@camstack/system 1.2.66 → 1.2.68

package/dist/{dist-DqPyKwVB.mjs → dist-D2J8RJ7m.mjs}

@@ -4050,357 +4050,1157 @@ var ConvertResultSchema = z.object({
 	artifacts: z.array(ConvertArtifactSchema).readonly()
 });
 /**
-* `addon-pages` — system-scoped singleton aggregator cap. Public-facing
-* surface that admin-ui consumes through `useAddonPagesListPages()`.
-*
-* The provider iterates every `addon-pages-source` (collection) provider
-* and emits `AddonPageInfo[]` enriched with versioned `bundleUrl` strings
-* pointing at `/api/addon-pages/<addonId>/<bundle>?v=<mtime>`. The
-* filesystem `mtime` cache-buster lets the browser pick up addon
-* rebuilds without manual reload.
-*
-* The hub-local builtin `addon-pages-aggregator` (see
-* `@camstack/system/builtins/addon-pages-aggregator`) registers the
-* provider. Splitting the public aggregator from the raw collection
-* keeps both ends in codegen — there's no hand-written
-* `addon-pages.router.ts` wrapper anymore.
-*/
-var AddonPageDeclarationSchema$1 = z.object({
-	id: z.string(),
-	label: z.string(),
-	icon: z.string(),
-	path: z.string(),
-	remoteName: z.string(),
-	bundle: z.string(),
-	section: z.string().optional(),
-	sectionLabel: z.string().optional()
-});
-var AddonPageInfoSchema = z.object({
-	addonId: z.string(),
-	page: AddonPageDeclarationSchema$1,
-	bundleUrl: z.string()
-});
-var addonPagesCapability = {
-	name: "addon-pages",
-	scope: "system",
-	mode: "singleton",
-	methods: { listPages: method(z.void(), z.array(AddonPageInfoSchema).readonly()) }
-};
-/**
-* `addon-pages-source` — collection cap exposing per-provider raw page
-* declarations. Every addon that contributes a UI page registers a
-* provider here. The hub-side singleton aggregator (`addon-pages` cap,
-* see `addon-pages.cap.ts`) walks this collection, stamps versioned
-* `bundleUrl` values, and returns the enriched `AddonPageInfo[]` list
-* that admin-ui consumes.
-*
-* The split exists because the public listing has a different output
-* shape than the per-provider raw declarations, and we want both ends
-* to flow through codegen instead of relying on a hand-written wrapper.
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
 */
-var AddonPageDeclarationSchema = z.object({
-	id: z.string(),
-	label: z.string(),
-	icon: z.string(),
-	path: z.string(),
-	/**
-	* Module Federation remote name — must match the `name` field on the
-	* page addon's `federation()` plugin config. Used by admin-ui's
-	* `<AddonPageLoader>` to call `loadRemote('<remoteName>/page')`.
-	* Conventionally `addon_<id>_page` (snake_case; MF names cannot
-	* contain hyphens).
-	*/
-	remoteName: z.string(),
-	/**
-	* Bundle filename inside the addon's `dist/` dir served at
-	* `/api/addon-pages/<addonId>/<bundle>`. With Module Federation this
-	* is always `'remoteEntry.js'`; the value is kept on the metadata so
-	* the static-file route can compute an mtime-based cache-buster URL
-	* without a separate filesystem stat.
-	*/
-	bundle: z.string(),
-	/**
-	* Sidebar section this page docks into. Well-known ids: `'detection'`,
-	* `'cluster'`, `'administration'` — the page renders inside that group.
-	* Any OTHER string creates (or joins) a custom section rendered after
-	* the built-in groups; its label comes from `sectionLabel` (first
-	* declaration wins), falling back to the id. Absent → the legacy
-	* "Addon Pages" group.
-	*/
-	section: z.string().optional(),
-	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
-	sectionLabel: z.string().optional()
-});
-var addonPagesSourceCapability = {
-	name: "addon-pages-source",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: { listPages: method(z.void(), z.array(AddonPageDeclarationSchema).readonly()) }
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
 };
-var AddonHttpRouteSchema = z.object({
-	method: z.enum([
-		"GET",
-		"POST",
-		"PUT",
-		"DELETE",
-		"PATCH"
-	]),
-	path: z.string(),
-	access: z.enum([
-		"public",
-		"authenticated",
-		"admin"
-	]).optional(),
-	description: z.string().optional()
-});
-/**
-* Cross-process route invocation envelope. The hub captures the
-* request as plain data, ships it to the worker via Moleculer, and
-* the worker runs the local handler against a capturing reply. The
-* envelope returned describes what the handler intended (status,
-* headers, body, or a redirect) so the hub can translate it back to
-* the Fastify reply that's actually wired to the socket.
-*/
-var InvokeRequestSchema = z.object({
-	method: z.string(),
-	path: z.string(),
-	params: z.record(z.string(), z.string()),
-	query: z.record(z.string(), z.string()),
-	body: z.unknown(),
-	headers: z.record(z.string(), z.string()),
-	user: z.object({
-		id: z.string(),
-		username: z.string(),
-		isAdmin: z.boolean()
-	}).optional(),
-	scopedToken: z.unknown().optional()
-});
-var InvokeReplyEnvelopeSchema = z.object({
-	status: z.number().int(),
-	headers: z.record(z.string(), z.string()),
-	/** When set, the hub MUST `reply.redirect(redirectUrl)` instead of
-	*  sending `body`. Status defaults to 302 when this is set unless
-	*  the handler called `reply.code(...)` explicitly. */
-	redirectUrl: z.string().nullable(),
-	/** JSON-serializable body. `undefined` is treated as "no body". */
-	body: z.unknown().optional(),
-	/** Set when the handler called `reply.type(mime)`. */
-	contentType: z.string().optional()
-});
-var addonRoutesCapability = {
-	name: "addon-routes",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: {
-		getRoutes: method(z.void(), z.array(AddonHttpRouteSchema)),
-		/**
-		* Cross-process dispatch entry point. Forked addons implement this
-		* (via `buildAddonRouteProvider`) so the hub's Fastify catch-all
-		* can route through Moleculer when the handler lives in a worker.
-		*
-		* Local addons can implement it for free with the same helper;
-		* the hub bypasses the wire on co-located addons.
-		*/
-		invoke: method(InvokeRequestSchema, InvokeReplyEnvelopeSchema, { kind: "mutation" })
-	},
-	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
-	mount: { kind: "skip" }
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
 };
-var ConfigTabDeclarationSchema = z.object({
-	id: z.string(),
-	label: z.string(),
-	icon: z.string(),
-	order: z.number().optional()
-});
-var ConfigSectionWithValuesSchema = z.object({
-	id: z.string(),
-	title: z.string(),
-	description: z.string().optional(),
-	style: z.enum(["card", "accordion"]).optional(),
-	defaultCollapsed: z.boolean().optional(),
-	columns: z.union([
-		z.literal(1),
-		z.literal(2),
-		z.literal(3),
-		z.literal(4)
-	]).optional(),
-	tab: z.string().optional(),
-	location: z.enum(["settings", "top-tab"]).optional(),
-	order: z.number().optional(),
-	fields: z.array(z.any())
-});
-var SettingsSchemaWithValuesSchema = z.object({
-	tabs: z.array(ConfigTabDeclarationSchema).optional(),
-	sections: z.array(ConfigSectionWithValuesSchema)
-});
-/** Patch object — keys are field names, values are the new field values. */
-var SettingsPatchSchema = z.record(z.string(), z.unknown());
-/** Standard success response for update operations. */
-var SettingsUpdateResultSchema = z.object({ success: z.literal(true) });
 /**
-* addon-settings — singleton gateway for three-level addon settings.
-*
-* Works like `device-manager`: a single hub-side provider that resolves
-* `addonId` to the target addon and delegates the call. For hub-local
-* addons the call is direct; for remote agents it proxies via the
-* per-addon Moleculer service.
-*
-* Replaces the `$addonHost` Moleculer service. Transport transparency
-* is handled by the provider implementation — callers (admin UI, other
-* addons via `ctx.api`) never know which node hosts the target addon.
+* Frozen, null-prototype builtin function table for the expression engine
+* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
+* parser rejects any callee not in it, and the evaluator gates each call on an
+* own-property check against it.
 *
-* Three levels:
-*   - **addon**: addon-scoped settings (installation config, API keys, …)
-*   - **global**: settings applied to all devices by default
-*   - **device**: per-device overrides
+* Because the object has a NULL prototype AND is `Object.freeze`d:
+*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
+*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
+*    (there is no `Object.prototype` in the chain), so those names are not
+*    callable — they are simply "unknown function" at parse time.
 *
-* Optional `nodeId` allows explicit node targeting. When absent the
-* provider resolves the addon's host node automatically.
-*/
-/**
-* `addon-settings` is a **hub-centric** cap: the hub hosts the single
-* provider, and `nodeId` in the input is data for the hub provider's
-* internal dispatcher, not a routing hint for the cap-router. See
-* `CapabilityDefinition.nodeIdMode` for the contract.
+* Every numeric argument is validated as a finite number and every numeric
+* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
+* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
+* closed rather than emitting a garbage value.
 */
-var addonSettingsCapability = {
-	name: "addon-settings",
-	scope: "system",
-	mode: "singleton",
-	nodeIdMode: "data",
-	methods: {
-		getGlobalSettings: method(z.object({
-			addonId: z.string(),
-			nodeId: z.string().optional(),
-			overlay: z.record(z.string(), z.unknown()).optional(),
-			cap: z.string().optional()
-		}), SettingsSchemaWithValuesSchema.nullable()),
-		updateGlobalSettings: method(z.object({
-			addonId: z.string(),
-			nodeId: z.string().optional(),
-			patch: SettingsPatchSchema
-		}), SettingsUpdateResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		getDeviceSettings: method(z.object({
-			addonId: z.string(),
-			deviceId: z.number(),
-			nodeId: z.string().optional()
-		}), SettingsSchemaWithValuesSchema.nullable()),
-		updateDeviceSettings: method(z.object({
-			addonId: z.string(),
-			deviceId: z.number(),
-			nodeId: z.string().optional(),
-			patch: SettingsPatchSchema
-		}), SettingsUpdateResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		})
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString$1(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString$1(args[1], "convert", 1).trim();
+			const to = asString$1(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
 	}
 };
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
 /**
-* `addon-widgets-source` — collection cap exposing per-addon raw widget
-* declarations. Mirrors the addon-pages split: every addon shipping
-* widgets registers a provider on this collection cap; the hub-local
-* aggregator (`addon-widgets`, see `addon-widgets.cap.ts`) walks the
-* collection, stamps versioned `bundleUrl`s onto each declaration, and
-* exposes the public listing surface that admin-ui consumes.
-*
-* The split exists because the public listing has a different output
-* shape (flat enriched metadata with `addonId` + `bundleUrl`) than the
-* per-provider raw declarations. Both ends flow through codegen.
+* Resource-bound constants for the safe expression engine.
 *
-* Unified UI-contribution model (Task 10): a widget descriptor IS a
-* `UiContribution` with `kind:'remote'`. The host renders it through the
-* same `ContributionRenderer` / Module-Federation path as every other
-* contributed UI surface — no bespoke widget-rendering path. The widget-
-* only metadata (sizing hints, `requires`) lives as extra fields on the
-* descriptor; the `UiContribution` core (`tab` / `label` / `order` /
-* `kind` / `remote`) carries identity + placement + the MF remote.
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
 */
-/** Where the widget makes sense to render — maps to a contribution `tab`. */
-var WidgetHostEnum = z.enum([
-	"device-tab",
-	"dashboard",
-	"integration-detail"
-]);
-var WidgetSizeEnum = z.enum([
-	"xs",
-	"sm",
-	"md",
-	"lg",
-	"xl"
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
 ]);
 /**
-* MF remote descriptor — mirrors `UiContributionRemote` from
-* `capability-definition.ts`. Widget remotes expose a single
-* `'./widgets'` module whose default export is a
-* `Record<componentKey, Component>` map; `componentKey` (the widget
-* `stableId`) picks the entry the host mounts.
-*/
-var WidgetRemoteSchema = z.object({
-	remoteName: z.string(),
-	exposedModule: z.string(),
-	componentKey: z.string().optional()
-});
-/**
-* One widget declaration — a `UiContribution` (`kind:'remote'`) plus
-* widget-only metadata. The `UiContribution` core fields:
-*
-*  - `tab`     — where the widget hosts. A widget that runs on the
-*                dashboard declares `tab:'dashboard'`; a device-tab
-*                widget declares the target device-detail tab id.
-*  - `subTab`  — optional sub-tab within `tab`.
-*  - `label`   — operator-facing label.
-*  - `order`   — ordering within `(tab, subTab)`.
-*  - `kind`    — always `'remote'` for widgets.
-*  - `remote`  — the MF remote `{ remoteName, exposedModule, componentKey }`.
-*
-* Widget-only fields retained alongside the contribution core:
-*
-*  - `stableId`      — stable identity within the addon (the MF
-*                      `componentKey`; kept top-level so consumers have
-*                      a stable key without reaching into `remote`).
-*  - `description` / `icon` — picker metadata.
-*  - `bundle`        — entry filename inside the addon `dist/` dir; the
-*                      aggregator stamps a versioned `bundleUrl` from it.
-*  - `hosts`         — every host the widget supports (a widget can run
-*                      both on the dashboard and a device tab). `tab`
-*                      is the PRIMARY host; `hosts` is the full set the
-*                      picker filters on.
-*  - `requires`      — host-context requirements validated at mount.
-*  - `defaultSize` / `allowedSizes` / `defaultColumns` / `defaultRows`
-*                    — dashboard placement hints.
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
 */
-var WidgetMetadataSchema = z.object({
-	/** Primary host tab — `'dashboard'`, `'device-tab'`, or a device-detail tab id. */
-	tab: z.string(),
-	/** Optional sub-tab within `tab`. */
-	subTab: z.string().optional(),
-	/** Operator-facing label. */
-	label: z.string(),
-	/** Ordering within `(tab, subTab)`, ascending. */
-	order: z.number().optional(),
-	/** Always `'remote'` — a widget is a Module Federation remote. */
-	kind: z.literal("remote"),
-	/** MF remote descriptor. */
-	remote: WidgetRemoteSchema,
-	/** Stable id within the addon — kebab-case. Equals `remote.componentKey`. */
-	stableId: z.string(),
-	description: z.string().optional(),
-	icon: z.string().optional(),
-	/**
-	* Bundle filename inside the addon's `dist/` dir served at
-	* `/api/addon-widgets/<addonId>/<bundle>`. With Module Federation
-	* this is always `'remoteEntry.js'` — the value is kept on the
-	* metadata so the static-file route can compute an mtime-based
-	* cache-buster URL without a separate filesystem stat.
