@camstack/addon-notifiers 1.2.18 → 1.2.20

package/dist/addon.js

@@ -13141,7 +13141,23 @@ var NotificationActionSchema = object({
 	* else — see `notification-center/action-token.ts` for what that does and
 	* does not buy.
 	*/
-	destructive: boolean().optional()
+	destructive: boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: _enum(["navigate", "background"]).optional()
 });
 /**
 * The canonical notification. `body` is the only hard field (Apprise model).
@@ -14156,6 +14172,9 @@ var NcSystemEventConditionSchema = object({
 	nodeIds: array(string().min(1)).min(1).optional(),
 	packageNames: array(string().min(1)).min(1).optional()
 });
+/** Hard ceiling on a window (24h). A snooze that could not expire would be an
+*  outage the operator asked for once and forgot. */
+var NC_SNOOZE_MAX_MINUTES = 1440;
 /** Weekly schedule — OR of windows; absence on the rule = always active. */
 var NcScheduleSchema = object({
 	windows: array(object({
@@ -14532,15 +14551,15 @@ var NcConditionsSchema = object({
 	* (an `immediate` rule naming an `audio-*` class, one notification per
 	* classified sample) stays exactly as it was for rules that already use it.
 	*
-	* NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
-	* rather than an oversight: the viewer mirrors the descriptor enums BY HAND
-	* (`camstack/src/data/notification-center.ts`, guarded by
-	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+	* In {@link NC_CONDITION_CATALOG} since P2, and the ORDER it got there is the
+	* rule rather than an accident: the viewer mirrors the descriptor enums BY
+	* HAND (`camstack/src/data/notification-center.ts`, guarded by
+	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor strips the
 	* condition fields it does not know when a rule is saved from the phone.
 	* Publishing an editor for a condition the app cannot round-trip is how an
-	* operator loses a rule's conditions by opening it — so the descriptor, the
-	* admin widget and the viewer mirror land together (P2 + P3), and only then
-	* does an audio rule become authorable.
+	* operator loses a rule's conditions by opening it — so the viewer mirror
+	* (P3, shipped) went FIRST, and the descriptor an editor renders from
+	* follows here.
 	*/
 	audio: NcAudioConditionSchema.optional()
 });
@@ -14776,6 +14795,30 @@ var NcRuleInputSchema = object({
 	*/
 	snoozeAllowGlobal: boolean().optional(),
 	/**
+	* The snooze durations THIS rule's notification offers as buttons, in
+	* minutes.
+	*
+	* Three states, and all three are distinct — which is exactly why this is
+	* `.optional()` and never `.default()`. A Zod default does not run on the
+	* addon cap path (three production failures in one day), so a schema default
+	* would collapse the first two:
+	*
+	* | value | meaning |
+	* | --- | --- |
+	* | absent | the operator never said ⇒ {@link NC_DEFAULT_SNOOZE_MINUTES} |
+	* | `[]` | **no snooze buttons on this rule** — the explicit override |
+	* | a list | these choices, de-duplicated and sorted, at most four |
+	*
+	* `.max(4)` because the notifier's own action budget is small (ntfy allows
+	* three buttons in total) and a rule that spent it all on snooze choices
+	* would push its own tap-through actions off the notification.
+	*
+	* An empty list is NOT an alarm exemption: a rule the alarm is about, or
+	* that arms the panel, is exempt automatically and cannot be silenced by a
+	* window from anywhere (D133).
+	*/
+	snoozeOptions: array(number().int().min(1).max(NC_SNOOZE_MAX_MINUTES)).max(4).optional(),
+	/**
 	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
 	*
 	* This is what makes the rule set the alarm's trigger set without the alarm
@@ -14875,6 +14918,7 @@ var NcConditionDescriptorSchema = object({
 		"device",
 		"package",
 		"occupancy",
+		"audio",
 		"system"
 	]),
 	label: string(),
@@ -14893,6 +14937,7 @@ var NcConditionDescriptorSchema = object({
 		"crossingSelect",
 		"polygonDraw",
 		"occupancy",
+		"audio",
 		"deviceState",
 		"systemEvent"
 	]),
@@ -15044,7 +15089,20 @@ var NcSnoozeInputSchema = object({
 	ruleId: string().optional(),
 	/** Required when `scope: 'device'`. */
 	deviceId: number().int().optional(),
-	durationMinutes: number().int().min(1).max(1440),
+	/**
+	* Narrow the window to these subject classes — "the cat, not the person".
