@camstack/addon-import-alexa 0.2.169 → 0.2.170

package/dist/addon.mjs

@@ -5649,7 +5649,7 @@ function number(params) {
 	return /* @__PURE__ */ _coercedNumber(ZodNumber, params);
 }
 //#endregion
-//#region ../types/dist/sleep-63gM_1JR.mjs
+//#region ../types/dist/sleep-CeyhrcOk.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7716,6 +7716,7 @@ var BaseAddon = class {
 	* a warning and falls back rather than crashing boot.
 	*/
 	state(key, schema, fallback) {
+		this._declaredStateKeys.add(key);
 		return createDurableState({
 			key,
 			schema,
@@ -7731,6 +7732,96 @@ var BaseAddon = class {
 			} })
 		});
 	}
+	/** Durable-state keys this process registered through {@link state}. */
+	_declaredStateKeys = /* @__PURE__ */ new Set();
+	/**
+	* Stale-data audit: every global-settings key this addon still declares —
+	* constructor defaults, settings-schema fields (layout containers included),
+	* durable-state keys and the root of each `secretStatePaths` entry. Answered
+	* here, in the addon's own process, so the hub keeps no copy of it.
+	*/
+	async getDeclaredSettingsKeys() {
+		return { keys: [...this.declaredKeySet()].toSorted() };
+	}
+	declaredKeySet() {
+		const keys = new Set(Object.keys(this.defaults));
+		const schema = this.globalSettingsSchema();
+		if (schema) for (const section of schema.sections) for (const key of collectFieldKeys(section.fields)) keys.add(key);
+		for (const key of this._declaredStateKeys) keys.add(key);
+		for (const path of this.secretStatePaths) {
+			const root = path.split(/[.[]/, 1)[0];
+			if (root) keys.add(root);
+		}
+		return keys;
+	}
+	/**
+	* Stale-data audit: remove stored global-settings keys the addon no longer
+	* declares, and clear the keychain values their markers held — except a value
+	* a surviving key still points at. A declared or absent key is refused.
+	*/
+	async unsetStoredSettingsKeys(keys) {
+		const settings = this._ctx?.settings;
+		const raw = this.rawSettings();
+		if (!settings || !raw) return {
+			removed: [],
+			refused: keys.map((key) => ({
+				key,
+				reason: "no settings store"
+			})),
+			secretsCleared: 0
+		};
+		let stored;
+		try {
+			stored = await raw.readAddonStore();
+		} catch (error) {
+			const reason = `store unreadable: ${error instanceof Error ? error.message : "unknown"}`;
+			return {
+				removed: [],
+				refused: keys.map((key) => ({
+					key,
+					reason
+				})),
+				secretsCleared: 0
+			};
+		}
+		const declared = this.declaredKeySet();
+		const removed = [];
+		const refused = [];
+		for (const key of keys) {
+			const base = key.split("@", 1)[0] ?? key;
+			if (declared.has(base)) refused.push({
+				key,
+				reason: "still declared by the addon"
+			});
+			else if (!(key in stored)) refused.push({
+				key,
+				reason: "not stored"
+			});
+			else removed.push(key);
+		}
+		if (removed.length === 0) return {
+			removed,
+			refused,
+			secretsCleared: 0
+		};
+		const kept = /* @__PURE__ */ new Set();
+		const held = /* @__PURE__ */ new Set();
+		for (const [key, value] of Object.entries(stored)) {
+			const target = removed.includes(key) ? held : kept;
+			for (const ref of collectSecretMarkerRefs(value)) target.add(ref);
+		}
+		const refsToClear = [...held].filter((ref) => !kept.has(ref));
+		const patch = {};
+		for (const key of removed) patch[key] = void 0;
+		await settings.writeAddonStore(patch);
+		const secretsCleared = refsToClear.length > 0 && this._ctx?.secrets ? await this._ctx.secrets.delete(refsToClear) : 0;
+		await this.resolveConfig();
+		return {
+			removed,
+			refused,
+			secretsCleared
+		};
+	}
 	/** Per-device variant of {@link state}, backed by the per-device store. */
 	deviceState(deviceId, key, schema, fallback) {
 		return createDurableState({
@@ -8001,6 +8092,21 @@ function dropPerNodeFields(fields) {
 	}
 	return kept;
 }
+function collectFieldKeys(fields) {
+	const collected = [];
+	for (const field of fields) {
+		if (field.type === "group") {
+			collected.push(...collectFieldKeys(field.fields));
+			continue;
+		}
+		if (field.type === "sub-tabs") {
+			for (const tab of field.tabs) collected.push(...collectFieldKeys(tab.fields));
+			continue;
+		}
+		if ("key" in field && typeof field.key === "string") collected.push(field.key);
+	}
+	return collected;
+}
 function collectPerNodeFieldKeys(fields) {
 	const collected = [];
 	for (const field of fields) {
@@ -16555,8 +16661,172 @@ object({
 	quantity: ReadingQuantitySchema,
 	unit: string().min(1)
 });
-/** How a leaf compares a device field to a value. Derived from the field's
-*  `kind` in `deviceManager.getWireableFields`, never hand-maintained. */
+new Set([
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle"
+	},
+	{
+		id: "animal",
+		name: "Animal"
+	},
+	{
+		id: "package",
+		name: "Package"
+	}
+].map((l) => l.id));
+var COCO_TO_MACRO = {
+	mapping: {
+		person: "person",
+		bicycle: "vehicle",
+		car: "vehicle",
+		motorcycle: "vehicle",
+		airplane: "vehicle",
+		bus: "vehicle",
+		train: "vehicle",
+		truck: "vehicle",
+		boat: "vehicle",
+		bird: "animal",
+		cat: "animal",
+		dog: "animal",
+		horse: "animal",
+		sheep: "animal",
+		cow: "animal",
+		elephant: "animal",
+		bear: "animal",
+		zebra: "animal",
+		giraffe: "animal",
+		suitcase: "package",
+		backpack: "package",
+		handbag: "package"
+	},
+	preserveOriginal: false
+};
+/**
+* WHAT a detection-shaped leaf is about: one MACRO class (person, vehicle,
+* animal, package) plus an OPTIONAL label that narrows it.
+*
+* The taxonomy is `COCO_TO_MACRO` (and `CLASS_MAP_MACRO_TARGETS`) — never a
+* second list. The label that fits depends on the macro class:
+*
+*  - `animal`  → a sub-class (`dog`, `cat`, …);
+*  - `person`  → a known face (an identity of the `face-gallery`);
+*  - `vehicle` → a plate (its text) or a sub-class (`car`, `truck`, …);
+*  - `package` → a sub-class.
+*
+* `other` exists only so a class the taxonomy does not know (a custom model's
+* `forklift`) survives the conversion of a stored recipe without widening.
+*
+* A label is decided LATE (D683): face recognition and LPR land after the
+* detection starts. The track-lifecycle `update` event carries the newly
+* resolved `label` / `plateText`, which is why a leaf with a label fires when
+* the subject GETS it — not at the first detection.
