@camstack/addon-provider-amcrest 0.2.120 → 0.2.121

package/dist/addon.mjs

@@ -5374,7 +5374,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-PEo0-Fz9.mjs
+//#region ../types/dist/sleep-D_4W7xuQ.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7355,11 +7355,17 @@ var RawStateResultSchema = object({
 method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(object({ deviceId: number() }), array(ConfigEntrySchema$1)), method(object({
 	deviceId: number(),
 	values: record(string(), unknown())
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	deviceId: number(),
 	action: string().min(1),
 	input: unknown()
-}), unknown(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
+}), unknown(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
 new Set([
 	"track",
 	"summary",
@@ -11583,7 +11589,7 @@ method(ListInputSchema, array(BrokerInfoSchema$1)), method(GetInputSchema, Broke
 }), method(UnsubscribeInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(GetStateInputSchema, unknown().nullable()), method(_void(), RegistryStatusSchema);
+}), method(GetStateInputSchema, unknown().nullable(), { auth: "admin" }), method(_void(), RegistryStatusSchema);
 DeviceType.Camera;
 /** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
 var StreamFormatSchema = _enum([
@@ -12766,17 +12772,20 @@ method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string()
-}), unknown()), method(object({
+}), unknown(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string(),
 	value: unknown()
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: QueryFilterSchema.optional(),
 	columns: array(string()).readonly().optional()
-}), array(SettingsRecordSchema).readonly()), method(object({
+}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	/** Declared columns identifying the slot; must be covered by a UNIQUE
@@ -12786,7 +12795,10 @@ method(object({
 }), object({ 
 /** The id the row HAS: assigned by SQLite on an insert, or the existing
 *  row's own id on an update. */
-id: union([string(), number()]) }), { kind: "mutation" }), method(object({
+id: union([string(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	record: object({
@@ -12799,38 +12811,56 @@ id: union([string(), number()]) }), { kind: "mutation" }), method(object({
 * for an absent one, or the ROWID SQLite assigned on an `INTEGER`
 * primary key — which is the only place an auto key is knowable.
 */
-id: union([string(), number()]) }), { kind: "mutation" }), method(object({
+id: union([string(), number()]) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	records: array(BulkRecordSchema).readonly()
-}), object({ inserted: number().int() }), { kind: "mutation" }), method(object({
+}), object({ inserted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	id: string(),
 	data: record(string(), unknown())
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string()
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: MutationFilterSchema
-}), object({ deleted: number().int() }), { kind: "mutation" }), method(object({
+}), object({ deleted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: MutationFilterSchema,
 	data: record(string(), unknown())
-}), object({ updated: number().int() }), { kind: "mutation" }), method(object({
+}), object({ updated: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: QueryFilterSchema.optional()
-}), number()), method(object({
+}), number(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	fields: array(AggregateFieldSchema).readonly(),
 	filter: QueryFilterSchema.optional()
-}), AggregateResultSchema), method(object({
+}), AggregateResultSchema, { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -12840,15 +12870,18 @@ id: union([string(), number()]) }), { kind: "mutation" }), method(object({
 }), array(object({
 	bucket: number().int(),
 	count: number().int()
-})).readonly()), method(object({
+})).readonly(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string()
-}), boolean()), method(object({
+}), boolean(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	columns: array(CollectionColumnSchema).readonly(),
 	indexes: array(CollectionIndexSchema).readonly().optional()
-}), _void(), { kind: "mutation" });
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * What one engine says about itself. The orchestrator uses `kind` to pick
 * a registrant for a collection; `engineId` is what a log line names when
@@ -13752,7 +13785,13 @@ var ExposeInputSchema = object({
 	capabilities: array(string()).optional()
 });
 var UnexposeInputSchema = object({ deviceId: string() });
-method(_void(), DeviceExportStatusSchema), method(_void(), array(DeviceKindSchema)), method(_void(), array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), { kind: "mutation" }), method(UnexposeInputSchema, _void(), { kind: "mutation" });
+method(_void(), DeviceExportStatusSchema), method(_void(), array(DeviceKindSchema)), method(_void(), array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(UnexposeInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /** Wire/storage schema for one icon id. */
 var LocationIconIdSchema = _enum([
 	"map-pin",
@@ -14337,7 +14376,10 @@ method(object({
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 12 * 6e4
-}), method(DeviceRegisterPayloadSchema, _void(), { kind: "mutation" }), method(DeviceRemovePayloadSchema, _void(), { kind: "mutation" }), method(DevicePersistConfigPayloadSchema, _void(), { kind: "mutation" }), method(object({ deviceId: number() }), record(string(), unknown())), method(object({ deviceId: number() }), record(string(), unknown())), method(object({ deviceId: number() }), DeviceMetaSchema.nullable()), method(object({
+}), method(DeviceRegisterPayloadSchema, _void(), { kind: "mutation" }), method(DeviceRemovePayloadSchema, _void(), { kind: "mutation" }), method(DevicePersistConfigPayloadSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number() }), record(string(), unknown()), { auth: "admin" }), method(object({ deviceId: number() }), record(string(), unknown()), { auth: "admin" }), method(object({ deviceId: number() }), DeviceMetaSchema.nullable()), method(object({
 	deviceId: number(),
 	name: string()
 }), _void(), {
@@ -14542,7 +14584,7 @@ method(object({
 }), method(object({ deviceId: number() }), array(StreamProbeResultSchema), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceId: number() }), DeviceBindingsForDeviceSchema), method(object({ deviceIds: array(number()) }), array(DeviceBindingsForDeviceSchema)), method(object({}), array(DeviceBindingsForDeviceSchema)), method(object({
+}), method(object({ deviceId: number() }), DeviceBindingsForDeviceSchema), method(object({ deviceIds: array(number()) }), array(DeviceBindingsForDeviceSchema)), method(object({}), array(DeviceBindingsForDeviceSchema)), method(object({ capNames: array(string().min(1)).min(1).max(16) }), array(number())), method(object({
 	deviceId: number(),
 	capName: string(),
 	wrapperAddonId: string(),
@@ -14897,18 +14939,30 @@ var LlmErrorCodeSchema = _enum([
 	"budget-exceeded",
 	"adapter-error"
 ]);
-var LlmGenerateResultSchema = discriminatedUnion("ok", [object({
+var LlmGenerateOkSchema = object({
 	ok: literal(true),
 	text: string(),
 	model: string(),
 	usage: LlmUsageSchema,
 	truncated: boolean(),
 	latencyMs: number()
-}), object({
+});
+/**
+* WHO refused, on a `refusal`. `guardrail` = a safety filter in front of the
+* model rejected the request before it answered (Apple Foundation Models
+* refuses surveillance-framed prompts in 0.1 s); `model` = the model itself
+* declined. They are different faults: a guardrail refusal is a property of
+* the BACKEND, so the provider falls back to the next profile; a model refusal
+* is an answer. Absent on every other code, and on a refusal a wire cannot
+* attribute.
