@camstack/system 1.2.14 → 1.2.16

package/dist/{dist-eOaraBhT.mjs → dist-BU-QPlE8.mjs}

@@ -5138,280 +5138,825 @@ var AccessoryKind = {
 AccessoryKind.Siren, AccessoryKind.Floodlight, AccessoryKind.Spotlight, AccessoryKind.PirSensor, AccessoryKind.Chime, AccessoryKind.Autotrack, AccessoryKind.Nightvision, AccessoryKind.PrivacyMask;
 DeviceFeature.BatteryOperated;
 /**
-* Generic device-level status snapshot. Auto-registered by `BaseDevice`
-* for every device, regardless of provider — the kernel needs a uniform
-* cap-keyed slice for the basic device flags every consumer expects to
-* read across processes (the `online` flag in particular). Driver-specific
-* caps (`battery`, `doorbell`, …) carry their domain-specific state on
-* their own slices.
+* Shared geometry vocabulary for on-frame shape caps — privacy-mask,
+* motion-zones, and the detection zones/lines editor all speak this one
+* language so a single drawing-plane editor and the providers stay
+* decoupled from each cap's storage.
 *
-* Pattern is identical to `battery`: schema-bearing `runtimeState`,
-* empty `methods`, single change event. Reads land at
-* `runtimeState.getCapState('device-status')`; writes at
-* `runtimeState.setCapState('device-status', …)`. Cross-process
-* consumers reach the same data via the `device-state` cap router
-* (`getCapSlice({deviceId, capName: 'device-status'})`).
+* All coordinates are normalized 0..1 of the camera frame (top-left
+* origin). Each cap composes the SUBSET of shape kinds it supports and
+* advertises it via `supportedShapes` in its `getOptions`.
 */
-var DeviceStatusSchema = z.object({
-	/**
-	* Device-level liveness. Drivers flip via `markOnline(boolean)` on
-	* `BaseDevice`. Provider semantics vary — RTSP aggregates broker
-	* stream-health, Reolink reads firmware push events, ONVIF tracks
-	* ping responses. This cap intentionally does NOT prescribe which
-	* signal drives the flag.
-	*/
-	online: z.boolean(),
-	/** Ms epoch of the last `online` transition. Lets consumers tell
-	*  apart "just came online" from "still online". */
-	lastChangedAt: z.number()
+/** A normalized 0..1 point (top-left origin). */
+var MaskPointSchema = z.object({
+	x: z.number(),
+	y: z.number()
+});
+/** Axis-aligned rectangle (normalized 0..1). */
+var MaskRectShapeSchema = z.object({
+	kind: z.literal("rect"),
+	x: z.number(),
+	y: z.number(),
+	width: z.number(),
+	height: z.number()
+});
+/** Free polygon — an ordered list of normalized vertices (≥3). */
+var MaskPolygonShapeSchema = z.object({
+	kind: z.literal("polygon"),
+	points: z.array(MaskPointSchema)
+});
+/** Boolean cell grid — row-major, length === gridWidth*gridHeight. */
+var MaskGridShapeSchema = z.object({
+	kind: z.literal("grid"),
+	gridWidth: z.number(),
+	gridHeight: z.number(),
+	cells: z.array(z.boolean())
+});
+/** Directed line / tripwire — an ordered list of normalized points (≥2). */
+var MaskLineShapeSchema = z.object({
+	kind: z.literal("line"),
+	points: z.array(MaskPointSchema)
+});
+z.discriminatedUnion("kind", [
+	MaskRectShapeSchema,
+	MaskPolygonShapeSchema,
+	MaskGridShapeSchema,
+	MaskLineShapeSchema
+]);
+/** Every shape-kind discriminant, for `supportedShapes` advertisement. */
+var MaskShapeKindSchema = z.enum([
+	"rect",
+	"polygon",
+	"grid",
+	"line"
+]);
+/** Polygon vertex bounds when a cap supports 'polygon' (e.g. Hikvision {min:4,max:4}). */
+var MaskPolygonVerticesSchema = z.object({
+	min: z.number(),
+	max: z.number()
+});
+/** Grid dimensions when a cap supports 'grid'. */
+var MaskGridDimsSchema = z.object({
+	width: z.number(),
+	height: z.number()
 });
-var deviceStatusCapability = {
-	name: "device-status",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	methods: {},
-	events: { 
-	/** Emitted when `online` transitions. Mirrors the semantics of
-	*  `battery.onStatusChanged`. */
-onStatusChanged: { data: z.object({
-		deviceId: z.number(),
-		status: DeviceStatusSchema
-	}) } },
-	status: {
-		schema: DeviceStatusSchema,
-		kind: "push"
-	},
-	runtimeState: DeviceStatusSchema
-};
 /**
-* Per-device feature/identity probe slice. Holds the runtime-resolved
-* truth about what a device CAN do — which the kernel uses to:
-*   1. Reconcile accessory children (hub-children spawn siren/floodlight/PIR
-*      based on what the firmware actually advertises).
-*   2. Compute the public `features: DeviceFeature[]` array surfaced via
-*      `device-manager.listAll`.
-*   3. Decide which optional caps (PTZ, intercom, doorbell, battery, …)
-*      to register on the device's capability surface.
+* notification-rules — the Notification Center rule surface (P1 core).
 *
-* Auto-registered by `BaseDevice` for every device. Drivers populate the
-* slice from `onProbe()` (kernel calls it once after register, before
-* accessory reconciliation). Consumers read via:
-*   `runtimeState.getCapState<FeatureProbeStatus>('feature-probe')`
+* Spec: `docs/superpowers/specs/2026-07-22-notification-center-requirements.md`
+* (operator decisions D-1/D-2/D-3 are binding):
 *
-* `flags` is an open record so each driver carries its own keys without
-* a centralized schema bottleneck — Reolink writes `hasPtz/hasIntercom`,
-* Hikvision writes `hasSupplementalLight/hasAlarmIo`, etc.
+*  - D-2: rule EVALUATION lives in `addon-post-analysis` (the
+*    `notification-center` module), hooked on the durable persistence
+*    moments (object-event insert, TrackCloser.closeExpired) with a
+*    persisted outbox + retry — never the lossy telemetry bus (D8).
+*  - D-3: urgency belongs to the RULE. `delivery: 'immediate'` fires on the
+*    FIRST persisted detection matching the conditions (per-track dedup,
+*    `maxPerTrack` fixed at 1 — see {@link NC_MAX_PER_TRACK_IMMEDIATE});
+*    `delivery: 'track-end'` evaluates the finalized track record at close.
+*  - DISPATCH stays behind `notification-output` (rules reference targets
+*    by id; per-backend params are a passthrough blob capped by the
+*    target kind's own caps/degrade engine).
 *
-* Replaces the older driver-local `deviceCache.has*` blob: the per-device
-* config is for operator-edited overrides + UI snapshots; runtime probe
-* results belong in runtime-state where the kernel handles persistence,
-* cross-process mirroring, and reactive updates.
+* P1 scope: admin-authored rules only (`createdBy` stamped from the
+* server-injected caller identity — the first `caller: 'required'`
+* adopter). The P1 condition subset is: devices, classes(+exclude),
+* minConfidence, admin zones (any/all + exclude), weekly schedule
+* windows, and the optional label/identity/plate matchers. User rules,
+* private zones, per-recipient fan-out and the wider condition table are
+* P2+ (see spec §7).
+*
+* All schemas here are the single source of truth — `NcRule` etc. are
+* `z.infer` exports; no duplicate interfaces (the advanced-notifier
+* schema/interface drift is explicitly not repeated).
 */
-var FeatureProbeStatusSchema = z.object({
+/**
+* D-3: the trigger/urgency of a rule — which persistence moment evaluates it.
+* The value maps 1:1 onto the evaluated record kind:
+*  - `immediate`     ↔ object-event persist (lowest-latency detection burst)
+*  - `track-end`     ↔ TrackCloser.closeExpired (finalized track record)
+*  - `device-event`  ↔ SensorEventStore insert (doorbell press / sensor state
+*                       change of a LINKED device, one row per linked camera)
+*  - `package-event` ↔ PackageDropDetector object-event insert (a `package`
+*                       delivery / pick-up)
+*
+* `immediate`/`track-end` carry the D-3 urgency semantics; `device-event`/
+* `package-event` are pure trigger kinds (no urgency dimension). Extending
+* this one field keeps the schema additive — a rule still declares exactly
+* one trigger.
+*/
+var NcDeliverySchema = z.enum([
+	"immediate",
+	"track-end",
+	"device-event",
+	"package-event"
+]);
+/** One weekly activation window. `startMinute > endMinute` crosses midnight. */
+var NcScheduleWindowSchema = z.object({
+	/** Days of week the window STARTS on (0 = Sunday … 6 = Saturday). */
+	days: z.array(z.number().int().min(0).max(6)).min(1),
+	startMinute: z.number().int().min(0).max(1439),
+	endMinute: z.number().int().min(0).max(1439)
+});
+/** Weekly schedule — OR of windows; absence on the rule = always active. */
+var NcScheduleSchema = z.object({
+	windows: z.array(NcScheduleWindowSchema).min(1),
+	/** IANA timezone; default = hub host timezone. */
+	timezone: z.string().optional(),
+	/** Active OUTSIDE the windows (e.g. "only outside business hours"). */
+	invert: z.boolean().optional()
+});
+/** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
+var NcPlateMatcherSchema = z.object({
+	values: z.array(z.string().min(1)).min(1),
+	/** Max Levenshtein distance after normalization (uppercase alphanumeric). */
+	maxDistance: z.number().int().min(0).max(3).default(1)
+});
+/**
+* Occupancy condition (DEVICE-EVENT trigger). Fires on a ZoneAnalytics
+* occupancy edge for a device — optionally narrowed to a single admin
+* `zoneId` and/or object `className`. `op` selects the edge/threshold:
+*  - `became-occupied` (default) — count crossed 0 → ≥ `count`
+*  - `became-free`               — count crossed ≥ `count` → below it
+*  - `>=` / `<=`                 — count is at/over or at/under `count`
+* `sustainSeconds` requires the condition hold continuously that long
+* before firing (debounces flicker; 0 = fire on the first matching edge).
+* Fail-closed: no ZoneAnalytics snapshot / missing zone / null snapshot ⇒
+* the condition never matches. Confirmed edge-state survives addon restarts
+* (declared SQLite collection, reseeded on boot).
+*/
+var NcOccupancyConditionSchema = z.object({
+	/** Admin zone id to scope the count to; absent = whole-frame occupancy. */
+	zoneId: z.string().optional(),
+	/** Object class to count; absent = any class. */
+	className: z.string().optional(),
+	op: z.enum([
+		"became-occupied",
+		"became-free",
+		">=",
+		"<="
+	]).default("became-occupied"),
+	count: z.number().int().min(0).default(1),
+	sustainSeconds: z.number().int().min(0).max(3600).default(15)
+});
+/** Admin-zone membership condition (zone IDs as stamped by the ZoneEngine). */
+var NcZoneConditionSchema = z.object({
+	ids: z.array(z.string().min(1)).min(1),
+	/** Quantifier over `ids` — at least one / every one visited. */
+	match: z.enum(["any", "all"]).default("any")
+});
+/**
+* The P1 condition set — a flat AND of groups; absent group = pass;
+* membership lists are OR within the list (spec §2.3).
+*/
+var NcConditionsSchema = z.object({
+	/** Device scope — absent = all devices. */
+	devices: z.array(z.number()).optional(),
+	/** Detector class names (any overlap with the record's class set). */
+	classes: z.array(z.string().min(1)).optional(),
+	/** Veto classes — any overlap fails the rule. */
+	classesExclude: z.array(z.string().min(1)).optional(),
+	/** Minimum detection confidence 0–1 (fails when the record has none). */
+	minConfidence: z.number().min(0).max(1).optional(),
+	/** Admin zone membership over event `zones` / track `zonesVisited`. */
+	zones: NcZoneConditionSchema.optional(),
+	/** Veto zones — any hit fails the rule. */
+	zonesExclude: z.array(z.string().min(1)).optional(),
 	/**
-	* Driver-specific flag bag. Each driver picks its own key names — the
-	* cap deliberately does NOT enforce a closed enum here. Reolink keys:
-	* `hasPtz`, `hasIntercom`, `hasDoorbell`, `hasFloodlight`, `hasSiren`,
-	* `hasPirSensor`, `hasAutotrack`, `hasBattery`. Hikvision keys:
-	* `hasSupplementalLight`, `lightHasWhiteLight`, `hasAlarmIo`, `hasPtz`.
+	* Exact (case-insensitive) match on the record's collapsed `label`
+	* (identity name / plate text / subclass).
