@camstack/addon-notifiers 1.2.19 → 1.2.21

package/dist/addon.js

@@ -13111,11 +13111,33 @@ var NotificationFormatSchema = _enum([
 * Named by INTENT, never by glyph. "check" would tie the vocabulary to one
 * renderer's icon set; "acknowledge" survives an adapter that draws it
 * differently.
+*
+* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
+*
+* These names are for US. **No adapter may forward one verbatim.** Each maps
+* the whole set onto its own renderer's vocabulary through a
+* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
+* fallback, so adding a member here fails every adapter's build until someone
+* decides its glyph, which is the only place that decision can be made
+* honestly.
+*
+* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
+* `disarm` straight through; iOS feeds that string to
+* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
+* and every snooze and alarm button arrived BLANK. A pass-through is not a
+* mapping, and "the field is documented" is not "the value renders".
+*
+* Adding a member is TRAIN-BOUND. The enum lives in the published
+* `@camstack/server` closure and the cap seam validates against the HUB's copy,
+* so an addon that emits a token the running hub does not know does not lose an
+* icon — its whole `send` fails Zod validation and the notification never
+* arrives. Never emit a new token from an addon before the train carrying it.
 */
 var NotificationActionIconSchema = _enum([
 	"acknowledge",
 	"dismiss",
 	"silence",
+	"snooze",
 	"view",
 	"play",
 	"open",
@@ -13123,9 +13145,13 @@ var NotificationActionIconSchema = _enum([
 	"lock",
 	"unlock",
 	"arm",
+	"arm-home",
+	"arm-away",
+	"arm-night",
 	"disarm",
 	"light",
-	"alert"
+	"alert",
+	"camera"
 ]);
 /** A single tap-through action button. */
 var NotificationActionSchema = object({
@@ -13141,7 +13167,23 @@ var NotificationActionSchema = object({
 	* else — see `notification-center/action-token.ts` for what that does and
 	* does not buy.
 	*/
-	destructive: boolean().optional()
+	destructive: boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: _enum(["navigate", "background"]).optional()
 });
 /**
 * The canonical notification. `body` is the only hard field (Apprise model).
@@ -13323,6 +13365,24 @@ var notificationOutputCapability = {
 		}), _void(), { kind: "mutation" })
 	}
 };
+new Set([
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle"
+	},
+	{
+		id: "animal",
+		name: "Animal"
+	},
+	{
+		id: "package",
+		name: "Package"
+	}
+].map((l) => l.id));
 var COCO_TO_MACRO = {
 	mapping: {
 		person: "person",
@@ -14120,6 +14180,8 @@ var NcSystemEventKindSchema = _enum([
 	"alarm-triggered",
 	"alarm-armed",
 	"alarm-disarmed",
+	"alarm-arming",
+	"alarm-arm-refused",
 	"camera-online",
 	"camera-offline",
 	"camera-disabled",
@@ -14156,6 +14218,9 @@ var NcSystemEventConditionSchema = object({
 	nodeIds: array(string().min(1)).min(1).optional(),
 	packageNames: array(string().min(1)).min(1).optional()
 });
+/** Hard ceiling on a window (24h). A snooze that could not expire would be an
+*  outage the operator asked for once and forgot. */
+var NC_SNOOZE_MAX_MINUTES = 1440;
 /** Weekly schedule — OR of windows; absence on the rule = always active. */
 var NcScheduleSchema = object({
 	windows: array(object({
@@ -14532,15 +14597,15 @@ var NcConditionsSchema = object({
 	* (an `immediate` rule naming an `audio-*` class, one notification per
 	* classified sample) stays exactly as it was for rules that already use it.
 	*
-	* NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
-	* rather than an oversight: the viewer mirrors the descriptor enums BY HAND
-	* (`camstack/src/data/notification-center.ts`, guarded by
-	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+	* In {@link NC_CONDITION_CATALOG} since P2, and the ORDER it got there is the
+	* rule rather than an accident: the viewer mirrors the descriptor enums BY
+	* HAND (`camstack/src/data/notification-center.ts`, guarded by
+	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor strips the
 	* condition fields it does not know when a rule is saved from the phone.
 	* Publishing an editor for a condition the app cannot round-trip is how an
-	* operator loses a rule's conditions by opening it — so the descriptor, the
-	* admin widget and the viewer mirror land together (P2 + P3), and only then
-	* does an audio rule become authorable.
+	* operator loses a rule's conditions by opening it — so the viewer mirror
+	* (P3, shipped) went FIRST, and the descriptor an editor renders from
+	* follows here.
 	*/
 	audio: NcAudioConditionSchema.optional()
 });
@@ -14776,6 +14841,30 @@ var NcRuleInputSchema = object({
 	*/
 	snoozeAllowGlobal: boolean().optional(),
 	/**
+	* The snooze durations THIS rule's notification offers as buttons, in
+	* minutes.