-	*/
-	bundle: z.string(),
-	/** Every host the widget supports. The picker filters on this set. */
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	}
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
+/**
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
+*
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
+*
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+*/
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
+		};
+	}
+	peek() {
+		return this.tokens[this.pos];
+	}
+	next() {
+		return this.tokens[this.pos++];
+	}
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
+	}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
+		}
+		return false;
+	}
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	}
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
+		}
+		return test;
+	}
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
+				};
+			}
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
+	}
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
+	}
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
+/**
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
+*
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
+*/
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
+	}
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
+	}
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
+	}
+	return result;
+}
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
+}
+Object.freeze({});
+/**
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
+	}
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	}
+	return null;
+}
+/**
+* What an expression's named bindings READ from.
+*
+* Salvaged verbatim from the deleted device-link mechanism. Wiring's source
+* kinds were the one part of it worth keeping: addressing a device field by
+* re-sync-stable `stableId`, a per-device constant, and a sibling-accessory
+* read are the vocabulary any cross-device derivation needs, and they were
+* already correct. What wiring got wrong was the DESTINATION — a field on
+* somebody else's device, with no identity — not the source.
+*
+* These shapes are therefore kept, re-homed next to the engine that consumes
+* them, and are the binding type of a composition recipe (the source picker
+* stays `deviceManager.getWireableFields`). They deliberately do NOT nest: a
+* binding is a read, never another expression.
+*
+* Schemas are authoritative; every type is `z.infer` of one, so a wire shape and
+* a TypeScript shape cannot drift apart (`scripts/check-schema-type-twins.ts`).
+*/
+/** Read a sibling accessory's status field, addressed by the sibling's key.
+*  `kind` is optional for wire compatibility — absent means `'field'`. */
+var ExpressionFieldBindingSchema = z.object({
+	kind: z.literal("field").optional(),
+	sourceKey: z.string(),
+	cap: z.string(),
+	fieldPath: z.string()
+});
+/** A constant. No device is read. */
+var ExpressionLiteralBindingSchema = z.object({
+	kind: z.literal("literal"),
+	value: z.union([
+		z.string(),
+		z.number(),
+		z.boolean(),
+		z.null()
+	])
+});
+/** Read ANY device's status field, addressed by its re-sync-stable `stableId` —
+*  never by numeric id, which a re-adoption reissues. */
+var ExpressionGlobalBindingSchema = z.object({
+	kind: z.literal("global"),
+	sourceStableId: z.string(),
+	cap: z.string(),
+	fieldPath: z.string()
+});
+var ExpressionBindingSourceSchema = z.union([
+	ExpressionFieldBindingSchema,
+	ExpressionLiteralBindingSchema,
+	ExpressionGlobalBindingSchema
+]);
+z.object({
+	expr: z.string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: z.record(z.string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+/** How a leaf compares a device field to a value. Derived from the field's
+*  `kind` in `deviceManager.getWireableFields`, never hand-maintained. */
+var AutomationConditionOperatorSchema = z.enum([
+	"eq",
+	"ne",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"contains",
+	"in"
+]);
+var AutomationConditionLeafSchema = z.object({
+	kind: z.literal("condition"),
+	deviceId: z.number().int().nonnegative(),
+	cap: z.string().min(1),
+	fieldPath: z.string().min(1),
+	operator: AutomationConditionOperatorSchema,
+	value: z.union([
+		z.string(),
+		z.number(),
+		z.boolean(),
+		z.array(z.union([z.string(), z.number()]))
+	])
+});
+/**
+* The expression leaf, declared as a plain object rather than an intersection
+* with {@link ExpressionSourceSchema}: a discriminated union has to be able to
+* read `kind` off each option, and an intersection hides it. The author-time
+* validation is the SAME function `ExpressionSourceSchema` runs, so the two
+* cannot drift — an expression that one accepts, the other accepts.
+*/
+var AutomationConditionExpressionSchema = z.object({
+	kind: z.literal("expression"),
+	expr: z.string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: z.record(z.string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+var AutomationConditionSchema = z.lazy(() => z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("all"),
+		children: z.array(AutomationConditionSchema)
+	}),
+	z.object({
+		kind: z.literal("any"),
+		children: z.array(AutomationConditionSchema)
+	}),
+	z.object({
+		kind: z.literal("not"),
+		child: AutomationConditionSchema
+	}),
+	AutomationConditionLeafSchema,
+	AutomationConditionExpressionSchema
+]));
+/**
+* What starts a run.
+*
+* D8 compliance, and it is the reason `device-state` is not merely an event
+* subscription: the trigger evaluates against the **state mirror**, which is
+* reconciled, and an event only WAKES the evaluation. A dropped event therefore
+* DELAYS a trigger; it does not lose it. `schedule` uses `croner` — the one
+* already in the repo — because `setInterval(24h)` drifts and "at 23:30" does
+* not.
+*/
+var AutomationTriggerSchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("device-state"),
+		deviceId: z.number().int().nonnegative(),
+		cap: z.string().min(1),
+		fieldPath: z.string().min(1),
+		/** Fire when the field takes this value. Omit to fire on any change. */
+		becomes: z.union([
+			z.string(),
+			z.number(),
+			z.boolean()
+		]).optional(),
+		/** Only on a CHANGE of value, not on every re-report. */
+		edge: z.boolean().optional(),
+		/** The condition must hold this long before the run starts. */
+		forMs: z.number().int().min(0).max(864e5).optional(),
+		/** Collapse a burst into one run. */
+		debounceMs: z.number().int().min(0).max(6e5).optional()
+	}),
+	z.object({
+		kind: z.literal("device-event"),
+		/** An `EventCategory` value. */
+		category: z.string().min(1),
+		deviceId: z.number().int().nonnegative().optional()
+	}),
+	z.object({
+		kind: z.literal("schedule"),
+		cron: z.string().min(1).max(120)
+	}),
+	z.object({ kind: z.literal("manual") })
+]);
+/**
+* One action step.
+*
+* `wait` and `cap` are `NcRuleActionSchema`'s two members, kept structurally
+* identical so `NcRuleActionRunner` runs them unchanged — its device-scope
+* check, stop-at-first-failure and per-sequence throttle are the whole reason
+* to reuse it, and none of them are re-implemented here.
+*
+* **The one divergence, and it is forced.** `NcRuleActionSchema.cap.deviceId` is
+* a literal `z.number().int()`, and the NC runner's own `RunSequencesInput`
+* documents its subject device as *"for the log tag, never for routing"*. So an
+* NC action can never target the device that triggered it — which is fine for
+* the NC (its rules already scope to a device) and fatal for an automation
+* ("sound the siren of the camera that saw the person"). `deviceId` therefore
+* also accepts `{ $var }`, resolved from the run's `vars` bag BEFORE the runner
+* is called. The runner still receives a number and is untouched; the
+* resolution is the recipe's job, not the runner's.
+*/
+var AutomationActionSchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("wait"),
+		seconds: z.number().min(0).max(300)
+	}),
+	z.object({
+		kind: z.literal("cap"),
+		deviceId: z.union([z.number().int(), z.object({ $var: z.string().min(1) })]),
+		cap: z.string().min(1),
+		method: z.string().min(1),
+		/** Values may carry `{{vars.x}}` slots, which SUBSTITUTE and do not
+		*  evaluate (§3.2.3). Anything beyond substitution is the expression leaf. */
+		args: z.record(z.string(), z.unknown()).optional()
+	}),
+	z.object({
+		kind: z.literal("code"),
+		/** Compiled into the automation's OWN block by esbuild — not a third
+		*  runtime, not a `vm`, and not dynamically evaluated. */
+		code: z.string().min(1).max(2e4)
+	})
+]);
+z.object({
+	triggers: z.array(AutomationTriggerSchema),
+	conditions: AutomationConditionSchema.optional(),
+	actions: z.array(AutomationActionSchema)
+});
+/**
+* `addon-pages` — system-scoped singleton aggregator cap. Public-facing
+* surface that admin-ui consumes through `useAddonPagesListPages()`.
+*
+* The provider iterates every `addon-pages-source` (collection) provider
+* and emits `AddonPageInfo[]` enriched with versioned `bundleUrl` strings
+* pointing at `/api/addon-pages/<addonId>/<bundle>?v=<mtime>`. The
+* filesystem `mtime` cache-buster lets the browser pick up addon
+* rebuilds without manual reload.
+*
+* The hub-local builtin `addon-pages-aggregator` (see
+* `@camstack/system/builtins/addon-pages-aggregator`) registers the
+* provider. Splitting the public aggregator from the raw collection
+* keeps both ends in codegen — there's no hand-written
+* `addon-pages.router.ts` wrapper anymore.
+*/
+var AddonPageDeclarationSchema$1 = z.object({
+	id: z.string(),
+	label: z.string(),
+	icon: z.string(),
+	path: z.string(),
+	remoteName: z.string(),
+	bundle: z.string(),
+	section: z.string().optional(),
+	sectionLabel: z.string().optional()
+});
+var AddonPageInfoSchema = z.object({
+	addonId: z.string(),
+	page: AddonPageDeclarationSchema$1,
+	bundleUrl: z.string()
+});
+var addonPagesCapability = {
+	name: "addon-pages",
+	scope: "system",
+	mode: "singleton",
+	methods: { listPages: method(z.void(), z.array(AddonPageInfoSchema).readonly()) }
+};
+/**
+* `addon-pages-source` — collection cap exposing per-provider raw page
+* declarations. Every addon that contributes a UI page registers a
+* provider here. The hub-side singleton aggregator (`addon-pages` cap,
+* see `addon-pages.cap.ts`) walks this collection, stamps versioned
+* `bundleUrl` values, and returns the enriched `AddonPageInfo[]` list
+* that admin-ui consumes.
+*
+* The split exists because the public listing has a different output
+* shape than the per-provider raw declarations, and we want both ends
+* to flow through codegen instead of relying on a hand-written wrapper.
+*/
+var AddonPageDeclarationSchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	icon: z.string(),
+	path: z.string(),
+	/**
+	* Module Federation remote name — must match the `name` field on the
+	* page addon's `federation()` plugin config. Used by admin-ui's
+	* `<AddonPageLoader>` to call `loadRemote('<remoteName>/page')`.
+	* Conventionally `addon_<id>_page` (snake_case; MF names cannot
+	* contain hyphens).
+	*/
+	remoteName: z.string(),
+	/**
+	* Bundle filename inside the addon's `dist/` dir served at
+	* `/api/addon-pages/<addonId>/<bundle>`. With Module Federation this
+	* is always `'remoteEntry.js'`; the value is kept on the metadata so
+	* the static-file route can compute an mtime-based cache-buster URL
+	* without a separate filesystem stat.
+	*/
+	bundle: z.string(),
+	/**
+	* Sidebar section this page docks into. Well-known ids: `'detection'`,
+	* `'cluster'`, `'administration'` — the page renders inside that group.
+	* Any OTHER string creates (or joins) a custom section rendered after
+	* the built-in groups; its label comes from `sectionLabel` (first
+	* declaration wins), falling back to the id. Absent → the legacy
+	* "Addon Pages" group.
+	*/
+	section: z.string().optional(),
+	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
+	sectionLabel: z.string().optional()
+});
+var addonPagesSourceCapability = {
+	name: "addon-pages-source",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { listPages: method(z.void(), z.array(AddonPageDeclarationSchema).readonly()) }
+};
+var AddonHttpRouteSchema = z.object({
+	method: z.enum([
+		"GET",
+		"POST",
+		"PUT",
+		"DELETE",
+		"PATCH"
+	]),
+	path: z.string(),
+	access: z.enum([
+		"public",
+		"authenticated",
+		"admin"
+	]).optional(),
+	description: z.string().optional()
+});
+/**
+* Cross-process route invocation envelope. The hub captures the
+* request as plain data, ships it to the worker via Moleculer, and
+* the worker runs the local handler against a capturing reply. The
+* envelope returned describes what the handler intended (status,
+* headers, body, or a redirect) so the hub can translate it back to
+* the Fastify reply that's actually wired to the socket.
+*/
+var InvokeRequestSchema = z.object({
+	method: z.string(),
+	path: z.string(),
+	params: z.record(z.string(), z.string()),
+	query: z.record(z.string(), z.string()),
+	body: z.unknown(),
+	headers: z.record(z.string(), z.string()),
+	user: z.object({
+		id: z.string(),
+		username: z.string(),
+		isAdmin: z.boolean()
+	}).optional(),
+	scopedToken: z.unknown().optional()
+});
+var InvokeReplyEnvelopeSchema = z.object({
+	status: z.number().int(),
+	headers: z.record(z.string(), z.string()),
+	/** When set, the hub MUST `reply.redirect(redirectUrl)` instead of
+	*  sending `body`. Status defaults to 302 when this is set unless
+	*  the handler called `reply.code(...)` explicitly. */
+	redirectUrl: z.string().nullable(),
+	/** JSON-serializable body. `undefined` is treated as "no body". */
+	body: z.unknown().optional(),
+	/** Set when the handler called `reply.type(mime)`. */
+	contentType: z.string().optional()
+});
+var addonRoutesCapability = {
+	name: "addon-routes",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		getRoutes: method(z.void(), z.array(AddonHttpRouteSchema)),
+		/**
+		* Cross-process dispatch entry point. Forked addons implement this
+		* (via `buildAddonRouteProvider`) so the hub's Fastify catch-all
+		* can route through Moleculer when the handler lives in a worker.
+		*
+		* Local addons can implement it for free with the same helper;
+		* the hub bypasses the wire on co-located addons.
+		*/
+		invoke: method(InvokeRequestSchema, InvokeReplyEnvelopeSchema, { kind: "mutation" })
+	},
+	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+	mount: { kind: "skip" }
+};
+var ConfigTabDeclarationSchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	icon: z.string(),
+	order: z.number().optional()
+});
+var ConfigSectionWithValuesSchema = z.object({
+	id: z.string(),
+	title: z.string(),
+	description: z.string().optional(),
+	style: z.enum(["card", "accordion"]).optional(),
+	defaultCollapsed: z.boolean().optional(),
+	columns: z.union([
+		z.literal(1),
+		z.literal(2),
+		z.literal(3),
+		z.literal(4)
+	]).optional(),
+	tab: z.string().optional(),
+	location: z.enum(["settings", "top-tab"]).optional(),
+	order: z.number().optional(),
+	fields: z.array(z.any())
+});
+var SettingsSchemaWithValuesSchema = z.object({
+	tabs: z.array(ConfigTabDeclarationSchema).optional(),
+	sections: z.array(ConfigSectionWithValuesSchema)
+});
+/** Patch object — keys are field names, values are the new field values. */
+var SettingsPatchSchema = z.record(z.string(), z.unknown());
+/** Standard success response for update operations. */
+var SettingsUpdateResultSchema = z.object({ success: z.literal(true) });
+/**
+* addon-settings — singleton gateway for three-level addon settings.
