@camstack/types 1.2.7 → 1.2.9

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-eVjOy4ev.js");
-const require_event_category = require("./event-category-CGj9fI4L.js");
+const require_sleep = require("./sleep-BG8hQTA8.js");
+const require_event_category = require("./event-category-Cdyife4p.js");
 const require_enums = require("./enums.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
 let zod = require("zod");
@@ -2945,6 +2945,63 @@ function subKindsOf(macro) {
 	return out;
 }
 //#endregion
+//#region src/catalogs/nc-taxonomy.ts
+/**
+* Notification-Center taxonomy — the fixed vocabulary the NC rule editor
+* offers as pickers instead of free text. Derived (never hand-listed) from the
+* single `EVENT_TAXONOMY` dictionary so it stays in lockstep with every other
+* taxonomy surface (timeline, filters, event page).
+*
+* Three buckets, mapped onto the rule editor's `stringList` conditions:
+*   - `videoClasses` → detection classes (person / vehicle / animal + subs)
+*     for the `classes` / `classesExclude` conditions.
+*   - `audioKinds`   → audio-analyzer sub kinds (`audio-scream`, …) shown in
+*     the same class picker, grouped under an Audio header.
+*   - `labels`       → sensor + control taxonomy kinds (doorbell / contact /
+*     lock / …) for the `sensorKinds` device-event condition.
+*
+* Each entry carries `parentKind` so the client can group video subs under
+* their macro and sensor/control kinds under their category. This surface is
+* served ADDITIVELY on the `nc.getConditionCatalog` bridge response — no cap
+* method, no codegen — so it ships train-free with an addon deploy.
+*/
+/** One selectable taxonomy value: a stable kind id + display label + parent. */
+var NcTaxonomyEntrySchema = zod.z.object({
+	/** Stable kind id (e.g. 'person', 'car', 'audio-scream', 'doorbell'). */
+	kind: zod.z.string(),
+	/** English fallback label (the UI translates via the event-kind i18n key). */
+	label: zod.z.string(),
+	/** Macro/category parent for grouping ('car' → 'vehicle'); null for a top. */
+	parentKind: zod.z.string().nullable()
+});
+/** The complete NC picker taxonomy — three grouped buckets. */
+var NcTaxonomySchema = zod.z.object({
+	videoClasses: zod.z.array(NcTaxonomyEntrySchema),
+	audioKinds: zod.z.array(NcTaxonomyEntrySchema),
+	labels: zod.z.array(NcTaxonomyEntrySchema)
+});
+function toEntry(kind, label, parentKind) {
+	return {
+		kind,
+		label,
+		parentKind
+	};
+}
+/**
+* Build the NC taxonomy from `EVENT_TAXONOMY`. Insertion order is preserved
+* (macros before their subs), which the client relies on for stable grouping.
+*/
+function buildNcTaxonomy() {
+	const all = Object.values(EVENT_TAXONOMY);
+	return {
+		videoClasses: all.filter((e) => e.category === "detection").map((e) => toEntry(e.kind, e.label, e.parentKind)),
+		audioKinds: all.filter((e) => e.category === "audio" && e.level === "sub").map((e) => toEntry(e.kind, e.label, e.parentKind)),
+		labels: all.filter((e) => e.category === "sensor" || e.category === "control").map((e) => toEntry(e.kind, e.label, e.parentKind))
+	};
+}
+/** The frozen NC taxonomy, derived once from the taxonomy dictionary. */
+var NC_TAXONOMY = Object.freeze(buildNcTaxonomy());
+//#endregion
 //#region src/types/device-type.ts
 var DEVICE_TYPE_INFO = { ["camera"]: {
 	type: "camera",
@@ -13575,6 +13632,17 @@ function createSystemProxy(api) {
 			deleteTarget: (input) => dispatch("notificationOutput", "deleteTarget", "mutation", input),
 			setTargetEnabled: (input) => dispatch("notificationOutput", "setTargetEnabled", "mutation", input)
 		},
+		notificationRules: {
+			listRules: (input) => dispatch("notificationRules", "listRules", "query", input),
+			getRule: (input) => dispatch("notificationRules", "getRule", "query", input),
+			createRule: (input) => dispatch("notificationRules", "createRule", "mutation", input),
+			updateRule: (input) => dispatch("notificationRules", "updateRule", "mutation", input),
+			deleteRule: (input) => dispatch("notificationRules", "deleteRule", "mutation", input),
+			setRuleEnabled: (input) => dispatch("notificationRules", "setRuleEnabled", "mutation", input),
+			testRule: (input) => dispatch("notificationRules", "testRule", "mutation", input),
+			getConditionCatalog: (input) => dispatch("notificationRules", "getConditionCatalog", "query", input),
+			getHistory: (input) => dispatch("notificationRules", "getHistory", "query", input)
+		},
 		pipelineExecutor: {
 			getAvailableEngines: (input) => dispatch("pipelineExecutor", "getAvailableEngines", "query", input),
 			getSelectedEngine: (input) => dispatch("pipelineExecutor", "getSelectedEngine", "query", input),
@@ -14843,108 +14911,6 @@ var addonWidgetsCapability = {
 	methods: { listWidgets: require_sleep.method(zod.z.void(), zod.z.array(EnrichedWidgetMetadataSchema).readonly()) }
 };
 //#endregion
-//#region src/capabilities/advanced-notifier.cap.ts
-var NotificationRuleConditionsSchema = zod.z.object({
-	deviceIds: zod.z.array(zod.z.number()).readonly().optional(),
-	classNames: zod.z.array(zod.z.string()).readonly().optional(),
-	zoneIds: zod.z.array(zod.z.string()).readonly().optional(),
-	minConfidence: zod.z.number().optional(),
-	source: zod.z.enum([
-		"pipeline",
-		"onboard",
-		"any"
-	]).optional(),
-	schedule: zod.z.object({
-		days: zod.z.array(zod.z.number()).readonly(),
-		startHour: zod.z.number(),
-		endHour: zod.z.number()
-	}).optional(),
-	cooldownSeconds: zod.z.number().optional(),
-	minDwellSeconds: zod.z.number().optional(),
-	/** Match against `event.data.eventType` token (e.g. `'press_long'`). When non-empty, only events
-	*  carrying a matching `data.eventType` string pass this condition. Rules without this field are
-	*  unaffected (back-compat). Distinct from `rule.eventTypes` which holds EventCategory strings. */
-	eventTypeTokens: zod.z.array(zod.z.string()).readonly().optional(),
-	/** Match detections whose CLIP image embedding is semantically similar to this free-text
-	*  description. Requires the embedding-encoder cap to have pre-warmed the text vector.
-	*  `minSimilarity` is the cosine similarity threshold in [0, 1]. */
-	clipDescription: zod.z.object({
-		text: zod.z.string().min(1),
-		minSimilarity: zod.z.number().min(0).max(1)
-	}).optional(),
-	/** Match events whose recognized-entity label (face identity name or plate
-	*  vehicle name, propagated onto `event.data.label`) is one of these values.
-	*  Empty/absent → unaffected (back-compat). Enables "notify me when <named
-	*  vehicle/person> is seen". */
-	labels: zod.z.array(zod.z.string()).readonly().optional()
-});
-var NotificationRuleTemplateSchema = zod.z.object({
-	title: zod.z.string(),
-	body: zod.z.string(),
-	imageMode: zod.z.enum([
-		"crop",
-		"annotated",
-		"full",
-		"none"
-	])
-});
-var NotificationRuleSchema = zod.z.object({
-	id: zod.z.string(),
-	name: zod.z.string(),
-	enabled: zod.z.boolean(),
-	eventTypes: zod.z.array(zod.z.string()).readonly(),
-	conditions: NotificationRuleConditionsSchema,
-	outputs: zod.z.array(zod.z.string()).readonly(),
-	template: NotificationRuleTemplateSchema.optional(),
-	priority: zod.z.enum([
-		"low",
-		"normal",
-		"high",
-		"critical"
-	])
-});
-var NotificationTestResultSchema = zod.z.object({
-	ruleId: zod.z.string(),
-	eventId: zod.z.string(),
-	timestamp: zod.z.number(),
-	wouldFire: zod.z.boolean(),
-	reason: zod.z.string().optional()
-});
-var NotificationHistoryEntrySchema = zod.z.object({
-	id: zod.z.string(),
-	ruleId: zod.z.string(),
-	ruleName: zod.z.string(),
-	eventId: zod.z.string(),
-	timestamp: zod.z.number(),
-	outputs: zod.z.array(zod.z.string()).readonly(),
-	success: zod.z.boolean(),
-	error: zod.z.string().optional(),
-	deviceId: zod.z.number().optional()
-});
-var NotificationHistoryFilterSchema = zod.z.object({
-	ruleId: zod.z.string().optional(),
-	deviceId: zod.z.number().optional(),
-	from: zod.z.number().optional(),
-	to: zod.z.number().optional(),
-	limit: zod.z.number().optional()
-});
-var advancedNotifierCapability = {
-	name: "advanced-notifier",
-	scope: "system",
-	mode: "singleton",
-	internal: true,
-	methods: {
-		getRules: require_sleep.method(zod.z.void(), zod.z.object({ rules: zod.z.array(NotificationRuleSchema).readonly() })),
-		upsertRule: require_sleep.method(zod.z.object({ rule: NotificationRuleSchema }), zod.z.object({ success: zod.z.literal(true) }), { kind: "mutation" }),
-		deleteRule: require_sleep.method(zod.z.object({ ruleId: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), { kind: "mutation" }),
-		testRule: require_sleep.method(zod.z.object({
-			ruleId: zod.z.string(),
-			lookbackMinutes: zod.z.number()
-		}), zod.z.object({ results: zod.z.array(NotificationTestResultSchema).readonly() }), { kind: "mutation" }),
-		getHistory: require_sleep.method(zod.z.object({ filter: NotificationHistoryFilterSchema.optional() }), zod.z.object({ entries: zod.z.array(NotificationHistoryEntrySchema).readonly() }))
-	}
-};
-//#endregion
 //#region src/capabilities/alerts.cap.ts
 /**
 * Alerts capability — collection-based internal alert system.
@@ -15287,119 +15253,6 @@ var authProviderCapability = {
 	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
 	mount: { kind: "skip" }
 };
-//#endregion
-//#region src/capabilities/login-method.cap.ts
-/**
-* `login-method` — collection cap through which auth addons contribute
-* their pre-auth login surfaces to the login page. This is the SINGLE,
-* generic mechanism that supersedes the dead `auth.listProviders` reader:
-* every auth addon (OIDC, magic-link, WebAuthn/passkey) registers a
-* `login-method` provider and the PUBLIC `auth.listLoginMethods`
-* procedure aggregates them for the unauthenticated login page.
-*
-* A contribution is a discriminated union on `kind`:
-*
-*  - `redirect` — a declarative button. The login page renders a generic
-*    button that navigates to `startUrl` (an addon-owned HTTP route).
-*    Covers OIDC (`/addon/auth-oidc/<id>/start`) and magic-link with
-*    ZERO shell-side JS. A future SSO addon plugs in the same way — the
-*    login page needs NO change.
-*
-*  - `widget` — a Module-Federation widget the login page mounts (via
-*    `loadRemoteBundle`) for an in-page ceremony. `auth.listLoginMethods`
-*    stamps a public `bundleUrl` from `addonId` + `bundle`. Generic
-*    mechanism kept for future use; no shipped addon uses it on the login
-*    page (the passkey ceremony below runs natively in the shell instead).
-*
-*  - `passkey` — a declarative WebAuthn ceremony the shell renders
-*    natively (`@simplewebauthn/browser` lives in `addon-admin-ui`, not in
-*    a remotely-loaded bundle). Carries the addon's effective `rpId` /
-*    `origin` (from its `resolveRpID()` / `resolveOrigin()`) so the shell
-*    can gate visibility (IP-literal origin, hostname/rpId mismatch) WITHOUT
-*    fetching any remote code pre-auth. Contribution stays unconditional —
-*    enrollment state is never leaked pre-auth; visibility is a shell
-*    decision.
-*
-* Every contribution carries a `stage`:
-*  - `primary`        — shown on the first credentials screen (OIDC /
-*                       magic-link buttons; a future usernameless passkey).
-*  - `second-factor`  — shown AFTER the password leg, gated on the
-*                       returned `factors` (passkey-as-2FA today).
-*
-* `mount: skip` — the cap is read server-side by the core auth router
-* (`registry.getCollection('login-method')`), never mounted as its own
-* tRPC router.
-*/
-/** When a login method renders in the two-phase login flow. */
-var LoginStageEnum = zod.z.enum(["primary", "second-factor"]);
-/**
-* A declarative redirect button — the login page navigates to `startUrl`.
-* OIDC and magic-link contribute this; a future SSO addon does too.
-*/
-var RedirectLoginMethodSchema = zod.z.object({
-	kind: zod.z.literal("redirect"),
-	/** Stable id within the login-method set (e.g. `auth-oidc/google`). */
-	id: zod.z.string(),
-	/** Operator-facing button label. */
-	label: zod.z.string(),
-	/** lucide-react icon name. */
-	icon: zod.z.string().optional(),
-	/** Addon-owned HTTP route the button navigates to (GET). */
-	startUrl: zod.z.string(),
-	stage: LoginStageEnum
-});
-/**
-* A Module-Federation widget the login page mounts for an in-page
-* ceremony. `bundle` + `addonId` let `auth.listLoginMethods` stamp a
-* public `bundleUrl`; `remote` is the MF descriptor `loadRemoteBundle`
-* consumes. No `bundleUrl` here — it is server-stamped on the public
-* output so the addon never encodes the static-route scheme.
-*/
-var WidgetLoginMethodSchema = zod.z.object({
-	kind: zod.z.literal("widget"),
-	/** Stable id within the login-method set (e.g. `auth-webauthn/passkey-login`). */
-	id: zod.z.string(),
-	/** Owning addon id — drives the public bundle URL + the MF namespace. */
-	addonId: zod.z.string(),
-	/** Bundle filename inside the addon's dist dir (`remoteEntry.js`). */
-	bundle: zod.z.string(),
-	/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
-	remote: WidgetRemoteSchema,
-	stage: LoginStageEnum
-});
-/**
-* A declarative WebAuthn ceremony the shell renders natively (no remote
-* code). Carries the addon's EFFECTIVE `rpId`/`origin` so the shell can
-* gate visibility (IP-literal origin, hostname/rpId mismatch) before ever
-* showing the button — the contribution itself stays unconditional.
-*/
-var PasskeyLoginMethodSchema = zod.z.object({
-	kind: zod.z.literal("passkey"),
-	/** Stable id within the login-method set (e.g. `auth-webauthn/passkey-direct-login`). */
-	id: zod.z.string(),
-	/** Operator-facing button label. */
-	label: zod.z.string(),
-	stage: LoginStageEnum,
-	/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
-	rpId: zod.z.string(),
-	/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
-	origin: zod.z.string().nullable()
-});
-/** One login-method contribution — redirect button, pre-auth widget, or native passkey ceremony. */
-var LoginMethodContributionSchema = zod.z.discriminatedUnion("kind", [
-	RedirectLoginMethodSchema,
-	WidgetLoginMethodSchema,
-	PasskeyLoginMethodSchema
-]);
-var loginMethodCapability = {
-	name: "login-method",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: { getLoginMethods: require_sleep.method(zod.z.void(), zod.z.array(LoginMethodContributionSchema).readonly()) },
-	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
-	mount: { kind: "skip" }
-};
 /**
 * Orchestrator-side destination metadata. The orchestrator computes
 * `id = <addonId>:<subId>` from its provider lookup so consumers
@@ -16055,7 +15908,8 @@ function customAction(input, output, options) {
 		output,
 		kind: options?.kind ?? "query",
 		auth: options?.auth ?? "protected",
-		scope: options?.scope ?? { kind: "system" }
+		scope: options?.scope ?? { kind: "system" },
+		...options?.caller ? { caller: "required" } : {}
 	};
 }
 function deviceCustomAction(input, output, options) {
@@ -17660,1061 +17514,1946 @@ var filesystemBrowseCapability = {
 	}
 };
 //#endregion
-//#region src/capabilities/log-destination.cap.ts
-var LogLevelSchema = zod.z.enum([
-	"debug",
-	"info",
-	"warn",
-	"error"
+//#region src/capabilities/llm-shared.ts
+/**
+* Shared LLM generate contracts — imported by BOTH `llm.cap.ts` (consumer
+* surface) and `llm-runtime.cap.ts` (node-side managed executor) so the two
+* caps stay wire-compatible without a circular cap→cap import.
+*
+* Errors are a discriminated-union RESULT, never thrown: the shape survives
+* every transport tier structurally, and failed calls still write usage rows.
+* Token counts only in v1 — no costUsd (operator decision, 2026-07-15).
+*/
+var LlmUsageSchema = zod.z.object({
+	inputTokens: zod.z.number(),
+	outputTokens: zod.z.number()
+});
+var LlmErrorCodeSchema = zod.z.enum([
+	"timeout",
+	"rate-limited",
+	"auth",
+	"refusal",
+	"bad-request",
+	"unavailable",
+	"no-profile",
+	"budget-exceeded",
+	"adapter-error"
 ]);
-var LogEntrySchema = zod.z.object({
-	timestamp: zod.z.date(),
-	level: LogLevelSchema,
-	scope: zod.z.array(zod.z.string()),
-	message: zod.z.string(),
-	meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-	tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
+var LlmGenerateOkSchema = zod.z.object({
+	ok: zod.z.literal(true),
+	text: zod.z.string(),
+	model: zod.z.string(),
+	usage: LlmUsageSchema,
+	truncated: zod.z.boolean(),
+	latencyMs: zod.z.number()
 });
-var logDestinationCapability = {
-	name: "log-destination",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: {
-		write: require_sleep.method(LogEntrySchema, zod.z.void(), { kind: "mutation" }),
-		query: require_sleep.method(zod.z.object({
-			scope: zod.z.array(zod.z.string()).optional(),
-			level: LogLevelSchema.optional(),
-			since: zod.z.date().optional(),
-			until: zod.z.date().optional(),
-			limit: zod.z.number().optional(),
-			tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
-		}), zod.z.array(LogEntrySchema).readonly())
-	},
-	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
-	mount: { kind: "skip" }
-};
-//#endregion
-//#region src/capabilities/metrics-provider.cap.ts
-var CpuBreakdownSchema = zod.z.object({
-	total: zod.z.number(),
-	user: zod.z.number(),
-	system: zod.z.number(),
-	irq: zod.z.number(),
-	nice: zod.z.number(),
-	loadAvg: zod.z.tuple([
-		zod.z.number(),
-		zod.z.number(),
-		zod.z.number()
-	]),
-	cores: zod.z.number()
+var LlmGenerateErrSchema = zod.z.object({
+	ok: zod.z.literal(false),
+	code: LlmErrorCodeSchema,
+	message: zod.z.string(),
+	retryAfterMs: zod.z.number().optional()
 });
-var MemoryInfoSchema = zod.z.object({
-	percent: zod.z.number(),
-	totalBytes: zod.z.number(),
-	usedBytes: zod.z.number(),
-	availableBytes: zod.z.number(),
-	swapUsedBytes: zod.z.number(),
-	swapTotalBytes: zod.z.number()
-});
-var DiskIoSnapshotSchema = zod.z.object({
-	readBytes: zod.z.number(),
-	writeBytes: zod.z.number(),
-	readOps: zod.z.number(),
-	writeOps: zod.z.number(),
-	timestampMs: zod.z.number()
-});
-var NetworkIoSnapshotSchema = zod.z.object({
-	rxBytes: zod.z.number(),
-	txBytes: zod.z.number(),
-	rxPackets: zod.z.number(),
-	txPackets: zod.z.number(),
-	rxErrors: zod.z.number(),
-	txErrors: zod.z.number(),
-	timestampMs: zod.z.number()
-});
-var MetricsGpuInfoSchema = zod.z.object({
-	utilization: zod.z.number(),
-	model: zod.z.string(),
-	memoryUsedBytes: zod.z.number(),
-	memoryTotalBytes: zod.z.number(),
-	temperature: zod.z.number().nullable()
-});
-var ProcessResourceInfoSchema = zod.z.object({
-	openFds: zod.z.number(),
-	threadCount: zod.z.number(),
-	activeHandles: zod.z.number(),
-	activeRequests: zod.z.number()
-});
-var PressureAvgsSchema = zod.z.object({
-	avg10: zod.z.number(),
-	avg60: zod.z.number(),
-	avg300: zod.z.number()
+var LlmGenerateResultSchema = zod.z.discriminatedUnion("ok", [LlmGenerateOkSchema, LlmGenerateErrSchema]);
+/**
+* `Uint8Array` is the sanctioned binary convention — superjson + the UDS
+* MsgPack channel round-trip typed arrays (embedding-encoder.cap.ts:29,
+* notification-output.cap.ts:27-31 precedents).
