@camstack/addon-provider-homeassistant 1.2.11 → 1.2.13

package/dist/addon.mjs

@@ -9466,8 +9466,11 @@ function prepareNotification(caps, n) {
 		});
 	}
 	const inActions = n.actions ?? [];
-	const actions = inActions.slice(0, Math.max(0, caps.actions));
-	if (inActions.length > actions.length) dropped.push("actions");
+	const kept = inActions.slice(0, Math.max(0, caps.actions));
+	if (inActions.length > kept.length) dropped.push("actions");
+	const iconsSupported = caps.actionIcons === true;
+	if (!iconsSupported && kept.some((a) => a.icon !== void 0)) dropped.push("actionIcons");
+	const actions = iconsSupported ? kept : kept.map(({ icon: _icon, ...rest }) => rest);
 	let clickUrl = null;
 	if (n.clickUrl !== void 0) if (caps.clickUrl) clickUrl = n.clickUrl;
 	else dropped.push("clickUrl");
@@ -9566,6 +9569,290 @@ var MaskGridDimsSchema = object({
 	height: number()
 });
 /**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = _enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: string().optional(),
+	bytes: _instanceof(Uint8Array).optional(),
+	mime: string().optional(),
+	name: string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = _enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/**
+* The CLOSED icon vocabulary an action button may use.
+*
+* A closed set, not a free string, and that is the whole point: an arbitrary
+* icon name is one that ntfy renders, zentik silently drops, and nobody
+* notices — the same class of gap as a zone vocabulary nothing produced
+* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
+* declares `actionIcons: false` and the degrade engine strips the field.
+*
+* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
+* renderer's icon set; "acknowledge" survives an adapter that draws it
+* differently.
+*/
+var NotificationActionIconSchema = _enum([
+	"acknowledge",
+	"dismiss",
+	"silence",
+	"view",
+	"play",
+	"open",
+	"close",
+	"lock",
+	"unlock",
+	"arm",
+	"disarm",
+	"light",
+	"alert"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = object({
+	id: string(),
+	label: string(),
+	url: string().optional(),
+	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
+	icon: NotificationActionIconSchema.optional(),
+	/**
+	* Renders in a warning style where the notifier supports it.
+	*
+	* A HINT, never a gate. The callback's authority is its token and nothing
+	* else — see `notification-center/action-token.ts` for what that does and
+	* does not buy.
+	*/
+	destructive: boolean().optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = object({
+	body: string(),
+	title: string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: number().int().min(1).max(5).default(3),
+	level: string().optional(),
+	attachments: array(AttachmentSchema).optional(),
+	clickUrl: string().optional(),
+	actions: array(NotificationActionSchema).optional(),
+	sound: string().optional(),
+	ttl: number().optional(),
+	tag: string().optional(),
+	deviceId: number().optional(),
+	eventId: string().optional(),
+	metadata: record(string(), unknown()).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = object({
+	id: string(),
+	label: string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: number().int().min(1).max(5).nullable(),
+	flags: object({
+		critical: boolean().optional(),
+		silent: boolean().optional(),
+		noPush: boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: array(string()).optional(),
+	description: string().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = object({
+	attachments: object({
+		mediaTypes: array(AttachmentMediaTypeSchema),
+		mode: _enum([
+			"url",
+			"bytes",
+			"both"
+		]),
+		max: number().int().nonnegative(),
+		maxBytes: number().int().positive().optional()
+	}),
+	/** Max action buttons (0 = none). */
+	actions: number().int().nonnegative(),
+	/**
+	* Whether this kind renders a per-action ICON.
+	*
+	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
+	* run on the addon cap path — three production failures in one day taught
+	* this repo that once. Absent is read as false by the degrade engine, which
+	* is the safe direction: an icon that is not rendered costs nothing, an icon
+	* assumed and dropped costs the operator's trust in the field.
+	*/
+	actionIcons: boolean().optional(),
+	levels: array(TargetKindLevelSchema),
+	format: array(NotificationFormatSchema),
+	clickUrl: boolean(),
+	sound: boolean(),
+	ttl: boolean(),
+	bodyMaxLen: number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough$1 = unknown();
+var TargetKindSchema = object({
+	kind: string(),
+	label: string(),
+	icon: string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: string().optional(),
+	configSchema: ConfigSchemaPassthrough$1,
+	supportsDiscovery: boolean(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = object({
+	id: string(),
+	name: string(),
+	kind: string(),
+	addonId: string(),
+	enabled: boolean(),
+	config: record(string(), unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = object({
+	kind: string(),
+	suggestedName: string(),
+	config: record(string(), unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = object({
+	level: string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: number().int().nonnegative(),
+	actionsSent: number().int().nonnegative(),
+	truncated: boolean(),
+	dropped: array(string())
+});
+var SendResultSchema = object({
+	success: boolean(),
+	error: string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+var notificationOutputCapability = {
+	name: "notification-output",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		listTargetKinds: method(object({}), array(TargetKindSchema)),
+		listTargets: method(object({}), array(TargetSchema)),
+		discoverTargets: method(object({
+			kind: string(),
+			config: record(string(), unknown()).optional()
+		}), array(DiscoveredTargetSchema)),
+		send: method(object({
+			targetId: string(),
+			notification: NotificationSchema
+		}), SendResultSchema, { kind: "mutation" }),
+		testTarget: method(object({
+			targetId: string(),
+			sample: NotificationSchema.optional()
+		}), TestResultSchema, { kind: "mutation" }),
+		upsertTarget: method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }),
+		deleteTarget: method(object({ targetId: string() }), _void(), { kind: "mutation" }),
+		setTargetEnabled: method(object({
+			targetId: string(),
+			enabled: boolean()
+		}), _void(), { kind: "mutation" })
+	}
+};
+/**
 * notification-rules — the Notification Center rule surface (P1 core).
