@camstack/addon-matter-broker 0.2.154 → 0.2.156

package/dist/addon.mjs

@@ -797,7 +797,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/device-type-CfHw_quR.mjs
+//#region ../types/dist/device-type-D1fH5kaC.mjs
 /**
 import { errMsg } from '@camstack/types'
 * Extract a human-readable message from an unknown error value.
@@ -1028,6 +1028,12 @@ var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
 	DeviceFeature["MediaPlayerPrevious"] = "media-player-previous";
 	/** Media player exposes stop distinct from pause. */
 	DeviceFeature["MediaPlayerStop"] = "media-player-stop";
+	/** Media player exposes volume up / down in steps (an infrared TV has no level). */
+	DeviceFeature["MediaPlayerVolumeStep"] = "media-player-volume-step";
+	/** Media player exposes channel up / down in steps. */
+	DeviceFeature["MediaPlayerChannelStep"] = "media-player-channel-step";
+	/** Media player exposes power on / off. */
+	DeviceFeature["MediaPlayerPower"] = "media-player-power";
 	/** Alarm panel requires a PIN code on arm/disarm. */
 	DeviceFeature["AlarmPinRequired"] = "alarm-pin-required";
 	/** Presence device carries GPS coordinates (lat/lng/accuracy) in
@@ -5987,7 +5993,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-QsoHs66J.mjs
+//#region ../types/dist/sleep-BaWhXZFm.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6066,6 +6072,22 @@ function buildAlawTable() {
 }
 buildUlawTable();
 buildAlawTable();
+/**
+* An addon whose own migrations did not apply refuses to initialise (D987). The error is typed
+* so a runner hosting several addons can tell "this addon is blocked" from a crash and keep its
+* co-located siblings running. Recognised by NAME and shape, never `instanceof`: a forked addon
+* bundles its own copy of this module, so the class the runner sees is not the one that threw.
+*/
+var MIGRATIONS_BLOCKED_ERROR_NAME = "AddonMigrationsBlockedError";
+var AddonMigrationsBlockedError = class extends Error {
+	/** The ledger ids that did not apply and block the owner. */
+	migrationIds;
+	constructor(migrationIds) {
+		super(`migration(s) ${migrationIds.join(", ")} did not apply and block this addon — fix or retry them (migrations.retry), then restart it`);
+		this.name = MIGRATIONS_BLOCKED_ERROR_NAME;
+		this.migrationIds = migrationIds;
+	}
+};
 /** Is this field's stored value a credential? */
 function isSecretConfigField(field) {
 	if (field.type === "password") return true;
@@ -6119,9 +6141,16 @@ function isSecretMarker(value) {
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
+/** Anything carrying a `$secret` key — a stored marker or a UI view of one. */
+function isSecretMarkerLike(value) {
+	return isRecord$7(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
+}
 function isSecretClear(value) {
 	return isRecord$7(value) && value["$secretClear"] === true;
 }
+function isSecretFieldView(value) {
+	return isRecord$7(value) && value["set"] === true && isSecretMarkerLike(value);
+}
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
 * plaintext becomes "set (inline)", nothing becomes `null`. A value never
@@ -6503,6 +6532,53 @@ function emitReadiness(bus, params) {
 		ts
 	}));
 }
+/** Why a catalogue entry is not a runnable body of its declared kind. */
+var AddonMigrationDefinitionError = class extends Error {
+	id;
+	constructor(id, message) {
+		super(`${id}: ${message}`);
+		this.id = id;
+		this.name = "AddonMigrationDefinitionError";
+	}
+};
+/**
+* Bind a catalogue to the addon's ports. Throws {@link AddonMigrationDefinitionError} when
+* an entry's `bodyKind` does not match the body it carries, or is `sql` (a hub-only
+* body). A throwing body never escapes `execute`: it is reported as a failed result.
+*/
+function defineAddonMigrations(catalogue, ports) {
+	return catalogue.map((entry) => {
+		const { meta } = entry;
+		if ("plan" in entry) {
+			if (meta.bodyKind !== "plan") throw new AddonMigrationDefinitionError(meta.id, `carries a plan body but declares "${meta.bodyKind}"`);
+			return {
+				meta,
+				execute: () => guarded(async () => ({
+					kind: "plan",
+					plan: await entry.plan(ports)
+				}))
+			};
+		}
+		if (meta.bodyKind !== "procedure") throw new AddonMigrationDefinitionError(meta.id, `carries a procedure body but declares "${meta.bodyKind}"`);
+		return {
+			meta,
+			execute: () => guarded(async () => ({
+				kind: "procedure",
+				result: await entry.procedure(ports)
+			}))
+		};
+	});
+}
+async function guarded(work) {
+	try {
+		return await work();
+	} catch (err) {
+		return {
+			kind: "failed",
+			error: errMsg(err)
+		};
+	}
+}
 var NOT_RUN = {
 	declared: false,
 	snapshot: null,
@@ -6724,11 +6800,36 @@ function projectStore(store, perNodeKeys, nodeId) {
 	}
 	return out;
 }
+/**
+* The address of one keychain value: `secret://<owner>/<scope>/<fieldPath>`.
+*
+* A ref is DETERMINISTIC from where the value lives — the owner addon, the
+* scope (global, one node, one device, one integration, one row of a business
+* collection) and the field path inside that scope — so saving the same field
+* twice updates the same ref, and the ref itself says which settings blob
+* points at it. It is also the AAD of the value's ciphertext: a ciphertext
+* copied onto another ref does not decrypt.
+*
+* Array items are addressed by ITEM ID, never by index
+* (`providers[authentik].clientSecret`), so reordering a list keeps every ref.
+*
+* Pure and browser-safe: no node builtins, no I/O.
+*/
+/** The URI scheme of every keychain ref. */
+var SECRET_REF_SCHEME = "secret://";
 var GLOBAL_SCOPE = { kind: "global" };
 /** The scope every addon-wide (not per-node, not per-device) setting lives in. */
 function globalSecretScope() {
 	return GLOBAL_SCOPE;
 }
+/**
+* An addon id as a ref owner. A hub in-process builtin's context id is
+* `addon:<id>`; the owner of its secrets is `<id>`, exactly as for the same
+* addon running forked.
+*/
+function normalizeSecretOwner(addonId) {
+	return addonId.startsWith("addon:") ? addonId.slice(6) : addonId;
+}
 function encodeSegment(value) {
 	return encodeURIComponent(value);
 }
@@ -6739,6 +6840,16 @@ function decodeSegment(value) {
 		return null;
 	}
 }
+/** The scope as it appears inside a ref (`global`, `node/<id>`, …). */
+function formatSecretScope(scope) {
+	switch (scope.kind) {
+		case "global": return "global";
+		case "node": return `node/${encodeSegment(scope.nodeId)}`;
+		case "device": return `device/${scope.deviceId}`;
+		case "integration": return `integration/${encodeSegment(scope.integrationId)}`;
+		case "row": return `row/${encodeSegment(scope.collection)}/${encodeSegment(scope.rowId)}`;
+	}
+}
 /**
 * The field path of a value inside an array item, addressed by the item's id:
 * `arrayItemFieldPath('providers', 'authentik', 'clientSecret')` →
@@ -6747,6 +6858,13 @@ function decodeSegment(value) {
 function arrayItemFieldPath(arrayKey, itemId, fieldKey) {
 	return `${arrayKey}[${encodeSegment(itemId)}].${fieldKey}`;
 }
+/** Build a ref. Throws on an empty owner or field path — both are bugs. */
+function buildSecretRef(parts) {
+	const owner = normalizeSecretOwner(parts.owner);
+	if (owner.length === 0) throw new Error("buildSecretRef: owner is empty");
+	if (parts.fieldPath.length === 0) throw new Error("buildSecretRef: fieldPath is empty");
+	return `${SECRET_REF_SCHEME}${encodeSegment(owner)}/${formatSecretScope(parts.scope)}/${parts.fieldPath}`;
+}
 function parseScope(segments) {
 	switch (segments[0]) {
 		case "global": return {
@@ -7672,7 +7790,7 @@ var BaseAddon = class {
 			startMigration: (input) => api.startMigration.mutate(input),
 			finishMigration: (input) => api.finishMigration.mutate(input)
 		}, migrations, this.ctx.logger);
-		if (report.blockOwner.length > 0) throw new Error(`migration(s) ${report.blockOwner.join(", ")} did not apply and block this addon — fix or retry them (migrations.retry), then restart it`);
+		if (report.blockOwner.length > 0) throw new AddonMigrationsBlockedError(report.blockOwner);
 		return report;
 	}
 	/**
@@ -8012,6 +8130,10 @@ var BaseAddon = class {
 		const stored = keychain ? await this.readAddonStoreWithRetry() : {};
 		const patch = {};
 		for (const key of keys) {
+			if (tree.get(key)?.kind === "array") {
+				patch[key] = [];
+				continue;
+			}
 			const keychainStored = tree.has(key) || collectSecretMarkerRefs(stored[key]).length > 0;
 			patch[key] = keychain && keychainStored ? SECRET_CLEAR : "";
 		}
@@ -8700,11 +8822,17 @@ var RECORD_BATCH_MAX = 1e3;
 var RECORD_QUERY_MAX = 1e3;
 /** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
 var RECORD_SETTINGS_MAX_ROWS = 5e4;
+/** The `Column`-free proof prefix: a ref collection for a kind's secret fields. */
+var RECORD_SECRET_COLLECTION_PREFIX = "records:";
 /**
 * Secret fields of a record, addressed the way a Zod schema declares them
 * (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
 * (`auth.accessToken`, `headers[].value`).
 *
+* `{}` after a key means "each value of this map" (`applianceSecrets{}`): the map's own key
+* names the value (`applianceSecrets{fridge}`), so no id key is declared and a body that drops a
+* key releases exactly that key's secret.
+*
 * Array elements are matched by a DECLARED id key (`secretArrayKeys`:
 * `{ headers: 'name' }`), never by index, so reordering a list keeps every
 * keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
@@ -8717,11 +8845,13 @@ function parseSecretPath(path) {
 	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
 	return path.split(".").map((raw) => {
 		const each = raw.endsWith("[]");
-		const key = each ? raw.slice(0, -2) : raw;
+		const map = raw.endsWith("{}");
+		const key = each || map ? raw.slice(0, -2) : raw;
 		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
 		return {
 			key,
-			each
+			each,
+			map
 		};
 	});
 }
@@ -8736,6 +8866,128 @@ function secretArrayPrefixes(path) {
 	}
 	return prefixes;
 }
+function isRecord$4$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function elementId(element, idKey, declared, prefix) {
+	const id = isRecord$4$1(element) ? element[idKey] : void 0;
+	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
+	return id;
+}
+/**
+* Visit every secret leaf PRESENT in `data` (an absent branch has nothing to
+* visit). `replace` returns the new leaf value, or {@link REMOVE_LEAF}; the
+* result is a new body, `data` is untouched.
+*/
+var REMOVE_LEAF = Symbol("remove-leaf");
+function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
+	if (!isRecord$4$1(node)) return node;
+	const segment = segments[index];
+	if (segment === void 0) return node;
+	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
+	const child = node[segment.key];
+	const keys = [...walkedKeys, segment.key];
+	const last = index === segments.length - 1;
+	if (segment.each) {
+		if (!Array.isArray(child)) return node;
+		const prefix = keys.join(".");
+		const idKey = arrayKeys[prefix];
+		if (idKey === void 0) throw new InvalidRecordError(`"${declared}": no id key declared for the array "${prefix}"`);
+		const mapped = child.map((element) => {
+			const id = elementId(element, idKey, declared, prefix);
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}[${encodeURIComponent(id)}]`;
+			return last ? element : mapAt(element, segments, index + 1, keys, concrete, declared, arrayKeys, visit);
+		});
+		return {
+			...node,
+			[segment.key]: mapped
+		};
+	}
+	if (segment.map) {
+		if (!isRecord$4$1(child)) return node;
+		const kept = Object.entries(child).map(([mapKey, value]) => {
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}{${encodeURIComponent(mapKey)}}`;
+			if (!last) return [mapKey, mapAt(value, segments, index + 1, keys, concrete, declared, arrayKeys, visit)];
+			return [mapKey, visit({
+				declared,
+				concrete,
+				value
+			})];
+		}).filter(([, value]) => value !== REMOVE_LEAF);
+		return {
+			...node,
+			[segment.key]: Object.fromEntries(kept)
+		};
+	}
+	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
+	if (last) {
+		const replacement = visit({
+			declared,
+			concrete,
+			value: child
+		});
+		if (replacement === REMOVE_LEAF) return Object.fromEntries(Object.entries(node).filter(([key]) => key !== segment.key));
+		return {
+			...node,
+			[segment.key]: replacement
+		};
+	}
+	return {
+		...node,
+		[segment.key]: mapAt(child, segments, index + 1, keys, concrete, declared, arrayKeys, visit)
+	};
+}
+/** Replace/remove every present secret leaf; returns a NEW body. */
+function mapSecretLeaves(data, paths, arrayKeys, visit) {
+	let current = data;
+	for (const declared of paths) current = mapAt(current, parseSecretPath(declared), 0, [], "", declared, arrayKeys, visit);
+	return current;
+}
+/**
+* The keychain collection name a kind's secrets live under. Prefixed so a
+* record's refs never collide with the refs a legacy collection of the same name
+* already holds during an adoption.
+*/
+function recordSecretCollection(kind) {
+	return `${RECORD_SECRET_COLLECTION_PREFIX}${kind}`;
+}
+/** The ONE ref a row's secret field may carry: the engine and the facade both build it here. */
+function recordSecretRef(owner, kind, rowId, concretePath) {
+	return buildSecretRef({
+		owner,
+		scope: {
+			kind: "row",
+			collection: recordSecretCollection(kind),
+			rowId
+		},
+		fieldPath: concretePath
+	});
+}
+/**
+* A stored secret, as an admin read shows it: a VIEW naming the row's own
+* keychain ref (`set: true`), never the value and no longer the bare redaction
+* token. The form hands it to the secret field, which reveals the value by ref
+* through the audited `keychain-admin.reveal`; sent back untouched it keeps the
+* stored secret (the records door reads a view as KEEP).
+*
+* ONE implementation for the entries service and for every addon that serves
+* its own instances (`RecordIntegrationInstances`).
+*/
+function isRecord$3$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function secretViewsOf(owner, kind, id, decl, data) {
+	if (decl.secretPaths.length === 0) return data;
+	const shown = mapSecretLeaves(data, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
+		if (leaf.value !== "__camstack_redacted__") return leaf.value;
+		return {
+			$secret: recordSecretRef(owner, kind, id, leaf.concrete),
+			v: 1,
+			set: true
+		};
+	});
+	return isRecord$3$1(shown) ? shown : data;
+}
 /**
 * The share-view scope kinds a share-link token can carry. The hub mints
 * and validates them (`ShareViewGrantSchema` builds its
@@ -8808,7 +9060,8 @@ function isZodSecret(schema) {
 }
 /**
 * Every declared secret path in a config schema: dotted keys, `[]` for "each
-* element of this array" (`connection.password`, `rows[].token`). A declared
+* element of this array" (`connection.password`, `rows[].token`), `{}` for "each value of this
+* map" (`applianceSecrets{}`). A declared
 * object or array is reported as one path and not descended into — everything
 * under it is secret.
