@camstack/addon-google-services 0.2.45 → 0.2.46

package/CHANGELOG.md

@@ -7,11 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.46] - 2026-11-09
+
+### Changed
+
+- Gmail send provider drops the unused verify call
+
 ## [0.2.45] - 2026-11-09
 
 ### Fixed
 
 - Each imported calendar names the record that owns it, so its switch is found on the Calendars page
+### Changed
+
 
 ## [0.2.44] - 2026-11-08
 

package/dist/google-services.addon.js

@@ -6016,7 +6016,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-CS5Xp1iQ.mjs
+//#region ../types/dist/sleep-CkinsFFb.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8695,16 +8695,6 @@ var BaseAddon = class {
 		return null;
 	}
 	/**
-	* The form schema of ONE integration instance, or `null` to use the scoped form.
-	*
-	* Override it only when an `instanceMode: multiple` addon's instances differ: an NVR integration
-	* needs its connection fields, the default integration the addon's own sections. It is the
-	* SHAPE of the form only — the values live on the instance record.
-	*/
-	async integrationFormSchema(_instance) {
-		return null;
-	}
-	/**
 	* D986 scoped settings: the form shape of the CLUSTER-wide settings one capability this addon
 	* provides owns, or `null` when it has none. `cap` is a capability name the addon's manifest
 	* declares. Stored as `addon-settings` rows `<addonId>.<field>`. The keys of this schema, of
@@ -8732,8 +8722,7 @@ var BaseAddon = class {
 	}
 	/**
 	* The host's read of the scoped declarations: the schema one capability declares for `scope`,
-	* or `null`. Beside {@link getIntegrationFormSchema}, the same shape: the hook is protected, the
-	* host asks this method.
+	* or `null`. The hook is protected, the host asks this method.
 	*/
 	async getScopedSettingsSchema(scope, cap) {
 		switch (scope) {
@@ -8901,22 +8890,6 @@ var BaseAddon = class {
 		return Object.fromEntries([...collectHydratedFieldValues(form)].filter(([, value]) => value !== void 0));
 	}
 	/**
-	* What the create wizard and the integration edit page render for one instance: the addon's
-	* per-instance schema when it declares one, else its global schema (what they always showed).
-	*/
-	async getIntegrationFormSchema(instance, nodeId) {
-		const scoped = await this.integrationFormSchema(instance);
-		if (scoped === null) return this.scopedForm(nodeId);
-		return hydrateSchema(scoped, {}, { inlineSecretsAsViews: true });
-	}
-	/** The form of the scoped schemas this addon declared, hydrated from its store. */
-	async scopedForm(nodeId) {
-		await this.loadScopedSchemas();
-		const schema = this.scopedFormSchema();
-		if (!schema) return { sections: [] };
-		return hydrateSchema(schema, await this.readRawProjectedStore(nodeId), { inlineSecretsAsViews: true });
-	}
-	/**
 	* The raw addon store PROJECTED onto the target node's bare per-node keys:
 	* every `perNode: true` field carries THAT node's scoped value on its bare
 	* key (absent scoped key ⇒ key absent, so the schema `default` wins — no
@@ -9103,12 +9076,6 @@ var BaseAddon = class {
 		this._nodeKeysByCap = /* @__PURE__ */ new Map();
 		this._addonSecretTree = null;
 	}
-	/** The form of an addon's scoped schemas: their sections, each shown once. */
-	scopedFormSchema(cap) {
-		const byId = /* @__PURE__ */ new Map();
-		for (const entry of this.loadedScopedSchemas(cap)) for (const section of entry.schema.sections) if (!byId.has(section.id)) byId.set(section.id, section);
-		return byId.size === 0 ? null : { sections: [...byId.values()] };
-	}
 	/** Every loaded scoped schema of `cap`, or of every loaded capability. */
 	loadedScopedSchemas(cap) {
 		if (cap !== void 0) return this._scopedByCap.get(cap) ?? [];
@@ -9698,6 +9665,24 @@ function normalizeAddonInitResult(result) {
 	if (Array.isArray(result)) return { providers: result };
 	return result;
 }
+object({
+	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
+	params: record(string(), union([string(), number$1()])).optional()
+});
+var CamstackError = class extends Error {
+	i18nCode;
+	i18nParams;
+	constructor(code, params, englishMessage) {
+		super(englishMessage);
+		this.name = "CamstackError";
+		this.i18nCode = code;
+		this.i18nParams = params;
+	}
+};
+/** `throw userError('device.not-found', { id }, 'Device 12 not found')` */
+function userError(code, params, englishFallback) {
+	return new CamstackError(code, params, englishFallback);
+}
 object({
 	field: string().min(1),
 	on: literal("advance")
@@ -9774,12 +9759,6 @@ function systemMethod(input, output, options) {
 		systemOnly: true
 	};
 }
-/**
-* A method a SOURCE of a collection cap may legitimately not serve — OPTIONAL
-* on `InferProvider`. The `providerOptional: true` literal is what
-* `InferProvider` keys on; see {@link CapabilityMethodSchema.providerOptional}
-* for when this is the honest answer and when it is a soft stub.
