@camstack/types 1.2.443 → 1.2.445

package/dist/client.mjs

@@ -696,6 +696,10 @@ var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
 	*  integrations sharing the same food/desiccant/hopper surface. */
 	DeviceType["PetFeeder"] = "pet-feeder";
+	/** Pet water fountain — tank level, water drunk, pump and its duty cycle.
+	*  Installed with the `pet-fountain` cap. Reaches CamStack as loose entities
+	*  of a container and is BUILT as a composed device (D967). */
+	DeviceType["PetFountain"] = "pet-fountain";
 	/** Built-in dishwasher — program lifecycle, door / remote-start gates,
 	*  salt and rinse-aid levels. Installed with the `dishwasher` cap.
 	*  Sources: native Bosch Home Connect, reusable by similar integrations.
@@ -1114,6 +1118,431 @@ function optionalMethod(input, output, options) {
 	};
 }
 //#endregion
+//#region src/capabilities/notification-output.cap.ts
+/**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = z.enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = z.object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: z.string().optional(),
+	bytes: z.instanceof(Uint8Array).optional(),
+	mime: z.string().optional(),
+	name: z.string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = z.enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/**
+* The CLOSED icon vocabulary an action button may use.
+*
+* A closed set, not a free string, and that is the whole point: an arbitrary
+* icon name is one that ntfy renders, zentik silently drops, and nobody
+* notices — the same class of gap as a zone vocabulary nothing produced
+* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
+* declares `actionIcons: false` and the degrade engine strips the field.
+*
+* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
+* renderer's icon set; "acknowledge" survives an adapter that draws it
+* differently.
+*
+* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
+*
+* These names are for US. **No adapter may forward one verbatim.** Each maps
+* the whole set onto its own renderer's vocabulary through a
+* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
+* fallback, so adding a member here fails every adapter's build until someone
+* decides its glyph, which is the only place that decision can be made
+* honestly.
+*
+* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
+* `disarm` straight through; iOS feeds that string to
+* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
+* and every snooze and alarm button arrived BLANK. A pass-through is not a
+* mapping, and "the field is documented" is not "the value renders".
+*
+* Adding a member is TRAIN-BOUND. The enum lives in the published
+* `@camstack/server` closure and the cap seam validates against the HUB's copy,
+* so an addon that emits a token the running hub does not know does not lose an
+* icon — its whole `send` fails Zod validation and the notification never
+* arrives. Never emit a new token from an addon before the train carrying it.
+*/
+var NotificationActionIconSchema = z.enum([
+	"acknowledge",
+	"dismiss",
+	"silence",
+	"snooze",
+	"view",
+	"play",
+	"open",
+	"close",
+	"lock",
+	"unlock",
+	"arm",
+	"arm-home",
+	"arm-away",
+	"arm-night",
+	"disarm",
+	"light",
+	"alert",
+	"camera"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	url: z.string().optional(),
+	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
+	icon: NotificationActionIconSchema.optional(),
+	/**
+	* Renders in a warning style where the notifier supports it.
+	*
+	* A HINT, never a gate. The callback's authority is its token and nothing
+	* else — see `notification-center/action-token.ts` for what that does and
+	* does not buy.
+	*/
+	destructive: z.boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: z.enum(["navigate", "background"]).optional()
+});
+/** A delivery parameter value: what a notifier declared it takes. */
+var DeliveryParamValueSchema = z.union([
+	z.string(),
+	z.number(),
+	z.boolean()
+]);
+/**
+* One extra delivery parameter a notifier KIND declares (D938). A rule that
+* addresses a target of that kind may set it; a kind that declares nothing is
+* never handed one. The admin UI derives its control from this descriptor —
+* no editor knows a service by name.
+*
+* Optional fields are `.optional()`, never `.default()` (a Zod default does not
+* run on the addon cap path).
+*/
+var DeliveryParamSchema = z.object({
+	key: z.string().min(1),
+	label: z.string(),
+	/** i18n key of the label, resolved by the declaring addon's namespace. */
+	labelKey: z.string().optional(),
+	type: z.enum([
+		"enum",
+		"number",
+		"boolean",
+		"string"
+	]),
+	/** `enum` only: the closed set of accepted values. */
+	options: z.array(z.object({
+		value: z.string(),
+		label: z.string()
+	})).optional(),
+	/** `number` only. */
+	min: z.number().optional(),
+	max: z.number().optional(),
+	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
+	default: DeliveryParamValueSchema.optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = z.object({
+	body: z.string(),
+	title: z.string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: z.number().int().min(1).max(5).default(3),
+	level: z.string().optional(),
+	attachments: z.array(AttachmentSchema).optional(),
+	clickUrl: z.string().optional(),
+	actions: z.array(NotificationActionSchema).optional(),
+	sound: z.string().optional(),
+	ttl: z.number().optional(),
+	tag: z.string().optional(),
+	deviceId: z.number().optional(),
+	eventId: z.string().optional(),
+	metadata: z.record(z.string(), z.unknown()).optional(),
+	/**
+	* Values for the parameters the target's kind DECLARES in
+	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
+	* declaration by the sender; a notifier reads only the keys it declared.
+	*/
+	delivery: z.record(z.string(), DeliveryParamValueSchema).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: z.number().int().min(1).max(5).nullable(),
+	flags: z.object({
+		critical: z.boolean().optional(),
+		silent: z.boolean().optional(),
+		noPush: z.boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: z.array(z.string()).optional(),
+	description: z.string().optional()
+});
+/** Attachment capabilities for a kind (drives the degrade engine + test panel). */
+var TargetKindAttachmentsCapsSchema = z.object({
+	mediaTypes: z.array(AttachmentMediaTypeSchema),
+	mode: z.enum([
+		"url",
+		"bytes",
+		"both"
+	]),
+	max: z.number().int().nonnegative(),
+	maxBytes: z.number().int().positive().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = z.object({
+	attachments: TargetKindAttachmentsCapsSchema,
+	/** Max action buttons (0 = none). */
+	actions: z.number().int().nonnegative(),
+	/**
+	* Whether this kind renders a per-action ICON.
+	*
+	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
+	* run on the addon cap path — three production failures in one day taught
+	* this repo that once. Absent is read as false by the degrade engine, which
+	* is the safe direction: an icon that is not rendered costs nothing, an icon
+	* assumed and dropped costs the operator's trust in the field.
+	*/
+	actionIcons: z.boolean().optional(),
+	levels: z.array(TargetKindLevelSchema),
+	format: z.array(NotificationFormatSchema),
+	clickUrl: z.boolean(),
+	sound: z.boolean(),
+	ttl: z.boolean(),
+	bodyMaxLen: z.number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough = z.unknown();
+var TargetKindSchema = z.object({
+	kind: z.string(),
+	label: z.string(),
+	icon: z.string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: z.string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: z.string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: z.string().optional(),
+	configSchema: ConfigSchemaPassthrough,
+	/**
+	* The config keys that decide WHERE this kind's secrets are sent (server,
+	* base URL, instance, chat, recipient). A save that changes any of them
+	* while leaving a secret redacted is refused by the provider (D634), so an
+	* editor uses this to ask for the secret on exactly those edits instead of
+	* on every edit.
