@camstack/types 1.2.46 → 1.2.48

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { t as EventCategory } from "./event-category-41fKf-q9.mjs";
-import { $ as FrameHandleSchema, A as method, B as readinessKey, C as DeviceType, Ct as collectHydratedFieldEntries, D as event, E as DEVICE_STATUS_METHOD, Et as resolveHydratedFieldValue, F as readNodePin, G as CamProfileSchema, H as BrokerStatsSchema, I as toNodeId, J as CameraStreamSchema, K as CamStreamKindSchema, L as ReadinessRegistry, M as systemMethod, N as CAP_NODE_PIN_CONTEXT_KEY, O as expandCapMethods, P as nodePin, Q as FrameHandleFormatSchema, R as ReadinessTimeoutError, S as DeviceRole, St as WELL_KNOWN_TAB_MAP, T as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Tt as hydrateSchema, U as BrokerStatusSchema, V as scopeKey, W as CAM_PROFILE_ORDER, X as DecodedFrameSchema, Y as DecodedAudioChunkSchema, Z as EncodedPacketSchema, _ as RawStateResultSchema, _t as createDurableState, a as asJsonObject, at as SubscribeAudioChunksInputSchema, b as ChargingStatus, bt as isEvent, c as parseJsonArray, ct as SubscribeFramesResultSchema, d as DEVICE_SCOPED_CAPS, dt as parseProfileBrokerId, et as ProfileRtspEntrySchema, f as isDeviceScopedCap, ft as selectAssignedProfileSlots, g as createSliceHandle, gt as normalizeAddonInitResult, h as createMirrorSource, ht as BaseAddon, i as asJsonArray, it as StreamSourceSchema, j as resolveCapMount, k as isDeviceConfigCap, l as parseJsonObject, lt as makeProfileBrokerId, m as createLazyTrpcSource, mt as DisposerChain, n as sleepCancellable, nt as ProfileSlotStatusSchema, o as asNumber, ot as SubscribeAudioChunksResultSchema, p as createDeviceProxy, pt as DATAPLANE_SECRET_HEADER, q as CamStreamResolutionSchema, r as asBoolean, rt as StreamSourceEntrySchema, s as asString, st as SubscribeFramesInputSchema, t as sleep, tt as ProfileSlotSchema, u as parseJsonUnknown, ut as makeSourceBrokerId, v as deviceOpsCapability, vt as createEvent, w as adminUiCapability, wt as collectHydratedFieldValues, x as DeviceFeature, xt as WELL_KNOWN_TABS, y as viewerUiCapability, yt as emitReadiness, z as emitDownForOwnedCaps } from "./sleep-BbYwFLG6.mjs";
-import { a as buildAudioArgs, c as buildVideoArgs, d as logBannerArgs, f as pickVideoEncoder, i as audioPlanFromEncodeProfile, l as invocationFromEncodeProfile, n as canonicalHash, o as buildFfmpegArgs, r as AUDIO_PRESETS, s as buildInputArgs, t as Fmp4BoxSplitter, u as isSoftwareDecode } from "./fmp4-box-splitter-B53u9-Nu.mjs";
+import { $ as FrameHandleSchema, A as method, B as readinessKey, C as DeviceType, Ct as collectHydratedFieldEntries, D as event, E as DEVICE_STATUS_METHOD, Et as resolveHydratedFieldValue, F as readNodePin, G as CamProfileSchema, H as BrokerStatsSchema, I as toNodeId, J as CameraStreamSchema, K as CamStreamKindSchema, L as ReadinessRegistry, M as systemMethod, N as CAP_NODE_PIN_CONTEXT_KEY, O as expandCapMethods, P as nodePin, Q as FrameHandleFormatSchema, R as ReadinessTimeoutError, S as DeviceRole, St as WELL_KNOWN_TAB_MAP, T as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Tt as hydrateSchema, U as BrokerStatusSchema, V as scopeKey, W as CAM_PROFILE_ORDER, X as DecodedFrameSchema, Y as DecodedAudioChunkSchema, Z as EncodedPacketSchema, _ as RawStateResultSchema, _t as createDurableState, a as asJsonObject, at as SubscribeAudioChunksInputSchema, b as ChargingStatus, bt as isEvent, c as parseJsonArray, ct as SubscribeFramesResultSchema, d as DEVICE_SCOPED_CAPS, dt as parseProfileBrokerId, et as ProfileRtspEntrySchema, f as isDeviceScopedCap, ft as selectAssignedProfileSlots, g as createSliceHandle, gt as normalizeAddonInitResult, h as createMirrorSource, ht as BaseAddon, i as asJsonArray, it as StreamSourceSchema, j as resolveCapMount, k as isDeviceConfigCap, l as parseJsonObject, lt as makeProfileBrokerId, m as createLazyTrpcSource, mt as DisposerChain, n as sleepCancellable, nt as ProfileSlotStatusSchema, o as asNumber, ot as SubscribeAudioChunksResultSchema, p as createDeviceProxy, pt as DATAPLANE_SECRET_HEADER, q as CamStreamResolutionSchema, r as asBoolean, rt as StreamSourceEntrySchema, s as asString, st as SubscribeFramesInputSchema, t as sleep, tt as ProfileSlotSchema, u as parseJsonUnknown, ut as makeSourceBrokerId, v as deviceOpsCapability, vt as createEvent, w as adminUiCapability, wt as collectHydratedFieldValues, x as DeviceFeature, xt as WELL_KNOWN_TABS, y as viewerUiCapability, yt as emitReadiness, z as emitDownForOwnedCaps } from "./sleep-7WqNZVcL.mjs";
+import { a as buildAudioArgs, c as buildVideoArgs, d as logBannerArgs, f as pickVideoEncoder, i as audioPlanFromEncodeProfile, l as invocationFromEncodeProfile, n as Fmp4BoxSplitter, o as buildFfmpegArgs, r as AUDIO_PRESETS, s as buildInputArgs, t as canonicalHash, u as isSoftwareDecode } from "./canonical-hash-rO1sRmEK.mjs";
 import { EventSourceType } from "./enums.mjs";
 import { t as errMsg } from "./err-msg-IQTHeDzc.mjs";
 import { z } from "zod";
@@ -4325,12 +4325,34 @@ var streamBrokerCapability = {
 			kinds: z.array(EventMediaKindSchema).min(1).default(["mp4"]),
 			/** GIF geometry. The video keeps the source's own. */
 			gifMaxWidth: z.number().int().min(120).max(1280).default(640),
-			gifFps: z.number().int().min(1).max(15).default(8),
 			/**
-			* Playback rate, applied to EVERY container so they stay one clip.
-			* `1` is real time and is what allows the copy branch.
+			* The gif's own PLAYBACK rate in frames per second — what the finished
+			* gif runs at, not how many source frames feed it. The decimation that
+			* feeds it samples `gifFps / gifSpeed` source frames per second, so at
+			* the defaults a 12 fps gif is built out of 3 source frames a second.
 			*/
-			speed: z.number().min(1).max(8).default(1)
+			gifFps: z.number().int().min(1).max(15).default(12),
+			/**
+			* How fast the GIF plays against real time, independent of `speed`.
+			*
+			* 4× by default, by operator request: a notification gif is glanced at
+			* on a lock screen, so a ~12 s window has to be over in ~3 s. It stays
+			* a separate knob from `speed` even though both now default to 4 —
+			* a caller wanting a real-time video and a fast gif must not have to
+			* choose.
+			*/
+			gifSpeed: z.number().min(1).max(8).default(4),
+			/**
+			* Playback rate of the VIDEO. Also 4× by default, by operator decision.
+			*
+			* `1` is real time and is the ONLY value that allows the copy branch —
+			* anything else forces `libx264` over the window. That was priced
+			* before it was chosen: a per-event burst measured at 0.23 s and 254 KB
+			* on a real 615 720p cut, against 922 KB for the copy it replaces. A
+			* re-encode is capped at 720p (`EVENT_CLIP_ENCODE_MAX_WIDTH`), because
+			* once the decode is forced the width stops being free.
+			*/
+			speed: z.number().min(1).max(8).default(4)
 		}), EventMediaProductionSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -4927,6 +4949,28 @@ function kebabToCamel(s) {
 * instead of taking the hub with it (D6). Every method here is admin-only, and
 * must stay so.
 */
+/**
+* Prefix for a block's generated addon id AND its runner id — one addon, one
+* process, so the two are the same string (D2).
+*
+* It lives on the CONTRACT rather than beside the code that materialises the
+* package, because it is not an implementation detail: the operator surface
+* reads a block's logs by asking `logs.query` for `addonId = core-block-<id>`,
+* with no cap and no store of its own. Two copies of this string is one copy
+* too many — a drift would show as a logs pane that is simply always empty.
+*/
+var CORE_BLOCK_ADDON_PREFIX = "core-block-";
+/** The addon/runner id a block's process runs under. */
+function coreBlockAddonId(blockId) {
+	return `${CORE_BLOCK_ADDON_PREFIX}${blockId}`;
+}
+/** The block id behind a generated addon/runner id, or null when the id belongs
+*  to something else. The inverse of {@link coreBlockAddonId}. */
+function coreBlockIdFromAddonId(addonId) {
+	if (!addonId.startsWith("core-block-")) return null;
+	const rest = addonId.slice(11);
+	return rest.length > 0 ? rest : null;
+}
 /** Where a block runs. The operator chooses — a block driving a device on an
 *  agent is the reason placement is not fixed to the hub. */
 var CoreBlockPlacementSchema = z.union([z.literal("hub"), z.string().min(1)]);
@@ -5015,6 +5059,23 @@ var coreBlocksCapability = {
 			auth: "admin"
 		}),
 		/**
+		* Stop this block's runner and let the supervisor bring it back.
+		*
+		* **It stores nothing.** There is no "restart requested" flag and no second
+		* lifecycle field: the supervisor already stops and respawns a runner when
+		* the code hash changes, and this exposes that same path deliberately
+		* (D62 — a switch writes the authority that already owned the function).
+		* The next reconcile pass remains the authority, so a restart that lost a
+		* race is corrected within one pass rather than leaving a stale flag behind.
+		*
+		* Refused for a DISABLED block: nothing would come back, and a button that
+		* silently does nothing is worse than one that says why.
+		*/
+		restart: method(z.object({ blockId: z.string() }), z.object({ block: CoreBlockSchema }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Type-check without saving — what the editor calls as the author types, so
 		* the compiler's verdict is the same one the server will reach.
 		*/
@@ -6230,1114 +6291,247 @@ var deviceExportCapability = {
 	}
 };
 //#endregion
-//#region src/expression/limits.ts
+//#region src/capabilities/device-provider.cap.ts
+var ProviderStatusSchema = z.object({
+	connected: z.boolean(),
+	deviceCount: z.number(),
+	error: z.string().optional()
+});
+var DiscoveredDeviceSchema = z.object({
+	externalId: z.string(),
+	name: z.string(),
+	type: z.string(),
+	metadata: z.record(z.string(), z.unknown()).optional()
+});
 /**
-* Resource-bound constants for the safe expression engine.
-*
-* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
-* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
-* O(nodeCount) by construction. These caps merely put a hard ceiling on the
-* work a single author-supplied expression can request, so a hostile or
-* accidental pathological string can never spend unbounded CPU/memory.
+* Candidate handed back from discovery and accepted by
+* `adoptDiscoveredDevice`. Shape mirrors the in-process
+* `DiscoveredDevice` interface used by `DeviceDiscovery`.
 */
-/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
-*  rejected without allocation. */
-var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
-/** Max AST nodes — checked during parse; a deeply nested grouping that exceeds
-*  this is rejected as "expression too complex". */
-var MAX_EXPRESSION_AST_NODES = 256;
-/** Defense-in-depth walker step budget — one increment per node visit during
-*  evaluation. The grammar guarantees O(nodeCount) walks, so this can only trip
-*  on a crafted maximum-size AST. */
-var MAX_EXPRESSION_EVAL_STEPS = 4096;
-/** Max named bindings on one `DeviceLinkExpressionSource`. */
-var MAX_EXPRESSION_BINDINGS = 32;
-/** Max positional arguments to any builtin call. */
-var MAX_EXPRESSION_CALL_ARGS = 16;
-/** LRU compile-cache capacity (parsed ASTs keyed by raw source string). */
-var EXPRESSION_COMPILE_CACHE_CAPACITY = 256;
-/** A legal binding / identifier name. */
-var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/** Binding names an author may NOT use: `now` is auto-injected; the literal
-*  keywords lex as values, not identifiers, so binding to them is meaningless. */
-var RESERVED_BINDING_NAMES = new Set([
-	"now",
-	"true",
-	"false",
-	"null"
-]);
-//#endregion
-//#region src/expression/errors.ts
+var DiscoveryCandidateSchema = z.object({
+	stableId: z.string(),
+	type: z.enum(DeviceType),
+	suggestedName: z.string(),
+	prefilledConfig: z.record(z.string(), z.unknown()),
+	/**
+	* Optional upstream-system identity (HA entity_id, vendor MAC, …).
+	* Discovery pre-populates this for systems that know the upstream
+	* identity ahead of adoption. Rendering metadata (unit, precision)
+	* flows live through the cap STATUS SLICE after adoption.
+	*/
+	sourceInfo: SourceInfoSchema.optional()
+});
 /**
-* Error types for the safe expression engine. Two distinct classes so callers
-* can tell a compile-time (grammar) failure from a runtime (evaluation)
-* failure — both are non-fatal to the host: read paths degrade to "skip link".
+* Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
+* Mirrors `toDeviceShape()` output in `device-management.router.ts` so the
+* tRPC layer can pass it through without reshaping.
 */
-/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
-*  the failure is anchored to a character (author-facing inline feedback). */
-var ExpressionParseError = class extends Error {
-	position;
-	constructor(message, position) {
-		super(message);
-		this.name = "ExpressionParseError";
-		this.position = position;
-	}
-};
-/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
-*  result, unknown builtin, step-budget exceeded). */
-var ExpressionEvalError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ExpressionEvalError";
-	}
-};
-//#endregion
-//#region src/expression/builtins.ts
+var DeviceSummarySchema = z.object({
+	id: z.number(),
+	stableId: z.string(),
+	addonId: z.string(),
+	type: z.string(),
+	name: z.string(),
+	parentDeviceId: z.number().nullable(),
+	online: z.boolean(),
+	features: z.array(z.string()),
+	config: z.record(z.string(), z.unknown()),
+	/** Optional upstream-system identity (dispatch key + system tag).
+	*  See `SourceInfo`. Present when the device has a non-synthetic
+	*  source identifier (HA entities, vendor MAC, …); omitted when the
+	*  synthetic backfill is in effect. */
+	sourceInfo: SourceInfoSchema.optional()
+});
 /**
-* Frozen, null-prototype builtin function table for the expression engine
-* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
-* parser rejects any callee not in it, and the evaluator gates each call on an
-* own-property check against it.
-*
-* Because the object has a NULL prototype AND is `Object.freeze`d:
-*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
-*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
-*    (there is no `Object.prototype` in the chain), so those names are not
-*    callable — they are simply "unknown function" at parse time.
-*
-* Every numeric argument is validated as a finite number and every numeric
-* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
-* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
-* closed rather than emitting a garbage value.
+* Result of a live field test (e.g. probing an RTSP URL during device
+* creation). Matches the UI-side `FieldProbeResult` in
+* `interfaces/config-ui.ts` — the admin `FormBuilder` renders the
+* returned `labels` as chips next to the input.
 */
-function asFiniteNumber(value, name, index) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
-	return value;
-}
-function asString$1(value, name, index) {
-	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
-	return value;
-}
-function finiteResult(value, name) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
-	return value;
-}
-function allFiniteNumbers(args, name) {
-	return args.map((a, idx) => asFiniteNumber(a, name, idx));
-}
-var INF = Number.POSITIVE_INFINITY;
-var table = {
-	min: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
-	},
-	max: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
-	},
-	abs: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
-	},
-	floor: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
-	},
-	ceil: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
-	},
-	sqrt: {
-		minArgs: 1,
-		maxArgs: 1,
-		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
-	},
-	round: {
-		minArgs: 1,
-		maxArgs: 2,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "round", 0);
-			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
-			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
-			const factor = 10 ** digits;
-			return finiteResult(Math.round(x * factor) / factor, "round");
-		}
-	},
-	pow: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
-	},
-	clamp: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args) => {
-			const x = asFiniteNumber(args[0], "clamp", 0);
-			const lo = asFiniteNumber(args[1], "clamp", 1);
-			const hi = asFiniteNumber(args[2], "clamp", 2);
-			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
-			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
-		}
-	},
-	avg: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			const nums = allFiniteNumbers(args, "avg");
-			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
-		}
-	},
-	sum: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
-	},
-	coalesce: {
-		minArgs: 1,
-		maxArgs: INF,
-		apply: (args) => {
-			for (const a of args) if (a !== null) return a;
-			return null;
-		}
-	},
-	age: {
-		minArgs: 2,
-		maxArgs: 2,
-		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
-	},
-	convert: {
-		minArgs: 3,
-		maxArgs: 3,
-		apply: (args, hooks) => {
-			const x = asFiniteNumber(args[0], "convert", 0);
-			const from = asString$1(args[1], "convert", 1).trim();
-			const to = asString$1(args[2], "convert", 2).trim();
-			if (hooks.convert) {
-				const out = hooks.convert(x, from, to);
-				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
-				return finiteResult(out, "convert");
-			}
-			if (from === to) return x;
-			throw new ExpressionEvalError("convert: unit conversion table not installed");
-		}
-	}
-};
-/** Frozen, null-prototype builtin table. */
-var EXPRESSION_BUILTINS = Object.freeze(Object.assign(Object.create(null), table));
-/** The set of valid builtin names — used by the parser to reject unknown
-*  callees at parse time (immediate author feedback). */
-var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
-//#endregion
-//#region src/expression/tokenizer.ts
+var FieldProbeResultSchema = z.object({
+	status: z.enum(["ok", "error"]),
+	labels: z.array(z.string()).optional(),
+	error: z.string().optional()
+});
 /**
-* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
-* zero-dependency. The grammar is deliberately boring: decimal numbers,
-* single/double-quoted strings with a tiny escape set, identifiers, the three
-* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
-* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
-* is a parse error with a source position, so member access / assignment /
-* template literals are lexically impossible.
+* The output of `getChildCreationSchema` is a UI schema tree. We store
+* it as `unknown` at the capability layer — the router just passes it
+* through and the admin UI renders it via `FormBuilder`. The actual
+* type is `ConfigUISchema` (see `packages/types/src/interfaces/config-ui.ts`),
+* but we deliberately avoid a Zod mirror because the union is large and
+* not meant for runtime validation at this seam.
 */
-var KEYWORDS = new Set([
-	"true",
-	"false",
-	"null"
-]);
-function isDigit(ch) {
-	return ch >= "0" && ch <= "9";
-}
-function isIdentStart(ch) {
-	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
-}
-function isIdentPart(ch) {
-	return isIdentStart(ch) || isDigit(ch);
-}
-function isWhitespace(ch) {
-	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
-}
-/** Tokenize `source` into a flat token list ending with a single `eof` token.
-*  Throws `ExpressionParseError` on any illegal character or unterminated
-*  string. */
-function tokenize(source) {
-	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
-	const tokens = [];
-	let i = 0;
-	const n = source.length;
-	while (i < n) {
-		const ch = source[i];
-		if (isWhitespace(ch)) {
-			i += 1;
-			continue;
-		}
-		if (isDigit(ch)) {
-			const start = i;
-			while (i < n && isDigit(source[i])) i += 1;
-			if (i < n && source[i] === ".") {
-				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
-				i += 1;
-				while (i < n && isDigit(source[i])) i += 1;
-			}
-			const text = source.slice(start, i);
-			const value = Number(text);
-			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
-			tokens.push({
-				type: "number",
-				value,
-				pos: start
-			});
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			const quote = ch;
-			const start = i;
-			i += 1;
-			let out = "";
-			let closed = false;
-			while (i < n) {
-				const c = source[i];
-				if (c === "\\") {
-					const next = i + 1 < n ? source[i + 1] : "";
-					if (next === "\\" || next === "'" || next === "\"") {
-						out += next;
-						i += 2;
-						continue;
-					}
-					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
-				}
-				if (c === quote) {
-					closed = true;
-					i += 1;
-					break;
-				}
-				out += c;
-				i += 1;
-			}
-			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
-			tokens.push({
-				type: "string",
-				value: out,
-				pos: start
-			});
-			continue;
-		}
-		if (isIdentStart(ch)) {
-			const start = i;
-			while (i < n && isIdentPart(source[i])) i += 1;
-			const text = source.slice(start, i);
-			if (KEYWORDS.has(text)) tokens.push({
-				type: "keyword",
-				keyword: keywordOf(text),
-				pos: start
-			});
-			else tokens.push({
-				type: "identifier",
-				name: text,
-				pos: start
-			});
-			continue;
-		}
-		const two = i + 1 < n ? source.slice(i, i + 2) : "";
-		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
-			tokens.push({
-				type: "punct",
-				punct: two,
-				pos: i
-			});
-			i += 2;
-			continue;
-		}
-		if (isSinglePunct(ch)) {
-			tokens.push({
-				type: "punct",
-				punct: ch,
-				pos: i
-			});
-			i += 1;
-			continue;
-		}
-		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+var CreationSchemaOutputSchema = z.unknown();
+var deviceProviderCapability = {
+	name: "device-provider",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		start: method(z.void(), z.void(), { kind: "mutation" }),
+		stop: method(z.void(), z.void(), { kind: "mutation" }),
+		getStatus: method(z.void(), ProviderStatusSchema),
+		getDevices: method(z.void(), z.array(z.object({
+			id: z.string(),
+			name: z.string(),
+			type: z.string()
+		}))),
+		supportsDiscovery: method(z.object({}), z.boolean()),
+		/**
+		* Run a network scan. `params` carries optional provider-specific scan
+		* inputs (e.g. a broadcast address / subnet for cross-subnet discovery),
+		* shaped by `getDiscoveryParamsSchema`. Omitted for the generic scan
+		* (provider uses its local-network default).
+		*/
+		discoverDevices: method(z.object({ params: z.record(z.string(), z.unknown()).optional() }), z.array(DiscoveryCandidateSchema), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Optional form schema (`ConfigUISchema`) for the EXTRA per-scan inputs a
+		* provider accepts (e.g. Gree's broadcast address for a different subnet).
+		* `null` when the provider takes no extra scan params — the generic
+		* aggregated scan never renders this; the per-integration scan does.
+		*/
+		getDiscoveryParamsSchema: method(z.object({}), CreationSchemaOutputSchema),
+		/**
+		* The DeviceType this provider creates via manual add (Camera for
+		* Reolink/ONVIF, Container for Gree, Hub for Ecowitt). `null` when the
+		* provider does not support manual creation. Lets the Add-Device dialog
+		* pick the right type instead of assuming Camera.
+		*/
+		getManualCreationType: method(z.object({}), z.object({ deviceType: z.enum(DeviceType).nullable() })),
+		adoptDiscoveredDevice: method(z.object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		supportsManualCreation: method(z.object({}), z.boolean()),
+		/**
+		* Fetch the creation form schema for a given DeviceType. Returns
+		* `null` when the provider does not support manually creating
+		* devices of that type. The output is a `ConfigUISchema` — the
+		* router type-asserts it at the boundary.
+		*/
+		getChildCreationSchema: method(z.object({ type: z.enum(DeviceType) }), CreationSchemaOutputSchema),
+		createDevice: method(z.object({
+			type: z.enum(DeviceType),
+			config: z.record(z.string(), z.unknown())
+		}), DeviceSummarySchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Test a single field in the creation form before the device has
+		* been persisted. Typical use: probing an RTSP URL entered by the
+		* user. Providers that don't support field probing return
+		* `{ success: true, message: 'Field test not supported' }`.
+		*
+		* `formValues` is the live snapshot of every field in the form at
+		* the moment the user clicked Test — useful for probes that depend
+		* on multiple fields together (e.g. Reolink autodetect needs host
+		* + credentials + UID + transport mode in a single call). Optional
+		* for backwards compatibility; providers free to ignore it.
+		*/
+		testCreationField: method(z.object({
+			type: z.enum(DeviceType),
+			key: z.string(),
+			value: z.unknown(),
+			formValues: z.record(z.string(), z.unknown()).optional()
+		}), FieldProbeResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
-	tokens.push({
-		type: "eof",
-		pos: n
-	});
-	return tokens;
-}
-function keywordOf(text) {
-	if (text === "true") return "true";
-	if (text === "false") return "false";
-	return "null";
-}
-function isSinglePunct(ch) {
-	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
-}
+};
 //#endregion
-//#region src/expression/parser.ts
+//#region src/capabilities/device-manager.cap.ts
 /**
-* Pratt (precedence-climbing) parser for the safe expression mini-language.
+* Device Manager capability — hub-side singleton that unifies device persistence,
+* live registry access, and all management operations into a single tRPC surface.
 *
-* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
-* → relational → additive → multiplicative → unary `! -` → call / primary.
-* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
-* string validated against the builtin table at parse time, so an unknown
-* function is rejected immediately (author feedback) and a persisted expression
-* that references a since-removed builtin degrades at read.
+* Replaces:
+*   - `device-persistence` capability (persistence methods absorbed here)
+*   - `device-management.router.ts` (deleted in Phase 2)
+*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
 *
-* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
-* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
-*/
-/** Binary/logical operator precedence (higher binds tighter). */
-var BINARY_PRECEDENCE = {
-	"||": 1,
-	"&&": 2,
-	"==": 3,
-	"!=": 3,
-	"<": 4,
-	"<=": 4,
-	">": 4,
-	">=": 4,
-	"+": 5,
-	"-": 5,
-	"*": 6,
-	"/": 6,
-	"%": 6
-};
-function isLogicalOp(op) {
-	return op === "&&" || op === "||";
-}
-function isBinaryOp(op) {
-	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
-}
-var Parser = class {
-	tokens;
-	pos = 0;
-	nodeCount = 0;
-	identifiers = /* @__PURE__ */ new Set();
-	callees = /* @__PURE__ */ new Set();
-	constructor(tokens) {
-		this.tokens = tokens;
-	}
-	parse() {
-		const ast = this.parseTernary();
-		const tok = this.peek();
-		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
-		return {
-			ast,
-			identifiers: this.identifiers,
-			callees: this.callees,
-			nodeCount: this.nodeCount
-		};
-	}
-	peek() {
-		return this.tokens[this.pos];
-	}
-	next() {
-		return this.tokens[this.pos++];
-	}
-	/** Consume a punctuator token, erroring if the next token isn't it. */
-	expectPunct(punct) {
-		const tok = this.peek();
-		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
-		this.pos += 1;
-	}
-	matchPunct(punct) {
-		const tok = this.peek();
-		if (tok.type === "punct" && tok.punct === punct) {
-			this.pos += 1;
-			return true;
-		}
-		return false;
-	}
-	countNode() {
-		this.nodeCount += 1;
-		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
-	}
-	parseTernary() {
-		const test = this.parseBinary(1);
-		if (this.matchPunct("?")) {
-			const consequent = this.parseTernary();
-			this.expectPunct(":");
-			const alternate = this.parseTernary();
-			this.countNode();
-			return {
-				kind: "conditional",
-				test,
-				consequent,
-				alternate
-			};
-		}
-		return test;
-	}
-	parseBinary(minPrec) {
-		let left = this.parseUnary();
-		for (;;) {
-			const tok = this.peek();
-			if (tok.type !== "punct") break;
-			const prec = BINARY_PRECEDENCE[tok.punct];
-			if (prec === void 0 || prec < minPrec) break;
-			const op = tok.punct;
-			this.pos += 1;
-			const right = this.parseBinary(prec + 1);
-			this.countNode();
-			if (isLogicalOp(op)) left = {
-				kind: "logical",
-				op,
-				left,
-				right
-			};
-			else if (isBinaryOp(op)) left = {
-				kind: "binary",
-				op,
-				left,
-				right
-			};
-			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
-		}
-		return left;
-	}
-	parseUnary() {
-		const tok = this.peek();
-		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
-			const op = tok.punct;
-			this.pos += 1;
-			const operand = this.parseUnary();
-			this.countNode();
-			return {
-				kind: "unary",
-				op,
-				operand
-			};
-		}
-		return this.parsePrimary();
-	}
-	parsePrimary() {
-		const tok = this.next();
-		switch (tok.type) {
-			case "number":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "string":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.value
-				};
-			case "keyword":
-				this.countNode();
-				return {
-					kind: "literal",
-					value: tok.keyword === "null" ? null : tok.keyword === "true"
-				};
-			case "identifier": {
-				const nextTok = this.peek();
-				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
-				this.identifiers.add(tok.name);
-				this.countNode();
-				return {
-					kind: "identifier",
-					name: tok.name
-				};
-			}
-			case "punct":
-				if (tok.punct === "(") {
-					const inner = this.parseTernary();
-					this.expectPunct(")");
-					return inner;
-				}
-				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
-			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
-		}
-	}
-	parseCall(callee, pos) {
-		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
-		this.expectPunct("(");
-		const args = [];
-		if (!this.matchPunct(")")) for (;;) {
-			args.push(this.parseTernary());
-			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
-			if (this.matchPunct(",")) continue;
-			this.expectPunct(")");
-			break;
-		}
-		this.callees.add(callee);
-		this.countNode();
-		return {
-			kind: "call",
-			callee,
-			args
-		};
-	}
-};
-/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
-*  `ExpressionParseError` on any lexical or grammatical failure. */
-function parseExpression(source) {
-	return new Parser(tokenize(source)).parse();
-}
-//#endregion
-//#region src/expression/compile.ts
-/**
-* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
-* by expr"). The cache stores BOTH successes and failures (negative caching),
-* so a corrupt persisted string costs exactly one tokenize+parse total — not
-* one per read on a hot resolve path.
