@camstack/addon-post-analysis 1.2.650 → 1.2.652

package/dist/{clip-model-registry-CC7pvitG.js → clip-model-registry-Bz1uQvQ8.js}

@@ -5676,7 +5676,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BAvUCi_2.mjs
+//#region ../types/dist/sleep-63gM_1JR.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8777,65 +8777,6 @@ var MODEL_FORMATS = [
 	"pt",
 	"gguf"
 ];
-/**
-* Per-call node pinning for `ctx.api` capability calls.
-*
-* A capability call normally resolves to its DEFAULT provider — a `singleton`
-* cap resolves to the hub, a device-scoped cap to the device's owning node. To
-* query a SPECIFIC node's provider instead (e.g. a remote agent's own
-* in-process `platform-probe` hardware, which the hub cannot probe), pin the
-* call to that node.
-*
-* The nodeId rides OUT-OF-BAND in the tRPC call context (NOT in the validated
-* method args), so capability method signatures stay `nodeId`-free — node
-* targeting is a property of the CALL, not of the method. The transport lifts
-* it from `op.context` onto the `CapCallInput.nodeId` field (`ipcParentLink`),
-* and the hub parent's `onUnownedCall` passes it to the `CapRouteResolver`,
-* which classifies a pinned agent node as `agent-child-forward`
-* (`$agent-cap-fwd.forward` → the agent's in-process provider).
-*
-* Usage at a call site:
-*
-*   await api.platformProbe.getCapabilities.query(undefined, nodePin(nodeId))
-*/
-/** tRPC `op.context` key carrying a per-call node pin. */
-var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
-/**
-* Build the tRPC request options that pin a single capability call to `nodeId`.
-* Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
-*
-* ## The id is normalised here, and it has to be
-*
-* A forked addon reads its own node from `ctx.kernel.localNodeId`, and inside a
-* worker that value is a RUNNER id — `hub/export-hap`, not `hub`. Routing
-* compares a pin against real node ids, so such a pin matches nothing and the
-* call fails with `no provider registered for cap "…"`. The local-first
-* resolver already guarded against this (`localNodeId.split('/')[0]`), which
-* made the hazard invisible: unpinned calls worked, and only an explicit pin —
-* the thing you reach for when you specifically need THIS node — silently
-* addressed a node that does not exist.
-*
-* Cost of it being missing: `addon-export-hap` pinned `decoder.getInfo` to its
-* own node to read the host's hardware-decode backend. It never once answered,
-* so every HomeKit egress transcode decoded in SOFTWARE — including 4K H.265 —
-* while D67's whole premise was that the decoder addon is the authority on
-* hardware. The warn said `decoding in SOFTWARE` and read as "this node has no
-* hardware", which was false.
-*
-* Normalising in the ONE constructor fixes every caller at once, which is why
-* it is here and not at the call sites.
-*/
-function nodePin(nodeId) {
-	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: toNodeId(nodeId) } };
-}
-/**
-* A runner id is `<nodeId>/<addonId>`; a node id has no slash. Taking the head
-* is idempotent, so passing an already-clean id costs nothing.
-*/
-function toNodeId(idOrRunnerId) {
-	const head = idOrRunnerId.split("/")[0];
-	return head === void 0 || head.length === 0 ? idOrRunnerId : head;
-}
 object({
 	field: string().min(1),
 	on: literal("advance")
@@ -8928,6 +8869,111 @@ function optionalMethod(input, output, options) {
 function event(data) {
 	return { data };
 }
+/**
+* Per-call node pinning for `ctx.api` capability calls.
+*
+* A capability call normally resolves to its DEFAULT provider — a `singleton`
+* cap resolves to the hub, a device-scoped cap to the device's owning node. To
+* query a SPECIFIC node's provider instead (e.g. a remote agent's own
+* in-process `platform-probe` hardware, which the hub cannot probe), pin the
+* call to that node.
+*
+* The nodeId rides OUT-OF-BAND in the tRPC call context (NOT in the validated
+* method args), so capability method signatures stay `nodeId`-free — node
+* targeting is a property of the CALL, not of the method. The transport lifts
+* it from `op.context` onto the `CapCallInput.nodeId` field (`ipcParentLink`),
+* and the hub parent's `onUnownedCall` passes it to the `CapRouteResolver`,
+* which classifies a pinned agent node as `agent-child-forward`
+* (`$agent-cap-fwd.forward` → the agent's in-process provider).
+*
+* Usage at a call site:
+*
+*   await api.platformProbe.getCapabilities.query(undefined, nodePin(nodeId))
+*/
+/** tRPC `op.context` key carrying a per-call node pin. */
+var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
+/**
+* Build the tRPC request options that pin a single capability call to `nodeId`.
+* Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
+*
+* ## The id is normalised here, and it has to be
+*
+* A forked addon reads its own node from `ctx.kernel.localNodeId`, and inside a
+* worker that value is a RUNNER id — `hub/export-hap`, not `hub`. Routing
+* compares a pin against real node ids, so such a pin matches nothing and the
+* call fails with `no provider registered for cap "…"`. The local-first
+* resolver already guarded against this (`localNodeId.split('/')[0]`), which
+* made the hazard invisible: unpinned calls worked, and only an explicit pin —
+* the thing you reach for when you specifically need THIS node — silently
+* addressed a node that does not exist.
+*
+* Cost of it being missing: `addon-export-hap` pinned `decoder.getInfo` to its
+* own node to read the host's hardware-decode backend. It never once answered,
+* so every HomeKit egress transcode decoded in SOFTWARE — including 4K H.265 —
+* while D67's whole premise was that the decoder addon is the authority on
+* hardware. The warn said `decoding in SOFTWARE` and read as "this node has no
+* hardware", which was false.
+*
+* Normalising in the ONE constructor fixes every caller at once, which is why
+* it is here and not at the call sites.
+*/
+function nodePin(nodeId) {
+	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: toNodeId(nodeId) } };
+}
+/**
+* A runner id is `<nodeId>/<addonId>`; a node id has no slash. Taking the head
+* is idempotent, so passing an already-clean id costs nothing.
+*/
+function toNodeId(idOrRunnerId) {
+	const head = idOrRunnerId.split("/")[0];
+	return head === void 0 || head.length === 0 ? idOrRunnerId : head;
+}
+/**
+* `addon-pages-source` — collection cap exposing per-provider raw page
+* declarations. Every addon that contributes a UI page registers a
+* provider here. The hub-side singleton aggregator (`addon-pages` cap,
+* see `addon-pages.cap.ts`) walks this collection, stamps versioned
+* `bundleUrl` values, and returns the enriched `AddonPageInfo[]` list
+* that admin-ui consumes.
+*
+* The split exists because the public listing has a different output
+* shape than the per-provider raw declarations, and we want both ends
+* to flow through codegen instead of relying on a hand-written wrapper.
+*/
+var AddonPageDeclarationSchema = object({
+	id: string(),
+	label: string(),
+	icon: string(),
+	path: string(),
+	/**
+	* Module Federation remote name — must match the `name` field on the
+	* page addon's `federation()` plugin config. Used by admin-ui's
+	* `<AddonPageLoader>` to call `loadRemote('<remoteName>/page')`.
+	* Conventionally `addon_<id>_page` (snake_case; MF names cannot
+	* contain hyphens).
+	*/
+	remoteName: string(),
+	/**
+	* Bundle filename inside the addon's `dist/` dir served at
+	* `/api/addon-pages/<addonId>/<bundle>`. With Module Federation this
+	* is always `'remoteEntry.js'`; the value is kept on the metadata so
+	* the static-file route can compute an mtime-based cache-buster URL
+	* without a separate filesystem stat.
+	*/
+	bundle: string(),
+	/**
+	* Sidebar section this page docks into. Well-known ids: `'detection'`,
+	* `'cluster'`, `'administration'` — the page renders inside that group.
+	* Any OTHER string creates (or joins) a custom section rendered after
+	* the built-in groups; its label comes from `sectionLabel` (first
+	* declaration wins), falling back to the id. Absent → the legacy
+	* "Addon Pages" group.
+	*/
+	section: string().optional(),
+	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
+	sectionLabel: string().optional()
+});
+method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" });
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
 method(_void(), StaticDirOutputSchema$1, { auth: "admin" }), method(_void(), VersionOutputSchema$1, { auth: "admin" });
@@ -8953,6 +8999,27 @@ function customAction(input, output, options) {
 		...options?.caller ? { caller: "required" } : {}
 	};
 }
+/**
+* The pipeline step-input shape and the run-result bridge, in a module that
+* imports nothing but zod and types.
+*
+* WHY A SEPARATE FILE (addon footprint, D28): both were declared in
+* `pipeline-executor.cap.ts`, whose import evaluates the whole executor schema
+* graph. An addon that only needs these two (the benchmark's `runPipelineTest`
+* action) paid ~130 MB of heap at load. `pipeline-executor.cap.ts` re-exports
+* them, so every existing import keeps working; addon server code takes them
+* from `@camstack/types/addon`.
+*/
+var PipelineStepInputSchema = lazy(() => object({
+	addonId: string(),
+	modelId: string().optional(),
+	enabled: boolean().default(true),
+	children: array(PipelineStepInputSchema).optional(),
+	settings: record(string(), unknown()).optional(),
+	jumpDeviceKey: string().optional()
+}));
+/** Typed bridge to the recursive `FrameResult` graph; validation is structural. */
+var PipelineRunResultBridge = custom();
 var StaticDirOutputSchema = object({ staticDir: string() });
 var VersionOutputSchema = object({ version: string() });
 method(_void(), StaticDirOutputSchema, { auth: "admin" }), method(_void(), VersionOutputSchema, { auth: "admin" });
@@ -9138,6 +9205,7 @@ var CAP_NAMES = Object.freeze([
 	"network-link",
 	"network-quality",
 	"node-certificates",
+	"node-removal-hook",
 	"nodes",
 	"notification-output",
 	"notification-rules",
@@ -9148,6 +9216,7 @@ var CAP_NAMES = Object.freeze([
 	"osd",
 	"osd-manager",
 	"pet-feeder",
+	"pet-fountain",
 	"pipeline-analytics",
 	"pipeline-executor",
 	"pipeline-orchestrator",
@@ -9168,6 +9237,8 @@ var CAP_NAMES = Object.freeze([
 	"recording-onboard",
 	"recording-signal",
 	"records",
+	"remote",
+	"remote-layout-components",
 	"running-state",
 	"scene-monitor",
 	"script-runner",
@@ -9191,6 +9262,7 @@ var CAP_NAMES = Object.freeze([
 	"system",
 	"tamper",
 	"temperature-sensor",
+	"template",
 	"terminal-session",
 	"toast",
 	"training",
@@ -10131,6 +10203,11 @@ Object.freeze({
 				"standby"
 			]
 		},
+		{
+			"path": "stateSource",
+			"valueType": "enum",
+			"enumValues": ["reported", "assumed"]
+		},
 		{
 			"path": "volumeLevel",
 			"valueType": "number"
@@ -10406,6 +10483,68 @@ Object.freeze({
 		{
 			"path": "volume",
 			"valueType": "number"
+		},
+		{
+			"path": "lastFeedGrams",
+			"valueType": "number"
+		},
+		{
+			"path": "lastFeedHopper1",
+			"valueType": "number"
+		},
+		{
+			"path": "lastFeedHopper2",
+			"valueType": "number"
+		}
+	],
+	"pet-fountain": [
+		{
+			"path": "waterLevel",
+			"valueType": "number"
+		},
+		{
+			"path": "waterVolume",
+			"valueType": "number"
+		},
+		{
+			"path": "empty",
+			"valueType": "boolean"
+		},
+		{
+			"path": "pumpRunning",
+			"valueType": "boolean"
+		},
+		{
+			"path": "pumpIntervalEnabled",
+			"valueType": "boolean"
+		},
+		{
+			"path": "pumpOnTime",
+			"valueType": "number"
+		},
+		{
+			"path": "pumpOffTime",
+			"valueType": "number"
+		},
+		{
+			"path": "lastDrink",
+			"valueType": "number"
+		},
+		{
+			"path": "currentHourDrink",
+			"valueType": "number"
+		},
+		{
+			"path": "last24hDrink",
+			"valueType": "number"
+		},
+		{
+			"path": "todayDrink",
+			"valueType": "number"
+		},
+		{
+			"path": "error",
+			"valueType": "string"
 		}
 	],
 	"power-meter": [
@@ -10947,7 +11086,7 @@ Object.freeze({
 * can answer "may a rule actuate this?" without importing the schema barrel
 * (~144MB RSS per runner, D28).
 *
-* Coverage: 96 device-scoped capabilities.
+* Coverage: 97 device-scoped capabilities.
 */
 var DEVICE_SCOPED_CAPS = new Set([
 	"accessories",
@@ -11013,6 +11152,7 @@ var DEVICE_SCOPED_CAPS = new Set([
 	"numeric-sensor",
 	"osd",
 	"pet-feeder",
+	"pet-fountain",
 	"pipeline-analytics",
 	"power-meter",
 	"presence",
@@ -11091,7 +11231,7 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }
 //#endregion
-//#region ../types/dist/err-msg-BCdlR2Li.mjs
+//#region ../types/dist/err-msg-DWXWc0Di.mjs
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -11183,6 +11323,10 @@ var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
 	*  integrations sharing the same food/desiccant/hopper surface. */
 	DeviceType["PetFeeder"] = "pet-feeder";
+	/** Pet water fountain — tank level, water drunk, pump and its duty cycle.
+	*  Installed with the `pet-fountain` cap. Reaches CamStack as loose entities
+	*  of a container and is BUILT as a composed device (D967). */
+	DeviceType["PetFountain"] = "pet-fountain";
 	/** Built-in dishwasher — program lifecycle, door / remote-start gates,
 	*  salt and rinse-aid levels. Installed with the `dishwasher` cap.
 	*  Sources: native Bosch Home Connect, reusable by similar integrations.
@@ -11453,7 +11597,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-DpFv_J6D.mjs
+//#region ../types/dist/composition-kSuOifuG.mjs
 /**
 * Deterministic SHA-256 hash of an arbitrary serialisable value. The
 * canonical form sorts object keys alphabetically at every depth so two
@@ -12698,12 +12842,28 @@ var CompositionFieldSourceSchema = discriminatedUnion("kind", [
 		])
 	})
 ]);
-var CompositionCommandTargetSchema = discriminatedUnion("kind", [object({
+var forwardArgUnion = union([
+	string(),
+	number(),
+	boolean(),
+	strictObject({ ["$input"]: string().min(1) }),
+	record(string().min(1), lazy(() => forwardArgUnion))
+]);
+var CompositionForwardArgSchema = forwardArgUnion;
+/**
+* `forward` (D659, amended by D967): one method of a BUILT capability is one
+* call of `cap.method` on `source`. Without `args` the built method's input
+* passes through minus `deviceId`; with `args` the template IS the source's
+* whole input. `deviceId` is always the source's own, never an argument.