+	*
+	* ORTHOGONAL to `scope`, deliberately, and absent means EVERY class: that is
+	* what every window authored before this field meant, so no persisted row
+	* changes meaning and no client has to learn anything to keep working.
+	*
+	* It is what makes the window's real key `(deviceId, classes[])` and lets it
+	* cross rules (D133): the operator points at a camera and a kind of thing,
+	* not at whichever of their four rules happened to produce the notification
+	* they are dismissing.
+	*/
+	classes: array(string().min(1)).min(1).optional(),
+	durationMinutes: number().int().min(1).max(NC_SNOOZE_MAX_MINUTES),
 	/**
 	* Silence this for EVERY recipient, not just the caller. Permission is
 	* checked server-side (the rule's `snoozeAllowGlobal`, or admin for the
@@ -15069,6 +15127,10 @@ var NcSnoozeSchema = object({
 	scope: NcSnoozeScopeSchema,
 	ruleId: string().optional(),
 	deviceId: number().int().optional(),
+	/** Subject classes this window covers. ABSENT = every class — see
+	*  {@link NcSnoozeInputSchema.shape.classes}. Lives in the JSON blob and has
+	*  no SQLite column: nothing queries a window by class. */
+	classes: array(string().min(1)).min(1).optional(),
 	startedAt: number(),
 	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
 	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
@@ -23771,13 +23833,24 @@ method(object({
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = number().min(.25).max(32);
 /**
-* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+* One dense interval, in WALL-CLOCK SECONDS FROM THE EXPORT'S OWN `fromMs`.
+*
+* **Wall clock, not ffmpeg's `t`** — and the recorder translates. A caller
+* derives these bounds from things that happened at a TIME (a track's
+* `firstSeen`), while `t` runs over the source playlist: the concatenation of
+* every segment present for the range, with each recording GAP removed. The
+* two agree only on a window that recorded without one interruption, and only
+* the render side knows the segments, so the translation lives there
+* (`export-dense-map.ts`, addon-pipeline).
 *
-* Relative and not absolute epoch on purpose: the renderer's frame-select
-* expression sees ffmpeg's `t`, which starts at 0 for the export's source
-* playlist. Handing it absolute epochs would make every call site responsible
-* for the same subtraction, and the one that forgot would emit a filter that
-* selects nothing — silently, as a uniform timelapse.
+* It was not always so. These seconds were fed to `between(t,…)` verbatim, and
+* on a 10 h window holding 29,393 s of footage every range landed late by the
+* gap accumulated before it — up to 6,607 s, well past EOF. Nothing matched,
+* the video was a uniform timelapse, and the log line reported the five ranges
+* that had been ASKED for (2026-08-13, export `57d14363`, camera 615).
+*
+* Relative and not absolute epoch, because an absolute epoch would make every
+* call site responsible for the same subtraction.
 */
 var ExportDenseRangeSchema = object({
 	fromSec: number().nonnegative(),
@@ -30630,6 +30703,7 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
+new Map(AUDIO_MACRO_LABELS.flatMap((macro) => macro.icon === void 0 ? [] : [[macro.id, macro.icon]]));
 new Set(["devices", "classes"]);
 /** Strip a small, safe subset of Markdown down to plain text. */
 function markdownToText(md) {
@@ -31114,25 +31188,32 @@ object({
 var NativeLeaseAdmissionSchema = _enum(["all", "inferred"]);
 object({
 	/**
-	* How long a retained native frame is served before it counts as a miss.
+	* How many delivered frames the worker HOLDS at once, waiting for each one's
+	* detection result.
+	*
+	* This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+	* a time window was never related to the event the pixels were waiting for.
