@camstack/addon-google-services 0.2.38 → 0.2.40

package/dist/google-services.addon.mjs

@@ -1,4 +1,4 @@
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 //#region ../types/dist/event-category-BmPm98n0.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
@@ -5981,7 +5981,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BaWhXZFm.mjs
+//#region ../types/dist/sleep-BX_MqzUe.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6581,7 +6581,7 @@ var NOT_RUN = {
 * throws: an unreachable or refusing engine is logged and reported `declared: false`,
 * because the hub (and this addon's boot) must not hang on a migration.
 */
-async function runAddonMigrations(host, migrations, logger) {
+async function runAddonMigrations(host, migrations, logger, options = {}) {
 	const first = migrations[0];
 	if (first === void 0) return NOT_RUN;
 	const owner = first.meta.owner;
@@ -6610,7 +6610,9 @@ async function runAddonMigrations(host, migrations, logger) {
 		else if (status === "blocked") blocked.push(id);
 		else skipped.push(id);
 	};
+	const selected = options.only === void 0 ? null : new Set(options.only);
 	for (const step of declaration.steps) {
+		if (selected !== null && !selected.has(step.id)) continue;
 		const bound = byId.get(step.id);
 		if (bound === void 0 || step.action === "skip") {
 			skipped.push(step.id);
@@ -6788,6 +6790,12 @@ function projectStore(store, perNodeKeys, nodeId) {
 	}
 	return out;
 }
+/** Every scope, in the order the guard and the docs list them. */
+var SCOPED_SETTINGS_SCOPES = [
+	"cluster",
+	"device-defaults",
+	"node"
+];
 /**
 * The address of one keychain value: `secret://<owner>/<scope>/<fieldPath>`.
 *
@@ -7602,6 +7610,28 @@ var SECRET_RETRY_MAX_MS = 5 * 6e4;
 /** Coalesces a burst of `keychain.changed` events into one re-resolve. */
 var SECRET_CHANGE_DEBOUNCE_MS = 250;
 /**
+* Pair a catalogue with the function that builds its ports FROM THE MIGRATION API. The one
+* place a catalogue is bound: a migration reaches nothing a ports binder cannot reach
+* through `api` (guard `check-migration-ports-surface`).
+*/
+function migrationSet(catalogue, bindPorts) {
+	return { bind: (api) => defineAddonMigrations(catalogue, bindPorts(api)) };
+}
+/** A mixed array is a mistake: the other kind would be dropped without a word. */
+function refuseMixed(form, kept, dropped) {
+	if (dropped > 0) throw new Error(`runMigrations(${form}): ${dropped} of ${kept + dropped} entries are of the other kind and would be dropped; pass one kind per call`);
+}
+function catalogueOf(list) {
+	const kept = list.filter((entry) => !("execute" in entry));
+	refuseMixed("catalogue, (api) => ports", kept.length, list.length - kept.length);
+	return kept;
+}
+function boundOf(list) {
+	const kept = list.filter((entry) => "execute" in entry);
+	refuseMixed("bound migrations", kept.length, list.length - kept.length);
+	return kept;
+}
+/**
 * Base class for CamStack addons. Eliminates settings boilerplate:
 *
 * - Typed `config` property with automatic resolution from store + defaults
@@ -7679,6 +7709,13 @@ var BaseAddon = class {
 	*/
 	secretStatePaths = [];
 	_addonSecretTree = null;
+	/**
+	* D986 M4: the scoped schemas this addon declared, resolved once per capability
+	* (`loadScopedSchemas`) so the sync readers (`perNodeKeys`, the secret tree, the restart check)
+	* see them. Empty until loaded: the readers then fall back to {@link globalSettingsSchema}.
+	*/
+	_scopedByCap = /* @__PURE__ */ new Map();
+	_nodeKeysByCap = /* @__PURE__ */ new Map();
 	_deviceSecretTree = null;
 	/** Refs the last resolved config pointed at — a change to one re-resolves. */
 	_configSecretRefs = /* @__PURE__ */ new Set();
@@ -7748,6 +7785,7 @@ var BaseAddon = class {
 			this._ctx = context;
 			this._secretSettings = null;
 		}
+		await this.loadScopedSchemas();
 		await this.resolveConfig();
 		if (secrets !== void 0) this._secretChangeUnsub = secrets.onChange((ref) => {
 			if (this._configSecretRefs.has(ref)) this.scheduleSecretReresolve(SECRET_CHANGE_DEBOUNCE_MS);
@@ -7757,27 +7795,30 @@ var BaseAddon = class {
 		const normalized = normalizeAddonInitResult(result);
 		const providers = normalized && "providers" in normalized && normalized.providers ? normalized.providers : [];
 		this._registeredCapNames = providers.map((p) => p.capability.name);
+		await this.loadScopedSchemas();
 		return normalized;
 	}
+	async runMigrations(first, second, third) {
+		if (typeof second === "function") return this.runMigrationSets([migrationSet(catalogueOf(first), second)], third);
+		return this.runBound(boundOf(first), second);
+	}
 	/**
-	* Run this addon's migration catalogue (D987 M3) through the hub's `migrations`
-	* engine. Call it at the point of the boot where the data must already have the new
-	* shape — `onInitialize`, or `onRestoreDevices` for a migration that needs the
-	* restored devices — with the catalogue bound to the addon's ports
-	* (`defineAddonMigrations(ADDON_MIGRATIONS, ports)`).
-	*
-	* An engine that cannot be reached or refuses the catalogue is logged and runs
-	* nothing; the boot continues. A migration that FAILED (or was blocked by one)
-	* and declares `onFailure: 'block-owner'` makes this throw, so the addon does not
-	* serve data whose shape it cannot trust; `tolerate` migrations never do.
+	* Several catalogues of ONE owner in one declaration (the engine replaces an owner's
+	* catalogue on every declare, so two calls would each judge the other's ids "newer").
+	* Build each entry with `migrationSet(catalogue, (api) => ports)`.
 	*/
-	async runMigrations(migrations) {
+	async runMigrationSets(sets, options) {
+		const api = this.ctx.migrationApi;
+		if (api === void 0) throw new Error(`${this.ctx.id}: the migration API is not available on this context`);
+		return this.runBound(sets.flatMap((set) => set.bind(api)), options);
+	}
+	async runBound(migrations, options) {
 		const api = this.ctx.api.migrations;
 		const report = await runAddonMigrations({
 			declareOwner: (input) => api.declareOwner.mutate(input),
 			startMigration: (input) => api.startMigration.mutate(input),
 			finishMigration: (input) => api.finishMigration.mutate(input)
-		}, migrations, this.ctx.logger);
+		}, migrations, this.ctx.logger, options);
 		if (report.blockOwner.length > 0) throw new AddonMigrationsBlockedError(report.blockOwner);
 		return report;
 	}
@@ -7841,6 +7882,16 @@ var BaseAddon = class {
 	schema(schema) {
 		return schema;
 	}
+	/**
+	* The capability names whose scoped settings schemas ({@link clusterSettingsSchema},
+	* {@link nodeSettingsSchema}, {@link deviceDefaultsSchema}) this addon declares. Read BEFORE
+	* `onInitialize`, when the providers it registers are not known yet: the first config resolve
+	* must already know which keys are per node. Names the providers register at init are added
+	* once known.
+	*/
+	scopedSettingsCapabilities() {
+		return [];
+	}
 	/** Override to provide global-level settings UI schema. */
 	globalSettingsSchema(_cap) {
 		return null;
@@ -7884,7 +7935,8 @@ var BaseAddon = class {
 		return [];
 	}
 	async getGlobalSettings(overlay, cap, nodeId) {
-		const schema = this.globalSettingsSchema(cap);
+		await this.loadScopedSchemas(cap);
+		const schema = this.globalSettingsSchema(cap) ?? this.scopedFormSchema(cap);
 		if (!schema) return { sections: [] };
 		const projected = await this.readRawProjectedStore(nodeId, cap);
 		return hydrateSchema(schema, overlay ? await this.overlayKeepingMarkers(projected, overlay) : projected, { inlineSecretsAsViews: true });
@@ -7919,10 +7971,9 @@ var BaseAddon = class {
 	*
 	* Override it only when an `instanceMode: multiple` addon's instances differ: an NVR integration
 	* needs its connection fields, the default integration the addon's own sections. It is the
-	* SHAPE of the form only — the values live in `integrations.getSettings`, and the write path is
-	* unchanged (`integrations.setSettings` for an account integration).
+	* SHAPE of the form only — the values live on the instance record.
 	*/
-	async integrationSettingsSchema(_instance) {
+	async integrationFormSchema(_instance) {
 		return null;
 	}
 	/**
@@ -7968,7 +8019,7 @@ var BaseAddon = class {
 	* per-instance schema when it declares one, else its global schema (what they always showed).
 	*/
 	async getIntegrationFormSchema(instance, nodeId) {
-		const scoped = await this.integrationSettingsSchema(instance);
+		const scoped = await this.integrationFormSchema(instance);
 		if (scoped === null) return this.getGlobalSettings(void 0, void 0, nodeId);
 		return hydrateSchema(scoped, {}, { inlineSecretsAsViews: true });
 	}
@@ -8016,6 +8067,7 @@ var BaseAddon = class {
 	* resolved blob back is a no-op for every unchanged secret.
 	*/
 	async resolveGlobalStore(nodeId, cap) {
+		await this.loadScopedSchemas(cap);
 		const raw = await this._ctx?.settings?.readAddonStore() ?? {};
 		return this.projectForNode(raw, nodeId, cap);
 	}
@@ -8026,6 +8078,7 @@ var BaseAddon = class {
 	}
 	/** The PROJECTED store with its markers — the form hydrate only (D798). */
 	async readRawProjectedStore(nodeId, cap) {
+		await this.loadScopedSchemas(cap);
 		const raw = await this.rawSettings()?.readAddonStore() ?? {};
 		return this.projectForNode(raw, nodeId, cap);
 	}
@@ -8128,6 +8181,7 @@ var BaseAddon = class {
 		await this.applyGlobalPatch(patch, nodeId);
 	}
 	async applyGlobalPatch(barePatch, nodeId) {
+		await this.loadScopedSchemas();
 		const keys = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
@@ -8141,7 +8195,8 @@ var BaseAddon = class {
 		await this.resolveConfig();
 		await this.onConfigChanged();
 		this.emitLifecycle(EventCategory.AddonUpdated, { level: "global" });
-		this.maybeAutoRestart(Object.keys(barePatch), this.globalSettingsSchema());
+		const legacy = this.globalSettingsSchema();
+		this.maybeAutoRestart(Object.keys(barePatch), [...legacy === null ? [] : [legacy], ...this.loadedScopedSchemas().map((entry) => entry.schema)]);
 	}
 	/**
 	* The set of field keys the global settings schema declares `perNode: true`
@@ -8149,14 +8204,67 @@ var BaseAddon = class {
 	* declarations). Empty set ⇒ every per-node code path is bypassed and the
 	* settings API behaves exactly like the legacy node-agnostic one.
 	*/
-	_perNodeKeysCache = /* @__PURE__ */ new Map();
+	/**
+	* Load the scoped schemas of every capability this addon declares (the override and the
+	* providers registered at init, plus `extraCap`) that is not loaded yet, then drop what was
+	* derived from the previous set. Idempotent.
+	*/
+	async loadScopedSchemas(extraCap) {
+		const caps = new Set([
+			...this.scopedSettingsCapabilities(),
+			...this._registeredCapNames,
+			...extraCap === void 0 ? [] : [extraCap]
+		]);
+		let added = false;
+		for (const cap of caps) {
+			if (this._scopedByCap.has(cap)) continue;
+			const loaded = [];
+			for (const scope of SCOPED_SETTINGS_SCOPES) {
+				const schema = await this.getScopedSettingsSchema(scope, cap);
+				if (schema !== null) loaded.push({
+					scope,
+					schema
+				});
+			}
+			this._scopedByCap.set(cap, loaded);
+			added = true;
+		}
+		if (!added) return;
+		this._nodeKeysByCap = /* @__PURE__ */ new Map();
+		this._addonSecretTree = null;
+	}
+	/**
+	* The form the settings API serves while an addon declares no {@link globalSettingsSchema}: the
+	* sections of its scoped schemas, so dropping the old hook does not blank the form.
+	*/
+	scopedFormSchema(cap) {
+		const byId = /* @__PURE__ */ new Map();
+		for (const entry of this.loadedScopedSchemas(cap)) for (const section of entry.schema.sections) if (!byId.has(section.id)) byId.set(section.id, section);
+		return byId.size === 0 ? null : { sections: [...byId.values()] };
+	}
+	/** Every loaded scoped schema of `cap`, or of every loaded capability. */
+	loadedScopedSchemas(cap) {
+		if (cap !== void 0) return this._scopedByCap.get(cap) ?? [];
+		return [...this._scopedByCap.values()].flat();
+	}
+	/**
+	* The field keys that are stored per node: every field of a {@link nodeSettingsSchema}, plus
+	* the fields the legacy {@link globalSettingsSchema} still marks `perNode: true`. Derived once
+	* per `cap` argument and memoized (schemas are static declarations). Empty set ⇒ every
+	* per-node code path is bypassed and the settings API behaves like the node-agnostic one.
+	* Call {@link loadScopedSchemas} first (the async seams do).
+	*/
 	perNodeKeys(cap) {
 		const cacheKey = cap ?? "";
-		const cached = this._perNodeKeysCache.get(cacheKey);
+		const cached = this._nodeKeysByCap.get(cacheKey);
 		if (cached) return cached;
-		const schema = this.globalSettingsSchema(cap);
-		const keys = new Set(schema ? schema.sections.flatMap((section) => collectPerNodeFieldKeys(section.fields)) : []);
-		this._perNodeKeysCache.set(cacheKey, keys);
+		const legacy = this.globalSettingsSchema(cap);
+		const keys = new Set(legacy ? legacy.sections.flatMap((section) => collectPerNodeFieldKeys(section.fields)) : []);
+		for (const { scope, schema } of this.loadedScopedSchemas(cap)) {
+			if (scope !== "node") continue;
+			for (const section of schema.sections) for (const key of collectValueFieldKeys(section.fields)) keys.add(key);
+		}
+		this._nodeKeysByCap.set(cacheKey, keys);
 		return keys;
 	}
 	/**
@@ -8166,10 +8274,9 @@ var BaseAddon = class {
 	* time to return its response before the addon is torn down and
 	* re-initialised by `AddonRegistryService.restartAddon`.
 	*/
-	maybeAutoRestart(patchKeys, schema) {
-		if (!schema) return;
+	maybeAutoRestart(patchKeys, schemas) {
 		const restartKeys = /* @__PURE__ */ new Set();
-		for (const section of schema.sections) for (const field of section.fields) {
+		for (const schema of schemas) for (const section of schema.sections) for (const field of section.fields) {
 			if (field.type === "separator" || field.type === "info") continue;
 			if (field.requiresRestart) restartKeys.add(field.key);
 		}
@@ -8365,12 +8472,14 @@ var BaseAddon = class {
 	* here, in the addon's own process, so the hub keeps no copy of it.
