@camstack/addon-import-alexa 0.2.183 → 0.2.185

package/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.185] - 2026-11-04
+
+### Changed
+
+- Alexa starts without waiting for the first appliance list and state poll, so a large account no longer exceeds the runner init budget during an update
+- Alexa broker migrations no longer read as 'skipped-newer' (and no false 'Database is newer' alert) after the addon boots
+
+## [0.2.184] - 2026-11-04
+
+### Changed
+
+- The integration states its role (devices, services or both) to the Integrations page
+
 ## [0.2.183] - 2026-11-04
 
 ### Changed

package/dist/addon.js

@@ -6044,7 +6044,7 @@ function number(params) {
 	return /* @__PURE__ */ _coercedNumber(ZodNumber, params);
 }
 //#endregion
-//#region ../types/dist/sleep-BkzQdpzF.mjs
+//#region ../types/dist/sleep-Cv4Zmie9.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6644,7 +6644,7 @@ var NOT_RUN = {
 * throws: an unreachable or refusing engine is logged and reported `declared: false`,
 * because the hub (and this addon's boot) must not hang on a migration.
 */
-async function runAddonMigrations(host, migrations, logger) {
+async function runAddonMigrations(host, migrations, logger, options = {}) {
 	const first = migrations[0];
 	if (first === void 0) return NOT_RUN;
 	const owner = first.meta.owner;
@@ -6673,7 +6673,9 @@ async function runAddonMigrations(host, migrations, logger) {
 		else if (status === "blocked") blocked.push(id);
 		else skipped.push(id);
 	};
+	const selected = options.only === void 0 ? null : new Set(options.only);
 	for (const step of declaration.steps) {
+		if (selected !== null && !selected.has(step.id)) continue;
 		const bound = byId.get(step.id);
 		if (bound === void 0 || step.action === "skip") {
 			skipped.push(step.id);
@@ -7833,14 +7835,18 @@ var BaseAddon = class {
 	* nothing; the boot continues. A migration that FAILED (or was blocked by one)
 	* and declares `onFailure: 'block-owner'` makes this throw, so the addon does not
 	* serve data whose shape it cannot trust; `tolerate` migrations never do.
+	*
+	* ALWAYS pass the whole catalogue; a phase that must run only some of it passes
+	* `{ only: [ids] }` — never a filtered catalogue (the engine would judge the
+	* omitted applied ids "newer").
 	*/
-	async runMigrations(migrations) {
+	async runMigrations(migrations, options) {
 		const api = this.ctx.api.migrations;
 		const report = await runAddonMigrations({
 			declareOwner: (input) => api.declareOwner.mutate(input),
 			startMigration: (input) => api.startMigration.mutate(input),
 			finishMigration: (input) => api.finishMigration.mutate(input)
-		}, migrations, this.ctx.logger);
+		}, migrations, this.ctx.logger, options);
 		if (report.blockOwner.length > 0) throw new AddonMigrationsBlockedError(report.blockOwner);
 		return report;
 	}
@@ -8880,6 +8886,10 @@ var RECORD_SECRET_COLLECTION_PREFIX = "records:";
 * (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
 * (`auth.accessToken`, `headers[].value`).
 *
+* `{}` after a key means "each value of this map" (`applianceSecrets{}`): the map's own key
+* names the value (`applianceSecrets{fridge}`), so no id key is declared and a body that drops a
+* key releases exactly that key's secret.
