@camstack/types 1.2.453 → 1.2.455

package/dist/client.js

@@ -80,6 +80,784 @@ function buildAlawTable() {
 buildUlawTable();
 buildAlawTable();
 //#endregion
+//#region src/enums/event-category.ts
+var EventCategory = /* @__PURE__ */ function(EventCategory) {
+	EventCategory["SystemBoot"] = "system.boot";
+	EventCategory["SystemAddonsReady"] = "system.addons-ready";
+	EventCategory["SystemRestarting"] = "system.restarting";
+	/**
+	* Fired exactly once after the hub finishes booting following a
+	* restart that was triggered by `RestartCoordinator` (today: framework
+	* live-update). Payload is the marker that was on disk at boot
+	* (`PendingRestartMarkerPayload`); admin UI listens for it to display a
+	* success toast describing what changed.
+	*
+	* Spec: docs/superpowers/specs/2026-05-14-framework-live-update-design.md
+	*/
+	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
+	/**
+	* The hub reissued its own TLS certificate at boot (`ensureTlsCert`).
+	* Emitted only when the material on disk actually changed, so an
+	* operator who trusted the old certificate by hand is told rather than
+	* discovering it as a browser error. Payload `TlsCertChangedPayload`.
+	*
+	* Rule: docs/decisions/adr-0227-*.md
+	*/
+	EventCategory["SystemTlsCertChanged"] = "system.tls-cert-changed";
+	/**
+	* A newer addon or server-root package version was found by the
+	* authoritative registry check. Emitted once when any observed
+	* `latestVersion` changes (or a package/node first appears behind);
+	* the payload carries the full currently-available list. Repeated
+	* polling of the same latests is silent.
+	*/
+	EventCategory["UpdateAvailable"] = "update.available";
+	/**
+	* Readiness transition for a capability provider. Every producer emits
+	* this event on `onInitialize` completion, `onDestroy`, and
+	* `$node.reconnect`; every consumer that needs to gate on a cross-process
+	* cap subscribes via the kernel's readiness module (`awaitReady` /
+	* `onReadyState`) instead of polling. Payload is
+	* `SystemReadyStatePayload` — see event-bus.ts.
+	*/
+	EventCategory["SystemReadyState"] = "system.ready-state";
+	EventCategory["AddonStarted"] = "addon.started";
+	EventCategory["AddonStopped"] = "addon.stopped";
+	EventCategory["AddonRestarted"] = "addon.restarted";
+	EventCategory["AddonUpdated"] = "addon.updated";
+	EventCategory["AddonInstalled"] = "addon.installed";
+	EventCategory["AddonUninstalled"] = "addon.uninstalled";
+	EventCategory["AddonCrashed"] = "addon.crashed";
+	/**
+	* A RUNNER the D6 crash circuit-breaker gave up on — terminal.
+	*
+	* `AddonCrashed` is the routine, self-healing fact ("it crashed; it is being
+	* respawned"); this is the one that never resolves itself. Emitted exactly
+	* once per trip, by `process-service.ts`, carrying the node, the runner, the
+	* addons it hosted and the crash count that tripped the breaker.
+	*
+	* It exists because a runner marked terminally `failed` used to be SILENT:
+	* on 2026-08-18 the `recorder` runner died of three unhandled ffmpeg spawn
+	* errors, the breaker stopped respawning it (correctly), `/health` kept
+	* returning 200, and fleet-wide recording was gone for 3h15 before the
+	* operator's phone told him. The Notification Center's system-event intake
+	* consumes this category and maps it to the `addon-crash-loop` kind.
+	*/
+	EventCategory["AddonRunnerFailed"] = "addon.runner-failed";
+	/**
+	* A runner whose addon refused to start with a typed reason (D877) - parked
+	* in `refused`, never counted by the crash breaker, retried on operator
+	* action. One event per refusal.
+	*/
+	EventCategory["AddonRunnerRefused"] = "addon.runner-refused";
+	/**
+	* A runner settled on a state (D877): `running` (READY), `crashed`, `failed` or
+	* `refused`. In-process telemetry for the boot check (re-evaluate while any
+	* runner is still pending) and the alert centre (close a recovered runner).
+	*/
+	EventCategory["ProcessStateChanged"] = "process.state-changed";
+	/**
+	* The node's one-shot runner boot check (D877): planned runners against the
+	* process service, `degraded` when any is failed, refused or missing. The
+	* alert centre turns it into one critical alert.
+	*/
+	EventCategory["SystemRunnerCheck"] = "system.runner-check";
+	/**
+	* An alert EPISODE opened or closed, emitted by the alert centre for alerts
+	* of severity `critical` or `error` (`AlertEpisodePayload`). The alert
+	* centre sends no notification of its own: Notification Center turns this
+	* into the `alert-critical` / `alert-error` / `alert-critical-resolved`
+	* system-event kinds, and reconciles from the alerts store because a bus
+	* event may be dropped (D8, D11).
+	*/
+	EventCategory["AlertEpisode"] = "alert.episode";
+	EventCategory["AddonError"] = "addon.error";
+	EventCategory["AddonPageReady"] = "addon.page-ready";
+	EventCategory["AddonWidgetReady"] = "addon.widget-ready";
+	/**
+	* Addon failed to load (import or initialize). Emitted by the kernel's
+	* AddonHealthMonitor only AFTER the boot grace period ends — failures
+	* during the first 5 minutes are silently retried without alerting
+	* (slow-starting addons must have time to come up). Post-grace, this
+	* event is emitted exactly once per failure-streak; AlertCenter
+	* consumes it to create a persistent operator-visible alert.
+	*
+	* Payload: `{ packageName, addonId?, error: { message, stack }, retryCount, nextRetryAt }`.
+	*/
+	EventCategory["AddonLoadFailed"] = "addon.load-failed";
+	/**
+	* A keychain value was stored or removed (D787). Carries the ref, its
+	* owner and the new version — NEVER the value. A process holding the ref
+	* drops its cached copy and the owning `BaseAddon` re-resolves its config.
+	* Telemetry (D8): a process that misses it still revalidates by version.
+	*/
+	EventCategory["KeychainChanged"] = "keychain.changed";
+	/**
+	* Addon recovered from a previous failure. Emitted when an addon
+	* transitions from `failed` back to `healthy` (typically via the
+	* monitor's auto-retry loop, or after manual `addons.retryLoad`).
+	* AlertCenter dismisses the corresponding `AddonLoadFailed` alert
+	* on this event.
+	*/
+	EventCategory["AddonLoadRecovered"] = "addon.load-recovered";
+	/**
+	* Monitor scheduled the next retry for a failed addon. Transient —
+	* surfaced to the UI for live-updating the "next retry in Ns"
+	* countdown on the Addons page row, NOT persisted as an alert.
+	*/
+	EventCategory["AddonRetryScheduled"] = "addon.retry-scheduled";
+	/**
+	* A liveness invariant of this node is false — it has no devices, every
+	* camera is offline, or a camera that was recording has stopped producing
+	* segments. Emitted by the `liveness-monitor` builtin, once per fault (the
+	* `findingId` is stable across ticks), only after its boot grace period.
+	* AlertCenter raises a persistent operator-visible alert.
+	*
+	* It exists because on 2026-08-03 the hub ran four hours with zero devices
+	* and zero recordings while every surface stayed quiet.
+	*
+	* Payload: `{ findingId, severity, title, message, deviceId? }`.
+	*/
+	EventCategory["SystemLivenessFailed"] = "system.liveness-failed";
+	/**
+	* A previously reported liveness fault is true again. AlertCenter dismisses
+	* the matching `SystemLivenessFailed` alert.
+	*
+	* Payload: `{ findingId }`.
+	*/
+	EventCategory["SystemLivenessRecovered"] = "system.liveness-recovered";
+	/**
+	* Monitor is attempting to reload a failed addon NOW. UI uses this
+	* to show a spinner during the retry attempt. Same transient nature
+	* as AddonRetryScheduled.
+	*/
+	EventCategory["AddonRetryAttempting"] = "addon.retry-attempting";
+	EventCategory["DeviceRegistered"] = "device.registered";
+	EventCategory["DeviceUnregistered"] = "device.unregistered";
+	EventCategory["DeviceEnabled"] = "device.enabled";
+	EventCategory["DeviceDisabled"] = "device.disabled";
+	EventCategory["DeviceSettingsUpdated"] = "device.settings-updated";
+	/**
+	* Emitted when the set of native capability providers bound to a device
+	* changes — e.g. an addon registers a new native cap via
+	* `DeviceContext.registerNativeCap`, or all native bindings for a device
+	* are cleared on removal. Hub consumers re-resolve device-proxy routes
+	* when this fires.
+	*/
+	EventCategory["DeviceBindingsChanged"] = "device.bindings-changed";
+	/**
+	* Emitted when the operator-organisational meta surface changes
+	* (`name` / `location` / `disabled`). Payload: `{deviceId, field,
+	* value}`. Live consumers (UI device list, alert center) react
+	* without polling. Distinct from `DeviceSettingsUpdated` which
+	* fires on hardware-config changes (host/port/credentials/etc).
+	*/
+	EventCategory["DeviceMetaChanged"] = "device.meta-changed";
+	/**
+	* Emitted by `BaseDevice.updateSourceInfo()` after a successful patch
+	* to the device's upstream-system identity / rendering envelope. The
+	* full new SourceInfo travels in the payload so cross-process listeners
+	* (UI, export adapters) don't need to re-read the meta blob.
+	*
+	* Payload: `{deviceId, sourceInfo}`.
+	*
+	* Distinct from `DeviceMetaChanged` which covers the operator-edited
+	* surface (`name` / `location` / `disabled`). The two share the
+	* persistence layer (both ride on `device-manager.setMetadata` for
+	* SourceInfo, or `setName`/`setLocation`/`setDisabled` for the meta
+	* fields) but consumers care about different subsets.
+	*/
+	EventCategory["DeviceSourceInfoChanged"] = "device.source-info-changed";
+	/**
+	* Emitted by DeviceStreamWiringService after a successful
+	* `stream-broker.registerDeviceStreams` call. Payload includes
+	* deviceId — consumers look up the full registered device info via
+	* `brokerManager.getRegisteredDevice(deviceId)`.
+	*
+	* Replaces the legacy `StreamRouterService.onDeviceRegistered` callback.
+	*/
+	EventCategory["DeviceStreamsRegistered"] = "device.streams-registered";
+	/**
+	* Device-level "fully provisioned" signal — the EXPORT trigger. Emitted once
+	* a device's persisted export-relevant shape (its `DeviceFeature` set) is
+	* established or changes, carrying `{deviceId, fingerprint, generation}`.
+	* Export adapters (Alexa / HAP) react to THIS instead of the chatty per-cap
+	* `DeviceBindingsChanged`, turning a boot's incomplete→complete trickle into
+	* one clean delta. `fingerprint` is `canonicalDeviceFingerprint(shape)`.
+	*
+	* Spec: docs/superpowers/specs/2026-06-01-alexa-hap-export-reconciler-design.md
+	*/
+	EventCategory["DeviceProvisioned"] = "device.provisioned";
+	/**
+	* Fires once when a device's initial feature-probe completes successfully
+	* (lastProbedAt 0→>0); exported shape is now stable. Telemetry (may be
+	* dropped) — consumers MUST also gate on the device record's `probed` flag.
+	*/
+	EventCategory["DeviceReady"] = "device.ready";
+	EventCategory["IntegrationEnabled"] = "integration.enabled";
+	EventCategory["IntegrationDisabled"] = "integration.disabled";
+	EventCategory["IntegrationDeleted"] = "integration.deleted";
+	/** Emitted when a broker connection's status flips (connected /
+	*  disconnected / error). Carries `{ brokerId, status, error? }`. */
+	EventCategory["BrokerStatusChanged"] = "broker.status-changed";
+	/** Emitted for every subscription-matched message routed by a
+	*  broker provider. Carries `{ brokerId, subscriptionId, key, payload }`.
+	*  Consumers filter by `brokerId` + `subscriptionId` in the handler. */
+	EventCategory["BrokerMessage"] = "broker.message";
+	EventCategory["ProviderStarted"] = "provider.started";
+	EventCategory["ProviderStopped"] = "provider.stopped";
+	EventCategory["ProcessCrashed"] = "process.crashed";
+	EventCategory["ProcessRestartScheduled"] = "process.restart_scheduled";
+	EventCategory["ProcessRestarted"] = "process.restarted";
+	/**
+	* The SET of storage locations changed — one was created, edited, enabled,
+	* disabled or deleted through `storage.upsertLocation` / `deleteLocation`.
+	*
+	* Telemetry, not a transaction (D8/D11): every consumer that re-resolves on
+	* it must also converge on its own periodic path, because a dropped event
+	* must not leave a node writing to yesterday's disk set forever. It exists
+	* because there was NO signal at all — an operator who added a second
+	* recordings disk in the admin UI got nothing, and the recorder kept its
+	* resolved locations until something else happened to re-resolve them
+	* (D387). Payload `StorageLocationsChangedPayload`.