+	*
+	* Three states, and all three are distinct — which is exactly why this is
+	* `.optional()` and never `.default()`. A Zod default does not run on the
+	* addon cap path (three production failures in one day), so a schema default
+	* would collapse the first two:
+	*
+	* | value | meaning |
+	* | --- | --- |
+	* | absent | the operator never said ⇒ {@link NC_DEFAULT_SNOOZE_MINUTES} |
+	* | `[]` | **no snooze buttons on this rule** — the explicit override |
+	* | a list | these choices, de-duplicated and sorted, at most four |
+	*
+	* `.max(4)` because the notifier's own action budget is small (ntfy allows
+	* three buttons in total) and a rule that spent it all on snooze choices
+	* would push its own tap-through actions off the notification.
+	*
+	* An empty list is NOT an alarm exemption: a rule the alarm is about, or
+	* that arms the panel, is exempt automatically and cannot be silenced by a
+	* window from anywhere (D133).
+	*/
+	snoozeOptions: array(number().int().min(1).max(NC_SNOOZE_MAX_MINUTES)).max(4).optional(),
+	/**
 	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
 	*
 	* This is what makes the rule set the alarm's trigger set without the alarm
@@ -14875,6 +14964,7 @@ var NcConditionDescriptorSchema = object({
 		"device",
 		"package",
 		"occupancy",
+		"audio",
 		"system"
 	]),
 	label: string(),
@@ -14893,6 +14983,7 @@ var NcConditionDescriptorSchema = object({
 		"crossingSelect",
 		"polygonDraw",
 		"occupancy",
+		"audio",
 		"deviceState",
 		"systemEvent"
 	]),
@@ -15044,7 +15135,20 @@ var NcSnoozeInputSchema = object({
 	ruleId: string().optional(),
 	/** Required when `scope: 'device'`. */
 	deviceId: number().int().optional(),
-	durationMinutes: number().int().min(1).max(1440),
+	/**
+	* Narrow the window to these subject classes — "the cat, not the person".
+	*
+	* ORTHOGONAL to `scope`, deliberately, and absent means EVERY class: that is
+	* what every window authored before this field meant, so no persisted row
+	* changes meaning and no client has to learn anything to keep working.
+	*
+	* It is what makes the window's real key `(deviceId, classes[])` and lets it
+	* cross rules (D133): the operator points at a camera and a kind of thing,
+	* not at whichever of their four rules happened to produce the notification
+	* they are dismissing.
+	*/
+	classes: array(string().min(1)).min(1).optional(),
+	durationMinutes: number().int().min(1).max(NC_SNOOZE_MAX_MINUTES),
 	/**
 	* Silence this for EVERY recipient, not just the caller. Permission is
 	* checked server-side (the rule's `snoozeAllowGlobal`, or admin for the
@@ -15069,6 +15173,10 @@ var NcSnoozeSchema = object({
 	scope: NcSnoozeScopeSchema,
 	ruleId: string().optional(),
 	deviceId: number().int().optional(),
+	/** Subject classes this window covers. ABSENT = every class — see
+	*  {@link NcSnoozeInputSchema.shape.classes}. Lives in the JSON blob and has
+	*  no SQLite column: nothing queries a window by class. */
+	classes: array(string().min(1)).min(1).optional(),
 	startedAt: number(),
 	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
 	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
@@ -17306,6 +17414,22 @@ var detectionFpsField = {
 	default: 10,
 	step: 1
 };
+/**
+* The occupancy re-check interval. DEFAULT 300 s (2026-08-13 — was 30 s).
+*
+* The recheck is now on by default (a parked car is invisible to occupancy
+* rules until the stationary registry has been rebuilt by motion, which after a
+* restart may be never on a quiet camera). Each cycle re-subscribes a detection
+* session — an RTSP re-dial — so the switch is only affordable at a WIDE
+* interval: 300 s is ~12 re-dials an hour per camera, against 120 at the old
+* 30 s. A parked car is therefore counted within 5 minutes of a restart.
+*
+* Why not wider: `max` is 300 and raising it is TRAIN-BOUND, not addon-bound —
+* the host validates `attachCamera` against ITS copy of this schema, so a
+* runner asked for 600 would be rejected by the hub until a `@camstack/server`
+* carrying the wider bound is installed everywhere. 300 is the widest value
+* that ships with an addon deploy.
+*/
 var occupancyRecheckSecField = {
 	min: 0,
 	max: 300,
@@ -17507,15 +17631,21 @@ var RunnerCameraConfigSchema = object({
 	*/
 	onboardMotionDrivesAnalyzer: boolean().default(true),
 	/**
-	* Master toggle for the occupancy re-check. When `false` (DEFAULT) the runner
-	* never arms the periodic recheck timer, regardless of `occupancyRecheckSec` —
-	* this is off by default because the recheck re-subscribes a detection session
-	* every N seconds while `watching`, a major source of pull-decoder re-dial
-	* churn (each cycle creates+tears a session → RTSP re-dial → latency). The
+	* Master toggle for the occupancy re-check. When `false` the runner never arms
+	* the periodic recheck timer, regardless of `occupancyRecheckSec`; the
 	* `occupancyRecheckSec` / `occupancyRecheckFrames` sliders only take effect
 	* (and only render) when this is enabled.
