@camstack/system 1.2.349 → 1.2.351

package/dist/{dist-C6CPaa8G.mjs → dist-DADwBtU5.mjs}

@@ -710,7 +710,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-CDCONfkt.mjs
+//#region ../types/dist/sleep-DXKLNFvA.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -1019,6 +1019,43 @@ function hydrateField(field, values) {
 	}
 	const rawValue = storedValue !== void 0 ? storedValue : defaultValue !== void 0 ? defaultValue : null;
 	const value = field.type === "textarea" && field.isJson && rawValue !== null && typeof rawValue === "object" ? JSON.stringify(rawValue, null, 2) : rawValue;
+	if (field.type === "tags" && typeof field.suggestionsFrom === "string") {
+		const from = values[field.suggestionsFrom];
+		const extra = Array.isArray(from) ? from.filter((s) => typeof s === "string" && s.length > 0) : [];
+		const merged = [...new Set([...field.suggestions ?? [], ...extra])];
+		return {
+			...field,
+			suggestions: merged,
+			value
+		};
+	}
+	if ((field.type === "select" || field.type === "multiselect") && typeof field.optionsFrom === "string") {
+		const from = values[field.optionsFrom];
+		const byValue = /* @__PURE__ */ new Map();
+		for (const opt of field.options) byValue.set(opt.value, opt);
+		if (Array.isArray(from)) for (const entry of from) {
+			if (typeof entry === "string" && entry.length > 0) {
+				if (!byValue.has(entry)) byValue.set(entry, {
+					value: entry,
+					label: entry
+				});
+				continue;
+			}
+			if (entry === null || typeof entry !== "object") continue;
+			const v = Reflect.get(entry, "value");
+			const lbl = Reflect.get(entry, "label");
+			if (typeof v !== "string" || v.length === 0) continue;
+			if (!byValue.has(v)) byValue.set(v, {
+				value: v,
+				label: typeof lbl === "string" && lbl.length > 0 ? lbl : v
+			});
+		}
+		return {
+			...field,
+			options: [...byValue.values()],
+			value
+		};
+	}
 	return {
 		...field,
 		value
@@ -8341,7 +8378,16 @@ var AutomationActionSchema = z.discriminatedUnion("kind", [
 	}),
 	z.object({
 		kind: z.literal("cap"),
-		deviceId: z.union([z.number().int(), z.object({ $var: z.string().min(1) })]),
+		/**
+		* One device, several same-family devices (locks / climate family / …),
+		* or `{ $var }` for the device that triggered the run. An array is
+		* fan-out at codegen — each id gets the same cap.method call.
+		*/
+		deviceId: z.union([
+			z.number().int(),
+			z.array(z.number().int()).min(1),
+			z.object({ $var: z.string().min(1) })
+		]),
 		cap: z.string().min(1),
 		method: z.string().min(1),
 		/** Values may carry `{{vars.x}}` slots, which SUBSTITUTE and do not
@@ -14122,7 +14168,7 @@ var detectionPipelineCapability = {
 * This matters here more than anywhere else in the repo, because every provider
 * that knows a device's host knows its PASSWORD too: `{ host, port, username,
 * password }` sit in one object on Hikvision, Amcrest, Reolink and ONVIF alike,
-* and `http://admin:hunter2@192.168.50.139/` is a URL a browser accepts. The
+* and `http://admin:hunter2@192.168.x.x/` is a URL a browser accepts. The
 * camera's own page will ask for its own login. That is correct, and pre-
 * filling it is the operator's business, not ours.
 *
@@ -19082,6 +19128,17 @@ var SendResultSchema = z.object({
 });
 /** Same shape as SendResult — kept as a distinct name for the test panel. */
 var TestResultSchema = SendResultSchema;
+/**
+* Pre-save credential probe against a partial (unsaved) target config.
+* `resolvedUrl` never includes secrets (token stripped from path).
+*/
+var ProbeTargetConfigResultSchema = z.object({
+	ok: z.boolean(),
+	resolvedUrl: z.string(),
+	httpStatus: z.number().int().optional(),
+	stateInstance: z.string().optional(),
+	error: z.string().optional()
+});
 var notificationOutputCapability = {
 	name: "notification-output",
 	scope: "system",
@@ -19089,10 +19146,32 @@ var notificationOutputCapability = {
 	methods: {
 		listTargetKinds: method(z.object({}), z.array(TargetKindSchema)),
 		listTargets: method(z.object({}), z.array(TargetSchema), { auth: "admin" }),
+		/**
+		* One target WITH secrets — admin edit / duplicate hydration only.
+		* `listTargets` stays redacted; the editor loads this so password fields
+		* are filled (masked in the input) and a save can round-trip the token
+		* when a destination changes (Duplicate with a new chatId, etc.).
+		*/
+		getTarget: method(z.object({ targetId: z.string() }), TargetSchema, { auth: "admin" }),
 		discoverTargets: method(z.object({
 			kind: z.string(),
-			config: z.record(z.string(), z.unknown()).optional()
+			config: z.record(z.string(), z.unknown()).optional(),
+			/**
+			* When editing / duplicating, the blank password field never round-trips
+			* the stored token. Pass the source target id so the provider can restore
+			* secrets server-side before dialling (same merge as upsert).