+	*/
+	EventCategory["StorageLocationsChanged"] = "storage.locations-changed";
+	EventCategory["RecordingStarted"] = "recording.started";
+	EventCategory["RecordingStopped"] = "recording.stopped";
+	EventCategory["RecordingError"] = "recording.error";
+	EventCategory["RecordingHealthDegraded"] = "recording.health.degraded";
+	/** Recording enabled but no segment finalized for the NC stall window. */
+	EventCategory["RecordingHealthStalled"] = "recording.health.stalled";
+	/** Recovery from {@link RecordingHealthStalled}. */
+	EventCategory["RecordingHealthOk"] = "recording.health.ok";
+	EventCategory["RecordingStorageCritical"] = "recording.storage.critical";
+	/** Free space on a storage location crossed the warn bar. */
+	EventCategory["StorageLocationLow"] = "storage.location.low";
+	/** Free space at/under the critical bar, or capacity probe failed (`null`). */
+	EventCategory["StorageLocationCritical"] = "storage.location.critical";
+	/** Recovery from low/critical on a storage location. */
+	EventCategory["StorageLocationOk"] = "storage.location.ok";
+	EventCategory["RecordingSegmentWritten"] = "recording.segment.written";
+	EventCategory["RecordingPolicyFallback"] = "recording.policy.fallback";
+	EventCategory["RecordingRetentionCompleted"] = "recording.retention.completed";
+	/** Export render progress (0–100). Telemetry (D8): a lost tick is a stale
+	*  progress bar the client reconciles via `recordingExport.getExport`. */
+	EventCategory["RecordingExportProgress"] = "recording.export.progress";
+	EventCategory["RecordingExportCompleted"] = "recording.export.completed";
+	EventCategory["RecordingExportFailed"] = "recording.export.failed";
+	EventCategory["DetectionEvent"] = "detection.event";
+	EventCategory["SessionTrackNew"] = "session.track.new";
+	EventCategory["SessionTrackExpired"] = "session.track.expired";
+	EventCategory["BenchmarkProgress"] = "benchmark.progress";
+	EventCategory["PlatformProbePhase"] = "platform-probe.phase";
+	EventCategory["PipelineProgress"] = "pipeline.progress";
+	/** Per-frame execution trace emitted by the pipeline executor for live observability. */
+	EventCategory["PipelineTrace"] = "pipeline.trace";
+	/**
+	* Raw inference output emitted by `addon-pipeline-runner` after running the
+	* detection pipeline on a frame. Carries the `FrameResult` (with
+	* `detections[]`, `width`/`height`, timing debug) — never the frame
+	* buffer itself. Hub-side consumers (analysis pipeline, class filters,
+	* notifications) subscribe to this and re-emit `detection.result` after
+	* post-processing.
+	*/
+	EventCategory["PipelineInferenceResult"] = "pipeline.inference-result";
+	/**
+	* Camera lifecycle event emitted by `addon-pipeline-orchestrator` when it
+	* assigns or unassigns a camera to/from an agent. Carries no frame data;
+	* pure observability for UI dashboards and metrics consumers.
+	*/
+	EventCategory["PipelineCameraAssigned"] = "pipeline.camera-assigned";
+	EventCategory["PipelineCameraUnassigned"] = "pipeline.camera-unassigned";
+	/**
+	* A node the orchestrator would otherwise place cameras on has NO usable
+	* inference device: the operator enabled one or more accelerators there and
+	* the live probe reports every one of them unavailable. Emitted once per
+	* TRANSITION into that state (never per dispatch), and the node is dropped
+	* from the placement candidate set for as long as it holds.
+	*
+	* This exists because the state was previously invisible: agent-a
+	* absorbed 283k inference errors in a day while still being handed cameras,
+	* and nothing in the system said so.
+	*
+	* A node with no accelerators configured at all is NOT this — its devices
+	* are `disabled`, not `unavailable`, and the runner's default CPU pool
+	* serves it exactly as before.
+	*/
+	EventCategory["PipelineNodeInferenceUnavailable"] = "pipeline.node-inference-unavailable";
+	/**
+	* A camera has an OPEN detection session and has produced no detection at
+	* all for longer than the blind threshold — the camera is being decoded and
+	* inferred and is returning nothing. Emitted once per transition into blind,
+	* per camera.
+	*
+	* The failure it reports: a 1h43 detection blackout on the entrance camera
+	* that nobody noticed, because "a camera that detects nothing" and "a quiet
+	* camera" produce byte-identical silence.
+	*/
+	EventCategory["PipelineDetectionBlind"] = "pipeline.detection-blind";
+	/**
+	* A camera's motion source has fired constantly with no subject for an hour
+	* (motion duty or session count over the bar, zero detections) — it is not
+	* blind, its motion zones or sensitivity want tuning (D907). Paired with
+	* {@link PipelineMotionCalm}.
+	*/
+	EventCategory["PipelineMotionNoisy"] = "pipeline.motion-noisy";
+	/** The recovery edge of {@link PipelineMotionNoisy}: the motion fell back, or a detection arrived. */
+	EventCategory["PipelineMotionCalm"] = "pipeline.motion-calm";
+	/**
+	* A camera's package LLM confirm has failed closed three times in a row
+	* (D931, 2026-10-26). One edge per camera until
+	* {@link PipelinePackageLlmAnswered}.
+	*/
+	EventCategory["PipelinePackageLlmSilent"] = "pipeline.package-llm-silent";
+	/** The recovery edge of {@link PipelinePackageLlmSilent}: a confirm returned yes or no. */
+	EventCategory["PipelinePackageLlmAnswered"] = "pipeline.package-llm-answered";
+	/**
+	* Per-camera pipeline config was mutated by the orchestrator
+	* (a settings change via `setAgentInferenceDevices` /
+	* `setCameraStepToggle` / `setCameraStepSettings`). Orchestrator
+	* subscribes to its own emission to hot-reload the assigned runner
+	* via `attachCamera` so the next frame executes against the new
+	* engine/steps without waiting for a rebalance or the next
+	* `DeviceStreamsRegistered` cycle.
+	*/
+	EventCategory["PipelineCameraUpdated"] = "pipeline.camera-updated";
+	/**
+	* The cluster camera-source OWNER changed (`clusterRoles.ingestNode`).
+	* Emitted by addon-pipeline-orchestrator whenever it (re)derives node
+	* capabilities — at boot, on agent online/offline, and on an ingest-node
+	* flip. Carries the resolved `ownerNodeId`. The stream-broker consumes it to
+	* keep its ingest-owner-gate decision current WITHOUT a per-`ensureBroker`
+	* cross-process `getIngestOwner` query (push the authority's decision instead
+	* of polling it on the hot path). Idempotent state — re-emitted on every
+	* topology change, so a dropped event self-heals on the next one (plus the
+	* broker's long backstop reconcile query).
+	*/
+	EventCategory["PipelineIngestOwnerChanged"] = "pipeline.ingest-owner-changed";
+	/**
+	* Periodic snapshot of per-node pipeline-runner load
+	* (`RunnerLocalLoad`). Emitted ~1Hz by every runner so UI dashboards
+	* subscribe instead of polling `pipelineRunner.getLocalLoad`.
+	* `nodeId` carried in the payload + on `event.source.nodeId`.
+	*/
+	EventCategory["PipelineRunnerLoadSnapshot"] = "pipeline.runner-load-snapshot";
+	/**
+	* Periodic snapshot of per-camera pipeline metrics (`CameraMetrics`
+	* + `deviceId` + `nodeId`). Emitted ~1Hz by every runner for each
+	* attached camera. UI subscribes to drive overlay phase / fps /
+	* inference time without polling `getCameraMetrics`.
+	*/
+	EventCategory["PipelineCameraMetricsSnapshot"] = "pipeline.camera-metrics-snapshot";
+	/**
+	* Periodic snapshot of stream-broker per-broker statistics (input
+	* fps, decoded fps, bitrate, codec). Emitted ~1Hz by every
+	* stream-broker process for each active broker so the UI can drive
+	* the Stream / Cluster dashboards without polling
+	* `streamBroker.listAllProfileSlots` and friends.
+	*/
+	EventCategory["StreamBrokerMetricsSnapshot"] = "stream-broker.metrics-snapshot";
+	/**
+	* Cap event fired by `stream-broker` when a profile slot enters
+	* "demanded" state — a cam stream has been assigned and at least one
+	* consumer (RTSP restream, decoded subscriber, WebRTC session, …) is
+	* present. Camera-provider addons (Reolink Baichuan push, …)
+	* subscribe to this category to start their underlying transport
+	* lazily. Payload: `{ deviceId, camStreamId, profile }`.
+	*/
+	EventCategory["StreamBrokerOnCamStreamDemand"] = "stream-broker.onCamStreamDemand";
+	/**
+	* Cap event fired by `stream-broker` when the last consumer leaves a
+	* previously-demanded cam stream. Providers tear down their
+	* underlying transport on receipt. Payload: `{ deviceId, camStreamId }`.
+	*/
+	EventCategory["StreamBrokerOnCamStreamIdle"] = "stream-broker.onCamStreamIdle";
+	/**
+	* Cap event fired by `stream-broker` when a broker fails to dial a
+	* managed-loopback source (today: `pull-rfc4571`) and the publisher
+	* needs to refresh the cached URL. The lib's TCP server idle-tears-down
+	* on its own schedule, so a re-publish with a fresh `host:port` is the
+	* only way to keep the broker dialable. Camera providers (Reolink
+	* Baichuan native, …) subscribe and respond by re-running their publish
+	* pipeline.
+	* Payload: `{ deviceId, camStreamId, brokerId }`.
+	*/
+	EventCategory["StreamBrokerOnRequestStreamSourceRefresh"] = "stream-broker.onRequestStreamSourceRefresh";
+	/**
+	* A camera provider changed a device's stream parameters (codec /
+	* resolution / bitrate / a stream added or removed). A LOW-LATENCY NUDGE
+	* for the stream-broker's catalog reconcile: it carries NO authoritative
+	* data — the broker re-PULLS that device's `stream-catalog` cap on receipt
+	* (the 30s reconcile poll is the backstop if this nudge is dropped). Emitted
+	* by providers from `stream-params.setProfile`. Payload: `{ deviceId }`.
+	*/
+	EventCategory["StreamParamsChanged"] = "stream-params.changed";
+	/**
+	* Generic per-device runtime-state change. Fired by `device-manager`
+	* whenever a persisted slice in any cap's `runtimeState` shape
+	* mutates. Payload: `{deviceId, capName, slice}`. Subscribers are
+	* the `deviceState` cap router (cross-process listeners) and the
+	* deviceProxy reactive bindings (`device.state.<capName>.value`).
+	* Cap-specific events (`battery.onStatusChanged`, …) still fire
+	* — they're authoritative for callers that want a typed payload
+	* without filtering on `capName`.
+	*/
+	EventCategory["DeviceStateChanged"] = "device.state-changed";
+	/**
+	* The NATIVE shadow of a cap a composition has claimed fields of moved
+	* (D663). Payload: `{ deviceId, capName, native }` — what the provider
+	* wrote, BEFORE the owned fields are overlaid. Owner-only (D224): it is for
+	* the composer's native self-reads, and the public event routers refuse it
+	* (`isOwnerOnlyEventCategory`) so no consumer surface ever shows a second
+	* truth beside the merged `DeviceStateChanged.slice`. Emitted only under a
+	* `replace` claim, one per native write of that cap.
+	*/
+	EventCategory["DeviceNativeShadowChanged"] = "device.native-shadow-changed";
+	/**
+	* Frame occupancy for a camera CHANGED — a tracked object was gained or
+	* lost. Carries `{ deviceId, totalObjects, byClass, zones }`.
+	*
+	* Emitted only on a change, so a steady scene is silent. It exists so a
+	* client can stop polling `zoneAnalytics.getCurrentSnapshot`: that was the
+	* one live badge with no push signal at all, and it cost a request every
+	* four seconds per visible camera.
+	*
+	* Like every event it is telemetry and may be dropped ([D8]) — a consumer
+	* keeps a slow reconcile rather than trusting it alone.
+	*/
+	EventCategory["ZoneAnalyticsOccupancyChanged"] = "zone-analytics.occupancy-changed";
+	/**
+	* Cap event fired by every device that registers the `battery`
+	* capability. Mirrors the cap definition's `onStatusChanged`. Carries
+	* `{ deviceId, status: BatteryStatus }`. Subscribers (alert center,
+	* snapshot wrapper, UI) react to charge/sleep transitions without
+	* polling `batteryCapability.getStatus`.
+	*/
+	EventCategory["BatteryOnStatusChanged"] = "battery.onStatusChanged";
+	/**
+	* Cap event fired by every device that registers the `network-link`
+	* capability. Mirrors the cap definition's `onStatusChanged`. Carries
+	* `{ deviceId, status: NetworkLinkStatus }` — a link switch or a signal
+	* reading that moved.