+*/
+var CompositionForwardCommandSchema = object({
 	kind: literal("forward"),
 	source: CompositionSourceRefSchema,
 	cap: string().min(1),
-	method: string().min(1)
-}), CompositionCodeSourceSchema]);
+	method: string().min(1),
+	args: record(string().min(1), CompositionForwardArgSchema).optional()
+});
+var CompositionCommandTargetSchema = discriminatedUnion("kind", [CompositionForwardCommandSchema, CompositionCodeSourceSchema]);
 /** An item key inside an item-array cap (`consumables.items[<key>]`). */
 var COMPOSITION_ITEM_KEY_RE = /^[a-z0-9][a-z0-9-]{0,47}$/;
 /**
@@ -12713,7 +12873,13 @@ var COMPOSITION_ITEM_KEY_RE = /^[a-z0-9][a-z0-9-]{0,47}$/;
 */
 var CompositionItemEntrySchema = object({
 	label: string().min(1).max(80),
-	fields: record(string().min(1), CompositionFieldSourceSchema)
+	fields: record(string().min(1), CompositionFieldSourceSchema),
+	/**
+	* What the cap's `reset` does for THIS item (consumables). Present = the item
+	* is resettable and a `reset` call naming its key forwards here. The item key
+	* selects the command, so it is never an argument: there is no pass-through.
+	*/
+	reset: CompositionForwardCommandSchema.optional()
 });
 var CompositionFeatureSchema = discriminatedUnion("kind", [object({
 	kind: literal("fields"),
@@ -12725,7 +12891,7 @@ var CompositionFeatureSchema = discriminatedUnion("kind", [object({
 	* owns the WHOLE array field: the composed value holds exactly these items.
 	*/
 	items: record(string().regex(COMPOSITION_ITEM_KEY_RE), CompositionItemEntrySchema).refine((items) => Object.keys(items).length <= 16, { message: `at most 16 items` }).optional(),
-	/** RESERVED for slice 3; refused by the validator when non-empty. */
+	/** Method name → what serves it. Only a BUILT capability takes commands (D967). */
 	commands: record(string().min(1), CompositionCommandTargetSchema).optional()
 }), object({
 	kind: literal("passthrough"),
@@ -16868,6 +17034,538 @@ object({
 		path: ["expr"]
 	});
 });
+/**
+* Identity envelope for a device's upstream-system metadata.
+*
+* Two jobs:
+*
+*   1. **Dispatch key.** `id` is the natural identifier the SOURCE system
+*      uses to address this device (HA `entity_id`, Reolink MAC, ONVIF
+*      WS-Discovery endpoint UUID, …). Provider code keeps a
+*      `Map<sourceInfo.id, IDevice>` to route inbound push events in O(1)
+*      without round-tripping through `stableId` / `id` mappings.
+*
+*   2. **Stability bridge.** `uniqueId` is the *immutable* upstream id when
+*      one exists (HA `entity.unique_id`, Reolink MAC again — same as `id`
+*      for vendors where MAC is the natural key). For systems where the
+*      live dispatch key can be renamed (HA `entity_id` can be edited),
+*      providers detect renames by matching `uniqueId` and patch `id`
+*      in-place so dispatch keeps working.
+*
+* **Display unit and precision are NOT stored here.** They are a read-time
+* preference (D944). A polymorphic reading stores its `quantity` here once,
+* at adopt, and a date/time value stores `dateTimeShape` the same way —
+* neither is repeated on each sample. The `device_class` tag is an
+* HA-specific input consumed at the discovery boundary (`ha-domain-mapping`)
+* to derive the CamStack `DeviceRole`; it is never stored after that point.
+*
+* The `raw` escape hatch carries provider-specific attributes that don't
+* fit the structured slots (HA `attributes` whitelist, Reolink `deviceCache`
+* details, …). Providers control what lands here.
+*/
+var SourceInfoSchema = object({
+	/** Live dispatch key — mutable when the source system allows rename. */
+	id: string(),
+	/** Source system tag — e.g. 'homeassistant' | 'reolink' | 'onvif'. */
+	system: string(),
+	/** Immutable upstream identifier when available (HA `unique_id`, … ).
+	*  Used to detect rename when `id` changes. */
+	uniqueId: string().optional(),
+	/** Quantity of a polymorphic reading, written once at adopt (D944). */
+	quantity: ReadingQuantitySchema.optional(),
+	/** Date / time / datetime shape of a string reading, written once at adopt. */
+	dateTimeShape: _enum([
+		"date",
+		"time",
+		"datetime"
+	]).optional(),
+	/** Provider-specific extras that don't fit the structured slots.
+	*  Whitelist what goes here per provider — do NOT dump entire HA
+	*  attribute blobs (would explode the meta JSON column). */
+	raw: record(string(), unknown()).optional()
+});
+/**
+* Build the synthetic SourceInfo every existing provider falls back to
+* when no upstream value has been persisted. Keeps non-migrated providers
+* (Reolink / Hikvision / ONVIF / RTSP) functional without code
+* changes — `id` reuses the CamStack stableId, `system` reuses the addon
+* id. Real upstream identity replaces this once a provider migrates and
+* calls `updateSourceInfo()` with concrete values.
+*/
+function synthesizeSourceInfo(input) {
+	return {
+		id: input.stableId,
+		system: input.addonId
+	};
+}
+/**
+* Shallow-merge a partial patch over a prior SourceInfo. `undefined`
+* patch values are ignored (no field clobber); to clear a field
+* explicitly, providers omit it from the patch and rebuild from scratch
+* via `updateSourceInfo({})` cycles — uncommon enough that we don't
+* bother with a `null`-means-delete sentinel.
+*
+* The `raw` field is also shallow-merged: passing `raw: { foo: 1 }`
+* merges over existing `raw` keys instead of replacing the whole bag.
+*/
+function mergeSourceInfo(prev, patch) {
+	const next = { ...prev };
+	for (const [k, v] of Object.entries(patch)) {
+		if (v === void 0) continue;
+		if (k === "raw" && typeof v === "object" && v !== null) {
+			next.raw = {
+				...prev.raw,
+				...v
+			};
+			continue;
+		}
+		next[k] = v;
+	}
+	return next;
+}
+/**
+* Key under which `SourceInfo` lives inside `DeviceMeta.metadata`. The
+* blob is a free-form `Record<string, unknown>` shared with hardware-
+* identity fields (`manufacturer`, `model`, `firmware`, …); SourceInfo
+* lives under a single nested key to keep it composable with those.
+*/
+var SOURCE_INFO_METADATA_KEY = "sourceInfo";
+/**
+* Extract a SourceInfo from a `DeviceMeta.metadata` blob, validating
+* with Zod. Returns `null` when the blob is missing or the nested
+* `sourceInfo` key fails validation — callers fall back to the
+* synthetic default in that case (see `synthesizeSourceInfo`).
+*/
+function extractSourceInfoFromMetadata(metadata) {
+	if (!metadata) return null;
+	const raw = metadata[SOURCE_INFO_METADATA_KEY];
+	if (!raw) return null;
+	const parsed = SourceInfoSchema.safeParse(raw);
+	if (!parsed.success) return null;
+	return parsed.data;
+}
+/**
+* Frozen unit → spec table. `•` in the doc marks each dimension's canonical
+* unit (`factor: 1, offset: 0`). °F derives from `°C = (°F − 32) × 5/9` ⇒
+* `factor = 5/9`, `offset = -160/9` (kept as exact expressions, not rounded
+* decimals). K derives from `°C = K − 273.15`.
+*/
+var UNIT_TABLE = {
+	"°C": {
+		dimension: "temperature",
+		factor: 1,
+		offset: 0
+	},
+	"°F": {
+		dimension: "temperature",
+		factor: 5 / 9,
+		offset: -160 / 9
+	},
+	K: {
+		dimension: "temperature",
+		factor: 1,
+		offset: -273.15
+	},
+	hPa: {
+		dimension: "pressure",
+		factor: 1,
+		offset: 0
+	},
+	kPa: {
+		dimension: "pressure",
+		factor: 10,
+		offset: 0
+	},
+	Pa: {
+		dimension: "pressure",
+		factor: .01,
+		offset: 0
+	},
+	mbar: {
+		dimension: "pressure",
+		factor: 1,
+		offset: 0
+	},
+	bar: {
+		dimension: "pressure",
+		factor: 1e3,
+		offset: 0
+	},
+	inHg: {
+		dimension: "pressure",
+		factor: 33.8639,
+		offset: 0
+	},
+	mmHg: {
+		dimension: "pressure",
+		factor: 1.33322,
+		offset: 0
+	},
+	psi: {
+		dimension: "pressure",
+		factor: 68.9476,
+		offset: 0
+	},
+	"m/s": {
+		dimension: "speed",
+		factor: 1,
+		offset: 0
+	},
+	"km/h": {
+		dimension: "speed",
+		factor: 1 / 3.6,
+		offset: 0
+	},
+	mph: {
+		dimension: "speed",
+		factor: .44704,
+		offset: 0
+	},
+	kn: {
+		dimension: "speed",
+		factor: .514444,
+		offset: 0
+	},
+	"mm/h": {
+		dimension: "precipitation-rate",
+		factor: 1,
+		offset: 0
+	},
+	"in/h": {
+		dimension: "precipitation-rate",
+		factor: 25.4,
+		offset: 0
+	},
+	m: {
+		dimension: "length",
+		factor: 1,
+		offset: 0
+	},
+	mm: {
+		dimension: "length",
+		factor: .001,
+		offset: 0
+	},
+	cm: {
+		dimension: "length",
+		factor: .01,
+		offset: 0
+	},
+	km: {
+		dimension: "length",
+		factor: 1e3,
+		offset: 0
+	},
+	in: {
+		dimension: "length",
+		factor: .0254,
+		offset: 0
+	},
+	ft: {
+		dimension: "length",
+		factor: .3048,
+		offset: 0
+	},
+	mi: {
+		dimension: "length",
+		factor: 1609.344,
+		offset: 0
+	},
+	"m²": {
+		dimension: "area",
+		factor: 1,
+		offset: 0
+	},
+	lx: {
+		dimension: "illuminance",
+		factor: 1,
+		offset: 0
+	},
+	"W/m²": {
+		dimension: "irradiance",
+		factor: 1,
+		offset: 0
+	},
+	W: {
+		dimension: "power",
+		factor: 1,
+		offset: 0
+	},
+	kW: {
+		dimension: "power",
+		factor: 1e3,
+		offset: 0
+	},
+	VA: {
+		dimension: "apparent-power",
+		factor: 1,
+		offset: 0
+	},
+	Wh: {
+		dimension: "energy",
+		factor: 1,
+		offset: 0
+	},
+	kWh: {
+		dimension: "energy",
+		factor: 1e3,
+		offset: 0
+	},
+	MWh: {
+		dimension: "energy",
+		factor: 1e6,
+		offset: 0
+	},
+	V: {
+		dimension: "voltage",
+		factor: 1,
+		offset: 0
+	},
+	mV: {
+		dimension: "voltage",
+		factor: .001,
+		offset: 0
+	},
+	A: {
+		dimension: "current",
+		factor: 1,
+		offset: 0
+	},
+	mA: {
+		dimension: "current",
+		factor: .001,
+		offset: 0
+	},
+	ppm: {
+		dimension: "concentration-volume",
+		factor: 1,
+		offset: 0
+	},
+	ppb: {
+		dimension: "concentration-volume",
+		factor: .001,
+		offset: 0
+	},
+	"µg/m³": {
+		dimension: "concentration-mass",
+		factor: 1,
+		offset: 0
+	},
+	"mg/m³": {
+		dimension: "concentration-mass",
+		factor: 1e3,
+		offset: 0
+	},
+	kg: {
+		dimension: "mass",
+		factor: 1,
+		offset: 0
+	},
+	g: {
+		dimension: "mass",
+		factor: .001,
+		offset: 0
+	},
+	lb: {
+		dimension: "mass",
+		factor: .453592,
+		offset: 0
+	},
+	oz: {
+		dimension: "mass",
+		factor: .0283495,
+		offset: 0
+	},
+	"%": {
+		dimension: "percentage",
+		factor: 1,
+		offset: 0
+	},
+	L: {
+		dimension: "volume",
+		factor: 1,
+		offset: 0
+	},
+	mL: {
+		dimension: "volume",
+		factor: .001,
+		offset: 0
+	},
+	gal: {
+		dimension: "volume",
+		factor: 3.785411784,
+		offset: 0
+	},
+	s: {
+		dimension: "duration",
+		factor: 1,
+		offset: 0
+	},
+	ms: {
+		dimension: "duration",
+		factor: .001,
+		offset: 0
+	},
+	min: {
+		dimension: "duration",
+		factor: 60,
+		offset: 0
+	},
+	h: {
+		dimension: "duration",
+		factor: 3600,
+		offset: 0
+	},
+	d: {
+		dimension: "duration",
+		factor: 86400,
+		offset: 0
+	},
+	B: {
+		dimension: "information",
+		factor: 1,
+		offset: 0
+	},
+	KiB: {
+		dimension: "information",
+		factor: 1024,
+		offset: 0
+	},
+	MiB: {
+		dimension: "information",
+		factor: 1024 ** 2,
+		offset: 0
+	},
+	GiB: {
+		dimension: "information",
+		factor: 1024 ** 3,
+		offset: 0
+	},
+	TiB: {
+		dimension: "information",
+		factor: 1024 ** 4,
+		offset: 0
+	},
+	kB: {
+		dimension: "information",
+		factor: 1e3,
+		offset: 0
+	},
+	MB: {
+		dimension: "information",
+		factor: 1e6,
+		offset: 0
+	},
+	GB: {
+		dimension: "information",
+		factor: 1e9,
+		offset: 0
+	},
+	"°": {
+		dimension: "angle",
+		factor: 1,
+		offset: 0
+	},
+	dBFS: {
+		dimension: "sound-level",
+		factor: 1,
+		offset: 0
+	},
+	dBm: {
+		dimension: "signal-level",
+		factor: 1,
+		offset: 0
+	},
+	mired: {
+		dimension: "colour-temperature",
+		factor: 1,
+		offset: 0
+	},
+	kbps: {
+		dimension: "bitrate",
+		factor: 1,
+		offset: 0
+	},
+	Mbps: {
+		dimension: "bitrate",
+		factor: 1e3,
+		offset: 0
+	},
+	fps: {
+		dimension: "rate",
+		factor: 1,
+		offset: 0
+	}
+};
+/** Resolve a unit's `UnitSpec`, or `undefined` when the spelling is unknown. */
+function specFor(unit) {
+	return Object.hasOwn(UNIT_TABLE, unit) ? UNIT_TABLE[unit] : void 0;
+}
+/** Value in `spec`'s unit → its dimension's canonical unit. */
+function toCanonical(value, spec) {
+	return value * spec.factor + spec.offset;
+}
+/** Canonical-unit value → the unit described by `spec`. */
+function fromCanonical(canonical, spec) {
+	return (canonical - spec.offset) / spec.factor;
+}
+/**
+* Graceful variant for the render path: returns the converted value, or
+* `undefined` when the conversion is refused (unknown unit / cross-dimension).
+* Never throws — a render caller falls back to the raw value + source unit.
+*/
+function tryConvertUnit(value, from, to) {
+	if (from === to) return value;
+	const fromSpec = specFor(from);
+	if (!fromSpec) return void 0;
+	const toSpec = specFor(to);
+	if (!toSpec) return void 0;
+	if (fromSpec.dimension !== toSpec.dimension) return void 0;
+	return fromCanonical(toCanonical(value, fromSpec), toSpec);
+}
+/**
+* A number a person types for a physical quantity — the input side of the
+* value + unit contract (D972).