 	*/
-	flags: z.record(z.string(), z.unknown()),
+	labelEquals: z.array(z.string().min(1)).optional(),
 	/**
-	* Coarse driver-classification — lets cross-process consumers tell apart
-	* cameras / battery-cams / NVRs without re-running the probe. `null`
-	* before the first probe completes.
+	* Identity matcher. P1 boundary: matched against the record's collapsed
+	* `label` (the identity display name propagated by the face pipeline) —
+	* identity-ID matching rides in P2 when identity ids reach the record.
 	*/
-	deviceType: z.string().nullable(),
-	/** Camera/firmware model string. `null` when the firmware doesn't expose it. */
-	model: z.string().nullable(),
-	/** Channel count for NVR/Hub devices; `1` for standalone cameras; `null` pre-probe. */
-	channelCount: z.number().nullable(),
+	identities: z.array(z.string().min(1)).optional(),
+	/** Fuzzy plate matcher against the record's `label` (plate text). */
+	plates: NcPlateMatcherSchema.optional(),
 	/**
-	* Ms epoch of the last SUCCESSFUL probe. `0` before the first probe
-	* completes — drivers' `getAccessoryChildren()` should treat zero as
-	* "probe not done yet, return empty" so accessories aren't spawned
-	* before the firmware is queried.
+	* Identity EXCLUDE — mirror of {@link identities} with `notIn` semantics.
+	* Same P1 boundary: matched against the record's collapsed `label` (the
+	* identity display name). A record with NO label passes (nothing to
+	* exclude), unlike the include variant which fails on an absent label.
 	*/
-	lastProbedAt: z.number(),
+	identitiesExclude: z.array(z.string().min(1)).optional(),
 	/**
-	* Framework convention: every runtime-state slice carries this for the
-	* createRuntimeStateBridge stale-check helper. We keep it in sync with
-	* `lastProbedAt` on every write.
+	* Minimum server-computed key-event importance in [0,1] (`Track.importance`).
+	* TRACK-END only: importance is scored at track close, so it does not exist
+	* at immediate / object-event evaluation time (see catalog `appliesTo`). At
+	* close the value is threaded via the close-time info (the `Track` clone is
+	* captured before the DB row is updated, so it would otherwise read stale).
+	* Fails when the record carries no importance (never guess quality — the
+	* `minConfidence` precedent). MVP cut: a single scalar threshold.
 	*/
-	lastFetchedAt: z.number()
+	minImportance: z.number().min(0).max(1).optional(),
+	/**
+	* Minimum track dwell in SECONDS — `(lastSeen − firstSeen) / 1000`.
+	* TRACK-END only: an `immediate` / object-event subject has no closed
+	* lifespan, so a dwell condition never matches immediate delivery
+	* (documented choice — the object-event record carries no `firstSeen`,
+	* so dwell cannot be computed from what the subject actually carries).
+	*/
+	minDwellSeconds: z.number().min(0).optional(),
+	/**
+	* Detection provenance filter. `any` (default / absent) matches every
+	* source; otherwise the subject's source must equal it. Legacy records
+	* with no stamped source are treated as `pipeline`. The union spans both
+	* record kinds — object events carry `pipeline` | `onboard`, synthetic
+	* tracks carry `sensor`.
+	*/
+	source: z.enum([
+		"pipeline",
+		"onboard",
+		"sensor",
+		"any"
+	]).optional(),
+	/**
+	* Minimum identity / plate MATCH confidence in [0,1] — DISTINCT from the
+	* detector `minConfidence` (that gates the object-detection score; this
+	* gates the recognition/OCR match score). Fails when the subject carries
+	* no label-match confidence (never guess). TRACK-END only: the confidence
+	* lives on the recognition result and reaches the subject at track close.
+	*
+	* What it measures precisely (plumbed at track close — the closer threads
+	* the value into `NcTrackClosedInfo.labelConfidence`, the same seam as
+	* `importance`): the BEST recognition match confidence observed for the
+	* label the track carries at close — for a face, the peak cosine similarity
+	* of the ASSIGNED identity (`FaceMatch.score`, reset on an identity switch);
+	* for a plate, the peak OCR read score of the best-held plate
+	* (`plateText.confidence`). When BOTH a face and a plate were recognized on
+	* one track the higher of the two is used. A track that ended with no
+	* confident identity/plate match carries no value, so the condition fails
+	* closed for it (an un-recognized subject).
+	*/
+	minLabelConfidence: z.number().min(0).max(1).optional(),
+	/**
+	* DEVICE-EVENT only. Raw device event-type tokens (`EventFire.eventType`,
+	* e.g. a doorbell `press` / `press_long`) — matched case-insensitively
+	* against the token carried on the device-event subject (extracted from the
+	* event-emitter runtime slice's `lastEvent.eventType`). Fails when the
+	* subject carries no token. Doorbell-pulse / passive-sensor kinds emit no
+	* eventType, so gate those with {@link sensorKinds} instead.
+	*/
+	eventTypeTokens: z.array(z.string().min(1)).optional(),
+	/**
+	* DEVICE-EVENT only. Sensor/control taxonomy kinds (e.g. `doorbell`,
+	* `contact`, `button`, `device-event`) — matched against the persisted
+	* `SensorEvent.kind` (see `sensor-event-kinds.ts`). Membership is OR.
+	*/
+	sensorKinds: z.array(z.string().min(1)).optional(),
+	/**
+	* PACKAGE-EVENT only. Which package phase fires the rule — `delivered`
+	* (a parked parcel appeared), `picked-up` (it departed), or `both`. Fails
+	* when the subject's phase does not match (a subject always carries a phase
+	* on the package-event trigger).
+	*/
+	packagePhase: z.enum([
+		"delivered",
+		"picked-up",
+		"both"
+	]).optional(),
+	/**
+	* PERSONAL-RULE custom zones (viewer-drawn). Inline normalized polygons
+	* (MaskShape vocabulary). A record passes when its bbox overlaps ANY
+	* listed polygon (ZoneEngine membership semantics). Evaluated only when
+	* the subject carries a bbox; absent bbox ⇒ the condition FAILS.
+	*/
+	customZones: z.array(MaskPolygonShapeSchema).optional(),
+	/**
+	* DEVICE-EVENT only. ZoneAnalytics occupancy edge — fires when a device's
+	* (optionally zone/class-scoped) occupancy count crosses the configured
+	* threshold and holds for `sustainSeconds`. Fail-closed on missing
+	* substrate (no snapshot / missing zone). See {@link NcOccupancyCondition}.
+	*/
+	occupancy: NcOccupancyConditionSchema.optional()
+});
+/** One delivery target: a `notification-output` Target ref + passthrough params. */
+var NcRuleTargetSchema = z.object({
+	/** `notification-output` Target id. */
+	targetId: z.string().min(1),
+	/**
+	* Per-backend passthrough. Recognized keys are mapped onto the canonical
+	* Notification (`priority`, `level`, `sound`, `clickUrl`, `ttl`); the
+	* degrade engine drops what the backend can't render.
+	*/
+	params: z.record(z.string(), z.unknown()).optional()
 });
-var featureProbeCapability = {
-	name: "feature-probe",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	methods: {},
-	events: { 
-	/** Fires whenever a fresh probe completes (kernel-driven `reprobe()`
-	*  or driver-initiated re-detect after a state change). */
-onProbeChanged: { data: z.object({
-		deviceId: z.number(),
-		status: FeatureProbeStatusSchema
-	}) } },
-	status: {
-		schema: FeatureProbeStatusSchema,
-		kind: "push"
-	},
-	runtimeState: FeatureProbeStatusSchema
-};
 /**
-* Multi-metric air-quality slice. Covers CO₂, total VOCs, particulate
-* matter at PM2.5 / PM10, and a derived AQI index — all optional so
-* a single-metric source populates only what it observes. Mirrors
-* the HA `sensor` device_class set (`co2`, `volatile_organic_compounds`,
-* `pm25`, `pm10`, `aqi`) collapsed into one cap because a typical
-* air-quality node reports several of these together; modelling them
-* as siblings keeps a single timestamp + one slice subscription.
+* Media attachment policy (P1 still-image subset).
+*  - `best` — the best AVAILABLE subject image at dispatch time (D-3).
+*  - `best-matching` — the media that explains WHY the rule fired: a rule
+*    matched on identities attaches the subject's `faceCrop`, one matched on
+*    plates attaches the `plateCrop`; a rule with no identity/plate condition
+*    (or when the specific crop is missing) degrades to `best`, then
+*    `keyFrame`, then no attachment — never delaying the send. The matched
+*    condition summary is frozen on the outbox row at enqueue (like the rule
+*    name), so the choice never drifts from the record that fired it.
+*  - `keyFrame` — the clean scene frame (no subject box).
+*  - `none` — no attachment.
 */
-var AirQualitySensorStatusSchema = z.object({
-	/** Carbon dioxide concentration in ppm. */
-	co2Ppm: z.number().min(0).optional(),
-	/** Total volatile organic compounds in ppb. */
-	vocPpb: z.number().min(0).optional(),
-	/** Particulate matter ≤ 2.5 μm in µg/m³. */
-	pm25: z.number().min(0).optional(),
-	/** Particulate matter ≤ 10 μm in µg/m³. */
-	pm10: z.number().min(0).optional(),
-	/** Composite AQI value (typically 0..500). */
-	aqi: z.number().optional(),
-	/** Ms epoch when the slice was last updated. */
-	lastFetchedAt: z.number(),
-	/** Live display unit of the single metric this slice carries (e.g. HA
-	*  `attributes.unit_of_measurement` → 'ppm' / 'ppb' / 'µg/m³'). Each
-	*  upstream `sensor.*` entity surfaces ONE device_class, so one unit
-	*  per slice is unambiguous. */
-	unit: z.string().optional(),
-	/** Suggested decimal places for numeric display.
-	*  Populated live from the upstream source when provided (e.g. HA
-	*  `attributes.suggested_display_precision`). Falls back to
-	*  auto-formatting when absent. */
-	precision: z.number().int().min(0).max(10).optional()
+var NcMediaPolicySchema = z.object({ attach: z.enum([
+	"best",
+	"best-matching",
+	"keyFrame",
+	"none"
+]).default("best") });
+/** Throttle — cooldown survives restarts (rebuilt from the outbox on boot). */
+var NcThrottleSchema = z.object({
+	cooldownSec: z.number().int().min(0).max(86400).default(60),
+	/** `rule` = one shared cooldown; `rule-device` = per-camera cooldown. */
+	scope: z.enum(["rule", "rule-device"]).default("rule-device")
+});
+/** Client-supplied rule fields (server stamps id/createdBy/createdAt/updatedAt). */
+var NcRuleInputSchema = z.object({
+	name: z.string().min(1).max(200),
+	enabled: z.boolean().default(true),
+	delivery: NcDeliverySchema,
+	conditions: NcConditionsSchema.default({}),
+	schedule: NcScheduleSchema.optional(),
+	targets: z.array(NcRuleTargetSchema).min(1),
+	media: NcMediaPolicySchema.default({ attach: "best" }),
+	throttle: NcThrottleSchema.default({
+		cooldownSec: 60,
+		scope: "rule-device"
+	}),
+	/** `{{var}}` templating over camera/class/label/zones/confidence/time. */
+	template: z.object({
+		title: z.string().max(500).optional(),
+		body: z.string().max(2e3).optional()
+	}).optional(),
+	/** Canonical notification priority ordinal (1..5); per-target overridable. */
+	priority: z.number().int().min(1).max(5).default(3),
+	/**
+	* Ownership/visibility key. Absent = admin/global rule (unchanged legacy
+	* behaviour, visible to all, read-only in the viewer). Present = personal
+	* rule owned by this userId. Server-stamped; never trusted from a client.
+	*/
+	ownerUserId: z.string().optional()
 });
-var airQualitySensorCapability = {
-	name: "air-quality-sensor",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	deviceTypes: [DeviceType.Sensor],
-	methods: {},
-	status: {
-		schema: AirQualitySensorStatusSchema,
-		kind: "push"
-	},
-	runtimeState: AirQualitySensorStatusSchema
-};
 /**
-* Alarm-panel cap. Models HA `alarm_control_panel.*` on
-* `DeviceType.AlarmPanel`. State follows HA's canonical lifecycle
-* across disarmed / armed_(home|away|night|vacation|custom_bypass) /
-* arming / pending / triggered / disarming.
-*
-* Many panels require a PIN code on arm / disarm — the optional
-* `code` field on the methods passes it through to the upstream
-* service; it's NEVER persisted in the runtime slice or any event
-* payload. The presence of a required code is signalled by
-* `DeviceFeature.AlarmPinRequired` so the UI gates a code-entry
-* field without a slice fetch.
-*
-* `availableModes` mirrors HA's `supported_features`-derived arm
-* mode list — the UI renders only the buttons the panel accepts.
