@camstack/addon-import-alexa 0.2.190 → 0.2.192

package/dist/addon.js

@@ -6044,7 +6044,7 @@ function number(params) {
 	return /* @__PURE__ */ _coercedNumber(ZodNumber, params);
 }
 //#endregion
-//#region ../types/dist/sleep-BX_MqzUe.mjs
+//#region ../types/dist/sleep-CmjWurK5.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6728,137 +6728,102 @@ async function runAddonMigrations(host, migrations, logger, options = {}) {
 		blockOwner
 	};
 }
-/**
-* Build a {@link DurableState} over a single store key. Transport-agnostic:
-* `read`/`write` are the addon-store or device-store accessors. The whole
-* validated value round-trips on every read/write — the schema is the
-* single source of truth for what is persisted, so no hand-listed field
-* set can drop a key on save.
-*/
-function createDurableState(deps) {
-	const get = async () => {
-		const raw = (await deps.read())[deps.key];
-		if (raw === void 0) return deps.fallback;
-		const parsed = deps.schema.safeParse(raw);
-		if (!parsed.success) {
-			deps.onParseError?.(deps.key, parsed.error);
-			return deps.fallback;
-		}
-		return parsed.data;
-	};
-	const set = async (next) => {
-		const validated = deps.schema.parse(next);
-		await deps.write({ [deps.key]: validated });
-	};
-	const update = async (fn) => {
-		await set(fn(await get()));
-	};
+/** The record calls the one-switch migration makes, over the migration API. */
+function switchRecordsOverMigrationApi(api) {
+	return { kind: (definition) => {
+		const handle = api.records.kind(definition);
+		return {
+			get: (id) => handle.get({ id }),
+			put: (input, opts) => handle.put({
+				...input,
+				...opts?.ifRev === void 0 ? {} : { ifRev: opts.ifRev }
+			}),
+			patch: (id, partial) => handle.patch({
+				id,
+				partial
+			})
+		};
+	} };
+}
+function integrationRowsApiOver(api) {
 	return {
-		get,
-		set,
-		update
+		list: async () => (await api.integrations.list({})).integrations,
+		readLegacyIntegrationRows: (input) => api.legacyRows.read(input),
+		clearLegacyIntegrationRows: (input) => api.legacyRows.clear(input)
 	};
 }
+var PREFIX = "records/";
+/** The base of every records failure. `detail` is the human part of the message. */
+var RecordsError = class extends Error {
+	code;
+	detail;
+	constructor(code, detail) {
+		super(`${PREFIX}${code}: ${detail}`);
+		this.name = "RecordsError";
+		this.code = code;
+		this.detail = detail;
+	}
+};
+/** A write guarded by `ifRev` found another revision (or an existing row for `ifRev: 0`). */
+var RevConflictError = class extends RecordsError {
+	constructor(detail) {
+		super("rev-conflict", detail);
+		this.name = "RevConflictError";
+	}
+};
+/** The keychain could not store or serve a value: explicit, never an empty string. */
+var RecordSecretUnavailableError = class extends RecordsError {
+	constructor(detail) {
+		super("secret-unavailable", detail);
+		this.name = "RecordSecretUnavailableError";
+	}
+};
+var InvalidRecordError = class extends RecordsError {
+	constructor(detail) {
+		super("invalid-record", detail);
+		this.name = "InvalidRecordError";
+	}
+};
+/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
+var DeclarationRefusedError = class extends RecordsError {
+	constructor(detail) {
+		super("declaration-refused", detail);
+		this.name = "DeclarationRefusedError";
+	}
+};
 /**
-* Per-node scoping for the shared addon-settings blob.
-*
-* An addon's settings store is hub-central (the `addon-settings` cap is
-* hub-routed — the hub instance answers for every node), so fields whose
-* value is a NODE fact (decoder backend, engine pick, probed hardware
-* capabilities) persist under the node-scoped key `<key>@<nodeId>` inside
-* the single shared blob. The SCHEMA field key stays bare: the write path
-* ({@link scopePatch}) maps the bare field onto the target node's scoped
-* key; the read/hydrate path ({@link projectStore}) maps THIS node's value
-* back, so UI forms and `resolveConfig` only ever see the bare key.
-*
-* Fields opt in via the `perNode: true` schema marker on `ConfigFieldBase`
-* (`interfaces/config-ui.ts`); `BaseAddon` derives the key set from the
-* schema and routes reads/writes through these helpers.
-*
-* ## No bare-key fallback — deliberate
-*
-* {@link readNodeValue} reads the node-scoped key ONLY. A node with no
-* scoped key resolves to `undefined` so the field's schema `default` wins —
-* NEVER `store[base]` and never another node's value. A bare legacy key in
-* the store is invisible to every node, hub included, so one node's
-* selection can never leak onto another. (This generalizes the
-* `decoder-backend-keys.ts` semantics — the no-fallback variant — over an
-* arbitrary set of per-node field keys.)
-*
-* Pure functions only — no I/O, no imports beyond the language. This is a
-* LEAF module: import it via its deep path, never from the root barrel.
-*/
-/**
-* Normalize a raw kernel node id to the bare node id used for scoping.
-* `localNodeId` can carry a `<node>/<addon>` suffix on forked child
-* processes; per-node settings are per-NODE, so strip the addon segment.
-* `undefined` / `null` / empty falls back to `'hub'`.
-*/
-function normalizeNodeId(raw) {
-	if (raw === void 0 || raw === null || raw === "") return "hub";
-	const slashIdx = raw.indexOf("/");
-	if (slashIdx < 0) return raw;
-	const bare = raw.slice(0, slashIdx);
-	return bare === "" ? "hub" : bare;
-}
-/** The node-scoped store key for a per-node field: `<base>@<nodeId>`. */
-function nodeScopedKey(base, nodeId) {
-	return `${base}@${normalizeNodeId(nodeId)}`;
-}
-/**
-* Read a node's value for a per-node field from the raw shared store:
-* the node-scoped key when present, otherwise `undefined`.
-* Deliberately NO bare-key fallback (see module doc) — the caller lets the
-* schema `default` win on `undefined`.
+* The link primitive's declaration half (D1013 rule 5): what a link field names and how a kind
+* records it. Split from `instance-link.ts` so `RecordIntegrationInstances` can read the links of
+* its kind without importing the builders that import it.
 */
-function readNodeValue(store, base, nodeId) {
-	return store[nodeScopedKey(base, nodeId)];
+/** The body field of a link: the id of the instance it names; the target rides in the field meta. */
+function linkField(target) {
+	return string().meta({ link: target });
 }
-/**
-* Re-map a UI/settings patch so every bare perNode field persists under the
-* TARGET node's scoped key; all other keys pass through unchanged. Used on
-* the write path so a save for one node never clobbers another node's value
-* (and the bare key is never written). Returns a new object — the input
-* patch is not mutated.
-*/
-function scopePatch(patch, perNodeKeys, nodeId) {
-	const out = {};
-	for (const [key, value] of Object.entries(patch)) out[perNodeKeys.has(key) ? nodeScopedKey(key, nodeId) : key] = value;
-	return out;
+function linkTargetOf(meta) {
+	if (typeof meta !== "object" || meta === null) return void 0;
+	const link = Reflect.get(meta, "link");
+	const parsed = LinkTargetSchema.safeParse(link);
+	return parsed.success ? parsed.data : void 0;
 }
-/**
-* Project the raw shared store onto the bare schema keys for ONE node so a
-* UI schema (whose field keys are bare) hydrates from that node's own
-* values:
-*
-* - EVERY `@`-scoped key (any node's) is dropped from the pass-through.
-* - Every bare perNode key is dropped from the pass-through (a stray bare
-*   legacy key must never hydrate any node — no bare fallback).
-* - THIS node's effective value ({@link readNodeValue}) is then laid onto
-*   each bare perNode key; when the node has no scoped key the bare key is
-*   left ABSENT so the field's schema `default` wins.
-*
-* Returns a new object — the input store is not mutated.
-*/
-function projectStore(store, perNodeKeys, nodeId) {
-	const out = {};
-	for (const [key, value] of Object.entries(store)) {
-		if (key.includes("@")) continue;
-		if (perNodeKeys.has(key)) continue;
-		out[key] = value;
-	}
-	for (const base of perNodeKeys) {
-		const value = readNodeValue(store, base, nodeId);
-		if (value !== void 0) out[base] = value;
+var LinkTargetSchema = object({
+	cap: string().min(1),
+	kind: string().min(1).optional()
+});
+/** The links a kind declares, read from the meta of its body fields. */
+function linksOfKind(kind) {
+	const schema = kind.schema;
+	if (!(schema instanceof ZodObject)) return [];
+	const links = [];
+	for (const [field, fieldSchema] of Object.entries(schema.shape)) {
+		const to = linkTargetOf(globalRegistry.get(fieldSchema));
+		if (to !== void 0) links.push({
+			field,
+			to
+		});
 	}
-	return out;
+	return links;
 }
-/** Every scope, in the order the guard and the docs list them. */
-var SCOPED_SETTINGS_SCOPES = [
-	"cluster",
-	"device-defaults",
-	"node"
-];
 /**
 * The address of one keychain value: `secret://<owner>/<scope>/<fieldPath>`.
 *
@@ -6993,6 +6958,643 @@ function parseSecretRef(ref) {
 		fieldPath
 	};
 }
+/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
+/** The files a kind may live in. `history` is device-history's (D850), never records. */
+var RECORD_DATABASES = ["settings", "events"];
+/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
+var RECORD_CLASSES = [
+	"config",
+	"ledger",
+	"audit",
+	"mirror",
+	"ephemeral"
+];
+var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
+var RECORD_MAX_DATA_BYTES = 1024 * 1024;
+var RECORD_BATCH_MAX = 1e3;
+var RECORD_QUERY_MAX = 1e3;
+/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
+var RECORD_SETTINGS_MAX_ROWS = 5e4;
+/** The `Column`-free proof prefix: a ref collection for a kind's secret fields. */
+var RECORD_SECRET_COLLECTION_PREFIX = "records:";
+/**
+* Secret fields of a record, addressed the way a Zod schema declares them
+* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
+* (`auth.accessToken`, `headers[].value`).
+*
+* `{}` after a key means "each value of this map" (`applianceSecrets{}`): the map's own key
+* names the value (`applianceSecrets{fridge}`), so no id key is declared and a body that drops a
+* key releases exactly that key's secret.
+*
+* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
+* `{ headers: 'name' }`), never by index, so reordering a list keeps every
+* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
+* leaf names its element: `headers[X-Api].value`.
+*
+* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
+*/
+/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
+function parseSecretPath(path) {
+	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
+	return path.split(".").map((raw) => {
+		const each = raw.endsWith("[]");
+		const map = raw.endsWith("{}");
+		const key = each || map ? raw.slice(0, -2) : raw;
+		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
+		return {
+			key,
+			each,
+			map
+		};
+	});
+}
+/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
+function secretArrayPrefixes(path) {
+	const segments = parseSecretPath(path);
+	const prefixes = [];
+	const walked = [];
+	for (const segment of segments) {
+		walked.push(segment.key);
+		if (segment.each) prefixes.push(walked.join("."));
+	}
+	return prefixes;
+}
+function isRecord$6(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function elementId(element, idKey, declared, prefix) {
+	const id = isRecord$6(element) ? element[idKey] : void 0;
+	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
+	return id;
+}
+/**
+* Visit every secret leaf PRESENT in `data` (an absent branch has nothing to
+* visit). `replace` returns the new leaf value, or {@link REMOVE_LEAF}; the
+* result is a new body, `data` is untouched.
+*/
+var REMOVE_LEAF = Symbol("remove-leaf");
+function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
+	if (!isRecord$6(node)) return node;
+	const segment = segments[index];
+	if (segment === void 0) return node;
+	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
+	const child = node[segment.key];
+	const keys = [...walkedKeys, segment.key];
+	const last = index === segments.length - 1;
+	if (segment.each) {
+		if (!Array.isArray(child)) return node;
+		const prefix = keys.join(".");
+		const idKey = arrayKeys[prefix];
+		if (idKey === void 0) throw new InvalidRecordError(`"${declared}": no id key declared for the array "${prefix}"`);
+		const mapped = child.map((element) => {
+			const id = elementId(element, idKey, declared, prefix);
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}[${encodeURIComponent(id)}]`;
+			return last ? element : mapAt(element, segments, index + 1, keys, concrete, declared, arrayKeys, visit);
+		});
+		return {
+			...node,
+			[segment.key]: mapped
+		};
+	}
+	if (segment.map) {
+		if (!isRecord$6(child)) return node;
+		const kept = Object.entries(child).map(([mapKey, value]) => {
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}{${encodeURIComponent(mapKey)}}`;
+			if (!last) return [mapKey, mapAt(value, segments, index + 1, keys, concrete, declared, arrayKeys, visit)];
+			return [mapKey, visit({
+				declared,
+				concrete,
+				value
+			})];
+		}).filter(([, value]) => value !== REMOVE_LEAF);
+		return {
+			...node,
+			[segment.key]: Object.fromEntries(kept)
+		};
+	}
+	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
+	if (last) {
+		const replacement = visit({
+			declared,
+			concrete,
+			value: child
+		});
+		if (replacement === REMOVE_LEAF) return Object.fromEntries(Object.entries(node).filter(([key]) => key !== segment.key));
+		return {
+			...node,
+			[segment.key]: replacement
+		};
+	}
+	return {
+		...node,
+		[segment.key]: mapAt(child, segments, index + 1, keys, concrete, declared, arrayKeys, visit)
+	};
+}
+/** Replace/remove every present secret leaf; returns a NEW body. */
+function mapSecretLeaves(data, paths, arrayKeys, visit) {
+	let current = data;
+	for (const declared of paths) current = mapAt(current, parseSecretPath(declared), 0, [], "", declared, arrayKeys, visit);
+	return current;
+}
+/**
+* The keychain collection name a kind's secrets live under. Prefixed so a
+* record's refs never collide with the refs a legacy collection of the same name
+* already holds during an adoption.
+*/
+function recordSecretCollection(kind) {
+	return `${RECORD_SECRET_COLLECTION_PREFIX}${kind}`;
+}
+/** The ONE ref a row's secret field may carry: the engine and the facade both build it here. */
+function recordSecretRef(owner, kind, rowId, concretePath) {
+	return buildSecretRef({
+		owner,
+		scope: {
+			kind: "row",
+			collection: recordSecretCollection(kind),
+			rowId
+		},
+		fieldPath: concretePath
+	});
+}
+/**
+* A stored secret, as an admin read shows it: a VIEW naming the row's own
+* keychain ref (`set: true`), never the value and no longer the bare redaction
+* token. The form hands it to the secret field, which reveals the value by ref
+* through the audited `keychain-admin.reveal`; sent back untouched it keeps the
+* stored secret (the records door reads a view as KEEP).