 */
@@ -8819,6 +9072,7 @@ function collectZodSecretPaths(schema, prefix = "") {
 		const def = defOf(layer);
 		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
 		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "record" && def.valueType) paths.push(...collectZodSecretPaths(def.valueType, `${prefix}{}`));
 		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
 		else if (def.type === "intersection") {
 			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
@@ -8958,7 +9212,7 @@ function defineRecordKinds(specs) {
 			retention: spec.retention,
 			deviceRemoval: spec.deviceRemoval,
 			maxDataBytes: spec.maxDataBytes,
-			secretPaths: [...secretPaths],
+			secretPaths: [...new Set([...secretPaths, ...spec.retiredSecretPaths ?? []])],
 			secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
 			transactFamily: spec.transactFamily,
 			entry: spec.entry === void 0 ? void 0 : {
@@ -9003,6 +9257,7 @@ function defineEntryKind(name, spec) {
 		...spec.database === void 0 ? {} : { database: spec.database },
 		...spec.indexes === void 0 ? {} : { indexes: spec.indexes },
 		...spec.secretArrayKeys === void 0 ? {} : { secretArrayKeys: spec.secretArrayKeys },
+		...spec.retiredSecretPaths === void 0 ? {} : { retiredSecretPaths: spec.retiredSecretPaths },
 		entry: {
 			title: spec.title,
 			...spec.nameField === void 0 ? {} : { nameField: spec.nameField }
@@ -9667,6 +9922,7 @@ var CAP_NAMES = Object.freeze([
 	"backup",
 	"battery",
 	"binary",
+	"board-key-source",
 	"brightness",
 	"broker",
 	"button",
@@ -9788,6 +10044,7 @@ var CAP_NAMES = Object.freeze([
 	"privacy-mask",
 	"ptz",
 	"ptz-autotrack",
+	"pump-cycle",
 	"reboot",
 	"record-entries",
 	"recording",
@@ -11080,18 +11337,6 @@ Object.freeze({
 			"path": "pumpRunning",
 			"valueType": "boolean"
 		},
-		{
-			"path": "pumpIntervalEnabled",
-			"valueType": "boolean"
-		},
-		{
-			"path": "pumpOnTime",
-			"valueType": "number"
-		},
-		{
-			"path": "pumpOffTime",
-			"valueType": "number"
-		},
 		{
 			"path": "lastDrink",
 			"valueType": "number"
@@ -11215,6 +11460,20 @@ Object.freeze({
 			"valueType": "number"
 		}
 	],
+	"pump-cycle": [
+		{
+			"path": "enabled",
+			"valueType": "boolean"
+		},
+		{
+			"path": "onTime",
+			"valueType": "number"
+		},
+		{
+			"path": "offTime",
+			"valueType": "number"
+		}
+	],
 	"recording-archive": [
 		{
 			"path": "deviceId",
@@ -11664,7 +11923,7 @@ object({
 	params: record(string$2(), union([string$2(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/composition-Dh3RfMx5.mjs
+//#region ../types/dist/composition-CRNwcFYY.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -12427,38 +12686,6 @@ function validateExpressionSource(src) {
 	return null;
 }
 /**
-* One power reading becomes a washer, dryer or dishwasher (D944 helper).
-*
-* Standby of the control board is under 5 W; a motor or a heater is far
-* above that, so 5 W is the line. A door lock or a short pump spike is not
-* a cycle, so running starts only after 30 s above the line.
-*
-* A wash, dry or dishwasher pause (soak, heat-wait, heater off between
-* bursts) lasts several minutes. Ending the cycle on the first dip would
-* report "finished" in the middle of the program, so the stop dwell is
-* 10 minutes on every type. The number is stored per type so one machine
-* can move later without moving the others.
-*/
-var APPLIANCE_TEMPLATE_ID = "appliance";
-var APPLIANCE_KINDS = [
-	"washer",
-	"dryer",
-	"dishwasher"
-];
-DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher;
-/**
-* A dumb plug-in stove or heater, built from a smart plug (a `Heater`).
-*
-* The plug is the actuator: `switch.setState` is a FORWARD to the plug's own
-* (D967), so the heater switches exactly as the plug does. Running is the
-* plug being on; when a power reading is also named, running is the draw
-* staying above the line instead (a plug left on with the stove's own
-* thermostat open is not heating). 50 W is far above any standby and below
-* the smallest radiator.
-*/
-var HEATER_TEMPLATE_ID = "heater";
-DeviceType.Heater;
-/**
 * Statistics and integrals over a history read (D944).
 *
 * Pure: the same points always give the same answer, so a restart recomputes
@@ -12602,34 +12829,6 @@ var HelperSpecSchema = discriminatedUnion("kind", [
 		/** Actuator groups only. Readings leave this unset. */
 		active: ActiveCriterionSchema.optional()
 	}),
-	object({
-		kind: literal("appliance"),
-		templateId: literal(APPLIANCE_TEMPLATE_ID),
-		appliance: _enum(APPLIANCE_KINDS),
-		thresholdWatts: number().positive(),
-		startDwellMs: number().int().nonnegative(),
-		stopDwellMs: number().int().nonnegative(),
-		member: HelperMemberSchema,
-		/**
-		* The plug that powers the appliance (`switch.on`). Optional: when set, the
-		* composition carries a `power-source` feature, so the hub can cut and restore
-		* that plug (power-source link of a NEW-target composition).
-		*/
-		powerSwitch: HelperMemberSchema.optional(),
-		/** How long a forced restart keeps the plug off; the cap's default when unset. */
-		offSeconds: number().optional()
-	}),
-	object({
-		kind: literal("heater"),
-		templateId: literal(HEATER_TEMPLATE_ID),
-		/** The plug, read and commanded at `switch.on`. */
-		plug: HelperMemberSchema,
-		/** The plug's power reading, when it has one: running is then the draw, not the switch. */
-		meter: HelperMemberSchema.optional(),
-		thresholdWatts: number().positive(),
-		startDwellMs: number().int().nonnegative(),
-		stopDwellMs: number().int().nonnegative()
-	}),
 	object({
 		kind: literal("statistic"),
 		stat: _enum(STATISTIC_STATS),
@@ -12801,7 +13000,14 @@ var CompositionForwardCommandSchema = object({
 	method: string$2().min(1),
 	args: record(string$2().min(1), CompositionForwardArgSchema).optional()
 });
-var CompositionCommandTargetSchema = discriminatedUnion("kind", [CompositionForwardCommandSchema, CompositionCodeSourceSchema]);
+var CompositionCommandTargetSchema = discriminatedUnion("kind", [
+	CompositionForwardCommandSchema,
+	CompositionCodeSourceSchema,
+	object({
+		kind: literal("extension"),
+		target: literal("remote")
+	})
+]);
 /** An item key inside an item-array cap (`consumables.items[<key>]`). */
 var COMPOSITION_ITEM_KEY_RE = /^[a-z0-9][a-z0-9-]{0,47}$/;
 /**
@@ -12846,7 +13052,7 @@ var CompositionSchema = object({
 		kind: literal("existing"),
 		device: CompositionSourceRefSchema
 	})]),
-	features: array(CompositionFeatureSchema).min(1).max(16),
+	features: array(CompositionFeatureSchema).min(0).max(16),
 	/**
 	* Present when the block is a helper template. Absent on a free
 	* composition (the room example, device 4603). The editor reads this,
@@ -12878,6 +13084,73 @@ var NodeColorIdSchema = _enum([
 	"node-g",
 	"node-h"
 ]);
+//#endregion
+//#region ../types/dist/index.mjs
+var SMTP_INBOUND_DEFAULT_PORT = 2525;
+var SMTP_INBOUND_DEFAULT_DOMAIN = "camstack.local";
+var SMTP_INBOUND_DEFAULT_MAX_MESSAGE_BYTES = 25 * 1024 * 1024;
+/** The text excerpt a message carries on the bus. */
+var SMTP_INBOUND_TEXT_MAX_CHARS = 4096;
+var PortSchema = number().int().min(1).max(65535);
+/** A recipient local-part: what stands before the `@`. */
+var SmtpRecipientSchema = string$2().min(1).max(64).regex(/^[A-Za-z0-9._+-]+$/);
+object({
+	port: PortSchema.default(SMTP_INBOUND_DEFAULT_PORT),
+	bindHost: string$2().min(1).default("0.0.0.0"),
+	domain: string$2().min(1).default(SMTP_INBOUND_DEFAULT_DOMAIN),
+	requireAuth: boolean().default(true),
+	username: string$2().default(""),
+	password: string$2().default("").meta({ secret: true }),
+	starttls: boolean().default(false),
+	maxMessageBytes: number().int().positive().default(SMTP_INBOUND_DEFAULT_MAX_MESSAGE_BYTES)
+});
+object({
+	host: string$2().min(1).nullable(),
+	hostReason: string$2().nullable(),
+	port: PortSchema,
+	domain: string$2().min(1),
+	requireAuth: boolean(),
+	username: string$2(),
+	password: string$2(),
+	starttls: boolean()
+});
+object({
+	recipients: array(SmtpRecipientSchema).min(1),
+	/**
+	* Who is subscribing. A second `subscribe` with the same id REPLACES that subscriber's
+	* recipients (the way a consumer that restarted, or lost a device, declares its set again);
+	* a recipient held by another subscriber is refused with `smtp-inbound/recipient-claimed`.
+	* Absent, the subscriber is anonymous and unique.
+	*/
+	subscriberId: string$2().min(1).max(64).optional()
+});
+var SmtpInboundAttachmentSchema = object({
+	filename: string$2(),
+	contentType: string$2(),
+	bytes: number().int().nonnegative()
+});
+/** The payload of one `broker.message` (the key is the recipient local-part). */
+var SmtpInboundMessageSchema = object({
+	/** Monotonic per mailbox; a gap tells a consumer it missed an event. */
+	seq: number().int().positive(),
+	messageId: string$2(),
+	receivedAt: number().int().nonnegative(),
+	from: string$2(),
+	to: string$2(),
+	subject: string$2(),
+	text: string$2().max(SMTP_INBOUND_TEXT_MAX_CHARS),
+	attachments: array(SmtpInboundAttachmentSchema)
+});
+object({
+	/** The newest seq issued so far (0 before any mail). */
+	lastSeq: number().int().nonnegative(),
+	/** The oldest seq still retained; messages below it are gone. */
+	oldestSeq: number().int().nonnegative(),
+	messages: array(object({
+		key: string$2(),
+		message: SmtpInboundMessageSchema
+	}))
+});
 new Set([
 	"track",
 	"face",
@@ -12997,6 +13270,205 @@ var IntegrationInstanceRefSchema = object({
 	]),
 	candidateStableId: string$2().optional()
 });
+/**
+* `RecordIntegrationInstances` - the `integration-instances` provider over ONE
+* entry kind, so an addon that holds a connection serves it in ~30 lines.
+*
+* Every instance is one record of the addon's own kind, keyed by the
+* `integrations` registry id. The records door does the secret work: a field the
+* kind marks `.meta({ secret: true })` is a keychain marker bound to the row, so
+* deleting the row deletes the secret, and one row's value is never another's.
+*
+* Patch rules for a secret (`updateInstance`): omitted, `''`, the redaction
+* token or the view the form was given KEEP the stored secret;
+* `{ $secretClear: true }` clears it; any other string replaces it.
+*/
+/** The most instances one addon lists (an integrations page, not a table). */
+var INSTANCES_LIST_MAX = 1e3;
+/** The keys of the kind's secret fields that sit at the top level of the body. */
+function topLevelSecretKeys(paths) {
+	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[") && !p.includes("{")));
+}
+/** The keys of the kind's top-level MAPS whose values are secrets (`applianceSecrets{}`). */
+function secretMapKeys(paths) {
+	return new Set(paths.filter((p) => p.endsWith("{}") && !p.slice(0, -2).match(/[.[{]/)).map((p) => p.slice(0, -2)));
+}
+/**
+* A patch value for a map of secrets: an entry that is omitted, `''`, the redaction token or the
+* view the form was given KEEPS its stored secret (it is left out of the merge); `{ $secretClear }`
+* or `null` removes the entry; any other string replaces it. Null when nothing is left to merge.
+*/
+function secretMapPatch(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) if (entry === null || isSecretClear(entry)) out[key] = null;
+	else if (typeof entry === "string" && entry !== "" && entry !== "__camstack_redacted__" && !isSecretFieldView(entry)) out[key] = entry;
+	return Object.keys(out).length > 0 ? out : null;
+}
+/** Does the kind's body schema carry an `enabled` field? */
+function declaresEnabled(kind) {
+	const json = toJSONSchema(kind.schema, {
+		unrepresentable: "any",
+		io: "input"
+	});
+	const properties = Reflect.get(json, "properties");
+	return typeof properties === "object" && properties !== null && "enabled" in properties;
+}
+var RecordIntegrationInstances = class {
+	records;
+	kind;
+	hooks;
+	handle;
+	secretKeys;
+	secretMaps;
+	nameField;
+	/** The `integrations` registry owns the on/off switch (`role: devices`); the body has none. */
+	registryOwnsEnabled;
+	constructor(records, kind, hooks) {
+		this.records = records;
+		this.kind = kind;
+		this.hooks = hooks;
+		this.handle = records.kind(kind);
+		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
+		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
+		this.nameField = kind.declaration.entry?.nameField ?? "name";
+		this.registryOwnsEnabled = hooks.description.role === "devices";
+		if (this.registryOwnsEnabled && declaresEnabled(kind)) throw new Error(`kind "${kind.name}": the integrations registry owns the on/off switch of a role "devices" addon, so the body must not declare "enabled"`);
+	}
+	/**
+	* One instance read for the addon's own runtime; null when absent. When the keychain is
+	* locked the row is served WITHOUT its secrets and says so (`secrets: 'unavailable'`), so the
+	* caller can keep what it had instead of reconfiguring with an empty secret (D49).
