@camstack/addon-post-analysis 1.2.33 → 1.2.35

package/dist/{dist-D3Ht9Ae5.mjs → dist-nh2kuzSC.mjs}

@@ -9432,6 +9432,100 @@ function shallowEqual(a, b) {
 }
 new Set(["devices", "classes"]);
 /**
+* Alarm-panel cap. Models HA `alarm_control_panel.*` on
+* `DeviceType.AlarmPanel`. State follows HA's canonical lifecycle
+* across disarmed / armed_(home|away|night|vacation|custom_bypass) /
+* arming / pending / triggered / disarming.
+*
+* Many panels require a PIN code on arm / disarm — the optional
+* `code` field on the methods passes it through to the upstream
+* service; it's NEVER persisted in the runtime slice or any event
+* payload. The presence of a required code is signalled by
+* `DeviceFeature.AlarmPinRequired` so the UI gates a code-entry
+* field without a slice fetch.
+*
+* `availableModes` mirrors HA's `supported_features`-derived arm
+* mode list — the UI renders only the buttons the panel accepts.
+*/
+var AlarmStateSchema = _enum([
+	"disarmed",
+	"armed_home",
+	"armed_away",
+	"armed_night",
+	"armed_vacation",
+	"armed_custom_bypass",
+	"arming",
+	"disarming",
+	"pending",
+	"triggered"
+]);
+var AlarmArmModeSchema = _enum([
+	"home",
+	"away",
+	"night",
+	"vacation",
+	"custom_bypass"
+]);
+var AlarmPanelStatusSchema = object({
+	/** Current lifecycle state. */
+	state: AlarmStateSchema,
+	/** Subset of arm modes the panel accepts. UI renders one button per
+	*  mode in this list. */
+	availableModes: array(AlarmArmModeSchema),
+	/** Whether the panel requires a PIN on arm / disarm. Mirrors
+	*  `DeviceFeature.AlarmPinRequired` for slice consumers. */
+	requiresCode: boolean(),
+	/** Ms epoch when the slice was last updated. */
+	lastChangedAt: number()
+});
+var alarmPanelCapability = {
+	name: "alarm-panel",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.AlarmPanel],
+	methods: {
+		arm: method(object({
+			deviceId: number().int().nonnegative(),
+			mode: AlarmArmModeSchema,
+			/** Optional PIN code. Required when `requiresCode === true`.
+			*  Passed through to the upstream service; never persisted. */
+			code: string().min(1).optional()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		disarm: method(object({
+			deviceId: number().int().nonnegative(),
+			code: string().min(1).optional()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Force the panel into the `triggered` state — used by HA
+		* automations to surface external sensor events through the panel
+		* (e.g. a Reolink camera intrusion event firing the security
+		* system). Provider rejects when the panel hardware doesn't
+		* support a software-initiated trigger.
+		*/
+		trigger: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: AlarmPanelStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI panel reads the
+	* full slice; renders an arm button per `availableModes` entry and
+	* a PIN field iff `requiresCode === true`.
+	*/
+	runtimeState: AlarmPanelStatusSchema
+};
+/**
 * Shared geometry vocabulary for on-frame shape caps — privacy-mask,
 * motion-zones, and the detection zones/lines editor all speak this one
 * language so a single drawing-plane editor and the providers stay
@@ -9493,6 +9587,276 @@ var MaskGridDimsSchema = object({
 	height: number()
 });
 /**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = _enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: string().optional(),
+	bytes: _instanceof(Uint8Array).optional(),
+	mime: string().optional(),
+	name: string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = _enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/**
+* The CLOSED icon vocabulary an action button may use.
+*
+* A closed set, not a free string, and that is the whole point: an arbitrary
+* icon name is one that ntfy renders, zentik silently drops, and nobody
+* notices — the same class of gap as a zone vocabulary nothing produced
+* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
+* declares `actionIcons: false` and the degrade engine strips the field.
