@camstack/addon-google-services 0.2.43 → 0.2.44

package/dist/google-services.addon.js

@@ -806,7 +806,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/device-type-D1fH5kaC.mjs
+//#region ../types/dist/device-type-DxCT0krO.mjs
 /**
 import { errMsg } from '@camstack/types'
 * Extract a human-readable message from an unknown error value.
@@ -968,6 +968,13 @@ var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
 	* filters that want "all devices with on-motion behaviour".
 	*/
 	DeviceFeature["MotionTrigger"] = "motion-trigger";
+	/**
+	* Device can be run for a chosen time and then stopped. Mirrors the
+	* `timed-run` wrapper cap — the cap is bound by the core-blocks addon, not by
+	* a driver, so the flag is derived from the device's bindings
+	* (`featuresOfBoundCaps`). Gates the quick-run control in the viewer.
+	*/
+	DeviceFeature["TimedRun"] = "timed-run";
 	/** Light supports rgb-triplet color via `color` cap. */
 	DeviceFeature["LightColorRgb"] = "light-color-rgb";
 	/** Light supports HSV color via `color` cap. */
@@ -6002,7 +6009,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-AEnTN3b4.mjs
+//#region ../types/dist/sleep-CGPZyzB5.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6366,6 +6373,59 @@ Object.fromEntries([
 function isValuelessField(field) {
 	return field.type === "separator" || field.type === "info" || field.type === "qr-code" || field.type === "button" || field.type === "object-array" || field.type === "widget" || field.type === "addon-action-button" || field.type === "device-action-button" || field.type === "account-sign-in" || field.type === "secret-presence";
 }
+/**
+* Base collector: flatten a hydrated `ConfigUISchemaWithValues` into
+* `key → { value, default }`, recursing through `group` and `sub-tabs`
+* layout fields. Keeping `value` and `default` SEPARATE (rather than
+* pre-resolving) lets callers both read the effective value AND detect
+* overrides (`value` differs from `default`). Structural over `unknown`;
+* malformed input yields an empty map, never throws.
+*/
+function collectHydratedFieldEntries(schema) {
+	const out = /* @__PURE__ */ new Map();
+	if (typeof schema !== "object" || schema === null) return out;
+	const sections = schema.sections;
+	if (!Array.isArray(sections)) return out;
+	for (const section of sections) if (typeof section === "object" && section !== null) collectFieldEntriesInto(section.fields, out);
+	return out;
+}
+/** Recursive field walker for {@link collectHydratedFieldEntries}. */
+function collectFieldEntriesInto(fields, into) {
+	if (!Array.isArray(fields)) return;
+	for (const field of fields) {
+		if (typeof field !== "object" || field === null) continue;
+		const type = field.type;
+		if (type === "group") {
+			collectFieldEntriesInto(field.fields, into);
+			continue;
+		}
+		if (type === "sub-tabs") {
+			const tabs = field.tabs;
+			if (Array.isArray(tabs)) {
+				for (const tab of tabs) if (typeof tab === "object" && tab !== null) collectFieldEntriesInto(tab.fields, into);
+			}
+			continue;
+		}
+		const key = field.key;
+		if (typeof key !== "string" || key.length === 0) continue;
+		if (!("value" in field)) continue;
+		into.set(key, {
+			value: field.value,
+			default: field.default
+		});
+	}
+}
+/**
+* Flatten a hydrated settings payload into `key → EFFECTIVE value`
+* (`value ?? default`). The read-side inverse of `hydrateSchema` for the
+* common "just give me the resolved values" case. Built on
+* {@link collectHydratedFieldEntries}.
+*/
+function collectHydratedFieldValues(schema) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [key, entry] of collectHydratedFieldEntries(schema)) out.set(key, entry.value ?? entry.default);
+	return out;
+}
 function hydrateSchema(schema, values, options = {}) {
 	return {
 		...schema.tabs ? { tabs: [...schema.tabs] } : {},
@@ -7166,6 +7226,7 @@ var RecordIntegrationInstances = class {
 		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
 		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
 		this.nameField = kind.declaration.entry?.nameField ?? "name";
+		if (hooks.kindOf === void 0 && hooks.description.kinds.length !== 1) throw new Error(`record kind '${kind.name}': describe().kinds has ${hooks.description.kinds.length} entries, so kindOf is required to say which one an instance is`);
 	}
 	/**
 	* One instance read for the addon's own runtime; null when absent. When the keychain is
@@ -7207,10 +7268,21 @@ var RecordIntegrationInstances = class {
 		}
 		return out;
 	}
+	/** The kind an instance body is of: the provider's `kindOf`, else its one declared kind. */
+	kindOfBody(body) {
+		if (this.hooks.kindOf !== void 0) {
+			const id = this.hooks.kindOf(body);
+			if (!this.hooks.description.kinds.some((declared) => declared.id === id)) throw new Error(`record kind '${this.kind.name}': kindOf returned '${id}', which describe().kinds does not declare (D1013)`);
+			return id;
+		}
+		const only = this.hooks.description.kinds[0];
+		if (only === void 0) throw new Error(`record kind '${this.kind.name}' declares no kinds`);
+		return only.id;
+	}
 	viewOf(record) {
 		const shown = secretViewsOf(this.records.owner, this.kind.name, record.id, this.kind.declaration, record.data);
 		const rawName = record.data[this.nameField];
-		const kind = this.hooks.kindOf?.(record.data);
+		const kind = this.kindOfBody(record.data);
 		const health = this.hooks.health?.(record.data, record.id);
 		return {
 			id: record.id,
@@ -7218,7 +7290,7 @@ var RecordIntegrationInstances = class {
 			configured: this.hooks.configured(record.data),
 			enabled: isInstanceEnabled(record.data),
 			formValues: shown,
-			...kind !== void 0 ? { kind } : {},
+			kind,
 			...health?.status !== void 0 ? { status: health.status } : {},
 			...health?.lastCheckedAt !== void 0 ? { lastCheckedAt: health.lastCheckedAt } : {}
 		};
@@ -7590,6 +7662,21 @@ var SCOPED_SETTINGS_SCOPES = [
 	"device-defaults",
 	"node"
 ];
+/** The one refusal of a key a scope did not declare. */
+function assertDeclaredKeys(keys, declared) {
+	const undeclared = keys.filter((key) => !declared.has(key));
+	if (undeclared.length > 0) throw new Error(`scoped settings: [${undeclared.join(", ")}] not declared for this scope (declared: [${[...declared].join(", ")}])`);
+}
+/** Build the handle over an addon's scoped read, write and unset. */
+function createScopedSettings(deps) {
+	return {
+		async get() {
+			return deps.schema.parse(await deps.read());
+		},
+		patch: (patch) => deps.write(Object.fromEntries(Object.entries(patch))),
+		unset: (keys) => deps.unset(keys)
+	};
+}
 /** A write to a secret path could not be stored in the keychain, so it was refused. */
 var KeychainWriteRefusedError = class extends Error {
 	fieldPath;
@@ -8165,7 +8252,16 @@ function createHandle(raw, opts) {
 				return blob;
 			}
 		},
-		writeAddonStore: writeAddon
+		writeAddonStore: writeAddon,
+		removeClearedKeys: (keys) => serialize("addon", async () => {
+			const stored = await readStoredAddonBlob(raw);
+			index.seen("addon", stored);
+			const removable = keys.filter((key) => collectSecretMarkerRefs(stored[key]).length === 0);
+			if (removable.length === 0) return;
+			const patch = Object.fromEntries(removable.map((key) => [key, void 0]));
+			await raw.writeAddonStore(patch);
+			index.wrote("addon", patch);
+		})
 	};
 }
 /** The context the addon sees, plus the private raw view and write outcome. */
@@ -8295,7 +8391,7 @@ function boundOf(list) {
 * Base class for CamStack addons. Eliminates settings boilerplate:
 *
 * - Typed `config` property with automatic resolution from store + defaults
-* - `getGlobalSettings()` / `updateGlobalSettings()` auto-implemented
+* - the scoped settings API (`clusterSettings` / `nodeSettings` / `deviceDefaults`) auto-implemented
 * - `getAddonSettings()` / `updateAddonSettings()` auto-implemented
 * - `getDeviceSettings()` / `updateDeviceSettings()` auto-implemented
 * - `ctx` accessor for the AddonContext (no manual `this.ctxRef` storage)
@@ -8305,7 +8401,7 @@ function boundOf(list) {
 * Subclasses override:
 * - `onInitialize()` — addon-specific init logic, return ProviderRegistration[]
 * - `onShutdown()` — cleanup
-* - `globalSettingsSchema()` / `deviceSettingsSchema()` — UI schemas
+* - `clusterSettingsSchema()` / `nodeSettingsSchema()` / `deviceSettingsSchema()` — UI schemas
 *
 * @example
 * ```ts
@@ -8319,7 +8415,7 @@ function boundOf(list) {
 *     super({ maxRetries: 3, endpoint: 'http://localhost' })
 *   }
 *
-*   protected globalSettingsSchema() {
+*   protected clusterSettingsSchema() {
 *     return this.schema({
 *       sections: [{
 *         id: 'main', title: 'Settings',
@@ -8362,7 +8458,7 @@ var BaseAddon = class {
 	defaults;
 	/**
 	* Hidden-state paths that hold secrets (D787) — values the addon writes
-	* itself (`updateGlobalSettings`, `state()`) that no form field declares.
+	* itself (`state()`, the scoped writers) that no form field declares.
 	* Stored in the keychain exactly like a `password` field. Syntax:
 	* `'snapshotSigningKey'`, `'identity.pincode'`, `'tokens[userId].accessToken'`
 	* (`key[<id field>]` addresses array items by id, never by index).
@@ -8372,7 +8468,7 @@ var BaseAddon = class {
 	/**
 	* D986 M4: the scoped schemas this addon declared, resolved once per capability
 	* (`loadScopedSchemas`) so the sync readers (`perNodeKeys`, the secret tree, the restart check)
-	* see them. Empty until loaded: the readers then fall back to {@link globalSettingsSchema}.
+	* see them. Empty until loaded.
 	*/
 	_scopedByCap = /* @__PURE__ */ new Map();
 	_nodeKeysByCap = /* @__PURE__ */ new Map();
@@ -8558,7 +8654,7 @@ var BaseAddon = class {
 	/** Addon-specific cleanup. Override if needed. */
 	async onShutdown() {}
 	/**
-	* Called after config is resolved during updateGlobalSettings/updateAddonSettings.
+	* Called after config is resolved during a settings write.
 	* Override to react to config changes (e.g. restart a sampler, reconnect a service).
 	* Not called during initialize() — use onInitialize() for initial setup.
 	*/
@@ -8587,82 +8683,12 @@ var BaseAddon = class {
 	scopedSettingsCapabilities() {
 		return [];
 	}
-	/** Override to provide global-level settings UI schema. */
-	globalSettingsSchema(_cap) {
-		return null;
-	}
 	/** Override to provide device-level settings UI schema. */
 	deviceSettingsSchema() {
 		return null;
 	}
 	/**
-	* INTEGRATION-LEVEL SETTINGS — declare which of this addon's global sections
-	* ARE the configuration of its integration.
-	*
-	* Return the `ConfigSection.id`s, from {@link globalSettingsSchema}, that an
-	* operator should find on the addon's integration page (System →
-	* Integrations → <name>) rather than only in the cluster-wide list of every
-	* addon. Empty (the default) means the addon has no integration-level
-	* settings and no such surface is offered — this is opt-in, because whether
-	* an addon's configuration IS its integration's configuration depends on the
-	* nature of the integration.
-	*
-	* WHAT THIS IS NOT. It is not a scope. The selected sections keep living in
-	* the ONE global schema, in the ONE addon store, written by the ONE
-	* `updateGlobalSettings` path. There is deliberately no
-	* `updateIntegrationSettings`: a second write path is how a surface acquires
-	* a second store key, and this repo has shipped that twice (`btmPath@hub`,
-	* D266). Selecting sections cannot introduce a key that selecting cannot.
-	*
-	* WHY IT IS A LIST OF SECTION IDS AND NOT A MARKER ON THE SECTION.
-	* `ConfigFieldBase` used to carry `scope?: 'device' | 'global'` and it was
-	* removed with the reason recorded at
-	* `packages/types/src/interfaces/config-ui.ts:249` — *"a field's scope is
-	* determined by WHICH schema it lives in, not by a field-level marker."* A
-	* marker sprinkled across sections also has to borrow a field that already
-	* means something else; borrowing `section.tab` put the literal word
-	* "integration" into an operator-facing tab bar, because `tab` means "how to
-	* GROUP this visually" and cannot also mean "where this lives" (D269
-	* supersedes D268). One declaration, in one place, next to the schema whose
-	* ids it names.
-	*/
-	integrationSettingSections() {
-		return [];
-	}
-	async getGlobalSettings(overlay, cap, nodeId) {
-		await this.loadScopedSchemas(cap);
-		const schema = this.globalSettingsSchema(cap) ?? this.scopedFormSchema(cap);
-		if (!schema) return { sections: [] };
-		const projected = await this.readRawProjectedStore(nodeId, cap);
-		return hydrateSchema(schema, overlay ? await this.overlayKeepingMarkers(projected, overlay) : projected, { inlineSecretsAsViews: true });
-	}
-	/**
-	* The integration-level view of this addon's settings: exactly the sections
-	* named by {@link integrationSettingSections}, hydrated from the SAME store
-	* `getGlobalSettings` reads, and narrowed to cluster-scoped fields.
-	*
-	* Returns `null` when the addon declared nothing — an addon that opts out has
-	* no integration settings surface at all, rather than an empty one that reads
-	* as a failed load.
-	*
-	* Three properties hold BY CONSTRUCTION, which is why they are here in core
-	* and not in whichever UI happens to render this:
-	*
-	*  1. **One key.** The payload is a SUBSET of the global schema, so a field
-	*     shown here is the same field, with the same bare key, that the addon's
-	*     own page shows. There is no integration-specific writer — callers save
-	*     through `updateGlobalSettings` — so a second store key is unreachable,
-	*     not merely discouraged.
-	*  2. **No node scope.** `perNode: true` fields are DROPPED. Their store key
-	*     is `<key>@<nodeId>` and an integration is not a node; whichever node
-	*     such a field silently picked would be a wrong answer for the operator
-	*     who opened the page (D266).
-	*  3. **No silent typo.** A declared id that names no section throws. The
-	*     alternative — skip it — turns a rename into a surface that quietly
-	*     empties, which looks exactly like an addon with nothing to configure.
-	*/
-	/**
-	* The form schema of ONE integration instance, or `null` to use {@link globalSettingsSchema}.
+	* The form schema of ONE integration instance, or `null` to use the scoped form.
 	*
 	* Override it only when an `instanceMode: multiple` addon's instances differ: an NVR integration
 	* needs its connection fields, the default integration the addon's own sections. It is the
@@ -8710,37 +8736,178 @@ var BaseAddon = class {
 		}
 	}
 	/**
+	* Hook: values layered over the stored ones when the FORM of one scope is served
+	* ({@link getScopedSettings}) — a preview that derives dependent options without writing.
+	* Never applied to {@link ScopedSettings.get} or to a write. `null` ⇒ no overlay.
+	*/
+	async scopedSettingsOverlay(_scope, _cap, _nodeId) {
+		return null;
+	}
+	/**
+	* Hook: a write of one scope changed stored values (not called when the store reports no change,
+	* e.g. the write-back of a stored secret). `keys` are the bare field keys of the write, node keys included.
+	*/
+	async onScopedSettingsChanged(_scope, _cap, _keys) {}
+	/** Typed handle over the CLUSTER settings `cap` declares (`clusterSettingsSchema`). */
+	clusterSettings(cap, schema) {
+		return this.scopedHandle("cluster", cap, schema);
+	}
+	/** Typed handle over the fleet defaults of the per-device settings `cap` declares. */
+	deviceDefaults(cap, schema) {
+		return this.scopedHandle("device-defaults", cap, schema);
+	}
+	/**
+	* Typed handle over the settings `cap` owns PER NODE. `nodeId` omitted ⇒ the local node. A node
+	* with no row yields the schema defaults — never a bare-key fallback.