+*
 * Array elements are matched by a DECLARED id key (`secretArrayKeys`:
 * `{ headers: 'name' }`), never by index, so reordering a list keeps every
 * keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
@@ -8892,11 +8902,13 @@ function parseSecretPath(path) {
 	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
 	return path.split(".").map((raw) => {
 		const each = raw.endsWith("[]");
-		const key = each ? raw.slice(0, -2) : raw;
+		const map = raw.endsWith("{}");
+		const key = each || map ? raw.slice(0, -2) : raw;
 		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
 		return {
 			key,
-			each
+			each,
+			map
 		};
 	});
 }
@@ -8948,6 +8960,22 @@ function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arra
 			[segment.key]: mapped
 		};
 	}
+	if (segment.map) {
+		if (!isRecord$4$1(child)) return node;
+		const kept = Object.entries(child).map(([mapKey, value]) => {
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}{${encodeURIComponent(mapKey)}}`;
+			if (!last) return [mapKey, mapAt(value, segments, index + 1, keys, concrete, declared, arrayKeys, visit)];
+			return [mapKey, visit({
+				declared,
+				concrete,
+				value
+			})];
+		}).filter(([, value]) => value !== REMOVE_LEAF);
+		return {
+			...node,
+			[segment.key]: Object.fromEntries(kept)
+		};
+	}
 	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
 	if (last) {
 		const replacement = visit({
@@ -9089,7 +9117,8 @@ function isZodSecret(schema) {
 }
 /**
 * Every declared secret path in a config schema: dotted keys, `[]` for "each
-* element of this array" (`connection.password`, `rows[].token`). A declared
+* element of this array" (`connection.password`, `rows[].token`), `{}` for "each value of this
+* map" (`applianceSecrets{}`). A declared
 * object or array is reported as one path and not descended into — everything
 * under it is secret.
 */
@@ -9100,6 +9129,7 @@ function collectZodSecretPaths(schema, prefix = "") {
 		const def = defOf(layer);
 		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
 		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "record" && def.valueType) paths.push(...collectZodSecretPaths(def.valueType, `${prefix}{}`));
 		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
 		else if (def.type === "intersection") {
 			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
@@ -13414,11 +13444,49 @@ function buildCapturingReply(envelope) {
 	};
 	return wrapper;
 }
+/**
+* `RecordIntegrationInstances` - the `integration-instances` provider over ONE
+* entry kind, so an addon that holds a connection serves it in ~30 lines.
+*
+* Every instance is one record of the addon's own kind, keyed by the
+* `integrations` registry id. The records door does the secret work: a field the
+* kind marks `.meta({ secret: true })` is a keychain marker bound to the row, so
+* deleting the row deletes the secret, and one row's value is never another's.
+*
+* Patch rules for a secret (`updateInstance`): omitted, `''`, the redaction
+* token or the view the form was given KEEP the stored secret;
+* `{ $secretClear: true }` clears it; any other string replaces it.
+*/
 /** The most instances one addon lists (an integrations page, not a table). */
 var INSTANCES_LIST_MAX = 1e3;
 /** The keys of the kind's secret fields that sit at the top level of the body. */
 function topLevelSecretKeys(paths) {
-	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[")));
+	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[") && !p.includes("{")));
+}
+/** The keys of the kind's top-level MAPS whose values are secrets (`applianceSecrets{}`). */
+function secretMapKeys(paths) {
+	return new Set(paths.filter((p) => p.endsWith("{}") && !p.slice(0, -2).match(/[.[{]/)).map((p) => p.slice(0, -2)));
+}
+/**
+* A patch value for a map of secrets: an entry that is omitted, `''`, the redaction token or the
+* view the form was given KEEPS its stored secret (it is left out of the merge); `{ $secretClear }`
+* or `null` removes the entry; any other string replaces it. Null when nothing is left to merge.
