@camstack/addon-notifiers 1.2.11 → 1.2.13

package/dist/addon.js

@@ -29,7 +29,7 @@ let node_fs = require("node:fs");
 let node_path = require("node:path");
 node_path = __toESM(node_path);
 let node_url = require("node:url");
-//#region ../types/dist/event-category-Bz24uP1U.mjs
+//#region ../types/dist/event-category-41fKf-q9.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -89,6 +89,26 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AddonRetryScheduled"] = "addon.retry-scheduled";
 	/**
+	* A liveness invariant of this node is false — it has no devices, every
+	* camera is offline, or a camera that was recording has stopped producing
+	* segments. Emitted by the `liveness-monitor` builtin, once per fault (the
+	* `findingId` is stable across ticks), only after its boot grace period.
+	* AlertCenter raises a persistent operator-visible alert.
+	*
+	* It exists because on 2026-08-03 the hub ran four hours with zero devices
+	* and zero recordings while every surface stayed quiet.
+	*
+	* Payload: `{ findingId, severity, title, message, deviceId? }`.
+	*/
+	EventCategory["SystemLivenessFailed"] = "system.liveness-failed";
+	/**
+	* A previously reported liveness fault is true again. AlertCenter dismisses
+	* the matching `SystemLivenessFailed` alert.
+	*
+	* Payload: `{ findingId }`.
+	*/
+	EventCategory["SystemLivenessRecovered"] = "system.liveness-recovered";
+	/**
 	* Monitor is attempting to reload a failed addon NOW. UI uses this
 	* to show a spinner during the retry attempt. Same transient nature
 	* as AddonRetryScheduled.
@@ -7456,14 +7476,7 @@ var RecordingConfigSchema = object({
 	* windows only — existing sheets are immutable, and each window's index
 	* carries its own tile dims so mixed-preset history renders correctly.
 	*/
-	scrubThumbnails: ScrubThumbnailPresetSchema.optional(),
-	/**
-	* OPT-IN thumbnail-strip generation for this camera: every keyframe of the
-	* low recording saved as a JPEG (the fast-drag scrub depth), a derived
-	* cache that eviction reclaims with the footage. Absent/false = no strips
-	* are written and scrub reads exact keyframes at every velocity.
-	*/
-	stripsEnabled: boolean().optional()
+	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
 }).strict();
 /**
 * Ops-log — the durable, append-only operations audit shared by the
@@ -7525,7 +7538,7 @@ var OpsLogQueryInputSchema = object({
 /**
 * Entity-relocation job state (storage entity-routing spec, Phase 4).
 *
-* One shape shared by the recorder's `relocateFootage` (segments + strips) and
+* One shape shared by the recorder's `relocateFootage` (segments) and
 * pipeline-analytics' `relocateMedia` (event media blobs) so the admin Data
 * page renders both movers with one component. Jobs are in-RAM (a restart
 * forgets them — re-running is safe by construction: copy-if-absent, delete
@@ -7547,7 +7560,7 @@ var RelocateJobSchema = object({
 	toLocationId: string(),
 	/** Scoped device, or null = every device. */
 	deviceId: number().nullable(),
-	/** What the job moves (owner-addon specific: segments/strips or media). */
+	/** What the job moves (owner-addon specific: segments or media). */
 	entities: array(string()),
 	filesMoved: number().int(),
 	bytesMoved: number().int(),
@@ -7561,7 +7574,7 @@ var RelocateFootageInputSchema = object({
 	deviceId: number().optional(),
 	fromLocationId: string(),
 	toLocationId: string(),
-	entities: array(_enum(["segments", "strips"])).optional(),
+	entities: array(_enum(["segments"])).optional(),
 	/** Copy throttle in MB/s (default 40) — the drain is a background chore,
 	*  never allowed to starve live writers. */
 	throttleMbps: number().min(1).max(1e3).optional()
@@ -9223,8 +9236,11 @@ function prepareNotification(caps, n) {
 		});
 	}
 	const inActions = n.actions ?? [];
-	const actions = inActions.slice(0, Math.max(0, caps.actions));
-	if (inActions.length > actions.length) dropped.push("actions");
+	const kept = inActions.slice(0, Math.max(0, caps.actions));
+	if (inActions.length > kept.length) dropped.push("actions");
+	const iconsSupported = caps.actionIcons === true;
+	if (!iconsSupported && kept.some((a) => a.icon !== void 0)) dropped.push("actionIcons");
+	const actions = iconsSupported ? kept : kept.map(({ icon: _icon, ...rest }) => rest);
 	let clickUrl = null;
 	if (n.clickUrl !== void 0) if (caps.clickUrl) clickUrl = n.clickUrl;
 	else dropped.push("clickUrl");
@@ -9323,160 +9339,552 @@ var MaskGridDimsSchema = object({
 	height: number()
 });
 /**
-* notification-rules — the Notification Center rule surface (P1 core).
-*
-* Spec: `docs/superpowers/specs/2026-07-22-notification-center-requirements.md`
-* (operator decisions D-1/D-2/D-3 are binding):
+* notification-output — canonical, capability-gated notification delivery.
 *
-*  - D-2: rule EVALUATION lives in `addon-post-analysis` (the
-*    `notification-center` module), hooked on the durable persistence
-*    moments (object-event insert, TrackCloser.closeExpired) with a
-*    persisted outbox + retry — never the lossy telemetry bus (D8).
-*  - D-3: urgency belongs to the RULE. `delivery: 'immediate'` fires on the
-*    FIRST persisted detection matching the conditions (per-track dedup,
-*    `maxPerTrack` fixed at 1 — see {@link NC_MAX_PER_TRACK_IMMEDIATE});
-*    `delivery: 'track-end'` evaluates the finalized track record at close.
-*  - DISPATCH stays behind `notification-output` (rules reference targets
-*    by id; per-backend params are a passthrough blob capped by the
-*    target kind's own caps/degrade engine).
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
 *
-* P1 scope: admin-authored rules only (`createdBy` stamped from the
-* server-injected caller identity — the first `caller: 'required'`
-* adopter). The P1 condition subset is: devices, classes(+exclude),
-* minConfidence, admin zones (any/all + exclude), weekly schedule
-* windows, and the optional label/identity/plate matchers. User rules,
-* private zones, per-recipient fan-out and the wider condition table are
-* P2+ (see spec §7).
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
 *
-* All schemas here are the single source of truth — `NcRule` etc. are
-* `z.infer` exports; no duplicate interfaces (the advanced-notifier
-* schema/interface drift is explicitly not repeated).
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
 */
 /**
-* D-3: the trigger/urgency of a rule — which persistence moment evaluates it.
-* The value maps 1:1 onto the evaluated record kind:
-*  - `immediate`     ↔ object-event persist (lowest-latency detection burst)
-*  - `track-end`     ↔ TrackCloser.closeExpired (finalized track record)
-*  - `device-event`  ↔ SensorEventStore insert (doorbell press / sensor state
-*                       change of a LINKED device, one row per linked camera)
-*  - `package-event` ↔ PackageDropDetector object-event insert (a `package`
-*                       delivery / pick-up)
-*
-* `immediate`/`track-end` carry the D-3 urgency semantics; `device-event`/
-* `package-event` are pure trigger kinds (no urgency dimension). Extending
-* this one field keeps the schema additive — a rule still declares exactly
-* one trigger.