+			*/
+			targetId: z.string().optional()
 		}), z.array(DiscoveredTargetSchema), { auth: "admin" }),
+		probeTargetConfig: method(z.object({
+			kind: z.string(),
+			config: z.record(z.string(), z.unknown()),
+			/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
+			targetId: z.string().optional()
+		}), ProbeTargetConfigResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		send: method(z.object({
 			targetId: z.string(),
 			notification: NotificationSchema
@@ -19107,7 +19186,16 @@ var notificationOutputCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		upsertTarget: method(z.object({ target: TargetSchema }), TargetSchema, {
+		upsertTarget: method(z.object({
+			target: TargetSchema,
+			/**
+			* Duplicate flow: create a NEW target id while copying secrets from an
+			* existing row. The UI never holds the stored token; blank / redacted
+			* password fields are restored from this source (D634 still applies if
+			* destinations diverge without a re-typed secret).
+			*/
+			cloneSecretsFrom: z.string().optional()
+		}), TargetSchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
@@ -21556,12 +21644,33 @@ var NC_ALARM_TRIGGERED_MAX_SEC = 3600;
 var NcAlarmDelaySecSchema = z.number().int().min(0).max(600);
 var NcAlarmTriggeredSecSchema = z.number().int().min(0).max(NC_ALARM_TRIGGERED_MAX_SEC);
 var uniqueModes = (entries) => new Set(entries.map((e) => e.mode)).size === entries.length;
+/**
+* What the panel does when a bounded triggered window ends.
+* - `rearmAfter` — return to the armed mode
+* - `disableAfter` — auto-disarm
+* - `doNothing` — stay triggered until a human disarms
+*/
+var NcAlarmPostTriggeredActionSchema = z.enum([
+	"rearmAfter",
+	"disableAfter",
+	"doNothing"
+]);
 /** One mode's OVERRIDES. An absent field inherits the global value (D697). */
 var NcAlarmModeDelaysSchema = z.object({
 	mode: AlarmArmModeSchema,
 	exitDelaySec: NcAlarmDelaySecSchema.optional(),
 	entryDelaySec: NcAlarmDelaySecSchema.optional(),
-	triggeredDurationSec: NcAlarmTriggeredSecSchema.optional()
+	/**
+	* Duration of `triggered` before {@link postTriggeredAction}. Kept as the
+	* historical field name so older clients still read/write a number.
+	*/
+	triggeredDurationSec: NcAlarmTriggeredSecSchema.optional(),
+	postTriggeredAction: NcAlarmPostTriggeredActionSchema.optional(),
+	/**
+	* When this mode may be armed. Absent / null = always allowed (same as a
+	* rule with no `schedule`). Evaluated with {@link isScheduleActive}.
+	*/
+	schedule: NcScheduleSchema.optional()
 });
 var NcAlarmModeDelaysListSchema = z.array(NcAlarmModeDelaysSchema).max(8).refine(uniqueModes, { message: "modeDelays: at most one entry per arm mode" });
 /**
@@ -21573,7 +21682,10 @@ var NcAlarmModeDelaysEditSchema = z.object({
 	mode: AlarmArmModeSchema,
 	exitDelaySec: NcAlarmDelaySecSchema.nullable().optional(),
 	entryDelaySec: NcAlarmDelaySecSchema.nullable().optional(),
-	triggeredDurationSec: NcAlarmTriggeredSecSchema.nullable().optional()
+	triggeredDurationSec: NcAlarmTriggeredSecSchema.nullable().optional(),
+	postTriggeredAction: NcAlarmPostTriggeredActionSchema.nullable().optional(),
+	/** Set a schedule, or `null` to clear (mode always allowed again). */
+	schedule: NcScheduleSchema.nullable().optional()
 });
 var NcAlarmModeDelaysEditListSchema = z.array(NcAlarmModeDelaysEditSchema).max(8).refine(uniqueModes, { message: "modeDelays: at most one edit per arm mode" });
 /** One switch of the alarm table: put ONE device on, or take it off, ONE mode's list. */
@@ -21646,12 +21758,18 @@ var NcAlarmSettingsSchema = z.object({
 	/** Grace period between a trigger and the alarm firing. 0 = immediate. */
 	entryDelaySec: NcAlarmDelaySecSchema,
 	/**
-	* How long `triggered` lasts before the panel re-arms itself.
-	* **0 = until an operator disarms it** — the behaviour before this field
-	* existed, and therefore what an untouched install keeps doing.
+	* How long `triggered` lasts before {@link postTriggeredAction} runs.
+	* Ignored when the action is `doNothing`. Historical name kept so older
+	* clients still round-trip a number.
 	*/
 	triggeredDurationSec: NcAlarmTriggeredSecSchema,
 	/**
+	* What happens when the triggered window ends. Absent on a blob older than
+	* this field → derived from {@link triggeredDurationSec} (`>0` ⇒ rearmAfter,
+	* else doNothing).
+	*/
+	postTriggeredAction: NcAlarmPostTriggeredActionSchema.optional(),
+	/**
 	* Deprecated by D630 — every transition is announced. Parsed, never read;
 	* remove after one release. Optional so an older admin's patch (which still
 	* sends it) parses rather than failing the whole save.