+*/
+var LlmImageSchema = zod.z.object({
+	bytes: zod.z.instanceof(Uint8Array),
+	mimeType: zod.z.string()
 });
-var PressureInfoSchema = zod.z.object({
-	some: PressureAvgsSchema,
-	full: PressureAvgsSchema.nullable()
+var LlmGenerateBaseInputSchema = zod.z.object({
+	/** Collection routing (the notification-output posture). */
+	addonId: zod.z.string().optional(),
+	/** Explicit profile; else the resolution chain (spec §3). */
+	profileId: zod.z.string().optional(),
+	/** MANDATORY usage tag: 'ai-summary', 'notifier-rules', 'adhoc-ui', … */
+	consumer: zod.z.string(),
+	system: zod.z.string().optional(),
+	/** v1: single-turn. `messages[]` is a v2 additive field. */
+	prompt: zod.z.string(),
+	/** Structured output — adapter-mapped (response_format / forced tool / responseSchema). */
+	jsonSchema: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+	/** Per-call override of the profile default. */
+	maxTokens: zod.z.number().int().positive().optional(),
+	temperature: zod.z.number().optional()
 });
-var SystemResourceSnapshotSchema = zod.z.object({
-	cpu: CpuBreakdownSchema,
-	memory: MemoryInfoSchema,
-	gpu: MetricsGpuInfoSchema.nullable(),
-	network: NetworkIoSnapshotSchema,
-	disk: DiskIoSnapshotSchema,
-	pressure: zod.z.object({
-		cpu: PressureInfoSchema.nullable(),
-		memory: PressureInfoSchema.nullable(),
-		io: PressureInfoSchema.nullable()
+//#endregion
+//#region src/capabilities/llm-runtime.cap.ts
+/**
+* `llm-runtime` — node-side managed llama.cpp executor (spec §4). Registered
+* on EVERY node where `addon-ai` is installed; the hub `llm` provider reaches
+* a specific node's runtime with `nodePin(profile.runtime.nodeId)` — normal
+* cap routing, zero bespoke plumbing. `internal: true`: the operator reaches
+* this only through the `llm` cap's methods.
+*
+* One running llama-server child per node in v1 (models are RAM-heavy).
+* Resource ceiling = llama-server flags + idleStopMinutes ONLY (no RSS
+* watchdog — operator decision #3).
+*/
+var ManagedModelRefSchema = zod.z.discriminatedUnion("kind", [
+	zod.z.object({
+		kind: zod.z.literal("catalog"),
+		catalogId: zod.z.string()
 	}),
-	process: ProcessResourceInfoSchema,
-	cpuTemperature: zod.z.number().nullable(),
-	timestampMs: zod.z.number()
-});
-var DiskSpaceInfoSchema = zod.z.object({
-	path: zod.z.string(),
-	totalBytes: zod.z.number(),
-	usedBytes: zod.z.number(),
-	availableBytes: zod.z.number(),
-	percent: zod.z.number()
-});
-var PidResourceStatsSchema = zod.z.object({
-	pid: zod.z.number(),
-	cpu: zod.z.number(),
-	memory: zod.z.number(),
-	/**
-	* Private (anonymous) resident bytes — the per-process V8 heap + native
-	* allocations NOT shared with other processes (Linux RssAnon). This is the
-	* "real" per-runner cost; summing it across runners is meaningful, unlike
-	* `memory` (RSS), which double-counts the shared mmap'd framework code.
-	* Undefined where /proc is unavailable (e.g. macOS).
-	*/
-	privateBytes: zod.z.number().optional(),
-	/**
-	* Shared file-backed resident bytes (Linux RssFile) — mmap'd framework/lib
-	* code shared copy-on-write across runners. Undefined on macOS.
-	*/
-	sharedBytes: zod.z.number().optional()
+	zod.z.object({
+		kind: zod.z.literal("url"),
+		url: zod.z.string(),
+		sha256: zod.z.string().optional()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("path"),
+		path: zod.z.string()
+	})
+]);
+var ManagedRuntimeConfigSchema = zod.z.object({
+	/** WHERE the runtime lives — hub or any agent. */
+	nodeId: zod.z.string(),
+	/** Closed for v1; 'ollama' is a v2 candidate. */
+	engine: zod.z.enum(["llama-cpp"]),
+	model: ManagedModelRefSchema,
+	contextSize: zod.z.number().int().default(4096),
+	/** 0 = CPU-only. */
+	gpuLayers: zod.z.number().int().default(0),
+	/** Default: cpus-2, clamped ≥1 (resolved node-side). */
+	threads: zod.z.number().int().optional(),
+	/** Concurrent slots. */
+	parallel: zod.z.number().int().default(1),
+	/** Else lazy: first generate boots it. */
+	autoStart: zod.z.boolean().default(false),
+	/** 0 = never; frees RAM after quiet periods. */
+	idleStopMinutes: zod.z.number().int().default(30)
 });
-var AddonInstanceSchema = zod.z.object({
-	addonId: zod.z.string(),
+var LlmRuntimeStatusSchema = zod.z.object({
+	/** Status is ALWAYS node-qualified. */
 	nodeId: zod.z.string(),
-	role: zod.z.enum(["hub", "worker"]),
-	pid: zod.z.number(),
 	state: zod.z.enum([
-		"starting",
-		"running",
-		"stopping",
 		"stopped",
-		"crashed"
-	]),
-	uptimeSec: zod.z.number()
-});
-var NodeProcessSchema = zod.z.object({
-	pid: zod.z.number(),
-	ppid: zod.z.number(),
-	pgid: zod.z.number(),
-	classification: zod.z.enum([
-		"root",
-		"managed",
-		"system",
-		"ghost"
+		"downloading",
+		"starting",
+		"ready",
+		"crashed",
+		"failed"
 	]),
-	/** `$process` addon binding when `managed`, else null. */
-	addonId: zod.z.string().nullable(),
-	/** Kernel-reported nodeId when the process is a known agent/worker. */
-	nodeId: zod.z.string().nullable(),
-	/** Truncated command line. */
-	command: zod.z.string(),
-	cpuPercent: zod.z.number(),
-	memoryRssBytes: zod.z.number(),
-	/** Wall-clock uptime (seconds). Parsed from `ps etime`. */
-	uptimeSec: zod.z.number(),
-	/** True when ancestor walk reaches `ppid=1` (reparented to init/launchd). */
-	orphaned: zod.z.boolean()
-});
-var KillProcessInputSchema = zod.z.object({
-	pid: zod.z.number(),
-	/** Force = SIGKILL. Default is SIGTERM. */
-	force: zod.z.boolean().optional()
+	pid: zod.z.number().optional(),
+	port: zod.z.number().optional(),
+	modelPath: zod.z.string().optional(),
+	modelId: zod.z.string().optional(),
+	downloadProgress: zod.z.number().min(0).max(1).optional(),
+	lastError: zod.z.string().optional(),
+	crashesInWindow: zod.z.number(),
+	/** Child RSS (sampled best-effort). */
+	memoryBytes: zod.z.number().optional(),
+	vramBytes: zod.z.number().optional()
 });
-var KillProcessResultSchema = zod.z.object({
-	success: zod.z.boolean(),
-	reason: zod.z.string().optional(),
-	signal: zod.z.enum(["SIGTERM", "SIGKILL"]).optional()
+var LlmNodeModelSchema = zod.z.object({
+	file: zod.z.string(),
+	sizeBytes: zod.z.number(),
+	catalogId: zod.z.string().optional(),
+	installedAt: zod.z.number().optional()
 });
-var DumpHeapSnapshotInputSchema = zod.z.object({ 
-/** The addon whose runner should dump a heap snapshot. */
-addonId: zod.z.string() });
-var DumpHeapSnapshotResultSchema = zod.z.object({
-	success: zod.z.boolean(),
-	/** Path of the written .heapsnapshot inside the runner's container/host. */
-	path: zod.z.string().optional(),
-	/** Process pid that was signalled. */
-	pid: zod.z.number().optional(),
-	reason: zod.z.string().optional()
+var LlmRuntimeDiskUsageSchema = zod.z.object({
+	nodeId: zod.z.string(),
+	modelsBytes: zod.z.number(),
+	freeBytes: zod.z.number().optional()
 });
-var SystemMetricsSchema = zod.z.object({
-	cpuPercent: zod.z.number(),
-	memoryPercent: zod.z.number(),
-	memoryUsedMB: zod.z.number(),
-	memoryTotalMB: zod.z.number(),
-	diskPercent: zod.z.number().optional(),
-	temperature: zod.z.number().optional(),
-	gpuPercent: zod.z.number().optional(),
-	gpuMemoryPercent: zod.z.number().optional()
+var LlmRuntimeCompleteInputSchema = LlmGenerateBaseInputSchema.extend({
+	images: zod.z.array(LlmImageSchema).optional(),
+	runtime: ManagedRuntimeConfigSchema,
+	/** The managed profile's timeout, threaded by the hub provider. */
+	timeoutMs: zod.z.number().int().positive().optional()
 });
-var metricsProviderCapability = {
-	name: "metrics-provider",
+var llmRuntimeCapability = {
+	name: "llm-runtime",
 	scope: "system",
 	mode: "singleton",
+	internal: true,
 	methods: {
-		/** Fresh, full system snapshot (triggers OS-level collection). */
-		collectSnapshot: require_sleep.method(zod.z.void(), SystemResourceSnapshotSchema),
-		/** Most recent cached snapshot from the background sampler, or null pre-first-sample. */
-		getCached: require_sleep.method(zod.z.void(), SystemResourceSnapshotSchema.nullable()),
-		/** Light-weight cached summary for heartbeats and list views. */
-		getCurrent: require_sleep.method(zod.z.void(), SystemMetricsSchema),
-		/** Disk space for the given mount/path. */
-		getDiskSpace: require_sleep.method(zod.z.object({ dirPath: zod.z.string() }), DiskSpaceInfoSchema),
-		/** GPU info (null if unavailable). */
-		getGpuInfo: require_sleep.method(zod.z.void(), MetricsGpuInfoSchema.nullable()),
-		/** CPU temperature in °C (null if unavailable). */
-		getCpuTemperature: require_sleep.method(zod.z.void(), zod.z.number().nullable()),
-		/** Per-PID resource stats. Missing/dead PIDs are omitted from the result. */
-		getProcessStats: require_sleep.method(zod.z.object({ pids: zod.z.array(zod.z.number()) }), zod.z.array(PidResourceStatsSchema)),
-		/**
-		* List addon instances known to this node — one entry per forked worker
-		* plus a synthetic 'hub' entry representing the local hub process.
-		* Used by benchmarks/observability to detect whether a given addon runs
-		* in its own process (measurable independently) or inline with the hub.
-		*/
-		listAddonInstances: require_sleep.method(zod.z.void(), zod.z.array(AddonInstanceSchema).readonly()),
-		/**
-		* Resource stats for the process hosting the given addon.
-		* Returns null when the addon runs in-process on the hub (can't measure
-		* independently — caller should detect via listAddonInstances). Returns
-		* hub process stats for addonId '$hub'.
-		*/
-		getAddonStats: require_sleep.method(zod.z.object({ addonId: zod.z.string() }), PidResourceStatsSchema.nullable()),
-		/**
-		* Snapshot of every camstack-related process on this node with a
-		* ghost/managed/root classification. Powers the Cluster → Agent →
-		* Processes tab: cross-references `$process.list` against a `ps` scan
-		* so orphaned trees (PPID=1) or unknown children show up as `ghost`
-		* and can be killed from the UI.
-		*/
-		listNodeProcesses: require_sleep.method(zod.z.void(), zod.z.array(NodeProcessSchema).readonly()),
-		/**
-		* Send SIGTERM (or SIGKILL when `force`) to a pid inside this node's
-		* process tree. The provider refuses pids that aren't in the live
-		* `listNodeProcesses()` snapshot — callers can't use this endpoint
-		* to kill arbitrary system processes.
-		*/
-		killProcess: require_sleep.method(KillProcessInputSchema, KillProcessResultSchema, {
+		complete: require_sleep.method(LlmRuntimeCompleteInputSchema, LlmGenerateResultSchema, { kind: "mutation" }),
+		ensureStarted: require_sleep.method(zod.z.object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/**
-		* Tell the addon's forked runner to write a V8 heap snapshot to disk (via
-		* SIGUSR2 — the runner's diagnostic handler). Also logs its
-		* `process.memoryUsage()` + heap-space breakdown. Refuses pids not in the
-		* live `listNodeProcesses()` snapshot. Use for deep per-addon memory
-		* attribution; copy the returned path off the node to analyze.
-		*/
-		dumpHeapSnapshot: require_sleep.method(DumpHeapSnapshotInputSchema, DumpHeapSnapshotResultSchema, {
+		stop: require_sleep.method(zod.z.object({}), zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
-		})
+		}),
+		status: require_sleep.method(zod.z.object({}), LlmRuntimeStatusSchema),
+		installModel: require_sleep.method(zod.z.object({ model: ManagedModelRefSchema }), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteModel: require_sleep.method(zod.z.object({ file: zod.z.string() }), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		listLocalModels: require_sleep.method(zod.z.object({}), zod.z.array(LlmNodeModelSchema)),
+		getDiskUsage: require_sleep.method(zod.z.object({}), LlmRuntimeDiskUsageSchema)
 	}
 };
 //#endregion
-//#region src/capabilities/model-convert.cap.ts
-var ModelConvertInputSchema = zod.z.object({
-	sourceUrl: zod.z.string(),
-	metadata: ModelConvertMetadataSchema,
-	targets: zod.z.array(ConvertTargetSchema).min(1).readonly(),
-	calibrationRef: zod.z.string().optional(),
-	sessionId: zod.z.string().optional()
-});
-var modelConvertCapability = {
-	name: "model-convert",
-	scope: "system",
-	mode: "singleton",
-	internal: true,
-	methods: { convert: require_sleep.method(ModelConvertInputSchema, ConvertResultSchema, {
-		kind: "mutation",
-		auth: "admin",
-		timeoutMs: 6e5
-	}) }
-};
-//#endregion
-//#region src/capabilities/model-distributor.cap.ts
-/**
-* `model-distributor` — singleton, hub-resident. Pushes a model FORMAT that is
-* already present on the hub's `/data/models` to a target agent node's
-* `/data/models`, sha256-verified, reusing the agent-pull machinery
-* (DeployStageRegistry + the one-time-token bundle route + the agent's
-* `fetchBundleFromHub`). Its provider is built in `server/backend` because it
-* needs the Moleculer broker + the deploy-stage registry, which a forked addon
-* can't reach. `addon-model-studio` drives it via `ctx.api` and owns the
-* per-node availability map.
-*/
-var ModelDistributeInputSchema = zod.z.object({
-	nodeId: zod.z.string(),
-	modelId: zod.z.string(),
-	format: zod.z.enum(MODEL_FORMATS),
-	entry: ModelCatalogEntrySchema
-});
-var ModelDistributeResultSchema = zod.z.object({
-	ok: zod.z.boolean(),
-	/** sha256 of the staged tarball (empty for a hub-local no-op). */
-	sha256: zod.z.string(),
-	bytes: zod.z.number(),
-	/** The target node's modelsDir the artifact landed in. */
-	path: zod.z.string()
-});
-var modelDistributorCapability = {
-	name: "model-distributor",
-	scope: "system",
-	mode: "singleton",
-	internal: true,
-	methods: { distributeModel: require_sleep.method(ModelDistributeInputSchema, ModelDistributeResultSchema, {
-		kind: "mutation",
-		auth: "admin"
-	}) }
-};
-//#endregion
-//#region src/capabilities/mqtt-broker.cap.ts
-/**
-* `mqtt-broker` — broker-registry cap.
-*
-* NOT a pub/sub proxy. The cap exposes (a) a registry of configured
-* MQTT brokers (external + optionally an embedded `aedes`-backed one)
-* and (b) the connection details a consumer addon needs to spin up
-* its OWN `mqtt.js` client.
-*
-* Why: pub/sub routing over the system event-bus loses fidelity
-* (callback shape, QoS guarantees, will/retain semantics) and adds
-* refcount bookkeeping that addons would rather own themselves. The
-* canonical consumer (`addon-export-ha-mqtt`) needs raw `mqtt.js`
-* features anyway — give it the connection config, get out of the way.
-*
-* Consumer flow:
-*   const cfg = await ctx.api.mqttBroker.getBrokerConfig({ id })
-*   const client = mqtt.connect(cfg.url, { username: cfg.username, … })
-*   client.subscribe('zigbee2mqtt/+')
-*
-* Collection mode: multiple brokers (e.g. one local mosquitto + one
-* cloud bridge). The "embedded" entry (when present) is just another
-* broker in the registry — its lifecycle is owned by the addon that
-* spawned it.
-*/
-var BrokerKindSchema = zod.z.enum(["external", "embedded"]);
+//#region src/capabilities/llm.cap.ts
 /**
-* Broker live-probe status.
+* `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
+* methods concat-fan across providers; single-row methods route to ONE
+* provider by the `addonId` in the call input (the notification-output
+* posture, notification-output.cap.ts:215-250). Provided by `addon-ai`
+* (hub-placed); the cap stays open for future providers.
 *
-* - `connected` — last probe completed a clean CONNACK
-* - `disconnected` — no probe has run yet (cold cache)
-* - `auth-failed` — CONNACK refused with auth error (RC 4 / 5)
-* - `unreachable` — TCP connect timed out / refused
-* - `tls-error` — TLS handshake failed (cert / SNI / cipher)
+* Profiles are ROWS (data), not addons: one row = one usable model endpoint.
+* `apiKey` is a password field — providers REDACT it on read and merge on
+* write; a stored key NEVER round-trips to a client.
 */
-var BrokerStatusSchema$1 = zod.z.enum([
-	"connected",
-	"disconnected",
-	"auth-failed",
-	"unreachable",
-	"tls-error"
+var LlmProfileKindSchema = zod.z.enum([
+	"openai-compatible",
+	"openai",
+	"anthropic",
+	"google",
+	"managed-local"
 ]);
-var BrokerInfoSchema = zod.z.object({
+var LlmProfileSchema = zod.z.object({
 	id: zod.z.string(),
 	name: zod.z.string(),
-	url: zod.z.string(),
-	kind: BrokerKindSchema,
-	status: BrokerStatusSchema$1,
-	latencyMs: zod.z.number().nullable(),
-	error: zod.z.string().optional(),
-	/** Embedded brokers only: number of MQTT clients currently connected. */
-	connectedClients: zod.z.number().int().nonnegative().optional(),
-	/** Epoch ms of the last live probe (external) or aedes snapshot (embedded). */
-	lastCheckedAt: zod.z.number().optional()
-});
-/**
-* Connection details — what a consumer needs to call
-* `mqtt.connect(url, options)`. We split URL + credentials so the
-* consumer can pass them as `mqtt.connect(url, { username, password })`
-* instead of stuffing creds into the URL (which leaks them into logs).
