@camstack/system 1.2.66 → 1.2.67

package/dist/{dist-DqPyKwVB.mjs → dist-CbS6uoSb.mjs}

@@ -4050,1526 +4050,2326 @@ var ConvertResultSchema = z.object({
 	artifacts: z.array(ConvertArtifactSchema).readonly()
 });
 /**
-* `addon-pages` — system-scoped singleton aggregator cap. Public-facing
-* surface that admin-ui consumes through `useAddonPagesListPages()`.
-*
-* The provider iterates every `addon-pages-source` (collection) provider
-* and emits `AddonPageInfo[]` enriched with versioned `bundleUrl` strings
-* pointing at `/api/addon-pages/<addonId>/<bundle>?v=<mtime>`. The
-* filesystem `mtime` cache-buster lets the browser pick up addon
-* rebuilds without manual reload.
-*
-* The hub-local builtin `addon-pages-aggregator` (see
-* `@camstack/system/builtins/addon-pages-aggregator`) registers the
-* provider. Splitting the public aggregator from the raw collection
-* keeps both ends in codegen — there's no hand-written
-* `addon-pages.router.ts` wrapper anymore.
-*/
-var AddonPageDeclarationSchema$1 = z.object({
-	id: z.string(),
-	label: z.string(),
-	icon: z.string(),
-	path: z.string(),
-	remoteName: z.string(),
-	bundle: z.string(),
-	section: z.string().optional(),
-	sectionLabel: z.string().optional()
-});
-var AddonPageInfoSchema = z.object({
-	addonId: z.string(),
-	page: AddonPageDeclarationSchema$1,
-	bundleUrl: z.string()
-});
-var addonPagesCapability = {
-	name: "addon-pages",
-	scope: "system",
-	mode: "singleton",
-	methods: { listPages: method(z.void(), z.array(AddonPageInfoSchema).readonly()) }
-};
-/**
-* `addon-pages-source` — collection cap exposing per-provider raw page
-* declarations. Every addon that contributes a UI page registers a
-* provider here. The hub-side singleton aggregator (`addon-pages` cap,
-* see `addon-pages.cap.ts`) walks this collection, stamps versioned
-* `bundleUrl` values, and returns the enriched `AddonPageInfo[]` list
-* that admin-ui consumes.
-*
-* The split exists because the public listing has a different output
-* shape than the per-provider raw declarations, and we want both ends
-* to flow through codegen instead of relying on a hand-written wrapper.
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
 */
-var AddonPageDeclarationSchema = z.object({
-	id: z.string(),
-	label: z.string(),
-	icon: z.string(),
-	path: z.string(),
-	/**
-	* Module Federation remote name — must match the `name` field on the
-	* page addon's `federation()` plugin config. Used by admin-ui's
-	* `<AddonPageLoader>` to call `loadRemote('<remoteName>/page')`.
-	* Conventionally `addon_<id>_page` (snake_case; MF names cannot
-	* contain hyphens).
-	*/
-	remoteName: z.string(),
-	/**
-	* Bundle filename inside the addon's `dist/` dir served at
-	* `/api/addon-pages/<addonId>/<bundle>`. With Module Federation this
-	* is always `'remoteEntry.js'`; the value is kept on the metadata so
-	* the static-file route can compute an mtime-based cache-buster URL
-	* without a separate filesystem stat.
-	*/
-	bundle: z.string(),
-	/**
-	* Sidebar section this page docks into. Well-known ids: `'detection'`,
-	* `'cluster'`, `'administration'` — the page renders inside that group.
-	* Any OTHER string creates (or joins) a custom section rendered after
-	* the built-in groups; its label comes from `sectionLabel` (first
-	* declaration wins), falling back to the id. Absent → the legacy
-	* "Addon Pages" group.
-	*/
-	section: z.string().optional(),
-	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
-	sectionLabel: z.string().optional()
-});
-var addonPagesSourceCapability = {
-	name: "addon-pages-source",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: { listPages: method(z.void(), z.array(AddonPageDeclarationSchema).readonly()) }
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
 };
-var AddonHttpRouteSchema = z.object({
-	method: z.enum([
-		"GET",
-		"POST",
-		"PUT",
-		"DELETE",
-		"PATCH"
-	]),
-	path: z.string(),
-	access: z.enum([
-		"public",
-		"authenticated",
-		"admin"
-	]).optional(),
-	description: z.string().optional()
-});
-/**
-* Cross-process route invocation envelope. The hub captures the
-* request as plain data, ships it to the worker via Moleculer, and
-* the worker runs the local handler against a capturing reply. The
-* envelope returned describes what the handler intended (status,
-* headers, body, or a redirect) so the hub can translate it back to
-* the Fastify reply that's actually wired to the socket.
-*/
-var InvokeRequestSchema = z.object({
-	method: z.string(),
-	path: z.string(),
-	params: z.record(z.string(), z.string()),
-	query: z.record(z.string(), z.string()),
-	body: z.unknown(),
-	headers: z.record(z.string(), z.string()),
-	user: z.object({
-		id: z.string(),
-		username: z.string(),
-		isAdmin: z.boolean()
-	}).optional(),
-	scopedToken: z.unknown().optional()
-});
-var InvokeReplyEnvelopeSchema = z.object({
-	status: z.number().int(),
-	headers: z.record(z.string(), z.string()),
-	/** When set, the hub MUST `reply.redirect(redirectUrl)` instead of
-	*  sending `body`. Status defaults to 302 when this is set unless
-	*  the handler called `reply.code(...)` explicitly. */
-	redirectUrl: z.string().nullable(),
-	/** JSON-serializable body. `undefined` is treated as "no body". */
-	body: z.unknown().optional(),
-	/** Set when the handler called `reply.type(mime)`. */
-	contentType: z.string().optional()
-});
-var addonRoutesCapability = {
-	name: "addon-routes",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: {
-		getRoutes: method(z.void(), z.array(AddonHttpRouteSchema)),
-		/**
-		* Cross-process dispatch entry point. Forked addons implement this
-		* (via `buildAddonRouteProvider`) so the hub's Fastify catch-all
-		* can route through Moleculer when the handler lives in a worker.
-		*
-		* Local addons can implement it for free with the same helper;
-		* the hub bypasses the wire on co-located addons.
-		*/
-		invoke: method(InvokeRequestSchema, InvokeReplyEnvelopeSchema, { kind: "mutation" })
-	},
-	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
-	mount: { kind: "skip" }
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
 };
-var ConfigTabDeclarationSchema = z.object({
-	id: z.string(),
-	label: z.string(),
-	icon: z.string(),
-	order: z.number().optional()
-});
-var ConfigSectionWithValuesSchema = z.object({
-	id: z.string(),
-	title: z.string(),
-	description: z.string().optional(),
-	style: z.enum(["card", "accordion"]).optional(),
-	defaultCollapsed: z.boolean().optional(),
-	columns: z.union([
-		z.literal(1),
-		z.literal(2),
-		z.literal(3),
-		z.literal(4)
-	]).optional(),
-	tab: z.string().optional(),
-	location: z.enum(["settings", "top-tab"]).optional(),
-	order: z.number().optional(),
-	fields: z.array(z.any())
-});
-var SettingsSchemaWithValuesSchema = z.object({
-	tabs: z.array(ConfigTabDeclarationSchema).optional(),
-	sections: z.array(ConfigSectionWithValuesSchema)
-});
-/** Patch object — keys are field names, values are the new field values. */
-var SettingsPatchSchema = z.record(z.string(), z.unknown());
-/** Standard success response for update operations. */
-var SettingsUpdateResultSchema = z.object({ success: z.literal(true) });
 /**
-* addon-settings — singleton gateway for three-level addon settings.
-*
-* Works like `device-manager`: a single hub-side provider that resolves
-* `addonId` to the target addon and delegates the call. For hub-local
-* addons the call is direct; for remote agents it proxies via the
-* per-addon Moleculer service.
-*
-* Replaces the `$addonHost` Moleculer service. Transport transparency
-* is handled by the provider implementation — callers (admin UI, other
-* addons via `ctx.api`) never know which node hosts the target addon.
+* Frozen, null-prototype builtin function table for the expression engine
+* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
+* parser rejects any callee not in it, and the evaluator gates each call on an
+* own-property check against it.
 *
-* Three levels:
-*   - **addon**: addon-scoped settings (installation config, API keys, …)
-*   - **global**: settings applied to all devices by default
-*   - **device**: per-device overrides
+* Because the object has a NULL prototype AND is `Object.freeze`d:
+*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
+*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
+*    (there is no `Object.prototype` in the chain), so those names are not
+*    callable — they are simply "unknown function" at parse time.
 *
-* Optional `nodeId` allows explicit node targeting. When absent the
-* provider resolves the addon's host node automatically.
-*/
-/**
-* `addon-settings` is a **hub-centric** cap: the hub hosts the single
-* provider, and `nodeId` in the input is data for the hub provider's
-* internal dispatcher, not a routing hint for the cap-router. See
-* `CapabilityDefinition.nodeIdMode` for the contract.
+* Every numeric argument is validated as a finite number and every numeric
+* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
+* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
+* closed rather than emitting a garbage value.
 */
-var addonSettingsCapability = {
-	name: "addon-settings",
-	scope: "system",
-	mode: "singleton",
-	nodeIdMode: "data",
-	methods: {
-		getGlobalSettings: method(z.object({
-			addonId: z.string(),
-			nodeId: z.string().optional(),
-			overlay: z.record(z.string(), z.unknown()).optional(),
-			cap: z.string().optional()
-		}), SettingsSchemaWithValuesSchema.nullable()),
-		updateGlobalSettings: method(z.object({
-			addonId: z.string(),
-			nodeId: z.string().optional(),
-			patch: SettingsPatchSchema
-		}), SettingsUpdateResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		getDeviceSettings: method(z.object({
-			addonId: z.string(),
-			deviceId: z.number(),
-			nodeId: z.string().optional()
-		}), SettingsSchemaWithValuesSchema.nullable()),
-		updateDeviceSettings: method(z.object({
-			addonId: z.string(),
-			deviceId: z.number(),
-			nodeId: z.string().optional(),
-			patch: SettingsPatchSchema
-		}), SettingsUpdateResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		})
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString$1(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString$1(args[1], "convert", 1).trim();
+			const to = asString$1(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
 	}
 };
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
 /**
-* `addon-widgets-source` — collection cap exposing per-addon raw widget
-* declarations. Mirrors the addon-pages split: every addon shipping
-* widgets registers a provider on this collection cap; the hub-local
-* aggregator (`addon-widgets`, see `addon-widgets.cap.ts`) walks the
-* collection, stamps versioned `bundleUrl`s onto each declaration, and
-* exposes the public listing surface that admin-ui consumes.
-*
-* The split exists because the public listing has a different output
-* shape (flat enriched metadata with `addonId` + `bundleUrl`) than the
-* per-provider raw declarations. Both ends flow through codegen.
+* Resource-bound constants for the safe expression engine.
 *
-* Unified UI-contribution model (Task 10): a widget descriptor IS a
-* `UiContribution` with `kind:'remote'`. The host renders it through the
-* same `ContributionRenderer` / Module-Federation path as every other
-* contributed UI surface — no bespoke widget-rendering path. The widget-
-* only metadata (sizing hints, `requires`) lives as extra fields on the
-* descriptor; the `UiContribution` core (`tab` / `label` / `order` /
-* `kind` / `remote`) carries identity + placement + the MF remote.
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
 */
-/** Where the widget makes sense to render — maps to a contribution `tab`. */
-var WidgetHostEnum = z.enum([
-	"device-tab",
-	"dashboard",
-	"integration-detail"
-]);
-var WidgetSizeEnum = z.enum([
-	"xs",
-	"sm",
-	"md",
-	"lg",
-	"xl"
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
 ]);
 /**
-* MF remote descriptor — mirrors `UiContributionRemote` from
-* `capability-definition.ts`. Widget remotes expose a single
-* `'./widgets'` module whose default export is a
-* `Record<componentKey, Component>` map; `componentKey` (the widget
-* `stableId`) picks the entry the host mounts.
-*/
-var WidgetRemoteSchema = z.object({
-	remoteName: z.string(),
-	exposedModule: z.string(),
-	componentKey: z.string().optional()
-});
-/**
-* One widget declaration — a `UiContribution` (`kind:'remote'`) plus
-* widget-only metadata. The `UiContribution` core fields:
-*
-*  - `tab`     — where the widget hosts. A widget that runs on the
-*                dashboard declares `tab:'dashboard'`; a device-tab
-*                widget declares the target device-detail tab id.
-*  - `subTab`  — optional sub-tab within `tab`.
-*  - `label`   — operator-facing label.
-*  - `order`   — ordering within `(tab, subTab)`.
-*  - `kind`    — always `'remote'` for widgets.
-*  - `remote`  — the MF remote `{ remoteName, exposedModule, componentKey }`.
-*
-* Widget-only fields retained alongside the contribution core:
-*
-*  - `stableId`      — stable identity within the addon (the MF
-*                      `componentKey`; kept top-level so consumers have
-*                      a stable key without reaching into `remote`).
-*  - `description` / `icon` — picker metadata.
-*  - `bundle`        — entry filename inside the addon `dist/` dir; the
-*                      aggregator stamps a versioned `bundleUrl` from it.
-*  - `hosts`         — every host the widget supports (a widget can run
-*                      both on the dashboard and a device tab). `tab`
-*                      is the PRIMARY host; `hosts` is the full set the
-*                      picker filters on.
-*  - `requires`      — host-context requirements validated at mount.
-*  - `defaultSize` / `allowedSizes` / `defaultColumns` / `defaultRows`
-*                    — dashboard placement hints.
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
 */
-var WidgetMetadataSchema = z.object({
-	/** Primary host tab — `'dashboard'`, `'device-tab'`, or a device-detail tab id. */
-	tab: z.string(),
-	/** Optional sub-tab within `tab`. */
-	subTab: z.string().optional(),
-	/** Operator-facing label. */
-	label: z.string(),
-	/** Ordering within `(tab, subTab)`, ascending. */
-	order: z.number().optional(),
-	/** Always `'remote'` — a widget is a Module Federation remote. */
-	kind: z.literal("remote"),
-	/** MF remote descriptor. */
-	remote: WidgetRemoteSchema,
-	/** Stable id within the addon — kebab-case. Equals `remote.componentKey`. */
-	stableId: z.string(),
-	description: z.string().optional(),
-	icon: z.string().optional(),
-	/**
-	* Bundle filename inside the addon's `dist/` dir served at
-	* `/api/addon-widgets/<addonId>/<bundle>`. With Module Federation
-	* this is always `'remoteEntry.js'` — the value is kept on the
-	* metadata so the static-file route can compute an mtime-based
-	* cache-buster URL without a separate filesystem stat.
-	*/
-	bundle: z.string(),
-	/** Every host the widget supports. The picker filters on this set. */
-	hosts: z.array(WidgetHostEnum).readonly(),
-	/** Required props the host must supply. Validated at `<WidgetSlot>` mount. */
-	requires: z.object({
-		deviceContext: z.boolean().default(false),
-		integrationContext: z.boolean().default(false)
-	}),
-	/**
-	* Loadable BEFORE authentication. The normal widget registry listing
-	* (`addon-widgets.listWidgets`) is auth-gated, so a pre-auth surface
-	* (the login page) cannot discover a widget through it. A widget that
-	* declares `preAuth: true` marks itself as safe to mount on a pre-auth
-	* screen — it is surfaced through the PUBLIC `auth.listLoginMethods`
-	* login-method contribution channel (see `login-method.cap.ts`) rather
-	* than the authenticated registry, and its bundle is served by the
-	* public `/api/addon-widgets/:addonId/*` static route. Defaults false.
-	*/
-	preAuth: z.boolean().optional().default(false),
-	/** Dashboard placement HINTS (operator can override per instance). */
-	defaultSize: WidgetSizeEnum.default("md"),
-	allowedSizes: z.array(WidgetSizeEnum).readonly().default([
-		"sm",
-		"md",
-		"lg"
-	]),
-	defaultColumns: z.number().int().min(1).max(12).default(6),
-	defaultRows: z.number().int().min(1).max(12).default(1)
-});
-var addonWidgetsSourceCapability = {
-	name: "addon-widgets-source",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: { listWidgets: method(z.void(), z.array(WidgetMetadataSchema).readonly()) }
-};
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	}
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
 /**
-* `addon-widgets` — system-scoped singleton aggregator cap. Public-facing
-* surface that admin-ui consumes through `useAddonWidgetsListWidgets()`.
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
 *
-* The provider iterates every `addon-widgets-source` (collection)
-* provider and emits `EnrichedWidgetMetadata[]` enriched with versioned
-* `bundleUrl` strings pointing at
-* `/api/addon-widgets/<addonId>/<bundle>?v=<mtime>`. The filesystem
-* `mtime` cache-buster lets the browser pick up addon rebuilds without
-* manual reload — same scheme used by `addon-pages`.
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
 *
-* The hub-local builtin `addon-widgets-aggregator` (see
-* `@camstack/system/builtins/addon-widgets-aggregator`) registers the
-* provider. Splitting the public aggregator from the raw collection
-* keeps both ends in codegen — there's no hand-written wrapper.
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
 */
-var EnrichedWidgetMetadataSchema = WidgetMetadataSchema.extend({
-	addonId: z.string(),
-	bundleUrl: z.string()
-});
-var addonWidgetsCapability = {
-	name: "addon-widgets",
-	scope: "system",
-	mode: "singleton",
-	methods: { listWidgets: method(z.void(), z.array(EnrichedWidgetMetadataSchema).readonly()) }
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
 };
-/**
-* Alerts capability — collection-based internal alert system.
-*
-* Multiple providers can register. Each provider filters by EventBus category
-* and creates/updates alerts. The built-in Alert Center addon persists alerts
-* in the DB and serves them to the admin UI.
-*/
-var AlertSeveritySchema = z.enum([
-	"info",
-	"success",
-	"warning",
-	"error"
-]);
-var AlertStatusSchema = z.enum([
-	"active",
-	"in-progress",
-	"completed",
-	"failed",
-	"dismissed"
-]);
-var AlertSourceSchema = z.object({
-	type: z.string(),
-	id: z.string()
-});
-var AlertSchema = z.object({
-	id: z.string(),
-	category: z.string(),
-	severity: AlertSeveritySchema,
-	title: z.string(),
-	message: z.string(),
-	status: AlertStatusSchema,
-	progress: z.number().optional(),
-	read: z.boolean(),
-	createdAt: z.number(),
-	updatedAt: z.number(),
-	source: AlertSourceSchema.optional(),
-	metadata: z.record(z.string(), z.unknown()).optional()
-});
-var alertsCapability = {
-	name: "alerts",
-	scope: "system",
-	mode: "singleton",
-	methods: {
-		emit: method(AlertSchema, z.void(), { kind: "mutation" }),
-		update: method(z.object({
-			alertId: z.string(),
-			patch: AlertSchema.partial()
-		}), z.void(), { kind: "mutation" }),
-		list: method(z.object({
-			unreadOnly: z.boolean().optional(),
-			limit: z.number().optional()
-		}).optional(), z.array(AlertSchema).readonly()),
-		getUnreadCount: method(z.void(), z.number()),
-		markRead: method(z.object({ alertId: z.string() }), z.void(), { kind: "mutation" }),
-		markAllRead: method(z.void(), z.void(), { kind: "mutation" }),
-		dismiss: method(z.object({ alertId: z.string() }), z.void(), { kind: "mutation" })
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
+		};
+	}
+	peek() {
+		return this.tokens[this.pos];
+	}
+	next() {
+		return this.tokens[this.pos++];
+	}
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
+	}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
+		}
+		return false;
+	}
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	}
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
+		}
+		return test;
+	}
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
+				};
+			}
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
+	}
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
 	}
 };
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
 /**
-* audio-analysis — device-scoped facade over the system `audio-analyzer`.
-*
-* Pairs with `audio-analyzer` (system, singleton) the way `camera-streams`
-* pairs with `stream-broker`: the system cap owns the compute path
-* (`processChunk`, engine lifecycle) while `audio-analysis` exposes the
-* per-device surface — settings resolution, device-settings contribution,
-* audio-level events — and is the binding row every camera sees in the
-* device-manager bindings UI.
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
 *
-* The cap definition itself declares `kind: 'wrapper'` and `defaultActive: true`,
-* so every camera picks up audio analysis automatically without any runtime flag
-* in the addon's registration. Operators can disable per-device via
-* `device-manager.setWrapperActive` when they don't want a given camera to be
-* analysed (e.g. muted / motion-only cams).
-*/
-var audioAnalysisCapability = {
-	name: "audio-analysis",
-	scope: "device",
-	mode: "singleton",
-	kind: "wrapper",
-	defaultActive: true,
-	deviceTypes: [DeviceType.Camera],
-	exposesDeviceSettings: true,
-	methods: { 
-	/**
-	* Resolve per-device audio analysis settings (minConfidence,
-	* allowedClasses) from the addon settings store for a given camera.
