@camstack/addon-pipeline-orchestrator 1.2.10 → 1.2.11

package/dist/index.mjs

@@ -6880,6 +6880,36 @@ function randomGeneration() {
 	if (typeof crypto !== "undefined" && crypto.randomUUID) return crypto.randomUUID();
 	return Math.random().toString(36).slice(2, 14);
 }
+/**
+* Per-call node pinning for `ctx.api` capability calls.
+*
+* A capability call normally resolves to its DEFAULT provider — a `singleton`
+* cap resolves to the hub, a device-scoped cap to the device's owning node. To
+* query a SPECIFIC node's provider instead (e.g. a remote agent's own
+* in-process `platform-probe` hardware, which the hub cannot probe), pin the
+* call to that node.
+*
+* The nodeId rides OUT-OF-BAND in the tRPC call context (NOT in the validated
+* method args), so capability method signatures stay `nodeId`-free — node
+* targeting is a property of the CALL, not of the method. The transport lifts
+* it from `op.context` onto the `CapCallInput.nodeId` field (`ipcParentLink`),
+* and the hub parent's `onUnownedCall` passes it to the `CapRouteResolver`,
+* which classifies a pinned agent node as `agent-child-forward`
+* (`$agent-cap-fwd.forward` → the agent's in-process provider).
+*
+* Usage at a call site:
+*
+*   await api.platformProbe.getCapabilities.query(undefined, nodePin(nodeId))
+*/
+/** tRPC `op.context` key carrying a per-call node pin. */
+var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
+/**
+* Build the tRPC request options that pin a single capability call to `nodeId`.
+* Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
+*/
+function nodePin(nodeId) {
+	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: nodeId } };
+}
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -7983,16 +8013,23 @@ var StorageLocationDeclarationSchema = object({
 	* Which node root the seeded `<id>:default` instance is placed under on a
 	* FRESH install:
 	* - `'data'` (default) — the node's data dir (`CAMSTACK_DATA` / boot dir),
-	*   the appData volume. Right for small/durable data (backups, logs, models).
+	*   the appData volume. Right for small/durable data (logs, models).
 	* - `'media'` — the dedicated media volume (`CAMSTACK_MEDIA_ROOT`) when that
 	*   env is set, else falls back to the data root. Right for bulky, hot media
 	*   (recordings, event media) that should stay off the appData disk.
+	* - `'backup'` — the dedicated backup volume (`CAMSTACK_BACKUP_ROOT`, default
+	*   `/backups` in the image) so archives live on their own mount rather than
+	*   filling the appData disk. Falls back to the data root when unset.
 	*
 	* Only affects the seeded default's `basePath`; operators can repoint any
 	* location afterwards, and a `defaultsTo` slot inherits its parent's root
 	* regardless of this field. Absent (the common case) is treated as `'data'`.
 	*/
-	defaultRoot: _enum(["data", "media"]).optional()
+	defaultRoot: _enum([
+		"data",
+		"media",
+		"backup"
+	]).optional()
 });
 var DecoderStatsSchema = object({
 	inputFps: number(),
@@ -8117,36 +8154,6 @@ var EncodeProfileSchema = object({
 	outputArgs: array(string()).optional()
 });
 /**
-* Per-call node pinning for `ctx.api` capability calls.
-*
-* A capability call normally resolves to its DEFAULT provider — a `singleton`
-* cap resolves to the hub, a device-scoped cap to the device's owning node. To
-* query a SPECIFIC node's provider instead (e.g. a remote agent's own
-* in-process `platform-probe` hardware, which the hub cannot probe), pin the
-* call to that node.
-*
-* The nodeId rides OUT-OF-BAND in the tRPC call context (NOT in the validated
-* method args), so capability method signatures stay `nodeId`-free — node
-* targeting is a property of the CALL, not of the method. The transport lifts
-* it from `op.context` onto the `CapCallInput.nodeId` field (`ipcParentLink`),
-* and the hub parent's `onUnownedCall` passes it to the `CapRouteResolver`,
-* which classifies a pinned agent node as `agent-child-forward`
-* (`$agent-cap-fwd.forward` → the agent's in-process provider).
-*
-* Usage at a call site:
-*
-*   await api.platformProbe.getCapabilities.query(undefined, nodePin(nodeId))
-*/
-/** tRPC `op.context` key carrying a per-call node pin. */
-var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
-/**
-* Build the tRPC request options that pin a single capability call to `nodeId`.
-* Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
-*/
-function nodePin(nodeId) {
-	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: nodeId } };
-}
-/**
 * DEVICE-POOL backend → model format — the SSOT for the multi-device inference
 * DESCRIPTOR path (Python per-device pools), distinct from {@link BACKEND_TO_FORMAT}
 * above which is the legacy NODE runtime map (where `coreml → onnx` because
@@ -9429,529 +9436,1167 @@ function resolveDeviceProfile(features) {
 	return null;
 }
 /**
-* Generic device-level status snapshot. Auto-registered by `BaseDevice`
-* for every device, regardless of provider — the kernel needs a uniform
-* cap-keyed slice for the basic device flags every consumer expects to
-* read across processes (the `online` flag in particular). Driver-specific
-* caps (`battery`, `doorbell`, …) carry their domain-specific state on
-* their own slices.
+* Shared geometry vocabulary for on-frame shape caps — privacy-mask,
+* motion-zones, and the detection zones/lines editor all speak this one
+* language so a single drawing-plane editor and the providers stay
+* decoupled from each cap's storage.
 *
-* Pattern is identical to `battery`: schema-bearing `runtimeState`,
-* empty `methods`, single change event. Reads land at
-* `runtimeState.getCapState('device-status')`; writes at
-* `runtimeState.setCapState('device-status', …)`. Cross-process
-* consumers reach the same data via the `device-state` cap router
-* (`getCapSlice({deviceId, capName: 'device-status'})`).
+* All coordinates are normalized 0..1 of the camera frame (top-left
+* origin). Each cap composes the SUBSET of shape kinds it supports and
+* advertises it via `supportedShapes` in its `getOptions`.
 */
-var DeviceStatusSchema = object({
-	/**
-	* Device-level liveness. Drivers flip via `markOnline(boolean)` on
-	* `BaseDevice`. Provider semantics vary — RTSP aggregates broker
-	* stream-health, Reolink reads firmware push events, ONVIF tracks
-	* ping responses. This cap intentionally does NOT prescribe which
-	* signal drives the flag.
-	*/
-	online: boolean(),
-	/** Ms epoch of the last `online` transition. Lets consumers tell
-	*  apart "just came online" from "still online". */
-	lastChangedAt: number()
+/** A normalized 0..1 point (top-left origin). */
+var MaskPointSchema = object({
+	x: number(),
+	y: number()
 });
-object({
-	deviceId: number(),
-	status: DeviceStatusSchema
+/** Axis-aligned rectangle (normalized 0..1). */
+var MaskRectShapeSchema = object({
+	kind: literal("rect"),
+	x: number(),
+	y: number(),
+	width: number(),
+	height: number()
 });
-/**
-* Per-device feature/identity probe slice. Holds the runtime-resolved
-* truth about what a device CAN do — which the kernel uses to:
-*   1. Reconcile accessory children (hub-children spawn siren/floodlight/PIR
-*      based on what the firmware actually advertises).
-*   2. Compute the public `features: DeviceFeature[]` array surfaced via
-*      `device-manager.listAll`.
-*   3. Decide which optional caps (PTZ, intercom, doorbell, battery, …)
-*      to register on the device's capability surface.
-*
-* Auto-registered by `BaseDevice` for every device. Drivers populate the
-* slice from `onProbe()` (kernel calls it once after register, before
-* accessory reconciliation). Consumers read via:
-*   `runtimeState.getCapState<FeatureProbeStatus>('feature-probe')`
-*
-* `flags` is an open record so each driver carries its own keys without
-* a centralized schema bottleneck — Reolink writes `hasPtz/hasIntercom`,
-* Hikvision writes `hasSupplementalLight/hasAlarmIo`, etc.
-*
-* Replaces the older driver-local `deviceCache.has*` blob: the per-device
-* config is for operator-edited overrides + UI snapshots; runtime probe
-* results belong in runtime-state where the kernel handles persistence,
-* cross-process mirroring, and reactive updates.
-*/
-var FeatureProbeStatusSchema = object({
-	/**
-	* Driver-specific flag bag. Each driver picks its own key names — the
-	* cap deliberately does NOT enforce a closed enum here. Reolink keys:
-	* `hasPtz`, `hasIntercom`, `hasDoorbell`, `hasFloodlight`, `hasSiren`,
-	* `hasPirSensor`, `hasAutotrack`, `hasBattery`. Hikvision keys:
-	* `hasSupplementalLight`, `lightHasWhiteLight`, `hasAlarmIo`, `hasPtz`.
-	*/
-	flags: record(string(), unknown()),
-	/**
-	* Coarse driver-classification — lets cross-process consumers tell apart
-	* cameras / battery-cams / NVRs without re-running the probe. `null`
-	* before the first probe completes.
-	*/
-	deviceType: string().nullable(),
-	/** Camera/firmware model string. `null` when the firmware doesn't expose it. */
-	model: string().nullable(),
-	/** Channel count for NVR/Hub devices; `1` for standalone cameras; `null` pre-probe. */
-	channelCount: number().nullable(),
-	/**
-	* Ms epoch of the last SUCCESSFUL probe. `0` before the first probe
-	* completes — drivers' `getAccessoryChildren()` should treat zero as
-	* "probe not done yet, return empty" so accessories aren't spawned
-	* before the firmware is queried.
-	*/
-	lastProbedAt: number(),
-	/**
-	* Framework convention: every runtime-state slice carries this for the
-	* createRuntimeStateBridge stale-check helper. We keep it in sync with
-	* `lastProbedAt` on every write.
-	*/
-	lastFetchedAt: number()
+/** Free polygon — an ordered list of normalized vertices (≥3). */
+var MaskPolygonShapeSchema = object({
+	kind: literal("polygon"),
+	points: array(MaskPointSchema)
 });
-object({
-	deviceId: number(),
-	status: FeatureProbeStatusSchema
+/** Boolean cell grid — row-major, length === gridWidth*gridHeight. */
+var MaskGridShapeSchema = object({
+	kind: literal("grid"),
+	gridWidth: number(),
+	gridHeight: number(),
+	cells: array(boolean())
 });
-object({
-	/** Carbon dioxide concentration in ppm. */
-	co2Ppm: number().min(0).optional(),
-	/** Total volatile organic compounds in ppb. */
-	vocPpb: number().min(0).optional(),
-	/** Particulate matter ≤ 2.5 μm in µg/m³. */
-	pm25: number().min(0).optional(),
-	/** Particulate matter ≤ 10 μm in µg/m³. */
-	pm10: number().min(0).optional(),
-	/** Composite AQI value (typically 0..500). */
-	aqi: number().optional(),
-	/** Ms epoch when the slice was last updated. */
-	lastFetchedAt: number(),
-	/** Live display unit of the single metric this slice carries (e.g. HA
-	*  `attributes.unit_of_measurement` → 'ppm' / 'ppb' / 'µg/m³'). Each
-	*  upstream `sensor.*` entity surfaces ONE device_class, so one unit
-	*  per slice is unambiguous. */
-	unit: string().optional(),
-	/** Suggested decimal places for numeric display.
-	*  Populated live from the upstream source when provided (e.g. HA
-	*  `attributes.suggested_display_precision`). Falls back to
-	*  auto-formatting when absent. */
-	precision: number().int().min(0).max(10).optional()
+discriminatedUnion("kind", [
+	MaskRectShapeSchema,
+	MaskPolygonShapeSchema,
+	MaskGridShapeSchema,
+	object({
+		kind: literal("line"),
+		points: array(MaskPointSchema)
+	})
+]);
+/** Every shape-kind discriminant, for `supportedShapes` advertisement. */
+var MaskShapeKindSchema = _enum([
+	"rect",
+	"polygon",
+	"grid",
+	"line"
+]);
+/** Polygon vertex bounds when a cap supports 'polygon' (e.g. Hikvision {min:4,max:4}). */
+var MaskPolygonVerticesSchema = object({
+	min: number(),
+	max: number()
+});
+/** Grid dimensions when a cap supports 'grid'. */
+var MaskGridDimsSchema = object({
+	width: number(),
+	height: number()
 });
-DeviceType.Sensor;
 /**
-* Alarm-panel cap. Models HA `alarm_control_panel.*` on
-* `DeviceType.AlarmPanel`. State follows HA's canonical lifecycle
-* across disarmed / armed_(home|away|night|vacation|custom_bypass) /
-* arming / pending / triggered / disarming.
+* notification-rules — the Notification Center rule surface (P1 core).
 *
-* Many panels require a PIN code on arm / disarm — the optional
-* `code` field on the methods passes it through to the upstream
-* service; it's NEVER persisted in the runtime slice or any event
-* payload. The presence of a required code is signalled by
-* `DeviceFeature.AlarmPinRequired` so the UI gates a code-entry
-* field without a slice fetch.
+* Spec: `docs/superpowers/specs/2026-07-22-notification-center-requirements.md`
+* (operator decisions D-1/D-2/D-3 are binding):
 *
-* `availableModes` mirrors HA's `supported_features`-derived arm
-* mode list — the UI renders only the buttons the panel accepts.
-*/
-var AlarmStateSchema = _enum([
-	"disarmed",
-	"armed_home",
-	"armed_away",
-	"armed_night",
-	"armed_vacation",
-	"armed_custom_bypass",
-	"arming",
-	"disarming",
-	"pending",
-	"triggered"
-]);
-var AlarmArmModeSchema = _enum([
-	"home",
-	"away",
-	"night",
-	"vacation",
-	"custom_bypass"
-]);
-object({
-	/** Current lifecycle state. */
-	state: AlarmStateSchema,
-	/** Subset of arm modes the panel accepts. UI renders one button per
-	*  mode in this list. */
-	availableModes: array(AlarmArmModeSchema),
-	/** Whether the panel requires a PIN on arm / disarm. Mirrors
-	*  `DeviceFeature.AlarmPinRequired` for slice consumers. */
-	requiresCode: boolean(),
-	/** Ms epoch when the slice was last updated. */
-	lastChangedAt: number()
-});
-DeviceType.AlarmPanel, method(object({
-	deviceId: number().int().nonnegative(),
-	mode: AlarmArmModeSchema,
-	/** Optional PIN code. Required when `requiresCode === true`.
-	*  Passed through to the upstream service; never persisted. */
-	code: string().min(1).optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	code: string().min(1).optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-object({
-	/** Current illuminance in lux (lx). */
-	lux: number().min(0),
-	/** Ms epoch when the slice was last updated. */
-	lastFetchedAt: number(),
-	/** Live display unit from the upstream source (e.g. HA
-	*  `attributes.unit_of_measurement`). The UI prefers this over the
-	*  role's canonical unit. Absent → fall back to the canonical unit. */
-	unit: string().optional(),
-	/** Suggested decimal places for numeric display.
-	*  Populated live from the upstream source when provided (e.g. HA
-	*  `attributes.suggested_display_precision`). Falls back to
-	*  auto-formatting when absent. */
-	precision: number().int().min(0).max(10).optional()
-});
-DeviceType.Sensor;
-/**
-* Per-class audio metrics aggregated over a sliding window.
+*  - D-2: rule EVALUATION lives in `addon-post-analysis` (the
+*    `notification-center` module), hooked on the durable persistence
+*    moments (object-event insert, TrackCloser.closeExpired) with a
+*    persisted outbox + retry — never the lossy telemetry bus (D8).
+*  - D-3: urgency belongs to the RULE. `delivery: 'immediate'` fires on the
+*    FIRST persisted detection matching the conditions (per-track dedup,
+*    `maxPerTrack` fixed at 1 — see {@link NC_MAX_PER_TRACK_IMMEDIATE});
+*    `delivery: 'track-end'` evaluates the finalized track record at close.
+*  - DISPATCH stays behind `notification-output` (rules reference targets
+*    by id; per-backend params are a passthrough blob capped by the
+*    target kind's own caps/degrade engine).
+*
+* P1 scope: admin-authored rules only (`createdBy` stamped from the
+* server-injected caller identity — the first `caller: 'required'`
+* adopter). The P1 condition subset is: devices, classes(+exclude),
+* minConfidence, admin zones (any/all + exclude), weekly schedule
+* windows, and the optional label/identity/plate matchers. User rules,
+* private zones, per-recipient fan-out and the wider condition table are
+* P2+ (see spec §7).
+*
+* All schemas here are the single source of truth — `NcRule` etc. are
+* `z.infer` exports; no duplicate interfaces (the advanced-notifier
+* schema/interface drift is explicitly not repeated).
 */
-var AudioClassSummarySchema = object({
-	className: string(),
-	/** Number of windows (chunks) where this class was the top hit. */
-	hits: number().int().nonnegative(),
-	/** Mean score across those hits, clamped to [0,1]. */
-	avgScore: number().min(0).max(1),
-	/** Peak score in the window. */
-	peakScore: number().min(0).max(1)
-});
 /**
-* Per-camera audio metrics snapshot — emitted by the analytics frame
-* handler on every `pipeline.audio-inference-result` event and
-* mirrored into the `audio-metrics` device-state slice. Symmetric
-* with `zone-analytics` snapshots for video — every consumer
-* (admin UI panel, automations, alert rules) reads via the
-* canonical `device.state.audioMetrics.value` reactive handle.
+* D-3: the trigger/urgency of a rule — which persistence moment evaluates it.
+* The value maps 1:1 onto the evaluated record kind:
+*  - `immediate`     ↔ object-event persist (lowest-latency detection burst)
+*  - `track-end`     ↔ TrackCloser.closeExpired (finalized track record)
+*  - `device-event`  ↔ SensorEventStore insert (doorbell press / sensor state
+*                       change of a LINKED device, one row per linked camera)
+*  - `package-event` ↔ PackageDropDetector object-event insert (a `package`
+*                       delivery / pick-up)
 *
-* Aggregates are computed over a rolling `windowSec` window
-* (default 60s). Past that window, classes drop out of `byClass`
-* and the level history shifts forward.
+* `immediate`/`track-end` carry the D-3 urgency semantics; `device-event`/
+* `package-event` are pure trigger kinds (no urgency dimension). Extending
+* this one field keeps the schema additive — a rule still declares exactly
+* one trigger.
 */
-var AudioMetricsSnapshotSchema = object({
-	/** Wall-clock timestamp (ms) of the most recent audio window. */
-	ts: number().int(),
-	/** Sliding-window length (seconds) used for aggregation. */
-	windowSec: number().int().positive(),
-	/** Latest level reading from the most recent window. */
-	level: object({
-		rms: number(),
-		dbfs: number()
-	}),
-	/** Peak dBFS observed across the rolling window. */
-	peakDbfs: number(),
-	/** Mean dBFS across the rolling window. */
-	avgDbfs: number(),
-	/** Most recent above-threshold classification, or null on silence. */
-	current: object({
-		className: string(),
-		score: number().min(0).max(1),
-		timestamp: number().int()
-	}).nullable(),
-	/** Per-class summary across the rolling window — keys are
-	*  `macroClass` strings (e.g. `dog_bark`, `speech`, `glass_break`). */
-	byClass: array(AudioClassSummarySchema).readonly()
+var NcDeliverySchema = _enum([
+	"immediate",
+	"track-end",
+	"device-event",
+	"package-event"
+]);
+/** Weekly schedule — OR of windows; absence on the rule = always active. */
+var NcScheduleSchema = object({
+	windows: array(object({
+		/** Days of week the window STARTS on (0 = Sunday … 6 = Saturday). */
+		days: array(number().int().min(0).max(6)).min(1),
+		startMinute: number().int().min(0).max(1439),
+		endMinute: number().int().min(0).max(1439)
+	})).min(1),
+	/** IANA timezone; default = hub host timezone. */
+	timezone: string().optional(),
+	/** Active OUTSIDE the windows (e.g. "only outside business hours"). */
+	invert: boolean().optional()
+});
+/** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
+var NcPlateMatcherSchema = object({
+	values: array(string().min(1)).min(1),
+	/** Max Levenshtein distance after normalization (uppercase alphanumeric). */
+	maxDistance: number().int().min(0).max(3).default(1)
 });
 /**
-* Audio-metrics history payload — a series of `AudioMetricsHistoryPoint`
-* samples capped at `maxPoints` (default 1024). When the requested
-* `windowSec / sampleEveryMs` would exceed the cap, the provider
-* subsamples by bucketed averaging and reports the effective sample
-* spacing on `effectiveSampleEveryMs` so the UI can label the x-axis.
+* Occupancy condition (DEVICE-EVENT trigger). Fires on a ZoneAnalytics
+* occupancy edge for a device — optionally narrowed to a single admin
+* `zoneId` and/or object `className`. `op` selects the edge/threshold:
+*  - `became-occupied` (default) — count crossed 0 → ≥ `count`
+*  - `became-free`               — count crossed ≥ `count` → below it
+*  - `>=` / `<=`                 — count is at/over or at/under `count`
+* `sustainSeconds` requires the condition hold continuously that long
+* before firing (debounces flicker; 0 = fire on the first matching edge).
+* Fail-closed: no ZoneAnalytics snapshot / missing zone / null snapshot ⇒
+* the condition never matches. Confirmed edge-state survives addon restarts
+* (declared SQLite collection, reseeded on boot).