+* Partial patch for `updateRule` — any subset of the input fields, plus the
+* persisted-only {@link NcRuleSchema} `disabledTargetIds` set. The latter is
+* NOT a client-authored input field (it lives on the persisted rule, not the
+* input), so it is added here explicitly to let the store's per-target opt-out
+* toggle round-trip through the shared `update` path. Viewer opt-out mutations
+* still flow through `nc.setRuleTargetEnabled` (owner-checked), never a raw
+* `updateRule` patch.
 */
-var AlarmStateSchema = z.enum([
-	"disarmed",
-	"armed_home",
-	"armed_away",
-	"armed_night",
-	"armed_vacation",
-	"armed_custom_bypass",
-	"arming",
-	"disarming",
+var NcRulePatchSchema = NcRuleInputSchema.partial().extend({ disabledTargetIds: z.array(z.string()).optional() });
+/** A persisted rule. */
+var NcRuleSchema = NcRuleInputSchema.extend({
+	id: z.string(),
+	/** userId of the admin who created the rule (server-stamped caller). */
+	createdBy: z.string(),
+	createdAt: z.number(),
+	updatedAt: z.number(),
+	/**
+	* Per-target opt-out set. A targetId here is suppressed for THIS rule at
+	* send time. Only a target's OWNER may add/remove its id (server-checked
+	* in `nc.setRuleTargetEnabled`). Defaults to empty.
+	*/
+	disabledTargetIds: z.array(z.string()).default([])
+});
+var NcTestResultSchema = z.object({
+	recordId: z.string(),
+	recordKind: z.enum([
+		"object-event",
+		"track",
+		"device-event",
+		"package-event"
+	]),
+	deviceId: z.number(),
+	timestamp: z.number(),
+	wouldFire: z.boolean(),
+	/** Condition id that failed (first failing group), when `wouldFire` is false. */
+	failedCondition: z.string().optional(),
+	className: z.string().optional(),
+	label: z.string().optional()
+});
+var NcConditionDescriptorSchema = z.object({
+	/** Field id inside `NcConditions` (or `'schedule'` for the rule-level group). */
+	id: z.string(),
+	group: z.enum([
+		"scope",
+		"class",
+		"zones",
+		"quality",
+		"label",
+		"schedule",
+		"device",
+		"package",
+		"occupancy"
+	]),
+	label: z.string(),
+	/** Editor widget the UI renders — never hardcode per-condition forms. */
+	valueType: z.enum([
+		"deviceIdList",
+		"stringList",
+		"number01",
+		"number",
+		"sourceSelect",
+		"zoneSelection",
+		"zoneIdList",
+		"schedule",
+		"plateMatcher",
+		"packagePhase",
+		"polygonDraw",
+		"occupancy"
+	]),
+	operator: z.enum([
+		"in",
+		"notIn",
+		"anyOf",
+		"allOf",
+		"gte",
+		"fuzzyIn",
+		"withinSchedule"
+	]),
+	/** Which delivery kinds the condition applies to. */
+	appliesTo: z.array(NcDeliverySchema),
+	phase: z.string(),
+	description: z.string().optional()
+});
+/**
+* The delivery lifecycle status of a history row — a straight read of the
+* durable outbox row's own status (single source of truth):
+*  - `pending` — enqueued, in-flight or retrying with backoff
+*  - `sent`    — delivered (terminal)
+*  - `dead`    — dead-lettered after exhausting retries / a permanent
+*                backend rejection / a deleted target (terminal; carries
+*                the failure `error`)
+*
+* P1 has no `suppressed-quiet-hours` / `snoozed` states — those ride the P2
+* user dimension (quiet hours / snooze) and are additive when they land.
+*/
+var NcHistoryStatusSchema = z.enum([
 	"pending",
-	"triggered"
+	"sent",
+	"dead"
 ]);
-var AlarmArmModeSchema = z.enum([
-	"home",
-	"away",
-	"night",
-	"vacation",
-	"custom_bypass"
+/** The evaluated record kind a history row descends from (one per trigger). */
+var NcHistoryRecordKindSchema = z.enum([
+	"object-event",
+	"track-end",
+	"device-event",
+	"package-event"
 ]);
-var AlarmPanelStatusSchema = z.object({
-	/** Current lifecycle state. */
-	state: AlarmStateSchema,
-	/** Subset of arm modes the panel accepts. UI renders one button per
-	*  mode in this list. */
-	availableModes: z.array(AlarmArmModeSchema),
-	/** Whether the panel requires a PIN on arm / disarm. Mirrors
-	*  `DeviceFeature.AlarmPinRequired` for slice consumers. */
-	requiresCode: z.boolean(),
-	/** Ms epoch when the slice was last updated. */
-	lastChangedAt: z.number()
+/** Subject summary frozen on the row at fire time (survives rule/record edits). */
+var NcHistorySubjectSchema = z.object({
+	className: z.string(),
+	label: z.string().optional(),
+	confidence: z.number().optional(),
+	zones: z.array(z.string()),
+	timestamp: z.number()
 });
-var alarmPanelCapability = {
-	name: "alarm-panel",
-	scope: "device",
-	deviceNative: true,
+/**
+* One delivery-history row. This is a read-only VIEW over the durable
+* outbox row (single source of truth — the same row the drain loop drives;
+* NO second write path, so history can never drift from delivery state).
+* The §3.2 fields map directly: `ruleId`/`targetId`/`deviceId` are columns,
+* `eventRef` is `recordKind`+`recordId`, `timestamps` are `createdAt`
+* (fire) / `updatedAt` (last transition), `status` + `error` are the
+* lifecycle. `ruleName` + `subject` are the intent snapshot frozen at
+* enqueue. `userId?` (per-recipient history) is P2 — no user dimension in
+* P1 (admin scope only).
+*/
+var NcHistoryEntrySchema = z.object({
+	/** Outbox row id — the stable dedup id `ruleId:dedupRef:targetId`. */
+	id: z.string(),
+	ruleId: z.string(),
+	/** Rule name frozen at fire time (outlives a later rename / delete). */
+	ruleName: z.string(),
+	/** The rule urgency/trigger that produced this delivery. */
+	delivery: NcDeliverySchema,
+	targetId: z.string(),
+	deviceId: z.number(),
+	recordKind: NcHistoryRecordKindSchema,
+	/** Event / track ref of the evaluated record (§3.2 `eventRef`). */
+	recordId: z.string(),
+	/** Present for track-scoped deliveries (object-event / track-end). */
+	trackId: z.string().optional(),
+	status: NcHistoryStatusSchema,
+	/** Delivery attempts made so far. */
+	attempts: z.number().int(),
+	/** Fire time (outbox enqueue). */
+	createdAt: z.number(),
+	/** Last transition time (terminal for sent / dead). */
+	updatedAt: z.number(),
+	/** Failure detail — present on a `dead` row. */
+	error: z.string().optional(),
+	subject: NcHistorySubjectSchema
+});
+/**
+* Query filter for `getHistory` (spec §4.2). Every field is a narrowing
+* AND; absent = unbounded on that axis. `since`/`until` bound the fire time
+* (`createdAt`, epoch ms, inclusive). `limit` is clamped to
+* {@link NC_HISTORY_LIMIT_MAX}. `userId` (per-recipient filtering) is P2.
+*/
+var NcHistoryFilterSchema = z.object({
+	ruleId: z.string().optional(),
+	deviceId: z.number().optional(),
+	status: NcHistoryStatusSchema.optional(),
+	since: z.number().optional(),
+	until: z.number().optional(),
+	limit: z.number().int().min(1).max(500).default(100)
+});
+var notificationRulesCapability = {
+	name: "notification-rules",
+	scope: "system",
 	mode: "singleton",
-	deviceTypes: [DeviceType.AlarmPanel],
 	methods: {
-		arm: method(z.object({
-			deviceId: z.number().int().nonnegative(),
-			mode: AlarmArmModeSchema,
-			/** Optional PIN code. Required when `requiresCode === true`.
-			*  Passed through to the upstream service; never persisted. */
-			code: z.string().min(1).optional()
-		}), z.void(), {
+		listRules: method(z.object({}), z.object({ rules: z.array(NcRuleSchema) }), { auth: "admin" }),
+		getRule: method(z.object({ ruleId: z.string() }), z.object({ rule: NcRuleSchema.nullable() }), { auth: "admin" }),
+		createRule: method(z.object({ rule: NcRuleInputSchema }), z.object({ rule: NcRuleSchema }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		updateRule: method(z.object({
+			ruleId: z.string(),
+			patch: NcRulePatchSchema
+		}), z.object({ rule: NcRuleSchema }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		deleteRule: method(z.object({ ruleId: z.string() }), z.object({ success: z.literal(true) }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		disarm: method(z.object({
-			deviceId: z.number().int().nonnegative(),
-			code: z.string().min(1).optional()
-		}), z.void(), {
+		setRuleEnabled: method(z.object({
+			ruleId: z.string(),
+			enabled: z.boolean()
+		}), z.object({ success: z.literal(true) }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
 		/**
-		* Force the panel into the `triggered` state — used by HA
-		* automations to surface external sensor events through the panel
-		* (e.g. a Reolink camera intrusion event firing the security
-		* system). Provider rejects when the panel hardware doesn't
-		* support a software-initiated trigger.
+		* Dry-run a rule against recently persisted records (object events for
+		* `immediate`, closed tracks for `track-end`). Mutation kind only to
+		* carry the full rule object safely; no side effects.
 		*/
-		trigger: method(z.object({ deviceId: z.number().int().nonnegative() }), z.void(), {
+		testRule: method(z.object({
+			rule: NcRuleInputSchema,
+			lookbackMinutes: z.number().int().min(1).max(1440).default(60)
+		}), z.object({ results: z.array(NcTestResultSchema) }), {
 			kind: "mutation",
 			auth: "admin"
-		})
-	},
-	status: {
-		schema: AlarmPanelStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — mirrored by the kernel. UI panel reads the
-	* full slice; renders an arm button per `availableModes` entry and
-	* a PIN field iff `requiresCode === true`.
-	*/
-	runtimeState: AlarmPanelStatusSchema
+		}),
+		getConditionCatalog: method(z.object({}), z.object({ catalog: z.array(NcConditionDescriptorSchema) })),
+		/**
+		* Queryable delivery history — a read-only view over the durable outbox
+		* (fired rule, subject summary, target, status, timestamps, error on a
+		* dead row). Newest-first, bounded by `filter.limit`. Retention follows
+		* the outbox's own terminal-row prune horizon (no separate history
+		* horizon — single collection, single source of truth). Admin-only in
+		* P1 (no user dimension); the P2 viewer History screen adds per-caller
+		* scoping on the same method.
+		*/
+		getHistory: method(z.object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), z.object({ entries: z.array(NcHistoryEntrySchema) }), { auth: "admin" })
+	}
 };
 /**
-* Ambient illuminance reading in lux. Drives Home Assistant `sensor`
-* entries with `device_class: illuminance`.
-*/
-var AmbientLightSensorStatusSchema = z.object({
-	/** Current illuminance in lux (lx). */
-	lux: z.number().min(0),
+* TimelapseRule — the STANDALONE scheduled timelapse producer's rule model.
+*
+* Spec: `docs/superpowers/specs/2026-07-24-nc-occupancy-timelapse-design.md`
+* §3.2/§3.3.
+*
+* Deliberately NOT a capability definition and NOT an `NcRule`:
+*  - Every `NcDelivery` member is a *persisted-pipeline-record* trigger. A
+*    timelapse fires on a SCHEDULE WINDOW BOUNDARY, evaluates no pipeline
+*    record, and produces a video it assembled itself — so it rides no
+*    delivery-enum member (the enum is frozen) and no cap method. This file is
+*    a plain typed schema; it does NOT go through `npm run codegen`.
+*  - It shares only the delivery leg (`notification-output.send`) and the
+*    persistence/ownership patterns with the Notification Center, reusing
+*    {@link NcScheduleSchema} (weekly windows, midnight-crossing, invertible)
+*    and {@link NcRuleTargetSchema} (target ref + passthrough params).
+*
+* Ownership is SERVER-DERIVED. `ownerUserId` / `createdBy` / `createdAt` /
+* `updatedAt` / `id` / `lastGeneratedAt` live on the PERSISTED rule only —
+* {@link TimelapseRuleInputSchema} and {@link TimelapseRulePatchSchema} do not
+* carry them, so a forged client payload can never claim or re-own a rule
+* (Zod strips unknown keys). The store stamps them from the resolved caller.
