@camstack/addon-export-hap 1.2.8 → 1.2.10

package/dist/export-hap.addon.mjs

@@ -10,7 +10,7 @@ import { networkInterfaces } from "node:os";
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
-//#region ../types/dist/event-category-Bz24uP1U.mjs
+//#region ../types/dist/event-category-41fKf-q9.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -70,6 +70,26 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AddonRetryScheduled"] = "addon.retry-scheduled";
 	/**
+	* A liveness invariant of this node is false — it has no devices, every
+	* camera is offline, or a camera that was recording has stopped producing
+	* segments. Emitted by the `liveness-monitor` builtin, once per fault (the
+	* `findingId` is stable across ticks), only after its boot grace period.
+	* AlertCenter raises a persistent operator-visible alert.
+	*
+	* It exists because on 2026-08-03 the hub ran four hours with zero devices
+	* and zero recordings while every surface stayed quiet.
+	*
+	* Payload: `{ findingId, severity, title, message, deviceId? }`.
+	*/
+	EventCategory["SystemLivenessFailed"] = "system.liveness-failed";
+	/**
+	* A previously reported liveness fault is true again. AlertCenter dismisses
+	* the matching `SystemLivenessFailed` alert.
+	*
+	* Payload: `{ findingId }`.
+	*/
+	EventCategory["SystemLivenessRecovered"] = "system.liveness-recovered";
+	/**
 	* Monitor is attempting to reload a failed addon NOW. UI uses this
 	* to show a spinner during the retry attempt. Same transient nature
 	* as AddonRetryScheduled.
@@ -7320,14 +7340,7 @@ var RecordingConfigSchema = object({
 	* windows only — existing sheets are immutable, and each window's index
 	* carries its own tile dims so mixed-preset history renders correctly.
 	*/
-	scrubThumbnails: ScrubThumbnailPresetSchema.optional(),
-	/**
-	* OPT-IN thumbnail-strip generation for this camera: every keyframe of the
-	* low recording saved as a JPEG (the fast-drag scrub depth), a derived
-	* cache that eviction reclaims with the footage. Absent/false = no strips
-	* are written and scrub reads exact keyframes at every velocity.
-	*/
-	stripsEnabled: boolean().optional()
+	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
 }).strict();
 /**
 * Ops-log — the durable, append-only operations audit shared by the
@@ -7389,7 +7402,7 @@ var OpsLogQueryInputSchema = object({
 /**
 * Entity-relocation job state (storage entity-routing spec, Phase 4).
 *
-* One shape shared by the recorder's `relocateFootage` (segments + strips) and
+* One shape shared by the recorder's `relocateFootage` (segments) and
 * pipeline-analytics' `relocateMedia` (event media blobs) so the admin Data
 * page renders both movers with one component. Jobs are in-RAM (a restart
 * forgets them — re-running is safe by construction: copy-if-absent, delete
@@ -7411,7 +7424,7 @@ var RelocateJobSchema = object({
 	toLocationId: string(),
 	/** Scoped device, or null = every device. */
 	deviceId: number().nullable(),
-	/** What the job moves (owner-addon specific: segments/strips or media). */
+	/** What the job moves (owner-addon specific: segments or media). */
 	entities: array(string()),
 	filesMoved: number().int(),
 	bytesMoved: number().int(),
@@ -7425,7 +7438,7 @@ var RelocateFootageInputSchema = object({
 	deviceId: number().optional(),
 	fromLocationId: string(),
 	toLocationId: string(),
-	entities: array(_enum(["segments", "strips"])).optional(),
+	entities: array(_enum(["segments"])).optional(),
 	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
 	*  never allowed to starve live writers. */
 	throttleMbps: number().min(1).max(1e3).optional()
@@ -8976,6 +8989,72 @@ AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, Accessor
 DeviceFeature.BatteryOperated;
 new Set(["devices", "classes"]);
 /**
+* Alarm-panel cap. Models HA `alarm_control_panel.*` on
+* `DeviceType.AlarmPanel`. State follows HA's canonical lifecycle
+* across disarmed / armed_(home|away|night|vacation|custom_bypass) /
+* arming / pending / triggered / disarming.
+*
+* Many panels require a PIN code on arm / disarm — the optional
+* `code` field on the methods passes it through to the upstream
+* service; it's NEVER persisted in the runtime slice or any event
+* payload. The presence of a required code is signalled by
+* `DeviceFeature.AlarmPinRequired` so the UI gates a code-entry
+* field without a slice fetch.
+*
+* `availableModes` mirrors HA's `supported_features`-derived arm
+* mode list — the UI renders only the buttons the panel accepts.
+*/
+var AlarmStateSchema = _enum([
+	"disarmed",
+	"armed_home",
+	"armed_away",
+	"armed_night",
+	"armed_vacation",
+	"armed_custom_bypass",
+	"arming",
+	"disarming",
+	"pending",
+	"triggered"
+]);
+var AlarmArmModeSchema = _enum([
+	"home",
+	"away",
+	"night",
+	"vacation",
+	"custom_bypass"
+]);
+object({
+	/** Current lifecycle state. */
+	state: AlarmStateSchema,
+	/** Subset of arm modes the panel accepts. UI renders one button per
+	*  mode in this list. */
+	availableModes: array(AlarmArmModeSchema),
+	/** Whether the panel requires a PIN on arm / disarm. Mirrors
+	*  `DeviceFeature.AlarmPinRequired` for slice consumers. */
+	requiresCode: boolean(),
+	/** Ms epoch when the slice was last updated. */
+	lastChangedAt: number()
+});
+DeviceType.AlarmPanel, method(object({
+	deviceId: number().int().nonnegative(),
+	mode: AlarmArmModeSchema,
+	/** Optional PIN code. Required when `requiresCode === true`.
+	*  Passed through to the upstream service; never persisted. */
+	code: string().min(1).optional()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int().nonnegative(),
+	code: string().min(1).optional()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * Shared geometry vocabulary for on-frame shape caps — privacy-mask,
 * motion-zones, and the detection zones/lines editor all speak this one
 * language so a single drawing-plane editor and the providers stay
@@ -9037,6 +9116,276 @@ var MaskGridDimsSchema = object({
 	height: number()
 });
 /**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = _enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: string().optional(),
+	bytes: _instanceof(Uint8Array).optional(),
+	mime: string().optional(),
+	name: string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = _enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/**
+* The CLOSED icon vocabulary an action button may use.
+*
+* A closed set, not a free string, and that is the whole point: an arbitrary
+* icon name is one that ntfy renders, zentik silently drops, and nobody
+* notices — the same class of gap as a zone vocabulary nothing produced
+* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
+* declares `actionIcons: false` and the degrade engine strips the field.
+*
+* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
+* renderer's icon set; "acknowledge" survives an adapter that draws it
+* differently.
+*/
+var NotificationActionIconSchema = _enum([
+	"acknowledge",
+	"dismiss",
+	"silence",
+	"view",
+	"play",
+	"open",
+	"close",
+	"lock",
+	"unlock",
+	"arm",
+	"disarm",
+	"light",
+	"alert"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = object({
+	id: string(),
+	label: string(),
+	url: string().optional(),
+	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
+	icon: NotificationActionIconSchema.optional(),
+	/**
+	* Renders in a warning style where the notifier supports it.
+	*
+	* A HINT, never a gate. The callback's authority is its token and nothing
+	* else — see `notification-center/action-token.ts` for what that does and
+	* does not buy.