+*/
+var SubClassLabelSchema = object({
+	kind: literal("sub-class"),
+	className: string().min(1)
+});
+var IdentityLabelSchema = object({
+	kind: literal("identity"),
+	/** The `face-gallery` identity id (stable across a rename). */
+	identityId: string().min(1),
+	/** The identity's name — what a track-lifecycle event carries as `label`. */
+	name: string().min(1)
+});
+var PlateLabelSchema = object({
+	kind: literal("plate"),
+	text: string().min(1)
+});
+function macroOf$1(className) {
+	return COCO_TO_MACRO.mapping[className.toLowerCase()] ?? className.toLowerCase();
+}
+/** A sub-class label must belong to the macro it is under. */
+function subClassBelongs(macro, label) {
+	return label === void 0 || macroOf$1(label.className) === macro;
+}
+var subClassOf = (macro) => SubClassLabelSchema.refine((l) => subClassBelongs(macro, l), { message: `that class is not a kind of ${macro} in the detection taxonomy` });
+var DetectionSubjectSchema = discriminatedUnion("macro", [
+	object({
+		macro: literal("animal"),
+		label: subClassOf("animal").optional()
+	}),
+	object({
+		macro: literal("person"),
+		label: IdentityLabelSchema.optional()
+	}),
+	object({
+		macro: literal("vehicle"),
+		label: discriminatedUnion("kind", [SubClassLabelSchema.refine((l) => subClassBelongs("vehicle", l), { message: "that class is not a kind of vehicle in the detection taxonomy" }), PlateLabelSchema]).optional()
+	}),
+	object({
+		macro: literal("package"),
+		label: subClassOf("package").optional()
+	}),
+	object({
+		macro: literal("other"),
+		className: string().min(1)
+	})
+]);
+/**
+* The subject of a PARKED object. The stationary registry's event carries a
+* class and a zone, no face and no plate — an identity or plate label there
+* could never match, so the schema refuses it instead of letting it sit dead.
+*/
+var StationarySubjectSchema = DetectionSubjectSchema.refine((s) => s.macro === "other" || s.label === void 0 || s.label.kind === "sub-class", { message: "a parked object carries no face or plate — only a class can narrow it" });
+/**
+* A stored class string as a subject: a macro name stays a macro; a raw class
+* the taxonomy files under a macro becomes that macro plus the sub-class label
+* (`dog` → animal / dog); anything else is `other`, kept verbatim.
+*/
+function subjectFromClassName(className) {
+	const name = className.trim().toLowerCase();
+	const macro = COCO_TO_MACRO.mapping[name];
+	if (new Set(Object.values(COCO_TO_MACRO.mapping)).has(name)) return macroOnly(name);
+	if (macro === void 0) return {
+		macro: "other",
+		className
+	};
+	const label = {
+		kind: "sub-class",
+		className: name
+	};
+	switch (macro) {
+		case "animal": return {
+			macro: "animal",
+			label
+		};
+		case "vehicle": return {
+			macro: "vehicle",
+			label
+		};
+		case "package": return {
+			macro: "package",
+			label
+		};
+		default: return {
+			macro: "other",
+			className
+		};
+	}
+}
+function macroOnly(macro) {
+	switch (macro) {
+		case "animal": return { macro: "animal" };
+		case "person": return { macro: "person" };
+		case "vehicle": return { macro: "vehicle" };
+		case "package": return { macro: "package" };
+		default: return {
+			macro: "other",
+			className: macro
+		};
+	}
+}
+/** How a state leaf compares a device field to a value. Derived from the
+*  field's `kind` in `deviceManager.getWireableFields`, never hand-maintained. */
 var AutomationConditionOperatorSchema = _enum([
 	"eq",
 	"ne",
@@ -16567,12 +16837,76 @@ var AutomationConditionOperatorSchema = _enum([
 	"contains",
 	"in"
 ]);
-var AutomationConditionLeafSchema = object({
-	kind: literal("condition"),
+/**
+* D8 compliance, and it is the reason a "becomes" leaf is not merely an event
+* subscription: it evaluates against the **state mirror**, which is reconciled,
+* and an event only WAKES the evaluation. A dropped event therefore DELAYS a
+* fire; it does not lose it.
+*/
+var DeviceBecomesLeafSchema = object({
+	kind: literal("device-becomes"),
+	deviceId: number$1().int().nonnegative(),
+	cap: string().min(1),
+	fieldPath: string().min(1),
+	/** Fire when the field takes this value. Omit to fire on any change. */
+	becomes: union([
+		string(),
+		number$1(),
+		boolean()
+	]).optional(),
+	/** Only on a CHANGE of value, not on every re-report. */
+	edge: boolean().optional(),
+	/** The new value must hold this long before it counts. */
+	forMs: number$1().int().min(0).max(864e5).optional(),
+	/** Collapse a burst into one occurrence. */
+	debounceMs: number$1().int().min(0).max(6e5).optional()
+});
+var DeviceEventLeafSchema = object({
+	kind: literal("device-event"),
+	/** An `EventCategory` value. */
+	category: string().min(1),
+	deviceId: number$1().int().nonnegative().optional()
+});
+var ScheduleLeafSchema = object({
+	kind: literal("schedule"),
+	cron: string().min(1).max(120)
+});
+var ManualLeafSchema = object({ kind: literal("manual") });
+var IntervalLeafSchema = object({
+	kind: literal("interval"),
+	minutes: number$1().int().min(1).max(1440)
+});
+var DetectionLeafSchema = object({
+	kind: literal("detection"),
+	/** One macro class each, optionally narrowed by a label; a track of any listed subject fires. */
+	subjects: array(DetectionSubjectSchema).min(1),
+	deviceIds: array(number$1().int().nonnegative()).min(1),
+	/** The track must have visited at least one of these zones. */
+	zones: array(string().min(1)).min(1).optional(),
+	/** Best-so-far confidence the track must reach. */
+	minScore: number$1().min(0).max(1).optional()
+});
+var StationaryLeafSchema = object({
+	kind: literal("stationary"),
+	deviceIds: array(number$1().int().nonnegative()).min(1),
+	subjects: array(StationarySubjectSchema).min(1).optional(),
+	zones: array(string().min(1)).min(1).optional(),
+	/** `appeared`: it became parked. `departed`: the registry retired it. */
+	phase: _enum(["appeared", "departed"])
+});
+/** "is": one device field compared to one value, NOW. */
+var DeviceIsLeafSchema = object({
+	kind: literal("device-is"),
 	deviceId: number$1().int().nonnegative(),
 	cap: string().min(1),
 	fieldPath: string().min(1),
 	operator: AutomationConditionOperatorSchema,
+	/**
+	* The value. A number on a quantity field is stored in the field's base unit
+	* (D944); a quantity value is the WRITE form, which the save boundary
+	* replaces with the converted number and `unit`. A leaf that still carries
+	* one is never evaluated (it fails).
+	*/
 	value: union([
 		string(),
 		number$1(),
@@ -16580,24 +16914,26 @@ var AutomationConditionLeafSchema = object({
 		array(union([string(), number$1()])),
 		QuantityValueSchema
 	]),
+	/** The unit the person picked for `value` (display only; `value` is in the base unit). */
 	unit: string().min(1).optional()
 });
-var AutomationConditionStationaryPresentSchema = object({
+/**
+* True when the camera currently has a PARKED object matching `subjects` in at
+* least one of `zones`. Reads the zone-analytics snapshot through the same
+* mirror as every other state leaf, so a dropped event never decides it (D49).
+*/
+var StationaryPresentLeafSchema = object({
 	kind: literal("stationary-present"),
 	deviceId: number$1().int().nonnegative(),
-	/** Class names; a macro class matches every raw class that maps to it. */
-	classes: array(string().min(1)).min(1).optional(),
-	/** The parked object must be in at least one of these zones. */
+	subjects: array(StationarySubjectSchema).min(1).optional(),
 	zones: array(string().min(1)).min(1).optional()
 });
 /**
-* The expression leaf, declared as a plain object rather than an intersection
-* with {@link ExpressionSourceSchema}: a discriminated union has to be able to
-* read `kind` off each option, and an intersection hides it. The author-time
-* validation is the SAME function `ExpressionSourceSchema` runs, so the two
-* cannot drift — an expression that one accepts, the other accepts.