 	*/
 	async getDeclaredSettingsKeys() {
+		await this.loadScopedSchemas();
 		return { keys: [...this.declaredKeySet()].toSorted() };
 	}
 	declaredKeySet() {
 		const keys = new Set(Object.keys(this.defaults));
 		const schema = this.globalSettingsSchema();
 		if (schema) for (const section of schema.sections) for (const key of collectFieldKeys(section.fields)) keys.add(key);
+		for (const { schema: scoped } of this.loadedScopedSchemas()) for (const section of scoped.sections) for (const key of collectFieldKeys(section.fields)) keys.add(key);
 		for (const key of this._declaredStateKeys) keys.add(key);
 		for (const path of this.secretStatePaths) {
 			const root = path.split(/[.[]/, 1)[0];
@@ -8466,7 +8575,11 @@ var BaseAddon = class {
 	}
 	/** The addon store's secret tree: schema fields by TYPE, plus `secretStatePaths`. */
 	addonSecretTree() {
-		this._addonSecretTree ??= mergeSecretStatePaths(secretTreeFromSchema(this.globalSettingsSchema()), this.secretStatePaths);
+		if (this._addonSecretTree === null) {
+			const tree = new Map(secretTreeFromSchema(this.globalSettingsSchema()));
+			for (const { schema } of this.loadedScopedSchemas()) for (const [key, node] of secretTreeFromSchema(schema)) tree.set(key, node);
+			this._addonSecretTree = mergeSecretStatePaths(tree, this.secretStatePaths);
+		}
 		return this._addonSecretTree;
 	}
 	deviceSecretTree() {
@@ -8716,6 +8829,23 @@ function dropPerNodeFields(fields) {
 	}
 	return kept;
 }
+/** The keys of the value-holding fields, recursing into layout containers. */
+function collectValueFieldKeys(fields) {
+	const collected = [];
+	for (const field of fields) {
+		if (field.type === "group") {
+			collected.push(...collectValueFieldKeys(field.fields));
+			continue;
+		}
+		if (field.type === "sub-tabs") {
+			for (const tab of field.tabs) collected.push(...collectValueFieldKeys(tab.fields));
+			continue;
+		}
+		if (field.type === "separator" || field.type === "info") continue;
+		if ("key" in field && typeof field.key === "string") collected.push(field.key);
+	}
+	return collected;
+}
 function collectFieldKeys(fields) {
 	const collected = [];
 	for (const field of fields) {
@@ -9242,6 +9372,7 @@ function defineEntryKind(name, spec) {
 		class: "config",
 		writeTrigger: spec.writeTrigger ?? "an operator adds or edits an entry in the entries UI",
 		retention: { none: "an entry goes only when the operator deletes it" },
+		...spec.maxDataBytes === void 0 ? {} : { maxDataBytes: spec.maxDataBytes },
 		...spec.database === void 0 ? {} : { database: spec.database },
 		...spec.indexes === void 0 ? {} : { indexes: spec.indexes },
 		...spec.secretArrayKeys === void 0 ? {} : { secretArrayKeys: spec.secretArrayKeys },
@@ -11921,7 +12052,7 @@ function userError(code, params, englishFallback) {
 	return new CamstackError(code, params, englishFallback);
 }
 //#endregion
-//#region ../types/dist/composition-CRNwcFYY.mjs
+//#region ../types/dist/composition-pOHbTzRB.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -13386,6 +13517,39 @@ function buildCapturingReply(envelope) {
 	return wrapper;
 }
 /**
+* The link primitive's declaration half (D1013 rule 5): what a link field names and how a kind
+* records it. Split from `instance-link.ts` so `RecordIntegrationInstances` can read the links of
+* its kind without importing the builders that import it.
+*/
+/** The body field of a link: the id of the instance it names; the target rides in the field meta. */
+function linkField(target) {
+	return string().meta({ link: target });
+}
+function linkTargetOf(meta) {
+	if (typeof meta !== "object" || meta === null) return void 0;
+	const link = Reflect.get(meta, "link");
+	const parsed = LinkTargetSchema.safeParse(link);
+	return parsed.success ? parsed.data : void 0;
+}
+var LinkTargetSchema = object({
+	cap: string().min(1),
+	kind: string().min(1).optional()
+});
+/** The links a kind declares, read from the meta of its body fields. */
+function linksOfKind(kind) {
+	const schema = kind.schema;
+	if (!(schema instanceof ZodObject)) return [];
+	const links = [];
+	for (const [field, fieldSchema] of Object.entries(schema.shape)) {
+		const to = linkTargetOf(globalRegistry.get(fieldSchema));
+		if (to !== void 0) links.push({
+			field,
+			to
+		});
+	}
+	return links;
+}
+/**
 * `RecordIntegrationInstances` - the `integration-instances` provider over ONE
 * entry kind, so an addon that holds a connection serves it in ~30 lines.
 *
@@ -13506,9 +13670,18 @@ var RecordIntegrationInstances = class {
 			...health?.lastCheckedAt !== void 0 ? { lastCheckedAt: health.lastCheckedAt } : {}
 		};
 	}
-	describe = async () => this.hooks.mintId === void 0 ? this.hooks.description : {
-		...this.hooks.description,
-		mintsId: true
+	describe = async () => {
+		const declared = linksOfKind(this.kind);
+		const links = this.hooks.description.links !== void 0 || declared.length === 0 ? {} : { links: declared.map((link) => ({
+			kind: this.kind.name,
+			field: link.field,
+			to: link.to
+		})) };
+		return {
+			...this.hooks.description,
+			...links,
+			...this.hooks.mintId === void 0 ? {} : { mintsId: true }
+		};
 	};
 	instanceFormSchema = async ({ id }) => this.hooks.formSchema(id);
 	listInstances = async () => {
@@ -13519,7 +13692,7 @@ var RecordIntegrationInstances = class {
 		return record === null ? null : this.viewOf(record);
 	};
 	/** Insert ONE row (`ifRev: 0`: an existing id is refused, never overwritten). */
-	createInstance = async ({ id, name, kind }) => {
+	createInstance = async ({ id, name, kind, values }) => {
 		const minted = id ?? this.hooks.mintId?.({
 			name,
 			...kind !== void 0 ? { kind } : {}
@@ -13529,10 +13702,20 @@ var RecordIntegrationInstances = class {
 			id: minted,
 			data: this.hooks.initialBody(name, kind)
 		}, { ifRev: 0 });
+		const patch = this.patchOf(values ?? {});
+		if (Object.keys(patch).length > 0) await this.handle.patch(minted, patch);
 		await this.hooks.onChanged?.(minted, "created");
 		return { id: minted };
 	};
 	updateInstance = async ({ id, name, values }) => {
+		const patch = this.patchOf(values);
+		if (name !== void 0) patch[this.nameField] = name;
+		await this.handle.patch(id, patch);
+		await this.hooks.onChanged?.(id, "updated");
+		return { ok: true };
+	};
+	/** The record patch a form `values` object means: secrets kept, cleared or replaced. */
+	patchOf(values) {
 		const patch = {};
 		for (const [key, value] of Object.entries(values)) {
 			if (value === void 0) continue;
@@ -13543,11 +13726,8 @@ var RecordIntegrationInstances = class {
 			else if (isSecretClear(value)) patch[key] = null;
 			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
 		}
-		if (name !== void 0) patch[this.nameField] = name;
-		await this.handle.patch(id, patch);
-		await this.hooks.onChanged?.(id, "updated");
-		return { ok: true };
-	};
+		return patch;
+	}
 	/** The switch lives in the record body; the addon is told so it applies it (D996). */
 	setInstanceEnabled = async ({ id, enabled }) => {
 		if (this.registryOwnsEnabled) throw new Error(`instance "${id}": the integrations registry owns the on/off switch of this addon; set it with integrations.update`);
@@ -13584,6 +13764,80 @@ var RecordIntegrationInstances = class {
 		};
 	}
 };
+/** No part holds the id a call named. */
+var UnknownInstanceError = class extends Error {
+	instanceId;
+	constructor(instanceId) {
+		super(`Unknown instance '${instanceId}'`);
+		this.instanceId = instanceId;
+		this.name = "UnknownInstanceError";
+	}
+};
+/** A create or a form named no kind, or a kind no part serves. */
+var UnknownInstanceKindError = class extends Error {
+	kindId;
+	constructor(kindId) {
+		super(kindId === void 0 ? "This provider has several kinds: name one" : `Unknown instance kind '${kindId}'`);
+		this.kindId = kindId;
+		this.name = "UnknownInstanceKindError";
+	}
+};
+function composeInstanceKinds(parts, base) {
+	const byKind = (kindId) => {
+		if (kindId === void 0) {
+			const only = parts.length === 1 ? parts[0] : void 0;
+			if (only === void 0) throw new UnknownInstanceKindError(void 0);
+			return only;
+		}
+		const part = parts.find((candidate) => candidate.kind.id === kindId);
+		if (part === void 0) throw new UnknownInstanceKindError(kindId);
+		return part;
+	};
+	const holderOf = async (id) => {
+		for (const part of parts) if (await part.provider.getInstance({ id }) !== null) return part;
+		throw new UnknownInstanceError(id);
+	};
+	const tagged = (part, instance) => ({
+		...instance,
+		kind: part.kind.id
+	});
+	return {
+		describe: async () => {
+			const links = (await Promise.all(parts.map(async (part) => (await part.provider.describe()).links ?? []))).flat();
+			return {
+				...base,
+				kinds: parts.map((part) => part.kind),
+				...links.length > 0 ? { links } : {}
+			};
+		},
+		instanceFormSchema: async ({ id, kind }) => {
+			return (id === null ? byKind(kind) : await holderOf(id)).provider.instanceFormSchema({ id });
+		},
+		listInstances: async () => {
+			return (await Promise.all(parts.map(async (part) => (await part.provider.listInstances()).map((instance) => tagged(part, instance))))).flat();
+		},
+		getInstance: async ({ id }) => {
+			for (const part of parts) {
+				const found = await part.provider.getInstance({ id });
+				if (found !== null) return tagged(part, found);
+			}
+			return null;
+		},
+		createInstance: async (input) => byKind(input.kind).provider.createInstance(input),
+		updateInstance: async (input) => (await holderOf(input.id)).provider.updateInstance(input),
+		setInstanceEnabled: async (input) => (await holderOf(input.id)).provider.setInstanceEnabled(input),
+		deleteInstance: async (input) => (await holderOf(input.id)).provider.deleteInstance(input),
+		testInstance: async (input) => {
+			const test = (input.id === null ? byKind(input.kind) : await holderOf(input.id)).provider.testInstance;
+			if (test === void 0) return {
+				success: false,
+				status: "inconclusive",
+				error: "This kind cannot be tested"
+			};
+			return test(input);
+		}
+	};
+}
 var EncodeProfileSchema = object({
 	video: object({
 		codec: _enum([
@@ -14629,7 +14883,13 @@ var MigrationLedgerEntrySchema = object({
 	* joined by the engine from the catalogues it knows this boot. Absent when no
 	* catalogue lists the id (a newer database).
 	*/
-	meta: MigrationMetaSchema.optional()
+	meta: MigrationMetaSchema.optional(),
+	/**
+	* Set when this is an applied row of an addon owner whose catalogue the answering
+	* process has not loaded (the owner has not declared yet): the row is applied, the
+	* process just cannot judge it. Never `skipped-newer` — that needs the owner loaded.
+	*/
+	ownerNotLoaded: boolean().optional()
 });
 /** A catalogued migration that is not applied, with where it stands. */
 var MigrationPendingEntrySchema = object({
@@ -15750,6 +16010,39 @@ var UnstampedEventMediaCountSchema = object({
 	/** Sum across both, or `null` when either lane could not be counted. */
 	total: number().int().nonnegative().nullable()
 }).nullable();
+/**
+* Where the stored event media sits, per storage location: how many media rows
+* and how many bytes carry each location id, how many carry none (legacy,
+* resolved to the default `eventMedia` location), and how many name a location
+* that was not asked about (a deleted or never-listed one).
+*
+* One covering-index aggregate per asked location plus the NULL one, and one
+* unfiltered total that scans the covering index: O(rows), not a walk of the
+* rows themselves. `unlisted` is total minus the ASKED locations minus NULL, so
+* it is a deleted location only when every location id was asked.
+* `null` is "could not be measured", never zero.
+*/
+var MediaLocationCensusInputSchema = object({ locationIds: array(string().min(1)).max(50).readonly() });
+var MediaLocationCensusSchema = object({
+	locations: array(object({
+		locationId: string(),
+		rows: number().int().nonnegative(),
+		bytes: number().nonnegative()
+	})).readonly(),
+	unstamped: object({
+		rows: number().int().nonnegative(),
+		bytes: number().nonnegative()
+	}),
+	/** Rows stamped with a location id that was not in the asked list. */
+	unlisted: object({
+		rows: number().int().nonnegative(),
+		bytes: number().nonnegative()
+	}),
+	total: object({
+		rows: number().int().nonnegative(),
+		bytes: number().nonnegative()
+	})
+});
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
 /** The independently selectable logical storage classes — every class
 * `storage.listLocationDeclarations` reports, so an operator never meets a
@@ -46289,52 +46582,7 @@ DeviceType.Light, method(object({
 	level: number().min(0).max(100),
 	lastChangedAt: number()
 });
-/**
-* `broker` — unified pub/sub broker registry, system-scoped collection.
-*
-* The cap models any kind-tagged message broker the user wants to
-* register and that other addons might consume. The first two kinds
-* are MQTT (mosquitto / aedes embedded / cloud bridge) and
-* Home Assistant (HA WebSocket — subscribe_entities + call_service).
-* Future kinds (Zigbee2MQTT bridge, ZHA, KNX, Telegram, …) plug in
-* the same surface.
-*
-* Why one cap, not one cap per kind:
-*   - The integrations page wants a single table of "every broker"
-*     across kinds; a unified cap drives it without join logic.
-*   - Generic admin operations (add / remove / test / status) are
-*     identical across kinds — duplicating them per cap was busywork.
-*   - The `network-access` cap precedent: same interface, many
-*     `providerKind: 'ingress'` implementations (Tailscale, ngrok, …).
-*
-* What stays kind-specific:
-*   - `getBrokerConfig` payload (kind decides whether it returns
-*     mqtt URL+creds, HA baseUrl+token, …) — typed as
-*     `Record<string, unknown>` at the wire; consumers narrow.
-*   - `publish` / `subscribe` / `getState` arguments (target / filter /
-*     key) — also typed as `Record<string, unknown>` so each kind can
-*     evolve its surface (MQTT topic+qos vs HA entity_id+domain)
-*     without rebreaking the cap signature.
-*   - `add` `settings` payload (different fields per kind, validated by
-*     the kind-specific provider).
-*
-* Bidirectionality:
-*   - `publish` is RPC — synchronous result (provider-defined).
-*   - `subscribe` returns a subscription handle; the actual message
-*     stream flows over the typed event-bus as `broker.message` events
-*     keyed by `(brokerId, subscriptionId)`. Consumers filter in their
-*     event handler. Subscriptions persist across reconnects — the
-*     provider re-subscribes upstream after a transport drop.
-*
-* Why event-bus push (not a subscription RPC stream):
-*   - Matches the rest of CamStack's D8 contract — events for telemetry,
-*     RPC for loss-is-a-bug. Broker messages are telemetry (a single
-*     drop is recoverable via `getState({key})`).
-*   - Frees `broker.subscribe` from holding a long-lived RPC channel.
-*   - Cross-process: events already route through `$event-bus`; no
-*     per-broker wire-shaping needed.
-*/
-var BrokerStatusEnum = _enum([
+_enum([
 	"connected",
 	"disconnected",
 	"connecting",
@@ -46342,141 +46590,12 @@ var BrokerStatusEnum = _enum([
 	"unreachable",
 	"error"
 ]);
-var BrokerInfoSchema = object({
-	/** Stable broker id. Persisted; survives addon restarts. */
-	id: string(),
-	/** Addon id of the provider that OWNS this broker.