+	*/
+	destructive: boolean().optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = object({
+	body: string(),
+	title: string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: number().int().min(1).max(5).default(3),
+	level: string().optional(),
+	attachments: array(AttachmentSchema).optional(),
+	clickUrl: string().optional(),
+	actions: array(NotificationActionSchema).optional(),
+	sound: string().optional(),
+	ttl: number().optional(),
+	tag: string().optional(),
+	deviceId: number().optional(),
+	eventId: string().optional(),
+	metadata: record(string(), unknown()).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = object({
+	id: string(),
+	label: string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: number().int().min(1).max(5).nullable(),
+	flags: object({
+		critical: boolean().optional(),
+		silent: boolean().optional(),
+		noPush: boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: array(string()).optional(),
+	description: string().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = object({
+	attachments: object({
+		mediaTypes: array(AttachmentMediaTypeSchema),
+		mode: _enum([
+			"url",
+			"bytes",
+			"both"
+		]),
+		max: number().int().nonnegative(),
+		maxBytes: number().int().positive().optional()
+	}),
+	/** Max action buttons (0 = none). */
+	actions: number().int().nonnegative(),
+	/**
+	* Whether this kind renders a per-action ICON.
+	*
+	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
+	* run on the addon cap path — three production failures in one day taught
+	* this repo that once. Absent is read as false by the degrade engine, which
+	* is the safe direction: an icon that is not rendered costs nothing, an icon
+	* assumed and dropped costs the operator's trust in the field.
+	*/
+	actionIcons: boolean().optional(),
+	levels: array(TargetKindLevelSchema),
+	format: array(NotificationFormatSchema),
+	clickUrl: boolean(),
+	sound: boolean(),
+	ttl: boolean(),
+	bodyMaxLen: number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough$1 = unknown();
+var TargetKindSchema = object({
+	kind: string(),
+	label: string(),
+	icon: string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: string().optional(),
+	configSchema: ConfigSchemaPassthrough$1,
+	supportsDiscovery: boolean(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = object({
+	id: string(),
+	name: string(),
+	kind: string(),
+	addonId: string(),
+	enabled: boolean(),
+	config: record(string(), unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = object({
+	kind: string(),
+	suggestedName: string(),
+	config: record(string(), unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = object({
+	level: string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: number().int().nonnegative(),
+	actionsSent: number().int().nonnegative(),
+	truncated: boolean(),
+	dropped: array(string())
+});
+var SendResultSchema = object({
+	success: boolean(),
+	error: string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema)), method(object({
+	kind: string(),
+	config: record(string(), unknown()).optional()
+}), array(DiscoveredTargetSchema)), method(object({
+	targetId: string(),
+	notification: NotificationSchema
+}), SendResultSchema, { kind: "mutation" }), method(object({
+	targetId: string(),
+	sample: NotificationSchema.optional()
+}), TestResultSchema, { kind: "mutation" }), method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }), method(object({ targetId: string() }), _void(), { kind: "mutation" }), method(object({
+	targetId: string(),
+	enabled: boolean()
+}), _void(), { kind: "mutation" });
+/**
 * notification-rules — the Notification Center rule surface (P1 core).
 *
 * Spec: `docs/superpowers/specs/2026-07-22-notification-center-requirements.md`
@@ -9166,7 +9515,115 @@ var NcZoneConditionSchema = object({
 * The P1 condition set — a flat AND of groups; absent group = pass;
 * membership lists are OR within the list (spec §2.3).
 */
+/**
+* What a rule may actuate.
+*
+* **No hand-maintained allowlist** (operator decision, and the right one — a
+* written list of methods is a third parallel map to keep aligned, and this
+* repo has paid for those). The boundary instead comes from a property the
+* capabilities already carry: an action may target only a **device-scoped**
+* capability method.
+*
+* That is not decoration. A rule can be authored by a NON-ADMIN — personal
+* rules are a supported flow — and the executor runs with the addon's
+* privileges, so an unbounded action is an arbitrary RPC channel with a
+* privilege escalation attached. Restricting to device scope excludes the
+* system caps (`device-manager.removeDevice` and friends) by construction,
+* costs nothing to maintain, and cannot rot: a cap that stops being
+* device-scoped stops being actuatable in the same change.
+*
+* The executor enforces it; {@link NcRuleActionSchema} carries the intent.
+*/
+/**
+* One step of a sequence.
+*
+* `wait` is a first-class step rather than a property of the next action: it is
+* what makes a sequence a SEQUENCE and not a list — "unlock, wait 5s, open"
+* cannot be expressed otherwise.
+*/
+var NcRuleActionSchema = discriminatedUnion("kind", [object({
+	kind: literal("wait"),
+	seconds: number().min(0).max(300)
+}), object({
+	kind: literal("cap"),
+	deviceId: number().int(),
+	/** Capability name, e.g. `alarm-panel`. */
+	cap: string().min(1),
+	/** Method on it. The executor refuses a non-device-scoped cap. */
+	method: string().min(1),
+	/** Method arguments, minus `deviceId` (the executor injects it). */
+	args: record(string(), unknown()).optional()
+})]);
+/**
+* A named, ordered run of steps with its own throttle.
+*
+* `minDelaySec` exists because a noisy rule otherwise hammers a physical
+* actuator — the rule's own cooldown governs NOTIFICATIONS, which is a
+* different budget from "how often may this gate actually open".
+*/
+var NcRuleActionSequenceSchema = object({
+	name: string().min(1).max(120),
+	enabled: boolean(),
+	minDelaySec: number().int().min(0).max(86400).optional(),
+	actions: array(NcRuleActionSchema).min(1)
+});
+/**
+* One button carried by the notification, running a named sequence on tap.
+*
+* **Read this before adding a button that does something physical.** The tap
+* arrives over a link that travelled through third-party infrastructure — ntfy,
+* a push relay, whatever forwarded the message — and the callback's ONLY
+* authority is the token in that link: single-use, short-lived, bound to this
+* one action of this one notification. It does not identify who tapped.
+* Whoever holds the notification can run the button, once, inside the window.
+* That is the operator's explicit choice (2026-08-05), and `destructive` is a
+* rendering hint, not a second gate. [D47](decisions/adr-0047.md).
+*/
+var NcRuleNotificationButtonSchema = object({
+	/** Stable id — travels in the callback and identifies the button in logs. */
+	id: string().min(1).max(64),
+	label: string().min(1).max(40),
+	/** Name of a sequence in `onTrigger`. The dispatcher drops a button whose
+	*  sequence does not exist rather than minting a token for nothing. */
+	sequence: string().min(1).max(120),
+	icon: NotificationActionIconSchema.optional(),
+	destructive: boolean().optional()
+});
+/**
+* Sequences a rule runs, by hook point.
+*
+* ONLY `onTrigger` is here, deliberately. The reference also has activation /
+* deactivation / reset / post-generation hooks, and they are wanted — but this
+* repo's expensive failure mode is declaring a surface nothing produces, so a
+* hook appears here in the same change that produces its edge, never before.
+*/
+var NcRuleActionsSchema = object({
+	/** Runs when the rule MATCHES. */
+	onTrigger: array(NcRuleActionSequenceSchema).optional(),
+	/**
+	* Buttons the NOTIFICATION carries, each running one of this rule's
+	* sequences when tapped.
+	*
+	* Deliberately a REFERENCE to a sequence rather than a second place to
+	* author steps. A button that could define its own actions would be a
+	* parallel actuation vocabulary — the executor's device-scope check, the
+	* stop-at-first-failure rule and the per-sequence throttle all live on
+	* sequences, and a second authoring surface would drift from every one of
+	* them.
+	*
+	* A sequence reachable ONLY by a button simply appears in `onTrigger` with
+	* `enabled: false`: it is then authored, throttled and validated like the
+	* rest, and nothing runs it automatically.
