@camstack/system 1.2.42 → 1.2.44

package/dist/{dist-DBeh_RnY.js → dist-CBwOEr6q.js}

@@ -5281,6 +5281,292 @@ var MaskGridDimsSchema = zod.z.object({
 	height: zod.z.number()
 });
 /**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = zod.z.enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = zod.z.object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: zod.z.string().optional(),
+	bytes: zod.z.instanceof(Uint8Array).optional(),
+	mime: zod.z.string().optional(),
+	name: zod.z.string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = zod.z.enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/**
+* The CLOSED icon vocabulary an action button may use.
+*
+* A closed set, not a free string, and that is the whole point: an arbitrary
+* icon name is one that ntfy renders, zentik silently drops, and nobody
+* notices — the same class of gap as a zone vocabulary nothing produced
+* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
+* declares `actionIcons: false` and the degrade engine strips the field.
+*
+* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
+* renderer's icon set; "acknowledge" survives an adapter that draws it
+* differently.
+*/
+var NotificationActionIconSchema = zod.z.enum([
+	"acknowledge",
+	"dismiss",
+	"silence",
+	"view",
+	"play",
+	"open",
+	"close",
+	"lock",
+	"unlock",
+	"arm",
+	"disarm",
+	"light",
+	"alert"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	url: zod.z.string().optional(),
+	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
+	icon: NotificationActionIconSchema.optional(),
+	/**
+	* Renders in a warning style where the notifier supports it.
+	*
+	* A HINT, never a gate. The callback's authority is its token and nothing
+	* else — see `notification-center/action-token.ts` for what that does and
+	* does not buy.
+	*/
+	destructive: zod.z.boolean().optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = zod.z.object({
+	body: zod.z.string(),
+	title: zod.z.string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: zod.z.number().int().min(1).max(5).default(3),
+	level: zod.z.string().optional(),
+	attachments: zod.z.array(AttachmentSchema).optional(),
+	clickUrl: zod.z.string().optional(),
+	actions: zod.z.array(NotificationActionSchema).optional(),
+	sound: zod.z.string().optional(),
+	ttl: zod.z.number().optional(),
+	tag: zod.z.string().optional(),
+	deviceId: zod.z.number().optional(),
+	eventId: zod.z.string().optional(),
+	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: zod.z.number().int().min(1).max(5).nullable(),
+	flags: zod.z.object({
+		critical: zod.z.boolean().optional(),
+		silent: zod.z.boolean().optional(),
+		noPush: zod.z.boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: zod.z.array(zod.z.string()).optional(),
+	description: zod.z.string().optional()
+});
+/** Attachment capabilities for a kind (drives the degrade engine + test panel). */
+var TargetKindAttachmentsCapsSchema = zod.z.object({
+	mediaTypes: zod.z.array(AttachmentMediaTypeSchema),
+	mode: zod.z.enum([
+		"url",
+		"bytes",
+		"both"
+	]),
+	max: zod.z.number().int().nonnegative(),
+	maxBytes: zod.z.number().int().positive().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = zod.z.object({
+	attachments: TargetKindAttachmentsCapsSchema,
+	/** Max action buttons (0 = none). */
+	actions: zod.z.number().int().nonnegative(),
+	/**
+	* Whether this kind renders a per-action ICON.
+	*
+	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
+	* run on the addon cap path — three production failures in one day taught
+	* this repo that once. Absent is read as false by the degrade engine, which
+	* is the safe direction: an icon that is not rendered costs nothing, an icon
+	* assumed and dropped costs the operator's trust in the field.
