@camstack/types 1.2.442 → 1.2.444

package/dist/index.js

@@ -1,9 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-BpwNJ1Su.js");
+const require_sleep = require("./sleep-UXDHn-oJ.js");
 const require_event_category = require("./event-category-E17zaHjN.js");
-const require_composition = require("./composition-C0dlyG9U.js");
+const require_composition = require("./composition-CO6Sak-s.js");
 const require_node_color = require("./node-color.js");
-const require_err_msg = require("./err-msg-COHgq7Mb.js");
+const require_err_msg = require("./err-msg-EJhsFHqa.js");
 const require_enums = require("./enums.js");
 let zod = require("zod");
 //#region src/media/media-owner-key.ts
@@ -10705,6 +10705,593 @@ function buildActionSteps(steps, vars, deps) {
 	});
 }
 //#endregion
+//#region src/capabilities/notification-output.cap.ts
+/**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = zod.z.enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = zod.z.object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: zod.z.string().optional(),
+	bytes: zod.z.instanceof(Uint8Array).optional(),
+	mime: zod.z.string().optional(),
+	name: zod.z.string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = zod.z.enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/**
+* The CLOSED icon vocabulary an action button may use.
+*
+* A closed set, not a free string, and that is the whole point: an arbitrary
+* icon name is one that ntfy renders, zentik silently drops, and nobody
+* notices — the same class of gap as a zone vocabulary nothing produced
+* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
+* declares `actionIcons: false` and the degrade engine strips the field.
+*
+* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
+* renderer's icon set; "acknowledge" survives an adapter that draws it
+* differently.
+*
+* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
+*
+* These names are for US. **No adapter may forward one verbatim.** Each maps
+* the whole set onto its own renderer's vocabulary through a
+* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
+* fallback, so adding a member here fails every adapter's build until someone
+* decides its glyph, which is the only place that decision can be made
+* honestly.
+*
+* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
+* `disarm` straight through; iOS feeds that string to
+* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
+* and every snooze and alarm button arrived BLANK. A pass-through is not a
+* mapping, and "the field is documented" is not "the value renders".
+*
+* Adding a member is TRAIN-BOUND. The enum lives in the published
+* `@camstack/server` closure and the cap seam validates against the HUB's copy,
+* so an addon that emits a token the running hub does not know does not lose an
+* icon — its whole `send` fails Zod validation and the notification never
+* arrives. Never emit a new token from an addon before the train carrying it.
+*/
+var NotificationActionIconSchema = zod.z.enum([
+	"acknowledge",
+	"dismiss",
+	"silence",
+	"snooze",
+	"view",
+	"play",
+	"open",
+	"close",
+	"lock",
+	"unlock",
+	"arm",
+	"arm-home",
+	"arm-away",
+	"arm-night",
+	"disarm",
+	"light",
+	"alert",
+	"camera"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	url: zod.z.string().optional(),
+	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
+	icon: NotificationActionIconSchema.optional(),
+	/**
+	* Renders in a warning style where the notifier supports it.
+	*
+	* A HINT, never a gate. The callback's authority is its token and nothing
+	* else — see `notification-center/action-token.ts` for what that does and
+	* does not buy.
+	*/
+	destructive: zod.z.boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: zod.z.enum(["navigate", "background"]).optional()
+});
+/** A delivery parameter value: what a notifier declared it takes. */
+var DeliveryParamValueSchema = zod.z.union([
+	zod.z.string(),
+	zod.z.number(),
+	zod.z.boolean()
+]);
+/**
+* One extra delivery parameter a notifier KIND declares (D938). A rule that
+* addresses a target of that kind may set it; a kind that declares nothing is
+* never handed one. The admin UI derives its control from this descriptor —
+* no editor knows a service by name.
+*
+* Optional fields are `.optional()`, never `.default()` (a Zod default does not
+* run on the addon cap path).
+*/
+var DeliveryParamSchema = zod.z.object({
+	key: zod.z.string().min(1),
+	label: zod.z.string(),
+	/** i18n key of the label, resolved by the declaring addon's namespace. */
+	labelKey: zod.z.string().optional(),
+	type: zod.z.enum([
+		"enum",
+		"number",
+		"boolean",
+		"string"
+	]),
+	/** `enum` only: the closed set of accepted values. */
+	options: zod.z.array(zod.z.object({
+		value: zod.z.string(),
+		label: zod.z.string()
+	})).optional(),
+	/** `number` only. */
+	min: zod.z.number().optional(),
+	max: zod.z.number().optional(),
+	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
+	default: DeliveryParamValueSchema.optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = zod.z.object({
+	body: zod.z.string(),
+	title: zod.z.string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: zod.z.number().int().min(1).max(5).default(3),
+	level: zod.z.string().optional(),
+	attachments: zod.z.array(AttachmentSchema).optional(),
+	clickUrl: zod.z.string().optional(),
+	actions: zod.z.array(NotificationActionSchema).optional(),
+	sound: zod.z.string().optional(),
+	ttl: zod.z.number().optional(),
+	tag: zod.z.string().optional(),
+	deviceId: zod.z.number().optional(),
+	eventId: zod.z.string().optional(),
+	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+	/**
+	* Values for the parameters the target's kind DECLARES in
+	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
+	* declaration by the sender; a notifier reads only the keys it declared.
+	*/
+	delivery: zod.z.record(zod.z.string(), DeliveryParamValueSchema).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: zod.z.number().int().min(1).max(5).nullable(),
+	flags: zod.z.object({
+		critical: zod.z.boolean().optional(),
+		silent: zod.z.boolean().optional(),
+		noPush: zod.z.boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: zod.z.array(zod.z.string()).optional(),
+	description: zod.z.string().optional()
+});
+/** Attachment capabilities for a kind (drives the degrade engine + test panel). */
+var TargetKindAttachmentsCapsSchema = zod.z.object({
+	mediaTypes: zod.z.array(AttachmentMediaTypeSchema),
+	mode: zod.z.enum([
+		"url",
+		"bytes",
+		"both"
+	]),
+	max: zod.z.number().int().nonnegative(),
+	maxBytes: zod.z.number().int().positive().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = zod.z.object({
+	attachments: TargetKindAttachmentsCapsSchema,
+	/** Max action buttons (0 = none). */
+	actions: zod.z.number().int().nonnegative(),
+	/**
+	* Whether this kind renders a per-action ICON.
+	*
+	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
+	* run on the addon cap path — three production failures in one day taught
+	* this repo that once. Absent is read as false by the degrade engine, which
+	* is the safe direction: an icon that is not rendered costs nothing, an icon
+	* assumed and dropped costs the operator's trust in the field.
+	*/
+	actionIcons: zod.z.boolean().optional(),
+	levels: zod.z.array(TargetKindLevelSchema),
+	format: zod.z.array(NotificationFormatSchema),
+	clickUrl: zod.z.boolean(),
+	sound: zod.z.boolean(),
+	ttl: zod.z.boolean(),
+	bodyMaxLen: zod.z.number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough$3 = zod.z.unknown();
+var TargetKindSchema = zod.z.object({
+	kind: zod.z.string(),
+	label: zod.z.string(),
+	icon: zod.z.string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: zod.z.string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: zod.z.string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: zod.z.string().optional(),
+	configSchema: ConfigSchemaPassthrough$3,
+	/**
+	* The config keys that decide WHERE this kind's secrets are sent (server,
+	* base URL, instance, chat, recipient). A save that changes any of them
+	* while leaving a secret redacted is refused by the provider (D634), so an
+	* editor uses this to ask for the secret on exactly those edits instead of
+	* on every edit.
+	*
+	* Optional: absent from a provider that holds no secret (the Home Assistant
+	* kinds) and from a provider older than this field — an editor that finds
+	* it absent must assume ANY edit may need the secret.
+	*/
+	destinationKeys: zod.z.array(zod.z.string()).optional(),
+	supportsDiscovery: zod.z.boolean(),
+	/**
+	* Extra delivery parameters a rule may set for a target of this kind (D938).
+	* Absent = none; the rule editor then offers nothing.
+	*/
+	deliveryParams: zod.z.array(DeliveryParamSchema).optional(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	kind: zod.z.string(),
+	addonId: zod.z.string(),
+	enabled: zod.z.boolean(),
+	config: zod.z.record(zod.z.string(), zod.z.unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = zod.z.object({
+	kind: zod.z.string(),
+	suggestedName: zod.z.string(),
+	config: zod.z.record(zod.z.string(), zod.z.unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = zod.z.object({
+	level: zod.z.string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: zod.z.number().int().nonnegative(),
+	actionsSent: zod.z.number().int().nonnegative(),
+	truncated: zod.z.boolean(),
+	dropped: zod.z.array(zod.z.string())
+});
+var SendResultSchema = zod.z.object({
+	success: zod.z.boolean(),
+	error: zod.z.string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+/**
+* Pre-save credential probe against a partial (unsaved) target config.
+* `resolvedUrl` never includes secrets (token stripped from path).
+*/
+var ProbeTargetConfigResultSchema = zod.z.object({
+	ok: zod.z.boolean(),
+	resolvedUrl: zod.z.string(),
+	httpStatus: zod.z.number().int().optional(),
+	stateInstance: zod.z.string().optional(),
+	error: zod.z.string().optional()
+});
+var notificationOutputCapability = {
+	name: "notification-output",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		listTargetKinds: require_sleep.method(zod.z.object({}), zod.z.array(TargetKindSchema)),
+		listTargets: require_sleep.method(zod.z.object({}), zod.z.array(TargetSchema), { auth: "admin" }),
+		/**
+		* One target WITH secrets — admin edit / duplicate hydration only.
+		* `listTargets` stays redacted; the editor loads this so password fields
+		* are filled (masked in the input) and a save can round-trip the token
+		* when a destination changes (Duplicate with a new chatId, etc.).
+		*/
+		getTarget: require_sleep.method(zod.z.object({ targetId: zod.z.string() }), TargetSchema, { auth: "admin" }),
+		discoverTargets: require_sleep.method(zod.z.object({
+			kind: zod.z.string(),
+			config: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+			/**
+			* When editing / duplicating, the blank password field never round-trips
+			* the stored token. Pass the source target id so the provider can restore
+			* secrets server-side before dialling (same merge as upsert).
+			*/
+			targetId: zod.z.string().optional()
+		}), zod.z.array(DiscoveredTargetSchema), { auth: "admin" }),
+		probeTargetConfig: require_sleep.method(zod.z.object({
+			kind: zod.z.string(),
+			config: zod.z.record(zod.z.string(), zod.z.unknown()),
+			/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
+			targetId: zod.z.string().optional()
+		}), ProbeTargetConfigResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		send: require_sleep.method(zod.z.object({
+			targetId: zod.z.string(),
+			notification: NotificationSchema
+		}), SendResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		testTarget: require_sleep.method(zod.z.object({
+			targetId: zod.z.string(),
+			sample: NotificationSchema.optional()
+		}), TestResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		upsertTarget: require_sleep.method(zod.z.object({
+			target: TargetSchema,
+			/**
+			* Duplicate flow: create a NEW target id while copying secrets from an
+			* existing row. The UI never holds the stored token; blank / redacted
+			* password fields are restored from this source (D634 still applies if
+			* destinations diverge without a re-typed secret).
+			*/
+			cloneSecretsFrom: zod.z.string().optional()
+		}), TargetSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteTarget: require_sleep.method(zod.z.object({ targetId: zod.z.string() }), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setTargetEnabled: require_sleep.method(zod.z.object({
+			targetId: zod.z.string(),
+			enabled: zod.z.boolean()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+//#endregion
+//#region src/automation/export-entities.ts
+function errorText(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+/** `actions.run` flattens a refusal to `[code] text`; the code leads. */
+function refusalFromThrown(message) {
+	if (message.startsWith("[busy]")) return "already-running";
+	if (message.startsWith("[not-found]")) return "not-found";
+	return null;
+}
+async function runExportedAction(api, log, input) {
+	const { exporter, actionId } = input;
+	const tags = { actionId };
+	const refuse = (reason, detail) => {
+		log.warn(`${exporter}: exported action not run — ${reason}`, {
+			tags,
+			meta: {
+				reason,
+				...detail ? { detail } : {}
+			}
+		});
+		return {
+			status: "refused",
+			reason
+		};
+	};
+	try {
+		const result = await api.actions.run.mutate({ actionId });
+		if (result.outcome === "skipped-overlap") return refuse("already-running", result.message);
+		if (result.outcome === "skipped-cooldown") return refuse("cooldown", result.message);
+		if (result.outcome === "failed" || result.outcome === "aborted") {
+			const message = result.message ?? result.outcome;
+			log.warn(`${exporter}: exported action failed`, {
+				tags,
+				meta: {
+					outcome: result.outcome,
+					message
+				}
+			});
+			return {
+				status: "failed",
+				message
+			};
+		}
+		log.info(`${exporter}: exported action ran`, {
+			tags,
+			meta: { outcome: result.outcome }
+		});
+		return { status: "started" };
+	} catch (err) {
+		const message = errorText(err);
+		const reason = refusalFromThrown(message);
+		if (reason !== null) return refuse(reason, message);
+		log.warn(`${exporter}: exported action failed`, {
+			tags,
+			meta: { message }
+		});
+		return {
+			status: "failed",
+			message
+		};
+	}
+}
+/** Send through one CamStack notification target on behalf of an exporter. */
+async function sendToExportedTarget(api, log, input) {
+	const { exporter, targetId } = input;
+	const tags = { targetId };
+	try {
+		const target = (await api.notificationOutput.listTargets.query({})).find((t) => t.id === targetId);
+		if (target === void 0) {
+			log.warn(`${exporter}: exported notifier not used — target-gone`, {
+				tags,
+				meta: { reason: "target-gone" }
+			});
+			return {
+				status: "refused",
+				reason: "target-gone"
+			};
+		}
+		if (!target.enabled) {
+			log.warn(`${exporter}: exported notifier not used — target-disabled`, {
+				tags,
+				meta: { reason: "target-disabled" }
+			});
+			return {
+				status: "refused",
+				reason: "target-disabled"
+			};
+		}
+		const result = await api.notificationOutput.send.mutate({
+			targetId,
+			addonId: target.addonId,
+			notification: NotificationSchema.parse(input.notification)
+		});
+		if (!result.success) {
+			const message = result.error ?? "send failed";
+			log.warn(`${exporter}: exported notifier send failed`, {
+				tags,
+				meta: { message }
+			});
+			return {
+				status: "failed",
+				message
+			};
+		}
+		return { status: "sent" };
+	} catch (err) {
+		const message = errorText(err);
+		log.warn(`${exporter}: exported notifier send failed`, {
+			tags,
+			meta: { message }
+		});
+		return {
+			status: "failed",
+			message
+		};
+	}
+}
+/**
+* Split an exporter's selection into what still exists and what was deleted.
+* Devices are never judged here (their lifecycle is the tombstone, D865).
+* Callers pass ids from a query that ANSWERED — an unanswered list must not
+* reach this function (D49: a failed read changes nothing).
