@camstack/types 1.2.45 → 1.2.47

package/dist/device/declared-device.d.ts

@@ -0,0 +1,197 @@
+/**
+ * Declared devices — the ownership primitive for a device an addon DECLARES
+ * rather than discovers.
+ *
+ * A provider adopts what a vendor reports. A *declaration* is the other shape:
+ * a device exists because an addon says so, in code, on every boot. The NC
+ * alarm panel is the live instance of it (device 1023) and, until this module,
+ * the only one — hand-rolled inline with eight injected dependencies.
+ *
+ * What this owns, and why each part is here rather than at the call site:
+ *
+ * - **Idempotence.** `reconcile` is `get-or-create` on `(addonId, stableId)`
+ *   and is safe to run on every boot and on every convergence tick. Nothing
+ *   here is one-shot.
+ * - **Reconcile, not one-shot (D49).** The destructive branch — "the index does
+ *   not list it, so CREATE it with its declared meta" — re-stamps the declared
+ *   name over an operator's rename. It therefore requires a SECOND read of the
+ *   index to agree before it runs. A read that fails changes nothing at all:
+ *   the pass aborts, and the next one converges.
+ * - **The name follows the authority.** A declared device's name is seeded ONCE,
+ *   at create. Every later pass adopts without meta, because a rename belongs to
+ *   the operator and re-stamping it every boot is the losing half of two writers
+ *   (D62).
+ * - **`fixed` is re-asserted every pass.** The defect the hand-rolled version
+ *   shipped with wrote `info.fixed` only on the create path, so an install that
+ *   already had the integration never received the flag — the kernel kept
+ *   allowing its deletion. Get-or-create is not enough for a flag; it has to be
+ *   re-asserted.
+ * - **Withdrawal is cleanup.** A declaration removed from the code removes its
+ *   device, bounded to the addon's own FIXED integration and logged per device.
+ *   Nothing outside that integration is ever touched.
+ * - **One owner node.** An addon that runs on every node must not race to own a
+ *   cluster singleton. The default placement is `'hub'`.
+ *
+ * What this deliberately does NOT own: writing a declared device's STATE. The
+ * authority for a cap slice is already `deviceState.setCapSlice` (via
+ * `BaseDevice.runtimeState` / `ctx.fetchDevice(id)`). A third alias for it would
+ * be a second writer of a value that already has one.
+ */
+import type { IScopedLogger } from '../interfaces/logging.js';
+import type { IDevice } from './device.js';
+import type { DeviceConstructor, DeviceManagerApi } from './device-context.js';
+import type { DeviceType } from './device-type.js';
+/** Marker written to a declared integration's `info`. */
+export declare const DECLARED_INTEGRATION_FIXED_KEY = "fixed";
+/** One row of the addon's own device index, as `deviceManager.listAll` reports it. */
+export interface DeclaredDeviceRow {
+    readonly id: number;
+    readonly stableId: string;
+    readonly integrationId?: string | null;
+}
+/** An integration as the integrations store reports it. */
+export interface DeclaredIntegrationRow {
+    readonly id: string;
+    readonly info?: Record<string, unknown> | null;
+}
+/**
+ * The narrow surface `DeclaredDevices` drives.
+ *
+ * Ports rather than a whole `AddonContext` for one reason that has cost this
+ * repo twice: a fake of the whole context supplies values production forgets to
+ * fetch. Five named operations can be faked without inventing behaviour.
+ */
+export interface DeclaredDevicePorts {
+    readonly logger: IScopedLogger;
+    /** The declaring addon's id — the owner half of `(addonId, stableId)`. */
+    readonly addonId: string;
+    /** `ctx.kernel.devices`. */
+    readonly devices: DeviceManagerApi;
+    /** `ctx.kernel.localNodeId`. A forked child reads `<node>/<addon>`. */
+    readonly localNodeId?: string | undefined;
+    /** `integrations.getByAddonId` — null when this addon has none yet. */
+    readonly getIntegration: (addonId: string) => Promise<DeclaredIntegrationRow | null>;
+    readonly createIntegration: (input: {
+        addonId: string;
+        name: string;
+        info: Record<string, unknown>;
+    }) => Promise<{
+        readonly id: string;
+    }>;
+    /** Merge `info` onto an EXISTING integration. Used to re-assert `fixed`. */
+    readonly updateIntegration: (input: {
+        id: string;
+        info: Record<string, unknown>;
+    }) => Promise<void>;
+    /**
+     * Every device row this addon owns.
+     *
+     * FALLIBLE on purpose: this is the read the D49 discipline applies to. It may
+     * throw, and it may transiently answer `[]` while the registry is cold — which