+	*
+	* Optional: absent from a provider that holds no secret (the Home Assistant
+	* kinds) and from a provider older than this field — an editor that finds
+	* it absent must assume ANY edit may need the secret.
+	*/
+	destinationKeys: z.array(z.string()).optional(),
+	supportsDiscovery: z.boolean(),
+	/**
+	* Extra delivery parameters a rule may set for a target of this kind (D938).
+	* Absent = none; the rule editor then offers nothing.
+	*/
+	deliveryParams: z.array(DeliveryParamSchema).optional(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	kind: z.string(),
+	addonId: z.string(),
+	enabled: z.boolean(),
+	config: z.record(z.string(), z.unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = z.object({
+	kind: z.string(),
+	suggestedName: z.string(),
+	config: z.record(z.string(), z.unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = z.object({
+	level: z.string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: z.number().int().nonnegative(),
+	actionsSent: z.number().int().nonnegative(),
+	truncated: z.boolean(),
+	dropped: z.array(z.string())
+});
+var SendResultSchema = z.object({
+	success: z.boolean(),
+	error: z.string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+/**
+* Pre-save credential probe against a partial (unsaved) target config.
+* `resolvedUrl` never includes secrets (token stripped from path).
+*/
+var ProbeTargetConfigResultSchema = z.object({
+	ok: z.boolean(),
+	resolvedUrl: z.string(),
+	httpStatus: z.number().int().optional(),
+	stateInstance: z.string().optional(),
+	error: z.string().optional()
+});
+method(z.object({}), z.array(TargetKindSchema)), method(z.object({}), z.array(TargetSchema), { auth: "admin" }), method(z.object({ targetId: z.string() }), TargetSchema, { auth: "admin" }), method(z.object({
+	kind: z.string(),
+	config: z.record(z.string(), z.unknown()).optional(),
+	/**
+	* When editing / duplicating, the blank password field never round-trips
+	* the stored token. Pass the source target id so the provider can restore
+	* secrets server-side before dialling (same merge as upsert).
+	*/
+	targetId: z.string().optional()
+}), z.array(DiscoveredTargetSchema), { auth: "admin" }), method(z.object({
+	kind: z.string(),
+	config: z.record(z.string(), z.unknown()),
+	/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
+	targetId: z.string().optional()
+}), ProbeTargetConfigResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(z.object({
+	targetId: z.string(),
+	notification: NotificationSchema
+}), SendResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(z.object({
+	targetId: z.string(),
+	sample: NotificationSchema.optional()
+}), TestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(z.object({
+	target: TargetSchema,
+	/**
+	* Duplicate flow: create a NEW target id while copying secrets from an
+	* existing row. The UI never holds the stored token; blank / redacted
+	* password fields are restored from this source (D634 still applies if
+	* destinations diverge without a re-typed secret).
+	*/
+	cloneSecretsFrom: z.string().optional()
+}), TargetSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(z.object({ targetId: z.string() }), z.void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(z.object({
+	targetId: z.string(),
+	enabled: z.boolean()
+}), z.void(), {
+	kind: "mutation",
+	auth: "admin"
+});
+//#endregion
 //#region src/device/icon-catalog.generated.ts
 /** Lucide category ids, alphabetical. `ICON_META` indexes into this. */
 var ICON_CATEGORY_IDS = [
@@ -20775,827 +21204,402 @@ var ICON_SYNONYMS = {
 	store: [
 		"negozio",
 		"ingresso",
-		"vetrina",
-		"shop"
-	],
-	sun: [
-		"sole",
-		"luminosita",
-		"giorno",
-		"esterno",
-		"outdoor"
-	],
-	"sun-medium": ["sole", "luminosita"],
-	sunrise: ["alba"],
-	tablet: ["ipad"],
-	thermometer: [
-		"temperatura",
-		"termometro",
-		"termostato"
-	],
-	"thermometer-snowflake": [
-		"freddo",
-		"temperatura",
-		"bassa"
-	],
-	"thermometer-sun": [
-		"caldo",
-		"temperatura",
-		"alta"
-	],
-	timer: ["conto", "rovescia"],
-	"toggle-left": [
-		"interruttore",
-		"switch",
-		"toggle"
-	],
-	"toggle-right": [
-		"interruttore",
-		"switch",
-		"toggle",
-		"acceso"
-	],
-	tractor: [
-		"trattore",
-		"tosaerba",
-		"giardino"
-	],
-	"train-front": ["treno"],
-	"tree-pine": [
-		"albero",
-		"pino",
-		"giardino"
-	],
-	trees: [
-		"giardino",
-		"alberi",
-		"esterno",
-		"parco",
-		"garden"
-	],
-	truck: [
-		"camion",
-		"furgone",
-		"consegna"
-	],
-	tv: ["televisore"],
-	umbrella: [
-		"tenda",
-		"markise",
-		"ombrellone",
-		"pergola",
-		"veranda",
-		"terrace"
-	],
-	user: ["persona", "utente"],
-	users: [
-		"persone",
-		"gruppo",
-		"famiglia"
-	],
-	utensils: [
-		"cucina",
-		"posate",
-		"sala",
-		"pranzo",
-		"kitchen"
-	],
-	vibrate: [
-		"vibrazione",
-		"urto",
-		"tamper"
-	],
-	video: [],
-	"video-off": ["video", "spento"],
-	"volume-2": [
-		"volume",
-		"audio",
-		"altoparlante",
-		"suono"
-	],
-	"volume-x": [
-		"muto",
-		"silenziato",
-		"volume",
-		"spento"
-	],
-	warehouse: [
-		"magazzino",
-		"capanno",
-		"deposito",
-		"cantina",
-		"warehouse"
-	],
-	"washing-machine": [
-		"lavatrice",
-		"lavastoviglie",
-		"asciugatrice"
-	],
-	waves: [
-		"onde",
-		"acqua",
-		"vibrazione"
-	],
-	"waves-ladder": [
-		"piscina",
-		"vasca",
-		"pool"
-	],
-	wifi: ["rete", "segnale"],
-	"wifi-off": [
-		"wifi",
-		"assente",
-		"offline",
-		"disconnesso"
-	],
-	wind: [
-		"vento",
-		"aria",
-		"gas",
-		"monossido",
-		"co"
-	],
-	workflow: [
-		"automazione",
-		"flusso",
-		"scenario"
+		"vetrina",
+		"shop"
 	],
-	wrench: [
-		"officina",
-		"manutenzione",
-		"attrezzi",
-		"utenze"
+	sun: [
+		"sole",
+		"luminosita",
+		"giorno",
+		"esterno",
+		"outdoor"
 	],
-	zap: [
-		"energia",
-		"corrente",
-		"consumo",
-		"watt",
-		"elettricita"
-	]
-};
-/**
-* Spellings an operator may already have PERSISTED that no lucide package
-* accepts any more, and the catalog key they draw. They resolve
-* (`canonicalIconKey`) but are never offered. `gauge2` was this repo's own
-* pre-catalog spelling of `gauge`.