+	*/
+	nodeSettings(cap, schema, nodeId) {
+		return this.scopedHandle("node", cap, schema, nodeId);
+	}
+	/**
+	* {@link state} for a value that is kept per node: stored under `<key>@<nodeId>`, and the
+	* settings store carries `nodeId` in the row data (D986 §1), so a forgotten node's rows go in one
+	* central delete. `nodeId` omitted ⇒ the local node.
+	*/
+	nodeState(key, schema, fallback, nodeId) {
+		this._declaredStateKeys.add(key);
+		return createDurableState({
+			key: nodeScopedKey(key, nodeId ?? this._ctx?.kernel?.localNodeId ?? ""),
+			schema,
+			fallback,
+			read: async () => this.resolveStoredSecrets(await this.readAddonStoreWithRetry()),
+			write: async (patch) => {
+				await this._ctx?.settings?.writeAddonStore(patch);
+			},
+			onParseError: (k, e) => this._ctx?.logger?.warn?.(`durable-state: stored "${k}" failed validation — using fallback`, { meta: {
+				addonId: this._ctx?.id,
+				key: k,
+				error: String(e)
+			} })
+		});
+	}
+	/** The loaded schema `cap` declares for `scope`, or `null`. */
+	async declaredScopedSchema(scope, cap) {
+		await this.loadScopedSchemas(cap);
+		return this.loadedScopedSchemas(cap).find((entry) => entry.scope === scope)?.schema ?? null;
+	}
+	async requireScopedSchema(scope, cap) {
+		const schema = await this.declaredScopedSchema(scope, cap);
+		if (schema === null) throw new Error(`${this.constructor.name}: cap "${cap}" declares no ${scope} settings`);
+		return schema;
+	}
+	scopedKeys(schema) {
+		return new Set(schema.sections.flatMap((section) => collectValueFieldKeys(section.fields)));
+	}
+	/** `store` narrowed to the keys `schema` declares. */
+	narrowToScope(store, schema) {
+		const keys = this.scopedKeys(schema);
+		return Object.fromEntries(Object.entries(store).filter(([key]) => keys.has(key)));
+	}
+	scopedHandle(scope, cap, schema, nodeId) {
+		return createScopedSettings({
+			schema,
+			read: async () => {
+				const declared = await this.requireScopedSchema(scope, cap);
+				const stored = this.narrowToScope(await this.resolveGlobalStore(nodeId, cap), declared);
+				const effective = collectHydratedFieldValues(hydrateSchema(declared, stored));
+				return {
+					...Object.fromEntries([...effective].filter(([, value]) => value !== void 0)),
+					...stored
+				};
+			},
+			write: (patch) => this.writeScoped(scope, cap, patch, nodeId),
+			unset: (keys) => this.unsetScoped(scope, cap, keys, nodeId)
+		});
+	}
+	/** The one write path of the scoped API: declared keys only, then the global patch. */
+	async writeScoped(scope, cap, patch, nodeId) {
+		assertDeclaredKeys(Object.keys(patch), this.scopedKeys(await this.requireScopedSchema(scope, cap)));
+		if (await this.applyGlobalPatch(patch, scope === "node" ? nodeId : void 0, cap)) await this.onScopedSettingsChanged(scope, cap, Object.keys(patch));
+	}
+	/**
+	* Remove declared keys of one scope. A secret goes through {@link clearSecrets} — its keychain
+	* value is released exactly as there — and the emptied row is then removed; every other key is
+	* removed by an `undefined` patch (which a secret transform would read as "keep").
+	*/
+	async unsetScoped(scope, cap, keys, nodeId) {
+		assertDeclaredKeys(keys, this.scopedKeys(await this.requireScopedSchema(scope, cap)));
+		const target = scope === "node" ? nodeId : void 0;
+		const tree = this.addonSecretTree();
+		const secretKeys = keys.filter((key) => tree.has(key));
+		const plainKeys = keys.filter((key) => !tree.has(key));
+		let changed = false;
+		if (plainKeys.length > 0) {
+			const patch = Object.fromEntries(plainKeys.map((key) => [key, void 0]));
+			changed = await this.applyGlobalPatch(patch, target, cap) || changed;
+		}
+		if (secretKeys.length > 0) {
+			await this.clearSecretKeys(secretKeys, target, cap);
+			const node = normalizeNodeId(target ?? this._ctx?.kernel?.localNodeId);
+			const rows = secretKeys.map((key) => scope === "node" ? nodeScopedKey(key, node) : key);
+			if (this._secretSettings !== null) await this._secretSettings.removeClearedKeys(rows);
+			else await this._ctx?.settings?.writeAddonStore(Object.fromEntries(rows.map((row) => [row, void 0])));
+			changed = true;
+		}
+		if (changed) await this.onScopedSettingsChanged(scope, cap, [...keys]);
+	}
+	/**
+	* The hydrated form of one scope of one capability's settings (any
+	* {@link scopedSettingsOverlay} applied), or `null` when the capability declares nothing there.
+	*/
+	async getScopedSettings(scope, cap, nodeId) {
+		const schema = await this.declaredScopedSchema(scope, cap);
+		if (schema === null) return null;
+		const stored = this.narrowToScope(await this.readRawProjectedStore(nodeId, cap), schema);
+		const overlay = await this.scopedSettingsOverlay(scope, cap, nodeId);
+		return hydrateSchema(schema, overlay ? await this.overlayKeepingMarkers(stored, overlay) : stored, { inlineSecretsAsViews: true });
+	}
+	/**
+	* The scoped schemas this addon serves: one entry per loaded (capability, scope), capabilities
+	* in declaration order, scopes in {@link SCOPED_SETTINGS_SCOPES} order. `[]` when it declares
+	* nothing.
+	*/
+	async listScopedSettings() {
+		await this.loadScopedSchemas();
+		return [...this._scopedByCap].flatMap(([cap, entries]) => entries.map((entry) => ({
+			cap,
+			scope: entry.scope,
+			sectionIds: entry.schema.sections.map((section) => section.id)
+		})));
+	}
+	/** The OPERATOR's write of declared keys of one scope (D787 secret semantics). */
+	async updateScopedSettings(scope, cap, patch, nodeId) {
+		this._operatorWriteDepth++;
+		try {
+			await this.writeScoped(scope, cap, patch, nodeId);
+		} finally {
+			this._operatorWriteDepth--;
+		}
+	}
+	/**
+	* The effective values (`stored ?? default`) of one scope, a secret as its `set` view — never
+	* its value. `null` when the capability declares nothing for the scope.
+	*/
+	async readScopedValues(scope, cap, nodeId) {
+		const schema = await this.declaredScopedSchema(scope, cap);
+		if (schema === null) return null;
+		const form = hydrateSchema(schema, this.narrowToScope(await this.readRawProjectedStore(nodeId, cap), schema), { inlineSecretsAsViews: true });
+		return Object.fromEntries([...collectHydratedFieldValues(form)].filter(([, value]) => value !== void 0));
+	}
+	/**
 	* What the create wizard and the integration edit page render for one instance: the addon's
 	* per-instance schema when it declares one, else its global schema (what they always showed).
 	*/
 	async getIntegrationFormSchema(instance, nodeId) {
 		const scoped = await this.integrationFormSchema(instance);
-		if (scoped === null) return this.getGlobalSettings(void 0, void 0, nodeId);
+		if (scoped === null) return this.scopedForm(nodeId);
 		return hydrateSchema(scoped, {}, { inlineSecretsAsViews: true });
 	}
-	async getIntegrationSettings(nodeId) {
-		const declared = this.integrationSettingSections();
-		if (declared.length === 0) return null;
-		const schema = this.globalSettingsSchema();
-		if (!schema) throw new Error(`${this.constructor.name}: integrationSettingSections() names [${declared.join(", ")}] but globalSettingsSchema() returns null.`);
-		const byId = new Map(schema.sections.map((section) => [section.id, section]));
-		const sections = [];
-		for (const id of declared) {
-			const section = byId.get(id);
-			if (!section) throw new Error(`${this.constructor.name}: integrationSettingSections() names unknown section "${id}". Known sections: [${[...byId.keys()].join(", ")}].`);
-			const fields = dropPerNodeFields(section.fields);
-			if (fields.length === 0) continue;
-			sections.push({
-				...section,
-				fields
-			});
-		}
-		if (sections.length === 0) return null;
-		const projected = await this.readRawProjectedStore(nodeId);
-		return hydrateSchema({
-			...schema,
-			sections
-		}, projected, { inlineSecretsAsViews: true });
+	/** The form of the scoped schemas this addon declared, hydrated from its store. */
+	async scopedForm(nodeId) {
+		await this.loadScopedSchemas();
+		const schema = this.scopedFormSchema();
+		if (!schema) return { sections: [] };
+		return hydrateSchema(schema, await this.readRawProjectedStore(nodeId), { inlineSecretsAsViews: true });
 	}
 	/**
 	* The raw addon store PROJECTED onto the target node's bare per-node keys:
@@ -8749,8 +8916,8 @@ var BaseAddon = class {
 	* bare fallback), all `@`-scoped and stray bare per-node keys are dropped.
 	* A no-op passthrough when the schema declares no `perNode` field.
 	*
-	* This is the sanctioned way for a `getGlobalSettings` OVERRIDE that needs
-	* the store for custom option logic (option narrowing, value snapping) to
+	* This is the sanctioned way for an addon that needs
+	* the store for custom logic (option narrowing, value snapping) to
 	* read it per-node — never `ctx.settings.readAddonStore()` directly.
 	* `nodeId` omitted ⇒ the local node (node-blind injection from ctx).
 	*
@@ -8802,7 +8969,7 @@ var BaseAddon = class {
 	}
 	/**
 	* Whether ONE global key of this addon's store was written, read three-way
-	* (D651). For a question a hydrated view cannot answer: `getGlobalSettings`
+	* (D651). For a question a hydrated view cannot answer: a hydrated form
 	* reports `value ?? default`, so "the operator chose the default" and "nobody
 	* chose" look the same, and a failed read looks like both. A `perNode` key is
 	* not supported here: its stored name is scoped.
@@ -8836,7 +9003,7 @@ var BaseAddon = class {
 	}
 	/**
 	* The OPERATOR's write — a settings form or an admin API call, dispatched by
-	* the kernel. Identical to {@link updateGlobalSettings}, except that a secret
+	* the kernel. The one in-process write of the addon blob that is not a scoped write; a secret
 	* the operator sends is stored as sent even when it equals a pre-keychain
 	* inline value: the operator re-entering a password is a change, an addon
 	* writing back what it read is not (D787).
@@ -8849,9 +9016,6 @@ var BaseAddon = class {
 			this._operatorWriteDepth--;
 		}
 	}
-	async updateGlobalSettings(patch, nodeId) {
-		await this.applyGlobalPatch(patch, nodeId);
-	}
 	/**
 	* REMOVE stored secrets — their keychain values and their markers (D787).
 	*
@@ -8861,6 +9025,9 @@ var BaseAddon = class {
 	* a keychain (an older kernel) it writes `''`, as such code always did.
 	*/
 	async clearSecrets(keys, nodeId) {
+		await this.clearSecretKeys(keys, nodeId);
+	}
+	async clearSecretKeys(keys, nodeId, cap) {
 		const tree = this.addonSecretTree();
 		const keychain = this._ctx?.secrets !== void 0;
 		const stored = keychain ? await this.readAddonStoreWithRetry() : {};
@@ -8873,25 +9040,26 @@ var BaseAddon = class {
 			const keychainStored = tree.has(key) || collectSecretMarkerRefs(stored[key]).length > 0;
 			patch[key] = keychain && keychainStored ? SECRET_CLEAR : "";
 		}
-		await this.applyGlobalPatch(patch, nodeId);
+		await this.applyGlobalPatch(patch, nodeId, cap);
 	}
-	async applyGlobalPatch(barePatch, nodeId) {
-		await this.loadScopedSchemas();
-		const keys = this.perNodeKeys();
+	/** Resolves `true` when the write changed stored values. */
+	async applyGlobalPatch(barePatch, nodeId, cap) {
+		await this.loadScopedSchemas(cap);
+		const keys = this.perNodeKeys(cap);
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
 		const scoped = keys.size > 0 ? scopePatch(barePatch, keys, target) : barePatch;
 		const handle = this._secretSettings;
 		if (handle !== null) {
 			const { changed } = await handle.writeAddonStore(scoped);
-			if (!changed) return;
+			if (!changed) return false;
 		} else await this._ctx?.settings?.writeAddonStore(scoped);
-		if (target !== localNode) return;
+		if (target !== localNode) return true;
 		await this.resolveConfig();
 		await this.onConfigChanged();
 		this.emitLifecycle(EventCategory.AddonUpdated, { level: "global" });
-		const legacy = this.globalSettingsSchema();
-		this.maybeAutoRestart(Object.keys(barePatch), [...legacy === null ? [] : [legacy], ...this.loadedScopedSchemas().map((entry) => entry.schema)]);
+		this.maybeAutoRestart(Object.keys(barePatch), this.loadedScopedSchemas().map((entry) => entry.schema));
+		return true;
 	}
 	/**
 	* The set of field keys the global settings schema declares `perNode: true`
@@ -8928,10 +9096,7 @@ var BaseAddon = class {
 		this._nodeKeysByCap = /* @__PURE__ */ new Map();
 		this._addonSecretTree = null;
 	}
-	/**
-	* The form the settings API serves while an addon declares no {@link globalSettingsSchema}: the
-	* sections of its scoped schemas, so dropping the old hook does not blank the form.
-	*/
+	/** The form of an addon's scoped schemas: their sections, each shown once. */
 	scopedFormSchema(cap) {
 		const byId = /* @__PURE__ */ new Map();
 		for (const entry of this.loadedScopedSchemas(cap)) for (const section of entry.schema.sections) if (!byId.has(section.id)) byId.set(section.id, section);
@@ -8943,8 +9108,7 @@ var BaseAddon = class {
 		return [...this._scopedByCap.values()].flat();
 	}
 	/**
-	* The field keys that are stored per node: every field of a {@link nodeSettingsSchema}, plus
-	* the fields the legacy {@link globalSettingsSchema} still marks `perNode: true`. Derived once
+	* The field keys that are stored per node: every field of a {@link nodeSettingsSchema}. Derived once
 	* per `cap` argument and memoized (schemas are static declarations). Empty set ⇒ every
 	* per-node code path is bypassed and the settings API behaves like the node-agnostic one.
 	* Call {@link loadScopedSchemas} first (the async seams do).
@@ -8953,8 +9117,7 @@ var BaseAddon = class {
 		const cacheKey = cap ?? "";
 		const cached = this._nodeKeysByCap.get(cacheKey);
 		if (cached) return cached;
-		const legacy = this.globalSettingsSchema(cap);
-		const keys = new Set(legacy ? legacy.sections.flatMap((section) => collectPerNodeFieldKeys(section.fields)) : []);
+		const keys = /* @__PURE__ */ new Set();
 		for (const { scope, schema } of this.loadedScopedSchemas(cap)) {
 			if (scope !== "node") continue;
 			for (const section of schema.sections) for (const key of collectValueFieldKeys(section.fields)) keys.add(key);
@@ -9172,8 +9335,6 @@ var BaseAddon = class {
 	}
 	declaredKeySet() {
 		const keys = new Set(Object.keys(this.defaults));
-		const schema = this.globalSettingsSchema();
-		if (schema) for (const section of schema.sections) for (const key of collectFieldKeys(section.fields)) keys.add(key);
 		for (const { schema: scoped } of this.loadedScopedSchemas()) for (const section of scoped.sections) for (const key of collectFieldKeys(section.fields)) keys.add(key);
 		for (const key of this._declaredStateKeys) keys.add(key);
 		for (const path of this.secretStatePaths) {
@@ -9271,7 +9432,7 @@ var BaseAddon = class {
 	/** The addon store's secret tree: schema fields by TYPE, plus `secretStatePaths`. */
 	addonSecretTree() {
 		if (this._addonSecretTree === null) {
-			const tree = new Map(secretTreeFromSchema(this.globalSettingsSchema()));
+			const tree = /* @__PURE__ */ new Map();
 			for (const { schema } of this.loadedScopedSchemas()) for (const [key, node] of secretTreeFromSchema(schema)) tree.set(key, node);
 			this._addonSecretTree = mergeSecretStatePaths(tree, this.secretStatePaths);
 		}
@@ -9483,47 +9644,6 @@ function classifyStoreError(err) {
 	if (TRANSPORT_PHRASES.some((f) => message.includes(f))) return "transport";
 	return "permanent";
 }
-/**
-* Collect the keys of every field marked `perNode: true`, recursing into
-* layout containers (`group` fields and `sub-tabs` tabs) the same way
-* `hydrateSchema` does. Valueless structural fields (separator/info/…)
-* don't declare `perNode` and are excluded by the `in` narrowing.