-*/
-var BrokerConnectionDetailsSchema = zod.z.object({
-	url: zod.z.string(),
-	username: zod.z.string().optional(),
-	password: zod.z.string().optional(),
-	/**
-	* Suggested prefix for `clientId`. Each consumer should suffix this
-	* with its own discriminator (addon id, instance id) so reconnects
-	* don't kick each other off (MQTT spec: clientId must be unique per
-	* broker).
-	*/
-	clientIdPrefix: zod.z.string().optional()
-});
-var AddBrokerInputSchema = zod.z.object({
-	name: zod.z.string().min(1),
-	url: zod.z.string().regex(/^(mqtt|mqtts|ws|wss):\/\//, "URL must start with mqtt(s):// or ws(s)://"),
-	username: zod.z.string().optional(),
-	password: zod.z.string().optional(),
-	clientIdPrefix: zod.z.string().optional()
-});
-var AddBrokerResultSchema = zod.z.object({ id: zod.z.string() });
-var IdInputSchema = zod.z.object({ id: zod.z.string() });
-var TestResultSchema$1 = zod.z.discriminatedUnion("ok", [zod.z.object({
-	ok: zod.z.literal(true),
-	latencyMs: zod.z.number()
-}), zod.z.object({
-	ok: zod.z.literal(false),
-	error: zod.z.string()
-})]);
-var StartEmbeddedInputSchema = zod.z.object({
-	port: zod.z.number().int().min(1).max(65535).default(1883),
-	/** Allow anonymous connect (no username/password). Default: false. */
-	allowAnonymous: zod.z.boolean().default(false),
-	/** Optional shared username/password for clients. */
-	username: zod.z.string().optional(),
-	password: zod.z.string().optional()
+	kind: LlmProfileKindSchema,
+	/** Stamped by the provider — keeps the fanned catalog routable. */
+	addonId: zod.z.string(),
+	enabled: zod.z.boolean(),
+	/** Vendor model id, or the managed runtime's loaded model. */
+	model: zod.z.string(),
+	/** Required for openai-compatible; override for cloud kinds. */
+	baseUrl: zod.z.string().optional(),
+	/** ConfigUISchema type:'password' — never round-trips (spec §5). */
+	apiKey: zod.z.string().optional(),
+	supportsVision: zod.z.boolean(),
+	temperature: zod.z.number().min(0).max(2).optional(),
+	maxTokens: zod.z.number().int().positive().optional(),
+	timeoutMs: zod.z.number().int().positive().default(6e4),
+	extraHeaders: zod.z.record(zod.z.string(), zod.z.string()).optional(),
+	/** kind === 'managed-local' only (spec §4). */
+	runtime: ManagedRuntimeConfigSchema.optional()
 });
-var StartEmbeddedResultSchema = zod.z.object({
-	id: zod.z.string(),
-	url: zod.z.string()
+/** ConfigUISchema tree passed through untyped on the wire (the
+*  notification-output `ConfigSchemaPassthrough` precedent at
+*  notification-output.cap.ts:151); the exported TS type re-tightens it. */
+var ConfigSchemaPassthrough$1 = zod.z.unknown();
+var LlmProfileKindDescriptorSchema = zod.z.object({
+	kind: LlmProfileKindSchema,
+	label: zod.z.string(),
+	icon: zod.z.string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: zod.z.string(),
+	configSchema: ConfigSchemaPassthrough$1
 });
-var StatusSchema = zod.z.object({
-	brokerCount: zod.z.number(),
-	embeddedRunning: zod.z.boolean()
+var LlmDefaultSelectorSchema = zod.z.union([zod.z.object({ consumer: zod.z.string() }), zod.z.object({ purpose: zod.z.enum(["text", "vision"]) })]);
+var LlmDefaultSchema = zod.z.object({
+	selector: LlmDefaultSelectorSchema,
+	profileId: zod.z.string()
 });
-var mqttBrokerCapability = {
-	name: "mqtt-broker",
+/** Server-side rollup row — getUsage never dumps raw call rows (spec §6). */
+var LlmUsageRollupSchema = zod.z.object({
+	day: zod.z.string(),
+	consumer: zod.z.string(),
+	profileId: zod.z.string(),
+	calls: zod.z.number(),
+	okCalls: zod.z.number(),
+	errorCalls: zod.z.number(),
+	inputTokens: zod.z.number(),
+	outputTokens: zod.z.number(),
+	avgLatencyMs: zod.z.number()
+});
+/** LLM-facing view over the reused ModelCatalogEntry mechanism (spec §4.2). */
+var ManagedModelCatalogEntrySchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	family: zod.z.string(),
+	purpose: zod.z.enum(["text", "vision"]),
+	url: zod.z.string(),
+	sha256: zod.z.string(),
+	sizeBytes: zod.z.number(),
+	quantization: zod.z.string(),
+	/** Load-time guidance shown in the picker. */
+	minRamBytes: zod.z.number(),
+	contextSizeDefault: zod.z.number().int(),
+	/** Vision models: companion projector file. */
+	mmprojUrl: zod.z.string().optional()
+});
+var LlmRuntimeNodeSchema = zod.z.object({
+	nodeId: zod.z.string(),
+	reachable: zod.z.boolean(),
+	status: LlmRuntimeStatusSchema.optional(),
+	disk: LlmRuntimeDiskUsageSchema.optional(),
+	error: zod.z.string().optional()
+});
+var GenerateVisionInputSchema = LlmGenerateBaseInputSchema.extend({ images: zod.z.array(LlmImageSchema).min(1) });
+var ProfileRefInputSchema = zod.z.object({
+	addonId: zod.z.string(),
+	profileId: zod.z.string()
+});
+var llmCapability = {
+	name: "llm",
 	scope: "system",
 	mode: "collection",
-	providerKind: "broker",
-	status: {
-		schema: StatusSchema,
-		kind: "poll"
-	},
+	internal: false,
+	providerKind: "ai",
+	/** `nodeId` inputs below are DATA (the hub provider pins itself), never routing. */
+	nodeIdMode: "data",
 	methods: {
-		listBrokers: require_sleep.method(zod.z.void(), zod.z.array(BrokerInfoSchema)),
-		getBrokerConfig: require_sleep.method(IdInputSchema, BrokerConnectionDetailsSchema),
-		addBroker: require_sleep.method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }),
-		removeBroker: require_sleep.method(IdInputSchema, zod.z.void(), { kind: "mutation" }),
-		testConnection: require_sleep.method(IdInputSchema, TestResultSchema$1, { kind: "mutation" }),
-		startEmbeddedBroker: require_sleep.method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }),
-		stopEmbeddedBroker: require_sleep.method(IdInputSchema, zod.z.void(), { kind: "mutation" }),
-		getStatus: require_sleep.method(zod.z.void(), StatusSchema)
+		generate: require_sleep.method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }),
+		generateVision: require_sleep.method(GenerateVisionInputSchema, LlmGenerateResultSchema, { kind: "mutation" }),
+		listProfileKinds: require_sleep.method(zod.z.object({}), zod.z.array(LlmProfileKindDescriptorSchema)),
+		listProfiles: require_sleep.method(zod.z.object({}), zod.z.array(LlmProfileSchema)),
+		upsertProfile: require_sleep.method(zod.z.object({ profile: LlmProfileSchema }), LlmProfileSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteProfile: require_sleep.method(ProfileRefInputSchema, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		testProfile: require_sleep.method(ProfileRefInputSchema, LlmGenerateResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Live vendor enumeration (GET /models etc.). */
+		listModels: require_sleep.method(ProfileRefInputSchema, zod.z.array(zod.z.string())),
+		getDefaults: require_sleep.method(zod.z.object({}), zod.z.array(LlmDefaultSchema)),
+		setDefault: require_sleep.method(zod.z.object({
+			selector: LlmDefaultSelectorSchema,
+			profileId: zod.z.string().nullable()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getUsage: require_sleep.method(zod.z.object({
+			since: zod.z.number().optional(),
+			until: zod.z.number().optional(),
+			consumer: zod.z.string().optional(),
+			profileId: zod.z.string().optional()
+		}), zod.z.array(LlmUsageRollupSchema)),
+		listModelCatalog: require_sleep.method(zod.z.object({}), zod.z.array(ManagedModelCatalogEntrySchema)),
+		listRuntimeNodes: require_sleep.method(zod.z.object({}), zod.z.array(LlmRuntimeNodeSchema)),
+		listNodeModels: require_sleep.method(zod.z.object({ nodeId: zod.z.string() }), zod.z.array(LlmNodeModelSchema)),
+		installModel: require_sleep.method(zod.z.object({
+			nodeId: zod.z.string(),
+			model: ManagedModelRefSchema
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteModel: require_sleep.method(zod.z.object({
+			nodeId: zod.z.string(),
+			file: zod.z.string()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getRuntimeStatus: require_sleep.method(ProfileRefInputSchema, LlmRuntimeStatusSchema),
+		startRuntime: require_sleep.method(ProfileRefInputSchema, LlmRuntimeStatusSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		stopRuntime: require_sleep.method(ProfileRefInputSchema, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 //#endregion
-//#region src/capabilities/network-access.cap.ts
-var NetworkEndpointSchema = zod.z.object({
-	url: zod.z.string(),
-	hostname: zod.z.string(),
-	port: zod.z.number(),
-	protocol: zod.z.enum(["http", "https"])
-});
-var NetworkAccessStatusSchema = zod.z.object({
-	connected: zod.z.boolean(),
-	endpoint: NetworkEndpointSchema.nullable(),
-	error: zod.z.string().optional()
-});
-/**
-* Optional, richer endpoint shape returned by providers that expose
-* MORE than one ingress concurrently (Tailscale Ingress with mixed
-* serve+funnel rules, future ngrok multi-tunnel, …). Each entry carries
-* the originating provider config (mode + sourcePort) so the
-* orchestrator UI can label rows distinctly. Providers that expose only
-* one endpoint just omit `listEndpoints` from their provider impl.
-*/
-var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
-	/**
-	* Stable id within the provider — typically `<mode>-<sourcePort>` so
-	* the orchestrator can dedupe across `listEndpoints` polls.
-	*/
-	id: zod.z.string(),
-	/** Operator-facing label (mirrors `MeshEndpoint.label`). */
-	label: zod.z.string(),
-	/** Optional provider-specific mode tag, used for icon/colour in admin UI. */
-	mode: zod.z.string().optional(),
-	/** Originating local port the ingress fronts (informational). */
-	sourcePort: zod.z.number().optional()
+//#region src/capabilities/log-destination.cap.ts
+var LogLevelSchema = zod.z.enum([
+	"debug",
+	"info",
+	"warn",
+	"error"
+]);
+var LogEntrySchema = zod.z.object({
+	timestamp: zod.z.date(),
+	level: LogLevelSchema,
+	scope: zod.z.array(zod.z.string()),
+	message: zod.z.string(),
+	meta: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+	tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
 });
-var networkAccessCapability = {
-	name: "network-access",
+var logDestinationCapability = {
+	name: "log-destination",
 	scope: "system",
 	mode: "collection",
-	providerKind: "ingress",
+	internal: true,
 	methods: {
-		start: require_sleep.method(zod.z.void(), NetworkEndpointSchema, { kind: "mutation" }),
-		stop: require_sleep.method(zod.z.void(), zod.z.void(), { kind: "mutation" }),
-		getEndpoint: require_sleep.method(zod.z.void(), NetworkEndpointSchema.nullable()),
-		getStatus: require_sleep.method(zod.z.void(), NetworkAccessStatusSchema),
-		/**
-		* Enumerate every active ingress entry. Providers that expose only a
-		* single endpoint may omit this method; callers fall back to
-		* `getEndpoint()` in that case.
-		*/
-		listEndpoints: require_sleep.method(zod.z.void(), zod.z.array(NetworkEndpointEntrySchema).readonly())
-	}
+		write: require_sleep.method(LogEntrySchema, zod.z.void(), { kind: "mutation" }),
+		query: require_sleep.method(zod.z.object({
+			scope: zod.z.array(zod.z.string()).optional(),
+			level: LogLevelSchema.optional(),
+			since: zod.z.date().optional(),
+			until: zod.z.date().optional(),
+			limit: zod.z.number().optional(),
+			tags: zod.z.record(zod.z.string(), zod.z.string()).optional()
+		}), zod.z.array(LogEntrySchema).readonly())
+	},
+	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+	mount: { kind: "skip" }
 };
 //#endregion
-//#region src/capabilities/notification-output.cap.ts
+//#region src/capabilities/login-method.cap.ts
 /**
-* notification-output — canonical, capability-gated notification delivery.
+* `login-method` — collection cap through which auth addons contribute
+* their pre-auth login surfaces to the login page. This is the SINGLE,
+* generic mechanism that supersedes the dead `auth.listProviders` reader:
+* every auth addon (OIDC, magic-link, WebAuthn/passkey) registers a
+* `login-method` provider and the PUBLIC `auth.listLoginMethods`
+* procedure aggregates them for the unauthenticated login page.
 *
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
+* A contribution is a discriminated union on `kind`:
 *
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
+*  - `redirect` — a declarative button. The login page renders a generic
+*    button that navigates to `startUrl` (an addon-owned HTTP route).
+*    Covers OIDC (`/addon/auth-oidc/<id>/start`) and magic-link with
+*    ZERO shell-side JS. A future SSO addon plugs in the same way — the
+*    login page needs NO change.
 *
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = zod.z.enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = zod.z.object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: zod.z.string().optional(),
-	bytes: zod.z.instanceof(Uint8Array).optional(),
-	mime: zod.z.string().optional(),
-	name: zod.z.string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = zod.z.enum([
-	"text",
-	"markdown",
-	"html"
-]);
-/** A single tap-through action button. */
-var NotificationActionSchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	url: zod.z.string().optional()
-});
+*  - `widget` — a Module-Federation widget the login page mounts (via
+*    `loadRemoteBundle`) for an in-page ceremony. `auth.listLoginMethods`
+*    stamps a public `bundleUrl` from `addonId` + `bundle`. Generic
+*    mechanism kept for future use; no shipped addon uses it on the login
+*    page (the passkey ceremony below runs natively in the shell instead).
+*
+*  - `passkey` — a declarative WebAuthn ceremony the shell renders
+*    natively (`@simplewebauthn/browser` lives in `addon-admin-ui`, not in
+*    a remotely-loaded bundle). Carries the addon's effective `rpId` /
+*    `origin` (from its `resolveRpID()` / `resolveOrigin()`) so the shell
+*    can gate visibility (IP-literal origin, hostname/rpId mismatch) WITHOUT
+*    fetching any remote code pre-auth. Contribution stays unconditional —
+*    enrollment state is never leaked pre-auth; visibility is a shell
+*    decision.
+*
+* Every contribution carries a `stage`:
+*  - `primary`        — shown on the first credentials screen (OIDC /
+*                       magic-link buttons; a future usernameless passkey).
+*  - `second-factor`  — shown AFTER the password leg, gated on the
+*                       returned `factors` (passkey-as-2FA today).
+*
+* `mount: skip` — the cap is read server-side by the core auth router
+* (`registry.getCollection('login-method')`), never mounted as its own
+* tRPC router.
+*/
+/** When a login method renders in the two-phase login flow. */
+var LoginStageEnum = zod.z.enum(["primary", "second-factor"]);
 /**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
+* A declarative redirect button — the login page navigates to `startUrl`.
+* OIDC and magic-link contribute this; a future SSO addon does too.
 */
-var NotificationSchema = zod.z.object({
-	body: zod.z.string(),
-	title: zod.z.string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: zod.z.number().int().min(1).max(5).default(3),
-	level: zod.z.string().optional(),
-	attachments: zod.z.array(AttachmentSchema).optional(),
-	clickUrl: zod.z.string().optional(),
-	actions: zod.z.array(NotificationActionSchema).optional(),
-	sound: zod.z.string().optional(),
-	ttl: zod.z.number().optional(),
-	tag: zod.z.string().optional(),
-	deviceId: zod.z.number().optional(),
-	eventId: zod.z.string().optional(),
-	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-});
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = zod.z.object({
+var RedirectLoginMethodSchema = zod.z.object({
+	kind: zod.z.literal("redirect"),
+	/** Stable id within the login-method set (e.g. `auth-oidc/google`). */
 	id: zod.z.string(),
+	/** Operator-facing button label. */
 	label: zod.z.string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: zod.z.number().int().min(1).max(5).nullable(),
-	flags: zod.z.object({
-		critical: zod.z.boolean().optional(),
-		silent: zod.z.boolean().optional(),
-		noPush: zod.z.boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: zod.z.array(zod.z.string()).optional(),
-	description: zod.z.string().optional()
-});
-/** Attachment capabilities for a kind (drives the degrade engine + test panel). */
-var TargetKindAttachmentsCapsSchema = zod.z.object({
-	mediaTypes: zod.z.array(AttachmentMediaTypeSchema),
-	mode: zod.z.enum([
-		"url",
-		"bytes",
-		"both"
-	]),
-	max: zod.z.number().int().nonnegative(),
-	maxBytes: zod.z.number().int().positive().optional()
-});
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = zod.z.object({
-	attachments: TargetKindAttachmentsCapsSchema,
-	/** Max action buttons (0 = none). */
-	actions: zod.z.number().int().nonnegative(),
-	levels: zod.z.array(TargetKindLevelSchema),
-	format: zod.z.array(NotificationFormatSchema),
-	clickUrl: zod.z.boolean(),
-	sound: zod.z.boolean(),
-	ttl: zod.z.boolean(),
-	bodyMaxLen: zod.z.number().int().positive()
+	/** lucide-react icon name. */
+	icon: zod.z.string().optional(),
+	/** Addon-owned HTTP route the button navigates to (GET). */
+	startUrl: zod.z.string(),
+	stage: LoginStageEnum
 });
 /**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+* A Module-Federation widget the login page mounts for an in-page
+* ceremony. `bundle` + `addonId` let `auth.listLoginMethods` stamp a
+* public `bundleUrl`; `remote` is the MF descriptor `loadRemoteBundle`
+* consumes. No `bundleUrl` here — it is server-stamped on the public
+* output so the addon never encodes the static-route scheme.
 */
-var ConfigSchemaPassthrough$1 = zod.z.unknown();
-var TargetKindSchema = zod.z.object({
-	kind: zod.z.string(),
-	label: zod.z.string(),
-	icon: zod.z.string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+var WidgetLoginMethodSchema = zod.z.object({
+	kind: zod.z.literal("widget"),
+	/** Stable id within the login-method set (e.g. `auth-webauthn/passkey-login`). */
+	id: zod.z.string(),
+	/** Owning addon id — drives the public bundle URL + the MF namespace. */
 	addonId: zod.z.string(),
-	configSchema: ConfigSchemaPassthrough$1,
-	supportsDiscovery: zod.z.boolean(),
-	caps: TargetKindCapsSchema
+	/** Bundle filename inside the addon's dist dir (`remoteEntry.js`). */
+	bundle: zod.z.string(),
+	/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
+	remote: WidgetRemoteSchema,
+	stage: LoginStageEnum
 });
 /**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
+* A declarative WebAuthn ceremony the shell renders natively (no remote
+* code). Carries the addon's EFFECTIVE `rpId`/`origin` so the shell can
+* gate visibility (IP-literal origin, hostname/rpId mismatch) before ever
+* showing the button — the contribution itself stays unconditional.