+	*/
+	EventCategory["NetworkLinkOnStatusChanged"] = "network-link.onStatusChanged";
+	/**
+	* Emitted by the battery cap provider WHEN `wakeForStream` enters the
+	* "wake in progress" window — between the Baichuan wake-up issue and
+	* the camera's first dialed-back RTP packet. The stream-broker
+	* manager subscribes to flip the per-broker placeholder reason to
+	* `'waking'` so viewers see a labelled "WAKING UP" tile instead of
+	* the generic `'reconnecting'` frame. Carries `{ deviceId }`. The
+	* complementary "wake complete" signal is the existing
+	* `BatteryOnStatusChanged { sleeping: false }` event.
+	*/
+	EventCategory["BatteryOnWakeStarted"] = "battery.onWakeStarted";
+	/**
+	* Cap event fired by every device that registers the `doorbell`
+	* capability. Mirrors `doorbellCapability.events.onPressed`. Carries
+	* `{ deviceId, timestamp }`. Operators consuming the UI subscribe
+	* here to render transient ring toasts and a "Recent presses" row
+	* on the device detail page.
+	*/
+	EventCategory["DoorbellOnPressed"] = "doorbell.onPressed";
+	/** Mirrors `runningStateCapability.events.onStarted`. */
+	EventCategory["RunningStarted"] = "running.started";
+	/** Mirrors `runningStateCapability.events.onFinished`. */
+	EventCategory["RunningFinished"] = "running.finished";
+	/**
+	* Cap event fired by every device that registers the `event-emitter`
+	* capability. Mirrors `eventEmitterCapability.events.onEvent`. Carries
+	* `{ deviceId, eventType, data, timestamp, seq }` — the device's EXACT
+	* declared event verbatim (NO normalization). Subscribers (UI event
+	* stream, advanced-notifier rules) react to fired events without
+	* holding a cap reference.
+	*/
+	EventCategory["EventEmitted"] = "event-emitter.event";
+	/**
+	* Periodic snapshot of the per-node detection-pipeline engine
+	* registry (loaded engines, models resident, in-use cameras, idle
+	* TTL). Emitted ~0.2Hz (every 5 s) by every detection-pipeline
+	* process. The Engines tab subscribes to drive its inventory view
+	* without polling `pipelineExecutor.listLoadedEngines`.
+	*/
+	EventCategory["PipelineEngineMetricsSnapshot"] = "pipeline.engine-metrics-snapshot";
+	/**
+	* Per-node detection-engine runtime-provisioning transition. Emitted by
+	* the detection-pipeline provider on every state change of its lazy
+	* engine-provisioning machine (idle → installing → verifying → ready,
+	* or → failed with a `nextRetryAt`). Payload is the
+	* `EngineProvisioningState` snapshot; `event.source.nodeId` carries the
+	* node. The Pipeline page subscribes to drive a live "installing
+	* OpenVINO… / ready" indicator per node without polling
+	* `pipelineExecutor.getEngineProvisioning`. Telemetry-grade (D8): the UI
+	* also reads the cap snapshot on mount / reconnect. Phase 2.
+	*/
+	EventCategory["PipelineEngineProvisioning"] = "pipeline.engine-provisioning";
+	/**
+	* Cluster topology snapshot. Carries the same payload returned by
+	* `nodes.topology` (every reachable node + addons + processes).
+	* Emitted by the hub on any agent / addon lifecycle change
+	* (debounced) plus a periodic safety net. Replaces UI polling on
+	* `nodes.topology` — admin-ui dashboards subscribe to drive the
+	* cluster view directly from the event payload.
+	*/
+	EventCategory["ClusterTopologySnapshot"] = "cluster.topology-snapshot";
+	/**
+	* Periodic per-node system metrics snapshot (CPU / memory / GPU /
+	* disk / network). Emitted ~0.2 Hz by the metrics-provider addon
+	* for each node. Drives the dashboard SystemStatus / ProcessResources
+	* widgets without polling `metricsProvider.getCurrent`.
+	*/
+	EventCategory["MetricsNodeResourcesSnapshot"] = "metrics.node-resources-snapshot";
+	/**
+	* Periodic per-node process-tree snapshot (camstack-related pids
+	* with root / managed / system classification). Emitted ~0.2 Hz by
+	* the metrics-provider addon. Drives the Cluster → Processes tab
+	* without polling `metricsProvider.listNodeProcesses`.
+	*/
+	EventCategory["MetricsNodeProcessesSnapshot"] = "metrics.node-processes-snapshot";
+	/**
+	* Capability binding change event emitted by `addon-pipeline-orchestrator`
+	* when a user changes which addon implements a cap on a node. Subscribed
+	* by every kernel process to update its local `preferredProviderRegistry`
+	* so future capability lookups respect the new binding.
+	*/
+	/**
+	* A capability binding was changed for a node — addon X now provides
+	* capability `cap` on node `nodeId`. Lives under the generic
+	* `capability.*` namespace because capability bindings are a kernel-
+	* level concept used by many addons, not strictly pipeline-scoped.
+	*/
+	EventCategory["CapabilityBindingChanged"] = "capability.binding-changed";
+	EventCategory["ModelDownloadProgress"] = "model.download.progress";
+	EventCategory["AgentRegistered"] = "agent.registered";
+	EventCategory["AgentUnregistered"] = "agent.unregistered";
+	EventCategory["AgentOnline"] = "agent.online";
+	EventCategory["AgentOffline"] = "agent.offline";
+	/** Forked worker process (e.g. hub/pipeline) connected to the broker. */
+	EventCategory["WorkerOnline"] = "worker.online";
+	/** Forked worker process disconnected from the broker. */
+	EventCategory["WorkerOffline"] = "worker.offline";
+	EventCategory["AgentTaskDispatched"] = "agent.task.dispatched";
+	EventCategory["AgentTaskAssigned"] = "agent.task.assigned";
+	EventCategory["AgentTrpcConnected"] = "agent.trpc.connected";
+	EventCategory["AgentWsConnected"] = "agent.ws.connected";
+	EventCategory["AgentWsDisconnected"] = "agent.ws.disconnected";
+	EventCategory["AgentBackupActivated"] = "agent.backup.activated";
+	EventCategory["OrchestrationSettingsUpdated"] = "orchestration.settings-updated";
+	EventCategory["MotionAnalysis"] = "detection.motion-analysis";
+	/** All raw motion zones from CCL before minArea filter — for UI debug overlay. */
+	EventCategory["MotionZonesRaw"] = "detection.motion-zones-raw";
+	/**
+	* Per-camera motion phase transition (`watching ↔ active`) emitted
+	* by the runner. Mirrors the `motion.onMotionChanged` cap event
+	* surface — payload `MotionOnMotionChangedPayload` carries
+	* `{deviceId, detected, timestamp, source, regions?}`. Subscribers
+	* include addons that need to react to motion state without
+	* polling the runtime-state mirror.
+	*/
+	EventCategory["MotionOnMotionChanged"] = "motion.on-motion-changed";
+	EventCategory["DetectionResult"] = "detection.result";
+	EventCategory["DetectionRaw"] = "detection.raw";
+	EventCategory["DetectionCameraNative"] = "detection.camera-native";
+	/**
+	* Canonical per-chunk live audio pipeline output. Payload is
+	* `PipelineAudioInferenceResultPayload` carrying a full `AudioResult`
+	* (level + detections + debug). Lives on the pipeline.* namespace
+	* alongside `pipeline.inference-result` (video) for symmetry.
+	*/
+	EventCategory["PipelineAudioInferenceResult"] = "pipeline.audio-inference-result";
+	EventCategory["DetectionPhaseTransition"] = "detection.phase-transition";
+	/**
+	* A camera provider's RAW onboard motion push (D673): the `MotionOnMotionChanged`
+	* data shape without `triggeredBy`, built by `providerMotionEvent`. Its one
+	* consumer is the orchestrator's camera-sensors bridge, which re-emits the
+	* camera's EFFECTIVE onboard motion as `MotionOnMotionChanged` (a pass-through
+	* for a camera with no attached sensor). Providers must not emit
+	* `MotionOnMotionChanged` themselves; `scripts/check-onboard-motion-emitters.ts`
+	* keeps it so (camera-grid is a named, deferred exception).
+	*/
+	EventCategory["ProviderMotion"] = "provider.motion";
+	EventCategory["ProviderDetection"] = "provider.detection";
+	EventCategory["EnrichmentEmbeddingStored"] = "enrichment.embedding.stored";
+	EventCategory["EnrichmentSceneStateChanged"] = "enrichment.scene.state-changed";
+	EventCategory["EnrichmentActivitySummary"] = "enrichment.activity.summary";
+	/**
+	* Unified track-lifecycle event: ONE category carrying `phase:
+	* 'start' | 'update' | 'end'` with a rich, typed
+	* `PipelineAnalyticsTrackLifecyclePayload`. Supersedes the thin
+	* `PipelineAnalyticsTrackStarted` / `PipelineAnalyticsTrackEnded`
+	* pair — a consumer subscribes once and branches on `phase`.
+	*/
+	EventCategory["PipelineAnalyticsTrackLifecycle"] = "pipeline-analytics.track-lifecycle";
+	/**
+	* @deprecated Superseded by {@link PipelineAnalyticsTrackLifecycle}
+	* (`phase:'start'`). Kept as a soft alias — no known subscribers.
+	*/
+	EventCategory["PipelineAnalyticsTrackStarted"] = "pipeline-analytics.track-started";
+	/**
+	* @deprecated Superseded by {@link PipelineAnalyticsTrackLifecycle}
+	* (`phase:'end'`). Kept as a soft alias — no known subscribers.
+	*/
+	EventCategory["PipelineAnalyticsTrackEnded"] = "pipeline-analytics.track-ended";
+	EventCategory["PipelineAnalyticsDetectionEvent"] = "pipeline-analytics.detection-event";
+	EventCategory["PipelineAnalyticsFrameTracked"] = "pipeline-analytics.frame-tracked";
+	/**
+	* Fired by `addon-post-analysis` when a parked (stationary) object appears
+	* (a track was promoted to a stationary-registry entry) or departs (the
+	* object moved / was removed). Telemetry (D8): lossy, drives a UI refresh of
+	* the dedicated "Stationary" section — never the live event feed. Payload:
+	* `{ deviceId, entryId, className, phase:'appeared'|'departed', timestamp, observedAt, zones }`.
+	*/
+	EventCategory["PipelineAnalyticsStationaryChanged"] = "pipeline-analytics.stationary-changed";
+	/**
+	* Fired by `addon-post-analysis` when a package-drop is confirmed inside
+	* a package zone — a newly-appeared stationary object of a package class
+	* that cleared the class / zone / dwell / size gates. Payload:
+	* `PipelineAnalyticsPackageDeliveredPayload` carrying `{ deviceId,
+	* entryId, className, zoneIds, keyFrameMediaId?, bbox, timestamp }`.
+	* Telemetry (D8): the durable record is the `package-events` store row;
+	* this bus topic drives notifier rules + live UI. See
+	* docs/superpowers/specs/2026-07-17-package-zones-design.md §5.1.
+	*/
+	EventCategory["PipelineAnalyticsPackageDelivered"] = "pipeline-analytics.package-delivered";
+	/**
+	* Fired by `addon-post-analysis` when a previously-delivered package
+	* leaves its zone (the stationary entry departed — moved or swept).
+	* Payload: `PipelineAnalyticsPackagePickedUpPayload` carrying
+	* `{ deviceId, entryId, deliveredEventId, className, timestamp }`.
+	* Telemetry (D8). See package-zones-design §5.2.
+	*/
+	EventCategory["PipelineAnalyticsPackagePickedUp"] = "pipeline-analytics.package-picked-up";
+	/**
+	* Fired by `addon-post-analysis` whenever a gallery face row changes:
+	* `kind:'buffered'` a new detected face was persisted, `'assigned'` /
+	* `'unassigned'` its identity link changed, `'deleted'` the row was
+	* removed. Telemetry semantics (D8): a lost event only delays a refresh,
+	* never a correctness issue. Payload `PipelineAnalyticsFaceGalleryChangedPayload`.
+	*/
+	EventCategory["PipelineAnalyticsFaceGalleryChanged"] = "pipeline-analytics.face-gallery-changed";
+	/**
+	* Fired by `addon-post-analysis` whenever a gallery plate row changes:
+	* `kind:'buffered'` a new read was persisted (`PlateRecognizer.onTrackEnd`),
+	* `'assigned'` / `'unassigned'` its vehicle link changed
+	* (`PlateGalleryProvider`), `'deleted'` the row was removed. Telemetry
+	* semantics (D8): a lost event only delays a refresh, never a correctness
+	* issue. Payload `PipelineAnalyticsPlateGalleryChangedPayload`.