+	*/
+	buttons: array(NcRuleNotificationButtonSchema).max(8).optional()
+});
 var NcConditionsSchema = object({
+	/** Gate on ANOTHER device's current state (the alarm armed, a switch on). */
+	deviceState: object({
+		deviceId: number().int(),
+		/** Any of these matches. */
+		states: array(string().min(1)).min(1)
+	}).optional(),
 	/** Device scope — absent = all devices. */
 	devices: array(number()).optional(),
 	/** Detector class names (any overlap with the record's class set). */
@@ -9367,6 +9824,14 @@ var NcMediaPolicySchema = object({
 	clipPreRollSec: number().int().min(0).max(30).optional(),
 	clipPostRollSec: number().int().min(0).max(30).optional(),
 	/**
+	* Playback rate of the attached gif / clip. Absent = 2x.
+	*
+	* A notification clip is GLANCED at on a lock screen, not watched: at real
+	* time an eight-second passage is eight seconds of the recipient's attention
+	* and twice the bytes. 1 is real time for the operator who wants it.
+	*/
+	clipSpeed: number().min(1).max(8).optional(),
+	/**
 	* Which stream profile the footage is cut from. Absent = the CHEAPEST
 	* assigned profile: a notification is watched on a phone, so the 4K
 	* rendition would burn CPU to produce a file the client downscales anyway.
@@ -9438,7 +9903,30 @@ var NcRuleInputSchema = object({
 	* behaviour, visible to all, read-only in the viewer). Present = personal
 	* rule owned by this userId. Server-stamped; never trusted from a client.
 	*/
-	ownerUserId: string().optional()
+	ownerUserId: string().optional(),
+	/**
+	* May a non-admin snooze this rule for EVERYONE, not just themselves?
+	*
+	* A snooze is personal by default — it silences the person who set it. This
+	* opts THIS rule into the "the gardener is here all afternoon" case, where
+	* silencing the camera for the whole household is legitimate. It silences
+	* other people, so it is off unless a rule deliberately allows it.
+	*
+	* `.optional()`, deliberately NOT `.default()`: a Zod default does not run on
+	* the addon cap path (three production failures in one day), so absent is
+	* read as `false` by {@link canSetGlobal} in the engine. Admins are not bound
+	* by this flag — see the scope rules on that function.
+	*/
+	snoozeAllowGlobal: boolean().optional(),
+	/**
+	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
+	*
+	* This is what makes the rule set the alarm's trigger set without the alarm
+	* being a special case: arming is
+	* `{ cap: 'alarm-panel', method: 'arm', args: { mode: 'away' } }`, the same
+	* shape as every other actuation.
+	*/
+	actions: NcRuleActionsSchema.optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -9509,7 +9997,8 @@ var NcConditionDescriptorSchema = object({
 		"packagePhase",
 		"crossingSelect",
 		"polygonDraw",
-		"occupancy"
+		"occupancy",
+		"deviceState"
 	]),
 	operator: _enum([
 		"in",
@@ -9523,7 +10012,28 @@ var NcConditionDescriptorSchema = object({
 	/** Which delivery kinds the condition applies to. */
 	appliesTo: array(NcDeliverySchema),
 	phase: string(),
-	description: string().optional()
+	description: string().optional(),
+	/**
+	* The CHOICES for a single-choice widget (`sourceSelect`, `crossingSelect`,
+	* `packagePhase`, …), served with the descriptor.
+	*
+	* Before this the descriptor said which widget to render and not what to put
+	* in it, so every option list lived in three places: this file's enums, the
+	* admin's `NC_*_OPTIONS` and the viewer's `NC_*_VALUES`. That triple mirror
+	* is the drift that emptied the viewer's rule editor on 2026-08-04 — the app
+	* mirrors the cap by hand, so it is only ever as current as its last build.
+	*
+	* With the options on the wire, a condition of an EXISTING `valueType` costs
+	* zero client changes. Clients keep a local fallback for an older hub that
+	* does not send them; absent here is "use your own list", not "no choices".
+	*/
+	options: array(object({
+		/** Written to the rule verbatim. `''` means the ABSENT state. */
+		value: string(),
+		label: string(),
+		/** What THIS choice matches — shown one at a time, under the control. */
+		hint: string().optional()
+	})).readonly().optional()
 });
 /**
 * The delivery lifecycle status of a history row — a straight read of the
@@ -9608,6 +10118,135 @@ var NcHistoryFilterSchema = object({
 	until: number().optional(),
 	limit: number().int().min(1).max(500).default(100)
 });
+/**
+* What a snooze covers. Broader scopes win when several overlap, so one window
+* leaves ONE digest rather than a rule snooze and a whole-feed snooze both
+* summarising the same silence.
+*/
+var NcSnoozeScopeSchema = _enum([
+	"rule",
+	"device",
+	"all"
+]);
+/**
+* Client-authored snooze. The server stamps `userId`, `startedAt` and
+* `expiresAt` — a DURATION is sent rather than an instant so a client with a
+* skewed clock cannot author a window that is already over, or never ends.
+*/
+var NcSnoozeInputSchema = object({
+	scope: NcSnoozeScopeSchema,
+	/** Required when `scope: 'rule'` — a scoped snooze with no id matches
+	*  NOTHING rather than degrading to "everything". */
+	ruleId: string().optional(),
+	/** Required when `scope: 'device'`. */
+	deviceId: number().int().optional(),
+	durationMinutes: number().int().min(1).max(1440),
+	/**
+	* Silence this for EVERY recipient, not just the caller. Permission is
+	* checked server-side (the rule's `snoozeAllowGlobal`, or admin for the
+	* broader scopes). Absent = personal.
+	*/
+	global: boolean().optional(),
+	/**
+	* Deliver a summary of what was suppressed when the window ends. Absent =
+	* ON: someone silencing a nuisance camera wants it off, someone silencing a
+	* SECURITY camera wants to know what they missed, and choosing "off" for
+	* everybody is how a snooze becomes an outage. Resolved to a concrete
+	* boolean by the server at create time — never left to a Zod default, which
+	* does not run on the addon cap path.
+	*/
+	summary: boolean().optional()
+});
+/** A persisted snooze window. */
+var NcSnoozeSchema = object({
+	id: string(),
+	/** Who set it. Also who it silences, unless `global`. */
+	userId: string(),
+	scope: NcSnoozeScopeSchema,
+	ruleId: string().optional(),
+	deviceId: number().int().optional(),
+	startedAt: number(),
+	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
+	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
+	expiresAt: number(),
+	global: boolean(),
+	summary: boolean(),
+	/** When the end-of-window digest went out. Absent = not sent (yet, or the
+	*  window has not closed, or `summary` is false). */
+	digestSentAt: number().optional()
+});
+object({
+	snoozeId: string(),
+	targetId: string(),
+	ruleId: string(),
+	ruleName: string(),
+	deviceId: number().int(),
+	/** How many notifications this snooze hid for that pair. */
+	count: number().int(),
+	firstAt: number(),
+	lastAt: number()
+});
+/**
+* The three durations the panel's state machine runs on, plus who hears about
+* an arm.
+*
+* They live on the NOTIFICATION-RULES cap, not on `alarm-panel`, on purpose:
+* `alarm-panel` is `deviceNative` and its other provider mirrors somebody
+* else's panel, which has its own delays and no way to be told these. This is
+* configuration of the panel CamStack owns, and the Notification Center owns
+* that panel.
+*/
+var NcAlarmSettingsSchema = object({
+	/** Grace period between arming and the mode taking effect. 0 = immediate. */
+	exitDelaySec: number().int().min(0).max(600),
+	/** Grace period between a trigger and the alarm firing. 0 = immediate. */
+	entryDelaySec: number().int().min(0).max(600),
+	/**
+	* How long `triggered` lasts before the panel re-arms itself.