+     * is indistinguishable from "the operator deleted everything".
+     */
+    readonly listOwnDevices: () => Promise<readonly DeclaredDeviceRow[]>;
+}
+/** One device an addon declares. */
+export interface DeviceDeclaration<T extends IDevice = IDevice> {
+    /** Stable within the addon, never derived from the name — a rename must not
+     *  mint a second device. */
+    readonly stableId: string;
+    /** Seeded ONCE, at create. Never re-stamped (D62). */
+    readonly name: string;
+    readonly type: DeviceType;
+    readonly DeviceClass: DeviceConstructor<T>;
+    /** Initial config blob, written before the constructor runs. Create only. */
+    readonly config?: Record<string, unknown>;
+    /** Optional semantic role, stamped at create alongside the type. */
+    readonly role?: string;
+}
+/** Where the declaration is owned. */
+export type DeclarationPlacement = 'hub' | 'this-node';
+export interface DeclaredDevicesSpec {
+    /** Display name of the FIXED integration the devices hang from. */
+    readonly integrationName: string;
+    readonly devices: readonly DeviceDeclaration[];
+    /**
+     * Default `'hub'`: a declaration is cluster state and belongs to the node
+     * that is always there. `'this-node'` is for a declaration that is genuinely
+     * per-node.
+     */
+    readonly placement?: DeclarationPlacement;
+}
+export interface DeclaredDeviceOutcome {
+    readonly stableId: string;
+    readonly deviceId: number;
+    readonly device: IDevice;
+    /** True only on the boot that created it — the operator sees one line, once. */
+    readonly created: boolean;
+}
+export interface DeclaredDevicesResult {
+    /** Null when this node does not own the declaration (see `placement`). */
+    readonly integrationId: string | null;
+    readonly devices: readonly DeclaredDeviceOutcome[];
+    /** Device ids removed because their declaration was withdrawn. */
+    readonly removed: readonly number[];
+    /** False when the placement gate skipped this node entirely. */
+    readonly owned: boolean;
+}
+/**
+ * Strip the `<node>/<addon>` suffix a forked child carries.
+ *
+ * Comparing `ctx.kernel.localNodeId` raw skipped EVERY node — including the one
+ * that was supposed to act — because on the hub it reads `hub/<addon>`.
+ */
+export declare function declarationOwnerNodeId(localNodeId: string | undefined): string;
+/** Cap on how many rows one withdrawal pass may delete. */
+export declare const DECLARED_DEVICE_SWEEP_LIMIT = 32;
+/**
+ * The one way an addon owns a device it declares.
+ *
+ * Construct once with the addon's ports, then call {@link reconcile} on boot and
+ * on every convergence tick. There is no second get-or-create helper — a guard
+ * in `scripts/` enforces that.
+ */
+export declare class DeclaredDevices {
+    private readonly ports;
+    constructor(ports: DeclaredDevicePorts);
+    /**
+     * Converge the declared set. Idempotent, and safe to call repeatedly.
+     *
+     * Throws only what the ports throw on the FIRST index read; every other
+     * failure is per-device and logged, so one bad declaration never takes the
+     * others down.
+     */
+    reconcile(spec: DeclaredDevicesSpec): Promise<DeclaredDevicesResult>;
+    /**
+     * Get-or-create the FIXED integration, and RE-ASSERT the flag every pass.
+     *
+     * The re-assertion is the fix for the defect the hand-rolled version shipped
+     * with: writing `info.fixed` only on the create path left every pre-existing
+     * install without it, and the kernel kept offering to delete an integration
+     * the addon owns.
+     */
+    private ensureIntegration;
+    private readIndex;
+    /**
+     * One declaration: adopt what exists, create what does not.
+     *
+     * The create branch is the destructive one — it seeds `initialMeta`, and
+     * `initialMeta.name` lands as an unconditional `setName`. A transiently empty
+     * index therefore looks exactly like a first boot and would silently re-stamp
+     * the declared name over the operator's rename. D49: that branch needs a
+     * second read to agree.
+     */
+    private applyDeclaration;
+    /**
+     * Remove rows under the addon's FIXED integration whose declaration is gone.
+     *
+     * Bounded to that integration: a declared integration has no operator
+     * add-flow, so every row under it got there by declaration. Devices this
+     * addon owns OUTSIDE it (a provider's adopted devices) are never candidates.
+     *
+     * Bounded in count, and every deletion is logged with its `deviceId` — a
+     * withdrawal that removes an operator-visible row silently is the failure
+     * mode, not the removal itself.
+     */
+    private sweepWithdrawn;
+}

