@camstack/types 1.2.280 → 1.2.282

package/dist/index.js

@@ -7419,6 +7419,119 @@ var authProviderCapability = {
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
 	mount: { kind: "skip" }
 };
+//#endregion
+//#region src/capabilities/database-snapshot.cap.ts
+/**
+* The suffix of a verified snapshot, written next to the live database it
+* copies: `<db>.backup-snapshot`. A restore promotes it back over `<db>`
+* (`server/backend/src/sqlite-restore.ts` spells the same string — the
+* launcher stays free of `@camstack/*` runtime imports — and a spec pins the
+* two together).
+*/
+var DATABASE_SNAPSHOT_SUFFIX = ".backup-snapshot";
+/**
+* The suffix of a copy still being written or verified. A file under this name
+* is never archived and never promoted: only a copy that passed every check is
+* renamed to {@link DATABASE_SNAPSHOT_SUFFIX}.
+*/
+var DATABASE_SNAPSHOT_PARTIAL_SUFFIX = ".backup-snapshot-partial";
+/**
+* How long one snapshot may take end to end: the pinned copy of the whole
+* database plus `PRAGMA integrity_check` over the copy, on the hub's slowest
+* disk. ~800 MB at a pessimistic 10 MB/s is under 3 minutes; the bound is
+* generous because a timeout fails the whole backup run.
+*/
+var DATABASE_SNAPSHOT_TIMEOUT_MS = 30 * 6e4;
+/**
+* The databases an owner snapshots — declared by the OWNER, so a caller never
+* guesses which file is live from what sits beside it (a cleanly closed
+* database has no sidecars and is just as owned). Paths are absolute on the
+* owner's host.
+*/
+var DatabaseSnapshotTargetsSchema = zod.z.object({ databases: zod.z.array(zod.z.object({ livePath: zod.z.string() })) });
+/** One b-tree table of the snapshot and the rows it holds. */
+var DatabaseSnapshotTableSchema = zod.z.object({
+	name: zod.z.string(),
+	rows: zod.z.number().int().nonnegative()
+});
+/**
+* What the owner wrote. Every path is ABSOLUTE on the owner's host — the
+* caller pins the call to its own node, so it can read the file; a caller
+* that finds the path outside its own data root refuses it rather than
+* archiving something it cannot place.
+*/
+var DatabaseSnapshotResultSchema = zod.z.object({
+	/** The live database the snapshot copies. Never to be copied as a file. */
+	livePath: zod.z.string(),
+	/** The verified copy: `<livePath>` + {@link DATABASE_SNAPSHOT_SUFFIX}. */
+	snapshotPath: zod.z.string(),
+	sizeBytes: zod.z.number().int().nonnegative(),
+	pageCount: zod.z.number().int().nonnegative(),
+	pageSize: zod.z.number().int().positive(),
+	/**
+	* Every b-tree table with its row count. Read inside the SAME read
+	* transaction the copy was taken from, and found EQUAL on the copy — so
+	* this is the content of the snapshot, not an estimate of the source.
+	*/
+	tables: zod.z.array(DatabaseSnapshotTableSchema),
+	/** Wall time of the pinned copy (row counts included). */
+	copyMs: zod.z.number().nonnegative(),
+	/** Wall time of the checks on the copy (`integrity_check`, row counts). */
+	verifyMs: zod.z.number().nonnegative(),
+	/** When the pinned read transaction began (ms epoch) — the snapshot's instant. */
+	takenAt: zod.z.number()
+});
+/**
+* A snapshot as an ARCHIVE records it (`ArchiveManifest.sqliteSnapshots`):
+* the same facts, with both paths relative to the archive root (the node's
+* data dir), because an archive outlives the host that made it.
+*/
+var ArchiveSqliteSnapshotSchema = DatabaseSnapshotResultSchema.extend({
+	/** Archive-relative path of the live database the archive does NOT carry. */
+	livePath: zod.z.string(),
+	/** Archive-relative path of the verified copy it carries in its place. */
+	snapshotPath: zod.z.string()
+});
+/**
+* database-snapshot — the OWNER of a live SQLite database writes a consistent,
+* verified copy of it (D693).
+*
+* A live database cannot be copied as files: three files written by a live
+* process cannot be read at one instant from outside it, and a tar of the
+* `.db` / `-wal` / `-shm` trio was measured torn in 6/6 archives (D679). Nor may
+* another process open it (D679 rule 2). So the process that owns the
+* connection writes the copy — through its own connection, on a thread,
+* pinned to one read transaction — and checks it before handing it out.
+*
+* Hub-only and internal: `sqlite-settings` is the registrant, and its consumer
+* is `backup-orchestrator`, which calls it pinned to its own node so the path
+* it gets back is on its own host. `auth: 'admin'` explicitly — `internal`
+* does not gate the mount (see `data-store-provider`).
+*/
+var databaseSnapshotCapability = {
+	name: "database-snapshot",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		/**
+		* Which databases this owner snapshots. Answered from memory — no file is
+		* touched — so a backup can ask it before deciding anything.
+		*/
+		listDatabases: require_sleep.method(zod.z.object({}), DatabaseSnapshotTargetsSchema, { auth: "admin" }),
+		/**
+		* Write `<db>.backup-snapshot` and return what it holds. Throws — and
+		* leaves no file under the final name — when the copy fails
+		* `integrity_check` or its row counts differ from the pinned source's.
+		* A second call while one is running joins it.
+		*/
+		writeSnapshot: require_sleep.method(zod.z.object({}), DatabaseSnapshotResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: DATABASE_SNAPSHOT_TIMEOUT_MS
+		})
+	}
+};
 /**
 * Orchestrator-side destination metadata. The orchestrator computes
 * `id = <addonId>:<subId>` from its provider lookup so consumers
@@ -7530,7 +7643,12 @@ var ArchiveManifestSchema = zod.z.object({
 	locations: zod.z.array(zod.z.string()),
 	entries: zod.z.array(ArchiveEntrySchema),
 	totalBytes: zod.z.number(),
-	totalFiles: zod.z.number()
+	totalFiles: zod.z.number(),
+	/**
+	* Live SQLite databases this archive carries as their OWNER's verified
+	* snapshot instead of as files (D693). Absent on archives made before.
+	*/
+	sqliteSnapshots: zod.z.array(ArchiveSqliteSnapshotSchema).optional()
 });
 var LocationStatSchema = zod.z.object({
 	name: zod.z.string(),
@@ -9920,6 +10038,79 @@ var CompositionBlockStateSchema = zod.z.object({
 	fields: zod.z.array(CompositionFieldStateSchema)
 });
 //#endregion
+//#region src/capabilities/composer.cap.ts
+/**
+* composer — runs every DECLARATIVE composition (D659).
+*
+* Internal and admin-only: its one caller is `core-blocks`' supervisor, which
+* sends the WHOLE set of composition blocks on every converge (idempotent),
+* and reads their state for the API. Nothing else talks to it.
+*/
+/** The composer's runner id, `resolveRunnerId(decl, 'composer')`; pinned by `composer-manifest.spec.ts`. */
+var COMPOSER_RUNNER_ID = require_composition.COMPOSER_ADDON_ID;
+var ComposerBlockSchema = zod.z.object({
+	id: zod.z.string().min(1),
+	name: zod.z.string().min(1).max(120),
+	enabled: zod.z.boolean(),
+	updatedAt: zod.z.number(),
+	composition: require_composition.CompositionSchema
+});
+/**
+* A stored composition row that no longer PARSES — a schema a release
+* tightened, a row written by a newer build. Sent by id so the composer keeps
+* its device as a placeholder and reports the block `failed` naming the parse
+* error. Leaving it out would read, twice, exactly like a delete (D49).
