@camstack/addon-import-alexa 0.2.189 → 0.2.191

package/dist/addon.mjs

@@ -6042,7 +6042,7 @@ function number(params) {
 	return /* @__PURE__ */ _coercedNumber(ZodNumber, params);
 }
 //#endregion
-//#region ../types/dist/sleep-DEZaLbiu.mjs
+//#region ../types/dist/sleep-BX_MqzUe.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7671,6 +7671,28 @@ var SECRET_RETRY_MAX_MS = 5 * 6e4;
 /** Coalesces a burst of `keychain.changed` events into one re-resolve. */
 var SECRET_CHANGE_DEBOUNCE_MS = 250;
 /**
+* Pair a catalogue with the function that builds its ports FROM THE MIGRATION API. The one
+* place a catalogue is bound: a migration reaches nothing a ports binder cannot reach
+* through `api` (guard `check-migration-ports-surface`).
+*/
+function migrationSet(catalogue, bindPorts) {
+	return { bind: (api) => defineAddonMigrations(catalogue, bindPorts(api)) };
+}
+/** A mixed array is a mistake: the other kind would be dropped without a word. */
+function refuseMixed(form, kept, dropped) {
+	if (dropped > 0) throw new Error(`runMigrations(${form}): ${dropped} of ${kept + dropped} entries are of the other kind and would be dropped; pass one kind per call`);
+}
+function catalogueOf(list) {
+	const kept = list.filter((entry) => !("execute" in entry));
+	refuseMixed("catalogue, (api) => ports", kept.length, list.length - kept.length);
+	return kept;
+}
+function boundOf(list) {
+	const kept = list.filter((entry) => "execute" in entry);
+	refuseMixed("bound migrations", kept.length, list.length - kept.length);
+	return kept;
+}
+/**
 * Base class for CamStack addons. Eliminates settings boilerplate:
 *
 * - Typed `config` property with automatic resolution from store + defaults
@@ -7837,23 +7859,21 @@ var BaseAddon = class {
 		await this.loadScopedSchemas();
 		return normalized;
 	}
+	async runMigrations(first, second, third) {
+		if (typeof second === "function") return this.runMigrationSets([migrationSet(catalogueOf(first), second)], third);
+		return this.runBound(boundOf(first), second);
+	}
 	/**
-	* Run this addon's migration catalogue (D987 M3) through the hub's `migrations`
-	* engine. Call it at the point of the boot where the data must already have the new
-	* shape — `onInitialize`, or `onRestoreDevices` for a migration that needs the
-	* restored devices — with the catalogue bound to the addon's ports
-	* (`defineAddonMigrations(ADDON_MIGRATIONS, ports)`).
-	*
-	* An engine that cannot be reached or refuses the catalogue is logged and runs
-	* nothing; the boot continues. A migration that FAILED (or was blocked by one)
-	* and declares `onFailure: 'block-owner'` makes this throw, so the addon does not
-	* serve data whose shape it cannot trust; `tolerate` migrations never do.
-	*
-	* ALWAYS pass the whole catalogue; a phase that must run only some of it passes
-	* `{ only: [ids] }` — never a filtered catalogue (the engine would judge the
-	* omitted applied ids "newer").
+	* Several catalogues of ONE owner in one declaration (the engine replaces an owner's
+	* catalogue on every declare, so two calls would each judge the other's ids "newer").
+	* Build each entry with `migrationSet(catalogue, (api) => ports)`.
 	*/
-	async runMigrations(migrations, options) {
+	async runMigrationSets(sets, options) {
+		const api = this.ctx.migrationApi;
+		if (api === void 0) throw new Error(`${this.ctx.id}: the migration API is not available on this context`);
+		return this.runBound(sets.flatMap((set) => set.bind(api)), options);
+	}
+	async runBound(migrations, options) {
 		const api = this.ctx.api.migrations;
 		const report = await runAddonMigrations({
 			declareOwner: (input) => api.declareOwner.mutate(input),
@@ -13555,6 +13575,39 @@ function buildCapturingReply(envelope) {
 	return wrapper;
 }
 /**
+* The link primitive's declaration half (D1013 rule 5): what a link field names and how a kind
+* records it. Split from `instance-link.ts` so `RecordIntegrationInstances` can read the links of
+* its kind without importing the builders that import it.
+*/
+/** The body field of a link: the id of the instance it names; the target rides in the field meta. */
+function linkField(target) {
+	return string().meta({ link: target });
+}
+function linkTargetOf(meta) {
+	if (typeof meta !== "object" || meta === null) return void 0;
+	const link = Reflect.get(meta, "link");
+	const parsed = LinkTargetSchema.safeParse(link);
+	return parsed.success ? parsed.data : void 0;
+}
+var LinkTargetSchema = object({
+	cap: string().min(1),
+	kind: string().min(1).optional()
+});
+/** The links a kind declares, read from the meta of its body fields. */
+function linksOfKind(kind) {
+	const schema = kind.schema;
+	if (!(schema instanceof ZodObject)) return [];
+	const links = [];
+	for (const [field, fieldSchema] of Object.entries(schema.shape)) {
+		const to = linkTargetOf(globalRegistry.get(fieldSchema));
+		if (to !== void 0) links.push({
+			field,
+			to
+		});
+	}
+	return links;
+}
+/**
 * `RecordIntegrationInstances` - the `integration-instances` provider over ONE
 * entry kind, so an addon that holds a connection serves it in ~30 lines.
 *
@@ -13675,30 +13728,29 @@ var RecordIntegrationInstances = class {
 			...health?.lastCheckedAt !== void 0 ? { lastCheckedAt: health.lastCheckedAt } : {}
 		};
 	}
-	describe = async () => this.hooks.mintId === void 0 ? this.hooks.description : {
-		...this.hooks.description,
-		mintsId: true
+	describe = async () => {
+		const declared = linksOfKind(this.kind);
+		const links = this.hooks.description.links !== void 0 || declared.length === 0 ? {} : { links: declared.map((link) => ({
+			kind: this.kind.name,
+			field: link.field,
+			to: link.to
+		})) };
+		return {
+			...this.hooks.description,
+			...links,
+			...this.hooks.mintId === void 0 ? {} : { mintsId: true }
+		};
 	};
-	/**
-	* The record an id names. A caller holding the `integrations` registry id (the Integrations
-	* page) reaches a kind whose body links to it through `integrationId`; an id that is itself a
-	* record id answers as it is. An id that names nothing comes back unchanged.
-	*/
-	async resolveRecordId(id) {
-		if (await this.handle.get(id) !== null) return id;
-		const linked = (await this.handle.query({ limit: INSTANCES_LIST_MAX })).records.find((record) => record.data["integrationId"] === id);
-		return linked === void 0 ? id : linked.id;
-	}
-	instanceFormSchema = async ({ id }) => this.hooks.formSchema(id === null ? null : await this.resolveRecordId(id));
+	instanceFormSchema = async ({ id }) => this.hooks.formSchema(id);
 	listInstances = async () => {
 		return (await this.handle.query({ limit: INSTANCES_LIST_MAX })).records.map((record) => this.viewOf(record));
 	};
 	getInstance = async ({ id }) => {
-		const record = await this.handle.get(await this.resolveRecordId(id));
+		const record = await this.handle.get(id);
 		return record === null ? null : this.viewOf(record);
 	};
 	/** Insert ONE row (`ifRev: 0`: an existing id is refused, never overwritten). */
-	createInstance = async ({ id, name, kind }) => {
+	createInstance = async ({ id, name, kind, values }) => {
 		const minted = id ?? this.hooks.mintId?.({
 			name,
 			...kind !== void 0 ? { kind } : {}
@@ -13708,11 +13760,20 @@ var RecordIntegrationInstances = class {
 			id: minted,
 			data: this.hooks.initialBody(name, kind)
 		}, { ifRev: 0 });
+		const patch = this.patchOf(values ?? {});
+		if (Object.keys(patch).length > 0) await this.handle.patch(minted, patch);
 		await this.hooks.onChanged?.(minted, "created");
 		return { id: minted };
 	};
-	updateInstance = async ({ id: askedId, name, values }) => {
-		const id = await this.resolveRecordId(askedId);
+	updateInstance = async ({ id, name, values }) => {
+		const patch = this.patchOf(values);
+		if (name !== void 0) patch[this.nameField] = name;
+		await this.handle.patch(id, patch);
+		await this.hooks.onChanged?.(id, "updated");
+		return { ok: true };
+	};
+	/** The record patch a form `values` object means: secrets kept, cleared or replaced. */
+	patchOf(values) {
 		const patch = {};
 		for (const [key, value] of Object.entries(values)) {
 			if (value === void 0) continue;
@@ -13723,11 +13784,8 @@ var RecordIntegrationInstances = class {
 			else if (isSecretClear(value)) patch[key] = null;
 			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
 		}
-		if (name !== void 0) patch[this.nameField] = name;
-		await this.handle.patch(id, patch);
-		await this.hooks.onChanged?.(id, "updated");
-		return { ok: true };
-	};
+		return patch;
+	}
 	/** The switch lives in the record body; the addon is told so it applies it (D996). */
 	setInstanceEnabled = async ({ id, enabled }) => {
 		if (this.registryOwnsEnabled) throw new Error(`instance "${id}": the integrations registry owns the on/off switch of this addon; set it with integrations.update`);
@@ -13747,10 +13805,7 @@ var RecordIntegrationInstances = class {
 			status: "unsupported",
 			error: "This integration declares no connection test"
 		};
-		return this.hooks.test(input.id === null ? input : {
-			...input,
-			id: await this.resolveRecordId(input.id)
-		});
+		return this.hooks.test(input);
 	};
 	/** The flat provider object to hand to `registerProvider`. */
 	toProvider() {
@@ -13767,6 +13822,80 @@ var RecordIntegrationInstances = class {
 		};
 	}
 };
+/** No part holds the id a call named. */
+var UnknownInstanceError = class extends Error {
+	instanceId;
+	constructor(instanceId) {
+		super(`Unknown instance '${instanceId}'`);
+		this.instanceId = instanceId;
+		this.name = "UnknownInstanceError";
+	}
+};
+/** A create or a form named no kind, or a kind no part serves. */
+var UnknownInstanceKindError = class extends Error {
+	kindId;
+	constructor(kindId) {
+		super(kindId === void 0 ? "This provider has several kinds: name one" : `Unknown instance kind '${kindId}'`);
+		this.kindId = kindId;
+		this.name = "UnknownInstanceKindError";
+	}
+};
+function composeInstanceKinds(parts, base) {
+	const byKind = (kindId) => {
+		if (kindId === void 0) {
+			const only = parts.length === 1 ? parts[0] : void 0;
+			if (only === void 0) throw new UnknownInstanceKindError(void 0);
+			return only;
+		}
+		const part = parts.find((candidate) => candidate.kind.id === kindId);
+		if (part === void 0) throw new UnknownInstanceKindError(kindId);
+		return part;
+	};
+	const holderOf = async (id) => {
+		for (const part of parts) if (await part.provider.getInstance({ id }) !== null) return part;
+		throw new UnknownInstanceError(id);
+	};
+	const tagged = (part, instance) => ({
+		...instance,
+		kind: part.kind.id
+	});
+	return {
+		describe: async () => {
+			const links = (await Promise.all(parts.map(async (part) => (await part.provider.describe()).links ?? []))).flat();
+			return {
+				...base,
+				kinds: parts.map((part) => part.kind),
+				...links.length > 0 ? { links } : {}
+			};
+		},
+		instanceFormSchema: async ({ id, kind }) => {
+			return (id === null ? byKind(kind) : await holderOf(id)).provider.instanceFormSchema({ id });
+		},
+		listInstances: async () => {
+			return (await Promise.all(parts.map(async (part) => (await part.provider.listInstances()).map((instance) => tagged(part, instance))))).flat();
+		},
+		getInstance: async ({ id }) => {
+			for (const part of parts) {
+				const found = await part.provider.getInstance({ id });
+				if (found !== null) return tagged(part, found);
+			}
+			return null;
+		},
+		createInstance: async (input) => byKind(input.kind).provider.createInstance(input),
+		updateInstance: async (input) => (await holderOf(input.id)).provider.updateInstance(input),
+		setInstanceEnabled: async (input) => (await holderOf(input.id)).provider.setInstanceEnabled(input),
+		deleteInstance: async (input) => (await holderOf(input.id)).provider.deleteInstance(input),
+		testInstance: async (input) => {
+			const test = (input.id === null ? byKind(input.kind) : await holderOf(input.id)).provider.testInstance;
+			if (test === void 0) return {
+				success: false,
+				status: "inconclusive",
+				error: "This kind cannot be tested"
+			};
+			return test(input);
+		}
+	};
+}
 var EncodeProfileSchema = object({
 	video: object({
 		codec: _enum([
@@ -16047,6 +16176,39 @@ var UnstampedEventMediaCountSchema = object({
 	/** Sum across both, or `null` when either lane could not be counted. */
 	total: number$1().int().nonnegative().nullable()
 }).nullable();
+/**
+* Where the stored event media sits, per storage location: how many media rows
+* and how many bytes carry each location id, how many carry none (legacy,
+* resolved to the default `eventMedia` location), and how many name a location
+* that was not asked about (a deleted or never-listed one).
