@camstack/addon-pipeline 1.2.290 → 1.2.292

package/dist/{dist-C4JqXCw-.mjs → dist-Bn6BQW8q.mjs}

@@ -5360,7 +5360,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-PEo0-Fz9.mjs
+//#region ../types/dist/sleep-D_4W7xuQ.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7534,11 +7534,17 @@ var RawStateResultSchema = object({
 method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(object({ deviceId: number() }), array(ConfigEntrySchema$1)), method(object({
 	deviceId: number(),
 	values: record(string(), unknown())
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	deviceId: number(),
 	action: string().min(1),
 	input: unknown()
-}), unknown(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
+}), unknown(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
 /**
 * The ONE retry schedule for work that can fail simply because the node was
 * still booting.
@@ -13608,7 +13614,7 @@ method(ListInputSchema, array(BrokerInfoSchema$1)), method(GetInputSchema, Broke
 }), method(UnsubscribeInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(GetStateInputSchema, unknown().nullable()), method(_void(), RegistryStatusSchema);
+}), method(GetStateInputSchema, unknown().nullable(), { auth: "admin" }), method(_void(), RegistryStatusSchema);
 DeviceType.Camera;
 /** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
 var StreamFormatSchema = _enum([
@@ -15043,17 +15049,20 @@ method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string()
-}), unknown()), method(object({
+}), unknown(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string(),
 	value: unknown()
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: QueryFilterSchema.optional(),
 	columns: array(string()).readonly().optional()
-}), array(SettingsRecordSchema).readonly()), method(object({
+}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	/** Declared columns identifying the slot; must be covered by a UNIQUE
@@ -15063,7 +15072,10 @@ method(object({
 }), object({ 
 /** The id the row HAS: assigned by SQLite on an insert, or the existing
 *  row's own id on an update. */
-id: union([string(), number()]) }), { kind: "mutation" }), method(object({
+id: union([string(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	record: object({
@@ -15076,38 +15088,56 @@ id: union([string(), number()]) }), { kind: "mutation" }), method(object({
 * for an absent one, or the ROWID SQLite assigned on an `INTEGER`
 * primary key — which is the only place an auto key is knowable.
 */
-id: union([string(), number()]) }), { kind: "mutation" }), method(object({
+id: union([string(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	records: array(BulkRecordSchema).readonly()
-}), object({ inserted: number().int() }), { kind: "mutation" }), method(object({
+}), object({ inserted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	id: string(),
 	data: record(string(), unknown())
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string()
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: MutationFilterSchema
-}), object({ deleted: number().int() }), { kind: "mutation" }), method(object({
+}), object({ deleted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: MutationFilterSchema,
 	data: record(string(), unknown())
-}), object({ updated: number().int() }), { kind: "mutation" }), method(object({
+}), object({ updated: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: QueryFilterSchema.optional()
-}), number()), method(object({
+}), number(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	fields: array(AggregateFieldSchema).readonly(),
 	filter: QueryFilterSchema.optional()
-}), AggregateResultSchema), method(object({
+}), AggregateResultSchema, { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -15117,15 +15147,18 @@ id: union([string(), number()]) }), { kind: "mutation" }), method(object({
 }), array(object({
 	bucket: number().int(),
 	count: number().int()
-})).readonly()), method(object({
+})).readonly(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string()
-}), boolean()), method(object({
+}), boolean(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	columns: array(CollectionColumnSchema).readonly(),
 	indexes: array(CollectionIndexSchema).readonly().optional()
-}), _void(), { kind: "mutation" });