+	*/
+	async readResolved(id) {
+		try {
+			const record = await this.handle.getResolved(id);
+			return record === null ? null : {
+				id,
+				body: record.data,
+				enabled: record.data.enabled !== false,
+				secrets: "resolved"
+			};
+		} catch (err) {
+			if (!(err instanceof RecordSecretUnavailableError)) throw err;
+			const stored = await this.handle.get(id);
+			if (stored === null) return null;
+			return {
+				id,
+				body: Object.fromEntries(Object.entries(stored.data).filter(([key]) => !this.secretKeys.has(key))),
+				enabled: stored.data.enabled !== false,
+				secrets: "unavailable"
+			};
+		}
+	}
+	/** The body of {@link readResolved} alone; a locked keychain yields the row without secrets. */
+	async getResolved(id) {
+		return (await this.readResolved(id))?.body ?? null;
+	}
+	/** Every instance, secrets resolved where the keychain allows; an absent one is skipped. */
+	async listResolved() {
+		const page = await this.handle.query({ limit: INSTANCES_LIST_MAX });
+		const out = [];
+		for (const record of page.records) {
+			const read = await this.readResolved(record.id);
+			if (read !== null) out.push(read);
+		}
+		return out;
+	}
+	viewOf(record) {
+		const shown = secretViewsOf(this.records.owner, this.kind.name, record.id, this.kind.declaration, record.data);
+		const rawName = record.data[this.nameField];
+		const kind = this.hooks.kindOf?.(record.data);
+		const health = this.hooks.health?.(record.data, record.id);
+		return {
+			id: record.id,
+			name: typeof rawName === "string" ? rawName : record.id,
+			configured: this.hooks.configured(record.data),
+			...this.registryOwnsEnabled ? {} : { enabled: record.data.enabled !== false },
+			formValues: shown,
+			...kind !== void 0 ? { kind } : {},
+			...health?.status !== void 0 ? { status: health.status } : {},
+			...health?.lastCheckedAt !== void 0 ? { lastCheckedAt: health.lastCheckedAt } : {}
+		};
+	}
+	describe = async () => this.hooks.mintId === void 0 ? this.hooks.description : {
+		...this.hooks.description,
+		mintsId: true
+	};
+	instanceFormSchema = async ({ id }) => this.hooks.formSchema(id);
+	listInstances = async () => {
+		return (await this.handle.query({ limit: INSTANCES_LIST_MAX })).records.map((record) => this.viewOf(record));
+	};
+	getInstance = async ({ id }) => {
+		const record = await this.handle.get(id);
+		return record === null ? null : this.viewOf(record);
+	};
+	/** Insert ONE row (`ifRev: 0`: an existing id is refused, never overwritten). */
+	createInstance = async ({ id, name, kind }) => {
+		const minted = id ?? this.hooks.mintId?.({
+			name,
+			...kind !== void 0 ? { kind } : {}
+		});
+		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
+		await this.handle.put({
+			id: minted,
+			data: this.hooks.initialBody(name, kind)
+		}, { ifRev: 0 });
+		await this.hooks.onChanged?.(minted, "created");
+		return { id: minted };
+	};
+	updateInstance = async ({ id, name, values }) => {
+		const patch = {};
+		for (const [key, value] of Object.entries(values)) {
+			if (value === void 0) continue;
+			if (this.secretMaps.has(key)) {
+				const entries = secretMapPatch(value);
+				if (entries !== null) patch[key] = entries;
+			} else if (!this.secretKeys.has(key)) patch[key] = value;
+			else if (isSecretClear(value)) patch[key] = null;
+			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
+		}
+		if (name !== void 0) patch[this.nameField] = name;
+		await this.handle.patch(id, patch);
+		await this.hooks.onChanged?.(id, "updated");
+		return { ok: true };
+	};
+	/** The switch lives in the record body; the addon is told so it applies it (D996). */
+	setInstanceEnabled = async ({ id, enabled }) => {
+		if (this.registryOwnsEnabled) throw new Error(`instance "${id}": the integrations registry owns the on/off switch of this addon; set it with integrations.update`);
+		await this.handle.patch(id, { enabled });
+		await this.hooks.onChanged?.(id, "enabled");
+		return { ok: true };
+	};
+	/** The row and its keychain refs go together (the records door). */
+	deleteInstance = async ({ id }) => {
+		await this.handle.delete(id);
+		await this.hooks.onChanged?.(id, "deleted");
+		return { ok: true };
+	};
+	testInstance = async (input) => {
+		if (this.hooks.test === void 0) return {
+			success: false,
+			status: "unsupported",
+			error: "This integration declares no connection test"
+		};
+		return this.hooks.test(input);
+	};
+	/** The flat provider object to hand to `registerProvider`. */
+	toProvider() {
+		return {
+			describe: this.describe,
+			instanceFormSchema: this.instanceFormSchema,
+			listInstances: this.listInstances,
+			getInstance: this.getInstance,
+			createInstance: this.createInstance,
+			updateInstance: this.updateInstance,
+			setInstanceEnabled: this.setInstanceEnabled,
+			deleteInstance: this.deleteInstance,
+			testInstance: this.testInstance
+		};
+	}
+};
 var EncodeProfileSchema = object({
 	video: object({
 		codec: _enum([
@@ -14065,6 +14537,58 @@ var MigrationOwnerStepSchema = object({
 	/** The ledger state the engine found: `pending` has no row yet. */
 	state: union([literal("pending"), MigrationStatusSchema])
 });
+function isPlain(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function flattenNestedRecords(ports, spec) {
+	const ids = await ports.listNested(spec.legacyKey);
+	if (ids.length === 0) return {
+		outcome: "already-done",
+		summary: { converted: 0 }
+	};
+	const rows = /* @__PURE__ */ new Map();
+	for (const id of ids) try {
+		rows.set(id, await ports.readResolved(id));
+	} catch (err) {
+		const why = err instanceof Error ? err.message : String(err);
+		throw new Error(`record '${id}': cannot be read with its secrets (${why}) - nothing moved`);
+	}
+	for (const [id, row] of rows) {
+		const legacy = row[spec.legacyKey];
+		if (!isPlain(legacy)) throw new Error(`record '${id}': '${spec.legacyKey}' is not an object - nothing moved`);
+		const flat = spec.toFlat(legacy, row);
+		await ports.patch(id, flat);
+		const back = await ports.readResolved(id);
+		const wrong = spec.flatSecretKeys.filter((key) => {
+			const sent = flat[key];
+			const got = back[key];
+			return (typeof sent === "string" ? sent : "") !== (typeof got === "string" ? got : "");
+		});
+		if (wrong.length > 0) {
+			await ports.patch(id, Object.fromEntries(Object.keys(flat).map((key) => [key, null])));
+			throw new Error(`record '${id}': ${wrong.join(", ")} did not read back from its new home - the row is unchanged`);
+		}
+		await ports.patch(id, { [spec.legacyKey]: null });
+	}
+	return {
+		outcome: "done",
+		summary: { converted: rows.size }
+	};
+}
+/** The ports over one kind's records handle. */
+function flattenPortsOver(handle) {
+	return {
+		listNested: async (legacyKey) => (await handle.query({ limit: 1e3 })).records.filter((r) => legacyKey in r.data).map((r) => r.id),
+		readResolved: async (id) => {
+			const row = await handle.getResolved(id);
+			if (row === null) throw new Error("the record is gone");
+			return row.data;
+		},
+		patch: async (id, patch) => {
+			await handle.patch(id, patch);
+		}
+	};
+}
 /**
 * The trainer contract — what the hub hands the cloud trainer and what it
 * gets back (cloud training, D805+).
@@ -19150,24 +19674,52 @@ var APPLIANCE_CAP_VOCABULARY = {
 				args: { on: false }
 			},
 			{
-				id: "petFountain.intervalOn",
-				method: "setPumpInterval",
+				id: "petFountain.resetDailyConsumption",
+				method: "resetDailyConsumption",
+				label: t("Clear daily consumption", "Azzera il consumo giornaliero"),
+				phrase: t("Clear the daily water consumption of {device}", "Azzera il consumo giornaliero di acqua di {device}"),
+				icon: "rotate-ccw"
+			}
+		],
+		state: [{
+			kind: "boolean",
+			field: "empty",
+			label: t("Tank empty", "Serbatoio vuoto"),
+			whenTrue: t("When the tank of {device} is empty", "Quando il serbatoio di {device} è vuoto"),
+			whenFalse: t("When the tank of {device} is refilled", "Quando il serbatoio di {device} viene riempito"),
+			icon: "droplet"
+		}, {
+			kind: "numeric",
+			field: "waterLevel",
+			quantity: t("the water level", "il livello dell’acqua"),
+			label: t("Water level", "Livello dell’acqua"),
+			unit: "%",
+			icon: "droplets"
+		}]
+	},
+	"pump-cycle": {
+		scope: "device",
+		noun: t("Pump cycle", "Ciclo della pompa"),
+		actions: [
+			{
+				id: "pumpCycle.on",
+				method: "setEnabled",
 				label: t("Pump cycle on", "Ciclo pompa attivo"),
 				phrase: t("Run the pump of {device} on its on/off cycle", "Fai lavorare la pompa di {device} a ciclo acceso/spento"),
 				icon: "timer",
 				args: { on: true }
 			},
 			{
-				id: "petFountain.intervalOff",
-				method: "setPumpInterval",
+				id: "pumpCycle.off",
+				method: "setEnabled",
 				label: t("Pump cycle off", "Ciclo pompa spento"),
 				phrase: t("Run the pump of {device} continuously", "Fai lavorare la pompa di {device} in continuo"),
 				icon: "timer-off",
 				args: { on: false }
 			},
 			{
-				id: "petFountain.pumpOnMinutes",
-				method: "setPumpOnMinutes",
+				id: "pumpCycle.onMinutes",
+				method: "setOnMinutes",
 				label: t("Set pump run time", "Imposta il tempo di lavoro della pompa"),
 				phrase: t("Set the pump of {device} to run {minutes} minutes per cycle", "Imposta la pompa di {device} a lavorare {minutes} minuti per ciclo"),
 				icon: "timer",
@@ -19183,8 +19735,8 @@ var APPLIANCE_CAP_VOCABULARY = {
 				}]
 			},
 			{
-				id: "petFountain.pumpOffMinutes",
-				method: "setPumpOffMinutes",
+				id: "pumpCycle.offMinutes",
+				method: "setOffMinutes",
 				label: t("Set pump rest time", "Imposta il tempo di riposo della pompa"),
 				phrase: t("Set the pump of {device} to rest {minutes} minutes per cycle", "Imposta la pompa di {device} a riposare {minutes} minuti per ciclo"),
 				icon: "timer-off",
@@ -19198,35 +19750,63 @@ var APPLIANCE_CAP_VOCABULARY = {
 						unit: "min"
 					}
 				}]
-			},
-			{
-				id: "petFountain.resetDailyConsumption",
-				method: "resetDailyConsumption",
-				label: t("Clear daily consumption", "Azzera il consumo giornaliero"),
-				phrase: t("Clear the daily water consumption of {device}", "Azzera il consumo giornaliero di acqua di {device}"),
-				icon: "rotate-ccw"
 			}
 		],
 		state: [{
 			kind: "boolean",
-			field: "empty",
-			label: t("Tank empty", "Serbatoio vuoto"),
-			whenTrue: t("When the tank of {device} is empty", "Quando il serbatoio di {device} è vuoto"),
-			whenFalse: t("When the tank of {device} is refilled", "Quando il serbatoio di {device} viene riempito"),
-			icon: "droplet"
-		}, {
-			kind: "numeric",
-			field: "waterLevel",
-			quantity: t("the water level", "il livello dell’acqua"),
-			label: t("Water level", "Livello dell’acqua"),
-			unit: "%",
-			icon: "droplets"
+			field: "enabled",
+			label: t("Pump cycle", "Ciclo pompa"),
+			whenTrue: t("When {device} starts running its pump on a cycle", "Quando {device} inizia a far lavorare la pompa a ciclo"),
+			whenFalse: t("When {device} runs its pump continuously", "Quando {device} fa lavorare la pompa in continuo"),
+			icon: "timer"
 		}]
 	},
 	"media-player": {
 		scope: "device",
 		noun: t("Media player", "Lettore multimediale"),
 		actions: [
+			{
+				id: "media.turnOn",
+				method: "turnOn",
+				label: t("Turn on", "Accendi"),
+				phrase: t("Turn on {device}", "Accendi {device}"),
+				icon: "power"
+			},
+			{
+				id: "media.turnOff",
+				method: "turnOff",
+				label: t("Turn off", "Spegni"),
+				phrase: t("Turn off {device}", "Spegni {device}"),
+				icon: "power"
+			},
+			{
+				id: "media.volumeUp",
+				method: "volumeUp",
+				label: t("Volume up", "Alza il volume"),
+				phrase: t("Raise the volume of {device}", "Alza il volume di {device}"),
+				icon: "volume-2"
+			},
+			{
+				id: "media.volumeDown",
+				method: "volumeDown",
+				label: t("Volume down", "Abbassa il volume"),
+				phrase: t("Lower the volume of {device}", "Abbassa il volume di {device}"),
+				icon: "volume-2"
+			},
+			{
+				id: "media.channelUp",
+				method: "channelUp",
+				label: t("Channel up", "Canale successivo"),
+				phrase: t("Go to the next channel on {device}", "Passa al canale successivo su {device}"),
+				icon: "skip-forward"
+			},
+			{
+				id: "media.channelDown",
+				method: "channelDown",
+				label: t("Channel down", "Canale precedente"),
+				phrase: t("Go to the previous channel on {device}", "Torna al canale precedente su {device}"),
+				icon: "skip-back"
+			},
 			{
 				id: "media.play",
 				method: "play",
@@ -21113,6 +21693,7 @@ var SYSTEM_CAP_VOCABULARY = {
 	"audio-analyzer": system(PIPELINE),
 	"audio-codec": system(INTERNAL$1),
 	"auth-provider": system(IDENTITY),
+	"board-key-source": system(INTERNAL$1),
 	backup: system("system backups — run and restored from the Backups page"),
 	broker: system("message-broker connections — configured, not actuated"),
 	"calendar-source": system(INTERNAL$1),
@@ -46022,6 +46603,49 @@ var binaryCapability = {
 	volatileStateFields: ["lastChangedAt"]
 };
 /**
+* Why a board key could not be read. Typed so a caller reports the cause and
+* never treats "could not read" as "has no key" (D49).
+*/
+var BoardKeyFailureReasonSchema = _enum([
+	"unknown-source",
+	"not-admin",
+	"no-builder",
+	"no-ingress-url",
+	"unreachable",
+	"unknown-board",
+	"no-encryption-key",
+	"unreadable-config"
+]);
+var BoardKeySourceSchema = object({
+	sourceId: string$2(),
+	name: string$2()
+});
+var BoardKeyBoardSchema = object({
+	/** The builder's file name, e.g. `kitchen.yaml`: the handle `getBoardKey` takes. */
+	configuration: string$2(),
+	/** The node name the builder gives the board. */
+	name: string$2(),
+	/** The address the builder knows the board by, when it has one. */
+	address: string$2().nullable()
+});
+var BoardKeyFailureSchema = object({
+	ok: literal(false),
+	reason: BoardKeyFailureReasonSchema,
+	detail: string$2().optional()
+});
+var ListBoardsResultSchema = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	boards: array(BoardKeyBoardSchema).readonly()
+}), BoardKeyFailureSchema]);
+var GetBoardKeyResultSchema = discriminatedUnion("ok", [object({
+	ok: literal(true),
+	key: string$2()
+}), BoardKeyFailureSchema]);
+method(_void(), array(BoardKeySourceSchema).readonly(), { auth: "admin" }), method(object({ sourceId: string$2().min(1) }), ListBoardsResultSchema, { auth: "admin" }), method(object({
+	sourceId: string$2().min(1),
+	configuration: string$2().min(1)
+}), GetBoardKeyResultSchema, { auth: "admin" });
+/**
 * Dimmable-light brightness control. Co-exists with `switch` on the
 * same device — the switch toggles on/off, this cap sets the level
 * applied when the light is on. Drivers map their per-vendor dim
@@ -48769,6 +49393,244 @@ var controlCapability = {
 	*/
 	history: "none"
 };
+/**
+* Media-player cap. Models HA `media_player.*` (Sonos, Chromecast,
+* Apple TV, Spotify, Roku, generic OTT receivers, …) on
+* `DeviceType.MediaPlayer`. Disjoint from the camera streaming
+* surface — those use `DeviceType.Camera` + the broker pipeline.
+*
+* The cap declares a wide method surface; not every backend supports
+* every method. Drivers signal sub-capability via the
+* `DeviceFeature.MediaPlayerXxx` flags (paired one-to-one with the
+* corresponding method) so the UI gates buttons without a slice
+* fetch — same pattern as `PanTiltZoom` for cameras.