+*/
+var LlmRefusalSourceSchema = _enum(["guardrail", "model"]);
+var LlmGenerateResultSchema = discriminatedUnion("ok", [LlmGenerateOkSchema, object({
 	ok: literal(false),
 	code: LlmErrorCodeSchema,
 	message: string(),
-	retryAfterMs: number().optional()
+	retryAfterMs: number().optional(),
+	refusalSource: LlmRefusalSourceSchema.optional()
 })]);
 /**
 * `Uint8Array` is the sanctioned binary convention — superjson + the UDS
@@ -15138,12 +15192,78 @@ var LlmRuntimeDiskUsageSchema = object({
 	modelsBytes: number(),
 	freeBytes: number().optional()
 });
-method(LlmGenerateBaseInputSchema.extend({
+var LlmRuntimeCompleteInputSchema = LlmGenerateBaseInputSchema.extend({
 	images: array(LlmImageSchema).optional(),
 	runtime: ManagedRuntimeConfigSchema,
 	/** The managed profile's timeout, threaded by the hub provider. */
 	timeoutMs: number().int().positive().optional()
-}), LlmGenerateResultSchema, {
+});
+/**
+* Why Apple Foundation Models cannot run on a node that has it in principle.
+* The first three are Apple's own `UnavailableReason`s, verbatim; the rest are
+* ours: the OS predates the framework (macOS < 26), the helper binary is not
+* in the installed addon, or it crashed past the respawn bound.
+*/
+var AppleFmUnavailableReasonSchema = _enum([
+	"deviceNotEligible",
+	"appleIntelligenceNotEnabled",
+	"modelNotReady",
+	"osTooOld",
+	"helperMissing",
+	"helperCrashed"
+]);
+/**
+* Apple Foundation Models on ONE node — four states, never a boolean (D315).
+*
+*   - `available`            — the helper probed it; what it CAN do is reported
+*                              here (`imageInput`, `contextSize`, languages),
+*                              never typed by an operator.
+*   - `unavailable`          — a known absence, with the reason to act on.
+*   - `unsupported-platform` — not a Mac; there is nothing to enable.
+*   - `unknown`              — the probe did not answer (not yet run, timed
+*                              out, helper crashed mid-probe). A failed
+*                              measurement is NEVER `unavailable` (D393).
+*/
+var AppleFmAvailabilitySchema = discriminatedUnion("state", [
+	object({
+		state: literal("available"),
+		osVersion: string(),
+		/** Tokens, as the framework reports it. Read at runtime, never assumed. */
+		contextSize: number().int().positive(),
+		/** BCP-47-ish tags (`it-IT`) of the languages the model supports. */
+		languages: array(string()),
+		/** Whether prompts may carry images. `false` on a macOS 26 build. */
+		imageInput: boolean()
+	}),
+	object({
+		state: literal("unavailable"),
+		reason: AppleFmUnavailableReasonSchema,
+		osVersion: string().nullable(),
+		detail: string()
+	}),
+	object({
+		state: literal("unsupported-platform"),
+		platform: string()
+	}),
+	object({
+		state: literal("unknown"),
+		error: string()
+	})
+]);
+/**
+* A generation on the node's Apple Foundation Models helper. A separate verb
+* from `complete`, whose `runtime` is a llama.cpp config: overloading it would
+* drag a GGUF model reference into a backend that has none. `images` is part
+* of the contract so vision needs no cap change later; a node whose model has
+* no image input REFUSES them (`unavailable`), never drops them.
+*/
+var LlmRuntimeAppleCompleteInputSchema = LlmGenerateBaseInputSchema.extend({
+	images: array(LlmImageSchema).optional(),
+	/** The profile's timeout, threaded by the hub provider. */
+	timeoutMs: number().int().positive().optional()
+});
+var LlmRuntimeCancelInputSchema = object({ requestId: string() });
+method(LlmRuntimeCompleteInputSchema, LlmGenerateResultSchema, {
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: AI_CAP_TRANSPORT_TIMEOUT_MS
@@ -15161,7 +15281,14 @@ method(LlmGenerateBaseInputSchema.extend({
 }), method(object({ file: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), array(LlmNodeModelSchema), { auth: "admin" }), method(object({}), LlmRuntimeDiskUsageSchema, { auth: "admin" });
+}), method(object({}), array(LlmNodeModelSchema), { auth: "admin" }), method(object({}), LlmRuntimeDiskUsageSchema, { auth: "admin" }), method(LlmRuntimeCancelInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), AppleFmAvailabilitySchema, { auth: "admin" }), method(LlmRuntimeAppleCompleteInputSchema, LlmGenerateResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: AI_CAP_TRANSPORT_TIMEOUT_MS
+});
 /**
 * `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
 * methods concat-fan across providers; single-row methods route to ONE
@@ -15178,7 +15305,8 @@ var LlmProfileKindSchema = _enum([
 	"openai",
 	"anthropic",
 	"google",
-	"managed-local"
+	"managed-local",
+	"apple-foundation"
 ]);
 var LlmProfileSchema = object({
 	id: string(),
@@ -15236,7 +15364,14 @@ var LlmProfileSchema = object({
 	toolsEnabled: boolean().default(false),
 	extraHeaders: record(string(), string()).optional(),
 	/** kind === 'managed-local' only (spec §4). */
-	runtime: ManagedRuntimeConfigSchema.optional()
+	runtime: ManagedRuntimeConfigSchema.optional(),
+	/**
+	* kind === 'apple-foundation' only: WHERE it runs — the only thing there is
+	* to configure (no key, no URL, no download; `model` is `apple-system`).
+	* `supportsVision` on such a row is stamped by the provider from the node's
+	* reported `imageInput`, never taken from the operator (D62).
+	*/
+	appleFoundation: object({ nodeId: string() }).optional()
 });
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
@@ -15318,7 +15453,9 @@ var LlmRuntimeNodeSchema = object({
 	reachable: boolean(),
 	status: LlmRuntimeStatusSchema.optional(),
 	disk: LlmRuntimeDiskUsageSchema.optional(),
-	error: string().optional()
+	error: string().optional(),
+	/** Absent = the node did not answer the question (render as unknown). */
+	apple: AppleFmAvailabilitySchema.optional()
 });
 var GenerateVisionInputSchema = LlmGenerateBaseInputSchema.extend({ images: array(LlmImageSchema).min(1) });
 var ProfileRefInputSchema = object({
@@ -16089,7 +16226,22 @@ var StatusSchema = object({
 	brokerCount: number(),
 	embeddedRunning: boolean()
 });
-method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema), method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(IdInputSchema, TestResultSchema$1, { kind: "mutation" }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(_void(), StatusSchema);
+method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }), method(AddBrokerInputSchema, AddBrokerResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(IdInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(IdInputSchema, TestResultSchema$1, {
+	kind: "mutation",
+	auth: "admin"
+}), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(IdInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), StatusSchema);
 var NetworkEndpointSchema = object({
 	url: string(),
 	hostname: string(),
@@ -16384,6 +16536,18 @@ var TargetKindSchema = object({
 	*/
 	iconMediaType: string().optional(),
 	configSchema: ConfigSchemaPassthrough,
+	/**
+	* The config keys that decide WHERE this kind's secrets are sent (server,
+	* base URL, instance, chat, recipient). A save that changes any of them
+	* while leaving a secret redacted is refused by the provider (D634), so an
+	* editor uses this to ask for the secret on exactly those edits instead of
+	* on every edit.
+	*
+	* Optional: absent from a provider that holds no secret (the Home Assistant
+	* kinds) and from a provider older than this field — an editor that finds
+	* it absent must assume ANY edit may need the secret.