-	* Orchestrator callers use this before handing chunks to
-	* `audio-analyzer.processChunk`.
-	*/
-resolveDeviceSettings: method(z.object({ deviceId: z.number() }), z.custom()) },
-	events: { onAudioLevel: event(z.object({
-		deviceId: z.number(),
-		rms: z.number(),
-		dbfs: z.number()
-	})) }
-};
-/** Shared Zod schemas used across detection capabilities. */
-/**
-* Canonical frame-format enum mirrored on `FrameFormat` in
-* `packages/types/src/types/io.ts`. Kept inline (vs imported) so the
-* Zod runtime schema and TypeScript type stay in sync at the call site
-* — adding a new format requires changing both this enum and the
-* `FrameFormat` type alias together.
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
 */
-var FrameFormatSchema = z.enum([
-	"jpeg",
-	"rgb",
-	"bgr",
-	"yuv420",
-	"gray"
-]);
-var FrameInputSchema = z.object({
-	data: z.custom(),
-	format: FrameFormatSchema,
-	width: z.number(),
-	height: z.number(),
-	timestamp: z.number()
-});
-var BoundingBoxSchema = z.object({
-	x: z.number(),
-	y: z.number(),
-	w: z.number(),
-	h: z.number()
-});
-z.object({
-	class: z.string(),
-	originalClass: z.string(),
-	score: z.number(),
-	bbox: BoundingBoxSchema
-});
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
+	}
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
+	}
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
+	}
+	return result;
+}
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
+}
+Object.freeze({});
 /**
-* `data` carries the raw f32le bytes of the PCM samples (4 bytes per
-* sample, little-endian IEEE 754).  `Uint8Array` is the wire-safe choice
-* because `@msgpack/msgpack` serialises it as a MsgPack `bin` type that
-* round-trips losslessly over the UDS transport.  `Float32Array` is NOT
-* preserved — the encoder serialises it as `bin` (its raw bytes) but
-* the decoder returns `Uint8Array`, so treating a `Float32Array` as the
-* wire type causes receivers to read bytes as sample values, producing
-* wildly wrong RMS/dBFS results (~+43 dBFS instead of ≤0).
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
+	}
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	}
+	return null;
+}
+/**
+* What an expression's named bindings READ from.
 *
-* Callers that need float arithmetic reconstruct the view with:
-*   `new Float32Array(chunk.data.buffer, chunk.data.byteOffset, chunk.data.byteLength / 4)`
+* Salvaged verbatim from the deleted device-link mechanism. Wiring's source
+* kinds were the one part of it worth keeping: addressing a device field by
+* re-sync-stable `stableId`, a per-device constant, and a sibling-accessory
+* read are the vocabulary any cross-device derivation needs, and they were
+* already correct. What wiring got wrong was the DESTINATION — a field on
+* somebody else's device, with no identity — not the source.
+*
+* These shapes are therefore kept, re-homed next to the engine that consumes
+* them, and are the binding type of a composition recipe (the source picker
+* stays `deviceManager.getWireableFields`). They deliberately do NOT nest: a
+* binding is a read, never another expression.
+*
+* Schemas are authoritative; every type is `z.infer` of one, so a wire shape and
+* a TypeScript shape cannot drift apart (`scripts/check-schema-type-twins.ts`).
 */
-var AudioChunkInputSchema = z.object({
-	data: z.instanceof(Uint8Array),
-	sampleRate: z.number(),
-	channels: z.number(),
-	timestamp: z.number(),
-	/** Originating device id — used by the classifier for per-camera concurrency tracking. */
-	deviceId: z.number().optional()
+/** Read a sibling accessory's status field, addressed by the sibling's key.
+*  `kind` is optional for wire compatibility — absent means `'field'`. */
+var ExpressionFieldBindingSchema = z.object({
+	kind: z.literal("field").optional(),
+	sourceKey: z.string(),
+	cap: z.string(),
+	fieldPath: z.string()
 });
-var AudioLevelSchema = z.object({
-	rms: z.number(),
-	dbfs: z.number()
+/** A constant. No device is read. */
+var ExpressionLiteralBindingSchema = z.object({
+	kind: z.literal("literal"),
+	value: z.union([
+		z.string(),
+		z.number(),
+		z.boolean(),
+		z.null()
+	])
 });
-var AudioClassificationLabelSchema = z.object({
-	/**
-	* Primary display class. Depending on how the label was produced
-	* this is either the macro category (e.g. `dog`) or the raw
-	* backend label (e.g. `Dog bark`). Mirrors `class` on
-	* `SpatialDetection`.
-	*/
-	className: z.string(),
-	/**
-	* Raw backend-native label the classifier actually emitted (e.g.
-	* `Dog bark` for YAMNet, `dog_bark` for Apple SoundAnalysis). For
-	* macro-aggregated entries this is the top raw contributor. Mirrors
-	* `originalClass` on `SpatialDetection`.
-	*/
-	originalClass: z.string().optional(),
-	score: z.number()
+/** Read ANY device's status field, addressed by its re-sync-stable `stableId` —
+*  never by numeric id, which a re-adoption reissues. */
+var ExpressionGlobalBindingSchema = z.object({
+	kind: z.literal("global"),
+	sourceStableId: z.string(),
+	cap: z.string(),
+	fieldPath: z.string()
 });
-var AudioAnalysisResultSchema = z.object({
-	level: AudioLevelSchema,
-	classification: z.object({
-		labels: z.array(AudioClassificationLabelSchema).readonly(),
-		inferenceMs: z.number()
-	}).optional(),
-	timestamp: z.number()
+var ExpressionBindingSourceSchema = z.union([
+	ExpressionFieldBindingSchema,
+	ExpressionLiteralBindingSchema,
+	ExpressionGlobalBindingSchema
+]);
+z.object({
+	expr: z.string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: z.record(z.string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
 });
-var AudioAnalysisSettingsSchema = z.object({
-	minConfidence: z.number().min(0).max(1).default(.3),
-	allowedClasses: z.array(z.string()).default([])
+/** How a leaf compares a device field to a value. Derived from the field's
+*  `kind` in `deviceManager.getWireableFields`, never hand-maintained. */
+var AutomationConditionOperatorSchema = z.enum([
+	"eq",
+	"ne",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"contains",
+	"in"
+]);
+var AutomationConditionLeafSchema = z.object({
+	kind: z.literal("condition"),
+	deviceId: z.number().int().nonnegative(),
+	cap: z.string().min(1),
+	fieldPath: z.string().min(1),
+	operator: AutomationConditionOperatorSchema,
+	value: z.union([
+		z.string(),
+		z.number(),
+		z.boolean(),
+		z.array(z.union([z.string(), z.number()]))
+	])
 });
-var AudioClassificationResultSchema = z.object({
-	labels: z.array(AudioClassificationLabelSchema).readonly(),
-	rawLabels: z.array(AudioClassificationLabelSchema).readonly().optional(),
-	inferenceMs: z.number()
+/**
+* The expression leaf, declared as a plain object rather than an intersection
+* with {@link ExpressionSourceSchema}: a discriminated union has to be able to
+* read `kind` off each option, and an intersection hides it. The author-time
+* validation is the SAME function `ExpressionSourceSchema` runs, so the two
+* cannot drift — an expression that one accepts, the other accepts.
+*/
+var AutomationConditionExpressionSchema = z.object({
+	kind: z.literal("expression"),
+	expr: z.string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: z.record(z.string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
 });
-var audioAnalyzerCapability = {
-	name: "audio-analyzer",
+var AutomationConditionSchema = z.lazy(() => z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("all"),
+		children: z.array(AutomationConditionSchema)
+	}),
+	z.object({
+		kind: z.literal("any"),
+		children: z.array(AutomationConditionSchema)
+	}),
+	z.object({
+		kind: z.literal("not"),
+		child: AutomationConditionSchema
+	}),
+	AutomationConditionLeafSchema,
+	AutomationConditionExpressionSchema
+]));
+/**
+* What starts a run.
+*
+* D8 compliance, and it is the reason `device-state` is not merely an event
+* subscription: the trigger evaluates against the **state mirror**, which is
+* reconciled, and an event only WAKES the evaluation. A dropped event therefore
+* DELAYS a trigger; it does not lose it. `schedule` uses `croner` — the one
+* already in the repo — because `setInterval(24h)` drifts and "at 23:30" does
+* not.
+*/
+var AutomationTriggerSchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("device-state"),
+		deviceId: z.number().int().nonnegative(),
+		cap: z.string().min(1),
+		fieldPath: z.string().min(1),
+		/** Fire when the field takes this value. Omit to fire on any change. */
+		becomes: z.union([
+			z.string(),
+			z.number(),
+			z.boolean()
+		]).optional(),
+		/** Only on a CHANGE of value, not on every re-report. */
+		edge: z.boolean().optional(),
+		/** The condition must hold this long before the run starts. */
+		forMs: z.number().int().min(0).max(864e5).optional(),
+		/** Collapse a burst into one run. */
+		debounceMs: z.number().int().min(0).max(6e5).optional()
+	}),
+	z.object({
+		kind: z.literal("device-event"),
+		/** An `EventCategory` value. */
+		category: z.string().min(1),
+		deviceId: z.number().int().nonnegative().optional()
+	}),
+	z.object({
+		kind: z.literal("schedule"),
+		cron: z.string().min(1).max(120)
+	}),
+	z.object({ kind: z.literal("manual") })
+]);
+/**
+* One action step.
+*
+* `wait` and `cap` are `NcRuleActionSchema`'s two members, kept structurally
+* identical so `NcRuleActionRunner` runs them unchanged — its device-scope
+* check, stop-at-first-failure and per-sequence throttle are the whole reason
+* to reuse it, and none of them are re-implemented here.
+*
+* **The one divergence, and it is forced.** `NcRuleActionSchema.cap.deviceId` is
+* a literal `z.number().int()`, and the NC runner's own `RunSequencesInput`
+* documents its subject device as *"for the log tag, never for routing"*. So an
+* NC action can never target the device that triggered it — which is fine for
+* the NC (its rules already scope to a device) and fatal for an automation
+* ("sound the siren of the camera that saw the person"). `deviceId` therefore
+* also accepts `{ $var }`, resolved from the run's `vars` bag BEFORE the runner
+* is called. The runner still receives a number and is untouched; the
+* resolution is the recipe's job, not the runner's.
+*/
+var AutomationActionSchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("wait"),
+		seconds: z.number().min(0).max(300)
+	}),
+	z.object({
+		kind: z.literal("cap"),
+		deviceId: z.union([z.number().int(), z.object({ $var: z.string().min(1) })]),
+		cap: z.string().min(1),
+		method: z.string().min(1),
+		/** Values may carry `{{vars.x}}` slots, which SUBSTITUTE and do not
+		*  evaluate (§3.2.3). Anything beyond substitution is the expression leaf. */
+		args: z.record(z.string(), z.unknown()).optional()
+	}),
+	z.object({
+		kind: z.literal("code"),
+		/** Compiled into the automation's OWN block by esbuild — not a third
+		*  runtime, not a `vm`, and not dynamically evaluated. */
+		code: z.string().min(1).max(2e4)
+	})
+]);
+z.object({
+	triggers: z.array(AutomationTriggerSchema),
+	conditions: AutomationConditionSchema.optional(),
+	actions: z.array(AutomationActionSchema)
+});
+/**
+* `addon-pages` — system-scoped singleton aggregator cap. Public-facing
+* surface that admin-ui consumes through `useAddonPagesListPages()`.
+*
+* The provider iterates every `addon-pages-source` (collection) provider
+* and emits `AddonPageInfo[]` enriched with versioned `bundleUrl` strings
+* pointing at `/api/addon-pages/<addonId>/<bundle>?v=<mtime>`. The
+* filesystem `mtime` cache-buster lets the browser pick up addon
+* rebuilds without manual reload.
+*
+* The hub-local builtin `addon-pages-aggregator` (see
+* `@camstack/system/builtins/addon-pages-aggregator`) registers the
+* provider. Splitting the public aggregator from the raw collection
+* keeps both ends in codegen — there's no hand-written
+* `addon-pages.router.ts` wrapper anymore.
+*/
+var AddonPageDeclarationSchema$1 = z.object({
+	id: z.string(),
+	label: z.string(),
+	icon: z.string(),
+	path: z.string(),
+	remoteName: z.string(),
+	bundle: z.string(),
+	section: z.string().optional(),
+	sectionLabel: z.string().optional()
+});
+var AddonPageInfoSchema = z.object({
+	addonId: z.string(),
+	page: AddonPageDeclarationSchema$1,
+	bundleUrl: z.string()
+});
+var addonPagesCapability = {
+	name: "addon-pages",
 	scope: "system",
 	mode: "singleton",
-	methods: {
-		analyseChunk: method(z.object({
-			chunk: AudioChunkInputSchema,
-			settings: AudioAnalysisSettingsSchema
-		}), AudioAnalysisResultSchema.nullable(), { kind: "mutation" }),
-		classify: method(AudioChunkInputSchema, AudioClassificationResultSchema, { timeoutMs: 3e4 }),
-		isReady: method(z.void(), z.boolean()),
-		dispose: method(z.void(), z.void(), { kind: "mutation" }),
-		/**
-		* Re-run the host platform-probe for the audio backend and persist
-		* the detected value into `probedBestAudioBackend`. Replaces the
-		* orchestrator's legacy `AgentPipelineSettings.audio.engine` —
-		* audio-analyzer now owns the choice. Operator `audioBackend` is
-		* not touched; only the probed-best hint.
-		*/
-		reprobeAudioEngine: method(z.void(), z.object({ backend: z.string() }), {
-			kind: "mutation",
-			auth: "admin"
-		})
-	}
+	methods: { listPages: method(z.void(), z.array(AddonPageInfoSchema).readonly()) }
 };
-var PcmSampleFormatSchema = z.enum(["f32le", "s16le"]);
-var AudioCodecInfoSchema = z.object({
-	codec: z.string(),
-	canDecode: z.boolean(),
-	canEncode: z.boolean(),
-	label: z.string().optional()
+/**
+* `addon-pages-source` — collection cap exposing per-provider raw page
+* declarations. Every addon that contributes a UI page registers a
+* provider here. The hub-side singleton aggregator (`addon-pages` cap,
+* see `addon-pages.cap.ts`) walks this collection, stamps versioned
+* `bundleUrl` values, and returns the enriched `AddonPageInfo[]` list
+* that admin-ui consumes.
+*
+* The split exists because the public listing has a different output
+* shape than the per-provider raw declarations, and we want both ends
+* to flow through codegen instead of relying on a hand-written wrapper.
+*/
+var AddonPageDeclarationSchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	icon: z.string(),
+	path: z.string(),
+	/**
+	* Module Federation remote name — must match the `name` field on the
+	* page addon's `federation()` plugin config. Used by admin-ui's
+	* `<AddonPageLoader>` to call `loadRemote('<remoteName>/page')`.
+	* Conventionally `addon_<id>_page` (snake_case; MF names cannot
+	* contain hyphens).
+	*/
+	remoteName: z.string(),
+	/**
+	* Bundle filename inside the addon's `dist/` dir served at
+	* `/api/addon-pages/<addonId>/<bundle>`. With Module Federation this
+	* is always `'remoteEntry.js'`; the value is kept on the metadata so
+	* the static-file route can compute an mtime-based cache-buster URL
+	* without a separate filesystem stat.
+	*/
+	bundle: z.string(),
+	/**
+	* Sidebar section this page docks into. Well-known ids: `'detection'`,
+	* `'cluster'`, `'administration'` — the page renders inside that group.
+	* Any OTHER string creates (or joins) a custom section rendered after
+	* the built-in groups; its label comes from `sectionLabel` (first
+	* declaration wins), falling back to the id. Absent → the legacy
+	* "Addon Pages" group.
+	*/
+	section: z.string().optional(),
+	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
+	sectionLabel: z.string().optional()
 });
-var AudioDecodeSessionConfigSchema = z.object({
-	codec: z.string(),
-	sourceSampleRate: z.number().int().positive(),
-	sourceChannels: z.number().int().positive(),
-	extraData: z.instanceof(Uint8Array).optional(),
-	targetSampleRate: z.number().int().positive(),
-	targetChannels: z.number().int().positive(),
-	targetFormat: PcmSampleFormatSchema.optional(),
-	idleMs: z.number().int().positive().optional(),
-	tag: z.string().optional()
+var addonPagesSourceCapability = {
+	name: "addon-pages-source",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { listPages: method(z.void(), z.array(AddonPageDeclarationSchema).readonly()) }
+};
+var AddonHttpRouteSchema = z.object({
+	method: z.enum([
+		"GET",
+		"POST",
+		"PUT",
+		"DELETE",
+		"PATCH"
+	]),
+	path: z.string(),
+	access: z.enum([
+		"public",
+		"authenticated",
+		"admin"
+	]).optional(),
+	description: z.string().optional()
 });
-var AudioEncodeSessionConfigSchema = z.object({
-	codec: z.string(),
-	sourceSampleRate: z.number().int().positive(),
-	sourceChannels: z.number().int().positive(),
-	sourceFormat: PcmSampleFormatSchema.optional(),
-	targetSampleRate: z.number().int().positive(),
-	targetChannels: z.number().int().positive(),
-	bitrateKbps: z.number().int().positive().optional(),
-	idleMs: z.number().int().positive().optional(),
-	tag: z.string().optional()
+/**
+* Cross-process route invocation envelope. The hub captures the
+* request as plain data, ships it to the worker via Moleculer, and
+* the worker runs the local handler against a capturing reply. The
+* envelope returned describes what the handler intended (status,
+* headers, body, or a redirect) so the hub can translate it back to
+* the Fastify reply that's actually wired to the socket.
+*/
+var InvokeRequestSchema = z.object({
+	method: z.string(),
+	path: z.string(),
+	params: z.record(z.string(), z.string()),
+	query: z.record(z.string(), z.string()),
+	body: z.unknown(),
+	headers: z.record(z.string(), z.string()),
+	user: z.object({
+		id: z.string(),
+		username: z.string(),
+		isAdmin: z.boolean()
+	}).optional(),
+	scopedToken: z.unknown().optional()
 });
-var AudioPcmChunkSchema = z.object({
-	data: z.instanceof(Uint8Array),
-	sampleRate: z.number().int().positive(),
-	channels: z.number().int().positive(),
-	format: PcmSampleFormatSchema,
-	pts: z.number()
+var InvokeReplyEnvelopeSchema = z.object({
+	status: z.number().int(),
+	headers: z.record(z.string(), z.string()),
+	/** When set, the hub MUST `reply.redirect(redirectUrl)` instead of
+	*  sending `body`. Status defaults to 302 when this is set unless
+	*  the handler called `reply.code(...)` explicitly. */
+	redirectUrl: z.string().nullable(),
+	/** JSON-serializable body. `undefined` is treated as "no body". */
+	body: z.unknown().optional(),
+	/** Set when the handler called `reply.type(mime)`. */
+	contentType: z.string().optional()
 });
-var AudioEncodedChunkSchema = z.object({
-	data: z.instanceof(Uint8Array),
-	codec: z.string(),
-	pts: z.number(),
-	frameComplete: z.boolean()
+var addonRoutesCapability = {
+	name: "addon-routes",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		getRoutes: method(z.void(), z.array(AddonHttpRouteSchema)),
+		/**
+		* Cross-process dispatch entry point. Forked addons implement this
+		* (via `buildAddonRouteProvider`) so the hub's Fastify catch-all
+		* can route through Moleculer when the handler lives in a worker.
+		*
+		* Local addons can implement it for free with the same helper;
+		* the hub bypasses the wire on co-located addons.
+		*/
+		invoke: method(InvokeRequestSchema, InvokeReplyEnvelopeSchema, { kind: "mutation" })
+	},
+	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+	mount: { kind: "skip" }
+};
+var ConfigTabDeclarationSchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	icon: z.string(),
+	order: z.number().optional()
 });
-var SessionInventoryEntrySchema = z.object({
-	sessionId: z.string(),
-	kind: z.enum(["decode", "encode"]),
-	codec: z.string(),
-	sourceSampleRate: z.number(),
-	sourceChannels: z.number(),
-	targetSampleRate: z.number(),
-	targetChannels: z.number(),
-	format: PcmSampleFormatSchema,
-	tag: z.string().optional(),
-	createdAtMs: z.number(),
-	lastActivityMs: z.number(),
-	framesIn: z.number(),
-	framesOut: z.number()
+var ConfigSectionWithValuesSchema = z.object({
+	id: z.string(),
+	title: z.string(),
+	description: z.string().optional(),
+	style: z.enum(["card", "accordion"]).optional(),
+	defaultCollapsed: z.boolean().optional(),
+	columns: z.union([
+		z.literal(1),
+		z.literal(2),
+		z.literal(3),
+		z.literal(4)
+	]).optional(),
+	tab: z.string().optional(),
+	location: z.enum(["settings", "top-tab"]).optional(),
+	order: z.number().optional(),
+	fields: z.array(z.any())
+});
+var SettingsSchemaWithValuesSchema = z.object({
+	tabs: z.array(ConfigTabDeclarationSchema).optional(),
+	sections: z.array(ConfigSectionWithValuesSchema)
 });
+/** Patch object — keys are field names, values are the new field values. */
+var SettingsPatchSchema = z.record(z.string(), z.unknown());
+/** Standard success response for update operations. */
+var SettingsUpdateResultSchema = z.object({ success: z.literal(true) });
 /**
-* audio-codec — bidirectional PCM ↔ encoded audio I/O box.