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * What one engine says about itself. The orchestrator uses `kind` to pick
 * a registrant for a collection; `engineId` is what a log line names when
@@ -15840,7 +15873,13 @@ var ExposeInputSchema = object({
 	capabilities: array(string()).optional()
 });
 var UnexposeInputSchema = object({ deviceId: string() });
-method(_void(), DeviceExportStatusSchema), method(_void(), array(DeviceKindSchema)), method(_void(), array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), { kind: "mutation" }), method(UnexposeInputSchema, _void(), { kind: "mutation" });
+method(_void(), DeviceExportStatusSchema), method(_void(), array(DeviceKindSchema)), method(_void(), array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(UnexposeInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /** Wire/storage schema for one icon id. */
 var LocationIconIdSchema = _enum([
 	"map-pin",
@@ -16344,7 +16383,10 @@ method(object({
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 12 * 6e4
-}), method(DeviceRegisterPayloadSchema, _void(), { kind: "mutation" }), method(DeviceRemovePayloadSchema, _void(), { kind: "mutation" }), method(DevicePersistConfigPayloadSchema, _void(), { kind: "mutation" }), method(object({ deviceId: number() }), record(string(), unknown())), method(object({ deviceId: number() }), record(string(), unknown())), method(object({ deviceId: number() }), DeviceMetaSchema.nullable()), method(object({
+}), method(DeviceRegisterPayloadSchema, _void(), { kind: "mutation" }), method(DeviceRemovePayloadSchema, _void(), { kind: "mutation" }), method(DevicePersistConfigPayloadSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number() }), record(string(), unknown()), { auth: "admin" }), method(object({ deviceId: number() }), record(string(), unknown()), { auth: "admin" }), method(object({ deviceId: number() }), DeviceMetaSchema.nullable()), method(object({
 	deviceId: number(),
 	name: string()
 }), _void(), {
@@ -16549,7 +16591,7 @@ method(object({
 }), method(object({ deviceId: number() }), array(StreamProbeResultSchema), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceId: number() }), DeviceBindingsForDeviceSchema), method(object({ deviceIds: array(number()) }), array(DeviceBindingsForDeviceSchema)), method(object({}), array(DeviceBindingsForDeviceSchema)), method(object({
+}), method(object({ deviceId: number() }), DeviceBindingsForDeviceSchema), method(object({ deviceIds: array(number()) }), array(DeviceBindingsForDeviceSchema)), method(object({}), array(DeviceBindingsForDeviceSchema)), method(object({ capNames: array(string().min(1)).min(1).max(16) }), array(number())), method(object({
 	deviceId: number(),
 	capName: string(),
 	wrapperAddonId: string(),
@@ -18167,7 +18209,22 @@ var StatusSchema = object({
 	brokerCount: number(),
 	embeddedRunning: boolean()
 });
-method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema), method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(IdInputSchema, TestResultSchema$1, { kind: "mutation" }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(_void(), StatusSchema);
+method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }), method(AddBrokerInputSchema, AddBrokerResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(IdInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(IdInputSchema, TestResultSchema$1, {
+	kind: "mutation",
+	auth: "admin"
+}), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(IdInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), StatusSchema);
 var NetworkEndpointSchema = object({
 	url: string(),
 	hostname: string(),
@@ -18462,6 +18519,18 @@ var TargetKindSchema = object({
 	*/
 	iconMediaType: string().optional(),
 	configSchema: ConfigSchemaPassthrough,
+	/**
+	* The config keys that decide WHERE this kind's secrets are sent (server,
+	* base URL, instance, chat, recipient). A save that changes any of them
+	* while leaving a secret redacted is refused by the provider (D634), so an
+	* editor uses this to ask for the secret on exactly those edits instead of
+	* on every edit.
+	*
+	* Optional: absent from a provider that holds no secret (the Home Assistant
+	* kinds) and from a provider older than this field — an editor that finds
+	* it absent must assume ANY edit may need the secret.