+*
+* One covering-index aggregate per asked location plus the NULL one, and one
+* unfiltered total that scans the covering index: O(rows), not a walk of the
+* rows themselves. `unlisted` is total minus the ASKED locations minus NULL, so
+* it is a deleted location only when every location id was asked.
+* `null` is "could not be measured", never zero.
+*/
+var MediaLocationCensusInputSchema = object({ locationIds: array(string().min(1)).max(50).readonly() });
+var MediaLocationCensusSchema = object({
+	locations: array(object({
+		locationId: string(),
+		rows: number$1().int().nonnegative(),
+		bytes: number$1().nonnegative()
+	})).readonly(),
+	unstamped: object({
+		rows: number$1().int().nonnegative(),
+		bytes: number$1().nonnegative()
+	}),
+	/** Rows stamped with a location id that was not in the asked list. */
+	unlisted: object({
+		rows: number$1().int().nonnegative(),
+		bytes: number$1().nonnegative()
+	}),
+	total: object({
+		rows: number$1().int().nonnegative(),
+		bytes: number$1().nonnegative()
+	})
+});
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
 /** The independently selectable logical storage classes — every class
 * `storage.listLocationDeclarations` reports, so an operator never meets a
@@ -47124,52 +47286,7 @@ onBrightnessChanged: { data: object({
 		minIntervalMs: 0
 	} } }
 };
-/**
-* `broker` — unified pub/sub broker registry, system-scoped collection.
-*
-* The cap models any kind-tagged message broker the user wants to
-* register and that other addons might consume. The first two kinds
-* are MQTT (mosquitto / aedes embedded / cloud bridge) and
-* Home Assistant (HA WebSocket — subscribe_entities + call_service).
-* Future kinds (Zigbee2MQTT bridge, ZHA, KNX, Telegram, …) plug in
-* the same surface.
-*
-* Why one cap, not one cap per kind:
-*   - The integrations page wants a single table of "every broker"
-*     across kinds; a unified cap drives it without join logic.
-*   - Generic admin operations (add / remove / test / status) are
-*     identical across kinds — duplicating them per cap was busywork.
-*   - The `network-access` cap precedent: same interface, many
-*     `providerKind: 'ingress'` implementations (Tailscale, ngrok, …).
-*
-* What stays kind-specific:
-*   - `getBrokerConfig` payload (kind decides whether it returns
-*     mqtt URL+creds, HA baseUrl+token, …) — typed as
-*     `Record<string, unknown>` at the wire; consumers narrow.
-*   - `publish` / `subscribe` / `getState` arguments (target / filter /
-*     key) — also typed as `Record<string, unknown>` so each kind can
-*     evolve its surface (MQTT topic+qos vs HA entity_id+domain)
-*     without rebreaking the cap signature.
-*   - `add` `settings` payload (different fields per kind, validated by
-*     the kind-specific provider).
-*
-* Bidirectionality:
-*   - `publish` is RPC — synchronous result (provider-defined).
-*   - `subscribe` returns a subscription handle; the actual message
-*     stream flows over the typed event-bus as `broker.message` events
-*     keyed by `(brokerId, subscriptionId)`. Consumers filter in their
-*     event handler. Subscriptions persist across reconnects — the
-*     provider re-subscribes upstream after a transport drop.
-*
-* Why event-bus push (not a subscription RPC stream):
-*   - Matches the rest of CamStack's D8 contract — events for telemetry,
-*     RPC for loss-is-a-bug. Broker messages are telemetry (a single
-*     drop is recoverable via `getState({key})`).
-*   - Frees `broker.subscribe` from holding a long-lived RPC channel.
-*   - Cross-process: events already route through `$event-bus`; no
-*     per-broker wire-shaping needed.
-*/
-var BrokerStatusEnum = _enum([
+_enum([
 	"connected",
 	"disconnected",
 	"connecting",
@@ -47177,141 +47294,12 @@ var BrokerStatusEnum = _enum([
 	"unreachable",
 	"error"
 ]);
-var BrokerInfoSchema = object({
-	/** Stable broker id. Persisted; survives addon restarts. */
-	id: string(),
-	/** Addon id of the provider that OWNS this broker.
-	*
-	*  The `broker` cap is a system-scoped collection: several addons
-	*  register a `broker` provider, each owning a DISJOINT set of
-	*  brokers (mqtt-broker owns `mqtt_*`, provider-homeassistant owns
-	*  `ha_*`). A broker therefore belongs to exactly one addon — like a
-	*  device belongs to one integration. The admin UI threads this id
-	*  back as the `{ addonId }` system-collection selector on every
-	*  id-keyed call (`get` / `getSettings` / `setSettings` / `remove` /
-	*  `testConnection`), so the call routes to the OWNING provider
-	*  instead of defaulting to the first-registered one. */
-	addonId: string(),
-	/** Human-readable name (operator-chosen at add-time). */
-	name: string(),
-	/** Provider-defined kind tag — `mqtt` / `home-assistant` / future. */
-	kind: string(),
-	status: BrokerStatusEnum,
-	/** Free-form provider-specific info (HA version, MQTT broker
-	*  flavour, latency, mTLS active, …). */
-	info: record(string(), unknown()),
-	/** Ms epoch of the last connection probe / status update. */
-	lastCheckedAt: number$1().nullable(),
-	/** Last error message, when `status` indicates failure. */
-	error: string().nullable()
-});
 var RegistryStatusSchema = object({
 	brokerCount: number$1().int().nonnegative(),
 	connectedCount: number$1().int().nonnegative()
 });
-/**
-* One entry per `broker` provider — which addon provides which broker
-* kind(s). The unified create picker reads this to know, for each
-* (addonId, kind) pair the operator can pick, where to route the
-* follow-up `getSettingsSchema` / `testSettings` / `add` calls (via the
-* `{ addonId }` selector). A provider only advertises a kind here when
-* it implements `getSettingsSchema` for that kind (so the picker never
-* offers a kind whose creation form can't be rendered).
-*/
-var BrokerProviderInfoSchema = object({
-	/** Addon id of the `broker` provider this entry describes. */
-	addonId: string(),
-	/** Broker kinds this provider can create, with a display label. */
-	kinds: array(object({
-		kind: string(),
-		label: string(),
-		/**
-		* Relative hub path to start an interactive account link (OAuth popup).
-		* May include `{{brokerId}}`; admin-ui substitutes and appends `?popup=1`.
-		*/
-		interactiveConnectPath: string().min(1).optional(),
-		/** Relative hub path to disconnect the linked account (same popup pattern). */
-		interactiveDisconnectPath: string().min(1).optional(),
-		/**
-		* The kind signs in through a server-held interactive session instead of
-		* (or before) typed credentials. `basePath` is a hub-relative route set
-		* served by the owning addon (`/addon/<id>/...`) speaking the sign-in
-		* contract: `POST {basePath}/start` (body: the form's settings) answers
-		* `{ sessionId, loginUrl }`; `GET {basePath}/status?sessionId=` answers
-		* `{ phase: 'starting' | 'awaiting-login' | 'captured' | 'error' |
-		* 'cancelled', loginUrl, error }`; `POST {basePath}/commit`
-		* (`{ sessionId, name, brokerId? }`) stores the credentials on a new or
-		* existing broker and answers `{ brokerId }`; `POST {basePath}/cancel`
-		* (`{ sessionId }`) drops the session. The dialog that edits a broker
-		* offers it as the default path; the fields the session fills are
-		* marked `filledBySignIn` in the kind's settings schema.
-		*
-		* `methods` lists the ways the session can sign in, recommended first:
-		* `'device-code'` adds `POST {basePath}/code/start` (body: the form's
-		* settings) answering `{ sessionId, userCode, verificationUrl,
-		* expiresAt }` — the operator types `userCode` at `verificationUrl` on
-		* any device, and the same `status` / `commit` / `cancel` routes follow
-		* (status then carries `method`, `userCode`, `verificationUrl`,
-		* `expiresAt` and the phases `'awaiting-code'` / `'expired'`);
-		* `'proxy'` is the `{basePath}/start` flow above. Absent means
-		* `['proxy']`.
-		*/
-		signIn: object({
-			basePath: string().min(1),
-			methods: array(_enum(["device-code", "proxy"])).optional()
-		}).optional()
-	}))
-});
-var ListInputSchema = object({ 
-/** Optional kind filter — `list({kind:'home-assistant'})` returns
-*  only HA brokers. Omit to list every broker. */
-kind: string().optional() });
 var GetInputSchema = object({ id: string() });
-var AddInputSchema = object({
-	kind: string().min(1),
-	name: string().min(1),
-	/**
-	* ADOPT an existing id instead of minting a new one.
-	*
-	* Written the day this cost an outage. A broker's id is not a detail: HA
-	* devices carry it inside their `stableId` (`ha:ha_004:dev:…`), so a broker
-	* lost from config and re-added as `ha_001` leaves every one of its devices
-	* bound to a broker that no longer exists. Re-entering the password under the
-	* ORIGINAL id turns a multi-step device migration back into re-entering a
-	* password.
-	*
-	* A provider MUST refuse an id that is already in use — adopting a live
-	* broker's id would silently take it over.
-	*/
-	id: string().min(1).optional(),
-	/** Kind-specific settings (e.g. MQTT `{url,username,password}` or HA
-	*  `{baseUrl,accessToken}`). Validated by the kind-specific provider
-	*  branch on receipt — invalid shape rejects the add. */
-	settings: record(string(), unknown())
-});
-var AddResultSchema = object({ id: string() });
-var RemoveInputSchema = object({ id: string() });
-var TestConnectionResultSchema = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number$1().nonnegative()
-}), object({
-	ok: literal(false),
-	error: string()
-})]);
 var SettingsRecordSchema$1 = record(string(), unknown());
-var SettingsSchemaInputSchema = object({ kind: string() });
-var TestSettingsInputSchema = object({
-	kind: string(),
-	settings: SettingsRecordSchema$1
-});
-var TestSettingsResultSchema = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number$1().nonnegative().optional()
-}).strict(), object({
-	ok: literal(false),
-	error: string()
-})]);
-var SettingsSchemaResultSchema = unknown().nullable();
 var PublishInputSchema = object({
 	brokerId: string(),
 	/** Kind-specific routing target.
@@ -47355,51 +47343,12 @@ var brokerCapability = {
 		kind: "poll"
 	},
 	methods: {
-		list: method(ListInputSchema, array(BrokerInfoSchema)),
-		get: method(GetInputSchema, BrokerInfoSchema.nullable()),
-		/** Enumerate which addon provides which broker kind(s) for the
-		*  unified create picker. The auto-mount fans this array across
-		*  every registered `broker` provider (array-output method), so the
-		*  picker sees every kind from every provider in one call. */
-		listProviders: method(_void(), array(BrokerProviderInfoSchema), { auth: "admin" }),
-		add: method(AddInputSchema, AddResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		remove: method(RemoveInputSchema, _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		testConnection: method(GetInputSchema, TestConnectionResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/** Read the persisted settings record for a broker (kind-specific
-		*  shape). Admin-only — settings may contain secrets. Returns `null`
-		*  when the broker id is unknown to the provider (the collection
-		*  fallback may route a foreign id to the first provider). */
-		getSettings: method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }),
-		/** Overwrite the persisted settings record. The kind-specific
-		*  provider validates the shape and applies the change (reconnects
-		*  if credentials changed). */
-		setSettings: method(object({
-			id: string(),
-			settings: SettingsRecordSchema$1
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
 		/** Returns the kind-specific connection config the consumer needs
 		*  to open its own client (MQTT pattern: `{url, username, password,
 		*  clientIdPrefix}`). HA providers MAY return the auth envelope
 		*  but typical HA consumers use `publish` / `subscribe` instead.
 		*  Returns `null` when the broker id is unknown to the provider. */
 		getBrokerConfig: method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }),
-		getSettingsSchema: method(SettingsSchemaInputSchema, SettingsSchemaResultSchema, { auth: "admin" }),
-		testSettings: method(TestSettingsInputSchema, TestSettingsResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
 		publish: method(PublishInputSchema, unknown(), {
 			kind: "mutation",
 			auth: "admin"
@@ -52246,7 +52195,14 @@ var DiscoveryCandidateSchema = object({
 	/** `stableId` of the gateway candidate this device was found BEHIND. */
 	parentStableId: string().optional(),
 	/** `false` = shown for context but not pickable. Default true. */
-	selectable: boolean().optional()
+	selectable: boolean().optional(),
+	/**
+	* Keys of the provider's creation form (`getChildCreationSchema`) this candidate
+	* cannot be adopted without — a key for an encrypted board, a pairing code. The
+	* admin asks for exactly these, on the creation form prefilled with
+	* `prefilledConfig`, before it adopts. Absent or empty = adopt as it is.