+	*/
+	EventCategory["PipelineAnalyticsPlateGalleryChanged"] = "pipeline-analytics.plate-gallery-changed";
+	EventCategory["CameraStreamsProfileSlotsChanged"] = "camera-streams.onProfileSlotsChanged";
+	/**
+	* Stream-broker health watchdog. Per-broker (deviceId/profile) emission.
+	* `stream.offline` fires after STREAM_STALE_TIMEOUT_MS without an encoded
+	* packet on an active broker. `stream.online` fires on first packet
+	* after a stale gap (or on initial first packet). Payload includes
+	* the assigned camStreamId as `profileKey`.
+	*/
+	EventCategory["StreamOnline"] = "stream.online";
+	EventCategory["StreamOffline"] = "stream.offline";
+	EventCategory["NetworkTunnelStarted"] = "network.tunnel.started";
+	EventCategory["NetworkTunnelStopped"] = "network.tunnel.stopped";
+	/** Fired by the `local-network` cap when the host's interface set
+	*  changes (new IP from DHCP, VPN connect, docker bridge added). */
+	EventCategory["LocalNetworkChanged"] = "network.local.changed";
+	/**
+	* Fired by a `mesh-network` provider (Tailscale, …) when its
+	* mesh-reachable host changes (join / leave / MagicDNS or 100.x IP
+	* change). Lets `local-network` fold the mesh endpoint into its
+	* connection-endpoint list without a cross-package import. Payload
+	* carries the preferred host (`host: ''` = no longer reachable),
+	* the hub port, and the scheme. Telemetry-grade (D8): consumers
+	* pull-reconcile from the provider's `getStatus` on reconnect. */
+	EventCategory["MeshNetworkChanged"] = "network.mesh.changed";
+	EventCategory["BackupCompleted"] = "backup.completed";
+	/**
+	* A whole backup RUN finished — every destination attempted, win or lose.
+	*
+	* `backup.completed` fires once per DESTINATION, which is the right grain for
+	* a progress UI and the wrong one for a notification: an operator with three
+	* destinations would be told three times. And a run where two of three
+	* destinations succeeded is not a clean success — a single "backup
+	* completed" that hid the failed one would be a lie, so the count of each is
+	* carried here and the message says both.
+	*
+	* Emitted by the backup orchestrator only after the destination loop, so a
+	* run that dies during the BUILD phase produces no completion at all.
+	*/
+	EventCategory["BackupRunCompleted"] = "backup.run-completed";
+	EventCategory["BackupRestored"] = "backup.restored";
+	EventCategory["NotificationDispatched"] = "notification.dispatched";
+	EventCategory["NotificationFailed"] = "notification.failed";
+	/**
+	* A notification rule that cannot work (D905): its stored row does not load,
+	* or it still names a device / delivery target the prune CONFIRMED deleted.
+	* One edge per rule per distinct set of reasons; never on an unanswered read.
+	*/
+	EventCategory["NotificationRuleBroken"] = "notification.rule-broken";
+	/** The clear of {@link NotificationRuleBroken}: the rule loads and names nothing deleted. */
+	EventCategory["NotificationRuleRepaired"] = "notification.rule-repaired";
+	EventCategory["DeviceUpdated"] = "device.updated";
+	/**
+	* Transport-level connectivity. Emitted by the device driver when
+	* the underlying control socket actually connects / disconnects
+	* (Baichuan TCP, ONVIF probe response, RTSP DESCRIBE, …) — NOT for
+	* power-state transitions on a battery camera. For battery wake /
+	* doze cycles see `DeviceAwake` / `DeviceSleeping`.
+	*/
+	EventCategory["DeviceOnline"] = "device.online";
+	/**
+	* Stream-broker watchdog — emitted when no encoded packet has been
+	* received for STREAM_STALE_TIMEOUT_MS on an active broker (rtsp or
+	* push). Paired with DeviceOnline which fires on first packet after
+	* a stale gap. Payload: DeviceStreamHealthPayload.
+	*/
+	EventCategory["DeviceOffline"] = "device.offline";
+	/**
+	* Battery cam woke up — physical power-state transition reported
+	* by the device firmware. Distinct from `DeviceOnline` so a UI panel
+	* watching power state doesn't flap on every UDP socket reconnect.
+	*/
+	EventCategory["DeviceAwake"] = "device.awake";
+	/**
+	* Battery cam went to sleep. See `DeviceAwake`.
+	*/
+	EventCategory["DeviceSleeping"] = "device.sleeping";
+	EventCategory["RetentionCleanup"] = "retention.cleanup";
+	/**
+	* Legacy bulk-update progress snapshot (payload `BulkUpdateState`). No longer
+	* emitted — F3 removed the coordinator that produced it; "Update all" now runs
+	* as one lifecycle engine job (`AddonsJobProgress`/`AddonsJobLog`). Retained
+	* (with `BulkUpdateState`) only to avoid regenerating the event maps; removed
+	* in F4 once live bulk progress is re-implemented over the engine events.
+	*/
+	EventCategory["AddonsBulkUpdateProgress"] = "addons.bulk-update-progress";
+	EventCategory["AddonsJobProgress"] = "addons.job-progress";
+	EventCategory["AddonsJobLog"] = "addons.job-log";
+	/**
+	* A container's child visibility toggled (hidden/shown). Emitted by the
+	* `accessories` cap when a child device is hidden or revealed.
+	* Payload: `{ deviceId, childDeviceId, hidden }`.
+	*/
+	EventCategory["AccessoriesChildVisibilityChanged"] = "accessories.onChildVisibilityChanged";
+	/**
+	* A container's child set changed (children added/removed/reordered).
+	* Payload: `{ deviceId, childDeviceIds, hiddenChildIds }`.
+	*/
+	EventCategory["AccessoriesChanged"] = "accessories.onAccessoriesChanged";
+	/**
+	* An action run started or ended. Emitted by the `actions` surface.
+	* Payload: `ActionRunChanged` (`{ actionId, runId, isRunning, outcome?, lastRunAt, lastError }`).
+	*/
+	EventCategory["ActionsRunChanged"] = "actions.onRunChanged";
+	/**
+	* Progress update from a running model conversion job.
+	* Payload: `{ kind: 'model-convert', phase, sessionId?, pct?, detail? }`.
+	* Emitted by `addon-model-studio` on the converting node.
+	*/
+	EventCategory["ModelConvertProgress"] = "model-convert.progress";
+	return EventCategory;
+}({});
+//#endregion
 //#region src/interfaces/addon-peer-bytes.ts
 /** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
 var PeerBytesTicketSchema = zod.z.object({
@@ -963,593 +1741,6 @@ zod.z.object({
 	app: AppLoginPathSchema.nullable()
 });
 //#endregion
-//#region src/catalogs/sensor-active-state.ts
-/**
-* THE table "which boolean of this device type counts as HIGH", and the
-* pure evaluator of its EDGE.
-*
-* ONE table for everyone who asks "is this device HIGH?": the
-* recorder's `RecordingTriggers.sensorDeviceIds` trigger, the post-analysis
-* sensor markers, the orchestrator's camera-sensors bridge and
-* the sources of a pulse (`compilePulseOverride`, D936).
-* A second copy would diverge at the first cap added, and the symptom — "the
-* sensor rings the doorbell but does not record" — is exactly D62.
-*
-* ⚠ NOT `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), and the
-* two must not be unified: that one answers "what is the state WORD for a
-* rule" (and includes `presence`, `cover`, `alarm-panel`), this one "which
-* boolean's EDGE counts". Deliberately different vocabularies.
-*/
-/**
-* Known binary / switch source caps → the boolean slice field whose
-* false→true rise counts as ACTIVE. Every entry is "fire on active".
-* Sensors whose "active" reading is not a plain boolean (presence's string
-* state, connectivity's connected flag) are deliberately excluded — a
-* reconnect is not a doorbell press, and it is not a recording either.
-*/
-var SOURCE_CAP_ACTIVE_FIELD = {
-	contact: "entryOpen",
-	binary: "on",
-	switch: "on",
-	motion: "detected",
-	flood: "flooded",
-	gas: "detected",
-	smoke: "detected",
-	"carbon-monoxide": "detected",
-	vibration: "detected",
-	tamper: "tampered"
-};
-//#endregion
-//#region src/catalogs/coco-classmap.ts
-var MACRO_LABELS = [
-	{
-		id: "person",
-		name: "Person"
-	},
-	{
-		id: "vehicle",
-		name: "Vehicle"
-	},
-	{
-		id: "animal",
-		name: "Animal"
-	},
-	{
-		id: "package",
-		name: "Package"
-	}
-];
-new Set(MACRO_LABELS.map((l) => l.id));
-var COCO_TO_MACRO = {
-	mapping: {
-		person: "person",
-		bicycle: "vehicle",
-		car: "vehicle",
-		motorcycle: "vehicle",
-		airplane: "vehicle",
-		bus: "vehicle",
-		train: "vehicle",
-		truck: "vehicle",
-		boat: "vehicle",
-		bird: "animal",
-		cat: "animal",
-		dog: "animal",
-		horse: "animal",
-		sheep: "animal",
-		cow: "animal",
-		elephant: "animal",
-		bear: "animal",
-		zebra: "animal",
-		giraffe: "animal",
-		suitcase: "package",
-		backpack: "package",
-		handbag: "package"
-	},
-	preserveOriginal: false
-};
-zod.z.object({
-	field: zod.z.string().min(1),
-	on: zod.z.literal("advance")
-});
-/**
-* Output schema shared by the contribution + live methods.
-*
-* Mirrors the `ConfigUISchemaWithValues` shape (sections[] + optional
-* tabs[]) without importing from `../interfaces/config-ui.js` — a
-* concrete-but-lenient Zod object keeps tRPC output inference happy
-* (using `z.unknown()` here collapses unrelated router branches to
-* `unknown` when the generator re-inlines the huge AppRouter type).
-*
-* `.passthrough()` on sections/fields accepts whatever FormBuilder
-* extensions the caller adds (showWhen, displayScale, …) without
-* rebuilding every time a new field kind is introduced.
-*/
-var ContributionSectionSchema = zod.z.object({
-	id: zod.z.string(),
-	title: zod.z.string(),
-	description: zod.z.string().optional(),
-	style: zod.z.enum(["card", "accordion"]).optional(),
-	defaultCollapsed: zod.z.boolean().optional(),
-	columns: zod.z.union([
-		zod.z.literal(1),
-		zod.z.literal(2),
-		zod.z.literal(3),
-		zod.z.literal(4)
-	]).optional(),
-	tab: zod.z.string().optional(),
-	location: zod.z.enum([
-		"settings",
-		"top-tab",
-		"hero"
-	]).optional(),
-	order: zod.z.number().optional(),
-	fields: zod.z.array(zod.z.any())
-});
-var ContributionTabSchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	icon: zod.z.string(),
-	order: zod.z.number().optional()
-});
-zod.z.object({
-	tabs: zod.z.array(ContributionTabSchema).optional(),
-	sections: zod.z.array(ContributionSectionSchema)
-}).nullable();
-zod.z.object({ deviceId: zod.z.number() }), zod.z.object({ deviceId: zod.z.number() }), zod.z.object({
-	deviceId: zod.z.number(),
-	patch: zod.z.record(zod.z.string(), zod.z.unknown())
-}), zod.z.object({ success: zod.z.literal(true) });
-zod.z.object({ deviceId: zod.z.number() }), zod.z.unknown().nullable();
-function method(input, output, options) {
-	return {
-		input,
-		output,
-		kind: options?.kind ?? "query",
-		...options?.auth !== void 0 ? { auth: options.auth } : {},
-		...options?.access !== void 0 ? { access: options.access } : {},
-		...options?.role !== void 0 ? { role: options.role } : {},
-		...options?.caller !== void 0 ? { caller: options.caller } : {},
-		timeoutMs: options?.timeoutMs
-	};
-}
-/**
-* A method a SOURCE of a collection cap may legitimately not serve — OPTIONAL
-* on `InferProvider`. The `providerOptional: true` literal is what
-* `InferProvider` keys on; see {@link CapabilityMethodSchema.providerOptional}
-* for when this is the honest answer and when it is a soft stub.
-*/
-function optionalMethod(input, output, options) {
-	return {
-		...method(input, output, options),
-		providerOptional: true
-	};
-}
-//#endregion
-//#region src/capabilities/notification-output.cap.ts
-/**
-* notification-output — canonical, capability-gated notification delivery.
-*
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
-*
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
-*
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = zod.z.enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = zod.z.object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: zod.z.string().optional(),
-	bytes: zod.z.instanceof(Uint8Array).optional(),
-	mime: zod.z.string().optional(),
-	name: zod.z.string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = zod.z.enum([
-	"text",
-	"markdown",
-	"html"
-]);
-/**
-* The CLOSED icon vocabulary an action button may use.
-*
-* A closed set, not a free string, and that is the whole point: an arbitrary
-* icon name is one that ntfy renders, zentik silently drops, and nobody
-* notices — the same class of gap as a zone vocabulary nothing produced
-* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
-* declares `actionIcons: false` and the degrade engine strips the field.