+	*/
+	destinationKeys: array(string()).optional(),
 	supportsDiscovery: boolean(),
 	caps: TargetKindCapsSchema
 });
@@ -18500,19 +18569,34 @@ var SendResultSchema = object({
 });
 /** Same shape as SendResult — kept as a distinct name for the test panel. */
 var TestResultSchema = SendResultSchema;
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema)), method(object({
+method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({
 	kind: string(),
 	config: record(string(), unknown()).optional()
-}), array(DiscoveredTargetSchema)), method(object({
+}), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
 	targetId: string(),
 	notification: NotificationSchema
-}), SendResultSchema, { kind: "mutation" }), method(object({
+}), SendResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	targetId: string(),
 	sample: NotificationSchema.optional()
-}), TestResultSchema, { kind: "mutation" }), method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }), method(object({ targetId: string() }), _void(), { kind: "mutation" }), method(object({
+}), TestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ target: TargetSchema }), TargetSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ targetId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	targetId: string(),
 	enabled: boolean()
-}), _void(), { kind: "mutation" });
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 var COCO_80_LABELS = [
 	{
 		id: "person",
@@ -19359,6 +19443,7 @@ sub("presence", "sensor", "sensor", "#22c55e", "presence", "Presence");
 sub("enum-sensor", "sensor", "sensor", TAXONOMY_COLORS.sensor, "generic", "Sensor state");
 sub("device-event", "sensor", "sensor", "#10b981", "button", "Device event");
 sub("lock", "control", "control", "#0ea5e9", "lock", "Lock");
+sub("cover", "control", "control", "#0ea5e9", "door", "Cover");
 sub("switch", "control", "control", TAXONOMY_COLORS.control, "switch", "Switch");
 sub("siren", "control", "control", "#dc2626", "siren", "Siren");
 sub("button", "control", "control", "#10b981", "button", "Button");
@@ -19639,6 +19724,10 @@ var NcSystemEventKindSchema = _enum([
 	"alarm-disarmed",
 	"alarm-arming",
 	"alarm-arm-refused",
+	"alarm-pending",
+	"alarm-rearmed",
+	"alarm-sensor-bypass",
+	"alarm-check-failed",
 	"addon-updated",
 	"server-updated",
 	"export-completed",
@@ -19676,6 +19765,19 @@ var NcSystemEventConditionSchema = object({
 	* does not carry) matches no `deviceTypes` list.
 	*/
 	deviceTypes: array(string().min(1)).min(1).optional(),
+	/**
+	* Devices this rule NEVER speaks about, whatever else matched. Scoped to the
+	* same kind family as `deviceIds` (`systemEventFilterApplies(kind,
+	* 'deviceIds')`) and applied AFTER it: include first, then exclude. A
+	* consumable subject (`consumable:<id>:<key>`) is excluded by its device id.
+	*
+	* It never fails closed: a subject that carries no device id is not in the
+	* list, so it is not excluded. "Every battery except the one thermometer that
+	* reads 0 % forever" is the question this answers — expressed as an include
+	* list it would have to name every other battery device, and every device
+	* adopted later would be silently left out (D636).
+	*/
+	excludeDeviceIds: array(number().int()).min(1).optional(),
 	nodeIds: array(string().min(1)).min(1).optional(),
 	packageNames: array(string().min(1)).min(1).optional()
 });
@@ -20234,6 +20336,19 @@ var NcMediaFrameSchema = _enum([
 	"full",
 	"boxed"
 ]);
+/**
+* How a SENSOR notification shows the cameras that link the sensor.
+*
+* `mosaic` — one image composed of every linked camera's photograph, taken at
+* the trigger. `each` — one image per camera where the target takes several
+* attachments; a target that takes one keeps the first camera's (the degrade
+* engine drops the rest by order). Either way ONE notification per event.
+* Absent = `mosaic`, applied by the Notification Center and deliberately NOT
+* a Zod default (see NcRulePatchSchema: a default materialises on every
+* partial patch). Meaningless for a rule whose subject is not a sensor, and a
+* sensor linked to one camera ships that camera's plain snapshot either way.
+*/
+var NcLinkedCameraModeSchema = _enum(["mosaic", "each"]);
 var NcMediaPolicySchema = object({
 	attach: _enum([
 		"best",
@@ -20279,7 +20394,9 @@ var NcMediaPolicySchema = object({
 	* A profile that is not assigned falls back to the cheapest, and the render
 	* reports which one actually ran.