package/dist/device/device-binding.d.ts

@@ -6,19 +6,25 @@
  */
 export interface DeviceBindingEntry {
     capName: string;
-    /** `native`/`wrapped` = a real provider serves the cap. `linked` = the cap
-     *  is SYNTHESIZED from device-links (no provider — the getStatus dispatcher
-     *  routes to device-manager's resolveLinkedStatus). UI metadata only —
-     *  consumers must never branch on it for routing (D13). */
-    kind: 'native' | 'wrapped' | 'linked';
+    /**
+     * Which shape of provider serves the cap. UI metadata only — consumers must
+     * never branch on it for routing (D13); resolve a `(cap, device)` pair
+     * through `getProviderForDevice`.
+     *
+     * There were three. `linked` denoted a cap SYNTHESIZED from device-links with
+     * no provider at all, and it existed so a link-only cap would still render a
+     * panel — a fifth binding kind and a virtual-binding path the kernel paid for
+     * one feature. Wiring was deleted on 2026-08-08 (0 links across 302 devices)
+     * and the kind went with it: a composed device's caps are native to it, so
+     * nothing needs to be synthesized out of nowhere.
+     */
+    kind: 'native' | 'wrapped';
     /** Currently-active provider. For kind='native', equal to `nativeAddonId`.
-     *  For kind='wrapped', the wrapper addon id. For kind='linked', the
-     *  device-manager addon id (the synthesize owner). */
+     *  For kind='wrapped', the wrapper addon id. */
     providerAddonId: string;
     /** Node where the active provider runs. 'hub' for native; may vary for wrappers. */
     providerNodeId: string;
-    /** Always the addon id of the underlying native provider for the device.
-     *  Empty for kind='linked' (no native exists). */
+    /** Always the addon id of the underlying native provider for the device. */
     nativeAddonId: string;
 }
 export interface DeviceBinding {

package/dist/device/device-management.d.ts

@@ -95,82 +95,6 @@ export interface ChildLayoutEntry {
     readonly collapsed?: boolean;
 }
 export type ChildLayout = readonly ChildLayoutEntry[];
-/** Field source: copy one field of a sibling accessory's cap status.
- *  Addressed by the source's re-sync-stable accessory `stableIdSuffix`
- *  (`sourceKey`) — NOT a raw numeric id — so the link survives a re-sync. The
- *  source must be a sibling accessory under the SAME parent container as the
- *  target device; resolution is `${parentStableId}-${sourceKey}`. For a source
- *  anywhere else in the cluster use `DeviceLinkGlobalSource`. */
-export interface DeviceLinkFieldSource {
-    readonly kind?: 'field';
-    readonly sourceKey: string;
-    readonly cap: string;
-    readonly fieldPath: string;
-}
-/** Literal source: a per-device constant (e.g. `battery.binary = true`,
- *  a consumable item's `label`/`resettable`). No sibling is read. */
-export interface DeviceLinkLiteralSource {
-    readonly kind: 'literal';
-    readonly value: string | number | boolean | null;
-}
-/** Global source (P2e): copy one field of ANY device's cap status, regardless
- *  of parent container. Addressed by the source device's FULL `stableId` —
- *  chosen over the numeric id because a re-sync (`resetToSource`) REALLOCATES
- *  numeric ids while stableIds are deterministic from the provider (the same
- *  property the sibling `sourceKey` mechanism relies on). stableId uniqueness
- *  is formally per-addon; the resolver matches the first meta row with that
- *  stableId (effective global uniqueness — an `addonId` disambiguator can be
- *  added later without a wire break). */
-export interface DeviceLinkGlobalSource {
-    readonly kind: 'global';
-    readonly sourceStableId: string;
-    readonly cap: string;
-    readonly fieldPath: string;
-}
-/** The source kinds a single expression BINDING may use — a sibling FIELD, a