-*/
-/**
-* The same fields with every `perNode: true` one removed, recursing into layout
-* containers exactly as {@link collectPerNodeFieldKeys} does. A container left
-* with no child is dropped rather than rendered empty.
-*
-* Used by `getIntegrationSettings`: an integration is not a node, so a field
-* whose store key is `<key>@<nodeId>` has no node to belong to there.
-*/
-function dropPerNodeFields(fields) {
-	const kept = [];
-	for (const field of fields) {
-		if (field.type === "group") {
-			const inner = dropPerNodeFields(field.fields);
-			if (inner.length > 0) kept.push({
-				...field,
-				fields: inner
-			});
-			continue;
-		}
-		if (field.type === "sub-tabs") {
-			const tabs = field.tabs.map((tab) => ({
-				...tab,
-				fields: dropPerNodeFields(tab.fields)
-			})).filter((tab) => tab.fields.length > 0);
-			if (tabs.length > 0) kept.push({
-				...field,
-				tabs
-			});
-			continue;
-		}
-		if ("perNode" in field && field.perNode === true) continue;
-		kept.push(field);
-	}
-	return kept;
-}
 /** The keys of the value-holding fields, recursing into layout containers. */
 function collectValueFieldKeys(fields) {
 	const collected = [];
@@ -9556,21 +9676,6 @@ function collectFieldKeys(fields) {
 	}
 	return collected;
 }
-function collectPerNodeFieldKeys(fields) {
-	const collected = [];
-	for (const field of fields) {
-		if (field.type === "group") {
-			collected.push(...collectPerNodeFieldKeys(field.fields));
-			continue;
-		}
-		if (field.type === "sub-tabs") {
-			for (const tab of field.tabs) collected.push(...collectPerNodeFieldKeys(tab.fields));
-			continue;
-		}
-		if ("perNode" in field && field.perNode === true) collected.push(field.key);
-	}
-	return collected;
-}
 /**
 * Normalize an `ICamstackAddon.initialize()` return value into the
 * `AddonInitResult` envelope. Arrays are wrapped into `{ providers }`;
@@ -12327,13 +12432,25 @@ Object.freeze({
 		"path": "temperature",
 		"valueType": "number"
 	}],
-	"timed-run": [{
-		"path": "activeUntil",
-		"valueType": "number"
-	}, {
-		"path": "requestedBy",
-		"valueType": "string"
-	}],
+	"timed-run": [
+		{
+			"path": "activeUntil",
+			"valueType": "number"
+		},
+		{
+			"path": "requestedBy",
+			"valueType": "string"
+		},
+		{
+			"path": "quickRun.duration",
+			"valueType": "number"
+		},
+		{
+			"path": "quickRun.unit",
+			"valueType": "enum",
+			"enumValues": ["s", "min"]
+		}
+	],
 	"update": [
 		{
 			"path": "currentVersion",
@@ -12571,7 +12688,7 @@ function userError(code, params, englishFallback) {
 	return new CamstackError(code, params, englishFallback);
 }
 //#endregion
-//#region ../types/dist/composition-BmBHuDTQ.mjs
+//#region ../types/dist/composition-Bx0JvKUU.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -13733,502 +13850,883 @@ var NodeColorIdSchema = _enum([
 	"node-h"
 ]);
 //#endregion
-//#region ../types/dist/index.mjs
-var SMTP_INBOUND_DEFAULT_PORT = 2525;
-var SMTP_INBOUND_DEFAULT_DOMAIN = "camstack.local";
-var SMTP_INBOUND_DEFAULT_MAX_MESSAGE_BYTES = 25 * 1024 * 1024;
-/** The text excerpt a message carries on the bus. */
-var SMTP_INBOUND_TEXT_MAX_CHARS = 4096;
-var PortSchema = number().int().min(1).max(65535);
-/** A recipient local-part: what stands before the `@`. */
-var SmtpRecipientSchema = string().min(1).max(64).regex(/^[A-Za-z0-9._+-]+$/);
-object({
-	port: PortSchema.default(SMTP_INBOUND_DEFAULT_PORT),
-	bindHost: string().min(1).default("0.0.0.0"),
-	domain: string().min(1).default(SMTP_INBOUND_DEFAULT_DOMAIN),
-	requireAuth: boolean().default(true),
-	username: string().default(""),
-	password: string().default("").meta({ secret: true }),
-	starttls: boolean().default(false),
-	maxMessageBytes: number().int().positive().default(SMTP_INBOUND_DEFAULT_MAX_MESSAGE_BYTES)
-});
-object({
-	host: string().min(1).nullable(),
-	hostReason: string().nullable(),
-	port: PortSchema,
-	domain: string().min(1),
-	requireAuth: boolean(),
-	username: string(),
-	password: string(),
-	starttls: boolean()
-});
-object({
-	recipients: array(SmtpRecipientSchema).min(1),
-	/**
-	* Who is subscribing. A second `subscribe` with the same id REPLACES that subscriber's
-	* recipients (the way a consumer that restarted, or lost a device, declares its set again);
-	* a recipient held by another subscriber is refused with `smtp-inbound/recipient-claimed`.
-	* Absent, the subscriber is anonymous and unique.
-	*/
-	subscriberId: string().min(1).max(64).optional()
-});
-var SmtpInboundAttachmentSchema = object({
-	filename: string(),
-	contentType: string(),
-	bytes: number().int().nonnegative()
-});
-/** The payload of one `broker.message` (the key is the recipient local-part). */
-var SmtpInboundMessageSchema = object({
-	/** Monotonic per mailbox; a gap tells a consumer it missed an event. */
-	seq: number().int().positive(),
-	messageId: string(),
-	receivedAt: number().int().nonnegative(),
-	from: string(),
-	to: string(),
-	subject: string(),
-	text: string().max(SMTP_INBOUND_TEXT_MAX_CHARS),
-	attachments: array(SmtpInboundAttachmentSchema)
-});
-object({
-	/** The newest seq issued so far (0 before any mail). */
-	lastSeq: number().int().nonnegative(),
-	/** The oldest seq still retained; messages below it are gone. */
-	oldestSeq: number().int().nonnegative(),
-	messages: array(object({
-		key: string(),
-		message: SmtpInboundMessageSchema
-	}))
-});
-new Set([
-	"track",
-	"face",
-	"identity",
-	"plate",
-	"vehicle",
-	"scene",
-	"motion",
-	"object",
-	"audio",
-	"mosaic"
-]);
-/**
-* The owner types that are event tables, in the order the event-media resolver
-* should consider them. Exported so a consumer asking "is this key an event?"
-* does not re-spell the list and drift from it.
-*/
-var EVENT_OWNER_TYPES = [
-	"motion",
-	"object",
-	"audio"
-];
+//#region ../types/dist/convert-BAzH15HU.mjs
 /**
-* The same list as a Zod enum, for the cap inputs that must NAME the table
-* (D482: `getEventMedia` / `listEventMedia` take an owner, and an owner is
-* `(table, id)`).
-*
-* Built FROM {@link EVENT_OWNER_TYPES} rather than re-spelled: a fourth event
-* table would otherwise be accepted by the codec and refused at the door, with
-* nothing failing until a caller asked.
-*/
-var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
-/** The same list as a Zod enum, for the cap input that carries it. */
-var MediaPresenceOwnerKindSchema = _enum([...EVENT_OWNER_TYPES, "track"]);
-new Set(EVENT_OWNER_TYPES);
-/**
-* What a published package needs from the rest of the install (D989).
-*
-* One published framework package (`@camstack/server`) carries the kernel, the
-* builtins and the capability contracts, so "which addon runs on which
-* framework" is a question of version, and the answer is DECLARED by the
-* package that knows it:
-*
-*   - an addon says the oldest server it runs on (`requires.server: ">=X"`);
-*   - the server says the oldest addon it works with
-*     (`requires.addons: { "@camstack/addon-x": ">=Y" }`) and the oldest shell
-*     around it (`requires.wrapper: { desktop, image }`);
-*   - a wrapper (the desktop app, the container starter) says which server
-*     range it can host, and reports its own kind and version.
-*
-* The publish workflow STAMPS these after the version bump
-* (`scripts/ci/stamp-requires.mjs`); nobody types a number by hand.
-*
-* A requirement that cannot be checked is NOT met: a shell that reports no
-* version counts as below the minimum, and an unreadable running version is
-* named in the result (a failed read is never a pass).
-*/
-/** `>=MAJOR.MINOR.PATCH[-prerelease]` — the only range shape a requirement uses. */
-var MinVersionSchema = string().regex(/^>=\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/, "a minimum is written \">=X.Y.Z\"");
-object({
-	/** The oldest `@camstack/server` this package runs on. */
-	server: MinVersionSchema.optional(),
-	/** The oldest installed version of each named addon package. */
-	addons: record(string(), MinVersionSchema).optional(),
-	/** The oldest shell around the server, per shell kind. */
-	wrapper: object({
-		desktop: MinVersionSchema.optional(),
-		image: MinVersionSchema.optional()
-	}).optional()
-});
-/** One unmet requirement; each names the versions on both sides. */
-var UnmetRequirementSchema = discriminatedUnion("kind", [
-	object({
-		kind: literal("server-too-old"),
-		required: string(),
-		/** `null` — the running server version could not be read. */
-		running: string().nullable()
-	}),
-	object({
-		kind: literal("addon-too-old"),
-		packageName: string(),
-		required: string(),
-		/** `null` — the addon is not installed (or its version is unreadable). */
-		running: string().nullable()
-	}),
-	object({
-		kind: literal("wrapper-too-old"),
-		wrapper: _enum(["desktop", "image"]),
-		required: string(),
-		/** `null` — the wrapper reported no version. */
-		running: string().nullable()
-	})
-]);
-var RequiredAddonUpdateSchema = object({
-	packageName: string(),
-	/** The minimum the target server declares. */
-	required: string(),
-	/** What this node has; `null` when the addon is not installed. */
-	installed: string().nullable()
-});
-/**
-* Which integration instance a settings form is for. An addon that serves several instances
-* (`instanceMode: multiple`) can show a different form per instance — an NVR integration
-* needs its connection, the default integration needs the addon's own sections.
-*
-* - `integrationId` is `null` in the create wizard: nothing exists yet, the operator is
-*   setting up a NEW instance.
-* - `mode` is the wizard mode of the integration type (`getAvailableTypes`).
-* - `candidateStableId` is the discovery candidate a wizard was seeded from, if any.
-*/
-var IntegrationInstanceRefSchema = object({
-	integrationId: string().nullable(),
-	mode: _enum([
-		"standalone",
-		"account",
-		"broker"
-	]),
-	candidateStableId: string().optional()
-});
-/**
-* Build an `IAddonRouteProvider` from a list of routes. Implements
-* both the operator-facing `getRoutes` (returning route descriptors
-* minus the handlers, which can't cross JSON) and the framework-
-* private `invoke` method that the hub calls when this provider lives
-* in a forked worker.
-*
-* Co-located addons use the returned `getRoutes` directly because
-* their handlers don't need to cross any wire. The `invoke` method
-* is present anyway so the bridge code on the hub is uniform — it
-* doesn't need to switch on "local vs remote provider" at the call
-* site.
-*
-* Example:
-*   const routes: IAddonHttpRoute[] = [
-*     { method: 'GET', path: '/start', access: 'public', handler: this.handleStart },
-*   ]
-*   return [
-*     {
-*       capability: addonRoutesCapability,
-*       provider: buildAddonRouteProvider('auth-oidc', routes),
-*     },
-*   ]
-*/
-function buildAddonRouteProvider(id, routes) {
-	return {
-		id,
-		getRoutes: () => routes,
-		invoke: async (input) => {
-			const match = matchRoute(routes, input.method, input.path);
-			if (!match) return {
-				status: 404,
-				headers: {},
-				redirectUrl: null,
-				body: { error: `No route matches ${input.method} ${input.path}` }
-			};
-			const envelope = {
-				status: 200,
-				headers: {},
-				redirectUrl: null
-			};
-			const reply = buildCapturingReply(envelope);
-			const request = {
-				params: {
-					...match.params,
-					...input.params
-				},
-				query: input.query,
-				body: input.body,
-				headers: input.headers,
-				...input.user ? { user: input.user } : {},
-				...input.scopedToken !== void 0 ? { scopedToken: input.scopedToken } : {}
-			};
-			await match.route.handler(request, reply);
-			return envelope;
-		}
-	};
-}
-/**
-* Pattern matcher: same semantics as `AddonRouteRegistry.matchRoute`
-* but operating on a flat list and bypassing the `/addon/<id>/` prefix
-* — the bridge sends the post-prefix path directly so we don't need
-* to round-trip it through normalization.
+* Frozen unit → spec table. `•` in the doc marks each dimension's canonical
+* unit (`factor: 1, offset: 0`). °F derives from `°C = (°F − 32) × 5/9` ⇒
+* `factor = 5/9`, `offset = -160/9` (kept as exact expressions, not rounded
+* decimals). K derives from `°C = K − 273.15`.
 */
-function matchRoute(routes, method, path) {
-	const normalizedMethod = method.toUpperCase();
-	for (const route of routes) {
-		if (route.method !== normalizedMethod) continue;
-		const params = matchPath(route.path, path);
-		if (params !== null) return {
-			route,
-			params
-		};
-	}
-	return null;
-}
-function matchPath(pattern, p) {
-	const patternParts = pattern.split("/").filter(Boolean);
-	const pathParts = p.split("/").filter(Boolean);
-	if (patternParts.length !== pathParts.length) return null;
-	const params = {};
-	for (let i = 0; i < patternParts.length; i++) {
-		const a = patternParts[i];
-		const b = pathParts[i];
-		if (a.startsWith(":")) params[a.slice(1)] = b;
-		else if (a !== b) return null;
-	}
-	return params;
-}
-function buildCapturingReply(envelope) {
-	const wrapper = {
-		status(code) {
-			envelope.status = code;
-			return wrapper;
-		},
-		code(code) {
-			envelope.status = code;
-			return wrapper;
-		},
-		send(data) {
-			envelope.body = data;
-		},
-		redirect(url) {
-			envelope.redirectUrl = url;
-			if (envelope.status === 200) envelope.status = 302;
-		},
-		header(name, value) {
-			envelope.headers[name.toLowerCase()] = value;
-			return wrapper;
-		},
-		type(mime) {
-			envelope.contentType = mime;
-			return wrapper;
-		}
-	};
-	return wrapper;
-}
-/** No part holds the id a call named. */
-var UnknownInstanceError = class extends Error {
-	instanceId;
-	constructor(instanceId) {
-		super(`Unknown instance '${instanceId}'`);
-		this.instanceId = instanceId;
-		this.name = "UnknownInstanceError";
-	}
-};
-/** A create or a form named no kind, or a kind no part serves. */
-var UnknownInstanceKindError = class extends Error {
-	kindId;
-	constructor(kindId) {
-		super(kindId === void 0 ? "This provider has several kinds: name one" : `Unknown instance kind '${kindId}'`);
-		this.kindId = kindId;
-		this.name = "UnknownInstanceKindError";
-	}
-};
-function composeInstanceKinds(parts, base) {
-	const byKind = (kindId) => {
-		if (kindId === void 0) {
-			const only = parts.length === 1 ? parts[0] : void 0;
-			if (only === void 0) throw new UnknownInstanceKindError(void 0);
-			return only;
-		}
-		const part = parts.find((candidate) => candidate.kind.id === kindId);
-		if (part === void 0) throw new UnknownInstanceKindError(kindId);
-		return part;
-	};
-	/**
-	* The part a DRAFT test runs on. A named kind is that kind; an unnamed one is the provider's only
-	* testable kind. Several testable kinds and none named is a typed refusal that lists them, never a throw.