+* addon-settings — singleton gateway for three-level addon settings.
 *
-* Independent per-consumer sessions. The provider runs decode + resample
-* (or resample + encode) inside the session so a 16kHz mono ASA
-* subscriber and a 48kHz stereo WebRTC subscriber on the same source
-* stream don't share resamplers.
+* Works like `device-manager`: a single hub-side provider that resolves
+* `addonId` to the target addon and delegates the call. For hub-local
+* addons the call is direct; for remote agents it proxies via the
+* per-addon Moleculer service.
 *
-* Singleton on each node. Decoder and encoder live in the same provider
-* because they share the underlying libav contexts (node-av today,
-* pluggable later) — operators always install one or the other together.
+* Replaces the `$addonHost` Moleculer service. Transport transparency
+* is handled by the provider implementation — callers (admin UI, other
+* addons via `ctx.api`) never know which node hosts the target addon.
+*
+* Three levels:
+*   - **addon**: addon-scoped settings (installation config, API keys, …)
+*   - **global**: settings applied to all devices by default
+*   - **device**: per-device overrides
+*
+* Optional `nodeId` allows explicit node targeting. When absent the
+* provider resolves the addon's host node automatically.
 */
-var audioCodecCapability = {
-	name: "audio-codec",
+/**
+* `addon-settings` is a **hub-centric** cap: the hub hosts the single
+* provider, and `nodeId` in the input is data for the hub provider's
+* internal dispatcher, not a routing hint for the cap-router. See
+* `CapabilityDefinition.nodeIdMode` for the contract.
+*/
+var addonSettingsCapability = {
+	name: "addon-settings",
 	scope: "system",
 	mode: "singleton",
-	preferredProvider: "decoder-nodeav",
+	nodeIdMode: "data",
 	methods: {
-		/** Probe the local runtime and return the supported codec matrix. */
-		listSupportedCodecs: method(z.void(), z.array(AudioCodecInfoSchema).readonly()),
-		/** Cheap predicate — does the runtime support `(codec, kind)`? */
-		canHandle: method(z.object({
-			codec: z.string(),
-			kind: z.enum(["decode", "encode"])
-		}), z.boolean()),
-		createDecodeSession: method(AudioDecodeSessionConfigSchema, z.object({
-			sessionId: z.string(),
-			nodeId: z.string()
-		}), { kind: "mutation" }),
-		createEncodeSession: method(AudioEncodeSessionConfigSchema, z.object({
-			sessionId: z.string(),
-			nodeId: z.string()
-		}), { kind: "mutation" }),
-		closeSession: method(z.object({
-			sessionId: z.string(),
-			nodeId: z.string().optional()
-		}), z.void(), { kind: "mutation" }),
-		/** Push one encoded audio frame into a decode session. */
-		pushEncodedFrame: method(z.object({
-			sessionId: z.string(),
-			nodeId: z.string().optional(),
-			data: z.instanceof(Uint8Array),
-			/** Source PTS in milliseconds. Synthesised when omitted. */
-			pts: z.number().optional()
-		}), z.void(), { kind: "mutation" }),
-		/** Pull up to `maxCount` PCM chunks from a decode session. */
-		pullPcm: method(z.object({
-			sessionId: z.string(),
-			nodeId: z.string().optional(),
-			maxCount: z.number().int().positive().default(8)
-		}), z.array(AudioPcmChunkSchema)),
-		/** Push one PCM chunk into an encode session. */
-		pushPcm: method(z.object({
-			sessionId: z.string(),
+		getGlobalSettings: method(z.object({
+			addonId: z.string(),
 			nodeId: z.string().optional(),
-			data: z.instanceof(Uint8Array),
-			/** Source PTS in milliseconds. */
-			pts: z.number().optional()
-		}), z.void(), { kind: "mutation" }),
-		/** Pull up to `maxCount` encoded chunks from an encode session. */
-		pullEncoded: method(z.object({
-			sessionId: z.string(),
+			overlay: z.record(z.string(), z.unknown()).optional(),
+			cap: z.string().optional()
+		}), SettingsSchemaWithValuesSchema.nullable()),
+		updateGlobalSettings: method(z.object({
+			addonId: z.string(),
 			nodeId: z.string().optional(),
-			maxCount: z.number().int().positive().default(8)
-		}), z.array(AudioEncodedChunkSchema)),
-		/** Flush any pending encoded output (call before close on graceful tear). */
-		flushEncode: method(z.object({
-			sessionId: z.string(),
+			patch: SettingsPatchSchema
+		}), SettingsUpdateResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getDeviceSettings: method(z.object({
+			addonId: z.string(),
+			deviceId: z.number(),
 			nodeId: z.string().optional()
-		}), z.array(AudioEncodedChunkSchema), { kind: "mutation" }),
-		listActiveSessions: method(z.void(), z.array(SessionInventoryEntrySchema).readonly())
+		}), SettingsSchemaWithValuesSchema.nullable()),
+		updateDeviceSettings: method(z.object({
+			addonId: z.string(),
+			deviceId: z.number(),
+			nodeId: z.string().optional(),
+			patch: SettingsPatchSchema
+		}), SettingsUpdateResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
-var AuthResultSchema = z.object({
-	userId: z.string(),
-	username: z.string(),
-	email: z.string().optional(),
-	displayName: z.string().optional(),
+/**
+* `addon-widgets-source` — collection cap exposing per-addon raw widget
+* declarations. Mirrors the addon-pages split: every addon shipping
+* widgets registers a provider on this collection cap; the hub-local
+* aggregator (`addon-widgets`, see `addon-widgets.cap.ts`) walks the
+* collection, stamps versioned `bundleUrl`s onto each declaration, and
+* exposes the public listing surface that admin-ui consumes.
+*
+* The split exists because the public listing has a different output
+* shape (flat enriched metadata with `addonId` + `bundleUrl`) than the
+* per-provider raw declarations. Both ends flow through codegen.
+*
+* Unified UI-contribution model (Task 10): a widget descriptor IS a
+* `UiContribution` with `kind:'remote'`. The host renders it through the
+* same `ContributionRenderer` / Module-Federation path as every other
+* contributed UI surface — no bespoke widget-rendering path. The widget-
+* only metadata (sizing hints, `requires`) lives as extra fields on the
+* descriptor; the `UiContribution` core (`tab` / `label` / `order` /
+* `kind` / `remote`) carries identity + placement + the MF remote.
+*/
+/** Where the widget makes sense to render — maps to a contribution `tab`. */
+var WidgetHostEnum = z.enum([
+	"device-tab",
+	"dashboard",
+	"integration-detail"
+]);
+var WidgetSizeEnum = z.enum([
+	"xs",
+	"sm",
+	"md",
+	"lg",
+	"xl"
+]);
+/**
+* MF remote descriptor — mirrors `UiContributionRemote` from
+* `capability-definition.ts`. Widget remotes expose a single
+* `'./widgets'` module whose default export is a
+* `Record<componentKey, Component>` map; `componentKey` (the widget
+* `stableId`) picks the entry the host mounts.
+*/
+var WidgetRemoteSchema = z.object({
+	remoteName: z.string(),
+	exposedModule: z.string(),
+	componentKey: z.string().optional()
+});
+/**
+* One widget declaration — a `UiContribution` (`kind:'remote'`) plus
+* widget-only metadata. The `UiContribution` core fields:
+*
+*  - `tab`     — where the widget hosts. A widget that runs on the
+*                dashboard declares `tab:'dashboard'`; a device-tab
+*                widget declares the target device-detail tab id.
+*  - `subTab`  — optional sub-tab within `tab`.
+*  - `label`   — operator-facing label.
+*  - `order`   — ordering within `(tab, subTab)`.
+*  - `kind`    — always `'remote'` for widgets.
+*  - `remote`  — the MF remote `{ remoteName, exposedModule, componentKey }`.
+*
+* Widget-only fields retained alongside the contribution core:
+*
+*  - `stableId`      — stable identity within the addon (the MF
+*                      `componentKey`; kept top-level so consumers have
+*                      a stable key without reaching into `remote`).
+*  - `description` / `icon` — picker metadata.
+*  - `bundle`        — entry filename inside the addon `dist/` dir; the
+*                      aggregator stamps a versioned `bundleUrl` from it.
+*  - `hosts`         — every host the widget supports (a widget can run
+*                      both on the dashboard and a device tab). `tab`
+*                      is the PRIMARY host; `hosts` is the full set the
+*                      picker filters on.
+*  - `requires`      — host-context requirements validated at mount.
+*  - `defaultSize` / `allowedSizes` / `defaultColumns` / `defaultRows`
+*                    — dashboard placement hints.
+*/
+var WidgetMetadataSchema = z.object({
+	/** Primary host tab — `'dashboard'`, `'device-tab'`, or a device-detail tab id. */
+	tab: z.string(),
+	/** Optional sub-tab within `tab`. */
+	subTab: z.string().optional(),
+	/** Operator-facing label. */
+	label: z.string(),
+	/** Ordering within `(tab, subTab)`, ascending. */
+	order: z.number().optional(),
+	/** Always `'remote'` — a widget is a Module Federation remote. */
+	kind: z.literal("remote"),
+	/** MF remote descriptor. */
+	remote: WidgetRemoteSchema,
+	/** Stable id within the addon — kebab-case. Equals `remote.componentKey`. */
+	stableId: z.string(),
+	description: z.string().optional(),
+	icon: z.string().optional(),
 	/**
-	* Whether the authenticating user is an admin. The auth-provider
-	* surface returns this so the server's login flow can mint a JWT
-	* with the correct bypass flag. Non-admin users authenticated via
-	* an external IdP still need their scopes assigned by an admin via
-	* `setUserScopes` — the SSO flow doesn't carry permissions.
+	* Bundle filename inside the addon's `dist/` dir served at
+	* `/api/addon-widgets/<addonId>/<bundle>`. With Module Federation
+	* this is always `'remoteEntry.js'` — the value is kept on the
+	* metadata so the static-file route can compute an mtime-based
+	* cache-buster URL without a separate filesystem stat.
 	*/
-	isAdmin: z.boolean().default(false)
+	bundle: z.string(),
+	/** Every host the widget supports. The picker filters on this set. */
+	hosts: z.array(WidgetHostEnum).readonly(),
+	/** Required props the host must supply. Validated at `<WidgetSlot>` mount. */
+	requires: z.object({
+		deviceContext: z.boolean().default(false),
+		integrationContext: z.boolean().default(false)
+	}),
+	/**
+	* Loadable BEFORE authentication. The normal widget registry listing
+	* (`addon-widgets.listWidgets`) is auth-gated, so a pre-auth surface
+	* (the login page) cannot discover a widget through it. A widget that
+	* declares `preAuth: true` marks itself as safe to mount on a pre-auth
+	* screen — it is surfaced through the PUBLIC `auth.listLoginMethods`
+	* login-method contribution channel (see `login-method.cap.ts`) rather
+	* than the authenticated registry, and its bundle is served by the
+	* public `/api/addon-widgets/:addonId/*` static route. Defaults false.
+	*/
+	preAuth: z.boolean().optional().default(false),
+	/** Dashboard placement HINTS (operator can override per instance). */
+	defaultSize: WidgetSizeEnum.default("md"),
+	allowedSizes: z.array(WidgetSizeEnum).readonly().default([
+		"sm",
+		"md",
+		"lg"
+	]),
+	defaultColumns: z.number().int().min(1).max(12).default(6),
+	defaultRows: z.number().int().min(1).max(12).default(1)
 });
-var authProviderCapability = {
-	name: "auth-provider",
+var addonWidgetsSourceCapability = {
+	name: "addon-widgets-source",
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: {
-		validateCredentials: method(z.object({
-			username: z.string(),
-			password: z.string()
-		}), AuthResultSchema.nullable(), { kind: "mutation" }),
-		getLoginUrl: method(z.object({ state: z.string() }), z.string()),
-		handleCallback: method(z.record(z.string(), z.string()), AuthResultSchema, { kind: "mutation" }),
-		validateToken: method(z.object({ token: z.string() }), AuthResultSchema.nullable())
-	},
-	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
-	mount: { kind: "skip" }
+	methods: { listWidgets: method(z.void(), z.array(WidgetMetadataSchema).readonly()) }
 };
 /**
-* Orchestrator-side destination metadata. The orchestrator computes
-* `id = <addonId>:<subId>` from its provider lookup so consumers
-* (admin UI, restore flow) see one canonical key.
+* `addon-widgets` — system-scoped singleton aggregator cap. Public-facing
+* surface that admin-ui consumes through `useAddonWidgetsListWidgets()`.
 *
-* Phase 4 (admin UI redesign) adds the per-destination policy fields
-* (`enabled`, `retentionCount`, `label`) so the destinations table can
-* render the joined view without a follow-up round-trip. The backend
-* already joins these in `listDestinations` — we now surface them on
-* the wire.
+* The provider iterates every `addon-widgets-source` (collection)
+* provider and emits `EnrichedWidgetMetadata[]` enriched with versioned
+* `bundleUrl` strings pointing at
+* `/api/addon-widgets/<addonId>/<bundle>?v=<mtime>`. The filesystem
+* `mtime` cache-buster lets the browser pick up addon rebuilds without
+* manual reload — same scheme used by `addon-pages`.
 *
-* `lastSuccessAt` / `lastSuccessSizeBytes` are computed from each
-* location's `manifests.json` (newest archive). Optional — locations
-* with no archives yet leave them undefined.
+* The hub-local builtin `addon-widgets-aggregator` (see
+* `@camstack/system/builtins/addon-widgets-aggregator`) registers the
+* provider. Splitting the public aggregator from the raw collection
+* keeps both ends in codegen — there's no hand-written wrapper.
 */
-var BackupDestinationInfoSchema = z.object({
-	/**
-	* Sub-id within this addon. Convention `default` for single-
-	* destination addons; addons that host many (S3 with N buckets)
-	* pick stable per-bucket strings. The orchestrator stitches
-	* `<manifestId>:<subId>` for the wire format.
-	*/
-	subId: z.string(),
-	displayName: z.string(),
-	description: z.string().optional(),
-	kind: z.string(),
-	triggerSupported: z.boolean(),
-	restoreSupported: z.boolean()
-}).extend({
-	/** `<addonId>:<subId>` — globally-unique dispatch key. */
-	id: z.string(),
-	/**
-	* Manifest id of the owning addon. The Settings button on the
-	* destination card opens that addon's `globalSettingsSchema` panel.
-	*/
+var EnrichedWidgetMetadataSchema = WidgetMetadataSchema.extend({
 	addonId: z.string(),
-	/** Operator-toggled enable flag from the destination-policy table. */
-	enabled: z.boolean(),
-	/** Operator-defined retention count (archives kept per destination). */
-	retentionCount: z.number(),
-	/** Operator-defined display label (overrides storage location displayName). */
-	label: z.string().optional(),
-	/** Newest-archive timestamp from `manifests.json`, or undefined. */
-	lastSuccessAt: z.number().optional(),
-	/** Newest-archive size from `manifests.json`, or undefined. */
-	lastSuccessSizeBytes: z.number().optional(),
-	/** Per-destination cron expression. Empty = manual-only (no schedule). */
-	cron: z.string().optional(),
-	/** ms-epoch of next computed firing for this destination's cron, if any. */
-	nextRunAt: z.number().optional(),
-	/** ms-epoch of last successful scheduled run (mirrors policy.lastRunAt). */
-	lastRunAt: z.number().optional()
+	bundleUrl: z.string()
 });
+var addonWidgetsCapability = {
+	name: "addon-widgets",
+	scope: "system",
+	mode: "singleton",
+	methods: { listWidgets: method(z.void(), z.array(EnrichedWidgetMetadataSchema).readonly()) }
+};
 /**
-* Per-archive entry returned by `backup.listArchives({ destinationId })`.
-* Same shape the destination drill-in renders. Sourced from the per-
-* location `manifests.json` (no per-archive tarball read required).
+* Alerts capability — collection-based internal alert system.
+*
+* Multiple providers can register. Each provider filters by EventBus category
+* and creates/updates alerts. The built-in Alert Center addon persists alerts
+* in the DB and serves them to the admin UI.
 */
-var BackupArchiveEntrySchema = z.object({
-	id: z.string(),
-	filename: z.string(),
-	createdAt: z.number(),
-	sizeBytes: z.number(),
-	label: z.string().optional(),
-	/** Top-level locations included in the archive (db, addons, tls, …). */
-	locations: z.array(z.string()).readonly()
+var AlertSeveritySchema = z.enum([
+	"info",
+	"success",
+	"warning",
+	"error"
+]);
+var AlertStatusSchema = z.enum([
+	"active",
+	"in-progress",
+	"completed",
+	"failed",
+	"dismissed"
+]);
+var AlertSourceSchema = z.object({
+	type: z.string(),
+	id: z.string()
 });
-var BackupEntrySchema = z.object({
+var AlertSchema = z.object({
 	id: z.string(),
-	/** Addon id of the destination that owns this backup (e.g. `local-backup`, `s3-backup`). */
-	destinationId: z.string().optional(),
-	label: z.string().optional(),
-	createdAt: z.number(),
-	sizeBytes: z.number(),
-	locations: z.array(z.string()).optional()
-});
-var ArchiveEntrySchema = z.object({
-	path: z.string(),
-	kind: z.enum([
-		"file",
-		"dir",
-		"symlink"
-	]),
-	sizeBytes: z.number(),
-	mtime: z.number()
-});
-var ArchiveManifestSchema = z.object({
-	archiveVersion: z.literal(1),
+	category: z.string(),
+	severity: AlertSeveritySchema,
+	title: z.string(),
+	message: z.string(),
+	status: AlertStatusSchema,
+	progress: z.number().optional(),
+	read: z.boolean(),
 	createdAt: z.number(),
-	dataDir: z.string(),
-	locations: z.array(z.string()),
-	entries: z.array(ArchiveEntrySchema),
-	totalBytes: z.number(),
-	totalFiles: z.number()
-});
-var LocationStatSchema = z.object({
-	name: z.string(),
-	sizeBytes: z.number(),
-	fileCount: z.number(),
-	present: z.boolean()
+	updatedAt: z.number(),
+	source: AlertSourceSchema.optional(),
+	metadata: z.record(z.string(), z.unknown()).optional()
 });
+var alertsCapability = {
+	name: "alerts",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		emit: method(AlertSchema, z.void(), { kind: "mutation" }),
+		update: method(z.object({
+			alertId: z.string(),
+			patch: AlertSchema.partial()
+		}), z.void(), { kind: "mutation" }),
+		list: method(z.object({
+			unreadOnly: z.boolean().optional(),
+			limit: z.number().optional()
+		}).optional(), z.array(AlertSchema).readonly()),
+		getUnreadCount: method(z.void(), z.number()),
+		markRead: method(z.object({ alertId: z.string() }), z.void(), { kind: "mutation" }),
+		markAllRead: method(z.void(), z.void(), { kind: "mutation" }),
+		dismiss: method(z.object({ alertId: z.string() }), z.void(), { kind: "mutation" })
+	}
+};
 /**
-* A backup schedule — the N:M "entry" that binds one cron cadence to a
-* SET of destination locations. Supersedes the per-location cron on
-* `BackupDestinationPolicy`: an operator creates a schedule, picks the
-* `backups` locations it should write to, and the orchestrator fans a
-* single archive out to all of them when the cron fires.
+* audio-analysis — device-scoped facade over the system `audio-analyzer`.
 *
-* `retentionCount` is per-schedule (D-decision 2026-07-28): every
-* location targeted by this schedule keeps this many archives from
-* this schedule's runs.
+* Pairs with `audio-analyzer` (system, singleton) the way `camera-streams`
+* pairs with `stream-broker`: the system cap owns the compute path
+* (`processChunk`, engine lifecycle) while `audio-analysis` exposes the
+* per-device surface — settings resolution, device-settings contribution,
+* audio-level events — and is the binding row every camera sees in the
+* device-manager bindings UI.
 *
-* `dataSources` optionally narrows which top-level state locations
-* (db, addons, tls, …) are archived; omitted = the orchestrator's
-* default full set.