+*/
+function pruneDeletedEntities(selection, live, log, exporter) {
+	const kept = [];
+	const dropped = [];
+	for (const ref of selection) if (ref.kind === "action" && !live.actionIds.has(ref.actionId)) {
+		dropped.push(ref);
+		log.warn(`${exporter}: exported action was deleted — dropped from the export`, { tags: { actionId: ref.actionId } });
+	} else if (ref.kind === "notifier" && !live.targetIds.has(ref.targetId)) {
+		dropped.push(ref);
+		log.warn(`${exporter}: exported notifier target was deleted — dropped from the export`, { tags: { targetId: ref.targetId } });
+	} else kept.push(ref);
+	return {
+		kept,
+		dropped
+	};
+}
+//#endregion
 //#region src/capabilities/addon-pages.cap.ts
 /**
 * `addon-pages` — system-scoped singleton aggregator cap. Public-facing
@@ -10744,71 +11331,6 @@ var addonPagesCapability = {
 	methods: { listPages: require_sleep.method(zod.z.void(), zod.z.array(AddonPageInfoSchema).readonly()) }
 };
 //#endregion
-//#region src/capabilities/addon-pages-source.cap.ts
-/**
-* `addon-pages-source` — collection cap exposing per-provider raw page
-* declarations. Every addon that contributes a UI page registers a
-* provider here. The hub-side singleton aggregator (`addon-pages` cap,
-* see `addon-pages.cap.ts`) walks this collection, stamps versioned
-* `bundleUrl` values, and returns the enriched `AddonPageInfo[]` list
-* that admin-ui consumes.
-*
-* The split exists because the public listing has a different output
-* shape than the per-provider raw declarations, and we want both ends
-* to flow through codegen instead of relying on a hand-written wrapper.
-*/
-var AddonPageDeclarationSchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	icon: zod.z.string(),
-	path: zod.z.string(),
-	/**
-	* Module Federation remote name — must match the `name` field on the
-	* page addon's `federation()` plugin config. Used by admin-ui's
-	* `<AddonPageLoader>` to call `loadRemote('<remoteName>/page')`.
-	* Conventionally `addon_<id>_page` (snake_case; MF names cannot
-	* contain hyphens).
-	*/
-	remoteName: zod.z.string(),
-	/**
-	* Bundle filename inside the addon's `dist/` dir served at
-	* `/api/addon-pages/<addonId>/<bundle>`. With Module Federation this
-	* is always `'remoteEntry.js'`; the value is kept on the metadata so
-	* the static-file route can compute an mtime-based cache-buster URL
-	* without a separate filesystem stat.
-	*/
-	bundle: zod.z.string(),
-	/**
-	* Sidebar section this page docks into. Well-known ids: `'detection'`,
-	* `'cluster'`, `'administration'` — the page renders inside that group.
-	* Any OTHER string creates (or joins) a custom section rendered after
-	* the built-in groups; its label comes from `sectionLabel` (first
-	* declaration wins), falling back to the id. Absent → the legacy
-	* "Addon Pages" group.
-	*/
-	section: zod.z.string().optional(),
-	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
-	sectionLabel: zod.z.string().optional()
-});
-var addonPagesSourceCapability = {
-	name: "addon-pages-source",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: { 
-	/**
-	* `internal: true` did not gate the mount (see the 2026-08-26 note on
-	* `data-store-provider`) — this was reachable on the AppRouter by ANY
-	* authenticated session at the default `auth: 'protected'`. The only
-	* consumer, the `addon-pages-aggregator` builtin, reads it via
-	* `ctx.capabilities.getCollection('addon-pages-source')` — LOCAL-PROCESS
-	* only, never tRPC (per `ctx.capabilities` seeing only the local
-	* process). The public, enriched listing admin-ui actually consumes is
-	* the separate `addon-pages` cap, unaffected by this change.
-	*/
-listPages: require_sleep.method(zod.z.void(), zod.z.array(AddonPageDeclarationSchema).readonly(), { auth: "admin" }) }
-};
-//#endregion
 //#region src/capabilities/addon-routes.cap.ts
 var AddonHttpRouteSchema = zod.z.object({
 	method: zod.z.enum([
@@ -14915,7 +15437,11 @@ var CompositionProblemCodeSchema = zod.z.enum([
 	"mixed-quantity",
 	"helper-mismatch",
 	"member-constraint",
-	"retention"
+	"retention",
+	"command-method-unknown",
+	"command-source-unknown",
+	"command-input-unknown",
+	"command-input-missing"
 ]);
 /** One refusal, named (D391). `path` points into the composition, e.g. `features[0].fields.temperature`. */
 var CompositionProblemSchema = zod.z.object({
@@ -14957,7 +15483,9 @@ var CompositionFieldRoleSchema = zod.z.enum([
 var CompositionFieldItemSchema = zod.z.object({
 	arrayPath: zod.z.string(),
 	key: zod.z.string(),
-	label: zod.z.string()
+	label: zod.z.string(),
+	/** True when the item carries a `reset` forward: the composer writes `resettable` from this (D967). */
+	resettable: zod.z.boolean().optional()
 });
 var CompositionFieldPlanSchema = zod.z.object({
 	cap: zod.z.string(),
@@ -15478,7 +16006,7 @@ function unavailableFor(tf, role, mode, cap, at) {
 }
 //#endregion
 //#region src/composition/composition-items.ts
-/** Item fields the composer writes itself, with the value it writes. */
+/** Item fields the composer writes itself, with the value it writes. `resettable` is the default: an item with a `reset` forward writes `true` (D967). */
 var COMPOSED_ITEM_FIXED_FIELDS = { resettable: false };
 function reservedItemFields(itemArray) {
 	return new Set([
@@ -15521,7 +16049,8 @@ function planItemField(ctx, leaf) {
 		item: {
 			arrayPath: itemArray.path,
 			key,
-			label
+			label,
+			...leaf.resettable ? { resettable: true } : {}
 		},
 		featureIndex,
 		kind: tf.kind,
@@ -15561,6 +16090,7 @@ function planItems(def, feature, featureIndex, lookupCap, mode = "new") {
 	}, ...Object.entries(item.fields).map(([path, source]) => planItemField(ctx, {
 		key,
 		label: item.label,
+		resettable: item.reset !== void 0,
 		path,
 		source
 	}))]);
@@ -15572,12 +16102,163 @@ function planItems(def, feature, featureIndex, lookupCap, mode = "new") {
 	};
 }
 //#endregion
+//#region src/composition/validate-forward.ts
+/**
+* Save-time validation of `forward` commands (D659, amended by D967).
+*
+* A BUILT capability serves a method only through a command, so every method
+* the cap serves needs one. A forward is checked against the two input schemas
+* it joins: the BUILT method's (what the caller sends) and the SOURCE method's
+* (what is called). An input field in neither place is refused BY NAME, and so
+* is a required source input nothing provides. `deviceId` is the source's own
+* and is never an argument.
+*
+* Static: it needs only the capability definitions. That the source DEVICE
+* exists and binds the cap is `forwardSourceProblems`, with the sources read.
+*/
+var DEVICE_ID_FIELD = "deviceId";
+/** Every forward of a feature: the method commands, then each item's `reset`. */
+function featureForwards(feature, featureIndex) {
+	const at = `features[${featureIndex}]`;
+	const commands = Object.entries(feature.commands ?? {}).flatMap(([method, target]) => target.kind === "forward" ? [{
+		at: `${at}.commands.${method}`,
+		method,
+		command: target
+	}] : []);
+	const resets = Object.entries(feature.items ?? {}).flatMap(([key, item]) => item.reset === void 0 ? [] : [{
+		at: `${at}.items.${key}.reset`,
+		method: "reset",
+		itemKey: key,
+		command: item.reset
+	}]);
+	return [...commands, ...resets];
+}
+/** Every source a forward of an enabled feature calls, once. */
+function forwardSourceRefs(composition) {
+	const refs = composition.features.flatMap((feature, index) => feature.kind === "fields" && require_composition.compositionFeatureEnabled(feature) ? featureForwards(feature, index).map((forward) => forward.command.source) : []);
+	return [...new Map(refs.map((ref) => [require_composition.compositionSourceKey(ref), ref])).values()];
+}
+/** The methods a BUILT cap must give a command: served, and not answered by the composer itself. */
+function commandedMethods(def) {
+	return Object.entries(def.methods).filter(([name, m]) => m.systemOnly !== true && def.composedMethods?.[name] === void 0).map(([name]) => name);
+}
+var NO_INPUT = {
+	all: /* @__PURE__ */ new Set(),
+	required: /* @__PURE__ */ new Set()
+};
+/** The top-level input fields of a method, `deviceId` removed; null when the input is not an object. */
+function inputFields(def, method) {
+	const input = def.methods[method]?.input;
+	if (input === void 0) return null;
+	const root = unwrapSchema(input);
+	if (!(root instanceof zod.z.ZodObject)) return null;
+	const entries = Object.entries(root.shape).filter(([name]) => name !== DEVICE_ID_FIELD);
+	return {
+		all: new Set(entries.map(([name]) => name)),
+		required: new Set(entries.flatMap(([name, field]) => field instanceof zod.z.ZodType && !field.safeParse(void 0).success ? [name] : []))
+	};
+}
+function inputRefs(arg) {
+	if (typeof arg !== "object") return [];
+	if (require_composition.isForwardInputRef(arg)) return [arg.$input];
+	return Object.values(arg).flatMap(inputRefs);
+}
+function names(list) {
+	return [...list].map((name) => `\`${name}\``).join(", ");
+}
+function sourceMethodOf(forward, lookupCap) {
+	const { command, at } = forward;
+	const def = lookupCap(command.cap);
+	if (def === null) return {
+		def: null,
+		problems: [problem("command-source-unknown", `${at}.cap`, `no capability is named \`${command.cap}\``)]
+	};
+	const served = def.methods[command.method];
+	if (served === void 0 || served.systemOnly === true) return {
+		def: null,
+		problems: [problem("command-source-unknown", `${at}.method`, `\`${command.cap}\` has no method \`${command.method}\` to forward to`)]
+	};
+	if (served.kind !== "mutation") return {
+		def: null,
+		problems: [problem("command-source-unknown", `${at}.method`, `\`${command.cap}.${command.method}\` is a query — a command calls a mutation of the source`)]
+	};
+	return {
+		def,
+		problems: []
+	};
+}
+function mappedInputProblems(forward, built, source, args) {
+	const { at, command } = forward;
+	const where = `${command.cap}.${command.method}`;
+	const problems = [];
+	if ("deviceId" in args) problems.push(problem("command-input-unknown", `${at}.args.${DEVICE_ID_FIELD}`, `\`${DEVICE_ID_FIELD}\` is the source device's own — a forward never takes it as an argument`));
+	if (source !== null) {
+		for (const key of Object.keys(args).filter((k) => k !== "deviceId" && !source.all.has(k))) problems.push(problem("command-input-unknown", `${at}.args.${key}`, `\`${where}\` has no input field \`${key}\` (it takes ${names(source.all)})`));
+		const missing = [...source.required].filter((k) => !(k in args));
+		if (missing.length > 0) problems.push(problem("command-input-missing", `${at}.args`, `\`${where}\` needs ${names(missing)}, which \`args\` does not provide`));
+	}
+	const readable = forward.itemKey === void 0 ? built : NO_INPUT;
+	if (readable !== null) for (const ref of Object.values(args).flatMap(inputRefs)) {
+		if (readable.all.has(ref)) continue;
+		problems.push(problem("command-input-unknown", `${at}.args`, readable === NO_INPUT ? `an item's \`reset\` takes no input — \`$input: ${ref}\` has nothing to read` : `\`$input: ${ref}\` is not a field of the \`${forward.method}\` input (it takes ${names(readable.all)})`));
+	}
+	return problems;
+}
+function passthroughInputProblems(forward, built, source) {
+	const { at, command } = forward;
+	const where = `${command.cap}.${command.method}`;
+	const sent = forward.itemKey === void 0 ? built : NO_INPUT;
+	if (sent === null || source === null) return [];
+	const problems = [];
+	for (const field of [...sent.all].filter((f) => !source.all.has(f))) problems.push(problem("command-input-unknown", `${at}.args`, `\`${forward.method}\` takes \`${field}\`, which \`${where}\` does not (it takes ${names(source.all)}) — add \`args\` to map it`));
+	const missing = [...source.required].filter((k) => !sent.all.has(k));
+	if (missing.length > 0) problems.push(problem("command-input-missing", `${at}.args`, `\`${where}\` needs ${names(missing)}, which \`${forward.method}\` does not take — add \`args\` to provide it`));
+	return problems;
+}
+/** One forward against the built cap's method and the source cap's method. */
+function forwardProblems(built, forward, lookupCap) {
+	const source = sourceMethodOf(forward, lookupCap);
+	if (source.def === null) return source.problems;
+	const builtFields = inputFields(built, forward.method);
+	const sourceFields = inputFields(source.def, forward.command.method);
+	const mapping = forward.command.args;
+	return mapping === void 0 ? passthroughInputProblems(forward, builtFields, sourceFields) : mappedInputProblems(forward, builtFields, sourceFields, mapping);
+}
+/** A command must name a method the built cap serves and the composer does not answer itself. */
+function commandMethodProblems(built, feature, at) {
+	const commanded = new Set(commandedMethods(built));
+	return Object.keys(feature.commands ?? {}).flatMap((method) => {
+		if (commanded.has(method)) return [];
+		const answered = built.composedMethods?.[method] !== void 0;
+		return [problem("command-method-unknown", `${at}.commands.${method}`, answered ? `\`${built.name}.${method}\` is answered by the composer itself — an item's \`reset\` serves it` : `\`${built.name}\` has no method \`${method}\` to serve`)];
+	});
+}
+/**
+* The source DEVICES of the forwards, read: each must exist and bind the cap it
+* is called on. A forward onto an unread device is refused rather than stored
+* unchecked, like every other source (D391).
+*/
+function forwardSourceProblems(composition, sources) {
+	return composition.features.flatMap((feature, index) => {
+		if (feature.kind !== "fields" || !require_composition.compositionFeatureEnabled(feature)) return [];
+		return featureForwards(feature, index).flatMap((forward) => {
+			const key = require_composition.compositionSourceKey(forward.command.source);
+			const desc = sources.get(key);
+			const at = `${forward.at}.source`;
+			if (desc === void 0 || desc.kind === "unreadable") return [problem("source-unreadable", at, `could not read source \`${key}\` (${desc === void 0 ? "it was not read" : desc.error}) — the save is refused rather than stored unchecked`)];
+			if (desc.kind === "absent") return [problem("source-missing", at, `source \`${key}\` does not exist`)];
+			if (!desc.caps.has(forward.command.cap)) return [problem("source-capability-missing", at, `source \`${key}\` (device ${desc.deviceId}) has no \`${forward.command.cap}\``)];
+			return [];
+		});
+	});
+}
+//#endregion
 //#region src/composition/helpers/catalog.ts
 /**
 * One catalog row per base reading a group helper can build (D944 §3).
 * Data, not a form default written into the block.