 */
-var TargetSchema = zod.z.object({
+var PasskeyLoginMethodSchema = zod.z.object({
+	kind: zod.z.literal("passkey"),
+	/** Stable id within the login-method set (e.g. `auth-webauthn/passkey-direct-login`). */
 	id: zod.z.string(),
-	name: zod.z.string(),
-	kind: zod.z.string(),
-	addonId: zod.z.string(),
-	enabled: zod.z.boolean(),
-	config: zod.z.record(zod.z.string(), zod.z.unknown())
-});
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = zod.z.object({
-	kind: zod.z.string(),
-	suggestedName: zod.z.string(),
-	config: zod.z.record(zod.z.string(), zod.z.unknown())
-});
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = zod.z.object({
-	level: zod.z.string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: zod.z.number().int().nonnegative(),
-	actionsSent: zod.z.number().int().nonnegative(),
-	truncated: zod.z.boolean(),
-	dropped: zod.z.array(zod.z.string())
-});
-var SendResultSchema = zod.z.object({
-	success: zod.z.boolean(),
-	error: zod.z.string().optional(),
-	renderedAs: RenderedAsSchema.optional()
+	/** Operator-facing button label. */
+	label: zod.z.string(),
+	stage: LoginStageEnum,
+	/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
+	rpId: zod.z.string(),
+	/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
+	origin: zod.z.string().nullable()
 });
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
-var notificationOutputCapability = {
-	name: "notification-output",
+/** One login-method contribution — redirect button, pre-auth widget, or native passkey ceremony. */
+var LoginMethodContributionSchema = zod.z.discriminatedUnion("kind", [
+	RedirectLoginMethodSchema,
+	WidgetLoginMethodSchema,
+	PasskeyLoginMethodSchema
+]);
+var loginMethodCapability = {
+	name: "login-method",
 	scope: "system",
 	mode: "collection",
-	methods: {
-		listTargetKinds: require_sleep.method(zod.z.object({}), zod.z.array(TargetKindSchema)),
-		listTargets: require_sleep.method(zod.z.object({}), zod.z.array(TargetSchema)),
-		discoverTargets: require_sleep.method(zod.z.object({
-			kind: zod.z.string(),
-			config: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-		}), zod.z.array(DiscoveredTargetSchema)),
-		send: require_sleep.method(zod.z.object({
-			targetId: zod.z.string(),
-			notification: NotificationSchema
-		}), SendResultSchema, { kind: "mutation" }),
-		testTarget: require_sleep.method(zod.z.object({
-			targetId: zod.z.string(),
-			sample: NotificationSchema.optional()
-		}), TestResultSchema, { kind: "mutation" }),
-		upsertTarget: require_sleep.method(zod.z.object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }),
-		deleteTarget: require_sleep.method(zod.z.object({ targetId: zod.z.string() }), zod.z.void(), { kind: "mutation" }),
-		setTargetEnabled: require_sleep.method(zod.z.object({
-			targetId: zod.z.string(),
-			enabled: zod.z.boolean()
-		}), zod.z.void(), { kind: "mutation" })
-	}
+	internal: true,
+	methods: { getLoginMethods: require_sleep.method(zod.z.void(), zod.z.array(LoginMethodContributionSchema).readonly()) },
+	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+	mount: { kind: "skip" }
 };
 //#endregion
-//#region src/capabilities/llm-shared.ts
-/**
-* Shared LLM generate contracts — imported by BOTH `llm.cap.ts` (consumer
-* surface) and `llm-runtime.cap.ts` (node-side managed executor) so the two
-* caps stay wire-compatible without a circular cap→cap import.
-*
-* Errors are a discriminated-union RESULT, never thrown: the shape survives
-* every transport tier structurally, and failed calls still write usage rows.
-* Token counts only in v1 — no costUsd (operator decision, 2026-07-15).
-*/
-var LlmUsageSchema = zod.z.object({
-	inputTokens: zod.z.number(),
-	outputTokens: zod.z.number()
+//#region src/capabilities/metrics-provider.cap.ts
+var CpuBreakdownSchema = zod.z.object({
+	total: zod.z.number(),
+	user: zod.z.number(),
+	system: zod.z.number(),
+	irq: zod.z.number(),
+	nice: zod.z.number(),
+	loadAvg: zod.z.tuple([
+		zod.z.number(),
+		zod.z.number(),
+		zod.z.number()
+	]),
+	cores: zod.z.number()
 });
-var LlmErrorCodeSchema = zod.z.enum([
-	"timeout",
-	"rate-limited",
-	"auth",
-	"refusal",
-	"bad-request",
-	"unavailable",
-	"no-profile",
-	"budget-exceeded",
-	"adapter-error"
-]);
-var LlmGenerateOkSchema = zod.z.object({
-	ok: zod.z.literal(true),
-	text: zod.z.string(),
+var MemoryInfoSchema = zod.z.object({
+	percent: zod.z.number(),
+	totalBytes: zod.z.number(),
+	usedBytes: zod.z.number(),
+	availableBytes: zod.z.number(),
+	swapUsedBytes: zod.z.number(),
+	swapTotalBytes: zod.z.number()
+});
+var DiskIoSnapshotSchema = zod.z.object({
+	readBytes: zod.z.number(),
+	writeBytes: zod.z.number(),
+	readOps: zod.z.number(),
+	writeOps: zod.z.number(),
+	timestampMs: zod.z.number()
+});
+var NetworkIoSnapshotSchema = zod.z.object({
+	rxBytes: zod.z.number(),
+	txBytes: zod.z.number(),
+	rxPackets: zod.z.number(),
+	txPackets: zod.z.number(),
+	rxErrors: zod.z.number(),
+	txErrors: zod.z.number(),
+	timestampMs: zod.z.number()
+});
+var MetricsGpuInfoSchema = zod.z.object({
+	utilization: zod.z.number(),
 	model: zod.z.string(),
-	usage: LlmUsageSchema,
-	truncated: zod.z.boolean(),
-	latencyMs: zod.z.number()
+	memoryUsedBytes: zod.z.number(),
+	memoryTotalBytes: zod.z.number(),
+	temperature: zod.z.number().nullable()
 });
-var LlmGenerateErrSchema = zod.z.object({
-	ok: zod.z.literal(false),
-	code: LlmErrorCodeSchema,
-	message: zod.z.string(),
-	retryAfterMs: zod.z.number().optional()
+var ProcessResourceInfoSchema = zod.z.object({
+	openFds: zod.z.number(),
+	threadCount: zod.z.number(),
+	activeHandles: zod.z.number(),
+	activeRequests: zod.z.number()
 });
-var LlmGenerateResultSchema = zod.z.discriminatedUnion("ok", [LlmGenerateOkSchema, LlmGenerateErrSchema]);
-/**
-* `Uint8Array` is the sanctioned binary convention — superjson + the UDS
-* MsgPack channel round-trip typed arrays (embedding-encoder.cap.ts:29,
-* notification-output.cap.ts:27-31 precedents).
-*/
-var LlmImageSchema = zod.z.object({
-	bytes: zod.z.instanceof(Uint8Array),
-	mimeType: zod.z.string()
+var PressureAvgsSchema = zod.z.object({
+	avg10: zod.z.number(),
+	avg60: zod.z.number(),
+	avg300: zod.z.number()
 });
-var LlmGenerateBaseInputSchema = zod.z.object({
-	/** Collection routing (the notification-output posture). */
-	addonId: zod.z.string().optional(),
-	/** Explicit profile; else the resolution chain (spec §3). */
-	profileId: zod.z.string().optional(),
-	/** MANDATORY usage tag: 'ai-summary', 'notifier-rules', 'adhoc-ui', … */
-	consumer: zod.z.string(),
-	system: zod.z.string().optional(),
-	/** v1: single-turn. `messages[]` is a v2 additive field. */
-	prompt: zod.z.string(),
-	/** Structured output — adapter-mapped (response_format / forced tool / responseSchema). */
-	jsonSchema: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-	/** Per-call override of the profile default. */
-	maxTokens: zod.z.number().int().positive().optional(),
-	temperature: zod.z.number().optional()
+var PressureInfoSchema = zod.z.object({
+	some: PressureAvgsSchema,
+	full: PressureAvgsSchema.nullable()
 });
-//#endregion
-//#region src/capabilities/llm-runtime.cap.ts
-/**
-* `llm-runtime` — node-side managed llama.cpp executor (spec §4). Registered
-* on EVERY node where `addon-ai` is installed; the hub `llm` provider reaches
-* a specific node's runtime with `nodePin(profile.runtime.nodeId)` — normal
-* cap routing, zero bespoke plumbing. `internal: true`: the operator reaches
-* this only through the `llm` cap's methods.
-*
-* One running llama-server child per node in v1 (models are RAM-heavy).
-* Resource ceiling = llama-server flags + idleStopMinutes ONLY (no RSS
-* watchdog — operator decision #3).
-*/
-var ManagedModelRefSchema = zod.z.discriminatedUnion("kind", [
-	zod.z.object({
-		kind: zod.z.literal("catalog"),
-		catalogId: zod.z.string()
-	}),
-	zod.z.object({
-		kind: zod.z.literal("url"),
-		url: zod.z.string(),
-		sha256: zod.z.string().optional()
+var SystemResourceSnapshotSchema = zod.z.object({
+	cpu: CpuBreakdownSchema,
+	memory: MemoryInfoSchema,
+	gpu: MetricsGpuInfoSchema.nullable(),
+	network: NetworkIoSnapshotSchema,
+	disk: DiskIoSnapshotSchema,
+	pressure: zod.z.object({
+		cpu: PressureInfoSchema.nullable(),
+		memory: PressureInfoSchema.nullable(),
+		io: PressureInfoSchema.nullable()
 	}),
-	zod.z.object({
-		kind: zod.z.literal("path"),
-		path: zod.z.string()
-	})
-]);
-var ManagedRuntimeConfigSchema = zod.z.object({
-	/** WHERE the runtime lives — hub or any agent. */
-	nodeId: zod.z.string(),
-	/** Closed for v1; 'ollama' is a v2 candidate. */
-	engine: zod.z.enum(["llama-cpp"]),
-	model: ManagedModelRefSchema,
-	contextSize: zod.z.number().int().default(4096),
-	/** 0 = CPU-only. */
-	gpuLayers: zod.z.number().int().default(0),
-	/** Default: cpus-2, clamped ≥1 (resolved node-side). */
-	threads: zod.z.number().int().optional(),
-	/** Concurrent slots. */
-	parallel: zod.z.number().int().default(1),
-	/** Else lazy: first generate boots it. */
-	autoStart: zod.z.boolean().default(false),
-	/** 0 = never; frees RAM after quiet periods. */
-	idleStopMinutes: zod.z.number().int().default(30)
+	process: ProcessResourceInfoSchema,
+	cpuTemperature: zod.z.number().nullable(),
+	timestampMs: zod.z.number()
 });
-var LlmRuntimeStatusSchema = zod.z.object({
-	/** Status is ALWAYS node-qualified. */
+var DiskSpaceInfoSchema = zod.z.object({
+	path: zod.z.string(),
+	totalBytes: zod.z.number(),
+	usedBytes: zod.z.number(),
+	availableBytes: zod.z.number(),
+	percent: zod.z.number()
+});
+var PidResourceStatsSchema = zod.z.object({
+	pid: zod.z.number(),
+	cpu: zod.z.number(),
+	memory: zod.z.number(),
+	/**
+	* Private (anonymous) resident bytes — the per-process V8 heap + native
+	* allocations NOT shared with other processes (Linux RssAnon). This is the
+	* "real" per-runner cost; summing it across runners is meaningful, unlike
+	* `memory` (RSS), which double-counts the shared mmap'd framework code.
+	* Undefined where /proc is unavailable (e.g. macOS).
+	*/
+	privateBytes: zod.z.number().optional(),
+	/**
+	* Shared file-backed resident bytes (Linux RssFile) — mmap'd framework/lib
+	* code shared copy-on-write across runners. Undefined on macOS.
+	*/
+	sharedBytes: zod.z.number().optional()
+});
+var AddonInstanceSchema = zod.z.object({
+	addonId: zod.z.string(),
 	nodeId: zod.z.string(),
+	role: zod.z.enum(["hub", "worker"]),
+	pid: zod.z.number(),
 	state: zod.z.enum([
-		"stopped",
-		"downloading",
 		"starting",
-		"ready",
-		"crashed",
-		"failed"
+		"running",
+		"stopping",
+		"stopped",
+		"crashed"
 	]),
-	pid: zod.z.number().optional(),
-	port: zod.z.number().optional(),
-	modelPath: zod.z.string().optional(),
-	modelId: zod.z.string().optional(),
-	downloadProgress: zod.z.number().min(0).max(1).optional(),
-	lastError: zod.z.string().optional(),
-	crashesInWindow: zod.z.number(),
-	/** Child RSS (sampled best-effort). */
-	memoryBytes: zod.z.number().optional(),
-	vramBytes: zod.z.number().optional()
+	uptimeSec: zod.z.number()
 });
-var LlmNodeModelSchema = zod.z.object({
-	file: zod.z.string(),
-	sizeBytes: zod.z.number(),
-	catalogId: zod.z.string().optional(),
-	installedAt: zod.z.number().optional()
+var NodeProcessSchema = zod.z.object({
+	pid: zod.z.number(),
+	ppid: zod.z.number(),
+	pgid: zod.z.number(),
+	classification: zod.z.enum([
+		"root",
+		"managed",
+		"system",
+		"ghost"
+	]),
+	/** `$process` addon binding when `managed`, else null. */
+	addonId: zod.z.string().nullable(),
+	/** Kernel-reported nodeId when the process is a known agent/worker. */
+	nodeId: zod.z.string().nullable(),
+	/** Truncated command line. */
+	command: zod.z.string(),
+	cpuPercent: zod.z.number(),
+	memoryRssBytes: zod.z.number(),
+	/** Wall-clock uptime (seconds). Parsed from `ps etime`. */
+	uptimeSec: zod.z.number(),
+	/** True when ancestor walk reaches `ppid=1` (reparented to init/launchd). */
+	orphaned: zod.z.boolean()
 });
-var LlmRuntimeDiskUsageSchema = zod.z.object({
-	nodeId: zod.z.string(),
-	modelsBytes: zod.z.number(),
-	freeBytes: zod.z.number().optional()
+var KillProcessInputSchema = zod.z.object({
+	pid: zod.z.number(),
+	/** Force = SIGKILL. Default is SIGTERM. */
+	force: zod.z.boolean().optional()
 });
-var LlmRuntimeCompleteInputSchema = LlmGenerateBaseInputSchema.extend({
-	images: zod.z.array(LlmImageSchema).optional(),
-	runtime: ManagedRuntimeConfigSchema,
-	/** The managed profile's timeout, threaded by the hub provider. */
-	timeoutMs: zod.z.number().int().positive().optional()
+var KillProcessResultSchema = zod.z.object({
+	success: zod.z.boolean(),
+	reason: zod.z.string().optional(),
+	signal: zod.z.enum(["SIGTERM", "SIGKILL"]).optional()
 });
-var llmRuntimeCapability = {
-	name: "llm-runtime",
+var DumpHeapSnapshotInputSchema = zod.z.object({ 
+/** The addon whose runner should dump a heap snapshot. */
+addonId: zod.z.string() });
+var DumpHeapSnapshotResultSchema = zod.z.object({
+	success: zod.z.boolean(),
+	/** Path of the written .heapsnapshot inside the runner's container/host. */
+	path: zod.z.string().optional(),
+	/** Process pid that was signalled. */
+	pid: zod.z.number().optional(),
+	reason: zod.z.string().optional()
+});
+var SystemMetricsSchema = zod.z.object({
+	cpuPercent: zod.z.number(),
+	memoryPercent: zod.z.number(),
+	memoryUsedMB: zod.z.number(),
+	memoryTotalMB: zod.z.number(),
+	diskPercent: zod.z.number().optional(),
+	temperature: zod.z.number().optional(),
+	gpuPercent: zod.z.number().optional(),
+	gpuMemoryPercent: zod.z.number().optional()
+});
+var metricsProviderCapability = {
+	name: "metrics-provider",
 	scope: "system",
 	mode: "singleton",
-	internal: true,
 	methods: {
-		complete: require_sleep.method(LlmRuntimeCompleteInputSchema, LlmGenerateResultSchema, { kind: "mutation" }),
-		ensureStarted: require_sleep.method(zod.z.object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		stop: require_sleep.method(zod.z.object({}), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		status: require_sleep.method(zod.z.object({}), LlmRuntimeStatusSchema),
-		installModel: require_sleep.method(zod.z.object({ model: ManagedModelRefSchema }), zod.z.void(), {
+		/** Fresh, full system snapshot (triggers OS-level collection). */
+		collectSnapshot: require_sleep.method(zod.z.void(), SystemResourceSnapshotSchema),
+		/** Most recent cached snapshot from the background sampler, or null pre-first-sample. */
+		getCached: require_sleep.method(zod.z.void(), SystemResourceSnapshotSchema.nullable()),
+		/** Light-weight cached summary for heartbeats and list views. */
+		getCurrent: require_sleep.method(zod.z.void(), SystemMetricsSchema),
+		/** Disk space for the given mount/path. */
+		getDiskSpace: require_sleep.method(zod.z.object({ dirPath: zod.z.string() }), DiskSpaceInfoSchema),
+		/** GPU info (null if unavailable). */
+		getGpuInfo: require_sleep.method(zod.z.void(), MetricsGpuInfoSchema.nullable()),
+		/** CPU temperature in °C (null if unavailable). */
+		getCpuTemperature: require_sleep.method(zod.z.void(), zod.z.number().nullable()),
+		/** Per-PID resource stats. Missing/dead PIDs are omitted from the result. */
+		getProcessStats: require_sleep.method(zod.z.object({ pids: zod.z.array(zod.z.number()) }), zod.z.array(PidResourceStatsSchema)),
+		/**
+		* List addon instances known to this node — one entry per forked worker
+		* plus a synthetic 'hub' entry representing the local hub process.
+		* Used by benchmarks/observability to detect whether a given addon runs
+		* in its own process (measurable independently) or inline with the hub.
+		*/
+		listAddonInstances: require_sleep.method(zod.z.void(), zod.z.array(AddonInstanceSchema).readonly()),
+		/**
+		* Resource stats for the process hosting the given addon.
+		* Returns null when the addon runs in-process on the hub (can't measure
+		* independently — caller should detect via listAddonInstances). Returns
+		* hub process stats for addonId '$hub'.
+		*/
+		getAddonStats: require_sleep.method(zod.z.object({ addonId: zod.z.string() }), PidResourceStatsSchema.nullable()),
+		/**
+		* Snapshot of every camstack-related process on this node with a
+		* ghost/managed/root classification. Powers the Cluster → Agent →
+		* Processes tab: cross-references `$process.list` against a `ps` scan
+		* so orphaned trees (PPID=1) or unknown children show up as `ghost`
+		* and can be killed from the UI.
+		*/
+		listNodeProcesses: require_sleep.method(zod.z.void(), zod.z.array(NodeProcessSchema).readonly()),
+		/**
+		* Send SIGTERM (or SIGKILL when `force`) to a pid inside this node's
+		* process tree. The provider refuses pids that aren't in the live
+		* `listNodeProcesses()` snapshot — callers can't use this endpoint
+		* to kill arbitrary system processes.