- *  per-device LITERAL, or a GLOBAL device field. Never another expression:
- *  bindings do not nest, so an expression cannot reference another expression. */
-export type DeviceLinkExpressionBinding = DeviceLinkFieldSource | DeviceLinkLiteralSource | DeviceLinkGlobalSource;
-/** Expression source (Stage X): compute the target field from N named source
- *  bindings via a safe, non-Turing-complete infix expression (see
- *  `packages/types/src/expression/`). Each binding resolves to an
- *  `ExpressionValue` and is exposed to the expression under its record key.
- *  `now` (epoch ms) is auto-injected and is a reserved binding name. The
- *  evaluated result flows through `transform` exactly like a scalar source. */
-export interface DeviceLinkExpressionSource {
-    readonly kind: 'expression';
-    readonly expr: string;
-    readonly bindings: Readonly<Record<string, DeviceLinkExpressionBinding>>;
-}
-export type DeviceLinkSource = DeviceLinkFieldSource | DeviceLinkLiteralSource | DeviceLinkGlobalSource | DeviceLinkExpressionSource;
-/** The target field a link writes: a dot-path into the target cap's status. */
-export interface DeviceLinkTarget {
-    readonly cap: string;
-    readonly fieldPath: string;
-    /** Optional grouping key for array-of-items target caps (consumables); P2. */
-    readonly itemKey?: string;
-}
-/** Optional value transform applied to the resolved source value. */
-export type DeviceLinkTransform = {
-    readonly kind: 'identity';
-} | {
-    readonly kind: 'enum-map';
-    readonly mapping: Record<string, string | number | boolean>;
-    readonly fallback?: string | number | boolean;
-} | {
-    readonly kind: 'linear';
-    readonly scale: number;
-    readonly offset: number;
-    readonly clamp?: readonly [number, number];
-};
-/** One operator-authored cross-device field wiring, persisted on the TARGET. */
-export interface DeviceLink {
-    readonly id: string;
-    readonly source: DeviceLinkSource;
-    readonly target: DeviceLinkTarget;
-    readonly transform?: DeviceLinkTransform;
-}
-export type DeviceLinks = readonly DeviceLink[];
 /** Per-cap display refinement inside a `DeviceDisplayOverride` — unit/precision
  *  only (icon/label/hidden are device-level). Keyed by cap name for devices
  *  carrying several numeric caps (e.g. power-meter). */
@@ -254,12 +178,8 @@ export interface DeviceMeta {
      *  same lifecycle as `primaryChildEntityId`. Absent ⇒ no layout declared (all
      *  children render in the plain Overview list). */
     readonly childLayout?: ChildLayout;
-    /** Operator-authored cross-device field wirings (source field → this device's
-     *  cap field). Same create/persist/project/restore lifecycle as `childLayout`.
-     *  Absent ⇒ no links. Overlaid onto the target cap's `getStatus` at read time. */
-    readonly deviceLinks?: DeviceLinks;
     /** Operator-authored per-device display override (icon/label/unit/precision/
-     *  hidden). Same create/persist/project/restore lifecycle as `deviceLinks`.
+     *  hidden). Same create/persist/project/restore lifecycle as `childLayout`.
      *  Absent ⇒ no override; the renderer falls back to role default → live slice
      *  → canonical unit. Applied at RENDER time only — storage stays in source
      *  units. */
@@ -292,8 +212,6 @@ export interface InitialDeviceMeta {
      *  across re-register/restore. Optional: only set for CONTAINER devices that
      *  declare a layout. */
     readonly childLayout?: ChildLayout;
-    /** Cross-device field wirings set at create. Mirrors `DeviceMeta.deviceLinks`. */
-    readonly deviceLinks?: DeviceLinks;
     /** Per-device display override set at create. Mirrors `DeviceMeta.display`. */
     readonly display?: DeviceDisplayOverride;
 }