+	* A held frame now lives from delivery until the runner has its `FrameResult`
+	* — at which moment the runner cuts the subject tiles it actually wanted and
+	* releases the frame. The bound exists only so a runner that stops answering
+	* cannot pin RAM: above it the OLDEST held frame is dropped and counted.
 	*
-	* Must cover the FULL late-crop horizon: detection inference + the
-	* cross-process inference-result hop to hub post-analysis + tracking + the
-	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	* Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+	* 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+	* without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+	* Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+	* `holdOverflow` on the metrics line is what says you need it.
 	*/
-	ttlMs: number().int().min(250).max(1e4),
+	holdFrames: number().int().min(1).max(64),
 	/**
 	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
 	*
-	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-	* which one is actually binding before reasoning from that. At the shipped
-	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
-	* change that admits fewer frames buys retention WINDOW at constant RAM
-	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+	* is what decides how much is held, and the ceiling is the number above which
+	* something is wrong. Before that it was the effective cap — at 1024 MB with
+	* a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+	* with the TTL expiring nothing, which is exactly the confusion the hold
+	* removes. `leaseMb` / `leaseFrames` still say what is resident.
 	* `0` DISABLES the lease entirely and falls the worker back to the tiny
 	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
 	* to replace).
@@ -31158,22 +31239,45 @@ object({
 	* there is the signal that some caller names frames outside the inference set
 	* and that this must go back to `all`.
 	*/
-	admission: NativeLeaseAdmissionSchema
+	admission: NativeLeaseAdmissionSchema,
+	/**
+	* RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+	* compressed native crops the worker cuts at the moment a frame's detection
+	* result arrives, and keeps long after the frame itself is freed.
+	*
+	* This is the knob that replaced the old retention window, and it buys about
+	* three orders of magnitude more of it: a tile is one subject at native
+	* resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+	* the frame it was cut from. A frame on which nothing was detected costs
+	* nothing at all, which is the real change — the old lease paid per FRAME and
+	* was interrogated per SUBJECT.
+	*
+	* `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+	* reproduce that.
+	*/
+	tileBudgetMb: number().int().min(0).max(1024)
 });
 /**
-* The values in force when the operator has set nothing — byte-for-byte the
-* constants the decode worker shipped with as env-var defaults, so making these
-* settings changed no behaviour on the day it landed.
+* The values in force when the operator has set nothing.
+*
+* `budgetMb` stays at 1024 on the day the hold landed, deliberately: it stopped
+* being the retention window and became the OOM ceiling, and lowering a ceiling
+* in the same change that redefines it would make a regression and a retune
+* indistinguishable. Cut it once `tileHits` / `holdOverflow` have been read on
+* live traffic.
 */
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
-	ttlMs: 1200,
+	holdFrames: 8,
 	budgetMb: 1024,
 	activityMs: 15e3,
+	tileBudgetMb: 64,
 	admission: "inferred"
 };
-DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames;
 DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var NOTIFIER_ICONS = {
 	telegram: {
@@ -32180,11 +32284,24 @@ function nativePriority$1(prepared) {
 }
 function viewActions(prepared) {
 	const out = [];
-	for (const action of prepared.actions.slice(0, MAX_ACTIONS$1)) if (action.url !== void 0 && action.url.length > 0) out.push({
-		action: "view",
-		label: action.label,
-		url: action.url
-	});
+	for (const action of prepared.actions.slice(0, MAX_ACTIONS$1)) {
+		if (action.url === void 0 || action.url.length === 0) continue;
+		if (action.mode === "background") {
+			out.push({
+				action: "http",
+				label: action.label,
+				url: action.url,
+				method: "POST",
+				clear: true
+			});
+			continue;
+		}
+		out.push({
+			action: "view",
+			label: action.label,
+			url: action.url
+		});
+	}
 	return out;
 }
 /** The single attachment (caps.max = 1), if any. */
@@ -32239,7 +32356,7 @@ function buildUploadRequest(config, prepared, attachment) {
 	if (tags.length > 0) headers["x-tags"] = tags.join(",");
 	if (prepared.clickUrl !== null) headers["x-click"] = prepared.clickUrl;
 	if (attachment.name !== void 0) headers["x-filename"] = attachment.name;
-	if (actions.length > 0) headers["x-actions"] = actions.map((a) => `view, ${a.label}, ${a.url}`).join("; ");
+	if (actions.length > 0) headers["x-actions"] = actions.map((a) => a.action === "http" ? `http, ${a.label}, ${a.url}, method=POST, clear=true` : `view, ${a.label}, ${a.url}`).join("; ");
 	return {
 		url: `${serverUrl}/${topic}`,
 		method: "PUT",
@@ -33498,17 +33615,46 @@ function userIdsFrom(config) {
 	if (typeof raw === "string") return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
 	return [];
 }
+/**
+* How a `BACKGROUND_CALL` names its request: `METHOD::url`.