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
 */
-var NcDeliverySchema = _enum([
-	"immediate",
-	"track-end",
-	"device-event",
-	"package-event"
+var AttachmentMediaTypeSchema = _enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
 ]);
-/** Weekly schedule — OR of windows; absence on the rule = always active. */
-var NcScheduleSchema = object({
-	windows: array(object({
-		/** Days of week the window STARTS on (0 = Sunday … 6 = Saturday). */
-		days: array(number().int().min(0).max(6)).min(1),
-		startMinute: number().int().min(0).max(1439),
-		endMinute: number().int().min(0).max(1439)
-	})).min(1),
-	/** IANA timezone; default = hub host timezone. */
-	timezone: string().optional(),
-	/** Active OUTSIDE the windows (e.g. "only outside business hours"). */
-	invert: boolean().optional()
-});
-/** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
-var NcPlateMatcherSchema = object({
-	values: array(string().min(1)).min(1),
-	/** Max Levenshtein distance after normalization (uppercase alphanumeric). */
-	maxDistance: number().int().min(0).max(3).default(1)
-});
 /**
-* Occupancy condition (DEVICE-EVENT trigger). Fires on a ZoneAnalytics
-* occupancy edge for a device — optionally narrowed to a single admin
-* `zoneId` and/or object `className`. `op` selects the edge/threshold:
-*  - `became-occupied` (default) — count crossed 0 → ≥ `count`
-*  - `became-free`               — count crossed ≥ `count` → below it
-*  - `>=` / `<=`                 — count is at/over or at/under `count`
-* `sustainSeconds` requires the condition hold continuously that long
-* before firing (debounces flicker; 0 = fire on the first matching edge).
-* Fail-closed: no ZoneAnalytics snapshot / missing zone / null snapshot ⇒
-* the condition never matches. Confirmed edge-state survives addon restarts
-* (declared SQLite collection, reseeded on boot).
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
 */
-var NcOccupancyConditionSchema = object({
-	/** Admin zone id to scope the count to; absent = whole-frame occupancy. */
-	zoneId: string().optional(),
-	/** Object class to count; absent = any class. */
-	className: string().optional(),
-	op: _enum([
-		"became-occupied",
-		"became-free",
-		">=",
-		"<="
-	]).default("became-occupied"),
-	count: number().int().min(0).default(1),
-	sustainSeconds: number().int().min(0).max(3600).default(15)
-});
+var AttachmentSchema = object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: string().optional(),
+	bytes: _instanceof(Uint8Array).optional(),
+	mime: string().optional(),
+	name: string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = _enum([
+	"text",
+	"markdown",
+	"html"
+]);
 /**
-* Which zone-crossing DIRECTION a rule accepts (`ObjectEvent.zoneCrossing`).
+* The CLOSED icon vocabulary an action button may use.
 *
-* The values are not symmetric, and deliberately so — the absent value has to
-* mean exactly what every rule authored before this condition existed already
-* does:
-*  - `enter` — entries and every NON-crossing record (movement state,
-*    package, sensor). Exits are rejected. **This is the absent behaviour**:
-*    an operator who never asked for exits must not start receiving them.
-*  - `exit`  — ONLY an exit crossing. A record that is not a crossing at all
-*    fails closed, because "the car left the drive" is a question about a
-*    boundary, not about a detection.
-*  - `any`   — no direction filter; entries, exits and non-crossings alike.
+* A closed set, not a free string, and that is the whole point: an arbitrary
+* icon name is one that ntfy renders, zentik silently drops, and nobody
+* notices — the same class of gap as a zone vocabulary nothing produced
+* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
+* declares `actionIcons: false` and the degrade engine strips the field.
 *
-* A rule asking for a direction should normally also scope `zones`, which the
-* engine evaluates against the crossed zone as well as the current membership
-* (an exit's membership no longer contains the zone it just left).
+* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
+* renderer's icon set; "acknowledge" survives an adapter that draws it
+* differently.
 */
-var NcCrossingSchema = _enum([
-	"enter",
-	"exit",
-	"any"
+var NotificationActionIconSchema = _enum([
+	"acknowledge",
+	"dismiss",
+	"silence",
+	"view",
+	"play",
+	"open",
+	"close",
+	"lock",
+	"unlock",
+	"arm",
+	"disarm",
+	"light",
+	"alert"
 ]);
-/** Admin-zone membership condition (zone IDs as stamped by the ZoneEngine). */
-var NcZoneConditionSchema = object({
-	ids: array(string().min(1)).min(1),
-	/** Quantifier over `ids` — at least one / every one visited. */
-	match: _enum(["any", "all"]).default("any")
+/** A single tap-through action button. */
+var NotificationActionSchema = object({
+	id: string(),
+	label: string(),
+	url: string().optional(),
+	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
+	icon: NotificationActionIconSchema.optional(),
+	/**
+	* Renders in a warning style where the notifier supports it.
+	*
+	* A HINT, never a gate. The callback's authority is its token and nothing
+	* else — see `notification-center/action-token.ts` for what that does and
+	* does not buy.
+	*/
+	destructive: boolean().optional()
 });
 /**
-* The P1 condition set — a flat AND of groups; absent group = pass;
-* membership lists are OR within the list (spec §2.3).
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
 */
-var NcConditionsSchema = object({
-	/** Device scope — absent = all devices. */
-	devices: array(number()).optional(),
-	/** Detector class names (any overlap with the record's class set). */
-	classes: array(string().min(1)).optional(),
-	/** Veto classes — any overlap fails the rule. */
-	classesExclude: array(string().min(1)).optional(),
-	/** Minimum detection confidence 0–1 (fails when the record has none). */
-	minConfidence: number().min(0).max(1).optional(),
-	/** Admin zone membership over event `zones` / track `zonesVisited`. */
-	zones: NcZoneConditionSchema.optional(),
-	/** Veto zones — any hit fails the rule. */
-	zonesExclude: array(string().min(1)).optional(),
-	/**
-	* Zone-crossing direction. IMMEDIATE only — a crossing is a per-event fact
-	* and a closed track carries none, so a `track-end` rule asking for one
-	* fails closed (use `zones`, which tests `zonesVisited`). ABSENT = `enter`,
-	* which is exactly today's behaviour. See {@link NcCrossingSchema}.
-	*/
-	crossing: NcCrossingSchema.optional(),
+var NotificationSchema = object({
+	body: string(),
+	title: string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: number().int().min(1).max(5).default(3),
+	level: string().optional(),
+	attachments: array(AttachmentSchema).optional(),
+	clickUrl: string().optional(),
+	actions: array(NotificationActionSchema).optional(),
+	sound: string().optional(),
+	ttl: number().optional(),
+	tag: string().optional(),
+	deviceId: number().optional(),
+	eventId: string().optional(),
+	metadata: record(string(), unknown()).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = object({
+	id: string(),
+	label: string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: number().int().min(1).max(5).nullable(),
+	flags: object({
+		critical: boolean().optional(),
+		silent: boolean().optional(),
+		noPush: boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: array(string()).optional(),
+	description: string().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = object({
+	attachments: object({
+		mediaTypes: array(AttachmentMediaTypeSchema),
+		mode: _enum([
+			"url",
+			"bytes",
+			"both"
+		]),
+		max: number().int().nonnegative(),
+		maxBytes: number().int().positive().optional()
+	}),
+	/** Max action buttons (0 = none). */
+	actions: number().int().nonnegative(),
 	/**
-	* Exact (case-insensitive) match on the record's collapsed `label`
-	* (identity name / plate text / subclass).
+	* Whether this kind renders a per-action ICON.
+	*
+	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
+	* run on the addon cap path — three production failures in one day taught
+	* this repo that once. Absent is read as false by the degrade engine, which
+	* is the safe direction: an icon that is not rendered costs nothing, an icon
+	* assumed and dropped costs the operator's trust in the field.