-*/
 function optionalMethod(input, output, options) {
 	return {
 		...method(input, output, options),
@@ -17174,24 +17153,6 @@ Object.freeze({
 		"uploadDataset": 72e5
 	}
 });
-object({
-	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
-	params: record(string(), union([string(), number$1()])).optional()
-});
-var CamstackError = class extends Error {
-	i18nCode;
-	i18nParams;
-	constructor(code, params, englishMessage) {
-		super(englishMessage);
-		this.name = "CamstackError";
-		this.i18nCode = code;
-		this.i18nParams = params;
-	}
-};
-/** `throw userError('device.not-found', { id }, 'Device 12 not found')` */
-function userError(code, params, englishFallback) {
-	return new CamstackError(code, params, englishFallback);
-}
 //#endregion
 //#region ../types/dist/composition-CXCX78IR.mjs
 /**
@@ -18903,25 +18864,6 @@ var RequiredAddonUpdateSchema = object({
 	installed: string().nullable()
 });
 /**
-* Which integration instance a settings form is for. An addon that serves several instances
-* (`instanceMode: multiple`) can show a different form per instance — an NVR integration
-* needs its connection, the default integration needs the addon's own sections.
-*
-* - `integrationId` is `null` in the create wizard: nothing exists yet, the operator is
-*   setting up a NEW instance.
-* - `mode` is the wizard mode of the integration type (`getAvailableTypes`).
-* - `candidateStableId` is the discovery candidate a wizard was seeded from, if any.
-*/
-var IntegrationInstanceRefSchema = object({
-	integrationId: string().nullable(),
-	mode: _enum([
-		"standalone",
-		"account",
-		"broker"
-	]),
-	candidateStableId: string().optional()
-});
-/**
 * Build an `IAddonRouteProvider` from a list of routes. Implements
 * both the operator-facing `getRoutes` (returning route descriptors
 * minus the handlers, which can't cross JSON) and the framework-
@@ -19098,8 +19040,8 @@ function composeInstanceKinds(parts, base) {
 		instanceFormSchema: async ({ id, kind }) => {
 			return (id === null ? byKind(kind) : await holderOf(id)).provider.instanceFormSchema({ id });
 		},
-		listInstances: async () => {
-			return (await Promise.all(parts.map(async (part) => (await part.provider.listInstances()).map((instance) => tagged(part, instance))))).flat();
+		listInstances: async (input) => {
+			return (await Promise.all(parts.map(async (part) => (await part.provider.listInstances(input)).map((instance) => tagged(part, instance))))).flat();
 		},
 		getInstance: async ({ id }) => {
 			for (const part of parts) {
@@ -45244,10 +45186,6 @@ method(object({
 	scope: ScopedSettingsScopeSchema,
 	nodeId: string().optional()
 }), record(string(), unknown()).nullable()), method(object({
-	addonId: string(),
-	nodeId: string().optional(),
-	instance: IntegrationInstanceRefSchema
-}), SettingsSchemaWithValuesSchema.nullable()), method(object({
 	addonId: string(),
 	nodeId: string().optional()
 }), object({ keys: array(string()) }).nullable(), { auth: "admin" }), method(object({
@@ -55652,6 +55590,12 @@ var IntegrationWithStateSchema = object({
 	name: string(),
 	/** A projection of the instance body's switch (`setInstanceEnabled` is the only writer). */
 	enabled: boolean(),
+	/**
+	* True when the addon that holds the switch did not answer (down, failed, or keeps no record for
+	* this row): `enabled` is then the stored registry flag, a stale value, not the state. A reader
+	* must not draw it as on or off (D315).