+* The escape hatch: the bounded expression engine over named device bindings.
+* Declared as a plain object so a discriminated union can read `kind`; the
+* author-time validation is the SAME function `ExpressionSourceSchema` runs.
 */
-var AutomationConditionExpressionSchema = object({
+var ExpressionLeafSchema = object({
 	kind: literal("expression"),
 	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
 	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
@@ -16609,55 +16945,62 @@ var AutomationConditionExpressionSchema = object({
 		path: ["expr"]
 	});
 });
-var AutomationConditionSchema = lazy(() => discriminatedUnion("kind", [
+var AutomationWhenSchema = lazy(() => discriminatedUnion("kind", [
 	object({
 		kind: literal("all"),
-		children: array(AutomationConditionSchema)
+		children: array(AutomationWhenSchema)
 	}),
 	object({
 		kind: literal("any"),
-		children: array(AutomationConditionSchema)
+		children: array(AutomationWhenSchema)
 	}),
 	object({
 		kind: literal("not"),
-		child: AutomationConditionSchema
+		child: AutomationWhenSchema
 	}),
-	AutomationConditionLeafSchema,
-	AutomationConditionExpressionSchema,
-	AutomationConditionStationaryPresentSchema
+	DeviceBecomesLeafSchema,
+	DeviceEventLeafSchema,
+	ScheduleLeafSchema,
+	ManualLeafSchema,
+	IntervalLeafSchema,
+	DetectionLeafSchema,
+	StationaryLeafSchema,
+	DeviceIsLeafSchema,
+	StationaryPresentLeafSchema,
+	ExpressionLeafSchema
 ]));
 /**
-* What starts a run.
-*
-* D8 compliance, and it is the reason `device-state` is not merely an event
-* subscription: the trigger evaluates against the **state mirror**, which is
-* reconciled, and an event only WAKES the evaluation. A dropped event therefore
-* DELAYS a trigger; it does not lose it. `schedule` uses `croner` — the one
-* already in the repo — because `setInterval(24h)` drifts and "at 23:30" does
-* not.
-*/
-var AutomationTriggerSchema = discriminatedUnion("kind", [
+* The recipe shape before the single `when` tree: a flat list of triggers
+* (OR'd, each an instant) and an optional condition tree. Stored recipes —
+* the `AUTOMATION_RECIPE` literal of every block saved so far, and whatever an
+* older client still posts — are in this shape, so it stays READABLE here, and
+* {@link convertLegacyRecipe} turns it into the new one, losslessly and one
+* way. Nothing writes this shape any more.
+*
+*   `{ triggers: [t1…tn], conditions?: C }`
+*      → `when = all(any(t1…tn), C)`, or `any(t1…tn)` without `C`;
+*        a single trigger is not wrapped in `any`.
+*   a `condition` leaf → a `device-is` leaf (the "is" verb);
+*   a `device-state` trigger → a `device-becomes` leaf (the "becomes" verb);
+*   `classes: ['dog']` → the macro `animal` with the label `dog`.
+*/
+var LegacyTriggerSchema = discriminatedUnion("kind", [
 	object({
 		kind: literal("device-state"),
 		deviceId: number$1().int().nonnegative(),
 		cap: string().min(1),
 		fieldPath: string().min(1),
-		/** Fire when the field takes this value. Omit to fire on any change. */
 		becomes: union([
 			string(),
 			number$1(),
 			boolean()
 		]).optional(),
-		/** Only on a CHANGE of value, not on every re-report. */
 		edge: boolean().optional(),
-		/** The condition must hold this long before the run starts. */
 		forMs: number$1().int().min(0).max(864e5).optional(),
-		/** Collapse a burst into one run. */
 		debounceMs: number$1().int().min(0).max(6e5).optional()
 	}),
 	object({
 		kind: literal("device-event"),
-		/** An `EventCategory` value. */
 		category: string().min(1),
 		deviceId: number$1().int().nonnegative().optional()
 	}),
@@ -16668,25 +17011,16 @@ var AutomationTriggerSchema = discriminatedUnion("kind", [
 	object({ kind: literal("manual") }),
 	object({
 		kind: literal("detection"),
-		/** Class names. A macro class (`animal`, `vehicle`, `person`, `package`)
-		*  matches every raw class that maps to it; any other name matches
-		*  exactly. */
 		classes: array(string().min(1)).min(1),
 		deviceIds: array(number$1().int().nonnegative()).min(1),
-		/** The track must have visited at least one of these zones. */
 		zones: array(string().min(1)).min(1).optional(),
-		/** Best-so-far confidence the track must reach. */
 		minScore: number$1().min(0).max(1).optional()
 	}),
 	object({
 		kind: literal("stationary"),
 		deviceIds: array(number$1().int().nonnegative()).min(1),
-		/** Class names; a macro class matches like the detection trigger. */
 		classes: array(string().min(1)).min(1).optional(),
-		/** The parked object must be in at least one of these zones. */
 		zones: array(string().min(1)).min(1).optional(),
-		/** `appeared`: it became parked. `departed`: the registry retired it.
-		*  The vocabulary of `PipelineAnalyticsStationaryChanged`. */
 		phase: _enum(["appeared", "departed"])
 	}),
 	object({
@@ -16694,6 +17028,143 @@ var AutomationTriggerSchema = discriminatedUnion("kind", [
 		minutes: number$1().int().min(1).max(1440)
 	})
 ]);
+var LegacyConditionLeafSchema = object({
+	kind: literal("condition"),
+	deviceId: number$1().int().nonnegative(),
+	cap: string().min(1),
+	fieldPath: string().min(1),
+	operator: AutomationConditionOperatorSchema,
+	value: union([
+		string(),
+		number$1(),
+		boolean(),
+		array(union([string(), number$1()])),
+		QuantityValueSchema
+	]),
+	unit: string().min(1).optional()
+});
+var LegacyStationaryPresentSchema = object({
+	kind: literal("stationary-present"),
+	deviceId: number$1().int().nonnegative(),
+	classes: array(string().min(1)).min(1).optional(),
+	zones: array(string().min(1)).min(1).optional()
+});
+var LegacyExpressionSchema = object({
+	kind: literal("expression"),
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+var LegacyConditionSchema = lazy(() => discriminatedUnion("kind", [
+	object({
+		kind: literal("all"),
+		children: array(LegacyConditionSchema)
+	}),
+	object({
+		kind: literal("any"),
+		children: array(LegacyConditionSchema)
+	}),
+	object({
+		kind: literal("not"),
+		child: LegacyConditionSchema
+	}),
+	LegacyConditionLeafSchema,
+	LegacyExpressionSchema,
+	LegacyStationaryPresentSchema
+]));
+function convertTrigger(trigger) {
+	switch (trigger.kind) {
+		case "device-state": return {
+			...trigger,
+			kind: "device-becomes"
+		};
+		case "detection": {
+			const { classes, ...rest } = trigger;
+			return {
+				...rest,
+				subjects: classes.map(subjectFromClassName)
+			};
+		}
+		case "stationary": {
+			const { classes, ...rest } = trigger;
+			return {
+				...rest,
+				...classes === void 0 ? {} : { subjects: classes.map(subjectFromClassName) }
+			};
+		}
+		default: return trigger;
+	}
+}
+/** An old condition tree as a `when` subtree: `condition` → "is", classes → subjects. */
+function convertLegacyCondition(condition) {
+	switch (condition.kind) {
+		case "condition": return {
+			...condition,
+			kind: "device-is"
+		};
+		case "stationary-present": {
+			const { classes, ...rest } = condition;
+			return {
+				...rest,
+				...classes === void 0 ? {} : { subjects: classes.map(subjectFromClassName) }
+			};
+		}
+		case "expression": return condition;
+		case "not": return {
+			kind: "not",
+			child: convertLegacyCondition(condition.child)
+		};
+		case "all":
+		case "any": return {
+			kind: condition.kind,
+			children: condition.children.map(convertLegacyCondition)
+		};
+	}
+}
+/** `all(any(t1…tn), C)`, or `any(t1…tn)`; a single trigger is not wrapped in `any`. */
+function convertLegacyWhen(half) {
+	const leaves = half.triggers.map(convertTrigger);
+	const first = leaves[0];
+	const triggers = leaves.length === 1 && first !== void 0 ? first : {
+		kind: "any",
+		children: leaves
+	};
+	if (half.conditions === void 0) return triggers;
+	return {
+		kind: "all",
+		children: [triggers, convertLegacyCondition(half.conditions)]
+	};
+}
+/**
+* The automation RECIPE — what a visually-authored automation is, before it
+* becomes code.