 */
-var AudioMetricsHistorySchema = object({
-	points: array(object({
-		/** Wall-clock ms when this sample was recorded. */
-		ts: number().int(),
-		/** Instantaneous dBFS level at sample time. `null` for windows where
-		*  the source had no level reading (rare; happens at decode startup). */
-		dbfs: number().nullable(),
-		/** Rolling-window peak dBFS at sample time. Same window the live
-		*  snapshot reports. */
-		peakDbfs: number(),
-		/** Rolling-window mean dBFS at sample time. */
-		avgDbfs: number(),
-		/** Dominant above-threshold class at sample time, or null on silence. */
-		topClass: string().nullable(),
-		/** Score of the dominant class (`null` whenever `topClass` is null). */
-		topScore: number().min(0).max(1).nullable()
-	})).readonly(),
-	/** Actual ms between adjacent samples after any subsampling. */
-	effectiveSampleEveryMs: number().int().positive(),
-	/** Wall-clock window covered by `points` (`points[N-1].ts - points[0].ts`),
-	*  or `0` when there's fewer than 2 samples. */
-	windowMsActual: number().int().nonnegative()
-});
-DeviceType.Camera, method(object({ deviceId: number() }), AudioMetricsSnapshotSchema.nullable()), method(object({
-	deviceId: number(),
-	/** History window in seconds. Default 300 (5 minutes).
-	*  Provider clamps to its retention cap if larger. */
-	windowSec: number().int().positive().optional(),
-	/** Target sample interval in ms. Default 1000 (1 sample/second).
-	*  Provider clamps to natural sample rate if smaller, and
-	*  bucket-averages when bigger than the requested window
-	*  would produce more than `maxPoints` samples. */
-	sampleEveryMs: number().int().positive().optional()
-}), AudioMetricsHistorySchema);
-object({
-	/** Whether the automation is currently enabled. Disabled automations
-	*  ignore their trigger block — manual `trigger` still works. */
-	enabled: boolean(),
-	/** Whether the automation is currently executing its action block. */
-	isRunning: boolean(),
-	/** Ms epoch of the last successful run. 0 when never run. */
-	lastTriggeredAt: number(),
-	/** Failure description from the last completed run. Null on success
-	*  or when never run. */
-	lastError: string().nullable(),
-	/** Ms epoch when the slice was last updated. */
-	lastChangedAt: number()
+var NcOccupancyConditionSchema = object({
+	/** Admin zone id to scope the count to; absent = whole-frame occupancy. */
+	zoneId: string().optional(),
+	/** Object class to count; absent = any class. */
+	className: string().optional(),
+	op: _enum([
+		"became-occupied",
+		"became-free",
+		">=",
+		"<="
+	]).default("became-occupied"),
+	count: number().int().min(0).default(1),
+	sustainSeconds: number().int().min(0).max(3600).default(15)
 });
-DeviceType.Automation, method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int().nonnegative(),
-	/** When true, fires the action block while bypassing the
-	*  automation's condition evaluation. Gated by
-	*  `DeviceFeature.AutomationSkipCondition`. */
-	skipCondition: boolean().optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
+/** Admin-zone membership condition (zone IDs as stamped by the ZoneEngine). */
+var NcZoneConditionSchema = object({
+	ids: array(string().min(1)).min(1),
+	/** Quantifier over `ids` — at least one / every one visited. */
+	match: _enum(["any", "all"]).default("any")
 });
 /**
-* Battery status snapshot. Emitted by providers whose device is
-* battery-operated (cameras with `DeviceFeature.BatteryOperated`,
-* future sensor/button accessories). Consumers build their own "low
-* battery" alerting on top — the cap deliberately does NOT enforce a
-* threshold.
+* The P1 condition set — a flat AND of groups; absent group = pass;
+* membership lists are OR within the list (spec §2.3).
 */
-var BatteryStatusSchema = object({
-	/** 0..100 inclusive. Firmware-reported. */
-	percentage: number().min(0).max(100),
+var NcConditionsSchema = object({
+	/** Device scope — absent = all devices. */
+	devices: array(number()).optional(),
+	/** Detector class names (any overlap with the record's class set). */
+	classes: array(string().min(1)).optional(),
+	/** Veto classes — any overlap fails the rule. */
+	classesExclude: array(string().min(1)).optional(),
+	/** Minimum detection confidence 0–1 (fails when the record has none). */
+	minConfidence: number().min(0).max(1).optional(),
+	/** Admin zone membership over event `zones` / track `zonesVisited`. */
+	zones: NcZoneConditionSchema.optional(),
+	/** Veto zones — any hit fails the rule. */
+	zonesExclude: array(string().min(1)).optional(),
 	/**
-	* Charging source. `'dc'` covers wall/USB adapters; `'solar'` is
-	* Reolink-specific for the Solar Panel 2 accessory (will become
-	* common on other battery cams). `'none'` means running on battery
-	* alone.
+	* Exact (case-insensitive) match on the record's collapsed `label`
+	* (identity name / plate text / subclass).
 	*/
-	charging: _enum([
-		"dc",
-		"solar",
-		"none"
-	]),
+	labelEquals: array(string().min(1)).optional(),
 	/**
-	* True when the camera firmware has gone into low-power mode. Battery
-	* providers MUST avoid polling during sleep — reading the battery
-	* wakes the camera up and drains charge.
+	* Identity matcher. P1 boundary: matched against the record's collapsed
+	* `label` (the identity display name propagated by the face pipeline) —
+	* identity-ID matching rides in P2 when identity ids reach the record.
 	*/
-	sleeping: boolean(),
-	/** Ms epoch of the last observation. Lets consumers reason about freshness. */
-	lastUpdated: number(),
+	identities: array(string().min(1)).optional(),
+	/** Fuzzy plate matcher against the record's `label` (plate text). */
+	plates: NcPlateMatcherSchema.optional(),
 	/**
-	* True when the source is a BINARY low-battery indicator (HA
-	* `binary_sensor` device_class=battery / `LOW_BAT`) that has no real
-	* charge level — `percentage` is then a coarse stand-in (100 = normal,
-	* sub-threshold = low). UI MUST render "Normal"/"Low" instead of a
-	* misleading exact percentage. Absent/false → genuine 0–100 % reading.
+	* Identity EXCLUDE — mirror of {@link identities} with `notIn` semantics.
+	* Same P1 boundary: matched against the record's collapsed `label` (the
+	* identity display name). A record with NO label passes (nothing to
+	* exclude), unlike the include variant which fails on an absent label.
 	*/
-	binary: boolean().optional()
-});
-DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, method(object({
-	deviceId: number(),
-	/** Bound on the wait. Sensible range 3000–10000ms. */
-	timeoutMs: number().int().min(500).max(3e4).default(8e3)
-}), object({
-	awoke: boolean(),
-	durationMs: number()
-}), { kind: "mutation" }), object({
-	deviceId: number(),
-	status: BatteryStatusSchema
-});
-object({
-	on: boolean(),
-	/** Ms epoch of the last transition. 0 if never observed. */
-	lastChangedAt: number()
-});
-DeviceType.Sensor;
-object({
-	/** Current level as 0..100 inclusive. Firmware-reported. */
-	percentage: number().min(0).max(100),
-	/** Ms epoch of the last operator-driven change. Useful for UI freshness. */
-	lastChangedAt: number()
-});
-DeviceType.Light, method(object({
-	deviceId: number().int().nonnegative(),
-	percentage: number().min(0).max(100)
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), object({
-	deviceId: number(),
-	percentage: number().min(0).max(100),
-	lastChangedAt: number()
-});
-/** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
-var StreamFormatSchema = _enum([
-	"webrtc",
-	"hls",
-	"mjpeg",
-	"rtsp"
-]);
-var RtspRestreamEntrySchema = object({
-	brokerId: string(),
-	url: string(),
-	mutedUrl: string(),
-	enabled: boolean(),
+	identitiesExclude: array(string().min(1)).optional(),
 	/**
-	* Source-stream codec / resolution for the camStream this entry serves
-	* (the broker's "high"/"mid"/"low" profile slot for this device).
-	* Used by exporter pickers (`pickPreferredRtspEntry`) to resolve
-	* `streamPreference: 'auto'` to the slot whose source is closest to
-	* the consumer's target — Alexa wants ~720p, HomeKit wants ~1080p,
-	* and there's no point dialling the 4K slot for an Echo Show. Absent
-	* when the source publisher never advertised the field; pickers fall
-	* back to first-enabled in that case.
+	* Minimum server-computed key-event importance in [0,1] (`Track.importance`).
+	* TRACK-END only: importance is scored at track close, so it does not exist
+	* at immediate / object-event evaluation time (see catalog `appliesTo`). At
+	* close the value is threaded via the close-time info (the `Track` clone is
+	* captured before the DB row is updated, so it would otherwise read stale).
+	* Fails when the record carries no importance (never guess quality — the
+	* `minConfidence` precedent). MVP cut: a single scalar threshold.
 	*/
-	codec: string().optional(),
-	resolution: object({
-		width: number().int().positive(),
-		height: number().int().positive()
-	}).optional()
-});
-var BrokerRtspClientSchema = object({
-	sessionId: string(),
-	remoteAddr: string(),
-	/** Client `User-Agent` (e.g. `recorder` for the recorder's RTSP pull), or
-	*  null/absent when the client sent none. Lets the UI label a consumer by
-	*  purpose. Optional so a client built against an older schema stays valid. */
-	userAgent: string().nullish(),
-	playing: boolean(),
-	muted: boolean(),
-	connectedAt: number(),
-	lastRtpAt: number(),
-	bytesSent: number()
-});
-var BrokerDecodedClientSchema = object({
-	tag: string(),
-	subscribedAt: number(),
-	maxFps: number(),
-	framesDelivered: number(),
-	framesDropped: number()
-});
-var BrokerAudioClientSchema = object({
-	tag: string(),
-	subscribedAt: number(),
-	chunksDelivered: number()
-});
-var BrokerConsumerAttributionSchema = object({
-	kind: _enum([
-		"alexa",
-		"homekit",
-		"webrtc-browser",
-		"webrtc-mobile",
-		"webrtc-whep",
-		"rtsp-listen",
-		"derived-broker",
-		"recording",
-		"pipeline",
-		"snapshot",
-		"warmup",
-		"unknown"
-	]),
+	minImportance: number().min(0).max(1).optional(),
 	/**
-	* Free-form label intended to disambiguate consumers OF THE SAME kind
-	* on the same broker — e.g. user name, device alias. Should NOT repeat
-	* the kind / cam / cam-stream / sessionId (those are surfaced by
-	* dedicated fields). When empty the widget falls back to `${kind} ·
-	* <sessionId tail>`.
+	* Minimum track dwell in SECONDS — `(lastSeen − firstSeen) / 1000`.
+	* TRACK-END only: an `immediate` / object-event subject has no closed
+	* lifespan, so a dwell condition never matches immediate delivery
+	* (documented choice — the object-event record carries no `firstSeen`,
+	* so dwell cannot be computed from what the subject actually carries).
 	*/
-	label: string().optional(),
+	minDwellSeconds: number().min(0).optional(),
 	/**
-	* Which part of the encoded plane this subscription consumes:
-	*   - `'audio'` — audio packets only
-	*   - `'video'` — video packets only
-	*   - `'both'`  — both video + audio (typical for AnnexB push paths
-	*                 that don't split the source RTP)
-	*
-	* Missing field means "unknown" — older callers and the legacy
-	* paths that haven't been migrated yet.
+	* Detection provenance filter. `any` (default / absent) matches every
+	* source; otherwise the subject's source must equal it. Legacy records
+	* with no stamped source are treated as `pipeline`. The union spans both
+	* record kinds — object events carry `pipeline` | `onboard`, synthetic
+	* tracks carry `sensor`.
 	*/
-	media: _enum([
-		"audio",
-		"video",
-		"both"
+	source: _enum([
+		"pipeline",
+		"onboard",
+		"sensor",
+		"any"
 	]).optional(),
 	/**
-	* Codec the consumer receives AFTER any per-session re-encoding. For
-	* a WebRTC session this is the negotiated egress codec (e.g. `H264`,
-	* `H265`, `Opus`, `Pcmu`); for an RTSP restreamer it mirrors the
-	* source codec. Surfaced in the widget chip so operators see at a
-	* glance whether a viewer is on H.264 (Echo) or H.265 (Safari).
+	* Minimum identity / plate MATCH confidence in [0,1] — DISTINCT from the
+	* detector `minConfidence` (that gates the object-detection score; this
+	* gates the recognition/OCR match score). Fails when the subject carries
+	* no label-match confidence (never guess). TRACK-END only: the confidence
+	* lives on the recognition result and reaches the subject at track close.
+	*
+	* What it measures precisely (plumbed at track close — the closer threads
+	* the value into `NcTrackClosedInfo.labelConfidence`, the same seam as
+	* `importance`): the BEST recognition match confidence observed for the
+	* label the track carries at close — for a face, the peak cosine similarity
+	* of the ASSIGNED identity (`FaceMatch.score`, reset on an identity switch);
+	* for a plate, the peak OCR read score of the best-held plate
+	* (`plateText.confidence`). When BOTH a face and a plate were recognized on
+	* one track the higher of the two is used. A track that ended with no
+	* confident identity/plate match carries no value, so the condition fails
+	* closed for it (an un-recognized subject).
 	*/
-	targetCodec: string().optional(),
+	minLabelConfidence: number().min(0).max(1).optional(),
 	/**
-	* Whether the broker is re-encoding for this consumer:
-	*   - `'passthrough'` — bytes flow source→consumer without ffmpeg
-	*   - `'repacketize'` — RTP payload is re-packetized but NOT re-encoded
-	*                       (preserves frames, just rebuilds headers; e.g.
-	*                       the H.265 repacketizer path)
-	*   - `'transcode'`   — a full encode/decode round (ffmpeg, libx264,
-	*                       libav…); the most expensive path
+	* DEVICE-EVENT only. Raw device event-type tokens (`EventFire.eventType`,
+	* e.g. a doorbell `press` / `press_long`) — matched case-insensitively
+	* against the token carried on the device-event subject (extracted from the
+	* event-emitter runtime slice's `lastEvent.eventType`). Fails when the
+	* subject carries no token. Doorbell-pulse / passive-sensor kinds emit no
+	* eventType, so gate those with {@link sensorKinds} instead.
 	*/
-	transport: _enum([
-		"passthrough",
-		"repacketize",
-		"transcode"
-	]).optional(),
-	/** Remote peer IP if the consumer terminates a network socket. */
-	remoteAddr: string().optional(),
+	eventTypeTokens: array(string().min(1)).optional(),
 	/**
-	* Server-read User-Agent of the originating client; enriched by the hub
-	* from the tRPC request context (browser sessions).
+	* DEVICE-EVENT only. Sensor/control taxonomy kinds (e.g. `doorbell`,
+	* `contact`, `button`, `device-event`) — matched against the persisted
+	* `SensorEvent.kind` (see `sensor-event-kinds.ts`). Membership is OR.
 	*/
-	userAgent: string().optional(),
-	/** Authenticated user id (CamStack OAuth subject) when known. */
-	userId: string().optional(),
-	/** Higher-level session identifier (Alexa Echo sessionId, HAP session, …). */
-	sessionId: string().optional(),
-	/** Free-form key/value extras (e.g. clientHints from a WebRTC offer). */
-	extra: record(string(), string()).optional()
-}).readonly();
-var BrokerEncodedClientSchema = object({
-	/** Stable id assigned on attach; used by `killClient`. */
-	id: string(),
-	/** Which broker fanout the subscriber rides — annexB encoded packets vs raw RTP. */
-	channel: _enum(["annexb", "rtp"]),
-	attribution: BrokerConsumerAttributionSchema,
+	sensorKinds: array(string().min(1)).optional(),
+	/**
+	* PACKAGE-EVENT only. Which package phase fires the rule — `delivered`
+	* (a parked parcel appeared), `picked-up` (it departed), or `both`. Fails
+	* when the subject's phase does not match (a subject always carries a phase
+	* on the package-event trigger).
+	*/
+	packagePhase: _enum([
+		"delivered",
+		"picked-up",
+		"both"
+	]).optional(),
+	/**
+	* PERSONAL-RULE custom zones (viewer-drawn). Inline normalized polygons
+	* (MaskShape vocabulary). A record passes when its bbox overlaps ANY
+	* listed polygon (ZoneEngine membership semantics). Evaluated only when
+	* the subject carries a bbox; absent bbox ⇒ the condition FAILS.
+	*/
+	customZones: array(MaskPolygonShapeSchema).optional(),
+	/**
+	* DEVICE-EVENT only. ZoneAnalytics occupancy edge — fires when a device's
+	* (optionally zone/class-scoped) occupancy count crosses the configured
+	* threshold and holds for `sustainSeconds`. Fail-closed on missing
+	* substrate (no snapshot / missing zone). See {@link NcOccupancyCondition}.
+	*/
+	occupancy: NcOccupancyConditionSchema.optional()
+});
+/** One delivery target: a `notification-output` Target ref + passthrough params. */
+var NcRuleTargetSchema = object({
+	/** `notification-output` Target id. */
+	targetId: string().min(1),
+	/**
+	* Per-backend passthrough. Recognized keys are mapped onto the canonical
+	* Notification (`priority`, `level`, `sound`, `clickUrl`, `ttl`); the
+	* degrade engine drops what the backend can't render.
+	*/
+	params: record(string(), unknown()).optional()
+});
+/**
+* Media attachment policy (P1 still-image subset).
+*  - `best` — the best AVAILABLE subject image at dispatch time (D-3).
+*  - `best-matching` — the media that explains WHY the rule fired: a rule
+*    matched on identities attaches the subject's `faceCrop`, one matched on
+*    plates attaches the `plateCrop`; a rule with no identity/plate condition
+*    (or when the specific crop is missing) degrades to `best`, then
+*    `keyFrame`, then no attachment — never delaying the send. The matched
+*    condition summary is frozen on the outbox row at enqueue (like the rule
+*    name), so the choice never drifts from the record that fired it.
+*  - `keyFrame` — the clean scene frame (no subject box).
+*  - `none` — no attachment.
+*/
+var NcMediaPolicySchema = object({ attach: _enum([
+	"best",
+	"best-matching",
+	"keyFrame",
+	"none"
+]).default("best") });
+/** Throttle — cooldown survives restarts (rebuilt from the outbox on boot). */
+var NcThrottleSchema = object({
+	cooldownSec: number().int().min(0).max(86400).default(60),
+	/** `rule` = one shared cooldown; `rule-device` = per-camera cooldown. */
+	scope: _enum(["rule", "rule-device"]).default("rule-device")
+});
+/** Client-supplied rule fields (server stamps id/createdBy/createdAt/updatedAt). */
+var NcRuleInputSchema = object({
+	name: string().min(1).max(200),
+	enabled: boolean().default(true),
+	delivery: NcDeliverySchema,
+	conditions: NcConditionsSchema.default({}),
+	schedule: NcScheduleSchema.optional(),
+	targets: array(NcRuleTargetSchema).min(1),
+	media: NcMediaPolicySchema.default({ attach: "best" }),
+	throttle: NcThrottleSchema.default({
+		cooldownSec: 60,
+		scope: "rule-device"
+	}),
+	/** `{{var}}` templating over camera/class/label/zones/confidence/time. */
+	template: object({
+		title: string().max(500).optional(),
+		body: string().max(2e3).optional()
+	}).optional(),
+	/** Canonical notification priority ordinal (1..5); per-target overridable. */
+	priority: number().int().min(1).max(5).default(3),
+	/**
+	* Ownership/visibility key. Absent = admin/global rule (unchanged legacy
+	* behaviour, visible to all, read-only in the viewer). Present = personal
+	* rule owned by this userId. Server-stamped; never trusted from a client.
+	*/
+	ownerUserId: string().optional()
+});
+/**
+* Partial patch for `updateRule` — any subset of the input fields, plus the
+* persisted-only {@link NcRuleSchema} `disabledTargetIds` set. The latter is
+* NOT a client-authored input field (it lives on the persisted rule, not the
+* input), so it is added here explicitly to let the store's per-target opt-out
+* toggle round-trip through the shared `update` path. Viewer opt-out mutations
+* still flow through `nc.setRuleTargetEnabled` (owner-checked), never a raw
+* `updateRule` patch.
+*/
+var NcRulePatchSchema = NcRuleInputSchema.partial().extend({ disabledTargetIds: array(string()).optional() });
+/** A persisted rule. */
+var NcRuleSchema = NcRuleInputSchema.extend({
+	id: string(),
+	/** userId of the admin who created the rule (server-stamped caller). */
+	createdBy: string(),
+	createdAt: number(),
+	updatedAt: number(),
+	/**
+	* Per-target opt-out set. A targetId here is suppressed for THIS rule at
+	* send time. Only a target's OWNER may add/remove its id (server-checked
+	* in `nc.setRuleTargetEnabled`). Defaults to empty.
+	*/
+	disabledTargetIds: array(string()).default([])
+});
+var NcTestResultSchema = object({
+	recordId: string(),
+	recordKind: _enum([
+		"object-event",
+		"track",
+		"device-event",
+		"package-event"
+	]),
+	deviceId: number(),
+	timestamp: number(),
+	wouldFire: boolean(),
+	/** Condition id that failed (first failing group), when `wouldFire` is false. */
+	failedCondition: string().optional(),
+	className: string().optional(),
+	label: string().optional()
+});
+var NcConditionDescriptorSchema = object({
+	/** Field id inside `NcConditions` (or `'schedule'` for the rule-level group). */
+	id: string(),
+	group: _enum([
+		"scope",
+		"class",
+		"zones",
+		"quality",
+		"label",
+		"schedule",
+		"device",
+		"package",
+		"occupancy"
+	]),
+	label: string(),
+	/** Editor widget the UI renders — never hardcode per-condition forms. */
+	valueType: _enum([
+		"deviceIdList",
+		"stringList",
+		"number01",
+		"number",
+		"sourceSelect",
+		"zoneSelection",
+		"zoneIdList",
+		"schedule",
+		"plateMatcher",
+		"packagePhase",
+		"polygonDraw",
+		"occupancy"
+	]),
+	operator: _enum([
+		"in",
+		"notIn",
+		"anyOf",
+		"allOf",
+		"gte",
+		"fuzzyIn",
+		"withinSchedule"
+	]),
+	/** Which delivery kinds the condition applies to. */
+	appliesTo: array(NcDeliverySchema),
+	phase: string(),
+	description: string().optional()
+});
+/**
+* The delivery lifecycle status of a history row — a straight read of the
+* durable outbox row's own status (single source of truth):
+*  - `pending` — enqueued, in-flight or retrying with backoff
+*  - `sent`    — delivered (terminal)
+*  - `dead`    — dead-lettered after exhausting retries / a permanent
+*                backend rejection / a deleted target (terminal; carries
+*                the failure `error`)
+*
+* P1 has no `suppressed-quiet-hours` / `snoozed` states — those ride the P2
+* user dimension (quiet hours / snooze) and are additive when they land.