+	* **0 = until an operator disarms it** — the behaviour before this field
+	* existed, and therefore what an untouched install keeps doing.
+	*/
+	triggeredDurationSec: number().int().min(0).max(3600),
+	/** Send a notification when a mode takes effect. */
+	announceArm: boolean(),
+	/**
+	* Where that notification goes. Target ids from `notification-output`.
+	*
+	* Explicit rather than "everyone": an arm announcement is a household
+	* message, and broadcasting it to every configured endpoint (including a
+	* webhook wired to something else) is not a default anybody would choose.
+	* Empty with `announceArm: true` sends nothing, and the server logs that —
+	* silence must be attributable.
+	*/
+	announceTargets: array(string().min(1)).max(16)
+});
+/** Every field optional — a tab edits one control at a time. */
+var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.partial();
+/**
+* What one arm mode actually arms, DERIVED from the enabled rules gated on it.
+* Never authored, never stored — see `alarm-mode-coverage.ts` for why a stored
+* copy would lie the first time a rule is disabled.
+*/
+var NcAlarmModeCoverageSchema = object({
+	mode: AlarmArmModeSchema,
+	/** Enabled rules gated on `armed_<mode>`. Zero means the mode does nothing. */
+	ruleCount: number().int().min(0),
+	/** At least one covering rule has no device scope, so the mode covers all. */
+	allDevices: boolean(),
+	/** Ids named by the covering rules. A SUBSET when `allDevices` is true. */
+	deviceIds: array(number().int())
+});
+var NcAlarmConfigSchema = object({
+	/**
+	* The panel's device id, or null when this install has no panel (the ensure
+	* step failed, or this is not the hub). Null is the honest answer: an editor
+	* that rendered delays for a panel that does not exist would be a form whose
+	* Save does nothing.
+	*/
+	deviceId: number().int().nullable(),
+	settings: NcAlarmSettingsSchema,
+	coverage: array(NcAlarmModeCoverageSchema)
+});
 method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), method(object({ ruleId: string() }), object({ rule: NcRuleSchema.nullable() }), { auth: "admin" }), method(object({ rule: NcRuleInputSchema }), object({ rule: NcRuleSchema }), {
 	kind: "mutation",
 	auth: "admin",
@@ -9637,7 +10276,16 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), method(object({}), object({
 	catalog: array(NcConditionDescriptorSchema),
 	taxonomy: NcTaxonomySchema.optional()
-})), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" });
+})), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" }), method(object({}), object({ snoozes: array(NcSnoozeSchema) }), { caller: "required" }), method(object({ snooze: NcSnoozeInputSchema }), object({ snooze: NcSnoozeSchema }), {
+	kind: "mutation",
+	caller: "required"
+}), method(object({ snoozeId: string() }), object({ success: literal(true) }), {
+	kind: "mutation",
+	caller: "required"
+}), method(object({}), NcAlarmConfigSchema, { auth: "admin" }), method(object({ patch: NcAlarmSettingsPatchSchema }), NcAlarmConfigSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -9845,72 +10493,6 @@ object({
 	precision: number().int().min(0).max(10).optional()
 });
 DeviceType.Sensor;
-/**
-* Alarm-panel cap. Models HA `alarm_control_panel.*` on
-* `DeviceType.AlarmPanel`. State follows HA's canonical lifecycle
-* across disarmed / armed_(home|away|night|vacation|custom_bypass) /
-* arming / pending / triggered / disarming.
-*
-* Many panels require a PIN code on arm / disarm — the optional
-* `code` field on the methods passes it through to the upstream
-* service; it's NEVER persisted in the runtime slice or any event
-* payload. The presence of a required code is signalled by
-* `DeviceFeature.AlarmPinRequired` so the UI gates a code-entry
-* field without a slice fetch.
-*
-* `availableModes` mirrors HA's `supported_features`-derived arm
-* mode list — the UI renders only the buttons the panel accepts.
-*/
-var AlarmStateSchema = _enum([
-	"disarmed",
-	"armed_home",
-	"armed_away",
-	"armed_night",
-	"armed_vacation",
-	"armed_custom_bypass",
-	"arming",
-	"disarming",
-	"pending",
-	"triggered"
-]);
-var AlarmArmModeSchema = _enum([
-	"home",
-	"away",
-	"night",
-	"vacation",
-	"custom_bypass"
-]);
-object({
-	/** Current lifecycle state. */
-	state: AlarmStateSchema,
-	/** Subset of arm modes the panel accepts. UI renders one button per
-	*  mode in this list. */
-	availableModes: array(AlarmArmModeSchema),
-	/** Whether the panel requires a PIN on arm / disarm. Mirrors
-	*  `DeviceFeature.AlarmPinRequired` for slice consumers. */
-	requiresCode: boolean(),
-	/** Ms epoch when the slice was last updated. */
-	lastChangedAt: number()
-});
-DeviceType.AlarmPanel, method(object({
-	deviceId: number().int().nonnegative(),
-	mode: AlarmArmModeSchema,
-	/** Optional PIN code. Required when `requiresCode === true`.
-	*  Passed through to the upstream service; never persisted. */
-	code: string().min(1).optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	code: string().min(1).optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
 object({
 	/** Current illuminance in lux (lx). */
 	lux: number().min(0),
@@ -10385,7 +10967,15 @@ method(object({
 	format: _enum(["gif", "mp4"]).default("gif"),
 	maxWidth: number().int().min(120).max(1920).default(480),
 	/** GIF only — MP4 keeps the source cadence. */
-	fps: number().int().min(1).max(15).default(5)
+	fps: number().int().min(1).max(15).default(5),
+	/**
+	* Playback rate. A notification clip is GLANCED at on a lock screen,
+	* not watched, so 2x is the default: the recipient sees the whole
+	* passage in half the time and the GIF is half the bytes. `1` is real
+	* time. Applies to MP4 as well — the operator set a speed, not a GIF
+	* speed.
+	*/
+	speed: number().min(1).max(8).default(2)
 }), object({
 	base64: string(),
 	mime: string(),
@@ -14967,6 +15557,20 @@ var GetInputSchema = object({ id: string() });
 var AddInputSchema = object({
 	kind: string().min(1),
 	name: string().min(1),
+	/**
+	* ADOPT an existing id instead of minting a new one.
+	*
+	* Written the day this cost an outage. A broker's id is not a detail: HA
+	* devices carry it inside their `stableId` (`ha:ha_004:dev:…`), so a broker
+	* lost from config and re-added as `ha_001` leaves every one of its devices
+	* bound to a broker that no longer exists. Re-entering the password under the
+	* ORIGINAL id turns a multi-step device migration back into re-entering a
+	* password.
+	*
+	* A provider MUST refuse an id that is already in use — adopting a live
+	* broker's id would silently take it over.
+	*/
+	id: string().min(1).optional(),
 	/** Kind-specific settings (e.g. MQTT `{url,username,password}` or HA
 	*  `{baseUrl,accessToken}`). Validated by the kind-specific provider
 	*  branch on receipt — invalid shape rejects the add. */
@@ -15130,6 +15734,210 @@ method(object({ codec: string() }), boolean()), method(_void(), object({
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* Query filter for settings-store collections.
+*/
+var QueryFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	orderBy: object({
+		field: string(),
+		direction: _enum(["asc", "desc"])
+	}).optional(),
+	limit: number().optional(),
+	offset: number().optional()
+});
+/**
+* The predicate half of a filter, for BULK MUTATIONS.