+		*/
+		killProcess: require_sleep.method(KillProcessInputSchema, KillProcessResultSchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		deleteModel: require_sleep.method(zod.z.object({ file: zod.z.string() }), zod.z.void(), {
+		/**
+		* Tell the addon's forked runner to write a V8 heap snapshot to disk (via
+		* SIGUSR2 — the runner's diagnostic handler). Also logs its
+		* `process.memoryUsage()` + heap-space breakdown. Refuses pids not in the
+		* live `listNodeProcesses()` snapshot. Use for deep per-addon memory
+		* attribution; copy the returned path off the node to analyze.
+		*/
+		dumpHeapSnapshot: require_sleep.method(DumpHeapSnapshotInputSchema, DumpHeapSnapshotResultSchema, {
 			kind: "mutation",
 			auth: "admin"
-		}),
-		listLocalModels: require_sleep.method(zod.z.object({}), zod.z.array(LlmNodeModelSchema)),
-		getDiskUsage: require_sleep.method(zod.z.object({}), LlmRuntimeDiskUsageSchema)
+		})
 	}
 };
 //#endregion
-//#region src/capabilities/llm.cap.ts
+//#region src/capabilities/model-convert.cap.ts
+var ModelConvertInputSchema = zod.z.object({
+	sourceUrl: zod.z.string(),
+	metadata: ModelConvertMetadataSchema,
+	targets: zod.z.array(ConvertTargetSchema).min(1).readonly(),
+	calibrationRef: zod.z.string().optional(),
+	sessionId: zod.z.string().optional()
+});
+var modelConvertCapability = {
+	name: "model-convert",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: { convert: require_sleep.method(ModelConvertInputSchema, ConvertResultSchema, {
+		kind: "mutation",
+		auth: "admin",
+		timeoutMs: 6e5
+	}) }
+};
+//#endregion
+//#region src/capabilities/model-distributor.cap.ts
 /**
-* `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
-* methods concat-fan across providers; single-row methods route to ONE
-* provider by the `addonId` in the call input (the notification-output
-* posture, notification-output.cap.ts:215-250). Provided by `addon-ai`
-* (hub-placed); the cap stays open for future providers.
+* `model-distributor` — singleton, hub-resident. Pushes a model FORMAT that is
+* already present on the hub's `/data/models` to a target agent node's
+* `/data/models`, sha256-verified, reusing the agent-pull machinery
+* (DeployStageRegistry + the one-time-token bundle route + the agent's
+* `fetchBundleFromHub`). Its provider is built in `server/backend` because it
+* needs the Moleculer broker + the deploy-stage registry, which a forked addon
+* can't reach. `addon-model-studio` drives it via `ctx.api` and owns the
+* per-node availability map.
+*/
+var ModelDistributeInputSchema = zod.z.object({
+	nodeId: zod.z.string(),
+	modelId: zod.z.string(),
+	format: zod.z.enum(MODEL_FORMATS),
+	entry: ModelCatalogEntrySchema
+});
+var ModelDistributeResultSchema = zod.z.object({
+	ok: zod.z.boolean(),
+	/** sha256 of the staged tarball (empty for a hub-local no-op). */
+	sha256: zod.z.string(),
+	bytes: zod.z.number(),
+	/** The target node's modelsDir the artifact landed in. */
+	path: zod.z.string()
+});
+var modelDistributorCapability = {
+	name: "model-distributor",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: { distributeModel: require_sleep.method(ModelDistributeInputSchema, ModelDistributeResultSchema, {
+		kind: "mutation",
+		auth: "admin"
+	}) }
+};
+//#endregion
+//#region src/capabilities/mqtt-broker.cap.ts
+/**
+* `mqtt-broker` — broker-registry cap.
 *
-* Profiles are ROWS (data), not addons: one row = one usable model endpoint.
-* `apiKey` is a password field — providers REDACT it on read and merge on
-* write; a stored key NEVER round-trips to a client.
+* NOT a pub/sub proxy. The cap exposes (a) a registry of configured
+* MQTT brokers (external + optionally an embedded `aedes`-backed one)
+* and (b) the connection details a consumer addon needs to spin up
+* its OWN `mqtt.js` client.
+*
+* Why: pub/sub routing over the system event-bus loses fidelity
+* (callback shape, QoS guarantees, will/retain semantics) and adds
+* refcount bookkeeping that addons would rather own themselves. The
+* canonical consumer (`addon-export-ha-mqtt`) needs raw `mqtt.js`
+* features anyway — give it the connection config, get out of the way.
+*
+* Consumer flow:
+*   const cfg = await ctx.api.mqttBroker.getBrokerConfig({ id })
+*   const client = mqtt.connect(cfg.url, { username: cfg.username, … })
+*   client.subscribe('zigbee2mqtt/+')
+*
+* Collection mode: multiple brokers (e.g. one local mosquitto + one
+* cloud bridge). The "embedded" entry (when present) is just another
+* broker in the registry — its lifecycle is owned by the addon that
+* spawned it.
 */
-var LlmProfileKindSchema = zod.z.enum([
-	"openai-compatible",
-	"openai",
-	"anthropic",
-	"google",
-	"managed-local"
+var BrokerKindSchema = zod.z.enum(["external", "embedded"]);
+/**
+* Broker live-probe status.
+*
+* - `connected` — last probe completed a clean CONNACK
+* - `disconnected` — no probe has run yet (cold cache)
+* - `auth-failed` — CONNACK refused with auth error (RC 4 / 5)
+* - `unreachable` — TCP connect timed out / refused
+* - `tls-error` — TLS handshake failed (cert / SNI / cipher)
+*/
+var BrokerStatusSchema$1 = zod.z.enum([
+	"connected",
+	"disconnected",
+	"auth-failed",
+	"unreachable",
+	"tls-error"
 ]);
-var LlmProfileSchema = zod.z.object({
+var BrokerInfoSchema = zod.z.object({
 	id: zod.z.string(),
 	name: zod.z.string(),
-	kind: LlmProfileKindSchema,
-	/** Stamped by the provider — keeps the fanned catalog routable. */
-	addonId: zod.z.string(),
-	enabled: zod.z.boolean(),
-	/** Vendor model id, or the managed runtime's loaded model. */
-	model: zod.z.string(),
-	/** Required for openai-compatible; override for cloud kinds. */
-	baseUrl: zod.z.string().optional(),
-	/** ConfigUISchema type:'password' — never round-trips (spec §5). */
-	apiKey: zod.z.string().optional(),
-	supportsVision: zod.z.boolean(),
-	temperature: zod.z.number().min(0).max(2).optional(),
-	maxTokens: zod.z.number().int().positive().optional(),
-	timeoutMs: zod.z.number().int().positive().default(6e4),
-	extraHeaders: zod.z.record(zod.z.string(), zod.z.string()).optional(),
-	/** kind === 'managed-local' only (spec §4). */
-	runtime: ManagedRuntimeConfigSchema.optional()
+	url: zod.z.string(),
+	kind: BrokerKindSchema,
+	status: BrokerStatusSchema$1,
+	latencyMs: zod.z.number().nullable(),
+	error: zod.z.string().optional(),
+	/** Embedded brokers only: number of MQTT clients currently connected. */
+	connectedClients: zod.z.number().int().nonnegative().optional(),
+	/** Epoch ms of the last live probe (external) or aedes snapshot (embedded). */
+	lastCheckedAt: zod.z.number().optional()
 });
-/** ConfigUISchema tree passed through untyped on the wire (the
-*  notification-output `ConfigSchemaPassthrough` precedent at
-*  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough = zod.z.unknown();
-var LlmProfileKindDescriptorSchema = zod.z.object({
-	kind: LlmProfileKindSchema,
-	label: zod.z.string(),
-	icon: zod.z.string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: zod.z.string(),
-	configSchema: ConfigSchemaPassthrough
+/**
+* Connection details — what a consumer needs to call
+* `mqtt.connect(url, options)`. We split URL + credentials so the
+* consumer can pass them as `mqtt.connect(url, { username, password })`
+* instead of stuffing creds into the URL (which leaks them into logs).
+*/
+var BrokerConnectionDetailsSchema = zod.z.object({
+	url: zod.z.string(),
+	username: zod.z.string().optional(),
+	password: zod.z.string().optional(),
+	/**
+	* Suggested prefix for `clientId`. Each consumer should suffix this
+	* with its own discriminator (addon id, instance id) so reconnects
+	* don't kick each other off (MQTT spec: clientId must be unique per
+	* broker).
+	*/
+	clientIdPrefix: zod.z.string().optional()
 });
-var LlmDefaultSelectorSchema = zod.z.union([zod.z.object({ consumer: zod.z.string() }), zod.z.object({ purpose: zod.z.enum(["text", "vision"]) })]);
-var LlmDefaultSchema = zod.z.object({
-	selector: LlmDefaultSelectorSchema,
-	profileId: zod.z.string()
+var AddBrokerInputSchema = zod.z.object({
+	name: zod.z.string().min(1),
+	url: zod.z.string().regex(/^(mqtt|mqtts|ws|wss):\/\//, "URL must start with mqtt(s):// or ws(s)://"),
+	username: zod.z.string().optional(),
+	password: zod.z.string().optional(),
+	clientIdPrefix: zod.z.string().optional()
 });
-/** Server-side rollup row — getUsage never dumps raw call rows (spec §6). */
-var LlmUsageRollupSchema = zod.z.object({
-	day: zod.z.string(),
-	consumer: zod.z.string(),
-	profileId: zod.z.string(),
-	calls: zod.z.number(),
-	okCalls: zod.z.number(),
-	errorCalls: zod.z.number(),
-	inputTokens: zod.z.number(),
-	outputTokens: zod.z.number(),
-	avgLatencyMs: zod.z.number()
+var AddBrokerResultSchema = zod.z.object({ id: zod.z.string() });
+var IdInputSchema = zod.z.object({ id: zod.z.string() });
+var TestResultSchema$1 = zod.z.discriminatedUnion("ok", [zod.z.object({
+	ok: zod.z.literal(true),
+	latencyMs: zod.z.number()
+}), zod.z.object({
+	ok: zod.z.literal(false),
+	error: zod.z.string()
+})]);
+var StartEmbeddedInputSchema = zod.z.object({
+	port: zod.z.number().int().min(1).max(65535).default(1883),
+	/** Allow anonymous connect (no username/password). Default: false. */
+	allowAnonymous: zod.z.boolean().default(false),
+	/** Optional shared username/password for clients. */
+	username: zod.z.string().optional(),
+	password: zod.z.string().optional()
+});
+var StartEmbeddedResultSchema = zod.z.object({
+	id: zod.z.string(),
+	url: zod.z.string()
+});
+var StatusSchema = zod.z.object({
+	brokerCount: zod.z.number(),
+	embeddedRunning: zod.z.boolean()
+});
+var mqttBrokerCapability = {
+	name: "mqtt-broker",
+	scope: "system",
+	mode: "collection",
+	providerKind: "broker",
+	status: {
+		schema: StatusSchema,
+		kind: "poll"
+	},
+	methods: {
+		listBrokers: require_sleep.method(zod.z.void(), zod.z.array(BrokerInfoSchema)),
+		getBrokerConfig: require_sleep.method(IdInputSchema, BrokerConnectionDetailsSchema),
+		addBroker: require_sleep.method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }),
+		removeBroker: require_sleep.method(IdInputSchema, zod.z.void(), { kind: "mutation" }),
+		testConnection: require_sleep.method(IdInputSchema, TestResultSchema$1, { kind: "mutation" }),
+		startEmbeddedBroker: require_sleep.method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }),
+		stopEmbeddedBroker: require_sleep.method(IdInputSchema, zod.z.void(), { kind: "mutation" }),
+		getStatus: require_sleep.method(zod.z.void(), StatusSchema)
+	}
+};
+//#endregion
+//#region src/capabilities/network-access.cap.ts
+var NetworkEndpointSchema = zod.z.object({
+	url: zod.z.string(),
+	hostname: zod.z.string(),
+	port: zod.z.number(),
+	protocol: zod.z.enum(["http", "https"])
+});
+var NetworkAccessStatusSchema = zod.z.object({
+	connected: zod.z.boolean(),
+	endpoint: NetworkEndpointSchema.nullable(),
+	error: zod.z.string().optional()
+});
+/**
+* Optional, richer endpoint shape returned by providers that expose
+* MORE than one ingress concurrently (Tailscale Ingress with mixed
+* serve+funnel rules, future ngrok multi-tunnel, …). Each entry carries
+* the originating provider config (mode + sourcePort) so the
+* orchestrator UI can label rows distinctly. Providers that expose only
+* one endpoint just omit `listEndpoints` from their provider impl.
+*/
+var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
+	/**
+	* Stable id within the provider — typically `<mode>-<sourcePort>` so
+	* the orchestrator can dedupe across `listEndpoints` polls.
+	*/
+	id: zod.z.string(),
+	/** Operator-facing label (mirrors `MeshEndpoint.label`). */
+	label: zod.z.string(),
+	/** Optional provider-specific mode tag, used for icon/colour in admin UI. */
+	mode: zod.z.string().optional(),
+	/** Originating local port the ingress fronts (informational). */
+	sourcePort: zod.z.number().optional()
+});
+var networkAccessCapability = {
+	name: "network-access",
+	scope: "system",
+	mode: "collection",
+	providerKind: "ingress",
+	methods: {
+		start: require_sleep.method(zod.z.void(), NetworkEndpointSchema, { kind: "mutation" }),
+		stop: require_sleep.method(zod.z.void(), zod.z.void(), { kind: "mutation" }),
+		getEndpoint: require_sleep.method(zod.z.void(), NetworkEndpointSchema.nullable()),
+		getStatus: require_sleep.method(zod.z.void(), NetworkAccessStatusSchema),
+		/**
+		* Enumerate every active ingress entry. Providers that expose only a
+		* single endpoint may omit this method; callers fall back to
+		* `getEndpoint()` in that case.
+		*/
+		listEndpoints: require_sleep.method(zod.z.void(), zod.z.array(NetworkEndpointEntrySchema).readonly())
+	}
+};
+//#endregion
+//#region src/capabilities/notification-output.cap.ts
+/**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = zod.z.enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = zod.z.object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: zod.z.string().optional(),
+	bytes: zod.z.instanceof(Uint8Array).optional(),
+	mime: zod.z.string().optional(),
+	name: zod.z.string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = zod.z.enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	url: zod.z.string().optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = zod.z.object({
+	body: zod.z.string(),
+	title: zod.z.string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: zod.z.number().int().min(1).max(5).default(3),
+	level: zod.z.string().optional(),
+	attachments: zod.z.array(AttachmentSchema).optional(),
+	clickUrl: zod.z.string().optional(),
+	actions: zod.z.array(NotificationActionSchema).optional(),
+	sound: zod.z.string().optional(),
+	ttl: zod.z.number().optional(),
+	tag: zod.z.string().optional(),
+	deviceId: zod.z.number().optional(),
+	eventId: zod.z.string().optional(),
+	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: zod.z.number().int().min(1).max(5).nullable(),
+	flags: zod.z.object({
+		critical: zod.z.boolean().optional(),
+		silent: zod.z.boolean().optional(),
+		noPush: zod.z.boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: zod.z.array(zod.z.string()).optional(),
+	description: zod.z.string().optional()
+});
+/** Attachment capabilities for a kind (drives the degrade engine + test panel). */
+var TargetKindAttachmentsCapsSchema = zod.z.object({
+	mediaTypes: zod.z.array(AttachmentMediaTypeSchema),
+	mode: zod.z.enum([
+		"url",
+		"bytes",
+		"both"
+	]),
+	max: zod.z.number().int().nonnegative(),
+	maxBytes: zod.z.number().int().positive().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = zod.z.object({
+	attachments: TargetKindAttachmentsCapsSchema,
+	/** Max action buttons (0 = none). */
+	actions: zod.z.number().int().nonnegative(),
+	levels: zod.z.array(TargetKindLevelSchema),
+	format: zod.z.array(NotificationFormatSchema),
+	clickUrl: zod.z.boolean(),
+	sound: zod.z.boolean(),
+	ttl: zod.z.boolean(),
+	bodyMaxLen: zod.z.number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough = zod.z.unknown();
+var TargetKindSchema = zod.z.object({
+	kind: zod.z.string(),
+	label: zod.z.string(),
+	icon: zod.z.string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: zod.z.string(),
+	configSchema: ConfigSchemaPassthrough,
+	supportsDiscovery: zod.z.boolean(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	kind: zod.z.string(),
+	addonId: zod.z.string(),
+	enabled: zod.z.boolean(),
+	config: zod.z.record(zod.z.string(), zod.z.unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = zod.z.object({
+	kind: zod.z.string(),
+	suggestedName: zod.z.string(),
+	config: zod.z.record(zod.z.string(), zod.z.unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = zod.z.object({
+	level: zod.z.string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: zod.z.number().int().nonnegative(),
+	actionsSent: zod.z.number().int().nonnegative(),
+	truncated: zod.z.boolean(),
+	dropped: zod.z.array(zod.z.string())
+});
+var SendResultSchema = zod.z.object({
+	success: zod.z.boolean(),
+	error: zod.z.string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+var notificationOutputCapability = {
+	name: "notification-output",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		listTargetKinds: require_sleep.method(zod.z.object({}), zod.z.array(TargetKindSchema)),
+		listTargets: require_sleep.method(zod.z.object({}), zod.z.array(TargetSchema)),
+		discoverTargets: require_sleep.method(zod.z.object({
+			kind: zod.z.string(),
+			config: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+		}), zod.z.array(DiscoveredTargetSchema)),
+		send: require_sleep.method(zod.z.object({
+			targetId: zod.z.string(),
+			notification: NotificationSchema
+		}), SendResultSchema, { kind: "mutation" }),
+		testTarget: require_sleep.method(zod.z.object({
+			targetId: zod.z.string(),
+			sample: NotificationSchema.optional()
+		}), TestResultSchema, { kind: "mutation" }),
+		upsertTarget: require_sleep.method(zod.z.object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }),
+		deleteTarget: require_sleep.method(zod.z.object({ targetId: zod.z.string() }), zod.z.void(), { kind: "mutation" }),
+		setTargetEnabled: require_sleep.method(zod.z.object({
+			targetId: zod.z.string(),
+			enabled: zod.z.boolean()
+		}), zod.z.void(), { kind: "mutation" })
+	}
+};
+//#endregion
+//#region src/capabilities/notification-rules.cap.ts
+/**
+* notification-rules — the Notification Center rule surface (P1 core).
+*
+* Spec: `docs/superpowers/specs/2026-07-22-notification-center-requirements.md`
+* (operator decisions D-1/D-2/D-3 are binding):
+*
+*  - D-2: rule EVALUATION lives in `addon-post-analysis` (the
+*    `notification-center` module), hooked on the durable persistence
+*    moments (object-event insert, TrackCloser.closeExpired) with a
+*    persisted outbox + retry — never the lossy telemetry bus (D8).
+*  - D-3: urgency belongs to the RULE. `delivery: 'immediate'` fires on the
+*    FIRST persisted detection matching the conditions (per-track dedup,
+*    `maxPerTrack` fixed at 1 — see {@link NC_MAX_PER_TRACK_IMMEDIATE});
+*    `delivery: 'track-end'` evaluates the finalized track record at close.
+*  - DISPATCH stays behind `notification-output` (rules reference targets
+*    by id; per-backend params are a passthrough blob capped by the
+*    target kind's own caps/degrade engine).