+*/
+function secretMapPatch(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) if (entry === null || isSecretClear(entry)) out[key] = null;
+	else if (typeof entry === "string" && entry !== "" && entry !== "__camstack_redacted__" && !isSecretFieldView(entry)) out[key] = entry;
+	return Object.keys(out).length > 0 ? out : null;
+}
+/** Does the kind's body schema carry an `enabled` field? */
+function declaresEnabled(kind) {
+	const json = toJSONSchema(kind.schema, {
+		unrepresentable: "any",
+		io: "input"
+	});
+	const properties = Reflect.get(json, "properties");
+	return typeof properties === "object" && properties !== null && "enabled" in properties;
 }
 var RecordIntegrationInstances = class {
 	records;
@@ -13426,14 +13494,20 @@ var RecordIntegrationInstances = class {
 	hooks;
 	handle;
 	secretKeys;
+	secretMaps;
 	nameField;
+	/** The `integrations` registry owns the on/off switch (`role: devices`); the body has none. */
+	registryOwnsEnabled;
 	constructor(records, kind, hooks) {
 		this.records = records;
 		this.kind = kind;
 		this.hooks = hooks;
 		this.handle = records.kind(kind);
 		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
+		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
 		this.nameField = kind.declaration.entry?.nameField ?? "name";
+		this.registryOwnsEnabled = hooks.description.role === "devices";
+		if (this.registryOwnsEnabled && declaresEnabled(kind)) throw new Error(`kind "${kind.name}": the integrations registry owns the on/off switch of a role "devices" addon, so the body must not declare "enabled"`);
 	}
 	/**
 	* One instance read for the addon's own runtime; null when absent. When the keychain is
@@ -13484,7 +13558,7 @@ var RecordIntegrationInstances = class {
 			id: record.id,
 			name: typeof rawName === "string" ? rawName : record.id,
 			configured: this.hooks.configured(record.data),
-			enabled: record.data.enabled !== false,
+			...this.registryOwnsEnabled ? {} : { enabled: record.data.enabled !== false },
 			formValues: shown,
 			...kind !== void 0 ? { kind } : {},
 			...health?.status !== void 0 ? { status: health.status } : {},
@@ -13514,32 +13588,36 @@ var RecordIntegrationInstances = class {
 			id: minted,
 			data: this.hooks.initialBody(name, kind)
 		}, { ifRev: 0 });
-		await this.hooks.onChanged?.(minted);
+		await this.hooks.onChanged?.(minted, "created");
 		return { id: minted };
 	};
 	updateInstance = async ({ id, name, values }) => {
 		const patch = {};
 		for (const [key, value] of Object.entries(values)) {
 			if (value === void 0) continue;
-			if (!this.secretKeys.has(key)) patch[key] = value;
+			if (this.secretMaps.has(key)) {
+				const entries = secretMapPatch(value);
+				if (entries !== null) patch[key] = entries;
+			} else if (!this.secretKeys.has(key)) patch[key] = value;
 			else if (isSecretClear(value)) patch[key] = null;
 			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
 		}
 		if (name !== void 0) patch[this.nameField] = name;
 		await this.handle.patch(id, patch);
-		await this.hooks.onChanged?.(id);
+		await this.hooks.onChanged?.(id, "updated");
 		return { ok: true };
 	};
 	/** The switch lives in the record body; the addon is told so it applies it (D996). */
 	setInstanceEnabled = async ({ id, enabled }) => {
+		if (this.registryOwnsEnabled) throw new Error(`instance "${id}": the integrations registry owns the on/off switch of this addon; set it with integrations.update`);
 		await this.handle.patch(id, { enabled });
-		await this.hooks.onChanged?.(id);
+		await this.hooks.onChanged?.(id, "enabled");
 		return { ok: true };
 	};
 	/** The row and its keychain refs go together (the records door). */
 	deleteInstance = async ({ id }) => {
 		await this.handle.delete(id);
-		await this.hooks.onChanged?.(id);
+		await this.hooks.onChanged?.(id, "deleted");
 		return { ok: true };
 	};
 	testInstance = async (input) => {
@@ -14600,7 +14678,13 @@ var MigrationLedgerEntrySchema = object({
 	* joined by the engine from the catalogues it knows this boot. Absent when no
 	* catalogue lists the id (a newer database).
 	*/
-	meta: MigrationMetaSchema.optional()
+	meta: MigrationMetaSchema.optional(),
+	/**
+	* Set when this is an applied row of an addon owner whose catalogue the answering
+	* process has not loaded (the owner has not declared yet): the row is applied, the
+	* process just cannot judge it. Never `skipped-newer` — that needs the owner loaded.