+	*/
+	switchUnknown: literal(true).optional(),
 	info: record(string(), unknown()).readonly(),
 	/** The discovery candidate this integration was set up from (D984). */
 	originStableId: string().optional(),
@@ -55665,6 +55609,12 @@ var IntegrationLiteSchema = object({
 	name: string(),
 	/** A projection of the instance body's switch (`setInstanceEnabled` is the only writer). */
 	enabled: boolean(),
+	/**
+	* True when the addon that holds the switch did not answer (down, failed, or keeps no record for
+	* this row): `enabled` is then the stored registry flag, a stale value, not the state. A reader
+	* must not draw it as on or off (D315).
+	*/
+	switchUnknown: literal(true).optional(),
 	info: record(string(), unknown()).readonly(),
 	/** The discovery candidate this integration was set up from (D984). */
 	originStableId: string().optional(),
@@ -55763,9 +55713,9 @@ var UpdateIntegrationInputSchema = object({
 	id: string(),
 	name: string().optional(),
 	/**
-	* Accepted for a FIXED builtin only (`info.fixed`: alarm panel, camera grid, core blocks,
-	* terminal), which keeps no instance record: the registry flag is its one store. Any other
-	* integration is switched through `integration-instances.setInstanceEnabled`.
+	* Honoured ONLY for a fixed builtin (`info.fixed`), whose switch is the hub's own registry flag
+	* and works while its addon is down. Any other row is refused (a typed `BAD_REQUEST`): its
+	* switch is `integration-instances.setInstanceEnabled`.
 	*/
 	enabled: boolean().optional(),
 	info: record(string(), unknown()).optional()
@@ -55799,6 +55749,12 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 * the form as a `SecretFieldView`, never text (D789). A patch value omitted, `''`
 * or the redaction token KEEPS the stored secret; `{ $secretClear: true }`
 * clears it.
+*
+* Who may call (epic #440): every method but `describe` and `instanceFormSchema` is open to any
+* session (`caller: 'scoped'`) and default-denies. An admin passes everywhere. A non-admin passes
+* only on a call pinned to one addon whose `describe().userScoped` is true, and that provider
+* filters every row on the `caller` the router injected (a notification target is somebody's
+* phone: a user sees and changes only their own). An addon that says nothing keeps the admin door.
 */
 var ConfigSchemaPassthrough$2 = custom();
 var IntegrationInstanceIdSchema = string().min(1);
@@ -55912,7 +55868,15 @@ var IntegrationInstanceDescriptionSchema = object({
 	*/
 	mintsId: boolean().optional(),
 	/** The links to other instances the provider's kinds declare; absent means none. */
-	links: array(IntegrationInstanceLinkSchema).optional()
+	links: array(IntegrationInstanceLinkSchema).optional(),
+	/**
+	* The rows belong to individual users (a notification target is somebody's phone). The router
+	* then opens `listInstances`, `getInstance`, `createInstance`, `updateInstance`,
+	* `setInstanceEnabled`, `deleteInstance` and `testInstance` to a NON-admin session on a call
+	* pinned to this addon, and hands the provider the `caller` so it keeps a user to their own rows.
+	* Absent means admin only, as it always was.
+	*/
+	userScoped: boolean().optional()
 });
 var IntegrationInstanceStatusSchema = object({
 	state: _enum([
@@ -55970,8 +55934,14 @@ var integrationInstancesCapability = {
 			/** The discovery candidate the wizard was seeded from (`stableId`), if any. */
 			candidateStableId: string().min(1).optional()
 		}), ConfigSchemaPassthrough$2, { auth: "admin" }),
-		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
-		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
+		listInstances: method(looseObject({}), array(IntegrationInstanceSchema).readonly(), {
+			auth: "protected",
+			caller: "scoped"
+		}),
+		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), {
+			auth: "protected",
+			caller: "scoped"
+		}),
 		/**
 		* Insert the typed record. With `id` it is stored under that id (a duplicate id is refused);
 		* without one the PROVIDER mints it and answers it. `kind` picks one of `describe().kinds`.
