@camstack/addon-ai 0.4.128 → 0.4.129

package/dist/addon.mjs

@@ -43,7 +43,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 }) : target, mod));
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
-//#region ../types/dist/event-category-C5xZWqz6.mjs
+//#region ../types/dist/event-category-BGmz_oxW.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -576,6 +576,15 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["PipelineAudioInferenceResult"] = "pipeline.audio-inference-result";
 	EventCategory["DetectionPhaseTransition"] = "detection.phase-transition";
+	/**
+	* A camera provider's RAW onboard motion push (D673): the `MotionOnMotionChanged`
+	* data shape without `triggeredBy`, built by `providerMotionEvent`. Its one
+	* consumer is the orchestrator's camera-sensors bridge, which re-emits the
+	* camera's EFFECTIVE onboard motion as `MotionOnMotionChanged` (a pass-through
+	* for a camera with no attached sensor). Providers must not emit
+	* `MotionOnMotionChanged` themselves; `scripts/check-onboard-motion-emitters.ts`
+	* keeps it so (camera-grid is a named, deferred exception).
+	*/
 	EventCategory["ProviderMotion"] = "provider.motion";
 	EventCategory["ProviderDetection"] = "provider.detection";
 	EventCategory["EnrichmentEmbeddingStored"] = "enrichment.embedding.stored";
@@ -5561,7 +5570,7 @@ function number(params) {
 	return /* @__PURE__ */ _coercedNumber(ZodNumber, params);
 }
 //#endregion
-//#region ../types/dist/sleep-gU6hqv4_.mjs
+//#region ../types/dist/sleep-CDCONfkt.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7649,7 +7658,7 @@ var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
 	return DeviceRole;
 }({});
 //#endregion
-//#region ../types/dist/composition-Dq42XWp0.mjs
+//#region ../types/dist/composition-D7ULvLdD.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -7703,21 +7712,20 @@ function portable(target) {
 }
 portable("linux64"), portable("linuxarm64"), portable("macarm64"), portable("mac64");
 /**
-* LA tabella "quale booleano di questo tipo di device conta come ALTO", e il
-* valutatore puro del suo FRONTE.
+* THE table "which boolean of this device type counts as HIGH", and the
+* pure evaluator of its EDGE.
 *
-* Viveva dentro il builtin virtual-doorbell
-* (`@camstack/system` — `builtins/doorbell/trigger-engine.ts`) e i suoi
-* predicati erano privati al modulo. Il recorder ne ha bisogno per il trigger
-* `RecordingTriggers.sensorDeviceIds`: copiarla avrebbe creato la SECONDA
-* tabella, che diverge alla prima cap aggiunta e il cui sintomo — "il sensore
-* fa suonare il campanello ma non registra" — è esattamente D62. Quindi si
-* SPOSTA qui e il doorbell la ri-esporta.
+* ONE table for everyone who asks "is this device HIGH?": the
+* recorder's `RecordingTriggers.sensorDeviceIds` trigger, the post-analysis
+* sensor markers, the orchestrator's camera-sensors bridge and
+* the sources of a composite doorbell (`doorbellFeatureSources`, D671).
+* A second copy would diverge at the first cap added, and the symptom — "the
+* sensor rings the doorbell but does not record" — is exactly D62.
 *
-* ⚠ NON è `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), e le
-* due non vanno unificate: quella risponde a "qual è la PAROLA di stato per una
-* regola" (e include `presence`, `cover`, `alarm-panel`), questa a "qual è il
-* booleano il cui FRONTE conta". Vocabolari deliberatamente diversi.
+* ⚠ NOT `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), and the
+* two must not be unified: that one answers "what is the state WORD for a
+* rule" (and includes `presence`, `cover`, `alarm-panel`), this one "which
+* boolean's EDGE counts". Deliberately different vocabularies.
 */
 /**
 * Known binary / switch source caps → the boolean slice field whose
@@ -9324,22 +9332,22 @@ var CLASS_MAP_MACRO_TARGETS = [
 	"package"
 ];
 /**
-* Le macro classi di PRIMO LIVELLO: quelle che un object detector emette e che
-* un operatore può selezionare.
+* The FIRST-LEVEL macro classes: those an object detector emits and that
+* an operator can select.
 *
-* Sono le tre offerte dallo step `object-detection`
+* They are the three offered by the `object-detection` step
 * (`addon-pipeline/src/detection-pipeline/registry/step-definitions.ts`,
-* `enabledMacroClasses`). `package` sta in {@link CLASS_MAP_MACRO_TARGETS} e in
-* `MACRO_LABELS` — è una macro vera — ma NON qui: appartiene allo step
-* `package-detection`, la cui abilitazione è guidata dalle zone, e offrire la
-* stessa parola due volte ha già fatto accendere a un operatore il proxy COCO
+* `enabledMacroClasses`). `package` is in {@link CLASS_MAP_MACRO_TARGETS} and in
+* `MACRO_LABELS` — it is a true macro — but NOT here: it belongs to the step
+* `package-detection`, whose enablement is driven by zones, and offering the
+* same word twice has already made an operator turn on the COCO proxy
 * (suitcase/backpack/handbag) lasciando spento il detector dedicato.
