@camstack/addon-provider-homeassistant 1.2.636 → 1.2.638

package/dist/{dist-BusXPPvn.mjs → dist-Cvz76AD1.mjs}

@@ -5200,6 +5200,14 @@ function object(shape, params) {
 		...normalizeParams(params)
 	});
 }
+function strictObject(shape, params) {
+	return new ZodObject({
+		type: "object",
+		shape,
+		catchall: never(),
+		...normalizeParams(params)
+	});
+}
 function looseObject(shape, params) {
 	return new ZodObject({
 		type: "object",
@@ -5579,7 +5587,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DJws6ho7.mjs
+//#region ../types/dist/sleep-6eG9C8Xl.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8725,65 +8733,6 @@ var MODEL_FORMATS = [
 	"pt",
 	"gguf"
 ];
-/**
-* Per-call node pinning for `ctx.api` capability calls.
-*
-* A capability call normally resolves to its DEFAULT provider — a `singleton`
-* cap resolves to the hub, a device-scoped cap to the device's owning node. To
-* query a SPECIFIC node's provider instead (e.g. a remote agent's own
-* in-process `platform-probe` hardware, which the hub cannot probe), pin the
-* call to that node.
-*
-* The nodeId rides OUT-OF-BAND in the tRPC call context (NOT in the validated
-* method args), so capability method signatures stay `nodeId`-free — node
-* targeting is a property of the CALL, not of the method. The transport lifts
-* it from `op.context` onto the `CapCallInput.nodeId` field (`ipcParentLink`),
-* and the hub parent's `onUnownedCall` passes it to the `CapRouteResolver`,
-* which classifies a pinned agent node as `agent-child-forward`
-* (`$agent-cap-fwd.forward` → the agent's in-process provider).
-*
-* Usage at a call site:
-*
-*   await api.platformProbe.getCapabilities.query(undefined, nodePin(nodeId))
-*/
-/** tRPC `op.context` key carrying a per-call node pin. */
-var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
-/**
-* Build the tRPC request options that pin a single capability call to `nodeId`.
-* Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
-*
-* ## The id is normalised here, and it has to be
-*
-* A forked addon reads its own node from `ctx.kernel.localNodeId`, and inside a
-* worker that value is a RUNNER id — `hub/export-hap`, not `hub`. Routing
-* compares a pin against real node ids, so such a pin matches nothing and the
-* call fails with `no provider registered for cap "…"`. The local-first
-* resolver already guarded against this (`localNodeId.split('/')[0]`), which
-* made the hazard invisible: unpinned calls worked, and only an explicit pin —
-* the thing you reach for when you specifically need THIS node — silently
-* addressed a node that does not exist.
-*
-* Cost of it being missing: `addon-export-hap` pinned `decoder.getInfo` to its
-* own node to read the host's hardware-decode backend. It never once answered,
-* so every HomeKit egress transcode decoded in SOFTWARE — including 4K H.265 —
-* while D67's whole premise was that the decoder addon is the authority on
-* hardware. The warn said `decoding in SOFTWARE` and read as "this node has no
-* hardware", which was false.
-*
-* Normalising in the ONE constructor fixes every caller at once, which is why
-* it is here and not at the call sites.
-*/
-function nodePin(nodeId) {
-	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: toNodeId(nodeId) } };
-}
-/**
-* A runner id is `<nodeId>/<addonId>`; a node id has no slash. Taking the head
-* is idempotent, so passing an already-clean id costs nothing.
-*/
-function toNodeId(idOrRunnerId) {
-	const head = idOrRunnerId.split("/")[0];
-	return head === void 0 || head.length === 0 ? idOrRunnerId : head;
-}
 object({
 	field: string().min(1),
 	on: literal("advance")
@@ -8876,9 +8825,135 @@ function optionalMethod(input, output, options) {
 function event(data) {
 	return { data };
 }
+/**
+* Per-call node pinning for `ctx.api` capability calls.
+*
+* A capability call normally resolves to its DEFAULT provider — a `singleton`
+* cap resolves to the hub, a device-scoped cap to the device's owning node. To
+* query a SPECIFIC node's provider instead (e.g. a remote agent's own
+* in-process `platform-probe` hardware, which the hub cannot probe), pin the
+* call to that node.
+*
+* The nodeId rides OUT-OF-BAND in the tRPC call context (NOT in the validated
+* method args), so capability method signatures stay `nodeId`-free — node
+* targeting is a property of the CALL, not of the method. The transport lifts
+* it from `op.context` onto the `CapCallInput.nodeId` field (`ipcParentLink`),
+* and the hub parent's `onUnownedCall` passes it to the `CapRouteResolver`,
+* which classifies a pinned agent node as `agent-child-forward`
+* (`$agent-cap-fwd.forward` → the agent's in-process provider).
+*
+* Usage at a call site:
+*
+*   await api.platformProbe.getCapabilities.query(undefined, nodePin(nodeId))
+*/
+/** tRPC `op.context` key carrying a per-call node pin. */
+var CAP_NODE_PIN_CONTEXT_KEY = "__camstackNodePin";
+/**
+* Build the tRPC request options that pin a single capability call to `nodeId`.
+* Pass as the second argument to `.query(input, …)` / `.mutate(input, …)`.
+*
+* ## The id is normalised here, and it has to be
+*
+* A forked addon reads its own node from `ctx.kernel.localNodeId`, and inside a
+* worker that value is a RUNNER id — `hub/export-hap`, not `hub`. Routing
+* compares a pin against real node ids, so such a pin matches nothing and the
+* call fails with `no provider registered for cap "…"`. The local-first
+* resolver already guarded against this (`localNodeId.split('/')[0]`), which
+* made the hazard invisible: unpinned calls worked, and only an explicit pin —
+* the thing you reach for when you specifically need THIS node — silently
+* addressed a node that does not exist.
+*
+* Cost of it being missing: `addon-export-hap` pinned `decoder.getInfo` to its
+* own node to read the host's hardware-decode backend. It never once answered,
+* so every HomeKit egress transcode decoded in SOFTWARE — including 4K H.265 —
+* while D67's whole premise was that the decoder addon is the authority on
+* hardware. The warn said `decoding in SOFTWARE` and read as "this node has no
+* hardware", which was false.
+*
+* Normalising in the ONE constructor fixes every caller at once, which is why
+* it is here and not at the call sites.
+*/
+function nodePin(nodeId) {
+	return { context: { [CAP_NODE_PIN_CONTEXT_KEY]: toNodeId(nodeId) } };
+}
+/**
+* A runner id is `<nodeId>/<addonId>`; a node id has no slash. Taking the head
+* is idempotent, so passing an already-clean id costs nothing.
+*/
+function toNodeId(idOrRunnerId) {
+	const head = idOrRunnerId.split("/")[0];
+	return head === void 0 || head.length === 0 ? idOrRunnerId : head;
+}
+/**
+* `addon-pages-source` — collection cap exposing per-provider raw page
+* declarations. Every addon that contributes a UI page registers a
+* provider here. The hub-side singleton aggregator (`addon-pages` cap,
+* see `addon-pages.cap.ts`) walks this collection, stamps versioned
+* `bundleUrl` values, and returns the enriched `AddonPageInfo[]` list
+* that admin-ui consumes.
+*
+* The split exists because the public listing has a different output
+* shape than the per-provider raw declarations, and we want both ends
+* to flow through codegen instead of relying on a hand-written wrapper.
+*/
+var AddonPageDeclarationSchema = object({
+	id: string(),
+	label: string(),
+	icon: string(),
+	path: string(),
+	/**
+	* Module Federation remote name — must match the `name` field on the
+	* page addon's `federation()` plugin config. Used by admin-ui's
+	* `<AddonPageLoader>` to call `loadRemote('<remoteName>/page')`.
+	* Conventionally `addon_<id>_page` (snake_case; MF names cannot
+	* contain hyphens).
+	*/
+	remoteName: string(),
+	/**
+	* Bundle filename inside the addon's `dist/` dir served at
+	* `/api/addon-pages/<addonId>/<bundle>`. With Module Federation this
+	* is always `'remoteEntry.js'`; the value is kept on the metadata so
+	* the static-file route can compute an mtime-based cache-buster URL
+	* without a separate filesystem stat.
+	*/
+	bundle: string(),
+	/**
+	* Sidebar section this page docks into. Well-known ids: `'detection'`,
+	* `'cluster'`, `'administration'` — the page renders inside that group.
+	* Any OTHER string creates (or joins) a custom section rendered after
+	* the built-in groups; its label comes from `sectionLabel` (first
+	* declaration wins), falling back to the id. Absent → the legacy
+	* "Addon Pages" group.
+	*/
+	section: string().optional(),
+	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
+	sectionLabel: string().optional()
+});
+method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" });
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
 method(_void(), StaticDirOutputSchema$1, { auth: "admin" }), method(_void(), VersionOutputSchema$1, { auth: "admin" });
+/**
+* The pipeline step-input shape and the run-result bridge, in a module that
+* imports nothing but zod and types.
+*
+* WHY A SEPARATE FILE (addon footprint, D28): both were declared in
+* `pipeline-executor.cap.ts`, whose import evaluates the whole executor schema
+* graph. An addon that only needs these two (the benchmark's `runPipelineTest`
+* action) paid ~130 MB of heap at load. `pipeline-executor.cap.ts` re-exports
+* them, so every existing import keeps working; addon server code takes them
+* from `@camstack/types/addon`.