+*/
+var ComposerUnreadableBlockSchema = zod.z.object({
+	id: zod.z.string().min(1),
+	/** The row's stored name column; null when even that is unreadable (the device keeps the name it has). */
+	name: zod.z.string().nullable(),
+	/** The parse error, in the operator's words. */
+	error: zod.z.string()
+});
+var ComposerApplyInputSchema = zod.z.object({
+	/** The shared Blocks integration; null until `core-blocks` has reconciled it. */
+	integrationId: zod.z.string().nullable(),
+	/** False when the `core_blocks` read failed: then nothing may be withdrawn (D49). */
+	storeLoaded: zod.z.boolean(),
+	blocks: zod.z.array(ComposerBlockSchema),
+	/** Operator restarts: rebuild these runtimes and re-resolve their sources. Stores nothing (D62). */
+	restartBlockIds: zod.z.array(zod.z.string()),
+	/** Composition rows that exist but do not parse: held, never withdrawn, reported failed. */
+	unreadableBlocks: zod.z.array(ComposerUnreadableBlockSchema)
+});
+var ComposerBlockVerdictSchema = zod.z.object({
+	blockId: zod.z.string(),
+	status: CompositionRunStatusSchema,
+	reason: zod.z.string().optional()
+});
+var ComposerApplyResultSchema = zod.z.object({
+	blocks: zod.z.array(ComposerBlockVerdictSchema),
+	/**
+	* False when the composer declared and withdrew NOTHING (store not loaded,
+	* integration unknown, its own rows unread or read empty once). An empty
+	* apply the caller owes is paid off only by one the composer acted on (D49).
+	*/
+	acted: zod.z.boolean()
+});
+var composerCapability = {
+	name: "composer",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		/**
+		* Not `apply`: tRPC reserves `apply`, `call` and `then` as router keys, and
+		* `router({})` throws on one — every cap router is built at boot.
+		*/
+		applyBlocks: require_sleep.method(ComposerApplyInputSchema, ComposerApplyResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getStates: require_sleep.method(zod.z.object({ blockIds: zod.z.array(zod.z.string()) }), zod.z.object({ states: zod.z.array(CompositionBlockStateSchema) }), { auth: "admin" })
+	}
+};
+//#endregion
 //#region src/composition/plan-result.ts
 function problem(code, path, message) {
 	return {
@@ -11168,79 +11359,6 @@ var coreBlocksCapability = {
 	}
 };
 //#endregion
-//#region src/capabilities/composer.cap.ts
-/**
-* composer — runs every DECLARATIVE composition (D659).
-*
-* Internal and admin-only: its one caller is `core-blocks`' supervisor, which
-* sends the WHOLE set of composition blocks on every converge (idempotent),
-* and reads their state for the API. Nothing else talks to it.
-*/
-/** The composer's runner id, `resolveRunnerId(decl, 'composer')`; pinned by `composer-manifest.spec.ts`. */
-var COMPOSER_RUNNER_ID = require_composition.COMPOSER_ADDON_ID;
-var ComposerBlockSchema = zod.z.object({
-	id: zod.z.string().min(1),
-	name: zod.z.string().min(1).max(120),
-	enabled: zod.z.boolean(),
-	updatedAt: zod.z.number(),
-	composition: require_composition.CompositionSchema
-});
-/**
-* A stored composition row that no longer PARSES — a schema a release
-* tightened, a row written by a newer build. Sent by id so the composer keeps
-* its device as a placeholder and reports the block `failed` naming the parse
-* error. Leaving it out would read, twice, exactly like a delete (D49).
-*/
-var ComposerUnreadableBlockSchema = zod.z.object({
-	id: zod.z.string().min(1),
-	/** The row's stored name column; null when even that is unreadable (the device keeps the name it has). */
-	name: zod.z.string().nullable(),
-	/** The parse error, in the operator's words. */
-	error: zod.z.string()
-});
-var ComposerApplyInputSchema = zod.z.object({
-	/** The shared Blocks integration; null until `core-blocks` has reconciled it. */
-	integrationId: zod.z.string().nullable(),
-	/** False when the `core_blocks` read failed: then nothing may be withdrawn (D49). */
-	storeLoaded: zod.z.boolean(),
-	blocks: zod.z.array(ComposerBlockSchema),
-	/** Operator restarts: rebuild these runtimes and re-resolve their sources. Stores nothing (D62). */
-	restartBlockIds: zod.z.array(zod.z.string()),
-	/** Composition rows that exist but do not parse: held, never withdrawn, reported failed. */
-	unreadableBlocks: zod.z.array(ComposerUnreadableBlockSchema)
-});
-var ComposerBlockVerdictSchema = zod.z.object({
-	blockId: zod.z.string(),
-	status: CompositionRunStatusSchema,
-	reason: zod.z.string().optional()
-});
-var ComposerApplyResultSchema = zod.z.object({
-	blocks: zod.z.array(ComposerBlockVerdictSchema),
-	/**
-	* False when the composer declared and withdrew NOTHING (store not loaded,
-	* integration unknown, its own rows unread or read empty once). An empty
-	* apply the caller owes is paid off only by one the composer acted on (D49).
-	*/
-	acted: zod.z.boolean()
-});
-var composerCapability = {
-	name: "composer",
-	scope: "system",
-	mode: "singleton",
-	internal: true,
-	methods: {
-		/**
-		* Not `apply`: tRPC reserves `apply`, `call` and `then` as router keys, and
-		* `router({})` throws on one — every cap router is built at boot.
-		*/
-		applyBlocks: require_sleep.method(ComposerApplyInputSchema, ComposerApplyResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		getStates: require_sleep.method(zod.z.object({ blockIds: zod.z.array(zod.z.string()) }), zod.z.object({ states: zod.z.array(CompositionBlockStateSchema) }), { auth: "admin" })
-	}
-};
-//#endregion
 //#region src/capabilities/custom-model-registry.cap.ts
 /**
 * `custom-model-registry` — collection cap exposing operator-registered
@@ -14715,6 +14833,337 @@ var deviceManagerCapability = {
 	}
 };
 //#endregion
+//#region src/capabilities/doorbell.cap.ts
+/**
+* Doorbell button cap. Two kinds of providers coexist behind this cap
+* name (same pattern as `snapshot`):
+*
+*   - **Native** providers: registered per-device by device-driver
+*     addons via `ctx.registerNativeCap` — either on a
+*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
+*     or directly on the camera (Reolink registers at camera level).
+*     Emits an `onPressed` event every time the firmware pushes a
+*     ring; status tracks the last press and a pressCount since start
+*     (diagnostic).
+*
+*   - **Wrapper** provider: the `virtual-doorbell` system builtin
+*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
+*     device (contact / switch / event-emitter …) into a doorbell for
+*     a camera. `defaultActive: false` — the operator explicitly binds
+*     it per camera in the device-bindings UI, then picks the source
+*     device + trigger in the per-device settings.
+*
+* The DeviceEventPropagator re-emits `onPressed` on the camera parent
+* — subscribers listening at the camera level receive ring events
+* with `via[]` populated. No code on the parent needed.