-	*
-	*  The `broker` cap is a system-scoped collection: several addons
-	*  register a `broker` provider, each owning a DISJOINT set of
-	*  brokers (mqtt-broker owns `mqtt_*`, provider-homeassistant owns
-	*  `ha_*`). A broker therefore belongs to exactly one addon — like a
-	*  device belongs to one integration. The admin UI threads this id
-	*  back as the `{ addonId }` system-collection selector on every
-	*  id-keyed call (`get` / `getSettings` / `setSettings` / `remove` /
-	*  `testConnection`), so the call routes to the OWNING provider
-	*  instead of defaulting to the first-registered one. */
-	addonId: string(),
-	/** Human-readable name (operator-chosen at add-time). */
-	name: string(),
-	/** Provider-defined kind tag — `mqtt` / `home-assistant` / future. */
-	kind: string(),
-	status: BrokerStatusEnum,
-	/** Free-form provider-specific info (HA version, MQTT broker
-	*  flavour, latency, mTLS active, …). */
-	info: record(string(), unknown()),
-	/** Ms epoch of the last connection probe / status update. */
-	lastCheckedAt: number().nullable(),
-	/** Last error message, when `status` indicates failure. */
-	error: string().nullable()
-});
 var RegistryStatusSchema = object({
 	brokerCount: number().int().nonnegative(),
 	connectedCount: number().int().nonnegative()
 });
-/**
-* One entry per `broker` provider — which addon provides which broker
-* kind(s). The unified create picker reads this to know, for each
-* (addonId, kind) pair the operator can pick, where to route the
-* follow-up `getSettingsSchema` / `testSettings` / `add` calls (via the
-* `{ addonId }` selector). A provider only advertises a kind here when
-* it implements `getSettingsSchema` for that kind (so the picker never
-* offers a kind whose creation form can't be rendered).
-*/
-var BrokerProviderInfoSchema = object({
-	/** Addon id of the `broker` provider this entry describes. */
-	addonId: string(),
-	/** Broker kinds this provider can create, with a display label. */
-	kinds: array(object({
-		kind: string(),
-		label: string(),
-		/**
-		* Relative hub path to start an interactive account link (OAuth popup).
-		* May include `{{brokerId}}`; admin-ui substitutes and appends `?popup=1`.
-		*/
-		interactiveConnectPath: string().min(1).optional(),
-		/** Relative hub path to disconnect the linked account (same popup pattern). */
-		interactiveDisconnectPath: string().min(1).optional(),
-		/**
-		* The kind signs in through a server-held interactive session instead of
-		* (or before) typed credentials. `basePath` is a hub-relative route set
-		* served by the owning addon (`/addon/<id>/...`) speaking the sign-in
-		* contract: `POST {basePath}/start` (body: the form's settings) answers
-		* `{ sessionId, loginUrl }`; `GET {basePath}/status?sessionId=` answers
-		* `{ phase: 'starting' | 'awaiting-login' | 'captured' | 'error' |
-		* 'cancelled', loginUrl, error }`; `POST {basePath}/commit`
-		* (`{ sessionId, name, brokerId? }`) stores the credentials on a new or
-		* existing broker and answers `{ brokerId }`; `POST {basePath}/cancel`
-		* (`{ sessionId }`) drops the session. The dialog that edits a broker
-		* offers it as the default path; the fields the session fills are
-		* marked `filledBySignIn` in the kind's settings schema.
-		*
-		* `methods` lists the ways the session can sign in, recommended first:
-		* `'device-code'` adds `POST {basePath}/code/start` (body: the form's
-		* settings) answering `{ sessionId, userCode, verificationUrl,
-		* expiresAt }` — the operator types `userCode` at `verificationUrl` on
-		* any device, and the same `status` / `commit` / `cancel` routes follow
-		* (status then carries `method`, `userCode`, `verificationUrl`,
-		* `expiresAt` and the phases `'awaiting-code'` / `'expired'`);
-		* `'proxy'` is the `{basePath}/start` flow above. Absent means
-		* `['proxy']`.
-		*/
-		signIn: object({
-			basePath: string().min(1),
-			methods: array(_enum(["device-code", "proxy"])).optional()
-		}).optional()
-	}))
-});
-var ListInputSchema = object({ 
-/** Optional kind filter — `list({kind:'home-assistant'})` returns
-*  only HA brokers. Omit to list every broker. */
-kind: string().optional() });
 var GetInputSchema = object({ id: string() });
-var AddInputSchema = object({
-	kind: string().min(1),
-	name: string().min(1),
-	/**
-	* ADOPT an existing id instead of minting a new one.
-	*
-	* Written the day this cost an outage. A broker's id is not a detail: HA
-	* devices carry it inside their `stableId` (`ha:ha_004:dev:…`), so a broker
-	* lost from config and re-added as `ha_001` leaves every one of its devices
-	* bound to a broker that no longer exists. Re-entering the password under the
-	* ORIGINAL id turns a multi-step device migration back into re-entering a
-	* password.
-	*
-	* A provider MUST refuse an id that is already in use — adopting a live
-	* broker's id would silently take it over.
-	*/
-	id: string().min(1).optional(),
-	/** Kind-specific settings (e.g. MQTT `{url,username,password}` or HA
-	*  `{baseUrl,accessToken}`). Validated by the kind-specific provider
-	*  branch on receipt — invalid shape rejects the add. */
-	settings: record(string(), unknown())
-});
-var AddResultSchema = object({ id: string() });
-var RemoveInputSchema = object({ id: string() });
-var TestConnectionResultSchema = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number().nonnegative()
-}), object({
-	ok: literal(false),
-	error: string()
-})]);
 var SettingsRecordSchema$1 = record(string(), unknown());
-var SettingsSchemaInputSchema = object({ kind: string() });
-var TestSettingsInputSchema = object({
-	kind: string(),
-	settings: SettingsRecordSchema$1
-});
-var TestSettingsResultSchema = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number().nonnegative().optional()
-}).strict(), object({
-	ok: literal(false),
-	error: string()
-})]);
-var SettingsSchemaResultSchema = unknown().nullable();
 var PublishInputSchema = object({
 	brokerId: string(),
 	/** Kind-specific routing target.
@@ -46520,51 +46639,12 @@ var brokerCapability = {
 		kind: "poll"
 	},
 	methods: {
-		list: method(ListInputSchema, array(BrokerInfoSchema)),
-		get: method(GetInputSchema, BrokerInfoSchema.nullable()),
-		/** Enumerate which addon provides which broker kind(s) for the
-		*  unified create picker. The auto-mount fans this array across
-		*  every registered `broker` provider (array-output method), so the
-		*  picker sees every kind from every provider in one call. */
-		listProviders: method(_void(), array(BrokerProviderInfoSchema), { auth: "admin" }),
-		add: method(AddInputSchema, AddResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		remove: method(RemoveInputSchema, _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		testConnection: method(GetInputSchema, TestConnectionResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/** Read the persisted settings record for a broker (kind-specific
-		*  shape). Admin-only — settings may contain secrets. Returns `null`
-		*  when the broker id is unknown to the provider (the collection
-		*  fallback may route a foreign id to the first provider). */
-		getSettings: method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }),
-		/** Overwrite the persisted settings record. The kind-specific
-		*  provider validates the shape and applies the change (reconnects
-		*  if credentials changed). */
-		setSettings: method(object({
-			id: string(),
-			settings: SettingsRecordSchema$1
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
 		/** Returns the kind-specific connection config the consumer needs
 		*  to open its own client (MQTT pattern: `{url, username, password,
 		*  clientIdPrefix}`). HA providers MAY return the auth envelope
 		*  but typical HA consumers use `publish` / `subscribe` instead.
 		*  Returns `null` when the broker id is unknown to the provider. */
 		getBrokerConfig: method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }),
-		getSettingsSchema: method(SettingsSchemaInputSchema, SettingsSchemaResultSchema, { auth: "admin" }),
-		testSettings: method(TestSettingsInputSchema, TestSettingsResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
 		publish: method(PublishInputSchema, unknown(), {
 			kind: "mutation",
 			auth: "admin"
@@ -49198,6 +49278,9 @@ var RunningProposalEvidenceSchema = object({
 	runsFound: number().int().nonnegative(),
 	pausesFound: number().int().nonnegative(),
 	longestPauseMs: number().nonnegative(),
+	/** Episodes shorter than ~90 s (an anti-crease pulse, a display waking): never a run, never a pause. */
+	pulsesFound: number().int().nonnegative(),
+	longestPulseMs: number().nonnegative(),
 	idleFloorW: number(),
 	noiseCeilingW: number(),
 	plateauW: number(),
@@ -50644,7 +50727,14 @@ var DiscoveryCandidateSchema = object({
 	/** `stableId` of the gateway candidate this device was found BEHIND. */
 	parentStableId: string().optional(),
 	/** `false` = shown for context but not pickable. Default true. */
-	selectable: boolean().optional()
+	selectable: boolean().optional(),
+	/**
+	* Keys of the provider's creation form (`getChildCreationSchema`) this candidate
+	* cannot be adopted without — a key for an encrypted board, a pairing code. The
+	* admin asks for exactly these, on the creation form prefilled with
+	* `prefilledConfig`, before it adopts. Absent or empty = adopt as it is.
+	*/
+	needsParams: array(string()).optional()
 });
 /**
 * Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
@@ -50703,12 +50793,24 @@ method(_void(), _void(), { kind: "mutation" }), method(_void(), _void(), { kind:
 }), array(DiscoveryCandidateSchema), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), CreationSchemaOutputSchema), method(object({}), object({ deviceType: _enum(DeviceType).nullable() })), method(object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
+}), method(object({}), CreationSchemaOutputSchema), method(object({ 
+/** The integration asked about; a provider whose integrations differ answers per one. */
+integrationId: string().optional() }), object({ deviceType: _enum(DeviceType).nullable() })), method(object({
+	candidate: DiscoveryCandidateSchema,
+	/** The integration the operator adopts into; a provider with several instances needs it. */
+	integrationId: string().optional()
+}), DeviceSummarySchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), boolean()), method(object({ type: _enum(DeviceType) }), CreationSchemaOutputSchema), method(object({
+}), method(object({}), boolean()), method(object({
 	type: _enum(DeviceType),
-	config: record(string(), unknown())
+	/** The integration asked about; a provider whose integrations differ answers per one. */
+	integrationId: string().optional()
+}), CreationSchemaOutputSchema), method(object({
+	type: _enum(DeviceType),
+	config: record(string(), unknown()),
+	/** The integration the operator adds the device to; a provider with several instances needs it. */
+	integrationId: string().optional()
 }), DeviceSummarySchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -51418,7 +51520,10 @@ method(object({
 	auth: "admin"
 }), method(object({
 	addonId: string(),
-	type: _enum(DeviceType)
+	type: _enum(DeviceType),
+	/** The integration the form is for; a provider whose integrations differ (a hub
+	*  integration takes no manual add) answers per integration. Absent = the addon's own. */
+	integrationId: string().optional()
 }), unknown().nullable()), method(object({
 	addonId: string(),
 	type: _enum(DeviceType),
@@ -51502,7 +51607,11 @@ method(object({
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 12e4
-}), method(object({ addonId: string() }), object({ deviceType: _enum(DeviceType).nullable() }), { auth: "admin" }), method(object({ addonId: string() }), unknown(), { auth: "admin" }), method(object({
+}), method(object({
+	addonId: string(),
+	/** The integration the Add-Device dialog is open on; absent = the addon's own. */
+	integrationId: string().optional()
+}), object({ deviceType: _enum(DeviceType).nullable() }), { auth: "admin" }), method(object({ addonId: string() }), unknown(), { auth: "admin" }), method(object({
 	deviceId: number(),
 	key: string(),
 	value: unknown()
@@ -54098,7 +54207,7 @@ var TestConnectionStatusEnum = _enum([
 	"inconclusive",
 	"unsupported"
 ]);
-var TestConnectionResultSchema$1 = object({
+var TestConnectionResultSchema = object({
 	/** True ONLY for `validated`. Never true for a test that did not run. */
 	success: boolean(),
 	error: string().optional(),
@@ -54119,11 +54228,7 @@ var CreateIntegrationInputSchema = object({
 	info: record(string(), unknown()).optional(),
 	/** `stableId` of the discovery candidate the form was seeded from (D984). */
 	originStableId: string().optional(),
-	settings: record(string(), unknown()).optional(),
-	/** Keys of `settings` the form's schema declares secret (by type) — kept in
-	*  the keychain, not the table (D787). */
-	secretKeys: array(string()).optional(),
-	skipRestart: boolean().optional()
+	settings: record(string(), unknown()).optional()
 });
 var UpdateIntegrationInputSchema = object({
 	id: string(),
@@ -54144,20 +54249,10 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 }), method(object({ id: string() }), DeleteIntegrationResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ id: string() }), record(string(), unknown()), { auth: "admin" }), method(object({
-	id: string(),
-	settings: record(string(), unknown()),
-	/** Keys the form's schema declares secret (by type) — keychain-stored (D787). */
-	secretKeys: array(string()).optional(),
-	/** The integration's own addon applies the change in-process and asks the hub not to respawn it. */
-	skipRestart: boolean().optional()
-}), object({ success: boolean() }), {
-	kind: "mutation",
-	auth: "admin"
 }), method(_void(), array(AvailableIntegrationTypeSchema), { auth: "admin" }), method(object({
 	addonId: string(),
 	settings: record(string(), unknown())
-}), TestConnectionResultSchema$1, {
+}), TestConnectionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -54184,6 +54279,14 @@ var ConfigSchemaPassthrough$3 = custom();
 var IntegrationInstanceIdSchema = string().min(1);
 var IntegrationInstanceModeSchema = _enum(["single", "multiple"]);
 /**
+* What the addon's instances ARE for the Integrations page (planning#416). `devices`: each
+* instance is an integration that brings devices (the registry owns its on/off switch);
+* `services`: a connection configured from the addon's own function page, never listed on
+* Integrations.
+* It is the same vocabulary as the manifest's `integrationRole`, which stays as an override.
+*/
+var IntegrationInstanceRoleSchema = _enum(["devices", "services"]);
+/**
 * One kind of instance a provider can create (an adapter, an account type). The sign-in and
 * connect fields follow the `broker` contract (`broker.cap.ts`): `signIn.basePath` is a
 * hub-relative route set speaking the sign-in contract, `connectPath` / `disconnectPath` open an
@@ -54194,6 +54297,22 @@ var IntegrationInstanceKindSchema = object({
 	/** Stable id of the kind, sent back as `createInstance.kind`. */
 	id: string().min(1),
 	label: string().min(1),
+	/**
+	* The function capability this kind is configured for (`broker`, `smtp-provider`,
+	* `device-provider`, ...). A page section is the kinds whose `functionCap` it names (D1013); a
+	* provider with more than one section must name it on every kind.
+	*/
+	functionCap: string().min(1),
+	/**
+	* For `functionCap: 'broker'`: the registry kind of the broker an instance of this kind is
+	* (`matter`, `home-assistant`, ...). A caller that needs a broker of one kind (a link field)
+	* finds the instances whose kind names it; absent takes the kind `id`.