package/dist/device/index.d.ts

@@ -1,25 +1,26 @@
-export { DeviceType, DeviceFeature, ChargingStatus, DeviceRole } from './device-type.js';
-export { AccessoryKind, ACCESSORY_LABEL, accessoryStableId, type AccessoryKindValue, } from './accessory.js';
-export type { IBatteryOperated, IRebootable, INativeSnapshot, IDoorbellButton, ITwoWayAudio, IPanTiltZoom, } from './features.js';
-export { DeviceConfig } from './device-config.js';
-export type { DeviceContext, DeviceManagerApi, DeviceConstructor, IDeviceRegistryReader, IDeviceRegistry, } from './device-context.js';
-export { BaseDevice } from './base-device.js';
+export { ACCESSORY_LABEL, AccessoryKind, type AccessoryKindValue, accessoryStableId, } from './accessory.js';
 export type { AccessoryChildSpec } from './base-device.js';
+export { BaseDevice } from './base-device.js';
+export type { DeviceSummary, DiscoveryCandidate, FieldProbeResult, ProviderStatus, } from './base-device-provider.js';
 export { BaseDeviceProvider, toDeviceSummary } from './base-device-provider.js';
-export type { DiscoveryCandidate, DeviceSummary, ProviderStatus, FieldProbeResult, } from './base-device-provider.js';
-export type { IDevice } from './device.js';
-export { DEVICE_PROFILES, BATTERY_DEVICE_PROFILE, deviceMatchesProfile, resolveDeviceProfile, } from './device-profile.js';
-export type { DeviceProfile, DeviceProfileMatch, DeviceProfileDefaults, PipelinePhaseMode, } from './device-profile.js';
 export type { ICameraDevice, StreamSourceEntry } from './camera-device.js';
-export type { DeviceManualCreation, DeviceDiscovery, DiscoveredDevice, SavedDevice, DeviceMeta, InitialDeviceMeta, CreateDeviceSpec, ChildLayout, ChildLayoutEntry, DeviceLinkFieldSource, DeviceLinkLiteralSource, DeviceLinkGlobalSource, DeviceLinkExpressionBinding, DeviceLinkExpressionSource, DeviceLinkSource, DeviceLinkTarget, DeviceLinkTransform, DeviceLink, DeviceLinks, } from './device-management.js';
-export { zodEntriesToConfigUI } from './zod-to-config-ui.js';
-export type { DeviceConfigEntry } from './zod-to-config-ui.js';
-export { createRuntimeStateBridge } from './runtime-state-helpers.js';
-export type { RuntimeStateBridge } from './runtime-state-helpers.js';
+export type { DeclarationPlacement, DeclaredDeviceOutcome, DeclaredDevicePorts, DeclaredDeviceRow, DeclaredDevicesResult, DeclaredDevicesSpec, DeclaredIntegrationRow, DeviceDeclaration, } from './declared-device.js';
+export { DECLARED_DEVICE_SWEEP_LIMIT, DECLARED_INTEGRATION_FIXED_KEY, DeclaredDevices, declarationOwnerNodeId, } from './declared-device.js';
+export type { IDevice } from './device.js';
+export { DeviceConfig } from './device-config.js';
+export type { DeviceConstructor, DeviceContext, DeviceManagerApi, IDeviceRegistry, IDeviceRegistryReader, } from './device-context.js';
+export type { ChildLayout, ChildLayoutEntry, CreateDeviceSpec, DeviceDiscovery, DeviceManualCreation, DeviceMeta, DiscoveredDevice, InitialDeviceMeta, SavedDevice, } from './device-management.js';
+export type { DeviceProfile, DeviceProfileDefaults, DeviceProfileMatch, PipelinePhaseMode, } from './device-profile.js';
+export { BATTERY_DEVICE_PROFILE, DEVICE_PROFILES, deviceMatchesProfile, resolveDeviceProfile, } from './device-profile.js';
 export type { IDeviceRuntimeState, Snapshot as RuntimeStateSnapshot, } from './device-runtime-state.js';
+export { ChargingStatus, DeviceFeature, DeviceRole, DeviceType } from './device-type.js';
+export type { IBatteryOperated, IDoorbellButton, INativeSnapshot, IPanTiltZoom, IRebootable, ITwoWayAudio, } from './features.js';
 export { getByPath, setByPath } from './path-util.js';
-export { applyTransform } from './device-link-transform.js';
-export { enumerateItemArrayFields, enumerateSchemaFields } from './schema-fields.js';
+export type { ReachabilityPollHandle, ReachabilityPollLogger, ReachabilityPollOptions, } from './reachability-poll.js';
+export { REACHABILITY_FAILURES_TO_OFFLINE, REACHABILITY_POLL_INTERVAL_MS, REACHABILITY_PROBE_TIMEOUT_MS, startReachabilityPoll, } from './reachability-poll.js';
+export type { RuntimeStateBridge } from './runtime-state-helpers.js';
+export { createRuntimeStateBridge } from './runtime-state-helpers.js';
 export type { WireableField } from './schema-fields.js';
-export { startReachabilityPoll, REACHABILITY_POLL_INTERVAL_MS, REACHABILITY_FAILURES_TO_OFFLINE, REACHABILITY_PROBE_TIMEOUT_MS, } from './reachability-poll.js';
-export type { ReachabilityPollOptions, ReachabilityPollHandle, ReachabilityPollLogger, } from './reachability-poll.js';
+export { enumerateItemArrayFields, enumerateSchemaFields } from './schema-fields.js';
+export type { DeviceConfigEntry } from './zod-to-config-ui.js';
+export { zodEntriesToConfigUI } from './zod-to-config-ui.js';