+	*/
+	needsParams: array(string()).optional()
 });
 /**
 * Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
@@ -52373,8 +52329,14 @@ var deviceProviderCapability = {
 		* provider does not support manual creation. Lets the Add-Device dialog
 		* pick the right type instead of assuming Camera.
 		*/
-		getManualCreationType: method(object({}), object({ deviceType: _enum(DeviceType).nullable() })),
-		adoptDiscoveredDevice: method(object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
+		getManualCreationType: method(object({ 
+		/** The integration asked about; a provider whose integrations differ answers per one. */
+integrationId: string().optional() }), object({ deviceType: _enum(DeviceType).nullable() })),
+		adoptDiscoveredDevice: method(object({
+			candidate: DiscoveryCandidateSchema,
+			/** The integration the operator adopts into; a provider with several instances needs it. */
+			integrationId: string().optional()
+		}), DeviceSummarySchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
@@ -52385,10 +52347,16 @@ var deviceProviderCapability = {
 		* devices of that type. The output is a `ConfigUISchema` — the
 		* router type-asserts it at the boundary.
 		*/
-		getChildCreationSchema: method(object({ type: _enum(DeviceType) }), CreationSchemaOutputSchema),
+		getChildCreationSchema: method(object({
+			type: _enum(DeviceType),
+			/** The integration asked about; a provider whose integrations differ answers per one. */
+			integrationId: string().optional()
+		}), CreationSchemaOutputSchema),
 		createDevice: method(object({
 			type: _enum(DeviceType),
-			config: record(string(), unknown())
+			config: record(string(), unknown()),
+			/** The integration the operator adds the device to; a provider with several instances needs it. */
+			integrationId: string().optional()
 		}), DeviceSummarySchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -53113,7 +53081,10 @@ method(object({
 	auth: "admin"
 }), method(object({
 	addonId: string(),
-	type: _enum(DeviceType)
+	type: _enum(DeviceType),
+	/** The integration the form is for; a provider whose integrations differ (a hub
+	*  integration takes no manual add) answers per integration. Absent = the addon's own. */
+	integrationId: string().optional()
 }), unknown().nullable()), method(object({
 	addonId: string(),
 	type: _enum(DeviceType),
@@ -53197,7 +53168,11 @@ method(object({
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 12e4
-}), method(object({ addonId: string() }), object({ deviceType: _enum(DeviceType).nullable() }), { auth: "admin" }), method(object({ addonId: string() }), unknown(), { auth: "admin" }), method(object({
+}), method(object({
+	addonId: string(),
+	/** The integration the Add-Device dialog is open on; absent = the addon's own. */
+	integrationId: string().optional()
+}), object({ deviceType: _enum(DeviceType).nullable() }), { auth: "admin" }), method(object({ addonId: string() }), unknown(), { auth: "admin" }), method(object({
 	deviceId: number$1(),
 	key: string(),
 	value: unknown()
@@ -56477,7 +56452,7 @@ var TestConnectionStatusEnum = _enum([
 	"inconclusive",
 	"unsupported"
 ]);
-var TestConnectionResultSchema$1 = object({
+var TestConnectionResultSchema = object({
 	/** True ONLY for `validated`. Never true for a test that did not run. */
 	success: boolean(),
 	error: string().optional(),
@@ -56522,7 +56497,7 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 }), method(_void(), array(AvailableIntegrationTypeSchema), { auth: "admin" }), method(object({
 	addonId: string(),
 	settings: record(string(), unknown())
-}), TestConnectionResultSchema$1, {
+}), TestConnectionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -56549,6 +56524,14 @@ var ConfigSchemaPassthrough$3 = custom();
 var IntegrationInstanceIdSchema = string().min(1);
 var IntegrationInstanceModeSchema = _enum(["single", "multiple"]);
 /**
+* What the addon's instances ARE for the Integrations page (planning#416). `devices`: each
+* instance is an integration that brings devices (the registry owns its on/off switch);
+* `services`: a connection configured from the addon's own function page, never listed on
+* Integrations.
+* It is the same vocabulary as the manifest's `integrationRole`, which stays as an override.
+*/
+var IntegrationInstanceRoleSchema = _enum(["devices", "services"]);
+/**
 * One kind of instance a provider can create (an adapter, an account type). The sign-in and
 * connect fields follow the `broker` contract (`broker.cap.ts`): `signIn.basePath` is a
 * hub-relative route set speaking the sign-in contract, `connectPath` / `disconnectPath` open an
@@ -56559,6 +56542,22 @@ var IntegrationInstanceKindSchema = object({
 	/** Stable id of the kind, sent back as `createInstance.kind`. */
 	id: string().min(1),
 	label: string().min(1),
+	/**
+	* The function capability this kind is configured for (`broker`, `smtp-provider`,
+	* `device-provider`, ...). A page section is the kinds whose `functionCap` it names (D1013); a
+	* provider with more than one section must name it on every kind.
+	*/
+	functionCap: string().min(1),
+	/**
+	* For `functionCap: 'broker'`: the registry kind of the broker an instance of this kind is
+	* (`matter`, `home-assistant`, ...). A caller that needs a broker of one kind (a link field)
+	* finds the instances whose kind names it; absent takes the kind `id`.
+	*/
+	brokerKind: string().min(1).optional(),
+	/** What instances of this kind are for the Integrations page; absent takes the provider's `role`. */
+	role: IntegrationInstanceRoleSchema.optional(),
+	/** `testInstance` really probes the remote for this kind; absent takes the provider's `canTest`. */
+	canTest: boolean().optional(),
 	/** The kind signs in through a server-held interactive session. */
 	signIn: object({
 		basePath: string().min(1),
@@ -56569,22 +56568,38 @@ var IntegrationInstanceKindSchema = object({
 	/** Relative hub path to disconnect that account. */
 	disconnectPath: string().min(1).optional()
 });
+/**
+* How devices of an instance are found. `none`: the operator adds them by hand; `lan`: the addon
+* scans the network before any instance exists (the wizard offers the candidates); `account`: the
+* devices appear after the instance signs in. `scopedToInstance`: a discovery run belongs to ONE
+* instance and its candidates are claimed by it.
+*/
+var IntegrationInstanceDiscoverySchema = object({
+	mode: _enum([
+		"none",
+		"lan",
+		"account"
+	]),
+	scopedToInstance: boolean()
+});
+/**
+* One link a kind of this provider declares (D1013 rule 5): the body `field` of an instance of
+* `kind` holds the id of an instance of the function cap `to.cap` (of kind `to.kind`, when set).
+* The hub indexes these so the target's delete is refused while a link names it.
+*/
+var IntegrationInstanceLinkSchema = object({
+	kind: string().min(1),
+	field: string().min(1),
+	to: object({
+		cap: string().min(1),
+		kind: string().min(1).optional()
+	})
+});
 var IntegrationInstanceDescriptionSchema = object({
 	/** What the instances are for the Integrations page; see {@link IntegrationInstanceRoleSchema}. */
-	role: _enum([
-		"devices",
-		"services",
-		"both"
-	]),
+	role: IntegrationInstanceRoleSchema,
 	/** How the devices of an instance are found; absent means `{ mode: 'none' }`. */
-	discovery: object({
-		mode: _enum([
-			"none",
-			"lan",
-			"account"
-		]),
-		scopedToInstance: boolean()
-	}).optional(),
+	discovery: IntegrationInstanceDiscoverySchema.optional(),
 	/** `single`: at most one instance can exist (Loki). `multiple`: an account each. */
 	instanceMode: IntegrationInstanceModeSchema,
 	/** What the instance is, for the UI (`destination`, `relay`, `account`). */
@@ -56605,7 +56620,9 @@ var IntegrationInstanceDescriptionSchema = object({
 	* `createInstance` without an `id` works: the provider mints it. Absent means the caller must
 	* send an id (the UI then mints an opaque one).
 	*/
-	mintsId: boolean().optional()
+	mintsId: boolean().optional(),
+	/** The links to other instances the provider's kinds declare; absent means none. */
+	links: array(IntegrationInstanceLinkSchema).optional()
 });
 var IntegrationInstanceStatusSchema = object({
 	state: _enum([
@@ -56650,7 +56667,11 @@ var integrationInstancesCapability = {
 	methods: {
 		describe: method(_void(), IntegrationInstanceDescriptionSchema, { auth: "admin" }),
 		/** The form; `id: null` is the create form. */
-		instanceFormSchema: method(object({ id: IntegrationInstanceIdSchema.nullable() }), ConfigSchemaPassthrough$3, { auth: "admin" }),
+		instanceFormSchema: method(object({
+			id: IntegrationInstanceIdSchema.nullable(),
+			/** The kind of the create form (`id: null`) of a provider with several. */
+			kind: string().min(1).optional()
+		}), ConfigSchemaPassthrough$3, { auth: "admin" }),
 		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
 		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
 		/**
@@ -56660,7 +56681,9 @@ var integrationInstancesCapability = {
 		createInstance: method(object({
 			id: IntegrationInstanceIdSchema.optional(),
 			name: string().min(1),
-			kind: string().min(1).optional()
+			kind: string().min(1).optional(),
+			/** Form values written with the record (a link picked in the create dialog). */
+			values: record(string(), unknown()).optional()
 		}), object({ id: string() }), {
 			kind: "mutation",
 			auth: "admin"
@@ -56687,8 +56710,10 @@ var integrationInstancesCapability = {
 		}),
 		testInstance: optionalMethod(object({
 			id: IntegrationInstanceIdSchema.nullable(),
-			values: record(string(), unknown())
-		}), TestConnectionResultSchema$1, {
+			values: record(string(), unknown()),
+			/** The kind to test when `id` is null and the provider has several. */
+			kind: string().min(1).optional()
+		}), TestConnectionResultSchema, {
 			kind: "mutation",
 			auth: "admin"
 		})
@@ -59445,6 +59470,380 @@ var SystemMetricsSchema = object({
 	gpuMemoryPercent: number$1().optional()
 });
 method(_void(), SystemResourceSnapshotSchema), method(_void(), SystemResourceSnapshotSchema.nullable()), method(_void(), SystemMetricsSchema), method(object({ dirPath: string() }), DiskSpaceInfoSchema), method(_void(), MetricsGpuInfoSchema.nullable()), method(_void(), number$1().nullable()), method(object({ pids: array(number$1()) }), array(PidResourceStatsSchema)), method(_void(), array(AddonInstanceSchema).readonly()), method(object({ addonId: string() }), PidResourceStatsSchema.nullable()), method(_void(), array(NodeProcessSchema).readonly()), method(GetLoadSeriesInputSchema, NodeLoadSeriesSchema);
+/**
+* records - an addon's own facts and documents (D881): ledgers, audit rows,
+* config documents, mirrors. The third storage API next to `ctx.settings`
+* (operator intent, D870) and device-history (numbers over time, D850).
+*
+* Who the OWNER is: `callerAddonId`, stamped by the transport on a call that
+* crossed a process and stated by a hub in-process caller (`ctx.records` does
+* that with the addon id closed over). It is deliberately NOT in any input
+* schema, so a session can never supply it, and a call with no stamp is refused
+* `records/no-caller`. A kind is readable and writable only by its owner; other
+* addons go through the owner's capability.
+*
+* Every read is three-way: a row, `null`, or the call THROWS. A failed read is
+* never `[]`. Secret fields are never on the wire: a read shows the
+* redaction token, `secretRefs` hands the owner's `ctx.secrets` the refs it
+* resolves itself, and a write may carry only a keychain marker bound to the
+* row's own ref.
+*
+* Internal: addons reach it through `ctx.records`, never directly.