-*
-* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
-* renderer's icon set; "acknowledge" survives an adapter that draws it
-* differently.
-*
-* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
-*
-* These names are for US. **No adapter may forward one verbatim.** Each maps
-* the whole set onto its own renderer's vocabulary through a
-* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
-* fallback, so adding a member here fails every adapter's build until someone
-* decides its glyph, which is the only place that decision can be made
-* honestly.
-*
-* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
-* `disarm` straight through; iOS feeds that string to
-* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
-* and every snooze and alarm button arrived BLANK. A pass-through is not a
-* mapping, and "the field is documented" is not "the value renders".
-*
-* Adding a member is TRAIN-BOUND. The enum lives in the published
-* `@camstack/server` closure and the cap seam validates against the HUB's copy,
-* so an addon that emits a token the running hub does not know does not lose an
-* icon — its whole `send` fails Zod validation and the notification never
-* arrives. Never emit a new token from an addon before the train carrying it.
-*/
-var NotificationActionIconSchema = zod.z.enum([
-	"acknowledge",
-	"dismiss",
-	"silence",
-	"snooze",
-	"view",
-	"play",
-	"open",
-	"close",
-	"lock",
-	"unlock",
-	"arm",
-	"arm-home",
-	"arm-away",
-	"arm-night",
-	"disarm",
-	"light",
-	"alert",
-	"camera"
-]);
-/** A single tap-through action button. */
-var NotificationActionSchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	url: zod.z.string().optional(),
-	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
-	icon: NotificationActionIconSchema.optional(),
-	/**
-	* Renders in a warning style where the notifier supports it.
-	*
-	* A HINT, never a gate. The callback's authority is its token and nothing
-	* else — see `notification-center/action-token.ts` for what that does and
-	* does not buy.
-	*/
-	destructive: zod.z.boolean().optional(),
-	/**
-	* How the tap should REACH the url.
-	*
-	* `navigate` (absent, and every button authored before this field) opens it:
-	* the phone leaves the notification and shows whatever the callback returns.
-	* That is right for a button whose answer the operator wants to read.
-	*
-	* `background` fires it as a POST and stays put. It exists for the buttons
-	* whose whole point is not to interrupt — "silence this for 30 minutes" is
-	* an answer to the notification, and being thrown into a browser tab to
-	* confirm it costs more attention than the notification did. A backend that
-	* cannot do a background call renders it as an ordinary link (the adapters
-	* fall back rather than dropping the button), so this is a preference, never
-	* a requirement.
-	*/
-	mode: zod.z.enum(["navigate", "background"]).optional()
-});
-/** A delivery parameter value: what a notifier declared it takes. */
-var DeliveryParamValueSchema = zod.z.union([
-	zod.z.string(),
-	zod.z.number(),
-	zod.z.boolean()
-]);
-/**
-* One extra delivery parameter a notifier KIND declares (D938). A rule that
-* addresses a target of that kind may set it; a kind that declares nothing is
-* never handed one. The admin UI derives its control from this descriptor —
-* no editor knows a service by name.
-*
-* Optional fields are `.optional()`, never `.default()` (a Zod default does not
-* run on the addon cap path).
-*/
-var DeliveryParamSchema = zod.z.object({
-	key: zod.z.string().min(1),
-	label: zod.z.string(),
-	/** i18n key of the label, resolved by the declaring addon's namespace. */
-	labelKey: zod.z.string().optional(),
-	type: zod.z.enum([
-		"enum",
-		"number",
-		"boolean",
-		"string"
-	]),
-	/** `enum` only: the closed set of accepted values. */
-	options: zod.z.array(zod.z.object({
-		value: zod.z.string(),
-		label: zod.z.string()
-	})).optional(),
-	/** `number` only. */
-	min: zod.z.number().optional(),
-	max: zod.z.number().optional(),
-	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
-	default: DeliveryParamValueSchema.optional()
-});
-/**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
-*/
-var NotificationSchema = zod.z.object({
-	body: zod.z.string(),
-	title: zod.z.string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: zod.z.number().int().min(1).max(5).default(3),
-	level: zod.z.string().optional(),
-	attachments: zod.z.array(AttachmentSchema).optional(),
-	clickUrl: zod.z.string().optional(),
-	actions: zod.z.array(NotificationActionSchema).optional(),
-	sound: zod.z.string().optional(),
-	ttl: zod.z.number().optional(),
-	tag: zod.z.string().optional(),
-	deviceId: zod.z.number().optional(),
-	eventId: zod.z.string().optional(),
-	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-	/**
-	* Values for the parameters the target's kind DECLARES in
-	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
-	* declaration by the sender; a notifier reads only the keys it declared.
-	*/
-	delivery: zod.z.record(zod.z.string(), DeliveryParamValueSchema).optional()
-});
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: zod.z.number().int().min(1).max(5).nullable(),
-	flags: zod.z.object({
-		critical: zod.z.boolean().optional(),
-		silent: zod.z.boolean().optional(),
-		noPush: zod.z.boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: zod.z.array(zod.z.string()).optional(),
-	description: zod.z.string().optional()
-});
-/** Attachment capabilities for a kind (drives the degrade engine + test panel). */
-var TargetKindAttachmentsCapsSchema = zod.z.object({
-	mediaTypes: zod.z.array(AttachmentMediaTypeSchema),
-	mode: zod.z.enum([
-		"url",
-		"bytes",
-		"both"
-	]),
-	max: zod.z.number().int().nonnegative(),
-	maxBytes: zod.z.number().int().positive().optional()
-});
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = zod.z.object({
-	attachments: TargetKindAttachmentsCapsSchema,
-	/** Max action buttons (0 = none). */
-	actions: zod.z.number().int().nonnegative(),
-	/**
-	* Whether this kind renders a per-action ICON.
-	*
-	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
-	* run on the addon cap path — three production failures in one day taught
-	* this repo that once. Absent is read as false by the degrade engine, which
-	* is the safe direction: an icon that is not rendered costs nothing, an icon
-	* assumed and dropped costs the operator's trust in the field.
-	*/
-	actionIcons: zod.z.boolean().optional(),
-	levels: zod.z.array(TargetKindLevelSchema),
-	format: zod.z.array(NotificationFormatSchema),
-	clickUrl: zod.z.boolean(),
-	sound: zod.z.boolean(),
-	ttl: zod.z.boolean(),
-	bodyMaxLen: zod.z.number().int().positive()
-});
-/**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
-*/
-var ConfigSchemaPassthrough = zod.z.unknown();
-var TargetKindSchema = zod.z.object({
-	kind: zod.z.string(),
-	label: zod.z.string(),
-	icon: zod.z.string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: zod.z.string(),
-	/**
-	* URL of the kind's bundled BRAND icon, served by the providing addon over
-	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
-	* when the addon bundles no icon for that kind — the client then falls back
-	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
-	*
-	* Root-relative on purpose: it resolves against whatever origin serves a web
-	* client, and a native client joins it onto its own hub base.
-	*
-	* DECLARED here deliberately. It used to travel as an undeclared passthrough
-	* field that survived only because the runtime cap-router forwards provider
-	* output verbatim — so every consumer had to re-declare it by hand to stop
-	* its own Zod parse from stripping it, and the whole arrangement would have
-	* broken silently the moment output validation was tightened anywhere.
-	*/
-	iconUrl: zod.z.string().optional(),
-	/**
-	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
-	*
-	* The server knows this and therefore says it, because the client cannot
-	* safely guess: a React-Native client renders SVG and raster through two
-	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
-	* not decode SVG on iOS/Android), so without this it silently fell back to a
-	* placeholder glyph for every vector icon while the web build looked fine.
-	*
-	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
-	* not been updated — a client that cannot determine the type should prefer
-	* its raster path, which is the safe default for an unknown image.
-	*/
-	iconMediaType: zod.z.string().optional(),
-	configSchema: ConfigSchemaPassthrough,
-	/**
-	* The config keys that decide WHERE this kind's secrets are sent (server,
-	* base URL, instance, chat, recipient). A save that changes any of them
-	* while leaving a secret redacted is refused by the provider (D634), so an
-	* editor uses this to ask for the secret on exactly those edits instead of
-	* on every edit.
-	*
-	* Optional: absent from a provider that holds no secret (the Home Assistant
-	* kinds) and from a provider older than this field — an editor that finds
-	* it absent must assume ANY edit may need the secret.
-	*/
-	destinationKeys: zod.z.array(zod.z.string()).optional(),
-	supportsDiscovery: zod.z.boolean(),
-	/**
-	* Extra delivery parameters a rule may set for a target of this kind (D938).
-	* Absent = none; the rule editor then offers nothing.
-	*/
-	deliveryParams: zod.z.array(DeliveryParamSchema).optional(),
-	caps: TargetKindCapsSchema
-});
-/**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
-*/
-var TargetSchema = zod.z.object({
-	id: zod.z.string(),
-	name: zod.z.string(),
-	kind: zod.z.string(),
-	addonId: zod.z.string(),
-	enabled: zod.z.boolean(),
-	config: zod.z.record(zod.z.string(), zod.z.unknown())
-});
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = zod.z.object({
-	kind: zod.z.string(),
-	suggestedName: zod.z.string(),
-	config: zod.z.record(zod.z.string(), zod.z.unknown())
-});
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = zod.z.object({
-	level: zod.z.string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: zod.z.number().int().nonnegative(),
-	actionsSent: zod.z.number().int().nonnegative(),
-	truncated: zod.z.boolean(),
-	dropped: zod.z.array(zod.z.string())
-});
-var SendResultSchema = zod.z.object({
-	success: zod.z.boolean(),
-	error: zod.z.string().optional(),
-	renderedAs: RenderedAsSchema.optional()
-});
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
-/**
-* Pre-save credential probe against a partial (unsaved) target config.
-* `resolvedUrl` never includes secrets (token stripped from path).
-*/
-var ProbeTargetConfigResultSchema = zod.z.object({
-	ok: zod.z.boolean(),
-	resolvedUrl: zod.z.string(),
-	httpStatus: zod.z.number().int().optional(),
-	stateInstance: zod.z.string().optional(),
-	error: zod.z.string().optional()
-});
-method(zod.z.object({}), zod.z.array(TargetKindSchema)), method(zod.z.object({}), zod.z.array(TargetSchema), { auth: "admin" }), method(zod.z.object({ targetId: zod.z.string() }), TargetSchema, { auth: "admin" }), method(zod.z.object({
-	kind: zod.z.string(),
-	config: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-	/**
-	* When editing / duplicating, the blank password field never round-trips
-	* the stored token. Pass the source target id so the provider can restore
-	* secrets server-side before dialling (same merge as upsert).
-	*/
-	targetId: zod.z.string().optional()
-}), zod.z.array(DiscoveredTargetSchema), { auth: "admin" }), method(zod.z.object({
-	kind: zod.z.string(),
-	config: zod.z.record(zod.z.string(), zod.z.unknown()),
-	/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
-	targetId: zod.z.string().optional()
-}), ProbeTargetConfigResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(zod.z.object({
-	targetId: zod.z.string(),
-	notification: NotificationSchema
-}), SendResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(zod.z.object({
-	targetId: zod.z.string(),
-	sample: NotificationSchema.optional()
-}), TestResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(zod.z.object({
-	target: TargetSchema,
-	/**
-	* Duplicate flow: create a NEW target id while copying secrets from an
-	* existing row. The UI never holds the stored token; blank / redacted
-	* password fields are restored from this source (D634 still applies if
-	* destinations diverge without a re-typed secret).
-	*/
-	cloneSecretsFrom: zod.z.string().optional()
-}), TargetSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(zod.z.object({ targetId: zod.z.string() }), zod.z.void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(zod.z.object({
-	targetId: zod.z.string(),
-	enabled: zod.z.boolean()
-}), zod.z.void(), {
-	kind: "mutation",
-	auth: "admin"
-});
-//#endregion
 //#region src/device/icon-catalog.generated.ts
 /** Lucide category ids, alphabetical. `ICON_META` indexes into this. */
 var ICON_CATEGORY_IDS = [
@@ -21371,242 +21562,869 @@ var ICON_SYNONYMS = {
 	]
 };
 /**
-* Spellings an operator may already have PERSISTED that no lucide package
-* accepts any more, and the catalog key they draw. They resolve
-* (`canonicalIconKey`) but are never offered. `gauge2` was this repo's own
-* pre-catalog spelling of `gauge`.
+* Spellings an operator may already have PERSISTED that no lucide package
+* accepts any more, and the catalog key they draw. They resolve
+* (`canonicalIconKey`) but are never offered. `gauge2` was this repo's own
+* pre-catalog spelling of `gauge`.
+*/
+var LEGACY_ICON_ALIASES = { gauge2: "gauge" };
+//#endregion
+//#region src/device/icon-catalog.ts
+/**
+* icon-catalog — THE icon vocabulary (D854).