-*/
-var LEGACY_ICON_ALIASES = { gauge2: "gauge" };
-//#endregion
-//#region src/device/icon-catalog.ts
-/**
-* icon-catalog — THE icon vocabulary (D854).
-*
-* Every place that picks or stores an icon — a device's display override, a
-* location, a site zone, a viewer accessory, an `icon` settings field — names
-* it by a key of this catalog and nothing else. There is no curated subset and
-* no second list: the catalog is every lucide icon that both surfaces can draw
-* (the admin UI's `lucide-react` and the viewer's `lucide-react-native`), the
-* intersection computed by `scripts/generate-icon-catalog.ts` into the
-* committed `icon-catalog.generated.ts`.
-*
-* Like the vocabularies it replaces, this module holds STRINGS only — no React,
-* no lucide import, no glyph. Each surface owns its glyph table (the web one
-* lives in `ui-library`, loaded lazily), and a test on each side pins that it
-* covers {@link ICON_KEYS}.
-*
-* ## What is persisted
-*
-* The canonical kebab-case lucide id ({@link IconKey}). Spellings that a lucide
-* package still accepts (`home` for `house`) and this repo's own legacy ones
-* (`gauge2`) RESOLVE ({@link canonicalIconKey}) so a stored value never goes
-* stale, but they are never OFFERED by search.
-*
-* ## Search
-*
-* Over the key, the Italian/English overlay in `icon-synonyms.ts`, any words
-* the caller adds, and lucide's English tags — in that order of weight.
-*/
-var KEY_SET$1 = new Set(ICON_KEYS);
-var ALIAS_TO_KEY = new Map([...Object.entries(ICON_ALIASES), ...Object.entries(LEGACY_ICON_ALIASES)]);
-/** Is this a canonical key of the catalog? (An alias is not — see {@link canonicalIconKey}.) */
-function isIconKey(value) {
-	return typeof value === "string" && KEY_SET$1.has(value);
-}
-/**
-* A stored value as a catalog key: the key itself, the key a still-accepted or
-* legacy spelling stands for, or `undefined` — never a guess.
-*/
-function canonicalIconKey(value) {
-	if (typeof value !== "string") return void 0;
-	if (isIconKey(value)) return value;
-	return ALIAS_TO_KEY.get(value);
-}
-/**
-* A stored icon value as a catalog key: its canonical key when it is (or
-* aliases) one, `fallback` otherwise. For an `icon` settings field whose stored
-* value may predate the catalog (a free-text lucide name) — the field's default
-* is drawn rather than nothing.
-*/
-function resolveIconKey(value, fallback) {
-	return canonicalIconKey(value) ?? fallback;
-}
-/**
-* Wire/storage schema for one icon key.
-*
-* Deliberately NOT a `z.enum` of the catalog: ~1,700 literals would be inlined
-* into every cap router, type and API-reference row that carries an icon. The
-* check is membership in the catalog and the type is {@link IconKey}.
-*/
-var IconKeySchema = z.custom(isIconKey, "Not an icon of the catalog");
-var ENTRIES = ICON_KEYS.map((key, index) => {
-	const [categoryIndexes, tags] = ICON_META[index] ?? [[], []];
-	const categories = categoryIndexes.flatMap((i) => {
-		const id = ICON_CATEGORY_IDS[i];
-		return id === void 0 ? [] : [id];
-	});
-	return {
-		key,
-		categories,
-		primaryCategory: categories[0] ?? ICON_CATEGORY_IDS[0],
-		tags,
-		synonyms: ICON_SYNONYMS[key] ?? []
-	};
-});
-var ENTRY_BY_KEY = new Map(ENTRIES.map((e) => [e.key, e]));
-/** The entry for a canonical key, or `undefined`. */
-function iconEntry(key) {
-	return ENTRY_BY_KEY.get(key);
-}
-/** Every entry, in key order. */
-var ICON_ENTRIES = ENTRIES;
-/** Categories a picker offers first: the ones this product's icons mostly live in. */
-var LEADING_CATEGORIES = [
-	"devices",
-	"home",
-	"security",
-	"buildings",
-	"connectivity",
-	"multimedia",
-	"nature",
-	"weather",
-	"transportation",
-	"animals"
-];
-var PRIMARY_CATEGORIES = new Set(ENTRIES.map((e) => e.primaryCategory));
-/**
-* The categories a picker files icons under, in picker order: the leading ones,
-* then the rest alphabetically. Only categories that are some icon's PRIMARY
-* one — a category lucide lists only as a secondary has no section of its own.
-*/
-var ICON_CATEGORIES = [...LEADING_CATEGORIES, ...ICON_CATEGORY_IDS.filter((c) => !LEADING_CATEGORIES.includes(c))].filter((c) => PRIMARY_CATEGORIES.has(c));
-/** The icons filed under a category as their PRIMARY one, in key order. */
-function iconsInCategory(category) {
-	return ENTRIES.filter((e) => e.primaryCategory === category);
-}
-function normalise(text) {
-	return text.normalize("NFD").replace(/\p{Diacritic}/gu, "").toLowerCase().replace(/[_-]+/g, " ").trim();
-}
-/** Does `needle` appear in `haystack` in order, though not adjacently? */
-function isSubsequence(needle, haystack) {
-	let i = 0;
-	for (const ch of haystack) {
-		if (ch === needle[i]) i += 1;
-		if (i === needle.length) return true;
-	}
-	return needle.length === 0;
-}
-/**
-* How well one word answers the query. 0 = not at all. An exact word beats a
-* prefix, a prefix beats a word STARTING inside the phrase, and a loose
-* subsequence comes last because it matches almost anything.
-*/
-function scoreWord(query, word, loose) {
-	if (word === query) return 100;
-	if (word.startsWith(query)) return 80;
-	if (word.split(" ").some((w) => w.startsWith(query))) return 60;
-	if (word.includes(query)) return 40;
-	if (loose && isSubsequence(query, word)) return 15;
-	return 0;
-}
-var WORDS_CACHE = /* @__PURE__ */ new Map();
-/** Normalised once per entry — search runs on every keystroke over ~1,700 entries. */
-function wordsOf(entry) {
-	const cached = WORDS_CACHE.get(entry.key);
-	if (cached !== void 0) return cached;
-	const built = {
-		key: normalise(entry.key),
-		synonyms: entry.synonyms.map(normalise),
-		tags: entry.tags.map(normalise)
-	};
-	WORDS_CACHE.set(entry.key, built);
-	return built;
-}
-/**
-* Rank the catalog against a free-text query.