 */
-var NOW$2 = {
+var NOW$3 = {
 	fieldPath: "lastFetchedAt",
 	expr: "now"
 };
@@ -15629,7 +16310,7 @@ var GROUP_TEMPLATES = [
 		quantity: "temperature",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2],
+		companions: [NOW$3],
 		alsoFrom: {
 			deviceTypes: CLIMATE_DEVICES,
 			accept: {
@@ -15647,7 +16328,7 @@ var GROUP_TEMPLATES = [
 		quantity: "humidity",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2],
+		companions: [NOW$3],
 		alsoFrom: {
 			deviceTypes: CLIMATE_DEVICES,
 			accept: {
@@ -15665,7 +16346,7 @@ var GROUP_TEMPLATES = [
 		quantity: "pressure",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2]
+		companions: [NOW$3]
 	}),
 	numeric({
 		id: "illuminance",
@@ -15676,7 +16357,7 @@ var GROUP_TEMPLATES = [
 		quantity: "illuminance",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2]
+		companions: [NOW$3]
 	}),
 	numeric({
 		id: "power",
@@ -15687,7 +16368,7 @@ var GROUP_TEMPLATES = [
 		quantity: "power",
 		defaultAggregate: "sum",
 		empty: "omit",
-		companions: [NOW$2]
+		companions: [NOW$3]
 	}),
 	numeric({
 		id: "energy",
@@ -15698,7 +16379,7 @@ var GROUP_TEMPLATES = [
 		quantity: "energy",
 		defaultAggregate: "sum",
 		empty: "omit",
-		companions: [NOW$2]
+		companions: [NOW$3]
 	}),
 	numeric({
 		id: "battery",
@@ -15733,7 +16414,7 @@ var GROUP_TEMPLATES = [
 		quantity: "device",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2]
+		companions: [NOW$3]
 	}),
 	binary({
 		id: "motion",
@@ -16159,7 +16840,7 @@ async function runFanOut(calls, invoke) {
 //#region src/generated/history-catalog.ts
 /**
 * Cap history catalog, projected from every `*.cap.ts` `history` block.
-* 41 caps with series (76 series), 34 caps answered `'none'`.
+* 42 caps with series (80 series), 34 caps answered `'none'`.
 * Field keys are `runtimeState` paths (`a.b` into fixed objects only).
 */
 var HISTORY_CATALOG = {
@@ -16399,6 +17080,25 @@ var HISTORY_CATALOG = {
 			unit: "s"
 		}
 	},
+	"pet-fountain": {
+		"waterLevel": {
+			kind: "gauge",
+			unit: "%",
+			deadband: 1
+		},
+		"waterVolume": {
+			kind: "gauge",
+			unit: "L"
+		},
+		"todayDrink": {
+			kind: "gauge",
+			unit: "L"
+		},
+		"last24hDrink": {
+			kind: "gauge",
+			unit: "L"
+		}
+	},
 	"power-meter": {
 		"power": {
 			kind: "gauge",
@@ -16596,7 +17296,7 @@ function historyFieldsFor(capName) {
 * Project a statistics or integral helper onto a new device (D944 §3).
 * The value field is `series`: the composer fills it from history.
 */
-var NOW$1 = {
+var NOW$2 = {
 	kind: "expression",
 	expr: "now",
 	bindings: {}
@@ -16656,7 +17356,7 @@ function draft(input) {
 			cap: input.cap,
 			fields: {
 				[input.field]: series(input.member, "value", input.empty),
-				lastFetchedAt: NOW$1
+				lastFetchedAt: NOW$2
 			}
 		}, {
 			kind: "fields",
@@ -16738,12 +17438,12 @@ function integralDraft(spec, retention = require_composition.DEFAULT_HISTORY_RET
 * a free expression is the expression engine unchanged — it still includes a
 * stale input, and the template says so.
 */
-var NOW = {
+var NOW$1 = {
 	kind: "expression",
 	expr: "now",
 	bindings: {}
 };
-function from$1(member) {
+function from$2(member) {
 	return {
 		kind: "from",
 		source: member.source,
@@ -16774,7 +17474,7 @@ function numericSensor(helper, value, extra = []) {
 			cap: "numeric-sensor",
 			fields: {
 				value,
-				lastFetchedAt: NOW
+				lastFetchedAt: NOW$1
 			}
 		}, ...extra]
 	};
@@ -16792,7 +17492,7 @@ function binarySensor(helper, on) {
 			cap: "binary",
 			fields: {
 				on,
-				lastChangedAt: NOW
+				lastChangedAt: NOW$1
 			}
 		}]
 	};
@@ -16810,7 +17510,7 @@ function thresholdDraft(spec) {
 	const delays = onFor !== null && offFor !== null && (spec.onForMs > 0 || spec.offForMs > 0) ? `, ${onFor}, ${offFor}` : "";
 	return {
 		problems,
-		draft: binarySensor(spec, expression$1(`coalesce(schmitt(x, ${high ?? "0"}, ${low ?? "0"}${delays}), false)`, { x: from$1(spec.source) }))
+		draft: binarySensor(spec, expression$1(`coalesce(schmitt(x, ${high ?? "0"}, ${low ?? "0"}${delays}), false)`, { x: from$2(spec.source) }))
 	};
 }
 var NAMES = ["a", "b"];
@@ -16854,7 +17554,7 @@ function arithmeticDraft(spec) {
 			}])
 		};
 	}
-	const bindings = Object.fromEntries(spec.inputs.slice(0, 2).map((input, index) => [NAMES[index] ?? "a", from$1(input)]));
+	const bindings = Object.fromEntries(spec.inputs.slice(0, 2).map((input, index) => [NAMES[index] ?? "a", from$2(input)]));
 	return {
 		problems,
 		draft: numericSensor(spec, expression$1(spec.op === "difference" ? "a - b" : "b == 0 ? null : a / b", bindings))
@@ -16870,7 +17570,7 @@ function expressionProblems(spec) {
 		seen.add(input.name);
 	});
 	if (problems.length > 0) return problems;
-	const bindings = Object.fromEntries(spec.inputs.map((input) => [input.name, from$1(input.member)]));
+	const bindings = Object.fromEntries(spec.inputs.map((input) => [input.name, from$2(input.member)]));
 	const message = require_composition.validateExpressionSource({
 		expr: spec.expr,
 		bindings
@@ -16879,7 +17579,7 @@ function expressionProblems(spec) {
 }
 function expressionDraft(spec) {
 	const problems = expressionProblems(spec);
-	const bindings = Object.fromEntries(spec.inputs.map((input) => [input.name, from$1(input.member)]));
+	const bindings = Object.fromEntries(spec.inputs.map((input) => [input.name, from$2(input.member)]));
 	const source = expression$1(spec.expr, bindings);
 	return {
 		problems,
@@ -17396,8 +18096,9 @@ function actuatorCommandCaps(composition) {
 function builtCapProblems({ def, state, fields: targetFields }, feature, at, deviceType, servedCommands) {
 	const problems = [];
 	if (def.deviceTypes !== void 0 && !def.deviceTypes.includes(deviceType)) problems.push(problem("wrong-device-type", `${at}.cap`, `\`${def.name}\` is not offered on a \`${deviceType}\` device (it allows ${def.deviceTypes.join(", ")})`));
-	const served = Object.entries(def.methods).filter(([name, m]) => m.systemOnly !== true && def.composedMethods?.[name] === void 0).map(([name]) => `\`${name}\``);
-	if (served.length > 0 && !servedCommands.has(def.name)) problems.push(problem("has-commands", `${at}.cap`, `\`${def.name}\` has ${served.join(", ")}, which a composed device cannot serve until commands arrive (slice 3)`));
+	const commanded = new Set(Object.entries(feature.commands ?? {}).flatMap(([name, target]) => target.kind === "forward" ? [name] : []));
+	const unserved = commandedMethods(def).filter((name) => !commanded.has(name)).map((name) => `\`${name}\``);
+	if (unserved.length > 0 && !servedCommands.has(def.name)) problems.push(problem("has-commands", `${at}.cap`, `\`${def.name}\` has ${unserved.join(", ")} with no command — a composed device serves a method only through a \`forward\` (D967)`));
 	const itemArrayPath = feature.items === void 0 ? null : def.status?.itemArray?.path ?? null;
 	for (const key of requiredTopLevelKeys(state)) {
 		if (key === itemArrayPath) continue;
@@ -17438,12 +18139,28 @@ function planTopLevelField({ def, fields }, field, mode, lookupCap) {
 		events: []
 	};
 }
+/**
+* The commands of a feature (D967). Only a BUILT capability on a NEW device
+* serves a method through a `forward`; on an existing device the native keeps
+* its methods, and a `code` command is slice 4.
+*/
+function commandProblems(def, feature, featureIndex, mode, lookupCap) {
+	const at = `features[${featureIndex}]`;
+	const forwards = featureForwards(feature, featureIndex);
+	const problems = Object.entries(feature.commands ?? {}).filter(([, t]) => t.kind === "code").map(([method]) => problem("reserved-variant", `${at}.commands.${method}`, "a `code` command arrives in slice 4"));
+	if (forwards.length > 0 && mode !== "new") return [...problems, problem("reserved-variant", `${at}.commands`, "commands (`forward`) are served only by a capability a NEW device builds — not on an existing device")];
+	return [
+		...problems,
+		...commandMethodProblems(def, feature, at),
+		...forwards.flatMap((forward) => forwardProblems(def, forward, lookupCap))
+	];
+}
 function planFeature(feature, featureIndex, target, lookupCap, servedCommands) {
 	const at = `features[${featureIndex}]`;
 	const cap = composableCap(feature, at, lookupCap);
 	if ("code" in cap) return refused(cap);
 	const capProblems = target.mode === "replace" ? [] : [...builtCapProblems(cap, feature, at, target.deviceType, servedCommands)];
-	if (feature.commands !== void 0 && Object.keys(feature.commands).length > 0) capProblems.push(problem("reserved-variant", `${at}.commands`, "commands (`forward`) arrive in slice 3"));
+	capProblems.push(...commandProblems(cap.def, feature, featureIndex, target.mode, lookupCap));
 	const perField = Object.entries(feature.fields).map(([path, source]) => planTopLevelField(cap, {
 		featureIndex,
 		path,
@@ -17562,7 +18279,7 @@ function planComposition(composition, lookupCap, target) {
 }
 function compositionSourceRefs(composition) {
 	const refs = composition.features.flatMap((f) => require_composition.compositionFeatureEnabled(f) && f.kind === "fields" ? require_composition.featureSources(f).flatMap(require_composition.fieldReads).map((r) => r.source) : []);
-	return [...new Map(refs.map((r) => [require_composition.compositionSourceKey(r), r])).values()];
+	return [...new Map([...refs, ...forwardSourceRefs(composition)].map((r) => [require_composition.compositionSourceKey(r), r])).values()];
 }
 /**
 * The candidate's device: the existing target itself, else `self`, else a
@@ -17698,6 +18415,7 @@ function validateComposition(composition, ctx) {
 	const problems = [
 		...plan.problems,
 		...sourceProblems(plan.fields, ctx, self),
+		...forwardSourceProblems(composition, ctx.sources),
 		...cycles,
 		...helperSaveProblems(composition, facts)
 	];
@@ -21058,6 +21776,36 @@ var ExposeInputSchema = zod.z.object({
 	capabilities: zod.z.array(zod.z.string()).optional()
 });
 var UnexposeInputSchema = zod.z.object({ deviceId: zod.z.string() });
+/**
+* What an exporter may expose besides devices (D968). An action and a
+* notification target are LIST ENTRIES, never devices (D954): they enter an
+* exporter's own selection, not the device registry.
+*/
+var ExportEntityKindSchema = zod.z.enum([
+	"device",
+	"action",
+	"notifier"
+]);
+var ExportEntityRefSchema = zod.z.discriminatedUnion("kind", [
+	zod.z.object({
+		kind: zod.z.literal("device"),
+		deviceId: zod.z.string()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("action"),
+		actionId: zod.z.string().min(1)
+	}),
+	zod.z.object({
+		kind: zod.z.literal("notifier"),
+		targetId: zod.z.string().min(1)
+	})
+]);
+var ExposedEntitySchema = zod.z.object({
+	entity: ExportEntityRefSchema,
+	exposedAs: zod.z.string().optional()
+});
+var ExposeEntityInputSchema = zod.z.object({ entity: ExportEntityRefSchema });
+var UnexposeEntityInputSchema = zod.z.object({ entity: ExportEntityRefSchema });
 var deviceExportCapability = {
 	name: "device-export",
 	scope: "system",
@@ -21087,6 +21835,16 @@ var deviceExportCapability = {
 		unexposeDevice: require_sleep.method(UnexposeInputSchema, zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
+		}),
+		listSupportedEntityKinds: require_sleep.optionalMethod(zod.z.void(), zod.z.array(ExportEntityKindSchema)),
+		listExposedEntities: require_sleep.optionalMethod(zod.z.void(), zod.z.array(ExposedEntitySchema)),
+		exposeEntity: require_sleep.optionalMethod(ExposeEntityInputSchema, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		unexposeEntity: require_sleep.optionalMethod(UnexposeEntityInputSchema, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
 		})
 	}
 };
@@ -43463,6 +44221,64 @@ var embeddingEncoderCapability = {
 	}
 };
 //#endregion
+//#region src/capabilities/node-removal-hook.cap.ts
+/**
+* `node-removal-hook` — the reliable way an addon learns a cluster node was
+* FORGOTTEN, so it can remove or re-point what it keeps for that node. The
+* node-scoped twin of `device-removal-hook` (D865); same shape, same rules.
+*
+* ## Why not "the node is absent"
+*
+* A node missing from topology is offline, restarting or not yet re-registered —
+* it is not forgotten. Deleting node-scoped data from absence destroys a live
+* node's configuration on any failed or partial read (D49). So the hook is
+* driven by a TOMBSTONE the hub records when the operator forgets a node
+* (`AgentRegistryService.forgetClusterNode`); nothing else produces one.
+*
+* ## The pieces
+*
+* 1. The hub records a tombstone `{ nodeId, removedAt, pending }` before it calls
+*    anyone. `pending` is the set of implementers that have not yet acknowledged.
+* 2. The hub calls `onNodeRemoved` on EVERY provider of this collection, one by
+*    one, with bounded retries, logged; an acknowledgement removes the
+*    implementer from `pending`.
+* 3. The hub re-drives still-pending tombstones at boot, so an implementer that
+*    was down at forget time is told when it is back.
+*
+* ## Contract for an implementer
+*
+* - **Idempotent.** Called again by a retry and by the boot re-drive. A node with
+*   nothing left answers zero counts.
+* - **One key per store** in `counts`, rows changed per store, so the log line
+*   can say where the data was.
+* - **Re-point or remove, never guess.** A row that merely MENTIONS the node as
+*   a preference is re-pointed to "unset"; a row that only means something on
+*   that node (a runtime bound to it) is removed.
+* - A provider that cannot tell is allowed to throw; the caller retries it.