-	*/
-	occupancyRecheckEnabled: boolean().default(false),
+	*
+	* DEFAULT `true` since 2026-08-13 (was `false`). It was off because the
+	* recheck re-subscribes a detection session every N seconds while `watching`
+	* — each cycle creates+tears a session ⇒ an RTSP re-dial ⇒ latency, a major
+	* pull-decoder churn source. What that bought was a blind spot: a STATIONARY
+	* object is counted only while the stationary registry holds it, and the
+	* registry rebuilds from motion, so after a restart a parked car was invisible
+	* to every occupancy rule until something moved in front of it. The churn is
+	* now paid on the interval instead — see `occupancyRecheckSecField`.
+	*/
+	occupancyRecheckEnabled: boolean().default(true),
 	occupancyRecheckSec: number().min(occupancyRecheckSecField.min).max(occupancyRecheckSecField.max).default(occupancyRecheckSecField.default),
 	occupancyRecheckFrames: number().min(occupancyRecheckFramesField.min).max(occupancyRecheckFramesField.max).default(occupancyRecheckFramesField.default),
 	/**
@@ -30641,6 +30771,7 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
+new Map(AUDIO_MACRO_LABELS.flatMap((macro) => macro.icon === void 0 ? [] : [[macro.id, macro.icon]]));
 new Set(["devices", "classes"]);
 /** Strip a small, safe subset of Markdown down to plain text. */
 function markdownToText(md) {
@@ -32221,11 +32352,24 @@ function nativePriority$1(prepared) {
 }
 function viewActions(prepared) {
 	const out = [];
-	for (const action of prepared.actions.slice(0, MAX_ACTIONS$1)) if (action.url !== void 0 && action.url.length > 0) out.push({
-		action: "view",
-		label: action.label,
-		url: action.url
-	});
+	for (const action of prepared.actions.slice(0, MAX_ACTIONS$1)) {
+		if (action.url === void 0 || action.url.length === 0) continue;
+		if (action.mode === "background") {
+			out.push({
+				action: "http",
+				label: action.label,
+				url: action.url,
+				method: "POST",
+				clear: true
+			});
+			continue;
+		}
+		out.push({
+			action: "view",
+			label: action.label,
+			url: action.url
+		});
+	}
 	return out;
 }
 /** The single attachment (caps.max = 1), if any. */
@@ -32280,7 +32424,7 @@ function buildUploadRequest(config, prepared, attachment) {
 	if (tags.length > 0) headers["x-tags"] = tags.join(",");
 	if (prepared.clickUrl !== null) headers["x-click"] = prepared.clickUrl;
 	if (attachment.name !== void 0) headers["x-filename"] = attachment.name;
-	if (actions.length > 0) headers["x-actions"] = actions.map((a) => `view, ${a.label}, ${a.url}`).join("; ");
+	if (actions.length > 0) headers["x-actions"] = actions.map((a) => a.action === "http" ? `http, ${a.label}, ${a.url}, method=POST, clear=true` : `view, ${a.label}, ${a.url}`).join("; ");
 	return {
 		url: `${serverUrl}/${topic}`,
 		method: "PUT",
@@ -32357,6 +32501,21 @@ var ntfyAdapter = {
 				max: 1
 			},
 			actions: MAX_ACTIONS$1,
+			/**
+			* ntfy has NO per-action icon, and this says so out loud.
+			*
+			* Its action object is `{action, label, url, clear, headers, body}` and the
+			* `X-Actions` header form is `action, label, url[, extras]` — there is no
+			* icon field in either, and the `icon` ntfy does have is the NOTIFICATION's
+			* icon (an attachment URL, handled above), not a per-button one.
+			*
+			* Left EXPLICIT rather than absent: absent and `false` behave identically
+			* (the degrade engine reads a missing value as unsupported), but only one
+			* of them proves somebody checked. The degrade engine then strips the icon
+			* centrally and puts `actionIcons` in `renderedAs.dropped`, so the loss is
+			* reported instead of being discovered on a phone.
+			*/
+			actionIcons: false,
 			levels: [
 				{
 					id: "min",
@@ -33539,17 +33698,123 @@ function userIdsFrom(config) {
 	if (typeof raw === "string") return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
 	return [];
 }
+/**
+* Canonical icon token → the string Zentik's client actually renders.
+*
+* ── EVIDENCE (read from the Zentik sources, not guessed) ────────────
+* `NotificationActionDto.icon` is `@IsOptional() @IsString()` — the BACKEND
+* validates nothing, so a wrong value is accepted, stored and delivered. The
+* rendering happens on the client, and both iOS paths do the same thing
+* (`ZentikNotificationService/NotificationService.swift`,
+* `ZentikNotificationContentExtension/NotificationViewController.swift`):
+*
+*     let actualIconName = iconName.hasPrefix("sfsymbols:")
+*       ? String(iconName.dropFirst("sfsymbols:".count)) : iconName
+*     icon = UNNotificationActionIcon(systemImageName: actualIconName)
+*
+* So the value is an **SF Symbol name**, with an optional `sfsymbols:` prefix
+* that is stripped. Zentik's own UI confirms the convention: its icon field
+* placeholder is "e.g., house.fill, heart, gear" and its picker writes
+* `sfsymbols:${iconName}`.
+*
+* `UNNotificationActionIcon(systemImageName:)` with a name iOS does not know
+* renders NOTHING — silently. That is the whole failure: we sent `silence`,
+* `arm` and `disarm`, none of which are SF Symbols, and every button arrived
+* blank with nothing anywhere saying why.