+*/
+var RecordIdSchema = string().min(1).max(256);
+/** A JSON object body. Size is the engine's check (`maxDataBytes`), not a schema's. */
+var RecordBodySchema = record(string(), unknown());
+var RecordInputSchema = object({
+	id: RecordIdSchema,
+	/** The device this row belongs to (D865 removal, per-device reads). */
+	deviceId: number$1().int().optional(),
+	/** The domain clock, ms: observed / created / opened. */
+	at: number$1().int().optional(),
+	/** Producer-set expiry, ms. Refused on a kind whose retention is an engine TTL. */
+	expiresAt: number$1().int().optional(),
+	data: RecordBodySchema
+});
+var RecordViewSchema = object({
+	id: string(),
+	deviceId: number$1().int().nullable(),
+	at: number$1().nullable(),
+	expiresAt: number$1().nullable(),
+	rev: number$1().int(),
+	updatedAt: number$1(),
+	data: RecordBodySchema
+});
+/** Declared index fields only. Anything else does not compile, by design. */
+var RecordWhereSchema = record(RecordFieldPathSchema, union([
+	string(),
+	number$1(),
+	boolean(),
+	object({ in: array(union([
+		string(),
+		number$1(),
+		boolean()
+	])).min(1).max(RECORD_BATCH_MAX) }),
+	object({
+		gt: union([string(), number$1()]).optional(),
+		gte: union([string(), number$1()]).optional(),
+		lt: union([string(), number$1()]).optional(),
+		lte: union([string(), number$1()]).optional()
+	}).refine((r) => Object.keys(r).length > 0, { message: "name at least one bound" })
+]));
+var KindShape = { kind: RecordKindNameSchema };
+var TimeWindowShape = {
+	deviceId: number$1().int().optional(),
+	atFrom: number$1().optional(),
+	atTo: number$1().optional()
+};
+var RecordQueryInputSchema = object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional(),
+	/** Without `where`: `at` (default for a kind with a clock) or `id`. With `where` the order is the index's. */
+	order: _enum(["at", "id"]).optional(),
+	desc: boolean().optional(),
+	limit: number$1().int().min(1).max(RECORD_QUERY_MAX).default(100),
+	/** Opaque keyset cursor from a previous answer. There is no offset. */
+	cursor: string().min(1).optional()
+});
+var RecordQueryResultSchema = object({
+	records: array(RecordViewSchema),
+	nextCursor: string().nullable()
+});
+var RecordKindStateSchema = _enum([
+	"created",
+	"unchanged",
+	"updated"
+]);
+var DeclareKindResultSchema = object({
+	kindId: number$1().int(),
+	state: RecordKindStateSchema,
+	createdIndexes: array(string())
+});
+/** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
+var SecretRefsList = array(string());
+/**
+* One op of a `transact`: the single-row writes, each on a kind of the caller.
+* All ops of one call share ONE database file and ONE `transactFamily`.
+*/
+var RecordTransactOpSchema = discriminatedUnion("op", [
+	object({
+		op: literal("put"),
+		kind: RecordKindNameSchema,
+		record: RecordInputSchema,
+		ifRev: number$1().int().min(0).optional()
+	}),
+	object({
+		op: literal("patch"),
+		kind: RecordKindNameSchema,
+		id: RecordIdSchema,
+		data: RecordBodySchema,
+		at: number$1().int().nullable().optional(),
+		expiresAt: number$1().int().nullable().optional(),
+		ifRev: number$1().int().min(1).optional()
+	}),
+	object({
+		op: literal("delete"),
+		kind: RecordKindNameSchema,
+		id: RecordIdSchema
+	})
+]);
+var RecordSecretRefsSchema = record(string(), record(string(), string()));
+method(object({ kinds: record(RecordKindNameSchema, RecordKindDeclarationSchema) }), object({ kinds: record(string(), DeclareKindResultSchema) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), RecordViewSchema.nullable(), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), array(RecordViewSchema), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), RecordSecretRefsSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	record: RecordInputSchema,
+	/** Compare-and-set. `0` means "the row must not exist". */
+	ifRev: number$1().int().min(0).optional()
+}), object({
+	rev: number$1().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	records: array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	count: number$1().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema,
+	data: RecordBodySchema,
+	at: number$1().int().nullable().optional(),
+	expiresAt: number$1().int().nullable().optional(),
+	ifRev: number$1().int().min(1).optional()
+}), object({
+	rev: number$1().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), object({
+	deleted: boolean(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	deleted: number$1().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(RecordQueryInputSchema, RecordQueryResultSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional()
+}), object({ count: number$1().int() }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number$1().int().optional(),
+	from: number$1(),
+	to: number$1(),
+	bucketMs: number$1().int().positive()
+}), object({ buckets: array(object({
+	bucketStart: number$1(),
+	count: number$1().int()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	op: _enum([
+		"sum",
+		"min",
+		"max",
+		"count"
+	]),
+	field: RecordFieldPathSchema.optional(),
+	groupBy: RecordFieldPathSchema.optional(),
+	where: RecordWhereSchema.optional()
+}), object({ rows: array(object({
+	group: union([
+		string(),
+		number$1(),
+		_null()
+	]),
+	value: number$1().nullable()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number$1().int().optional(),
+	atBefore: number$1().optional(),
+	where: RecordWhereSchema.optional()
+}), object({
+	deleted: number$1().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ ops: array(RecordTransactOpSchema).min(1).max(RECORD_BATCH_MAX) }), object({
+	results: array(object({
+		rev: number$1().int().nullable(),
+		deleted: boolean()
+	})),
+	releasedRefs: SecretRefsList,
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number$1().int(),
+	kinds: array(RecordKindNameSchema).optional()
+}), object({
+	deleted: record(string(), number$1().int()),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object(KindShape), object({ id: number$1().int() }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* The wire shapes of the migration API, version 1 (planning#447).
+*
+* A migration is code that outlives the server it was written against: an addon at
+* version 1.4 that is brought to 1.9 in one jump still runs its 1.4 catalogue, against
+* the 1.9 kernel. The only thing that code may call is {@link MigrationApiV1}; this file
+* is the contract of every method of it, one Zod pair per method.
+*
+* APPEND-ONLY. A released method is never removed and never changes meaning: an input
+* field is never removed or made required, an enum never narrows, an output field is
+* never removed. A change that cannot be expressed that way is `migration-api.v2`, next
+* to this file. `scripts/check-migration-api-append-only.ts` holds the line against
+* `scripts/migration-api-contract.json`, and every `behaviours` id below must have an
+* `it('<id>'` in `migration-api.contract.spec.ts`.
+*/
+var Rows = record(string(), unknown());
+var IntegrationId = object({ integrationId: string().min(1) });
+var RecordId = object({ id: string().min(1) });
+var RecordRowSchema = object({
+	id: string(),
+	deviceId: number$1().int().nullable(),
+	at: number$1().nullable(),
+	expiresAt: number$1().nullable(),
+	rev: number$1().int(),
+	updatedAt: number$1(),
+	data: Rows
+});
+var RecordPutShape = {
+	id: string().min(1),
+	deviceId: number$1().int().optional(),
+	at: number$1().int().optional(),
+	expiresAt: number$1().int().optional(),
+	data: Rows
+};
+var MigrationIntegrationSchema = object({
+	id: string(),
+	addonId: string(),
+	name: string(),
+	info: Rows,
+	originStableId: string().optional()
+});
+var MigrationDeviceSchema = object({
+	id: number$1().int(),
+	integrationId: string().nullable().optional(),
+	/** The owning device; null or absent for a root. */
+	parentDeviceId: number$1().int().nullable().optional(),
+	type: string().optional(),
+	name: string().optional(),
+	stableId: string().optional()
+});
+/** What the engine says about the migration API it serves: lets an addon notice an older server. */
+var MigrationApiInfoSchema = object({
+	version: number$1().int(),
+	methods: array(string())
+});
+object({
+	message: string(),
+	meta: Rows.optional(),
+	/** Grouping tags of the line; a line about a device carries `{ deviceId }`. */
+	tags: object({ deviceId: number$1().int().optional() }).optional()
+});
+object({
+	owner: string().min(1),
+	metas: array(MigrationMetaSchema)
+}), object({
+	bootId: string(),
+	snapshot: _enum([
+		"none",
+		"written",
+		"refused"
+	]),
+	steps: array(MigrationOwnerStepSchema),
+	/** The migration API the engine serves; absent from a server that predates it. */
+	migrationApi: MigrationApiInfoSchema.optional()
+}), object({ id: string().min(1) }), object({
+	proceed: boolean(),
+	state: union([literal("pending"), MigrationStatusSchema]),
+	reason: string().nullable()
+}), object({
+	id: string().min(1),
+	result: MigrationOwnerResultSchema
+}), object({
+	status: MigrationStatusSchema,
+	error: string().nullable(),
+	rowsChanged: number$1().int().nonnegative()
+}), object({
+	rows: number$1().int().nonnegative(),
+	secrets: number$1().int().nonnegative()
+}), IntegrationId.extend({ patch: Rows }), object({ written: boolean() }), IntegrationId.extend({ keys: array(string().min(1)) }), object({
+	present: boolean(),
+	removed: Rows
+}), RecordRowSchema.nullable(), RecordRowSchema.nullable(), object({
+	...RecordPutShape,
+	ifRev: number$1().int().optional()
+}), object({ rev: number$1().int() }), object({ records: array(object(RecordPutShape)) }), object({ count: number$1().int().nonnegative() }), RecordId.extend({
+	partial: Rows,
+	ifRev: number$1().int().optional()
+}), object({ rev: number$1().int() }), object({ deleted: boolean() }), object({
+	deviceId: number$1().int().optional(),
+	atFrom: number$1().optional(),
+	atTo: number$1().optional(),
+	where: RecordWhereSchema.optional(),
+	limit: number$1().int().min(1).optional(),
+	cursor: string().min(1).optional(),
+	resolveSecrets: boolean().optional()
+}), object({
+	records: array(RecordRowSchema),
+	nextCursor: string().nullable()
+}), object({
+	deviceId: number$1().int().optional(),
+	atBefore: number$1().optional(),
+	where: RecordWhereSchema.optional()
+}), object({ count: number$1().int().nonnegative() }), object({}), object({ store: Rows }), object({ patch: Rows }), object({}), object({ keys: array(string().min(1)) }), object({ removed: array(string()) }), object({ refs: array(string()) }), object({ values: record(string(), string().nullable()) }), object({
+	ref: string().min(1),
+	value: string()
+}), object({}), object({ refs: array(string()) }), object({ deleted: number$1().int().nonnegative() }), object({}), object({ integrations: array(MigrationIntegrationSchema) }), object({ id: string().min(1) }), MigrationIntegrationSchema.nullable(), object({
+	addonId: string().min(1),
+	integrationId: string().min(1).optional()
+}), object({ devices: array(MigrationDeviceSchema) }), object({ deviceId: number$1().int() }), object({
+	id: number$1().int(),
+	integrationId: string().nullable(),
+	/** Whether the device carries any stored config; its content is not offered. */
+	hasConfig: boolean()
+}).nullable(), object({
+	deviceId: number$1().int(),
+	integrationId: string().min(1)
+}), object({}), object({}), object({ nodeId: string() }), object({}), object({});
 method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { auth: "admin" }), method(object({ owner: string().optional() }), object({ pending: array(MigrationPendingEntrySchema) }), { auth: "admin" }), method(object({ id: string().min(1) }), MigrationDryRunResultSchema, { auth: "admin" }), method(object({
 	id: string().min(1),
 	error: string().min(1)
@@ -59474,7 +59873,9 @@ method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { aut
 		"written",
 		"refused"
 	]),
-	steps: array(MigrationOwnerStepSchema)
+	steps: array(MigrationOwnerStepSchema),
+	/** The migration API this engine serves (additive: a server that predates it omits it). */
+	migrationApi: MigrationApiInfoSchema.optional()
 }), {
 	kind: "mutation",
 	auth: "admin"
@@ -62141,7 +62542,10 @@ DeviceType.Camera, method(object({ deviceId: number$1() }), array(TrackSchema).r
 }), method(RelocateMediaInputSchema, object({ jobId: string() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }), method(RelocatableMediaCountInputSchema, RelocatableMediaCountSchema, {
+}), method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }), method(MediaLocationCensusInputSchema, MediaLocationCensusSchema, {
+	kind: "query",
+	auth: "admin"
+}), method(RelocatableMediaCountInputSchema, RelocatableMediaCountSchema, {
 	kind: "query",
 	auth: "admin"
 }), method(object({}), array(RelocateJobSchema).readonly(), {
@@ -64796,7 +65200,7 @@ var BrokerStatusSchema$1 = _enum([
 	"unreachable",
 	"tls-error"
 ]);
-var BrokerInfoSchema$1 = object({
+var BrokerInfoSchema = object({
 	id: string(),
 	name: string(),
 	url: string(),
@@ -64859,7 +65263,7 @@ var StatusSchema = object({
 	brokerCount: number$1(),
 	embeddedRunning: boolean()
 });
-method(_void(), array(BrokerInfoSchema$1)), method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }), method(AddBrokerInputSchema, AddBrokerResultSchema, {
+method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }), method(AddBrokerInputSchema, AddBrokerResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(IdInputSchema, _void(), {
@@ -72041,253 +72445,6 @@ DeviceType.Camera, DeviceType.Sensor, DeviceType.Switch, DeviceType.Gateway, met
 	auth: "admin"
 });
 /**
-* records - an addon's own facts and documents (D881): ledgers, audit rows,
-* config documents, mirrors. The third storage API next to `ctx.settings`
-* (operator intent, D870) and device-history (numbers over time, D850).