+*/
+/** What a hook is told about the removal. */
+var NodeRemovedInputSchema = zod.z.object({
+	nodeId: zod.z.string().min(1),
+	/** Epoch ms the node was forgotten (the tombstone's `removedAt`). */
+	removedAt: zod.z.number()
+});
+/** Rows changed (removed or re-pointed), per store this implementer owns. */
+var NodeRemovedResultSchema = zod.z.object({ counts: zod.z.record(zod.z.string(), zod.z.number().int().nonnegative()) });
+var nodeRemovalHookCapability = {
+	name: "node-removal-hook",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { 
+	/** Remove or re-point everything this addon keeps for the forgotten node. Idempotent. */
+onNodeRemoved: require_sleep.method(NodeRemovedInputSchema, NodeRemovedResultSchema, {
+		kind: "mutation",
+		auth: "admin"
+	}) },
+	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
+	mount: { kind: "skip" }
+};
+//#endregion
 //#region src/capabilities/device-removal-hook.cap.ts
 /**
 * `device-removal-hook` — the reliable way an addon learns a device was DELETED,
@@ -44737,7 +45553,7 @@ var LlmProviderWidgetSchema = zod.z.object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$3 = zod.z.unknown();
+var ConfigSchemaPassthrough$2 = zod.z.unknown();
 var LlmProfileKindDescriptorSchema = zod.z.object({
 	kind: LlmProfileKindSchema,
 	label: zod.z.string(),
@@ -44746,9 +45562,9 @@ var LlmProfileKindDescriptorSchema = zod.z.object({
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: zod.z.string(),
 	/** The provider's own fields (`providerConfig`); `password` fields are keychain-held. */
-	connectionSchema: ConfigSchemaPassthrough$3,
+	connectionSchema: ConfigSchemaPassthrough$2,
 	/** Provider fields that belong under "Advanced" (extra headers, runtime tuning). */
-	advancedSchema: ConfigSchemaPassthrough$3.optional(),
+	advancedSchema: ConfigSchemaPassthrough$2.optional(),
 	/** The kind's defaults; a model from `listModels` may override any of them. */
 	features: LlmModelFeaturesSchema,
 	/** `false` = the provider stamps `supportsVision` itself (from what a node reports). */
@@ -45505,10 +46321,10 @@ var CpuBreakdownSchema = zod.z.object({
 	cores: zod.z.number()
 });
 var MemoryInfoSchema = zod.z.object({
-	percent: zod.z.number(),
+	percent: zod.z.number().nullable(),
 	totalBytes: zod.z.number(),
-	usedBytes: zod.z.number(),
-	availableBytes: zod.z.number(),
+	usedBytes: zod.z.number().nullable(),
+	availableBytes: zod.z.number().nullable(),
 	swapUsedBytes: zod.z.number(),
 	swapTotalBytes: zod.z.number()
 });
@@ -45812,8 +46628,9 @@ var GetLoadSeriesInputSchema = zod.z.object({
 });
 var SystemMetricsSchema = zod.z.object({
 	cpuPercent: zod.z.number(),
-	memoryPercent: zod.z.number(),
-	memoryUsedMB: zod.z.number(),
+	/** `null` when the memory sample failed or was not taken yet (D393). */
+	memoryPercent: zod.z.number().nullable(),
+	memoryUsedMB: zod.z.number().nullable(),
 	memoryTotalMB: zod.z.number(),
 	diskPercent: zod.z.number().optional(),
 	temperature: zod.z.number().optional(),
@@ -46215,453 +47032,6 @@ var networkAccessCapability = {
 	}
 };
 //#endregion
-//#region src/capabilities/notification-output.cap.ts
-/**
-* notification-output — canonical, capability-gated notification delivery.
-*
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
-*
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
-*
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = zod.z.enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = zod.z.object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: zod.z.string().optional(),
-	bytes: zod.z.instanceof(Uint8Array).optional(),
-	mime: zod.z.string().optional(),
-	name: zod.z.string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = zod.z.enum([
-	"text",
-	"markdown",
-	"html"
-]);
-/**
-* The CLOSED icon vocabulary an action button may use.
-*
-* A closed set, not a free string, and that is the whole point: an arbitrary
-* icon name is one that ntfy renders, zentik silently drops, and nobody
-* notices — the same class of gap as a zone vocabulary nothing produced
-* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
-* declares `actionIcons: false` and the degrade engine strips the field.
-*
-* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
-* renderer's icon set; "acknowledge" survives an adapter that draws it
-* differently.
-*
-* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
-*
-* These names are for US. **No adapter may forward one verbatim.** Each maps
-* the whole set onto its own renderer's vocabulary through a
-* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
-* fallback, so adding a member here fails every adapter's build until someone
-* decides its glyph, which is the only place that decision can be made
-* honestly.
-*
-* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
-* `disarm` straight through; iOS feeds that string to
-* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
-* and every snooze and alarm button arrived BLANK. A pass-through is not a
-* mapping, and "the field is documented" is not "the value renders".
-*
-* Adding a member is TRAIN-BOUND. The enum lives in the published
-* `@camstack/server` closure and the cap seam validates against the HUB's copy,
-* so an addon that emits a token the running hub does not know does not lose an
-* icon — its whole `send` fails Zod validation and the notification never
-* arrives. Never emit a new token from an addon before the train carrying it.
-*/
-var NotificationActionIconSchema = zod.z.enum([
-	"acknowledge",
-	"dismiss",
-	"silence",
-	"snooze",
-	"view",
-	"play",
-	"open",
-	"close",
-	"lock",
-	"unlock",
-	"arm",
-	"arm-home",
-	"arm-away",
-	"arm-night",
-	"disarm",
-	"light",
-	"alert",
-	"camera"
-]);
-/** A single tap-through action button. */
-var NotificationActionSchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	url: zod.z.string().optional(),
-	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
-	icon: NotificationActionIconSchema.optional(),
-	/**
-	* Renders in a warning style where the notifier supports it.
-	*
-	* A HINT, never a gate. The callback's authority is its token and nothing
-	* else — see `notification-center/action-token.ts` for what that does and
-	* does not buy.
-	*/
-	destructive: zod.z.boolean().optional(),
-	/**
-	* How the tap should REACH the url.
-	*
-	* `navigate` (absent, and every button authored before this field) opens it:
-	* the phone leaves the notification and shows whatever the callback returns.
-	* That is right for a button whose answer the operator wants to read.
-	*
-	* `background` fires it as a POST and stays put. It exists for the buttons
-	* whose whole point is not to interrupt — "silence this for 30 minutes" is
-	* an answer to the notification, and being thrown into a browser tab to
-	* confirm it costs more attention than the notification did. A backend that
-	* cannot do a background call renders it as an ordinary link (the adapters
-	* fall back rather than dropping the button), so this is a preference, never
-	* a requirement.
-	*/
-	mode: zod.z.enum(["navigate", "background"]).optional()
-});
-/** A delivery parameter value: what a notifier declared it takes. */
-var DeliveryParamValueSchema = zod.z.union([
-	zod.z.string(),
-	zod.z.number(),
-	zod.z.boolean()
-]);
-/**
-* One extra delivery parameter a notifier KIND declares (D938). A rule that
-* addresses a target of that kind may set it; a kind that declares nothing is
-* never handed one. The admin UI derives its control from this descriptor —
-* no editor knows a service by name.
-*
-* Optional fields are `.optional()`, never `.default()` (a Zod default does not
-* run on the addon cap path).
-*/
-var DeliveryParamSchema = zod.z.object({
-	key: zod.z.string().min(1),
-	label: zod.z.string(),
-	/** i18n key of the label, resolved by the declaring addon's namespace. */
-	labelKey: zod.z.string().optional(),
-	type: zod.z.enum([
-		"enum",
-		"number",
-		"boolean",
-		"string"
-	]),
-	/** `enum` only: the closed set of accepted values. */
-	options: zod.z.array(zod.z.object({
-		value: zod.z.string(),
-		label: zod.z.string()
-	})).optional(),
-	/** `number` only. */
-	min: zod.z.number().optional(),
-	max: zod.z.number().optional(),
-	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
-	default: DeliveryParamValueSchema.optional()
-});
-/**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
-*/
-var NotificationSchema = zod.z.object({
-	body: zod.z.string(),
-	title: zod.z.string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: zod.z.number().int().min(1).max(5).default(3),
-	level: zod.z.string().optional(),
-	attachments: zod.z.array(AttachmentSchema).optional(),
-	clickUrl: zod.z.string().optional(),
-	actions: zod.z.array(NotificationActionSchema).optional(),
-	sound: zod.z.string().optional(),
-	ttl: zod.z.number().optional(),
-	tag: zod.z.string().optional(),
-	deviceId: zod.z.number().optional(),
-	eventId: zod.z.string().optional(),
-	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-	/**
-	* Values for the parameters the target's kind DECLARES in
-	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
-	* declaration by the sender; a notifier reads only the keys it declared.
-	*/
-	delivery: zod.z.record(zod.z.string(), DeliveryParamValueSchema).optional()
-});
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: zod.z.number().int().min(1).max(5).nullable(),
-	flags: zod.z.object({
-		critical: zod.z.boolean().optional(),
-		silent: zod.z.boolean().optional(),
-		noPush: zod.z.boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: zod.z.array(zod.z.string()).optional(),
-	description: zod.z.string().optional()
-});
-/** Attachment capabilities for a kind (drives the degrade engine + test panel). */
-var TargetKindAttachmentsCapsSchema = zod.z.object({
-	mediaTypes: zod.z.array(AttachmentMediaTypeSchema),
-	mode: zod.z.enum([
-		"url",
-		"bytes",
-		"both"
-	]),
-	max: zod.z.number().int().nonnegative(),
-	maxBytes: zod.z.number().int().positive().optional()
-});
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = zod.z.object({
-	attachments: TargetKindAttachmentsCapsSchema,
-	/** Max action buttons (0 = none). */
-	actions: zod.z.number().int().nonnegative(),
-	/**
-	* Whether this kind renders a per-action ICON.
-	*
-	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
-	* run on the addon cap path — three production failures in one day taught
-	* this repo that once. Absent is read as false by the degrade engine, which
-	* is the safe direction: an icon that is not rendered costs nothing, an icon
-	* assumed and dropped costs the operator's trust in the field.
-	*/
-	actionIcons: zod.z.boolean().optional(),
-	levels: zod.z.array(TargetKindLevelSchema),
-	format: zod.z.array(NotificationFormatSchema),
-	clickUrl: zod.z.boolean(),
-	sound: zod.z.boolean(),
-	ttl: zod.z.boolean(),
-	bodyMaxLen: zod.z.number().int().positive()
-});
-/**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
-*/
-var ConfigSchemaPassthrough$2 = zod.z.unknown();
-var TargetKindSchema = zod.z.object({
-	kind: zod.z.string(),
-	label: zod.z.string(),
-	icon: zod.z.string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: zod.z.string(),
-	/**
-	* URL of the kind's bundled BRAND icon, served by the providing addon over
-	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
-	* when the addon bundles no icon for that kind — the client then falls back
-	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
-	*
-	* Root-relative on purpose: it resolves against whatever origin serves a web
-	* client, and a native client joins it onto its own hub base.
-	*
-	* DECLARED here deliberately. It used to travel as an undeclared passthrough
-	* field that survived only because the runtime cap-router forwards provider
-	* output verbatim — so every consumer had to re-declare it by hand to stop
-	* its own Zod parse from stripping it, and the whole arrangement would have
-	* broken silently the moment output validation was tightened anywhere.
-	*/
-	iconUrl: zod.z.string().optional(),
-	/**
-	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
-	*
-	* The server knows this and therefore says it, because the client cannot
-	* safely guess: a React-Native client renders SVG and raster through two
-	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
-	* not decode SVG on iOS/Android), so without this it silently fell back to a
-	* placeholder glyph for every vector icon while the web build looked fine.
-	*
-	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
-	* not been updated — a client that cannot determine the type should prefer
-	* its raster path, which is the safe default for an unknown image.
-	*/
-	iconMediaType: zod.z.string().optional(),
-	configSchema: ConfigSchemaPassthrough$2,
-	/**
-	* The config keys that decide WHERE this kind's secrets are sent (server,
-	* base URL, instance, chat, recipient). A save that changes any of them
-	* while leaving a secret redacted is refused by the provider (D634), so an
-	* editor uses this to ask for the secret on exactly those edits instead of
-	* on every edit.
-	*
-	* Optional: absent from a provider that holds no secret (the Home Assistant
-	* kinds) and from a provider older than this field — an editor that finds
-	* it absent must assume ANY edit may need the secret.
-	*/
-	destinationKeys: zod.z.array(zod.z.string()).optional(),
-	supportsDiscovery: zod.z.boolean(),
-	/**
-	* Extra delivery parameters a rule may set for a target of this kind (D938).
-	* Absent = none; the rule editor then offers nothing.
-	*/
-	deliveryParams: zod.z.array(DeliveryParamSchema).optional(),
-	caps: TargetKindCapsSchema
-});
-/**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
-*/
-var TargetSchema = zod.z.object({
-	id: zod.z.string(),
-	name: zod.z.string(),
-	kind: zod.z.string(),
-	addonId: zod.z.string(),
-	enabled: zod.z.boolean(),
-	config: zod.z.record(zod.z.string(), zod.z.unknown())
-});
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = zod.z.object({
-	kind: zod.z.string(),
-	suggestedName: zod.z.string(),
-	config: zod.z.record(zod.z.string(), zod.z.unknown())
-});
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = zod.z.object({
-	level: zod.z.string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: zod.z.number().int().nonnegative(),
-	actionsSent: zod.z.number().int().nonnegative(),
-	truncated: zod.z.boolean(),
-	dropped: zod.z.array(zod.z.string())
-});
-var SendResultSchema = zod.z.object({
-	success: zod.z.boolean(),
-	error: zod.z.string().optional(),
-	renderedAs: RenderedAsSchema.optional()
-});
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
-/**
-* Pre-save credential probe against a partial (unsaved) target config.
-* `resolvedUrl` never includes secrets (token stripped from path).
-*/
-var ProbeTargetConfigResultSchema = zod.z.object({
-	ok: zod.z.boolean(),
-	resolvedUrl: zod.z.string(),
-	httpStatus: zod.z.number().int().optional(),
-	stateInstance: zod.z.string().optional(),
-	error: zod.z.string().optional()
-});
-var notificationOutputCapability = {
-	name: "notification-output",
-	scope: "system",
-	mode: "collection",
-	methods: {
-		listTargetKinds: require_sleep.method(zod.z.object({}), zod.z.array(TargetKindSchema)),
-		listTargets: require_sleep.method(zod.z.object({}), zod.z.array(TargetSchema), { auth: "admin" }),
-		/**
-		* One target WITH secrets — admin edit / duplicate hydration only.
-		* `listTargets` stays redacted; the editor loads this so password fields
-		* are filled (masked in the input) and a save can round-trip the token
-		* when a destination changes (Duplicate with a new chatId, etc.).
-		*/
-		getTarget: require_sleep.method(zod.z.object({ targetId: zod.z.string() }), TargetSchema, { auth: "admin" }),
-		discoverTargets: require_sleep.method(zod.z.object({
-			kind: zod.z.string(),
-			config: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-			/**
-			* When editing / duplicating, the blank password field never round-trips
-			* the stored token. Pass the source target id so the provider can restore
-			* secrets server-side before dialling (same merge as upsert).