 	*/
-	profile: CamProfileSchema.optional()
+	profile: CamProfileSchema.optional(),
+	/** See {@link NcLinkedCameraModeSchema}. */
+	linkedCameras: NcLinkedCameraModeSchema.optional()
 });
 /**
 * Cooldown GRANULARITY over the subject's class — how much a fired
@@ -20399,7 +20516,7 @@ var NcRuleInputSchema = object({
 		cooldownSec: 60,
 		scope: "rule-device"
 	}),
-	/** `{{var}}` templating over camera/class/label/zones/confidence/time. */
+	/** `{{var}}` title/body. The variables are declared in `NC_TEMPLATE_VARS` (@camstack/types) and depend on the rule kind — see `templateVarsFor`. */
 	template: object({
 		title: string().max(500).optional(),
 		body: string().max(2e3).optional()
@@ -20579,6 +20696,22 @@ var NcRulePatchSchema = NcRuleInputSchema.partial().extend({
 	throttle: NcThrottleSchema.optional(),
 	priority: number().int().min(1).max(5).optional()
 });
+var NcRuleClearableKeySchema = _enum([
+	"template",
+	"schedule",
+	"targetUsers",
+	"snoozeOptions",
+	"snoozeAllowGlobal",
+	"waitForEnhancement",
+	"actions",
+	"confirm",
+	"groupIdleSec"
+]);
+var NcRuleUpdateInputSchema = object({
+	ruleId: string(),
+	patch: NcRulePatchSchema,
+	clear: array(NcRuleClearableKeySchema).optional()
+});
 /** A persisted rule. */
 var NcRuleSchema = NcRuleInputSchema.extend({
 	id: string(),
@@ -20610,6 +20743,85 @@ var NcTestResultSchema = object({
 	className: string().optional(),
 	label: string().optional()
 });
+/** The five rule kinds, as data. `NcRuleKind` in `notification/rule-kinds.ts`
+*  is the same union; the template-vars spec pins the two together. */
+var NcRuleKindSchema = _enum([
+	"detection",
+	"sensor",
+	"occupancy",
+	"sound",
+	"system"
+]);
+/** Which producer renders a template: an ordinary rule, a timelapse, a digest. */
+var NcTemplateFamilySchema = _enum([
+	"rule",
+	"timelapse",
+	"summary"
+]);
+/** Which text field of that producer. `previewText` is the timelapse frame
+*  caption, `captionText` the digest mosaic caption — both see fewer vars. */
+var NcTemplateFieldSchema = _enum([
+	"title",
+	"body",
+	"previewText",
+	"captionText"
+]);
+var NcTemplateVarGroupSchema = _enum([
+	"subject",
+	"place",
+	"time",
+	"rule",
+	"occupancy",
+	"sound",
+	"sensor",
+	"system",
+	"digest",
+	"ai"
+]);
+/**
+* ONE `{{var}}` a notification template may name.
+*
+* `families` / `fields` / `kinds` / `deliveries` / `systemEventKinds` say WHERE
+* it has a value; absent = no restriction on that axis. `systemEventKinds` is
+* read only for a `system` rule. `dynamic` declares a FAMILY of names
+* (`count_<class>`): the descriptor's `name` is the example member.
+*/
+var NcTemplateVarDescriptorSchema = object({
+	name: string().regex(/^\w+$/),
+	label: string(),
+	description: string().optional(),
+	example: string(),
+	group: NcTemplateVarGroupSchema,
+	families: array(NcTemplateFamilySchema).min(1),
+	fields: array(NcTemplateFieldSchema).optional(),
+	kinds: array(NcRuleKindSchema).optional(),
+	deliveries: array(NcDeliverySchema).optional(),
+	systemEventKinds: array(NcSystemEventKindSchema).optional(),
+	dynamic: object({
+		prefix: literal("count_"),
+		from: literal("classes")
+	}).optional()
+});
+/** Input to `previewTemplate` — the editor's own context, plus the draft text. */
+var NcTemplatePreviewInputSchema = object({
+	context: object({
+		family: NcTemplateFamilySchema,
+		field: NcTemplateFieldSchema,
+		kind: NcRuleKindSchema.optional(),
+		delivery: NcDeliverySchema.optional(),
+		systemEventKinds: array(NcSystemEventKindSchema).optional()
+	}),
+	template: object({
+		title: string().max(500).optional(),
+		body: string().max(2e3).optional()
+	})
+});
+var NcTemplatePreviewSchema = object({
+	title: string().nullable(),
+	body: string().nullable(),
+	/** Names the template uses that this context never fills — they render empty. */
+	unknown: array(string())
+});
 var NcConditionDescriptorSchema = object({
 	/** Field id inside `NcConditions` (or `'schedule'` for the rule-level group). */
 	id: string(),
@@ -20875,8 +21087,17 @@ object({
 	lastAt: number()
 });
 /**
-* The three durations the panel's state machine runs on, plus who hears about
-* an arm.
+* The per-mode lists, at most one per mode. Two lists for one mode have no
+* meaning a reader could agree on (union? the last one?), so they are refused
+* at the boundary rather than interpreted.