+	*/
+	ownerNotLoaded: boolean().optional()
 });
 /** A catalogued migration that is not applied, with where it stands. */
 var MigrationPendingEntrySchema = object({
@@ -56307,6 +56391,21 @@ var IntegrationInstanceKindSchema = object({
 	disconnectPath: string().min(1).optional()
 });
 var IntegrationInstanceDescriptionSchema = object({
+	/** What the instances are for the Integrations page; see {@link IntegrationInstanceRoleSchema}. */
+	role: _enum([
+		"devices",
+		"services",
+		"both"
+	]),
+	/** How the devices of an instance are found; absent means `{ mode: 'none' }`. */
+	discovery: object({
+		mode: _enum([
+			"none",
+			"lan",
+			"account"
+		]),
+		scopedToInstance: boolean()
+	}).optional(),
 	/** `single`: at most one instance can exist (Loki). `multiple`: an account each. */
 	instanceMode: IntegrationInstanceModeSchema,
 	/** What the instance is, for the UI (`destination`, `relay`, `account`). */
@@ -56346,10 +56445,11 @@ var IntegrationInstanceSchema = object({
 	/** The addon's own rule (an URL is present, a client id is present...). */
 	configured: boolean(),
 	/**
-	* The instance's own on/off switch (D996): always present, derived from the record body
-	* (`enabled !== false`, so a row written before the field existed is on).
+	* The instance's own on/off switch (D996), derived from the record body (`enabled !== false`,
+	* so a row written before the field existed is on). Absent when the `integrations` registry
+	* owns the switch (`describe().role` is `devices`): read it from the registry row.
 	*/
-	enabled: boolean(),
+	enabled: boolean().optional(),
 	/** The kind of this instance (one of `describe().kinds[].id`), when the provider has kinds. */
 	kind: string().optional(),
 	/** Values for the instance form; a secret is a `SecretFieldView`, never text. */
@@ -141550,10 +141650,8 @@ var AlexaIntegrationManager = class {
 			this.#status = "connected";
 			this.#lastCheckedAt = Date.now();
 			this.#onConnected(this.#id);
-			await this.refreshAppliances();
-			await this.poll();
-			this.#schedulePoll();
 			this.#logger.info("AlexaIntegrationManager: started", { tags: { brokerId: this.#id } });
+			this.#firstSync(client);
 		} catch (err) {
 			if (err instanceof AlexaAuthError) {
 				this.#status = "auth-failed";
@@ -141574,6 +141672,24 @@ var AlexaIntegrationManager = class {
 			});
 		}
 	}
+	/** Background first refresh + poll, then the poll loop. Does nothing once `client` is stale. */
+	async #firstSync(client) {
+		let refreshed = false;
+		try {
+			await this.refreshAppliances();
+			refreshed = true;
+		} catch (err) {
+			this.#error = errMsg(err);
+			this.#logger.warn("AlexaIntegrationManager: first appliance refresh failed", {
+				tags: { brokerId: this.#id },
+				meta: { error: errMsg(err) }
+			});
+		}
+		if (this.#client !== client) return;
+		if (refreshed) await this.poll();
+		if (this.#client !== client) return;
+		this.#schedulePoll();
+	}
 	/** List the account's appliances + publish them to the resolver. */
 	async refreshAppliances() {
 		const client = this.#client;
@@ -143315,6 +143431,7 @@ function statusOf(info, configured) {
 function buildAlexaInstances(records, deps) {
 	return new RecordIntegrationInstances(records, alexaBrokersEntryKind, {
 		description: {
+			role: "both",
 			instanceMode: "multiple",
 			kind: "account",
 			canTest: true,
@@ -145027,7 +145144,7 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 			infoOf: (id) => this.registry?.get(id) ?? null,
 			onChanged: (id) => this.syncBrokerRuntime(id)
 		});
-		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS.filter((m) => m.meta.id === FLATTEN_BROKER_RECORDS_ID), this.migrationPorts(records)));
+		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, this.migrationPorts(records)), { only: [FLATTEN_BROKER_RECORDS_ID] });
 		this.activeBrokers = await this.loadPersistedBrokers();
 		this.registry = new AlexaBrokerRegistry(this.ctx.logger, {
 			dataDir: this.ctx.dataDir,
@@ -145072,7 +145189,7 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 			deviceCode: this.deviceCodeLogin,
 			commitCookie: (input) => this.commitCapturedCookie(input)
 		}), ...speakIconRoutes()];
-		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS.filter((m) => m.meta.id !== FLATTEN_BROKER_RECORDS_ID), this.migrationPorts(records)));
+		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, this.migrationPorts(records)), { only: ADDON_MIGRATIONS.map((m) => m.meta.id).filter((id) => id !== FLATTEN_BROKER_RECORDS_ID) });
 		const speak = new AlexaSpeakController({
 			logger: this.ctx.logger.child("speak"),
 			readConfig: () => this.config,

package/dist/addon.mjs

@@ -6042,7 +6042,7 @@ function number(params) {
 	return /* @__PURE__ */ _coercedNumber(ZodNumber, params);
 }
 //#endregion
-//#region ../types/dist/sleep-BkzQdpzF.mjs
+//#region ../types/dist/sleep-Cv4Zmie9.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6642,7 +6642,7 @@ var NOT_RUN = {
 * throws: an unreachable or refusing engine is logged and reported `declared: false`,
 * because the hub (and this addon's boot) must not hang on a migration.