+*/
+var DoorbellStatusSchema = zod.z.object({
+	/** Ms epoch of the last press. null = never observed since this provider started. */
+	lastPressedAt: zod.z.number().nullable(),
+	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
+	pressCountSinceStart: zod.z.number()
+});
+var DoorbellPressEventSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	timestamp: zod.z.number()
+});
+/**
+* The `doorbell-source` extension slot's editable value (D648): the camera's
+* virtual-doorbell trigger devices, exactly what the wrapper's
+* `doorbellSources` persists (as `{ deviceId }` records).
+*/
+var DoorbellSourceSlotValueSchema = zod.z.object({ deviceIds: zod.z.array(zod.z.number().int().positive()) });
+/**
+* The `doorbell-source` slot — which devices ring this camera's VIRTUAL
+* doorbell, owned by the `virtual-doorbell` wrapper over its
+* `doorbellSources` store (D648). A source rings when one of its
+* `SOURCE_CAPS` rises. Whether the wrapper is bound to the camera at all is a
+* different authority (`deviceManager.setWrapperActive`, D62) — the slot
+* reports it, it never writes it.
+*/
+var DOORBELL_SOURCE_SLOT = {
+	id: "doorbell-source",
+	label: "Doorbell trigger devices",
+	description: "Any of these becoming active rings this camera's virtual doorbell: a binary sensor when it goes active, a switch when it turns on.",
+	shape: "association",
+	hostDeviceTypes: [require_err_msg.DeviceType.Camera],
+	sourceCaps: require_composition.SOURCE_CAPS,
+	cardinality: "many",
+	value: DoorbellSourceSlotValueSchema
+};
+var doorbellCapability = {
+	name: "doorbell",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	kind: "wrapper",
+	defaultActive: false,
+	deviceTypes: [require_err_msg.DeviceType.Button, require_err_msg.DeviceType.Camera],
+	extensionSlots: [DOORBELL_SOURCE_SLOT],
+	methods: {},
+	events: { 
+	/**
+	* Fires once per physical press. Reolink delivers via Baichuan
+	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
+	* release/duration — it's a pulse.
+	*/
+onPressed: {
+		data: DoorbellPressEventSchema,
+		fromState: {
+			field: "lastPressedAt",
+			on: "advance"
+		}
+	} },
+	status: {
+		schema: DoorbellStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — last press timestamp + lifetime press count.
+	* Mirrored by the kernel and readable via
+	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
+	* without subscribing.
+	*/
+	runtimeState: DoorbellStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored"
+};
+//#endregion
+//#region src/generated/extension-slots.ts
+/**
+* AUTO-GENERATED by scripts/generate-extension-slots.ts — DO NOT EDIT.
+*
+* Every extension slot declared by a capability (`extensionSlots` in its
+* `*.cap.ts`, D648), folded into one typed table. Imports ONLY the declaring
+* caps' descriptors and value schemas — never the caps barrel — so
+* `device-extension.cap.ts` can import this module without a cycle.
+*
+* Coverage: 2 slot(s).
+*/
+/** Every declared slot id, in table order. */
+var EXTENSION_SLOT_IDS = ["doorbell-source", "linked-devices"];
+var ExtensionSlotIdSchema = zod.z.enum(EXTENSION_SLOT_IDS);
+var EXTENSION_SLOTS = {
+	"doorbell-source": {
+		descriptor: DOORBELL_SOURCE_SLOT,
+		declaringCap: "doorbell",
+		hostDeviceTypes: [require_err_msg.DeviceType.Camera]
+	},
+	"linked-devices": {
+		descriptor: LINKED_DEVICES_SLOT,
+		declaringCap: "device-manager",
+		hostDeviceTypes: [require_err_msg.DeviceType.Camera]
+	}
+};
+/** A slot's editable value, discriminated on `slot`. */
+var ExtensionSlotValueSchema = zod.z.discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: zod.z.literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: zod.z.literal("linked-devices") })]);
+/** Every device type at least one slot is offered on — `device-extension`'s `deviceTypes`. */
+var EXTENSION_HOST_DEVICE_TYPES = [require_err_msg.DeviceType.Camera];
+//#endregion
+//#region src/capabilities/device-extension.cap.ts
+/**
+* `device-extension` — ONE place to see and author what a device is extended
+* with by OTHER devices (D648).
+*
+* **A contract, not a store.** Every slot (`linked-devices`, `doorbell-source`)
+* is declared by the cap that owns the function (`extensionSlots` in its
+* `*.cap.ts`, D4) and SERVED by the addon that already owns its store, over
+* that store and its existing write path. This cap persists nothing and has no config method (guarded by
+* `scripts/check-extension-slots.ts`): D62 applied to the whole feature, and
+* D3 — no shadow registry.
+*
+* **Shape.** A device-scoped wrapper COLLECTION, the D554 shape `videoclips`
+* uses: `resolveCapMount` gives it the `device-scoped` mount and
+* `requireDeviceCollection` dispatches it. Its providers are the slot owners
+* (device-manager, virtual-doorbell, …), and a device's sources are its
+* bindings (step 0 of `getBindings`, derived, persisted nowhere).
+*
+*  - `listSources` — one row per provider, the D554 source-listing convention
+*    that lets a scalar call be routed by the prefix of its `slotRef`.
+*  - `listSlots` — fan-out, concatenated. A provider that throws becomes ONE
+*    `unreachable` row naming it, never an absence (D554.4, D315): "no
+*    extensions" is claimed only from an answer.
+*  - `listCandidates` / `setSlot` — scalar, routed by `slotRef`
+*    (`<source>:<slotId>`). An unclaimed ref is refused by name (D554.5).
+*
+* The slot's value travels as the generated discriminated union
+* (`ExtensionSlotValue`, keyed on `slot`), so a value under the wrong slot is
+* a schema error before it reaches any owner.
+*
+* **Associations only.** A slot LISTS other devices on its host. A host that
+* GAINS a capability from other devices is a composition (D663, amends D648:
+* the reserved `graft` shape, its `projects` and its `enabled` switch were
+* retired unimplemented).
+*/
+/** Separator between the source and the slot id in a `slotRef`. It is the
+*  D554 routing separator: the dispatcher matches `<source>:` prefixes. */
+var EXTENSION_SLOT_REF_SEPARATOR = ":";
+/** The contract method whose failure BECOMES a row, like `listSources`'s. */
+var EXTENSION_SLOT_LISTING_METHOD = "listSlots";
+var ExtensionSourceAvailabilitySchema = zod.z.discriminatedUnion("state", [zod.z.object({ state: zod.z.literal("ok") }), zod.z.object({
+	state: zod.z.literal("unreachable"),
+	reason: zod.z.string()
+})]);
+/** One provider of slots — the D554 source-listing row. */
+var ExtensionSourceSchema = zod.z.object({
+	/** The routing prefix of every `slotRef` this provider serves. */
+	source: zod.z.string(),
+	label: zod.z.string(),
+	/** Stamped by the dispatcher from the registry (D557). */
+	addonId: zod.z.string().optional(),
+	availability: ExtensionSourceAvailabilitySchema
+});
+/**
+* How one picked source stands. `missing` — no such device (deleted, or an id
+* that never existed); `foreign` — a device the slot's owner cannot read from
+* (a source owned by another addon); `unavailable` — it exists but is not a
+* valid source now (a container, which is never a pick). A source in any of
+* these states is SHOWN, never silently dropped or re-pointed.