+* The cap definition itself declares `kind: 'wrapper'` and `defaultActive: true`,
+* so every camera picks up audio analysis automatically without any runtime flag
+* in the addon's registration. Operators can disable per-device via
+* `device-manager.setWrapperActive` when they don't want a given camera to be
+* analysed (e.g. muted / motion-only cams).
 */
-var BackupScheduleSchema = z.object({
-	/** Stable id. Generated by the orchestrator on first upsert if absent. */
-	id: z.string(),
-	/** Operator-facing display name. */
-	label: z.string(),
-	/** 5-field POSIX cron. Empty = disabled cadence (kept for editing). */
-	cron: z.string(),
-	/** Master on/off toggle for the whole schedule. */
-	enabled: z.boolean(),
-	/** `backups`-location ids this schedule writes to (fan-out set). */
-	locationIds: z.array(z.string()).readonly(),
-	/** Archives kept per targeted location for this schedule. */
-	retentionCount: z.number().int().min(1).max(1e3),
-	/** Optional subset of source locations to include; omitted = all. */
-	dataSources: z.array(z.string()).readonly().optional(),
-	/** ms-epoch of last successful run. */
-	lastRunAt: z.number().optional(),
-	/** ms-epoch of next computed firing (read-only, filled on list). */
-	nextRunAt: z.number().optional()
+var audioAnalysisCapability = {
+	name: "audio-analysis",
+	scope: "device",
+	mode: "singleton",
+	kind: "wrapper",
+	defaultActive: true,
+	deviceTypes: [DeviceType.Camera],
+	exposesDeviceSettings: true,
+	methods: { 
+	/**
+	* Resolve per-device audio analysis settings (minConfidence,
+	* allowedClasses) from the addon settings store for a given camera.
+	* Orchestrator callers use this before handing chunks to
+	* `audio-analyzer.processChunk`.
+	*/
+resolveDeviceSettings: method(z.object({ deviceId: z.number() }), z.custom()) },
+	events: { onAudioLevel: event(z.object({
+		deviceId: z.number(),
+		rms: z.number(),
+		dbfs: z.number()
+	})) }
+};
+/** Shared Zod schemas used across detection capabilities. */
+/**
+* Canonical frame-format enum mirrored on `FrameFormat` in
+* `packages/types/src/types/io.ts`. Kept inline (vs imported) so the
+* Zod runtime schema and TypeScript type stay in sync at the call site
+* — adding a new format requires changing both this enum and the
+* `FrameFormat` type alias together.
+*/
+var FrameFormatSchema = z.enum([
+	"jpeg",
+	"rgb",
+	"bgr",
+	"yuv420",
+	"gray"
+]);
+var FrameInputSchema = z.object({
+	data: z.custom(),
+	format: FrameFormatSchema,
+	width: z.number(),
+	height: z.number(),
+	timestamp: z.number()
+});
+var BoundingBoxSchema = z.object({
+	x: z.number(),
+	y: z.number(),
+	w: z.number(),
+	h: z.number()
+});
+z.object({
+	class: z.string(),
+	originalClass: z.string(),
+	score: z.number(),
+	bbox: BoundingBoxSchema
 });
 /**
-* backup — singleton capability for backup management.
+* `data` carries the raw f32le bytes of the PCM samples (4 bytes per
+* sample, little-endian IEEE 754).  `Uint8Array` is the wire-safe choice
+* because `@msgpack/msgpack` serialises it as a MsgPack `bin` type that
+* round-trips losslessly over the UDS transport.  `Float32Array` is NOT
+* preserved — the encoder serialises it as `bin` (its raw bytes) but
+* the decoder returns `Uint8Array`, so treating a `Float32Array` as the
+* wire type causes receivers to read bytes as sample values, producing
+* wildly wrong RMS/dBFS results (~+43 dBFS instead of ≤0).
 *
-* Implemented by `local-backup` addon. Future providers (S3, rsync)
-* can replace it by registering the same capability.
+* Callers that need float arithmetic reconstruct the view with:
+*   `new Float32Array(chunk.data.buffer, chunk.data.byteOffset, chunk.data.byteLength / 4)`
 */
-var backupCapability = {
-	name: "backup",
-	scope: "system",
-	mode: "singleton",
-	methods: {
-		/**
-		* Flat aggregate of every destination across every registered
-		* `backup-destination` provider. This is the orchestrator-side
-		* surface; it expands per-addon `listDestinations()` results into
-		* one list the UI can render directly.
-		*/
-		listDestinations: method(z.void(), z.array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }),
-		/**
-		* Trigger a backup. Without `destinations` the orchestrator fans
-		* out to every destination flagged as enabled in the routing
-		* config; with it, only the listed addons receive the archive.
-		*/
-		trigger: method(z.object({
-			/** Subset of registered `backup-destination` addon ids to write to. */
-			destinations: z.array(z.string()).optional(),
-			locations: z.array(z.string()).optional(),
-			label: z.string().optional(),
-			/**
-			* Per-run retention override applied to every targeted
-			* destination. Used by schedule-driven runs (per-entry
-			* retention). Omitted = each destination's own policy
-			* retention (manual runs).
-			*/
-			retentionCount: z.number().int().min(1).max(1e3).optional()
-		}).optional(), z.array(BackupEntrySchema).readonly(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/** Union of every destination's archives, each tagged with `destinationId`. */
-		list: method(z.void(), z.array(BackupEntrySchema).readonly(), { auth: "admin" }),
-		/**
-		* Pre-backup snapshot of the well-known locations on disk — sizes
-		* + file counts. Powers the opt-in checklist that lets the
-		* operator pick which subsections of state get archived.
-		*/
-		listLocations: method(z.void(), z.array(LocationStatSchema).readonly(), { auth: "admin" }),
-		/**
-		* Read the embedded `.camstack-backup-manifest.json` from a
-		* previously-created archive. The manifest carries the full
-		* file/dir listing with sizes + mtimes — the readdir snapshot
-		* the UI shows in the "Contents" panel. Returns `null` when the
-		* archive predates manifests (created before this feature
-		* shipped).
-		*/
-		getEntries: method(z.object({
-			destinationId: z.string(),
-			backupId: z.string()
-		}), ArchiveManifestSchema.nullable(), { auth: "admin" }),
-		restore: method(z.object({
-			destinationId: z.string(),
-			backupId: z.string(),
-			/**
-			* Optional whitelist — only restore these top-level locations
-			* from the archive. Default = every location the archive
-			* carries (full restore). The boot-time apply hook reads
-			* this list and skips entries whose path doesn't start with
-			* any of them.
-			*/
-			locations: z.array(z.string()).optional()
-		}), z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		delete: method(z.object({
-			destinationId: z.string(),
-			backupId: z.string()
-		}), z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* List archives at a single destination. Reads the per-location
-		* `manifests.json` and returns one entry per archive (newest
-		* first). Powers the destinations-table drill-in in admin UI.
-		*/
-		listArchives: method(z.object({ destinationId: z.string() }), z.array(BackupArchiveEntrySchema).readonly(), { auth: "admin" }),
-		/**
-		* Upsert a per-destination policy row. The `locationId` MUST be
-		* the id of an existing `backups`-typed `StorageLocation`. Used
-		* by the admin-UI destinations table (enable toggle + retention
-		* input + optional label).
-		*/
-		upsertDestinationPolicy: method(z.object({
-			locationId: z.string(),
-			enabled: z.boolean(),
-			retentionCount: z.number().int().min(1).max(1e3),
-			label: z.string().optional(),
-			/**
-			* Per-destination cron expression. Empty string clears the
-			* schedule (manual-only). Validated server-side via croner;
-			* malformed expressions reject the upsert with an actionable
-			* message.
-			*/
-			cron: z.string().optional()
-		}), z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Validate a cron expression and peek the next N firing times.
-		* Used by the admin-UI CronEditor to render a live "next-run"
-		* preview as the operator edits the pattern.
-		*/
-		previewSchedule: method(z.object({
-			cron: z.string(),
-			count: z.number().int().min(1).max(20).optional()
-		}), z.object({
-			ok: z.boolean(),
-			error: z.string().optional(),
-			nextRuns: z.array(z.number()).readonly()
-		})),
-		/**
-		* List every backup schedule (the N:M entries), each with its
-		* computed `nextRunAt`. Powers the Schedules section of the
-		* admin-UI Backups page.
-		*/
-		listSchedules: method(z.void(), z.array(BackupScheduleSchema).readonly(), { auth: "admin" }),
+var AudioChunkInputSchema = z.object({
+	data: z.instanceof(Uint8Array),
+	sampleRate: z.number(),
+	channels: z.number(),
+	timestamp: z.number(),
+	/** Originating device id — used by the classifier for per-camera concurrency tracking. */
+	deviceId: z.number().optional()
+});
+var AudioLevelSchema = z.object({
+	rms: z.number(),
+	dbfs: z.number()
+});
+var AudioClassificationLabelSchema = z.object({
+	/**
+	* Primary display class. Depending on how the label was produced
+	* this is either the macro category (e.g. `dog`) or the raw
+	* backend label (e.g. `Dog bark`). Mirrors `class` on
+	* `SpatialDetection`.
+	*/
+	className: z.string(),
+	/**
+	* Raw backend-native label the classifier actually emitted (e.g.
+	* `Dog bark` for YAMNet, `dog_bark` for Apple SoundAnalysis). For
+	* macro-aggregated entries this is the top raw contributor. Mirrors
+	* `originalClass` on `SpatialDetection`.
+	*/
+	originalClass: z.string().optional(),
+	score: z.number()
+});
+var AudioAnalysisResultSchema = z.object({
+	level: AudioLevelSchema,
+	classification: z.object({
+		labels: z.array(AudioClassificationLabelSchema).readonly(),
+		inferenceMs: z.number()
+	}).optional(),
+	timestamp: z.number()
+});
+var AudioAnalysisSettingsSchema = z.object({
+	minConfidence: z.number().min(0).max(1).default(.3),
+	allowedClasses: z.array(z.string()).default([])
+});
+var AudioClassificationResultSchema = z.object({
+	labels: z.array(AudioClassificationLabelSchema).readonly(),
+	rawLabels: z.array(AudioClassificationLabelSchema).readonly().optional(),
+	inferenceMs: z.number()
+});
+var audioAnalyzerCapability = {
+	name: "audio-analyzer",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		analyseChunk: method(z.object({
+			chunk: AudioChunkInputSchema,
+			settings: AudioAnalysisSettingsSchema
+		}), AudioAnalysisResultSchema.nullable(), { kind: "mutation" }),
+		classify: method(AudioChunkInputSchema, AudioClassificationResultSchema, { timeoutMs: 3e4 }),
+		isReady: method(z.void(), z.boolean()),
+		dispose: method(z.void(), z.void(), { kind: "mutation" }),
 		/**
-		* Create or replace a schedule. An empty / absent `id` mints a new
-		* one; a present `id` replaces in place. `cron` is validated
-		* server-side; `locationIds` must reference existing `backups`
-		* locations (unknown ids are dropped with a warning).
+		* Re-run the host platform-probe for the audio backend and persist
+		* the detected value into `probedBestAudioBackend`. Replaces the
+		* orchestrator's legacy `AgentPipelineSettings.audio.engine` —
+		* audio-analyzer now owns the choice. Operator `audioBackend` is
+		* not touched; only the probed-best hint.
 		*/
-		upsertSchedule: method(z.object({
-			id: z.string().optional(),
-			label: z.string(),
-			cron: z.string(),
-			enabled: z.boolean(),
-			locationIds: z.array(z.string()).readonly(),
-			retentionCount: z.number().int().min(1).max(1e3),
-			dataSources: z.array(z.string()).readonly().optional()
-		}), BackupScheduleSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/** Delete a schedule by id. Does not touch the target locations. */
-		deleteSchedule: method(z.object({ id: z.string() }), z.void(), {
+		reprobeAudioEngine: method(z.void(), z.object({ backend: z.string() }), {
 			kind: "mutation",
 			auth: "admin"
 		})
 	}
 };
+var PcmSampleFormatSchema = z.enum(["f32le", "s16le"]);
+var AudioCodecInfoSchema = z.object({
+	codec: z.string(),
+	canDecode: z.boolean(),
+	canEncode: z.boolean(),
+	label: z.string().optional()
+});
+var AudioDecodeSessionConfigSchema = z.object({
+	codec: z.string(),
+	sourceSampleRate: z.number().int().positive(),
+	sourceChannels: z.number().int().positive(),
+	extraData: z.instanceof(Uint8Array).optional(),
+	targetSampleRate: z.number().int().positive(),
+	targetChannels: z.number().int().positive(),
+	targetFormat: PcmSampleFormatSchema.optional(),
+	idleMs: z.number().int().positive().optional(),
+	tag: z.string().optional()
+});
+var AudioEncodeSessionConfigSchema = z.object({
+	codec: z.string(),
+	sourceSampleRate: z.number().int().positive(),
+	sourceChannels: z.number().int().positive(),
+	sourceFormat: PcmSampleFormatSchema.optional(),
+	targetSampleRate: z.number().int().positive(),
+	targetChannels: z.number().int().positive(),
+	bitrateKbps: z.number().int().positive().optional(),
+	idleMs: z.number().int().positive().optional(),
+	tag: z.string().optional()
+});
+var AudioPcmChunkSchema = z.object({
+	data: z.instanceof(Uint8Array),
+	sampleRate: z.number().int().positive(),
+	channels: z.number().int().positive(),
+	format: PcmSampleFormatSchema,
+	pts: z.number()
+});
+var AudioEncodedChunkSchema = z.object({
+	data: z.instanceof(Uint8Array),
+	codec: z.string(),
+	pts: z.number(),
+	frameComplete: z.boolean()
+});
+var SessionInventoryEntrySchema = z.object({
+	sessionId: z.string(),
+	kind: z.enum(["decode", "encode"]),
+	codec: z.string(),
+	sourceSampleRate: z.number(),
+	sourceChannels: z.number(),
+	targetSampleRate: z.number(),
+	targetChannels: z.number(),
+	format: PcmSampleFormatSchema,
+	tag: z.string().optional(),
+	createdAtMs: z.number(),
+	lastActivityMs: z.number(),
+	framesIn: z.number(),
+	framesOut: z.number()
+});
 /**
-* `broker` — unified pub/sub broker registry, system-scoped collection.
+* audio-codec — bidirectional PCM ↔ encoded audio I/O box.
 *
-* The cap models any kind-tagged message broker the user wants to
-* register and that other addons might consume. The first two kinds
-* are MQTT (mosquitto / aedes embedded / cloud bridge) and
-* Home Assistant (HA WebSocket — subscribe_entities + call_service).
-* Future kinds (Zigbee2MQTT bridge, ZHA, KNX, Telegram, …) plug in
-* the same surface.
+* Independent per-consumer sessions. The provider runs decode + resample
+* (or resample + encode) inside the session so a 16kHz mono ASA
+* subscriber and a 48kHz stereo WebRTC subscriber on the same source
+* stream don't share resamplers.
 *
-* Why one cap, not one cap per kind:
-*   - The integrations page wants a single table of "every broker"
-*     across kinds; a unified cap drives it without join logic.
-*   - Generic admin operations (add / remove / test / status) are
-*     identical across kinds — duplicating them per cap was busywork.
-*   - The `network-access` cap precedent: same interface, many
-*     `providerKind: 'ingress'` implementations (Tailscale, ngrok, …).
-*
-* What stays kind-specific:
-*   - `getBrokerConfig` payload (kind decides whether it returns
-*     mqtt URL+creds, HA baseUrl+token, …) — typed as
-*     `Record<string, unknown>` at the wire; consumers narrow.
-*   - `publish` / `subscribe` / `getState` arguments (target / filter /
-*     key) — also typed as `Record<string, unknown>` so each kind can
-*     evolve its surface (MQTT topic+qos vs HA entity_id+domain)
-*     without rebreaking the cap signature.
-*   - `add` `settings` payload (different fields per kind, validated by
-*     the kind-specific provider).
+* Singleton on each node. Decoder and encoder live in the same provider
+* because they share the underlying libav contexts (node-av today,
+* pluggable later) — operators always install one or the other together.
+*/
+var audioCodecCapability = {
+	name: "audio-codec",
+	scope: "system",
+	mode: "singleton",
+	preferredProvider: "decoder-nodeav",
+	methods: {
+		/** Probe the local runtime and return the supported codec matrix. */
+		listSupportedCodecs: method(z.void(), z.array(AudioCodecInfoSchema).readonly()),
+		/** Cheap predicate — does the runtime support `(codec, kind)`? */
+		canHandle: method(z.object({
+			codec: z.string(),
+			kind: z.enum(["decode", "encode"])
+		}), z.boolean()),
+		createDecodeSession: method(AudioDecodeSessionConfigSchema, z.object({
+			sessionId: z.string(),
+			nodeId: z.string()
+		}), { kind: "mutation" }),
+		createEncodeSession: method(AudioEncodeSessionConfigSchema, z.object({
+			sessionId: z.string(),
+			nodeId: z.string()
+		}), { kind: "mutation" }),
+		closeSession: method(z.object({
+			sessionId: z.string(),
+			nodeId: z.string().optional()
+		}), z.void(), { kind: "mutation" }),
+		/** Push one encoded audio frame into a decode session. */
+		pushEncodedFrame: method(z.object({
+			sessionId: z.string(),
+			nodeId: z.string().optional(),
+			data: z.instanceof(Uint8Array),
+			/** Source PTS in milliseconds. Synthesised when omitted. */
+			pts: z.number().optional()
+		}), z.void(), { kind: "mutation" }),
+		/** Pull up to `maxCount` PCM chunks from a decode session. */
+		pullPcm: method(z.object({
+			sessionId: z.string(),
+			nodeId: z.string().optional(),
+			maxCount: z.number().int().positive().default(8)
+		}), z.array(AudioPcmChunkSchema)),
+		/** Push one PCM chunk into an encode session. */
+		pushPcm: method(z.object({
+			sessionId: z.string(),
+			nodeId: z.string().optional(),
+			data: z.instanceof(Uint8Array),
+			/** Source PTS in milliseconds. */
+			pts: z.number().optional()
+		}), z.void(), { kind: "mutation" }),
+		/** Pull up to `maxCount` encoded chunks from an encode session. */
+		pullEncoded: method(z.object({
+			sessionId: z.string(),
+			nodeId: z.string().optional(),
+			maxCount: z.number().int().positive().default(8)
+		}), z.array(AudioEncodedChunkSchema)),
+		/** Flush any pending encoded output (call before close on graceful tear). */
+		flushEncode: method(z.object({
+			sessionId: z.string(),
+			nodeId: z.string().optional()
+		}), z.array(AudioEncodedChunkSchema), { kind: "mutation" }),
+		listActiveSessions: method(z.void(), z.array(SessionInventoryEntrySchema).readonly())
+	}
+};
+var AuthResultSchema = z.object({
+	userId: z.string(),
+	username: z.string(),
+	email: z.string().optional(),
+	displayName: z.string().optional(),
+	/**
+	* Whether the authenticating user is an admin. The auth-provider
+	* surface returns this so the server's login flow can mint a JWT
+	* with the correct bypass flag. Non-admin users authenticated via
+	* an external IdP still need their scopes assigned by an admin via
+	* `setUserScopes` — the SSO flow doesn't carry permissions.
+	*/
+	isAdmin: z.boolean().default(false)
+});
+var authProviderCapability = {
+	name: "auth-provider",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		validateCredentials: method(z.object({
+			username: z.string(),
+			password: z.string()
+		}), AuthResultSchema.nullable(), { kind: "mutation" }),
+		getLoginUrl: method(z.object({ state: z.string() }), z.string()),
+		handleCallback: method(z.record(z.string(), z.string()), AuthResultSchema, { kind: "mutation" }),
+		validateToken: method(z.object({ token: z.string() }), AuthResultSchema.nullable())
+	},
+	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+	mount: { kind: "skip" }
+};
+/**
+* Orchestrator-side destination metadata. The orchestrator computes
+* `id = <addonId>:<subId>` from its provider lookup so consumers
+* (admin UI, restore flow) see one canonical key.
 *
-* Bidirectionality:
-*   - `publish` is RPC — synchronous result (provider-defined).
-*   - `subscribe` returns a subscription handle; the actual message
-*     stream flows over the typed event-bus as `broker.message` events
-*     keyed by `(brokerId, subscriptionId)`. Consumers filter in their
-*     event handler. Subscriptions persist across reconnects — the
-*     provider re-subscribes upstream after a transport drop.
+* Phase 4 (admin UI redesign) adds the per-destination policy fields
+* (`enabled`, `retentionCount`, `label`) so the destinations table can
+* render the joined view without a follow-up round-trip. The backend
+* already joins these in `listDestinations` — we now surface them on
+* the wire.
