@camstack/types 1.2.46 → 1.2.48

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-BE4PDZ_3.js");
-const require_sleep = require("./sleep-CyN9nHr_.js");
-const require_fmp4_box_splitter = require("./fmp4-box-splitter-BkWH7O3L.js");
+const require_sleep = require("./sleep-ocMLM2o5.js");
+const require_canonical_hash = require("./canonical-hash-DNV8S5ET.js");
 const require_enums = require("./enums.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
 let zod = require("zod");
@@ -481,7 +481,7 @@ function canonicalEgressPlan(request, delivery = egressTransportFromRequest(requ
 * every other consumer to 360p.
 */
 function egressTranscodeSharingKey(request, delivery = egressTransportFromRequest(request)) {
-	return `egress:${require_fmp4_box_splitter.canonicalHash(canonicalEgressPlan(request, delivery))}`;
+	return `egress:${require_canonical_hash.canonicalHash(canonicalEgressPlan(request, delivery))}`;
 }
 //#endregion
 //#region src/health/wiring-health.ts
@@ -4326,12 +4326,34 @@ var streamBrokerCapability = {
 			kinds: zod.z.array(EventMediaKindSchema).min(1).default(["mp4"]),
 			/** GIF geometry. The video keeps the source's own. */
 			gifMaxWidth: zod.z.number().int().min(120).max(1280).default(640),
-			gifFps: zod.z.number().int().min(1).max(15).default(8),
 			/**
-			* Playback rate, applied to EVERY container so they stay one clip.
-			* `1` is real time and is what allows the copy branch.
+			* The gif's own PLAYBACK rate in frames per second — what the finished
+			* gif runs at, not how many source frames feed it. The decimation that
+			* feeds it samples `gifFps / gifSpeed` source frames per second, so at
+			* the defaults a 12 fps gif is built out of 3 source frames a second.
 			*/
-			speed: zod.z.number().min(1).max(8).default(1)
+			gifFps: zod.z.number().int().min(1).max(15).default(12),
+			/**
+			* How fast the GIF plays against real time, independent of `speed`.
+			*
+			* 4× by default, by operator request: a notification gif is glanced at
+			* on a lock screen, so a ~12 s window has to be over in ~3 s. It stays
+			* a separate knob from `speed` even though both now default to 4 —
+			* a caller wanting a real-time video and a fast gif must not have to
+			* choose.
+			*/
+			gifSpeed: zod.z.number().min(1).max(8).default(4),
+			/**
+			* Playback rate of the VIDEO. Also 4× by default, by operator decision.
+			*
+			* `1` is real time and is the ONLY value that allows the copy branch —
+			* anything else forces `libx264` over the window. That was priced
+			* before it was chosen: a per-event burst measured at 0.23 s and 254 KB
+			* on a real 615 720p cut, against 922 KB for the copy it replaces. A
+			* re-encode is capped at 720p (`EVENT_CLIP_ENCODE_MAX_WIDTH`), because
+			* once the decode is forced the width stops being free.
+			*/
+			speed: zod.z.number().min(1).max(8).default(4)
 		}), EventMediaProductionSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -4928,6 +4950,28 @@ function kebabToCamel(s) {
 * instead of taking the hub with it (D6). Every method here is admin-only, and
 * must stay so.
 */
+/**
+* Prefix for a block's generated addon id AND its runner id — one addon, one
+* process, so the two are the same string (D2).
+*
+* It lives on the CONTRACT rather than beside the code that materialises the
+* package, because it is not an implementation detail: the operator surface
+* reads a block's logs by asking `logs.query` for `addonId = core-block-<id>`,
+* with no cap and no store of its own. Two copies of this string is one copy
+* too many — a drift would show as a logs pane that is simply always empty.
+*/
+var CORE_BLOCK_ADDON_PREFIX = "core-block-";
+/** The addon/runner id a block's process runs under. */
+function coreBlockAddonId(blockId) {
+	return `${CORE_BLOCK_ADDON_PREFIX}${blockId}`;
+}
+/** The block id behind a generated addon/runner id, or null when the id belongs
+*  to something else. The inverse of {@link coreBlockAddonId}. */
+function coreBlockIdFromAddonId(addonId) {
+	if (!addonId.startsWith("core-block-")) return null;
+	const rest = addonId.slice(11);
+	return rest.length > 0 ? rest : null;
+}
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = zod.z.union([zod.z.literal("hub"), zod.z.string().min(1)]);
@@ -5016,6 +5060,23 @@ var coreBlocksCapability = {
 			auth: "admin"
 		}),
 		/**
+		* Stop this block's runner and let the supervisor bring it back.
+		*
+		* **It stores nothing.** There is no "restart requested" flag and no second
+		* lifecycle field: the supervisor already stops and respawns a runner when
+		* the code hash changes, and this exposes that same path deliberately
+		* (D62 — a switch writes the authority that already owned the function).
+		* The next reconcile pass remains the authority, so a restart that lost a
+		* race is corrected within one pass rather than leaving a stale flag behind.
+		*
+		* Refused for a DISABLED block: nothing would come back, and a button that
+		* silently does nothing is worse than one that says why.
+		*/
+		restart: require_sleep.method(zod.z.object({ blockId: zod.z.string() }), zod.z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Type-check without saving — what the editor calls as the author types, so
 		* the compiler's verdict is the same one the server will reach.
 		*/
@@ -6231,1114 +6292,247 @@ var deviceExportCapability = {
 	}
 };
 //#endregion
-//#region src/expression/limits.ts
+//#region src/capabilities/device-provider.cap.ts
+var ProviderStatusSchema = zod.z.object({
+	connected: zod.z.boolean(),
+	deviceCount: zod.z.number(),
+	error: zod.z.string().optional()
+});
+var DiscoveredDeviceSchema = zod.z.object({
+	externalId: zod.z.string(),
+	name: zod.z.string(),
+	type: zod.z.string(),
+	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+});
 /**
-* Resource-bound constants for the safe expression engine.
-*
-* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
-* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
-* O(nodeCount) by construction. These caps merely put a hard ceiling on the
-* work a single author-supplied expression can request, so a hostile or
-* accidental pathological string can never spend unbounded CPU/memory.
+* Candidate handed back from discovery and accepted by
+* `adoptDiscoveredDevice`. Shape mirrors the in-process
+* `DiscoveredDevice` interface used by `DeviceDiscovery`.
 */
-/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
-*  rejected without allocation. */
-var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
-/** Max AST nodes — checked during parse; a deeply nested grouping that exceeds
-*  this is rejected as "expression too complex". */
-var MAX_EXPRESSION_AST_NODES = 256;
-/** Defense-in-depth walker step budget — one increment per node visit during
-*  evaluation. The grammar guarantees O(nodeCount) walks, so this can only trip
-*  on a crafted maximum-size AST. */
-var MAX_EXPRESSION_EVAL_STEPS = 4096;
-/** Max named bindings on one `DeviceLinkExpressionSource`. */
-var MAX_EXPRESSION_BINDINGS = 32;
-/** Max positional arguments to any builtin call. */
-var MAX_EXPRESSION_CALL_ARGS = 16;
-/** LRU compile-cache capacity (parsed ASTs keyed by raw source string). */
-var EXPRESSION_COMPILE_CACHE_CAPACITY = 256;
-/** A legal binding / identifier name. */
-var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Binding names an author may NOT use: `now` is auto-injected; the literal
-*  keywords lex as values, not identifiers, so binding to them is meaningless. */
-var RESERVED_BINDING_NAMES = new Set([
-	"now",
-	"true",
-	"false",
-	"null"
-]);
-//#endregion
-//#region src/expression/errors.ts
+var DiscoveryCandidateSchema = zod.z.object({
+	stableId: zod.z.string(),
+	type: zod.z.enum(require_sleep.DeviceType),
+	suggestedName: zod.z.string(),
+	prefilledConfig: zod.z.record(zod.z.string(), zod.z.unknown()),
+	/**
+	* Optional upstream-system identity (HA entity_id, vendor MAC, …).
+	* Discovery pre-populates this for systems that know the upstream
+	* identity ahead of adoption. Rendering metadata (unit, precision)
+	* flows live through the cap STATUS SLICE after adoption.
+	*/
+	sourceInfo: SourceInfoSchema.optional()
+});
 /**
-* Error types for the safe expression engine. Two distinct classes so callers
-* can tell a compile-time (grammar) failure from a runtime (evaluation)
-* failure — both are non-fatal to the host: read paths degrade to "skip link".
+* Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
+* Mirrors `toDeviceShape()` output in `device-management.router.ts` so the
+* tRPC layer can pass it through without reshaping.
 */
-/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
-*  the failure is anchored to a character (author-facing inline feedback). */
-var ExpressionParseError = class extends Error {
-	position;
-	constructor(message, position) {
-		super(message);
-		this.name = "ExpressionParseError";
-		this.position = position;
-	}
-};
-/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
-*  result, unknown builtin, step-budget exceeded). */
-var ExpressionEvalError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ExpressionEvalError";
-	}
-};
-//#endregion
-//#region src/expression/builtins.ts
+var DeviceSummarySchema = zod.z.object({
+	id: zod.z.number(),
+	stableId: zod.z.string(),
+	addonId: zod.z.string(),
+	type: zod.z.string(),
+	name: zod.z.string(),
+	parentDeviceId: zod.z.number().nullable(),
+	online: zod.z.boolean(),
+	features: zod.z.array(zod.z.string()),
+	config: zod.z.record(zod.z.string(), zod.z.unknown()),
+	/** Optional upstream-system identity (dispatch key + system tag).
+	*  See `SourceInfo`. Present when the device has a non-synthetic
+	*  source identifier (HA entities, vendor MAC, …); omitted when the
+	*  synthetic backfill is in effect. */
+	sourceInfo: SourceInfoSchema.optional()
+});
 /**
-* Frozen, null-prototype builtin function table for the expression engine
-* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
-* parser rejects any callee not in it, and the evaluator gates each call on an
-* own-property check against it.
-*
-* Because the object has a NULL prototype AND is `Object.freeze`d:
-*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
-*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
-*    (there is no `Object.prototype` in the chain), so those names are not
-*    callable — they are simply "unknown function" at parse time.
-*
-* Every numeric argument is validated as a finite number and every numeric
-* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
-* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
-* closed rather than emitting a garbage value.
+* Result of a live field test (e.g. probing an RTSP URL during device
+* creation). Matches the UI-side `FieldProbeResult` in
+* `interfaces/config-ui.ts` — the admin `FormBuilder` renders the
+* returned `labels` as chips next to the input.
 */
-function asFiniteNumber(value, name, index) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
-	return value;
-}
-function asString$1(value, name, index) {
-	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
-	return value;
-}
-function finiteResult(value, name) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
-	return value;
-}
-function allFiniteNumbers(args, name) {
-	return args.map((a, idx) => asFiniteNumber(a, name, idx));
-}
-var INF = Number.POSITIVE_INFINITY;
-var table = {
-	min: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
-	},
-	max: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
-	},
-	abs: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
-	},
-	floor: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
-	},
-	ceil: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
-	},
-	sqrt: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
-	},
-	round: {
-		minArgs: 1,
-		maxArgs: 2,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "round", 0);
-			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
-			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
-			const factor = 10 ** digits;
-			return finiteResult(Math.round(x * factor) / factor, "round");
-		}
-	},
-	pow: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
-	},
-	clamp: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "clamp", 0);
-			const lo = asFiniteNumber(args[1], "clamp", 1);
-			const hi = asFiniteNumber(args[2], "clamp", 2);
-			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
-			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
-		}
-	},
-	avg: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const nums = allFiniteNumbers(args, "avg");
-			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
-		}
-	},
-	sum: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
-	},
-	coalesce: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			for (const a of args) if (a !== null) return a;
-			return null;
-		}
-	},
-	age: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
-	},
-	convert: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args, hooks) => {
-			const x = asFiniteNumber(args[0], "convert", 0);
-			const from = asString$1(args[1], "convert", 1).trim();
-			const to = asString$1(args[2], "convert", 2).trim();
-			if (hooks.convert) {
-				const out = hooks.convert(x, from, to);
-				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
-				return finiteResult(out, "convert");
-			}
-			if (from === to) return x;
-			throw new ExpressionEvalError("convert: unit conversion table not installed");
-		}
-	}
-};
-/** Frozen, null-prototype builtin table. */
-var EXPRESSION_BUILTINS = Object.freeze(Object.assign(Object.create(null), table));
-/** The set of valid builtin names — used by the parser to reject unknown
-*  callees at parse time (immediate author feedback). */
-var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
-//#endregion
-//#region src/expression/tokenizer.ts
+var FieldProbeResultSchema = zod.z.object({
+	status: zod.z.enum(["ok", "error"]),
+	labels: zod.z.array(zod.z.string()).optional(),
+	error: zod.z.string().optional()
+});
 /**
-* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
-* zero-dependency. The grammar is deliberately boring: decimal numbers,
-* single/double-quoted strings with a tiny escape set, identifiers, the three
-* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
-* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
-* is a parse error with a source position, so member access / assignment /
-* template literals are lexically impossible.
+* The output of `getChildCreationSchema` is a UI schema tree. We store
+* it as `unknown` at the capability layer — the router just passes it
+* through and the admin UI renders it via `FormBuilder`. The actual
+* type is `ConfigUISchema` (see `packages/types/src/interfaces/config-ui.ts`),
+* but we deliberately avoid a Zod mirror because the union is large and
+* not meant for runtime validation at this seam.
 */
-var KEYWORDS = new Set([
-	"true",
-	"false",
-	"null"
-]);
-function isDigit(ch) {
-	return ch >= "0" && ch <= "9";
-}
-function isIdentStart(ch) {
-	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
-}
-function isIdentPart(ch) {
-	return isIdentStart(ch) || isDigit(ch);
-}
-function isWhitespace(ch) {
-	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
-}
-/** Tokenize `source` into a flat token list ending with a single `eof` token.
-*  Throws `ExpressionParseError` on any illegal character or unterminated
-*  string. */
-function tokenize(source) {
-	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
-	const tokens = [];
-	let i = 0;
-	const n = source.length;
-	while (i < n) {
-		const ch = source[i];
-		if (isWhitespace(ch)) {
-			i += 1;
-			continue;
-		}
-		if (isDigit(ch)) {
-			const start = i;
-			while (i < n && isDigit(source[i])) i += 1;
-			if (i < n && source[i] === ".") {
-				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
-				i += 1;
-				while (i < n && isDigit(source[i])) i += 1;
-			}
-			const text = source.slice(start, i);
-			const value = Number(text);
-			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
-			tokens.push({
-				type: "number",
-				value,
-				pos: start
-			});
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			const quote = ch;
-			const start = i;
-			i += 1;
-			let out = "";
-			let closed = false;
-			while (i < n) {
-				const c = source[i];
-				if (c === "\\") {
-					const next = i + 1 < n ? source[i + 1] : "";
-					if (next === "\\" || next === "'" || next === "\"") {
-						out += next;
-						i += 2;
-						continue;
-					}
-					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
-				}
-				if (c === quote) {
-					closed = true;
-					i += 1;
-					break;
-				}
-				out += c;
-				i += 1;
-			}
-			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
-			tokens.push({
-				type: "string",
-				value: out,
-				pos: start
-			});
-			continue;
-		}
-		if (isIdentStart(ch)) {
-			const start = i;
-			while (i < n && isIdentPart(source[i])) i += 1;
-			const text = source.slice(start, i);
-			if (KEYWORDS.has(text)) tokens.push({
-				type: "keyword",
-				keyword: keywordOf(text),
-				pos: start
-			});
-			else tokens.push({
-				type: "identifier",
-				name: text,
-				pos: start
-			});
-			continue;
-		}
-		const two = i + 1 < n ? source.slice(i, i + 2) : "";
-		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
-			tokens.push({
-				type: "punct",
-				punct: two,
-				pos: i
-			});
-			i += 2;
-			continue;
-		}
-		if (isSinglePunct(ch)) {
-			tokens.push({
-				type: "punct",
-				punct: ch,
-				pos: i
-			});
-			i += 1;
-			continue;
-		}
-		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+var CreationSchemaOutputSchema = zod.z.unknown();
+var deviceProviderCapability = {
+	name: "device-provider",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		start: require_sleep.method(zod.z.void(), zod.z.void(), { kind: "mutation" }),
+		stop: require_sleep.method(zod.z.void(), zod.z.void(), { kind: "mutation" }),
+		getStatus: require_sleep.method(zod.z.void(), ProviderStatusSchema),
+		getDevices: require_sleep.method(zod.z.void(), zod.z.array(zod.z.object({
+			id: zod.z.string(),
+			name: zod.z.string(),
+			type: zod.z.string()
+		}))),
+		supportsDiscovery: require_sleep.method(zod.z.object({}), zod.z.boolean()),
+		/**
+		* Run a network scan. `params` carries optional provider-specific scan
+		* inputs (e.g. a broadcast address / subnet for cross-subnet discovery),
+		* shaped by `getDiscoveryParamsSchema`. Omitted for the generic scan
+		* (provider uses its local-network default).
+		*/
+		discoverDevices: require_sleep.method(zod.z.object({ params: zod.z.record(zod.z.string(), zod.z.unknown()).optional() }), zod.z.array(DiscoveryCandidateSchema), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Optional form schema (`ConfigUISchema`) for the EXTRA per-scan inputs a
+		* provider accepts (e.g. Gree's broadcast address for a different subnet).
+		* `null` when the provider takes no extra scan params — the generic
+		* aggregated scan never renders this; the per-integration scan does.
+		*/
+		getDiscoveryParamsSchema: require_sleep.method(zod.z.object({}), CreationSchemaOutputSchema),
+		/**
+		* The DeviceType this provider creates via manual add (Camera for
+		* Reolink/ONVIF, Container for Gree, Hub for Ecowitt). `null` when the
+		* provider does not support manual creation. Lets the Add-Device dialog
+		* pick the right type instead of assuming Camera.
+		*/
+		getManualCreationType: require_sleep.method(zod.z.object({}), zod.z.object({ deviceType: zod.z.enum(require_sleep.DeviceType).nullable() })),
+		adoptDiscoveredDevice: require_sleep.method(zod.z.object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		supportsManualCreation: require_sleep.method(zod.z.object({}), zod.z.boolean()),
+		/**
+		* Fetch the creation form schema for a given DeviceType. Returns
+		* `null` when the provider does not support manually creating
+		* devices of that type. The output is a `ConfigUISchema` — the
+		* router type-asserts it at the boundary.
+		*/
+		getChildCreationSchema: require_sleep.method(zod.z.object({ type: zod.z.enum(require_sleep.DeviceType) }), CreationSchemaOutputSchema),
+		createDevice: require_sleep.method(zod.z.object({
+			type: zod.z.enum(require_sleep.DeviceType),
+			config: zod.z.record(zod.z.string(), zod.z.unknown())
+		}), DeviceSummarySchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Test a single field in the creation form before the device has
+		* been persisted. Typical use: probing an RTSP URL entered by the
+		* user. Providers that don't support field probing return
+		* `{ success: true, message: 'Field test not supported' }`.
+		*
+		* `formValues` is the live snapshot of every field in the form at
+		* the moment the user clicked Test — useful for probes that depend
+		* on multiple fields together (e.g. Reolink autodetect needs host
+		* + credentials + UID + transport mode in a single call). Optional
+		* for backwards compatibility; providers free to ignore it.
+		*/
+		testCreationField: require_sleep.method(zod.z.object({
+			type: zod.z.enum(require_sleep.DeviceType),
+			key: zod.z.string(),
+			value: zod.z.unknown(),
+			formValues: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+		}), FieldProbeResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
-	tokens.push({
-		type: "eof",
-		pos: n
-	});
-	return tokens;
-}
-function keywordOf(text) {
-	if (text === "true") return "true";
-	if (text === "false") return "false";
-	return "null";
-}
-function isSinglePunct(ch) {
-	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
-}
+};
 //#endregion
-//#region src/expression/parser.ts
+//#region src/capabilities/device-manager.cap.ts
 /**
-* Pratt (precedence-climbing) parser for the safe expression mini-language.
+* Device Manager capability — hub-side singleton that unifies device persistence,
+* live registry access, and all management operations into a single tRPC surface.
 *
-* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
-* → relational → additive → multiplicative → unary `! -` → call / primary.
-* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
-* string validated against the builtin table at parse time, so an unknown
-* function is rejected immediately (author feedback) and a persisted expression
-* that references a since-removed builtin degrades at read.