+*/
+var ExtensionSourceHealthSchema = zod.z.enum([
+	"ok",
+	"missing",
+	"foreign",
+	"unavailable"
+]);
+var ExtensionSlotSourceSchema = zod.z.object({
+	deviceId: zod.z.number().int(),
+	/** The device's name, or null when it could not be resolved (`missing`). */
+	name: zod.z.string().nullable(),
+	health: ExtensionSourceHealthSchema,
+	detail: zod.z.string().optional()
+});
+/**
+* A DIFFERENT authority that gates whether the slot's sources do anything —
+* reported read-only, named, never written through this contract (D62). The
+* virtual doorbell's sources ring only while the wrapper is bound to the
+* camera, and that binding belongs to `deviceManager.setWrapperActive`.
+* `unknown` means the gate could not be read; it is not "inactive" (D315).
+*/
+var ExtensionSlotActivationSchema = zod.z.object({
+	state: zod.z.enum([
+		"active",
+		"inactive",
+		"unknown"
+	]),
+	authority: zod.z.string(),
+	detail: zod.z.string().optional()
+});
+/** One slot of one device, as its owner reads it from its own store. */
+var ExtensionSlotStateSchema = zod.z.object({
+	state: zod.z.literal("ok"),
+	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
+	slotRef: zod.z.string(),
+	slot: ExtensionSlotIdSchema,
+	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
+	authority: zod.z.string(),
+	activation: ExtensionSlotActivationSchema.nullable(),
+	value: ExtensionSlotValueSchema,
+	sources: zod.z.array(ExtensionSlotSourceSchema),
+	/**
+	* Devices the owner links to the host ON ITS OWN, by structure, and that
+	* are therefore not in `value` (D655): a camera's device-tree children, and
+	* the child a picked container stands for (D356 — a container is never a
+	* pick, its children are). Read-only; the editor shows them and may offer
+	* per-device options on them (the linked-devices tracked-event opt-in).
+	* Absent when the owner links nothing beyond the picks, and from an owner
+	* older than D655.
+	*/
+	impliedSources: zod.z.array(ExtensionSlotSourceSchema).optional()
+});
+/**
+* A provider that could not answer `listSlots` at all. It could not name its
+* own slots, so the row names the ADDON and carries the refusal verbatim.
+* Written by the dispatcher, never by a provider.
+*/
+var ExtensionSlotUnreachableSchema = zod.z.object({
+	state: zod.z.literal("unreachable"),
+	addonId: zod.z.string(),
+	reason: zod.z.string()
+});
+var ExtensionSlotRowSchema = zod.z.discriminatedUnion("state", [ExtensionSlotStateSchema, ExtensionSlotUnreachableSchema]);
+/** The row the dispatcher writes for a provider whose `listSlots` threw. */
+function unreachableExtensionSlotRow(addonId, reason) {
+	return {
+		state: "unreachable",
+		addonId,
+		reason
+	};
+}
+/** One device the slot's editor may offer as a source. */
+var ExtensionCandidateSchema = zod.z.object({
+	deviceId: zod.z.number().int(),
+	name: zod.z.string(),
+	type: zod.z.string(),
+	location: zod.z.string().nullable(),
+	/** The container a child belongs to — "Spotlight 2" alone does not say which. */
+	parentName: zod.z.string().nullable(),
+	/** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
+	suggested: zod.z.boolean(),
+	/** Why it is suggested ("same location"), null when it is not. */
+	reason: zod.z.string().nullable()
+});
+var ExtensionCandidatesSchema = zod.z.object({ candidates: zod.z.array(ExtensionCandidateSchema) });
+/**
+* What a write did. `none` — applied in place. `host` / `parent` — the owner
+* reloaded the host (or, for an accessory child, its parent) because the
+* write changed what the host REGISTERS. A slot never adds a capability to its
+* host — that is a composition (D663) — so today's owners answer `none`.
+*/
+var ExtensionSetResultSchema = zod.z.object({
+	applied: zod.z.literal(true),
+	reload: zod.z.enum([
+		"none",
+		"host",
+		"parent"
+	])
+});
+var ExtensionSlotRefInputSchema = zod.z.object({
+	deviceId: zod.z.number().int(),
+	slotRef: zod.z.string().min(1)
+});
+var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
+var deviceExtensionCapability = {
+	name: "device-extension",
+	scope: "device",
+	mode: "collection",
+	kind: "wrapper",
+	defaultActive: true,
+	deviceTypes: EXTENSION_HOST_DEVICE_TYPES,
+	deviceConfig: { ui: {
+		kind: "widget",
+		widgetId: "host/extensions-panel",
+		tab: "general",
+		label: "Extensions",
+		order: 72
+	} },
+	methods: {
+		/** One row per slot owner — the D554 source listing `slotRef` routes by. */
+		listSources: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int() }), zod.z.array(ExtensionSourceSchema)),
+		/**
+		* Every slot this device is offered, read by each owner from its own
+		* store. A provider that throws is ONE `unreachable` row (D554.4).
+		*/
+		listSlots: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int() }), zod.z.array(ExtensionSlotRowSchema)),
+		/** The devices the slot's editor may offer, suggestions pre-marked (D356). */
+		listCandidates: require_sleep.method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema),
+		/**
+		* Write one slot through its owner's EXISTING write path. The owner
+		* validates (a container is never a linked device, a camera is never its
+		* own source) and refuses by name before persisting.
+		*/
+		setSlot: require_sleep.method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+//#endregion
 //#region src/capabilities/device-state.cap.ts
 /**
 * Per-field ownership (D663). A composition may CLAIM fields of a native
@@ -19579,10 +20028,12 @@ var NcMediaPolicySchema = zod.z.object({
 /**
 * Cooldown GRANULARITY over the subject's class — how much a fired
 * notification suppresses.
-*  - `shared` (default, and the absent value) — one window for the whole
-*    rule/scope: a cat silences the next dog for `cooldownSec`.
-*  - `per-class` — an independent window per detected class, so cat→dog fires
-*    at once and cat→cat still waits.
+*  - `per-class` (default, and the absent value since 2026-10-01 — D36) — an
+*    independent window per detected class: cat→dog fires at once, cat→cat
+*    still waits.
+*  - `shared` — one window for the whole rule/scope: a cat silences the next
+*    dog for `cooldownSec`. Only written when an operator picks it; it is no
+*    longer what an unset rule means.
 *
 * AUDIO subjects are ALWAYS per-class regardless of this setting: a scream
 * must not be swallowed by a bark's window (the precedent this generalizes —
@@ -19597,8 +20048,11 @@ var NcThrottleSchema = zod.z.object({
 	/**
 	* Class granularity of the cooldown key. Optional rather than defaulted:
 	* a Zod default does NOT run on the addon→addon cap path, so a persisted
-	* rule authored before this field simply carries none — and the engine
-	* reads absent as `shared`, the pre-existing behaviour.
+	* rule authored before this field simply carries none. The engine used to
+	* read absent as `shared` (D36); since 2026-10-01 it reads absent as
+	* `per-class` — the operator's default — and only an explicit `shared`
+	* still means `shared`. See `cooldownKey` / `keysPerClass` in the rule
+	* engine, and D36's dated note.
 	*/
 	granularity: NcThrottleGranularitySchema.optional()
 });
@@ -31307,337 +31761,6 @@ var CLIP_PLAYBACK_OPTIONS = {
 	}
 };
 //#endregion
-//#region src/capabilities/doorbell.cap.ts
-/**
-* Doorbell button cap. Two kinds of providers coexist behind this cap
-* name (same pattern as `snapshot`):
-*
-*   - **Native** providers: registered per-device by device-driver
-*     addons via `ctx.registerNativeCap` — either on a
-*     `DeviceType.Button` accessory with `role: DeviceRole.Doorbell`,
-*     or directly on the camera (Reolink registers at camera level).