 *
-* Why event-bus push (not a subscription RPC stream):
-*   - Matches the rest of CamStack's D8 contract — events for telemetry,
-*     RPC for loss-is-a-bug. Broker messages are telemetry (a single
-*     drop is recoverable via `getState({key})`).
-*   - Frees `broker.subscribe` from holding a long-lived RPC channel.
-*   - Cross-process: events already route through `$event-bus`; no
-*     per-broker wire-shaping needed.
+* `lastSuccessAt` / `lastSuccessSizeBytes` are computed from each
+* location's `manifests.json` (newest archive). Optional — locations
+* with no archives yet leave them undefined.
 */
-var BrokerStatusEnum = z.enum([
-	"connected",
-	"disconnected",
-	"connecting",
-	"auth-failed",
-	"unreachable",
-	"error"
-]);
-var BrokerInfoSchema$1 = z.object({
-	/** Stable broker id. Persisted; survives addon restarts. */
+var BackupDestinationInfoSchema = z.object({
+	/**
+	* Sub-id within this addon. Convention `default` for single-
+	* destination addons; addons that host many (S3 with N buckets)
+	* pick stable per-bucket strings. The orchestrator stitches
+	* `<manifestId>:<subId>` for the wire format.
+	*/
+	subId: z.string(),
+	displayName: z.string(),
+	description: z.string().optional(),
+	kind: z.string(),
+	triggerSupported: z.boolean(),
+	restoreSupported: z.boolean()
+}).extend({
+	/** `<addonId>:<subId>` — globally-unique dispatch key. */
 	id: z.string(),
-	/** Addon id of the provider that OWNS this broker.
-	*
-	*  The `broker` cap is a system-scoped collection: several addons
-	*  register a `broker` provider, each owning a DISJOINT set of
-	*  brokers (mqtt-broker owns `mqtt_*`, provider-homeassistant owns
-	*  `ha_*`). A broker therefore belongs to exactly one addon — like a
-	*  device belongs to one integration. The admin UI threads this id
-	*  back as the `{ addonId }` system-collection selector on every
-	*  id-keyed call (`get` / `getSettings` / `setSettings` / `remove` /
-	*  `testConnection`), so the call routes to the OWNING provider
-	*  instead of defaulting to the first-registered one. */
+	/**
+	* Manifest id of the owning addon. The Settings button on the
+	* destination card opens that addon's `globalSettingsSchema` panel.
+	*/
 	addonId: z.string(),
-	/** Human-readable name (operator-chosen at add-time). */
-	name: z.string(),
-	/** Provider-defined kind tag — `mqtt` / `home-assistant` / future. */
-	kind: z.string(),
-	status: BrokerStatusEnum,
-	/** Free-form provider-specific info (HA version, MQTT broker
-	*  flavour, latency, mTLS active, …). */
-	info: z.record(z.string(), z.unknown()),
-	/** Ms epoch of the last connection probe / status update. */
-	lastCheckedAt: z.number().nullable(),
-	/** Last error message, when `status` indicates failure. */
-	error: z.string().nullable()
-});
-var RegistryStatusSchema = z.object({
-	brokerCount: z.number().int().nonnegative(),
-	connectedCount: z.number().int().nonnegative()
+	/** Operator-toggled enable flag from the destination-policy table. */
+	enabled: z.boolean(),
+	/** Operator-defined retention count (archives kept per destination). */
+	retentionCount: z.number(),
+	/** Operator-defined display label (overrides storage location displayName). */
+	label: z.string().optional(),
+	/** Newest-archive timestamp from `manifests.json`, or undefined. */
+	lastSuccessAt: z.number().optional(),
+	/** Newest-archive size from `manifests.json`, or undefined. */
+	lastSuccessSizeBytes: z.number().optional(),
+	/** Per-destination cron expression. Empty = manual-only (no schedule). */
+	cron: z.string().optional(),
+	/** ms-epoch of next computed firing for this destination's cron, if any. */
+	nextRunAt: z.number().optional(),
+	/** ms-epoch of last successful scheduled run (mirrors policy.lastRunAt). */
+	lastRunAt: z.number().optional()
 });
 /**
-* One entry per `broker` provider — which addon provides which broker
-* kind(s). The unified create picker reads this to know, for each
-* (addonId, kind) pair the operator can pick, where to route the
-* follow-up `getSettingsSchema` / `testSettings` / `add` calls (via the
-* `{ addonId }` selector). A provider only advertises a kind here when
-* it implements `getSettingsSchema` for that kind (so the picker never
-* offers a kind whose creation form can't be rendered).
+* Per-archive entry returned by `backup.listArchives({ destinationId })`.
+* Same shape the destination drill-in renders. Sourced from the per-
+* location `manifests.json` (no per-archive tarball read required).
 */
-var BrokerProviderInfoSchema = z.object({
-	/** Addon id of the `broker` provider this entry describes. */
-	addonId: z.string(),
-	/** Broker kinds this provider can create, with a display label. */
-	kinds: z.array(z.object({
-		kind: z.string(),
-		label: z.string()
-	}))
+var BackupArchiveEntrySchema = z.object({
+	id: z.string(),
+	filename: z.string(),
+	createdAt: z.number(),
+	sizeBytes: z.number(),
+	label: z.string().optional(),
+	/** Top-level locations included in the archive (db, addons, tls, …). */
+	locations: z.array(z.string()).readonly()
 });
-var ListInputSchema = z.object({ 
-/** Optional kind filter — `list({kind:'home-assistant'})` returns
-*  only HA brokers. Omit to list every broker. */
-kind: z.string().optional() });
-var GetInputSchema = z.object({ id: z.string() });
-var AddInputSchema = z.object({
-	kind: z.string().min(1),
-	name: z.string().min(1),
-	/**
-	* ADOPT an existing id instead of minting a new one.
-	*
-	* Written the day this cost an outage. A broker's id is not a detail: HA
-	* devices carry it inside their `stableId` (`ha:ha_004:dev:…`), so a broker
-	* lost from config and re-added as `ha_001` leaves every one of its devices
-	* bound to a broker that no longer exists. Re-entering the password under the
-	* ORIGINAL id turns a multi-step device migration back into re-entering a
-	* password.
-	*
-	* A provider MUST refuse an id that is already in use — adopting a live
-	* broker's id would silently take it over.
-	*/
-	id: z.string().min(1).optional(),
-	/** Kind-specific settings (e.g. MQTT `{url,username,password}` or HA
-	*  `{baseUrl,accessToken}`). Validated by the kind-specific provider
-	*  branch on receipt — invalid shape rejects the add. */
-	settings: z.record(z.string(), z.unknown())
-});
-var AddResultSchema = z.object({ id: z.string() });
-var RemoveInputSchema = z.object({ id: z.string() });
-var TestConnectionResultSchema = z.discriminatedUnion("ok", [z.object({
-	ok: z.literal(true),
-	latencyMs: z.number().nonnegative()
-}), z.object({
-	ok: z.literal(false),
-	error: z.string()
-})]);
-var SettingsRecordSchema$1 = z.record(z.string(), z.unknown());
-var SettingsSchemaInputSchema = z.object({ kind: z.string() });
-var TestSettingsInputSchema = z.object({
-	kind: z.string(),
-	settings: SettingsRecordSchema$1
+var BackupEntrySchema = z.object({
+	id: z.string(),
+	/** Addon id of the destination that owns this backup (e.g. `local-backup`, `s3-backup`). */
+	destinationId: z.string().optional(),
+	label: z.string().optional(),
+	createdAt: z.number(),
+	sizeBytes: z.number(),
+	locations: z.array(z.string()).optional()
 });
-var TestSettingsResultSchema = z.discriminatedUnion("ok", [z.object({
-	ok: z.literal(true),
-	latencyMs: z.number().nonnegative().optional()
-}).strict(), z.object({
-	ok: z.literal(false),
-	error: z.string()
-})]);
-var SettingsSchemaResultSchema = z.unknown().nullable();
-var PublishInputSchema = z.object({
-	brokerId: z.string(),
-	/** Kind-specific routing target.
-	*  MQTT: `{ topic: string, qos?: 0|1|2, retain?: boolean }`.
-	*  HA:   `{ domain: string, service: string, entityId?: string, area?: string }`. */
-	target: z.record(z.string(), z.unknown()),
-	/** Kind-specific payload.
-	*  MQTT: raw string / number / object (provider serialises).
-	*  HA:   service-call `data` object (transition, brightness, …). */
-	payload: z.unknown().optional()
+var ArchiveEntrySchema = z.object({
+	path: z.string(),
+	kind: z.enum([
+		"file",
+		"dir",
+		"symlink"
+	]),
+	sizeBytes: z.number(),
+	mtime: z.number()
 });
-var SubscribeInputSchema = z.object({
-	brokerId: z.string(),
-	/** Kind-specific filter.
-	*  MQTT: `{ topic: string, qos?: 0|1|2 }` — topic can include wildcards.
-	*  HA:   `{ entityIds: string[] }` or `{ domain: string }`. */
-	filter: z.record(z.string(), z.unknown())
+var ArchiveManifestSchema = z.object({
+	archiveVersion: z.literal(1),
+	createdAt: z.number(),
+	dataDir: z.string(),
+	locations: z.array(z.string()),
+	entries: z.array(ArchiveEntrySchema),
+	totalBytes: z.number(),
+	totalFiles: z.number()
 });
-var SubscribeResultSchema = z.object({ 
-/** Stable subscription id. Used to unsubscribe and to filter the
-*  matching `broker.message` events on the bus. */
-subscriptionId: z.string() });
-var UnsubscribeInputSchema = z.object({
-	brokerId: z.string(),
-	subscriptionId: z.string()
+var LocationStatSchema = z.object({
+	name: z.string(),
+	sizeBytes: z.number(),
+	fileCount: z.number(),
+	present: z.boolean()
 });
-var GetStateInputSchema = z.object({
-	brokerId: z.string(),
-	/** Kind-specific lookup key.
-	*  MQTT: topic string (returns the last retained message).
-	*  HA:   entity_id (returns the cached entity state). */
-	key: z.string()
+/**
+* A backup schedule — the N:M "entry" that binds one cron cadence to a
+* SET of destination locations. Supersedes the per-location cron on
+* `BackupDestinationPolicy`: an operator creates a schedule, picks the
+* `backups` locations it should write to, and the orchestrator fans a
+* single archive out to all of them when the cron fires.
+*
+* `retentionCount` is per-schedule (D-decision 2026-07-28): every
+* location targeted by this schedule keeps this many archives from
+* this schedule's runs.
+*
+* `dataSources` optionally narrows which top-level state locations
+* (db, addons, tls, …) are archived; omitted = the orchestrator's
+* default full set.
+*/
+var BackupScheduleSchema = z.object({
+	/** Stable id. Generated by the orchestrator on first upsert if absent. */
+	id: z.string(),
+	/** Operator-facing display name. */
+	label: z.string(),
+	/** 5-field POSIX cron. Empty = disabled cadence (kept for editing). */
+	cron: z.string(),
+	/** Master on/off toggle for the whole schedule. */
+	enabled: z.boolean(),
+	/** `backups`-location ids this schedule writes to (fan-out set). */
+	locationIds: z.array(z.string()).readonly(),
+	/** Archives kept per targeted location for this schedule. */
+	retentionCount: z.number().int().min(1).max(1e3),
+	/** Optional subset of source locations to include; omitted = all. */
+	dataSources: z.array(z.string()).readonly().optional(),
+	/** ms-epoch of last successful run. */
+	lastRunAt: z.number().optional(),
+	/** ms-epoch of next computed firing (read-only, filled on list). */
+	nextRunAt: z.number().optional()
 });
-var brokerCapability = {
-	name: "broker",
+/**
+* backup — singleton capability for backup management.
+*
+* Implemented by `local-backup` addon. Future providers (S3, rsync)
+* can replace it by registering the same capability.
+*/
+var backupCapability = {
+	name: "backup",
 	scope: "system",
-	mode: "collection",
-	providerKind: "broker",
-	status: {
-		schema: RegistryStatusSchema,
-		kind: "poll"
-	},
+	mode: "singleton",
 	methods: {
-		list: method(ListInputSchema, z.array(BrokerInfoSchema$1)),
-		get: method(GetInputSchema, BrokerInfoSchema$1.nullable()),
-		/** Enumerate which addon provides which broker kind(s) for the
-		*  unified create picker. The auto-mount fans this array across
-		*  every registered `broker` provider (array-output method), so the
-		*  picker sees every kind from every provider in one call. */
-		listProviders: method(z.void(), z.array(BrokerProviderInfoSchema), { auth: "admin" }),
-		add: method(AddInputSchema, AddResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		remove: method(RemoveInputSchema, z.void(), {
+		/**
+		* Flat aggregate of every destination across every registered
+		* `backup-destination` provider. This is the orchestrator-side
+		* surface; it expands per-addon `listDestinations()` results into
+		* one list the UI can render directly.
+		*/
+		listDestinations: method(z.void(), z.array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }),
+		/**
+		* Trigger a backup. Without `destinations` the orchestrator fans
+		* out to every destination flagged as enabled in the routing
+		* config; with it, only the listed addons receive the archive.
+		*/
+		trigger: method(z.object({
+			/** Subset of registered `backup-destination` addon ids to write to. */
+			destinations: z.array(z.string()).optional(),
+			locations: z.array(z.string()).optional(),
+			label: z.string().optional(),
+			/**
+			* Per-run retention override applied to every targeted
+			* destination. Used by schedule-driven runs (per-entry
+			* retention). Omitted = each destination's own policy
+			* retention (manual runs).
+			*/
+			retentionCount: z.number().int().min(1).max(1e3).optional()
+		}).optional(), z.array(BackupEntrySchema).readonly(), {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		testConnection: method(GetInputSchema, TestConnectionResultSchema, {
+		/** Union of every destination's archives, each tagged with `destinationId`. */
+		list: method(z.void(), z.array(BackupEntrySchema).readonly(), { auth: "admin" }),
+		/**
+		* Pre-backup snapshot of the well-known locations on disk — sizes
+		* + file counts. Powers the opt-in checklist that lets the
+		* operator pick which subsections of state get archived.
+		*/
+		listLocations: method(z.void(), z.array(LocationStatSchema).readonly(), { auth: "admin" }),
+		/**
+		* Read the embedded `.camstack-backup-manifest.json` from a
+		* previously-created archive. The manifest carries the full
+		* file/dir listing with sizes + mtimes — the readdir snapshot
+		* the UI shows in the "Contents" panel. Returns `null` when the
+		* archive predates manifests (created before this feature
+		* shipped).
+		*/
+		getEntries: method(z.object({
+			destinationId: z.string(),
+			backupId: z.string()
+		}), ArchiveManifestSchema.nullable(), { auth: "admin" }),
+		restore: method(z.object({
+			destinationId: z.string(),
+			backupId: z.string(),
+			/**
+			* Optional whitelist — only restore these top-level locations
+			* from the archive. Default = every location the archive
+			* carries (full restore). The boot-time apply hook reads
+			* this list and skips entries whose path doesn't start with
+			* any of them.
+			*/
+			locations: z.array(z.string()).optional()
+		}), z.void(), {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Read the persisted settings record for a broker (kind-specific
-		*  shape). Admin-only — settings may contain secrets. Returns `null`
-		*  when the broker id is unknown to the provider (the collection
-		*  fallback may route a foreign id to the first provider). */
-		getSettings: method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }),
-		/** Overwrite the persisted settings record. The kind-specific
-		*  provider validates the shape and applies the change (reconnects
-		*  if credentials changed). */
-		setSettings: method(z.object({
-			id: z.string(),
-			settings: SettingsRecordSchema$1
+		delete: method(z.object({
+			destinationId: z.string(),
+			backupId: z.string()
 		}), z.void(), {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Returns the kind-specific connection config the consumer needs
-		*  to open its own client (MQTT pattern: `{url, username, password,
-		*  clientIdPrefix}`). HA providers MAY return the auth envelope
-		*  but typical HA consumers use `publish` / `subscribe` instead.
-		*  Returns `null` when the broker id is unknown to the provider. */
-		getBrokerConfig: method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }),
-		getSettingsSchema: method(SettingsSchemaInputSchema, SettingsSchemaResultSchema, { auth: "admin" }),
-		testSettings: method(TestSettingsInputSchema, TestSettingsResultSchema, {
+		/**
+		* List archives at a single destination. Reads the per-location
+		* `manifests.json` and returns one entry per archive (newest
+		* first). Powers the destinations-table drill-in in admin UI.
+		*/
+		listArchives: method(z.object({ destinationId: z.string() }), z.array(BackupArchiveEntrySchema).readonly(), { auth: "admin" }),
+		/**
+		* Upsert a per-destination policy row. The `locationId` MUST be
+		* the id of an existing `backups`-typed `StorageLocation`. Used
+		* by the admin-UI destinations table (enable toggle + retention
+		* input + optional label).
+		*/
+		upsertDestinationPolicy: method(z.object({
+			locationId: z.string(),
+			enabled: z.boolean(),
+			retentionCount: z.number().int().min(1).max(1e3),
+			label: z.string().optional(),
+			/**
+			* Per-destination cron expression. Empty string clears the
+			* schedule (manual-only). Validated server-side via croner;
+			* malformed expressions reject the upsert with an actionable
+			* message.
+			*/
+			cron: z.string().optional()
+		}), z.void(), {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		publish: method(PublishInputSchema, z.unknown(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		subscribe: method(SubscribeInputSchema, SubscribeResultSchema, {
+		/**
+		* Validate a cron expression and peek the next N firing times.
+		* Used by the admin-UI CronEditor to render a live "next-run"
+		* preview as the operator edits the pattern.
+		*/
+		previewSchedule: method(z.object({
+			cron: z.string(),
+			count: z.number().int().min(1).max(20).optional()
+		}), z.object({
+			ok: z.boolean(),
+			error: z.string().optional(),
+			nextRuns: z.array(z.number()).readonly()
+		})),
+		/**
+		* List every backup schedule (the N:M entries), each with its
+		* computed `nextRunAt`. Powers the Schedules section of the
+		* admin-UI Backups page.
+		*/
+		listSchedules: method(z.void(), z.array(BackupScheduleSchema).readonly(), { auth: "admin" }),
+		/**
+		* Create or replace a schedule. An empty / absent `id` mints a new
+		* one; a present `id` replaces in place. `cron` is validated
+		* server-side; `locationIds` must reference existing `backups`
+		* locations (unknown ids are dropped with a warning).
+		*/
+		upsertSchedule: method(z.object({
+			id: z.string().optional(),
+			label: z.string(),
+			cron: z.string(),
+			enabled: z.boolean(),
+			locationIds: z.array(z.string()).readonly(),
+			retentionCount: z.number().int().min(1).max(1e3),
+			dataSources: z.array(z.string()).readonly().optional()
+		}), BackupScheduleSchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		unsubscribe: method(UnsubscribeInputSchema, z.void(), {
+		/** Delete a schedule by id. Does not touch the target locations. */
+		deleteSchedule: method(z.object({ id: z.string() }), z.void(), {
 			kind: "mutation",
 			auth: "admin"
-		}),
-		/** Read the broker's cached state for a key. Returns `null` when
-		*  unknown to the broker (never published / unknown entity). */
-		getState: method(GetStateInputSchema, z.unknown().nullable()),
-		/** Status method — explicit registration with a `z.void()` input so
-		*  the codegen-generated tRPC router types its input as
-		*  `{addonId?: string, nodeId?: string}` (system-scoped collection
-		*  shape) instead of the device-scoped `{deviceId}` fallback. */
-		getStatus: method(z.void(), RegistryStatusSchema)
+		})
 	}
 };
 /**
-* camera-pipeline-config — device-scoped wrapper that carries the
-* pipeline-orchestrator's PER-DEVICE settings contribution into the
-* binding-driven device-detail aggregate (D12).
+* `broker` — unified pub/sub broker registry, system-scoped collection.
 *
-* Why this cap exists: the orchestrator's per-camera settings (motion
-* sources / fps / cooldown, detection + audio mode, cluster assignment,
-* the Detection-Zones top-tab widget, onboard-motion + onboard-object-
-* detection toggles) were historically contributed via the
-* `pipeline-orchestrator` cap's `exposesDeviceSettings` methods. But
-* `pipeline-orchestrator` is `scope:'system'` and never appears in
-* `getBindings(deviceId)`, so the D12 binding-driven aggregate
-* (`device-manager.getDeviceAggregate`) silently dropped the entire
-* contribution — the zones tab and the pipeline/motion settings vanished
-* from device-detail.
+* The cap models any kind-tagged message broker the user wants to
+* register and that other addons might consume. The first two kinds
+* are MQTT (mosquitto / aedes embedded / cloud bridge) and
+* Home Assistant (HA WebSocket — subscribe_entities + call_service).
+* Future kinds (Zigbee2MQTT bridge, ZHA, KNX, Telegram, …) plug in
+* the same surface.