+	*/
+	actionIcons: zod.z.boolean().optional(),
+	levels: zod.z.array(TargetKindLevelSchema),
+	format: zod.z.array(NotificationFormatSchema),
+	clickUrl: zod.z.boolean(),
+	sound: zod.z.boolean(),
+	ttl: zod.z.boolean(),
+	bodyMaxLen: zod.z.number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough$1 = zod.z.unknown();
+var TargetKindSchema = zod.z.object({
+	kind: zod.z.string(),
+	label: zod.z.string(),
+	icon: zod.z.string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: zod.z.string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: zod.z.string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: zod.z.string().optional(),
+	configSchema: ConfigSchemaPassthrough$1,
+	supportsDiscovery: zod.z.boolean(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	kind: zod.z.string(),
+	addonId: zod.z.string(),
+	enabled: zod.z.boolean(),
+	config: zod.z.record(zod.z.string(), zod.z.unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = zod.z.object({
+	kind: zod.z.string(),
+	suggestedName: zod.z.string(),
+	config: zod.z.record(zod.z.string(), zod.z.unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = zod.z.object({
+	level: zod.z.string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: zod.z.number().int().nonnegative(),
+	actionsSent: zod.z.number().int().nonnegative(),
+	truncated: zod.z.boolean(),
+	dropped: zod.z.array(zod.z.string())
+});
+var SendResultSchema = zod.z.object({
+	success: zod.z.boolean(),
+	error: zod.z.string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+var notificationOutputCapability = {
+	name: "notification-output",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		listTargetKinds: method(zod.z.object({}), zod.z.array(TargetKindSchema)),
+		listTargets: method(zod.z.object({}), zod.z.array(TargetSchema)),
+		discoverTargets: method(zod.z.object({
+			kind: zod.z.string(),
+			config: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+		}), zod.z.array(DiscoveredTargetSchema)),
+		send: method(zod.z.object({
+			targetId: zod.z.string(),
+			notification: NotificationSchema
+		}), SendResultSchema, { kind: "mutation" }),
+		testTarget: method(zod.z.object({
+			targetId: zod.z.string(),
+			sample: NotificationSchema.optional()
+		}), TestResultSchema, { kind: "mutation" }),
+		upsertTarget: method(zod.z.object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }),
+		deleteTarget: method(zod.z.object({ targetId: zod.z.string() }), zod.z.void(), { kind: "mutation" }),
+		setTargetEnabled: method(zod.z.object({
+			targetId: zod.z.string(),
+			enabled: zod.z.boolean()
+		}), zod.z.void(), { kind: "mutation" })
+	}
+};
+/**
 * notification-rules — the Notification Center rule surface (P1 core).
 *
 * Spec: `docs/superpowers/specs/2026-07-22-notification-center-requirements.md`
@@ -5465,6 +5751,28 @@ var NcRuleActionSequenceSchema = zod.z.object({
 	actions: zod.z.array(NcRuleActionSchema).min(1)
 });
 /**
+* One button carried by the notification, running a named sequence on tap.
+*
+* **Read this before adding a button that does something physical.** The tap
+* arrives over a link that travelled through third-party infrastructure — ntfy,
+* a push relay, whatever forwarded the message — and the callback's ONLY
+* authority is the token in that link: single-use, short-lived, bound to this
+* one action of this one notification. It does not identify who tapped.
+* Whoever holds the notification can run the button, once, inside the window.
+* That is the operator's explicit choice (2026-08-05), and `destructive` is a
+* rendering hint, not a second gate. [D47](decisions/adr-0047.md).
+*/
+var NcRuleNotificationButtonSchema = zod.z.object({
+	/** Stable id — travels in the callback and identifies the button in logs. */
+	id: zod.z.string().min(1).max(64),
+	label: zod.z.string().min(1).max(40),
+	/** Name of a sequence in `onTrigger`. The dispatcher drops a button whose
+	*  sequence does not exist rather than minting a token for nothing. */
+	sequence: zod.z.string().min(1).max(120),
+	icon: NotificationActionIconSchema.optional(),
+	destructive: zod.z.boolean().optional()
+});
+/**
 * Sequences a rule runs, by hook point.
 *
 * ONLY `onTrigger` is here, deliberately. The reference also has activation /
@@ -5472,9 +5780,26 @@ var NcRuleActionSequenceSchema = zod.z.object({
 * repo's expensive failure mode is declaring a surface nothing produces, so a
 * hook appears here in the same change that produces its edge, never before.
 */
-var NcRuleActionsSchema = zod.z.object({ 
-/** Runs when the rule MATCHES. */
-onTrigger: zod.z.array(NcRuleActionSequenceSchema).optional() });
+var NcRuleActionsSchema = zod.z.object({
+	/** Runs when the rule MATCHES. */
+	onTrigger: zod.z.array(NcRuleActionSequenceSchema).optional(),
+	/**
+	* Buttons the NOTIFICATION carries, each running one of this rule's
+	* sequences when tapped.