 	*/
-	labelEquals: array(string().min(1)).optional(),
+	actionIcons: boolean().optional(),
+	levels: array(TargetKindLevelSchema),
+	format: array(NotificationFormatSchema),
+	clickUrl: boolean(),
+	sound: boolean(),
+	ttl: boolean(),
+	bodyMaxLen: number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough$1 = unknown();
+var TargetKindSchema = object({
+	kind: string(),
+	label: string(),
+	icon: string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: string().optional(),
+	configSchema: ConfigSchemaPassthrough$1,
+	supportsDiscovery: boolean(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = object({
+	id: string(),
+	name: string(),
+	kind: string(),
+	addonId: string(),
+	enabled: boolean(),
+	config: record(string(), unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = object({
+	kind: string(),
+	suggestedName: string(),
+	config: record(string(), unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = object({
+	level: string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: number().int().nonnegative(),
+	actionsSent: number().int().nonnegative(),
+	truncated: boolean(),
+	dropped: array(string())
+});
+var SendResultSchema = object({
+	success: boolean(),
+	error: string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+var notificationOutputCapability = {
+	name: "notification-output",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		listTargetKinds: method(object({}), array(TargetKindSchema)),
+		listTargets: method(object({}), array(TargetSchema)),
+		discoverTargets: method(object({
+			kind: string(),
+			config: record(string(), unknown()).optional()
+		}), array(DiscoveredTargetSchema)),
+		send: method(object({
+			targetId: string(),
+			notification: NotificationSchema
+		}), SendResultSchema, { kind: "mutation" }),
+		testTarget: method(object({
+			targetId: string(),
+			sample: NotificationSchema.optional()
+		}), TestResultSchema, { kind: "mutation" }),
+		upsertTarget: method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }),
+		deleteTarget: method(object({ targetId: string() }), _void(), { kind: "mutation" }),
+		setTargetEnabled: method(object({
+			targetId: string(),
+			enabled: boolean()
+		}), _void(), { kind: "mutation" })
+	}
+};
+/**
+* notification-rules — the Notification Center rule surface (P1 core).
+*
+* Spec: `docs/superpowers/specs/2026-07-22-notification-center-requirements.md`
+* (operator decisions D-1/D-2/D-3 are binding):
+*
+*  - D-2: rule EVALUATION lives in `addon-post-analysis` (the
+*    `notification-center` module), hooked on the durable persistence
+*    moments (object-event insert, TrackCloser.closeExpired) with a
+*    persisted outbox + retry — never the lossy telemetry bus (D8).
+*  - D-3: urgency belongs to the RULE. `delivery: 'immediate'` fires on the
+*    FIRST persisted detection matching the conditions (per-track dedup,
+*    `maxPerTrack` fixed at 1 — see {@link NC_MAX_PER_TRACK_IMMEDIATE});
+*    `delivery: 'track-end'` evaluates the finalized track record at close.
+*  - DISPATCH stays behind `notification-output` (rules reference targets
+*    by id; per-backend params are a passthrough blob capped by the
+*    target kind's own caps/degrade engine).
+*
+* P1 scope: admin-authored rules only (`createdBy` stamped from the
+* server-injected caller identity — the first `caller: 'required'`
+* adopter). The P1 condition subset is: devices, classes(+exclude),
+* minConfidence, admin zones (any/all + exclude), weekly schedule
+* windows, and the optional label/identity/plate matchers. User rules,
+* private zones, per-recipient fan-out and the wider condition table are
+* P2+ (see spec §7).
+*
+* All schemas here are the single source of truth — `NcRule` etc. are
+* `z.infer` exports; no duplicate interfaces (the advanced-notifier
+* schema/interface drift is explicitly not repeated).
+*/
+/**
+* D-3: the trigger/urgency of a rule — which persistence moment evaluates it.
+* The value maps 1:1 onto the evaluated record kind:
+*  - `immediate`     ↔ object-event persist (lowest-latency detection burst)
+*  - `track-end`     ↔ TrackCloser.closeExpired (finalized track record)
+*  - `device-event`  ↔ SensorEventStore insert (doorbell press / sensor state
+*                       change of a LINKED device, one row per linked camera)
+*  - `package-event` ↔ PackageDropDetector object-event insert (a `package`
+*                       delivery / pick-up)
+*
+* `immediate`/`track-end` carry the D-3 urgency semantics; `device-event`/
+* `package-event` are pure trigger kinds (no urgency dimension). Extending
+* this one field keeps the schema additive — a rule still declares exactly
+* one trigger.
+*/
+var NcDeliverySchema = _enum([
+	"immediate",
+	"track-end",
+	"device-event",
+	"package-event"
+]);
+/** Weekly schedule — OR of windows; absence on the rule = always active. */
+var NcScheduleSchema = object({
+	windows: array(object({
+		/** Days of week the window STARTS on (0 = Sunday … 6 = Saturday). */
+		days: array(number().int().min(0).max(6)).min(1),
+		startMinute: number().int().min(0).max(1439),
+		endMinute: number().int().min(0).max(1439)
+	})).min(1),
+	/** IANA timezone; default = hub host timezone. */
+	timezone: string().optional(),
+	/** Active OUTSIDE the windows (e.g. "only outside business hours"). */
+	invert: boolean().optional()
+});
+/** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
+var NcPlateMatcherSchema = object({
+	values: array(string().min(1)).min(1),
+	/** Max Levenshtein distance after normalization (uppercase alphanumeric). */
+	maxDistance: number().int().min(0).max(3).default(1)
+});
+/**
+* Occupancy condition (DEVICE-EVENT trigger). Fires on a ZoneAnalytics
+* occupancy edge for a device — optionally narrowed to a single admin
+* `zoneId` and/or object `className`. `op` selects the edge/threshold:
+*  - `became-occupied` (default) — count crossed 0 → ≥ `count`
+*  - `became-free`               — count crossed ≥ `count` → below it
+*  - `>=` / `<=`                 — count is at/over or at/under `count`
+* `sustainSeconds` requires the condition hold continuously that long
+* before firing (debounces flicker; 0 = fire on the first matching edge).
+* Fail-closed: no ZoneAnalytics snapshot / missing zone / null snapshot ⇒
+* the condition never matches. Confirmed edge-state survives addon restarts
+* (declared SQLite collection, reseeded on boot).
+*/
+var NcOccupancyConditionSchema = object({
+	/** Admin zone id to scope the count to; absent = whole-frame occupancy. */
+	zoneId: string().optional(),
+	/** Object class to count; absent = any class. */
+	className: string().optional(),
+	op: _enum([
+		"became-occupied",
+		"became-free",
+		">=",
+		"<="
+	]).default("became-occupied"),
+	count: number().int().min(0).default(1),
+	sustainSeconds: number().int().min(0).max(3600).default(15)
+});
+/**
+* Which zone-crossing DIRECTION a rule accepts (`ObjectEvent.zoneCrossing`).
+*
+* The values are not symmetric, and deliberately so — the absent value has to
+* mean exactly what every rule authored before this condition existed already
+* does:
+*  - `enter` — entries and every NON-crossing record (movement state,
+*    package, sensor). Exits are rejected. **This is the absent behaviour**:
+*    an operator who never asked for exits must not start receiving them.
+*  - `exit`  — ONLY an exit crossing. A record that is not a crossing at all
+*    fails closed, because "the car left the drive" is a question about a
+*    boundary, not about a detection.
+*  - `any`   — no direction filter; entries, exits and non-crossings alike.
+*
+* A rule asking for a direction should normally also scope `zones`, which the
+* engine evaluates against the crossed zone as well as the current membership
+* (an exit's membership no longer contains the zone it just left).