+*
+* Every place that picks or stores an icon — a device's display override, a
+* location, a site zone, a viewer accessory, an `icon` settings field — names
+* it by a key of this catalog and nothing else. There is no curated subset and
+* no second list: the catalog is every lucide icon that both surfaces can draw
+* (the admin UI's `lucide-react` and the viewer's `lucide-react-native`), the
+* intersection computed by `scripts/generate-icon-catalog.ts` into the
+* committed `icon-catalog.generated.ts`.
+*
+* Like the vocabularies it replaces, this module holds STRINGS only — no React,
+* no lucide import, no glyph. Each surface owns its glyph table (the web one
+* lives in `ui-library`, loaded lazily), and a test on each side pins that it
+* covers {@link ICON_KEYS}.
+*
+* ## What is persisted
+*
+* The canonical kebab-case lucide id ({@link IconKey}). Spellings that a lucide
+* package still accepts (`home` for `house`) and this repo's own legacy ones
+* (`gauge2`) RESOLVE ({@link canonicalIconKey}) so a stored value never goes
+* stale, but they are never OFFERED by search.
+*
+* ## Search
+*
+* Over the key, the Italian/English overlay in `icon-synonyms.ts`, any words
+* the caller adds, and lucide's English tags — in that order of weight.
+*/
+var KEY_SET$1 = new Set(ICON_KEYS);
+var ALIAS_TO_KEY = new Map([...Object.entries(ICON_ALIASES), ...Object.entries(LEGACY_ICON_ALIASES)]);
+/** Is this a canonical key of the catalog? (An alias is not — see {@link canonicalIconKey}.) */
+function isIconKey(value) {
+	return typeof value === "string" && KEY_SET$1.has(value);
+}
+/**
+* A stored value as a catalog key: the key itself, the key a still-accepted or
+* legacy spelling stands for, or `undefined` — never a guess.
+*/
+function canonicalIconKey(value) {
+	if (typeof value !== "string") return void 0;
+	if (isIconKey(value)) return value;
+	return ALIAS_TO_KEY.get(value);
+}
+/**
+* A stored icon value as a catalog key: its canonical key when it is (or
+* aliases) one, `fallback` otherwise. For an `icon` settings field whose stored
+* value may predate the catalog (a free-text lucide name) — the field's default
+* is drawn rather than nothing.
+*/
+function resolveIconKey(value, fallback) {
+	return canonicalIconKey(value) ?? fallback;
+}
+/**
+* Wire/storage schema for one icon key.
+*
+* Deliberately NOT a `z.enum` of the catalog: ~1,700 literals would be inlined
+* into every cap router, type and API-reference row that carries an icon. The
+* check is membership in the catalog and the type is {@link IconKey}.
+*/
+var IconKeySchema = zod.z.custom(isIconKey, "Not an icon of the catalog");
+var ENTRIES = ICON_KEYS.map((key, index) => {
+	const [categoryIndexes, tags] = ICON_META[index] ?? [[], []];
+	const categories = categoryIndexes.flatMap((i) => {
+		const id = ICON_CATEGORY_IDS[i];
+		return id === void 0 ? [] : [id];
+	});
+	return {
+		key,
+		categories,
+		primaryCategory: categories[0] ?? ICON_CATEGORY_IDS[0],
+		tags,
+		synonyms: ICON_SYNONYMS[key] ?? []
+	};
+});
+var ENTRY_BY_KEY = new Map(ENTRIES.map((e) => [e.key, e]));
+/** The entry for a canonical key, or `undefined`. */
+function iconEntry(key) {
+	return ENTRY_BY_KEY.get(key);
+}
+/** Every entry, in key order. */
+var ICON_ENTRIES = ENTRIES;
+/** Categories a picker offers first: the ones this product's icons mostly live in. */
+var LEADING_CATEGORIES = [
+	"devices",
+	"home",
+	"security",
+	"buildings",
+	"connectivity",
+	"multimedia",
+	"nature",
+	"weather",
+	"transportation",
+	"animals"
+];
+var PRIMARY_CATEGORIES = new Set(ENTRIES.map((e) => e.primaryCategory));
+/**
+* The categories a picker files icons under, in picker order: the leading ones,
+* then the rest alphabetically. Only categories that are some icon's PRIMARY
+* one — a category lucide lists only as a secondary has no section of its own.
+*/
+var ICON_CATEGORIES = [...LEADING_CATEGORIES, ...ICON_CATEGORY_IDS.filter((c) => !LEADING_CATEGORIES.includes(c))].filter((c) => PRIMARY_CATEGORIES.has(c));
+/** The icons filed under a category as their PRIMARY one, in key order. */
+function iconsInCategory(category) {
+	return ENTRIES.filter((e) => e.primaryCategory === category);
+}
+function normalise(text) {
+	return text.normalize("NFD").replace(/\p{Diacritic}/gu, "").toLowerCase().replace(/[_-]+/g, " ").trim();
+}
+/** Does `needle` appear in `haystack` in order, though not adjacently? */
+function isSubsequence(needle, haystack) {
+	let i = 0;
+	for (const ch of haystack) {
+		if (ch === needle[i]) i += 1;
+		if (i === needle.length) return true;
+	}
+	return needle.length === 0;
+}
+/**
+* How well one word answers the query. 0 = not at all. An exact word beats a
+* prefix, a prefix beats a word STARTING inside the phrase, and a loose
+* subsequence comes last because it matches almost anything.
+*/
+function scoreWord(query, word, loose) {
+	if (word === query) return 100;
+	if (word.startsWith(query)) return 80;
+	if (word.split(" ").some((w) => w.startsWith(query))) return 60;
+	if (word.includes(query)) return 40;
+	if (loose && isSubsequence(query, word)) return 15;
+	return 0;
+}
+var WORDS_CACHE = /* @__PURE__ */ new Map();
+/** Normalised once per entry — search runs on every keystroke over ~1,700 entries. */
+function wordsOf(entry) {
+	const cached = WORDS_CACHE.get(entry.key);
+	if (cached !== void 0) return cached;
+	const built = {
+		key: normalise(entry.key),
+		synonyms: entry.synonyms.map(normalise),
+		tags: entry.tags.map(normalise)
+	};
+	WORDS_CACHE.set(entry.key, built);
+	return built;
+}
+/**
+* Rank the catalog against a free-text query.
+*
+* An empty query returns the WHOLE catalog in key order, because a picker's
+* resting state is the full list. `extraWords` lets a caller add the words IT
+* can translate without this module knowing what a locale is; they score like a
+* synonym. The key outranks a synonym, a synonym outranks a lucide tag, and
+* ties keep key order so the list does not reshuffle between keystrokes.
+*/
+function searchIcons(query, extraWords) {
+	const q = normalise(query);
+	if (q.length === 0) return ENTRIES.map((entry) => ({
+		entry,
+		score: 0
+	}));
+	const hits = [];
+	for (const entry of ENTRIES) {
+		const words = wordsOf(entry);
+		const keyScore = scoreWord(q, words.key, true);
+		let best = keyScore > 0 ? keyScore + 2 : 0;
+		for (const word of [...words.synonyms, ...(extraWords?.get(entry.key) ?? []).map(normalise)]) {
+			const score = scoreWord(q, word, true);
+			if (score > 0 && score + 1 > best) best = score + 1;
+		}
+		for (const word of words.tags) {
+			const score = scoreWord(q, word, false);
+			if (score > best) best = score;
+		}
+		if (best > 0) hits.push({
+			entry,
+			score: best
+		});
+	}
+	return hits.toSorted((a, b) => b.score - a.score);
+}
+/** A readable label derived from a lucide category id (`food-beverage` → `Food beverage`). */
+function iconCategoryLabel(category) {
+	const spaced = category.replace(/-/g, " ");
+	return spaced.charAt(0).toUpperCase() + spaced.slice(1);
+}
+//#endregion
+//#region src/device/location-icon.ts
+/**
+* What a location's icon is, and the ONE key its label joins on.
+*
+* A location is not an entity — it is a free-form label (`PersistedDeviceMeta.
+* location`) plus an operator-curated registry of labels in the device-manager
+* addon store. The icon is a second map beside that registry, keyed the same
+* way the registry matches everywhere else: {@link locationIconKey}, i.e.
+* trimmed + lower-cased.
+*
+* The icon itself is a key of the ONE icon catalog (`icon-catalog.ts`, D854):
+* a location may wear any icon both surfaces can draw. There used to be a
+* closed 20-icon subset here (D511); it was a second vocabulary on the same two
+* surfaces and is gone. The names below keep their meaning:
+*
+* DEGRADATION IS A FALLBACK, NEVER A HOLE. A surface that cannot draw a stored
+* value — a persisted value from a newer hub, a hand-edited settings row —
+* draws {@link LOCATION_ICON_FALLBACK} (`map-pin`, the one every surface has
+* always had). Read a stored/wire value through
+* `resolveIconKey(value, LOCATION_ICON_FALLBACK)` and that is what you get;
+* nothing anywhere renders an empty box.
+*/
+/**
+* The id every surface is guaranteed to draw, and what an unrecognised value
+* degrades to. It has been in both icon sets since before the catalog existed
+* (the Locations page's own page icon), so "the fallback is missing" is not a
+* state a build can reach.
+*/
+var LOCATION_ICON_FALLBACK = "map-pin";
+zod.z.object({
+	locationKey: zod.z.string(),
+	icon: IconKeySchema
+});
+/**
+* The join key for a location label: trimmed, lower-cased. The ONE place this
+* derivation lives — a caller that re-spells it is a rename away from an
+* orphaned icon.
+*/
+function locationIconKey(label) {
+	return label.trim().toLowerCase();
+}
+zod.z.object({
+	locationKey: zod.z.string(),
+	description: zod.z.string()
+});
+//#endregion
+//#region src/automation/action-target.ts
+/**
+* WHO an action step acts on (D983) — one target shape for every place that
+* performs an action (automation steps, Action entries, notification
+* sequences, scheduler points):
+*
+*  - `devices` — device ids the operator picked, frozen at save time;
+*  - `domain`  — every device that offers the step's VOCABULARY action,
+*    optionally narrowed to one device type and one room, resolved WHEN THE
+*    STEP RUNS (a device added later is included). The action always comes
+*    from the vocabulary (`cover.open`), never from a raw cap name, so a
+*    `domain` target needs an `actionId` (enforced on the step schema);
+*  - `var`     — a `$var` resolved from the run's scope.
+*
+* {@link ActionTargetResolver} turns a target into device ids. It is pure
+* (a {@link DeviceDirectory} is handed in) so the hub's core-blocks service and
+* a generated automation block share it.
+*
+* A room is the device's `location` label (`DeviceInfo.location`); two labels
+* name the same room when `locationIconKey` agrees (trimmed, lower-cased).
+*/
+var ActionTargetSchema = zod.z.discriminatedUnion("kind", [
+	zod.z.object({
+		kind: zod.z.literal("devices"),
+		ids: zod.z.array(zod.z.number().int()).min(1)
+	}),
+	zod.z.object({
+		kind: zod.z.literal("domain"),
+		/** Narrow to one kind of device. */
+		deviceType: zod.z.enum(DeviceType).optional(),
+		/** Narrow to one room: the `location` label devices carry. */
+		roomId: zod.z.string().min(1).optional()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("var"),
+		name: zod.z.string().min(1)
+	})
+]);
+EventCategory.DeviceRegistered, EventCategory.DeviceUnregistered, EventCategory.DeviceUpdated, EventCategory.DeviceMetaChanged, EventCategory.DeviceBindingsChanged;
+//#endregion
+//#region src/catalogs/sensor-active-state.ts
+/**
+* THE table "which boolean of this device type counts as HIGH", and the
+* pure evaluator of its EDGE.
+*
+* ONE table for everyone who asks "is this device HIGH?": the
+* recorder's `RecordingTriggers.sensorDeviceIds` trigger, the post-analysis
+* sensor markers, the orchestrator's camera-sensors bridge and
+* the sources of a pulse (`compilePulseOverride`, D936).
+* A second copy would diverge at the first cap added, and the symptom — "the
+* sensor rings the doorbell but does not record" — is exactly D62.
+*
+* ⚠ NOT `DEVICE_STATE_READERS` (`catalogs/device-state-vocabulary.ts`), and the
+* two must not be unified: that one answers "what is the state WORD for a
+* rule" (and includes `presence`, `cover`, `alarm-panel`), this one "which
+* boolean's EDGE counts". Deliberately different vocabularies.
 */
-var LEGACY_ICON_ALIASES = { gauge2: "gauge" };
+/**
+* Known binary / switch source caps → the boolean slice field whose
+* false→true rise counts as ACTIVE. Every entry is "fire on active".
+* Sensors whose "active" reading is not a plain boolean (presence's string
+* state, connectivity's connected flag) are deliberately excluded — a
+* reconnect is not a doorbell press, and it is not a recording either.