@@ -36049,7 +36167,7 @@ var LocalInterfaceSchema = z.object({
 	name: z.string(),
 	family: z.enum(["IPv4", "IPv6"]),
 	address: z.string(),
-	/** CIDR shorthand (e.g. `192.168.1.10/24`). Empty when OS doesn't expose. */
+	/** CIDR shorthand (e.g. `192.168.x.x/24`). Empty when OS doesn't expose. */
 	cidr: z.string(),
 	/** OS netmask. Stable across calls so the SDK can hash on it. */
 	netmask: z.string(),
@@ -36248,7 +36366,7 @@ var localNetworkCapability = {
 		* every client a second authority on a socket only the hub binds. A viewer
 		* configured with a port-less public URL (`https://camstack.example.top`)
 		* infers 443 from the scheme, asks with 443, and was handed
-		* `https://192.168.1.9:443` for a hub listening on 4443. That candidate
+		* `https://192.168.x.x:443` for a hub listening on 4443. That candidate
 		* cannot ever answer, and losing its race reads in the log exactly like
 		* "the LAN was tried and it was slower" — so an operator sitting on his own
 		* WiFi stayed on the public tunnel for weeks, with the LAN candidate born
@@ -36701,7 +36819,7 @@ var MeshPeerSchema = z.object({
 	tags: z.array(z.string()).readonly(),
 	/** True when the peer advertises itself as an exit-node candidate. */
 	exitNodeOption: z.boolean(),
-	/** Subnet routes the peer advertises (e.g. `["192.168.1.0/24"]`). */
+	/** Subnet routes the peer advertises (e.g. `["192.168.x.x/24"]`). */
 	advertisedRoutes: z.array(z.string()).readonly(),
 	/** Owner account login (e.g. `foo@example.com`). Null for tagged peers. */
 	userLogin: z.string().nullable(),
@@ -50118,6 +50236,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationOutput.getTarget": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationOutput.listTargetKinds": {
 		capName: "notification-output",
 		capScope: "system",
@@ -50130,6 +50254,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationOutput.probeTargetConfig": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationOutput.send": {
 		capName: "notification-output",
 		capScope: "system",
@@ -53839,6 +53969,7 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "create"
 	}
 });
+DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
 DeviceFeature.BatteryOperated;
 /**
 * The vocabulary, in the order a picker offers it.

package/dist/{dist-DvAczrLl.js → dist-DeGPW01G.js}

@@ -710,7 +710,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-CDCONfkt.mjs
+//#region ../types/dist/sleep-DXKLNFvA.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -1019,6 +1019,43 @@ function hydrateField(field, values) {
 	}
 	const rawValue = storedValue !== void 0 ? storedValue : defaultValue !== void 0 ? defaultValue : null;
 	const value = field.type === "textarea" && field.isJson && rawValue !== null && typeof rawValue === "object" ? JSON.stringify(rawValue, null, 2) : rawValue;
+	if (field.type === "tags" && typeof field.suggestionsFrom === "string") {
+		const from = values[field.suggestionsFrom];
+		const extra = Array.isArray(from) ? from.filter((s) => typeof s === "string" && s.length > 0) : [];
+		const merged = [...new Set([...field.suggestions ?? [], ...extra])];
+		return {
+			...field,
+			suggestions: merged,
+			value
+		};
+	}
+	if ((field.type === "select" || field.type === "multiselect") && typeof field.optionsFrom === "string") {
+		const from = values[field.optionsFrom];
+		const byValue = /* @__PURE__ */ new Map();
+		for (const opt of field.options) byValue.set(opt.value, opt);
+		if (Array.isArray(from)) for (const entry of from) {
+			if (typeof entry === "string" && entry.length > 0) {
+				if (!byValue.has(entry)) byValue.set(entry, {
+					value: entry,
+					label: entry
+				});
+				continue;
+			}
+			if (entry === null || typeof entry !== "object") continue;
+			const v = Reflect.get(entry, "value");
+			const lbl = Reflect.get(entry, "label");
+			if (typeof v !== "string" || v.length === 0) continue;
+			if (!byValue.has(v)) byValue.set(v, {
+				value: v,
+				label: typeof lbl === "string" && lbl.length > 0 ? lbl : v
+			});
+		}
+		return {
+			...field,
+			options: [...byValue.values()],
+			value
+		};
+	}
 	return {
 		...field,
 		value
@@ -8341,7 +8378,16 @@ var AutomationActionSchema = zod.z.discriminatedUnion("kind", [
 	}),
 	zod.z.object({
 		kind: zod.z.literal("cap"),
-		deviceId: zod.z.union([zod.z.number().int(), zod.z.object({ $var: zod.z.string().min(1) })]),
+		/**
+		* One device, several same-family devices (locks / climate family / …),
+		* or `{ $var }` for the device that triggered the run. An array is
+		* fan-out at codegen — each id gets the same cap.method call.