@@ -56004,11 +55974,13 @@ var integrationInstancesCapability = {
 			seed: object({ info: record(string(), unknown()) }).optional()
 		}), object({ id: string() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		}),
 		updateInstance: method(IntegrationInstancePatchSchema, object({ ok: literal(true) }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		}),
 		/**
 		* Switch ONE instance on or off, for every role; a missing record is created from the addon's
@@ -56020,7 +55992,8 @@ var integrationInstancesCapability = {
 			enabled: boolean()
 		}), object({ ok: literal(true) }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		}),
 		/**
 		* Delete the record and its keychain refs together. For an instance that brings devices the hub
@@ -56029,7 +56002,8 @@ var integrationInstancesCapability = {
 		*/
 		deleteInstance: method(object({ id: IntegrationInstanceIdSchema }), object({ ok: literal(true) }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		}),
 		testInstance: optionalMethod(object({
 			id: IntegrationInstanceIdSchema.nullable(),
@@ -56038,7 +56012,8 @@ var integrationInstancesCapability = {
 			kind: string().min(1).optional()
 		}), TestConnectionResultSchema, {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		})
 	}
 };
@@ -73888,6 +73863,11 @@ var SendEmailResultSchema = object({
 var SmtpStatusSchema = object({
 	/** True iff the addon has successfully verified the relay. */
 	ready: boolean(),
+	/**
+	* The tri-state behind `ready` (D315): true when the last send worked, false when it failed,
+	* ABSENT when the relay has not sent yet (unknown, never "not verified").
+	*/
+	verified: boolean().optional(),
 	/** Operator-visible host string (no credentials). */
 	host: string(),
 	/** Last error message reported by the relay, when not ready. */
@@ -73907,13 +73887,6 @@ var smtpProviderCapability = {
 			auth: "admin",
 			access: "create"
 		}),
-		/** Round-trip ping against the SMTP relay (EHLO + AUTH if configured).
-		*  Used by the operator's "Test connection" button. */
-		verify: method(RelayPinSchema, SmtpStatusSchema, {
-			kind: "mutation",
-			auth: "admin",
-			access: "view"
-		}),
 		getStatus: method(RelayPinSchema, SmtpStatusSchema, { auth: "admin" })
 	}
 };
@@ -80584,13 +80557,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"addonSettings.getIntegrationFormSchema": {
-		capName: "addon-settings",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"addonSettings.getScopedSettings": {
 		capName: "addon-settings",
 		capScope: "system",
@@ -88613,13 +88579,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"smtpProvider.verify": {
-		capName: "smtp-provider",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"snapshot.applyDeviceSettingsPatch": {
 		capName: "snapshot",
 		capScope: "device",
@@ -95597,28 +95556,6 @@ function createGmailSmtpProvider(deps) {
 	};
 	return {
 		getStatus: async () => status(),
-		verify: async () => {
-			const account = selectGmailAccount(deps.accounts(), void 0);
-			if (account === null) {
-				lastError = "No Google broker connected.";
-				return status();
-			}
-			try {
-				const token = await account.getAccessToken();
-				const res = await http(`${GOOGLE_GMAIL_API}/users/me/profile`, { headers: { Authorization: `Bearer ${token}` } });
-				if (!res.ok) {
-					const text = await res.text();
-					lastError = `Gmail profile failed (${res.status}): ${text.slice(0, 200)}`;
-					return status();
-				}
-				lastError = void 0;
-				lastVerifiedAt = Date.now();
-				return status();
-			} catch (err) {
-				lastError = err instanceof Error ? err.message : String(err);
-				return status();
-			}
-		},
 		sendEmail: async (input) => {
 			const account = selectGmailAccount(deps.accounts(), input.from);
 			if (account === null) throw new Error("No Google broker connected — add one under Connectivity → Brokers and Connect.");

package/dist/google-services.addon.mjs

@@ -6012,7 +6012,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-CS5Xp1iQ.mjs
+//#region ../types/dist/sleep-CkinsFFb.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8691,16 +8691,6 @@ var BaseAddon = class {
 		return null;
 	}
 	/**
-	* The form schema of ONE integration instance, or `null` to use the scoped form.