+*
+* Readings are stored in the base unit of their quantity (D944); a cap method
+* param is stored in the unit its input schema DECLARES (`paramMeta`). The
+* wire pair {@link QuantityValue} says "this number is expressed in this
+* unit"; {@link convertQuantityInput} brings it to the stored unit and refuses,
+* with a typed {@link QuantityUnitError}, a unit that cannot be that quantity.
+*/
+/** A unit that cannot be applied to the number it was given with. */
+var QuantityUnitError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(`[${code}] ${message}`);
+		this.name = "QuantityUnitError";
+		this.code = code;
+	}
+};
+/** The wire pair: `value` is expressed in `unit`. */
+var QuantityValueSchema = object({
+	value: number(),
+	unit: string().min(1)
+});
+/**
+* Zod `.meta()` bag for a cap METHOD param that is a physical quantity — the
+* input-side twin of `readingMeta`. The value is carried in `unit` (a gram
+* portion stays in grams); the unit must belong to the quantity, checked once
+* when the cap is declared.
+*/
+function paramMeta(declared) {
+	const base = baseUnitOf(declared.quantity);
+	if (base === void 0) throw new QuantityUnitError("unknown-unit", `quantity "${declared.quantity}" has no unit`);
+	if (tryConvertUnit(1, declared.unit, base) === void 0) throw new QuantityUnitError("cross-dimension", `"${declared.unit}" is not a unit of ${declared.quantity}`);
+	return {
+		quantity: declared.quantity,
+		unit: declared.unit
+	};
+}
+object({
+	quantity: ReadingQuantitySchema,
+	unit: string().min(1)
+});
 /** How a leaf compares a device field to a value. Derived from the field's
 *  `kind` in `deviceManager.getWireableFields`, never hand-maintained. */
 var AutomationConditionOperatorSchema = _enum([
@@ -16890,8 +17588,10 @@ var AutomationConditionLeafSchema = object({
 		string(),
 		number(),
 		boolean(),
-		array(union([string(), number()]))
-	])
+		array(union([string(), number()])),
+		QuantityValueSchema
+	]),
+	unit: string().min(1).optional()
 });
 var AutomationConditionStationaryPresentSchema = object({
 	kind: literal("stationary-present"),
@@ -17044,7 +17744,13 @@ var AutomationCapStepSchema = object({
 	/** Values may carry `{{vars.x}}` slots, or be exactly `{ $var: 'name' }`, which
 	*  SUBSTITUTE and do not evaluate (§3.2.3). Anything beyond substitution is
 	*  the expression leaf. */
-	args: record(string(), unknown()).optional()
+	args: record(string(), unknown()).optional(),
+	/**
+	* The unit the person picked per arg (display only). `args` always hold the
+	* value in the unit the method's input DECLARES (`paramMeta`); on a write an
+	* arg may be a {@link QuantityValue}, which the save boundary converts.
+	*/
+	argUnits: record(string(), string().min(1)).optional()
 });
 /**
 * The steps an internal Action may contain: cap and wait, and nothing that can
@@ -17446,6 +18152,437 @@ object({
 	lastRunAt: number().nullable(),
 	lastError: string().nullable()
 });
+/** A bare number accepted as a base unit — the save succeeded, say so. */
+var UnitWarningSchema = object({
+	/** Where in the saved record, e.g. `conditions.children.0` or `steps.2.args.grams`. */
+	path: string(),
+	deviceId: number().int().optional(),
+	field: string(),
+	value: number(),
+	assumedUnit: string(),
+	message: string()
+});
+/**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = _enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: string().optional(),
+	bytes: _instanceof(Uint8Array).optional(),
+	mime: string().optional(),
+	name: string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = _enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/**
+* The CLOSED icon vocabulary an action button may use.
+*
+* A closed set, not a free string, and that is the whole point: an arbitrary
+* icon name is one that ntfy renders, zentik silently drops, and nobody
+* notices — the same class of gap as a zone vocabulary nothing produced
+* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
+* declares `actionIcons: false` and the degrade engine strips the field.
+*
+* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
+* renderer's icon set; "acknowledge" survives an adapter that draws it
+* differently.
+*
+* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
+*
+* These names are for US. **No adapter may forward one verbatim.** Each maps
+* the whole set onto its own renderer's vocabulary through a
+* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
+* fallback, so adding a member here fails every adapter's build until someone
+* decides its glyph, which is the only place that decision can be made
+* honestly.
+*
+* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
+* `disarm` straight through; iOS feeds that string to
+* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
+* and every snooze and alarm button arrived BLANK. A pass-through is not a
+* mapping, and "the field is documented" is not "the value renders".
+*
+* Adding a member is TRAIN-BOUND. The enum lives in the published
+* `@camstack/server` closure and the cap seam validates against the HUB's copy,
+* so an addon that emits a token the running hub does not know does not lose an
+* icon — its whole `send` fails Zod validation and the notification never
+* arrives. Never emit a new token from an addon before the train carrying it.
+*/
+var NotificationActionIconSchema = _enum([
+	"acknowledge",
+	"dismiss",
+	"silence",
+	"snooze",
+	"view",
+	"play",
+	"open",
+	"close",
+	"lock",
+	"unlock",
+	"arm",
+	"arm-home",
+	"arm-away",
+	"arm-night",
+	"disarm",
+	"light",
+	"alert",
+	"camera"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = object({
+	id: string(),
+	label: string(),
+	url: string().optional(),
+	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
+	icon: NotificationActionIconSchema.optional(),
+	/**
+	* Renders in a warning style where the notifier supports it.
+	*
+	* A HINT, never a gate. The callback's authority is its token and nothing
+	* else — see `notification-center/action-token.ts` for what that does and
+	* does not buy.
+	*/
+	destructive: boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: _enum(["navigate", "background"]).optional()
+});
+/** A delivery parameter value: what a notifier declared it takes. */
+var DeliveryParamValueSchema = union([
+	string(),
+	number(),
+	boolean()
+]);
+/**
+* One extra delivery parameter a notifier KIND declares (D938). A rule that
+* addresses a target of that kind may set it; a kind that declares nothing is
+* never handed one. The admin UI derives its control from this descriptor —
+* no editor knows a service by name.
+*
+* Optional fields are `.optional()`, never `.default()` (a Zod default does not
+* run on the addon cap path).
+*/
+var DeliveryParamSchema = object({
+	key: string().min(1),
+	label: string(),
+	/** i18n key of the label, resolved by the declaring addon's namespace. */
+	labelKey: string().optional(),
+	type: _enum([
+		"enum",
+		"number",
+		"boolean",
+		"string"
+	]),
+	/** `enum` only: the closed set of accepted values. */
+	options: array(object({
+		value: string(),
+		label: string()
+	})).optional(),
+	/** `number` only. */
+	min: number().optional(),
+	max: number().optional(),
+	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
+	default: DeliveryParamValueSchema.optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = object({
+	body: string(),
+	title: string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: number().int().min(1).max(5).default(3),
+	level: string().optional(),
+	attachments: array(AttachmentSchema).optional(),
+	clickUrl: string().optional(),
+	actions: array(NotificationActionSchema).optional(),
+	sound: string().optional(),
+	ttl: number().optional(),
+	tag: string().optional(),
+	deviceId: number().optional(),
+	eventId: string().optional(),
+	metadata: record(string(), unknown()).optional(),
+	/**
+	* Values for the parameters the target's kind DECLARES in
+	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
+	* declaration by the sender; a notifier reads only the keys it declared.
+	*/
+	delivery: record(string(), DeliveryParamValueSchema).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = object({
+	id: string(),
+	label: string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: number().int().min(1).max(5).nullable(),
+	flags: object({
+		critical: boolean().optional(),
+		silent: boolean().optional(),
+		noPush: boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: array(string()).optional(),
+	description: string().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = object({
+	attachments: object({
+		mediaTypes: array(AttachmentMediaTypeSchema),
+		mode: _enum([
+			"url",
+			"bytes",
+			"both"
+		]),
+		max: number().int().nonnegative(),
+		maxBytes: number().int().positive().optional()
+	}),
+	/** Max action buttons (0 = none). */
+	actions: number().int().nonnegative(),
+	/**
+	* Whether this kind renders a per-action ICON.
+	*
+	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
+	* run on the addon cap path — three production failures in one day taught
+	* this repo that once. Absent is read as false by the degrade engine, which
+	* is the safe direction: an icon that is not rendered costs nothing, an icon
+	* assumed and dropped costs the operator's trust in the field.
+	*/
+	actionIcons: boolean().optional(),
+	levels: array(TargetKindLevelSchema),
+	format: array(NotificationFormatSchema),
+	clickUrl: boolean(),
+	sound: boolean(),
+	ttl: boolean(),
+	bodyMaxLen: number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough$3 = unknown();
+var TargetKindSchema = object({
+	kind: string(),
+	label: string(),
+	icon: string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: string().optional(),
+	configSchema: ConfigSchemaPassthrough$3,
+	/**
+	* The config keys that decide WHERE this kind's secrets are sent (server,
+	* base URL, instance, chat, recipient). A save that changes any of them
+	* while leaving a secret redacted is refused by the provider (D634), so an
+	* editor uses this to ask for the secret on exactly those edits instead of
+	* on every edit.
+	*
+	* Optional: absent from a provider that holds no secret (the Home Assistant
+	* kinds) and from a provider older than this field — an editor that finds
+	* it absent must assume ANY edit may need the secret.
+	*/
+	destinationKeys: array(string()).optional(),
+	supportsDiscovery: boolean(),
+	/**
+	* Extra delivery parameters a rule may set for a target of this kind (D938).
+	* Absent = none; the rule editor then offers nothing.
+	*/
+	deliveryParams: array(DeliveryParamSchema).optional(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = object({
+	id: string(),
+	name: string(),
+	kind: string(),
+	addonId: string(),
+	enabled: boolean(),
+	config: record(string(), unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = object({
+	kind: string(),
+	suggestedName: string(),
+	config: record(string(), unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = object({
+	level: string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: number().int().nonnegative(),
+	actionsSent: number().int().nonnegative(),
+	truncated: boolean(),
+	dropped: array(string())
+});
+var SendResultSchema = object({
+	success: boolean(),
+	error: string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+/**
+* Pre-save credential probe against a partial (unsaved) target config.
+* `resolvedUrl` never includes secrets (token stripped from path).
+*/
+var ProbeTargetConfigResultSchema = object({
+	ok: boolean(),
+	resolvedUrl: string(),
+	httpStatus: number().int().optional(),
+	stateInstance: string().optional(),
+	error: string().optional()
+});
+method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({ targetId: string() }), TargetSchema, { auth: "admin" }), method(object({
+	kind: string(),
+	config: record(string(), unknown()).optional(),
+	/**
+	* When editing / duplicating, the blank password field never round-trips
+	* the stored token. Pass the source target id so the provider can restore
+	* secrets server-side before dialling (same merge as upsert).
+	*/
+	targetId: string().optional()
+}), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
+	kind: string(),
+	config: record(string(), unknown()),
+	/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
+	targetId: string().optional()
+}), ProbeTargetConfigResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	targetId: string(),
+	notification: NotificationSchema
+}), SendResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	targetId: string(),
+	sample: NotificationSchema.optional()
+}), TestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	target: TargetSchema,
+	/**
+	* Duplicate flow: create a NEW target id while copying secrets from an
+	* existing row. The UI never holds the stored token; blank / redacted
+	* password fields are restored from this source (D634 still applies if
+	* destinations diverge without a re-typed secret).
+	*/
+	cloneSecretsFrom: string().optional()
+}), TargetSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ targetId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	targetId: string(),
+	enabled: boolean()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * `addon-pages` — system-scoped singleton aggregator cap. Public-facing
 * surface that admin-ui consumes through `useAddonPagesListPages()`.
@@ -17478,52 +18615,6 @@ var AddonPageInfoSchema = object({
 	bundleUrl: string()
 });
 method(_void(), array(AddonPageInfoSchema).readonly());
-/**
-* `addon-pages-source` — collection cap exposing per-provider raw page
-* declarations. Every addon that contributes a UI page registers a
-* provider here. The hub-side singleton aggregator (`addon-pages` cap,
-* see `addon-pages.cap.ts`) walks this collection, stamps versioned
-* `bundleUrl` values, and returns the enriched `AddonPageInfo[]` list
-* that admin-ui consumes.
-*
-* The split exists because the public listing has a different output
-* shape than the per-provider raw declarations, and we want both ends
-* to flow through codegen instead of relying on a hand-written wrapper.
-*/
-var AddonPageDeclarationSchema = object({
-	id: string(),
-	label: string(),
-	icon: string(),
-	path: string(),
-	/**
-	* Module Federation remote name — must match the `name` field on the
-	* page addon's `federation()` plugin config. Used by admin-ui's
-	* `<AddonPageLoader>` to call `loadRemote('<remoteName>/page')`.
-	* Conventionally `addon_<id>_page` (snake_case; MF names cannot
-	* contain hyphens).
-	*/
-	remoteName: string(),
-	/**
-	* Bundle filename inside the addon's `dist/` dir served at
-	* `/api/addon-pages/<addonId>/<bundle>`. With Module Federation this
-	* is always `'remoteEntry.js'`; the value is kept on the metadata so
-	* the static-file route can compute an mtime-based cache-buster URL
-	* without a separate filesystem stat.
-	*/
-	bundle: string(),
-	/**
-	* Sidebar section this page docks into. Well-known ids: `'detection'`,
-	* `'cluster'`, `'administration'` — the page renders inside that group.
-	* Any OTHER string creates (or joins) a custom section rendered after
-	* the built-in groups; its label comes from `sectionLabel` (first
-	* declaration wins), falling back to the id. Absent → the legacy
-	* "Addon Pages" group.
-	*/
-	section: string().optional(),
-	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
-	sectionLabel: string().optional()
-});
-method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" });
 var AddonHttpRouteSchema = object({
 	method: _enum([
 		"GET",
@@ -17824,9 +18915,21 @@ var AlertSeveritySchema = _enum([
 	"error",
 	"critical"
 ]);
+/**
+* An action that RUNS something instead of going somewhere: the admin UI calls
+* the addon's custom action (`addons.custom`) with exactly these fields. The
+* producer owns the meaning; the UI knows nothing about the addon or the kind.
+*/
+var AlertActionInvokeSchema = object({
+	addonId: string().min(1),
+	action: string().min(1),
+	input: record(string(), unknown()).optional()
+});
+/** An action has `href` (a link) OR `invoke` (a button that runs a custom action). */
 var AlertActionSchema = object({
 	label: string(),
 	href: string().optional(),
+	invoke: AlertActionInvokeSchema.optional(),
 	/**
 	* How `href` is followed. Absent / `app`: an admin-ui route (client-side).