-*
-* An empty query returns the WHOLE catalog in key order, because a picker's
-* resting state is the full list. `extraWords` lets a caller add the words IT
-* can translate without this module knowing what a locale is; they score like a
-* synonym. The key outranks a synonym, a synonym outranks a lucide tag, and
-* ties keep key order so the list does not reshuffle between keystrokes.
-*/
-function searchIcons(query, extraWords) {
-	const q = normalise(query);
-	if (q.length === 0) return ENTRIES.map((entry) => ({
-		entry,
-		score: 0
-	}));
-	const hits = [];
-	for (const entry of ENTRIES) {
-		const words = wordsOf(entry);
-		const keyScore = scoreWord(q, words.key, true);
-		let best = keyScore > 0 ? keyScore + 2 : 0;
-		for (const word of [...words.synonyms, ...(extraWords?.get(entry.key) ?? []).map(normalise)]) {
-			const score = scoreWord(q, word, true);
-			if (score > 0 && score + 1 > best) best = score + 1;
-		}
-		for (const word of words.tags) {
-			const score = scoreWord(q, word, false);
-			if (score > best) best = score;
-		}
-		if (best > 0) hits.push({
-			entry,
-			score: best
-		});
-	}
-	return hits.toSorted((a, b) => b.score - a.score);
-}
-/** A readable label derived from a lucide category id (`food-beverage` → `Food beverage`). */
-function iconCategoryLabel(category) {
-	const spaced = category.replace(/-/g, " ");
-	return spaced.charAt(0).toUpperCase() + spaced.slice(1);
-}
-//#endregion
-//#region src/device/location-icon.ts
-/**
-* What a location's icon is, and the ONE key its label joins on.
-*
-* A location is not an entity — it is a free-form label (`PersistedDeviceMeta.
-* location`) plus an operator-curated registry of labels in the device-manager
-* addon store. The icon is a second map beside that registry, keyed the same
-* way the registry matches everywhere else: {@link locationIconKey}, i.e.
-* trimmed + lower-cased.
-*
-* The icon itself is a key of the ONE icon catalog (`icon-catalog.ts`, D854):
-* a location may wear any icon both surfaces can draw. There used to be a
-* closed 20-icon subset here (D511); it was a second vocabulary on the same two
-* surfaces and is gone. The names below keep their meaning:
-*
-* DEGRADATION IS A FALLBACK, NEVER A HOLE. A surface that cannot draw a stored
-* value — a persisted value from a newer hub, a hand-edited settings row —
-* draws {@link LOCATION_ICON_FALLBACK} (`map-pin`, the one every surface has
-* always had). Read a stored/wire value through
-* `resolveIconKey(value, LOCATION_ICON_FALLBACK)` and that is what you get;
-* nothing anywhere renders an empty box.
-*/
-/**
-* The id every surface is guaranteed to draw, and what an unrecognised value
-* degrades to. It has been in both icon sets since before the catalog existed
-* (the Locations page's own page icon), so "the fallback is missing" is not a
-* state a build can reach.
-*/
-var LOCATION_ICON_FALLBACK = "map-pin";
-z.object({
-	locationKey: z.string(),
-	icon: IconKeySchema
-});
+	"sun-medium": ["sole", "luminosita"],
+	sunrise: ["alba"],
+	tablet: ["ipad"],
+	thermometer: [
+		"temperatura",
+		"termometro",
+		"termostato"
+	],
+	"thermometer-snowflake": [
+		"freddo",
+		"temperatura",
+		"bassa"
+	],
+	"thermometer-sun": [
+		"caldo",
+		"temperatura",
+		"alta"
+	],
+	timer: ["conto", "rovescia"],
+	"toggle-left": [
+		"interruttore",
+		"switch",
+		"toggle"
+	],
+	"toggle-right": [
+		"interruttore",
+		"switch",
+		"toggle",
+		"acceso"
+	],
+	tractor: [
+		"trattore",
+		"tosaerba",
+		"giardino"
+	],
+	"train-front": ["treno"],
+	"tree-pine": [
+		"albero",
+		"pino",
+		"giardino"
+	],
+	trees: [
+		"giardino",
+		"alberi",
+		"esterno",
+		"parco",
+		"garden"
+	],
+	truck: [
+		"camion",
+		"furgone",
+		"consegna"
+	],
+	tv: ["televisore"],
+	umbrella: [
+		"tenda",
+		"markise",
+		"ombrellone",
+		"pergola",
+		"veranda",
+		"terrace"
+	],
+	user: ["persona", "utente"],
+	users: [
+		"persone",
+		"gruppo",
+		"famiglia"
+	],
+	utensils: [
+		"cucina",
+		"posate",
+		"sala",
+		"pranzo",
+		"kitchen"
+	],
+	vibrate: [
+		"vibrazione",
+		"urto",
+		"tamper"
+	],
+	video: [],
+	"video-off": ["video", "spento"],
+	"volume-2": [
+		"volume",
+		"audio",
+		"altoparlante",
+		"suono"
+	],
+	"volume-x": [
+		"muto",
+		"silenziato",
+		"volume",
+		"spento"
+	],
+	warehouse: [
+		"magazzino",
+		"capanno",
+		"deposito",
+		"cantina",
+		"warehouse"
+	],
+	"washing-machine": [
+		"lavatrice",
+		"lavastoviglie",
+		"asciugatrice"
+	],
+	waves: [
+		"onde",
+		"acqua",
+		"vibrazione"
+	],
+	"waves-ladder": [
+		"piscina",
+		"vasca",
+		"pool"
+	],
+	wifi: ["rete", "segnale"],
+	"wifi-off": [
+		"wifi",
+		"assente",
+		"offline",
+		"disconnesso"
+	],
+	wind: [
+		"vento",
+		"aria",
+		"gas",
+		"monossido",
+		"co"
+	],
+	workflow: [
+		"automazione",
+		"flusso",
+		"scenario"
+	],
+	wrench: [
+		"officina",
+		"manutenzione",
+		"attrezzi",
+		"utenze"
+	],
+	zap: [
+		"energia",
+		"corrente",
+		"consumo",
+		"watt",
+		"elettricita"
+	]
+};
 /**
-* The join key for a location label: trimmed, lower-cased. The ONE place this
-* derivation lives — a caller that re-spells it is a rename away from an
-* orphaned icon.
+* Spellings an operator may already have PERSISTED that no lucide package
+* accepts any more, and the catalog key they draw. They resolve
+* (`canonicalIconKey`) but are never offered. `gauge2` was this repo's own
+* pre-catalog spelling of `gauge`.