+*
+* Works like `device-manager`: a single hub-side provider that resolves
+* `addonId` to the target addon and delegates the call. For hub-local
+* addons the call is direct; for remote agents it proxies via the
+* per-addon Moleculer service.
+*
+* Replaces the `$addonHost` Moleculer service. Transport transparency
+* is handled by the provider implementation — callers (admin UI, other
+* addons via `ctx.api`) never know which node hosts the target addon.
+*
+* Three levels:
+*   - **addon**: addon-scoped settings (installation config, API keys, …)
+*   - **global**: settings applied to all devices by default
+*   - **device**: per-device overrides
+*
+* Optional `nodeId` allows explicit node targeting. When absent the
+* provider resolves the addon's host node automatically.
+*/
+/**
+* `addon-settings` is a **hub-centric** cap: the hub hosts the single
+* provider, and `nodeId` in the input is data for the hub provider's
+* internal dispatcher, not a routing hint for the cap-router. See
+* `CapabilityDefinition.nodeIdMode` for the contract.
+*/
+var addonSettingsCapability = {
+	name: "addon-settings",
+	scope: "system",
+	mode: "singleton",
+	nodeIdMode: "data",
+	methods: {
+		getGlobalSettings: method(z.object({
+			addonId: z.string(),
+			nodeId: z.string().optional(),
+			overlay: z.record(z.string(), z.unknown()).optional(),
+			cap: z.string().optional()
+		}), SettingsSchemaWithValuesSchema.nullable()),
+		updateGlobalSettings: method(z.object({
+			addonId: z.string(),
+			nodeId: z.string().optional(),
+			patch: SettingsPatchSchema
+		}), SettingsUpdateResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getDeviceSettings: method(z.object({
+			addonId: z.string(),
+			deviceId: z.number(),
+			nodeId: z.string().optional()
+		}), SettingsSchemaWithValuesSchema.nullable()),
+		updateDeviceSettings: method(z.object({
+			addonId: z.string(),
+			deviceId: z.number(),
+			nodeId: z.string().optional(),
+			patch: SettingsPatchSchema
+		}), SettingsUpdateResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
+* `addon-widgets-source` — collection cap exposing per-addon raw widget
+* declarations. Mirrors the addon-pages split: every addon shipping
+* widgets registers a provider on this collection cap; the hub-local
+* aggregator (`addon-widgets`, see `addon-widgets.cap.ts`) walks the
+* collection, stamps versioned `bundleUrl`s onto each declaration, and
+* exposes the public listing surface that admin-ui consumes.
+*
+* The split exists because the public listing has a different output
+* shape (flat enriched metadata with `addonId` + `bundleUrl`) than the
+* per-provider raw declarations. Both ends flow through codegen.
+*
+* Unified UI-contribution model (Task 10): a widget descriptor IS a
+* `UiContribution` with `kind:'remote'`. The host renders it through the
+* same `ContributionRenderer` / Module-Federation path as every other
+* contributed UI surface — no bespoke widget-rendering path. The widget-
+* only metadata (sizing hints, `requires`) lives as extra fields on the
+* descriptor; the `UiContribution` core (`tab` / `label` / `order` /
+* `kind` / `remote`) carries identity + placement + the MF remote.
+*/
+/** Where the widget makes sense to render — maps to a contribution `tab`. */
+var WidgetHostEnum = z.enum([
+	"device-tab",
+	"dashboard",
+	"integration-detail"
+]);
+var WidgetSizeEnum = z.enum([
+	"xs",
+	"sm",
+	"md",
+	"lg",
+	"xl"
+]);
+/**
+* MF remote descriptor — mirrors `UiContributionRemote` from
+* `capability-definition.ts`. Widget remotes expose a single
+* `'./widgets'` module whose default export is a
+* `Record<componentKey, Component>` map; `componentKey` (the widget
+* `stableId`) picks the entry the host mounts.
+*/
+var WidgetRemoteSchema = z.object({
+	remoteName: z.string(),
+	exposedModule: z.string(),
+	componentKey: z.string().optional()
+});
+/**
+* One widget declaration — a `UiContribution` (`kind:'remote'`) plus
+* widget-only metadata. The `UiContribution` core fields:
+*
+*  - `tab`     — where the widget hosts. A widget that runs on the
+*                dashboard declares `tab:'dashboard'`; a device-tab
+*                widget declares the target device-detail tab id.
+*  - `subTab`  — optional sub-tab within `tab`.
+*  - `label`   — operator-facing label.
+*  - `order`   — ordering within `(tab, subTab)`.
+*  - `kind`    — always `'remote'` for widgets.
+*  - `remote`  — the MF remote `{ remoteName, exposedModule, componentKey }`.
+*
+* Widget-only fields retained alongside the contribution core:
+*
+*  - `stableId`      — stable identity within the addon (the MF
+*                      `componentKey`; kept top-level so consumers have
+*                      a stable key without reaching into `remote`).
+*  - `description` / `icon` — picker metadata.
+*  - `bundle`        — entry filename inside the addon `dist/` dir; the
+*                      aggregator stamps a versioned `bundleUrl` from it.
+*  - `hosts`         — every host the widget supports (a widget can run
+*                      both on the dashboard and a device tab). `tab`
+*                      is the PRIMARY host; `hosts` is the full set the
+*                      picker filters on.
+*  - `requires`      — host-context requirements validated at mount.
+*  - `defaultSize` / `allowedSizes` / `defaultColumns` / `defaultRows`
+*                    — dashboard placement hints.
+*/
+var WidgetMetadataSchema = z.object({
+	/** Primary host tab — `'dashboard'`, `'device-tab'`, or a device-detail tab id. */
+	tab: z.string(),
+	/** Optional sub-tab within `tab`. */
+	subTab: z.string().optional(),
+	/** Operator-facing label. */
+	label: z.string(),
+	/** Ordering within `(tab, subTab)`, ascending. */
+	order: z.number().optional(),
+	/** Always `'remote'` — a widget is a Module Federation remote. */
+	kind: z.literal("remote"),
+	/** MF remote descriptor. */
+	remote: WidgetRemoteSchema,
+	/** Stable id within the addon — kebab-case. Equals `remote.componentKey`. */
+	stableId: z.string(),
+	description: z.string().optional(),
+	icon: z.string().optional(),
+	/**
+	* Bundle filename inside the addon's `dist/` dir served at
+	* `/api/addon-widgets/<addonId>/<bundle>`. With Module Federation
+	* this is always `'remoteEntry.js'` — the value is kept on the
+	* metadata so the static-file route can compute an mtime-based
+	* cache-buster URL without a separate filesystem stat.
+	*/
+	bundle: z.string(),
+	/** Every host the widget supports. The picker filters on this set. */
 	hosts: z.array(WidgetHostEnum).readonly(),
 	/** Required props the host must supply. Validated at `<WidgetSlot>` mount. */
 	requires: z.object({
@@ -6598,6 +7398,23 @@ function kebabToCamel(s) {
 * too many — a drift would show as a logs pane that is simply always empty.
 */
 var CORE_BLOCK_ADDON_PREFIX = "core-block-";
+/**
+* The builtin's own addon id — and, because of that, the OWNER of the
+* integration every block's devices hang from.
+*
+* A block cannot own one. Every integration read is gated on the installed-addon
+* set (`addon-registry.service.ts` → `createFilteredRegistry`) and a block's
+* `core-block-<uuid>` is never in it, so its `getIntegrationByAddonId` answers
+* null forever while the write succeeds — one invisible, undeletable row per
+* start. `core-blocks` IS installed, so it reconciles one shared integration and
+* a block names it by id (`DeclaredDevicesSpec.integrationId`), minting nothing.
+*
+* Exported from the contract, next to the runner prefix and for the same reason:
+* a block reads it as
+* `ctx.api.integrations.getByAddonId.query({ addonId: CORE_BLOCKS_ADDON_ID })`,
+* so a second copy of the string is a block that silently declares into nowhere.
+*/
+var CORE_BLOCKS_ADDON_ID = "core-blocks";
 /** The addon/runner id a block's process runs under. */
 function coreBlockAddonId(blockId) {
 	return `${CORE_BLOCK_ADDON_PREFIX}${blockId}`;
@@ -9728,7 +10545,7 @@ var motionDetectionCapability = {
 * Why: pub/sub routing over the system event-bus loses fidelity
 * (callback shape, QoS guarantees, will/retain semantics) and adds
 * refcount bookkeeping that addons would rather own themselves. The
-* canonical consumer (`addon-export-ha-mqtt`) needs raw `mqtt.js`
+* canonical consumer needs raw `mqtt.js`
 * features anyway — give it the connection config, get out of the way.
 *
 * Consumer flow:
@@ -12471,8 +13288,26 @@ var TrackSchema = z.object({
 	/** Periodic snapshots at snapshotIntervalMs cadence (subject to
 	*  saveThumbnails policy). */
 	snapshots: z.array(TrackSnapshotSchema).readonly(),
-	/** Deduplicated zones the track has entered at least once. */
+	/** Deduplicated zones the track has entered at least once. Zone IDS. */
 	zonesVisited: z.array(z.string()).readonly(),
+	/**
+	* Human NAMES for {@link zonesVisited}, resolved at READ time against the
+	* `zones` capability.
+	*
+	* `zonesVisited` persists ids (`cfeec78c-8d69-…`), which no operator can type
+	* and no card can render — so every free-text search surface was structurally
+	* unable to answer "show me the tracks in Uscio", and did not fail loudly, it
+	* just returned nothing. Resolving here rather than in each client keeps ONE
+	* derivation and costs the clients no extra call (the `zones` cap is
+	* per-device, so a client-side resolve would be a per-camera fan-out on a
+	* surface built to avoid exactly that).
+	*
+	* Resolved, never invented: a zone deleted since the track was written has no
+	* name and is DROPPED, so this array can be shorter than `zonesVisited` — the
+	* two are not positionally aligned. Absent when the track visited no zone, or
+	* when the zone catalogue could not be read.
+	*/
+	zoneNames: z.array(z.string()).readonly().optional(),
 	/** Deduplicated set of detector classes observed for this track over its
 	*  life (a track may be reclassified, e.g. person→vehicle). Absent on
 	*  legacy rows written before class accumulation shipped. */
@@ -16277,6 +17112,77 @@ var snapshotCapability = {
 			lastCapturedAt: z.number().nullable(),
 			cacheAgeMs: z.number().nullable(),
 			etag: z.string().nullable()
+		}))),
+		/**
+		* Signed, expiring links to a CLIENT-SIZED frame — and the demand signal
+		* that makes those frames current.
+		*
+		* ## The problem it replaces
+		*
+		* `getSnapshotOverview` is cache-only by contract: it answers from whatever
+		* the wrapper happens to hold and never captures. Under D93 the client
+		* versions its image URL on that answer, and an image REQUEST is what enrols
+		* a camera in the keep-warm loop. Both of those are satisfiable by the
+		* client's own image cache — `expo-image` is URL-keyed and never revalidates
+		* — so a URL painted in a previous session comes off disk with no network,
+		* no enrolment, and nothing warming. Measured on the live hub: reopening
+		* after two minutes idle painted 15 of 16 tiles at **168 s old** with zero
+		* HTTP requests, and the fleet only recovered because a later poll happened
+		* to observe a different identity.
+		*
+		* ## The two properties that fix it
+		*
+		* **It is an RPC, so no client cache can answer it.** The demand signal
+		* always reaches the wrapper. This method therefore MAY create keep-warm
+		* subscriptions, where `getSnapshotOverview` must never (D93) — the
+		* distinction is not "one is newer" but that the overview poll is app-wide
+		* (a creating overview would warm every camera on the install) while this is
+		* called by a rendered surface naming the tiles it is actually painting, at
+		* the width it is painting them.
+		*
+		* **It waits, briefly and boundedly, for the capture it triggered.** The
+		* returned `capturedAt` is the frame the link will serve, not the frame the
+		* cache held when the client asked, so a first paint is honest and current
+		* instead of a generation behind. A device that does not settle inside the
+		* bound still gets a link and its real (older) `capturedAt` — the next poll
+		* carries it forward.
+		*
+		* `force` is never set on behalf of a client here. A sleeping battery camera
+		* is reported with `sleeping: true` and the last frame it produced, however
+		* old; the wrapper's existing sleep gate owns that decision and this method
+		* adds no second one.
+		*/
+		getSnapshotLinks: systemMethod(z.object({ 
+		/** The tiles a surface is actually rendering. One entry per (device,
+		*  width) the caller will paint — the width is snapped to the server's
+		*  ladder and becomes part of the link's SIGNED identity. */
+targets: z.array(z.object({
+			deviceId: z.number(),
+			/** Target width in px. Omit for the frame as captured — correct
+			*  for a full-bleed surface, wrong (and expensive) for a grid. */
+			width: z.number().int().positive().optional()
+		})).min(1).max(200) }), z.array(z.object({
+			deviceId: z.number(),
+			/** Root-relative signed path, or null when the link plane is not
+			*  served (no data-plane facility). Present even for a device that has
+			*  never captured — the request is what triggers the first one (D94). */
+			url: z.string().nullable(),
+			/** Epoch ms of the frame this link serves. Null = never captured.
+			*  THE honest age: the tRPC path carried none before this. */
+			capturedAt: z.number().nullable(),
+			/** Age of that frame at the moment the answer was built. */
+			ageMs: z.number().nullable(),
+			/** Epoch ms after which `url` stops verifying. */
+			expiresAt: z.number().nullable(),
+			/** Ladder rung the bytes are at; null = the frame as captured. */
+			width: z.number().nullable(),
+			/** The device has never produced a frame. An empty state, not a
+			*  failure — and never a reason to withhold the link (D94). */
+			neverCaptured: z.boolean(),
+			/** A sleeping battery camera: the frame is deliberately stale and will
+			*  NOT refresh in the background. A surface should say so rather than
+			*  present it as current. */
+			sleeping: z.boolean()
 		})))
 	},
 	status: {
@@ -25244,1231 +26150,786 @@ var ValveStatusSchema = z.object({
 	/** Lifecycle state of the valve. */
 	state: ValveStateSchema,
 	/** 0 = fully closed, 100 = fully open. Null when the device has no
-	*  intermediate position surface. */
-	position: z.number().min(0).max(100).nullable(),
-	/** Ms epoch when the slice was last updated. */
-	lastChangedAt: z.number()
-});
-var valveCapability = {
-	name: "valve",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	deviceTypes: [DeviceType.Valve],
-	methods: {
-		open: method(z.object({ deviceId: z.number().int().nonnegative() }), z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		close: method(z.object({ deviceId: z.number().int().nonnegative() }), z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		stop: method(z.object({ deviceId: z.number().int().nonnegative() }), z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		setPosition: method(z.object({
-			deviceId: z.number().int().nonnegative(),
-			position: z.number().min(0).max(100)
-		}), z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
-	},
-	status: {
-		schema: ValveStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — mirrored by the kernel. UI controls watch the
-	* slice for live position changes during a move.