-*
-* Who the OWNER is: `callerAddonId`, stamped by the transport on a call that
-* crossed a process and stated by a hub in-process caller (`ctx.records` does
-* that with the addon id closed over). It is deliberately NOT in any input
-* schema, so a session can never supply it, and a call with no stamp is refused
-* `records/no-caller`. A kind is readable and writable only by its owner; other
-* addons go through the owner's capability.
-*
-* Every read is three-way: a row, `null`, or the call THROWS. A failed read is
-* never `[]`. Secret fields are never on the wire: a read shows the
-* redaction token, `secretRefs` hands the owner's `ctx.secrets` the refs it
-* resolves itself, and a write may carry only a keychain marker bound to the
-* row's own ref.
-*
-* Internal: addons reach it through `ctx.records`, never directly.
-*/
-var RecordIdSchema = string().min(1).max(256);
-/** A JSON object body. Size is the engine's check (`maxDataBytes`), not a schema's. */
-var RecordBodySchema = record(string(), unknown());
-var RecordInputSchema = object({
-	id: RecordIdSchema,
-	/** The device this row belongs to (D865 removal, per-device reads). */
-	deviceId: number$1().int().optional(),
-	/** The domain clock, ms: observed / created / opened. */
-	at: number$1().int().optional(),
-	/** Producer-set expiry, ms. Refused on a kind whose retention is an engine TTL. */
-	expiresAt: number$1().int().optional(),
-	data: RecordBodySchema
-});
-var RecordViewSchema = object({
-	id: string(),
-	deviceId: number$1().int().nullable(),
-	at: number$1().nullable(),
-	expiresAt: number$1().nullable(),
-	rev: number$1().int(),
-	updatedAt: number$1(),
-	data: RecordBodySchema
-});
-/** Declared index fields only. Anything else does not compile, by design. */
-var RecordWhereSchema = record(RecordFieldPathSchema, union([
-	string(),
-	number$1(),
-	boolean(),
-	object({ in: array(union([
-		string(),
-		number$1(),
-		boolean()
-	])).min(1).max(RECORD_BATCH_MAX) }),
-	object({
-		gt: union([string(), number$1()]).optional(),
-		gte: union([string(), number$1()]).optional(),
-		lt: union([string(), number$1()]).optional(),
-		lte: union([string(), number$1()]).optional()
-	}).refine((r) => Object.keys(r).length > 0, { message: "name at least one bound" })
-]));
-var KindShape = { kind: RecordKindNameSchema };
-var TimeWindowShape = {
-	deviceId: number$1().int().optional(),
-	atFrom: number$1().optional(),
-	atTo: number$1().optional()
-};
-var RecordQueryInputSchema = object({
-	...KindShape,
-	...TimeWindowShape,
-	where: RecordWhereSchema.optional(),
-	/** Without `where`: `at` (default for a kind with a clock) or `id`. With `where` the order is the index's. */
-	order: _enum(["at", "id"]).optional(),
-	desc: boolean().optional(),
-	limit: number$1().int().min(1).max(RECORD_QUERY_MAX).default(100),
-	/** Opaque keyset cursor from a previous answer. There is no offset. */
-	cursor: string().min(1).optional()
-});
-var RecordQueryResultSchema = object({
-	records: array(RecordViewSchema),
-	nextCursor: string().nullable()
-});
-var RecordKindStateSchema = _enum([
-	"created",
-	"unchanged",
-	"updated"
-]);
-var DeclareKindResultSchema = object({
-	kindId: number$1().int(),
-	state: RecordKindStateSchema,
-	createdIndexes: array(string())
-});
-/** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
-var SecretRefsList = array(string());
-/**
-* One op of a `transact`: the single-row writes, each on a kind of the caller.
-* All ops of one call share ONE database file and ONE `transactFamily`.
-*/
-var RecordTransactOpSchema = discriminatedUnion("op", [
-	object({
-		op: literal("put"),
-		kind: RecordKindNameSchema,
-		record: RecordInputSchema,
-		ifRev: number$1().int().min(0).optional()
-	}),
-	object({
-		op: literal("patch"),
-		kind: RecordKindNameSchema,
-		id: RecordIdSchema,
-		data: RecordBodySchema,
-		at: number$1().int().nullable().optional(),
-		expiresAt: number$1().int().nullable().optional(),
-		ifRev: number$1().int().min(1).optional()
-	}),
-	object({
-		op: literal("delete"),
-		kind: RecordKindNameSchema,
-		id: RecordIdSchema
-	})
-]);
-var RecordSecretRefsSchema = record(string(), record(string(), string()));
-method(object({ kinds: record(RecordKindNameSchema, RecordKindDeclarationSchema) }), object({ kinds: record(string(), DeclareKindResultSchema) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	id: RecordIdSchema
-}), RecordViewSchema.nullable(), { auth: "admin" }), method(object({
-	...KindShape,
-	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
-}), array(RecordViewSchema), { auth: "admin" }), method(object({
-	...KindShape,
-	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
-}), RecordSecretRefsSchema, { auth: "admin" }), method(object({
-	...KindShape,
-	record: RecordInputSchema,
-	/** Compare-and-set. `0` means "the row must not exist". */
-	ifRev: number$1().int().min(0).optional()
-}), object({
-	rev: number$1().int(),
-	releasedRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	records: array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX)
-}), object({
-	count: number$1().int(),
-	releasedRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	id: RecordIdSchema,
-	data: RecordBodySchema,
-	at: number$1().int().nullable().optional(),
-	expiresAt: number$1().int().nullable().optional(),
-	ifRev: number$1().int().min(1).optional()
-}), object({
-	rev: number$1().int(),
-	releasedRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	id: RecordIdSchema
-}), object({
-	deleted: boolean(),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
-}), object({
-	deleted: number$1().int(),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(RecordQueryInputSchema, RecordQueryResultSchema, { auth: "admin" }), method(object({
-	...KindShape,
-	...TimeWindowShape,
-	where: RecordWhereSchema.optional()
-}), object({ count: number$1().int() }), { auth: "admin" }), method(object({
-	...KindShape,
-	deviceId: number$1().int().optional(),
-	from: number$1(),
-	to: number$1(),
-	bucketMs: number$1().int().positive()
-}), object({ buckets: array(object({
-	bucketStart: number$1(),
-	count: number$1().int()
-})) }), { auth: "admin" }), method(object({
-	...KindShape,
-	op: _enum([
-		"sum",
-		"min",
-		"max",
-		"count"
-	]),
-	field: RecordFieldPathSchema.optional(),
-	groupBy: RecordFieldPathSchema.optional(),
-	where: RecordWhereSchema.optional()
-}), object({ rows: array(object({
-	group: union([
-		string(),
-		number$1(),
-		_null()
-	]),
-	value: number$1().nullable()
-})) }), { auth: "admin" }), method(object({
-	...KindShape,
-	deviceId: number$1().int().optional(),
-	atBefore: number$1().optional(),
-	where: RecordWhereSchema.optional()
-}), object({
-	deleted: number$1().int(),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ ops: array(RecordTransactOpSchema).min(1).max(RECORD_BATCH_MAX) }), object({
-	results: array(object({
-		rev: number$1().int().nullable(),
-		deleted: boolean()
-	})),
-	releasedRefs: SecretRefsList,
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number$1().int(),
-	kinds: array(RecordKindNameSchema).optional()
-}), object({
-	deleted: record(string(), number$1().int()),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object(KindShape), object({ id: number$1().int() }), {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * record-entries - the ONE admin surface for every list of user-created entries
 * (D881): notification targets, brokers, LLM profiles, anything an addon
 * declares as an ENTRY kind (`entry: { title }` in `defineRecordKinds`).
@@ -82015,7 +82172,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 	* `deviceClasses` map (first registered type). `null` when manual creation is
 	* unsupported. Lets the Add-Device dialog pick the right type per provider.
 	*/
-	async getManualCreationType() {
+	async getManualCreationType(_input) {
 		if (!await this.supportsManualCreation()) return { deviceType: null };
 		return { deviceType: Object.values(DeviceType).find((t) => this.deviceClasses[t] !== void 0) ?? null };
 	}
@@ -82026,7 +82183,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 		return true;
 	}
 	async getChildCreationSchema(input) {
-		return this.onGetCreationSchema(input.type);
+		return this.onGetCreationSchema(input.type, { integrationId: input.integrationId });
 	}
 	/**
 	* Default kernel-orchestrated `createDevice` implementation. The
@@ -82038,7 +82195,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 	* `deviceClasses` instead.
 	*/
 	async createDevice(input) {
-		const spec = await this.onCreateDevice(input.type, input.config);
+		const spec = await this.onCreateDevice(input.type, input.config, { ...input.integrationId !== void 0 ? { integrationId: input.integrationId } : {} });
 		const Class = this.deviceClasses[spec.meta.type];
 		if (!Class) throw new Error(`${this.providerName} provider: no device class registered for type "${spec.meta.type}" — add it to the deviceClasses map`);
 		const stableId = this.generateStableId(spec.meta.type, spec.config);
@@ -83447,20 +83604,6 @@ Object.freeze({
 		access: "create",
 		role: "viewer"
 	},
-	"broker.add": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"broker.get": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"broker.getBrokerConfig": {
 		capName: "broker",
 		capScope: "system",
@@ -83468,20 +83611,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"broker.getSettings": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"broker.getSettingsSchema": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"broker.getState": {
 		capName: "broker",
 		capScope: "system",
@@ -83496,20 +83625,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"broker.list": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"broker.listProviders": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"broker.publish": {
 		capName: "broker",
 		capScope: "system",
@@ -83517,20 +83632,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"broker.remove": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
-	"broker.setSettings": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"broker.subscribe": {
 		capName: "broker",
 		capScope: "system",
@@ -83538,20 +83639,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"broker.testConnection": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"broker.testSettings": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"broker.unsubscribe": {
 		capName: "broker",
 		capScope: "system",
@@ -88515,6 +88602,13 @@ Object.freeze({
 		access: "view",
 		role: "viewer"
 	},
+	"pipelineAnalytics.getMediaLocationCensus": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"pipelineAnalytics.getMediaReclaimStatus": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -97765,6 +97859,15 @@ function rewriteLocation(location, currentUpstream, route) {
 /** Characters that may precede a URL that STARTS a value (never `=`, `?`, `&`, `%3D`). */
 var VALUE_START = String.raw`(?<=^|["'(\s>,\[{])`;
 /**
+* Subresource Integrity pins the bytes of a script or stylesheet. The proxy rewrites vendor
+* URLs inside those bytes (and re-serves them from another origin), so the hash can no longer
+* match and the browser refuses the file: the page renders with no script at all. The hub
+* already drops the CSP that would have enforced the same pin; the attribute goes with it.
+*/
+function stripIntegrity(html) {
+	return html.replace(/\s+integrity\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, "");
+}
+/**
 * Rewrite vendor URLs in a text body: absolute (`https://host/…`), protocol-relative
 * (`//host/…`) and JSON-escaped (`https:\/\/host\/…`) when they start a value; and, in
 * HTML/CSS, root-relative references (`href="/x"`, `url(/x)`) which would otherwise
@@ -97780,6 +97883,7 @@ function rewriteBody(body, kind, currentUpstream, route) {
 		const escaped = new RegExp(`${VALUE_START}(?:https?:)?\\\\/\\\\/${host}(?=\\\\/|["'?#\\s)\\]},<]|$)`, "g");
 		out = out.replace(escaped, escapedBase);
 	}
+	if (kind === "html") out = stripIntegrity(out);
 	const current = `${route.basePath}/${currentUpstream.host}/`;
 	const notMounted = `(?!/)(?!${escapeRegex(route.basePath.slice(1))}/)`;
 	if (kind === "html") {
@@ -98404,6 +98508,232 @@ object({
 	delay: number$1().nonnegative().optional(),
 	commands: record(string(), unknown())
 });
+var InstanceInUseError = class extends Error {
+	instanceId;
+	users;
+	name = "InstanceInUseError";
+	constructor(instanceId, users) {
+		super(`instance '${instanceId}' is still in use by ${users.map((u) => `${u.kind} '${u.name ?? u.id}' (${u.id})`).join(", ")}; unlink them first`);
+		this.instanceId = instanceId;
+		this.users = users;
+	}
+};
+/** Throw {@link InstanceInUseError} when any finder names a user of `instanceId`. */
+async function assertInstanceUnused(instanceId, finders) {
+	const users = [];
+	for (const finder of finders) users.push(...await finder.find(instanceId));
+	if (users.length > 0) throw new InstanceInUseError(instanceId, users);
+}
+/** The `instance-select` field of a link, keyed like the body field it fills. */
+function linkFieldDescriptor(key, target, labels) {
+	return {
+		type: "instance-select",
+		key,
+		label: labels.label,
+		...labels.description !== void 0 ? { description: labels.description } : {},
+		required: labels.required ?? true,
+		...labels.noneLabel !== void 0 ? { noneLabel: labels.noneLabel } : {},
+		functionCap: target.cap,
+		...target.kind !== void 0 ? { kind: target.kind } : {}
+	};
+}
+/** @deprecated use {@link InstanceInUseError}; this one only adds the old `brokerId` name. */
+var BrokerInUseError = class extends InstanceInUseError {
+	get brokerId() {
+		return this.instanceId;
+	}
+};
+/** @deprecated use {@link assertInstanceUnused}. */
+async function assertBrokerUnused(brokerId, finders) {
+	try {
+		await assertInstanceUnused(brokerId, finders);
+	} catch (err) {
+		if (err instanceof InstanceInUseError) throw new BrokerInUseError(err.instanceId, err.users);
+		throw err;
+	}
+}
+/** @deprecated use `guardInstanceDelete`. */
+function guardBrokerDelete(base, users) {
+	return {
+		...base,
+		deleteInstance: async (input) => {
+			await assertBrokerUnused(input.id, users());
+			return base.deleteInstance(input);
+		}
+	};
+}
+/**
+* The generic binding of a service to a broker (D1012). A service (an integration today; a
+* notifier target, a calendar source or an exporter later) names the broker it runs through by id
+* and keeps only its OWN link settings: never a copy of the broker's host, sign-in or secrets,
+* which stay with the broker and are edited on the Brokers page.