+*
+* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
+* meaning for a statement that rewrites a set, and accepting them would invite
+* a caller to believe `limit` bounds the damage. Every field is optional here
+* only so the shape stays composable — the implementation REJECTS a filter
+* that compiles to no predicate, because that is the whole collection.
+*/
+var MutationFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional()
+});
+/** A single stored record: `{ id, data }`. */
+var SettingsRecordSchema = object({
+	id: string(),
+	data: record(string(), unknown())
+});
+/**
+* Column declaration for a structured (SQL-backed) collection.
+*
+* Logical types — the backend translates each to the matching SQLite
+* storage class and handles per-type marshaling:
+*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
+*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
+*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
+*/
+var CollectionColumnSchema = object({
+	name: string(),
+	type: _enum([
+		"TEXT",
+		"INTEGER",
+		"REAL",
+		"JSON",
+		"BOOLEAN"
+	]),
+	primaryKey: boolean().optional(),
+	notNull: boolean().optional(),
+	unique: boolean().optional(),
+	/**
+	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
+	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
+	* collection surface simply cannot express their existing tables — which is
+	* why they were still on the uncapped `table*` API.
+	*/
+	defaultValue: union([
+		string(),
+		number(),
+		boolean()
+	]).optional()
+});
+var CollectionIndexSchema = object({
+	name: string(),
+	columns: array(string()).readonly(),
+	unique: boolean().optional()
+});
+method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), unknown()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string(),
+	value: unknown()
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), array(SettingsRecordSchema).readonly()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	record: SettingsRecordSchema
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	id: string(),
+	data: record(string(), unknown())
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema
+}), object({ deleted: number().int() }), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema,
+	data: record(string(), unknown())
+}), object({ updated: number().int() }), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), number()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	field: string(),
+	bucketSize: number().int().positive(),
+	origin: number().int(),
+	filter: QueryFilterSchema.optional()
+}), array(object({
+	bucket: number().int(),
+	count: number().int()
+})).readonly()), method(object({
+	namespace: string().optional(),
+	collection: string()
+}), boolean()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	columns: array(CollectionColumnSchema).readonly(),
+	indexes: array(CollectionIndexSchema).readonly().optional()
+}), _void(), { kind: "mutation" });
+/**
+* What one engine says about itself. The orchestrator uses `kind` to pick
+* a registrant for a collection; `engineId` is what a log line names when
+* a call is routed or refused.
+*/
+var EngineInfoSchema = object({
+	engineId: string(),
+	/**
+	* `relational` — rows, columns, indexes, the surface `settings-store`
+	* has always described. `vector` — an embedding store answering
+	* similarity queries. A registrant declares exactly one; an engine that
+	* does both registers twice, because "both" would make the routing
+	* decision ambiguous at exactly the point it must not be.
+	*/
+	kind: _enum(["relational", "vector"]),
+	displayName: string()
+});
+method(_void(), EngineInfoSchema), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), unknown()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string(),
+	value: unknown()
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), array(SettingsRecordSchema).readonly()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	record: SettingsRecordSchema
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	id: string(),
+	data: record(string(), unknown())
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema
+}), object({ deleted: number().int() }), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema,
+	data: record(string(), unknown())
+}), object({ updated: number().int() }), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), number()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	field: string(),
+	bucketSize: number().int().positive(),
+	origin: number().int(),
+	filter: QueryFilterSchema.optional()
+}), array(object({
+	bucket: number().int(),
+	count: number().int()
+})).readonly()), method(object({
+	namespace: string().optional(),
+	collection: string()
+}), boolean()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	columns: array(CollectionColumnSchema).readonly(),
+	indexes: array(CollectionIndexSchema).readonly().optional()
+}), _void(), { kind: "mutation" });
 DeviceType.Camera;
 /**
 * `device-adoption` — generic discovery + adoption surface,
@@ -15833,7 +16641,20 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ addonId: string() }), array(SavedDeviceRowSchema)), method(object({ addonId: string().optional() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
+}), method(object({ addonId: string() }), array(SavedDeviceRowSchema)), method(object({
+	addonId: string().optional(),
+	/**
+	* `slim` omits `config` (returned `{}`), `metadata` (null) and the
+	* `sourceInfo` derived from config — and skips the per-device settings
+	* read that produces them. Everything identifying a device (id, name,
+	* type, online, features, isCamera, parent/link ids) is unchanged.
+	* Do not use it for dispatch routing, which needs `sourceInfo`.
+	*/
+	projection: _enum(["full", "slim"]).optional(),
+	/** Return only camera devices. Filtering server-side instead of
+	*  shipping 293 rows to find 12. */
+	isCamera: boolean().optional()
+}), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
 	mode: DeviceLinkModeSchema,
 	devices: array(LinkedDeviceSchema)
 })), method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)), method(object({ deviceId: number() }), array(ConfigEntrySchema)), method(object({ deviceId: number() }), ConfigUISchemaOutput), method(object({
@@ -16272,14 +17093,14 @@ var LlmProfileSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$1 = unknown();
+var ConfigSchemaPassthrough = unknown();
 var LlmProfileKindDescriptorSchema = object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
-	configSchema: ConfigSchemaPassthrough$1
+	configSchema: ConfigSchemaPassthrough
 });
 var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
 var LlmDefaultSchema = object({
@@ -16810,227 +17631,102 @@ var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
 });
 method(_void(), NetworkEndpointSchema, { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), NetworkEndpointSchema.nullable()), method(_void(), NetworkAccessStatusSchema), method(_void(), array(NetworkEndpointEntrySchema).readonly());
 /**
-* notification-output — canonical, capability-gated notification delivery.
-*
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
-*
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
-*
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = _enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: string().optional(),
-	bytes: _instanceof(Uint8Array).optional(),
-	mime: string().optional(),
-	name: string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = _enum([
-	"text",
-	"markdown",
-	"html"
+* core-blocks — user-authored TypeScript, stored in the kernel and executed in
+* its own process.
+*
+* Spec: `docs/superpowers/specs/2026-08-04-core-blocks-and-synthetic-devices-design.md`.
+*
+* The first use is **owning devices without being a device provider**: a block
+* declares devices under a system or custom integration and drives their state,
+* with the same `ctx` an addon gets. Automations come later; nothing here
+* models a trigger.
+*
+* **Stated plainly, because it does not change by being true:** a block has an
+* addon's powers — devices, storage, the event bus, `ctx.api`. It is a plugin
+* with no review step. What makes that survivable is not a sandbox, it is
+* PROCESS ISOLATION: one process per block, supervised by `CrashSupervisor`,
+* so a block that throws or never returns is marked `failed` and visible
+* instead of taking the hub with it (D6). Every method here is admin-only, and
+* must stay so.