-			*/
-			targetId: zod.z.string().optional()
-		}), zod.z.array(DiscoveredTargetSchema), { auth: "admin" }),
-		probeTargetConfig: require_sleep.method(zod.z.object({
-			kind: zod.z.string(),
-			config: zod.z.record(zod.z.string(), zod.z.unknown()),
-			/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
-			targetId: zod.z.string().optional()
-		}), ProbeTargetConfigResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		send: require_sleep.method(zod.z.object({
-			targetId: zod.z.string(),
-			notification: NotificationSchema
-		}), SendResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		testTarget: require_sleep.method(zod.z.object({
-			targetId: zod.z.string(),
-			sample: NotificationSchema.optional()
-		}), TestResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		upsertTarget: require_sleep.method(zod.z.object({
-			target: TargetSchema,
-			/**
-			* Duplicate flow: create a NEW target id while copying secrets from an
-			* existing row. The UI never holds the stored token; blank / redacted
-			* password fields are restored from this source (D634 still applies if
-			* destinations diverge without a re-typed secret).
-			*/
-			cloneSecretsFrom: zod.z.string().optional()
-		}), TargetSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		deleteTarget: require_sleep.method(zod.z.object({ targetId: zod.z.string() }), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		setTargetEnabled: require_sleep.method(zod.z.object({
-			targetId: zod.z.string(),
-			enabled: zod.z.boolean()
-		}), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
-	}
-};
-//#endregion
 //#region src/catalogs/audio-classmap.ts
 var AUDIO_MACRO_LABELS = [
 	{
@@ -55536,14 +55906,6 @@ var EngineProvisioningSchema = zod.z.object({
 	*/
 	configIssues: zod.z.array(zod.z.string()).optional()
 });
-var PipelineStepInputSchema = zod.z.lazy(() => zod.z.object({
-	addonId: zod.z.string(),
-	modelId: zod.z.string().optional(),
-	enabled: zod.z.boolean().default(true),
-	children: zod.z.array(PipelineStepInputSchema).optional(),
-	settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-	jumpDeviceKey: zod.z.string().optional()
-}));
 var ModelSubstitutionSchema = zod.z.object({
 	addonId: zod.z.string(),
 	chosen: zod.z.string(),
@@ -55622,7 +55984,6 @@ var ConfigUISchemaBridge = zod.z.custom();
 var ConfigUISchemaNullableBridge = zod.z.custom();
 var InferenceCapabilitiesBridge = zod.z.custom();
 var ModelAvailabilityListBridge = zod.z.custom();
-var PipelineRunResultBridge = zod.z.custom();
 /**
 * Pipeline executor — detection engine + configuration + inference API.
 *
@@ -55735,7 +56096,7 @@ var pipelineExecutorCapability = {
 		* reads any media: can this (node, deviceKey) run exactly this model?
 		*/
 		validatePipeline: require_sleep.method(zod.z.object({
-			steps: zod.z.array(PipelineStepInputSchema),
+			steps: zod.z.array(require_sleep.PipelineStepInputSchema),
 			deviceKey: zod.z.string().optional()
 		}), PipelineValidationResultSchema),
 		getCapabilities: require_sleep.method(zod.z.void(), InferenceCapabilitiesBridge),
@@ -55779,7 +56140,7 @@ var pipelineExecutorCapability = {
 		*  - `referenceImage`: named file from the reference-image store.
 		*/
 		runPipeline: require_sleep.method(zod.z.object({
-			steps: zod.z.array(PipelineStepInputSchema).min(1),
+			steps: zod.z.array(require_sleep.PipelineStepInputSchema).min(1),
 			frame: FrameInputSchema.optional(),
 			/**
 			* Process-local lazy frame. Valid only when caller and provider resolve
@@ -55853,7 +56214,7 @@ var pipelineExecutorCapability = {
 			* PIXELS of the image this call carries. Absent ⇒ the root step runs.
 			*/
 			suppliedRoot: SuppliedRootOutputSchema.optional()
-		}), PipelineRunResultBridge, { kind: "mutation" }),
+		}), require_sleep.PipelineRunResultBridge, { kind: "mutation" }),
 		/**
 		* Batched run — N raw frames packed into one cap call. The provider
 		* routes the batch through `SharedInferencePool.inferBatch`
@@ -55866,7 +56227,7 @@ var pipelineExecutorCapability = {
 		* N frames in one call to amortise per-call IPC overhead.
 		*/
 		runPipelineBatch: require_sleep.method(zod.z.object({
-			steps: zod.z.array(PipelineStepInputSchema).min(1),
+			steps: zod.z.array(require_sleep.PipelineStepInputSchema).min(1),
 			frames: zod.z.array(FrameInputSchema).min(1).max(255),
 			deviceId: zod.z.number().optional(),
 			sessionId: zod.z.string().optional(),
@@ -55883,7 +56244,7 @@ var pipelineExecutorCapability = {
 			frameId: zod.z.number().int().nonnegative().optional(),
 			/** Inference-device selector (Phase 2 multi-device); see runPipeline. */
 			deviceKey: zod.z.string().optional()
-		}), zod.z.object({ results: zod.z.array(PipelineRunResultBridge).readonly() }), { kind: "mutation" }),
+		}), zod.z.object({ results: zod.z.array(require_sleep.PipelineRunResultBridge).readonly() }), { kind: "mutation" }),
 		/**
 		* Cache a raw frame inside the Python inference pool's memory.
 		* Returns a numeric `frameId` that `inferCached` references —
@@ -57586,7 +57947,7 @@ var RunnerCameraConfigSchema = zod.z.object({
 	detectionSources: DetectionSourcesSchema.default(["pipeline"]),
 	pipelineEnabled: zod.z.boolean().default(true),
 	/** Ordered tree of video steps. Absent → runner skips video detection. */
-	steps: zod.z.array(PipelineStepInputSchema).readonly().optional(),
+	steps: zod.z.array(require_sleep.PipelineStepInputSchema).readonly().optional(),
 	/** Audio classification branch. `enabled:false` disables, null skips. */
 	audio: zod.z.object({
 		modelId: zod.z.string().optional(),
@@ -58321,7 +58682,7 @@ var pipelineRunnerCapability = {
 //#region src/capabilities/pipeline-orchestrator.cap.ts
 var CameraPipelineConfigSchema = zod.z.object({
 	engine: PipelineEngineChoiceSchema.optional(),
-	steps: zod.z.array(PipelineStepInputSchema).readonly(),
+	steps: zod.z.array(require_sleep.PipelineStepInputSchema).readonly(),
 	audio: zod.z.object({
 		engine: PipelineEngineChoiceSchema.optional(),
 		modelId: zod.z.string().optional(),
@@ -59120,8 +59481,7 @@ var pipelineOrchestratorCapability = {
 		* replaced the four flat orchestrator lists (`enabledNodes`,
 		* `enabledDecoderNodes`, `enabledAudioNodes`, `remoteSourcingNodes`).
 		* Each flag is optional in the patch: omit a flag to leave it unchanged,
-		* pass `null` to reset it to the node default (`hub` → capable, every
-		* other node → not). Detection/audio eligibility is derived from these
+		* pass `null` to reset it to the default (ON for every node). Detection/audio eligibility is derived from these
 		* flags across the cluster; changing them re-derives the enabled sets
 		* and reconciles dispatch immediately. There is NO separate decode flag:
 		* decode is always co-located with its frame consumer, so decode
@@ -66927,14 +67287,13 @@ reset: require_sleep.method(zod.z.object({
 		auth: "admin"
 	}) },
 	/**
-	* A composed consumable (item added to a device with no native consumables
-	* provider) refuses `reset` by name: "Only meaningful when the item's
-	* `resettable` is true" — a composed item is never resettable until
-	* commands (`forward`) arrive in slice 3 (D663).
+	* A consumable ADDED to an existing device (a graft) refuses `reset` by
+	* name: only a composed device of a NEW type forwards an item's reset to a
+	* source button, and marks that item `resettable` (D967).
 	*/
 	composedMethods: { reset: {
 		kind: "refuse",
-		reason: "a composed consumable is not resettable until commands (forward) arrive — slice 3"
+		reason: "a consumable added to an existing device is not resettable — only a new composed device forwards a reset"
 	} },
 	status: {
 		schema: ConsumablesStatusSchema,
@@ -67597,7 +67956,7 @@ var DishwasherStatusSchema = zod.z.object({
 	/** Ms epoch of the last value received from the appliance; 0 = never. */
 	lastFetchedAt: zod.z.number()
 });
-var DeviceIdSchema = zod.z.number().int().nonnegative();
+var DeviceIdSchema$1 = zod.z.number().int().nonnegative();
 /** A value a program option or setting can take. */
 var DishwasherValueSchema = zod.z.union([
 	zod.z.boolean(),
@@ -67672,77 +68031,77 @@ var dishwasherCapability = {
 		* option feature keys; each is checked against the program's constraints.
 		*/
 		start: require_sleep.method(zod.z.object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			program: zod.z.string().min(1).optional(),
 			options: zod.z.record(zod.z.string(), DishwasherValueSchema).optional()
 		}), zod.z.void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		pause: require_sleep.method(zod.z.object({ deviceId: DeviceIdSchema }), zod.z.void(), {
+		pause: require_sleep.method(zod.z.object({ deviceId: DeviceIdSchema$1 }), zod.z.void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		resume: require_sleep.method(zod.z.object({ deviceId: DeviceIdSchema }), zod.z.void(), {
+		resume: require_sleep.method(zod.z.object({ deviceId: DeviceIdSchema$1 }), zod.z.void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		stop: require_sleep.method(zod.z.object({ deviceId: DeviceIdSchema }), zod.z.void(), {
+		stop: require_sleep.method(zod.z.object({ deviceId: DeviceIdSchema$1 }), zod.z.void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		/** Select (not start) a program; refused when the appliance does not offer it. */
 		setProgram: require_sleep.method(zod.z.object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			program: zod.z.string().min(1)
 		}), zod.z.void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setPower: require_sleep.method(zod.z.object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: zod.z.boolean()
 		}), zod.z.void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setHalfLoad: require_sleep.method(zod.z.object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: zod.z.boolean()
 		}), zod.z.void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setHygienePlus: require_sleep.method(zod.z.object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: zod.z.boolean()
 		}), zod.z.void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setExtraDry: require_sleep.method(zod.z.object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: zod.z.boolean()
 		}), zod.z.void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setIntensiveZone: require_sleep.method(zod.z.object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: zod.z.boolean()
 		}), zod.z.void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setVarioSpeedPlus: require_sleep.method(zod.z.object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: zod.z.boolean()
 		}), zod.z.void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setChildLock: require_sleep.method(zod.z.object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: zod.z.boolean()
 		}), zod.z.void(), {
 			kind: "mutation",
@@ -67754,7 +68113,7 @@ var dishwasherCapability = {
 		* its declared range / members.
 		*/
 		setOption: require_sleep.method(zod.z.object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			key: zod.z.string().min(1),
 			value: DishwasherValueSchema
 		}), zod.z.void(), {
@@ -67762,7 +68121,7 @@ var dishwasherCapability = {
 			auth: "protected"
 		}),
 		/** What this appliance can do, from its own description — the UI is derived from it. */
-		getOptions: require_sleep.method(zod.z.object({ deviceId: DeviceIdSchema }), DishwasherOptionsSchema, { auth: "protected" })
+		getOptions: require_sleep.method(zod.z.object({ deviceId: DeviceIdSchema$1 }), DishwasherOptionsSchema, { auth: "protected" })
 	},
 	status: {
 		schema: DishwasherStatusSchema,
@@ -72065,7 +72424,8 @@ var TopologyNodeSchema = zod.z.object({
 	isHub: zod.z.boolean(),
 	isOnline: zod.z.boolean(),
 	cpuPercent: zod.z.number(),
-	memoryPercent: zod.z.number(),
+	/** `null` when the node's memory read failed or it has not reported one (D393). */
+	memoryPercent: zod.z.number().nullable(),
 	uptime: zod.z.number(),
 	lastSeen: zod.z.string(),
 	localIps: zod.z.array(zod.z.string()).readonly(),
@@ -72906,9 +73266,10 @@ var PetFeederStatusSchema = zod.z.object({
 	*  combined reading; per-hopper levels live in `food1`/`food2`. Null when
 	*  the device has not reported yet. */
 	foodLevel: zod.z.number().nullable().meta(require_sleep.readingMeta("none")),
-	/** Food in the BOWL as the feeder reports it (`state.bowl`), in the
-	*  feeder's own units. Null when the model reports none. */
-	bowlFood: zod.z.number().nullable().meta(require_sleep.readingMeta("none")),
+	/** Food in the BOWL, a mass (stored in kilograms, D944). Reported only by a
+	*  feeder with a bowl scale; null when the model has none or its reading is
+	*  of an unproven unit. */
+	bowlFood: zod.z.number().nullable().meta(require_sleep.readingMeta("mass")),
 	/** True while the pet is eating (`state.eating`). */
 	eating: zod.z.boolean(),
 	/** Whether `markFoodReplenished` does anything on this model. When false
@@ -73093,6 +73454,139 @@ var petFeederCapability = {
 	} }
 };
 //#endregion
+//#region src/capabilities/pet-fountain.cap.ts
+/**
+* Pet water-fountain cap. Models the telemetry and the control surface of a
+* circulating drinking fountain: how much water is in the tank, how much the
+* pet drank, whether the pump runs and on what duty cycle.
+*
+* It has no native vendor provider of its own: a fountain reaches CamStack as
+* a container of loose entities (a pump switch, two number boxes, a "filter
+* changed" button), and an operator BUILDS the device from them — a composed
+* device of this type (D659, D967). Every method is therefore a forward to ONE
+* method of ONE source entity, and every reading is a field derived from a
+* source entity; the provider-shaped interface below exists so the composed
+* device and any future native provider answer the same contract.
+*
+* Quantities are stored in the base unit of their kind (D944): volumes in
+* LITRES, durations in SECONDS, the tank level in percent. A source that
+* reports millilitres or minutes is converted in the composition's expression,
+* never here. Every reading may be `null`: a source that is offline or does
+* not report is unknown, never zero.
+*
+* The filter is not a field of this cap: it is an item of the `consumables`
+* cap on the same device (kind `wear`), reset by the same forward mechanism.