+*
+* This is the data half of `docs/design/2026-08-08-automation-scripts-custom-devices.md`
+* Phase 6. A recipe is not an engine and never evaluates anything: it is a
+* declarative description that {@link generateAutomationBlock} compiles to the
+* TypeScript of an ordinary core block. There is therefore no second rule
+* engine, no second store and no second runtime — the block runner is the
+* runtime, `core_blocks` is the store (§2.1).
+*
+* Two parts:
+*
+*  - **`when`** — ONE tree (`./when.ts`) of all/any/not over event leaves
+*    (instants) and state leaves (durations). It replaces the flat trigger list
+*    plus the separate condition tree; the firing rule is in that file and in
+*    ADR "one tree".
+*  - **Actions** — `NcRuleActionSchema`'s two steps, plus the `{kind:'code'}`
+*    fragment of §3.2.2. See {@link AutomationActionSchema} for the ONE place
+*    this had to diverge from "verbatim", and why.
+*
+* A recipe stored in the old shape (`triggers` + `conditions`) still LOADS:
+* {@link AutomationRecipeSchema} (the parse-anywhere schema) converts it on parse. Nothing writes it.
+*/
 /**
 * One action step.
 *
@@ -16796,69 +17267,49 @@ var AutomationRunModeSchema = discriminatedUnion("mode", [
 		minutes: number$1().int().min(1).max(1440)
 	})
 ]);
-var AutomationRecipeSchema = object({
-	triggers: array(AutomationTriggerSchema),
-	conditions: AutomationConditionSchema.optional(),
+var CurrentAutomationRecipeSchema = object({
+	when: AutomationWhenSchema,
 	actions: array(AutomationActionSchema),
 	runMode: AutomationRunModeSchema.optional(),
 	/** How many run traces the automation keeps (default {@link DEFAULT_TRACE_KEEP}). */
 	keepTraces: number$1().int().min(1).max(100).optional()
 });
-new Set([
-	{
-		id: "person",
-		name: "Person"
-	},
-	{
-		id: "vehicle",
-		name: "Vehicle"
-	},
-	{
-		id: "animal",
-		name: "Animal"
-	},
-	{
-		id: "package",
-		name: "Package"
-	}
-].map((l) => l.id));
-var COCO_TO_MACRO = {
-	mapping: {
-		person: "person",
-		bicycle: "vehicle",
-		car: "vehicle",
-		motorcycle: "vehicle",
-		airplane: "vehicle",
-		bus: "vehicle",
-		train: "vehicle",
-		truck: "vehicle",
-		boat: "vehicle",
-		bird: "animal",
-		cat: "animal",
-		dog: "animal",
-		horse: "animal",
-		sheep: "animal",
-		cow: "animal",
-		elephant: "animal",
-		bear: "animal",
-		zebra: "animal",
-		giraffe: "animal",
-		suitcase: "package",
-		backpack: "package",
-		handbag: "package"
-	},
-	preserveOriginal: false
-};
+/** A recipe as it was stored before the single tree. Read-only: nothing writes this. */
+var LegacyAutomationRecipeSchema = object({
+	triggers: array(LegacyTriggerSchema),
+	conditions: LegacyConditionSchema.optional(),
+	actions: array(AutomationActionSchema),
+	runMode: AutomationRunModeSchema.optional(),
+	keepTraces: number$1().int().min(1).max(100).optional()
+});
+/** The old shape as the new one, lossless. */
+function convertLegacyRecipe(legacy) {
+	const { triggers, conditions, ...rest } = legacy;
+	return {
+		when: convertLegacyWhen({
+			triggers,
+			conditions
+		}),
+		...rest
+	};
+}
+/**
+* Where recipes are PARSED (the core-blocks cap, the MCP tool, the literal a
+* saved block carries): the new shape as it is, or the old shape converted to
+* it. The output type is always the new one.
+*/
+var AutomationRecipeSchema = union([CurrentAutomationRecipeSchema, LegacyAutomationRecipeSchema.transform(convertLegacyRecipe)]);
 new Set(Object.values(COCO_TO_MACRO.mapping));
 /**
 * Run traces — what an automation (or, later, an Action run) DID, node by node,
 * so the editor can paint every block green or red with its reason.
 *
-* A trace is data, not a log: it covers the WHOLE tree — the trigger stage,
-* every condition node (containers and leaves, including the ones a
-* short-circuit never reached), the run-mode verdict and every action step —
-* each addressed by a stable path (`conditions.0.1`, `actions.2`, or `steps.N`
-* for an Action run). Skipped
+* A trace is data, not a log: it covers the WHOLE tree — the event leaf that
+* fired, every node of the `when` tree (containers and leaves, including the
+* ones a short-circuit never reached), the run-mode verdict and every action
+* step — each addressed by a stable path (`when.0.1`, `actions.2`, or `steps.N`
+* for an Action run). Traces written before the single tree carry
+* `conditions.*` paths and still parse. Skipped
 * evaluations are traced too, and identical consecutive skips collapse into a
 * repeat count so a trigger that fails every 5 minutes cannot flush real runs.
 *
@@ -16890,6 +17341,8 @@ var TraceNodeOutcomeSchema = _enum([
 ]);
 var AutomationTriggerTraceSchema = object({
 	kind: string().min(1),
+	/** The event leaf that fired (`when`, `when.0.1`); absent on traces written before the single tree. */
+	path: string().min(1).optional(),
 	outcome: _enum(["pass", "fail"]),
 	/** Why an event was rejected ("class person not in [dog]") or what fired. */
 	reason: string(),
@@ -16897,15 +17350,23 @@ var AutomationTriggerTraceSchema = object({
 	vars: record(string(), TraceValueSchema)
 });
 var AutomationConditionTraceNodeSchema = object({
-	/** `conditions` for the root, `conditions.<i>` for its i-th child, … */
+	/** `when` for the root, `when.<i>` for its i-th child, … (`conditions…` on an old trace). */
 	path: string().min(1),
 	kind: _enum([
 		"all",
 		"any",
 		"not",
 		"condition",
+		"device-is",
 		"expression",
-		"stationary-present"
+		"stationary-present",
+		"device-becomes",
+		"device-event",
+		"schedule",
+		"interval",
+		"manual",
+		"detection",
+		"stationary"
 	]),
 	outcome: TraceNodeOutcomeSchema,
 	reason: string(),
@@ -16939,6 +17400,12 @@ var AutomationStepTraceSchema = object({
 	deviceId: number$1().int().optional(),
 	startedAt: number$1().optional(),
 	endedAt: number$1().optional(),
+	/**
+	* The parameters the step SENT, after `{{vars.x}}` substitution — what the
+	* device was actually asked. Bounded like trigger `vars`; a secret parameter
+	* is shown as {@link REDACTED_ARG}. Absent on traces written before it existed.