-	*/
-	const draftPart = (kindId) => {
-		if (kindId !== void 0) return parts.find((candidate) => candidate.kind.id === kindId) ?? { error: `Unknown instance kind '${kindId}'` };
-		const testable = parts.filter((part) => part.kind.canTest !== false);
-		const only = testable.length === 1 ? testable[0] : parts.length === 1 ? parts[0] : void 0;
-		if (only !== void 0) return only;
-		return { error: `This provider has several kinds: name one of ${(testable.length > 0 ? testable : parts).map((part) => part.kind.id).join(", ")}` };
-	};
-	const holderOf = async (id) => {
-		for (const part of parts) if (await part.provider.getInstance({ id }) !== null) return part;
-		throw new UnknownInstanceError(id);
-	};
-	const tagged = (part, instance) => ({
-		...instance,
-		kind: part.kind.id
-	});
-	return {
-		describe: async () => {
-			const links = (await Promise.all(parts.map(async (part) => (await part.provider.describe()).links ?? []))).flat();
-			return {
-				...base,
-				kinds: parts.map((part) => part.kind),
-				...links.length > 0 ? { links } : {}
-			};
-		},
-		instanceFormSchema: async ({ id, kind }) => {
-			return (id === null ? byKind(kind) : await holderOf(id)).provider.instanceFormSchema({ id });
-		},
-		listInstances: async () => {
-			return (await Promise.all(parts.map(async (part) => (await part.provider.listInstances()).map((instance) => tagged(part, instance))))).flat();
-		},
-		getInstance: async ({ id }) => {
-			for (const part of parts) {
-				const found = await part.provider.getInstance({ id });
-				if (found !== null) return tagged(part, found);
-			}
-			return null;
-		},
-		createInstance: async (input) => byKind(input.kind).provider.createInstance(input),
-		updateInstance: async (input) => (await holderOf(input.id)).provider.updateInstance(input),
-		setInstanceEnabled: async (input) => (await holderOf(input.id)).provider.setInstanceEnabled(input),
-		deleteInstance: async (input) => (await holderOf(input.id)).provider.deleteInstance(input),
-		testInstance: async (input) => {
-			const resolved = input.id === null ? draftPart(input.kind) : await holderOf(input.id);
-			if ("error" in resolved) return {
-				success: false,
-				status: "inconclusive",
-				error: resolved.error
-			};
-			const test = resolved.provider.testInstance;
-			if (test === void 0) return {
-				success: false,
-				status: "inconclusive",
-				error: "This kind cannot be tested"
-			};
-			return test(input);
-		}
-	};
+var UNIT_TABLE = {
+	"°C": {
+		dimension: "temperature",
+		factor: 1,
+		offset: 0
+	},
+	"°F": {
+		dimension: "temperature",
+		factor: 5 / 9,
+		offset: -160 / 9
+	},
+	K: {
+		dimension: "temperature",
+		factor: 1,
+		offset: -273.15
+	},
+	hPa: {
+		dimension: "pressure",
+		factor: 1,
+		offset: 0
+	},
+	kPa: {
+		dimension: "pressure",
+		factor: 10,
+		offset: 0
+	},
+	Pa: {
+		dimension: "pressure",
+		factor: .01,
+		offset: 0
+	},
+	mbar: {
+		dimension: "pressure",
+		factor: 1,
+		offset: 0
+	},
+	bar: {
+		dimension: "pressure",
+		factor: 1e3,
+		offset: 0
+	},
+	inHg: {
+		dimension: "pressure",
+		factor: 33.8639,
+		offset: 0
+	},
+	mmHg: {
+		dimension: "pressure",
+		factor: 1.33322,
+		offset: 0
+	},
+	psi: {
+		dimension: "pressure",
+		factor: 68.9476,
+		offset: 0
+	},
+	"m/s": {
+		dimension: "speed",
+		factor: 1,
+		offset: 0
+	},
+	"km/h": {
+		dimension: "speed",
+		factor: 1 / 3.6,
+		offset: 0
+	},
+	mph: {
+		dimension: "speed",
+		factor: .44704,
+		offset: 0
+	},
+	kn: {
+		dimension: "speed",
+		factor: .514444,
+		offset: 0
+	},
+	"mm/h": {
+		dimension: "precipitation-rate",
+		factor: 1,
+		offset: 0
+	},
+	"in/h": {
+		dimension: "precipitation-rate",
+		factor: 25.4,
+		offset: 0
+	},
+	m: {
+		dimension: "length",
+		factor: 1,
+		offset: 0
+	},
+	mm: {
+		dimension: "length",
+		factor: .001,
+		offset: 0
+	},
+	cm: {
+		dimension: "length",
+		factor: .01,
+		offset: 0
+	},
+	km: {
+		dimension: "length",
+		factor: 1e3,
+		offset: 0
+	},
+	in: {
+		dimension: "length",
+		factor: .0254,
+		offset: 0
+	},
+	ft: {
+		dimension: "length",
+		factor: .3048,
+		offset: 0
+	},
+	mi: {
+		dimension: "length",
+		factor: 1609.344,
+		offset: 0
+	},
+	"m²": {
+		dimension: "area",
+		factor: 1,
+		offset: 0
+	},
+	lx: {
+		dimension: "illuminance",
+		factor: 1,
+		offset: 0
+	},
+	"W/m²": {
+		dimension: "irradiance",
+		factor: 1,
+		offset: 0
+	},
+	W: {
+		dimension: "power",
+		factor: 1,
+		offset: 0
+	},
+	kW: {
+		dimension: "power",
+		factor: 1e3,
+		offset: 0
+	},
+	VA: {
+		dimension: "apparent-power",
+		factor: 1,
+		offset: 0
+	},
+	Wh: {
+		dimension: "energy",
+		factor: 1,
+		offset: 0
+	},
+	kWh: {
+		dimension: "energy",
+		factor: 1e3,
+		offset: 0
+	},
+	MWh: {
+		dimension: "energy",
+		factor: 1e6,
+		offset: 0
+	},
+	V: {
+		dimension: "voltage",
+		factor: 1,
+		offset: 0
+	},
+	mV: {
+		dimension: "voltage",
+		factor: .001,
+		offset: 0
+	},
+	A: {
+		dimension: "current",
+		factor: 1,
+		offset: 0
+	},
+	mA: {
+		dimension: "current",
+		factor: .001,
+		offset: 0
+	},
+	ppm: {
+		dimension: "concentration-volume",
+		factor: 1,
+		offset: 0
+	},
+	ppb: {
+		dimension: "concentration-volume",
+		factor: .001,
+		offset: 0
+	},
+	"µg/m³": {
+		dimension: "concentration-mass",
+		factor: 1,
+		offset: 0
+	},
+	"mg/m³": {
+		dimension: "concentration-mass",
+		factor: 1e3,
+		offset: 0
+	},
+	kg: {
+		dimension: "mass",
+		factor: 1,
+		offset: 0
+	},
+	g: {
+		dimension: "mass",
+		factor: .001,
+		offset: 0
+	},
+	lb: {
+		dimension: "mass",
+		factor: .453592,
+		offset: 0
+	},
+	oz: {
+		dimension: "mass",
+		factor: .0283495,
+		offset: 0
+	},
+	"%": {
+		dimension: "percentage",
+		factor: 1,
+		offset: 0
+	},
+	L: {
+		dimension: "volume",
+		factor: 1,
+		offset: 0
+	},
+	mL: {
+		dimension: "volume",
+		factor: .001,
+		offset: 0
+	},
+	gal: {
+		dimension: "volume",
+		factor: 3.785411784,
+		offset: 0
+	},
+	s: {
+		dimension: "duration",
+		factor: 1,
+		offset: 0
+	},
+	ms: {
+		dimension: "duration",
+		factor: .001,
+		offset: 0
+	},
+	min: {
+		dimension: "duration",
+		factor: 60,
+		offset: 0
+	},
+	h: {
+		dimension: "duration",
+		factor: 3600,
+		offset: 0
+	},
+	d: {
+		dimension: "duration",
+		factor: 86400,
+		offset: 0
+	},
+	B: {
+		dimension: "information",
+		factor: 1,
+		offset: 0
+	},
+	KiB: {
+		dimension: "information",
+		factor: 1024,
+		offset: 0
+	},
+	MiB: {
+		dimension: "information",
+		factor: 1024 ** 2,
+		offset: 0
+	},
+	GiB: {
+		dimension: "information",
+		factor: 1024 ** 3,
+		offset: 0
+	},
+	TiB: {
+		dimension: "information",
+		factor: 1024 ** 4,
+		offset: 0
+	},
+	kB: {
+		dimension: "information",
+		factor: 1e3,
+		offset: 0
+	},
+	MB: {
+		dimension: "information",
+		factor: 1e6,
+		offset: 0
+	},
+	GB: {
+		dimension: "information",
+		factor: 1e9,
+		offset: 0
+	},
+	"°": {
+		dimension: "angle",
+		factor: 1,
+		offset: 0
+	},
+	dBFS: {
+		dimension: "sound-level",
+		factor: 1,
+		offset: 0
+	},
+	dBm: {
+		dimension: "signal-level",
+		factor: 1,
+		offset: 0
+	},
+	mired: {
+		dimension: "colour-temperature",
+		factor: 1,
+		offset: 0
+	},
+	kbps: {
+		dimension: "bitrate",
+		factor: 1,
+		offset: 0
+	},
+	Mbps: {
+		dimension: "bitrate",
+		factor: 1e3,
+		offset: 0
+	},
+	fps: {
+		dimension: "rate",
+		factor: 1,
+		offset: 0
+	}
+};
+/** Resolve a unit's `UnitSpec`, or `undefined` when the spelling is unknown. */
+function specFor(unit) {
+	return Object.hasOwn(UNIT_TABLE, unit) ? UNIT_TABLE[unit] : void 0;
+}
+/** Value in `spec`'s unit → its dimension's canonical unit. */
+function toCanonical(value, spec) {
+	return value * spec.factor + spec.offset;
+}
+/** Canonical-unit value → the unit described by `spec`. */
+function fromCanonical(canonical, spec) {
+	return (canonical - spec.offset) / spec.factor;
 }
 /**
-* notification-output — canonical, capability-gated notification delivery.
-*
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
-*
-* DESIGN DECISIONS (locked):
-*  - A target is an INSTANCE of this function cap (epic #440, step 6): the
-*    providers serve their targets as `integration-instances` records, one
-*    record kind per target kind, and the admin lists, adds, edits, switches
-*    and deletes them through that cap. This cap keeps what an instance cannot
-*    say: the kind catalogue (`listTargetKinds`: capabilities, delivery
-*    parameters, brand icon), dispatch (`send`, `testTarget`) and the form
-*    helpers (`discoverTargets`, `probeTargetConfig`).
-*  - `listTargetKinds` / `discoverTargets` return arrays → the generated
-*    cap-mount auto-`concatCollection`-fans them across every registered
-*    provider so one catalog is routable. `send` / `testTarget` /
-*    `probeTargetConfig` route to ONE provider by the `addonId` the generated
-*    collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
-*
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = _enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: string().optional(),
-	bytes: _instanceof(Uint8Array).optional(),
-	mime: string().optional(),
-	name: string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = _enum([
-	"text",
-	"markdown",
-	"html"
-]);
-/**
-* The CLOSED icon vocabulary an action button may use.
-*
-* A closed set, not a free string, and that is the whole point: an arbitrary
-* icon name is one that ntfy renders, zentik silently drops, and nobody
-* notices — the same class of gap as a zone vocabulary nothing produced
-* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
-* declares `actionIcons: false` and the degrade engine strips the field.
-*
-* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
-* renderer's icon set; "acknowledge" survives an adapter that draws it
-* differently.
-*
-* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
-*
-* These names are for US. **No adapter may forward one verbatim.** Each maps
-* the whole set onto its own renderer's vocabulary through a
-* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
-* fallback, so adding a member here fails every adapter's build until someone
-* decides its glyph, which is the only place that decision can be made
-* honestly.
-*
-* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
-* `disarm` straight through; iOS feeds that string to
-* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
-* and every snooze and alarm button arrived BLANK. A pass-through is not a
-* mapping, and "the field is documented" is not "the value renders".
-*
-* Adding a member is TRAIN-BOUND. The enum lives in the published
-* `@camstack/server` closure and the cap seam validates against the HUB's copy,
-* so an addon that emits a token the running hub does not know does not lose an
-* icon — its whole `send` fails Zod validation and the notification never
-* arrives. Never emit a new token from an addon before the train carrying it.
+* Graceful variant for the render path: returns the converted value, or
+* `undefined` when the conversion is refused (unknown unit / cross-dimension).
+* Never throws — a render caller falls back to the raw value + source unit.
 */
-var NotificationActionIconSchema = _enum([
-	"acknowledge",
-	"dismiss",
-	"silence",
-	"snooze",
-	"view",
-	"play",
-	"open",
+function tryConvertUnit(value, from, to) {
+	if (from === to) return value;
+	const fromSpec = specFor(from);
+	if (!fromSpec) return void 0;
+	const toSpec = specFor(to);
+	if (!toSpec) return void 0;
+	if (fromSpec.dimension !== toSpec.dimension) return void 0;
+	return fromCanonical(toCanonical(value, fromSpec), toSpec);
+}
+//#endregion
+//#region ../types/dist/index.mjs
+var SMTP_INBOUND_DEFAULT_PORT = 2525;
+var SMTP_INBOUND_DEFAULT_DOMAIN = "camstack.local";
+var SMTP_INBOUND_DEFAULT_MAX_MESSAGE_BYTES = 25 * 1024 * 1024;
+/** The text excerpt a message carries on the bus. */
+var SMTP_INBOUND_TEXT_MAX_CHARS = 4096;
+var PortSchema = number().int().min(1).max(65535);
+/** A recipient local-part: what stands before the `@`. */
+var SmtpRecipientSchema = string().min(1).max(64).regex(/^[A-Za-z0-9._+-]+$/);
+object({
+	port: PortSchema.default(SMTP_INBOUND_DEFAULT_PORT),
+	bindHost: string().min(1).default("0.0.0.0"),
+	domain: string().min(1).default(SMTP_INBOUND_DEFAULT_DOMAIN),
+	requireAuth: boolean().default(true),
+	username: string().default(""),
+	password: string().default("").meta({ secret: true }),
+	starttls: boolean().default(false),
+	maxMessageBytes: number().int().positive().default(SMTP_INBOUND_DEFAULT_MAX_MESSAGE_BYTES)
+});
+object({
+	host: string().min(1).nullable(),
+	hostReason: string().nullable(),
+	port: PortSchema,
+	domain: string().min(1),
+	requireAuth: boolean(),
+	username: string(),
+	password: string(),
+	starttls: boolean()
+});
+object({
+	recipients: array(SmtpRecipientSchema).min(1),
+	/**
+	* Who is subscribing. A second `subscribe` with the same id REPLACES that subscriber's
+	* recipients (the way a consumer that restarted, or lost a device, declares its set again);
+	* a recipient held by another subscriber is refused with `smtp-inbound/recipient-claimed`.
+	* Absent, the subscriber is anonymous and unique.