+*/
+var NcHistoryStatusSchema = _enum([
+	"pending",
+	"sent",
+	"dead"
+]);
+/** The evaluated record kind a history row descends from (one per trigger). */
+var NcHistoryRecordKindSchema = _enum([
+	"object-event",
+	"track-end",
+	"device-event",
+	"package-event"
+]);
+/** Subject summary frozen on the row at fire time (survives rule/record edits). */
+var NcHistorySubjectSchema = object({
+	className: string(),
+	label: string().optional(),
+	confidence: number().optional(),
+	zones: array(string()),
+	timestamp: number()
+});
+/**
+* One delivery-history row. This is a read-only VIEW over the durable
+* outbox row (single source of truth — the same row the drain loop drives;
+* NO second write path, so history can never drift from delivery state).
+* The §3.2 fields map directly: `ruleId`/`targetId`/`deviceId` are columns,
+* `eventRef` is `recordKind`+`recordId`, `timestamps` are `createdAt`
+* (fire) / `updatedAt` (last transition), `status` + `error` are the
+* lifecycle. `ruleName` + `subject` are the intent snapshot frozen at
+* enqueue. `userId?` (per-recipient history) is P2 — no user dimension in
+* P1 (admin scope only).
+*/
+var NcHistoryEntrySchema = object({
+	/** Outbox row id — the stable dedup id `ruleId:dedupRef:targetId`. */
+	id: string(),
+	ruleId: string(),
+	/** Rule name frozen at fire time (outlives a later rename / delete). */
+	ruleName: string(),
+	/** The rule urgency/trigger that produced this delivery. */
+	delivery: NcDeliverySchema,
+	targetId: string(),
+	deviceId: number(),
+	recordKind: NcHistoryRecordKindSchema,
+	/** Event / track ref of the evaluated record (§3.2 `eventRef`). */
+	recordId: string(),
+	/** Present for track-scoped deliveries (object-event / track-end). */
+	trackId: string().optional(),
+	status: NcHistoryStatusSchema,
+	/** Delivery attempts made so far. */
+	attempts: number().int(),
+	/** Fire time (outbox enqueue). */
+	createdAt: number(),
+	/** Last transition time (terminal for sent / dead). */
+	updatedAt: number(),
+	/** Failure detail — present on a `dead` row. */
+	error: string().optional(),
+	subject: NcHistorySubjectSchema
+});
+/**
+* Query filter for `getHistory` (spec §4.2). Every field is a narrowing
+* AND; absent = unbounded on that axis. `since`/`until` bound the fire time
+* (`createdAt`, epoch ms, inclusive). `limit` is clamped to
+* {@link NC_HISTORY_LIMIT_MAX}. `userId` (per-recipient filtering) is P2.
+*/
+var NcHistoryFilterSchema = object({
+	ruleId: string().optional(),
+	deviceId: number().optional(),
+	status: NcHistoryStatusSchema.optional(),
+	since: number().optional(),
+	until: number().optional(),
+	limit: number().int().min(1).max(500).default(100)
+});
+method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), method(object({ ruleId: string() }), object({ rule: NcRuleSchema.nullable() }), { auth: "admin" }), method(object({ rule: NcRuleInputSchema }), object({ rule: NcRuleSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({
+	ruleId: string(),
+	patch: NcRulePatchSchema
+}), object({ rule: NcRuleSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ ruleId: string() }), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	ruleId: string(),
+	enabled: boolean()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	rule: NcRuleInputSchema,
+	lookbackMinutes: number().int().min(1).max(1440).default(60)
+}), object({ results: array(NcTestResultSchema) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({ catalog: array(NcConditionDescriptorSchema) })), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" });
+/**
+* TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
+*
+* Spec: `docs/superpowers/specs/2026-07-24-nc-occupancy-timelapse-design.md`
+* §3.2/§3.3.
+*
+* Deliberately NOT a capability definition and NOT an `NcRule`:
+*  - Every `NcDelivery` member is a *persisted-pipeline-record* trigger. A
+*    timelapse fires on a SCHEDULE WINDOW BOUNDARY, evaluates no pipeline
+*    record, and produces a video it assembled itself — so it rides no
+*    delivery-enum member (the enum is frozen) and no cap method. This file is
+*    a plain typed schema; it does NOT go through `npm run codegen`.
+*  - It shares only the delivery leg (`notification-output.send`) and the
+*    persistence/ownership patterns with the Notification Center, reusing
+*    {@link NcScheduleSchema} (weekly windows, midnight-crossing, invertible)
+*    and {@link NcRuleTargetSchema} (target ref + passthrough params).
+*
+* Ownership is SERVER-DERIVED. `ownerUserId` / `createdBy` / `createdAt` /
+* `updatedAt` / `id` / `lastGeneratedAt` live on the PERSISTED rule only —
+* {@link TimelapseRuleInputSchema} and {@link TimelapseRulePatchSchema} do not
+* carry them, so a forged client payload can never claim or re-own a rule
+* (Zod strips unknown keys). The store stamps them from the resolved caller.
+*/
+/** `{{var}}` templating over camera/rule/time — same vocabulary as `NcRule`. */
+var TimelapseTemplateSchema = object({
+	title: string().max(500).optional(),
+	body: string().max(2e3).optional()
+});
+var NameField = string().min(1).max(200);
+var DeviceIdsField = array(number()).min(1);
+var CadenceSecField = number().int().min(2).max(3600);
+var FramerateField = number().int().min(1).max(60);
+var TargetsField = array(NcRuleTargetSchema).min(1);
+var PriorityField = number().int().min(1).max(5);
+/**
+* Client-supplied timelapse-rule fields. The server stamps id / createdBy /
+* createdAt / updatedAt / ownerUserId / lastGeneratedAt — none of them appear
+* here (see the ownership note above).
+*/
+var TimelapseRuleInputSchema = object({
+	name: NameField,
+	enabled: boolean().default(true),
+	/** Cameras sampled by this rule — one scratch dir + one artifact per device. */
+	deviceIds: DeviceIdsField,
+	/**
+	* Activation window(s). REQUIRED (unlike `NcRule`, where an absent schedule
+	* means "always active"): a timelapse is defined by its window boundaries —
+	* open clears the scratch, close assembles and delivers.
+	*/
+	schedule: NcScheduleSchema,
+	/** Force-snapshot cadence inside the window, seconds (predecessor parity). */
+	cadenceSec: CadenceSecField.default(15),
+	/** Output frames per second of the assembled mp4 (predecessor parity). */
+	framerate: FramerateField.default(10),
+	/** `notification-output` targets the finished video/thumbnail is sent to. */
+	targets: TargetsField,
+	template: TimelapseTemplateSchema.optional(),
+	/** Canonical notification priority ordinal (1..5); per-target overridable. */
+	priority: PriorityField.default(3)
+});
+object({
+	name: NameField.optional(),
+	enabled: boolean().optional(),
+	deviceIds: DeviceIdsField.optional(),
+	schedule: NcScheduleSchema.optional(),
+	cadenceSec: CadenceSecField.optional(),
+	framerate: FramerateField.optional(),
+	targets: TargetsField.optional(),
+	template: TimelapseTemplateSchema.nullable().optional(),
+	priority: PriorityField.optional()
+});
+TimelapseRuleInputSchema.extend({
+	id: string(),
+	/**
+	* Ownership/visibility key. Absent = admin/global rule (visible to all).
+	* Present = personal rule owned by this userId. Server-stamped from the
+	* resolved caller; never trusted from a client payload.
+	*/
+	ownerUserId: string().optional(),
+	/**
+	* Epoch-ms of the last successful generation — the 1-hour re-generation
+	* guard's durable state (predecessor parity). Absent = never generated.
+	*/
+	lastGeneratedAt: number().optional(),
+	/** userId of the caller who created the rule (server-stamped). */
+	createdBy: string(),
+	createdAt: number(),
+	updatedAt: number()
+});
+/**
+* Generic device-level status snapshot. Auto-registered by `BaseDevice`
+* for every device, regardless of provider — the kernel needs a uniform
+* cap-keyed slice for the basic device flags every consumer expects to
+* read across processes (the `online` flag in particular). Driver-specific
+* caps (`battery`, `doorbell`, …) carry their domain-specific state on
+* their own slices.
+*
+* Pattern is identical to `battery`: schema-bearing `runtimeState`,
+* empty `methods`, single change event. Reads land at
+* `runtimeState.getCapState('device-status')`; writes at
+* `runtimeState.setCapState('device-status', …)`. Cross-process
+* consumers reach the same data via the `device-state` cap router
+* (`getCapSlice({deviceId, capName: 'device-status'})`).
+*/
+var DeviceStatusSchema = object({
+	/**
+	* Device-level liveness. Drivers flip via `markOnline(boolean)` on
+	* `BaseDevice`. Provider semantics vary — RTSP aggregates broker
+	* stream-health, Reolink reads firmware push events, ONVIF tracks
+	* ping responses. This cap intentionally does NOT prescribe which
+	* signal drives the flag.
+	*/
+	online: boolean(),
+	/** Ms epoch of the last `online` transition. Lets consumers tell
+	*  apart "just came online" from "still online". */
+	lastChangedAt: number()
+});
+object({
+	deviceId: number(),
+	status: DeviceStatusSchema
+});
+/**
+* Per-device feature/identity probe slice. Holds the runtime-resolved
+* truth about what a device CAN do — which the kernel uses to:
+*   1. Reconcile accessory children (hub-children spawn siren/floodlight/PIR
+*      based on what the firmware actually advertises).
+*   2. Compute the public `features: DeviceFeature[]` array surfaced via
+*      `device-manager.listAll`.
+*   3. Decide which optional caps (PTZ, intercom, doorbell, battery, …)
+*      to register on the device's capability surface.
+*
+* Auto-registered by `BaseDevice` for every device. Drivers populate the
+* slice from `onProbe()` (kernel calls it once after register, before
+* accessory reconciliation). Consumers read via:
+*   `runtimeState.getCapState<FeatureProbeStatus>('feature-probe')`
+*
+* `flags` is an open record so each driver carries its own keys without
+* a centralized schema bottleneck — Reolink writes `hasPtz/hasIntercom`,
+* Hikvision writes `hasSupplementalLight/hasAlarmIo`, etc.
+*
+* Replaces the older driver-local `deviceCache.has*` blob: the per-device
+* config is for operator-edited overrides + UI snapshots; runtime probe
+* results belong in runtime-state where the kernel handles persistence,
+* cross-process mirroring, and reactive updates.
+*/
+var FeatureProbeStatusSchema = object({
+	/**
+	* Driver-specific flag bag. Each driver picks its own key names — the
+	* cap deliberately does NOT enforce a closed enum here. Reolink keys:
+	* `hasPtz`, `hasIntercom`, `hasDoorbell`, `hasFloodlight`, `hasSiren`,
+	* `hasPirSensor`, `hasAutotrack`, `hasBattery`. Hikvision keys:
+	* `hasSupplementalLight`, `lightHasWhiteLight`, `hasAlarmIo`, `hasPtz`.
+	*/
+	flags: record(string(), unknown()),
+	/**
+	* Coarse driver-classification — lets cross-process consumers tell apart
+	* cameras / battery-cams / NVRs without re-running the probe. `null`
+	* before the first probe completes.
+	*/
+	deviceType: string().nullable(),
+	/** Camera/firmware model string. `null` when the firmware doesn't expose it. */
+	model: string().nullable(),
+	/** Channel count for NVR/Hub devices; `1` for standalone cameras; `null` pre-probe. */
+	channelCount: number().nullable(),
+	/**
+	* Ms epoch of the last SUCCESSFUL probe. `0` before the first probe
+	* completes — drivers' `getAccessoryChildren()` should treat zero as
+	* "probe not done yet, return empty" so accessories aren't spawned
+	* before the firmware is queried.
+	*/
+	lastProbedAt: number(),
+	/**
+	* Framework convention: every runtime-state slice carries this for the
+	* createRuntimeStateBridge stale-check helper. We keep it in sync with
+	* `lastProbedAt` on every write.
+	*/
+	lastFetchedAt: number()
+});
+object({
+	deviceId: number(),
+	status: FeatureProbeStatusSchema
+});
+object({
+	/** Carbon dioxide concentration in ppm. */
+	co2Ppm: number().min(0).optional(),
+	/** Total volatile organic compounds in ppb. */
+	vocPpb: number().min(0).optional(),
+	/** Particulate matter ≤ 2.5 μm in µg/m³. */
+	pm25: number().min(0).optional(),
+	/** Particulate matter ≤ 10 μm in µg/m³. */
+	pm10: number().min(0).optional(),
+	/** Composite AQI value (typically 0..500). */
+	aqi: number().optional(),
+	/** Ms epoch when the slice was last updated. */
+	lastFetchedAt: number(),
+	/** Live display unit of the single metric this slice carries (e.g. HA
+	*  `attributes.unit_of_measurement` → 'ppm' / 'ppb' / 'µg/m³'). Each
+	*  upstream `sensor.*` entity surfaces ONE device_class, so one unit
+	*  per slice is unambiguous. */
+	unit: string().optional(),
+	/** Suggested decimal places for numeric display.
+	*  Populated live from the upstream source when provided (e.g. HA
+	*  `attributes.suggested_display_precision`). Falls back to
+	*  auto-formatting when absent. */
+	precision: number().int().min(0).max(10).optional()
+});
+DeviceType.Sensor;
+/**
+* Alarm-panel cap. Models HA `alarm_control_panel.*` on
+* `DeviceType.AlarmPanel`. State follows HA's canonical lifecycle
+* across disarmed / armed_(home|away|night|vacation|custom_bypass) /
+* arming / pending / triggered / disarming.
+*
+* Many panels require a PIN code on arm / disarm — the optional
+* `code` field on the methods passes it through to the upstream
+* service; it's NEVER persisted in the runtime slice or any event
+* payload. The presence of a required code is signalled by
+* `DeviceFeature.AlarmPinRequired` so the UI gates a code-entry
+* field without a slice fetch.
+*
+* `availableModes` mirrors HA's `supported_features`-derived arm
+* mode list — the UI renders only the buttons the panel accepts.
+*/
+var AlarmStateSchema = _enum([
+	"disarmed",
+	"armed_home",
+	"armed_away",
+	"armed_night",
+	"armed_vacation",
+	"armed_custom_bypass",
+	"arming",
+	"disarming",
+	"pending",
+	"triggered"
+]);
+var AlarmArmModeSchema = _enum([
+	"home",
+	"away",
+	"night",
+	"vacation",
+	"custom_bypass"
+]);
+object({
+	/** Current lifecycle state. */
+	state: AlarmStateSchema,
+	/** Subset of arm modes the panel accepts. UI renders one button per
+	*  mode in this list. */
+	availableModes: array(AlarmArmModeSchema),
+	/** Whether the panel requires a PIN on arm / disarm. Mirrors
+	*  `DeviceFeature.AlarmPinRequired` for slice consumers. */
+	requiresCode: boolean(),
+	/** Ms epoch when the slice was last updated. */
+	lastChangedAt: number()
+});
+DeviceType.AlarmPanel, method(object({
+	deviceId: number().int().nonnegative(),
+	mode: AlarmArmModeSchema,
+	/** Optional PIN code. Required when `requiresCode === true`.
+	*  Passed through to the upstream service; never persisted. */
+	code: string().min(1).optional()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int().nonnegative(),
+	code: string().min(1).optional()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
+object({
+	/** Current illuminance in lux (lx). */
+	lux: number().min(0),
+	/** Ms epoch when the slice was last updated. */
+	lastFetchedAt: number(),
+	/** Live display unit from the upstream source (e.g. HA
+	*  `attributes.unit_of_measurement`). The UI prefers this over the
+	*  role's canonical unit. Absent → fall back to the canonical unit. */
+	unit: string().optional(),
+	/** Suggested decimal places for numeric display.
+	*  Populated live from the upstream source when provided (e.g. HA
+	*  `attributes.suggested_display_precision`). Falls back to
+	*  auto-formatting when absent. */
+	precision: number().int().min(0).max(10).optional()
+});
+DeviceType.Sensor;
+/**
+* Per-class audio metrics aggregated over a sliding window.
+*/
+var AudioClassSummarySchema = object({
+	className: string(),
+	/** Number of windows (chunks) where this class was the top hit. */
+	hits: number().int().nonnegative(),
+	/** Mean score across those hits, clamped to [0,1]. */
+	avgScore: number().min(0).max(1),
+	/** Peak score in the window. */
+	peakScore: number().min(0).max(1)
+});
+/**
+* Per-camera audio metrics snapshot — emitted by the analytics frame
+* handler on every `pipeline.audio-inference-result` event and
+* mirrored into the `audio-metrics` device-state slice. Symmetric
+* with `zone-analytics` snapshots for video — every consumer
+* (admin UI panel, automations, alert rules) reads via the
+* canonical `device.state.audioMetrics.value` reactive handle.
+*
+* Aggregates are computed over a rolling `windowSec` window
+* (default 60s). Past that window, classes drop out of `byClass`
+* and the level history shifts forward.
+*/
+var AudioMetricsSnapshotSchema = object({
+	/** Wall-clock timestamp (ms) of the most recent audio window. */
+	ts: number().int(),
+	/** Sliding-window length (seconds) used for aggregation. */
+	windowSec: number().int().positive(),
+	/** Latest level reading from the most recent window. */
+	level: object({
+		rms: number(),
+		dbfs: number()
+	}),
+	/** Peak dBFS observed across the rolling window. */
+	peakDbfs: number(),
+	/** Mean dBFS across the rolling window. */
+	avgDbfs: number(),
+	/** Most recent above-threshold classification, or null on silence. */
+	current: object({
+		className: string(),
+		score: number().min(0).max(1),
+		timestamp: number().int()
+	}).nullable(),
+	/** Per-class summary across the rolling window — keys are
+	*  `macroClass` strings (e.g. `dog_bark`, `speech`, `glass_break`). */
+	byClass: array(AudioClassSummarySchema).readonly()
+});
+/**
+* Audio-metrics history payload — a series of `AudioMetricsHistoryPoint`
+* samples capped at `maxPoints` (default 1024). When the requested
+* `windowSec / sampleEveryMs` would exceed the cap, the provider
+* subsamples by bucketed averaging and reports the effective sample
+* spacing on `effectiveSampleEveryMs` so the UI can label the x-axis.
+*/
+var AudioMetricsHistorySchema = object({
+	points: array(object({
+		/** Wall-clock ms when this sample was recorded. */
+		ts: number().int(),
+		/** Instantaneous dBFS level at sample time. `null` for windows where
+		*  the source had no level reading (rare; happens at decode startup). */
+		dbfs: number().nullable(),
+		/** Rolling-window peak dBFS at sample time. Same window the live
+		*  snapshot reports. */
+		peakDbfs: number(),
+		/** Rolling-window mean dBFS at sample time. */
+		avgDbfs: number(),
+		/** Dominant above-threshold class at sample time, or null on silence. */
+		topClass: string().nullable(),
+		/** Score of the dominant class (`null` whenever `topClass` is null). */
+		topScore: number().min(0).max(1).nullable()
+	})).readonly(),
+	/** Actual ms between adjacent samples after any subsampling. */
+	effectiveSampleEveryMs: number().int().positive(),
+	/** Wall-clock window covered by `points` (`points[N-1].ts - points[0].ts`),
+	*  or `0` when there's fewer than 2 samples. */
+	windowMsActual: number().int().nonnegative()
+});
+DeviceType.Camera, method(object({ deviceId: number() }), AudioMetricsSnapshotSchema.nullable()), method(object({
+	deviceId: number(),
+	/** History window in seconds. Default 300 (5 minutes).
+	*  Provider clamps to its retention cap if larger. */
+	windowSec: number().int().positive().optional(),
+	/** Target sample interval in ms. Default 1000 (1 sample/second).
+	*  Provider clamps to natural sample rate if smaller, and
+	*  bucket-averages when bigger than the requested window
+	*  would produce more than `maxPoints` samples. */
+	sampleEveryMs: number().int().positive().optional()
+}), AudioMetricsHistorySchema);
+object({
+	/** Whether the automation is currently enabled. Disabled automations
+	*  ignore their trigger block — manual `trigger` still works. */
+	enabled: boolean(),
+	/** Whether the automation is currently executing its action block. */
+	isRunning: boolean(),
+	/** Ms epoch of the last successful run. 0 when never run. */
+	lastTriggeredAt: number(),
+	/** Failure description from the last completed run. Null on success
+	*  or when never run. */
+	lastError: string().nullable(),
+	/** Ms epoch when the slice was last updated. */
+	lastChangedAt: number()
+});
+DeviceType.Automation, method(object({ deviceId: number().int().nonnegative() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int().nonnegative(),
+	/** When true, fires the action block while bypassing the
+	*  automation's condition evaluation. Gated by
+	*  `DeviceFeature.AutomationSkipCondition`. */
+	skipCondition: boolean().optional()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* Battery status snapshot. Emitted by providers whose device is
+* battery-operated (cameras with `DeviceFeature.BatteryOperated`,
+* future sensor/button accessories). Consumers build their own "low
+* battery" alerting on top — the cap deliberately does NOT enforce a
+* threshold.