+*/
+/** `{{var}}` templating over camera/rule/time — same vocabulary as `NcRule`. */
+var TimelapseTemplateSchema = z.object({
+	title: z.string().max(500).optional(),
+	body: z.string().max(2e3).optional()
+});
+var NameField = z.string().min(1).max(200);
+var DeviceIdsField = z.array(z.number()).min(1);
+var CadenceSecField = z.number().int().min(2).max(3600);
+var FramerateField = z.number().int().min(1).max(60);
+var TargetsField = z.array(NcRuleTargetSchema).min(1);
+var PriorityField = z.number().int().min(1).max(5);
+/**
+* Client-supplied timelapse-rule fields. The server stamps id / createdBy /
+* createdAt / updatedAt / ownerUserId / lastGeneratedAt — none of them appear
+* here (see the ownership note above).
+*/
+var TimelapseRuleInputSchema = z.object({
+	name: NameField,
+	enabled: z.boolean().default(true),
+	/** Cameras sampled by this rule — one scratch dir + one artifact per device. */
+	deviceIds: DeviceIdsField,
+	/**
+	* Activation window(s). REQUIRED (unlike `NcRule`, where an absent schedule
+	* means "always active"): a timelapse is defined by its window boundaries —
+	* open clears the scratch, close assembles and delivers.
+	*/
+	schedule: NcScheduleSchema,
+	/** Force-snapshot cadence inside the window, seconds (predecessor parity). */
+	cadenceSec: CadenceSecField.default(15),
+	/** Output frames per second of the assembled mp4 (predecessor parity). */
+	framerate: FramerateField.default(10),
+	/** `notification-output` targets the finished video/thumbnail is sent to. */
+	targets: TargetsField,
+	template: TimelapseTemplateSchema.optional(),
+	/** Canonical notification priority ordinal (1..5); per-target overridable. */
+	priority: PriorityField.default(3)
+});
+z.object({
+	name: NameField.optional(),
+	enabled: z.boolean().optional(),
+	deviceIds: DeviceIdsField.optional(),
+	schedule: NcScheduleSchema.optional(),
+	cadenceSec: CadenceSecField.optional(),
+	framerate: FramerateField.optional(),
+	targets: TargetsField.optional(),
+	template: TimelapseTemplateSchema.nullable().optional(),
+	priority: PriorityField.optional()
+});
+TimelapseRuleInputSchema.extend({
+	id: z.string(),
+	/**
+	* Ownership/visibility key. Absent = admin/global rule (visible to all).
+	* Present = personal rule owned by this userId. Server-stamped from the
+	* resolved caller; never trusted from a client payload.
+	*/
+	ownerUserId: z.string().optional(),
+	/**
+	* Epoch-ms of the last successful generation — the 1-hour re-generation
+	* guard's durable state (predecessor parity). Absent = never generated.
+	*/
+	lastGeneratedAt: z.number().optional(),
+	/** userId of the caller who created the rule (server-stamped). */
+	createdBy: z.string(),
+	createdAt: z.number(),
+	updatedAt: z.number()
+});
+/**
+* Generic device-level status snapshot. Auto-registered by `BaseDevice`
+* for every device, regardless of provider — the kernel needs a uniform
+* cap-keyed slice for the basic device flags every consumer expects to
+* read across processes (the `online` flag in particular). Driver-specific
+* caps (`battery`, `doorbell`, …) carry their domain-specific state on
+* their own slices.
+*
+* Pattern is identical to `battery`: schema-bearing `runtimeState`,
+* empty `methods`, single change event. Reads land at
+* `runtimeState.getCapState('device-status')`; writes at
+* `runtimeState.setCapState('device-status', …)`. Cross-process
+* consumers reach the same data via the `device-state` cap router
+* (`getCapSlice({deviceId, capName: 'device-status'})`).
+*/
+var DeviceStatusSchema = z.object({
+	/**
+	* Device-level liveness. Drivers flip via `markOnline(boolean)` on
+	* `BaseDevice`. Provider semantics vary — RTSP aggregates broker
+	* stream-health, Reolink reads firmware push events, ONVIF tracks
+	* ping responses. This cap intentionally does NOT prescribe which
+	* signal drives the flag.
+	*/
+	online: z.boolean(),
+	/** Ms epoch of the last `online` transition. Lets consumers tell
+	*  apart "just came online" from "still online". */
+	lastChangedAt: z.number()
+});
+var deviceStatusCapability = {
+	name: "device-status",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	methods: {},
+	events: { 
+	/** Emitted when `online` transitions. Mirrors the semantics of
+	*  `battery.onStatusChanged`. */
+onStatusChanged: { data: z.object({
+		deviceId: z.number(),
+		status: DeviceStatusSchema
+	}) } },
+	status: {
+		schema: DeviceStatusSchema,
+		kind: "push"
+	},
+	runtimeState: DeviceStatusSchema
+};
+/**
+* Per-device feature/identity probe slice. Holds the runtime-resolved
+* truth about what a device CAN do — which the kernel uses to:
+*   1. Reconcile accessory children (hub-children spawn siren/floodlight/PIR
+*      based on what the firmware actually advertises).
+*   2. Compute the public `features: DeviceFeature[]` array surfaced via
+*      `device-manager.listAll`.
+*   3. Decide which optional caps (PTZ, intercom, doorbell, battery, …)
+*      to register on the device's capability surface.
+*
+* Auto-registered by `BaseDevice` for every device. Drivers populate the
+* slice from `onProbe()` (kernel calls it once after register, before
+* accessory reconciliation). Consumers read via:
+*   `runtimeState.getCapState<FeatureProbeStatus>('feature-probe')`
+*
+* `flags` is an open record so each driver carries its own keys without
+* a centralized schema bottleneck — Reolink writes `hasPtz/hasIntercom`,
+* Hikvision writes `hasSupplementalLight/hasAlarmIo`, etc.
+*
+* Replaces the older driver-local `deviceCache.has*` blob: the per-device
+* config is for operator-edited overrides + UI snapshots; runtime probe
+* results belong in runtime-state where the kernel handles persistence,
+* cross-process mirroring, and reactive updates.
+*/
+var FeatureProbeStatusSchema = z.object({
+	/**
+	* Driver-specific flag bag. Each driver picks its own key names — the
+	* cap deliberately does NOT enforce a closed enum here. Reolink keys:
+	* `hasPtz`, `hasIntercom`, `hasDoorbell`, `hasFloodlight`, `hasSiren`,
+	* `hasPirSensor`, `hasAutotrack`, `hasBattery`. Hikvision keys:
+	* `hasSupplementalLight`, `lightHasWhiteLight`, `hasAlarmIo`, `hasPtz`.
+	*/
+	flags: z.record(z.string(), z.unknown()),
+	/**
+	* Coarse driver-classification — lets cross-process consumers tell apart
+	* cameras / battery-cams / NVRs without re-running the probe. `null`
+	* before the first probe completes.
+	*/
+	deviceType: z.string().nullable(),
+	/** Camera/firmware model string. `null` when the firmware doesn't expose it. */
+	model: z.string().nullable(),
+	/** Channel count for NVR/Hub devices; `1` for standalone cameras; `null` pre-probe. */
+	channelCount: z.number().nullable(),
+	/**
+	* Ms epoch of the last SUCCESSFUL probe. `0` before the first probe
+	* completes — drivers' `getAccessoryChildren()` should treat zero as
+	* "probe not done yet, return empty" so accessories aren't spawned
+	* before the firmware is queried.
+	*/
+	lastProbedAt: z.number(),
+	/**
+	* Framework convention: every runtime-state slice carries this for the
+	* createRuntimeStateBridge stale-check helper. We keep it in sync with
+	* `lastProbedAt` on every write.
+	*/
+	lastFetchedAt: z.number()
+});
+var featureProbeCapability = {
+	name: "feature-probe",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	methods: {},
+	events: { 
+	/** Fires whenever a fresh probe completes (kernel-driven `reprobe()`
+	*  or driver-initiated re-detect after a state change). */
+onProbeChanged: { data: z.object({
+		deviceId: z.number(),
+		status: FeatureProbeStatusSchema
+	}) } },
+	status: {
+		schema: FeatureProbeStatusSchema,
+		kind: "push"
+	},
+	runtimeState: FeatureProbeStatusSchema
+};
+/**
+* Multi-metric air-quality slice. Covers CO₂, total VOCs, particulate
+* matter at PM2.5 / PM10, and a derived AQI index — all optional so
+* a single-metric source populates only what it observes. Mirrors
+* the HA `sensor` device_class set (`co2`, `volatile_organic_compounds`,
+* `pm25`, `pm10`, `aqi`) collapsed into one cap because a typical
+* air-quality node reports several of these together; modelling them
+* as siblings keeps a single timestamp + one slice subscription.
+*/
+var AirQualitySensorStatusSchema = z.object({
+	/** Carbon dioxide concentration in ppm. */
+	co2Ppm: z.number().min(0).optional(),
+	/** Total volatile organic compounds in ppb. */
+	vocPpb: z.number().min(0).optional(),
+	/** Particulate matter ≤ 2.5 μm in µg/m³. */
+	pm25: z.number().min(0).optional(),
+	/** Particulate matter ≤ 10 μm in µg/m³. */
+	pm10: z.number().min(0).optional(),
+	/** Composite AQI value (typically 0..500). */
+	aqi: z.number().optional(),
 	/** Ms epoch when the slice was last updated. */
 	lastFetchedAt: z.number(),
-	/** Live display unit from the upstream source (e.g. HA
-	*  `attributes.unit_of_measurement`). The UI prefers this over the
-	*  role's canonical unit. Absent → fall back to the canonical unit. */
+	/** Live display unit of the single metric this slice carries (e.g. HA
+	*  `attributes.unit_of_measurement` → 'ppm' / 'ppb' / 'µg/m³'). Each
+	*  upstream `sensor.*` entity surfaces ONE device_class, so one unit
+	*  per slice is unambiguous. */
 	unit: z.string().optional(),
 	/** Suggested decimal places for numeric display.
 	*  Populated live from the upstream source when provided (e.g. HA
@@ -5419,88 +5964,214 @@ var AmbientLightSensorStatusSchema = z.object({
 	*  auto-formatting when absent. */
 	precision: z.number().int().min(0).max(10).optional()
 });
-var ambientLightSensorCapability = {
-	name: "ambient-light-sensor",
+var airQualitySensorCapability = {
+	name: "air-quality-sensor",
 	scope: "device",
 	deviceNative: true,
 	mode: "singleton",
 	deviceTypes: [DeviceType.Sensor],
 	methods: {},
 	status: {
-		schema: AmbientLightSensorStatusSchema,
+		schema: AirQualitySensorStatusSchema,
 		kind: "push"
 	},
-	runtimeState: AmbientLightSensorStatusSchema
+	runtimeState: AirQualitySensorStatusSchema
 };
 /**
-* Per-class audio metrics aggregated over a sliding window.
-*/
-var AudioClassSummarySchema = z.object({
-	className: z.string(),
-	/** Number of windows (chunks) where this class was the top hit. */
-	hits: z.number().int().nonnegative(),
-	/** Mean score across those hits, clamped to [0,1]. */
-	avgScore: z.number().min(0).max(1),
-	/** Peak score in the window. */
-	peakScore: z.number().min(0).max(1)
-});
-/**
-* Per-camera audio metrics snapshot — emitted by the analytics frame
-* handler on every `pipeline.audio-inference-result` event and
-* mirrored into the `audio-metrics` device-state slice. Symmetric
-* with `zone-analytics` snapshots for video — every consumer
-* (admin UI panel, automations, alert rules) reads via the
-* canonical `device.state.audioMetrics.value` reactive handle.
+* Alarm-panel cap. Models HA `alarm_control_panel.*` on
+* `DeviceType.AlarmPanel`. State follows HA's canonical lifecycle
+* across disarmed / armed_(home|away|night|vacation|custom_bypass) /
+* arming / pending / triggered / disarming.
 *
-* Aggregates are computed over a rolling `windowSec` window
-* (default 60s). Past that window, classes drop out of `byClass`
-* and the level history shifts forward.
-*/
-var AudioMetricsSnapshotSchema = z.object({
-	/** Wall-clock timestamp (ms) of the most recent audio window. */
-	ts: z.number().int(),
-	/** Sliding-window length (seconds) used for aggregation. */
-	windowSec: z.number().int().positive(),
-	/** Latest level reading from the most recent window. */
-	level: z.object({
-		rms: z.number(),
-		dbfs: z.number()
-	}),
-	/** Peak dBFS observed across the rolling window. */
-	peakDbfs: z.number(),
-	/** Mean dBFS across the rolling window. */
-	avgDbfs: z.number(),
-	/** Most recent above-threshold classification, or null on silence. */
-	current: z.object({
-		className: z.string(),
-		score: z.number().min(0).max(1),
-		timestamp: z.number().int()
-	}).nullable(),
-	/** Per-class summary across the rolling window — keys are
-	*  `macroClass` strings (e.g. `dog_bark`, `speech`, `glass_break`). */
-	byClass: z.array(AudioClassSummarySchema).readonly()
-});
-/**
-* One sample on the audio-metrics history time-series. Captures the
-* subset of the live snapshot useful for charting: dB level, peak/avg
-* over the rolling window, and the dominant above-threshold class
-* (when any). Per-class hit breakdown lives on the snapshot but is
-* elided from the history sample to keep the buffer compact —
-* consumers needing class drill-down should pull `getCurrentSnapshot`.