+*
+* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
+* renderer's icon set; "acknowledge" survives an adapter that draws it
+* differently.
+*/
+var NotificationActionIconSchema = _enum([
+	"acknowledge",
+	"dismiss",
+	"silence",
+	"view",
+	"play",
+	"open",
+	"close",
+	"lock",
+	"unlock",
+	"arm",
+	"disarm",
+	"light",
+	"alert"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = object({
+	id: string(),
+	label: string(),
+	url: string().optional(),
+	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
+	icon: NotificationActionIconSchema.optional(),
+	/**
+	* Renders in a warning style where the notifier supports it.
+	*
+	* A HINT, never a gate. The callback's authority is its token and nothing
+	* else — see `notification-center/action-token.ts` for what that does and
+	* does not buy.
+	*/
+	destructive: boolean().optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = object({
+	body: string(),
+	title: string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: number().int().min(1).max(5).default(3),
+	level: string().optional(),
+	attachments: array(AttachmentSchema).optional(),
+	clickUrl: string().optional(),
+	actions: array(NotificationActionSchema).optional(),
+	sound: string().optional(),
+	ttl: number().optional(),
+	tag: string().optional(),
+	deviceId: number().optional(),
+	eventId: string().optional(),
+	metadata: record(string(), unknown()).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = object({
+	id: string(),
+	label: string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: number().int().min(1).max(5).nullable(),
+	flags: object({
+		critical: boolean().optional(),
+		silent: boolean().optional(),
+		noPush: boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: array(string()).optional(),
+	description: string().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = object({
+	attachments: object({
+		mediaTypes: array(AttachmentMediaTypeSchema),
+		mode: _enum([
+			"url",
+			"bytes",
+			"both"
+		]),
+		max: number().int().nonnegative(),
+		maxBytes: number().int().positive().optional()
+	}),
+	/** Max action buttons (0 = none). */
+	actions: number().int().nonnegative(),
+	/**
+	* Whether this kind renders a per-action ICON.
+	*
+	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
+	* run on the addon cap path — three production failures in one day taught
+	* this repo that once. Absent is read as false by the degrade engine, which
+	* is the safe direction: an icon that is not rendered costs nothing, an icon
+	* assumed and dropped costs the operator's trust in the field.
+	*/
+	actionIcons: boolean().optional(),
+	levels: array(TargetKindLevelSchema),
+	format: array(NotificationFormatSchema),
+	clickUrl: boolean(),
+	sound: boolean(),
+	ttl: boolean(),
+	bodyMaxLen: number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough$1 = unknown();
+var TargetKindSchema = object({
+	kind: string(),
+	label: string(),
+	icon: string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: string().optional(),
+	configSchema: ConfigSchemaPassthrough$1,
+	supportsDiscovery: boolean(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = object({
+	id: string(),
+	name: string(),
+	kind: string(),
+	addonId: string(),
+	enabled: boolean(),
+	config: record(string(), unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = object({
+	kind: string(),
+	suggestedName: string(),
+	config: record(string(), unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = object({
+	level: string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: number().int().nonnegative(),
+	actionsSent: number().int().nonnegative(),
+	truncated: boolean(),
+	dropped: array(string())
+});
+var SendResultSchema = object({
+	success: boolean(),
+	error: string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema)), method(object({
+	kind: string(),
+	config: record(string(), unknown()).optional()
+}), array(DiscoveredTargetSchema)), method(object({
+	targetId: string(),
+	notification: NotificationSchema
+}), SendResultSchema, { kind: "mutation" }), method(object({
+	targetId: string(),
+	sample: NotificationSchema.optional()
+}), TestResultSchema, { kind: "mutation" }), method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }), method(object({ targetId: string() }), _void(), { kind: "mutation" }), method(object({
+	targetId: string(),
+	enabled: boolean()
+}), _void(), { kind: "mutation" });
+/**
 * notification-rules — the Notification Center rule surface (P1 core).