+		*/
+		deviceId: zod.z.union([
+			zod.z.number().int(),
+			zod.z.array(zod.z.number().int()).min(1),
+			zod.z.object({ $var: zod.z.string().min(1) })
+		]),
 		cap: zod.z.string().min(1),
 		method: zod.z.string().min(1),
 		/** Values may carry `{{vars.x}}` slots, which SUBSTITUTE and do not
@@ -14122,7 +14168,7 @@ var detectionPipelineCapability = {
 * This matters here more than anywhere else in the repo, because every provider
 * that knows a device's host knows its PASSWORD too: `{ host, port, username,
 * password }` sit in one object on Hikvision, Amcrest, Reolink and ONVIF alike,
-* and `http://admin:hunter2@192.168.50.139/` is a URL a browser accepts. The
+* and `http://admin:hunter2@192.168.x.x/` is a URL a browser accepts. The
 * camera's own page will ask for its own login. That is correct, and pre-
 * filling it is the operator's business, not ours.
 *
@@ -19082,6 +19128,17 @@ var SendResultSchema = zod.z.object({
 });
 /** Same shape as SendResult — kept as a distinct name for the test panel. */
 var TestResultSchema = SendResultSchema;
+/**
+* Pre-save credential probe against a partial (unsaved) target config.
+* `resolvedUrl` never includes secrets (token stripped from path).
+*/
+var ProbeTargetConfigResultSchema = zod.z.object({
+	ok: zod.z.boolean(),
+	resolvedUrl: zod.z.string(),
+	httpStatus: zod.z.number().int().optional(),
+	stateInstance: zod.z.string().optional(),
+	error: zod.z.string().optional()
+});
 var notificationOutputCapability = {
 	name: "notification-output",
 	scope: "system",
@@ -19089,10 +19146,32 @@ var notificationOutputCapability = {
 	methods: {
 		listTargetKinds: method(zod.z.object({}), zod.z.array(TargetKindSchema)),
 		listTargets: method(zod.z.object({}), zod.z.array(TargetSchema), { auth: "admin" }),
+		/**
+		* One target WITH secrets — admin edit / duplicate hydration only.
+		* `listTargets` stays redacted; the editor loads this so password fields
+		* are filled (masked in the input) and a save can round-trip the token
+		* when a destination changes (Duplicate with a new chatId, etc.).
+		*/
+		getTarget: method(zod.z.object({ targetId: zod.z.string() }), TargetSchema, { auth: "admin" }),
 		discoverTargets: method(zod.z.object({
 			kind: zod.z.string(),
-			config: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+			config: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+			/**
+			* When editing / duplicating, the blank password field never round-trips
+			* the stored token. Pass the source target id so the provider can restore
+			* secrets server-side before dialling (same merge as upsert).
+			*/
+			targetId: zod.z.string().optional()
 		}), zod.z.array(DiscoveredTargetSchema), { auth: "admin" }),
+		probeTargetConfig: method(zod.z.object({
+			kind: zod.z.string(),
+			config: zod.z.record(zod.z.string(), zod.z.unknown()),
+			/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
+			targetId: zod.z.string().optional()
+		}), ProbeTargetConfigResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		send: method(zod.z.object({
 			targetId: zod.z.string(),
 			notification: NotificationSchema
@@ -19107,7 +19186,16 @@ var notificationOutputCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		upsertTarget: method(zod.z.object({ target: TargetSchema }), TargetSchema, {
+		upsertTarget: method(zod.z.object({
+			target: TargetSchema,
+			/**
+			* Duplicate flow: create a NEW target id while copying secrets from an
+			* existing row. The UI never holds the stored token; blank / redacted
+			* password fields are restored from this source (D634 still applies if
+			* destinations diverge without a re-typed secret).
+			*/
+			cloneSecretsFrom: zod.z.string().optional()
+		}), TargetSchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
@@ -21556,12 +21644,33 @@ var NC_ALARM_TRIGGERED_MAX_SEC = 3600;
 var NcAlarmDelaySecSchema = zod.z.number().int().min(0).max(600);
 var NcAlarmTriggeredSecSchema = zod.z.number().int().min(0).max(NC_ALARM_TRIGGERED_MAX_SEC);
 var uniqueModes = (entries) => new Set(entries.map((e) => e.mode)).size === entries.length;
+/**
+* What the panel does when a bounded triggered window ends.
+* - `rearmAfter` — return to the armed mode
+* - `disableAfter` — auto-disarm
+* - `doNothing` — stay triggered until a human disarms
+*/
+var NcAlarmPostTriggeredActionSchema = zod.z.enum([
+	"rearmAfter",
+	"disableAfter",
+	"doNothing"
+]);
 /** One mode's OVERRIDES. An absent field inherits the global value (D697). */
 var NcAlarmModeDelaysSchema = zod.z.object({
 	mode: AlarmArmModeSchema,
 	exitDelaySec: NcAlarmDelaySecSchema.optional(),
 	entryDelaySec: NcAlarmDelaySecSchema.optional(),
-	triggeredDurationSec: NcAlarmTriggeredSecSchema.optional()
+	/**
+	* Duration of `triggered` before {@link postTriggeredAction}. Kept as the
+	* historical field name so older clients still read/write a number.
+	*/
+	triggeredDurationSec: NcAlarmTriggeredSecSchema.optional(),
+	postTriggeredAction: NcAlarmPostTriggeredActionSchema.optional(),
+	/**
+	* When this mode may be armed. Absent / null = always allowed (same as a
+	* rule with no `schedule`). Evaluated with {@link isScheduleActive}.