-	*
-	* Override it only when an `instanceMode: multiple` addon's instances differ: an NVR integration
-	* needs its connection fields, the default integration the addon's own sections. It is the
-	* SHAPE of the form only — the values live on the instance record.
-	*/
-	async integrationFormSchema(_instance) {
-		return null;
-	}
-	/**
 	* D986 scoped settings: the form shape of the CLUSTER-wide settings one capability this addon
 	* provides owns, or `null` when it has none. `cap` is a capability name the addon's manifest
 	* declares. Stored as `addon-settings` rows `<addonId>.<field>`. The keys of this schema, of
@@ -8728,8 +8718,7 @@ var BaseAddon = class {
 	}
 	/**
 	* The host's read of the scoped declarations: the schema one capability declares for `scope`,
-	* or `null`. Beside {@link getIntegrationFormSchema}, the same shape: the hook is protected, the
-	* host asks this method.
+	* or `null`. The hook is protected, the host asks this method.
 	*/
 	async getScopedSettingsSchema(scope, cap) {
 		switch (scope) {
@@ -8897,22 +8886,6 @@ var BaseAddon = class {
 		return Object.fromEntries([...collectHydratedFieldValues(form)].filter(([, value]) => value !== void 0));
 	}
 	/**
-	* What the create wizard and the integration edit page render for one instance: the addon's
-	* per-instance schema when it declares one, else its global schema (what they always showed).
-	*/
-	async getIntegrationFormSchema(instance, nodeId) {
-		const scoped = await this.integrationFormSchema(instance);
-		if (scoped === null) return this.scopedForm(nodeId);
-		return hydrateSchema(scoped, {}, { inlineSecretsAsViews: true });
-	}
-	/** The form of the scoped schemas this addon declared, hydrated from its store. */
-	async scopedForm(nodeId) {
-		await this.loadScopedSchemas();
-		const schema = this.scopedFormSchema();
-		if (!schema) return { sections: [] };
-		return hydrateSchema(schema, await this.readRawProjectedStore(nodeId), { inlineSecretsAsViews: true });
-	}
-	/**
 	* The raw addon store PROJECTED onto the target node's bare per-node keys:
 	* every `perNode: true` field carries THAT node's scoped value on its bare
 	* key (absent scoped key ⇒ key absent, so the schema `default` wins — no
@@ -9099,12 +9072,6 @@ var BaseAddon = class {
 		this._nodeKeysByCap = /* @__PURE__ */ new Map();
 		this._addonSecretTree = null;
 	}
-	/** The form of an addon's scoped schemas: their sections, each shown once. */
-	scopedFormSchema(cap) {
-		const byId = /* @__PURE__ */ new Map();
-		for (const entry of this.loadedScopedSchemas(cap)) for (const section of entry.schema.sections) if (!byId.has(section.id)) byId.set(section.id, section);
-		return byId.size === 0 ? null : { sections: [...byId.values()] };
-	}
 	/** Every loaded scoped schema of `cap`, or of every loaded capability. */
 	loadedScopedSchemas(cap) {
 		if (cap !== void 0) return this._scopedByCap.get(cap) ?? [];
@@ -9694,6 +9661,24 @@ function normalizeAddonInitResult(result) {
 	if (Array.isArray(result)) return { providers: result };
 	return result;
 }
+object({
+	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
+	params: record(string(), union([string(), number$1()])).optional()
+});
+var CamstackError = class extends Error {
+	i18nCode;
+	i18nParams;
+	constructor(code, params, englishMessage) {
+		super(englishMessage);
+		this.name = "CamstackError";
+		this.i18nCode = code;
+		this.i18nParams = params;
+	}
+};
+/** `throw userError('device.not-found', { id }, 'Device 12 not found')` */
+function userError(code, params, englishFallback) {
+	return new CamstackError(code, params, englishFallback);
+}
 object({
 	field: string().min(1),
 	on: literal("advance")
@@ -9770,12 +9755,6 @@ function systemMethod(input, output, options) {
 		systemOnly: true
 	};
 }
-/**
-* A method a SOURCE of a collection cap may legitimately not serve — OPTIONAL
-* on `InferProvider`. The `providerOptional: true` literal is what
-* `InferProvider` keys on; see {@link CapabilityMethodSchema.providerOptional}
-* for when this is the honest answer and when it is a soft stub.