+*/
+var MediaPlayerStateSchema = _enum([
+	"off",
+	"on",
+	"idle",
+	"playing",
+	"paused",
+	"buffering",
+	"standby"
+]);
+var MediaPlayerRepeatSchema = _enum([
+	"off",
+	"all",
+	"one"
+]);
+var MediaInfoSchema = object({
+	/** Free-form media kind (`music`, `tvshow`, `movie`, `app`, `channel`,
+	*  `podcast`, …). */
+	type: string$2(),
+	/** Human-readable title. */
+	title: string$2(),
+	/** Optional artist / channel / station label. */
+	artist: string$2().optional(),
+	/** Optional album / season / show name. */
+	album: string$2().optional(),
+	/** Optional cover-art / thumbnail URL. */
+	imageUrl: string$2().optional()
+});
+/**
+* Where `state`, `volumeLevel`, `isMuted` and `source` come from. `reported`:
+* the device said so. `assumed`: the driver has no feedback (infrared) and
+* tracks what it last SENT; it moves only after a send was accepted, and a
+* human at the real remote makes it wrong. A UI shows an assumed value as a
+* guess, never as a reading.
+*/
+var MediaPlayerStateSourceSchema = _enum(["reported", "assumed"]);
+/** The fields of a media-player status a driver can only guess. */
+var MediaPlayerAssumedFieldSchema = _enum([
+	"state",
+	"volumeLevel",
+	"isMuted",
+	"source"
+]);
+var MediaPlayerStatusSchema = object({
+	/** Playback lifecycle state. */
+	state: MediaPlayerStateSchema,
+	/**
+	* Whether the state fields are readings or the driver's own bookkeeping.
+	* A slice written before this field existed parses as `reported`.
+	*/
+	stateSource: MediaPlayerStateSourceSchema.default("reported"),
+	/**
+	* Which fields are the driver's own guess. `stateSource` is `assumed` when
+	* this is not empty; a field not listed here is a reading even then (power
+	* from a running-state source, mute guessed from the last send).
+	*/
+	assumedFields: array(MediaPlayerAssumedFieldSchema).default([]),
+	/** Volume as 0..100 inclusive. Null when the device has no volume
+	*  surface. Pair with `DeviceFeature.MediaPlayerVolume`. */
+	volumeLevel: number().min(0).max(100).nullable().meta(readingMeta("percentage")),
+	/** Mute toggle distinct from volume=0. Null when no mute surface.
+	*  Pair with `DeviceFeature.MediaPlayerMute`. */
+	isMuted: boolean().nullable(),
+	/** Active source / input. Empty when no source surface. */
+	source: string$2(),
+	/** Selectable sources. Empty when no source surface.
+	*  Pair with `DeviceFeature.MediaPlayerSelectSource`. */
+	availableSources: array(string$2()),
+	/** Currently-playing media info. Null when nothing is playing. */
+	currentMedia: MediaInfoSchema.nullable(),
+	/** Current playback position in ms. Null when not seekable or
+	*  nothing is playing. Pair with `DeviceFeature.MediaPlayerSeek`. */
+	position: number().int().nonnegative().nullable().meta(readingMeta("duration-ms")),
+	/** Total duration of the current media in ms. Null when unknown
+	*  (live stream) or nothing is playing. */
+	duration: number().int().nonnegative().nullable().meta(readingMeta("duration-ms")),
+	/** Shuffle toggle. Null when no shuffle surface.
+	*  Pair with `DeviceFeature.MediaPlayerShuffle`. */
+	shuffle: boolean().nullable(),
+	/** Repeat mode. Null when no repeat surface.
+	*  Pair with `DeviceFeature.MediaPlayerRepeat`. */
+	repeat: MediaPlayerRepeatSchema.nullable(),
+	/** Ms epoch when the slice was last updated. */
+	lastChangedAt: number()
+});
+var stepInput = object({
+	deviceId: number().int().nonnegative(),
+	/** How many presses: the caller's count (Alexa `volumeSteps`, `channelCount`). */
+	steps: number().int().min(1).max(50).default(1)
+});
+var deviceOnly = object({ deviceId: number().int().nonnegative() });
+var mediaPlayerCapability = {
+	name: "media-player",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.MediaPlayer],
+	methods: {
+		turnOn: method(deviceOnly, _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		turnOff: method(deviceOnly, _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		volumeUp: method(stepInput, _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		volumeDown: method(stepInput, _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		channelUp: method(stepInput, _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		channelDown: method(stepInput, _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		play: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		pause: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		stop: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		next: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		previous: method(object({ deviceId: number().int().nonnegative() }), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		seek: method(object({
+			deviceId: number().int().nonnegative(),
+			position: number().int().nonnegative()
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		setVolume: method(object({
+			deviceId: number().int().nonnegative(),
+			volumeLevel: number().min(0).max(100)
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		setMute: method(object({
+			deviceId: number().int().nonnegative(),
+			muted: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		setShuffle: method(object({
+			deviceId: number().int().nonnegative(),
+			shuffle: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		setRepeat: method(object({
+			deviceId: number().int().nonnegative(),
+			repeat: MediaPlayerRepeatSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		selectSource: method(object({
+			deviceId: number().int().nonnegative(),
+			source: string$2().min(1)
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		playMedia: method(object({
+			deviceId: number().int().nonnegative(),
+			/** Media identifier / URL. */
+			mediaId: string$2().min(1),
+			/** Media kind (`music`, `tvshow`, `movie`, `app`, …) — provider
+			*  passes it through to the upstream service. */
+			mediaType: string$2().min(1)
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		})
+	},
+	status: {
+		schema: MediaPlayerStatusSchema,
+		kind: "push"
+	},
+	/**
+	* Runtime-state slice — mirrored by the kernel. UI players read the
+	* full slice for live now-playing, volume, and progress updates
+	* without polling.
+	*/
+	runtimeState: MediaPlayerStatusSchema,
+	/**
+	* Runtime-state durability: **session** — a restored transport position describes a playback that stopped when the hub did.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
+	/**
+	* History (D850): volume (a level an operator or an automation sets; the
+	* default 10 s floor folds a slider drag into its end value) and mute.
+	* `position` is not recorded: it moves continuously while playing.
+	*/
+	history: { fields: {
+		volumeLevel: {
+			kind: "gauge",
+			unit: "%",
+			deadband: 1
+		},
+		isMuted: { kind: "boolean" }
+	} }
+};
 DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.EventEmitter, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.PetFountain, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Heater, DeviceType.Dryer, DeviceType.Gateway, DeviceType.Camera, DeviceType.Fan, DeviceType.Lock, DeviceType.Camera, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Gateway, DeviceType.Hub, DeviceType.Camera, DeviceType.Sensor, DeviceType.MediaPlayer, DeviceType.Vacuum, DeviceType.Generic, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.PetFountain, DeviceType.Fan, DeviceType.Humidifier, DeviceType.Climate, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder, DeviceType.Heater;
 var NUMBER = {
 	kind: "fixed",
@@ -49216,117 +50078,6 @@ function actuator(input) {
 	};
 }
 new Map(GROUP_TEMPLATES.map((template) => [template.id, template]));
-var PowerSourceRefusalReasonSchema = _enum([
-	"no-power-source",
-	"switch-missing",
-	"switch-offline",
-	"switch-unknown",
-	"restart-in-progress",
-	"switch-call-failed"
-]);
-var PowerSourceActionResultSchema = discriminatedUnion("accepted", [object({ accepted: literal(true) }), object({
-	accepted: literal(false),
-	reason: PowerSourceRefusalReasonSchema,
-	/** One line for the operator, naming the switch. */
-	message: string$2()
-})]);
-var PowerSourceInfoSchema = object({
-	/** False when the device has no power source linked; the rest is then empty. */
-	linked: boolean(),
-	switchDeviceId: number().nullable(),
-	switchName: string$2().nullable(),
-	/** The switch's on/off state, or null when it is unknown. Never false for unknown (D393). */
-	switchOn: boolean().nullable(),
-	switchOnline: boolean().nullable(),
-	restartInProgress: boolean(),
-	offSeconds: number().int()
-});
-/** The composed slice: the switch state the link mirrors, plus the stored off time. */
-var PowerSourceStateSchema = object({
-	/** Null while the switch has not reported: unknown is never `false` (D393). */
-	switchOn: boolean().nullable(),
-	offSeconds: number().int(),
-	lastFetchedAt: number()
-});
-var POWER_SOURCE_DEVICE_TYPES = [
-	DeviceType.Gateway,
-	DeviceType.Hub,
-	DeviceType.Camera,
-	DeviceType.Sensor,
-	DeviceType.MediaPlayer,
-	DeviceType.Vacuum,
-	DeviceType.Generic,
-	DeviceType.Washer,
-	DeviceType.Dryer,
-	DeviceType.Dishwasher,
-	DeviceType.PetFountain,
-	DeviceType.Fan,
-	DeviceType.Humidifier,
-	DeviceType.Climate,
-	DeviceType.WaterHeater
-];
-var powerSourceCustomize = {
-	version: 1,
-	targets: [{
-		id: "switch",
-		cardinality: "scalar",
-		vocabulary: {
-			cap: "power-source",
-			stateField: "switchOn"
-		},
-		deviceTypes: POWER_SOURCE_DEVICE_TYPES,
-		apply: "add",
-		path: "switchOn",
-		sources: [{
-			kind: "switch",
-			transforms: [{ kind: "identity" }]
-		}],
-		companions: [{
-			kind: "constant",
-			path: "offSeconds",
-			value: 10,
-			when: "add"
-		}, {
-			kind: "clock",
-			path: "lastFetchedAt",
-			when: "always"
-		}],
-		sourceReport: { status: "assignment-status" }
-	}]
-};
-var deviceInput$2 = object({ deviceId: number().int().nonnegative() });
-var powerSourceCapability = {
-	name: "power-source",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: POWER_SOURCE_DEVICE_TYPES,
-	methods: {
-		getStatus: systemMethod(deviceInput$2, PowerSourceInfoSchema, { auth: "admin" }),
-		powerOn: systemMethod(deviceInput$2, PowerSourceActionResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		powerOff: systemMethod(deviceInput$2, PowerSourceActionResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		forceRestart: systemMethod(deviceInput$2, PowerSourceActionResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		})
-	},
-	runtimeState: PowerSourceStateSchema,
-	customize: powerSourceCustomize,
-	/**
-	* Runtime-state durability: **session** — mirrored from the linked switch on
-	* its next report; a restored value would outlive the reading it names.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "session",
-	history: "none"
-};
 DeviceFeature.LightColorRgb, DeviceFeature.LightColorHsv, DeviceFeature.LightColorMired;
 DeviceType.Camera;
 `${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
@@ -49354,6 +50105,165 @@ var ComposableCapabilitiesSchema = object({ caps: array(object({
 	}).optional()
 })) });
 /**
+* A saved Customize assignment (D936). The schema is the type: callers use
+* `z.infer`, they do not restate the shape.
+*/
+var OverrideSourceSchema = object({
+	addonId: string$2().min(1),
+	stableId: string$2().min(1),
+	cap: string$2().min(1),
+	fieldPath: string$2().min(1)
+});
+var IdentityTransformDraftSchema = object({ kind: literal("identity") });
+var InvertTransformDraftSchema = object({ kind: literal("invert") });
+var ThresholdTransformDraftSchema = object({
+	kind: literal("threshold"),
+	comparison: _enum(["gte", "lte"]),
+	threshold: number(),
+	startDwellMs: number().nonnegative(),
+	stopDwellMs: number().nonnegative()
+});
+var CustomizeTransformDraftSchema = discriminatedUnion("kind", [
+	IdentityTransformDraftSchema,
+	InvertTransformDraftSchema,
+	ThresholdTransformDraftSchema,
+	object({
+		kind: literal("linear"),
+		scale: number(),
+		offset: number(),
+		clampMin: number().optional(),
+		clampMax: number().optional()
+	}),
+	object({
+		kind: literal("enum-map"),
+		mapping: record(string$2(), string$2().nullable())
+	}),
+	object({ kind: literal("number") })
+]);
+var ScalarOverrideDraftSchema = object({
+	kind: literal("scalar"),
+	cap: string$2().min(1),
+	targetId: string$2().min(1),
+	source: OverrideSourceSchema,
+	transform: CustomizeTransformDraftSchema
+});
+var KeyedArrayOverrideDraftSchema = object({
+	kind: literal("keyedArray"),
+	cap: string$2().min(1),
+	targetId: string$2().min(1),
+	key: string$2().min(1),
+	label: string$2().min(1),
+	fieldPath: string$2().min(1),
+	source: OverrideSourceSchema,
+	transform: CustomizeTransformDraftSchema
+});
+var PulseOverrideDraftSchema = object({
+	kind: literal("pulse"),
+	cap: string$2().min(1),
+	targetId: string$2().min(1),
+	enabled: boolean(),
+	debounceMs: number().nonnegative(),
+	edges: array(_enum([
+		"rising",
+		"button",
+		"native-event"
+	])).min(1).optional(),
+	sources: array(OverrideSourceSchema).min(1)
+});
+var SpanSourceDraftSchema = OverrideSourceSchema.extend({ mode: _enum([
+	"in-addition",
+	"confirm",
+	"replace"
+]).optional() });
+discriminatedUnion("kind", [
+	ScalarOverrideDraftSchema,
+	KeyedArrayOverrideDraftSchema,
+	PulseOverrideDraftSchema,
+	object({
+		kind: literal("span"),
+		cap: string$2().min(1),
+		targetId: string$2().min(1),
+		timeoutMs: number().nonnegative(),
+		cooldownMs: number().nonnegative().optional(),
+		sources: array(SpanSourceDraftSchema)
+	})
+]);
+object({
+	targetId: string$2().min(1),
+	configured: boolean(),
+	source: _enum(["native", "assigned"]),
+	state: _enum([
+		"active",
+		"stale",
+		"released",
+		"unavailable"
+	]),
+	reason: string$2().nullable()
+});
+/**
+* What a running-threshold proposal says (planning#405). The schema is the
+* type: the algorithm, the capability method and the UI all read `z.infer`.
+*
+* A proposal is read-only advice: it carries the numbers it was derived from
+* (`evidence`) so the operator can judge it, and an `insufficient` answer names
+* WHY with a typed reason and the catalog defaults, never an invented number.