+* Replaces:
+*   - `device-persistence` capability (persistence methods absorbed here)
+*   - `device-management.router.ts` (deleted in Phase 2)
+*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
 *
-* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
-* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
-*/
-/** Binary/logical operator precedence (higher binds tighter). */
-var BINARY_PRECEDENCE = {
-	"||": 1,
-	"&&": 2,
-	"==": 3,
-	"!=": 3,
-	"<": 4,
-	"<=": 4,
-	">": 4,
-	">=": 4,
-	"+": 5,
-	"-": 5,
-	"*": 6,
-	"/": 6,
-	"%": 6
-};
-function isLogicalOp(op) {
-	return op === "&&" || op === "||";
-}
-function isBinaryOp(op) {
-	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
-}
-var Parser = class {
-	tokens;
-	pos = 0;
-	nodeCount = 0;
-	identifiers = /* @__PURE__ */ new Set();
-	callees = /* @__PURE__ */ new Set();
-	constructor(tokens) {
-		this.tokens = tokens;
-	}
-	parse() {
-		const ast = this.parseTernary();
-		const tok = this.peek();
-		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
-		return {
-			ast,
-			identifiers: this.identifiers,
-			callees: this.callees,
-			nodeCount: this.nodeCount
-		};
-	}
-	peek() {
-		return this.tokens[this.pos];
-	}
-	next() {
-		return this.tokens[this.pos++];
-	}
-	/** Consume a punctuator token, erroring if the next token isn't it. */
-	expectPunct(punct) {
-		const tok = this.peek();
-		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
-		this.pos += 1;
-	}
-	matchPunct(punct) {
-		const tok = this.peek();
-		if (tok.type === "punct" && tok.punct === punct) {
-			this.pos += 1;
-			return true;
-		}
-		return false;
-	}
-	countNode() {
-		this.nodeCount += 1;
-		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
-	}
-	parseTernary() {
-		const test = this.parseBinary(1);
-		if (this.matchPunct("?")) {
-			const consequent = this.parseTernary();
-			this.expectPunct(":");
-			const alternate = this.parseTernary();
-			this.countNode();
-			return {
-				kind: "conditional",
-				test,
-				consequent,
-				alternate
-			};
-		}
-		return test;
-	}
-	parseBinary(minPrec) {
-		let left = this.parseUnary();
-		for (;;) {
-			const tok = this.peek();
-			if (tok.type !== "punct") break;
-			const prec = BINARY_PRECEDENCE[tok.punct];
-			if (prec === void 0 || prec < minPrec) break;
-			const op = tok.punct;
-			this.pos += 1;
-			const right = this.parseBinary(prec + 1);
-			this.countNode();
-			if (isLogicalOp(op)) left = {
-				kind: "logical",
-				op,
-				left,
-				right
-			};
-			else if (isBinaryOp(op)) left = {
-				kind: "binary",
-				op,
-				left,
-				right
-			};
-			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
-		}
-		return left;
-	}
-	parseUnary() {
-		const tok = this.peek();
-		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
-			const op = tok.punct;
-			this.pos += 1;
-			const operand = this.parseUnary();
-			this.countNode();
-			return {
-				kind: "unary",
-				op,
-				operand
-			};
-		}
-		return this.parsePrimary();
-	}
-	parsePrimary() {
-		const tok = this.next();
-		switch (tok.type) {
-			case "number":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "string":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "keyword":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.keyword === "null" ? null : tok.keyword === "true"
-				};
-			case "identifier": {
-				const nextTok = this.peek();
-				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
-				this.identifiers.add(tok.name);
-				this.countNode();
-				return {
-					kind: "identifier",
-					name: tok.name
-				};
-			}
-			case "punct":
-				if (tok.punct === "(") {
-					const inner = this.parseTernary();
-					this.expectPunct(")");
-					return inner;
-				}
-				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
-			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
-		}
-	}
-	parseCall(callee, pos) {
-		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
-		this.expectPunct("(");
-		const args = [];
-		if (!this.matchPunct(")")) for (;;) {
-			args.push(this.parseTernary());
-			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
-			if (this.matchPunct(",")) continue;
-			this.expectPunct(")");
-			break;
-		}
-		this.callees.add(callee);
-		this.countNode();
-		return {
-			kind: "call",
-			callee,
-			args
-		};
-	}
-};
-/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
-*  `ExpressionParseError` on any lexical or grammatical failure. */
-function parseExpression(source) {
-	return new Parser(tokenize(source)).parse();
-}
-//#endregion
-//#region src/expression/compile.ts
-/**
-* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
-* by expr"). The cache stores BOTH successes and failures (negative caching),
-* so a corrupt persisted string costs exactly one tokenize+parse total — not
-* one per read on a hot resolve path.
-*
-* The cache is a module-level singleton: entries are pure, content-addressed
-* ASTs keyed by the raw source string, so sharing one instance across all
-* callers is safe and maximises hit rate.
-*/
-var cache = /* @__PURE__ */ new Map();
-function getCached(source) {
-	const hit = cache.get(source);
-	if (hit !== void 0) {
-		cache.delete(source);
-		cache.set(source, hit);
-		return hit;
-	}
-	let result;
-	try {
-		result = {
-			ok: true,
-			parsed: parseExpression(source)
-		};
-	} catch (err) {
-		result = {
-			ok: false,
-			error: err instanceof ExpressionParseError ? err.message : String(err)
-		};
-	}
-	cache.set(source, result);
-	if (cache.size > 256) {
-		const oldest = cache.keys().next().value;
-		if (oldest !== void 0) cache.delete(oldest);
-	}
-	return result;
-}
-/** Compile `source` to a `ParsedExpression`, throwing `ExpressionParseError`
-*  on failure. LRU/negative-cached. */
-function compileExpression(source) {
-	const result = getCached(source);
-	if (result.ok) return result.parsed;
-	throw new ExpressionParseError(result.error);
-}
-/** Compile `source`, returning a discriminated result instead of throwing.
-*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
-function compileExpressionSafe(source) {
-	return getCached(source);
-}
-//#endregion
-//#region src/expression/evaluator.ts
-/**
-* Tree-walking evaluator for the safe expression mini-language.
+* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
+* fork into separate processes but never run on remote cluster agents. Therefore:
+*   - No nodeId routing needed — this is a pure hub singleton.
+*   - The hub's DeviceRegistry is the single source of truth for all live devices.
+*   - No shadow registry or cross-node aggregation required.
 *
-* SECURITY (spec §4 rule 2/5):
-*  - The scope is an `Object.create(null)` copy of ONLY the caller's own
-*    enumerable binding entries, so `name in scope` is a pure own-key check and
-*    `constructor` / `__proto__` / `toString` are plain unknown identifiers.
-*  - Performs ZERO I/O and never touches `globalThis` / `Date` / `Math`
-*    directly — the only external calls are into the frozen builtin table.
-*  - The grammar has no loops/recursion/lambdas, so a walk is O(nodeCount) by
-*    construction; the step counter is defense-in-depth for a crafted max-size
-*    AST. Nothing blocks: there are no timers, awaits or unbounded loops.
-*/
-var EMPTY_HOOKS = Object.freeze({});
-/** Build a null-prototype scope from own-enumerable binding entries. Inherited
-*  keys of the input (e.g. from a `{__proto__: {...}}` payload) are NOT copied,
-*  so nothing smuggles in via the prototype chain. */
-function createExpressionScope(bindings) {
-	const scope = Object.create(null);
-	for (const key of Object.keys(bindings)) if (Object.prototype.hasOwnProperty.call(bindings, key)) scope[key] = bindings[key];
-	return scope;
-}
-function isFiniteNumber(value) {
-	return typeof value === "number" && Number.isFinite(value);
-}
-/** JS truthiness of a primitive value. */
-function truthy(value) {
-	return Boolean(value);
-}
-function requireFinite(value, context) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${context} produced a non-finite result`);
-	return value;
-}
-function step(ctx) {
-	ctx.steps += 1;
-	if (ctx.steps > ctx.maxSteps) throw new ExpressionEvalError("expression evaluation step budget exceeded");
-}
-function evalNode(node, ctx) {
-	step(ctx);
-	switch (node.kind) {
-		case "literal": return node.value;
-		case "identifier":
-			if (!(node.name in ctx.scope)) throw new ExpressionEvalError(`unknown identifier: ${node.name}`);
-			return ctx.scope[node.name];
-		case "unary": return evalUnary(node.op, evalNode(node.operand, ctx));
-		case "binary": return evalBinary(node.op, evalNode(node.left, ctx), evalNode(node.right, ctx));
-		case "logical": {
-			const left = evalNode(node.left, ctx);
-			if (node.op === "&&") return truthy(left) ? evalNode(node.right, ctx) : left;
-			return truthy(left) ? left : evalNode(node.right, ctx);
-		}
-		case "conditional": return truthy(evalNode(node.test, ctx)) ? evalNode(node.consequent, ctx) : evalNode(node.alternate, ctx);
-		case "call": return evalCall(node.callee, node.args.map((a) => evalNode(a, ctx)), ctx.hooks);
-	}
-}
-function evalUnary(op, operand) {
-	if (op === "!") return !truthy(operand);
-	if (!isFiniteNumber(operand)) throw new ExpressionEvalError("unary \"-\" requires a finite number");
-	return requireFinite(-operand, "unary \"-\"");
-}
-function evalBinary(op, left, right) {
-	switch (op) {
-		case "==": return left === right;
-		case "!=": return left !== right;
-		case "+":
-			if (typeof left === "string" && typeof right === "string") return left + right;
-			if (isFiniteNumber(left) && isFiniteNumber(right)) return requireFinite(left + right, "\"+\"");
-			throw new ExpressionEvalError("\"+\" requires two numbers or two strings");
-		case "-":
-		case "*":
-		case "/":
-		case "%":
-			if (!isFiniteNumber(left) || !isFiniteNumber(right)) throw new ExpressionEvalError(`"${op}" requires two finite numbers`);
-			return requireFinite(op === "-" ? left - right : op === "*" ? left * right : op === "/" ? left / right : left % right, `"${op}"`);
-		case "<":
-		case "<=":
-		case ">":
-		case ">=":
-			if (isFiniteNumber(left) && isFiniteNumber(right)) return op === "<" ? left < right : op === "<=" ? left <= right : op === ">" ? left > right : left >= right;
-			if (typeof left === "string" && typeof right === "string") return op === "<" ? left < right : op === "<=" ? left <= right : op === ">" ? left > right : left >= right;
-			throw new ExpressionEvalError(`"${op}" requires two numbers or two strings`);
-	}
-}
-function evalCall(callee, args, hooks) {
-	if (!Object.prototype.hasOwnProperty.call(EXPRESSION_BUILTINS, callee)) throw new ExpressionEvalError(`unknown function: ${callee}`);
-	const builtin = EXPRESSION_BUILTINS[callee];
-	if (args.length < builtin.minArgs || args.length > builtin.maxArgs) throw new ExpressionEvalError(`${callee}: wrong number of arguments (${args.length})`);
-	return builtin.apply(args, hooks);
-}
-/** Evaluate an AST node against a scope. Throws `ExpressionEvalError` on any
-*  runtime failure (unknown identifier, type mismatch, non-finite result,
-*  step-budget exhaustion). */
-function evaluateAst(node, scope, opts) {
-	return evalNode(node, {
-		scope,
-		hooks: opts?.hooks ?? EMPTY_HOOKS,
-		maxSteps: opts?.maxSteps ?? 4096,
-		steps: 0
-	});
-}
-//#endregion
-//#region src/expression/link-expression.ts
-/**
-* DeviceLink-facing helpers for the expression engine — the single seam both
-* resolver channels (async provider-read + sync mirror) and the wire-schema
-* `superRefine` share, so validation and evaluation semantics stay identical
-* everywhere.
-*/
-/** The `now` epoch-ms binding is auto-injected into every evaluation and is a
-*  reserved binding name (authors may not rebind it). */
-var EXPRESSION_INJECTED_NOW = "now";
-/**
-* Coerce an untrusted `getByPath` / mirror read to an `ExpressionValue`.
-* Non-primitive values (objects, arrays, `undefined`, functions, bigint,
-* symbol) and non-finite numbers become `undefined` so the caller can apply
-* its binding-miss policy (→ `null`). `null` itself is a valid value.
-*/
-function toExpressionValue(raw) {
-	if (raw === null) return null;
-	if (typeof raw === "string") return raw;
-	if (typeof raw === "boolean") return raw;
-	if (typeof raw === "number") return Number.isFinite(raw) ? raw : void 0;
-}
-/**
-* Author-time validation. Returns `null` when the source is valid, else a
-* human-readable error message. Checks: the expression compiles; binding count
-* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
-* is not reserved (`now`/keywords) and does not shadow a builtin; and every
-* FREE identifier of the AST is covered by a binding or the injected `now`.
-*/
-function validateExpressionSource(src) {
-	const names = Object.keys(src.bindings);
-	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
-	for (const name of names) {
-		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
-		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
-		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
-	}
-	const compiled = compileExpressionSafe(src.expr);
-	if (!compiled.ok) return compiled.error;
-	const bound = new Set(names);
-	for (const id of compiled.parsed.identifiers) {
-		if (id === "now") continue;
-		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
-	}
-	return null;
-}
-/**
-* Shared read-path evaluation for BOTH resolver channels. Builds a null-proto
-* scope from `bindingValues` plus the injected `now` (supplied by the caller
-* for determinism/testability), compiles via the LRU, and evaluates. Any
-* failure (parse or eval) returns `{ ok: false }` — the caller treats that as
-* "skip this link".
+* Forked workers register devices back to the hub via `ctx.devices`
+* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
 */
-function evaluateLinkExpression(expr, bindingValues, now, opts) {
-	const compiled = compileExpressionSafe(expr);
-	if (!compiled.ok) return {
-		ok: false,
-		error: compiled.error
-	};
-	const scope = createExpressionScope({
-		...bindingValues,
-		["now"]: now
-	});
-	try {
-		return {
-			ok: true,
-			value: evaluateAst(compiled.parsed.ast, scope, opts)
-		};
-	} catch (err) {
-		return {
-			ok: false,
-			error: err instanceof ExpressionEvalError ? err.message : String(err)
-		};
-	}
-}
-//#endregion
-//#region src/capabilities/device-provider.cap.ts
-var ProviderStatusSchema = zod.z.object({
-	connected: zod.z.boolean(),
-	deviceCount: zod.z.number(),
-	error: zod.z.string().optional()
+/** One child-placement directive on a container's `childLayout`. Structurally
+*  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
+*  shape for the same field. The child is identified by its re-sync-stable
+*  accessory `stableIdSuffix` (`childKey`); listed children are grouped into
+*  named accordion sections (with optional intra-section order). */
+var ChildLayoutEntrySchema = zod.z.object({
+	childKey: zod.z.string(),
+	section: zod.z.string(),
+	order: zod.z.number().optional(),
+	collapsed: zod.z.boolean().optional()
 });
-var DiscoveredDeviceSchema = zod.z.object({
-	externalId: zod.z.string(),
-	name: zod.z.string(),
-	type: zod.z.string(),
-	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+/** Cap-wire shape of a per-cap display refinement — mirrors
+*  `DeviceCapDisplayOverride` in `device-management.ts`. */
+var DeviceCapDisplayOverrideSchema = zod.z.object({
+	unit: zod.z.string().min(1).optional(),
+	precision: zod.z.number().int().min(0).max(10).optional()
 });
-/**
-* Candidate handed back from discovery and accepted by
-* `adoptDiscoveredDevice`. Shape mirrors the in-process
-* `DiscoveredDevice` interface used by `DeviceDiscovery`.
-*/
-var DiscoveryCandidateSchema = zod.z.object({
-	stableId: zod.z.string(),
-	type: zod.z.enum(require_sleep.DeviceType),
-	suggestedName: zod.z.string(),
-	prefilledConfig: zod.z.record(zod.z.string(), zod.z.unknown()),
-	/**
-	* Optional upstream-system identity (HA entity_id, vendor MAC, …).
-	* Discovery pre-populates this for systems that know the upstream
-	* identity ahead of adoption. Rendering metadata (unit, precision)
-	* flows live through the cap STATUS SLICE after adoption.
-	*/
-	sourceInfo: SourceInfoSchema.optional()
+/** Cap-wire shape of an operator-authored per-device display override —
+*  mirrors `DeviceDisplayOverride` in `device-management.ts`. `precision`
+*  bounds mirror `numeric-sensor.cap.ts` (`int 0-10`). */
+var DeviceDisplayOverrideSchema = zod.z.object({
+	icon: zod.z.string().min(1).optional(),
+	label: zod.z.string().min(1).optional(),
+	unit: zod.z.string().min(1).optional(),
+	precision: zod.z.number().int().min(0).max(10).optional(),
+	hidden: zod.z.boolean().optional(),
+	perCap: zod.z.record(zod.z.string(), DeviceCapDisplayOverrideSchema).optional()
+});
+/** Cap-wire shape of a per-role display default — mirrors `RoleDisplayDefault`
+*  in `device-management.ts`. Keyed by `DeviceRole` string (role strings cross
+*  the wire as plain strings everywhere else — cf. `DeviceInfoSchema.role`). */
+var RoleDisplayDefaultSchema = zod.z.object({
+	unit: zod.z.string().min(1).optional(),
+	precision: zod.z.number().int().min(0).max(10).optional(),
+	icon: zod.z.string().min(1).optional()
 });
 /**
-* Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
-* Mirrors `toDeviceShape()` output in `device-management.router.ts` so the
-* tRPC layer can pass it through without reshaping.
+* Serializable projection of a live IDevice.
+* Returned by listAll, getDevice, getChildren.
+* Live methods (getStreamSources, getConfigSchema) are separate calls.
 */
-var DeviceSummarySchema = zod.z.object({
+var DeviceInfoSchema = zod.z.object({
+	/** Progressive, system-wide unique number. Allocated synchronously by
+	*  `device-manager.allocateDeviceId` BEFORE the owning `IDevice` is
+	*  constructed, so every live device exposes an `id` — no transient
+	*  null window. Distinct from `stableId`, which is unique per
+	*  integration. Ids are monotonic and never reissued on removal. */
 	id: zod.z.number(),
 	stableId: zod.z.string(),
 	addonId: zod.z.string(),
-	type: zod.z.string(),
+	type: zod.z.enum(require_sleep.DeviceType),
 	name: zod.z.string(),
+	/** Operator-organisational location label. `null` when unset. */
+	location: zod.z.string().nullable(),
+	/** Soft-disabled flag. */
+	disabled: zod.z.boolean(),
 	parentDeviceId: zod.z.number().nullable(),
+	/** Optional semantic role — `DeviceRole` string. null for top-level devices. */
+	role: zod.z.string().nullable().optional(),
 	online: zod.z.boolean(),
+	/** True when the device's initial feature-probe has completed (or it has
+	*  no probe) — exported shape is stable; exporters gate advertise on this.
+	*  Optional for deploy-order resilience: a record produced by an older
+	*  device-manager build omits it, and consumers treat absent as "not ready"
+	*  (export gate carries forward, never advertises a partial shape). */
+	probed: zod.z.boolean().optional(),
 	features: zod.z.array(zod.z.string()),
-	config: zod.z.record(zod.z.string(), zod.z.unknown()),
-	/** Optional upstream-system identity (dispatch key + system tag).
-	*  See `SourceInfo`. Present when the device has a non-synthetic
-	*  source identifier (HA entities, vendor MAC, …); omitted when the
-	*  synthetic backfill is in effect. */
-	sourceInfo: SourceInfoSchema.optional()
-});
-/**
-* Result of a live field test (e.g. probing an RTSP URL during device
-* creation). Matches the UI-side `FieldProbeResult` in
-* `interfaces/config-ui.ts` — the admin `FormBuilder` renders the
-* returned `labels` as chips next to the input.
-*/
-var FieldProbeResultSchema = zod.z.object({
-	status: zod.z.enum(["ok", "error"]),
-	labels: zod.z.array(zod.z.string()).optional(),
-	error: zod.z.string().optional()
-});
-/**
-* The output of `getChildCreationSchema` is a UI schema tree. We store
-* it as `unknown` at the capability layer — the router just passes it
-* through and the admin UI renders it via `FormBuilder`. The actual
-* type is `ConfigUISchema` (see `packages/types/src/interfaces/config-ui.ts`),
-* but we deliberately avoid a Zod mirror because the union is large and
-* not meant for runtime validation at this seam.
-*/
-var CreationSchemaOutputSchema = zod.z.unknown();
-var deviceProviderCapability = {
-	name: "device-provider",
-	scope: "system",
-	mode: "collection",
-	methods: {
-		start: require_sleep.method(zod.z.void(), zod.z.void(), { kind: "mutation" }),
-		stop: require_sleep.method(zod.z.void(), zod.z.void(), { kind: "mutation" }),
-		getStatus: require_sleep.method(zod.z.void(), ProviderStatusSchema),
-		getDevices: require_sleep.method(zod.z.void(), zod.z.array(zod.z.object({
-			id: zod.z.string(),
-			name: zod.z.string(),
-			type: zod.z.string()
-		}))),
-		supportsDiscovery: require_sleep.method(zod.z.object({}), zod.z.boolean()),
-		/**
-		* Run a network scan. `params` carries optional provider-specific scan
-		* inputs (e.g. a broadcast address / subnet for cross-subnet discovery),
-		* shaped by `getDiscoveryParamsSchema`. Omitted for the generic scan
-		* (provider uses its local-network default).
-		*/
-		discoverDevices: require_sleep.method(zod.z.object({ params: zod.z.record(zod.z.string(), zod.z.unknown()).optional() }), zod.z.array(DiscoveryCandidateSchema), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Optional form schema (`ConfigUISchema`) for the EXTRA per-scan inputs a
-		* provider accepts (e.g. Gree's broadcast address for a different subnet).
-		* `null` when the provider takes no extra scan params — the generic
-		* aggregated scan never renders this; the per-integration scan does.
-		*/
-		getDiscoveryParamsSchema: require_sleep.method(zod.z.object({}), CreationSchemaOutputSchema),
-		/**
-		* The DeviceType this provider creates via manual add (Camera for
-		* Reolink/ONVIF, Container for Gree, Hub for Ecowitt). `null` when the
-		* provider does not support manual creation. Lets the Add-Device dialog
-		* pick the right type instead of assuming Camera.
-		*/
-		getManualCreationType: require_sleep.method(zod.z.object({}), zod.z.object({ deviceType: zod.z.enum(require_sleep.DeviceType).nullable() })),
-		adoptDiscoveredDevice: require_sleep.method(zod.z.object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		supportsManualCreation: require_sleep.method(zod.z.object({}), zod.z.boolean()),
-		/**
-		* Fetch the creation form schema for a given DeviceType. Returns
-		* `null` when the provider does not support manually creating
-		* devices of that type. The output is a `ConfigUISchema` — the
-		* router type-asserts it at the boundary.
-		*/
-		getChildCreationSchema: require_sleep.method(zod.z.object({ type: zod.z.enum(require_sleep.DeviceType) }), CreationSchemaOutputSchema),
-		createDevice: require_sleep.method(zod.z.object({
-			type: zod.z.enum(require_sleep.DeviceType),
-			config: zod.z.record(zod.z.string(), zod.z.unknown())
-		}), DeviceSummarySchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Test a single field in the creation form before the device has
-		* been persisted. Typical use: probing an RTSP URL entered by the
-		* user. Providers that don't support field probing return
-		* `{ success: true, message: 'Field test not supported' }`.
-		*
-		* `formValues` is the live snapshot of every field in the form at
-		* the moment the user clicked Test — useful for probes that depend
-		* on multiple fields together (e.g. Reolink autodetect needs host
-		* + credentials + UID + transport mode in a single call). Optional
-		* for backwards compatibility; providers free to ignore it.