 */
-function locationIconKey(label) {
-	return label.trim().toLowerCase();
-}
-z.object({
-	locationKey: z.string(),
-	description: z.string()
-});
+var LEGACY_ICON_ALIASES = { gauge2: "gauge" };
 //#endregion
-//#region src/capabilities/notification-output.cap.ts
-/**
-* notification-output — canonical, capability-gated notification delivery.
-*
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
-*
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
-*
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = z.enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = z.object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: z.string().optional(),
-	bytes: z.instanceof(Uint8Array).optional(),
-	mime: z.string().optional(),
-	name: z.string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = z.enum([
-	"text",
-	"markdown",
-	"html"
-]);
+//#region src/device/icon-catalog.ts
 /**
-* The CLOSED icon vocabulary an action button may use.
-*
-* A closed set, not a free string, and that is the whole point: an arbitrary
-* icon name is one that ntfy renders, zentik silently drops, and nobody
-* notices — the same class of gap as a zone vocabulary nothing produced
-* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
-* declares `actionIcons: false` and the degrade engine strips the field.
+* icon-catalog — THE icon vocabulary (D854).
 *
-* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
-* renderer's icon set; "acknowledge" survives an adapter that draws it
-* differently.
+* Every place that picks or stores an icon — a device's display override, a
+* location, a site zone, a viewer accessory, an `icon` settings field — names
+* it by a key of this catalog and nothing else. There is no curated subset and
+* no second list: the catalog is every lucide icon that both surfaces can draw
+* (the admin UI's `lucide-react` and the viewer's `lucide-react-native`), the
+* intersection computed by `scripts/generate-icon-catalog.ts` into the
+* committed `icon-catalog.generated.ts`.
 *
-* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
+* Like the vocabularies it replaces, this module holds STRINGS only — no React,
+* no lucide import, no glyph. Each surface owns its glyph table (the web one
+* lives in `ui-library`, loaded lazily), and a test on each side pins that it
+* covers {@link ICON_KEYS}.
 *
-* These names are for US. **No adapter may forward one verbatim.** Each maps
-* the whole set onto its own renderer's vocabulary through a
-* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
-* fallback, so adding a member here fails every adapter's build until someone
-* decides its glyph, which is the only place that decision can be made
-* honestly.
+* ## What is persisted
 *
-* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
-* `disarm` straight through; iOS feeds that string to
-* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
-* and every snooze and alarm button arrived BLANK. A pass-through is not a
-* mapping, and "the field is documented" is not "the value renders".
+* The canonical kebab-case lucide id ({@link IconKey}). Spellings that a lucide
+* package still accepts (`home` for `house`) and this repo's own legacy ones
+* (`gauge2`) RESOLVE ({@link canonicalIconKey}) so a stored value never goes
+* stale, but they are never OFFERED by search.
 *
-* Adding a member is TRAIN-BOUND. The enum lives in the published
-* `@camstack/server` closure and the cap seam validates against the HUB's copy,
-* so an addon that emits a token the running hub does not know does not lose an
-* icon — its whole `send` fails Zod validation and the notification never
-* arrives. Never emit a new token from an addon before the train carrying it.
+* ## Search
+*
+* Over the key, the Italian/English overlay in `icon-synonyms.ts`, any words
+* the caller adds, and lucide's English tags — in that order of weight.
 */
-var NotificationActionIconSchema = z.enum([
-	"acknowledge",
-	"dismiss",
-	"silence",
-	"snooze",
-	"view",
-	"play",
-	"open",
-	"close",
-	"lock",
-	"unlock",
-	"arm",
-	"arm-home",
-	"arm-away",
-	"arm-night",
-	"disarm",
-	"light",
-	"alert",
-	"camera"
-]);
-/** A single tap-through action button. */
-var NotificationActionSchema = z.object({
-	id: z.string(),
-	label: z.string(),
-	url: z.string().optional(),
-	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
-	icon: NotificationActionIconSchema.optional(),
-	/**
-	* Renders in a warning style where the notifier supports it.
-	*
-	* A HINT, never a gate. The callback's authority is its token and nothing
-	* else — see `notification-center/action-token.ts` for what that does and
-	* does not buy.
-	*/
-	destructive: z.boolean().optional(),
-	/**
-	* How the tap should REACH the url.
-	*
-	* `navigate` (absent, and every button authored before this field) opens it:
-	* the phone leaves the notification and shows whatever the callback returns.
-	* That is right for a button whose answer the operator wants to read.
-	*
-	* `background` fires it as a POST and stays put. It exists for the buttons
-	* whose whole point is not to interrupt — "silence this for 30 minutes" is
-	* an answer to the notification, and being thrown into a browser tab to
-	* confirm it costs more attention than the notification did. A backend that
-	* cannot do a background call renders it as an ordinary link (the adapters
-	* fall back rather than dropping the button), so this is a preference, never
-	* a requirement.
-	*/
-	mode: z.enum(["navigate", "background"]).optional()
-});
-/** A delivery parameter value: what a notifier declared it takes. */
-var DeliveryParamValueSchema = z.union([
-	z.string(),
-	z.number(),
-	z.boolean()
-]);
+var KEY_SET$1 = new Set(ICON_KEYS);
+var ALIAS_TO_KEY = new Map([...Object.entries(ICON_ALIASES), ...Object.entries(LEGACY_ICON_ALIASES)]);
+/** Is this a canonical key of the catalog? (An alias is not — see {@link canonicalIconKey}.) */
+function isIconKey(value) {
+	return typeof value === "string" && KEY_SET$1.has(value);
+}
 /**
-* One extra delivery parameter a notifier KIND declares (D938). A rule that
-* addresses a target of that kind may set it; a kind that declares nothing is
-* never handed one. The admin UI derives its control from this descriptor —
-* no editor knows a service by name.
+* A stored value as a catalog key: the key itself, the key a still-accepted or
+* legacy spelling stands for, or `undefined` — never a guess.
+*/
+function canonicalIconKey(value) {
+	if (typeof value !== "string") return void 0;
+	if (isIconKey(value)) return value;
+	return ALIAS_TO_KEY.get(value);
+}
+/**
+* A stored icon value as a catalog key: its canonical key when it is (or
+* aliases) one, `fallback` otherwise. For an `icon` settings field whose stored
+* value may predate the catalog (a free-text lucide name) — the field's default
+* is drawn rather than nothing.
+*/
+function resolveIconKey(value, fallback) {
+	return canonicalIconKey(value) ?? fallback;
+}
+/**
+* Wire/storage schema for one icon key.
 *
-* Optional fields are `.optional()`, never `.default()` (a Zod default does not
-* run on the addon cap path).
+* Deliberately NOT a `z.enum` of the catalog: ~1,700 literals would be inlined
+* into every cap router, type and API-reference row that carries an icon. The
+* check is membership in the catalog and the type is {@link IconKey}.