-*
-* The cache is a module-level singleton: entries are pure, content-addressed
-* ASTs keyed by the raw source string, so sharing one instance across all
-* callers is safe and maximises hit rate.
-*/
-var cache = /* @__PURE__ */ new Map();
-function getCached(source) {
-	const hit = cache.get(source);
-	if (hit !== void 0) {
-		cache.delete(source);
-		cache.set(source, hit);
-		return hit;
-	}
-	let result;
-	try {
-		result = {
-			ok: true,
-			parsed: parseExpression(source)
-		};
-	} catch (err) {
-		result = {
-			ok: false,
-			error: err instanceof ExpressionParseError ? err.message : String(err)
-		};
-	}
-	cache.set(source, result);
-	if (cache.size > 256) {
-		const oldest = cache.keys().next().value;
-		if (oldest !== void 0) cache.delete(oldest);
-	}
-	return result;
-}
-/** Compile `source` to a `ParsedExpression`, throwing `ExpressionParseError`
-*  on failure. LRU/negative-cached. */
-function compileExpression(source) {
-	const result = getCached(source);
-	if (result.ok) return result.parsed;
-	throw new ExpressionParseError(result.error);
-}
-/** Compile `source`, returning a discriminated result instead of throwing.
-*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
-function compileExpressionSafe(source) {
-	return getCached(source);
-}
-//#endregion
-//#region src/expression/evaluator.ts
-/**
-* Tree-walking evaluator for the safe expression mini-language.
+* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
+* fork into separate processes but never run on remote cluster agents. Therefore:
+*   - No nodeId routing needed — this is a pure hub singleton.
+*   - The hub's DeviceRegistry is the single source of truth for all live devices.
+*   - No shadow registry or cross-node aggregation required.
 *
-* SECURITY (spec §4 rule 2/5):
-*  - The scope is an `Object.create(null)` copy of ONLY the caller's own
-*    enumerable binding entries, so `name in scope` is a pure own-key check and
-*    `constructor` / `__proto__` / `toString` are plain unknown identifiers.
-*  - Performs ZERO I/O and never touches `globalThis` / `Date` / `Math`
-*    directly — the only external calls are into the frozen builtin table.
-*  - The grammar has no loops/recursion/lambdas, so a walk is O(nodeCount) by
-*    construction; the step counter is defense-in-depth for a crafted max-size
-*    AST. Nothing blocks: there are no timers, awaits or unbounded loops.
-*/
-var EMPTY_HOOKS = Object.freeze({});
-/** Build a null-prototype scope from own-enumerable binding entries. Inherited
-*  keys of the input (e.g. from a `{__proto__: {...}}` payload) are NOT copied,
-*  so nothing smuggles in via the prototype chain. */
-function createExpressionScope(bindings) {
-	const scope = Object.create(null);
-	for (const key of Object.keys(bindings)) if (Object.prototype.hasOwnProperty.call(bindings, key)) scope[key] = bindings[key];
-	return scope;
-}
-function isFiniteNumber(value) {
-	return typeof value === "number" && Number.isFinite(value);
-}
-/** JS truthiness of a primitive value. */
-function truthy(value) {
-	return Boolean(value);
-}
-function requireFinite(value, context) {
-	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${context} produced a non-finite result`);
-	return value;
-}
-function step(ctx) {
-	ctx.steps += 1;
-	if (ctx.steps > ctx.maxSteps) throw new ExpressionEvalError("expression evaluation step budget exceeded");
-}
-function evalNode(node, ctx) {
-	step(ctx);
-	switch (node.kind) {
-		case "literal": return node.value;
-		case "identifier":
-			if (!(node.name in ctx.scope)) throw new ExpressionEvalError(`unknown identifier: ${node.name}`);
-			return ctx.scope[node.name];
-		case "unary": return evalUnary(node.op, evalNode(node.operand, ctx));
-		case "binary": return evalBinary(node.op, evalNode(node.left, ctx), evalNode(node.right, ctx));
-		case "logical": {
-			const left = evalNode(node.left, ctx);
-			if (node.op === "&&") return truthy(left) ? evalNode(node.right, ctx) : left;
-			return truthy(left) ? left : evalNode(node.right, ctx);
-		}
-		case "conditional": return truthy(evalNode(node.test, ctx)) ? evalNode(node.consequent, ctx) : evalNode(node.alternate, ctx);
-		case "call": return evalCall(node.callee, node.args.map((a) => evalNode(a, ctx)), ctx.hooks);
-	}
-}
-function evalUnary(op, operand) {
-	if (op === "!") return !truthy(operand);
-	if (!isFiniteNumber(operand)) throw new ExpressionEvalError("unary \"-\" requires a finite number");
-	return requireFinite(-operand, "unary \"-\"");
-}
-function evalBinary(op, left, right) {
-	switch (op) {
-		case "==": return left === right;
-		case "!=": return left !== right;
-		case "+":
-			if (typeof left === "string" && typeof right === "string") return left + right;
-			if (isFiniteNumber(left) && isFiniteNumber(right)) return requireFinite(left + right, "\"+\"");
-			throw new ExpressionEvalError("\"+\" requires two numbers or two strings");
-		case "-":
-		case "*":
-		case "/":
-		case "%":
-			if (!isFiniteNumber(left) || !isFiniteNumber(right)) throw new ExpressionEvalError(`"${op}" requires two finite numbers`);
-			return requireFinite(op === "-" ? left - right : op === "*" ? left * right : op === "/" ? left / right : left % right, `"${op}"`);
-		case "<":
-		case "<=":
-		case ">":
-		case ">=":
-			if (isFiniteNumber(left) && isFiniteNumber(right)) return op === "<" ? left < right : op === "<=" ? left <= right : op === ">" ? left > right : left >= right;
-			if (typeof left === "string" && typeof right === "string") return op === "<" ? left < right : op === "<=" ? left <= right : op === ">" ? left > right : left >= right;
-			throw new ExpressionEvalError(`"${op}" requires two numbers or two strings`);
-	}
-}
-function evalCall(callee, args, hooks) {
-	if (!Object.prototype.hasOwnProperty.call(EXPRESSION_BUILTINS, callee)) throw new ExpressionEvalError(`unknown function: ${callee}`);
-	const builtin = EXPRESSION_BUILTINS[callee];
-	if (args.length < builtin.minArgs || args.length > builtin.maxArgs) throw new ExpressionEvalError(`${callee}: wrong number of arguments (${args.length})`);
-	return builtin.apply(args, hooks);
-}
-/** Evaluate an AST node against a scope. Throws `ExpressionEvalError` on any
-*  runtime failure (unknown identifier, type mismatch, non-finite result,
-*  step-budget exhaustion). */
-function evaluateAst(node, scope, opts) {
-	return evalNode(node, {
-		scope,
-		hooks: opts?.hooks ?? EMPTY_HOOKS,
-		maxSteps: opts?.maxSteps ?? 4096,
-		steps: 0
-	});
-}
-//#endregion
-//#region src/expression/link-expression.ts
-/**
-* DeviceLink-facing helpers for the expression engine — the single seam both
-* resolver channels (async provider-read + sync mirror) and the wire-schema
-* `superRefine` share, so validation and evaluation semantics stay identical
-* everywhere.
-*/
-/** The `now` epoch-ms binding is auto-injected into every evaluation and is a
-*  reserved binding name (authors may not rebind it). */
-var EXPRESSION_INJECTED_NOW = "now";
-/**
-* Coerce an untrusted `getByPath` / mirror read to an `ExpressionValue`.
-* Non-primitive values (objects, arrays, `undefined`, functions, bigint,
-* symbol) and non-finite numbers become `undefined` so the caller can apply
-* its binding-miss policy (→ `null`). `null` itself is a valid value.
-*/
-function toExpressionValue(raw) {
-	if (raw === null) return null;
-	if (typeof raw === "string") return raw;
-	if (typeof raw === "boolean") return raw;
-	if (typeof raw === "number") return Number.isFinite(raw) ? raw : void 0;
-}
-/**
-* Author-time validation. Returns `null` when the source is valid, else a
-* human-readable error message. Checks: the expression compiles; binding count
-* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
-* is not reserved (`now`/keywords) and does not shadow a builtin; and every
-* FREE identifier of the AST is covered by a binding or the injected `now`.
-*/
-function validateExpressionSource(src) {
-	const names = Object.keys(src.bindings);
-	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
-	for (const name of names) {
-		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
-		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
-		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
-	}
-	const compiled = compileExpressionSafe(src.expr);
-	if (!compiled.ok) return compiled.error;
-	const bound = new Set(names);
-	for (const id of compiled.parsed.identifiers) {
-		if (id === "now") continue;
-		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
-	}
-	return null;
-}
-/**
-* Shared read-path evaluation for BOTH resolver channels. Builds a null-proto
-* scope from `bindingValues` plus the injected `now` (supplied by the caller
-* for determinism/testability), compiles via the LRU, and evaluates. Any
-* failure (parse or eval) returns `{ ok: false }` — the caller treats that as
-* "skip this link".
+* Forked workers register devices back to the hub via `ctx.devices`
+* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
 */
-function evaluateLinkExpression(expr, bindingValues, now, opts) {
-	const compiled = compileExpressionSafe(expr);
-	if (!compiled.ok) return {
-		ok: false,
-		error: compiled.error
-	};
-	const scope = createExpressionScope({
-		...bindingValues,
-		["now"]: now
-	});
-	try {
-		return {
-			ok: true,
-			value: evaluateAst(compiled.parsed.ast, scope, opts)
-		};
-	} catch (err) {
-		return {
-			ok: false,
-			error: err instanceof ExpressionEvalError ? err.message : String(err)
-		};
-	}
-}
-//#endregion
-//#region src/capabilities/device-provider.cap.ts
-var ProviderStatusSchema = z.object({
-	connected: z.boolean(),
-	deviceCount: z.number(),
-	error: z.string().optional()
+/** One child-placement directive on a container's `childLayout`. Structurally
+*  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
+*  shape for the same field. The child is identified by its re-sync-stable
+*  accessory `stableIdSuffix` (`childKey`); listed children are grouped into
+*  named accordion sections (with optional intra-section order). */
+var ChildLayoutEntrySchema = z.object({
+	childKey: z.string(),
+	section: z.string(),
+	order: z.number().optional(),
+	collapsed: z.boolean().optional()
 });
-var DiscoveredDeviceSchema = z.object({
-	externalId: z.string(),
-	name: z.string(),
-	type: z.string(),
-	metadata: z.record(z.string(), z.unknown()).optional()
+/** Cap-wire shape of a per-cap display refinement — mirrors
+*  `DeviceCapDisplayOverride` in `device-management.ts`. */
+var DeviceCapDisplayOverrideSchema = z.object({
+	unit: z.string().min(1).optional(),
+	precision: z.number().int().min(0).max(10).optional()
 });
-/**
-* Candidate handed back from discovery and accepted by
-* `adoptDiscoveredDevice`. Shape mirrors the in-process
-* `DiscoveredDevice` interface used by `DeviceDiscovery`.
-*/
-var DiscoveryCandidateSchema = z.object({
-	stableId: z.string(),
-	type: z.enum(DeviceType),
-	suggestedName: z.string(),
-	prefilledConfig: z.record(z.string(), z.unknown()),
-	/**
-	* Optional upstream-system identity (HA entity_id, vendor MAC, …).
-	* Discovery pre-populates this for systems that know the upstream
-	* identity ahead of adoption. Rendering metadata (unit, precision)
-	* flows live through the cap STATUS SLICE after adoption.
-	*/
-	sourceInfo: SourceInfoSchema.optional()
+/** Cap-wire shape of an operator-authored per-device display override —
+*  mirrors `DeviceDisplayOverride` in `device-management.ts`. `precision`
+*  bounds mirror `numeric-sensor.cap.ts` (`int 0-10`). */
+var DeviceDisplayOverrideSchema = z.object({
+	icon: z.string().min(1).optional(),
+	label: z.string().min(1).optional(),
+	unit: z.string().min(1).optional(),
+	precision: z.number().int().min(0).max(10).optional(),
+	hidden: z.boolean().optional(),
+	perCap: z.record(z.string(), DeviceCapDisplayOverrideSchema).optional()
+});
+/** Cap-wire shape of a per-role display default — mirrors `RoleDisplayDefault`
+*  in `device-management.ts`. Keyed by `DeviceRole` string (role strings cross
+*  the wire as plain strings everywhere else — cf. `DeviceInfoSchema.role`). */
+var RoleDisplayDefaultSchema = z.object({
+	unit: z.string().min(1).optional(),
+	precision: z.number().int().min(0).max(10).optional(),
+	icon: z.string().min(1).optional()
 });
 /**
-* Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
-* Mirrors `toDeviceShape()` output in `device-management.router.ts` so the
-* tRPC layer can pass it through without reshaping.
+* Serializable projection of a live IDevice.
+* Returned by listAll, getDevice, getChildren.
+* Live methods (getStreamSources, getConfigSchema) are separate calls.
 */
-var DeviceSummarySchema = z.object({
+var DeviceInfoSchema = z.object({
+	/** Progressive, system-wide unique number. Allocated synchronously by
+	*  `device-manager.allocateDeviceId` BEFORE the owning `IDevice` is
+	*  constructed, so every live device exposes an `id` — no transient
+	*  null window. Distinct from `stableId`, which is unique per
+	*  integration. Ids are monotonic and never reissued on removal. */
 	id: z.number(),
 	stableId: z.string(),
 	addonId: z.string(),
-	type: z.string(),
+	type: z.enum(DeviceType),
 	name: z.string(),
+	/** Operator-organisational location label. `null` when unset. */
+	location: z.string().nullable(),
+	/** Soft-disabled flag. */
+	disabled: z.boolean(),
 	parentDeviceId: z.number().nullable(),
+	/** Optional semantic role — `DeviceRole` string. null for top-level devices. */
+	role: z.string().nullable().optional(),
 	online: z.boolean(),
+	/** True when the device's initial feature-probe has completed (or it has
+	*  no probe) — exported shape is stable; exporters gate advertise on this.
+	*  Optional for deploy-order resilience: a record produced by an older
+	*  device-manager build omits it, and consumers treat absent as "not ready"
+	*  (export gate carries forward, never advertises a partial shape). */
+	probed: z.boolean().optional(),
 	features: z.array(z.string()),
-	config: z.record(z.string(), z.unknown()),
-	/** Optional upstream-system identity (dispatch key + system tag).
-	*  See `SourceInfo`. Present when the device has a non-synthetic
-	*  source identifier (HA entities, vendor MAC, …); omitted when the
-	*  synthetic backfill is in effect. */
-	sourceInfo: SourceInfoSchema.optional()
-});
-/**
-* Result of a live field test (e.g. probing an RTSP URL during device
-* creation). Matches the UI-side `FieldProbeResult` in
-* `interfaces/config-ui.ts` — the admin `FormBuilder` renders the
-* returned `labels` as chips next to the input.
-*/
-var FieldProbeResultSchema = z.object({
-	status: z.enum(["ok", "error"]),
-	labels: z.array(z.string()).optional(),
-	error: z.string().optional()
-});
-/**
-* The output of `getChildCreationSchema` is a UI schema tree. We store
-* it as `unknown` at the capability layer — the router just passes it
-* through and the admin UI renders it via `FormBuilder`. The actual
-* type is `ConfigUISchema` (see `packages/types/src/interfaces/config-ui.ts`),
-* but we deliberately avoid a Zod mirror because the union is large and
-* not meant for runtime validation at this seam.
-*/
-var CreationSchemaOutputSchema = z.unknown();
-var deviceProviderCapability = {
-	name: "device-provider",
-	scope: "system",
-	mode: "collection",
-	methods: {
-		start: method(z.void(), z.void(), { kind: "mutation" }),
-		stop: method(z.void(), z.void(), { kind: "mutation" }),
-		getStatus: method(z.void(), ProviderStatusSchema),
-		getDevices: method(z.void(), z.array(z.object({
-			id: z.string(),
-			name: z.string(),
-			type: z.string()
-		}))),
-		supportsDiscovery: method(z.object({}), z.boolean()),
-		/**
-		* Run a network scan. `params` carries optional provider-specific scan
-		* inputs (e.g. a broadcast address / subnet for cross-subnet discovery),
-		* shaped by `getDiscoveryParamsSchema`. Omitted for the generic scan
-		* (provider uses its local-network default).
-		*/
-		discoverDevices: method(z.object({ params: z.record(z.string(), z.unknown()).optional() }), z.array(DiscoveryCandidateSchema), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Optional form schema (`ConfigUISchema`) for the EXTRA per-scan inputs a
-		* provider accepts (e.g. Gree's broadcast address for a different subnet).
-		* `null` when the provider takes no extra scan params — the generic
-		* aggregated scan never renders this; the per-integration scan does.
-		*/
-		getDiscoveryParamsSchema: method(z.object({}), CreationSchemaOutputSchema),
-		/**
-		* The DeviceType this provider creates via manual add (Camera for
-		* Reolink/ONVIF, Container for Gree, Hub for Ecowitt). `null` when the
-		* provider does not support manual creation. Lets the Add-Device dialog
-		* pick the right type instead of assuming Camera.
-		*/
-		getManualCreationType: method(z.object({}), z.object({ deviceType: z.enum(DeviceType).nullable() })),
-		adoptDiscoveredDevice: method(z.object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		supportsManualCreation: method(z.object({}), z.boolean()),
-		/**
-		* Fetch the creation form schema for a given DeviceType. Returns
-		* `null` when the provider does not support manually creating
-		* devices of that type. The output is a `ConfigUISchema` — the
-		* router type-asserts it at the boundary.
-		*/
-		getChildCreationSchema: method(z.object({ type: z.enum(DeviceType) }), CreationSchemaOutputSchema),
-		createDevice: method(z.object({
-			type: z.enum(DeviceType),
-			config: z.record(z.string(), z.unknown())
-		}), DeviceSummarySchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Test a single field in the creation form before the device has
-		* been persisted. Typical use: probing an RTSP URL entered by the
-		* user. Providers that don't support field probing return
-		* `{ success: true, message: 'Field test not supported' }`.
-		*
-		* `formValues` is the live snapshot of every field in the form at
-		* the moment the user clicked Test — useful for probes that depend
-		* on multiple fields together (e.g. Reolink autodetect needs host
-		* + credentials + UID + transport mode in a single call). Optional
-		* for backwards compatibility; providers free to ignore it.
-		*/
-		testCreationField: method(z.object({
-			type: z.enum(DeviceType),
-			key: z.string(),
-			value: z.unknown(),
-			formValues: z.record(z.string(), z.unknown()).optional()
-		}), FieldProbeResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		})
-	}
-};
-//#endregion
-//#region src/capabilities/device-manager.cap.ts
-/**
-* Device Manager capability — hub-side singleton that unifies device persistence,
-* live registry access, and all management operations into a single tRPC surface.
-*
-* Replaces:
-*   - `device-persistence` capability (persistence methods absorbed here)
-*   - `device-management.router.ts` (deleted in Phase 2)
-*   - `device-ops.router.ts` (compat layer — deleted; device-provider ops absorbed here)
-*
-* All device provider addons (rtsp, onvif, frigate, …) are hub-local: they may
-* fork into separate processes but never run on remote cluster agents. Therefore:
-*   - No nodeId routing needed — this is a pure hub singleton.
-*   - The hub's DeviceRegistry is the single source of truth for all live devices.
-*   - No shadow registry or cross-node aggregation required.
-*
-* Forked workers register devices back to the hub via `ctx.devices`
-* (DeviceManagerApi → ctx.api.deviceManager.registerDevice), same as today.
-*/
-/** One child-placement directive on a container's `childLayout`. Structurally
-*  identical to `ChildLayoutEntry` in `device-management.ts` — the cap wire
-*  shape for the same field. The child is identified by its re-sync-stable
-*  accessory `stableIdSuffix` (`childKey`); listed children are grouped into
-*  named accordion sections (with optional intra-section order). */
-var ChildLayoutEntrySchema = z.object({
-	childKey: z.string(),
-	section: z.string(),
-	order: z.number().optional(),
-	collapsed: z.boolean().optional()
-});
-/** Cap-wire shape of a DeviceLink — structurally mirrors `DeviceLink` in
-*  `device-management.ts`. Source is a union: a FIELD source copies a sibling
-*  accessory's status field (`kind` optional/absent for wire compat); a
-*  LITERAL source carries a per-device constant (no sibling is read); a
-*  GLOBAL source (P2e) copies ANY device's status field, addressed by the
-*  source device's full re-sync-stable `stableId`. */
-var DeviceLinkFieldSourceSchema = z.object({
-	kind: z.literal("field").optional(),
-	sourceKey: z.string(),
-	cap: z.string(),
-	fieldPath: z.string()
-});
-var DeviceLinkLiteralSourceSchema = z.object({
-	kind: z.literal("literal"),
-	value: z.union([
-		z.string(),
-		z.number(),
-		z.boolean(),
-		z.null()
-	])
-});
-var DeviceLinkGlobalSourceSchema = z.object({
-	kind: z.literal("global"),
-	sourceStableId: z.string(),
-	cap: z.string(),
-	fieldPath: z.string()
-});
-/** Expression source (Stage X): compute the target field from N named bindings
-*  via the safe expression engine. Bindings are field | literal | global — never
-*  another expression (no nesting). The `superRefine` runs the SAME author-time
-*  validation as `validateExpressionSource` (compiles the expr, checks binding
-*  names + identifier coverage) so every wire boundary that parses a DeviceLink
-*  (tRPC mount, kernel create pre-seed, projection output) validates-at-write.
-*  Compiles are LRU-cached, so repeated validation of the same expr is a hit. */
-var DeviceLinkExpressionSourceSchema = z.object({
-	kind: z.literal("expression"),
-	expr: z.string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: z.record(z.string().regex(EXPRESSION_IDENTIFIER_RE), z.union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema
-	]))
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
-});
-var DeviceLinkSchema = z.object({
-	id: z.string(),
-	source: z.union([
-		DeviceLinkFieldSourceSchema,
-		DeviceLinkLiteralSourceSchema,
-		DeviceLinkGlobalSourceSchema,
-		DeviceLinkExpressionSourceSchema
-	]),
-	target: z.object({
-		cap: z.string(),
-		fieldPath: z.string(),
-		itemKey: z.string().optional()
-	}),
-	transform: z.discriminatedUnion("kind", [
-		z.object({ kind: z.literal("identity") }),
-		z.object({
-			kind: z.literal("enum-map"),
-			mapping: z.record(z.string(), z.union([
-				z.string(),
-				z.number(),
-				z.boolean()
-			])),
-			fallback: z.union([
-				z.string(),
-				z.number(),
-				z.boolean()
-			]).optional()
-		}),
-		z.object({
-			kind: z.literal("linear"),
-			scale: z.number(),
-			offset: z.number(),
-			clamp: z.tuple([z.number(), z.number()]).readonly().optional()
-		})
-	]).optional()
-});
-/** Cap-wire shape of a per-cap display refinement — mirrors
-*  `DeviceCapDisplayOverride` in `device-management.ts`. */
-var DeviceCapDisplayOverrideSchema = z.object({
-	unit: z.string().min(1).optional(),
-	precision: z.number().int().min(0).max(10).optional()
-});
-/** Cap-wire shape of an operator-authored per-device display override —
-*  mirrors `DeviceDisplayOverride` in `device-management.ts`. `precision`
-*  bounds mirror `numeric-sensor.cap.ts` (`int 0-10`). */
-var DeviceDisplayOverrideSchema = z.object({
-	icon: z.string().min(1).optional(),
-	label: z.string().min(1).optional(),
-	unit: z.string().min(1).optional(),
-	precision: z.number().int().min(0).max(10).optional(),
-	hidden: z.boolean().optional(),
-	perCap: z.record(z.string(), DeviceCapDisplayOverrideSchema).optional()
-});
-/** Cap-wire shape of a per-role display default — mirrors `RoleDisplayDefault`
-*  in `device-management.ts`. Keyed by `DeviceRole` string (role strings cross
-*  the wire as plain strings everywhere else — cf. `DeviceInfoSchema.role`). */
-var RoleDisplayDefaultSchema = z.object({
-	unit: z.string().min(1).optional(),
-	precision: z.number().int().min(0).max(10).optional(),
-	icon: z.string().min(1).optional()
-});
-/**
-* Serializable projection of a live IDevice.
-* Returned by listAll, getDevice, getChildren.
-* Live methods (getStreamSources, getConfigSchema) are separate calls.
-*/
-var DeviceInfoSchema = z.object({
-	/** Progressive, system-wide unique number. Allocated synchronously by
-	*  `device-manager.allocateDeviceId` BEFORE the owning `IDevice` is
-	*  constructed, so every live device exposes an `id` — no transient
-	*  null window. Distinct from `stableId`, which is unique per
-	*  integration. Ids are monotonic and never reissued on removal. */
-	id: z.number(),
-	stableId: z.string(),
-	addonId: z.string(),
-	type: z.enum(DeviceType),
-	name: z.string(),
-	/** Operator-organisational location label. `null` when unset. */
-	location: z.string().nullable(),
-	/** Soft-disabled flag. */
-	disabled: z.boolean(),
-	parentDeviceId: z.number().nullable(),
-	/** Optional semantic role — `DeviceRole` string. null for top-level devices. */
-	role: z.string().nullable().optional(),
-	online: z.boolean(),
-	/** True when the device's initial feature-probe has completed (or it has
-	*  no probe) — exported shape is stable; exporters gate advertise on this.
-	*  Optional for deploy-order resilience: a record produced by an older
-	*  device-manager build omits it, and consumers treat absent as "not ready"
-	*  (export gate carries forward, never advertises a partial shape). */
-	probed: z.boolean().optional(),
-	features: z.array(z.string()),
-	/** true when the device has a getStreamSources() method (ICameraDevice) */
-	isCamera: z.boolean(),
-	/** Current config values — serializable snapshot */
+	/** true when the device has a getStreamSources() method (ICameraDevice) */
+	isCamera: z.boolean(),
+	/** Current config values — serializable snapshot */
 	config: z.record(z.string(), z.unknown()),
 	/** Hardware + identity blob (manufacturer / model / firmware / sn /
 	*  uid / mac / …). Populated by drivers; editable via setMetadata. */
@@ -7358,8 +6552,6 @@ var DeviceInfoSchema = z.object({
 	*  named accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: z.array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: z.array(DeviceLinkSchema).readonly().optional(),
 	/** Operator-authored per-device display override. See `DeviceMeta.display`. */
 	display: DeviceDisplayOverrideSchema.optional()
 });
@@ -7368,7 +6560,7 @@ var ConfigEntrySchema = z.object({
 	value: z.unknown(),
 	description: z.string().optional()
 });
-var DeviceLinkModeSchema = z.enum(["auto", "manual"]);
+var LinkedDevicesModeSchema = z.enum(["auto", "manual"]);
 /** One resolved linked device — the compact projection consumers need. */
 var LinkedDeviceSchema = z.object({
 	deviceId: z.number(),
@@ -7431,8 +6623,6 @@ var DeviceMetaSchema = z.object({
 	*  accordion sections (with optional intra-section order). See
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: z.array(ChildLayoutEntrySchema).readonly().optional(),
-	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: z.array(DeviceLinkSchema).readonly().optional(),
 	/** Semantic role string (`DeviceRole`) — propagated from the spawn pre-seed.
 	*  Optional: only present for accessory children that carry a known role. */
 	role: z.string().nullable().optional(),
@@ -7584,16 +6774,6 @@ var deviceManagerCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Set (or replace) the cross-device field wirings on a device's meta row.
-		*  Mirrors `setChildLayout`; persisted, projected, preserved across
-		*  re-register/restore. Idempotent. */
-		setDeviceLinks: method(z.object({
-			deviceId: z.number(),
-			deviceLinks: z.array(DeviceLinkSchema).readonly()
-		}), z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
 		/** Set (or clear) the per-device display override on the meta row. Mirrors
 		*  `setChildLayout` persistence; `null` clears the override entirely. The
 		*  override unit(s) are normalized (`normalizeUnit`) at write so the render
@@ -7617,15 +6797,15 @@ var deviceManagerCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** List the wireable status-schema fields per cap bound to a device.
-		*  Powers the Wiring tab's field pickers. Caps without a status schema are
-		*  omitted. Item-array caps (`status.itemArray`, e.g. consumables) also
-		*  emit their per-item fields tagged `item: true` (a link targeting one
-		*  must carry a `target.itemKey`) plus the cap-level `itemArray`
-		*  descriptor. `includeSynthesizable: true` (TARGET pickers only) unions
-		*  in unbound device-scoped caps that declare `status.empty` and match
-		*  the device's type — so the FIRST link to a synthesize-only cap
-		*  (consumables on an HA vacuum) can be authored. */
+		/** The per-cap catalog of readable status-schema fields for one device.
+		*  This is the SOURCE PICKER — it outlived the Wiring tab that first
+		*  needed it (deleted 2026-08-08) and becomes the picker of a composition
+		*  recipe: every field the old tab could target, a composed device can
+		*  read. Caps without a status schema are omitted. Item-array caps
+		*  (`status.itemArray`, e.g. consumables) also emit their per-item fields
+		*  tagged `item: true` plus the cap-level `itemArray` descriptor.