 *
 * Spec: `docs/superpowers/specs/2026-07-22-notification-center-requirements.md`
@@ -9662,6 +10026,41 @@ var NcRuleActionSchema = discriminatedUnion("kind", [object({
 	args: record(string(), unknown()).optional()
 })]);
 /**
+* A named, ordered run of steps with its own throttle.
+*
+* `minDelaySec` exists because a noisy rule otherwise hammers a physical
+* actuator — the rule's own cooldown governs NOTIFICATIONS, which is a
+* different budget from "how often may this gate actually open".
+*/
+var NcRuleActionSequenceSchema = object({
+	name: string().min(1).max(120),
+	enabled: boolean(),
+	minDelaySec: number().int().min(0).max(86400).optional(),
+	actions: array(NcRuleActionSchema).min(1)
+});
+/**
+* One button carried by the notification, running a named sequence on tap.
+*
+* **Read this before adding a button that does something physical.** The tap
+* arrives over a link that travelled through third-party infrastructure — ntfy,
+* a push relay, whatever forwarded the message — and the callback's ONLY
+* authority is the token in that link: single-use, short-lived, bound to this
+* one action of this one notification. It does not identify who tapped.
+* Whoever holds the notification can run the button, once, inside the window.
+* That is the operator's explicit choice (2026-08-05), and `destructive` is a
+* rendering hint, not a second gate. [D47](decisions/adr-0047.md).
+*/
+var NcRuleNotificationButtonSchema = object({
+	/** Stable id — travels in the callback and identifies the button in logs. */
+	id: string().min(1).max(64),
+	label: string().min(1).max(40),
+	/** Name of a sequence in `onTrigger`. The dispatcher drops a button whose
+	*  sequence does not exist rather than minting a token for nothing. */
+	sequence: string().min(1).max(120),
+	icon: NotificationActionIconSchema.optional(),
+	destructive: boolean().optional()
+});
+/**
 * Sequences a rule runs, by hook point.
 *
 * ONLY `onTrigger` is here, deliberately. The reference also has activation /
@@ -9669,14 +10068,26 @@ var NcRuleActionSchema = discriminatedUnion("kind", [object({
 * repo's expensive failure mode is declaring a surface nothing produces, so a
 * hook appears here in the same change that produces its edge, never before.
 */
-var NcRuleActionsSchema = object({ 
-/** Runs when the rule MATCHES. */
-onTrigger: array(object({
-	name: string().min(1).max(120),
-	enabled: boolean(),
-	minDelaySec: number().int().min(0).max(86400).optional(),
-	actions: array(NcRuleActionSchema).min(1)
-})).optional() });
+var NcRuleActionsSchema = object({
+	/** Runs when the rule MATCHES. */
+	onTrigger: array(NcRuleActionSequenceSchema).optional(),
+	/**
+	* Buttons the NOTIFICATION carries, each running one of this rule's
+	* sequences when tapped.
+	*
+	* Deliberately a REFERENCE to a sequence rather than a second place to
+	* author steps. A button that could define its own actions would be a
+	* parallel actuation vocabulary — the executor's device-scope check, the
+	* stop-at-first-failure rule and the per-sequence throttle all live on
+	* sequences, and a second authoring surface would drift from every one of
+	* them.
+	*
+	* A sequence reachable ONLY by a button simply appears in `onTrigger` with
+	* `enabled: false`: it is then authored, throttled and validated like the
+	* rest, and nothing runs it automatically.
+	*/
+	buttons: array(NcRuleNotificationButtonSchema).max(8).optional()
+});
 var NcConditionsSchema = object({
 	/** Gate on ANOTHER device's current state (the alarm armed, a switch on). */
 	deviceState: object({
@@ -10103,7 +10514,7 @@ var NC_CONDITION_CATALOG = [
 	{
 		id: "devices",
 		group: "scope",
-		label: "Cameras",
+		label: "Devices",
 		valueType: "deviceIdList",
 		operator: "in",
 		appliesTo: [
@@ -10113,7 +10524,7 @@ var NC_CONDITION_CATALOG = [
 			"package-event"
 		],
 		phase: "P1",
-		description: "Restrict the rule to these devices; absent = all devices."