+* Many panels require a PIN code on arm / disarm — the optional
+* `code` field on the methods passes it through to the upstream
+* service; it's NEVER persisted in the runtime slice or any event
+* payload. The presence of a required code is signalled by
+* `DeviceFeature.AlarmPinRequired` so the UI gates a code-entry
+* field without a slice fetch.
+*
+* `availableModes` mirrors HA's `supported_features`-derived arm
+* mode list — the UI renders only the buttons the panel accepts.
 */
-var AudioMetricsHistoryPointSchema = z.object({
-	/** Wall-clock ms when this sample was recorded. */
-	ts: z.number().int(),
-	/** Instantaneous dBFS level at sample time. `null` for windows where
-	*  the source had no level reading (rare; happens at decode startup). */
-	dbfs: z.number().nullable(),
-	/** Rolling-window peak dBFS at sample time. Same window the live
-	*  snapshot reports. */
-	peakDbfs: z.number(),
-	/** Rolling-window mean dBFS at sample time. */
-	avgDbfs: z.number(),
-	/** Dominant above-threshold class at sample time, or null on silence. */
-	topClass: z.string().nullable(),
+var AlarmStateSchema = z.enum([
+	"disarmed",
+	"armed_home",
+	"armed_away",
+	"armed_night",
+	"armed_vacation",
+	"armed_custom_bypass",
+	"arming",
+	"disarming",
+	"pending",
+	"triggered"
+]);
+var AlarmArmModeSchema = z.enum([
+	"home",
+	"away",
+	"night",
+	"vacation",
+	"custom_bypass"
+]);
+var AlarmPanelStatusSchema = z.object({
+	/** Current lifecycle state. */
+	state: AlarmStateSchema,
+	/** Subset of arm modes the panel accepts. UI renders one button per
+	*  mode in this list. */
+	availableModes: z.array(AlarmArmModeSchema),
+	/** Whether the panel requires a PIN on arm / disarm. Mirrors
+	*  `DeviceFeature.AlarmPinRequired` for slice consumers. */
+	requiresCode: z.boolean(),
+	/** Ms epoch when the slice was last updated. */
+	lastChangedAt: z.number()
+});
+var alarmPanelCapability = {
+	name: "alarm-panel",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.AlarmPanel],
+	methods: {
+		arm: method(z.object({
+			deviceId: z.number().int().nonnegative(),
+			mode: AlarmArmModeSchema,
+			/** Optional PIN code. Required when `requiresCode === true`.
+			*  Passed through to the upstream service; never persisted. */
+			code: z.string().min(1).optional()
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		disarm: method(z.object({
+			deviceId: z.number().int().nonnegative(),
+			code: z.string().min(1).optional()
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Force the panel into the `triggered` state — used by HA
+		* automations to surface external sensor events through the panel
+		* (e.g. a Reolink camera intrusion event firing the security
+		* system). Provider rejects when the panel hardware doesn't
+		* support a software-initiated trigger.
+		*/
+		trigger: method(z.object({ deviceId: z.number().int().nonnegative() }), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	status: {
+		schema: AlarmPanelStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI panel reads the
+	* full slice; renders an arm button per `availableModes` entry and
+	* a PIN field iff `requiresCode === true`.
+	*/
+	runtimeState: AlarmPanelStatusSchema
+};
+/**
+* Ambient illuminance reading in lux. Drives Home Assistant `sensor`
+* entries with `device_class: illuminance`.
+*/
+var AmbientLightSensorStatusSchema = z.object({
+	/** Current illuminance in lux (lx). */
+	lux: z.number().min(0),
+	/** Ms epoch when the slice was last updated. */
+	lastFetchedAt: z.number(),
+	/** Live display unit from the upstream source (e.g. HA
+	*  `attributes.unit_of_measurement`). The UI prefers this over the
+	*  role's canonical unit. Absent → fall back to the canonical unit. */
+	unit: z.string().optional(),
+	/** Suggested decimal places for numeric display.
+	*  Populated live from the upstream source when provided (e.g. HA
+	*  `attributes.suggested_display_precision`). Falls back to
+	*  auto-formatting when absent. */
+	precision: z.number().int().min(0).max(10).optional()
+});
+var ambientLightSensorCapability = {
+	name: "ambient-light-sensor",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: AmbientLightSensorStatusSchema,
+		kind: "push"
+	},
+	runtimeState: AmbientLightSensorStatusSchema
+};
+/**
+* Per-class audio metrics aggregated over a sliding window.
+*/
+var AudioClassSummarySchema = z.object({
+	className: z.string(),
+	/** Number of windows (chunks) where this class was the top hit. */
+	hits: z.number().int().nonnegative(),
+	/** Mean score across those hits, clamped to [0,1]. */
+	avgScore: z.number().min(0).max(1),
+	/** Peak score in the window. */
+	peakScore: z.number().min(0).max(1)
+});
+/**
+* Per-camera audio metrics snapshot — emitted by the analytics frame
+* handler on every `pipeline.audio-inference-result` event and
+* mirrored into the `audio-metrics` device-state slice. Symmetric
+* with `zone-analytics` snapshots for video — every consumer
+* (admin UI panel, automations, alert rules) reads via the
+* canonical `device.state.audioMetrics.value` reactive handle.
+*
+* Aggregates are computed over a rolling `windowSec` window
+* (default 60s). Past that window, classes drop out of `byClass`
+* and the level history shifts forward.
+*/
+var AudioMetricsSnapshotSchema = z.object({
+	/** Wall-clock timestamp (ms) of the most recent audio window. */
+	ts: z.number().int(),
+	/** Sliding-window length (seconds) used for aggregation. */
+	windowSec: z.number().int().positive(),
+	/** Latest level reading from the most recent window. */
+	level: z.object({
+		rms: z.number(),
+		dbfs: z.number()
+	}),
+	/** Peak dBFS observed across the rolling window. */
+	peakDbfs: z.number(),
+	/** Mean dBFS across the rolling window. */
+	avgDbfs: z.number(),
+	/** Most recent above-threshold classification, or null on silence. */
+	current: z.object({
+		className: z.string(),
+		score: z.number().min(0).max(1),
+		timestamp: z.number().int()
+	}).nullable(),
+	/** Per-class summary across the rolling window — keys are
+	*  `macroClass` strings (e.g. `dog_bark`, `speech`, `glass_break`). */
+	byClass: z.array(AudioClassSummarySchema).readonly()
+});
+/**
+* One sample on the audio-metrics history time-series. Captures the
+* subset of the live snapshot useful for charting: dB level, peak/avg
+* over the rolling window, and the dominant above-threshold class
+* (when any). Per-class hit breakdown lives on the snapshot but is
+* elided from the history sample to keep the buffer compact —
+* consumers needing class drill-down should pull `getCurrentSnapshot`.
+*/
+var AudioMetricsHistoryPointSchema = z.object({
+	/** Wall-clock ms when this sample was recorded. */
+	ts: z.number().int(),
+	/** Instantaneous dBFS level at sample time. `null` for windows where
+	*  the source had no level reading (rare; happens at decode startup). */
+	dbfs: z.number().nullable(),
+	/** Rolling-window peak dBFS at sample time. Same window the live
+	*  snapshot reports. */
+	peakDbfs: z.number(),
+	/** Rolling-window mean dBFS at sample time. */
+	avgDbfs: z.number(),
+	/** Dominant above-threshold class at sample time, or null on silence. */
+	topClass: z.string().nullable(),
 	/** Score of the dominant class (`null` whenever `topClass` is null). */
 	topScore: z.number().min(0).max(1).nullable()
 });
@@ -9712,69 +10383,6 @@ var motionTriggerCapability = {
 	runtimeState: MotionTriggerRuntimeStateSchema
 };
 /**
-* Shared geometry vocabulary for on-frame shape caps — privacy-mask,
-* motion-zones, and the detection zones/lines editor all speak this one
-* language so a single drawing-plane editor and the providers stay
-* decoupled from each cap's storage.
-*
-* All coordinates are normalized 0..1 of the camera frame (top-left
-* origin). Each cap composes the SUBSET of shape kinds it supports and
-* advertises it via `supportedShapes` in its `getOptions`.
-*/
-/** A normalized 0..1 point (top-left origin). */
-var MaskPointSchema = z.object({
-	x: z.number(),
-	y: z.number()
-});
-/** Axis-aligned rectangle (normalized 0..1). */
-var MaskRectShapeSchema = z.object({
-	kind: z.literal("rect"),
-	x: z.number(),
-	y: z.number(),
-	width: z.number(),
-	height: z.number()
-});
-/** Free polygon — an ordered list of normalized vertices (≥3). */
-var MaskPolygonShapeSchema = z.object({
-	kind: z.literal("polygon"),
-	points: z.array(MaskPointSchema)
-});
-/** Boolean cell grid — row-major, length === gridWidth*gridHeight. */
-var MaskGridShapeSchema = z.object({
-	kind: z.literal("grid"),
-	gridWidth: z.number(),
-	gridHeight: z.number(),
-	cells: z.array(z.boolean())
-});
-/** Directed line / tripwire — an ordered list of normalized points (≥2). */
-var MaskLineShapeSchema = z.object({
-	kind: z.literal("line"),
-	points: z.array(MaskPointSchema)
-});
-z.discriminatedUnion("kind", [
-	MaskRectShapeSchema,
-	MaskPolygonShapeSchema,
-	MaskGridShapeSchema,
-	MaskLineShapeSchema
-]);
-/** Every shape-kind discriminant, for `supportedShapes` advertisement. */
-var MaskShapeKindSchema = z.enum([
-	"rect",
-	"polygon",
-	"grid",
-	"line"
-]);
-/** Polygon vertex bounds when a cap supports 'polygon' (e.g. Hikvision {min:4,max:4}). */
-var MaskPolygonVerticesSchema = z.object({
-	min: z.number(),
-	max: z.number()
-});
-/** Grid dimensions when a cap supports 'grid'. */
-var MaskGridDimsSchema = z.object({
-	width: z.number(),
-	height: z.number()
-});
-/**
 * Motion-zones share the same MaskShape vocabulary as privacy-mask — the
 * on-camera motion-detection mask is a single `grid` region (a row-major
 * boolean cell lattice the camera's onboard VMD evaluates). Composing it as
@@ -12797,21 +13405,97 @@ var authProviderCapability = {
 	mount: { kind: "skip" }
 };
 /**
-* Orchestrator-side destination metadata. The orchestrator computes
-* `id = <addonId>:<subId>` from its provider lookup so consumers
-* (admin UI, restore flow) see one canonical key.
-*
-* Phase 4 (admin UI redesign) adds the per-destination policy fields
-* (`enabled`, `retentionCount`, `label`) so the destinations table can
-* render the joined view without a follow-up round-trip. The backend
-* already joins these in `listDestinations` — we now surface them on
-* the wire.
-*
-* `lastSuccessAt` / `lastSuccessSizeBytes` are computed from each
-* location's `manifests.json` (newest archive). Optional — locations
-* with no archives yet leave them undefined.
+* A live terminal session hosted by the provider addon. Output and input do
+* NOT flow through the capability — they use the addon data plane
+* (`GET /addon/terminal/<id>/out` SSE, `POST /addon/terminal/<id>/in`) because
+* terminal output must be ordered and lossless. The event bus is telemetry and
+* may drop chunks ([D8]), and a dropped chunk desynchronises the vt parser
+* permanently until a full repaint. The capability owns only lifecycle.
 */
-var BackupDestinationInfoSchema = z.object({
+var TerminalSessionInfoSchema = z.object({
+	/** Opaque session id minted by the provider on `openSession`. */
+	sessionId: z.string(),
+	/** The pre-declared profile this session runs (never a free-form command). */
+	profileId: z.string(),
+	/** Human-readable profile label for the UI session list. */
+	label: z.string(),
+	cols: z.number().int().positive(),
+	rows: z.number().int().positive(),
+	/** ms-epoch the session's pty was spawned. */
+	startedAt: z.number()
+});
+/**
+* A profile the operator may open — a pre-declared, allowlisted program
+* (`monitor` → `btm`). The capability accepts only these ids; a free-form
+* command string would be remote code execution as the server's user, so it is
+* deliberately not part of the contract.
+*/
+var TerminalProfileInfoSchema = z.object({
+	profileId: z.string(),
+	label: z.string(),
+	description: z.string().optional()
+});
+/**
+* terminal-session — singleton system capability for interactive TTY sessions.