+	*/
+	args: record(string(), TraceValueSchema).optional(),
 	outcome: _enum([
 		"ok",
 		"error",
@@ -17729,6 +18196,23 @@ method(object({
 	addonId: string(),
 	nodeId: string().optional()
 }), SettingsSchemaWithValuesSchema.nullable()), method(object({
+	addonId: string(),
+	nodeId: string().optional()
+}), object({ keys: array(string()) }).nullable(), { auth: "admin" }), method(object({
+	addonId: string(),
+	nodeId: string().optional(),
+	keys: array(string())
+}), object({
+	removed: array(string()),
+	refused: array(object({
+		key: string(),
+		reason: string()
+	})),
+	secretsCleared: number$1()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	addonId: string(),
 	deviceId: number$1(),
 	nodeId: string().optional()
@@ -21807,6 +22291,8 @@ var StorageKindSchema = object({
 		"orphaned",
 		"dropped"
 	]),
+	/** An owner declared this kind since the engine started. */
+	declaredThisBoot: boolean(),
 	/** `null` when the caller asked for no counts (`counts: false`). */
 	rows: number$1().int().nonnegative().nullable(),
 	/** Rows x the average size of a sample; null for an empty kind. */
@@ -21818,6 +22304,51 @@ var StorageKindSchema = object({
 	/** The whole declaration, secret paths and entry descriptor included (the entries service builds its handle from it). */
 	declaration: RecordKindDeclarationSchema
 });
+_enum([
+	"orphaned",
+	"stale",
+	"unknown"
+]);
+/** A record kind nobody declared since its owner started, or whose owner is gone. */
+var StaleKindFindingSchema = object({
+	owner: string(),
+	kind: string(),
+	/** `unknown`: the owner could not be judged (not running, or its state unreadable) - never dropped. */
+	verdict: _enum(["orphaned", "unknown"]),
+	reason: string(),
+	rows: number$1().int().nonnegative().nullable(),
+	/** local-auth's tables are never dropped by this audit. */
+	protected: boolean()
+});
+/** A stored global-settings key the running addon no longer declares. */
+var StaleSettingsKeyFindingSchema = object({
+	addonId: string(),
+	/** The stored key as written, a per-node `<key>@<nodeId>` suffix included. */
+	key: string(),
+	/**
+	* Keychain refs whose ONLY marker sits under this key: in use by stale data,
+	* not orphans yet. Removing the key releases them.
+	*/
+	secretRefs: array(string())
+});
+/** An addon the audit could not judge, with the reason. Never reported as stale. */
+var StaleUnknownSchema = object({
+	subject: string(),
+	reason: string()
+});
+var StaleDataReportSchema = object({
+	/** Epoch ms of the last finished scan; `null` before the first. */
+	scannedAt: number$1().nullable(),
+	scanning: boolean(),
+	trigger: _enum([
+		"boot",
+		"interval",
+		"manual"
+	]).nullable(),
+	kinds: array(StaleKindFindingSchema),
+	settingsKeys: array(StaleSettingsKeyFindingSchema),
+	unknown: array(StaleUnknownSchema)
+});
 method(object({ ownerPrefix: string().min(1).optional() }), object({ tables: array(StorageTableSchema) }), { auth: "admin" }), method(object({
 	owner: string().min(1).optional(),
 	/** `false` skips the per-kind row count (a catalog read only). Default true. */
@@ -21825,7 +22356,30 @@ method(object({ ownerPrefix: string().min(1).optional() }), object({ tables: arr
 }), object({ kinds: array(StorageKindSchema) }), { auth: "admin" }), method(RecordQueryInputSchema.extend({
 	owner: string().min(1),
 	kind: RecordKindNameSchema
-}), RecordQueryResultSchema, { auth: "admin" });
+}), RecordQueryResultSchema, { auth: "admin" }), method(object({}), StaleDataReportSchema, { auth: "admin" }), method(object({}), StaleDataReportSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	owner: string().min(1),
+	kind: RecordKindNameSchema
+}), object({
+	deleted: number$1().int().nonnegative(),
+	secretsReleased: number$1().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({
+	addonId: string().min(1),
+	key: string().min(1)
+}), object({
+	removed: boolean(),
+	secretsCleared: number$1().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+});
 /**
 * record-entries - the ONE admin surface for every list of user-created entries
 * (D881): notification targets, brokers, LLM profiles, anything an addon
@@ -21964,6 +22518,12 @@ method(object({
 }), method(object({ deviceId: number$1().int() }), object({ refs: array(string()).readonly() }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	refs: RefListSchema,
+	onBehalfOf: string().min(1)
+}), object({ released: number$1().int() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({}), array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }), method(object({}), KeychainStateSchema, { auth: "admin" });
 /**
 * device-history — the ONE mechanism for numeric history (D850).
@@ -22753,7 +23313,9 @@ var DiscoveredChildDeviceSchema = lazy(() => object({
 	/** Upstream-system identity + rendering hints for the candidate. */
 	sourceInfo: SourceInfoSchema.optional(),
 	/** Nested entity-children for accordion preview — integrations populate, Hubs omit. */
-	children: array(DiscoveredChildDeviceSchema).readonly().optional()
+	children: array(DiscoveredChildDeviceSchema).readonly().optional(),
+	/** `childNativeId` of the gateway candidate in the same list this device sits behind. */
+	parentStableId: string().optional()
 }));
 /**
 * Status block — populated by the integration after each
@@ -43136,6 +43698,79 @@ object({
 	metadata: record(string(), unknown()).optional()
 });
 /**
+* HOW a provider can be found on the network. The provider only DECLARES the
+* mode; the `local-network` scan engine runs it once for every provider that
+* asked (one multicast browse, one host sweep) and hands the raw hits back to
+* `classifyDiscoveryHits`. A provider never opens a discovery socket itself,
+* except through a `custom` mode.
+*/
+var DiscoveryModeSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("mdns"),
+		/** DNS-SD service type, e.g. `_esphomelib._tcp`. */
+		serviceType: string().min(1),
+		/** Regular expression an instance name must match (case-insensitive). */
+		instancePattern: string().optional()
+	}),
+	object({
+		kind: literal("ws-discovery"),
+		/** Probe types (e.g. `dn:NetworkVideoTransmitter`); omitted = any device. */
+		types: array(string()).optional()
+	}),
+	object({
+		kind: literal("ssdp"),
+		searchTarget: string().min(1)
+	}),
+	object({
+		kind: literal("udp-broadcast"),
+		port: number$1().int().min(1).max(65535),
+		payloadHex: string().regex(/^([0-9a-fA-F]{2})*$/),
+		/** Port replies arrive on, when the device answers somewhere other than the source port. */
+		listenPort: number$1().int().min(1).max(65535).optional()
+	}),
+	object({
+		kind: literal("http-probe"),
+		port: number$1().int().min(1).max(65535),
+		path: string().startsWith("/"),
+		method: _enum(["GET", "POST"]).default("GET"),
+		bodyText: string().optional(),
+		contentType: string().optional(),
+		tls: boolean().default(false),
+		/** Status codes that count as a hit. Omitted = any HTTP answer. */
+		acceptStatus: array(number$1().int()).optional()
+	}),
+	object({
+		kind: literal("custom"),
+		/** Why the engine cannot do it (an allowlisted exception, e.g. a vendor UDP protocol). */
+		reason: string().min(1)
+	})
+]);
+/** What the engine saw on the wire for ONE declared mode; the provider classifies it. */
+var DiscoveryHitSchema = object({
+	/** Index into the provider's own `getDiscoveryModes()` array. */
+	modeIndex: number$1().int().min(0),
+	host: string(),
+	port: number$1().int(),
+	http: object({
+		status: number$1().int(),
+		headers: record(string(), string()),
+		/** At most 16 KiB. */
+		bodyText: string()
+	}).optional(),
+	mdns: object({
+		instance: string(),
+		host: string(),
+		port: number$1().int(),
+		txt: record(string(), string())
+	}).optional(),
+	udp: object({ payloadHex: string() }).optional(),
+	wsd: object({
+		xaddrs: array(string()),
+		types: array(string()),
+		scopes: array(string())
+	}).optional()
+});
+/**
 * Candidate handed back from discovery and accepted by
 * `adoptDiscoveredDevice`. Shape mirrors the in-process
 * `DiscoveredDevice` interface used by `DeviceDiscovery`.