-		*/
-		testCreationField: require_sleep.method(zod.z.object({
-			type: zod.z.enum(require_sleep.DeviceType),
-			key: zod.z.string(),
-			value: zod.z.unknown(),
-			formValues: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-		}), FieldProbeResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		})
-	}
-};
-//#endregion
-//#region src/capabilities/device-manager.cap.ts
-/**
-* Device Manager capability — hub-side singleton that unifies device persistence,
-* live registry access, and all management operations into a single tRPC surface.
-*
-* Replaces:
-*   - `device-persistence` capability (persistence methods absorbed here)
-*   - `device-management.router.ts` (deleted in Phase 2)
-*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
-*
-* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
-* fork into separate processes but never run on remote cluster agents. Therefore:
-*   - No nodeId routing needed — this is a pure hub singleton.
-*   - The hub's DeviceRegistry is the single source of truth for all live devices.
-*   - No shadow registry or cross-node aggregation required.
-*
-* Forked workers register devices back to the hub via `ctx.devices`
-* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
-*/
-/** One child-placement directive on a container's `childLayout`. Structurally
-*  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
-*  shape for the same field. The child is identified by its re-sync-stable
-*  accessory `stableIdSuffix` (`childKey`); listed children are grouped into
-*  named accordion sections (with optional intra-section order). */
-var ChildLayoutEntrySchema = zod.z.object({
-	childKey: zod.z.string(),
-	section: zod.z.string(),
-	order: zod.z.number().optional(),
-	collapsed: zod.z.boolean().optional()
-});
-/** Cap-wire shape of a DeviceLink — structurally mirrors `DeviceLink` in
-*  `device-management.ts`. Source is a union: a FIELD source copies a sibling
-*  accessory's status field (`kind` optional/absent for wire compat); a
-*  LITERAL source carries a per-device constant (no sibling is read); a
-*  GLOBAL source (P2e) copies ANY device's status field, addressed by the
-*  source device's full re-sync-stable `stableId`. */
-var DeviceLinkFieldSourceSchema = zod.z.object({
-	kind: zod.z.literal("field").optional(),
-	sourceKey: zod.z.string(),
-	cap: zod.z.string(),
-	fieldPath: zod.z.string()
-});
-var DeviceLinkLiteralSourceSchema = zod.z.object({
-	kind: zod.z.literal("literal"),
-	value: zod.z.union([
-		zod.z.string(),
-		zod.z.number(),
-		zod.z.boolean(),
-		zod.z.null()
-	])
-});
-var DeviceLinkGlobalSourceSchema = zod.z.object({
-	kind: zod.z.literal("global"),
-	sourceStableId: zod.z.string(),
-	cap: zod.z.string(),
-	fieldPath: zod.z.string()
-});
-/** Expression source (Stage X): compute the target field from N named bindings
-*  via the safe expression engine. Bindings are field | literal | global — never
-*  another expression (no nesting). The `superRefine` runs the SAME author-time
-*  validation as `validateExpressionSource` (compiles the expr, checks binding
-*  names + identifier coverage) so every wire boundary that parses a DeviceLink
-*  (tRPC mount, kernel create pre-seed, projection output) validates-at-write.
-*  Compiles are LRU-cached, so repeated validation of the same expr is a hit. */
-var DeviceLinkExpressionSourceSchema = zod.z.object({
-	kind: zod.z.literal("expression"),
-	expr: zod.z.string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: zod.z.record(zod.z.string().regex(EXPRESSION_IDENTIFIER_RE), zod.z.union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema
-	]))
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
-});
-var DeviceLinkSchema = zod.z.object({
-	id: zod.z.string(),
-	source: zod.z.union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema,
-		DeviceLinkExpressionSourceSchema
-	]),
-	target: zod.z.object({
-		cap: zod.z.string(),
-		fieldPath: zod.z.string(),
-		itemKey: zod.z.string().optional()
-	}),
-	transform: zod.z.discriminatedUnion("kind", [
-		zod.z.object({ kind: zod.z.literal("identity") }),
-		zod.z.object({
-			kind: zod.z.literal("enum-map"),
-			mapping: zod.z.record(zod.z.string(), zod.z.union([
-				zod.z.string(),
-				zod.z.number(),
-				zod.z.boolean()
-			])),
-			fallback: zod.z.union([
-				zod.z.string(),
-				zod.z.number(),
-				zod.z.boolean()
-			]).optional()
-		}),
-		zod.z.object({
-			kind: zod.z.literal("linear"),
-			scale: zod.z.number(),
-			offset: zod.z.number(),
-			clamp: zod.z.tuple([zod.z.number(), zod.z.number()]).readonly().optional()
-		})
-	]).optional()
-});
-/** Cap-wire shape of a per-cap display refinement — mirrors
-*  `DeviceCapDisplayOverride` in `device-management.ts`. */
-var DeviceCapDisplayOverrideSchema = zod.z.object({
-	unit: zod.z.string().min(1).optional(),
-	precision: zod.z.number().int().min(0).max(10).optional()
-});
-/** Cap-wire shape of an operator-authored per-device display override —
-*  mirrors `DeviceDisplayOverride` in `device-management.ts`. `precision`
-*  bounds mirror `numeric-sensor.cap.ts` (`int 0-10`). */
-var DeviceDisplayOverrideSchema = zod.z.object({
-	icon: zod.z.string().min(1).optional(),
-	label: zod.z.string().min(1).optional(),
-	unit: zod.z.string().min(1).optional(),
-	precision: zod.z.number().int().min(0).max(10).optional(),
-	hidden: zod.z.boolean().optional(),
-	perCap: zod.z.record(zod.z.string(), DeviceCapDisplayOverrideSchema).optional()
-});
-/** Cap-wire shape of a per-role display default — mirrors `RoleDisplayDefault`
-*  in `device-management.ts`. Keyed by `DeviceRole` string (role strings cross
-*  the wire as plain strings everywhere else — cf. `DeviceInfoSchema.role`). */
-var RoleDisplayDefaultSchema = zod.z.object({
-	unit: zod.z.string().min(1).optional(),
-	precision: zod.z.number().int().min(0).max(10).optional(),
-	icon: zod.z.string().min(1).optional()
-});
-/**
-* Serializable projection of a live IDevice.
-* Returned by listAll, getDevice, getChildren.
-* Live methods (getStreamSources, getConfigSchema) are separate calls.
-*/
-var DeviceInfoSchema = zod.z.object({
-	/** Progressive, system-wide unique number. Allocated synchronously by
-	*  `device-manager.allocateDeviceId` BEFORE the owning `IDevice` is
-	*  constructed, so every live device exposes an `id` — no transient
-	*  null window. Distinct from `stableId`, which is unique per
-	*  integration. Ids are monotonic and never reissued on removal. */
-	id: zod.z.number(),
-	stableId: zod.z.string(),
-	addonId: zod.z.string(),
-	type: zod.z.enum(require_sleep.DeviceType),
-	name: zod.z.string(),
-	/** Operator-organisational location label. `null` when unset. */
-	location: zod.z.string().nullable(),
-	/** Soft-disabled flag. */
-	disabled: zod.z.boolean(),
-	parentDeviceId: zod.z.number().nullable(),
-	/** Optional semantic role — `DeviceRole` string. null for top-level devices. */
-	role: zod.z.string().nullable().optional(),
-	online: zod.z.boolean(),
-	/** True when the device's initial feature-probe has completed (or it has
-	*  no probe) — exported shape is stable; exporters gate advertise on this.
-	*  Optional for deploy-order resilience: a record produced by an older
-	*  device-manager build omits it, and consumers treat absent as "not ready"
-	*  (export gate carries forward, never advertises a partial shape). */
-	probed: zod.z.boolean().optional(),
-	features: zod.z.array(zod.z.string()),
-	/** true when the device has a getStreamSources() method (ICameraDevice) */
-	isCamera: zod.z.boolean(),
-	/** Current config values — serializable snapshot */
+	/** true when the device has a getStreamSources() method (ICameraDevice) */
+	isCamera: zod.z.boolean(),
+	/** Current config values — serializable snapshot */
 	config: zod.z.record(zod.z.string(), zod.z.unknown()),
 	/** Hardware + identity blob (manufacturer / model / firmware / sn /
 	*  uid / mac / …). Populated by drivers; editable via setMetadata. */
@@ -7359,8 +6553,6 @@ var DeviceInfoSchema = zod.z.object({
 	*  named accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: zod.z.array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: zod.z.array(DeviceLinkSchema).readonly().optional(),
 	/** Operator-authored per-device display override. See `DeviceMeta.display`. */
 	display: DeviceDisplayOverrideSchema.optional()
 });
@@ -7369,7 +6561,7 @@ var ConfigEntrySchema = zod.z.object({
 	value: zod.z.unknown(),
 	description: zod.z.string().optional()
 });
-var DeviceLinkModeSchema = zod.z.enum(["auto", "manual"]);
+var LinkedDevicesModeSchema = zod.z.enum(["auto", "manual"]);
 /** One resolved linked device — the compact projection consumers need. */
 var LinkedDeviceSchema = zod.z.object({
 	deviceId: zod.z.number(),
@@ -7432,8 +6624,6 @@ var DeviceMetaSchema = zod.z.object({
 	*  accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: zod.z.array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: zod.z.array(DeviceLinkSchema).readonly().optional(),
 	/** Semantic role string (`DeviceRole`) — propagated from the spawn pre-seed.
 	*  Optional: only present for accessory children that carry a known role. */
 	role: zod.z.string().nullable().optional(),
@@ -7585,16 +6775,6 @@ var deviceManagerCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Set (or replace) the cross-device field wirings on a device's meta row.
-		*  Mirrors `setChildLayout`; persisted, projected, preserved across
-		*  re-register/restore. Idempotent. */
-		setDeviceLinks: require_sleep.method(zod.z.object({
-			deviceId: zod.z.number(),
-			deviceLinks: zod.z.array(DeviceLinkSchema).readonly()
-		}), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
 		/** Set (or clear) the per-device display override on the meta row. Mirrors
 		*  `setChildLayout` persistence; `null` clears the override entirely. The
 		*  override unit(s) are normalized (`normalizeUnit`) at write so the render
@@ -7618,15 +6798,15 @@ var deviceManagerCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** List the wireable status-schema fields per cap bound to a device.
-		*  Powers the Wiring tab's field pickers. Caps without a status schema are
-		*  omitted. Item-array caps (`status.itemArray`, e.g. consumables) also
-		*  emit their per-item fields tagged `item: true` (a link targeting one
-		*  must carry a `target.itemKey`) plus the cap-level `itemArray`
-		*  descriptor. `includeSynthesizable: true` (TARGET pickers only) unions
-		*  in unbound device-scoped caps that declare `status.empty` and match
-		*  the device's type — so the FIRST link to a synthesize-only cap
-		*  (consumables on an HA vacuum) can be authored. */
+		/** The per-cap catalog of readable status-schema fields for one device.
+		*  This is the SOURCE PICKER — it outlived the Wiring tab that first
+		*  needed it (deleted 2026-08-08) and becomes the picker of a composition
+		*  recipe: every field the old tab could target, a composed device can
+		*  read. Caps without a status schema are omitted. Item-array caps
+		*  (`status.itemArray`, e.g. consumables) also emit their per-item fields
+		*  tagged `item: true` plus the cap-level `itemArray` descriptor.
+		*  `includeSynthesizable: true` unions in unbound device-scoped caps that
+		*  declare `status.empty` and match the device's type. */
 		getWireableFields: require_sleep.method(zod.z.object({
 			deviceId: zod.z.number(),
 			includeSynthesizable: zod.z.boolean().optional()
@@ -7768,7 +6948,7 @@ var deviceManagerCapability = {
 		* (see the module docblock) — there are no bespoke link mutations.
 		*/
 		getLinkedDevices: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.object({
-			mode: DeviceLinkModeSchema,
+			mode: LinkedDevicesModeSchema,
 			devices: zod.z.array(LinkedDeviceSchema)
 		})),
 		/** Get stream sources for a camera device. */
@@ -7832,11 +7012,7 @@ var deviceManagerCapability = {
 			deviceId: zod.z.number(),
 			entries: zod.z.array(zod.z.object({
 				capName: zod.z.string(),
-				kind: zod.z.enum([
-					"native",
-					"wrapped",
-					"linked"
-				]),
+				kind: zod.z.enum(["native", "wrapped"]),
 				providerAddonId: zod.z.string(),
 				providerNodeId: zod.z.string(),
 				nativeAddonId: zod.z.string()
@@ -7854,11 +7030,7 @@ var deviceManagerCapability = {
 			deviceId: zod.z.number(),
 			entries: zod.z.array(zod.z.object({
 				capName: zod.z.string(),
-				kind: zod.z.enum([
-					"native",
-					"wrapped",
-					"linked"
-				]),
+				kind: zod.z.enum(["native", "wrapped"]),
 				providerAddonId: zod.z.string(),
 				providerNodeId: zod.z.string(),
 				nativeAddonId: zod.z.string()
@@ -9104,6 +8276,10 @@ var motionDetectionCapability = {
 	mode: "singleton",
 	kind: "wrapper",
 	defaultActive: true,
+	/** Frame-differencing motion analysis over a video stream — only a camera
+	*  produces the frames. Read by the `defaultActive` auto-bind in
+	*  `device-manager.getBindings` to decide which devices it may claim. */
+	deviceTypes: [require_sleep.DeviceType.Camera],
 	exposesDeviceSettings: true,
 	methods: {
 		analyze: require_sleep.method(zod.z.object({
@@ -12225,6 +11401,18 @@ var OauthIntegrationDescriptorSchema = zod.z.object({
 	*  redirect_uri that does not start with one of these. Required —
 	*  an empty list means the integration can never complete linking. */
 	allowedRedirectPrefixes: zod.z.array(zod.z.string()).min(1),
+	/** Paths accepted as a `redirect_uri` when the host is PRIVATE — loopback,
+	*  RFC1918, CGNAT (100.64/10, Tailscale), link-local, IPv6 ULA, or an
+	*  `.local` / `.internal` / `.ts.net` name. Exists for self-hosted clients
+	*  whose address the hub cannot know in advance (a Home Assistant at
+	*  `http://<lan-ip>:8123/auth/external/callback`). The PATH must match
+	*  exactly; a public host never satisfies this branch, so it is not a
+	*  wildcard prefix by another name. */
+	allowedPrivateHostPaths: zod.z.array(zod.z.string()).optional(),
+	/** When true this is a PUBLIC client (source is published, no secret can be
+	*  protected) and PKCE is mandatory: `/authorize` refuses without an S256
+	*  `code_challenge`, `/token` refuses without the matching `code_verifier`. */
+	requiresPkce: zod.z.boolean().optional(),
 	/** Optional public origin (no trailing slash) that this integration's
 	*  issued codes/tokens should carry as the `hubUrl` claim — typically the
 	*  operator-selected external-access endpoint resolved by the addon. When
@@ -12383,7 +11571,7 @@ var TrackEnvelopeSchema = zod.z.object({
 * `snapshots[]` references — megabytes across a page of tracks. `slim`
 * keeps every scalar the list surfaces actually render (ids, class(es),
 * label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
-* zonesVisited, bestEventId, envelope) and returns `positions` /
+* zonesVisited, bestEventId, envelope, hasFace) and returns `positions` /
 * `snapshots` as EMPTY arrays — detail views re-fetch the full row via
 * `getTrack`. Mirrors the event-store `projection` convention
 * (`getObjectEvents` et al.).
@@ -12636,6 +11824,24 @@ var TrackSchema = zod.z.object({
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
 	envelope: TrackEnvelopeSchema.optional(),
+	/**
+	* A face DETECTOR found a face on this track — nothing more. It says the
+	* detail plane produced a `face` detail; it does NOT say the face was
+	* embedded, matched, above `minFacePx`, or that the recognizer was even
+	* enabled. Set once and never cleared.
+	*
+	* **This exists so "face present but not recognised" is expressible.** A
+	* recognised identity lands in `subLabel` (attributed to the face chain via
+	* `subLabelMeta.stepId`), so before this field a track with an unmatched face
+	* and a track with no face at all were byte-identical on the wire and no
+	* surface could tell them apart. The read is `hasFace === true && subLabel
+	* === undefined`.
+	*
+	* **Absent ≠ false.** Every row written before the column existed omits it,
+	* and so does every server that predates the field — a consumer must test
+	* `=== true` and render nothing otherwise, never infer "no face".
+	*/
+	hasFace: zod.z.boolean().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -16577,6 +15783,10 @@ var SsoBridgeClaimsSchema = zod.z.object({
 	integrationId: zod.z.string().optional(),
 	/** JWT ID — unique per issued code; consumed-set enforces single-use. */
 	jti: zod.z.string().optional(),
+	/** PKCE S256 challenge — set only on `oauth-code` tokens issued to a public
+	*  client. Its PRESENCE is what makes the verifier mandatory at exchange,
+	*  so the requirement travels with the code and not with mutable config. */
+	codeChallenge: zod.z.string().optional(),
 	/** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
 	*  tokens so the verify path can check the session is not revoked. */
 	sessionId: zod.z.string().optional()
@@ -17349,6 +16559,10 @@ var videoclipsCapability = {
 	mode: "singleton",
 	kind: "wrapper",
 	defaultActive: true,
+	/** A clip is a window over a camera's footage — the cap is meaningless on a
+	*  sensor, a button or an event emitter, and the `defaultActive` auto-bind
+	*  reads this to decide which devices it may claim. */
+	deviceTypes: [require_sleep.DeviceType.Camera],
 	methods: {
 		listClips: require_sleep.method(zod.z.object({
 			deviceId: zod.z.number(),
@@ -19900,7 +19114,29 @@ var FaceInfoSchema = zod.z.object({
 	recognizedIdentityId: zod.z.string().optional(),
 	identityName: zod.z.string().optional(),
 	assigned: zod.z.boolean(),
+	/**
+	* The crop, inline, base64.
+	*
+	* **Prefer {@link cropUrl}.** At the 500 rows the Faces view asks for this
+	* field alone is ~2.87 MiB, re-sent in full on every operator assign and
+	* every 30 s poll, base64-inflated over the msgpack socket and held in the
+	* query heap. It stays for callers that have not migrated; `includeCrops:
+	* false` turns it off once they have.
+	*/
 	base64: zod.z.string().optional(),
+	/**
+	* Same crop, as a data-plane URL for `<img src>` — the move the admin
+	* snapshot surfaces made on 2026-08-08.
+	*
+	* Served by the `event-media` plane, which resolves a raw MediaStore key and
+	* is `access: 'authenticated'`: a bare `<img>` carries the `camstack_session`
+	* cookie, so no header plumbing is needed. The bytes then ride the browser's
+	* HTTP cache with an ETag and `immutable`, instead of the WebSocket.
+	*
+	* Absent when the face has no stored crop, or when the addon has no data
+	* plane — callers fall back to {@link base64}.
+	*/
+	cropUrl: zod.z.string().optional(),
 	/** Design B: the face bbox (pixel space) on the key frame — lets a detail
 	*  view draw the box over the native `keyFrameMediaKey` frame. Absent on
 	*  legacy rows written before design B. */
@@ -19976,7 +19212,23 @@ var faceGalleryCapability = {
 		}),
 		listRecentFaces: require_sleep.method(zod.z.object({
 			limit: zod.z.number().int().positive().optional(),
-			filter: FaceFilterEnum.optional()
+			filter: FaceFilterEnum.optional(),
+			/**
+			* Inline the base64 crop on every row. Default `true` — the existing
+			* behaviour, kept so no caller breaks.
+			*
+			* Set `false` once the caller renders {@link FaceInfo.cropUrl}: that
+			* drops ~2.87 MiB per 500-row page to a few KiB of metadata and lets
+			* the browser cache the images.
+			*
+			* **This is an INPUT field, so it does not reach the addon until the
+			* next train.** The hub router validates cap inputs against its own
+			* compiled Zod, which strips a key it does not know — verified today
+			* on the OUTPUT side, where an additive field DOES arrive immediately
+			* (`Track.hasFace`). Until the train ships, sending `false` is
+			* harmless and simply keeps the crops inline.
+			*/
+			includeCrops: zod.z.boolean().optional()
 		}).optional(), zod.z.array(FaceInfoSchema).readonly()),
 		getFaceByTrack: require_sleep.method(zod.z.object({
 			deviceId: zod.z.number().int(),
@@ -25489,14 +24741,19 @@ var userManagementCapability = {
 			username: zod.z.string(),
 			scopes: zod.z.array(TokenScopeSchema),
 			redirectUri: zod.z.string(),
-			hubUrl: zod.z.string()
+			hubUrl: zod.z.string(),
+			/** PKCE (RFC 7636) S256 challenge. Baked into the signed code; a code
+			*  that carries one can ONLY be exchanged with the matching verifier. */
+			codeChallenge: zod.z.string().optional()
 		}), zod.z.object({ code: zod.z.string() }), {
 			kind: "mutation",
 			access: "create"
 		}),
 		oauthExchangeCode: require_sleep.method(zod.z.object({
 			code: zod.z.string(),
-			redirectUri: zod.z.string()
+			redirectUri: zod.z.string(),
+			/** PKCE verifier. REQUIRED when the code carries a challenge. */
+			codeVerifier: zod.z.string().optional()
 		}), zod.z.object({
 			accessToken: zod.z.string(),
 			refreshToken: zod.z.string(),
@@ -27387,6 +26644,218 @@ var BaseDeviceProvider = class extends require_sleep.BaseAddon {
 	}
 };
 //#endregion
+//#region src/device/declared-device.ts
+/** Marker written to a declared integration's `info`. */
+var DECLARED_INTEGRATION_FIXED_KEY = "fixed";
+/**
+* Strip the `<node>/<addon>` suffix a forked child carries.
+*
+* Comparing `ctx.kernel.localNodeId` raw skipped EVERY node — including the one
+* that was supposed to act — because on the hub it reads `hub/<addon>`.
+*/
+function declarationOwnerNodeId(localNodeId) {
+	const raw = localNodeId ?? "hub";
+	if (!raw.includes("/")) return raw;
+	return raw.split("/")[0] ?? "hub";
+}
+/** Cap on how many rows one withdrawal pass may delete. */
+var DECLARED_DEVICE_SWEEP_LIMIT = 32;
+/**
+* The one way an addon owns a device it declares.