-	*/
-	runtimeState: ValveStatusSchema
-};
-/**
-* Vibration / shake / impact sensor. Drives Home Assistant
-* `binary_sensor` entries with `device_class: vibration`. Push-driven.
-*/
-var VibrationStatusSchema = z.object({
-	detected: z.boolean(),
-	/** Ms epoch of the last transition. 0 if never observed. */
-	lastChangedAt: z.number()
-});
-var vibrationCapability = {
-	name: "vibration",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	deviceTypes: [DeviceType.Sensor],
-	methods: {},
-	status: {
-		schema: VibrationStatusSchema,
-		kind: "push"
-	},
-	runtimeState: VibrationStatusSchema
-};
-/**
-* Water heater / boiler cap. Models HA `water_heater.*` entities — a
-* climate-family actuator with a target temperature, an operation-mode
-* selector (`eco` / `electric` / `gas` / `heat_pump` / `high_demand` /
-* `performance` / `off`), and an optional away-mode toggle.
-*
-* The slice carries the current + target temperature, the active
-* operation mode (HA's `state`) and its available set (HA's
-* `operation_list`), the away flag (HA `away_mode` 'on'/'off' → bool,
-* null when unsupported), plus the `min_temp` / `max_temp` bounds.
-*
-* Providers populate only what the hardware reports — temperature and
-* away fields stay null when the device has no such surface.
-*/
-var WaterHeaterStatusSchema = z.object({
-	/** Current measured temperature. Null when not reported. */
-	currentTemp: z.number().nullable(),
-	/** Target temperature setpoint. Null when no setpoint surface. */
-	targetTemp: z.number().nullable(),
-	/** Active operation mode = HA `state` (`eco` / `electric` / `gas` /
-	*  `heat_pump` / `high_demand` / `performance` / `off`). Null when the
-	*  device reports an unknown state. */
-	operationMode: z.string().nullable(),
-	/** Available operation modes = HA `operation_list`. */
-	availableModes: z.array(z.string()),
-	/** Away mode (HA `away_mode` 'on'/'off' → bool). Null when the device
-	*  has no away surface. */
-	away: z.boolean().nullable(),
-	/** HA `min_temp` attribute. Null when not reported. */
-	minTemp: z.number().nullable(),
-	/** HA `max_temp` attribute. Null when not reported. */
-	maxTemp: z.number().nullable(),
-	/** Ms epoch when the slice was last updated. */
-	lastChangedAt: z.number()
-});
-var waterHeaterCapability = {
-	name: "water-heater",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	deviceTypes: [DeviceType.WaterHeater],
-	methods: {
-		setTargetTemp: method(z.object({
-			deviceId: z.number().int().nonnegative(),
-			temp: z.number().finite()
-		}), z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		setOperationMode: method(z.object({
-			deviceId: z.number().int().nonnegative(),
-			mode: z.string().min(1)
-		}), z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		setAway: method(z.object({
-			deviceId: z.number().int().nonnegative(),
-			on: z.boolean()
-		}), z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
-	},
-	status: {
-		schema: WaterHeaterStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — mirrored by the kernel. UI controls watch the
-	* slice for live temperature / mode / away changes.
-	*/
-	runtimeState: WaterHeaterStatusSchema
-};
-/**
-* Weather provider cap. Models HA `weather.*` entities — a read-only
-* snapshot of the CURRENT conditions a weather integration reports.
-*
-* Read-only: there are no setters. The slice is populated from upstream
-* pushes (the HA weather entity's state + attributes) and rendered by
-* the UI as a sky scene + readouts.
-*
-* `condition` is the verbatim HA state string (`sunny` / `cloudy` /
-* `rainy` / `snowy` / `partlycloudy` / `pouring` / `lightning` /
-* `lightning-rainy` / `fog` / `windy` / `windy-variant` / `hail` /
-* `clear-night` / `exceptional` / …). The UI maps it to a glyph + tint;
-* unknown strings fall back to a neutral cloud.
-*
-* Every numeric reading is nullable — a given weather integration only
-* populates the metrics it actually provides.
-*
-* Forecast deferred — current conditions only for v1.
-*/
-var WeatherStatusSchema = z.object({
-	/** Verbatim HA condition state (`sunny`, `cloudy`, `rainy`, …). Null
-	*  when no condition has been reported yet. */
-	condition: z.string().nullable(),
-	/** Current temperature in the reported unit. Null when not provided. */
-	temperature: z.number().nullable(),
-	/** Temperature unit string (e.g. `°C` / `°F`). Null when not provided. */
-	temperatureUnit: z.string().nullable(),
-	/** Relative humidity (0..100). Null when not provided. */
-	humidity: z.number().min(0).max(100).nullable(),
-	/** Barometric pressure in the reported unit. Null when not provided. */
-	pressure: z.number().nullable(),
-	/** Pressure unit string (e.g. `hPa` / `inHg`). Null when not provided. */
-	pressureUnit: z.string().nullable(),
-	/** Wind speed in the reported unit. Null when not provided. */
-	windSpeed: z.number().nullable(),
-	/** Wind-speed unit string (e.g. `km/h` / `mph`). Null when not provided. */
-	windSpeedUnit: z.string().nullable(),
-	/** Wind bearing in degrees (0..360, meteorological). Null when not provided. */
-	windBearing: z.number().nullable(),
+	*  intermediate position surface. */
+	position: z.number().min(0).max(100).nullable(),
 	/** Ms epoch when the slice was last updated. */
-	lastFetchedAt: z.number()
+	lastChangedAt: z.number()
 });
-var weatherCapability = {
-	name: "weather",
+var valveCapability = {
+	name: "valve",
 	scope: "device",
 	deviceNative: true,
 	mode: "singleton",
-	deviceTypes: [DeviceType.Weather],
-	methods: {},
+	deviceTypes: [DeviceType.Valve],
+	methods: {
+		open: method(z.object({ deviceId: z.number().int().nonnegative() }), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		close: method(z.object({ deviceId: z.number().int().nonnegative() }), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		stop: method(z.object({ deviceId: z.number().int().nonnegative() }), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setPosition: method(z.object({
+			deviceId: z.number().int().nonnegative(),
+			position: z.number().min(0).max(100)
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
 	status: {
-		schema: WeatherStatusSchema,
+		schema: ValveStatusSchema,
 		kind: "push"
 	},
 	/**
-	* Runtime-state slice — mirrored by the kernel. The UI reads the
-	* current conditions directly from the slice on each weather push.
+	* Runtime-state slice — mirrored by the kernel. UI controls watch the
+	* slice for live position changes during a move.
 	*/
-	runtimeState: WeatherStatusSchema
+	runtimeState: ValveStatusSchema
 };
 /**
-* Per-zone occupancy aggregation produced by the analytics frame
-* processor on every inference result. Covers the full combinatorial
-* matrix the operator UI needs: total objects everywhere, total
-* objects per zone, single class everywhere, single class per zone,
-* objects outside any zone.
-*
-* Counts are derived from the analytics tracker (tracked detections
-* with stable trackIds), not raw detector hits — this filters out
-* one-off detector flickers and gives counts that match what the user
-* sees on the live overlay.
-*
-* Overlap policy: a detection that intersects two zones counts in
-* BOTH zones' `byClass` and `totalObjects` (count-in-each). The
-* `frame` aggregate de-duplicates trivially since it's frame-wide.
-* `unzoned` counts only detections that landed in zero zones.
-*/
-var PerScopeBreakdownSchema = z.object({
-	/** Total tracked objects in this scope (frame / zone / unzoned). */
-	totalObjects: z.number().int().nonnegative(),
-	/** Per-class count. Keys are macro class names (e.g. `person`, `car`). */
-	byClass: z.record(z.string(), z.number().int().nonnegative())
-});
-var ZoneScopeBreakdownSchema = PerScopeBreakdownSchema.extend({
-	zoneId: z.string(),
-	zoneName: z.string(),
-	/** TrackIds of objects currently inside this zone — for cross-reference
-	*  with the per-track detail panel and live overlay. */
-	trackIds: z.array(z.string()).readonly()
-});
-/**
-* A parked ("stationary") object surfaced alongside occupancy — an object that
-* settled and stopped moving. It is NO LONGER a tracked object (the tracker was
-* told to forget it so it stops re-spawning tracks/events), but it IS still
-* physically present, so it keeps counting toward `frame` occupancy and is
-* listed here so the UI can show it in a dedicated "Stationary" section instead
-* of flooding the live event feed.
-*/
-var StationaryObjectSchema = z.object({
-	id: z.string(),
-	className: z.string(),
-	bbox: z.object({
-		x: z.number(),
-		y: z.number(),
-		w: z.number(),
-		h: z.number()
-	}),
-	frameWidth: z.number().int().nonnegative(),
-	frameHeight: z.number().int().nonnegative(),
-	/** When the source track was first seen. */
-	firstSeenAt: z.number().int(),
-	/** When the object was recognised as parked (promotion time). */
-	becameStationaryAt: z.number().int(),
-	/** Last frame a detection confirmed the object is still there. */
-	lastConfirmedAt: z.number().int(),
-	/** Enrichment label carried from the source track (identity / plate). */
-	label: z.string().optional(),
-	/** Native-resolution key-frame media key for the parked object's best image. */
-	keyFrameMediaKey: z.string().optional()
-});
-var CameraOccupancySnapshotSchema = z.object({
-	/** Frame timestamp of the inference result that produced this snapshot. */
-	ts: z.number().int(),
-	/** Frame width/height in pixels — let the UI normalize bbox coords. */
-	frameWidth: z.number().int().nonnegative(),
-	frameHeight: z.number().int().nonnegative(),
-	/** Per-zone breakdown — one entry per defined zone (user + onboard). */
-	zones: z.array(ZoneScopeBreakdownSchema).readonly(),
-	/** Frame-wide aggregate (everywhere, regardless of zone membership).
-	*  INCLUDES currently-confirmed stationary objects (they are still present). */
-	frame: PerScopeBreakdownSchema,
-	/** Detections that landed outside every zone. Empty when no zones defined. */
-	unzoned: PerScopeBreakdownSchema,
-	/** Parked objects on this camera (additive — absent on legacy snapshots).
-	*  Surfaced separately so the UI shows them in a dedicated section rather
-	*  than as repeated tracks/events. */
-	stationaryObjects: z.array(StationaryObjectSchema).readonly().optional()
-});
-/**
-* Time-series resolution. The history methods return one bucket per
-* step over the requested range. Smaller resolutions cost more
-* memory + bandwidth; bound to discrete steps so caller cannot ask
-* for arbitrary fractional buckets.
+* Vibration / shake / impact sensor. Drives Home Assistant
+* `binary_sensor` entries with `device_class: vibration`. Push-driven.
 */
-var HistoryResolutionEnum = z.enum([
-	"minute",
-	"5min",
-	"hour"
-]);
-var HistoryRangeSchema = z.object({
-	/** Range start (epoch ms, inclusive). */
-	from: z.number().int(),
-	/** Range end (epoch ms, inclusive). Defaults to "now" at query time. */
-	to: z.number().int(),
-	resolution: HistoryResolutionEnum
-});
-var HistoryPointSchema = z.object({
-	/** Bucket midpoint (epoch ms). */
-	ts: z.number().int(),
-	/** Object count averaged over the bucket (rounded to nearest integer). */
-	count: z.number().int().nonnegative()
+var VibrationStatusSchema = z.object({
+	detected: z.boolean(),
+	/** Ms epoch of the last transition. 0 if never observed. */
+	lastChangedAt: z.number()
 });
-/**
-* Zone Analytics capability — spatial occupancy aggregations over
-* tracked detections. Hosted by `addon-pipeline-analytics`.
-*
-* Live snapshot is mirrored into the `zone-occupancy` device-state
-* slice on every frame; the cap method `getCurrentSnapshot` is a
-* direct read for callers that don't want to subscribe.
-*
-* History methods are sourced from a 60-minute rolling in-memory
-* ring of frame-level samples (sub-second resolution). Queries
-* outside the ring window return empty arrays — durable storage
-* is a follow-up (Step 4b: persisted samples → SQL store).
-*
-* Every history method takes an optional `className` filter:
-* - omitted → bucket count includes ALL classes in scope
-* - present → bucket count restricted to that class
-*
-* The `getZoneHistory` / `getCameraHistory` / `getUnzonedHistory`
-* triple covers the three spatial scopes (per-zone, frame-wide,
-* outside-any-zone). Crossing them with `className?` gives the full
-* combinatorial coverage the operator UI requested.
-*/
-var zoneAnalyticsCapability = {
-	name: "zone-analytics",
+var vibrationCapability = {
+	name: "vibration",
 	scope: "device",
+	deviceNative: true,
 	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
-	methods: {
-		/** Latest computed occupancy snapshot for this camera. Null when
-		*  the analytics pipeline hasn't seen a frame for this device yet
-		*  (no inference result emitted since boot or since binding was
-		*  activated). */
-		getCurrentSnapshot: method(z.object({ deviceId: z.number() }), CameraOccupancySnapshotSchema.nullable()),
-		/** Time-series object count inside one zone. `className` optional —
-		*  omit to count every class in the zone. */
-		getZoneHistory: method(z.object({
-			deviceId: z.number(),
-			zoneId: z.string(),
-			className: z.string().optional()
-		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly()),
-		/** Time-series frame-wide object count (everywhere). */
-		getCameraHistory: method(z.object({
-			deviceId: z.number(),
-			className: z.string().optional()
-		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly()),
-		/** Time-series count of objects outside every zone. */
-		getUnzonedHistory: method(z.object({
-			deviceId: z.number(),
-			className: z.string().optional()
-		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly())
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: VibrationStatusSchema,
+		kind: "push"
 	},
-	/**
-	* Runtime-state slice — the latest occupancy snapshot mirrored by
-	* the analytics frame processor on every inference result. Consumers
-	* read via `device.state.zoneAnalytics.value` and stay in sync
-	* automatically; the explicit `getCurrentSnapshot` cap method is
-	* still useful for one-off polls without a subscription.