+		*  `includeSynthesizable: true` unions in unbound device-scoped caps that
+		*  declare `status.empty` and match the device's type. */
 		getWireableFields: method(z.object({
 			deviceId: z.number(),
 			includeSynthesizable: z.boolean().optional()
@@ -7767,7 +6947,7 @@ var deviceManagerCapability = {
 		* (see the module docblock) — there are no bespoke link mutations.
 		*/
 		getLinkedDevices: method(z.object({ deviceId: z.number() }), z.object({
-			mode: DeviceLinkModeSchema,
+			mode: LinkedDevicesModeSchema,
 			devices: z.array(LinkedDeviceSchema)
 		})),
 		/** Get stream sources for a camera device. */
@@ -7831,11 +7011,7 @@ var deviceManagerCapability = {
 			deviceId: z.number(),
 			entries: z.array(z.object({
 				capName: z.string(),
-				kind: z.enum([
-					"native",
-					"wrapped",
-					"linked"
-				]),
+				kind: z.enum(["native", "wrapped"]),
 				providerAddonId: z.string(),
 				providerNodeId: z.string(),
 				nativeAddonId: z.string()
@@ -7853,11 +7029,7 @@ var deviceManagerCapability = {
 			deviceId: z.number(),
 			entries: z.array(z.object({
 				capName: z.string(),
-				kind: z.enum([
-					"native",
-					"wrapped",
-					"linked"
-				]),
+				kind: z.enum(["native", "wrapped"]),
 				providerAddonId: z.string(),
 				providerNodeId: z.string(),
 				nativeAddonId: z.string()
@@ -9103,6 +8275,10 @@ var motionDetectionCapability = {
 	mode: "singleton",
 	kind: "wrapper",
 	defaultActive: true,
+	/** Frame-differencing motion analysis over a video stream — only a camera
+	*  produces the frames. Read by the `defaultActive` auto-bind in
+	*  `device-manager.getBindings` to decide which devices it may claim. */
+	deviceTypes: [DeviceType.Camera],
 	exposesDeviceSettings: true,
 	methods: {
 		analyze: method(z.object({
@@ -12224,6 +11400,18 @@ var OauthIntegrationDescriptorSchema = z.object({
 	*  redirect_uri that does not start with one of these. Required —
 	*  an empty list means the integration can never complete linking. */
 	allowedRedirectPrefixes: z.array(z.string()).min(1),
+	/** Paths accepted as a `redirect_uri` when the host is PRIVATE — loopback,
+	*  RFC1918, CGNAT (100.64/10, Tailscale), link-local, IPv6 ULA, or an
+	*  `.local` / `.internal` / `.ts.net` name. Exists for self-hosted clients
+	*  whose address the hub cannot know in advance (a Home Assistant at
+	*  `http://<lan-ip>:8123/auth/external/callback`). The PATH must match
+	*  exactly; a public host never satisfies this branch, so it is not a
+	*  wildcard prefix by another name. */
+	allowedPrivateHostPaths: z.array(z.string()).optional(),
+	/** When true this is a PUBLIC client (source is published, no secret can be
+	*  protected) and PKCE is mandatory: `/authorize` refuses without an S256
+	*  `code_challenge`, `/token` refuses without the matching `code_verifier`. */
+	requiresPkce: z.boolean().optional(),
 	/** Optional public origin (no trailing slash) that this integration's
 	*  issued codes/tokens should carry as the `hubUrl` claim — typically the
 	*  operator-selected external-access endpoint resolved by the addon. When
@@ -12382,7 +11570,7 @@ var TrackEnvelopeSchema = z.object({
 * `snapshots[]` references — megabytes across a page of tracks. `slim`
 * keeps every scalar the list surfaces actually render (ids, class(es),
 * label / audioLabels / importance enrichment, firstSeen/lastSeen, state,
-* zonesVisited, bestEventId, envelope) and returns `positions` /
+* zonesVisited, bestEventId, envelope, hasFace) and returns `positions` /
 * `snapshots` as EMPTY arrays — detail views re-fetch the full row via
 * `getTrack`. Mirrors the event-store `projection` convention
 * (`getObjectEvents` et al.).
@@ -12635,6 +11823,24 @@ var TrackSchema = z.object({
 	*  Populated from the persisted envelope columns on historical reads;
 	*  absent on legacy rows, dims-less tracks and active (in-RAM) tracks. */
 	envelope: TrackEnvelopeSchema.optional(),
+	/**
+	* A face DETECTOR found a face on this track — nothing more. It says the
+	* detail plane produced a `face` detail; it does NOT say the face was
+	* embedded, matched, above `minFacePx`, or that the recognizer was even
+	* enabled. Set once and never cleared.
+	*
+	* **This exists so "face present but not recognised" is expressible.** A
+	* recognised identity lands in `subLabel` (attributed to the face chain via
+	* `subLabelMeta.stepId`), so before this field a track with an unmatched face
+	* and a track with no face at all were byte-identical on the wire and no
+	* surface could tell them apart. The read is `hasFace === true && subLabel
+	* === undefined`.
+	*
+	* **Absent ≠ false.** Every row written before the column existed omits it,
+	* and so does every server that predates the field — a consumer must test
+	* `=== true` and render nothing otherwise, never infer "no face".
+	*/
+	hasFace: z.boolean().optional(),
 	...TrackFlagFields,
 	...TrackRetrainFields
 });
@@ -16576,6 +15782,10 @@ var SsoBridgeClaimsSchema = z.object({
 	integrationId: z.string().optional(),
 	/** JWT ID — unique per issued code; consumed-set enforces single-use. */
 	jti: z.string().optional(),
+	/** PKCE S256 challenge — set only on `oauth-code` tokens issued to a public
+	*  client. Its PRESENCE is what makes the verifier mandatory at exchange,
+	*  so the requirement travels with the code and not with mutable config. */
+	codeChallenge: z.string().optional(),
 	/** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
 	*  tokens so the verify path can check the session is not revoked. */
 	sessionId: z.string().optional()
@@ -17348,6 +16558,10 @@ var videoclipsCapability = {
 	mode: "singleton",
 	kind: "wrapper",
 	defaultActive: true,
+	/** A clip is a window over a camera's footage — the cap is meaningless on a
+	*  sensor, a button or an event emitter, and the `defaultActive` auto-bind
+	*  reads this to decide which devices it may claim. */
+	deviceTypes: [DeviceType.Camera],
 	methods: {
 		listClips: method(z.object({
 			deviceId: z.number(),
@@ -19899,7 +19113,29 @@ var FaceInfoSchema = z.object({
 	recognizedIdentityId: z.string().optional(),
 	identityName: z.string().optional(),
 	assigned: z.boolean(),
+	/**
+	* The crop, inline, base64.
+	*
+	* **Prefer {@link cropUrl}.** At the 500 rows the Faces view asks for this
+	* field alone is ~2.87 MiB, re-sent in full on every operator assign and
+	* every 30 s poll, base64-inflated over the msgpack socket and held in the
+	* query heap. It stays for callers that have not migrated; `includeCrops:
+	* false` turns it off once they have.
+	*/
 	base64: z.string().optional(),
+	/**
+	* Same crop, as a data-plane URL for `<img src>` — the move the admin
+	* snapshot surfaces made on 2026-08-08.
+	*
+	* Served by the `event-media` plane, which resolves a raw MediaStore key and
+	* is `access: 'authenticated'`: a bare `<img>` carries the `camstack_session`
+	* cookie, so no header plumbing is needed. The bytes then ride the browser's
+	* HTTP cache with an ETag and `immutable`, instead of the WebSocket.
+	*
+	* Absent when the face has no stored crop, or when the addon has no data
+	* plane — callers fall back to {@link base64}.
+	*/
+	cropUrl: z.string().optional(),
 	/** Design B: the face bbox (pixel space) on the key frame — lets a detail
 	*  view draw the box over the native `keyFrameMediaKey` frame. Absent on
 	*  legacy rows written before design B. */
@@ -19975,7 +19211,23 @@ var faceGalleryCapability = {
 		}),
 		listRecentFaces: method(z.object({
 			limit: z.number().int().positive().optional(),
-			filter: FaceFilterEnum.optional()
+			filter: FaceFilterEnum.optional(),
+			/**
+			* Inline the base64 crop on every row. Default `true` — the existing
+			* behaviour, kept so no caller breaks.
+			*
+			* Set `false` once the caller renders {@link FaceInfo.cropUrl}: that
+			* drops ~2.87 MiB per 500-row page to a few KiB of metadata and lets
+			* the browser cache the images.
+			*
+			* **This is an INPUT field, so it does not reach the addon until the
+			* next train.** The hub router validates cap inputs against its own
+			* compiled Zod, which strips a key it does not know — verified today
+			* on the OUTPUT side, where an additive field DOES arrive immediately
+			* (`Track.hasFace`). Until the train ships, sending `false` is
+			* harmless and simply keeps the crops inline.
+			*/
+			includeCrops: z.boolean().optional()
 		}).optional(), z.array(FaceInfoSchema).readonly()),
 		getFaceByTrack: method(z.object({
 			deviceId: z.number().int(),
@@ -25488,14 +24740,19 @@ var userManagementCapability = {
 			username: z.string(),
 			scopes: z.array(TokenScopeSchema),
 			redirectUri: z.string(),
-			hubUrl: z.string()
+			hubUrl: z.string(),
+			/** PKCE (RFC 7636) S256 challenge. Baked into the signed code; a code
+			*  that carries one can ONLY be exchanged with the matching verifier. */
+			codeChallenge: z.string().optional()
 		}), z.object({ code: z.string() }), {
 			kind: "mutation",
 			access: "create"
 		}),
 		oauthExchangeCode: method(z.object({
 			code: z.string(),
-			redirectUri: z.string()
+			redirectUri: z.string(),
+			/** PKCE verifier. REQUIRED when the code carries a challenge. */
+			codeVerifier: z.string().optional()
 		}), z.object({
 			accessToken: z.string(),
 			refreshToken: z.string(),
@@ -27386,6 +26643,218 @@ var BaseDeviceProvider = class extends BaseAddon {
 	}
 };
 //#endregion
+//#region src/device/declared-device.ts
+/** Marker written to a declared integration's `info`. */
+var DECLARED_INTEGRATION_FIXED_KEY = "fixed";
+/**
+* Strip the `<node>/<addon>` suffix a forked child carries.
+*
+* Comparing `ctx.kernel.localNodeId` raw skipped EVERY node — including the one
+* that was supposed to act — because on the hub it reads `hub/<addon>`.
+*/
+function declarationOwnerNodeId(localNodeId) {
+	const raw = localNodeId ?? "hub";
+	if (!raw.includes("/")) return raw;
+	return raw.split("/")[0] ?? "hub";
+}
+/** Cap on how many rows one withdrawal pass may delete. */
+var DECLARED_DEVICE_SWEEP_LIMIT = 32;
+/**
+* The one way an addon owns a device it declares.
+*
+* Construct once with the addon's ports, then call {@link reconcile} on boot and
+* on every convergence tick. There is no second get-or-create helper — a guard
+* in `scripts/` enforces that.
+*/
+var DeclaredDevices = class {
+	ports;
+	constructor(ports) {
+		this.ports = ports;
+	}
+	/**
+	* Converge the declared set. Idempotent, and safe to call repeatedly.
+	*
+	* Throws only what the ports throw on the FIRST index read; every other
+	* failure is per-device and logged, so one bad declaration never takes the
+	* others down.
+	*/
+	async reconcile(spec) {
+		if ((spec.placement ?? "hub") === "hub") {
+			const nodeId = declarationOwnerNodeId(this.ports.localNodeId);
+			if (nodeId !== "hub") {
+				this.ports.logger.info("declared devices are hub-owned — skipping on this node", { meta: {
+					nodeId,
+					rawNodeId: this.ports.localNodeId ?? null
+				} });
+				return {
+					integrationId: null,
+					devices: [],
+					removed: [],
+					owned: false
+				};
+			}
+		}
+		const integrationId = await this.ensureIntegration(spec.integrationName);
+		const index = await this.readIndex();
+		const outcomes = [];
+		for (const declaration of spec.devices) {
+			const outcome = await this.applyDeclaration(declaration, integrationId, index);
+			if (outcome !== null) outcomes.push(outcome);
+		}
+		return {
+			integrationId,
+			devices: outcomes,
+			removed: await this.sweepWithdrawn(spec.devices, integrationId, index),
+			owned: true
+		};
+	}
+	/**
+	* Get-or-create the FIXED integration, and RE-ASSERT the flag every pass.
+	*
+	* The re-assertion is the fix for the defect the hand-rolled version shipped
+	* with: writing `info.fixed` only on the create path left every pre-existing
+	* install without it, and the kernel kept offering to delete an integration
+	* the addon owns.
+	*/
+	async ensureIntegration(integrationName) {
+		const existing = await this.ports.getIntegration(this.ports.addonId);
+		if (existing === null) {
+			const created = await this.ports.createIntegration({
+				addonId: this.ports.addonId,
+				name: integrationName,
+				info: { [DECLARED_INTEGRATION_FIXED_KEY]: true }
+			});
+			this.ports.logger.info("declared a fixed integration", { meta: {
+				integrationId: created.id,
+				name: integrationName
+			} });
+			return created.id;
+		}
+		if (existing.info?.["fixed"] !== true) {
+			await this.ports.updateIntegration({
+				id: existing.id,
+				info: { [DECLARED_INTEGRATION_FIXED_KEY]: true }
+			});
+			this.ports.logger.info("re-asserted `fixed` on a declared integration", { meta: { integrationId: existing.id } });
+		}
+		return existing.id;
+	}
+	async readIndex() {
+		const rows = await this.ports.listOwnDevices();
+		return new Map(rows.map((row) => [row.stableId, row]));
+	}
+	/**
+	* One declaration: adopt what exists, create what does not.
+	*
+	* The create branch is the destructive one — it seeds `initialMeta`, and
+	* `initialMeta.name` lands as an unconditional `setName`. A transiently empty
+	* index therefore looks exactly like a first boot and would silently re-stamp
+	* the declared name over the operator's rename. D49: that branch needs a
+	* second read to agree.
+	*/
+	async applyDeclaration(declaration, integrationId, index) {
+		try {
+			let existing = index.get(declaration.stableId);
+			if (existing === void 0) {
+				existing = (await this.readIndex()).get(declaration.stableId);
+				if (existing !== void 0) this.ports.logger.warn("device index disagreed with itself — adopting instead of re-creating", {
+					tags: { deviceId: existing.id },
+					meta: {
+						stableId: declaration.stableId,
+						addonId: this.ports.addonId
+					}
+				});
+			}
+			if (existing !== void 0) {
+				const device = await this.ports.devices.create(declaration.stableId, declaration.DeviceClass, {}, null, void 0);
+				this.ports.logger.info("declared device adopted", {
+					tags: { deviceId: device.id },
+					meta: {
+						stableId: declaration.stableId,
+						integrationId
+					}
+				});
+				return {
+					stableId: declaration.stableId,
+					deviceId: device.id,
+					device,
+					created: false
+				};
+			}
+			const device = await this.ports.devices.create(declaration.stableId, declaration.DeviceClass, declaration.config ?? {}, null, {
+				type: declaration.type,
+				name: declaration.name,
+				integrationId,
+				...declaration.role === void 0 ? {} : { role: declaration.role }
+			});
+			this.ports.logger.info("declared device created", {
+				tags: { deviceId: device.id },
+				meta: {
+					stableId: declaration.stableId,
+					integrationId
+				}
+			});
+			return {
+				stableId: declaration.stableId,
+				deviceId: device.id,
+				device,
+				created: true
+			};
+		} catch (err) {
+			this.ports.logger.warn("a declared device could not be brought up", { meta: {
+				stableId: declaration.stableId,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+			return null;
+		}
+	}
+	/**
+	* Remove rows under the addon's FIXED integration whose declaration is gone.
+	*
+	* Bounded to that integration: a declared integration has no operator
+	* add-flow, so every row under it got there by declaration. Devices this
+	* addon owns OUTSIDE it (a provider's adopted devices) are never candidates.
+	*
+	* Bounded in count, and every deletion is logged with its `deviceId` — a
+	* withdrawal that removes an operator-visible row silently is the failure
+	* mode, not the removal itself.
+	*/
+	async sweepWithdrawn(declarations, integrationId, index) {
+		const declared = new Set(declarations.map((d) => d.stableId));
+		const candidates = [...index.values()].filter((row) => row.integrationId === integrationId && !declared.has(row.stableId));
+		if (candidates.length === 0) return [];
+		if (candidates.length > 32) {
+			this.ports.logger.warn("withdrawal sweep exceeded its bound — removing nothing", { meta: {
+				integrationId,
+				candidates: candidates.length,
+				bound: 32
+			} });
+			return [];
+		}
+		const removed = [];
+		for (const row of candidates) try {
+			await this.ports.devices.remove(row.id);
+			removed.push(row.id);
+			this.ports.logger.info("declared device removed — its declaration was withdrawn", {
+				tags: { deviceId: row.id },
+				meta: {
+					stableId: row.stableId,
+					integrationId
+				}
+			});
+		} catch (err) {
+			this.ports.logger.warn("a withdrawn declared device could not be removed", {
+				tags: { deviceId: row.id },
+				meta: {
+					stableId: row.stableId,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
+		return removed;
+	}
+};
+//#endregion
 //#region src/device/device-control-resolution.ts
 /**
 * Device-control RESOLUTION LOGIC — the single, presentation-free source of
@@ -27562,30 +27031,6 @@ function resolveMutate(router, method) {
 	return typeof mutate === "function" ? mutate : null;
 }
 //#endregion
-//#region src/device/device-link-transform.ts
-/** Apply a link transform to a resolved source value. `identity`/undefined
-*  pass through; `enum-map` remaps strings (fallback or null when unknown);
-*  `linear` does scale*x+offset with optional clamp (null for non-numbers). */
-function applyTransform(value, transform) {
-	if (!transform || transform.kind === "identity") return value;
-	if (transform.kind === "enum-map") {
-		const key = String(value);
-		if (Object.prototype.hasOwnProperty.call(transform.mapping, key)) return transform.mapping[key];
-		return transform.fallback ?? null;
-	}
-	if (transform.kind === "linear") {
-		if (typeof value !== "number" || Number.isNaN(value)) return null;
-		let out = value * transform.scale + transform.offset;
-		if (transform.clamp) {
-			const min = transform.clamp[0];
-			const max = transform.clamp[1];
-			out = Math.min(max, Math.max(min, out));
-		}
-		return out;
-	}
-	return value;
-}
-//#endregion
 //#region src/device/device-profile.ts
 /**
 * Heuristic check — `device.features?.includes(profile.when.hasFeature)`.
@@ -28114,501 +27559,1347 @@ var SystemMirror = class {
 			const proxy = this.getDeviceById(deviceId);
 			if (proxy) out.push(proxy);
 		}
-		return out;
-	}
-	/** Map every device's slice for `capName` to a derived value. Devices
-	*  without the cap or without a slice are skipped. */
-	mapState(capName, mapper) {
-		const out = [];
-		for (const [deviceId, perCap] of this.stateMirror) {
-			const slice = perCap.get(capName);
-			if (!slice) continue;
-			out.push(mapper(slice, deviceId));
+		return out;
+	}
+	/** Map every device's slice for `capName` to a derived value. Devices
+	*  without the cap or without a slice are skipped. */
+	mapState(capName, mapper) {
+		const out = [];
+		for (const [deviceId, perCap] of this.stateMirror) {
+			const slice = perCap.get(capName);
+			if (!slice) continue;
+			out.push(mapper(slice, deviceId));
+		}
+		return out;
+	}
+	/** First device whose slice matches `predicate`, or null. */
+	findState(capName, predicate) {
+		for (const [deviceId, perCap] of this.stateMirror) {
+			const slice = perCap.get(capName);
+			if (!slice) continue;
+			if (!predicate(slice, deviceId)) continue;
+			return this.getDeviceById(deviceId);
+		}
+		return null;
+	}
+	/** Count devices that bind a cap. Faster than `filterByCap(...).length`. */
+	countByCap(capName) {
+		let n = 0;
+		for (const binding of this.bindings.values()) if (binding.entries.some((e) => e.capName === capName)) n++;
+		return n;
+	}
+	/** Count devices whose slice for `capName` matches `predicate`. */
+	countByState(capName, predicate) {
+		let n = 0;
+		for (const [deviceId, perCap] of this.stateMirror) {
+			const slice = perCap.get(capName);
+			if (!slice) continue;
+			if (predicate(slice, deviceId)) n++;
+		}
+		return n;
+	}
+	/**
+	* Global listener — fires for every `device.state-changed` event the
+	* mirror absorbs.
+	*/
+	listen(cb) {
+		this.globalStateListeners.add(cb);
+		return () => {
+			this.globalStateListeners.delete(cb);
+		};
+	}
+	/**
+	* Per-cap listener — fires only for state changes on `capName`,
+	* across every device. The callback receives the deviceId so the
+	* caller can route.
+	*/
+	listenCap(capName, cb) {
+		let set = this.capListeners.get(capName);
+		if (!set) {
+			set = /* @__PURE__ */ new Set();
+			this.capListeners.set(capName, set);
+		}
+		set.add(cb);
+		return () => {
+			set.delete(cb);
+			if (set.size === 0) this.capListeners.delete(capName);
+		};
+	}
+	/**
+	* Per-device listener — fires for every cap change on `deviceId`.
+	*/
+	listenDevice(deviceId, cb) {
+		let set = this.deviceListeners.get(deviceId);
+		if (!set) {
+			set = /* @__PURE__ */ new Set();
+			this.deviceListeners.set(deviceId, set);
+		}
+		set.add(cb);
+		return () => {
+			set.delete(cb);
+			if (set.size === 0) this.deviceListeners.delete(deviceId);
+		};
+	}
+	/** Fires when `device.registered` lands. Receives the new metadata. */
+	onDeviceAdded(cb) {
+		this.addedListeners.add(cb);
+		return () => {
+			this.addedListeners.delete(cb);
+		};
+	}
+	/** Fires when `device.unregistered` lands. `info` is the LAST-known
+	*  metadata (or null if the device was never seen). */
+	onDeviceRemoved(cb) {
+		this.removedListeners.add(cb);
+		return () => {
+			this.removedListeners.delete(cb);
+		};
+	}
+	/**
+	* Resolve when `predicate` over the runtime-state slice for
+	* `(deviceId, capName)` becomes true. Resolves immediately if the
+	* current slice already matches. Rejects with `Error('timeout')`
+	* after `timeoutMs` (default 30s; pass `Infinity` to wait forever).
+	*
+	* Returns the matching slice — caller can read it directly without
+	* a second mirror lookup.
+	*/
+	waitForState(deviceId, capName, predicate, timeoutMs = 3e4) {
+		return new Promise((resolve, reject) => {
+			const check = () => {
+				const slice = this.stateMirror.get(deviceId)?.get(capName);
+				if (slice && predicate(slice)) return slice;
+				return null;
+			};
+			const initial = check();
+			if (initial) {
+				resolve(initial);
+				return;
+			}
+			let timer = null;
+			const off = this.listenDevice(deviceId, (_id, cap, slice) => {
+				if (cap !== capName) return;
+				if (!slice) return;
+				if (predicate(slice)) {
+					if (timer) clearTimeout(timer);
+					off();
+					resolve(slice);
+				}
+			});
+			if (Number.isFinite(timeoutMs)) timer = setTimeout(() => {
+				off();
+				reject(/* @__PURE__ */ new Error(`waitForState timed out after ${timeoutMs}ms (deviceId=${deviceId}, capName=${capName})`));
+			}, timeoutMs);
+		});
+	}
+	/**
+	* Resolve when a device with `deviceId` becomes available (a
+	* binding exists). Resolves immediately if already known. Rejects
+	* with timeout.
+	*/
+	waitForDevice(deviceId, timeoutMs = 3e4) {
+		return new Promise((resolve, reject) => {
+			const existing = this.getDeviceById(deviceId);
+			if (existing) {
+				resolve(existing);
+				return;
+			}
+			let timer = null;
+			const off = this.onDeviceAdded((id) => {
+				if (id !== deviceId) return;
+				const proxy = this.getDeviceById(id);
+				if (!proxy) return;
+				if (timer) clearTimeout(timer);
+				off();
+				resolve(proxy);
+			});
+			if (Number.isFinite(timeoutMs)) timer = setTimeout(() => {
+				off();
+				reject(/* @__PURE__ */ new Error(`waitForDevice timed out after ${timeoutMs}ms (deviceId=${deviceId})`));
+			}, timeoutMs);
+		});
+	}
+	/**
+	* Iterate every device that binds `capName`. Awaits each callback
+	* sequentially — for parallel use `invokeCap` with explicit
+	* parallelism.
+	*/
+	async forEachCap(capName, cb) {
+		for (const proxy of this.filterByCap(capName)) await cb(proxy);
+	}
+	/**
+	* Invoke a cap method on every device that binds the cap. Returns
+	* one result per device, success or failure isolated. Optional
+	* parallelism cap — useful for "snapshot all cameras but only 4
+	* at a time so battery cams don't all wake at once".
+	*
+	* Example:
+	*
+	*   const results = await sm.invokeCap('snapshot', 'getSnapshot', {}, { parallelism: 4 })
+	*   const failed = results.filter(r => !r.ok)
+	*/
+	async invokeCap(capName, methodName, args, opts = {}) {
+		const targets = this.filterByCap(capName);
+		const parallelism = Math.max(1, opts.parallelism ?? targets.length);
+		const out = [];
+		for (let i = 0; i < targets.length; i += parallelism) {
+			const chunk = targets.slice(i, i + parallelism);
+			const settled = await Promise.allSettled(chunk.map(async (proxy) => {
+				const cap = proxy[capName];
+				if (!cap || typeof cap[methodName] !== "function") throw new Error(`device '${proxy.deviceId}' does not expose '${capName}.${methodName}'`);
+				return await cap[methodName](args);
+			}));
+			for (let j = 0; j < settled.length; j++) {
+				const proxy = chunk[j];
+				const r = settled[j];
+				if (r.status === "fulfilled") out.push({
+					deviceId: proxy.deviceId,
+					ok: true,
+					result: r.value
+				});
+				else out.push({
+					deviceId: proxy.deviceId,
+					ok: false,
+					error: r.reason
+				});
+			}
+		}
+		return out;
+	}
+	/**
+	* One-shot summary — fleet size, breakdown by cap / addon / type.
+	* Designed for REPL inspection (`sm.summary()`).
+	*/
+	summary() {
+		const byCap = {};
+		const byAddon = {};
+		const byType = {};
+		let online = 0;
+		let offline = 0;
+		for (const binding of this.bindings.values()) for (const entry of binding.entries) byCap[entry.capName] = (byCap[entry.capName] ?? 0) + 1;
+		for (const info of this.devices.values()) {
+			byAddon[info.addonId] = (byAddon[info.addonId] ?? 0) + 1;
+			byType[info.type] = (byType[info.type] ?? 0) + 1;
+			if (info.online) online++;
+			else offline++;
+		}
+		return {
+			totalDevices: this.bindings.size,
+			online,
+			offline,
+			byCap,
+			byAddon,
+			byType,
+			statedDevices: this.stateMirror.size
+		};
+	}
+	/**
+	* Debug-friendly dump — full state + binding + metadata for one
+	* device or all devices. Cheap deep clone so caller mutations don't
+	* leak into the mirror.
+	*/
+	dump(deviceId) {
+		const dumpOne = (id) => {
+			const info = this.devices.get(id) ?? null;
+			const binding = this.bindings.get(id) ?? null;
+			const state = {};
+			const perCap = this.stateMirror.get(id);
+			if (perCap) for (const [cap, slice] of perCap) state[cap] = { ...slice };
+			return {
+				deviceId: id,
+				info,
+				binding: binding ? {
+					...binding,
+					entries: binding.entries.map((e) => ({ ...e }))
+				} : null,
+				state
+			};
+		};
+		if (deviceId !== void 0) return dumpOne(deviceId);
+		const out = [];
+		for (const id of this.bindings.keys()) out.push(dumpOne(id));
+		return out;
+	}
+	/**
+	* Direct read-only access to the underlying state mirror. Use
+	* sparingly — `getSystemState` returns a deep copy that's safer for
+	* exploratory work; this avoids the clone cost when iterating
+	* thousands of slices.
+	*/
+	getRawMirror() {
+		return this.stateMirror;
+	}
+	/**
+	* Snapshot of the full state mirror — same shape as the warm-boot
+	* payload. Deep-cloned; safe to mutate.