+*
+* Construct once with the addon's ports, then call {@link reconcile} on boot and
+* on every convergence tick. There is no second get-or-create helper — a guard
+* in `scripts/` enforces that.
+*/
+var DeclaredDevices = class {
+	ports;
+	constructor(ports) {
+		this.ports = ports;
+	}
+	/**
+	* Converge the declared set. Idempotent, and safe to call repeatedly.
+	*
+	* Throws only what the ports throw on the FIRST index read; every other
+	* failure is per-device and logged, so one bad declaration never takes the
+	* others down.
+	*/
+	async reconcile(spec) {
+		if ((spec.placement ?? "hub") === "hub") {
+			const nodeId = declarationOwnerNodeId(this.ports.localNodeId);
+			if (nodeId !== "hub") {
+				this.ports.logger.info("declared devices are hub-owned — skipping on this node", { meta: {
+					nodeId,
+					rawNodeId: this.ports.localNodeId ?? null
+				} });
+				return {
+					integrationId: null,
+					devices: [],
+					removed: [],
+					owned: false
+				};
+			}
+		}
+		const integrationId = await this.ensureIntegration(spec.integrationName);
+		const index = await this.readIndex();
+		const outcomes = [];
+		for (const declaration of spec.devices) {
+			const outcome = await this.applyDeclaration(declaration, integrationId, index);
+			if (outcome !== null) outcomes.push(outcome);
+		}
+		return {
+			integrationId,
+			devices: outcomes,
+			removed: await this.sweepWithdrawn(spec.devices, integrationId, index),
+			owned: true
+		};
+	}
+	/**
+	* Get-or-create the FIXED integration, and RE-ASSERT the flag every pass.
+	*
+	* The re-assertion is the fix for the defect the hand-rolled version shipped
+	* with: writing `info.fixed` only on the create path left every pre-existing
+	* install without it, and the kernel kept offering to delete an integration
+	* the addon owns.
+	*/
+	async ensureIntegration(integrationName) {
+		const existing = await this.ports.getIntegration(this.ports.addonId);
+		if (existing === null) {
+			const created = await this.ports.createIntegration({
+				addonId: this.ports.addonId,
+				name: integrationName,
+				info: { [DECLARED_INTEGRATION_FIXED_KEY]: true }
+			});
+			this.ports.logger.info("declared a fixed integration", { meta: {
+				integrationId: created.id,
+				name: integrationName
+			} });
+			return created.id;
+		}
+		if (existing.info?.["fixed"] !== true) {
+			await this.ports.updateIntegration({
+				id: existing.id,
+				info: { [DECLARED_INTEGRATION_FIXED_KEY]: true }
+			});
+			this.ports.logger.info("re-asserted `fixed` on a declared integration", { meta: { integrationId: existing.id } });
+		}
+		return existing.id;
+	}
+	async readIndex() {
+		const rows = await this.ports.listOwnDevices();
+		return new Map(rows.map((row) => [row.stableId, row]));
+	}
+	/**
+	* One declaration: adopt what exists, create what does not.
+	*
+	* The create branch is the destructive one — it seeds `initialMeta`, and
+	* `initialMeta.name` lands as an unconditional `setName`. A transiently empty
+	* index therefore looks exactly like a first boot and would silently re-stamp
+	* the declared name over the operator's rename. D49: that branch needs a
+	* second read to agree.
+	*/
+	async applyDeclaration(declaration, integrationId, index) {
+		try {
+			let existing = index.get(declaration.stableId);
+			if (existing === void 0) {
+				existing = (await this.readIndex()).get(declaration.stableId);
+				if (existing !== void 0) this.ports.logger.warn("device index disagreed with itself — adopting instead of re-creating", {
+					tags: { deviceId: existing.id },
+					meta: {
+						stableId: declaration.stableId,
+						addonId: this.ports.addonId
+					}
+				});
+			}
+			if (existing !== void 0) {
+				const device = await this.ports.devices.create(declaration.stableId, declaration.DeviceClass, {}, null, void 0);
+				this.ports.logger.info("declared device adopted", {
+					tags: { deviceId: device.id },
+					meta: {
+						stableId: declaration.stableId,
+						integrationId
+					}
+				});
+				return {
+					stableId: declaration.stableId,
+					deviceId: device.id,
+					device,
+					created: false
+				};
+			}
+			const device = await this.ports.devices.create(declaration.stableId, declaration.DeviceClass, declaration.config ?? {}, null, {
+				type: declaration.type,
+				name: declaration.name,
+				integrationId,
+				...declaration.role === void 0 ? {} : { role: declaration.role }
+			});
+			this.ports.logger.info("declared device created", {
+				tags: { deviceId: device.id },
+				meta: {
+					stableId: declaration.stableId,
+					integrationId
+				}
+			});
+			return {
+				stableId: declaration.stableId,
+				deviceId: device.id,
+				device,
+				created: true
+			};
+		} catch (err) {
+			this.ports.logger.warn("a declared device could not be brought up", { meta: {
+				stableId: declaration.stableId,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+			return null;
+		}
+	}
+	/**
+	* Remove rows under the addon's FIXED integration whose declaration is gone.
+	*
+	* Bounded to that integration: a declared integration has no operator
+	* add-flow, so every row under it got there by declaration. Devices this
+	* addon owns OUTSIDE it (a provider's adopted devices) are never candidates.
+	*
+	* Bounded in count, and every deletion is logged with its `deviceId` — a
+	* withdrawal that removes an operator-visible row silently is the failure
+	* mode, not the removal itself.
+	*/
+	async sweepWithdrawn(declarations, integrationId, index) {
+		const declared = new Set(declarations.map((d) => d.stableId));
+		const candidates = [...index.values()].filter((row) => row.integrationId === integrationId && !declared.has(row.stableId));
+		if (candidates.length === 0) return [];
+		if (candidates.length > 32) {
+			this.ports.logger.warn("withdrawal sweep exceeded its bound — removing nothing", { meta: {
+				integrationId,
+				candidates: candidates.length,
+				bound: 32
+			} });
+			return [];
+		}
+		const removed = [];
+		for (const row of candidates) try {
+			await this.ports.devices.remove(row.id);
+			removed.push(row.id);
+			this.ports.logger.info("declared device removed — its declaration was withdrawn", {
+				tags: { deviceId: row.id },
+				meta: {
+					stableId: row.stableId,
+					integrationId
+				}
+			});
+		} catch (err) {
+			this.ports.logger.warn("a withdrawn declared device could not be removed", {
+				tags: { deviceId: row.id },
+				meta: {
+					stableId: row.stableId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
+		return removed;
+	}
+};
+//#endregion
 //#region src/device/device-control-resolution.ts
 /**
 * Device-control RESOLUTION LOGIC — the single, presentation-free source of
@@ -27563,30 +27032,6 @@ function resolveMutate(router, method) {
 	return typeof mutate === "function" ? mutate : null;
 }
 //#endregion
-//#region src/device/device-link-transform.ts
-/** Apply a link transform to a resolved source value. `identity`/undefined
-*  pass through; `enum-map` remaps strings (fallback or null when unknown);
-*  `linear` does scale*x+offset with optional clamp (null for non-numbers). */
-function applyTransform(value, transform) {
-	if (!transform || transform.kind === "identity") return value;
-	if (transform.kind === "enum-map") {
-		const key = String(value);
-		if (Object.prototype.hasOwnProperty.call(transform.mapping, key)) return transform.mapping[key];
-		return transform.fallback ?? null;
-	}
-	if (transform.kind === "linear") {
-		if (typeof value !== "number" || Number.isNaN(value)) return null;
-		let out = value * transform.scale + transform.offset;
-		if (transform.clamp) {
-			const min = transform.clamp[0];
-			const max = transform.clamp[1];
-			out = Math.min(max, Math.max(min, out));
-		}
-		return out;
-	}
-	return value;
-}
-//#endregion
 //#region src/device/device-profile.ts
 /**
 * Heuristic check — `device.features?.includes(profile.when.hasFeature)`.
@@ -28115,501 +27560,1347 @@ var SystemMirror = class {
 			const proxy = this.getDeviceById(deviceId);
 			if (proxy) out.push(proxy);
 		}
-		return out;
-	}
-	/** Map every device's slice for `capName` to a derived value. Devices
-	*  without the cap or without a slice are skipped. */
-	mapState(capName, mapper) {
-		const out = [];
-		for (const [deviceId, perCap] of this.stateMirror) {
-			const slice = perCap.get(capName);
-			if (!slice) continue;
-			out.push(mapper(slice, deviceId));
+		return out;
+	}
+	/** Map every device's slice for `capName` to a derived value. Devices
+	*  without the cap or without a slice are skipped. */
+	mapState(capName, mapper) {
+		const out = [];
+		for (const [deviceId, perCap] of this.stateMirror) {
+			const slice = perCap.get(capName);
+			if (!slice) continue;
+			out.push(mapper(slice, deviceId));
+		}
+		return out;
+	}
+	/** First device whose slice matches `predicate`, or null. */
+	findState(capName, predicate) {
+		for (const [deviceId, perCap] of this.stateMirror) {
+			const slice = perCap.get(capName);
+			if (!slice) continue;
+			if (!predicate(slice, deviceId)) continue;
+			return this.getDeviceById(deviceId);
+		}
+		return null;
+	}
+	/** Count devices that bind a cap. Faster than `filterByCap(...).length`. */
+	countByCap(capName) {
+		let n = 0;
+		for (const binding of this.bindings.values()) if (binding.entries.some((e) => e.capName === capName)) n++;
+		return n;
+	}
+	/** Count devices whose slice for `capName` matches `predicate`. */
+	countByState(capName, predicate) {
+		let n = 0;
+		for (const [deviceId, perCap] of this.stateMirror) {
+			const slice = perCap.get(capName);
+			if (!slice) continue;
+			if (predicate(slice, deviceId)) n++;
+		}
+		return n;
+	}
+	/**
+	* Global listener — fires for every `device.state-changed` event the
+	* mirror absorbs.
+	*/
+	listen(cb) {
+		this.globalStateListeners.add(cb);
+		return () => {
+			this.globalStateListeners.delete(cb);
+		};
+	}
+	/**
+	* Per-cap listener — fires only for state changes on `capName`,
+	* across every device. The callback receives the deviceId so the
+	* caller can route.
+	*/
+	listenCap(capName, cb) {
+		let set = this.capListeners.get(capName);
+		if (!set) {
+			set = /* @__PURE__ */ new Set();
+			this.capListeners.set(capName, set);
+		}
+		set.add(cb);
+		return () => {
+			set.delete(cb);
+			if (set.size === 0) this.capListeners.delete(capName);
+		};
+	}
+	/**
+	* Per-device listener — fires for every cap change on `deviceId`.
+	*/
+	listenDevice(deviceId, cb) {
+		let set = this.deviceListeners.get(deviceId);
+		if (!set) {
+			set = /* @__PURE__ */ new Set();
+			this.deviceListeners.set(deviceId, set);
+		}
+		set.add(cb);
+		return () => {
+			set.delete(cb);
+			if (set.size === 0) this.deviceListeners.delete(deviceId);
+		};
+	}
+	/** Fires when `device.registered` lands. Receives the new metadata. */
+	onDeviceAdded(cb) {
+		this.addedListeners.add(cb);
+		return () => {
+			this.addedListeners.delete(cb);
+		};
+	}
+	/** Fires when `device.unregistered` lands. `info` is the LAST-known
+	*  metadata (or null if the device was never seen). */
+	onDeviceRemoved(cb) {
+		this.removedListeners.add(cb);
+		return () => {
+			this.removedListeners.delete(cb);
+		};
+	}
+	/**
+	* Resolve when `predicate` over the runtime-state slice for
+	* `(deviceId, capName)` becomes true. Resolves immediately if the
+	* current slice already matches. Rejects with `Error('timeout')`
+	* after `timeoutMs` (default 30s; pass `Infinity` to wait forever).
+	*
+	* Returns the matching slice — caller can read it directly without
+	* a second mirror lookup.
+	*/
+	waitForState(deviceId, capName, predicate, timeoutMs = 3e4) {
+		return new Promise((resolve, reject) => {
+			const check = () => {
+				const slice = this.stateMirror.get(deviceId)?.get(capName);
+				if (slice && predicate(slice)) return slice;
+				return null;
+			};
+			const initial = check();
+			if (initial) {
+				resolve(initial);
+				return;
+			}
+			let timer = null;
+			const off = this.listenDevice(deviceId, (_id, cap, slice) => {
+				if (cap !== capName) return;
+				if (!slice) return;
+				if (predicate(slice)) {
+					if (timer) clearTimeout(timer);
+					off();
+					resolve(slice);
+				}
+			});
+			if (Number.isFinite(timeoutMs)) timer = setTimeout(() => {
+				off();
+				reject(/* @__PURE__ */ new Error(`waitForState timed out after ${timeoutMs}ms (deviceId=${deviceId}, capName=${capName})`));
+			}, timeoutMs);
+		});
+	}
+	/**
+	* Resolve when a device with `deviceId` becomes available (a
+	* binding exists). Resolves immediately if already known. Rejects
+	* with timeout.
+	*/
+	waitForDevice(deviceId, timeoutMs = 3e4) {
+		return new Promise((resolve, reject) => {
+			const existing = this.getDeviceById(deviceId);
+			if (existing) {
+				resolve(existing);
+				return;
+			}
+			let timer = null;
+			const off = this.onDeviceAdded((id) => {
+				if (id !== deviceId) return;
+				const proxy = this.getDeviceById(id);
+				if (!proxy) return;
+				if (timer) clearTimeout(timer);
+				off();
+				resolve(proxy);
+			});
+			if (Number.isFinite(timeoutMs)) timer = setTimeout(() => {
+				off();
+				reject(/* @__PURE__ */ new Error(`waitForDevice timed out after ${timeoutMs}ms (deviceId=${deviceId})`));
+			}, timeoutMs);
+		});
+	}
+	/**
+	* Iterate every device that binds `capName`. Awaits each callback
+	* sequentially — for parallel use `invokeCap` with explicit
+	* parallelism.
+	*/
+	async forEachCap(capName, cb) {
+		for (const proxy of this.filterByCap(capName)) await cb(proxy);
+	}
+	/**
+	* Invoke a cap method on every device that binds the cap. Returns
+	* one result per device, success or failure isolated. Optional
+	* parallelism cap — useful for "snapshot all cameras but only 4
+	* at a time so battery cams don't all wake at once".
+	*
+	* Example:
+	*
+	*   const results = await sm.invokeCap('snapshot', 'getSnapshot', {}, { parallelism: 4 })
+	*   const failed = results.filter(r => !r.ok)
+	*/
+	async invokeCap(capName, methodName, args, opts = {}) {
+		const targets = this.filterByCap(capName);
+		const parallelism = Math.max(1, opts.parallelism ?? targets.length);
+		const out = [];
+		for (let i = 0; i < targets.length; i += parallelism) {
+			const chunk = targets.slice(i, i + parallelism);
+			const settled = await Promise.allSettled(chunk.map(async (proxy) => {
+				const cap = proxy[capName];
+				if (!cap || typeof cap[methodName] !== "function") throw new Error(`device '${proxy.deviceId}' does not expose '${capName}.${methodName}'`);
+				return await cap[methodName](args);
+			}));
+			for (let j = 0; j < settled.length; j++) {
+				const proxy = chunk[j];
+				const r = settled[j];
+				if (r.status === "fulfilled") out.push({
+					deviceId: proxy.deviceId,
+					ok: true,
+					result: r.value
+				});
+				else out.push({
+					deviceId: proxy.deviceId,
+					ok: false,
+					error: r.reason
+				});
+			}
+		}
+		return out;
+	}
+	/**
+	* One-shot summary — fleet size, breakdown by cap / addon / type.
+	* Designed for REPL inspection (`sm.summary()`).
+	*/
+	summary() {
+		const byCap = {};
+		const byAddon = {};
+		const byType = {};
+		let online = 0;
+		let offline = 0;
+		for (const binding of this.bindings.values()) for (const entry of binding.entries) byCap[entry.capName] = (byCap[entry.capName] ?? 0) + 1;
+		for (const info of this.devices.values()) {
+			byAddon[info.addonId] = (byAddon[info.addonId] ?? 0) + 1;
+			byType[info.type] = (byType[info.type] ?? 0) + 1;
+			if (info.online) online++;
+			else offline++;
+		}
+		return {
+			totalDevices: this.bindings.size,
+			online,
+			offline,
+			byCap,
+			byAddon,
+			byType,
+			statedDevices: this.stateMirror.size
+		};
+	}
+	/**
+	* Debug-friendly dump — full state + binding + metadata for one
+	* device or all devices. Cheap deep clone so caller mutations don't
+	* leak into the mirror.
+	*/
+	dump(deviceId) {
+		const dumpOne = (id) => {
+			const info = this.devices.get(id) ?? null;
+			const binding = this.bindings.get(id) ?? null;
+			const state = {};
+			const perCap = this.stateMirror.get(id);
+			if (perCap) for (const [cap, slice] of perCap) state[cap] = { ...slice };
+			return {
+				deviceId: id,
+				info,
+				binding: binding ? {
+					...binding,
+					entries: binding.entries.map((e) => ({ ...e }))
+				} : null,
+				state
+			};
+		};
+		if (deviceId !== void 0) return dumpOne(deviceId);
+		const out = [];
+		for (const id of this.bindings.keys()) out.push(dumpOne(id));
+		return out;
+	}
+	/**
+	* Direct read-only access to the underlying state mirror. Use
+	* sparingly — `getSystemState` returns a deep copy that's safer for
+	* exploratory work; this avoids the clone cost when iterating
+	* thousands of slices.
+	*/
+	getRawMirror() {
+		return this.stateMirror;
+	}
+	/**
+	* Snapshot of the full state mirror — same shape as the warm-boot
+	* payload. Deep-cloned; safe to mutate.
+	*/
+	getSystemState() {
+		const copy = /* @__PURE__ */ new Map();
+		for (const [id, perCap] of this.stateMirror) {
+			const dup = /* @__PURE__ */ new Map();
+			for (const [k, v] of perCap) dup.set(k, { ...v });
+			copy.set(id, dup);
+		}
+		return copy;
+	}
+	subscribeBus() {
+		if (!this.api.live?.onEvent) return;
+		const sub = this.api.live.onEvent;
+		this.bridges.push(sub.subscribe({ category: STATE_CHANGED_CATEGORY }, { onData: (evt) => {
+			const data = evt.data;
+			if (!data || typeof data.deviceId !== "number" || typeof data.capName !== "string") return;
+			this.applyStateUpdate(data.deviceId, data.capName, data.slice);
+		} }));
+		this.bridges.push(sub.subscribe({ category: BINDING_CHANGED_CATEGORY }, { onData: (evt) => {
+			const data = evt.data;
+			const deviceId = typeof data?.deviceId === "number" ? data.deviceId : data?.source?.type === "device" && typeof data.source.id === "number" ? data.source.id : null;
+			if (deviceId === null) return;
+			this.refreshBinding(deviceId);
+		} }));
+		this.bridges.push(sub.subscribe({ category: DEVICE_REGISTERED_CATEGORY }, { onData: (evt) => {
+			const data = evt.data;
+			if (typeof data?.deviceId !== "number") return;
+			this.refreshDeviceMetadata(data.deviceId, "added");
+		} }));
+		this.bridges.push(sub.subscribe({ category: DEVICE_UNREGISTERED_CATEGORY }, { onData: (evt) => {
+			const data = evt.data;
+			if (typeof data?.deviceId !== "number") return;
+			this.applyDeviceRemoval(data.deviceId);
+		} }));
+		this.bridges.push(sub.subscribe({ category: DEVICE_UPDATED_CATEGORY }, { onData: (evt) => {
+			const data = evt.data;
+			if (typeof data?.deviceId !== "number") return;
+			this.refreshDeviceMetadata(data.deviceId, "updated");
+		} }));
+	}
+	applyStateUpdate(deviceId, capName, slice) {
+		let perCap = this.stateMirror.get(deviceId);
+		if (!perCap) {
+			perCap = /* @__PURE__ */ new Map();
+			this.stateMirror.set(deviceId, perCap);
+		}
+		if (slice === void 0) perCap.delete(capName);
+		else perCap.set(capName, slice);
+		const handleKey = `${deviceId}:${capName}`;
+		const handleSet = this.handleListeners.get(handleKey);
+		if (handleSet) for (const cb of handleSet) try {
+			cb(slice);
+		} catch {}
+		for (const cb of this.globalStateListeners) try {
+			cb(deviceId, capName, slice);
+		} catch {}
+		const capSet = this.capListeners.get(capName);
+		if (capSet) for (const cb of capSet) try {
+			cb(deviceId, slice);
+		} catch {}
+		const devSet = this.deviceListeners.get(deviceId);
+		if (devSet) for (const cb of devSet) try {
+			cb(deviceId, capName, slice);
+		} catch {}
+	}
+	applyDeviceRemoval(deviceId) {
+		const lastInfo = this.devices.get(deviceId) ?? null;
+		this.bindings.delete(deviceId);
+		this.devices.delete(deviceId);
+		this.stateMirror.delete(deviceId);
+		for (const cb of this.removedListeners) try {
+			cb(deviceId, lastInfo);
+		} catch {}
+	}
+	async refreshBinding(deviceId) {
+		try {
+			const fresh = (await this.api.deviceManager.getAllBindings.query({})).find((b) => b.deviceId === deviceId);
+			if (fresh) this.bindings.set(deviceId, fresh);
+			else this.applyDeviceRemoval(deviceId);
+		} catch {}
+	}
+	async refreshDeviceMetadata(deviceId, kind) {
+		try {
+			const info = await this.api.deviceManager.getDevice.query({ deviceId });
+			if (!info) return;
+			const wasNew = !this.devices.has(deviceId);
+			this.devices.set(deviceId, info);
+			if (kind === "added" && wasNew) {
+				await this.refreshBinding(deviceId);
+				for (const cb of this.addedListeners) try {
+					cb(deviceId, info);
+				} catch {}
+			}
+		} catch {}
+	}
+};
+function inSet(value, set) {
+	if (Array.isArray(set)) return set.includes(value);
+	return value === set;
+}
+function toArray(value) {
+	return Array.isArray(value) ? value : [value];
+}
+function matchesString(haystack, match) {
+	if (typeof match === "string") return haystack === match;
+	if (match instanceof RegExp) return match.test(haystack);
+	if ("exact" in match) return haystack === match.exact;
+	if ("contains" in match) return haystack.toLowerCase().includes(match.contains.toLowerCase());
+	return false;
+}
+//#endregion
+//#region src/device/zod-to-config-ui.ts
+/** Access Zod v4 internal .def — not in public typings but stable at runtime */
+function zodDef(schema) {
+	return schema.def;
+}
+/** Access internal properties on a Zod schema instance */
+function zodInternals(schema) {
+	return schema;
+}
+/**
+* Convert DeviceConfig.entries() output to ConfigUISchema for the admin UI FormBuilder.