package/dist/expression/binding-source.d.ts

@@ -0,0 +1,85 @@
+/**
+ * What an expression's named bindings READ from.
+ *
+ * Salvaged verbatim from the deleted device-link mechanism. Wiring's source
+ * kinds were the one part of it worth keeping: addressing a device field by
+ * re-sync-stable `stableId`, a per-device constant, and a sibling-accessory
+ * read are the vocabulary any cross-device derivation needs, and they were
+ * already correct. What wiring got wrong was the DESTINATION — a field on
+ * somebody else's device, with no identity — not the source.
+ *
+ * These shapes are therefore kept, re-homed next to the engine that consumes
+ * them, and are the binding type of a composition recipe (the source picker
+ * stays `deviceManager.getWireableFields`). They deliberately do NOT nest: a
+ * binding is a read, never another expression.
+ *
+ * Schemas are authoritative; every type is `z.infer` of one, so a wire shape and
+ * a TypeScript shape cannot drift apart (`scripts/check-schema-type-twins.ts`).
+ */
+import { z } from 'zod';
+/** Read a sibling accessory's status field, addressed by the sibling's key.
+ *  `kind` is optional for wire compatibility — absent means `'field'`. */
+export declare const ExpressionFieldBindingSchema: z.ZodObject<{
+    kind: z.ZodOptional<z.ZodLiteral<"field">>;
+    sourceKey: z.ZodString;
+    cap: z.ZodString;
+    fieldPath: z.ZodString;
+}, z.core.$strip>;
+/** A constant. No device is read. */
+export declare const ExpressionLiteralBindingSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"literal">;
+    value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>;
+}, z.core.$strip>;
+/** Read ANY device's status field, addressed by its re-sync-stable `stableId` —
+ *  never by numeric id, which a re-adoption reissues. */
+export declare const ExpressionGlobalBindingSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"global">;
+    sourceStableId: z.ZodString;
+    cap: z.ZodString;
+    fieldPath: z.ZodString;
+}, z.core.$strip>;
+export declare const ExpressionBindingSourceSchema: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodOptional<z.ZodLiteral<"field">>;
+    sourceKey: z.ZodString;
+    cap: z.ZodString;
+    fieldPath: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"literal">;
+    value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"global">;
+    sourceStableId: z.ZodString;
+    cap: z.ZodString;
+    fieldPath: z.ZodString;
+}, z.core.$strip>]>;
+/**
+ * An expression plus the bindings its free identifiers resolve against.
+ *
+ * The `superRefine` runs the SAME author-time validation as
+ * `validateExpressionSource` — compiles the expression, checks binding names,
+ * checks identifier coverage — so every boundary that parses one
+ * validates-at-write rather than discovering the problem at read time.
+ * Compiles are LRU-cached, so repeated validation of the same string is a hit.
+ */
+export declare const ExpressionSourceSchema: z.ZodObject<{
+    expr: z.ZodString;
+    bindings: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+        kind: z.ZodOptional<z.ZodLiteral<"field">>;
+        sourceKey: z.ZodString;
+        cap: z.ZodString;
+        fieldPath: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"literal">;
+        value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"global">;
+        sourceStableId: z.ZodString;
+        cap: z.ZodString;
+        fieldPath: z.ZodString;
+    }, z.core.$strip>]>>;
+}, z.core.$strip>;
+export type ExpressionFieldBinding = z.infer<typeof ExpressionFieldBindingSchema>;
+export type ExpressionLiteralBinding = z.infer<typeof ExpressionLiteralBindingSchema>;
+export type ExpressionGlobalBinding = z.infer<typeof ExpressionGlobalBindingSchema>;
+export type ExpressionBindingSource = z.infer<typeof ExpressionBindingSourceSchema>;
+export type ExpressionSource = z.infer<typeof ExpressionSourceSchema>;

package/dist/expression/{link-expression.d.ts → expression-source.d.ts}

@@ -1,5 +1,15 @@
-import { type ExpressionEvalOptions } from './evaluator.js';
+/**
+ * Expression-source helpers — the single seam every consumer of the engine
+ * shares, so author-time validation and read-time evaluation cannot drift.
+ *
+ * These were written for the `expression` device-link source and outlived it:
+ * wiring was deleted on 2026-08-08 with zero live users, and the engine was
+ * kept on purpose. It is the derivation language of a composed device and the
+ * escape-hatch leaf of an automation's condition tree — one language, three
+ * positions (derive a value, gate a trigger, compute an argument).
+ */
 import type { ExpressionValue } from './ast.js';
+import { type ExpressionEvalOptions } from './evaluator.js';
 /** The `now` epoch-ms binding is auto-injected into every evaluation and is a
  *  reserved binding name (authors may not rebind it). */
 export declare const EXPRESSION_INJECTED_NOW = "now";
@@ -10,8 +20,8 @@ export declare const EXPRESSION_INJECTED_NOW = "now";
  * its binding-miss policy (→ `null`). `null` itself is a valid value.
  */
 export declare function toExpressionValue(raw: unknown): ExpressionValue | undefined;
-/** Shape the author-time validator accepts (structural subset of a
- *  `DeviceLinkExpressionSource`). */
+/** Shape the author-time validator accepts (structural subset of an
+ *  {@link ExpressionSource}). */
 export interface ExpressionSourceInput {
     readonly expr: string;
     readonly bindings: Readonly<Record<string, unknown>>;
@@ -24,10 +34,9 @@ export interface ExpressionSourceInput {
  * FREE identifier of the AST is covered by a binding or the injected `now`.
  */
 export declare function validateExpressionSource(src: ExpressionSourceInput): string | null;
-/** Result of a link-expression evaluation — `ok` carries the value, the error
- *  branch carries a reason the async channel can log while the sync channel
- *  silently skips. */
-export type EvaluateLinkExpressionResult = {
+/** Result of an expression evaluation — `ok` carries the value, the error
+ *  branch carries a reason the caller can log while it skips the derivation. */
+export type EvaluateExpressionSourceResult = {
     readonly ok: true;
     readonly value: ExpressionValue;
 } | {
@@ -35,10 +44,10 @@ export type EvaluateLinkExpressionResult = {
     readonly error: string;
 };
 /**
- * Shared read-path evaluation for BOTH resolver channels. Builds a null-proto
- * scope from `bindingValues` plus the injected `now` (supplied by the caller
- * for determinism/testability), compiles via the LRU, and evaluates. Any
- * failure (parse or eval) returns `{ ok: false }` — the caller treats that as
- * "skip this link".
+ * Shared read-path evaluation. Builds a null-proto scope from `bindingValues`
+ * plus the injected `now` (supplied by the caller for determinism and
+ * testability), compiles via the LRU, and evaluates. Any failure (parse or
+ * eval) returns `{ ok: false }` — the caller treats that as "skip this
+ * derivation", never as a throw that takes the pass down.
  */
-export declare function evaluateLinkExpression(expr: string, bindingValues: Readonly<Record<string, ExpressionValue>>, now: number, opts?: ExpressionEvalOptions): EvaluateLinkExpressionResult;
+export declare function evaluateExpressionSource(expr: string, bindingValues: Readonly<Record<string, ExpressionValue>>, now: number, opts?: ExpressionEvalOptions): EvaluateExpressionSourceResult;