+*/
+var NcAlarmNonBlockingListSchema = array(object({
+	mode: AlarmArmModeSchema,
+	deviceIds: array(number().int()).max(200)
+})).max(8).refine((lists) => new Set(lists.map((l) => l.mode)).size === lists.length, { message: "nonBlocking: at most one list per arm mode" });
+/**
+* The three durations the panel's state machine runs on, who hears about its
+* transitions, and which openings each mode tolerates.
 *
 * They live on the NOTIFICATION-RULES cap, not on `alarm-panel`, on purpose:
 * `alarm-panel` is `deviceNative` and its other provider mirrors somebody
@@ -20895,21 +21116,39 @@ var NcAlarmSettingsSchema = object({
 	* existed, and therefore what an untouched install keeps doing.
 	*/
 	triggeredDurationSec: number().int().min(0).max(3600),
-	/** Send a notification when a mode takes effect. */
-	announceArm: boolean(),
 	/**
-	* Where that notification goes. Target ids from `notification-output`.
+	* Deprecated by D630 — every transition is announced. Parsed, never read;
+	* remove after one release. Optional so an older admin's patch (which still
+	* sends it) parses rather than failing the whole save.
+	*/
+	announceArm: boolean().optional(),
+	/**
+	* Target ids from `notification-output`: every alarm transition goes here.
 	*
-	* Explicit rather than "everyone": an arm announcement is a household
+	* Explicit rather than "everyone": an alarm announcement is a household
 	* message, and broadcasting it to every configured endpoint (including a
 	* webhook wired to something else) is not a default anybody would choose.
-	* Empty with `announceArm: true` sends nothing, and the server logs that —
-	* silence must be attributable.
+	* Empty sends nothing, and the server logs that — silence must be
+	* attributable.
+	*/
+	announceTargets: array(string().min(1)).max(16),
+	/**
+	* Per arm mode, the covered devices whose being OPEN does not refuse the
+	* arm (a window left ajar for the cat under `home`, say). At most one entry
+	* per mode is meaningful. Defaulted to `[]` so a blob stored before D630
+	* parses as "every opening blocks" — the behaviour it was written under.
 	*/
-	announceTargets: array(string().min(1)).max(16)
+	nonBlocking: NcAlarmNonBlockingListSchema.default([])
 });
-/** Every field optional — a tab edits one control at a time. */
-var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.partial();
+/**
+* Every field optional — a tab edits one control at a time.
+*
+* `nonBlocking` is re-declared WITHOUT its default: `.partial()` does not
+* remove an inner `.default()`, so a patch that never named the field would
+* parse to `nonBlocking: []` and wipe every mode's list on an unrelated edit
+* (the same trap {@link NcRulePatchSchema} documents).
+*/
+var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.extend({ nonBlocking: NcAlarmNonBlockingListSchema }).partial();
 /**
 * What one arm mode actually arms, DERIVED from the enabled rules gated on it.
 * Never authored, never stored — see `alarm-mode-coverage.ts` for why a stored
@@ -20954,6 +21193,36 @@ var NcAlarmModeCoverageSchema = object({
 	*/
 	skippedDevices: array(NcAlarmSkippedDeviceSchema).default([])
 });
+/** One covered device that reads open, and whether that refuses the arm. */
+var NcAlarmOpeningSchema = object({
+	deviceId: number().int(),
+	name: string(),
+	/** The device's state word as read (`open`, `unlocked`, …). */
+	state: string(),
+	/** False when the mode's non-blocking list names this device. */
+	blocking: boolean()
+});
+/** A device the panel is currently ignoring, and which side of it it is on. */
+var NcAlarmExclusionViewSchema = object({
+	deviceId: number().int(),
+	name: string(),
+	phase: _enum(["open", "closed"])
+});
+/** One mode's openings: devices read open, plus those whose state is unknown. */
+var NcAlarmModeOpeningsSchema = object({
+	mode: AlarmArmModeSchema,
+	devices: array(NcAlarmOpeningSchema),
+	/** Covered devices whose state could not be read (D49): neither open nor closed. */
+	unknown: array(number().int())
+});
+var NcAlarmLiveSchema = object({
+	state: AlarmStateSchema,
+	/** The mode being armed into (exit delay) or held; null when disarmed. */
+	targetMode: AlarmArmModeSchema.nullable(),
+	availableModes: array(AlarmArmModeSchema),
+	openings: array(NcAlarmModeOpeningsSchema),
+	exclusions: array(NcAlarmExclusionViewSchema)
+});
 var NcAlarmConfigSchema = object({
 	/**
 	* The panel's device id, or null when this install has no panel (the ensure
@@ -20963,7 +21232,13 @@ var NcAlarmConfigSchema = object({
 	*/
 	deviceId: number().int().nullable(),
 	settings: NcAlarmSettingsSchema,
-	coverage: array(NcAlarmModeCoverageSchema)
+	coverage: array(NcAlarmModeCoverageSchema),
+	/**
+	* The panel as it is NOW — state, what each mode would find open, what is
+	* excluded. Optional: a panel-less hub answers without it, and a client
+	* must not read its absence as "nothing is open".