-*/
 function optionalMethod(input, output, options) {
 	return {
 		...method(input, output, options),
@@ -17170,24 +17149,6 @@ Object.freeze({
 		"uploadDataset": 72e5
 	}
 });
-object({
-	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
-	params: record(string(), union([string(), number$1()])).optional()
-});
-var CamstackError = class extends Error {
-	i18nCode;
-	i18nParams;
-	constructor(code, params, englishMessage) {
-		super(englishMessage);
-		this.name = "CamstackError";
-		this.i18nCode = code;
-		this.i18nParams = params;
-	}
-};
-/** `throw userError('device.not-found', { id }, 'Device 12 not found')` */
-function userError(code, params, englishFallback) {
-	return new CamstackError(code, params, englishFallback);
-}
 //#endregion
 //#region ../types/dist/composition-CXCX78IR.mjs
 /**
@@ -18899,25 +18860,6 @@ var RequiredAddonUpdateSchema = object({
 	installed: string().nullable()
 });
 /**
-* Which integration instance a settings form is for. An addon that serves several instances
-* (`instanceMode: multiple`) can show a different form per instance — an NVR integration
-* needs its connection, the default integration needs the addon's own sections.
-*
-* - `integrationId` is `null` in the create wizard: nothing exists yet, the operator is
-*   setting up a NEW instance.
-* - `mode` is the wizard mode of the integration type (`getAvailableTypes`).
-* - `candidateStableId` is the discovery candidate a wizard was seeded from, if any.
-*/
-var IntegrationInstanceRefSchema = object({
-	integrationId: string().nullable(),
-	mode: _enum([
-		"standalone",
-		"account",
-		"broker"
-	]),
-	candidateStableId: string().optional()
-});
-/**
 * Build an `IAddonRouteProvider` from a list of routes. Implements
 * both the operator-facing `getRoutes` (returning route descriptors
 * minus the handlers, which can't cross JSON) and the framework-
@@ -19094,8 +19036,8 @@ function composeInstanceKinds(parts, base) {
 		instanceFormSchema: async ({ id, kind }) => {
 			return (id === null ? byKind(kind) : await holderOf(id)).provider.instanceFormSchema({ id });
 		},
-		listInstances: async () => {
-			return (await Promise.all(parts.map(async (part) => (await part.provider.listInstances()).map((instance) => tagged(part, instance))))).flat();
+		listInstances: async (input) => {
+			return (await Promise.all(parts.map(async (part) => (await part.provider.listInstances(input)).map((instance) => tagged(part, instance))))).flat();
 		},
 		getInstance: async ({ id }) => {
 			for (const part of parts) {
@@ -45240,10 +45182,6 @@ method(object({
 	scope: ScopedSettingsScopeSchema,
 	nodeId: string().optional()
 }), record(string(), unknown()).nullable()), method(object({
-	addonId: string(),
-	nodeId: string().optional(),
-	instance: IntegrationInstanceRefSchema
-}), SettingsSchemaWithValuesSchema.nullable()), method(object({
 	addonId: string(),
 	nodeId: string().optional()
 }), object({ keys: array(string()) }).nullable(), { auth: "admin" }), method(object({
@@ -55648,6 +55586,12 @@ var IntegrationWithStateSchema = object({
 	name: string(),
 	/** A projection of the instance body's switch (`setInstanceEnabled` is the only writer). */
 	enabled: boolean(),
+	/**
+	* True when the addon that holds the switch did not answer (down, failed, or keeps no record for
+	* this row): `enabled` is then the stored registry flag, a stale value, not the state. A reader
+	* must not draw it as on or off (D315).