+*/
+var PipelineStepInputSchema = lazy(() => object({
+	addonId: string(),
+	modelId: string().optional(),
+	enabled: boolean().default(true),
+	children: array(PipelineStepInputSchema).optional(),
+	settings: record(string(), unknown()).optional(),
+	jumpDeviceKey: string().optional()
+}));
+/** Typed bridge to the recursive `FrameResult` graph; validation is structural. */
+var PipelineRunResultBridge = custom();
 var StaticDirOutputSchema = object({ staticDir: string() });
 var VersionOutputSchema = object({ version: string() });
 method(_void(), StaticDirOutputSchema, { auth: "admin" }), method(_void(), VersionOutputSchema, { auth: "admin" });
@@ -9063,6 +9138,7 @@ var CAP_NAMES = Object.freeze([
 	"network-link",
 	"network-quality",
 	"node-certificates",
+	"node-removal-hook",
 	"nodes",
 	"notification-output",
 	"notification-rules",
@@ -9073,6 +9149,7 @@ var CAP_NAMES = Object.freeze([
 	"osd",
 	"osd-manager",
 	"pet-feeder",
+	"pet-fountain",
 	"pipeline-analytics",
 	"pipeline-executor",
 	"pipeline-orchestrator",
@@ -10352,6 +10429,56 @@ Object.freeze({
 			"valueType": "number"
 		}
 	],
+	"pet-fountain": [
+		{
+			"path": "waterLevel",
+			"valueType": "number"
+		},
+		{
+			"path": "waterVolume",
+			"valueType": "number"
+		},
+		{
+			"path": "empty",
+			"valueType": "boolean"
+		},
+		{
+			"path": "pumpRunning",
+			"valueType": "boolean"
+		},
+		{
+			"path": "pumpIntervalEnabled",
+			"valueType": "boolean"
+		},
+		{
+			"path": "pumpOnTime",
+			"valueType": "number"
+		},
+		{
+			"path": "pumpOffTime",
+			"valueType": "number"
+		},
+		{
+			"path": "lastDrink",
+			"valueType": "number"
+		},
+		{
+			"path": "currentHourDrink",
+			"valueType": "number"
+		},
+		{
+			"path": "last24hDrink",
+			"valueType": "number"
+		},
+		{
+			"path": "todayDrink",
+			"valueType": "number"
+		},
+		{
+			"path": "error",
+			"valueType": "string"
+		}
+	],
 	"power-meter": [
 		{
 			"path": "power",
@@ -10889,7 +11016,7 @@ object({
 	params: record(string(), union([string(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/err-msg-BCdlR2Li.mjs
+//#region ../types/dist/err-msg-DWXWc0Di.mjs
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -10981,6 +11108,10 @@ var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
 	*  integrations sharing the same food/desiccant/hopper surface. */
 	DeviceType["PetFeeder"] = "pet-feeder";
+	/** Pet water fountain — tank level, water drunk, pump and its duty cycle.
+	*  Installed with the `pet-fountain` cap. Reaches CamStack as loose entities
+	*  of a container and is BUILT as a composed device (D967). */
+	DeviceType["PetFountain"] = "pet-fountain";
 	/** Built-in dishwasher — program lifecycle, door / remote-start gates,
 	*  salt and rinse-aid levels. Installed with the `dishwasher` cap.
 	*  Sources: native Bosch Home Connect, reusable by similar integrations.
@@ -11251,7 +11382,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-DpFv_J6D.mjs
+//#region ../types/dist/composition-kSuOifuG.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -12336,12 +12467,28 @@ var CompositionFieldSourceSchema = discriminatedUnion("kind", [
 		])
 	})
 ]);
-var CompositionCommandTargetSchema = discriminatedUnion("kind", [object({
+var forwardArgUnion = union([
+	string(),
+	number(),
+	boolean(),
+	strictObject({ ["$input"]: string().min(1) }),
+	record(string().min(1), lazy(() => forwardArgUnion))
+]);
+var CompositionForwardArgSchema = forwardArgUnion;
+/**
+* `forward` (D659, amended by D967): one method of a BUILT capability is one
+* call of `cap.method` on `source`. Without `args` the built method's input
+* passes through minus `deviceId`; with `args` the template IS the source's
+* whole input. `deviceId` is always the source's own, never an argument.
+*/
+var CompositionForwardCommandSchema = object({
 	kind: literal("forward"),
 	source: CompositionSourceRefSchema,
 	cap: string().min(1),
-	method: string().min(1)
-}), CompositionCodeSourceSchema]);
+	method: string().min(1),
+	args: record(string().min(1), CompositionForwardArgSchema).optional()
+});
+var CompositionCommandTargetSchema = discriminatedUnion("kind", [CompositionForwardCommandSchema, CompositionCodeSourceSchema]);
 /** An item key inside an item-array cap (`consumables.items[<key>]`). */
 var COMPOSITION_ITEM_KEY_RE = /^[a-z0-9][a-z0-9-]{0,47}$/;
 /**
@@ -12351,7 +12498,13 @@ var COMPOSITION_ITEM_KEY_RE = /^[a-z0-9][a-z0-9-]{0,47}$/;
 */
 var CompositionItemEntrySchema = object({
 	label: string().min(1).max(80),
-	fields: record(string().min(1), CompositionFieldSourceSchema)
+	fields: record(string().min(1), CompositionFieldSourceSchema),
+	/**
+	* What the cap's `reset` does for THIS item (consumables). Present = the item
+	* is resettable and a `reset` call naming its key forwards here. The item key
+	* selects the command, so it is never an argument: there is no pass-through.
+	*/
+	reset: CompositionForwardCommandSchema.optional()
 });
 var CompositionFeatureSchema = discriminatedUnion("kind", [object({
 	kind: literal("fields"),
@@ -12363,7 +12516,7 @@ var CompositionFeatureSchema = discriminatedUnion("kind", [object({
 	* owns the WHOLE array field: the composed value holds exactly these items.
 	*/
 	items: record(string().regex(COMPOSITION_ITEM_KEY_RE), CompositionItemEntrySchema).refine((items) => Object.keys(items).length <= 16, { message: `at most 16 items` }).optional(),
-	/** RESERVED for slice 3; refused by the validator when non-empty. */
+	/** Method name → what serves it. Only a BUILT capability takes commands (D967). */
 	commands: record(string().min(1), CompositionCommandTargetSchema).optional()
 }), object({
 	kind: literal("passthrough"),
@@ -16447,6 +16600,587 @@ object({
 	lastError: string().nullable()
 });
 /**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = _enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: string().optional(),
+	bytes: _instanceof(Uint8Array).optional(),
+	mime: string().optional(),
+	name: string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = _enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/**
+* The CLOSED icon vocabulary an action button may use.
+*
+* A closed set, not a free string, and that is the whole point: an arbitrary
+* icon name is one that ntfy renders, zentik silently drops, and nobody
+* notices — the same class of gap as a zone vocabulary nothing produced
+* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
+* declares `actionIcons: false` and the degrade engine strips the field.
+*
+* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
+* renderer's icon set; "acknowledge" survives an adapter that draws it
+* differently.
+*
+* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
+*
+* These names are for US. **No adapter may forward one verbatim.** Each maps
+* the whole set onto its own renderer's vocabulary through a
+* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
+* fallback, so adding a member here fails every adapter's build until someone
+* decides its glyph, which is the only place that decision can be made
+* honestly.
+*
+* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
+* `disarm` straight through; iOS feeds that string to
+* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
+* and every snooze and alarm button arrived BLANK. A pass-through is not a
+* mapping, and "the field is documented" is not "the value renders".
+*
+* Adding a member is TRAIN-BOUND. The enum lives in the published
+* `@camstack/server` closure and the cap seam validates against the HUB's copy,
+* so an addon that emits a token the running hub does not know does not lose an
+* icon — its whole `send` fails Zod validation and the notification never
+* arrives. Never emit a new token from an addon before the train carrying it.
+*/
+var NotificationActionIconSchema = _enum([
+	"acknowledge",
+	"dismiss",
+	"silence",
+	"snooze",
+	"view",
+	"play",
+	"open",
+	"close",
+	"lock",
+	"unlock",
+	"arm",
+	"arm-home",
+	"arm-away",
+	"arm-night",
+	"disarm",
+	"light",
+	"alert",
+	"camera"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = object({
+	id: string(),
+	label: string(),
+	url: string().optional(),
+	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
+	icon: NotificationActionIconSchema.optional(),
+	/**
+	* Renders in a warning style where the notifier supports it.
+	*
+	* A HINT, never a gate. The callback's authority is its token and nothing
+	* else — see `notification-center/action-token.ts` for what that does and
+	* does not buy.
+	*/
+	destructive: boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: _enum(["navigate", "background"]).optional()
+});
+/** A delivery parameter value: what a notifier declared it takes. */
+var DeliveryParamValueSchema = union([
+	string(),
+	number(),
+	boolean()
+]);
+/**
+* One extra delivery parameter a notifier KIND declares (D938). A rule that
+* addresses a target of that kind may set it; a kind that declares nothing is
+* never handed one. The admin UI derives its control from this descriptor —
+* no editor knows a service by name.
+*
+* Optional fields are `.optional()`, never `.default()` (a Zod default does not
+* run on the addon cap path).
+*/
+var DeliveryParamSchema = object({
+	key: string().min(1),
+	label: string(),
+	/** i18n key of the label, resolved by the declaring addon's namespace. */
+	labelKey: string().optional(),
+	type: _enum([
+		"enum",
+		"number",
+		"boolean",
+		"string"
+	]),
+	/** `enum` only: the closed set of accepted values. */
+	options: array(object({
+		value: string(),
+		label: string()
+	})).optional(),
+	/** `number` only. */
+	min: number().optional(),
+	max: number().optional(),
+	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
+	default: DeliveryParamValueSchema.optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = object({
+	body: string(),
+	title: string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: number().int().min(1).max(5).default(3),
+	level: string().optional(),
+	attachments: array(AttachmentSchema).optional(),
+	clickUrl: string().optional(),
+	actions: array(NotificationActionSchema).optional(),
+	sound: string().optional(),
+	ttl: number().optional(),
+	tag: string().optional(),
+	deviceId: number().optional(),
+	eventId: string().optional(),
+	metadata: record(string(), unknown()).optional(),
+	/**
+	* Values for the parameters the target's kind DECLARES in
+	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
+	* declaration by the sender; a notifier reads only the keys it declared.
+	*/
+	delivery: record(string(), DeliveryParamValueSchema).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = object({
+	id: string(),
+	label: string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: number().int().min(1).max(5).nullable(),
+	flags: object({
+		critical: boolean().optional(),
+		silent: boolean().optional(),
+		noPush: boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: array(string()).optional(),
+	description: string().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = object({
+	attachments: object({
+		mediaTypes: array(AttachmentMediaTypeSchema),
+		mode: _enum([
+			"url",
+			"bytes",
+			"both"
+		]),
+		max: number().int().nonnegative(),
+		maxBytes: number().int().positive().optional()
+	}),
+	/** Max action buttons (0 = none). */
+	actions: number().int().nonnegative(),
+	/**
+	* Whether this kind renders a per-action ICON.
+	*
+	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
+	* run on the addon cap path — three production failures in one day taught
+	* this repo that once. Absent is read as false by the degrade engine, which
+	* is the safe direction: an icon that is not rendered costs nothing, an icon
+	* assumed and dropped costs the operator's trust in the field.
+	*/
+	actionIcons: boolean().optional(),
+	levels: array(TargetKindLevelSchema),
+	format: array(NotificationFormatSchema),
+	clickUrl: boolean(),
+	sound: boolean(),
+	ttl: boolean(),
+	bodyMaxLen: number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough$3 = unknown();
+var TargetKindSchema = object({
+	kind: string(),
+	label: string(),
+	icon: string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: string().optional(),
+	configSchema: ConfigSchemaPassthrough$3,
+	/**
+	* The config keys that decide WHERE this kind's secrets are sent (server,
+	* base URL, instance, chat, recipient). A save that changes any of them
+	* while leaving a secret redacted is refused by the provider (D634), so an
+	* editor uses this to ask for the secret on exactly those edits instead of
+	* on every edit.