-*     Emits an `onPressed` event every time the firmware pushes a
-*     ring; status tracks the last press and a pressCount since start
-*     (diagnostic).
-*
-*   - **Wrapper** provider: the `virtual-doorbell` system builtin
-*     (`@camstack/system/builtins/doorbell`). Turns ANY binary-ish
-*     device (contact / switch / event-emitter …) into a doorbell for
-*     a camera. `defaultActive: false` — the operator explicitly binds
-*     it per camera in the device-bindings UI, then picks the source
-*     device + trigger in the per-device settings.
-*
-* The DeviceEventPropagator re-emits `onPressed` on the camera parent
-* — subscribers listening at the camera level receive ring events
-* with `via[]` populated. No code on the parent needed.
-*/
-var DoorbellStatusSchema = zod.z.object({
-	/** Ms epoch of the last press. null = never observed since this provider started. */
-	lastPressedAt: zod.z.number().nullable(),
-	/** Counter since provider start. Resets on reboot. Useful for metrics/debug. */
-	pressCountSinceStart: zod.z.number()
-});
-var DoorbellPressEventSchema = zod.z.object({
-	deviceId: zod.z.number(),
-	timestamp: zod.z.number()
-});
-/**
-* The `doorbell-source` extension slot's editable value (D648): the camera's
-* virtual-doorbell trigger devices, exactly what the wrapper's
-* `doorbellSources` persists (as `{ deviceId }` records).
-*/
-var DoorbellSourceSlotValueSchema = zod.z.object({ deviceIds: zod.z.array(zod.z.number().int().positive()) });
-/**
-* The `doorbell-source` slot — which devices ring this camera's VIRTUAL
-* doorbell, owned by the `virtual-doorbell` wrapper over its
-* `doorbellSources` store (D648). A source rings when one of its
-* `SOURCE_CAPS` rises. Whether the wrapper is bound to the camera at all is a
-* different authority (`deviceManager.setWrapperActive`, D62) — the slot
-* reports it, it never writes it.
-*/
-var DOORBELL_SOURCE_SLOT = {
-	id: "doorbell-source",
-	label: "Doorbell trigger devices",
-	description: "Any of these becoming active rings this camera's virtual doorbell: a binary sensor when it goes active, a switch when it turns on.",
-	shape: "association",
-	hostDeviceTypes: [require_err_msg.DeviceType.Camera],
-	sourceCaps: require_composition.SOURCE_CAPS,
-	cardinality: "many",
-	value: DoorbellSourceSlotValueSchema
-};
-var doorbellCapability = {
-	name: "doorbell",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	kind: "wrapper",
-	defaultActive: false,
-	deviceTypes: [require_err_msg.DeviceType.Button, require_err_msg.DeviceType.Camera],
-	extensionSlots: [DOORBELL_SOURCE_SLOT],
-	methods: {},
-	events: { 
-	/**
-	* Fires once per physical press. Reolink delivers via Baichuan
-	* push (`ReolinkSimpleEvent.type === 'doorbell'`). There is no
-	* release/duration — it's a pulse.
-	*/
-onPressed: {
-		data: DoorbellPressEventSchema,
-		fromState: {
-			field: "lastPressedAt",
-			on: "advance"
-		}
-	} },
-	status: {
-		schema: DoorbellStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — last press timestamp + lifetime press count.
-	* Mirrored by the kernel and readable via
-	* `device.state.doorbell.value`. UIs can show "last ring 5m ago"
-	* without subscribing.
-	*/
-	runtimeState: DoorbellStatusSchema,
-	/**
-	* Runtime-state durability: **restored** — a monotonic accumulator: the slice IS the record. `lastPressedAt` is content here, not a clock, so it is deliberately NOT volatile.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "restored"
-};
-//#endregion
-//#region src/generated/extension-slots.ts
-/**
-* AUTO-GENERATED by scripts/generate-extension-slots.ts — DO NOT EDIT.
-*
-* Every extension slot declared by a capability (`extensionSlots` in its
-* `*.cap.ts`, D648), folded into one typed table. Imports ONLY the declaring
-* caps' descriptors and value schemas — never the caps barrel — so
-* `device-extension.cap.ts` can import this module without a cycle.
-*
-* Coverage: 2 slot(s).
-*/
-/** Every declared slot id, in table order. */
-var EXTENSION_SLOT_IDS = ["doorbell-source", "linked-devices"];
-var ExtensionSlotIdSchema = zod.z.enum(EXTENSION_SLOT_IDS);
-var EXTENSION_SLOTS = {
-	"doorbell-source": {
-		descriptor: DOORBELL_SOURCE_SLOT,
-		declaringCap: "doorbell",
-		hostDeviceTypes: [require_err_msg.DeviceType.Camera]
-	},
-	"linked-devices": {
-		descriptor: LINKED_DEVICES_SLOT,
-		declaringCap: "device-manager",
-		hostDeviceTypes: [require_err_msg.DeviceType.Camera]
-	}
-};
-/** A slot's editable value, discriminated on `slot`. */
-var ExtensionSlotValueSchema = zod.z.discriminatedUnion("slot", [DoorbellSourceSlotValueSchema.extend({ slot: zod.z.literal("doorbell-source") }), LinkedDevicesSlotValueSchema.extend({ slot: zod.z.literal("linked-devices") })]);
-/** Every device type at least one slot is offered on — `device-extension`'s `deviceTypes`. */
-var EXTENSION_HOST_DEVICE_TYPES = [require_err_msg.DeviceType.Camera];
-//#endregion
-//#region src/capabilities/device-extension.cap.ts
-/**
-* `device-extension` — ONE place to see and author what a device is extended
-* with by OTHER devices (D648).
-*
-* **A contract, not a store.** Every slot (`linked-devices`, `doorbell-source`)
-* is declared by the cap that owns the function (`extensionSlots` in its
-* `*.cap.ts`, D4) and SERVED by the addon that already owns its store, over
-* that store and its existing write path. This cap persists nothing and has no config method (guarded by
-* `scripts/check-extension-slots.ts`): D62 applied to the whole feature, and
-* D3 — no shadow registry.
-*
-* **Shape.** A device-scoped wrapper COLLECTION, the D554 shape `videoclips`
-* uses: `resolveCapMount` gives it the `device-scoped` mount and
-* `requireDeviceCollection` dispatches it. Its providers are the slot owners
-* (device-manager, virtual-doorbell, …), and a device's sources are its
-* bindings (step 0 of `getBindings`, derived, persisted nowhere).
-*
-*  - `listSources` — one row per provider, the D554 source-listing convention
-*    that lets a scalar call be routed by the prefix of its `slotRef`.
-*  - `listSlots` — fan-out, concatenated. A provider that throws becomes ONE
-*    `unreachable` row naming it, never an absence (D554.4, D315): "no
-*    extensions" is claimed only from an answer.
-*  - `listCandidates` / `setSlot` — scalar, routed by `slotRef`
-*    (`<source>:<slotId>`). An unclaimed ref is refused by name (D554.5).
-*
-* The slot's value travels as the generated discriminated union
-* (`ExtensionSlotValue`, keyed on `slot`), so a value under the wrong slot is
-* a schema error before it reaches any owner.