+*
+* Phase 1 (this cap): open/resize/close/list a pty running an allowlisted
+* profile, streamed to xterm.js over the data plane. Phase 2 (streaming a
+* session as a camera) is a separate device-provider concern and does not
+* change this contract.
+*/
+var terminalSessionCapability = {
+	name: "terminal-session",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/** Pre-declared profiles the operator may open. */
+		listProfiles: method(z.void(), z.array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }),
+		/** Live sessions currently hosted by the provider. */
+		listSessions: method(z.void(), z.array(TerminalSessionInfoSchema).readonly(), { auth: "admin" }),
+		/**
+		* Spawn a pty for an allowlisted profile at the given grid size and return
+		* its session id. Output/input then flow over the data plane by that id.
+		*/
+		openSession: method(z.object({
+			profileId: z.string(),
+			cols: z.number().int().positive(),
+			rows: z.number().int().positive()
+		}), TerminalSessionInfoSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Resize a live session's pty (reflows the running program). */
+		resize: method(z.object({
+			sessionId: z.string(),
+			cols: z.number().int().positive(),
+			rows: z.number().int().positive()
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Terminate a live session and release its pty. */
+		close: method(z.object({ sessionId: z.string() }), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
+* Orchestrator-side destination metadata. The orchestrator computes
+* `id = <addonId>:<subId>` from its provider lookup so consumers
+* (admin UI, restore flow) see one canonical key.
+*
+* Phase 4 (admin UI redesign) adds the per-destination policy fields
+* (`enabled`, `retentionCount`, `label`) so the destinations table can
+* render the joined view without a follow-up round-trip. The backend
+* already joins these in `listDestinations` — we now surface them on
+* the wire.
+*
+* `lastSuccessAt` / `lastSuccessSizeBytes` are computed from each
+* location's `manifests.json` (newest archive). Optional — locations
+* with no archives yet leave them undefined.
+*/
+var BackupDestinationInfoSchema = z.object({
 	/**
 	* Sub-id within this addon. Convention `default` for single-
 	* destination addons; addons that host many (S3 with N buckets)
@@ -15814,780 +16498,261 @@ var mqttBrokerCapability = {
 	}
 };
 var NetworkEndpointSchema = z.object({
-	url: z.string(),
-	hostname: z.string(),
-	port: z.number(),
-	protocol: z.enum(["http", "https"])
-});
-var NetworkAccessStatusSchema = z.object({
-	connected: z.boolean(),
-	endpoint: NetworkEndpointSchema.nullable(),
-	error: z.string().optional()
-});
-/**
-* Optional, richer endpoint shape returned by providers that expose
-* MORE than one ingress concurrently (Tailscale Ingress with mixed
-* serve+funnel rules, future ngrok multi-tunnel, …). Each entry carries
-* the originating provider config (mode + sourcePort) so the
-* orchestrator UI can label rows distinctly. Providers that expose only
-* one endpoint just omit `listEndpoints` from their provider impl.
-*/
-var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
-	/**
-	* Stable id within the provider — typically `<mode>-<sourcePort>` so
-	* the orchestrator can dedupe across `listEndpoints` polls.
-	*/
-	id: z.string(),
-	/** Operator-facing label (mirrors `MeshEndpoint.label`). */
-	label: z.string(),
-	/** Optional provider-specific mode tag, used for icon/colour in admin UI. */
-	mode: z.string().optional(),
-	/** Originating local port the ingress fronts (informational). */
-	sourcePort: z.number().optional()
-});
-var networkAccessCapability = {
-	name: "network-access",
-	scope: "system",
-	mode: "collection",
-	providerKind: "ingress",
-	methods: {
-		start: method(z.void(), NetworkEndpointSchema, { kind: "mutation" }),
-		stop: method(z.void(), z.void(), { kind: "mutation" }),
-		getEndpoint: method(z.void(), NetworkEndpointSchema.nullable()),
-		getStatus: method(z.void(), NetworkAccessStatusSchema),
-		/**
-		* Enumerate every active ingress entry. Providers that expose only a
-		* single endpoint may omit this method; callers fall back to
-		* `getEndpoint()` in that case.
-		*/
-		listEndpoints: method(z.void(), z.array(NetworkEndpointEntrySchema).readonly())
-	}
-};
-/**
-* notification-output — canonical, capability-gated notification delivery.
-*
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
-*
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
-*
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = z.enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = z.object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: z.string().optional(),
-	bytes: z.instanceof(Uint8Array).optional(),
-	mime: z.string().optional(),
-	name: z.string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = z.enum([
-	"text",
-	"markdown",
-	"html"
-]);
-/** A single tap-through action button. */
-var NotificationActionSchema = z.object({
-	id: z.string(),
-	label: z.string(),
-	url: z.string().optional()
-});
-/**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
-*/
-var NotificationSchema = z.object({
-	body: z.string(),
-	title: z.string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: z.number().int().min(1).max(5).default(3),
-	level: z.string().optional(),
-	attachments: z.array(AttachmentSchema).optional(),
-	clickUrl: z.string().optional(),
-	actions: z.array(NotificationActionSchema).optional(),
-	sound: z.string().optional(),
-	ttl: z.number().optional(),
-	tag: z.string().optional(),
-	deviceId: z.number().optional(),
-	eventId: z.string().optional(),
-	metadata: z.record(z.string(), z.unknown()).optional()
-});
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = z.object({
-	id: z.string(),
-	label: z.string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: z.number().int().min(1).max(5).nullable(),
-	flags: z.object({
-		critical: z.boolean().optional(),
-		silent: z.boolean().optional(),
-		noPush: z.boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: z.array(z.string()).optional(),
-	description: z.string().optional()
-});
-/** Attachment capabilities for a kind (drives the degrade engine + test panel). */
-var TargetKindAttachmentsCapsSchema = z.object({
-	mediaTypes: z.array(AttachmentMediaTypeSchema),
-	mode: z.enum([
-		"url",
-		"bytes",
-		"both"
-	]),
-	max: z.number().int().nonnegative(),
-	maxBytes: z.number().int().positive().optional()
-});
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = z.object({
-	attachments: TargetKindAttachmentsCapsSchema,
-	/** Max action buttons (0 = none). */
-	actions: z.number().int().nonnegative(),
-	levels: z.array(TargetKindLevelSchema),
-	format: z.array(NotificationFormatSchema),
-	clickUrl: z.boolean(),
-	sound: z.boolean(),
-	ttl: z.boolean(),
-	bodyMaxLen: z.number().int().positive()
-});
-/**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
-*/
-var ConfigSchemaPassthrough = z.unknown();
-var TargetKindSchema = z.object({
-	kind: z.string(),
-	label: z.string(),
-	icon: z.string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: z.string(),
-	configSchema: ConfigSchemaPassthrough,
-	supportsDiscovery: z.boolean(),
-	caps: TargetKindCapsSchema
-});
-/**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
-*/
-var TargetSchema = z.object({
-	id: z.string(),
-	name: z.string(),
-	kind: z.string(),
-	addonId: z.string(),
-	enabled: z.boolean(),
-	config: z.record(z.string(), z.unknown())
-});
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = z.object({
-	kind: z.string(),
-	suggestedName: z.string(),
-	config: z.record(z.string(), z.unknown())
-});
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = z.object({
-	level: z.string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: z.number().int().nonnegative(),
-	actionsSent: z.number().int().nonnegative(),
-	truncated: z.boolean(),
-	dropped: z.array(z.string())
-});
-var SendResultSchema = z.object({
-	success: z.boolean(),
-	error: z.string().optional(),
-	renderedAs: RenderedAsSchema.optional()
-});
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
-var notificationOutputCapability = {
-	name: "notification-output",
-	scope: "system",
-	mode: "collection",
-	methods: {
-		listTargetKinds: method(z.object({}), z.array(TargetKindSchema)),
-		listTargets: method(z.object({}), z.array(TargetSchema)),
-		discoverTargets: method(z.object({
-			kind: z.string(),
-			config: z.record(z.string(), z.unknown()).optional()
-		}), z.array(DiscoveredTargetSchema)),
-		send: method(z.object({
-			targetId: z.string(),
-			notification: NotificationSchema
-		}), SendResultSchema, { kind: "mutation" }),
-		testTarget: method(z.object({
-			targetId: z.string(),
-			sample: NotificationSchema.optional()
-		}), TestResultSchema, { kind: "mutation" }),
-		upsertTarget: method(z.object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }),
-		deleteTarget: method(z.object({ targetId: z.string() }), z.void(), { kind: "mutation" }),
-		setTargetEnabled: method(z.object({
-			targetId: z.string(),
-			enabled: z.boolean()
-		}), z.void(), { kind: "mutation" })
-	}
-};
-/**
-* notification-rules — the Notification Center rule surface (P1 core).
-*
-* Spec: `docs/superpowers/specs/2026-07-22-notification-center-requirements.md`
-* (operator decisions D-1/D-2/D-3 are binding):
-*
-*  - D-2: rule EVALUATION lives in `addon-post-analysis` (the
-*    `notification-center` module), hooked on the durable persistence
-*    moments (object-event insert, TrackCloser.closeExpired) with a
-*    persisted outbox + retry — never the lossy telemetry bus (D8).
-*  - D-3: urgency belongs to the RULE. `delivery: 'immediate'` fires on the
-*    FIRST persisted detection matching the conditions (per-track dedup,
-*    `maxPerTrack` fixed at 1 — see {@link NC_MAX_PER_TRACK_IMMEDIATE});
-*    `delivery: 'track-end'` evaluates the finalized track record at close.
-*  - DISPATCH stays behind `notification-output` (rules reference targets
-*    by id; per-backend params are a passthrough blob capped by the
-*    target kind's own caps/degrade engine).
-*
-* P1 scope: admin-authored rules only (`createdBy` stamped from the
-* server-injected caller identity — the first `caller: 'required'`
-* adopter). The P1 condition subset is: devices, classes(+exclude),
-* minConfidence, admin zones (any/all + exclude), weekly schedule
-* windows, and the optional label/identity/plate matchers. User rules,
-* private zones, per-recipient fan-out and the wider condition table are
-* P2+ (see spec §7).
-*
-* All schemas here are the single source of truth — `NcRule` etc. are
-* `z.infer` exports; no duplicate interfaces (the advanced-notifier
-* schema/interface drift is explicitly not repeated).
-*/
-/**
-* D-3: the trigger/urgency of a rule — which persistence moment evaluates it.
-* The value maps 1:1 onto the evaluated record kind:
-*  - `immediate`     ↔ object-event persist (lowest-latency detection burst)
-*  - `track-end`     ↔ TrackCloser.closeExpired (finalized track record)
-*  - `device-event`  ↔ SensorEventStore insert (doorbell press / sensor state
-*                       change of a LINKED device, one row per linked camera)
-*  - `package-event` ↔ PackageDropDetector object-event insert (a `package`
-*                       delivery / pick-up)
-*
-* `immediate`/`track-end` carry the D-3 urgency semantics; `device-event`/
-* `package-event` are pure trigger kinds (no urgency dimension). Extending
-* this one field keeps the schema additive — a rule still declares exactly
-* one trigger.
-*/
-var NcDeliverySchema = z.enum([
-	"immediate",
-	"track-end",
-	"device-event",
-	"package-event"
-]);
-/** One weekly activation window. `startMinute > endMinute` crosses midnight. */
-var NcScheduleWindowSchema = z.object({
-	/** Days of week the window STARTS on (0 = Sunday … 6 = Saturday). */
-	days: z.array(z.number().int().min(0).max(6)).min(1),
-	startMinute: z.number().int().min(0).max(1439),
-	endMinute: z.number().int().min(0).max(1439)
-});
-/** Weekly schedule — OR of windows; absence on the rule = always active. */
-var NcScheduleSchema = z.object({
-	windows: z.array(NcScheduleWindowSchema).min(1),
-	/** IANA timezone; default = hub host timezone. */
-	timezone: z.string().optional(),
-	/** Active OUTSIDE the windows (e.g. "only outside business hours"). */
-	invert: z.boolean().optional()
-});
-/** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
-var NcPlateMatcherSchema = z.object({
-	values: z.array(z.string().min(1)).min(1),
-	/** Max Levenshtein distance after normalization (uppercase alphanumeric). */
-	maxDistance: z.number().int().min(0).max(3).default(1)
-});
-/**
-* Occupancy condition (DEVICE-EVENT trigger). Fires on a ZoneAnalytics
-* occupancy edge for a device — optionally narrowed to a single admin
-* `zoneId` and/or object `className`. `op` selects the edge/threshold:
-*  - `became-occupied` (default) — count crossed 0 → ≥ `count`
-*  - `became-free`               — count crossed ≥ `count` → below it
-*  - `>=` / `<=`                 — count is at/over or at/under `count`
-* `sustainSeconds` requires the condition hold continuously that long
-* before firing (debounces flicker; 0 = fire on the first matching edge).