+		description: "Restrict the rule to these devices; absent = all devices. A sensor event matches either the SENSOR that fired or the camera it is attributed to, so a rule may name either one."
 	},
 	{
 		id: "classes",
@@ -10568,6 +10979,67 @@ var NcSnoozeSuppressedSchema = object({
 	firstAt: number(),
 	lastAt: number()
 });
+/**
+* The three durations the panel's state machine runs on, plus who hears about
+* an arm.
+*
+* They live on the NOTIFICATION-RULES cap, not on `alarm-panel`, on purpose:
+* `alarm-panel` is `deviceNative` and its other provider mirrors somebody
+* else's panel, which has its own delays and no way to be told these. This is
+* configuration of the panel CamStack owns, and the Notification Center owns
+* that panel.
+*/
+var NcAlarmSettingsSchema = object({
+	/** Grace period between arming and the mode taking effect. 0 = immediate. */
+	exitDelaySec: number().int().min(0).max(600),
+	/** Grace period between a trigger and the alarm firing. 0 = immediate. */
+	entryDelaySec: number().int().min(0).max(600),
+	/**
+	* How long `triggered` lasts before the panel re-arms itself.
+	* **0 = until an operator disarms it** — the behaviour before this field
+	* existed, and therefore what an untouched install keeps doing.
+	*/
+	triggeredDurationSec: number().int().min(0).max(3600),
+	/** Send a notification when a mode takes effect. */
+	announceArm: boolean(),
+	/**
+	* Where that notification goes. Target ids from `notification-output`.
+	*
+	* Explicit rather than "everyone": an arm announcement is a household
+	* message, and broadcasting it to every configured endpoint (including a
+	* webhook wired to something else) is not a default anybody would choose.
+	* Empty with `announceArm: true` sends nothing, and the server logs that —
+	* silence must be attributable.
+	*/
+	announceTargets: array(string().min(1)).max(16)
+});
+/** Every field optional — a tab edits one control at a time. */
+var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.partial();
+/**
+* What one arm mode actually arms, DERIVED from the enabled rules gated on it.
+* Never authored, never stored — see `alarm-mode-coverage.ts` for why a stored
+* copy would lie the first time a rule is disabled.
+*/
+var NcAlarmModeCoverageSchema = object({
+	mode: AlarmArmModeSchema,
+	/** Enabled rules gated on `armed_<mode>`. Zero means the mode does nothing. */
+	ruleCount: number().int().min(0),
+	/** At least one covering rule has no device scope, so the mode covers all. */
+	allDevices: boolean(),
+	/** Ids named by the covering rules. A SUBSET when `allDevices` is true. */
+	deviceIds: array(number().int())
+});
+var NcAlarmConfigSchema = object({
+	/**
+	* The panel's device id, or null when this install has no panel (the ensure
+	* step failed, or this is not the hub). Null is the honest answer: an editor
+	* that rendered delays for a panel that does not exist would be a form whose
+	* Save does nothing.
+	*/
+	deviceId: number().int().nullable(),
+	settings: NcAlarmSettingsSchema,
+	coverage: array(NcAlarmModeCoverageSchema)
+});
 var notificationRulesCapability = {
 	name: "notification-rules",
 	scope: "system",
@@ -10663,6 +11135,26 @@ var notificationRulesCapability = {
 		cancelSnooze: method(object({ snoozeId: string() }), object({ success: literal(true) }), {
 			kind: "mutation",
 			caller: "required"
+		}),
+		/**
+		* The alarm panel's durations, plus what each mode ACTUALLY arms.