-*
-* **Associations only.** A slot LISTS other devices on its host. A host that
-* GAINS a capability from other devices is a composition (D663, amends D648:
-* the reserved `graft` shape, its `projects` and its `enabled` switch were
-* retired unimplemented).
-*/
-/** Separator between the source and the slot id in a `slotRef`. It is the
-*  D554 routing separator: the dispatcher matches `<source>:` prefixes. */
-var EXTENSION_SLOT_REF_SEPARATOR = ":";
-/** The contract method whose failure BECOMES a row, like `listSources`'s. */
-var EXTENSION_SLOT_LISTING_METHOD = "listSlots";
-var ExtensionSourceAvailabilitySchema = zod.z.discriminatedUnion("state", [zod.z.object({ state: zod.z.literal("ok") }), zod.z.object({
-	state: zod.z.literal("unreachable"),
-	reason: zod.z.string()
-})]);
-/** One provider of slots — the D554 source-listing row. */
-var ExtensionSourceSchema = zod.z.object({
-	/** The routing prefix of every `slotRef` this provider serves. */
-	source: zod.z.string(),
-	label: zod.z.string(),
-	/** Stamped by the dispatcher from the registry (D557). */
-	addonId: zod.z.string().optional(),
-	availability: ExtensionSourceAvailabilitySchema
-});
-/**
-* How one picked source stands. `missing` — no such device (deleted, or an id
-* that never existed); `foreign` — a device the slot's owner cannot read from
-* (a source owned by another addon); `unavailable` — it exists but is not a
-* valid source now (a container, which is never a pick). A source in any of
-* these states is SHOWN, never silently dropped or re-pointed.
-*/
-var ExtensionSourceHealthSchema = zod.z.enum([
-	"ok",
-	"missing",
-	"foreign",
-	"unavailable"
-]);
-var ExtensionSlotSourceSchema = zod.z.object({
-	deviceId: zod.z.number().int(),
-	/** The device's name, or null when it could not be resolved (`missing`). */
-	name: zod.z.string().nullable(),
-	health: ExtensionSourceHealthSchema,
-	detail: zod.z.string().optional()
-});
-/**
-* A DIFFERENT authority that gates whether the slot's sources do anything —
-* reported read-only, named, never written through this contract (D62). The
-* virtual doorbell's sources ring only while the wrapper is bound to the
-* camera, and that binding belongs to `deviceManager.setWrapperActive`.
-* `unknown` means the gate could not be read; it is not "inactive" (D315).
-*/
-var ExtensionSlotActivationSchema = zod.z.object({
-	state: zod.z.enum([
-		"active",
-		"inactive",
-		"unknown"
-	]),
-	authority: zod.z.string(),
-	detail: zod.z.string().optional()
-});
-/** One slot of one device, as its owner reads it from its own store. */
-var ExtensionSlotStateSchema = zod.z.object({
-	state: zod.z.literal("ok"),
-	/** `<source>:<slotId>` — the routing key for `listCandidates` / `setSlot`. */
-	slotRef: zod.z.string(),
-	slot: ExtensionSlotIdSchema,
-	/** Names the store written (D62), e.g. `virtual-doorbell:doorbellSources`. */
-	authority: zod.z.string(),
-	activation: ExtensionSlotActivationSchema.nullable(),
-	value: ExtensionSlotValueSchema,
-	sources: zod.z.array(ExtensionSlotSourceSchema),
-	/**
-	* Devices the owner links to the host ON ITS OWN, by structure, and that
-	* are therefore not in `value` (D655): a camera's device-tree children, and
-	* the child a picked container stands for (D356 — a container is never a
-	* pick, its children are). Read-only; the editor shows them and may offer
-	* per-device options on them (the linked-devices tracked-event opt-in).
-	* Absent when the owner links nothing beyond the picks, and from an owner
-	* older than D655.
-	*/
-	impliedSources: zod.z.array(ExtensionSlotSourceSchema).optional()
-});
-/**
-* A provider that could not answer `listSlots` at all. It could not name its
-* own slots, so the row names the ADDON and carries the refusal verbatim.
-* Written by the dispatcher, never by a provider.
-*/
-var ExtensionSlotUnreachableSchema = zod.z.object({
-	state: zod.z.literal("unreachable"),
-	addonId: zod.z.string(),
-	reason: zod.z.string()
-});
-var ExtensionSlotRowSchema = zod.z.discriminatedUnion("state", [ExtensionSlotStateSchema, ExtensionSlotUnreachableSchema]);
-/** The row the dispatcher writes for a provider whose `listSlots` threw. */
-function unreachableExtensionSlotRow(addonId, reason) {
-	return {
-		state: "unreachable",
-		addonId,
-		reason
-	};
-}
-/** One device the slot's editor may offer as a source. */
-var ExtensionCandidateSchema = zod.z.object({
-	deviceId: zod.z.number().int(),
-	name: zod.z.string(),
-	type: zod.z.string(),
-	location: zod.z.string().nullable(),
-	/** The container a child belongs to — "Spotlight 2" alone does not say which. */
-	parentName: zod.z.string().nullable(),
-	/** Pre-marked by the owner's suggestion rule. NEVER saved on its own (D356). */
-	suggested: zod.z.boolean(),
-	/** Why it is suggested ("same location"), null when it is not. */
-	reason: zod.z.string().nullable()
-});
-var ExtensionCandidatesSchema = zod.z.object({ candidates: zod.z.array(ExtensionCandidateSchema) });
-/**
-* What a write did. `none` — applied in place. `host` / `parent` — the owner
-* reloaded the host (or, for an accessory child, its parent) because the
-* write changed what the host REGISTERS. A slot never adds a capability to its
-* host — that is a composition (D663) — so today's owners answer `none`.
-*/
-var ExtensionSetResultSchema = zod.z.object({
-	applied: zod.z.literal(true),
-	reload: zod.z.enum([
-		"none",
-		"host",
-		"parent"
-	])
-});
-var ExtensionSlotRefInputSchema = zod.z.object({
-	deviceId: zod.z.number().int(),
-	slotRef: zod.z.string().min(1)
-});
-var ExtensionSetSlotInputSchema = ExtensionSlotRefInputSchema.extend({ value: ExtensionSlotValueSchema });
-var deviceExtensionCapability = {
-	name: "device-extension",
-	scope: "device",
-	mode: "collection",
-	kind: "wrapper",
-	defaultActive: true,
-	deviceTypes: EXTENSION_HOST_DEVICE_TYPES,
-	deviceConfig: { ui: {
-		kind: "widget",
-		widgetId: "host/extensions-panel",
-		tab: "general",
-		label: "Extensions",
-		order: 72
-	} },
-	methods: {
-		/** One row per slot owner — the D554 source listing `slotRef` routes by. */
-		listSources: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int() }), zod.z.array(ExtensionSourceSchema)),
-		/**
-		* Every slot this device is offered, read by each owner from its own
-		* store. A provider that throws is ONE `unreachable` row (D554.4).
-		*/
-		listSlots: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int() }), zod.z.array(ExtensionSlotRowSchema)),
-		/** The devices the slot's editor may offer, suggestions pre-marked (D356). */
-		listCandidates: require_sleep.method(ExtensionSlotRefInputSchema, ExtensionCandidatesSchema),
-		/**
-		* Write one slot through its owner's EXISTING write path. The owner
-		* validates (a container is never a linked device, a camera is never its
-		* own source) and refuses by name before persisting.