+	*/
+	brokerKind: string().min(1).optional(),
+	/** What instances of this kind are for the Integrations page; absent takes the provider's `role`. */
+	role: IntegrationInstanceRoleSchema.optional(),
+	/** `testInstance` really probes the remote for this kind; absent takes the provider's `canTest`. */
+	canTest: boolean().optional(),
 	/** The kind signs in through a server-held interactive session. */
 	signIn: object({
 		basePath: string().min(1),
@@ -54204,22 +54323,38 @@ var IntegrationInstanceKindSchema = object({
 	/** Relative hub path to disconnect that account. */
 	disconnectPath: string().min(1).optional()
 });
+/**
+* How devices of an instance are found. `none`: the operator adds them by hand; `lan`: the addon
+* scans the network before any instance exists (the wizard offers the candidates); `account`: the
+* devices appear after the instance signs in. `scopedToInstance`: a discovery run belongs to ONE
+* instance and its candidates are claimed by it.
+*/
+var IntegrationInstanceDiscoverySchema = object({
+	mode: _enum([
+		"none",
+		"lan",
+		"account"
+	]),
+	scopedToInstance: boolean()
+});
+/**
+* One link a kind of this provider declares (D1013 rule 5): the body `field` of an instance of
+* `kind` holds the id of an instance of the function cap `to.cap` (of kind `to.kind`, when set).
+* The hub indexes these so the target's delete is refused while a link names it.
+*/
+var IntegrationInstanceLinkSchema = object({
+	kind: string().min(1),
+	field: string().min(1),
+	to: object({
+		cap: string().min(1),
+		kind: string().min(1).optional()
+	})
+});
 var IntegrationInstanceDescriptionSchema = object({
 	/** What the instances are for the Integrations page; see {@link IntegrationInstanceRoleSchema}. */
-	role: _enum([
-		"devices",
-		"services",
-		"both"
-	]),
+	role: IntegrationInstanceRoleSchema,
 	/** How the devices of an instance are found; absent means `{ mode: 'none' }`. */
-	discovery: object({
-		mode: _enum([
-			"none",
-			"lan",
-			"account"
-		]),
-		scopedToInstance: boolean()
-	}).optional(),
+	discovery: IntegrationInstanceDiscoverySchema.optional(),
 	/** `single`: at most one instance can exist (Loki). `multiple`: an account each. */
 	instanceMode: IntegrationInstanceModeSchema,
 	/** What the instance is, for the UI (`destination`, `relay`, `account`). */
@@ -54240,7 +54375,9 @@ var IntegrationInstanceDescriptionSchema = object({
 	* `createInstance` without an `id` works: the provider mints it. Absent means the caller must
 	* send an id (the UI then mints an opaque one).
 	*/
-	mintsId: boolean().optional()
+	mintsId: boolean().optional(),
+	/** The links to other instances the provider's kinds declare; absent means none. */
+	links: array(IntegrationInstanceLinkSchema).optional()
 });
 var IntegrationInstanceStatusSchema = object({
 	state: _enum([
@@ -54285,7 +54422,11 @@ var integrationInstancesCapability = {
 	methods: {
 		describe: method(_void(), IntegrationInstanceDescriptionSchema, { auth: "admin" }),
 		/** The form; `id: null` is the create form. */
-		instanceFormSchema: method(object({ id: IntegrationInstanceIdSchema.nullable() }), ConfigSchemaPassthrough$3, { auth: "admin" }),
+		instanceFormSchema: method(object({
+			id: IntegrationInstanceIdSchema.nullable(),
+			/** The kind of the create form (`id: null`) of a provider with several. */
+			kind: string().min(1).optional()
+		}), ConfigSchemaPassthrough$3, { auth: "admin" }),
 		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
 		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
 		/**
@@ -54295,7 +54436,9 @@ var integrationInstancesCapability = {
 		createInstance: method(object({
 			id: IntegrationInstanceIdSchema.optional(),
 			name: string().min(1),
-			kind: string().min(1).optional()
+			kind: string().min(1).optional(),
+			/** Form values written with the record (a link picked in the create dialog). */
+			values: record(string(), unknown()).optional()
 		}), object({ id: string() }), {
 			kind: "mutation",
 			auth: "admin"
@@ -54322,8 +54465,10 @@ var integrationInstancesCapability = {
 		}),
 		testInstance: optionalMethod(object({
 			id: IntegrationInstanceIdSchema.nullable(),
-			values: record(string(), unknown())
-		}), TestConnectionResultSchema$1, {
+			values: record(string(), unknown()),
+			/** The kind to test when `id` is null and the provider has several. */
+			kind: string().min(1).optional()
+		}), TestConnectionResultSchema, {
 			kind: "mutation",
 			auth: "admin"
 		})
@@ -56828,6 +56973,380 @@ var SystemMetricsSchema = object({
 	gpuMemoryPercent: number().optional()
 });
 method(_void(), SystemResourceSnapshotSchema), method(_void(), SystemResourceSnapshotSchema.nullable()), method(_void(), SystemMetricsSchema), method(object({ dirPath: string() }), DiskSpaceInfoSchema), method(_void(), MetricsGpuInfoSchema.nullable()), method(_void(), number().nullable()), method(object({ pids: array(number()) }), array(PidResourceStatsSchema)), method(_void(), array(AddonInstanceSchema).readonly()), method(object({ addonId: string() }), PidResourceStatsSchema.nullable()), method(_void(), array(NodeProcessSchema).readonly()), method(GetLoadSeriesInputSchema, NodeLoadSeriesSchema);
+/**
+* records - an addon's own facts and documents (D881): ledgers, audit rows,
+* config documents, mirrors. The third storage API next to `ctx.settings`
+* (operator intent, D870) and device-history (numbers over time, D850).
+*
+* Who the OWNER is: `callerAddonId`, stamped by the transport on a call that
+* crossed a process and stated by a hub in-process caller (`ctx.records` does
+* that with the addon id closed over). It is deliberately NOT in any input
+* schema, so a session can never supply it, and a call with no stamp is refused
+* `records/no-caller`. A kind is readable and writable only by its owner; other
+* addons go through the owner's capability.
+*
+* Every read is three-way: a row, `null`, or the call THROWS. A failed read is
+* never `[]`. Secret fields are never on the wire: a read shows the
+* redaction token, `secretRefs` hands the owner's `ctx.secrets` the refs it
+* resolves itself, and a write may carry only a keychain marker bound to the
+* row's own ref.
+*
+* Internal: addons reach it through `ctx.records`, never directly.
+*/
+var RecordIdSchema = string().min(1).max(256);
+/** A JSON object body. Size is the engine's check (`maxDataBytes`), not a schema's. */
+var RecordBodySchema = record(string(), unknown());
+var RecordInputSchema = object({
+	id: RecordIdSchema,
+	/** The device this row belongs to (D865 removal, per-device reads). */
+	deviceId: number().int().optional(),
+	/** The domain clock, ms: observed / created / opened. */
+	at: number().int().optional(),
+	/** Producer-set expiry, ms. Refused on a kind whose retention is an engine TTL. */
+	expiresAt: number().int().optional(),
+	data: RecordBodySchema
+});
+var RecordViewSchema = object({
+	id: string(),
+	deviceId: number().int().nullable(),
+	at: number().nullable(),
+	expiresAt: number().nullable(),
+	rev: number().int(),
+	updatedAt: number(),
+	data: RecordBodySchema
+});
+/** Declared index fields only. Anything else does not compile, by design. */
+var RecordWhereSchema = record(RecordFieldPathSchema, union([
+	string(),
+	number(),
+	boolean(),
+	object({ in: array(union([
+		string(),
+		number(),
+		boolean()
+	])).min(1).max(RECORD_BATCH_MAX) }),
+	object({
+		gt: union([string(), number()]).optional(),
+		gte: union([string(), number()]).optional(),
+		lt: union([string(), number()]).optional(),
+		lte: union([string(), number()]).optional()
+	}).refine((r) => Object.keys(r).length > 0, { message: "name at least one bound" })
+]));
+var KindShape = { kind: RecordKindNameSchema };
+var TimeWindowShape = {
+	deviceId: number().int().optional(),
+	atFrom: number().optional(),
+	atTo: number().optional()
+};
+var RecordQueryInputSchema = object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional(),
+	/** Without `where`: `at` (default for a kind with a clock) or `id`. With `where` the order is the index's. */
+	order: _enum(["at", "id"]).optional(),
+	desc: boolean().optional(),
+	limit: number().int().min(1).max(RECORD_QUERY_MAX).default(100),
+	/** Opaque keyset cursor from a previous answer. There is no offset. */
+	cursor: string().min(1).optional()
+});
+var RecordQueryResultSchema = object({
+	records: array(RecordViewSchema),
+	nextCursor: string().nullable()
+});
+var RecordKindStateSchema = _enum([
+	"created",
+	"unchanged",
+	"updated"
+]);
+var DeclareKindResultSchema = object({
+	kindId: number().int(),
+	state: RecordKindStateSchema,
+	createdIndexes: array(string())
+});
+/** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
+var SecretRefsList = array(string());
+/**
+* One op of a `transact`: the single-row writes, each on a kind of the caller.
+* All ops of one call share ONE database file and ONE `transactFamily`.
+*/
+var RecordTransactOpSchema = discriminatedUnion("op", [
+	object({
+		op: literal("put"),
+		kind: RecordKindNameSchema,
+		record: RecordInputSchema,
+		ifRev: number().int().min(0).optional()
+	}),
+	object({
+		op: literal("patch"),
+		kind: RecordKindNameSchema,
+		id: RecordIdSchema,
+		data: RecordBodySchema,
+		at: number().int().nullable().optional(),
+		expiresAt: number().int().nullable().optional(),
+		ifRev: number().int().min(1).optional()
+	}),
+	object({
+		op: literal("delete"),
+		kind: RecordKindNameSchema,
+		id: RecordIdSchema
+	})
+]);
+var RecordSecretRefsSchema = record(string(), record(string(), string()));
+method(object({ kinds: record(RecordKindNameSchema, RecordKindDeclarationSchema) }), object({ kinds: record(string(), DeclareKindResultSchema) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), RecordViewSchema.nullable(), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), array(RecordViewSchema), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), RecordSecretRefsSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	record: RecordInputSchema,
+	/** Compare-and-set. `0` means "the row must not exist". */
+	ifRev: number().int().min(0).optional()
+}), object({
+	rev: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	records: array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	count: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema,
+	data: RecordBodySchema,
+	at: number().int().nullable().optional(),
+	expiresAt: number().int().nullable().optional(),
+	ifRev: number().int().min(1).optional()
+}), object({
+	rev: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), object({
+	deleted: boolean(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	deleted: number().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(RecordQueryInputSchema, RecordQueryResultSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional()
+}), object({ count: number().int() }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number().int().optional(),
+	from: number(),
+	to: number(),
+	bucketMs: number().int().positive()
+}), object({ buckets: array(object({
+	bucketStart: number(),
+	count: number().int()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	op: _enum([
+		"sum",
+		"min",
+		"max",
+		"count"
+	]),
+	field: RecordFieldPathSchema.optional(),
+	groupBy: RecordFieldPathSchema.optional(),
+	where: RecordWhereSchema.optional()
+}), object({ rows: array(object({
+	group: union([
+		string(),
+		number(),
+		_null()
+	]),
+	value: number().nullable()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number().int().optional(),
+	atBefore: number().optional(),
+	where: RecordWhereSchema.optional()
+}), object({
+	deleted: number().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ ops: array(RecordTransactOpSchema).min(1).max(RECORD_BATCH_MAX) }), object({
+	results: array(object({
+		rev: number().int().nullable(),
+		deleted: boolean()
+	})),
+	releasedRefs: SecretRefsList,
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int(),
+	kinds: array(RecordKindNameSchema).optional()
+}), object({
+	deleted: record(string(), number().int()),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object(KindShape), object({ id: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* The wire shapes of the migration API, version 1 (planning#447).
+*
+* A migration is code that outlives the server it was written against: an addon at
+* version 1.4 that is brought to 1.9 in one jump still runs its 1.4 catalogue, against
+* the 1.9 kernel. The only thing that code may call is {@link MigrationApiV1}; this file
+* is the contract of every method of it, one Zod pair per method.
+*
+* APPEND-ONLY. A released method is never removed and never changes meaning: an input
+* field is never removed or made required, an enum never narrows, an output field is
+* never removed. A change that cannot be expressed that way is `migration-api.v2`, next
+* to this file. `scripts/check-migration-api-append-only.ts` holds the line against
+* `scripts/migration-api-contract.json`, and every `behaviours` id below must have an
+* `it('<id>'` in `migration-api.contract.spec.ts`.