 */
-async function runAddonMigrations(host, migrations, logger) {
+async function runAddonMigrations(host, migrations, logger, options = {}) {
 	const first = migrations[0];
 	if (first === void 0) return NOT_RUN;
 	const owner = first.meta.owner;
@@ -6671,7 +6671,9 @@ async function runAddonMigrations(host, migrations, logger) {
 		else if (status === "blocked") blocked.push(id);
 		else skipped.push(id);
 	};
+	const selected = options.only === void 0 ? null : new Set(options.only);
 	for (const step of declaration.steps) {
+		if (selected !== null && !selected.has(step.id)) continue;
 		const bound = byId.get(step.id);
 		if (bound === void 0 || step.action === "skip") {
 			skipped.push(step.id);
@@ -7831,14 +7833,18 @@ var BaseAddon = class {
 	* nothing; the boot continues. A migration that FAILED (or was blocked by one)
 	* and declares `onFailure: 'block-owner'` makes this throw, so the addon does not
 	* serve data whose shape it cannot trust; `tolerate` migrations never do.
+	*
+	* ALWAYS pass the whole catalogue; a phase that must run only some of it passes
+	* `{ only: [ids] }` — never a filtered catalogue (the engine would judge the
+	* omitted applied ids "newer").
 	*/
-	async runMigrations(migrations) {
+	async runMigrations(migrations, options) {
 		const api = this.ctx.api.migrations;
 		const report = await runAddonMigrations({
 			declareOwner: (input) => api.declareOwner.mutate(input),
 			startMigration: (input) => api.startMigration.mutate(input),
 			finishMigration: (input) => api.finishMigration.mutate(input)
-		}, migrations, this.ctx.logger);
+		}, migrations, this.ctx.logger, options);
 		if (report.blockOwner.length > 0) throw new AddonMigrationsBlockedError(report.blockOwner);
 		return report;
 	}
@@ -8878,6 +8884,10 @@ var RECORD_SECRET_COLLECTION_PREFIX = "records:";
 * (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
 * (`auth.accessToken`, `headers[].value`).
 *
+* `{}` after a key means "each value of this map" (`applianceSecrets{}`): the map's own key
+* names the value (`applianceSecrets{fridge}`), so no id key is declared and a body that drops a
+* key releases exactly that key's secret.
+*
 * Array elements are matched by a DECLARED id key (`secretArrayKeys`:
 * `{ headers: 'name' }`), never by index, so reordering a list keeps every
 * keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
@@ -8890,11 +8900,13 @@ function parseSecretPath(path) {
 	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
 	return path.split(".").map((raw) => {
 		const each = raw.endsWith("[]");
-		const key = each ? raw.slice(0, -2) : raw;
+		const map = raw.endsWith("{}");
+		const key = each || map ? raw.slice(0, -2) : raw;
 		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
 		return {
 			key,
-			each
+			each,
+			map
 		};
 	});
 }
@@ -8946,6 +8958,22 @@ function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arra
 			[segment.key]: mapped
 		};
 	}
+	if (segment.map) {
+		if (!isRecord$4$1(child)) return node;
+		const kept = Object.entries(child).map(([mapKey, value]) => {
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}{${encodeURIComponent(mapKey)}}`;
+			if (!last) return [mapKey, mapAt(value, segments, index + 1, keys, concrete, declared, arrayKeys, visit)];
+			return [mapKey, visit({
+				declared,
+				concrete,
+				value
+			})];
+		}).filter(([, value]) => value !== REMOVE_LEAF);
+		return {
+			...node,
+			[segment.key]: Object.fromEntries(kept)
+		};
+	}
 	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
 	if (last) {
 		const replacement = visit({
@@ -9087,7 +9115,8 @@ function isZodSecret(schema) {
 }
 /**
 * Every declared secret path in a config schema: dotted keys, `[]` for "each
-* element of this array" (`connection.password`, `rows[].token`). A declared
+* element of this array" (`connection.password`, `rows[].token`), `{}` for "each value of this
+* map" (`applianceSecrets{}`). A declared
 * object or array is reported as one path and not descended into — everything
 * under it is secret.