+	*/
+	live: NcAlarmLiveSchema.optional()
 });
 /**
 * ONE rule's demand on ONE camera's clip ring.
@@ -21011,10 +21286,7 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 	kind: "mutation",
 	auth: "admin",
 	caller: "required"
-}), method(object({
-	ruleId: string(),
-	patch: NcRulePatchSchema
-}), object({ rule: NcRuleSchema }), {
+}), method(NcRuleUpdateInputSchema, object({ rule: NcRuleSchema }), {
 	kind: "mutation",
 	auth: "admin",
 	caller: "required"
@@ -21042,7 +21314,10 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), method(object({}), object({
 	catalog: array(NcConditionDescriptorSchema),
 	taxonomy: NcTaxonomySchema.optional()
-})), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" }), method(object({ artifactId: string().min(1) }), object({ url: string().nullable() }), { auth: "admin" }), method(object({}), object({ snoozes: array(NcSnoozeSchema) }), { caller: "required" }), method(object({ snooze: NcSnoozeInputSchema }), object({ snooze: NcSnoozeSchema }), {
+})), method(object({}), object({ vars: array(NcTemplateVarDescriptorSchema) })), method(NcTemplatePreviewInputSchema, NcTemplatePreviewSchema, {
+	kind: "mutation",
+	access: "view"
+}), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" }), method(object({ artifactId: string().min(1) }), object({ url: string().nullable() }), { auth: "admin" }), method(object({}), object({ snoozes: array(NcSnoozeSchema) }), { caller: "required" }), method(object({ snooze: NcSnoozeInputSchema }), object({ snooze: NcSnoozeSchema }), {
 	kind: "mutation",
 	caller: "required"
 }), method(object({ snoozeId: string() }), object({ success: literal(true) }), {
@@ -25851,6 +26126,7 @@ var CAP_TO_KIND = {
 	"enum-sensor": "enum-sensor",
 	"event-emitter": "device-event",
 	"lock-control": "lock",
+	cover: "cover",
 	switch: "switch",
 	button: "button",
 	doorbell: "doorbell"
@@ -26411,41 +26687,65 @@ var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object(
 method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
-}), string()), method(object({
+}), string(), { auth: "admin" }), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string(),
 	data: _instanceof(Uint8Array)
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
-}), _instanceof(Uint8Array)), method(object({
+}), _instanceof(Uint8Array), { auth: "admin" }), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
-}), boolean()), method(object({
+}), boolean(), { auth: "admin" }), method(object({
 	location: StorageLocationRefSchema,
 	prefix: string().optional()
-}), array(string()).readonly()), method(object({
+}), array(string()).readonly(), { auth: "admin" }), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
-}), _void(), { kind: "mutation" }), method(object({ location: StorageLocationRefSchema }), number().nullable()), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ location: StorageLocationRefSchema }), number().nullable()), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string(),
 	sizeBytes: number().optional()
-}), object({ uploadId: string() }), { kind: "mutation" }), method(object({
+}), object({ uploadId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	uploadId: string(),
 	offset: number(),
 	data: _instanceof(Uint8Array)
-}), _void(), { kind: "mutation" }), method(object({ uploadId: string() }), _void(), { kind: "mutation" }), method(object({ uploadId: string() }), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ uploadId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ uploadId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
 }), object({
 	downloadId: string(),
 	sizeBytes: number()
-}), { kind: "mutation" }), method(object({
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	downloadId: string(),
 	offset: number(),
 	length: number()
-}), _instanceof(Uint8Array)), method(object({ downloadId: string() }), _void(), { kind: "mutation" }), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
+}), _instanceof(Uint8Array), { auth: "admin" }), method(object({ downloadId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
 	createdAt: true,
 	updatedAt: true
 }), StorageLocationSchema, {
@@ -28317,7 +28617,67 @@ var WebrtcLadderDecisionSchema = object({
 	serverSending: boolean().nullable(),
 	/** Epoch ms. The overlay prints its age; a decision from 40 minutes ago
 	*  must not read like one from this second. */
-	at: number()
+	at: number(),
+	/** The broker's own cause when it is finer than `cause` can carry, e.g.