-	*/
-	runtimeState: CameraOccupancySnapshotSchema
+	runtimeState: VibrationStatusSchema
 };
 /**
-* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
-* cap so a single CRUD surface backs every consumer; each stage has
-* its own dev-state mirror slice (`motion-zone-rules`,
-* `detection-zone-rules`, …) so consumer addons subscribe independently.
-*
-* Extend the enum here when a new gating consumer comes online (audio
-* gating, alert filtering, …) — no other surface needs to change.
-*/
-var ZoneRuleStageEnum = z.enum([
-	"motion",
-	"detection",
-	"package"
-]);
-/**
-* Zone rules capability — per-camera CRUD over the {@link ZoneRule}
-* arrays that decide how each pipeline stage uses the polygon zones.
+* Water heater / boiler cap. Models HA `water_heater.*` entities — a
+* climate-family actuator with a target temperature, an operation-mode
+* selector (`eco` / `electric` / `gas` / `heat_pump` / `high_demand` /
+* `performance` / `off`), and an optional away-mode toggle.
 *
-* Hosted by `addon-pipeline-orchestrator` alongside the zones provider
-* so the operator has a single hub-side source of truth for both
-* geometry and behaviour. Per-stage rules are stored under the
-* `zoneRules.<stage>` key in the orchestrator's per-device store and
-* mirrored to the device-state slice `<stage>-zone-rules` on every
-* mutation; consumer addons (analytics, motion-wasm, pipeline-executor)
-* subscribe to that slice and refresh their gating without
-* round-tripping the cap.
+* The slice carries the current + target temperature, the active
+* operation mode (HA's `state`) and its available set (HA's
+* `operation_list`), the away flag (HA `away_mode` 'on'/'off' → bool,
+* null when unsupported), plus the `min_temp` / `max_temp` bounds.
 *
-* Sets are bulk-replace — the operator UI sends the new rule list
-* wholesale, so reordering / batch enable-toggle / drag-drop CRUD lives
-* naturally in the rule editor without per-rule mutation chatter.
+* Providers populate only what the hardware reports — temperature and
+* away fields stay null when the device has no such surface.
 */
-var zoneRulesCapability = {
-	name: "zone-rules",
+var WaterHeaterStatusSchema = z.object({
+	/** Current measured temperature. Null when not reported. */
+	currentTemp: z.number().nullable(),
+	/** Target temperature setpoint. Null when no setpoint surface. */
+	targetTemp: z.number().nullable(),
+	/** Active operation mode = HA `state` (`eco` / `electric` / `gas` /
+	*  `heat_pump` / `high_demand` / `performance` / `off`). Null when the
+	*  device reports an unknown state. */
+	operationMode: z.string().nullable(),
+	/** Available operation modes = HA `operation_list`. */
+	availableModes: z.array(z.string()),
+	/** Away mode (HA `away_mode` 'on'/'off' → bool). Null when the device
+	*  has no away surface. */
+	away: z.boolean().nullable(),
+	/** HA `min_temp` attribute. Null when not reported. */
+	minTemp: z.number().nullable(),
+	/** HA `max_temp` attribute. Null when not reported. */
+	maxTemp: z.number().nullable(),
+	/** Ms epoch when the slice was last updated. */
+	lastChangedAt: z.number()
+});
+var waterHeaterCapability = {
+	name: "water-heater",
 	scope: "device",
+	deviceNative: true,
 	mode: "singleton",
-	deviceTypes: [DeviceType.Camera],
+	deviceTypes: [DeviceType.WaterHeater],
 	methods: {
-		/** Read the full rule list for a given stage (empty when no rules
-		*  are defined yet). */
-		listRules: method(z.object({
-			deviceId: z.number(),
-			stage: ZoneRuleStageEnum
-		}), z.array(ZoneRuleSchema).readonly()),
-		/** Bulk-replace the rule list for one stage. The provider validates
-		*  each entry against {@link ZoneRuleSchema} (zoneIds non-empty,
-		*  thresholds in range) and rejects the whole patch if any entry
-		*  is invalid — partial writes are a configuration footgun. */
-		setRules: method(z.object({
-			deviceId: z.number(),
-			stage: ZoneRuleStageEnum,
-			rules: z.array(ZoneRuleSchema).readonly()
+		setTargetTemp: method(z.object({
+			deviceId: z.number().int().nonnegative(),
+			temp: z.number().finite()
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setOperationMode: method(z.object({
+			deviceId: z.number().int().nonnegative(),
+			mode: z.string().min(1)
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setAway: method(z.object({
+			deviceId: z.number().int().nonnegative(),
+			on: z.boolean()
 		}), z.void(), {
 			kind: "mutation",
 			auth: "admin"
 		})
 	},
+	status: {
+		schema: WaterHeaterStatusSchema,
+		kind: "push"
+	},
 	/**
-	* Runtime-state slice — every stage mirrored together so consumers
-	* see one reactive handle (`device.state.zoneRules.value`) instead
-	* of one per stage. Bulk-replace mutations on any stage write the full
-	* `{motion, detection, package}` shape, so subscribers always get the
-	* complete current set. Consumers that only care about one stage
-	* just read the matching property.
-	*
-	* `package` backs the package-drop detector — a package zone is a
-	* `ZoneRule` on the `'package'` stage referencing drawn polygons
-	* (see docs/superpowers/specs/2026-07-17-package-zones-design.md §3.1).
-	* The orchestrator provider writes this stage as a first-class slice
-	* (Phase 4): every mutation mirrors the full `{motion, detection,
-	* package}` shape, so consumers read the current package rules directly
-	* off `device.state.zoneRules.value.package`.
+	* Runtime-state slice — mirrored by the kernel. UI controls watch the
+	* slice for live temperature / mode / away changes.
 	*/
-	runtimeState: z.object({
-		motion: z.array(ZoneRuleSchema).readonly(),
-		detection: z.array(ZoneRuleSchema).readonly(),
-		package: z.array(ZoneRuleSchema).readonly()
-	})
+	runtimeState: WaterHeaterStatusSchema
 };
 /**
-* Runtime defaults -- used by ConfigManager.get() for backward compatibility
-* until Plan B wires all runtime settings to the system_settings SQL table.
+* Weather provider cap. Models HA `weather.*` entities — a read-only
+* snapshot of the CURRENT conditions a weather integration reports.
 *
-* Moved from @camstack/system/config-schema to @camstack/types so that
-* @camstack/system can reference it without a cross-package kernel import.
-*/
-var RUNTIME_DEFAULTS = {
-	"features.streaming": true,
-	"features.notifications": true,
-	"features.objectDetection": false,
-	"features.remoteAccess": true,
-	"features.agentCluster": false,
-	"features.smartHome": true,
-	"features.recordings": true,
-	"features.backup": true,
-	"features.repl": true,
-	"retention.detectionEventsDays": 30,
-	"retention.audioLevelsDays": 7,
-	"logging.level": "info",
-	"logging.retentionDays": 30,
-	"eventBus.ringBufferSize": 1e4,
-	"storage.provider": "sqlite-storage",
-	"storage.locations": {
-		data: "camstack-data/data",
-		media: "camstack-data/media",
-		recordings: "camstack-data/recordings",
-		cache: "/tmp/camstack-cache",
-		logs: "camstack-data/logs",
-		models: "camstack-data/models"
-	},
-	providers: [],
-	"ffmpeg.binaryPath": "ffmpeg",
-	"ffmpeg.hwAccel": "auto",
-	"ffmpeg.threadCount": 0,
-	"auth.tokenExpiry": "7d"
-};
-/**
-* Accessory device helpers — shared across drivers.
+* Read-only: there are no setters. The slice is populated from upstream
+* pushes (the HA weather entity's state + attributes) and rendered by
+* the UI as a sky scene + readouts.
 *
-* Many vendor-specific drivers register accessory child devices on
-* top of a parent (Reolink: siren / floodlight / PIR / autotrack /
-* chime; ONVIF: relay outputs; future: Tapo Hub child devices). Each
-* driver picks the right `DeviceType` + `DeviceRole` explicitly when
-* spawning, builds a name derived from the parent, and produces a
-* stableId tied to the parent so boot-restore can reconstruct the
-* relationship.
+* `condition` is the verbatim HA state string (`sunny` / `cloudy` /
+* `rainy` / `snowy` / `partlycloudy` / `pouring` / `lightning` /
+* `lightning-rainy` / `fog` / `windy` / `windy-variant` / `hail` /
+* `clear-night` / `exceptional` / …). The UI maps it to a glyph + tint;
+* unknown strings fall back to a neutral cloud.
 *
-* Centralised `(kind → DeviceType)` mapping was dropped on purpose:
-* drivers may reasonably disagree on the right type for an accessory
-* (a Reolink PIR exposes a switch on/off + sensitivity, while a hypothetical
-* read-only motion-only sensor might be `DeviceType.Sensor`). Forcing
-* one canonical mapping was over-prescriptive and added a layer of
-* indirection without saving meaningful code at call sites — the
-* driver knows its own hardware best.
-*/
-/**
-* Subset of `DeviceRole` values that drivers register as child
-* accessories of a parent device. Sourced verbatim from `DeviceRole`
-* — `AccessoryKind` is the alias drivers use when building accessory
-* children, so the call site reads as
-* `accessoryStableId(parent, AccessoryKind.Siren)` rather than
-* `accessoryStableId(parent, DeviceRole.Siren)` (which would imply
-* any role works, including non-accessory ones like Doorbell).
+* Every numeric reading is nullable — a given weather integration only
+* populates the metrics it actually provides.
+*
+* Forecast deferred — current conditions only for v1.
 */
-var AccessoryKind = {
-	Siren: DeviceRole.Siren,
-	Floodlight: DeviceRole.Floodlight,
-	Spotlight: DeviceRole.Spotlight,
-	PirSensor: DeviceRole.PirSensor,
-	Chime: DeviceRole.Chime,
-	Autotrack: DeviceRole.Autotrack,
-	Nightvision: DeviceRole.Nightvision,
-	PrivacyMask: DeviceRole.PrivacyMask
-};
-AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
-new Set(Object.values(DeviceType));
-DeviceFeature.BatteryOperated;
-/** Unwrap ZodNullable / ZodOptional / ZodDefault wrappers to reach the inner type.
-*  Zod v4 exposes `.unwrap()` on all three wrapper classes. */
-function unwrap(schema) {
-	let s = schema;
-	while (s instanceof z.ZodNullable || s instanceof z.ZodOptional || s instanceof z.ZodDefault) s = s.unwrap();
-	return s;
-}
-function leafKind(schema) {
-	const s = unwrap(schema);
-	if (s instanceof z.ZodEnum) return {
-		kind: "enum",
-		enumValues: s.options
-	};
-	if (s instanceof z.ZodNumber) return { kind: "number" };
-	if (s instanceof z.ZodString) return { kind: "string" };
-	if (s instanceof z.ZodBoolean) return { kind: "boolean" };
-	return null;
-}
-/** Walk a cap status schema into flat wireable leaf fields (dotted paths).
-*  Recurses into nested ZodObject (unwrapping nullable/optional/default first),
-*  so fields with null live values are still offered. Arrays / unknown shapes
-*  are skipped — never throws. */
-function enumerateSchemaFields(schema, prefix = "") {
-	const root = unwrap(schema);
-	if (!(root instanceof z.ZodObject)) return [];
-	const out = [];
-	const shape = root.shape;
-	for (const [key, field] of Object.entries(shape)) {
-		const path = prefix ? `${prefix}.${key}` : key;
-		const inner = unwrap(field);
-		if (inner instanceof z.ZodObject) {
-			out.push(...enumerateSchemaFields(inner, path));
-			continue;
-		}
-		const leaf = leafKind(field);
-		if (leaf) out.push({
-			path,
-			kind: leaf.kind,
-			...leaf.enumValues ? { enumValues: leaf.enumValues } : {}
-		});
-	}
-	return out;
-}
-/** Enumerate the per-item wireable fields of an item-array cap (see
-*  `CapabilityStatusItemArray`): the item schema's leaf fields, minus the
-*  `keyField` (the key comes from the link's `itemKey`, never from a wired
-*  source), each tagged `item: true` so the authoring UI collects an
-*  `itemKey` alongside the field. Never throws. */
-function enumerateItemArrayFields(itemArray) {
-	return enumerateSchemaFields(itemArray.itemSchema).filter((f) => f.path !== itemArray.keyField).map((f) => ({
-		...f,
-		item: true
-	}));
-}
+var WeatherStatusSchema = z.object({
+	/** Verbatim HA condition state (`sunny`, `cloudy`, `rainy`, …). Null
+	*  when no condition has been reported yet. */
+	condition: z.string().nullable(),
+	/** Current temperature in the reported unit. Null when not provided. */
+	temperature: z.number().nullable(),
+	/** Temperature unit string (e.g. `°C` / `°F`). Null when not provided. */
+	temperatureUnit: z.string().nullable(),
+	/** Relative humidity (0..100). Null when not provided. */
+	humidity: z.number().min(0).max(100).nullable(),
+	/** Barometric pressure in the reported unit. Null when not provided. */
+	pressure: z.number().nullable(),
+	/** Pressure unit string (e.g. `hPa` / `inHg`). Null when not provided. */
+	pressureUnit: z.string().nullable(),
+	/** Wind speed in the reported unit. Null when not provided. */
+	windSpeed: z.number().nullable(),
+	/** Wind-speed unit string (e.g. `km/h` / `mph`). Null when not provided. */
+	windSpeedUnit: z.string().nullable(),
+	/** Wind bearing in degrees (0..360, meteorological). Null when not provided. */
+	windBearing: z.number().nullable(),
+	/** Ms epoch when the slice was last updated. */
+	lastFetchedAt: z.number()
+});
+var weatherCapability = {
+	name: "weather",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Weather],
+	methods: {},
+	status: {
+		schema: WeatherStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. The UI reads the
+	* current conditions directly from the slice on each weather push.
+	*/
+	runtimeState: WeatherStatusSchema
+};
 /**
-* Error types for the safe expression engine. Two distinct classes so callers
-* can tell a compile-time (grammar) failure from a runtime (evaluation)
-* failure — both are non-fatal to the host: read paths degrade to "skip link".
+* Per-zone occupancy aggregation produced by the analytics frame
+* processor on every inference result. Covers the full combinatorial
+* matrix the operator UI needs: total objects everywhere, total
+* objects per zone, single class everywhere, single class per zone,
+* objects outside any zone.
+*
+* Counts are derived from the analytics tracker (tracked detections
+* with stable trackIds), not raw detector hits — this filters out
+* one-off detector flickers and gives counts that match what the user
+* sees on the live overlay.