+*/
+var Rows = record(string(), unknown());
+var IntegrationId = object({ integrationId: string().min(1) });
+var RecordId = object({ id: string().min(1) });
+var RecordRowSchema = object({
+	id: string(),
+	deviceId: number().int().nullable(),
+	at: number().nullable(),
+	expiresAt: number().nullable(),
+	rev: number().int(),
+	updatedAt: number(),
+	data: Rows
+});
+var RecordPutShape = {
+	id: string().min(1),
+	deviceId: number().int().optional(),
+	at: number().int().optional(),
+	expiresAt: number().int().optional(),
+	data: Rows
+};
+var MigrationIntegrationSchema = object({
+	id: string(),
+	addonId: string(),
+	name: string(),
+	info: Rows,
+	originStableId: string().optional()
+});
+var MigrationDeviceSchema = object({
+	id: number().int(),
+	integrationId: string().nullable().optional(),
+	/** The owning device; null or absent for a root. */
+	parentDeviceId: number().int().nullable().optional(),
+	type: string().optional(),
+	name: string().optional(),
+	stableId: string().optional()
+});
+/** What the engine says about the migration API it serves: lets an addon notice an older server. */
+var MigrationApiInfoSchema = object({
+	version: number().int(),
+	methods: array(string())
+});
+object({
+	message: string(),
+	meta: Rows.optional(),
+	/** Grouping tags of the line; a line about a device carries `{ deviceId }`. */
+	tags: object({ deviceId: number().int().optional() }).optional()
+});
+object({
+	owner: string().min(1),
+	metas: array(MigrationMetaSchema)
+}), object({
+	bootId: string(),
+	snapshot: _enum([
+		"none",
+		"written",
+		"refused"
+	]),
+	steps: array(MigrationOwnerStepSchema),
+	/** The migration API the engine serves; absent from a server that predates it. */
+	migrationApi: MigrationApiInfoSchema.optional()
+}), object({ id: string().min(1) }), object({
+	proceed: boolean(),
+	state: union([literal("pending"), MigrationStatusSchema]),
+	reason: string().nullable()
+}), object({
+	id: string().min(1),
+	result: MigrationOwnerResultSchema
+}), object({
+	status: MigrationStatusSchema,
+	error: string().nullable(),
+	rowsChanged: number().int().nonnegative()
+}), object({
+	rows: number().int().nonnegative(),
+	secrets: number().int().nonnegative()
+}), IntegrationId.extend({ patch: Rows }), object({ written: boolean() }), IntegrationId.extend({ keys: array(string().min(1)) }), object({
+	present: boolean(),
+	removed: Rows
+}), RecordRowSchema.nullable(), RecordRowSchema.nullable(), object({
+	...RecordPutShape,
+	ifRev: number().int().optional()
+}), object({ rev: number().int() }), object({ records: array(object(RecordPutShape)) }), object({ count: number().int().nonnegative() }), RecordId.extend({
+	partial: Rows,
+	ifRev: number().int().optional()
+}), object({ rev: number().int() }), object({ deleted: boolean() }), object({
+	deviceId: number().int().optional(),
+	atFrom: number().optional(),
+	atTo: number().optional(),
+	where: RecordWhereSchema.optional(),
+	limit: number().int().min(1).optional(),
+	cursor: string().min(1).optional(),
+	resolveSecrets: boolean().optional()
+}), object({
+	records: array(RecordRowSchema),
+	nextCursor: string().nullable()
+}), object({
+	deviceId: number().int().optional(),
+	atBefore: number().optional(),
+	where: RecordWhereSchema.optional()
+}), object({ count: number().int().nonnegative() }), object({}), object({ store: Rows }), object({ patch: Rows }), object({}), object({ keys: array(string().min(1)) }), object({ removed: array(string()) }), object({ refs: array(string()) }), object({ values: record(string(), string().nullable()) }), object({
+	ref: string().min(1),
+	value: string()
+}), object({}), object({ refs: array(string()) }), object({ deleted: number().int().nonnegative() }), object({}), object({ integrations: array(MigrationIntegrationSchema) }), object({ id: string().min(1) }), MigrationIntegrationSchema.nullable(), object({
+	addonId: string().min(1),
+	integrationId: string().min(1).optional()
+}), object({ devices: array(MigrationDeviceSchema) }), object({ deviceId: number().int() }), object({
+	id: number().int(),
+	integrationId: string().nullable(),
+	/** Whether the device carries any stored config; its content is not offered. */
+	hasConfig: boolean()
+}).nullable(), object({
+	deviceId: number().int(),
+	integrationId: string().min(1)
+}), object({}), object({}), object({ nodeId: string() }), object({}), object({});
 method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { auth: "admin" }), method(object({ owner: string().optional() }), object({ pending: array(MigrationPendingEntrySchema) }), { auth: "admin" }), method(object({ id: string().min(1) }), MigrationDryRunResultSchema, { auth: "admin" }), method(object({
 	id: string().min(1),
 	error: string().min(1)
@@ -56857,7 +57376,9 @@ method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { aut
 		"written",
 		"refused"
 	]),
-	steps: array(MigrationOwnerStepSchema)
+	steps: array(MigrationOwnerStepSchema),
+	/** The migration API this engine serves (additive: a server that predates it omits it). */
+	migrationApi: MigrationApiInfoSchema.optional()
 }), {
 	kind: "mutation",
 	auth: "admin"
@@ -56878,6 +57399,27 @@ method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { aut
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ integrationId: string().min(1) }), record(string(), unknown()), { auth: "admin" }), method(object({ integrationId: string().min(1) }), object({
+	rows: number().int().nonnegative(),
+	secrets: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	integrationId: string().min(1),
+	patch: record(string(), unknown())
+}), object({ written: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	integrationId: string().min(1),
+	keys: array(string().min(1))
+}), object({
+	present: boolean(),
+	removed: record(string(), unknown())
+}), {
+	kind: "mutation",
+	auth: "admin"
 });
 method(object({
 	sourceUrl: string(),
@@ -59503,7 +60045,10 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(RelocateMediaInputSchema, object({ jobId: string() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }), method(RelocatableMediaCountInputSchema, RelocatableMediaCountSchema, {
+}), method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }), method(MediaLocationCensusInputSchema, MediaLocationCensusSchema, {
+	kind: "query",
+	auth: "admin"
+}), method(RelocatableMediaCountInputSchema, RelocatableMediaCountSchema, {
 	kind: "query",
 	auth: "admin"
 }), method(object({}), array(RelocateJobSchema).readonly(), {
@@ -61910,7 +62455,7 @@ var BrokerStatusSchema$1 = _enum([
 	"unreachable",
 	"tls-error"
 ]);
-var BrokerInfoSchema$1 = object({
+var BrokerInfoSchema = object({
 	id: string(),
 	name: string(),
 	url: string(),
@@ -61973,7 +62518,7 @@ var StatusSchema = object({
 	brokerCount: number(),
 	embeddedRunning: boolean()
 });
-method(_void(), array(BrokerInfoSchema$1)), method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }), method(AddBrokerInputSchema, AddBrokerResultSchema, {
+method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }), method(AddBrokerInputSchema, AddBrokerResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(IdInputSchema, _void(), {
@@ -68291,253 +68836,6 @@ DeviceType.Camera, DeviceType.Sensor, DeviceType.Switch, DeviceType.Gateway, met
 	auth: "admin"
 });
 /**
-* records - an addon's own facts and documents (D881): ledgers, audit rows,
-* config documents, mirrors. The third storage API next to `ctx.settings`
-* (operator intent, D870) and device-history (numbers over time, D850).
-*
-* Who the OWNER is: `callerAddonId`, stamped by the transport on a call that
-* crossed a process and stated by a hub in-process caller (`ctx.records` does
-* that with the addon id closed over). It is deliberately NOT in any input
-* schema, so a session can never supply it, and a call with no stamp is refused
-* `records/no-caller`. A kind is readable and writable only by its owner; other
-* addons go through the owner's capability.
-*
-* Every read is three-way: a row, `null`, or the call THROWS. A failed read is
-* never `[]`. Secret fields are never on the wire: a read shows the
-* redaction token, `secretRefs` hands the owner's `ctx.secrets` the refs it
-* resolves itself, and a write may carry only a keychain marker bound to the
-* row's own ref.
-*
-* Internal: addons reach it through `ctx.records`, never directly.
-*/
-var RecordIdSchema = string().min(1).max(256);
-/** A JSON object body. Size is the engine's check (`maxDataBytes`), not a schema's. */
-var RecordBodySchema = record(string(), unknown());
-var RecordInputSchema = object({
-	id: RecordIdSchema,
-	/** The device this row belongs to (D865 removal, per-device reads). */
-	deviceId: number().int().optional(),
-	/** The domain clock, ms: observed / created / opened. */
-	at: number().int().optional(),
-	/** Producer-set expiry, ms. Refused on a kind whose retention is an engine TTL. */
-	expiresAt: number().int().optional(),
-	data: RecordBodySchema
-});
-var RecordViewSchema = object({
-	id: string(),
-	deviceId: number().int().nullable(),
-	at: number().nullable(),
-	expiresAt: number().nullable(),
-	rev: number().int(),
-	updatedAt: number(),
-	data: RecordBodySchema
-});
-/** Declared index fields only. Anything else does not compile, by design. */
-var RecordWhereSchema = record(RecordFieldPathSchema, union([
-	string(),
-	number(),
-	boolean(),
-	object({ in: array(union([
-		string(),
-		number(),
-		boolean()
-	])).min(1).max(RECORD_BATCH_MAX) }),
-	object({
-		gt: union([string(), number()]).optional(),
-		gte: union([string(), number()]).optional(),
-		lt: union([string(), number()]).optional(),
-		lte: union([string(), number()]).optional()
-	}).refine((r) => Object.keys(r).length > 0, { message: "name at least one bound" })
-]));
-var KindShape = { kind: RecordKindNameSchema };
-var TimeWindowShape = {
-	deviceId: number().int().optional(),
-	atFrom: number().optional(),
-	atTo: number().optional()
-};
-var RecordQueryInputSchema = object({
-	...KindShape,
-	...TimeWindowShape,
-	where: RecordWhereSchema.optional(),
-	/** Without `where`: `at` (default for a kind with a clock) or `id`. With `where` the order is the index's. */
-	order: _enum(["at", "id"]).optional(),
-	desc: boolean().optional(),
-	limit: number().int().min(1).max(RECORD_QUERY_MAX).default(100),
-	/** Opaque keyset cursor from a previous answer. There is no offset. */
-	cursor: string().min(1).optional()
-});
-var RecordQueryResultSchema = object({
-	records: array(RecordViewSchema),
-	nextCursor: string().nullable()
-});
-var RecordKindStateSchema = _enum([
-	"created",
-	"unchanged",
-	"updated"
-]);
-var DeclareKindResultSchema = object({
-	kindId: number().int(),
-	state: RecordKindStateSchema,
-	createdIndexes: array(string())
-});
-/** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
-var SecretRefsList = array(string());
-/**
-* One op of a `transact`: the single-row writes, each on a kind of the caller.
-* All ops of one call share ONE database file and ONE `transactFamily`.
-*/
-var RecordTransactOpSchema = discriminatedUnion("op", [
-	object({
-		op: literal("put"),
-		kind: RecordKindNameSchema,
-		record: RecordInputSchema,
-		ifRev: number().int().min(0).optional()
-	}),
-	object({
-		op: literal("patch"),
-		kind: RecordKindNameSchema,
-		id: RecordIdSchema,
-		data: RecordBodySchema,
-		at: number().int().nullable().optional(),
-		expiresAt: number().int().nullable().optional(),
-		ifRev: number().int().min(1).optional()
-	}),
-	object({
-		op: literal("delete"),
-		kind: RecordKindNameSchema,
-		id: RecordIdSchema
-	})
-]);
-var RecordSecretRefsSchema = record(string(), record(string(), string()));
-method(object({ kinds: record(RecordKindNameSchema, RecordKindDeclarationSchema) }), object({ kinds: record(string(), DeclareKindResultSchema) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	id: RecordIdSchema
-}), RecordViewSchema.nullable(), { auth: "admin" }), method(object({
-	...KindShape,
-	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
-}), array(RecordViewSchema), { auth: "admin" }), method(object({
-	...KindShape,
-	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
-}), RecordSecretRefsSchema, { auth: "admin" }), method(object({
-	...KindShape,
-	record: RecordInputSchema,
-	/** Compare-and-set. `0` means "the row must not exist". */
-	ifRev: number().int().min(0).optional()
-}), object({
-	rev: number().int(),
-	releasedRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	records: array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX)
-}), object({
-	count: number().int(),
-	releasedRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	id: RecordIdSchema,
-	data: RecordBodySchema,
-	at: number().int().nullable().optional(),
-	expiresAt: number().int().nullable().optional(),
-	ifRev: number().int().min(1).optional()
-}), object({
-	rev: number().int(),
-	releasedRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	id: RecordIdSchema
-}), object({
-	deleted: boolean(),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
-}), object({
-	deleted: number().int(),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(RecordQueryInputSchema, RecordQueryResultSchema, { auth: "admin" }), method(object({
-	...KindShape,
-	...TimeWindowShape,
-	where: RecordWhereSchema.optional()
-}), object({ count: number().int() }), { auth: "admin" }), method(object({
-	...KindShape,
-	deviceId: number().int().optional(),
-	from: number(),
-	to: number(),
-	bucketMs: number().int().positive()
-}), object({ buckets: array(object({
-	bucketStart: number(),
-	count: number().int()
-})) }), { auth: "admin" }), method(object({
-	...KindShape,
-	op: _enum([
-		"sum",
-		"min",
-		"max",
-		"count"
-	]),
-	field: RecordFieldPathSchema.optional(),
-	groupBy: RecordFieldPathSchema.optional(),
-	where: RecordWhereSchema.optional()
-}), object({ rows: array(object({
-	group: union([
-		string(),
-		number(),
-		_null()
-	]),
-	value: number().nullable()
-})) }), { auth: "admin" }), method(object({
-	...KindShape,
-	deviceId: number().int().optional(),
-	atBefore: number().optional(),
-	where: RecordWhereSchema.optional()
-}), object({
-	deleted: number().int(),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ ops: array(RecordTransactOpSchema).min(1).max(RECORD_BATCH_MAX) }), object({
-	results: array(object({
-		rev: number().int().nullable(),
-		deleted: boolean()
-	})),
-	releasedRefs: SecretRefsList,
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int(),
-	kinds: array(RecordKindNameSchema).optional()
-}), object({
-	deleted: record(string(), number().int()),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object(KindShape), object({ id: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * record-entries - the ONE admin surface for every list of user-created entries
 * (D881): notification targets, brokers, LLM profiles, anything an addon
 * declares as an ENTRY kind (`entry: { title }` in `defineRecordKinds`).
@@ -76052,11 +76350,15 @@ discriminatedUnion("kind", [object({
 *  1. idle floor F = time-weighted median; noise ceiling N = highest value seen
 *     near F. A device that is not near one level most of the time has no floor.
 *  2. coarse activity = above max(2N, N + 5 W); consecutive stretches are episodes.
-*  3. gaps between episodes split in two by the largest log-scale jump (>= 3x):
-*     the short ones are pauses INSIDE a run (a soak), the long ones separate runs.
+*  3. an episode shorter than `PULSE_MAX_MS` is a PULSE (an anti-crease tumble, a
+*     display waking): it is neither a run nor a pause. Among the remaining
+*     episodes, gaps over `PAUSE_MAX_MS` always separate runs; the rest split in
+*     two by the largest log-scale jump (>= 3x): the short ones are pauses INSIDE
+*     a run (a soak), the long ones separate runs. A stretch under `MIN_RUN_MS`
+*     is no run.
 *  4. T = geometric mean of N and the plateau's 10th percentile, snapped to a
-*     grid a person would type; stop dwell covers the longest pause; start dwell
-*     covers the longest standby blip above T.
+*     grid a person would type; stop dwell covers the longest pause and the
+*     kind's floor; start dwell covers the longest pulse and standby blip above T.
 *  5. the numbers are proved by REPLAY through the real `dwell` evaluation: each
 *     run must hold exactly one true interval and nothing may flap outside.
 */
@@ -76067,6 +76369,10 @@ var MINUTE_MS$1 = 60 * SECOND_MS;
 30 * SECOND_MS;
 60 * SECOND_MS;
 20 * MINUTE_MS$1;
+90 * SECOND_MS;
+30 * MINUTE_MS$1;
+10 * MINUTE_MS$1;
+DeviceType.Dryer, 3 * MINUTE_MS$1, DeviceType.Dishwasher, 3 * MINUTE_MS$1, DeviceType.Washer, 10 * MINUTE_MS$1;
 10 * SECOND_MS;
 10 * SECOND_MS;
 DeviceFeature.FanSpeed, DeviceFeature.FanPreset, DeviceFeature.FanDirection, DeviceFeature.FanOscillating, DeviceFeature.CoverStoppable, DeviceFeature.CoverPositionable, DeviceFeature.CoverTilt, DeviceFeature.ValvePositionable, DeviceFeature.MediaPlayerVolume, DeviceFeature.ClimateFanMode;
@@ -77085,20 +77391,6 @@ Object.freeze({
 		access: "create",
 		role: "viewer"
 	},
-	"broker.add": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"broker.get": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"broker.getBrokerConfig": {
 		capName: "broker",
 		capScope: "system",
@@ -77106,20 +77398,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"broker.getSettings": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"broker.getSettingsSchema": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"broker.getState": {
 		capName: "broker",
 		capScope: "system",
@@ -77134,20 +77412,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"broker.list": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"broker.listProviders": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"broker.publish": {
 		capName: "broker",
 		capScope: "system",
@@ -77155,20 +77419,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"broker.remove": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
-	"broker.setSettings": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"broker.subscribe": {
 		capName: "broker",
 		capScope: "system",
@@ -77176,20 +77426,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"broker.testConnection": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"broker.testSettings": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"broker.unsubscribe": {
 		capName: "broker",
 		capScope: "system",
@@ -79822,13 +80058,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"integrations.getSettings": {
-		capName: "integrations",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"integrations.list": {
 		capName: "integrations",
 		capScope: "system",
@@ -79836,13 +80065,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"integrations.setSettings": {
-		capName: "integrations",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"integrations.testConnection": {
 		capName: "integrations",
 		capScope: "system",
@@ -80837,6 +81059,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"migrations.clearLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
 	"migrations.declareOwner": {
 		capName: "migrations",
 		capScope: "system",
@@ -80844,6 +81073,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"migrations.deleteLegacyIntegrationRowKeys": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
 	"migrations.dryRun": {
 		capName: "migrations",
 		capScope: "system",
@@ -80879,6 +81115,20 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"migrations.patchLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.readLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"migrations.restorePreMigration": {
 		capName: "migrations",
 		capScope: "system",
@@ -82139,6 +82389,13 @@ Object.freeze({
 		access: "view",
 		role: "viewer"
 	},
+	"pipelineAnalytics.getMediaLocationCensus": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"pipelineAnalytics.getMediaReclaimStatus": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -91111,6 +91368,165 @@ object({
 	delay: number().nonnegative().optional(),
 	commands: record(string(), unknown())
 });
+/** The `instance-select` field of a link, keyed like the body field it fills. */
+function linkFieldDescriptor(key, target, labels) {
+	return {
+		type: "instance-select",
+		key,
+		label: labels.label,
+		...labels.description !== void 0 ? { description: labels.description } : {},
+		required: labels.required ?? true,
+		...labels.noneLabel !== void 0 ? { noneLabel: labels.noneLabel } : {},
+		functionCap: target.cap,
+		...target.kind !== void 0 ? { kind: target.kind } : {}
+	};
+}
+/**
+* Declare the record kind of a service that links to other instances. The body is
+* `{ name, ...links, ...fields }`; the links are recorded in the kind (read back by
+* {@link linksOfKind}) so the hub can index who points at what.