 *
-* UNA lista. Prima di oggi le stesse tre erano scritte a mano nell'offerta
-* dello step e una seconda volta come union `FirstLevelMacro`
-* (`types/detection.ts`); una terza copia per il trigger di registrazione
-* (`RecordingTriggers.objectClasses`) avrebbe reso invisibile la divergenza
-* successiva.
+* ONE list. Before today the same three were hand-written in the step's offer
+* and a second time as the union `FirstLevelMacro`
+* (`types/detection.ts`); a third copy for the recording trigger
+* (`RecordingTriggers.objectClasses`) would have made the later divergence
+* invisible.
 */
 var FIRST_LEVEL_MACRO_CLASSES = [
 	"person",
@@ -9404,17 +9412,17 @@ var RecordingStorageModeSchema = _enum([
 	"on-device-decision"
 ]);
 /**
-* Le macro classi che possono aprire una finestra di registrazione — le stesse
-* tre offerte dallo step `object-detection`, da UNA lista
+* The macro classes that can open a recording window — the same
+* three offered by the `object-detection` step, from ONE list
 * ({@link FIRST_LEVEL_MACRO_CLASSES}).
 */
 var RecordingObjectTriggerClassSchema = _enum(FIRST_LEVEL_MACRO_CLASSES);
 /**
-* True quando `values` non ripete un elemento.
+* True when `values` does not repeat an element.
 *
-* Un duplicato non è innocuo: ogni voce di `objectClasses` / `sensorDeviceIds`
-* diventa una SORGENTE in `bandTriggerSources`, e la stessa sorgente due volte
-* conterebbe due volte le sue finestre in `segmentMissedByMs`.
+* A duplicate is not harmless: every entry of `objectClasses` / `sensorDeviceIds`
+* becomes a SOURCE in `bandTriggerSources`, and the same source twice
+* would count its windows twice in `segmentMissedByMs`.
 */
 var noDuplicates = (values) => new Set(values).size === values.length;
 /** Which detectors trigger an `events`-mode band. */
@@ -9422,34 +9430,34 @@ var RecordingTriggersSchema = object({
 	motion: boolean().optional(),
 	audioThresholdDbfs: number$1().optional(),
 	/**
-	* Le macro classi la cui detection apre una finestra. ASSENTE = la sorgente
-	* non è ascoltata; un array VUOTO è rifiutato, perché "banda events, trigger
-	* object acceso, nessuna classe" è la stessa forma "abilitata e non registra
-	* nulla, per sempre" contro cui è scritto `eventsBandCanEverDemand`.
+	* The macro classes whose detection opens a window. ABSENT = the source
+	* is not listened to; an EMPTY array is rejected, because "events band, object
+	* trigger on, no class" is the same shape "enabled and records
+	* nothing, forever" that `eventsBandCanEverDemand` is written against.
 	*
-	* Il segnale letto è GIÀ FILTRATO: solo detection `source: 'pipeline'`, cioè
-	* quelle che hanno attraversato `enabledMacroClasses`, i
-	* `minConfidence<Macro>` e il full-frame guard. L'AI a bordo camera
-	* (`source: 'onboard'`) non attraversa nessuno di quei gate e NON apre
-	* finestre — vedi `recorder/object-trigger.ts`.
+	* The signal read is ALREADY FILTERED: only `source: 'pipeline'` detections, i.e.
+	* those that went through `enabledMacroClasses`, the
+	* `minConfidence<Macro>` and the full-frame guard. The camera's onboard AI
+	* (`source: 'onboard'`) goes through none of those gates and does NOT open
+	* windows — see `recorder/object-trigger.ts`.
 	*/
 	objectClasses: array(RecordingObjectTriggerClassSchema).min(1).refine(noDuplicates, { message: "objectClasses must not repeat a class" }).optional(),
 	/**
-	* I device LINKED il cui FRONTE ALTO apre una finestra. Assente = la sorgente
-	* non è ascoltata; un array vuoto è rifiutato per la stessa ragione di
+	* The LINKED devices whose RISING EDGE opens a window. Absent = the source
+	* is not listened to; an empty array is rejected for the same reason as
 	* `objectClasses`.
 	*
-	* Sono id di device SORGENTE, non camere: la banda li nomina, quindi il
-	* percorso caldo (`DeviceStateChanged`, a ritmo di bus su tutta la flotta)
-	* non fa RPC. L'OFFERTA da cui l'operatore li sceglie è un'altra domanda, e
-	* si risolve con `deviceManager.getLinkedDevices` + `getBindingsBatch` per
-	* device (D12) — mai un elenco globale di cap.
+	* These are SOURCE device ids, not cameras: the band names them, so the
+	* hot path (`DeviceStateChanged`, at bus rate across the whole fleet)
+	* does no RPC. The OFFER from which the operator picks them is another question, and
+	* is resolved with `deviceManager.getLinkedDevices` + `getBindingsBatch` per
+	* device (D12) — never a global list of caps.
 	*
-	* Cosa vuol dire "alto" dipende dal TIPO di device e non è deciso qui:
-	* `SOURCE_CAP_ACTIVE_FIELD` (`catalogs/sensor-active-state.ts`) è LA tabella,
-	* la stessa che il virtual-doorbell usa dal 2026-08-05. Ed è il FRONTE, non
-	* il livello: un contatto trovato già aperto al riavvio del runner non fa
-	* registrare.
+	* What "high" means depends on the device TYPE and is not decided here:
+	* `SOURCE_CAP_ACTIVE_FIELD` (`catalogs/sensor-active-state.ts`) is THE table,
+	* the same one as the composite doorbell (D671). And it is the EDGE, not
+	* the level: a contact found already open at runner restart does not
+	* record.
 	*/
 	sensorDeviceIds: array(number$1().int().positive()).min(1).max(16).refine(noDuplicates, { message: "sensorDeviceIds must not repeat a device" }).optional()
 });
@@ -10526,7 +10534,7 @@ var DecoderSessionConfigSchema = object({
 * - **VALUE** — at which level, for which scope, until when. That stays ONE
 *   thing: the logging settings document on the `system` cap. Two authorities
 *   over the values is the exact defect
-*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   `docs/design/plans/2026-08-26-per-component-logging.md` was written to
 *   remove; re-introducing it from the cure side would be grotesque.
 *
 * Nothing in this file reads a clock, an env var or a store. The registry is
@@ -13979,7 +13987,7 @@ method(_void(), EngineInfoSchema, { auth: "admin" }), method(object({
 	*
 	* ⚠ An earlier version of this comment blamed Zod stripping, and that
 	* was wrong — corrected 2026-08-26 after the hop map
-	* (`docs/design/2026-08-26-mappa-hop-argomenti.md`) traced the path.
+	* (`docs/design/2026-08-26-topic-hop-map.md`) traced the path.
 	* There is **no Zod parse at all** between the door and the engine: the
 	* dispatcher forwards the payload verbatim and UDS carries it whole. A
 	* field declared here reaches `SqliteSettingsBackend` either way.
@@ -14735,7 +14743,17 @@ var SiteZoneSchema = object({
 var ProviderStatusSchema = object({
 	connected: boolean(),
 	deviceCount: number$1(),
-	error: string().optional()
+	error: string().optional(),
+	/**
+	* `'orchestrator'`: this provider writes NO camera's `motion` runtime slice
+	* — the orchestrator is its only writer (D696). Set by `BaseDeviceProvider`,
+	* which every provider bundles, so only a provider BUILT from D696-amended
+	* code says it. ABSENT means an older provider that may still write it (raw
+	* VMD writes, a boot seed), and the orchestrator's provider gate keeps that
+	* provider's cameras unwritten (`camera-sensors/motion-slice-provider-gate.ts`)
+	* — the provider twin of the runner's `getLocalLoad().motionSliceWriter`.
+	*/
+	motionSliceWriter: literal("orchestrator").optional()
 });
 object({
 	externalId: string(),
@@ -15533,28 +15551,10 @@ method(object({
 	deviceIds: array(number$1()).readonly(),
 	caps: array(string()).readonly().optional()
 }), record(string(), record(string(), unknown().nullable())));
-object({
-	/** Ms epoch of the last press. null = never observed since this provider started. */
-	lastPressedAt: number$1().nullable(),
-	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
-	pressCountSinceStart: number$1()
-});
-object({
-	deviceId: number$1(),
-	timestamp: number$1()
-});
-/**
-* The `doorbell-source` extension slot's editable value (D648): the camera's
-* virtual-doorbell trigger devices, exactly what the wrapper's
-* `doorbellSources` persists (as `{ deviceId }` records).
-*/
-var DoorbellSourceSlotValueSchema = object({ deviceIds: array(number$1().int().positive()) });
+var ExtensionSlotIdSchema = _enum(["linked-devices"]);
 DeviceType.Camera;
-DeviceType.Button, DeviceType.Camera;
-var ExtensionSlotIdSchema = _enum(["doorbell-source", "linked-devices"]);
-DeviceType.Camera, DeviceType.Camera;
 /** A slot's editable value, discriminated on `slot`. */
-var ExtensionSlotValueSchema = discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: literal("linked-devices") })]);
+var ExtensionSlotValueSchema = discriminatedUnion("slot", [LinkedDevicesSlotValueSchema.extend({ slot: literal("linked-devices") })]);
 DeviceType.Camera;
 var ExtensionSourceAvailabilitySchema = discriminatedUnion("state", [object({ state: literal("ok") }), object({
 	state: literal("unreachable"),
@@ -15591,10 +15591,11 @@ var ExtensionSlotSourceSchema = object({
 });
 /**
 * A DIFFERENT authority that gates whether the slot's sources do anything —
-* reported read-only, named, never written through this contract (D62). The
-* virtual doorbell's sources ring only while the wrapper is bound to the
-* camera, and that binding belongs to `deviceManager.setWrapperActive`.
-* `unknown` means the gate could not be read; it is not "inactive" (D315).
+* reported read-only, named, never written through this contract (D62) — e.g.
+* a slot whose sources act only while a wrapper is bound to the host, a
+* binding that belongs to `deviceManager.setWrapperActive`. No slot reports
+* one today (`linked-devices` answers `null`). `unknown` means the gate could
+* not be read; it is not "inactive" (D315).
 */
 var ExtensionSlotActivationSchema = object({
 	state: _enum([
@@ -15610,7 +15611,7 @@ var ExtensionSlotRowSchema = discriminatedUnion("state", [object({
 	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
 	slotRef: string(),
 	slot: ExtensionSlotIdSchema,
-	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
+	/** Names the store written (D62), e.g. `device-manager:_linkedDeviceIds`. */
 	authority: string(),
 	activation: ExtensionSlotActivationSchema.nullable(),
 	value: ExtensionSlotValueSchema,
@@ -15888,7 +15889,7 @@ method(object({
 * per-device window, `KeyFrameCaptureLog`, `bumpCropMetric`. Every one of them
 * ends in a log line, and a log line is the thing the operator asked to stop
 * needing: *"possiamo armare questi errori intanto? Così al prossimo giro
-* ricontrolliamo tutti questi punti"*. Reading them meant grepping Loki and
+* ricontrolliamo tutti questi punti"* [can we instrument these errors in the meantime? That way next round we recheck all these points]. Reading them meant grepping Loki and
 * hand-correlating timestamps, which is how a 22% thumbnail gap and a 3-hour
 * media blackout were both diagnosed. The counters stay; this is where they can
 * be READ.
@@ -20203,6 +20204,29 @@ object({
 	firstAt: number$1(),
 	lastAt: number$1()
 });
+var NC_ALARM_TRIGGERED_MAX_SEC = 3600;
+var NcAlarmDelaySecSchema = number$1().int().min(0).max(600);
+var NcAlarmTriggeredSecSchema = number$1().int().min(0).max(NC_ALARM_TRIGGERED_MAX_SEC);
+var uniqueModes = (entries) => new Set(entries.map((e) => e.mode)).size === entries.length;
+var NcAlarmModeDelaysListSchema = array(object({
+	mode: AlarmArmModeSchema,
+	exitDelaySec: NcAlarmDelaySecSchema.optional(),
+	entryDelaySec: NcAlarmDelaySecSchema.optional(),
+	triggeredDurationSec: NcAlarmTriggeredSecSchema.optional()
+})).max(8).refine(uniqueModes, { message: "modeDelays: at most one entry per arm mode" });
+var NcAlarmModeDelaysEditListSchema = array(object({
+	mode: AlarmArmModeSchema,
+	exitDelaySec: NcAlarmDelaySecSchema.nullable().optional(),
+	entryDelaySec: NcAlarmDelaySecSchema.nullable().optional(),
+	triggeredDurationSec: NcAlarmTriggeredSecSchema.nullable().optional()
+})).max(8).refine(uniqueModes, { message: "modeDelays: at most one edit per arm mode" });
+/** One switch of the alarm table: put ONE device on, or take it off, ONE mode's list. */
+var NcAlarmNonBlockingEditSchema = object({
+	mode: AlarmArmModeSchema,
+	deviceId: number$1().int().positive(),
+	/** true = on the list (may be open, does not block); false = off the list (blocks). */
+	nonBlocking: boolean()
+});
 /**
 * The per-mode lists, at most one per mode. Two lists for one mode have no
 * meaning a reader could agree on (union? the last one?), so they are refused
@@ -20211,10 +20235,10 @@ object({
 var NcAlarmNonBlockingListSchema = array(object({
 	mode: AlarmArmModeSchema,
 	deviceIds: array(number$1().int()).max(200)
-})).max(8).refine((lists) => new Set(lists.map((l) => l.mode)).size === lists.length, { message: "nonBlocking: at most one list per arm mode" });
+})).max(8).refine(uniqueModes, { message: "nonBlocking: at most one list per arm mode" });
 /**
-* The three durations the panel's state machine runs on, who hears about its
-* transitions, and which openings each mode tolerates.
+* The three durations — global, and per mode since D697 — the panel's state
+* machine runs on, who hears about its transitions, and which openings each mode tolerates.
 *
 * They live on the NOTIFICATION-RULES cap, not on `alarm-panel`, on purpose:
 * `alarm-panel` is `deviceNative` and its other provider mirrors somebody
@@ -20224,15 +20248,15 @@ var NcAlarmNonBlockingListSchema = array(object({
 */
 var NcAlarmSettingsSchema = object({
 	/** Grace period between arming and the mode taking effect. 0 = immediate. */
-	exitDelaySec: number$1().int().min(0).max(600),
+	exitDelaySec: NcAlarmDelaySecSchema,
 	/** Grace period between a trigger and the alarm firing. 0 = immediate. */
-	entryDelaySec: number$1().int().min(0).max(600),
+	entryDelaySec: NcAlarmDelaySecSchema,
 	/**
 	* How long `triggered` lasts before the panel re-arms itself.
 	* **0 = until an operator disarms it** — the behaviour before this field
 	* existed, and therefore what an untouched install keeps doing.
 	*/
-	triggeredDurationSec: number$1().int().min(0).max(3600),
+	triggeredDurationSec: NcAlarmTriggeredSecSchema,
 	/**
 	* Deprecated by D630 — every transition is announced. Parsed, never read;
 	* remove after one release. Optional so an older admin's patch (which still
@@ -20255,17 +20279,30 @@ var NcAlarmSettingsSchema = object({
 	* per mode is meaningful. Defaulted to `[]` so a blob stored before D630
 	* parses as "every opening blocks" — the behaviour it was written under.
 	*/
-	nonBlocking: NcAlarmNonBlockingListSchema.default([])
+	nonBlocking: NcAlarmNonBlockingListSchema.default([]),
+	/**
+	* Per arm mode, the delays that mode OVERRIDES (D697). A mode with no entry, or an entry
+	* without a field, uses the global value above — so `[]`, the default, is exactly the
+	* behaviour of a blob stored before this field existed. Read through `resolveModeDelays`.
+	*/
+	modeDelays: NcAlarmModeDelaysListSchema.default([])
 });
 /**
 * Every field optional — a tab edits one control at a time.
 *
-* `nonBlocking` is re-declared WITHOUT its default: `.partial()` does not
-* remove an inner `.default()`, so a patch that never named the field would
-* parse to `nonBlocking: []` and wipe every mode's list on an unrelated edit
-* (the same trap {@link NcRulePatchSchema} documents).
+* `nonBlocking` and `modeDelays` are re-declared WITHOUT their defaults:
+* `.partial()` does not remove an inner `.default()`, so a patch that never
+* named the field would parse to `[]` and wipe every mode's list on an
+* unrelated edit (the same trap {@link NcRulePatchSchema} documents). Here
+* `modeDelays` means EDITS, not the stored overrides.
 */
-var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.extend({ nonBlocking: NcAlarmNonBlockingListSchema }).partial();
+var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.extend({
+	nonBlocking: NcAlarmNonBlockingListSchema,
+	/** Per-mode, per-field edits — NOT the whole list (see NcAlarmModeDelaysEditSchema). */
+	modeDelays: NcAlarmModeDelaysEditListSchema,
+	/** ONE membership change; the panel applies it to the list it holds at its turn. */
+	nonBlockingEdit: NcAlarmNonBlockingEditSchema
+}).partial().refine((p) => p.nonBlocking === void 0 || p.nonBlockingEdit === void 0, { message: "nonBlocking and nonBlockingEdit are exclusive — send the whole lists or one edit" });
 /**
 * What one arm mode actually arms, DERIVED from the enabled rules gated on it.
 * Never authored, never stored — see `alarm-mode-coverage.ts` for why a stored
@@ -20365,6 +20402,28 @@ var NcAlarmConfigSchema = object({
 	*/
 	live: NcAlarmLiveSchema.optional()
 });
+var NcAlarmSensorReadingSchema = _enum([
+	"open",
+	"closed",
+	"unknown",
+	"not-opening"
+]);
+/** One device's state as the alarm reads it — the classifier the arm check uses. */
+var NcAlarmSensorStateSchema = object({
+	deviceId: number$1().int().positive(),
+	reading: NcAlarmSensorReadingSchema,
+	/** The word as read (`open`, `closed`, `unlocked`, `stopped`, …); null when unknown / not an opening. */
+	state: string().nullable(),
+	/** Why `unknown`: the read failed, or the slice holds no word its cap defines (a placeholder included). */
+	unknownWhy: _enum(["read-failed", "unknown-word"]).nullable(),
+	/** The device manager's liveness as the centre mirrors it; null = not known. */
+	online: boolean().nullable()
+});
+var NcAlarmSensorsInputSchema = object({ deviceIds: array(number$1().int().positive()).max(500) });
+var NcAlarmSensorsSchema = object({
+	sensors: array(NcAlarmSensorStateSchema),
+	readAt: number$1().int().nonnegative()
+});
 /**
 * ONE rule's demand on ONE camera's clip ring.
 *
@@ -20455,7 +20514,7 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), method(object({}), NcAlarmConfigSchema, { auth: "admin" }), method(object({ patch: NcAlarmSettingsPatchSchema }), NcAlarmConfigSchema, {
 	kind: "mutation",
 	auth: "admin"
-});
+}), method(NcAlarmSensorsInputSchema, NcAlarmSensorsSchema, { auth: "admin" });
 /**
 * Zod schemas for persisted record types.
 *
@@ -20802,12 +20861,26 @@ var CameraSensorRefSchema = object({
 function cameraSensorRefKey(ref) {
 	return `${ref.addonId}/${ref.stableId}`;
 }
-/** CS-1 accepts exactly one mode; CS-2 (D673) widens it to confirm / replace. */
-var CameraSensorsModeSchema = _enum(["in-addition"]);
-var CameraSensorsConfigSchema = object({
-	mode: CameraSensorsModeSchema,
-	sensors: array(CameraSensorRefSchema).min(1).max(8)
-}).superRefine((value, ctx) => {
+/**
+* A sensor's mode (D673). `in-addition`: its motion is the camera's motion too.
+* `replace`: its motion is the camera's, and while one is READY the camera's
+* own motion no longer counts on its own. `confirm`: while one is READY the
+* camera's own motion counts only while a confirm sensor is active — with or
+* without a replace sensor (spec C2, the controller's ruling on Q1).
+*/
+var CameraSensorModeSchema = _enum([
+	"in-addition",
+	"confirm",
+	"replace"
+]);
+/** A stored sensor with no mode — every CS-1 row — is in addition. */
+var DEFAULT_CAMERA_SENSOR_MODE = "in-addition";
+/**
+* A camera's attached sensors. A CS-1 row carried an envelope
+* `mode: 'in-addition'`: `z.object` drops it on parse, and the PARSED value is
+* what the write stores (D672 rule 3), so it is never written again.
+*/
+var CameraSensorsConfigSchema = object({ sensors: array(CameraSensorRefSchema.extend({ mode: CameraSensorModeSchema.default(DEFAULT_CAMERA_SENSOR_MODE) })).min(1).max(8) }).superRefine((value, ctx) => {
 	const seen = /* @__PURE__ */ new Set();
 	value.sensors.forEach((ref, index) => {
 		const key = cameraSensorRefKey(ref);
@@ -20819,39 +20892,41 @@ var CameraSensorsConfigSchema = object({
 		seen.add(key);
 	});
 });
-var RefFields = {
+/** Every attachment names its mode; an older orchestrator that does not is in addition. */
+var AttachmentFields = {
 	addonId: string(),
-	stableId: string()
+	stableId: string(),
+	mode: CameraSensorModeSchema.default(DEFAULT_CAMERA_SENSOR_MODE)
 };
 var CameraSensorAttachmentSchema = discriminatedUnion("state", [
 	object({
-		...RefFields,
+		...AttachmentFields,
 		state: literal("ready"),
 		deviceId: number$1(),
 		name: string(),
 		caps: array(string()).readonly()
 	}),
 	object({
-		...RefFields,
+		...AttachmentFields,
 		state: literal("offline"),
 		deviceId: number$1(),
 		name: string(),
 		reason: _enum(["offline", "disabled"])
 	}),
 	object({
-		...RefFields,
+		...AttachmentFields,
 		state: literal("missing"),
 		reason: string()
 	}),
 	object({
-		...RefFields,
+		...AttachmentFields,
 		state: literal("unsupported"),
 		deviceId: number$1(),
 		name: string(),
 		reason: string()
 	}),
 	object({
-		...RefFields,
+		...AttachmentFields,
 		state: literal("unreadable"),
 		reason: string()
 	})
@@ -20864,17 +20939,49 @@ var CameraSensorAttachmentSchema = discriminatedUnion("state", [
 * say.
 */
 var CameraSensorsNotForwardedSchema = _enum(["onboard-not-listed", "no-active-detection"]);
+/** Whether the camera's OWN motion counts on its own (D673 C2), from its READY sensors (C3). */
+var CameraOwnMotionSchema = _enum([
+	"always",
+	"when-confirmed",
+	"never"
+]);
+/** Confirm / Replace cannot suppress this camera's motion: its provider still emits it directly (D673 C13). */
+var CameraSensorsNotEnforcedSchema = _enum(["provider-not-split"]);
+/**
+* The camera's OWN onboard motion (D696): the raw input the bridge combines,
+* never the effective value. The camera's `motion` slice is the effective one,
+* so a view of the camera's own row reads this.
+* - `atMs`: when the bridge received the camera's last own edge.
+* - `detected`: evaluated WHEN THE STATUS IS ASKED — the last edge said `true`
+*   AND it is younger than the window the bridge counts the camera's own motion
+*   for (`motionCooldownMs`, floored at two sustain ticks). A camera that never
+*   sends a clear (heartbeats only) therefore reads `false` once no push came
+*   within the window; a status read is a snapshot, so a live view re-asks.
+* Absent = this orchestrator has not received the camera's own motion since it
+* started (unknown, never "quiet"), or an orchestrator older than D696.
+*/
+var CameraRawLevelSchema = object({
+	detected: boolean(),
+	atMs: number$1()
+});
 var CameraSensorsStatusSchema = discriminatedUnion("state", [
-	object({ state: literal("not-configured") }),
+	object({
+		state: literal("not-configured"),
+		cameraLevel: CameraRawLevelSchema.optional()
+	}),
 	object({
 		state: literal("unreadable"),
-		reason: string()
+		reason: string(),
+		cameraLevel: CameraRawLevelSchema.optional()
 	}),
 	object({
 		state: literal("configured"),
-		mode: CameraSensorsModeSchema,
+		cameraLevel: CameraRawLevelSchema.optional(),
 		sensors: array(CameraSensorAttachmentSchema).readonly(),
-		notForwarded: CameraSensorsNotForwardedSchema.optional()
+		/** Absent = an orchestrator older than CS-2: it does not say (D315). */
+		cameraMotion: CameraOwnMotionSchema.optional(),
+		notForwarded: CameraSensorsNotForwardedSchema.optional(),
+		notEnforced: CameraSensorsNotEnforcedSchema.optional()
 	})
 ]);
 Object.freeze({
@@ -21559,14 +21666,14 @@ var TrackSchema = object({
 	* `derive-returned-null tile=standin`,
 	* `native-tile tile=native no-key-frame-at-close`, …) written at close and
 	* CLEARED by the late-keyFrame upgrade when a native tile lands after all.
-	* The operator-facing answer to "perché manca l'immagine?" on a track whose
+	* The operator-facing answer to "perché manca l'immagine?" [why is the image missing?] on a track whose
 	* tile is a face/plate stand-in, a raster crop, or an icon.
 	*
 	* **`no-key-frame-at-close` (D400).** The line used to be written ONLY when
 	* the TILE ranked below native, so a track whose thumbnail landed natively
 	* while its key frame missed carried no reason at all — three of the four
 	* `MISSING_KEYFRAME` tracks in the 2026-09-07 operator audit were exactly
-	* that shape, and their "niente ultimo" had no cause anywhere on the row.
+	* that shape, and their "niente ultimo" [no last frame] had no cause anywhere on the row.
 	* The key frame is the head of a cascade (`keyFrame ⇒ keyFrameSmall ⇒ the
 	* lastFrame copy source`), so its absence is now on this line whatever the
 	* tile ended up being.
@@ -21653,7 +21760,7 @@ var MotionEventSchema = object({
 	/**
 	* Ms offsets from `timestamp` (the episode's own first rising edge, so the
 	* first entry is always `0`) of every genuine off→on transition the
-	* episode saw — "ogni evento on si deve salvare" (D475). NOT one entry per
+	* episode saw — "ogni evento on si deve salvare" [every ON event must be saved] (D475). NOT one entry per
 	* push: a firmware source that keepalives at ~1 Hz for the whole burst
 	* (Reolink, Hikvision) produces exactly one edge; a source that reports an
 	* explicit `false` mid-episode and then resumes before the quiet window
@@ -24065,8 +24172,10 @@ var RunnerCameraConfigSchema = object({
 	* - `analyzer`: ML/frame-diff motion detection (motion-wasm or other
 	*   analyzer providers) running on decoded frames in this runner.
 	* - `onboard`: camera-native motion pushes (Reolink Baichuan, ONVIF
-	*   analytics). The provider emits ProviderMotion
-	*   events; the orchestrator forwards to `reportMotion`.
+	*   analytics). The provider emits its raw push as `ProviderMotion`
+	*   (D673); the orchestrator's camera-sensors bridge re-emits the camera's
+	*   effective motion as `MotionOnMotionChanged`, which is what reaches
+	*   `reportMotion`.
 	*/
 	motionSources: MotionSourcesSchema.default(["analyzer"]),
 	/**
@@ -24243,7 +24352,15 @@ var RunnerLocalLoadSchema = object({
 		hasGpu: boolean(),
 		inferenceBackend: string().optional(),
 		cpuCores: number$1().optional()
-	})
+	}),
+	/**
+	* Who writes a camera's `motion` runtime slice (D696). `'orchestrator'`: this
+	* runner never writes it. ABSENT = a runner older than D696, which still
+	* writes the slice from its phase machine; the orchestrator does not write
+	* while any runner node is absent-or-unanswered, so one slice never has two
+	* writers.
+	*/
+	motionSliceWriter: literal("orchestrator").optional()
 });
 /**
 * Aggregate runtime metrics for the runner's whole local pool. Mirrors the
@@ -26879,7 +26996,7 @@ var ClipPlaybackSchema = object({
 * **One authorised yes is one wake.** `next-natural` — take the clip the next
 * time the camera is awake for its own reasons — is deliberately not a member:
 * it was proposed, it is free on the battery, and the operator declined it on
-* 2026-09-20 (*"Quando un export viene richiesto si sveglia la camera."*,
+* 2026-09-20 (*"Quando un export viene richiesto si sveglia la camera."* [When an export is requested the camera wakes up],
 * D558 "Considered and not taken").
 */
 var ClipWakeSchema = _enum(["authorised"]);
@@ -27140,7 +27257,7 @@ DeviceType.Camera, method(object({
 	* It replaced `sources?: string[]`, a VIEW filter over source ids that
 	* assumed the answer was a fan-out over everything a camera has. The
 	* operator settled otherwise on 2026-09-20 — *"l'utilizzatore è uno
-	* solo"* — so the list is asked of one provider at a time and there is
+	* solo"* [there is only one user] — so the list is asked of one provider at a time and there is
 	* nothing to filter out of it.
 	*/
 	provider: string().min(1)
@@ -29084,6 +29201,17 @@ object({
 	deviceId: number$1(),
 	status: DeviceStatusSchema
 });
+object({
+	/** Ms epoch of the last press. null = never observed since this provider started. */
+	lastPressedAt: number$1().nullable(),
+	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
+	pressCountSinceStart: number$1()
+});
+object({
+	deviceId: number$1(),
+	timestamp: number$1()
+});
+DeviceType.Button, DeviceType.Camera;
 /**
 * Enum-state sensor — a string value picked from a finite option set.
 * Drives HA `sensor` entries with `state_class: enum` (HVAC action
@@ -30728,9 +30856,9 @@ object({
 	/** Ms epoch of the last detected-true observation. Null if never detected. */
 	lastDetectedAt: number$1().nullable(),
 	/**
-	* `MOTION_CLOSE_AFTER_MS` while `detected: true` on a `Camera` device,
-	* `null` while false and on every `Sensor` device (D475) — see that
-	* constant's doc for the one-authority rule.
+	* `MOTION_CLOSE_AFTER_MS` while `detected: true` on a `Camera` device (the
+	* orchestrator writes it, D696), `null` while false and on every `Sensor`
+	* device (D475) — see that constant's doc for the one-authority rule.
 	*
 	* ## Reading this field still arms nothing
 	*
@@ -30748,38 +30876,41 @@ object({
 	* `addon-export-alexa/src/motion-clear-hold.ts` and
 	* `addon-export-hap`'s `RESET_DEBOUNCE_MS` both do.
 	*
-	* ## Who writes it
-	*
-	* - **Cameras** — the runner's phase machine, `active → watching` on
-	*   `cooldown_expired`, which then writes this slice with
-	*   `detected: false` (`handlePhaseChanged` in
-	*   `pipeline-runner/index.ts`). It produces the FALLING edge, which
-	*   matters most for the sources that only ever push a rising one:
-	*   Reolink emits `MotionOnMotionChanged { detected: true }` and never
-	*   a false.
-	* - **Sensors** (Home Assistant binary sensors, Homematic) — the
-	*   provider pushes the false itself, from the upstream system's own
-	*   state change. No phase machine is involved.
+	* ## Who writes it (D696)
 	*
-	* ### The phase machine is CANONICAL, not sole — and that is a defect
+	* - **Cameras** — the orchestrator, and nothing else. It writes the camera's
+	*   EFFECTIVE motion (`addon-pipeline-orchestrator`
+	*   `camera-sensors/motion-slice.ts`), alongside the effective
+	*   `MotionOnMotionChanged` it emits or receives: the camera-sensors bridge
+	*   for a split camera, an unsplit emitter's direct event, the analyzer and
+	*   device activity, as the camera's `motionSources` counts them. A source
+	*   that never sends a clear falls one window after its last `true`.
+	*   `lastDetectedAt` moves only on an effective rise. No camera provider
+	*   writes this slice (not even a boot seed), and neither does the runner's
+	*   phase machine: its phase is "a session is attached" for every on-motion
+	*   session, not motion, and it now has its own `DetectionPhaseTransition`.
+	*   A provider's `isDetected` answers from the hub's slice.
+	* - **Sensors** (Home Assistant binary sensors, Homematic, Matter, Alexa
+	*   imports) — the provider pushes both edges itself, from the upstream
+	*   system's own state change. That is the sensor's own fact.
 	*
-	* An earlier revision of this docblock (mine, 2026-09-12) claimed the
-	* phase machine is the sole writer for a camera. It is not.
-	* `hikvision-camera.ts:3464` and `amcrest-camera.ts:445` both call
-	* `setCapSlice(motionCapability, …)` on their own rising edge, and
-	* Hikvision's comment says why: it read THIS docblock, agreed the
-	* runner is canonical, and wrote anyway to avoid per-tick churn. So
-	* two authorities can disagree about one slice, which this repo
-	* forbids, and the doc said otherwise — which is worse than saying
-	* nothing, because it reads as verification.
+	* `scripts/check-onboard-motion-emitters.ts` refuses any other writer of a
+	* `motion` slice; each sensor writer is a named exemption.
 	*
-	* This predates D475 and is not fixed there: the fix touches every
-	* camera provider. Recorded in D475's Consequences. Do not restore the
-	* "sole writer" wording without also removing the other writers.
+	* This replaces the D475 §4 rule ("the phase machine is the sole writer").
+	* That rule was never true: Hikvision and Amcrest wrote the slice raw beside
+	* it, every provider seeded it at boot, and every session left it
+	* `detected: true` after its detach.
 	*/
 	autoClearAfterMs: number$1().nullable()
 });
-object({
+/**
+* Payload of `motion.onMotionChanged` event + the corresponding bus
+* event `EventCategory.MotionOnMotionChanged`. Single source of truth
+* — both the cap event surface and the bus payload type alias to this
+* schema.
+*/
+var MotionOnMotionChangedDataSchema = object({
 	deviceId: number$1(),
 	detected: boolean(),
 	timestamp: number$1(),
@@ -33244,7 +33375,7 @@ var ReadGopBytesResultSchema = object({
 /**
 * A time WINDOW of one finalized segment, cut by byte range — the multi-GOP
 * twin of {@link ReadGopBytesResultSchema}'s single instant. Built for the
-* replay clip's `recording` source (`docs/design/plans/2026-08-26-replay-clip-su-pipeline.md`):
+* replay clip's `recording` source (`docs/design/plans/2026-08-26-clip-replay-on-pipeline.md`):
 * a replay needs several seconds of native pixels, not one frame.
 *
 * `ok.data` is standalone-demuxable, same as a GOP read. `ok.reachesRequestedEnd`
@@ -40838,6 +40969,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.getAlarmSensors": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.getClipRetentionAsks": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -45321,6 +45458,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"notificationRules.getAlarmSensors": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"notificationRules.setDeviceMuted": [{
 		name: "deviceId",
 		form: "single",
@@ -47118,7 +47260,7 @@ var PreviewTextField = string().max(200);
 * Whether the notification's preview is a STILL or a short animation.
 *
 * The operator's ask, verbatim: *"inviato come gif o video (come per le altre
-* rule)"* — the other rules already offer an animated preview, and a ten-hour
+* rule)"* [sent as a gif or video (as for the other rules)] — the other rules already offer an animated preview, and a ten-hour
 * night reads better as three seconds of motion than as one frame of it. Both
 * modes get the SAME treatment (blurred frame, large centred title); `'gif'`
 * simply applies it to a dozen frames sampled across the render and assembles
@@ -47256,6 +47398,7 @@ TimelapseRuleInputSchema.extend({
 	createdAt: number$1(),
 	updatedAt: number$1()
 });
+MotionOnMotionChangedDataSchema.omit({ triggeredBy: true });
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.
@@ -83024,7 +83167,7 @@ function messagesFor(request) {
 * `RetryError` is the wrapper the library returns when the attempts are spent;
 * the interesting error is the LAST one inside it, so the envelope is unwrapped
 * before anything is classified (§2.3, "chi classifica gli errori deve
-* scartare l'involucro").
+* scartare l'involucro" [whoever classifies errors must discard the envelope]).
 */
 function mapLibraryError(error) {
 	if (RetryError.isInstance(error)) {