+*
+* Overlap policy: a detection that intersects two zones counts in
+* BOTH zones' `byClass` and `totalObjects` (count-in-each). The
+* `frame` aggregate de-duplicates trivially since it's frame-wide.
+* `unzoned` counts only detections that landed in zero zones.
 */
-/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
-*  the failure is anchored to a character (author-facing inline feedback). */
-var ExpressionParseError = class extends Error {
-	position;
-	constructor(message, position) {
-		super(message);
-		this.name = "ExpressionParseError";
-		this.position = position;
-	}
-};
-/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
-*  result, unknown builtin, step-budget exceeded). */
-var ExpressionEvalError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ExpressionEvalError";
-	}
-};
+var PerScopeBreakdownSchema = z.object({
+	/** Total tracked objects in this scope (frame / zone / unzoned). */
+	totalObjects: z.number().int().nonnegative(),
+	/** Per-class count. Keys are macro class names (e.g. `person`, `car`). */
+	byClass: z.record(z.string(), z.number().int().nonnegative())
+});
+var ZoneScopeBreakdownSchema = PerScopeBreakdownSchema.extend({
+	zoneId: z.string(),
+	zoneName: z.string(),
+	/** TrackIds of objects currently inside this zone — for cross-reference
+	*  with the per-track detail panel and live overlay. */
+	trackIds: z.array(z.string()).readonly()
+});
 /**
-* Frozen, null-prototype builtin function table for the expression engine
-* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
-* parser rejects any callee not in it, and the evaluator gates each call on an
-* own-property check against it.
+* A parked ("stationary") object surfaced alongside occupancy — an object that
+* settled and stopped moving. It is NO LONGER a tracked object (the tracker was
+* told to forget it so it stops re-spawning tracks/events), but it IS still
+* physically present, so it keeps counting toward `frame` occupancy and is
+* listed here so the UI can show it in a dedicated "Stationary" section instead
+* of flooding the live event feed.
+*/
+var StationaryObjectSchema = z.object({
+	id: z.string(),
+	className: z.string(),
+	bbox: z.object({
+		x: z.number(),
+		y: z.number(),
+		w: z.number(),
+		h: z.number()
+	}),
+	frameWidth: z.number().int().nonnegative(),
+	frameHeight: z.number().int().nonnegative(),
+	/** When the source track was first seen. */
+	firstSeenAt: z.number().int(),
+	/** When the object was recognised as parked (promotion time). */
+	becameStationaryAt: z.number().int(),
+	/** Last frame a detection confirmed the object is still there. */
+	lastConfirmedAt: z.number().int(),
+	/** Enrichment label carried from the source track (identity / plate). */
+	label: z.string().optional(),
+	/** Native-resolution key-frame media key for the parked object's best image. */
+	keyFrameMediaKey: z.string().optional()
+});
+var CameraOccupancySnapshotSchema = z.object({
+	/** Frame timestamp of the inference result that produced this snapshot. */
+	ts: z.number().int(),
+	/** Frame width/height in pixels — let the UI normalize bbox coords. */
+	frameWidth: z.number().int().nonnegative(),
+	frameHeight: z.number().int().nonnegative(),
+	/** Per-zone breakdown — one entry per defined zone (user + onboard). */
+	zones: z.array(ZoneScopeBreakdownSchema).readonly(),
+	/** Frame-wide aggregate (everywhere, regardless of zone membership).
+	*  INCLUDES currently-confirmed stationary objects (they are still present). */
+	frame: PerScopeBreakdownSchema,
+	/** Detections that landed outside every zone. Empty when no zones defined. */
+	unzoned: PerScopeBreakdownSchema,
+	/** Parked objects on this camera (additive — absent on legacy snapshots).
+	*  Surfaced separately so the UI shows them in a dedicated section rather
+	*  than as repeated tracks/events. */
+	stationaryObjects: z.array(StationaryObjectSchema).readonly().optional()
+});
+/**
+* Time-series resolution. The history methods return one bucket per
+* step over the requested range. Smaller resolutions cost more
+* memory + bandwidth; bound to discrete steps so caller cannot ask
+* for arbitrary fractional buckets.
+*/
+var HistoryResolutionEnum = z.enum([
+	"minute",
+	"5min",
+	"hour"
+]);
+var HistoryRangeSchema = z.object({
+	/** Range start (epoch ms, inclusive). */
+	from: z.number().int(),
+	/** Range end (epoch ms, inclusive). Defaults to "now" at query time. */
+	to: z.number().int(),
+	resolution: HistoryResolutionEnum
+});
+var HistoryPointSchema = z.object({
+	/** Bucket midpoint (epoch ms). */
+	ts: z.number().int(),
+	/** Object count averaged over the bucket (rounded to nearest integer). */
+	count: z.number().int().nonnegative()
+});
+/**
+* Zone Analytics capability — spatial occupancy aggregations over
+* tracked detections. Hosted by `addon-pipeline-analytics`.
 *
-* Because the object has a NULL prototype AND is `Object.freeze`d:
-*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
-*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
-*    (there is no `Object.prototype` in the chain), so those names are not
-*    callable — they are simply "unknown function" at parse time.
+* Live snapshot is mirrored into the `zone-occupancy` device-state
+* slice on every frame; the cap method `getCurrentSnapshot` is a
+* direct read for callers that don't want to subscribe.
 *
-* Every numeric argument is validated as a finite number and every numeric
-* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
-* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
-* closed rather than emitting a garbage value.
+* History methods are sourced from a 60-minute rolling in-memory
+* ring of frame-level samples (sub-second resolution). Queries
+* outside the ring window return empty arrays — durable storage
+* is a follow-up (Step 4b: persisted samples → SQL store).
+*
+* Every history method takes an optional `className` filter:
+* - omitted → bucket count includes ALL classes in scope
+* - present → bucket count restricted to that class
+*
+* The `getZoneHistory` / `getCameraHistory` / `getUnzonedHistory`
+* triple covers the three spatial scopes (per-zone, frame-wide,
+* outside-any-zone). Crossing them with `className?` gives the full
+* combinatorial coverage the operator UI requested.
 */
-function asFiniteNumber(value, name, index) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
-	return value;
-}
-function asString$1(value, name, index) {
-	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
-	return value;
-}
-function finiteResult(value, name) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
-	return value;
-}
-function allFiniteNumbers(args, name) {
-	return args.map((a, idx) => asFiniteNumber(a, name, idx));
-}
-var INF = Number.POSITIVE_INFINITY;
-var table = {
-	min: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
-	},
-	max: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
-	},
-	abs: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
-	},
-	floor: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
-	},
-	ceil: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
-	},
-	sqrt: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
-	},
-	round: {
-		minArgs: 1,
-		maxArgs: 2,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "round", 0);
-			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
-			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
-			const factor = 10 ** digits;
-			return finiteResult(Math.round(x * factor) / factor, "round");
-		}
-	},
-	pow: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
-	},
-	clamp: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "clamp", 0);
-			const lo = asFiniteNumber(args[1], "clamp", 1);
-			const hi = asFiniteNumber(args[2], "clamp", 2);
-			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
-			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
-		}
-	},
-	avg: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const nums = allFiniteNumbers(args, "avg");
-			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
-		}
-	},
-	sum: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
-	},
-	coalesce: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			for (const a of args) if (a !== null) return a;
-			return null;
-		}
-	},
-	age: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+var zoneAnalyticsCapability = {
+	name: "zone-analytics",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		/** Latest computed occupancy snapshot for this camera. Null when
+		*  the analytics pipeline hasn't seen a frame for this device yet
+		*  (no inference result emitted since boot or since binding was
+		*  activated). */
+		getCurrentSnapshot: method(z.object({ deviceId: z.number() }), CameraOccupancySnapshotSchema.nullable()),
+		/** Time-series object count inside one zone. `className` optional —
+		*  omit to count every class in the zone. */
+		getZoneHistory: method(z.object({
+			deviceId: z.number(),
+			zoneId: z.string(),
+			className: z.string().optional()
+		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly()),
+		/** Time-series frame-wide object count (everywhere). */
+		getCameraHistory: method(z.object({
+			deviceId: z.number(),
+			className: z.string().optional()
+		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly()),
+		/** Time-series count of objects outside every zone. */
+		getUnzonedHistory: method(z.object({
+			deviceId: z.number(),
+			className: z.string().optional()
+		}).extend(HistoryRangeSchema.shape), z.array(HistoryPointSchema).readonly())
 	},
-	convert: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args, hooks) => {
-			const x = asFiniteNumber(args[0], "convert", 0);
-			const from = asString$1(args[1], "convert", 1).trim();
-			const to = asString$1(args[2], "convert", 2).trim();
-			if (hooks.convert) {
-				const out = hooks.convert(x, from, to);
-				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
-				return finiteResult(out, "convert");
-			}
-			if (from === to) return x;
-			throw new ExpressionEvalError("convert: unit conversion table not installed");
-		}
-	}
+	/**
+	* Runtime-state slice — the latest occupancy snapshot mirrored by
+	* the analytics frame processor on every inference result. Consumers
+	* read via `device.state.zoneAnalytics.value` and stay in sync
+	* automatically; the explicit `getCurrentSnapshot` cap method is
+	* still useful for one-off polls without a subscription.
+	*/
+	runtimeState: CameraOccupancySnapshotSchema
 };
-Object.freeze(Object.assign(Object.create(null), table));
-/** The set of valid builtin names — used by the parser to reject unknown
-*  callees at parse time (immediate author feedback). */
-var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
 /**
-* Resource-bound constants for the safe expression engine.
+* Stages a {@link ZoneRule} can apply to. Discriminator on the rules
+* cap so a single CRUD surface backs every consumer; each stage has
+* its own dev-state mirror slice (`motion-zone-rules`,
+* `detection-zone-rules`, …) so consumer addons subscribe independently.
 *
-* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
-* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
-* O(nodeCount) by construction. These caps merely put a hard ceiling on the
-* work a single author-supplied expression can request, so a hostile or
-* accidental pathological string can never spend unbounded CPU/memory.
+* Extend the enum here when a new gating consumer comes online (audio
+* gating, alert filtering, …) — no other surface needs to change.
 */
-/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
-*  rejected without allocation. */
-var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
-/** A legal binding / identifier name. */
-var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Binding names an author may NOT use: `now` is auto-injected; the literal
-*  keywords lex as values, not identifiers, so binding to them is meaningless. */
-var RESERVED_BINDING_NAMES = new Set([
-	"now",
-	"true",
-	"false",
-	"null"
+var ZoneRuleStageEnum = z.enum([
+	"motion",
+	"detection",
+	"package"
 ]);
 /**
-* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
-* zero-dependency. The grammar is deliberately boring: decimal numbers,
-* single/double-quoted strings with a tiny escape set, identifiers, the three
-* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
-* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
-* is a parse error with a source position, so member access / assignment /
-* template literals are lexically impossible.
+* Zone rules capability — per-camera CRUD over the {@link ZoneRule}
+* arrays that decide how each pipeline stage uses the polygon zones.
+*
+* Hosted by `addon-pipeline-orchestrator` alongside the zones provider
+* so the operator has a single hub-side source of truth for both
+* geometry and behaviour. Per-stage rules are stored under the
+* `zoneRules.<stage>` key in the orchestrator's per-device store and
+* mirrored to the device-state slice `<stage>-zone-rules` on every
+* mutation; consumer addons (analytics, motion-wasm, pipeline-executor)
+* subscribe to that slice and refresh their gating without
+* round-tripping the cap.
+*
+* Sets are bulk-replace — the operator UI sends the new rule list
+* wholesale, so reordering / batch enable-toggle / drag-drop CRUD lives
+* naturally in the rule editor without per-rule mutation chatter.
 */
-var KEYWORDS = new Set([
-	"true",
-	"false",
-	"null"
-]);
-function isDigit(ch) {
-	return ch >= "0" && ch <= "9";
-}
-function isIdentStart(ch) {
-	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
-}
-function isIdentPart(ch) {
-	return isIdentStart(ch) || isDigit(ch);
-}
-function isWhitespace(ch) {
-	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
-}
-/** Tokenize `source` into a flat token list ending with a single `eof` token.
-*  Throws `ExpressionParseError` on any illegal character or unterminated
-*  string. */
-function tokenize(source) {
-	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
-	const tokens = [];
-	let i = 0;
-	const n = source.length;
-	while (i < n) {
-		const ch = source[i];
-		if (isWhitespace(ch)) {
-			i += 1;
-			continue;
-		}
-		if (isDigit(ch)) {
-			const start = i;
-			while (i < n && isDigit(source[i])) i += 1;
-			if (i < n && source[i] === ".") {
-				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
-				i += 1;
-				while (i < n && isDigit(source[i])) i += 1;
-			}
-			const text = source.slice(start, i);
-			const value = Number(text);
-			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
-			tokens.push({
-				type: "number",
-				value,
-				pos: start
-			});
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			const quote = ch;
-			const start = i;
-			i += 1;
-			let out = "";
-			let closed = false;
-			while (i < n) {
-				const c = source[i];
-				if (c === "\\") {
-					const next = i + 1 < n ? source[i + 1] : "";
-					if (next === "\\" || next === "'" || next === "\"") {
-						out += next;
-						i += 2;
-						continue;
-					}
-					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
-				}
-				if (c === quote) {
-					closed = true;
-					i += 1;
-					break;
-				}
-				out += c;
-				i += 1;
-			}
-			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
-			tokens.push({
-				type: "string",
-				value: out,
-				pos: start
-			});
-			continue;
-		}
-		if (isIdentStart(ch)) {
-			const start = i;
-			while (i < n && isIdentPart(source[i])) i += 1;
-			const text = source.slice(start, i);
-			if (KEYWORDS.has(text)) tokens.push({
-				type: "keyword",
-				keyword: keywordOf(text),
-				pos: start
-			});
-			else tokens.push({
-				type: "identifier",
-				name: text,
-				pos: start
-			});
-			continue;
-		}
-		const two = i + 1 < n ? source.slice(i, i + 2) : "";
-		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
-			tokens.push({
-				type: "punct",
-				punct: two,
-				pos: i
-			});
-			i += 2;
-			continue;
-		}
-		if (isSinglePunct(ch)) {
-			tokens.push({
-				type: "punct",
-				punct: ch,
-				pos: i
-			});
-			i += 1;
-			continue;
-		}
-		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
-	}
-	tokens.push({
-		type: "eof",
-		pos: n
-	});
-	return tokens;
-}
-function keywordOf(text) {
-	if (text === "true") return "true";
-	if (text === "false") return "false";
-	return "null";
-}
-function isSinglePunct(ch) {
-	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
-}
+var zoneRulesCapability = {
+	name: "zone-rules",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: [DeviceType.Camera],
+	methods: {
+		/** Read the full rule list for a given stage (empty when no rules
+		*  are defined yet). */
+		listRules: method(z.object({
+			deviceId: z.number(),
+			stage: ZoneRuleStageEnum
+		}), z.array(ZoneRuleSchema).readonly()),
+		/** Bulk-replace the rule list for one stage. The provider validates
+		*  each entry against {@link ZoneRuleSchema} (zoneIds non-empty,
+		*  thresholds in range) and rejects the whole patch if any entry
+		*  is invalid — partial writes are a configuration footgun. */
+		setRules: method(z.object({
+			deviceId: z.number(),
+			stage: ZoneRuleStageEnum,
+			rules: z.array(ZoneRuleSchema).readonly()
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	/**
+	* Runtime-state slice — every stage mirrored together so consumers
+	* see one reactive handle (`device.state.zoneRules.value`) instead
+	* of one per stage. Bulk-replace mutations on any stage write the full
+	* `{motion, detection, package}` shape, so subscribers always get the
+	* complete current set. Consumers that only care about one stage
+	* just read the matching property.