 	* `server`: a route the HUB serves (an addon HTTP route such as an OAuth
@@ -20183,7 +21286,11 @@ var CompositionProblemSchema = object({
 		"mixed-quantity",
 		"helper-mismatch",
 		"member-constraint",
-		"retention"
+		"retention",
+		"command-method-unknown",
+		"command-source-unknown",
+		"command-input-unknown",
+		"command-input-missing"
 	]),
 	path: string(),
 	message: string()
@@ -20222,7 +21329,9 @@ var CompositionFieldRoleSchema = _enum([
 var CompositionFieldItemSchema = object({
 	arrayPath: string(),
 	key: string(),
-	label: string()
+	label: string(),
+	/** True when the item carries a `reset` forward: the composer writes `resettable` from this (D967). */
+	resettable: boolean().optional()
 });
 var CompositionFieldPlanSchema = object({
 	cap: string(),
@@ -20427,7 +21536,7 @@ Object.freeze({
 * One catalog row per base reading a group helper can build (D944 §3).
 * Data, not a form default written into the block.
 */
-var NOW$2 = {
+var NOW$3 = {
 	fieldPath: "lastFetchedAt",
 	expr: "now"
 };
@@ -20479,7 +21588,7 @@ var GROUP_TEMPLATES = [
 		quantity: "temperature",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2],
+		companions: [NOW$3],
 		alsoFrom: {
 			deviceTypes: CLIMATE_DEVICES,
 			accept: {
@@ -20497,7 +21606,7 @@ var GROUP_TEMPLATES = [
 		quantity: "humidity",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2],
+		companions: [NOW$3],
 		alsoFrom: {
 			deviceTypes: CLIMATE_DEVICES,
 			accept: {
@@ -20515,7 +21624,7 @@ var GROUP_TEMPLATES = [
 		quantity: "pressure",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2]
+		companions: [NOW$3]
 	}),
 	numeric({
 		id: "illuminance",
@@ -20526,7 +21635,7 @@ var GROUP_TEMPLATES = [
 		quantity: "illuminance",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2]
+		companions: [NOW$3]
 	}),
 	numeric({
 		id: "power",
@@ -20537,7 +21646,7 @@ var GROUP_TEMPLATES = [
 		quantity: "power",
 		defaultAggregate: "sum",
 		empty: "omit",
-		companions: [NOW$2]
+		companions: [NOW$3]
 	}),
 	numeric({
 		id: "energy",
@@ -20548,7 +21657,7 @@ var GROUP_TEMPLATES = [
 		quantity: "energy",
 		defaultAggregate: "sum",
 		empty: "omit",
-		companions: [NOW$2]
+		companions: [NOW$3]
 	}),
 	numeric({
 		id: "battery",
@@ -20583,7 +21692,7 @@ var GROUP_TEMPLATES = [
 		quantity: "device",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2]
+		companions: [NOW$3]
 	}),
 	binary({
 		id: "motion",
@@ -22533,116 +23642,6 @@ var DeviceAdminLinkSchema = object({
 });
 method(object({ deviceId: number().int().nonnegative() }), DeviceAdminLinkSchema.nullable(), { auth: "admin" });
 /**
-* Identity envelope for a device's upstream-system metadata.
-*
-* Two jobs:
-*
-*   1. **Dispatch key.** `id` is the natural identifier the SOURCE system
-*      uses to address this device (HA `entity_id`, Reolink MAC, ONVIF
-*      WS-Discovery endpoint UUID, …). Provider code keeps a
-*      `Map<sourceInfo.id, IDevice>` to route inbound push events in O(1)
-*      without round-tripping through `stableId` / `id` mappings.
-*
-*   2. **Stability bridge.** `uniqueId` is the *immutable* upstream id when
-*      one exists (HA `entity.unique_id`, Reolink MAC again — same as `id`
-*      for vendors where MAC is the natural key). For systems where the
-*      live dispatch key can be renamed (HA `entity_id` can be edited),
-*      providers detect renames by matching `uniqueId` and patch `id`
-*      in-place so dispatch keeps working.
-*
-* **Display unit and precision are NOT stored here.** They are a read-time
-* preference (D944). A polymorphic reading stores its `quantity` here once,
-* at adopt, and a date/time value stores `dateTimeShape` the same way —
-* neither is repeated on each sample. The `device_class` tag is an
-* HA-specific input consumed at the discovery boundary (`ha-domain-mapping`)
-* to derive the CamStack `DeviceRole`; it is never stored after that point.
-*
-* The `raw` escape hatch carries provider-specific attributes that don't
-* fit the structured slots (HA `attributes` whitelist, Reolink `deviceCache`
-* details, …). Providers control what lands here.
-*/
-var SourceInfoSchema = object({
-	/** Live dispatch key — mutable when the source system allows rename. */
-	id: string(),
-	/** Source system tag — e.g. 'homeassistant' | 'reolink' | 'onvif'. */
-	system: string(),
-	/** Immutable upstream identifier when available (HA `unique_id`, … ).
-	*  Used to detect rename when `id` changes. */
-	uniqueId: string().optional(),
-	/** Quantity of a polymorphic reading, written once at adopt (D944). */
-	quantity: ReadingQuantitySchema.optional(),
-	/** Date / time / datetime shape of a string reading, written once at adopt. */
-	dateTimeShape: _enum([
-		"date",
-		"time",
-		"datetime"
-	]).optional(),
-	/** Provider-specific extras that don't fit the structured slots.
-	*  Whitelist what goes here per provider — do NOT dump entire HA
-	*  attribute blobs (would explode the meta JSON column). */
-	raw: record(string(), unknown()).optional()
-});
-/**
-* Build the synthetic SourceInfo every existing provider falls back to
-* when no upstream value has been persisted. Keeps non-migrated providers
-* (Reolink / Hikvision / ONVIF / RTSP) functional without code
-* changes — `id` reuses the CamStack stableId, `system` reuses the addon
-* id. Real upstream identity replaces this once a provider migrates and
-* calls `updateSourceInfo()` with concrete values.
-*/
-function synthesizeSourceInfo(input) {
-	return {
-		id: input.stableId,
-		system: input.addonId
-	};
-}
-/**
-* Shallow-merge a partial patch over a prior SourceInfo. `undefined`
-* patch values are ignored (no field clobber); to clear a field
-* explicitly, providers omit it from the patch and rebuild from scratch
-* via `updateSourceInfo({})` cycles — uncommon enough that we don't
-* bother with a `null`-means-delete sentinel.
-*
-* The `raw` field is also shallow-merged: passing `raw: { foo: 1 }`
-* merges over existing `raw` keys instead of replacing the whole bag.
-*/
-function mergeSourceInfo(prev, patch) {
-	const next = { ...prev };
-	for (const [k, v] of Object.entries(patch)) {
-		if (v === void 0) continue;
-		if (k === "raw" && typeof v === "object" && v !== null) {
-			next.raw = {
-				...prev.raw,
-				...v
-			};
-			continue;
-		}
-		next[k] = v;
-	}
-	return next;
-}
-/**
-* Key under which `SourceInfo` lives inside `DeviceMeta.metadata`. The
-* blob is a free-form `Record<string, unknown>` shared with hardware-
-* identity fields (`manufacturer`, `model`, `firmware`, …); SourceInfo
-* lives under a single nested key to keep it composable with those.
-*/
-var SOURCE_INFO_METADATA_KEY = "sourceInfo";
-/**
-* Extract a SourceInfo from a `DeviceMeta.metadata` blob, validating
-* with Zod. Returns `null` when the blob is missing or the nested
-* `sourceInfo` key fails validation — callers fall back to the
-* synthetic default in that case (see `synthesizeSourceInfo`).
-*/
-function extractSourceInfoFromMetadata(metadata) {
-	if (!metadata) return null;
-	const raw = metadata[SOURCE_INFO_METADATA_KEY];
-	if (!raw) return null;
-	const parsed = SourceInfoSchema.safeParse(raw);
-	if (!parsed.success) return null;
-	return parsed.data;
-}
-/**
 * device-discovery — device-scoped capability for parents that host /
 * enumerate child devices (Reolink Hub / NVR, ONVIF gateway, future
 * integrations). The parent advertises a list of discoverable children,
@@ -23047,12 +24046,48 @@ var ExposeInputSchema = object({
 	capabilities: array(string()).optional()
 });
 var UnexposeInputSchema = object({ deviceId: string() });
+/**
+* What an exporter may expose besides devices (D968). An action and a
+* notification target are LIST ENTRIES, never devices (D954): they enter an
+* exporter's own selection, not the device registry.
+*/
+var ExportEntityKindSchema = _enum([
+	"device",
+	"action",
+	"notifier"
+]);
+var ExportEntityRefSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("device"),
+		deviceId: string()
+	}),
+	object({
+		kind: literal("action"),
+		actionId: string().min(1)
+	}),
+	object({
+		kind: literal("notifier"),
+		targetId: string().min(1)
+	})
+]);
+var ExposedEntitySchema = object({
+	entity: ExportEntityRefSchema,
+	exposedAs: string().optional()
+});
+var ExposeEntityInputSchema = object({ entity: ExportEntityRefSchema });
+var UnexposeEntityInputSchema = object({ entity: ExportEntityRefSchema });
 method(_void(), DeviceExportStatusSchema), method(_void(), array(DeviceKindSchema)), method(_void(), array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(UnexposeInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), optionalMethod(_void(), array(ExportEntityKindSchema)), optionalMethod(_void(), array(ExposedEntitySchema)), optionalMethod(ExposeEntityInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), optionalMethod(UnexposeEntityInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
 });
 /** Lucide category ids, alphabetical. `ICON_META` indexes into this. */
 var ICON_CATEGORY_IDS = [
@@ -44268,6 +45303,14 @@ var embeddingEncoderCapability = {
 		})
 	}
 };
+method(object({
+	nodeId: string().min(1),
+	/** Epoch ms the node was forgotten (the tombstone's `removedAt`). */
+	removedAt: number()
+}), object({ counts: record(string(), number().int().nonnegative()) }), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * `device-removal-hook` — the reliable way an addon learns a device was DELETED,
 * so it can delete what it keeps for that device (D865).
@@ -45110,7 +46153,7 @@ var LlmProviderWidgetSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$3 = unknown();
+var ConfigSchemaPassthrough$2 = unknown();
 var LlmProfileKindDescriptorSchema = object({
 	kind: LlmProfileKindSchema,
 	label: string(),
@@ -45119,9 +46162,9 @@ var LlmProfileKindDescriptorSchema = object({
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
 	/** The provider's own fields (`providerConfig`); `password` fields are keychain-held. */
-	connectionSchema: ConfigSchemaPassthrough$3,
+	connectionSchema: ConfigSchemaPassthrough$2,
 	/** Provider fields that belong under "Advanced" (extra headers, runtime tuning). */
-	advancedSchema: ConfigSchemaPassthrough$3.optional(),
+	advancedSchema: ConfigSchemaPassthrough$2.optional(),
 	/** The kind's defaults; a model from `listModels` may override any of them. */
 	features: LlmModelFeaturesSchema,
 	/** `false` = the provider stamps `supportsVision` itself (from what a node reports). */
@@ -45647,10 +46690,10 @@ var CpuBreakdownSchema = object({
 	cores: number()
 });
 var MemoryInfoSchema = object({
-	percent: number(),
+	percent: number().nullable(),
 	totalBytes: number(),
-	usedBytes: number(),
-	availableBytes: number(),
+	usedBytes: number().nullable(),
+	availableBytes: number().nullable(),
 	swapUsedBytes: number(),
 	swapTotalBytes: number()
 });
@@ -45954,8 +46997,9 @@ var GetLoadSeriesInputSchema = object({
 });
 var SystemMetricsSchema = object({
 	cpuPercent: number(),
-	memoryPercent: number(),
-	memoryUsedMB: number(),
+	/** `null` when the memory sample failed or was not taken yet (D393). */
+	memoryPercent: number().nullable(),
+	memoryUsedMB: number().nullable(),
 	memoryTotalMB: number(),
 	diskPercent: number().optional(),
 	temperature: number().optional(),
@@ -46191,427 +47235,6 @@ var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
 	sourcePort: number().optional()
 });
 method(_void(), NetworkEndpointSchema, { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), NetworkEndpointSchema.nullable()), method(_void(), NetworkAccessStatusSchema), method(_void(), array(NetworkEndpointEntrySchema).readonly());
-/**
-* notification-output — canonical, capability-gated notification delivery.
-*
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
-*
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
-*
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = _enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: string().optional(),
-	bytes: _instanceof(Uint8Array).optional(),
-	mime: string().optional(),
-	name: string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = _enum([
-	"text",
-	"markdown",
-	"html"
-]);
-/**
-* The CLOSED icon vocabulary an action button may use.
-*
-* A closed set, not a free string, and that is the whole point: an arbitrary
-* icon name is one that ntfy renders, zentik silently drops, and nobody
-* notices — the same class of gap as a zone vocabulary nothing produced
-* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
-* declares `actionIcons: false` and the degrade engine strips the field.
-*
-* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
-* renderer's icon set; "acknowledge" survives an adapter that draws it
-* differently.
-*
-* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
-*
-* These names are for US. **No adapter may forward one verbatim.** Each maps
-* the whole set onto its own renderer's vocabulary through a
-* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
-* fallback, so adding a member here fails every adapter's build until someone
-* decides its glyph, which is the only place that decision can be made
-* honestly.
-*
-* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
-* `disarm` straight through; iOS feeds that string to
-* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
-* and every snooze and alarm button arrived BLANK. A pass-through is not a
-* mapping, and "the field is documented" is not "the value renders".
-*
-* Adding a member is TRAIN-BOUND. The enum lives in the published
-* `@camstack/server` closure and the cap seam validates against the HUB's copy,
-* so an addon that emits a token the running hub does not know does not lose an
-* icon — its whole `send` fails Zod validation and the notification never
-* arrives. Never emit a new token from an addon before the train carrying it.
-*/
-var NotificationActionIconSchema = _enum([
-	"acknowledge",
-	"dismiss",
-	"silence",
-	"snooze",
-	"view",
-	"play",
-	"open",
-	"close",
-	"lock",
-	"unlock",
-	"arm",
-	"arm-home",
-	"arm-away",
-	"arm-night",
-	"disarm",
-	"light",
-	"alert",
-	"camera"
-]);
-/** A single tap-through action button. */
-var NotificationActionSchema = object({
-	id: string(),
-	label: string(),
-	url: string().optional(),
-	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
-	icon: NotificationActionIconSchema.optional(),
-	/**
-	* Renders in a warning style where the notifier supports it.
-	*
-	* A HINT, never a gate. The callback's authority is its token and nothing
-	* else — see `notification-center/action-token.ts` for what that does and
-	* does not buy.
-	*/
-	destructive: boolean().optional(),
-	/**
-	* How the tap should REACH the url.
-	*
-	* `navigate` (absent, and every button authored before this field) opens it:
-	* the phone leaves the notification and shows whatever the callback returns.
-	* That is right for a button whose answer the operator wants to read.
-	*
-	* `background` fires it as a POST and stays put. It exists for the buttons
-	* whose whole point is not to interrupt — "silence this for 30 minutes" is
-	* an answer to the notification, and being thrown into a browser tab to
-	* confirm it costs more attention than the notification did. A backend that
-	* cannot do a background call renders it as an ordinary link (the adapters
-	* fall back rather than dropping the button), so this is a preference, never
-	* a requirement.
-	*/
-	mode: _enum(["navigate", "background"]).optional()
-});
-/** A delivery parameter value: what a notifier declared it takes. */
-var DeliveryParamValueSchema = union([
-	string(),
-	number(),
-	boolean()
-]);
-/**
-* One extra delivery parameter a notifier KIND declares (D938). A rule that
-* addresses a target of that kind may set it; a kind that declares nothing is
-* never handed one. The admin UI derives its control from this descriptor —
-* no editor knows a service by name.