+*/
+var BatteryStatusSchema = object({
+	/** 0..100 inclusive. Firmware-reported. */
+	percentage: number().min(0).max(100),
+	/**
+	* Charging source. `'dc'` covers wall/USB adapters; `'solar'` is
+	* Reolink-specific for the Solar Panel 2 accessory (will become
+	* common on other battery cams). `'none'` means running on battery
+	* alone.
+	*/
+	charging: _enum([
+		"dc",
+		"solar",
+		"none"
+	]),
+	/**
+	* True when the camera firmware has gone into low-power mode. Battery
+	* providers MUST avoid polling during sleep — reading the battery
+	* wakes the camera up and drains charge.
+	*/
+	sleeping: boolean(),
+	/** Ms epoch of the last observation. Lets consumers reason about freshness. */
+	lastUpdated: number(),
+	/**
+	* True when the source is a BINARY low-battery indicator (HA
+	* `binary_sensor` device_class=battery / `LOW_BAT`) that has no real
+	* charge level — `percentage` is then a coarse stand-in (100 = normal,
+	* sub-threshold = low). UI MUST render "Normal"/"Low" instead of a
+	* misleading exact percentage. Absent/false → genuine 0–100 % reading.
+	*/
+	binary: boolean().optional()
+});
+DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, method(object({
+	deviceId: number(),
+	/** Bound on the wait. Sensible range 3000–10000ms. */
+	timeoutMs: number().int().min(500).max(3e4).default(8e3)
+}), object({
+	awoke: boolean(),
+	durationMs: number()
+}), { kind: "mutation" }), object({
+	deviceId: number(),
+	status: BatteryStatusSchema
+});
+object({
+	on: boolean(),
+	/** Ms epoch of the last transition. 0 if never observed. */
+	lastChangedAt: number()
+});
+DeviceType.Sensor;
+object({
+	/** Current level as 0..100 inclusive. Firmware-reported. */
+	percentage: number().min(0).max(100),
+	/** Ms epoch of the last operator-driven change. Useful for UI freshness. */
+	lastChangedAt: number()
+});
+DeviceType.Light, method(object({
+	deviceId: number().int().nonnegative(),
+	percentage: number().min(0).max(100)
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), object({
+	deviceId: number(),
+	percentage: number().min(0).max(100),
+	lastChangedAt: number()
+});
+/** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
+var StreamFormatSchema = _enum([
+	"webrtc",
+	"hls",
+	"mjpeg",
+	"rtsp"
+]);
+var RtspRestreamEntrySchema = object({
+	brokerId: string(),
+	url: string(),
+	mutedUrl: string(),
+	enabled: boolean(),
+	/**
+	* Source-stream codec / resolution for the camStream this entry serves
+	* (the broker's "high"/"mid"/"low" profile slot for this device).
+	* Used by exporter pickers (`pickPreferredRtspEntry`) to resolve
+	* `streamPreference: 'auto'` to the slot whose source is closest to
+	* the consumer's target — Alexa wants ~720p, HomeKit wants ~1080p,
+	* and there's no point dialling the 4K slot for an Echo Show. Absent
+	* when the source publisher never advertised the field; pickers fall
+	* back to first-enabled in that case.
+	*/
+	codec: string().optional(),
+	resolution: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}).optional()
+});
+var BrokerRtspClientSchema = object({
+	sessionId: string(),
+	remoteAddr: string(),
+	/** Client `User-Agent` (e.g. `recorder` for the recorder's RTSP pull), or
+	*  null/absent when the client sent none. Lets the UI label a consumer by
+	*  purpose. Optional so a client built against an older schema stays valid. */
+	userAgent: string().nullish(),
+	playing: boolean(),
+	muted: boolean(),
+	connectedAt: number(),
+	lastRtpAt: number(),
+	bytesSent: number()
+});
+var BrokerDecodedClientSchema = object({
+	tag: string(),
+	subscribedAt: number(),
+	maxFps: number(),
+	framesDelivered: number(),
+	framesDropped: number()
+});
+var BrokerAudioClientSchema = object({
+	tag: string(),
+	subscribedAt: number(),
+	chunksDelivered: number()
+});
+var BrokerConsumerAttributionSchema = object({
+	kind: _enum([
+		"alexa",
+		"homekit",
+		"webrtc-browser",
+		"webrtc-mobile",
+		"webrtc-whep",
+		"rtsp-listen",
+		"derived-broker",
+		"recording",
+		"pipeline",
+		"snapshot",
+		"warmup",
+		"unknown"
+	]),
+	/**
+	* Free-form label intended to disambiguate consumers OF THE SAME kind
+	* on the same broker — e.g. user name, device alias. Should NOT repeat
+	* the kind / cam / cam-stream / sessionId (those are surfaced by
+	* dedicated fields). When empty the widget falls back to `${kind} ·
+	* <sessionId tail>`.
+	*/
+	label: string().optional(),
+	/**
+	* Which part of the encoded plane this subscription consumes:
+	*   - `'audio'` — audio packets only
+	*   - `'video'` — video packets only
+	*   - `'both'`  — both video + audio (typical for AnnexB push paths
+	*                 that don't split the source RTP)
+	*
+	* Missing field means "unknown" — older callers and the legacy
+	* paths that haven't been migrated yet.
+	*/
+	media: _enum([
+		"audio",
+		"video",
+		"both"
+	]).optional(),
+	/**
+	* Codec the consumer receives AFTER any per-session re-encoding. For
+	* a WebRTC session this is the negotiated egress codec (e.g. `H264`,
+	* `H265`, `Opus`, `Pcmu`); for an RTSP restreamer it mirrors the
+	* source codec. Surfaced in the widget chip so operators see at a
+	* glance whether a viewer is on H.264 (Echo) or H.265 (Safari).
+	*/
+	targetCodec: string().optional(),
+	/**
+	* Whether the broker is re-encoding for this consumer:
+	*   - `'passthrough'` — bytes flow source→consumer without ffmpeg
+	*   - `'repacketize'` — RTP payload is re-packetized but NOT re-encoded
+	*                       (preserves frames, just rebuilds headers; e.g.
+	*                       the H.265 repacketizer path)
+	*   - `'transcode'`   — a full encode/decode round (ffmpeg, libx264,
+	*                       libav…); the most expensive path
+	*/
+	transport: _enum([
+		"passthrough",
+		"repacketize",
+		"transcode"
+	]).optional(),
+	/** Remote peer IP if the consumer terminates a network socket. */
+	remoteAddr: string().optional(),
+	/**
+	* Server-read User-Agent of the originating client; enriched by the hub
+	* from the tRPC request context (browser sessions).
+	*/
+	userAgent: string().optional(),
+	/** Authenticated user id (CamStack OAuth subject) when known. */
+	userId: string().optional(),
+	/** Higher-level session identifier (Alexa Echo sessionId, HAP session, …). */
+	sessionId: string().optional(),
+	/** Free-form key/value extras (e.g. clientHints from a WebRTC offer). */
+	extra: record(string(), string()).optional()
+}).readonly();
+var BrokerEncodedClientSchema = object({
+	/** Stable id assigned on attach; used by `killClient`. */
+	id: string(),
+	/** Which broker fanout the subscriber rides — annexB encoded packets vs raw RTP. */
+	channel: _enum(["annexb", "rtp"]),
+	attribution: BrokerConsumerAttributionSchema,
 	subscribedAt: number(),
 	/** Total packets delivered (annex-B EncodedPackets or RTP byte-buffers). */
 	packetsDelivered: number()
@@ -12696,101 +13341,40 @@ method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mu
 }), object({ details: array(DetailResultSchema) }).nullable(), { kind: "mutation" });
 object({
 	detected: boolean(),
-	/** Ms epoch of the last detected-true observation. Null if never detected. */
-	lastDetectedAt: number().nullable(),
-	/**
-	* Ms after which `detected` auto-reverts to false if no fresh push
-	* arrives. Null means the provider leaves detected state until a
-	* native "clear" event.
-	*/
-	autoClearAfterMs: number().nullable()
-});
-object({
-	deviceId: number(),
-	detected: boolean(),
-	timestamp: number(),
-	source: MotionSourceEnum,
-	regions: array(MotionRegionSchema).readonly().optional()
-});
-DeviceType.Camera, DeviceType.Sensor, method(object({ deviceId: number() }), boolean());
-object({
-	enabled: boolean(),
-	/** Ms epoch of the last operator-driven change. */
-	lastChangedAt: number()
-}).extend({ 
-/** Ms epoch of the last successful camera fetch (0 = never). */
-lastFetchedAt: number() });
-DeviceType.Light, DeviceType.Siren, DeviceType.Switch, method(object({
-	deviceId: number().int().nonnegative(),
-	enabled: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), object({
-	deviceId: number(),
-	enabled: boolean(),
-	lastChangedAt: number()
-});
-/**
-* Shared geometry vocabulary for on-frame shape caps — privacy-mask,
-* motion-zones, and the detection zones/lines editor all speak this one
-* language so a single drawing-plane editor and the providers stay
-* decoupled from each cap's storage.
-*
-* All coordinates are normalized 0..1 of the camera frame (top-left
-* origin). Each cap composes the SUBSET of shape kinds it supports and
-* advertises it via `supportedShapes` in its `getOptions`.
-*/
-/** A normalized 0..1 point (top-left origin). */
-var MaskPointSchema = object({
-	x: number(),
-	y: number()
-});
-/** Axis-aligned rectangle (normalized 0..1). */
-var MaskRectShapeSchema = object({
-	kind: literal("rect"),
-	x: number(),
-	y: number(),
-	width: number(),
-	height: number()
-});
-/** Free polygon — an ordered list of normalized vertices (≥3). */
-var MaskPolygonShapeSchema = object({
-	kind: literal("polygon"),
-	points: array(MaskPointSchema)
-});
-/** Boolean cell grid — row-major, length === gridWidth*gridHeight. */
-var MaskGridShapeSchema = object({
-	kind: literal("grid"),
-	gridWidth: number(),
-	gridHeight: number(),
-	cells: array(boolean())
-});
-discriminatedUnion("kind", [
-	MaskRectShapeSchema,
-	MaskPolygonShapeSchema,
-	MaskGridShapeSchema,
-	object({
-		kind: literal("line"),
-		points: array(MaskPointSchema)
-	})
-]);
-/** Every shape-kind discriminant, for `supportedShapes` advertisement. */
-var MaskShapeKindSchema = _enum([
-	"rect",
-	"polygon",
-	"grid",
-	"line"
-]);
-/** Polygon vertex bounds when a cap supports 'polygon' (e.g. Hikvision {min:4,max:4}). */
-var MaskPolygonVerticesSchema = object({
-	min: number(),
-	max: number()
+	/** Ms epoch of the last detected-true observation. Null if never detected. */
+	lastDetectedAt: number().nullable(),
+	/**
+	* Ms after which `detected` auto-reverts to false if no fresh push
+	* arrives. Null means the provider leaves detected state until a
+	* native "clear" event.
+	*/
+	autoClearAfterMs: number().nullable()
 });
-/** Grid dimensions when a cap supports 'grid'. */
-var MaskGridDimsSchema = object({
-	width: number(),
-	height: number()
+object({
+	deviceId: number(),
+	detected: boolean(),
+	timestamp: number(),
+	source: MotionSourceEnum,
+	regions: array(MotionRegionSchema).readonly().optional()
+});
+DeviceType.Camera, DeviceType.Sensor, method(object({ deviceId: number() }), boolean());
+object({
+	enabled: boolean(),
+	/** Ms epoch of the last operator-driven change. */
+	lastChangedAt: number()
+}).extend({ 
+/** Ms epoch of the last successful camera fetch (0 = never). */
+lastFetchedAt: number() });
+DeviceType.Light, DeviceType.Siren, DeviceType.Switch, method(object({
+	deviceId: number().int().nonnegative(),
+	enabled: boolean()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), object({
+	deviceId: number(),
+	enabled: boolean(),
+	lastChangedAt: number()
 });
 /**
 * Motion-zones share the same MaskShape vocabulary as privacy-mask — the
@@ -14716,6 +15300,55 @@ method(object({
 	password: string()
 }), AuthResultSchema.nullable(), { kind: "mutation" }), method(object({ state: string() }), string()), method(record(string(), string()), AuthResultSchema, { kind: "mutation" }), method(object({ token: string() }), AuthResultSchema.nullable());
 /**
+* A live terminal session hosted by the provider addon. Output and input do
+* NOT flow through the capability — they use the addon data plane
+* (`GET /addon/terminal/<id>/out` SSE, `POST /addon/terminal/<id>/in`) because
+* terminal output must be ordered and lossless. The event bus is telemetry and
+* may drop chunks ([D8]), and a dropped chunk desynchronises the vt parser
+* permanently until a full repaint. The capability owns only lifecycle.
+*/
+var TerminalSessionInfoSchema = object({
+	/** Opaque session id minted by the provider on `openSession`. */
+	sessionId: string(),
+	/** The pre-declared profile this session runs (never a free-form command). */
+	profileId: string(),
+	/** Human-readable profile label for the UI session list. */
+	label: string(),
+	cols: number().int().positive(),
+	rows: number().int().positive(),
+	/** ms-epoch the session's pty was spawned. */
+	startedAt: number()
+});
+/**
+* A profile the operator may open — a pre-declared, allowlisted program
+* (`monitor` → `btm`). The capability accepts only these ids; a free-form
+* command string would be remote code execution as the server's user, so it is
+* deliberately not part of the contract.
+*/
+var TerminalProfileInfoSchema = object({
+	profileId: string(),
+	label: string(),
+	description: string().optional()
+});
+method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }), method(_void(), array(TerminalSessionInfoSchema).readonly(), { auth: "admin" }), method(object({
+	profileId: string(),
+	cols: number().int().positive(),
+	rows: number().int().positive()
+}), TerminalSessionInfoSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	sessionId: string(),
+	cols: number().int().positive(),
+	rows: number().int().positive()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ sessionId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * Orchestrator-side destination metadata. The orchestrator computes
 * `id = <addonId>:<subId>` from its provider lookup so consumers
 * (admin UI, restore flow) see one canonical key.
@@ -14816,11 +15449,53 @@ var LocationStatSchema = object({
 	fileCount: number(),
 	present: boolean()
 });
+/**
+* A backup schedule — the N:M "entry" that binds one cron cadence to a
+* SET of destination locations. Supersedes the per-location cron on
+* `BackupDestinationPolicy`: an operator creates a schedule, picks the
+* `backups` locations it should write to, and the orchestrator fans a
+* single archive out to all of them when the cron fires.
+*
+* `retentionCount` is per-schedule (D-decision 2026-07-28): every
+* location targeted by this schedule keeps this many archives from
+* this schedule's runs.
+*
+* `dataSources` optionally narrows which top-level state locations
+* (db, addons, tls, …) are archived; omitted = the orchestrator's
+* default full set.
+*/
+var BackupScheduleSchema = object({
+	/** Stable id. Generated by the orchestrator on first upsert if absent. */
+	id: string(),
+	/** Operator-facing display name. */
+	label: string(),
+	/** 5-field POSIX cron. Empty = disabled cadence (kept for editing). */
+	cron: string(),
+	/** Master on/off toggle for the whole schedule. */
+	enabled: boolean(),
+	/** `backups`-location ids this schedule writes to (fan-out set). */
+	locationIds: array(string()).readonly(),
+	/** Archives kept per targeted location for this schedule. */
+	retentionCount: number().int().min(1).max(1e3),
+	/** Optional subset of source locations to include; omitted = all. */
+	dataSources: array(string()).readonly().optional(),
+	/** ms-epoch of last successful run. */
+	lastRunAt: number().optional(),
+	/** ms-epoch of next computed firing (read-only, filled on list). */
+	nextRunAt: number().optional()
+});
 method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }), method(object({
 	/** Subset of registered `backup-destination` addon ids to write to. */
 	destinations: array(string()).optional(),
 	locations: array(string()).optional(),
-	label: string().optional()
+	label: string().optional(),
+	/**
+	* Per-run retention override applied to every targeted
+	* destination. Used by schedule-driven runs (per-entry
+	* retention). Omitted = each destination's own policy
+	* retention (manual runs).
+	*/
+	retentionCount: number().int().min(1).max(1e3).optional()
 }).optional(), array(BackupEntrySchema).readonly(), {
 	kind: "mutation",
 	auth: "admin"
@@ -14869,7 +15544,21 @@ method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }
 	ok: boolean(),
 	error: string().optional(),
 	nextRuns: array(number()).readonly()
-}));
+})), method(_void(), array(BackupScheduleSchema).readonly(), { auth: "admin" }), method(object({
+	id: string().optional(),
+	label: string(),
+	cron: string(),
+	enabled: boolean(),
+	locationIds: array(string()).readonly(),
+	retentionCount: number().int().min(1).max(1e3),
+	dataSources: array(string()).readonly().optional()
+}), BackupScheduleSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * `broker` — unified pub/sub broker registry, system-scoped collection.
 *
@@ -15945,1596 +16634,1108 @@ method(object({
 	active: boolean()
 }), _void(), {
 	kind: "mutation",
-	auth: "admin"
-}), method(object({ capName: string() }), array(string())), method(object({ deviceType: string() }), array(object({
-	capName: string(),
-	wrappers: array(string())
-}))), method(object({ deviceId: number() }), SettingsSchemaWithValuesSchema.nullable()), method(object({ deviceId: number() }), SettingsSchemaWithValuesSchema.nullable()), method(object({ deviceId: number() }), object({
-	settings: SettingsSchemaWithValuesSchema.nullable(),
-	live: SettingsSchemaWithValuesSchema.nullable()
-})), method(object({
-	deviceId: number().int().nonnegative(),
-	action: string().min(1),
-	input: unknown()
-}), unknown(), { kind: "mutation" }), method(object({
-	deviceId: number(),
-	writerCapName: string(),
-	writerAddonId: string(),
-	key: string(),
-	value: unknown()
-}), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	changes: array(object({
-		writerCapName: string(),
-		writerAddonId: string(),
-		key: string(),
-		value: unknown()
-	}))
-}), object({
-	success: literal(true),
-	failures: array(object({
-		writerCapName: string(),
-		writerAddonId: string(),
-		error: string()
-	}))
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ addonId: string() }), array(DiscoveryCandidateSchema), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	addonId: string(),
-	candidate: DiscoveryCandidateSchema,
-	/** Owning integration id, stamped onto the new device's meta by the
-	*  device-manager forwarder so `removeByIntegration` can cascade it.
-	*  Optional for back-compat (omitted = no stamp = pre-existing behavior). */
-	integrationId: string().optional()
-}), DeviceSummarySchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	addonId: string(),
-	type: _enum(DeviceType)
-}), unknown().nullable()), method(object({
-	addonId: string(),
-	type: _enum(DeviceType),
-	config: record(string(), unknown()),
-	/** Owning integration id, stamped onto the new device's meta by the
-	*  device-manager forwarder so `removeByIntegration` can cascade it.
-	*  Optional for back-compat (omitted = no stamp = pre-existing behavior). */
-	integrationId: string().optional()
-}), DeviceSummarySchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	addonId: string(),
-	type: _enum(DeviceType),
-	key: string(),
-	value: unknown(),
-	formValues: record(string(), unknown()).optional()
-}), FieldProbeResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	addonId: string(),
-	integrationId: string()
-}), object({ filters: array(AdoptionFilterSchema) }), { auth: "admin" }), method(ListCandidatesInputSchema.extend({ addonId: string() }), ListCandidatesOutputSchema, { auth: "admin" }), method(object({
-	addonId: string(),
-	integrationId: string()
-}), AdoptionStatusSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(AdoptInputSchema.extend({ addonId: string() }), AdoptResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(ReleaseInputSchema.extend({ addonId: string() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(ResyncInputSchema, ResyncResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({}), object({ providers: array(object({
-	addonId: string(),
-	label: string()
-})).readonly() }), { auth: "admin" }), method(object({}), object({ groups: array(object({
-	addonId: string(),
-	label: string(),
-	candidates: array(DiscoveryCandidateSchema).readonly(),
-	error: string().nullable()
-})).readonly() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	addonId: string(),
-	params: record(string(), unknown()).optional()
-}), object({ candidates: array(DiscoveryCandidateSchema).readonly() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ addonId: string() }), object({ deviceType: _enum(DeviceType).nullable() }), { auth: "admin" }), method(object({ addonId: string() }), unknown(), { auth: "admin" }), method(object({
-	deviceId: number(),
-	key: string(),
-	value: unknown()
-}), FieldProbeResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number(),
-	caps: array(string()).readonly().optional()
-}), record(string(), unknown().nullable()));
-method(object({ deviceId: number() }), record(string(), record(string(), unknown()))), method(object({
-	deviceId: number(),
-	capName: string()
-}), record(string(), unknown()).nullable()), method(object({}), record(string(), record(string(), record(string(), unknown())))), method(object({
-	deviceId: number(),
-	capName: string(),
-	slice: record(string(), unknown())
-}), _void(), { kind: "mutation" }), object({
-	deviceId: number(),
-	capName: string(),
-	slice: record(string(), unknown())
-});
-/**
-* Embedding output. `embedding` is wire-encoded as `number[]` so the
-* Zod-validated tRPC surface round-trips cleanly; consumers that need a
-* `Float32Array` can wrap it on the way out (in-process, no marshalling
-* is involved). `inferenceMs` mirrors the runtime field used by the
-* post-analysis enrichment-engine.
-*/
-var EmbeddingResultSchema = object({
-	embedding: array(number()),
-	inferenceMs: number()
-});
-var EmbeddingInfoSchema = object({
-	modelId: string(),
-	embeddingDim: number(),
-	ready: boolean()
-});
-method(object({
-	crop: _instanceof(Uint8Array),
-	width: number(),
-	height: number()
-}), EmbeddingResultSchema), method(object({ text: string() }), EmbeddingResultSchema), method(_void(), EmbeddingInfoSchema);
-/**
-* filesystem-browse — per-node capability for browsing the node's local
-* filesystem, sandboxed to operator-configured allowed roots. Used by the
-* admin "Add filesystem location" flow to pick a node + path. `mode:'per-node'`
-* (one provider per node); the hub calls it with `{nodeId}` so the codegen
-* routes to that exact node (default `nodeIdMode:'routing'`).