+	*  `trial-revert` (reported as `stall`/`loss` for older consumers). Optional:
+	*  an older server strips it instead of rejecting the answer. */
+	causeDetail: string().optional()
+});
+var WebrtcClimbHoldSchema = object({
+	/** `stall-building` — the client receives ≪ what is sent; `delivery` — the
+	*  current rung is not landing whole; `no-evidence` — no receiver feedback;
+	*  `warming` — healthy, accumulating the streak; `cooldown` — too soon after
+	*  a change; `capacity` — a MEASURED probe below the next rung's bar;
+	*  `try-unclean` — no capacity evidence, and the path is not clean enough to
+	*  try; `try-backoff` — a try reverted, waiting out its backoff; `trial` —
+	*  this rung IS a try, reverting if it does not land; `suspended` —
+	*  recorded playback on the track. */
+	code: string(),
+	/** The rung a climb would go to. */
+	nextTier: CamProfileSchema,
+	/** Bytes received ÷ bytes sent over the delivery window (≥ one GOP). */
+	deliveryRatio: number().nullable(),
+	deliveryWindowMs: number().nullable(),
+	/** The ratio a climb requires. */
+	climbDeliveryRatio: number(),
+	/** The receiver's bandwidth estimate (REMB), kbps. Capped by what is sent. */
+	capacityKbps: number().nullable(),
+	/** The viewer's downlink probe for this session, kbps. */
+	probeKbps: number().nullable(),
+	/** The next rung's measured bitrate, kbps. */
+	nextTierKbps: number().nullable(),
+	capacityMargin: number(),
+	/** The capacity a climb to `nextTier` needs, kbps (bitrate × margin, or the
+	*  client ladder threshold when the rung has measured nothing). */
+	neededKbps: number().nullable(),
+	/** For `try-unclean`: which clean-path condition failed (a `WebrtcTryBlocker`,
+	*  carried as a string for the same reason as `code`). */
+	tryBlockedBy: string().nullable(),
+	/** The delivery ratio and the loss ratio a try requires / must stay under.
+	*  Optional, like every field added to this schema after it first shipped:
+	*  the router validates output, so a REQUIRED new field makes a newer server
+	*  reject an older broker's whole answer (review m1). */
+	tryDeliveryRatio: number().optional(),
+	tryMaxLossRatio: number().optional(),
+	/** For `try-backoff`: time until the next try, ms. */
+	retryInMs: number().nullable(),
+	/** The last try that reverted in this viewer session. */
+	lastRevert: object({
+		tier: CamProfileSchema,
+		deliveryRatio: number().nullable(),
+		stalled: boolean(),
+		at: number()
+	}).nullable(),
+	/** For `trial`: how long this rung has been on trial, and for how long it must hold. */
+	trialForMs: number().nullable(),
+	trialMs: number().nullable(),
+	healthyForMs: number().nullable(),
+	requiredHealthyMs: number().nullable(),
+	/** Epoch ms this hold's code began. */
+	since: number(),
+	/** The same one-line account the broker logs, e.g.