-*
-* Optional fields are `.optional()`, never `.default()` (a Zod default does not
-* run on the addon cap path).
-*/
-var DeliveryParamSchema = object({
-	key: string().min(1),
-	label: string(),
-	/** i18n key of the label, resolved by the declaring addon's namespace. */
-	labelKey: string().optional(),
-	type: _enum([
-		"enum",
-		"number",
-		"boolean",
-		"string"
-	]),
-	/** `enum` only: the closed set of accepted values. */
-	options: array(object({
-		value: string(),
-		label: string()
-	})).optional(),
-	/** `number` only. */
-	min: number().optional(),
-	max: number().optional(),
-	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
-	default: DeliveryParamValueSchema.optional()
-});
-/**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
-*/
-var NotificationSchema = object({
-	body: string(),
-	title: string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: number().int().min(1).max(5).default(3),
-	level: string().optional(),
-	attachments: array(AttachmentSchema).optional(),
-	clickUrl: string().optional(),
-	actions: array(NotificationActionSchema).optional(),
-	sound: string().optional(),
-	ttl: number().optional(),
-	tag: string().optional(),
-	deviceId: number().optional(),
-	eventId: string().optional(),
-	metadata: record(string(), unknown()).optional(),
-	/**
-	* Values for the parameters the target's kind DECLARES in
-	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
-	* declaration by the sender; a notifier reads only the keys it declared.
-	*/
-	delivery: record(string(), DeliveryParamValueSchema).optional()
-});
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = object({
-	id: string(),
-	label: string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: number().int().min(1).max(5).nullable(),
-	flags: object({
-		critical: boolean().optional(),
-		silent: boolean().optional(),
-		noPush: boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: array(string()).optional(),
-	description: string().optional()
-});
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = object({
-	attachments: object({
-		mediaTypes: array(AttachmentMediaTypeSchema),
-		mode: _enum([
-			"url",
-			"bytes",
-			"both"
-		]),
-		max: number().int().nonnegative(),
-		maxBytes: number().int().positive().optional()
-	}),
-	/** Max action buttons (0 = none). */
-	actions: number().int().nonnegative(),
-	/**
-	* Whether this kind renders a per-action ICON.
-	*
-	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
-	* run on the addon cap path — three production failures in one day taught
-	* this repo that once. Absent is read as false by the degrade engine, which
-	* is the safe direction: an icon that is not rendered costs nothing, an icon
-	* assumed and dropped costs the operator's trust in the field.
-	*/
-	actionIcons: boolean().optional(),
-	levels: array(TargetKindLevelSchema),
-	format: array(NotificationFormatSchema),
-	clickUrl: boolean(),
-	sound: boolean(),
-	ttl: boolean(),
-	bodyMaxLen: number().int().positive()
-});
-/**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
-*/
-var ConfigSchemaPassthrough$2 = unknown();
-var TargetKindSchema = object({
-	kind: string(),
-	label: string(),
-	icon: string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: string(),
-	/**
-	* URL of the kind's bundled BRAND icon, served by the providing addon over
-	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
-	* when the addon bundles no icon for that kind — the client then falls back
-	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
-	*
-	* Root-relative on purpose: it resolves against whatever origin serves a web
-	* client, and a native client joins it onto its own hub base.
-	*
-	* DECLARED here deliberately. It used to travel as an undeclared passthrough
-	* field that survived only because the runtime cap-router forwards provider
-	* output verbatim — so every consumer had to re-declare it by hand to stop
-	* its own Zod parse from stripping it, and the whole arrangement would have
-	* broken silently the moment output validation was tightened anywhere.
-	*/
-	iconUrl: string().optional(),
-	/**
-	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
-	*
-	* The server knows this and therefore says it, because the client cannot
-	* safely guess: a React-Native client renders SVG and raster through two
-	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
-	* not decode SVG on iOS/Android), so without this it silently fell back to a
-	* placeholder glyph for every vector icon while the web build looked fine.
-	*
-	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
-	* not been updated — a client that cannot determine the type should prefer
-	* its raster path, which is the safe default for an unknown image.
-	*/
-	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough$2,
-	/**
-	* The config keys that decide WHERE this kind's secrets are sent (server,
-	* base URL, instance, chat, recipient). A save that changes any of them
-	* while leaving a secret redacted is refused by the provider (D634), so an
-	* editor uses this to ask for the secret on exactly those edits instead of
-	* on every edit.
-	*
-	* Optional: absent from a provider that holds no secret (the Home Assistant
-	* kinds) and from a provider older than this field — an editor that finds
-	* it absent must assume ANY edit may need the secret.
-	*/
-	destinationKeys: array(string()).optional(),
-	supportsDiscovery: boolean(),
-	/**
-	* Extra delivery parameters a rule may set for a target of this kind (D938).
-	* Absent = none; the rule editor then offers nothing.
-	*/
-	deliveryParams: array(DeliveryParamSchema).optional(),
-	caps: TargetKindCapsSchema
-});
-/**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
-*/
-var TargetSchema = object({
-	id: string(),
-	name: string(),
-	kind: string(),
-	addonId: string(),
-	enabled: boolean(),
-	config: record(string(), unknown())
-});
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = object({
-	kind: string(),
-	suggestedName: string(),
-	config: record(string(), unknown())
-});
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = object({
-	level: string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: number().int().nonnegative(),
-	actionsSent: number().int().nonnegative(),
-	truncated: boolean(),
-	dropped: array(string())
-});
-var SendResultSchema = object({
-	success: boolean(),
-	error: string().optional(),
-	renderedAs: RenderedAsSchema.optional()
-});
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
-/**
-* Pre-save credential probe against a partial (unsaved) target config.
-* `resolvedUrl` never includes secrets (token stripped from path).
-*/
-var ProbeTargetConfigResultSchema = object({
-	ok: boolean(),
-	resolvedUrl: string(),
-	httpStatus: number().int().optional(),
-	stateInstance: string().optional(),
-	error: string().optional()
-});
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({ targetId: string() }), TargetSchema, { auth: "admin" }), method(object({
-	kind: string(),
-	config: record(string(), unknown()).optional(),
-	/**
-	* When editing / duplicating, the blank password field never round-trips
-	* the stored token. Pass the source target id so the provider can restore
-	* secrets server-side before dialling (same merge as upsert).
-	*/
-	targetId: string().optional()
-}), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
-	kind: string(),
-	config: record(string(), unknown()),
-	/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
-	targetId: string().optional()
-}), ProbeTargetConfigResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	notification: NotificationSchema
-}), SendResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	sample: NotificationSchema.optional()
-}), TestResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	target: TargetSchema,
-	/**
-	* Duplicate flow: create a NEW target id while copying secrets from an
-	* existing row. The UI never holds the stored token; blank / redacted
-	* password fields are restored from this source (D634 still applies if
-	* destinations diverge without a re-typed secret).
-	*/
-	cloneSecretsFrom: string().optional()
-}), TargetSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ targetId: string() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	enabled: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
 var AUDIO_MACRO_LABELS = [
 	{
 		id: "speech",
@@ -54856,14 +55479,6 @@ var EngineProvisioningSchema = object({
 	*/
 	configIssues: array(string()).optional()
 });
-var PipelineStepInputSchema = lazy(() => object({
-	addonId: string(),
-	modelId: string().optional(),
-	enabled: boolean().default(true),
-	children: array(PipelineStepInputSchema).optional(),
-	settings: record(string(), unknown()).optional(),
-	jumpDeviceKey: string().optional()
-}));
 var ModelSubstitutionSchema = object({
 	addonId: string(),
 	chosen: string(),
@@ -54942,7 +55557,6 @@ var ConfigUISchemaBridge = custom();
 var ConfigUISchemaNullableBridge = custom();
 var InferenceCapabilitiesBridge = custom();
 var ModelAvailabilityListBridge = custom();
-var PipelineRunResultBridge = custom();
 method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngineChoiceSchema), method(object({ nodeId: string() }), EngineProvisioningSchema), method(_void(), record(string(), object({
 	modelId: string(),
 	settings: record(string(), unknown()).readonly()
@@ -57938,11 +58552,13 @@ var ImageContractSchema = object({
 * The shell verdict (see {@link WrapperKindSchema}) with the proofs that
 * produced it.
 *
-* There is deliberately NO `canSelfUpdate` and no apply action: a wrapper
-* update is an ANNOUNCEMENT. The notification body carries the exact command
-* for a `docker` shell and says the app restarts into the new build for
-* `electron`, and that sentence is chosen from `kind` alone — a boolean
-* nothing reads is the defect this repo keeps paying for.
+* There is deliberately NO `canSelfUpdate` boolean: a wrapper update is an
+* ANNOUNCEMENT. The notification body carries the exact command for a `docker`
+* shell and says the app restarts into the new build for `electron`, and that
+* sentence is chosen from `kind` alone — a boolean nothing reads is the defect
+* this repo keeps paying for. The one shell that CAN be acted on is the
+* Electron app, and only through `installDesktopUpdate` (see
+* {@link DesktopAppStatusSchema} for what the node reads from the app first).
 */
 var WrapperIdentitySchema = object({
 	kind: _enum([
@@ -57990,6 +58606,49 @@ var ServerRollbackInfoSchema = object({
 	reason: string()
 });
 /**
+* What the native desktop app (Electron) that hosts this node says about
+* itself, read from `<dataDir>/server-root/desktop-app-state.json` (ADR-0971).
+* Absent on the status = no desktop app, or it never wrote the file.
+*
+* `stale` is the honest answer to an app that stopped writing (closed, hung,
+* crashed): the update facts are then the LAST ones known, not current ones,
+* and a consumer must not read `update.available: false` from a stale record
+* as "no update". `stateAtMs` is when the app last wrote.
+*/
+var DesktopAppStatusSchema = object({
+	/** The Electron app's own version (not the node closure's). */
+	version: string(),
+	update: object({
+		available: boolean(),
+		/** The new build is downloaded and `installDesktopUpdate` can apply it. */
+		downloaded: boolean(),
+		version: string().nullable(),
+		checking: boolean(),
+		/** Why the app's last update check produced no answer; `null` when it did. */
+		error: string().nullable()
+	}),
+	stateAtMs: number(),
+	stale: boolean()
+});
+/**
+* Why `installDesktopUpdate` did nothing. Stable names a UI maps to a sentence:
+*  - `not-electron`   — this node does not run inside the desktop app.
+*  - `no-app-state`   — the app never published its state (or the file is unreadable).
+*  - `app-state-stale` — the app stopped writing; it is probably not running.
+*  - `not-downloaded` — no update is downloaded yet; nothing to install.
+*/
+var InstallDesktopUpdateReasonSchema = _enum([
+	"not-electron",
+	"no-app-state",
+	"app-state-stale",
+	"not-downloaded"
+]);
+var InstallDesktopUpdateResultSchema = object({
+	accepted: boolean(),
+	/** Non-null exactly when `accepted` is false. */
+	reason: InstallDesktopUpdateReasonSchema.nullable()
+});
+/**
 * The runner boot check (D877): the runners this node PLANNED (hub: one per
 * `resolveRunnerId` over its forked addons; agent: the runners its process
 * service holds, because only the hub plans) against the states the process
@@ -58093,7 +58752,12 @@ var ServerPackageStatusSchema = object({
 	* on a provider that predates it. Absent is "not checked yet", never "all
 	* well": a consumer that needs the answer treats it as pending.
 	*/
-	runners: RunnerBootCheckSchema.optional()
+	runners: RunnerBootCheckSchema.optional(),
+	/**
+	* The desktop app hosting this node (see {@link DesktopAppStatusSchema}).
+	* Optional for version skew AND because most nodes have no desktop app.
+	*/
+	desktopApp: DesktopAppStatusSchema.optional()
 });
 var ServerUpdateCheckResultSchema = object({
 	packageName: string(),
@@ -58176,6 +58840,12 @@ var ServerUpdateActionResultSchema = object({
 	*/
 	blockers: array(UpdateBlockerSchema).optional()
 });
+var LaunchOverridesSchema = object({ 
+/** The persisted heap ceiling in MB, or `null` when none is set. */
+heapMb: number().int().nullable() });
+var SetLaunchOverridesResultSchema = LaunchOverridesSchema.extend({ 
+/** Always true: the override is read at launch, not by the running process. */
+restartRequired: boolean() });
 method(_void(), ServerPackageStatusSchema, { auth: "admin" }), method(_void(), ServerUpdateCheckResultSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -58192,12 +58862,18 @@ method(_void(), ServerPackageStatusSchema, { auth: "admin" }), method(_void(), S
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 16 * 6e4
+}), method(_void(), InstallDesktopUpdateResultSchema, {
+	kind: "mutation",
+	auth: "admin"
 }), method(_void(), ServerUpdateActionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(_void(), ServerUpdateActionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(_void(), LaunchOverridesSchema, { auth: "admin" }), method(object({ heapMb: number().int().min(512).max(65536).nullable() }), SetLaunchOverridesResultSchema, {
+	kind: "mutation",
+	auth: "admin"
 });
 /**
 * `smtp-provider` — pluggable email delivery surface.
@@ -61339,13 +62015,19 @@ method(object({}), array(ActionEntrySchema), { auth: "admin" }), method(object({
 }), method(ActionIdInput, _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(ActionIdInput, object({ traces: array(AutomationRunTraceSchema) }), { auth: "admin" }), method(object({ action: ActionInputSchema }), object({ action: ActionEntrySchema }), {
+}), method(ActionIdInput, object({ traces: array(AutomationRunTraceSchema) }), { auth: "admin" }), method(object({ action: ActionInputSchema }), object({
+	action: ActionEntrySchema,
+	warnings: array(UnitWarningSchema).optional()
+}), {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
 	actionId: string().min(1),
 	action: ActionInputSchema.partial()
-}), object({ action: ActionEntrySchema }), {
+}), object({
+	action: ActionEntrySchema,
+	warnings: array(UnitWarningSchema).optional()
+}), {
 	kind: "mutation",
 	auth: "admin"
 }), method(ActionIdInput, _void(), {
@@ -61797,6 +62479,510 @@ onBrightnessChanged: { data: object({
 		minIntervalMs: 0
 	} } }
 };
+/**
+* The role vocabulary of a remote (D963): what a button MEANS, independent of
+* how it is wired. A layout template places buttons by role; a device binds a
+* role to an action; an exporter asks for a role by name. Roles are shared so
+* one layout fits every appliance and one voice command fits every binding.
+*
+* A role outside this list is `custom:<key>` — the operator's own button (a
+* SmartIR source, a channel preset). The key is a lowercase slug.