 *
-* `kind:'wrapper'` + `defaultActive:true` makes this cap auto-bind to every
-* camera (it appears in `getBindings` as `kind:'wrapped'`), so the aggregate
-* invokes the orchestrator's contribution methods through it — restoring the
-* tabs without violating D12 (contributions come only from bound providers).
+* Why one cap, not one cap per kind:
+*   - The integrations page wants a single table of "every broker"
+*     across kinds; a unified cap drives it without join logic.
+*   - Generic admin operations (add / remove / test / status) are
+*     identical across kinds — duplicating them per cap was busywork.
+*   - The `network-access` cap precedent: same interface, many
+*     `providerKind: 'ingress'` implementations (Tailscale, ngrok, …).
 *
-* `exposesDeviceSettings:true` (NOT `deviceConfig`) is intentional: the
-* contribution is a dynamic, multi-section, per-device hand-built structure
-* (it probes bindings for onboard-motion / native-object-detection presence,
-* cluster nodes, etc.), which the derived-UI `deviceConfig` archetype cannot
-* express. This mirrors the `detection-pipeline` / `motion-detection`
-* wrapper pattern. The orchestrator class is the provider; it already
-* implements the three DeviceSettingsContribution methods.
-*/
-var cameraPipelineConfigCapability = {
-	name: "camera-pipeline-config",
-	scope: "device",
-	mode: "singleton",
-	kind: "wrapper",
-	defaultActive: true,
-	deviceTypes: [DeviceType.Camera],
-	exposesDeviceSettings: true,
-	methods: {}
-};
-/** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
-var StreamFormatSchema = z.enum([
-	"webrtc",
-	"hls",
-	"mjpeg",
-	"rtsp"
-]);
-/** A container `produceEventMedia` can emit. */
-var EventMediaKindSchema = z.enum(["mp4", "gif"]);
-/**
-* One produced artifact, referenced by HANDLE.
+* What stays kind-specific:
+*   - `getBrokerConfig` payload (kind decides whether it returns
+*     mqtt URL+creds, HA baseUrl+token, …) — typed as
+*     `Record<string, unknown>` at the wire; consumers narrow.
+*   - `publish` / `subscribe` / `getState` arguments (target / filter /
+*     key) — also typed as `Record<string, unknown>` so each kind can
+*     evolve its surface (MQTT topic+qos vs HA entity_id+domain)
+*     without rebreaking the cap signature.
+*   - `add` `settings` payload (different fields per kind, validated by
+*     the kind-specific provider).
 *
-* Never inline bytes: a produced clip is 200 KB–5 MB and every consumer of this
-* method is in another runner ([D9](../../../../docs/decisions/adr-0009.md),
-* [D18](../../../../docs/decisions/adr-0018.md) — cross-process media is fetched
-* on demand, compressed, by handle). `bytes` is here so a caller can decide
-* whether it wants the fetch at all.
+* Bidirectionality:
+*   - `publish` is RPC — synchronous result (provider-defined).
+*   - `subscribe` returns a subscription handle; the actual message
+*     stream flows over the typed event-bus as `broker.message` events
+*     keyed by `(brokerId, subscriptionId)`. Consumers filter in their
+*     event handler. Subscriptions persist across reconnects — the
+*     provider re-subscribes upstream after a transport drop.
+*
+* Why event-bus push (not a subscription RPC stream):
+*   - Matches the rest of CamStack's D8 contract — events for telemetry,
+*     RPC for loss-is-a-bug. Broker messages are telemetry (a single
+*     drop is recoverable via `getState({key})`).
+*   - Frees `broker.subscribe` from holding a long-lived RPC channel.
+*   - Cross-process: events already route through `$event-bus`; no
+*     per-broker wire-shaping needed.
 */
-var EventMediaArtifactSchema = z.object({
-	kind: EventMediaKindSchema,
-	/** Opaque, single-camera, short-lived. Redeem with `fetchEventMedia`. */
-	handle: z.string(),
-	/**
-	* The node holding the bytes — the ROUTING key for `fetchEventMedia`.
+var BrokerStatusEnum = z.enum([
+	"connected",
+	"disconnected",
+	"connecting",
+	"auth-failed",
+	"unreachable",
+	"error"
+]);
+var BrokerInfoSchema$1 = z.object({
+	/** Stable broker id. Persisted; survives addon restarts. */
+	id: z.string(),
+	/** Addon id of the provider that OWNS this broker.
 	*
-	* `stream-broker` is a singleton cap and an unpinned call never leaves the
-	* hub, so a handle produced on an agent's broker would be redeemed against
-	* the hub's store and come back `null`. Same contract, same field name and
-	* the same reason as `FrameHandleSchema.nodeId`: the producer stamps where it
-	* lives and the consumer pins to it.
-	*/
-	nodeId: z.string(),
-	mime: z.string(),
-	bytes: z.number().int(),
-	width: z.number().int(),
-	height: z.number().int()
+	*  The `broker` cap is a system-scoped collection: several addons
+	*  register a `broker` provider, each owning a DISJOINT set of
+	*  brokers (mqtt-broker owns `mqtt_*`, provider-homeassistant owns
+	*  `ha_*`). A broker therefore belongs to exactly one addon — like a
+	*  device belongs to one integration. The admin UI threads this id
+	*  back as the `{ addonId }` system-collection selector on every
+	*  id-keyed call (`get` / `getSettings` / `setSettings` / `remove` /
+	*  `testConnection`), so the call routes to the OWNING provider
+	*  instead of defaulting to the first-registered one. */
+	addonId: z.string(),
+	/** Human-readable name (operator-chosen at add-time). */
+	name: z.string(),
+	/** Provider-defined kind tag — `mqtt` / `home-assistant` / future. */
+	kind: z.string(),
+	status: BrokerStatusEnum,
+	/** Free-form provider-specific info (HA version, MQTT broker
+	*  flavour, latency, mTLS active, …). */
+	info: z.record(z.string(), z.unknown()),
+	/** Ms epoch of the last connection probe / status update. */
+	lastCheckedAt: z.number().nullable(),
+	/** Last error message, when `status` indicates failure. */
+	error: z.string().nullable()
 });
-/**
-* What a production actually covered — the answer to the only question an
-* operator asks about a notification clip.
-*
-* `fromTs`/`toTs` are WALL CLOCK, derived from the ring's own packet timeline,
-* so a caller can state "this clip starts 4.1 s before the event" instead of
-* inferring it from a duration. A production whose `fromTs` is later than the
-* event is a production with no pre-roll, and that is exactly the defect this
-* method exists to make visible rather than plausible.
-*/
-var EventMediaCoverageSchema = z.object({
-	fromTs: z.number(),
-	toTs: z.number(),
-	/** Encoded packets in the muxed window. */
-	packets: z.number().int()
+var RegistryStatusSchema = z.object({
+	brokerCount: z.number().int().nonnegative(),
+	connectedCount: z.number().int().nonnegative()
 });
 /**
-* The result of ONE cut, in every container the caller asked for.
-*
-* Every artifact in `media` came out of the SAME window of the SAME rendition —
-* that is the whole reason this is one method rather than one call per format.
-* A consumer attaching a gif and a video can no longer show two different
-* moments, because it never chose two sources.
+* One entry per `broker` provider — which addon provides which broker
+* kind(s). The unified create picker reads this to know, for each
+* (addonId, kind) pair the operator can pick, where to route the
+* follow-up `getSettingsSchema` / `testSettings` / `add` calls (via the
+* `{ addonId }` selector). A provider only advertises a kind here when
+* it implements `getSettingsSchema` for that kind (so the picker never
+* offers a kind whose creation form can't be rendered).
 */
-var EventMediaProductionSchema = z.object({
-	media: z.array(EventMediaArtifactSchema).readonly(),
-	coverage: EventMediaCoverageSchema,
-	/** The rendition actually cut from — what the default or the fallback chose. */
-	profile: CamProfileSchema,
-	/** `copy` = the camera's own H.264, untouched. `encode` = re-encoded (H.265
-	*  source, a downscale, or a playback rate other than 1). */
-	video: z.enum(["copy", "encode"])
+var BrokerProviderInfoSchema = z.object({
+	/** Addon id of the `broker` provider this entry describes. */
+	addonId: z.string(),
+	/** Broker kinds this provider can create, with a display label. */
+	kinds: z.array(z.object({
+		kind: z.string(),
+		label: z.string()
+	}))
 });
-var RtspRestreamEntrySchema = z.object({
-	brokerId: z.string(),
-	url: z.string(),
-	mutedUrl: z.string(),
-	enabled: z.boolean(),
+var ListInputSchema = z.object({ 
+/** Optional kind filter — `list({kind:'home-assistant'})` returns
+*  only HA brokers. Omit to list every broker. */
+kind: z.string().optional() });
+var GetInputSchema = z.object({ id: z.string() });
+var AddInputSchema = z.object({
+	kind: z.string().min(1),
+	name: z.string().min(1),
 	/**
-	* Source-stream codec / resolution for the camStream this entry serves
-	* (the broker's "high"/"mid"/"low" profile slot for this device).
-	* Used by exporter pickers (`pickPreferredRtspEntry`) to resolve
-	* `streamPreference: 'auto'` to the slot whose source is closest to
-	* the consumer's target — Alexa wants ~720p, HomeKit wants ~1080p,
-	* and there's no point dialling the 4K slot for an Echo Show. Absent
-	* when the source publisher never advertised the field; pickers fall
-	* back to first-enabled in that case.
+	* ADOPT an existing id instead of minting a new one.
+	*
+	* Written the day this cost an outage. A broker's id is not a detail: HA
+	* devices carry it inside their `stableId` (`ha:ha_004:dev:…`), so a broker
+	* lost from config and re-added as `ha_001` leaves every one of its devices
+	* bound to a broker that no longer exists. Re-entering the password under the
+	* ORIGINAL id turns a multi-step device migration back into re-entering a
+	* password.
+	*
+	* A provider MUST refuse an id that is already in use — adopting a live
+	* broker's id would silently take it over.
 	*/
-	codec: z.string().optional(),
-	resolution: z.object({
-		width: z.number().int().positive(),
-		height: z.number().int().positive()
-	}).optional()
+	id: z.string().min(1).optional(),
+	/** Kind-specific settings (e.g. MQTT `{url,username,password}` or HA
+	*  `{baseUrl,accessToken}`). Validated by the kind-specific provider
+	*  branch on receipt — invalid shape rejects the add. */
+	settings: z.record(z.string(), z.unknown())
 });
-var BrokerRtspClientSchema = z.object({
-	sessionId: z.string(),
-	remoteAddr: z.string(),
-	/** Client `User-Agent` (e.g. `recorder` for the recorder's RTSP pull), or
-	*  null/absent when the client sent none. Lets the UI label a consumer by
-	*  purpose. Optional so a client built against an older schema stays valid. */
-	userAgent: z.string().nullish(),
-	playing: z.boolean(),
-	muted: z.boolean(),
-	connectedAt: z.number(),
-	lastRtpAt: z.number(),
-	bytesSent: z.number()
+var AddResultSchema = z.object({ id: z.string() });
+var RemoveInputSchema = z.object({ id: z.string() });
+var TestConnectionResultSchema = z.discriminatedUnion("ok", [z.object({
+	ok: z.literal(true),
+	latencyMs: z.number().nonnegative()
+}), z.object({
+	ok: z.literal(false),
+	error: z.string()
+})]);
+var SettingsRecordSchema$1 = z.record(z.string(), z.unknown());
+var SettingsSchemaInputSchema = z.object({ kind: z.string() });
+var TestSettingsInputSchema = z.object({
+	kind: z.string(),
+	settings: SettingsRecordSchema$1
 });
-var BrokerDecodedClientSchema = z.object({
-	tag: z.string(),
-	subscribedAt: z.number(),
-	maxFps: z.number(),
-	framesDelivered: z.number(),
-	framesDropped: z.number()
+var TestSettingsResultSchema = z.discriminatedUnion("ok", [z.object({
+	ok: z.literal(true),
+	latencyMs: z.number().nonnegative().optional()
+}).strict(), z.object({
+	ok: z.literal(false),
+	error: z.string()
+})]);
+var SettingsSchemaResultSchema = z.unknown().nullable();
+var PublishInputSchema = z.object({
+	brokerId: z.string(),
+	/** Kind-specific routing target.
+	*  MQTT: `{ topic: string, qos?: 0|1|2, retain?: boolean }`.
+	*  HA:   `{ domain: string, service: string, entityId?: string, area?: string }`. */
+	target: z.record(z.string(), z.unknown()),
+	/** Kind-specific payload.
+	*  MQTT: raw string / number / object (provider serialises).
+	*  HA:   service-call `data` object (transition, brightness, …). */
+	payload: z.unknown().optional()
 });
-var BrokerAudioClientSchema = z.object({
-	tag: z.string(),
-	subscribedAt: z.number(),
-	chunksDelivered: z.number()
+var SubscribeInputSchema = z.object({
+	brokerId: z.string(),
+	/** Kind-specific filter.
+	*  MQTT: `{ topic: string, qos?: 0|1|2 }` — topic can include wildcards.
+	*  HA:   `{ entityIds: string[] }` or `{ domain: string }`. */
+	filter: z.record(z.string(), z.unknown())
+});
+var SubscribeResultSchema = z.object({ 
+/** Stable subscription id. Used to unsubscribe and to filter the
+*  matching `broker.message` events on the bus. */
+subscriptionId: z.string() });
+var UnsubscribeInputSchema = z.object({
+	brokerId: z.string(),
+	subscriptionId: z.string()
+});
+var GetStateInputSchema = z.object({
+	brokerId: z.string(),
+	/** Kind-specific lookup key.
+	*  MQTT: topic string (returns the last retained message).
+	*  HA:   entity_id (returns the cached entity state). */
+	key: z.string()
 });
+var brokerCapability = {
+	name: "broker",
+	scope: "system",
+	mode: "collection",
+	providerKind: "broker",
+	status: {
+		schema: RegistryStatusSchema,
+		kind: "poll"
+	},
+	methods: {
+		list: method(ListInputSchema, z.array(BrokerInfoSchema$1)),
+		get: method(GetInputSchema, BrokerInfoSchema$1.nullable()),
+		/** Enumerate which addon provides which broker kind(s) for the
+		*  unified create picker. The auto-mount fans this array across
+		*  every registered `broker` provider (array-output method), so the
+		*  picker sees every kind from every provider in one call. */
+		listProviders: method(z.void(), z.array(BrokerProviderInfoSchema), { auth: "admin" }),
+		add: method(AddInputSchema, AddResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		remove: method(RemoveInputSchema, z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		testConnection: method(GetInputSchema, TestConnectionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Read the persisted settings record for a broker (kind-specific
+		*  shape). Admin-only — settings may contain secrets. Returns `null`
+		*  when the broker id is unknown to the provider (the collection
+		*  fallback may route a foreign id to the first provider). */
+		getSettings: method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }),
+		/** Overwrite the persisted settings record. The kind-specific
+		*  provider validates the shape and applies the change (reconnects
+		*  if credentials changed). */
+		setSettings: method(z.object({
+			id: z.string(),
+			settings: SettingsRecordSchema$1
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Returns the kind-specific connection config the consumer needs
+		*  to open its own client (MQTT pattern: `{url, username, password,
+		*  clientIdPrefix}`). HA providers MAY return the auth envelope
+		*  but typical HA consumers use `publish` / `subscribe` instead.
+		*  Returns `null` when the broker id is unknown to the provider. */
+		getBrokerConfig: method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }),
+		getSettingsSchema: method(SettingsSchemaInputSchema, SettingsSchemaResultSchema, { auth: "admin" }),
+		testSettings: method(TestSettingsInputSchema, TestSettingsResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		publish: method(PublishInputSchema, z.unknown(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		subscribe: method(SubscribeInputSchema, SubscribeResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		unsubscribe: method(UnsubscribeInputSchema, z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Read the broker's cached state for a key. Returns `null` when
+		*  unknown to the broker (never published / unknown entity). */
+		getState: method(GetStateInputSchema, z.unknown().nullable()),
+		/** Status method — explicit registration with a `z.void()` input so
+		*  the codegen-generated tRPC router types its input as
+		*  `{addonId?: string, nodeId?: string}` (system-scoped collection
+		*  shape) instead of the device-scoped `{deviceId}` fallback. */
+		getStatus: method(z.void(), RegistryStatusSchema)
+	}
+};
 /**
-* Identifies who is holding an encoded / raw-RTP subscription open on
-* the broker. Populated by the subscribing addon when it attaches —
-* defaults to `{ kind: 'unknown' }` for callers that haven't been
-* migrated. The widget surfaces every field that's set so an operator
-* can answer "who is keeping cam X warm?" without grepping logs.
+* camera-pipeline-config — device-scoped wrapper that carries the
+* pipeline-orchestrator's PER-DEVICE settings contribution into the
+* binding-driven device-detail aggregate (D12).
+*
+* Why this cap exists: the orchestrator's per-camera settings (motion
+* sources / fps / cooldown, detection + audio mode, cluster assignment,
+* the Detection-Zones top-tab widget, onboard-motion + onboard-object-
+* detection toggles) were historically contributed via the
+* `pipeline-orchestrator` cap's `exposesDeviceSettings` methods. But
+* `pipeline-orchestrator` is `scope:'system'` and never appears in
+* `getBindings(deviceId)`, so the D12 binding-driven aggregate
+* (`device-manager.getDeviceAggregate`) silently dropped the entire
+* contribution — the zones tab and the pipeline/motion settings vanished
+* from device-detail.
+*
+* `kind:'wrapper'` + `defaultActive:true` makes this cap auto-bind to every
+* camera (it appears in `getBindings` as `kind:'wrapped'`), so the aggregate
+* invokes the orchestrator's contribution methods through it — restoring the
+* tabs without violating D12 (contributions come only from bound providers).
+*
+* `exposesDeviceSettings:true` (NOT `deviceConfig`) is intentional: the
+* contribution is a dynamic, multi-section, per-device hand-built structure
+* (it probes bindings for onboard-motion / native-object-detection presence,
+* cluster nodes, etc.), which the derived-UI `deviceConfig` archetype cannot
+* express. This mirrors the `detection-pipeline` / `motion-detection`
+* wrapper pattern. The orchestrator class is the provider; it already
+* implements the three DeviceSettingsContribution methods.
 */
-var BrokerConsumerKindSchema = z.enum([
-	"alexa",
-	"homekit",
-	"webrtc-browser",
-	"webrtc-mobile",
-	"webrtc-whep",
-	"rtsp-listen",
-	"derived-broker",
-	"recording",
-	"pipeline",
-	"snapshot",
-	"warmup",
-	"unknown"
+var cameraPipelineConfigCapability = {
+	name: "camera-pipeline-config",
+	scope: "device",
+	mode: "singleton",
+	kind: "wrapper",
+	defaultActive: true,
+	deviceTypes: [DeviceType.Camera],
+	exposesDeviceSettings: true,
+	methods: {}
+};
+/** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
+var StreamFormatSchema = z.enum([
+	"webrtc",
+	"hls",
+	"mjpeg",
+	"rtsp"
 ]);
-var BrokerConsumerAttributionSchema = z.object({
-	kind: BrokerConsumerKindSchema,
+/** A container `produceEventMedia` can emit. */
+var EventMediaKindSchema = z.enum(["mp4", "gif"]);
+/**
+* One produced artifact, referenced by HANDLE.
+*
+* Never inline bytes: a produced clip is 200 KB–5 MB and every consumer of this
+* method is in another runner ([D9](../../../../docs/decisions/adr-0009.md),
+* [D18](../../../../docs/decisions/adr-0018.md) — cross-process media is fetched
+* on demand, compressed, by handle). `bytes` is here so a caller can decide
+* whether it wants the fetch at all.
+*/
+var EventMediaArtifactSchema = z.object({
+	kind: EventMediaKindSchema,
+	/** Opaque, single-camera, short-lived. Redeem with `fetchEventMedia`. */
+	handle: z.string(),
 	/**
-	* Free-form label intended to disambiguate consumers OF THE SAME kind
-	* on the same broker — e.g. user name, device alias. Should NOT repeat
-	* the kind / cam / cam-stream / sessionId (those are surfaced by
+	* The node holding the bytes — the ROUTING key for `fetchEventMedia`.
+	*
+	* `stream-broker` is a singleton cap and an unpinned call never leaves the
+	* hub, so a handle produced on an agent's broker would be redeemed against
+	* the hub's store and come back `null`. Same contract, same field name and
+	* the same reason as `FrameHandleSchema.nodeId`: the producer stamps where it
+	* lives and the consumer pins to it.
+	*/
+	nodeId: z.string(),
+	mime: z.string(),
+	bytes: z.number().int(),
+	width: z.number().int(),
+	height: z.number().int()
+});
+/**
+* What a production actually covered — the answer to the only question an
+* operator asks about a notification clip.