+*/
+var SOURCE_CAP_ACTIVE_FIELD = {
+	contact: "entryOpen",
+	binary: "on",
+	switch: "on",
+	motion: "detected",
+	flood: "flooded",
+	gas: "detected",
+	smoke: "detected",
+	"carbon-monoxide": "detected",
+	vibration: "detected",
+	tamper: "tampered"
+};
 //#endregion
-//#region src/device/icon-catalog.ts
+//#region src/catalogs/coco-classmap.ts
+var MACRO_LABELS = [
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle"
+	},
+	{
+		id: "animal",
+		name: "Animal"
+	},
+	{
+		id: "package",
+		name: "Package"
+	}
+];
+new Set(MACRO_LABELS.map((l) => l.id));
+var COCO_TO_MACRO = {
+	mapping: {
+		person: "person",
+		bicycle: "vehicle",
+		car: "vehicle",
+		motorcycle: "vehicle",
+		airplane: "vehicle",
+		bus: "vehicle",
+		train: "vehicle",
+		truck: "vehicle",
+		boat: "vehicle",
+		bird: "animal",
+		cat: "animal",
+		dog: "animal",
+		horse: "animal",
+		sheep: "animal",
+		cow: "animal",
+		elephant: "animal",
+		bear: "animal",
+		zebra: "animal",
+		giraffe: "animal",
+		suitcase: "package",
+		backpack: "package",
+		handbag: "package"
+	},
+	preserveOriginal: false
+};
+zod.z.object({
+	field: zod.z.string().min(1),
+	on: zod.z.literal("advance")
+});
 /**
-* icon-catalog — THE icon vocabulary (D854).
-*
-* Every place that picks or stores an icon — a device's display override, a
-* location, a site zone, a viewer accessory, an `icon` settings field — names
-* it by a key of this catalog and nothing else. There is no curated subset and
-* no second list: the catalog is every lucide icon that both surfaces can draw
-* (the admin UI's `lucide-react` and the viewer's `lucide-react-native`), the
-* intersection computed by `scripts/generate-icon-catalog.ts` into the
-* committed `icon-catalog.generated.ts`.
+* Output schema shared by the contribution + live methods.
 *
-* Like the vocabularies it replaces, this module holds STRINGS only — no React,
-* no lucide import, no glyph. Each surface owns its glyph table (the web one
-* lives in `ui-library`, loaded lazily), and a test on each side pins that it
-* covers {@link ICON_KEYS}.
+* Mirrors the `ConfigUISchemaWithValues` shape (sections[] + optional
+* tabs[]) without importing from `../interfaces/config-ui.js` — a
+* concrete-but-lenient Zod object keeps tRPC output inference happy
+* (using `z.unknown()` here collapses unrelated router branches to
+* `unknown` when the generator re-inlines the huge AppRouter type).
 *
-* ## What is persisted
+* `.passthrough()` on sections/fields accepts whatever FormBuilder
+* extensions the caller adds (showWhen, displayScale, …) without
+* rebuilding every time a new field kind is introduced.
+*/
+var ContributionSectionSchema = zod.z.object({
+	id: zod.z.string(),
+	title: zod.z.string(),
+	description: zod.z.string().optional(),
+	style: zod.z.enum(["card", "accordion"]).optional(),
+	defaultCollapsed: zod.z.boolean().optional(),
+	columns: zod.z.union([
+		zod.z.literal(1),
+		zod.z.literal(2),
+		zod.z.literal(3),
+		zod.z.literal(4)
+	]).optional(),
+	tab: zod.z.string().optional(),
+	location: zod.z.enum([
+		"settings",
+		"top-tab",
+		"hero"
+	]).optional(),
+	order: zod.z.number().optional(),
+	fields: zod.z.array(zod.z.any())
+});
+var ContributionTabSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	icon: zod.z.string(),
+	order: zod.z.number().optional()
+});
+zod.z.object({
+	tabs: zod.z.array(ContributionTabSchema).optional(),
+	sections: zod.z.array(ContributionSectionSchema)
+}).nullable();
+zod.z.object({ deviceId: zod.z.number() }), zod.z.object({ deviceId: zod.z.number() }), zod.z.object({
+	deviceId: zod.z.number(),
+	patch: zod.z.record(zod.z.string(), zod.z.unknown())
+}), zod.z.object({ success: zod.z.literal(true) });
+zod.z.object({ deviceId: zod.z.number() }), zod.z.unknown().nullable();
+function method(input, output, options) {
+	return {
+		input,
+		output,
+		kind: options?.kind ?? "query",
+		...options?.auth !== void 0 ? { auth: options.auth } : {},
+		...options?.access !== void 0 ? { access: options.access } : {},
+		...options?.role !== void 0 ? { role: options.role } : {},
+		...options?.caller !== void 0 ? { caller: options.caller } : {},
+		timeoutMs: options?.timeoutMs
+	};
+}
+/**
+* A method a SOURCE of a collection cap may legitimately not serve — OPTIONAL
+* on `InferProvider`. The `providerOptional: true` literal is what
+* `InferProvider` keys on; see {@link CapabilityMethodSchema.providerOptional}
+* for when this is the honest answer and when it is a soft stub.
+*/
+function optionalMethod(input, output, options) {
+	return {
+		...method(input, output, options),
+		providerOptional: true
+	};
+}
+//#endregion
+//#region src/capabilities/notification-output.cap.ts
+/**
+* notification-output — canonical, capability-gated notification delivery.
 *
-* The canonical kebab-case lucide id ({@link IconKey}). Spellings that a lucide
-* package still accepts (`home` for `house`) and this repo's own legacy ones
-* (`gauge2`) RESOLVE ({@link canonicalIconKey}) so a stored value never goes
-* stale, but they are never OFFERED by search.
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
 *
-* ## Search
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
 *
-* Over the key, the Italian/English overlay in `icon-synonyms.ts`, any words
-* the caller adds, and lucide's English tags — in that order of weight.
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
 */
-var KEY_SET$1 = new Set(ICON_KEYS);
-var ALIAS_TO_KEY = new Map([...Object.entries(ICON_ALIASES), ...Object.entries(LEGACY_ICON_ALIASES)]);
-/** Is this a canonical key of the catalog? (An alias is not — see {@link canonicalIconKey}.) */
-function isIconKey(value) {
-	return typeof value === "string" && KEY_SET$1.has(value);
-}
 /**
-* A stored value as a catalog key: the key itself, the key a still-accepted or
-* legacy spelling stands for, or `undefined` — never a guess.
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
 */
-function canonicalIconKey(value) {
-	if (typeof value !== "string") return void 0;
-	if (isIconKey(value)) return value;
-	return ALIAS_TO_KEY.get(value);
-}
+var AttachmentMediaTypeSchema = zod.z.enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
 /**
-* A stored icon value as a catalog key: its canonical key when it is (or
-* aliases) one, `fallback` otherwise. For an `icon` settings field whose stored
-* value may predate the catalog (a free-text lucide name) — the field's default
-* is drawn rather than nothing.
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
 */
-function resolveIconKey(value, fallback) {
-	return canonicalIconKey(value) ?? fallback;
-}
+var AttachmentSchema = zod.z.object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: zod.z.string().optional(),
+	bytes: zod.z.instanceof(Uint8Array).optional(),
+	mime: zod.z.string().optional(),
+	name: zod.z.string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = zod.z.enum([
+	"text",
+	"markdown",
+	"html"
+]);
 /**
-* Wire/storage schema for one icon key.
+* The CLOSED icon vocabulary an action button may use.
 *
-* Deliberately NOT a `z.enum` of the catalog: ~1,700 literals would be inlined
-* into every cap router, type and API-reference row that carries an icon. The
-* check is membership in the catalog and the type is {@link IconKey}.
+* A closed set, not a free string, and that is the whole point: an arbitrary
+* icon name is one that ntfy renders, zentik silently drops, and nobody
+* notices — the same class of gap as a zone vocabulary nothing produced
+* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
+* declares `actionIcons: false` and the degrade engine strips the field.
+*
+* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
+* renderer's icon set; "acknowledge" survives an adapter that draws it
+* differently.
+*
+* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
+*
+* These names are for US. **No adapter may forward one verbatim.** Each maps
+* the whole set onto its own renderer's vocabulary through a
+* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
+* fallback, so adding a member here fails every adapter's build until someone
+* decides its glyph, which is the only place that decision can be made
+* honestly.
+*
+* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
+* `disarm` straight through; iOS feeds that string to
+* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
+* and every snooze and alarm button arrived BLANK. A pass-through is not a
+* mapping, and "the field is documented" is not "the value renders".
+*
+* Adding a member is TRAIN-BOUND. The enum lives in the published
+* `@camstack/server` closure and the cap seam validates against the HUB's copy,
+* so an addon that emits a token the running hub does not know does not lose an
+* icon — its whole `send` fails Zod validation and the notification never
+* arrives. Never emit a new token from an addon before the train carrying it.
 */
-var IconKeySchema = zod.z.custom(isIconKey, "Not an icon of the catalog");
-var ENTRIES = ICON_KEYS.map((key, index) => {
-	const [categoryIndexes, tags] = ICON_META[index] ?? [[], []];
-	const categories = categoryIndexes.flatMap((i) => {
-		const id = ICON_CATEGORY_IDS[i];
-		return id === void 0 ? [] : [id];
-	});
-	return {
-		key,
-		categories,
-		primaryCategory: categories[0] ?? ICON_CATEGORY_IDS[0],
-		tags,
-		synonyms: ICON_SYNONYMS[key] ?? []
-	};
+var NotificationActionIconSchema = zod.z.enum([
+	"acknowledge",
+	"dismiss",
+	"silence",
+	"snooze",
+	"view",
+	"play",
+	"open",
+	"close",
+	"lock",
+	"unlock",
+	"arm",
+	"arm-home",
+	"arm-away",
+	"arm-night",
+	"disarm",
+	"light",
+	"alert",
+	"camera"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	url: zod.z.string().optional(),
+	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
+	icon: NotificationActionIconSchema.optional(),
+	/**
+	* Renders in a warning style where the notifier supports it.
+	*
+	* A HINT, never a gate. The callback's authority is its token and nothing
+	* else — see `notification-center/action-token.ts` for what that does and
+	* does not buy.
+	*/
+	destructive: zod.z.boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: zod.z.enum(["navigate", "background"]).optional()
 });
-var ENTRY_BY_KEY = new Map(ENTRIES.map((e) => [e.key, e]));
-/** The entry for a canonical key, or `undefined`. */
-function iconEntry(key) {
-	return ENTRY_BY_KEY.get(key);
-}
-/** Every entry, in key order. */
-var ICON_ENTRIES = ENTRIES;
-/** Categories a picker offers first: the ones this product's icons mostly live in. */
-var LEADING_CATEGORIES = [
-	"devices",
-	"home",
-	"security",
-	"buildings",
-	"connectivity",
-	"multimedia",
-	"nature",
-	"weather",
-	"transportation",
-	"animals"
-];
-var PRIMARY_CATEGORIES = new Set(ENTRIES.map((e) => e.primaryCategory));
-/**
-* The categories a picker files icons under, in picker order: the leading ones,
-* then the rest alphabetically. Only categories that are some icon's PRIMARY
-* one — a category lucide lists only as a secondary has no section of its own.
-*/
-var ICON_CATEGORIES = [...LEADING_CATEGORIES, ...ICON_CATEGORY_IDS.filter((c) => !LEADING_CATEGORIES.includes(c))].filter((c) => PRIMARY_CATEGORIES.has(c));
-/** The icons filed under a category as their PRIMARY one, in key order. */
-function iconsInCategory(category) {
-	return ENTRIES.filter((e) => e.primaryCategory === category);
-}
-function normalise(text) {
-	return text.normalize("NFD").replace(/\p{Diacritic}/gu, "").toLowerCase().replace(/[_-]+/g, " ").trim();
-}
-/** Does `needle` appear in `haystack` in order, though not adjacently? */
-function isSubsequence(needle, haystack) {
-	let i = 0;
-	for (const ch of haystack) {
-		if (ch === needle[i]) i += 1;
-		if (i === needle.length) return true;
-	}
-	return needle.length === 0;
-}
+/** A delivery parameter value: what a notifier declared it takes. */
+var DeliveryParamValueSchema = zod.z.union([
+	zod.z.string(),
+	zod.z.number(),
+	zod.z.boolean()
+]);
 /**
-* How well one word answers the query. 0 = not at all. An exact word beats a
-* prefix, a prefix beats a word STARTING inside the phrase, and a loose
-* subsequence comes last because it matches almost anything.
+* One extra delivery parameter a notifier KIND declares (D938). A rule that
+* addresses a target of that kind may set it; a kind that declares nothing is
+* never handed one. The admin UI derives its control from this descriptor —
+* no editor knows a service by name.
+*
+* Optional fields are `.optional()`, never `.default()` (a Zod default does not
+* run on the addon cap path).