+*/
+var NcCrossingSchema = _enum([
+	"enter",
+	"exit",
+	"any"
+]);
+/** Admin-zone membership condition (zone IDs as stamped by the ZoneEngine). */
+var NcZoneConditionSchema = object({
+	ids: array(string().min(1)).min(1),
+	/** Quantifier over `ids` — at least one / every one visited. */
+	match: _enum(["any", "all"]).default("any")
+});
+/**
+* The P1 condition set — a flat AND of groups; absent group = pass;
+* membership lists are OR within the list (spec §2.3).
+*/
+/**
+* What a rule may actuate.
+*
+* **No hand-maintained allowlist** (operator decision, and the right one — a
+* written list of methods is a third parallel map to keep aligned, and this
+* repo has paid for those). The boundary instead comes from a property the
+* capabilities already carry: an action may target only a **device-scoped**
+* capability method.
+*
+* That is not decoration. A rule can be authored by a NON-ADMIN — personal
+* rules are a supported flow — and the executor runs with the addon's
+* privileges, so an unbounded action is an arbitrary RPC channel with a
+* privilege escalation attached. Restricting to device scope excludes the
+* system caps (`device-manager.removeDevice` and friends) by construction,
+* costs nothing to maintain, and cannot rot: a cap that stops being
+* device-scoped stops being actuatable in the same change.
+*
+* The executor enforces it; {@link NcRuleActionSchema} carries the intent.
+*/
+/**
+* One step of a sequence.
+*
+* `wait` is a first-class step rather than a property of the next action: it is
+* what makes a sequence a SEQUENCE and not a list — "unlock, wait 5s, open"
+* cannot be expressed otherwise.
+*/
+var NcRuleActionSchema = discriminatedUnion("kind", [object({
+	kind: literal("wait"),
+	seconds: number().min(0).max(300)
+}), object({
+	kind: literal("cap"),
+	deviceId: number().int(),
+	/** Capability name, e.g. `alarm-panel`. */
+	cap: string().min(1),
+	/** Method on it. The executor refuses a non-device-scoped cap. */
+	method: string().min(1),
+	/** Method arguments, minus `deviceId` (the executor injects it). */
+	args: record(string(), unknown()).optional()
+})]);
+/**
+* A named, ordered run of steps with its own throttle.
+*
+* `minDelaySec` exists because a noisy rule otherwise hammers a physical
+* actuator — the rule's own cooldown governs NOTIFICATIONS, which is a
+* different budget from "how often may this gate actually open".
+*/
+var NcRuleActionSequenceSchema = object({
+	name: string().min(1).max(120),
+	enabled: boolean(),
+	minDelaySec: number().int().min(0).max(86400).optional(),
+	actions: array(NcRuleActionSchema).min(1)
+});
+/**
+* One button carried by the notification, running a named sequence on tap.
+*
+* **Read this before adding a button that does something physical.** The tap
+* arrives over a link that travelled through third-party infrastructure — ntfy,
+* a push relay, whatever forwarded the message — and the callback's ONLY
+* authority is the token in that link: single-use, short-lived, bound to this
+* one action of this one notification. It does not identify who tapped.
+* Whoever holds the notification can run the button, once, inside the window.
+* That is the operator's explicit choice (2026-08-05), and `destructive` is a
+* rendering hint, not a second gate. [D47](decisions/adr-0047.md).
+*/
+var NcRuleNotificationButtonSchema = object({
+	/** Stable id — travels in the callback and identifies the button in logs. */
+	id: string().min(1).max(64),
+	label: string().min(1).max(40),
+	/** Name of a sequence in `onTrigger`. The dispatcher drops a button whose
+	*  sequence does not exist rather than minting a token for nothing. */
+	sequence: string().min(1).max(120),
+	icon: NotificationActionIconSchema.optional(),
+	destructive: boolean().optional()
+});
+/**
+* Sequences a rule runs, by hook point.
+*
+* ONLY `onTrigger` is here, deliberately. The reference also has activation /
+* deactivation / reset / post-generation hooks, and they are wanted — but this
+* repo's expensive failure mode is declaring a surface nothing produces, so a
+* hook appears here in the same change that produces its edge, never before.
+*/
+var NcRuleActionsSchema = object({
+	/** Runs when the rule MATCHES. */
+	onTrigger: array(NcRuleActionSequenceSchema).optional(),
+	/**
+	* Buttons the NOTIFICATION carries, each running one of this rule's
+	* sequences when tapped.
+	*
+	* Deliberately a REFERENCE to a sequence rather than a second place to
+	* author steps. A button that could define its own actions would be a
+	* parallel actuation vocabulary — the executor's device-scope check, the
+	* stop-at-first-failure rule and the per-sequence throttle all live on
+	* sequences, and a second authoring surface would drift from every one of
+	* them.
+	*
+	* A sequence reachable ONLY by a button simply appears in `onTrigger` with
+	* `enabled: false`: it is then authored, throttled and validated like the
+	* rest, and nothing runs it automatically.
+	*/
+	buttons: array(NcRuleNotificationButtonSchema).max(8).optional()
+});
+var NcConditionsSchema = object({
+	/** Gate on ANOTHER device's current state (the alarm armed, a switch on). */
+	deviceState: object({
+		deviceId: number().int(),
+		/** Any of these matches. */
+		states: array(string().min(1)).min(1)
+	}).optional(),
+	/** Device scope — absent = all devices. */
+	devices: array(number()).optional(),
+	/** Detector class names (any overlap with the record's class set). */
+	classes: array(string().min(1)).optional(),
+	/** Veto classes — any overlap fails the rule. */
+	classesExclude: array(string().min(1)).optional(),
+	/** Minimum detection confidence 0–1 (fails when the record has none). */
+	minConfidence: number().min(0).max(1).optional(),
+	/** Admin zone membership over event `zones` / track `zonesVisited`. */
+	zones: NcZoneConditionSchema.optional(),
+	/** Veto zones — any hit fails the rule. */
+	zonesExclude: array(string().min(1)).optional(),
+	/**
+	* Zone-crossing direction. IMMEDIATE only — a crossing is a per-event fact
+	* and a closed track carries none, so a `track-end` rule asking for one
+	* fails closed (use `zones`, which tests `zonesVisited`). ABSENT = `enter`,
+	* which is exactly today's behaviour. See {@link NcCrossingSchema}.
+	*/
+	crossing: NcCrossingSchema.optional(),
+	/**
+	* Exact (case-insensitive) match on the record's collapsed `label`
+	* (identity name / plate text / subclass).
+	*/
+	labelEquals: array(string().min(1)).optional(),
 	/**
 	* Identity matcher. P1 boundary: matched against the record's collapsed
 	* `label` (the identity display name propagated by the face pipeline) —
@@ -9653,6 +10061,14 @@ var NcMediaPolicySchema = object({
 	clipPreRollSec: number().int().min(0).max(30).optional(),
 	clipPostRollSec: number().int().min(0).max(30).optional(),
 	/**
+	* Playback rate of the attached gif / clip. Absent = 2x.
+	*
+	* A notification clip is GLANCED at on a lock screen, not watched: at real
+	* time an eight-second passage is eight seconds of the recipient's attention
+	* and twice the bytes. 1 is real time for the operator who wants it.
+	*/
+	clipSpeed: number().min(1).max(8).optional(),
+	/**
 	* Which stream profile the footage is cut from. Absent = the CHEAPEST
 	* assigned profile: a notification is watched on a phone, so the 4K
 	* rendition would burn CPU to produce a file the client downscales anyway.
@@ -9724,7 +10140,30 @@ var NcRuleInputSchema = object({
 	* behaviour, visible to all, read-only in the viewer). Present = personal
 	* rule owned by this userId. Server-stamped; never trusted from a client.