+*
+* `fromTs`/`toTs` are WALL CLOCK, derived from the ring's own packet timeline,
+* so a caller can state "this clip starts 4.1 s before the event" instead of
+* inferring it from a duration. A production whose `fromTs` is later than the
+* event is a production with no pre-roll, and that is exactly the defect this
+* method exists to make visible rather than plausible.
+*/
+var EventMediaCoverageSchema = z.object({
+	fromTs: z.number(),
+	toTs: z.number(),
+	/** Encoded packets in the muxed window. */
+	packets: z.number().int()
+});
+/**
+* The result of ONE cut, in every container the caller asked for.
+*
+* Every artifact in `media` came out of the SAME window of the SAME rendition —
+* that is the whole reason this is one method rather than one call per format.
+* A consumer attaching a gif and a video can no longer show two different
+* moments, because it never chose two sources.
+*/
+var EventMediaProductionSchema = z.object({
+	media: z.array(EventMediaArtifactSchema).readonly(),
+	coverage: EventMediaCoverageSchema,
+	/** The rendition actually cut from — what the default or the fallback chose. */
+	profile: CamProfileSchema,
+	/** `copy` = the camera's own H.264, untouched. `encode` = re-encoded (H.265
+	*  source, a downscale, or a playback rate other than 1). */
+	video: z.enum(["copy", "encode"])
+});
+var RtspRestreamEntrySchema = z.object({
+	brokerId: z.string(),
+	url: z.string(),
+	mutedUrl: z.string(),
+	enabled: z.boolean(),
+	/**
+	* Source-stream codec / resolution for the camStream this entry serves
+	* (the broker's "high"/"mid"/"low" profile slot for this device).
+	* Used by exporter pickers (`pickPreferredRtspEntry`) to resolve
+	* `streamPreference: 'auto'` to the slot whose source is closest to
+	* the consumer's target — Alexa wants ~720p, HomeKit wants ~1080p,
+	* and there's no point dialling the 4K slot for an Echo Show. Absent
+	* when the source publisher never advertised the field; pickers fall
+	* back to first-enabled in that case.
+	*/
+	codec: z.string().optional(),
+	resolution: z.object({
+		width: z.number().int().positive(),
+		height: z.number().int().positive()
+	}).optional()
+});
+var BrokerRtspClientSchema = z.object({
+	sessionId: z.string(),
+	remoteAddr: z.string(),
+	/** Client `User-Agent` (e.g. `recorder` for the recorder's RTSP pull), or
+	*  null/absent when the client sent none. Lets the UI label a consumer by
+	*  purpose. Optional so a client built against an older schema stays valid. */
+	userAgent: z.string().nullish(),
+	playing: z.boolean(),
+	muted: z.boolean(),
+	connectedAt: z.number(),
+	lastRtpAt: z.number(),
+	bytesSent: z.number()
+});
+var BrokerDecodedClientSchema = z.object({
+	tag: z.string(),
+	subscribedAt: z.number(),
+	maxFps: z.number(),
+	framesDelivered: z.number(),
+	framesDropped: z.number()
+});
+var BrokerAudioClientSchema = z.object({
+	tag: z.string(),
+	subscribedAt: z.number(),
+	chunksDelivered: z.number()
+});
+/**
+* Identifies who is holding an encoded / raw-RTP subscription open on
+* the broker. Populated by the subscribing addon when it attaches —
+* defaults to `{ kind: 'unknown' }` for callers that haven't been
+* migrated. The widget surfaces every field that's set so an operator
+* can answer "who is keeping cam X warm?" without grepping logs.
+*/
+var BrokerConsumerKindSchema = z.enum([
+	"alexa",
+	"homekit",
+	"webrtc-browser",
+	"webrtc-mobile",
+	"webrtc-whep",
+	"rtsp-listen",
+	"derived-broker",
+	"recording",
+	"pipeline",
+	"snapshot",
+	"warmup",
+	"unknown"
+]);
+var BrokerConsumerAttributionSchema = z.object({
+	kind: BrokerConsumerKindSchema,
+	/**
+	* Free-form label intended to disambiguate consumers OF THE SAME kind
+	* on the same broker — e.g. user name, device alias. Should NOT repeat
+	* the kind / cam / cam-stream / sessionId (those are surfaced by
 	* dedicated fields). When empty the widget falls back to `${kind} ·
 	* <sessionId tail>`.
 	*/
@@ -6598,6 +7398,23 @@ function kebabToCamel(s) {
 * too many — a drift would show as a logs pane that is simply always empty.
 */
 var CORE_BLOCK_ADDON_PREFIX = "core-block-";
+/**
+* The builtin's own addon id — and, because of that, the OWNER of the
+* integration every block's devices hang from.
+*
+* A block cannot own one. Every integration read is gated on the installed-addon
+* set (`addon-registry.service.ts` → `createFilteredRegistry`) and a block's
+* `core-block-<uuid>` is never in it, so its `getIntegrationByAddonId` answers
+* null forever while the write succeeds — one invisible, undeletable row per
+* start. `core-blocks` IS installed, so it reconciles one shared integration and
+* a block names it by id (`DeclaredDevicesSpec.integrationId`), minting nothing.
+*
+* Exported from the contract, next to the runner prefix and for the same reason:
+* a block reads it as
+* `ctx.api.integrations.getByAddonId.query({ addonId: CORE_BLOCKS_ADDON_ID })`,
+* so a second copy of the string is a block that silently declares into nowhere.
+*/
+var CORE_BLOCKS_ADDON_ID = "core-blocks";
 /** The addon/runner id a block's process runs under. */
 function coreBlockAddonId(blockId) {
 	return `${CORE_BLOCK_ADDON_PREFIX}${blockId}`;
@@ -9728,7 +10545,7 @@ var motionDetectionCapability = {
 * Why: pub/sub routing over the system event-bus loses fidelity
 * (callback shape, QoS guarantees, will/retain semantics) and adds
 * refcount bookkeeping that addons would rather own themselves. The
-* canonical consumer (`addon-export-ha-mqtt`) needs raw `mqtt.js`
+* canonical consumer needs raw `mqtt.js`
 * features anyway — give it the connection config, get out of the way.
 *
 * Consumer flow:
@@ -12471,8 +13288,26 @@ var TrackSchema = z.object({
 	/** Periodic snapshots at snapshotIntervalMs cadence (subject to
 	*  saveThumbnails policy). */
 	snapshots: z.array(TrackSnapshotSchema).readonly(),
-	/** Deduplicated zones the track has entered at least once. */
+	/** Deduplicated zones the track has entered at least once. Zone IDS. */
 	zonesVisited: z.array(z.string()).readonly(),
+	/**
+	* Human NAMES for {@link zonesVisited}, resolved at READ time against the
+	* `zones` capability.
+	*
+	* `zonesVisited` persists ids (`cfeec78c-8d69-…`), which no operator can type
+	* and no card can render — so every free-text search surface was structurally
+	* unable to answer "show me the tracks in Uscio", and did not fail loudly, it
+	* just returned nothing. Resolving here rather than in each client keeps ONE
+	* derivation and costs the clients no extra call (the `zones` cap is
+	* per-device, so a client-side resolve would be a per-camera fan-out on a
+	* surface built to avoid exactly that).
+	*
+	* Resolved, never invented: a zone deleted since the track was written has no
+	* name and is DROPPED, so this array can be shorter than `zonesVisited` — the
+	* two are not positionally aligned. Absent when the track visited no zone, or
+	* when the zone catalogue could not be read.
+	*/
+	zoneNames: z.array(z.string()).readonly().optional(),
 	/** Deduplicated set of detector classes observed for this track over its
 	*  life (a track may be reclassified, e.g. person→vehicle). Absent on
 	*  legacy rows written before class accumulation shipped. */
@@ -25752,723 +26587,278 @@ var AccessoryKind = {
 	Spotlight: DeviceRole.Spotlight,
 	PirSensor: DeviceRole.PirSensor,
 	Chime: DeviceRole.Chime,
-	Autotrack: DeviceRole.Autotrack,
-	Nightvision: DeviceRole.Nightvision,
-	PrivacyMask: DeviceRole.PrivacyMask
-};
-AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
-new Set(Object.values(DeviceType));
-DeviceFeature.BatteryOperated;
-/** Unwrap ZodNullable / ZodOptional / ZodDefault wrappers to reach the inner type.
-*  Zod v4 exposes `.unwrap()` on all three wrapper classes. */
-function unwrap(schema) {
-	let s = schema;
-	while (s instanceof z.ZodNullable || s instanceof z.ZodOptional || s instanceof z.ZodDefault) s = s.unwrap();
-	return s;
-}
-function leafKind(schema) {
-	const s = unwrap(schema);
-	if (s instanceof z.ZodEnum) return {
-		kind: "enum",
-		enumValues: s.options
-	};
-	if (s instanceof z.ZodNumber) return { kind: "number" };
-	if (s instanceof z.ZodString) return { kind: "string" };
-	if (s instanceof z.ZodBoolean) return { kind: "boolean" };
-	return null;
-}
-/** Walk a cap status schema into flat wireable leaf fields (dotted paths).
-*  Recurses into nested ZodObject (unwrapping nullable/optional/default first),
-*  so fields with null live values are still offered. Arrays / unknown shapes
-*  are skipped — never throws. */
-function enumerateSchemaFields(schema, prefix = "") {
-	const root = unwrap(schema);
-	if (!(root instanceof z.ZodObject)) return [];
-	const out = [];
-	const shape = root.shape;
-	for (const [key, field] of Object.entries(shape)) {
-		const path = prefix ? `${prefix}.${key}` : key;
-		const inner = unwrap(field);
-		if (inner instanceof z.ZodObject) {
-			out.push(...enumerateSchemaFields(inner, path));
-			continue;
-		}
-		const leaf = leafKind(field);
-		if (leaf) out.push({
-			path,
-			kind: leaf.kind,
-			...leaf.enumValues ? { enumValues: leaf.enumValues } : {}
-		});
-	}
-	return out;
-}
-/** Enumerate the per-item wireable fields of an item-array cap (see
-*  `CapabilityStatusItemArray`): the item schema's leaf fields, minus the
-*  `keyField` (the key comes from the link's `itemKey`, never from a wired
-*  source), each tagged `item: true` so the authoring UI collects an
-*  `itemKey` alongside the field. Never throws. */
-function enumerateItemArrayFields(itemArray) {
-	return enumerateSchemaFields(itemArray.itemSchema).filter((f) => f.path !== itemArray.keyField).map((f) => ({
-		...f,
-		item: true
-	}));
-}
-/**
-* Error types for the safe expression engine. Two distinct classes so callers
-* can tell a compile-time (grammar) failure from a runtime (evaluation)
-* failure — both are non-fatal to the host: read paths degrade to "skip link".
-*/
-/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
-*  the failure is anchored to a character (author-facing inline feedback). */
-var ExpressionParseError = class extends Error {
-	position;
-	constructor(message, position) {
-		super(message);
-		this.name = "ExpressionParseError";
-		this.position = position;
-	}
-};
-/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
-*  result, unknown builtin, step-budget exceeded). */
-var ExpressionEvalError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ExpressionEvalError";
-	}
-};
-/**
-* Frozen, null-prototype builtin function table for the expression engine
-* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
-* parser rejects any callee not in it, and the evaluator gates each call on an
-* own-property check against it.
-*
-* Because the object has a NULL prototype AND is `Object.freeze`d:
-*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
-*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
-*    (there is no `Object.prototype` in the chain), so those names are not
-*    callable — they are simply "unknown function" at parse time.
-*
-* Every numeric argument is validated as a finite number and every numeric
-* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
-* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
-* closed rather than emitting a garbage value.
-*/
-function asFiniteNumber(value, name, index) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
-	return value;
-}
-function asString$1(value, name, index) {
-	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
-	return value;
-}
-function finiteResult(value, name) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
-	return value;
-}
-function allFiniteNumbers(args, name) {
-	return args.map((a, idx) => asFiniteNumber(a, name, idx));
-}
-var INF = Number.POSITIVE_INFINITY;
-var table = {
-	min: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
-	},
-	max: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
-	},
-	abs: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
-	},
-	floor: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
-	},
-	ceil: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
-	},
-	sqrt: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
-	},
-	round: {
-		minArgs: 1,
-		maxArgs: 2,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "round", 0);
-			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
-			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
-			const factor = 10 ** digits;
-			return finiteResult(Math.round(x * factor) / factor, "round");
-		}
-	},
-	pow: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
-	},
-	clamp: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "clamp", 0);
-			const lo = asFiniteNumber(args[1], "clamp", 1);
-			const hi = asFiniteNumber(args[2], "clamp", 2);
-			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
-			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
-		}
-	},
-	avg: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const nums = allFiniteNumbers(args, "avg");
-			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
-		}
-	},
-	sum: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
-	},
-	coalesce: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			for (const a of args) if (a !== null) return a;
-			return null;
-		}
-	},
-	age: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
-	},
-	convert: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args, hooks) => {
-			const x = asFiniteNumber(args[0], "convert", 0);
-			const from = asString$1(args[1], "convert", 1).trim();
-			const to = asString$1(args[2], "convert", 2).trim();
-			if (hooks.convert) {
-				const out = hooks.convert(x, from, to);
-				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
-				return finiteResult(out, "convert");
-			}
-			if (from === to) return x;
-			throw new ExpressionEvalError("convert: unit conversion table not installed");
-		}
-	}
-};
-Object.freeze(Object.assign(Object.create(null), table));
-/** The set of valid builtin names — used by the parser to reject unknown
-*  callees at parse time (immediate author feedback). */
-var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
-/**
-* Resource-bound constants for the safe expression engine.
-*
-* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
-* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
-* O(nodeCount) by construction. These caps merely put a hard ceiling on the
-* work a single author-supplied expression can request, so a hostile or
-* accidental pathological string can never spend unbounded CPU/memory.
-*/
-/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
-*  rejected without allocation. */
-var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
-/** A legal binding / identifier name. */
-var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Binding names an author may NOT use: `now` is auto-injected; the literal
-*  keywords lex as values, not identifiers, so binding to them is meaningless. */
-var RESERVED_BINDING_NAMES = new Set([
-	"now",
-	"true",
-	"false",
-	"null"
-]);
-/**
-* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
-* zero-dependency. The grammar is deliberately boring: decimal numbers,
-* single/double-quoted strings with a tiny escape set, identifiers, the three
-* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
-* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
-* is a parse error with a source position, so member access / assignment /
-* template literals are lexically impossible.
-*/
-var KEYWORDS = new Set([
-	"true",
-	"false",
-	"null"
-]);
-function isDigit(ch) {
-	return ch >= "0" && ch <= "9";
-}
-function isIdentStart(ch) {
-	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
-}
-function isIdentPart(ch) {
-	return isIdentStart(ch) || isDigit(ch);
-}
-function isWhitespace(ch) {
-	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
-}
-/** Tokenize `source` into a flat token list ending with a single `eof` token.
-*  Throws `ExpressionParseError` on any illegal character or unterminated
-*  string. */
-function tokenize(source) {
-	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
-	const tokens = [];
-	let i = 0;
-	const n = source.length;
-	while (i < n) {
-		const ch = source[i];
-		if (isWhitespace(ch)) {
-			i += 1;
-			continue;
-		}
-		if (isDigit(ch)) {
-			const start = i;
-			while (i < n && isDigit(source[i])) i += 1;
-			if (i < n && source[i] === ".") {
-				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
-				i += 1;
-				while (i < n && isDigit(source[i])) i += 1;
-			}
-			const text = source.slice(start, i);
-			const value = Number(text);
-			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
-			tokens.push({
-				type: "number",
-				value,
-				pos: start
-			});
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			const quote = ch;
-			const start = i;
-			i += 1;
-			let out = "";
-			let closed = false;
-			while (i < n) {
-				const c = source[i];
-				if (c === "\\") {
-					const next = i + 1 < n ? source[i + 1] : "";
-					if (next === "\\" || next === "'" || next === "\"") {
-						out += next;
-						i += 2;
-						continue;
-					}
-					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
-				}
-				if (c === quote) {
-					closed = true;
-					i += 1;
-					break;
-				}
-				out += c;
-				i += 1;
-			}
-			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
-			tokens.push({
-				type: "string",
-				value: out,
-				pos: start
-			});
-			continue;
-		}
-		if (isIdentStart(ch)) {
-			const start = i;
-			while (i < n && isIdentPart(source[i])) i += 1;
-			const text = source.slice(start, i);
-			if (KEYWORDS.has(text)) tokens.push({
-				type: "keyword",
-				keyword: keywordOf(text),
-				pos: start
-			});
-			else tokens.push({
-				type: "identifier",
-				name: text,
-				pos: start
-			});
-			continue;
-		}
-		const two = i + 1 < n ? source.slice(i, i + 2) : "";
-		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
-			tokens.push({
-				type: "punct",
-				punct: two,
-				pos: i
-			});
-			i += 2;
-			continue;
-		}
-		if (isSinglePunct(ch)) {
-			tokens.push({
-				type: "punct",
-				punct: ch,
-				pos: i
-			});
-			i += 1;
-			continue;
-		}
-		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
-	}
-	tokens.push({
-		type: "eof",
-		pos: n
-	});
-	return tokens;
-}
-function keywordOf(text) {
-	if (text === "true") return "true";
-	if (text === "false") return "false";
-	return "null";
-}
-function isSinglePunct(ch) {
-	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
-}
-/**
-* Pratt (precedence-climbing) parser for the safe expression mini-language.
-*
-* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
-* → relational → additive → multiplicative → unary `! -` → call / primary.
-* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
-* string validated against the builtin table at parse time, so an unknown
-* function is rejected immediately (author feedback) and a persisted expression
-* that references a since-removed builtin degrades at read.
-*
-* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
-* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
-*/
-/** Binary/logical operator precedence (higher binds tighter). */
-var BINARY_PRECEDENCE = {
-	"||": 1,
-	"&&": 2,
-	"==": 3,
-	"!=": 3,
-	"<": 4,
-	"<=": 4,
-	">": 4,
-	">=": 4,
-	"+": 5,
-	"-": 5,
-	"*": 6,
-	"/": 6,
-	"%": 6
-};
-function isLogicalOp(op) {
-	return op === "&&" || op === "||";
-}
-function isBinaryOp(op) {
-	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
-}
-var Parser = class {
-	tokens;
-	pos = 0;
-	nodeCount = 0;
-	identifiers = /* @__PURE__ */ new Set();
-	callees = /* @__PURE__ */ new Set();
-	constructor(tokens) {
-		this.tokens = tokens;
-	}
-	parse() {
-		const ast = this.parseTernary();
-		const tok = this.peek();
-		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
-		return {
-			ast,
-			identifiers: this.identifiers,
-			callees: this.callees,
-			nodeCount: this.nodeCount
-		};
-	}
-	peek() {
-		return this.tokens[this.pos];
-	}
-	next() {
-		return this.tokens[this.pos++];
-	}
-	/** Consume a punctuator token, erroring if the next token isn't it. */
-	expectPunct(punct) {
-		const tok = this.peek();
-		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
-		this.pos += 1;
-	}
-	matchPunct(punct) {
-		const tok = this.peek();
-		if (tok.type === "punct" && tok.punct === punct) {
-			this.pos += 1;
-			return true;
-		}
-		return false;
-	}
-	countNode() {
-		this.nodeCount += 1;
-		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
-	}
-	parseTernary() {
-		const test = this.parseBinary(1);
-		if (this.matchPunct("?")) {
-			const consequent = this.parseTernary();
-			this.expectPunct(":");
-			const alternate = this.parseTernary();
-			this.countNode();
-			return {
-				kind: "conditional",
-				test,
-				consequent,
-				alternate
-			};
-		}
-		return test;
-	}
-	parseBinary(minPrec) {
-		let left = this.parseUnary();
-		for (;;) {
-			const tok = this.peek();
-			if (tok.type !== "punct") break;
-			const prec = BINARY_PRECEDENCE[tok.punct];
-			if (prec === void 0 || prec < minPrec) break;
-			const op = tok.punct;
-			this.pos += 1;
-			const right = this.parseBinary(prec + 1);
-			this.countNode();
-			if (isLogicalOp(op)) left = {
-				kind: "logical",
-				op,
-				left,
-				right
-			};
-			else if (isBinaryOp(op)) left = {
-				kind: "binary",
-				op,
-				left,
-				right
-			};
-			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
-		}
-		return left;
-	}
-	parseUnary() {
-		const tok = this.peek();
-		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
-			const op = tok.punct;
-			this.pos += 1;
-			const operand = this.parseUnary();
-			this.countNode();
-			return {
-				kind: "unary",
-				op,
-				operand
-			};
-		}
-		return this.parsePrimary();
-	}
-	parsePrimary() {
-		const tok = this.next();
-		switch (tok.type) {
-			case "number":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "string":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "keyword":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.keyword === "null" ? null : tok.keyword === "true"
-				};
-			case "identifier": {
-				const nextTok = this.peek();
-				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
-				this.identifiers.add(tok.name);
-				this.countNode();
+	Autotrack: DeviceRole.Autotrack,
+	Nightvision: DeviceRole.Nightvision,
+	PrivacyMask: DeviceRole.PrivacyMask
+};
+AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
+/** Marker written to a declared integration's `info`. */
+var DECLARED_INTEGRATION_FIXED_KEY = "fixed";
+/**
+* Strip the `<node>/<addon>` suffix a forked child carries.