+*
+* One primitive serves every consumer:
+*  - {@link declareBrokerLinkKind}: the record kind, body `{ name, brokerId, ...linkFields }`;
+*  - {@link buildBrokerLinkForm}: the form, a `broker-select` picker plus the service's link
+*    sections, which may be DYNAMIC (a list read from the chosen broker, like HA calendars);
+*  - {@link buildBrokerLinkInstances}: the `integration-instances` provider of an integration;
+*  - {@link resolveBrokerId} / {@link brokerLinkUserFinder}: which broker a record names and which
+*    records name a broker, so a delete of a broker still in use can name its users generically.
+*/
+/** The record kind an integration is stored under. */
+var BROKER_LINK_KIND_NAME = "connections";
+/** What every broker-linked record carries; `brokerId` is always present, `''` is a row whose broker is not picked yet; link fields of the service come on top. */
+var BrokerLinkBodySchema = entryBody({ brokerId: string() });
+function declareBrokerLinkKind(spec) {
+	return defineEntryKind(BROKER_LINK_KIND_NAME, {
+		title: spec.title,
+		schema: BrokerLinkBodySchema.extend(spec.linkFields ?? {}),
+		writeTrigger: spec.writeTrigger
+	});
+}
+/** The form: a picker over the brokers of `brokerKind`, then the service's link sections. */
+async function buildBrokerLinkForm(spec, brokerId) {
+	const dynamic = brokerId !== void 0 && spec.dynamicSections !== void 0 ? await spec.dynamicSections(brokerId) : [];
+	return { sections: [
+		{
+			id: "broker-link",
+			title: spec.brokerLabel,
+			description: `Each integration links to a ${spec.brokerLabel} connection (Connectivity → Brokers). The connection and its sign-in are edited there.`,
+			columns: 1,
+			fields: [{
+				type: "broker-select",
+				key: "brokerId",
+				label: spec.brokerLabel,
+				brokerKind: spec.brokerKind
+			}]
+		},
+		...spec.linkSections ?? [],
+		...dynamic
+	] };
+}
+/** The broker a record names; undefined while it names none. */
+function resolveBrokerId(record) {
+	return record.brokerId === void 0 || record.brokerId === "" ? void 0 : record.brokerId;
+}
+/** The broker an integration links to, from its record. */
+async function brokerIdOf(instances, integrationId) {
+	const body = await instances.getResolved(integrationId);
+	return body === null ? void 0 : resolveBrokerId(body);
+}
+/** Every record of the kind that names `brokerId`, as users of that broker. */
+function brokerLinkUserFinder(instances, userKind = "integration") {
+	return { find: async (brokerId) => (await instances.listResolved()).filter((entry) => resolveBrokerId(entry.body) === brokerId).map((entry) => ({
+		kind: userKind,
+		id: entry.id,
+		name: entry.body.name
+	})) };
+}
+/** The `integration-instances` provider of an addon whose integrations link to a broker. */
+function buildBrokerLinkInstances(records, spec) {
+	const instances = new RecordIntegrationInstances(records, spec.kind, {
+		description: {
+			role: "devices",
+			instanceMode: "multiple",
+			kind: "connection",
+			canTest: false
+		},
+		formSchema: async (id) => buildBrokerLinkForm(spec, id === null ? void 0 : await brokerIdOf(instances, id)),
+		initialBody: (name) => spec.kind.schema.parse({
+			name,
+			brokerId: ""
+		}),
+		configured: (body) => resolveBrokerId(body) !== void 0,
+		...spec.onChanged !== void 0 ? { onChanged: spec.onChanged } : {}
+	});
+	return instances;
+}
+var BROKER_ROWS_MAX = 1e3;
+var STRAY_REGISTRY_ID = /^int_\d+$/;
+async function moveBrokerLinksToConnections(ports) {
+	const brokers = await ports.listBrokers();
+	const strays = brokers.filter((b) => STRAY_REGISTRY_ID.test(b.id));
+	if (strays.length > 0) ports.warn(`${strays.length} broker row(s) are keyed like a registry integration and are left as they are: ${strays.map((s) => s.id).join(", ")}`);
+	let moved = 0;
+	for (const broker of brokers) {
+		const integrationId = broker.integrationId;
+		if (integrationId === void 0 || integrationId === "") continue;
+		const existing = await ports.readConnection(integrationId);
+		if (existing === null) await ports.putConnection(integrationId, {
+			name: broker.name,
+			brokerId: broker.id
+		});
+		else if (existing.brokerId !== broker.id) {
+			ports.warn(`integration '${integrationId}' already names broker '${existing.brokerId ?? "none"}', not '${broker.id}'; the link stays on the broker`);
+			continue;
+		}
+		if ((await ports.readConnection(integrationId))?.brokerId !== broker.id) throw new Error(`integration '${integrationId}': the link did not read back - broker '${broker.id}' keeps it`);
+		await ports.clearBrokerLink(broker.id);
+		moved += 1;
+	}
+	return {
+		outcome: moved === 0 ? "already-done" : "done",
+		summary: {
+			brokers: brokers.length,
+			moved,
+			strayIntegrationRows: strays.length
+		}
+	};
+}
+/** The ports over the two record kinds of the addon. */
+function brokerLinkPortsOver(deps) {
+	return {
+		warn: deps.warn,
+		listBrokers: async () => {
+			return (await deps.brokers.query({ limit: BROKER_ROWS_MAX })).records.map((row) => {
+				const name = row.data["name"];
+				const link = row.data["integrationId"];
+				return {
+					id: row.id,
+					name: typeof name === "string" && name.length > 0 ? name : row.id,
+					integrationId: typeof link === "string" ? link : void 0
+				};
+			});
+		},
+		readConnection: async (id) => {
+			const row = await deps.connections.get(id);
+			return row === null ? null : { brokerId: row.data.brokerId };
+		},
+		putConnection: async (id, body) => {
+			await deps.connections.put({
+				id,
+				data: body
+			}, { ifRev: 0 });
+		},
+		clearBrokerLink: async (brokerId) => {
+			await deps.brokers.patch(brokerId, { integrationId: null });
+		}
+	};
+}
+//#endregion
+//#region src/speak/constants.ts
+/** Echo speech limits and the worker restart bound (same window as CrashSupervisor). */
+var ALEXA_SPEAK_ADDON_ID = "import-alexa";
+var ALEXA_SPEAK_KIND = "alexa-echo";
+/** The kind of the Amazon-account broker the Echoes are read from. */
+var ALEXA_BROKER_KIND = "alexa";
+/** The Amazon account an Echo target speaks through. */
+var ALEXA_ACCOUNT_LINK = {
+	cap: "broker",
+	kind: ALEXA_BROKER_KIND
+};
+var DEVICE_REFRESH_MS = 5 * 6e4;
+/** Where the addon serves the Alexa mark; `listTargetKinds` stamps it as `iconUrl`. */
+var ALEXA_SPEAK_ICON_URL = `/addon/${ALEXA_SPEAK_ADDON_ID}/icons/${ALEXA_SPEAK_KIND}`;
+/** How often an adopted Echo's player state is read (a push channel is a later phase). */
+var ECHO_POLL_MS = 3e4;
+/** One more read after a command, once Amazon has had time to apply it. */
+var ECHO_REREAD_MS = 1500;
+/** After a 429 the account is left alone for this long, doubling up to the cap. */
+var ECHO_RATE_BACKOFF_BASE_MS = 3e4;
+var ECHO_RATE_BACKOFF_MAX_MS = 5 * 6e4;
+/**
+* A command (volume, play, Do Not Disturb) that has not started within this, or not
+* finished, is answered with an error instead of running minutes late.
+*/
+var ECHO_COMMAND_DEADLINE_MS = 12e3;
+/** A poll read is stale after this; it is dropped from the queue rather than sent late. */
+var ECHO_READ_DEADLINE_MS = 25e3;
 //#endregion
 //#region src/config.ts
 /**
@@ -98449,7 +98779,6 @@ var AlexaBrokerEntrySchema = object({
 	id: string().min(1),
 	name: string().min(1),
 	connection: alexaConnectionSchema,
-	integrationId: string().optional(),
 	/** Absent means on; the instances page switches a connection off without deleting it. */
 	enabled: boolean().optional()
 });
@@ -98462,7 +98791,7 @@ var alexaEchoTargetSchema = object({
 	name: string(),
 	enabled: boolean(),
 	/** The broker (Amazon account) the Echo belongs to; '' until one is chosen. */
-	brokerId: string().default(""),
+	brokerId: linkField(ALEXA_ACCOUNT_LINK).default(""),
 	echoId: string(),
 	respectDnd: boolean()
 });
@@ -142695,7 +143024,6 @@ var AlexaBrokerRegistry = class {
 	#onStatesPolled;
 	#makeManager;
 	#managers = /* @__PURE__ */ new Map();
-	#integrationToBroker = /* @__PURE__ */ new Map();
 	#nextId = 1;
 	constructor(logger, deps = {}) {
 		this.#logger = logger;
@@ -142746,7 +143074,6 @@ var AlexaBrokerRegistry = class {
 			}
 		}));
 		this.#managers.clear();
-		this.#integrationToBroker.clear();
 	}
 	setOnBrokerConnected(cb) {
 		this.#onBrokerConnected = cb;
@@ -142769,17 +143096,14 @@ var AlexaBrokerRegistry = class {
 		const entry = {
 			id,
 			name,
-			connection,
-			...opts.integrationId !== void 0 ? { integrationId: opts.integrationId } : {}
+			connection
 		};
 		await this.#startManager(entry);
-		if (opts.integrationId !== void 0) this.#integrationToBroker.set(opts.integrationId, id);
 		return entry;
 	}
 	async removeEntry(id) {
 		const mgr = this.#managers.get(id);
 		if (!mgr) return;
-		for (const [integrationId, brokerId] of this.#integrationToBroker.entries()) if (brokerId === id) this.#integrationToBroker.delete(integrationId);
 		this.#managers.delete(id);
 		try {
 			await mgr.stop();
@@ -142805,9 +143129,6 @@ var AlexaBrokerRegistry = class {
 		if (!mgr) throw new Error(`AlexaBrokerRegistry: unknown broker id "${brokerId}"`);
 		await mgr.sendCommand(command);
 	}
-	linkIntegration(integrationId, brokerId) {
-		this.#integrationToBroker.set(integrationId, brokerId);
-	}
 	list() {
 		return Array.from(this.#managers.values()).map((m) => m.getInfo());
 	}
@@ -142826,10 +143147,7 @@ var AlexaBrokerRegistry = class {
 		return count;
 	}
 	async #startManager(entry) {
-		if (this.#managers.has(entry.id)) {
-			if (entry.integrationId !== void 0) this.#integrationToBroker.set(entry.integrationId, entry.id);
-			return;
-		}
+		if (this.#managers.has(entry.id)) return;
 		const mgr = this.#makeManager({
 			id: entry.id,
 			name: entry.name,
@@ -142842,7 +143160,6 @@ var AlexaBrokerRegistry = class {
 			onStatesPolled: (id, values) => this.#onStatesPolled(id, values)
 		});
 		this.#managers.set(entry.id, mgr);
-		if (entry.integrationId !== void 0) this.#integrationToBroker.set(entry.integrationId, entry.id);
 		await mgr.start();
 	}
 	/** The next free broker id, for a record minted before its manager exists. */
@@ -142906,40 +143223,15 @@ async function removeSessionFile(dataDir, brokerId) {
 	await fs$1.rm(sessionPath(dataDir, brokerId), { force: true });
 }
 //#endregion
-//#region src/speak/constants.ts
-/** Echo speech limits and the worker restart bound (same window as CrashSupervisor). */
-var ALEXA_SPEAK_ADDON_ID = "import-alexa";
-var ALEXA_SPEAK_KIND = "alexa-echo";
-/** The kind of the Amazon-account broker the Echoes are read from. */
-var ALEXA_BROKER_KIND = "alexa";
-var DEVICE_REFRESH_MS = 5 * 6e4;
-/** Where the addon serves the Alexa mark; `listTargetKinds` stamps it as `iconUrl`. */
-var ALEXA_SPEAK_ICON_URL = `/addon/${ALEXA_SPEAK_ADDON_ID}/icons/${ALEXA_SPEAK_KIND}`;
-/** How often an adopted Echo's player state is read (a push channel is a later phase). */
-var ECHO_POLL_MS = 3e4;
-/** One more read after a command, once Amazon has had time to apply it. */
-var ECHO_REREAD_MS = 1500;
-/** After a 429 the account is left alone for this long, doubling up to the cap. */
-var ECHO_RATE_BACKOFF_BASE_MS = 3e4;
-var ECHO_RATE_BACKOFF_MAX_MS = 5 * 6e4;
-/**
-* A command (volume, play, Do Not Disturb) that has not started within this, or not
-* finished, is answered with an error instead of running minutes late.