 	*/
-	ownerUserId: string().optional()
+	ownerUserId: string().optional(),
+	/**
+	* May a non-admin snooze this rule for EVERYONE, not just themselves?
+	*
+	* A snooze is personal by default — it silences the person who set it. This
+	* opts THIS rule into the "the gardener is here all afternoon" case, where
+	* silencing the camera for the whole household is legitimate. It silences
+	* other people, so it is off unless a rule deliberately allows it.
+	*
+	* `.optional()`, deliberately NOT `.default()`: a Zod default does not run on
+	* the addon cap path (three production failures in one day), so absent is
+	* read as `false` by {@link canSetGlobal} in the engine. Admins are not bound
+	* by this flag — see the scope rules on that function.
+	*/
+	snoozeAllowGlobal: boolean().optional(),
+	/**
+	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
+	*
+	* This is what makes the rule set the alarm's trigger set without the alarm
+	* being a special case: arming is
+	* `{ cap: 'alarm-panel', method: 'arm', args: { mode: 'away' } }`, the same
+	* shape as every other actuation.
+	*/
+	actions: NcRuleActionsSchema.optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -9795,7 +10234,8 @@ var NcConditionDescriptorSchema = object({
 		"packagePhase",
 		"crossingSelect",
 		"polygonDraw",
-		"occupancy"
+		"occupancy",
+		"deviceState"
 	]),
 	operator: _enum([
 		"in",
@@ -9809,7 +10249,28 @@ var NcConditionDescriptorSchema = object({
 	/** Which delivery kinds the condition applies to. */
 	appliesTo: array(NcDeliverySchema),
 	phase: string(),
-	description: string().optional()
+	description: string().optional(),
+	/**
+	* The CHOICES for a single-choice widget (`sourceSelect`, `crossingSelect`,
+	* `packagePhase`, …), served with the descriptor.
+	*
+	* Before this the descriptor said which widget to render and not what to put
+	* in it, so every option list lived in three places: this file's enums, the
+	* admin's `NC_*_OPTIONS` and the viewer's `NC_*_VALUES`. That triple mirror
+	* is the drift that emptied the viewer's rule editor on 2026-08-04 — the app
+	* mirrors the cap by hand, so it is only ever as current as its last build.
+	*
+	* With the options on the wire, a condition of an EXISTING `valueType` costs
+	* zero client changes. Clients keep a local fallback for an older hub that
+	* does not send them; absent here is "use your own list", not "no choices".
+	*/
+	options: array(object({
+		/** Written to the rule verbatim. `''` means the ABSENT state. */
+		value: string(),
+		label: string(),
+		/** What THIS choice matches — shown one at a time, under the control. */
+		hint: string().optional()
+	})).readonly().optional()
 });
 /**
 * The delivery lifecycle status of a history row — a straight read of the
@@ -9894,6 +10355,74 @@ var NcHistoryFilterSchema = object({
 	until: number().optional(),
 	limit: number().int().min(1).max(500).default(100)
 });
+/**
+* What a snooze covers. Broader scopes win when several overlap, so one window
+* leaves ONE digest rather than a rule snooze and a whole-feed snooze both
+* summarising the same silence.
+*/
+var NcSnoozeScopeSchema = _enum([
+	"rule",
+	"device",
+	"all"
+]);
+/**
+* Client-authored snooze. The server stamps `userId`, `startedAt` and
+* `expiresAt` — a DURATION is sent rather than an instant so a client with a
+* skewed clock cannot author a window that is already over, or never ends.
+*/
+var NcSnoozeInputSchema = object({
+	scope: NcSnoozeScopeSchema,
+	/** Required when `scope: 'rule'` — a scoped snooze with no id matches
+	*  NOTHING rather than degrading to "everything". */
+	ruleId: string().optional(),
+	/** Required when `scope: 'device'`. */
+	deviceId: number().int().optional(),
+	durationMinutes: number().int().min(1).max(1440),
+	/**
+	* Silence this for EVERY recipient, not just the caller. Permission is
+	* checked server-side (the rule's `snoozeAllowGlobal`, or admin for the
+	* broader scopes). Absent = personal.
+	*/
+	global: boolean().optional(),
+	/**
+	* Deliver a summary of what was suppressed when the window ends. Absent =
+	* ON: someone silencing a nuisance camera wants it off, someone silencing a
+	* SECURITY camera wants to know what they missed, and choosing "off" for
+	* everybody is how a snooze becomes an outage. Resolved to a concrete
+	* boolean by the server at create time — never left to a Zod default, which
+	* does not run on the addon cap path.
+	*/
+	summary: boolean().optional()
+});
+/** A persisted snooze window. */
+var NcSnoozeSchema = object({
+	id: string(),
+	/** Who set it. Also who it silences, unless `global`. */
+	userId: string(),
+	scope: NcSnoozeScopeSchema,
+	ruleId: string().optional(),
+	deviceId: number().int().optional(),
+	startedAt: number(),
+	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
+	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
+	expiresAt: number(),
+	global: boolean(),
+	summary: boolean(),
+	/** When the end-of-window digest went out. Absent = not sent (yet, or the
+	*  window has not closed, or `summary` is false). */
+	digestSentAt: number().optional()
+});
+object({
+	snoozeId: string(),
+	targetId: string(),
+	ruleId: string(),
+	ruleName: string(),
+	deviceId: number().int(),
+	/** How many notifications this snooze hid for that pair. */
+	count: number().int(),
+	firstAt: number(),
+	lastAt: number()
+});
 method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), method(object({ ruleId: string() }), object({ rule: NcRuleSchema.nullable() }), { auth: "admin" }), method(object({ rule: NcRuleInputSchema }), object({ rule: NcRuleSchema }), {
 	kind: "mutation",
 	auth: "admin",
@@ -9923,7 +10452,13 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), method(object({}), object({
 	catalog: array(NcConditionDescriptorSchema),
 	taxonomy: NcTaxonomySchema.optional()
-})), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" });
+})), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" }), method(object({}), object({ snoozes: array(NcSnoozeSchema) }), { caller: "required" }), method(object({ snooze: NcSnoozeInputSchema }), object({ snooze: NcSnoozeSchema }), {
+	kind: "mutation",
+	caller: "required"
+}), method(object({ snoozeId: string() }), object({ success: literal(true) }), {
+	kind: "mutation",
+	caller: "required"
+});
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -10671,7 +11206,15 @@ method(object({
 	format: _enum(["gif", "mp4"]).default("gif"),
 	maxWidth: number().int().min(120).max(1920).default(480),
 	/** GIF only — MP4 keeps the source cadence. */
-	fps: number().int().min(1).max(15).default(5)
+	fps: number().int().min(1).max(15).default(5),
+	/**
+	* Playback rate. A notification clip is GLANCED at on a lock screen,
+	* not watched, so 2x is the default: the recipient sees the whole
+	* passage in half the time and the GIF is half the bytes. `1` is real
+	* time. Applies to MP4 as well — the operator set a speed, not a GIF
+	* speed.
+	*/
+	speed: number().min(1).max(8).default(2)
 }), object({
 	base64: string(),
 	mime: string(),
@@ -15457,6 +16000,210 @@ method(object({ codec: string() }), boolean()), method(_void(), object({
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* Query filter for settings-store collections.
+*/
+var QueryFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
+	orderBy: object({
+		field: string(),
+		direction: _enum(["asc", "desc"])
+	}).optional(),
+	limit: number().optional(),
+	offset: number().optional()
+});
+/**
+* The predicate half of a filter, for BULK MUTATIONS.