+*
+* Comparing `ctx.kernel.localNodeId` raw skipped EVERY node — including the one
+* that was supposed to act — because on the hub it reads `hub/<addon>`.
+*/
+function declarationOwnerNodeId(localNodeId) {
+	const raw = localNodeId ?? "hub";
+	if (!raw.includes("/")) return raw;
+	return raw.split("/")[0] ?? "hub";
+}
+/**
+* The one way an addon owns a device it declares.
+*
+* Construct once with the addon's ports, then call {@link reconcile} on boot and
+* on every convergence tick. There is no second get-or-create helper — a guard
+* in `scripts/` enforces that.
+*/
+var DeclaredDevices = class {
+	ports;
+	constructor(ports) {
+		const addonId = ports.addonId;
+		if (typeof addonId !== "string" || addonId.length === 0) throw new Error(`DeclaredDevices: addonId must be the declaring addon's id, got ${JSON.stringify(addonId)}. On an addon context it is \`ctx.id\` — there is no \`ctx.addonId\`.`);
+		this.ports = ports;
+	}
+	/**
+	* Converge the declared set. Idempotent, and safe to call repeatedly.
+	*
+	* Throws only what the ports throw on the FIRST index read; every other
+	* failure is per-device and logged, so one bad declaration never takes the
+	* others down.
+	*/
+	async reconcile(spec) {
+		if ((spec.placement ?? "hub") === "hub") {
+			const nodeId = declarationOwnerNodeId(this.ports.localNodeId);
+			if (nodeId !== "hub") {
+				this.ports.logger.info("declared devices are hub-owned — skipping on this node", { meta: {
+					nodeId,
+					rawNodeId: this.ports.localNodeId ?? null
+				} });
 				return {
-					kind: "identifier",
-					name: tok.name
+					integrationId: null,
+					devices: [],
+					removed: [],
+					owned: false
 				};
 			}
-			case "punct":
-				if (tok.punct === "(") {
-					const inner = this.parseTernary();
-					this.expectPunct(")");
-					return inner;
-				}
-				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
-			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
 		}
-	}
-	parseCall(callee, pos) {
-		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
-		this.expectPunct("(");
-		const args = [];
-		if (!this.matchPunct(")")) for (;;) {
-			args.push(this.parseTernary());
-			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
-			if (this.matchPunct(",")) continue;
-			this.expectPunct(")");
-			break;
+		const integrationId = spec.integrationId ?? await this.ensureIntegration(spec.integrationName);
+		const index = await this.readIndex();
+		const outcomes = [];
+		for (const declaration of spec.devices) {
+			const outcome = await this.applyDeclaration(declaration, integrationId, index);
+			if (outcome !== null) outcomes.push(outcome);
 		}
-		this.callees.add(callee);
-		this.countNode();
 		return {
-			kind: "call",
-			callee,
-			args
+			integrationId,
+			devices: outcomes,
+			removed: await this.sweepWithdrawn(spec.devices, integrationId, index),
+			owned: true
 		};
 	}
-};
-/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
-*  `ExpressionParseError` on any lexical or grammatical failure. */
-function parseExpression(source) {
-	return new Parser(tokenize(source)).parse();
-}
-/**
-* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
-* by expr"). The cache stores BOTH successes and failures (negative caching),
-* so a corrupt persisted string costs exactly one tokenize+parse total — not
-* one per read on a hot resolve path.
-*
-* The cache is a module-level singleton: entries are pure, content-addressed
-* ASTs keyed by the raw source string, so sharing one instance across all
-* callers is safe and maximises hit rate.
-*/
-var cache = /* @__PURE__ */ new Map();
-function getCached(source) {
-	const hit = cache.get(source);
-	if (hit !== void 0) {
-		cache.delete(source);
-		cache.set(source, hit);
-		return hit;
+	/**
+	* Get-or-create the FIXED integration, and RE-ASSERT the flag every pass.
+	*
+	* The re-assertion is the fix for the defect the hand-rolled version shipped
+	* with: writing `info.fixed` only on the create path left every pre-existing
+	* install without it, and the kernel kept offering to delete an integration
+	* the addon owns.
+	*/
+	async ensureIntegration(integrationName) {
+		const existing = await this.ports.getIntegration(this.ports.addonId);
+		if (existing === null) {
+			const created = await this.ports.createIntegration({
+				addonId: this.ports.addonId,
+				name: integrationName,
+				info: { [DECLARED_INTEGRATION_FIXED_KEY]: true }
+			});
+			this.ports.logger.info("declared a fixed integration", { meta: {
+				integrationId: created.id,
+				name: integrationName
+			} });
+			return created.id;
+		}
+		if (existing.info?.["fixed"] !== true) {
+			await this.ports.updateIntegration({
+				id: existing.id,
+				info: { [DECLARED_INTEGRATION_FIXED_KEY]: true }
+			});
+			this.ports.logger.info("re-asserted `fixed` on a declared integration", { meta: { integrationId: existing.id } });
+		}
+		return existing.id;
 	}
-	let result;
-	try {
-		result = {
-			ok: true,
-			parsed: parseExpression(source)
-		};
-	} catch (err) {
-		result = {
-			ok: false,
-			error: err instanceof ExpressionParseError ? err.message : String(err)
-		};
+	async readIndex() {
+		const rows = await this.ports.listOwnDevices();
+		return new Map(rows.map((row) => [row.stableId, row]));
 	}
-	cache.set(source, result);
-	if (cache.size > 256) {
-		const oldest = cache.keys().next().value;
-		if (oldest !== void 0) cache.delete(oldest);
+	/**
+	* One declaration: adopt what exists, create what does not.
+	*
+	* The create branch is the destructive one — it seeds `initialMeta`, and
+	* `initialMeta.name` lands as an unconditional `setName`. A transiently empty
+	* index therefore looks exactly like a first boot and would silently re-stamp
+	* the declared name over the operator's rename. D49: that branch needs a
+	* second read to agree.
+	*/
+	async applyDeclaration(declaration, integrationId, index) {
+		try {
+			let existing = index.get(declaration.stableId);
+			if (existing === void 0) {
+				existing = (await this.readIndex()).get(declaration.stableId);
+				if (existing !== void 0) this.ports.logger.warn("device index disagreed with itself — adopting instead of re-creating", {
+					tags: { deviceId: existing.id },
+					meta: {
+						stableId: declaration.stableId,
+						addonId: this.ports.addonId
+					}
+				});
+			}
+			if (existing !== void 0) {
+				const device = await this.ports.devices.create(declaration.stableId, declaration.DeviceClass, {}, null, void 0);
+				this.ports.logger.info("declared device adopted", {
+					tags: { deviceId: device.id },
+					meta: {
+						stableId: declaration.stableId,
+						integrationId
+					}
+				});
+				return {
+					stableId: declaration.stableId,
+					deviceId: device.id,
+					device,
+					created: false
+				};
+			}
+			const device = await this.ports.devices.create(declaration.stableId, declaration.DeviceClass, declaration.config ?? {}, null, {
+				type: declaration.type,
+				name: declaration.name,
+				integrationId,
+				...declaration.role === void 0 ? {} : { role: declaration.role }
+			});
+			this.ports.logger.info("declared device created", {
+				tags: { deviceId: device.id },
+				meta: {
+					stableId: declaration.stableId,
+					integrationId
+				}
+			});
+			return {
+				stableId: declaration.stableId,
+				deviceId: device.id,
+				device,
+				created: true
+			};
+		} catch (err) {
+			this.ports.logger.warn("a declared device could not be brought up", { meta: {
+				stableId: declaration.stableId,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+			return null;
+		}
 	}
-	return result;
+	/**
+	* Remove rows under the addon's FIXED integration whose declaration is gone.
+	*
+	* Bounded to that integration: a declared integration has no operator
+	* add-flow, so every row under it got there by declaration. Devices this
+	* addon owns OUTSIDE it (a provider's adopted devices) are never candidates.
+	*
+	* Bounded in count, and every deletion is logged with its `deviceId` — a
+	* withdrawal that removes an operator-visible row silently is the failure
+	* mode, not the removal itself.
+	*/
+	async sweepWithdrawn(declarations, integrationId, index) {
+		const declared = new Set(declarations.map((d) => d.stableId));
+		const candidates = [...index.values()].filter((row) => row.integrationId === integrationId && !declared.has(row.stableId));
+		if (candidates.length === 0) return [];
+		if (candidates.length > 32) {
+			this.ports.logger.warn("withdrawal sweep exceeded its bound — removing nothing", { meta: {
+				integrationId,
+				candidates: candidates.length,
+				bound: 32
+			} });
+			return [];
+		}
+		const removed = [];
+		for (const row of candidates) try {
+			await this.ports.devices.remove(row.id);
+			removed.push(row.id);
+			this.ports.logger.info("declared device removed — its declaration was withdrawn", {
+				tags: { deviceId: row.id },
+				meta: {
+					stableId: row.stableId,
+					integrationId
+				}
+			});
+		} catch (err) {
+			this.ports.logger.warn("a withdrawn declared device could not be removed", {
+				tags: { deviceId: row.id },
+				meta: {
+					stableId: row.stableId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
+		return removed;
+	}
+};
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
+new Set(Object.values(DeviceType));
+DeviceFeature.BatteryOperated;
+/** Unwrap ZodNullable / ZodOptional / ZodDefault wrappers to reach the inner type.
+*  Zod v4 exposes `.unwrap()` on all three wrapper classes. */
+function unwrap(schema) {
+	let s = schema;
+	while (s instanceof z.ZodNullable || s instanceof z.ZodOptional || s instanceof z.ZodDefault) s = s.unwrap();
+	return s;
 }
-/** Compile `source`, returning a discriminated result instead of throwing.
-*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
-function compileExpressionSafe(source) {
-	return getCached(source);
+function leafKind(schema) {
+	const s = unwrap(schema);
+	if (s instanceof z.ZodEnum) return {
+		kind: "enum",
+		enumValues: s.options
+	};
+	if (s instanceof z.ZodNumber) return { kind: "number" };
+	if (s instanceof z.ZodString) return { kind: "string" };
+	if (s instanceof z.ZodBoolean) return { kind: "boolean" };
+	return null;
 }
-Object.freeze({});
-/**
-* Author-time validation. Returns `null` when the source is valid, else a
-* human-readable error message. Checks: the expression compiles; binding count
-* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
-* is not reserved (`now`/keywords) and does not shadow a builtin; and every
-* FREE identifier of the AST is covered by a binding or the injected `now`.
-*/
-function validateExpressionSource(src) {
-	const names = Object.keys(src.bindings);
-	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
-	for (const name of names) {
-		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
-		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
-		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
-	}
-	const compiled = compileExpressionSafe(src.expr);
-	if (!compiled.ok) return compiled.error;
-	const bound = new Set(names);
-	for (const id of compiled.parsed.identifiers) {
-		if (id === "now") continue;
-		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+/** Walk a cap status schema into flat wireable leaf fields (dotted paths).
+*  Recurses into nested ZodObject (unwrapping nullable/optional/default first),
+*  so fields with null live values are still offered. Arrays / unknown shapes
+*  are skipped — never throws. */
+function enumerateSchemaFields(schema, prefix = "") {
+	const root = unwrap(schema);
+	if (!(root instanceof z.ZodObject)) return [];
+	const out = [];
+	const shape = root.shape;
+	for (const [key, field] of Object.entries(shape)) {
+		const path = prefix ? `${prefix}.${key}` : key;
+		const inner = unwrap(field);
+		if (inner instanceof z.ZodObject) {
+			out.push(...enumerateSchemaFields(inner, path));
+			continue;
+		}
+		const leaf = leafKind(field);
+		if (leaf) out.push({
+			path,
+			kind: leaf.kind,
+			...leaf.enumValues ? { enumValues: leaf.enumValues } : {}
+		});
 	}
-	return null;
+	return out;
+}
+/** Enumerate the per-item wireable fields of an item-array cap (see
+*  `CapabilityStatusItemArray`): the item schema's leaf fields, minus the
+*  `keyField` (the key comes from the link's `itemKey`, never from a wired
+*  source), each tagged `item: true` so the authoring UI collects an
+*  `itemKey` alongside the field. Never throws. */
+function enumerateItemArrayFields(itemArray) {
+	return enumerateSchemaFields(itemArray.itemSchema).filter((f) => f.path !== itemArray.keyField).map((f) => ({
+		...f,
+		item: true
+	}));
 }
-/**
-* What an expression's named bindings READ from.
-*
-* Salvaged verbatim from the deleted device-link mechanism. Wiring's source
-* kinds were the one part of it worth keeping: addressing a device field by
-* re-sync-stable `stableId`, a per-device constant, and a sibling-accessory
-* read are the vocabulary any cross-device derivation needs, and they were
-* already correct. What wiring got wrong was the DESTINATION — a field on
-* somebody else's device, with no identity — not the source.
-*
-* These shapes are therefore kept, re-homed next to the engine that consumes
-* them, and are the binding type of a composition recipe (the source picker
-* stays `deviceManager.getWireableFields`). They deliberately do NOT nest: a
-* binding is a read, never another expression.
-*
-* Schemas are authoritative; every type is `z.infer` of one, so a wire shape and
-* a TypeScript shape cannot drift apart (`scripts/check-schema-type-twins.ts`).
-*/
-/** Read a sibling accessory's status field, addressed by the sibling's key.
-*  `kind` is optional for wire compatibility — absent means `'field'`. */
-var ExpressionFieldBindingSchema = z.object({
-	kind: z.literal("field").optional(),
-	sourceKey: z.string(),
-	cap: z.string(),
-	fieldPath: z.string()
-});
-/** A constant. No device is read. */
-var ExpressionLiteralBindingSchema = z.object({
-	kind: z.literal("literal"),
-	value: z.union([
-		z.string(),
-		z.number(),
-		z.boolean(),
-		z.null()
-	])
-});
-/** Read ANY device's status field, addressed by its re-sync-stable `stableId` —
-*  never by numeric id, which a re-adoption reissues. */
-var ExpressionGlobalBindingSchema = z.object({
-	kind: z.literal("global"),
-	sourceStableId: z.string(),
-	cap: z.string(),
-	fieldPath: z.string()
-});
-var ExpressionBindingSourceSchema = z.union([
-	ExpressionFieldBindingSchema,
-	ExpressionLiteralBindingSchema,
-	ExpressionGlobalBindingSchema
-]);
-z.object({
-	expr: z.string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: z.record(z.string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
-});
 /**
 * Runtime list of cap names with status. Used by the settings
 * aggregator to enumerate caps whose `status` should be polled +
@@ -32477,4 +32867,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { platformProbeCapability as $, deviceStatusCapability as A, nodePin as At, isSameAddonId as B, coreBlockAddonId as C, asString as Ct, decodeVectorBase64 as D, expandCapMethods as Dt, dataStoreProviderCapability as E, emitReadiness as Et, extractNestedAddonId as F, scopeKey as Ft, logDestinationCapability as G, kebabToCamel as H, filesystemBrowseCapability as I, sleep as It, metricsProviderCapability as J, logLevelAtMost as K, isArrayOutputSchema as L, EventCategory as Lt, enumerateInferenceDevices as M, parseJsonUnknown as Mt, enumerateItemArrayFields as N, readinessKey as Nt, deviceManagerCapability as O, hydrateSchema as Ot, enumerateSchemaFields as P, resolveCapMount as Pt, parseStreamParamsFormPatch as Q, isCollectionArrayMethod as R, buildStreamParamsConfigSchema as S, asNumber as St, coreBlocksCapability as T, emitDownForOwnedCaps as Tt, lifecycleJobSchema as U, isVoidInput as V, localNetworkCapability as W, oauthIntegrationCapability as X, normalizeUnit as Y, objectInputDeclaresAddonId as Z, addonWidgetsCapability as _, DeviceType as _t, CAP_NAMES_WITH_STATUS as a, storageProviderCapability as at, backupCapability as b, WELL_KNOWN_TAB_MAP as bt, DeviceStatusSchema as c, vectorDimFromBase64 as ct, STREAM_PROFILE_META as d, BaseAddon as dt, procedureAuthKey as et, ScopedTokenSchema as f, DATAPLANE_SECRET_HEADER as ft, addonSettingsCapability as g, DeviceRole as gt, addonPagesCapability as h, DeviceFeature as ht, BatteryStatusSchema as i, storageCapability as it, doorbellCapability as j, parseJsonObject as jt, deviceStateCapability as k, isDeviceConfigCap as kt, METHOD_ACCESS_MAP as l, vectorStoreCapability as lt, UserRecordSchema as m, DEVICE_STATUS_METHOD as mt, AlertSchema as n, settingsStoreCapability as nt, CORE_BLOCK_ADDON_PREFIX as o, streamQualityLabel as ot, StorageLocationTypeSchema as p, DEVICE_SETTINGS_CONTRIBUTION_METHODS as pt, looseSchema as q, ApiKeyRecordSchema as r, snapshotCapability as rt, CoreBlockSchema as s, userManagementCapability as st, ALL_CAPABILITY_DEFINITIONS as t, scoreRuntimes as tt, RUNTIME_DEFAULTS as u, errMsg as ut, alertsCapability as v, ReadinessRegistry as vt, coreBlockIdFromAddonId as w, createEvent as wt, bareAddonId as x, asJsonObject as xt, authProviderCapability as y, ReadinessTimeoutError as yt, isObjectInput as z };
+export { objectInputDeclaresAddonId as $, deviceManagerCapability as A, hydrateSchema as At, isCollectionArrayMethod as B, bareAddonId as C, asJsonObject as Ct, coreBlocksCapability as D, emitDownForOwnedCaps as Dt, coreBlockIdFromAddonId as E, createEvent as Et, enumerateItemArrayFields as F, readinessKey as Ft, lifecycleJobSchema as G, isSameAddonId as H, enumerateSchemaFields as I, resolveCapMount as It, logLevelAtMost as J, localNetworkCapability as K, extractNestedAddonId as L, scopeKey as Lt, deviceStatusCapability as M, nodePin as Mt, doorbellCapability as N, parseJsonObject as Nt, dataStoreProviderCapability as O, emitReadiness as Ot, enumerateInferenceDevices as P, parseJsonUnknown as Pt, oauthIntegrationCapability as Q, filesystemBrowseCapability as R, sleep as Rt, backupCapability as S, WELL_KNOWN_TAB_MAP as St, coreBlockAddonId as T, asString as Tt, isVoidInput as U, isObjectInput as V, kebabToCamel as W, metricsProviderCapability as X, looseSchema as Y, normalizeUnit as Z, addonPagesCapability as _, DeviceFeature as _t, CAP_NAMES_WITH_STATUS as a, snapshotCapability as at, alertsCapability as b, ReadinessRegistry as bt, CoreBlockSchema as c, streamQualityLabel as ct, METHOD_ACCESS_MAP as d, vectorStoreCapability as dt, parseStreamParamsFormPatch as et, RUNTIME_DEFAULTS as f, errMsg as ft, UserRecordSchema as g, DEVICE_STATUS_METHOD as gt, StorageLocationTypeSchema as h, DEVICE_SETTINGS_CONTRIBUTION_METHODS as ht, BatteryStatusSchema as i, settingsStoreCapability as it, deviceStateCapability as j, isDeviceConfigCap as jt, decodeVectorBase64 as k, expandCapMethods as kt, DeclaredDevices as l, userManagementCapability as lt, ScopedTokenSchema as m, DATAPLANE_SECRET_HEADER as mt, AlertSchema as n, procedureAuthKey as nt, CORE_BLOCKS_ADDON_ID as o, storageCapability as ot, STREAM_PROFILE_META as p, BaseAddon as pt, logDestinationCapability as q, ApiKeyRecordSchema as r, scoreRuntimes as rt, CORE_BLOCK_ADDON_PREFIX as s, storageProviderCapability as st, ALL_CAPABILITY_DEFINITIONS as t, platformProbeCapability as tt, DeviceStatusSchema as u, vectorDimFromBase64 as ut, addonSettingsCapability as v, DeviceRole as vt, buildStreamParamsConfigSchema as w, asNumber as wt, authProviderCapability as x, ReadinessTimeoutError as xt, addonWidgetsCapability as y, DeviceType as yt, isArrayOutputSchema as z, EventCategory as zt };