 *
 * Spec: `docs/superpowers/specs/2026-07-22-notification-center-requirements.md`
@@ -9695,7 +9982,115 @@ var NcZoneConditionSchema = object({
 * The P1 condition set — a flat AND of groups; absent group = pass;
 * membership lists are OR within the list (spec §2.3).
 */
+/**
+* What a rule may actuate.
+*
+* **No hand-maintained allowlist** (operator decision, and the right one — a
+* written list of methods is a third parallel map to keep aligned, and this
+* repo has paid for those). The boundary instead comes from a property the
+* capabilities already carry: an action may target only a **device-scoped**
+* capability method.
+*
+* That is not decoration. A rule can be authored by a NON-ADMIN — personal
+* rules are a supported flow — and the executor runs with the addon's
+* privileges, so an unbounded action is an arbitrary RPC channel with a
+* privilege escalation attached. Restricting to device scope excludes the
+* system caps (`device-manager.removeDevice` and friends) by construction,
+* costs nothing to maintain, and cannot rot: a cap that stops being
+* device-scoped stops being actuatable in the same change.
+*
+* The executor enforces it; {@link NcRuleActionSchema} carries the intent.
+*/
+/**
+* One step of a sequence.
+*
+* `wait` is a first-class step rather than a property of the next action: it is
+* what makes a sequence a SEQUENCE and not a list — "unlock, wait 5s, open"
+* cannot be expressed otherwise.
+*/
+var NcRuleActionSchema = discriminatedUnion("kind", [object({
+	kind: literal("wait"),
+	seconds: number().min(0).max(300)
+}), object({
+	kind: literal("cap"),
+	deviceId: number().int(),
+	/** Capability name, e.g. `alarm-panel`. */
+	cap: string().min(1),
+	/** Method on it. The executor refuses a non-device-scoped cap. */
+	method: string().min(1),
+	/** Method arguments, minus `deviceId` (the executor injects it). */
+	args: record(string(), unknown()).optional()
+})]);
+/**
+* A named, ordered run of steps with its own throttle.
+*
+* `minDelaySec` exists because a noisy rule otherwise hammers a physical
+* actuator — the rule's own cooldown governs NOTIFICATIONS, which is a
+* different budget from "how often may this gate actually open".
+*/
+var NcRuleActionSequenceSchema = object({
+	name: string().min(1).max(120),
+	enabled: boolean(),
+	minDelaySec: number().int().min(0).max(86400).optional(),
+	actions: array(NcRuleActionSchema).min(1)
+});
+/**
+* One button carried by the notification, running a named sequence on tap.
+*
+* **Read this before adding a button that does something physical.** The tap
+* arrives over a link that travelled through third-party infrastructure — ntfy,
+* a push relay, whatever forwarded the message — and the callback's ONLY
+* authority is the token in that link: single-use, short-lived, bound to this
+* one action of this one notification. It does not identify who tapped.
+* Whoever holds the notification can run the button, once, inside the window.
+* That is the operator's explicit choice (2026-08-05), and `destructive` is a
+* rendering hint, not a second gate. [D47](decisions/adr-0047.md).
+*/
+var NcRuleNotificationButtonSchema = object({
+	/** Stable id — travels in the callback and identifies the button in logs. */
+	id: string().min(1).max(64),
+	label: string().min(1).max(40),
+	/** Name of a sequence in `onTrigger`. The dispatcher drops a button whose
+	*  sequence does not exist rather than minting a token for nothing. */
+	sequence: string().min(1).max(120),
+	icon: NotificationActionIconSchema.optional(),
+	destructive: boolean().optional()
+});
+/**
+* Sequences a rule runs, by hook point.
+*
+* ONLY `onTrigger` is here, deliberately. The reference also has activation /
+* deactivation / reset / post-generation hooks, and they are wanted — but this
+* repo's expensive failure mode is declaring a surface nothing produces, so a
+* hook appears here in the same change that produces its edge, never before.
+*/
+var NcRuleActionsSchema = object({
+	/** Runs when the rule MATCHES. */
+	onTrigger: array(NcRuleActionSequenceSchema).optional(),
+	/**
+	* Buttons the NOTIFICATION carries, each running one of this rule's
+	* sequences when tapped.
+	*
+	* Deliberately a REFERENCE to a sequence rather than a second place to
+	* author steps. A button that could define its own actions would be a
+	* parallel actuation vocabulary — the executor's device-scope check, the
+	* stop-at-first-failure rule and the per-sequence throttle all live on
+	* sequences, and a second authoring surface would drift from every one of
+	* them.
+	*
+	* A sequence reachable ONLY by a button simply appears in `onTrigger` with
+	* `enabled: false`: it is then authored, throttled and validated like the
+	* rest, and nothing runs it automatically.
+	*/
+	buttons: array(NcRuleNotificationButtonSchema).max(8).optional()
+});
 var NcConditionsSchema = object({
+	/** Gate on ANOTHER device's current state (the alarm armed, a switch on). */
+	deviceState: object({
+		deviceId: number().int(),
+		/** Any of these matches. */
+		states: array(string().min(1)).min(1)
+	}).optional(),
 	/** Device scope — absent = all devices. */
 	devices: array(number()).optional(),
 	/** Detector class names (any overlap with the record's class set). */
@@ -9896,6 +10291,14 @@ var NcMediaPolicySchema = object({
 	clipPreRollSec: number().int().min(0).max(30).optional(),
 	clipPostRollSec: number().int().min(0).max(30).optional(),
 	/**
+	* Playback rate of the attached gif / clip. Absent = 2x.