+	*/
+	destinationKeys: array(string()).optional(),
 	supportsDiscovery: boolean(),
 	caps: TargetKindCapsSchema
 });
@@ -16422,19 +16586,34 @@ var SendResultSchema = object({
 });
 /** Same shape as SendResult — kept as a distinct name for the test panel. */
 var TestResultSchema = SendResultSchema;
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema)), method(object({
+method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({
 	kind: string(),
 	config: record(string(), unknown()).optional()
-}), array(DiscoveredTargetSchema)), method(object({
+}), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
 	targetId: string(),
 	notification: NotificationSchema
-}), SendResultSchema, { kind: "mutation" }), method(object({
+}), SendResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	targetId: string(),
 	sample: NotificationSchema.optional()
-}), TestResultSchema, { kind: "mutation" }), method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }), method(object({ targetId: string() }), _void(), { kind: "mutation" }), method(object({
+}), TestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ target: TargetSchema }), TargetSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ targetId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	targetId: string(),
 	enabled: boolean()
-}), _void(), { kind: "mutation" });
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 new Set([
 	{
 		id: "person",
@@ -16955,6 +17134,7 @@ sub("presence", "sensor", "sensor", "#22c55e", "presence", "Presence");
 sub("enum-sensor", "sensor", "sensor", TAXONOMY_COLORS.sensor, "generic", "Sensor state");
 sub("device-event", "sensor", "sensor", "#10b981", "button", "Device event");
 sub("lock", "control", "control", "#0ea5e9", "lock", "Lock");
+sub("cover", "control", "control", "#0ea5e9", "door", "Cover");
 sub("switch", "control", "control", TAXONOMY_COLORS.control, "switch", "Switch");
 sub("siren", "control", "control", "#dc2626", "siren", "Siren");
 sub("button", "control", "control", "#10b981", "button", "Button");
@@ -17273,6 +17453,10 @@ var NcSystemEventKindSchema = _enum([
 	"alarm-disarmed",
 	"alarm-arming",
 	"alarm-arm-refused",
+	"alarm-pending",
+	"alarm-rearmed",
+	"alarm-sensor-bypass",
+	"alarm-check-failed",
 	"addon-updated",
 	"server-updated",
 	"export-completed",
@@ -17310,6 +17494,19 @@ var NcSystemEventConditionSchema = object({
 	* does not carry) matches no `deviceTypes` list.
 	*/
 	deviceTypes: array(string().min(1)).min(1).optional(),
+	/**
+	* Devices this rule NEVER speaks about, whatever else matched. Scoped to the
+	* same kind family as `deviceIds` (`systemEventFilterApplies(kind,
+	* 'deviceIds')`) and applied AFTER it: include first, then exclude. A
+	* consumable subject (`consumable:<id>:<key>`) is excluded by its device id.
+	*
+	* It never fails closed: a subject that carries no device id is not in the
+	* list, so it is not excluded. "Every battery except the one thermometer that
+	* reads 0 % forever" is the question this answers — expressed as an include
+	* list it would have to name every other battery device, and every device
+	* adopted later would be silently left out (D636).
+	*/
+	excludeDeviceIds: array(number().int()).min(1).optional(),
 	nodeIds: array(string().min(1)).min(1).optional(),
 	packageNames: array(string().min(1)).min(1).optional()
 });
@@ -17868,6 +18065,19 @@ var NcMediaFrameSchema = _enum([
 	"full",
 	"boxed"
 ]);
+/**
+* How a SENSOR notification shows the cameras that link the sensor.
+*
+* `mosaic` — one image composed of every linked camera's photograph, taken at
+* the trigger. `each` — one image per camera where the target takes several
+* attachments; a target that takes one keeps the first camera's (the degrade
+* engine drops the rest by order). Either way ONE notification per event.
+* Absent = `mosaic`, applied by the Notification Center and deliberately NOT
+* a Zod default (see NcRulePatchSchema: a default materialises on every
+* partial patch). Meaningless for a rule whose subject is not a sensor, and a
+* sensor linked to one camera ships that camera's plain snapshot either way.
+*/
+var NcLinkedCameraModeSchema = _enum(["mosaic", "each"]);
 var NcMediaPolicySchema = object({
 	attach: _enum([
 		"best",
@@ -17913,7 +18123,9 @@ var NcMediaPolicySchema = object({
 	* A profile that is not assigned falls back to the cheapest, and the render
 	* reports which one actually ran.
 	*/
-	profile: CamProfileSchema.optional()
+	profile: CamProfileSchema.optional(),
+	/** See {@link NcLinkedCameraModeSchema}. */
+	linkedCameras: NcLinkedCameraModeSchema.optional()
 });
 /**
 * Cooldown GRANULARITY over the subject's class — how much a fired
@@ -18033,7 +18245,7 @@ var NcRuleInputSchema = object({
 		cooldownSec: 60,
 		scope: "rule-device"
 	}),
-	/** `{{var}}` templating over camera/class/label/zones/confidence/time. */
+	/** `{{var}}` title/body. The variables are declared in `NC_TEMPLATE_VARS` (@camstack/types) and depend on the rule kind — see `templateVarsFor`. */
 	template: object({
 		title: string().max(500).optional(),
 		body: string().max(2e3).optional()
@@ -18213,6 +18425,22 @@ var NcRulePatchSchema = NcRuleInputSchema.partial().extend({
 	throttle: NcThrottleSchema.optional(),
 	priority: number().int().min(1).max(5).optional()
 });
+var NcRuleClearableKeySchema = _enum([
+	"template",
+	"schedule",
+	"targetUsers",
+	"snoozeOptions",
+	"snoozeAllowGlobal",
+	"waitForEnhancement",
+	"actions",
+	"confirm",
+	"groupIdleSec"
+]);
+var NcRuleUpdateInputSchema = object({
+	ruleId: string(),
+	patch: NcRulePatchSchema,
+	clear: array(NcRuleClearableKeySchema).optional()
+});
 /** A persisted rule. */
 var NcRuleSchema = NcRuleInputSchema.extend({
 	id: string(),
@@ -18244,6 +18472,85 @@ var NcTestResultSchema = object({
 	className: string().optional(),
 	label: string().optional()
 });
+/** The five rule kinds, as data. `NcRuleKind` in `notification/rule-kinds.ts`
+*  is the same union; the template-vars spec pins the two together. */
+var NcRuleKindSchema = _enum([
+	"detection",
+	"sensor",
+	"occupancy",
+	"sound",
+	"system"
+]);
+/** Which producer renders a template: an ordinary rule, a timelapse, a digest. */
+var NcTemplateFamilySchema = _enum([
+	"rule",
+	"timelapse",
+	"summary"
+]);
+/** Which text field of that producer. `previewText` is the timelapse frame
+*  caption, `captionText` the digest mosaic caption — both see fewer vars. */
+var NcTemplateFieldSchema = _enum([
+	"title",
+	"body",
+	"previewText",
+	"captionText"
+]);
+var NcTemplateVarGroupSchema = _enum([
+	"subject",
+	"place",
+	"time",
+	"rule",
+	"occupancy",
+	"sound",
+	"sensor",
+	"system",
+	"digest",
+	"ai"
+]);
+/**
+* ONE `{{var}}` a notification template may name.
+*
+* `families` / `fields` / `kinds` / `deliveries` / `systemEventKinds` say WHERE
+* it has a value; absent = no restriction on that axis. `systemEventKinds` is
+* read only for a `system` rule. `dynamic` declares a FAMILY of names
+* (`count_<class>`): the descriptor's `name` is the example member.