+	*
+	* Deliberately a REFERENCE to a sequence rather than a second place to
+	* author steps. A button that could define its own actions would be a
+	* parallel actuation vocabulary — the executor's device-scope check, the
+	* stop-at-first-failure rule and the per-sequence throttle all live on
+	* sequences, and a second authoring surface would drift from every one of
+	* them.
+	*
+	* A sequence reachable ONLY by a button simply appears in `onTrigger` with
+	* `enabled: false`: it is then authored, throttled and validated like the
+	* rest, and nothing runs it automatically.
+	*/
+	buttons: zod.z.array(NcRuleNotificationButtonSchema).max(8).optional()
+});
 /**
 * "This rule applies only while `deviceId` is in one of `states`."
 *
@@ -14376,6 +14701,20 @@ var GetInputSchema = zod.z.object({ id: zod.z.string() });
 var AddInputSchema = zod.z.object({
 	kind: zod.z.string().min(1),
 	name: zod.z.string().min(1),
+	/**
+	* ADOPT an existing id instead of minting a new one.
+	*
+	* Written the day this cost an outage. A broker's id is not a detail: HA
+	* devices carry it inside their `stableId` (`ha:ha_004:dev:…`), so a broker
+	* lost from config and re-added as `ha_001` leaves every one of its devices
+	* bound to a broker that no longer exists. Re-entering the password under the
+	* ORIGINAL id turns a multi-step device migration back into re-entering a
+	* password.
+	*
+	* A provider MUST refuse an id that is already in use — adopting a live
+	* broker's id would silently take it over.
+	*/
+	id: zod.z.string().min(1).optional(),
 	/** Kind-specific settings (e.g. MQTT `{url,username,password}` or HA
 	*  `{baseUrl,accessToken}`). Validated by the kind-specific provider
 	*  branch on receipt — invalid shape rejects the add. */
@@ -16801,14 +17140,14 @@ var LlmProfileSchema = zod.z.object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$1 = zod.z.unknown();
+var ConfigSchemaPassthrough = zod.z.unknown();
 var LlmProfileKindDescriptorSchema = zod.z.object({
 	kind: LlmProfileKindSchema,
 	label: zod.z.string(),
 	icon: zod.z.string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: zod.z.string(),
-	configSchema: ConfigSchemaPassthrough$1
+	configSchema: ConfigSchemaPassthrough
 });
 var LlmDefaultSelectorSchema = zod.z.union([zod.z.object({ consumer: zod.z.string() }), zod.z.object({ purpose: zod.z.enum(["text", "vision"]) })]);
 var LlmDefaultSchema = zod.z.object({
@@ -17513,244 +17852,6 @@ var networkAccessCapability = {
 	}
 };
 /**
-* notification-output — canonical, capability-gated notification delivery.