+	*/
+	subscriberId: string().min(1).max(64).optional()
+});
+var SmtpInboundAttachmentSchema = object({
+	filename: string(),
+	contentType: string(),
+	bytes: number().int().nonnegative()
+});
+/** The payload of one `broker.message` (the key is the recipient local-part). */
+var SmtpInboundMessageSchema = object({
+	/** Monotonic per mailbox; a gap tells a consumer it missed an event. */
+	seq: number().int().positive(),
+	messageId: string(),
+	receivedAt: number().int().nonnegative(),
+	from: string(),
+	to: string(),
+	subject: string(),
+	text: string().max(SMTP_INBOUND_TEXT_MAX_CHARS),
+	attachments: array(SmtpInboundAttachmentSchema)
+});
+object({
+	/** The newest seq issued so far (0 before any mail). */
+	lastSeq: number().int().nonnegative(),
+	/** The oldest seq still retained; messages below it are gone. */
+	oldestSeq: number().int().nonnegative(),
+	messages: array(object({
+		key: string(),
+		message: SmtpInboundMessageSchema
+	}))
+});
+new Set([
+	"track",
+	"face",
+	"identity",
+	"plate",
+	"vehicle",
+	"scene",
+	"motion",
+	"object",
+	"audio",
+	"mosaic"
+]);
+/**
+* The owner types that are event tables, in the order the event-media resolver
+* should consider them. Exported so a consumer asking "is this key an event?"
+* does not re-spell the list and drift from it.
+*/
+var EVENT_OWNER_TYPES = [
+	"motion",
+	"object",
+	"audio"
+];
+/**
+* The same list as a Zod enum, for the cap inputs that must NAME the table
+* (D482: `getEventMedia` / `listEventMedia` take an owner, and an owner is
+* `(table, id)`).
+*
+* Built FROM {@link EVENT_OWNER_TYPES} rather than re-spelled: a fourth event
+* table would otherwise be accepted by the codec and refused at the door, with
+* nothing failing until a caller asked.
+*/
+var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
+/** The same list as a Zod enum, for the cap input that carries it. */
+var MediaPresenceOwnerKindSchema = _enum([...EVENT_OWNER_TYPES, "track"]);
+new Set(EVENT_OWNER_TYPES);
+/**
+* What a published package needs from the rest of the install (D989).
+*
+* One published framework package (`@camstack/server`) carries the kernel, the
+* builtins and the capability contracts, so "which addon runs on which
+* framework" is a question of version, and the answer is DECLARED by the
+* package that knows it:
+*
+*   - an addon says the oldest server it runs on (`requires.server: ">=X"`);
+*   - the server says the oldest addon it works with
+*     (`requires.addons: { "@camstack/addon-x": ">=Y" }`) and the oldest shell
+*     around it (`requires.wrapper: { desktop, image }`);
+*   - a wrapper (the desktop app, the container starter) says which server
+*     range it can host, and reports its own kind and version.
+*
+* The publish workflow STAMPS these after the version bump
+* (`scripts/ci/stamp-requires.mjs`); nobody types a number by hand.
+*
+* A requirement that cannot be checked is NOT met: a shell that reports no
+* version counts as below the minimum, and an unreadable running version is
+* named in the result (a failed read is never a pass).
+*/
+/** `>=MAJOR.MINOR.PATCH[-prerelease]` — the only range shape a requirement uses. */
+var MinVersionSchema = string().regex(/^>=\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/, "a minimum is written \">=X.Y.Z\"");
+object({
+	/** The oldest `@camstack/server` this package runs on. */
+	server: MinVersionSchema.optional(),
+	/** The oldest installed version of each named addon package. */
+	addons: record(string(), MinVersionSchema).optional(),
+	/** The oldest shell around the server, per shell kind. */
+	wrapper: object({
+		desktop: MinVersionSchema.optional(),
+		image: MinVersionSchema.optional()
+	}).optional()
+});
+/** One unmet requirement; each names the versions on both sides. */
+var UnmetRequirementSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("server-too-old"),
+		required: string(),
+		/** `null` — the running server version could not be read. */
+		running: string().nullable()
+	}),
+	object({
+		kind: literal("addon-too-old"),
+		packageName: string(),
+		required: string(),
+		/** `null` — the addon is not installed (or its version is unreadable). */
+		running: string().nullable()
+	}),
+	object({
+		kind: literal("wrapper-too-old"),
+		wrapper: _enum(["desktop", "image"]),
+		required: string(),
+		/** `null` — the wrapper reported no version. */
+		running: string().nullable()
+	})
+]);
+var RequiredAddonUpdateSchema = object({
+	packageName: string(),
+	/** The minimum the target server declares. */
+	required: string(),
+	/** What this node has; `null` when the addon is not installed. */
+	installed: string().nullable()
+});
+/**
+* Which integration instance a settings form is for. An addon that serves several instances
+* (`instanceMode: multiple`) can show a different form per instance — an NVR integration
+* needs its connection, the default integration needs the addon's own sections.
+*
+* - `integrationId` is `null` in the create wizard: nothing exists yet, the operator is
+*   setting up a NEW instance.
+* - `mode` is the wizard mode of the integration type (`getAvailableTypes`).
+* - `candidateStableId` is the discovery candidate a wizard was seeded from, if any.
+*/
+var IntegrationInstanceRefSchema = object({
+	integrationId: string().nullable(),
+	mode: _enum([
+		"standalone",
+		"account",
+		"broker"
+	]),
+	candidateStableId: string().optional()
+});
+/**
+* Build an `IAddonRouteProvider` from a list of routes. Implements
+* both the operator-facing `getRoutes` (returning route descriptors
+* minus the handlers, which can't cross JSON) and the framework-
+* private `invoke` method that the hub calls when this provider lives
+* in a forked worker.
+*
+* Co-located addons use the returned `getRoutes` directly because
+* their handlers don't need to cross any wire. The `invoke` method
+* is present anyway so the bridge code on the hub is uniform — it
+* doesn't need to switch on "local vs remote provider" at the call
+* site.
+*
+* Example:
+*   const routes: IAddonHttpRoute[] = [
+*     { method: 'GET', path: '/start', access: 'public', handler: this.handleStart },
+*   ]
+*   return [
+*     {
+*       capability: addonRoutesCapability,
+*       provider: buildAddonRouteProvider('auth-oidc', routes),
+*     },
+*   ]
+*/
+function buildAddonRouteProvider(id, routes) {
+	return {
+		id,
+		getRoutes: () => routes,
+		invoke: async (input) => {
+			const match = matchRoute(routes, input.method, input.path);
+			if (!match) return {
+				status: 404,
+				headers: {},
+				redirectUrl: null,
+				body: { error: `No route matches ${input.method} ${input.path}` }
+			};
+			const envelope = {
+				status: 200,
+				headers: {},
+				redirectUrl: null
+			};
+			const reply = buildCapturingReply(envelope);
+			const request = {
+				params: {
+					...match.params,
+					...input.params
+				},
+				query: input.query,
+				body: input.body,
+				headers: input.headers,
+				...input.user ? { user: input.user } : {},
+				...input.scopedToken !== void 0 ? { scopedToken: input.scopedToken } : {}
+			};
+			await match.route.handler(request, reply);
+			return envelope;
+		}
+	};
+}
+/**
+* Pattern matcher: same semantics as `AddonRouteRegistry.matchRoute`
+* but operating on a flat list and bypassing the `/addon/<id>/` prefix
+* — the bridge sends the post-prefix path directly so we don't need
+* to round-trip it through normalization.
+*/
+function matchRoute(routes, method, path) {
+	const normalizedMethod = method.toUpperCase();
+	for (const route of routes) {
+		if (route.method !== normalizedMethod) continue;
+		const params = matchPath(route.path, path);
+		if (params !== null) return {
+			route,
+			params
+		};
+	}
+	return null;
+}
+function matchPath(pattern, p) {
+	const patternParts = pattern.split("/").filter(Boolean);
+	const pathParts = p.split("/").filter(Boolean);
+	if (patternParts.length !== pathParts.length) return null;
+	const params = {};
+	for (let i = 0; i < patternParts.length; i++) {
+		const a = patternParts[i];
+		const b = pathParts[i];
+		if (a.startsWith(":")) params[a.slice(1)] = b;
+		else if (a !== b) return null;
+	}
+	return params;
+}
+function buildCapturingReply(envelope) {
+	const wrapper = {
+		status(code) {
+			envelope.status = code;
+			return wrapper;
+		},
+		code(code) {
+			envelope.status = code;
+			return wrapper;
+		},
+		send(data) {
+			envelope.body = data;
+		},
+		redirect(url) {
+			envelope.redirectUrl = url;
+			if (envelope.status === 200) envelope.status = 302;
+		},
+		header(name, value) {
+			envelope.headers[name.toLowerCase()] = value;
+			return wrapper;
+		},
+		type(mime) {
+			envelope.contentType = mime;
+			return wrapper;
+		}
+	};
+	return wrapper;
+}
+/** No part holds the id a call named. */
+var UnknownInstanceError = class extends Error {
+	instanceId;
+	constructor(instanceId) {
+		super(`Unknown instance '${instanceId}'`);
+		this.instanceId = instanceId;
+		this.name = "UnknownInstanceError";
+	}
+};
+/** A create or a form named no kind, or a kind no part serves. */
+var UnknownInstanceKindError = class extends Error {
+	kindId;
+	constructor(kindId) {
+		super(kindId === void 0 ? "This provider has several kinds: name one" : `Unknown instance kind '${kindId}'`);
+		this.kindId = kindId;
+		this.name = "UnknownInstanceKindError";
+	}
+};
+function composeInstanceKinds(parts, base) {
+	const byKind = (kindId) => {
+		if (kindId === void 0) {
+			const only = parts.length === 1 ? parts[0] : void 0;
+			if (only === void 0) throw new UnknownInstanceKindError(void 0);
+			return only;
+		}
+		const part = parts.find((candidate) => candidate.kind.id === kindId);
+		if (part === void 0) throw new UnknownInstanceKindError(kindId);
+		return part;
+	};
+	/**
+	* The part a DRAFT test runs on. A named kind is that kind; an unnamed one is the provider's only
+	* testable kind. Several testable kinds and none named is a typed refusal that lists them, never a throw.
+	*/
+	const draftPart = (kindId) => {
+		if (kindId !== void 0) return parts.find((candidate) => candidate.kind.id === kindId) ?? { error: `Unknown instance kind '${kindId}'` };
+		const testable = parts.filter((part) => part.kind.canTest !== false);
+		const only = testable.length === 1 ? testable[0] : parts.length === 1 ? parts[0] : void 0;
+		if (only !== void 0) return only;
+		return { error: `This provider has several kinds: name one of ${(testable.length > 0 ? testable : parts).map((part) => part.kind.id).join(", ")}` };
+	};
+	const holderOf = async (id) => {
+		for (const part of parts) if (await part.provider.getInstance({ id }) !== null) return part;
+		throw new UnknownInstanceError(id);
+	};
+	const tagged = (part, instance) => ({
+		...instance,
+		kind: part.kind.id
+	});
+	return {
+		describe: async () => {
+			const links = (await Promise.all(parts.map(async (part) => (await part.provider.describe()).links ?? []))).flat();
+			return {
+				...base,
+				kinds: parts.map((part) => part.kind),
+				...links.length > 0 ? { links } : {}
+			};
+		},
+		instanceFormSchema: async ({ id, kind }) => {
+			return (id === null ? byKind(kind) : await holderOf(id)).provider.instanceFormSchema({ id });
+		},
+		listInstances: async () => {
+			return (await Promise.all(parts.map(async (part) => (await part.provider.listInstances()).map((instance) => tagged(part, instance))))).flat();
+		},
+		getInstance: async ({ id }) => {
+			for (const part of parts) {
+				const found = await part.provider.getInstance({ id });
+				if (found !== null) return tagged(part, found);
+			}
+			return null;
+		},
+		createInstance: async (input) => byKind(input.kind).provider.createInstance(input),
+		updateInstance: async (input) => (await holderOf(input.id)).provider.updateInstance(input),
+		setInstanceEnabled: async (input) => (await holderOf(input.id)).provider.setInstanceEnabled(input),
+		deleteInstance: async (input) => (await holderOf(input.id)).provider.deleteInstance(input),
+		testInstance: async (input) => {
+			const resolved = input.id === null ? draftPart(input.kind) : await holderOf(input.id);
+			if ("error" in resolved) return {
+				success: false,
+				status: "inconclusive",
+				error: resolved.error
+			};
+			const test = resolved.provider.testInstance;
+			if (test === void 0) return {
+				success: false,
+				status: "inconclusive",
+				error: "This kind cannot be tested"
+			};
+			return test(input);
+		}
+	};
+}
+/**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - A target is an INSTANCE of this function cap (epic #440, step 6): the
+*    providers serve their targets as `integration-instances` records, one
+*    record kind per target kind, and the admin lists, adds, edits, switches
+*    and deletes them through that cap. This cap keeps what an instance cannot
+*    say: the kind catalogue (`listTargetKinds`: capabilities, delivery
+*    parameters, brand icon), dispatch (`send`, `testTarget`) and the form
+*    helpers (`discoverTargets`, `probeTargetConfig`).
+*  - `listTargetKinds` / `discoverTargets` return arrays → the generated
+*    cap-mount auto-`concatCollection`-fans them across every registered
+*    provider so one catalog is routable. `send` / `testTarget` /
+*    `probeTargetConfig` route to ONE provider by the `addonId` the generated
+*    collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = _enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: string().optional(),
+	bytes: _instanceof(Uint8Array).optional(),
+	mime: string().optional(),
+	name: string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = _enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/**
+* The CLOSED icon vocabulary an action button may use.
+*
+* A closed set, not a free string, and that is the whole point: an arbitrary
+* icon name is one that ntfy renders, zentik silently drops, and nobody
+* notices — the same class of gap as a zone vocabulary nothing produced
+* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
+* declares `actionIcons: false` and the degrade engine strips the field.
+*
+* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
+* renderer's icon set; "acknowledge" survives an adapter that draws it
+* differently.
+*
+* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
+*
+* These names are for US. **No adapter may forward one verbatim.** Each maps
+* the whole set onto its own renderer's vocabulary through a
+* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
+* fallback, so adding a member here fails every adapter's build until someone
+* decides its glyph, which is the only place that decision can be made
+* honestly.
+*
+* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
+* `disarm` straight through; iOS feeds that string to
+* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
+* and every snooze and alarm button arrived BLANK. A pass-through is not a
+* mapping, and "the field is documented" is not "the value renders".
+*
+* Adding a member is TRAIN-BOUND. The enum lives in the published
+* `@camstack/server` closure and the cap seam validates against the HUB's copy,
+* so an addon that emits a token the running hub does not know does not lose an
+* icon — its whole `send` fails Zod validation and the notification never
+* arrives. Never emit a new token from an addon before the train carrying it.