+*/
+var REMOTE_KNOWN_ROLES = [
+	"power",
+	"power_on",
+	"power_off",
+	"volume_up",
+	"volume_down",
+	"mute",
+	"channel_up",
+	"channel_down",
+	"up",
+	"down",
+	"left",
+	"right",
+	"ok",
+	"back",
+	"home",
+	"menu",
+	"info",
+	"guide",
+	"exit",
+	"input",
+	"play",
+	"pause",
+	"play_pause",
+	"stop",
+	"next",
+	"previous",
+	"fast_forward",
+	"rewind",
+	"digit_0",
+	"digit_1",
+	"digit_2",
+	"digit_3",
+	"digit_4",
+	"digit_5",
+	"digit_6",
+	"digit_7",
+	"digit_8",
+	"digit_9"
+];
+var CUSTOM_KEY_RE = /^[a-z0-9][a-z0-9_]{0,47}$/;
+var KNOWN_ROLES = new Set(REMOTE_KNOWN_ROLES);
+function isRemoteKnownRole(value) {
+	return KNOWN_ROLES.has(value);
+}
+function isRemoteCustomKey(key) {
+	return CUSTOM_KEY_RE.test(key);
+}
+/** The key of a `custom:<key>` role, or null for any other string. */
+function customKeyOfRole(role) {
+	if (!role.startsWith("custom:")) return null;
+	const key = role.slice(7);
+	return isRemoteCustomKey(key) ? key : null;
+}
+function isRemoteRole(value) {
+	return isRemoteKnownRole(value) || customKeyOfRole(value) !== null;
+}
+var RemoteRoleSchema = string().refine(isRemoteRole, { message: "a role is one of the known roles or custom:<key> (lowercase letters, digits, _)" });
+var RemoteBindingSchema = object({ action: AutomationCapStepSchema.extend({ deviceId: number().int().nonnegative() }) });
+var RemoteCustomButtonSchema = object({
+	/** The slug after `custom:` in the role. */
+	key: string().refine(isRemoteCustomKey, { message: "a lowercase slug" }),
+	/** What the operator calls it, and what a voice command may name. */
+	name: string().min(1).max(60)
+});
+var RemotePowerModeSchema = _enum(["toggle", "discrete"]);
+var RemoteConfigSchema = object({
+	layoutTemplateId: string().min(1).nullable(),
+	/**
+	* The transmitter device new bindings and an import send through. A binding
+	* names its own device, so one command may override it.
+	*/
+	defaultTransmitterId: number().int().nonnegative().nullable().default(null),
+	/** Keyed by role. A role with no entry falls back to the native cap. */
+	bindings: record(string(), RemoteBindingSchema),
+	customButtons: array(RemoteCustomButtonSchema).max(100),
+	power: object({ mode: RemotePowerModeSchema })
+}).superRefine((config, ctx) => {
+	const roles = Object.keys(config.bindings);
+	if (roles.length > 200) ctx.addIssue({
+		code: "custom",
+		message: "too many bindings",
+		path: ["bindings"]
+	});
+	for (const role of roles) if (!isRemoteRole(role)) ctx.addIssue({
+		code: "custom",
+		message: `"${role}" is not a role`,
+		path: ["bindings", role]
+	});
+	const keys = /* @__PURE__ */ new Set();
+	config.customButtons.forEach((button, index) => {
+		if (keys.has(button.key)) ctx.addIssue({
+			code: "custom",
+			message: `custom button "${button.key}" is listed twice`,
+			path: [
+				"customButtons",
+				index,
+				"key"
+			]
+		});
+		keys.add(button.key);
+	});
+	for (const role of roles) {
+		const key = customKeyOfRole(role);
+		if (key !== null && !keys.has(key)) ctx.addIssue({
+			code: "custom",
+			message: `${role} is bound but has no entry in customButtons`,
+			path: ["bindings", role]
+		});
+	}
+});
+object({
+	power: object({
+		state: _enum(["on", "off"]),
+		at: number()
+	}).nullable(),
+	muted: object({
+		value: boolean(),
+		at: number()
+	}).nullable()
+});
+var RemoteButtonShapeSchema = _enum([
+	"rect",
+	"rounded",
+	"round",
+	"pill"
+]);
+var RemoteButtonToneSchema = _enum([
+	"neutral",
+	"accent",
+	"danger",
+	"red",
+	"green",
+	"yellow",
+	"blue"
+]);
+var RemoteGroupFrameSchema = _enum([
+	"none",
+	"panel",
+	"divider",
+	"dpad",
+	"rocker-v",
+	"rocker-h",
+	"keypad"
+]);
+var RemoteLayoutButtonSchema = object({
+	id: string().min(1).max(40),
+	/** 0-based grid position. */
+	row: number().int().min(0).max(24),
+	col: number().int().min(0).max(24),
+	rowSpan: number().int().min(1).max(24),
+	colSpan: number().int().min(1).max(24),
+	icon: string().min(1).max(60).optional(),
+	label: string().min(1).max(40).optional(),
+	role: RemoteRoleSchema,
+	/** Absent = the plain rendering every layout had before shapes existed. */
+	shape: RemoteButtonShapeSchema.optional(),
+	tone: RemoteButtonToneSchema.optional(),
+	/** The group this button belongs to; it must lie inside that group's rectangle. */
+	groupId: string().min(1).max(40).optional()
+});
+/**
+* A rectangle of the grid that moves as ONE thing and is drawn with a frame: a
+* titled panel, a section divider, a D-pad ring. `componentId` names the palette
+* entry it came from (informational: the layout is self-contained).
+*/
+var RemoteLayoutGroupSchema = object({
+	id: string().min(1).max(40),
+	componentId: string().min(1).max(80),
+	frame: RemoteGroupFrameSchema,
+	row: number().int().min(0).max(24),
+	col: number().int().min(0).max(24),
+	rowSpan: number().int().min(1).max(24),
+	colSpan: number().int().min(1).max(24),
+	title: string().min(1).max(40).optional()
+});
+function rectsOverlap(a, b) {
+	return a.row < b.row + b.rowSpan && b.row < a.row + a.rowSpan && a.col < b.col + b.colSpan && b.col < a.col + a.colSpan;
+}
+function rectContains(outer, inner) {
+	return inner.row >= outer.row && inner.col >= outer.col && inner.row + inner.rowSpan <= outer.row + outer.rowSpan && inner.col + inner.colSpan <= outer.col + outer.colSpan;
+}
+/**
+* The group rules of a layout: inside the grid, no two groups overlap, a
+* member lies inside its group, a divider holds nothing, and a button that is
+* not a member never sits inside someone else's rectangle (a group moves as
+* one thing, so a stray key under it would be left behind).
+*/
+function refineGroups(grid, ctx) {
+	const groups = grid.groups ?? [];
+	const byId = /* @__PURE__ */ new Map();
+	const fail = (message, path) => {
+		ctx.addIssue({
+			code: "custom",
+			message,
+			path
+		});
+	};
+	groups.forEach((group, index) => {
+		if (byId.has(group.id)) fail(`group id "${group.id}" is used twice`, [
+			"groups",
+			index,
+			"id"
+		]);
+		byId.set(group.id, group);
+		if (group.row + group.rowSpan > grid.rows || group.col + group.colSpan > grid.columns) fail(`group "${group.id}" leaves the grid`, ["groups", index]);
+		for (let other = 0; other < index; other += 1) {
+			const earlier = groups[other];
+			if (earlier !== void 0 && rectsOverlap(earlier, group)) {
+				fail(`groups "${earlier.id}" and "${group.id}" overlap`, ["groups", index]);
+				return;
+			}
+		}
+	});
+	grid.buttons.forEach((button, index) => {
+		if (button.groupId !== void 0) {
+			const group = byId.get(button.groupId);
+			if (group === void 0) {
+				fail(`button "${button.id}" names the unknown group "${button.groupId}"`, [
+					"buttons",
+					index,
+					"groupId"
+				]);
+				return;
+			}
+			if (group.frame === "divider") fail(`a divider group ("${group.id}") holds no buttons`, [
+				"buttons",
+				index,
+				"groupId"
+			]);
+			if (!rectContains(group, button)) fail(`button "${button.id}" lies outside its group "${group.id}"`, ["buttons", index]);
+			return;
+		}
+		const foreign = groups.find((group) => rectsOverlap(group, button));
+		if (foreign !== void 0) fail(`button "${button.id}" lies inside group "${foreign.id}" but is not a member`, ["buttons", index]);
+	});
+}
+object({
+	columns: number().int().min(1).max(24),
+	rows: number().int().min(1).max(24),
+	buttons: array(RemoteLayoutButtonSchema).max(200),
+	groups: array(RemoteLayoutGroupSchema).max(50).optional()
+}).superRefine((grid, ctx) => {
+	const ids = /* @__PURE__ */ new Set();
+	const taken = /* @__PURE__ */ new Map();
+	grid.buttons.forEach((button, index) => {
+		if (ids.has(button.id)) ctx.addIssue({
+			code: "custom",
+			message: `button id "${button.id}" is used twice`,
+			path: [
+				"buttons",
+				index,
+				"id"
+			]
+		});
+		ids.add(button.id);
+		if (button.row + button.rowSpan > grid.rows || button.col + button.colSpan > grid.columns) {
+			ctx.addIssue({
+				code: "custom",
+				message: `button "${button.id}" leaves the grid`,
+				path: ["buttons", index]
+			});
+			return;
+		}
+		for (let r = button.row; r < button.row + button.rowSpan; r += 1) for (let c = button.col; c < button.col + button.colSpan; c += 1) {
+			const cell = `${r}:${c}`;
+			const other = taken.get(cell);
+			if (other !== void 0) {
+				ctx.addIssue({
+					code: "custom",
+					message: `buttons "${other}" and "${button.id}" overlap`,
+					path: ["buttons", index]
+				});
+				return;
+			}
+			taken.set(cell, button.id);
+		}
+	});
+	refineGroups(grid, ctx);
+});
+var RemoteBoundCommandSchema = object({
+	role: RemoteRoleSchema,
+	/** The operator's name for a custom button; absent for a known role. */
+	label: string().optional(),
+	custom: boolean()
+});
+var RemoteCommandListSchema = object({
+	layoutTemplateId: string().nullable(),
+	power: object({ mode: RemotePowerModeSchema }),
+	/** Only the roles that are BOUND — the ones a press can reach. */
+	commands: array(RemoteBoundCommandSchema)
+});
+var RemoteRefusalReasonSchema = _enum([
+	"no-remote",
+	"unbound-role",
+	"action-failed"
+]);
+var RemoteSendResultSchema = discriminatedUnion("status", [
+	object({
+		status: literal("sent"),
+		/** How many times the action ran. */
+		sends: number().int().min(1)
+	}),
+	object({
+		status: literal("skipped"),
+		reason: literal("already-in-state")
+	}),
+	object({
+		status: literal("refused"),
+		reason: RemoteRefusalReasonSchema,
+		detail: string().optional()
+	})
+]);
+var RemoteMediaCommandSchema = _enum([
+	"play",
+	"pause",
+	"stop",
+	"next",
+	"previous",
+	"setMute",
+	"selectSource"
+]);
+/** A send result, or `not-routed`: the role is not bound, so the native cap answers. */
+var RemoteMediaCommandResultSchema = discriminatedUnion("status", [...RemoteSendResultSchema.options, object({ status: literal("not-routed") })]);
+var RemoteSetConfigResultSchema = discriminatedUnion("status", [object({ status: literal("saved") }), object({
+	status: literal("refused"),
+	reason: _enum(["unknown-template", "not-a-media-player"]),
+	detail: string()
+})]);
+var deviceInput = object({ deviceId: number().int().nonnegative() });
+DeviceType.MediaPlayer;
+method(deviceInput, RemoteConfigSchema, { auth: "admin" }), method(deviceInput.extend({ config: RemoteConfigSchema }), RemoteSetConfigResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(deviceInput, RemoteCommandListSchema, { auth: "protected" }), method(deviceInput.extend({
+	role: RemoteRoleSchema,
+	/** Sends in a row (volume steps). */
+	repeat: number().int().min(1).max(50).default(1)
+}), RemoteSendResultSchema, {
+	kind: "mutation",
+	auth: "protected"
+}), method(deviceInput.extend({
+	command: RemoteMediaCommandSchema,
+	muted: boolean().optional(),
+	source: string().optional(),
+	repeat: number().int().min(1).max(50).default(1)
+}), RemoteMediaCommandResultSchema, {
+	kind: "mutation",
+	auth: "protected"
+});
+var TemplateKindSchema = _enum(["remote"]);
+/**
+* template — the generic store of reusable, named operator data (D963). A
+* record is `{ id, kind, name, payload }`; the kinds (today only `remote`, the
+* button grid of a remote) and the schema each payload must satisfy are
+* declared by the system in `template-kinds.ts`. Nothing here is specific to a
+* kind: the engine validates a payload against its kind's schema and, on a
+* delete, asks the kind's owner whether anything still points at the record.
+*
+* Every refusal is a typed result — a UI says "unknown kind" or names the
+* devices that still use a template, without parsing text.
+*/
+var TemplateRecordSchema = object({
+	id: string().min(1),
+	kind: TemplateKindSchema,
+	name: string().min(1).max(120),
+	/** Shaped by the kind; `checkTemplatePayload(kind, payload)` reads it. */
+	payload: unknown(),
+	createdAt: number(),
+	updatedAt: number()
+});
+var TemplateWriteResultSchema = discriminatedUnion("status", [object({
+	status: literal("saved"),
+	template: TemplateRecordSchema
+}), object({
+	status: literal("refused"),
+	reason: _enum(["invalid-payload", "not-found"]),
+	detail: string()
+})]);
+/** A device still pointing at a template. */
+var TemplateUserSchema = object({
+	deviceId: number().int().nonnegative(),
+	name: string()
+});
+var TemplateDeleteResultSchema = discriminatedUnion("status", [
+	object({ status: literal("deleted") }),
+	object({ status: literal("not-found") }),
+	object({
+		status: literal("in-use"),
+		devices: array(TemplateUserSchema).min(1)
+	})
+]);
+method(object({ kind: TemplateKindSchema.optional() }), array(TemplateRecordSchema), { auth: "protected" }), method(object({ id: string().min(1) }), TemplateRecordSchema.nullable(), { auth: "protected" }), method(object({
+	kind: TemplateKindSchema,
+	name: string().min(1).max(120),
+	payload: unknown()
+}), TemplateWriteResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	id: string().min(1),
+	name: string().min(1).max(120).optional(),
+	payload: unknown().optional()
+}), TemplateWriteResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string().min(1) }), TemplateDeleteResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+var RemoteComponentCategorySchema = _enum([
+	"power",
+	"navigation",
+	"volume",
+	"numbers",
+	"media",
+	"colour",
+	"apps",
+	"layout"
+]);
+/** `<namespace>:<name>`, both lowercase slugs — `core:dpad`, `<addonId>:<name>`. */
+var COMPONENT_ID_RE = /^[a-z0-9][a-z0-9_.-]*:[a-z0-9][a-z0-9_-]*$/;
+var RemoteComponentButtonSchema = object({
+	/** Joined to the instance id when the component is inserted. */
+	idSuffix: string().regex(/^[a-z0-9][a-z0-9_-]{0,19}$/, { message: "a short lowercase slug" }),
+	row: number().int().min(0).max(24),
+	col: number().int().min(0).max(24),
+	rowSpan: number().int().min(1).max(24),
+	colSpan: number().int().min(1).max(24),
+	role: RemoteRoleSchema,
+	icon: string().min(1).max(60).optional(),
+	label: string().min(1).max(40).optional(),
+	shape: RemoteButtonShapeSchema.optional(),
+	tone: RemoteButtonToneSchema.optional()
+});
+var RemoteLayoutComponentSchema = object({
+	id: string().max(80).regex(COMPONENT_ID_RE, { message: "<namespace>:<name>, lowercase" }),
+	name: string().min(1).max(60),
+	nameI18n: object({
+		en: string().min(1).max(60),
+		it: string().min(1).max(60)
+	}).optional(),
+	/** A display icon key, resolved by the UI like a button icon. */
+	icon: string().min(1).max(60),
+	category: RemoteComponentCategorySchema,
+	size: object({
+		rows: number().int().min(1).max(24),
+		cols: number().int().min(1).max(24)
+	}),
+	/** The frame drawn around the whole component, or null for loose buttons. */
+	group: object({
+		frame: RemoteGroupFrameSchema,
+		title: string().min(1).max(40).optional()
+	}).nullable(),
+	buttons: array(RemoteComponentButtonSchema).max(40)
+}).superRefine((component, ctx) => {
+	const suffixes = /* @__PURE__ */ new Set();
+	component.buttons.forEach((button, index) => {
+		if (suffixes.has(button.idSuffix)) ctx.addIssue({
+			code: "custom",
+			message: `button "${button.idSuffix}" is listed twice`,
+			path: [
+				"buttons",
+				index,
+				"idSuffix"
+			]
+		});
+		suffixes.add(button.idSuffix);
+		if (button.row + button.rowSpan > component.size.rows || button.col + button.colSpan > component.size.cols) {
+			ctx.addIssue({
+				code: "custom",
+				message: `button "${button.idSuffix}" leaves the component`,
+				path: ["buttons", index]
+			});
+			return;
+		}
+		for (let other = 0; other < index; other += 1) {
+			const earlier = component.buttons[other];
+			if (earlier !== void 0 && rectsOverlap(earlier, button)) {
+				ctx.addIssue({
+					code: "custom",
+					message: `buttons "${earlier.idSuffix}" and "${button.idSuffix}" overlap`,
+					path: ["buttons", index]
+				});
+				return;
+			}
+		}
+	});
+	if (component.group?.frame === "divider" && component.buttons.length > 0) ctx.addIssue({
+		code: "custom",
+		message: "a divider component holds no buttons",
+		path: ["buttons"]
+	});
+});
+method(object({}), array(RemoteLayoutComponentSchema), { auth: "protected" });
 DeviceType.Button, method(object({ deviceId: number().int().nonnegative() }), _void(), {
 	kind: "mutation",
 	auth: "protected"
@@ -62852,14 +64038,13 @@ reset: method(object({
 		auth: "admin"
 	}) },
 	/**
-	* A composed consumable (item added to a device with no native consumables
-	* provider) refuses `reset` by name: "Only meaningful when the item's
-	* `resettable` is true" — a composed item is never resettable until
-	* commands (`forward`) arrive in slice 3 (D663).