+*
+* P1 scope: admin-authored rules only (`createdBy` stamped from the
+* server-injected caller identity — the first `caller: 'required'`
+* adopter). The P1 condition subset is: devices, classes(+exclude),
+* minConfidence, admin zones (any/all + exclude), weekly schedule
+* windows, and the optional label/identity/plate matchers. User rules,
+* private zones, per-recipient fan-out and the wider condition table are
+* P2+ (see spec §7).
+*
+* All schemas here are the single source of truth — `NcRule` etc. are
+* `z.infer` exports; no duplicate interfaces (the advanced-notifier
+* schema/interface drift is explicitly not repeated).
+*/
+/**
+* D-3: the trigger/urgency of a rule — which persistence moment evaluates it.
+* The value maps 1:1 onto the evaluated record kind:
+*  - `immediate`     ↔ object-event persist (lowest-latency detection burst)
+*  - `track-end`     ↔ TrackCloser.closeExpired (finalized track record)
+*  - `device-event`  ↔ SensorEventStore insert (doorbell press / sensor state
+*                       change of a LINKED device, one row per linked camera)
+*  - `package-event` ↔ PackageDropDetector object-event insert (a `package`
+*                       delivery / pick-up)
+*
+* `immediate`/`track-end` carry the D-3 urgency semantics; `device-event`/
+* `package-event` are pure trigger kinds (no urgency dimension). Extending
+* this one field keeps the schema additive — a rule still declares exactly
+* one trigger.
+*/
+var NcDeliverySchema = zod.z.enum([
+	"immediate",
+	"track-end",
+	"device-event",
+	"package-event"
+]);
+/**
+* `maxPerTrack` for `immediate` rules is FIXED at 1 (D-3): a single track
+* fires an immediate rule at most once, enforced durably by the outbox
+* unique key `(ruleId, trackId, targetId)`. Not a rule field in P1.
+*/
+var NC_MAX_PER_TRACK_IMMEDIATE = 1;
+/** One weekly activation window. `startMinute > endMinute` crosses midnight. */
+var NcScheduleWindowSchema = zod.z.object({
+	/** Days of week the window STARTS on (0 = Sunday … 6 = Saturday). */
+	days: zod.z.array(zod.z.number().int().min(0).max(6)).min(1),
+	startMinute: zod.z.number().int().min(0).max(1439),
+	endMinute: zod.z.number().int().min(0).max(1439)
+});
+/** Weekly schedule — OR of windows; absence on the rule = always active. */
+var NcScheduleSchema = zod.z.object({
+	windows: zod.z.array(NcScheduleWindowSchema).min(1),
+	/** IANA timezone; default = hub host timezone. */
+	timezone: zod.z.string().optional(),
+	/** Active OUTSIDE the windows (e.g. "only outside business hours"). */
+	invert: zod.z.boolean().optional()
+});
+/** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
+var NcPlateMatcherSchema = zod.z.object({
+	values: zod.z.array(zod.z.string().min(1)).min(1),
+	/** Max Levenshtein distance after normalization (uppercase alphanumeric). */
+	maxDistance: zod.z.number().int().min(0).max(3).default(1)
+});
+/**
+* Occupancy condition (DEVICE-EVENT trigger). Fires on a ZoneAnalytics
+* occupancy edge for a device — optionally narrowed to a single admin
+* `zoneId` and/or object `className`. `op` selects the edge/threshold:
+*  - `became-occupied` (default) — count crossed 0 → ≥ `count`
+*  - `became-free`               — count crossed ≥ `count` → below it
+*  - `>=` / `<=`                 — count is at/over or at/under `count`
+* `sustainSeconds` requires the condition hold continuously that long
+* before firing (debounces flicker; 0 = fire on the first matching edge).
+* Fail-closed: no ZoneAnalytics snapshot / missing zone / null snapshot ⇒
+* the condition never matches. Confirmed edge-state survives addon restarts
+* (declared SQLite collection, reseeded on boot).
+*/
+var NcOccupancyConditionSchema = zod.z.object({
+	/** Admin zone id to scope the count to; absent = whole-frame occupancy. */
+	zoneId: zod.z.string().optional(),
+	/** Object class to count; absent = any class. */
+	className: zod.z.string().optional(),
+	op: zod.z.enum([
+		"became-occupied",
+		"became-free",
+		">=",
+		"<="
+	]).default("became-occupied"),
+	count: zod.z.number().int().min(0).default(1),
+	sustainSeconds: zod.z.number().int().min(0).max(3600).default(15)
+});
+/** Admin-zone membership condition (zone IDs as stamped by the ZoneEngine). */
+var NcZoneConditionSchema = zod.z.object({
+	ids: zod.z.array(zod.z.string().min(1)).min(1),
+	/** Quantifier over `ids` — at least one / every one visited. */
+	match: zod.z.enum(["any", "all"]).default("any")
+});
+/**
+* The P1 condition set — a flat AND of groups; absent group = pass;
+* membership lists are OR within the list (spec §2.3).
+*/
+var NcConditionsSchema = zod.z.object({
+	/** Device scope — absent = all devices. */
+	devices: zod.z.array(zod.z.number()).optional(),
+	/** Detector class names (any overlap with the record's class set). */
+	classes: zod.z.array(zod.z.string().min(1)).optional(),
+	/** Veto classes — any overlap fails the rule. */
+	classesExclude: zod.z.array(zod.z.string().min(1)).optional(),
+	/** Minimum detection confidence 0–1 (fails when the record has none). */
+	minConfidence: zod.z.number().min(0).max(1).optional(),
+	/** Admin zone membership over event `zones` / track `zonesVisited`. */
+	zones: NcZoneConditionSchema.optional(),
+	/** Veto zones — any hit fails the rule. */
+	zonesExclude: zod.z.array(zod.z.string().min(1)).optional(),
+	/**
+	* Exact (case-insensitive) match on the record's collapsed `label`
+	* (identity name / plate text / subclass).
+	*/
+	labelEquals: zod.z.array(zod.z.string().min(1)).optional(),
+	/**
+	* Identity matcher. P1 boundary: matched against the record's collapsed
+	* `label` (the identity display name propagated by the face pipeline) —
+	* identity-ID matching rides in P2 when identity ids reach the record.
+	*/
+	identities: zod.z.array(zod.z.string().min(1)).optional(),
+	/** Fuzzy plate matcher against the record's `label` (plate text). */
+	plates: NcPlateMatcherSchema.optional(),
+	/**
+	* Identity EXCLUDE — mirror of {@link identities} with `notIn` semantics.
+	* Same P1 boundary: matched against the record's collapsed `label` (the
+	* identity display name). A record with NO label passes (nothing to
+	* exclude), unlike the include variant which fails on an absent label.
+	*/
+	identitiesExclude: zod.z.array(zod.z.string().min(1)).optional(),
+	/**
+	* Minimum server-computed key-event importance in [0,1] (`Track.importance`).
+	* TRACK-END only: importance is scored at track close, so it does not exist
+	* at immediate / object-event evaluation time (see catalog `appliesTo`). At
+	* close the value is threaded via the close-time info (the `Track` clone is
+	* captured before the DB row is updated, so it would otherwise read stale).
+	* Fails when the record carries no importance (never guess quality — the
+	* `minConfidence` precedent). MVP cut: a single scalar threshold.
+	*/
+	minImportance: zod.z.number().min(0).max(1).optional(),
+	/**
+	* Minimum track dwell in SECONDS — `(lastSeen − firstSeen) / 1000`.
+	* TRACK-END only: an `immediate` / object-event subject has no closed
+	* lifespan, so a dwell condition never matches immediate delivery
+	* (documented choice — the object-event record carries no `firstSeen`,
+	* so dwell cannot be computed from what the subject actually carries).
+	*/
+	minDwellSeconds: zod.z.number().min(0).optional(),
+	/**
+	* Detection provenance filter. `any` (default / absent) matches every
+	* source; otherwise the subject's source must equal it. Legacy records
+	* with no stamped source are treated as `pipeline`. The union spans both
+	* record kinds — object events carry `pipeline` | `onboard`, synthetic
+	* tracks carry `sensor`.
+	*/
+	source: zod.z.enum([
+		"pipeline",
+		"onboard",
+		"sensor",
+		"any"
+	]).optional(),
+	/**
+	* Minimum identity / plate MATCH confidence in [0,1] — DISTINCT from the
+	* detector `minConfidence` (that gates the object-detection score; this
+	* gates the recognition/OCR match score). Fails when the subject carries
+	* no label-match confidence (never guess). TRACK-END only: the confidence
+	* lives on the recognition result and reaches the subject at track close.
+	*
+	* What it measures precisely (plumbed at track close — the closer threads
+	* the value into `NcTrackClosedInfo.labelConfidence`, the same seam as
+	* `importance`): the BEST recognition match confidence observed for the
+	* label the track carries at close — for a face, the peak cosine similarity
+	* of the ASSIGNED identity (`FaceMatch.score`, reset on an identity switch);
+	* for a plate, the peak OCR read score of the best-held plate
+	* (`plateText.confidence`). When BOTH a face and a plate were recognized on
+	* one track the higher of the two is used. A track that ended with no
+	* confident identity/plate match carries no value, so the condition fails
+	* closed for it (an un-recognized subject).
+	*/
+	minLabelConfidence: zod.z.number().min(0).max(1).optional(),
+	/**
+	* DEVICE-EVENT only. Raw device event-type tokens (`EventFire.eventType`,
+	* e.g. a doorbell `press` / `press_long`) — matched case-insensitively
+	* against the token carried on the device-event subject (extracted from the
+	* event-emitter runtime slice's `lastEvent.eventType`). Fails when the
+	* subject carries no token. Doorbell-pulse / passive-sensor kinds emit no
+	* eventType, so gate those with {@link sensorKinds} instead.
+	*/
+	eventTypeTokens: zod.z.array(zod.z.string().min(1)).optional(),
+	/**
+	* DEVICE-EVENT only. Sensor/control taxonomy kinds (e.g. `doorbell`,
+	* `contact`, `button`, `device-event`) — matched against the persisted
+	* `SensorEvent.kind` (see `sensor-event-kinds.ts`). Membership is OR.
+	*/
+	sensorKinds: zod.z.array(zod.z.string().min(1)).optional(),
+	/**
+	* PACKAGE-EVENT only. Which package phase fires the rule — `delivered`
+	* (a parked parcel appeared), `picked-up` (it departed), or `both`. Fails
+	* when the subject's phase does not match (a subject always carries a phase
+	* on the package-event trigger).
+	*/
+	packagePhase: zod.z.enum([
+		"delivered",
+		"picked-up",
+		"both"
+	]).optional(),
+	/**
+	* PERSONAL-RULE custom zones (viewer-drawn). Inline normalized polygons
+	* (MaskShape vocabulary). A record passes when its bbox overlaps ANY
+	* listed polygon (ZoneEngine membership semantics). Evaluated only when
+	* the subject carries a bbox; absent bbox ⇒ the condition FAILS.
+	*/
+	customZones: zod.z.array(MaskPolygonShapeSchema).optional(),
+	/**
+	* DEVICE-EVENT only. ZoneAnalytics occupancy edge — fires when a device's
+	* (optionally zone/class-scoped) occupancy count crosses the configured
+	* threshold and holds for `sustainSeconds`. Fail-closed on missing
+	* substrate (no snapshot / missing zone). See {@link NcOccupancyCondition}.
+	*/
+	occupancy: NcOccupancyConditionSchema.optional()
+});
+/** One delivery target: a `notification-output` Target ref + passthrough params. */
+var NcRuleTargetSchema = zod.z.object({
+	/** `notification-output` Target id. */
+	targetId: zod.z.string().min(1),
+	/**
+	* Per-backend passthrough. Recognized keys are mapped onto the canonical
+	* Notification (`priority`, `level`, `sound`, `clickUrl`, `ttl`); the
+	* degrade engine drops what the backend can't render.
+	*/
+	params: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+});
+/**
+* Media attachment policy (P1 still-image subset).
+*  - `best` — the best AVAILABLE subject image at dispatch time (D-3).
+*  - `best-matching` — the media that explains WHY the rule fired: a rule
+*    matched on identities attaches the subject's `faceCrop`, one matched on
+*    plates attaches the `plateCrop`; a rule with no identity/plate condition
+*    (or when the specific crop is missing) degrades to `best`, then
+*    `keyFrame`, then no attachment — never delaying the send. The matched
+*    condition summary is frozen on the outbox row at enqueue (like the rule
+*    name), so the choice never drifts from the record that fired it.
+*  - `keyFrame` — the clean scene frame (no subject box).
+*  - `none` — no attachment.
+*/
+var NcMediaPolicySchema = zod.z.object({ attach: zod.z.enum([
+	"best",
+	"best-matching",
+	"keyFrame",
+	"none"
+]).default("best") });
+/** Throttle — cooldown survives restarts (rebuilt from the outbox on boot). */
+var NcThrottleSchema = zod.z.object({
+	cooldownSec: zod.z.number().int().min(0).max(86400).default(60),
+	/** `rule` = one shared cooldown; `rule-device` = per-camera cooldown. */
+	scope: zod.z.enum(["rule", "rule-device"]).default("rule-device")
+});
+/** Client-supplied rule fields (server stamps id/createdBy/createdAt/updatedAt). */
+var NcRuleInputSchema = zod.z.object({
+	name: zod.z.string().min(1).max(200),
+	enabled: zod.z.boolean().default(true),
+	delivery: NcDeliverySchema,
+	conditions: NcConditionsSchema.default({}),
+	schedule: NcScheduleSchema.optional(),
+	targets: zod.z.array(NcRuleTargetSchema).min(1),
+	media: NcMediaPolicySchema.default({ attach: "best" }),
+	throttle: NcThrottleSchema.default({
+		cooldownSec: 60,
+		scope: "rule-device"
+	}),
+	/** `{{var}}` templating over camera/class/label/zones/confidence/time. */
+	template: zod.z.object({
+		title: zod.z.string().max(500).optional(),
+		body: zod.z.string().max(2e3).optional()
+	}).optional(),
+	/** Canonical notification priority ordinal (1..5); per-target overridable. */
+	priority: zod.z.number().int().min(1).max(5).default(3),
+	/**
+	* Ownership/visibility key. Absent = admin/global rule (unchanged legacy
+	* behaviour, visible to all, read-only in the viewer). Present = personal
+	* rule owned by this userId. Server-stamped; never trusted from a client.
+	*/
+	ownerUserId: zod.z.string().optional()
+});
+/**
+* Partial patch for `updateRule` — any subset of the input fields, plus the
+* persisted-only {@link NcRuleSchema} `disabledTargetIds` set. The latter is
+* NOT a client-authored input field (it lives on the persisted rule, not the
+* input), so it is added here explicitly to let the store's per-target opt-out
+* toggle round-trip through the shared `update` path. Viewer opt-out mutations
+* still flow through `nc.setRuleTargetEnabled` (owner-checked), never a raw
+* `updateRule` patch.
+*/
+var NcRulePatchSchema = NcRuleInputSchema.partial().extend({ disabledTargetIds: zod.z.array(zod.z.string()).optional() });
+/** A persisted rule. */
+var NcRuleSchema = NcRuleInputSchema.extend({
+	id: zod.z.string(),
+	/** userId of the admin who created the rule (server-stamped caller). */
+	createdBy: zod.z.string(),
+	createdAt: zod.z.number(),
+	updatedAt: zod.z.number(),
+	/**
+	* Per-target opt-out set. A targetId here is suppressed for THIS rule at
+	* send time. Only a target's OWNER may add/remove its id (server-checked
+	* in `nc.setRuleTargetEnabled`). Defaults to empty.
+	*/
+	disabledTargetIds: zod.z.array(zod.z.string()).default([])
+});
+var NcTestResultSchema = zod.z.object({
+	recordId: zod.z.string(),
+	recordKind: zod.z.enum([
+		"object-event",
+		"track",
+		"device-event",
+		"package-event"
+	]),
+	deviceId: zod.z.number(),
+	timestamp: zod.z.number(),
+	wouldFire: zod.z.boolean(),
+	/** Condition id that failed (first failing group), when `wouldFire` is false. */
+	failedCondition: zod.z.string().optional(),
+	className: zod.z.string().optional(),
+	label: zod.z.string().optional()
 });
-/** LLM-facing view over the reused ModelCatalogEntry mechanism (spec §4.2). */
-var ManagedModelCatalogEntrySchema = zod.z.object({
+var NcConditionDescriptorSchema = zod.z.object({
+	/** Field id inside `NcConditions` (or `'schedule'` for the rule-level group). */
 	id: zod.z.string(),
+	group: zod.z.enum([
+		"scope",
+		"class",
+		"zones",
+		"quality",
+		"label",
+		"schedule",
+		"device",
+		"package",
+		"occupancy"
+	]),
 	label: zod.z.string(),
-	family: zod.z.string(),
-	purpose: zod.z.enum(["text", "vision"]),
-	url: zod.z.string(),
-	sha256: zod.z.string(),
-	sizeBytes: zod.z.number(),
-	quantization: zod.z.string(),
-	/** Load-time guidance shown in the picker. */
-	minRamBytes: zod.z.number(),
-	contextSizeDefault: zod.z.number().int(),
-	/** Vision models: companion projector file. */
-	mmprojUrl: zod.z.string().optional()
+	/** Editor widget the UI renders — never hardcode per-condition forms. */
+	valueType: zod.z.enum([
+		"deviceIdList",
+		"stringList",
+		"number01",
+		"number",
+		"sourceSelect",
+		"zoneSelection",
+		"zoneIdList",
+		"schedule",
+		"plateMatcher",
+		"packagePhase",
+		"polygonDraw",
+		"occupancy"
+	]),
+	operator: zod.z.enum([
+		"in",
+		"notIn",
+		"anyOf",
+		"allOf",
+		"gte",
+		"fuzzyIn",
+		"withinSchedule"
+	]),
+	/** Which delivery kinds the condition applies to. */
+	appliesTo: zod.z.array(NcDeliverySchema),
+	phase: zod.z.string(),
+	description: zod.z.string().optional()
 });
-var LlmRuntimeNodeSchema = zod.z.object({
-	nodeId: zod.z.string(),
-	reachable: zod.z.boolean(),
-	status: LlmRuntimeStatusSchema.optional(),
-	disk: LlmRuntimeDiskUsageSchema.optional(),
-	error: zod.z.string().optional()
+/**
+* The P1 condition surface as data — served by `getConditionCatalog` so
+* rule editors render from the catalog, not hardcoded forms (spec §4.2).
+*/
+var NC_CONDITION_CATALOG = [
+	{
+		id: "devices",
+		group: "scope",
+		label: "Cameras",
+		valueType: "deviceIdList",
+		operator: "in",
+		appliesTo: [
+			"immediate",
+			"track-end",
+			"device-event",
+			"package-event"
+		],
+		phase: "P1",
+		description: "Restrict the rule to these devices; absent = all devices."
+	},
+	{
+		id: "classes",
+		group: "class",
+		label: "Object classes",
+		valueType: "stringList",
+		operator: "in",
+		appliesTo: [
+			"immediate",
+			"track-end",
+			"package-event"
+		],
+		phase: "P1",
+		description: "Any overlap with the detection class set passes."
+	},
+	{
+		id: "classesExclude",
+		group: "class",
+		label: "Excluded classes",
+		valueType: "stringList",
+		operator: "notIn",
+		appliesTo: [
+			"immediate",
+			"track-end",
+			"package-event"
+		],
+		phase: "P1"
+	},
+	{
+		id: "minConfidence",
+		group: "quality",
+		label: "Minimum confidence",
+		valueType: "number01",
+		operator: "gte",
+		appliesTo: [
+			"immediate",
+			"track-end",
+			"package-event"
+		],
+		phase: "P1"
+	},
+	{
+		id: "zones",
+		group: "zones",
+		label: "Zones",
+		valueType: "zoneSelection",
+		operator: "anyOf",
+		appliesTo: [
+			"immediate",
+			"track-end",
+			"package-event"
+		],
+		phase: "P1",
+		description: "Admin zone ids; quantifier any/all over the visited set."