+*
+* Each entry's Zod type is inspected to determine the correct ConfigField type:
+* - ZodString → 'text' (or 'password' when key contains "password"/"secret"/"token"/"apikey")
+* - ZodNumber → 'number' (extracts min/max/step from Zod v4 checks)
+* - ZodBoolean → 'boolean'
+* - ZodEnum → 'select' (options built from enum values)
+* - Anything else → 'text' fallback
+*
+* Wrapper types ZodDefault, ZodOptional, and ZodNullable are unwrapped transparently.
+* Default values are extracted from ZodDefault wrappers.
+*/
+function zodEntriesToConfigUI(entries, sectionTitle = "Configuration", sectionId = "main") {
+	return { sections: [{
+		id: sectionId,
+		title: sectionTitle,
+		fields: entries.map((entry) => zodToConfigField(entry.key, entry.schema, entry.description))
+	}] };
+}
+function zodToConfigField(key, schema, description) {
+	const inner = unwrapZod(schema);
+	const defaultValue = getZodDefault(schema);
+	const base = {
+		key,
+		label: description ?? humanizeKey(key),
+		description,
+		default: defaultValue
+	};
+	if (inner instanceof zod.z.ZodString) return buildStringField(key, base);
+	if (inner instanceof zod.z.ZodNumber) return buildNumberField(inner, base);
+	if (inner instanceof zod.z.ZodBoolean) return {
+		...base,
+		type: "boolean"
+	};
+	if (inner instanceof zod.z.ZodEnum) return buildEnumField(inner, base);
+	if (inner instanceof zod.z.ZodArray || inner instanceof zod.z.ZodObject) return {
+		...base,
+		type: "textarea",
+		rows: 6,
+		isJson: true
+	};
+	return {
+		...base,
+		type: "text"
+	};
+}
+function buildStringField(key, base) {
+	const lowerKey = key.toLowerCase();
+	if (lowerKey.includes("password") || lowerKey.includes("secret") || lowerKey.includes("token") || lowerKey.includes("apikey") || lowerKey.includes("api_key")) return {
+		...base,
+		type: "password",
+		showToggle: true
+	};
+	return {
+		...base,
+		type: "text"
+	};
+}
+function buildNumberField(inner, base) {
+	const anyInner = zodInternals(inner);
+	const rawMin = anyInner.minValue;
+	const rawMax = anyInner.maxValue;
+	const min = rawMin != null && isFinite(rawMin) ? rawMin : void 0;
+	const max = rawMax != null && isFinite(rawMax) ? rawMax : void 0;
+	const step = getMultipleOfStep(inner);
+	return {
+		...base,
+		type: "number",
+		...min !== void 0 ? { min } : {},
+		...max !== void 0 ? { max } : {},
+		...step !== void 0 ? { step } : {}
+	};
+}
+function getMultipleOfStep(inner) {
+	const checks = zodDef(inner).checks ?? [];
+	for (const check of checks) if (check._zod?.def?.check === "multiple_of" && check._zod.def.value !== void 0) return check._zod.def.value;
+}
+function buildEnumField(inner, base) {
+	const values = inner.options.map((v) => String(v));
+	return {
+		...base,
+		type: "select",
+		options: values.map((v) => ({
+			label: humanizeKey(v),
+			value: v
+		}))
+	};
+}
+function unwrapZod(schema) {
+	if (schema instanceof zod.z.ZodDefault) return unwrapZod(zodDef(schema).innerType);
+	if (schema instanceof zod.z.ZodOptional) return unwrapZod(zodDef(schema).innerType);
+	if (schema instanceof zod.z.ZodNullable) return unwrapZod(zodDef(schema).innerType);
+	return schema;
+}
+function getZodDefault(schema) {
+	if (schema instanceof zod.z.ZodDefault) return zodDef(schema).defaultValue;
+}
+function humanizeKey(key) {
+	return key.replace(/([A-Z])/g, " $1").replace(/[_-]/g, " ").replace(/^\w/, (c) => c.toUpperCase()).trim();
+}
+//#endregion
+//#region src/expression/errors.ts
+/**
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
+*/
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
+//#endregion
+//#region src/expression/builtins.ts
+/**
+* Frozen, null-prototype builtin function table for the expression engine
+* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
+* parser rejects any callee not in it, and the evaluator gates each call on an
+* own-property check against it.
+*
+* Because the object has a NULL prototype AND is `Object.freeze`d:
+*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
+*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
+*    (there is no `Object.prototype` in the chain), so those names are not
+*    callable — they are simply "unknown function" at parse time.
+*
+* Every numeric argument is validated as a finite number and every numeric
+* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
+* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
+* closed rather than emitting a garbage value.
+*/
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString$1(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString$1(args[1], "convert", 1).trim();
+			const to = asString$1(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
+	}
+};
+/** Frozen, null-prototype builtin table. */
+var EXPRESSION_BUILTINS = Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
+//#endregion
+//#region src/expression/limits.ts
+/**
+* Resource-bound constants for the safe expression engine.
+*
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
+*/
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** Max AST nodes — checked during parse; a deeply nested grouping that exceeds
+*  this is rejected as "expression too complex". */
+var MAX_EXPRESSION_AST_NODES = 256;
+/** Defense-in-depth walker step budget — one increment per node visit during
+*  evaluation. The grammar guarantees O(nodeCount) walks, so this can only trip
+*  on a crafted maximum-size AST. */
+var MAX_EXPRESSION_EVAL_STEPS = 4096;
+/** Max named bindings on one {@link ExpressionSource}. */
+var MAX_EXPRESSION_BINDINGS = 32;
+/** Max positional arguments to any builtin call. */
+var MAX_EXPRESSION_CALL_ARGS = 16;
+/** LRU compile-cache capacity (parsed ASTs keyed by raw source string). */
+var EXPRESSION_COMPILE_CACHE_CAPACITY = 256;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
+]);
+//#endregion
+//#region src/expression/tokenizer.ts
+/**
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
+*/
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
 		}
-		return out;
-	}
-	/** First device whose slice matches `predicate`, or null. */
-	findState(capName, predicate) {
-		for (const [deviceId, perCap] of this.stateMirror) {
-			const slice = perCap.get(capName);
-			if (!slice) continue;
-			if (!predicate(slice, deviceId)) continue;
-			return this.getDeviceById(deviceId);
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
 		}
-		return null;
-	}
-	/** Count devices that bind a cap. Faster than `filterByCap(...).length`. */
-	countByCap(capName) {
-		let n = 0;
-		for (const binding of this.bindings.values()) if (binding.entries.some((e) => e.capName === capName)) n++;
-		return n;
-	}
-	/** Count devices whose slice for `capName` matches `predicate`. */
-	countByState(capName, predicate) {
-		let n = 0;
-		for (const [deviceId, perCap] of this.stateMirror) {
-			const slice = perCap.get(capName);
-			if (!slice) continue;
-			if (predicate(slice, deviceId)) n++;
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
 		}
-		return n;
-	}
-	/**
-	* Global listener — fires for every `device.state-changed` event the
-	* mirror absorbs.
-	*/
-	listen(cb) {
-		this.globalStateListeners.add(cb);
-		return () => {
-			this.globalStateListeners.delete(cb);
-		};
-	}
-	/**
-	* Per-cap listener — fires only for state changes on `capName`,
-	* across every device. The callback receives the deviceId so the
-	* caller can route.
-	*/
-	listenCap(capName, cb) {
-		let set = this.capListeners.get(capName);
-		if (!set) {
-			set = /* @__PURE__ */ new Set();
-			this.capListeners.set(capName, set);
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
 		}
-		set.add(cb);
-		return () => {
-			set.delete(cb);
-			if (set.size === 0) this.capListeners.delete(capName);
-		};
-	}
-	/**
-	* Per-device listener — fires for every cap change on `deviceId`.
-	*/
-	listenDevice(deviceId, cb) {
-		let set = this.deviceListeners.get(deviceId);
-		if (!set) {
-			set = /* @__PURE__ */ new Set();
-			this.deviceListeners.set(deviceId, set);
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
 		}
-		set.add(cb);
-		return () => {
-			set.delete(cb);
-			if (set.size === 0) this.deviceListeners.delete(deviceId);
-		};
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
 	}
-	/** Fires when `device.registered` lands. Receives the new metadata. */
-	onDeviceAdded(cb) {
-		this.addedListeners.add(cb);
-		return () => {
-			this.addedListeners.delete(cb);
-		};
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
+//#endregion
+//#region src/expression/parser.ts
+/**
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
+*
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
+*
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+*/
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
 	}
-	/** Fires when `device.unregistered` lands. `info` is the LAST-known
-	*  metadata (or null if the device was never seen). */
-	onDeviceRemoved(cb) {
-		this.removedListeners.add(cb);
-		return () => {
-			this.removedListeners.delete(cb);
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
 		};
 	}
-	/**
-	* Resolve when `predicate` over the runtime-state slice for
-	* `(deviceId, capName)` becomes true. Resolves immediately if the
-	* current slice already matches. Rejects with `Error('timeout')`
-	* after `timeoutMs` (default 30s; pass `Infinity` to wait forever).
-	*
-	* Returns the matching slice — caller can read it directly without
-	* a second mirror lookup.
-	*/
-	waitForState(deviceId, capName, predicate, timeoutMs = 3e4) {
-		return new Promise((resolve, reject) => {
-			const check = () => {
-				const slice = this.stateMirror.get(deviceId)?.get(capName);
-				if (slice && predicate(slice)) return slice;
-				return null;
-			};
-			const initial = check();
-			if (initial) {
-				resolve(initial);
-				return;
-			}
-			let timer = null;
-			const off = this.listenDevice(deviceId, (_id, cap, slice) => {
-				if (cap !== capName) return;
-				if (!slice) return;
-				if (predicate(slice)) {
-					if (timer) clearTimeout(timer);
-					off();
-					resolve(slice);
-				}
-			});
-			if (Number.isFinite(timeoutMs)) timer = setTimeout(() => {
-				off();
-				reject(/* @__PURE__ */ new Error(`waitForState timed out after ${timeoutMs}ms (deviceId=${deviceId}, capName=${capName})`));
-			}, timeoutMs);
-		});
+	peek() {
+		return this.tokens[this.pos];
 	}
-	/**
-	* Resolve when a device with `deviceId` becomes available (a
-	* binding exists). Resolves immediately if already known. Rejects
-	* with timeout.
-	*/
-	waitForDevice(deviceId, timeoutMs = 3e4) {
-		return new Promise((resolve, reject) => {
-			const existing = this.getDeviceById(deviceId);
-			if (existing) {
-				resolve(existing);
-				return;
-			}
-			let timer = null;
-			const off = this.onDeviceAdded((id) => {
-				if (id !== deviceId) return;
-				const proxy = this.getDeviceById(id);
-				if (!proxy) return;
-				if (timer) clearTimeout(timer);
-				off();
-				resolve(proxy);
-			});
-			if (Number.isFinite(timeoutMs)) timer = setTimeout(() => {
-				off();
-				reject(/* @__PURE__ */ new Error(`waitForDevice timed out after ${timeoutMs}ms (deviceId=${deviceId})`));
-			}, timeoutMs);
-		});
+	next() {
+		return this.tokens[this.pos++];
 	}
-	/**
-	* Iterate every device that binds `capName`. Awaits each callback
-	* sequentially — for parallel use `invokeCap` with explicit
-	* parallelism.
-	*/
-	async forEachCap(capName, cb) {
-		for (const proxy of this.filterByCap(capName)) await cb(proxy);
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
 	}
-	/**
-	* Invoke a cap method on every device that binds the cap. Returns
-	* one result per device, success or failure isolated. Optional
-	* parallelism cap — useful for "snapshot all cameras but only 4
-	* at a time so battery cams don't all wake at once".
-	*
-	* Example:
-	*
-	*   const results = await sm.invokeCap('snapshot', 'getSnapshot', {}, { parallelism: 4 })
-	*   const failed = results.filter(r => !r.ok)
-	*/
-	async invokeCap(capName, methodName, args, opts = {}) {
-		const targets = this.filterByCap(capName);
-		const parallelism = Math.max(1, opts.parallelism ?? targets.length);
-		const out = [];
-		for (let i = 0; i < targets.length; i += parallelism) {
-			const chunk = targets.slice(i, i + parallelism);
-			const settled = await Promise.allSettled(chunk.map(async (proxy) => {
-				const cap = proxy[capName];
-				if (!cap || typeof cap[methodName] !== "function") throw new Error(`device '${proxy.deviceId}' does not expose '${capName}.${methodName}'`);
-				return await cap[methodName](args);
-			}));
-			for (let j = 0; j < settled.length; j++) {
-				const proxy = chunk[j];
-				const r = settled[j];
-				if (r.status === "fulfilled") out.push({
-					deviceId: proxy.deviceId,
-					ok: true,
-					result: r.value
-				});
-				else out.push({
-					deviceId: proxy.deviceId,
-					ok: false,
-					error: r.reason
-				});
-			}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
 		}
-		return out;
+		return false;
 	}
-	/**
-	* One-shot summary — fleet size, breakdown by cap / addon / type.
-	* Designed for REPL inspection (`sm.summary()`).
-	*/
-	summary() {
-		const byCap = {};
-		const byAddon = {};
-		const byType = {};
-		let online = 0;
-		let offline = 0;
-		for (const binding of this.bindings.values()) for (const entry of binding.entries) byCap[entry.capName] = (byCap[entry.capName] ?? 0) + 1;
-		for (const info of this.devices.values()) {
-			byAddon[info.addonId] = (byAddon[info.addonId] ?? 0) + 1;
-			byType[info.type] = (byType[info.type] ?? 0) + 1;
-			if (info.online) online++;
-			else offline++;
-		}
-		return {
-			totalDevices: this.bindings.size,
-			online,
-			offline,
-			byCap,
-			byAddon,
-			byType,
-			statedDevices: this.stateMirror.size
-		};
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
 	}
-	/**
-	* Debug-friendly dump — full state + binding + metadata for one
-	* device or all devices. Cheap deep clone so caller mutations don't
-	* leak into the mirror.
-	*/
-	dump(deviceId) {
-		const dumpOne = (id) => {
-			const info = this.devices.get(id) ?? null;
-			const binding = this.bindings.get(id) ?? null;
-			const state = {};
-			const perCap = this.stateMirror.get(id);
-			if (perCap) for (const [cap, slice] of perCap) state[cap] = { ...slice };
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
 			return {
-				deviceId: id,
-				info,
-				binding: binding ? {
-					...binding,
-					entries: binding.entries.map((e) => ({ ...e }))
-				} : null,
-				state
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
 			};
-		};
-		if (deviceId !== void 0) return dumpOne(deviceId);
-		const out = [];
-		for (const id of this.bindings.keys()) out.push(dumpOne(id));
-		return out;
-	}
-	/**
-	* Direct read-only access to the underlying state mirror. Use
-	* sparingly — `getSystemState` returns a deep copy that's safer for
-	* exploratory work; this avoids the clone cost when iterating
-	* thousands of slices.
-	*/
-	getRawMirror() {
-		return this.stateMirror;
+		}
+		return test;
 	}
-	/**
-	* Snapshot of the full state mirror — same shape as the warm-boot
-	* payload. Deep-cloned; safe to mutate.
-	*/
-	getSystemState() {
-		const copy = /* @__PURE__ */ new Map();
-		for (const [id, perCap] of this.stateMirror) {
-			const dup = /* @__PURE__ */ new Map();
-			for (const [k, v] of perCap) dup.set(k, { ...v });
-			copy.set(id, dup);
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
 		}
-		return copy;
+		return this.parsePrimary();
 	}
-	subscribeBus() {
-		if (!this.api.live?.onEvent) return;
-		const sub = this.api.live.onEvent;
-		this.bridges.push(sub.subscribe({ category: STATE_CHANGED_CATEGORY }, { onData: (evt) => {
-			const data = evt.data;
-			if (!data || typeof data.deviceId !== "number" || typeof data.capName !== "string") return;
-			this.applyStateUpdate(data.deviceId, data.capName, data.slice);
-		} }));
-		this.bridges.push(sub.subscribe({ category: BINDING_CHANGED_CATEGORY }, { onData: (evt) => {
-			const data = evt.data;
-			const deviceId = typeof data?.deviceId === "number" ? data.deviceId : data?.source?.type === "device" && typeof data.source.id === "number" ? data.source.id : null;
-			if (deviceId === null) return;
-			this.refreshBinding(deviceId);
-		} }));
-		this.bridges.push(sub.subscribe({ category: DEVICE_REGISTERED_CATEGORY }, { onData: (evt) => {
-			const data = evt.data;
-			if (typeof data?.deviceId !== "number") return;
-			this.refreshDeviceMetadata(data.deviceId, "added");
-		} }));
-		this.bridges.push(sub.subscribe({ category: DEVICE_UNREGISTERED_CATEGORY }, { onData: (evt) => {
-			const data = evt.data;
-			if (typeof data?.deviceId !== "number") return;
-			this.applyDeviceRemoval(data.deviceId);
-		} }));
-		this.bridges.push(sub.subscribe({ category: DEVICE_UPDATED_CATEGORY }, { onData: (evt) => {
-			const data = evt.data;
-			if (typeof data?.deviceId !== "number") return;
-			this.refreshDeviceMetadata(data.deviceId, "updated");
-		} }));
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
+				};
+			}
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
 	}
-	applyStateUpdate(deviceId, capName, slice) {
-		let perCap = this.stateMirror.get(deviceId);
-		if (!perCap) {
-			perCap = /* @__PURE__ */ new Map();
-			this.stateMirror.set(deviceId, perCap);
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
 		}
-		if (slice === void 0) perCap.delete(capName);
-		else perCap.set(capName, slice);
-		const handleKey = `${deviceId}:${capName}`;
-		const handleSet = this.handleListeners.get(handleKey);
-		if (handleSet) for (const cb of handleSet) try {
-			cb(slice);
-		} catch {}
-		for (const cb of this.globalStateListeners) try {
-			cb(deviceId, capName, slice);
-		} catch {}
-		const capSet = this.capListeners.get(capName);
-		if (capSet) for (const cb of capSet) try {
-			cb(deviceId, slice);
-		} catch {}
-		const devSet = this.deviceListeners.get(deviceId);
-		if (devSet) for (const cb of devSet) try {
-			cb(deviceId, capName, slice);
-		} catch {}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
 	}
-	applyDeviceRemoval(deviceId) {
-		const lastInfo = this.devices.get(deviceId) ?? null;
-		this.bindings.delete(deviceId);
-		this.devices.delete(deviceId);
-		this.stateMirror.delete(deviceId);
-		for (const cb of this.removedListeners) try {
-			cb(deviceId, lastInfo);
-		} catch {}
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
+//#endregion
+//#region src/expression/compile.ts
+/**
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
+*
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
+*/
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
 	}
-	async refreshBinding(deviceId) {
-		try {
-			const fresh = (await this.api.deviceManager.getAllBindings.query({})).find((b) => b.deviceId === deviceId);
-			if (fresh) this.bindings.set(deviceId, fresh);
-			else this.applyDeviceRemoval(deviceId);
-		} catch {}
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
 	}
-	async refreshDeviceMetadata(deviceId, kind) {
-		try {
-			const info = await this.api.deviceManager.getDevice.query({ deviceId });
-			if (!info) return;
-			const wasNew = !this.devices.has(deviceId);
-			this.devices.set(deviceId, info);
-			if (kind === "added" && wasNew) {
-				await this.refreshBinding(deviceId);
-				for (const cb of this.addedListeners) try {
-					cb(deviceId, info);
-				} catch {}
-			}
-		} catch {}
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
 	}
-};
-function inSet(value, set) {
-	if (Array.isArray(set)) return set.includes(value);
-	return value === set;
+	return result;
 }
-function toArray(value) {
-	return Array.isArray(value) ? value : [value];
+/** Compile `source` to a `ParsedExpression`, throwing `ExpressionParseError`
+*  on failure. LRU/negative-cached. */
+function compileExpression(source) {
+	const result = getCached(source);
+	if (result.ok) return result.parsed;
+	throw new ExpressionParseError(result.error);
 }
-function matchesString(haystack, match) {
-	if (typeof match === "string") return haystack === match;
-	if (match instanceof RegExp) return match.test(haystack);
-	if ("exact" in match) return haystack === match.exact;
-	if ("contains" in match) return haystack.toLowerCase().includes(match.contains.toLowerCase());
-	return false;
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
 }
 //#endregion
-//#region src/device/zod-to-config-ui.ts
-/** Access Zod v4 internal .def — not in public typings but stable at runtime */
-function zodDef(schema) {
-	return schema.def;
-}
-/** Access internal properties on a Zod schema instance */
-function zodInternals(schema) {
-	return schema;
-}
+//#region src/expression/evaluator.ts
 /**
-* Convert DeviceConfig.entries() output to ConfigUISchema for the admin UI FormBuilder.
-*
-* Each entry's Zod type is inspected to determine the correct ConfigField type:
-* - ZodString → 'text' (or 'password' when key contains "password"/"secret"/"token"/"apikey")
-* - ZodNumber → 'number' (extracts min/max/step from Zod v4 checks)
-* - ZodBoolean → 'boolean'
-* - ZodEnum → 'select' (options built from enum values)
-* - Anything else → 'text' fallback
+* Tree-walking evaluator for the safe expression mini-language.
 *
-* Wrapper types ZodDefault, ZodOptional, and ZodNullable are unwrapped transparently.