+*
+* The whole reason the type exists here: a "silence this for 30 minutes"
+* button that opens a browser tab has already cost more attention than the
+* notification it was dismissing. `BACKGROUND_CALL` fires the callback and
+* leaves the phone where it is.
+*/
+var BACKGROUND_CALL_PREFIX = "POST::";
 function actionsFor(prepared) {
 	const out = [];
-	for (const action of prepared.actions.slice(0, MAX_ACTIONS)) if (action.url !== void 0 && action.url.length > 0) out.push({
-		type: "NAVIGATE",
-		title: action.label,
-		value: action.url
-	});
-	else out.push({
-		type: "OPEN_NOTIFICATION",
-		title: action.label
-	});
+	for (const action of prepared.actions.slice(0, MAX_ACTIONS)) {
+		const decoration = {
+			...action.destructive !== void 0 ? { destructive: action.destructive } : {},
+			...action.icon !== void 0 ? { icon: action.icon } : {}
+		};
+		if (action.url === void 0 || action.url.length === 0) {
+			out.push({
+				type: "OPEN_NOTIFICATION",
+				title: action.label,
+				...decoration
+			});
+			continue;
+		}
+		if (action.mode === "background") {
+			out.push({
+				type: "BACKGROUND_CALL",
+				title: action.label,
+				value: `${BACKGROUND_CALL_PREFIX}${action.url}`,
+				...decoration
+			});
+			continue;
+		}
+		out.push({
+			type: "NAVIGATE",
+			title: action.label,
+			value: action.url,
+			...decoration
+		});
+	}
 	return out;
 }
 function attachmentsFor(prepared) {
@@ -33674,6 +33820,15 @@ var zentikAdapter = {
 			],
 			format: ["text"],
 			clickUrl: true,
+			/**
+			* `NotificationActionDto.icon` is a documented field, so the engine hands
+			* the icon over instead of stripping it centrally. What Zentik's client
+			* DRAWS for a given name is not documented — so the intent name travels
+			* verbatim, exactly as the webhook kind forwards it, and a name the app
+			* does not know renders as no icon rather than as a wrong one. This is a
+			* pass-through claim, not a rendering claim.
+			*/
+			actionIcons: true,
 			sound: true,
 			ttl: true,
 			bodyMaxLen: BODY_MAX_LEN

package/dist/addon.mjs

@@ -13114,7 +13114,23 @@ var NotificationActionSchema = object({
 	* else — see `notification-center/action-token.ts` for what that does and
 	* does not buy.
 	*/
-	destructive: boolean().optional()
+	destructive: boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: _enum(["navigate", "background"]).optional()
 });
 /**
 * The canonical notification. `body` is the only hard field (Apprise model).
@@ -14129,6 +14145,9 @@ var NcSystemEventConditionSchema = object({
 	nodeIds: array(string().min(1)).min(1).optional(),
 	packageNames: array(string().min(1)).min(1).optional()
 });
+/** Hard ceiling on a window (24h). A snooze that could not expire would be an
+*  outage the operator asked for once and forgot. */
+var NC_SNOOZE_MAX_MINUTES = 1440;
 /** Weekly schedule — OR of windows; absence on the rule = always active. */
 var NcScheduleSchema = object({
 	windows: array(object({
@@ -14505,15 +14524,15 @@ var NcConditionsSchema = object({
 	* (an `immediate` rule naming an `audio-*` class, one notification per
 	* classified sample) stays exactly as it was for rules that already use it.