@@ -43170,7 +43805,17 @@ var DiscoveryCandidateSchema = object({
 	/** Numeric id of the device this candidate was matched to. Set with `alreadyOnboarded`. */
 	onboardedDeviceId: number$1().optional(),
 	/** Operator-facing name of the matched device, so the UI can say WHICH one it is. */
-	onboardedName: string().optional()
+	onboardedName: string().optional(),
+	/**
+	* This candidate is an INTEGRATION to set up (a gateway, a hub, a controller),
+	* not a device to adopt. Replaces the `prefilledConfig.setupIntegration` marker,
+	* which is still read for one release.
+	*/
+	setupIntegration: boolean().optional(),
+	/** `stableId` of the gateway candidate this device was found BEHIND. */
+	parentStableId: string().optional(),
+	/** `false` = shown for context but not pickable. Default true. */
+	selectable: boolean().optional()
 });
 /**
 * Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
@@ -43267,6 +43912,24 @@ var deviceProviderCapability = {
 			auth: "admin"
 		}),
 		/**
+		* How this provider is found on the network. `[]` = the provider has no
+		* declarative mode and keeps answering `discoverDevices` itself.
+		*/
+		getDiscoveryModes: method(object({}), array(DiscoveryModeSchema)),
+		/**
+		* Turn the engine's raw hits into candidates. The provider may make
+		* follow-up UNICAST requests to a hit host (an authenticated call, an
+		* identity check) and never sweeps a subnet. `params` is the per-scan form
+		* from `getDiscoveryParamsSchema`.
+		*/
+		classifyDiscoveryHits: method(object({
+			hits: array(DiscoveryHitSchema),
+			params: record(string(), unknown()).optional()
+		}), array(DiscoveryCandidateSchema), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Optional form schema (`ConfigUISchema`) for the EXTRA per-scan inputs a
 		* provider accepts (e.g. Gree's broadcast address for a different subnet).
 		* `null` when the provider takes no extra scan params — the generic
@@ -44031,17 +44694,23 @@ method(object({
 }), method(object({}), object({ providers: array(object({
 	addonId: string(),
 	label: string()
-})).readonly() }), { auth: "admin" }), method(object({}), object({ groups: array(object({
-	addonId: string(),
-	label: string(),
-	candidates: array(DiscoveryCandidateSchema).readonly(),
-	error: string().nullable()
-})).readonly() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
+})).readonly() }), { auth: "admin" }), method(
+	/** `subnets`: extra CIDRs for THIS scan, on top of the hub's own and the saved list. */
+	object({ subnets: array(string()).optional() }),
+	object({ groups: array(object({
+		addonId: string(),
+		label: string(),
+		candidates: array(DiscoveryCandidateSchema).readonly(),
+		error: string().nullable()
+	})).readonly() }),
+	{
+		kind: "mutation",
+		auth: "admin"
+	}
+), method(object({
 	addonId: string(),
-	params: record(string(), unknown()).optional()
+	params: record(string(), unknown()).optional(),
+	subnets: array(string()).optional()
 }), object({ candidates: array(DiscoveryCandidateSchema).readonly() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -63392,7 +64061,9 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 	id: string(),
 	settings: record(string(), unknown()),
 	/** Keys the form's schema declares secret (by type) — keychain-stored (D787). */
-	secretKeys: array(string()).optional()
+	secretKeys: array(string()).optional(),
+	/** The integration's own addon applies the change in-process and asks the hub not to respawn it. */
+	skipRestart: boolean().optional()
 }), object({ success: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -64020,6 +64691,39 @@ var TlsStatusSchema = object({
 		hasCa: boolean()
 	}).nullable()
 });
+/** One provider's ask of the scan engine: the modes it declared. */
+var ScanRequestSchema = object({
+	providerId: string().min(1),
+	modes: array(DiscoveryModeSchema)
+});
+var ScanErrorSchema = object({
+	/** Absent for a failure that is the scan's own (a bad subnet, a socket that would not open). */
+	providerId: string().optional(),
+	/** The mode family that failed (`mdns`, `http-probe`, …). */
+	mode: string().optional(),
+	message: string()
+});
+/** What one scan did, per mode family; the engine logs the same numbers once. */
+var ScanStatsSchema = object({
+	hostsProbed: number$1().int(),
+	hits: number$1().int(),
+	timeouts: number$1().int(),
+	byMode: record(string(), object({
+		probed: number$1().int(),
+		hits: number$1().int(),
+		timeouts: number$1().int()
+	}))
+});
+var ScanNetworkResultSchema = object({
+	hits: array(object({
+		providerId: string(),
+		hit: DiscoveryHitSchema
+	})),
+	/** CIDRs actually covered: the hub's own /24s, the saved list and the per-call list. */
+	subnetsScanned: array(string()),
+	errors: array(ScanErrorSchema),
+	stats: ScanStatsSchema
+});
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
 	/**
 	* LEGACY HINT — do not send from new code. Kept optional so clients
@@ -64074,6 +64778,16 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 }), method(_void(), object({ pem: string() })), method(_void(), TlsStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	requests: array(ScanRequestSchema),
+	subnets: array(string()).optional()
+}), ScanNetworkResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 9e4
+}), method(_void(), object({ subnets: array(string()) }), { auth: "admin" }), method(object({ subnets: array(string()) }), object({ subnets: array(string()) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(_void(), TlsStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -73656,6 +74370,17 @@ var BaseDeviceProvider = class extends BaseAddon {
 	async discoverDevices(_input) {
 		return [];
 	}
+	/**
+	* How the scan engine finds this provider. Default `[]`: the provider is
+	* not migrated and keeps answering `discoverDevices` itself.
+	*/
+	async getDiscoveryModes() {
+		return [];
+	}
+	/** Turn the scan engine's raw hits into candidates. Default: none. */
+	async classifyDiscoveryHits(_input) {
+		return [];
+	}
 	/** Extra per-scan input form (e.g. a broadcast address for another subnet).