+	*
+	* A notification clip is GLANCED at on a lock screen, not watched: at real
+	* time an eight-second passage is eight seconds of the recipient's attention
+	* and twice the bytes. 1 is real time for the operator who wants it.
+	*/
+	clipSpeed: number().min(1).max(8).optional(),
+	/**
 	* Which stream profile the footage is cut from. Absent = the CHEAPEST
 	* assigned profile: a notification is watched on a phone, so the 4K
 	* rendition would burn CPU to produce a file the client downscales anyway.
@@ -9967,7 +10370,30 @@ var NcRuleInputSchema = object({
 	* behaviour, visible to all, read-only in the viewer). Present = personal
 	* rule owned by this userId. Server-stamped; never trusted from a client.
 	*/
-	ownerUserId: string().optional()
+	ownerUserId: string().optional(),
+	/**
+	* May a non-admin snooze this rule for EVERYONE, not just themselves?
+	*
+	* A snooze is personal by default — it silences the person who set it. This
+	* opts THIS rule into the "the gardener is here all afternoon" case, where
+	* silencing the camera for the whole household is legitimate. It silences
+	* other people, so it is off unless a rule deliberately allows it.
+	*
+	* `.optional()`, deliberately NOT `.default()`: a Zod default does not run on
+	* the addon cap path (three production failures in one day), so absent is
+	* read as `false` by {@link canSetGlobal} in the engine. Admins are not bound
+	* by this flag — see the scope rules on that function.
+	*/
+	snoozeAllowGlobal: boolean().optional(),
+	/**
+	* Devices this rule ACTUATES — arm the alarm, open a gate, turn on a light.
+	*
+	* This is what makes the rule set the alarm's trigger set without the alarm
+	* being a special case: arming is
+	* `{ cap: 'alarm-panel', method: 'arm', args: { mode: 'away' } }`, the same
+	* shape as every other actuation.
+	*/
+	actions: NcRuleActionsSchema.optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -10038,7 +10464,8 @@ var NcConditionDescriptorSchema = object({
 		"packagePhase",
 		"crossingSelect",
 		"polygonDraw",
-		"occupancy"
+		"occupancy",
+		"deviceState"
 	]),
 	operator: _enum([
 		"in",
@@ -10052,7 +10479,28 @@ var NcConditionDescriptorSchema = object({
 	/** Which delivery kinds the condition applies to. */
 	appliesTo: array(NcDeliverySchema),
 	phase: string(),
-	description: string().optional()
+	description: string().optional(),
+	/**
+	* The CHOICES for a single-choice widget (`sourceSelect`, `crossingSelect`,
+	* `packagePhase`, …), served with the descriptor.
+	*
+	* Before this the descriptor said which widget to render and not what to put
+	* in it, so every option list lived in three places: this file's enums, the
+	* admin's `NC_*_OPTIONS` and the viewer's `NC_*_VALUES`. That triple mirror
+	* is the drift that emptied the viewer's rule editor on 2026-08-04 — the app
+	* mirrors the cap by hand, so it is only ever as current as its last build.
+	*
+	* With the options on the wire, a condition of an EXISTING `valueType` costs
+	* zero client changes. Clients keep a local fallback for an older hub that
+	* does not send them; absent here is "use your own list", not "no choices".
+	*/
+	options: array(object({
+		/** Written to the rule verbatim. `''` means the ABSENT state. */
+		value: string(),
+		label: string(),
+		/** What THIS choice matches — shown one at a time, under the control. */
+		hint: string().optional()
+	})).readonly().optional()
 });
 /**
 * The delivery lifecycle status of a history row — a straight read of the
@@ -10137,6 +10585,74 @@ var NcHistoryFilterSchema = object({
 	until: number().optional(),
 	limit: number().int().min(1).max(500).default(100)
 });
+/**
+* What a snooze covers. Broader scopes win when several overlap, so one window
+* leaves ONE digest rather than a rule snooze and a whole-feed snooze both
+* summarising the same silence.
+*/
+var NcSnoozeScopeSchema = _enum([
+	"rule",
+	"device",
+	"all"
+]);
+/**
+* Client-authored snooze. The server stamps `userId`, `startedAt` and
+* `expiresAt` — a DURATION is sent rather than an instant so a client with a
+* skewed clock cannot author a window that is already over, or never ends.
+*/
+var NcSnoozeInputSchema = object({
+	scope: NcSnoozeScopeSchema,
+	/** Required when `scope: 'rule'` — a scoped snooze with no id matches
+	*  NOTHING rather than degrading to "everything". */
+	ruleId: string().optional(),
+	/** Required when `scope: 'device'`. */
+	deviceId: number().int().optional(),
+	durationMinutes: number().int().min(1).max(1440),
+	/**
+	* Silence this for EVERY recipient, not just the caller. Permission is
+	* checked server-side (the rule's `snoozeAllowGlobal`, or admin for the
+	* broader scopes). Absent = personal.
+	*/
+	global: boolean().optional(),
+	/**
+	* Deliver a summary of what was suppressed when the window ends. Absent =
+	* ON: someone silencing a nuisance camera wants it off, someone silencing a
+	* SECURITY camera wants to know what they missed, and choosing "off" for
+	* everybody is how a snooze becomes an outage. Resolved to a concrete
+	* boolean by the server at create time — never left to a Zod default, which
+	* does not run on the addon cap path.
+	*/
+	summary: boolean().optional()
+});
+/** A persisted snooze window. */
+var NcSnoozeSchema = object({
+	id: string(),
+	/** Who set it. Also who it silences, unless `global`. */
+	userId: string(),
+	scope: NcSnoozeScopeSchema,
+	ruleId: string().optional(),
+	deviceId: number().int().optional(),
+	startedAt: number(),
+	/** Exclusive: at exactly this instant the snooze is over. Expiry is a
+	*  COMPARISON, not a job — no sweeper can leave the operator silenced. */
+	expiresAt: number(),
+	global: boolean(),
+	summary: boolean(),
+	/** When the end-of-window digest went out. Absent = not sent (yet, or the
+	*  window has not closed, or `summary` is false). */
+	digestSentAt: number().optional()
+});
+object({
+	snoozeId: string(),
+	targetId: string(),
+	ruleId: string(),
+	ruleName: string(),
+	deviceId: number().int(),
+	/** How many notifications this snooze hid for that pair. */
+	count: number().int(),
+	firstAt: number(),
+	lastAt: number()
+});
 method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), method(object({ ruleId: string() }), object({ rule: NcRuleSchema.nullable() }), { auth: "admin" }), method(object({ rule: NcRuleInputSchema }), object({ rule: NcRuleSchema }), {
 	kind: "mutation",
 	auth: "admin",
@@ -10166,7 +10682,13 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), method(object({}), object({
 	catalog: array(NcConditionDescriptorSchema),
 	taxonomy: NcTaxonomySchema.optional()
-})), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" });
+})), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" }), method(object({}), object({ snoozes: array(NcSnoozeSchema) }), { caller: "required" }), method(object({ snooze: NcSnoozeInputSchema }), object({ snooze: NcSnoozeSchema }), {
+	kind: "mutation",
+	caller: "required"
+}), method(object({ snoozeId: string() }), object({ success: literal(true) }), {
+	kind: "mutation",
+	caller: "required"
+});
 /**
 * TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
 *
@@ -11186,7 +11708,15 @@ method(object({
 	format: _enum(["gif", "mp4"]).default("gif"),
 	maxWidth: number().int().min(120).max(1920).default(480),
 	/** GIF only — MP4 keeps the source cadence. */
-	fps: number().int().min(1).max(15).default(5)
+	fps: number().int().min(1).max(15).default(5),
+	/**
+	* Playback rate. A notification clip is GLANCED at on a lock screen,
+	* not watched, so 2x is the default: the recipient sees the whole
+	* passage in half the time and the GIF is half the bytes. `1` is real
+	* time. Applies to MP4 as well — the operator set a speed, not a GIF
+	* speed.
+	*/
+	speed: number().min(1).max(8).default(2)
 }), object({
 	base64: string(),
 	mime: string(),
@@ -18312,6 +18842,20 @@ var GetInputSchema = object({ id: string() });
 var AddInputSchema = object({
 	kind: string().min(1),
 	name: string().min(1),
+	/**
+	* ADOPT an existing id instead of minting a new one.
+	*
+	* Written the day this cost an outage. A broker's id is not a detail: HA
+	* devices carry it inside their `stableId` (`ha:ha_004:dev:…`), so a broker
+	* lost from config and re-added as `ha_001` leaves every one of its devices
+	* bound to a broker that no longer exists. Re-entering the password under the
+	* ORIGINAL id turns a multi-step device migration back into re-entering a
+	* password.
+	*
+	* A provider MUST refuse an id that is already in use — adopting a live
+	* broker's id would silently take it over.
+	*/
+	id: string().min(1).optional(),
 	/** Kind-specific settings (e.g. MQTT `{url,username,password}` or HA
 	*  `{baseUrl,accessToken}`). Validated by the kind-specific provider
 	*  branch on receipt — invalid shape rejects the add. */
@@ -19423,7 +19967,20 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ addonId: string() }), array(SavedDeviceRowSchema)), method(object({ addonId: string().optional() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
+}), method(object({ addonId: string() }), array(SavedDeviceRowSchema)), method(object({
+	addonId: string().optional(),
+	/**
+	* `slim` omits `config` (returned `{}`), `metadata` (null) and the
+	* `sourceInfo` derived from config — and skips the per-device settings
+	* read that produces them. Everything identifying a device (id, name,
+	* type, online, features, isCamera, parent/link ids) is unchanged.
+	* Do not use it for dispatch routing, which needs `sourceInfo`.
+	*/
+	projection: _enum(["full", "slim"]).optional(),
+	/** Return only camera devices. Filtering server-side instead of
+	*  shipping 293 rows to find 12. */
+	isCamera: boolean().optional()
+}), array(DeviceInfoSchema)), method(object({ deviceId: number() }), DeviceInfoSchema.nullable()), method(object({ parentDeviceId: number() }), array(DeviceInfoSchema)), method(object({ deviceId: number() }), object({
 	mode: DeviceLinkModeSchema,
 	devices: array(LinkedDeviceSchema)
 })), method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)), method(object({ deviceId: number() }), array(ConfigEntrySchema)), method(object({ deviceId: number() }), ConfigUISchemaOutput), method(object({
@@ -19862,14 +20419,14 @@ var LlmProfileSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$1 = unknown();
+var ConfigSchemaPassthrough = unknown();
 var LlmProfileKindDescriptorSchema = object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
-	configSchema: ConfigSchemaPassthrough$1
+	configSchema: ConfigSchemaPassthrough
 });
 var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
 var LlmDefaultSchema = object({
@@ -20366,275 +20923,136 @@ var StatusSchema = object({
 	embeddedRunning: boolean()
 });
 method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema), method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(IdInputSchema, TestResultSchema$1, { kind: "mutation" }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(_void(), StatusSchema);
-var NetworkEndpointSchema = object({
-	url: string(),
-	hostname: string(),
-	port: number(),
-	protocol: _enum(["http", "https"])
-});
-var NetworkAccessStatusSchema = object({
-	connected: boolean(),
-	endpoint: NetworkEndpointSchema.nullable(),
-	error: string().optional()
-});
-/**
-* Optional, richer endpoint shape returned by providers that expose
-* MORE than one ingress concurrently (Tailscale Ingress with mixed
-* serve+funnel rules, future ngrok multi-tunnel, …). Each entry carries
-* the originating provider config (mode + sourcePort) so the
-* orchestrator UI can label rows distinctly. Providers that expose only
-* one endpoint just omit `listEndpoints` from their provider impl.
-*/
-var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
-	/**
-	* Stable id within the provider — typically `<mode>-<sourcePort>` so
-	* the orchestrator can dedupe across `listEndpoints` polls.
-	*/
-	id: string(),
-	/** Operator-facing label (mirrors `MeshEndpoint.label`). */
-	label: string(),
-	/** Optional provider-specific mode tag, used for icon/colour in admin UI. */
-	mode: string().optional(),
-	/** Originating local port the ingress fronts (informational). */
-	sourcePort: number().optional()
-});
-method(_void(), NetworkEndpointSchema, { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), NetworkEndpointSchema.nullable()), method(_void(), NetworkAccessStatusSchema), method(_void(), array(NetworkEndpointEntrySchema).readonly());
-/**
-* notification-output — canonical, capability-gated notification delivery.
-*
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
-*
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
-*
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = _enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: string().optional(),
-	bytes: _instanceof(Uint8Array).optional(),
-	mime: string().optional(),
-	name: string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = _enum([
-	"text",
-	"markdown",
-	"html"
-]);
-/** A single tap-through action button. */
-var NotificationActionSchema = object({
-	id: string(),
-	label: string(),
-	url: string().optional()
-});
-/**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
-*/
-var NotificationSchema = object({
-	body: string(),
-	title: string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: number().int().min(1).max(5).default(3),
-	level: string().optional(),
-	attachments: array(AttachmentSchema).optional(),
-	clickUrl: string().optional(),
-	actions: array(NotificationActionSchema).optional(),
-	sound: string().optional(),
-	ttl: number().optional(),
-	tag: string().optional(),
-	deviceId: number().optional(),
-	eventId: string().optional(),
-	metadata: record(string(), unknown()).optional()
-});
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = object({
-	id: string(),
-	label: string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: number().int().min(1).max(5).nullable(),
-	flags: object({
-		critical: boolean().optional(),
-		silent: boolean().optional(),
-		noPush: boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: array(string()).optional(),
-	description: string().optional()
+var NetworkEndpointSchema = object({
+	url: string(),
+	hostname: string(),
+	port: number(),
+	protocol: _enum(["http", "https"])
 });
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = object({
-	attachments: object({
-		mediaTypes: array(AttachmentMediaTypeSchema),
-		mode: _enum([
-			"url",
-			"bytes",
-			"both"
-		]),
-		max: number().int().nonnegative(),
-		maxBytes: number().int().positive().optional()
-	}),
-	/** Max action buttons (0 = none). */
-	actions: number().int().nonnegative(),
-	levels: array(TargetKindLevelSchema),
-	format: array(NotificationFormatSchema),
-	clickUrl: boolean(),
-	sound: boolean(),
-	ttl: boolean(),
-	bodyMaxLen: number().int().positive()
+var NetworkAccessStatusSchema = object({
+	connected: boolean(),
+	endpoint: NetworkEndpointSchema.nullable(),
+	error: string().optional()
 });
 /**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+* Optional, richer endpoint shape returned by providers that expose
+* MORE than one ingress concurrently (Tailscale Ingress with mixed
+* serve+funnel rules, future ngrok multi-tunnel, …). Each entry carries
+* the originating provider config (mode + sourcePort) so the
+* orchestrator UI can label rows distinctly. Providers that expose only
+* one endpoint just omit `listEndpoints` from their provider impl.
 */
-var ConfigSchemaPassthrough = unknown();
-var TargetKindSchema = object({
-	kind: string(),
-	label: string(),
-	icon: string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: string(),
-	/**
-	* URL of the kind's bundled BRAND icon, served by the providing addon over
-	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
-	* when the addon bundles no icon for that kind — the client then falls back
-	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
-	*
-	* Root-relative on purpose: it resolves against whatever origin serves a web
-	* client, and a native client joins it onto its own hub base.
-	*
-	* DECLARED here deliberately. It used to travel as an undeclared passthrough
-	* field that survived only because the runtime cap-router forwards provider
-	* output verbatim — so every consumer had to re-declare it by hand to stop
-	* its own Zod parse from stripping it, and the whole arrangement would have
-	* broken silently the moment output validation was tightened anywhere.
-	*/
-	iconUrl: string().optional(),
+var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
 	/**
-	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
-	*
-	* The server knows this and therefore says it, because the client cannot
-	* safely guess: a React-Native client renders SVG and raster through two
-	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
-	* not decode SVG on iOS/Android), so without this it silently fell back to a
-	* placeholder glyph for every vector icon while the web build looked fine.
-	*
-	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
-	* not been updated — a client that cannot determine the type should prefer
-	* its raster path, which is the safe default for an unknown image.
+	* Stable id within the provider — typically `<mode>-<sourcePort>` so
+	* the orchestrator can dedupe across `listEndpoints` polls.
 	*/
-	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough,
-	supportsDiscovery: boolean(),
-	caps: TargetKindCapsSchema
+	id: string(),
+	/** Operator-facing label (mirrors `MeshEndpoint.label`). */
+	label: string(),
+	/** Optional provider-specific mode tag, used for icon/colour in admin UI. */
+	mode: string().optional(),
+	/** Originating local port the ingress fronts (informational). */
+	sourcePort: number().optional()
 });
+method(_void(), NetworkEndpointSchema, { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), NetworkEndpointSchema.nullable()), method(_void(), NetworkAccessStatusSchema), method(_void(), array(NetworkEndpointEntrySchema).readonly());
 /**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
-*/
-var TargetSchema = object({
-	id: string(),
-	name: string(),
-	kind: string(),
-	addonId: string(),
+* core-blocks — user-authored TypeScript, stored in the kernel and executed in
+* its own process.
+*
+* Spec: `docs/superpowers/specs/2026-08-04-core-blocks-and-synthetic-devices-design.md`.
+*
+* The first use is **owning devices without being a device provider**: a block
+* declares devices under a system or custom integration and drives their state,
+* with the same `ctx` an addon gets. Automations come later; nothing here
+* models a trigger.
+*
+* **Stated plainly, because it does not change by being true:** a block has an
+* addon's powers — devices, storage, the event bus, `ctx.api`. It is a plugin
+* with no review step. What makes that survivable is not a sandbox, it is
+* PROCESS ISOLATION: one process per block, supervised by `CrashSupervisor`,
+* so a block that throws or never returns is marked `failed` and visible
+* instead of taking the hub with it (D6). Every method here is admin-only, and
+* must stay so.
+*/
+/** Where a block runs. The operator chooses — a block driving a device on an
+*  agent is the reason placement is not fixed to the hub. */
+var CoreBlockPlacementSchema = union([literal("hub"), string().min(1)]);
+/** What a block's process is doing. Mirrors the addon runner's own lifecycle so
+*  a failing block reads the same way a failing addon does. */
+var CoreBlockStatusSchema = _enum([
+	"stopped",
+	"starting",
+	"running",
+	"failed"
+]);
+/** Client-authored fields. */
+var CoreBlockInputSchema = object({
+	name: string().min(1).max(120),
+	/** TypeScript source. Compiled server-side before it is ever stored — a
+	*  block that does not compile is a fork failure the operator would meet
+	*  minutes later, in a log, instead of in the editor. */
+	code: string().max(2e5),
 	enabled: boolean(),
-	config: record(string(), unknown())
-});
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = object({
-	kind: string(),
-	suggestedName: string(),
-	config: record(string(), unknown())
+	placement: CoreBlockPlacementSchema,
+	/**
+	* Integration the block's devices hang from. Absent = the system integration
+	* blocks share. A block may declare its own instead.
+	*/
+	integrationId: string().optional()
 });
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = object({
-	level: string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: number().int().nonnegative(),
-	actionsSent: number().int().nonnegative(),
-	truncated: boolean(),
-	dropped: array(string())
+/** A stored block. */
+var CoreBlockSchema = CoreBlockInputSchema.extend({
+	id: string(),
+	createdAt: number(),
+	updatedAt: number(),
+	/** Server-stamped author. */
+	createdBy: string(),
+	status: CoreBlockStatusSchema,
+	/**
+	* Why the block is not running, when it is not. The operator's ONLY window
+	* into a block that failed at load — a block that is silently absent is the
+	* failure mode this whole feature has to avoid.
+	*/
+	lastError: string().optional(),
+	/** Ms epoch of the last state change. */
+	lastChangedAt: number()
 });
-var SendResultSchema = object({
-	success: boolean(),
+/** What a compile attempt produced. */
+var CoreBlockCompileResultSchema = object({
+	ok: boolean(),
+	/** Present when `ok` is false — the first error, in the author's words. */
 	error: string().optional(),
-	renderedAs: RenderedAsSchema.optional()
+	line: number().optional(),
+	column: number().optional()
 });
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
-var notificationOutputCapability = {
-	name: "notification-output",
-	scope: "system",
-	mode: "collection",
-	methods: {
-		listTargetKinds: method(object({}), array(TargetKindSchema)),
-		listTargets: method(object({}), array(TargetSchema)),
-		discoverTargets: method(object({
-			kind: string(),
-			config: record(string(), unknown()).optional()
-		}), array(DiscoveredTargetSchema)),
-		send: method(object({
-			targetId: string(),
-			notification: NotificationSchema
-		}), SendResultSchema, { kind: "mutation" }),
-		testTarget: method(object({
-			targetId: string(),
-			sample: NotificationSchema.optional()
-		}), TestResultSchema, { kind: "mutation" }),
-		upsertTarget: method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }),
-		deleteTarget: method(object({ targetId: string() }), _void(), { kind: "mutation" }),
-		setTargetEnabled: method(object({
-			targetId: string(),
-			enabled: boolean()
-		}), _void(), { kind: "mutation" })
-	}
-};
+method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }), method(object({ blockId: string() }), object({ block: CoreBlockSchema.nullable() }), { auth: "admin" }), method(object({ block: CoreBlockInputSchema }), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({
+	blockId: string(),
+	block: CoreBlockInputSchema.partial()
+}), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ blockId: string() }), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	blockId: string(),
+	enabled: boolean()
+}), object({ block: CoreBlockSchema }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ code: string() }), CoreBlockCompileResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({ libs: array(object({
+	filePath: string(),
+	content: string()
+})) }), { auth: "admin" });
 /**
 * Zod schemas for persisted record types.