+	*
+	* Optional: absent from a provider that holds no secret (the Home Assistant
+	* kinds) and from a provider older than this field — an editor that finds
+	* it absent must assume ANY edit may need the secret.
+	*/
+	destinationKeys: array(string()).optional(),
+	supportsDiscovery: boolean(),
+	/**
+	* Extra delivery parameters a rule may set for a target of this kind (D938).
+	* Absent = none; the rule editor then offers nothing.
+	*/
+	deliveryParams: array(DeliveryParamSchema).optional(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = object({
+	id: string(),
+	name: string(),
+	kind: string(),
+	addonId: string(),
+	enabled: boolean(),
+	config: record(string(), unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = object({
+	kind: string(),
+	suggestedName: string(),
+	config: record(string(), unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = object({
+	level: string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: number().int().nonnegative(),
+	actionsSent: number().int().nonnegative(),
+	truncated: boolean(),
+	dropped: array(string())
+});
+var SendResultSchema = object({
+	success: boolean(),
+	error: string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+/**
+* Pre-save credential probe against a partial (unsaved) target config.
+* `resolvedUrl` never includes secrets (token stripped from path).
+*/
+var ProbeTargetConfigResultSchema = object({
+	ok: boolean(),
+	resolvedUrl: string(),
+	httpStatus: number().int().optional(),
+	stateInstance: string().optional(),
+	error: string().optional()
+});
+var notificationOutputCapability = {
+	name: "notification-output",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		listTargetKinds: method(object({}), array(TargetKindSchema)),
+		listTargets: method(object({}), array(TargetSchema), { auth: "admin" }),
+		/**
+		* One target WITH secrets — admin edit / duplicate hydration only.
+		* `listTargets` stays redacted; the editor loads this so password fields
+		* are filled (masked in the input) and a save can round-trip the token
+		* when a destination changes (Duplicate with a new chatId, etc.).
+		*/
+		getTarget: method(object({ targetId: string() }), TargetSchema, { auth: "admin" }),
+		discoverTargets: method(object({
+			kind: string(),
+			config: record(string(), unknown()).optional(),
+			/**
+			* When editing / duplicating, the blank password field never round-trips
+			* the stored token. Pass the source target id so the provider can restore
+			* secrets server-side before dialling (same merge as upsert).
+			*/
+			targetId: string().optional()
+		}), array(DiscoveredTargetSchema), { auth: "admin" }),
+		probeTargetConfig: method(object({
+			kind: string(),
+			config: record(string(), unknown()),
+			/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
+			targetId: string().optional()
+		}), ProbeTargetConfigResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		send: method(object({
+			targetId: string(),
+			notification: NotificationSchema
+		}), SendResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		testTarget: method(object({
+			targetId: string(),
+			sample: NotificationSchema.optional()
+		}), TestResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		upsertTarget: method(object({
+			target: TargetSchema,
+			/**
+			* Duplicate flow: create a NEW target id while copying secrets from an
+			* existing row. The UI never holds the stored token; blank / redacted
+			* password fields are restored from this source (D634 still applies if
+			* destinations diverge without a re-typed secret).
+			*/
+			cloneSecretsFrom: string().optional()
+		}), TargetSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteTarget: method(object({ targetId: string() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setTargetEnabled: method(object({
+			targetId: string(),
+			enabled: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+function errorText(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+/** `actions.run` flattens a refusal to `[code] text`; the code leads. */
+function refusalFromThrown(message) {
+	if (message.startsWith("[busy]")) return "already-running";
+	if (message.startsWith("[not-found]")) return "not-found";
+	return null;
+}
+async function runExportedAction(api, log, input) {
+	const { exporter, actionId } = input;
+	const tags = { actionId };
+	const refuse = (reason, detail) => {
+		log.warn(`${exporter}: exported action not run — ${reason}`, {
+			tags,
+			meta: {
+				reason,
+				...detail ? { detail } : {}
+			}
+		});
+		return {
+			status: "refused",
+			reason
+		};
+	};
+	try {
+		const result = await api.actions.run.mutate({ actionId });
+		if (result.outcome === "skipped-overlap") return refuse("already-running", result.message);
+		if (result.outcome === "skipped-cooldown") return refuse("cooldown", result.message);
+		if (result.outcome === "failed" || result.outcome === "aborted") {
+			const message = result.message ?? result.outcome;
+			log.warn(`${exporter}: exported action failed`, {
+				tags,
+				meta: {
+					outcome: result.outcome,
+					message
+				}
+			});
+			return {
+				status: "failed",
+				message
+			};
+		}
+		log.info(`${exporter}: exported action ran`, {
+			tags,
+			meta: { outcome: result.outcome }
+		});
+		return { status: "started" };
+	} catch (err) {
+		const message = errorText(err);
+		const reason = refusalFromThrown(message);
+		if (reason !== null) return refuse(reason, message);
+		log.warn(`${exporter}: exported action failed`, {
+			tags,
+			meta: { message }
+		});
+		return {
+			status: "failed",
+			message
+		};
+	}
+}
+/** Send through one CamStack notification target on behalf of an exporter. */
+async function sendToExportedTarget(api, log, input) {
+	const { exporter, targetId } = input;
+	const tags = { targetId };
+	try {
+		const target = (await api.notificationOutput.listTargets.query({})).find((t) => t.id === targetId);
+		if (target === void 0) {
+			log.warn(`${exporter}: exported notifier not used — target-gone`, {
+				tags,
+				meta: { reason: "target-gone" }
+			});
+			return {
+				status: "refused",
+				reason: "target-gone"
+			};
+		}
+		if (!target.enabled) {
+			log.warn(`${exporter}: exported notifier not used — target-disabled`, {
+				tags,
+				meta: { reason: "target-disabled" }
+			});
+			return {
+				status: "refused",
+				reason: "target-disabled"
+			};
+		}
+		const result = await api.notificationOutput.send.mutate({
+			targetId,
+			addonId: target.addonId,
+			notification: NotificationSchema.parse(input.notification)
+		});
+		if (!result.success) {
+			const message = result.error ?? "send failed";
+			log.warn(`${exporter}: exported notifier send failed`, {
+				tags,
+				meta: { message }
+			});
+			return {
+				status: "failed",
+				message
+			};
+		}
+		return { status: "sent" };
+	} catch (err) {
+		const message = errorText(err);
+		log.warn(`${exporter}: exported notifier send failed`, {
+			tags,
+			meta: { message }
+		});
+		return {
+			status: "failed",
+			message
+		};
+	}
+}
+/**
+* Split an exporter's selection into what still exists and what was deleted.
+* Devices are never judged here (their lifecycle is the tombstone, D865).
+* Callers pass ids from a query that ANSWERED — an unanswered list must not
+* reach this function (D49: a failed read changes nothing).
+*/
+function pruneDeletedEntities(selection, live, log, exporter) {
+	const kept = [];
+	const dropped = [];
+	for (const ref of selection) if (ref.kind === "action" && !live.actionIds.has(ref.actionId)) {
+		dropped.push(ref);
+		log.warn(`${exporter}: exported action was deleted — dropped from the export`, { tags: { actionId: ref.actionId } });
+	} else if (ref.kind === "notifier" && !live.targetIds.has(ref.targetId)) {
+		dropped.push(ref);
+		log.warn(`${exporter}: exported notifier target was deleted — dropped from the export`, { tags: { targetId: ref.targetId } });
+	} else kept.push(ref);
+	return {
+		kept,
+		dropped
+	};
+}
+/**
 * `addon-pages` — system-scoped singleton aggregator cap. Public-facing
 * surface that admin-ui consumes through `useAddonPagesListPages()`.
 *
@@ -16478,52 +17212,6 @@ var AddonPageInfoSchema = object({
 	bundleUrl: string()
 });
 method(_void(), array(AddonPageInfoSchema).readonly());
-/**
-* `addon-pages-source` — collection cap exposing per-provider raw page
-* declarations. Every addon that contributes a UI page registers a
-* provider here. The hub-side singleton aggregator (`addon-pages` cap,
-* see `addon-pages.cap.ts`) walks this collection, stamps versioned
-* `bundleUrl` values, and returns the enriched `AddonPageInfo[]` list
-* that admin-ui consumes.
-*
-* The split exists because the public listing has a different output
-* shape than the per-provider raw declarations, and we want both ends
-* to flow through codegen instead of relying on a hand-written wrapper.
-*/
-var AddonPageDeclarationSchema = object({
-	id: string(),
-	label: string(),
-	icon: string(),
-	path: string(),
-	/**
-	* Module Federation remote name — must match the `name` field on the
-	* page addon's `federation()` plugin config. Used by admin-ui's
-	* `<AddonPageLoader>` to call `loadRemote('<remoteName>/page')`.
-	* Conventionally `addon_<id>_page` (snake_case; MF names cannot
-	* contain hyphens).
-	*/
-	remoteName: string(),
-	/**
-	* Bundle filename inside the addon's `dist/` dir served at
-	* `/api/addon-pages/<addonId>/<bundle>`. With Module Federation this
-	* is always `'remoteEntry.js'`; the value is kept on the metadata so
-	* the static-file route can compute an mtime-based cache-buster URL
-	* without a separate filesystem stat.
-	*/
-	bundle: string(),
-	/**
-	* Sidebar section this page docks into. Well-known ids: `'detection'`,
-	* `'cluster'`, `'administration'` — the page renders inside that group.
-	* Any OTHER string creates (or joins) a custom section rendered after
-	* the built-in groups; its label comes from `sectionLabel` (first
-	* declaration wins), falling back to the id. Absent → the legacy
-	* "Addon Pages" group.
-	*/
-	section: string().optional(),
-	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
-	sectionLabel: string().optional()
-});
-method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" });
 var AddonHttpRouteSchema = object({
 	method: _enum([
 		"GET",
@@ -19240,7 +19928,11 @@ var CompositionProblemSchema = object({
 		"mixed-quantity",
 		"helper-mismatch",
 		"member-constraint",
-		"retention"
+		"retention",
+		"command-method-unknown",
+		"command-source-unknown",
+		"command-input-unknown",
+		"command-input-missing"
 	]),
 	path: string(),
 	message: string()
@@ -19279,7 +19971,9 @@ var CompositionFieldRoleSchema = _enum([
 var CompositionFieldItemSchema = object({
 	arrayPath: string(),
 	key: string(),
-	label: string()
+	label: string(),
+	/** True when the item carries a `reset` forward: the composer writes `resettable` from this (D967). */
+	resettable: boolean().optional()
 });
 var CompositionFieldPlanSchema = object({
 	cap: string(),
@@ -19484,7 +20178,7 @@ Object.freeze({
 * One catalog row per base reading a group helper can build (D944 §3).