 	*  Null = no extra params. Override in providers that support scoped scans. */
 	async getDiscoveryParamsSchema() {
@@ -74524,6 +75249,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"addonSettings.getDeclaredSettingsKeys": {
+		capName: "addon-settings",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"addonSettings.getDeviceSettings": {
 		capName: "addon-settings",
 		capScope: "system",
@@ -74545,6 +75277,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"addonSettings.unsetStoredSettingsKeys": {
+		capName: "addon-settings",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"addonSettings.updateDeviceSettings": {
 		capName: "addon-settings",
 		capScope: "system",
@@ -76960,6 +77699,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"deviceProvider.classifyDiscoveryHits": {
+		capName: "device-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"deviceProvider.createDevice": {
 		capName: "device-provider",
 		capScope: "system",
@@ -76988,6 +77734,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"deviceProvider.getDiscoveryModes": {
+		capName: "device-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"deviceProvider.getDiscoveryParamsSchema": {
 		capName: "device-provider",
 		capScope: "system",
@@ -77765,6 +78518,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"keychain.releaseRecordRefs": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"keychain.resolve": {
 		capName: "keychain",
 		capScope: "system",
@@ -78185,6 +78945,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"localNetwork.getScanSubnets": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"localNetwork.getTlsStatus": {
 		capName: "local-network",
 		capScope: "system",
@@ -78234,6 +79001,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"localNetwork.scanNetwork": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"localNetwork.setAddressRole": {
 		capName: "local-network",
 		capScope: "system",
@@ -78255,6 +79029,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"localNetwork.setScanSubnets": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"localNetwork.setViewerEndpoints": {
 		capName: "local-network",
 		capScope: "system",
@@ -82476,6 +83257,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"storageAdmin.dropOrphanedKind": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
 	"storageAdmin.listKinds": {
 		capName: "storage-admin",
 		capScope: "system",
@@ -82497,6 +83285,27 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"storageAdmin.scanStaleData": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"storageAdmin.staleDataReport": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"storageAdmin.unsetStaleSettingsKey": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"storageEvictable.evict": {
 		capName: "storage-evictable",
 		capScope: "system",
@@ -92770,12 +93579,22 @@ function rewriteBody(body, kind, currentUpstream, route) {
 /**
 * A vendor `Set-Cookie` for the browser: no `Domain` (the cookie belongs to the hub
 * origin), `Path` narrowed to this attempt's prefix, `Secure` kept (the hub is HTTPS).
-*/
-function rewriteSetCookie(cookie, route) {
-	const kept = cookie.split(";").map((part) => part.trim()).filter((part, index) => {
+* `browserSafe` (the server keeps its own jar, so this copy only serves the page's script):
+* also no `Secure` / `SameSite`, which a plain-http hub makes the browser refuse, and no
+* `__Host-` / `__Secure-` cookie, whose rules a narrowed Path breaks.
+*/
+function rewriteSetCookie(cookie, route, options = {}) {
+	const parts = cookie.split(";").map((part) => part.trim());
+	const dropped = options.browserSafe === true ? [
+		"domain",
+		"path",
+		"secure",
+		"samesite"
+	] : ["domain", "path"];
+	const kept = parts.filter((part, index) => {
 		if (index === 0) return true;
 		const name = part.split("=")[0]?.trim().toLowerCase() ?? "";
-		return name !== "domain" && name !== "path";
+		return !dropped.includes(name);
 	});
 	kept.push(`Path=${route.basePath}/`);
 	return kept.join("; ");
@@ -92786,10 +93605,10 @@ function rewriteSetCookie(cookie, route) {
 * one, so a past-dated set that only deleted the other domain's copy would delete the
 * live one the same response just set: that deletion is dropped.
 */
-function rewriteSetCookies(cookies, route) {
+function rewriteSetCookies(cookies, route, options = {}) {
 	const now = Date.now();
 	const liveNames = new Set(cookies.filter((c) => !isExpiredCookie(c, now)).map(cookieName));
-	return cookies.filter((c) => !(isExpiredCookie(c, now) && liveNames.has(cookieName(c)))).map((c) => rewriteSetCookie(c, route));
+	return cookies.filter((c) => !(isExpiredCookie(c, now) && liveNames.has(cookieName(c)))).filter((c) => options.browserSafe !== true || !/^__(?:host|secure)-/i.test(cookieName(c))).map((c) => rewriteSetCookie(c, route, options));
 }
 function cookieName(cookie) {
 	return cookie.split(";")[0]?.split("=")[0]?.trim() ?? "";
@@ -92849,6 +93668,99 @@ function rewriteFormBody(body, route) {
 function filterForwardedCookies(cookieHeader) {
 	return cookieHeader.split(";").map((part) => part.trim()).filter((part) => part.length > 0 && !part.toLowerCase().startsWith("camstack_")).join("; ");
 }
+/**
+* Server-side cookie jar of ONE vendor sign-in attempt (D955).
+*
+* A vendor login (an identity provider's cookie/JS check page) refuses a flow that arrives
+* without the cookies it set a step earlier. Relying on the browser to store them under the
+* hub origin loses them whenever the browser refuses the rewritten cookie (a `Secure` cookie
+* on a plain-http hub, a `__Host-` name with a narrowed Path, a `SameSite=None` without
+* `Secure`). The proxy therefore keeps every vendor cookie itself and sends them upstream,
+* whatever the browser did. Values never leave this object except as the upstream `Cookie`
+* header; nothing here logs.
+*/
+function attributeValue(attrs, name) {
+	const found = attrs.find((a) => a.split("=")[0]?.trim().toLowerCase() === name);
+	if (found === void 0) return void 0;
+	const eq = found.indexOf("=");
+	return eq === -1 ? "" : found.slice(eq + 1).trim();
+}
+function hasFlag(attrs, name) {
+	return attrs.some((a) => a.toLowerCase() === name);
+}
+function expiryOf(attrs, nowMs) {
+	const maxAge = attributeValue(attrs, "max-age");
+	if (maxAge !== void 0 && maxAge.length > 0 && Number.isFinite(Number(maxAge))) return nowMs + Number(maxAge) * 1e3;
+	const expires = attributeValue(attrs, "expires");
+	if (expires === void 0) return null;
+	const at = Date.parse(expires);
+	return Number.isFinite(at) ? at : null;
+}
+function defaultPath(requestPath) {
+	const last = requestPath.lastIndexOf("/");
+	return last <= 0 ? "/" : requestPath.slice(0, last);
+}
+function pathMatches(cookiePath, requestPath) {
+	if (requestPath === cookiePath) return true;
+	if (!requestPath.startsWith(cookiePath)) return false;
+	return cookiePath.endsWith("/") || requestPath.charAt(cookiePath.length) === "/";
+}
+function hostMatches(cookie, host) {
+	if (cookie.domain === null) return cookie.originHost === host;
+	const bare = hostWithoutPort(host);
+	return bare === cookie.domain || bare.endsWith(`.${cookie.domain}`);
+}
+var VendorCookieJar = class {
+	#cookies = /* @__PURE__ */ new Map();
+	/** Store (or delete, when expired) the cookies of one upstream response. */
+	store(setCookies, origin, nowMs) {
+		for (const raw of setCookies) {
+			const [first, ...rest] = raw.split(";").map((part) => part.trim());
+			const eq = first?.indexOf("=") ?? -1;
+			if (first === void 0 || eq <= 0) continue;
+			const name = first.slice(0, eq);
+			const attrs = rest;
+			const domainAttr = attributeValue(attrs, "domain");