+*/
+var PetFountainStatusSchema = zod.z.object({
+	/** Water in the tank, 0..100 (%). Null while the source has not reported. */
+	waterLevel: zod.z.number().min(0).max(100).nullable().meta(require_sleep.readingMeta("percentage")),
+	/** Water in the tank, in litres. Null while the source has not reported. */
+	waterVolume: zod.z.number().min(0).nullable().meta(require_sleep.readingMeta("volume")),
+	/** True when the tank is empty. Null while unknown. */
+	empty: zod.z.boolean().nullable(),
+	/** True while the pump is running. Null while unknown. */
+	pumpRunning: zod.z.boolean().nullable(),
+	/** True when the pump works on an on/off duty cycle rather than continuously. */
+	pumpIntervalEnabled: zod.z.boolean().nullable(),
+	/** How long the pump runs per cycle, in seconds. */
+	pumpOnTime: zod.z.number().min(0).nullable().meta(require_sleep.readingMeta("duration")),
+	/** How long the pump rests per cycle, in seconds. */
+	pumpOffTime: zod.z.number().min(0).nullable().meta(require_sleep.readingMeta("duration")),
+	/** Water drunk in the last drink, in litres. */
+	lastDrink: zod.z.number().min(0).nullable().meta(require_sleep.readingMeta("volume")),
+	/** Water drunk in the current hour, in litres. */
+	currentHourDrink: zod.z.number().min(0).nullable().meta(require_sleep.readingMeta("volume")),
+	/** Water drunk over the last 24 hours (rolling), in litres. */
+	last24hDrink: zod.z.number().min(0).nullable().meta(require_sleep.readingMeta("volume")),
+	/** Water drunk since local midnight, in litres. */
+	todayDrink: zod.z.number().min(0).nullable().meta(require_sleep.readingMeta("volume")),
+	/** Decoded fault message. Null means healthy; a non-null string is an active fault. */
+	error: zod.z.string().nullable(),
+	/** Ms epoch when the slice was last refreshed. */
+	lastFetchedAt: zod.z.number()
+});
+var DeviceIdSchema = zod.z.number().int().nonnegative();
+var MinutesSchema = zod.z.number().int().min(0);
+var petFountainCapability = {
+	name: "pet-fountain",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [require_err_msg.DeviceType.PetFountain],
+	methods: {
+		/** Start or stop the pump. */
+		setPump: require_sleep.method(zod.z.object({
+			deviceId: DeviceIdSchema,
+			on: zod.z.boolean()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** Switch the on/off duty cycle on or off (off = the pump runs continuously). */
+		setPumpInterval: require_sleep.method(zod.z.object({
+			deviceId: DeviceIdSchema,
+			on: zod.z.boolean()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** Set how many minutes the pump runs per cycle. */
+		setPumpOnMinutes: require_sleep.method(zod.z.object({
+			deviceId: DeviceIdSchema,
+			minutes: MinutesSchema
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** Set how many minutes the pump rests per cycle. */
+		setPumpOffMinutes: require_sleep.method(zod.z.object({
+			deviceId: DeviceIdSchema,
+			minutes: MinutesSchema
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** Clear the rolling daily consumption counters on the device. */
+		resetDailyConsumption: require_sleep.method(zod.z.object({ deviceId: DeviceIdSchema }), zod.z.void(), {
+			kind: "mutation",
+			auth: "protected"
+		})
+	},
+	status: {
+		schema: PetFountainStatusSchema,
+		kind: "push"
+	},
+	/** Runtime-state slice — mirrored by the kernel; the hero card reads it whole. */
+	runtimeState: PetFountainStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live appliance state re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
+	/** History (D850): recorded series. */
+	history: { fields: {
+		waterLevel: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 1
+		},
+		waterVolume: {
+			kind: "gauge",
+			unit: "L"
+		},
+		todayDrink: {
+			kind: "gauge",
+			unit: "L"
+		},
+		last24hDrink: {
+			kind: "gauge",
+			unit: "L"
+		}
+	} }
+};
+//#endregion
 //#region src/capabilities/plate-gallery.cap.ts
 var VehicleSchema = zod.z.object({
 	id: zod.z.string(),
@@ -82985,7 +83479,7 @@ var ROOM_EXAMPLE_MOTION_SOURCES = [{
 	addonId: "provider-homeassistant",
 	stableId: "binary_sensor.living_room_presence"
 }];
-function from(source, cap, fieldPath) {
+function from$1(source, cap, fieldPath) {
 	return {
 		kind: "from",
 		source,
@@ -82994,7 +83488,7 @@ function from(source, cap, fieldPath) {
 	};
 }
 function named(prefix, sources, cap, fieldPath) {
-	return Object.fromEntries(sources.map((s, i) => [`${prefix}${i + 1}`, from(s, cap, fieldPath)]));
+	return Object.fromEntries(sources.map((s, i) => [`${prefix}${i + 1}`, from$1(s, cap, fieldPath)]));
 }
 function roomCompositionExample(input) {
 	const t = named("t", input.temperatureSources, "temperature-sensor", "temperature");
@@ -83082,7 +83576,7 @@ function feederExampleSources(brokerId) {
 	};
 }
 function feederCustomizationExample(sources) {
-	const days = { d: from(sources.desiccantDays, "enum-sensor", "value") };
+	const days = { d: from$1(sources.desiccantDays, "enum-sensor", "value") };
 	return require_composition.CompositionSchema.parse({
 		target: {
 			kind: "existing",
@@ -83130,7 +83624,7 @@ function feederCustomizationExample(sources) {
 				level: {
 					kind: "expression",
 					expr: "s == \"low\" ? 15 : (s == \"normal\" ? 100 : null)",
-					bindings: { s: from(sources.batteryStatus, "enum-sensor", "value") }
+					bindings: { s: from$1(sources.batteryStatus, "enum-sensor", "value") }
 				},
 				binary: {
 					kind: "expression",
@@ -83140,7 +83634,7 @@ function feederCustomizationExample(sources) {
 				charging: {
 					kind: "expression",
 					expr: "c ? \"dc\" : \"unknown\"",
-					bindings: { c: from(sources.batteryCharging, "binary", "on") }
+					bindings: { c: from$1(sources.batteryCharging, "binary", "on") }
 				},
 				sleeping: {
 					kind: "expression",
@@ -83226,6 +83720,158 @@ function convertPresetFeature(input) {
 	};
 }
 //#endregion
+//#region src/composition/presets/pet-fountain.ts
+/**
+* The preset for a pet water fountain built from loose entities (D659, D967).
+*
+* A fountain reaches CamStack as a container of single-purpose entities: a
+* pump switch, a cycle switch, two number boxes, a handful of sensors that
+* report millilitres as text, and a few buttons. This preset names the
+* `pet-fountain` cap's fields over those entities, forwards each of its five
+* methods to ONE entity method, and adds the filter as a resettable
+* `consumables` item.
+*
+* Stored quantities are base units (D944): litres for volume, seconds for
+* duration. The cycle times cannot be read back (see `pumpOnTime` below). The sensors are `enum-sensor`s, so their value is a STRING:
+* `number(x)` reads it and anything that is not a number stays `null`, never
+* 0 (D393). The caller supplies the sources — it knows which entity is which;
+* the preset guesses no entity id.
+*/
+var UNKNOWN = {
+	kind: "expression",
+	expr: "null",
+	bindings: {}
+};
+var NOW = {
+	kind: "expression",
+	expr: "now",
+	bindings: {}
+};
+function from(source, cap, fieldPath) {
+	return {
+		kind: "from",
+		source,
+		cap,
+		fieldPath
+	};
+}
+function over(name, binding, expr) {
+	return {
+		kind: "expression",
+		expr,
+		bindings: { [name]: binding }
+	};
+}
+/** A text reading in millilitres, as litres; unreadable stays unknown. */
+function millilitresAsLitres(source) {
+	return over("v", from(source, "enum-sensor", "value"), "number(v) == null ? null : number(v) / 1000");
+}
+function percentOf(source) {
+	return over("l", from(source, "enum-sensor", "value"), "number(l)");
+}
+function filterFeature(filter) {
+	const days = { d: from(filter.daysRemaining, "enum-sensor", "value") };
+	return {
+		kind: "fields",
+		cap: "consumables",
+		fields: {
+			lastChangedAt: NOW,
+			lastFetchedAt: NOW
+		},
+		items: { filter: {
+			label: "Filter",
+			fields: {
+				"remaining.value": {
+					kind: "expression",
+					expr: "number(d)",
+					bindings: days
+				},
+				"remaining.kind": {
+					kind: "expression",
+					expr: "\"duration\"",
+					bindings: {}
+				},
+				status: {
+					kind: "expression",
+					expr: "number(d) == null ? null : (number(d) <= 0 ? \"replace\" : \"ok\")",
+					bindings: days
+				}
+			},
+			reset: {
+				kind: "forward",
+				source: filter.changed,
+				cap: "button",
+				method: "press"
+			}
+		} }
+	};
+}
+function petFountainFromEntitiesComposition(sources) {
+	const minutes = {
+		kind: "numeric",
+		value: { $input: "minutes" }
+	};
+	return require_composition.CompositionSchema.parse({
+		target: {
+			kind: "new",
+			type: require_err_msg.DeviceType.PetFountain
+		},
+		features: [{
+			kind: "fields",
+			cap: "pet-fountain",
+			fields: {
+				waterLevel: percentOf(sources.waterLevel),
+				waterVolume: millilitresAsLitres(sources.waterVolume),
+				empty: over("l", from(sources.waterLevel, "enum-sensor", "value"), "number(l) == null ? null : number(l) <= 0"),
+				pumpRunning: from(sources.pump, "switch", "on"),
+				pumpIntervalEnabled: from(sources.pumpInterval, "switch", "on"),
+				pumpOnTime: UNKNOWN,
+				pumpOffTime: UNKNOWN,
+				lastDrink: millilitresAsLitres(sources.lastDrink),
+				currentHourDrink: millilitresAsLitres(sources.currentHourDrink),
+				last24hDrink: millilitresAsLitres(sources.last24hDrink),
+				todayDrink: millilitresAsLitres(sources.todayDrink),
+				error: UNKNOWN,
+				lastFetchedAt: NOW
+			},
+			commands: {
+				setPump: {
+					kind: "forward",
+					source: sources.pump,
+					cap: "switch",
+					method: "setState"
+				},
+				setPumpInterval: {
+					kind: "forward",
+					source: sources.pumpInterval,
+					cap: "switch",
+					method: "setState"
+				},
+				setPumpOnMinutes: {
+					kind: "forward",
+					source: sources.pumpOnMinutes,
+					cap: "control",
+					method: "setValue",
+					args: { control: minutes }
+				},
+				setPumpOffMinutes: {
+					kind: "forward",
+					source: sources.pumpOffMinutes,
+					cap: "control",
+					method: "setValue",
+					args: { control: minutes }
+				},
+				resetDailyConsumption: {
+					kind: "forward",
+					source: sources.clearDaily,
+					cap: "button",
+					method: "press"
+				}
+			}
+		}, ...sources.filter === void 0 ? [] : [filterFeature(sources.filter)]]
+	});
+}
+//#endregion
 //#region src/composition/cards/classify-field.ts
 function fromSources(binding) {
 	return {
@@ -83475,6 +84121,7 @@ var CAP_CUSTOMIZE_CATALOG = {
 				require_err_msg.DeviceType.Container,
 				require_err_msg.DeviceType.Image,
 				require_err_msg.DeviceType.PetFeeder,
+				require_err_msg.DeviceType.PetFountain,
 				require_err_msg.DeviceType.Dishwasher,
 				require_err_msg.DeviceType.Washer,
 				require_err_msg.DeviceType.Dryer
@@ -85987,6 +86634,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	notifier: notifierCapability,
 	numericSensor: numericSensorCapability,
 	petFeeder: petFeederCapability,
+	petFountain: petFountainCapability,
 	powerMeter: powerMeterCapability,
 	presence: presenceCapability,
 	pressureSensor: pressureSensorCapability,
@@ -87975,6 +88623,7 @@ var DEVICE_TYPE_CONTROL_KIND = {
 	[require_err_msg.DeviceType.Container]: "dummy",
 	[require_err_msg.DeviceType.Image]: "image",
 	[require_err_msg.DeviceType.PetFeeder]: "pet-feeder",
+	[require_err_msg.DeviceType.PetFountain]: "pet-fountain",
 	[require_err_msg.DeviceType.Dishwasher]: "dishwasher",
 	[require_err_msg.DeviceType.Washer]: "dummy",
 	[require_err_msg.DeviceType.Dryer]: "dummy"
@@ -90017,6 +90666,13 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"deviceExport.exposeEntity": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"deviceExport.getDeviceLiveContribution": {
 		capName: "device-export",
 		capScope: "system",
@@ -90045,6 +90701,13 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"deviceExport.listExposedEntities": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"deviceExport.listSupportedDeviceKinds": {
 		capName: "device-export",
 		capScope: "system",
@@ -90052,6 +90715,13 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"deviceExport.listSupportedEntityKinds": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"deviceExport.unexposeDevice": {
 		capName: "device-export",
 		capScope: "system",
@@ -90059,6 +90729,13 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"deviceExport.unexposeEntity": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"deviceExtension.listCandidates": {
 		capName: "device-extension",
 		capScope: "device",
@@ -92880,6 +93557,13 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"nodeRemovalHook.onNodeRemoved": {
+		capName: "node-removal-hook",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"nodes.clusterAddonStatus": {
 		capName: "nodes",
 		capScope: "system",
@@ -93517,6 +94201,48 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "create",
 		role: "viewer"
 	},
+	"petFountain.getStatus": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
+	"petFountain.resetDailyConsumption": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "delete",
+		role: "viewer"
+	},
+	"petFountain.setPump": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"petFountain.setPumpInterval": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"petFountain.setPumpOffMinutes": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"petFountain.setPumpOnMinutes": {
+		capName: "pet-fountain",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