-*
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
-*
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
-*
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = zod.z.enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = zod.z.object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: zod.z.string().optional(),
-	bytes: zod.z.instanceof(Uint8Array).optional(),
-	mime: zod.z.string().optional(),
-	name: zod.z.string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = zod.z.enum([
-	"text",
-	"markdown",
-	"html"
-]);
-/** A single tap-through action button. */
-var NotificationActionSchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	url: zod.z.string().optional()
-});
-/**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
-*/
-var NotificationSchema = zod.z.object({
-	body: zod.z.string(),
-	title: zod.z.string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: zod.z.number().int().min(1).max(5).default(3),
-	level: zod.z.string().optional(),
-	attachments: zod.z.array(AttachmentSchema).optional(),
-	clickUrl: zod.z.string().optional(),
-	actions: zod.z.array(NotificationActionSchema).optional(),
-	sound: zod.z.string().optional(),
-	ttl: zod.z.number().optional(),
-	tag: zod.z.string().optional(),
-	deviceId: zod.z.number().optional(),
-	eventId: zod.z.string().optional(),
-	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-});
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: zod.z.number().int().min(1).max(5).nullable(),
-	flags: zod.z.object({
-		critical: zod.z.boolean().optional(),
-		silent: zod.z.boolean().optional(),
-		noPush: zod.z.boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: zod.z.array(zod.z.string()).optional(),
-	description: zod.z.string().optional()
-});
-/** Attachment capabilities for a kind (drives the degrade engine + test panel). */
-var TargetKindAttachmentsCapsSchema = zod.z.object({
-	mediaTypes: zod.z.array(AttachmentMediaTypeSchema),
-	mode: zod.z.enum([
-		"url",
-		"bytes",
-		"both"
-	]),
-	max: zod.z.number().int().nonnegative(),
-	maxBytes: zod.z.number().int().positive().optional()
-});
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = zod.z.object({
-	attachments: TargetKindAttachmentsCapsSchema,
-	/** Max action buttons (0 = none). */
-	actions: zod.z.number().int().nonnegative(),
-	levels: zod.z.array(TargetKindLevelSchema),
-	format: zod.z.array(NotificationFormatSchema),
-	clickUrl: zod.z.boolean(),
-	sound: zod.z.boolean(),
-	ttl: zod.z.boolean(),
-	bodyMaxLen: zod.z.number().int().positive()
-});
-/**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
-*/
-var ConfigSchemaPassthrough = zod.z.unknown();
-var TargetKindSchema = zod.z.object({
-	kind: zod.z.string(),
-	label: zod.z.string(),
-	icon: zod.z.string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: zod.z.string(),
-	/**
-	* URL of the kind's bundled BRAND icon, served by the providing addon over
-	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
-	* when the addon bundles no icon for that kind — the client then falls back
-	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
-	*
-	* Root-relative on purpose: it resolves against whatever origin serves a web
-	* client, and a native client joins it onto its own hub base.
-	*
-	* DECLARED here deliberately. It used to travel as an undeclared passthrough
-	* field that survived only because the runtime cap-router forwards provider
-	* output verbatim — so every consumer had to re-declare it by hand to stop
-	* its own Zod parse from stripping it, and the whole arrangement would have
-	* broken silently the moment output validation was tightened anywhere.
-	*/
-	iconUrl: zod.z.string().optional(),
-	/**
-	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
-	*
-	* The server knows this and therefore says it, because the client cannot
-	* safely guess: a React-Native client renders SVG and raster through two
-	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
-	* not decode SVG on iOS/Android), so without this it silently fell back to a
-	* placeholder glyph for every vector icon while the web build looked fine.
-	*
-	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
-	* not been updated — a client that cannot determine the type should prefer
-	* its raster path, which is the safe default for an unknown image.
-	*/
-	iconMediaType: zod.z.string().optional(),
-	configSchema: ConfigSchemaPassthrough,
-	supportsDiscovery: zod.z.boolean(),
-	caps: TargetKindCapsSchema
-});
-/**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
-*/
-var TargetSchema = zod.z.object({
-	id: zod.z.string(),
-	name: zod.z.string(),
-	kind: zod.z.string(),
-	addonId: zod.z.string(),
-	enabled: zod.z.boolean(),
-	config: zod.z.record(zod.z.string(), zod.z.unknown())
-});
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = zod.z.object({
-	kind: zod.z.string(),
-	suggestedName: zod.z.string(),
-	config: zod.z.record(zod.z.string(), zod.z.unknown())
-});
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = zod.z.object({
-	level: zod.z.string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: zod.z.number().int().nonnegative(),
-	actionsSent: zod.z.number().int().nonnegative(),
-	truncated: zod.z.boolean(),
-	dropped: zod.z.array(zod.z.string())
-});
-var SendResultSchema = zod.z.object({
-	success: zod.z.boolean(),
-	error: zod.z.string().optional(),
-	renderedAs: RenderedAsSchema.optional()
-});
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
-var notificationOutputCapability = {
-	name: "notification-output",
-	scope: "system",
-	mode: "collection",
-	methods: {
-		listTargetKinds: method(zod.z.object({}), zod.z.array(TargetKindSchema)),
-		listTargets: method(zod.z.object({}), zod.z.array(TargetSchema)),
-		discoverTargets: method(zod.z.object({
-			kind: zod.z.string(),
-			config: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-		}), zod.z.array(DiscoveredTargetSchema)),
-		send: method(zod.z.object({
-			targetId: zod.z.string(),
-			notification: NotificationSchema
-		}), SendResultSchema, { kind: "mutation" }),
-		testTarget: method(zod.z.object({
-			targetId: zod.z.string(),
-			sample: NotificationSchema.optional()
-		}), TestResultSchema, { kind: "mutation" }),
-		upsertTarget: method(zod.z.object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }),
-		deleteTarget: method(zod.z.object({ targetId: zod.z.string() }), zod.z.void(), { kind: "mutation" }),
-		setTargetEnabled: method(zod.z.object({
-			targetId: zod.z.string(),
-			enabled: zod.z.boolean()
-		}), zod.z.void(), { kind: "mutation" })
-	}
-};
-/**
 * core-blocks — user-authored TypeScript, stored in the kernel and executed in
 * its own process.