 * Data, not a form default written into the block.
 */
-var NOW$2 = {
+var NOW$3 = {
 	fieldPath: "lastFetchedAt",
 	expr: "now"
 };
@@ -19536,7 +20230,7 @@ var GROUP_TEMPLATES = [
 		quantity: "temperature",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2],
+		companions: [NOW$3],
 		alsoFrom: {
 			deviceTypes: CLIMATE_DEVICES,
 			accept: {
@@ -19554,7 +20248,7 @@ var GROUP_TEMPLATES = [
 		quantity: "humidity",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2],
+		companions: [NOW$3],
 		alsoFrom: {
 			deviceTypes: CLIMATE_DEVICES,
 			accept: {
@@ -19572,7 +20266,7 @@ var GROUP_TEMPLATES = [
 		quantity: "pressure",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2]
+		companions: [NOW$3]
 	}),
 	numeric({
 		id: "illuminance",
@@ -19583,7 +20277,7 @@ var GROUP_TEMPLATES = [
 		quantity: "illuminance",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2]
+		companions: [NOW$3]
 	}),
 	numeric({
 		id: "power",
@@ -19594,7 +20288,7 @@ var GROUP_TEMPLATES = [
 		quantity: "power",
 		defaultAggregate: "sum",
 		empty: "omit",
-		companions: [NOW$2]
+		companions: [NOW$3]
 	}),
 	numeric({
 		id: "energy",
@@ -19605,7 +20299,7 @@ var GROUP_TEMPLATES = [
 		quantity: "energy",
 		defaultAggregate: "sum",
 		empty: "omit",
-		companions: [NOW$2]
+		companions: [NOW$3]
 	}),
 	numeric({
 		id: "battery",
@@ -19640,7 +20334,7 @@ var GROUP_TEMPLATES = [
 		quantity: "device",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2]
+		companions: [NOW$3]
 	}),
 	binary({
 		id: "motion",
@@ -22335,6 +23029,36 @@ var ExposeInputSchema = object({
 	capabilities: array(string()).optional()
 });
 var UnexposeInputSchema = object({ deviceId: string() });
+/**
+* What an exporter may expose besides devices (D968). An action and a
+* notification target are LIST ENTRIES, never devices (D954): they enter an
+* exporter's own selection, not the device registry.
+*/
+var ExportEntityKindSchema = _enum([
+	"device",
+	"action",
+	"notifier"
+]);
+var ExportEntityRefSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("device"),
+		deviceId: string()
+	}),
+	object({
+		kind: literal("action"),
+		actionId: string().min(1)
+	}),
+	object({
+		kind: literal("notifier"),
+		targetId: string().min(1)
+	})
+]);
+var ExposedEntitySchema = object({
+	entity: ExportEntityRefSchema,
+	exposedAs: string().optional()
+});
+var ExposeEntityInputSchema = object({ entity: ExportEntityRefSchema });
+var UnexposeEntityInputSchema = object({ entity: ExportEntityRefSchema });
 var deviceExportCapability = {
 	name: "device-export",
 	scope: "system",
@@ -22364,6 +23088,16 @@ var deviceExportCapability = {
 		unexposeDevice: method(UnexposeInputSchema, _void(), {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		listSupportedEntityKinds: optionalMethod(_void(), array(ExportEntityKindSchema)),
+		listExposedEntities: optionalMethod(_void(), array(ExposedEntitySchema)),
+		exposeEntity: optionalMethod(ExposeEntityInputSchema, _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		unexposeEntity: optionalMethod(UnexposeEntityInputSchema, _void(), {
+			kind: "mutation",
+			auth: "admin"
 		})
 	}
 };
@@ -43587,6 +44321,14 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 });
+method(object({
+	nodeId: string().min(1),
+	/** Epoch ms the node was forgotten (the tombstone's `removedAt`). */
+	removedAt: number()
+}), object({ counts: record(string(), number().int().nonnegative()) }), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * `device-removal-hook` — the reliable way an addon learns a device was DELETED,
 * so it can delete what it keeps for that device (D865).
@@ -44307,7 +45049,7 @@ var LlmProviderWidgetSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$3 = unknown();
+var ConfigSchemaPassthrough$2 = unknown();
 var LlmProfileKindDescriptorSchema = object({
 	kind: LlmProfileKindSchema,
 	label: string(),
@@ -44316,9 +45058,9 @@ var LlmProfileKindDescriptorSchema = object({
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
 	/** The provider's own fields (`providerConfig`); `password` fields are keychain-held. */
-	connectionSchema: ConfigSchemaPassthrough$3,
+	connectionSchema: ConfigSchemaPassthrough$2,
 	/** Provider fields that belong under "Advanced" (extra headers, runtime tuning). */
-	advancedSchema: ConfigSchemaPassthrough$3.optional(),
+	advancedSchema: ConfigSchemaPassthrough$2.optional(),
 	/** The kind's defaults; a model from `listModels` may override any of them. */
 	features: LlmModelFeaturesSchema,
 	/** `false` = the provider stamps `supportsVision` itself (from what a node reports). */
@@ -44844,10 +45586,10 @@ var CpuBreakdownSchema = object({
 	cores: number()
 });
 var MemoryInfoSchema = object({
-	percent: number(),
+	percent: number().nullable(),
 	totalBytes: number(),
-	usedBytes: number(),
-	availableBytes: number(),
+	usedBytes: number().nullable(),
+	availableBytes: number().nullable(),
 	swapUsedBytes: number(),
 	swapTotalBytes: number()
 });
@@ -45151,8 +45893,9 @@ var GetLoadSeriesInputSchema = object({
 });
 var SystemMetricsSchema = object({
 	cpuPercent: number(),
-	memoryPercent: number(),
-	memoryUsedMB: number(),
+	/** `null` when the memory sample failed or was not taken yet (D393). */
+	memoryPercent: number().nullable(),
+	memoryUsedMB: number().nullable(),
 	memoryTotalMB: number(),
 	diskPercent: number().optional(),
 	temperature: number().optional(),
@@ -45251,586 +45994,143 @@ var BrokerKindSchema = _enum(["external", "embedded"]);
 *
 * - `connected` — last probe completed a clean CONNACK
 * - `disconnected` — no probe has run yet (cold cache)
-* - `auth-failed` — CONNACK refused with auth error (RC 4 / 5)
-* - `unreachable` — TCP connect timed out / refused
-* - `tls-error` — TLS handshake failed (cert / SNI / cipher)
-*/
-var BrokerStatusSchema$1 = _enum([
-	"connected",
-	"disconnected",
-	"auth-failed",
-	"unreachable",
-	"tls-error"
-]);
-var BrokerInfoSchema$1 = object({
-	id: string(),
-	name: string(),
-	url: string(),
-	kind: BrokerKindSchema,
-	status: BrokerStatusSchema$1,
-	latencyMs: number().nullable(),
-	error: string().optional(),
-	/** Embedded brokers only: number of MQTT clients currently connected. */
-	connectedClients: number().int().nonnegative().optional(),
-	/** Epoch ms of the last live probe (external) or aedes snapshot (embedded). */
-	lastCheckedAt: number().optional()
-});
-/**
-* Connection details — what a consumer needs to call
-* `mqtt.connect(url, options)`. We split URL + credentials so the
-* consumer can pass them as `mqtt.connect(url, { username, password })`
-* instead of stuffing creds into the URL (which leaks them into logs).
-*/
-var BrokerConnectionDetailsSchema = object({
-	url: string(),
-	username: string().optional(),
-	password: string().optional(),
-	/**
-	* Suggested prefix for `clientId`. Each consumer should suffix this
-	* with its own discriminator (addon id, instance id) so reconnects
-	* don't kick each other off (MQTT spec: clientId must be unique per
-	* broker).
-	*/
-	clientIdPrefix: string().optional()
-});
-var AddBrokerInputSchema = object({
-	name: string().min(1),
-	url: string().regex(/^(mqtt|mqtts|ws|wss):\/\//, "URL must start with mqtt(s):// or ws(s)://"),
-	username: string().optional(),
-	password: string().optional(),
-	clientIdPrefix: string().optional()
-});
-var AddBrokerResultSchema = object({ id: string() });
-var IdInputSchema = object({ id: string() });
-var TestResultSchema$1 = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number()
-}), object({
-	ok: literal(false),
-	error: string()
-})]);
-var StartEmbeddedInputSchema = object({
-	port: number().int().min(1).max(65535).default(1883),
-	/** Allow anonymous connect (no username/password). Default: false. */
-	allowAnonymous: boolean().default(false),
-	/** Optional shared username/password for clients. */
-	username: string().optional(),
-	password: string().optional()
-});
-var StartEmbeddedResultSchema = object({
-	id: string(),
-	url: string()
-});
-var StatusSchema = object({
-	brokerCount: number(),
-	embeddedRunning: boolean()
-});
-method(_void(), array(BrokerInfoSchema$1)), method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }), method(AddBrokerInputSchema, AddBrokerResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(IdInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(IdInputSchema, TestResultSchema$1, {
-	kind: "mutation",
-	auth: "admin"
-}), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(IdInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), StatusSchema);
-var NetworkEndpointSchema = object({
-	url: string(),
-	hostname: string(),
-	port: number(),
-	protocol: _enum(["http", "https"]),
-	/**
-	* Whether this address survives a restart of its provider. `false` = it is
-	* re-issued every time (a Quick tunnel's random `*.trycloudflare.com`); the
-	* hub never selects such an address AUTOMATICALLY for a role (D860), though
-	* it stays visible and an operator may still flag it. Absent = stable: every
-	* provider except a Quick tunnel owns a name that does not change.
-	*/
-	stable: boolean().optional()
-});
-object({
-	url: string(),
-	/** Mirrors {@link NetworkEndpointSchema} `stable`; absent = stable. */
-	stable: boolean().optional(),
-	updated: boolean().optional()
-});
-var NetworkAccessStatusSchema = object({
-	connected: boolean(),
-	endpoint: NetworkEndpointSchema.nullable(),
-	error: string().optional()
-});
-/**
-* Optional, richer endpoint shape returned by providers that expose
-* MORE than one ingress concurrently (Tailscale Funnel with mixed
-* serve+funnel rules, future ngrok multi-tunnel, …). Each entry carries
-* the originating provider config (mode + sourcePort) so the
-* orchestrator UI can label rows distinctly. Providers that expose only
-* one endpoint just omit `listEndpoints` from their provider impl.