 */
@@ -9098,6 +9127,7 @@ function collectZodSecretPaths(schema, prefix = "") {
 		const def = defOf(layer);
 		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
 		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "record" && def.valueType) paths.push(...collectZodSecretPaths(def.valueType, `${prefix}{}`));
 		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
 		else if (def.type === "intersection") {
 			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
@@ -13412,11 +13442,49 @@ function buildCapturingReply(envelope) {
 	};
 	return wrapper;
 }
+/**
+* `RecordIntegrationInstances` - the `integration-instances` provider over ONE
+* entry kind, so an addon that holds a connection serves it in ~30 lines.
+*
+* Every instance is one record of the addon's own kind, keyed by the
+* `integrations` registry id. The records door does the secret work: a field the
+* kind marks `.meta({ secret: true })` is a keychain marker bound to the row, so
+* deleting the row deletes the secret, and one row's value is never another's.
+*
+* Patch rules for a secret (`updateInstance`): omitted, `''`, the redaction
+* token or the view the form was given KEEP the stored secret;
+* `{ $secretClear: true }` clears it; any other string replaces it.
+*/
 /** The most instances one addon lists (an integrations page, not a table). */
 var INSTANCES_LIST_MAX = 1e3;
 /** The keys of the kind's secret fields that sit at the top level of the body. */
 function topLevelSecretKeys(paths) {
-	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[")));
+	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[") && !p.includes("{")));
+}
+/** The keys of the kind's top-level MAPS whose values are secrets (`applianceSecrets{}`). */
+function secretMapKeys(paths) {
+	return new Set(paths.filter((p) => p.endsWith("{}") && !p.slice(0, -2).match(/[.[{]/)).map((p) => p.slice(0, -2)));
+}
+/**
+* A patch value for a map of secrets: an entry that is omitted, `''`, the redaction token or the
+* view the form was given KEEPS its stored secret (it is left out of the merge); `{ $secretClear }`
+* or `null` removes the entry; any other string replaces it. Null when nothing is left to merge.
+*/
+function secretMapPatch(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) if (entry === null || isSecretClear(entry)) out[key] = null;
+	else if (typeof entry === "string" && entry !== "" && entry !== "__camstack_redacted__" && !isSecretFieldView(entry)) out[key] = entry;
+	return Object.keys(out).length > 0 ? out : null;
+}
+/** Does the kind's body schema carry an `enabled` field? */
+function declaresEnabled(kind) {
+	const json = toJSONSchema(kind.schema, {
+		unrepresentable: "any",
+		io: "input"
+	});
+	const properties = Reflect.get(json, "properties");
+	return typeof properties === "object" && properties !== null && "enabled" in properties;
 }
 var RecordIntegrationInstances = class {
 	records;
@@ -13424,14 +13492,20 @@ var RecordIntegrationInstances = class {
 	hooks;
 	handle;
 	secretKeys;
+	secretMaps;
 	nameField;
+	/** The `integrations` registry owns the on/off switch (`role: devices`); the body has none. */
+	registryOwnsEnabled;
 	constructor(records, kind, hooks) {
 		this.records = records;
 		this.kind = kind;
 		this.hooks = hooks;
 		this.handle = records.kind(kind);
 		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
+		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
 		this.nameField = kind.declaration.entry?.nameField ?? "name";
+		this.registryOwnsEnabled = hooks.description.role === "devices";
+		if (this.registryOwnsEnabled && declaresEnabled(kind)) throw new Error(`kind "${kind.name}": the integrations registry owns the on/off switch of a role "devices" addon, so the body must not declare "enabled"`);
 	}
 	/**
 	* One instance read for the addon's own runtime; null when absent. When the keychain is
@@ -13482,7 +13556,7 @@ var RecordIntegrationInstances = class {
 			id: record.id,