-* Default values are extracted from ZodDefault wrappers.
+* SECURITY (spec §4 rule 2/5):
+*  - The scope is an `Object.create(null)` copy of ONLY the caller's own
+*    enumerable binding entries, so `name in scope` is a pure own-key check and
+*    `constructor` / `__proto__` / `toString` are plain unknown identifiers.
+*  - Performs ZERO I/O and never touches `globalThis` / `Date` / `Math`
+*    directly — the only external calls are into the frozen builtin table.
+*  - The grammar has no loops/recursion/lambdas, so a walk is O(nodeCount) by
+*    construction; the step counter is defense-in-depth for a crafted max-size
+*    AST. Nothing blocks: there are no timers, awaits or unbounded loops.
 */
-function zodEntriesToConfigUI(entries, sectionTitle = "Configuration", sectionId = "main") {
-	return { sections: [{
-		id: sectionId,
-		title: sectionTitle,
-		fields: entries.map((entry) => zodToConfigField(entry.key, entry.schema, entry.description))
-	}] };
+var EMPTY_HOOKS = Object.freeze({});
+/** Build a null-prototype scope from own-enumerable binding entries. Inherited
+*  keys of the input (e.g. from a `{__proto__: {...}}` payload) are NOT copied,
+*  so nothing smuggles in via the prototype chain. */
+function createExpressionScope(bindings) {
+	const scope = Object.create(null);
+	for (const key of Object.keys(bindings)) if (Object.prototype.hasOwnProperty.call(bindings, key)) scope[key] = bindings[key];
+	return scope;
 }
-function zodToConfigField(key, schema, description) {
-	const inner = unwrapZod(schema);
-	const defaultValue = getZodDefault(schema);
-	const base = {
-		key,
-		label: description ?? humanizeKey(key),
-		description,
-		default: defaultValue
-	};
-	if (inner instanceof zod.z.ZodString) return buildStringField(key, base);
-	if (inner instanceof zod.z.ZodNumber) return buildNumberField(inner, base);
-	if (inner instanceof zod.z.ZodBoolean) return {
-		...base,
-		type: "boolean"
-	};
-	if (inner instanceof zod.z.ZodEnum) return buildEnumField(inner, base);
-	if (inner instanceof zod.z.ZodArray || inner instanceof zod.z.ZodObject) return {
-		...base,
-		type: "textarea",
-		rows: 6,
-		isJson: true
-	};
-	return {
-		...base,
-		type: "text"
-	};
+function isFiniteNumber(value) {
+	return typeof value === "number" && Number.isFinite(value);
 }
-function buildStringField(key, base) {
-	const lowerKey = key.toLowerCase();
-	if (lowerKey.includes("password") || lowerKey.includes("secret") || lowerKey.includes("token") || lowerKey.includes("apikey") || lowerKey.includes("api_key")) return {
-		...base,
-		type: "password",
-		showToggle: true
-	};
-	return {
-		...base,
-		type: "text"
-	};
+/** JS truthiness of a primitive value. */
+function truthy(value) {
+	return Boolean(value);
 }
-function buildNumberField(inner, base) {
-	const anyInner = zodInternals(inner);
-	const rawMin = anyInner.minValue;
-	const rawMax = anyInner.maxValue;
-	const min = rawMin != null && isFinite(rawMin) ? rawMin : void 0;
-	const max = rawMax != null && isFinite(rawMax) ? rawMax : void 0;
-	const step = getMultipleOfStep(inner);
-	return {
-		...base,
-		type: "number",
-		...min !== void 0 ? { min } : {},
-		...max !== void 0 ? { max } : {},
-		...step !== void 0 ? { step } : {}
-	};
+function requireFinite(value, context) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${context} produced a non-finite result`);
+	return value;
 }
-function getMultipleOfStep(inner) {
-	const checks = zodDef(inner).checks ?? [];
-	for (const check of checks) if (check._zod?.def?.check === "multiple_of" && check._zod.def.value !== void 0) return check._zod.def.value;
+function step(ctx) {
+	ctx.steps += 1;
+	if (ctx.steps > ctx.maxSteps) throw new ExpressionEvalError("expression evaluation step budget exceeded");
 }
-function buildEnumField(inner, base) {
-	const values = inner.options.map((v) => String(v));
-	return {
-		...base,
-		type: "select",
-		options: values.map((v) => ({
-			label: humanizeKey(v),
-			value: v
-		}))
-	};
+function evalNode(node, ctx) {
+	step(ctx);
+	switch (node.kind) {
+		case "literal": return node.value;
+		case "identifier":
+			if (!(node.name in ctx.scope)) throw new ExpressionEvalError(`unknown identifier: ${node.name}`);
+			return ctx.scope[node.name];
+		case "unary": return evalUnary(node.op, evalNode(node.operand, ctx));
+		case "binary": return evalBinary(node.op, evalNode(node.left, ctx), evalNode(node.right, ctx));
+		case "logical": {
+			const left = evalNode(node.left, ctx);
+			if (node.op === "&&") return truthy(left) ? evalNode(node.right, ctx) : left;
+			return truthy(left) ? left : evalNode(node.right, ctx);
+		}
+		case "conditional": return truthy(evalNode(node.test, ctx)) ? evalNode(node.consequent, ctx) : evalNode(node.alternate, ctx);
+		case "call": return evalCall(node.callee, node.args.map((a) => evalNode(a, ctx)), ctx.hooks);
+	}
 }
-function unwrapZod(schema) {
-	if (schema instanceof zod.z.ZodDefault) return unwrapZod(zodDef(schema).innerType);
-	if (schema instanceof zod.z.ZodOptional) return unwrapZod(zodDef(schema).innerType);
-	if (schema instanceof zod.z.ZodNullable) return unwrapZod(zodDef(schema).innerType);
-	return schema;
+function evalUnary(op, operand) {
+	if (op === "!") return !truthy(operand);
+	if (!isFiniteNumber(operand)) throw new ExpressionEvalError("unary \"-\" requires a finite number");
+	return requireFinite(-operand, "unary \"-\"");
 }
-function getZodDefault(schema) {
-	if (schema instanceof zod.z.ZodDefault) return zodDef(schema).defaultValue;
+function evalBinary(op, left, right) {
+	switch (op) {
+		case "==": return left === right;
+		case "!=": return left !== right;
+		case "+":
+			if (typeof left === "string" && typeof right === "string") return left + right;
+			if (isFiniteNumber(left) && isFiniteNumber(right)) return requireFinite(left + right, "\"+\"");
+			throw new ExpressionEvalError("\"+\" requires two numbers or two strings");
+		case "-":
+		case "*":
+		case "/":
+		case "%":
+			if (!isFiniteNumber(left) || !isFiniteNumber(right)) throw new ExpressionEvalError(`"${op}" requires two finite numbers`);
+			return requireFinite(op === "-" ? left - right : op === "*" ? left * right : op === "/" ? left / right : left % right, `"${op}"`);
+		case "<":
+		case "<=":
+		case ">":
+		case ">=":
+			if (isFiniteNumber(left) && isFiniteNumber(right)) return op === "<" ? left < right : op === "<=" ? left <= right : op === ">" ? left > right : left >= right;
+			if (typeof left === "string" && typeof right === "string") return op === "<" ? left < right : op === "<=" ? left <= right : op === ">" ? left > right : left >= right;
+			throw new ExpressionEvalError(`"${op}" requires two numbers or two strings`);
+	}
 }
-function humanizeKey(key) {
-	return key.replace(/([A-Z])/g, " $1").replace(/[_-]/g, " ").replace(/^\w/, (c) => c.toUpperCase()).trim();
+function evalCall(callee, args, hooks) {
+	if (!Object.prototype.hasOwnProperty.call(EXPRESSION_BUILTINS, callee)) throw new ExpressionEvalError(`unknown function: ${callee}`);
+	const builtin = EXPRESSION_BUILTINS[callee];
+	if (args.length < builtin.minArgs || args.length > builtin.maxArgs) throw new ExpressionEvalError(`${callee}: wrong number of arguments (${args.length})`);
+	return builtin.apply(args, hooks);
+}
+/** Evaluate an AST node against a scope. Throws `ExpressionEvalError` on any
+*  runtime failure (unknown identifier, type mismatch, non-finite result,
+*  step-budget exhaustion). */
+function evaluateAst(node, scope, opts) {
+	return evalNode(node, {
+		scope,
+		hooks: opts?.hooks ?? EMPTY_HOOKS,
+		maxSteps: opts?.maxSteps ?? 4096,
+		steps: 0
+	});
+}
+//#endregion
+//#region src/expression/expression-source.ts
+/** The `now` epoch-ms binding is auto-injected into every evaluation and is a
+*  reserved binding name (authors may not rebind it). */
+var EXPRESSION_INJECTED_NOW = "now";
+/**
+* Coerce an untrusted `getByPath` / mirror read to an `ExpressionValue`.
+* Non-primitive values (objects, arrays, `undefined`, functions, bigint,
+* symbol) and non-finite numbers become `undefined` so the caller can apply
+* its binding-miss policy (→ `null`). `null` itself is a valid value.
+*/
+function toExpressionValue(raw) {
+	if (raw === null) return null;
+	if (typeof raw === "string") return raw;
+	if (typeof raw === "boolean") return raw;
+	if (typeof raw === "number") return Number.isFinite(raw) ? raw : void 0;
+}
+/**
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
+	}
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	}
+	return null;
+}
+/**
+* Shared read-path evaluation. Builds a null-proto scope from `bindingValues`
+* plus the injected `now` (supplied by the caller for determinism and
+* testability), compiles via the LRU, and evaluates. Any failure (parse or
+* eval) returns `{ ok: false }` — the caller treats that as "skip this
+* derivation", never as a throw that takes the pass down.
+*/
+function evaluateExpressionSource(expr, bindingValues, now, opts) {
+	const compiled = compileExpressionSafe(expr);
+	if (!compiled.ok) return {
+		ok: false,
+		error: compiled.error
+	};
+	const scope = createExpressionScope({
+		...bindingValues,
+		["now"]: now
+	});
+	try {
+		return {
+			ok: true,
+			value: evaluateAst(compiled.parsed.ast, scope, opts)
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: err instanceof ExpressionEvalError ? err.message : String(err)
+		};
+	}
 }
 //#endregion
+//#region src/expression/binding-source.ts
+/**
+* What an expression's named bindings READ from.
+*
+* Salvaged verbatim from the deleted device-link mechanism. Wiring's source
+* kinds were the one part of it worth keeping: addressing a device field by
+* re-sync-stable `stableId`, a per-device constant, and a sibling-accessory
+* read are the vocabulary any cross-device derivation needs, and they were
+* already correct. What wiring got wrong was the DESTINATION — a field on
+* somebody else's device, with no identity — not the source.
+*
+* These shapes are therefore kept, re-homed next to the engine that consumes
+* them, and are the binding type of a composition recipe (the source picker
+* stays `deviceManager.getWireableFields`). They deliberately do NOT nest: a
+* binding is a read, never another expression.
+*
+* Schemas are authoritative; every type is `z.infer` of one, so a wire shape and
+* a TypeScript shape cannot drift apart (`scripts/check-schema-type-twins.ts`).
+*/
+/** Read a sibling accessory's status field, addressed by the sibling's key.
+*  `kind` is optional for wire compatibility — absent means `'field'`. */
+var ExpressionFieldBindingSchema = zod.z.object({
+	kind: zod.z.literal("field").optional(),
+	sourceKey: zod.z.string(),
+	cap: zod.z.string(),
+	fieldPath: zod.z.string()
+});
+/** A constant. No device is read. */
+var ExpressionLiteralBindingSchema = zod.z.object({
+	kind: zod.z.literal("literal"),
+	value: zod.z.union([
+		zod.z.string(),
+		zod.z.number(),
+		zod.z.boolean(),
+		zod.z.null()
+	])
+});
+/** Read ANY device's status field, addressed by its re-sync-stable `stableId` —
+*  never by numeric id, which a re-adoption reissues. */
+var ExpressionGlobalBindingSchema = zod.z.object({
+	kind: zod.z.literal("global"),
+	sourceStableId: zod.z.string(),
+	cap: zod.z.string(),
+	fieldPath: zod.z.string()
+});
+var ExpressionBindingSourceSchema = zod.z.union([
+	ExpressionFieldBindingSchema,
+	ExpressionLiteralBindingSchema,
+	ExpressionGlobalBindingSchema
+]);
+/**
+* An expression plus the bindings its free identifiers resolve against.
+*
+* The `superRefine` runs the SAME author-time validation as
+* `validateExpressionSource` — compiles the expression, checks binding names,
+* checks identifier coverage — so every boundary that parses one
+* validates-at-write rather than discovering the problem at read time.
+* Compiles are LRU-cached, so repeated validation of the same string is a hit.
+*/
+var ExpressionSourceSchema = zod.z.object({
+	expr: zod.z.string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: zod.z.record(zod.z.string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+//#endregion
 //#region src/generated/cap-status-types.ts
 /**
 * Runtime list of cap names with status. Used by the settings
@@ -30411,6 +30702,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.restart": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.setEnabled": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -31047,12 +31344,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"deviceManager.setDeviceLinks": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"deviceManager.setDisabled": {
 		capName: "device-manager",
 		capScope: "system",
@@ -35465,6 +35756,7 @@ function createSystemProxy(api) {
 			update: (input) => dispatch("coreBlocks", "update", "mutation", input),
 			delete: (input) => dispatch("coreBlocks", "delete", "mutation", input),
 			setEnabled: (input) => dispatch("coreBlocks", "setEnabled", "mutation", input),
+			restart: (input) => dispatch("coreBlocks", "restart", "mutation", input),
 			compile: (input) => dispatch("coreBlocks", "compile", "mutation", input),
 			getTypeDefs: (input) => dispatch("coreBlocks", "getTypeDefs", "query", input)
 		},
@@ -36388,6 +36680,441 @@ var TimelapseRuleSchema = TimelapseRuleInputSchema.extend({
 	updatedAt: zod.z.number()
 });
 //#endregion
+//#region src/pipeline/detail-crop.ts
+/**
+* THE detail-crop convention — the single derivation of the rectangle a
+* detail/enrichment step (clip-embedding, face-detection, plate-detection…)
+* is fed.
+*
+* ## Why this is one module and not two constants
+*
+* `object-clip` is ONE vector index, and cosine similarity is only meaningful
+* between vectors produced from the same crop convention. Two encode paths
+* write into it — the live detail plane and the embedding rebuild — and they
+* used to derive their crops independently: `DETAIL_CROP_PADDING_RATIO = 0.15`
+* with no squaring on one side, `DEFAULT_CROP_MARGIN = 0.2` with squaring on
+* by default on the other. Every rebuild therefore poured a second, silently
+* incomparable feature space into the index it exists to keep consistent.
+*
+* So the rectangle is derived HERE, once, from ONE convention value. Both
+* paths now reach this function through `pipelineRunner.runDetailSubtree` —
+* the runner is the only process that cuts (see `detail-subtree.ts`), and the
+* convention is a cluster-global `pipeline-orchestrator` setting. There is
+* deliberately no per-node or per-device scope: a per-accelerator crop margin
+* would reintroduce the same split, merely relocated.
+*
+* ## The default IS the live convention
+*
+* {@link DEFAULT_DETAIL_CROP_CONVENTION} reproduces what the live path has
+* been storing (0.15, no squaring). Anything else would invalidate every
+* vector already in the index on the day it shipped. Changing the convention
+* is legitimate — that is what the operator knob is for — but it must be
+* followed by a rebuild, which is now guaranteed to produce crops from this
+* same function.
+*/
+/**
+* Store identity of the convention in `pipeline-orchestrator`'s GLOBAL
+* (cluster-wide) settings.
+*
+* These live here rather than in the orchestrator because the reader is a
+* different addon — the pipeline runner, over the hub-routed `addon-settings`
+* cap. Addons never import each other, so a key owned by the writer would have
+* to be hand-copied by the reader, and a hand-copied key is how a setting
+* silently stops arriving while both sides still look correct.
+*/
+var DETAIL_CROP_SECTION_ID = "detail-crop";
+var DETAIL_CROP_PADDING_KEY = "detailCropPaddingRatio";
+var DETAIL_CROP_SQUARE_KEY = "detailCropSquare";
+/**
+* Operator-tunable crop convention. Single-valued and cluster-wide — see the
+* module docblock for why it cannot be scoped per node or per device.
+*/
+var DetailCropConventionSchema = zod.z.object({
+	/**
+	* Fraction of the box's own size added on EACH side before cutting.
+	*
+	* CLIP is trained on natural images WITH surroundings; a pixel-tight crop
+	* removes exactly the context it is strongest on (a dog cut to its outline
+	* is a dark blob). The right value is an empirical question, which is why it
+	* is a setting: 0 / 0.15 / 0.2 / 0.5 are the interesting points.
+	*/
+	paddingRatio: zod.z.number().min(0).max(4),
+	/**
+	* Square the window (in PIXELS) before cutting.
+	*
+	* CLIP's input is square, so a tall bbox resized straight to NxN is squashed
+	* — a standing person becomes a shape the model never saw. Squaring costs
+	* extra background, which is context the model wants anyway. Off by default
+	* because the live path has never squared and the stored index reflects that.
+	*/
+	square: zod.z.boolean()
+});
+/**
+* The convention in force when nobody has configured one — byte-for-byte the
+* behaviour of the pre-unification LIVE path (`DETAIL_CROP_PADDING_RATIO`).
+*/
+var DEFAULT_DETAIL_CROP_CONVENTION = {
+	paddingRatio: .15,
+	square: false
+};
+/**
+* Narrow a FLAT settings record to the convention.
+*
+* Per-FIELD fallback, deliberately: a junk padding must not also discard a
+* valid squaring choice. An absent or invalid value resolves to
+* {@link DEFAULT_DETAIL_CROP_CONVENTION} — the historical live behaviour —
+* rather than to a clamped number nobody chose, so a bad read can never
+* quietly change what the stored vectors mean.
+*/
+function readDetailCropConvention(config) {
+	const paddingRatio = DetailCropConventionSchema.shape.paddingRatio.safeParse(config[DETAIL_CROP_PADDING_KEY]);
+	const square = DetailCropConventionSchema.shape.square.safeParse(config[DETAIL_CROP_SQUARE_KEY]);
+	return {
+		paddingRatio: paddingRatio.success ? paddingRatio.data : DEFAULT_DETAIL_CROP_CONVENTION.paddingRatio,
+		square: square.success ? square.data : DEFAULT_DETAIL_CROP_CONVENTION.square
+	};
+}
+function isHydratedField$1(entry) {
+	return typeof entry === "object" && entry !== null && "key" in entry;
+}
+/**
+* Extract the convention from an `addon-settings.getGlobalSettings` payload.
+*
+* Walks EVERY section rather than looking inside {@link DETAIL_CROP_SECTION_ID}
+* alone: the keys are unique across the addon's schema, and a section rename
+* must not silently revert the whole cluster to the default. A `null` payload
+* (addon mid-boot) is the default convention.
+*/
+function pickDetailCropConvention(view) {
+	if (view === null) return DEFAULT_DETAIL_CROP_CONVENTION;
+	const flat = {};
+	for (const section of view.sections) for (const entry of section.fields) {
+		if (!isHydratedField$1(entry) || typeof entry.key !== "string") continue;
+		if (entry.key === "detailCropPaddingRatio" || entry.key === "detailCropSquare") flat[entry.key] = entry.value;
+	}
+	return readDetailCropConvention(flat);
+}
+/** Slider bounds for the operator-facing padding knob (orchestrator settings UI). */
+var DETAIL_CROP_PADDING_FIELD = {
+	min: 0,
+	max: 1,
+	step: .05,
+	default: DEFAULT_DETAIL_CROP_CONVENTION.paddingRatio
+};
+/**
+* Derive the crop rectangle for one parent detection.
+*
+* Order: pad by `paddingRatio` of the box's own size → optionally square in
+* pixel space around the padded centre → keep it inside the frame. Pure:
+* always returns a new rect and never mutates `bbox`.
+*
+* Edge handling differs by mode, on purpose:
+*
+* - **unsquared** — TRUNCATED at the frame border, byte-for-byte what the live
+*   path has always done (`padAndClampFrameBbox`). A subject against the edge
+*   gets a slightly smaller window. Changing this would silently reinterpret
+*   every edge-touching vector already in the index.
+* - **squared** — SLID inward instead, because a truncated square is not
+*   square and squaring exists precisely to preserve the aspect the model
+*   sees. It only shrinks when the square is larger than the frame itself.
+*/
+function deriveDetailCropRect(bbox, frameWidth, frameHeight, convention) {
+	const padX = convention.paddingRatio * bbox.w;
+	const padY = convention.paddingRatio * bbox.h;
+	const padded = {
+		x: bbox.x - padX,
+		y: bbox.y - padY,
+		w: bbox.w + 2 * padX,
+		h: bbox.h + 2 * padY
+	};
+	return convention.square ? slideInsideFrame(squareInPixels(padded, frameWidth, frameHeight), frameWidth, frameHeight) : truncateToFrame(padded, frameWidth, frameHeight);
+}
+/**
+* Grow the shorter side to the longer one around the window's centre, bounded
+* by the frame's shorter side — a square larger than the frame cannot exist,
+* and collapsing to the frame's short side is the most that does.
+*/
+function squareInPixels(rect, frameWidth, frameHeight) {
+	const side = Math.min(Math.max(rect.w, rect.h), Math.min(frameWidth, frameHeight));
+	const cx = rect.x + rect.w / 2;
+	const cy = rect.y + rect.h / 2;
+	return {
+		x: cx - side / 2,
+		y: cy - side / 2,
+		w: side,
+		h: side
+	};
+}
+/**
+* Cut the window at the frame border — the pre-unification live behaviour,
+* preserved exactly so unsquared crops keep matching the stored index.
+*/
+function truncateToFrame(rect, frameWidth, frameHeight) {
+	const x1 = Math.max(0, rect.x);
+	const y1 = Math.max(0, rect.y);
+	const x2 = Math.min(frameWidth, rect.x + rect.w);
+	const y2 = Math.min(frameHeight, rect.y + rect.h);
+	return {
+		x: x1,
+		y: y1,
+		w: Math.max(0, x2 - x1),
+		h: Math.max(0, y2 - y1)
+	};
+}
+/**
+* Move the window inside the frame keeping its extent — used only for squared
+* windows, where truncating would destroy the squareness that is the point.