+		*
+		* Coverage is returned by the same call as the settings on purpose: they
+		* are read together or not at all. An editor that showed the delays
+		* without the coverage would let an operator tune an exit delay for a mode
+		* that arms nothing, which is the failure this whole surface exists to
+		* make visible.
+		*/
+		getAlarmConfig: method(object({}), NcAlarmConfigSchema, { auth: "admin" }),
+		/**
+		* Patch the durations. Returns the WHOLE config, coverage included, so a
+		* client never has to guess what the server settled on — the panel clamps
+		* and normalises, and a form that re-rendered from its own input would
+		* show a value the alarm is not using.
+		*/
+		setAlarmConfig: method(object({ patch: NcAlarmSettingsPatchSchema }), NcAlarmConfigSchema, {
+			kind: "mutation",
+			auth: "admin"
 		})
 	}
 };
@@ -10908,116 +11400,22 @@ var AirQualitySensorStatusSchema = object({
 	unit: string().optional(),
 	/** Suggested decimal places for numeric display.
 	*  Populated live from the upstream source when provided (e.g. HA
-	*  `attributes.suggested_display_precision`). Falls back to
-	*  auto-formatting when absent. */
-	precision: number().int().min(0).max(10).optional()
-});
-var airQualitySensorCapability = {
-	name: "air-quality-sensor",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	deviceTypes: [DeviceType.Sensor],
-	methods: {},
-	status: {
-		schema: AirQualitySensorStatusSchema,
-		kind: "push"
-	},
-	runtimeState: AirQualitySensorStatusSchema
-};
-/**
-* Alarm-panel cap. Models HA `alarm_control_panel.*` on
-* `DeviceType.AlarmPanel`. State follows HA's canonical lifecycle
-* across disarmed / armed_(home|away|night|vacation|custom_bypass) /
-* arming / pending / triggered / disarming.
-*
-* Many panels require a PIN code on arm / disarm — the optional
-* `code` field on the methods passes it through to the upstream
-* service; it's NEVER persisted in the runtime slice or any event
-* payload. The presence of a required code is signalled by
-* `DeviceFeature.AlarmPinRequired` so the UI gates a code-entry
-* field without a slice fetch.
-*
-* `availableModes` mirrors HA's `supported_features`-derived arm
-* mode list — the UI renders only the buttons the panel accepts.
-*/
-var AlarmStateSchema = _enum([
-	"disarmed",
-	"armed_home",
-	"armed_away",
-	"armed_night",
-	"armed_vacation",
-	"armed_custom_bypass",
-	"arming",
-	"disarming",
-	"pending",
-	"triggered"
-]);
-var AlarmArmModeSchema = _enum([
-	"home",
-	"away",
-	"night",
-	"vacation",
-	"custom_bypass"
-]);
-var AlarmPanelStatusSchema = object({
-	/** Current lifecycle state. */
-	state: AlarmStateSchema,
-	/** Subset of arm modes the panel accepts. UI renders one button per
-	*  mode in this list. */
-	availableModes: array(AlarmArmModeSchema),
-	/** Whether the panel requires a PIN on arm / disarm. Mirrors
-	*  `DeviceFeature.AlarmPinRequired` for slice consumers. */
-	requiresCode: boolean(),
-	/** Ms epoch when the slice was last updated. */
-	lastChangedAt: number()
-});
-var alarmPanelCapability = {
-	name: "alarm-panel",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	deviceTypes: [DeviceType.AlarmPanel],
-	methods: {
-		arm: method(object({
-			deviceId: number().int().nonnegative(),
-			mode: AlarmArmModeSchema,
-			/** Optional PIN code. Required when `requiresCode === true`.