+	*
+	* `package` backs the package-drop detector — a package zone is a
+	* `ZoneRule` on the `'package'` stage referencing drawn polygons
+	* (see docs/superpowers/specs/2026-07-17-package-zones-design.md §3.1).
+	* The orchestrator provider writes this stage as a first-class slice
+	* (Phase 4): every mutation mirrors the full `{motion, detection,
+	* package}` shape, so consumers read the current package rules directly
+	* off `device.state.zoneRules.value.package`.
+	*/
+	runtimeState: z.object({
+		motion: z.array(ZoneRuleSchema).readonly(),
+		detection: z.array(ZoneRuleSchema).readonly(),
+		package: z.array(ZoneRuleSchema).readonly()
+	})
+};
 /**
-* Pratt (precedence-climbing) parser for the safe expression mini-language.
+* Runtime defaults -- used by ConfigManager.get() for backward compatibility
+* until Plan B wires all runtime settings to the system_settings SQL table.
 *
-* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
-* → relational → additive → multiplicative → unary `! -` → call / primary.
-* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
-* string validated against the builtin table at parse time, so an unknown
-* function is rejected immediately (author feedback) and a persisted expression
-* that references a since-removed builtin degrades at read.
+* Moved from @camstack/system/config-schema to @camstack/types so that
+* @camstack/system can reference it without a cross-package kernel import.
+*/
+var RUNTIME_DEFAULTS = {
+	"features.streaming": true,
+	"features.notifications": true,
+	"features.objectDetection": false,
+	"features.remoteAccess": true,
+	"features.agentCluster": false,
+	"features.smartHome": true,
+	"features.recordings": true,
+	"features.backup": true,
+	"features.repl": true,
+	"retention.detectionEventsDays": 30,
+	"retention.audioLevelsDays": 7,
+	"logging.level": "info",
+	"logging.retentionDays": 30,
+	"eventBus.ringBufferSize": 1e4,
+	"storage.provider": "sqlite-storage",
+	"storage.locations": {
+		data: "camstack-data/data",
+		media: "camstack-data/media",
+		recordings: "camstack-data/recordings",
+		cache: "/tmp/camstack-cache",
+		logs: "camstack-data/logs",
+		models: "camstack-data/models"
+	},
+	providers: [],
+	"ffmpeg.binaryPath": "ffmpeg",
+	"ffmpeg.hwAccel": "auto",
+	"ffmpeg.threadCount": 0,
+	"auth.tokenExpiry": "7d"
+};
+/**
+* Accessory device helpers — shared across drivers.
 *
-* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
-* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+* Many vendor-specific drivers register accessory child devices on
+* top of a parent (Reolink: siren / floodlight / PIR / autotrack /
+* chime; ONVIF: relay outputs; future: Tapo Hub child devices). Each
+* driver picks the right `DeviceType` + `DeviceRole` explicitly when
+* spawning, builds a name derived from the parent, and produces a
+* stableId tied to the parent so boot-restore can reconstruct the
+* relationship.
+*
+* Centralised `(kind → DeviceType)` mapping was dropped on purpose:
+* drivers may reasonably disagree on the right type for an accessory
+* (a Reolink PIR exposes a switch on/off + sensitivity, while a hypothetical
+* read-only motion-only sensor might be `DeviceType.Sensor`). Forcing
+* one canonical mapping was over-prescriptive and added a layer of
+* indirection without saving meaningful code at call sites — the
+* driver knows its own hardware best.
 */
-/** Binary/logical operator precedence (higher binds tighter). */
-var BINARY_PRECEDENCE = {
-	"||": 1,
-	"&&": 2,
-	"==": 3,
-	"!=": 3,
-	"<": 4,
-	"<=": 4,
-	">": 4,
-	">=": 4,
-	"+": 5,
-	"-": 5,
-	"*": 6,
-	"/": 6,
-	"%": 6
+/**
+* Subset of `DeviceRole` values that drivers register as child
+* accessories of a parent device. Sourced verbatim from `DeviceRole`
+* — `AccessoryKind` is the alias drivers use when building accessory
+* children, so the call site reads as
+* `accessoryStableId(parent, AccessoryKind.Siren)` rather than
+* `accessoryStableId(parent, DeviceRole.Siren)` (which would imply
+* any role works, including non-accessory ones like Doorbell).
+*/
+var AccessoryKind = {
+	Siren: DeviceRole.Siren,
+	Floodlight: DeviceRole.Floodlight,
+	Spotlight: DeviceRole.Spotlight,
+	PirSensor: DeviceRole.PirSensor,
+	Chime: DeviceRole.Chime,
+	Autotrack: DeviceRole.Autotrack,
+	Nightvision: DeviceRole.Nightvision,
+	PrivacyMask: DeviceRole.PrivacyMask
 };
-function isLogicalOp(op) {
-	return op === "&&" || op === "||";
-}
-function isBinaryOp(op) {
-	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
-}
-var Parser = class {
-	tokens;
-	pos = 0;
-	nodeCount = 0;
-	identifiers = /* @__PURE__ */ new Set();
-	callees = /* @__PURE__ */ new Set();
-	constructor(tokens) {
-		this.tokens = tokens;
-	}
-	parse() {
-		const ast = this.parseTernary();
-		const tok = this.peek();
-		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
-		return {
-			ast,
-			identifiers: this.identifiers,
-			callees: this.callees,
-			nodeCount: this.nodeCount
-		};
-	}
-	peek() {
-		return this.tokens[this.pos];
-	}
-	next() {
-		return this.tokens[this.pos++];
-	}
-	/** Consume a punctuator token, erroring if the next token isn't it. */
-	expectPunct(punct) {
-		const tok = this.peek();
-		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
-		this.pos += 1;
-	}
-	matchPunct(punct) {
-		const tok = this.peek();
-		if (tok.type === "punct" && tok.punct === punct) {
-			this.pos += 1;
-			return true;
-		}
-		return false;
-	}
-	countNode() {
-		this.nodeCount += 1;
-		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
-	}
-	parseTernary() {
-		const test = this.parseBinary(1);
-		if (this.matchPunct("?")) {
-			const consequent = this.parseTernary();
-			this.expectPunct(":");
-			const alternate = this.parseTernary();
-			this.countNode();
-			return {
-				kind: "conditional",
-				test,
-				consequent,
-				alternate
-			};
-		}
-		return test;
-	}
-	parseBinary(minPrec) {
-		let left = this.parseUnary();
-		for (;;) {
-			const tok = this.peek();
-			if (tok.type !== "punct") break;
-			const prec = BINARY_PRECEDENCE[tok.punct];
-			if (prec === void 0 || prec < minPrec) break;
-			const op = tok.punct;
-			this.pos += 1;
-			const right = this.parseBinary(prec + 1);
-			this.countNode();
-			if (isLogicalOp(op)) left = {
-				kind: "logical",
-				op,
-				left,
-				right
-			};
-			else if (isBinaryOp(op)) left = {
-				kind: "binary",
-				op,
-				left,
-				right
-			};
-			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
-		}
-		return left;
-	}
-	parseUnary() {
-		const tok = this.peek();
-		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
-			const op = tok.punct;
-			this.pos += 1;
-			const operand = this.parseUnary();
-			this.countNode();
-			return {
-				kind: "unary",
-				op,
-				operand
-			};
-		}
-		return this.parsePrimary();
-	}
-	parsePrimary() {
-		const tok = this.next();
-		switch (tok.type) {
-			case "number":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "string":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "keyword":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.keyword === "null" ? null : tok.keyword === "true"
-				};
-			case "identifier": {
-				const nextTok = this.peek();
-				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
-				this.identifiers.add(tok.name);
-				this.countNode();
+AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
+/** Marker written to a declared integration's `info`. */
+var DECLARED_INTEGRATION_FIXED_KEY = "fixed";
+/**
+* Strip the `<node>/<addon>` suffix a forked child carries.
+*
+* Comparing `ctx.kernel.localNodeId` raw skipped EVERY node — including the one
+* that was supposed to act — because on the hub it reads `hub/<addon>`.
+*/
+function declarationOwnerNodeId(localNodeId) {
+	const raw = localNodeId ?? "hub";
+	if (!raw.includes("/")) return raw;
+	return raw.split("/")[0] ?? "hub";
+}
+/**
+* The one way an addon owns a device it declares.
+*
+* Construct once with the addon's ports, then call {@link reconcile} on boot and
+* on every convergence tick. There is no second get-or-create helper — a guard
+* in `scripts/` enforces that.
+*/
+var DeclaredDevices = class {
+	ports;
+	constructor(ports) {
+		const addonId = ports.addonId;
+		if (typeof addonId !== "string" || addonId.length === 0) throw new Error(`DeclaredDevices: addonId must be the declaring addon's id, got ${JSON.stringify(addonId)}. On an addon context it is \`ctx.id\` — there is no \`ctx.addonId\`.`);
+		this.ports = ports;
+	}
+	/**
+	* Converge the declared set. Idempotent, and safe to call repeatedly.
+	*
+	* Throws only what the ports throw on the FIRST index read; every other
+	* failure is per-device and logged, so one bad declaration never takes the
+	* others down.
+	*/
+	async reconcile(spec) {
+		if ((spec.placement ?? "hub") === "hub") {
+			const nodeId = declarationOwnerNodeId(this.ports.localNodeId);
+			if (nodeId !== "hub") {
+				this.ports.logger.info("declared devices are hub-owned — skipping on this node", { meta: {
+					nodeId,
+					rawNodeId: this.ports.localNodeId ?? null
+				} });
 				return {
-					kind: "identifier",
-					name: tok.name
+					integrationId: null,
+					devices: [],
+					removed: [],
+					owned: false
 				};
 			}
-			case "punct":
-				if (tok.punct === "(") {
-					const inner = this.parseTernary();
-					this.expectPunct(")");
-					return inner;
-				}
-				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
-			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
 		}
-	}
-	parseCall(callee, pos) {
-		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
-		this.expectPunct("(");
-		const args = [];
-		if (!this.matchPunct(")")) for (;;) {
-			args.push(this.parseTernary());
-			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
-			if (this.matchPunct(",")) continue;
-			this.expectPunct(")");
-			break;
+		const integrationId = spec.integrationId ?? await this.ensureIntegration(spec.integrationName);
+		const index = await this.readIndex();
+		const outcomes = [];
+		for (const declaration of spec.devices) {
+			const outcome = await this.applyDeclaration(declaration, integrationId, index);
+			if (outcome !== null) outcomes.push(outcome);
 		}
-		this.callees.add(callee);
-		this.countNode();
 		return {
-			kind: "call",
-			callee,
-			args
+			integrationId,
+			devices: outcomes,
+			removed: await this.sweepWithdrawn(spec.devices, integrationId, index),
+			owned: true
 		};
 	}
-};
-/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
-*  `ExpressionParseError` on any lexical or grammatical failure. */
-function parseExpression(source) {
-	return new Parser(tokenize(source)).parse();
-}
-/**
-* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
-* by expr"). The cache stores BOTH successes and failures (negative caching),
-* so a corrupt persisted string costs exactly one tokenize+parse total — not
-* one per read on a hot resolve path.
-*
-* The cache is a module-level singleton: entries are pure, content-addressed
-* ASTs keyed by the raw source string, so sharing one instance across all
-* callers is safe and maximises hit rate.
-*/
-var cache = /* @__PURE__ */ new Map();
-function getCached(source) {
-	const hit = cache.get(source);
-	if (hit !== void 0) {
-		cache.delete(source);
-		cache.set(source, hit);
-		return hit;
+	/**
+	* Get-or-create the FIXED integration, and RE-ASSERT the flag every pass.
+	*
+	* The re-assertion is the fix for the defect the hand-rolled version shipped
+	* with: writing `info.fixed` only on the create path left every pre-existing
+	* install without it, and the kernel kept offering to delete an integration
+	* the addon owns.
+	*/
+	async ensureIntegration(integrationName) {
+		const existing = await this.ports.getIntegration(this.ports.addonId);
+		if (existing === null) {
+			const created = await this.ports.createIntegration({
+				addonId: this.ports.addonId,
+				name: integrationName,
+				info: { [DECLARED_INTEGRATION_FIXED_KEY]: true }
+			});
+			this.ports.logger.info("declared a fixed integration", { meta: {
+				integrationId: created.id,
+				name: integrationName
+			} });
+			return created.id;
+		}
+		if (existing.info?.["fixed"] !== true) {
+			await this.ports.updateIntegration({
+				id: existing.id,
+				info: { [DECLARED_INTEGRATION_FIXED_KEY]: true }
+			});
+			this.ports.logger.info("re-asserted `fixed` on a declared integration", { meta: { integrationId: existing.id } });
+		}
+		return existing.id;
 	}
-	let result;
-	try {
-		result = {
-			ok: true,
-			parsed: parseExpression(source)
-		};
-	} catch (err) {
-		result = {
-			ok: false,
-			error: err instanceof ExpressionParseError ? err.message : String(err)
-		};
+	async readIndex() {
+		const rows = await this.ports.listOwnDevices();
+		return new Map(rows.map((row) => [row.stableId, row]));
 	}
-	cache.set(source, result);
-	if (cache.size > 256) {
-		const oldest = cache.keys().next().value;
-		if (oldest !== void 0) cache.delete(oldest);
+	/**
+	* One declaration: adopt what exists, create what does not.
+	*
+	* The create branch is the destructive one — it seeds `initialMeta`, and
+	* `initialMeta.name` lands as an unconditional `setName`. A transiently empty
+	* index therefore looks exactly like a first boot and would silently re-stamp
+	* the declared name over the operator's rename. D49: that branch needs a
+	* second read to agree.