 */
-var DeliveryParamSchema = z.object({
-	key: z.string().min(1),
-	label: z.string(),
-	/** i18n key of the label, resolved by the declaring addon's namespace. */
-	labelKey: z.string().optional(),
-	type: z.enum([
-		"enum",
-		"number",
-		"boolean",
-		"string"
-	]),
-	/** `enum` only: the closed set of accepted values. */
-	options: z.array(z.object({
-		value: z.string(),
-		label: z.string()
-	})).optional(),
-	/** `number` only. */
-	min: z.number().optional(),
-	max: z.number().optional(),
-	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
-	default: DeliveryParamValueSchema.optional()
+var IconKeySchema = z.custom(isIconKey, "Not an icon of the catalog");
+var ENTRIES = ICON_KEYS.map((key, index) => {
+	const [categoryIndexes, tags] = ICON_META[index] ?? [[], []];
+	const categories = categoryIndexes.flatMap((i) => {
+		const id = ICON_CATEGORY_IDS[i];
+		return id === void 0 ? [] : [id];
+	});
+	return {
+		key,
+		categories,
+		primaryCategory: categories[0] ?? ICON_CATEGORY_IDS[0],
+		tags,
+		synonyms: ICON_SYNONYMS[key] ?? []
+	};
 });
+var ENTRY_BY_KEY = new Map(ENTRIES.map((e) => [e.key, e]));
+/** The entry for a canonical key, or `undefined`. */
+function iconEntry(key) {
+	return ENTRY_BY_KEY.get(key);
+}
+/** Every entry, in key order. */
+var ICON_ENTRIES = ENTRIES;
+/** Categories a picker offers first: the ones this product's icons mostly live in. */
+var LEADING_CATEGORIES = [
+	"devices",
+	"home",
+	"security",
+	"buildings",
+	"connectivity",
+	"multimedia",
+	"nature",
+	"weather",
+	"transportation",
+	"animals"
+];
+var PRIMARY_CATEGORIES = new Set(ENTRIES.map((e) => e.primaryCategory));
 /**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
+* The categories a picker files icons under, in picker order: the leading ones,
+* then the rest alphabetically. Only categories that are some icon's PRIMARY
+* one — a category lucide lists only as a secondary has no section of its own.
 */
-var NotificationSchema = z.object({
-	body: z.string(),
-	title: z.string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: z.number().int().min(1).max(5).default(3),
-	level: z.string().optional(),
-	attachments: z.array(AttachmentSchema).optional(),
-	clickUrl: z.string().optional(),
-	actions: z.array(NotificationActionSchema).optional(),
-	sound: z.string().optional(),
-	ttl: z.number().optional(),
-	tag: z.string().optional(),
-	deviceId: z.number().optional(),
-	eventId: z.string().optional(),
-	metadata: z.record(z.string(), z.unknown()).optional(),
-	/**
-	* Values for the parameters the target's kind DECLARES in
-	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
-	* declaration by the sender; a notifier reads only the keys it declared.
-	*/
-	delivery: z.record(z.string(), DeliveryParamValueSchema).optional()
-});
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = z.object({
-	id: z.string(),
-	label: z.string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: z.number().int().min(1).max(5).nullable(),
-	flags: z.object({
-		critical: z.boolean().optional(),
-		silent: z.boolean().optional(),
-		noPush: z.boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: z.array(z.string()).optional(),
-	description: z.string().optional()
-});
-/** Attachment capabilities for a kind (drives the degrade engine + test panel). */
-var TargetKindAttachmentsCapsSchema = z.object({
-	mediaTypes: z.array(AttachmentMediaTypeSchema),
-	mode: z.enum([
-		"url",
-		"bytes",
-		"both"
-	]),
-	max: z.number().int().nonnegative(),
-	maxBytes: z.number().int().positive().optional()
-});
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = z.object({
-	attachments: TargetKindAttachmentsCapsSchema,
-	/** Max action buttons (0 = none). */
-	actions: z.number().int().nonnegative(),
-	/**
-	* Whether this kind renders a per-action ICON.
-	*
-	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
-	* run on the addon cap path — three production failures in one day taught
-	* this repo that once. Absent is read as false by the degrade engine, which
-	* is the safe direction: an icon that is not rendered costs nothing, an icon
-	* assumed and dropped costs the operator's trust in the field.
-	*/
-	actionIcons: z.boolean().optional(),
-	levels: z.array(TargetKindLevelSchema),
-	format: z.array(NotificationFormatSchema),
-	clickUrl: z.boolean(),
-	sound: z.boolean(),
-	ttl: z.boolean(),
-	bodyMaxLen: z.number().int().positive()
-});
+var ICON_CATEGORIES = [...LEADING_CATEGORIES, ...ICON_CATEGORY_IDS.filter((c) => !LEADING_CATEGORIES.includes(c))].filter((c) => PRIMARY_CATEGORIES.has(c));
+/** The icons filed under a category as their PRIMARY one, in key order. */
+function iconsInCategory(category) {
+	return ENTRIES.filter((e) => e.primaryCategory === category);
+}
+function normalise(text) {
+	return text.normalize("NFD").replace(/\p{Diacritic}/gu, "").toLowerCase().replace(/[_-]+/g, " ").trim();
+}
+/** Does `needle` appear in `haystack` in order, though not adjacently? */
+function isSubsequence(needle, haystack) {
+	let i = 0;
+	for (const ch of haystack) {
+		if (ch === needle[i]) i += 1;
+		if (i === needle.length) return true;
+	}
+	return needle.length === 0;
+}
+/**
+* How well one word answers the query. 0 = not at all. An exact word beats a
+* prefix, a prefix beats a word STARTING inside the phrase, and a loose
+* subsequence comes last because it matches almost anything.
+*/
+function scoreWord(query, word, loose) {
+	if (word === query) return 100;
+	if (word.startsWith(query)) return 80;
+	if (word.split(" ").some((w) => w.startsWith(query))) return 60;
+	if (word.includes(query)) return 40;
+	if (loose && isSubsequence(query, word)) return 15;
+	return 0;
+}
+var WORDS_CACHE = /* @__PURE__ */ new Map();
+/** Normalised once per entry — search runs on every keystroke over ~1,700 entries. */
+function wordsOf(entry) {
+	const cached = WORDS_CACHE.get(entry.key);
+	if (cached !== void 0) return cached;
+	const built = {
+		key: normalise(entry.key),
+		synonyms: entry.synonyms.map(normalise),
+		tags: entry.tags.map(normalise)
+	};
+	WORDS_CACHE.set(entry.key, built);
+	return built;
+}
 /**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+* Rank the catalog against a free-text query.