+	*/
+	getSystemState() {
+		const copy = /* @__PURE__ */ new Map();
+		for (const [id, perCap] of this.stateMirror) {
+			const dup = /* @__PURE__ */ new Map();
+			for (const [k, v] of perCap) dup.set(k, { ...v });
+			copy.set(id, dup);
+		}
+		return copy;
+	}
+	subscribeBus() {
+		if (!this.api.live?.onEvent) return;
+		const sub = this.api.live.onEvent;
+		this.bridges.push(sub.subscribe({ category: STATE_CHANGED_CATEGORY }, { onData: (evt) => {
+			const data = evt.data;
+			if (!data || typeof data.deviceId !== "number" || typeof data.capName !== "string") return;
+			this.applyStateUpdate(data.deviceId, data.capName, data.slice);
+		} }));
+		this.bridges.push(sub.subscribe({ category: BINDING_CHANGED_CATEGORY }, { onData: (evt) => {
+			const data = evt.data;
+			const deviceId = typeof data?.deviceId === "number" ? data.deviceId : data?.source?.type === "device" && typeof data.source.id === "number" ? data.source.id : null;
+			if (deviceId === null) return;
+			this.refreshBinding(deviceId);
+		} }));
+		this.bridges.push(sub.subscribe({ category: DEVICE_REGISTERED_CATEGORY }, { onData: (evt) => {
+			const data = evt.data;
+			if (typeof data?.deviceId !== "number") return;
+			this.refreshDeviceMetadata(data.deviceId, "added");
+		} }));
+		this.bridges.push(sub.subscribe({ category: DEVICE_UNREGISTERED_CATEGORY }, { onData: (evt) => {
+			const data = evt.data;
+			if (typeof data?.deviceId !== "number") return;
+			this.applyDeviceRemoval(data.deviceId);
+		} }));
+		this.bridges.push(sub.subscribe({ category: DEVICE_UPDATED_CATEGORY }, { onData: (evt) => {
+			const data = evt.data;
+			if (typeof data?.deviceId !== "number") return;
+			this.refreshDeviceMetadata(data.deviceId, "updated");
+		} }));
+	}
+	applyStateUpdate(deviceId, capName, slice) {
+		let perCap = this.stateMirror.get(deviceId);
+		if (!perCap) {
+			perCap = /* @__PURE__ */ new Map();
+			this.stateMirror.set(deviceId, perCap);
+		}
+		if (slice === void 0) perCap.delete(capName);
+		else perCap.set(capName, slice);
+		const handleKey = `${deviceId}:${capName}`;
+		const handleSet = this.handleListeners.get(handleKey);
+		if (handleSet) for (const cb of handleSet) try {
+			cb(slice);
+		} catch {}
+		for (const cb of this.globalStateListeners) try {
+			cb(deviceId, capName, slice);
+		} catch {}
+		const capSet = this.capListeners.get(capName);
+		if (capSet) for (const cb of capSet) try {
+			cb(deviceId, slice);
+		} catch {}
+		const devSet = this.deviceListeners.get(deviceId);
+		if (devSet) for (const cb of devSet) try {
+			cb(deviceId, capName, slice);
+		} catch {}
+	}
+	applyDeviceRemoval(deviceId) {
+		const lastInfo = this.devices.get(deviceId) ?? null;
+		this.bindings.delete(deviceId);
+		this.devices.delete(deviceId);
+		this.stateMirror.delete(deviceId);
+		for (const cb of this.removedListeners) try {
+			cb(deviceId, lastInfo);
+		} catch {}
+	}
+	async refreshBinding(deviceId) {
+		try {
+			const fresh = (await this.api.deviceManager.getAllBindings.query({})).find((b) => b.deviceId === deviceId);
+			if (fresh) this.bindings.set(deviceId, fresh);
+			else this.applyDeviceRemoval(deviceId);
+		} catch {}
+	}
+	async refreshDeviceMetadata(deviceId, kind) {
+		try {
+			const info = await this.api.deviceManager.getDevice.query({ deviceId });
+			if (!info) return;
+			const wasNew = !this.devices.has(deviceId);
+			this.devices.set(deviceId, info);
+			if (kind === "added" && wasNew) {
+				await this.refreshBinding(deviceId);
+				for (const cb of this.addedListeners) try {
+					cb(deviceId, info);
+				} catch {}
+			}
+		} catch {}
+	}
+};
+function inSet(value, set) {
+	if (Array.isArray(set)) return set.includes(value);
+	return value === set;
+}
+function toArray(value) {
+	return Array.isArray(value) ? value : [value];
+}
+function matchesString(haystack, match) {
+	if (typeof match === "string") return haystack === match;
+	if (match instanceof RegExp) return match.test(haystack);
+	if ("exact" in match) return haystack === match.exact;
+	if ("contains" in match) return haystack.toLowerCase().includes(match.contains.toLowerCase());
+	return false;
+}
+//#endregion
+//#region src/device/zod-to-config-ui.ts
+/** Access Zod v4 internal .def — not in public typings but stable at runtime */
+function zodDef(schema) {
+	return schema.def;
+}
+/** Access internal properties on a Zod schema instance */
+function zodInternals(schema) {
+	return schema;
+}
+/**
+* Convert DeviceConfig.entries() output to ConfigUISchema for the admin UI FormBuilder.
+*
+* Each entry's Zod type is inspected to determine the correct ConfigField type:
+* - ZodString → 'text' (or 'password' when key contains "password"/"secret"/"token"/"apikey")
+* - ZodNumber → 'number' (extracts min/max/step from Zod v4 checks)
+* - ZodBoolean → 'boolean'
+* - ZodEnum → 'select' (options built from enum values)
+* - Anything else → 'text' fallback
+*
+* Wrapper types ZodDefault, ZodOptional, and ZodNullable are unwrapped transparently.
+* Default values are extracted from ZodDefault wrappers.
+*/
+function zodEntriesToConfigUI(entries, sectionTitle = "Configuration", sectionId = "main") {
+	return { sections: [{
+		id: sectionId,
+		title: sectionTitle,
+		fields: entries.map((entry) => zodToConfigField(entry.key, entry.schema, entry.description))
+	}] };
+}
+function zodToConfigField(key, schema, description) {
+	const inner = unwrapZod(schema);
+	const defaultValue = getZodDefault(schema);
+	const base = {
+		key,
+		label: description ?? humanizeKey(key),
+		description,
+		default: defaultValue
+	};
+	if (inner instanceof z.ZodString) return buildStringField(key, base);
+	if (inner instanceof z.ZodNumber) return buildNumberField(inner, base);
+	if (inner instanceof z.ZodBoolean) return {
+		...base,
+		type: "boolean"
+	};
+	if (inner instanceof z.ZodEnum) return buildEnumField(inner, base);
+	if (inner instanceof z.ZodArray || inner instanceof z.ZodObject) return {
+		...base,
+		type: "textarea",
+		rows: 6,
+		isJson: true
+	};
+	return {
+		...base,
+		type: "text"
+	};
+}
+function buildStringField(key, base) {
+	const lowerKey = key.toLowerCase();
+	if (lowerKey.includes("password") || lowerKey.includes("secret") || lowerKey.includes("token") || lowerKey.includes("apikey") || lowerKey.includes("api_key")) return {
+		...base,
+		type: "password",
+		showToggle: true
+	};
+	return {
+		...base,
+		type: "text"
+	};
+}
+function buildNumberField(inner, base) {
+	const anyInner = zodInternals(inner);
+	const rawMin = anyInner.minValue;
+	const rawMax = anyInner.maxValue;
+	const min = rawMin != null && isFinite(rawMin) ? rawMin : void 0;
+	const max = rawMax != null && isFinite(rawMax) ? rawMax : void 0;
+	const step = getMultipleOfStep(inner);
+	return {
+		...base,
+		type: "number",
+		...min !== void 0 ? { min } : {},
+		...max !== void 0 ? { max } : {},
+		...step !== void 0 ? { step } : {}
+	};
+}
+function getMultipleOfStep(inner) {
+	const checks = zodDef(inner).checks ?? [];
+	for (const check of checks) if (check._zod?.def?.check === "multiple_of" && check._zod.def.value !== void 0) return check._zod.def.value;
+}
+function buildEnumField(inner, base) {
+	const values = inner.options.map((v) => String(v));
+	return {
+		...base,
+		type: "select",
+		options: values.map((v) => ({
+			label: humanizeKey(v),
+			value: v
+		}))
+	};
+}
+function unwrapZod(schema) {
+	if (schema instanceof z.ZodDefault) return unwrapZod(zodDef(schema).innerType);
+	if (schema instanceof z.ZodOptional) return unwrapZod(zodDef(schema).innerType);
+	if (schema instanceof z.ZodNullable) return unwrapZod(zodDef(schema).innerType);
+	return schema;
+}
+function getZodDefault(schema) {
+	if (schema instanceof z.ZodDefault) return zodDef(schema).defaultValue;
+}
+function humanizeKey(key) {
+	return key.replace(/([A-Z])/g, " $1").replace(/[_-]/g, " ").replace(/^\w/, (c) => c.toUpperCase()).trim();
+}
+//#endregion
+//#region src/expression/errors.ts
+/**
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
+*/
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
+//#endregion
+//#region src/expression/builtins.ts
+/**
+* Frozen, null-prototype builtin function table for the expression engine
+* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
+* parser rejects any callee not in it, and the evaluator gates each call on an
+* own-property check against it.
+*
+* Because the object has a NULL prototype AND is `Object.freeze`d:
+*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
+*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
+*    (there is no `Object.prototype` in the chain), so those names are not
+*    callable — they are simply "unknown function" at parse time.
+*
+* Every numeric argument is validated as a finite number and every numeric
+* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
+* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
+* closed rather than emitting a garbage value.
+*/
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString$1(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString$1(args[1], "convert", 1).trim();
+			const to = asString$1(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
+	}
+};
+/** Frozen, null-prototype builtin table. */
+var EXPRESSION_BUILTINS = Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
+//#endregion
+//#region src/expression/limits.ts
+/**
+* Resource-bound constants for the safe expression engine.
+*
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
+*/
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** Max AST nodes — checked during parse; a deeply nested grouping that exceeds
+*  this is rejected as "expression too complex". */
+var MAX_EXPRESSION_AST_NODES = 256;
+/** Defense-in-depth walker step budget — one increment per node visit during
+*  evaluation. The grammar guarantees O(nodeCount) walks, so this can only trip
+*  on a crafted maximum-size AST. */
+var MAX_EXPRESSION_EVAL_STEPS = 4096;
+/** Max named bindings on one {@link ExpressionSource}. */
+var MAX_EXPRESSION_BINDINGS = 32;
+/** Max positional arguments to any builtin call. */
+var MAX_EXPRESSION_CALL_ARGS = 16;
+/** LRU compile-cache capacity (parsed ASTs keyed by raw source string). */
+var EXPRESSION_COMPILE_CACHE_CAPACITY = 256;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
+]);
+//#endregion
+//#region src/expression/tokenizer.ts
+/**
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
+*/
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
 		}
-		return out;
-	}
-	/** First device whose slice matches `predicate`, or null. */
-	findState(capName, predicate) {
-		for (const [deviceId, perCap] of this.stateMirror) {
-			const slice = perCap.get(capName);
-			if (!slice) continue;
-			if (!predicate(slice, deviceId)) continue;
-			return this.getDeviceById(deviceId);
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
 		}
-		return null;
-	}
-	/** Count devices that bind a cap. Faster than `filterByCap(...).length`. */
-	countByCap(capName) {
-		let n = 0;
-		for (const binding of this.bindings.values()) if (binding.entries.some((e) => e.capName === capName)) n++;
-		return n;
-	}
-	/** Count devices whose slice for `capName` matches `predicate`. */
-	countByState(capName, predicate) {
-		let n = 0;
-		for (const [deviceId, perCap] of this.stateMirror) {
-			const slice = perCap.get(capName);
-			if (!slice) continue;
-			if (predicate(slice, deviceId)) n++;
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
 		}
-		return n;
-	}
-	/**
-	* Global listener — fires for every `device.state-changed` event the
-	* mirror absorbs.
-	*/
-	listen(cb) {
-		this.globalStateListeners.add(cb);
-		return () => {
-			this.globalStateListeners.delete(cb);
-		};
-	}
-	/**
-	* Per-cap listener — fires only for state changes on `capName`,
-	* across every device. The callback receives the deviceId so the
-	* caller can route.
-	*/
-	listenCap(capName, cb) {
-		let set = this.capListeners.get(capName);
-		if (!set) {
-			set = /* @__PURE__ */ new Set();
-			this.capListeners.set(capName, set);
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
 		}
-		set.add(cb);
-		return () => {
-			set.delete(cb);
-			if (set.size === 0) this.capListeners.delete(capName);
-		};
-	}
-	/**
-	* Per-device listener — fires for every cap change on `deviceId`.
-	*/
-	listenDevice(deviceId, cb) {
-		let set = this.deviceListeners.get(deviceId);
-		if (!set) {
-			set = /* @__PURE__ */ new Set();
-			this.deviceListeners.set(deviceId, set);
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
 		}
-		set.add(cb);
-		return () => {
-			set.delete(cb);
-			if (set.size === 0) this.deviceListeners.delete(deviceId);
-		};
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
 	}
-	/** Fires when `device.registered` lands. Receives the new metadata. */
-	onDeviceAdded(cb) {
-		this.addedListeners.add(cb);
-		return () => {
-			this.addedListeners.delete(cb);
-		};
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
+//#endregion
+//#region src/expression/parser.ts
+/**
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
+*
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
+*
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+*/
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
 	}
-	/** Fires when `device.unregistered` lands. `info` is the LAST-known
-	*  metadata (or null if the device was never seen). */
-	onDeviceRemoved(cb) {
-		this.removedListeners.add(cb);
-		return () => {
-			this.removedListeners.delete(cb);
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
 		};
 	}
-	/**
-	* Resolve when `predicate` over the runtime-state slice for
-	* `(deviceId, capName)` becomes true. Resolves immediately if the
-	* current slice already matches. Rejects with `Error('timeout')`
-	* after `timeoutMs` (default 30s; pass `Infinity` to wait forever).
-	*
-	* Returns the matching slice — caller can read it directly without
-	* a second mirror lookup.
-	*/
-	waitForState(deviceId, capName, predicate, timeoutMs = 3e4) {
-		return new Promise((resolve, reject) => {
-			const check = () => {
-				const slice = this.stateMirror.get(deviceId)?.get(capName);
-				if (slice && predicate(slice)) return slice;
-				return null;
-			};
-			const initial = check();
-			if (initial) {
-				resolve(initial);
-				return;
-			}
-			let timer = null;
-			const off = this.listenDevice(deviceId, (_id, cap, slice) => {
-				if (cap !== capName) return;
-				if (!slice) return;
-				if (predicate(slice)) {
-					if (timer) clearTimeout(timer);
-					off();
-					resolve(slice);
-				}
-			});
-			if (Number.isFinite(timeoutMs)) timer = setTimeout(() => {
-				off();
-				reject(/* @__PURE__ */ new Error(`waitForState timed out after ${timeoutMs}ms (deviceId=${deviceId}, capName=${capName})`));
-			}, timeoutMs);
-		});
+	peek() {
+		return this.tokens[this.pos];
 	}
-	/**
-	* Resolve when a device with `deviceId` becomes available (a
-	* binding exists). Resolves immediately if already known. Rejects
-	* with timeout.
-	*/
-	waitForDevice(deviceId, timeoutMs = 3e4) {
-		return new Promise((resolve, reject) => {
-			const existing = this.getDeviceById(deviceId);
-			if (existing) {
-				resolve(existing);
-				return;
-			}
-			let timer = null;
-			const off = this.onDeviceAdded((id) => {
-				if (id !== deviceId) return;
-				const proxy = this.getDeviceById(id);
-				if (!proxy) return;
-				if (timer) clearTimeout(timer);
-				off();
-				resolve(proxy);
-			});
-			if (Number.isFinite(timeoutMs)) timer = setTimeout(() => {
-				off();
-				reject(/* @__PURE__ */ new Error(`waitForDevice timed out after ${timeoutMs}ms (deviceId=${deviceId})`));
-			}, timeoutMs);
-		});
+	next() {
+		return this.tokens[this.pos++];
 	}
-	/**
-	* Iterate every device that binds `capName`. Awaits each callback
-	* sequentially — for parallel use `invokeCap` with explicit
-	* parallelism.
-	*/
-	async forEachCap(capName, cb) {
-		for (const proxy of this.filterByCap(capName)) await cb(proxy);
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
 	}
-	/**
-	* Invoke a cap method on every device that binds the cap. Returns
-	* one result per device, success or failure isolated. Optional
-	* parallelism cap — useful for "snapshot all cameras but only 4
-	* at a time so battery cams don't all wake at once".
-	*
-	* Example:
-	*
-	*   const results = await sm.invokeCap('snapshot', 'getSnapshot', {}, { parallelism: 4 })
-	*   const failed = results.filter(r => !r.ok)
-	*/
-	async invokeCap(capName, methodName, args, opts = {}) {
-		const targets = this.filterByCap(capName);
-		const parallelism = Math.max(1, opts.parallelism ?? targets.length);
-		const out = [];
-		for (let i = 0; i < targets.length; i += parallelism) {
-			const chunk = targets.slice(i, i + parallelism);
-			const settled = await Promise.allSettled(chunk.map(async (proxy) => {
-				const cap = proxy[capName];
-				if (!cap || typeof cap[methodName] !== "function") throw new Error(`device '${proxy.deviceId}' does not expose '${capName}.${methodName}'`);
-				return await cap[methodName](args);
-			}));
-			for (let j = 0; j < settled.length; j++) {
-				const proxy = chunk[j];
-				const r = settled[j];
-				if (r.status === "fulfilled") out.push({
-					deviceId: proxy.deviceId,
-					ok: true,
-					result: r.value
-				});
-				else out.push({
-					deviceId: proxy.deviceId,
-					ok: false,
-					error: r.reason
-				});
-			}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
 		}
-		return out;
+		return false;
 	}
-	/**
-	* One-shot summary — fleet size, breakdown by cap / addon / type.
-	* Designed for REPL inspection (`sm.summary()`).
-	*/
-	summary() {
-		const byCap = {};
-		const byAddon = {};
-		const byType = {};
-		let online = 0;
-		let offline = 0;
-		for (const binding of this.bindings.values()) for (const entry of binding.entries) byCap[entry.capName] = (byCap[entry.capName] ?? 0) + 1;
-		for (const info of this.devices.values()) {
-			byAddon[info.addonId] = (byAddon[info.addonId] ?? 0) + 1;
-			byType[info.type] = (byType[info.type] ?? 0) + 1;
-			if (info.online) online++;
-			else offline++;
-		}
-		return {
-			totalDevices: this.bindings.size,
-			online,
-			offline,
-			byCap,
-			byAddon,
-			byType,
-			statedDevices: this.stateMirror.size
-		};
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
 	}
-	/**
-	* Debug-friendly dump — full state + binding + metadata for one
-	* device or all devices. Cheap deep clone so caller mutations don't
-	* leak into the mirror.
-	*/
-	dump(deviceId) {
-		const dumpOne = (id) => {
-			const info = this.devices.get(id) ?? null;
-			const binding = this.bindings.get(id) ?? null;
-			const state = {};
-			const perCap = this.stateMirror.get(id);
-			if (perCap) for (const [cap, slice] of perCap) state[cap] = { ...slice };
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
 			return {
-				deviceId: id,
-				info,
-				binding: binding ? {
-					...binding,
-					entries: binding.entries.map((e) => ({ ...e }))
-				} : null,
-				state
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
 			};
-		};
-		if (deviceId !== void 0) return dumpOne(deviceId);
-		const out = [];
-		for (const id of this.bindings.keys()) out.push(dumpOne(id));
-		return out;
-	}
-	/**
-	* Direct read-only access to the underlying state mirror. Use
-	* sparingly — `getSystemState` returns a deep copy that's safer for
-	* exploratory work; this avoids the clone cost when iterating
-	* thousands of slices.
-	*/
-	getRawMirror() {
-		return this.stateMirror;
+		}
+		return test;
 	}
-	/**
-	* Snapshot of the full state mirror — same shape as the warm-boot
-	* payload. Deep-cloned; safe to mutate.
-	*/
-	getSystemState() {
-		const copy = /* @__PURE__ */ new Map();
-		for (const [id, perCap] of this.stateMirror) {
-			const dup = /* @__PURE__ */ new Map();
-			for (const [k, v] of perCap) dup.set(k, { ...v });
-			copy.set(id, dup);
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
 		}
-		return copy;
+		return this.parsePrimary();
 	}
-	subscribeBus() {
-		if (!this.api.live?.onEvent) return;
-		const sub = this.api.live.onEvent;
-		this.bridges.push(sub.subscribe({ category: STATE_CHANGED_CATEGORY }, { onData: (evt) => {
-			const data = evt.data;
-			if (!data || typeof data.deviceId !== "number" || typeof data.capName !== "string") return;
-			this.applyStateUpdate(data.deviceId, data.capName, data.slice);
-		} }));
-		this.bridges.push(sub.subscribe({ category: BINDING_CHANGED_CATEGORY }, { onData: (evt) => {
-			const data = evt.data;
-			const deviceId = typeof data?.deviceId === "number" ? data.deviceId : data?.source?.type === "device" && typeof data.source.id === "number" ? data.source.id : null;
-			if (deviceId === null) return;
-			this.refreshBinding(deviceId);
-		} }));
-		this.bridges.push(sub.subscribe({ category: DEVICE_REGISTERED_CATEGORY }, { onData: (evt) => {
-			const data = evt.data;
-			if (typeof data?.deviceId !== "number") return;
-			this.refreshDeviceMetadata(data.deviceId, "added");
-		} }));
-		this.bridges.push(sub.subscribe({ category: DEVICE_UNREGISTERED_CATEGORY }, { onData: (evt) => {
-			const data = evt.data;
-			if (typeof data?.deviceId !== "number") return;
-			this.applyDeviceRemoval(data.deviceId);
-		} }));
-		this.bridges.push(sub.subscribe({ category: DEVICE_UPDATED_CATEGORY }, { onData: (evt) => {
-			const data = evt.data;
-			if (typeof data?.deviceId !== "number") return;
-			this.refreshDeviceMetadata(data.deviceId, "updated");
-		} }));
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
+				};
+			}
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
 	}
-	applyStateUpdate(deviceId, capName, slice) {
-		let perCap = this.stateMirror.get(deviceId);
-		if (!perCap) {
-			perCap = /* @__PURE__ */ new Map();
-			this.stateMirror.set(deviceId, perCap);
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
 		}
-		if (slice === void 0) perCap.delete(capName);
-		else perCap.set(capName, slice);
-		const handleKey = `${deviceId}:${capName}`;
-		const handleSet = this.handleListeners.get(handleKey);
-		if (handleSet) for (const cb of handleSet) try {
-			cb(slice);
-		} catch {}
-		for (const cb of this.globalStateListeners) try {
-			cb(deviceId, capName, slice);
-		} catch {}
-		const capSet = this.capListeners.get(capName);
-		if (capSet) for (const cb of capSet) try {
-			cb(deviceId, slice);
-		} catch {}
-		const devSet = this.deviceListeners.get(deviceId);
-		if (devSet) for (const cb of devSet) try {
-			cb(deviceId, capName, slice);
-		} catch {}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
 	}
-	applyDeviceRemoval(deviceId) {
-		const lastInfo = this.devices.get(deviceId) ?? null;
-		this.bindings.delete(deviceId);
-		this.devices.delete(deviceId);
-		this.stateMirror.delete(deviceId);
-		for (const cb of this.removedListeners) try {
-			cb(deviceId, lastInfo);
-		} catch {}
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
+//#endregion
+//#region src/expression/compile.ts
+/**
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
+*
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
+*/
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
 	}
-	async refreshBinding(deviceId) {
-		try {
-			const fresh = (await this.api.deviceManager.getAllBindings.query({})).find((b) => b.deviceId === deviceId);
-			if (fresh) this.bindings.set(deviceId, fresh);
-			else this.applyDeviceRemoval(deviceId);
-		} catch {}
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
 	}
-	async refreshDeviceMetadata(deviceId, kind) {
-		try {
-			const info = await this.api.deviceManager.getDevice.query({ deviceId });
-			if (!info) return;
-			const wasNew = !this.devices.has(deviceId);
-			this.devices.set(deviceId, info);
-			if (kind === "added" && wasNew) {
-				await this.refreshBinding(deviceId);
-				for (const cb of this.addedListeners) try {
-					cb(deviceId, info);
-				} catch {}
-			}
-		} catch {}
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
 	}
-};
-function inSet(value, set) {
-	if (Array.isArray(set)) return set.includes(value);
-	return value === set;
+	return result;
 }
-function toArray(value) {
-	return Array.isArray(value) ? value : [value];
+/** Compile `source` to a `ParsedExpression`, throwing `ExpressionParseError`
+*  on failure. LRU/negative-cached. */
+function compileExpression(source) {
+	const result = getCached(source);
+	if (result.ok) return result.parsed;
+	throw new ExpressionParseError(result.error);
 }
-function matchesString(haystack, match) {
-	if (typeof match === "string") return haystack === match;
-	if (match instanceof RegExp) return match.test(haystack);
-	if ("exact" in match) return haystack === match.exact;
-	if ("contains" in match) return haystack.toLowerCase().includes(match.contains.toLowerCase());
-	return false;
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
 }
 //#endregion
-//#region src/device/zod-to-config-ui.ts
-/** Access Zod v4 internal .def — not in public typings but stable at runtime */
-function zodDef(schema) {
-	return schema.def;
-}
-/** Access internal properties on a Zod schema instance */
-function zodInternals(schema) {
-	return schema;
-}
+//#region src/expression/evaluator.ts
 /**
-* Convert DeviceConfig.entries() output to ConfigUISchema for the admin UI FormBuilder.
-*
-* Each entry's Zod type is inspected to determine the correct ConfigField type:
-* - ZodString → 'text' (or 'password' when key contains "password"/"secret"/"token"/"apikey")
-* - ZodNumber → 'number' (extracts min/max/step from Zod v4 checks)
-* - ZodBoolean → 'boolean'
-* - ZodEnum → 'select' (options built from enum values)
-* - Anything else → 'text' fallback
+* Tree-walking evaluator for the safe expression mini-language.
 *
-* Wrapper types ZodDefault, ZodOptional, and ZodNullable are unwrapped transparently.
-* Default values are extracted from ZodDefault wrappers.
+* SECURITY (spec §4 rule 2/5):
+*  - The scope is an `Object.create(null)` copy of ONLY the caller's own
+*    enumerable binding entries, so `name in scope` is a pure own-key check and
+*    `constructor` / `__proto__` / `toString` are plain unknown identifiers.
+*  - Performs ZERO I/O and never touches `globalThis` / `Date` / `Math`
+*    directly — the only external calls are into the frozen builtin table.
+*  - The grammar has no loops/recursion/lambdas, so a walk is O(nodeCount) by
+*    construction; the step counter is defense-in-depth for a crafted max-size
+*    AST. Nothing blocks: there are no timers, awaits or unbounded loops.