 	*
-	* NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
-	* rather than an oversight: the viewer mirrors the descriptor enums BY HAND
-	* (`camstack/src/data/notification-center.ts`, guarded by
-	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+	* In {@link NC_CONDITION_CATALOG} since P2, and the ORDER it got there is the
+	* rule rather than an accident: the viewer mirrors the descriptor enums BY
+	* HAND (`camstack/src/data/notification-center.ts`, guarded by
+	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor strips the
 	* condition fields it does not know when a rule is saved from the phone.
 	* Publishing an editor for a condition the app cannot round-trip is how an
-	* operator loses a rule's conditions by opening it — so the descriptor, the
-	* admin widget and the viewer mirror land together (P2 + P3), and only then
-	* does an audio rule become authorable.
+	* operator loses a rule's conditions by opening it — so the viewer mirror
+	* (P3, shipped) went FIRST, and the descriptor an editor renders from
+	* follows here.
 	*/
 	audio: NcAudioConditionSchema.optional()
 });
@@ -14749,6 +14768,30 @@ var NcRuleInputSchema = object({
 	*/
 	snoozeAllowGlobal: boolean().optional(),
 	/**
+	* The snooze durations THIS rule's notification offers as buttons, in
+	* minutes.
+	*
+	* Three states, and all three are distinct — which is exactly why this is
+	* `.optional()` and never `.default()`. A Zod default does not run on the
+	* addon cap path (three production failures in one day), so a schema default
+	* would collapse the first two:
+	*
+	* | value | meaning |
+	* | --- | --- |
+	* | absent | the operator never said ⇒ {@link NC_DEFAULT_SNOOZE_MINUTES} |
+	* | `[]` | **no snooze buttons on this rule** — the explicit override |
+	* | a list | these choices, de-duplicated and sorted, at most four |
+	*
+	* `.max(4)` because the notifier's own action budget is small (ntfy allows
+	* three buttons in total) and a rule that spent it all on snooze choices
+	* would push its own tap-through actions off the notification.
+	*
+	* An empty list is NOT an alarm exemption: a rule the alarm is about, or
+	* that arms the panel, is exempt automatically and cannot be silenced by a
+	* window from anywhere (D133).
+	*/
+	snoozeOptions: array(number().int().min(1).max(NC_SNOOZE_MAX_MINUTES)).max(4).optional(),
+	/**
 	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
 	*
 	* This is what makes the rule set the alarm's trigger set without the alarm
@@ -14848,6 +14891,7 @@ var NcConditionDescriptorSchema = object({
 		"device",
 		"package",
 		"occupancy",
+		"audio",
 		"system"
 	]),
 	label: string(),
@@ -14866,6 +14910,7 @@ var NcConditionDescriptorSchema = object({
 		"crossingSelect",
 		"polygonDraw",
 		"occupancy",
+		"audio",
 		"deviceState",
 		"systemEvent"
 	]),
@@ -15017,7 +15062,20 @@ var NcSnoozeInputSchema = object({
 	ruleId: string().optional(),
 	/** Required when `scope: 'device'`. */
 	deviceId: number().int().optional(),
-	durationMinutes: number().int().min(1).max(1440),
+	/**
+	* Narrow the window to these subject classes — "the cat, not the person".
+	*
+	* ORTHOGONAL to `scope`, deliberately, and absent means EVERY class: that is
+	* what every window authored before this field meant, so no persisted row
+	* changes meaning and no client has to learn anything to keep working.
+	*
+	* It is what makes the window's real key `(deviceId, classes[])` and lets it
+	* cross rules (D133): the operator points at a camera and a kind of thing,
+	* not at whichever of their four rules happened to produce the notification
+	* they are dismissing.