+*
+* Deliberately not `QueryFilterSchema`: `orderBy` / `limit` / `offset` have no
+* meaning for a statement that rewrites a set, and accepting them would invite
+* a caller to believe `limit` bounds the damage. Every field is optional here
+* only so the shape stays composable — the implementation REJECTS a filter
+* that compiles to no predicate, because that is the whole collection.
+*/
+var MutationFilterSchema = object({
+	where: record(string(), unknown()).optional(),
+	whereIn: record(string(), array(unknown())).optional(),
+	whereBetween: record(string(), tuple([unknown(), unknown()])).optional()
+});
+/** A single stored record: `{ id, data }`. */
+var SettingsRecordSchema = object({
+	id: string(),
+	data: record(string(), unknown())
+});
+/**
+* Column declaration for a structured (SQL-backed) collection.
+*
+* Logical types — the backend translates each to the matching SQLite
+* storage class and handles per-type marshaling:
+*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
+*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
+*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
+*/
+var CollectionColumnSchema = object({
+	name: string(),
+	type: _enum([
+		"TEXT",
+		"INTEGER",
+		"REAL",
+		"JSON",
+		"BOOLEAN"
+	]),
+	primaryKey: boolean().optional(),
+	notNull: boolean().optional(),
+	unique: boolean().optional(),
+	/**
+	* Column DEFAULT. Required for B2: the four `ensureTable` consumers declare
+	* columns like `enabled INTEGER NOT NULL DEFAULT 1`, and without this the
+	* collection surface simply cannot express their existing tables — which is
+	* why they were still on the uncapped `table*` API.
+	*/
+	defaultValue: union([
+		string(),
+		number(),
+		boolean()
+	]).optional()
+});
+var CollectionIndexSchema = object({
+	name: string(),
+	columns: array(string()).readonly(),
+	unique: boolean().optional()
+});
+method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), unknown()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string(),
+	value: unknown()
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), array(SettingsRecordSchema).readonly()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	record: SettingsRecordSchema
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	id: string(),
+	data: record(string(), unknown())
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema
+}), object({ deleted: number().int() }), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema,
+	data: record(string(), unknown())
+}), object({ updated: number().int() }), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), number()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	field: string(),
+	bucketSize: number().int().positive(),
+	origin: number().int(),
+	filter: QueryFilterSchema.optional()
+}), array(object({
+	bucket: number().int(),
+	count: number().int()
+})).readonly()), method(object({
+	namespace: string().optional(),
+	collection: string()
+}), boolean()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	columns: array(CollectionColumnSchema).readonly(),
+	indexes: array(CollectionIndexSchema).readonly().optional()
+}), _void(), { kind: "mutation" });
+/**
+* What one engine says about itself. The orchestrator uses `kind` to pick
+* a registrant for a collection; `engineId` is what a log line names when
+* a call is routed or refused.
+*/
+var EngineInfoSchema = object({
+	engineId: string(),
+	/**
+	* `relational` — rows, columns, indexes, the surface `settings-store`
+	* has always described. `vector` — an embedding store answering
+	* similarity queries. A registrant declares exactly one; an engine that
+	* does both registers twice, because "both" would make the routing
+	* decision ambiguous at exactly the point it must not be.
+	*/
+	kind: _enum(["relational", "vector"]),
+	displayName: string()
+});
+method(_void(), EngineInfoSchema), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), unknown()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string(),
+	value: unknown()
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), array(SettingsRecordSchema).readonly()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	record: SettingsRecordSchema
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	id: string(),
+	data: record(string(), unknown())
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	key: string()
+}), _void(), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema
+}), object({ deleted: number().int() }), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: MutationFilterSchema,
+	data: record(string(), unknown())
+}), object({ updated: number().int() }), { kind: "mutation" }), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	filter: QueryFilterSchema.optional()
+}), number()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	field: string(),
+	bucketSize: number().int().positive(),
+	origin: number().int(),
+	filter: QueryFilterSchema.optional()
+}), array(object({
+	bucket: number().int(),
+	count: number().int()
+})).readonly()), method(object({
+	namespace: string().optional(),
+	collection: string()
+}), boolean()), method(object({
+	namespace: string().optional(),
+	collection: string(),
+	columns: array(CollectionColumnSchema).readonly(),
+	indexes: array(CollectionIndexSchema).readonly().optional()
+}), _void(), { kind: "mutation" });
 DeviceType.Camera;
 /**
 * `device-adoption` — generic discovery + adoption surface,
@@ -16135,7 +16882,20 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ addonId: string() }), array(SavedDeviceRowSchema)), method(object({ addonId: string().optional() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
+}), method(object({ addonId: string() }), array(SavedDeviceRowSchema)), method(object({
+	addonId: string().optional(),
+	/**
+	* `slim` omits `config` (returned `{}`), `metadata` (null) and the
+	* `sourceInfo` derived from config — and skips the per-device settings
+	* read that produces them. Everything identifying a device (id, name,
+	* type, online, features, isCamera, parent/link ids) is unchanged.
+	* Do not use it for dispatch routing, which needs `sourceInfo`.
+	*/
+	projection: _enum(["full", "slim"]).optional(),
+	/** Return only camera devices. Filtering server-side instead of
+	*  shipping 293 rows to find 12. */
+	isCamera: boolean().optional()
+}), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
 	mode: DeviceLinkModeSchema,
 	devices: array(LinkedDeviceSchema)
 })), method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)), method(object({ deviceId: number() }), array(ConfigEntrySchema)), method(object({ deviceId: number() }), ConfigUISchemaOutput), method(object({
@@ -16574,14 +17334,14 @@ var LlmProfileSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$1 = unknown();
+var ConfigSchemaPassthrough = unknown();
 var LlmProfileKindDescriptorSchema = object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
-	configSchema: ConfigSchemaPassthrough$1
+	configSchema: ConfigSchemaPassthrough
 });
 var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
 var LlmDefaultSchema = object({
@@ -17112,241 +17872,102 @@ var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
 });
 method(_void(), NetworkEndpointSchema, { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), NetworkEndpointSchema.nullable()), method(_void(), NetworkAccessStatusSchema), method(_void(), array(NetworkEndpointEntrySchema).readonly());
 /**
-* notification-output — canonical, capability-gated notification delivery.
-*
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
-*
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
-*
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = _enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: string().optional(),
-	bytes: _instanceof(Uint8Array).optional(),
-	mime: string().optional(),
-	name: string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = _enum([
-	"text",
-	"markdown",
-	"html"
+* core-blocks — user-authored TypeScript, stored in the kernel and executed in
+* its own process.
+*
+* Spec: `docs/superpowers/specs/2026-08-04-core-blocks-and-synthetic-devices-design.md`.
+*
+* The first use is **owning devices without being a device provider**: a block
+* declares devices under a system or custom integration and drives their state,
+* with the same `ctx` an addon gets. Automations come later; nothing here
+* models a trigger.
+*
+* **Stated plainly, because it does not change by being true:** a block has an
+* addon's powers — devices, storage, the event bus, `ctx.api`. It is a plugin
+* with no review step. What makes that survivable is not a sandbox, it is
+* PROCESS ISOLATION: one process per block, supervised by `CrashSupervisor`,
+* so a block that throws or never returns is marked `failed` and visible
+* instead of taking the hub with it (D6). Every method here is admin-only, and
+* must stay so.