+*
+* ONE implementation for the entries service and for every addon that serves
+* its own instances (`RecordIntegrationInstances`).
+*/
+function isRecord$5(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function secretViewsOf(owner, kind, id, decl, data) {
+	if (decl.secretPaths.length === 0) return data;
+	const shown = mapSecretLeaves(data, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
+		if (leaf.value !== "__camstack_redacted__") return leaf.value;
+		return {
+			$secret: recordSecretRef(owner, kind, id, leaf.concrete),
+			v: 1,
+			set: true
+		};
+	});
+	return isRecord$5(shown) ? shown : data;
+}
+/** The most instances one addon lists (an integrations page, not a table). */
+var INSTANCES_LIST_MAX = 1e3;
+/**
+* The ONE reader of an instance's switch (D996): an absent field means on, so a row written
+* before the field existed needs no migration. Every consumer of an instance body asks this.
+*/
+function isInstanceEnabled(body) {
+	return body.enabled !== false;
+}
+/** The body key of the switch; only {@link RecordIntegrationInstances.setInstanceEnabled} writes it. */
+var SWITCH_KEY = "enabled";
+/** The keys of the kind's secret fields that sit at the top level of the body. */
+function topLevelSecretKeys(paths) {
+	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[") && !p.includes("{")));
+}
+/** The keys of the kind's top-level MAPS whose values are secrets (`applianceSecrets{}`). */
+function secretMapKeys(paths) {
+	return new Set(paths.filter((p) => p.endsWith("{}") && !p.slice(0, -2).match(/[.[{]/)).map((p) => p.slice(0, -2)));
+}
+/**
+* A patch value for a map of secrets: an entry that is omitted, `''`, the redaction token or the
+* view the form was given KEEPS its stored secret (it is left out of the merge); `{ $secretClear }`
+* or `null` removes the entry; any other string replaces it. Null when nothing is left to merge.
+*/
+function secretMapPatch(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) if (entry === null || isSecretClear(entry)) out[key] = null;
+	else if (typeof entry === "string" && entry !== "" && entry !== "__camstack_redacted__" && !isSecretFieldView(entry)) out[key] = entry;
+	return Object.keys(out).length > 0 ? out : null;
+}
+var RecordIntegrationInstances = class {
+	records;
+	kind;
+	hooks;
+	handle;
+	secretKeys;
+	secretMaps;
+	nameField;
+	switchListeners = /* @__PURE__ */ new Set();
+	constructor(records, kind, hooks) {
+		this.records = records;
+		this.kind = kind;
+		this.hooks = hooks;
+		this.handle = records.kind(kind);
+		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
+		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
+		this.nameField = kind.declaration.entry?.nameField ?? "name";
+	}
+	/**
+	* One instance read for the addon's own runtime; null when absent. When the keychain is
+	* locked the row is served WITHOUT its secrets and says so (`secrets: 'unavailable'`), so the
+	* caller can keep what it had instead of reconfiguring with an empty secret (D49).
+	*/
+	async readResolved(id) {
+		try {
+			const record = await this.handle.getResolved(id);
+			return record === null ? null : {
+				id,
+				body: record.data,
+				enabled: isInstanceEnabled(record.data),
+				secrets: "resolved"
+			};
+		} catch (err) {
+			if (!(err instanceof RecordSecretUnavailableError)) throw err;
+			const stored = await this.handle.get(id);
+			if (stored === null) return null;
+			return {
+				id,
+				body: Object.fromEntries(Object.entries(stored.data).filter(([key]) => !this.secretKeys.has(key))),
+				enabled: isInstanceEnabled(stored.data),
+				secrets: "unavailable"
+			};
+		}
+	}
+	/** The body of {@link readResolved} alone; a locked keychain yields the row without secrets. */
+	async getResolved(id) {
+		return (await this.readResolved(id))?.body ?? null;
+	}
+	/** Every instance, secrets resolved where the keychain allows; an absent one is skipped. */
+	async listResolved() {
+		const page = await this.handle.query({ limit: INSTANCES_LIST_MAX });
+		const out = [];
+		for (const record of page.records) {
+			const read = await this.readResolved(record.id);
+			if (read !== null) out.push(read);
+		}
+		return out;
+	}
+	viewOf(record) {
+		const shown = secretViewsOf(this.records.owner, this.kind.name, record.id, this.kind.declaration, record.data);
+		const rawName = record.data[this.nameField];
+		const kind = this.hooks.kindOf?.(record.data);
+		const health = this.hooks.health?.(record.data, record.id);
+		return {
+			id: record.id,
+			name: typeof rawName === "string" ? rawName : record.id,
+			configured: this.hooks.configured(record.data),
+			enabled: isInstanceEnabled(record.data),
+			formValues: shown,
+			...kind !== void 0 ? { kind } : {},
+			...health?.status !== void 0 ? { status: health.status } : {},
+			...health?.lastCheckedAt !== void 0 ? { lastCheckedAt: health.lastCheckedAt } : {}
+		};
+	}
+	describe = async () => {
+		const declared = linksOfKind(this.kind);
+		const links = this.hooks.description.links !== void 0 || declared.length === 0 ? {} : { links: declared.map((link) => ({
+			kind: this.kind.name,
+			field: link.field,
+			to: link.to
+		})) };
+		return {
+			...this.hooks.description,
+			...links,
+			...this.hooks.mintId === void 0 ? {} : { mintsId: true }
+		};
+	};
+	instanceFormSchema = async ({ id }) => this.hooks.formSchema(id);
+	listInstances = async () => {
+		return (await this.handle.query({ limit: INSTANCES_LIST_MAX })).records.map((record) => this.viewOf(record));
+	};
+	getInstance = async ({ id }) => {
+		const record = await this.handle.get(id);
+		return record === null ? null : this.viewOf(record);
+	};
+	/** Insert ONE row (`ifRev: 0`: an existing id is refused, never overwritten). */
+	createInstance = async ({ id, name, kind, values }) => {
+		const minted = id ?? this.hooks.mintId?.({
+			name,
+			...kind !== void 0 ? { kind } : {}
+		});
+		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
+		await this.handle.put({
+			id: minted,
+			data: this.hooks.initialBody(name, kind)
+		}, { ifRev: 0 });
+		const patch = this.patchOf(values ?? {});
+		if (Object.keys(patch).length > 0) await this.handle.patch(minted, patch);
+		await this.hooks.onChanged?.(minted, "created");
+		return { id: minted };
+	};
+	updateInstance = async ({ id, name, values }) => {
+		const patch = this.patchOf(values);
+		if (name !== void 0) patch[this.nameField] = name;
+		await this.handle.patch(id, patch);
+		await this.hooks.onChanged?.(id, "updated");
+		return { ok: true };
+	};
+	/** The record patch a form `values` object means: secrets kept, cleared or replaced. */
+	patchOf(values) {
+		const patch = {};
+		for (const [key, value] of Object.entries(values)) {
+			if (value === void 0) continue;
+			if (key === "enabled") continue;
+			if (this.secretMaps.has(key)) {
+				const entries = secretMapPatch(value);
+				if (entries !== null) patch[key] = entries;
+			} else if (!this.secretKeys.has(key)) patch[key] = value;
+			else if (isSecretClear(value)) patch[key] = null;
+			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
+		}
+		return patch;
+	}
+	/**
+	* Listen to the switch of ANY instance of this helper (in the process that serves it). The
+	* durable replacement of the `integration.enabled` / `integration.disabled` events (D8): the
+	* addon reconciles from the record, whichever way it flipped.
+	*/
+	onSwitched(listener) {
+		this.switchListeners.add(listener);
+	}
+	/**
+	* The ONE writer of the switch (D996, D1014): the record body's `enabled`, for every role. A
+	* configured thing is an instance, so an id with no record yet (a default integration that was
+	* never configured) gets its record from `initialBody` before the switch is written.
+	*/
+	setInstanceEnabled = async ({ id, enabled }) => {
+		if (await this.handle.get(id) === null) await this.handle.put({
+			id,
+			data: this.hooks.initialBody(id)
+		}, { ifRev: 0 });
+		await this.handle.patch(id, { [SWITCH_KEY]: enabled });
+		await this.hooks.onChanged?.(id, "enabled");
+		for (const listener of this.switchListeners) await listener(id, enabled);
+		return { ok: true };
+	};
+	/** The row and its keychain refs go together (the records door). */
+	deleteInstance = async ({ id }) => {
+		await this.handle.delete(id);
+		await this.hooks.onChanged?.(id, "deleted");
+		return { ok: true };
+	};
+	testInstance = async (input) => {
+		if (this.hooks.test === void 0) return {
+			success: false,
+			status: "unsupported",
+			error: "This integration declares no connection test"
+		};
+		return this.hooks.test(input);
+	};
+	/** The flat provider object to hand to `registerProvider`. */
+	toProvider() {
+		return {
+			describe: this.describe,
+			instanceFormSchema: this.instanceFormSchema,
+			listInstances: this.listInstances,
+			getInstance: this.getInstance,
+			createInstance: this.createInstance,
+			updateInstance: this.updateInstance,
+			setInstanceEnabled: this.setInstanceEnabled,
+			deleteInstance: this.deleteInstance,
+			testInstance: this.testInstance
+		};
+	}
+};
+/**
+* The one-switch migration (epic #440, step 3). An integration's on/off state used to live in the
+* registry's `enabled` column for a device addon; it now lives only in the instance record's
+* body (`enabled`, D1007 superseded). This moves a registry `enabled = false` into the body, once.
+*
+* For every registry row of the addon that is OFF:
+*  - no record under its id: the record is created from `initialBody(name)` with `enabled: false`
+*    (a default integration that never had settings, Reolink's among them);
+*  - a record whose body states no `enabled`: `enabled: false` is written into it;
+*  - a record that already states `enabled` (either way) is the newer truth and is left alone.
+* A row that is ON writes nothing: an absent field reads as on. A rerun finds every off row with
+* a stated switch and does nothing, so nothing switched off comes back on and nothing switched on
+* goes off. The registry column itself is neither read afterwards nor written; its drop is step 5.
+*
+* It runs in the addon process, BEFORE the addon registers its `integration-instances` provider,
+* which is also why `integrations.list` still answers the stored column at that point.
+*/
+function registrySwitchToBodyId(addonId, date) {
+	return `${addonId}/${date}-registry-switch-to-body`;
+}
+async function moveRegistrySwitchToBody(ports, spec) {
+	const rows = await ports.listIntegrations(spec.addonId);
+	let created = 0;
+	let switched = 0;
+	let kept = 0;
+	for (const row of rows) {
+		if (row.enabled) continue;
+		const body = await ports.readBody(row.id);
+		if (body === null) {
+			if (await ports.createRecord(row.id, {
+				...spec.initialBody(row.name),
+				["enabled"]: false
+			}) === "created") created += 1;
+			else kept += 1;
+			continue;
+		}
+		if ("enabled" in body) {
+			kept += 1;
+			continue;
+		}
+		await ports.switchOff(row.id);
+		switched += 1;
+	}
+	const summary = {
+		integrations: rows.length,
+		off: rows.filter((r) => !r.enabled).length,
+		created,
+		switched,
+		kept
+	};
+	return created === 0 && switched === 0 ? {
+		outcome: "already-done",
+		summary
+	} : {
+		outcome: "done",
+		summary
+	};
+}
+/** A migration entry: an addon states its kind and how a new body starts, nothing else. */
+function registrySwitchToBodyMigration(spec) {
+	return {
+		meta: {
+			id: registrySwitchToBodyId(spec.addonId, spec.date),
+			owner: spec.addonId,
+			level: "addon-state",
+			seq: spec.seq,
+			dependsOn: [],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "block-owner",
+			bodyKind: "procedure",
+			description: "Move the registry enabled flag of every switched-off integration into its instance record body, creating the record when there is none",
+			fixtureMark: "enabled"
+		},
+		procedure: (ports) => moveRegistrySwitchToBody(ports, {
+			addonId: spec.addonId,
+			initialBody: spec.initialBody
+		})
+	};
+}
+/** The hub and records sides of {@link registrySwitchToBodyMigration}. */
+function registrySwitchPortsOver(deps) {
+	const handle = deps.records.kind({
+		name: deps.kind.name,
+		declaration: deps.kind.declaration,
+		schema: record(string(), unknown())
+	});
+	return {
+		listIntegrations: async (addonId) => (await deps.api.list()).filter((i) => i.addonId === addonId).map((i) => ({
+			id: i.id,
+			name: i.name,
+			enabled: i.enabled !== false
+		})),
+		readBody: async (id) => (await handle.get(id))?.data ?? null,
+		createRecord: async (id, body) => {
+			if (await handle.get(id) !== null) return "exists";
+			await handle.put({
+				id,
+				data: body
+			}, { ifRev: 0 });
+			return "created";
+		},
+		switchOff: async (id) => {
+			await handle.patch(id, { [SWITCH_KEY]: false });
+		}
+	};
+}
+/**
+* Build a {@link DurableState} over a single store key. Transport-agnostic:
+* `read`/`write` are the addon-store or device-store accessors. The whole
+* validated value round-trips on every read/write — the schema is the
+* single source of truth for what is persisted, so no hand-listed field
+* set can drop a key on save.
+*/
+function createDurableState(deps) {
+	const get = async () => {
+		const raw = (await deps.read())[deps.key];
+		if (raw === void 0) return deps.fallback;
+		const parsed = deps.schema.safeParse(raw);
+		if (!parsed.success) {
+			deps.onParseError?.(deps.key, parsed.error);
+			return deps.fallback;
+		}
+		return parsed.data;
+	};
+	const set = async (next) => {
+		const validated = deps.schema.parse(next);
+		await deps.write({ [deps.key]: validated });
+	};
+	const update = async (fn) => {
+		await set(fn(await get()));
+	};
+	return {
+		get,
+		set,
+		update
+	};
+}
+/**
+* Per-node scoping for the shared addon-settings blob.
+*
+* An addon's settings store is hub-central (the `addon-settings` cap is
+* hub-routed — the hub instance answers for every node), so fields whose
+* value is a NODE fact (decoder backend, engine pick, probed hardware
+* capabilities) persist under the node-scoped key `<key>@<nodeId>` inside
+* the single shared blob. The SCHEMA field key stays bare: the write path
+* ({@link scopePatch}) maps the bare field onto the target node's scoped
+* key; the read/hydrate path ({@link projectStore}) maps THIS node's value
+* back, so UI forms and `resolveConfig` only ever see the bare key.
+*
+* Fields opt in via the `perNode: true` schema marker on `ConfigFieldBase`
+* (`interfaces/config-ui.ts`); `BaseAddon` derives the key set from the
+* schema and routes reads/writes through these helpers.
+*
+* ## No bare-key fallback — deliberate
+*
+* {@link readNodeValue} reads the node-scoped key ONLY. A node with no
+* scoped key resolves to `undefined` so the field's schema `default` wins —
+* NEVER `store[base]` and never another node's value. A bare legacy key in
+* the store is invisible to every node, hub included, so one node's
+* selection can never leak onto another. (This generalizes the
+* `decoder-backend-keys.ts` semantics — the no-fallback variant — over an
+* arbitrary set of per-node field keys.)
+*
+* Pure functions only — no I/O, no imports beyond the language. This is a
+* LEAF module: import it via its deep path, never from the root barrel.
+*/
+/**
+* Normalize a raw kernel node id to the bare node id used for scoping.
+* `localNodeId` can carry a `<node>/<addon>` suffix on forked child
+* processes; per-node settings are per-NODE, so strip the addon segment.
+* `undefined` / `null` / empty falls back to `'hub'`.
+*/
+function normalizeNodeId(raw) {
+	if (raw === void 0 || raw === null || raw === "") return "hub";
+	const slashIdx = raw.indexOf("/");
+	if (slashIdx < 0) return raw;
+	const bare = raw.slice(0, slashIdx);
+	return bare === "" ? "hub" : bare;
+}
+/** The node-scoped store key for a per-node field: `<base>@<nodeId>`. */
+function nodeScopedKey(base, nodeId) {
+	return `${base}@${normalizeNodeId(nodeId)}`;
+}
+/**
+* Read a node's value for a per-node field from the raw shared store:
+* the node-scoped key when present, otherwise `undefined`.
+* Deliberately NO bare-key fallback (see module doc) — the caller lets the
+* schema `default` win on `undefined`.
+*/
+function readNodeValue(store, base, nodeId) {
+	return store[nodeScopedKey(base, nodeId)];
+}
+/**
+* Re-map a UI/settings patch so every bare perNode field persists under the
+* TARGET node's scoped key; all other keys pass through unchanged. Used on
+* the write path so a save for one node never clobbers another node's value
+* (and the bare key is never written). Returns a new object — the input
+* patch is not mutated.
+*/
+function scopePatch(patch, perNodeKeys, nodeId) {
+	const out = {};
+	for (const [key, value] of Object.entries(patch)) out[perNodeKeys.has(key) ? nodeScopedKey(key, nodeId) : key] = value;
+	return out;
+}
+/**
+* Project the raw shared store onto the bare schema keys for ONE node so a
+* UI schema (whose field keys are bare) hydrates from that node's own
+* values:
+*
+* - EVERY `@`-scoped key (any node's) is dropped from the pass-through.
+* - Every bare perNode key is dropped from the pass-through (a stray bare
+*   legacy key must never hydrate any node — no bare fallback).
+* - THIS node's effective value ({@link readNodeValue}) is then laid onto
+*   each bare perNode key; when the node has no scoped key the bare key is
+*   left ABSENT so the field's schema `default` wins.
+*
+* Returns a new object — the input store is not mutated.
+*/
+function projectStore(store, perNodeKeys, nodeId) {
+	const out = {};
+	for (const [key, value] of Object.entries(store)) {
+		if (key.includes("@")) continue;
+		if (perNodeKeys.has(key)) continue;
+		out[key] = value;
+	}
+	for (const base of perNodeKeys) {
+		const value = readNodeValue(store, base, nodeId);
+		if (value !== void 0) out[base] = value;
+	}
+	return out;
+}
+/** Every scope, in the order the guard and the docs list them. */
+var SCOPED_SETTINGS_SCOPES = [
+	"cluster",
+	"device-defaults",
+	"node"
+];
 /** A write to a secret path could not be stored in the keychain, so it was refused. */
 var KeychainWriteRefusedError = class extends Error {
 	fieldPath;
@@ -7003,7 +7605,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$6(value) {
+function isRecord$4$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -7016,7 +7618,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$6(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$4$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -7071,7 +7673,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$6) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$4$1) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -7087,7 +7689,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$6(row)) {
+		if (!isRecord$4$1(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -7112,7 +7714,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$6(incoming)) {
+			if (!isRecord$4$1(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -7120,7 +7722,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$6(stored) ? stored : {};
+			const storedObj = isRecord$4$1(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -7243,7 +7845,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$6(v)) {
+		if (isRecord$4$1(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -7275,7 +7877,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord$5(value) {
+function isRecord$3$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -7304,7 +7906,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord$5(item) && isRecord$5(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$3$1(item) && isRecord$3$1(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -7315,7 +7917,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord$5(value) && isRecord$5(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$3$1(value) && isRecord$3$1(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -7323,7 +7925,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord$5(incoming) || !isRecord$5(stored)) return incoming;
+	if (!isRecord$3$1(incoming) || !isRecord$3$1(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -7354,7 +7956,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord$5(a) && isRecord$5(b)) {
+	if (isRecord$3$1(a) && isRecord$3$1(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -7378,7 +7980,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord$5(value)) return null;
+	if (!isRecord$3$1(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -7875,13 +8477,48 @@ var BaseAddon = class {
 		if (api === void 0) throw new Error(`${this.ctx.id}: the migration API is not available on this context`);
 		return this.runBound(sets.flatMap((set) => set.bind(api)), options);
 	}
-	async runBound(migrations, options) {
+	/**
+	* A device addon states its instance kind once, before its migrations run, and the one-switch
+	* migration (registry `enabled` to the instance body, epic #440 step 3) joins whatever
+	* catalogue the addon runs, in the SAME declaration (the engine replaces an owner's catalogue
+	* on every declare).
+	*/
+	declareRegistrySwitch(spec) {
+		this.registrySwitchSpec = spec;
+	}
+	registrySwitchSpec = null;
+	registrySwitchBound() {
+		const spec = this.registrySwitchSpec;
+		if (spec === null) return [];
+		const api = this.ctx.migrationApi;
+		if (api === void 0) {
+			this.ctx.logger.warn("the registry switch migration is skipped: the migration API is not available on this context");
+			return [];
+		}
+		return migrationSet([registrySwitchToBodyMigration({
+			addonId: this.ctx.id,
+			date: "2026-11-06",
+			seq: 1e3,
+			initialBody: spec.initialBody
+		})], (a) => registrySwitchPortsOver({
+			api: integrationRowsApiOver(a),
+			records: switchRecordsOverMigrationApi(a),
+			kind: spec.kind
+		})).bind(api);
+	}
+	async runBound(declared, options) {
+		const added = this.registrySwitchBound();
+		const migrations = [...declared, ...added];
+		const phased = options?.only === void 0 || added.length === 0 ? options : {
+			...options,
+			only: [...options.only, ...added.map((m) => m.meta.id)]
+		};
 		const api = this.ctx.api.migrations;
 		const report = await runAddonMigrations({
 			declareOwner: (input) => api.declareOwner.mutate(input),
 			startMigration: (input) => api.startMigration.mutate(input),
 			finishMigration: (input) => api.finishMigration.mutate(input)
-		}, migrations, this.ctx.logger, options);
+		}, migrations, this.ctx.logger, phased);
 		if (report.blockOwner.length > 0) throw new AddonMigrationsBlockedError(report.blockOwner);
 		return report;
 	}
@@ -8954,228 +9591,6 @@ function normalizeAddonInitResult(result) {
 	if (Array.isArray(result)) return { providers: result };
 	return result;
 }
-var PREFIX = "records/";
-/** The base of every records failure. `detail` is the human part of the message. */
-var RecordsError = class extends Error {
-	code;
-	detail;
-	constructor(code, detail) {
-		super(`${PREFIX}${code}: ${detail}`);
-		this.name = "RecordsError";
-		this.code = code;
-		this.detail = detail;
-	}
-};
-/** A write guarded by `ifRev` found another revision (or an existing row for `ifRev: 0`). */
-var RevConflictError = class extends RecordsError {
-	constructor(detail) {
-		super("rev-conflict", detail);
-		this.name = "RevConflictError";
-	}
-};
-/** The keychain could not store or serve a value: explicit, never an empty string. */
-var RecordSecretUnavailableError = class extends RecordsError {
-	constructor(detail) {
-		super("secret-unavailable", detail);
-		this.name = "RecordSecretUnavailableError";
-	}
-};
-var InvalidRecordError = class extends RecordsError {
-	constructor(detail) {
-		super("invalid-record", detail);
-		this.name = "InvalidRecordError";
-	}
-};
-/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
-var DeclarationRefusedError = class extends RecordsError {
-	constructor(detail) {
-		super("declaration-refused", detail);
-		this.name = "DeclarationRefusedError";
-	}
-};
-/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
-/** The files a kind may live in. `history` is device-history's (D850), never records. */
-var RECORD_DATABASES = ["settings", "events"];
-/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
-var RECORD_CLASSES = [
-	"config",
-	"ledger",
-	"audit",
-	"mirror",
-	"ephemeral"
-];
-var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
-var RECORD_MAX_DATA_BYTES = 1024 * 1024;
-var RECORD_BATCH_MAX = 1e3;
-var RECORD_QUERY_MAX = 1e3;
-/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
-var RECORD_SETTINGS_MAX_ROWS = 5e4;
-/** The `Column`-free proof prefix: a ref collection for a kind's secret fields. */
-var RECORD_SECRET_COLLECTION_PREFIX = "records:";
-/**
-* Secret fields of a record, addressed the way a Zod schema declares them
-* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
-* (`auth.accessToken`, `headers[].value`).
-*
-* `{}` after a key means "each value of this map" (`applianceSecrets{}`): the map's own key
-* names the value (`applianceSecrets{fridge}`), so no id key is declared and a body that drops a
-* key releases exactly that key's secret.
-*
-* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
-* `{ headers: 'name' }`), never by index, so reordering a list keeps every
-* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
-* leaf names its element: `headers[X-Api].value`.
-*
-* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
-*/
-/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
-function parseSecretPath(path) {
-	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
-	return path.split(".").map((raw) => {
-		const each = raw.endsWith("[]");
-		const map = raw.endsWith("{}");
-		const key = each || map ? raw.slice(0, -2) : raw;
-		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
-		return {
-			key,
-			each,
-			map
-		};
-	});
-}
-/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
-function secretArrayPrefixes(path) {
-	const segments = parseSecretPath(path);
-	const prefixes = [];
-	const walked = [];
-	for (const segment of segments) {
-		walked.push(segment.key);
-		if (segment.each) prefixes.push(walked.join("."));
-	}
-	return prefixes;
-}
-function isRecord$4$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function elementId(element, idKey, declared, prefix) {
-	const id = isRecord$4$1(element) ? element[idKey] : void 0;
-	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
-	return id;
-}
-/**
-* Visit every secret leaf PRESENT in `data` (an absent branch has nothing to
-* visit). `replace` returns the new leaf value, or {@link REMOVE_LEAF}; the
-* result is a new body, `data` is untouched.
-*/
-var REMOVE_LEAF = Symbol("remove-leaf");
-function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
-	if (!isRecord$4$1(node)) return node;
-	const segment = segments[index];
-	if (segment === void 0) return node;
-	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
-	const child = node[segment.key];
-	const keys = [...walkedKeys, segment.key];
-	const last = index === segments.length - 1;
-	if (segment.each) {
-		if (!Array.isArray(child)) return node;
-		const prefix = keys.join(".");
-		const idKey = arrayKeys[prefix];
-		if (idKey === void 0) throw new InvalidRecordError(`"${declared}": no id key declared for the array "${prefix}"`);
-		const mapped = child.map((element) => {
-			const id = elementId(element, idKey, declared, prefix);
-			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}[${encodeURIComponent(id)}]`;
-			return last ? element : mapAt(element, segments, index + 1, keys, concrete, declared, arrayKeys, visit);
-		});
-		return {
-			...node,
-			[segment.key]: mapped
-		};
-	}
-	if (segment.map) {
-		if (!isRecord$4$1(child)) return node;
-		const kept = Object.entries(child).map(([mapKey, value]) => {
-			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}{${encodeURIComponent(mapKey)}}`;
-			if (!last) return [mapKey, mapAt(value, segments, index + 1, keys, concrete, declared, arrayKeys, visit)];
-			return [mapKey, visit({
-				declared,
-				concrete,
-				value
-			})];
-		}).filter(([, value]) => value !== REMOVE_LEAF);
-		return {
-			...node,
-			[segment.key]: Object.fromEntries(kept)
-		};
-	}
-	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
-	if (last) {
-		const replacement = visit({
-			declared,
-			concrete,
-			value: child
-		});
-		if (replacement === REMOVE_LEAF) return Object.fromEntries(Object.entries(node).filter(([key]) => key !== segment.key));
-		return {
-			...node,
-			[segment.key]: replacement
-		};
-	}
-	return {
-		...node,
-		[segment.key]: mapAt(child, segments, index + 1, keys, concrete, declared, arrayKeys, visit)
-	};
-}
-/** Replace/remove every present secret leaf; returns a NEW body. */
-function mapSecretLeaves(data, paths, arrayKeys, visit) {
-	let current = data;
-	for (const declared of paths) current = mapAt(current, parseSecretPath(declared), 0, [], "", declared, arrayKeys, visit);
-	return current;
-}
-/**
-* The keychain collection name a kind's secrets live under. Prefixed so a
-* record's refs never collide with the refs a legacy collection of the same name
-* already holds during an adoption.
-*/
-function recordSecretCollection(kind) {
-	return `${RECORD_SECRET_COLLECTION_PREFIX}${kind}`;
-}
-/** The ONE ref a row's secret field may carry: the engine and the facade both build it here. */
-function recordSecretRef(owner, kind, rowId, concretePath) {
-	return buildSecretRef({
-		owner,
-		scope: {
-			kind: "row",
-			collection: recordSecretCollection(kind),
-			rowId
-		},
-		fieldPath: concretePath
-	});
-}
-/**
-* A stored secret, as an admin read shows it: a VIEW naming the row's own
-* keychain ref (`set: true`), never the value and no longer the bare redaction
-* token. The form hands it to the secret field, which reveals the value by ref
-* through the audited `keychain-admin.reveal`; sent back untouched it keeps the
-* stored secret (the records door reads a view as KEEP).
-*
-* ONE implementation for the entries service and for every addon that serves
-* its own instances (`RecordIntegrationInstances`).
-*/
-function isRecord$3$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function secretViewsOf(owner, kind, id, decl, data) {
-	if (decl.secretPaths.length === 0) return data;
-	const shown = mapSecretLeaves(data, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
-		if (leaf.value !== "__camstack_redacted__") return leaf.value;
-		return {
-			$secret: recordSecretRef(owner, kind, id, leaf.concrete),
-			v: 1,
-			set: true
-		};
-	});
-	return isRecord$3$1(shown) ? shown : data;
-}
 /**
 * The share-view scope kinds a share-link token can carry. The hub mints
 * and validates them (`ShareViewGrantSchema` builds its
@@ -9429,6 +9844,7 @@ function defineRecordKinds(specs) {
 function entryBody(shape) {
 	return object({
 		name: string().min(1),
+		enabled: boolean().optional(),
 		...shape
 	});
 }
@@ -11272,6 +11688,10 @@ Object.freeze({
 				"all",
 				"one"
 			]
+		},
+		{
+			"path": "positionUpdatedAt",
+			"valueType": "number"
 		}
 	],
 	"meter": [{
@@ -11526,22 +11946,6 @@ Object.freeze({
 			"path": "pumpRunning",
 			"valueType": "boolean"
 		},
-		{
-			"path": "lastDrink",
-			"valueType": "number"
-		},
-		{
-			"path": "currentHourDrink",
-			"valueType": "number"
-		},
-		{
-			"path": "last24hDrink",
-			"valueType": "number"
-		},
-		{
-			"path": "todayDrink",
-			"valueType": "number"
-		},
 		{
 			"path": "error",
 			"valueType": "string"
@@ -12107,12 +12511,66 @@ Object.freeze({
 		}
 	]
 });
+Object.freeze({
+	"actions": { "run": 363e4 },
+	"audio-analyzer": { "classify": 3e4 },
+	"custom-model-registry": { "importModelBundle": 18e5 },
+	"database-snapshot": { "writeSnapshot": 18e5 },
+	"device-manager": {
+		"migrateDevice": 72e4,
+		"runDiscoverySweep": 12e4
+	},
+	"device-provider": { "reloadDevice": 18e4 },
+	"llm": {
+		"generate": 6e5,
+		"generateVision": 6e5,
+		"testProfile": 6e5
+	},
+	"llm-runtime": {
+		"complete": 6e5,
+		"completeApple": 6e5,
+		"ensureStarted": 6e5,
+		"installModel": 36e5
+	},
+	"local-network": { "scanNetwork": 9e4 },
+	"model-convert": { "convert": 6e5 },
+	"pipeline-analytics": {
+		"addRetrainFrameFromRecording": 6e4,
+		"offerRetrainArchive": 12e4,
+		"proposeRetrainAnnotationsWithLlm": 18e4,
+		"resolveRetrainTrainingCorpus": 6e4,
+		"writeRetrainArchive": 36e5
+	},
+	"server-management": { "applyServerUpdate": 96e4 },
+	"terminal-session": { "pullOutput": 15e3 },
+	"training": {
+		"canaryResult": 12e4,
+		"cancelJob": 12e4,
+		"planJob": 6e4,
+		"registerResult": 18e5,
+		"rollbackCanary": 12e4,
+		"startJob": 12e4,
+		"startJobBatch": 12e4
+	},
+	"training-provider": {
+		"cancelJob": 6e4,
+		"cleanupJob": 3e5,
+		"getJob": 6e4,
+		"listJobEvents": 6e4,
+		"listJobs": 12e4,
+		"offerArtifact": 3e5,
+		"readResult": 3e5,
+		"submitJob": 18e5,
+		"uploadDataset": 72e5,
+		"validateCredentials": 3e4
+	}
+});
 object({
 	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
 	params: record(string(), union([string(), number$1()])).optional()
 });
 //#endregion
-//#region ../types/dist/composition-pOHbTzRB.mjs
+//#region ../types/dist/composition-BmBHuDTQ.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -12416,7 +12874,7 @@ var table = {
 	},
 	dwell: {
 		minArgs: 3,
-		maxArgs: 3,
+		maxArgs: 4,
 		apply: () => {
 			throw new ExpressionEvalError("dwell: stateful evaluation context is required");
 		}
@@ -13576,212 +14034,6 @@ function buildCapturingReply(envelope) {
 	};
 	return wrapper;
 }
-/**
-* `RecordIntegrationInstances` - the `integration-instances` provider over ONE
-* entry kind, so an addon that holds a connection serves it in ~30 lines.
-*
-* Every instance is one record of the addon's own kind, keyed by the
-* `integrations` registry id. The records door does the secret work: a field the
-* kind marks `.meta({ secret: true })` is a keychain marker bound to the row, so
-* deleting the row deletes the secret, and one row's value is never another's.
-*
-* Patch rules for a secret (`updateInstance`): omitted, `''`, the redaction
-* token or the view the form was given KEEP the stored secret;
-* `{ $secretClear: true }` clears it; any other string replaces it.
-*/
-/** The most instances one addon lists (an integrations page, not a table). */
-var INSTANCES_LIST_MAX = 1e3;
-/** The keys of the kind's secret fields that sit at the top level of the body. */
-function topLevelSecretKeys(paths) {
-	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[") && !p.includes("{")));
-}
-/** The keys of the kind's top-level MAPS whose values are secrets (`applianceSecrets{}`). */
-function secretMapKeys(paths) {
-	return new Set(paths.filter((p) => p.endsWith("{}") && !p.slice(0, -2).match(/[.[{]/)).map((p) => p.slice(0, -2)));
-}
-/**
-* A patch value for a map of secrets: an entry that is omitted, `''`, the redaction token or the
-* view the form was given KEEPS its stored secret (it is left out of the merge); `{ $secretClear }`
-* or `null` removes the entry; any other string replaces it. Null when nothing is left to merge.
-*/
-function secretMapPatch(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
-	const out = {};
-	for (const [key, entry] of Object.entries(value)) if (entry === null || isSecretClear(entry)) out[key] = null;
-	else if (typeof entry === "string" && entry !== "" && entry !== "__camstack_redacted__" && !isSecretFieldView(entry)) out[key] = entry;
-	return Object.keys(out).length > 0 ? out : null;
-}
-/** Does the kind's body schema carry an `enabled` field? */
-function declaresEnabled(kind) {
-	const json = toJSONSchema(kind.schema, {
-		unrepresentable: "any",
-		io: "input"
-	});
-	const properties = Reflect.get(json, "properties");
-	return typeof properties === "object" && properties !== null && "enabled" in properties;
-}
-var RecordIntegrationInstances = class {
-	records;
-	kind;
-	hooks;
-	handle;
-	secretKeys;
-	secretMaps;
-	nameField;
-	/** The `integrations` registry owns the on/off switch (`role: devices`); the body has none. */
-	registryOwnsEnabled;
-	constructor(records, kind, hooks) {
-		this.records = records;
-		this.kind = kind;
-		this.hooks = hooks;
-		this.handle = records.kind(kind);
-		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
-		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
-		this.nameField = kind.declaration.entry?.nameField ?? "name";
-		this.registryOwnsEnabled = hooks.description.role === "devices";
-		if (this.registryOwnsEnabled && declaresEnabled(kind)) throw new Error(`kind "${kind.name}": the integrations registry owns the on/off switch of a role "devices" addon, so the body must not declare "enabled"`);
-	}
-	/**
-	* One instance read for the addon's own runtime; null when absent. When the keychain is
-	* locked the row is served WITHOUT its secrets and says so (`secrets: 'unavailable'`), so the
-	* caller can keep what it had instead of reconfiguring with an empty secret (D49).
-	*/
-	async readResolved(id) {
-		try {
-			const record = await this.handle.getResolved(id);
-			return record === null ? null : {
-				id,
-				body: record.data,
-				enabled: record.data.enabled !== false,
-				secrets: "resolved"
-			};
-		} catch (err) {
-			if (!(err instanceof RecordSecretUnavailableError)) throw err;
-			const stored = await this.handle.get(id);
-			if (stored === null) return null;
-			return {
-				id,
-				body: Object.fromEntries(Object.entries(stored.data).filter(([key]) => !this.secretKeys.has(key))),
-				enabled: stored.data.enabled !== false,
-				secrets: "unavailable"
-			};
-		}
-	}
-	/** The body of {@link readResolved} alone; a locked keychain yields the row without secrets. */
-	async getResolved(id) {
-		return (await this.readResolved(id))?.body ?? null;
-	}
-	/** Every instance, secrets resolved where the keychain allows; an absent one is skipped. */
-	async listResolved() {
-		const page = await this.handle.query({ limit: INSTANCES_LIST_MAX });
-		const out = [];
-		for (const record of page.records) {
-			const read = await this.readResolved(record.id);
-			if (read !== null) out.push(read);
-		}
-		return out;
-	}
-	viewOf(record) {
-		const shown = secretViewsOf(this.records.owner, this.kind.name, record.id, this.kind.declaration, record.data);
-		const rawName = record.data[this.nameField];
-		const kind = this.hooks.kindOf?.(record.data);
-		const health = this.hooks.health?.(record.data, record.id);
-		return {
-			id: record.id,
-			name: typeof rawName === "string" ? rawName : record.id,
-			configured: this.hooks.configured(record.data),
-			...this.registryOwnsEnabled ? {} : { enabled: record.data.enabled !== false },
-			formValues: shown,
-			...kind !== void 0 ? { kind } : {},
-			...health?.status !== void 0 ? { status: health.status } : {},
-			...health?.lastCheckedAt !== void 0 ? { lastCheckedAt: health.lastCheckedAt } : {}
-		};
-	}
-	describe = async () => this.hooks.mintId === void 0 ? this.hooks.description : {
-		...this.hooks.description,
-		mintsId: true
-	};
-	instanceFormSchema = async ({ id }) => this.hooks.formSchema(id);
-	listInstances = async () => {
-		return (await this.handle.query({ limit: INSTANCES_LIST_MAX })).records.map((record) => this.viewOf(record));
-	};
-	getInstance = async ({ id }) => {
-		const record = await this.handle.get(id);
-		return record === null ? null : this.viewOf(record);
-	};
-	/** Insert ONE row (`ifRev: 0`: an existing id is refused, never overwritten). */
-	createInstance = async ({ id, name, kind, values }) => {
-		const minted = id ?? this.hooks.mintId?.({
-			name,
-			...kind !== void 0 ? { kind } : {}
-		});
-		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
-		await this.handle.put({
-			id: minted,
-			data: this.hooks.initialBody(name, kind)
-		}, { ifRev: 0 });
-		const patch = this.patchOf(values ?? {});
-		if (Object.keys(patch).length > 0) await this.handle.patch(minted, patch);
-		await this.hooks.onChanged?.(minted, "created");
-		return { id: minted };
-	};
-	updateInstance = async ({ id, name, values }) => {
-		const patch = this.patchOf(values);
-		if (name !== void 0) patch[this.nameField] = name;
-		await this.handle.patch(id, patch);
-		await this.hooks.onChanged?.(id, "updated");
-		return { ok: true };
-	};
-	/** The record patch a form `values` object means: secrets kept, cleared or replaced. */
-	patchOf(values) {
-		const patch = {};
-		for (const [key, value] of Object.entries(values)) {
-			if (value === void 0) continue;
-			if (this.secretMaps.has(key)) {
-				const entries = secretMapPatch(value);
-				if (entries !== null) patch[key] = entries;
-			} else if (!this.secretKeys.has(key)) patch[key] = value;
-			else if (isSecretClear(value)) patch[key] = null;
-			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
-		}
-		return patch;
-	}
-	/** The switch lives in the record body; the addon is told so it applies it (D996). */
-	setInstanceEnabled = async ({ id, enabled }) => {
-		if (this.registryOwnsEnabled) throw new Error(`instance "${id}": the integrations registry owns the on/off switch of this addon; set it with integrations.update`);
-		await this.handle.patch(id, { enabled });
-		await this.hooks.onChanged?.(id, "enabled");
-		return { ok: true };
-	};
-	/** The row and its keychain refs go together (the records door). */
-	deleteInstance = async ({ id }) => {
-		await this.handle.delete(id);
-		await this.hooks.onChanged?.(id, "deleted");
-		return { ok: true };
-	};
-	testInstance = async (input) => {
-		if (this.hooks.test === void 0) return {
-			success: false,
-			status: "unsupported",
-			error: "This integration declares no connection test"
-		};
-		return this.hooks.test(input);
-	};
-	/** The flat provider object to hand to `registerProvider`. */
-	toProvider() {
-		return {
-			describe: this.describe,
-			instanceFormSchema: this.instanceFormSchema,
-			listInstances: this.listInstances,
-			getInstance: this.getInstance,
-			createInstance: this.createInstance,
-			updateInstance: this.updateInstance,
-			setInstanceEnabled: this.setInstanceEnabled,
-			deleteInstance: this.deleteInstance,
-			testInstance: this.testInstance
-		};
-	}
-};
 /** No part holds the id a call named. */
 var UnknownInstanceError = class extends Error {
 	instanceId;
@@ -13820,10 +14072,14 @@ function composeInstanceKinds(parts, base) {
 		kind: part.kind.id
 	});
 	return {
-		describe: async () => ({
-			...base,
-			kinds: parts.map((part) => part.kind)
-		}),
+		describe: async () => {
+			const links = (await Promise.all(parts.map(async (part) => (await part.provider.describe()).links ?? []))).flat();
+			return {
+				...base,
+				kinds: parts.map((part) => part.kind),
+				...links.length > 0 ? { links } : {}
+			};
+		},
 		instanceFormSchema: async ({ id, kind }) => {
 			return (id === null ? byKind(kind) : await holderOf(id)).provider.instanceFormSchema({ id });
 		},
@@ -20144,31 +20400,21 @@ var APPLIANCE_CAP_VOCABULARY = {
 	"pet-fountain": {
 		scope: "device",
 		noun: t("Pet fountain", "Fontana per animali"),
-		actions: [
-			{
-				id: "petFountain.pumpOn",
-				method: "setPump",
-				label: t("Pump on", "Pompa accesa"),
-				phrase: t("Start the pump of {device}", "Avvia la pompa di {device}"),
-				icon: "play",
-				args: { on: true }
-			},
-			{
-				id: "petFountain.pumpOff",
-				method: "setPump",
-				label: t("Pump off", "Pompa spenta"),
-				phrase: t("Stop the pump of {device}", "Ferma la pompa di {device}"),
-				icon: "square",
-				args: { on: false }
-			},
-			{
-				id: "petFountain.resetDailyConsumption",
-				method: "resetDailyConsumption",
-				label: t("Clear daily consumption", "Azzera il consumo giornaliero"),
-				phrase: t("Clear the daily water consumption of {device}", "Azzera il consumo giornaliero di acqua di {device}"),
-				icon: "rotate-ccw"
-			}
-		],
+		actions: [{
+			id: "petFountain.pumpOn",
+			method: "setPump",
+			label: t("Pump on", "Pompa accesa"),
+			phrase: t("Start the pump of {device}", "Avvia la pompa di {device}"),
+			icon: "play",
+			args: { on: true }
+		}, {
+			id: "petFountain.pumpOff",
+			method: "setPump",
+			label: t("Pump off", "Pompa spenta"),
+			phrase: t("Stop the pump of {device}", "Ferma la pompa di {device}"),
+			icon: "square",
+			args: { on: false }
+		}],
 		state: [{
 			kind: "boolean",
 			field: "empty",
@@ -44122,8 +44368,15 @@ var ActionInputSchema = object({
 var ActionRunOriginSchema = object({ 
 /** The automation block whose step started it. */
 blockId: string().min(1).optional() });
-/** `started` = the caller did not ask to wait. */
-var ActionRunOutcomeSchema = union([AutomationRunOutcomeSchema, literal("started")]);
+/**
+* `started` = the caller did not ask to wait. `timed-out` = the run reached the
+* ceiling (`ACTION_RUN_MAX_MS`) and was stopped; it is never a `ran`.
+*/
+var ActionRunOutcomeSchema = union([
+	AutomationRunOutcomeSchema,
+	literal("started"),
+	literal("timed-out")
+]);
 var ActionRunResultSchema = object({
 	runId: string().min(1),
 	outcome: ActionRunOutcomeSchema,
@@ -44667,6 +44920,8 @@ method(object({}), array(ActionEntrySchema), { auth: "admin" }), method(object({
 	kind: "mutation",
 	auth: "admin"
 });
+/** `timeoutMs` of `actions.run`: a waited call outlives any legal run. */
+var ACTION_RUN_TIMEOUT_MS = 363e4;
 /**
 * actions — the ONE surface for runnable actions, for the UI and for
 * automations. Provided by the core-blocks builtin on the hub.
@@ -44685,6 +44940,12 @@ method(object({}), array(ActionEntrySchema), { auth: "admin" }), method(object({
 * An admin, and an in-process caller (an automation block), may run any action.
 * Every refusal is typed (`[not-linked] …`) and logged.
 *
+* **A run lasts at most `ACTION_RUN_MAX_MS` (60 min).** The provider stops a
+* run that reaches it and answers `timed-out` (never `ran`); an action whose
+* `wait` steps alone add up to more is refused at create/update
+* (`[invalid-steps]`). `run` declares a `timeoutMs` above that ceiling, so a
+* waited call (an automation step) is never cut by the 60 s transport default.
+*
 * A second `run` of an action that is already running is REFUSED — traced and
 * logged — never queued.
 */
@@ -44711,7 +44972,8 @@ method(object({}), array(ActionEntrySchema), { auth: "admin" }), method(object({
 	role: "viewer",
 	auth: "protected",
 	kind: "mutation",
-	caller: "required"
+	caller: "required",
+	timeoutMs: ACTION_RUN_TIMEOUT_MS
 }), method(ActionIdInput, _void(), {
 	kind: "mutation",
 	auth: "admin"
@@ -49802,6 +50064,9 @@ var MediaPlayerStatusSchema = object({
 	/** Repeat mode. Null when no repeat surface.
 	*  Pair with `DeviceFeature.MediaPlayerRepeat`. */
 	repeat: MediaPlayerRepeatSchema.nullable(),
+	/** Ms epoch when `position` was read from the device. Null when the driver
+	*  does not say; a UI that advances the position while playing counts from it. */
+	positionUpdatedAt: number$1().nullable().default(null),
 	/** Ms epoch when the slice was last updated. */
 	lastChangedAt: number$1()
 });
@@ -50437,7 +50702,9 @@ var ThresholdTransformDraftSchema = object({
 	comparison: _enum(["gte", "lte"]),
 	threshold: number$1(),
 	startDwellMs: number$1().nonnegative(),
-	stopDwellMs: number$1().nonnegative()
+	stopDwellMs: number$1().nonnegative(),
+	/** Samples a start needs; absent = the compiler's default for the source (2 for running power, else 1). */
+	minSamples: number$1().int().min(1).optional()
 });
 var CustomizeTransformDraftSchema = discriminatedUnion("kind", [
 	IdentityTransformDraftSchema,
@@ -56314,6 +56581,7 @@ var IntegrationWithStateSchema = object({
 	id: string(),
 	addonId: string(),
 	name: string(),
+	/** A projection of the instance body's switch (`setInstanceEnabled` is the only writer). */
 	enabled: boolean(),
 	info: record(string(), unknown()).readonly(),
 	/** The discovery candidate this integration was set up from (D984). */
@@ -56326,6 +56594,7 @@ var IntegrationLiteSchema = object({
 	id: string(),
 	addonId: string(),
 	name: string(),
+	/** A projection of the instance body's switch (`setInstanceEnabled` is the only writer). */
 	enabled: boolean(),
 	info: record(string(), unknown()).readonly(),
 	/** The discovery candidate this integration was set up from (D984). */
@@ -56425,7 +56694,6 @@ var TestConnectionResultSchema = object({
 var CreateIntegrationInputSchema = object({
 	addonId: string(),
 	name: string(),
-	enabled: boolean().optional(),
 	info: record(string(), unknown()).optional(),
 	/** `stableId` of the discovery candidate the form was seeded from (D984). */
 	originStableId: string().optional(),
@@ -56434,6 +56702,11 @@ var CreateIntegrationInputSchema = object({
 var UpdateIntegrationInputSchema = object({
 	id: string(),
 	name: string().optional(),
+	/**
+	* Accepted for a FIXED builtin only (`info.fixed`: alarm panel, camera grid, core blocks,
+	* terminal), which keeps no instance record: the registry flag is its one store. Any other
+	* integration is switched through `integration-instances.setInstanceEnabled`.
+	*/
 	enabled: boolean().optional(),
 	info: record(string(), unknown()).optional()
 });
@@ -56481,7 +56754,7 @@ var IntegrationInstanceIdSchema = string().min(1);
 var IntegrationInstanceModeSchema = _enum(["single", "multiple"]);
 /**
 * What the addon's instances ARE for the Integrations page (planning#416). `devices`: each
-* instance is an integration that brings devices (the registry owns its on/off switch);
+* instance is an integration that brings devices (its record body owns the on/off switch);
 * `services`: a connection configured from the addon's own function page, never listed on
 * Integrations.
 * It is the same vocabulary as the manifest's `integrationRole`, which stays as an override.
@@ -56524,18 +56797,38 @@ var IntegrationInstanceKindSchema = object({
 	/** Relative hub path to disconnect that account. */
 	disconnectPath: string().min(1).optional()
 });
+/**
+* How devices of an instance are found. `none`: the operator adds them by hand; `lan`: the addon
+* scans the network before any instance exists (the wizard offers the candidates); `account`: the
+* devices appear after the instance signs in. `scopedToInstance`: a discovery run belongs to ONE
+* instance and its candidates are claimed by it.
+*/
+var IntegrationInstanceDiscoverySchema = object({
+	mode: _enum([
+		"none",
+		"lan",
+		"account"
+	]),
+	scopedToInstance: boolean()
+});
+/**
+* One link a kind of this provider declares (D1013 rule 5): the body `field` of an instance of
+* `kind` holds the id of an instance of the function cap `to.cap` (of kind `to.kind`, when set).
+* The hub indexes these so the target's delete is refused while a link names it.
+*/
+var IntegrationInstanceLinkSchema = object({
+	kind: string().min(1),
+	field: string().min(1),
+	to: object({
+		cap: string().min(1),
+		kind: string().min(1).optional()
+	})
+});
 var IntegrationInstanceDescriptionSchema = object({
 	/** What the instances are for the Integrations page; see {@link IntegrationInstanceRoleSchema}. */
 	role: IntegrationInstanceRoleSchema,
 	/** How the devices of an instance are found; absent means `{ mode: 'none' }`. */
-	discovery: object({
-		mode: _enum([
-			"none",
-			"lan",
-			"account"
-		]),
-		scopedToInstance: boolean()
-	}).optional(),
+	discovery: IntegrationInstanceDiscoverySchema.optional(),
 	/** `single`: at most one instance can exist (Loki). `multiple`: an account each. */
 	instanceMode: IntegrationInstanceModeSchema,
 	/** What the instance is, for the UI (`destination`, `relay`, `account`). */
@@ -56556,7 +56849,9 @@ var IntegrationInstanceDescriptionSchema = object({
 	* `createInstance` without an `id` works: the provider mints it. Absent means the caller must
 	* send an id (the UI then mints an opaque one).
 	*/
-	mintsId: boolean().optional()
+	mintsId: boolean().optional(),
+	/** The links to other instances the provider's kinds declare; absent means none. */
+	links: array(IntegrationInstanceLinkSchema).optional()
 });
 var IntegrationInstanceStatusSchema = object({
 	state: _enum([
@@ -56576,8 +56871,8 @@ var IntegrationInstanceSchema = object({
 	configured: boolean(),
 	/**
 	* The instance's own on/off switch (D996), derived from the record body (`enabled !== false`,
-	* so a row written before the field existed is on). Absent when the `integrations` registry
-	* owns the switch (`describe().role` is `devices`): read it from the registry row.
+	* so a row written before the field existed is on). The same for every role, `devices` included:
+	* the body is the one store, `setInstanceEnabled` the one writer (epic #440, step 3).
 	*/
 	enabled: boolean().optional(),
 	/** The kind of this instance (one of `describe().kinds[].id`), when the provider has kinds. */
@@ -56627,7 +56922,8 @@ var integrationInstancesCapability = {
 			auth: "admin"
 		}),
 		/**
-		* Switch ONE instance on or off. A row control, not a form field: `updateInstance.values` is the
+		* Switch ONE instance on or off, for every role; a missing record is created from the addon's
+		* initial body. A row control, not a form field: `updateInstance.values` is the
 		* form patch (D62, D996). An off instance keeps its record and secrets and does no work.
 		*/
 		setInstanceEnabled: method(object({
@@ -59690,6 +59986,8 @@ var MigrationIntegrationSchema = object({
 	addonId: string(),
 	name: string(),
 	info: Rows,
+	/** The registry's stored switch: read by the one-switch migration, nothing else. */
+	enabled: boolean().optional(),
 	originStableId: string().optional()
 });
 var MigrationDeviceSchema = object({
@@ -69819,14 +70117,6 @@ var PetFountainStatusSchema = object({
 	empty: boolean().nullable(),
 	/** True while the pump is running. Null while unknown. */
 	pumpRunning: boolean().nullable(),
-	/** Water drunk in the last drink, in litres. */
-	lastDrink: number$1().min(0).nullable().meta(readingMeta("volume")),
-	/** Water drunk in the current hour, in litres. */
-	currentHourDrink: number$1().min(0).nullable().meta(readingMeta("volume")),
-	/** Water drunk over the last 24 hours (rolling), in litres. */
-	last24hDrink: number$1().min(0).nullable().meta(readingMeta("volume")),
-	/** Water drunk since local midnight, in litres. Null when the fountain has no such sensor. */
-	todayDrink: number$1().min(0).nullable().meta(readingMeta("volume")),
 	/** Decoded fault message. Null means healthy; a non-null string is an active fault. */
 	error: string().nullable(),
 	/** Ms epoch when the slice was last refreshed. */
@@ -69839,21 +70129,15 @@ var petFountainCapability = {
 	deviceNative: true,
 	mode: "singleton",
 	deviceTypes: [DeviceType.PetFountain],
-	methods: {
-		/** Start or stop the pump. */
-		setPump: method(object({
-			deviceId: DeviceIdSchema$1,
-			on: boolean()
-		}), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
-		/** Clear the rolling daily consumption counters on the device. */
-		resetDailyConsumption: method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		})
-	},
+	methods: { 
+	/** Start or stop the pump. */
+setPump: method(object({
+		deviceId: DeviceIdSchema$1,
+		on: boolean()
+	}), _void(), {
+		kind: "mutation",
+		auth: "protected"
+	}) },
 	status: {
 		schema: PetFountainStatusSchema,
 		kind: "push"
@@ -69877,14 +70161,6 @@ var petFountainCapability = {
 		waterVolume: {
 			kind: "gauge",
 			unit: "L"
-		},
-		todayDrink: {
-			kind: "gauge",
-			unit: "L"
-		},
-		last24hDrink: {
-			kind: "gauge",
-			unit: "L"
 		}
 	} }
 };
@@ -88333,13 +88609,6 @@ Object.freeze({
 		access: "view",
 		role: "viewer"
 	},
-	"petFountain.resetDailyConsumption": {
-		capName: "pet-fountain",
-		capScope: "device",
-		addonId: null,
-		access: "delete",
-		role: "viewer"
-	},
 	"petFountain.setPump": {
 		capName: "pet-fountain",
 		capScope: "device",
@@ -94736,11 +95005,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"petFountain.resetDailyConsumption": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
 	"petFountain.setPump": [{
 		name: "deviceId",
 		form: "single",
@@ -98442,113 +98706,114 @@ object({
 	delay: number$1().nonnegative().optional(),
 	commands: record(string(), unknown())
 });
-var BrokerInUseError = class extends Error {
-	brokerId;
+var InstanceInUseError = class extends Error {
+	instanceId;
 	users;
-	name = "BrokerInUseError";
-	constructor(brokerId, users) {
-		super(`broker '${brokerId}' is still in use by ${users.map((u) => `${u.kind} '${u.name ?? u.id}' (${u.id})`).join(", ")}; unlink them first`);
-		this.brokerId = brokerId;
+	name = "InstanceInUseError";
+	constructor(instanceId, users) {
+		super(`instance '${instanceId}' is still in use by ${users.map((u) => `${u.kind} '${u.name ?? u.id}' (${u.id})`).join(", ")}; unlink them first`);
+		this.instanceId = instanceId;
 		this.users = users;
 	}
 };
-/** Throw {@link BrokerInUseError} when any finder names a user of `brokerId`. */
-async function assertBrokerUnused(brokerId, finders) {
+/** Throw {@link InstanceInUseError} when any finder names a user of `instanceId`. */
+async function assertInstanceUnused(instanceId, finders) {
 	const users = [];
-	for (const finder of finders) users.push(...await finder.find(brokerId));
-	if (users.length > 0) throw new BrokerInUseError(brokerId, users);
+	for (const finder of finders) users.push(...await finder.find(instanceId));
+	if (users.length > 0) throw new InstanceInUseError(instanceId, users);
 }
 /**
-* An account provider whose `deleteInstance` is refused while anything still uses the account
-* (D1012). The account is an `integration-instances` kind (D1013), so the refusal lives on the
-* delete the instances page calls, not on a separate broker cap.
+* A provider whose `deleteInstance` is refused while anything still uses the instance. The
+* account is an `integration-instances` kind (D1013), so the refusal lives on the delete the
+* instances page calls.
 */
-function guardBrokerDelete(base, users) {
+function guardInstanceDelete(base, users) {
 	return {
 		...base,
 		deleteInstance: async (input) => {
-			await assertBrokerUnused(input.id, users());
+			await assertInstanceUnused(input.id, users());
 			return base.deleteInstance(input);
 		}
 	};
 }
-/**
-* The generic binding of a service to a broker (D1012). A service (an integration today; a
-* notifier target, a calendar source or an exporter later) names the broker it runs through by id
-* and keeps only its OWN link settings: never a copy of the broker's host, sign-in or secrets,
-* which stay with the broker and are edited on the Brokers page.
-*
-* One primitive serves every consumer:
-*  - {@link declareBrokerLinkKind}: the record kind, body `{ name, brokerId, ...linkFields }`;
-*  - {@link buildBrokerLinkForm}: the form, a `broker-select` picker plus the service's link
-*    sections, which may be DYNAMIC (a list read from the chosen broker, like HA calendars);
-*  - {@link buildBrokerLinkInstances}: the `integration-instances` provider of an integration;
-*  - {@link resolveBrokerId} / {@link brokerLinkUserFinder}: which broker a record names and which
-*    records name a broker, so a delete of a broker still in use can name its users generically.
-*/
-/** The record kind an integration is stored under. */
-var BROKER_LINK_KIND_NAME = "connections";
-/** What every broker-linked record carries; `brokerId` is always present, `''` is a row whose broker is not picked yet; link fields of the service come on top. */
-var BrokerLinkBodySchema = entryBody({ brokerId: string() });
-function declareBrokerLinkKind(spec) {
-	return defineEntryKind(BROKER_LINK_KIND_NAME, {
+/** The `instance-select` field of a link, keyed like the body field it fills. */
+function linkFieldDescriptor(key, target, labels) {
+	return {
+		type: "instance-select",
+		key,
+		label: labels.label,
+		...labels.description !== void 0 ? { description: labels.description } : {},
+		required: labels.required ?? true,
+		...labels.noneLabel !== void 0 ? { noneLabel: labels.noneLabel } : {},
+		functionCap: target.cap,
+		...target.kind !== void 0 ? { kind: target.kind } : {}
+	};
+}
+function declareLinkKind(spec) {
+	const linkShape = {};
+	for (const [field, target] of Object.entries(spec.links)) linkShape[field] = linkField(target);
+	const typed = entryBody({
+		...linkShape,
+		...spec.fields
+	});
+	return defineEntryKind(spec.name, {
 		title: spec.title,
-		schema: BrokerLinkBodySchema.extend(spec.linkFields ?? {}),
+		schema: typed,
 		writeTrigger: spec.writeTrigger
 	});
 }
-/** The form: a picker over the brokers of `brokerKind`, then the service's link sections. */
-async function buildBrokerLinkForm(spec, brokerId) {
-	const dynamic = brokerId !== void 0 && spec.dynamicSections !== void 0 ? await spec.dynamicSections(brokerId) : [];
-	return { sections: [
-		{
-			id: "broker-link",
-			title: spec.brokerLabel,
-			description: `Each integration links to a ${spec.brokerLabel} connection (Connectivity → Brokers). The connection and its sign-in are edited there.`,
-			columns: 1,
-			fields: [{
-				type: "broker-select",
-				key: "brokerId",
-				label: spec.brokerLabel,
-				brokerKind: spec.brokerKind
-			}]
-		},
-		...spec.linkSections ?? [],
-		...dynamic
-	] };
-}
-/** The broker a record names; undefined while it names none. */
-function resolveBrokerId(record) {
-	return record.brokerId === void 0 || record.brokerId === "" ? void 0 : record.brokerId;
+/** The id a record holds in a link field; undefined while it names none. */
+function linkedId(body, field) {
+	const value = body[field];
+	return typeof value === "string" && value !== "" ? value : void 0;
 }
-/** The broker an integration links to, from its record. */
-async function brokerIdOf(instances, integrationId) {
+/** The instance an integration's record links to through `field`; undefined while it names none. */
+async function linkedIdOf(instances, integrationId, field) {
 	const body = await instances.getResolved(integrationId);
-	return body === null ? void 0 : resolveBrokerId(body);
+	return body === null ? void 0 : linkedId(body, field);
 }
-/** Every record of the kind that names `brokerId`, as users of that broker. */
-function brokerLinkUserFinder(instances, userKind = "integration") {
-	return { find: async (brokerId) => (await instances.listResolved()).filter((entry) => resolveBrokerId(entry.body) === brokerId).map((entry) => ({
+/** Every record of the kind whose `field` names `instanceId`, as users of that instance. */
+function linkUserFinder(instances, field, userKind = "integration") {
+	return { find: async (instanceId) => (await instances.listResolved()).filter((entry) => linkedId(entry.body, field) === instanceId).map((entry) => ({
 		kind: userKind,
 		id: entry.id,
-		name: entry.body.name
+		name: typeof entry.body["name"] === "string" ? entry.body["name"] : entry.id
 	})) };
 }
-/** The `integration-instances` provider of an addon whose integrations link to a broker. */
-function buildBrokerLinkInstances(records, spec) {
+/** The `integration-instances` provider of a service whose records link to other instances. */
+function buildLinkedInstances(records, spec) {
+	const links = linksOfKind(spec.kind);
+	const kindId = spec.instanceKind ?? spec.kind.name;
 	const instances = new RecordIntegrationInstances(records, spec.kind, {
 		description: {
-			role: "devices",
-			instanceMode: "multiple",
-			kind: "connection",
-			canTest: false
+			...spec.description,
+			links: links.map((link) => ({
+				kind: kindId,
+				field: link.field,
+				to: link.to
+			}))
+		},
+		formSchema: async (id) => {
+			const first = links[0];
+			const chosen = id === null || first === void 0 || spec.dynamicSections === void 0 ? void 0 : linkedId(await instances.getResolved(id) ?? {}, first.field);
+			const dynamic = chosen !== void 0 && spec.dynamicSections !== void 0 ? await spec.dynamicSections(chosen) : [];
+			return { sections: [
+				{
+					id: "links",
+					title: "Linked instances",
+					columns: 1,
+					fields: links.map((link) => linkFieldDescriptor(link.field, link.to, spec.labels?.[link.field] ?? { label: link.field }))
+				},
+				...spec.linkSections ?? [],
+				...dynamic
+			] };
 		},
-		formSchema: async (id) => buildBrokerLinkForm(spec, id === null ? void 0 : await brokerIdOf(instances, id)),
 		initialBody: (name) => spec.kind.schema.parse({
 			name,
-			brokerId: ""
+			...Object.fromEntries(links.map((link) => [link.field, ""]))
 		}),
-		configured: (body) => resolveBrokerId(body) !== void 0,
+		configured: (body) => links.every((link) => linkedId(body, link.field) !== void 0) && (spec.alsoConfigured?.(body) ?? true),
+		...spec.mintId !== void 0 ? { mintId: spec.mintId } : {},
 		...spec.onChanged !== void 0 ? { onChanged: spec.onChanged } : {}
 	});
 	return instances;
@@ -98616,6 +98881,42 @@ function brokerLinkPortsOver(deps) {
 	};
 }
 //#endregion
+//#region src/speak/constants.ts
+/** Echo speech limits and the worker restart bound (same window as CrashSupervisor). */
+var ALEXA_SPEAK_ADDON_ID = "import-alexa";
+var ALEXA_SPEAK_KIND = "alexa-echo";
+/** The kind of the Amazon-account broker the Echoes are read from. */
+var ALEXA_BROKER_KIND = "alexa";
+/** The Amazon account an Echo target speaks through. */
+var ALEXA_ACCOUNT_LINK = {
+	cap: "broker",
+	kind: ALEXA_BROKER_KIND
+};
+var DEVICE_REFRESH_MS = 5 * 6e4;
+/** Where the addon serves the Alexa mark; `listTargetKinds` stamps it as `iconUrl`. */
+var ALEXA_SPEAK_ICON_URL = `/addon/${ALEXA_SPEAK_ADDON_ID}/icons/${ALEXA_SPEAK_KIND}`;
+/** How often an adopted Echo's player state is read while the push channel is down. */
+var ECHO_POLL_MS = 3e4;
+/**
+* The same read while the push channel is up: a safety net for a missed event, not the
+* way changes arrive. Back to `ECHO_POLL_MS` the moment the channel goes down.
+*/
+var ECHO_POLL_PUSH_HEALTHY_MS = 5 * 6e4;
+/** Push events for one Echo inside this window are one read, not one per event. */
+var ECHO_PUSH_READ_GAP_MS = 2e3;
+/** One more read after a command, once Amazon has had time to apply it. */
+var ECHO_REREAD_MS = 1500;
+/** After a 429 the account is left alone for this long, doubling up to the cap. */
+var ECHO_RATE_BACKOFF_BASE_MS = 3e4;
+var ECHO_RATE_BACKOFF_MAX_MS = 5 * 6e4;
+/**
+* A command (volume, play, Do Not Disturb) that has not started within this, or not
+* finished, is answered with an error instead of running minutes late.
+*/
+var ECHO_COMMAND_DEADLINE_MS = 12e3;
+/** A poll read is stale after this; it is dropped from the queue rather than sent late. */
+var ECHO_READ_DEADLINE_MS = 25e3;
+//#endregion
 //#region src/config.ts
 /**
 * Alexa account connection settings for ONE broker (= one Amazon account).
@@ -98672,7 +98973,7 @@ var alexaEchoTargetSchema = object({
 	name: string(),
 	enabled: boolean(),
 	/** The broker (Amazon account) the Echo belongs to; '' until one is chosen. */
-	brokerId: string().default(""),
+	brokerId: linkField(ALEXA_ACCOUNT_LINK).default(""),
 	echoId: string(),
 	respectDnd: boolean()
 });
@@ -142931,7 +143232,7 @@ var AlexaBrokerRegistry = class {
 	async restore(entries) {
 		for (const entry of entries) this.#seedCounter(entry.id);
 		for (const entry of entries) {
-			if (entry.enabled === false) continue;
+			if (!isInstanceEnabled(entry)) continue;
 			try {
 				await this.#startManager(entry);
 			} catch (err) {
@@ -143897,6 +144198,9 @@ function isKnownCap(cap) {
 	return KNOWN_CAPS.has(cap);
 }
 var EchoSessionRegistry = class {
+	#channels = /* @__PURE__ */ new Map();
+	#pushListeners = /* @__PURE__ */ new Map();
+	#channelListeners = /* @__PURE__ */ new Map();
 	#resolve = null;
 	#dnd = /* @__PURE__ */ new Map();
 	#volumes = /* @__PURE__ */ new Map();
@@ -143938,12 +144242,54 @@ var EchoSessionRegistry = class {
 		});
 		return pending;
 	}
+	/** Forget the shared volume list: a list fetched before a set must not answer a poll after it. */
+	invalidateVolumes(brokerId) {
+		this.#volumes.delete(brokerId);
+	}
+	/** Forget the shared Do Not Disturb list, for the same reason. */
+	invalidateDnd(brokerId) {
+		this.#dnd.delete(brokerId);
+	}
+	/** Whether the account's push channel is open; `down` when nothing was ever reported. */
+	pushChannel(brokerId) {
+		return this.#channels.get(brokerId) ?? "down";
+	}
+	channel(brokerId, state) {
+		if (this.pushChannel(brokerId) === state) return;
+		this.#channels.set(brokerId, state);
+		for (const listener of [...this.#channelListeners.get(brokerId) ?? []]) listener(state);
+	}
+	event(brokerId, serial) {
+		this.invalidateVolumes(brokerId);
+		this.invalidateDnd(brokerId);
+		for (const listener of [...this.#pushListeners.get(`${brokerId}\u0000${serial}`) ?? []]) listener();
+	}
+	/** Called when Amazon pushes something about this Echo. Returns the unsubscribe. */
+	onEcho(brokerId, serial, listener) {
+		return subscribe(this.#pushListeners, `${brokerId}\u0000${serial}`, listener);
+	}
+	/** Called when the account's channel goes up or down. Returns the unsubscribe. */
+	onChannel(brokerId, listener) {
+		return subscribe(this.#channelListeners, brokerId, listener);
+	}
 	clear() {
+		this.#channels.clear();
+		this.#pushListeners.clear();
+		this.#channelListeners.clear();
 		this.#resolve = null;
 		this.#dnd.clear();
 		this.#volumes.clear();
 	}
 };
+function subscribe(map, key, listener) {
+	const set = map.get(key) ?? /* @__PURE__ */ new Set();
+	set.add(listener);
+	map.set(key, set);
+	return () => {
+		set.delete(listener);
+		if (set.size === 0 && map.get(key) === set) map.delete(key);
+	};
+}
 /** The single in-process registry shared across the addon. */
 var alexaEchoSessions = new EchoSessionRegistry();
 //#endregion
@@ -143963,6 +144309,7 @@ function emptyEchoStatus(state, now) {
 		duration: null,
 		shuffle: null,
 		repeat: null,
+		positionUpdatedAt: null,
 		lastChangedAt: now
 	};
 }
@@ -143996,12 +144343,24 @@ function repeatOf(value) {
 	if (value === "UNSELECTED") return "off";
 	return null;
 }
+/** The streaming service playing: its display name, else its raw name; empty when Amazon names none. */
+function sourceOf(info) {
+	return nonEmpty(info.provider?.providerDisplayName) ?? nonEmpty(info.provider?.providerName) ?? "";
+}
+/**
+* What is playing. Amazon puts the title in `infoText.title`, but a radio station
+* often names itself only in the first sub text, and some players send artwork and
+* a provider with no text at all: each still counts as now playing. Nothing to
+* title it by (no text, and artwork with no provider name) is null.
+*/
 function currentMediaOf(info) {
-	const title = nonEmpty(info.infoText?.title);
-	if (title === null) return null;
-	const artist = nonEmpty(info.infoText?.subText1);
-	const album = nonEmpty(info.infoText?.subText2);
+	const first = nonEmpty(info.infoText?.title);
+	const second = nonEmpty(info.infoText?.subText1);
 	const imageUrl = nonEmpty(info.mainArt?.url);
+	const album = nonEmpty(info.infoText?.subText2);
+	const title = first ?? second ?? (imageUrl !== null ? nonEmpty(sourceOf(info)) : null);
+	if (title === null) return null;
+	const artist = first !== null ? second : null;
 	return {
 		type: "unknown",
 		title,
@@ -144013,12 +144372,15 @@ function currentMediaOf(info) {
 function mapPlayerInfoToStatus(info, input) {
 	if (!input.online) return emptyEchoStatus("off", input.now);
 	const length = secondsToMs(info.progress?.mediaLength);
+	const position = secondsToMs(info.progress?.mediaProgress);
 	return {
 		...emptyEchoStatus(mapEchoPlaybackState(info.state), input.now),
 		volumeLevel: percent(info.volume?.volume),
 		isMuted: typeof info.volume?.muted === "boolean" ? info.volume.muted : null,
+		source: sourceOf(info),
 		currentMedia: currentMediaOf(info),
-		position: secondsToMs(info.progress?.mediaProgress),
+		position,
+		positionUpdatedAt: position === null ? null : input.now,
 		duration: length === 0 ? null : length,
 		shuffle: shuffleOf(info.transport?.shuffle),
 		repeat: repeatOf(info.transport?.repeat)
@@ -144037,30 +144399,6 @@ function withListedVolume(status, listed) {
 	};
 }
 //#endregion
-//#region src/speak/constants.ts
-/** Echo speech limits and the worker restart bound (same window as CrashSupervisor). */
-var ALEXA_SPEAK_ADDON_ID = "import-alexa";
-var ALEXA_SPEAK_KIND = "alexa-echo";
-/** The kind of the Amazon-account broker the Echoes are read from. */
-var ALEXA_BROKER_KIND = "alexa";
-var DEVICE_REFRESH_MS = 5 * 6e4;
-/** Where the addon serves the Alexa mark; `listTargetKinds` stamps it as `iconUrl`. */
-var ALEXA_SPEAK_ICON_URL = `/addon/${ALEXA_SPEAK_ADDON_ID}/icons/${ALEXA_SPEAK_KIND}`;
-/** How often an adopted Echo's player state is read (a push channel is a later phase). */
-var ECHO_POLL_MS = 3e4;
-/** One more read after a command, once Amazon has had time to apply it. */
-var ECHO_REREAD_MS = 1500;
-/** After a 429 the account is left alone for this long, doubling up to the cap. */
-var ECHO_RATE_BACKOFF_BASE_MS = 3e4;
-var ECHO_RATE_BACKOFF_MAX_MS = 5 * 6e4;
-/**
-* A command (volume, play, Do Not Disturb) that has not started within this, or not
-* finished, is answered with an error instead of running minutes late.
-*/
-var ECHO_COMMAND_DEADLINE_MS = 12e3;
-/** A poll read is stale after this; it is dropped from the queue rather than sent late. */
-var ECHO_READ_DEADLINE_MS = 25e3;
-//#endregion
 //#region src/speak/worker-protocol.ts
 /** Line-delimited JSON the long-lived Python worker speaks. One object per line. */
 var EchoDeviceSchema = object({
@@ -144096,6 +144434,35 @@ var WorkerLineSchema = union([object({
 	/** A typed reason the worker names; `rate-limited` is Amazon's 429. */
 	code: string().optional()
 })]);
+var WorkerPushSchema = discriminatedUnion("push", [object({
+	push: literal("channel"),
+	state: _enum(["up", "down"]),
+	reason: string().default(""),
+	/** How long until the worker opens the channel again; 0 when it is up. */
+	retryInMs: number$1().int().nonnegative().default(0)
+}), object({
+	push: literal("event"),
+	command: string().min(1),
+	/** The Echo the event is about; null when Amazon named none. */
+	serial: string().min(1).nullable()
+})]);
+/** Push events that change what an Echo's slice shows: the addon reads that Echo once. */
+var PUSH_READ_COMMANDS = new Set([
+	"PUSH_AUDIO_PLAYER_STATE",
+	"PUSH_MEDIA_CHANGE",
+	"PUSH_VOLUME_CHANGE",
+	"PUSH_DOPPLER_CONNECTION_CHANGE"
+]);
+/**
+* Push events Amazon sends that the slice does not need: progress ticks every few
+* seconds while playing (the position is derived from `positionUpdatedAt`), and the
+* notification / equalizer changes touch nothing the media-player shows.
+*/
+var PUSH_IGNORED_COMMANDS = new Set([
+	"PUSH_MEDIA_PROGRESS_CHANGE",
+	"PUSH_NOTIFICATION_CHANGE",
+	"PUSH_EQUALIZER_STATE_CHANGE"
+]);
 var RATE_LIMITED_CODE = "rate-limited";
 /** Amazon answered 429. Never an empty answer: the caller backs off and keeps what it had. */
 var RateLimitedError = class extends Error {
@@ -144138,35 +144505,75 @@ function parseSessionStatus(result) {
 	return parsed.data;
 }
 /**
+* A reading Amazon sent in a shape we did not expect is a reading we do not have
+* (null), never a reason to discard the rest of the player: one odd field used to
+* fail the whole read and the Echo kept showing nothing.
+*/
+var text = string().nullish().catch(null);
+var flag = boolean().nullish().catch(null);
+var count = number$1().nullish().catch(null);
+/**
 * The raw `playerInfo` of `/api/np/player`. Amazon omits what it does not know,
 * so every field is nullable; the mapping to the media-player cap turns a missing
-* value into null, never into 0 (D393).
+* value into null, never into 0 (D393). Every block and every leaf is read on its
+* own: a block of the wrong type is null, the others still count.
 */
 var PlayerInfoSchema = object({
-	state: string().nullish(),
+	state: text,
 	volume: object({
-		volume: number$1().nullish(),
-		muted: boolean().nullish()
-	}).nullish(),
+		volume: count,
+		muted: flag
+	}).nullish().catch(null),
 	infoText: object({
-		title: string().nullish(),
-		subText1: string().nullish(),
-		subText2: string().nullish()
-	}).nullish(),
-	mainArt: object({ url: string().nullish() }).nullish(),
+		title: text,
+		subText1: text,
+		subText2: text
+	}).nullish().catch(null),
+	mainArt: object({ url: text }).nullish().catch(null),
 	progress: object({
-		mediaLength: number$1().nullish(),
-		mediaProgress: number$1().nullish()
-	}).nullish(),
+		mediaLength: count,
+		mediaProgress: count
+	}).nullish().catch(null),
+	provider: object({
+		providerName: text,
+		providerDisplayName: text
+	}).nullish().catch(null),
 	transport: object({
-		shuffle: string().nullish(),
-		repeat: string().nullish()
-	}).nullish()
-});
+		shuffle: text,
+		repeat: text
+	}).nullish().catch(null)
+});
+/** The playback states Amazon is known to send. */
+var KNOWN_PLAYER_STATES = new Set([
+	"PLAYING",
+	"PAUSED",
+	"BUFFERING",
+	"IDLE"
+]);
+/**
+* A lenient read must not turn garbage into a healthy idle player: when Amazon sent a
+* state we do not recognise (or of the wrong type) and not one block survived, the read
+* is a failure, exactly as before the leniency. A body that says nothing (`{}`, null
+* state) stays an idle player.
+*/
 function parsePlayerState(result) {
 	const parsed = object({ playerInfo: PlayerInfoSchema.nullish() }).safeParse(result);
 	if (!parsed.success) throw new Error("worker returned an unexpected player state");
-	return parsed.data.playerInfo ?? {};
+	const info = parsed.data.playerInfo ?? {};
+	const raw = object({ playerInfo: object({ state: unknown() }).nullish() }).safeParse(result);
+	const rawState = raw.success ? raw.data.playerInfo?.state : void 0;
+	const saidSomething = rawState !== void 0 && rawState !== null;
+	const knownState = typeof info.state === "string" && KNOWN_PLAYER_STATES.has(info.state);
+	const noBlock = [
+		info.volume,
+		info.infoText,
+		info.mainArt,
+		info.progress,
+		info.provider,
+		info.transport
+	].every((block) => block === null || block === void 0);
+	if (saidSomething && !knownState && noBlock) throw new Error("worker returned an unreadable player state");
+	return info;
 }
 var DndEntrySchema = object({
 	serial: string().min(1),
@@ -144217,21 +144624,32 @@ var AlexaEchoDevice = class extends BaseDevice {
 	features = [
 		DeviceFeature.MediaPlayerVolume,
 		DeviceFeature.MediaPlayerNext,
-		DeviceFeature.MediaPlayerPrevious
+		DeviceFeature.MediaPlayerPrevious,
+		DeviceFeature.MediaPlayerShuffle,
+		DeviceFeature.MediaPlayerRepeat
 	];
 	brokerId;
 	serial;
 	amazonDeviceType;
 	timer = null;
 	rereadTimer = null;
+	pushReadTimer = null;
+	lastPushReadAt = 0;
+	repollAfter = false;
+	unsubscribers = [];
 	polling = false;
 	failureLogged = false;
 	volumeFailureLogged = false;
 	health = "ok";
-	/** The last level this device asked Amazon for, and when; a step starts from it until a read is newer. */
-	lastSet = null;
-	/** When the read that produced the current media-player slice began. */
-	polledFrom = 0;
+	/** When this device last wrote its volume / Do Not Disturb optimistically; a read that began earlier must not overwrite it. */
+	volumeSetAt = 0;
+	dndSetAt = 0;
+	/** Counts this device's sets; a refused set reverts only while it is still the latest. */
+	volumeSeq = 0;
+	dndSeq = 0;
+	/** The level Amazon last took (a good set, or a read newer than every set); undefined until one is known. */
+	volumeSettled = void 0;
+	dndSettled = void 0;
 	constructor(ctx) {
 		const persisted = alexaEchoDeviceSchema.parse(ctx.persistedConfig ?? {});
 		super(ctx, alexaEchoDeviceSchema, { type: DeviceType.MediaPlayer });
@@ -144250,14 +144668,54 @@ var AlexaEchoDevice = class extends BaseDevice {
 		this.runtimeState.setCapState("media-player", emptyEchoStatus("off", 0));
 		this.runtimeState.setCapState("do-not-disturb", COLD_DND);
 		this.poll();
-		this.timer = setInterval(() => void this.poll(), ECHO_POLL_MS);
+		this.armPollTimer();
+		this.unsubscribers = [alexaEchoSessions.onEcho(this.brokerId, this.serial, () => this.onPushEvent()), alexaEchoSessions.onChannel(this.brokerId, (state) => this.onChannel(state))];
+	}
+	/** The poll pace now: slow while the push channel is up, normal when it is down. */
+	get pollIntervalMs() {
+		return alexaEchoSessions.pushChannel(this.brokerId) === "up" ? ECHO_POLL_PUSH_HEALTHY_MS : ECHO_POLL_MS;
+	}
+	armPollTimer() {
+		if (this.timer !== null) clearInterval(this.timer);
+		this.timer = setInterval(() => void this.poll(), this.pollIntervalMs);
 		this.timer.unref();
 	}
+	onChannel(state) {
+		this.armPollTimer();
+		this.ctx.logger.debug("alexa echo: push channel changed, poll pace follows", {
+			tags: { deviceId: this.id },
+			meta: {
+				channel: state,
+				pollMs: this.pollIntervalMs
+			}
+		});
+		this.poll();
+	}
+	/**
+	* Amazon pushed a change for this Echo: read it once, no sooner than the gap after the
+	* last push read. The read is the ordinary one, so the optimistic-set guard applies as
+	* it does to a poll: a read that began before a set never undoes it.
+	*/
+	onPushEvent() {
+		if (this.pushReadTimer !== null) return;
+		const wait = Math.max(0, this.lastPushReadAt + ECHO_PUSH_READ_GAP_MS - Date.now());
+		this.pushReadTimer = setTimeout(() => {
+			this.pushReadTimer = null;
+			this.lastPushReadAt = Date.now();
+			if (this.polling) this.repollAfter = true;
+			else this.poll();
+		}, wait);
+		this.pushReadTimer.unref();
+	}
 	async removeDevice() {
 		if (this.timer !== null) clearInterval(this.timer);
 		if (this.rereadTimer !== null) clearTimeout(this.rereadTimer);
+		if (this.pushReadTimer !== null) clearTimeout(this.pushReadTimer);
+		for (const off of this.unsubscribers) off();
+		this.unsubscribers = [];
 		this.timer = null;
 		this.rereadTimer = null;
+		this.pushReadTimer = null;
 		await super.removeDevice();
 	}
 	session() {
@@ -144286,8 +144744,13 @@ var AlexaEchoDevice = class extends BaseDevice {
 		} finally {
 			this.polling = false;
 		}
+		if (this.repollAfter) {
+			this.repollAfter = false;
+			await this.poll();
+		}
 	}
 	async readOnce() {
+		const readStartedAt = Date.now();
 		const session = alexaEchoSessions.get(this.brokerId);
 		if (session === null || session.state !== "ready") return;
 		if (session.rateLimitedUntil !== null) {
@@ -144303,21 +144766,21 @@ var AlexaEchoDevice = class extends BaseDevice {
 		}
 		const deviceType = this.amazonDeviceType !== "" ? this.amazonDeviceType : listed?.deviceType ?? "";
 		try {
-			const readStartedAt = Date.now();
-			const info = await session.playerState(this.serial, deviceType, this.id);
-			this.polledFrom = readStartedAt;
-			const fromPlayer = mapPlayerInfoToStatus(info, {
+			const fromPlayer = mapPlayerInfoToStatus(await session.playerState(this.serial, deviceType, this.id), {
 				online: true,
 				now: Date.now()
 			});
-			this.runtimeState.setCapState("media-player", await this.completeVolume(fromPlayer));
+			const read = await this.completeVolume(fromPlayer);
+			const kept = this.keepNewerVolume(read, readStartedAt);
+			if (kept === read) this.volumeSettled = read.volumeLevel;
+			this.runtimeState.setCapState("media-player", kept);
 			this.markOnline(true);
 			this.noteRecovered();
 		} catch (err) {
 			this.noteReadFailure(err);
 			return;
 		}
-		await this.readDoNotDisturb();
+		await this.readDoNotDisturb(readStartedAt);
 	}
 	/**
 	* An idle Echo's player read carries no volume. Ask the account's volume list
@@ -144342,10 +144805,26 @@ var AlexaEchoDevice = class extends BaseDevice {
 			return status;
 		}
 	}
-	async readDoNotDisturb() {
+	/**
+	* A read that began before this device last set its volume carries the level from
+	* before the set: keep the level the operator chose (and its mute), take the rest.
+	*/
+	keepNewerVolume(read, readStartedAt) {
+		if (this.volumeSetAt < readStartedAt) return read;
+		const current = this.runtimeState.getCapState("media-player");
+		if (current === void 0) return read;
+		return {
+			...read,
+			volumeLevel: current.volumeLevel,
+			isMuted: current.isMuted
+		};
+	}
+	async readDoNotDisturb(readStartedAt) {
 		try {
 			const enabled = (await alexaEchoSessions.dnd(this.brokerId, Date.now())).get(this.serial);
 			if (enabled === void 0) return;
+			if (this.dndSetAt >= readStartedAt) return;
+			this.dndSettled = enabled;
 			this.runtimeState.setCapState("do-not-disturb", {
 				enabled,
 				lastChangedAt: Date.now()
@@ -144377,23 +144856,56 @@ var AlexaEchoDevice = class extends BaseDevice {
 		await this.session().npCommand(this.serial, command, this.id);
 		this.rereadSoon();
 	}
+	/**
+	* The slice shows the new level at once; Amazon is told next. On a refusal the
+	* slice goes back to the level Amazon last took (a good set, else the last read,
+	* else what the slice held), with a new stamp, and the error is rethrown
+	* (RateLimitedError included) after a warning. Only the LATEST set reverts: when
+	* a newer set has superseded this one, that set owns the slice, so an earlier
+	* refusal never writes over it, and a later refusal falls back to what Amazon
+	* actually took, never to a level it did not. A cold slice (no read yet) gets no
+	* optimistic write, so no state is invented.
+	*/
 	async sendVolume(level) {
-		this.lastSet = {
-			level,
-			at: Date.now()
-		};
-		await this.session().setVolume(this.serial, level, this.id);
-		this.rereadSoon();
+		const previous = this.runtimeState.getCapState("media-player");
+		const setAt = Date.now();
+		const seq = ++this.volumeSeq;
+		this.volumeSetAt = setAt;
+		if (previous !== void 0) this.runtimeState.setCapState("media-player", {
+			...previous,
+			volumeLevel: level,
+			lastChangedAt: setAt
+		});
+		alexaEchoSessions.invalidateVolumes(this.brokerId);
+		try {
+			await this.session().setVolume(this.serial, level, this.id);
+			this.volumeSettled = level;
+		} catch (err) {
+			const back = this.volumeSettled !== void 0 ? this.volumeSettled : previous?.volumeLevel ?? null;
+			const current = this.runtimeState.getCapState("media-player");
+			if (seq === this.volumeSeq && current !== void 0) this.runtimeState.setCapState("media-player", {
+				...current,
+				volumeLevel: back,
+				lastChangedAt: Date.now()
+			});
+			this.ctx.logger.warn("alexa echo: Amazon refused the volume, back to the previous level", {
+				tags: { deviceId: this.id },
+				meta: {
+					from: back,
+					to: level,
+					superseded: seq !== this.volumeSeq,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+			throw err;
+		}
 	}
 	/**
-	* Amazon has no step command: move from the level we last SET when no read since
-	* is newer (a polled level lags the command), else the polled one; refuse when
-	* there is none.
+	* Amazon has no step command: move from the level in the slice (it already holds
+	* the last level we set); refuse when there is none.
 	*/
 	async stepVolume(delta) {
-		const polled = this.runtimeState.getCapState("media-player")?.volumeLevel;
-		const set = this.lastSet;
-		const level = set !== null && set.at >= this.polledFrom ? set.level : polled;
+		const level = this.runtimeState.getCapState("media-player")?.volumeLevel;
 		if (level === null || level === void 0) throw new Error("the Echo volume is not known yet");
 		await this.sendVolume(Math.max(0, Math.min(100, level + delta)));
 	}
@@ -144414,22 +144926,51 @@ var AlexaEchoDevice = class extends BaseDevice {
 			channelDown: async () => unsupported("channel steps"),
 			seek: async () => unsupported("seek"),
 			setMute: async () => unsupported("mute"),
-			setShuffle: async () => unsupported("shuffle"),
-			setRepeat: async () => unsupported("repeat"),
+			setShuffle: ({ shuffle }) => this.command(shuffle ? "shuffle-on" : "shuffle-off"),
+			setRepeat: async ({ repeat }) => {
+				if (repeat === "one") unsupported("repeat one");
+				await this.command(repeat === "all" ? "repeat-on" : "repeat-off");
+			},
 			selectSource: async () => unsupported("source selection"),
 			playMedia: async () => unsupported("playing media")
 		});
 	}
+	/** Optimistic like the volume, with the same rules: only the latest refused set reverts, to what Amazon last took. */
+	async sendDnd(enabled) {
+		const previous = this.runtimeState.getCapState("do-not-disturb") ?? COLD_DND;
+		const setAt = Date.now();
+		const seq = ++this.dndSeq;
+		this.dndSetAt = setAt;
+		this.runtimeState.setCapState("do-not-disturb", {
+			enabled,
+			lastChangedAt: setAt
+		});
+		alexaEchoSessions.invalidateDnd(this.brokerId);
+		try {
+			await this.session().setDnd(this.serial, enabled, this.id);
+			this.dndSettled = enabled;
+		} catch (err) {
+			const back = this.dndSettled !== void 0 ? this.dndSettled : previous.enabled;
+			if (seq === this.dndSeq) this.runtimeState.setCapState("do-not-disturb", {
+				enabled: back,
+				lastChangedAt: Date.now()
+			});
+			this.ctx.logger.warn("alexa echo: Amazon refused Do Not Disturb, back to the previous state", {
+				tags: { deviceId: this.id },
+				meta: {
+					from: back,
+					to: enabled,
+					superseded: seq !== this.dndSeq,
+					error: err instanceof Error ? err.message : String(err)
+				}
+			});
+			throw err;
+		}
+	}
 	registerDoNotDisturb() {
 		this.ctx.registerNativeCap(doNotDisturbCapability, {
 			getStatus: async () => this.runtimeState.getCapState("do-not-disturb") ?? COLD_DND,
-			setEnabled: async ({ enabled }) => {
-				await this.session().setDnd(this.serial, enabled, this.id);
-				this.runtimeState.setCapState("do-not-disturb", {
-					enabled,
-					lastChangedAt: Date.now()
-				});
-			}
+			setEnabled: async ({ enabled }) => this.sendDnd(enabled)
 		});
 	}
 };
@@ -144450,7 +144991,9 @@ var alexaSpeakSessionsEntryKind = defineEntryKind("speak-sessions", {
 	writeTrigger: "an Echo worker signs in as an Alexa account broker"
 });
 /** An Alexa integration: the link to the Alexa account (broker) it imports devices from. */
-var alexaConnectionsEntryKind = declareBrokerLinkKind({
+var alexaConnectionsEntryKind = declareLinkKind({
+	name: "connections",
+	links: { brokerId: ALEXA_ACCOUNT_LINK },
 	title: "Alexa integrations",
 	writeTrigger: "an operator links an Alexa integration to an Alexa account"
 });
@@ -144552,11 +145095,15 @@ function buildAlexaAccountInstances(records, deps) {
 * record, edited on the Brokers page). The account's sign-in and secrets are never copied here.
 */
 function buildAlexaInstances(records) {
-	return buildBrokerLinkInstances(records, {
+	return buildLinkedInstances(records, {
 		kind: alexaConnectionsEntryKind,
-		brokerKind: ALEXA_BROKER_KIND,
-		brokerLabel: "Alexa account",
-		onChanged: () => void 0
+		description: {
+			role: "devices",
+			instanceMode: "multiple",
+			kind: "connection",
+			canTest: false
+		},
+		labels: { brokerId: { label: "Alexa account" } }
 	});
 }
 //#endregion
@@ -144849,8 +145396,67 @@ var BrokerEcho = class {
 	currentDevices = [];
 	backoffMs = 0;
 	limitedUntil = 0;
+	channelState = "down";
+	channelWasUp = false;
+	secrets = [];
+	unknownPushLogged = /* @__PURE__ */ new Set();
 	constructor(deps) {
 		this.deps = deps;
+		deps.worker.onPush((push) => this.onPush(push));
+	}
+	/** Whether Amazon's push channel is open for this account right now. */
+	get pushChannel() {
+		return this.channelState;
+	}
+	/** A reason is text from the library: capped, then scrubbed of the secrets in play. */
+	safeReason(reason) {
+		return scrubSecrets(reason.slice(0, 200), this.secrets);
+	}
+	onPush(push) {
+		const tags = { tags: { brokerId: this.deps.brokerId } };
+		if (push.push === "channel") {
+			if (push.state === this.channelState) {
+				if (push.state === "down") this.deps.logger.debug("alexa echo: push channel still down", {
+					...tags,
+					meta: {
+						reason: this.safeReason(push.reason),
+						retryInMs: push.retryInMs
+					}
+				});
+				return;
+			}
+			this.channelState = push.state;
+			if (push.state === "up") {
+				this.deps.logger.info(this.channelWasUp ? "alexa echo: push channel reconnected, polling slows down" : "alexa echo: push channel connected, polling slows down", tags);
+				this.channelWasUp = true;
+			} else this.deps.logger.warn("alexa echo: push channel down, polling at the normal pace", {
+				...tags,
+				meta: {
+					reason: this.safeReason(push.reason),
+					retryInMs: push.retryInMs
+				}
+			});
+			this.deps.push?.channel(this.deps.brokerId, push.state);
+			return;
+		}
+		if (PUSH_READ_COMMANDS.has(push.command)) {
+			if (push.serial === null) {
+				this.deps.logger.debug("alexa echo: push event without an Echo, ignored", {
+					...tags,
+					meta: { command: push.command }
+				});
+				return;
+			}
+			this.deps.push?.event(this.deps.brokerId, push.serial);
+			return;
+		}
+		if (PUSH_IGNORED_COMMANDS.has(push.command)) return;
+		if (this.unknownPushLogged.has(push.command)) return;
+		this.unknownPushLogged.add(push.command);
+		this.deps.logger.info("alexa echo: unknown push event, ignored (logged once)", {
+			...tags,
+			meta: { command: push.command }
+		});
 	}
 	get id() {
 		return this.deps.brokerId;
@@ -144876,6 +145482,10 @@ var BrokerEcho = class {
 	}
 	stop() {
 		this.deps.worker.stop();
+		if (this.channelState === "up") {
+			this.channelState = "down";
+			this.deps.push?.channel(this.deps.brokerId, "down");
+		}
 	}
 	/** Sign the worker in as the broker's account. Never throws; the outcome is `state`. */
 	async signIn() {
@@ -144902,6 +145512,7 @@ var BrokerEcho = class {
 			}
 			secrets = seed === null ? [] : [seed.refreshToken];
 			worker.noteSecrets(secrets);
+			this.secrets = secrets;
 			let outcome = parseLoginResult({
 				status: "failed",
 				error: "worker gave no answer"
@@ -145138,6 +145749,13 @@ function speechFromNotification(notification) {
 }
 //#endregion
 //#region src/speak/provider.ts
+/**
+* `notification-output` provider for Echo devices. Text is the rule template
+* as plain speech. A burst collapses or waits; it is not queued. A transport
+* failure is `success: false` so the notification outbox retries. A collapse,
+* a rate limit, or Do Not Disturb is a recorded skip (`success: true`) so the
+* outbox does not speak the same sentence again later.
+*/
 function quietLogger$1() {
 	const logger = {
 		debug() {},
@@ -145193,11 +145811,8 @@ function configSchema() {
 		title: "Echo",
 		titleKey: "import-alexa:echoTarget.s_echo.title",
 		fields: [...[{
-			type: "broker-select",
-			key: "brokerId",
-			label: "Amazon account",
-			labelKey: "import-alexa:echoTarget.s_echo.brokerId.label",
-			brokerKind: ALEXA_BROKER_KIND
+			...linkFieldDescriptor("brokerId", ALEXA_ACCOUNT_LINK, { label: "Amazon account" }),
+			labelKey: "import-alexa:echoTarget.s_echo.brokerId.label"
 		}, {
 			type: "select",
 			key: "echoId",
@@ -145716,6 +146331,14 @@ function startAlexaWorker(deps) {
 	let secrets = [];
 	let pending = null;
 	const queue = [];
+	const pushListeners = [];
+	function deliverPush(push) {
+		for (const listener of pushListeners) try {
+			listener(push);
+		} catch (err) {
+			logger.warn("alexa worker push listener failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
 	function scrub(text) {
 		return scrubSecrets(text, secrets);
 	}
@@ -145793,6 +146416,12 @@ function startAlexaWorker(deps) {
 			logger.warn("alexa worker non-JSON line", { meta: { error: err instanceof Error ? err.message : String(err) } });
 			return;
 		}
+		if (typeof parsed === "object" && parsed !== null && "push" in parsed) {
+			const push = WorkerPushSchema.safeParse(parsed);
+			if (push.success) deliverPush(push.data);
+			else logger.warn("alexa worker push line failed schema", { meta: { error: push.error.message } });
+			return;
+		}
 		const checked = WorkerLineSchema.safeParse(parsed);
 		if (!checked.success) {
 			logger.warn("alexa worker line failed schema", { meta: { error: checked.error.message } });
@@ -145819,6 +146448,12 @@ function startAlexaWorker(deps) {
 	}
 	function onExit(code) {
 		child = null;
+		deliverPush({
+			push: "channel",
+			state: "down",
+			reason: "worker exited",
+			retryInMs: 0
+		});
 		if (stopped) {
 			failPending(/* @__PURE__ */ new Error("alexa worker stopped"));
 			return;
@@ -145925,6 +146560,9 @@ function startAlexaWorker(deps) {
 	}
 	return {
 		request,
+		onPush(listener) {
+			pushListeners.push(listener);
+		},
 		noteSecrets(next) {
 			secrets = [...next];
 		},
@@ -146075,7 +146713,8 @@ var AlexaSpeakController = class {
 			readSeed: () => this.host.readSeed(ref.id),
 			sessions: this.host.sessions,
 			logger: this.host.logger,
-			now: this.now
+			now: this.now,
+			...this.host.push === void 0 ? {} : { push: this.host.push }
 		}));
 		await Promise.all(refs.map(async (ref) => {
 			const echo = this.echoes.get(ref.id);
@@ -146489,7 +147128,8 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 				return entry === void 0 ? null : readBrokerSeed(entry);
 			},
 			sessions: RecordsSpeakSessionStore.of(records),
-			ensurePython: () => this.ctx.deps.ensurePython()
+			ensurePython: () => this.ctx.deps.ensurePython(),
+			push: alexaEchoSessions
 		});
 		this.speak = speak;
 		alexaEchoSessions.setResolver((brokerId) => speak.echoFor(brokerId));
@@ -146553,7 +147193,7 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 					methods: ["device-code", "proxy"]
 				}
 			},
-			provider: guardBrokerDelete(this.accountInstances.toProvider(), () => this.brokerUsers())
+			provider: guardInstanceDelete(this.accountInstances.toProvider(), () => this.brokerUsers())
 		}, {
 			kind: {
 				id: "integration",
@@ -146586,7 +147226,7 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 			return;
 		}
 		const configured = entry.connection.cookie.length > 0 || entry.connection.refreshToken.length > 0;
-		if (entry.enabled === false || !configured) {
+		if (!isInstanceEnabled(entry) || !configured) {
 			await reg.removeEntry(id);
 			this.speak?.brokersChanged();
 			return;
@@ -146678,7 +147318,7 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 			} });
 		}
 		for (const entry of persisted) {
-			if (entry.enabled === false) continue;
+			if (!isInstanceEnabled(entry)) continue;
 			if (entry.id && liveIds.has(entry.id)) {
 				if (sameConnection(entry.connection, reg.getConnection(entry.id))) continue;
 				try {
@@ -146853,7 +147493,7 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 	}
 	/** Who still points at an Alexa account: its integrations and the Echo targets that speak through it. */
 	brokerUsers() {
-		return [brokerLinkUserFinder(this.requireInstances()), { find: async (brokerId) => readEchoTargets(this.config).filter((target) => target.brokerId === brokerId).map((target) => ({
+		return [linkUserFinder(this.requireInstances(), "brokerId"), { find: async (brokerId) => readEchoTargets(this.config).filter((target) => target.brokerId === brokerId).map((target) => ({
 			kind: "notification-target",
 			id: target.id,
 			name: target.name
@@ -146884,7 +147524,7 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 			},
 			logger: this.ctx.logger,
 			getBrokerIdForIntegration: async (id) => {
-				const brokerId = await brokerIdOf(this.requireInstances(), id);
+				const brokerId = await linkedIdOf(this.requireInstances(), id, "brokerId");
 				if (brokerId === void 0) throw new Error(`integration ${id} has no broker`);
 				return brokerId;
 			},