+*/
+var NcTemplateVarDescriptorSchema = object({
+	name: string().regex(/^\w+$/),
+	label: string(),
+	description: string().optional(),
+	example: string(),
+	group: NcTemplateVarGroupSchema,
+	families: array(NcTemplateFamilySchema).min(1),
+	fields: array(NcTemplateFieldSchema).optional(),
+	kinds: array(NcRuleKindSchema).optional(),
+	deliveries: array(NcDeliverySchema).optional(),
+	systemEventKinds: array(NcSystemEventKindSchema).optional(),
+	dynamic: object({
+		prefix: literal("count_"),
+		from: literal("classes")
+	}).optional()
+});
+/** Input to `previewTemplate` — the editor's own context, plus the draft text. */
+var NcTemplatePreviewInputSchema = object({
+	context: object({
+		family: NcTemplateFamilySchema,
+		field: NcTemplateFieldSchema,
+		kind: NcRuleKindSchema.optional(),
+		delivery: NcDeliverySchema.optional(),
+		systemEventKinds: array(NcSystemEventKindSchema).optional()
+	}),
+	template: object({
+		title: string().max(500).optional(),
+		body: string().max(2e3).optional()
+	})
+});
+var NcTemplatePreviewSchema = object({
+	title: string().nullable(),
+	body: string().nullable(),
+	/** Names the template uses that this context never fills — they render empty. */
+	unknown: array(string())
+});
 var NcConditionDescriptorSchema = object({
 	/** Field id inside `NcConditions` (or `'schedule'` for the rule-level group). */
 	id: string(),
@@ -18509,8 +18816,17 @@ object({
 	lastAt: number()
 });
 /**
-* The three durations the panel's state machine runs on, plus who hears about
-* an arm.
+* The per-mode lists, at most one per mode. Two lists for one mode have no
+* meaning a reader could agree on (union? the last one?), so they are refused
+* at the boundary rather than interpreted.
+*/
+var NcAlarmNonBlockingListSchema = array(object({
+	mode: AlarmArmModeSchema,
+	deviceIds: array(number().int()).max(200)
+})).max(8).refine((lists) => new Set(lists.map((l) => l.mode)).size === lists.length, { message: "nonBlocking: at most one list per arm mode" });
+/**
+* The three durations the panel's state machine runs on, who hears about its
+* transitions, and which openings each mode tolerates.
 *
 * They live on the NOTIFICATION-RULES cap, not on `alarm-panel`, on purpose:
 * `alarm-panel` is `deviceNative` and its other provider mirrors somebody
@@ -18529,21 +18845,39 @@ var NcAlarmSettingsSchema = object({
 	* existed, and therefore what an untouched install keeps doing.
 	*/
 	triggeredDurationSec: number().int().min(0).max(3600),
-	/** Send a notification when a mode takes effect. */
-	announceArm: boolean(),
 	/**
-	* Where that notification goes. Target ids from `notification-output`.
+	* Deprecated by D630 — every transition is announced. Parsed, never read;
+	* remove after one release. Optional so an older admin's patch (which still
+	* sends it) parses rather than failing the whole save.
+	*/
+	announceArm: boolean().optional(),
+	/**
+	* Target ids from `notification-output`: every alarm transition goes here.
 	*
-	* Explicit rather than "everyone": an arm announcement is a household
+	* Explicit rather than "everyone": an alarm announcement is a household
 	* message, and broadcasting it to every configured endpoint (including a
 	* webhook wired to something else) is not a default anybody would choose.
-	* Empty with `announceArm: true` sends nothing, and the server logs that —
-	* silence must be attributable.
+	* Empty sends nothing, and the server logs that — silence must be
+	* attributable.
+	*/
+	announceTargets: array(string().min(1)).max(16),
+	/**
+	* Per arm mode, the covered devices whose being OPEN does not refuse the
+	* arm (a window left ajar for the cat under `home`, say). At most one entry
+	* per mode is meaningful. Defaulted to `[]` so a blob stored before D630
+	* parses as "every opening blocks" — the behaviour it was written under.
 	*/
-	announceTargets: array(string().min(1)).max(16)
+	nonBlocking: NcAlarmNonBlockingListSchema.default([])
 });
-/** Every field optional — a tab edits one control at a time. */
-var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.partial();
+/**
+* Every field optional — a tab edits one control at a time.
+*
+* `nonBlocking` is re-declared WITHOUT its default: `.partial()` does not
+* remove an inner `.default()`, so a patch that never named the field would
+* parse to `nonBlocking: []` and wipe every mode's list on an unrelated edit
+* (the same trap {@link NcRulePatchSchema} documents).
+*/
+var NcAlarmSettingsPatchSchema = NcAlarmSettingsSchema.extend({ nonBlocking: NcAlarmNonBlockingListSchema }).partial();
 /**
 * What one arm mode actually arms, DERIVED from the enabled rules gated on it.
 * Never authored, never stored — see `alarm-mode-coverage.ts` for why a stored
@@ -18588,6 +18922,36 @@ var NcAlarmModeCoverageSchema = object({
 	*/
 	skippedDevices: array(NcAlarmSkippedDeviceSchema).default([])
 });
+/** One covered device that reads open, and whether that refuses the arm. */
+var NcAlarmOpeningSchema = object({
+	deviceId: number().int(),
+	name: string(),
+	/** The device's state word as read (`open`, `unlocked`, …). */
+	state: string(),
+	/** False when the mode's non-blocking list names this device. */
+	blocking: boolean()
+});
+/** A device the panel is currently ignoring, and which side of it it is on. */
+var NcAlarmExclusionViewSchema = object({
+	deviceId: number().int(),
+	name: string(),
+	phase: _enum(["open", "closed"])
+});
+/** One mode's openings: devices read open, plus those whose state is unknown. */
+var NcAlarmModeOpeningsSchema = object({
+	mode: AlarmArmModeSchema,
+	devices: array(NcAlarmOpeningSchema),
+	/** Covered devices whose state could not be read (D49): neither open nor closed. */
+	unknown: array(number().int())
+});
+var NcAlarmLiveSchema = object({
+	state: AlarmStateSchema,
+	/** The mode being armed into (exit delay) or held; null when disarmed. */
+	targetMode: AlarmArmModeSchema.nullable(),
+	availableModes: array(AlarmArmModeSchema),
+	openings: array(NcAlarmModeOpeningsSchema),
+	exclusions: array(NcAlarmExclusionViewSchema)
+});
 var NcAlarmConfigSchema = object({
 	/**
 	* The panel's device id, or null when this install has no panel (the ensure
@@ -18597,7 +18961,13 @@ var NcAlarmConfigSchema = object({
 	*/
 	deviceId: number().int().nullable(),
 	settings: NcAlarmSettingsSchema,
-	coverage: array(NcAlarmModeCoverageSchema)
+	coverage: array(NcAlarmModeCoverageSchema),
+	/**
+	* The panel as it is NOW — state, what each mode would find open, what is
+	* excluded. Optional: a panel-less hub answers without it, and a client
+	* must not read its absence as "nothing is open".
+	*/
+	live: NcAlarmLiveSchema.optional()
 });
 /**
 * ONE rule's demand on ONE camera's clip ring.