+*/
+/** Where a block runs. The operator chooses — a block driving a device on an
+*  agent is the reason placement is not fixed to the hub. */
+var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
+/** What a block's process is doing. Mirrors the addon runner's own lifecycle so
+*  a failing block reads the same way a failing addon does. */
+var CoreBlockStatusSchema = _enum([
+	"stopped",
+	"starting",
+	"running",
+	"failed"
 ]);
-/** A single tap-through action button. */
-var NotificationActionSchema = object({
-	id: string(),
-	label: string(),
-	url: string().optional()
-});
-/**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
-*/
-var NotificationSchema = object({
-	body: string(),
-	title: string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: number().int().min(1).max(5).default(3),
-	level: string().optional(),
-	attachments: array(AttachmentSchema).optional(),
-	clickUrl: string().optional(),
-	actions: array(NotificationActionSchema).optional(),
-	sound: string().optional(),
-	ttl: number().optional(),
-	tag: string().optional(),
-	deviceId: number().optional(),
-	eventId: string().optional(),
-	metadata: record(string(), unknown()).optional()
-});
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = object({
-	id: string(),
-	label: string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: number().int().min(1).max(5).nullable(),
-	flags: object({
-		critical: boolean().optional(),
-		silent: boolean().optional(),
-		noPush: boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: array(string()).optional(),
-	description: string().optional()
-});
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = object({
-	attachments: object({
-		mediaTypes: array(AttachmentMediaTypeSchema),
-		mode: _enum([
-			"url",
-			"bytes",
-			"both"
-		]),
-		max: number().int().nonnegative(),
-		maxBytes: number().int().positive().optional()
-	}),
-	/** Max action buttons (0 = none). */
-	actions: number().int().nonnegative(),
-	levels: array(TargetKindLevelSchema),
-	format: array(NotificationFormatSchema),
-	clickUrl: boolean(),
-	sound: boolean(),
-	ttl: boolean(),
-	bodyMaxLen: number().int().positive()
-});
-/**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
-*/
-var ConfigSchemaPassthrough = unknown();
-var TargetKindSchema = object({
-	kind: string(),
-	label: string(),
-	icon: string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: string(),
-	/**
-	* URL of the kind's bundled BRAND icon, served by the providing addon over
-	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
-	* when the addon bundles no icon for that kind — the client then falls back
-	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
-	*
-	* Root-relative on purpose: it resolves against whatever origin serves a web
-	* client, and a native client joins it onto its own hub base.
-	*
-	* DECLARED here deliberately. It used to travel as an undeclared passthrough
-	* field that survived only because the runtime cap-router forwards provider
-	* output verbatim — so every consumer had to re-declare it by hand to stop
-	* its own Zod parse from stripping it, and the whole arrangement would have
-	* broken silently the moment output validation was tightened anywhere.
-	*/
-	iconUrl: string().optional(),
+/** Client-authored fields. */
+var CoreBlockInputSchema = object({
+	name: string().min(1).max(120),
+	/** TypeScript source. Compiled server-side before it is ever stored — a
+	*  block that does not compile is a fork failure the operator would meet
+	*  minutes later, in a log, instead of in the editor. */
+	code: string().max(2e5),
+	enabled: boolean(),
+	placement: CoreBlockPlacementSchema,
 	/**
-	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
-	*
-	* The server knows this and therefore says it, because the client cannot
-	* safely guess: a React-Native client renders SVG and raster through two
-	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
-	* not decode SVG on iOS/Android), so without this it silently fell back to a
-	* placeholder glyph for every vector icon while the web build looked fine.
-	*
-	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
-	* not been updated — a client that cannot determine the type should prefer
-	* its raster path, which is the safe default for an unknown image.
+	* Integration the block's devices hang from. Absent = the system integration
+	* blocks share. A block may declare its own instead.
 	*/
-	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough,
-	supportsDiscovery: boolean(),
-	caps: TargetKindCapsSchema
+	integrationId: string().optional()
 });
-/**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
-*/
-var TargetSchema = object({
+/** A stored block. */
+var CoreBlockSchema = CoreBlockInputSchema.extend({
 	id: string(),
-	name: string(),
-	kind: string(),
-	addonId: string(),
-	enabled: boolean(),
-	config: record(string(), unknown())
-});
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = object({
-	kind: string(),
-	suggestedName: string(),
-	config: record(string(), unknown())
-});
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = object({
-	level: string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: number().int().nonnegative(),
-	actionsSent: number().int().nonnegative(),
-	truncated: boolean(),
-	dropped: array(string())
-});
-var SendResultSchema = object({
-	success: boolean(),
-	error: string().optional(),
-	renderedAs: RenderedAsSchema.optional()
-});
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
-var notificationOutputCapability = {
-	name: "notification-output",
-	scope: "system",
-	mode: "collection",
-	methods: {
-		listTargetKinds: method(object({}), array(TargetKindSchema)),
-		listTargets: method(object({}), array(TargetSchema)),
-		discoverTargets: method(object({
-			kind: string(),
-			config: record(string(), unknown()).optional()
-		}), array(DiscoveredTargetSchema)),
-		send: method(object({
-			targetId: string(),
-			notification: NotificationSchema
-		}), SendResultSchema, { kind: "mutation" }),
-		testTarget: method(object({
-			targetId: string(),
-			sample: NotificationSchema.optional()
-		}), TestResultSchema, { kind: "mutation" }),
-		upsertTarget: method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }),
-		deleteTarget: method(object({ targetId: string() }), _void(), { kind: "mutation" }),
-		setTargetEnabled: method(object({
-			targetId: string(),
-			enabled: boolean()
-		}), _void(), { kind: "mutation" })
-	}
-};
+	createdAt: number(),
+	updatedAt: number(),
+	/** Server-stamped author. */
+	createdBy: string(),
+	status: CoreBlockStatusSchema,
+	/**
+	* Why the block is not running, when it is not. The operator's ONLY window
+	* into a block that failed at load — a block that is silently absent is the
+	* failure mode this whole feature has to avoid.
+	*/
+	lastError: string().optional(),
+	/** Ms epoch of the last state change. */
+	lastChangedAt: number()
+});
+/** What a compile attempt produced. */
+var CoreBlockCompileResultSchema = object({
+	ok: boolean(),
+	/** Present when `ok` is false — the first error, in the author's words. */
+	error: string().optional(),
+	line: number().optional(),
+	column: number().optional()
+});
+method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }), method(object({ blockId: string() }), object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }), method(object({ block: CoreBlockInputSchema }), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({
+	blockId: string(),
+	block: CoreBlockInputSchema.partial()
+}), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ blockId: string() }), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	blockId: string(),
+	enabled: boolean()
+}), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ code: string() }), CoreBlockCompileResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({ libs: array(object({
+	filePath: string(),
+	content: string()
+})) }), { auth: "admin" });
 /**
 * Zod schemas for persisted record types.
 *
@@ -17594,6 +18215,11 @@ var EventKindDescriptorSchema = object({
 		deviceId: number()
 	})
 });
+/** One camera's event vocabulary, as returned by `listEventKindsBatch`. */
+var EventKindsForDeviceSchema = object({
+	deviceId: number(),
+	kinds: array(EventKindDescriptorSchema).readonly()
+});
 var SensorEventSchema = object({
 	id: string(),
 	/** The CAMERA the event is attributed to (a sensor linked to N cameras
@@ -17850,6 +18476,19 @@ var MediaFileSchema = object({
 	sizeBytes: number(),
 	timestamp: number()
 });
+/**
+* One media row WITHOUT its bytes.
+*
+* A track's media is 5-8 MB of base64 (measured: 7.67 MB across 23 files for a
+* 140 s track), and a client that renders tiles from the media data plane needs
+* to know only WHAT EXISTS — the bytes then arrive per tile, lazily, over HTTP
+* with an immutable cache, instead of all at once inside a tRPC response that
+* blocks the whole view.
+*
+* `sizeBytes` is carried because it is what lets a client decide between the
+* stored blob and a `?variant=thumb` rendering without fetching either.