+*/
+var RunningProposalTierSchema = _enum(["raw", "5m"]);
+var RunningProposalConfidenceSchema = _enum([
+	"high",
+	"medium",
+	"low"
+]);
+var RunningProposalInsufficientReasonSchema = _enum([
+	"no-history",
+	"span-too-short",
+	"truncated",
+	"no-idle-floor",
+	"no-runs",
+	"no-separation"
+]);
+var RunningProposalReplaySchema = object({
+	/** Intervals the real dwell expression held true over the window. */
+	intervals: number().int().nonnegative(),
+	/** Intervals outside every run, or a second interval inside one. */
+	extra: number().int().nonnegative(),
+	/** Runs without an interval of their own (none, or merged into a neighbour). */
+	missed: number().int().nonnegative()
+});
+var RunningProposalEvidenceSchema = object({
+	tier: RunningProposalTierSchema,
+	spanMs: number().nonnegative(),
+	from: number(),
+	to: number(),
+	points: number().int().nonnegative(),
+	runsFound: number().int().nonnegative(),
+	pausesFound: number().int().nonnegative(),
+	longestPauseMs: number().nonnegative(),
+	idleFloorW: number(),
+	noiseCeilingW: number(),
+	plateauW: number(),
+	replay: RunningProposalReplaySchema
+});
+var RunningProposalInsufficientEvidenceSchema = object({
+	spanMs: number().nonnegative(),
+	points: number().int().nonnegative(),
+	runsFound: number().int().nonnegative()
+});
+var RunningThresholdProposalSchema = discriminatedUnion("state", [object({
+	state: literal("proposal"),
+	transform: ThresholdTransformDraftSchema,
+	evidence: RunningProposalEvidenceSchema,
+	confidence: RunningProposalConfidenceSchema,
+	/** Why the confidence is not higher; empty when nothing held it back. */
+	notes: array(string$2())
+}), object({
+	state: literal("insufficient"),
+	reason: RunningProposalInsufficientReasonSchema,
+	evidence: RunningProposalInsufficientEvidenceSchema,
+	/** The catalog defaults, offered as what stands when nothing better is known. */
+	fallback: ThresholdTransformDraftSchema
+})]);
+/**
 * The report of a one-shot "move this owner's plaintext secrets into the
 * keychain" run (D878). COUNTS only - never a value, never a ref.
 *
@@ -49643,6 +50553,14 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 	kind: "mutation",
 	auth: "admin",
 	access: "view"
+}), method(object({
+	deviceId: number().int(),
+	cap: string$2().min(1),
+	fieldPath: string$2().min(1),
+	deviceType: _enum(DeviceType).optional()
+}), RunningThresholdProposalSchema, {
+	auth: "admin",
+	access: "view"
 }), method(object({
 	blockId: string$2().min(1),
 	trace: AutomationRunTraceSchema.optional(),
@@ -50598,7 +51516,27 @@ method(object({
 * exposes only the COMMON surface: link state, supported device
 * kinds (so the UI can filter the device picker), and per-device
 * expose/unexpose.
-*/
+*
+* INSTANCES. One export addon can serve several independent targets (a
+* HomeKit bridge, a Home Assistant broker). `listInstances` names them.
+* `instanceId` on a READ is optional: absent = the whole addon (linked if any
+* enabled instance is, `exposedDeviceCount` = distinct devices, `setup` = the
+* default instance's); present = that instance; an id the provider does not
+* serve is refused with `ExportInstanceUnknownError` (`export-instance-unknown`),
+* never answered empty. `instanceId` on a WRITE is REQUIRED: a membership
+* change always names the target it changes. A single-instance provider
+* accepts an absent id on a read or its own id, and refuses any other.
+*/
+/** Which instance of an export addon a call addresses. Absent on a read = the whole addon. */
+var InstanceIdSchema$1 = string$2().min(1);
+var InstancePinSchema = object({ instanceId: InstanceIdSchema$1.optional() });
+/** One independent export target of an addon. */
+var ExportInstanceSchema = object({
+	instanceId: InstanceIdSchema$1,
+	name: string$2(),
+	enabled: boolean(),
+	kind: string$2().optional()
+});
 var LinkStateSchema = _enum([
 	"unlinked",
 	"linked",
@@ -50649,10 +51587,14 @@ var ExposedDeviceSchema = object({
 	capabilities: array(string$2()).optional()
 });
 var ExposeInputSchema = object({
+	instanceId: InstanceIdSchema$1,
 	deviceId: string$2(),
 	capabilities: array(string$2()).optional()
 });
-var UnexposeInputSchema = object({ deviceId: string$2() });
+var UnexposeInputSchema = object({
+	instanceId: InstanceIdSchema$1,
+	deviceId: string$2()
+});
 /**
 * What an exporter may expose besides devices (D968). An action and a
 * notification target are LIST ENTRIES, never devices (D954): they enter an
@@ -50681,15 +51623,21 @@ var ExposedEntitySchema = object({
 	entity: ExportEntityRefSchema,
 	exposedAs: string$2().optional()
 });
-var ExposeEntityInputSchema = object({ entity: ExportEntityRefSchema });
-var UnexposeEntityInputSchema = object({ entity: ExportEntityRefSchema });
-method(_void(), DeviceExportStatusSchema), method(_void(), array(DeviceKindSchema)), method(_void(), array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), {
+var ExposeEntityInputSchema = object({
+	instanceId: InstanceIdSchema$1,
+	entity: ExportEntityRefSchema
+});
+var UnexposeEntityInputSchema = object({
+	instanceId: InstanceIdSchema$1,
+	entity: ExportEntityRefSchema
+});
+method(InstancePinSchema, DeviceExportStatusSchema), method(_void(), array(ExportInstanceSchema)), method(InstancePinSchema, array(DeviceKindSchema)), method(InstancePinSchema, array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(UnexposeInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), optionalMethod(_void(), array(ExportEntityKindSchema)), optionalMethod(_void(), array(ExposedEntitySchema)), optionalMethod(ExposeEntityInputSchema, _void(), {
+}), optionalMethod(_void(), array(ExportEntityKindSchema)), optionalMethod(InstancePinSchema, array(ExposedEntitySchema)), optionalMethod(ExposeEntityInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), optionalMethod(UnexposeEntityInputSchema, _void(), {
@@ -52691,7 +53639,7 @@ var DishwasherStatusSchema = object({
 	/** Ms epoch of the last value received from the appliance; 0 = never. */
 	lastFetchedAt: number()
 });
-var DeviceIdSchema$1 = number().int().nonnegative();
+var DeviceIdSchema$2 = number().int().nonnegative();
 /** A value a program option or setting can take. */
 var DishwasherValueSchema = union([
 	boolean(),
@@ -52766,77 +53714,77 @@ var dishwasherCapability = {
 		* option feature keys; each is checked against the program's constraints.
 		*/
 		start: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			program: string$2().min(1).optional(),
 			options: record(string$2(), DishwasherValueSchema).optional()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		pause: method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
+		pause: method(object({ deviceId: DeviceIdSchema$2 }), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		resume: method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
+		resume: method(object({ deviceId: DeviceIdSchema$2 }), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		stop: method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
+		stop: method(object({ deviceId: DeviceIdSchema$2 }), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		/** Select (not start) a program; refused when the appliance does not offer it. */
 		setProgram: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			program: string$2().min(1)
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setPower: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setHalfLoad: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setHygienePlus: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setExtraDry: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setIntensiveZone: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setVarioSpeedPlus: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
 		setChildLock: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
@@ -52848,7 +53796,7 @@ var dishwasherCapability = {
 		* its declared range / members.
 		*/
 		setOption: method(object({
-			deviceId: DeviceIdSchema$1,
+			deviceId: DeviceIdSchema$2,
 			key: string$2().min(1),
 			value: DishwasherValueSchema
 		}), _void(), {
@@ -52856,7 +53804,7 @@ var dishwasherCapability = {
 			auth: "protected"
 		}),
 		/** What this appliance can do, from its own description — the UI is derived from it. */
-		getOptions: method(object({ deviceId: DeviceIdSchema$1 }), DishwasherOptionsSchema, { auth: "protected" })
+		getOptions: method(object({ deviceId: DeviceIdSchema$2 }), DishwasherOptionsSchema, { auth: "protected" })
 	},
 	status: {
 		schema: DishwasherStatusSchema,
@@ -54280,15 +55228,15 @@ var FanPresetCaptureResultSchema = object({
 	items: array(FanCaptureItemSchema),
 	omitted: array(FanCaptureOmissionSchema)
 });
-var deviceInput$1 = object({ deviceId: number().int().nonnegative() });
+var deviceInput$2 = object({ deviceId: number().int().nonnegative() });
 DeviceType.Fan;
-method(deviceInput$1, array(FanPresetSchema), { auth: "protected" }), method(deviceInput$1.extend({ presets: array(FanPresetSchema).max(12) }), FanPresetsSetResultSchema, {
+method(deviceInput$2, array(FanPresetSchema), { auth: "protected" }), method(deviceInput$2.extend({ presets: array(FanPresetSchema).max(12) }), FanPresetsSetResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(deviceInput$1.extend({ presetId: string$2().min(1) }), FanPresetApplyResultSchema, {
+}), method(deviceInput$2.extend({ presetId: string$2().min(1) }), FanPresetApplyResultSchema, {
 	kind: "mutation",
 	auth: "protected"
-}), method(deviceInput$1.extend({
+}), method(deviceInput$2.extend({
 	fields: array(FanCaptureFieldSchema).optional(),
 	steps: array(ActionStepSchema).max(20).default([])
 }), FanPresetCaptureResultSchema, { auth: "protected" });
@@ -55199,13 +56147,65 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string$2
 */
 var ConfigSchemaPassthrough$3 = custom();
 var IntegrationInstanceIdSchema = string$2().min(1);
+var IntegrationInstanceModeSchema = _enum(["single", "multiple"]);
+/**
+* One kind of instance a provider can create (an adapter, an account type). The sign-in and
+* connect fields follow the `broker` contract (`broker.cap.ts`): `signIn.basePath` is a
+* hub-relative route set speaking the sign-in contract, `connectPath` / `disconnectPath` open an
+* interactive account link (popup) and may carry `{{brokerId}}`, which the UI replaces with the
+* instance id.
+*/
+var IntegrationInstanceKindSchema = object({
+	/** Stable id of the kind, sent back as `createInstance.kind`. */
+	id: string$2().min(1),
+	label: string$2().min(1),
+	/** The kind signs in through a server-held interactive session. */
+	signIn: object({
+		basePath: string$2().min(1),
+		methods: array(_enum(["device-code", "proxy"])).optional()
+	}).optional(),
+	/** Relative hub path to start an interactive account link of an instance of this kind. */
+	connectPath: string$2().min(1).optional(),
+	/** Relative hub path to disconnect that account. */
+	disconnectPath: string$2().min(1).optional()
+});
 var IntegrationInstanceDescriptionSchema = object({
+	/** What the instances are for the Integrations page; see {@link IntegrationInstanceRoleSchema}. */
+	role: _enum([
+		"devices",
+		"services",
+		"both"
+	]),
+	/** How the devices of an instance are found; absent means `{ mode: 'none' }`. */
+	discovery: object({
+		mode: _enum([
+			"none",
+			"lan",
+			"account"
+		]),
+		scopedToInstance: boolean()
+	}).optional(),
 	/** `single`: at most one instance can exist (Loki). `multiple`: an account each. */
-	instanceMode: _enum(["single", "multiple"]),
+	instanceMode: IntegrationInstanceModeSchema,
 	/** What the instance is, for the UI (`destination`, `relay`, `account`). */
 	kind: string$2(),
 	/** True when `testInstance` really probes the remote. */
-	canTest: boolean()
+	canTest: boolean(),
+	/**
+	* The kinds an instance can be of. Absent or one entry: nothing to choose; more than one: the
+	* Add flow asks which first and sends it as `createInstance.kind`.
+	*/
+	kinds: array(IntegrationInstanceKindSchema).optional(),
+	/**
+	* The provider accepts `createInstance.id` for an id that once existed (an adopted id, because
+	* devices carry it). The UI then offers "restore under its old id" on Add. Absent means no.
+	*/
+	allowRestoreId: boolean().optional(),
+	/**
+	* `createInstance` without an `id` works: the provider mints it. Absent means the caller must
+	* send an id (the UI then mints an opaque one).
+	*/
+	mintsId: boolean().optional()
 });
 var IntegrationInstanceStatusSchema = object({
 	state: _enum([
@@ -55214,16 +56214,28 @@ var IntegrationInstanceStatusSchema = object({
 		"error",
 		"unknown"
 	]),
-	detail: string$2().optional()
+	detail: string$2().optional(),
+	/** A short human word for the state ("Signed in", "Token expired"); shown instead of `state`. */
+	label: string$2().optional()
 });
 var IntegrationInstanceSchema = object({
 	id: IntegrationInstanceIdSchema,
 	name: string$2(),
 	/** The addon's own rule (an URL is present, a client id is present...). */
 	configured: boolean(),
+	/**
+	* The instance's own on/off switch (D996), derived from the record body (`enabled !== false`,
+	* so a row written before the field existed is on). Absent when the `integrations` registry
+	* owns the switch (`describe().role` is `devices`): read it from the registry row.
+	*/
+	enabled: boolean().optional(),
+	/** The kind of this instance (one of `describe().kinds[].id`), when the provider has kinds. */
+	kind: string$2().optional(),
 	/** Values for the instance form; a secret is a `SecretFieldView`, never text. */
 	formValues: record(string$2(), unknown()),
-	status: IntegrationInstanceStatusSchema.optional()
+	status: IntegrationInstanceStatusSchema.optional(),
+	/** Epoch ms of the last probe of the remote that produced `status`; absent when never checked. */
+	lastCheckedAt: number().optional()
 });
 var IntegrationInstancePatchSchema = object({
 	id: IntegrationInstanceIdSchema,
@@ -55231,25 +56243,57 @@ var IntegrationInstancePatchSchema = object({
 	/** Omitted / '' / redaction token keeps a secret; `{ $secretClear: true }` clears it. */
 	values: record(string$2(), unknown())
 });
-method(_void(), IntegrationInstanceDescriptionSchema, { auth: "admin" }), method(object({ id: IntegrationInstanceIdSchema.nullable() }), ConfigSchemaPassthrough$3, { auth: "admin" }), method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }), method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }), method(object({
-	id: IntegrationInstanceIdSchema,
-	name: string$2().min(1)
-}), object({ id: string$2() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(IntegrationInstancePatchSchema, object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ id: IntegrationInstanceIdSchema }), object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), optionalMethod(object({
-	id: IntegrationInstanceIdSchema.nullable(),
-	values: record(string$2(), unknown())
-}), TestConnectionResultSchema$1, {
-	kind: "mutation",
-	auth: "admin"
-});
+var integrationInstancesCapability = {
+	name: "integration-instances",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		describe: method(_void(), IntegrationInstanceDescriptionSchema, { auth: "admin" }),
+		/** The form; `id: null` is the create form. */
+		instanceFormSchema: method(object({ id: IntegrationInstanceIdSchema.nullable() }), ConfigSchemaPassthrough$3, { auth: "admin" }),
+		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
+		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
+		/**
+		* Insert the typed record. With `id` it is stored under that id (a duplicate id is refused);
+		* without one the PROVIDER mints it and answers it. `kind` picks one of `describe().kinds`.
+		*/
+		createInstance: method(object({
+			id: IntegrationInstanceIdSchema.optional(),
+			name: string$2().min(1),
+			kind: string$2().min(1).optional()
+		}), object({ id: string$2() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateInstance: method(IntegrationInstancePatchSchema, object({ ok: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Switch ONE instance on or off. A row control, not a form field: `updateInstance.values` is the
+		* form patch (D62, D996). An off instance keeps its record and secrets and does no work.
+		*/
+		setInstanceEnabled: method(object({
+			id: IntegrationInstanceIdSchema,
+			enabled: boolean()
+		}), object({ ok: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Delete the record and its keychain refs together. */
+		deleteInstance: method(object({ id: IntegrationInstanceIdSchema }), object({ ok: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		testInstance: optionalMethod(object({
+			id: IntegrationInstanceIdSchema.nullable(),
+			values: record(string$2(), unknown())
+		}), TestConnectionResultSchema$1, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
 /**
 * Two-way audio / talk-back cap. Clients open a WebRTC audio-only
 * session (server-initiated offer pattern, identical to the main
@@ -57267,6 +58311,11 @@ var LogEntrySchema = object({
 * flight, and not asking for the next slice ends the scan.