+	* A consumable ADDED to an existing device (a graft) refuses `reset` by
+	* name: only a composed device of a NEW type forwards an item's reset to a
+	* source button, and marks that item `resettable` (D967).
 	*/
 	composedMethods: { reset: {
 		kind: "refuse",
-		reason: "a composed consumable is not resettable until commands (forward) arrive — slice 3"
+		reason: "a consumable added to an existing device is not resettable — only a new composed device forwards a reset"
 	} },
 	status: {
 		schema: ConsumablesStatusSchema,
@@ -63475,7 +64660,7 @@ var DishwasherStatusSchema = object({
 	/** Ms epoch of the last value received from the appliance; 0 = never. */
 	lastFetchedAt: number()
 });
-var DeviceIdSchema = number().int().nonnegative();
+var DeviceIdSchema$1 = number().int().nonnegative();
 /** A value a program option or setting can take. */
 var DishwasherValueSchema = union([
 	boolean(),
@@ -63550,77 +64735,77 @@ var dishwasherCapability = {
 		* option feature keys; each is checked against the program's constraints.
 		*/
 		start: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			program: string().min(1).optional(),
 			options: record(string(), DishwasherValueSchema).optional()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		pause: method(object({ deviceId: DeviceIdSchema }), _void(), {
+		pause: method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		resume: method(object({ deviceId: DeviceIdSchema }), _void(), {
+		resume: method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		stop: method(object({ deviceId: DeviceIdSchema }), _void(), {
+		stop: method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		/** Select (not start) a program; refused when the appliance does not offer it. */
 		setProgram: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			program: string().min(1)
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setPower: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setHalfLoad: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setHygienePlus: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setExtraDry: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setIntensiveZone: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setVarioSpeedPlus: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setChildLock: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
@@ -63632,7 +64817,7 @@ var dishwasherCapability = {
 		* its declared range / members.
 		*/
 		setOption: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			key: string().min(1),
 			value: DishwasherValueSchema
 		}), _void(), {
@@ -63640,7 +64825,7 @@ var dishwasherCapability = {
 			auth: "protected"
 		}),
 		/** What this appliance can do, from its own description — the UI is derived from it. */
-		getOptions: method(object({ deviceId: DeviceIdSchema }), DishwasherOptionsSchema, { auth: "protected" })
+		getOptions: method(object({ deviceId: DeviceIdSchema$1 }), DishwasherOptionsSchema, { auth: "protected" })
 	},
 	status: {
 		schema: DishwasherStatusSchema,
@@ -66072,9 +67257,35 @@ var MediaInfoSchema = object({
 	/** Optional cover-art / thumbnail URL. */
 	imageUrl: string().optional()
 });
+/**
+* Where `state`, `volumeLevel`, `isMuted` and `source` come from. `reported`:
+* the device said so. `assumed`: the driver has no feedback (infrared) and
+* tracks what it last SENT; it moves only after a send was accepted, and a
+* human at the real remote makes it wrong. A UI shows an assumed value as a
+* guess, never as a reading.
+*/
+var MediaPlayerStateSourceSchema = _enum(["reported", "assumed"]);
+/** The fields of a media-player status a driver can only guess. */
+var MediaPlayerAssumedFieldSchema = _enum([
+	"state",
+	"volumeLevel",
+	"isMuted",
+	"source"
+]);
 var MediaPlayerStatusSchema = object({
 	/** Playback lifecycle state. */
 	state: MediaPlayerStateSchema,
+	/**
+	* Whether the state fields are readings or the driver's own bookkeeping.
+	* A slice written before this field existed parses as `reported`.
+	*/
+	stateSource: MediaPlayerStateSourceSchema.default("reported"),
+	/**
+	* Which fields are the driver's own guess. `stateSource` is `assumed` when
+	* this is not empty; a field not listed here is a reading even then (power
+	* from a running-state source, mute guessed from the last send).
+	*/
+	assumedFields: array(MediaPlayerAssumedFieldSchema).default([]),
 	/** Volume as 0..100 inclusive. Null when the device has no volume
 	*  surface. Pair with `DeviceFeature.MediaPlayerVolume`. */
 	volumeLevel: number().min(0).max(100).nullable().meta(readingMeta("percentage")),
@@ -67391,7 +68602,8 @@ var TopologyNodeSchema = object({
 	isHub: boolean(),
 	isOnline: boolean(),
 	cpuPercent: number(),
-	memoryPercent: number(),
+	/** `null` when the node's memory read failed or it has not reported one (D393). */
+	memoryPercent: number().nullable(),
 	uptime: number(),
 	lastSeen: string(),
 	localIps: array(string()).readonly(),
@@ -68002,6 +69214,14 @@ var PetFeederDeviceStatusSchema = _enum([
 	"on_batteries"
 ]);
 var gramsPortion = number().int().min(4).max(200);
+/** A portion REQUESTED of the feeder is a mass the method takes in GRAMS (the
+*  hardware's own unit). The bounds are grams; a caller entering another unit
+*  converts to grams first (`paramMeta`, D972). The STATUS fields above stay
+*  plain grams — they are not readings in the kilogram base. */
+var gramsParam = gramsPortion.meta(paramMeta({
+	quantity: "mass",
+	unit: "g"
+}));
 var PetFeederStatusSchema = object({
 	/** Food in the TANK (hopper), as the feeder's own sensor reports it
 	*  (`state.food`). A coarse level code, not grams — `0` is empty. The
@@ -68009,9 +69229,10 @@ var PetFeederStatusSchema = object({
 	*  combined reading; per-hopper levels live in `food1`/`food2`. Null when
 	*  the device has not reported yet. */
 	foodLevel: number().nullable().meta(readingMeta("none")),
-	/** Food in the BOWL as the feeder reports it (`state.bowl`), in the
-	*  feeder's own units. Null when the model reports none. */
-	bowlFood: number().nullable().meta(readingMeta("none")),
+	/** Food in the BOWL, a mass (stored in kilograms, D944). Reported only by a
+	*  feeder with a bowl scale; null when the model has none or its reading is
+	*  of an unproven unit. */
+	bowlFood: number().nullable().meta(readingMeta("mass")),
 	/** True while the pet is eating (`state.eating`). */
 	eating: boolean(),
 	/** Whether `markFoodReplenished` does anything on this model. When false
@@ -68062,6 +69283,14 @@ var PetFeederStatusSchema = object({
 	feedSound: boolean(),
 	/** Speaker / prompt volume level (device-scaled integer). */
 	volume: number().meta(readingMeta("none")),
+	/** Portion (grams) of the last manual feed sent from a single-hopper
+	*  stepper — the default the next manual feed starts from. Persisted per
+	*  device by the provider; null until a manual feed has been sent. */
+	lastFeedGrams: gramsPortion.nullable(),
+	/** Hopper-1 portion of the last manual feed (dual-hopper); null until sent. */
+	lastFeedHopper1: gramsPortion.nullable(),
+	/** Hopper-2 portion of the last manual feed (dual-hopper); null until sent. */
+	lastFeedHopper2: gramsPortion.nullable(),
 	/** Ms epoch when the slice was last refreshed from the cloud. */
 	lastFetchedAt: number()
 });
@@ -68081,9 +69310,9 @@ var petFeederCapability = {
 		*/
 		feed: method(object({
 			deviceId: number().int().nonnegative(),
-			grams: gramsPortion.optional(),
-			hopper1: gramsPortion.optional(),
-			hopper2: gramsPortion.optional()
+			grams: gramsParam.optional(),
+			hopper1: gramsParam.optional(),
+			hopper2: gramsParam.optional()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
@@ -68187,6 +69416,137 @@ var petFeederCapability = {
 		}
 	} }
 };
+/**
+* Pet water-fountain cap. Models the telemetry and the control surface of a
+* circulating drinking fountain: how much water is in the tank, how much the
+* pet drank, whether the pump runs and on what duty cycle.
+*
+* It has no native vendor provider of its own: a fountain reaches CamStack as
+* a container of loose entities (a pump switch, two number boxes, a "filter
+* changed" button), and an operator BUILDS the device from them — a composed
+* device of this type (D659, D967). Every method is therefore a forward to ONE
+* method of ONE source entity, and every reading is a field derived from a
+* source entity; the provider-shaped interface below exists so the composed
+* device and any future native provider answer the same contract.
+*
+* Quantities are stored in the base unit of their kind (D944): volumes in
+* LITRES, durations in SECONDS, the tank level in percent. A source that
+* reports millilitres or minutes is converted in the composition's expression,
+* never here. Every reading may be `null`: a source that is offline or does
+* not report is unknown, never zero.
+*
+* The filter is not a field of this cap: it is an item of the `consumables`
+* cap on the same device (kind `wear`), reset by the same forward mechanism.