+*/
+function declareLinkKind(spec) {
+	const linkShape = {};
+	for (const [field, target] of Object.entries(spec.links)) linkShape[field] = linkField(target);
+	const typed = entryBody({
+		...linkShape,
+		...spec.fields
+	});
+	return defineEntryKind(spec.name, {
+		title: spec.title,
+		schema: typed,
+		writeTrigger: spec.writeTrigger
+	});
+}
+/** The id a record holds in a link field; undefined while it names none. */
+function linkedId(body, field) {
+	const value = body[field];
+	return typeof value === "string" && value !== "" ? value : void 0;
+}
+/** The `integration-instances` provider of a service whose records link to other instances. */
+function buildLinkedInstances(records, spec) {
+	const links = linksOfKind(spec.kind);
+	const kindId = spec.instanceKind ?? spec.kind.name;
+	const instances = new RecordIntegrationInstances(records, spec.kind, {
+		description: {
+			...spec.description,
+			links: links.map((link) => ({
+				kind: kindId,
+				field: link.field,
+				to: link.to
+			}))
+		},
+		formSchema: async (id) => {
+			const first = links[0];
+			const chosen = id === null || first === void 0 || spec.dynamicSections === void 0 ? void 0 : linkedId(await instances.getResolved(id) ?? {}, first.field);
+			const dynamic = chosen !== void 0 && spec.dynamicSections !== void 0 ? await spec.dynamicSections(chosen) : [];
+			return { sections: [
+				{
+					id: "links",
+					title: "Linked instances",
+					columns: 1,
+					fields: links.map((link) => linkFieldDescriptor(link.field, link.to, spec.labels?.[link.field] ?? { label: link.field }))
+				},
+				...spec.linkSections ?? [],
+				...dynamic
+			] };
+		},
+		initialBody: (name) => spec.kind.schema.parse({
+			name,
+			...Object.fromEntries(links.map((link) => [link.field, ""]))
+		}),
+		configured: (body) => links.every((link) => linkedId(body, link.field) !== void 0) && (spec.alsoConfigured?.(body) ?? true),
+		...spec.mintId !== void 0 ? { mintId: spec.mintId } : {},
+		...spec.onChanged !== void 0 ? { onChanged: spec.onChanged } : {}
+	});
+	return instances;
+}
+entryBody({ brokerId: string() });
+/**
+* The calendars an account imports leave the account (D1013). An account record used to carry a
+* `calendarIds` array; each calendar is now a record of its own that LINKS to the account
+* (`calendars`, one per account and calendar). For every account row with an array:
+*
+*  1. each entry becomes a calendar record under a deterministic id (an existing one is kept);
+*  2. each record is read back and must name this account and calendar;
+*  3. only then is the array cleared (a patch: nothing else on the account is touched).
+*
+* An entry that names another account, or is not a calendar id at all, selected nothing before
+* (the reader only matched its own account's ids): it is counted, named in a warning and goes with
+* the array. An array that is not a list of strings is left where it is. A failure on one account
+* does not stop the others; the run then throws, and the accounts that failed keep their array.
+* Accounts are never created or deleted. Idempotent: with the arrays cleared nothing is left to do.
+*/
+/** The id of the calendar record of one (account, calendar): the same pair is always the same row. */
+function calendarRecordId(accountId, calendarId) {
+	return `cal_${createHash("sha1").update(`${accountId}\0${calendarId}`).digest("hex").slice(0, 16)}`;
+}
+function entriesOf(value) {
+	if (!Array.isArray(value)) return null;
+	const out = [];
+	for (const item of value) {
+		if (typeof item !== "string") return null;
+		out.push(item);
+	}
+	return out;
+}
+async function moveCalendarIdsToRecords(ports, spec) {
+	let created = 0;
+	let cleared = 0;
+	let dropped = 0;
+	const failed = [];
+	for (const account of await ports.listAccounts()) {
+		if (account.calendarIds === void 0 || account.calendarIds === null) continue;
+		const entries = entriesOf(account.calendarIds);
+		if (entries === null) {
+			ports.warn(`account '${account.id}': calendarIds is not a list of ids and stays as it is`);
+			failed.push(account.id);
+			continue;
+		}
+		try {
+			const own = /* @__PURE__ */ new Set();
+			const inert = [];
+			for (const entry of entries) {
+				const calendarId = spec.calendarIdOf(account.id, entry);
+				if (calendarId === null || calendarId === "") inert.push(entry);
+				else own.add(calendarId);
+			}
+			for (const calendarId of own) {
+				const recordId = calendarRecordId(account.id, calendarId);
+				const body = {
+					name: calendarId,
+					accountId: account.id,
+					calendarId
+				};
+				if (await ports.readCalendar(recordId) === null) {
+					await ports.putCalendar(recordId, body);
+					created += 1;
+				}
+				const back = await ports.readCalendar(recordId);
+				if (back?.accountId !== account.id || back.calendarId !== calendarId) throw new Error(`account '${account.id}': the calendar record '${recordId}' did not read back; the array stays`);
+			}
+			if (inert.length > 0) {
+				ports.warn(`account '${account.id}': ${inert.length} entr${inert.length === 1 ? "y" : "ies"} of calendarIds named another account or no calendar and selected nothing: ${inert.join(", ")}`);
+				dropped += inert.length;
+			}
+			await ports.clearCalendarIds(account.id);
+			cleared += 1;
+		} catch (error) {
+			ports.warn(error instanceof Error ? error.message : String(error));
+			failed.push(account.id);
+		}
+	}
+	if (failed.length > 0) throw new Error(`calendarIds kept on ${failed.length} account(s) (${failed.join(", ")}); ${created} calendar record(s) written, ${cleared} account(s) cleared`);
+	return {
+		outcome: created === 0 && cleared === 0 ? "already-done" : "done",
+		summary: {
+			created,
+			cleared,
+			dropped
+		}
+	};
+}
 //#endregion
 //#region src/google-types.ts
 /** One Google account connection (broker entry). Credentials for the OAuth
@@ -91121,28 +91537,16 @@ var GoogleBrokerEntrySchema = object({
 	clientId: string().default(""),
 	clientSecret: string().default("").meta({ secret: true }),
 	/**
-	* @deprecated Per-broker filter; import selection lives on addon
-	* `calendarIds` (Connectivity → Calendars). Kept for migrate only.
+	* @deprecated Per-broker filter; the calendars an account imports are `calendars` records
+	* (Connectivity → Calendars). Kept for migrate only.
 	*/
 	calendarFilter: string().default(""),
 	/** Default From for Gmail send — usually the connected account email. */
 	fromAddress: string().default(""),
-	fromName: string().default(""),
-	/**
-	* The stamped calendar ids (`<brokerId>:<googleCalendarId>`) this broker imports. `undefined`
-	* means "not moved here yet": the reader falls back to the shared `calendarIds` setting of
-	* the addon until the migration copied it. Empty = import none.
-	*/
-	calendarIds: array(string()).optional()
+	fromName: string().default("")
 });
 var GoogleServicesConfigSchema = object({
 	brokers: array(GoogleBrokerEntrySchema).default([]),
-	/**
-	* @deprecated The shared set (`brokerId:googleCalendarId`). Each broker owns its own
-	* `calendarIds` now; this key is read only while a broker has none, and the migration
-	* `google-services/2026-11-03-drop-shared-calendar-ids` deletes it.
-	*/
-	calendarIds: array(string()).default([]),
 	/** @deprecated Pre-broker singleton — cleared after migrateLegacyToBrokers. */
 	clientId: string().optional(),
 	/** @deprecated Pre-broker singleton — cleared after migrateLegacyToBrokers. */
@@ -91196,37 +91600,32 @@ var OAUTH_START_PATH = `/addon/google-services/oauth/start`;
 var OAUTH_CALLBACK_SUFFIX = `/addon/google-services/oauth/callback`;
 //#endregion
 //#region src/google-broker-registry.ts
+/**
+* Google broker registry — N Google accounts under kind `google`.
+* No live WS; "connected" means a refresh token exists for the broker id.
+*/
 var GoogleAddSettingsSchema = object({
 	clientId: string().min(1),
 	clientSecret: string().min(1).meta({ secret: true }),
-	/** Selected Google calendar ids; empty = import all. */
-	calendarIds: array(string()).optional(),
-	/** @deprecated Prefer calendarIds — still accepted on save. */
+	/** @deprecated Calendars are `calendars` records now — still accepted on save. */
 	calendarFilter: string().optional(),
 	fromAddress: string().optional(),
 	fromName: string().optional()
 });
-/** Persist UI calendarIds (or legacy filter string) as comma-separated filter. */
-function calendarIdsToFilter(settings) {
-	if (settings.calendarIds !== void 0) return settings.calendarIds.map((s) => s.trim()).filter((s) => s.length > 0).join(",");
-	return settings.calendarFilter ?? "";
-}
 function settingsToBrokerFields(settings) {
 	const parsed = GoogleAddSettingsSchema.parse(settings);
 	return {
 		clientId: parsed.clientId,
 		clientSecret: parsed.clientSecret,
-		calendarFilter: calendarIdsToFilter(parsed),
+		calendarFilter: parsed.calendarFilter ?? "",
 		fromAddress: parsed.fromAddress ?? "",
-		fromName: parsed.fromName ?? "",
-		...parsed.calendarIds !== void 0 ? { calendarIds: [...parsed.calendarIds] } : {}
+		fromName: parsed.fromName ?? ""
 	};
 }
 function brokerEntryToSettings(entry) {
 	return {
 		clientId: entry.clientId,
 		clientSecret: entry.clientSecret,
-		calendarIds: [...entry.calendarIds ?? parseCalendarFilter(entry.calendarFilter)],
 		fromAddress: entry.fromAddress,
 		fromName: entry.fromName
 	};
@@ -91277,18 +91676,6 @@ function migrateLegacyToBrokers(rawConfig, legacyOauth) {
 		didMigrate: true
 	};
 }
-/**
-* The stamped calendar ids one broker imports: its own set, or — while the migration has not
-* reached it — the shared setting older versions wrote, so the move never changes what is imported.
-*/
-function calendarIdsOfEntry(entry, shared) {
-	return new Set(entry?.calendarIds ?? shared);
-}
-function parseCalendarFilter(raw) {
-	const trimmed = raw.trim();
-	if (!trimmed) return /* @__PURE__ */ new Set();
-	return new Set(trimmed.split(",").map((s) => s.trim()).filter((s) => s.length > 0));
-}
 /** Local calendar id stamped as `brokerId:googleCalendarId`. */
 function stampCalendarId(brokerId, googleCalendarId) {
 	return `${brokerId}:${googleCalendarId}`;
@@ -91303,7 +91690,7 @@ function parseStampedCalendarId(stamped) {
 }
 /**
 * In-memory index over broker entries + oauth accounts. The addon owns
-* persistence; this class only allocates ids and builds BrokerInfo rows.
+* persistence; this class only allocates ids and tracks the OAuth state.
 */
 var GoogleBrokerRegistry = class {
 	nextIdCounter = 1;
@@ -91370,7 +91757,6 @@ var GoogleBrokerRegistry = class {
 		const entry = GoogleBrokerEntrySchema.parse({
 			id,
 			name,
-			calendarIds: [],
 			...fields
 		});
 		this.entries = [...this.entries, entry];
@@ -91384,7 +91770,6 @@ var GoogleBrokerRegistry = class {
 		const next = GoogleBrokerEntrySchema.parse({
 			id: prev.id,
 			name: prev.name,
-			...prev.calendarIds !== void 0 ? { calendarIds: prev.calendarIds } : {},
 			...fields
 		});
 		this.entries = this.entries.map((e, i) => i === idx ? next : e);
@@ -91400,39 +91785,14 @@ var GoogleBrokerRegistry = class {
 		this.entries = entries.map((e) => GoogleBrokerEntrySchema.parse(e));
 		this.seedCounterFromEntries(this.entries);
 	}
-	toBrokerInfo(entry, addonId) {
-		const oauth = this.oauthById.get(entry.id);
-		const connected = this.isConnected(entry.id);
-		const reauth = this.needsReauth(entry.id);
-		return {
-			id: entry.id,
-			addonId,
-			name: entry.name,
-			kind: GOOGLE_BROKER_KIND,
-			status: connected ? "connected" : reauth ? "auth-failed" : "disconnected",
-			info: {
-				accountEmail: oauth?.accountEmail ?? "",
-				hasClient: entry.clientId.length > 0
-			},
-			lastCheckedAt: connected ? Date.now() : null,
-			error: connected ? null : reauth ? "Google session expired — sign in again" : entry.clientId.length === 0 ? "Configure Client ID / secret, then Connect Google" : "Not connected — open Connect Google on this broker"
-		};
-	}
-	listBrokerInfos(addonId, kind) {
-		if (kind !== void 0 && kind !== "google") return [];
-		return this.entries.map((e) => this.toBrokerInfo(e, addonId));
-	}
 	size() {
 		return this.entries.length;
 	}
 	connectedSize() {
 		return this.entries.filter((e) => this.isConnected(e.id)).length;
 	}
-	toConfig(calendarIds = []) {
-		return {
-			brokers: [...this.entries],
-			calendarIds: [...calendarIds]
-		};
+	toConfig() {
+		return { brokers: [...this.entries] };
 	}
 	seedCounterFromEntries(entries) {
 		let maxSeen = 0;
@@ -91527,8 +91887,8 @@ function escapeHtml$1(s) {
 //#region src/google-broker-settings-schema.ts
 /**
 * Per-kind broker creation/edit form for kind=`google`.
-* Account linking (Sign in) is driven by `listProviders.interactiveConnectPath`
-* in BrokerManager — not a hard-coded Connect link in this form.
+* Account linking (Sign in) is driven by the kind's `connectPath`
+* on the instances page — not a hard-coded Connect link in this form.