 	"pipelineAnalytics.addRetrainFrameFromRecording": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -98115,6 +98841,7 @@ var KNOWN_CAP_NAMES = [
 	"network-link",
 	"network-quality",
 	"node-certificates",
+	"node-removal-hook",
 	"nodes",
 	"notification-output",
 	"notification-rules",
@@ -98125,6 +98852,7 @@ var KNOWN_CAP_NAMES = [
 	"osd",
 	"osd-manager",
 	"pet-feeder",
+	"pet-fountain",
 	"pipeline-analytics",
 	"pipeline-executor",
 	"pipeline-orchestrator",
@@ -98256,6 +98984,7 @@ var DEVICE_CAP_NAMES = [
 	"numeric-sensor",
 	"osd",
 	"pet-feeder",
+	"pet-fountain",
 	"pipeline-analytics",
 	"power-meter",
 	"presence",
@@ -98348,6 +99077,7 @@ var SYSTEM_CAP_NAMES = [
 	"network-access",
 	"network-quality",
 	"node-certificates",
+	"node-removal-hook",
 	"nodes",
 	"notification-output",
 	"notification-rules",
@@ -100394,6 +101124,100 @@ var APPLIANCE_CAP_VOCABULARY = {
 			}
 		]
 	},
+	"pet-fountain": {
+		scope: "device",
+		noun: t("Pet fountain", "Fontana per animali"),
+		actions: [
+			{
+				id: "petFountain.pumpOn",
+				method: "setPump",
+				label: t("Pump on", "Pompa accesa"),
+				phrase: t("Start the pump of {device}", "Avvia la pompa di {device}"),
+				icon: "play",
+				args: { on: true }
+			},
+			{
+				id: "petFountain.pumpOff",
+				method: "setPump",
+				label: t("Pump off", "Pompa spenta"),
+				phrase: t("Stop the pump of {device}", "Ferma la pompa di {device}"),
+				icon: "square",
+				args: { on: false }
+			},
+			{
+				id: "petFountain.intervalOn",
+				method: "setPumpInterval",
+				label: t("Pump cycle on", "Ciclo pompa attivo"),
+				phrase: t("Run the pump of {device} on its on/off cycle", "Fai lavorare la pompa di {device} a ciclo acceso/spento"),
+				icon: "timer",
+				args: { on: true }
+			},
+			{
+				id: "petFountain.intervalOff",
+				method: "setPumpInterval",
+				label: t("Pump cycle off", "Ciclo pompa spento"),
+				phrase: t("Run the pump of {device} continuously", "Fai lavorare la pompa di {device} in continuo"),
+				icon: "timer-off",
+				args: { on: false }
+			},
+			{
+				id: "petFountain.pumpOnMinutes",
+				method: "setPumpOnMinutes",
+				label: t("Set pump run time", "Imposta il tempo di lavoro della pompa"),
+				phrase: t("Set the pump of {device} to run {minutes} minutes per cycle", "Imposta la pompa di {device} a lavorare {minutes} minuti per ciclo"),
+				icon: "timer",
+				openArgs: [{
+					key: "minutes",
+					label: t("Minutes", "Minuti"),
+					offer: {
+						kind: "number",
+						min: 0,
+						step: 1,
+						unit: "min"
+					}
+				}]
+			},
+			{
+				id: "petFountain.pumpOffMinutes",
+				method: "setPumpOffMinutes",
+				label: t("Set pump rest time", "Imposta il tempo di riposo della pompa"),
+				phrase: t("Set the pump of {device} to rest {minutes} minutes per cycle", "Imposta la pompa di {device} a riposare {minutes} minuti per ciclo"),
+				icon: "timer-off",
+				openArgs: [{
+					key: "minutes",
+					label: t("Minutes", "Minuti"),
+					offer: {
+						kind: "number",
+						min: 0,
+						step: 1,
+						unit: "min"
+					}
+				}]
+			},
+			{
+				id: "petFountain.resetDailyConsumption",
+				method: "resetDailyConsumption",
+				label: t("Clear daily consumption", "Azzera il consumo giornaliero"),
+				phrase: t("Clear the daily water consumption of {device}", "Azzera il consumo giornaliero di acqua di {device}"),
+				icon: "rotate-ccw"
+			}
+		],
+		state: [{
+			kind: "boolean",
+			field: "empty",
+			label: t("Tank empty", "Serbatoio vuoto"),
+			whenTrue: t("When the tank of {device} is empty", "Quando il serbatoio di {device} è vuoto"),
+			whenFalse: t("When the tank of {device} is refilled", "Quando il serbatoio di {device} viene riempito"),
+			icon: "droplet"
+		}, {
+			kind: "numeric",
+			field: "waterLevel",
+			quantity: t("the water level", "il livello dell’acqua"),
+			label: t("Water level", "Livello dell’acqua"),
+			unit: "%",
+			icon: "droplets"
+		}]
+	},
 	"media-player": {
 		scope: "device",
 		noun: t("Media player", "Lettore multimediale"),
@@ -102224,6 +103048,7 @@ var SYSTEM_CAP_VOCABULARY = {
 	"device-manager": system("the device registry itself — rename, move and remove are administration"),
 	"device-provider": system(INTERNAL),
 	"device-removal-hook": system(INTERNAL),
+	"node-removal-hook": system(INTERNAL),
 	"device-state": system("the runtime-state mirror every trigger already reads through"),
 	"display-palette": system("the cluster display palette — one colour table for every client, not a device action"),
 	"embedding-encoder": system(ML),
@@ -102455,6 +103280,7 @@ var DEVICE_TYPE_DO_CAPS = {
 	[require_err_msg.DeviceType.Container]: [],
 	[require_err_msg.DeviceType.Image]: [],
 	[require_err_msg.DeviceType.PetFeeder]: ["pet-feeder"],
+	[require_err_msg.DeviceType.PetFountain]: ["pet-fountain"],
 	[require_err_msg.DeviceType.Dishwasher]: ["dishwasher"],
 	[require_err_msg.DeviceType.Washer]: [],
 	[require_err_msg.DeviceType.Dryer]: []
@@ -104073,6 +104899,7 @@ var CAP_NAMES_WITH_STATUS = [
 	"numeric-sensor",
 	"osd",
 	"pet-feeder",
+	"pet-fountain",
 	"power-meter",
 	"presence",
 	"pressure-sensor",
@@ -104216,6 +105043,7 @@ var CAPABILITY_NAMES = {
 	networkLink: "network-link",
 	networkQuality: "network-quality",
 	nodeCertificates: "node-certificates",
+	nodeRemovalHook: "node-removal-hook",
 	nodes: "nodes",
 	notificationOutput: "notification-output",
 	notificationRules: "notification-rules",
@@ -104226,6 +105054,7 @@ var CAPABILITY_NAMES = {
 	osd: "osd",
 	osdManager: "osd-manager",
 	petFeeder: "pet-feeder",
+	petFountain: "pet-fountain",
 	pipelineAnalytics: "pipeline-analytics",
 	pipelineExecutor: "pipeline-executor",
 	pipelineOrchestrator: "pipeline-orchestrator",
@@ -104754,6 +105583,10 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "nodeCertificates",
 		name: "node-certificates"
 	},
+	{
+		key: "nodeRemovalHook",
+		name: "node-removal-hook"
+	},
 	{
 		key: "nodes",
 		name: "nodes"
@@ -104794,6 +105627,10 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "petFeeder",
 		name: "pet-feeder"
 	},
+	{
+		key: "petFountain",
+		name: "pet-fountain"
+	},
 	{
 		key: "pipelineAnalytics",
 		name: "pipeline-analytics"
@@ -105069,7 +105906,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	actionSourceCapability,
 	actionsCapability,
 	addonPagesCapability,
-	addonPagesSourceCapability,
+	require_sleep.addonPagesSourceCapability,
 	addonRoutesCapability,
 	addonSettingsCapability,
 	addonWidgetsCapability,
@@ -105180,6 +106017,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	networkLinkCapability,
 	networkQualityCapability,
 	nodeCertificatesCapability,
+	nodeRemovalHookCapability,
 	nodesCapability,
 	notificationOutputCapability,
 	notificationRulesCapability,
@@ -105190,6 +106028,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	osdCapability,
 	osdManagerCapability,
 	petFeederCapability,
+	petFountainCapability,
 	pipelineAnalyticsCapability,
 	pipelineExecutorCapability,
 	pipelineOrchestratorCapability,
@@ -106768,6 +107607,36 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"petFountain.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFountain.resetDailyConsumption": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFountain.setPump": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFountain.setPumpInterval": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFountain.setPumpOffMinutes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"petFountain.setPumpOnMinutes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.addRetrainFrameFromRecording": [{
 		name: "deviceId",
 		form: "single",
@@ -108325,7 +109194,7 @@ function getCapsByProviderKind(kind) {
 //#region src/generated/runtime-state-durability.ts
 /**
 * Per-cap runtime-state policy, projected from every `*.cap.ts` that declares
-* `runtimeState`. 76 caps: 39 `restored`, 37 `session`.
+* `runtimeState`. 77 caps: 39 `restored`, 38 `session`.
 *
 * A cap absent from this map has no runtime-state slice at all. A cap PRESENT
 * with `durability: 'session'` has one and has decided not to keep it.
@@ -108531,6 +109400,10 @@ var RUNTIME_STATE_POLICY = {
 		durability: "session",
 		volatileFields: []
 	},
+	"pet-fountain": {
+		durability: "session",
+		volatileFields: []
+	},
 	"power-meter": {
 		durability: "restored",
 		volatileFields: ["lastFetchedAt"]
@@ -109518,7 +110391,11 @@ function createSystemProxy(api) {
 			listSupportedDeviceKinds: (input) => dispatch("deviceExport", "listSupportedDeviceKinds", "query", input),
 			listExposedDevices: (input) => dispatch("deviceExport", "listExposedDevices", "query", input),
 			exposeDevice: (input) => dispatch("deviceExport", "exposeDevice", "mutation", input),
-			unexposeDevice: (input) => dispatch("deviceExport", "unexposeDevice", "mutation", input)
+			unexposeDevice: (input) => dispatch("deviceExport", "unexposeDevice", "mutation", input),
+			listSupportedEntityKinds: (input) => dispatch("deviceExport", "listSupportedEntityKinds", "query", input),
+			listExposedEntities: (input) => dispatch("deviceExport", "listExposedEntities", "query", input),
+			exposeEntity: (input) => dispatch("deviceExport", "exposeEntity", "mutation", input),
+			unexposeEntity: (input) => dispatch("deviceExport", "unexposeEntity", "mutation", input)
 		},
 		deviceHistory: {
 			listNodeSeries: (input) => dispatch("deviceHistory", "listNodeSeries", "query", input),
@@ -119078,6 +119955,7 @@ var OAUTH_LANDING_REASONS = [
 	"unknown_broker",
 	"not_configured",
 	"exchange_failed",
+	"no_authorization_code",
 	"no_refresh_token",
 	"unavailable",
 	"unknown"
@@ -119305,6 +120183,83 @@ function filterForwardedCookies(cookieHeader) {
 	return cookieHeader.split(";").map((part) => part.trim()).filter((part) => part.length > 0 && !part.toLowerCase().startsWith("camstack_")).join("; ");
 }
 //#endregion
+//#region src/vendor-login-proxy/flow-trace.ts
+/** A short stable label for the attempt: enough to group lines, useless as a capability. */
+function attemptLabel(attemptId) {
+	let hash = 2166136261;
+	for (let i = 0; i < attemptId.length; i += 1) hash = Math.imul(hash ^ attemptId.charCodeAt(i), 16777619) >>> 0;
+	return hash.toString(16).padStart(8, "0");
+}
+/** Distinct parameter names of a `?a=1&b=2` string (or of a urlencoded body), in order. */
+function paramNames(query) {
+	const names = [];
+	const raw = query.startsWith("?") ? query.slice(1) : query;
+	for (const pair of raw.split("&")) {
+		if (pair.length === 0) continue;
+		const eq = pair.indexOf("=");
+		const rawName = eq === -1 ? pair : pair.slice(0, eq);
+		let name;
+		try {
+			name = decodeURIComponent(rawName.replace(/\+/g, " "));
+		} catch {
+			name = rawName;
+		}
+		if (!names.includes(name)) names.push(name);
+	}
+	return names;
+}
+function hasOa2(names) {
+	return names.some((name) => name.startsWith("openid.oa2.") || name === "openid.ns.oa2");
+}
+function cookieNamesOf(setCookies) {
+	return setCookies.map((c) => c.split(";")[0]?.split("=")[0]?.trim() ?? "");
+}
+function mediaType(contentType) {
+	return (contentType ?? "none").split(";")[0]?.trim().toLowerCase() || "none";
+}
+/** Host and path of a Location (no query), or 'unparsable'. */
+function locationShape(location, base) {
+	try {
+		const url = new URL(location, base);
+		return {
+			target: `${url.host}${url.pathname}`,
+			names: paramNames(url.search)
+		};
+	} catch {
+		return {
+			target: "unparsable",
+			names: []
+		};
+	}
+}
+/** The `meta` of one trace line. Values: never. */
+function flowTraceMeta(input) {
+	const queryNames = paramNames(input.requestSearch);
+	const formNames = input.formBody === null ? null : paramNames(input.formBody);
+	const meta = {
+		session: attemptLabel(input.attemptId),
+		method: input.method,
+		upstream: `${input.upstreamHost}${input.upstreamPath}`,
+		queryNames: queryNames.join(",") || "none",
+		oa2InQuery: hasOa2(queryNames),
+		status: input.status,
+		setCookieNames: cookieNamesOf(input.setCookies).join(",") || "none",
+		cookiesSent: (input.cookieHeader ?? "").split(";").filter((p) => p.trim().length > 0).length
+	};
+	if (formNames !== null) {
+		meta["contentType"] = mediaType(input.contentType);
+		meta["formNames"] = formNames.join(",") || "none";
+		meta["oa2InForm"] = hasOa2(formNames);
+	}
+	if (input.location !== null) {
+		const loc = locationShape(input.location, `http://${input.upstreamHost}/`);
+		meta["location"] = loc.target;
+		meta["locationQueryNames"] = loc.names.join(",") || "none";
+		meta["oa2InLocation"] = hasOa2(loc.names);
+	}
+	return meta;
+}
+//#endregion
 //#region src/vendor-login-proxy/login-proxy.ts
 var MAX_REQUEST_BODY_BYTES = 2 * 1024 * 1024;
 var MAX_TEXT_BODY_BYTES = 4 * 1024 * 1024;
@@ -119410,6 +120365,8 @@ var VendorLoginProxy = class {
 	#now;
 	#fetch;
 	#attempts = /* @__PURE__ */ new Map();
+	/** Trace lines written per attempt (bounded by FLOW_TRACE_MAX_LINES). */
+	#traced = /* @__PURE__ */ new Map();
 	constructor(options) {
 		this.#addonId = options.addonId;
 		this.#logger = options.logger;
@@ -119436,6 +120393,7 @@ var VendorLoginProxy = class {
 	}
 	close(attemptId) {
 		this.#attempts.delete(attemptId);
+		this.#traced.delete(attemptId);
 	}
 	isOpen(attemptId) {
 		const attempt = this.#attempts.get(attemptId);
@@ -119482,7 +120440,7 @@ var VendorLoginProxy = class {