+	*/
+	classes: array(string().min(1)).min(1).optional(),
+	durationMinutes: number().int().min(1).max(NC_SNOOZE_MAX_MINUTES),
 	/**
 	* Silence this for EVERY recipient, not just the caller. Permission is
 	* checked server-side (the rule's `snoozeAllowGlobal`, or admin for the
@@ -15042,6 +15100,10 @@ var NcSnoozeSchema = object({
 	scope: NcSnoozeScopeSchema,
 	ruleId: string().optional(),
 	deviceId: number().int().optional(),
+	/** Subject classes this window covers. ABSENT = every class — see
+	*  {@link NcSnoozeInputSchema.shape.classes}. Lives in the JSON blob and has
+	*  no SQLite column: nothing queries a window by class. */
+	classes: array(string().min(1)).min(1).optional(),
 	startedAt: number(),
 	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
 	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
@@ -23744,13 +23806,24 @@ method(object({
 /** Playback-speed multiplier for the render (1 = realtime). */
 var ExportSpeedSchema = number().min(.25).max(32);
 /**
-* One dense interval, in SECONDS FROM THE EXPORT'S OWN `fromMs`.
+* One dense interval, in WALL-CLOCK SECONDS FROM THE EXPORT'S OWN `fromMs`.
+*
+* **Wall clock, not ffmpeg's `t`** — and the recorder translates. A caller
+* derives these bounds from things that happened at a TIME (a track's
+* `firstSeen`), while `t` runs over the source playlist: the concatenation of
+* every segment present for the range, with each recording GAP removed. The
+* two agree only on a window that recorded without one interruption, and only
+* the render side knows the segments, so the translation lives there
+* (`export-dense-map.ts`, addon-pipeline).
 *
-* Relative and not absolute epoch on purpose: the renderer's frame-select
-* expression sees ffmpeg's `t`, which starts at 0 for the export's source
-* playlist. Handing it absolute epochs would make every call site responsible
-* for the same subtraction, and the one that forgot would emit a filter that
-* selects nothing — silently, as a uniform timelapse.
+* It was not always so. These seconds were fed to `between(t,…)` verbatim, and
+* on a 10 h window holding 29,393 s of footage every range landed late by the
+* gap accumulated before it — up to 6,607 s, well past EOF. Nothing matched,
+* the video was a uniform timelapse, and the log line reported the five ranges
+* that had been ASKED for (2026-08-13, export `57d14363`, camera 615).
+*
+* Relative and not absolute epoch, because an absolute epoch would make every
+* call site responsible for the same subtraction.
 */
 var ExportDenseRangeSchema = object({
 	fromSec: number().nonnegative(),
@@ -30603,6 +30676,7 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
+new Map(AUDIO_MACRO_LABELS.flatMap((macro) => macro.icon === void 0 ? [] : [[macro.id, macro.icon]]));
 new Set(["devices", "classes"]);
 /** Strip a small, safe subset of Markdown down to plain text. */
 function markdownToText(md) {
@@ -31087,25 +31161,32 @@ object({
 var NativeLeaseAdmissionSchema = _enum(["all", "inferred"]);
 object({
 	/**
-	* How long a retained native frame is served before it counts as a miss.
+	* How many delivered frames the worker HOLDS at once, waiting for each one's
+	* detection result.
+	*
+	* This replaced a TTL on 2026-08-13, and the replacement is the whole point:
+	* a time window was never related to the event the pixels were waiting for.
+	* A held frame now lives from delivery until the runner has its `FrameResult`
+	* — at which moment the runner cuts the subject tiles it actually wanted and
+	* releases the frame. The bound exists only so a runner that stops answering
+	* cannot pin RAM: above it the OLDEST held frame is dropped and counted.
 	*
-	* Must cover the FULL late-crop horizon: detection inference + the
-	* cross-process inference-result hop to hub post-analysis + tracking + the
-	* tRPC crop round-trip back. Below ~500 ms the busiest cameras' subject crops
-	* outrun it and fall back to the ≤640 detection frame; above ~3 s the resident
-	* RAM per busy camera grows linearly with no measured hit-rate gain.
+	* Sizing: the steady state is `inferenceLatency × deliveredFps`, measured at
+	* 40-160 ms × ≤25 fps = 1-4 frames. The default leaves headroom for a hiccup
+	* without ever approaching the old resident set (43 frames × 24.9 MB at 4K).
+	* Raising it does not buy hit rate — it buys tolerance for a slow runner, and
+	* `holdOverflow` on the metrics line is what says you need it.