-*/
-var DirEntrySchema = object({
-	name: string(),
-	path: string()
-});
-var BrowseResultSchema = object({
-	path: string(),
-	entries: array(DirEntrySchema).readonly(),
-	freeBytes: number(),
-	totalBytes: number()
-});
-method(_void(), array(string()).readonly(), { auth: "admin" }), method(object({ path: string() }), BrowseResultSchema, { auth: "admin" }), method(object({ path: string() }), object({ path: string() }), {
+	auth: "admin"
+}), method(object({ capName: string() }), array(string())), method(object({ deviceType: string() }), array(object({
+	capName: string(),
+	wrappers: array(string())
+}))), method(object({ deviceId: number() }), SettingsSchemaWithValuesSchema.nullable()), method(object({ deviceId: number() }), SettingsSchemaWithValuesSchema.nullable()), method(object({ deviceId: number() }), object({
+	settings: SettingsSchemaWithValuesSchema.nullable(),
+	live: SettingsSchemaWithValuesSchema.nullable()
+})), method(object({
+	deviceId: number().int().nonnegative(),
+	action: string().min(1),
+	input: unknown()
+}), unknown(), { kind: "mutation" }), method(object({
+	deviceId: number(),
+	writerCapName: string(),
+	writerAddonId: string(),
+	key: string(),
+	value: unknown()
+}), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
-});
-/**
-* Shared LLM generate contracts — imported by BOTH `llm.cap.ts` (consumer
-* surface) and `llm-runtime.cap.ts` (node-side managed executor) so the two
-* caps stay wire-compatible without a circular cap→cap import.
-*
-* Errors are a discriminated-union RESULT, never thrown: the shape survives
-* every transport tier structurally, and failed calls still write usage rows.
-* Token counts only in v1 — no costUsd (operator decision, 2026-07-15).
-*/
-var LlmUsageSchema = object({
-	inputTokens: number(),
-	outputTokens: number()
-});
-var LlmErrorCodeSchema = _enum([
-	"timeout",
-	"rate-limited",
-	"auth",
-	"refusal",
-	"bad-request",
-	"unavailable",
-	"no-profile",
-	"budget-exceeded",
-	"adapter-error"
-]);
-var LlmGenerateResultSchema = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	text: string(),
-	model: string(),
-	usage: LlmUsageSchema,
-	truncated: boolean(),
-	latencyMs: number()
+}), method(object({
+	deviceId: number(),
+	changes: array(object({
+		writerCapName: string(),
+		writerAddonId: string(),
+		key: string(),
+		value: unknown()
+	}))
 }), object({
-	ok: literal(false),
-	code: LlmErrorCodeSchema,
-	message: string(),
-	retryAfterMs: number().optional()
-})]);
-/**
-* `Uint8Array` is the sanctioned binary convention — superjson + the UDS
-* MsgPack channel round-trip typed arrays (embedding-encoder.cap.ts:29,
-* notification-output.cap.ts:27-31 precedents).
-*/
-var LlmImageSchema = object({
-	bytes: _instanceof(Uint8Array),
-	mimeType: string()
-});
-var LlmGenerateBaseInputSchema = object({
-	/** Collection routing (the notification-output posture). */
-	addonId: string().optional(),
-	/** Explicit profile; else the resolution chain (spec §3). */
-	profileId: string().optional(),
-	/** MANDATORY usage tag: 'ai-summary', 'notifier-rules', 'adhoc-ui', … */
-	consumer: string(),
-	system: string().optional(),
-	/** v1: single-turn. `messages[]` is a v2 additive field. */
-	prompt: string(),
-	/** Structured output — adapter-mapped (response_format / forced tool / responseSchema). */
-	jsonSchema: record(string(), unknown()).optional(),
-	/** Per-call override of the profile default. */
-	maxTokens: number().int().positive().optional(),
-	temperature: number().optional()
-});
-/**
-* `llm-runtime` — node-side managed llama.cpp executor (spec §4). Registered
-* on EVERY node where `addon-ai` is installed; the hub `llm` provider reaches
-* a specific node's runtime with `nodePin(profile.runtime.nodeId)` — normal
-* cap routing, zero bespoke plumbing. `internal: true`: the operator reaches
-* this only through the `llm` cap's methods.
-*
-* One running llama-server child per node in v1 (models are RAM-heavy).
-* Resource ceiling = llama-server flags + idleStopMinutes ONLY (no RSS
-* watchdog — operator decision #3).
-*/
-var ManagedModelRefSchema = discriminatedUnion("kind", [
-	object({
-		kind: literal("catalog"),
-		catalogId: string()
-	}),
-	object({
-		kind: literal("url"),
-		url: string(),
-		sha256: string().optional()
-	}),
-	object({
-		kind: literal("path"),
-		path: string()
-	})
-]);
-var ManagedRuntimeConfigSchema = object({
-	/** WHERE the runtime lives — hub or any agent. */
-	nodeId: string(),
-	/** Closed for v1; 'ollama' is a v2 candidate. */
-	engine: _enum(["llama-cpp"]),
-	model: ManagedModelRefSchema,
-	contextSize: number().int().default(4096),
-	/** 0 = CPU-only. */
-	gpuLayers: number().int().default(0),
-	/** Default: cpus-2, clamped ≥1 (resolved node-side). */
-	threads: number().int().optional(),
-	/** Concurrent slots. */
-	parallel: number().int().default(1),
-	/** Else lazy: first generate boots it. */
-	autoStart: boolean().default(false),
-	/** 0 = never; frees RAM after quiet periods. */
-	idleStopMinutes: number().int().default(30)
-});
-var LlmRuntimeStatusSchema = object({
-	/** Status is ALWAYS node-qualified. */
-	nodeId: string(),
-	state: _enum([
-		"stopped",
-		"downloading",
-		"starting",
-		"ready",
-		"crashed",
-		"failed"
-	]),
-	pid: number().optional(),
-	port: number().optional(),
-	modelPath: string().optional(),
-	modelId: string().optional(),
-	downloadProgress: number().min(0).max(1).optional(),
-	lastError: string().optional(),
-	crashesInWindow: number(),
-	/** Child RSS (sampled best-effort). */
-	memoryBytes: number().optional(),
-	vramBytes: number().optional()
-});
-var LlmNodeModelSchema = object({
-	file: string(),
-	sizeBytes: number(),
-	catalogId: string().optional(),
-	installedAt: number().optional()
-});
-var LlmRuntimeDiskUsageSchema = object({
-	nodeId: string(),
-	modelsBytes: number(),
-	freeBytes: number().optional()
-});
-method(LlmGenerateBaseInputSchema.extend({
-	images: array(LlmImageSchema).optional(),
-	runtime: ManagedRuntimeConfigSchema,
-	/** The managed profile's timeout, threaded by the hub provider. */
-	timeoutMs: number().int().positive().optional()
-}), LlmGenerateResultSchema, { kind: "mutation" }), method(object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
+	success: literal(true),
+	failures: array(object({
+		writerCapName: string(),
+		writerAddonId: string(),
+		error: string()
+	}))
+}), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), _void(), {
+}), method(object({ addonId: string() }), array(DiscoveryCandidateSchema), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), LlmRuntimeStatusSchema), method(object({ model: ManagedModelRefSchema }), _void(), {
+}), method(object({
+	addonId: string(),
+	candidate: DiscoveryCandidateSchema,
+	/** Owning integration id, stamped onto the new device's meta by the
+	*  device-manager forwarder so `removeByIntegration` can cascade it.
+	*  Optional for back-compat (omitted = no stamp = pre-existing behavior). */
+	integrationId: string().optional()
+}), DeviceSummarySchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ file: string() }), _void(), {
+}), method(object({
+	addonId: string(),
+	type: _enum(DeviceType)
+}), unknown().nullable()), method(object({
+	addonId: string(),
+	type: _enum(DeviceType),
+	config: record(string(), unknown()),
+	/** Owning integration id, stamped onto the new device's meta by the
+	*  device-manager forwarder so `removeByIntegration` can cascade it.
+	*  Optional for back-compat (omitted = no stamp = pre-existing behavior). */
+	integrationId: string().optional()
+}), DeviceSummarySchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), array(LlmNodeModelSchema)), method(object({}), LlmRuntimeDiskUsageSchema);
-/**
-* `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
-* methods concat-fan across providers; single-row methods route to ONE
-* provider by the `addonId` in the call input (the notification-output
-* posture, notification-output.cap.ts:215-250). Provided by `addon-ai`
-* (hub-placed); the cap stays open for future providers.
-*
-* Profiles are ROWS (data), not addons: one row = one usable model endpoint.
-* `apiKey` is a password field — providers REDACT it on read and merge on
-* write; a stored key NEVER round-trips to a client.
-*/
-var LlmProfileKindSchema = _enum([
-	"openai-compatible",
-	"openai",
-	"anthropic",
-	"google",
-	"managed-local"
-]);
-var LlmProfileSchema = object({
-	id: string(),
-	name: string(),
-	kind: LlmProfileKindSchema,
-	/** Stamped by the provider — keeps the fanned catalog routable. */
+}), method(object({
 	addonId: string(),
-	enabled: boolean(),
-	/** Vendor model id, or the managed runtime's loaded model. */
-	model: string(),
-	/** Required for openai-compatible; override for cloud kinds. */
-	baseUrl: string().optional(),
-	/** ConfigUISchema type:'password' — never round-trips (spec §5). */
-	apiKey: string().optional(),
-	supportsVision: boolean(),
-	temperature: number().min(0).max(2).optional(),
-	maxTokens: number().int().positive().optional(),
-	timeoutMs: number().int().positive().default(6e4),
-	extraHeaders: record(string(), string()).optional(),
-	/** kind === 'managed-local' only (spec §4). */
-	runtime: ManagedRuntimeConfigSchema.optional()
-});
-/** ConfigUISchema tree passed through untyped on the wire (the
-*  notification-output `ConfigSchemaPassthrough` precedent at
-*  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$1 = unknown();
-var LlmProfileKindDescriptorSchema = object({
-	kind: LlmProfileKindSchema,
-	label: string(),
-	icon: string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	type: _enum(DeviceType),
+	key: string(),
+	value: unknown(),
+	formValues: record(string(), unknown()).optional()
+}), FieldProbeResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	addonId: string(),
-	configSchema: ConfigSchemaPassthrough$1
-});
-var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
-var LlmDefaultSchema = object({
-	selector: LlmDefaultSelectorSchema,
-	profileId: string()
-});
-/** Server-side rollup row — getUsage never dumps raw call rows (spec §6). */
-var LlmUsageRollupSchema = object({
-	day: string(),
-	consumer: string(),
-	profileId: string(),
-	calls: number(),
-	okCalls: number(),
-	errorCalls: number(),
-	inputTokens: number(),
-	outputTokens: number(),
-	avgLatencyMs: number()
-});
-/** LLM-facing view over the reused ModelCatalogEntry mechanism (spec §4.2). */
-var ManagedModelCatalogEntrySchema = object({
-	id: string(),
-	label: string(),
-	family: string(),
-	purpose: _enum(["text", "vision"]),
-	url: string(),
-	sha256: string(),
-	sizeBytes: number(),
-	quantization: string(),
-	/** Load-time guidance shown in the picker. */
-	minRamBytes: number(),
-	contextSizeDefault: number().int(),
-	/** Vision models: companion projector file. */
-	mmprojUrl: string().optional()
-});
-var LlmRuntimeNodeSchema = object({
-	nodeId: string(),
-	reachable: boolean(),
-	status: LlmRuntimeStatusSchema.optional(),
-	disk: LlmRuntimeDiskUsageSchema.optional(),
-	error: string().optional()
-});
-var GenerateVisionInputSchema = LlmGenerateBaseInputSchema.extend({ images: array(LlmImageSchema).min(1) });
-var ProfileRefInputSchema = object({
+	integrationId: string()
+}), object({ filters: array(AdoptionFilterSchema) }), { auth: "admin" }), method(ListCandidatesInputSchema.extend({ addonId: string() }), ListCandidatesOutputSchema, { auth: "admin" }), method(object({
 	addonId: string(),
-	profileId: string()
-});
-method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(GenerateVisionInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
+	integrationId: string()
+}), AdoptionStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(ProfileRefInputSchema, _void(), {
+}), method(AdoptInputSchema.extend({ addonId: string() }), AdoptResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(ProfileRefInputSchema, LlmGenerateResultSchema, {
+}), method(ReleaseInputSchema.extend({ addonId: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(ProfileRefInputSchema, array(string())), method(object({}), array(LlmDefaultSchema)), method(object({
-	selector: LlmDefaultSelectorSchema,
-	profileId: string().nullable()
-}), _void(), {
+}), method(ResyncInputSchema, ResyncResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	since: number().optional(),
-	until: number().optional(),
-	consumer: string().optional(),
-	profileId: string().optional()
-}), array(LlmUsageRollupSchema)), method(object({}), array(ManagedModelCatalogEntrySchema)), method(object({}), array(LlmRuntimeNodeSchema)), method(object({ nodeId: string() }), array(LlmNodeModelSchema)), method(object({
-	nodeId: string(),
-	model: ManagedModelRefSchema
-}), _void(), {
+}), method(object({}), object({ providers: array(object({
+	addonId: string(),
+	label: string()
+})).readonly() }), { auth: "admin" }), method(object({}), object({ groups: array(object({
+	addonId: string(),
+	label: string(),
+	candidates: array(DiscoveryCandidateSchema).readonly(),
+	error: string().nullable()
+})).readonly() }), {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
-	nodeId: string(),
-	file: string()
-}), _void(), {
+	addonId: string(),
+	params: record(string(), unknown()).optional()
+}), object({ candidates: array(DiscoveryCandidateSchema).readonly() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(ProfileRefInputSchema, LlmRuntimeStatusSchema), method(ProfileRefInputSchema, LlmRuntimeStatusSchema, {
+}), method(object({ addonId: string() }), object({ deviceType: _enum(DeviceType).nullable() }), { auth: "admin" }), method(object({ addonId: string() }), unknown(), { auth: "admin" }), method(object({
+	deviceId: number(),
+	key: string(),
+	value: unknown()
+}), FieldProbeResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(ProfileRefInputSchema, _void(), {
+}), method(object({
+	deviceId: number(),
+	caps: array(string()).readonly().optional()
+}), record(string(), unknown().nullable()));
+method(object({ deviceId: number() }), record(string(), record(string(), unknown()))), method(object({
+	deviceId: number(),
+	capName: string()
+}), record(string(), unknown()).nullable()), method(object({}), record(string(), record(string(), record(string(), unknown())))), method(object({
+	deviceId: number(),
+	capName: string(),
+	slice: record(string(), unknown())
+}), _void(), { kind: "mutation" }), object({
+	deviceId: number(),
+	capName: string(),
+	slice: record(string(), unknown())
+});
+/**
+* Embedding output. `embedding` is wire-encoded as `number[]` so the
+* Zod-validated tRPC surface round-trips cleanly; consumers that need a
+* `Float32Array` can wrap it on the way out (in-process, no marshalling
+* is involved). `inferenceMs` mirrors the runtime field used by the
+* post-analysis enrichment-engine.
+*/
+var EmbeddingResultSchema = object({
+	embedding: array(number()),
+	inferenceMs: number()
+});
+var EmbeddingInfoSchema = object({
+	modelId: string(),
+	embeddingDim: number(),
+	ready: boolean()
+});
+method(object({
+	crop: _instanceof(Uint8Array),
+	width: number(),
+	height: number()
+}), EmbeddingResultSchema), method(object({ text: string() }), EmbeddingResultSchema), method(_void(), EmbeddingInfoSchema);
+/**
+* filesystem-browse — per-node capability for browsing the node's local
+* filesystem, sandboxed to operator-configured allowed roots. Used by the
+* admin "Add filesystem location" flow to pick a node + path. `mode:'per-node'`
+* (one provider per node); the hub calls it with `{nodeId}` so the codegen
+* routes to that exact node (default `nodeIdMode:'routing'`).
+*/
+var DirEntrySchema = object({
+	name: string(),
+	path: string()
+});
+var BrowseResultSchema = object({
+	path: string(),
+	entries: array(DirEntrySchema).readonly(),
+	freeBytes: number(),
+	totalBytes: number()
+});
+method(_void(), array(string()).readonly(), { auth: "admin" }), method(object({ path: string() }), BrowseResultSchema, { auth: "admin" }), method(object({ path: string() }), object({ path: string() }), {
 	kind: "mutation",
 	auth: "admin"
 });
-var LogLevelSchema = _enum([
-	"debug",
-	"info",
-	"warn",
-	"error"
+/**
+* Shared LLM generate contracts — imported by BOTH `llm.cap.ts` (consumer
+* surface) and `llm-runtime.cap.ts` (node-side managed executor) so the two
+* caps stay wire-compatible without a circular cap→cap import.
+*
+* Errors are a discriminated-union RESULT, never thrown: the shape survives
+* every transport tier structurally, and failed calls still write usage rows.
+* Token counts only in v1 — no costUsd (operator decision, 2026-07-15).
+*/
+var LlmUsageSchema = object({
+	inputTokens: number(),
+	outputTokens: number()
+});
+var LlmErrorCodeSchema = _enum([
+	"timeout",
+	"rate-limited",
+	"auth",
+	"refusal",
+	"bad-request",
+	"unavailable",
+	"no-profile",
+	"budget-exceeded",
+	"adapter-error"
 ]);
-var LogEntrySchema = object({
-	timestamp: date(),
-	level: LogLevelSchema,
-	scope: array(string()),
+var LlmGenerateResultSchema = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	text: string(),
+	model: string(),
+	usage: LlmUsageSchema,
+	truncated: boolean(),
+	latencyMs: number()
+}), object({
+	ok: literal(false),
+	code: LlmErrorCodeSchema,
 	message: string(),
-	meta: record(string(), unknown()).optional(),
-	tags: record(string(), string()).optional()
-});
-method(LogEntrySchema, _void(), { kind: "mutation" }), method(object({
-	scope: array(string()).optional(),
-	level: LogLevelSchema.optional(),
-	since: date().optional(),
-	until: date().optional(),
-	limit: number().optional(),
-	tags: record(string(), string()).optional()
-}), array(LogEntrySchema).readonly());
+	retryAfterMs: number().optional()
+})]);
 /**
-* `login-method` — collection cap through which auth addons contribute
-* their pre-auth login surfaces to the login page. This is the SINGLE,
-* generic mechanism that supersedes the dead `auth.listProviders` reader:
-* every auth addon (OIDC, magic-link, WebAuthn/passkey) registers a
-* `login-method` provider and the PUBLIC `auth.listLoginMethods`
-* procedure aggregates them for the unauthenticated login page.
-*
-* A contribution is a discriminated union on `kind`:
-*
-*  - `redirect` — a declarative button. The login page renders a generic
-*    button that navigates to `startUrl` (an addon-owned HTTP route).
-*    Covers OIDC (`/addon/auth-oidc/<id>/start`) and magic-link with
-*    ZERO shell-side JS. A future SSO addon plugs in the same way — the
-*    login page needs NO change.
-*
-*  - `widget` — a Module-Federation widget the login page mounts (via
-*    `loadRemoteBundle`) for an in-page ceremony. `auth.listLoginMethods`
-*    stamps a public `bundleUrl` from `addonId` + `bundle`. Generic
-*    mechanism kept for future use; no shipped addon uses it on the login
-*    page (the passkey ceremony below runs natively in the shell instead).
-*
-*  - `passkey` — a declarative WebAuthn ceremony the shell renders
-*    natively (`@simplewebauthn/browser` lives in `addon-admin-ui`, not in
-*    a remotely-loaded bundle). Carries the addon's effective `rpId` /
-*    `origin` (from its `resolveRpID()` / `resolveOrigin()`) so the shell
-*    can gate visibility (IP-literal origin, hostname/rpId mismatch) WITHOUT
-*    fetching any remote code pre-auth. Contribution stays unconditional —
-*    enrollment state is never leaked pre-auth; visibility is a shell
-*    decision.
-*
-* Every contribution carries a `stage`:
-*  - `primary`        — shown on the first credentials screen (OIDC /
-*                       magic-link buttons; a future usernameless passkey).
-*  - `second-factor`  — shown AFTER the password leg, gated on the
-*                       returned `factors` (passkey-as-2FA today).
+* `Uint8Array` is the sanctioned binary convention — superjson + the UDS
+* MsgPack channel round-trip typed arrays (embedding-encoder.cap.ts:29,
+* notification-output.cap.ts:27-31 precedents).
+*/
+var LlmImageSchema = object({
+	bytes: _instanceof(Uint8Array),
+	mimeType: string()
+});
+var LlmGenerateBaseInputSchema = object({
+	/** Collection routing (the notification-output posture). */
+	addonId: string().optional(),
+	/** Explicit profile; else the resolution chain (spec §3). */
+	profileId: string().optional(),
+	/** MANDATORY usage tag: 'ai-summary', 'notifier-rules', 'adhoc-ui', … */
+	consumer: string(),
+	system: string().optional(),
+	/** v1: single-turn. `messages[]` is a v2 additive field. */
+	prompt: string(),
+	/** Structured output — adapter-mapped (response_format / forced tool / responseSchema). */
+	jsonSchema: record(string(), unknown()).optional(),
+	/** Per-call override of the profile default. */
+	maxTokens: number().int().positive().optional(),
+	temperature: number().optional()
+});
+/**
+* `llm-runtime` — node-side managed llama.cpp executor (spec §4). Registered
+* on EVERY node where `addon-ai` is installed; the hub `llm` provider reaches
+* a specific node's runtime with `nodePin(profile.runtime.nodeId)` — normal
+* cap routing, zero bespoke plumbing. `internal: true`: the operator reaches
+* this only through the `llm` cap's methods.