 */
 function consoleLinksHtml() {
 	return [
@@ -91590,24 +91950,6 @@ function buildGoogleBrokerSettingsSchema(publicOrigin) {
 				showToggle: true
 			}]
 		},
-		{
-			id: "google-calendars-import",
-			title: "Calendars to import",
-			titleKey: "google-services:googleBrokerSettings.s_google-calendars-import.title",
-			description: "Nothing selected = no calendars imported from this account. Options appear once the account is signed in.",
-			descriptionKey: "google-services:googleBrokerSettings.s_google-calendars-import.description",
-			columns: 1,
-			fields: [{
-				type: "multiselect",
-				key: "calendarIds",
-				label: "Calendars",
-				labelKey: "google-services:googleBrokerSettings.s_google-calendars-import.calendarIds.label",
-				options: [],
-				optionsFrom: "_calendarCatalog",
-				description: "The calendars of this Google account that CamStack imports.",
-				descriptionKey: "google-services:googleBrokerSettings.s_google-calendars-import.calendarIds.description"
-			}]
-		},
 		{
 			id: "gmail-send",
 			title: "Gmail send",
@@ -91647,7 +91989,7 @@ function buildGoogleFeatureSettingsSchema(cap, publicOrigin) {
 			format: "html",
 			content: [
 				"<p>Link a Google account under Connectivity → <strong>Brokers</strong> ",
-				"(Client ID / secret + Sign in). Pick the calendars to import on each broker. ",
+				"(Client ID / secret + Sign in), then add a calendar under Connectivity → <strong>Calendars</strong>. ",
 				`OAuth redirect URI: <code>${redirect}</code>.</p>`
 			].join("")
 		}]
@@ -92127,11 +92469,76 @@ var googleBrokersEntryKind = defineEntryKind("brokers", {
 		clientSecret: GoogleBrokerEntrySchema.shape.clientSecret,
 		calendarFilter: GoogleBrokerEntrySchema.shape.calendarFilter,
 		fromAddress: GoogleBrokerEntrySchema.shape.fromAddress,
-		fromName: GoogleBrokerEntrySchema.shape.fromName,
-		calendarIds: GoogleBrokerEntrySchema.shape.calendarIds
+		fromName: GoogleBrokerEntrySchema.shape.fromName
 	}),
 	writeTrigger: "an operator adds or edits a Google OAuth broker"
 });
+/**
+* One calendar an account imports (D1013): a record that LINKS to the account it belongs to and
+* names the Google calendar by its own id (`primary`, `name@group.calendar.google.com`). The id the
+* calendar answers to elsewhere stays `<accountId>:<calendarId>` (`stampCalendarId`).
+*/
+var googleCalendarsEntryKind = declareLinkKind({
+	name: "calendars",
+	title: "Google calendars",
+	writeTrigger: "an operator adds or removes a calendar an account imports",
+	links: { accountId: {
+		cap: "broker",
+		kind: GOOGLE_BROKER_KIND
+	} },
+	fields: { calendarId: string().default("") }
+});
+//#endregion
+//#region src/google-calendar-instances.ts
+/**
+* The calendars a Google account imports as `integration-instances` (D1013): one `calendars`
+* record per (account, calendar), linking to its account through the link primitive. The calendar
+* source reads the records; nothing is stored on the account.
+*/
+var GOOGLE_CALENDAR_INSTANCE_KIND = "calendar";
+/** The stamped ids each account imports, from the calendar records. */
+function selectedStampedIds(rows) {
+	const out = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const { accountId, calendarId } = row.body;
+		if (!row.enabled || accountId === "" || calendarId === "") continue;
+		const set = out.get(accountId) ?? /* @__PURE__ */ new Set();
+		set.add(stampCalendarId(accountId, calendarId));
+		out.set(accountId, set);
+	}
+	return out;
+}
+function buildGoogleCalendarInstances(records, deps) {
+	return buildLinkedInstances(records, {
+		kind: googleCalendarsEntryKind,
+		instanceKind: GOOGLE_CALENDAR_INSTANCE_KIND,
+		description: {
+			role: "services",
+			instanceMode: "multiple",
+			kind: GOOGLE_CALENDAR_INSTANCE_KIND,
+			canTest: false
+		},
+		labels: { accountId: {
+			label: "Google account",
+			description: "The account this calendar belongs to."
+		} },
+		alsoConfigured: (body) => body.calendarId !== "",
+		dynamicSections: async (accountId) => [{
+			id: "google-calendar-pick",
+			title: "Calendar",
+			columns: 1,
+			fields: [{
+				type: "select",
+				key: "calendarId",
+				label: "Calendar",
+				options: [...await deps.catalog(accountId)],
+				description: "The calendars of that account. Sign the account in to see them."
+			}]
+		}],
+		mintId: () => `cal_${randomBytes(6).toString("hex")}`,
+		onChanged: deps.onChanged
+	});
+}
 //#endregion
 //#region src/google-instances.ts
 /**
@@ -92151,6 +92558,17 @@ function asTestResult(r) {
 		error: r.error ?? "Google rejected the check"
 	};
 }
+/** The `account` kind of the composed provider: where the OAuth sign-in starts and ends. */
+function googleAccountKind(deps) {
+	return {
+		id: GOOGLE_BROKER_KIND,
+		label: GOOGLE_BROKER_KIND_LABEL,
+		functionCap: "broker",
+		brokerKind: GOOGLE_BROKER_KIND,
+		connectPath: deps.connectPath,
+		disconnectPath: deps.disconnectPath
+	};
+}
 function buildGoogleInstances(records, deps) {
 	return new RecordIntegrationInstances(records, googleBrokersEntryKind, {
 		description: {
@@ -92158,29 +92576,16 @@ function buildGoogleInstances(records, deps) {
 			instanceMode: "multiple",
 			kind: "account",
 			canTest: true,
-			kinds: [{
-				id: GOOGLE_BROKER_KIND,
-				label: GOOGLE_BROKER_KIND_LABEL,
-				connectPath: deps.connectPath,
-				disconnectPath: deps.disconnectPath
-			}],
 			allowRestoreId: true
 		},
-		formSchema: () => {
-			const full = buildGoogleBrokerSettingsSchema(deps.publicOrigin());
-			return {
-				...full,
-				sections: full.sections.filter((s) => s.id !== "google-calendars-import")
-			};
-		},
+		formSchema: () => buildGoogleBrokerSettingsSchema(deps.publicOrigin()),
 		initialBody: (name) => ({
 			name,
 			clientId: "",
 			clientSecret: "",
 			calendarFilter: "",
 			fromAddress: "",
-			fromName: "",
-			calendarIds: []
+			fromName: ""
 		}),
 		mintId: deps.mintId,
 		kindOf: () => GOOGLE_BROKER_KIND,
@@ -92299,42 +92704,66 @@ async function planDropSharedCalendarIds(ports) {
 		} })
 	}] };
 }
-//#endregion
-//#region src/migrations/index.ts
 /** The `google-services` catalogue (D987): offered to the engine when the addon initialises. */
-var ADDON_MIGRATIONS = [{
-	meta: {
-		id: "google-services/2026-11-03-calendar-ids-to-brokers",
-		owner: "google-services",
-		level: "addon-state",
-		seq: 1,
-		dependsOn: [],
-		store: "settings",
-		scope: "cluster",
-		onFailure: "tolerate",
-		bodyKind: "procedure",
-		description: "Copy the shared calendar set to every Google broker record that has none of its own",
-		fixtureMark: "the client secret marker of a broker record the migration does not know"
-	},
-	procedure: copyCalendarIdsToBrokers
-}, {
-	meta: {
-		id: "google-services/2026-11-03-drop-shared-calendar-ids",
-		owner: "google-services",
-		level: "addon-state",
-		seq: 2,
-		dependsOn: ["google-services/2026-11-03-calendar-ids-to-brokers"],
-		store: "settings",
-		scope: "cluster",
-		onFailure: "tolerate",
-		bodyKind: "plan",
-		description: "Delete the shared calendar set once every broker shows its own",
-		fixtureMark: "the shared set parked when a broker holds a different one"
-	},
-	plan: planDropSharedCalendarIds
-}];
+var ADDON_MIGRATIONS = [
+	{
+		meta: {
+			id: "google-services/2026-11-03-calendar-ids-to-brokers",
+			owner: "google-services",
+			level: "addon-state",
+			seq: 1,
+			dependsOn: [],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "tolerate",
+			bodyKind: "procedure",
+			description: "Copy the shared calendar set to every Google broker record that has none of its own",
+			fixtureMark: "the client secret marker of a broker record the migration does not know"
+		},
+		procedure: copyCalendarIdsToBrokers
+	},
+	{
+		meta: {
+			id: "google-services/2026-11-03-drop-shared-calendar-ids",
+			owner: "google-services",
+			level: "addon-state",
+			seq: 2,
+			dependsOn: ["google-services/2026-11-03-calendar-ids-to-brokers"],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "tolerate",
+			bodyKind: "plan",
+			description: "Delete the shared calendar set once every broker shows its own",
+			fixtureMark: "the shared set parked when a broker holds a different one"
+		},
+		plan: planDropSharedCalendarIds
+	},
+	{
+		meta: {
+			id: "google-services/2026-11-07-calendar-ids-to-calendar-records",
+			owner: "google-services",
+			level: "addon-state",
+			seq: 3,
+			dependsOn: ["google-services/2026-11-03-drop-shared-calendar-ids"],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "tolerate",
+			bodyKind: "procedure",
+			description: "Write one calendar record per calendar an account imports (linked to the account), read each back, then clear the calendar array of the account row",
+			fixtureMark: "the client secret marker of the account that keeps its calendars"
+		},
+		procedure: (ports) => moveCalendarIdsToRecords(ports, { calendarIdOf: (accountId, entry) => {
+			const parsed = parseStampedCalendarId(entry);
+			return parsed?.brokerId === accountId ? parsed.googleCalendarId : null;
+		} })
+	}
+];
 //#endregion
 //#region src/migrations/ports.ts
+function listOf(value) {
+	if (!Array.isArray(value)) return void 0;
+	return value.filter((item) => typeof item === "string");
+}
 /** The migration's ports over the `brokers` record kind and the addon's raw settings read. */
 function calendarIdsPortsOver(kind, readStored) {
 	return {
@@ -92342,18 +92771,43 @@ function calendarIdsPortsOver(kind, readStored) {
 		listBrokers: async () => {
 			return (await kind.query({ limit: 1e3 })).records.map((record) => ({
 				id: record.id,
-				calendarIds: record.data.calendarIds
+				calendarIds: listOf(record.data["calendarIds"])
 			}));
 		},
 		setBrokerCalendarIds: async (id, ids) => {
 			const row = await kind.get(id);
 			if (row === null) return false;
-			if (row.data.calendarIds !== void 0) return true;
+			if (row.data["calendarIds"] !== void 0) return true;
 			await kind.patch(id, { calendarIds: [...ids] });
 			return true;
 		}
 	};
 }
+/** The ports of the calendars move: the raw `brokers` rows and the `calendars` records. */
+function calendarRecordPortsOver(deps) {
+	return {
+		warn: deps.warn,
+		listAccounts: async () => {
+			return (await deps.brokers.query({ limit: 1e3 })).records.map((record) => ({
+				id: record.id,
+				calendarIds: record.data["calendarIds"]
+			}));
+		},
+		readCalendar: async (recordId) => {
+			const row = await deps.calendars.get(recordId);
+			return row === null ? null : row.data;
+		},
+		putCalendar: async (recordId, body) => {
+			await deps.calendars.put({
+				id: recordId,
+				data: body
+			}, { ifRev: 0 });
+		},
+		clearCalendarIds: async (accountId) => {
+			await deps.brokers.patch(accountId, { calendarIds: null });
+		}
+	};
+}
 //#endregion
 //#region src/google-broker-store.ts
 function rowToEntry(id, data) {
@@ -92392,15 +92846,14 @@ var GoogleBrokerStore = class GoogleBrokerStore {
 		const nextIds = new Set(entries.map((e) => e.id));
 		for (const row of page.records) if (!nextIds.has(row.id)) await this.kind.delete(row.id);
 		for (const entry of entries) {
-			const { id, name, clientId, clientSecret, calendarFilter, fromAddress, fromName, calendarIds } = entry;
+			const { id, name, clientId, clientSecret, calendarFilter, fromAddress, fromName } = entry;
 			const body = {
 				name,
 				clientId,
 				clientSecret,
 				calendarFilter,
 				fromAddress,
-				fromName,
-				...calendarIds !== void 0 ? { calendarIds } : {}
+				fromName
 			};
 			const parsed = googleBrokersEntryKind.schema.safeParse(body);
 			if (!parsed.success) throw new Error(`invalid Google broker '${id}': ${parsed.error.message}`);
@@ -92446,6 +92899,9 @@ var GoogleServicesAddon = class extends BaseAddon {
 	registry = new GoogleBrokerRegistry();
 	brokerStore = null;
 	instances = null;
+	calendarInstances = null;
+	/** The stamped calendar ids each account imports, from the `calendars` records. */
+	calendarSelection = /* @__PURE__ */ new Map();
 	activeBrokers = [];
 	/** CSRF state → { brokerId, issuedAt } for the in-flight OAuth consents. */
 	pendingStates = /* @__PURE__ */ new Map();
@@ -92491,15 +92947,23 @@ var GoogleServicesAddon = class extends BaseAddon {
 		}
 		const records = this.ctx.records;
 		if (records === void 0) throw new Error("google-services: ctx.records is required (hub-only addon)");
-		await records.declare({ brokers: googleBrokersEntryKind });
+		await records.declare({
+			brokers: googleBrokersEntryKind,
+			calendars: googleCalendarsEntryKind
+		});
 		this.brokerStore = GoogleBrokerStore.of(records);
 		this.instances = this.buildInstances(records);
+		this.calendarInstances = buildGoogleCalendarInstances(records, {
+			catalog: (accountId) => this.loadCalendarCatalog(accountId),
+			onChanged: () => this.refreshCalendarSelection()
+		});
 		this.activeBrokers = await this.loadPersistedBrokers();
 		if ((await this.brokerStore.listResolved()).length === 0 && this.config.brokers.length > 0) {
 			await this.brokerStore.replaceAll(this.config.brokers);
 			this.activeBrokers = await this.loadPersistedBrokers();
 		}
 		await this.migrateCalendarIds(records);
+		await this.refreshCalendarSelection();
 		this.registry.seedFrom(this.activeBrokers, oauthAccounts.accounts);
 		await this.refreshPublicOrigin();
 		const calendarProvider = createGoogleCalendarSource({
@@ -92509,7 +92973,7 @@ var GoogleServicesAddon = class extends BaseAddon {
 				connected: this.registry.isConnected(entry.id),
 				api: createGoogleCalendarApi(() => this.ensureAccessToken(entry.id))
 			})),
-			selectedCalendarIds: (brokerId) => this.calendarIdsOf(brokerId)
+			selectedCalendarIds: (brokerId) => this.calendarSelection.get(brokerId) ?? /* @__PURE__ */ new Set()
 		});
 		const smtpProvider = createGmailSmtpProvider({ accounts: () => this.registry.listEntries().map((entry) => {
 			const oauth = this.registry.getOauth(entry.id);
@@ -92558,7 +93022,7 @@ var GoogleServicesAddon = class extends BaseAddon {
 			},
 			{
 				capability: integrationInstancesCapability,
-				provider: this.requireInstances().toProvider()
+				provider: this.buildInstancesProvider()
 			},
 			{
 				capability: calendarSourceCapability,
@@ -92583,9 +93047,43 @@ var GoogleServicesAddon = class extends BaseAddon {
 		if (this.instances === null) throw new Error("google-services: instances used before initialize");
 		return this.instances;
 	}
+	/** One provider over the two record kinds: the Google accounts and the calendars they import. */
+	buildInstancesProvider() {
+		const calendars = this.calendarInstances;
+		if (calendars === null) throw new Error("google-services: instances used before initialize");
+		return composeInstanceKinds([{
+			kind: {
+				...googleAccountKind({
+					connectPath: `/addon/${ADDON_ID}${START_PATH}?brokerId={{brokerId}}`,
+					disconnectPath: `/addon/${ADDON_ID}${DISCONNECT_PATH}?brokerId={{brokerId}}`
+				}),
+				functionCap: "broker"
+			},
+			provider: this.requireInstances().toProvider()
+		}, {
+			kind: {
+				id: GOOGLE_CALENDAR_INSTANCE_KIND,
+				label: "Google calendar",
+				functionCap: "calendar-source",
+				role: "services"
+			},
+			provider: calendars.toProvider()
+		}], {
+			role: "services",
+			instanceMode: "multiple",
+			kind: "account",
+			canTest: true,
+			allowRestoreId: true
+		});
+	}
+	/** Re-read which calendars each account imports from the records. */
+	async refreshCalendarSelection() {
+		const calendars = this.calendarInstances;
+		if (calendars === null) return;
+		this.calendarSelection = selectedStampedIds(await calendars.listResolved());
+	}
 	/** The accounts as `integration-instances`, over the same `brokers` records (planning#408 P3). */
 	buildInstances(records) {
-		const brokerProvider = this.buildBrokerProvider();
 		return buildGoogleInstances(records, {
 			connectPath: `/addon/${ADDON_ID}${START_PATH}?brokerId={{brokerId}}`,
 			disconnectPath: `/addon/${ADDON_ID}${DISCONNECT_PATH}?brokerId={{brokerId}}`,
@@ -92598,169 +93096,29 @@ var GoogleServicesAddon = class extends BaseAddon {
 				this.registry.seedFrom(this.activeBrokers, accounts);
 				await this.persistOauthAccounts();
 			},
-			testSaved: async (id) => brokerProvider.testConnection({ id }),
-			testClient: async (clientId, clientSecret) => brokerProvider.testSettings({
-				kind: GOOGLE_BROKER_KIND,
-				settings: {
-					clientId,
-					clientSecret
-				}
-			})
+			testSaved: (id) => this.probeSavedAccount(id),
+			testClient: (clientId, clientSecret) => this.probeOauthClient(clientId, clientSecret)
 		});
 	}
+	/**
+	* The `broker` cap is the bus only (D1013): the accounts are the `integration-instances`
+	* provider; calendar and mail go through their own caps, so publish and subscribe are refused.