 	*/
-	ttlMs: number().int().min(250).max(1e4),
+	holdFrames: number().int().min(1).max(64),
 	/**
 	* Hard per-decode-worker RAM ceiling for retained native frames, in MB.
 	*
-	* Intended as a SAFETY ceiling with the TTL as the effective cap — but check
-	* which one is actually binding before reasoning from that. At the shipped
-	* 1024 MB and a 2 800 ms TTL, a 4K camera hits the CEILING first (~43 frames
-	* at ~24 MB each) and the TTL never gets to expire anything; `leaseMb` /
-	* `leaseFrames` on the metrics line say which. When the ceiling binds, a
-	* change that admits fewer frames buys retention WINDOW at constant RAM
-	* rather than giving RAM back — lower this knob if RAM is what you wanted.
+	* Since 2026-08-13 this is a SAFETY ceiling and nothing else: `holdFrames`
+	* is what decides how much is held, and the ceiling is the number above which
+	* something is wrong. Before that it was the effective cap — at 1024 MB with
+	* a 2 800 ms TTL a 4K camera sat pinned at `leaseMb:1020, leaseFrames:43`
+	* with the TTL expiring nothing, which is exactly the confusion the hold
+	* removes. `leaseMb` / `leaseFrames` still say what is resident.
 	* `0` DISABLES the lease entirely and falls the worker back to the tiny
 	* leak-prone GPU surface ring (~85% crop miss; that is what the lease exists
 	* to replace).
@@ -31131,22 +31212,45 @@ object({
 	* there is the signal that some caller names frames outside the inference set
 	* and that this must go back to `all`.
 	*/
-	admission: NativeLeaseAdmissionSchema
+	admission: NativeLeaseAdmissionSchema,
+	/**
+	* RAM ceiling per decode worker, in MB, for the SUBJECT TILES — the
+	* compressed native crops the worker cuts at the moment a frame's detection
+	* result arrives, and keeps long after the frame itself is freed.
+	*
+	* This is the knob that replaced the old retention window, and it buys about
+	* three orders of magnitude more of it: a tile is one subject at native
+	* resolution, JPEG-encoded (~60-120 KB on a 4K person), against ~24.9 MB for
+	* the frame it was cut from. A frame on which nothing was detected costs
+	* nothing at all, which is the real change — the old lease paid per FRAME and
+	* was interrogated per SUBJECT.
+	*
+	* `0` DISABLES tiles, leaving only the hold window and the ≤640 RAM
+	* fallback — i.e. the pre-2026-08-13 miss profile. Set it there only to
+	* reproduce that.
+	*/
+	tileBudgetMb: number().int().min(0).max(1024)
 });
 /**
-* The values in force when the operator has set nothing — byte-for-byte the
-* constants the decode worker shipped with as env-var defaults, so making these
-* settings changed no behaviour on the day it landed.
+* The values in force when the operator has set nothing.
+*
+* `budgetMb` stays at 1024 on the day the hold landed, deliberately: it stopped
+* being the retention window and became the OOM ceiling, and lowering a ceiling
+* in the same change that redefines it would make a regression and a retune
+* indistinguishable. Cut it once `tileHits` / `holdOverflow` have been read on
+* live traffic.