package/dist/expression/index.d.ts

@@ -2,24 +2,27 @@
  * Safe expression engine — public surface. A non-Turing-complete infix
  * mini-language (tokenizer → Pratt parser → whitelisted-AST interpreter) with
  * NO eval / new Function / node:vm, NO member access, NO loops/lambdas, and
- * hard resource bounds. Powers the `expression` DeviceLinkSource kind.
+ * hard resource bounds. It is the derivation language of a composed device and
+ * the escape-hatch leaf of an automation's condition tree.
  *
  * This is the module barrel; leaf files inside @camstack/types MUST import from
  * the deep modules (e.g. `../expression/compile.js`), never through this file
  * OR the root barrel (see biome-plugins/no-types-barrel-leaf-import.grit).
  */
-export type { ExpressionValue, ExpressionNode, ExpressionLiteralNode, ExpressionIdentifierNode, ExpressionUnaryNode, ExpressionBinaryNode, ExpressionLogicalNode, ExpressionConditionalNode, ExpressionCallNode, ExpressionBinaryOperator, ExpressionLogicalOperator, ExpressionUnaryOperator, } from './ast.js';
-export { ExpressionParseError, ExpressionEvalError } from './errors.js';
-export { MAX_EXPRESSION_SOURCE_LENGTH, MAX_EXPRESSION_AST_NODES, MAX_EXPRESSION_EVAL_STEPS, MAX_EXPRESSION_BINDINGS, MAX_EXPRESSION_CALL_ARGS, EXPRESSION_COMPILE_CACHE_CAPACITY, EXPRESSION_IDENTIFIER_RE, RESERVED_BINDING_NAMES, } from './limits.js';
-export { tokenize } from './tokenizer.js';
-export type { Token, Punctuator, Keyword } from './tokenizer.js';
-export { parseExpression } from './parser.js';
-export type { ParsedExpression } from './parser.js';
-export { EXPRESSION_BUILTINS, EXPRESSION_BUILTIN_NAMES, } from './builtins.js';
+export type { ExpressionBinaryNode, ExpressionBinaryOperator, ExpressionCallNode, ExpressionConditionalNode, ExpressionIdentifierNode, ExpressionLiteralNode, ExpressionLogicalNode, ExpressionLogicalOperator, ExpressionNode, ExpressionUnaryNode, ExpressionUnaryOperator, ExpressionValue, } from './ast.js';
+export type { ExpressionBindingSource, ExpressionFieldBinding, ExpressionGlobalBinding, ExpressionLiteralBinding, ExpressionSource, } from './binding-source.js';
+export { ExpressionBindingSourceSchema, ExpressionFieldBindingSchema, ExpressionGlobalBindingSchema, ExpressionLiteralBindingSchema, ExpressionSourceSchema, } from './binding-source.js';
 export type { ExpressionBuiltin, ExpressionEvalHooks } from './builtins.js';
-export { createExpressionScope, evaluateAst } from './evaluator.js';
-export type { ExpressionEvalOptions } from './evaluator.js';
-export { compileExpression, compileExpressionSafe } from './compile.js';
+export { EXPRESSION_BUILTIN_NAMES, EXPRESSION_BUILTINS, } from './builtins.js';
 export type { CompileResult } from './compile.js';
-export { EXPRESSION_INJECTED_NOW, toExpressionValue, validateExpressionSource, evaluateLinkExpression, } from './link-expression.js';
-export type { ExpressionSourceInput, EvaluateLinkExpressionResult, } from './link-expression.js';
+export { compileExpression, compileExpressionSafe } from './compile.js';
+export { ExpressionEvalError, ExpressionParseError } from './errors.js';
+export type { ExpressionEvalOptions } from './evaluator.js';
+export { createExpressionScope, evaluateAst } from './evaluator.js';
+export type { EvaluateExpressionSourceResult, ExpressionSourceInput, } from './expression-source.js';
+export { EXPRESSION_INJECTED_NOW, evaluateExpressionSource, toExpressionValue, validateExpressionSource, } from './expression-source.js';
+export { EXPRESSION_COMPILE_CACHE_CAPACITY, EXPRESSION_IDENTIFIER_RE, MAX_EXPRESSION_AST_NODES, MAX_EXPRESSION_BINDINGS, MAX_EXPRESSION_CALL_ARGS, MAX_EXPRESSION_EVAL_STEPS, MAX_EXPRESSION_SOURCE_LENGTH, RESERVED_BINDING_NAMES, } from './limits.js';
+export type { ParsedExpression } from './parser.js';
+export { parseExpression } from './parser.js';
+export type { Keyword, Punctuator, Token } from './tokenizer.js';
+export { tokenize } from './tokenizer.js';