+*
+* The prefix is emitted explicitly even though bare names work, because the
+* bare form is indistinguishable from an un-translated intent token in a
+* captured payload — and telling those two apart is what cost the time.
+*
+* A `Record` over the closed enum, NOT a lookup with a fallback: adding a
+* vocabulary member without deciding its glyph fails the build here.
+*
+* Android: Zentik's Android client does not render per-action icons at all
+* (an Android notification action needs a bundled drawable, not a name), so
+* this is an iOS/watchOS enrichment and a no-op elsewhere — which is a
+* cosmetic loss, not a wrong glyph.
+*/
+var ZENTIK_ACTION_ICONS = {
+	acknowledge: "checkmark.circle",
+	dismiss: "xmark.circle",
+	silence: "bell.slash",
+	snooze: "zzz",
+	view: "eye",
+	play: "play.fill",
+	open: "door.left.hand.open",
+	close: "door.left.hand.closed",
+	lock: "lock.fill",
+	unlock: "lock.open.fill",
+	arm: "shield.fill",
+	"arm-home": "house.fill",
+	"arm-away": "figure.walk",
+	"arm-night": "moon.fill",
+	disarm: "shield.slash.fill",
+	light: "lightbulb.fill",
+	alert: "exclamationmark.triangle.fill",
+	camera: "video.fill"
+};
+/** The `sfsymbols:` prefix Zentik's clients strip before resolving the symbol. */
+var SFSYMBOLS_PREFIX = "sfsymbols:";
+/**
+* The Zentik value for one icon token, or `undefined` when there is none.
+*
+* Typed on `string`, not on `NotificationActionIcon`, because that is what this
+* boundary actually receives: an addon deployed against a hub whose vocabulary
+* moved on hands over a token this build has never heard of. Omitting it is the
+* honest answer — forwarding it raw would put a string iOS ignores on the wire
+* and produce exactly the blank button this map exists to fix.
+*
+* `Object.hasOwn` and not a truthiness check: an inherited `toString` must not
+* read as a mapping.
+*/
+function zentikActionIcon(icon) {
+	const table = ZENTIK_ACTION_ICONS;
+	if (!Object.hasOwn(ZENTIK_ACTION_ICONS, icon)) return void 0;
+	const symbol = table[icon];
+	return symbol === void 0 ? void 0 : `${SFSYMBOLS_PREFIX}${symbol}`;
+}
+/**
+* How a `BACKGROUND_CALL` names its request: `METHOD::url`.
+*
+* The whole reason the type exists here: a "silence this for 30 minutes"
+* button that opens a browser tab has already cost more attention than the
+* notification it was dismissing. `BACKGROUND_CALL` fires the callback and
+* leaves the phone where it is.
+*/
+var BACKGROUND_CALL_PREFIX = "POST::";
 function actionsFor(prepared) {
 	const out = [];
-	for (const action of prepared.actions.slice(0, MAX_ACTIONS)) if (action.url !== void 0 && action.url.length > 0) out.push({
-		type: "NAVIGATE",
-		title: action.label,
-		value: action.url
-	});
-	else out.push({
-		type: "OPEN_NOTIFICATION",
-		title: action.label
-	});
+	for (const action of prepared.actions.slice(0, MAX_ACTIONS)) {
+		const symbol = action.icon === void 0 ? void 0 : zentikActionIcon(action.icon);
+		const decoration = {
+			...action.destructive !== void 0 ? { destructive: action.destructive } : {},
+			...symbol !== void 0 ? { icon: symbol } : {}
+		};
+		if (action.url === void 0 || action.url.length === 0) {
+			out.push({
+				type: "OPEN_NOTIFICATION",
+				title: action.label,
+				...decoration
+			});
+			continue;
+		}
+		if (action.mode === "background") {
+			out.push({
+				type: "BACKGROUND_CALL",
+				title: action.label,
+				value: `${BACKGROUND_CALL_PREFIX}${action.url}`,
+				...decoration
+			});
+			continue;
+		}
+		out.push({
+			type: "NAVIGATE",
+			title: action.label,
+			value: action.url,
+			...decoration
+		});
+	}
 	return out;
 }
 function attachmentsFor(prepared) {
@@ -33715,6 +33980,17 @@ var zentikAdapter = {
 			],
 			format: ["text"],
 			clickUrl: true,
+			/**
+			* A RENDERING claim, which it was not before.
+			*
+			* This used to say the intent name "travels verbatim … a name the app does
+			* not know renders as no icon rather than as a wrong one" — true, and it
+			* described a feature that never once drew an icon, because NO intent name
+			* is an SF Symbol. The engine handed the icon over and the adapter put it
+			* on the wire untranslated. `ZENTIK_ACTION_ICONS` is what makes this claim
+			* honest; keep it exhaustive or this reverts to a pass-through that lies.
+			*/
+			actionIcons: true,
 			sound: true,
 			ttl: true,
 			bodyMaxLen: BODY_MAX_LEN

package/dist/addon.mjs

@@ -13084,11 +13084,33 @@ var NotificationFormatSchema = _enum([
 * Named by INTENT, never by glyph. "check" would tie the vocabulary to one
 * renderer's icon set; "acknowledge" survives an adapter that draws it
 * differently.