@@ -18645,10 +19015,7 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 	kind: "mutation",
 	auth: "admin",
 	caller: "required"
-}), method(object({
-	ruleId: string(),
-	patch: NcRulePatchSchema
-}), object({ rule: NcRuleSchema }), {
+}), method(NcRuleUpdateInputSchema, object({ rule: NcRuleSchema }), {
 	kind: "mutation",
 	auth: "admin",
 	caller: "required"
@@ -18676,7 +19043,10 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), method(object({}), object({
 	catalog: array(NcConditionDescriptorSchema),
 	taxonomy: NcTaxonomySchema.optional()
-})), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" }), method(object({ artifactId: string().min(1) }), object({ url: string().nullable() }), { auth: "admin" }), method(object({}), object({ snoozes: array(NcSnoozeSchema) }), { caller: "required" }), method(object({ snooze: NcSnoozeInputSchema }), object({ snooze: NcSnoozeSchema }), {
+})), method(object({}), object({ vars: array(NcTemplateVarDescriptorSchema) })), method(NcTemplatePreviewInputSchema, NcTemplatePreviewSchema, {
+	kind: "mutation",
+	access: "view"
+}), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" }), method(object({ artifactId: string().min(1) }), object({ url: string().nullable() }), { auth: "admin" }), method(object({}), object({ snoozes: array(NcSnoozeSchema) }), { caller: "required" }), method(object({ snooze: NcSnoozeInputSchema }), object({ snooze: NcSnoozeSchema }), {
 	kind: "mutation",
 	caller: "required"
 }), method(object({ snoozeId: string() }), object({ success: literal(true) }), {
@@ -23149,6 +23519,7 @@ var CAP_TO_KIND = {
 	"enum-sensor": "enum-sensor",
 	"event-emitter": "device-event",
 	"lock-control": "lock",
+	cover: "cover",
 	switch: "switch",
 	button: "button",
 	doorbell: "doorbell"
@@ -23813,41 +24184,65 @@ var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object(
 method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
-}), string()), method(object({
+}), string(), { auth: "admin" }), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string(),
 	data: _instanceof(Uint8Array)
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
-}), _instanceof(Uint8Array)), method(object({
+}), _instanceof(Uint8Array), { auth: "admin" }), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
-}), boolean()), method(object({
+}), boolean(), { auth: "admin" }), method(object({
 	location: StorageLocationRefSchema,
 	prefix: string().optional()
-}), array(string()).readonly()), method(object({
+}), array(string()).readonly(), { auth: "admin" }), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
-}), _void(), { kind: "mutation" }), method(object({ location: StorageLocationRefSchema }), number().nullable()), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ location: StorageLocationRefSchema }), number().nullable()), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string(),
 	sizeBytes: number().optional()
-}), object({ uploadId: string() }), { kind: "mutation" }), method(object({
+}), object({ uploadId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	uploadId: string(),
 	offset: number(),
 	data: _instanceof(Uint8Array)
-}), _void(), { kind: "mutation" }), method(object({ uploadId: string() }), _void(), { kind: "mutation" }), method(object({ uploadId: string() }), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ uploadId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ uploadId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
 }), object({
 	downloadId: string(),
 	sizeBytes: number()
-}), { kind: "mutation" }), method(object({
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	downloadId: string(),
 	offset: number(),
 	length: number()
-}), _instanceof(Uint8Array)), method(object({ downloadId: string() }), _void(), { kind: "mutation" }), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
+}), _instanceof(Uint8Array), { auth: "admin" }), method(object({ downloadId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
 	createdAt: true,
 	updatedAt: true
 }), StorageLocationSchema, {
@@ -25861,7 +26256,67 @@ var WebrtcLadderDecisionSchema = object({
 	serverSending: boolean().nullable(),
 	/** Epoch ms. The overlay prints its age; a decision from 40 minutes ago
 	*  must not read like one from this second. */
-	at: number()
+	at: number(),
+	/** The broker's own cause when it is finer than `cause` can carry, e.g.
+	*  `trial-revert` (reported as `stall`/`loss` for older consumers). Optional:
+	*  an older server strips it instead of rejecting the answer. */
+	causeDetail: string().optional()
+});
+var WebrtcClimbHoldSchema = object({
+	/** `stall-building` — the client receives ≪ what is sent; `delivery` — the
+	*  current rung is not landing whole; `no-evidence` — no receiver feedback;
+	*  `warming` — healthy, accumulating the streak; `cooldown` — too soon after
+	*  a change; `capacity` — a MEASURED probe below the next rung's bar;
+	*  `try-unclean` — no capacity evidence, and the path is not clean enough to
+	*  try; `try-backoff` — a try reverted, waiting out its backoff; `trial` —
+	*  this rung IS a try, reverting if it does not land; `suspended` —
+	*  recorded playback on the track. */
+	code: string(),
+	/** The rung a climb would go to. */
+	nextTier: CamProfileSchema,
+	/** Bytes received ÷ bytes sent over the delivery window (≥ one GOP). */
+	deliveryRatio: number().nullable(),
+	deliveryWindowMs: number().nullable(),
+	/** The ratio a climb requires. */
+	climbDeliveryRatio: number(),
+	/** The receiver's bandwidth estimate (REMB), kbps. Capped by what is sent. */
+	capacityKbps: number().nullable(),
+	/** The viewer's downlink probe for this session, kbps. */
+	probeKbps: number().nullable(),
+	/** The next rung's measured bitrate, kbps. */
+	nextTierKbps: number().nullable(),
+	capacityMargin: number(),
+	/** The capacity a climb to `nextTier` needs, kbps (bitrate × margin, or the
+	*  client ladder threshold when the rung has measured nothing). */
+	neededKbps: number().nullable(),
+	/** For `try-unclean`: which clean-path condition failed (a `WebrtcTryBlocker`,
+	*  carried as a string for the same reason as `code`). */
+	tryBlockedBy: string().nullable(),
+	/** The delivery ratio and the loss ratio a try requires / must stay under.
+	*  Optional, like every field added to this schema after it first shipped:
+	*  the router validates output, so a REQUIRED new field makes a newer server
+	*  reject an older broker's whole answer (review m1). */
+	tryDeliveryRatio: number().optional(),
+	tryMaxLossRatio: number().optional(),
+	/** For `try-backoff`: time until the next try, ms. */
+	retryInMs: number().nullable(),
+	/** The last try that reverted in this viewer session. */
+	lastRevert: object({
+		tier: CamProfileSchema,
+		deliveryRatio: number().nullable(),
+		stalled: boolean(),
+		at: number()
+	}).nullable(),
+	/** For `trial`: how long this rung has been on trial, and for how long it must hold. */
+	trialForMs: number().nullable(),
+	trialMs: number().nullable(),
+	healthyForMs: number().nullable(),
+	requiredHealthyMs: number().nullable(),
+	/** Epoch ms this hold's code began. */
+	since: number(),
+	/** The same one-line account the broker logs, e.g.