 */
 var LogReadQuerySchema = object({
+	/**
+	* Which destination INSTANCE answers (a destination addon may hold several records). Absent ⇒
+	* the provider's first readable one, so a caller written before instances existed is unchanged.
+	*/
+	instanceId: string$2().min(1).max(200).optional(),
 	/** Correlates `cancelRead`. Caller-chosen, unique per in-flight read. */
 	requestId: string$2().min(1).max(64).optional(),
 	/** The device the line is about (`tags.deviceId`, numeric). */
@@ -57329,6 +58378,8 @@ var LogReadResultSchema = object({
 	/** True when `cancelRead` ended this slice early. */
 	cancelled: boolean().optional()
 });
+/** Names one destination instance; absent ⇒ the provider's first readable one. */
+var LogInstanceSelectorSchema = object({ instanceId: string$2().min(1).max(200).optional() });
 var LogReadCapabilitiesSchema = object({
 	/** False ⇒ this destination only ships lines (console, forwarder, an unconfigured Loki). */
 	readable: boolean(),
@@ -57347,7 +58398,7 @@ var LogReadCapabilitiesSchema = object({
 	/** How far back the store reaches, when the provider knows (days). */
 	retentionDays: number().nullable()
 });
-method(LogEntrySchema, _void(), { kind: "mutation" }), optionalMethod(_void(), LogReadCapabilitiesSchema, { auth: "admin" }), optionalMethod(LogReadQuerySchema, LogReadResultSchema, { auth: "admin" }), optionalMethod(object({ requestId: string$2().min(1).max(64) }), object({ cancelled: boolean() }), {
+method(LogEntrySchema, _void(), { kind: "mutation" }), optionalMethod(LogInstanceSelectorSchema, LogReadCapabilitiesSchema, { auth: "admin" }), optionalMethod(LogReadQuerySchema, LogReadResultSchema, { auth: "admin" }), optionalMethod(object({ requestId: string$2().min(1).max(64) }), object({ cancelled: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -57451,214 +58502,6 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 ]);
 method(_void(), array(LoginMethodContributionSchema).readonly());
 /**
-* Media-player cap. Models HA `media_player.*` (Sonos, Chromecast,
-* Apple TV, Spotify, Roku, generic OTT receivers, …) on
-* `DeviceType.MediaPlayer`. Disjoint from the camera streaming
-* surface — those use `DeviceType.Camera` + the broker pipeline.
-*
-* The cap declares a wide method surface; not every backend supports
-* every method. Drivers signal sub-capability via the
-* `DeviceFeature.MediaPlayerXxx` flags (paired one-to-one with the
-* corresponding method) so the UI gates buttons without a slice
-* fetch — same pattern as `PanTiltZoom` for cameras.
-*/
-var MediaPlayerStateSchema = _enum([
-	"off",
-	"on",
-	"idle",
-	"playing",
-	"paused",
-	"buffering",
-	"standby"
-]);
-var MediaPlayerRepeatSchema = _enum([
-	"off",
-	"all",
-	"one"
-]);
-var MediaInfoSchema = object({
-	/** Free-form media kind (`music`, `tvshow`, `movie`, `app`, `channel`,
-	*  `podcast`, …). */
-	type: string$2(),
-	/** Human-readable title. */
-	title: string$2(),
-	/** Optional artist / channel / station label. */
-	artist: string$2().optional(),
-	/** Optional album / season / show name. */
-	album: string$2().optional(),
-	/** Optional cover-art / thumbnail URL. */
-	imageUrl: string$2().optional()
-});
-/**
-* Where `state`, `volumeLevel`, `isMuted` and `source` come from. `reported`:
-* the device said so. `assumed`: the driver has no feedback (infrared) and
-* tracks what it last SENT; it moves only after a send was accepted, and a
-* human at the real remote makes it wrong. A UI shows an assumed value as a
-* guess, never as a reading.
-*/
-var MediaPlayerStateSourceSchema = _enum(["reported", "assumed"]);
-/** The fields of a media-player status a driver can only guess. */
-var MediaPlayerAssumedFieldSchema = _enum([
-	"state",
-	"volumeLevel",
-	"isMuted",
-	"source"
-]);
-var MediaPlayerStatusSchema = object({
-	/** Playback lifecycle state. */
-	state: MediaPlayerStateSchema,
-	/**
-	* Whether the state fields are readings or the driver's own bookkeeping.
-	* A slice written before this field existed parses as `reported`.
-	*/
-	stateSource: MediaPlayerStateSourceSchema.default("reported"),
-	/**
-	* Which fields are the driver's own guess. `stateSource` is `assumed` when
-	* this is not empty; a field not listed here is a reading even then (power
-	* from a running-state source, mute guessed from the last send).
-	*/
-	assumedFields: array(MediaPlayerAssumedFieldSchema).default([]),
-	/** Volume as 0..100 inclusive. Null when the device has no volume
-	*  surface. Pair with `DeviceFeature.MediaPlayerVolume`. */
-	volumeLevel: number().min(0).max(100).nullable().meta(readingMeta("percentage")),
-	/** Mute toggle distinct from volume=0. Null when no mute surface.
-	*  Pair with `DeviceFeature.MediaPlayerMute`. */
-	isMuted: boolean().nullable(),
-	/** Active source / input. Empty when no source surface. */
-	source: string$2(),
-	/** Selectable sources. Empty when no source surface.
-	*  Pair with `DeviceFeature.MediaPlayerSelectSource`. */
-	availableSources: array(string$2()),
-	/** Currently-playing media info. Null when nothing is playing. */
-	currentMedia: MediaInfoSchema.nullable(),
-	/** Current playback position in ms. Null when not seekable or
-	*  nothing is playing. Pair with `DeviceFeature.MediaPlayerSeek`. */
-	position: number().int().nonnegative().nullable().meta(readingMeta("duration-ms")),
-	/** Total duration of the current media in ms. Null when unknown
-	*  (live stream) or nothing is playing. */
-	duration: number().int().nonnegative().nullable().meta(readingMeta("duration-ms")),
-	/** Shuffle toggle. Null when no shuffle surface.
-	*  Pair with `DeviceFeature.MediaPlayerShuffle`. */
-	shuffle: boolean().nullable(),
-	/** Repeat mode. Null when no repeat surface.
-	*  Pair with `DeviceFeature.MediaPlayerRepeat`. */
-	repeat: MediaPlayerRepeatSchema.nullable(),
-	/** Ms epoch when the slice was last updated. */
-	lastChangedAt: number()
-});
-var mediaPlayerCapability = {
-	name: "media-player",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	deviceTypes: [DeviceType.MediaPlayer],
-	methods: {
-		play: method(object({ deviceId: number().int().nonnegative() }), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
-		pause: method(object({ deviceId: number().int().nonnegative() }), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
-		stop: method(object({ deviceId: number().int().nonnegative() }), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
-		next: method(object({ deviceId: number().int().nonnegative() }), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
-		previous: method(object({ deviceId: number().int().nonnegative() }), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
-		seek: method(object({
-			deviceId: number().int().nonnegative(),
-			position: number().int().nonnegative()
-		}), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
-		setVolume: method(object({
-			deviceId: number().int().nonnegative(),
-			volumeLevel: number().min(0).max(100)
-		}), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
-		setMute: method(object({
-			deviceId: number().int().nonnegative(),
-			muted: boolean()
-		}), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
-		setShuffle: method(object({
-			deviceId: number().int().nonnegative(),
-			shuffle: boolean()
-		}), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
-		setRepeat: method(object({
-			deviceId: number().int().nonnegative(),
-			repeat: MediaPlayerRepeatSchema
-		}), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
-		selectSource: method(object({
-			deviceId: number().int().nonnegative(),
-			source: string$2().min(1)
-		}), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
-		playMedia: method(object({
-			deviceId: number().int().nonnegative(),
-			/** Media identifier / URL. */
-			mediaId: string$2().min(1),
-			/** Media kind (`music`, `tvshow`, `movie`, `app`, …) — provider
-			*  passes it through to the upstream service. */
-			mediaType: string$2().min(1)
-		}), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		})
-	},
-	status: {
-		schema: MediaPlayerStatusSchema,
-		kind: "push"
-	},
-	/**
-	* Runtime-state slice — mirrored by the kernel. UI players read the
-	* full slice for live now-playing, volume, and progress updates
-	* without polling.
-	*/
-	runtimeState: MediaPlayerStatusSchema,
-	/**
-	* Runtime-state durability: **session** — a restored transport position describes a playback that stopped when the hub did.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "session",
-	/**
-	* History (D850): volume (a level an operator or an automation sets; the
-	* default 10 s floor folds a slider drag into its end value) and mute.
-	* `position` is not recorded: it moves continuously while playing.
-	*/
-	history: { fields: {
-		volumeLevel: {
-			kind: "gauge",
-			unit: "%",
-			deadband: 1
-		},
-		isMuted: { kind: "boolean" }
-	} }
-};
-/**
 * mesh-network — collection cap for mesh-VPN providers.
 *
 * Different shape from `network-access` (public tunnels):
@@ -66417,6 +67260,21 @@ var NcTemplateVarKindSchema = _enum([
 	"sound",
 	"system"
 ]);
+/**
+* The default title/body a rule of one SITUATION is delivered with when the
+* operator wrote no template — served so an editor can pre-fill it (and the
+* operator can rebuild it from placeholders) instead of starting from a blank
+* box that, once saved, silently replaces it. `id` names the situation inside
+* a rule `kind`: `appliance-cycle` is a `sensor` rule whose device is an
+* appliance finishing a cycle. Texts are raw templates (`{{var}}` intact), in
+* the hub's current language and with its overrides applied.
+*/
+var NcTemplateDefaultSchema = object({
+	id: _enum(["appliance-cycle"]),
+	kind: NcRuleKindSchema,
+	title: string$2(),
+	body: string$2()
+});
 /** Which producer renders a template: an ordinary rule, a timelapse, a digest. */
 var NcTemplateFamilySchema = _enum([
 	"rule",
@@ -67272,7 +68130,11 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 }), method(object({}), object({
 	catalog: array(NcConditionDescriptorSchema),
 	taxonomy: NcTaxonomySchema.optional()
-})), method(object({}), object({ vars: array(NcTemplateVarDescriptorSchema) })), method(NcTemplatePreviewInputSchema, NcTemplatePreviewSchema, {
+})), method(object({}), object({
+	vars: array(NcTemplateVarDescriptorSchema),
+	/** Per-situation default texts; absent on a hub that predates them. */
+	defaults: array(NcTemplateDefaultSchema)
+})), method(NcTemplatePreviewInputSchema, NcTemplatePreviewSchema, {
 	kind: "mutation",
 	access: "view"
 }), method(object({ filter: NcHistoryFilterSchema.default({ limit: 100 }) }), object({ entries: array(NcHistoryEntrySchema) }), { auth: "admin" }), method(object({}), NcRuleLastRunsSchema, { auth: "admin" }), method(object({ artifactId: string$2().min(1) }), object({ url: string$2().nullable() }), { auth: "admin" }), method(object({}), object({ snoozes: array(NcSnoozeSchema) }), { caller: "required" }), method(object({ snooze: NcSnoozeInputSchema }), object({ snooze: NcSnoozeSchema }), {
@@ -68168,7 +69030,7 @@ var petFeederCapability = {
 /**
 * Pet water-fountain cap. Models the telemetry and the control surface of a
 * circulating drinking fountain: how much water is in the tank, how much the
-* pet drank, whether the pump runs and on what duty cycle.
+* pet drank, whether the pump runs.
 *
 * It has no native vendor provider of its own: a fountain reaches CamStack as
 * a container of loose entities (a pump switch, two number boxes, a "filter
@@ -68184,8 +69046,10 @@ var petFeederCapability = {
 * never here. Every reading may be `null`: a source that is offline or does
 * not report is unknown, never zero.
 *
-* The filter is not a field of this cap: it is an item of the `consumables`
-* cap on the same device (kind `wear`), reset by the same forward mechanism.
+* The pump's on/off duty cycle is model-specific and lives in the optional
+* `pump-cycle` cap. The filter, the cleaning and the water change are not
+* fields of this cap: they are items of the `consumables` cap on the same
+* device (kind `wear`), reset by the same forward mechanism.
 */
 var PetFountainStatusSchema = object({
 	/** Water in the tank, 0..100 (%). Null while the source has not reported. */
@@ -68196,27 +69060,20 @@ var PetFountainStatusSchema = object({
 	empty: boolean().nullable(),
 	/** True while the pump is running. Null while unknown. */
 	pumpRunning: boolean().nullable(),
-	/** True when the pump works on an on/off duty cycle rather than continuously. */
-	pumpIntervalEnabled: boolean().nullable(),
-	/** How long the pump runs per cycle, in seconds. */
-	pumpOnTime: number().min(0).nullable().meta(readingMeta("duration")),
-	/** How long the pump rests per cycle, in seconds. */
-	pumpOffTime: number().min(0).nullable().meta(readingMeta("duration")),
 	/** Water drunk in the last drink, in litres. */
 	lastDrink: number().min(0).nullable().meta(readingMeta("volume")),
 	/** Water drunk in the current hour, in litres. */
 	currentHourDrink: number().min(0).nullable().meta(readingMeta("volume")),
 	/** Water drunk over the last 24 hours (rolling), in litres. */
 	last24hDrink: number().min(0).nullable().meta(readingMeta("volume")),
-	/** Water drunk since local midnight, in litres. */
+	/** Water drunk since local midnight, in litres. Null when the fountain has no such sensor. */
 	todayDrink: number().min(0).nullable().meta(readingMeta("volume")),
 	/** Decoded fault message. Null means healthy; a non-null string is an active fault. */
 	error: string$2().nullable(),
 	/** Ms epoch when the slice was last refreshed. */
 	lastFetchedAt: number()
 });
-var DeviceIdSchema = number().int().nonnegative();
-var MinutesSchema = number().int().min(0);
+var DeviceIdSchema$1 = number().int().nonnegative();
 var petFountainCapability = {
 	name: "pet-fountain",
 	scope: "device",
@@ -68226,38 +69083,14 @@ var petFountainCapability = {
 	methods: {
 		/** Start or stop the pump. */
 		setPump: method(object({
-			deviceId: DeviceIdSchema,
-			on: boolean()
-		}), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
-		/** Switch the on/off duty cycle on or off (off = the pump runs continuously). */
-		setPumpInterval: method(object({
-			deviceId: DeviceIdSchema,
+			deviceId: DeviceIdSchema$1,
 			on: boolean()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		/** Set how many minutes the pump runs per cycle. */
-		setPumpOnMinutes: method(object({
-			deviceId: DeviceIdSchema,
-			minutes: MinutesSchema
-		}), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
-		/** Set how many minutes the pump rests per cycle. */
-		setPumpOffMinutes: method(object({
-			deviceId: DeviceIdSchema,
-			minutes: MinutesSchema
-		}), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
 		/** Clear the rolling daily consumption counters on the device. */
-		resetDailyConsumption: method(object({ deviceId: DeviceIdSchema }), _void(), {
+		resetDailyConsumption: method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
 			kind: "mutation",
 			auth: "protected"
 		})
@@ -69892,6 +70725,14 @@ var powerMeterCapability = {
 	deviceNative: true,
 	mode: "singleton",
 	deviceTypes: POWER_METER_DEVICE_TYPES,
+	deviceConfig: { ui: {
+		kind: "widget",
+		widgetId: "host/power-meter-line",
+		tab: "power",
+		placement: "hero",
+		label: "Power",
+		order: 4
+	} },
 	methods: {},
 	status: {
 		schema: PowerMeterStatusSchema,
@@ -69951,6 +70792,117 @@ var powerMeterCapability = {
 	volatileStateFields: ["lastFetchedAt"],
 	customize: powerMeterCustomize
 };
+var PowerSourceRefusalReasonSchema = _enum([
+	"no-power-source",
+	"switch-missing",
+	"switch-offline",
+	"switch-unknown",
+	"restart-in-progress",
+	"switch-call-failed"
+]);
+var PowerSourceActionResultSchema = discriminatedUnion("accepted", [object({ accepted: literal(true) }), object({
+	accepted: literal(false),
+	reason: PowerSourceRefusalReasonSchema,
+	/** One line for the operator, naming the switch. */
+	message: string$2()
+})]);
+var PowerSourceInfoSchema = object({
+	/** False when the device has no power source linked; the rest is then empty. */
+	linked: boolean(),
+	switchDeviceId: number().nullable(),
+	switchName: string$2().nullable(),
+	/** The switch's on/off state, or null when it is unknown. Never false for unknown (D393). */
+	switchOn: boolean().nullable(),
+	switchOnline: boolean().nullable(),
+	restartInProgress: boolean(),
+	offSeconds: number().int()
+});
+/** The composed slice: the switch state the link mirrors, plus the stored off time. */
+var PowerSourceStateSchema = object({
+	/** Null while the switch has not reported: unknown is never `false` (D393). */
+	switchOn: boolean().nullable(),
+	offSeconds: number().int(),
+	lastFetchedAt: number()
+});
+var POWER_SOURCE_DEVICE_TYPES = [
+	DeviceType.Gateway,
+	DeviceType.Hub,
+	DeviceType.Camera,
+	DeviceType.Sensor,
+	DeviceType.MediaPlayer,
+	DeviceType.Vacuum,
+	DeviceType.Generic,
+	DeviceType.Washer,
+	DeviceType.Dryer,
+	DeviceType.Dishwasher,
+	DeviceType.PetFountain,
+	DeviceType.Fan,
+	DeviceType.Humidifier,
+	DeviceType.Climate,
+	DeviceType.WaterHeater
+];
+var powerSourceCustomize = {
+	version: 1,
+	targets: [{
+		id: "switch",
+		cardinality: "scalar",
+		vocabulary: {
+			cap: "power-source",
+			stateField: "switchOn"
+		},
+		deviceTypes: POWER_SOURCE_DEVICE_TYPES,
+		apply: "add",
+		path: "switchOn",
+		sources: [{
+			kind: "switch",
+			transforms: [{ kind: "identity" }]
+		}],
+		companions: [{
+			kind: "constant",
+			path: "offSeconds",
+			value: 10,
+			when: "add"
+		}, {
+			kind: "clock",
+			path: "lastFetchedAt",
+			when: "always"
+		}],
+		sourceReport: { status: "assignment-status" }
+	}]
+};
+var deviceInput$1 = object({ deviceId: number().int().nonnegative() });
+var powerSourceCapability = {
+	name: "power-source",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: POWER_SOURCE_DEVICE_TYPES,
+	methods: {
+		getStatus: systemMethod(deviceInput$1, PowerSourceInfoSchema, { auth: "admin" }),
+		powerOn: systemMethod(deviceInput$1, PowerSourceActionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		powerOff: systemMethod(deviceInput$1, PowerSourceActionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		forceRestart: systemMethod(deviceInput$1, PowerSourceActionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	runtimeState: PowerSourceStateSchema,
+	customize: powerSourceCustomize,
+	/**
+	* Runtime-state durability: **session** — mirrored from the linked switch on
+	* its next report; a restored value would outlive the reading it names.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
+	history: "none"
+};
 /**
 * Presence cap. Models HA `person.*` and `device_tracker.*` entities
 * on `DeviceType.Presence`. Read-only — no setters: presence is
@@ -70590,6 +71542,79 @@ var ptzAutotrackCapability = {
 	*/
 	history: "none"
 };
+/**
+* The on/off duty cycle of a pet fountain's pump. Some models run the pump
+* continuously and have nothing to configure; others can alternate a run time
+* and a rest time. That is model-specific, so it is its own optional cap on the
+* fountain device: a fountain without cycle entities simply never composes it
+* (planning#366), and the `pet-fountain` cap stays the model-independent core.
+*
+* Like `pet-fountain` it has no native vendor provider: an operator BUILDS the
+* cycle from loose entities (a cycle switch and two number boxes) and every
+* method is a forward to one source entity (D659, D967). Durations are stored
+* in SECONDS (D944); a number box that cannot be read back leaves them `null`
+* — unknown, never zero (D393).
+*/
+var PumpCycleStatusSchema = object({
+	/** True when the pump works on the on/off cycle, false when it runs continuously. Null while unknown. */
+	enabled: boolean().nullable(),
+	/** How long the pump runs per cycle, in seconds. Null while unknown. */
+	onTime: number().min(0).nullable().meta(readingMeta("duration")),
+	/** How long the pump rests per cycle, in seconds. Null while unknown. */
+	offTime: number().min(0).nullable().meta(readingMeta("duration")),
+	/** Ms epoch when the slice was last refreshed. */
+	lastFetchedAt: number()
+});
+var DeviceIdSchema = number().int().nonnegative();
+var MinutesSchema = number().int().min(0);
+var pumpCycleCapability = {
+	name: "pump-cycle",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.PetFountain],
+	methods: {
+		/** Switch the on/off duty cycle on or off (off = the pump runs continuously). */
+		setEnabled: method(object({
+			deviceId: DeviceIdSchema,
+			on: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** Set how many minutes the pump runs per cycle. */
+		setOnMinutes: method(object({
+			deviceId: DeviceIdSchema,
+			minutes: MinutesSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		}),
+		/** Set how many minutes the pump rests per cycle. */
+		setOffMinutes: method(object({
+			deviceId: DeviceIdSchema,
+			minutes: MinutesSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "protected"
+		})
+	},
+	status: {
+		schema: PumpCycleStatusSchema,
+		kind: "push"
+	},
+	/** Runtime-state slice — mirrored by the kernel; the hero card reads it whole. */
+	runtimeState: PumpCycleStatusSchema,
+	/**
+	* Runtime-state durability: **session** — live appliance state re-published on connect.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
+	/** History (D850): a duty-cycle setting is not a series worth recording. */
+	history: "none"
+};
 DeviceType.Camera, DeviceType.Sensor, DeviceType.Switch, DeviceType.Gateway, method(object({ deviceId: number().int().nonnegative() }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
@@ -73380,7 +74405,13 @@ var RemoteMediaCommandSchema = _enum([
 	"next",
 	"previous",
 	"setMute",
-	"selectSource"
+	"selectSource",
+	"turnOn",
+	"turnOff",
+	"volumeUp",
+	"volumeDown",
+	"channelUp",
+	"channelDown"
 ]);
 /** A send result, or `not-routed`: the role is not bound, so the native cap answers. */
 var RemoteMediaCommandResultSchema = discriminatedUnion("status", [...RemoteSendResultSchema.options, object({ status: literal("not-routed") })]);
@@ -73401,7 +74432,7 @@ method(deviceInput, RemoteConfigSchema, { auth: "admin" }), method(deviceInput.e
 }), RemoteSendResultSchema, {
 	kind: "mutation",
 	auth: "protected"
-}), method(deviceInput.extend({
+}), method(deviceInput, MediaPlayerStatusSchema.nullable(), { auth: "protected" }), method(deviceInput.extend({
 	command: RemoteMediaCommandSchema,
 	muted: boolean().optional(),
 	source: string$2().optional(),
@@ -75647,7 +76678,11 @@ listSignals: method(_void(), array(StreamSignalSchema).readonly()) }
 * `getSettingsUISchema()` surface.
 */
 var SwitchStatusSchema = object({
-	on: boolean().meta({ label: "On" }),
+	/**
+	* `null` = the device has never reported its state (a measurement that
+	* has not happened is unknown, never `false`).
+	*/
+	on: boolean().nullable().meta({ label: "On" }),
 	/** Ms epoch of the last state change. Useful for UI "X minutes ago". */
 	lastChangedAt: number()
 });
@@ -75672,7 +76707,7 @@ var switchCapability = {
 	}) },
 	events: { onStateChanged: { data: object({
 		deviceId: number(),
-		on: boolean(),
+		on: boolean().nullable(),
 		lastChangedAt: number()
 	}) } },
 	status: {
@@ -79229,6 +80264,26 @@ function buildDescriptor(capName, kind) {
 * contributes one entry per bound cap present in this map.
 */
 var EVENT_KIND_BY_CAP = Object.freeze(Object.fromEntries(Object.entries(CAP_TO_KIND).map(([capName, kind]) => [capName, buildDescriptor(capName, kind)])));
+/**
+* What a remote key is CALLED and what it LOOKS like, for every role (D963),
+* shared by the admin UI and the viewer. A role is data on the wire; each
+* client resolves its name from `label` (English and Italian side by side) and
+* its glyph from `icon`, a lucide id from the shared icon catalogue — the
+* server sends an id, a client maps it to its own icon set.
+*
+* `legend` is text printed on the key INSTEAD of a glyph (a digit has no
+* pictogram): a client that can draw text shows it, one that cannot falls back
+* to `icon`.
+*/
+function digit(n) {
+	return {
+		label: t(n, n),
+		icon: "hash",
+		legend: n
+	};
+}
+digit("0"), digit("1"), digit("2"), digit("3"), digit("4"), digit("5"), digit("6"), digit("7"), digit("8"), digit("9");
+DeviceFeature.MediaPlayerPower, DeviceFeature.MediaPlayerVolumeStep, DeviceFeature.MediaPlayerChannelStep, DeviceFeature.MediaPlayerMute, DeviceFeature.MediaPlayerStop, DeviceFeature.MediaPlayerNext, DeviceFeature.MediaPlayerPrevious;
 var btn = (idSuffix, row, col, init) => ({
 	idSuffix,
 	row,
@@ -79355,6 +80410,34 @@ discriminatedUnion("kind", [object({
 	kind: literal("pronto"),
 	code: string$2()
 })]);
+/**
+* Propose a running threshold from a device's own power history (planning#405).
+*
+* Pure and deterministic: the same series gives the same answer. The series is
+* a HELD-VALUE step series — a point's value stands until the next point — which
+* is how device-history stores a gauge, so "time at a level" is exact, not a
+* count of samples.
+*
+*  1. idle floor F = time-weighted median; noise ceiling N = highest value seen
+*     near F. A device that is not near one level most of the time has no floor.
+*  2. coarse activity = above max(2N, N + 5 W); consecutive stretches are episodes.
+*  3. gaps between episodes split in two by the largest log-scale jump (>= 3x):
+*     the short ones are pauses INSIDE a run (a soak), the long ones separate runs.
+*  4. T = geometric mean of N and the plateau's 10th percentile, snapped to a
+*     grid a person would type; stop dwell covers the longest pause; start dwell
+*     covers the longest standby blip above T.
+*  5. the numbers are proved by REPLAY through the real `dwell` evaluation: each
+*     run must hold exactly one true interval and nothing may flap outside.
+*/
+var SECOND_MS = 1e3;
+var MINUTE_MS$1 = 60 * SECOND_MS;
+24 * (60 * MINUTE_MS$1);
+10 * MINUTE_MS$1;
+30 * SECOND_MS;
+60 * SECOND_MS;
+20 * MINUTE_MS$1;
+10 * SECOND_MS;
+10 * SECOND_MS;
 DeviceFeature.FanSpeed, DeviceFeature.FanPreset, DeviceFeature.FanDirection, DeviceFeature.FanOscillating, DeviceFeature.CoverStoppable, DeviceFeature.CoverPositionable, DeviceFeature.CoverTilt, DeviceFeature.ValvePositionable, DeviceFeature.MediaPlayerVolume, DeviceFeature.ClimateFanMode;
 SOURCE_CAPS.filter((cap) => cap !== "switch" && cap !== "motion");
 String.raw`rose\(active(\d+), changed(\d+), (\d+(?:\.\d+)?)\)`;
@@ -79715,6 +80798,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	pressureSensor: pressureSensorCapability,
 	privacyMask: privacyMaskCapability,
 	ptzAutotrack: ptzAutotrackCapability,
+	pumpCycle: pumpCycleCapability,
 	recordingOnboard: recordingOnboardCapability,
 	recordingSignal: recordingSignalCapability,
 	runningState: runningStateCapability,
@@ -81899,6 +82983,27 @@ Object.freeze({
 		access: "view",
 		role: "viewer"
 	},
+	"boardKeySource.getBoardKey": {
+		capName: "board-key-source",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"boardKeySource.listBoards": {
+		capName: "board-key-source",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"boardKeySource.listSources": {
+		capName: "board-key-source",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"brightness.getStatus": {
 		capName: "brightness",
 		capScope: "device",
@@ -82438,6 +83543,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"coreBlocks.proposeRunningThreshold": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"coreBlocks.reportAutomationRun": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -82949,6 +84061,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"deviceExport.listInstances": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"deviceExport.listSupportedDeviceKinds": {
 		capName: "device-export",
 		capScope: "system",
@@ -84580,6 +85699,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"integrationInstances.setInstanceEnabled": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"integrationInstances.testInstance": {
 		capName: "integration-instances",
 		capScope: "system",
@@ -85378,6 +86504,20 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"mediaPlayer.channelDown": {
+		capName: "media-player",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"mediaPlayer.channelUp": {
+		capName: "media-player",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
 	"mediaPlayer.getStatus": {
 		capName: "media-player",
 		capScope: "device",
@@ -85469,6 +86609,34 @@ Object.freeze({
 		access: "create",
 		role: "viewer"
 	},
+	"mediaPlayer.turnOff": {
+		capName: "media-player",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"mediaPlayer.turnOn": {
+		capName: "media-player",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"mediaPlayer.volumeDown": {
+		capName: "media-player",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"mediaPlayer.volumeUp": {
+		capName: "media-player",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
 	"meshNetwork.getStatus": {
 		capName: "mesh-network",
 		capScope: "system",
@@ -86715,27 +87883,6 @@ Object.freeze({
 		access: "create",
 		role: "viewer"
 	},
-	"petFountain.setPumpInterval": {
-		capName: "pet-fountain",
-		capScope: "device",
-		addonId: null,
-		access: "create",
-		role: "viewer"
-	},
-	"petFountain.setPumpOffMinutes": {
-		capName: "pet-fountain",
-		capScope: "device",
-		addonId: null,
-		access: "create",
-		role: "viewer"
-	},
-	"petFountain.setPumpOnMinutes": {
-		capName: "pet-fountain",
-		capScope: "device",
-		addonId: null,
-		access: "create",
-		role: "viewer"
-	},
 	"pipelineAnalytics.addRetrainFrameFromRecording": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -88514,6 +89661,34 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"pumpCycle.getStatus": {
+		capName: "pump-cycle",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
+	"pumpCycle.setEnabled": {
+		capName: "pump-cycle",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"pumpCycle.setOffMinutes": {
+		capName: "pump-cycle",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"pumpCycle.setOnMinutes": {
+		capName: "pump-cycle",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
 	"reboot.reboot": {
 		capName: "reboot",
 		capScope: "device",
@@ -89018,6 +90193,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"remote.getAssumedStatus": {
+		capName: "remote",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"remote.getConfig": {
 		capName: "remote",
 		capScope: "system",
@@ -91833,6 +93015,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"coreBlocks.proposeRunningThreshold": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"cover.close": [{
 		name: "deviceId",
 		form: "single",
@@ -92684,6 +93871,16 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"mediaPlayer.channelDown": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.channelUp": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"mediaPlayer.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -92749,6 +93946,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"mediaPlayer.turnOff": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.turnOn": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.volumeDown": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"mediaPlayer.volumeUp": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"meter.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -93058,21 +94275,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"petFountain.setPumpInterval": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
-	"petFountain.setPumpOffMinutes": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
-	"petFountain.setPumpOnMinutes": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
 	"pipelineAnalytics.addRetrainFrameFromRecording": [{
 		name: "deviceId",
 		form: "single",
@@ -93708,6 +94910,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pumpCycle.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pumpCycle.setEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pumpCycle.setOffMinutes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"pumpCycle.setOnMinutes": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"reboot.reboot": [{
 		name: "deviceId",
 		form: "single",
@@ -93909,6 +95131,11 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"remote.getAssumedStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"remote.getConfig": [{
 		name: "deviceId",
 		form: "single",
@@ -94456,99 +95683,6 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
-/**
-* A saved Customize assignment (D936). The schema is the type: callers use
-* `z.infer`, they do not restate the shape.