+*
+* An empty query returns the WHOLE catalog in key order, because a picker's
+* resting state is the full list. `extraWords` lets a caller add the words IT
+* can translate without this module knowing what a locale is; they score like a
+* synonym. The key outranks a synonym, a synonym outranks a lucide tag, and
+* ties keep key order so the list does not reshuffle between keystrokes.
 */
-var ConfigSchemaPassthrough = z.unknown();
-var TargetKindSchema = z.object({
-	kind: z.string(),
-	label: z.string(),
-	icon: z.string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: z.string(),
-	/**
-	* URL of the kind's bundled BRAND icon, served by the providing addon over
-	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
-	* when the addon bundles no icon for that kind — the client then falls back
-	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
-	*
-	* Root-relative on purpose: it resolves against whatever origin serves a web
-	* client, and a native client joins it onto its own hub base.
-	*
-	* DECLARED here deliberately. It used to travel as an undeclared passthrough
-	* field that survived only because the runtime cap-router forwards provider
-	* output verbatim — so every consumer had to re-declare it by hand to stop
-	* its own Zod parse from stripping it, and the whole arrangement would have
-	* broken silently the moment output validation was tightened anywhere.
-	*/
-	iconUrl: z.string().optional(),
-	/**
-	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
-	*
-	* The server knows this and therefore says it, because the client cannot
-	* safely guess: a React-Native client renders SVG and raster through two
-	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
-	* not decode SVG on iOS/Android), so without this it silently fell back to a
-	* placeholder glyph for every vector icon while the web build looked fine.
-	*
-	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
-	* not been updated — a client that cannot determine the type should prefer
-	* its raster path, which is the safe default for an unknown image.
-	*/
-	iconMediaType: z.string().optional(),
-	configSchema: ConfigSchemaPassthrough,
-	/**
-	* The config keys that decide WHERE this kind's secrets are sent (server,
-	* base URL, instance, chat, recipient). A save that changes any of them
-	* while leaving a secret redacted is refused by the provider (D634), so an
-	* editor uses this to ask for the secret on exactly those edits instead of
-	* on every edit.
-	*
-	* Optional: absent from a provider that holds no secret (the Home Assistant
-	* kinds) and from a provider older than this field — an editor that finds
-	* it absent must assume ANY edit may need the secret.
-	*/
-	destinationKeys: z.array(z.string()).optional(),
-	supportsDiscovery: z.boolean(),
-	/**
-	* Extra delivery parameters a rule may set for a target of this kind (D938).
-	* Absent = none; the rule editor then offers nothing.
-	*/
-	deliveryParams: z.array(DeliveryParamSchema).optional(),
-	caps: TargetKindCapsSchema
-});
+function searchIcons(query, extraWords) {
+	const q = normalise(query);
+	if (q.length === 0) return ENTRIES.map((entry) => ({
+		entry,
+		score: 0
+	}));
+	const hits = [];
+	for (const entry of ENTRIES) {
+		const words = wordsOf(entry);
+		const keyScore = scoreWord(q, words.key, true);
+		let best = keyScore > 0 ? keyScore + 2 : 0;
+		for (const word of [...words.synonyms, ...(extraWords?.get(entry.key) ?? []).map(normalise)]) {
+			const score = scoreWord(q, word, true);
+			if (score > 0 && score + 1 > best) best = score + 1;
+		}
+		for (const word of words.tags) {
+			const score = scoreWord(q, word, false);
+			if (score > best) best = score;
+		}
+		if (best > 0) hits.push({
+			entry,
+			score: best
+		});
+	}
+	return hits.toSorted((a, b) => b.score - a.score);
+}
+/** A readable label derived from a lucide category id (`food-beverage` → `Food beverage`). */
+function iconCategoryLabel(category) {
+	const spaced = category.replace(/-/g, " ");
+	return spaced.charAt(0).toUpperCase() + spaced.slice(1);
+}
+//#endregion
+//#region src/device/location-icon.ts
 /**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
+* What a location's icon is, and the ONE key its label joins on.
+*
+* A location is not an entity — it is a free-form label (`PersistedDeviceMeta.
+* location`) plus an operator-curated registry of labels in the device-manager
+* addon store. The icon is a second map beside that registry, keyed the same
+* way the registry matches everywhere else: {@link locationIconKey}, i.e.
+* trimmed + lower-cased.
+*
+* The icon itself is a key of the ONE icon catalog (`icon-catalog.ts`, D854):
+* a location may wear any icon both surfaces can draw. There used to be a
+* closed 20-icon subset here (D511); it was a second vocabulary on the same two
+* surfaces and is gone. The names below keep their meaning:
+*
+* DEGRADATION IS A FALLBACK, NEVER A HOLE. A surface that cannot draw a stored
+* value — a persisted value from a newer hub, a hand-edited settings row —
+* draws {@link LOCATION_ICON_FALLBACK} (`map-pin`, the one every surface has
+* always had). Read a stored/wire value through
+* `resolveIconKey(value, LOCATION_ICON_FALLBACK)` and that is what you get;
+* nothing anywhere renders an empty box.
 */
-var TargetSchema = z.object({
-	id: z.string(),
-	name: z.string(),
-	kind: z.string(),
-	addonId: z.string(),
-	enabled: z.boolean(),
-	config: z.record(z.string(), z.unknown())
-});
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = z.object({
-	kind: z.string(),
-	suggestedName: z.string(),
-	config: z.record(z.string(), z.unknown())
-});
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = z.object({
-	level: z.string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: z.number().int().nonnegative(),
-	actionsSent: z.number().int().nonnegative(),
-	truncated: z.boolean(),
-	dropped: z.array(z.string())
-});
-var SendResultSchema = z.object({
-	success: z.boolean(),
-	error: z.string().optional(),
-	renderedAs: RenderedAsSchema.optional()
-});
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
 /**
-* Pre-save credential probe against a partial (unsaved) target config.
-* `resolvedUrl` never includes secrets (token stripped from path).
+* The id every surface is guaranteed to draw, and what an unrecognised value
+* degrades to. It has been in both icon sets since before the catalog existed
+* (the Locations page's own page icon), so "the fallback is missing" is not a
+* state a build can reach.
 */
-var ProbeTargetConfigResultSchema = z.object({
-	ok: z.boolean(),
-	resolvedUrl: z.string(),
-	httpStatus: z.number().int().optional(),
-	stateInstance: z.string().optional(),
-	error: z.string().optional()
+var LOCATION_ICON_FALLBACK = "map-pin";
+z.object({
+	locationKey: z.string(),
+	icon: IconKeySchema
 });
-method(z.object({}), z.array(TargetKindSchema)), method(z.object({}), z.array(TargetSchema), { auth: "admin" }), method(z.object({ targetId: z.string() }), TargetSchema, { auth: "admin" }), method(z.object({
-	kind: z.string(),
-	config: z.record(z.string(), z.unknown()).optional(),
-	/**
-	* When editing / duplicating, the blank password field never round-trips
-	* the stored token. Pass the source target id so the provider can restore
-	* secrets server-side before dialling (same merge as upsert).