+*
+* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
+*
+* These names are for US. **No adapter may forward one verbatim.** Each maps
+* the whole set onto its own renderer's vocabulary through a
+* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
+* fallback, so adding a member here fails every adapter's build until someone
+* decides its glyph, which is the only place that decision can be made
+* honestly.
+*
+* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
+* `disarm` straight through; iOS feeds that string to
+* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
+* and every snooze and alarm button arrived BLANK. A pass-through is not a
+* mapping, and "the field is documented" is not "the value renders".
+*
+* Adding a member is TRAIN-BOUND. The enum lives in the published
+* `@camstack/server` closure and the cap seam validates against the HUB's copy,
+* so an addon that emits a token the running hub does not know does not lose an
+* icon — its whole `send` fails Zod validation and the notification never
+* arrives. Never emit a new token from an addon before the train carrying it.
 */
 var NotificationActionIconSchema = _enum([
 	"acknowledge",
 	"dismiss",
 	"silence",
+	"snooze",
 	"view",
 	"play",
 	"open",
@@ -13096,9 +13118,13 @@ var NotificationActionIconSchema = _enum([
 	"lock",
 	"unlock",
 	"arm",
+	"arm-home",
+	"arm-away",
+	"arm-night",
 	"disarm",
 	"light",
-	"alert"
+	"alert",
+	"camera"
 ]);
 /** A single tap-through action button. */
 var NotificationActionSchema = object({
@@ -13114,7 +13140,23 @@ var NotificationActionSchema = object({
 	* else — see `notification-center/action-token.ts` for what that does and
 	* does not buy.
 	*/
-	destructive: boolean().optional()
+	destructive: boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: _enum(["navigate", "background"]).optional()
 });
 /**
 * The canonical notification. `body` is the only hard field (Apprise model).
@@ -13296,6 +13338,24 @@ var notificationOutputCapability = {
 		}), _void(), { kind: "mutation" })
 	}
 };
+new Set([
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle"
+	},
+	{
+		id: "animal",
+		name: "Animal"
+	},
+	{
+		id: "package",
+		name: "Package"
+	}
+].map((l) => l.id));
 var COCO_TO_MACRO = {
 	mapping: {
 		person: "person",
@@ -14093,6 +14153,8 @@ var NcSystemEventKindSchema = _enum([
 	"alarm-triggered",
 	"alarm-armed",
 	"alarm-disarmed",
+	"alarm-arming",
+	"alarm-arm-refused",
 	"camera-online",
 	"camera-offline",
 	"camera-disabled",
@@ -14129,6 +14191,9 @@ var NcSystemEventConditionSchema = object({
 	nodeIds: array(string().min(1)).min(1).optional(),
 	packageNames: array(string().min(1)).min(1).optional()
 });
+/** Hard ceiling on a window (24h). A snooze that could not expire would be an
+*  outage the operator asked for once and forgot. */
+var NC_SNOOZE_MAX_MINUTES = 1440;
 /** Weekly schedule — OR of windows; absence on the rule = always active. */
 var NcScheduleSchema = object({
 	windows: array(object({
@@ -14505,15 +14570,15 @@ var NcConditionsSchema = object({
 	* (an `immediate` rule naming an `audio-*` class, one notification per
 	* classified sample) stays exactly as it was for rules that already use it.
 	*
-	* NOT in {@link NC_CONDITION_CATALOG} yet, and that is the sequencing rule
-	* rather than an oversight: the viewer mirrors the descriptor enums BY HAND
-	* (`camstack/src/data/notification-center.ts`, guarded by
-	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor STRIPS the
+	* In {@link NC_CONDITION_CATALOG} since P2, and the ORDER it got there is the
+	* rule rather than an accident: the viewer mirrors the descriptor enums BY
+	* HAND (`camstack/src/data/notification-center.ts`, guarded by
+	* `scripts/check-viewer-condition-mirror.ts`) and its rule editor strips the
 	* condition fields it does not know when a rule is saved from the phone.
 	* Publishing an editor for a condition the app cannot round-trip is how an
-	* operator loses a rule's conditions by opening it — so the descriptor, the
-	* admin widget and the viewer mirror land together (P2 + P3), and only then
-	* does an audio rule become authorable.
+	* operator loses a rule's conditions by opening it — so the viewer mirror
+	* (P3, shipped) went FIRST, and the descriptor an editor renders from
+	* follows here.
 	*/
 	audio: NcAudioConditionSchema.optional()
 });
@@ -14749,6 +14814,30 @@ var NcRuleInputSchema = object({
 	*/
 	snoozeAllowGlobal: boolean().optional(),
 	/**
+	* The snooze durations THIS rule's notification offers as buttons, in
+	* minutes.
+	*
+	* Three states, and all three are distinct — which is exactly why this is
+	* `.optional()` and never `.default()`. A Zod default does not run on the
+	* addon cap path (three production failures in one day), so a schema default
+	* would collapse the first two:
+	*
+	* | value | meaning |
+	* | --- | --- |
+	* | absent | the operator never said ⇒ {@link NC_DEFAULT_SNOOZE_MINUTES} |
+	* | `[]` | **no snooze buttons on this rule** — the explicit override |
+	* | a list | these choices, de-duplicated and sorted, at most four |
+	*
+	* `.max(4)` because the notifier's own action budget is small (ntfy allows
+	* three buttons in total) and a rule that spent it all on snooze choices
+	* would push its own tap-through actions off the notification.