-			*  Passed through to the upstream service; never persisted. */
-			code: string().min(1).optional()
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		disarm: method(object({
-			deviceId: number().int().nonnegative(),
-			code: string().min(1).optional()
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Force the panel into the `triggered` state — used by HA
-		* automations to surface external sensor events through the panel
-		* (e.g. a Reolink camera intrusion event firing the security
-		* system). Provider rejects when the panel hardware doesn't
-		* support a software-initiated trigger.
-		*/
-		trigger: method(object({ deviceId: number().int().nonnegative() }), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
-	},
+	*  `attributes.suggested_display_precision`). Falls back to
+	*  auto-formatting when absent. */
+	precision: number().int().min(0).max(10).optional()
+});
+var airQualitySensorCapability = {
+	name: "air-quality-sensor",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
 	status: {
-		schema: AlarmPanelStatusSchema,
+		schema: AirQualitySensorStatusSchema,
 		kind: "push"
 	},
-	/**
-	* Runtime-state slice — mirrored by the kernel. UI panel reads the
-	* full slice; renders an arm button per `availableModes` entry and
-	* a PIN field iff `requiresCode === true`.
-	*/
-	runtimeState: AlarmPanelStatusSchema
+	runtimeState: AirQualitySensorStatusSchema
 };
 /**
 * Ambient illuminance reading in lux. Drives Home Assistant `sensor`
@@ -18468,6 +18866,20 @@ var GetInputSchema = object({ id: string() });
 var AddInputSchema = object({
 	kind: string().min(1),
 	name: string().min(1),
+	/**
+	* ADOPT an existing id instead of minting a new one.
+	*
+	* Written the day this cost an outage. A broker's id is not a detail: HA
+	* devices carry it inside their `stableId` (`ha:ha_004:dev:…`), so a broker
+	* lost from config and re-added as `ha_001` leaves every one of its devices
+	* bound to a broker that no longer exists. Re-entering the password under the
+	* ORIGINAL id turns a multi-step device migration back into re-entering a
+	* password.
+	*
+	* A provider MUST refuse an id that is already in use — adopting a live
+	* broker's id would silently take it over.
+	*/
+	id: string().min(1).optional(),
 	/** Kind-specific settings (e.g. MQTT `{url,username,password}` or HA
 	*  `{baseUrl,accessToken}`). Validated by the kind-specific provider
 	*  branch on receipt — invalid shape rejects the add. */
@@ -20001,14 +20413,14 @@ var LlmProfileSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$1 = unknown();
+var ConfigSchemaPassthrough = unknown();
 var LlmProfileKindDescriptorSchema = object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
-	configSchema: ConfigSchemaPassthrough$1
+	configSchema: ConfigSchemaPassthrough
 });
 var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
 var LlmDefaultSchema = object({
@@ -20539,228 +20951,6 @@ var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
 });
 method(_void(), NetworkEndpointSchema, { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), NetworkEndpointSchema.nullable()), method(_void(), NetworkAccessStatusSchema), method(_void(), array(NetworkEndpointEntrySchema).readonly());
 /**
-* notification-output — canonical, capability-gated notification delivery.