+	*  `held: delivery 0.97 over 4.0s ok, REMB 480 kbps < mid 1800 kbps × 1.2`. */
+	summary: string()
 });
 /** Per-tier count of MEASURED downgrades this viewer session has suffered. */
 var WebrtcTierFailureSchema = object({
@@ -28381,7 +28741,12 @@ var WebrtcSessionDebugSchema = object({
 	tierFailures: array(WebrtcTierFailureSchema),
 	/** Successful promotions in this viewer session (drives the progressive
 	*  healthy timer). Null when no ladder is running. */
-	upgradeCount: number().nullable()
+	upgradeCount: number().nullable(),
+	/** Why the ladder is not climbing right now. Null when no ladder runs, it
+	*  is at the top rung, or it just moved. Optional because this output is
+	*  validated by the router: a server carrying this schema must still accept
+	*  the answer of a stream-broker deployed before the field existed. */
+	climbHold: WebrtcClimbHoldSchema.nullable().optional()
 });
 /**
 * WebRTC session — device-scoped facade over the system `webrtc` cap.
@@ -32262,6 +32627,11 @@ var ClientNetworkStatsSchema = object({
 	jitterMs: number(),
 	estimatedBandwidthKbps: number(),
 	packetLossPercent: number().min(0).max(100),
+	/** The viewer's latest `/adaptive-probe` reading, Mbps — whatever it read
+	*  (D635 I4). Absent when it never probed or the probe failed (unknown). */
+	downlinkMbps: number().optional(),
+	/** Age of that reading when this report was sent, ms. */
+	downlinkAgeMs: number().optional(),
 	lastUpdated: number()
 });
 var DeviceNetworkStatsSchema = object({
@@ -32274,7 +32644,11 @@ method(object({ deviceId: number() }), DeviceNetworkStatsSchema.nullable()), met
 	rttMs: number().min(0).max(6e4),
 	jitterMs: number().min(0).max(1e4),
 	estimatedBandwidthKbps: number().min(0).max(1e6),
-	packetLossPercent: number().min(0).max(100)
+	packetLossPercent: number().min(0).max(100),
+	/** Latest downlink probe, Mbps, whatever it read; absent = never / failed. */
+	downlinkMbps: number().min(0).max(1e5).optional(),
+	/** Age of that probe when this report is sent, ms. */
+	downlinkAgeMs: number().min(0).max(864e5).optional()
 }), _void(), { kind: "mutation" });
 /**
 * nodes — system-scoped singleton capability for cluster topology
@@ -40535,6 +40909,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.listDeviceIdsByCaps": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.listLocationDescriptions": {
 		capName: "device-manager",
 		capScope: "system",
@@ -42341,6 +42721,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.getTemplateCatalog": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.listDeviceMutes": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -42359,6 +42745,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.previewTemplate": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.resolveArtifactUrl": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -47976,6 +48368,41 @@ var NC_AUDIO_DEFAULTS = {
 };
 new Set(["devices", "classes"]);
 NC_AUDIO_DEFAULTS.hitPercent, NC_AUDIO_DEFAULTS.samplingSeconds;
+var RULE_BODY_ONLY = ["body"];
+var RULE_TEXT = ["title", "body"];
+var BATTERY = ["device-battery-low", "device-battery-normal"];
+var CONSUMABLE = ["device-consumable-low", "device-consumable-normal"];
+var UPDATES = [
+	"addon-update-available",
+	"server-update-available",
+	"wrapper-update-available"
+];
+var PACKAGE_UPDATES = ["addon-update-available", "server-update-available"];
+var ALARM = [
+	"alarm-triggered",
+	"alarm-armed",
+	"alarm-disarmed",
+	"alarm-arming",
+	"alarm-arm-refused",
+	"alarm-pending",
+	"alarm-rearmed",
+	"alarm-sensor-bypass",
+	"alarm-check-failed"
+];
+var COMBINED_ALARM = ["alarm-triggered"];
+var DEVICE_EVENTS = [
+	"device-online",
+	"device-offline",
+	"device-disabled",
+	"device-enabled",
+	...BATTERY,
+	...CONSUMABLE,
+	"stream-online",
+	"stream-offline",
+	"detection-blind",
+	...ALARM
+];
+[...DEVICE_EVENTS], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_BODY_ONLY], [...RULE_TEXT], [...RULE_TEXT], [...DEVICE_EVENTS], [...RULE_TEXT], [...DEVICE_EVENTS], [...RULE_TEXT], [...BATTERY, ...CONSUMABLE], [...RULE_TEXT], [...CONSUMABLE], [...RULE_TEXT], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT];
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *