@camstack/addon-provider-reolink 1.2.4 → 1.2.6

package/dist/addon.mjs

@@ -21,7 +21,7 @@ import netImpl from "net";
 import { fileURLToPath } from "url";
 import { mkdir } from "fs/promises";
 import os from "node:os";
-//#region ../types/dist/event-category-D4HJq7Mw.mjs
+//#region ../types/dist/event-category-BLcNejAE.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -171,9 +171,6 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["RecordingSegmentWritten"] = "recording.segment.written";
 	EventCategory["RecordingPolicyFallback"] = "recording.policy.fallback";
 	EventCategory["RecordingRetentionCompleted"] = "recording.retention.completed";
-	/** Runner-sampled scrub thumbnail (~1/5 s/camera). Telemetry (D8): a lost
-	*  thumb is a scrub gap the recorder's keyframe backfill covers. */
-	EventCategory["RecordingThumbSampled"] = "recording.thumb-sampled";
 	/** Export render progress (0–100). Telemetry (D8): a lost tick is a stale
 	*  progress bar the client reconciles via `recordingExport.getExport`. */
 	EventCategory["RecordingExportProgress"] = "recording.export.progress";
@@ -6838,7 +6835,6 @@ object({ deviceId: number() }), object({ deviceId: number() }), object({
 	patch: record(string(), unknown())
 }), object({ success: literal(true) });
 object({ deviceId: number() }), unknown().nullable();
-/** Shorthand to define a method schema */
 function method(input, output, options) {
 	return {
 		input,
@@ -6846,6 +6842,7 @@ function method(input, output, options) {
 		kind: options?.kind ?? "query",
 		auth: options?.auth ?? "protected",
 		...options?.access !== void 0 ? { access: options.access } : {},
+		...options?.caller !== void 0 ? { caller: options.caller } : {},
 		timeoutMs: options?.timeoutMs
 	};
 }
@@ -8402,6 +8399,59 @@ for (const l of AUDIO_MACRO_LABELS) {
 /** The complete taxonomy dictionary, keyed by kind. */
 var EVENT_TAXONOMY = Object.freeze(Object.fromEntries(entries));
 /**
+* Notification-Center taxonomy — the fixed vocabulary the NC rule editor
+* offers as pickers instead of free text. Derived (never hand-listed) from the
+* single `EVENT_TAXONOMY` dictionary so it stays in lockstep with every other
+* taxonomy surface (timeline, filters, event page).
+*
+* Three buckets, mapped onto the rule editor's `stringList` conditions:
+*   - `videoClasses` → detection classes (person / vehicle / animal + subs)
+*     for the `classes` / `classesExclude` conditions.
+*   - `audioKinds`   → audio-analyzer sub kinds (`audio-scream`, …) shown in
+*     the same class picker, grouped under an Audio header.
+*   - `labels`       → sensor + control taxonomy kinds (doorbell / contact /
+*     lock / …) for the `sensorKinds` device-event condition.
+*
+* Each entry carries `parentKind` so the client can group video subs under
+* their macro and sensor/control kinds under their category. This surface is
+* served ADDITIVELY on the `nc.getConditionCatalog` bridge response — no cap
+* method, no codegen — so it ships train-free with an addon deploy.
+*/
+/** One selectable taxonomy value: a stable kind id + display label + parent. */
+var NcTaxonomyEntrySchema = object({
+	/** Stable kind id (e.g. 'person', 'car', 'audio-scream', 'doorbell'). */
+	kind: string(),
+	/** English fallback label (the UI translates via the event-kind i18n key). */
+	label: string(),
+	/** Macro/category parent for grouping ('car' → 'vehicle'); null for a top. */
+	parentKind: string().nullable()
+});
+object({
+	videoClasses: array(NcTaxonomyEntrySchema),
+	audioKinds: array(NcTaxonomyEntrySchema),
+	labels: array(NcTaxonomyEntrySchema)
+});
+function toEntry(kind, label, parentKind) {
+	return {
+		kind,
+		label,
+		parentKind
+	};
+}
+/**
+* Build the NC taxonomy from `EVENT_TAXONOMY`. Insertion order is preserved
+* (macros before their subs), which the client relies on for stable grouping.
+*/
+function buildNcTaxonomy() {
+	const all = Object.values(EVENT_TAXONOMY);
+	return {
+		videoClasses: all.filter((e) => e.category === "detection").map((e) => toEntry(e.kind, e.label, e.parentKind)),
+		audioKinds: all.filter((e) => e.category === "audio" && e.level === "sub").map((e) => toEntry(e.kind, e.label, e.parentKind)),
+		labels: all.filter((e) => e.category === "sensor" || e.category === "control").map((e) => toEntry(e.kind, e.label, e.parentKind))
+	};
+}
+Object.freeze(buildNcTaxonomy());
+/**
 * Error types for the safe expression engine. Two distinct classes so callers
 * can tell a compile-time (grammar) failure from a runtime (evaluation)
 * failure — both are non-fatal to the host: read paths degrade to "skip link".
@@ -12426,6 +12476,22 @@ var CameraMetricsSchema = object({
 	])
 });
 var CameraMetricsWithDeviceIdSchema = CameraMetricsSchema.extend({ deviceId: number() });
+/**
+* Reference to the frame's retained NATIVE surface + the parent crop's placement
+* within the frame, so the executor can re-cut a leaf child ROI at native
+* resolution on the detail plane. See the `runPipeline` `nativeCropRef` field.
+*/
+var NativeCropRefSchema = object({
+	/** Handle keying the retained native surface (node-pinned to its owner). */
+	handle: FrameHandleSchema,
+	/** The parent crop's padded/clamped rectangle in FRAME-space pixels. */
+	cropFrameSpace: object({
+		x: number(),
+		y: number(),
+		w: number(),
+		h: number()
+	})
+});
 var ModelFormatSchema$1 = _enum([
 	"onnx",
 	"coreml",
@@ -12701,7 +12767,22 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	* Omitted ⇒ the runner's default device (current single-engine
 	* behaviour). Selects WHICH device pool of the node runs the call.
 	*/
-	deviceKey: string().optional()
+	deviceKey: string().optional(),
+	/**
+	* Two-plane NATIVE child-crop reference. Set by `runDetailSubtree` ONLY
+	* when the parent crop was resolved from the frame's retained NATIVE
+	* surface (a frameHandle HIT). Lets the executor re-cut a LEAF crop
+	* child's ROI (plate-ocr, face-embedding, leaf classifiers) at native
+	* resolution from that surface — the SAME quality path faces already
+	* had — instead of the downscaled parent tile. `handle` keys the native
+	* surface (node-pinned to its owner); `cropFrameSpace` is the parent
+	* crop's padded/clamped rectangle in FRAME-space pixels, used to compose
+	* the executor's crop-normalized child ROI back into frame-normalized
+	* coordinates. Auxiliary to the image source (`image`/`frame`/…), NOT one
+	* of the mutually-exclusive image inputs. Absent ⇒ tile-crop children
+	* (today's behaviour on the fallback path).
+	*/
+	nativeCropRef: NativeCropRefSchema.optional()
 }), PipelineRunResultBridge, { kind: "mutation" }), method(object({
 	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).min(1),
@@ -12950,7 +13031,11 @@ var DetailResultSchema = object({
 	bbox: NativeCropBboxSchema.optional(),
 	embedding: string().optional(),
 	label: string().optional(),
-	alignedCropJpeg: string().optional()
+	alignedCropJpeg: string().optional(),
+	/** Face short side (px) measured on the NATIVE crop surface. The `bbox`
+	*  above is detection-frame px (≈6× smaller on a 4K camera) — min-face-size
+	*  consumers MUST prefer this when present (2026-07-22 native-gate fix). */
+	nativeFaceShortSidePx: number().optional()
 });
 /**
 * Per-camera tunable ranges + defaults. Single source of truth used
@@ -12964,6 +13049,12 @@ var motionCooldownMsField = {
 	default: 3e4,
 	step: 500
 };
+var maxSessionHoldMsField = {
+	min: 0,
+	max: 6e5,
+	default: 12e4,
+	step: 5e3
+};
 var motionFpsField = {
 	min: 1,
 	max: 30,
@@ -13111,6 +13202,19 @@ var RunnerCameraConfigSchema = object({
 		"on-motion"
 	]).default("always-on"),
 	motionCooldownMs: number().min(motionCooldownMsField.min).default(motionCooldownMsField.default),
+	/**
+	* Orchestrator-side on-motion session-hold cap (ms). While an on-motion
+	* detection session is active and ≥1 confirmed non-stationary track is
+	* still live, the orchestrator keeps the session open past
+	* `motionCooldownMs` (a slowly-moving subject can stop re-triggering the
+	* camera's VMD yet is still being tracked frame-to-frame) — up to this many
+	* ms since the session opened, after which it closes regardless. `0`
+	* disables the hold (legacy cooldown-only teardown). Not consumed by the
+	* runner itself — carried here so it shares the per-camera device-settings
+	* surface with `motionCooldownMs`; the orchestrator reads it off the
+	* resolved `CameraDetectionConfig`.
+	*/
+	maxSessionHoldMs: number().min(maxSessionHoldMsField.min).max(maxSessionHoldMsField.max).optional(),
 	motionFps: number().min(motionFpsField.min).max(motionFpsField.max).default(motionFpsField.default),
 	detectionFps: number().min(detectionFpsField.min).max(detectionFpsField.max).default(detectionFpsField.default),
 	motionStreamId: string(),
@@ -13200,7 +13304,7 @@ var RunnerCameraConfigSchema = object({
 	*/
 	inferenceDevices: array(RunnerInferenceDeviceSchema).readonly().optional()
 });
-motionFpsField.min, motionFpsField.max, motionFpsField.step, motionFpsField.default, detectionFpsField.min, detectionFpsField.max, detectionFpsField.step, detectionFpsField.default, motionCooldownMsField.min, motionCooldownMsField.max, motionCooldownMsField.step, motionCooldownMsField.default, occupancyRecheckSecField.min, occupancyRecheckSecField.max, occupancyRecheckSecField.step, occupancyRecheckSecField.default, occupancyRecheckFramesField.min, occupancyRecheckFramesField.max, occupancyRecheckFramesField.step, occupancyRecheckFramesField.default;
+motionFpsField.min, motionFpsField.max, motionFpsField.step, motionFpsField.default, detectionFpsField.min, detectionFpsField.max, detectionFpsField.step, detectionFpsField.default, motionCooldownMsField.min, motionCooldownMsField.max, motionCooldownMsField.step, motionCooldownMsField.default, maxSessionHoldMsField.min, maxSessionHoldMsField.max, maxSessionHoldMsField.step, maxSessionHoldMsField.default, occupancyRecheckSecField.min, occupancyRecheckSecField.max, occupancyRecheckSecField.step, occupancyRecheckSecField.default, occupancyRecheckFramesField.min, occupancyRecheckFramesField.max, occupancyRecheckFramesField.step, occupancyRecheckFramesField.default;
 /**
 * Runtime load summary returned by `getLocalLoad`. Used by the orchestrator's
 * load-balancing levels (L2 capacity-based, L3 hardware-aware) to decide
@@ -16727,94 +16831,6 @@ var EnrichedWidgetMetadataSchema = WidgetMetadataSchema.extend({
 	bundleUrl: string()
 });
 method(_void(), array(EnrichedWidgetMetadataSchema).readonly());
-var NotificationRuleConditionsSchema = object({
-	deviceIds: array(number()).readonly().optional(),
-	classNames: array(string()).readonly().optional(),
-	zoneIds: array(string()).readonly().optional(),
-	minConfidence: number().optional(),
-	source: _enum([
-		"pipeline",
-		"onboard",
-		"any"
-	]).optional(),
-	schedule: object({
-		days: array(number()).readonly(),
-		startHour: number(),
-		endHour: number()
-	}).optional(),
-	cooldownSeconds: number().optional(),
-	minDwellSeconds: number().optional(),
-	/** Match against `event.data.eventType` token (e.g. `'press_long'`). When non-empty, only events
-	*  carrying a matching `data.eventType` string pass this condition. Rules without this field are
-	*  unaffected (back-compat). Distinct from `rule.eventTypes` which holds EventCategory strings. */
-	eventTypeTokens: array(string()).readonly().optional(),
-	/** Match detections whose CLIP image embedding is semantically similar to this free-text
-	*  description. Requires the embedding-encoder cap to have pre-warmed the text vector.
-	*  `minSimilarity` is the cosine similarity threshold in [0, 1]. */
-	clipDescription: object({
-		text: string().min(1),
-		minSimilarity: number().min(0).max(1)
-	}).optional(),
-	/** Match events whose recognized-entity label (face identity name or plate
-	*  vehicle name, propagated onto `event.data.label`) is one of these values.
-	*  Empty/absent → unaffected (back-compat). Enables "notify me when <named
-	*  vehicle/person> is seen". */
-	labels: array(string()).readonly().optional()
-});
-var NotificationRuleTemplateSchema = object({
-	title: string(),
-	body: string(),
-	imageMode: _enum([
-		"crop",
-		"annotated",
-		"full",
-		"none"
-	])
-});
-var NotificationRuleSchema = object({
-	id: string(),
-	name: string(),
-	enabled: boolean(),
-	eventTypes: array(string()).readonly(),
-	conditions: NotificationRuleConditionsSchema,
-	outputs: array(string()).readonly(),
-	template: NotificationRuleTemplateSchema.optional(),
-	priority: _enum([
-		"low",
-		"normal",
-		"high",
-		"critical"
-	])
-});
-var NotificationTestResultSchema = object({
-	ruleId: string(),
-	eventId: string(),
-	timestamp: number(),
-	wouldFire: boolean(),
-	reason: string().optional()
-});
-var NotificationHistoryEntrySchema = object({
-	id: string(),
-	ruleId: string(),
-	ruleName: string(),
-	eventId: string(),
-	timestamp: number(),
-	outputs: array(string()).readonly(),
-	success: boolean(),
-	error: string().optional(),
-	deviceId: number().optional()
-});
-var NotificationHistoryFilterSchema = object({
-	ruleId: string().optional(),
-	deviceId: number().optional(),
-	from: number().optional(),
-	to: number().optional(),
-	limit: number().optional()
-});
-method(_void(), object({ rules: array(NotificationRuleSchema).readonly() })), method(object({ rule: NotificationRuleSchema }), object({ success: literal(true) }), { kind: "mutation" }), method(object({ ruleId: string() }), object({ success: literal(true) }), { kind: "mutation" }), method(object({
-	ruleId: string(),
-	lookbackMinutes: number()
-}), object({ results: array(NotificationTestResultSchema).readonly() }), { kind: "mutation" }), method(object({ filter: NotificationHistoryFilterSchema.optional() }), object({ entries: array(NotificationHistoryEntrySchema).readonly() }));
 /**
 * Alerts capability — collection-based internal alert system.
 *
@@ -17001,89 +17017,6 @@ method(object({
 	password: string()
 }), AuthResultSchema.nullable(), { kind: "mutation" }), method(object({ state: string() }), string()), method(record(string(), string()), AuthResultSchema, { kind: "mutation" }), method(object({ token: string() }), AuthResultSchema.nullable());
 /**
-* `login-method` — collection cap through which auth addons contribute
-* their pre-auth login surfaces to the login page. This is the SINGLE,
-* generic mechanism that supersedes the dead `auth.listProviders` reader:
-* every auth addon (OIDC, magic-link, WebAuthn/passkey) registers a
-* `login-method` provider and the PUBLIC `auth.listLoginMethods`
-* procedure aggregates them for the unauthenticated login page.
-*
-* A contribution is a discriminated union on `kind`:
-*
-*  - `redirect` — a declarative button. The login page renders a generic
-*    button that navigates to `startUrl` (an addon-owned HTTP route).
-*    Covers OIDC (`/addon/auth-oidc/<id>/start`) and magic-link with
-*    ZERO shell-side JS. A future SSO addon plugs in the same way — the
-*    login page needs NO change.
-*
-*  - `widget` — a Module-Federation widget the login page mounts (via
-*    `loadRemoteBundle`) for an in-page ceremony. `auth.listLoginMethods`
-*    stamps a public `bundleUrl` from `addonId` + `bundle`. Generic
-*    mechanism kept for future use; no shipped addon uses it on the login
-*    page (the passkey ceremony below runs natively in the shell instead).
-*
-*  - `passkey` — a declarative WebAuthn ceremony the shell renders
-*    natively (`@simplewebauthn/browser` lives in `addon-admin-ui`, not in
-*    a remotely-loaded bundle). Carries the addon's effective `rpId` /
-*    `origin` (from its `resolveRpID()` / `resolveOrigin()`) so the shell
-*    can gate visibility (IP-literal origin, hostname/rpId mismatch) WITHOUT
-*    fetching any remote code pre-auth. Contribution stays unconditional —
-*    enrollment state is never leaked pre-auth; visibility is a shell
-*    decision.
-*
-* Every contribution carries a `stage`:
-*  - `primary`        — shown on the first credentials screen (OIDC /
-*                       magic-link buttons; a future usernameless passkey).
-*  - `second-factor`  — shown AFTER the password leg, gated on the
-*                       returned `factors` (passkey-as-2FA today).
-*
-* `mount: skip` — the cap is read server-side by the core auth router
-* (`registry.getCollection('login-method')`), never mounted as its own
-* tRPC router.
-*/
-/** When a login method renders in the two-phase login flow. */
-var LoginStageEnum = _enum(["primary", "second-factor"]);
-/** One login-method contribution — redirect button, pre-auth widget, or native passkey ceremony. */
-var LoginMethodContributionSchema = discriminatedUnion("kind", [
-	object({
-		kind: literal("redirect"),
-		/** Stable id within the login-method set (e.g. `auth-oidc/google`). */
-		id: string(),
-		/** Operator-facing button label. */
-		label: string(),
-		/** lucide-react icon name. */
-		icon: string().optional(),
-		/** Addon-owned HTTP route the button navigates to (GET). */
-		startUrl: string(),
-		stage: LoginStageEnum
-	}),
-	object({
-		kind: literal("widget"),
-		/** Stable id within the login-method set (e.g. `auth-webauthn/passkey-login`). */
-		id: string(),
-		/** Owning addon id — drives the public bundle URL + the MF namespace. */
-		addonId: string(),
-		/** Bundle filename inside the addon's dist dir (`remoteEntry.js`). */
-		bundle: string(),
-		/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
-		remote: WidgetRemoteSchema,
-		stage: LoginStageEnum
-	}),
-	object({
-		kind: literal("passkey"),
-		/** Stable id within the login-method set (e.g. `auth-webauthn/passkey-direct-login`). */
-		id: string(),
-		/** Operator-facing button label. */
-		label: string(),
-		stage: LoginStageEnum,
-		/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
-		rpId: string(),
-		/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
-		origin: string().nullable()
-	})
-]);
-method(_void(), array(LoginMethodContributionSchema).readonly());
-/**
 * Orchestrator-side destination metadata. The orchestrator computes
 * `id = <addonId>:<subId>` from its provider lookup so consumers
 * (admin UI, restore flow) see one canonical key.
@@ -18439,6 +18372,298 @@ method(_void(), array(string()).readonly(), { auth: "admin" }), method(object({
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* Shared LLM generate contracts — imported by BOTH `llm.cap.ts` (consumer
+* surface) and `llm-runtime.cap.ts` (node-side managed executor) so the two
+* caps stay wire-compatible without a circular cap→cap import.
+*
+* Errors are a discriminated-union RESULT, never thrown: the shape survives
+* every transport tier structurally, and failed calls still write usage rows.
+* Token counts only in v1 — no costUsd (operator decision, 2026-07-15).
+*/
+var LlmUsageSchema = object({
+	inputTokens: number(),
+	outputTokens: number()
+});
+var LlmErrorCodeSchema = _enum([
+	"timeout",
+	"rate-limited",
+	"auth",
+	"refusal",
+	"bad-request",
+	"unavailable",
+	"no-profile",
+	"budget-exceeded",
+	"adapter-error"
+]);
+var LlmGenerateResultSchema = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	text: string(),
+	model: string(),
+	usage: LlmUsageSchema,
+	truncated: boolean(),
+	latencyMs: number()
+}), object({
+	ok: literal(false),
+	code: LlmErrorCodeSchema,
+	message: string(),
+	retryAfterMs: number().optional()
+})]);
+/**
+* `Uint8Array` is the sanctioned binary convention — superjson + the UDS
+* MsgPack channel round-trip typed arrays (embedding-encoder.cap.ts:29,
+* notification-output.cap.ts:27-31 precedents).
+*/
+var LlmImageSchema = object({
+	bytes: _instanceof(Uint8Array),
+	mimeType: string()
+});
+var LlmGenerateBaseInputSchema = object({
+	/** Collection routing (the notification-output posture). */
+	addonId: string().optional(),
+	/** Explicit profile; else the resolution chain (spec §3). */
+	profileId: string().optional(),
+	/** MANDATORY usage tag: 'ai-summary', 'notifier-rules', 'adhoc-ui', … */
+	consumer: string(),
+	system: string().optional(),
+	/** v1: single-turn. `messages[]` is a v2 additive field. */
+	prompt: string(),
+	/** Structured output — adapter-mapped (response_format / forced tool / responseSchema). */
+	jsonSchema: record(string(), unknown()).optional(),
+	/** Per-call override of the profile default. */
+	maxTokens: number().int().positive().optional(),
+	temperature: number().optional()
+});
+/**
+* `llm-runtime` — node-side managed llama.cpp executor (spec §4). Registered
+* on EVERY node where `addon-ai` is installed; the hub `llm` provider reaches
+* a specific node's runtime with `nodePin(profile.runtime.nodeId)` — normal
+* cap routing, zero bespoke plumbing. `internal: true`: the operator reaches
+* this only through the `llm` cap's methods.
+*
+* One running llama-server child per node in v1 (models are RAM-heavy).
+* Resource ceiling = llama-server flags + idleStopMinutes ONLY (no RSS
+* watchdog — operator decision #3).
+*/
+var ManagedModelRefSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("catalog"),
+		catalogId: string()
+	}),
+	object({
+		kind: literal("url"),
+		url: string(),
+		sha256: string().optional()
+	}),
+	object({
+		kind: literal("path"),
+		path: string()
+	})
+]);
+var ManagedRuntimeConfigSchema = object({
+	/** WHERE the runtime lives — hub or any agent. */
+	nodeId: string(),
+	/** Closed for v1; 'ollama' is a v2 candidate. */
+	engine: _enum(["llama-cpp"]),
+	model: ManagedModelRefSchema,
+	contextSize: number().int().default(4096),
+	/** 0 = CPU-only. */
+	gpuLayers: number().int().default(0),
+	/** Default: cpus-2, clamped ≥1 (resolved node-side). */
+	threads: number().int().optional(),
+	/** Concurrent slots. */
+	parallel: number().int().default(1),
+	/** Else lazy: first generate boots it. */
+	autoStart: boolean().default(false),
+	/** 0 = never; frees RAM after quiet periods. */
+	idleStopMinutes: number().int().default(30)
+});
+var LlmRuntimeStatusSchema = object({
+	/** Status is ALWAYS node-qualified. */
+	nodeId: string(),
+	state: _enum([
+		"stopped",
+		"downloading",
+		"starting",
+		"ready",
+		"crashed",
+		"failed"
+	]),
+	pid: number().optional(),
+	port: number().optional(),
+	modelPath: string().optional(),
+	modelId: string().optional(),
+	downloadProgress: number().min(0).max(1).optional(),
+	lastError: string().optional(),
+	crashesInWindow: number(),
+	/** Child RSS (sampled best-effort). */
+	memoryBytes: number().optional(),
+	vramBytes: number().optional()
+});
+var LlmNodeModelSchema = object({
+	file: string(),
+	sizeBytes: number(),
+	catalogId: string().optional(),
+	installedAt: number().optional()
+});
+var LlmRuntimeDiskUsageSchema = object({
+	nodeId: string(),
+	modelsBytes: number(),
+	freeBytes: number().optional()
+});
+method(LlmGenerateBaseInputSchema.extend({
+	images: array(LlmImageSchema).optional(),
+	runtime: ManagedRuntimeConfigSchema,
+	/** The managed profile's timeout, threaded by the hub provider. */
+	timeoutMs: number().int().positive().optional()
+}), LlmGenerateResultSchema, { kind: "mutation" }), method(object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), LlmRuntimeStatusSchema), method(object({ model: ManagedModelRefSchema }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ file: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(LlmNodeModelSchema)), method(object({}), LlmRuntimeDiskUsageSchema);
+/**
+* `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
+* methods concat-fan across providers; single-row methods route to ONE
+* provider by the `addonId` in the call input (the notification-output
+* posture, notification-output.cap.ts:215-250). Provided by `addon-ai`
+* (hub-placed); the cap stays open for future providers.
+*
+* Profiles are ROWS (data), not addons: one row = one usable model endpoint.
+* `apiKey` is a password field — providers REDACT it on read and merge on
+* write; a stored key NEVER round-trips to a client.
+*/
+var LlmProfileKindSchema = _enum([
+	"openai-compatible",
+	"openai",
+	"anthropic",
+	"google",
+	"managed-local"
+]);
+var LlmProfileSchema = object({
+	id: string(),
+	name: string(),
+	kind: LlmProfileKindSchema,
+	/** Stamped by the provider — keeps the fanned catalog routable. */
+	addonId: string(),
+	enabled: boolean(),
+	/** Vendor model id, or the managed runtime's loaded model. */
+	model: string(),
+	/** Required for openai-compatible; override for cloud kinds. */
+	baseUrl: string().optional(),
+	/** ConfigUISchema type:'password' — never round-trips (spec §5). */
+	apiKey: string().optional(),
+	supportsVision: boolean(),
+	temperature: number().min(0).max(2).optional(),
+	maxTokens: number().int().positive().optional(),
+	timeoutMs: number().int().positive().default(6e4),
+	extraHeaders: record(string(), string()).optional(),
+	/** kind === 'managed-local' only (spec §4). */
+	runtime: ManagedRuntimeConfigSchema.optional()
+});
+/** ConfigUISchema tree passed through untyped on the wire (the
+*  notification-output `ConfigSchemaPassthrough` precedent at
+*  notification-output.cap.ts:151); the exported TS type re-tightens it. */
+var ConfigSchemaPassthrough$1 = unknown();
+var LlmProfileKindDescriptorSchema = object({
+	kind: LlmProfileKindSchema,
+	label: string(),
+	icon: string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: string(),
+	configSchema: ConfigSchemaPassthrough$1
+});
+var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
+var LlmDefaultSchema = object({
+	selector: LlmDefaultSelectorSchema,
+	profileId: string()
+});
+/** Server-side rollup row — getUsage never dumps raw call rows (spec §6). */
+var LlmUsageRollupSchema = object({
+	day: string(),
+	consumer: string(),
+	profileId: string(),
+	calls: number(),
+	okCalls: number(),
+	errorCalls: number(),
+	inputTokens: number(),
+	outputTokens: number(),
+	avgLatencyMs: number()
+});
+/** LLM-facing view over the reused ModelCatalogEntry mechanism (spec §4.2). */
+var ManagedModelCatalogEntrySchema = object({
+	id: string(),
+	label: string(),
+	family: string(),
+	purpose: _enum(["text", "vision"]),
+	url: string(),
+	sha256: string(),
+	sizeBytes: number(),
+	quantization: string(),
+	/** Load-time guidance shown in the picker. */
+	minRamBytes: number(),
+	contextSizeDefault: number().int(),
+	/** Vision models: companion projector file. */
+	mmprojUrl: string().optional()
+});
+var LlmRuntimeNodeSchema = object({
+	nodeId: string(),
+	reachable: boolean(),
+	status: LlmRuntimeStatusSchema.optional(),
+	disk: LlmRuntimeDiskUsageSchema.optional(),
+	error: string().optional()
+});
+var GenerateVisionInputSchema = LlmGenerateBaseInputSchema.extend({ images: array(LlmImageSchema).min(1) });
+var ProfileRefInputSchema = object({
+	addonId: string(),
+	profileId: string()
+});
+method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(GenerateVisionInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(ProfileRefInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(ProfileRefInputSchema, LlmGenerateResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(ProfileRefInputSchema, array(string())), method(object({}), array(LlmDefaultSchema)), method(object({
+	selector: LlmDefaultSelectorSchema,
+	profileId: string().nullable()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	since: number().optional(),
+	until: number().optional(),
+	consumer: string().optional(),
+	profileId: string().optional()
+}), array(LlmUsageRollupSchema)), method(object({}), array(ManagedModelCatalogEntrySchema)), method(object({}), array(LlmRuntimeNodeSchema)), method(object({ nodeId: string() }), array(LlmNodeModelSchema)), method(object({
+	nodeId: string(),
+	model: ManagedModelRefSchema
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	nodeId: string(),
+	file: string()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(ProfileRefInputSchema, LlmRuntimeStatusSchema), method(ProfileRefInputSchema, LlmRuntimeStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(ProfileRefInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 var LogLevelSchema = _enum([
 	"debug",
 	"info",
@@ -18461,6 +18686,89 @@ method(LogEntrySchema, _void(), { kind: "mutation" }), method(object({
 	limit: number().optional(),
 	tags: record(string(), string()).optional()
 }), array(LogEntrySchema).readonly());
+/**
+* `login-method` — collection cap through which auth addons contribute
+* their pre-auth login surfaces to the login page. This is the SINGLE,
+* generic mechanism that supersedes the dead `auth.listProviders` reader:
+* every auth addon (OIDC, magic-link, WebAuthn/passkey) registers a
+* `login-method` provider and the PUBLIC `auth.listLoginMethods`
+* procedure aggregates them for the unauthenticated login page.
+*
+* A contribution is a discriminated union on `kind`:
+*
+*  - `redirect` — a declarative button. The login page renders a generic
+*    button that navigates to `startUrl` (an addon-owned HTTP route).
+*    Covers OIDC (`/addon/auth-oidc/<id>/start`) and magic-link with
+*    ZERO shell-side JS. A future SSO addon plugs in the same way — the
+*    login page needs NO change.
+*
+*  - `widget` — a Module-Federation widget the login page mounts (via
+*    `loadRemoteBundle`) for an in-page ceremony. `auth.listLoginMethods`
+*    stamps a public `bundleUrl` from `addonId` + `bundle`. Generic
+*    mechanism kept for future use; no shipped addon uses it on the login
+*    page (the passkey ceremony below runs natively in the shell instead).
+*
+*  - `passkey` — a declarative WebAuthn ceremony the shell renders
+*    natively (`@simplewebauthn/browser` lives in `addon-admin-ui`, not in
+*    a remotely-loaded bundle). Carries the addon's effective `rpId` /
+*    `origin` (from its `resolveRpID()` / `resolveOrigin()`) so the shell
+*    can gate visibility (IP-literal origin, hostname/rpId mismatch) WITHOUT
+*    fetching any remote code pre-auth. Contribution stays unconditional —
+*    enrollment state is never leaked pre-auth; visibility is a shell
+*    decision.
+*
+* Every contribution carries a `stage`:
+*  - `primary`        — shown on the first credentials screen (OIDC /
+*                       magic-link buttons; a future usernameless passkey).
+*  - `second-factor`  — shown AFTER the password leg, gated on the
+*                       returned `factors` (passkey-as-2FA today).
+*
+* `mount: skip` — the cap is read server-side by the core auth router
+* (`registry.getCollection('login-method')`), never mounted as its own
+* tRPC router.
+*/
+/** When a login method renders in the two-phase login flow. */
+var LoginStageEnum = _enum(["primary", "second-factor"]);
+/** One login-method contribution — redirect button, pre-auth widget, or native passkey ceremony. */
+var LoginMethodContributionSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("redirect"),
+		/** Stable id within the login-method set (e.g. `auth-oidc/google`). */
+		id: string(),
+		/** Operator-facing button label. */
+		label: string(),
+		/** lucide-react icon name. */
+		icon: string().optional(),
+		/** Addon-owned HTTP route the button navigates to (GET). */
+		startUrl: string(),
+		stage: LoginStageEnum
+	}),
+	object({
+		kind: literal("widget"),
+		/** Stable id within the login-method set (e.g. `auth-webauthn/passkey-login`). */
+		id: string(),
+		/** Owning addon id — drives the public bundle URL + the MF namespace. */
+		addonId: string(),
+		/** Bundle filename inside the addon's dist dir (`remoteEntry.js`). */
+		bundle: string(),
+		/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
+		remote: WidgetRemoteSchema,
+		stage: LoginStageEnum
+	}),
+	object({
+		kind: literal("passkey"),
+		/** Stable id within the login-method set (e.g. `auth-webauthn/passkey-direct-login`). */
+		id: string(),
+		/** Operator-facing button label. */
+		label: string(),
+		stage: LoginStageEnum,
+		/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
+		rpId: string(),
+		/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
+		origin: string().nullable()
+	})
+]);
+method(_void(), array(LoginMethodContributionSchema).readonly());
 var CpuBreakdownSchema = object({
 	total: number(),
 	user: number(),
@@ -18933,14 +19241,14 @@ var TargetKindCapsSchema = object({
 * the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough$1 = unknown();
+var ConfigSchemaPassthrough = unknown();
 var TargetKindSchema = object({
 	kind: string(),
 	label: string(),
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
-	configSchema: ConfigSchemaPassthrough$1,
+	configSchema: ConfigSchemaPassthrough,
 	supportsDiscovery: boolean(),
 	caps: TargetKindCapsSchema
 });
@@ -18993,297 +19301,493 @@ method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSche
 	enabled: boolean()
 }), _void(), { kind: "mutation" });
 /**
-* Shared LLM generate contracts — imported by BOTH `llm.cap.ts` (consumer
-* surface) and `llm-runtime.cap.ts` (node-side managed executor) so the two
-* caps stay wire-compatible without a circular cap→cap import.
+* notification-rules — the Notification Center rule surface (P1 core).
 *
-* Errors are a discriminated-union RESULT, never thrown: the shape survives
-* every transport tier structurally, and failed calls still write usage rows.
-* Token counts only in v1 — no costUsd (operator decision, 2026-07-15).
+* Spec: `docs/superpowers/specs/2026-07-22-notification-center-requirements.md`
+* (operator decisions D-1/D-2/D-3 are binding):
+*
+*  - D-2: rule EVALUATION lives in `addon-post-analysis` (the
+*    `notification-center` module), hooked on the durable persistence
+*    moments (object-event insert, TrackCloser.closeExpired) with a
+*    persisted outbox + retry — never the lossy telemetry bus (D8).
+*  - D-3: urgency belongs to the RULE. `delivery: 'immediate'` fires on the
+*    FIRST persisted detection matching the conditions (per-track dedup,
+*    `maxPerTrack` fixed at 1 — see {@link NC_MAX_PER_TRACK_IMMEDIATE});
+*    `delivery: 'track-end'` evaluates the finalized track record at close.
+*  - DISPATCH stays behind `notification-output` (rules reference targets
+*    by id; per-backend params are a passthrough blob capped by the
+*    target kind's own caps/degrade engine).
+*
+* P1 scope: admin-authored rules only (`createdBy` stamped from the
+* server-injected caller identity — the first `caller: 'required'`
+* adopter). The P1 condition subset is: devices, classes(+exclude),
+* minConfidence, admin zones (any/all + exclude), weekly schedule
+* windows, and the optional label/identity/plate matchers. User rules,
+* private zones, per-recipient fan-out and the wider condition table are
+* P2+ (see spec §7).
+*
+* All schemas here are the single source of truth — `NcRule` etc. are
+* `z.infer` exports; no duplicate interfaces (the advanced-notifier
+* schema/interface drift is explicitly not repeated).
 */
-var LlmUsageSchema = object({
-	inputTokens: number(),
-	outputTokens: number()
-});
-var LlmErrorCodeSchema = _enum([
-	"timeout",
-	"rate-limited",
-	"auth",
-	"refusal",
-	"bad-request",
-	"unavailable",
-	"no-profile",
-	"budget-exceeded",
-	"adapter-error"
-]);
-var LlmGenerateResultSchema = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	text: string(),
-	model: string(),
-	usage: LlmUsageSchema,
-	truncated: boolean(),
-	latencyMs: number()
-}), object({
-	ok: literal(false),
-	code: LlmErrorCodeSchema,
-	message: string(),
-	retryAfterMs: number().optional()
-})]);
 /**
-* `Uint8Array` is the sanctioned binary convention — superjson + the UDS
-* MsgPack channel round-trip typed arrays (embedding-encoder.cap.ts:29,
-* notification-output.cap.ts:27-31 precedents).
+* D-3: the trigger/urgency of a rule — which persistence moment evaluates it.
+* The value maps 1:1 onto the evaluated record kind:
+*  - `immediate`     ↔ object-event persist (lowest-latency detection burst)
+*  - `track-end`     ↔ TrackCloser.closeExpired (finalized track record)
+*  - `device-event`  ↔ SensorEventStore insert (doorbell press / sensor state
+*                       change of a LINKED device, one row per linked camera)
+*  - `package-event` ↔ PackageDropDetector object-event insert (a `package`
+*                       delivery / pick-up)
+*
+* `immediate`/`track-end` carry the D-3 urgency semantics; `device-event`/
+* `package-event` are pure trigger kinds (no urgency dimension). Extending
+* this one field keeps the schema additive — a rule still declares exactly
+* one trigger.
 */
-var LlmImageSchema = object({
-	bytes: _instanceof(Uint8Array),
-	mimeType: string()
+var NcDeliverySchema = _enum([
+	"immediate",
+	"track-end",
+	"device-event",
+	"package-event"
+]);
+/** Weekly schedule — OR of windows; absence on the rule = always active. */
+var NcScheduleSchema = object({
+	windows: array(object({
+		/** Days of week the window STARTS on (0 = Sunday … 6 = Saturday). */
+		days: array(number().int().min(0).max(6)).min(1),
+		startMinute: number().int().min(0).max(1439),
+		endMinute: number().int().min(0).max(1439)
+	})).min(1),
+	/** IANA timezone; default = hub host timezone. */
+	timezone: string().optional(),
+	/** Active OUTSIDE the windows (e.g. "only outside business hours"). */
+	invert: boolean().optional()
 });
-var LlmGenerateBaseInputSchema = object({
-	/** Collection routing (the notification-output posture). */
-	addonId: string().optional(),
-	/** Explicit profile; else the resolution chain (spec §3). */
-	profileId: string().optional(),
-	/** MANDATORY usage tag: 'ai-summary', 'notifier-rules', 'adhoc-ui', … */
-	consumer: string(),
-	system: string().optional(),
-	/** v1: single-turn. `messages[]` is a v2 additive field. */
-	prompt: string(),
-	/** Structured output — adapter-mapped (response_format / forced tool / responseSchema). */
-	jsonSchema: record(string(), unknown()).optional(),
-	/** Per-call override of the profile default. */
-	maxTokens: number().int().positive().optional(),
-	temperature: number().optional()
+/** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
+var NcPlateMatcherSchema = object({
+	values: array(string().min(1)).min(1),
+	/** Max Levenshtein distance after normalization (uppercase alphanumeric). */
+	maxDistance: number().int().min(0).max(3).default(1)
 });
 /**
-* `llm-runtime` — node-side managed llama.cpp executor (spec §4). Registered
-* on EVERY node where `addon-ai` is installed; the hub `llm` provider reaches
-* a specific node's runtime with `nodePin(profile.runtime.nodeId)` — normal
-* cap routing, zero bespoke plumbing. `internal: true`: the operator reaches
-* this only through the `llm` cap's methods.
-*
-* One running llama-server child per node in v1 (models are RAM-heavy).
-* Resource ceiling = llama-server flags + idleStopMinutes ONLY (no RSS
-* watchdog — operator decision #3).
+* Occupancy condition (DEVICE-EVENT trigger). Fires on a ZoneAnalytics
+* occupancy edge for a device — optionally narrowed to a single admin
+* `zoneId` and/or object `className`. `op` selects the edge/threshold:
+*  - `became-occupied` (default) — count crossed 0 → ≥ `count`
+*  - `became-free`               — count crossed ≥ `count` → below it
+*  - `>=` / `<=`                 — count is at/over or at/under `count`
+* `sustainSeconds` requires the condition hold continuously that long
+* before firing (debounces flicker; 0 = fire on the first matching edge).
+* Fail-closed: no ZoneAnalytics snapshot / missing zone / null snapshot ⇒
+* the condition never matches. Confirmed edge-state survives addon restarts
+* (declared SQLite collection, reseeded on boot).
 */
-var ManagedModelRefSchema = discriminatedUnion("kind", [
-	object({
-		kind: literal("catalog"),
-		catalogId: string()
-	}),
-	object({
-		kind: literal("url"),
-		url: string(),
-		sha256: string().optional()
-	}),
-	object({
-		kind: literal("path"),
-		path: string()
-	})
-]);
-var ManagedRuntimeConfigSchema = object({
-	/** WHERE the runtime lives — hub or any agent. */
-	nodeId: string(),
-	/** Closed for v1; 'ollama' is a v2 candidate. */
-	engine: _enum(["llama-cpp"]),
-	model: ManagedModelRefSchema,
-	contextSize: number().int().default(4096),
-	/** 0 = CPU-only. */
-	gpuLayers: number().int().default(0),
-	/** Default: cpus-2, clamped ≥1 (resolved node-side). */
-	threads: number().int().optional(),
-	/** Concurrent slots. */
-	parallel: number().int().default(1),
-	/** Else lazy: first generate boots it. */
-	autoStart: boolean().default(false),
-	/** 0 = never; frees RAM after quiet periods. */
-	idleStopMinutes: number().int().default(30)
+var NcOccupancyConditionSchema = object({
+	/** Admin zone id to scope the count to; absent = whole-frame occupancy. */
+	zoneId: string().optional(),
+	/** Object class to count; absent = any class. */
+	className: string().optional(),
+	op: _enum([
+		"became-occupied",
+		"became-free",
+		">=",
+		"<="
+	]).default("became-occupied"),
+	count: number().int().min(0).default(1),
+	sustainSeconds: number().int().min(0).max(3600).default(15)
+});
+/** Admin-zone membership condition (zone IDs as stamped by the ZoneEngine). */
+var NcZoneConditionSchema = object({
+	ids: array(string().min(1)).min(1),
+	/** Quantifier over `ids` — at least one / every one visited. */
+	match: _enum(["any", "all"]).default("any")
 });
-var LlmRuntimeStatusSchema = object({
-	/** Status is ALWAYS node-qualified. */
-	nodeId: string(),
-	state: _enum([
-		"stopped",
-		"downloading",
-		"starting",
-		"ready",
-		"crashed",
-		"failed"
-	]),
-	pid: number().optional(),
-	port: number().optional(),
-	modelPath: string().optional(),
-	modelId: string().optional(),
-	downloadProgress: number().min(0).max(1).optional(),
-	lastError: string().optional(),
-	crashesInWindow: number(),
-	/** Child RSS (sampled best-effort). */
-	memoryBytes: number().optional(),
-	vramBytes: number().optional()
+/**
+* The P1 condition set — a flat AND of groups; absent group = pass;
+* membership lists are OR within the list (spec §2.3).
+*/
+var NcConditionsSchema = object({
+	/** Device scope — absent = all devices. */
+	devices: array(number()).optional(),
+	/** Detector class names (any overlap with the record's class set). */
+	classes: array(string().min(1)).optional(),
+	/** Veto classes — any overlap fails the rule. */
+	classesExclude: array(string().min(1)).optional(),
+	/** Minimum detection confidence 0–1 (fails when the record has none). */
+	minConfidence: number().min(0).max(1).optional(),
+	/** Admin zone membership over event `zones` / track `zonesVisited`. */
+	zones: NcZoneConditionSchema.optional(),
+	/** Veto zones — any hit fails the rule. */
+	zonesExclude: array(string().min(1)).optional(),
+	/**
+	* Exact (case-insensitive) match on the record's collapsed `label`
+	* (identity name / plate text / subclass).
+	*/
+	labelEquals: array(string().min(1)).optional(),
+	/**
+	* Identity matcher. P1 boundary: matched against the record's collapsed
+	* `label` (the identity display name propagated by the face pipeline) —
+	* identity-ID matching rides in P2 when identity ids reach the record.
+	*/
+	identities: array(string().min(1)).optional(),
+	/** Fuzzy plate matcher against the record's `label` (plate text). */
+	plates: NcPlateMatcherSchema.optional(),
+	/**
+	* Identity EXCLUDE — mirror of {@link identities} with `notIn` semantics.
+	* Same P1 boundary: matched against the record's collapsed `label` (the
+	* identity display name). A record with NO label passes (nothing to
+	* exclude), unlike the include variant which fails on an absent label.
+	*/
+	identitiesExclude: array(string().min(1)).optional(),
+	/**
+	* Minimum server-computed key-event importance in [0,1] (`Track.importance`).
+	* TRACK-END only: importance is scored at track close, so it does not exist
+	* at immediate / object-event evaluation time (see catalog `appliesTo`). At
+	* close the value is threaded via the close-time info (the `Track` clone is
+	* captured before the DB row is updated, so it would otherwise read stale).
+	* Fails when the record carries no importance (never guess quality — the
+	* `minConfidence` precedent). MVP cut: a single scalar threshold.
+	*/
+	minImportance: number().min(0).max(1).optional(),
+	/**
+	* Minimum track dwell in SECONDS — `(lastSeen − firstSeen) / 1000`.
+	* TRACK-END only: an `immediate` / object-event subject has no closed
+	* lifespan, so a dwell condition never matches immediate delivery
+	* (documented choice — the object-event record carries no `firstSeen`,
+	* so dwell cannot be computed from what the subject actually carries).
+	*/
+	minDwellSeconds: number().min(0).optional(),
+	/**
+	* Detection provenance filter. `any` (default / absent) matches every
+	* source; otherwise the subject's source must equal it. Legacy records
+	* with no stamped source are treated as `pipeline`. The union spans both
+	* record kinds — object events carry `pipeline` | `onboard`, synthetic
+	* tracks carry `sensor`.
+	*/
+	source: _enum([
+		"pipeline",
+		"onboard",
+		"sensor",
+		"any"
+	]).optional(),
+	/**
+	* Minimum identity / plate MATCH confidence in [0,1] — DISTINCT from the
+	* detector `minConfidence` (that gates the object-detection score; this
+	* gates the recognition/OCR match score). Fails when the subject carries
+	* no label-match confidence (never guess). TRACK-END only: the confidence
+	* lives on the recognition result and reaches the subject at track close.
+	*
+	* What it measures precisely (plumbed at track close — the closer threads
+	* the value into `NcTrackClosedInfo.labelConfidence`, the same seam as
+	* `importance`): the BEST recognition match confidence observed for the
+	* label the track carries at close — for a face, the peak cosine similarity
+	* of the ASSIGNED identity (`FaceMatch.score`, reset on an identity switch);
+	* for a plate, the peak OCR read score of the best-held plate
+	* (`plateText.confidence`). When BOTH a face and a plate were recognized on
+	* one track the higher of the two is used. A track that ended with no
+	* confident identity/plate match carries no value, so the condition fails
+	* closed for it (an un-recognized subject).
+	*/
+	minLabelConfidence: number().min(0).max(1).optional(),
+	/**
+	* DEVICE-EVENT only. Raw device event-type tokens (`EventFire.eventType`,
+	* e.g. a doorbell `press` / `press_long`) — matched case-insensitively
+	* against the token carried on the device-event subject (extracted from the
+	* event-emitter runtime slice's `lastEvent.eventType`). Fails when the
+	* subject carries no token. Doorbell-pulse / passive-sensor kinds emit no
+	* eventType, so gate those with {@link sensorKinds} instead.
+	*/
+	eventTypeTokens: array(string().min(1)).optional(),
+	/**
+	* DEVICE-EVENT only. Sensor/control taxonomy kinds (e.g. `doorbell`,
+	* `contact`, `button`, `device-event`) — matched against the persisted
+	* `SensorEvent.kind` (see `sensor-event-kinds.ts`). Membership is OR.
+	*/
+	sensorKinds: array(string().min(1)).optional(),
+	/**
+	* PACKAGE-EVENT only. Which package phase fires the rule — `delivered`
+	* (a parked parcel appeared), `picked-up` (it departed), or `both`. Fails
+	* when the subject's phase does not match (a subject always carries a phase
+	* on the package-event trigger).
+	*/
+	packagePhase: _enum([
+		"delivered",
+		"picked-up",
+		"both"
+	]).optional(),
+	/**
+	* PERSONAL-RULE custom zones (viewer-drawn). Inline normalized polygons
+	* (MaskShape vocabulary). A record passes when its bbox overlaps ANY
+	* listed polygon (ZoneEngine membership semantics). Evaluated only when
+	* the subject carries a bbox; absent bbox ⇒ the condition FAILS.
+	*/
+	customZones: array(MaskPolygonShapeSchema).optional(),
+	/**
+	* DEVICE-EVENT only. ZoneAnalytics occupancy edge — fires when a device's
+	* (optionally zone/class-scoped) occupancy count crosses the configured
+	* threshold and holds for `sustainSeconds`. Fail-closed on missing
+	* substrate (no snapshot / missing zone). See {@link NcOccupancyCondition}.
+	*/
+	occupancy: NcOccupancyConditionSchema.optional()
 });
-var LlmNodeModelSchema = object({
-	file: string(),
-	sizeBytes: number(),
-	catalogId: string().optional(),
-	installedAt: number().optional()
+/** One delivery target: a `notification-output` Target ref + passthrough params. */
+var NcRuleTargetSchema = object({
+	/** `notification-output` Target id. */
+	targetId: string().min(1),
+	/**
+	* Per-backend passthrough. Recognized keys are mapped onto the canonical
+	* Notification (`priority`, `level`, `sound`, `clickUrl`, `ttl`); the
+	* degrade engine drops what the backend can't render.
+	*/
+	params: record(string(), unknown()).optional()
 });
-var LlmRuntimeDiskUsageSchema = object({
-	nodeId: string(),
-	modelsBytes: number(),
-	freeBytes: number().optional()
+/**
+* Media attachment policy (P1 still-image subset).
+*  - `best` — the best AVAILABLE subject image at dispatch time (D-3).
+*  - `best-matching` — the media that explains WHY the rule fired: a rule
+*    matched on identities attaches the subject's `faceCrop`, one matched on
+*    plates attaches the `plateCrop`; a rule with no identity/plate condition
+*    (or when the specific crop is missing) degrades to `best`, then
+*    `keyFrame`, then no attachment — never delaying the send. The matched
+*    condition summary is frozen on the outbox row at enqueue (like the rule
+*    name), so the choice never drifts from the record that fired it.
+*  - `keyFrame` — the clean scene frame (no subject box).
+*  - `none` — no attachment.
+*/
+var NcMediaPolicySchema = object({ attach: _enum([
+	"best",
+	"best-matching",
+	"keyFrame",
+	"none"
+]).default("best") });
+/** Throttle — cooldown survives restarts (rebuilt from the outbox on boot). */
+var NcThrottleSchema = object({
+	cooldownSec: number().int().min(0).max(86400).default(60),
+	/** `rule` = one shared cooldown; `rule-device` = per-camera cooldown. */
+	scope: _enum(["rule", "rule-device"]).default("rule-device")
+});
+/** Client-supplied rule fields (server stamps id/createdBy/createdAt/updatedAt). */
+var NcRuleInputSchema = object({
+	name: string().min(1).max(200),
+	enabled: boolean().default(true),
+	delivery: NcDeliverySchema,
+	conditions: NcConditionsSchema.default({}),
+	schedule: NcScheduleSchema.optional(),
+	targets: array(NcRuleTargetSchema).min(1),
+	media: NcMediaPolicySchema.default({ attach: "best" }),
+	throttle: NcThrottleSchema.default({
+		cooldownSec: 60,
+		scope: "rule-device"
+	}),
+	/** `{{var}}` templating over camera/class/label/zones/confidence/time. */
+	template: object({
+		title: string().max(500).optional(),
+		body: string().max(2e3).optional()
+	}).optional(),
+	/** Canonical notification priority ordinal (1..5); per-target overridable. */
+	priority: number().int().min(1).max(5).default(3),
+	/**
+	* Ownership/visibility key. Absent = admin/global rule (unchanged legacy
+	* behaviour, visible to all, read-only in the viewer). Present = personal
+	* rule owned by this userId. Server-stamped; never trusted from a client.
+	*/
+	ownerUserId: string().optional()
 });
-method(LlmGenerateBaseInputSchema.extend({
-	images: array(LlmImageSchema).optional(),
-	runtime: ManagedRuntimeConfigSchema,
-	/** The managed profile's timeout, threaded by the hub provider. */
-	timeoutMs: number().int().positive().optional()
-}), LlmGenerateResultSchema, { kind: "mutation" }), method(object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({}), LlmRuntimeStatusSchema), method(object({ model: ManagedModelRefSchema }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ file: string() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({}), array(LlmNodeModelSchema)), method(object({}), LlmRuntimeDiskUsageSchema);
 /**
-* `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
-* methods concat-fan across providers; single-row methods route to ONE
-* provider by the `addonId` in the call input (the notification-output
-* posture, notification-output.cap.ts:215-250). Provided by `addon-ai`
-* (hub-placed); the cap stays open for future providers.
-*
-* Profiles are ROWS (data), not addons: one row = one usable model endpoint.
-* `apiKey` is a password field — providers REDACT it on read and merge on
-* write; a stored key NEVER round-trips to a client.
+* Partial patch for `updateRule` — any subset of the input fields, plus the
+* persisted-only {@link NcRuleSchema} `disabledTargetIds` set. The latter is
+* NOT a client-authored input field (it lives on the persisted rule, not the
+* input), so it is added here explicitly to let the store's per-target opt-out
+* toggle round-trip through the shared `update` path. Viewer opt-out mutations
+* still flow through `nc.setRuleTargetEnabled` (owner-checked), never a raw
+* `updateRule` patch.
 */
-var LlmProfileKindSchema = _enum([
-	"openai-compatible",
-	"openai",
-	"anthropic",
-	"google",
-	"managed-local"
-]);
-var LlmProfileSchema = object({
+var NcRulePatchSchema = NcRuleInputSchema.partial().extend({ disabledTargetIds: array(string()).optional() });
+/** A persisted rule. */
+var NcRuleSchema = NcRuleInputSchema.extend({
 	id: string(),
-	name: string(),
-	kind: LlmProfileKindSchema,
-	/** Stamped by the provider — keeps the fanned catalog routable. */
-	addonId: string(),
-	enabled: boolean(),
-	/** Vendor model id, or the managed runtime's loaded model. */
-	model: string(),
-	/** Required for openai-compatible; override for cloud kinds. */
-	baseUrl: string().optional(),
-	/** ConfigUISchema type:'password' — never round-trips (spec §5). */
-	apiKey: string().optional(),
-	supportsVision: boolean(),
-	temperature: number().min(0).max(2).optional(),
-	maxTokens: number().int().positive().optional(),
-	timeoutMs: number().int().positive().default(6e4),
-	extraHeaders: record(string(), string()).optional(),
-	/** kind === 'managed-local' only (spec §4). */
-	runtime: ManagedRuntimeConfigSchema.optional()
-});
-/** ConfigUISchema tree passed through untyped on the wire (the
-*  notification-output `ConfigSchemaPassthrough` precedent at
-*  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough = unknown();
-var LlmProfileKindDescriptorSchema = object({
-	kind: LlmProfileKindSchema,
-	label: string(),
-	icon: string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: string(),
-	configSchema: ConfigSchemaPassthrough
-});
-var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
-var LlmDefaultSchema = object({
-	selector: LlmDefaultSelectorSchema,
-	profileId: string()
+	/** userId of the admin who created the rule (server-stamped caller). */
+	createdBy: string(),
+	createdAt: number(),
+	updatedAt: number(),
+	/**
+	* Per-target opt-out set. A targetId here is suppressed for THIS rule at
+	* send time. Only a target's OWNER may add/remove its id (server-checked
+	* in `nc.setRuleTargetEnabled`). Defaults to empty.
+	*/
+	disabledTargetIds: array(string()).default([])
 });
-/** Server-side rollup row — getUsage never dumps raw call rows (spec §6). */
-var LlmUsageRollupSchema = object({
-	day: string(),
-	consumer: string(),
-	profileId: string(),
-	calls: number(),
-	okCalls: number(),
-	errorCalls: number(),
-	inputTokens: number(),
-	outputTokens: number(),
-	avgLatencyMs: number()
+var NcTestResultSchema = object({
+	recordId: string(),
+	recordKind: _enum([
+		"object-event",
+		"track",
+		"device-event",
+		"package-event"
+	]),
+	deviceId: number(),
+	timestamp: number(),
+	wouldFire: boolean(),
+	/** Condition id that failed (first failing group), when `wouldFire` is false. */
+	failedCondition: string().optional(),
+	className: string().optional(),
+	label: string().optional()
 });
-/** LLM-facing view over the reused ModelCatalogEntry mechanism (spec §4.2). */
-var ManagedModelCatalogEntrySchema = object({
+var NcConditionDescriptorSchema = object({
+	/** Field id inside `NcConditions` (or `'schedule'` for the rule-level group). */
 	id: string(),
+	group: _enum([
+		"scope",
+		"class",
+		"zones",
+		"quality",
+		"label",
+		"schedule",
+		"device",
+		"package",
+		"occupancy"
+	]),
 	label: string(),
-	family: string(),
-	purpose: _enum(["text", "vision"]),
-	url: string(),
-	sha256: string(),
-	sizeBytes: number(),
-	quantization: string(),
-	/** Load-time guidance shown in the picker. */
-	minRamBytes: number(),
-	contextSizeDefault: number().int(),
-	/** Vision models: companion projector file. */
-	mmprojUrl: string().optional()
+	/** Editor widget the UI renders — never hardcode per-condition forms. */
+	valueType: _enum([
+		"deviceIdList",
+		"stringList",
+		"number01",
+		"number",
+		"sourceSelect",
+		"zoneSelection",
+		"zoneIdList",
+		"schedule",
+		"plateMatcher",
+		"packagePhase",
+		"polygonDraw",
+		"occupancy"
+	]),
+	operator: _enum([
+		"in",
+		"notIn",
+		"anyOf",
+		"allOf",
+		"gte",
+		"fuzzyIn",
+		"withinSchedule"
+	]),
+	/** Which delivery kinds the condition applies to. */
+	appliesTo: array(NcDeliverySchema),
+	phase: string(),
+	description: string().optional()
 });
-var LlmRuntimeNodeSchema = object({
-	nodeId: string(),
-	reachable: boolean(),
-	status: LlmRuntimeStatusSchema.optional(),
-	disk: LlmRuntimeDiskUsageSchema.optional(),
-	error: string().optional()
+/**
+* The delivery lifecycle status of a history row — a straight read of the
+* durable outbox row's own status (single source of truth):
+*  - `pending` — enqueued, in-flight or retrying with backoff
+*  - `sent`    — delivered (terminal)
+*  - `dead`    — dead-lettered after exhausting retries / a permanent
+*                backend rejection / a deleted target (terminal; carries
+*                the failure `error`)
+*
+* P1 has no `suppressed-quiet-hours` / `snoozed` states — those ride the P2
+* user dimension (quiet hours / snooze) and are additive when they land.
+*/
+var NcHistoryStatusSchema = _enum([
+	"pending",
+	"sent",
+	"dead"
+]);
+/** The evaluated record kind a history row descends from (one per trigger). */
+var NcHistoryRecordKindSchema = _enum([
+	"object-event",
+	"track-end",
+	"device-event",
+	"package-event"
+]);
+/** Subject summary frozen on the row at fire time (survives rule/record edits). */
+var NcHistorySubjectSchema = object({
+	className: string(),
+	label: string().optional(),
+	confidence: number().optional(),
+	zones: array(string()),
+	timestamp: number()
 });
-var GenerateVisionInputSchema = LlmGenerateBaseInputSchema.extend({ images: array(LlmImageSchema).min(1) });
-var ProfileRefInputSchema = object({
-	addonId: string(),
-	profileId: string()
+/**
+* One delivery-history row. This is a read-only VIEW over the durable
+* outbox row (single source of truth — the same row the drain loop drives;
+* NO second write path, so history can never drift from delivery state).
+* The §3.2 fields map directly: `ruleId`/`targetId`/`deviceId` are columns,
+* `eventRef` is `recordKind`+`recordId`, `timestamps` are `createdAt`
+* (fire) / `updatedAt` (last transition), `status` + `error` are the
+* lifecycle. `ruleName` + `subject` are the intent snapshot frozen at
+* enqueue. `userId?` (per-recipient history) is P2 — no user dimension in
+* P1 (admin scope only).
+*/
+var NcHistoryEntrySchema = object({
+	/** Outbox row id — the stable dedup id `ruleId:dedupRef:targetId`. */
+	id: string(),
+	ruleId: string(),
+	/** Rule name frozen at fire time (outlives a later rename / delete). */
+	ruleName: string(),
+	/** The rule urgency/trigger that produced this delivery. */
+	delivery: NcDeliverySchema,
+	targetId: string(),
+	deviceId: number(),
+	recordKind: NcHistoryRecordKindSchema,
+	/** Event / track ref of the evaluated record (§3.2 `eventRef`). */
+	recordId: string(),
+	/** Present for track-scoped deliveries (object-event / track-end). */
+	trackId: string().optional(),
+	status: NcHistoryStatusSchema,
+	/** Delivery attempts made so far. */
+	attempts: number().int(),
+	/** Fire time (outbox enqueue). */
+	createdAt: number(),
+	/** Last transition time (terminal for sent / dead). */
+	updatedAt: number(),
+	/** Failure detail — present on a `dead` row. */
+	error: string().optional(),
+	subject: NcHistorySubjectSchema
 });
-method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(GenerateVisionInputSchema, LlmGenerateResultSchema, { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(ProfileRefInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(ProfileRefInputSchema, LlmGenerateResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(ProfileRefInputSchema, array(string())), method(object({}), array(LlmDefaultSchema)), method(object({
-	selector: LlmDefaultSelectorSchema,
-	profileId: string().nullable()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
+/**
+* Query filter for `getHistory` (spec §4.2). Every field is a narrowing
+* AND; absent = unbounded on that axis. `since`/`until` bound the fire time
+* (`createdAt`, epoch ms, inclusive). `limit` is clamped to
+* {@link NC_HISTORY_LIMIT_MAX}. `userId` (per-recipient filtering) is P2.
+*/
+var NcHistoryFilterSchema = object({
+	ruleId: string().optional(),
+	deviceId: number().optional(),
+	status: NcHistoryStatusSchema.optional(),
 	since: number().optional(),
 	until: number().optional(),
-	consumer: string().optional(),
-	profileId: string().optional()
-}), array(LlmUsageRollupSchema)), method(object({}), array(ManagedModelCatalogEntrySchema)), method(object({}), array(LlmRuntimeNodeSchema)), method(object({ nodeId: string() }), array(LlmNodeModelSchema)), method(object({
-	nodeId: string(),
-	model: ManagedModelRefSchema
-}), _void(), {
+	limit: number().int().min(1).max(500).default(100)
+});
+method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), method(object({ ruleId: string() }), object({ rule: NcRuleSchema.nullable() }), { auth: "admin" }), method(object({ rule: NcRuleInputSchema }), object({ rule: NcRuleSchema }), {
 	kind: "mutation",
-	auth: "admin"
+	auth: "admin",
+	caller: "required"
 }), method(object({
-	nodeId: string(),
-	file: string()
-}), _void(), {
+	ruleId: string(),
+	patch: NcRulePatchSchema
+}), object({ rule: NcRuleSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ ruleId: string() }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(ProfileRefInputSchema, LlmRuntimeStatusSchema), method(ProfileRefInputSchema, LlmRuntimeStatusSchema, {
+}), method(object({
+	ruleId: string(),
+	enabled: boolean()
+}), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(ProfileRefInputSchema, _void(), {
+}), method(object({
+	rule: NcRuleInputSchema,
+	lookbackMinutes: number().int().min(1).max(1440).default(60)
+}), object({ results: array(NcTestResultSchema) }), {
 	kind: "mutation",
 	auth: "admin"
-});
+}), method(object({}), object({ catalog: array(NcConditionDescriptorSchema) })), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" });
 /**
 * Zod schemas for persisted record types.
 *
@@ -19969,7 +20473,10 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(object({
 	eventId: string(),
 	kind: MediaFileKindEnum.optional()
-}), array(MediaFileSchema).readonly()), method(object({ trackId: string() }), array(MediaFileSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), object({
+}), array(MediaFileSchema).readonly()), method(object({
+	trackId: string(),
+	kinds: array(MediaFileKindEnum).optional()
+}), array(MediaFileSchema).readonly()), method(SearchObjectEventsInput, array(ScoredObjectEventSchema).readonly()), object({
 	deviceId: number(),
 	timestamp: number(),
 	frameWidth: number(),
@@ -19990,76 +20497,6 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	eventId: string(),
 	timestamp: number()
 });
-/**
-* Cap → event-kind mapping for the SENSOR / CONTROL cap families — the table
-* `pipeline-analytics.listEventKinds` uses to turn a linked device's bound
-* caps into per-camera event-kind descriptors.
-*
-* The descriptor DATA (color / iconId / labelKey / parentKind / category)
-* is NOT duplicated here — every entry is derived from the single
-* `EVENT_TAXONOMY` dictionary (`catalogs/event-taxonomy.ts`). This file owns
-* ONLY the cap-name → taxonomy-kind mapping. Adding a new eventful sensor /
-* control cap means adding one line here (and a taxonomy entry); the anti-
-* drift guard `scripts/check-event-kind-coverage.ts` fails the build if an
-* eventful cap is missing.
-*/
-/** Map a taxonomy `iconId` onto the legacy closed `EventKindIcon` enum. */
-var LEGACY_ICON = {
-	motion: "motion",
-	audio: "audio",
-	person: "person",
-	vehicle: "vehicle",
-	animal: "animal",
-	package: "package",
-	door: "door",
-	pir: "pir",
-	smoke: "smoke",
-	water: "water",
-	button: "button",
-	generic: "generic",
-	gas: "smoke",
-	vibration: "generic",
-	tamper: "generic",
-	presence: "person",
-	lock: "generic",
-	siren: "generic",
-	switch: "generic",
-	doorbell: "button"
-};
-function legacyIcon(iconId) {
-	return LEGACY_ICON[iconId] ?? "generic";
-}
-/**
-* Cap name → taxonomy kind id. Covers EVERY eventful sensor / control cap.
-* The anti-drift guard cross-checks this against the eventful caps declared
-* in `packages/types/src/capabilities/*.cap.ts`.
-*/
-var CAP_TO_KIND = {
-	contact: "contact",
-	motion: "motion-sensor",
-	smoke: "smoke",
-	flood: "flood",
-	gas: "gas",
-	"carbon-monoxide": "carbon-monoxide",
-	vibration: "vibration",
-	tamper: "tamper",
-	presence: "presence",
-	"enum-sensor": "enum-sensor",
-	"event-emitter": "device-event",
-	"lock-control": "lock",
-	switch: "switch",
-	button: "button",
-	doorbell: "doorbell"
-};
-function buildDescriptor(capName, kind) {
-	const t = EVENT_TAXONOMY[kind];
-	if (t === void 0) throw new Error(`EVENT_KIND_BY_CAP: cap '${capName}' maps to unknown taxonomy kind '${kind}'`);
-	return {
-		...t,
-		icon: legacyIcon(t.iconId)
-	};
-}
-Object.freeze(Object.fromEntries(Object.entries(CAP_TO_KIND).map(([capName, kind]) => [capName, buildDescriptor(capName, kind)])));
 var CameraPipelineConfigSchema = object({
 	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).readonly(),
@@ -20545,6 +20982,76 @@ method(object({
 	auth: "admin"
 });
 /**
+* Cap → event-kind mapping for the SENSOR / CONTROL cap families — the table
+* `pipeline-analytics.listEventKinds` uses to turn a linked device's bound
+* caps into per-camera event-kind descriptors.
+*
+* The descriptor DATA (color / iconId / labelKey / parentKind / category)
+* is NOT duplicated here — every entry is derived from the single
+* `EVENT_TAXONOMY` dictionary (`catalogs/event-taxonomy.ts`). This file owns
+* ONLY the cap-name → taxonomy-kind mapping. Adding a new eventful sensor /
+* control cap means adding one line here (and a taxonomy entry); the anti-
+* drift guard `scripts/check-event-kind-coverage.ts` fails the build if an
+* eventful cap is missing.
+*/
+/** Map a taxonomy `iconId` onto the legacy closed `EventKindIcon` enum. */
+var LEGACY_ICON = {
+	motion: "motion",
+	audio: "audio",
+	person: "person",
+	vehicle: "vehicle",
+	animal: "animal",
+	package: "package",
+	door: "door",
+	pir: "pir",
+	smoke: "smoke",
+	water: "water",
+	button: "button",
+	generic: "generic",
+	gas: "smoke",
+	vibration: "generic",
+	tamper: "generic",
+	presence: "person",
+	lock: "generic",
+	siren: "generic",
+	switch: "generic",
+	doorbell: "button"
+};
+function legacyIcon(iconId) {
+	return LEGACY_ICON[iconId] ?? "generic";
+}
+/**
+* Cap name → taxonomy kind id. Covers EVERY eventful sensor / control cap.
+* The anti-drift guard cross-checks this against the eventful caps declared
+* in `packages/types/src/capabilities/*.cap.ts`.
+*/
+var CAP_TO_KIND = {
+	contact: "contact",
+	motion: "motion-sensor",
+	smoke: "smoke",
+	flood: "flood",
+	gas: "gas",
+	"carbon-monoxide": "carbon-monoxide",
+	vibration: "vibration",
+	tamper: "tamper",
+	presence: "presence",
+	"enum-sensor": "enum-sensor",
+	"event-emitter": "device-event",
+	"lock-control": "lock",
+	switch: "switch",
+	button: "button",
+	doorbell: "doorbell"
+};
+function buildDescriptor(capName, kind) {
+	const t = EVENT_TAXONOMY[kind];
+	if (t === void 0) throw new Error(`EVENT_KIND_BY_CAP: cap '${capName}' maps to unknown taxonomy kind '${kind}'`);
+	return {
+		...t,
+		icon: legacyIcon(t.iconId)
+	};
+}
+Object.freeze(Object.fromEntries(Object.entries(CAP_TO_KIND).map(([capName, kind]) => [capName, buildDescriptor(capName, kind)])));
+/**
 * server-management — per-NODE singleton capability for a node's ROOT
 * package lifecycle (runtime-updatable node packages).
 *
@@ -22050,7 +22557,28 @@ var FaceInfoSchema = object({
 	*  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`). Absent when the
 	*  track produced no key frame (e.g. native/onboard source) — the UI falls
 	*  back to the inline `base64` face crop. */
-	keyFrameMediaKey: string().optional()
+	keyFrameMediaKey: string().optional(),
+	/** Winning identity-match cosine (0..1) for this face's track, when an
+	*  identity was auto-confirmed. Lets the UI surface WHY a face was assigned
+	*  (confidence badge / low-confidence audit). Absent on legacy rows and on
+	*  faces that were never auto-recognized. */
+	bestMatchScore: number().optional(),
+	/** Native-scale face short side (px) at recognition time, when the runner
+	*  measured it. Lets the UI flag low-resolution auto-assignments. Absent on
+	*  legacy rows / runners that reported no native measure. */
+	nativeFaceShortSidePx: number().optional(),
+	/** SUGGESTED identity for this face — a plausible-but-not-confident match that
+	*  MISSED auto-assignment (cosine in the suggestion band, or above threshold
+	*  but blocked only by the recognition size floor). Mutually exclusive with
+	*  `recognizedIdentityId` (a suggestion is NEVER an assignment): the face stays
+	*  UNASSIGNED and everything else keeps treating it as unrecognized — the UI
+	*  merely offers a one-tap "is this <name>?" confirm. Absent on legacy rows and
+	*  on faces that were auto-assigned or below the suggestion band. (2026-07-24) */
+	suggestedIdentityId: string().optional(),
+	/** Peak identity-match cosine (0..1) for `suggestedIdentityId`, captured at the
+	*  same moment as `bestMatchScore` (track peak, at close). Lets the UI rank /
+	*  badge suggestion confidence. Present iff `suggestedIdentityId` is. (2026-07-24) */
+	suggestedMatchScore: number().optional()
 });
 var FaceFilterEnum = _enum([
 	"unassigned",
@@ -24422,36 +24950,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"advancedNotifier.deleteRule": {
-		capName: "advanced-notifier",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
-	"advancedNotifier.getHistory": {
-		capName: "advanced-notifier",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"advancedNotifier.getRules": {
-		capName: "advanced-notifier",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"advancedNotifier.testRule": {
-		capName: "advanced-notifier",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
-	"advancedNotifier.upsertRule": {
-		capName: "advanced-notifier",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"alarmPanel.arm": {
 		capName: "alarm-panel",
 		capScope: "device",
@@ -26756,6 +27254,60 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.createRule": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"notificationRules.deleteRule": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"notificationRules.getConditionCatalog": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationRules.getHistory": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationRules.getRule": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationRules.listRules": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationRules.setRuleEnabled": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"notificationRules.testRule": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"notificationRules.updateRule": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notifier.cancel": {
 		capName: "notifier",
 		capScope: "device",
@@ -219003,6 +219555,31 @@ var reolinkCameraSchema = object({
 			ext: ReolinkStreamProfileOptionsSchema.optional()
 		}).optional(),
 		/**
+		* Persisted `getOptions` descriptors for the device-config caps
+		* (`stream-params`, `motion-zones`, `privacy-mask`, `day-night`,
+		* `image-settings`, `ptz`), keyed by cap name.
+		*
+		* WHY: the device-detail aggregate (`deviceManager.getDeviceAggregate`)
+		* calls `getOptions` + `getStatus` on EVERY bound device-config cap,
+		* and the admin UI polls it every 2.5s while the Config tab is open.
+		* Un-cached, that is ~7 Baichuan round-trips every 2.5s — which keeps
+		* a battery camera permanently awake and wakes a sleeping one on a
+		* plain page visit. These descriptors are static per camera model
+		* (advertised ranges / codec sets / supported axes), so they are read
+		* once, persisted here, and served from the blob until the TTL
+		* expires (see `ReolinkCamera.resolveCapOptions`).
+		*
+		* `value` is intentionally `unknown`: this blob stays self-contained
+		* (no cross-package schema identity — same rationale as
+		* `ReolinkStreamProfileOptionsSchema` above). The reader validates
+		* each entry with the cap's own Zod schema, so a stale/incompatible
+		* shape is discarded instead of cast.
+		*/
+		capOptionsSnapshot: record(string(), object({
+			value: unknown(),
+			fetchedAt: number()
+		})).optional(),
+		/**
 		* Snapshot of the camera's privacy mask master switch from
 		* `getMask` (cmdId=52). Zone editing is a separate flow —
 		* we only expose the master enable.
@@ -221022,15 +221599,48 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	*/
 	sleepStateChangedAt = 0;
 	/**
-	* Min time between observed sleep transitions before we honour
-	* another flip. Picked >= the lib's full UDP inference cycle
-	* (~12s on battery cams with idle-disconnect) so a single
-	* inference flap doesn't pass through. 30s is also longer than
-	* `getIdleDisconnectTimeoutMs` (default 30s in the lib), which
-	* means a transient socket close → reopen pattern can't drive
-	* us through a full state cycle either.
-	*/
-	static SLEEP_HYSTERESIS_MS = 3e4;
+	* Hysteresis is ASYMMETRIC, because the two directions have very
+	* different costs when we get them wrong.
+	*
+	* `→ awake` (`WAKE_HYSTERESIS_MS`): expensive if wrong. Believing an
+	* asleep camera is awake un-gates every background probe
+	* (`refreshParentSettingsSnapshot`, the device-config cap refreshes,
+	* aux align) and makes `wakeForStream` early-out without actually
+	* waking. Keep the full window >= the lib's UDP inference cycle
+	* (~12s on battery cams with idle-disconnect) and >= the lib's
+	* `getIdleDisconnectTimeoutMs` (30s default), so neither an
+	* inference flap nor a transient socket close→reopen can walk us
+	* into a false "awake".
+	*
+	* `→ sleeping` (`SLEEP_HYSTERESIS_MS`): cheap if wrong. Believing an
+	* awake camera is asleep only means we skip background probes and
+	* serve cached values; the demand paths (`wakeForStream`,
+	* `wakeIfSleeping`) still drive a real wake. The old symmetric 30s
+	* window was LONGER than the camera's own awake window (~14s — see
+	* `onWakeTransition`), so a natural wake→sleep cycle had its
+	* `sleeping` transition dropped and the slice stayed stuck on
+	* "awake" while the camera slept: the exact "at rest we lose the
+	* sleeping state" symptom. 5s still absorbs a single 2s inference
+	* tick while tracking the real cycle.
+	*/
+	static WAKE_HYSTERESIS_MS = 3e4;
+	static SLEEP_HYSTERESIS_MS = 5e3;
+	/**
+	* Wall-clock ms of the last PROACTIVE wake — one we issued on our own
+	* initiative (background snapshot refresh), not because the operator
+	* or a stream consumer asked for the camera. Drives
+	* `canProactivelyWake` below.
+	*/
+	lastProactiveWakeAt = 0;
+	/**
+	* Minimum gap between two proactive wakes. Demand-driven wakes
+	* (`wakeForStream` from the broker, `wakeIfSleeping` behind an
+	* operator action, the intercom pre-wake) bypass this entirely —
+	* the operator asked, the operator gets the camera. Only
+	* self-initiated wakes are rate-limited, so a thumbnail cache miss
+	* can't wake a doorbell every few minutes.
+	*/
+	static PROACTIVE_WAKE_COOLDOWN_MS = 10 * 6e4;
 	/** Background timer that runs the passive sleep poll (battery cams only). */
 	sleepPollTimer = null;
 	/** Periodic timer driving `alignAuxDevicesState()` on wired cams.
@@ -221514,6 +222124,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 		} catch {
 			return false;
 		}
+		this.markWakeIssued();
 		this.ctx.logger.info("proactive action: waking sleeping battery cam", {
 			tags: { deviceId: this.id },
 			meta: { timeoutMs }
@@ -221810,6 +222421,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 						durationMs: Date.now() - startedAt
 					};
 				}
+				this.markWakeIssued();
 				this.ctx.logger.info("battery wakeForStream: cam sleeping — issuing wake", {
 					tags: { deviceId: this.id },
 					meta: { timeoutMs }
@@ -221882,7 +222494,8 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	/**
 	* Decide whether to honour a sleep-state transition. Returns
 	* `false` when the lib's UDP inference is still inside the
-	* hysteresis window (8s by default) so we don't flap. The first
+	* hysteresis window so we don't flap. The window is asymmetric —
+	* see `WAKE_HYSTERESIS_MS` / `SLEEP_HYSTERESIS_MS`. The first
 	* transition AFTER an api login / restart is always honoured —
 	* no prior-flip timestamp gating it.
 	*
@@ -221892,11 +222505,13 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	acceptSleepingTransition(next) {
 		if (this.sleeping === next) return false;
 		const now = Date.now();
-		if (this.sleepStateChangedAt > 0 && now - this.sleepStateChangedAt < ReolinkCamera.SLEEP_HYSTERESIS_MS) {
+		const windowMs = next ? ReolinkCamera.SLEEP_HYSTERESIS_MS : ReolinkCamera.WAKE_HYSTERESIS_MS;
+		if (this.sleepStateChangedAt > 0 && now - this.sleepStateChangedAt < windowMs) {
 			this.ctx.logger.debug("ignoring sleep inference flap within hysteresis window", {
 				tags: { deviceId: this.id },
 				meta: {
 					next,
+					windowMs,
 					sinceLastChangeMs: now - this.sleepStateChangedAt
 				}
 			});
@@ -221905,6 +222520,113 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 		this.sleepStateChangedAt = now;
 		return true;
 	}
+	/**
+	* THE single writer of the `battery.sleeping` slice.
+	*
+	* Before this existed the state had three independent writers with
+	* three different rules: the `awake`/`sleeping` simpleEvent handlers
+	* (hysteresis-gated) and the sleep poll (which wrote the slice
+	* directly, bypassing the hysteresis AND leaving
+	* `sleepStateChangedAt` stale so the NEXT event compared against an
+	* ancient timestamp). Funnelling every writer through here keeps one
+	* rule set and one timestamp.
+	*
+	* @param source - `'hub-summary'` is AUTHORITATIVE (the NVR reports
+	*   per-channel sleep state from its own firmware, not from socket
+	*   I/O inference) and therefore bypasses the hysteresis. The other
+	*   two sources are inference-derived and stay gated.
+	* @returns `true` when the slice actually changed.
+	*/
+	commitSleepState(next, source) {
+		if (!this.isBattery) return false;
+		if (this.sleeping === next) return false;
+		if (source !== "hub-summary" && !this.acceptSleepingTransition(next)) return false;
+		if (source === "hub-summary") this.sleepStateChangedAt = Date.now();
+		this.state.battery.sleeping = next;
+		this.ctx.logger.info("battery sleep state committed", {
+			tags: { deviceId: this.id },
+			meta: {
+				sleeping: next,
+				source
+			}
+		});
+		return true;
+	}
+	/**
+	* Hub-driven sleep reconcile. The NVR's `getNvrChannelsSummary`
+	* carries a per-channel `sleeping` flag that the parent Hub already
+	* pulls on every discovery refresh — firmware truth, obtained over
+	* the Hub's own mains-powered socket, costing the battery channel
+	* nothing. Before this the flag died inside the Hub's
+	* `device-discovery` slice and the adopted child's sleep state
+	* depended entirely on routed simpleEvents; a child that missed a
+	* transition (or whose channel dropped out of the routing map while
+	* deep-asleep) kept serving a stale value indefinitely.
+	*
+	* No-op for non-battery children. Called by `ReolinkHub` after each
+	* successful discovery refresh.
+	*/
+	applyHubSleepState(sleeping) {
+		if (!this.isBattery) return;
+		if (this.commitSleepState(sleeping, "hub-summary") && !sleeping) this.onWakeTransition("hub-summary").catch(() => {});
+	}
+	/**
+	* Rate-limit for wakes we issue on our OWN initiative. Returns
+	* `false` when a proactive wake happened less than
+	* `PROACTIVE_WAKE_COOLDOWN_MS` ago — the caller must then serve
+	* whatever it has cached instead of reaching for the radio.
+	*
+	* Demand-driven paths never call this: `wakeForStream` (a consumer
+	* wants live video), `wakeIfSleeping` (an operator clicked
+	* something) and the intercom pre-wake all wake unconditionally.
+	*/
+	canProactivelyWake(reason) {
+		if (this.lastProactiveWakeAt === 0) return true;
+		const sinceMs = Date.now() - this.lastProactiveWakeAt;
+		if (sinceMs >= ReolinkCamera.PROACTIVE_WAKE_COOLDOWN_MS) return true;
+		this.ctx.logger.debug("proactive wake suppressed by cooldown", {
+			tags: { deviceId: this.id },
+			meta: {
+				reason,
+				sinceMs,
+				cooldownMs: ReolinkCamera.PROACTIVE_WAKE_COOLDOWN_MS
+			}
+		});
+		return false;
+	}
+	/** Stamp the proactive-wake cooldown. Called by every path that
+	*  actually issues a wake — demand-driven ones included, so an
+	*  operator-triggered wake also postpones the next proactive one. */
+	markWakeIssued() {
+		this.lastProactiveWakeAt = Date.now();
+	}
+	/**
+	* Gate for a PROACTIVE camera read, checked BEFORE `ensureApi()`.
+	*
+	* The login itself is the wake. On a sleeping UDP/battery camera the
+	* lib's discovery + handshake nudges the firmware awake (same reason
+	* `refreshParentSettingsSnapshot` refuses to call `ensureApi` while
+	* asleep), so gating only the explicit `wakeUp()` call is useless —
+	* by the time we reach it the camera is already up. Production logs
+	* showed exactly that: a background read produced a full
+	* `Connecting to Reolink` → BCUDP discovery → `battery sleep state
+	* committed` (awake) → whole refresh cascade, on a camera that had
+	* been asleep for six minutes.
+	*
+	* Returns `false` when the caller must serve cache / bail out without
+	* touching the socket. Stamps the cooldown when it does let a wake
+	* through, so "at most one proactive wake per
+	* `PROACTIVE_WAKE_COOLDOWN_MS`" holds across ALL proactive callers
+	* rather than per-caller.
+	*
+	* Demand-driven paths never call this — see `canProactivelyWake`.
+	*/
+	allowProactiveCameraAccess(reason) {
+		if (!this.isBattery || !this.sleeping) return true;
+		if (!this.canProactivelyWake(reason)) return false;
+		this.markWakeIssued();
+		return true;
+	}
 	updateBatteryCache(info) {
 		this.setCapSlice(batteryCapability, this.mapBatteryInfo(info));
 	}
@@ -222150,6 +222872,10 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	}
 	async fetchSnapshotWithSingleFlight() {
 		if (this.snapshotInFlight) return this.snapshotInFlight;
+		if (!this.allowProactiveCameraAccess("snapshot")) {
+			this.ctx.logger.debug("snapshot: skipped — sleeping battery cam inside wake cooldown", { tags: { deviceId: this.id } });
+			return null;
+		}
 		const promise = (async () => {
 			let api;
 			try {
@@ -222628,6 +223354,117 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 		await (await this.ensureApi()).setEnc(this.getChannel(), { [streamKey]: encPatch });
 		this.cachedStreamDescriptors = void 0;
 	}
+	/** How long a persisted `getOptions` descriptor stays authoritative.
+	*  These describe model capabilities (advertised ranges, codec sets,
+	*  supported axes), not runtime state — they change on a firmware
+	*  update, not during operation. 6h keeps a firmware upgrade visible
+	*  within a day while removing the per-poll round-trip entirely. */
+	static CAP_OPTIONS_TTL_MS = 360 * 6e4;
+	/**
+	* Read a persisted `getOptions` descriptor, validated with the cap's
+	* OWN Zod schema. Validation (not a cast) is what makes the
+	* `z.unknown()` blob type-safe: an entry written by an older addon
+	* whose shape no longer parses is simply discarded, and the caller
+	* re-probes.
+	*/
+	readCapOptionsCache(capName, schema) {
+		const entry = this.config.get("deviceCache")?.capOptionsSnapshot?.[capName];
+		if (!entry) return null;
+		const parsed = schema.safeParse(entry.value);
+		if (!parsed.success) return null;
+		return {
+			value: parsed.data,
+			fetchedAt: entry.fetchedAt
+		};
+	}
+	/** Persist a freshly-probed descriptor. Best-effort — a failed write
+	*  only costs the next caller another probe. */
+	async persistCapOptions(capName, value) {
+		try {
+			const current = this.config.get("deviceCache") ?? {};
+			await this.config.setAll({ deviceCache: {
+				...current,
+				capOptionsSnapshot: {
+					...current.capOptionsSnapshot,
+					[capName]: {
+						value,
+						fetchedAt: Date.now()
+					}
+				}
+			} });
+		} catch (err) {
+			this.ctx.logger.debug("cap options persist failed", {
+				tags: { deviceId: this.id },
+				meta: {
+					capName,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+		}
+	}
+	/**
+	* Resolve a device-config cap's `getOptions` descriptor without
+	* touching a sleeping camera and without re-probing on every
+	* aggregate poll.
+	*
+	* Order of resolution:
+	*   1. fresh persisted entry (within `CAP_OPTIONS_TTL_MS`) → serve it;
+	*   2. battery cam believed asleep → serve the stale persisted entry
+	*      if we have one, otherwise `fallback()`. NEVER probes: this is
+	*      the path a page visit takes on a sleeping doorbell.
+	*   3. otherwise probe the camera, persist, serve.
+	* A probe failure falls back to the stale entry, then `fallback()`.
+	*/
+	async resolveCapOptions(params) {
+		const { capName, schema, probe, fallback } = params;
+		const cached = this.readCapOptionsCache(capName, schema);
+		if (cached && Date.now() - cached.fetchedAt < ReolinkCamera.CAP_OPTIONS_TTL_MS) return cached.value;
+		if (this.isBattery && this.sleeping) {
+			this.ctx.logger.debug("cap options: battery cam sleeping — serving cache, not probing", {
+				tags: { deviceId: this.id },
+				meta: {
+					capName,
+					hasCache: cached !== null
+				}
+			});
+			return cached?.value ?? fallback();
+		}
+		try {
+			const value = await probe();
+			await this.persistCapOptions(capName, value);
+			return value;
+		} catch (err) {
+			this.ctx.logger.debug("cap options probe failed — serving cache/fallback", {
+				tags: { deviceId: this.id },
+				meta: {
+					capName,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+			return cached?.value ?? fallback();
+		}
+	}
+	/**
+	* Wrap a cap's `refreshFromCamera` so the READ side (the bridge's
+	* stale-check behind `getStatus`) never wakes a sleeping battery cam.
+	* The bridge then projects whatever the slice last held — which is
+	* exactly what the operator should see for a camera that is asleep.
+	*
+	* Only the bridge gets the wrapped version; `setX` mutations keep the
+	* raw refresh so a write still re-reads the firmware's clamped result.
+	*/
+	sleepGatedRefresh(capName, refresh) {
+		return async () => {
+			if (this.isBattery && this.sleeping) {
+				this.ctx.logger.debug("cap status refresh skipped — battery cam is sleeping", {
+					tags: { deviceId: this.id },
+					meta: { capName }
+				});
+				return;
+			}
+			await refresh();
+		};
+	}
 	/**
 	* Register the `stream-params` native cap provider.
 	*
@@ -222635,9 +223472,10 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	* source of truth is `runtimeState['stream-params']`, kept fresh via a
 	* `createRuntimeStateBridge` with a `refresh` that round-trips `getEnc`.
 	*
-	* - `getStatus`  — slice-driven via bridge (stale → refresh from camera).
-	* - `getOptions` — on-demand `getEncOptions` call; not cached in the
-	*                  runtimeState slice (options don't change at runtime).
+	* - `getStatus`  — slice-driven via bridge (stale → refresh from camera,
+	*                  sleep-gated so a read never wakes a battery cam).
+	* - `getOptions` — persisted descriptor via `resolveCapOptions`; the
+	*                  `getEncOptions` round-trip runs at most once per TTL.
 	* - `setProfile` — translates cap patch → `EncStreamPatch`, calls
 	*                  `setEnc`, then refreshes the slice.
 	*/
@@ -222682,19 +223520,25 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 			runtimeState: this.runtimeState,
 			cap: streamParamsCapability,
 			ownDeviceId: this.id,
-			refresh: refreshFromCamera,
+			refresh: this.sleepGatedRefresh(CAP_NAME, refreshFromCamera),
 			staleMs: STALE_MS,
 			empty: () => ({ lastFetchedAt: 0 })
 		});
+		const resolveOptions = async () => this.resolveCapOptions({
+			capName: CAP_NAME,
+			schema: StreamParamsOptionsSchema,
+			probe: () => this.probeStreamParamsOptions(),
+			fallback: () => ({})
+		});
 		const provider = {
 			getStatus: bridge.getStatus,
 			getOptions: async ({ deviceId }) => {
 				if (deviceId !== this.id) return {};
-				return this.probeStreamParamsOptions();
+				return resolveOptions();
 			},
 			getConfigSchema: async ({ deviceId }) => {
 				if (deviceId !== this.id) return null;
-				const opts = await this.probeStreamParamsOptions();
+				const opts = await resolveOptions();
 				await bridge.ensureFresh();
 				return buildStreamParamsConfigSchema(opts, this.runtimeState.getCapState(CAP_NAME) ?? null);
 			},
@@ -222807,7 +223651,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 				runtimeState: this.runtimeState,
 				cap: motionZonesCapability,
 				ownDeviceId: this.id,
-				refresh: refreshFromCamera,
+				refresh: this.sleepGatedRefresh(CAP_NAME, refreshFromCamera),
 				staleMs: STALE_MS,
 				empty: () => ({
 					enabled: false,
@@ -222818,27 +223662,46 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 			}).getStatus,
 			getOptions: async ({ deviceId }) => {
 				if (deviceId !== this.id) throw new Error(`ReolinkCamera: deviceId mismatch, expected ${this.id}, got ${deviceId}`);
-				const raw = await (await this.ensureApi()).getMotionAlarm(channel);
-				const { scope } = this.parseMotionAlarm(raw);
-				this.motionZonesGrid = {
-					columns: scope.columns,
-					rows: scope.rows,
-					width: scope.width,
-					height: scope.height
-				};
-				return {
-					maxRegions: 1,
-					supportedShapes: ["grid"],
-					grid: {
-						width: scope.width,
-						height: scope.height
+				return this.resolveCapOptions({
+					capName: CAP_NAME,
+					schema: MotionZoneOptionsSchema,
+					probe: async () => {
+						const raw = await (await this.ensureApi()).getMotionAlarm(channel);
+						const { scope } = this.parseMotionAlarm(raw);
+						this.motionZonesGrid = {
+							columns: scope.columns,
+							rows: scope.rows,
+							width: scope.width,
+							height: scope.height
+						};
+						return {
+							maxRegions: 1,
+							supportedShapes: ["grid"],
+							grid: {
+								width: scope.width,
+								height: scope.height
+							},
+							sensitivity: {
+								min: 1,
+								max: 50,
+								step: 1
+							}
+						};
 					},
-					sensitivity: {
-						min: 1,
-						max: 50,
-						step: 1
-					}
-				};
+					fallback: () => ({
+						maxRegions: 1,
+						supportedShapes: [],
+						grid: {
+							width: 0,
+							height: 0
+						},
+						sensitivity: {
+							min: 1,
+							max: 50,
+							step: 1
+						}
+					})
+				});
 			},
 			setZone: async ({ deviceId, patch }) => {
 				if (deviceId !== this.id) return;
@@ -222946,7 +223809,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 				runtimeState: this.runtimeState,
 				cap: privacyMaskCapability,
 				ownDeviceId: this.id,
-				refresh: refreshFromCamera,
+				refresh: this.sleepGatedRefresh(CAP_NAME, refreshFromCamera),
 				staleMs: STALE_MS,
 				empty: () => ({
 					enabled: false,
@@ -222959,18 +223822,21 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 					maxRegions: 4,
 					supportedShapes: ["rect"]
 				};
-				try {
-					const zones = await (await this.ensureApi()).getMaskZones(channel);
-					return {
-						maxRegions: zones.maxNum,
-						supportedShapes: zones.maxNum > 0 ? ["rect"] : []
-					};
-				} catch {
-					return {
+				return this.resolveCapOptions({
+					capName: CAP_NAME,
+					schema: PrivacyMaskOptionsSchema,
+					probe: async () => {
+						const zones = await (await this.ensureApi()).getMaskZones(channel);
+						return {
+							maxRegions: zones.maxNum,
+							supportedShapes: zones.maxNum > 0 ? ["rect"] : []
+						};
+					},
+					fallback: () => ({
 						maxRegions: 4,
 						supportedShapes: ["rect"]
-					};
-				}
+					})
+				});
 			},
 			setMask: async ({ deviceId, patch }) => {
 				if (deviceId !== this.id) return;
@@ -223077,7 +223943,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 				runtimeState: this.runtimeState,
 				cap: dayNightCapability,
 				ownDeviceId: this.id,
-				refresh: refreshFromCamera,
+				refresh: this.sleepGatedRefresh(CAP_NAME, refreshFromCamera),
 				staleMs: STALE_MS,
 				empty: () => ({
 					mode: "auto",
@@ -223086,36 +223952,47 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 			}).getStatus,
 			getOptions: async ({ deviceId }) => {
 				if (deviceId !== this.id) throw new Error(`ReolinkCamera: deviceId mismatch, expected ${this.id}, got ${deviceId}`);
-				const api = await this.ensureApi();
-				const modes = ((await api.getVideoInput(channel))?.body?.VideoInput)?.dayNight !== void 0 ? [
-					"auto",
-					"day",
-					"night"
-				] : [];
-				let supportsSensitivity = false;
-				let sensitivityRange;
-				try {
-					const range = (await api.getDayNightThreshold(channel))?.body?.DayNightThreshold?.thresholdval;
-					if (typeof range?.min === "number" && typeof range?.max === "number") {
-						supportsSensitivity = true;
-						sensitivityRange = {
-							min: 0,
-							max: 100,
-							step: 1
+				return this.resolveCapOptions({
+					capName: CAP_NAME,
+					schema: DayNightOptionsSchema,
+					probe: async () => {
+						const api = await this.ensureApi();
+						const modes = ((await api.getVideoInput(channel))?.body?.VideoInput)?.dayNight !== void 0 ? [
+							"auto",
+							"day",
+							"night"
+						] : [];
+						let supportsSensitivity = false;
+						let sensitivityRange;
+						try {
+							const range = (await api.getDayNightThreshold(channel))?.body?.DayNightThreshold?.thresholdval;
+							if (typeof range?.min === "number" && typeof range?.max === "number") {
+								supportsSensitivity = true;
+								sensitivityRange = {
+									min: 0,
+									max: 100,
+									step: 1
+								};
+							}
+						} catch (err) {
+							this.ctx.logger.debug("day-night threshold options probe failed", {
+								tags: { deviceId: this.id },
+								meta: { error: err instanceof Error ? err.message : String(err) }
+							});
+						}
+						return {
+							modes,
+							supportsSensitivity,
+							...sensitivityRange !== void 0 ? { sensitivity: sensitivityRange } : {},
+							supportsSwitchDelay: false
 						};
-					}
-				} catch (err) {
-					this.ctx.logger.debug("day-night threshold options probe failed", {
-						tags: { deviceId: this.id },
-						meta: { error: err instanceof Error ? err.message : String(err) }
-					});
-				}
-				return {
-					modes,
-					supportsSensitivity,
-					...sensitivityRange !== void 0 ? { sensitivity: sensitivityRange } : {},
-					supportsSwitchDelay: false
-				};
+					},
+					fallback: () => ({
+						modes: [],
+						supportsSensitivity: false,
+						supportsSwitchDelay: false
+					})
+				});
 			},
 			setSettings: async ({ deviceId, settings }) => {
 				if (deviceId !== this.id) return;
@@ -223199,37 +224076,60 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 				runtimeState: this.runtimeState,
 				cap: imageSettingsCapability,
 				ownDeviceId: this.id,
-				refresh: refreshFromCamera,
+				refresh: this.sleepGatedRefresh(CAP_NAME, refreshFromCamera),
 				staleMs: STALE_MS,
 				empty: () => ({ lastFetchedAt: 0 })
 			}).getStatus,
 			getOptions: async ({ deviceId }) => {
 				if (deviceId !== this.id) throw new Error(`ReolinkCamera: deviceId mismatch, expected ${this.id}, got ${deviceId}`);
-				const isp = await (await this.ensureApi()).getIsp(channel);
-				const vi = isp?.body?.VideoInput;
-				const exposureRaw = isp?.body?.InputAdvanceCfg?.Exposure?.mode;
-				const supportsBrightness = typeof vi?.bright === "number";
-				const supportsContrast = typeof vi?.contrast === "number";
-				const supportsSaturation = typeof vi?.saturation === "number";
-				const supportsSharpness = typeof vi?.sharpen === "number";
-				const exposureModes = typeof exposureRaw === "string" ? ["auto", "manual"] : [];
-				return {
-					supportsBrightness,
-					...supportsBrightness ? { brightness: NORMALIZED_RANGE } : {},
-					supportsContrast,
-					...supportsContrast ? { contrast: NORMALIZED_RANGE } : {},
-					supportsSaturation,
-					...supportsSaturation ? { saturation: NORMALIZED_RANGE } : {},
-					supportsSharpness,
-					...supportsSharpness ? { sharpness: NORMALIZED_RANGE } : {},
+				const staticOptions = {
 					supportsMirror: false,
 					supportsFlip: false,
 					rotateOptions: [],
 					whiteBalanceModes: [],
 					supportsWarmth: false,
-					exposureModes,
 					backlightModes: []
 				};
+				return this.resolveCapOptions({
+					capName: CAP_NAME,
+					schema: ImageSettingsOptionsSchema,
+					probe: async () => {
+						const isp = await (await this.ensureApi()).getIsp(channel);
+						const vi = isp?.body?.VideoInput;
+						const exposureRaw = isp?.body?.InputAdvanceCfg?.Exposure?.mode;
+						const supportsBrightness = typeof vi?.bright === "number";
+						const supportsContrast = typeof vi?.contrast === "number";
+						const supportsSaturation = typeof vi?.saturation === "number";
+						const supportsSharpness = typeof vi?.sharpen === "number";
+						const exposureModes = typeof exposureRaw === "string" ? ["auto", "manual"] : [];
+						return {
+							supportsBrightness,
+							...supportsBrightness ? { brightness: NORMALIZED_RANGE } : {},
+							supportsContrast,
+							...supportsContrast ? { contrast: NORMALIZED_RANGE } : {},
+							supportsSaturation,
+							...supportsSaturation ? { saturation: NORMALIZED_RANGE } : {},
+							supportsSharpness,
+							...supportsSharpness ? { sharpness: NORMALIZED_RANGE } : {},
+							...staticOptions,
+							rotateOptions: [...staticOptions.rotateOptions],
+							whiteBalanceModes: [...staticOptions.whiteBalanceModes],
+							backlightModes: [...staticOptions.backlightModes],
+							exposureModes
+						};
+					},
+					fallback: () => ({
+						supportsBrightness: false,
+						supportsContrast: false,
+						supportsSaturation: false,
+						supportsSharpness: false,
+						...staticOptions,
+						rotateOptions: [...staticOptions.rotateOptions],
+						whiteBalanceModes: [...staticOptions.whiteBalanceModes],
+						backlightModes: [...staticOptions.backlightModes],
+						exposureModes: []
+					})
+				});
 			},
 			setSettings: async ({ deviceId, settings }) => {
 				if (deviceId !== this.id) return;
@@ -223467,7 +224367,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 			runtimeState: this.runtimeState,
 			cap: ptzAutotrackCapability,
 			ownDeviceId: this.id,
-			refresh: refreshFromCamera,
+			refresh: this.sleepGatedRefresh(CAP_NAME, refreshFromCamera),
 			staleMs: STALE_MS,
 			empty: () => ({
 				enabled: false,
@@ -223588,25 +224488,30 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 					hasAutofocus: false
 				};
 				const hasAutofocus = this.config.get("deviceCache")?.autoFocusSnapshot?.supported === true;
-				try {
-					const { capabilities } = await (await this.ensureApi()).getDeviceCapabilities(this.getChannel());
-					return {
-						hasPan: capabilities.hasPan,
-						hasTilt: capabilities.hasTilt,
-						hasZoom: capabilities.hasZoom,
-						supportsPresets: capabilities.hasPresets,
-						hasAutofocus
-					};
-				} catch {
-					const hasPtz = this.getProbeFlags().hasPtz === true;
-					return {
-						hasPan: hasPtz,
-						hasTilt: hasPtz,
-						hasZoom: hasPtz,
-						supportsPresets: hasPtz,
-						hasAutofocus
-					};
-				}
+				return this.resolveCapOptions({
+					capName: "ptz",
+					schema: PtzOptionsSchema,
+					probe: async () => {
+						const { capabilities } = await (await this.ensureApi()).getDeviceCapabilities(this.getChannel());
+						return {
+							hasPan: capabilities.hasPan,
+							hasTilt: capabilities.hasTilt,
+							hasZoom: capabilities.hasZoom,
+							supportsPresets: capabilities.hasPresets,
+							hasAutofocus
+						};
+					},
+					fallback: () => {
+						const hasPtz = this.getProbeFlags().hasPtz === true;
+						return {
+							hasPan: hasPtz,
+							hasTilt: hasPtz,
+							hasZoom: hasPtz,
+							supportsPresets: hasPtz,
+							hasAutofocus
+						};
+					}
+				});
 			},
 			goHome: async ({ deviceId }) => {
 				if (deviceId !== this.id) return;
@@ -224222,14 +225127,14 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 						});
 						return;
 					}
-					this.state.battery.sleeping = true;
+					if (!this.commitSleepState(true, "sleep-poll")) return;
 					this.ctx.logger.info("Sleep poll detected sleep — closing active streams", {
 						tags: { deviceId: this.id },
 						meta: { idleMs: status.idleMs }
 					});
 					this.closeActiveStreams("sleep-poll").catch(() => {});
 				} else if (status.state === "awake" && this.sleeping) {
-					this.state.battery.sleeping = false;
+					if (!this.commitSleepState(false, "sleep-poll")) return;
 					this.ctx.logger.debug("Sleep poll detected awake", { tags: { deviceId: this.id } });
 					this.onWakeTransition("sleep-poll").catch(() => {});
 				}
@@ -224361,6 +225266,10 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 		if (this.batteryUpdateInFlight) return this.batteryUpdateInFlight;
 		const cycle = (async () => {
 			try {
+				if (!this.allowProactiveCameraAccess("battery-update")) {
+					this.ctx.logger.debug("battery-update: cam sleeping — skipping cycle without connecting", { tags: { deviceId: this.id } });
+					return;
+				}
 				let api;
 				try {
 					api = await this.ensureApi();
@@ -226212,6 +227121,13 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 		}
 		if (this.api) return this.api;
 		if (this.loginPromise) return this.loginPromise;
+		if (this.isBattery && this.sleeping) {
+			const frames = (/* @__PURE__ */ new Error("wake-attribution")).stack?.split("\n").slice(2, 7).join(" | ");
+			this.ctx.logger.info("battery cam login while sleeping — this wakes the camera", {
+				tags: { deviceId: this.id },
+				meta: { caller: frames ?? "unavailable" }
+			});
+		}
 		const host = this.config.get("host");
 		const port = this.config.get("port");
 		const username = this.config.get("username");
@@ -226396,17 +227312,14 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 		}
 		if (event.type === "awake") {
 			const wasSleeping = this.sleeping;
-			if (this.acceptSleepingTransition(false)) {
-				if (this.isBattery) this.state.battery.sleeping = false;
-				if (wasSleeping) {
-					this.ctx.logger.info("Reolink camera woke up", { tags: { deviceId: this.id } });
-					this.ctx.eventBus.emit(createEvent(EventCategory.DeviceAwake, eventSource, {
-						deviceId: this.id,
-						providerId: REOLINK_ADDON_ID,
-						reason: "awake"
-					}));
-					this.onWakeTransition("simple-event").catch(() => {});
-				}
+			if (this.commitSleepState(false, "simple-event") && wasSleeping) {
+				this.ctx.logger.info("Reolink camera woke up", { tags: { deviceId: this.id } });
+				this.ctx.eventBus.emit(createEvent(EventCategory.DeviceAwake, eventSource, {
+					deviceId: this.id,
+					providerId: REOLINK_ADDON_ID,
+					reason: "awake"
+				}));
+				this.onWakeTransition("simple-event").catch(() => {});
 			}
 			return;
 		}
@@ -226429,21 +227342,19 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 		}
 		if (event.type === "sleeping") {
 			const wasSleeping = this.sleeping;
-			if (this.acceptSleepingTransition(true)) {
-				if (this.isBattery) this.state.battery.sleeping = true;
-				if (!wasSleeping) this.ctx.eventBus.emit(createEvent(EventCategory.DeviceSleeping, eventSource, {
-					deviceId: this.id,
-					providerId: REOLINK_ADDON_ID,
-					reason: "sleeping"
-				}));
-				if (this.active.size > 0) {
-					this.ctx.logger.info("Reolink camera went to sleep — closing active streams", {
-						tags: { deviceId: this.id },
-						meta: { activeStreams: this.active.size }
-					});
-					this.closeActiveStreams("sleeping").catch(() => {});
-				} else this.ctx.logger.debug("Reolink camera sleep transition (no active streams)", { tags: { deviceId: this.id } });
-			}
+			if (!this.commitSleepState(true, "simple-event")) return;
+			if (!wasSleeping) this.ctx.eventBus.emit(createEvent(EventCategory.DeviceSleeping, eventSource, {
+				deviceId: this.id,
+				providerId: REOLINK_ADDON_ID,
+				reason: "sleeping"
+			}));
+			if (this.active.size > 0) {
+				this.ctx.logger.info("Reolink camera went to sleep — closing active streams", {
+					tags: { deviceId: this.id },
+					meta: { activeStreams: this.active.size }
+				});
+				this.closeActiveStreams("sleeping").catch(() => {});
+			} else this.ctx.logger.debug("Reolink camera sleep transition (no active streams)", { tags: { deviceId: this.id } });
 			return;
 		}
 		if (event.type === "battery" && event.battery) {
@@ -226515,7 +227426,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 		const persistedModel = this.config.get("deviceCache")?.model ?? null;
 		const flags = {
 			...prevFlags,
-			hasBattery: hasBattery ?? prevFlags.hasBattery ?? this.isBattery,
+			hasBattery: hasBattery === true || prevFlags.hasBattery === true || this.isBattery,
 			...hasPtz !== void 0 ? { hasPtz } : {},
 			...hasIntercom !== void 0 ? { hasIntercom } : {},
 			...hasDoorbell !== void 0 ? { hasDoorbell } : {},
@@ -227082,13 +227993,14 @@ var ReolinkHub = class ReolinkHub extends BaseDevice {
 			source: "cgi",
 			timeoutMs: HUB_DISCOVERY_REFRESH_TIMEOUT_MS
 		} });
+		const adoptedByChannel = await this.loadAdoptedChildrenByChannel();
+		this.channelToDeviceId.clear();
+		for (const [channel, deviceId] of adoptedByChannel) this.channelToDeviceId.set(channel, deviceId);
 		try {
-			const summary = await (await this.ensureApi()).getNvrChannelsSummary({
+			discovered = (await (await this.ensureApi()).getNvrChannelsSummary({
 				source: "cgi",
 				timeoutMs: HUB_DISCOVERY_REFRESH_TIMEOUT_MS
-			});
-			const adoptedByChannel = await this.loadAdoptedChildrenByChannel();
-			discovered = summary.devices.map((d) => {
+			})).devices.map((d) => {
 				const childNativeId = computeChildNativeId(this.stableId, d.channel, d.uid);
 				const adoptedDeviceId = adoptedByChannel.get(d.channel) ?? null;
 				return {
@@ -227141,12 +228053,37 @@ var ReolinkHub = class ReolinkHub extends BaseDevice {
 				}))
 			} });
 		}
-		this.channelToDeviceId.clear();
-		for (const entry of discovered) {
-			const ch = entry.metadata.rtspChannel;
-			if (typeof ch === "number" && entry.adoptedDeviceId !== null) this.channelToDeviceId.set(ch, entry.adoptedDeviceId);
+		if (lastError === null) {
+			await this.reconcileAdoptedChildOnline(discovered);
+			await this.reconcileAdoptedChildSleepState(discovered);
+		}
+	}
+	/**
+	* Push the NVR's per-channel sleep state into each adopted battery
+	* child's `battery.sleeping` slice.
+	*
+	* `getNvrChannelsSummary` carries a `sleeping` flag straight from the
+	* Hub firmware — obtained over the Hub's own mains-powered socket, so
+	* it costs the battery channel nothing, and it is real firmware state
+	* rather than the socket-I/O inference a standalone camera has to rely
+	* on. Before this it only ever reached the discovery panel; the
+	* adopted child's sleep state depended entirely on routed simpleEvents
+	* and went stale the moment one was missed. This is the "the NVR
+	* already tells us everything" path — with it, a hub-attached battery
+	* camera needs no email-push server and no sleep poll of its own.
+	*
+	* Only `online` / `sleeping` are acted on: `offline` and `unknown`
+	* carry no sleep information, so the last known value stands.
+	*/
+	async reconcileAdoptedChildSleepState(discovered) {
+		const actionable = discovered.filter((e) => e.adoptedDeviceId !== null && (e.status === "sleeping" || e.status === "online"));
+		if (actionable.length === 0) return;
+		const all = await this.ctx.devices.getAll();
+		for (const entry of actionable) {
+			const child = all.find((d) => d.id === entry.adoptedDeviceId);
+			if (!(child instanceof ReolinkCamera)) continue;
+			child.applyHubSleepState(entry.status === "sleeping");
 		}
-		if (lastError === null) await this.reconcileAdoptedChildOnline(discovered);
 	}
 	/**
 	* After a successful discovery refresh, mark every adopted child