 */
-function zodEntriesToConfigUI(entries, sectionTitle = "Configuration", sectionId = "main") {
-	return { sections: [{
-		id: sectionId,
-		title: sectionTitle,
-		fields: entries.map((entry) => zodToConfigField(entry.key, entry.schema, entry.description))
-	}] };
+var EMPTY_HOOKS = Object.freeze({});
+/** Build a null-prototype scope from own-enumerable binding entries. Inherited
+*  keys of the input (e.g. from a `{__proto__: {...}}` payload) are NOT copied,
+*  so nothing smuggles in via the prototype chain. */
+function createExpressionScope(bindings) {
+	const scope = Object.create(null);
+	for (const key of Object.keys(bindings)) if (Object.prototype.hasOwnProperty.call(bindings, key)) scope[key] = bindings[key];
+	return scope;
 }
-function zodToConfigField(key, schema, description) {
-	const inner = unwrapZod(schema);
-	const defaultValue = getZodDefault(schema);
-	const base = {
-		key,
-		label: description ?? humanizeKey(key),
-		description,
-		default: defaultValue
-	};
-	if (inner instanceof z.ZodString) return buildStringField(key, base);
-	if (inner instanceof z.ZodNumber) return buildNumberField(inner, base);
-	if (inner instanceof z.ZodBoolean) return {
-		...base,
-		type: "boolean"
-	};
-	if (inner instanceof z.ZodEnum) return buildEnumField(inner, base);
-	if (inner instanceof z.ZodArray || inner instanceof z.ZodObject) return {
-		...base,
-		type: "textarea",
-		rows: 6,
-		isJson: true
-	};
-	return {
-		...base,
-		type: "text"
-	};
+function isFiniteNumber(value) {
+	return typeof value === "number" && Number.isFinite(value);
 }
-function buildStringField(key, base) {
-	const lowerKey = key.toLowerCase();
-	if (lowerKey.includes("password") || lowerKey.includes("secret") || lowerKey.includes("token") || lowerKey.includes("apikey") || lowerKey.includes("api_key")) return {
-		...base,
-		type: "password",
-		showToggle: true
-	};
-	return {
-		...base,
-		type: "text"
-	};
+/** JS truthiness of a primitive value. */
+function truthy(value) {
+	return Boolean(value);
 }
-function buildNumberField(inner, base) {
-	const anyInner = zodInternals(inner);
-	const rawMin = anyInner.minValue;
-	const rawMax = anyInner.maxValue;
-	const min = rawMin != null && isFinite(rawMin) ? rawMin : void 0;
-	const max = rawMax != null && isFinite(rawMax) ? rawMax : void 0;
-	const step = getMultipleOfStep(inner);
-	return {
-		...base,
-		type: "number",
-		...min !== void 0 ? { min } : {},
-		...max !== void 0 ? { max } : {},
-		...step !== void 0 ? { step } : {}
-	};
+function requireFinite(value, context) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${context} produced a non-finite result`);
+	return value;
 }
-function getMultipleOfStep(inner) {
-	const checks = zodDef(inner).checks ?? [];
-	for (const check of checks) if (check._zod?.def?.check === "multiple_of" && check._zod.def.value !== void 0) return check._zod.def.value;
+function step(ctx) {
+	ctx.steps += 1;
+	if (ctx.steps > ctx.maxSteps) throw new ExpressionEvalError("expression evaluation step budget exceeded");
 }
-function buildEnumField(inner, base) {
-	const values = inner.options.map((v) => String(v));
-	return {
-		...base,
-		type: "select",
-		options: values.map((v) => ({
-			label: humanizeKey(v),
-			value: v
-		}))
-	};
+function evalNode(node, ctx) {
+	step(ctx);
+	switch (node.kind) {
+		case "literal": return node.value;
+		case "identifier":
+			if (!(node.name in ctx.scope)) throw new ExpressionEvalError(`unknown identifier: ${node.name}`);
+			return ctx.scope[node.name];
+		case "unary": return evalUnary(node.op, evalNode(node.operand, ctx));
+		case "binary": return evalBinary(node.op, evalNode(node.left, ctx), evalNode(node.right, ctx));
+		case "logical": {
+			const left = evalNode(node.left, ctx);
+			if (node.op === "&&") return truthy(left) ? evalNode(node.right, ctx) : left;
+			return truthy(left) ? left : evalNode(node.right, ctx);
+		}
+		case "conditional": return truthy(evalNode(node.test, ctx)) ? evalNode(node.consequent, ctx) : evalNode(node.alternate, ctx);
+		case "call": return evalCall(node.callee, node.args.map((a) => evalNode(a, ctx)), ctx.hooks);
+	}
 }
-function unwrapZod(schema) {
-	if (schema instanceof z.ZodDefault) return unwrapZod(zodDef(schema).innerType);
-	if (schema instanceof z.ZodOptional) return unwrapZod(zodDef(schema).innerType);
-	if (schema instanceof z.ZodNullable) return unwrapZod(zodDef(schema).innerType);
-	return schema;
+function evalUnary(op, operand) {
+	if (op === "!") return !truthy(operand);
+	if (!isFiniteNumber(operand)) throw new ExpressionEvalError("unary \"-\" requires a finite number");
+	return requireFinite(-operand, "unary \"-\"");
 }
-function getZodDefault(schema) {
-	if (schema instanceof z.ZodDefault) return zodDef(schema).defaultValue;
+function evalBinary(op, left, right) {
+	switch (op) {
+		case "==": return left === right;
+		case "!=": return left !== right;
+		case "+":
+			if (typeof left === "string" && typeof right === "string") return left + right;
+			if (isFiniteNumber(left) && isFiniteNumber(right)) return requireFinite(left + right, "\"+\"");
+			throw new ExpressionEvalError("\"+\" requires two numbers or two strings");
+		case "-":
+		case "*":
+		case "/":
+		case "%":
+			if (!isFiniteNumber(left) || !isFiniteNumber(right)) throw new ExpressionEvalError(`"${op}" requires two finite numbers`);
+			return requireFinite(op === "-" ? left - right : op === "*" ? left * right : op === "/" ? left / right : left % right, `"${op}"`);
+		case "<":
+		case "<=":
+		case ">":
+		case ">=":
+			if (isFiniteNumber(left) && isFiniteNumber(right)) return op === "<" ? left < right : op === "<=" ? left <= right : op === ">" ? left > right : left >= right;
+			if (typeof left === "string" && typeof right === "string") return op === "<" ? left < right : op === "<=" ? left <= right : op === ">" ? left > right : left >= right;
+			throw new ExpressionEvalError(`"${op}" requires two numbers or two strings`);
+	}
 }
-function humanizeKey(key) {
-	return key.replace(/([A-Z])/g, " $1").replace(/[_-]/g, " ").replace(/^\w/, (c) => c.toUpperCase()).trim();
+function evalCall(callee, args, hooks) {
+	if (!Object.prototype.hasOwnProperty.call(EXPRESSION_BUILTINS, callee)) throw new ExpressionEvalError(`unknown function: ${callee}`);
+	const builtin = EXPRESSION_BUILTINS[callee];
+	if (args.length < builtin.minArgs || args.length > builtin.maxArgs) throw new ExpressionEvalError(`${callee}: wrong number of arguments (${args.length})`);
+	return builtin.apply(args, hooks);
+}
+/** Evaluate an AST node against a scope. Throws `ExpressionEvalError` on any
+*  runtime failure (unknown identifier, type mismatch, non-finite result,
+*  step-budget exhaustion). */
+function evaluateAst(node, scope, opts) {
+	return evalNode(node, {
+		scope,
+		hooks: opts?.hooks ?? EMPTY_HOOKS,
+		maxSteps: opts?.maxSteps ?? 4096,
+		steps: 0
+	});
+}
+//#endregion
+//#region src/expression/expression-source.ts
+/** The `now` epoch-ms binding is auto-injected into every evaluation and is a
+*  reserved binding name (authors may not rebind it). */
+var EXPRESSION_INJECTED_NOW = "now";
+/**
+* Coerce an untrusted `getByPath` / mirror read to an `ExpressionValue`.
+* Non-primitive values (objects, arrays, `undefined`, functions, bigint,
+* symbol) and non-finite numbers become `undefined` so the caller can apply
+* its binding-miss policy (→ `null`). `null` itself is a valid value.
+*/
+function toExpressionValue(raw) {
+	if (raw === null) return null;
+	if (typeof raw === "string") return raw;
+	if (typeof raw === "boolean") return raw;
+	if (typeof raw === "number") return Number.isFinite(raw) ? raw : void 0;
+}
+/**
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
+	}
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	}
+	return null;
+}
+/**
+* Shared read-path evaluation. Builds a null-proto scope from `bindingValues`
+* plus the injected `now` (supplied by the caller for determinism and
+* testability), compiles via the LRU, and evaluates. Any failure (parse or
+* eval) returns `{ ok: false }` — the caller treats that as "skip this
+* derivation", never as a throw that takes the pass down.
+*/
+function evaluateExpressionSource(expr, bindingValues, now, opts) {
+	const compiled = compileExpressionSafe(expr);
+	if (!compiled.ok) return {
+		ok: false,
+		error: compiled.error
+	};
+	const scope = createExpressionScope({
+		...bindingValues,
+		["now"]: now
+	});
+	try {
+		return {
+			ok: true,
+			value: evaluateAst(compiled.parsed.ast, scope, opts)
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: err instanceof ExpressionEvalError ? err.message : String(err)
+		};
+	}
 }
 //#endregion
+//#region src/expression/binding-source.ts
+/**
+* What an expression's named bindings READ from.
+*
+* Salvaged verbatim from the deleted device-link mechanism. Wiring's source
+* kinds were the one part of it worth keeping: addressing a device field by
+* re-sync-stable `stableId`, a per-device constant, and a sibling-accessory
+* read are the vocabulary any cross-device derivation needs, and they were
+* already correct. What wiring got wrong was the DESTINATION — a field on
+* somebody else's device, with no identity — not the source.
+*
+* These shapes are therefore kept, re-homed next to the engine that consumes
+* them, and are the binding type of a composition recipe (the source picker
+* stays `deviceManager.getWireableFields`). They deliberately do NOT nest: a
+* binding is a read, never another expression.
+*
+* Schemas are authoritative; every type is `z.infer` of one, so a wire shape and
+* a TypeScript shape cannot drift apart (`scripts/check-schema-type-twins.ts`).
+*/
+/** Read a sibling accessory's status field, addressed by the sibling's key.
+*  `kind` is optional for wire compatibility — absent means `'field'`. */
+var ExpressionFieldBindingSchema = z.object({
+	kind: z.literal("field").optional(),
+	sourceKey: z.string(),
+	cap: z.string(),
+	fieldPath: z.string()
+});
+/** A constant. No device is read. */
+var ExpressionLiteralBindingSchema = z.object({
+	kind: z.literal("literal"),
+	value: z.union([
+		z.string(),
+		z.number(),
+		z.boolean(),
+		z.null()
+	])
+});
+/** Read ANY device's status field, addressed by its re-sync-stable `stableId` —
+*  never by numeric id, which a re-adoption reissues. */
+var ExpressionGlobalBindingSchema = z.object({
+	kind: z.literal("global"),
+	sourceStableId: z.string(),
+	cap: z.string(),
+	fieldPath: z.string()
+});
+var ExpressionBindingSourceSchema = z.union([
+	ExpressionFieldBindingSchema,
+	ExpressionLiteralBindingSchema,
+	ExpressionGlobalBindingSchema
+]);
+/**
+* An expression plus the bindings its free identifiers resolve against.
+*
+* The `superRefine` runs the SAME author-time validation as
+* `validateExpressionSource` — compiles the expression, checks binding names,
+* checks identifier coverage — so every boundary that parses one
+* validates-at-write rather than discovering the problem at read time.
+* Compiles are LRU-cached, so repeated validation of the same string is a hit.
+*/
+var ExpressionSourceSchema = z.object({
+	expr: z.string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: z.record(z.string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+//#endregion
 //#region src/generated/cap-status-types.ts
 /**
 * Runtime list of cap names with status. Used by the settings
@@ -30410,6 +30701,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"coreBlocks.restart": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"coreBlocks.setEnabled": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -31046,12 +31343,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"deviceManager.setDeviceLinks": {
-		capName: "device-manager",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"deviceManager.setDisabled": {
 		capName: "device-manager",
 		capScope: "system",
@@ -35464,6 +35755,7 @@ function createSystemProxy(api) {
 			update: (input) => dispatch("coreBlocks", "update", "mutation", input),
 			delete: (input) => dispatch("coreBlocks", "delete", "mutation", input),
 			setEnabled: (input) => dispatch("coreBlocks", "setEnabled", "mutation", input),
+			restart: (input) => dispatch("coreBlocks", "restart", "mutation", input),
 			compile: (input) => dispatch("coreBlocks", "compile", "mutation", input),
 			getTypeDefs: (input) => dispatch("coreBlocks", "getTypeDefs", "query", input)
 		},
@@ -36387,6 +36679,441 @@ var TimelapseRuleSchema = TimelapseRuleInputSchema.extend({
 	updatedAt: z.number()
 });
 //#endregion
+//#region src/pipeline/detail-crop.ts
+/**
+* THE detail-crop convention — the single derivation of the rectangle a
+* detail/enrichment step (clip-embedding, face-detection, plate-detection…)
+* is fed.
+*
+* ## Why this is one module and not two constants
+*
+* `object-clip` is ONE vector index, and cosine similarity is only meaningful
+* between vectors produced from the same crop convention. Two encode paths
+* write into it — the live detail plane and the embedding rebuild — and they
+* used to derive their crops independently: `DETAIL_CROP_PADDING_RATIO = 0.15`
+* with no squaring on one side, `DEFAULT_CROP_MARGIN = 0.2` with squaring on
+* by default on the other. Every rebuild therefore poured a second, silently
+* incomparable feature space into the index it exists to keep consistent.
+*
+* So the rectangle is derived HERE, once, from ONE convention value. Both
+* paths now reach this function through `pipelineRunner.runDetailSubtree` —
+* the runner is the only process that cuts (see `detail-subtree.ts`), and the
+* convention is a cluster-global `pipeline-orchestrator` setting. There is
+* deliberately no per-node or per-device scope: a per-accelerator crop margin
+* would reintroduce the same split, merely relocated.
+*
+* ## The default IS the live convention
+*
+* {@link DEFAULT_DETAIL_CROP_CONVENTION} reproduces what the live path has
+* been storing (0.15, no squaring). Anything else would invalidate every
+* vector already in the index on the day it shipped. Changing the convention
+* is legitimate — that is what the operator knob is for — but it must be
+* followed by a rebuild, which is now guaranteed to produce crops from this
+* same function.
+*/
+/**
+* Store identity of the convention in `pipeline-orchestrator`'s GLOBAL
+* (cluster-wide) settings.
+*
+* These live here rather than in the orchestrator because the reader is a
+* different addon — the pipeline runner, over the hub-routed `addon-settings`
+* cap. Addons never import each other, so a key owned by the writer would have
+* to be hand-copied by the reader, and a hand-copied key is how a setting
+* silently stops arriving while both sides still look correct.
+*/
+var DETAIL_CROP_SECTION_ID = "detail-crop";
+var DETAIL_CROP_PADDING_KEY = "detailCropPaddingRatio";
+var DETAIL_CROP_SQUARE_KEY = "detailCropSquare";
+/**
+* Operator-tunable crop convention. Single-valued and cluster-wide — see the
+* module docblock for why it cannot be scoped per node or per device.
+*/
+var DetailCropConventionSchema = z.object({
+	/**
+	* Fraction of the box's own size added on EACH side before cutting.
+	*
+	* CLIP is trained on natural images WITH surroundings; a pixel-tight crop
+	* removes exactly the context it is strongest on (a dog cut to its outline
+	* is a dark blob). The right value is an empirical question, which is why it
+	* is a setting: 0 / 0.15 / 0.2 / 0.5 are the interesting points.
+	*/
+	paddingRatio: z.number().min(0).max(4),
+	/**
+	* Square the window (in PIXELS) before cutting.
+	*
+	* CLIP's input is square, so a tall bbox resized straight to NxN is squashed
+	* — a standing person becomes a shape the model never saw. Squaring costs
+	* extra background, which is context the model wants anyway. Off by default
+	* because the live path has never squared and the stored index reflects that.
+	*/
+	square: z.boolean()
+});
+/**
+* The convention in force when nobody has configured one — byte-for-byte the
+* behaviour of the pre-unification LIVE path (`DETAIL_CROP_PADDING_RATIO`).
+*/
+var DEFAULT_DETAIL_CROP_CONVENTION = {
+	paddingRatio: .15,
+	square: false
+};
+/**
+* Narrow a FLAT settings record to the convention.
+*
+* Per-FIELD fallback, deliberately: a junk padding must not also discard a
+* valid squaring choice. An absent or invalid value resolves to
+* {@link DEFAULT_DETAIL_CROP_CONVENTION} — the historical live behaviour —
+* rather than to a clamped number nobody chose, so a bad read can never
+* quietly change what the stored vectors mean.
+*/
+function readDetailCropConvention(config) {
+	const paddingRatio = DetailCropConventionSchema.shape.paddingRatio.safeParse(config[DETAIL_CROP_PADDING_KEY]);
+	const square = DetailCropConventionSchema.shape.square.safeParse(config[DETAIL_CROP_SQUARE_KEY]);
+	return {
+		paddingRatio: paddingRatio.success ? paddingRatio.data : DEFAULT_DETAIL_CROP_CONVENTION.paddingRatio,
+		square: square.success ? square.data : DEFAULT_DETAIL_CROP_CONVENTION.square
+	};
+}
+function isHydratedField$1(entry) {
+	return typeof entry === "object" && entry !== null && "key" in entry;
+}
+/**
+* Extract the convention from an `addon-settings.getGlobalSettings` payload.
+*
+* Walks EVERY section rather than looking inside {@link DETAIL_CROP_SECTION_ID}
+* alone: the keys are unique across the addon's schema, and a section rename
+* must not silently revert the whole cluster to the default. A `null` payload
+* (addon mid-boot) is the default convention.
+*/
+function pickDetailCropConvention(view) {
+	if (view === null) return DEFAULT_DETAIL_CROP_CONVENTION;
+	const flat = {};
+	for (const section of view.sections) for (const entry of section.fields) {
+		if (!isHydratedField$1(entry) || typeof entry.key !== "string") continue;
+		if (entry.key === "detailCropPaddingRatio" || entry.key === "detailCropSquare") flat[entry.key] = entry.value;
+	}
+	return readDetailCropConvention(flat);
+}
+/** Slider bounds for the operator-facing padding knob (orchestrator settings UI). */
+var DETAIL_CROP_PADDING_FIELD = {
+	min: 0,
+	max: 1,
+	step: .05,
+	default: DEFAULT_DETAIL_CROP_CONVENTION.paddingRatio
+};
+/**
+* Derive the crop rectangle for one parent detection.
+*
+* Order: pad by `paddingRatio` of the box's own size → optionally square in
+* pixel space around the padded centre → keep it inside the frame. Pure:
+* always returns a new rect and never mutates `bbox`.
+*
+* Edge handling differs by mode, on purpose:
+*
+* - **unsquared** — TRUNCATED at the frame border, byte-for-byte what the live
+*   path has always done (`padAndClampFrameBbox`). A subject against the edge
+*   gets a slightly smaller window. Changing this would silently reinterpret
+*   every edge-touching vector already in the index.
+* - **squared** — SLID inward instead, because a truncated square is not
+*   square and squaring exists precisely to preserve the aspect the model
+*   sees. It only shrinks when the square is larger than the frame itself.
+*/
+function deriveDetailCropRect(bbox, frameWidth, frameHeight, convention) {
+	const padX = convention.paddingRatio * bbox.w;
+	const padY = convention.paddingRatio * bbox.h;
+	const padded = {
+		x: bbox.x - padX,
+		y: bbox.y - padY,
+		w: bbox.w + 2 * padX,
+		h: bbox.h + 2 * padY
+	};
+	return convention.square ? slideInsideFrame(squareInPixels(padded, frameWidth, frameHeight), frameWidth, frameHeight) : truncateToFrame(padded, frameWidth, frameHeight);
+}
+/**
+* Grow the shorter side to the longer one around the window's centre, bounded
+* by the frame's shorter side — a square larger than the frame cannot exist,
+* and collapsing to the frame's short side is the most that does.
+*/
+function squareInPixels(rect, frameWidth, frameHeight) {
+	const side = Math.min(Math.max(rect.w, rect.h), Math.min(frameWidth, frameHeight));
+	const cx = rect.x + rect.w / 2;
+	const cy = rect.y + rect.h / 2;
+	return {
+		x: cx - side / 2,
+		y: cy - side / 2,
+		w: side,
+		h: side
+	};
+}
+/**
+* Cut the window at the frame border — the pre-unification live behaviour,
+* preserved exactly so unsquared crops keep matching the stored index.
+*/
+function truncateToFrame(rect, frameWidth, frameHeight) {
+	const x1 = Math.max(0, rect.x);
+	const y1 = Math.max(0, rect.y);
+	const x2 = Math.min(frameWidth, rect.x + rect.w);
+	const y2 = Math.min(frameHeight, rect.y + rect.h);
+	return {
+		x: x1,
+		y: y1,
+		w: Math.max(0, x2 - x1),
+		h: Math.max(0, y2 - y1)
+	};
+}
+/**
+* Move the window inside the frame keeping its extent — used only for squared
+* windows, where truncating would destroy the squareness that is the point.
+*/
+function slideInsideFrame(rect, frameWidth, frameHeight) {
+	const w = Math.max(0, Math.min(rect.w, frameWidth));
+	const h = Math.max(0, Math.min(rect.h, frameHeight));
+	return {
+		x: Math.min(Math.max(0, rect.x), Math.max(0, frameWidth - w)),
+		y: Math.min(Math.max(0, rect.y), Math.max(0, frameHeight - h)),
+		w,
+		h
+	};
+}
+//#endregion
+//#region src/pipeline/native-lease.ts
+/**
+* THE native-frame **lease** knobs — TTL, RAM budget and demand window for the
+* decode worker's native-resolution frame retention.
+*
+* ## Why they live here and not in the addon that reads them
+*
+* The WRITER is `pipeline-orchestrator` (the cluster-wide settings authority);
+* the READER is a private child process of `addon-pipeline`'s pipeline-runner.
+* Addons never import each other, so a key owned by either side would have to
+* be hand-copied by the other — and a hand-copied key is how a setting silently
+* stops arriving while both sides still look correct. Same reasoning, same
+* placement as `detail-crop.ts` (D52's "one cluster-wide orchestrator setting").
+*
+* ## Why cluster-wide and not per-node
+*
+* The lease is a per-decode-worker RAM window. Its purpose — the late
+* cross-process native crop landing on a full-resolution frame rather than the
+* ≤640 detection fallback — is a property of the PIPELINE, not of a node's
+* hardware: a per-node TTL would mean the same camera produces different crop
+* quality depending on which node the balancer placed it on, and nobody could
+* tell that from the stored media. Node-level RAM pressure is already handled
+* by the per-session budget ceiling, which is itself one of these knobs.
+*
+* ## What each knob costs
+*
+* A retained frame is a full NATIVE-resolution copy in system RAM. With the
+* default pinned-RGB24 lease path (`CAMSTACK_SESSION_PINNED_RGB_CROP`, on):
+* 4K ≈ 24.9 MB/frame, 1080p ≈ 6.2 MB/frame. On the YUV420P path (flag off, and
+* for software-decoded sessions): 4K ≈ 12.4 MB, 1080p ≈ 3.1 MB. Worst-case
+* resident RAM for ONE busy camera ≈ frameBytes × deliveredFps × ttlSeconds,
+* clamped by the budget ceiling. See `docs/design/decode-path.md` → "Lease
+* admission" for what actually gets admitted.
+*/
+/**
+* Store identity of the lease knobs in `pipeline-orchestrator`'s GLOBAL
+* (cluster-wide) settings. Keys are unique across that addon's whole schema, so
+* the reader can walk every section instead of trusting the section id.
+*/
+var NATIVE_LEASE_SECTION_ID = "native-lease";
+var NATIVE_LEASE_TTL_KEY = "nativeLeaseTtlMs";
+var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
+var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
+var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
+/**
+* WHICH delivered frames the decode worker retains a native copy of.
+*
+* - `all` — every frame the worker delivered to the runner. The shipped
+*   behaviour, and the only correct one if something can ask for a crop of a
+*   frame the runner never sent to inference.
+* - `inferred` — only the frames the runner ADMITTED to its detection queue.
+*   A native-crop request always names a `frameId` that rode an inference
+*   result, so that is the only set a request can name. How much it drops is
+*   the two-plane governor's admit ratio and nothing else: measured at ~50% on
+*   this cluster, not the ~80% the design sketch assumed, because the governor
+*   was not throttling as hard as the sketch supposed. Read
+*   `leaseAdmitted`/`leaseOffered` off the metrics line for the camera in front
+*   of you rather than quoting a number from here. The newest delivered frame is
+*   croppable regardless — it is still the worker's reserved slot, not a lease —
+*   which covers the one-frame race between a mark and the supersede that
+*   consumes it.
+*/
+var NativeLeaseAdmissionSchema = z.enum(["all", "inferred"]);
+/**
+* Operator-tunable native-lease settings. Bounds are enforced HERE (not only in
+* the slider) because the value also travels to a forked child process, where a
+* junk number would silently become a 0-length or unbounded retention window.
+*/
+var NativeLeaseSettingsSchema = z.object({
+	/**
+	* How long a retained native frame is served before it counts as a miss.
+	*
+	* Must cover the FULL late-crop horizon: detection inference + the
+	* cross-process inference-result hop to hub post-analysis + tracking + the
+	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
+	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
+	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	*/
+	ttlMs: z.number().int().min(250).max(1e4),
+	/**
+	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
+	*
+	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
+	* which one is actually binding before reasoning from that. At the shipped
+	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
+	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
+	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
+	* change that admits fewer frames buys retention WINDOW at constant RAM
+	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* `0` DISABLES the lease entirely and falls the worker back to the tiny
+	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
+	* to replace).
+	*/
+	budgetMb: z.number().int().min(0).max(4096),
+	/**
+	* Demand window: eager per-frame native retention runs only within this many
+	* ms of the last native-crop request (or of the dial starting).
+	*
+	* `0` means ALWAYS ON — it disables the gate, it does not disable retention.
+	* That is the legacy behaviour that saturated an N100 (24 native-4K downloads
+	* per second on a camera with zero crop demand), so leave it non-zero unless
+	* you are reproducing that.
+	*/
+	activityMs: z.number().int().min(0).max(12e4),
+	/**
+	* Which delivered frames are retained at all — see
+	* {@link NativeLeaseAdmissionSchema}. This is the only knob of the four that
+	* changes WHAT is kept rather than for how long, so it is also the only one
+	* that can turn a crop that used to hit into a miss. The worker counts every
+	* crop request naming a frame it did NOT see marked
+	* (`leaseUnmarkedCrops` on the session-decode metrics line): a non-zero value
+	* there is the signal that some caller names frames outside the inference set
+	* and that this must go back to `all`.
+	*/
+	admission: NativeLeaseAdmissionSchema
+});
+/**
+* The values in force when the operator has set nothing — byte-for-byte the
+* constants the decode worker shipped with as env-var defaults, so making these
+* settings changed no behaviour on the day it landed.
+*/
+var DEFAULT_NATIVE_LEASE_SETTINGS = {
+	ttlMs: 1200,
+	budgetMb: 1024,
+	activityMs: 15e3,
+	admission: "inferred"
+};
+/** Slider bounds for the operator-facing knobs (orchestrator settings UI). */
+var NATIVE_LEASE_TTL_FIELD = {
+	min: 250,
+	max: 1e4,
+	step: 50,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs
+};
+var NATIVE_LEASE_BUDGET_FIELD = {
+	min: 0,
+	max: 4096,
+	step: 64,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb
+};
+var NATIVE_LEASE_ACTIVITY_FIELD = {
+	min: 0,
+	max: 12e4,
+	step: 1e3,
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.activityMs
+};
+/** Select options for the admission knob (orchestrator settings UI). */
+var NATIVE_LEASE_ADMISSION_FIELD = {
+	options: [{
+		value: "all",
+		label: "Every delivered frame"
+	}, {
+		value: "inferred",
+		label: "Only frames sent to inference"
+	}],
+	default: DEFAULT_NATIVE_LEASE_SETTINGS.admission
+};
+/**
+* Parse one knob, reporting `null` for absent, junk, out-of-bounds — AND for a
+* value equal to the shipped default.
+*
+* That last rule is not tidiness, it is the difference between the documented
+* precedence being true and being a lie. `addon-settings.getGlobalSettings`
+* returns a HYDRATED payload, and `hydrateField` fills an unstored field with
+* the schema's own `default` (verified live on the hub: a cluster that has never
+* opened the form still reports `nativeLeaseTtlMs = 1200`). A reader that took
+* that at face value would report all three knobs as "set" on every cluster on
+* the day this shipped, permanently retiring the `CAMSTACK_SESSION_NATIVE_LEASE_*`
+* emergency override that the precedence promises. There is no raw-store read on
+* this cap to distinguish the two, so the default value itself is treated as
+* "the operator has expressed no preference" — which is also what leaving a
+* slider untouched means.
+*
+* The cost is one honest edge: an operator who deliberately selects the default
+* value in order to overrule an env var does not get it. Clear the env var
+* instead; the worker's spawn line names the source, so this is visible rather
+* than mysterious.
+*/
+function readKnob(knob, raw) {
+	const parsed = NativeLeaseSettingsSchema.shape[knob].safeParse(raw);
+	if (!parsed.success) return null;
+	return parsed.data === DEFAULT_NATIVE_LEASE_SETTINGS[knob] ? null : parsed.data;
+}
+/** {@link readKnob} for the one non-numeric knob. Same default-means-unset rule. */
+function readAdmissionKnob(raw) {
+	const parsed = NativeLeaseAdmissionSchema.safeParse(raw);
+	if (!parsed.success) return null;
+	return parsed.data === DEFAULT_NATIVE_LEASE_SETTINGS.admission ? null : parsed.data;
+}
+/**
+* Narrow a FLAT settings record to the knobs the operator set.
+*
+* Per-FIELD parse, deliberately: a junk TTL must not also discard a valid
+* budget. An absent, out-of-bounds or default-valued knob is OMITTED (not
+* clamped, not defaulted) so the caller can still fall through to the env
+* override — clamping here would turn a typo into a value nobody chose. See
+* {@link readKnob} for why the default counts as unset.
+*/
+function readNativeLeaseOverride(config) {
+	const ttlMs = readKnob("ttlMs", config[NATIVE_LEASE_TTL_KEY]);
+	const budgetMb = readKnob("budgetMb", config[NATIVE_LEASE_BUDGET_KEY]);
+	const activityMs = readKnob("activityMs", config[NATIVE_LEASE_ACTIVITY_KEY]);
+	const admission = readAdmissionKnob(config[NATIVE_LEASE_ADMISSION_KEY]);
+	return {
+		...ttlMs === null ? {} : { ttlMs },
+		...budgetMb === null ? {} : { budgetMb },
+		...activityMs === null ? {} : { activityMs },
+		...admission === null ? {} : { admission }
+	};
+}
+function isHydratedField(entry) {
+	return typeof entry === "object" && entry !== null && "key" in entry;
+}
+var LEASE_KEYS = [
+	NATIVE_LEASE_TTL_KEY,
+	NATIVE_LEASE_BUDGET_KEY,
+	NATIVE_LEASE_ACTIVITY_KEY,
+	NATIVE_LEASE_ADMISSION_KEY
+];
+/**
+* Extract the operator's lease overrides from an
+* `addon-settings.getGlobalSettings` payload.
+*
+* Walks EVERY section rather than looking inside {@link NATIVE_LEASE_SECTION_ID}
+* alone: the keys are unique across the addon's schema, and a section rename
+* must not silently revert the whole cluster to the defaults. A `null` payload
+* (addon mid-boot) means "operator set nothing" — the env/default fallback then
+* applies, which is the correct read of "I could not ask".
+*/
+function pickNativeLeaseOverride(view) {
+	if (view === null) return {};
+	const flat = {};
+	for (const section of view.sections) for (const entry of section.fields) {
+		if (!isHydratedField(entry) || typeof entry.key !== "string") continue;
+		if (LEASE_KEYS.includes(entry.key)) flat[entry.key] = entry.value;
+	}
+	return readNativeLeaseOverride(flat);
+}
+//#endregion
 //#region src/types/device-type.ts
 var DEVICE_TYPE_INFO = { ["camera"]: {
 	type: "camera",
@@ -37446,441 +38173,6 @@ function pointInPolygon(point, polygon) {
 	return inside;
 }
 //#endregion
-//#region src/pipeline/detail-crop.ts
-/**
-* THE detail-crop convention — the single derivation of the rectangle a
-* detail/enrichment step (clip-embedding, face-detection, plate-detection…)
-* is fed.