-*/
-var ECHO_COMMAND_DEADLINE_MS = 12e3;
-/** A poll read is stale after this; it is dropped from the queue rather than sent late. */
-var ECHO_READ_DEADLINE_MS = 25e3;
-//#endregion
 //#region src/alexa-broker-provider.ts
 /**
 * Construct the `broker` cap provider for the Alexa import addon. Pure builder.
-* Mirrors `buildEcowittBrokerProvider`. The cookie + refresh token are secrets:
-* redacted on settings reads, preserved on an empty round-trip. State sync is
-* poll-based (no pub/sub) — `publish`/`subscribe`/`getState` are no-ops.
+* The bus half only (D1013): creating, listing, editing and removing an account is
+* `integration-instances`. The cookie + refresh token are secrets, redacted on the config
+* read. State sync is poll-based (no pub/sub) — `publish`/`subscribe`/`getState` are no-ops.
 */
 function buildAlexaBrokerProvider(deps) {
-	const { ownerAddonId, registry, getBrokers, persistBrokers, cascadeRemoveDevices, logger } = deps;
-	const owns = (id) => getBrokers().some((b) => b.id === id);
+	const { registry, getBrokers } = deps;
 	const redact = (entry) => ({
 		...entry.connection,
 		cookie: "",
@@ -142947,108 +143239,10 @@ function buildAlexaBrokerProvider(deps) {
 		macDms: ""
 	});
 	return {
-		list: async ({ kind }) => {
-			if (kind && kind !== "alexa") return [];
-			return registry.list().map((info) => ({
-				...info,
-				addonId: ownerAddonId
-			}));
-		},
-		get: async ({ id }) => {
-			const info = registry.get(id);
-			return info ? {
-				...info,
-				addonId: ownerAddonId
-			} : null;
-		},
-		listProviders: async () => [{
-			addonId: ownerAddonId,
-			kinds: [{
-				kind: ALEXA_BROKER_KIND,
-				label: "Alexa",
-				signIn: {
-					basePath: "/addon/import-alexa/login",
-					methods: ["device-code", "proxy"]
-				}
-			}]
-		}],
-		add: async ({ kind, name, settings }) => {
-			if (kind !== "alexa") throw new Error(`import-alexa: only kind '${ALEXA_BROKER_KIND}' is handled here (got '${kind}')`);
-			const entry = await registry.createEntry(name, settingsToAlexaConnection(settings));
-			await persistBrokers([...getBrokers(), entry]);
-			return { id: entry.id };
-		},
-		remove: async ({ id }) => {
-			if (!owns(id)) return;
-			await registry.removeEntry(id);
-			await cascadeRemoveDevices(id).catch((err) => {
-				logger.warn("alexa: broker cascade-remove threw", {
-					tags: { brokerId: id },
-					meta: { error: errMsg(err) }
-				});
-			});
-			await persistBrokers(getBrokers().filter((b) => b.id !== id));
-		},
-		testConnection: async ({ id }) => {
-			if (!owns(id)) return {
-				ok: false,
-				error: "unknown broker"
-			};
-			const info = registry.get(id);
-			if (!info) return {
-				ok: false,
-				error: "unknown broker"
-			};
-			if (info.status === "connected") return {
-				ok: true,
-				latencyMs: info.lastCheckedAt ? Math.max(0, Date.now() - info.lastCheckedAt) : 0
-			};
-			return {
-				ok: false,
-				error: info.error ?? `status: ${info.status}`
-			};
-		},
-		getSettings: async ({ id }) => {
-			const entry = getBrokers().find((b) => b.id === id);
-			return entry ? redact(entry) : null;
-		},
-		setSettings: async ({ id, settings }) => {
-			if (!owns(id)) return;
-			const existing = getBrokers().find((b) => b.id === id);
-			if (!existing) return;
-			const parsed = settingsToAlexaConnection(settings);
-			const merged = {
-				...parsed,
-				cookie: parsed.cookie.length > 0 ? parsed.cookie : existing.connection.cookie,
-				refreshToken: parsed.refreshToken.length > 0 ? parsed.refreshToken : existing.connection.refreshToken,
-				macDms: parsed.macDms.length > 0 ? parsed.macDms : existing.connection.macDms
-			};
-			const updated = await registry.updateEntry(id, merged);
-			await persistBrokers(getBrokers().map((b) => b.id === id ? updated : b));
-		},
 		getBrokerConfig: async ({ id }) => {
 			const entry = getBrokers().find((b) => b.id === id);
 			return entry ? redact(entry) : null;
 		},
-		getSettingsSchema: async ({ kind }) => {
-			if (kind !== "alexa") return null;
-			return buildConnectionFormSchema();
-		},
-		testSettings: async ({ kind, settings }) => {
-			if (kind !== "alexa") return {
-				ok: false,
-				error: `unsupported kind: ${kind}`
-			};
-			try {
-				settingsToAlexaConnection(settings);
-				return { ok: true };
-			} catch (err) {
-				return {
-					ok: false,
-					error: errMsg(err)
-				};
-			}
-		},
 		publish: async () => null,
 		subscribe: async () => ({ subscriptionId: "" }),
 		unsubscribe: async () => void 0,
@@ -143374,7 +143568,7 @@ function buildAlexaAdoptionProvider(deps) {
 //#region src/alexa-broker-device-cascade.ts
 /**
 * Remove every adopted Alexa device whose persisted config carries
-* `{ system: 'alexa', brokerId }`. Used on broker.remove and integration delete.
+* `{ system: 'alexa', brokerId }`. Used when an account instance is deleted and when an integration is deleted.
 * Alexa appliances are flat (standalone) devices, so this removes top-level
 * devices directly. Best-effort per device; returns the count removed. Mirrors
 * the Ecowitt cascade helper.
@@ -144338,6 +144532,7 @@ var alexaBrokersEntryKind = defineEntryKind("brokers", {
 	title: "Alexa import brokers",
 	schema: entryBody({
 		...alexaConnectionSchema.shape,
+		/** Retired (D1012): the link lives on the integration's `connections` record. Only the migration reads it. */
 		integrationId: string().optional(),
 		enabled: boolean().optional()
 	}),
@@ -144349,20 +144544,27 @@ var alexaSpeakSessionsEntryKind = defineEntryKind("speak-sessions", {
 	schema: entryBody({ session: string().default("").meta({ secret: true }) }),
 	writeTrigger: "an Echo worker signs in as an Alexa account broker"
 });
+/** An Alexa integration: the link to the Alexa account (broker) it imports devices from. */
+var alexaConnectionsEntryKind = declareBrokerLinkKind({
+	title: "Alexa integrations",
+	writeTrigger: "an operator links an Alexa integration to an Alexa account"
+});
 /** Every kind this addon declares, keyed by its name: `records.declare` refuses any other key. */
 var alexaRecordKinds = {
 	brokers: alexaBrokersEntryKind,
+	connections: alexaConnectionsEntryKind,
 	"speak-sessions": alexaSpeakSessionsEntryKind
 };
 //#endregion
-//#region src/alexa-instances.ts
+//#region src/alexa-account-instances.ts
 /**
-* The Alexa accounts as `integration-instances` (planning#408 P3): one instance per `brokers`
-* record, over the SAME records and ids (`alexa_NNN`) the `broker` cap serves. The body is flat, so
+* The Alexa accounts as `integration-instances` (planning#408 P3, D1013): one instance per `brokers`
+* record, over the SAME records and ids (`alexa_NNN`) the `broker` cap serves; the `account` kind of
+* the composed provider (the integrations are the `integration` kind, `alexa-instances.ts`). The body is flat, so
 * the form the instances page edits is the stored shape. Signing in (device code or the Amazon
 * login proxy) goes through the routes the addon already serves under `/addon/import-alexa/login`.
 */
-var ALEXA_INSTANCE_KIND = "alexa";
+var ALEXA_ACCOUNT_KIND = "account";
 var ALEXA_SIGN_IN_PATH = "/addon/import-alexa/login";
 function isAlexaBodyConfigured(body) {
 	return body.cookie.length > 0 || body.refreshToken.length > 0;
@@ -144390,21 +144592,13 @@ function statusOf(info, configured) {
 		...info.error !== null ? { detail: info.error } : {}
 	};
 }
-function buildAlexaInstances(records, deps) {
+function buildAlexaAccountInstances(records, deps) {
 	return new RecordIntegrationInstances(records, alexaBrokersEntryKind, {
 		description: {
-			role: "both",
+			role: "services",
 			instanceMode: "multiple",
 			kind: "account",
 			canTest: true,
-			kinds: [{
-				id: ALEXA_INSTANCE_KIND,
-				label: "Alexa",
-				signIn: {
-					basePath: ALEXA_SIGN_IN_PATH,
-					methods: ["device-code", "proxy"]
-				}
-			}],
 			allowRestoreId: true
 		},
 		formSchema: () => buildConnectionFormSchema(),
@@ -144417,7 +144611,7 @@ function buildAlexaInstances(records, deps) {
 			pollIntervalMs: 6e4
 		}),
 		mintId: () => deps.mintId(),
-		kindOf: () => ALEXA_INSTANCE_KIND,
+		kindOf: () => ALEXA_ACCOUNT_KIND,
 		health: (body, id) => {
 			const info = deps.infoOf(id);
 			return {
@@ -144446,6 +144640,21 @@ function buildAlexaInstances(records, deps) {
 	});
 }
 //#endregion
+//#region src/alexa-instances.ts
+/**
+* The Alexa integrations as `integration-instances` (D1012): one `connections` record per
+* integration, keyed by the registry id, whose body is the link to an Alexa account (a `brokers`
+* record, edited on the Brokers page). The account's sign-in and secrets are never copied here.
+*/
+function buildAlexaInstances(records) {
+	return buildBrokerLinkInstances(records, {
+		kind: alexaConnectionsEntryKind,
+		brokerKind: ALEXA_BROKER_KIND,
+		brokerLabel: "Alexa account",
+		onChanged: () => void 0
+	});
+}
+//#endregion
 //#region src/alexa-broker-store.ts
 function rowToEntry(id, data) {
 	const parsed = AlexaBrokerEntrySchema.safeParse({
@@ -144458,7 +144667,6 @@ function rowToEntry(id, data) {
 			macDms: data.macDms,
 			pollIntervalMs: data.pollIntervalMs
 		},
-		integrationId: data.integrationId,
 		enabled: data.enabled
 	});
 	return parsed.success ? parsed.data : null;
@@ -144495,11 +144703,10 @@ var AlexaBrokerStore = class AlexaBrokerStore {
 		const nextIds = new Set(entries.map((e) => e.id));
 		for (const row of page.records) if (!nextIds.has(row.id)) await this.kind.delete(row.id);
 		for (const entry of entries) {
-			const { id, name, connection, integrationId, enabled } = entry;
+			const { id, name, connection, enabled } = entry;
 			const body = {
 				name,
 				...connection,
-				...integrationId === void 0 ? {} : { integrationId },
 				...enabled === void 0 ? {} : { enabled }
 			};
 			const parsed = alexaBrokersEntryKind.schema.safeParse(body);
@@ -145026,6 +145233,13 @@ function speechFromNotification(notification) {
 }
 //#endregion
 //#region src/speak/provider.ts
+/**
+* `notification-output` provider for Echo devices. Text is the rule template
+* as plain speech. A burst collapses or waits; it is not queued. A transport
+* failure is `success: false` so the notification outbox retries. A collapse,
+* a rate limit, or Do Not Disturb is a recorded skip (`success: true`) so the
+* outbox does not speak the same sentence again later.