 *
@@ -20882,6 +21300,11 @@ var EventKindDescriptorSchema = object({
 		deviceId: number()
 	})
 });
+/** One camera's event vocabulary, as returned by `listEventKindsBatch`. */
+var EventKindsForDeviceSchema = object({
+	deviceId: number(),
+	kinds: array(EventKindDescriptorSchema).readonly()
+});
 var SensorEventSchema = object({
 	id: string(),
 	/** The CAMERA the event is attributed to (a sensor linked to N cameras
@@ -21138,6 +21561,19 @@ var MediaFileSchema = object({
 	sizeBytes: number(),
 	timestamp: number()
 });
+/**
+* One media row WITHOUT its bytes.
+*
+* A track's media is 5-8 MB of base64 (measured: 7.67 MB across 23 files for a
+* 140 s track), and a client that renders tiles from the media data plane needs
+* to know only WHAT EXISTS — the bytes then arrive per tile, lazily, over HTTP
+* with an immutable cache, instead of all at once inside a tRPC response that
+* blocks the whole view.
+*
+* `sizeBytes` is carried because it is what lets a client decide between the
+* stored blob and a `?variant=thumb` rendering without fetching either.
+*/
+var MediaFileInfoSchema = MediaFileSchema.omit({ base64: true });
 var DEFAULT_EVENT_QUERY_LIMIT = 1e3;
 var MAX_EVENT_QUERY_LIMIT = 5e3;
 var DeviceEventQueryInput = object({
@@ -21287,7 +21723,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({
+}), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({ deviceIds: array(number()).min(1).max(200) }), array(EventKindsForDeviceSchema).readonly()), method(object({
 	deviceId: number(),
 	since: number().optional(),
 	until: number().optional(),
@@ -21361,7 +21797,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(MediaFileSchema).readonly()), method(object({
 	trackId: string(),
 	kinds: array(MediaFileKindEnum).optional()
-}), array(MediaFileSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), object({
+}), array(MediaFileSchema).readonly()), method(object({ trackId: string() }), array(MediaFileInfoSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), object({
 	deviceId: number(),
 	timestamp: number(),
 	frameWidth: number(),
@@ -26040,6 +26476,54 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"coreBlocks.compile": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"coreBlocks.create": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"coreBlocks.delete": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"coreBlocks.get": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"coreBlocks.getTypeDefs": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"coreBlocks.list": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"coreBlocks.setEnabled": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"coreBlocks.update": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"cover.close": {
 		capName: "cover",
 		capScope: "device",
@@ -27948,12 +28432,24 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.cancelSnooze": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.createRule": {
 		capName: "notification-rules",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.createSnooze": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationRules.deleteRule": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -27984,6 +28480,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationRules.listSnoozes": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationRules.setRuleEnabled": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -28188,6 +28690,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listEventKindsBatch": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listOpsLog": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -28200,6 +28708,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listTrackMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -30670,11 +31184,18 @@ var HaBaseChildDevice = class HaBaseChildDevice extends BaseDevice {
 	async onActivate() {
 		await super.onActivate();
 		await this.refreshFeatures();
-		await this.subscribeBrokerEntity();
-		this.deviceLogger.info("HA entity ready", { meta: {
+		if (await this.subscribeBrokerEntity()) {
+			this.deviceLogger.info("HA entity ready", { meta: {
+				entityId: this.entityId,
+				type: this.ctx.deviceMeta.type,
+				...this.features.length > 0 ? { features: [...this.features] } : {}
+			} });
+			return;
+		}
+		this.deviceLogger.warn("HA entity registered but NOT subscribed — it will receive nothing", { meta: {
 			entityId: this.entityId,
-			type: this.ctx.deviceMeta.type,
-			...this.features.length > 0 ? { features: [...this.features] } : {}
+			brokerId: this.brokerId,
+			type: this.ctx.deviceMeta.type
 		} });
 	}
 	async removeDevice() {
@@ -30778,6 +31299,8 @@ var HaBaseChildDevice = class HaBaseChildDevice extends BaseDevice {
 	* already-attached handler and `handleStatePush` fires with the real
 	* current state (seeding the cap-state slice at construction time).
 	*/
+	/** True when the entity is genuinely subscribed. The caller uses it to
+	*  decide whether "ready" is an honest thing to log. */
 	async subscribeBrokerEntity() {
 		try {
 			const result = await this.ctx.api.broker.subscribe.mutate({
@@ -30785,12 +31308,14 @@ var HaBaseChildDevice = class HaBaseChildDevice extends BaseDevice {
 				filter: { entityIds: [this.entityId] }
 			});
 			this.brokerSubscriptionId = result.subscriptionId;
+			return true;
 		} catch (err) {
 			this.deviceLogger.warn("ha-child failed to register broker subscription", { meta: {
 				entityId: this.entityId,
 				brokerId: this.brokerId,
 				error: errMsg(err)
 			} });
+			return false;
 		}
 	}
 	attachEventBusListener() {
@@ -35605,6 +36130,27 @@ var HaBrokerRegistry = class {
 		this.nextIdCounter += 1;
 		return id;
 	}
+	/**
+	* Take a caller-supplied id, or refuse.
+	*
+	* Two refusals, and both matter more than they look:
+	*
+	*  - **An id already in use** would SILENTLY take over a live broker: the new
+	*    entry replaces it in config while its devices keep pointing at the id,
+	*    now serving someone else's Home Assistant. Recovery is re-creating a
+	*    broker that is GONE, never overwriting one that is here.
+	*  - **The progressive counter is advanced past an adopted id.** Adopting
+	*    `ha_004` while the counter sits at 2 would let the next automatic
+	*    allocation mint `ha_004` a second time — two brokers, one id, and every
+	*    device bound to whichever won. The counter is only seeded from stored
+	*    entries at load, so it cannot discover this on its own.