+	*/
+	schedule: NcScheduleSchema.optional()
 });
 var NcAlarmModeDelaysListSchema = zod.z.array(NcAlarmModeDelaysSchema).max(8).refine(uniqueModes, { message: "modeDelays: at most one entry per arm mode" });
 /**
@@ -21573,7 +21682,10 @@ var NcAlarmModeDelaysEditSchema = zod.z.object({
 	mode: AlarmArmModeSchema,
 	exitDelaySec: NcAlarmDelaySecSchema.nullable().optional(),
 	entryDelaySec: NcAlarmDelaySecSchema.nullable().optional(),
-	triggeredDurationSec: NcAlarmTriggeredSecSchema.nullable().optional()
+	triggeredDurationSec: NcAlarmTriggeredSecSchema.nullable().optional(),
+	postTriggeredAction: NcAlarmPostTriggeredActionSchema.nullable().optional(),
+	/** Set a schedule, or `null` to clear (mode always allowed again). */
+	schedule: NcScheduleSchema.nullable().optional()
 });
 var NcAlarmModeDelaysEditListSchema = zod.z.array(NcAlarmModeDelaysEditSchema).max(8).refine(uniqueModes, { message: "modeDelays: at most one edit per arm mode" });
 /** One switch of the alarm table: put ONE device on, or take it off, ONE mode's list. */
@@ -21646,12 +21758,18 @@ var NcAlarmSettingsSchema = zod.z.object({
 	/** Grace period between a trigger and the alarm firing. 0 = immediate. */
 	entryDelaySec: NcAlarmDelaySecSchema,
 	/**
-	* How long `triggered` lasts before the panel re-arms itself.
-	* **0 = until an operator disarms it** — the behaviour before this field
-	* existed, and therefore what an untouched install keeps doing.
+	* How long `triggered` lasts before {@link postTriggeredAction} runs.
+	* Ignored when the action is `doNothing`. Historical name kept so older
+	* clients still round-trip a number.
 	*/
 	triggeredDurationSec: NcAlarmTriggeredSecSchema,
 	/**
+	* What happens when the triggered window ends. Absent on a blob older than
+	* this field → derived from {@link triggeredDurationSec} (`>0` ⇒ rearmAfter,
+	* else doNothing).
+	*/
+	postTriggeredAction: NcAlarmPostTriggeredActionSchema.optional(),
+	/**
 	* Deprecated by D630 — every transition is announced. Parsed, never read;
 	* remove after one release. Optional so an older admin's patch (which still
 	* sends it) parses rather than failing the whole save.
@@ -36049,7 +36167,7 @@ var LocalInterfaceSchema = zod.z.object({
 	name: zod.z.string(),
 	family: zod.z.enum(["IPv4", "IPv6"]),
 	address: zod.z.string(),
-	/** CIDR shorthand (e.g. `192.168.1.10/24`). Empty when OS doesn't expose. */
+	/** CIDR shorthand (e.g. `192.168.x.x/24`). Empty when OS doesn't expose. */
 	cidr: zod.z.string(),
 	/** OS netmask. Stable across calls so the SDK can hash on it. */
 	netmask: zod.z.string(),
@@ -36248,7 +36366,7 @@ var localNetworkCapability = {
 		* every client a second authority on a socket only the hub binds. A viewer
 		* configured with a port-less public URL (`https://camstack.example.top`)
 		* infers 443 from the scheme, asks with 443, and was handed
-		* `https://192.168.1.9:443` for a hub listening on 4443. That candidate
+		* `https://192.168.x.x:443` for a hub listening on 4443. That candidate
 		* cannot ever answer, and losing its race reads in the log exactly like
 		* "the LAN was tried and it was slower" — so an operator sitting on his own
 		* WiFi stayed on the public tunnel for weeks, with the LAN candidate born
@@ -36701,7 +36819,7 @@ var MeshPeerSchema = zod.z.object({
 	tags: zod.z.array(zod.z.string()).readonly(),
 	/** True when the peer advertises itself as an exit-node candidate. */
 	exitNodeOption: zod.z.boolean(),
-	/** Subnet routes the peer advertises (e.g. `["192.168.1.0/24"]`). */
+	/** Subnet routes the peer advertises (e.g. `["192.168.x.x/24"]`). */
 	advertisedRoutes: zod.z.array(zod.z.string()).readonly(),
 	/** Owner account login (e.g. `foo@example.com`). Null for tagged peers. */
 	userLogin: zod.z.string().nullable(),
@@ -50118,6 +50236,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationOutput.getTarget": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationOutput.listTargetKinds": {
 		capName: "notification-output",
 		capScope: "system",
@@ -50130,6 +50254,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"notificationOutput.probeTargetConfig": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notificationOutput.send": {
 		capName: "notification-output",
 		capScope: "system",
@@ -53839,6 +53969,7 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "create"
 	}
 });
+DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder;
 DeviceFeature.BatteryOperated;
 /**
 * The vocabulary, in the order a picker offers it.