-*/
-var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
-	/**
-	* Stable id within the provider — typically `<mode>-<sourcePort>` so
-	* the orchestrator can dedupe across `listEndpoints` polls.
-	*/
-	id: string(),
-	/** Operator-facing label (mirrors `MeshEndpoint.label`). */
-	label: string(),
-	/** Optional provider-specific mode tag, used for icon/colour in admin UI. */
-	mode: string().optional(),
-	/** Originating local port the ingress fronts (informational). */
-	sourcePort: number().optional()
-});
-method(_void(), NetworkEndpointSchema, { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), NetworkEndpointSchema.nullable()), method(_void(), NetworkAccessStatusSchema), method(_void(), array(NetworkEndpointEntrySchema).readonly());
-/**
-* notification-output — canonical, capability-gated notification delivery.
-*
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
-*
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
-*
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = _enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: string().optional(),
-	bytes: _instanceof(Uint8Array).optional(),
-	mime: string().optional(),
-	name: string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = _enum([
-	"text",
-	"markdown",
-	"html"
-]);
-/**
-* The CLOSED icon vocabulary an action button may use.
-*
-* A closed set, not a free string, and that is the whole point: an arbitrary
-* icon name is one that ntfy renders, zentik silently drops, and nobody
-* notices — the same class of gap as a zone vocabulary nothing produced
-* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
-* declares `actionIcons: false` and the degrade engine strips the field.
-*
-* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
-* renderer's icon set; "acknowledge" survives an adapter that draws it
-* differently.
-*
-* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
-*
-* These names are for US. **No adapter may forward one verbatim.** Each maps
-* the whole set onto its own renderer's vocabulary through a
-* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
-* fallback, so adding a member here fails every adapter's build until someone
-* decides its glyph, which is the only place that decision can be made
-* honestly.
-*
-* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
-* `disarm` straight through; iOS feeds that string to
-* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
-* and every snooze and alarm button arrived BLANK. A pass-through is not a
-* mapping, and "the field is documented" is not "the value renders".
-*
-* Adding a member is TRAIN-BOUND. The enum lives in the published
-* `@camstack/server` closure and the cap seam validates against the HUB's copy,
-* so an addon that emits a token the running hub does not know does not lose an
-* icon — its whole `send` fails Zod validation and the notification never
-* arrives. Never emit a new token from an addon before the train carrying it.
-*/
-var NotificationActionIconSchema = _enum([
-	"acknowledge",
-	"dismiss",
-	"silence",
-	"snooze",
-	"view",
-	"play",
-	"open",
-	"close",
-	"lock",
-	"unlock",
-	"arm",
-	"arm-home",
-	"arm-away",
-	"arm-night",
-	"disarm",
-	"light",
-	"alert",
-	"camera"
-]);
-/** A single tap-through action button. */
-var NotificationActionSchema = object({
-	id: string(),
-	label: string(),
-	url: string().optional(),
-	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
-	icon: NotificationActionIconSchema.optional(),
-	/**
-	* Renders in a warning style where the notifier supports it.
-	*
-	* A HINT, never a gate. The callback's authority is its token and nothing
-	* else — see `notification-center/action-token.ts` for what that does and
-	* does not buy.
-	*/
-	destructive: boolean().optional(),
-	/**
-	* How the tap should REACH the url.
-	*
-	* `navigate` (absent, and every button authored before this field) opens it:
-	* the phone leaves the notification and shows whatever the callback returns.
-	* That is right for a button whose answer the operator wants to read.
-	*
-	* `background` fires it as a POST and stays put. It exists for the buttons
-	* whose whole point is not to interrupt — "silence this for 30 minutes" is
-	* an answer to the notification, and being thrown into a browser tab to
-	* confirm it costs more attention than the notification did. A backend that
-	* cannot do a background call renders it as an ordinary link (the adapters
-	* fall back rather than dropping the button), so this is a preference, never
-	* a requirement.
-	*/
-	mode: _enum(["navigate", "background"]).optional()
-});
-/** A delivery parameter value: what a notifier declared it takes. */
-var DeliveryParamValueSchema = union([
-	string(),
-	number(),
-	boolean()
-]);
-/**
-* One extra delivery parameter a notifier KIND declares (D938). A rule that
-* addresses a target of that kind may set it; a kind that declares nothing is
-* never handed one. The admin UI derives its control from this descriptor —
-* no editor knows a service by name.
-*
-* Optional fields are `.optional()`, never `.default()` (a Zod default does not
-* run on the addon cap path).
-*/
-var DeliveryParamSchema = object({
-	key: string().min(1),
-	label: string(),
-	/** i18n key of the label, resolved by the declaring addon's namespace. */
-	labelKey: string().optional(),
-	type: _enum([
-		"enum",
-		"number",
-		"boolean",
-		"string"
-	]),
-	/** `enum` only: the closed set of accepted values. */
-	options: array(object({
-		value: string(),
-		label: string()
-	})).optional(),
-	/** `number` only. */
-	min: number().optional(),
-	max: number().optional(),
-	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
-	default: DeliveryParamValueSchema.optional()
-});
-/**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
-*/
-var NotificationSchema = object({
-	body: string(),
-	title: string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: number().int().min(1).max(5).default(3),
-	level: string().optional(),
-	attachments: array(AttachmentSchema).optional(),
-	clickUrl: string().optional(),
-	actions: array(NotificationActionSchema).optional(),
-	sound: string().optional(),
-	ttl: number().optional(),
-	tag: string().optional(),
-	deviceId: number().optional(),
-	eventId: string().optional(),
-	metadata: record(string(), unknown()).optional(),
-	/**
-	* Values for the parameters the target's kind DECLARES in
-	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
-	* declaration by the sender; a notifier reads only the keys it declared.
-	*/
-	delivery: record(string(), DeliveryParamValueSchema).optional()
-});
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = object({
-	id: string(),
-	label: string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: number().int().min(1).max(5).nullable(),
-	flags: object({
-		critical: boolean().optional(),
-		silent: boolean().optional(),
-		noPush: boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: array(string()).optional(),
-	description: string().optional()
-});
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = object({
-	attachments: object({
-		mediaTypes: array(AttachmentMediaTypeSchema),
-		mode: _enum([
-			"url",
-			"bytes",
-			"both"
-		]),
-		max: number().int().nonnegative(),
-		maxBytes: number().int().positive().optional()
-	}),
-	/** Max action buttons (0 = none). */
-	actions: number().int().nonnegative(),
-	/**
-	* Whether this kind renders a per-action ICON.
-	*
-	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
-	* run on the addon cap path — three production failures in one day taught
-	* this repo that once. Absent is read as false by the degrade engine, which
-	* is the safe direction: an icon that is not rendered costs nothing, an icon
-	* assumed and dropped costs the operator's trust in the field.
-	*/
-	actionIcons: boolean().optional(),
-	levels: array(TargetKindLevelSchema),
-	format: array(NotificationFormatSchema),
-	clickUrl: boolean(),
-	sound: boolean(),
-	ttl: boolean(),
-	bodyMaxLen: number().int().positive()
+* - `auth-failed` — CONNACK refused with auth error (RC 4 / 5)
+* - `unreachable` — TCP connect timed out / refused
+* - `tls-error` — TLS handshake failed (cert / SNI / cipher)
+*/
+var BrokerStatusSchema$1 = _enum([
+	"connected",
+	"disconnected",
+	"auth-failed",
+	"unreachable",
+	"tls-error"
+]);
+var BrokerInfoSchema$1 = object({
+	id: string(),
+	name: string(),
+	url: string(),
+	kind: BrokerKindSchema,
+	status: BrokerStatusSchema$1,
+	latencyMs: number().nullable(),
+	error: string().optional(),
+	/** Embedded brokers only: number of MQTT clients currently connected. */
+	connectedClients: number().int().nonnegative().optional(),
+	/** Epoch ms of the last live probe (external) or aedes snapshot (embedded). */
+	lastCheckedAt: number().optional()
 });
 /**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+* Connection details — what a consumer needs to call
+* `mqtt.connect(url, options)`. We split URL + credentials so the
+* consumer can pass them as `mqtt.connect(url, { username, password })`
+* instead of stuffing creds into the URL (which leaks them into logs).
 */
-var ConfigSchemaPassthrough$2 = unknown();
-var TargetKindSchema = object({
-	kind: string(),
-	label: string(),
-	icon: string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: string(),
-	/**
-	* URL of the kind's bundled BRAND icon, served by the providing addon over
-	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
-	* when the addon bundles no icon for that kind — the client then falls back
-	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
-	*
-	* Root-relative on purpose: it resolves against whatever origin serves a web
-	* client, and a native client joins it onto its own hub base.
-	*
-	* DECLARED here deliberately. It used to travel as an undeclared passthrough
-	* field that survived only because the runtime cap-router forwards provider
-	* output verbatim — so every consumer had to re-declare it by hand to stop
-	* its own Zod parse from stripping it, and the whole arrangement would have
-	* broken silently the moment output validation was tightened anywhere.
-	*/
-	iconUrl: string().optional(),
-	/**
-	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
-	*
-	* The server knows this and therefore says it, because the client cannot
-	* safely guess: a React-Native client renders SVG and raster through two
-	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
-	* not decode SVG on iOS/Android), so without this it silently fell back to a
-	* placeholder glyph for every vector icon while the web build looked fine.
-	*
-	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
-	* not been updated — a client that cannot determine the type should prefer
-	* its raster path, which is the safe default for an unknown image.
-	*/
-	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough$2,
-	/**
-	* The config keys that decide WHERE this kind's secrets are sent (server,
-	* base URL, instance, chat, recipient). A save that changes any of them
-	* while leaving a secret redacted is refused by the provider (D634), so an
-	* editor uses this to ask for the secret on exactly those edits instead of
-	* on every edit.
-	*
-	* Optional: absent from a provider that holds no secret (the Home Assistant
-	* kinds) and from a provider older than this field — an editor that finds
-	* it absent must assume ANY edit may need the secret.
-	*/
-	destinationKeys: array(string()).optional(),
-	supportsDiscovery: boolean(),
+var BrokerConnectionDetailsSchema = object({
+	url: string(),
+	username: string().optional(),
+	password: string().optional(),
 	/**
-	* Extra delivery parameters a rule may set for a target of this kind (D938).
-	* Absent = none; the rule editor then offers nothing.