+*/
+var NotificationActionIconSchema = _enum([
+	"acknowledge",
+	"dismiss",
+	"silence",
+	"snooze",
+	"view",
+	"play",
+	"open",
 	"close",
 	"lock",
 	"unlock",
@@ -42528,738 +43026,360 @@ var ICON_SYNONYMS = {
 	],
 	"toggle-right": [
 		"interruttore",
-		"switch",
-		"toggle",
-		"acceso"
-	],
-	tractor: [
-		"trattore",
-		"tosaerba",
-		"giardino"
-	],
-	"train-front": ["treno"],
-	"tree-pine": [
-		"albero",
-		"pino",
-		"giardino"
-	],
-	trees: [
-		"giardino",
-		"alberi",
-		"esterno",
-		"parco",
-		"garden"
-	],
-	truck: [
-		"camion",
-		"furgone",
-		"consegna"
-	],
-	tv: ["televisore"],
-	umbrella: [
-		"tenda",
-		"markise",
-		"ombrellone",
-		"pergola",
-		"veranda",
-		"terrace"
-	],
-	user: ["persona", "utente"],
-	users: [
-		"persone",
-		"gruppo",
-		"famiglia"
-	],
-	utensils: [
-		"cucina",
-		"posate",
-		"sala",
-		"pranzo",
-		"kitchen"
-	],
-	vibrate: [
-		"vibrazione",
-		"urto",
-		"tamper"
-	],
-	video: [],
-	"video-off": ["video", "spento"],
-	"volume-2": [
-		"volume",
-		"audio",
-		"altoparlante",
-		"suono"
-	],
-	"volume-x": [
-		"muto",
-		"silenziato",
-		"volume",
-		"spento"
-	],
-	warehouse: [
-		"magazzino",
-		"capanno",
-		"deposito",
-		"cantina",
-		"warehouse"
-	],
-	"washing-machine": [
-		"lavatrice",
-		"lavastoviglie",
-		"asciugatrice"
-	],
-	waves: [
-		"onde",
-		"acqua",
-		"vibrazione"
-	],
-	"waves-ladder": [
-		"piscina",
-		"vasca",
-		"pool"
-	],
-	wifi: ["rete", "segnale"],
-	"wifi-off": [
-		"wifi",
-		"assente",
-		"offline",
-		"disconnesso"
-	],
-	wind: [
-		"vento",
-		"aria",
-		"gas",
-		"monossido",
-		"co"
-	],
-	workflow: [
-		"automazione",
-		"flusso",
-		"scenario"
-	],
-	wrench: [
-		"officina",
-		"manutenzione",
-		"attrezzi",
-		"utenze"
-	],
-	zap: [
-		"energia",
-		"corrente",
-		"consumo",
-		"watt",
-		"elettricita"
-	]
-};
-/**
-* Spellings an operator may already have PERSISTED that no lucide package
-* accepts any more, and the catalog key they draw. They resolve
-* (`canonicalIconKey`) but are never offered. `gauge2` was this repo's own
-* pre-catalog spelling of `gauge`.
-*/
-var LEGACY_ICON_ALIASES = { gauge2: "gauge" };
-/**
-* icon-catalog — THE icon vocabulary (D854).
-*
-* Every place that picks or stores an icon — a device's display override, a
-* location, a site zone, a viewer accessory, an `icon` settings field — names
-* it by a key of this catalog and nothing else. There is no curated subset and
-* no second list: the catalog is every lucide icon that both surfaces can draw
-* (the admin UI's `lucide-react` and the viewer's `lucide-react-native`), the
-* intersection computed by `scripts/generate-icon-catalog.ts` into the
-* committed `icon-catalog.generated.ts`.
-*
-* Like the vocabularies it replaces, this module holds STRINGS only — no React,
-* no lucide import, no glyph. Each surface owns its glyph table (the web one
-* lives in `ui-library`, loaded lazily), and a test on each side pins that it
-* covers {@link ICON_KEYS}.
-*
-* ## What is persisted
-*
-* The canonical kebab-case lucide id ({@link IconKey}). Spellings that a lucide
-* package still accepts (`home` for `house`) and this repo's own legacy ones
-* (`gauge2`) RESOLVE ({@link canonicalIconKey}) so a stored value never goes
-* stale, but they are never OFFERED by search.
-*
-* ## Search
-*
-* Over the key, the Italian/English overlay in `icon-synonyms.ts`, any words
-* the caller adds, and lucide's English tags — in that order of weight.
-*/
-var KEY_SET$2 = new Set(ICON_KEYS);
-new Map([...Object.entries(ICON_ALIASES), ...Object.entries(LEGACY_ICON_ALIASES)]);
-/** Is this a canonical key of the catalog? (An alias is not — see {@link canonicalIconKey}.) */
-function isIconKey(value) {
-	return typeof value === "string" && KEY_SET$2.has(value);
-}
-/**
-* Wire/storage schema for one icon key.
-*
-* Deliberately NOT a `z.enum` of the catalog: ~1,700 literals would be inlined
-* into every cap router, type and API-reference row that carries an icon. The
-* check is membership in the catalog and the type is {@link IconKey}.
-*/
-var IconKeySchema = custom(isIconKey, "Not an icon of the catalog");
-var ENTRIES = ICON_KEYS.map((key, index) => {
-	const [categoryIndexes, tags] = ICON_META[index] ?? [[], []];
-	const categories = categoryIndexes.flatMap((i) => {
-		const id = ICON_CATEGORY_IDS[i];
-		return id === void 0 ? [] : [id];
-	});
-	return {
-		key,
-		categories,
-		primaryCategory: categories[0] ?? ICON_CATEGORY_IDS[0],
-		tags,
-		synonyms: ICON_SYNONYMS[key] ?? []
-	};
-});
-new Map(ENTRIES.map((e) => [e.key, e]));
-/** Categories a picker offers first: the ones this product's icons mostly live in. */
-var LEADING_CATEGORIES = [
-	"devices",
-	"home",
-	"security",
-	"buildings",
-	"connectivity",
-	"multimedia",
-	"nature",
-	"weather",
-	"transportation",
-	"animals"
-];
-var PRIMARY_CATEGORIES = new Set(ENTRIES.map((e) => e.primaryCategory));
-[...LEADING_CATEGORIES, ...ICON_CATEGORY_IDS.filter((c) => !LEADING_CATEGORIES.includes(c))].filter((c) => PRIMARY_CATEGORIES.has(c));
-/**
-* One (location, icon) assignment as it travels.
-*
-* `locationKey` is ALWAYS {@link locationIconKey} of the label — never the
-* operator's casing. The registry matches labels trimmed + case-insensitively
-* everywhere (`addLocation`, `removeLocation`, `renameLocation`), and a
-* case-only rename (`kitchen` → `Kitchen`) is a real edit this repo supports; a
-* map keyed on the displayed casing would orphan its entry on exactly that
-* edit. Consumers join by keying their own label through `locationIconKey`.
-*/
-var LocationIconAssignmentSchema = object({
-	locationKey: string(),
-	icon: IconKeySchema
-});
-/**
-* One (location, description) assignment as it travels.
-*
-* Same key discipline as {@link LocationIconAssignmentSchema}, and for the same
-* reason: this lived for a while in the post-analysis addon's own settings,
-* keyed by a HAND-TYPED label matched exactly and case-sensitively. A rename in
-* the Locations page carried the icon and silently orphaned the description —
-* two authorities for one thing, joined by two different rules. Now both hang
-* off the location itself, on `locationIconKey`.
-*/
-var LocationDescriptionAssignmentSchema = object({
-	locationKey: string(),
-	description: string()
-});
-/**
-* WHO an action step acts on (D983) — one target shape for every place that
-* performs an action (automation steps, Action entries, notification
-* sequences, scheduler points):
-*
-*  - `devices` — device ids the operator picked, frozen at save time;
-*  - `domain`  — every device that offers the step's VOCABULARY action,
-*    optionally narrowed to one device type and one room, resolved WHEN THE
-*    STEP RUNS (a device added later is included). The action always comes
-*    from the vocabulary (`cover.open`), never from a raw cap name, so a
-*    `domain` target needs an `actionId` (enforced on the step schema);
-*  - `var`     — a `$var` resolved from the run's scope.
-*
-* {@link ActionTargetResolver} turns a target into device ids. It is pure
-* (a {@link DeviceDirectory} is handed in) so the hub's core-blocks service and
-* a generated automation block share it.
-*
-* A room is the device's `location` label (`DeviceInfo.location`); two labels
-* name the same room when `locationIconKey` agrees (trimmed, lower-cased).
-*/
-var ActionTargetSchema = discriminatedUnion("kind", [
-	object({
-		kind: literal("devices"),
-		ids: array(number().int()).min(1)
-	}),
-	object({
-		kind: literal("domain"),
-		/** Narrow to one kind of device. */
-		deviceType: _enum(DeviceType).optional(),
-		/** Narrow to one room: the `location` label devices carry. */
-		roomId: string().min(1).optional()
-	}),
-	object({
-		kind: literal("var"),
-		name: string().min(1)
-	})
-]);
-EventCategory.DeviceRegistered, EventCategory.DeviceUnregistered, EventCategory.DeviceUpdated, EventCategory.DeviceMetaChanged, EventCategory.DeviceBindingsChanged;
-var ExpressionBindingSourceSchema = union([
-	object({
-		kind: literal("field").optional(),
-		sourceKey: string(),
-		cap: string(),
-		fieldPath: string()
-	}),
-	object({
-		kind: literal("literal"),
-		value: union([
-			string(),
-			number(),
-			boolean(),
-			_null()
-		])
-	}),
-	object({
-		kind: literal("global"),
-		sourceStableId: string(),
-		cap: string(),
-		fieldPath: string()
-	})
-]);
-object({
-	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
-});
-/**
-* Identity envelope for a device's upstream-system metadata.
-*
-* Two jobs:
-*
-*   1. **Dispatch key.** `id` is the natural identifier the SOURCE system
-*      uses to address this device (HA `entity_id`, Reolink MAC, ONVIF
-*      WS-Discovery endpoint UUID, …). Provider code keeps a
-*      `Map<sourceInfo.id, IDevice>` to route inbound push events in O(1)
-*      without round-tripping through `stableId` / `id` mappings.
-*
-*   2. **Stability bridge.** `uniqueId` is the *immutable* upstream id when
-*      one exists (HA `entity.unique_id`, Reolink MAC again — same as `id`
-*      for vendors where MAC is the natural key). For systems where the
-*      live dispatch key can be renamed (HA `entity_id` can be edited),
-*      providers detect renames by matching `uniqueId` and patch `id`
-*      in-place so dispatch keeps working.
-*
-* **Display unit and precision are NOT stored here.** They are a read-time
-* preference (D944). A polymorphic reading stores its `quantity` here once,
-* at adopt, and a date/time value stores `dateTimeShape` the same way —
-* neither is repeated on each sample. The `device_class` tag is an
-* HA-specific input consumed at the discovery boundary (`ha-domain-mapping`)
-* to derive the CamStack `DeviceRole`; it is never stored after that point.
-*
-* The `raw` escape hatch carries provider-specific attributes that don't
-* fit the structured slots (HA `attributes` whitelist, Reolink `deviceCache`
-* details, …). Providers control what lands here.
-*/
-var SourceInfoSchema = object({
-	/** Live dispatch key — mutable when the source system allows rename. */
-	id: string(),
-	/** Source system tag — e.g. 'homeassistant' | 'reolink' | 'onvif'. */
-	system: string(),
-	/** Immutable upstream identifier when available (HA `unique_id`, … ).
-	*  Used to detect rename when `id` changes. */
-	uniqueId: string().optional(),
-	/** Quantity of a polymorphic reading, written once at adopt (D944). */
-	quantity: ReadingQuantitySchema.optional(),
-	/** Date / time / datetime shape of a string reading, written once at adopt. */
-	dateTimeShape: _enum([
-		"date",
-		"time",
-		"datetime"
-	]).optional(),
-	/** Provider-specific extras that don't fit the structured slots.
-	*  Whitelist what goes here per provider — do NOT dump entire HA
-	*  attribute blobs (would explode the meta JSON column). */
-	raw: record(string(), unknown()).optional()
-});
-/**
-* Frozen unit → spec table. `•` in the doc marks each dimension's canonical
-* unit (`factor: 1, offset: 0`). °F derives from `°C = (°F − 32) × 5/9` ⇒
-* `factor = 5/9`, `offset = -160/9` (kept as exact expressions, not rounded
-* decimals). K derives from `°C = K − 273.15`.