+	*/
+	adoptId(id) {
+		if (this.managers.has(id)) throw new Error(`broker id "${id}" is already in use — adopt an id only to restore a broker that is gone`);
+		const match = id.match(/^ha_(\d+)$/);
+		if (match) this.nextIdCounter = Math.max(this.nextIdCounter, Number.parseInt(match[1], 10) + 1);
+		return id;
+	}
 	seedCounterFromEntries(entries) {
 		let maxSeen = 0;
 		for (const e of entries) {
@@ -35624,7 +36170,7 @@ var HaBrokerRegistry = class {
 	async createEntry(name, settings, options = {}) {
 		const auth = settingsToAuth(settings);
 		const entry = {
-			id: this.allocateId(),
+			id: options.id !== void 0 ? this.adoptId(options.id) : this.allocateId(),
 			name,
 			auth,
 			...options.integrationId !== void 0 ? { integrationId: options.integrationId } : {}
@@ -36814,6 +37360,7 @@ function homeassistantTargetKind(addonId) {
 				max: 1
 			},
 			actions: 3,
+			actionIcons: true,
 			levels: [
 				{
 					id: "default",
@@ -36869,6 +37416,21 @@ function applyLevel(data, level) {
 	}
 	data["push"] = push;
 }
+var HA_ACTION_ICONS = {
+	acknowledge: "mdi:check",
+	dismiss: "mdi:close",
+	silence: "mdi:bell-off",
+	view: "mdi:eye",
+	play: "mdi:play",
+	open: "mdi:door-open",
+	close: "mdi:door-closed",
+	lock: "mdi:lock",
+	unlock: "mdi:lock-open",
+	arm: "mdi:shield-check",
+	disarm: "mdi:shield-off",
+	light: "mdi:lightbulb",
+	alert: "mdi:alert"
+};
 /**
 * Build the `notify.<service>` `service_data` from a prepared (degraded)
 * notification. PURE — no WS, unit-testable in isolation.
@@ -36885,7 +37447,8 @@ function buildNotifyServiceData(prepared) {
 	if (prepared.actions.length > 0) data["actions"] = prepared.actions.map((a) => ({
 		action: a.id,
 		title: a.label,
-		...a.url !== void 0 ? { uri: a.url } : {}
+		...a.url !== void 0 ? { uri: a.url } : {},
+		...a.icon !== void 0 ? { icon: HA_ACTION_ICONS[a.icon] } : {}
 	}));
 	if (prepared.clickUrl !== null) {
 		data["url"] = prepared.clickUrl;
@@ -37229,6 +37792,19 @@ async function reconcileBroker(brokerId, deps) {
 * whose integration no longer exists should be cleaned up. Brokers with no
 * integrationId were created manually and are never auto-removed.
 */
+/**
+* Brokers whose spawning integration is gone.
+*
+* **The caller REPORTS these; it does not delete them.** This function used to
+* drive a delete, and on 2026-08-05 that erased the operator's Home Assistant
+* broker — host and token — when `integrations.list` returned an empty array
+* during a hub restart: nothing "survived", so everything was an orphan. A
+* broker cannot be rebuilt from an integration record, so the loss was
+* permanent and the doorbell simply stopped existing.
+*
+* Kept as a pure query because naming an orphan is useful; acting on one
+* automatically is not.
+*/
 function computeBrokerCleanup(brokers, survivingIntegrationIds) {
 	return brokers.filter((b) => b.integrationId !== void 0 && !survivingIntegrationIds.has(b.integrationId)).map((b) => b.id);
 }
@@ -37816,15 +38392,15 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 			}
 			const linkedBrokers = linkBrokersToIntegrations(this.config.brokers, integrationsWithBrokerId);
 			if (linkedBrokers.some((b, i) => b !== this.config.brokers[i])) await this.updateGlobalSettings({ brokers: linkedBrokers });
-			const toRemove = computeBrokerCleanup(this.config.brokers, survivingIntegrationIds);
-			if (toRemove.length === 0) return;
-			for (const id of toRemove) await this.requireRegistry().removeEntry(id);
-			const nextBrokers = this.config.brokers.filter((b) => !toRemove.includes(b.id));
-			await this.updateGlobalSettings({ brokers: nextBrokers });
+			const orphans = computeBrokerCleanup(this.config.brokers, survivingIntegrationIds);
 			this.ctx.logger.info("integration→broker reconcile", { meta: {
-				brokerCount: nextBrokers.length,
+				brokerCount: this.config.brokers.length,
 				integrationCount: haIntegrations.length,
-				removed: toRemove.length
+				orphans: orphans.length
+			} });
+			if (orphans.length > 0) this.ctx.logger.warn("broker entries have no surviving integration — KEPT", { meta: {
+				brokerIds: orphans,
+				integrationCount: haIntegrations.length
 			} });
 		} catch (err) {
 			this.ctx.logger.warn("integration→broker reconcile failed", { meta: { error: errMsg(err) } });
@@ -37958,9 +38534,13 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 					label: "Home Assistant"
 				}]
 			}],
-			add: async ({ kind, name, settings }) => {
+			add: async ({ kind, name, settings, id }) => {
 				if (kind !== HA_KIND) throw new Error(`provider-homeassistant: only kind '${HA_KIND}' is handled here (got '${kind}')`);
-				const entry = await this.requireRegistry().createEntry(name, settings);
+				const entry = await this.requireRegistry().createEntry(name, settings, { ...id !== void 0 ? { id } : {} });
+				if (id !== void 0) this.ctx.logger.info("broker restored under an adopted id", { meta: {
+					brokerId: entry.id,
+					name
+				} });
 				await this.updateGlobalSettings({ brokers: [...this.config.brokers, entry] });
 				return { id: entry.id };
 			},