 *
-* `mount: skip` — the cap is read server-side by the core auth router
-* (`registry.getCollection('login-method')`), never mounted as its own
-* tRPC router.
+* One running llama-server child per node in v1 (models are RAM-heavy).
+* Resource ceiling = llama-server flags + idleStopMinutes ONLY (no RSS
+* watchdog — operator decision #3).
 */
-/** When a login method renders in the two-phase login flow. */
-var LoginStageEnum = _enum(["primary", "second-factor"]);
-/** One login-method contribution — redirect button, pre-auth widget, or native passkey ceremony. */
-var LoginMethodContributionSchema = discriminatedUnion("kind", [
+var ManagedModelRefSchema = discriminatedUnion("kind", [
 	object({
-		kind: literal("redirect"),
-		/** Stable id within the login-method set (e.g. `auth-oidc/google`). */
-		id: string(),
-		/** Operator-facing button label. */
-		label: string(),
-		/** lucide-react icon name. */
-		icon: string().optional(),
-		/** Addon-owned HTTP route the button navigates to (GET). */
-		startUrl: string(),
-		stage: LoginStageEnum
+		kind: literal("catalog"),
+		catalogId: string()
 	}),
 	object({
-		kind: literal("widget"),
-		/** Stable id within the login-method set (e.g. `auth-webauthn/passkey-login`). */
-		id: string(),
-		/** Owning addon id — drives the public bundle URL + the MF namespace. */
-		addonId: string(),
-		/** Bundle filename inside the addon's dist dir (`remoteEntry.js`). */
-		bundle: string(),
-		/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
-		remote: WidgetRemoteSchema,
-		stage: LoginStageEnum
+		kind: literal("url"),
+		url: string(),
+		sha256: string().optional()
 	}),
 	object({
-		kind: literal("passkey"),
-		/** Stable id within the login-method set (e.g. `auth-webauthn/passkey-direct-login`). */
-		id: string(),
-		/** Operator-facing button label. */
-		label: string(),
-		stage: LoginStageEnum,
-		/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
-		rpId: string(),
-		/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
-		origin: string().nullable()
+		kind: literal("path"),
+		path: string()
 	})
 ]);
-method(_void(), array(LoginMethodContributionSchema).readonly());
-var CpuBreakdownSchema = object({
-	total: number(),
-	user: number(),
-	system: number(),
-	irq: number(),
-	nice: number(),
-	loadAvg: tuple([
-		number(),
-		number(),
-		number()
-	]),
-	cores: number()
-});
-var MemoryInfoSchema = object({
-	percent: number(),
-	totalBytes: number(),
-	usedBytes: number(),
-	availableBytes: number(),
-	swapUsedBytes: number(),
-	swapTotalBytes: number()
-});
-var DiskIoSnapshotSchema = object({
-	readBytes: number(),
-	writeBytes: number(),
-	readOps: number(),
-	writeOps: number(),
-	timestampMs: number()
-});
-var NetworkIoSnapshotSchema = object({
-	rxBytes: number(),
-	txBytes: number(),
-	rxPackets: number(),
-	txPackets: number(),
-	rxErrors: number(),
-	txErrors: number(),
-	timestampMs: number()
-});
-var MetricsGpuInfoSchema = object({
-	utilization: number(),
-	model: string(),
-	memoryUsedBytes: number(),
-	memoryTotalBytes: number(),
-	temperature: number().nullable()
-});
-var ProcessResourceInfoSchema = object({
-	openFds: number(),
-	threadCount: number(),
-	activeHandles: number(),
-	activeRequests: number()
-});
-var PressureAvgsSchema = object({
-	avg10: number(),
-	avg60: number(),
-	avg300: number()
-});
-var PressureInfoSchema = object({
-	some: PressureAvgsSchema,
-	full: PressureAvgsSchema.nullable()
-});
-var SystemResourceSnapshotSchema = object({
-	cpu: CpuBreakdownSchema,
-	memory: MemoryInfoSchema,
-	gpu: MetricsGpuInfoSchema.nullable(),
-	network: NetworkIoSnapshotSchema,
-	disk: DiskIoSnapshotSchema,
-	pressure: object({
-		cpu: PressureInfoSchema.nullable(),
-		memory: PressureInfoSchema.nullable(),
-		io: PressureInfoSchema.nullable()
-	}),
-	process: ProcessResourceInfoSchema,
-	cpuTemperature: number().nullable(),
-	timestampMs: number()
-});
-var DiskSpaceInfoSchema = object({
-	path: string(),
-	totalBytes: number(),
-	usedBytes: number(),
-	availableBytes: number(),
-	percent: number()
-});
-var PidResourceStatsSchema = object({
-	pid: number(),
-	cpu: number(),
-	memory: number(),
-	/**
-	* Private (anonymous) resident bytes — the per-process V8 heap + native
-	* allocations NOT shared with other processes (Linux RssAnon). This is the
-	* "real" per-runner cost; summing it across runners is meaningful, unlike
-	* `memory` (RSS), which double-counts the shared mmap'd framework code.
-	* Undefined where /proc is unavailable (e.g. macOS).
-	*/
-	privateBytes: number().optional(),
-	/**
-	* Shared file-backed resident bytes (Linux RssFile) — mmap'd framework/lib
-	* code shared copy-on-write across runners. Undefined on macOS.
-	*/
-	sharedBytes: number().optional()
+var ManagedRuntimeConfigSchema = object({
+	/** WHERE the runtime lives — hub or any agent. */
+	nodeId: string(),
+	/** Closed for v1; 'ollama' is a v2 candidate. */
+	engine: _enum(["llama-cpp"]),
+	model: ManagedModelRefSchema,
+	contextSize: number().int().default(4096),
+	/** 0 = CPU-only. */
+	gpuLayers: number().int().default(0),
+	/** Default: cpus-2, clamped ≥1 (resolved node-side). */
+	threads: number().int().optional(),
+	/** Concurrent slots. */
+	parallel: number().int().default(1),
+	/** Else lazy: first generate boots it. */
+	autoStart: boolean().default(false),
+	/** 0 = never; frees RAM after quiet periods. */
+	idleStopMinutes: number().int().default(30)
 });
-var AddonInstanceSchema = object({
-	addonId: string(),
+var LlmRuntimeStatusSchema = object({
+	/** Status is ALWAYS node-qualified. */
 	nodeId: string(),
-	role: _enum(["hub", "worker"]),
-	pid: number(),
 	state: _enum([
-		"starting",
-		"running",
-		"stopping",
 		"stopped",
-		"crashed"
-	]),
-	uptimeSec: number()
-});
-var NodeProcessSchema = object({
-	pid: number(),
-	ppid: number(),
-	pgid: number(),
-	classification: _enum([
-		"root",
-		"managed",
-		"system",
-		"ghost"
+		"downloading",
+		"starting",
+		"ready",
+		"crashed",
+		"failed"
 	]),
-	/** `$process` addon binding when `managed`, else null. */
-	addonId: string().nullable(),
-	/** Kernel-reported nodeId when the process is a known agent/worker. */
-	nodeId: string().nullable(),
-	/** Truncated command line. */
-	command: string(),
-	cpuPercent: number(),
-	memoryRssBytes: number(),
-	/** Wall-clock uptime (seconds). Parsed from `ps etime`. */
-	uptimeSec: number(),
-	/** True when ancestor walk reaches `ppid=1` (reparented to init/launchd). */
-	orphaned: boolean()
-});
-var KillProcessInputSchema = object({
-	pid: number(),
-	/** Force = SIGKILL. Default is SIGTERM. */
-	force: boolean().optional()
-});
-var KillProcessResultSchema = object({
-	success: boolean(),
-	reason: string().optional(),
-	signal: _enum(["SIGTERM", "SIGKILL"]).optional()
-});
-var DumpHeapSnapshotInputSchema = object({ 
-/** The addon whose runner should dump a heap snapshot. */
-addonId: string() });
-var DumpHeapSnapshotResultSchema = object({
-	success: boolean(),
-	/** Path of the written .heapsnapshot inside the runner's container/host. */
-	path: string().optional(),
-	/** Process pid that was signalled. */
 	pid: number().optional(),
-	reason: string().optional()
+	port: number().optional(),
+	modelPath: string().optional(),
+	modelId: string().optional(),
+	downloadProgress: number().min(0).max(1).optional(),
+	lastError: string().optional(),
+	crashesInWindow: number(),
+	/** Child RSS (sampled best-effort). */
+	memoryBytes: number().optional(),
+	vramBytes: number().optional()
 });
-var SystemMetricsSchema = object({
-	cpuPercent: number(),
-	memoryPercent: number(),
-	memoryUsedMB: number(),
-	memoryTotalMB: number(),
-	diskPercent: number().optional(),
-	temperature: number().optional(),
-	gpuPercent: number().optional(),
-	gpuMemoryPercent: number().optional()
+var LlmNodeModelSchema = object({
+	file: string(),
+	sizeBytes: number(),
+	catalogId: string().optional(),
+	installedAt: number().optional()
 });
-method(_void(), SystemResourceSnapshotSchema), method(_void(), SystemResourceSnapshotSchema.nullable()), method(_void(), SystemMetricsSchema), method(object({ dirPath: string() }), DiskSpaceInfoSchema), method(_void(), MetricsGpuInfoSchema.nullable()), method(_void(), number().nullable()), method(object({ pids: array(number()) }), array(PidResourceStatsSchema)), method(_void(), array(AddonInstanceSchema).readonly()), method(object({ addonId: string() }), PidResourceStatsSchema.nullable()), method(_void(), array(NodeProcessSchema).readonly()), method(KillProcessInputSchema, KillProcessResultSchema, {
+var LlmRuntimeDiskUsageSchema = object({
+	nodeId: string(),
+	modelsBytes: number(),
+	freeBytes: number().optional()
+});
+method(LlmGenerateBaseInputSchema.extend({
+	images: array(LlmImageSchema).optional(),
+	runtime: ManagedRuntimeConfigSchema,
+	/** The managed profile's timeout, threaded by the hub provider. */
+	timeoutMs: number().int().positive().optional()
+}), LlmGenerateResultSchema, { kind: "mutation" }), method(object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(DumpHeapSnapshotInputSchema, DumpHeapSnapshotResultSchema, {
+}), method(object({}), _void(), {
 	kind: "mutation",
 	auth: "admin"
-});
-method(object({
-	sourceUrl: string(),
-	metadata: ModelConvertMetadataSchema,
-	targets: array(ConvertTargetSchema).min(1).readonly(),
-	calibrationRef: string().optional(),
-	sessionId: string().optional()
-}), ConvertResultSchema, {
+}), method(object({}), LlmRuntimeStatusSchema), method(object({ model: ManagedModelRefSchema }), _void(), {
 	kind: "mutation",
-	auth: "admin",
-	timeoutMs: 6e5
-});
-method(object({
-	nodeId: string(),
-	modelId: string(),
-	format: _enum(MODEL_FORMATS),
-	entry: ModelCatalogEntrySchema
-}), object({
-	ok: boolean(),
-	/** sha256 of the staged tarball (empty for a hub-local no-op). */
-	sha256: string(),
-	bytes: number(),
-	/** The target node's modelsDir the artifact landed in. */
-	path: string()
-}), {
+	auth: "admin"
+}), method(object({ file: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-});
-/**
-* `mqtt-broker` — broker-registry cap.
-*
-* NOT a pub/sub proxy. The cap exposes (a) a registry of configured
-* MQTT brokers (external + optionally an embedded `aedes`-backed one)
-* and (b) the connection details a consumer addon needs to spin up
-* its OWN `mqtt.js` client.
-*
-* Why: pub/sub routing over the system event-bus loses fidelity
-* (callback shape, QoS guarantees, will/retain semantics) and adds
-* refcount bookkeeping that addons would rather own themselves. The
-* canonical consumer (`addon-export-ha-mqtt`) needs raw `mqtt.js`
-* features anyway — give it the connection config, get out of the way.
-*
-* Consumer flow:
-*   const cfg = await ctx.api.mqttBroker.getBrokerConfig({ id })
-*   const client = mqtt.connect(cfg.url, { username: cfg.username, … })
-*   client.subscribe('zigbee2mqtt/+')
-*
-* Collection mode: multiple brokers (e.g. one local mosquitto + one
-* cloud bridge). The "embedded" entry (when present) is just another
-* broker in the registry — its lifecycle is owned by the addon that
-* spawned it.
-*/
-var BrokerKindSchema = _enum(["external", "embedded"]);
+}), method(object({}), array(LlmNodeModelSchema)), method(object({}), LlmRuntimeDiskUsageSchema);
 /**
-* Broker live-probe status.
+* `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
+* methods concat-fan across providers; single-row methods route to ONE
+* provider by the `addonId` in the call input (the notification-output
+* posture, notification-output.cap.ts:215-250). Provided by `addon-ai`
+* (hub-placed); the cap stays open for future providers.
 *
-* - `connected` — last probe completed a clean CONNACK
-* - `disconnected` — no probe has run yet (cold cache)
-* - `auth-failed` — CONNACK refused with auth error (RC 4 / 5)
-* - `unreachable` — TCP connect timed out / refused
-* - `tls-error` — TLS handshake failed (cert / SNI / cipher)
+* Profiles are ROWS (data), not addons: one row = one usable model endpoint.
+* `apiKey` is a password field — providers REDACT it on read and merge on
+* write; a stored key NEVER round-trips to a client.
 */
-var BrokerStatusSchema$1 = _enum([
-	"connected",
-	"disconnected",
-	"auth-failed",
-	"unreachable",
-	"tls-error"
+var LlmProfileKindSchema = _enum([
+	"openai-compatible",
+	"openai",
+	"anthropic",
+	"google",
+	"managed-local"
 ]);
-var BrokerInfoSchema = object({
+var LlmProfileSchema = object({
 	id: string(),
 	name: string(),
-	url: string(),
-	kind: BrokerKindSchema,
-	status: BrokerStatusSchema$1,
-	latencyMs: number().nullable(),
-	error: string().optional(),
-	/** Embedded brokers only: number of MQTT clients currently connected. */
-	connectedClients: number().int().nonnegative().optional(),
-	/** Epoch ms of the last live probe (external) or aedes snapshot (embedded). */
-	lastCheckedAt: number().optional()
+	kind: LlmProfileKindSchema,
+	/** Stamped by the provider — keeps the fanned catalog routable. */
+	addonId: string(),
+	enabled: boolean(),
+	/** Vendor model id, or the managed runtime's loaded model. */
+	model: string(),
+	/** Required for openai-compatible; override for cloud kinds. */
+	baseUrl: string().optional(),
+	/** ConfigUISchema type:'password' — never round-trips (spec §5). */
+	apiKey: string().optional(),
+	supportsVision: boolean(),
+	temperature: number().min(0).max(2).optional(),
+	maxTokens: number().int().positive().optional(),
+	timeoutMs: number().int().positive().default(6e4),
+	extraHeaders: record(string(), string()).optional(),
+	/** kind === 'managed-local' only (spec §4). */
+	runtime: ManagedRuntimeConfigSchema.optional()
 });
-/**
-* Connection details — what a consumer needs to call
-* `mqtt.connect(url, options)`. We split URL + credentials so the
-* consumer can pass them as `mqtt.connect(url, { username, password })`
-* instead of stuffing creds into the URL (which leaks them into logs).
-*/
-var BrokerConnectionDetailsSchema = object({
-	url: string(),
-	username: string().optional(),
-	password: string().optional(),
-	/**
-	* Suggested prefix for `clientId`. Each consumer should suffix this
-	* with its own discriminator (addon id, instance id) so reconnects
-	* don't kick each other off (MQTT spec: clientId must be unique per
-	* broker).
-	*/
-	clientIdPrefix: string().optional()
+/** ConfigUISchema tree passed through untyped on the wire (the
+*  notification-output `ConfigSchemaPassthrough` precedent at
+*  notification-output.cap.ts:151); the exported TS type re-tightens it. */
+var ConfigSchemaPassthrough$1 = unknown();
+var LlmProfileKindDescriptorSchema = object({
+	kind: LlmProfileKindSchema,
+	label: string(),
+	icon: string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: string(),
+	configSchema: ConfigSchemaPassthrough$1
 });
-var AddBrokerInputSchema = object({
-	name: string().min(1),
-	url: string().regex(/^(mqtt|mqtts|ws|wss):\/\//, "URL must start with mqtt(s):// or ws(s)://"),
-	username: string().optional(),
-	password: string().optional(),
-	clientIdPrefix: string().optional()
+var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
+var LlmDefaultSchema = object({
+	selector: LlmDefaultSelectorSchema,
+	profileId: string()
 });
-var AddBrokerResultSchema = object({ id: string() });
-var IdInputSchema = object({ id: string() });
-var TestResultSchema$1 = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number()
-}), object({
-	ok: literal(false),
-	error: string()
-})]);
-var StartEmbeddedInputSchema = object({
-	port: number().int().min(1).max(65535).default(1883),
-	/** Allow anonymous connect (no username/password). Default: false. */
-	allowAnonymous: boolean().default(false),
-	/** Optional shared username/password for clients. */
-	username: string().optional(),
-	password: string().optional()
+/** Server-side rollup row — getUsage never dumps raw call rows (spec §6). */
+var LlmUsageRollupSchema = object({
+	day: string(),
+	consumer: string(),
+	profileId: string(),
+	calls: number(),
+	okCalls: number(),
+	errorCalls: number(),
+	inputTokens: number(),
+	outputTokens: number(),
+	avgLatencyMs: number()
 });
-var StartEmbeddedResultSchema = object({
+/** LLM-facing view over the reused ModelCatalogEntry mechanism (spec §4.2). */
+var ManagedModelCatalogEntrySchema = object({
 	id: string(),
-	url: string()
-});
-var StatusSchema = object({
-	brokerCount: number(),
-	embeddedRunning: boolean()
-});
-method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema), method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(IdInputSchema, TestResultSchema$1, { kind: "mutation" }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(_void(), StatusSchema);
-var NetworkEndpointSchema = object({
+	label: string(),
+	family: string(),
+	purpose: _enum(["text", "vision"]),
 	url: string(),
-	hostname: string(),
-	port: number(),
-	protocol: _enum(["http", "https"])
+	sha256: string(),
+	sizeBytes: number(),
+	quantization: string(),
+	/** Load-time guidance shown in the picker. */
+	minRamBytes: number(),
+	contextSizeDefault: number().int(),
+	/** Vision models: companion projector file. */
+	mmprojUrl: string().optional()
 });
-var NetworkAccessStatusSchema = object({
-	connected: boolean(),
-	endpoint: NetworkEndpointSchema.nullable(),
+var LlmRuntimeNodeSchema = object({
+	nodeId: string(),
+	reachable: boolean(),
+	status: LlmRuntimeStatusSchema.optional(),
+	disk: LlmRuntimeDiskUsageSchema.optional(),
 	error: string().optional()
 });
-/**
-* Optional, richer endpoint shape returned by providers that expose
-* MORE than one ingress concurrently (Tailscale Ingress with mixed
-* serve+funnel rules, future ngrok multi-tunnel, …). Each entry carries
-* the originating provider config (mode + sourcePort) so the
-* orchestrator UI can label rows distinctly. Providers that expose only
-* one endpoint just omit `listEndpoints` from their provider impl.
-*/
-var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
-	/**
-	* Stable id within the provider — typically `<mode>-<sourcePort>` so
-	* the orchestrator can dedupe across `listEndpoints` polls.
-	*/
-	id: string(),
-	/** Operator-facing label (mirrors `MeshEndpoint.label`). */
-	label: string(),
-	/** Optional provider-specific mode tag, used for icon/colour in admin UI. */
-	mode: string().optional(),
-	/** Originating local port the ingress fronts (informational). */
-	sourcePort: number().optional()
+var GenerateVisionInputSchema = LlmGenerateBaseInputSchema.extend({ images: array(LlmImageSchema).min(1) });
+var ProfileRefInputSchema = object({
+	addonId: string(),
+	profileId: string()
+});
+method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(GenerateVisionInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(ProfileRefInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(ProfileRefInputSchema, LlmGenerateResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(ProfileRefInputSchema, array(string())), method(object({}), array(LlmDefaultSchema)), method(object({
+	selector: LlmDefaultSelectorSchema,
+	profileId: string().nullable()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	since: number().optional(),
+	until: number().optional(),
+	consumer: string().optional(),
+	profileId: string().optional()
+}), array(LlmUsageRollupSchema)), method(object({}), array(ManagedModelCatalogEntrySchema)), method(object({}), array(LlmRuntimeNodeSchema)), method(object({ nodeId: string() }), array(LlmNodeModelSchema)), method(object({
+	nodeId: string(),
+	model: ManagedModelRefSchema
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	nodeId: string(),
+	file: string()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(ProfileRefInputSchema, LlmRuntimeStatusSchema), method(ProfileRefInputSchema, LlmRuntimeStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(ProfileRefInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
+var LogLevelSchema = _enum([
+	"debug",
+	"info",
+	"warn",
+	"error"
+]);
+var LogEntrySchema = object({
+	timestamp: date(),
+	level: LogLevelSchema,
+	scope: array(string()),
+	message: string(),
+	meta: record(string(), unknown()).optional(),
+	tags: record(string(), string()).optional()
 });
-method(_void(), NetworkEndpointSchema, { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), NetworkEndpointSchema.nullable()), method(_void(), NetworkAccessStatusSchema), method(_void(), array(NetworkEndpointEntrySchema).readonly());
+method(LogEntrySchema, _void(), { kind: "mutation" }), method(object({
+	scope: array(string()).optional(),
+	level: LogLevelSchema.optional(),
+	since: date().optional(),
+	until: date().optional(),
+	limit: number().optional(),
+	tags: record(string(), string()).optional()
+}), array(LogEntrySchema).readonly());
 /**
-* notification-output — canonical, capability-gated notification delivery.
+* `login-method` — collection cap through which auth addons contribute
+* their pre-auth login surfaces to the login page. This is the SINGLE,
+* generic mechanism that supersedes the dead `auth.listProviders` reader:
+* every auth addon (OIDC, magic-link, WebAuthn/passkey) registers a
+* `login-method` provider and the PUBLIC `auth.listLoginMethods`
+* procedure aggregates them for the unauthenticated login page.
 *
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
+* A contribution is a discriminated union on `kind`:
 *
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
+*  - `redirect` — a declarative button. The login page renders a generic
+*    button that navigates to `startUrl` (an addon-owned HTTP route).
+*    Covers OIDC (`/addon/auth-oidc/<id>/start`) and magic-link with
+*    ZERO shell-side JS. A future SSO addon plugs in the same way — the
+*    login page needs NO change.
 *
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = _enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*  - `widget` — a Module-Federation widget the login page mounts (via
+*    `loadRemoteBundle`) for an in-page ceremony. `auth.listLoginMethods`
+*    stamps a public `bundleUrl` from `addonId` + `bundle`. Generic
+*    mechanism kept for future use; no shipped addon uses it on the login
+*    page (the passkey ceremony below runs natively in the shell instead).
+*
+*  - `passkey` — a declarative WebAuthn ceremony the shell renders
+*    natively (`@simplewebauthn/browser` lives in `addon-admin-ui`, not in
+*    a remotely-loaded bundle). Carries the addon's effective `rpId` /
+*    `origin` (from its `resolveRpID()` / `resolveOrigin()`) so the shell
+*    can gate visibility (IP-literal origin, hostname/rpId mismatch) WITHOUT
+*    fetching any remote code pre-auth. Contribution stays unconditional —
+*    enrollment state is never leaked pre-auth; visibility is a shell
+*    decision.
+*
+* Every contribution carries a `stage`:
+*  - `primary`        — shown on the first credentials screen (OIDC /
+*                       magic-link buttons; a future usernameless passkey).
+*  - `second-factor`  — shown AFTER the password leg, gated on the
+*                       returned `factors` (passkey-as-2FA today).
+*
+* `mount: skip` — the cap is read server-side by the core auth router
+* (`registry.getCollection('login-method')`), never mounted as its own
+* tRPC router.
 */
-var AttachmentSchema = object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: string().optional(),
-	bytes: _instanceof(Uint8Array).optional(),
-	mime: string().optional(),
-	name: string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = _enum([
-	"text",
-	"markdown",
-	"html"
+/** When a login method renders in the two-phase login flow. */
+var LoginStageEnum = _enum(["primary", "second-factor"]);
+/** One login-method contribution — redirect button, pre-auth widget, or native passkey ceremony. */
+var LoginMethodContributionSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("redirect"),
+		/** Stable id within the login-method set (e.g. `auth-oidc/google`). */
+		id: string(),
+		/** Operator-facing button label. */
+		label: string(),
+		/** lucide-react icon name. */
+		icon: string().optional(),
+		/** Addon-owned HTTP route the button navigates to (GET). */
+		startUrl: string(),
+		stage: LoginStageEnum
+	}),
+	object({
+		kind: literal("widget"),
+		/** Stable id within the login-method set (e.g. `auth-webauthn/passkey-login`). */
+		id: string(),
+		/** Owning addon id — drives the public bundle URL + the MF namespace. */
+		addonId: string(),
+		/** Bundle filename inside the addon's dist dir (`remoteEntry.js`). */
+		bundle: string(),
+		/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
+		remote: WidgetRemoteSchema,
+		stage: LoginStageEnum
+	}),
+	object({
+		kind: literal("passkey"),
+		/** Stable id within the login-method set (e.g. `auth-webauthn/passkey-direct-login`). */
+		id: string(),
+		/** Operator-facing button label. */
+		label: string(),
+		stage: LoginStageEnum,
+		/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
+		rpId: string(),
+		/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
+		origin: string().nullable()
+	})
 ]);
-/** A single tap-through action button. */
-var NotificationActionSchema = object({
-	id: string(),
-	label: string(),
-	url: string().optional()
+method(_void(), array(LoginMethodContributionSchema).readonly());
+var CpuBreakdownSchema = object({
+	total: number(),
+	user: number(),
+	system: number(),
+	irq: number(),
+	nice: number(),
+	loadAvg: tuple([
+		number(),
+		number(),
+		number()
+	]),
+	cores: number()
 });
-/**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
-*/
-var NotificationSchema = object({
-	body: string(),
-	title: string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: number().int().min(1).max(5).default(3),
-	level: string().optional(),
-	attachments: array(AttachmentSchema).optional(),
-	clickUrl: string().optional(),
-	actions: array(NotificationActionSchema).optional(),
-	sound: string().optional(),
-	ttl: number().optional(),
-	tag: string().optional(),
-	deviceId: number().optional(),
-	eventId: string().optional(),
-	metadata: record(string(), unknown()).optional()
+var MemoryInfoSchema = object({
+	percent: number(),
+	totalBytes: number(),
+	usedBytes: number(),
+	availableBytes: number(),
+	swapUsedBytes: number(),
+	swapTotalBytes: number()
+});
+var DiskIoSnapshotSchema = object({
+	readBytes: number(),
+	writeBytes: number(),
+	readOps: number(),
+	writeOps: number(),
+	timestampMs: number()
+});
+var NetworkIoSnapshotSchema = object({
+	rxBytes: number(),
+	txBytes: number(),
+	rxPackets: number(),
+	txPackets: number(),
+	rxErrors: number(),
+	txErrors: number(),
+	timestampMs: number()
+});
+var MetricsGpuInfoSchema = object({
+	utilization: number(),
+	model: string(),
+	memoryUsedBytes: number(),
+	memoryTotalBytes: number(),
+	temperature: number().nullable()
+});
+var ProcessResourceInfoSchema = object({
+	openFds: number(),
+	threadCount: number(),
+	activeHandles: number(),
+	activeRequests: number()
 });
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = object({
-	id: string(),
-	label: string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: number().int().min(1).max(5).nullable(),
-	flags: object({
-		critical: boolean().optional(),
-		silent: boolean().optional(),
-		noPush: boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: array(string()).optional(),
-	description: string().optional()
+var PressureAvgsSchema = object({
+	avg10: number(),
+	avg60: number(),
+	avg300: number()
 });
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = object({
-	attachments: object({
-		mediaTypes: array(AttachmentMediaTypeSchema),
-		mode: _enum([
-			"url",
-			"bytes",
-			"both"
-		]),
-		max: number().int().nonnegative(),
-		maxBytes: number().int().positive().optional()
+var PressureInfoSchema = object({
+	some: PressureAvgsSchema,
+	full: PressureAvgsSchema.nullable()
+});
+var SystemResourceSnapshotSchema = object({
+	cpu: CpuBreakdownSchema,
+	memory: MemoryInfoSchema,
+	gpu: MetricsGpuInfoSchema.nullable(),
+	network: NetworkIoSnapshotSchema,
+	disk: DiskIoSnapshotSchema,
+	pressure: object({
+		cpu: PressureInfoSchema.nullable(),
+		memory: PressureInfoSchema.nullable(),
+		io: PressureInfoSchema.nullable()
 	}),
-	/** Max action buttons (0 = none). */
-	actions: number().int().nonnegative(),
-	levels: array(TargetKindLevelSchema),
-	format: array(NotificationFormatSchema),
-	clickUrl: boolean(),
-	sound: boolean(),
-	ttl: boolean(),
-	bodyMaxLen: number().int().positive()
+	process: ProcessResourceInfoSchema,
+	cpuTemperature: number().nullable(),
+	timestampMs: number()
 });
-/**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
-*/
-var ConfigSchemaPassthrough = unknown();
-var TargetKindSchema = object({
-	kind: string(),
-	label: string(),
-	icon: string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: string(),
-	configSchema: ConfigSchemaPassthrough,
-	supportsDiscovery: boolean(),
-	caps: TargetKindCapsSchema
+var DiskSpaceInfoSchema = object({
+	path: string(),
+	totalBytes: number(),
+	usedBytes: number(),
+	availableBytes: number(),
+	percent: number()
 });
-/**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
-*/
-var TargetSchema = object({
-	id: string(),
-	name: string(),
-	kind: string(),
+var PidResourceStatsSchema = object({
+	pid: number(),
+	cpu: number(),
+	memory: number(),
+	/**
+	* Private (anonymous) resident bytes — the per-process V8 heap + native
+	* allocations NOT shared with other processes (Linux RssAnon). This is the
+	* "real" per-runner cost; summing it across runners is meaningful, unlike
+	* `memory` (RSS), which double-counts the shared mmap'd framework code.
+	* Undefined where /proc is unavailable (e.g. macOS).
+	*/
+	privateBytes: number().optional(),
+	/**
+	* Shared file-backed resident bytes (Linux RssFile) — mmap'd framework/lib
+	* code shared copy-on-write across runners. Undefined on macOS.
+	*/
+	sharedBytes: number().optional()
+});
+var AddonInstanceSchema = object({
 	addonId: string(),
-	enabled: boolean(),
-	config: record(string(), unknown())
+	nodeId: string(),
+	role: _enum(["hub", "worker"]),
+	pid: number(),
+	state: _enum([
+		"starting",
+		"running",
+		"stopping",
+		"stopped",
+		"crashed"
+	]),
+	uptimeSec: number()
 });
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = object({
-	kind: string(),
-	suggestedName: string(),
-	config: record(string(), unknown())
+var NodeProcessSchema = object({
+	pid: number(),
+	ppid: number(),
+	pgid: number(),
+	classification: _enum([
+		"root",
+		"managed",
+		"system",
+		"ghost"
+	]),
+	/** `$process` addon binding when `managed`, else null. */
+	addonId: string().nullable(),
+	/** Kernel-reported nodeId when the process is a known agent/worker. */
+	nodeId: string().nullable(),
+	/** Truncated command line. */
+	command: string(),
+	cpuPercent: number(),
+	memoryRssBytes: number(),
+	/** Wall-clock uptime (seconds). Parsed from `ps etime`. */
+	uptimeSec: number(),
+	/** True when ancestor walk reaches `ppid=1` (reparented to init/launchd). */
+	orphaned: boolean()
 });
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = object({
-	level: string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: number().int().nonnegative(),
-	actionsSent: number().int().nonnegative(),
-	truncated: boolean(),
-	dropped: array(string())
+var KillProcessInputSchema = object({
+	pid: number(),
+	/** Force = SIGKILL. Default is SIGTERM. */
+	force: boolean().optional()
 });
-var SendResultSchema = object({
+var KillProcessResultSchema = object({
 	success: boolean(),
-	error: string().optional(),
-	renderedAs: RenderedAsSchema.optional()
+	reason: string().optional(),
+	signal: _enum(["SIGTERM", "SIGKILL"]).optional()
+});
+var DumpHeapSnapshotInputSchema = object({ 
+/** The addon whose runner should dump a heap snapshot. */
+addonId: string() });
+var DumpHeapSnapshotResultSchema = object({
+	success: boolean(),
+	/** Path of the written .heapsnapshot inside the runner's container/host. */
+	path: string().optional(),
+	/** Process pid that was signalled. */
+	pid: number().optional(),
+	reason: string().optional()
+});
+var SystemMetricsSchema = object({
+	cpuPercent: number(),
+	memoryPercent: number(),
+	memoryUsedMB: number(),
+	memoryTotalMB: number(),
+	diskPercent: number().optional(),
+	temperature: number().optional(),
+	gpuPercent: number().optional(),
+	gpuMemoryPercent: number().optional()
+});
+method(_void(), SystemResourceSnapshotSchema), method(_void(), SystemResourceSnapshotSchema.nullable()), method(_void(), SystemMetricsSchema), method(object({ dirPath: string() }), DiskSpaceInfoSchema), method(_void(), MetricsGpuInfoSchema.nullable()), method(_void(), number().nullable()), method(object({ pids: array(number()) }), array(PidResourceStatsSchema)), method(_void(), array(AddonInstanceSchema).readonly()), method(object({ addonId: string() }), PidResourceStatsSchema.nullable()), method(_void(), array(NodeProcessSchema).readonly()), method(KillProcessInputSchema, KillProcessResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(DumpHeapSnapshotInputSchema, DumpHeapSnapshotResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+method(object({
+	sourceUrl: string(),
+	metadata: ModelConvertMetadataSchema,
+	targets: array(ConvertTargetSchema).min(1).readonly(),
+	calibrationRef: string().optional(),
+	sessionId: string().optional()
+}), ConvertResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 6e5
+});
+method(object({
+	nodeId: string(),
+	modelId: string(),
+	format: _enum(MODEL_FORMATS),
+	entry: ModelCatalogEntrySchema
+}), object({
+	ok: boolean(),
+	/** sha256 of the staged tarball (empty for a hub-local no-op). */
+	sha256: string(),
+	bytes: number(),
+	/** The target node's modelsDir the artifact landed in. */
+	path: string()
+}), {
+	kind: "mutation",
+	auth: "admin"
 });
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema)), method(object({
-	kind: string(),
-	config: record(string(), unknown()).optional()
-}), array(DiscoveredTargetSchema)), method(object({
-	targetId: string(),
-	notification: NotificationSchema
-}), SendResultSchema, { kind: "mutation" }), method(object({
-	targetId: string(),
-	sample: NotificationSchema.optional()
-}), TestResultSchema, { kind: "mutation" }), method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }), method(object({ targetId: string() }), _void(), { kind: "mutation" }), method(object({
-	targetId: string(),
-	enabled: boolean()
-}), _void(), { kind: "mutation" });
 /**
-* notification-rules — the Notification Center rule surface (P1 core).
-*
-* Spec: `docs/superpowers/specs/2026-07-22-notification-center-requirements.md`
-* (operator decisions D-1/D-2/D-3 are binding):
+* `mqtt-broker` — broker-registry cap.
 *
-*  - D-2: rule EVALUATION lives in `addon-post-analysis` (the
-*    `notification-center` module), hooked on the durable persistence
-*    moments (object-event insert, TrackCloser.closeExpired) with a
-*    persisted outbox + retry — never the lossy telemetry bus (D8).
-*  - D-3: urgency belongs to the RULE. `delivery: 'immediate'` fires on the
-*    FIRST persisted detection matching the conditions (per-track dedup,
-*    `maxPerTrack` fixed at 1 — see {@link NC_MAX_PER_TRACK_IMMEDIATE});
-*    `delivery: 'track-end'` evaluates the finalized track record at close.
-*  - DISPATCH stays behind `notification-output` (rules reference targets
-*    by id; per-backend params are a passthrough blob capped by the
-*    target kind's own caps/degrade engine).
+* NOT a pub/sub proxy. The cap exposes (a) a registry of configured
+* MQTT brokers (external + optionally an embedded `aedes`-backed one)
+* and (b) the connection details a consumer addon needs to spin up
+* its OWN `mqtt.js` client.
 *
-* P1 scope: admin-authored rules only (`createdBy` stamped from the
-* server-injected caller identity — the first `caller: 'required'`
-* adopter). The P1 condition subset is: devices, classes(+exclude),
-* minConfidence, admin zones (any/all + exclude), weekly schedule
-* windows, and the optional label/identity/plate matchers. User rules,
-* private zones, per-recipient fan-out and the wider condition table are
-* P2+ (see spec §7).
+* Why: pub/sub routing over the system event-bus loses fidelity
+* (callback shape, QoS guarantees, will/retain semantics) and adds
+* refcount bookkeeping that addons would rather own themselves. The
+* canonical consumer (`addon-export-ha-mqtt`) needs raw `mqtt.js`
+* features anyway — give it the connection config, get out of the way.
 *
-* All schemas here are the single source of truth — `NcRule` etc. are
-* `z.infer` exports; no duplicate interfaces (the advanced-notifier
-* schema/interface drift is explicitly not repeated).
+* Consumer flow:
+*   const cfg = await ctx.api.mqttBroker.getBrokerConfig({ id })
+*   const client = mqtt.connect(cfg.url, { username: cfg.username, … })
+*   client.subscribe('zigbee2mqtt/+')
+*
+* Collection mode: multiple brokers (e.g. one local mosquitto + one
+* cloud bridge). The "embedded" entry (when present) is just another
+* broker in the registry — its lifecycle is owned by the addon that
+* spawned it.
 */
+var BrokerKindSchema = _enum(["external", "embedded"]);
 /**
-* D-3: the trigger/urgency of a rule — which persistence moment evaluates it.
-* The value maps 1:1 onto the evaluated record kind:
-*  - `immediate`     ↔ object-event persist (lowest-latency detection burst)
-*  - `track-end`     ↔ TrackCloser.closeExpired (finalized track record)
-*  - `device-event`  ↔ SensorEventStore insert (doorbell press / sensor state
-*                       change of a LINKED device, one row per linked camera)
-*  - `package-event` ↔ PackageDropDetector object-event insert (a `package`
-*                       delivery / pick-up)
+* Broker live-probe status.
 *
-* `immediate`/`track-end` carry the D-3 urgency semantics; `device-event`/
-* `package-event` are pure trigger kinds (no urgency dimension). Extending
-* this one field keeps the schema additive — a rule still declares exactly
-* one trigger.
+* - `connected` — last probe completed a clean CONNACK
+* - `disconnected` — no probe has run yet (cold cache)
+* - `auth-failed` — CONNACK refused with auth error (RC 4 / 5)
+* - `unreachable` — TCP connect timed out / refused
+* - `tls-error` — TLS handshake failed (cert / SNI / cipher)
 */
-var NcDeliverySchema = _enum([
-	"immediate",
-	"track-end",
-	"device-event",
-	"package-event"
+var BrokerStatusSchema$1 = _enum([
+	"connected",
+	"disconnected",
+	"auth-failed",
+	"unreachable",
+	"tls-error"
 ]);
-/** Weekly schedule — OR of windows; absence on the rule = always active. */
-var NcScheduleSchema = object({
-	windows: array(object({
-		/** Days of week the window STARTS on (0 = Sunday … 6 = Saturday). */
-		days: array(number().int().min(0).max(6)).min(1),
-		startMinute: number().int().min(0).max(1439),
-		endMinute: number().int().min(0).max(1439)
-	})).min(1),
-	/** IANA timezone; default = hub host timezone. */
-	timezone: string().optional(),
-	/** Active OUTSIDE the windows (e.g. "only outside business hours"). */
-	invert: boolean().optional()
-});
-/** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
-var NcPlateMatcherSchema = object({
-	values: array(string().min(1)).min(1),
-	/** Max Levenshtein distance after normalization (uppercase alphanumeric). */
-	maxDistance: number().int().min(0).max(3).default(1)
-});
-/**
-* Occupancy condition (DEVICE-EVENT trigger). Fires on a ZoneAnalytics
-* occupancy edge for a device — optionally narrowed to a single admin
-* `zoneId` and/or object `className`. `op` selects the edge/threshold:
-*  - `became-occupied` (default) — count crossed 0 → ≥ `count`
-*  - `became-free`               — count crossed ≥ `count` → below it
-*  - `>=` / `<=`                 — count is at/over or at/under `count`
-* `sustainSeconds` requires the condition hold continuously that long
-* before firing (debounces flicker; 0 = fire on the first matching edge).
-* Fail-closed: no ZoneAnalytics snapshot / missing zone / null snapshot ⇒
-* the condition never matches. Confirmed edge-state survives addon restarts
-* (declared SQLite collection, reseeded on boot).
-*/
-var NcOccupancyConditionSchema = object({
-	/** Admin zone id to scope the count to; absent = whole-frame occupancy. */
-	zoneId: string().optional(),
-	/** Object class to count; absent = any class. */
-	className: string().optional(),
-	op: _enum([
-		"became-occupied",
-		"became-free",
-		">=",
-		"<="
-	]).default("became-occupied"),
-	count: number().int().min(0).default(1),
-	sustainSeconds: number().int().min(0).max(3600).default(15)
-});
-/** Admin-zone membership condition (zone IDs as stamped by the ZoneEngine). */
-var NcZoneConditionSchema = object({
-	ids: array(string().min(1)).min(1),
-	/** Quantifier over `ids` — at least one / every one visited. */
-	match: _enum(["any", "all"]).default("any")
-});
-/**
-* The P1 condition set — a flat AND of groups; absent group = pass;
-* membership lists are OR within the list (spec §2.3).
-*/
-var NcConditionsSchema = object({
-	/** Device scope — absent = all devices. */
-	devices: array(number()).optional(),
-	/** Detector class names (any overlap with the record's class set). */
-	classes: array(string().min(1)).optional(),
-	/** Veto classes — any overlap fails the rule. */
-	classesExclude: array(string().min(1)).optional(),
-	/** Minimum detection confidence 0–1 (fails when the record has none). */
-	minConfidence: number().min(0).max(1).optional(),
-	/** Admin zone membership over event `zones` / track `zonesVisited`. */
-	zones: NcZoneConditionSchema.optional(),
-	/** Veto zones — any hit fails the rule. */
-	zonesExclude: array(string().min(1)).optional(),
-	/**
-	* Exact (case-insensitive) match on the record's collapsed `label`
-	* (identity name / plate text / subclass).
-	*/
-	labelEquals: array(string().min(1)).optional(),
-	/**
-	* Identity matcher. P1 boundary: matched against the record's collapsed
-	* `label` (the identity display name propagated by the face pipeline) —
-	* identity-ID matching rides in P2 when identity ids reach the record.
-	*/
-	identities: array(string().min(1)).optional(),
-	/** Fuzzy plate matcher against the record's `label` (plate text). */
-	plates: NcPlateMatcherSchema.optional(),
-	/**
-	* Identity EXCLUDE — mirror of {@link identities} with `notIn` semantics.