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DvAczrLl.js");
+const require_dist = require("./dist-DeGPW01G.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -31,7 +31,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-ey4mbofz.js");
 const require_tls$1 = require("./tls-ue_Xefmv.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-DiDBYNY4.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-B_0-zpI6.js");
 const require_resource_monitor = require("./resource-monitor-BgWGRxN5.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let zod = require("zod");

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $n as ReadinessRegistry, Bt as lifecycleJobSchema, D as METHOD_ACCESS_MAP, Dt as extractNestedAddonId, Ft as isObjectInput, Gt as looseSchema, It as isVoidInput, Jn as errMsg$1, Lt as kebabToCamel, M as RUNTIME_DEFAULTS, Mt as isArrayOutputSchema, Nt as isCollectionArrayMethod, Qn as DEVICE_STATUS_METHOD, U as addonSettingsCapability, Wt as logLevelAtMost, Xn as DATAPLANE_SECRET_HEADER$1, Zn as DEVICE_SETTINGS_CONTRIBUTION_METHODS, _r as scopeKey, an as procedureAuthKey, ar as createEvent, br as EventCategory$1, cr as expandCapMethods, en as objectInputDeclaresAddonId, er as ReadinessTimeoutError, gn as scopesAllowDeviceCap, gr as resolveCapMount, hn as scopesAllowAddon, hr as readinessKey, ir as asString$1, mr as parseJsonUnknown, nr as asJsonObject$1, or as emitDownForOwnedCaps, pn as resolveMethodAuth, pr as parseJsonObject, rr as asNumber, t as ALL_CAPABILITY_DEFINITIONS, tn as objectInputDeclaresRequiredDeviceId, w as LOG_LEVEL_RANK } from "./dist-C6CPaa8G.mjs";
+import { $n as ReadinessRegistry, Bt as lifecycleJobSchema, D as METHOD_ACCESS_MAP, Dt as extractNestedAddonId, Ft as isObjectInput, Gt as looseSchema, It as isVoidInput, Jn as errMsg$1, Lt as kebabToCamel, M as RUNTIME_DEFAULTS, Mt as isArrayOutputSchema, Nt as isCollectionArrayMethod, Qn as DEVICE_STATUS_METHOD, U as addonSettingsCapability, Wt as logLevelAtMost, Xn as DATAPLANE_SECRET_HEADER$1, Zn as DEVICE_SETTINGS_CONTRIBUTION_METHODS, _r as scopeKey, an as procedureAuthKey, ar as createEvent, br as EventCategory$1, cr as expandCapMethods, en as objectInputDeclaresAddonId, er as ReadinessTimeoutError, gn as scopesAllowDeviceCap, gr as resolveCapMount, hn as scopesAllowAddon, hr as readinessKey, ir as asString$1, mr as parseJsonUnknown, nr as asJsonObject$1, or as emitDownForOwnedCaps, pn as resolveMethodAuth, pr as parseJsonObject, rr as asNumber, t as ALL_CAPABILITY_DEFINITIONS, tn as objectInputDeclaresRequiredDeviceId, w as LOG_LEVEL_RANK } from "./dist-DADwBtU5.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -30,7 +30,7 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { _ as ensureModel, a as createFileDataPlaneHandler, c as parseRangeHeader, d as ModelDownloadService, g as downloadModel, h as downloadFile, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as deleteModelFromDisk, n as STALL_TICK_MS, o as contentTypeFor, p as collectModelFiles, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as fetchJson, x as isModelDownloaded, y as getModelFilePath } from "./event-loop-stall-monitor-EXjzIxDz.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-DTlVWwAI.mjs";
-import { $ as CapRouteError, $n as CAP_ACTION_UNLABELLED, $t as RUNNER_HEAP_WATCH_INTERVAL_MS, A as resolveHwAccel, An as OUTBOUND_QUEUE_COOLDOWN_MS, At as serializeTypedArrays, B as udsChildLogToWorkerEntry, Bn as SOCKET_QUEUE_TOP_N, Bt as createAddonPeerBytesFacility, C as getBrokerEventBus, Cn as DECISIVE_HEAP_SPACES, Ct as NATIVE_PROVIDER_SERVICE_INFIX, D as subscribePassthrough, Dn as heapSpaceField, Dt as capServiceName, E as setNodeEventInterest, En as formatHeapSpaces, Et as capBareAction, F as ipcParentLink, Fn as MESH_QUEUE_TOP_N, Ft as installManifestNativeDeps, G as UDS_NO_ROUTE_PREFIX, Gn as readSocketQueues, Gt as HEAP_RECLAIM_TRIGGER_MB, H as createUdsLoggerWithControl, Hn as createSocketPlaneReader, Ht as createAddonDataPlaneFacility, I as localProviderLink, In as createMeshQueueReader, It as resolveAddonClass, J as answerClaimedGetStatus, Jn as recordSocketFrame, Jt as HUB_MAIN_HEAP_WATCH_LABEL, K as afterWorkerOnlineAnnounce, Kn as EMPTY_SOCKET_DIRECTION, Kt as HEAP_WATCH_INTERVAL_MS, L as createParentUnownedCallHandler, Ln as formatMeshQueue, Lt as buildNpmChildEnv, M as brokerTransportLink, Mn as OUTBOUND_QUEUE_THRESHOLD_BYTES, Mt as CapabilityHandle, N as