-	*/
-	targetId: z.string().optional()
-}), z.array(DiscoveredTargetSchema), { auth: "admin" }), method(z.object({
-	kind: z.string(),
-	config: z.record(z.string(), z.unknown()),
-	/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
-	targetId: z.string().optional()
-}), ProbeTargetConfigResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(z.object({
-	targetId: z.string(),
-	notification: NotificationSchema
-}), SendResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(z.object({
-	targetId: z.string(),
-	sample: NotificationSchema.optional()
-}), TestResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(z.object({
-	target: TargetSchema,
-	/**
-	* Duplicate flow: create a NEW target id while copying secrets from an
-	* existing row. The UI never holds the stored token; blank / redacted
-	* password fields are restored from this source (D634 still applies if
-	* destinations diverge without a re-typed secret).
-	*/
-	cloneSecretsFrom: z.string().optional()
-}), TargetSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(z.object({ targetId: z.string() }), z.void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(z.object({
-	targetId: z.string(),
-	enabled: z.boolean()
-}), z.void(), {
-	kind: "mutation",
-	auth: "admin"
+/**
+* The join key for a location label: trimmed, lower-cased. The ONE place this
+* derivation lives — a caller that re-spells it is a rename away from an
+* orphaned icon.
+*/
+function locationIconKey(label) {
+	return label.trim().toLowerCase();
+}
+z.object({
+	locationKey: z.string(),
+	description: z.string()
 });
 //#endregion
 //#region src/catalogs/audio-classmap.ts
@@ -25797,7 +25801,8 @@ var TopologyNodeSchema = z.object({
 	isHub: z.boolean(),
 	isOnline: z.boolean(),
 	cpuPercent: z.number(),
-	memoryPercent: z.number(),
+	/** `null` when the node's memory read failed or it has not reported one (D393). */
+	memoryPercent: z.number().nullable(),
 	uptime: z.number(),
 	lastSeen: z.string(),
 	localIps: z.array(z.string()).readonly(),
@@ -27016,6 +27021,14 @@ function createDeviceProxy(api, binding, opts) {
 		setVolume: (input) => dispatch("pet-feeder", "petFeeder", "setVolume", "mutation", input),
 		getStatus: (input) => dispatch("pet-feeder", "petFeeder", "getStatus", "query", input)
 	};
+	const petFountainInterface = {
+		setPump: (input) => dispatch("pet-fountain", "petFountain", "setPump", "mutation", input),
+		setPumpInterval: (input) => dispatch("pet-fountain", "petFountain", "setPumpInterval", "mutation", input),
+		setPumpOnMinutes: (input) => dispatch("pet-fountain", "petFountain", "setPumpOnMinutes", "mutation", input),
+		setPumpOffMinutes: (input) => dispatch("pet-fountain", "petFountain", "setPumpOffMinutes", "mutation", input),
+		resetDailyConsumption: (input) => dispatch("pet-fountain", "petFountain", "resetDailyConsumption", "mutation", input),
+		getStatus: (input) => dispatch("pet-fountain", "petFountain", "getStatus", "query", input)
+	};
 	const pipelineAnalyticsInterface = {
 		getActiveTracks: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getActiveTracks", "query", input),
 		getTrack: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getTrack", "query", input),
@@ -27484,6 +27497,7 @@ function createDeviceProxy(api, binding, opts) {
 			notifier: createSliceHandle(stateSource, binding.deviceId, "notifier"),
 			numericSensor: createSliceHandle(stateSource, binding.deviceId, "numeric-sensor"),
 			petFeeder: createSliceHandle(stateSource, binding.deviceId, "pet-feeder"),
+			petFountain: createSliceHandle(stateSource, binding.deviceId, "pet-fountain"),
 			powerMeter: createSliceHandle(stateSource, binding.deviceId, "power-meter"),
 			presence: createSliceHandle(stateSource, binding.deviceId, "presence"),
 			pressureSensor: createSliceHandle(stateSource, binding.deviceId, "pressure-sensor"),
@@ -27574,6 +27588,7 @@ function createDeviceProxy(api, binding, opts) {
 		...bound("numeric-sensor") ? { numericSensor: numericSensorInterface } : {},
 		...bound("osd") ? { osd: osdInterface } : {},
 		...bound("pet-feeder") ? { petFeeder: petFeederInterface } : {},
+		...bound("pet-fountain") ? { petFountain: petFountainInterface } : {},
 		...bound("pipeline-analytics") ? { pipelineAnalytics: pipelineAnalyticsInterface } : {},
 		...bound("power-meter") ? { powerMeter: powerMeterInterface } : {},
 		...bound("presence") ? { presence: presenceInterface } : {},
@@ -28500,7 +28515,11 @@ function createSystemProxy(api) {
 			listSupportedDeviceKinds: (input) => dispatch("deviceExport", "listSupportedDeviceKinds", "query", input),
 			listExposedDevices: (input) => dispatch("deviceExport", "listExposedDevices", "query", input),
 			exposeDevice: (input) => dispatch("deviceExport", "exposeDevice", "mutation", input),
-			unexposeDevice: (input) => dispatch("deviceExport", "unexposeDevice", "mutation", input)
+			unexposeDevice: (input) => dispatch("deviceExport", "unexposeDevice", "mutation", input),
+			listSupportedEntityKinds: (input) => dispatch("deviceExport", "listSupportedEntityKinds", "query", input),
+			listExposedEntities: (input) => dispatch("deviceExport", "listExposedEntities", "query", input),
+			exposeEntity: (input) => dispatch("deviceExport", "exposeEntity", "mutation", input),
+			unexposeEntity: (input) => dispatch("deviceExport", "unexposeEntity", "mutation", input)
 		},
 		deviceHistory: {
 			listNodeSeries: (input) => dispatch("deviceHistory", "listNodeSeries", "query", input),
@@ -28950,7 +28969,9 @@ function createSystemProxy(api) {
 			checkServerUpdate: (input) => dispatch("serverManagement", "checkServerUpdate", "mutation", input),
 			applyServerUpdate: (input) => dispatch("serverManagement", "applyServerUpdate", "mutation", input),
 			rollbackServerUpdate: (input) => dispatch("serverManagement", "rollbackServerUpdate", "mutation", input),
-			restartServer: (input) => dispatch("serverManagement", "restartServer", "mutation", input)
+			restartServer: (input) => dispatch("serverManagement", "restartServer", "mutation", input),
+			getLaunchOverrides: (input) => dispatch("serverManagement", "getLaunchOverrides", "query", input),
+			setLaunchOverrides: (input) => dispatch("serverManagement", "setLaunchOverrides", "mutation", input)
 		},
 		settingsStore: {
 			get: (input) => dispatch("settingsStore", "get", "query", input),