+*/
+var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
 var DEFAULT_EVENT_QUERY_LIMIT = 1e3;
 var MAX_EVENT_QUERY_LIMIT = 5e3;
 var DeviceEventQueryInput = object({
@@ -17999,7 +18638,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({
+}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({ deviceIds: array(number()).min(1).max(200) }), array(EventKindsForDeviceSchema).readonly()), method(object({
 	deviceId: number(),
 	since: number().optional(),
 	until: number().optional(),
@@ -18073,7 +18712,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(MediaFileSchema).readonly()), method(object({
 	trackId: string(),
 	kinds: array(MediaFileKindEnum).optional()
-}), array(MediaFileSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), object({
+}), array(MediaFileSchema).readonly()), method(object({ trackId: string() }), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), object({
 	deviceId: number(),
 	timestamp: number(),
 	frameWidth: number(),
@@ -18703,6 +19342,28 @@ var ServerUpdateStateSchema = _enum([
 	"pending-restart",
 	"awaiting-confirmation"
 ]);
+var ImageContractSchema = object({
+	state: _enum([
+		"in-sync",
+		"behind-patch",
+		"behind-series",
+		"ahead",
+		"unknown"
+	]),
+	/** The baked seed closure version — the image/app-bundle fingerprint. */
+	seedVersion: string().nullable(),
+	/** Best-known version the deployment contract delivers today. */
+	contractVersion: string().nullable(),
+	/**
+	* Where `contractVersion` came from: a real registry check (`registry`), or
+	* the node's own running version (`running` — a node can never run code
+	* newer than the newest release, so `seed < running` proves image staleness
+	* even before any registry check has run).
+	*/
+	contractSource: _enum(["registry", "running"]).nullable(),
+	/** One operator-grade sentence: this node runs image X; the contract says Y. */
+	message: string()
+});
 var ServerRollbackInfoSchema = object({
 	/** The version that failed (or was manually rolled back). */
 	fromVersion: string(),
@@ -18739,7 +19400,12 @@ var ServerPackageStatusSchema = object({
 	* versions are being IGNORED. Surfaced as a warning in the UI.
 	*/
 	stateFileCorrupt: boolean(),
-	lastCheckedAtMs: number().nullable()
+	lastCheckedAtMs: number().nullable(),
+	/**
+	* Seed-vs-contract verdict (see {@link ImageContractSchema}). Optional for
+	* version skew: an older provider's payload simply omits it.
+	*/
+	imageContract: ImageContractSchema.optional()
 });
 var ServerUpdateCheckResultSchema = object({
 	packageName: string(),
@@ -18774,101 +19440,6 @@ version: string().optional() }), ServerUpdateActionResultSchema, {
 	auth: "admin"
 });
 /**
-* Query filter for settings-store collections.
-*/
-var QueryFilterSchema = object({
-	where: record(string(), unknown()).optional(),
-	whereIn: record(string(), array(unknown())).optional(),
-	whereBetween: record(string(), tuple([unknown(), unknown()])).optional(),
-	orderBy: object({
-		field: string(),
-		direction: _enum(["asc", "desc"])
-	}).optional(),
-	limit: number().optional(),
-	offset: number().optional()
-});
-/** A single stored record: `{ id, data }`. */
-var SettingsRecordSchema = object({
-	id: string(),
-	data: record(string(), unknown())
-});
-/**
-* Column declaration for a structured (SQL-backed) collection.
-*
-* Logical types — the backend translates each to the matching SQLite
-* storage class and handles per-type marshaling:
-*   - `TEXT` / `INTEGER` / `REAL` — native SQLite types, pass-through
-*   - `JSON`    — TEXT under the hood; serialised on write, parsed on read
-*   - `BOOLEAN` — INTEGER 0/1 under the hood; coerced both directions
-*/
-var CollectionColumnSchema = object({
-	name: string(),
-	type: _enum([
-		"TEXT",
-		"INTEGER",
-		"REAL",
-		"JSON",
-		"BOOLEAN"
-	]),
-	primaryKey: boolean().optional(),
-	notNull: boolean().optional(),
-	unique: boolean().optional()
-});
-var CollectionIndexSchema = object({
-	name: string(),
-	columns: array(string()).readonly(),
-	unique: boolean().optional()
-});
-method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), unknown()), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string(),
-	value: unknown()
-}), _void(), { kind: "mutation" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional()
-}), array(SettingsRecordSchema).readonly()), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	record: SettingsRecordSchema
-}), _void(), { kind: "mutation" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	id: string(),
-	data: record(string(), unknown())
-}), _void(), { kind: "mutation" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	key: string()
-}), _void(), { kind: "mutation" }), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	filter: QueryFilterSchema.optional()
-}), number()), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	field: string(),
-	bucketSize: number().int().positive(),
-	origin: number().int(),
-	filter: QueryFilterSchema.optional()
-}), array(object({
-	bucket: number().int(),
-	count: number().int()
-})).readonly()), method(object({
-	namespace: string().optional(),
-	collection: string()
-}), boolean()), method(object({
-	namespace: string().optional(),
-	collection: string(),
-	columns: array(CollectionColumnSchema).readonly(),
-	indexes: array(CollectionIndexSchema).readonly().optional()
-}), _void(), { kind: "mutation" });
-/**
 * `smtp-provider` — pluggable email delivery surface.
 *
 * Collection cap: a deployment may install multiple SMTP relays (e.g.
@@ -22731,6 +23302,54 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"coreBlocks.compile": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"coreBlocks.create": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"coreBlocks.delete": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"coreBlocks.get": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"coreBlocks.getTypeDefs": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"coreBlocks.list": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"coreBlocks.setEnabled": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"coreBlocks.update": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"cover.close": {
 		capName: "cover",
 		capScope: "device",
@@ -22767,6 +23386,84 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"dataStoreProvider.count": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.declareCollection": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"dataStoreProvider.delete": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"dataStoreProvider.deleteWhere": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"dataStoreProvider.get": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.getEngineInfo": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.histogram": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.insert": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"dataStoreProvider.isEmpty": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.query": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"dataStoreProvider.set": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"dataStoreProvider.update": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"dataStoreProvider.updateWhere": {
+		capName: "data-store-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dayNight.getOptions": {
 		capName: "day-night",
 		capScope: "device",
@@ -24561,12 +25258,24 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.cancelSnooze": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.createRule": {
 		capName: "notification-rules",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.createSnooze": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.deleteRule": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -24597,6 +25306,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.listSnoozes": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.setRuleEnabled": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -24801,6 +25516,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listEventKindsBatch": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listOpsLog": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -24813,6 +25534,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listTrackMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -25845,6 +26572,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"settingsStore.deleteWhere": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"settingsStore.get": {
 		capName: "settings-store",
 		capScope: "system",
@@ -25887,6 +26620,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"settingsStore.updateWhere": {
+		capName: "settings-store",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"smtpProvider.getStatus": {
 		capName: "smtp-provider",
 		capScope: "system",
@@ -28613,6 +29352,7 @@ var WEBHOOK_CAPS = {
 		max: 99
 	},
 	actions: 99,
+	actionIcons: true,
 	levels: [
 		{
 			id: "p1",
@@ -29945,7 +30685,7 @@ function createMemorySettingsStorePort() {
 * the store persists whatever it is handed verbatim.
 */
 /** The default collection name (see `settings-store` addonId-prefix note). */
-var TARGETS_COLLECTION = "notification-targets";
+var TARGETS_COLLECTION = "notifiers:notification-targets";
 /** KV JSON-blob shape — a single `data` column routes the row through the
 *  settings backend's canonical key/value path (id TEXT PK, data TEXT). */
 var KV_BLOB_COLUMNS = [{