 *

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DBeh_RnY.js");
+const require_dist = require("./dist-CBwOEr6q.js");
 const require_model_download_service = require("./model-download-service-hf0ookyy.js");
 const require_manifest_python_deps = require("./manifest-python-deps-BqE5j0-O.js");
 const require_resource_monitor = require("./resource-monitor-DNNomR-i.js");

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { At as readinessKey, B as lifecycleJobSchema, F as isArrayOutputSchema, I as isCollectionArrayMethod, L as isObjectInput, M as extractNestedAddonId, Mt as scopeKey, Ot as parseJsonObject, Pt as EventCategory$1, R as isVoidInput, St as emitDownForOwnedCaps, U as logLevelAtMost, W as looseSchema, X as procedureAuthKey, bt as asString$1, c as METHOD_ACCESS_MAP, dt as DEVICE_STATUS_METHOD, gt as ReadinessTimeoutError, h as addonSettingsCapability, ht as ReadinessRegistry, jt as resolveCapMount, kt as parseJsonUnknown$1, l as RUNTIME_DEFAULTS, lt as DATAPLANE_SECRET_HEADER$1, q as objectInputDeclaresAddonId, st as errMsg$1, t as ALL_CAPABILITY_DEFINITIONS, ut as DEVICE_SETTINGS_CONTRIBUTION_METHODS, vt as asJsonObject$1, wt as expandCapMethods, xt as createEvent, yt as asNumber, z as kebabToCamel } from "./dist-BpVtesRV.mjs";
+import { At as readinessKey, B as lifecycleJobSchema, F as isArrayOutputSchema, I as isCollectionArrayMethod, L as isObjectInput, M as extractNestedAddonId, Mt as scopeKey, Ot as parseJsonObject, Pt as EventCategory$1, R as isVoidInput, St as emitDownForOwnedCaps, U as logLevelAtMost, W as looseSchema, X as procedureAuthKey, bt as asString$1, c as METHOD_ACCESS_MAP, dt as DEVICE_STATUS_METHOD, gt as ReadinessTimeoutError, h as addonSettingsCapability, ht as ReadinessRegistry, jt as resolveCapMount, kt as parseJsonUnknown$1, l as RUNTIME_DEFAULTS, lt as DATAPLANE_SECRET_HEADER$1, q as objectInputDeclaresAddonId, st as errMsg$1, t as ALL_CAPABILITY_DEFINITIONS, ut as DEVICE_SETTINGS_CONTRIBUTION_METHODS, vt as asJsonObject$1, wt as expandCapMethods, xt as createEvent, yt as asNumber, z as kebabToCamel } from "./dist-BZAMwgix.mjs";
 import { a as downloadModel, c as getModelFilePath, d as contentTypeFor, f as createAuthenticatedFileServer, h as resolveFilePath, i as downloadFile, l as isModelDownloaded, m as parseTokenizedUrl, n as collectModelFiles, o as ensureModel, p as parseRangeHeader, r as deleteModelFromDisk, s as fetchJson, t as ModelDownloadService, u as createFileDataPlaneHandler } from "./model-download-service-Cp9f4dk6.mjs";
 import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-Ck4-9K9m.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BkP504Vq.mjs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.42",
+  "version": "1.2.44",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",