-*
-* ## Why this is one module and not two constants
-*
-* `object-clip` is ONE vector index, and cosine similarity is only meaningful
-* between vectors produced from the same crop convention. Two encode paths
-* write into it — the live detail plane and the embedding rebuild — and they
-* used to derive their crops independently: `DETAIL_CROP_PADDING_RATIO = 0.15`
-* with no squaring on one side, `DEFAULT_CROP_MARGIN = 0.2` with squaring on
-* by default on the other. Every rebuild therefore poured a second, silently
-* incomparable feature space into the index it exists to keep consistent.
-*
-* So the rectangle is derived HERE, once, from ONE convention value. Both
-* paths now reach this function through `pipelineRunner.runDetailSubtree` —
-* the runner is the only process that cuts (see `detail-subtree.ts`), and the
-* convention is a cluster-global `pipeline-orchestrator` setting. There is
-* deliberately no per-node or per-device scope: a per-accelerator crop margin
-* would reintroduce the same split, merely relocated.
-*
-* ## The default IS the live convention
-*
-* {@link DEFAULT_DETAIL_CROP_CONVENTION} reproduces what the live path has
-* been storing (0.15, no squaring). Anything else would invalidate every
-* vector already in the index on the day it shipped. Changing the convention
-* is legitimate — that is what the operator knob is for — but it must be
-* followed by a rebuild, which is now guaranteed to produce crops from this
-* same function.
-*/
-/**
-* Store identity of the convention in `pipeline-orchestrator`'s GLOBAL
-* (cluster-wide) settings.
-*
-* These live here rather than in the orchestrator because the reader is a
-* different addon — the pipeline runner, over the hub-routed `addon-settings`
-* cap. Addons never import each other, so a key owned by the writer would have
-* to be hand-copied by the reader, and a hand-copied key is how a setting
-* silently stops arriving while both sides still look correct.
-*/
-var DETAIL_CROP_SECTION_ID = "detail-crop";
-var DETAIL_CROP_PADDING_KEY = "detailCropPaddingRatio";
-var DETAIL_CROP_SQUARE_KEY = "detailCropSquare";
-/**
-* Operator-tunable crop convention. Single-valued and cluster-wide — see the
-* module docblock for why it cannot be scoped per node or per device.
-*/
-var DetailCropConventionSchema = z.object({
-	/**
-	* Fraction of the box's own size added on EACH side before cutting.
-	*
-	* CLIP is trained on natural images WITH surroundings; a pixel-tight crop
-	* removes exactly the context it is strongest on (a dog cut to its outline
-	* is a dark blob). The right value is an empirical question, which is why it
-	* is a setting: 0 / 0.15 / 0.2 / 0.5 are the interesting points.
-	*/
-	paddingRatio: z.number().min(0).max(4),
-	/**
-	* Square the window (in PIXELS) before cutting.
-	*
-	* CLIP's input is square, so a tall bbox resized straight to NxN is squashed
-	* — a standing person becomes a shape the model never saw. Squaring costs
-	* extra background, which is context the model wants anyway. Off by default
-	* because the live path has never squared and the stored index reflects that.
-	*/
-	square: z.boolean()
-});
-/**
-* The convention in force when nobody has configured one — byte-for-byte the
-* behaviour of the pre-unification LIVE path (`DETAIL_CROP_PADDING_RATIO`).
-*/
-var DEFAULT_DETAIL_CROP_CONVENTION = {
-	paddingRatio: .15,
-	square: false
-};
-/**
-* Narrow a FLAT settings record to the convention.
-*
-* Per-FIELD fallback, deliberately: a junk padding must not also discard a
-* valid squaring choice. An absent or invalid value resolves to
-* {@link DEFAULT_DETAIL_CROP_CONVENTION} — the historical live behaviour —
-* rather than to a clamped number nobody chose, so a bad read can never
-* quietly change what the stored vectors mean.
-*/
-function readDetailCropConvention(config) {
-	const paddingRatio = DetailCropConventionSchema.shape.paddingRatio.safeParse(config[DETAIL_CROP_PADDING_KEY]);
-	const square = DetailCropConventionSchema.shape.square.safeParse(config[DETAIL_CROP_SQUARE_KEY]);
-	return {
-		paddingRatio: paddingRatio.success ? paddingRatio.data : DEFAULT_DETAIL_CROP_CONVENTION.paddingRatio,
-		square: square.success ? square.data : DEFAULT_DETAIL_CROP_CONVENTION.square
-	};
-}
-function isHydratedField$1(entry) {
-	return typeof entry === "object" && entry !== null && "key" in entry;
-}
-/**
-* Extract the convention from an `addon-settings.getGlobalSettings` payload.
-*
-* Walks EVERY section rather than looking inside {@link DETAIL_CROP_SECTION_ID}
-* alone: the keys are unique across the addon's schema, and a section rename
-* must not silently revert the whole cluster to the default. A `null` payload
-* (addon mid-boot) is the default convention.
-*/
-function pickDetailCropConvention(view) {
-	if (view === null) return DEFAULT_DETAIL_CROP_CONVENTION;
-	const flat = {};
-	for (const section of view.sections) for (const entry of section.fields) {
-		if (!isHydratedField$1(entry) || typeof entry.key !== "string") continue;
-		if (entry.key === "detailCropPaddingRatio" || entry.key === "detailCropSquare") flat[entry.key] = entry.value;
-	}
-	return readDetailCropConvention(flat);
-}
-/** Slider bounds for the operator-facing padding knob (orchestrator settings UI). */
-var DETAIL_CROP_PADDING_FIELD = {
-	min: 0,
-	max: 1,
-	step: .05,
-	default: DEFAULT_DETAIL_CROP_CONVENTION.paddingRatio
-};
-/**
-* Derive the crop rectangle for one parent detection.
-*
-* Order: pad by `paddingRatio` of the box's own size → optionally square in
-* pixel space around the padded centre → keep it inside the frame. Pure:
-* always returns a new rect and never mutates `bbox`.
-*
-* Edge handling differs by mode, on purpose:
-*
-* - **unsquared** — TRUNCATED at the frame border, byte-for-byte what the live
-*   path has always done (`padAndClampFrameBbox`). A subject against the edge
-*   gets a slightly smaller window. Changing this would silently reinterpret
-*   every edge-touching vector already in the index.
-* - **squared** — SLID inward instead, because a truncated square is not
-*   square and squaring exists precisely to preserve the aspect the model
-*   sees. It only shrinks when the square is larger than the frame itself.
-*/
-function deriveDetailCropRect(bbox, frameWidth, frameHeight, convention) {
-	const padX = convention.paddingRatio * bbox.w;
-	const padY = convention.paddingRatio * bbox.h;
-	const padded = {
-		x: bbox.x - padX,
-		y: bbox.y - padY,
-		w: bbox.w + 2 * padX,
-		h: bbox.h + 2 * padY
-	};
-	return convention.square ? slideInsideFrame(squareInPixels(padded, frameWidth, frameHeight), frameWidth, frameHeight) : truncateToFrame(padded, frameWidth, frameHeight);
-}
-/**
-* Grow the shorter side to the longer one around the window's centre, bounded
-* by the frame's shorter side — a square larger than the frame cannot exist,
-* and collapsing to the frame's short side is the most that does.
-*/
-function squareInPixels(rect, frameWidth, frameHeight) {
-	const side = Math.min(Math.max(rect.w, rect.h), Math.min(frameWidth, frameHeight));
-	const cx = rect.x + rect.w / 2;
-	const cy = rect.y + rect.h / 2;
-	return {
-		x: cx - side / 2,
-		y: cy - side / 2,
-		w: side,
-		h: side
-	};
-}
-/**
-* Cut the window at the frame border — the pre-unification live behaviour,
-* preserved exactly so unsquared crops keep matching the stored index.
-*/
-function truncateToFrame(rect, frameWidth, frameHeight) {
-	const x1 = Math.max(0, rect.x);
-	const y1 = Math.max(0, rect.y);
-	const x2 = Math.min(frameWidth, rect.x + rect.w);
-	const y2 = Math.min(frameHeight, rect.y + rect.h);
-	return {
-		x: x1,
-		y: y1,
-		w: Math.max(0, x2 - x1),
-		h: Math.max(0, y2 - y1)
-	};
-}
-/**
-* Move the window inside the frame keeping its extent — used only for squared
-* windows, where truncating would destroy the squareness that is the point.
-*/
-function slideInsideFrame(rect, frameWidth, frameHeight) {
-	const w = Math.max(0, Math.min(rect.w, frameWidth));
-	const h = Math.max(0, Math.min(rect.h, frameHeight));
-	return {
-		x: Math.min(Math.max(0, rect.x), Math.max(0, frameWidth - w)),
-		y: Math.min(Math.max(0, rect.y), Math.max(0, frameHeight - h)),
-		w,
-		h
-	};
-}
-//#endregion
-//#region src/pipeline/native-lease.ts
-/**
-* THE native-frame **lease** knobs — TTL, RAM budget and demand window for the
-* decode worker's native-resolution frame retention.
-*
-* ## Why they live here and not in the addon that reads them
-*
-* The WRITER is `pipeline-orchestrator` (the cluster-wide settings authority);
-* the READER is a private child process of `addon-pipeline`'s pipeline-runner.
-* Addons never import each other, so a key owned by either side would have to
-* be hand-copied by the other — and a hand-copied key is how a setting silently
-* stops arriving while both sides still look correct. Same reasoning, same
-* placement as `detail-crop.ts` (D52's "one cluster-wide orchestrator setting").
-*
-* ## Why cluster-wide and not per-node
-*
-* The lease is a per-decode-worker RAM window. Its purpose — the late
-* cross-process native crop landing on a full-resolution frame rather than the
-* ≤640 detection fallback — is a property of the PIPELINE, not of a node's
-* hardware: a per-node TTL would mean the same camera produces different crop
-* quality depending on which node the balancer placed it on, and nobody could
-* tell that from the stored media. Node-level RAM pressure is already handled
-* by the per-session budget ceiling, which is itself one of these knobs.
-*
-* ## What each knob costs
-*
-* A retained frame is a full NATIVE-resolution copy in system RAM. With the
-* default pinned-RGB24 lease path (`CAMSTACK_SESSION_PINNED_RGB_CROP`, on):
-* 4K ≈ 24.9 MB/frame, 1080p ≈ 6.2 MB/frame. On the YUV420P path (flag off, and
-* for software-decoded sessions): 4K ≈ 12.4 MB, 1080p ≈ 3.1 MB. Worst-case
-* resident RAM for ONE busy camera ≈ frameBytes × deliveredFps × ttlSeconds,
-* clamped by the budget ceiling. See `docs/design/decode-path.md` → "Lease
-* admission" for what actually gets admitted.
-*/
-/**
-* Store identity of the lease knobs in `pipeline-orchestrator`'s GLOBAL
-* (cluster-wide) settings. Keys are unique across that addon's whole schema, so
-* the reader can walk every section instead of trusting the section id.
-*/
-var NATIVE_LEASE_SECTION_ID = "native-lease";
-var NATIVE_LEASE_TTL_KEY = "nativeLeaseTtlMs";
-var NATIVE_LEASE_BUDGET_KEY = "nativeLeaseBudgetMb";
-var NATIVE_LEASE_ACTIVITY_KEY = "nativeLeaseActivityMs";
-var NATIVE_LEASE_ADMISSION_KEY = "nativeLeaseAdmission";
-/**
-* WHICH delivered frames the decode worker retains a native copy of.
-*
-* - `all` — every frame the worker delivered to the runner. The shipped
-*   behaviour, and the only correct one if something can ask for a crop of a
-*   frame the runner never sent to inference.
-* - `inferred` — only the frames the runner ADMITTED to its detection queue.
-*   A native-crop request always names a `frameId` that rode an inference
-*   result, so that is the only set a request can name. How much it drops is
-*   the two-plane governor's admit ratio and nothing else: measured at ~50% on
-*   this cluster, not the ~80% the design sketch assumed, because the governor
-*   was not throttling as hard as the sketch supposed. Read
-*   `leaseAdmitted`/`leaseOffered` off the metrics line for the camera in front
-*   of you rather than quoting a number from here. The newest delivered frame is
-*   croppable regardless — it is still the worker's reserved slot, not a lease —
-*   which covers the one-frame race between a mark and the supersede that
-*   consumes it.
-*/
-var NativeLeaseAdmissionSchema = z.enum(["all", "inferred"]);
-/**
-* Operator-tunable native-lease settings. Bounds are enforced HERE (not only in
-* the slider) because the value also travels to a forked child process, where a
-* junk number would silently become a 0-length or unbounded retention window.
-*/
-var NativeLeaseSettingsSchema = z.object({
-	/**
-	* How long a retained native frame is served before it counts as a miss.
-	*
-	* Must cover the FULL late-crop horizon: detection inference + the
-	* cross-process inference-result hop to hub post-analysis + tracking + the
-	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-	* RAM per busy camera grows linearly with no measured hit-rate gain.
-	*/
-	ttlMs: z.number().int().min(250).max(1e4),
-	/**
-	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
-	*
-	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-	* which one is actually binding before reasoning from that. At the shipped
-	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
-	* change that admits fewer frames buys retention WINDOW at constant RAM
-	* rather than giving RAM back — lower this knob if RAM is what you wanted.
-	* `0` DISABLES the lease entirely and falls the worker back to the tiny
-	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
-	* to replace).
-	*/
-	budgetMb: z.number().int().min(0).max(4096),
-	/**
-	* Demand window: eager per-frame native retention runs only within this many
-	* ms of the last native-crop request (or of the dial starting).
-	*
-	* `0` means ALWAYS ON — it disables the gate, it does not disable retention.
-	* That is the legacy behaviour that saturated an N100 (24 native-4K downloads
-	* per second on a camera with zero crop demand), so leave it non-zero unless
-	* you are reproducing that.
-	*/
-	activityMs: z.number().int().min(0).max(12e4),
-	/**
-	* Which delivered frames are retained at all — see
-	* {@link NativeLeaseAdmissionSchema}. This is the only knob of the four that
-	* changes WHAT is kept rather than for how long, so it is also the only one
-	* that can turn a crop that used to hit into a miss. The worker counts every
-	* crop request naming a frame it did NOT see marked
-	* (`leaseUnmarkedCrops` on the session-decode metrics line): a non-zero value
-	* there is the signal that some caller names frames outside the inference set
-	* and that this must go back to `all`.
-	*/
-	admission: NativeLeaseAdmissionSchema
-});
-/**
-* The values in force when the operator has set nothing — byte-for-byte the
-* constants the decode worker shipped with as env-var defaults, so making these
-* settings changed no behaviour on the day it landed.
-*/
-var DEFAULT_NATIVE_LEASE_SETTINGS = {
-	ttlMs: 1200,
-	budgetMb: 1024,
-	activityMs: 15e3,
-	admission: "inferred"
-};
-/** Slider bounds for the operator-facing knobs (orchestrator settings UI). */
-var NATIVE_LEASE_TTL_FIELD = {
-	min: 250,
-	max: 1e4,
-	step: 50,
-	default: DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs
-};
-var NATIVE_LEASE_BUDGET_FIELD = {
-	min: 0,
-	max: 4096,
-	step: 64,
-	default: DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb
-};
-var NATIVE_LEASE_ACTIVITY_FIELD = {
-	min: 0,
-	max: 12e4,
-	step: 1e3,
-	default: DEFAULT_NATIVE_LEASE_SETTINGS.activityMs
-};
-/** Select options for the admission knob (orchestrator settings UI). */
-var NATIVE_LEASE_ADMISSION_FIELD = {
-	options: [{
-		value: "all",
-		label: "Every delivered frame"
-	}, {
-		value: "inferred",
-		label: "Only frames sent to inference"
-	}],
-	default: DEFAULT_NATIVE_LEASE_SETTINGS.admission
-};
-/**
-* Parse one knob, reporting `null` for absent, junk, out-of-bounds — AND for a
-* value equal to the shipped default.
-*
-* That last rule is not tidiness, it is the difference between the documented
-* precedence being true and being a lie. `addon-settings.getGlobalSettings`
-* returns a HYDRATED payload, and `hydrateField` fills an unstored field with
-* the schema's own `default` (verified live on the hub: a cluster that has never
-* opened the form still reports `nativeLeaseTtlMs = 1200`). A reader that took
-* that at face value would report all three knobs as "set" on every cluster on
-* the day this shipped, permanently retiring the `CAMSTACK_SESSION_NATIVE_LEASE_*`
-* emergency override that the precedence promises. There is no raw-store read on
-* this cap to distinguish the two, so the default value itself is treated as
-* "the operator has expressed no preference" — which is also what leaving a
-* slider untouched means.
-*
-* The cost is one honest edge: an operator who deliberately selects the default
-* value in order to overrule an env var does not get it. Clear the env var
-* instead; the worker's spawn line names the source, so this is visible rather
-* than mysterious.
-*/
-function readKnob(knob, raw) {
-	const parsed = NativeLeaseSettingsSchema.shape[knob].safeParse(raw);
-	if (!parsed.success) return null;
-	return parsed.data === DEFAULT_NATIVE_LEASE_SETTINGS[knob] ? null : parsed.data;
-}
-/** {@link readKnob} for the one non-numeric knob. Same default-means-unset rule. */
-function readAdmissionKnob(raw) {
-	const parsed = NativeLeaseAdmissionSchema.safeParse(raw);
-	if (!parsed.success) return null;
-	return parsed.data === DEFAULT_NATIVE_LEASE_SETTINGS.admission ? null : parsed.data;
-}
-/**
-* Narrow a FLAT settings record to the knobs the operator set.
-*
-* Per-FIELD parse, deliberately: a junk TTL must not also discard a valid
-* budget. An absent, out-of-bounds or default-valued knob is OMITTED (not
-* clamped, not defaulted) so the caller can still fall through to the env
-* override — clamping here would turn a typo into a value nobody chose. See
-* {@link readKnob} for why the default counts as unset.
-*/
-function readNativeLeaseOverride(config) {
-	const ttlMs = readKnob("ttlMs", config[NATIVE_LEASE_TTL_KEY]);
-	const budgetMb = readKnob("budgetMb", config[NATIVE_LEASE_BUDGET_KEY]);
-	const activityMs = readKnob("activityMs", config[NATIVE_LEASE_ACTIVITY_KEY]);
-	const admission = readAdmissionKnob(config[NATIVE_LEASE_ADMISSION_KEY]);
-	return {
-		...ttlMs === null ? {} : { ttlMs },
-		...budgetMb === null ? {} : { budgetMb },
-		...activityMs === null ? {} : { activityMs },
-		...admission === null ? {} : { admission }
-	};
-}
-function isHydratedField(entry) {
-	return typeof entry === "object" && entry !== null && "key" in entry;
-}
-var LEASE_KEYS = [
-	NATIVE_LEASE_TTL_KEY,
-	NATIVE_LEASE_BUDGET_KEY,
-	NATIVE_LEASE_ACTIVITY_KEY,
-	NATIVE_LEASE_ADMISSION_KEY
-];
-/**
-* Extract the operator's lease overrides from an
-* `addon-settings.getGlobalSettings` payload.
-*
-* Walks EVERY section rather than looking inside {@link NATIVE_LEASE_SECTION_ID}
-* alone: the keys are unique across the addon's schema, and a section rename
-* must not silently revert the whole cluster to the defaults. A `null` payload
-* (addon mid-boot) means "operator set nothing" — the env/default fallback then
-* applies, which is the correct read of "I could not ask".
-*/
-function pickNativeLeaseOverride(view) {
-	if (view === null) return {};
-	const flat = {};
-	for (const section of view.sections) for (const entry of section.fields) {
-		if (!isHydratedField(entry) || typeof entry.key !== "string") continue;
-		if (LEASE_KEYS.includes(entry.key)) flat[entry.key] = entry.value;
-	}
-	return readNativeLeaseOverride(flat);
-}
-//#endregion
 //#region src/helpers/bind-addon-actions.ts
 /**
 * Bind an addon's custom-action catalog to its tRPC surface, returning a
@@ -38132,4 +38424,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { ACCESSORY_LABEL, ALEXA_EGRESS_PROFILE, ALL_CAPABILITY_DEFINITIONS, APPLE_SA_TO_MACRO, AUDIO_ANALYSIS_CAP_NAME, AUDIO_BACKEND_CHOICES, AUDIO_MACRO_LABELS, AUDIO_PRESETS, AccessoriesStatusSchema, AccessoryKind, AddBrokerInputSchema, AddonAutoUpdateSchema, AddonListItemSchema, AddonPageDeclarationSchema, AddonPageInfoSchema, AdoptInputSchema as AdoptionAdoptInputSchema, AdoptResultSchema as AdoptionAdoptResultSchema, AdoptionFilterSchema, GetCandidateInputSchema as AdoptionGetCandidateInputSchema, ListCandidatesInputSchema as AdoptionListCandidatesInputSchema, ListCandidatesOutputSchema as AdoptionListCandidatesOutputSchema, ReleaseInputSchema as AdoptionReleaseInputSchema, AdoptionStatusSchema, AgentLoadSummarySchema, AirQualitySensorStatusSchema, AlarmArmModeSchema, AlarmPanelStatusSchema, AlarmStateSchema, AlertSchema, AlertSeveritySchema, AlertSourceSchema, AlertStatusSchema, AmbientLightSensorStatusSchema, ApiKeyRecordSchema, ApiKeySummarySchema, ArchiveEntrySchema, ArchiveManifestSchema, AttachmentMediaTypeSchema, AttachmentSchema, AudioAnalysisResultSchema, AudioAnalysisSettingsSchema, AudioChunkInputSchema, AudioClassSummarySchema, AudioClassificationLabelSchema, AudioClassificationResultSchema, AudioCodecInfoSchema, AudioDecodeSessionConfigSchema, AudioEncodeSchema, AudioEncodeSessionConfigSchema, AudioEncodedChunkSchema, AudioEventSchema, AudioLevelSchema, AudioMetricsHistoryPointSchema, AudioMetricsHistorySchema, AudioMetricsSnapshotSchema, AudioPcmChunkSchema, AuthResultSchema, AutoUpdateSettingsSchema, AutomationControlStatusSchema, AvailableIntegrationTypeSchema, BACKEND_TO_FORMAT, BASE_LIVE_EGRESS_PROFILE, BATTERY_DEVICE_PROFILE, BacklightModeSchema, BackupDestinationInfoSchema, BackupEntrySchema, BaseAddon, BaseDevice, BaseDeviceProvider, BatteryStatusSchema, BinaryStatusSchema, BoundingBoxSchema, BrightnessStatusSchema, AddInputSchema as BrokerAddInputSchema, BrokerAudioClientSchema, BrokerClientsSchema, BrokerConnectionDetailsSchema, BrokerConsumerAttributionSchema, BrokerConsumerKindSchema, BrokerDecodedClientSchema, BrokerEncodedClientSchema, GetStateInputSchema as BrokerGetStateInputSchema, BrokerInfoSchema, BrokerProviderInfoSchema, PublishInputSchema as BrokerPublishInputSchema, RegistryStatusSchema as BrokerRegistryStatusSchema, BrokerRtspClientSchema, BrokerStatsSchema, BrokerStatusEnum, BrokerStatusSchema, SubscribeInputSchema as BrokerSubscribeInputSchema, SubscribeResultSchema as BrokerSubscribeResultSchema, TestConnectionResultSchema as BrokerTestConnectionResultSchema, UnsubscribeInputSchema as BrokerUnsubscribeInputSchema, CAMERA_SWITCH_CATALOG, CAMERA_SWITCH_ORDER, CAM_PROFILE_ORDER, CAPABILITY_NAMES, CAPABILITY_ROUTER_KEYS, CAP_NAMES_WITH_STATUS, CAP_NODE_PIN_CONTEXT_KEY, CAP_PROVIDER_KIND_MAP, COCO_80_LABELS, COCO_TO_MACRO, CamProfileSchema, CamStreamDescriptorSchema, CamStreamKindSchema, CamStreamResolutionSchema, CameraAssignmentStatusSchema, CameraAudioStatusSchema, CameraBrokerProfileSchema, CameraBrokerStatusSchema, CameraCredentialsSchema, CameraCredentialsStatusSchema, CameraDecoderShmSchema, CameraDecoderStatusSchema, CameraDetectionPhaseSchema, CameraDetectionProvisioningSchema, CameraDetectionProvisioningStateSchema, CameraDetectionStatusSchema, CameraMetricsSchema, CameraMetricsWithDeviceIdSchema, CameraMotionStatusSchema, CameraRecordingModeSchema, CameraRecordingStatusSchema, CameraSourceStatusSchema, CameraSourceStreamSchema, CameraStatusSchema, CameraStreamSchema, CameraSwitchAuthoritySchema, CameraSwitchGroupSchema, CameraSwitchIdSchema, CameraSwitchSchema, CameraSwitchUnavailableReasonSchema, CandidateQueryFilterSchema, CapScopeSchema, CapabilityBindingsSchema, CarbonMonoxideStatusSchema, ChargingStatus, ClientNetworkStatsSchema, ClimateControlStatusSchema, ClipPlaybackSchema, ClipSchema, ClusterAddonNodeDeploymentSchema, ClusterAddonStatusEntrySchema, CollectionColumnSchema, CollectionIndexSchema, ColorStatusSchema, ConfigEntrySchema, ConfigSectionWithValuesSchema, ConfigTabDeclarationSchema, ConnectivityStatusSchema, ConsumableItemSchema, ConsumablesStatusSchema, ContactStatusSchema, ControlKindSchema, ControlStatusSchema, ConvertArtifactSchema, ConvertResultSchema, ConvertTargetSchema, CoreBlockCompileResultSchema, CoreBlockInputSchema, CoreBlockPlacementSchema, CoreBlockSchema, CoreBlockStatusSchema, CoverStateSchema, CoverStatusSchema, CreateApiKeyInputSchema, CreateApiKeyResultSchema, CreateIntegrationInputSchema, CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, CreateUserInputSchema, CustomActionInputSchema, CustomModelDescriptorSchema, DATAPLANE_SECRET_HEADER, DEFAULT_ADDON_PLACEMENT, DEFAULT_AUDIO_ANALYZER_CONFIG, DEFAULT_DECODER_HWACCEL_CONFIG, DEFAULT_DETAIL_CROP_CONVENTION, DEFAULT_EVENT_COLOR, DEFAULT_FEATURES, DEFAULT_NATIVE_LEASE_SETTINGS, DEFAULT_RETENTION, DEFAULT_SCRUB_THUMBNAIL_PRESET, DETAIL_CROP_PADDING_FIELD, DETAIL_CROP_PADDING_KEY, DETAIL_CROP_SECTION_ID, DETAIL_CROP_SQUARE_KEY, DETECTION_PIPELINE_CAP_NAME, DEVICE_BACKEND_TO_FORMAT, DEVICE_CAP_NAMES, DEVICE_PROFILES, DEVICE_SCOPED_CAPS, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATE_READERS, DEVICE_STATUS_METHOD, DEVICE_TYPE_CONTROL_KIND, DEVICE_TYPE_INFO, EngineInfoSchema