+	* Suggested prefix for `clientId`. Each consumer should suffix this
+	* with its own discriminator (addon id, instance id) so reconnects
+	* don't kick each other off (MQTT spec: clientId must be unique per
+	* broker).
 	*/
-	deliveryParams: array(DeliveryParamSchema).optional(),
-	caps: TargetKindCapsSchema
+	clientIdPrefix: string().optional()
 });
-/**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
-*/
-var TargetSchema = object({
+var AddBrokerInputSchema = object({
+	name: string().min(1),
+	url: string().regex(/^(mqtt|mqtts|ws|wss):\/\//, "URL must start with mqtt(s):// or ws(s)://"),
+	username: string().optional(),
+	password: string().optional(),
+	clientIdPrefix: string().optional()
+});
+var AddBrokerResultSchema = object({ id: string() });
+var IdInputSchema = object({ id: string() });
+var TestResultSchema$1 = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	latencyMs: number()
+}), object({
+	ok: literal(false),
+	error: string()
+})]);
+var StartEmbeddedInputSchema = object({
+	port: number().int().min(1).max(65535).default(1883),
+	/** Allow anonymous connect (no username/password). Default: false. */
+	allowAnonymous: boolean().default(false),
+	/** Optional shared username/password for clients. */
+	username: string().optional(),
+	password: string().optional()
+});
+var StartEmbeddedResultSchema = object({
 	id: string(),
-	name: string(),
-	kind: string(),
-	addonId: string(),
-	enabled: boolean(),
-	config: record(string(), unknown())
+	url: string()
 });
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = object({
-	kind: string(),
-	suggestedName: string(),
-	config: record(string(), unknown())
+var StatusSchema = object({
+	brokerCount: number(),
+	embeddedRunning: boolean()
 });
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = object({
-	level: string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: number().int().nonnegative(),
-	actionsSent: number().int().nonnegative(),
-	truncated: boolean(),
-	dropped: array(string())
+method(_void(), array(BrokerInfoSchema$1)), method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }), method(AddBrokerInputSchema, AddBrokerResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(IdInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(IdInputSchema, TestResultSchema$1, {
+	kind: "mutation",
+	auth: "admin"
+}), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(IdInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), StatusSchema);
+var NetworkEndpointSchema = object({
+	url: string(),
+	hostname: string(),
+	port: number(),
+	protocol: _enum(["http", "https"]),
+	/**
+	* Whether this address survives a restart of its provider. `false` = it is
+	* re-issued every time (a Quick tunnel's random `*.trycloudflare.com`); the
+	* hub never selects such an address AUTOMATICALLY for a role (D860), though
+	* it stays visible and an operator may still flag it. Absent = stable: every
+	* provider except a Quick tunnel owns a name that does not change.
+	*/
+	stable: boolean().optional()
 });
-var SendResultSchema = object({
-	success: boolean(),
-	error: string().optional(),
-	renderedAs: RenderedAsSchema.optional()
+object({
+	url: string(),
+	/** Mirrors {@link NetworkEndpointSchema} `stable`; absent = stable. */
+	stable: boolean().optional(),
+	updated: boolean().optional()
+});
+var NetworkAccessStatusSchema = object({
+	connected: boolean(),
+	endpoint: NetworkEndpointSchema.nullable(),
+	error: string().optional()
 });
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
 /**
-* Pre-save credential probe against a partial (unsaved) target config.
-* `resolvedUrl` never includes secrets (token stripped from path).
+* Optional, richer endpoint shape returned by providers that expose
+* MORE than one ingress concurrently (Tailscale Funnel with mixed
+* serve+funnel rules, future ngrok multi-tunnel, …). Each entry carries
+* the originating provider config (mode + sourcePort) so the
+* orchestrator UI can label rows distinctly. Providers that expose only
+* one endpoint just omit `listEndpoints` from their provider impl.
 */
-var ProbeTargetConfigResultSchema = object({
-	ok: boolean(),
-	resolvedUrl: string(),
-	httpStatus: number().int().optional(),
-	stateInstance: string().optional(),
-	error: string().optional()
+var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
+	/**
+	* Stable id within the provider — typically `<mode>-<sourcePort>` so
+	* the orchestrator can dedupe across `listEndpoints` polls.
+	*/
+	id: string(),
+	/** Operator-facing label (mirrors `MeshEndpoint.label`). */
+	label: string(),
+	/** Optional provider-specific mode tag, used for icon/colour in admin UI. */
+	mode: string().optional(),
+	/** Originating local port the ingress fronts (informational). */
+	sourcePort: number().optional()
 });
-var notificationOutputCapability = {
-	name: "notification-output",
-	scope: "system",
-	mode: "collection",
-	methods: {
-		listTargetKinds: method(object({}), array(TargetKindSchema)),
-		listTargets: method(object({}), array(TargetSchema), { auth: "admin" }),
-		/**
-		* One target WITH secrets — admin edit / duplicate hydration only.
-		* `listTargets` stays redacted; the editor loads this so password fields
-		* are filled (masked in the input) and a save can round-trip the token
-		* when a destination changes (Duplicate with a new chatId, etc.).
-		*/
-		getTarget: method(object({ targetId: string() }), TargetSchema, { auth: "admin" }),
-		discoverTargets: method(object({
-			kind: string(),
-			config: record(string(), unknown()).optional(),
-			/**
-			* When editing / duplicating, the blank password field never round-trips
-			* the stored token. Pass the source target id so the provider can restore
-			* secrets server-side before dialling (same merge as upsert).
-			*/
-			targetId: string().optional()
-		}), array(DiscoveredTargetSchema), { auth: "admin" }),
-		probeTargetConfig: method(object({
-			kind: string(),
-			config: record(string(), unknown()),
-			/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
-			targetId: string().optional()
-		}), ProbeTargetConfigResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		send: method(object({
-			targetId: string(),
-			notification: NotificationSchema
-		}), SendResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		testTarget: method(object({
-			targetId: string(),
-			sample: NotificationSchema.optional()
-		}), TestResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		upsertTarget: method(object({
-			target: TargetSchema,
-			/**
-			* Duplicate flow: create a NEW target id while copying secrets from an
-			* existing row. The UI never holds the stored token; blank / redacted
-			* password fields are restored from this source (D634 still applies if
-			* destinations diverge without a re-typed secret).
-			*/
-			cloneSecretsFrom: string().optional()
-		}), TargetSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		deleteTarget: method(object({ targetId: string() }), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		setTargetEnabled: method(object({
-			targetId: string(),
-			enabled: boolean()
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
-	}
-};
+method(_void(), NetworkEndpointSchema, { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), NetworkEndpointSchema.nullable()), method(_void(), NetworkAccessStatusSchema), method(_void(), array(NetworkEndpointEntrySchema).readonly());
 var AUDIO_MACRO_LABELS = [
 	{
 		id: "speech",
@@ -52291,14 +52591,6 @@ var EngineProvisioningSchema = object({
 	*/
 	configIssues: array(string()).optional()
 });
-var PipelineStepInputSchema = lazy(() => object({
-	addonId: string(),
-	modelId: string().optional(),
-	enabled: boolean().default(true),
-	children: array(PipelineStepInputSchema).optional(),
-	settings: record(string(), unknown()).optional(),
-	jumpDeviceKey: string().optional()
-}));
 var ModelSubstitutionSchema = object({
 	addonId: string(),
 	chosen: string(),
@@ -52377,7 +52669,6 @@ var ConfigUISchemaBridge = custom();
 var ConfigUISchemaNullableBridge = custom();
 var InferenceCapabilitiesBridge = custom();
 var ModelAvailabilityListBridge = custom();
-var PipelineRunResultBridge = custom();
 method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngineChoiceSchema), method(object({ nodeId: string() }), EngineProvisioningSchema), method(_void(), record(string(), object({
 	modelId: string(),
 	settings: record(string(), unknown()).readonly()
@@ -55583,6 +55874,12 @@ var ServerUpdateActionResultSchema = object({
 	*/
 	blockers: array(UpdateBlockerSchema).optional()
 });
+var LaunchOverridesSchema = object({ 
+/** The persisted heap ceiling in MB, or `null` when none is set. */
+heapMb: number().int().nullable() });
+var SetLaunchOverridesResultSchema = LaunchOverridesSchema.extend({ 
+/** Always true: the override is read at launch, not by the running process. */
+restartRequired: boolean() });
 method(_void(), ServerPackageStatusSchema, { auth: "admin" }), method(_void(), ServerUpdateCheckResultSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -55605,6 +55902,9 @@ method(_void(), ServerPackageStatusSchema, { auth: "admin" }), method(_void(), S
 }), method(_void(), ServerUpdateActionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(_void(), LaunchOverridesSchema, { auth: "admin" }), method(object({ heapMb: number().int().min(512).max(65536).nullable() }), SetLaunchOverridesResultSchema, {
+	kind: "mutation",
+	auth: "admin"
 });
 /**
 * `smtp-provider` — pluggable email delivery surface.
@@ -60609,14 +60909,13 @@ reset: method(object({
 		auth: "admin"
 	}) },
 	/**
-	* A composed consumable (item added to a device with no native consumables
-	* provider) refuses `reset` by name: "Only meaningful when the item's
-	* `resettable` is true" — a composed item is never resettable until
-	* commands (`forward`) arrive in slice 3 (D663).
+	* A consumable ADDED to an existing device (a graft) refuses `reset` by
+	* name: only a composed device of a NEW type forwards an item's reset to a
+	* source button, and marks that item `resettable` (D967).
 	*/
 	composedMethods: { reset: {
 		kind: "refuse",
-		reason: "a composed consumable is not resettable until commands (forward) arrive — slice 3"
+		reason: "a consumable added to an existing device is not resettable — only a new composed device forwards a reset"
 	} },
 	status: {
 		schema: ConsumablesStatusSchema,
@@ -61210,7 +61509,7 @@ var DishwasherStatusSchema = object({
 	/** Ms epoch of the last value received from the appliance; 0 = never. */
 	lastFetchedAt: number()
 });
-var DeviceIdSchema = number().int().nonnegative();
+var DeviceIdSchema$1 = number().int().nonnegative();
 /** A value a program option or setting can take. */
 var DishwasherValueSchema = union([
 	boolean(),
@@ -61285,77 +61584,77 @@ var dishwasherCapability = {
 		* option feature keys; each is checked against the program's constraints.