buildLinkChain, Nn as createOutboundQueueGate, Nt as CapabilityUnavailableError, O as AddonDepsManager, On as readHeapSpaces, Ot as parseCapAction, P as deviceCapResolverLink, Pn as formatOutboundQueueVerdict, Pt as copyBundledNativeModules, Q as CapRouteResolver, Qn as CAP_ACTION_OVERFLOW_LABEL, Qt as RSS_BUDGET_RELEASE_RATIO, R as createUdsEventBridge, Rn as EMPTY_SOCKET_PLANE_BASELINE, Rt as resolveNpmInvocation, S as clusterEventTopic, Sn as isArrayBufferCensusReport, St as validateProviderRegistrations, T as registerEventBusService, Tn as emitHeapDiagnosticReport, Tt as capActionSuffix, U as LocalChildClient, Un as diffSocketPlane, Ut as HEAP_RECLAIM_MIN_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneMeter, Vt as hostNodeIdOf, W as LocalChildRegistry, Wn as formatSocketPlane, Wt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, X as AGENT_CAP_FWD_ACTION, Xn as socketDirectionBytes, Xt as HUB_RSS_BUDGET_ENV, Y as deviceOfGetStatus, Yn as sampleSocketDirection, Yt as HUB_MAIN_RSS_BUDGET_MB, Z as AGENT_CAP_FWD_SERVICE, Zn as socketDirectionMessages, Zt as RSS_BUDGET_REANNOUNCE_MIN_MS, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, a as reapProcessGroup, an as createV8Reclaimer, ar as EVENT_PLANE_TOP_N, at as __resetCapUsageRegistryForTests, b as setHubConnected, bn as createInspectorArrayBufferCensus, c as runnerOwnsProcessGroup, cn as nextRssBudgetState, cr as diffEventPlane, ct as UdsLocalTransportClient, d as summarizeMembers, dn as shouldReclaim, dt as PeerAnsweredError, en as RUNNER_RSS_BUDGET_ENV, er as EMPTY_CAP_ACTION_READING, et as classifyCapRoute, f as installManifestSystemDeps, fn as startHeapWatch, ft as localEndpointPath, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, gt as createBrokerDeviceManagerApi, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ht as buildNativeCapProxy, in as createLoopDelayMeter, ir as diffCapActionCensus, it as PARENT_ROUTED_PROVIDER_ADDON_ID, j as brokerCallForCap, jn as OUTBOUND_QUEUE_SUSTAIN_MS, jt as DeviceRegistry, k as createKernelHwAccel, kn as selectReportedSpaces, kt as deserializeTypedArrays, l as signalAllRunnerGroups, ln as parseRssBudgetMb, lr as formatEventPlane, lt as UdsLocalTransportServer, m as adaptBrokerToCluster, mn as strandedMb, mt as encodeFrame, nn as buildHeapSample, nr as capActionLabel, nt as readMoleculerFanoutMode, o as registerRunnerGroup, on as describeRss, or as createEventPlaneMeter, ot as getCapUsageRegistry, p as installManifestPythonDeps, pn as startRunnerHeapWatch, pt as FrameDecoder, q as GET_STATUS_METHOD, qn as createSocketDirectionCounters, qt as HEAP_WATCH_WARN_RATIO, r as defaultProcessGroupOps, rn as createDeferredHeapWatchSink, rr as createCapActionCensus, rt as CapUsageRegistry, s as releaseRunnerGroup, sn as hubMainRssBudget, sr as createEventPlaneReader, st as createLocalTransport, t as CAP_METHOD_NOT_IMPLEMENTED, tn as ZERO_LOOP_DELAY, tr as MAX_CAP_ACTIONS_PER_PEER, tt as callWithServiceDiscovery, un as reclaimIntervalMs, ut as SocketChannel, v as getOrInitReadinessRegistry, vn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, w as getMoleculerEventStats, wn as HEAP_SPACE_REPORT_MIN_MB, wt as capActionName, x as EVENT_TOPIC_PREFIX, xn as formatArrayBufferCensus, xt as createAddonService, y as getOrInitReadinessRegistryForClient, yn as createArrayBufferCensusGate, yt as mountNativeCapService, z as createUdsEventBus, zn as SOCKET_PLANE_TOP_N, zt as runNpm } from "./child-cap-dispatch-Pkx_sEKR.mjs";
+import { $ as CapRouteError, $n as CAP_ACTION_UNLABELLED, $t as RUNNER_HEAP_WATCH_INTERVAL_MS, A as resolveHwAccel, An as OUTBOUND_QUEUE_COOLDOWN_MS, At as serializeTypedArrays, B as udsChildLogToWorkerEntry, Bn as SOCKET_QUEUE_TOP_N, Bt as createAddonPeerBytesFacility, C as getBrokerEventBus, Cn as DECISIVE_HEAP_SPACES, Ct as NATIVE_PROVIDER_SERVICE_INFIX, D as subscribePassthrough, Dn as heapSpaceField, Dt as capServiceName, E as setNodeEventInterest, En as formatHeapSpaces, Et as capBareAction, F as ipcParentLink, Fn as MESH_QUEUE_TOP_N, Ft as installManifestNativeDeps, G as UDS_NO_ROUTE_PREFIX, Gn as readSocketQueues, Gt as HEAP_RECLAIM_TRIGGER_MB, H as createUdsLoggerWithControl, Hn as createSocketPlaneReader, Ht as createAddonDataPlaneFacility, I as localProviderLink, In as createMeshQueueReader, It as resolveAddonClass, J as answerClaimedGetStatus, Jn as recordSocketFrame, Jt as HUB_MAIN_HEAP_WATCH_LABEL, K as afterWorkerOnlineAnnounce, Kn