as DataStoreEngineInfoSchema, DayNightModeSchema, DayNightOptionsSchema, DayNightSettingsPatchSchema, DayNightStatusSchema, DecodedAudioChunkSchema, DecodedFrameSchema, DecoderSessionConfigSchema, DecoderStatsSchema, DeleteIntegrationResultSchema, DetailCropConventionSchema, DetectionSourceSchema, DeviceCodeSeveritySchema, DeviceConfig, DeviceDiscoveryStatusSchema, ExposeInputSchema as DeviceExportExposeInputSchema, DeviceExportStatusSchema, UnexposeInputSchema as DeviceExportUnexposeInputSchema, DeviceFeature, DeviceInfoSchema, DeviceLinkModeSchema, DeviceNetworkStatsSchema, DeviceRole, DeviceRuntimeState, DeviceStatusSchema, DeviceType, DiscoveredChildDeviceSchema, DiscoveredChildStatusSchema, DiscoveredDeviceSchema, DiscoveredTargetSchema, DisposerChain, DoorbellPressEventSchema, DoorbellStatusSchema, EVENTFUL_CAP_NAMES, EVENT_KIND_BY_CAP, EVENT_PAD_MS, EVENT_TAXONOMY, EXPRESSION_BUILTINS, EXPRESSION_BUILTIN_NAMES, EXPRESSION_COMPILE_CACHE_CAPACITY, EXPRESSION_IDENTIFIER_RE, EXPRESSION_INJECTED_NOW, EgressEncodeSchema, EgressRateControlSchema, EgressTranscodeRequestSchema, EgressTranscodeSchema, ElementConfigStore, EmbeddingInfoSchema, EmbeddingResultSchema, EncodeProfileSchema, EncodedPacketSchema, EnrichedWidgetMetadataSchema, EnumSensorDateTimeFormatSchema, EnumSensorStatusSchema, EventCategory, EventEmitterStatusSchema, EventFireSchema, EventItemSchema, EventKindCategorySchema, EventKindDescriptorSchema, EventKindIconSchema, EventKindSchema, EventKindsForDeviceSchema, EventMediaArtifactSchema, EventMediaCoverageSchema, EventMediaKindSchema, EventMediaProductionSchema, EventSourceType, ExportDownloadSchema, ExportOptionsSchema, ExportRecordSchema, ExportSetupFieldSchema, ExportSetupSchema, ExportSpeedSchema, ExportStateSchema, ExportTimelapseSchema, ExposedDeviceSchema, ExposureModeSchema, ExpressionEvalError, ExpressionParseError, FanControlStatusSchema, FanDirectionSchema, FeatureManifestSchema, FeatureProbeStatusSchema, FloodStatusSchema, Fmp4BoxSplitter, FrameHandleFormatSchema, FrameHandleSchema, FrameInputSchema, GasStatusSchema, GetStreamWithCodecInputSchema, GlobalMetricsSchema, HAP_AUDIO_BASE, HAP_AUDIO_BITRATE_KBPS, HAP_AUDIO_VBV_KBITS, HAP_KEYFRAME_INTERVAL_SEC, HF_BASE_URL, HF_REPO, HWACCEL_OPTIONS, HealthStatusSchema, HistoryPointSchema, HistoryResolutionEnum, HumidifierStatusSchema, HumiditySensorStatusSchema, HvacModeSchema, ImageContractSchema, ImageContractStateSchema, ImageRotateSchema, ImageSettingsOptionsSchema, ImageSettingsPatchSchema, ImageSettingsStatusSchema, ImageStatusSchema, IngestOwnerSchema, InstalledPackageSchema, IntegrationLiteSchema, IntegrationWithStateSchema, IntercomAbilitySchema, IntercomStatusSchema, KNOWN_CAP_NAMES, KeyEventSchema, LOG_LEVEL_RANK, LabelAttributionSchema, LabelDefinitionSchema, LabelTierSchema, LawnMowerActivitySchema, LawnMowerControlStatusSchema, LinkedDeviceSchema, LlmDefaultSchema, LlmDefaultSelectorSchema, LlmErrorCodeSchema, LlmGenerateBaseInputSchema, LlmGenerateErrSchema, LlmGenerateOkSchema, LlmGenerateResultSchema, LlmImageSchema, LlmNodeModelSchema, LlmProfileKindDescriptorSchema, LlmProfileKindSchema, LlmProfileSchema, LlmRuntimeCompleteInputSchema, LlmRuntimeDiskUsageSchema, LlmRuntimeNodeSchema, LlmRuntimeStatusSchema, LlmUsageRollupSchema, LlmUsageSchema, LocateSegmentResultSchema, LocationStatSchema, LockControlStatusSchema, LockStateSchema, LogEntrySchema, LogLevelSchema, LogStreamEntrySchema, LoginMethodContributionSchema, LoginStageEnum, MACRO_LABELS, MAX_EXPRESSION_AST_NODES, MAX_EXPRESSION_BINDINGS, MAX_EXPRESSION_CALL_ARGS, MAX_EXPRESSION_EVAL_STEPS, MAX_EXPRESSION_SOURCE_LENGTH, METHOD_ACCESS_MAP, MODEL_FORMATS, MOTION_TRIGGER_FEATURE, ManagedModelCatalogEntrySchema, ManagedModelRefSchema, ManagedRuntimeConfigSchema, MaskGridDimsSchema, MaskGridShapeSchema, MaskLineShapeSchema, MaskPointSchema, MaskPolygonShapeSchema, MaskPolygonVerticesSchema, MaskRectShapeSchema, MaskShapeKindSchema, MaskShapeSchema, MediaFileInfoSchema, MediaFileSchema, MediaPlayerRepeatSchema, MediaPlayerStateSchema, MediaPlayerStatusSchema, MeshPeerSchema, MeshStatusSchema, MethodAccessSchema, ModelCatalogEntrySchema, ModelConvertInputSchema, ModelConvertMetadataSchema, ModelDistributeInputSchema, ModelDistributeResultSchema, ModelExtraFileSchema, ModelFormatEntrySchema, ModelFormatsSchema, ModelSubstitutionSchema, ModelVariantGroupSchema, MotionAnalysisResultSchema, MotionEventSchema, MotionOnMotionChangedDataSchema, MotionRegionSchema, MotionSourceEnum, MotionSourcesSchema, MotionStatusSchema, MotionTriggerRuntimeStateSchema, MotionTriggerStatusSchema, MotionZoneOptionsSchema, MotionZonePatchSchema, MotionZoneRegionSchema, MotionZoneStatusSchema, StatusSchema as MqttBrokerStatusSchema, MutationFilterSchema, NATIVE_LEASE_ACTIVITY_FIELD, NATIVE_LEASE_ACTIVITY_KEY, NATIVE_LEASE_ADMISSION_FIELD, NATIVE_LEASE_ADMISSION_KEY, NATIVE_LEASE_BUDGET_FIELD, NATIVE_LEASE_BUDGET_KEY, NATIVE_LEASE_SECTION_ID, NATIVE_LEASE_TTL_FIELD, NATIVE_LEASE_TTL_KEY, NC_BASE_CONDITION_KEYS, NC_CONDITION_CATALOG, NC_HISTORY_LIMIT_DEFAULT, NC_HISTORY_LIMIT_MAX, NC_MAX_PER_TRACK_IMMEDIATE, NC_SNOOZE_MAX_MINUTES, NC_TAXONOMY, NativeCropBboxSchema, NativeCropRefSchema, NativeCropResultSchema, NativeDetectionSchema, NativeLeaseAdmissionSchema, NativeLeaseSettingsSchema, NativeObjectClassEnum, NativeObjectDetectionRuntimeStateSchema, NativeObjectDetectionStatusSchema, NcAlarmConfigSchema, NcAlarmModeCoverageSchema, NcAlarmSettingsPatchSchema, NcAlarmSettingsSchema, NcConditionDescriptorSchema, NcConditionsSchema, NcCrossingSchema, NcDeliverySchema, NcDeviceStateConditionSchema, NcHistoryEntrySchema, NcHistoryFilterSchema, NcHistoryRecordKindSchema, NcHistoryStatusSchema, NcHistorySubjectSchema, NcMediaFrameSchema, NcMediaPolicySchema, NcOccupancyConditionSchema, NcPlateMatcherSchema, NcRuleActionSchema, NcRuleActionSequenceSchema, NcRuleActionsSchema, NcRuleInputSchema, NcRuleNotificationButtonSchema, NcRulePatchSchema, NcRuleSchema, NcRuleTargetSchema, NcScheduleSchema, NcScheduleWindowSchema, NcSnoozeInputSchema, NcSnoozeSchema, NcSnoozeScopeSchema, NcSnoozeSuppressedSchema, NcTaxonomyEntrySchema, NcTaxonomySchema, NcTestResultSchema, NcThrottleGranularitySchema, NcThrottleSchema, NcZoneConditionSchema, NetworkAccessStatusSchema, NetworkAddressSchema, NetworkEndpointSchema, NotificationActionIconSchema, NotificationActionSchema, NotificationFormatSchema, NotificationSchema, NotifierStatusSchema, NumericSensorStatusSchema, OPS_LOG_DEFAULT_LIMIT, OPS_LOG_RING_DEFAULT_MAX, OauthIntegrationDescriptorSchema, ObjectEventSchema, OpsLogDomainSchema, OpsLogEntrySchema, OpsLogOpSchema, OpsLogQueryInputSchema, OpsLogReasonSchema, OrchestratorMetricsSchema, OsdOverlayKindEnum, OsdOverlayPatchSchema, OsdOverlaySchema, OsdPositionEnum, OsdRenderOutcomeEnum, OsdRenderResultSchema, OsdSlotBindingSchema, OsdSlotViewSchema, OsdSourceOptionSchema, OsdSourceSchema, OsdSourceValueTypeEnum, OsdStatusSchema, PET_FEEDER_MANUAL_FEED_MAX, PET_FEEDER_MANUAL_FEED_MIN, PIPELINE_FLOW_CAPABILITY_NAMES, PIPELINE_OWNER_CAPABILITY_NAMES, PRIVACY_MASK_CAP_NAME, PROVIDER_KIND_CAP_NAMES, PYTHON_SCRIPT, PackageUpdateSchema, PackageVersionInfoSchema, PasskeyLoginMethodSchema, PasskeySummarySchema, PcmSampleFormatSchema, PerScopeBreakdownSchema, PetFeederStatusSchema, PickStreamPreferencesSchema, PickStreamRequirementsSchema, PickedCamStreamSchema, PipelineAssignmentSchema, PipelineDefaultStepSchema, PipelineEngineChoiceSchema, PipelineRunResultBridge, PipelineStepInputSchema, PipelineValidationIssueSchema, PipelineValidationResultSchema, PlaceholderReasonSchema, PolygonPointSchema, PowerMeterStatusSchema, PresenceStatusSchema, PressureSensorStatusSchema, PrivacyMaskOptionsSchema, PrivacyMaskPatchSchema, PrivacyMaskRegionSchema, PrivacyMaskShapeSchema, PrivacyMaskStatusSchema, ProfileRtspEntrySchema, ProfileSlotSchema, ProfileSlotStatusSchema, ProviderStatusSchema, PtzAutotrackRuntimeStateSchema, PtzAutotrackSettingsSchema, PtzAutotrackStatusSchema, PtzAutotrackTargetOptionSchema, PtzMoveCommandSchema, PtzOptionsSchema, PtzPositionSchema, PtzPresetSchema, PtzStatusSchema, QueryFilterSchema, RATE_CONTROL_RELAXED, RATE_CONTROL_TIGHT, REACHABILITY_FAILURES_TO_OFFLINE, REACHABILITY_POLL_INTERVAL_MS, REACHABILITY_PROBE_TIMEOUT_MS, RECOGNITION_TYPES, RESERVED_BINDING_NAMES, RUNTIME_DEFAULTS, RUNTIME_TO_FORMAT, RawStateResultSchema, ReadGopBytesResultSchema, ReadSegmentBytesResultSchema, ReadinessRegistry, ReadinessTimeoutError, RecentTracksPageSchema, RecentTracksQueryInput, RecordingAvailabilitySchema, RecordingBandModeSchema, RecordingBandSchema, RecordingBandTriggersSchema, RecordingConfigSchema, RecordingDaysSchema, RecordingDeviceUsageSchema, RecordingLocationUsageSchema, RecordingManifestSchema, RecordingRangeSchema, RecordingRetentionSchema, RecordingStatusSchema, RecordingStorageModeSchema, RecordingStorageUsageSchema, RecordingTriggersSchema, RecordingWeekdaySchema, RedirectLoginMethodSchema, RelocateFootageInputSchema, RelocateJobSchema, RelocateJobStateSchema, RelocateMediaInputSchema, RenderedAsSchema, ReportMotionInputSchema, RetrainAnnotationDraftSchema, RetrainAnnotationKindSchema, RetrainAnnotationSchema, RetrainAnnotationSourceSchema, RetrainAssistResultSchema, RetrainAssistSubjectSchema, RetrainCopyRefusalSchema, RetrainFrameCandidateSchema, RetrainFrameListSchema, RetrainFrameSchema, RetrainFrameSelectionSchema, RetrainMacroClassSchema, RetrainStatusSchema, RetrainTrackSchema, RetrainTransitionResultSchema, RingBuffer, RtpSourceSchema, RtspRestreamEntrySchema, RunnerCameraConfigSchema, RunnerCameraDeviceUIFields, RunnerFrameSourceSchema, RunnerInferenceDeviceSchema, RunnerLocalLoadSchema, RunnerLocalMetricsSchema, SCOPE_PRESETS, SCRUB_THUMBNAIL_PRESETS, SCRUB_THUMBNAIL_PRESET_LABELS, SCRUB_THUMBNAIL_PRESET_ORDER, SENSOR_FEATURES, SENSOR_MAP, SOURCE_INFO_METADATA_KEY, STREAM_PROFILE_META, STREAM_QUALITY_LABELS, SUB_DETECTION_TYPES, SYSTEM_CAP_NAMES, SceneCheckSchema, SceneConditionSchema, SceneMonitorSchema, SceneMonitorStateSchema, SceneMonitorStatusSchema, SceneReferenceSchema, ScopedTokenSchema, ScopedTokenSummarySchema, ScoredObjectEventSchema, ScriptRunnerStatusSchema, ScrubThumbnailPresetSchema, SearchResultSchema, SendEmailInputSchema, SendEmailResultSchema, SendResultSchema, SensorEventSchema, ServerBootModeSchema, ServerPackageStatusSchema, ServerRollbackInfoSchema, ServerUpdateActionResultSchema, ServerUpdateCheckResultSchema, ServerUpdateStateSchema, SettingsPatchSchema, SettingsRecordSchema, SettingsSchemaWithValuesSchema, SettingsUpdateResultSchema, ShmRingStatsSchema, SmokeStatusSchema, SmtpStatusSchema, SnapshotImageSchema, SourceInfoSchema, SpatialDetectionSchema, SsoBridgeClaimsSchema, StartEmbeddedInputSchema, StationaryObjectSchema, AbortUploadInputSchema as StorageAbortUploadInputSchema, BeginDownloadInputSchema as StorageBeginDownloadInputSchema, BeginDownloadResultSchema as StorageBeginDownloadResultSchema, BeginUploadInputSchema as StorageBeginUploadInputSchema, BeginUploadResultSchema as StorageBeginUploadResultSchema, EndDownloadInputSchema as StorageEndDownloadInputSchema, FinalizeUploadInputSchema as StorageFinalizeUploadInputSchema, StorageLocationDeclarationSchema, StorageLocationRefSchema, StorageLocationSchema, StorageLocationTypeSchema, ProviderInfoSchema as StorageProviderInfoSchema, ReadChunkInputSchema as StorageReadChunkInputSchema, TestLocationResultSchema as StorageTestLocationResultSchema, WriteChunkInputSchema as StorageWriteChunkInputSchema, StreamCodecSchema, StreamFormatSchema, StreamNetworkStatsSchema, StreamParamsOptionsSchema, StreamParamsStatusSchema, StreamProfileConfigSchema, StreamProfileOptionsSchema, StreamProfilePatchSchema, StreamProfileSchema, StreamSourceEntrySchema, StreamSourceSchema, SubscribeAudioChunksInputSchema, SubscribeAudioChunksResultSchema, SubscribeFramesInputSchema, SubscribeFramesResultSchema, SwitchStatusSchema, SystemMetricsSchema, SystemMirror, TAXONOMY_COLORS, TIMEZONES, TRANSCODE_DOWN_MAX_BITRATE_KBPS, TRANSCODE_DOWN_MAX_HEIGHT, TamperStatusSchema, TankStatusSchema, TargetKindCapsSchema, TargetKindLevelSchema, TargetKindSchema, TargetSchema, TemperatureSensorStatusSchema, TerminalProfileInfoSchema, TerminalSessionInfoSchema, TestConnectionResultSchema$1 as TestConnectionResultSchema, TestResultSchema, TimelapseRuleInputSchema, TimelapseRulePatchSchema, TimelapseRuleSchema, TimelapseTemplateSchema, ToastSchema, TokenScopeSchema, TopologyNodeSchema, TopologyProcessSchema, TopologyServiceSchema, TrackCascadeCountsSchema, TrackEnvelopeSchema, TrackFlagsPatchSchema, TrackFlagsSchema, TrackProjectionSchema, TrackSchema, TrackSourceSchema, TrackStateSchema, TrackZoneFilterSchema, TrackedDetectionSchema, TrainingExportDeviceTotalsSchema, TrainingExportSummarySchema, TurnServerSchema, UNIT_TABLE, BrokerInfoSchema$1 as UnifiedBrokerInfoSchema, UnitConversionError, UpdateIntegrationInputSchema, UpdateStatusSchema, UpdateUserInputSchema, UserRecordSchema, UserSummarySchema, VacuumControlStatusSchema, VacuumStateSchema, ValveStateSchema, ValveStatusSchema, VectorDeclareIndexInputSchema, VectorDeleteByFilterInputSchema, VectorDeleteInputSchema, VectorDeleteResultSchema, VectorFilterSchema, VectorGetInputSchema, VectorGetResultSchema, VectorItemSchema, VectorMatchSchema, VectorMetadataSchema, VectorMetricSchema, VectorQueryInputSchema, VectorQueryResultSchema, VectorStatsInputSchema, VectorStatsResultSchema, VectorUpsertInputSchema, VectorUpsertResultSchema, VibrationStatusSchema, VideoEncodeSchema, WEBRTC_EGRESS_PROFILE, WELL_KNOWN_TABS, WELL_KNOWN_TAB_MAP, WaterHeaterStatusSchema, WeatherStatusSchema, WebrtcStreamChoiceSchema, WebrtcStreamTargetSchema, WhiteBalanceModeSchema, WidgetHostEnum, WidgetLoginMethodSchema, WidgetMetadataSchema, WidgetRemoteSchema, WidgetSizeEnum, YAMNET_TO_MACRO, ZoneCrossingDirectionSchema, ZoneCrossingSchema, ZoneKindEnum, ZoneRuleModeEnum, ZoneRuleSchema, ZoneRuleStageEnum, ZoneRulesArraySchema, ZoneSchema, ZoneScopeBreakdownSchema, accessoriesCapability, accessoryStableId, addonPagesCapability, addonPagesSourceCapability, addonRoutesCapability, addonSettingsCapability, addonWidgetsCapability, addonWidgetsSourceCapability, addonsCapability, adminUiCapability, airQualitySensorCapability, alarmPanelCapability, alertsCapability, ambientLightSensorCapability, applyTransform, asBoolean, asJsonArray, asJsonObject, asNumber, asString, audioAnalysisCapability, audioAnalyzerCapability, audioCodecCapability, audioMetricsCapability, audioPlanFromEncodeProfile, authProviderCapability, autoAssignProfiles, automationControlCapability, backupCapability, bareAddonId, batteryCapability, bestLocationMatch, binaryCapability, bindAddonActions, brightnessCapability, brokerCapability, buildAddonRouteProvider, buildAudioArgs, buildEventKindDescriptor, buildFfmpegArgs, buildInputArgs, buildModelVariantGroups, buildNcTaxonomy, buildStreamParamsConfigSchema, buildVideoArgs, buttonCapability, cameraCredentialsCapability, cameraPipelineConfigCapability, cameraStreamsCapability, canConvertUnit, canonicalEgressPlan, carbonMonoxideCapability, cellsToRects, classifyStream, classifyStreams, climateControlCapability, collectHydratedFieldEntries, collectHydratedFieldValues, colorCapability, colorForKind, compileExpression, compileExpressionSafe, connectivityCapability, consumablesCapability, contactCapability, controlCapability, convertUnit, coreBlocksCapability, cosineSimilarity, coverCapability, createDeviceProxy, createDurableState, createEvent, createExpressionScope, createHwAccelCache, createLazyTrpcSource, createMirrorSource, createRuntimeStateBridge, createSliceHandle, createSystemProxy, customAction, customModelRegistryCapability, dataStoreProviderCapability, dayNightCapability, decodeVectorBase64, decoderCapability, defaultDeviceFor, defineCustomActions, deriveCameraSwitches, deriveDetailCropRect, deriveRecordingMode, describeModelVariant, detectionPipelineCapability, deviceAdoptionCapability, deviceBackendToFormat, deviceCustomAction, deviceDiscoveryCapability, deviceExportCapability, deviceManagerCapability, deviceMatchesProfile, deviceOpsCapability, deviceProviderCapability, deviceStateCapability, deviceStatusCapability, doorbellCapability, egressTranscodeSharingKey, egressTransportFromRequest, embeddingEncoderCapability, emitDownForOwnedCaps, emitReadiness, encodeProfileFromStreamShape, encodeVectorBase64, enumSensorCapability, enumerateInferenceDevices, enumerateItemArrayFields, enumerateSchemaFields, errMsg, evaluateAst, evaluateLinkExpression, evaluateZoneRules, event, eventEmitterCapability, eventsCapability, expandCapMethods, extractNestedAddonId, extractSourceInfoFromMetadata, faceGalleryCapability, fanControlCapability, featureProbeCapability, filesystemBrowseCapability, findTimezone, floodCapability, formatForBackend, formatForRuntime, gasCapability, getAudioMacroClassIds, getByPath, getCapsByProviderKind, getTaxonomyEntry, hasMotionTrigger, hfModelUrl, htmlToText, humidifierCapability, humiditySensorCapability, hydrateSchema, imageCapability, imageSettingsCapability, integrationsCapability, intercomCapability, invocationFromEncodeProfile, isAgentOnlyPlacement, isArrayOutputSchema, isBaseConditionKey, isCollectionArrayMethod, isDeployableToAgent, isDeviceConfigCap, isDeviceScopedCap, isEvent, isNode, isObjectInput, isSameAddonId, isScheduleActive, isSoftwareDecode, isVoidInput, jobKindSchema, kebabToCamel, knownValues, lawnMowerControlCapability, lifecycleJobSchema, lifecycleJobScopeSchema, lifecycleJobStateSchema, lifecycleTaskSchema, llmCapability, llmRuntimeCapability, localNetworkCapability, locationSimilarity, lockControlCapability, logBannerArgs, logDestinationCapability, logLevelAtMost, loginMethodCapability, looseSchema, makeProfileBrokerId, makeSourceBrokerId, mapAudioLabelToMacro, markdownToHtmlLite, markdownToText, maskUrlCredentials, mediaPlayerCapability, mergeSourceInfo, meshNetworkCapability, method, metricsProviderCapability, modelConvertCapability, modelDistributorCapability, modelFormatForRuntime, motionCapability, motionDetectionCapability, motionTriggerCapability, motionZonesCapability, mqttBrokerCapability, nativeObjectDetectionCapability, networkAccessCapability, networkQualityCapability, nodePin, nodesCapability, normalizeAddonInitResult, normalizeUnit, notificationOutputCapability, notificationRulesCapability, notifierCapability, numericSensorCapability, oauthIntegrationCapability, objectInputDeclaresAddonId, osdCapability, osdManagerCapability, parseCameraStreamConfig, parseExpression, parseJsonArray, parseJsonObject, parseJsonUnknown, parseProfileBrokerId, parseStreamParamsFormPatch, petFeederCapability, pickAccessoryControl, pickDetailCropConvention, pickNativeLeaseOverride, pickPreferredRtspEntry, pickVideoEncoder, pickerForCondition, pipelineAnalyticsCapability, pipelineExecutorCapability, pipelineOrchestratorCapability, pipelineRunnerCapability, plateGalleryCapability, platformProbeCapability, powerMeterCapability, prepareNotification, presenceCapability, pressureSensorCapability, privacyMaskCapability, procedureAuthKey, ptzAutotrackCapability, ptzCapability, pythonScriptForBackend, readDetailCropConvention, readDeviceStateFrom, readNativeLeaseOverride, readNodePin, readinessKey, rebootCapability, recordingCapability, recordingExportCapability, rectsToCells, requiresPython, resolveAddonExecution, resolveAddonGroup, resolveAddonPlacement, resolveAddonRuntime, resolveCapMount, resolveDetectionRuntime, resolveDeviceControlKind, resolveDeviceProfile, resolveEgressDecodeHwAccel, resolveFormat, resolveHydratedFieldValue, resolveModelFormat, resolveMutate, resolveRunnerId, resolveScrubThumbnailGeometry, resolveVariantModelId, runInferenceStep, runtimeDevices, sceneMonitorCapability, scopeKey, scoreRuntimes, scriptRunnerCapability, selectAssignedProfileSlots, serverManagementCapability, setByPath, settingsStoreCapability, sleep, sleepCancellable, smokeCapability, smtpProviderCapability, snapshotCapability, ssoBridgeCapability, startReachabilityPoll, stateVocabularyFor, storageCapability, storageEvictableCapability, storageProviderCapability, streamBrokerCapability, streamCatalogCapability, streamParamsCapability, streamPixels, streamQualityLabel, subKindsOf, summarisePrivacyAudio, supportedRuntimes, switchCapability, switchedOffIds, synthesizeSourceInfo, systemCapability, tamperCapability, taskLogEntrySchema, taskPhaseSchema, taskTargetSchema, temperatureSensorCapability, terminalSessionCapability, textToHtml, toDeviceSummary, toExpressionValue, toNodeId, toStreamSourceEntry, toastCapability, tokenize, transcodeBody, tryConvertUnit, turnProviderCapability, unitDimension, unitsForDimension, updateCapability, userManagementCapability, userPasskeysCapability, vacuumControlCapability, validateExpressionSource, valveCapability, vectorDimFromBase64, vectorStoreCapability, vibrationCapability, videoclipsCapability, viewerUiCapability, waterHeaterCapability, weatherCapability, webrtcClientHintsSchema, webrtcSessionCapability, wiringAddonHealthSchema, wiringHealthSnapshotSchema, wiringNodeHealthSchema, wiringProbeKindSchema, wiringProbeResultSchema, zodEntriesToConfigUI, zoneAnalyticsCapability, zoneRulesCapability, zonesCapability };