-		*/
-		setSlot: require_sleep.method(ExtensionSetSlotInputSchema, ExtensionSetResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		})
-	}
-};
-//#endregion
 //#region src/capabilities/webrtc-session.cap.ts
 /**
 * Optional client-side hints sent at session creation to help the provider
@@ -51698,6 +51821,7 @@ var CAPABILITY_NAMES = {
 	cover: "cover",
 	customModelRegistry: "custom-model-registry",
 	dataStoreProvider: "data-store-provider",
+	databaseSnapshot: "database-snapshot",
 	dayNight: "day-night",
 	decoder: "decoder",
 	detectionPipeline: "detection-pipeline",
@@ -51989,6 +52113,10 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "dataStoreProvider",
 		name: "data-store-provider"
 	},
+	{
+		key: "databaseSnapshot",
+		name: "database-snapshot"
+	},
 	{
 		key: "dayNight",
 		name: "day-night"
@@ -52522,6 +52650,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	coverCapability,
 	customModelRegistryCapability,
 	dataStoreProviderCapability,
+	databaseSnapshotCapability,
 	dayNightCapability,
 	decoderCapability,
 	detectionPipelineCapability,
@@ -53786,6 +53915,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"databaseSnapshot.listDatabases": {
+		capName: "database-snapshot",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"databaseSnapshot.writeSnapshot": {
+		capName: "database-snapshot",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"dataStoreProvider.aggregate": {
 		capName: "data-store-provider",
 		capScope: "system",
@@ -59867,6 +60008,7 @@ var KNOWN_CAP_NAMES = [
 	"cover",
 	"custom-model-registry",
 	"data-store-provider",
+	"database-snapshot",
 	"day-night",
 	"decoder",
 	"detection-pipeline",
@@ -60100,6 +60242,7 @@ var SYSTEM_CAP_NAMES = [
 	"core-blocks",
 	"custom-model-registry",
 	"data-store-provider",
+	"database-snapshot",
 	"decoder",
 	"device-adoption",
 	"device-export",
@@ -64771,6 +64914,74 @@ function isSystemDelivery(delivery) {
 	return delivery === NC_SYSTEM_DELIVERY;
 }
 /**
+* Which capability a device must carry to be OFFERED on a rule of this kind's
+* device-scope picker (operator ruling, 2026-10-01). `null` means "no
+* capability filter for this kind" — either every device applies (the system
+* families, each already a separate concern; see
+* `docs/architecture/notifications.md`'s D637 `deviceIds` table) or `mixed`,
+* which authors nothing.
+*
+* DERIVED, never a hand-picked list:
+*  - `sensor` reads `EVENTFUL_CAP_NAMES` — the SAME cap table the engine
+*    itself turns a linked device's bound caps into sensor event kinds with
+*    (`EVENT_KIND_BY_CAP`). A device this picker offers for a sensor rule is
+*    exactly a device the rule's `sensorKinds` condition could ever name.
+*  - `detection` (which a package-event rule is — there is no separate
+*    `package` kind, D637) / `occupancy` read the one pipeline cap a camera
+*    needs to produce the detections / counts / parcels those kinds match on.
+*  - `sound` reads the one cap a device needs to produce the audio metrics a
+*    sound rule's sampling window is built from.
+*  - `device-events` / `system` / `alarm` / `mixed` are `null`: a device
+*    event rule's `deviceIds` legitimately spans every device type (liveness,
+*    battery, consumable, `detection-blind`), a system rule has no device
+*    scope at all (dropped from the editor's tabs), and `alarm`'s `deviceIds`
+*    is a reference to whichever camera's rule set it off — not a scope this
+*    picker authors.
+*
+* Callers resolve the ids via `deviceManager.listDeviceIdsByCaps` (max 16
+* names — `EVENTFUL_CAP_NAMES` is exactly 16) and must treat an unanswered
+* read as "unknown", never as "no devices" (D315): this function only names
+* WHICH caps to ask for, not what to show while the answer is pending.
+*/
+function ruleDeviceCompatCapNames(kind) {
+	switch (kind) {
+		case "sensor": return EVENTFUL_CAP_NAMES;
+		case "detection":
+		case "occupancy": return ["detection-pipeline"];
+		case "sound": return ["audio-metrics"];
+		case "device-events":
+		case "system":
+		case "alarm":
+		case "mixed": return null;
+	}
+}
+/**
+* The capability every CAMERA carries: `camera-streams` is a `defaultActive`
+* wrapper bound to every `Camera`-type device (`camera-streams.cap.ts`).
+* Named once, because a sensor rule's compatible set needs it (below).
+*/
+var NC_CAMERA_SCOPE_CAP_NAME = "camera-streams";
+/**
+* Every capability QUERY whose union is the set of devices a rule of this kind
+* may be SCOPED to (`conditions.devices`) — what the save-time guard and the
+* admin's Devices tab ask `deviceManager.listDeviceIdsByCaps`, one call per
+* entry. `null` exactly where {@link ruleDeviceCompatCapNames} is `null`.
+*
+* Several queries rather than one list because `listDeviceIdsByCaps` takes at
+* most 16 names and `EVENTFUL_CAP_NAMES` is already exactly 16.
+*
+* A `sensor` rule's set is the eventful devices PLUS every camera (fix round
+* 1, 2026-10-01): the engine matches a sensor rule scoped to a CAMERA — a
+* per-camera row carries the camera's id, and a linked set matches on
+* `rowCameraIds` (D630 §6) — so a camera-scoped sensor rule is legitimate and
+* a guard that refused it would make every such stored rule un-editable.
+*/
+function ruleDeviceCompatCapQueries(kind) {
+	const primary = ruleDeviceCompatCapNames(kind);
+	if (primary === null) return null;
+	return kind === "sensor" ? [primary, [NC_CAMERA_SCOPE_CAP_NAME]] : [primary];
+}
+/**
 * Which kind of rule is this?
 *
 * The CONDITION wins over the delivery wherever the engine says it does, and
@@ -64844,12 +65055,20 @@ var NC_RULE_SECTIONS = [
 	},
 	{
 		key: "detection",
-		label: "Detections & devices",
-		blurb: "Rules driven by what the cameras and sensors SEE — detections, tracks, doorbell presses and package events.",
+		label: "Detections",
+		blurb: "Rules driven by what the cameras SEE — detections, tracks and package events.",
 		newRuleLabel: "New detection rule",
 		emptyHint: "No detection rules yet. Create one to be told what your cameras see.",
 		creatable: true
 	},
+	{
+		key: "sensor",
+		label: "Sensors",
+		blurb: "Rules driven by a device or sensor CHANGING STATE — a doorbell press, a linked sensor opening or closing. The picture comes from the camera the sensor is attributed to.",
+		newRuleLabel: "New sensor rule",
+		emptyHint: "No sensor rules yet. Create one to be told when a doorbell is pressed or a linked sensor changes.",
+		creatable: true
+	},
 	{
 		key: "audio",
 		label: "Sound",
@@ -64921,22 +65140,28 @@ function isOccupancyRule(subject) {
 * `all` always matches — a section that hides a rule is how an operator
 * concludes it was deleted. The others PARTITION the list: sound and
 * occupancy are claimed by their condition, a system-event rule by its trigger
-* and then by the family of its event kinds (or `mixed`, D637), and
-* everything left over — including a trigger this build has never heard of —
-* counts as a detection rule so it stays visible somewhere.
-*
-* Keyed on the CONDITION for two of them, because the trigger alone cannot
-* answer: a sound rule is `immediate` and an occupancy rule is `device-event`,
-* and in each case the condition is the discriminator the engine itself uses.