-	* Same P1 boundary: matched against the record's collapsed `label` (the
-	* identity display name). A record with NO label passes (nothing to
-	* exclude), unlike the include variant which fails on an absent label.
-	*/
-	identitiesExclude: array(string().min(1)).optional(),
-	/**
-	* Minimum server-computed key-event importance in [0,1] (`Track.importance`).
-	* TRACK-END only: importance is scored at track close, so it does not exist
-	* at immediate / object-event evaluation time (see catalog `appliesTo`). At
-	* close the value is threaded via the close-time info (the `Track` clone is
-	* captured before the DB row is updated, so it would otherwise read stale).
-	* Fails when the record carries no importance (never guess quality — the
-	* `minConfidence` precedent). MVP cut: a single scalar threshold.
-	*/
-	minImportance: number().min(0).max(1).optional(),
-	/**
-	* Minimum track dwell in SECONDS — `(lastSeen − firstSeen) / 1000`.
-	* TRACK-END only: an `immediate` / object-event subject has no closed
-	* lifespan, so a dwell condition never matches immediate delivery
-	* (documented choice — the object-event record carries no `firstSeen`,
-	* so dwell cannot be computed from what the subject actually carries).
-	*/
-	minDwellSeconds: number().min(0).optional(),
-	/**
-	* Detection provenance filter. `any` (default / absent) matches every
-	* source; otherwise the subject's source must equal it. Legacy records
-	* with no stamped source are treated as `pipeline`. The union spans both
-	* record kinds — object events carry `pipeline` | `onboard`, synthetic
-	* tracks carry `sensor`.
-	*/
-	source: _enum([
-		"pipeline",
-		"onboard",
-		"sensor",
-		"any"
-	]).optional(),
-	/**
-	* Minimum identity / plate MATCH confidence in [0,1] — DISTINCT from the
-	* detector `minConfidence` (that gates the object-detection score; this
-	* gates the recognition/OCR match score). Fails when the subject carries
-	* no label-match confidence (never guess). TRACK-END only: the confidence
-	* lives on the recognition result and reaches the subject at track close.
-	*
-	* What it measures precisely (plumbed at track close — the closer threads
-	* the value into `NcTrackClosedInfo.labelConfidence`, the same seam as
-	* `importance`): the BEST recognition match confidence observed for the
-	* label the track carries at close — for a face, the peak cosine similarity
-	* of the ASSIGNED identity (`FaceMatch.score`, reset on an identity switch);
-	* for a plate, the peak OCR read score of the best-held plate
-	* (`plateText.confidence`). When BOTH a face and a plate were recognized on
-	* one track the higher of the two is used. A track that ended with no
-	* confident identity/plate match carries no value, so the condition fails
-	* closed for it (an un-recognized subject).
-	*/
-	minLabelConfidence: number().min(0).max(1).optional(),
-	/**
-	* DEVICE-EVENT only. Raw device event-type tokens (`EventFire.eventType`,
-	* e.g. a doorbell `press` / `press_long`) — matched case-insensitively
-	* against the token carried on the device-event subject (extracted from the
-	* event-emitter runtime slice's `lastEvent.eventType`). Fails when the
-	* subject carries no token. Doorbell-pulse / passive-sensor kinds emit no
-	* eventType, so gate those with {@link sensorKinds} instead.
-	*/
-	eventTypeTokens: array(string().min(1)).optional(),
-	/**
-	* DEVICE-EVENT only. Sensor/control taxonomy kinds (e.g. `doorbell`,
-	* `contact`, `button`, `device-event`) — matched against the persisted
-	* `SensorEvent.kind` (see `sensor-event-kinds.ts`). Membership is OR.
-	*/
-	sensorKinds: array(string().min(1)).optional(),
-	/**
-	* PACKAGE-EVENT only. Which package phase fires the rule — `delivered`
-	* (a parked parcel appeared), `picked-up` (it departed), or `both`. Fails
-	* when the subject's phase does not match (a subject always carries a phase
-	* on the package-event trigger).
-	*/
-	packagePhase: _enum([
-		"delivered",
-		"picked-up",
-		"both"
-	]).optional(),
-	/**
-	* PERSONAL-RULE custom zones (viewer-drawn). Inline normalized polygons
-	* (MaskShape vocabulary). A record passes when its bbox overlaps ANY
-	* listed polygon (ZoneEngine membership semantics). Evaluated only when
-	* the subject carries a bbox; absent bbox ⇒ the condition FAILS.
-	*/
-	customZones: array(MaskPolygonShapeSchema).optional(),
-	/**
-	* DEVICE-EVENT only. ZoneAnalytics occupancy edge — fires when a device's
-	* (optionally zone/class-scoped) occupancy count crosses the configured
-	* threshold and holds for `sustainSeconds`. Fail-closed on missing
-	* substrate (no snapshot / missing zone). See {@link NcOccupancyCondition}.
-	*/
-	occupancy: NcOccupancyConditionSchema.optional()
-});
-/** One delivery target: a `notification-output` Target ref + passthrough params. */
-var NcRuleTargetSchema = object({
-	/** `notification-output` Target id. */
-	targetId: string().min(1),
-	/**
-	* Per-backend passthrough. Recognized keys are mapped onto the canonical
-	* Notification (`priority`, `level`, `sound`, `clickUrl`, `ttl`); the
-	* degrade engine drops what the backend can't render.
-	*/
-	params: record(string(), unknown()).optional()
+var BrokerInfoSchema = object({
+	id: string(),
+	name: string(),
+	url: string(),
+	kind: BrokerKindSchema,
+	status: BrokerStatusSchema$1,
+	latencyMs: number().nullable(),
+	error: string().optional(),
+	/** Embedded brokers only: number of MQTT clients currently connected. */
+	connectedClients: number().int().nonnegative().optional(),
+	/** Epoch ms of the last live probe (external) or aedes snapshot (embedded). */
+	lastCheckedAt: number().optional()
 });
 /**
-* Media attachment policy (P1 still-image subset).
-*  - `best` — the best AVAILABLE subject image at dispatch time (D-3).
-*  - `best-matching` — the media that explains WHY the rule fired: a rule
-*    matched on identities attaches the subject's `faceCrop`, one matched on
-*    plates attaches the `plateCrop`; a rule with no identity/plate condition
-*    (or when the specific crop is missing) degrades to `best`, then
-*    `keyFrame`, then no attachment — never delaying the send. The matched
-*    condition summary is frozen on the outbox row at enqueue (like the rule
-*    name), so the choice never drifts from the record that fired it.
-*  - `keyFrame` — the clean scene frame (no subject box).
-*  - `none` — no attachment.
+* Connection details — what a consumer needs to call
+* `mqtt.connect(url, options)`. We split URL + credentials so the
+* consumer can pass them as `mqtt.connect(url, { username, password })`
+* instead of stuffing creds into the URL (which leaks them into logs).
 */
-var NcMediaPolicySchema = object({ attach: _enum([
-	"best",
-	"best-matching",
-	"keyFrame",
-	"none"
-]).default("best") });
-/** Throttle — cooldown survives restarts (rebuilt from the outbox on boot). */
-var NcThrottleSchema = object({
-	cooldownSec: number().int().min(0).max(86400).default(60),
-	/** `rule` = one shared cooldown; `rule-device` = per-camera cooldown. */
-	scope: _enum(["rule", "rule-device"]).default("rule-device")
-});
-/** Client-supplied rule fields (server stamps id/createdBy/createdAt/updatedAt). */
-var NcRuleInputSchema = object({
-	name: string().min(1).max(200),
-	enabled: boolean().default(true),
-	delivery: NcDeliverySchema,
-	conditions: NcConditionsSchema.default({}),
-	schedule: NcScheduleSchema.optional(),
-	targets: array(NcRuleTargetSchema).min(1),
-	media: NcMediaPolicySchema.default({ attach: "best" }),
-	throttle: NcThrottleSchema.default({
-		cooldownSec: 60,
-		scope: "rule-device"
-	}),
-	/** `{{var}}` templating over camera/class/label/zones/confidence/time. */
-	template: object({
-		title: string().max(500).optional(),
-		body: string().max(2e3).optional()
-	}).optional(),
-	/** Canonical notification priority ordinal (1..5); per-target overridable. */
-	priority: number().int().min(1).max(5).default(3),
+var BrokerConnectionDetailsSchema = object({
+	url: string(),
+	username: string().optional(),
+	password: string().optional(),
 	/**
-	* Ownership/visibility key. Absent = admin/global rule (unchanged legacy
-	* behaviour, visible to all, read-only in the viewer). Present = personal
-	* rule owned by this userId. Server-stamped; never trusted from a client.
+	* Suggested prefix for `clientId`. Each consumer should suffix this
+	* with its own discriminator (addon id, instance id) so reconnects
+	* don't kick each other off (MQTT spec: clientId must be unique per
+	* broker).
 	*/
-	ownerUserId: string().optional()
+	clientIdPrefix: string().optional()
+});
+var AddBrokerInputSchema = object({
+	name: string().min(1),
+	url: string().regex(/^(mqtt|mqtts|ws|wss):\/\//, "URL must start with mqtt(s):// or ws(s)://"),
+	username: string().optional(),
+	password: string().optional(),
+	clientIdPrefix: string().optional()
+});
+var AddBrokerResultSchema = object({ id: string() });
+var IdInputSchema = object({ id: string() });
+var TestResultSchema$1 = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	latencyMs: number()
+}), object({
+	ok: literal(false),
+	error: string()
+})]);
+var StartEmbeddedInputSchema = object({
+	port: number().int().min(1).max(65535).default(1883),
+	/** Allow anonymous connect (no username/password). Default: false. */
+	allowAnonymous: boolean().default(false),
+	/** Optional shared username/password for clients. */
+	username: string().optional(),
+	password: string().optional()
+});
+var StartEmbeddedResultSchema = object({
+	id: string(),
+	url: string()
+});
+var StatusSchema = object({
+	brokerCount: number(),
+	embeddedRunning: boolean()
+});
+method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema), method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(IdInputSchema, TestResultSchema$1, { kind: "mutation" }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(_void(), StatusSchema);
+var NetworkEndpointSchema = object({
+	url: string(),
+	hostname: string(),
+	port: number(),
+	protocol: _enum(["http", "https"])
+});
+var NetworkAccessStatusSchema = object({
+	connected: boolean(),
+	endpoint: NetworkEndpointSchema.nullable(),
+	error: string().optional()
 });
 /**
-* Partial patch for `updateRule` — any subset of the input fields, plus the
-* persisted-only {@link NcRuleSchema} `disabledTargetIds` set. The latter is
-* NOT a client-authored input field (it lives on the persisted rule, not the
-* input), so it is added here explicitly to let the store's per-target opt-out
-* toggle round-trip through the shared `update` path. Viewer opt-out mutations
-* still flow through `nc.setRuleTargetEnabled` (owner-checked), never a raw
-* `updateRule` patch.
+* Optional, richer endpoint shape returned by providers that expose
+* MORE than one ingress concurrently (Tailscale Ingress with mixed
+* serve+funnel rules, future ngrok multi-tunnel, …). Each entry carries
+* the originating provider config (mode + sourcePort) so the
+* orchestrator UI can label rows distinctly. Providers that expose only
+* one endpoint just omit `listEndpoints` from their provider impl.
 */
-var NcRulePatchSchema = NcRuleInputSchema.partial().extend({ disabledTargetIds: array(string()).optional() });
-/** A persisted rule. */
-var NcRuleSchema = NcRuleInputSchema.extend({
-	id: string(),
-	/** userId of the admin who created the rule (server-stamped caller). */
-	createdBy: string(),
-	createdAt: number(),
-	updatedAt: number(),
+var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
 	/**
-	* Per-target opt-out set. A targetId here is suppressed for THIS rule at
-	* send time. Only a target's OWNER may add/remove its id (server-checked
-	* in `nc.setRuleTargetEnabled`). Defaults to empty.
+	* Stable id within the provider — typically `<mode>-<sourcePort>` so
+	* the orchestrator can dedupe across `listEndpoints` polls.
 	*/
-	disabledTargetIds: array(string()).default([])
-});
-var NcTestResultSchema = object({
-	recordId: string(),
-	recordKind: _enum([
-		"object-event",
-		"track",
-		"device-event",
-		"package-event"
-	]),
-	deviceId: number(),
-	timestamp: number(),
-	wouldFire: boolean(),
-	/** Condition id that failed (first failing group), when `wouldFire` is false. */
-	failedCondition: string().optional(),
-	className: string().optional(),
-	label: string().optional()
+	id: string(),
+	/** Operator-facing label (mirrors `MeshEndpoint.label`). */
+	label: string(),
+	/** Optional provider-specific mode tag, used for icon/colour in admin UI. */
+	mode: string().optional(),
+	/** Originating local port the ingress fronts (informational). */
+	sourcePort: number().optional()
 });
-var NcConditionDescriptorSchema = object({
-	/** Field id inside `NcConditions` (or `'schedule'` for the rule-level group). */
+method(_void(), NetworkEndpointSchema, { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), NetworkEndpointSchema.nullable()), method(_void(), NetworkAccessStatusSchema), method(_void(), array(NetworkEndpointEntrySchema).readonly());
+/**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = _enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: string().optional(),
+	bytes: _instanceof(Uint8Array).optional(),
+	mime: string().optional(),
+	name: string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = _enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = object({
+	id: string(),
+	label: string(),
+	url: string().optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = object({
+	body: string(),
+	title: string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: number().int().min(1).max(5).default(3),
+	level: string().optional(),
+	attachments: array(AttachmentSchema).optional(),
+	clickUrl: string().optional(),
+	actions: array(NotificationActionSchema).optional(),
+	sound: string().optional(),
+	ttl: number().optional(),
+	tag: string().optional(),
+	deviceId: number().optional(),
+	eventId: string().optional(),
+	metadata: record(string(), unknown()).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = object({
 	id: string(),
-	group: _enum([
-		"scope",
-		"class",
-		"zones",
-		"quality",
-		"label",
-		"schedule",
-		"device",
-		"package",
-		"occupancy"
-	]),
 	label: string(),
-	/** Editor widget the UI renders — never hardcode per-condition forms. */
-	valueType: _enum([
-		"deviceIdList",
-		"stringList",
-		"number01",
-		"number",
-		"sourceSelect",
-		"zoneSelection",
-		"zoneIdList",
-		"schedule",
-		"plateMatcher",
-		"packagePhase",
-		"polygonDraw",
-		"occupancy"
-	]),
-	operator: _enum([
-		"in",
-		"notIn",
-		"anyOf",
-		"allOf",
-		"gte",
-		"fuzzyIn",
-		"withinSchedule"
-	]),
-	/** Which delivery kinds the condition applies to. */
-	appliesTo: array(NcDeliverySchema),
-	phase: string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: number().int().min(1).max(5).nullable(),
+	flags: object({
+		critical: boolean().optional(),
+		silent: boolean().optional(),
+		noPush: boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: array(string()).optional(),
 	description: string().optional()
 });
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = object({
+	attachments: object({
+		mediaTypes: array(AttachmentMediaTypeSchema),
+		mode: _enum([
+			"url",
+			"bytes",
+			"both"
+		]),
+		max: number().int().nonnegative(),
+		maxBytes: number().int().positive().optional()
+	}),
+	/** Max action buttons (0 = none). */
+	actions: number().int().nonnegative(),
+	levels: array(TargetKindLevelSchema),
+	format: array(NotificationFormatSchema),
+	clickUrl: boolean(),
+	sound: boolean(),
+	ttl: boolean(),
+	bodyMaxLen: number().int().positive()
+});
 /**
-* The delivery lifecycle status of a history row — a straight read of the
-* durable outbox row's own status (single source of truth):
-*  - `pending` — enqueued, in-flight or retrying with backoff
-*  - `sent`    — delivered (terminal)
-*  - `dead`    — dead-lettered after exhausting retries / a permanent
-*                backend rejection / a deleted target (terminal; carries
-*                the failure `error`)
-*
-* P1 has no `suppressed-quiet-hours` / `snoozed` states — those ride the P2
-* user dimension (quiet hours / snooze) and are additive when they land.
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var NcHistoryStatusSchema = _enum([
-	"pending",
-	"sent",
-	"dead"
-]);
-/** The evaluated record kind a history row descends from (one per trigger). */
-var NcHistoryRecordKindSchema = _enum([
-	"object-event",
-	"track-end",
-	"device-event",
-	"package-event"
-]);
-/** Subject summary frozen on the row at fire time (survives rule/record edits). */
-var NcHistorySubjectSchema = object({
-	className: string(),
-	label: string().optional(),
-	confidence: number().optional(),
-	zones: array(string()),
-	timestamp: number()
+var ConfigSchemaPassthrough = unknown();
+var TargetKindSchema = object({
+	kind: string(),
+	label: string(),
+	icon: string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: string(),
+	configSchema: ConfigSchemaPassthrough,
+	supportsDiscovery: boolean(),
+	caps: TargetKindCapsSchema
 });
 /**
-* One delivery-history row. This is a read-only VIEW over the durable
-* outbox row (single source of truth — the same row the drain loop drives;
-* NO second write path, so history can never drift from delivery state).
-* The §3.2 fields map directly: `ruleId`/`targetId`/`deviceId` are columns,
-* `eventRef` is `recordKind`+`recordId`, `timestamps` are `createdAt`
-* (fire) / `updatedAt` (last transition), `status` + `error` are the
-* lifecycle. `ruleName` + `subject` are the intent snapshot frozen at
-* enqueue. `userId?` (per-recipient history) is P2 — no user dimension in
-* P1 (admin scope only).
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
 */
-var NcHistoryEntrySchema = object({
-	/** Outbox row id — the stable dedup id `ruleId:dedupRef:targetId`. */
+var TargetSchema = object({
 	id: string(),
-	ruleId: string(),
-	/** Rule name frozen at fire time (outlives a later rename / delete). */
-	ruleName: string(),
-	/** The rule urgency/trigger that produced this delivery. */
-	delivery: NcDeliverySchema,
-	targetId: string(),
-	deviceId: number(),
-	recordKind: NcHistoryRecordKindSchema,
-	/** Event / track ref of the evaluated record (§3.2 `eventRef`). */
-	recordId: string(),
-	/** Present for track-scoped deliveries (object-event / track-end). */
-	trackId: string().optional(),
-	status: NcHistoryStatusSchema,
-	/** Delivery attempts made so far. */
-	attempts: number().int(),
-	/** Fire time (outbox enqueue). */
-	createdAt: number(),
-	/** Last transition time (terminal for sent / dead). */
-	updatedAt: number(),
-	/** Failure detail — present on a `dead` row. */
-	error: string().optional(),
-	subject: NcHistorySubjectSchema
+	name: string(),
+	kind: string(),
+	addonId: string(),
+	enabled: boolean(),
+	config: record(string(), unknown())
 });
-/**
-* Query filter for `getHistory` (spec §4.2). Every field is a narrowing
-* AND; absent = unbounded on that axis. `since`/`until` bound the fire time
-* (`createdAt`, epoch ms, inclusive). `limit` is clamped to
-* {@link NC_HISTORY_LIMIT_MAX}. `userId` (per-recipient filtering) is P2.
-*/
-var NcHistoryFilterSchema = object({
-	ruleId: string().optional(),
-	deviceId: number().optional(),
-	status: NcHistoryStatusSchema.optional(),
-	since: number().optional(),
-	until: number().optional(),
-	limit: number().int().min(1).max(500).default(100)
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = object({
+	kind: string(),
+	suggestedName: string(),
+	config: record(string(), unknown())
 });
-method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), method(object({ ruleId: string() }), object({ rule: NcRuleSchema.nullable() }), { auth: "admin" }), method(object({ rule: NcRuleInputSchema }), object({ rule: NcRuleSchema }), {
-	kind: "mutation",
-	auth: "admin",
-	caller: "required"
-}), method(object({
-	ruleId: string(),
-	patch: NcRulePatchSchema
-}), object({ rule: NcRuleSchema }), {
-	kind: "mutation",
-	auth: "admin",
-	caller: "required"
-}), method(object({ ruleId: string() }), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	ruleId: string(),
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = object({
+	level: string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: number().int().nonnegative(),
+	actionsSent: number().int().nonnegative(),
+	truncated: boolean(),
+	dropped: array(string())
+});
+var SendResultSchema = object({
+	success: boolean(),
+	error: string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema)), method(object({
+	kind: string(),
+	config: record(string(), unknown()).optional()
+}), array(DiscoveredTargetSchema)), method(object({
+	targetId: string(),
+	notification: NotificationSchema
+}), SendResultSchema, { kind: "mutation" }), method(object({
+	targetId: string(),
+	sample: NotificationSchema.optional()
+}), TestResultSchema, { kind: "mutation" }), method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }), method(object({ targetId: string() }), _void(), { kind: "mutation" }), method(object({
+	targetId: string(),
 	enabled: boolean()
-}), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	rule: NcRuleInputSchema,
-	lookbackMinutes: number().int().min(1).max(1440).default(60)
-}), object({ results: array(NcTestResultSchema) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({}), object({ catalog: array(NcConditionDescriptorSchema) })), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" });
+}), _void(), { kind: "mutation" });
 /**
 * Zod schemas for persisted record types.
 *
@@ -22801,6 +23002,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"backup.deleteSchedule": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"backup.getEntries": {
 		capName: "backup",
 		capScope: "system",
@@ -22831,6 +23038,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"backup.listSchedules": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"backup.previewSchedule": {
 		capName: "backup",
 		capScope: "system",
@@ -22855,6 +23068,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"backup.upsertSchedule": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"battery.wakeForStream": {
 		capName: "battery",
 		capScope: "device",
@@ -26689,6 +26908,36 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.close": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"terminalSession.listProfiles": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"terminalSession.listSessions": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"terminalSession.openSession": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"terminalSession.resize": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"toast.onToast": {
 		capName: "toast",
 		capScope: "system",