+*/
 function quietLogger$1() {
 	const logger = {
 		debug() {},
@@ -145081,11 +145295,8 @@ function configSchema() {
 		title: "Echo",
 		titleKey: "import-alexa:echoTarget.s_echo.title",
 		fields: [...[{
-			type: "broker-select",
-			key: "brokerId",
-			label: "Amazon account",
-			labelKey: "import-alexa:echoTarget.s_echo.brokerId.label",
-			brokerKind: ALEXA_BROKER_KIND
+			...linkFieldDescriptor("brokerId", ALEXA_ACCOUNT_LINK, { label: "Amazon account" }),
+			labelKey: "import-alexa:echoTarget.s_echo.brokerId.label"
 		}, {
 			type: "select",
 			key: "echoId",
@@ -146082,6 +146293,21 @@ async function flattenBrokerRecords(ports) {
 	});
 }
 //#endregion
+//#region src/migrations/broker-links-to-connections.ts
+var BROKER_LINKS_TO_CONNECTIONS_ID = "import-alexa/2026-11-05-broker-links-to-connections";
+/** The broker records and the integration (`connections`) records of this addon. */
+function alexaBrokerLinkPorts(records, warn) {
+	return brokerLinkPortsOver({
+		brokers: records.kind({
+			name: alexaBrokersEntryKind.name,
+			declaration: alexaBrokersEntryKind.declaration,
+			schema: record(string(), unknown())
+		}),
+		connections: records.kind(alexaConnectionsEntryKind),
+		warn
+	});
+}
+//#endregion
 //#region src/migrations/strip-echo-target-volume-and-mode.ts
 var RETIRED_KEYS = ["volume", "mode"];
 function isRecord(value) {
@@ -146164,8 +146390,30 @@ var ADDON_MIGRATIONS = [
 			fixtureMark: "the name of the broker and the integration it already names"
 		},
 		procedure: moveAlexaIntegrationRows
+	},
+	{
+		meta: {
+			id: BROKER_LINKS_TO_CONNECTIONS_ID,
+			owner: "import-alexa",
+			level: "addon-state",
+			seq: 4,
+			dependsOn: [INTEGRATION_ROWS_TO_RECORD_ID],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "block-owner",
+			bodyKind: "procedure",
+			description: "Write each integration a connections record naming its Alexa account (keyed by the integration id), then clear the integration link on the account; stray registry-keyed account rows are counted and logged, never deleted",
+			fixtureMark: "the name and the extra field of the account that keeps its record"
+		},
+		procedure: moveBrokerLinksToConnections
 	}
 ];
+/** The migrations that rewrite the broker records: they run BEFORE anything reads or persists one. */
+var BROKER_RECORD_MIGRATION_IDS = [
+	FLATTEN_BROKER_RECORDS_ID,
+	INTEGRATION_ROWS_TO_RECORD_ID,
+	BROKER_LINKS_TO_CONNECTIONS_ID
+];
 //#endregion
 //#region src/speak/icon-routes.ts
 var ALEXA_ICON_SVG = "<svg role=\"img\" viewBox=\"0 0 24 24\" xmlns=\"http://www.w3.org/2000/svg\" fill=\"#00CAFF\"><title>Amazon Alexa</title><path d=\"M12 0C5.37 0 0 5.37 0 12C0 18.09 4.53 23.11 10.4 23.9V21.5A1.59 1.59 0 0 0 9.32 19.97A8.41 8.41 0 0 1 3.6 11.8A8.37 8.37 0 0 1 12.09 3.6A8.4 8.4 0 0 1 20.4 12.31L20.39 12.38A8.68 8.68 0 0 1 20.36 12.76C20.36 12.83 20.35 12.9 20.34 12.96C20.34 13.04 20.33 13.12 20.32 13.19L20.3 13.29C19.27 20.07 10.45 23.87 10.4 23.9C10.92 23.97 11.46 24 12 24C18.63 24 24 18.63 24 12S18.63 0 12 0Z\"/></svg>";
@@ -146264,6 +146512,7 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 	loginProxy = null;
 	brokerStore = null;
 	instances = null;
+	accountInstances = null;
 	activeBrokers = [];
 	speak = null;
 	constructor() {
@@ -146275,12 +146524,13 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		if (records === void 0) throw new Error("import-alexa: ctx.records is required (hub-only addon)");
 		await records.declare(alexaRecordKinds);
 		this.brokerStore = AlexaBrokerStore.of(records);
-		this.instances = buildAlexaInstances(records, {
+		this.instances = buildAlexaInstances(records);
+		this.accountInstances = buildAlexaAccountInstances(records, {
 			mintId: () => this.requireRegistry().allocateId(),
 			infoOf: (id) => this.registry?.get(id) ?? null,
 			onChanged: (id) => this.syncBrokerRuntime(id)
 		});
-		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, this.migrationPorts(records)), { only: [FLATTEN_BROKER_RECORDS_ID] });
+		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, this.migrationPorts(records)), { only: BROKER_RECORD_MIGRATION_IDS });
 		this.activeBrokers = await this.loadPersistedBrokers();
 		await this.adoptSessionFiles();
 		this.registry = new AlexaBrokerRegistry(this.ctx.logger, {
@@ -146315,15 +146565,13 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		});
 		this.deviceCodeLogin = new AlexaDeviceCodeManager({ logger: this.ctx.logger });
 		this.ctx.logger.info("Alexa: import addon initialised", { meta: { brokerCount: this.activeBrokers.length } });
-		await this.reconcileIntegrationsToBrokers();
-		this.subscribeIntegrationLifecycle();
 		const loginRoutes = [...buildAlexaLoginRoutes({
 			logger: this.ctx.logger,
 			proxyLogin: this.proxyLogin,
 			deviceCode: this.deviceCodeLogin,
 			commitCookie: (input) => this.commitCapturedCookie(input)
 		}), ...speakIconRoutes()];
-		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, this.migrationPorts(records)), { only: ADDON_MIGRATIONS.map((m) => m.meta.id).filter((id) => id !== FLATTEN_BROKER_RECORDS_ID) });
+		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, this.migrationPorts(records)), { only: ADDON_MIGRATIONS.map((m) => m.meta.id).filter((id) => !BROKER_RECORD_MIGRATION_IDS.includes(id)) });
 		const speak = new AlexaSpeakController({
 			logger: this.ctx.logger.child("speak"),
 			readConfig: () => this.config,
@@ -146355,7 +146603,7 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 			},
 			{
 				capability: integrationInstancesCapability,
-				provider: this.requireInstances().toProvider()
+				provider: this.buildInstancesProvider()
 			},
 			{
 				capability: deviceAdoptionCapability,
@@ -146380,6 +146628,7 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 				await this.updateGlobalSettings({ echoTargets: [...readEchoTargets({ echoTargets: rows })] });
 			},
 			...flattenPortsOver(records.kind(alexaBrokersEntryKind)),
+			...alexaBrokerLinkPorts(records, (message) => this.ctx.logger.warn(message)),
 			...alexaIntegrationRowsPorts({
 				api: defaultIntegrationApiOver(this.ctx.api),
 				records,
@@ -146388,10 +146637,42 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 			})
 		};
 	}
+	/** One provider over the two record kinds: the account (broker) and the integrations using it. */
+	buildInstancesProvider() {
+		if (this.accountInstances === null) throw new Error("import-alexa: account instances not ready");
+		return composeInstanceKinds([{
+			kind: {
+				id: "account",
+				label: "Alexa account",
+				functionCap: "broker",
+				brokerKind: ALEXA_BROKER_KIND,
+				role: "services",
+				signIn: {
+					basePath: ALEXA_SIGN_IN_PATH,
+					methods: ["device-code", "proxy"]
+				}
+			},
+			provider: guardBrokerDelete(this.accountInstances.toProvider(), () => this.brokerUsers())
+		}, {
+			kind: {
+				id: "integration",
+				label: "Alexa",
+				functionCap: "device-provider",
+				role: "devices"
+			},
+			provider: this.requireInstances().toProvider()
+		}], {
+			role: "devices",
+			instanceMode: "multiple",
+			kind: "account",
+			canTest: true,
+			allowRestoreId: true
+		});
+	}
 	/**
-	* Bring the runtime in line with one record after the instances page changed it: a removed
-	* record stops its manager and cascades its devices, an off record only stops the manager, a
-	* live one re-applies its connection or starts under the record's own id.
+	* Bring the runtime in line with one account record after the instances page changed it: a
+	* removed record stops its manager and cascades its devices, an off record only stops the
+	* manager, a live one re-applies its connection or starts under the record's own id.
 	*/
 	async syncBrokerRuntime(id) {
 		const reg = this.requireRegistry();
@@ -146412,10 +146693,7 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		try {
 			if (reg.get(id) !== null) {
 				if (!sameConnection(entry.connection, reg.getConnection(id))) await reg.updateEntry(id, entry.connection);
-			} else await reg.createEntry(entry.name, entry.connection, {
-				id,
-				...entry.integrationId !== void 0 ? { integrationId: entry.integrationId } : {}
-			});
+			} else await reg.createEntry(entry.name, entry.connection, { id });
 		} catch (err) {
 			this.ctx.logger.warn("alexa instance: could not start the account", { meta: {
 				brokerId: id,
@@ -146634,12 +146912,8 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 	}
 	buildBrokerProvider() {
 		return buildAlexaBrokerProvider({
-			ownerAddonId: this.ctx.id,
 			registry: this.requireRegistry(),
-			getBrokers: () => this.activeBrokers,
-			persistBrokers: (brokers) => this.persistBrokerEntries(brokers),
-			cascadeRemoveDevices: (brokerId) => this.cascadeRemoveDevicesForBroker(brokerId),
-			logger: this.ctx.logger
+			getBrokers: () => this.activeBrokers
 		});
 	}
 	/**
@@ -146676,6 +146950,14 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		} });
 		return { brokerId: entry.id };
 	}
+	/** Who still points at an Alexa account: its integrations and the Echo targets that speak through it. */
+	brokerUsers() {
+		return [brokerLinkUserFinder(this.requireInstances()), { find: async (brokerId) => readEchoTargets(this.config).filter((target) => target.brokerId === brokerId).map((target) => ({
+			kind: "notification-target",
+			id: target.id,
+			name: target.name
+		})) }];
+	}
 	async cascadeRemoveDevicesForBroker(brokerId) {
 		const reg = this.ctx.kernel.deviceRegistry;
 		const devices = this.ctx.kernel.devices;
@@ -146688,42 +146970,6 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 			logger: this.ctx.logger
 		});
 	}
-	async reconcileIntegrationsToBrokers() {
-		try {
-			const mine = (await this.ctx.api.integrations.list.query()).filter((i) => i.addonId === this.ctx.id);
-			const surviving = new Set(mine.map((i) => i.id));
-			for (const broker of this.activeBrokers) {
-				const integrationId = broker.integrationId;
-				if (integrationId === void 0 || !surviving.has(integrationId)) continue;
-				this.requireRegistry().linkIntegration(integrationId, broker.id);
-			}
-			const toRemove = this.activeBrokers.filter((b) => b.integrationId !== void 0 && !surviving.has(b.integrationId)).map((b) => b.id);
-			if (toRemove.length === 0) return;
-			for (const id of toRemove) try {
-				await this.requireRegistry().removeEntry(id);
-				await this.cascadeRemoveDevicesForBroker(id);
-			} catch (err) {
-				this.ctx.logger.warn("Alexa integration→broker: broker cleanup failed", { meta: {
-					brokerId: id,
-					error: errMsg(err)
-				} });
-			}
-			const nextBrokers = this.activeBrokers.filter((b) => !toRemove.includes(b.id));
-			await this.persistBrokerEntries(nextBrokers);
-		} catch (err) {
-			this.ctx.logger.warn("Alexa integration→broker reconcile failed", { meta: { error: errMsg(err) } });
-		}
-	}
-	subscribeIntegrationLifecycle() {
-		const handler = (event) => {
-			const addonId = event.data["addonId"];
-			if (typeof addonId === "string" && addonId !== this.ctx.id) return;
-			this.reconcileIntegrationsToBrokers();
-		};
-		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationEnabled }, handler);
-		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationDisabled }, handler);
-		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationDeleted }, handler);
-	}
 	buildAdoptionProvider() {
 		return buildAlexaAdoptionProvider({
 			registry: {
@@ -146737,9 +146983,9 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 			},
 			logger: this.ctx.logger,
 			getBrokerIdForIntegration: async (id) => {
-				const broker = this.activeBrokers.find((entry) => entry.integrationId === id);
-				if (broker === void 0) throw new Error(`integration ${id} has no linked brokerId`);
-				return broker.id;
+				const brokerId = await brokerIdOf(this.requireInstances(), id);
+				if (brokerId === void 0) throw new Error(`integration ${id} has no broker`);
+				return brokerId;
 			},
 			listAdoptedAlexa: async () => {
 				const reg = this.ctx.kernel.deviceRegistry;