-* A section keyed on delivery would put both back in the pile they are
-* invisible in.
+* and then by the family of its event kinds (or `mixed`, D637), `sensor`
+* claims the `device-event` trigger that occupancy did not (operator ruling,
+* 2026-10-01 — a doorbell press used to fall into `detection` for want of its
+* own section, which is the "everything mixed together" the viewer's
+* `ruleKindOf`-based list had already fixed and the admin's section strip had
+* not), and everything left over — including a trigger this build has never
+* heard of — counts as a detection rule so it stays visible somewhere.
+*
+* Keyed on the CONDITION for sound and occupancy, because the trigger alone
+* cannot answer: a sound rule is `immediate` and an occupancy rule is
+* `device-event`, and in each case the condition is the discriminator the
+* engine itself uses. `sensor` IS keyed on the trigger, same as `ruleKindOf`'s
+* `'sensor'` kind — a device-event subject with no occupancy condition is a
+* sensor rule, full stop.
 */
 function ruleMatchesSection(subject, section) {
 	if (section === "all") return true;
 	if (isSystemDelivery(subject.delivery)) return ruleKindOf(subject) === section;
 	if (section === "audio") return isAudioRule(subject);
 	if (section === "occupancy") return isOccupancyRule(subject);
-	if (section === "detection") return !isAudioRule(subject) && !isOccupancyRule(subject);
+	if (section === "sensor") return subject.delivery === "device-event" && !isOccupancyRule(subject);
+	if (section === "detection") return !isAudioRule(subject) && !isOccupancyRule(subject) && subject.delivery !== "device-event";
 	return false;
 }
 /**
@@ -64950,6 +65175,7 @@ function ruleSectionOf(subject) {
 	if (isSystemDelivery(subject.delivery)) return systemRuleKindOf(subject.conditions.systemEvent);
 	if (isAudioRule(subject)) return "audio";
 	if (isOccupancyRule(subject)) return "occupancy";
+	if (subject.delivery === "device-event") return "sensor";
 	return "detection";
 }
 /**
@@ -65007,6 +65233,10 @@ function ruleSeedForSection(section) {
 			delivery: "device-event",
 			conditions: { occupancy: NC_OCCUPANCY_DEFAULTS }
 		};
+		case "sensor": return {
+			delivery: "device-event",
+			conditions: {}
+		};
 		default: return {
 			delivery: "immediate",
 			conditions: { source: "pipeline" }
@@ -69047,6 +69277,7 @@ exports.AppleFmAvailabilitySchema = AppleFmAvailabilitySchema;
 exports.AppleFmUnavailableReasonSchema = AppleFmUnavailableReasonSchema;
 exports.ArchiveEntrySchema = ArchiveEntrySchema;
 exports.ArchiveManifestSchema = ArchiveManifestSchema;
+exports.ArchiveSqliteSnapshotSchema = ArchiveSqliteSnapshotSchema;
 exports.ArchivedDebugNoteQueryInputSchema = ArchivedDebugNoteQueryInputSchema;
 exports.ArchivedDebugNoteSchema = ArchivedDebugNoteSchema;
 exports.AttachmentMediaTypeSchema = AttachmentMediaTypeSchema;
@@ -69327,6 +69558,9 @@ exports.CreateScopedTokenResultSchema = CreateScopedTokenResultSchema;
 exports.CreateUserInputSchema = CreateUserInputSchema;
 exports.CustomActionInputSchema = CustomActionInputSchema;
 exports.CustomModelDescriptorSchema = CustomModelDescriptorSchema;
+exports.DATABASE_SNAPSHOT_PARTIAL_SUFFIX = DATABASE_SNAPSHOT_PARTIAL_SUFFIX;
+exports.DATABASE_SNAPSHOT_SUFFIX = DATABASE_SNAPSHOT_SUFFIX;
+exports.DATABASE_SNAPSHOT_TIMEOUT_MS = DATABASE_SNAPSHOT_TIMEOUT_MS;
 exports.DATAPLANE_SECRET_HEADER = require_sleep.DATAPLANE_SECRET_HEADER;
 exports.DAYS_PER_WEEK = DAYS_PER_WEEK;
 exports.DAY_NAMES = DAY_NAMES;
@@ -69377,6 +69611,9 @@ exports.DISPLAY_ICON_VOCABULARY = DISPLAY_ICON_VOCABULARY;
 exports.DOORBELL_RISE_DEBOUNCE_MS = DOORBELL_RISE_DEBOUNCE_MS;
 exports.DOORBELL_SOURCE_SLOT = DOORBELL_SOURCE_SLOT;
 exports.DataStoreEngineInfoSchema = EngineInfoSchema;
+exports.DatabaseSnapshotResultSchema = DatabaseSnapshotResultSchema;
+exports.DatabaseSnapshotTableSchema = DatabaseSnapshotTableSchema;
+exports.DatabaseSnapshotTargetsSchema = DatabaseSnapshotTargetsSchema;
 exports.DayNightModeSchema = DayNightModeSchema;
 exports.DayNightOptionsSchema = DayNightOptionsSchema;
 exports.DayNightSettingsPatchSchema = DayNightSettingsPatchSchema;
@@ -69779,6 +70016,7 @@ exports.NC_AUDIO_SEED = NC_AUDIO_SEED;
 exports.NC_AUTHORABLE_SYSTEM_EVENT_KINDS = NC_AUTHORABLE_SYSTEM_EVENT_KINDS;
 exports.NC_BASE_CONDITION_KEYS = NC_BASE_CONDITION_KEYS;
 exports.NC_BATTERY_CONSUMABLE_SYSTEM_EVENT_KINDS = NC_BATTERY_CONSUMABLE_SYSTEM_EVENT_KINDS;
+exports.NC_CAMERA_SCOPE_CAP_NAME = NC_CAMERA_SCOPE_CAP_NAME;
 exports.NC_CLIP_POST_ROLL_DEFAULT_SEC = NC_CLIP_POST_ROLL_DEFAULT_SEC;
 exports.NC_CLIP_PRE_ROLL_DEFAULT_SEC = NC_CLIP_PRE_ROLL_DEFAULT_SEC;
 exports.NC_CLIP_RETENTION_MAX_SEC = NC_CLIP_RETENTION_MAX_SEC;
@@ -70537,6 +70775,7 @@ exports.createSystemProxy = createSystemProxy;
 exports.customAction = require_sleep.customAction;
 exports.customModelRegistryCapability = customModelRegistryCapability;
 exports.dataStoreProviderCapability = dataStoreProviderCapability;
+exports.databaseSnapshotCapability = databaseSnapshotCapability;
 exports.dayNightCapability = dayNightCapability;
 exports.dayOfWeekToIndex = dayOfWeekToIndex;
 exports.declarationOwnerNodeId = declarationOwnerNodeId;
@@ -70890,6 +71129,8 @@ exports.resolveViewableDeviceIds = resolveViewableDeviceIds;
 exports.roleSpec = roleSpec;
 exports.roomCompositionExample = roomCompositionExample;
 exports.ruleBelongsToAlarm = ruleBelongsToAlarm;
+exports.ruleDeviceCompatCapNames = ruleDeviceCompatCapNames;
+exports.ruleDeviceCompatCapQueries = ruleDeviceCompatCapQueries;
 exports.ruleEditorSectionsForKind = ruleEditorSectionsForKind;
 exports.ruleKindOf = ruleKindOf;
 exports.ruleKindSpec = ruleKindSpec;