 */
 var DEFAULT_NATIVE_LEASE_SETTINGS = {
-	ttlMs: 1200,
+	holdFrames: 8,
 	budgetMb: 1024,
 	activityMs: 15e3,
+	tileBudgetMb: 64,
 	admission: "inferred"
 };
-DEFAULT_NATIVE_LEASE_SETTINGS.ttlMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.holdFrames;
 DEFAULT_NATIVE_LEASE_SETTINGS.budgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
+DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var NOTIFIER_ICONS = {
 	telegram: {
@@ -32153,11 +32257,24 @@ function nativePriority$1(prepared) {
 }
 function viewActions(prepared) {
 	const out = [];
-	for (const action of prepared.actions.slice(0, MAX_ACTIONS$1)) if (action.url !== void 0 && action.url.length > 0) out.push({
-		action: "view",
-		label: action.label,
-		url: action.url
-	});
+	for (const action of prepared.actions.slice(0, MAX_ACTIONS$1)) {
+		if (action.url === void 0 || action.url.length === 0) continue;
+		if (action.mode === "background") {
+			out.push({
+				action: "http",
+				label: action.label,
+				url: action.url,
+				method: "POST",
+				clear: true
+			});
+			continue;
+		}
+		out.push({
+			action: "view",
+			label: action.label,
+			url: action.url
+		});
+	}
 	return out;
 }
 /** The single attachment (caps.max = 1), if any. */
@@ -32212,7 +32329,7 @@ function buildUploadRequest(config, prepared, attachment) {
 	if (tags.length > 0) headers["x-tags"] = tags.join(",");
 	if (prepared.clickUrl !== null) headers["x-click"] = prepared.clickUrl;
 	if (attachment.name !== void 0) headers["x-filename"] = attachment.name;
-	if (actions.length > 0) headers["x-actions"] = actions.map((a) => `view, ${a.label}, ${a.url}`).join("; ");
+	if (actions.length > 0) headers["x-actions"] = actions.map((a) => a.action === "http" ? `http, ${a.label}, ${a.url}, method=POST, clear=true` : `view, ${a.label}, ${a.url}`).join("; ");
 	return {
 		url: `${serverUrl}/${topic}`,
 		method: "PUT",
@@ -33471,17 +33588,46 @@ function userIdsFrom(config) {
 	if (typeof raw === "string") return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
 	return [];
 }
+/**
+* How a `BACKGROUND_CALL` names its request: `METHOD::url`.
+*
+* The whole reason the type exists here: a "silence this for 30 minutes"
+* button that opens a browser tab has already cost more attention than the
+* notification it was dismissing. `BACKGROUND_CALL` fires the callback and
+* leaves the phone where it is.
+*/
+var BACKGROUND_CALL_PREFIX = "POST::";
 function actionsFor(prepared) {
 	const out = [];
-	for (const action of prepared.actions.slice(0, MAX_ACTIONS)) if (action.url !== void 0 && action.url.length > 0) out.push({
-		type: "NAVIGATE",
-		title: action.label,
-		value: action.url
-	});
-	else out.push({
-		type: "OPEN_NOTIFICATION",
-		title: action.label
-	});
+	for (const action of prepared.actions.slice(0, MAX_ACTIONS)) {
+		const decoration = {
+			...action.destructive !== void 0 ? { destructive: action.destructive } : {},
+			...action.icon !== void 0 ? { icon: action.icon } : {}
+		};
+		if (action.url === void 0 || action.url.length === 0) {
+			out.push({
+				type: "OPEN_NOTIFICATION",
+				title: action.label,
+				...decoration
+			});
+			continue;
+		}
+		if (action.mode === "background") {
+			out.push({
+				type: "BACKGROUND_CALL",
+				title: action.label,
+				value: `${BACKGROUND_CALL_PREFIX}${action.url}`,
+				...decoration
+			});
+			continue;
+		}
+		out.push({
+			type: "NAVIGATE",
+			title: action.label,
+			value: action.url,
+			...decoration
+		});
+	}
 	return out;
 }
 function attachmentsFor(prepared) {
@@ -33647,6 +33793,15 @@ var zentikAdapter = {
 			],
 			format: ["text"],
 			clickUrl: true,
+			/**
+			* `NotificationActionDto.icon` is a documented field, so the engine hands
+			* the icon over instead of stripping it centrally. What Zentik's client
+			* DRAWS for a given name is not documented — so the intent name travels
+			* verbatim, exactly as the webhook kind forwards it, and a name the app
+			* does not know renders as no icon rather than as a wrong one. This is a
+			* pass-through claim, not a rendering claim.
+			*/
+			actionIcons: true,
 			sound: true,
 			ttl: true,
 			bodyMaxLen: BODY_MAX_LEN

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-notifiers",
-  "version": "1.2.18",
+  "version": "1.2.20",
   "description": "System notifiers addon for CamStack — a `notification-output` collection provider hosting per-kind notifier adapters (ntfy, pushover, gotify, telegram, discord, webhook, zentik).",
   "keywords": [
     "camstack",