-* Fail-closed: no ZoneAnalytics snapshot / missing zone / null snapshot ⇒
-* the condition never matches. Confirmed edge-state survives addon restarts
-* (declared SQLite collection, reseeded on boot).
-*/
-var NcOccupancyConditionSchema = z.object({
-	/** Admin zone id to scope the count to; absent = whole-frame occupancy. */
-	zoneId: z.string().optional(),
-	/** Object class to count; absent = any class. */
-	className: z.string().optional(),
-	op: z.enum([
-		"became-occupied",
-		"became-free",
-		">=",
-		"<="
-	]).default("became-occupied"),
-	count: z.number().int().min(0).default(1),
-	sustainSeconds: z.number().int().min(0).max(3600).default(15)
-});
-/** Admin-zone membership condition (zone IDs as stamped by the ZoneEngine). */
-var NcZoneConditionSchema = z.object({
-	ids: z.array(z.string().min(1)).min(1),
-	/** Quantifier over `ids` — at least one / every one visited. */
-	match: z.enum(["any", "all"]).default("any")
-});
-/**
-* The P1 condition set — a flat AND of groups; absent group = pass;
-* membership lists are OR within the list (spec §2.3).
-*/
-var NcConditionsSchema = z.object({
-	/** Device scope — absent = all devices. */
-	devices: z.array(z.number()).optional(),
-	/** Detector class names (any overlap with the record's class set). */
-	classes: z.array(z.string().min(1)).optional(),
-	/** Veto classes — any overlap fails the rule. */
-	classesExclude: z.array(z.string().min(1)).optional(),
-	/** Minimum detection confidence 0–1 (fails when the record has none). */
-	minConfidence: z.number().min(0).max(1).optional(),
-	/** Admin zone membership over event `zones` / track `zonesVisited`. */
-	zones: NcZoneConditionSchema.optional(),
-	/** Veto zones — any hit fails the rule. */
-	zonesExclude: z.array(z.string().min(1)).optional(),
-	/**
-	* Exact (case-insensitive) match on the record's collapsed `label`
-	* (identity name / plate text / subclass).
-	*/
-	labelEquals: z.array(z.string().min(1)).optional(),
-	/**
-	* Identity matcher. P1 boundary: matched against the record's collapsed
-	* `label` (the identity display name propagated by the face pipeline) —
-	* identity-ID matching rides in P2 when identity ids reach the record.
-	*/
-	identities: z.array(z.string().min(1)).optional(),
-	/** Fuzzy plate matcher against the record's `label` (plate text). */
-	plates: NcPlateMatcherSchema.optional(),
-	/**
-	* Identity EXCLUDE — mirror of {@link identities} with `notIn` semantics.
-	* Same P1 boundary: matched against the record's collapsed `label` (the
-	* identity display name). A record with NO label passes (nothing to
-	* exclude), unlike the include variant which fails on an absent label.
-	*/
-	identitiesExclude: z.array(z.string().min(1)).optional(),
-	/**
-	* Minimum server-computed key-event importance in [0,1] (`Track.importance`).
-	* TRACK-END only: importance is scored at track close, so it does not exist
-	* at immediate / object-event evaluation time (see catalog `appliesTo`). At
-	* close the value is threaded via the close-time info (the `Track` clone is
-	* captured before the DB row is updated, so it would otherwise read stale).
-	* Fails when the record carries no importance (never guess quality — the
-	* `minConfidence` precedent). MVP cut: a single scalar threshold.
-	*/
-	minImportance: z.number().min(0).max(1).optional(),
-	/**
-	* Minimum track dwell in SECONDS — `(lastSeen − firstSeen) / 1000`.
-	* TRACK-END only: an `immediate` / object-event subject has no closed
-	* lifespan, so a dwell condition never matches immediate delivery
-	* (documented choice — the object-event record carries no `firstSeen`,
-	* so dwell cannot be computed from what the subject actually carries).
-	*/
-	minDwellSeconds: z.number().min(0).optional(),
-	/**
-	* Detection provenance filter. `any` (default / absent) matches every
-	* source; otherwise the subject's source must equal it. Legacy records
-	* with no stamped source are treated as `pipeline`. The union spans both
-	* record kinds — object events carry `pipeline` | `onboard`, synthetic
-	* tracks carry `sensor`.
-	*/
-	source: z.enum([
-		"pipeline",
-		"onboard",
-		"sensor",
-		"any"
-	]).optional(),
-	/**
-	* Minimum identity / plate MATCH confidence in [0,1] — DISTINCT from the
-	* detector `minConfidence` (that gates the object-detection score; this
-	* gates the recognition/OCR match score). Fails when the subject carries
-	* no label-match confidence (never guess). TRACK-END only: the confidence
-	* lives on the recognition result and reaches the subject at track close.
-	*
-	* What it measures precisely (plumbed at track close — the closer threads
-	* the value into `NcTrackClosedInfo.labelConfidence`, the same seam as
-	* `importance`): the BEST recognition match confidence observed for the
-	* label the track carries at close — for a face, the peak cosine similarity
-	* of the ASSIGNED identity (`FaceMatch.score`, reset on an identity switch);
-	* for a plate, the peak OCR read score of the best-held plate
-	* (`plateText.confidence`). When BOTH a face and a plate were recognized on
-	* one track the higher of the two is used. A track that ended with no
-	* confident identity/plate match carries no value, so the condition fails
-	* closed for it (an un-recognized subject).
-	*/
-	minLabelConfidence: z.number().min(0).max(1).optional(),
-	/**
-	* DEVICE-EVENT only. Raw device event-type tokens (`EventFire.eventType`,
-	* e.g. a doorbell `press` / `press_long`) — matched case-insensitively
-	* against the token carried on the device-event subject (extracted from the
-	* event-emitter runtime slice's `lastEvent.eventType`). Fails when the
-	* subject carries no token. Doorbell-pulse / passive-sensor kinds emit no
-	* eventType, so gate those with {@link sensorKinds} instead.
-	*/
-	eventTypeTokens: z.array(z.string().min(1)).optional(),
-	/**
-	* DEVICE-EVENT only. Sensor/control taxonomy kinds (e.g. `doorbell`,
-	* `contact`, `button`, `device-event`) — matched against the persisted
-	* `SensorEvent.kind` (see `sensor-event-kinds.ts`). Membership is OR.
-	*/
-	sensorKinds: z.array(z.string().min(1)).optional(),
-	/**
-	* PACKAGE-EVENT only. Which package phase fires the rule — `delivered`
-	* (a parked parcel appeared), `picked-up` (it departed), or `both`. Fails
-	* when the subject's phase does not match (a subject always carries a phase
-	* on the package-event trigger).
-	*/
-	packagePhase: z.enum([
-		"delivered",
-		"picked-up",
-		"both"
-	]).optional(),
-	/**
-	* PERSONAL-RULE custom zones (viewer-drawn). Inline normalized polygons
-	* (MaskShape vocabulary). A record passes when its bbox overlaps ANY
-	* listed polygon (ZoneEngine membership semantics). Evaluated only when
-	* the subject carries a bbox; absent bbox ⇒ the condition FAILS.
-	*/
-	customZones: z.array(MaskPolygonShapeSchema).optional(),
-	/**
-	* DEVICE-EVENT only. ZoneAnalytics occupancy edge — fires when a device's
-	* (optionally zone/class-scoped) occupancy count crosses the configured
-	* threshold and holds for `sustainSeconds`. Fail-closed on missing
-	* substrate (no snapshot / missing zone). See {@link NcOccupancyCondition}.
-	*/
-	occupancy: NcOccupancyConditionSchema.optional()
+	url: z.string(),
+	hostname: z.string(),
+	port: z.number(),
+	protocol: z.enum(["http", "https"])
 });
-/** One delivery target: a `notification-output` Target ref + passthrough params. */
-var NcRuleTargetSchema = z.object({
-	/** `notification-output` Target id. */
-	targetId: z.string().min(1),
-	/**
-	* Per-backend passthrough. Recognized keys are mapped onto the canonical
-	* Notification (`priority`, `level`, `sound`, `clickUrl`, `ttl`); the
-	* degrade engine drops what the backend can't render.
-	*/
-	params: z.record(z.string(), z.unknown()).optional()
+var NetworkAccessStatusSchema = z.object({
+	connected: z.boolean(),
+	endpoint: NetworkEndpointSchema.nullable(),
+	error: z.string().optional()
 });
 /**
-* Media attachment policy (P1 still-image subset).
-*  - `best` — the best AVAILABLE subject image at dispatch time (D-3).
-*  - `best-matching` — the media that explains WHY the rule fired: a rule
-*    matched on identities attaches the subject's `faceCrop`, one matched on
-*    plates attaches the `plateCrop`; a rule with no identity/plate condition
-*    (or when the specific crop is missing) degrades to `best`, then
-*    `keyFrame`, then no attachment — never delaying the send. The matched
-*    condition summary is frozen on the outbox row at enqueue (like the rule
-*    name), so the choice never drifts from the record that fired it.
-*  - `keyFrame` — the clean scene frame (no subject box).
-*  - `none` — no attachment.
+* Optional, richer endpoint shape returned by providers that expose
+* MORE than one ingress concurrently (Tailscale Ingress with mixed
+* serve+funnel rules, future ngrok multi-tunnel, …). Each entry carries
+* the originating provider config (mode + sourcePort) so the
+* orchestrator UI can label rows distinctly. Providers that expose only
+* one endpoint just omit `listEndpoints` from their provider impl.
 */
-var NcMediaPolicySchema = z.object({ attach: z.enum([
-	"best",
-	"best-matching",
-	"keyFrame",
-	"none"
-]).default("best") });
-/** Throttle — cooldown survives restarts (rebuilt from the outbox on boot). */
-var NcThrottleSchema = z.object({
-	cooldownSec: z.number().int().min(0).max(86400).default(60),
-	/** `rule` = one shared cooldown; `rule-device` = per-camera cooldown. */
-	scope: z.enum(["rule", "rule-device"]).default("rule-device")
-});
-/** Client-supplied rule fields (server stamps id/createdBy/createdAt/updatedAt). */
-var NcRuleInputSchema = z.object({
-	name: z.string().min(1).max(200),
-	enabled: z.boolean().default(true),
-	delivery: NcDeliverySchema,
-	conditions: NcConditionsSchema.default({}),
-	schedule: NcScheduleSchema.optional(),
-	targets: z.array(NcRuleTargetSchema).min(1),
-	media: NcMediaPolicySchema.default({ attach: "best" }),
-	throttle: NcThrottleSchema.default({
-		cooldownSec: 60,
-		scope: "rule-device"
-	}),
-	/** `{{var}}` templating over camera/class/label/zones/confidence/time. */
-	template: z.object({
-		title: z.string().max(500).optional(),
-		body: z.string().max(2e3).optional()
-	}).optional(),
-	/** Canonical notification priority ordinal (1..5); per-target overridable. */
-	priority: z.number().int().min(1).max(5).default(3),
+var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
 	/**
-	* Ownership/visibility key. Absent = admin/global rule (unchanged legacy
-	* behaviour, visible to all, read-only in the viewer). Present = personal
-	* rule owned by this userId. Server-stamped; never trusted from a client.
+	* Stable id within the provider — typically `<mode>-<sourcePort>` so
+	* the orchestrator can dedupe across `listEndpoints` polls.
 	*/
-	ownerUserId: z.string().optional()
+	id: z.string(),
+	/** Operator-facing label (mirrors `MeshEndpoint.label`). */
+	label: z.string(),
+	/** Optional provider-specific mode tag, used for icon/colour in admin UI. */
+	mode: z.string().optional(),
+	/** Originating local port the ingress fronts (informational). */
+	sourcePort: z.number().optional()
 });
+var networkAccessCapability = {
+	name: "network-access",
+	scope: "system",
+	mode: "collection",
+	providerKind: "ingress",
+	methods: {
+		start: method(z.void(), NetworkEndpointSchema, { kind: "mutation" }),
+		stop: method(z.void(), z.void(), { kind: "mutation" }),
+		getEndpoint: method(z.void(), NetworkEndpointSchema.nullable()),
+		getStatus: method(z.void(), NetworkAccessStatusSchema),
+		/**
+		* Enumerate every active ingress entry. Providers that expose only a
+		* single endpoint may omit this method; callers fall back to
+		* `getEndpoint()` in that case.