+	*
+	* An empty list is NOT an alarm exemption: a rule the alarm is about, or
+	* that arms the panel, is exempt automatically and cannot be silenced by a
+	* window from anywhere (D133).
+	*/
+	snoozeOptions: array(number().int().min(1).max(NC_SNOOZE_MAX_MINUTES)).max(4).optional(),
+	/**
 	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
 	*
 	* This is what makes the rule set the alarm's trigger set without the alarm
@@ -14848,6 +14937,7 @@ var NcConditionDescriptorSchema = object({
 		"device",
 		"package",
 		"occupancy",
+		"audio",
 		"system"
 	]),
 	label: string(),
@@ -14866,6 +14956,7 @@ var NcConditionDescriptorSchema = object({
 		"crossingSelect",
 		"polygonDraw",
 		"occupancy",
+		"audio",
 		"deviceState",
 		"systemEvent"
 	]),
@@ -15017,7 +15108,20 @@ var NcSnoozeInputSchema = object({
 	ruleId: string().optional(),
 	/** Required when `scope: 'device'`. */
 	deviceId: number().int().optional(),
-	durationMinutes: number().int().min(1).max(1440),
+	/**
+	* Narrow the window to these subject classes — "the cat, not the person".
+	*
+	* ORTHOGONAL to `scope`, deliberately, and absent means EVERY class: that is
+	* what every window authored before this field meant, so no persisted row
+	* changes meaning and no client has to learn anything to keep working.
+	*
+	* It is what makes the window's real key `(deviceId, classes[])` and lets it
+	* cross rules (D133): the operator points at a camera and a kind of thing,
+	* not at whichever of their four rules happened to produce the notification
+	* they are dismissing.
+	*/
+	classes: array(string().min(1)).min(1).optional(),
+	durationMinutes: number().int().min(1).max(NC_SNOOZE_MAX_MINUTES),
 	/**
 	* Silence this for EVERY recipient, not just the caller. Permission is
 	* checked server-side (the rule's `snoozeAllowGlobal`, or admin for the
@@ -15042,6 +15146,10 @@ var NcSnoozeSchema = object({
 	scope: NcSnoozeScopeSchema,
 	ruleId: string().optional(),
 	deviceId: number().int().optional(),
+	/** Subject classes this window covers. ABSENT = every class — see
+	*  {@link NcSnoozeInputSchema.shape.classes}. Lives in the JSON blob and has
+	*  no SQLite column: nothing queries a window by class. */
+	classes: array(string().min(1)).min(1).optional(),
 	startedAt: number(),
 	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
 	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
@@ -17279,6 +17387,22 @@ var detectionFpsField = {
 	default: 10,
 	step: 1
 };
+/**
+* The occupancy re-check interval. DEFAULT 300 s (2026-08-13 — was 30 s).
+*
+* The recheck is now on by default (a parked car is invisible to occupancy
+* rules until the stationary registry has been rebuilt by motion, which after a
+* restart may be never on a quiet camera). Each cycle re-subscribes a detection
+* session — an RTSP re-dial — so the switch is only affordable at a WIDE
+* interval: 300 s is ~12 re-dials an hour per camera, against 120 at the old
+* 30 s. A parked car is therefore counted within 5 minutes of a restart.
+*
+* Why not wider: `max` is 300 and raising it is TRAIN-BOUND, not addon-bound —
+* the host validates `attachCamera` against ITS copy of this schema, so a
+* runner asked for 600 would be rejected by the hub until a `@camstack/server`
+* carrying the wider bound is installed everywhere. 300 is the widest value
+* that ships with an addon deploy.
+*/
 var occupancyRecheckSecField = {
 	min: 0,
 	max: 300,
@@ -17480,15 +17604,21 @@ var RunnerCameraConfigSchema = object({
 	*/
 	onboardMotionDrivesAnalyzer: boolean().default(true),
 	/**
-	* Master toggle for the occupancy re-check. When `false` (DEFAULT) the runner
-	* never arms the periodic recheck timer, regardless of `occupancyRecheckSec` —
-	* this is off by default because the recheck re-subscribes a detection session
-	* every N seconds while `watching`, a major source of pull-decoder re-dial
-	* churn (each cycle creates+tears a session → RTSP re-dial → latency). The
+	* Master toggle for the occupancy re-check. When `false` the runner never arms
+	* the periodic recheck timer, regardless of `occupancyRecheckSec`; the
 	* `occupancyRecheckSec` / `occupancyRecheckFrames` sliders only take effect
 	* (and only render) when this is enabled.
-	*/
-	occupancyRecheckEnabled: boolean().default(false),
+	*
+	* DEFAULT `true` since 2026-08-13 (was `false`). It was off because the
+	* recheck re-subscribes a detection session every N seconds while `watching`
+	* — each cycle creates+tears a session ⇒ an RTSP re-dial ⇒ latency, a major
+	* pull-decoder churn source. What that bought was a blind spot: a STATIONARY
+	* object is counted only while the stationary registry holds it, and the
+	* registry rebuilds from motion, so after a restart a parked car was invisible
+	* to every occupancy rule until something moved in front of it. The churn is
+	* now paid on the interval instead — see `occupancyRecheckSecField`.