+	*/
 	buildBrokerProvider() {
-		const ownerAddonId = this.ctx.id;
-		const owns = (id) => this.registry.getEntry(id) !== null;
 		const notSupported = async () => {
 			throw new Error("google-services broker: publish/subscribe/getState are not supported — use calendar-source / smtp-provider");
 		};
 		return {
-			list: async ({ kind }) => this.registry.listBrokerInfos(ownerAddonId, kind),
-			get: async ({ id }) => {
-				const entry = this.registry.getEntry(id);
-				return entry ? this.registry.toBrokerInfo(entry, ownerAddonId) : null;
-			},
-			listProviders: async () => [{
-				addonId: ownerAddonId,
-				kinds: [{
-					kind: GOOGLE_BROKER_KIND,
-					label: GOOGLE_BROKER_KIND_LABEL,
-					interactiveConnectPath: `/addon/${ADDON_ID}${START_PATH}?brokerId={{brokerId}}`,
-					interactiveDisconnectPath: `/addon/${ADDON_ID}${DISCONNECT_PATH}?brokerId={{brokerId}}`
-				}]
-			}],
-			add: async ({ kind, name, settings, id }) => {
-				if (kind !== "google") throw new Error(`google-services: only kind '${GOOGLE_BROKER_KIND}' is handled here (got '${kind}')`);
-				const entry = this.registry.createEntry(name, settings, id !== void 0 ? { id } : {});
-				await this.persistBrokers();
-				return { id: entry.id };
-			},
-			remove: async ({ id }) => {
-				if (!owns(id)) return;
-				this.registry.removeEntry(id);
-				await this.persistBrokers();
-				await this.persistOauthAccounts();
-			},
-			testConnection: async ({ id }) => {
-				if (!owns(id)) return {
-					ok: false,
-					error: "unknown broker"
-				};
-				const entry = this.registry.getEntry(id);
-				if (entry === null) return {
-					ok: false,
-					error: "unknown broker"
-				};
-				if (!entry.clientId || !entry.clientSecret) return {
-					ok: false,
-					error: "Configure Client ID and Client secret first"
-				};
-				let redirectUri;
-				try {
-					redirectUri = await this.resolveRedirectUri();
-				} catch (err) {
-					return {
-						ok: false,
-						error: err instanceof Error ? err.message : String(err)
-					};
-				}
-				if (!this.registry.isConnected(id)) return probeGoogleOauthClient({
-					clientId: entry.clientId,
-					clientSecret: entry.clientSecret,
-					redirectUri
-				});
-				try {
-					const started = Date.now();
-					const token = await this.ensureAccessToken(id, { forceRefresh: true });
-					if (token.trim().length === 0) return {
-						ok: false,
-						error: "No access token after refresh — Sign out and Sign in again"
-					};
-					let res = await fetch(GOOGLE_CALENDAR_LIST_URL, { headers: { Authorization: `Bearer ${token}` } });
-					if (res.status === 401) {
-						const retryToken = await this.ensureAccessToken(id, { forceRefresh: true });
-						res = await fetch(GOOGLE_CALENDAR_LIST_URL, { headers: { Authorization: `Bearer ${retryToken}` } });
-					}
-					if (!res.ok) {
-						const text = await res.text();
-						return {
-							ok: false,
-							error: `Google Calendar probe failed (${res.status}): ${text.slice(0, 200)}`
-						};
-					}
-					const email = await this.fetchAccountEmail(token);
-					if (email.length > 0) {
-						const oauth = this.registry.getOauth(id);
-						if (oauth !== null && oauth.accountEmail !== email) {
-							this.registry.setOauth({
-								...oauth,
-								accountEmail: email
-							});
-							await this.persistOauthAccounts();
-						}
-					}
-					return {
-						ok: true,
-						latencyMs: Date.now() - started
-					};
-				} catch (err) {
-					return {
-						ok: false,
-						error: err instanceof Error ? err.message : String(err)
-					};
-				}
-			},
-			getSettings: async ({ id }) => {
-				const entry = this.registry.getEntry(id);
-				if (entry === null) return null;
-				return {
-					...brokerEntryToSettings(entry),
-					_calendarCatalog: await this.loadStampedCalendarCatalog(id)
-				};
-			},
-			setSettings: async ({ id, settings }) => {
-				if (!owns(id)) return;
-				this.registry.updateEntry(id, settings);
-				await this.persistBrokers();
-			},
 			getBrokerConfig: async ({ id }) => {
 				const entry = this.registry.getEntry(id);
 				if (entry === null) return null;
 				const oauth = this.registry.getOauth(id);
 				return {
 					...brokerEntryToSettings(entry),
-					_calendarCatalog: await this.loadStampedCalendarCatalog(id),
 					accountEmail: oauth?.accountEmail ?? "",
 					connected: this.registry.isConnected(id)
 				};
 			},
-			getSettingsSchema: async ({ kind }) => {
-				if (kind !== "google") return null;
-				return buildGoogleBrokerSettingsSchema(this.publicOrigin);
-			},
-			testSettings: async ({ kind, settings }) => {
-				if (kind !== "google") return {
-					ok: false,
-					error: `unsupported kind: ${kind}`
-				};
-				try {
-					const parsed = object({
-						clientId: string().min(1),
-						clientSecret: string().min(1).meta({ secret: true })
-					}).parse(settings);
-					const redirectUri = await this.resolveRedirectUri();
-					return probeGoogleOauthClient({
-						clientId: parsed.clientId,
-						clientSecret: parsed.clientSecret,
-						redirectUri
-					});
-				} catch (err) {
-					return {
-						ok: false,
-						error: err instanceof Error ? err.message : String(err)
-					};
-				}
-			},
 			publish: notSupported,
 			subscribe: notSupported,
 			unsubscribe: notSupported,
@@ -92771,6 +93129,95 @@ var GoogleServicesAddon = class extends BaseAddon {
 			})
 		};
 	}
+	/** Probe a saved account: the OAuth client, then (when signed in) a Calendar call. */
+	async probeSavedAccount(id) {
+		const entry = this.registry.getEntry(id);
+		if (entry === null) return {
+			ok: false,
+			error: "unknown broker"
+		};
+		if (!entry.clientId || !entry.clientSecret) return {
+			ok: false,
+			error: "Configure Client ID and Client secret first"
+		};
+		let redirectUri;
+		try {
+			redirectUri = await this.resolveRedirectUri();
+		} catch (err) {
+			return {
+				ok: false,
+				error: err instanceof Error ? err.message : String(err)
+			};
+		}
+		if (!this.registry.isConnected(id)) return probeGoogleOauthClient({
+			clientId: entry.clientId,
+			clientSecret: entry.clientSecret,
+			redirectUri
+		});
+		try {
+			const started = Date.now();
+			const token = await this.ensureAccessToken(id, { forceRefresh: true });
+			if (token.trim().length === 0) return {
+				ok: false,
+				error: "No access token after refresh — Sign out and Sign in again"
+			};
+			let res = await fetch(GOOGLE_CALENDAR_LIST_URL, { headers: { Authorization: `Bearer ${token}` } });
+			if (res.status === 401) {
+				const retryToken = await this.ensureAccessToken(id, { forceRefresh: true });
+				res = await fetch(GOOGLE_CALENDAR_LIST_URL, { headers: { Authorization: `Bearer ${retryToken}` } });
+			}
+			if (!res.ok) {
+				const text = await res.text();
+				return {
+					ok: false,
+					error: `Google Calendar probe failed (${res.status}): ${text.slice(0, 200)}`
+				};
+			}
+			const email = await this.fetchAccountEmail(token);
+			if (email.length > 0) {
+				const oauth = this.registry.getOauth(id);
+				if (oauth !== null && oauth.accountEmail !== email) {
+					this.registry.setOauth({
+						...oauth,
+						accountEmail: email
+					});
+					await this.persistOauthAccounts();
+				}
+			}
+			return {
+				ok: true,
+				latencyMs: Date.now() - started
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: err instanceof Error ? err.message : String(err)
+			};
+		}
+	}
+	/** Probe an OAuth client that is not saved yet. */
+	async probeOauthClient(clientId, clientSecret) {
+		try {
+			const parsed = object({
+				clientId: string().min(1),
+				clientSecret: string().min(1).meta({ secret: true })
+			}).parse({
+				clientId,
+				clientSecret
+			});
+			const redirectUri = await this.resolveRedirectUri();
+			return probeGoogleOauthClient({
+				clientId: parsed.clientId,
+				clientSecret: parsed.clientSecret,
+				redirectUri
+			});
+		} catch (err) {
+			return {
+				ok: false,
+				error: err instanceof Error ? err.message : String(err)
+			};
+		}
+	}
 	async handleStart(req, reply) {
 		const brokerIdRaw = req.query["brokerId"];
 		const brokerId = typeof brokerIdRaw === "string" ? brokerIdRaw.trim() : "";
@@ -92936,11 +93383,25 @@ var GoogleServicesAddon = class extends BaseAddon {
 		for (const [k, v] of this.pendingStates) if (v.issuedAt < cutoff) this.pendingStates.delete(k);
 	}
 	/**
-	* The shared calendar set becomes each broker's own (D985, D987). Brokers are reloaded once the
-	* copy landed, so the registry is seeded with the sets the migration wrote.
+	* The shared calendar set becomes each broker's own (D985, D987), then each broker's set becomes
+	* `calendars` records linked to the account (D1013). Brokers are reloaded once a migration
+	* landed, so the registry is seeded with what it wrote.
 	*/
 	async migrateCalendarIds(records) {
-		if ((await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, calendarIdsPortsOver(records.kind(googleBrokersEntryKind), (key) => this.readStoredGlobalKey(key))))).applied.length > 0) this.activeBrokers = await this.loadPersistedBrokers();
+		const brokers = records.kind({
+			name: googleBrokersEntryKind.name,
+			declaration: googleBrokersEntryKind.declaration,
+			schema: record(string(), unknown())
+		});
+		const ports = {
+			...calendarIdsPortsOver(brokers, (key) => this.readStoredGlobalKey(key)),
+			...calendarRecordPortsOver({
+				brokers,
+				calendars: records.kind(googleCalendarsEntryKind),
+				warn: (message) => this.ctx.logger.warn(message)
+			})
+		};
+		if ((await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, ports))).applied.length > 0) this.activeBrokers = await this.loadPersistedBrokers();
 	}
 	async loadPersistedBrokers() {
 		const store = this.brokerStore;
@@ -92964,30 +93425,24 @@ var GoogleServicesAddon = class extends BaseAddon {
 		if (!this.oauthAccountsHandle) return;
 		await this.oauthAccountsHandle.set({ accounts: [...this.registry.listOauthAccounts()] });
 	}
-	/** Stamped catalog for Connectivity → Calendars (`optionsFrom`). */
-	async loadStampedCalendarCatalog(onlyBrokerId) {
-		const out = [];
-		for (const entry of this.registry.listEntries()) {
-			if (onlyBrokerId !== void 0 && entry.id !== onlyBrokerId) continue;
-			if (!this.registry.isConnected(entry.id)) continue;
-			try {
-				const list = await createGoogleCalendarApi(() => this.ensureAccessToken(entry.id)).listCalendars();
-				const accountLabel = this.registry.getOauth(entry.id)?.accountEmail || entry.name;
-				for (const c of list) {
-					const summary = c.summary.trim().length > 0 ? c.summary : c.id;
-					out.push({
-						value: stampCalendarId(entry.id, c.id),
-						label: `${summary} (${accountLabel})`
-					});
-				}
-			} catch (err) {
-				this.ctx.logger.warn("google calendar catalog failed", { meta: {
-					brokerId: entry.id,
-					error: err instanceof Error ? err.message : String(err)
-				} });
-			}
+	/** The calendars one signed-in account lists, by their own id (the picker of a calendar record). */
+	async loadCalendarCatalog(accountId) {
+		const entry = this.registry.getEntry(accountId);
+		if (entry === null || !this.registry.isConnected(entry.id)) return [];
+		try {
+			const api = createGoogleCalendarApi(() => this.ensureAccessToken(entry.id));
+			const accountLabel = this.registry.getOauth(entry.id)?.accountEmail || entry.name;
+			return (await api.listCalendars()).map((c) => ({
+				value: c.id,
+				label: `${c.summary.trim().length > 0 ? c.summary : c.id} (${accountLabel})`
+			})).toSorted((a, b) => a.label.localeCompare(b.label));
+		} catch (err) {
+			this.ctx.logger.warn("google calendar catalog failed", { meta: {
+				brokerId: entry.id,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+			return [];
 		}
-		return out.toSorted((a, b) => a.label.localeCompare(b.label));
 	}
 	async emitGoogleBrokerReconnectAlert(brokerId, brokerName) {
 		const emit = this.ctx.api.alerts?.emit;
@@ -93110,14 +93565,6 @@ var GoogleServicesAddon = class extends BaseAddon {
 		await this.refreshPublicOrigin();
 		return super.getGlobalSettings(overlay, cap, nodeId);
 	}
-	/**
-	* The stamped calendar ids ONE broker imports. A broker the migration has not reached yet
-	* (no `calendarIds` of its own) reads the shared setting older versions wrote, so the move
-	* never changes what is imported mid-way.
-	*/
-	calendarIdsOf(brokerId) {
-		return calendarIdsOfEntry(this.registry.getEntry(brokerId), this.config.calendarIds ?? []);
-	}
 };
 function asSettingsCap(cap) {
 	if (cap === "calendar-source" || cap === "smtp-provider") return cap;