+*/
+function slideInsideFrame(rect, frameWidth, frameHeight) {
+	const w = Math.max(0, Math.min(rect.w, frameWidth));
+	const h = Math.max(0, Math.min(rect.h, frameHeight));
+	return {
+		x: Math.min(Math.max(0, rect.x), Math.max(0, frameWidth - w)),
+		y: Math.min(Math.max(0, rect.y), Math.max(0, frameHeight - h)),
+		w,
+		h
+	};
+}
+//#endregion
+//#region src/pipeline/native-lease.ts
+/**
+* THE native-frame **lease** knobs — TTL, RAM budget and demand window for the
+* decode worker's native-resolution frame retention.
+*
+* ## Why they live here and not in the addon that reads them
+*
+* The WRITER is `pipeline-orchestrator` (the cluster-wide settings authority);
+* the READER is a private child process of `addon-pipeline`'s pipeline-runner.
+* Addons never import each other, so a key owned by either side would have to
+* be hand-copied by the other — and a hand-copied key is how a setting silently
+* stops arriving while both sides still look correct. Same reasoning, same
+* placement as `detail-crop.ts` (D52's "one cluster-wide orchestrator setting").
+*
+* ## Why cluster-wide and not per-node
+*
+* The lease is a per-decode-worker RAM window. Its purpose — the late
+* cross-process native crop landing on a full-resolution frame rather than the
+* ≤640 detection fallback — is a property of the PIPELINE, not of a node's
+* hardware: a per-node TTL would mean the same camera produces different crop
+* quality depending on which node the balancer placed it on, and nobody could
+* tell that from the stored media. Node-level RAM pressure is already handled
+* by the per-session budget ceiling, which is itself one of these knobs.
+*
+* ## What each knob costs
+*
+* A retained frame is a full NATIVE-resolution copy in system RAM. With the
+* default pinned-RGB24 lease path (`CAMSTACK_SESSION_PINNED_RGB_CROP`, on):
+* 4K ≈ 24.9 MB/frame, 1080p ≈ 6.2 MB/frame. On the YUV420P path (flag off, and
+* for software-decoded sessions): 4K ≈ 12.4 MB, 1080p ≈ 3.1 MB. Worst-case
+* resident RAM for ONE busy camera ≈ frameBytes × deliveredFps × ttlSeconds,
+* clamped by the budget ceiling. See `docs/design/decode-path.md` → "Lease
+* admission" for what actually gets admitted.
+*/
+/**
+* Store identity of the lease knobs in `pipeline-orchestrator`'s GLOBAL
+* (cluster-wide) settings. Keys are unique across that addon's whole schema, so
+* the reader can walk every section instead of trusting the section id.
+*/
+var NATIVE_LEASE_SECTION_ID = "native-lease";
+var NATIVE_LEASE_TTL_KEY = "nativeLeaseTtlMs";
+var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
+var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
+var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
+/**
+* WHICH delivered frames the decode worker retains a native copy of.
+*
+* - `all` — every frame the worker delivered to the runner. The shipped
+*   behaviour, and the only correct one if something can ask for a crop of a
+*   frame the runner never sent to inference.
+* - `inferred` — only the frames the runner ADMITTED to its detection queue.
+*   A native-crop request always names a `frameId` that rode an inference
+*   result, so that is the only set a request can name. How much it drops is
+*   the two-plane governor's admit ratio and nothing else: measured at ~50% on
+*   this cluster, not the ~80% the design sketch assumed, because the governor
+*   was not throttling as hard as the sketch supposed. Read
+*   `leaseAdmitted`/`leaseOffered` off the metrics line for the camera in front
+*   of you rather than quoting a number from here. The newest delivered frame is
+*   croppable regardless — it is still the worker's reserved slot, not a lease —
+*   which covers the one-frame race between a mark and the supersede that
+*   consumes it.
+*/
+var NativeLeaseAdmissionSchema = zod.z.enum(["all", "inferred"]);
+/**
+* Operator-tunable native-lease settings. Bounds are enforced HERE (not only in
+* the slider) because the value also travels to a forked child process, where a
+* junk number would silently become a 0-length or unbounded retention window.
+*/
+var NativeLeaseSettingsSchema = zod.z.object({
+	/**
+	* How long a retained native frame is served before it counts as a miss.
+	*
+	* Must cover the FULL late-crop horizon: detection inference + the
+	* cross-process inference-result hop to hub post-analysis + tracking + the
+	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
+	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
+	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	*/
+	ttlMs: zod.z.number().int().min(250).max(1e4),
+	/**
+	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
+	*
+	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
+	* which one is actually binding before reasoning from that. At the shipped
+	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
+	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
+	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
+	* change that admits fewer frames buys retention WINDOW at constant RAM
+	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* `0` DISABLES the lease entirely and falls the worker back to the tiny
+	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
+	* to replace).
+	*/
+	budgetMb: zod.z.number().int().min(0).max(4096),
+	/**
+	* Demand window: eager per-frame native retention runs only within this many
+	* ms of the last native-crop request (or of the dial starting).
+	*
+	* `0` means ALWAYS ON — it disables the gate, it does not disable retention.
+	* That is the legacy behaviour that saturated an N100 (24 native-4K downloads
+	* per second on a camera with zero crop demand), so leave it non-zero unless
+	* you are reproducing that.
+	*/
+	activityMs: zod.z.number().int().min(0).max(12e4),
+	/**
+	* Which delivered frames are retained at all — see
+	* {@link NativeLeaseAdmissionSchema}. This is the only knob of the four that
+	* changes WHAT is kept rather than for how long, so it is also the only one
+	* that can turn a crop that used to hit into a miss. The worker counts every
+	* crop request naming a frame it did NOT see marked
+	* (`leaseUnmarkedCrops` on the session-decode metrics line): a non-zero value
+	* there is the signal that some caller names frames outside the inference set
+	* and that this must go back to `all`.
+	*/
+	admission: NativeLeaseAdmissionSchema
+});
+/**
+* The values in force when the operator has set nothing — byte-for-byte the
+* constants the decode worker shipped with as env-var defaults, so making these
+* settings changed no behaviour on the day it landed.
+*/
+var DEFAULT_NATIVE_LEASE_SETTINGS = {
+	ttlMs: 1200,
+	budgetMb: 1024,
+	activityMs: 15e3,
+	admission: "inferred"
+};
+/** Slider bounds for the operator-facing knobs (orchestrator settings UI). */
+var NATIVE_LEASE_TTL_FIELD = {
+	min: 250,
+	max: 1e4,
+	step: 50,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs
+};
+var NATIVE_LEASE_BUDGET_FIELD = {
+	min: 0,
+	max: 4096,
+	step: 64,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb
+};
+var NATIVE_LEASE_ACTIVITY_FIELD = {
+	min: 0,
+	max: 12e4,
+	step: 1e3,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.activityMs
+};
+/** Select options for the admission knob (orchestrator settings UI). */
+var NATIVE_LEASE_ADMISSION_FIELD = {
+	options: [{
+		value: "all",
+		label: "Every delivered frame"
+	}, {
+		value: "inferred",
+		label: "Only frames sent to inference"
+	}],
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.admission
+};
+/**
+* Parse one knob, reporting `null` for absent, junk, out-of-bounds — AND for a
+* value equal to the shipped default.
+*
+* That last rule is not tidiness, it is the difference between the documented
+* precedence being true and being a lie. `addon-settings.getGlobalSettings`
+* returns a HYDRATED payload, and `hydrateField` fills an unstored field with
+* the schema's own `default` (verified live on the hub: a cluster that has never
+* opened the form still reports `nativeLeaseTtlMs = 1200`). A reader that took
+* that at face value would report all three knobs as "set" on every cluster on
+* the day this shipped, permanently retiring the `CAMSTACK_SESSION_NATIVE_LEASE_*`
+* emergency override that the precedence promises. There is no raw-store read on
+* this cap to distinguish the two, so the default value itself is treated as
+* "the operator has expressed no preference" — which is also what leaving a
+* slider untouched means.
+*
+* The cost is one honest edge: an operator who deliberately selects the default
+* value in order to overrule an env var does not get it. Clear the env var
+* instead; the worker's spawn line names the source, so this is visible rather
+* than mysterious.
+*/
+function readKnob(knob, raw) {
+	const parsed = NativeLeaseSettingsSchema.shape[knob].safeParse(raw);
+	if (!parsed.success) return null;
+	return parsed.data === DEFAULT_NATIVE_LEASE_SETTINGS[knob] ? null : parsed.data;
+}
+/** {@link readKnob} for the one non-numeric knob. Same default-means-unset rule. */
+function readAdmissionKnob(raw) {
+	const parsed = NativeLeaseAdmissionSchema.safeParse(raw);
+	if (!parsed.success) return null;
+	return parsed.data === DEFAULT_NATIVE_LEASE_SETTINGS.admission ? null : parsed.data;
+}
+/**
+* Narrow a FLAT settings record to the knobs the operator set.
+*
+* Per-FIELD parse, deliberately: a junk TTL must not also discard a valid
+* budget. An absent, out-of-bounds or default-valued knob is OMITTED (not
+* clamped, not defaulted) so the caller can still fall through to the env
+* override — clamping here would turn a typo into a value nobody chose. See
+* {@link readKnob} for why the default counts as unset.
+*/
+function readNativeLeaseOverride(config) {
+	const ttlMs = readKnob("ttlMs", config[NATIVE_LEASE_TTL_KEY]);
+	const budgetMb = readKnob("budgetMb", config[NATIVE_LEASE_BUDGET_KEY]);
+	const activityMs = readKnob("activityMs", config[NATIVE_LEASE_ACTIVITY_KEY]);
+	const admission = readAdmissionKnob(config[NATIVE_LEASE_ADMISSION_KEY]);
+	return {
+		...ttlMs === null ? {} : { ttlMs },
+		...budgetMb === null ? {} : { budgetMb },
+		...activityMs === null ? {} : { activityMs },
+		...admission === null ? {} : { admission }
+	};
+}
+function isHydratedField(entry) {
+	return typeof entry === "object" && entry !== null && "key" in entry;
+}
+var LEASE_KEYS = [
+	NATIVE_LEASE_TTL_KEY,
+	NATIVE_LEASE_BUDGET_KEY,
+	NATIVE_LEASE_ACTIVITY_KEY,
+	NATIVE_LEASE_ADMISSION_KEY
+];
+/**
+* Extract the operator's lease overrides from an
+* `addon-settings.getGlobalSettings` payload.
+*
+* Walks EVERY section rather than looking inside {@link NATIVE_LEASE_SECTION_ID}
+* alone: the keys are unique across the addon's schema, and a section rename
+* must not silently revert the whole cluster to the defaults. A `null` payload
+* (addon mid-boot) means "operator set nothing" — the env/default fallback then
+* applies, which is the correct read of "I could not ask".
+*/
+function pickNativeLeaseOverride(view) {
+	if (view === null) return {};
+	const flat = {};
+	for (const section of view.sections) for (const entry of section.fields) {
+		if (!isHydratedField(entry) || typeof entry.key !== "string") continue;
+		if (LEASE_KEYS.includes(entry.key)) flat[entry.key] = entry.value;
+	}
+	return readNativeLeaseOverride(flat);
+}
+//#endregion
 //#region src/types/device-type.ts
 var DEVICE_TYPE_INFO = { ["camera"]: {
 	type: "camera",
@@ -37447,441 +38174,6 @@ function pointInPolygon(point, polygon) {
 	return inside;
 }
 //#endregion
-//#region src/pipeline/detail-crop.ts
-/**
-* THE detail-crop convention — the single derivation of the rectangle a
-* detail/enrichment step (clip-embedding, face-detection, plate-detection…)
-* is fed.
-*
-* ## Why this is one module and not two constants
-*
-* `object-clip` is ONE vector index, and cosine similarity is only meaningful
-* between vectors produced from the same crop convention. Two encode paths
-* write into it — the live detail plane and the embedding rebuild — and they
-* used to derive their crops independently: `DETAIL_CROP_PADDING_RATIO = 0.15`
-* with no squaring on one side, `DEFAULT_CROP_MARGIN = 0.2` with squaring on
-* by default on the other. Every rebuild therefore poured a second, silently
-* incomparable feature space into the index it exists to keep consistent.
-*
-* So the rectangle is derived HERE, once, from ONE convention value. Both
-* paths now reach this function through `pipelineRunner.runDetailSubtree` —
-* the runner is the only process that cuts (see `detail-subtree.ts`), and the
-* convention is a cluster-global `pipeline-orchestrator` setting. There is
-* deliberately no per-node or per-device scope: a per-accelerator crop margin
-* would reintroduce the same split, merely relocated.
-*
-* ## The default IS the live convention
-*
-* {@link DEFAULT_DETAIL_CROP_CONVENTION} reproduces what the live path has
-* been storing (0.15, no squaring). Anything else would invalidate every
-* vector already in the index on the day it shipped. Changing the convention
-* is legitimate — that is what the operator knob is for — but it must be
-* followed by a rebuild, which is now guaranteed to produce crops from this
-* same function.
-*/
-/**
-* Store identity of the convention in `pipeline-orchestrator`'s GLOBAL
-* (cluster-wide) settings.
-*
-* These live here rather than in the orchestrator because the reader is a
-* different addon — the pipeline runner, over the hub-routed `addon-settings`
-* cap. Addons never import each other, so a key owned by the writer would have
-* to be hand-copied by the reader, and a hand-copied key is how a setting
-* silently stops arriving while both sides still look correct.
-*/
-var DETAIL_CROP_SECTION_ID = "detail-crop";
-var DETAIL_CROP_PADDING_KEY = "detailCropPaddingRatio";
-var DETAIL_CROP_SQUARE_KEY = "detailCropSquare";
-/**
-* Operator-tunable crop convention. Single-valued and cluster-wide — see the
-* module docblock for why it cannot be scoped per node or per device.
-*/
-var DetailCropConventionSchema = zod.z.object({
-	/**
-	* Fraction of the box's own size added on EACH side before cutting.
-	*
-	* CLIP is trained on natural images WITH surroundings; a pixel-tight crop
-	* removes exactly the context it is strongest on (a dog cut to its outline
-	* is a dark blob). The right value is an empirical question, which is why it
-	* is a setting: 0 / 0.15 / 0.2 / 0.5 are the interesting points.
-	*/
-	paddingRatio: zod.z.number().min(0).max(4),
-	/**
-	* Square the window (in PIXELS) before cutting.
-	*
-	* CLIP's input is square, so a tall bbox resized straight to NxN is squashed
-	* — a standing person becomes a shape the model never saw. Squaring costs
-	* extra background, which is context the model wants anyway. Off by default
-	* because the live path has never squared and the stored index reflects that.
-	*/
-	square: zod.z.boolean()
-});
-/**
-* The convention in force when nobody has configured one — byte-for-byte the
-* behaviour of the pre-unification LIVE path (`DETAIL_CROP_PADDING_RATIO`).
-*/
-var DEFAULT_DETAIL_CROP_CONVENTION = {
-	paddingRatio: .15,
-	square: false
-};
-/**
-* Narrow a FLAT settings record to the convention.
-*
-* Per-FIELD fallback, deliberately: a junk padding must not also discard a
-* valid squaring choice. An absent or invalid value resolves to
-* {@link DEFAULT_DETAIL_CROP_CONVENTION} — the historical live behaviour —
-* rather than to a clamped number nobody chose, so a bad read can never
-* quietly change what the stored vectors mean.
-*/
-function readDetailCropConvention(config) {
-	const paddingRatio = DetailCropConventionSchema.shape.paddingRatio.safeParse(config[DETAIL_CROP_PADDING_KEY]);
-	const square = DetailCropConventionSchema.shape.square.safeParse(config[DETAIL_CROP_SQUARE_KEY]);
-	return {
-		paddingRatio: paddingRatio.success ? paddingRatio.data : DEFAULT_DETAIL_CROP_CONVENTION.paddingRatio,
-		square: square.success ? square.data : DEFAULT_DETAIL_CROP_CONVENTION.square
-	};
-}
-function isHydratedField$1(entry) {
-	return typeof entry === "object" && entry !== null && "key" in entry;
-}
-/**
-* Extract the convention from an `addon-settings.getGlobalSettings` payload.
-*
-* Walks EVERY section rather than looking inside {@link DETAIL_CROP_SECTION_ID}
-* alone: the keys are unique across the addon's schema, and a section rename
-* must not silently revert the whole cluster to the default. A `null` payload
-* (addon mid-boot) is the default convention.
-*/
-function pickDetailCropConvention(view) {
-	if (view === null) return DEFAULT_DETAIL_CROP_CONVENTION;
-	const flat = {};
-	for (const section of view.sections) for (const entry of section.fields) {
-		if (!isHydratedField$1(entry) || typeof entry.key !== "string") continue;
-		if (entry.key === "detailCropPaddingRatio" || entry.key === "detailCropSquare") flat[entry.key] = entry.value;
-	}
-	return readDetailCropConvention(flat);
-}
-/** Slider bounds for the operator-facing padding knob (orchestrator settings UI). */
-var DETAIL_CROP_PADDING_FIELD = {
-	min: 0,
-	max: 1,
-	step: .05,
-	default: DEFAULT_DETAIL_CROP_CONVENTION.paddingRatio
-};
-/**
-* Derive the crop rectangle for one parent detection.
-*
-* Order: pad by `paddingRatio` of the box's own size → optionally square in
-* pixel space around the padded centre → keep it inside the frame. Pure:
-* always returns a new rect and never mutates `bbox`.
-*
-* Edge handling differs by mode, on purpose:
-*
-* - **unsquared** — TRUNCATED at the frame border, byte-for-byte what the live
-*   path has always done (`padAndClampFrameBbox`). A subject against the edge
-*   gets a slightly smaller window. Changing this would silently reinterpret
-*   every edge-touching vector already in the index.
-* - **squared** — SLID inward instead, because a truncated square is not
-*   square and squaring exists precisely to preserve the aspect the model
-*   sees. It only shrinks when the square is larger than the frame itself.
-*/
-function deriveDetailCropRect(bbox, frameWidth, frameHeight, convention) {
-	const padX = convention.paddingRatio * bbox.w;
-	const padY = convention.paddingRatio * bbox.h;
-	const padded = {
-		x: bbox.x - padX,
-		y: bbox.y - padY,
-		w: bbox.w + 2 * padX,
-		h: bbox.h + 2 * padY
-	};
-	return convention.square ? slideInsideFrame(squareInPixels(padded, frameWidth, frameHeight), frameWidth, frameHeight) : truncateToFrame(padded, frameWidth, frameHeight);
-}
-/**
-* Grow the shorter side to the longer one around the window's centre, bounded
-* by the frame's shorter side — a square larger than the frame cannot exist,
-* and collapsing to the frame's short side is the most that does.
-*/
-function squareInPixels(rect, frameWidth, frameHeight) {
-	const side = Math.min(Math.max(rect.w, rect.h), Math.min(frameWidth, frameHeight));
-	const cx = rect.x + rect.w / 2;
-	const cy = rect.y + rect.h / 2;
-	return {
-		x: cx - side / 2,
-		y: cy - side / 2,
-		w: side,
-		h: side
-	};
-}
-/**
-* Cut the window at the frame border — the pre-unification live behaviour,
-* preserved exactly so unsquared crops keep matching the stored index.
-*/
-function truncateToFrame(rect, frameWidth, frameHeight) {
-	const x1 = Math.max(0, rect.x);
-	const y1 = Math.max(0, rect.y);
-	const x2 = Math.min(frameWidth, rect.x + rect.w);
-	const y2 = Math.min(frameHeight, rect.y + rect.h);
-	return {
-		x: x1,
-		y: y1,
-		w: Math.max(0, x2 - x1),
-		h: Math.max(0, y2 - y1)
-	};
-}
-/**
-* Move the window inside the frame keeping its extent — used only for squared
-* windows, where truncating would destroy the squareness that is the point.
-*/
-function slideInsideFrame(rect, frameWidth, frameHeight) {
-	const w = Math.max(0, Math.min(rect.w, frameWidth));
-	const h = Math.max(0, Math.min(rect.h, frameHeight));
-	return {
-		x: Math.min(Math.max(0, rect.x), Math.max(0, frameWidth - w)),
-		y: Math.min(Math.max(0, rect.y), Math.max(0, frameHeight - h)),
-		w,
-		h
-	};
-}
-//#endregion
-//#region src/pipeline/native-lease.ts
-/**
-* THE native-frame **lease** knobs — TTL, RAM budget and demand window for the
-* decode worker's native-resolution frame retention.
-*
-* ## Why they live here and not in the addon that reads them
-*
-* The WRITER is `pipeline-orchestrator` (the cluster-wide settings authority);
-* the READER is a private child process of `addon-pipeline`'s pipeline-runner.
-* Addons never import each other, so a key owned by either side would have to
-* be hand-copied by the other — and a hand-copied key is how a setting silently
-* stops arriving while both sides still look correct. Same reasoning, same
-* placement as `detail-crop.ts` (D52's "one cluster-wide orchestrator setting").
-*
-* ## Why cluster-wide and not per-node
-*
-* The lease is a per-decode-worker RAM window. Its purpose — the late
-* cross-process native crop landing on a full-resolution frame rather than the
-* ≤640 detection fallback — is a property of the PIPELINE, not of a node's
-* hardware: a per-node TTL would mean the same camera produces different crop
-* quality depending on which node the balancer placed it on, and nobody could
-* tell that from the stored media. Node-level RAM pressure is already handled
-* by the per-session budget ceiling, which is itself one of these knobs.
-*
-* ## What each knob costs
-*
-* A retained frame is a full NATIVE-resolution copy in system RAM. With the
-* default pinned-RGB24 lease path (`CAMSTACK_SESSION_PINNED_RGB_CROP`, on):
-* 4K ≈ 24.9 MB/frame, 1080p ≈ 6.2 MB/frame. On the YUV420P path (flag off, and
-* for software-decoded sessions): 4K ≈ 12.4 MB, 1080p ≈ 3.1 MB. Worst-case
-* resident RAM for ONE busy camera ≈ frameBytes × deliveredFps × ttlSeconds,
-* clamped by the budget ceiling. See `docs/design/decode-path.md` → "Lease
-* admission" for what actually gets admitted.