-*/
-var UNIT_TABLE = {
-	"°C": {
-		dimension: "temperature",
-		factor: 1,
-		offset: 0
-	},
-	"°F": {
-		dimension: "temperature",
-		factor: 5 / 9,
-		offset: -160 / 9
-	},
-	K: {
-		dimension: "temperature",
-		factor: 1,
-		offset: -273.15
-	},
-	hPa: {
-		dimension: "pressure",
-		factor: 1,
-		offset: 0
-	},
-	kPa: {
-		dimension: "pressure",
-		factor: 10,
-		offset: 0
-	},
-	Pa: {
-		dimension: "pressure",
-		factor: .01,
-		offset: 0
-	},
-	mbar: {
-		dimension: "pressure",
-		factor: 1,
-		offset: 0
-	},
-	bar: {
-		dimension: "pressure",
-		factor: 1e3,
-		offset: 0
-	},
-	inHg: {
-		dimension: "pressure",
-		factor: 33.8639,
-		offset: 0
-	},
-	mmHg: {
-		dimension: "pressure",
-		factor: 1.33322,
-		offset: 0
-	},
-	psi: {
-		dimension: "pressure",
-		factor: 68.9476,
-		offset: 0
-	},
-	"m/s": {
-		dimension: "speed",
-		factor: 1,
-		offset: 0
-	},
-	"km/h": {
-		dimension: "speed",
-		factor: 1 / 3.6,
-		offset: 0
-	},
-	mph: {
-		dimension: "speed",
-		factor: .44704,
-		offset: 0
-	},
-	kn: {
-		dimension: "speed",
-		factor: .514444,
-		offset: 0
-	},
-	"mm/h": {
-		dimension: "precipitation-rate",
-		factor: 1,
-		offset: 0
-	},
-	"in/h": {
-		dimension: "precipitation-rate",
-		factor: 25.4,
-		offset: 0
-	},
-	m: {
-		dimension: "length",
-		factor: 1,
-		offset: 0
-	},
-	mm: {
-		dimension: "length",
-		factor: .001,
-		offset: 0
-	},
-	cm: {
-		dimension: "length",
-		factor: .01,
-		offset: 0
-	},
-	km: {
-		dimension: "length",
-		factor: 1e3,
-		offset: 0
-	},
-	in: {
-		dimension: "length",
-		factor: .0254,
-		offset: 0
-	},
-	ft: {
-		dimension: "length",
-		factor: .3048,
-		offset: 0
-	},
-	mi: {
-		dimension: "length",
-		factor: 1609.344,
-		offset: 0
-	},
-	"m²": {
-		dimension: "area",
-		factor: 1,
-		offset: 0
-	},
-	lx: {
-		dimension: "illuminance",
-		factor: 1,
-		offset: 0
-	},
-	"W/m²": {
-		dimension: "irradiance",
-		factor: 1,
-		offset: 0
-	},
-	W: {
-		dimension: "power",
-		factor: 1,
-		offset: 0
-	},
-	kW: {
-		dimension: "power",
-		factor: 1e3,
-		offset: 0
-	},
-	VA: {
-		dimension: "apparent-power",
-		factor: 1,
-		offset: 0
-	},
-	Wh: {
-		dimension: "energy",
-		factor: 1,
-		offset: 0
-	},
-	kWh: {
-		dimension: "energy",
-		factor: 1e3,
-		offset: 0
-	},
-	MWh: {
-		dimension: "energy",
-		factor: 1e6,
-		offset: 0
-	},
-	V: {
-		dimension: "voltage",
-		factor: 1,
-		offset: 0
-	},
-	mV: {
-		dimension: "voltage",
-		factor: .001,
-		offset: 0
-	},
-	A: {
-		dimension: "current",
-		factor: 1,
-		offset: 0
-	},
-	mA: {
-		dimension: "current",
-		factor: .001,
-		offset: 0
-	},
-	ppm: {
-		dimension: "concentration-volume",
-		factor: 1,
-		offset: 0
-	},
-	ppb: {
-		dimension: "concentration-volume",
-		factor: .001,
-		offset: 0
-	},
-	"µg/m³": {
-		dimension: "concentration-mass",
-		factor: 1,
-		offset: 0
-	},
-	"mg/m³": {
-		dimension: "concentration-mass",
-		factor: 1e3,
-		offset: 0
-	},
-	kg: {
-		dimension: "mass",
-		factor: 1,
-		offset: 0
-	},
-	g: {
-		dimension: "mass",
-		factor: .001,
-		offset: 0
-	},
-	lb: {
-		dimension: "mass",
-		factor: .453592,
-		offset: 0
-	},
-	oz: {
-		dimension: "mass",
-		factor: .0283495,
-		offset: 0
-	},
-	"%": {
-		dimension: "percentage",
-		factor: 1,
-		offset: 0
-	},
-	L: {
-		dimension: "volume",
-		factor: 1,
-		offset: 0
-	},
-	mL: {
-		dimension: "volume",
-		factor: .001,
-		offset: 0
-	},
-	gal: {
-		dimension: "volume",
-		factor: 3.785411784,
-		offset: 0
-	},
-	s: {
-		dimension: "duration",
-		factor: 1,
-		offset: 0
-	},
-	ms: {
-		dimension: "duration",
-		factor: .001,
-		offset: 0
-	},
-	min: {
-		dimension: "duration",
-		factor: 60,
-		offset: 0
-	},
-	h: {
-		dimension: "duration",
-		factor: 3600,
-		offset: 0
-	},
-	d: {
-		dimension: "duration",
-		factor: 86400,
-		offset: 0
-	},
-	B: {
-		dimension: "information",
-		factor: 1,
-		offset: 0
-	},
-	KiB: {
-		dimension: "information",
-		factor: 1024,
-		offset: 0
-	},
-	MiB: {
-		dimension: "information",
-		factor: 1024 ** 2,
-		offset: 0
-	},
-	GiB: {
-		dimension: "information",
-		factor: 1024 ** 3,
-		offset: 0
-	},
-	TiB: {
-		dimension: "information",
-		factor: 1024 ** 4,
-		offset: 0
-	},
-	kB: {
-		dimension: "information",
-		factor: 1e3,
-		offset: 0
-	},
-	MB: {
-		dimension: "information",
-		factor: 1e6,
-		offset: 0
-	},
-	GB: {
-		dimension: "information",
-		factor: 1e9,
-		offset: 0
-	},
-	"°": {
-		dimension: "angle",
-		factor: 1,
-		offset: 0
-	},
-	dBFS: {
-		dimension: "sound-level",
-		factor: 1,
-		offset: 0
-	},
-	dBm: {
-		dimension: "signal-level",
-		factor: 1,
-		offset: 0
-	},
-	mired: {
-		dimension: "colour-temperature",
-		factor: 1,
-		offset: 0
-	},
-	kbps: {
-		dimension: "bitrate",
-		factor: 1,
-		offset: 0
-	},
-	Mbps: {
-		dimension: "bitrate",
-		factor: 1e3,
-		offset: 0
-	},
-	fps: {
-		dimension: "rate",
-		factor: 1,
-		offset: 0
-	}
+		"switch",
+		"toggle",
+		"acceso"
+	],
+	tractor: [
+		"trattore",
+		"tosaerba",
+		"giardino"
+	],
+	"train-front": ["treno"],
+	"tree-pine": [
+		"albero",
+		"pino",
+		"giardino"
+	],
+	trees: [
+		"giardino",
+		"alberi",
+		"esterno",
+		"parco",
+		"garden"
+	],
+	truck: [
+		"camion",
+		"furgone",
+		"consegna"
+	],
+	tv: ["televisore"],
+	umbrella: [
+		"tenda",
+		"markise",
+		"ombrellone",
+		"pergola",
+		"veranda",
+		"terrace"
+	],
+	user: ["persona", "utente"],
+	users: [
+		"persone",
+		"gruppo",
+		"famiglia"
+	],
+	utensils: [
+		"cucina",
+		"posate",
+		"sala",
+		"pranzo",
+		"kitchen"
+	],
+	vibrate: [
+		"vibrazione",
+		"urto",
+		"tamper"
+	],
+	video: [],
+	"video-off": ["video", "spento"],
+	"volume-2": [
+		"volume",
+		"audio",
+		"altoparlante",
+		"suono"
+	],
+	"volume-x": [
+		"muto",
+		"silenziato",
+		"volume",
+		"spento"
+	],
+	warehouse: [
+		"magazzino",
+		"capanno",
+		"deposito",
+		"cantina",
+		"warehouse"
+	],
+	"washing-machine": [
+		"lavatrice",
+		"lavastoviglie",
+		"asciugatrice"
+	],
+	waves: [
+		"onde",
+		"acqua",
+		"vibrazione"
+	],
+	"waves-ladder": [
+		"piscina",
+		"vasca",
+		"pool"
+	],
+	wifi: ["rete", "segnale"],
+	"wifi-off": [
+		"wifi",
+		"assente",
+		"offline",
+		"disconnesso"
+	],
+	wind: [
+		"vento",
+		"aria",
+		"gas",
+		"monossido",
+		"co"
+	],
+	workflow: [
+		"automazione",
+		"flusso",
+		"scenario"
+	],
+	wrench: [
+		"officina",
+		"manutenzione",
+		"attrezzi",
+		"utenze"
+	],
+	zap: [
+		"energia",
+		"corrente",
+		"consumo",
+		"watt",
+		"elettricita"
+	]
 };
-/** Resolve a unit's `UnitSpec`, or `undefined` when the spelling is unknown. */
-function specFor(unit) {
-	return Object.hasOwn(UNIT_TABLE, unit) ? UNIT_TABLE[unit] : void 0;
-}
-/** Value in `spec`'s unit → its dimension's canonical unit. */
-function toCanonical(value, spec) {
-	return value * spec.factor + spec.offset;
-}
-/** Canonical-unit value → the unit described by `spec`. */
-function fromCanonical(canonical, spec) {
-	return (canonical - spec.offset) / spec.factor;
-}
 /**
-* Graceful variant for the render path: returns the converted value, or
-* `undefined` when the conversion is refused (unknown unit / cross-dimension).
-* Never throws — a render caller falls back to the raw value + source unit.
+* Spellings an operator may already have PERSISTED that no lucide package
+* accepts any more, and the catalog key they draw. They resolve
+* (`canonicalIconKey`) but are never offered. `gauge2` was this repo's own
+* pre-catalog spelling of `gauge`.
 */
-function tryConvertUnit(value, from, to) {
-	if (from === to) return value;
-	const fromSpec = specFor(from);
-	if (!fromSpec) return void 0;
-	const toSpec = specFor(to);
-	if (!toSpec) return void 0;
-	if (fromSpec.dimension !== toSpec.dimension) return void 0;
-	return fromCanonical(toCanonical(value, fromSpec), toSpec);
+var LEGACY_ICON_ALIASES = { gauge2: "gauge" };
+/**
+* icon-catalog — THE icon vocabulary (D854).
+*
+* Every place that picks or stores an icon — a device's display override, a
+* location, a site zone, a viewer accessory, an `icon` settings field — names
+* it by a key of this catalog and nothing else. There is no curated subset and
+* no second list: the catalog is every lucide icon that both surfaces can draw
+* (the admin UI's `lucide-react` and the viewer's `lucide-react-native`), the
+* intersection computed by `scripts/generate-icon-catalog.ts` into the
+* committed `icon-catalog.generated.ts`.
+*
+* Like the vocabularies it replaces, this module holds STRINGS only — no React,
+* no lucide import, no glyph. Each surface owns its glyph table (the web one
+* lives in `ui-library`, loaded lazily), and a test on each side pins that it
+* covers {@link ICON_KEYS}.
+*
+* ## What is persisted
+*
+* The canonical kebab-case lucide id ({@link IconKey}). Spellings that a lucide
+* package still accepts (`home` for `house`) and this repo's own legacy ones
+* (`gauge2`) RESOLVE ({@link canonicalIconKey}) so a stored value never goes
+* stale, but they are never OFFERED by search.
+*
+* ## Search
+*
+* Over the key, the Italian/English overlay in `icon-synonyms.ts`, any words
+* the caller adds, and lucide's English tags — in that order of weight.
+*/
+var KEY_SET$2 = new Set(ICON_KEYS);
+new Map([...Object.entries(ICON_ALIASES), ...Object.entries(LEGACY_ICON_ALIASES)]);
+/** Is this a canonical key of the catalog? (An alias is not — see {@link canonicalIconKey}.) */
+function isIconKey(value) {
+	return typeof value === "string" && KEY_SET$2.has(value);
 }
 /**
+* Wire/storage schema for one icon key.
+*
+* Deliberately NOT a `z.enum` of the catalog: ~1,700 literals would be inlined
+* into every cap router, type and API-reference row that carries an icon. The
+* check is membership in the catalog and the type is {@link IconKey}.
+*/
+var IconKeySchema = custom(isIconKey, "Not an icon of the catalog");
+var ENTRIES = ICON_KEYS.map((key, index) => {
+	const [categoryIndexes, tags] = ICON_META[index] ?? [[], []];
+	const categories = categoryIndexes.flatMap((i) => {
+		const id = ICON_CATEGORY_IDS[i];
+		return id === void 0 ? [] : [id];
+	});
+	return {
+		key,
+		categories,
+		primaryCategory: categories[0] ?? ICON_CATEGORY_IDS[0],
+		tags,
+		synonyms: ICON_SYNONYMS[key] ?? []
+	};
+});
+new Map(ENTRIES.map((e) => [e.key, e]));
+/** Categories a picker offers first: the ones this product's icons mostly live in. */
+var LEADING_CATEGORIES = [
+	"devices",
+	"home",
+	"security",
+	"buildings",
+	"connectivity",
+	"multimedia",
+	"nature",
+	"weather",
+	"transportation",
+	"animals"
+];
+var PRIMARY_CATEGORIES = new Set(ENTRIES.map((e) => e.primaryCategory));
+[...LEADING_CATEGORIES, ...ICON_CATEGORY_IDS.filter((c) => !LEADING_CATEGORIES.includes(c))].filter((c) => PRIMARY_CATEGORIES.has(c));
+/**
+* One (location, icon) assignment as it travels.
+*
+* `locationKey` is ALWAYS {@link locationIconKey} of the label — never the
+* operator's casing. The registry matches labels trimmed + case-insensitively
+* everywhere (`addLocation`, `removeLocation`, `renameLocation`), and a
+* case-only rename (`kitchen` → `Kitchen`) is a real edit this repo supports; a
+* map keyed on the displayed casing would orphan its entry on exactly that
+* edit. Consumers join by keying their own label through `locationIconKey`.
+*/
+var LocationIconAssignmentSchema = object({
+	locationKey: string(),
+	icon: IconKeySchema
+});
+/**
+* One (location, description) assignment as it travels.
+*
+* Same key discipline as {@link LocationIconAssignmentSchema}, and for the same
+* reason: this lived for a while in the post-analysis addon's own settings,
+* keyed by a HAND-TYPED label matched exactly and case-sensitively. A rename in
+* the Locations page carried the icon and silently orphaned the description —
+* two authorities for one thing, joined by two different rules. Now both hang
+* off the location itself, on `locationIconKey`.
+*/
+var LocationDescriptionAssignmentSchema = object({
+	locationKey: string(),
+	description: string()
+});
+/**
+* WHO an action step acts on (D983) — one target shape for every place that
+* performs an action (automation steps, Action entries, notification
+* sequences, scheduler points):
+*
+*  - `devices` — device ids the operator picked, frozen at save time;
+*  - `domain`  — every device that offers the step's VOCABULARY action,
+*    optionally narrowed to one device type and one room, resolved WHEN THE
+*    STEP RUNS (a device added later is included). The action always comes
+*    from the vocabulary (`cover.open`), never from a raw cap name, so a
+*    `domain` target needs an `actionId` (enforced on the step schema);
+*  - `var`     — a `$var` resolved from the run's scope.
+*
+* {@link ActionTargetResolver} turns a target into device ids. It is pure
+* (a {@link DeviceDirectory} is handed in) so the hub's core-blocks service and
+* a generated automation block share it.
+*
+* A room is the device's `location` label (`DeviceInfo.location`); two labels
+* name the same room when `locationIconKey` agrees (trimmed, lower-cased).
+*/
+var ActionTargetSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("devices"),
+		ids: array(number().int()).min(1)
+	}),
+	object({
+		kind: literal("domain"),
+		/** Narrow to one kind of device. */
+		deviceType: _enum(DeviceType).optional(),
+		/** Narrow to one room: the `location` label devices carry. */
+		roomId: string().min(1).optional()
+	}),
+	object({
+		kind: literal("var"),
+		name: string().min(1)
+	})
+]);
+EventCategory.DeviceRegistered, EventCategory.DeviceUnregistered, EventCategory.DeviceUpdated, EventCategory.DeviceMetaChanged, EventCategory.DeviceBindingsChanged;
+var ExpressionBindingSourceSchema = union([
+	object({
+		kind: literal("field").optional(),
+		sourceKey: string(),
+		cap: string(),
+		fieldPath: string()
+	}),
+	object({
+		kind: literal("literal"),
+		value: union([
+			string(),
+			number(),
+			boolean(),
+			_null()
+		])
+	}),
+	object({
+		kind: literal("global"),
+		sourceStableId: string(),
+		addonId: string().optional(),
+		cap: string(),
+		fieldPath: string()
+	})
+]);
+object({
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+/**
+* Identity envelope for a device's upstream-system metadata.
+*
+* Two jobs:
+*
+*   1. **Dispatch key.** `id` is the natural identifier the SOURCE system
+*      uses to address this device (HA `entity_id`, Reolink MAC, ONVIF
+*      WS-Discovery endpoint UUID, …). Provider code keeps a
+*      `Map<sourceInfo.id, IDevice>` to route inbound push events in O(1)
+*      without round-tripping through `stableId` / `id` mappings.
+*
+*   2. **Stability bridge.** `uniqueId` is the *immutable* upstream id when
+*      one exists (HA `entity.unique_id`, Reolink MAC again — same as `id`
+*      for vendors where MAC is the natural key). For systems where the
+*      live dispatch key can be renamed (HA `entity_id` can be edited),
+*      providers detect renames by matching `uniqueId` and patch `id`
+*      in-place so dispatch keeps working.
+*
+* **Display unit and precision are NOT stored here.** They are a read-time
+* preference (D944). A polymorphic reading stores its `quantity` here once,
+* at adopt, and a date/time value stores `dateTimeShape` the same way —
+* neither is repeated on each sample. The `device_class` tag is an
+* HA-specific input consumed at the discovery boundary (`ha-domain-mapping`)
+* to derive the CamStack `DeviceRole`; it is never stored after that point.
+*
+* The `raw` escape hatch carries provider-specific attributes that don't
+* fit the structured slots (HA `attributes` whitelist, Reolink `deviceCache`
+* details, …). Providers control what lands here.
+*/
+var SourceInfoSchema = object({
+	/** Live dispatch key — mutable when the source system allows rename. */
+	id: string(),
+	/** Source system tag — e.g. 'homeassistant' | 'reolink' | 'onvif'. */
+	system: string(),
+	/** Immutable upstream identifier when available (HA `unique_id`, … ).
+	*  Used to detect rename when `id` changes. */
+	uniqueId: string().optional(),
+	/** Quantity of a polymorphic reading, written once at adopt (D944). */
+	quantity: ReadingQuantitySchema.optional(),
+	/** Date / time / datetime shape of a string reading, written once at adopt. */
+	dateTimeShape: _enum([
+		"date",
+		"time",
+		"datetime"
+	]).optional(),
+	/** Provider-specific extras that don't fit the structured slots.
+	*  Whitelist what goes here per provider — do NOT dump entire HA
+	*  attribute blobs (would explode the meta JSON column). */
+	raw: record(string(), unknown()).optional()
+});
+/**
 * A number a person types for a physical quantity — the input side of the
 * value + unit contract (D972).