 		const forwardedPrefix = (firstHeader(req.headers["x-forwarded-prefix"]) ?? "").replace(/\/+$/, "");
 		const attempt = this.#attempts.get(parsed.attemptId);
 		if (attempt === void 0 || this.#now() > attempt.expiresAtMs) {
-			if (attempt !== void 0) this.#attempts.delete(parsed.attemptId);
+			if (attempt !== void 0) this.close(parsed.attemptId);
 			this.#logger.info("vendor login proxy: attempt refused", { meta: {
 				addonId: this.#addonId,
 				reason: attempt === void 0 ? "missing" : "expired"
@@ -119507,13 +120465,17 @@ var VendorLoginProxy = class {
 		}
 		const method = (req.method ?? "GET").toUpperCase();
 		let body;
+		let formBodyRaw = null;
 		if (method !== "GET" && method !== "HEAD") {
 			const read = await readRequestBody(req);
 			if (read === "too-large") {
 				sendPlain(res, 413, "Request too large");
 				return;
 			}
-			body = isFormEncoded(req.headers["content-type"]) ? Buffer.from(rewriteFormBody(read.toString("utf8"), route), "utf8") : read;
+			if (isFormEncoded(req.headers["content-type"])) {
+				formBodyRaw = read.toString("utf8");
+				body = Buffer.from(rewriteFormBody(formBodyRaw, route), "utf8");
+			} else body = read;
 		}
 		const headers = this.#requestHeaders(req, route, upstream);
 		const upstreamRes = await this.#fetch(target, {
@@ -119538,6 +120500,19 @@ var VendorLoginProxy = class {
 			sentNames: cookieNames(headers["cookie"]),
 			vendorSets: setCookies.map(setCookieShape).join(" | ")
 		} });
+		this.#trace(parsed.attemptId, {
+			attemptId: parsed.attemptId,
+			method,
+			upstreamHost: upstream.host,
+			upstreamPath: target.pathname,
+			requestSearch: target.search,
+			formBody: formBodyRaw,
+			contentType: firstHeader(req.headers["content-type"]),
+			status: upstreamRes.status,
+			location,
+			setCookies,
+			cookieHeader: headers["cookie"]
+		});
 		const settled = await attempt.evaluate({
 			status: upstreamRes.status,
 			url: target.toString(),
@@ -119546,7 +120521,7 @@ var VendorLoginProxy = class {
 			bodyText: text
 		});
 		if (settled.kind === "done") {
-			this.#attempts.delete(parsed.attemptId);
+			this.close(parsed.attemptId);
 			this.#logger.info("vendor login proxy: sign-in finished", { meta: {
 				addonId: this.#addonId,
 				status: settled.landing.status
@@ -119570,6 +120545,16 @@ var VendorLoginProxy = class {
 		res.writeHead(upstreamRes.status, out);
 		await this.#pipeBody(upstreamRes, res);
 	}
+	/** One names-only line per proxied request, at most FLOW_TRACE_MAX_LINES per attempt. */
+	#trace(attemptId, input) {
+		const written = this.#traced.get(attemptId) ?? 0;
+		if (written >= 200) return;
+		this.#traced.set(attemptId, written + 1);
+		this.#logger.info("vendor login proxy: flow", { meta: {
+			addonId: this.#addonId,
+			...flowTraceMeta(input)
+		} });
+	}
 	#requestHeaders(req, route, upstream) {
 		const headers = {};
 		for (const [name, value] of Object.entries(req.headers)) {
@@ -120833,7 +121818,7 @@ exports.AddBrokerInputSchema = AddBrokerInputSchema;
 exports.AddRetrainFrameFromRecordingResultSchema = AddRetrainFrameFromRecordingResultSchema;
 exports.AddonAutoUpdateSchema = AddonAutoUpdateSchema;
 exports.AddonListItemSchema = AddonListItemSchema;
-exports.AddonPageDeclarationSchema = AddonPageDeclarationSchema;
+exports.AddonPageDeclarationSchema = require_sleep.AddonPageDeclarationSchema;
 exports.AddonPageInfoSchema = AddonPageInfoSchema;
 exports.AddonRoutesScopeSchema = AddonRoutesScopeSchema;
 exports.AdminLinkTargetEnum = AdminLinkTargetEnum;
@@ -121164,6 +122149,7 @@ exports.CompositionFieldSourceSchema = require_composition.CompositionFieldSourc
 exports.CompositionFieldStateKindSchema = CompositionFieldStateKindSchema;
 exports.CompositionFieldStateSchema = CompositionFieldStateSchema;
 exports.CompositionFieldsFeatureSchema = require_composition.CompositionFieldsFeatureSchema;
+exports.CompositionForwardArgSchema = require_composition.CompositionForwardArgSchema;
 exports.CompositionForwardCommandSchema = require_composition.CompositionForwardCommandSchema;
 exports.CompositionFromSourceSchema = require_composition.CompositionFromSourceSchema;
 exports.CompositionGetReadSchema = CompositionGetReadSchema;
@@ -121290,6 +122276,7 @@ exports.DEVICE_HISTORY_ENERGY_KEY = DEVICE_HISTORY_ENERGY_KEY;
 exports.DEVICE_HISTORY_ORPHAN_DELETE_MAX = DEVICE_HISTORY_ORPHAN_DELETE_MAX;
 exports.DEVICE_HISTORY_ORPHAN_LIST_MAX = DEVICE_HISTORY_ORPHAN_LIST_MAX;
 exports.DEVICE_HISTORY_QUERY_MANY_MAX_ITEMS = DEVICE_HISTORY_QUERY_MANY_MAX_ITEMS;
+exports.DEVICE_ID_FIELD = DEVICE_ID_FIELD;
 exports.DEVICE_NONCE_TTL_MS = DEVICE_NONCE_TTL_MS;
 exports.DEVICE_PROFILES = DEVICE_PROFILES;
 exports.DEVICE_RAMP = DEVICE_RAMP;
@@ -121472,6 +122459,8 @@ exports.ExportClipSubjectSchema = ExportClipSubjectSchema;
 exports.ExportDenseRangeSchema = ExportDenseRangeSchema;
 exports.ExportDenseSchema = ExportDenseSchema;
 exports.ExportDownloadSchema = ExportDownloadSchema;
+exports.ExportEntityKindSchema = ExportEntityKindSchema;
+exports.ExportEntityRefSchema = ExportEntityRefSchema;
 exports.ExportFootageSubjectSchema = ExportFootageSubjectSchema;
 exports.ExportOptionsSchema = ExportOptionsSchema;
 exports.ExportRecordSchema = ExportRecordSchema;
@@ -121481,7 +122470,9 @@ exports.ExportSpeedSchema = ExportSpeedSchema;
 exports.ExportStateSchema = ExportStateSchema;
 exports.ExportSubjectSchema = ExportSubjectSchema;
 exports.ExportTimelapseSchema = ExportTimelapseSchema;
+exports.ExposeEntityInputSchema = ExposeEntityInputSchema;
 exports.ExposedDeviceSchema = ExposedDeviceSchema;
+exports.ExposedEntitySchema = ExposedEntitySchema;
 exports.ExposureModeSchema = ExposureModeSchema;
 exports.ExpressionBindingSourceSchema = ExpressionBindingSourceSchema;
 exports.ExpressionEvalError = require_composition.ExpressionEvalError;
@@ -121517,6 +122508,7 @@ exports.FEEDER_EXAMPLE_ADDON_ID = FEEDER_EXAMPLE_ADDON_ID;
 exports.FEEDER_EXAMPLE_HA_DEVICE_ID = FEEDER_EXAMPLE_HA_DEVICE_ID;
 exports.FFMPEG_PATH_ENV = require_composition.FFMPEG_PATH_ENV;
 exports.FIRST_LEVEL_MACRO_CLASSES = FIRST_LEVEL_MACRO_CLASSES;
+exports.FORWARD_INPUT_KEY = require_composition.FORWARD_INPUT_KEY;
 exports.FULL_IMAGE_BBOX = FULL_IMAGE_BBOX;
 exports.FailureContributionSchema = FailureContributionSchema;
 exports.FailureCounters = FailureCounters;
@@ -122125,6 +123117,8 @@ exports.NodeDirectoryEntrySchema = NodeDirectoryEntrySchema;
 exports.NodeDirectorySchema = NodeDirectorySchema;
 exports.NodeHttpsStateSchema = NodeHttpsStateSchema;
 exports.NodeRecommendationSchema = NodeRecommendationSchema;
+exports.NodeRemovedInputSchema = NodeRemovedInputSchema;
+exports.NodeRemovedResultSchema = NodeRemovedResultSchema;
 exports.NotificationActionIconSchema = NotificationActionIconSchema;
 exports.NotificationActionSchema = NotificationActionSchema;
 exports.NotificationFormatSchema = NotificationFormatSchema;
@@ -122227,6 +123221,7 @@ exports.PcmSampleFormatSchema = PcmSampleFormatSchema;
 exports.PeerBytesTicketSchema = require_sleep.PeerBytesTicketSchema;
 exports.PerScopeBreakdownSchema = PerScopeBreakdownSchema;
 exports.PetFeederStatusSchema = PetFeederStatusSchema;
+exports.PetFountainStatusSchema = PetFountainStatusSchema;
 exports.PickStreamPreferencesSchema = PickStreamPreferencesSchema;
 exports.PickStreamRequirementsSchema = PickStreamRequirementsSchema;
 exports.PickedCamStreamSchema = PickedCamStreamSchema;
@@ -122234,8 +123229,8 @@ exports.PipelineAssignmentSchema = PipelineAssignmentSchema;
 exports.PipelineDefaultStepSchema = PipelineDefaultStepSchema;
 exports.PipelineEngineChoiceSchema = PipelineEngineChoiceSchema;
 exports.PipelineModelFormatStatusSchema = PipelineModelFormatStatusSchema;
-exports.PipelineRunResultBridge = PipelineRunResultBridge;
-exports.PipelineStepInputSchema = PipelineStepInputSchema;
+exports.PipelineRunResultBridge = require_sleep.PipelineRunResultBridge;
+exports.PipelineStepInputSchema = require_sleep.PipelineStepInputSchema;
 exports.PipelineValidationIssueSchema = PipelineValidationIssueSchema;
 exports.PipelineValidationResultSchema = PipelineValidationResultSchema;
 exports.PlaceholderReasonSchema = PlaceholderReasonSchema;
@@ -122824,6 +123819,7 @@ exports.UNIT_TABLE = UNIT_TABLE;
 exports.UNLOCK_CONFIRMATION = UNLOCK_CONFIRMATION;
 exports.USE_ROOT_MODEL_DEFAULTS = USE_ROOT_MODEL_DEFAULTS;
 exports.USE_ROOT_MODEL_SETTING_KEY = USE_ROOT_MODEL_SETTING_KEY;
+exports.UnexposeEntityInputSchema = UnexposeEntityInputSchema;
 exports.UnifiedBrokerInfoSchema = BrokerInfoSchema;
 exports.UnindexedFilterError = require_sleep.UnindexedFilterError;
 exports.UninstallNodeOutcomeSchema = UninstallNodeOutcomeSchema;
@@ -122928,7 +123924,7 @@ exports.actuatorMethodRow = actuatorMethodRow;
 exports.addonCatalogHref = addonCatalogHref;
 exports.addonIdOfActionId = addonIdOfActionId;
 exports.addonPagesCapability = addonPagesCapability;
-exports.addonPagesSourceCapability = addonPagesSourceCapability;
+exports.addonPagesSourceCapability = require_sleep.addonPagesSourceCapability;
 exports.addonRoutesCapability = addonRoutesCapability;
 exports.addonSettingsCapability = addonSettingsCapability;
 exports.addonWidgetsCapability = addonWidgetsCapability;
@@ -123084,6 +124080,8 @@ exports.collectSecretMarkerRefs = require_sleep.collectSecretMarkerRefs;
 exports.collectZodSecretPaths = require_sleep.collectZodSecretPaths;
 exports.colorCapability = colorCapability;
 exports.colorForKind = colorForKind;
+exports.commandMethodProblems = commandMethodProblems;
+exports.commandedMethods = commandedMethods;
 exports.commitWatchdogRestart = commitWatchdogRestart;
 exports.compareToTarget = compareToTarget;
 exports.compileExpression = require_composition.compileExpression;
@@ -123297,6 +124295,7 @@ exports.failureRate = failureRate;
 exports.fanControlCapability = fanControlCapability;
 exports.fanOutTargets = fanOutTargets;
 exports.featureFieldEntries = require_composition.featureFieldEntries;
+exports.featureForwards = featureForwards;
 exports.featureOfRole = featureOfRole;
 exports.featureProbeCapability = featureProbeCapability;
 exports.featureSources = require_composition.featureSources;
@@ -123324,6 +124323,9 @@ exports.formatParkedFor = formatParkedFor;
 exports.formatReading = formatReading;
 exports.formatSecretScope = require_sleep.formatSecretScope;
 exports.formulaProblem = formulaProblem;
+exports.forwardProblems = forwardProblems;
+exports.forwardSourceProblems = forwardSourceProblems;
+exports.forwardSourceRefs = forwardSourceRefs;
 exports.freshResults = freshResults;
 exports.fuseRecoveredDetections = fuseRecoveredDetections;
 exports.gasCapability = gasCapability;
@@ -123414,6 +124416,7 @@ exports.isEvent = require_sleep.isEvent;
 exports.isEventKindLabelKey = isEventKindLabelKey;
 exports.isEventOwnerType = isEventOwnerType;
 exports.isFirstLevelMacroClass = isFirstLevelMacroClass;
+exports.isForwardInputRef = require_composition.isForwardInputRef;
 exports.isHeldBackTemplateVar = isHeldBackTemplateVar;
 exports.isHistoryHelper = require_composition.isHistoryHelper;
 exports.isIconKey = isIconKey;
@@ -123559,6 +124562,7 @@ exports.nodeBenchmarkRefusals = nodeBenchmarkRefusals;
 exports.nodeCertificatesCapability = nodeCertificatesCapability;
 exports.nodePickerItems = nodePickerItems;
 exports.nodePin = require_sleep.nodePin;
+exports.nodeRemovalHookCapability = nodeRemovalHookCapability;
 exports.nodesCapability = nodesCapability;
 exports.normalizeAddonInitResult = require_sleep.normalizeAddonInitResult;
 exports.normalizeAudioLabel = normalizeAudioLabel;
@@ -123628,6 +124632,8 @@ exports.parseStreamParamsFormPatch = parseStreamParamsFormPatch;
 exports.parseTrainingEventLine = parseTrainingEventLine;
 exports.patchAudio = patchAudio;
 exports.petFeederCapability = petFeederCapability;
+exports.petFountainCapability = petFountainCapability;
+exports.petFountainFromEntitiesComposition = petFountainFromEntitiesComposition;
 exports.pickAccessoryControl = pickAccessoryControl;
 exports.pickAppLinkHub = pickAppLinkHub;
 exports.pickClusterStepModels = pickClusterStepModels;
@@ -123676,6 +124682,7 @@ exports.projectScalarAssignment = projectScalarAssignment;
 exports.projectSpanAssignment = projectSpanAssignment;
 exports.projectSubjectPath = projectSubjectPath;
 exports.providerMotionEvent = providerMotionEvent;
+exports.pruneDeletedEntities = pruneDeletedEntities;
 exports.ptzAutotrackCapability = ptzAutotrackCapability;
 exports.ptzCapability = ptzCapability;
 exports.publicEventCategories = require_event_category.publicEventCategories;
@@ -123805,6 +124812,7 @@ exports.ruleSection = ruleSection;
 exports.ruleSectionOf = ruleSectionOf;
 exports.ruleSeedForSection = ruleSeedForSection;
 exports.ruleTriggerZoneIds = ruleTriggerZoneIds;
+exports.runExportedAction = runExportedAction;
 exports.runFanOut = runFanOut;
 exports.runInferenceStep = runInferenceStep;
 exports.runSteps = runSteps;
@@ -123843,6 +124851,7 @@ exports.selectAssignedProfileSlots = require_sleep.selectAssignedProfileSlots;
 exports.selectRecoveryStep = selectRecoveryStep;
 exports.sendTimesForEditor = sendTimesForEditor;
 exports.sendTimesOfSchedule = sendTimesOfSchedule;
+exports.sendToExportedTarget = sendToExportedTarget;
 exports.sensorRaisedOf = sensorRaisedOf;
 exports.sensorTransitionNeverFires = sensorTransitionNeverFires;
 exports.sensorTransitionOffered = sensorTransitionOffered;