 			name: typeof rawName === "string" ? rawName : record.id,
 			configured: this.hooks.configured(record.data),
-			enabled: record.data.enabled !== false,
+			...this.registryOwnsEnabled ? {} : { enabled: record.data.enabled !== false },
 			formValues: shown,
 			...kind !== void 0 ? { kind } : {},
 			...health?.status !== void 0 ? { status: health.status } : {},
@@ -13512,32 +13586,36 @@ var RecordIntegrationInstances = class {
 			id: minted,
 			data: this.hooks.initialBody(name, kind)
 		}, { ifRev: 0 });
-		await this.hooks.onChanged?.(minted);
+		await this.hooks.onChanged?.(minted, "created");
 		return { id: minted };
 	};
 	updateInstance = async ({ id, name, values }) => {
 		const patch = {};
 		for (const [key, value] of Object.entries(values)) {
 			if (value === void 0) continue;
-			if (!this.secretKeys.has(key)) patch[key] = value;
+			if (this.secretMaps.has(key)) {
+				const entries = secretMapPatch(value);
+				if (entries !== null) patch[key] = entries;
+			} else if (!this.secretKeys.has(key)) patch[key] = value;
 			else if (isSecretClear(value)) patch[key] = null;
 			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
 		}
 		if (name !== void 0) patch[this.nameField] = name;
 		await this.handle.patch(id, patch);
-		await this.hooks.onChanged?.(id);
+		await this.hooks.onChanged?.(id, "updated");
 		return { ok: true };
 	};
 	/** The switch lives in the record body; the addon is told so it applies it (D996). */
 	setInstanceEnabled = async ({ id, enabled }) => {
+		if (this.registryOwnsEnabled) throw new Error(`instance "${id}": the integrations registry owns the on/off switch of this addon; set it with integrations.update`);
 		await this.handle.patch(id, { enabled });
-		await this.hooks.onChanged?.(id);
+		await this.hooks.onChanged?.(id, "enabled");
 		return { ok: true };
 	};
 	/** The row and its keychain refs go together (the records door). */
 	deleteInstance = async ({ id }) => {
 		await this.handle.delete(id);
-		await this.hooks.onChanged?.(id);
+		await this.hooks.onChanged?.(id, "deleted");
 		return { ok: true };
 	};
 	testInstance = async (input) => {
@@ -14598,7 +14676,13 @@ var MigrationLedgerEntrySchema = object({
 	* joined by the engine from the catalogues it knows this boot. Absent when no
 	* catalogue lists the id (a newer database).
 	*/
-	meta: MigrationMetaSchema.optional()
+	meta: MigrationMetaSchema.optional(),
+	/**
+	* Set when this is an applied row of an addon owner whose catalogue the answering
+	* process has not loaded (the owner has not declared yet): the row is applied, the
+	* process just cannot judge it. Never `skipped-newer` — that needs the owner loaded.
+	*/
+	ownerNotLoaded: boolean().optional()
 });
 /** A catalogued migration that is not applied, with where it stands. */
 var MigrationPendingEntrySchema = object({
@@ -56305,6 +56389,21 @@ var IntegrationInstanceKindSchema = object({
 	disconnectPath: string().min(1).optional()
 });
 var IntegrationInstanceDescriptionSchema = object({
+	/** What the instances are for the Integrations page; see {@link IntegrationInstanceRoleSchema}. */
+	role: _enum([
+		"devices",
+		"services",
+		"both"
+	]),
+	/** How the devices of an instance are found; absent means `{ mode: 'none' }`. */
+	discovery: object({
+		mode: _enum([
+			"none",
+			"lan",
+			"account"
+		]),
+		scopedToInstance: boolean()
+	}).optional(),
 	/** `single`: at most one instance can exist (Loki). `multiple`: an account each. */
 	instanceMode: IntegrationInstanceModeSchema,
 	/** What the instance is, for the UI (`destination`, `relay`, `account`). */
@@ -56344,10 +56443,11 @@ var IntegrationInstanceSchema = object({
 	/** The addon's own rule (an URL is present, a client id is present...). */
 	configured: boolean(),
 	/**
-	* The instance's own on/off switch (D996): always present, derived from the record body
-	* (`enabled !== false`, so a row written before the field existed is on).