+	},
+	{
+		id: "zonesExclude",
+		group: "zones",
+		label: "Excluded zones",
+		valueType: "zoneIdList",
+		operator: "notIn",
+		appliesTo: [
+			"immediate",
+			"track-end",
+			"package-event"
+		],
+		phase: "P1"
+	},
+	{
+		id: "labelEquals",
+		group: "label",
+		label: "Label equals",
+		valueType: "stringList",
+		operator: "in",
+		appliesTo: ["immediate", "track-end"],
+		phase: "P1",
+		description: "Exact match on the collapsed label (identity / plate / subclass)."
+	},
+	{
+		id: "identities",
+		group: "label",
+		label: "Identities",
+		valueType: "stringList",
+		operator: "in",
+		appliesTo: ["immediate", "track-end"],
+		phase: "P1",
+		description: "P1: matched against the identity display name on the record label."
+	},
+	{
+		id: "plates",
+		group: "label",
+		label: "License plates",
+		valueType: "plateMatcher",
+		operator: "fuzzyIn",
+		appliesTo: ["immediate", "track-end"],
+		phase: "P1",
+		description: "Levenshtein-tolerant match against the plate text."
+	},
+	{
+		id: "identitiesExclude",
+		group: "label",
+		label: "Excluded identities",
+		valueType: "stringList",
+		operator: "notIn",
+		appliesTo: ["immediate", "track-end"],
+		phase: "P1",
+		description: "Veto by identity display name (mirror of Identities; absent label passes)."
+	},
+	{
+		id: "minLabelConfidence",
+		group: "label",
+		label: "Minimum label confidence",
+		valueType: "number01",
+		operator: "gte",
+		appliesTo: ["track-end"],
+		phase: "P1",
+		description: "Best identity/plate recognition match confidence [0,1] for the label the track carries at close (peak assigned-identity cosine / peak plate OCR score; the higher of the two when both were read). Distinct from detection confidence. Fails closed for a track that ended un-recognized."
+	},
+	{
+		id: "minImportance",
+		group: "quality",
+		label: "Minimum importance",
+		valueType: "number01",
+		operator: "gte",
+		appliesTo: ["track-end"],
+		phase: "P1",
+		description: "Server-computed key-event importance [0,1]; track-end rules only (importance is scored at close). Fails when the record has none."
+	},
+	{
+		id: "minDwellSeconds",
+		group: "quality",
+		label: "Minimum dwell (seconds)",
+		valueType: "number",
+		operator: "gte",
+		appliesTo: ["track-end"],
+		phase: "P1",
+		description: "Track lifespan in seconds (lastSeen − firstSeen); track-end rules only."
+	},
+	{
+		id: "source",
+		group: "scope",
+		label: "Detection source",
+		valueType: "sourceSelect",
+		operator: "in",
+		appliesTo: [
+			"immediate",
+			"track-end",
+			"device-event",
+			"package-event"
+		],
+		phase: "P1",
+		description: "pipeline / onboard / sensor; a record with no stamped source counts as pipeline."
+	},
+	{
+		id: "sensorKinds",
+		group: "device",
+		label: "Sensor kinds",
+		valueType: "stringList",
+		operator: "in",
+		appliesTo: ["device-event"],
+		phase: "P1",
+		description: "Sensor/control taxonomy kinds (doorbell / contact / button / …) matched against the persisted device event."
+	},
+	{
+		id: "eventTypeTokens",
+		group: "device",
+		label: "Event-type tokens",
+		valueType: "stringList",
+		operator: "in",
+		appliesTo: ["device-event"],
+		phase: "P1",
+		description: "Raw device event-type tokens (e.g. doorbell press / press_long) from the event-emitter slice; absent on doorbell-pulse / passive sensors."
+	},
+	{
+		id: "packagePhase",
+		group: "package",
+		label: "Package phase",
+		valueType: "packagePhase",
+		operator: "in",
+		appliesTo: ["package-event"],
+		phase: "P1",
+		description: "Delivered / picked-up / both."
+	},
+	{
+		id: "occupancy",
+		group: "occupancy",
+		label: "Occupancy",
+		valueType: "occupancy",
+		operator: "anyOf",
+		appliesTo: ["device-event"],
+		phase: "P1",
+		description: "ZoneAnalytics occupancy edge (optionally zone/class-scoped): count crosses the threshold and holds for sustainSeconds. Fail-closed on a missing snapshot."
+	},
+	{
+		id: "customZones",
+		group: "zones",
+		label: "Custom zones",
+		valueType: "polygonDraw",
+		operator: "anyOf",
+		appliesTo: [
+			"immediate",
+			"track-end",
+			"package-event"
+		],
+		phase: "P1",
+		description: "User-drawn polygons; a detection whose bbox overlaps any polygon matches."
+	},
+	{
+		id: "schedule",
+		group: "schedule",
+		label: "Schedule",
+		valueType: "schedule",
+		operator: "withinSchedule",
+		appliesTo: [
+			"immediate",
+			"track-end",
+			"device-event",
+			"package-event"
+		],
+		phase: "P1",
+		description: "Weekly activation windows (invertible); absent = always active."
+	}
+];
+/**
+* The delivery lifecycle status of a history row — a straight read of the
+* durable outbox row's own status (single source of truth):
+*  - `pending` — enqueued, in-flight or retrying with backoff
+*  - `sent`    — delivered (terminal)
+*  - `dead`    — dead-lettered after exhausting retries / a permanent
+*                backend rejection / a deleted target (terminal; carries
+*                the failure `error`)
+*
+* P1 has no `suppressed-quiet-hours` / `snoozed` states — those ride the P2
+* user dimension (quiet hours / snooze) and are additive when they land.
+*/
+var NcHistoryStatusSchema = zod.z.enum([
+	"pending",
+	"sent",
+	"dead"
+]);
+/** The evaluated record kind a history row descends from (one per trigger). */
+var NcHistoryRecordKindSchema = zod.z.enum([
+	"object-event",
+	"track-end",
+	"device-event",
+	"package-event"
+]);
+/** Subject summary frozen on the row at fire time (survives rule/record edits). */
+var NcHistorySubjectSchema = zod.z.object({
+	className: zod.z.string(),
+	label: zod.z.string().optional(),
+	confidence: zod.z.number().optional(),
+	zones: zod.z.array(zod.z.string()),
+	timestamp: zod.z.number()
 });
-var GenerateVisionInputSchema = LlmGenerateBaseInputSchema.extend({ images: zod.z.array(LlmImageSchema).min(1) });
-var ProfileRefInputSchema = zod.z.object({
-	addonId: zod.z.string(),
-	profileId: zod.z.string()
+/**
+* One delivery-history row. This is a read-only VIEW over the durable
+* outbox row (single source of truth — the same row the drain loop drives;
+* NO second write path, so history can never drift from delivery state).
+* The §3.2 fields map directly: `ruleId`/`targetId`/`deviceId` are columns,
+* `eventRef` is `recordKind`+`recordId`, `timestamps` are `createdAt`
+* (fire) / `updatedAt` (last transition), `status` + `error` are the
+* lifecycle. `ruleName` + `subject` are the intent snapshot frozen at
+* enqueue. `userId?` (per-recipient history) is P2 — no user dimension in
+* P1 (admin scope only).
+*/
+var NcHistoryEntrySchema = zod.z.object({
+	/** Outbox row id — the stable dedup id `ruleId:dedupRef:targetId`. */
+	id: zod.z.string(),
+	ruleId: zod.z.string(),
+	/** Rule name frozen at fire time (outlives a later rename / delete). */
+	ruleName: zod.z.string(),
+	/** The rule urgency/trigger that produced this delivery. */
+	delivery: NcDeliverySchema,
+	targetId: zod.z.string(),
+	deviceId: zod.z.number(),
+	recordKind: NcHistoryRecordKindSchema,
+	/** Event / track ref of the evaluated record (§3.2 `eventRef`). */
+	recordId: zod.z.string(),
+	/** Present for track-scoped deliveries (object-event / track-end). */
+	trackId: zod.z.string().optional(),
+	status: NcHistoryStatusSchema,
+	/** Delivery attempts made so far. */
+	attempts: zod.z.number().int(),
+	/** Fire time (outbox enqueue). */
+	createdAt: zod.z.number(),
+	/** Last transition time (terminal for sent / dead). */
+	updatedAt: zod.z.number(),
+	/** Failure detail — present on a `dead` row. */
+	error: zod.z.string().optional(),
+	subject: NcHistorySubjectSchema
 });
-var llmCapability = {
-	name: "llm",
+/** `getHistory` default page size + hard ceiling (bounded output). */
+var NC_HISTORY_LIMIT_DEFAULT = 100;
+var NC_HISTORY_LIMIT_MAX = 500;
+/**
+* Query filter for `getHistory` (spec §4.2). Every field is a narrowing
+* AND; absent = unbounded on that axis. `since`/`until` bound the fire time
+* (`createdAt`, epoch ms, inclusive). `limit` is clamped to
+* {@link NC_HISTORY_LIMIT_MAX}. `userId` (per-recipient filtering) is P2.
+*/
+var NcHistoryFilterSchema = zod.z.object({
+	ruleId: zod.z.string().optional(),
+	deviceId: zod.z.number().optional(),
+	status: NcHistoryStatusSchema.optional(),
+	since: zod.z.number().optional(),
+	until: zod.z.number().optional(),
+	limit: zod.z.number().int().min(1).max(500).default(100)
+});
+var notificationRulesCapability = {
+	name: "notification-rules",
 	scope: "system",
-	mode: "collection",
-	internal: false,
-	providerKind: "ai",
-	/** `nodeId` inputs below are DATA (the hub provider pins itself), never routing. */
-	nodeIdMode: "data",
+	mode: "singleton",
 	methods: {
-		generate: require_sleep.method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, { kind: "mutation" }),
-		generateVision: require_sleep.method(GenerateVisionInputSchema, LlmGenerateResultSchema, { kind: "mutation" }),
-		listProfileKinds: require_sleep.method(zod.z.object({}), zod.z.array(LlmProfileKindDescriptorSchema)),
-		listProfiles: require_sleep.method(zod.z.object({}), zod.z.array(LlmProfileSchema)),
-		upsertProfile: require_sleep.method(zod.z.object({ profile: LlmProfileSchema }), LlmProfileSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		deleteProfile: require_sleep.method(ProfileRefInputSchema, zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		testProfile: require_sleep.method(ProfileRefInputSchema, LlmGenerateResultSchema, {
+		listRules: require_sleep.method(zod.z.object({}), zod.z.object({ rules: zod.z.array(NcRuleSchema) }), { auth: "admin" }),
+		getRule: require_sleep.method(zod.z.object({ ruleId: zod.z.string() }), zod.z.object({ rule: NcRuleSchema.nullable() }), { auth: "admin" }),
+		createRule: require_sleep.method(zod.z.object({ rule: NcRuleInputSchema }), zod.z.object({ rule: NcRuleSchema }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "admin",
+			caller: "required"
 		}),
-		/** Live vendor enumeration (GET /models etc.). */
-		listModels: require_sleep.method(ProfileRefInputSchema, zod.z.array(zod.z.string())),
-		getDefaults: require_sleep.method(zod.z.object({}), zod.z.array(LlmDefaultSchema)),
-		setDefault: require_sleep.method(zod.z.object({
-			selector: LlmDefaultSelectorSchema,
-			profileId: zod.z.string().nullable()
-		}), zod.z.void(), {
+		updateRule: require_sleep.method(zod.z.object({
+			ruleId: zod.z.string(),
+			patch: NcRulePatchSchema
+		}), zod.z.object({ rule: NcRuleSchema }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "admin",
+			caller: "required"
 		}),
-		getUsage: require_sleep.method(zod.z.object({
-			since: zod.z.number().optional(),
-			until: zod.z.number().optional(),
-			consumer: zod.z.string().optional(),
-			profileId: zod.z.string().optional()
-		}), zod.z.array(LlmUsageRollupSchema)),
-		listModelCatalog: require_sleep.method(zod.z.object({}), zod.z.array(ManagedModelCatalogEntrySchema)),
-		listRuntimeNodes: require_sleep.method(zod.z.object({}), zod.z.array(LlmRuntimeNodeSchema)),
-		listNodeModels: require_sleep.method(zod.z.object({ nodeId: zod.z.string() }), zod.z.array(LlmNodeModelSchema)),
-		installModel: require_sleep.method(zod.z.object({
-			nodeId: zod.z.string(),
-			model: ManagedModelRefSchema
-		}), zod.z.void(), {
+		deleteRule: require_sleep.method(zod.z.object({ ruleId: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		deleteModel: require_sleep.method(zod.z.object({
-			nodeId: zod.z.string(),
-			file: zod.z.string()
-		}), zod.z.void(), {
+		setRuleEnabled: require_sleep.method(zod.z.object({
+			ruleId: zod.z.string(),
+			enabled: zod.z.boolean()
+		}), zod.z.object({ success: zod.z.literal(true) }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		getRuntimeStatus: require_sleep.method(ProfileRefInputSchema, LlmRuntimeStatusSchema),
-		startRuntime: require_sleep.method(ProfileRefInputSchema, LlmRuntimeStatusSchema, {
+		/**
+		* Dry-run a rule against recently persisted records (object events for
+		* `immediate`, closed tracks for `track-end`). Mutation kind only to
+		* carry the full rule object safely; no side effects.
+		*/
+		testRule: require_sleep.method(zod.z.object({
+			rule: NcRuleInputSchema,
+			lookbackMinutes: zod.z.number().int().min(1).max(1440).default(60)
+		}), zod.z.object({ results: zod.z.array(NcTestResultSchema) }), {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		stopRuntime: require_sleep.method(ProfileRefInputSchema, zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
+		getConditionCatalog: require_sleep.method(zod.z.object({}), zod.z.object({ catalog: zod.z.array(NcConditionDescriptorSchema) })),
+		/**
+		* Queryable delivery history — a read-only view over the durable outbox
+		* (fired rule, subject summary, target, status, timestamps, error on a
+		* dead row). Newest-first, bounded by `filter.limit`. Retention follows
+		* the outbox's own terminal-row prune horizon (no separate history
+		* horizon — single collection, single source of truth). Admin-only in
+		* P1 (no user dimension); the P2 viewer History screen adds per-caller
+		* scoping on the same method.
+		*/
+		getHistory: require_sleep.method(zod.z.object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), zod.z.object({ entries: zod.z.array(NcHistoryEntrySchema) }), { auth: "admin" })
 	}
 };
 //#endregion
@@ -19543,160 +20282,56 @@ var pipelineAnalyticsCapability = {
 		*  Absent ⇒ every kind (back-compat). */
 		getTrackMedia: require_sleep.method(zod.z.object({
 			trackId: zod.z.string(),
-			kinds: zod.z.array(MediaFileKindEnum).optional()
-		}), zod.z.array(MediaFileSchema).readonly()),
-		/**
-		* Search object events by text query using CLIP cosine similarity.
-		* Encodes `text` via the `embedding-encoder` cap, queries the
-		* `ObjectEmbeddingStore` with optional prefilters, ranks all matching
-		* embeddings by cosine similarity, and joins winners to their
-		* ObjectEvents by trackId. Returns up to `limit` events scored ≥
-		* `minScore`, sorted descending by score.
-		*/
-		searchObjectEvents: require_sleep.method(SearchObjectEventsInput, zod.z.array(ScoredObjectEventSchema).readonly())
-	},
-	events: {
-		/**
-		* Enriched frame emitted after refinement — the live-overlay source of
-		* truth (two-plane re-injection). Carries the frame's detections in the
-		* `ObjectDetection` wire shape: first-level roots (with track info +
-		* enrichment labels) plus synthesized `kind:'detail'` face/plate entries
-		* re-projected from per-track detail state, so stream overlays render
-		* boxes + recognized names without querying full Track state.
-		*/
-		onFrameTracked: { data: zod.z.object({
-			deviceId: zod.z.number(),
-			timestamp: zod.z.number(),
-			frameWidth: zod.z.number(),
-			frameHeight: zod.z.number(),
-			detections: zod.z.array(OverlayDetectionSchema).readonly()
-		}) },
-		/** Track entered active state (first-seen). */
-		onTrackStarted: { data: zod.z.object({
-			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
-			className: zod.z.string()
-		}) },
-		/** Track expired (TTL reached after last detection). */
-		onTrackEnded: { data: zod.z.object({
-			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
-			className: zod.z.string(),
-			durationMs: zod.z.number()
-		}) },
-		/** Canonical "something happened at device X" event, per-kind. */
-		onDetectionEvent: { data: zod.z.object({
-			deviceId: zod.z.number(),
-			kind: EventKindSchema,
-			eventId: zod.z.string(),
-			timestamp: zod.z.number()
-		}) }
-	}
-};
-//#endregion
-//#region src/capabilities/sensor-event-kinds.ts
-/**
-* Cap → event-kind mapping for the SENSOR / CONTROL cap families — the table
-* `pipeline-analytics.listEventKinds` uses to turn a linked device's bound
-* caps into per-camera event-kind descriptors.
-*
-* The descriptor DATA (color / iconId / labelKey / parentKind / category)
-* is NOT duplicated here — every entry is derived from the single
-* `EVENT_TAXONOMY` dictionary (`catalogs/event-taxonomy.ts`). This file owns
-* ONLY the cap-name → taxonomy-kind mapping. Adding a new eventful sensor /
-* control cap means adding one line here (and a taxonomy entry); the anti-
-* drift guard `scripts/check-event-kind-coverage.ts` fails the build if an
-* eventful cap is missing.
-*/
-/** Map a taxonomy `iconId` onto the legacy closed `EventKindIcon` enum. */
-var LEGACY_ICON = {
-	motion: "motion",
-	audio: "audio",
-	person: "person",
-	vehicle: "vehicle",
-	animal: "animal",
-	package: "package",
-	door: "door",
-	pir: "pir",
-	smoke: "smoke",
-	water: "water",
-	button: "button",
-	generic: "generic",
-	gas: "smoke",
-	vibration: "generic",
-	tamper: "generic",
-	presence: "person",
-	lock: "generic",
-	siren: "generic",
-	switch: "generic",
-	doorbell: "button"
-};
-function legacyIcon(iconId) {
-	return LEGACY_ICON[iconId] ?? "generic";
-}
-/**
-* Cap name → taxonomy kind id. Covers EVERY eventful sensor / control cap.
-* The anti-drift guard cross-checks this against the eventful caps declared
-* in `packages/types/src/capabilities/*.cap.ts`.
-*/
-var CAP_TO_KIND = {
-	contact: "contact",
-	motion: "motion-sensor",
-	smoke: "smoke",
-	flood: "flood",
-	gas: "gas",
-	"carbon-monoxide": "carbon-monoxide",
-	vibration: "vibration",
-	tamper: "tamper",
-	presence: "presence",
-	"enum-sensor": "enum-sensor",
-	"event-emitter": "device-event",
-	"lock-control": "lock",
-	switch: "switch",
-	button: "button",
-	doorbell: "doorbell"
+			kinds: zod.z.array(MediaFileKindEnum).optional()
+		}), zod.z.array(MediaFileSchema).readonly()),
+		/**
+		* Search object events by text query using CLIP cosine similarity.