+	*/
+	occupancyRecheckEnabled: boolean().default(true),
 	occupancyRecheckSec: number().min(occupancyRecheckSecField.min).max(occupancyRecheckSecField.max).default(occupancyRecheckSecField.default),
 	occupancyRecheckFrames: number().min(occupancyRecheckFramesField.min).max(occupancyRecheckFramesField.max).default(occupancyRecheckFramesField.default),
 	/**
@@ -30614,6 +30744,7 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
+new Map(AUDIO_MACRO_LABELS.flatMap((macro) => macro.icon === void 0 ? [] : [[macro.id, macro.icon]]));
 new Set(["devices", "classes"]);
 /** Strip a small, safe subset of Markdown down to plain text. */
 function markdownToText(md) {
@@ -32194,11 +32325,24 @@ function nativePriority$1(prepared) {
 }
 function viewActions(prepared) {
 	const out = [];
-	for (const action of prepared.actions.slice(0, MAX_ACTIONS$1)) if (action.url !== void 0 && action.url.length > 0) out.push({
-		action: "view",
-		label: action.label,
-		url: action.url
-	});
+	for (const action of prepared.actions.slice(0, MAX_ACTIONS$1)) {
+		if (action.url === void 0 || action.url.length === 0) continue;
+		if (action.mode === "background") {
+			out.push({
+				action: "http",
+				label: action.label,
+				url: action.url,
+				method: "POST",
+				clear: true
+			});
+			continue;
+		}
+		out.push({
+			action: "view",
+			label: action.label,
+			url: action.url
+		});
+	}
 	return out;
 }
 /** The single attachment (caps.max = 1), if any. */
@@ -32253,7 +32397,7 @@ function buildUploadRequest(config, prepared, attachment) {
 	if (tags.length > 0) headers["x-tags"] = tags.join(",");
 	if (prepared.clickUrl !== null) headers["x-click"] = prepared.clickUrl;
 	if (attachment.name !== void 0) headers["x-filename"] = attachment.name;
-	if (actions.length > 0) headers["x-actions"] = actions.map((a) => `view, ${a.label}, ${a.url}`).join("; ");
+	if (actions.length > 0) headers["x-actions"] = actions.map((a) => a.action === "http" ? `http, ${a.label}, ${a.url}, method=POST, clear=true` : `view, ${a.label}, ${a.url}`).join("; ");
 	return {
 		url: `${serverUrl}/${topic}`,
 		method: "PUT",
@@ -32330,6 +32474,21 @@ var ntfyAdapter = {
 				max: 1
 			},
 			actions: MAX_ACTIONS$1,
+			/**
+			* ntfy has NO per-action icon, and this says so out loud.
+			*
+			* Its action object is `{action, label, url, clear, headers, body}` and the
+			* `X-Actions` header form is `action, label, url[, extras]` — there is no
+			* icon field in either, and the `icon` ntfy does have is the NOTIFICATION's
+			* icon (an attachment URL, handled above), not a per-button one.
+			*
+			* Left EXPLICIT rather than absent: absent and `false` behave identically
+			* (the degrade engine reads a missing value as unsupported), but only one
+			* of them proves somebody checked. The degrade engine then strips the icon
+			* centrally and puts `actionIcons` in `renderedAs.dropped`, so the loss is
+			* reported instead of being discovered on a phone.
+			*/
+			actionIcons: false,
 			levels: [
 				{
 					id: "min",
@@ -33512,17 +33671,123 @@ function userIdsFrom(config) {
 	if (typeof raw === "string") return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
 	return [];
 }
+/**
+* Canonical icon token → the string Zentik's client actually renders.
+*
+* ── EVIDENCE (read from the Zentik sources, not guessed) ────────────
+* `NotificationActionDto.icon` is `@IsOptional() @IsString()` — the BACKEND
+* validates nothing, so a wrong value is accepted, stored and delivered. The
+* rendering happens on the client, and both iOS paths do the same thing
+* (`ZentikNotificationService/NotificationService.swift`,
+* `ZentikNotificationContentExtension/NotificationViewController.swift`):
+*
+*     let actualIconName = iconName.hasPrefix("sfsymbols:")
+*       ? String(iconName.dropFirst("sfsymbols:".count)) : iconName
+*     icon = UNNotificationActionIcon(systemImageName: actualIconName)
+*
+* So the value is an **SF Symbol name**, with an optional `sfsymbols:` prefix
+* that is stripped. Zentik's own UI confirms the convention: its icon field
+* placeholder is "e.g., house.fill, heart, gear" and its picker writes
+* `sfsymbols:${iconName}`.
+*
+* `UNNotificationActionIcon(systemImageName:)` with a name iOS does not know
+* renders NOTHING — silently. That is the whole failure: we sent `silence`,
+* `arm` and `disarm`, none of which are SF Symbols, and every button arrived
+* blank with nothing anywhere saying why.