+		*/
+		listEndpoints: method(z.void(), z.array(NetworkEndpointEntrySchema).readonly())
+	}
+};
 /**
-* Partial patch for `updateRule` — any subset of the input fields, plus the
-* persisted-only {@link NcRuleSchema} `disabledTargetIds` set. The latter is
-* NOT a client-authored input field (it lives on the persisted rule, not the
-* input), so it is added here explicitly to let the store's per-target opt-out
-* toggle round-trip through the shared `update` path. Viewer opt-out mutations
-* still flow through `nc.setRuleTargetEnabled` (owner-checked), never a raw
-* `updateRule` patch.
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
 */
-var NcRulePatchSchema = NcRuleInputSchema.partial().extend({ disabledTargetIds: z.array(z.string()).optional() });
-/** A persisted rule. */
-var NcRuleSchema = NcRuleInputSchema.extend({
-	id: z.string(),
-	/** userId of the admin who created the rule (server-stamped caller). */
-	createdBy: z.string(),
-	createdAt: z.number(),
-	updatedAt: z.number(),
-	/**
-	* Per-target opt-out set. A targetId here is suppressed for THIS rule at
-	* send time. Only a target's OWNER may add/remove its id (server-checked
-	* in `nc.setRuleTargetEnabled`). Defaults to empty.
-	*/
-	disabledTargetIds: z.array(z.string()).default([])
-});
-var NcTestResultSchema = z.object({
-	recordId: z.string(),
-	recordKind: z.enum([
-		"object-event",
-		"track",
-		"device-event",
-		"package-event"
-	]),
-	deviceId: z.number(),
-	timestamp: z.number(),
-	wouldFire: z.boolean(),
-	/** Condition id that failed (first failing group), when `wouldFire` is false. */
-	failedCondition: z.string().optional(),
-	className: z.string().optional(),
-	label: z.string().optional()
-});
-var NcConditionDescriptorSchema = z.object({
-	/** Field id inside `NcConditions` (or `'schedule'` for the rule-level group). */
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = z.enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = z.object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: z.string().optional(),
+	bytes: z.instanceof(Uint8Array).optional(),
+	mime: z.string().optional(),
+	name: z.string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = z.enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = z.object({
 	id: z.string(),
-	group: z.enum([
-		"scope",
-		"class",
-		"zones",
-		"quality",
-		"label",
-		"schedule",
-		"device",
-		"package",
-		"occupancy"
-	]),
 	label: z.string(),
-	/** Editor widget the UI renders — never hardcode per-condition forms. */
-	valueType: z.enum([
-		"deviceIdList",
-		"stringList",
-		"number01",
-		"number",
-		"sourceSelect",
-		"zoneSelection",
-		"zoneIdList",
-		"schedule",
-		"plateMatcher",
-		"packagePhase",
-		"polygonDraw",
-		"occupancy"
-	]),
-	operator: z.enum([
-		"in",
-		"notIn",
-		"anyOf",
-		"allOf",
-		"gte",
-		"fuzzyIn",
-		"withinSchedule"
-	]),
-	/** Which delivery kinds the condition applies to. */
-	appliesTo: z.array(NcDeliverySchema),
-	phase: z.string(),
+	url: z.string().optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = z.object({
+	body: z.string(),
+	title: z.string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: z.number().int().min(1).max(5).default(3),
+	level: z.string().optional(),
+	attachments: z.array(AttachmentSchema).optional(),
+	clickUrl: z.string().optional(),
+	actions: z.array(NotificationActionSchema).optional(),
+	sound: z.string().optional(),
+	ttl: z.number().optional(),
+	tag: z.string().optional(),
+	deviceId: z.number().optional(),
+	eventId: z.string().optional(),
+	metadata: z.record(z.string(), z.unknown()).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: z.number().int().min(1).max(5).nullable(),
+	flags: z.object({
+		critical: z.boolean().optional(),
+		silent: z.boolean().optional(),
+		noPush: z.boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: z.array(z.string()).optional(),
 	description: z.string().optional()
 });
+/** Attachment capabilities for a kind (drives the degrade engine + test panel). */
+var TargetKindAttachmentsCapsSchema = z.object({
+	mediaTypes: z.array(AttachmentMediaTypeSchema),
+	mode: z.enum([
+		"url",
+		"bytes",
+		"both"
+	]),
+	max: z.number().int().nonnegative(),
+	maxBytes: z.number().int().positive().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = z.object({
+	attachments: TargetKindAttachmentsCapsSchema,
+	/** Max action buttons (0 = none). */
+	actions: z.number().int().nonnegative(),
+	levels: z.array(TargetKindLevelSchema),
+	format: z.array(NotificationFormatSchema),
+	clickUrl: z.boolean(),
+	sound: z.boolean(),
+	ttl: z.boolean(),
+	bodyMaxLen: z.number().int().positive()
+});
 /**
-* The delivery lifecycle status of a history row — a straight read of the
-* durable outbox row's own status (single source of truth):
-*  - `pending` — enqueued, in-flight or retrying with backoff
-*  - `sent`    — delivered (terminal)
-*  - `dead`    — dead-lettered after exhausting retries / a permanent
-*                backend rejection / a deleted target (terminal; carries
-*                the failure `error`)
-*
-* P1 has no `suppressed-quiet-hours` / `snoozed` states — those ride the P2
-* user dimension (quiet hours / snooze) and are additive when they land.
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var NcHistoryStatusSchema = z.enum([
-	"pending",
-	"sent",
-	"dead"
-]);
-/** The evaluated record kind a history row descends from (one per trigger). */
-var NcHistoryRecordKindSchema = z.enum([
-	"object-event",
-	"track-end",
-	"device-event",
-	"package-event"
-]);
-/** Subject summary frozen on the row at fire time (survives rule/record edits). */
-var NcHistorySubjectSchema = z.object({
-	className: z.string(),
-	label: z.string().optional(),
-	confidence: z.number().optional(),
-	zones: z.array(z.string()),
-	timestamp: z.number()
+var ConfigSchemaPassthrough = z.unknown();
+var TargetKindSchema = z.object({
+	kind: z.string(),
+	label: z.string(),
+	icon: z.string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: z.string(),
+	configSchema: ConfigSchemaPassthrough,
+	supportsDiscovery: z.boolean(),
+	caps: TargetKindCapsSchema
 });
 /**
-* One delivery-history row. This is a read-only VIEW over the durable
-* outbox row (single source of truth — the same row the drain loop drives;
-* NO second write path, so history can never drift from delivery state).
-* The §3.2 fields map directly: `ruleId`/`targetId`/`deviceId` are columns,
-* `eventRef` is `recordKind`+`recordId`, `timestamps` are `createdAt`
-* (fire) / `updatedAt` (last transition), `status` + `error` are the
-* lifecycle. `ruleName` + `subject` are the intent snapshot frozen at
-* enqueue. `userId?` (per-recipient history) is P2 — no user dimension in
-* P1 (admin scope only).
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
 */
-var NcHistoryEntrySchema = z.object({
-	/** Outbox row id — the stable dedup id `ruleId:dedupRef:targetId`. */
+var TargetSchema = z.object({
 	id: z.string(),
-	ruleId: z.string(),
-	/** Rule name frozen at fire time (outlives a later rename / delete). */
-	ruleName: z.string(),
-	/** The rule urgency/trigger that produced this delivery. */
-	delivery: NcDeliverySchema,
-	targetId: z.string(),
-	deviceId: z.number(),
-	recordKind: NcHistoryRecordKindSchema,
-	/** Event / track ref of the evaluated record (§3.2 `eventRef`). */
-	recordId: z.string(),
-	/** Present for track-scoped deliveries (object-event / track-end). */
-	trackId: z.string().optional(),
-	status: NcHistoryStatusSchema,
-	/** Delivery attempts made so far. */
-	attempts: z.number().int(),
-	/** Fire time (outbox enqueue). */
-	createdAt: z.number(),
-	/** Last transition time (terminal for sent / dead). */
-	updatedAt: z.number(),
-	/** Failure detail — present on a `dead` row. */
-	error: z.string().optional(),
-	subject: NcHistorySubjectSchema
+	name: z.string(),
+	kind: z.string(),
+	addonId: z.string(),
+	enabled: z.boolean(),
+	config: z.record(z.string(), z.unknown())
 });
-/**
-* Query filter for `getHistory` (spec §4.2). Every field is a narrowing
-* AND; absent = unbounded on that axis. `since`/`until` bound the fire time
-* (`createdAt`, epoch ms, inclusive). `limit` is clamped to
-* {@link NC_HISTORY_LIMIT_MAX}. `userId` (per-recipient filtering) is P2.
-*/
-var NcHistoryFilterSchema = z.object({
-	ruleId: z.string().optional(),
-	deviceId: z.number().optional(),
-	status: NcHistoryStatusSchema.optional(),
-	since: z.number().optional(),
-	until: z.number().optional(),
-	limit: z.number().int().min(1).max(500).default(100)
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = z.object({
+	kind: z.string(),
+	suggestedName: z.string(),
+	config: z.record(z.string(), z.unknown())
 });
-var notificationRulesCapability = {
-	name: "notification-rules",
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = z.object({
+	level: z.string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: z.number().int().nonnegative(),
+	actionsSent: z.number().int().nonnegative(),
+	truncated: z.boolean(),
+	dropped: z.array(z.string())
+});
+var SendResultSchema = z.object({
+	success: z.boolean(),
+	error: z.string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+var notificationOutputCapability = {
+	name: "notification-output",
 	scope: "system",
-	mode: "singleton",
+	mode: "collection",
 	methods: {
-		listRules: method(z.object({}), z.object({ rules: z.array(NcRuleSchema) }), { auth: "admin" }),
-		getRule: method(z.object({ ruleId: z.string() }), z.object({ rule: NcRuleSchema.nullable() }), { auth: "admin" }),
-		createRule: method(z.object({ rule: NcRuleInputSchema }), z.object({ rule: NcRuleSchema }), {
-			kind: "mutation",
-			auth: "admin",
-			caller: "required"
-		}),
-		updateRule: method(z.object({
-			ruleId: z.string(),
-			patch: NcRulePatchSchema
-		}), z.object({ rule: NcRuleSchema }), {
-			kind: "mutation",
-			auth: "admin",
-			caller: "required"
-		}),
-		deleteRule: method(z.object({ ruleId: z.string() }), z.object({ success: z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		setRuleEnabled: method(z.object({
-			ruleId: z.string(),
+		listTargetKinds: method(z.object({}), z.array(TargetKindSchema)),
+		listTargets: method(z.object({}), z.array(TargetSchema)),
+		discoverTargets: method(z.object({
+			kind: z.string(),
+			config: z.record(z.string(), z.unknown()).optional()
+		}), z.array(DiscoveredTargetSchema)),
+		send: method(z.object({
+			targetId: z.string(),
+			notification: NotificationSchema
+		}), SendResultSchema, { kind: "mutation" }),
+		testTarget: method(z.object({
+			targetId: z.string(),
+			sample: NotificationSchema.optional()
+		}), TestResultSchema, { kind: "mutation" }),
+		upsertTarget: method(z.object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }),
+		deleteTarget: method(z.object({ targetId: z.string() }), z.void(), { kind: "mutation" }),
+		setTargetEnabled: method(z.object({
+			targetId: z.string(),
 			enabled: z.boolean()
-		}), z.object({ success: z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/**
-		* Dry-run a rule against recently persisted records (object events for
-		* `immediate`, closed tracks for `track-end`). Mutation kind only to
-		* carry the full rule object safely; no side effects.
-		*/
-		testRule: method(z.object({
-			rule: NcRuleInputSchema,
-			lookbackMinutes: z.number().int().min(1).max(1440).default(60)
-		}), z.object({ results: z.array(NcTestResultSchema) }), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		getConditionCatalog: method(z.object({}), z.object({ catalog: z.array(NcConditionDescriptorSchema) })),
-		/**
-		* Queryable delivery history — a read-only view over the durable outbox
-		* (fired rule, subject summary, target, status, timestamps, error on a
-		* dead row). Newest-first, bounded by `filter.limit`. Retention follows
-		* the outbox's own terminal-row prune horizon (no separate history
-		* horizon — single collection, single source of truth). Admin-only in
-		* P1 (no user dimension); the P2 viewer History screen adds per-caller
-		* scoping on the same method.
-		*/
-		getHistory: method(z.object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), z.object({ entries: z.array(NcHistoryEntrySchema) }), { auth: "admin" })
+		}), z.void(), { kind: "mutation" })
 	}
 };
 /**
@@ -23156,6 +23321,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	systemCapability,
 	tamperCapability,
 	temperatureSensorCapability,
+	terminalSessionCapability,
 	toastCapability,
 	turnProviderCapability,
 	updateCapability,
@@ -27635,6 +27801,36 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.close": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"terminalSession.listProfiles": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"terminalSession.listSessions": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"terminalSession.openSession": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"terminalSession.resize": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"toast.onToast": {
 		capName: "toast",
 		capScope: "system",