+export { ACCESSORY_LABEL, ALEXA_EGRESS_PROFILE, ALL_CAPABILITY_DEFINITIONS, APPLE_SA_TO_MACRO, AUDIO_ANALYSIS_CAP_NAME, AUDIO_BACKEND_CHOICES, AUDIO_MACRO_LABELS, AUDIO_PRESETS, AccessoriesStatusSchema, AccessoryKind, AddBrokerInputSchema, AddonAutoUpdateSchema, AddonListItemSchema, AddonPageDeclarationSchema, AddonPageInfoSchema, AdoptInputSchema as AdoptionAdoptInputSchema, AdoptResultSchema as AdoptionAdoptResultSchema, AdoptionFilterSchema, GetCandidateInputSchema as AdoptionGetCandidateInputSchema, ListCandidatesInputSchema as AdoptionListCandidatesInputSchema, ListCandidatesOutputSchema as AdoptionListCandidatesOutputSchema, ReleaseInputSchema as AdoptionReleaseInputSchema, AdoptionStatusSchema, AgentLoadSummarySchema, AirQualitySensorStatusSchema, AlarmArmModeSchema, AlarmPanelStatusSchema, AlarmStateSchema, AlertSchema, AlertSeveritySchema, AlertSourceSchema, AlertStatusSchema, AmbientLightSensorStatusSchema, ApiKeyRecordSchema, ApiKeySummarySchema, ArchiveEntrySchema, ArchiveManifestSchema, AttachmentMediaTypeSchema, AttachmentSchema, AudioAnalysisResultSchema, AudioAnalysisSettingsSchema, AudioChunkInputSchema, AudioClassSummarySchema, AudioClassificationLabelSchema, AudioClassificationResultSchema, AudioCodecInfoSchema, AudioDecodeSessionConfigSchema, AudioEncodeSchema, AudioEncodeSessionConfigSchema, AudioEncodedChunkSchema, AudioEventSchema, AudioLevelSchema, AudioMetricsHistoryPointSchema, AudioMetricsHistorySchema, AudioMetricsSnapshotSchema, AudioPcmChunkSchema, AuthResultSchema, AutoUpdateSettingsSchema, AutomationControlStatusSchema, AvailableIntegrationTypeSchema, BACKEND_TO_FORMAT, BASE_LIVE_EGRESS_PROFILE, BATTERY_DEVICE_PROFILE, BacklightModeSchema, BackupDestinationInfoSchema, BackupEntrySchema, BaseAddon, BaseDevice, BaseDeviceProvider, BatteryStatusSchema, BinaryStatusSchema, BoundingBoxSchema, BrightnessStatusSchema, AddInputSchema as BrokerAddInputSchema, BrokerAudioClientSchema, BrokerClientsSchema, BrokerConnectionDetailsSchema, BrokerConsumerAttributionSchema, BrokerConsumerKindSchema, BrokerDecodedClientSchema, BrokerEncodedClientSchema, GetStateInputSchema as BrokerGetStateInputSchema, BrokerInfoSchema, BrokerProviderInfoSchema, PublishInputSchema as BrokerPublishInputSchema, RegistryStatusSchema as BrokerRegistryStatusSchema, BrokerRtspClientSchema, BrokerStatsSchema, BrokerStatusEnum, BrokerStatusSchema, SubscribeInputSchema as BrokerSubscribeInputSchema, SubscribeResultSchema as BrokerSubscribeResultSchema, TestConnectionResultSchema as BrokerTestConnectionResultSchema, UnsubscribeInputSchema as BrokerUnsubscribeInputSchema, CAMERA_SWITCH_CATALOG, CAMERA_SWITCH_ORDER, CAM_PROFILE_ORDER, CAPABILITY_NAMES, CAPABILITY_ROUTER_KEYS, CAP_NAMES_WITH_STATUS, CAP_NODE_PIN_CONTEXT_KEY, CAP_PROVIDER_KIND_MAP, COCO_80_LABELS, COCO_TO_MACRO, CORE_BLOCK_ADDON_PREFIX, CamProfileSchema, CamStreamDescriptorSchema, CamStreamKindSchema, CamStreamResolutionSchema, CameraAssignmentStatusSchema, CameraAudioStatusSchema, CameraBrokerProfileSchema, CameraBrokerStatusSchema, CameraCredentialsSchema, CameraCredentialsStatusSchema, CameraDecoderShmSchema, CameraDecoderStatusSchema, CameraDetectionPhaseSchema, CameraDetectionProvisioningSchema, CameraDetectionProvisioningStateSchema, CameraDetectionStatusSchema, CameraMetricsSchema, CameraMetricsWithDeviceIdSchema, CameraMotionStatusSchema, CameraRecordingModeSchema, CameraRecordingStatusSchema, CameraSourceStatusSchema, CameraSourceStreamSchema, CameraStatusSchema, CameraStreamSchema, CameraSwitchAuthoritySchema, CameraSwitchGroupSchema, CameraSwitchIdSchema, CameraSwitchSchema, CameraSwitchUnavailableReasonSchema, CandidateQueryFilterSchema, CapScopeSchema, CapabilityBindingsSchema, CarbonMonoxideStatusSchema, ChargingStatus, ClientNetworkStatsSchema, ClimateControlStatusSchema, ClipPlaybackSchema, ClipSchema, ClusterAddonNodeDeploymentSchema, ClusterAddonStatusEntrySchema, CollectionColumnSchema, CollectionIndexSchema, ColorStatusSchema, ConfigEntrySchema, ConfigSectionWithValuesSchema, ConfigTabDeclarationSchema, ConnectivityStatusSchema, ConsumableItemSchema, ConsumablesStatusSchema, ContactStatusSchema, ControlKindSchema, ControlStatusSchema, ConvertArtifactSchema, ConvertResultSchema, ConvertTargetSchema, CoreBlockCompileResultSchema, CoreBlockInputSchema, CoreBlockPlacementSchema, CoreBlockSchema, CoreBlockStatusSchema, CoverStateSchema, CoverStatusSchema, CreateApiKeyInputSchema, CreateApiKeyResultSchema, CreateIntegrationInputSchema, CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, CreateUserInputSchema, CustomActionInputSchema, CustomModelDescriptorSchema, DATAPLANE_SECRET_HEADER, DECLARED_DEVICE_SWEEP_LIMIT, DECLARED_INTEGRATION_FIXED_KEY, DEFAULT_ADDON_PLACEMENT, DEFAULT_AUDIO_ANALYZER_CONFIG, DEFAULT_DECODER_HWACCEL_CONFIG, DEFAULT_DETAIL_CROP_CONVENTION, DEFAULT_EVENT_COLOR, DEFAULT_FEATURES, DEFAULT_NATIVE_LEASE_SETTINGS, DEFAULT_RETENTION, DEFAULT_SCRUB_THUMBNAIL_PRESET, DETAIL_CROP_PADDING_FIELD, DETAIL_CROP_PADDING_KEY, DETAIL_CROP_SECTION_ID, DETAIL_CROP_SQUARE_KEY, DETECTION_PIPELINE_CAP_NAME, DEVICE_BACKEND_TO_FORMAT, DEVICE_CAP_NAMES, DEVICE_PROFILES, DEVICE_SCOPED_CAPS, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATE_READERS, DEVICE_STATUS_METHOD, DEVICE_TYPE_CONTROL_KIND, DEVICE_TYPE_INFO, EngineInfoSchema as DataStoreEngineInfoSchema, DayNightModeSchema, DayNightOptionsSchema, DayNightSettingsPatchSchema, DayNightStatusSchema, DeclaredDevices, DecodedAudioChunkSchema, DecodedFrameSchema, DecoderSessionConfigSchema, DecoderStatsSchema, DeleteIntegrationResultSchema, DetailCropConventionSchema, DetectionSourceSchema, DeviceCodeSeveritySchema, DeviceConfig, DeviceDiscoveryStatusSchema, ExposeInputSchema as DeviceExportExposeInputSchema, DeviceExportStatusSchema, UnexposeInputSchema as DeviceExportUnexposeInputSchema, DeviceFeature, DeviceInfoSchema, DeviceNetworkStatsSchema, DeviceRole, DeviceRuntimeState, DeviceStatusSchema, DeviceType, DiscoveredChildDeviceSchema, DiscoveredChildStatusSchema, DiscoveredDeviceSchema, DiscoveredTargetSchema, DisposerChain, DoorbellPressEventSchema, DoorbellStatusSchema, EVENTFUL_CAP_NAMES, EVENT_KIND_BY_CAP, EVENT_PAD_MS, EVENT_TAXONOMY, EXPRESSION_BUILTINS, EXPRESSION_BUILTIN_NAMES, EXPRESSION_COMPILE_CACHE_CAPACITY, EXPRESSION_IDENTIFIER_RE, EXPRESSION_INJECTED_NOW, EgressEncodeSchema, EgressRateControlSchema, EgressTranscodeRequestSchema, EgressTranscodeSchema, ElementConfigStore, EmbeddingInfoSchema, EmbeddingResultSchema, EncodeProfileSchema, EncodedPacketSchema, EnrichedWidgetMetadataSchema, EnumSensorDateTimeFormatSchema, EnumSensorStatusSchema, EventCategory, EventEmitterStatusSchema, EventFireSchema, EventItemSchema, EventKindCategorySchema, EventKindDescriptorSchema, EventKindIconSchema, EventKindSchema, EventKindsForDeviceSchema, EventMediaArtifactSchema, EventMediaCoverageSchema, EventMediaKindSchema, EventMediaProductionSchema, EventSourceType, ExportDownloadSchema, ExportOptionsSchema, ExportRecordSchema, ExportSetupFieldSchema, ExportSetupSchema, ExportSpeedSchema, ExportStateSchema, ExportTimelapseSchema, ExposedDeviceSchema, ExposureModeSchema, ExpressionBindingSourceSchema, ExpressionEvalError, ExpressionFieldBindingSchema, ExpressionGlobalBindingSchema, ExpressionLiteralBindingSchema, ExpressionParseError, ExpressionSourceSchema, FanControlStatusSchema, FanDirectionSchema, FeatureManifestSchema, FeatureProbeStatusSchema, FloodStatusSchema, Fmp4BoxSplitter, FrameHandleFormatSchema, FrameHandleSchema, FrameInputSchema, GasStatusSchema, GetStreamWithCodecInputSchema, GlobalMetricsSchema, HAP_AUDIO_BASE, HAP_AUDIO_BITRATE_KBPS, HAP_AUDIO_VBV_KBITS, HAP_KEYFRAME_INTERVAL_SEC, HF_BASE_URL, HF_REPO, HWACCEL_OPTIONS, HealthStatusSchema, HistoryPointSchema, HistoryResolutionEnum, HumidifierStatusSchema, HumiditySensorStatusSchema, HvacModeSchema, ImageContractSchema, ImageContractStateSchema, ImageRotateSchema, ImageSettingsOptionsSchema, ImageSettingsPatchSchema, ImageSettingsStatusSchema, ImageStatusSchema, IngestOwnerSchema, InstalledPackageSchema, IntegrationLiteSchema, IntegrationWithStateSchema, IntercomAbilitySchema, IntercomStatusSchema, KNOWN_CAP_NAMES, KeyEventSchema, LOG_LEVEL_RANK, LabelAttributionSchema, LabelDefinitionSchema, LabelTierSchema, LawnMowerActivitySchema, LawnMowerControlStatusSchema, LinkedDeviceSchema, LinkedDevicesModeSchema, LlmDefaultSchema, LlmDefaultSelectorSchema, LlmErrorCodeSchema, LlmGenerateBaseInputSchema, LlmGenerateErrSchema, LlmGenerateOkSchema, LlmGenerateResultSchema, LlmImageSchema, LlmNodeModelSchema, LlmProfileKindDescriptorSchema, LlmProfileKindSchema, LlmProfileSchema, LlmRuntimeCompleteInputSchema, LlmRuntimeDiskUsageSchema, LlmRuntimeNodeSchema, LlmRuntimeStatusSchema, LlmUsageRollupSchema, LlmUsageSchema, LocateSegmentResultSchema, LocationStatSchema, LockControlStatusSchema, LockStateSchema, LogEntrySchema, LogLevelSchema, LogStreamEntrySchema, LoginMethodContributionSchema, LoginStageEnum, MACRO_LABELS, MAX_EXPRESSION_AST_NODES, MAX_EXPRESSION_BINDINGS, MAX_EXPRESSION_CALL_ARGS, MAX_EXPRESSION_EVAL_STEPS, MAX_EXPRESSION_SOURCE_LENGTH, METHOD_ACCESS_MAP, MODEL_FORMATS, MOTION_TRIGGER_FEATURE, ManagedModelCatalogEntrySchema, ManagedModelRefSchema, ManagedRuntimeConfigSchema, MaskGridDimsSchema, MaskGridShapeSchema, MaskLineShapeSchema, MaskPointSchema, MaskPolygonShapeSchema, MaskPolygonVerticesSchema, MaskRectShapeSchema, MaskShapeKindSchema, MaskShapeSchema, MediaFileInfoSchema, MediaFileSchema, MediaPlayerRepeatSchema, MediaPlayerStateSchema, MediaPlayerStatusSchema, MeshPeerSchema, MeshStatusSchema, MethodAccessSchema, ModelCatalogEntrySchema, ModelConvertInputSchema, ModelConvertMetadataSchema, ModelDistributeInputSchema, ModelDistributeResultSchema, ModelExtraFileSchema, ModelFormatEntrySchema, ModelFormatsSchema, ModelSubstitutionSchema, ModelVariantGroupSchema, MotionAnalysisResultSchema, MotionEventSchema, MotionOnMotionChangedDataSchema, MotionRegionSchema, MotionSourceEnum, MotionSourcesSchema, MotionStatusSchema, MotionTriggerRuntimeStateSchema, MotionTriggerStatusSchema, MotionZoneOptionsSchema, MotionZonePatchSchema, MotionZoneRegionSchema, MotionZoneStatusSchema, StatusSchema as MqttBrokerStatusSchema, MutationFilterSchema, NATIVE_LEASE_ACTIVITY_FIELD, NATIVE_LEASE_ACTIVITY_KEY, NATIVE_LEASE_ADMISSION_FIELD, NATIVE_LEASE_ADMISSION_KEY, NATIVE_LEASE_BUDGET_FIELD, NATIVE_LEASE_BUDGET_KEY, NATIVE_LEASE_SECTION_ID, NATIVE_LEASE_TTL_FIELD, NATIVE_LEASE_TTL_KEY, NC_BASE_CONDITION_KEYS, NC_CONDITION_CATALOG, NC_HISTORY_LIMIT_DEFAULT, NC_HISTORY_LIMIT_MAX, NC_MAX_PER_TRACK_IMMEDIATE, NC_SNOOZE_MAX_MINUTES, NC_TAXONOMY, NativeCropBboxSchema, NativeCropRefSchema, NativeCropResultSchema, NativeDetectionSchema, NativeLeaseAdmissionSchema, NativeLeaseSettingsSchema, NativeObjectClassEnum, NativeObjectDetectionRuntimeStateSchema, NativeObjectDetectionStatusSchema, NcAlarmConfigSchema, NcAlarmModeCoverageSchema, NcAlarmSettingsPatchSchema, NcAlarmSettingsSchema, NcConditionDescriptorSchema, NcConditionsSchema, NcCrossingSchema, NcDeliverySchema, NcDeviceStateConditionSchema, NcHistoryEntrySchema, NcHistoryFilterSchema, NcHistoryRecordKindSchema, NcHistoryStatusSchema, NcHistorySubjectSchema, NcMediaFrameSchema, NcMediaPolicySchema, NcOccupancyConditionSchema, NcPlateMatcherSchema, NcRuleActionSchema, NcRuleActionSequenceSchema, NcRuleActionsSchema, NcRuleInputSchema, NcRuleNotificationButtonSchema, NcRulePatchSchema, NcRuleSchema, NcRuleTargetSchema, NcScheduleSchema, NcScheduleWindowSchema, NcSnoozeInputSchema, NcSnoozeSchema, NcSnoozeScopeSchema, NcSnoozeSuppressedSchema, NcTaxonomyEntrySchema, NcTaxonomySchema, NcTestResultSchema, NcThrottleGranularitySchema, NcThrottleSchema, NcZoneConditionSchema, NetworkAccessStatusSchema, NetworkAddressSchema, NetworkEndpointSchema, NotificationActionIconSchema, NotificationActionSchema, NotificationFormatSchema, NotificationSchema, NotifierStatusSchema, NumericSensorStatusSchema, OPS_LOG_DEFAULT_LIMIT, OPS_LOG_RING_DEFAULT_MAX, OauthIntegrationDescriptorSchema, ObjectEventSchema, OpsLogDomainSchema, OpsLogEntrySchema, OpsLogOpSchema, OpsLogQueryInputSchema, OpsLogReasonSchema, OrchestratorMetricsSchema, OsdOverlayKindEnum, OsdOverlayPatchSchema, OsdOverlaySchema, OsdPositionEnum, OsdRenderOutcomeEnum, OsdRenderResultSchema, OsdSlotBindingSchema, OsdSlotViewSchema, OsdSourceOptionSchema, OsdSourceSchema, OsdSourceValueTypeEnum, OsdStatusSchema, PET_FEEDER_MANUAL_FEED_MAX, PET_FEEDER_MANUAL_FEED_MIN, PIPELINE_FLOW_CAPABILITY_NAMES, PIPELINE_OWNER_CAPABILITY_NAMES, PRIVACY_MASK_CAP_NAME, PROVIDER_KIND_CAP_NAMES, PYTHON_SCRIPT, PackageUpdateSchema, PackageVersionInfoSchema, PasskeyLoginMethodSchema, PasskeySummarySchema, PcmSampleFormatSchema, PerScopeBreakdownSchema, PetFeederStatusSchema, PickStreamPreferencesSchema, PickStreamRequirementsSchema, PickedCamStreamSchema, PipelineAssignmentSchema, PipelineDefaultStepSchema, PipelineEngineChoiceSchema, PipelineRunResultBridge, PipelineStepInputSchema, PipelineValidationIssueSchema, PipelineValidationResultSchema, PlaceholderReasonSchema, PolygonPointSchema, PowerMeterStatusSchema, PresenceStatusSchema, PressureSensorStatusSchema, PrivacyMaskOptionsSchema, PrivacyMaskPatchSchema, PrivacyMaskRegionSchema, PrivacyMaskShapeSchema, PrivacyMaskStatusSchema, ProfileRtspEntrySchema, ProfileSlotSchema, ProfileSlotStatusSchema, ProviderStatusSchema, PtzAutotrackRuntimeStateSchema, PtzAutotrackSettingsSchema, PtzAutotrackStatusSchema, PtzAutotrackTargetOptionSchema, PtzMoveCommandSchema, PtzOptionsSchema, PtzPositionSchema, PtzPresetSchema, PtzStatusSchema, QueryFilterSchema, RATE_CONTROL_RELAXED, RATE_CONTROL_TIGHT, REACHABILITY_FAILURES_TO_OFFLINE, REACHABILITY_POLL_INTERVAL_MS, REACHABILITY_PROBE_TIMEOUT_MS, RECOGNITION_TYPES, RESERVED_BINDING_NAMES, RUNTIME_DEFAULTS, RUNTIME_TO_FORMAT, RawStateResultSchema, ReadGopBytesResultSchema, ReadSegmentBytesResultSchema, ReadinessRegistry, ReadinessTimeoutError, RecentTracksPageSchema, RecentTracksQueryInput, RecordingAvailabilitySchema, RecordingBandModeSchema, RecordingBandSchema, RecordingBandTriggersSchema, RecordingConfigSchema, RecordingDaysSchema, RecordingDeviceUsageSchema, RecordingLocationUsageSchema, RecordingManifestSchema, RecordingRangeSchema, RecordingRetentionSchema, RecordingStatusSchema, RecordingStorageModeSchema, RecordingStorageUsageSchema, RecordingTriggersSchema, RecordingWeekdaySchema, RedirectLoginMethodSchema, RelocateFootageInputSchema, RelocateJobSchema, RelocateJobStateSchema, RelocateMediaInputSchema, RenderedAsSchema, ReportMotionInputSchema, RetrainAnnotationDraftSchema, RetrainAnnotationKindSchema, RetrainAnnotationSchema, RetrainAnnotationSourceSchema, RetrainAssistResultSchema, RetrainAssistSubjectSchema, RetrainCopyRefusalSchema, RetrainFrameCandidateSchema, RetrainFrameListSchema, RetrainFrameSchema, RetrainFrameSelectionSchema, RetrainMacroClassSchema, RetrainStatusSchema, RetrainTrackSchema, RetrainTransitionResultSchema, RingBuffer, RtpSourceSchema, RtspRestreamEntrySchema, RunnerCameraConfigSchema, RunnerCameraDeviceUIFields, RunnerFrameSourceSchema, RunnerInferenceDeviceSchema, RunnerLocalLoadSchema, RunnerLocalMetricsSchema, SCOPE_PRESETS, SCRUB_THUMBNAIL_PRESETS, SCRUB_THUMBNAIL_PRESET_LABELS, SCRUB_THUMBNAIL_PRESET_ORDER, SENSOR_FEATURES, SENSOR_MAP, SOURCE_INFO_METADATA_KEY, STREAM_PROFILE_META, STREAM_QUALITY_LABELS, SUB_DETECTION_TYPES, SYSTEM_CAP_NAMES, SceneCheckSchema, SceneConditionSchema, SceneMonitorSchema, SceneMonitorStateSchema, SceneMonitorStatusSchema, SceneReferenceSchema, ScopedTokenSchema, ScopedTokenSummarySchema, ScoredObjectEventSchema, ScriptRunnerStatusSchema, ScrubThumbnailPresetSchema, SearchResultSchema, SendEmailInputSchema, SendEmailResultSchema, SendResultSchema, SensorEventSchema, ServerBootModeSchema, ServerPackageStatusSchema, ServerRollbackInfoSchema, ServerUpdateActionResultSchema, ServerUpdateCheckResultSchema, ServerUpdateStateSchema, SettingsPatchSchema, SettingsRecordSchema, SettingsSchemaWithValuesSchema, SettingsUpdateResultSchema, ShmRingStatsSchema, SmokeStatusSchema, SmtpStatusSchema, SnapshotImageSchema, SourceInfoSchema, SpatialDetectionSchema, SsoBridgeClaimsSchema, StartEmbeddedInputSchema, StationaryObjectSchema, AbortUploadInputSchema as StorageAbortUploadInputSchema, BeginDownloadInputSchema as StorageBeginDownloadInputSchema, BeginDownloadResultSchema as StorageBeginDownloadResultSchema, BeginUploadInputSchema as StorageBeginUploadInputSchema, BeginUploadResultSchema as StorageBeginUploadResultSchema, EndDownloadInputSchema as StorageEndDownloadInputSchema, FinalizeUploadInputSchema as StorageFinalizeUploadInputSchema, StorageLocationDeclarationSchema, StorageLocationRefSchema, StorageLocationSchema, StorageLocationTypeSchema, ProviderInfoSchema as StorageProviderInfoSchema, ReadChunkInputSchema as StorageReadChunkInputSchema, TestLocationResultSchema as StorageTestLocationResultSchema, WriteChunkInputSchema as StorageWriteChunkInputSchema, StreamCodecSchema, StreamFormatSchema, StreamNetworkStatsSchema, StreamParamsOptionsSchema, StreamParamsStatusSchema, StreamProfileConfigSchema, StreamProfileOptionsSchema, StreamProfilePatchSchema, StreamProfileSchema, StreamSourceEntrySchema, StreamSourceSchema, SubscribeAudioChunksInputSchema, SubscribeAudioChunksResultSchema, SubscribeFramesInputSchema, SubscribeFramesResultSchema, SwitchStatusSchema, SystemMetricsSchema, SystemMirror, TAXONOMY_COLORS, TIMEZONES, TRANSCODE_DOWN_MAX_BITRATE_KBPS, TRANSCODE_DOWN_MAX_HEIGHT, TamperStatusSchema, TankStatusSchema, TargetKindCapsSchema, TargetKindLevelSchema, TargetKindSchema, TargetSchema, TemperatureSensorStatusSchema, TerminalProfileInfoSchema, TerminalSessionInfoSchema, TestConnectionResultSchema$1 as TestConnectionResultSchema, TestResultSchema, TimelapseRuleInputSchema, TimelapseRulePatchSchema, TimelapseRuleSchema, TimelapseTemplateSchema, ToastSchema, TokenScopeSchema, TopologyNodeSchema, TopologyProcessSchema, TopologyServiceSchema, TrackCascadeCountsSchema, TrackEnvelopeSchema, TrackFlagsPatchSchema, TrackFlagsSchema, TrackProjectionSchema, TrackSchema, TrackSourceSchema, TrackStateSchema, TrackZoneFilterSchema, TrackedDetectionSchema, TrainingExportDeviceTotalsSchema, TrainingExportSummarySchema, TurnServerSchema, UNIT_TABLE, BrokerInfoSchema$1 as UnifiedBrokerInfoSchema, UnitConversionError, UpdateIntegrationInputSchema, UpdateStatusSchema, UpdateUserInputSchema, UserRecordSchema, UserSummarySchema, VacuumControlStatusSchema, VacuumStateSchema, ValveStateSchema, ValveStatusSchema, VectorDeclareIndexInputSchema, VectorDeleteByFilterInputSchema, VectorDeleteInputSchema, VectorDeleteResultSchema, VectorFilterSchema, VectorGetInputSchema, VectorGetResultSchema, VectorItemSchema, VectorMatchSchema, VectorMetadataSchema, VectorMetricSchema, VectorQueryInputSchema, VectorQueryResultSchema, VectorStatsInputSchema, VectorStatsResultSchema, VectorUpsertInputSchema, VectorUpsertResultSchema, VibrationStatusSchema, VideoEncodeSchema, WEBRTC_EGRESS_PROFILE, WELL_KNOWN_TABS, WELL_KNOWN_TAB_MAP, WaterHeaterStatusSchema, WeatherStatusSchema, WebrtcStreamChoiceSchema, WebrtcStreamTargetSchema, WhiteBalanceModeSchema, WidgetHostEnum, WidgetLoginMethodSchema, WidgetMetadataSchema, WidgetRemoteSchema, WidgetSizeEnum, YAMNET_TO_MACRO, ZoneCrossingDirectionSchema, ZoneCrossingSchema, ZoneKindEnum, ZoneRuleModeEnum, ZoneRuleSchema, ZoneRuleStageEnum, ZoneRulesArraySchema, ZoneSchema, ZoneScopeBreakdownSchema, accessoriesCapability, accessoryStableId, addonPagesCapability, addonPagesSourceCapability, addonRoutesCapability, addonSettingsCapability, addonWidgetsCapability, addonWidgetsSourceCapability, addonsCapability, adminUiCapability, airQualitySensorCapability, alarmPanelCapability, alertsCapability, ambientLightSensorCapability, asBoolean, asJsonArray, asJsonObject, asNumber, asString, audioAnalysisCapability, audioAnalyzerCapability, audioCodecCapability, audioMetricsCapability, audioPlanFromEncodeProfile, authProviderCapability, autoAssignProfiles, automationControlCapability, backupCapability, bareAddonId, batteryCapability, bestLocationMatch, binaryCapability, bindAddonActions, brightnessCapability, brokerCapability, buildAddonRouteProvider, buildAudioArgs, buildEventKindDescriptor, buildFfmpegArgs, buildInputArgs, buildModelVariantGroups, buildNcTaxonomy, buildStreamParamsConfigSchema, buildVideoArgs, buttonCapability, cameraCredentialsCapability, cameraPipelineConfigCapability, cameraStreamsCapability, canConvertUnit, canonicalEgressPlan, carbonMonoxideCapability, cellsToRects, classifyStream, classifyStreams, climateControlCapability, collectHydratedFieldEntries, collectHydratedFieldValues, colorCapability, colorForKind, compileExpression, compileExpressionSafe, connectivityCapability, consumablesCapability, contactCapability, controlCapability, convertUnit, coreBlockAddonId, coreBlockIdFromAddonId, coreBlocksCapability, cosineSimilarity, coverCapability, createDeviceProxy, createDurableState, createEvent, createExpressionScope, createHwAccelCache, createLazyTrpcSource, createMirrorSource, createRuntimeStateBridge, createSliceHandle, createSystemProxy, customAction, customModelRegistryCapability, dataStoreProviderCapability, dayNightCapability, declarationOwnerNodeId, decodeVectorBase64, decoderCapability, defaultDeviceFor, defineCustomActions, deriveCameraSwitches, deriveDetailCropRect, deriveRecordingMode, describeModelVariant, detectionPipelineCapability, deviceAdoptionCapability, deviceBackendToFormat, deviceCustomAction, deviceDiscoveryCapability, deviceExportCapability, deviceManagerCapability, deviceMatchesProfile, deviceOpsCapability, deviceProviderCapability, deviceStateCapability, deviceStatusCapability, doorbellCapability, egressTranscodeSharingKey, egressTransportFromRequest, embeddingEncoderCapability, emitDownForOwnedCaps, emitReadiness, encodeProfileFromStreamShape, encodeVectorBase64, enumSensorCapability, enumerateInferenceDevices, enumerateItemArrayFields, enumerateSchemaFields, errMsg, evaluateAst, evaluateExpressionSource, evaluateZoneRules, event, eventEmitterCapability, eventsCapability, expandCapMethods, extractNestedAddonId, extractSourceInfoFromMetadata, faceGalleryCapability, fanControlCapability, featureProbeCapability, filesystemBrowseCapability, findTimezone, floodCapability, formatForBackend, formatForRuntime, gasCapability, getAudioMacroClassIds, getByPath, getCapsByProviderKind, getTaxonomyEntry, hasMotionTrigger, hfModelUrl, htmlToText, humidifierCapability, humiditySensorCapability, hydrateSchema, imageCapability, imageSettingsCapability, integrationsCapability, intercomCapability, invocationFromEncodeProfile, isAgentOnlyPlacement, isArrayOutputSchema, isBaseConditionKey, isCollectionArrayMethod, isDeployableToAgent, isDeviceConfigCap, isDeviceScopedCap, isEvent, isNode, isObjectInput, isSameAddonId, isScheduleActive, isSoftwareDecode, isVoidInput, jobKindSchema, kebabToCamel, knownValues, lawnMowerControlCapability, lifecycleJobSchema, lifecycleJobScopeSchema, lifecycleJobStateSchema, lifecycleTaskSchema, llmCapability, llmRuntimeCapability, localNetworkCapability, locationSimilarity, lockControlCapability, logBannerArgs, logDestinationCapability, logLevelAtMost, loginMethodCapability, looseSchema, makeProfileBrokerId, makeSourceBrokerId, mapAudioLabelToMacro, markdownToHtmlLite, markdownToText, maskUrlCredentials, mediaPlayerCapability, mergeSourceInfo, meshNetworkCapability, method, metricsProviderCapability, modelConvertCapability, modelDistributorCapability, modelFormatForRuntime, motionCapability, motionDetectionCapability, motionTriggerCapability, motionZonesCapability, mqttBrokerCapability, nativeObjectDetectionCapability, networkAccessCapability, networkQualityCapability, nodePin, nodesCapability, normalizeAddonInitResult, normalizeUnit, notificationOutputCapability, notificationRulesCapability, notifierCapability, numericSensorCapability, oauthIntegrationCapability, objectInputDeclaresAddonId, osdCapability, osdManagerCapability, parseCameraStreamConfig, parseExpression, parseJsonArray, parseJsonObject, parseJsonUnknown, parseProfileBrokerId, parseStreamParamsFormPatch, petFeederCapability, pickAccessoryControl, pickDetailCropConvention, pickNativeLeaseOverride, pickPreferredRtspEntry, pickVideoEncoder, pickerForCondition, pipelineAnalyticsCapability, pipelineExecutorCapability, pipelineOrchestratorCapability, pipelineRunnerCapability, plateGalleryCapability, platformProbeCapability, powerMeterCapability, prepareNotification, presenceCapability, pressureSensorCapability, privacyMaskCapability, procedureAuthKey, ptzAutotrackCapability, ptzCapability, pythonScriptForBackend, readDetailCropConvention, readDeviceStateFrom, readNativeLeaseOverride, readNodePin, readinessKey, rebootCapability, recordingCapability, recordingExportCapability, rectsToCells, requiresPython, resolveAddonExecution, resolveAddonGroup, resolveAddonPlacement, resolveAddonRuntime, resolveCapMount, resolveDetectionRuntime, resolveDeviceControlKind, resolveDeviceProfile, resolveEgressDecodeHwAccel, resolveFormat, resolveHydratedFieldValue, resolveModelFormat, resolveMutate, resolveRunnerId, resolveScrubThumbnailGeometry, resolveVariantModelId, runInferenceStep, runtimeDevices, sceneMonitorCapability, scopeKey, scoreRuntimes, scriptRunnerCapability, selectAssignedProfileSlots, serverManagementCapability, setByPath, settingsStoreCapability, sleep, sleepCancellable, smokeCapability, smtpProviderCapability, snapshotCapability, ssoBridgeCapability, startReachabilityPoll, stateVocabularyFor, storageCapability, storageEvictableCapability, storageProviderCapability, streamBrokerCapability, streamCatalogCapability, streamParamsCapability, streamPixels, streamQualityLabel, subKindsOf, summarisePrivacyAudio, supportedRuntimes, switchCapability, switchedOffIds, synthesizeSourceInfo, systemCapability, tamperCapability, taskLogEntrySchema, taskPhaseSchema, taskTargetSchema, temperatureSensorCapability, terminalSessionCapability, textToHtml, toDeviceSummary, toExpressionValue, toNodeId, toStreamSourceEntry, toastCapability, tokenize, transcodeBody, tryConvertUnit, turnProviderCapability, unitDimension, unitsForDimension, updateCapability, userManagementCapability, userPasskeysCapability, vacuumControlCapability, validateExpressionSource, valveCapability, vectorDimFromBase64, vectorStoreCapability, vibrationCapability, videoclipsCapability, viewerUiCapability, waterHeaterCapability, weatherCapability, webrtcClientHintsSchema, webrtcSessionCapability, wiringAddonHealthSchema, wiringHealthSnapshotSchema, wiringNodeHealthSchema, wiringProbeKindSchema, wiringProbeResultSchema, zodEntriesToConfigUI, zoneAnalyticsCapability, zoneRulesCapability, zonesCapability };