+*/
+var PetFountainStatusSchema = object({
+	/** Water in the tank, 0..100 (%). Null while the source has not reported. */
+	waterLevel: number().min(0).max(100).nullable().meta(readingMeta("percentage")),
+	/** Water in the tank, in litres. Null while the source has not reported. */
+	waterVolume: number().min(0).nullable().meta(readingMeta("volume")),
+	/** True when the tank is empty. Null while unknown. */
+	empty: boolean().nullable(),
+	/** True while the pump is running. Null while unknown. */
+	pumpRunning: boolean().nullable(),
+	/** True when the pump works on an on/off duty cycle rather than continuously. */
+	pumpIntervalEnabled: boolean().nullable(),
+	/** How long the pump runs per cycle, in seconds. */
+	pumpOnTime: number().min(0).nullable().meta(readingMeta("duration")),
+	/** How long the pump rests per cycle, in seconds. */
+	pumpOffTime: number().min(0).nullable().meta(readingMeta("duration")),
+	/** Water drunk in the last drink, in litres. */
+	lastDrink: number().min(0).nullable().meta(readingMeta("volume")),
+	/** Water drunk in the current hour, in litres. */
+	currentHourDrink: number().min(0).nullable().meta(readingMeta("volume")),
+	/** Water drunk over the last 24 hours (rolling), in litres. */
+	last24hDrink: number().min(0).nullable().meta(readingMeta("volume")),
+	/** Water drunk since local midnight, in litres. */
+	todayDrink: number().min(0).nullable().meta(readingMeta("volume")),
+	/** Decoded fault message. Null means healthy; a non-null string is an active fault. */
+	error: string().nullable(),
+	/** Ms epoch when the slice was last refreshed. */
+	lastFetchedAt: number()
+});
+var DeviceIdSchema = number().int().nonnegative();
+var MinutesSchema = number().int().min(0);
+var petFountainCapability = {
+	name: "pet-fountain",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.PetFountain],
+	methods: {
+		/** Start or stop the pump. */
+		setPump: method(object({
+			deviceId: DeviceIdSchema,
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** Switch the on/off duty cycle on or off (off = the pump runs continuously). */
+		setPumpInterval: method(object({
+			deviceId: DeviceIdSchema,
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** Set how many minutes the pump runs per cycle. */
+		setPumpOnMinutes: method(object({
+			deviceId: DeviceIdSchema,
+			minutes: MinutesSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** Set how many minutes the pump rests per cycle. */
+		setPumpOffMinutes: method(object({
+			deviceId: DeviceIdSchema,
+			minutes: MinutesSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** Clear the rolling daily consumption counters on the device. */
+		resetDailyConsumption: method(object({ deviceId: DeviceIdSchema }), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		})
+	},
+	status: {
+		schema: PetFountainStatusSchema,
+		kind: "push"
+	},
+	/** Runtime-state slice — mirrored by the kernel; the hero card reads it whole. */
+	runtimeState: PetFountainStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live appliance state re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
+	/** History (D850): recorded series. */
+	history: { fields: {
+		waterLevel: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 1
+		},
+		waterVolume: {
+			kind: "gauge",
+			unit: "L"
+		},
+		todayDrink: {
+			kind: "gauge",
+			unit: "L"
+		},
+		last24hDrink: {
+			kind: "gauge",
+			unit: "L"
+		}
+	} }
+};
 var VehicleSchema = object({
 	id: string(),
 	name: string(),
@@ -74184,9 +75544,98 @@ method(object({}), array(TrainingBaseModelSchema).readonly(), { auth: "admin" })
 	kind: "mutation",
 	auth: "admin"
 });
+var btn = (idSuffix, row, col, init) => ({
+	idSuffix,
+	row,
+	col,
+	rowSpan: 1,
+	colSpan: 1,
+	...init
+});
+function rocker(id, name, it, frame, title, buttons, size) {
+	return {
+		id,
+		name,
+		nameI18n: {
+			en: name,
+			it
+		},
+		icon: frame === "rocker-v" ? "chevrons-up-down" : "chevrons-left-right",
+		category: id.includes("channel") || id.includes("volume") ? "volume" : "navigation",
+		size,
+		group: title === null ? { frame } : {
+			frame,
+			title
+		},
+		buttons
+	};
+}
+btn("power", 0, 0, {
+	role: "power",
+	shape: "round",
+	tone: "danger"
+}), btn("up", 0, 1, { role: "up" }), btn("left", 1, 0, { role: "left" }), btn("ok", 1, 1, {
+	role: "ok",
+	shape: "round",
+	tone: "accent"
+}), btn("right", 1, 2, { role: "right" }), btn("down", 2, 1, { role: "down" }), rocker("core:rocker-volume-v", "Volume rocker", "Bilanciere volume", "rocker-v", "VOL", [btn("up", 0, 0, {
+	role: "volume_up",
+	shape: "pill"
+}), btn("down", 1, 0, {
+	role: "volume_down",
+	shape: "pill"
+})], {
+	rows: 2,
+	cols: 1
+}), rocker("core:rocker-channel-v", "Channel rocker", "Bilanciere canali", "rocker-v", "CH", [btn("up", 0, 0, {
+	role: "channel_up",
+	shape: "pill"
+}), btn("down", 1, 0, {
+	role: "channel_down",
+	shape: "pill"
+})], {
+	rows: 2,
+	cols: 1
+}), rocker("core:rocker-h", "Minus / plus rocker", "Bilanciere meno / più", "rocker-h", null, [btn("minus", 0, 0, {
+	role: "custom:minus",
+	label: "−",
+	shape: "pill"
+}), btn("plus", 0, 1, {
+	role: "custom:plus",
+	label: "+",
+	shape: "pill"
+})], {
+	rows: 1,
+	cols: 2
+}), [...Array.from({ length: 9 }, (_, i) => btn(`d${i + 1}`, Math.floor(i / 3), i % 3, { role: `digit_${i + 1}` })), btn("d0", 3, 1, { role: "digit_0" })], btn("red", 0, 0, {
+	role: "custom:color_red",
+	tone: "red"
+}), btn("green", 0, 1, {
+	role: "custom:color_green",
+	tone: "green"
+}), btn("yellow", 0, 2, {
+	role: "custom:color_yellow",
+	tone: "yellow"
+}), btn("blue", 0, 3, {
+	role: "custom:color_blue",
+	tone: "blue"
+}), btn("rewind", 0, 0, { role: "rewind" }), btn("play", 0, 1, { role: "play" }), btn("pause", 0, 2, { role: "pause" }), btn("forward", 0, 3, { role: "fast_forward" }), btn("stop", 0, 4, { role: "stop" }), [
+	1,
+	2,
+	3,
+	4
+].map((n) => btn(`app${n}`, 0, n - 1, { role: `custom:app_slot_${n}` })), btn("back", 0, 0, { role: "back" }), btn("home", 0, 1, { role: "home" }), btn("menu", 0, 2, { role: "menu" });
+discriminatedUnion("kind", [object({
+	kind: literal("raw"),
+	timings: array(number().int()),
+	settings: TransmitSettingsSchema.optional()
+}), object({
+	kind: literal("pronto"),
+	code: string()
+})]);
 DeviceFeature.FanSpeed, DeviceFeature.FanPreset, DeviceFeature.FanDirection, DeviceFeature.FanOscillating, DeviceFeature.CoverPositionable, DeviceFeature.CoverTilt, DeviceFeature.ValvePositionable, DeviceFeature.MediaPlayerVolume, DeviceFeature.ClimateFanMode;
 SOURCE_CAPS.filter((cap) => cap !== "switch" && cap !== "motion");
-DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.EventEmitter, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer, DeviceType.Camera, DeviceType.Camera, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
+DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.EventEmitter, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.PetFountain, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer, DeviceType.Camera, DeviceType.Camera, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
 String.raw`rose\(active(\d+), changed(\d+), (\d+(?:\.\d+)?)\)`;
 DeviceRole.BinarySensor, DeviceRole.MotionSensor;
 new Set(CAP_NAMES);
@@ -74590,6 +76039,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	notifier: notifierCapability,
 	numericSensor: numericSensorCapability,
 	petFeeder: petFeederCapability,
+	petFountain: petFountainCapability,
 	powerMeter: powerMeterCapability,
 	presence: presenceCapability,
 	pressureSensor: pressureSensorCapability,
@@ -75357,7 +76807,7 @@ var DeclaredDevices = class {
 		return removed;
 	}
 };
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer;
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.PetFountain, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer;
 new Set(Object.values(DeviceType));
 Object.freeze({
 	"accessories.getStatus": {
@@ -77292,6 +78742,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"deviceExport.exposeEntity": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"deviceExport.getDeviceLiveContribution": {
 		capName: "device-export",
 		capScope: "system",
@@ -77320,6 +78777,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"deviceExport.listExposedEntities": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"deviceExport.listSupportedDeviceKinds": {
 		capName: "device-export",
 		capScope: "system",
@@ -77327,6 +78791,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"deviceExport.listSupportedEntityKinds": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"deviceExport.unexposeDevice": {
 		capName: "device-export",
 		capScope: "system",
@@ -77334,6 +78805,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"deviceExport.unexposeEntity": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"deviceExtension.listCandidates": {
 		capName: "device-extension",
 		capScope: "device",
@@ -80155,6 +81633,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"nodeRemovalHook.onNodeRemoved": {
+		capName: "node-removal-hook",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"nodes.clusterAddonStatus": {
 		capName: "nodes",
 		capScope: "system",
@@ -80792,6 +82277,48 @@ Object.freeze({
 		access: "create",
 		role: "viewer"
 	},
+	"petFountain.getStatus": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
+	"petFountain.resetDailyConsumption": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "delete",
+		role: "viewer"
+	},
+	"petFountain.setPump": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"petFountain.setPumpInterval": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"petFountain.setPumpOffMinutes": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"petFountain.setPumpOnMinutes": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
 	"pipelineAnalytics.addRetrainFrameFromRecording": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -83046,6 +84573,48 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"remote.getConfig": {
+		capName: "remote",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"remote.listCommands": {
+		capName: "remote",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"remote.sendCommand": {
+		capName: "remote",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"remote.sendMediaCommand": {
+		capName: "remote",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"remote.setConfig": {
+		capName: "remote",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"remoteLayoutComponents.listComponents": {
+		capName: "remote-layout-components",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"runningState.getStatus": {
 		capName: "running-state",
 		capScope: "device",
@@ -83158,6 +84727,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"serverManagement.getLaunchOverrides": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"serverManagement.getServerPackageStatus": {
 		capName: "server-management",
 		capScope: "system",
@@ -83165,6 +84741,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"serverManagement.installDesktopUpdate": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"serverManagement.restartServer": {
 		capName: "server-management",
 		capScope: "system",
@@ -83179,6 +84762,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"serverManagement.setLaunchOverrides": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"settingsStore.aggregate": {
 		capName: "settings-store",
 		capScope: "system",
@@ -84236,6 +85826,41 @@ Object.freeze({
 		access: "view",
 		role: "viewer"
 	},
+	"template.create": {
+		capName: "template",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"template.delete": {
+		capName: "template",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
+	"template.get": {
+		capName: "template",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"template.list": {
+		capName: "template",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"template.update": {
+		capName: "template",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"terminalSession.adoptLegacyMonitor": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -87033,7 +88658,8 @@ var APPLIANCE_CAP_VOCABULARY = {
 						min: 4,
 						max: 200,
 						step: 1,
-						unit: "g"
+						unit: "g",
+						quantity: "mass"
 					},
 					optional: true
 				}]
@@ -87052,7 +88678,8 @@ var APPLIANCE_CAP_VOCABULARY = {
 						min: 4,
 						max: 200,
 						step: 1,
-						unit: "g"
+						unit: "g",
+						quantity: "mass"
 					},
 					optional: true
 				}, {
@@ -87063,7 +88690,8 @@ var APPLIANCE_CAP_VOCABULARY = {
 						min: 4,
 						max: 200,
 						step: 1,
-						unit: "g"
+						unit: "g",
+						quantity: "mass"
 					},
 					optional: true
 				}]
@@ -87204,6 +88832,100 @@ var APPLIANCE_CAP_VOCABULARY = {
 			}
 		]
 	},
+	"pet-fountain": {
+		scope: "device",
+		noun: t("Pet fountain", "Fontana per animali"),
+		actions: [
+			{
+				id: "petFountain.pumpOn",
+				method: "setPump",
+				label: t("Pump on", "Pompa accesa"),
+				phrase: t("Start the pump of {device}", "Avvia la pompa di {device}"),
+				icon: "play",
+				args: { on: true }
+			},
+			{
+				id: "petFountain.pumpOff",
+				method: "setPump",
+				label: t("Pump off", "Pompa spenta"),
+				phrase: t("Stop the pump of {device}", "Ferma la pompa di {device}"),
+				icon: "square",
+				args: { on: false }
+			},
+			{
+				id: "petFountain.intervalOn",
+				method: "setPumpInterval",
+				label: t("Pump cycle on", "Ciclo pompa attivo"),
+				phrase: t("Run the pump of {device} on its on/off cycle", "Fai lavorare la pompa di {device} a ciclo acceso/spento"),
+				icon: "timer",
+				args: { on: true }
+			},
+			{
+				id: "petFountain.intervalOff",
+				method: "setPumpInterval",
+				label: t("Pump cycle off", "Ciclo pompa spento"),
+				phrase: t("Run the pump of {device} continuously", "Fai lavorare la pompa di {device} in continuo"),
+				icon: "timer-off",
+				args: { on: false }
+			},
+			{
+				id: "petFountain.pumpOnMinutes",
+				method: "setPumpOnMinutes",
+				label: t("Set pump run time", "Imposta il tempo di lavoro della pompa"),
+				phrase: t("Set the pump of {device} to run {minutes} minutes per cycle", "Imposta la pompa di {device} a lavorare {minutes} minuti per ciclo"),
+				icon: "timer",
+				openArgs: [{
+					key: "minutes",
+					label: t("Minutes", "Minuti"),
+					offer: {
+						kind: "number",
+						min: 0,
+						step: 1,
+						unit: "min"
+					}
+				}]
+			},
+			{
+				id: "petFountain.pumpOffMinutes",
+				method: "setPumpOffMinutes",
+				label: t("Set pump rest time", "Imposta il tempo di riposo della pompa"),
+				phrase: t("Set the pump of {device} to rest {minutes} minutes per cycle", "Imposta la pompa di {device} a riposare {minutes} minuti per ciclo"),
+				icon: "timer-off",
+				openArgs: [{
+					key: "minutes",
+					label: t("Minutes", "Minuti"),
+					offer: {
+						kind: "number",
+						min: 0,
+						step: 1,
+						unit: "min"
+					}
+				}]
+			},
+			{
+				id: "petFountain.resetDailyConsumption",
+				method: "resetDailyConsumption",
+				label: t("Clear daily consumption", "Azzera il consumo giornaliero"),
+				phrase: t("Clear the daily water consumption of {device}", "Azzera il consumo giornaliero di acqua di {device}"),
+				icon: "rotate-ccw"
+			}
+		],
+		state: [{
+			kind: "boolean",
+			field: "empty",
+			label: t("Tank empty", "Serbatoio vuoto"),
+			whenTrue: t("When the tank of {device} is empty", "Quando il serbatoio di {device} è vuoto"),
+			whenFalse: t("When the tank of {device} is refilled", "Quando il serbatoio di {device} viene riempito"),
+			icon: "droplet"
+		}, {
+			kind: "numeric",
+			field: "waterLevel",
+			quantity: t("the water level", "il livello dell’acqua"),
+			label: t("Water level", "Livello dell’acqua"),
+			unit: "%",
+			icon: "droplets"
+		}]
+	},
 	"media-player": {
 		scope: "device",
 		noun: t("Media player", "Lettore multimediale"),
@@ -89028,6 +90750,7 @@ var SYSTEM_CAP_VOCABULARY = {
 	"device-manager": system("the device registry itself — rename, move and remove are administration"),
 	"device-provider": system(INTERNAL),
 	"device-removal-hook": system(INTERNAL),
+	"node-removal-hook": system(INTERNAL),
 	"device-state": system("the runtime-state mirror every trigger already reads through"),
 	"display-palette": system("the cluster display palette — one colour table for every client, not a device action"),
 	"embedding-encoder": system(ML),
@@ -89067,6 +90790,8 @@ var SYSTEM_CAP_VOCABULARY = {
 	"recording-archive": system(STORAGE),
 	"recording-export": system("recording exports — requested from the timeline, not an automation step"),
 	records: system(INTERNAL),
+	remote: system("the per-device remote setup — authored in the Customize remote editor, sent through the remote UI"),
+	"remote-layout-components": system("the palette of the remote template editor — read-only data, never actuated"),
 	"server-management": system(CLUSTER),
 	"settings-store": system(INTERNAL),
 	"smtp-provider": system(INTERNAL),
@@ -89079,6 +90804,7 @@ var SYSTEM_CAP_VOCABULARY = {
 	"storage-provider": system(STORAGE),
 	"stream-broker": system(PIPELINE),
 	system: system(CLUSTER),
+	template: system("operator-authored templates — edited in their own editor, never actuated"),
 	"terminal-session": system(CLUSTER),
 	toast: system(UI_PLUMBING),
 	training: system(ML),
@@ -89138,7 +90864,7 @@ function projectAction(cap, action) {
 	};
 }
 Object.entries(CAP_VOCABULARY_BY_NAME).flatMap(([cap, entry]) => entry.scope === "device" ? (entry.actions ?? []).map((a) => projectAction(cap, a)) : []);
-DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer;
+DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.PetFountain, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer;
 DeviceFeature.BatteryOperated;
 DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher;
 var HA_AS = "a power sensor (device_class power). Home Assistant has no laundry domain. running-state stays unexported until a null reading can be published as unavailable.";
@@ -90689,6 +92415,36 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"petFountain.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFountain.resetDailyConsumption": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFountain.setPump": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFountain.setPumpInterval": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFountain.setPumpOffMinutes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFountain.setPumpOnMinutes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.addRetrainFrameFromRecording": [{
 		name: "deviceId",
 		form: "single",
@@ -91505,6 +93261,31 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"remote.getConfig": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"remote.listCommands": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"remote.sendCommand": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"remote.sendMediaCommand": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"remote.setConfig": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"runningState.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -95060,8 +96841,6 @@ var NC_TEMPLATE_VARS = [
 * delete it from here then, and the served catalog names it again.
 */
 var NC_TEMPLATE_HELD_BACK_SYSTEM_EVENT_KINDS = [
-	"node-restarting",
-	"node-updating",
 	"alert-critical",
 	"alert-error",
 	"alert-critical-resolved",
@@ -96874,14 +98653,6 @@ function armRemovalReconcile(opts) {
 	timer.unref?.();
 	return () => clearInterval(timer);
 }
-discriminatedUnion("kind", [object({
-	kind: literal("raw"),
-	timings: array(number().int()),
-	settings: TransmitSettingsSchema.optional()
-}), object({
-	kind: literal("pronto"),
-	code: string()
-})]);
 object({
 	manufacturer: string().optional(),
 	supportedModels: array(string()).optional(),