as EMPTY_SOCKET_DIRECTION, Kt as HEAP_WATCH_INTERVAL_MS, L as createParentUnownedCallHandler, Ln as formatMeshQueue, Lt as buildNpmChildEnv, M as brokerTransportLink, Mn as OUTBOUND_QUEUE_THRESHOLD_BYTES, Mt as CapabilityHandle, N as buildLinkChain, Nn as createOutboundQueueGate, Nt as CapabilityUnavailableError, O as AddonDepsManager, On as readHeapSpaces, Ot as parseCapAction, P as deviceCapResolverLink, Pn as formatOutboundQueueVerdict, Pt as copyBundledNativeModules, Q as CapRouteResolver, Qn as CAP_ACTION_OVERFLOW_LABEL, Qt as RSS_BUDGET_RELEASE_RATIO, R as createUdsEventBridge, Rn as EMPTY_SOCKET_PLANE_BASELINE, Rt as resolveNpmInvocation, S as clusterEventTopic, Sn as isArrayBufferCensusReport, St as validateProviderRegistrations, T as registerEventBusService, Tn as emitHeapDiagnosticReport, Tt as capActionSuffix, U as LocalChildClient, Un as diffSocketPlane, Ut as HEAP_RECLAIM_MIN_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneMeter, Vt as hostNodeIdOf, W as LocalChildRegistry, Wn as formatSocketPlane, Wt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, X as AGENT_CAP_FWD_ACTION, Xn as socketDirectionBytes, Xt as HUB_RSS_BUDGET_ENV, Y as deviceOfGetStatus, Yn as sampleSocketDirection, Yt as HUB_MAIN_RSS_BUDGET_MB, Z as AGENT_CAP_FWD_SERVICE, Zn as socketDirectionMessages, Zt as RSS_BUDGET_REANNOUNCE_MIN_MS, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, a as reapProcessGroup, an as createV8Reclaimer, ar as EVENT_PLANE_TOP_N, at as __resetCapUsageRegistryForTests, b as setHubConnected, bn as createInspectorArrayBufferCensus, c as runnerOwnsProcessGroup, cn as nextRssBudgetState, cr as diffEventPlane, ct as UdsLocalTransportClient, d as summarizeMembers, dn as shouldReclaim, dt as PeerAnsweredError, en as RUNNER_RSS_BUDGET_ENV, er as EMPTY_CAP_ACTION_READING, et as classifyCapRoute, f as installManifestSystemDeps, fn as startHeapWatch, ft as localEndpointPath, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, gt as createBrokerDeviceManagerApi, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ht as buildNativeCapProxy, in as createLoopDelayMeter, ir as diffCapActionCensus, it as PARENT_ROUTED_PROVIDER_ADDON_ID, j as brokerCallForCap, jn as OUTBOUND_QUEUE_SUSTAIN_MS, jt as DeviceRegistry, k as createKernelHwAccel, kn as selectReportedSpaces, kt as deserializeTypedArrays, l as signalAllRunnerGroups, ln as parseRssBudgetMb, lr as formatEventPlane, lt as UdsLocalTransportServer, m as adaptBrokerToCluster, mn as strandedMb, mt as encodeFrame, nn as buildHeapSample, nr as capActionLabel, nt as readMoleculerFanoutMode, o as registerRunnerGroup, on as describeRss, or as createEventPlaneMeter, ot as getCapUsageRegistry, p as installManifestPythonDeps, pn as startRunnerHeapWatch, pt as FrameDecoder, q as GET_STATUS_METHOD, qn as createSocketDirectionCounters, qt as HEAP_WATCH_WARN_RATIO, r as defaultProcessGroupOps, rn as createDeferredHeapWatchSink, rr as createCapActionCensus, rt as CapUsageRegistry, s as releaseRunnerGroup, sn as hubMainRssBudget, sr as createEventPlaneReader, st as createLocalTransport, t as CAP_METHOD_NOT_IMPLEMENTED, tn as ZERO_LOOP_DELAY, tr as MAX_CAP_ACTIONS_PER_PEER, tt as callWithServiceDiscovery, un as reclaimIntervalMs, ut as SocketChannel, v as getOrInitReadinessRegistry, vn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, w as getMoleculerEventStats, wn as HEAP_SPACE_REPORT_MIN_MB, wt as capActionName, x as EVENT_TOPIC_PREFIX, xn as formatArrayBufferCensus, xt as createAddonService, y as getOrInitReadinessRegistryForClient, yn as createArrayBufferCensusGate, yt as mountNativeCapService, z as createUdsEventBus, zn as SOCKET_PLANE_TOP_N, zt as runNpm } from "./child-cap-dispatch-BAfa6tjj.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B2WZ8_q9.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { z } from "zod";

package/dist/{retired-settings-keys-BQYjCJWI.js → retired-settings-keys-D8G5o4Fc.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DvAczrLl.js");
+const require_dist = require("./dist-DeGPW01G.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-tmMQQ9OH.mjs → retired-settings-keys-bUUnyTMg.mjs}

@@ -1,4 +1,4 @@
-import { nr as asJsonObject } from "./dist-C6CPaa8G.mjs";
+import { nr as asJsonObject } from "./dist-DADwBtU5.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.349",
+  "version": "1.2.351",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",