+	*  `held: delivery 0.97 over 4.0s ok, REMB 480 kbps < mid 1800 kbps × 1.2`. */
+	summary: string()
 });
 /** Per-tier count of MEASURED downgrades this viewer session has suffered. */
 var WebrtcTierFailureSchema = object({
@@ -25925,7 +26380,12 @@ var WebrtcSessionDebugSchema = object({
 	tierFailures: array(WebrtcTierFailureSchema),
 	/** Successful promotions in this viewer session (drives the progressive
 	*  healthy timer). Null when no ladder is running. */
-	upgradeCount: number().nullable()
+	upgradeCount: number().nullable(),
+	/** Why the ladder is not climbing right now. Null when no ladder runs, it
+	*  is at the top rung, or it just moved. Optional because this output is
+	*  validated by the router: a server carrying this schema must still accept
+	*  the answer of a stream-broker deployed before the field existed. */
+	climbHold: WebrtcClimbHoldSchema.nullable().optional()
 });
 DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), array(WebrtcStreamChoiceSchema)), method(object({
 	deviceId: number().int().nonnegative(),
@@ -31146,6 +31606,11 @@ var ClientNetworkStatsSchema = object({
 	jitterMs: number(),
 	estimatedBandwidthKbps: number(),
 	packetLossPercent: number().min(0).max(100),
+	/** The viewer's latest `/adaptive-probe` reading, Mbps — whatever it read
+	*  (D635 I4). Absent when it never probed or the probe failed (unknown). */
+	downlinkMbps: number().optional(),
+	/** Age of that reading when this report was sent, ms. */
+	downlinkAgeMs: number().optional(),
 	lastUpdated: number()
 });
 var DeviceNetworkStatsSchema = object({
@@ -31158,7 +31623,11 @@ method(object({ deviceId: number() }), DeviceNetworkStatsSchema.nullable()), met
 	rttMs: number().min(0).max(6e4),
 	jitterMs: number().min(0).max(1e4),
 	estimatedBandwidthKbps: number().min(0).max(1e6),
-	packetLossPercent: number().min(0).max(100)
+	packetLossPercent: number().min(0).max(100),
+	/** Latest downlink probe, Mbps, whatever it read; absent = never / failed. */
+	downlinkMbps: number().min(0).max(1e5).optional(),
+	/** Age of that probe when this report is sent, ms. */
+	downlinkAgeMs: number().min(0).max(864e5).optional()
 }), _void(), { kind: "mutation" });
 /**
 * nodes — system-scoped singleton capability for cluster topology
@@ -41972,6 +42441,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.listDeviceIdsByCaps": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.listLocationDescriptions": {
 		capName: "device-manager",
 		capScope: "system",
@@ -42932,12 +43407,30 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"llmRuntime.appleAvailability": {
+		capName: "llm-runtime",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"llmRuntime.cancel": {
+		capName: "llm-runtime",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llmRuntime.complete": {
 		capName: "llm-runtime",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"llmRuntime.completeApple": {
+		capName: "llm-runtime",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"llmRuntime.deleteModel": {
 		capName: "llm-runtime",
 		capScope: "system",
@@ -43778,6 +44271,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.getTemplateCatalog": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.listDeviceMutes": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -43796,6 +44295,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.previewTemplate": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.resolveArtifactUrl": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -49363,6 +49868,41 @@ var NC_AUDIO_DEFAULTS = {
 };
 new Set(["devices", "classes"]);
 NC_AUDIO_DEFAULTS.hitPercent, NC_AUDIO_DEFAULTS.samplingSeconds;
+var RULE_BODY_ONLY = ["body"];
+var RULE_TEXT = ["title", "body"];
+var BATTERY = ["device-battery-low", "device-battery-normal"];
+var CONSUMABLE = ["device-consumable-low", "device-consumable-normal"];
+var UPDATES = [
+	"addon-update-available",
+	"server-update-available",
+	"wrapper-update-available"
+];
+var PACKAGE_UPDATES = ["addon-update-available", "server-update-available"];
+var ALARM = [
+	"alarm-triggered",
+	"alarm-armed",
+	"alarm-disarmed",
+	"alarm-arming",
+	"alarm-arm-refused",
+	"alarm-pending",
+	"alarm-rearmed",
+	"alarm-sensor-bypass",
+	"alarm-check-failed"
+];
+var COMBINED_ALARM = ["alarm-triggered"];
+var DEVICE_EVENTS = [
+	"device-online",
+	"device-offline",
+	"device-disabled",
+	"device-enabled",
+	...BATTERY,
+	...CONSUMABLE,
+	"stream-online",
+	"stream-offline",
+	"detection-blind",
+	...ALARM
+];
+[...DEVICE_EVENTS], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...COMBINED_ALARM], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_BODY_ONLY], [...RULE_TEXT], [...RULE_TEXT], [...DEVICE_EVENTS], [...RULE_TEXT], [...DEVICE_EVENTS], [...RULE_TEXT], [...BATTERY, ...CONSUMABLE], [...RULE_TEXT], [...CONSUMABLE], [...RULE_TEXT], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...UPDATES], [...RULE_TEXT], [...PACKAGE_UPDATES], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT], [...RULE_TEXT];
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -54761,11 +55301,22 @@ function createClipThumbHandler(deps) {
 			writeJpeg(res, cached, req.method === "HEAD");
 			return;
 		}
+		const gone = new AbortController();
+		const onClose = () => {
+			if (!res.writableEnded) gone.abort();
+		};
+		res.on("close", onClose);
 		let minted;
 		try {
-			minted = await deps.mint(deviceId, clipKey);
+			minted = await deps.mint(deviceId, clipKey, gone.signal);
 		} catch (err) {
 			minted = refuseStill("camera-refused", err instanceof Error ? err.message : String(err));
+		} finally {
+			res.off("close", onClose);
+		}
+		if (!minted.ok && "abandoned" in minted) {
+			if (!res.writableEnded) res.end();
+			return;
 		}
 		if (!minted.ok) {
 			writeStillRefusal(res, minted, deviceId, deps.logger, clipKey);
@@ -55644,6 +56195,11 @@ function createClipStreamProducer(deps) {
 			code: "replay-busy",
 			detail: lease.detail
 		};
+		if (lease.kind === "abandoned") return {
+			kind: "refused",
+			code: "replay-busy",
+			detail: "the playback was abandoned before this camera’s replay came free"
+		};
 		const args = buildClipStreamMuxArgs({
 			url: request.url,
 			audio: request.audio
@@ -55898,7 +56454,7 @@ async function cutClipStill(input, deps) {
 	child.stderr?.on("data", (chunk) => {
 		stderr = `${stderr}${chunk.toString("utf8")}`.slice(-4e3);
 	});
-	const timeoutMs = deps.timeoutMs ?? 1e4;
+	const timeoutMs = deps.timeoutMs ?? 5e3;
 	let yielded = false;
 	const exit = await new Promise((resolve) => {
 		const onAbort = () => {
@@ -55953,10 +56509,73 @@ async function cutClipStill(input, deps) {
 		detail: `the replay ran for ${String(slotMs)} ms and produced no decodable frame`
 	};
 }
+function memoryKey(deviceId, clipKey) {
+	return `${String(deviceId)}/${clipKey}`;
+}
+function createClipStillGuard(deps) {
+	const now = deps.now ?? (() => Date.now());
+	const memoryMs = deps.memoryMs ?? 6e5;
+	const pauseMs = deps.pauseMs ?? 3e5;
+	const failuresToPause = deps.failuresToPause ?? 2;
+	const failures = /* @__PURE__ */ new Map();
+	const consecutive = /* @__PURE__ */ new Map();
+	const pausedUntil = /* @__PURE__ */ new Map();
+	const forgetLapsed = (at) => {
+		for (const [key, entry] of failures) if (entry.untilMs <= at) failures.delete(key);
+	};
+	return {
+		remembered: (deviceId, clipKey) => {
+			const key = memoryKey(deviceId, clipKey);
+			const entry = failures.get(key);
+			if (entry === void 0) return null;
+			if (entry.untilMs <= now()) {
+				failures.delete(key);
+				return null;
+			}
+			return entry.refusal;
+		},
+		pausedForMs: (deviceId) => {
+			const until = pausedUntil.get(deviceId);
+			if (until === void 0) return null;
+			const left = until - now();
+			if (left > 0) return left;
+			pausedUntil.delete(deviceId);
+			return null;
+		},
+		recordFailure: (deviceId, clipKey, refusal) => {
+			const at = now();
+			forgetLapsed(at);
+			failures.set(memoryKey(deviceId, clipKey), {
+				refusal,
+				untilMs: at + memoryMs
+			});
+			const count = (consecutive.get(deviceId) ?? 0) + 1;
+			if (count < failuresToPause) {
+				consecutive.set(deviceId, count);
+				return;
+			}
+			consecutive.delete(deviceId);
+			pausedUntil.set(deviceId, at + pauseMs);
+			deps.logger.warn("videoclips: pausing clip stills for this camera — its replays keep failing", {
+				tags: { deviceId },
+				meta: {
+					branch: "still-pause",
+					consecutiveFailures: count,
+					pauseMs,
+					lastClipKey: clipKey,
+					lastReason: refusal.reason
+				}
+			});
+		},
+		recordSuccess: (deviceId) => {
+			consecutive.delete(deviceId);
+		}
+	};
+}
 //#endregion
 //#region src/clips/replay-lane.ts
 /**
-* How long an ask may wait for a slot that is being released.