 *
@@ -44955,15 +45075,28 @@ var SettingsSchemaWithValuesSchema = object({
 });
 /** Patch object — keys are field names, values are the new field values. */
 var SettingsPatchSchema = record(string(), unknown());
+/** The scope of a scoped-settings call (D986): where the capability declared the values. */
+var ScopedSettingsScopeSchema = _enum(SCOPED_SETTINGS_SCOPES);
+/** One scoped schema an addon serves: its capability, scope and section ids. */
+var ScopedSettingsDeclarationSchema = object({
+	cap: string(),
+	scope: ScopedSettingsScopeSchema,
+	sectionIds: array(string())
+});
 /** Standard success response for update operations. */
 var SettingsUpdateResultSchema = object({ success: literal(true) });
 method(object({
 	addonId: string(),
-	nodeId: string().optional(),
-	overlay: record(string(), unknown()).optional(),
-	cap: string().optional()
+	cap: string(),
+	scope: ScopedSettingsScopeSchema,
+	nodeId: string().optional()
 }), SettingsSchemaWithValuesSchema.nullable()), method(object({
 	addonId: string(),
+	nodeId: string().optional()
+}), array(ScopedSettingsDeclarationSchema).nullable()), method(object({
+	addonId: string(),
+	cap: string(),
+	scope: ScopedSettingsScopeSchema,
 	nodeId: string().optional(),
 	patch: SettingsPatchSchema
 }), SettingsUpdateResultSchema, {
@@ -44971,8 +45104,10 @@ method(object({
 	auth: "admin"
 }), method(object({
 	addonId: string(),
+	cap: string(),
+	scope: ScopedSettingsScopeSchema,
 	nodeId: string().optional()
-}), SettingsSchemaWithValuesSchema.nullable()), method(object({
+}), record(string(), unknown()).nullable()), method(object({
 	addonId: string(),
 	nodeId: string().optional(),
 	instance: IntegrationInstanceRefSchema
@@ -46312,7 +46447,7 @@ var BackupDestinationInfoSchema = object({
 	id: string(),
 	/**
 	* Manifest id of the owning addon. The Settings button on the
-	* destination card opens that addon's `globalSettingsSchema` panel.
+	* destination card opens that addon's scoped settings panel.
 	*/
 	addonId: string(),
 	/** Operator-toggled enable flag from the destination-policy table. */
@@ -48921,7 +49056,7 @@ DeviceType.MediaPlayer, method(deviceOnly, _void(), {
 	kind: "mutation",
 	auth: "protected"
 });
-DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.EventEmitter, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.PetFountain, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Heater, DeviceType.Dryer, DeviceType.Gateway, DeviceType.Camera, DeviceType.Fan, DeviceType.Lock, DeviceType.Camera, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Gateway, DeviceType.Hub, DeviceType.Camera, DeviceType.Sensor, DeviceType.MediaPlayer, DeviceType.Vacuum, DeviceType.Generic, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.PetFountain, DeviceType.Fan, DeviceType.Humidifier, DeviceType.Climate, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder, DeviceType.Heater;
+DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.EventEmitter, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.PetFountain, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Heater, DeviceType.Dryer, DeviceType.Gateway, DeviceType.Camera, DeviceType.Fan, DeviceType.Lock, DeviceType.Camera, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Gateway, DeviceType.Hub, DeviceType.Camera, DeviceType.Sensor, DeviceType.MediaPlayer, DeviceType.Vacuum, DeviceType.Generic, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.PetFountain, DeviceType.Fan, DeviceType.Humidifier, DeviceType.Climate, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.MediaPlayer;
 var NUMBER = {
 	kind: "fixed",
 	result: ["number"]
@@ -50792,6 +50927,7 @@ method(InstancePinSchema, DeviceExportStatusSchema), method(_void(), array(Expor
 	kind: "mutation",
 	auth: "admin"
 });
+var DeviceAliasSchema = string().max(64).regex(/^[a-z][a-z0-9_]*$/);
 /**
 * A SITE ZONE — a named part of the property that several locations belong to.
 *
@@ -51185,6 +51321,12 @@ var DeviceInfoSchema = object({
 	addonId: string(),
 	type: _enum(DeviceType),
 	name: string(),
+	/** The name a value template uses for this device (`{{ stufa_veranda.temperature }}`),
+	*  entity_id style. Generated once from the name at first registration, unique
+	*  cluster-wide, editable through `setAlias`, NOT changed by a rename (D1021).
+	*  Optional: a record produced by an older build omits it until the boot
+	*  backfill has run. */
+	alias: DeviceAliasSchema.optional(),
 	/** Operator-organisational location label. `null` when unset. */
 	location: string().nullable(),
 	/** Soft-disabled flag. */
@@ -51504,6 +51646,25 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	alias: string()
+}), discriminatedUnion("ok", [object({
+	ok: literal(true),
+	alias: DeviceAliasSchema
+}), object({
+	ok: literal(false),
+	reason: _enum([
+		"empty",
+		"too-long",
+		"grammar",
+		"reserved",
+		"taken"
+	]),
+	takenBy: number().optional()
+})]), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	location: string().nullable()
@@ -54625,10 +54786,11 @@ var IntegrationInstanceDescriptionSchema = object({
 	/** True when `testInstance` really probes the remote. */
 	canTest: boolean(),
 	/**
-	* The kinds an instance can be of. Absent or one entry: nothing to choose; more than one: the
-	* Add flow asks which first and sends it as `createInstance.kind`.
+	* The kinds an instance can be of (D1013 rule 1), each naming its `functionCap`. One entry:
+	* nothing to choose; more than one: the Add flow asks which first and sends it as
+	* `createInstance.kind`. Never empty: every instance belongs to exactly one kind.
 	*/
-	kinds: array(IntegrationInstanceKindSchema).optional(),
+	kinds: array(IntegrationInstanceKindSchema).min(1),
 	/**
 	* The provider accepts `createInstance.id` for an id that once existed (an adopted id, because
 	* devices carry it). The UI then offers "restore under its old id" on Add. Absent means no.
@@ -54664,8 +54826,8 @@ var IntegrationInstanceSchema = object({
 	* the body is the one store, `setInstanceEnabled` the one writer (epic #440, step 3).
 	*/
 	enabled: boolean().optional(),
-	/** The kind of this instance (one of `describe().kinds[].id`), when the provider has kinds. */
-	kind: string().optional(),
+	/** The kind of this instance: exactly one of `describe().kinds[].id` (D1013 rule 2). */
+	kind: string().min(1),
 	/** Values for the instance form; a secret is a `SecretFieldView`, never text. */
 	formValues: record(string(), unknown()),
 	status: IntegrationInstanceStatusSchema.optional(),
@@ -64235,6 +64397,11 @@ var NcScheduleSchema = object({
 * as a STATE SUMMARY at the end of each window of `schedule`.
 */
 var NcSystemEventDeliveryModeSchema = _enum(["instant", "summary"]);
+_enum([
+	"activation",
+	"deactivation",
+	"schedule"
+]);
 /**
 * How a summary window is SENT (D698): `rule` (absent) = ONE notification with
 * every section; `section` = one notification per section with something to
@@ -64251,11 +64418,26 @@ var NcStateSummarySplitSchema = _enum(["rule", "section"]);
 * midnight crossing); the send time is each window's END. Refused on the
 * `alarm` family, which stays instant (`systemEventDeliveryProblems`).
 */
-var NcSystemEventDeliverySchema = discriminatedUnion("mode", [object({ mode: literal("instant") }), object({
-	mode: literal("summary"),
-	schedule: NcScheduleSchema,
-	split: NcStateSummarySplitSchema.optional()
-})]);
+var NcSystemEventDeliverySchema = discriminatedUnion("mode", [
+	object({ mode: literal("instant") }),
+	object({
+		mode: literal("summary"),
+		schedule: NcScheduleSchema,
+		split: NcStateSummarySplitSchema.optional()
+	}),
+	object({
+		mode: literal("modes"),
+		/** The bad edge, and every kind that has a single edge. */
+		onActivation: boolean(),
+		/** The recovery edges of the classes of the selected kinds (derived, never stored per kind). */
+		onDeactivation: boolean(),
+		/** A state summary at the end of each window; absent = no summary. */
+		onSchedule: object({
+			schedule: NcScheduleSchema,
+			grouping: NcStateSummarySplitSchema
+		}).optional()
+	})
+]);
 /** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
 var NcPlateMatcherSchema = object({
 	/**
@@ -71582,6 +71764,7 @@ var RemoteLayoutComponentSchema = object({
 	});
 });
 method(object({}), array(RemoteLayoutComponentSchema), { auth: "protected" });
+DeviceType.MediaPlayer;
 var RunningStateSourceSchema = _enum(["native", "assigned"]);
 object({
 	/** null = unknown — never coerced to false (D393). */
@@ -74009,7 +74192,7 @@ var TerminalInstanceInfoSchema = object({
 	/**
 	* False while the node the instance is bound to is not in the cluster
 	* topology (forgotten, renamed, re-paired). The instance is kept; the
-	* operator re-points it with `updateInstance({ targetNodeId })`.
+	* operator re-points it on the Terminal page.
 	*/
 	nodeInCluster: boolean(),
 	profileId: string(),
@@ -74047,41 +74230,7 @@ var TerminalOutputBatchSchema = object({
 	snapshot: string().optional(),
 	events: array(TerminalOutputEventSchema).readonly()
 });
-method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }), method(_void(), array(TerminalInstanceInfoSchema).readonly(), { auth: "admin" }), method(object({
-	targetNodeId: string().min(1),
-	profileId: string().min(1),
-	name: string().trim().min(1).max(160).optional(),
-	executable: string().max(1024).optional(),
-	args: array(string().max(2048)).max(64).optional(),
-	cwd: string().max(1024).optional(),
-	environment: array(string().max(4096)).max(64).optional(),
-	profileSettings: ProfileSettingsBagSchema.optional()
-}), TerminalInstanceInfoSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	instanceId: string().min(1),
-	/** Re-point the instance to another node; the profile must exist there. */
-	targetNodeId: string().min(1).max(256).optional(),
-	name: string().trim().min(1).max(160).optional(),
-	executable: string().max(1024).optional(),
-	args: array(string().max(2048)).max(64).optional(),
-	cwd: string().max(1024).optional(),
-	environment: array(string().max(4096)).max(64).optional(),
-	profileSettings: ProfileSettingsBagSchema.optional()
-}), TerminalInstanceInfoSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ instanceId: string().min(1) }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	instanceId: string().min(1),
-	enabled: boolean()
-}), TerminalInstanceInfoSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(TerminalLegacyCameraSchema).readonly(), { auth: "admin" }), method(object({
+method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }), method(_void(), array(TerminalLegacyCameraSchema).readonly(), { auth: "admin" }), method(object({
 	stableId: string().min(1),
 	name: string().trim().min(1).max(160).optional()
 }), TerminalInstanceInfoSchema, {
@@ -74150,6 +74299,11 @@ var TimedRunUnitSchema = _enum(["s", "min"]);
 _enum(["switch", "pet-fountain"]);
 DeviceType.Heater, DeviceType.PetFountain;
 DeviceType.Heater, DeviceType.PetFountain;
+/** One duration, as the one-tap run asks for it. */
+var TimedRunQuickRunSchema = object({
+	duration: number().positive().finite(),
+	unit: TimedRunUnitSchema
+});
 /** Why a request was not carried out. Typed, so a caller can say it in words. */
 var TimedRunRefusalSchema = _enum([
 	"unsupported-device",
@@ -74170,9 +74324,30 @@ object({
 	activeUntil: number().nullable(),
 	/** Who asked for the run (a user id or an addon id); `null` when nothing is armed or it did not say. */
 	requestedBy: string().nullable(),
+	/**
+	* The one-tap run of THIS device: what a "Run" button on any surface starts. `null` when
+	* the device is gone or its type has no timed run; a status from before this field
+	* existed has none, and a surface falls back to the type's default.
+	*/
+	quickRun: TimedRunQuickRunSchema.nullable(),
 	lastFetchedAt: number()
 });
-method(object({
+/** What the settings form needs: the unit, the bounds and the type's default. */
+var TimedRunOptionsSchema = object({
+	unit: TimedRunUnitSchema,
+	/** The longest run, in `unit`. */
+	maxDuration: number(),
+	defaultDuration: number()
+});
+/** The one-tap run duration, in the type's unit; `null` returns to the type's default. */
+var TimedRunSettingsPatchSchema = object({ quickRunDuration: number().positive().finite().nullable().optional() });
+method(object({ deviceId: number().int() }), TimedRunOptionsSchema), method(object({
+	deviceId: number().int(),
+	settings: TimedRunSettingsPatchSchema
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	deviceId: number().int(),
 	duration: number().positive().finite(),
 	unit: TimedRunUnitSchema
@@ -76878,21 +77053,28 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"addonSettings.getGlobalSettings": {
+	"addonSettings.getIntegrationFormSchema": {
 		capName: "addon-settings",
 		capScope: "system",
 		addonId: null,
 		access: "view",
 		role: "admin"
 	},
-	"addonSettings.getIntegrationFormSchema": {
+	"addonSettings.getScopedSettings": {
+		capName: "addon-settings",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"addonSettings.listScopedSettings": {
 		capName: "addon-settings",
 		capScope: "system",
 		addonId: null,
 		access: "view",
 		role: "admin"
 	},
-	"addonSettings.getIntegrationSettings": {
+	"addonSettings.readScopedValues": {
 		capName: "addon-settings",
 		capScope: "system",
 		addonId: null,
@@ -76913,7 +77095,7 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"addonSettings.updateGlobalSettings": {
+	"addonSettings.updateScopedSettings": {
 		capName: "addon-settings",
 		capScope: "system",
 		addonId: null,
@@ -79083,6 +79265,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"deviceManager.setAlias": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"deviceManager.setChildLayout": {
 		capName: "device-manager",
 		capScope: "system",
@@ -85810,27 +85999,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"terminalSession.createInstance": {
-		capName: "terminal-session",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"terminalSession.deleteInstance": {
-		capName: "terminal-session",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
-	"terminalSession.listInstances": {
-		capName: "terminal-session",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"terminalSession.listLegacyCameras": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -85873,20 +86041,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"terminalSession.setInstanceEnabled": {
-		capName: "terminal-session",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"terminalSession.updateInstance": {
-		capName: "terminal-session",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -85901,6 +86055,13 @@ Object.freeze({
 		access: "create",
 		role: "viewer"
 	},
+	"timedRun.getOptions": {
+		capName: "timed-run",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
 	"timedRun.getStatus": {
 		capName: "timed-run",
 		capScope: "device",
@@ -85915,6 +86076,13 @@ Object.freeze({
 		access: "create",
 		role: "viewer"
 	},
+	"timedRun.setSettings": {
+		capName: "timed-run",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"toast.onToast": {
 		capName: "toast",
 		capScope: "system",
@@ -86845,6 +87013,7 @@ function offered(received) {
 	};
 }
 offered(HA_AS), withheld(HOMEKIT_REASON), withheld(ALEXA_REASON), withheld(GOOGLE_REASON), withheld(MATTER_REASON);
+string().min(1).max(4096);
 Object.freeze({
 	"accessories.getStatus": [{
 		name: "deviceId",
@@ -87528,6 +87697,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.setAlias": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceManager.setChildLayout": [{
 		name: "deviceId",
 		form: "single",
@@ -89592,6 +89766,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"timedRun.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"timedRun.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -89602,6 +89781,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"timedRun.setSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"update.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -90464,6 +90648,7 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
+	[...RULE_TEXT],
 	[...RULE_BODY_ONLY],
 	[...RULE_TEXT],
 	([...RULE_TEXT], [...DEVICE_EVENTS]),
@@ -92081,7 +92266,13 @@ function buildGoogleCalendarInstances(records, deps) {
 			role: "services",
 			instanceMode: "multiple",
 			kind: GOOGLE_CALENDAR_INSTANCE_KIND,
-			canTest: false
+			canTest: false,
+			kinds: [{
+				id: GOOGLE_CALENDAR_INSTANCE_KIND,
+				label: "Google calendar",
+				functionCap: "calendar-source",
+				role: "services"
+			}]
 		},
 		labels: { accountId: {
 			label: "Google account",
@@ -92314,7 +92505,8 @@ function buildGoogleInstances(records, deps) {
 			instanceMode: "multiple",
 			kind: "account",
 			canTest: true,
-			allowRestoreId: true
+			allowRestoreId: true,
+			kinds: [googleAccountKind(deps)]
 		},
 		formSchema: () => buildGoogleBrokerSettingsSchema(deps.publicOrigin()),
 		initialBody: (name) => ({