-*
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
-*
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
-*
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = _enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: string().optional(),
-	bytes: _instanceof(Uint8Array).optional(),
-	mime: string().optional(),
-	name: string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = _enum([
-	"text",
-	"markdown",
-	"html"
-]);
-/** A single tap-through action button. */
-var NotificationActionSchema = object({
-	id: string(),
-	label: string(),
-	url: string().optional()
-});
-/**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
-*/
-var NotificationSchema = object({
-	body: string(),
-	title: string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: number().int().min(1).max(5).default(3),
-	level: string().optional(),
-	attachments: array(AttachmentSchema).optional(),
-	clickUrl: string().optional(),
-	actions: array(NotificationActionSchema).optional(),
-	sound: string().optional(),
-	ttl: number().optional(),
-	tag: string().optional(),
-	deviceId: number().optional(),
-	eventId: string().optional(),
-	metadata: record(string(), unknown()).optional()
-});
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = object({
-	id: string(),
-	label: string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: number().int().min(1).max(5).nullable(),
-	flags: object({
-		critical: boolean().optional(),
-		silent: boolean().optional(),
-		noPush: boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: array(string()).optional(),
-	description: string().optional()
-});
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = object({
-	attachments: object({
-		mediaTypes: array(AttachmentMediaTypeSchema),
-		mode: _enum([
-			"url",
-			"bytes",
-			"both"
-		]),
-		max: number().int().nonnegative(),
-		maxBytes: number().int().positive().optional()
-	}),
-	/** Max action buttons (0 = none). */
-	actions: number().int().nonnegative(),
-	levels: array(TargetKindLevelSchema),
-	format: array(NotificationFormatSchema),
-	clickUrl: boolean(),
-	sound: boolean(),
-	ttl: boolean(),
-	bodyMaxLen: number().int().positive()
-});
-/**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
-*/
-var ConfigSchemaPassthrough = unknown();
-var TargetKindSchema = object({
-	kind: string(),
-	label: string(),
-	icon: string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: string(),
-	/**
-	* URL of the kind's bundled BRAND icon, served by the providing addon over
-	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
-	* when the addon bundles no icon for that kind — the client then falls back
-	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
-	*
-	* Root-relative on purpose: it resolves against whatever origin serves a web
-	* client, and a native client joins it onto its own hub base.
-	*
-	* DECLARED here deliberately. It used to travel as an undeclared passthrough
-	* field that survived only because the runtime cap-router forwards provider
-	* output verbatim — so every consumer had to re-declare it by hand to stop
-	* its own Zod parse from stripping it, and the whole arrangement would have
-	* broken silently the moment output validation was tightened anywhere.
-	*/
-	iconUrl: string().optional(),
-	/**
-	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
-	*
-	* The server knows this and therefore says it, because the client cannot
-	* safely guess: a React-Native client renders SVG and raster through two
-	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
-	* not decode SVG on iOS/Android), so without this it silently fell back to a
-	* placeholder glyph for every vector icon while the web build looked fine.
-	*
-	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
-	* not been updated — a client that cannot determine the type should prefer
-	* its raster path, which is the safe default for an unknown image.
-	*/
-	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough,
-	supportsDiscovery: boolean(),
-	caps: TargetKindCapsSchema
-});
-/**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
-*/
-var TargetSchema = object({
-	id: string(),
-	name: string(),
-	kind: string(),
-	addonId: string(),
-	enabled: boolean(),
-	config: record(string(), unknown())
-});
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = object({
-	kind: string(),
-	suggestedName: string(),
-	config: record(string(), unknown())
-});
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = object({
-	level: string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: number().int().nonnegative(),
-	actionsSent: number().int().nonnegative(),
-	truncated: boolean(),
-	dropped: array(string())
-});
-var SendResultSchema = object({
-	success: boolean(),
-	error: string().optional(),
-	renderedAs: RenderedAsSchema.optional()
-});
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema)), method(object({
-	kind: string(),
-	config: record(string(), unknown()).optional()
-}), array(DiscoveredTargetSchema)), method(object({
-	targetId: string(),
-	notification: NotificationSchema
-}), SendResultSchema, { kind: "mutation" }), method(object({
-	targetId: string(),
-	sample: NotificationSchema.optional()
-}), TestResultSchema, { kind: "mutation" }), method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }), method(object({ targetId: string() }), _void(), { kind: "mutation" }), method(object({
-	targetId: string(),
-	enabled: boolean()
-}), _void(), { kind: "mutation" });
-/**
 * core-blocks — user-authored TypeScript, stored in the kernel and executed in
 * its own process.
 *
@@ -28469,6 +28659,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"notificationRules.getAlarmConfig": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.getConditionCatalog": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -28499,6 +28695,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.setAlarmConfig": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.setRuleEnabled": {
 		capName: "notification-rules",
 		capScope: "system",