+*/
+/** Where a block runs. The operator chooses — a block driving a device on an
+*  agent is the reason placement is not fixed to the hub. */
+var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
+/** What a block's process is doing. Mirrors the addon runner's own lifecycle so
+*  a failing block reads the same way a failing addon does. */
+var CoreBlockStatusSchema = _enum([
+	"stopped",
+	"starting",
+	"running",
+	"failed"
 ]);
-/** A single tap-through action button. */
-var NotificationActionSchema = object({
-	id: string(),
-	label: string(),
-	url: string().optional()
-});
-/**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
-*/
-var NotificationSchema = object({
-	body: string(),
-	title: string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: number().int().min(1).max(5).default(3),
-	level: string().optional(),
-	attachments: array(AttachmentSchema).optional(),
-	clickUrl: string().optional(),
-	actions: array(NotificationActionSchema).optional(),
-	sound: string().optional(),
-	ttl: number().optional(),
-	tag: string().optional(),
-	deviceId: number().optional(),
-	eventId: string().optional(),
-	metadata: record(string(), unknown()).optional()
-});
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = object({
-	id: string(),
-	label: string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: number().int().min(1).max(5).nullable(),
-	flags: object({
-		critical: boolean().optional(),
-		silent: boolean().optional(),
-		noPush: boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: array(string()).optional(),
-	description: string().optional()
-});
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = object({
-	attachments: object({
-		mediaTypes: array(AttachmentMediaTypeSchema),
-		mode: _enum([
-			"url",
-			"bytes",
-			"both"
-		]),
-		max: number().int().nonnegative(),
-		maxBytes: number().int().positive().optional()
-	}),
-	/** Max action buttons (0 = none). */
-	actions: number().int().nonnegative(),
-	levels: array(TargetKindLevelSchema),
-	format: array(NotificationFormatSchema),
-	clickUrl: boolean(),
-	sound: boolean(),
-	ttl: boolean(),
-	bodyMaxLen: number().int().positive()
-});
-/**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
-*/
-var ConfigSchemaPassthrough = unknown();
-var TargetKindSchema = object({
-	kind: string(),
-	label: string(),
-	icon: string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: string(),
-	/**
-	* URL of the kind's bundled BRAND icon, served by the providing addon over
-	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
-	* when the addon bundles no icon for that kind — the client then falls back
-	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
-	*
-	* Root-relative on purpose: it resolves against whatever origin serves a web
-	* client, and a native client joins it onto its own hub base.
-	*
-	* DECLARED here deliberately. It used to travel as an undeclared passthrough
-	* field that survived only because the runtime cap-router forwards provider
-	* output verbatim — so every consumer had to re-declare it by hand to stop
-	* its own Zod parse from stripping it, and the whole arrangement would have
-	* broken silently the moment output validation was tightened anywhere.
-	*/
-	iconUrl: string().optional(),
+/** Client-authored fields. */
+var CoreBlockInputSchema = object({
+	name: string().min(1).max(120),
+	/** TypeScript source. Compiled server-side before it is ever stored — a
+	*  block that does not compile is a fork failure the operator would meet
+	*  minutes later, in a log, instead of in the editor. */
+	code: string().max(2e5),
+	enabled: boolean(),
+	placement: CoreBlockPlacementSchema,
 	/**
-	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
-	*
-	* The server knows this and therefore says it, because the client cannot
-	* safely guess: a React-Native client renders SVG and raster through two
-	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
-	* not decode SVG on iOS/Android), so without this it silently fell back to a
-	* placeholder glyph for every vector icon while the web build looked fine.
-	*
-	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
-	* not been updated — a client that cannot determine the type should prefer
-	* its raster path, which is the safe default for an unknown image.
+	* Integration the block's devices hang from. Absent = the system integration
+	* blocks share. A block may declare its own instead.
 	*/
-	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough,
-	supportsDiscovery: boolean(),
-	caps: TargetKindCapsSchema
+	integrationId: string().optional()
 });
-/**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
-*/
-var TargetSchema = object({
+/** A stored block. */
+var CoreBlockSchema = CoreBlockInputSchema.extend({
 	id: string(),
-	name: string(),
-	kind: string(),
-	addonId: string(),
-	enabled: boolean(),
-	config: record(string(), unknown())
-});
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = object({
-	kind: string(),
-	suggestedName: string(),
-	config: record(string(), unknown())
-});
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = object({
-	level: string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: number().int().nonnegative(),
-	actionsSent: number().int().nonnegative(),
-	truncated: boolean(),
-	dropped: array(string())
+	createdAt: number(),
+	updatedAt: number(),
+	/** Server-stamped author. */
+	createdBy: string(),
+	status: CoreBlockStatusSchema,
+	/**
+	* Why the block is not running, when it is not. The operator's ONLY window
+	* into a block that failed at load — a block that is silently absent is the
+	* failure mode this whole feature has to avoid.
+	*/
+	lastError: string().optional(),
+	/** Ms epoch of the last state change. */
+	lastChangedAt: number()
 });
-var SendResultSchema = object({
-	success: boolean(),
+/** What a compile attempt produced. */
+var CoreBlockCompileResultSchema = object({
+	ok: boolean(),
+	/** Present when `ok` is false — the first error, in the author's words. */
 	error: string().optional(),
-	renderedAs: RenderedAsSchema.optional()
+	line: number().optional(),
+	column: number().optional()
 });
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema)), method(object({
-	kind: string(),
-	config: record(string(), unknown()).optional()
-}), array(DiscoveredTargetSchema)), method(object({
-	targetId: string(),
-	notification: NotificationSchema
-}), SendResultSchema, { kind: "mutation" }), method(object({
-	targetId: string(),
-	sample: NotificationSchema.optional()
-}), TestResultSchema, { kind: "mutation" }), method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }), method(object({ targetId: string() }), _void(), { kind: "mutation" }), method(object({
-	targetId: string(),
+method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }), method(object({ blockId: string() }), object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }), method(object({ block: CoreBlockInputSchema }), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({
+	blockId: string(),
+	block: CoreBlockInputSchema.partial()
+}), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ blockId: string() }), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	blockId: string(),
 	enabled: boolean()
-}), _void(), { kind: "mutation" });
+}), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ code: string() }), CoreBlockCompileResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({ libs: array(object({
+	filePath: string(),
+	content: string()
+})) }), { auth: "admin" });
 /**
 * Zod schemas for persisted record types.
 *
@@ -17278,6 +17974,11 @@ var EventKindDescriptorSchema = object({
 		deviceId: number()
 	})
 });
+/** One camera's event vocabulary, as returned by `listEventKindsBatch`. */
+var EventKindsForDeviceSchema = object({
+	deviceId: number(),
+	kinds: array(EventKindDescriptorSchema).readonly()
+});
 var SensorEventSchema = object({
 	id: string(),
 	/** The CAMERA the event is attributed to (a sensor linked to N cameras
@@ -17534,6 +18235,19 @@ var MediaFileSchema = object({
 	sizeBytes: number(),
 	timestamp: number()
 });
+/**
+* One media row WITHOUT its bytes.
+*
+* A track's media is 5-8 MB of base64 (measured: 7.67 MB across 23 files for a
+* 140 s track), and a client that renders tiles from the media data plane needs
+* to know only WHAT EXISTS — the bytes then arrive per tile, lazily, over HTTP
+* with an immutable cache, instead of all at once inside a tRPC response that
+* blocks the whole view.
+*
+* `sizeBytes` is carried because it is what lets a client decide between the
+* stored blob and a `?variant=thumb` rendering without fetching either.
+*/
+var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
 var DEFAULT_EVENT_QUERY_LIMIT = 1e3;
 var MAX_EVENT_QUERY_LIMIT = 5e3;
 var DeviceEventQueryInput = object({
@@ -17683,7 +18397,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({
+}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({ deviceIds: array(number()).min(1).max(200) }), array(EventKindsForDeviceSchema).readonly()), method(object({
 	deviceId: number(),
 	since: number().optional(),
 	until: number().optional(),
@@ -17757,7 +18471,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(MediaFileSchema).readonly()), method(object({
 	trackId: string(),
 	kinds: array(MediaFileKindEnum).optional()
-}), array(MediaFileSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), object({
+}), array(MediaFileSchema).readonly()), method(object({ trackId: string() }), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), object({
 	deviceId: number(),
 	timestamp: number(),
 	frameWidth: number(),
@@ -18387,6 +19101,28 @@ var ServerUpdateStateSchema = _enum([
 	"pending-restart",
 	"awaiting-confirmation"
 ]);
+var ImageContractSchema = object({
+	state: _enum([
+		"in-sync",
+		"behind-patch",
+		"behind-series",
+		"ahead",
+		"unknown"
+	]),
+	/** The baked seed closure version — the image/app-bundle fingerprint. */
+	seedVersion: string().nullable(),
+	/** Best-known version the deployment contract delivers today. */
+	contractVersion: string().nullable(),
+	/**
+	* Where `contractVersion` came from: a real registry check (`registry`), or
+	* the node's own running version (`running` — a node can never run code
+	* newer than the newest release, so `seed < running` proves image staleness
+	* even before any registry check has run).
+	*/
+	contractSource: _enum(["registry", "running"]).nullable(),
+	/** One operator-grade sentence: this node runs image X; the contract says Y. */
+	message: string()
+});
 var ServerRollbackInfoSchema = object({
 	/** The version that failed (or was manually rolled back). */
 	fromVersion: string(),
@@ -18423,7 +19159,12 @@ var ServerPackageStatusSchema = object({
 	* versions are being IGNORED. Surfaced as a warning in the UI.
 	*/
 	stateFileCorrupt: boolean(),
-	lastCheckedAtMs: number().nullable()
+	lastCheckedAtMs: number().nullable(),
+	/**
+	* Seed-vs-contract verdict (see {@link ImageContractSchema}). Optional for
+	* version skew: an older provider's payload simply omits it.
+	*/
+	imageContract: ImageContractSchema.optional()
 });
 var ServerUpdateCheckResultSchema = object({
 	packageName: string(),
@@ -18458,101 +19199,6 @@ version: string().optional() }), ServerUpdateActionResultSchema, {
 	auth: "admin"
 });
 /**
-* Query filter for settings-store collections.
-*/
-var QueryFilterSchema = object({
-	where: record(string(), unknown()).optional(),
-	whereIn: record(string(), array(unknown())).optional(),
-	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
-	orderBy: object({
-		field: string(),
-		direction: _enum(["asc", "desc"])
-	}).optional(),
-	limit: number().optional(),
-	offset: number().optional()
-});
-/** A single stored record: `{ id, data }`. */
-var SettingsRecordSchema = object({
-	id: string(),
-	data: record(string(), unknown())
-});
-/**
-* Column declaration for a structured (SQL-backed) collection.
-*
-* Logical types — the backend translates each to the matching SQLite
-* storage class and handles per-type marshaling:
-*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
-*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
-*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
-*/
-var CollectionColumnSchema = object({
-	name: string(),
-	type: _enum([
-		"TEXT",
-		"INTEGER",
-		"REAL",
-		"JSON",
-		"BOOLEAN"
-	]),
-	primaryKey: boolean().optional(),
-	notNull: boolean().optional(),
-	unique: boolean().optional()
-});
-var CollectionIndexSchema = object({
-	name: string(),
-	columns: array(string()).readonly(),
-	unique: boolean().optional()
-});
-method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), unknown()), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string(),
-	value: unknown()
-}), _void(), { kind: "mutation" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional()
-}), array(SettingsRecordSchema).readonly()), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	record: SettingsRecordSchema
-}), _void(), { kind: "mutation" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	id: string(),
-	data: record(string(), unknown())
-}), _void(), { kind: "mutation" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), _void(), { kind: "mutation" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional()
-}), number()), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	field: string(),
-	bucketSize: number().int().positive(),
-	origin: number().int(),
-	filter: QueryFilterSchema.optional()
-}), array(object({
-	bucket: number().int(),
-	count: number().int()
-})).readonly()), method(object({
-	namespace: string().optional(),
-	collection: string()
-}), boolean()), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	columns: array(CollectionColumnSchema).readonly(),
-	indexes: array(CollectionIndexSchema).readonly().optional()
-}), _void(), { kind: "mutation" });
-/**
 * `smtp-provider` — pluggable email delivery surface.
 *
 * Collection cap: a deployment may install multiple SMTP relays (e.g.
@@ -22415,6 +23061,54 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"coreBlocks.compile": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"coreBlocks.create": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"coreBlocks.delete": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"coreBlocks.get": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"coreBlocks.getTypeDefs": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"coreBlocks.list": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"coreBlocks.setEnabled": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"coreBlocks.update": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"cover.close": {
 		capName: "cover",
 		capScope: "device",
@@ -22451,6 +23145,84 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"dataStoreProvider.count": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.declareCollection": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"dataStoreProvider.delete": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"dataStoreProvider.deleteWhere": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"dataStoreProvider.get": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.getEngineInfo": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.histogram": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.insert": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"dataStoreProvider.isEmpty": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.query": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.set": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"dataStoreProvider.update": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"dataStoreProvider.updateWhere": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dayNight.getOptions": {
 		capName: "day-night",
 		capScope: "device",
@@ -24245,18 +25017,36 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.cancelSnooze": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.createRule": {
 		capName: "notification-rules",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.createSnooze": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.deleteRule": {
 		capName: "notification-rules",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"notificationRules.getAlarmConfig": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.getConditionCatalog": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -24281,6 +25071,18 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.listSnoozes": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationRules.setAlarmConfig": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.setRuleEnabled": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -24485,6 +25287,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listEventKindsBatch": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listOpsLog": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -24497,6 +25305,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listTrackMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -25529,6 +26343,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"settingsStore.deleteWhere": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"settingsStore.get": {
 		capName: "settings-store",
 		capScope: "system",
@@ -25571,6 +26391,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.updateWhere": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"smtpProvider.getStatus": {
 		capName: "smtp-provider",
 		capScope: "system",
@@ -37338,10 +38164,12 @@ async function prepareStream(request, sessions, bctx) {
 		profile: import_src.ProtectionProfileAes128CmHmacSha1_80
 	});
 	let videoOutSrtp;
+	let videoOutSrtcp;
 	let audioOutSrtp;
 	let audioOutSrtcp;
 	try {
 		videoOutSrtp = makeOutSrtp(request.video.srtp_key, request.video.srtp_salt);
+		videoOutSrtcp = makeOutSrtcp(request.video.srtp_key, request.video.srtp_salt);
 		audioOutSrtp = makeOutSrtp(request.audio.srtp_key, request.audio.srtp_salt);
 		audioOutSrtcp = makeOutSrtcp(request.audio.srtp_key, request.audio.srtp_salt);
 	} catch (err) {
@@ -37375,6 +38203,12 @@ async function prepareStream(request, sessions, bctx) {
 		videoUdp,
 		videoLoopUdp,
 		videoOutSrtp,
+		videoOutSrtcp,
+		videoOutPacketCount: 0,
+		videoOutOctetCount: 0,
+		videoOutLastRtpTimestamp: 0,
+		videoOutLastRtcpAt: 0,
+		videoRtcpIntervalMs: 5e3,
 		videoSendGate: null,
 		videoSsrc,
 		hapAudioPort: request.audio.port,
@@ -37419,9 +38253,7 @@ async function prepareStream(request, sessions, bctx) {
 	audioLoopUdp.on("message", (rtpPacket) => {
 		audioPacketsForwarded += 1;
 		if (audioPacketsForwarded === 1 || audioPacketsForwarded % 100 === 0) tagLog.info("export-hap: audio loopback packets forwarded", { meta: { count: audioPacketsForwarded } });
-		if (audioPacketsForwarded === 1) process.stderr.write(`[AUDIO-LISTENER] first packet — about to call forwardEncryptedRtp len=${rtpPacket.length} typeofFn=${typeof forwardEncryptedRtp}\n`);
 		forwardEncryptedRtp(session, rtpPacket, "audio", tagLog);
-		if (audioPacketsForwarded === 1) process.stderr.write("[AUDIO-LISTENER] forwardEncryptedRtp returned for first packet\n");
 	});
 	audioUdp.on("message", (packet, rinfo) => {
 		handleIncomingAudioRtp(session, packet, rinfo.address, bctx).catch((err) => {
@@ -37543,32 +38375,48 @@ function ntpTime() {
 	return secs << 32n | frac;
 }
 /**
-* Emit one RTCP Sender Report for the downstream audio leg. Carries
-* the cumulative packet + octet counts plus the (NTP, RTP) timestamp
-* pair that lets iOS align speaker playback against wall-clock time.
-* Encrypted via the per-session SRTCP context (same master key/salt
-* pair as the SRTP audio session) and sent to the same `(hapAddress,
-* hapAudioPort)` the SRTP packets go to.
+* Emit one RTCP Sender Report for a downstream leg. Carries the cumulative
+* packet + octet counts plus the (NTP, RTP) timestamp pair the controller
+* needs to anchor that leg against wall-clock time. Encrypted via the leg's
+* SRTCP context (same master key/salt pair as its SRTP session) and sent to
+* the same `(hapAddress, port)` the SRTP packets go to.
+*
+* BOTH legs need this, not just audio. HAP negotiates `rtcp_interval`
+* separately for video and audio, and a Sender Report is the only thing that
+* pairs an NTP instant with an RTP timestamp — without it the controller
+* cannot place the stream on a clock. The audio leg alone was covered for a
+* year (the speaker went mute without it, which made the omission visible);
+* the video leg has the same requirement and no equally loud symptom.
 */
-function sendAudioRtcpSr(session, log) {
-	if (!session.audioOutSrtcp) return;
+function sendRtcpSr(session, kind, log) {
+	const srtcp = kind === "video" ? session.videoOutSrtcp : session.audioOutSrtcp;
+	if (!srtcp) return;
+	const sink = kind === "video" ? session.videoUdp : session.audioUdp;
+	const port = kind === "video" ? session.hapVideoPort : session.hapAudioPort;
 	try {
 		const sr = new import_src.RtcpSrPacket({
-			ssrc: session.audioOutSsrc,
+			ssrc: kind === "video" ? session.videoSsrc : session.audioOutSsrc,
 			senderInfo: new import_src.RtcpSenderInfo({
 				ntpTimestamp: ntpTime(),
-				rtpTimestamp: session.audioOutLastRtpTimestamp,
-				packetCount: session.audioOutPacketCount,
-				octetCount: session.audioOutOctetCount
+				rtpTimestamp: kind === "video" ? session.videoOutLastRtpTimestamp : session.audioOutLastRtpTimestamp,
+				packetCount: kind === "video" ? session.videoOutPacketCount : session.audioOutPacketCount,
+				octetCount: kind === "video" ? session.videoOutOctetCount : session.audioOutOctetCount
 			})
 		});
-		const encrypted = session.audioOutSrtcp.encrypt(sr.serialize());
-		session.audioUdp.send(encrypted, session.hapAudioPort, session.hapAddress, (err) => {
-			if (err) log.debug("export-hap: audio RTCP send error", { meta: { error: err.message } });
+		const encrypted = srtcp.encrypt(sr.serialize());
+		sink.send(encrypted, port, session.hapAddress, (err) => {
+			if (err) log.debug("export-hap: RTCP send error", { meta: {
+				kind,
+				error: err.message
+			} });
 		});
-		session.audioOutLastRtcpAt = Date.now();
+		if (kind === "video") session.videoOutLastRtcpAt = Date.now();
+		else session.audioOutLastRtcpAt = Date.now();
 	} catch (err) {
-		log.debug("export-hap: audio RTCP SR build/encrypt failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		log.debug("export-hap: RTCP SR build/encrypt failed", { meta: {
+			kind,
+			error: err instanceof Error ? err.message : String(err)
+		} });
 	}
 }
 /**
@@ -37587,21 +38435,18 @@ function forwardEncryptedRtp(session, rtpPacket, kind, log) {
 	const sink = kind === "video" ? session.videoUdp : session.audioUdp;
 	const port = kind === "video" ? session.hapVideoPort : session.hapAudioPort;
 	const gate = kind === "video" ? session.videoSendGate : session.audioSendGate;
-	if (kind === "audio" && session.audioOutPacketCount === 0) {
-		process.stderr.write(`[FORWARD-AUDIO-DIAG] hasSrtp=${!!srtp} hasGate=${!!gate} audioOutSsrc=${session.audioOutSsrc} scale=${session.audioIntervalScale} hasStartParams=${!!session.lastStartParams}\n`);
-		log.info("export-hap: forwardEncryptedRtp audio entry diag", { meta: {
-			hasSrtp: !!srtp,
-			hasGate: !!gate,
-			audioOutSsrc: session.audioOutSsrc,
-			audioIntervalScale: session.audioIntervalScale,
-			hasLastStartParams: !!session.lastStartParams
-		} });
-	}
 	if (!srtp || !gate) return;
 	gate.then(() => {
 		try {
 			const parsed = import_src.RtpPacket.deSerialize(rtpPacket);
 			let firstAudio = false;
+			let firstVideo = false;
+			if (kind === "video") {
+				if (session.videoOutPacketCount === 0) firstVideo = true;
+				session.videoOutPacketCount += 1;
+				session.videoOutOctetCount += parsed.payload.length;
+				session.videoOutLastRtpTimestamp = parsed.header.timestamp;
+			}
 			if (kind === "audio") {
 				const originalTimestamp = parsed.header.timestamp;
 				if (session.firstAudioOutTimestamp === null) {
@@ -37631,9 +38476,10 @@ function forwardEncryptedRtp(session, rtpPacket, kind, log) {
 					error: err.message
 				} });
 			});
-			if (kind === "audio") {
-				if (firstAudio || Date.now() > session.audioOutLastRtcpAt + session.audioRtcpIntervalMs) sendAudioRtcpSr(session, log);
-			}
+			const now = Date.now();
+			if (kind === "video") {
+				if (firstVideo || now > session.videoOutLastRtcpAt + session.videoRtcpIntervalMs) sendRtcpSr(session, "video", log);
+			} else if (firstAudio || now > session.audioOutLastRtcpAt + session.audioRtcpIntervalMs) sendRtcpSr(session, "audio", log);
 		} catch (err) {
 			log.debug("export-hap: SRTP encrypt failed", { meta: {
 				kind,
@@ -37671,6 +38517,11 @@ async function handleStreamRequest(request, sessions, bctx) {
 		session.audioOutLastRtpTimestamp = 0;
 		session.audioOutLastRtcpAt = 0;
 		session.audioRtcpIntervalMs = (request.audio.rtcp_interval > 0 ? request.audio.rtcp_interval : 5) * 1e3;
+		session.videoRtcpIntervalMs = (request.video.rtcp_interval > 0 ? request.video.rtcp_interval : 5) * 1e3;
+		session.videoOutPacketCount = 0;
+		session.videoOutOctetCount = 0;
+		session.videoOutLastRtpTimestamp = 0;
+		session.videoOutLastRtcpAt = 0;
 		session.lastStartParams = {
 			pt: request.video.pt,
 			mtu: request.video.mtu,
@@ -37702,6 +38553,10 @@ async function handleStreamRequest(request, sessions, bctx) {
 		if (session.ffmpeg) killFfmpeg(session, bctx.ctx, bctx.numericDeviceId);
 		session.firstAudioOutTimestamp = null;
 		session.audioOutPacketCount = 0;
+		session.videoOutPacketCount = 0;
+		session.videoOutOctetCount = 0;
+		session.videoOutLastRtpTimestamp = 0;
+		session.videoOutLastRtcpAt = 0;
 		const startParams = {
 			width: request.video.width,
 			height: request.video.height,