+* How long a PLAYBACK may wait for a slot that is being released.
 *
 * A holder shutting down kills its ffmpeg and the camera's socket dies with
 * it; there is no teardown handshake to flush. Two seconds is an order of
@@ -55975,15 +56594,29 @@ var REPLAY_LANE_WAIT_MS = 2e3;
 function replayPreempts(asked, holder) {
 	return asked === "stream" && holder === "still";
 }
+/** Where a new waiter goes: a playback ahead of every still, else the tail. */
+function queuePosition(queue, purpose) {
+	if (purpose === "still") return queue.length;
+	const firstStill = queue.findIndex((w) => w.purpose === "still");
+	return firstStill === -1 ? queue.length : firstStill;
+}
 function createReplayLane(deps) {
 	const now = deps.now ?? (() => Date.now());
 	const waitMs = deps.waitMs ?? 2e3;
+	const maxPending = deps.maxPending ?? 8;
 	const holding = /* @__PURE__ */ new Map();
+	const queues = /* @__PURE__ */ new Map();
+	const leave = (deviceId, waiter) => {
+		const queue = queues.get(deviceId);
+		if (queue === void 0) return;
+		const index = queue.indexOf(waiter);
+		if (index !== -1) queue.splice(index, 1);
+		if (queue.length === 0) queues.delete(deviceId);
+	};
 	const take = (deviceId, purpose, onYield) => {
 		const entry = {
 			purpose,
 			sinceMs: now(),
-			waiters: [],
 			...onYield === void 0 ? {} : { onYield }
 		};
 		holding.set(deviceId, entry);
@@ -55995,16 +56628,82 @@ function createReplayLane(deps) {
 				released = true;
 				if (holding.get(deviceId) !== entry) return;
 				holding.delete(deviceId);
-				entry.waiters.shift()?.();
+				const next = queues.get(deviceId)?.[0];
+				if (next === void 0) return;
+				leave(deviceId, next);
+				next.grant();
 			}
 		};
 	};
+	const refuse = (deviceId, purpose, current, waitedMs, detail, branch) => {
+		const heldForMs = now() - current.sinceMs;
+		const extras = {
+			tags: { deviceId },
+			meta: {
+				branch,
+				asked: purpose,
+				holder: current.purpose,
+				heldForMs,
+				waitedMs
+			}
+		};
+		if (purpose === "stream") deps.logger.warn("videoclips: a replay was refused — this node already holds one", extras);
+		else deps.logger.debug("videoclips: a still was refused a place in the replay queue", extras);
+		return {
+			kind: "busy",
+			holder: current.purpose,
+			heldForMs,
+			waitedMs,
+			detail
+		};
+	};
 	return {
 		held: (deviceId) => holding.has(deviceId),
-		acquire: async (deviceId, purpose, onYield) => {
+		acquire: async (deviceId, purpose, onYield, signal) => {
 			const askedAt = now();
+			if (signal?.aborted === true) return {
+				kind: "abandoned",
+				waitedMs: 0
+			};
 			const current = holding.get(deviceId);
 			if (current === void 0) return take(deviceId, purpose, onYield);
+			const queue = queues.get(deviceId) ?? [];
+			if (purpose === "still" && queue.length >= maxPending) return refuse(deviceId, purpose, current, 0, `queue-full: ${String(queue.length)} replays are already waiting for this camera (at most ${String(maxPending)}) — nothing about this clip; ask again once the queue drains`, "replay-queue-full");
+			let settle = () => void 0;
+			const settled = new Promise((resolve) => {
+				settle = resolve;
+			});
+			let timer = null;
+			let done = false;
+			const finish = (value) => {
+				if (done) return;
+				done = true;
+				if (timer !== null) clearTimeout(timer);
+				timer = null;
+				signal?.removeEventListener("abort", onAbort);
+				settle(value);
+			};
+			const waiter = {
+				purpose,
+				grant: () => {
+					finish({
+						kind: "granted",
+						lease: take(deviceId, purpose, onYield)
+					});
+				}
+			};
+			const onAbort = () => {
+				leave(deviceId, waiter);
+				finish({ kind: "abandoned" });
+			};
+			queue.splice(queuePosition(queue, purpose), 0, waiter);
+			queues.set(deviceId, queue);
+			signal?.addEventListener("abort", onAbort, { once: true });
+			if (purpose === "stream") timer = setTimeout(() => {
+				timer = null;
+				leave(deviceId, waiter);
+				finish({ kind: "timeout" });
+			}, waitMs);
 			if (replayPreempts(purpose, current.purpose) && current.onYield !== void 0) {
 				deps.logger.debug("videoclips: a speculative replay was asked to give the slot back", {
 					tags: { deviceId },
@@ -56016,43 +56715,15 @@ function createReplayLane(deps) {
 				});
 				current.onYield();
 			}
-			await new Promise((resolve) => {
-				let timer = null;
-				const wake = () => {
-					if (timer !== null) clearTimeout(timer);
-					timer = null;
-					resolve();
-				};
-				timer = setTimeout(() => {
-					timer = null;
-					const index = current.waiters.indexOf(wake);
-					if (index !== -1) current.waiters.splice(index, 1);
-					resolve();
-				}, waitMs);
-				current.waiters.push(wake);
-			});
-			const after = holding.get(deviceId);
-			if (after === void 0) return take(deviceId, purpose, onYield);
-			const heldForMs = now() - after.sinceMs;
+			const outcome = await settled;
 			const waitedMs = now() - askedAt;
-			const detail = `replay-busy: this camera is already serving a clip ${after.purpose} for this node, held for ${String(heldForMs)} ms — nothing about this clip, and nothing a retry against the camera would change`;
-			deps.logger.warn("videoclips: a replay was refused — this node already holds one", {
-				tags: { deviceId },
-				meta: {
-					branch: "replay-busy",
-					asked: purpose,
-					holder: after.purpose,
-					heldForMs,
-					waitedMs
-				}
-			});
-			return {
-				kind: "busy",
-				holder: after.purpose,
-				heldForMs,
-				waitedMs,
-				detail
+			if (outcome.kind === "granted") return outcome.lease;
+			if (outcome.kind === "abandoned") return {
+				kind: "abandoned",
+				waitedMs
 			};
+			const after = holding.get(deviceId) ?? current;
+			return refuse(deviceId, purpose, after, waitedMs, `replay-busy: this camera is already serving a clip ${after.purpose} for this node, held for ${String(now() - after.sinceMs)} ms — nothing about this clip, and nothing a retry against the camera would change`, "replay-busy");
 		}
 	};
 }
@@ -56064,7 +56735,7 @@ function createReplayLane(deps) {
 * The caller is the route, which has already answered a cached still from disk
 * — this is only ever reached for a clip whose picture does not exist yet.