+			const domain = domainAttr === void 0 || domainAttr.length === 0 ? null : domainAttr.replace(/^\./, "").toLowerCase();
+			const pathAttr = attributeValue(attrs, "path");
+			const path = pathAttr !== void 0 && pathAttr.startsWith("/") ? pathAttr : defaultPath(origin.pathname);
+			const originBare = hostWithoutPort(origin.host);
+			if (domain !== null && originBare !== domain && !originBare.endsWith(`.${domain}`)) continue;
+			const expiresAtMs = expiryOf(attrs, nowMs);
+			const key = `${name}|${domain ?? origin.host}|${path}`;
+			if (expiresAtMs !== null && expiresAtMs <= nowMs) {
+				this.#cookies.delete(key);
+				continue;
+			}
+			this.#cookies.set(key, {
+				name,
+				value: first.slice(eq + 1),
+				originHost: origin.host,
+				domain,
+				path,
+				secure: hasFlag(attrs, "secure"),
+				expiresAtMs
+			});
+		}
+	}
+	/** The `Cookie` header value for a request to `host` + `pathname`, or null when none applies. */
+	headerFor(target, nowMs) {
+		const secureOk = target.scheme === "https" || isLoopbackHost(target.host);
+		const matching = [...this.#cookies.values()].filter((c) => (c.expiresAtMs === null || c.expiresAtMs > nowMs) && (!c.secure || secureOk) && hostMatches(c, target.host) && pathMatches(c.path, target.pathname)).sort((a, b) => b.path.length - a.path.length);
+		if (matching.length === 0) return null;
+		return matching.map((c) => `${c.name}=${c.value}`).join("; ");
+	}
+};
+/** Cookie names carried by a `Cookie` header value. */
+function cookieHeaderNames(header) {
+	return new Set(header.split(";").map((part) => part.split("=")[0]?.trim() ?? "").filter((name) => name.length > 0));
+}
+/** `browser` cookies not shadowed by the jar's, then the jar's: the jar is the truth. */
+function mergeCookieHeaders(browser, jar) {
+	if (jar === null) return browser;
+	const shadowed = cookieHeaderNames(jar);
+	return [...browser.split(";").map((part) => part.trim()).filter((part) => part.length > 0 && !shadowed.has(part.split("=")[0]?.trim() ?? "")), jar].join("; ");
+}
 /** A short stable label for the attempt: enough to group lines, useless as a capability. */
 function attemptLabel(attemptId) {
 	let hash = 2166136261;
@@ -93044,6 +93956,7 @@ var VendorLoginProxy = class {
 		this.#attempts.set(spec.attemptId, {
 			expiresAtMs: spec.expiresAtMs,
 			upstreams: spec.upstreams,
+			jar: spec.serverCookieJar === true ? new VendorCookieJar() : null,
 			evaluate: async (view) => {
 				const verdict = await spec.terminal(view);
 				if (verdict.kind === "continue") return verdict;
@@ -93140,7 +94053,7 @@ var VendorLoginProxy = class {
 				body = Buffer.from(rewriteFormBody(formBodyRaw, route), "utf8");
 			} else body = read;
 		}
-		const headers = this.#requestHeaders(req, route, upstream);
+		const headers = this.#requestHeaders(req, route, upstream, attempt.jar, target);
 		const upstreamRes = await this.#fetch(target, {
 			method,
 			headers,
@@ -93149,6 +94062,10 @@ var VendorLoginProxy = class {
 		});
 		const location = upstreamRes.headers.get("location");
 		const setCookies = upstreamRes.headers.getSetCookie();
+		attempt.jar?.store(setCookies, {
+			host: upstream.host,
+			pathname: target.pathname
+		}, this.#now());
 		const kind = bodyKindOf(upstreamRes.headers.get("content-type") ?? "");
 		const declaredLength = Number(upstreamRes.headers.get("content-length") ?? "0");
 		const text = kind !== null && !(declaredLength > MAX_TEXT_BODY_BYTES) && method !== "HEAD" ? await upstreamRes.text() : null;
@@ -93196,7 +94113,7 @@ var VendorLoginProxy = class {
 		upstreamRes.headers.forEach((value, name) => {
 			if (!DROP_RESPONSE_HEADERS.has(name.toLowerCase())) out[name] = value;
 		});
-		if (setCookies.length > 0) out["set-cookie"] = rewriteSetCookies(setCookies, route);
+		if (setCookies.length > 0) out["set-cookie"] = rewriteSetCookies(setCookies, route, { browserSafe: attempt.jar !== null });
 		if (location !== null) out["location"] = rewriteLocation(location, upstream, route);
 		out["cache-control"] = "no-store";
 		if (text !== null && kind !== null) {
@@ -93218,15 +94135,19 @@ var VendorLoginProxy = class {
 			...flowTraceMeta(input)
 		} });
 	}
-	#requestHeaders(req, route, upstream) {
+	#requestHeaders(req, route, upstream, jar, target) {
 		const headers = {};
 		for (const [name, value] of Object.entries(req.headers)) {
 			const lower = name.toLowerCase();
 			if (DROP_REQUEST_HEADERS.has(lower) || value === void 0) continue;
 			headers[lower] = Array.isArray(value) ? value.join(", ") : value;
 		}
-		const cookie = filterForwardedCookies(firstHeader(req.headers["cookie"]) ?? "");
-		if (cookie.length > 0) headers["cookie"] = cookie;
+		const merged = mergeCookieHeaders(filterForwardedCookies(firstHeader(req.headers["cookie"]) ?? ""), jar?.headerFor({
+			host: upstream.host,
+			pathname: target.pathname,
+			scheme: upstream.scheme
+		}, this.#now()) ?? null);
+		if (merged.length > 0) headers["cookie"] = merged;
 		if (req.headers["origin"] !== void 0) headers["origin"] = `${upstream.scheme}://${upstream.host}`;
 		const referer = firstHeader(req.headers["referer"]);
 		if (referer !== void 0) {
@@ -136249,10 +137170,6 @@ var AlexaRemoteClient = class {
 			if (isAuthError(message)) throw new AlexaAuthError(message);
 			throw err;
 		}
-		if (remote.getAuthenticationDetails().authenticated !== true) {
-			this.#connected = false;
-			throw new AlexaAuthError("account not authenticated (cookie/refresh token rejected or expired)");
-		}
 		this.#connected = true;
 		await this.#persistSession(remote);
 	}
@@ -136988,7 +137905,7 @@ function buildAlexaBrokerProvider(deps) {
 				label: "Alexa",
 				signIn: {
 					basePath: "/addon/import-alexa/login",
-					methods: ["device-code", "proxy"]
+					methods: ["device-code"]
 				}
 			}]
 		}],
@@ -138172,6 +139089,15 @@ var BrokerEcho = class {
 		try {
 			const seed = await this.deps.readSeed();
 			const stored = await sessions.get(brokerId);
+			logger.info("alexa speak: broker sign-in material", {
+				...tags,
+				meta: {
+					seedFound: seed !== null,
+					hasRefreshToken: seed !== null && seed.refreshToken.length > 0,
+					hasDeviceAppName: seed !== null && seed.deviceAppName.length > 0,
+					hasStoredSession: stored.length > 0
+				}
+			});
 			if (seed === null && stored.length === 0) {
 				this.currentState = "broker-not-signed-in";
 				this.currentError = null;
@@ -139774,22 +140700,6 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 				labelKey: "import-alexa:globalSettings.s_alexa-account.accountHelp.label",
 				content: "This integration links to an Amazon Alexa account broker. Add, edit, or remove accounts from External systems → Brokers, then adopt the imported devices. The integration only stores a reference to its broker. NOTE: this is an unofficial integration that Amazon can change or break without notice."
 			}]
-		}, {
-			id: "alexa-proxy-login",
-			title: "Interactive login (proxy)",
-			titleKey: "import-alexa:globalSettings.s_alexa-proxy-login.title",
-			description: "The \"Sign in\" button in onboarding opens the real Amazon login page through this hub (same address and HTTPS as this page) and captures the cookie after you complete it (incl. 2FA). The port below is only used on the hub itself and is never exposed.",
-			descriptionKey: "import-alexa:globalSettings.s_alexa-proxy-login.description",
-			columns: 2,
-			fields: [{
-				type: "number",
-				key: "proxyLogin.proxyPort",
-				label: "Internal login port (loopback)",
-				labelKey: "import-alexa:globalSettings.s_alexa-proxy-login.proxyLogin_proxyPort.label",
-				min: 1,
-				max: 65535,
-				default: 3456
-			}]
 		}] });
 	}
 	async supportsManualCreation() {