});
 Object.defineProperty(exports, "coreBlocksCapability", {
 	enumerable: true,
 	get: function() {
@@ -32824,12 +32733,6 @@ Object.defineProperty(exports, "errMsg", {
 		return errMsg;
 	}
 });
-Object.defineProperty(exports, "evaluateLinkExpression", {
-	enumerable: true,
-	get: function() {
-		return evaluateLinkExpression;
-	}
-});
 Object.defineProperty(exports, "expandCapMethods", {
 	enumerable: true,
 	get: function() {
@@ -32848,12 +32751,6 @@ Object.defineProperty(exports, "filesystemBrowseCapability", {
 		return filesystemBrowseCapability;
 	}
 });
-Object.defineProperty(exports, "getByPath", {
-	enumerable: true,
-	get: function() {
-		return getByPath;
-	}
-});
 Object.defineProperty(exports, "hydrateSchema", {
 	enumerable: true,
 	get: function() {
@@ -32950,6 +32847,12 @@ Object.defineProperty(exports, "normalizeUnit", {
 		return normalizeUnit;
 	}
 });
+Object.defineProperty(exports, "oauthIntegrationCapability", {
+	enumerable: true,
+	get: function() {
+		return oauthIntegrationCapability;
+	}
+});
 Object.defineProperty(exports, "objectInputDeclaresAddonId", {
 	enumerable: true,
 	get: function() {
@@ -33010,12 +32913,6 @@ Object.defineProperty(exports, "scoreRuntimes", {
 		return scoreRuntimes;
 	}
 });
-Object.defineProperty(exports, "setByPath", {
-	enumerable: true,
-	get: function() {
-		return setByPath;
-	}
-});
 Object.defineProperty(exports, "settingsStoreCapability", {
 	enumerable: true,
 	get: function() {
@@ -33052,24 +32949,12 @@ Object.defineProperty(exports, "streamQualityLabel", {
 		return streamQualityLabel;
 	}
 });
-Object.defineProperty(exports, "toExpressionValue", {
-	enumerable: true,
-	get: function() {
-		return toExpressionValue;
-	}
-});
 Object.defineProperty(exports, "userManagementCapability", {
 	enumerable: true,
 	get: function() {
 		return userManagementCapability;
 	}
 });
-Object.defineProperty(exports, "validateExpressionSource", {
-	enumerable: true,
-	get: function() {
-		return validateExpressionSource;
-	}
-});
 Object.defineProperty(exports, "vectorDimFromBase64", {
 	enumerable: true,
 	get: function() {