+	*/
+	switchUnknown: literal(true).optional(),
 	info: record(string(), unknown()).readonly(),
 	/** The discovery candidate this integration was set up from (D984). */
 	originStableId: string().optional(),
@@ -55661,6 +55605,12 @@ var IntegrationLiteSchema = object({
 	name: string(),
 	/** A projection of the instance body's switch (`setInstanceEnabled` is the only writer). */
 	enabled: boolean(),
+	/**
+	* True when the addon that holds the switch did not answer (down, failed, or keeps no record for
+	* this row): `enabled` is then the stored registry flag, a stale value, not the state. A reader
+	* must not draw it as on or off (D315).
+	*/
+	switchUnknown: literal(true).optional(),
 	info: record(string(), unknown()).readonly(),
 	/** The discovery candidate this integration was set up from (D984). */
 	originStableId: string().optional(),
@@ -55759,9 +55709,9 @@ var UpdateIntegrationInputSchema = object({
 	id: string(),
 	name: string().optional(),
 	/**
-	* Accepted for a FIXED builtin only (`info.fixed`: alarm panel, camera grid, core blocks,
-	* terminal), which keeps no instance record: the registry flag is its one store. Any other
-	* integration is switched through `integration-instances.setInstanceEnabled`.
+	* Honoured ONLY for a fixed builtin (`info.fixed`), whose switch is the hub's own registry flag
+	* and works while its addon is down. Any other row is refused (a typed `BAD_REQUEST`): its
+	* switch is `integration-instances.setInstanceEnabled`.
 	*/
 	enabled: boolean().optional(),
 	info: record(string(), unknown()).optional()
@@ -55795,6 +55745,12 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 * the form as a `SecretFieldView`, never text (D789). A patch value omitted, `''`
 * or the redaction token KEEPS the stored secret; `{ $secretClear: true }`
 * clears it.
+*
+* Who may call (epic #440): every method but `describe` and `instanceFormSchema` is open to any
+* session (`caller: 'scoped'`) and default-denies. An admin passes everywhere. A non-admin passes
+* only on a call pinned to one addon whose `describe().userScoped` is true, and that provider
+* filters every row on the `caller` the router injected (a notification target is somebody's
+* phone: a user sees and changes only their own). An addon that says nothing keeps the admin door.
 */
 var ConfigSchemaPassthrough$2 = custom();
 var IntegrationInstanceIdSchema = string().min(1);
@@ -55908,7 +55864,15 @@ var IntegrationInstanceDescriptionSchema = object({
 	*/
 	mintsId: boolean().optional(),
 	/** The links to other instances the provider's kinds declare; absent means none. */
-	links: array(IntegrationInstanceLinkSchema).optional()
+	links: array(IntegrationInstanceLinkSchema).optional(),
+	/**
+	* The rows belong to individual users (a notification target is somebody's phone). The router
+	* then opens `listInstances`, `getInstance`, `createInstance`, `updateInstance`,
+	* `setInstanceEnabled`, `deleteInstance` and `testInstance` to a NON-admin session on a call
+	* pinned to this addon, and hands the provider the `caller` so it keeps a user to their own rows.
+	* Absent means admin only, as it always was.
+	*/
+	userScoped: boolean().optional()
 });
 var IntegrationInstanceStatusSchema = object({
 	state: _enum([
@@ -55966,8 +55930,14 @@ var integrationInstancesCapability = {
 			/** The discovery candidate the wizard was seeded from (`stableId`), if any. */
 			candidateStableId: string().min(1).optional()
 		}), ConfigSchemaPassthrough$2, { auth: "admin" }),
-		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
-		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
+		listInstances: method(looseObject({}), array(IntegrationInstanceSchema).readonly(), {
+			auth: "protected",
+			caller: "scoped"
+		}),
+		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), {
+			auth: "protected",
+			caller: "scoped"
+		}),
 		/**
 		* Insert the typed record. With `id` it is stored under that id (a duplicate id is refused);
 		* without one the PROVIDER mints it and answers it. `kind` picks one of `describe().kinds`.