-*/
-/**
-* Store identity of the lease knobs in `pipeline-orchestrator`'s GLOBAL
-* (cluster-wide) settings. Keys are unique across that addon's whole schema, so
-* the reader can walk every section instead of trusting the section id.
-*/
-var NATIVE_LEASE_SECTION_ID = "native-lease";
-var NATIVE_LEASE_TTL_KEY = "nativeLeaseTtlMs";
-var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
-var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
-var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
-/**
-* WHICH delivered frames the decode worker retains a native copy of.
-*
-* - `all` — every frame the worker delivered to the runner. The shipped
-*   behaviour, and the only correct one if something can ask for a crop of a
-*   frame the runner never sent to inference.
-* - `inferred` — only the frames the runner ADMITTED to its detection queue.
-*   A native-crop request always names a `frameId` that rode an inference
-*   result, so that is the only set a request can name. How much it drops is
-*   the two-plane governor's admit ratio and nothing else: measured at ~50% on
-*   this cluster, not the ~80% the design sketch assumed, because the governor
-*   was not throttling as hard as the sketch supposed. Read
-*   `leaseAdmitted`/`leaseOffered` off the metrics line for the camera in front
-*   of you rather than quoting a number from here. The newest delivered frame is
-*   croppable regardless — it is still the worker's reserved slot, not a lease —
-*   which covers the one-frame race between a mark and the supersede that
-*   consumes it.
-*/
-var NativeLeaseAdmissionSchema = zod.z.enum(["all", "inferred"]);
-/**
-* Operator-tunable native-lease settings. Bounds are enforced HERE (not only in
-* the slider) because the value also travels to a forked child process, where a
-* junk number would silently become a 0-length or unbounded retention window.
-*/
-var NativeLeaseSettingsSchema = zod.z.object({
-	/**
-	* How long a retained native frame is served before it counts as a miss.
-	*
-	* Must cover the FULL late-crop horizon: detection inference + the
-	* cross-process inference-result hop to hub post-analysis + tracking + the
-	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-	* RAM per busy camera grows linearly with no measured hit-rate gain.
-	*/
-	ttlMs: zod.z.number().int().min(250).max(1e4),
-	/**
-	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
-	*
-	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-	* which one is actually binding before reasoning from that. At the shipped
-	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
-	* change that admits fewer frames buys retention WINDOW at constant RAM
-	* rather than giving RAM back — lower this knob if RAM is what you wanted.
-	* `0` DISABLES the lease entirely and falls the worker back to the tiny
-	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
-	* to replace).
-	*/
-	budgetMb: zod.z.number().int().min(0).max(4096),
-	/**
-	* Demand window: eager per-frame native retention runs only within this many
-	* ms of the last native-crop request (or of the dial starting).
-	*
-	* `0` means ALWAYS ON — it disables the gate, it does not disable retention.
-	* That is the legacy behaviour that saturated an N100 (24 native-4K downloads
-	* per second on a camera with zero crop demand), so leave it non-zero unless
-	* you are reproducing that.
-	*/
-	activityMs: zod.z.number().int().min(0).max(12e4),
-	/**
-	* Which delivered frames are retained at all — see
-	* {@link NativeLeaseAdmissionSchema}. This is the only knob of the four that
-	* changes WHAT is kept rather than for how long, so it is also the only one
-	* that can turn a crop that used to hit into a miss. The worker counts every
-	* crop request naming a frame it did NOT see marked
-	* (`leaseUnmarkedCrops` on the session-decode metrics line): a non-zero value
-	* there is the signal that some caller names frames outside the inference set
-	* and that this must go back to `all`.
-	*/
-	admission: NativeLeaseAdmissionSchema
-});
-/**
-* The values in force when the operator has set nothing — byte-for-byte the
-* constants the decode worker shipped with as env-var defaults, so making these
-* settings changed no behaviour on the day it landed.
-*/
-var DEFAULT_NATIVE_LEASE_SETTINGS = {
-	ttlMs: 1200,
-	budgetMb: 1024,
-	activityMs: 15e3,
-	admission: "inferred"
-};
-/** Slider bounds for the operator-facing knobs (orchestrator settings UI). */
-var NATIVE_LEASE_TTL_FIELD = {
-	min: 250,
-	max: 1e4,
-	step: 50,
-	default: DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs
-};
-var NATIVE_LEASE_BUDGET_FIELD = {
-	min: 0,
-	max: 4096,
-	step: 64,
-	default: DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb
-};
-var NATIVE_LEASE_ACTIVITY_FIELD = {
-	min: 0,
-	max: 12e4,
-	step: 1e3,
-	default: DEFAULT_NATIVE_LEASE_SETTINGS.activityMs
-};
-/** Select options for the admission knob (orchestrator settings UI). */
-var NATIVE_LEASE_ADMISSION_FIELD = {
-	options: [{
-		value: "all",
-		label: "Every delivered frame"
-	}, {
-		value: "inferred",
-		label: "Only frames sent to inference"
-	}],
-	default: DEFAULT_NATIVE_LEASE_SETTINGS.admission
-};
-/**
-* Parse one knob, reporting `null` for absent, junk, out-of-bounds — AND for a
-* value equal to the shipped default.
-*
-* That last rule is not tidiness, it is the difference between the documented
-* precedence being true and being a lie. `addon-settings.getGlobalSettings`
-* returns a HYDRATED payload, and `hydrateField` fills an unstored field with
-* the schema's own `default` (verified live on the hub: a cluster that has never
-* opened the form still reports `nativeLeaseTtlMs = 1200`). A reader that took
-* that at face value would report all three knobs as "set" on every cluster on
-* the day this shipped, permanently retiring the `CAMSTACK_SESSION_NATIVE_LEASE_*`
-* emergency override that the precedence promises. There is no raw-store read on
-* this cap to distinguish the two, so the default value itself is treated as
-* "the operator has expressed no preference" — which is also what leaving a
-* slider untouched means.
-*
-* The cost is one honest edge: an operator who deliberately selects the default
-* value in order to overrule an env var does not get it. Clear the env var
-* instead; the worker's spawn line names the source, so this is visible rather
-* than mysterious.
-*/
-function readKnob(knob, raw) {
-	const parsed = NativeLeaseSettingsSchema.shape[knob].safeParse(raw);
-	if (!parsed.success) return null;
-	return parsed.data === DEFAULT_NATIVE_LEASE_SETTINGS[knob] ? null : parsed.data;
-}
-/** {@link readKnob} for the one non-numeric knob. Same default-means-unset rule. */
-function readAdmissionKnob(raw) {
-	const parsed = NativeLeaseAdmissionSchema.safeParse(raw);
-	if (!parsed.success) return null;
-	return parsed.data === DEFAULT_NATIVE_LEASE_SETTINGS.admission ? null : parsed.data;
-}
-/**
-* Narrow a FLAT settings record to the knobs the operator set.
-*
-* Per-FIELD parse, deliberately: a junk TTL must not also discard a valid
-* budget. An absent, out-of-bounds or default-valued knob is OMITTED (not
-* clamped, not defaulted) so the caller can still fall through to the env
-* override — clamping here would turn a typo into a value nobody chose. See
-* {@link readKnob} for why the default counts as unset.
-*/
-function readNativeLeaseOverride(config) {
-	const ttlMs = readKnob("ttlMs", config[NATIVE_LEASE_TTL_KEY]);
-	const budgetMb = readKnob("budgetMb", config[NATIVE_LEASE_BUDGET_KEY]);
-	const activityMs = readKnob("activityMs", config[NATIVE_LEASE_ACTIVITY_KEY]);
-	const admission = readAdmissionKnob(config[NATIVE_LEASE_ADMISSION_KEY]);
-	return {
-		...ttlMs === null ? {} : { ttlMs },
-		...budgetMb === null ? {} : { budgetMb },
-		...activityMs === null ? {} : { activityMs },
-		...admission === null ? {} : { admission }
-	};
-}
-function isHydratedField(entry) {
-	return typeof entry === "object" && entry !== null && "key" in entry;
-}
-var LEASE_KEYS = [
-	NATIVE_LEASE_TTL_KEY,
-	NATIVE_LEASE_BUDGET_KEY,
-	NATIVE_LEASE_ACTIVITY_KEY,
-	NATIVE_LEASE_ADMISSION_KEY
-];
-/**
-* Extract the operator's lease overrides from an
-* `addon-settings.getGlobalSettings` payload.
-*
-* Walks EVERY section rather than looking inside {@link NATIVE_LEASE_SECTION_ID}
-* alone: the keys are unique across the addon's schema, and a section rename
-* must not silently revert the whole cluster to the defaults. A `null` payload
-* (addon mid-boot) means "operator set nothing" — the env/default fallback then
-* applies, which is the correct read of "I could not ask".
-*/
-function pickNativeLeaseOverride(view) {
-	if (view === null) return {};
-	const flat = {};
-	for (const section of view.sections) for (const entry of section.fields) {
-		if (!isHydratedField(entry) || typeof entry.key !== "string") continue;
-		if (LEASE_KEYS.includes(entry.key)) flat[entry.key] = entry.value;
-	}
-	return readNativeLeaseOverride(flat);
-}
-//#endregion
 //#region src/helpers/bind-addon-actions.ts
 /**
 * Bind an addon's custom-action catalog to its tRPC surface, returning a
@@ -38140,7 +38432,7 @@ exports.APPLE_SA_TO_MACRO = APPLE_SA_TO_MACRO;
 exports.AUDIO_ANALYSIS_CAP_NAME = AUDIO_ANALYSIS_CAP_NAME;
 exports.AUDIO_BACKEND_CHOICES = AUDIO_BACKEND_CHOICES;
 exports.AUDIO_MACRO_LABELS = AUDIO_MACRO_LABELS;
-exports.AUDIO_PRESETS = require_fmp4_box_splitter.AUDIO_PRESETS;
+exports.AUDIO_PRESETS = require_canonical_hash.AUDIO_PRESETS;
 exports.AccessoriesStatusSchema = AccessoriesStatusSchema;
 exports.AccessoryKind = AccessoryKind;
 exports.AddBrokerInputSchema = AddBrokerInputSchema;
@@ -38237,6 +38529,7 @@ exports.CAP_NODE_PIN_CONTEXT_KEY = require_sleep.CAP_NODE_PIN_CONTEXT_KEY;
 exports.CAP_PROVIDER_KIND_MAP = CAP_PROVIDER_KIND_MAP;
 exports.COCO_80_LABELS = COCO_80_LABELS;
 exports.COCO_TO_MACRO = COCO_TO_MACRO;
+exports.CORE_BLOCK_ADDON_PREFIX = CORE_BLOCK_ADDON_PREFIX;
 exports.CamProfileSchema = require_sleep.CamProfileSchema;
 exports.CamStreamDescriptorSchema = CamStreamDescriptorSchema;
 exports.CamStreamKindSchema = require_sleep.CamStreamKindSchema;
@@ -38309,6 +38602,8 @@ exports.CreateUserInputSchema = CreateUserInputSchema;
 exports.CustomActionInputSchema = CustomActionInputSchema;
 exports.CustomModelDescriptorSchema = CustomModelDescriptorSchema;
 exports.DATAPLANE_SECRET_HEADER = require_sleep.DATAPLANE_SECRET_HEADER;
+exports.DECLARED_DEVICE_SWEEP_LIMIT = DECLARED_DEVICE_SWEEP_LIMIT;
+exports.DECLARED_INTEGRATION_FIXED_KEY = DECLARED_INTEGRATION_FIXED_KEY;
 exports.DEFAULT_ADDON_PLACEMENT = DEFAULT_ADDON_PLACEMENT;
 exports.DEFAULT_AUDIO_ANALYZER_CONFIG = DEFAULT_AUDIO_ANALYZER_CONFIG;
 exports.DEFAULT_DECODER_HWACCEL_CONFIG = DEFAULT_DECODER_HWACCEL_CONFIG;
@@ -38337,6 +38632,7 @@ exports.DayNightModeSchema = DayNightModeSchema;
 exports.DayNightOptionsSchema = DayNightOptionsSchema;
 exports.DayNightSettingsPatchSchema = DayNightSettingsPatchSchema;
 exports.DayNightStatusSchema = DayNightStatusSchema;
+exports.DeclaredDevices = DeclaredDevices;
 exports.DecodedAudioChunkSchema = require_sleep.DecodedAudioChunkSchema;
 exports.DecodedFrameSchema = require_sleep.DecodedFrameSchema;
 exports.DecoderSessionConfigSchema = DecoderSessionConfigSchema;
@@ -38352,7 +38648,6 @@ exports.DeviceExportStatusSchema = DeviceExportStatusSchema;
 exports.DeviceExportUnexposeInputSchema = UnexposeInputSchema;
 exports.DeviceFeature = require_sleep.DeviceFeature;
 exports.DeviceInfoSchema = DeviceInfoSchema;
-exports.DeviceLinkModeSchema = DeviceLinkModeSchema;
 exports.DeviceNetworkStatsSchema = DeviceNetworkStatsSchema;
 exports.DeviceRole = require_sleep.DeviceRole;
 exports.DeviceRuntimeState = DeviceRuntimeState;
@@ -38410,14 +38705,19 @@ exports.ExportStateSchema = ExportStateSchema;
 exports.ExportTimelapseSchema = ExportTimelapseSchema;
 exports.ExposedDeviceSchema = ExposedDeviceSchema;
 exports.ExposureModeSchema = ExposureModeSchema;
+exports.ExpressionBindingSourceSchema = ExpressionBindingSourceSchema;
 exports.ExpressionEvalError = ExpressionEvalError;
+exports.ExpressionFieldBindingSchema = ExpressionFieldBindingSchema;
+exports.ExpressionGlobalBindingSchema = ExpressionGlobalBindingSchema;
+exports.ExpressionLiteralBindingSchema = ExpressionLiteralBindingSchema;
 exports.ExpressionParseError = ExpressionParseError;
+exports.ExpressionSourceSchema = ExpressionSourceSchema;
 exports.FanControlStatusSchema = FanControlStatusSchema;
 exports.FanDirectionSchema = FanDirectionSchema;
 exports.FeatureManifestSchema = FeatureManifestSchema;
 exports.FeatureProbeStatusSchema = FeatureProbeStatusSchema;
 exports.FloodStatusSchema = FloodStatusSchema;
-exports.Fmp4BoxSplitter = require_fmp4_box_splitter.Fmp4BoxSplitter;
+exports.Fmp4BoxSplitter = require_canonical_hash.Fmp4BoxSplitter;
 exports.FrameHandleFormatSchema = require_sleep.FrameHandleFormatSchema;
 exports.FrameHandleSchema = require_sleep.FrameHandleSchema;
 exports.FrameInputSchema = FrameInputSchema;
@@ -38459,6 +38759,7 @@ exports.LabelTierSchema = LabelTierSchema;
 exports.LawnMowerActivitySchema = LawnMowerActivitySchema;
 exports.LawnMowerControlStatusSchema = LawnMowerControlStatusSchema;
 exports.LinkedDeviceSchema = LinkedDeviceSchema;
+exports.LinkedDevicesModeSchema = LinkedDevicesModeSchema;
 exports.LlmDefaultSchema = LlmDefaultSchema;
 exports.LlmDefaultSelectorSchema = LlmDefaultSelectorSchema;
 exports.LlmErrorCodeSchema = LlmErrorCodeSchema;
@@ -38929,7 +39230,6 @@ exports.airQualitySensorCapability = airQualitySensorCapability;
 exports.alarmPanelCapability = alarmPanelCapability;
 exports.alertsCapability = alertsCapability;
 exports.ambientLightSensorCapability = ambientLightSensorCapability;
-exports.applyTransform = applyTransform;
 exports.asBoolean = require_sleep.asBoolean;
 exports.asJsonArray = require_sleep.asJsonArray;
 exports.asJsonObject = require_sleep.asJsonObject;
@@ -38939,7 +39239,7 @@ exports.audioAnalysisCapability = audioAnalysisCapability;
 exports.audioAnalyzerCapability = audioAnalyzerCapability;
 exports.audioCodecCapability = audioCodecCapability;
 exports.audioMetricsCapability = audioMetricsCapability;
-exports.audioPlanFromEncodeProfile = require_fmp4_box_splitter.audioPlanFromEncodeProfile;
+exports.audioPlanFromEncodeProfile = require_canonical_hash.audioPlanFromEncodeProfile;
 exports.authProviderCapability = authProviderCapability;
 exports.autoAssignProfiles = autoAssignProfiles;
 exports.automationControlCapability = automationControlCapability;
@@ -38952,14 +39252,14 @@ exports.bindAddonActions = bindAddonActions;
 exports.brightnessCapability = brightnessCapability;
 exports.brokerCapability = brokerCapability;
 exports.buildAddonRouteProvider = buildAddonRouteProvider;
-exports.buildAudioArgs = require_fmp4_box_splitter.buildAudioArgs;
+exports.buildAudioArgs = require_canonical_hash.buildAudioArgs;
 exports.buildEventKindDescriptor = buildEventKindDescriptor;
-exports.buildFfmpegArgs = require_fmp4_box_splitter.buildFfmpegArgs;
-exports.buildInputArgs = require_fmp4_box_splitter.buildInputArgs;
+exports.buildFfmpegArgs = require_canonical_hash.buildFfmpegArgs;
+exports.buildInputArgs = require_canonical_hash.buildInputArgs;
 exports.buildModelVariantGroups = buildModelVariantGroups;
 exports.buildNcTaxonomy = buildNcTaxonomy;
 exports.buildStreamParamsConfigSchema = buildStreamParamsConfigSchema;
-exports.buildVideoArgs = require_fmp4_box_splitter.buildVideoArgs;
+exports.buildVideoArgs = require_canonical_hash.buildVideoArgs;
 exports.buttonCapability = buttonCapability;
 exports.cameraCredentialsCapability = cameraCredentialsCapability;
 exports.cameraPipelineConfigCapability = cameraPipelineConfigCapability;
@@ -38982,6 +39282,8 @@ exports.consumablesCapability = consumablesCapability;
 exports.contactCapability = contactCapability;
 exports.controlCapability = controlCapability;
 exports.convertUnit = convertUnit;
+exports.coreBlockAddonId = coreBlockAddonId;
+exports.coreBlockIdFromAddonId = coreBlockIdFromAddonId;
 exports.coreBlocksCapability = coreBlocksCapability;
 exports.cosineSimilarity = cosineSimilarity;
 exports.coverCapability = coverCapability;
@@ -38999,6 +39301,7 @@ exports.customAction = customAction;
 exports.customModelRegistryCapability = customModelRegistryCapability;
 exports.dataStoreProviderCapability = dataStoreProviderCapability;
 exports.dayNightCapability = dayNightCapability;
+exports.declarationOwnerNodeId = declarationOwnerNodeId;
 exports.decodeVectorBase64 = decodeVectorBase64;
 exports.decoderCapability = decoderCapability;
 exports.defaultDeviceFor = defaultDeviceFor;
@@ -39033,7 +39336,7 @@ exports.enumerateItemArrayFields = enumerateItemArrayFields;
 exports.enumerateSchemaFields = enumerateSchemaFields;
 exports.errMsg = require_err_msg.errMsg;
 exports.evaluateAst = evaluateAst;
-exports.evaluateLinkExpression = evaluateLinkExpression;
+exports.evaluateExpressionSource = evaluateExpressionSource;
 exports.evaluateZoneRules = evaluateZoneRules;
 exports.event = require_sleep.event;
 exports.eventEmitterCapability = eventEmitterCapability;
@@ -39064,7 +39367,7 @@ exports.imageCapability = imageCapability;
 exports.imageSettingsCapability = imageSettingsCapability;
 exports.integrationsCapability = integrationsCapability;
 exports.intercomCapability = intercomCapability;
-exports.invocationFromEncodeProfile = require_fmp4_box_splitter.invocationFromEncodeProfile;
+exports.invocationFromEncodeProfile = require_canonical_hash.invocationFromEncodeProfile;
 exports.isAgentOnlyPlacement = isAgentOnlyPlacement;
 exports.isArrayOutputSchema = isArrayOutputSchema;
 exports.isBaseConditionKey = isBaseConditionKey;
@@ -39077,7 +39380,7 @@ exports.isNode = isNode;
 exports.isObjectInput = isObjectInput;
 exports.isSameAddonId = isSameAddonId;
 exports.isScheduleActive = isScheduleActive;
-exports.isSoftwareDecode = require_fmp4_box_splitter.isSoftwareDecode;
+exports.isSoftwareDecode = require_canonical_hash.isSoftwareDecode;
 exports.isVoidInput = isVoidInput;
 exports.jobKindSchema = jobKindSchema;
 exports.kebabToCamel = kebabToCamel;
@@ -39092,7 +39395,7 @@ exports.llmRuntimeCapability = llmRuntimeCapability;
 exports.localNetworkCapability = localNetworkCapability;
 exports.locationSimilarity = locationSimilarity;
 exports.lockControlCapability = lockControlCapability;
-exports.logBannerArgs = require_fmp4_box_splitter.logBannerArgs;
+exports.logBannerArgs = require_canonical_hash.logBannerArgs;
 exports.logDestinationCapability = logDestinationCapability;
 exports.logLevelAtMost = logLevelAtMost;
 exports.loginMethodCapability = loginMethodCapability;
@@ -39143,7 +39446,7 @@ exports.pickAccessoryControl = pickAccessoryControl;
 exports.pickDetailCropConvention = pickDetailCropConvention;
 exports.pickNativeLeaseOverride = pickNativeLeaseOverride;
 exports.pickPreferredRtspEntry = pickPreferredRtspEntry;
-exports.pickVideoEncoder = require_fmp4_box_splitter.pickVideoEncoder;
+exports.pickVideoEncoder = require_canonical_hash.pickVideoEncoder;
 exports.pickerForCondition = pickerForCondition;
 exports.pipelineAnalyticsCapability = pipelineAnalyticsCapability;
 exports.pipelineExecutorCapability = pipelineExecutorCapability;