+*
+* The prefix is emitted explicitly even though bare names work, because the
+* bare form is indistinguishable from an un-translated intent token in a
+* captured payload — and telling those two apart is what cost the time.
+*
+* A `Record` over the closed enum, NOT a lookup with a fallback: adding a
+* vocabulary member without deciding its glyph fails the build here.
+*
+* Android: Zentik's Android client does not render per-action icons at all
+* (an Android notification action needs a bundled drawable, not a name), so
+* this is an iOS/watchOS enrichment and a no-op elsewhere — which is a
+* cosmetic loss, not a wrong glyph.
+*/
+var ZENTIK_ACTION_ICONS = {
+	acknowledge: "checkmark.circle",
+	dismiss: "xmark.circle",
+	silence: "bell.slash",
+	snooze: "zzz",
+	view: "eye",
+	play: "play.fill",
+	open: "door.left.hand.open",
+	close: "door.left.hand.closed",
+	lock: "lock.fill",
+	unlock: "lock.open.fill",
+	arm: "shield.fill",
+	"arm-home": "house.fill",
+	"arm-away": "figure.walk",
+	"arm-night": "moon.fill",
+	disarm: "shield.slash.fill",
+	light: "lightbulb.fill",
+	alert: "exclamationmark.triangle.fill",
+	camera: "video.fill"
+};
+/** The `sfsymbols:` prefix Zentik's clients strip before resolving the symbol. */
+var SFSYMBOLS_PREFIX = "sfsymbols:";
+/**
+* The Zentik value for one icon token, or `undefined` when there is none.
+*
+* Typed on `string`, not on `NotificationActionIcon`, because that is what this
+* boundary actually receives: an addon deployed against a hub whose vocabulary
+* moved on hands over a token this build has never heard of. Omitting it is the
+* honest answer — forwarding it raw would put a string iOS ignores on the wire
+* and produce exactly the blank button this map exists to fix.
+*
+* `Object.hasOwn` and not a truthiness check: an inherited `toString` must not
+* read as a mapping.
+*/
+function zentikActionIcon(icon) {
+	const table = ZENTIK_ACTION_ICONS;
+	if (!Object.hasOwn(ZENTIK_ACTION_ICONS, icon)) return void 0;
+	const symbol = table[icon];
+	return symbol === void 0 ? void 0 : `${SFSYMBOLS_PREFIX}${symbol}`;
+}
+/**
+* How a `BACKGROUND_CALL` names its request: `METHOD::url`.
+*
+* The whole reason the type exists here: a "silence this for 30 minutes"
+* button that opens a browser tab has already cost more attention than the
+* notification it was dismissing. `BACKGROUND_CALL` fires the callback and
+* leaves the phone where it is.
+*/
+var BACKGROUND_CALL_PREFIX = "POST::";
 function actionsFor(prepared) {
 	const out = [];
-	for (const action of prepared.actions.slice(0, MAX_ACTIONS)) if (action.url !== void 0 && action.url.length > 0) out.push({
-		type: "NAVIGATE",
-		title: action.label,
-		value: action.url
-	});
-	else out.push({
-		type: "OPEN_NOTIFICATION",
-		title: action.label
-	});
+	for (const action of prepared.actions.slice(0, MAX_ACTIONS)) {
+		const symbol = action.icon === void 0 ? void 0 : zentikActionIcon(action.icon);
+		const decoration = {
+			...action.destructive !== void 0 ? { destructive: action.destructive } : {},
+			...symbol !== void 0 ? { icon: symbol } : {}
+		};
+		if (action.url === void 0 || action.url.length === 0) {
+			out.push({
+				type: "OPEN_NOTIFICATION",
+				title: action.label,
+				...decoration
+			});
+			continue;
+		}
+		if (action.mode === "background") {
+			out.push({
+				type: "BACKGROUND_CALL",
+				title: action.label,
+				value: `${BACKGROUND_CALL_PREFIX}${action.url}`,
+				...decoration
+			});
+			continue;
+		}
+		out.push({
+			type: "NAVIGATE",
+			title: action.label,
+			value: action.url,
+			...decoration
+		});
+	}
 	return out;
 }
 function attachmentsFor(prepared) {
@@ -33688,6 +33953,17 @@ var zentikAdapter = {
 			],
 			format: ["text"],
 			clickUrl: true,
+			/**
+			* A RENDERING claim, which it was not before.
+			*
+			* This used to say the intent name "travels verbatim … a name the app does
+			* not know renders as no icon rather than as a wrong one" — true, and it
+			* described a feature that never once drew an icon, because NO intent name
+			* is an SF Symbol. The engine handed the icon over and the adapter put it
+			* on the wire untranslated. `ZENTIK_ACTION_ICONS` is what makes this claim
+			* honest; keep it exhaustive or this reverts to a pass-through that lies.
+			*/
+			actionIcons: true,
 			sound: true,
 			ttl: true,
 			bodyMaxLen: BODY_MAX_LEN

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-notifiers",
-  "version": "1.2.19",
+  "version": "1.2.21",
   "description": "System notifiers addon for CamStack — a `notification-output` collection provider hosting per-kind notifier adapters (ntfy, pushover, gotify, telegram, discord, webhook, zentik).",
   "keywords": [
     "camstack",