+	* The instance's own on/off switch (D996), derived from the record body (`enabled !== false`,
+	* so a row written before the field existed is on). Absent when the `integrations` registry
+	* owns the switch (`describe().role` is `devices`): read it from the registry row.
 	*/
-	enabled: boolean(),
+	enabled: boolean().optional(),
 	/** The kind of this instance (one of `describe().kinds[].id`), when the provider has kinds. */
 	kind: string().optional(),
 	/** Values for the instance form; a secret is a `SecretFieldView`, never text. */
@@ -141548,10 +141648,8 @@ var AlexaIntegrationManager = class {
 			this.#status = "connected";
 			this.#lastCheckedAt = Date.now();
 			this.#onConnected(this.#id);
-			await this.refreshAppliances();
-			await this.poll();
-			this.#schedulePoll();
 			this.#logger.info("AlexaIntegrationManager: started", { tags: { brokerId: this.#id } });
+			this.#firstSync(client);
 		} catch (err) {
 			if (err instanceof AlexaAuthError) {
 				this.#status = "auth-failed";
@@ -141572,6 +141670,24 @@ var AlexaIntegrationManager = class {
 			});
 		}
 	}
+	/** Background first refresh + poll, then the poll loop. Does nothing once `client` is stale. */
+	async #firstSync(client) {
+		let refreshed = false;
+		try {
+			await this.refreshAppliances();
+			refreshed = true;
+		} catch (err) {
+			this.#error = errMsg(err);
+			this.#logger.warn("AlexaIntegrationManager: first appliance refresh failed", {
+				tags: { brokerId: this.#id },
+				meta: { error: errMsg(err) }
+			});
+		}
+		if (this.#client !== client) return;
+		if (refreshed) await this.poll();
+		if (this.#client !== client) return;
+		this.#schedulePoll();
+	}
 	/** List the account's appliances + publish them to the resolver. */
 	async refreshAppliances() {
 		const client = this.#client;
@@ -143313,6 +143429,7 @@ function statusOf(info, configured) {
 function buildAlexaInstances(records, deps) {
 	return new RecordIntegrationInstances(records, alexaBrokersEntryKind, {
 		description: {
+			role: "both",
 			instanceMode: "multiple",
 			kind: "account",
 			canTest: true,
@@ -145025,7 +145142,7 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 			infoOf: (id) => this.registry?.get(id) ?? null,
 			onChanged: (id) => this.syncBrokerRuntime(id)
 		});
-		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS.filter((m) => m.meta.id === FLATTEN_BROKER_RECORDS_ID), this.migrationPorts(records)));
+		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, this.migrationPorts(records)), { only: [FLATTEN_BROKER_RECORDS_ID] });
 		this.activeBrokers = await this.loadPersistedBrokers();
 		this.registry = new AlexaBrokerRegistry(this.ctx.logger, {
 			dataDir: this.ctx.dataDir,
@@ -145070,7 +145187,7 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 			deviceCode: this.deviceCodeLogin,
 			commitCookie: (input) => this.commitCapturedCookie(input)
 		}), ...speakIconRoutes()];
-		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS.filter((m) => m.meta.id !== FLATTEN_BROKER_RECORDS_ID), this.migrationPorts(records)));
+		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, this.migrationPorts(records)), { only: ADDON_MIGRATIONS.map((m) => m.meta.id).filter((id) => id !== FLATTEN_BROKER_RECORDS_ID) });
 		const speak = new AlexaSpeakController({
 			logger: this.ctx.logger.child("speak"),
 			readConfig: () => this.config,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-import-alexa",
-  "version": "0.2.183",
+  "version": "0.2.185",
   "description": "Alexa device-import provider for CamStack — imports the smart-home devices in a user's Alexa account via the unofficial alexa-remote2 cookie/token client (the inverse of the Alexa exporter)",
   "keywords": [
     "camstack",
@@ -72,7 +72,7 @@
       }
     ],
     "requires": {
-      "server": ">=1.2.761"
+      "server": ">=1.2.763"
     }
   },
   "files": [