 		*/
 		start: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			program: string().min(1).optional(),
 			options: record(string(), DishwasherValueSchema).optional()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		pause: method(object({ deviceId: DeviceIdSchema }), _void(), {
+		pause: method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		resume: method(object({ deviceId: DeviceIdSchema }), _void(), {
+		resume: method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		stop: method(object({ deviceId: DeviceIdSchema }), _void(), {
+		stop: method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		/** Select (not start) a program; refused when the appliance does not offer it. */
 		setProgram: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			program: string().min(1)
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setPower: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setHalfLoad: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setHygienePlus: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setExtraDry: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setIntensiveZone: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setVarioSpeedPlus: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setChildLock: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
@@ -61367,7 +61666,7 @@ var dishwasherCapability = {
 		* its declared range / members.
 		*/
 		setOption: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			key: string().min(1),
 			value: DishwasherValueSchema
 		}), _void(), {
@@ -61375,7 +61674,7 @@ var dishwasherCapability = {
 			auth: "protected"
 		}),
 		/** What this appliance can do, from its own description — the UI is derived from it. */
-		getOptions: method(object({ deviceId: DeviceIdSchema }), DishwasherOptionsSchema, { auth: "protected" })
+		getOptions: method(object({ deviceId: DeviceIdSchema$1 }), DishwasherOptionsSchema, { auth: "protected" })
 	},
 	status: {
 		schema: DishwasherStatusSchema,
@@ -65076,7 +65375,8 @@ var TopologyNodeSchema = object({
 	isHub: boolean(),
 	isOnline: boolean(),
 	cpuPercent: number(),
-	memoryPercent: number(),
+	/** `null` when the node's memory read failed or it has not reported one (D393). */
+	memoryPercent: number().nullable(),
 	uptime: number(),
 	lastSeen: string(),
 	localIps: array(string()).readonly(),
@@ -65694,9 +65994,10 @@ var PetFeederStatusSchema = object({
 	*  combined reading; per-hopper levels live in `food1`/`food2`. Null when
 	*  the device has not reported yet. */
 	foodLevel: number().nullable().meta(readingMeta("none")),
-	/** Food in the BOWL as the feeder reports it (`state.bowl`), in the
-	*  feeder's own units. Null when the model reports none. */
-	bowlFood: number().nullable().meta(readingMeta("none")),
+	/** Food in the BOWL, a mass (stored in kilograms, D944). Reported only by a
+	*  feeder with a bowl scale; null when the model has none or its reading is
+	*  of an unproven unit. */
+	bowlFood: number().nullable().meta(readingMeta("mass")),
 	/** True while the pet is eating (`state.eating`). */
 	eating: boolean(),
 	/** Whether `markFoodReplenished` does anything on this model. When false
@@ -65880,6 +66181,137 @@ var petFeederCapability = {
 		}
 	} }
 };
+/**
+* Pet water-fountain cap. Models the telemetry and the control surface of a
+* circulating drinking fountain: how much water is in the tank, how much the
+* pet drank, whether the pump runs and on what duty cycle.
+*
+* It has no native vendor provider of its own: a fountain reaches CamStack as
+* a container of loose entities (a pump switch, two number boxes, a "filter
+* changed" button), and an operator BUILDS the device from them — a composed
+* device of this type (D659, D967). Every method is therefore a forward to ONE
+* method of ONE source entity, and every reading is a field derived from a
+* source entity; the provider-shaped interface below exists so the composed
+* device and any future native provider answer the same contract.
+*
+* Quantities are stored in the base unit of their kind (D944): volumes in
+* LITRES, durations in SECONDS, the tank level in percent. A source that
+* reports millilitres or minutes is converted in the composition's expression,
+* never here. Every reading may be `null`: a source that is offline or does
+* not report is unknown, never zero.
+*
+* The filter is not a field of this cap: it is an item of the `consumables`
+* cap on the same device (kind `wear`), reset by the same forward mechanism.
+*/
+var PetFountainStatusSchema = object({
+	/** Water in the tank, 0..100 (%). Null while the source has not reported. */
+	waterLevel: number().min(0).max(100).nullable().meta(readingMeta("percentage")),
+	/** Water in the tank, in litres. Null while the source has not reported. */
+	waterVolume: number().min(0).nullable().meta(readingMeta("volume")),
+	/** True when the tank is empty. Null while unknown. */
+	empty: boolean().nullable(),
+	/** True while the pump is running. Null while unknown. */
+	pumpRunning: boolean().nullable(),
+	/** True when the pump works on an on/off duty cycle rather than continuously. */
+	pumpIntervalEnabled: boolean().nullable(),
+	/** How long the pump runs per cycle, in seconds. */
+	pumpOnTime: number().min(0).nullable().meta(readingMeta("duration")),
+	/** How long the pump rests per cycle, in seconds. */
+	pumpOffTime: number().min(0).nullable().meta(readingMeta("duration")),
+	/** Water drunk in the last drink, in litres. */
+	lastDrink: number().min(0).nullable().meta(readingMeta("volume")),
+	/** Water drunk in the current hour, in litres. */
+	currentHourDrink: number().min(0).nullable().meta(readingMeta("volume")),
+	/** Water drunk over the last 24 hours (rolling), in litres. */
+	last24hDrink: number().min(0).nullable().meta(readingMeta("volume")),
+	/** Water drunk since local midnight, in litres. */
+	todayDrink: number().min(0).nullable().meta(readingMeta("volume")),
+	/** Decoded fault message. Null means healthy; a non-null string is an active fault. */
+	error: string().nullable(),
+	/** Ms epoch when the slice was last refreshed. */
+	lastFetchedAt: number()
+});
+var DeviceIdSchema = number().int().nonnegative();
+var MinutesSchema = number().int().min(0);
+var petFountainCapability = {
+	name: "pet-fountain",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.PetFountain],
+	methods: {
+		/** Start or stop the pump. */
+		setPump: method(object({
+			deviceId: DeviceIdSchema,
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** Switch the on/off duty cycle on or off (off = the pump runs continuously). */
+		setPumpInterval: method(object({
+			deviceId: DeviceIdSchema,
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** Set how many minutes the pump runs per cycle. */
+		setPumpOnMinutes: method(object({
+			deviceId: DeviceIdSchema,
+			minutes: MinutesSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** Set how many minutes the pump rests per cycle. */
+		setPumpOffMinutes: method(object({
+			deviceId: DeviceIdSchema,
+			minutes: MinutesSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** Clear the rolling daily consumption counters on the device. */
+		resetDailyConsumption: method(object({ deviceId: DeviceIdSchema }), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		})
+	},
+	status: {
+		schema: PetFountainStatusSchema,
+		kind: "push"
+	},
+	/** Runtime-state slice — mirrored by the kernel; the hero card reads it whole. */
+	runtimeState: PetFountainStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live appliance state re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
+	/** History (D850): recorded series. */
+	history: { fields: {
+		waterLevel: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 1
+		},
+		waterVolume: {
+			kind: "gauge",
+			unit: "L"
+		},
+		todayDrink: {
+			kind: "gauge",
+			unit: "L"
+		},
+		last24hDrink: {
+			kind: "gauge",
+			unit: "L"
+		}
+	} }
+};
 var VehicleSchema = object({
 	id: string(),
 	name: string(),
@@ -72245,7 +72677,7 @@ function tryConvertDelta(value, from, to) {
 	return shifted - origin;
 }
 SOURCE_CAPS.filter((cap) => cap !== "switch" && cap !== "motion");
-DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.EventEmitter, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer, DeviceType.Camera, DeviceType.Camera, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
+DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.EventEmitter, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.PetFountain, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer, DeviceType.Camera, DeviceType.Camera, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
 String.raw`rose\(active(\d+), changed(\d+), (\d+(?:\.\d+)?)\)`;
 DeviceRole.BinarySensor, DeviceRole.MotionSensor;
 new Set(CAP_NAMES);
@@ -72596,6 +73028,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	notifier: notifierCapability,
 	numericSensor: numericSensorCapability,
 	petFeeder: petFeederCapability,
+	petFountain: petFountainCapability,
 	powerMeter: powerMeterCapability,
 	presence: presenceCapability,
 	pressureSensor: pressureSensorCapability,
@@ -73846,7 +74279,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 		return toDeviceSummary(device, this.addonId);
 	}
 };
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer;
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.PetFountain, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer;
 new Set(Object.values(DeviceType));
 Object.freeze({
 	"accessories.getStatus": {
@@ -75781,6 +76214,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"deviceExport.exposeEntity": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"deviceExport.getDeviceLiveContribution": {
 		capName: "device-export",
 		capScope: "system",
@@ -75809,6 +76249,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"deviceExport.listExposedEntities": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"deviceExport.listSupportedDeviceKinds": {
 		capName: "device-export",
 		capScope: "system",
@@ -75816,6 +76263,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"deviceExport.listSupportedEntityKinds": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"deviceExport.unexposeDevice": {
 		capName: "device-export",
 		capScope: "system",
@@ -75823,6 +76277,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"deviceExport.unexposeEntity": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"deviceExtension.listCandidates": {
 		capName: "device-extension",
 		capScope: "device",
@@ -78644,6 +79105,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"nodeRemovalHook.onNodeRemoved": {
+		capName: "node-removal-hook",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"nodes.clusterAddonStatus": {
 		capName: "nodes",
 		capScope: "system",
@@ -79281,6 +79749,48 @@ Object.freeze({
 		access: "create",
 		role: "viewer"
 	},
+	"petFountain.getStatus": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
+	"petFountain.resetDailyConsumption": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "delete",
+		role: "viewer"
+	},
+	"petFountain.setPump": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"petFountain.setPumpInterval": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"petFountain.setPumpOffMinutes": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"petFountain.setPumpOnMinutes": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