package/dist/expression/limits.d.ts

@@ -17,7 +17,7 @@ export declare const MAX_EXPRESSION_AST_NODES = 256;
  *  evaluation. The grammar guarantees O(nodeCount) walks, so this can only trip
  *  on a crafted maximum-size AST. */
 export declare const MAX_EXPRESSION_EVAL_STEPS = 4096;
-/** Max named bindings on one `DeviceLinkExpressionSource`. */
+/** Max named bindings on one {@link ExpressionSource}. */
 export declare const MAX_EXPRESSION_BINDINGS = 32;
 /** Max positional arguments to any builtin call. */
 export declare const MAX_EXPRESSION_CALL_ARGS = 16;

package/dist/generated/addon-api.d.ts

@@ -1441,6 +1441,13 @@ export type AppRouter = TrpcCoreRouter<{
             output: z.infer<typeof coreBlocksCapability.methods.setEnabled.output>;
             meta: object;
         }>;
+        restart: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof coreBlocksCapability.methods.restart.input>;
+            output: z.infer<typeof coreBlocksCapability.methods.restart.output>;
+            meta: object;
+        }>;
         compile: TRPCMutationProcedure<{
             input: {
                 [x: string]: unknown;
@@ -2076,13 +2083,6 @@ export type AppRouter = TrpcCoreRouter<{
             output: z.infer<typeof deviceManagerCapability.methods.setChildLayout.output>;
             meta: object;
         }>;
-        setDeviceLinks: TRPCMutationProcedure<{
-            input: {
-                [x: string]: unknown;
-            } & z.input<typeof deviceManagerCapability.methods.setDeviceLinks.input>;
-            output: z.infer<typeof deviceManagerCapability.methods.setDeviceLinks.output>;
-            meta: object;
-        }>;
         setDisplay: TRPCMutationProcedure<{
             input: {
                 [x: string]: unknown;
@@ -6961,6 +6961,20 @@ export type AppRouter = TrpcCoreRouter<{
             output: z.infer<typeof streamBrokerCapability.methods.renderPreBufferClip.output>;
             meta: object;
         }>;
+        produceEventMedia: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof streamBrokerCapability.methods.produceEventMedia.input>;
+            output: z.infer<typeof streamBrokerCapability.methods.produceEventMedia.output>;
+            meta: object;
+        }>;
+        fetchEventMedia: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof streamBrokerCapability.methods.fetchEventMedia.input>;
+            output: z.infer<typeof streamBrokerCapability.methods.fetchEventMedia.output>;
+            meta: object;
+        }>;
         listAllCameraStreams: TRPCQueryProcedure<{
             input: {
                 nodeId?: string | undefined;

package/dist/generated/cap-input-defaults.d.ts

@@ -11,7 +11,7 @@
  * Plain data, zero Zod: a forked runner must not import the schema barrel
  * (~144MB RSS per runner — D28).
  *
- * Coverage: 23 caps, 50 methods with defaults.
+ * Coverage: 23 caps, 51 methods with defaults.
  */
 export declare const CAP_INPUT_DEFAULTS: Readonly<Record<string, Readonly<Record<string, Readonly<Record<string, unknown>>>>>>;
 /**