 */
-async function mintClipStill(deviceId, clipKey, deps) {
+async function mintClipStill(deviceId, clipKey, deps, signal) {
 	const tags = { deviceId };
 	const meta = { clipKey };
 	if (!await deps.hasCamera(deviceId)) {
@@ -56101,12 +56772,41 @@ async function mintClipStill(deviceId, clipKey, deps) {
 		});
 		return refuseStill("no-keyframe", "this clip has no window to take a midpoint of — its catalog row spans nothing, and a midpoint of nothing is a guess rather than a picture");
 	}
+	const remembered = deps.guard.remembered(deviceId, clipKey);
+	if (remembered !== null) {
+		deps.logger.debug("videoclips: no still — this clip already failed recently", {
+			tags,
+			meta: {
+				...meta,
+				branch: "remembered-failure",
+				code: remembered.code
+			}
+		});
+		return remembered;
+	}
+	const paused = pausedRefusal(deviceId, clipKey, deps);
+	if (paused !== null) return paused;
 	const evict = new AbortController();
 	const lease = await deps.lane.acquire(deviceId, "still", () => {
 		evict.abort();
-	});
+	}, signal);
+	if (lease.kind === "abandoned") {
+		deps.logger.debug("videoclips: no still — its caller went away while it queued", {
+			tags,
+			meta: {
+				...meta,
+				branch: "abandoned",
+				waitedMs: lease.waitedMs
+			}
+		});
+		return {
+			ok: false,
+			abandoned: true,
+			waitedMs: lease.waitedMs
+		};
+	}
 	if (lease.kind === "busy") {
-		deps.logger.debug("videoclips: no still yet — this camera’s replay is held", {
+		deps.logger.debug("videoclips: no still yet — this camera’s replay queue is full", {
 			tags,
 			meta: {
 				...meta,
@@ -56117,6 +56817,26 @@ async function mintClipStill(deviceId, clipKey, deps) {
 		});
 		return deferStill("queue-full", lease.detail, REPLAY_LANE_WAIT_MS);
 	}
+	const pausedWhileQueued = pausedRefusal(deviceId, clipKey, deps);
+	if (pausedWhileQueued !== null) {
+		lease.release();
+		return pausedWhileQueued;
+	}
+	const mintedWhileQueued = await readCachedSafely(deviceId, clipKey, deps);
+	if (mintedWhileQueued !== null) {
+		lease.release();
+		deps.logger.debug("videoclips: still minted while this ask queued — served from disk", {
+			tags,
+			meta: {
+				...meta,
+				branch: "cached-while-queued"
+			}
+		});
+		return {
+			ok: true,
+			bytes: mintedWhileQueued
+		};
+	}
 	let cut;
 	try {
 		const replay = await deps.replayUrlFor(deviceId, row, window);
@@ -56129,7 +56849,9 @@ async function mintClipStill(deviceId, clipKey, deps) {
 					reason: replay.detail
 				}
 			});
-			return refuseStill("camera-refused", replay.detail);
+			const refusal = refuseStill("camera-refused", replay.detail);
+			deps.guard.recordFailure(deviceId, clipKey, refusal);
+			return refusal;
 		}
 		cut = await deps.cut({
 			url: replay.url,
@@ -56158,8 +56880,11 @@ async function mintClipStill(deviceId, clipKey, deps) {
 				reason: cut.detail
 			}
 		});
-		return refuseStill(cut.code, cut.detail);
+		const refusal = refuseStill(cut.code, cut.detail);
+		deps.guard.recordFailure(deviceId, clipKey, refusal);
+		return refusal;
 	}
+	deps.guard.recordSuccess(deviceId);
 	await deps.putStill(deviceId, clipKey, cut.bytes);
 	deps.logger.debug("videoclips: minted a clip still from the camera’s replay", {
 		tags,
@@ -56177,6 +56902,35 @@ async function mintClipStill(deviceId, clipKey, deps) {
 		bytes: cut.bytes
 	};
 }
+/** `camera-backoff` while this camera's stills are paused, else `null`. */
+function pausedRefusal(deviceId, clipKey, deps) {
+	const leftMs = deps.guard.pausedForMs(deviceId);
+	if (leftMs === null) return null;
+	deps.logger.debug("videoclips: no still — this camera’s stills are paused", {
+		tags: { deviceId },
+		meta: {
+			clipKey,
+			branch: "camera-backoff",
+			leftMs
+		}
+	});
+	return deferStill("camera-backoff", `camera-backoff: this camera failed its last clip replays in a row, so clip stills are paused for another ${String(Math.ceil(leftMs / 1e3))} s — nothing about this clip`, leftMs);
+}
+/** A cache read that fails is not a still: answered as "not there". */
+async function readCachedSafely(deviceId, clipKey, deps) {
+	try {
+		return await deps.readCached(deviceId, clipKey);
+	} catch (err) {
+		deps.logger.debug("videoclips: the still cache could not be read after the queue", {
+			tags: { deviceId },
+			meta: {
+				clipKey,
+				error: err instanceof Error ? err.message : String(err)
+			}
+		});
+		return null;
+	}
+}
 //#endregion
 //#region src/clips/clip-twins.ts
 /**
@@ -56828,9 +57582,15 @@ function createClipService(deps) {
 	* DEFERS — lives in `clip-still-mint.ts`; this is only the wiring that gives
 	* it a camera, a clock and a place to put the bytes.
 	*/
-	const mintStill = async (deviceId, clipKey) => await mintClipStill(deviceId, clipKey, {
+	const stillGuard = createClipStillGuard({
+		logger,
+		now
+	});
+	const mintStill = async (deviceId, clipKey, signal) => await mintClipStill(deviceId, clipKey, {
 		logger,
 		lane,
+		guard: stillGuard,
+		readCached: async (id, key) => await thumbs.read(id, key),
 		hasCamera: async () => await deps.resolveCamera(deviceId) !== null,
 		rowFor: (id, key) => rowsByKey.get(rowKey(id, key)),
 		replayUrlFor: async (id, row, window) => {
@@ -56865,7 +57625,7 @@ function createClipService(deps) {
 		putStill: async (id, key, bytes) => {
 			await thumbs.put(id, key, bytes);
 		}
-	});
+	}, signal);
 	return {
 		provider: createAmcrestVideoclipsProvider({
 			now,