 	"pipelineAnalytics.addRetrainFrameFromRecording": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -81682,6 +82192,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"serverManagement.getLaunchOverrides": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"serverManagement.getServerPackageStatus": {
 		capName: "server-management",
 		capScope: "system",
@@ -81703,6 +82220,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"serverManagement.setLaunchOverrides": {
+		capName: "server-management",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"settingsStore.aggregate": {
 		capName: "settings-store",
 		capScope: "system",
@@ -85763,6 +86287,100 @@ var APPLIANCE_CAP_VOCABULARY = {
 			}
 		]
 	},
+	"pet-fountain": {
+		scope: "device",
+		noun: t("Pet fountain", "Fontana per animali"),
+		actions: [
+			{
+				id: "petFountain.pumpOn",
+				method: "setPump",
+				label: t("Pump on", "Pompa accesa"),
+				phrase: t("Start the pump of {device}", "Avvia la pompa di {device}"),
+				icon: "play",
+				args: { on: true }
+			},
+			{
+				id: "petFountain.pumpOff",
+				method: "setPump",
+				label: t("Pump off", "Pompa spenta"),
+				phrase: t("Stop the pump of {device}", "Ferma la pompa di {device}"),
+				icon: "square",
+				args: { on: false }
+			},
+			{
+				id: "petFountain.intervalOn",
+				method: "setPumpInterval",
+				label: t("Pump cycle on", "Ciclo pompa attivo"),
+				phrase: t("Run the pump of {device} on its on/off cycle", "Fai lavorare la pompa di {device} a ciclo acceso/spento"),
+				icon: "timer",
+				args: { on: true }
+			},
+			{
+				id: "petFountain.intervalOff",
+				method: "setPumpInterval",
+				label: t("Pump cycle off", "Ciclo pompa spento"),
+				phrase: t("Run the pump of {device} continuously", "Fai lavorare la pompa di {device} in continuo"),
+				icon: "timer-off",
+				args: { on: false }
+			},
+			{
+				id: "petFountain.pumpOnMinutes",
+				method: "setPumpOnMinutes",
+				label: t("Set pump run time", "Imposta il tempo di lavoro della pompa"),
+				phrase: t("Set the pump of {device} to run {minutes} minutes per cycle", "Imposta la pompa di {device} a lavorare {minutes} minuti per ciclo"),
+				icon: "timer",
+				openArgs: [{
+					key: "minutes",
+					label: t("Minutes", "Minuti"),
+					offer: {
+						kind: "number",
+						min: 0,
+						step: 1,
+						unit: "min"
+					}
+				}]
+			},
+			{
+				id: "petFountain.pumpOffMinutes",
+				method: "setPumpOffMinutes",
+				label: t("Set pump rest time", "Imposta il tempo di riposo della pompa"),
+				phrase: t("Set the pump of {device} to rest {minutes} minutes per cycle", "Imposta la pompa di {device} a riposare {minutes} minuti per ciclo"),
+				icon: "timer-off",
+				openArgs: [{
+					key: "minutes",
+					label: t("Minutes", "Minuti"),
+					offer: {
+						kind: "number",
+						min: 0,
+						step: 1,
+						unit: "min"
+					}
+				}]
+			},
+			{
+				id: "petFountain.resetDailyConsumption",
+				method: "resetDailyConsumption",
+				label: t("Clear daily consumption", "Azzera il consumo giornaliero"),
+				phrase: t("Clear the daily water consumption of {device}", "Azzera il consumo giornaliero di acqua di {device}"),
+				icon: "rotate-ccw"
+			}
+		],
+		state: [{
+			kind: "boolean",
+			field: "empty",
+			label: t("Tank empty", "Serbatoio vuoto"),
+			whenTrue: t("When the tank of {device} is empty", "Quando il serbatoio di {device} è vuoto"),
+			whenFalse: t("When the tank of {device} is refilled", "Quando il serbatoio di {device} viene riempito"),
+			icon: "droplet"
+		}, {
+			kind: "numeric",
+			field: "waterLevel",
+			quantity: t("the water level", "il livello dell’acqua"),
+			label: t("Water level", "Livello dell’acqua"),
+			unit: "%",
+			icon: "droplets"
+		}]
+	},
 	"media-player": {
 		scope: "device",
 		noun: t("Media player", "Lettore multimediale"),
@@ -87587,6 +88205,7 @@ var SYSTEM_CAP_VOCABULARY = {
 	"device-manager": system("the device registry itself — rename, move and remove are administration"),
 	"device-provider": system(INTERNAL),
 	"device-removal-hook": system(INTERNAL),
+	"node-removal-hook": system(INTERNAL),
 	"device-state": system("the runtime-state mirror every trigger already reads through"),
 	"display-palette": system("the cluster display palette — one colour table for every client, not a device action"),
 	"embedding-encoder": system(ML),
@@ -87699,7 +88318,7 @@ function projectAction(cap, action) {
 	};
 }
 Object.entries(CAP_VOCABULARY_BY_NAME).flatMap(([cap, entry]) => entry.scope === "device" ? (entry.actions ?? []).map((a) => projectAction(cap, a)) : []);
-DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer;
+DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.PetFountain, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer;
 DeviceFeature.BatteryOperated;
 /**
 * How a washer, dryer or dishwasher leaves CamStack.
@@ -89261,6 +89880,36 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"petFountain.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFountain.resetDailyConsumption": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFountain.setPump": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFountain.setPumpInterval": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFountain.setPumpOffMinutes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFountain.setPumpOnMinutes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.addRetrainFrameFromRecording": [{
 		name: "deviceId",
 		form: "single",
@@ -92268,4 +92917,4 @@ object({
 	commands: record(string(), unknown())
 });
 //#endregion
-export { lawnMowerControlCapability as $, union as $t, buttonCapability as A, weatherCapability as At, coverCapability as B, defineRecordKinds as Bt, batteryCapability as C, tryConvertDelta as Ct, brokerCapability as D, valveCapability as Dt, brightnessCapability as E, vacuumControlCapability as Et, connectivityCapability as F, BaseAddon as Ft, eventEmitterCapability as G, array as Gt, deviceAdoptionCapability as H, isReadingQuantity as Ht, consumableFormOf as I, RecordSecretUnavailableError as It, gasCapability as J, literal as Jt, fanControlCapability as K, boolean as Kt, consumableKindOf as L, baseUnitOf as Lt, carbonMonoxideCapability as M, DeviceRole as Mt, climateControlCapability as N, DeviceType as Nt, buildAddonRouteProvider as O, vibrationCapability as Ot, colorCapability as P, errMsg as Pt, ingestReading as Q, string as Qt, contactCapability as R, createEvent as Rt, automationControlCapability as S, temperatureSensorCapability as St, binaryCapability as T, updateCapability as Tt, deviceExportCapability as U, nodePin as Ut, deviceAdminLinkCapability as V, entryBody as Vt, enumSensorCapability as W, _enum as Wt, humiditySensorCapability as X, object as Xt, humidifierCapability as Y, number as Yt, imageCapability as Z, record as Zt, accessoriesCapability as _, runningStateCapability as _t, COCO_TO_MACRO as a, notifierCapability as at, alarmPanelCapability as b, switchCapability as bt, ConsumableItemSchema as c, parseAdminBase as ct, FanDirectionSchema as d, presenceCapability as dt, unknown as en, lockControlCapability as et, HvacModeSchema as f, pressureSensorCapability as ft, TargetSchema as g, runningFromVacuumState as gt, RUNNING_STATE_COLD as h, runningFromMediaPlayer as ht, CAMERA_SWITCH_ORDER as i, notificationOutputCapability as it, calendarSourceCapability as j, DeviceFeature as jt, buildDeviceAdminUrl as k, waterHeaterCapability as kt, ConsumableStatusSchema as l, powerMeterCapability as lt, PLUG_APPLIANCE_TYPES as m, runningFromLawnMower as mt, BaseDevice as n, EventCategory as nn, motionCapability as nt, CameraSwitchIdSchema as o, numericSensorCapability as ot, MediaPlayerRepeatSchema as p, quantityFromUnit as pt, floodCapability as q, discriminatedUnion as qt, BaseDeviceProvider as r, normalizeUnit as rt, ConsumableFormSchema as s, oauthIntegrationCapability as st, AlarmArmModeSchema as t, url as tn, mediaPlayerCapability as tt, EnumSensorDateTimeFormatSchema as u, prepareNotification as ut, addonRoutesCapability as v, scriptRunnerCapability as vt, bestLocationMatch as w, tryConvertUnit as wt, ambientLightSensorCapability as x, tamperCapability as xt, airQualitySensorCapability as y, smokeCapability as yt, controlCapability as z, defineEntryKind as zt };
+export { lawnMowerControlCapability as $, object as $t, buttonCapability as A, valveCapability as At, coverCapability as B, baseUnitOf as Bt, batteryCapability as C, switchCapability as Ct, brokerCapability as D, tryConvertUnit as Dt, brightnessCapability as E, tryConvertDelta as Et, connectivityCapability as F, DeviceRole as Ft, eventEmitterCapability as G, isReadingQuantity as Gt, deviceAdoptionCapability as H, defineEntryKind as Ht, consumableFormOf as I, DeviceType as It, gasCapability as J, array as Jt, fanControlCapability as K, nodePin as Kt, consumableKindOf as L, errMsg as Lt, carbonMonoxideCapability as M, waterHeaterCapability as Mt, climateControlCapability as N, weatherCapability as Nt, buildAddonRouteProvider as O, updateCapability as Ot, colorCapability as P, DeviceFeature as Pt, ingestReading as Q, number as Qt, contactCapability as R, BaseAddon as Rt, automationControlCapability as S, smokeCapability as St, binaryCapability as T, temperatureSensorCapability as Tt, deviceExportCapability as U, defineRecordKinds as Ut, deviceAdminLinkCapability as V, createEvent as Vt, enumSensorCapability as W, entryBody as Wt, humiditySensorCapability as X, discriminatedUnion as Xt, humidifierCapability as Y, boolean as Yt, imageCapability as Z, literal as Zt, accessoriesCapability as _, runningFromMediaPlayer as _t, COCO_TO_MACRO as a, EventCategory as an, notifierCapability as at, alarmPanelCapability as b, scriptRunnerCapability as bt, ConsumableItemSchema as c, parseAdminBase as ct, FanDirectionSchema as d, presenceCapability as dt, record as en, lockControlCapability as et, HvacModeSchema as f, pressureSensorCapability as ft, TargetSchema as g, runningFromLawnMower as gt, RUNNING_STATE_COLD as h, runExportedAction as ht, CAMERA_SWITCH_ORDER as i, url as in, notificationOutputCapability as it, calendarSourceCapability as j, vibrationCapability as jt, buildDeviceAdminUrl as k, vacuumControlCapability as kt, ConsumableStatusSchema as l, powerMeterCapability as lt, PLUG_APPLIANCE_TYPES as m, quantityFromUnit as mt, BaseDevice as n, union as nn, motionCapability as nt, CameraSwitchIdSchema as o, numericSensorCapability as ot, MediaPlayerRepeatSchema as p, pruneDeletedEntities as pt, floodCapability as q, _enum as qt, BaseDeviceProvider as r, unknown as rn, normalizeUnit as rt, ConsumableFormSchema as s, oauthIntegrationCapability as st, AlarmArmModeSchema as t, string as tn, mediaPlayerCapability as tt, EnumSensorDateTimeFormatSchema as u, prepareNotification as ut, addonRoutesCapability as v, runningFromVacuumState as vt, bestLocationMatch as w, tamperCapability as wt, ambientLightSensorCapability as x, sendToExportedTarget as xt, airQualitySensorCapability as y, runningStateCapability as yt, controlCapability as z, RecordSecretUnavailableError as zt };