+		* Encodes `text` via the `embedding-encoder` cap, queries the
+		* `ObjectEmbeddingStore` with optional prefilters, ranks all matching
+		* embeddings by cosine similarity, and joins winners to their
+		* ObjectEvents by trackId. Returns up to `limit` events scored ≥
+		* `minScore`, sorted descending by score.
+		*/
+		searchObjectEvents: require_sleep.method(SearchObjectEventsInput, zod.z.array(ScoredObjectEventSchema).readonly())
+	},
+	events: {
+		/**
+		* Enriched frame emitted after refinement — the live-overlay source of
+		* truth (two-plane re-injection). Carries the frame's detections in the
+		* `ObjectDetection` wire shape: first-level roots (with track info +
+		* enrichment labels) plus synthesized `kind:'detail'` face/plate entries
+		* re-projected from per-track detail state, so stream overlays render
+		* boxes + recognized names without querying full Track state.
+		*/
+		onFrameTracked: { data: zod.z.object({
+			deviceId: zod.z.number(),
+			timestamp: zod.z.number(),
+			frameWidth: zod.z.number(),
+			frameHeight: zod.z.number(),
+			detections: zod.z.array(OverlayDetectionSchema).readonly()
+		}) },
+		/** Track entered active state (first-seen). */
+		onTrackStarted: { data: zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			className: zod.z.string()
+		}) },
+		/** Track expired (TTL reached after last detection). */
+		onTrackEnded: { data: zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string(),
+			className: zod.z.string(),
+			durationMs: zod.z.number()
+		}) },
+		/** Canonical "something happened at device X" event, per-kind. */
+		onDetectionEvent: { data: zod.z.object({
+			deviceId: zod.z.number(),
+			kind: EventKindSchema,
+			eventId: zod.z.string(),
+			timestamp: zod.z.number()
+		}) }
+	}
 };
-function buildDescriptor(capName, kind) {
-	const t = EVENT_TAXONOMY[kind];
-	if (t === void 0) throw new Error(`EVENT_KIND_BY_CAP: cap '${capName}' maps to unknown taxonomy kind '${kind}'`);
-	return {
-		...t,
-		icon: legacyIcon(t.iconId)
-	};
-}
-/**
-* Sensor / control cap name → static event-kind descriptor. A linked device
-* contributes one entry per bound cap present in this map.
-*/
-var EVENT_KIND_BY_CAP = Object.freeze(Object.fromEntries(Object.entries(CAP_TO_KIND).map(([capName, kind]) => [capName, buildDescriptor(capName, kind)])));
-/** The cap names covered by the taxonomy (for the anti-drift guard). */
-var EVENTFUL_CAP_NAMES = Object.keys(CAP_TO_KIND);
-/**
-* Build a full `EventKindDescriptor` for a taxonomy `kind`, stamping the
-* per-device `source`. Returns null when `kind` is not in the taxonomy.
-* This is THE bridge from the serializable taxonomy dictionary to the cap
-* wire shape — every event-kind descriptor the server emits goes through it,
-* so color/iconId/labelKey are never re-declared at a call site.
-*/
-function buildEventKindDescriptor(kind, source) {
-	const t = EVENT_TAXONOMY[kind];
-	if (t === void 0) return null;
-	return {
-		kind: t.kind,
-		labelKey: t.labelKey,
-		label: t.label,
-		color: t.color,
-		iconId: t.iconId,
-		icon: legacyIcon(t.iconId),
-		category: t.category,
-		parentKind: t.parentKind,
-		level: t.level,
-		source: {
-			capName: source.capName,
-			deviceId: source.deviceId
-		}
-	};
-}
 //#endregion
 //#region src/capabilities/pipeline-orchestrator.cap.ts
 var CameraPipelineConfigSchema = zod.z.object({
@@ -20454,6 +21089,110 @@ var pipelineOrchestratorCapability = {
 	}
 };
 //#endregion
+//#region src/capabilities/sensor-event-kinds.ts
+/**
+* Cap → event-kind mapping for the SENSOR / CONTROL cap families — the table
+* `pipeline-analytics.listEventKinds` uses to turn a linked device's bound
+* caps into per-camera event-kind descriptors.
+*
+* The descriptor DATA (color / iconId / labelKey / parentKind / category)
+* is NOT duplicated here — every entry is derived from the single
+* `EVENT_TAXONOMY` dictionary (`catalogs/event-taxonomy.ts`). This file owns
+* ONLY the cap-name → taxonomy-kind mapping. Adding a new eventful sensor /
+* control cap means adding one line here (and a taxonomy entry); the anti-
+* drift guard `scripts/check-event-kind-coverage.ts` fails the build if an
+* eventful cap is missing.
+*/
+/** Map a taxonomy `iconId` onto the legacy closed `EventKindIcon` enum. */
+var LEGACY_ICON = {
+	motion: "motion",
+	audio: "audio",
+	person: "person",
+	vehicle: "vehicle",
+	animal: "animal",
+	package: "package",
+	door: "door",
+	pir: "pir",
+	smoke: "smoke",
+	water: "water",
+	button: "button",
+	generic: "generic",
+	gas: "smoke",
+	vibration: "generic",
+	tamper: "generic",
+	presence: "person",
+	lock: "generic",
+	siren: "generic",
+	switch: "generic",
+	doorbell: "button"
+};
+function legacyIcon(iconId) {
+	return LEGACY_ICON[iconId] ?? "generic";
+}
+/**
+* Cap name → taxonomy kind id. Covers EVERY eventful sensor / control cap.
+* The anti-drift guard cross-checks this against the eventful caps declared
+* in `packages/types/src/capabilities/*.cap.ts`.
+*/
+var CAP_TO_KIND = {
+	contact: "contact",
+	motion: "motion-sensor",
+	smoke: "smoke",
+	flood: "flood",
+	gas: "gas",
+	"carbon-monoxide": "carbon-monoxide",
+	vibration: "vibration",
+	tamper: "tamper",
+	presence: "presence",
+	"enum-sensor": "enum-sensor",
+	"event-emitter": "device-event",
+	"lock-control": "lock",
+	switch: "switch",
+	button: "button",
+	doorbell: "doorbell"
+};
+function buildDescriptor(capName, kind) {
+	const t = EVENT_TAXONOMY[kind];
+	if (t === void 0) throw new Error(`EVENT_KIND_BY_CAP: cap '${capName}' maps to unknown taxonomy kind '${kind}'`);
+	return {
+		...t,
+		icon: legacyIcon(t.iconId)
+	};
+}
+/**
+* Sensor / control cap name → static event-kind descriptor. A linked device
+* contributes one entry per bound cap present in this map.
+*/
+var EVENT_KIND_BY_CAP = Object.freeze(Object.fromEntries(Object.entries(CAP_TO_KIND).map(([capName, kind]) => [capName, buildDescriptor(capName, kind)])));
+/** The cap names covered by the taxonomy (for the anti-drift guard). */
+var EVENTFUL_CAP_NAMES = Object.keys(CAP_TO_KIND);
+/**
+* Build a full `EventKindDescriptor` for a taxonomy `kind`, stamping the
+* per-device `source`. Returns null when `kind` is not in the taxonomy.
+* This is THE bridge from the serializable taxonomy dictionary to the cap
+* wire shape — every event-kind descriptor the server emits goes through it,
+* so color/iconId/labelKey are never re-declared at a call site.
+*/
+function buildEventKindDescriptor(kind, source) {
+	const t = EVENT_TAXONOMY[kind];
+	if (t === void 0) return null;
+	return {
+		kind: t.kind,
+		labelKey: t.labelKey,
+		label: t.label,
+		color: t.color,
+		iconId: t.iconId,
+		icon: legacyIcon(t.iconId),
+		category: t.category,
+		parentKind: t.parentKind,
+		level: t.level,
+		source: {
+			capName: source.capName,
+			deviceId: source.deviceId
+		}
+	};
+}
+//#endregion
 //#region src/capabilities/server-management.cap.ts
 /**
 * server-management — per-NODE singleton capability for a node's ROOT
@@ -22619,7 +23358,28 @@ var FaceInfoSchema = zod.z.object({
 	*  (`/addon/<addonId>/event-media/<keyFrameMediaKey>`). Absent when the
 	*  track produced no key frame (e.g. native/onboard source) — the UI falls
 	*  back to the inline `base64` face crop. */
-	keyFrameMediaKey: zod.z.string().optional()
+	keyFrameMediaKey: zod.z.string().optional(),
+	/** Winning identity-match cosine (0..1) for this face's track, when an
+	*  identity was auto-confirmed. Lets the UI surface WHY a face was assigned
+	*  (confidence badge / low-confidence audit). Absent on legacy rows and on
+	*  faces that were never auto-recognized. */
+	bestMatchScore: zod.z.number().optional(),
+	/** Native-scale face short side (px) at recognition time, when the runner
+	*  measured it. Lets the UI flag low-resolution auto-assignments. Absent on
+	*  legacy rows / runners that reported no native measure. */
+	nativeFaceShortSidePx: zod.z.number().optional(),
+	/** SUGGESTED identity for this face — a plausible-but-not-confident match that
+	*  MISSED auto-assignment (cosine in the suggestion band, or above threshold
+	*  but blocked only by the recognition size floor). Mutually exclusive with
+	*  `recognizedIdentityId` (a suggestion is NEVER an assignment): the face stays
+	*  UNASSIGNED and everything else keeps treating it as unrecognized — the UI
+	*  merely offers a one-tap "is this <name>?" confirm. Absent on legacy rows and
+	*  on faces that were auto-assigned or below the suggestion band. (2026-07-24) */
+	suggestedIdentityId: zod.z.string().optional(),
+	/** Peak identity-match cosine (0..1) for `suggestedIdentityId`, captured at the
+	*  same moment as `bestMatchScore` (track peak, at close). Lets the UI rank /
+	*  badge suggestion confidence. Present iff `suggestedIdentityId` is. (2026-07-24) */
+	suggestedMatchScore: zod.z.number().optional()
 });
 var FaceFilterEnum = zod.z.enum([
 	"unassigned",
@@ -25281,7 +26041,6 @@ var CAPABILITY_NAMES = {
 	addonWidgetsSource: "addon-widgets-source",
 	addons: "addons",
 	adminUi: "admin-ui",
-	advancedNotifier: "advanced-notifier",
 	airQualitySensor: "air-quality-sensor",
 	alarmPanel: "alarm-panel",
 	alerts: "alerts",
@@ -25360,6 +26119,7 @@ var CAPABILITY_NAMES = {
 	networkQuality: "network-quality",
 	nodes: "nodes",
 	notificationOutput: "notification-output",
+	notificationRules: "notification-rules",
 	notifier: "notifier",
 	numericSensor: "numeric-sensor",
 	oauthIntegration: "oauth-integration",
@@ -25453,10 +26213,6 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "adminUi",
 		name: "admin-ui"
 	},
-	{
-		key: "advancedNotifier",
-		name: "advanced-notifier"
-	},
 	{
 		key: "airQualitySensor",
 		name: "air-quality-sensor"
@@ -25769,6 +26525,10 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "notificationOutput",
 		name: "notification-output"
 	},
+	{
+		key: "notificationRules",
+		name: "notification-rules"
+	},
 	{
 		key: "notifier",
 		name: "notifier"
@@ -26005,7 +26765,6 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	addonWidgetsSourceCapability,
 	addonsCapability,
 	require_sleep.adminUiCapability,
-	advancedNotifierCapability,
 	airQualitySensorCapability,
 	alarmPanelCapability,
 	alertsCapability,
@@ -26084,6 +26843,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	networkQualityCapability,
 	nodesCapability,
 	notificationOutputCapability,
+	notificationRulesCapability,
 	notifierCapability,
 	numericSensorCapability,
 	oauthIntegrationCapability,
@@ -26495,36 +27255,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"advancedNotifier.deleteRule": {
-		capName: "advanced-notifier",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
-	"advancedNotifier.getHistory": {
-		capName: "advanced-notifier",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"advancedNotifier.getRules": {
-		capName: "advanced-notifier",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"advancedNotifier.testRule": {
-		capName: "advanced-notifier",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
-	"advancedNotifier.upsertRule": {
-		capName: "advanced-notifier",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"alarmPanel.arm": {
 		capName: "alarm-panel",
 		capScope: "device",
@@ -28829,6 +29559,60 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationRules.createRule": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"notificationRules.deleteRule": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"notificationRules.getConditionCatalog": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationRules.getHistory": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationRules.getRule": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationRules.listRules": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationRules.setRuleEnabled": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"notificationRules.testRule": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"notificationRules.updateRule": {
+		capName: "notification-rules",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"notifier.cancel": {
 		capName: "notifier",
 		capScope: "device",
@@ -31043,7 +31827,6 @@ var KNOWN_CAP_NAMES = [
 	"addon-widgets-source",
 	"addons",
 	"admin-ui",
-	"advanced-notifier",
 	"alarm-panel",
 	"alerts",
 	"audio-analysis",
@@ -31105,6 +31888,7 @@ var KNOWN_CAP_NAMES = [
 	"network-quality",
 	"nodes",
 	"notification-output",
+	"notification-rules",
 	"notifier",
 	"oauth-integration",
 	"osd",
@@ -31218,7 +32002,6 @@ var SYSTEM_CAP_NAMES = [
 	"addon-widgets-source",
 	"addons",
 	"admin-ui",
-	"advanced-notifier",
 	"alerts",
 	"audio-analyzer",
 	"audio-codec",
@@ -31250,6 +32033,7 @@ var SYSTEM_CAP_NAMES = [
 	"network-quality",
 	"nodes",
 	"notification-output",
+	"notification-rules",
 	"oauth-integration",
 	"pipeline-executor",
 	"pipeline-orchestrator",
@@ -32229,6 +33013,11 @@ exports.MotionZonePatchSchema = MotionZonePatchSchema;
 exports.MotionZoneRegionSchema = MotionZoneRegionSchema;
 exports.MotionZoneStatusSchema = MotionZoneStatusSchema;
 exports.MqttBrokerStatusSchema = StatusSchema;
+exports.NC_CONDITION_CATALOG = NC_CONDITION_CATALOG;
+exports.NC_HISTORY_LIMIT_DEFAULT = NC_HISTORY_LIMIT_DEFAULT;
+exports.NC_HISTORY_LIMIT_MAX = NC_HISTORY_LIMIT_MAX;
+exports.NC_MAX_PER_TRACK_IMMEDIATE = NC_MAX_PER_TRACK_IMMEDIATE;
+exports.NC_TAXONOMY = NC_TAXONOMY;
 exports.NativeCropBboxSchema = NativeCropBboxSchema;
 exports.NativeCropRefSchema = NativeCropRefSchema;
 exports.NativeCropResultSchema = NativeCropResultSchema;
@@ -32236,13 +33025,33 @@ exports.NativeDetectionSchema = NativeDetectionSchema;
 exports.NativeObjectClassEnum = NativeObjectClassEnum;
 exports.NativeObjectDetectionRuntimeStateSchema = NativeObjectDetectionRuntimeStateSchema;
 exports.NativeObjectDetectionStatusSchema = NativeObjectDetectionStatusSchema;
+exports.NcConditionDescriptorSchema = NcConditionDescriptorSchema;
+exports.NcConditionsSchema = NcConditionsSchema;
+exports.NcDeliverySchema = NcDeliverySchema;
+exports.NcHistoryEntrySchema = NcHistoryEntrySchema;
+exports.NcHistoryFilterSchema = NcHistoryFilterSchema;
+exports.NcHistoryRecordKindSchema = NcHistoryRecordKindSchema;
+exports.NcHistoryStatusSchema = NcHistoryStatusSchema;
+exports.NcHistorySubjectSchema = NcHistorySubjectSchema;
+exports.NcMediaPolicySchema = NcMediaPolicySchema;
+exports.NcOccupancyConditionSchema = NcOccupancyConditionSchema;
+exports.NcPlateMatcherSchema = NcPlateMatcherSchema;
+exports.NcRuleInputSchema = NcRuleInputSchema;
+exports.NcRulePatchSchema = NcRulePatchSchema;
+exports.NcRuleSchema = NcRuleSchema;
+exports.NcRuleTargetSchema = NcRuleTargetSchema;
+exports.NcScheduleSchema = NcScheduleSchema;
+exports.NcScheduleWindowSchema = NcScheduleWindowSchema;
+exports.NcTaxonomyEntrySchema = NcTaxonomyEntrySchema;
+exports.NcTaxonomySchema = NcTaxonomySchema;
+exports.NcTestResultSchema = NcTestResultSchema;
+exports.NcThrottleSchema = NcThrottleSchema;
+exports.NcZoneConditionSchema = NcZoneConditionSchema;
 exports.NetworkAccessStatusSchema = NetworkAccessStatusSchema;
 exports.NetworkAddressSchema = NetworkAddressSchema;
 exports.NetworkEndpointSchema = NetworkEndpointSchema;
 exports.NotificationActionSchema = NotificationActionSchema;
 exports.NotificationFormatSchema = NotificationFormatSchema;
-exports.NotificationHistoryEntrySchema = NotificationHistoryEntrySchema;
-exports.NotificationRuleSchema = NotificationRuleSchema;
 exports.NotificationSchema = NotificationSchema;
 exports.NotifierStatusSchema = NotifierStatusSchema;
 exports.NumericSensorStatusSchema = NumericSensorStatusSchema;
@@ -32303,6 +33112,7 @@ exports.PtzAutotrackSettingsSchema = PtzAutotrackSettingsSchema;
 exports.PtzAutotrackStatusSchema = PtzAutotrackStatusSchema;
 exports.PtzAutotrackTargetOptionSchema = PtzAutotrackTargetOptionSchema;
 exports.PtzMoveCommandSchema = PtzMoveCommandSchema;
+exports.PtzOptionsSchema = PtzOptionsSchema;
 exports.PtzPositionSchema = PtzPositionSchema;
 exports.PtzPresetSchema = PtzPresetSchema;
 exports.PtzStatusSchema = PtzStatusSchema;
@@ -32498,7 +33308,6 @@ exports.addonWidgetsCapability = addonWidgetsCapability;
 exports.addonWidgetsSourceCapability = addonWidgetsSourceCapability;
 exports.addonsCapability = addonsCapability;
 exports.adminUiCapability = require_sleep.adminUiCapability;
-exports.advancedNotifierCapability = advancedNotifierCapability;
 exports.airQualitySensorCapability = airQualitySensorCapability;
 exports.alarmPanelCapability = alarmPanelCapability;
 exports.alertsCapability = alertsCapability;
@@ -32526,6 +33335,7 @@ exports.brokerCapability = brokerCapability;
 exports.buildAddonRouteProvider = buildAddonRouteProvider;
 exports.buildEventKindDescriptor = buildEventKindDescriptor;
 exports.buildModelVariantGroups = buildModelVariantGroups;
+exports.buildNcTaxonomy = buildNcTaxonomy;
 exports.buildStreamParamsConfigSchema = buildStreamParamsConfigSchema;
 exports.buttonCapability = buttonCapability;
 exports.cameraCredentialsCapability = cameraCredentialsCapability;
@@ -32672,6 +33482,7 @@ exports.nodesCapability = nodesCapability;
 exports.normalizeAddonInitResult = require_sleep.normalizeAddonInitResult;
 exports.normalizeUnit = normalizeUnit;
 exports.notificationOutputCapability = notificationOutputCapability;
+exports.notificationRulesCapability = notificationRulesCapability;
 exports.notifierCapability = notifierCapability;
 exports.numericSensorCapability = numericSensorCapability;
 exports.oauthIntegrationCapability = oauthIntegrationCapability;