@@ -56000,11 +55970,13 @@ var integrationInstancesCapability = {
 			seed: object({ info: record(string(), unknown()) }).optional()
 		}), object({ id: string() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		}),
 		updateInstance: method(IntegrationInstancePatchSchema, object({ ok: literal(true) }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		}),
 		/**
 		* Switch ONE instance on or off, for every role; a missing record is created from the addon's
@@ -56016,7 +55988,8 @@ var integrationInstancesCapability = {
 			enabled: boolean()
 		}), object({ ok: literal(true) }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		}),
 		/**
 		* Delete the record and its keychain refs together. For an instance that brings devices the hub
@@ -56025,7 +55998,8 @@ var integrationInstancesCapability = {
 		*/
 		deleteInstance: method(object({ id: IntegrationInstanceIdSchema }), object({ ok: literal(true) }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		}),
 		testInstance: optionalMethod(object({
 			id: IntegrationInstanceIdSchema.nullable(),
@@ -56034,7 +56008,8 @@ var integrationInstancesCapability = {
 			kind: string().min(1).optional()
 		}), TestConnectionResultSchema, {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		})
 	}
 };
@@ -73884,6 +73859,11 @@ var SendEmailResultSchema = object({
 var SmtpStatusSchema = object({
 	/** True iff the addon has successfully verified the relay. */
 	ready: boolean(),
+	/**
+	* The tri-state behind `ready` (D315): true when the last send worked, false when it failed,
+	* ABSENT when the relay has not sent yet (unknown, never "not verified").
+	*/
+	verified: boolean().optional(),
 	/** Operator-visible host string (no credentials). */
 	host: string(),
 	/** Last error message reported by the relay, when not ready. */
@@ -73903,13 +73883,6 @@ var smtpProviderCapability = {
 			auth: "admin",
 			access: "create"
 		}),
-		/** Round-trip ping against the SMTP relay (EHLO + AUTH if configured).
-		*  Used by the operator's "Test connection" button. */
-		verify: method(RelayPinSchema, SmtpStatusSchema, {
-			kind: "mutation",
-			auth: "admin",
-			access: "view"
-		}),
 		getStatus: method(RelayPinSchema, SmtpStatusSchema, { auth: "admin" })
 	}
 };
@@ -80580,13 +80553,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"addonSettings.getIntegrationFormSchema": {
-		capName: "addon-settings",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"addonSettings.getScopedSettings": {
 		capName: "addon-settings",
 		capScope: "system",
@@ -88609,13 +88575,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"smtpProvider.verify": {
-		capName: "smtp-provider",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"snapshot.applyDeviceSettingsPatch": {
 		capName: "snapshot",
 		capScope: "device",
@@ -95593,28 +95552,6 @@ function createGmailSmtpProvider(deps) {
 	};
 	return {
 		getStatus: async () => status(),
-		verify: async () => {
-			const account = selectGmailAccount(deps.accounts(), void 0);
-			if (account === null) {
-				lastError = "No Google broker connected.";
-				return status();
-			}
-			try {
-				const token = await account.getAccessToken();
-				const res = await http(`${GOOGLE_GMAIL_API}/users/me/profile`, { headers: { Authorization: `Bearer ${token}` } });
-				if (!res.ok) {
-					const text = await res.text();
-					lastError = `Gmail profile failed (${res.status}): ${text.slice(0, 200)}`;
-					return status();
-				}
-				lastError = void 0;
-				lastVerifiedAt = Date.now();
-				return status();
-			} catch (err) {
-				lastError = err instanceof Error ? err.message : String(err);
-				return status();
-			}
-		},
 		sendEmail: async (input) => {
 			const account = selectGmailAccount(deps.accounts(), input.from);
 			if (account === null) throw new Error("No Google broker connected — add one under Connectivity → Brokers and Connect.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-google-services",
-  "version": "0.2.45",
+  "version": "0.2.46",
   "description": "Google — Google brokers (OAuth2): Calendar as calendar-source, Gmail send as smtp-provider.",
   "keywords": [
     "camstack",
@@ -64,7 +64,7 @@
       }
     ],
     "requires": {
-      "server": ">=1.2.818"
+      "server": ">=1.2.820"
     }
   },
   "files": [