+	*/
+	async applyDeclaration(declaration, integrationId, index) {
+		try {
+			let existing = index.get(declaration.stableId);
+			if (existing === void 0) {
+				existing = (await this.readIndex()).get(declaration.stableId);
+				if (existing !== void 0) this.ports.logger.warn("device index disagreed with itself — adopting instead of re-creating", {
+					tags: { deviceId: existing.id },
+					meta: {
+						stableId: declaration.stableId,
+						addonId: this.ports.addonId
+					}
+				});
+			}
+			if (existing !== void 0) {
+				const device = await this.ports.devices.create(declaration.stableId, declaration.DeviceClass, {}, null, void 0);
+				this.ports.logger.info("declared device adopted", {
+					tags: { deviceId: device.id },
+					meta: {
+						stableId: declaration.stableId,
+						integrationId
+					}
+				});
+				return {
+					stableId: declaration.stableId,
+					deviceId: device.id,
+					device,
+					created: false
+				};
+			}
+			const device = await this.ports.devices.create(declaration.stableId, declaration.DeviceClass, declaration.config ?? {}, null, {
+				type: declaration.type,
+				name: declaration.name,
+				integrationId,
+				...declaration.role === void 0 ? {} : { role: declaration.role }
+			});
+			this.ports.logger.info("declared device created", {
+				tags: { deviceId: device.id },
+				meta: {
+					stableId: declaration.stableId,
+					integrationId
+				}
+			});
+			return {
+				stableId: declaration.stableId,
+				deviceId: device.id,
+				device,
+				created: true
+			};
+		} catch (err) {
+			this.ports.logger.warn("a declared device could not be brought up", { meta: {
+				stableId: declaration.stableId,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+			return null;
+		}
 	}
-	return result;
+	/**
+	* Remove rows under the addon's FIXED integration whose declaration is gone.
+	*
+	* Bounded to that integration: a declared integration has no operator
+	* add-flow, so every row under it got there by declaration. Devices this
+	* addon owns OUTSIDE it (a provider's adopted devices) are never candidates.
+	*
+	* Bounded in count, and every deletion is logged with its `deviceId` — a
+	* withdrawal that removes an operator-visible row silently is the failure
+	* mode, not the removal itself.
+	*/
+	async sweepWithdrawn(declarations, integrationId, index) {
+		const declared = new Set(declarations.map((d) => d.stableId));
+		const candidates = [...index.values()].filter((row) => row.integrationId === integrationId && !declared.has(row.stableId));
+		if (candidates.length === 0) return [];
+		if (candidates.length > 32) {
+			this.ports.logger.warn("withdrawal sweep exceeded its bound — removing nothing", { meta: {
+				integrationId,
+				candidates: candidates.length,
+				bound: 32
+			} });
+			return [];
+		}
+		const removed = [];
+		for (const row of candidates) try {
+			await this.ports.devices.remove(row.id);
+			removed.push(row.id);
+			this.ports.logger.info("declared device removed — its declaration was withdrawn", {
+				tags: { deviceId: row.id },
+				meta: {
+					stableId: row.stableId,
+					integrationId
+				}
+			});
+		} catch (err) {
+			this.ports.logger.warn("a withdrawn declared device could not be removed", {
+				tags: { deviceId: row.id },
+				meta: {
+					stableId: row.stableId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
+		return removed;
+	}
+};
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
+new Set(Object.values(DeviceType));
+DeviceFeature.BatteryOperated;
+/** Unwrap ZodNullable / ZodOptional / ZodDefault wrappers to reach the inner type.
+*  Zod v4 exposes `.unwrap()` on all three wrapper classes. */
+function unwrap(schema) {
+	let s = schema;
+	while (s instanceof z.ZodNullable || s instanceof z.ZodOptional || s instanceof z.ZodDefault) s = s.unwrap();
+	return s;
 }
-/** Compile `source`, returning a discriminated result instead of throwing.
-*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
-function compileExpressionSafe(source) {
-	return getCached(source);
+function leafKind(schema) {
+	const s = unwrap(schema);
+	if (s instanceof z.ZodEnum) return {
+		kind: "enum",
+		enumValues: s.options
+	};
+	if (s instanceof z.ZodNumber) return { kind: "number" };
+	if (s instanceof z.ZodString) return { kind: "string" };
+	if (s instanceof z.ZodBoolean) return { kind: "boolean" };
+	return null;
 }
-Object.freeze({});
-/**
-* Author-time validation. Returns `null` when the source is valid, else a
-* human-readable error message. Checks: the expression compiles; binding count
-* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
-* is not reserved (`now`/keywords) and does not shadow a builtin; and every
-* FREE identifier of the AST is covered by a binding or the injected `now`.
-*/
-function validateExpressionSource(src) {
-	const names = Object.keys(src.bindings);
-	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
-	for (const name of names) {
-		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
-		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
-		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
-	}
-	const compiled = compileExpressionSafe(src.expr);
-	if (!compiled.ok) return compiled.error;
-	const bound = new Set(names);
-	for (const id of compiled.parsed.identifiers) {
-		if (id === "now") continue;
-		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+/** Walk a cap status schema into flat wireable leaf fields (dotted paths).
+*  Recurses into nested ZodObject (unwrapping nullable/optional/default first),
+*  so fields with null live values are still offered. Arrays / unknown shapes
+*  are skipped — never throws. */
+function enumerateSchemaFields(schema, prefix = "") {
+	const root = unwrap(schema);
+	if (!(root instanceof z.ZodObject)) return [];
+	const out = [];
+	const shape = root.shape;
+	for (const [key, field] of Object.entries(shape)) {
+		const path = prefix ? `${prefix}.${key}` : key;
+		const inner = unwrap(field);
+		if (inner instanceof z.ZodObject) {
+			out.push(...enumerateSchemaFields(inner, path));
+			continue;
+		}
+		const leaf = leafKind(field);
+		if (leaf) out.push({
+			path,
+			kind: leaf.kind,
+			...leaf.enumValues ? { enumValues: leaf.enumValues } : {}
+		});
 	}
-	return null;
+	return out;
+}
+/** Enumerate the per-item wireable fields of an item-array cap (see
+*  `CapabilityStatusItemArray`): the item schema's leaf fields, minus the
+*  `keyField` (the key comes from the link's `itemKey`, never from a wired
+*  source), each tagged `item: true` so the authoring UI collects an
+*  `itemKey` alongside the field. Never throws. */
+function enumerateItemArrayFields(itemArray) {
+	return enumerateSchemaFields(itemArray.itemSchema).filter((f) => f.path !== itemArray.keyField).map((f) => ({
+		...f,
+		item: true
+	}));
 }
-/**
-* What an expression's named bindings READ from.
-*
-* Salvaged verbatim from the deleted device-link mechanism. Wiring's source
-* kinds were the one part of it worth keeping: addressing a device field by
-* re-sync-stable `stableId`, a per-device constant, and a sibling-accessory
-* read are the vocabulary any cross-device derivation needs, and they were
-* already correct. What wiring got wrong was the DESTINATION — a field on
-* somebody else's device, with no identity — not the source.
-*
-* These shapes are therefore kept, re-homed next to the engine that consumes
-* them, and are the binding type of a composition recipe (the source picker
-* stays `deviceManager.getWireableFields`). They deliberately do NOT nest: a
-* binding is a read, never another expression.
-*
-* Schemas are authoritative; every type is `z.infer` of one, so a wire shape and
-* a TypeScript shape cannot drift apart (`scripts/check-schema-type-twins.ts`).
-*/
-/** Read a sibling accessory's status field, addressed by the sibling's key.
-*  `kind` is optional for wire compatibility — absent means `'field'`. */
-var ExpressionFieldBindingSchema = z.object({
-	kind: z.literal("field").optional(),
-	sourceKey: z.string(),
-	cap: z.string(),
-	fieldPath: z.string()
-});
-/** A constant. No device is read. */
-var ExpressionLiteralBindingSchema = z.object({
-	kind: z.literal("literal"),
-	value: z.union([
-		z.string(),
-		z.number(),
-		z.boolean(),
-		z.null()
-	])
-});
-/** Read ANY device's status field, addressed by its re-sync-stable `stableId` —
-*  never by numeric id, which a re-adoption reissues. */
-var ExpressionGlobalBindingSchema = z.object({
-	kind: z.literal("global"),
-	sourceStableId: z.string(),
-	cap: z.string(),
-	fieldPath: z.string()
-});
-var ExpressionBindingSourceSchema = z.union([
-	ExpressionFieldBindingSchema,
-	ExpressionLiteralBindingSchema,
-	ExpressionGlobalBindingSchema
-]);
-z.object({
-	expr: z.string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: z.record(z.string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
-});
 /**
 * Runtime list of cap names with status. Used by the settings
 * aggregator to enumerate caps whose `status` should be polled +
@@ -31035,6 +31496,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"snapshot.getSnapshotLinks": {
+		capName: "snapshot",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"snapshot.getSnapshotOverview": {
 		capName: "snapshot",
 		capScope: "device",
@@ -32477,4 +32944,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { platformProbeCapability as $, deviceStatusCapability as A, nodePin as At, isSameAddonId as B, coreBlockAddonId as C, asString as Ct, decodeVectorBase64 as D, expandCapMethods as Dt, dataStoreProviderCapability as E, emitReadiness as Et, extractNestedAddonId as F, scopeKey as Ft, logDestinationCapability as G, kebabToCamel as H, filesystemBrowseCapability as I, sleep as It, metricsProviderCapability as J, logLevelAtMost as K, isArrayOutputSchema as L, EventCategory as Lt, enumerateInferenceDevices as M, parseJsonUnknown as Mt, enumerateItemArrayFields as N, readinessKey as Nt, deviceManagerCapability as O, hydrateSchema as Ot, enumerateSchemaFields as P, resolveCapMount as Pt, parseStreamParamsFormPatch as Q, isCollectionArrayMethod as R, buildStreamParamsConfigSchema as S, asNumber as St, coreBlocksCapability as T, emitDownForOwnedCaps as Tt, lifecycleJobSchema as U, isVoidInput as V, localNetworkCapability as W, oauthIntegrationCapability as X, normalizeUnit as Y, objectInputDeclaresAddonId as Z, addonWidgetsCapability as _, DeviceType as _t, CAP_NAMES_WITH_STATUS as a, storageProviderCapability as at, backupCapability as b, WELL_KNOWN_TAB_MAP as bt, DeviceStatusSchema as c, vectorDimFromBase64 as ct, STREAM_PROFILE_META as d, BaseAddon as dt, procedureAuthKey as et, ScopedTokenSchema as f, DATAPLANE_SECRET_HEADER as ft, addonSettingsCapability as g, DeviceRole as gt, addonPagesCapability as h, DeviceFeature as ht, BatteryStatusSchema as i, storageCapability as it, doorbellCapability as j, parseJsonObject as jt, deviceStateCapability as k, isDeviceConfigCap as kt, METHOD_ACCESS_MAP as l, vectorStoreCapability as lt, UserRecordSchema as m, DEVICE_STATUS_METHOD as mt, AlertSchema as n, settingsStoreCapability as nt, CORE_BLOCK_ADDON_PREFIX as o, streamQualityLabel as ot, StorageLocationTypeSchema as p, DEVICE_SETTINGS_CONTRIBUTION_METHODS as pt, looseSchema as q, ApiKeyRecordSchema as r, snapshotCapability as rt, CoreBlockSchema as s, userManagementCapability as st, ALL_CAPABILITY_DEFINITIONS as t, scoreRuntimes as tt, RUNTIME_DEFAULTS as u, errMsg as ut, alertsCapability as v, ReadinessRegistry as vt, coreBlockIdFromAddonId as w, createEvent as wt, bareAddonId as x, asJsonObject as xt, authProviderCapability as y, ReadinessTimeoutError as yt, isObjectInput as z };
+export { objectInputDeclaresAddonId as $, deviceManagerCapability as A, hydrateSchema as At, isCollectionArrayMethod as B, bareAddonId as C, asJsonObject as Ct, coreBlocksCapability as D, emitDownForOwnedCaps as Dt, coreBlockIdFromAddonId as E, createEvent as Et, enumerateItemArrayFields as F, readinessKey as Ft, lifecycleJobSchema as G, isSameAddonId as H, enumerateSchemaFields as I, resolveCapMount as It, logLevelAtMost as J, localNetworkCapability as K, extractNestedAddonId as L, scopeKey as Lt, deviceStatusCapability as M, nodePin as Mt, doorbellCapability as N, parseJsonObject as Nt, dataStoreProviderCapability as O, emitReadiness as Ot, enumerateInferenceDevices as P, parseJsonUnknown as Pt, oauthIntegrationCapability as Q, filesystemBrowseCapability as R, sleep as Rt, backupCapability as S, WELL_KNOWN_TAB_MAP as St, coreBlockAddonId as T, asString as Tt, isVoidInput as U, isObjectInput as V, kebabToCamel as W, metricsProviderCapability as X, looseSchema as Y, normalizeUnit as Z, addonPagesCapability as _, DeviceFeature as _t, CAP_NAMES_WITH_STATUS as a, snapshotCapability as at, alertsCapability as b, ReadinessRegistry as bt, CoreBlockSchema as c, streamQualityLabel as ct, METHOD_ACCESS_MAP as d, vectorStoreCapability as dt, parseStreamParamsFormPatch as et, RUNTIME_DEFAULTS as f, errMsg as ft, UserRecordSchema as g, DEVICE_STATUS_METHOD as gt, StorageLocationTypeSchema as h, DEVICE_SETTINGS_CONTRIBUTION_METHODS as ht, BatteryStatusSchema as i, settingsStoreCapability as it, deviceStateCapability as j, isDeviceConfigCap as jt, decodeVectorBase64 as k, expandCapMethods as kt, DeclaredDevices as l, userManagementCapability as lt, ScopedTokenSchema as m, DATAPLANE_SECRET_HEADER as mt, AlertSchema as n, procedureAuthKey as nt, CORE_BLOCKS_ADDON_ID as o, storageCapability as ot, STREAM_PROFILE_META as p, BaseAddon as pt, logDestinationCapability as q, ApiKeyRecordSchema as r, scoreRuntimes as rt, CORE_BLOCK_ADDON_PREFIX as s, storageProviderCapability as st, ALL_CAPABILITY_DEFINITIONS as t, platformProbeCapability as tt, DeviceStatusSchema as u, vectorDimFromBase64 as ut, addonSettingsCapability as v, DeviceRole as vt, buildStreamParamsConfigSchema as w, asNumber as wt, authProviderCapability as x, ReadinessTimeoutError as xt, addonWidgetsCapability as y, DeviceType as yt, isArrayOutputSchema as z, EventCategory as zt };