 */
-function scoreWord(query, word, loose) {
-	if (word === query) return 100;
-	if (word.startsWith(query)) return 80;
-	if (word.split(" ").some((w) => w.startsWith(query))) return 60;
-	if (word.includes(query)) return 40;
-	if (loose && isSubsequence(query, word)) return 15;
-	return 0;
-}
-var WORDS_CACHE = /* @__PURE__ */ new Map();
-/** Normalised once per entry — search runs on every keystroke over ~1,700 entries. */
-function wordsOf(entry) {
-	const cached = WORDS_CACHE.get(entry.key);
-	if (cached !== void 0) return cached;
-	const built = {
-		key: normalise(entry.key),
-		synonyms: entry.synonyms.map(normalise),
-		tags: entry.tags.map(normalise)
-	};
-	WORDS_CACHE.set(entry.key, built);
-	return built;
-}
+var DeliveryParamSchema = zod.z.object({
+	key: zod.z.string().min(1),
+	label: zod.z.string(),
+	/** i18n key of the label, resolved by the declaring addon's namespace. */
+	labelKey: zod.z.string().optional(),
+	type: zod.z.enum([
+		"enum",
+		"number",
+		"boolean",
+		"string"
+	]),
+	/** `enum` only: the closed set of accepted values. */
+	options: zod.z.array(zod.z.object({
+		value: zod.z.string(),
+		label: zod.z.string()
+	})).optional(),
+	/** `number` only. */
+	min: zod.z.number().optional(),
+	max: zod.z.number().optional(),
+	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
+	default: DeliveryParamValueSchema.optional()
+});
 /**
-* Rank the catalog against a free-text query.
-*
-* An empty query returns the WHOLE catalog in key order, because a picker's
-* resting state is the full list. `extraWords` lets a caller add the words IT
-* can translate without this module knowing what a locale is; they score like a
-* synonym. The key outranks a synonym, a synonym outranks a lucide tag, and
-* ties keep key order so the list does not reshuffle between keystrokes.
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
 */
-function searchIcons(query, extraWords) {
-	const q = normalise(query);
-	if (q.length === 0) return ENTRIES.map((entry) => ({
-		entry,
-		score: 0
-	}));
-	const hits = [];
-	for (const entry of ENTRIES) {
-		const words = wordsOf(entry);
-		const keyScore = scoreWord(q, words.key, true);
-		let best = keyScore > 0 ? keyScore + 2 : 0;
-		for (const word of [...words.synonyms, ...(extraWords?.get(entry.key) ?? []).map(normalise)]) {
-			const score = scoreWord(q, word, true);
-			if (score > 0 && score + 1 > best) best = score + 1;
-		}
-		for (const word of words.tags) {
-			const score = scoreWord(q, word, false);
-			if (score > best) best = score;
-		}
-		if (best > 0) hits.push({
-			entry,
-			score: best
-		});
-	}
-	return hits.toSorted((a, b) => b.score - a.score);
-}
-/** A readable label derived from a lucide category id (`food-beverage` → `Food beverage`). */
-function iconCategoryLabel(category) {
-	const spaced = category.replace(/-/g, " ");
-	return spaced.charAt(0).toUpperCase() + spaced.slice(1);
-}
-//#endregion
-//#region src/device/location-icon.ts
+var NotificationSchema = zod.z.object({
+	body: zod.z.string(),
+	title: zod.z.string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: zod.z.number().int().min(1).max(5).default(3),
+	level: zod.z.string().optional(),
+	attachments: zod.z.array(AttachmentSchema).optional(),
+	clickUrl: zod.z.string().optional(),
+	actions: zod.z.array(NotificationActionSchema).optional(),
+	sound: zod.z.string().optional(),
+	ttl: zod.z.number().optional(),
+	tag: zod.z.string().optional(),
+	deviceId: zod.z.number().optional(),
+	eventId: zod.z.string().optional(),
+	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+	/**
+	* Values for the parameters the target's kind DECLARES in
+	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
+	* declaration by the sender; a notifier reads only the keys it declared.
+	*/
+	delivery: zod.z.record(zod.z.string(), DeliveryParamValueSchema).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: zod.z.number().int().min(1).max(5).nullable(),
+	flags: zod.z.object({
+		critical: zod.z.boolean().optional(),
+		silent: zod.z.boolean().optional(),
+		noPush: zod.z.boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: zod.z.array(zod.z.string()).optional(),
+	description: zod.z.string().optional()
+});
+/** Attachment capabilities for a kind (drives the degrade engine + test panel). */
+var TargetKindAttachmentsCapsSchema = zod.z.object({
+	mediaTypes: zod.z.array(AttachmentMediaTypeSchema),
+	mode: zod.z.enum([
+		"url",
+		"bytes",
+		"both"
+	]),
+	max: zod.z.number().int().nonnegative(),
+	maxBytes: zod.z.number().int().positive().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = zod.z.object({
+	attachments: TargetKindAttachmentsCapsSchema,
+	/** Max action buttons (0 = none). */
+	actions: zod.z.number().int().nonnegative(),
+	/**
+	* Whether this kind renders a per-action ICON.
+	*
+	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
+	* run on the addon cap path — three production failures in one day taught
+	* this repo that once. Absent is read as false by the degrade engine, which
+	* is the safe direction: an icon that is not rendered costs nothing, an icon
+	* assumed and dropped costs the operator's trust in the field.
+	*/
+	actionIcons: zod.z.boolean().optional(),
+	levels: zod.z.array(TargetKindLevelSchema),
+	format: zod.z.array(NotificationFormatSchema),
+	clickUrl: zod.z.boolean(),
+	sound: zod.z.boolean(),
+	ttl: zod.z.boolean(),
+	bodyMaxLen: zod.z.number().int().positive()
+});
 /**
-* What a location's icon is, and the ONE key its label joins on.
-*
-* A location is not an entity — it is a free-form label (`PersistedDeviceMeta.
-* location`) plus an operator-curated registry of labels in the device-manager
-* addon store. The icon is a second map beside that registry, keyed the same
-* way the registry matches everywhere else: {@link locationIconKey}, i.e.
-* trimmed + lower-cased.
-*
-* The icon itself is a key of the ONE icon catalog (`icon-catalog.ts`, D854):
-* a location may wear any icon both surfaces can draw. There used to be a
-* closed 20-icon subset here (D511); it was a second vocabulary on the same two
-* surfaces and is gone. The names below keep their meaning:
-*
-* DEGRADATION IS A FALLBACK, NEVER A HOLE. A surface that cannot draw a stored
-* value — a persisted value from a newer hub, a hand-edited settings row —
-* draws {@link LOCATION_ICON_FALLBACK} (`map-pin`, the one every surface has
-* always had). Read a stored/wire value through
-* `resolveIconKey(value, LOCATION_ICON_FALLBACK)` and that is what you get;
-* nothing anywhere renders an empty box.
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
+var ConfigSchemaPassthrough = zod.z.unknown();
+var TargetKindSchema = zod.z.object({
+	kind: zod.z.string(),
+	label: zod.z.string(),
+	icon: zod.z.string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: zod.z.string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: zod.z.string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: zod.z.string().optional(),
+	configSchema: ConfigSchemaPassthrough,
+	/**
+	* The config keys that decide WHERE this kind's secrets are sent (server,
+	* base URL, instance, chat, recipient). A save that changes any of them
+	* while leaving a secret redacted is refused by the provider (D634), so an
+	* editor uses this to ask for the secret on exactly those edits instead of
+	* on every edit.
+	*
+	* Optional: absent from a provider that holds no secret (the Home Assistant
+	* kinds) and from a provider older than this field — an editor that finds
+	* it absent must assume ANY edit may need the secret.
+	*/
+	destinationKeys: zod.z.array(zod.z.string()).optional(),
+	supportsDiscovery: zod.z.boolean(),
+	/**
+	* Extra delivery parameters a rule may set for a target of this kind (D938).
+	* Absent = none; the rule editor then offers nothing.
+	*/
+	deliveryParams: zod.z.array(DeliveryParamSchema).optional(),
+	caps: TargetKindCapsSchema
+});
 /**
-* The id every surface is guaranteed to draw, and what an unrecognised value
-* degrades to. It has been in both icon sets since before the catalog existed
-* (the Locations page's own page icon), so "the fallback is missing" is not a
-* state a build can reach.
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
 */
-var LOCATION_ICON_FALLBACK = "map-pin";
-zod.z.object({
-	locationKey: zod.z.string(),
-	icon: IconKeySchema
+var TargetSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	kind: zod.z.string(),
+	addonId: zod.z.string(),
+	enabled: zod.z.boolean(),
+	config: zod.z.record(zod.z.string(), zod.z.unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = zod.z.object({
+	kind: zod.z.string(),
+	suggestedName: zod.z.string(),
+	config: zod.z.record(zod.z.string(), zod.z.unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = zod.z.object({
+	level: zod.z.string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: zod.z.number().int().nonnegative(),
+	actionsSent: zod.z.number().int().nonnegative(),
+	truncated: zod.z.boolean(),
+	dropped: zod.z.array(zod.z.string())
+});
+var SendResultSchema = zod.z.object({
+	success: zod.z.boolean(),
+	error: zod.z.string().optional(),
+	renderedAs: RenderedAsSchema.optional()
 });
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
 /**
-* The join key for a location label: trimmed, lower-cased. The ONE place this
-* derivation lives — a caller that re-spells it is a rename away from an
-* orphaned icon.
+* Pre-save credential probe against a partial (unsaved) target config.
+* `resolvedUrl` never includes secrets (token stripped from path).
 */
-function locationIconKey(label) {
-	return label.trim().toLowerCase();
-}
-zod.z.object({
-	locationKey: zod.z.string(),
-	description: zod.z.string()
+var ProbeTargetConfigResultSchema = zod.z.object({
+	ok: zod.z.boolean(),
+	resolvedUrl: zod.z.string(),
+	httpStatus: zod.z.number().int().optional(),
+	stateInstance: zod.z.string().optional(),
+	error: zod.z.string().optional()
+});
+method(zod.z.object({}), zod.z.array(TargetKindSchema)), method(zod.z.object({}), zod.z.array(TargetSchema), { auth: "admin" }), method(zod.z.object({ targetId: zod.z.string() }), TargetSchema, { auth: "admin" }), method(zod.z.object({
+	kind: zod.z.string(),
+	config: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+	/**
+	* When editing / duplicating, the blank password field never round-trips
+	* the stored token. Pass the source target id so the provider can restore
+	* secrets server-side before dialling (same merge as upsert).
+	*/
+	targetId: zod.z.string().optional()
+}), zod.z.array(DiscoveredTargetSchema), { auth: "admin" }), method(zod.z.object({
+	kind: zod.z.string(),
+	config: zod.z.record(zod.z.string(), zod.z.unknown()),
+	/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
+	targetId: zod.z.string().optional()
+}), ProbeTargetConfigResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(zod.z.object({
+	targetId: zod.z.string(),
+	notification: NotificationSchema
+}), SendResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(zod.z.object({
+	targetId: zod.z.string(),
+	sample: NotificationSchema.optional()
+}), TestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(zod.z.object({
+	target: TargetSchema,
+	/**
+	* Duplicate flow: create a NEW target id while copying secrets from an
+	* existing row. The UI never holds the stored token; blank / redacted
+	* password fields are restored from this source (D634 still applies if
+	* destinations diverge without a re-typed secret).
+	*/
+	cloneSecretsFrom: zod.z.string().optional()
+}), TargetSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(zod.z.object({ targetId: zod.z.string() }), zod.z.void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(zod.z.object({
+	targetId: zod.z.string(),
+	enabled: zod.z.boolean()
+}), zod.z.void(), {
+	kind: "mutation",
+	auth: "admin"
 });
 //#endregion
 //#region src/catalogs/audio-classmap.ts
@@ -23123,13 +23941,28 @@ var NcRuleActionSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
 	seconds: zod.z.number().min(0).max(300)
 }), zod.z.object({
 	kind: zod.z.literal("cap"),
-	deviceId: zod.z.number().int(),
+	/**
+	* WHO the step acts on (D983) — the only shape that is written. A sequence
+	* stored before D983 carries `deviceId`; the sequence store reads it as a
+	* `devices` target.
+	*/
+	target: ActionTargetSchema.optional(),
+	/** The vocabulary action the step performs; required for a `domain` target. */
+	actionId: zod.z.string().min(1).optional(),
+	/** @deprecated The pre-D983 single device. Read, never written. */
+	deviceId: zod.z.number().int().optional(),
 	/** Capability name, e.g. `alarm-panel`. */
 	cap: zod.z.string().min(1),
 	/** Method on it. The executor refuses a non-device-scoped cap. */
 	method: zod.z.string().min(1),
 	/** Method arguments, minus `deviceId` (the executor injects it). */
 	args: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+}).refine((step) => step.target !== void 0 || step.deviceId !== void 0, {
+	message: "a cap step needs a target",
+	path: ["target"]
+}).refine((step) => step.target?.kind !== "domain" || step.actionId !== void 0, {
+	message: "a domain target needs the vocabulary action it applies to (actionId)",
+	path: ["actionId"]
 })]);
 /**
 * A named, ordered run of steps shared across rules, with its own throttle.