-*/
-var OverrideSourceSchema = object({
-	addonId: string$2().min(1),
-	stableId: string$2().min(1),
-	cap: string$2().min(1),
-	fieldPath: string$2().min(1)
-});
-var CustomizeTransformDraftSchema = discriminatedUnion("kind", [
-	object({ kind: literal("identity") }),
-	object({ kind: literal("invert") }),
-	object({
-		kind: literal("threshold"),
-		comparison: _enum(["gte", "lte"]),
-		threshold: number(),
-		startDwellMs: number().nonnegative(),
-		stopDwellMs: number().nonnegative()
-	}),
-	object({
-		kind: literal("linear"),
-		scale: number(),
-		offset: number(),
-		clampMin: number().optional(),
-		clampMax: number().optional()
-	}),
-	object({
-		kind: literal("enum-map"),
-		mapping: record(string$2(), string$2().nullable())
-	}),
-	object({ kind: literal("number") })
-]);
-var ScalarOverrideDraftSchema = object({
-	kind: literal("scalar"),
-	cap: string$2().min(1),
-	targetId: string$2().min(1),
-	source: OverrideSourceSchema,
-	transform: CustomizeTransformDraftSchema
-});
-var KeyedArrayOverrideDraftSchema = object({
-	kind: literal("keyedArray"),
-	cap: string$2().min(1),
-	targetId: string$2().min(1),
-	key: string$2().min(1),
-	label: string$2().min(1),
-	fieldPath: string$2().min(1),
-	source: OverrideSourceSchema,
-	transform: CustomizeTransformDraftSchema
-});
-var PulseOverrideDraftSchema = object({
-	kind: literal("pulse"),
-	cap: string$2().min(1),
-	targetId: string$2().min(1),
-	enabled: boolean(),
-	debounceMs: number().nonnegative(),
-	edges: array(_enum([
-		"rising",
-		"button",
-		"native-event"
-	])).min(1).optional(),
-	sources: array(OverrideSourceSchema).min(1)
-});
-var SpanSourceDraftSchema = OverrideSourceSchema.extend({ mode: _enum([
-	"in-addition",
-	"confirm",
-	"replace"
-]).optional() });
-discriminatedUnion("kind", [
-	ScalarOverrideDraftSchema,
-	KeyedArrayOverrideDraftSchema,
-	PulseOverrideDraftSchema,
-	object({
-		kind: literal("span"),
-		cap: string$2().min(1),
-		targetId: string$2().min(1),
-		timeoutMs: number().nonnegative(),
-		cooldownMs: number().nonnegative().optional(),
-		sources: array(SpanSourceDraftSchema)
-	})
-]);
-object({
-	targetId: string$2().min(1),
-	configured: boolean(),
-	source: _enum(["native", "assigned"]),
-	state: _enum([
-		"active",
-		"stale",
-		"released",
-		"unavailable"
-	]),
-	reason: string$2().nullable()
-});
 var G711_SCALE_CORRECTION_DB = {
 	PCMU: 20 * Math.log10(4),
 	PCMA: 20 * Math.log10(8)
@@ -95164,6 +96298,7 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_TEXT],
 	([...RULE_TEXT], [...DEVICE_EVENTS]),
 	([...RULE_TEXT], [...COMBINED_ALARM]),
+	([...RULE_TEXT], [...COMBINED_ALARM]),
 	([...RULE_TEXT], [...DEVICE_EVENTS]),
 	([...RULE_TEXT], [...BATTERY, ...CONSUMABLE]),
 	([...RULE_TEXT], [...CONSUMABLE]),
@@ -206241,13 +207376,16 @@ var MatterBrokerRegistry = class {
 	}
 	async restore(entries) {
 		for (const entry of entries) this.#seedCounter(entry.id);
-		for (const entry of entries) try {
-			await this.#startManager(entry);
-		} catch (err) {
-			this.#logger.warn("MatterBrokerRegistry: failed to restore manager", {
-				tags: { brokerId: entry.id },
-				meta: { error: errMsg(err) }
-			});
+		for (const entry of entries) {
+			if (entry.enabled === false) continue;
+			try {
+				await this.#startManager(entry);
+			} catch (err) {
+				this.#logger.warn("MatterBrokerRegistry: failed to restore manager", {
+					tags: { brokerId: entry.id },
+					meta: { error: errMsg(err) }
+				});
+			}
 		}
 	}
 	async shutdown() {
@@ -206278,7 +207416,8 @@ var MatterBrokerRegistry = class {
 		this.#onAttributeReport = cb;
 	}
 	async createEntry(name, connection, opts = {}) {
-		const id = this.#allocateId();
+		const id = opts.id ?? this.#allocateId();
+		if (opts.id !== void 0) this.#seedCounter(opts.id);
 		const entry = {
 			id,
 			name,
@@ -206291,7 +207430,7 @@ var MatterBrokerRegistry = class {
 	}
 	async removeEntry(id) {
 		const mgr = this.#managers.get(id);
-		if (!mgr) throw new Error(`MatterBrokerRegistry: unknown broker id "${id}"`);
+		if (!mgr) return;
 		for (const [integrationId, brokerId] of this.#integrationToBroker.entries()) if (brokerId === id) this.#integrationToBroker.delete(integrationId);
 		this.#managers.delete(id);
 		try {
@@ -206373,6 +207512,10 @@ var MatterBrokerRegistry = class {
 		if (entry.integrationId !== void 0) this.#integrationToBroker.set(entry.integrationId, entry.id);
 		await mgr.start();
 	}
+	/** The next free broker id, for a record minted before its manager exists. */
+	allocateId() {
+		return this.#allocateId();
+	}
 	#allocateId() {
 		const id = `matter_${String(this.#nextId).padStart(3, "0")}`;
 		this.#nextId++;
@@ -206411,10 +207554,12 @@ var MatterBrokerEntrySchema = object({
 	id: string$2().min(1),
 	name: string$2().min(1),
 	connection: matterConnectionSchema,
-	integrationId: string$2().optional()
+	integrationId: string$2().optional(),
+	/** Absent means on; the instances page switches a fabric off without deleting it. */
+	enabled: boolean().optional()
 });
-/** Top-level addon config — an ordered list of broker entries (default empty). */
-var matterAddonConfigSchema = object({ brokers: array(MatterBrokerEntrySchema).default([]) });
+/** Top-level addon config — the fabrics are records, so nothing is left here. */
+var matterAddonConfigSchema = object({});
 /** Narrow an `unknown` to a shallow plain-object record (cast-free boundary). */
 function toRecord(value) {
 	if (typeof value === "object" && value !== null && !Array.isArray(value)) return Object.fromEntries(Object.entries(value));
@@ -207496,19 +208641,146 @@ var MatterNodeDevice = class extends BaseDevice {
 var matterBrokersEntryKind = defineEntryKind("brokers", {
 	title: "Matter brokers",
 	schema: entryBody({
-		connection: MatterBrokerEntrySchema.shape.connection,
-		integrationId: string$2().optional()
+		...matterConnectionSchema.shape,
+		integrationId: string$2().optional(),
+		enabled: boolean().optional()
 	}),
-	writeTrigger: "an operator adds, edits or removes a Matter fabric broker"
+	writeTrigger: "an operator adds, edits or removes a Matter fabric broker",
+	retiredSecretPaths: ["connection.threadDataset", "connection.wifiPassword"]
 });
 //#endregion
+//#region src/matter-instances.ts
+/**
+* The Matter fabrics as `integration-instances` (planning#408 P3): one instance per `brokers`
+* record, over the SAME records and ids (`matter_NNN`) the `broker` cap serves. The body is flat.
+* A fabric needs no sign-in; commissioning a device stays on the adoption flow, behind the fabric.
+*/
+var MATTER_INSTANCE_KIND = "matter";
+function statusOf(info) {
+	if (info === null) return {
+		state: "unknown",
+		label: "Not started"
+	};
+	if (info.status === "connected") return {
+		state: "ok",
+		label: "Running"
+	};
+	if (info.status === "connecting") return {
+		state: "unknown",
+		label: "Starting"
+	};
+	return {
+		state: "error",
+		label: info.status,
+		...info.error !== null ? { detail: info.error } : {}
+	};
+}
+function buildMatterInstances(records, deps) {
+	return new RecordIntegrationInstances(records, matterBrokersEntryKind, {
+		description: {
+			role: "both",
+			instanceMode: "multiple",
+			kind: "connection",
+			canTest: true,
+			kinds: [{
+				id: MATTER_INSTANCE_KIND,
+				label: "Matter"
+			}],
+			allowRestoreId: true
+		},
+		formSchema: () => buildConnectionFormSchema(),
+		initialBody: (name) => ({
+			name,
+			threadDataset: "",
+			wifiSsid: "",
+			wifiPassword: "",
+			reconcileIntervalMs: 3e5
+		}),
+		mintId: () => deps.mintId(),
+		kindOf: () => MATTER_INSTANCE_KIND,
+		health: (_body, id) => {
+			const info = deps.infoOf(id);
+			return {
+				status: statusOf(info),
+				...info?.lastCheckedAt != null ? { lastCheckedAt: info.lastCheckedAt } : {}
+			};
+		},
+		configured: () => true,
+		onChanged: deps.onChanged,
+		test: async ({ id }) => {
+			const info = id === null ? null : deps.infoOf(id);
+			if (info === null) return {
+				success: false,
+				status: "inconclusive",
+				error: "Not started: save the fabric first"
+			};
+			return info.status === "connected" ? {
+				success: true,
+				status: "validated"
+			} : {
+				success: false,
+				status: "rejected",
+				error: info.error ?? `status: ${info.status}`
+			};
+		}
+	});
+}
+//#endregion
+//#region src/migrations/flatten-broker-records.ts
+/**
+* The Matter broker records keep their fabric settings flat (planning#408 P3): the nested
+* `connection` object (`threadDataset`, `wifiSsid`, `wifiPassword`, `reconcileIntervalMs`) becomes
+* top-level fields under the SAME record id (`matter_NNN`), so the devices that carry the id keep
+* their fabric. The work is `flattenNestedRecords`: every secret is read before anything is
+* written, read back from its new ref before the nested object goes, and the old refs are
+* deleted last.
+*/
+var FLATTEN_BROKER_RECORDS_ID = "matter-broker/2026-11-04-flatten-broker-records";
+async function flattenBrokerRecords(ports) {
+	return flattenNestedRecords(ports, {
+		legacyKey: "connection",
+		flatSecretKeys: ["threadDataset", "wifiPassword"],
+		toFlat: (legacy) => Object.fromEntries([
+			"threadDataset",
+			"wifiSsid",
+			"wifiPassword",
+			"reconcileIntervalMs"
+		].filter((key) => legacy[key] !== void 0).map((key) => [key, legacy[key]]))
+	});
+}
+//#endregion
+//#region src/migrations/index.ts
+/** The `matter-broker` catalogue (D987): offered to the engine when the addon initialises. */
+var ADDON_MIGRATIONS = [{
+	meta: {
+		id: FLATTEN_BROKER_RECORDS_ID,
+		owner: "matter-broker",
+		level: "addon-state",
+		seq: 1,
+		dependsOn: [],
+		store: "settings",
+		scope: "cluster",
+		onFailure: "block-owner",
+		bodyKind: "procedure",
+		description: "Move each Matter fabric from a nested connection object to flat top-level fields under the same id, reading every secret back first",
+		fixtureMark: "the integration link and the Wi-Fi SSID of each fabric"
+	},
+	procedure: flattenBrokerRecords
+}];
+//#endregion
 //#region src/matter-broker-store.ts
 function rowToEntry(id, data) {
 	const parsed = MatterBrokerEntrySchema.safeParse({
 		id,
 		name: data.name,
-		connection: data.connection,
-		integrationId: data.integrationId
+		connection: {
+			threadDataset: data.threadDataset,
+			wifiSsid: data.wifiSsid,
+			wifiPassword: data.wifiPassword,
+			reconcileIntervalMs: data.reconcileIntervalMs
+		},
+		integrationId: data.integrationId,
+		enabled: data.enabled
 	});
 	return parsed.success ? parsed.data : null;
 }
@@ -207536,16 +208808,20 @@ var MatterBrokerStore = class MatterBrokerStore {
 		}
 		return out;
 	}
+	async getById(id) {
+		return (await this.listResolved()).find((entry) => entry.id === id) ?? null;
+	}
 	async replaceAll(entries) {
 		const page = await this.kind.query({ limit: 1e3 });
 		const nextIds = new Set(entries.map((e) => e.id));
 		for (const row of page.records) if (!nextIds.has(row.id)) await this.kind.delete(row.id);
 		for (const entry of entries) {
-			const { id, name, connection, integrationId } = entry;
+			const { id, name, connection, integrationId, enabled } = entry;
 			const body = {
 				name,
-				connection,
-				...integrationId === void 0 ? {} : { integrationId }
+				...connection,
+				...integrationId === void 0 ? {} : { integrationId },
+				...enabled === void 0 ? {} : { enabled }
 			};
 			const parsed = matterBrokersEntryKind.schema.safeParse(body);
 			if (!parsed.success) throw new Error(`invalid Matter broker '${id}': ${parsed.error.message}`);
@@ -207559,7 +208835,7 @@ var MatterBrokerStore = class MatterBrokerStore {
 //#endregion
 //#region src/addon.ts
 /** Default config — a fresh install starts with no fabric. */
-var DEFAULTS = { brokers: [] };
+var DEFAULTS = {};
 /**
 * Matter broker addon (hub-only). Owns a Matter fabric per broker entry via an
 * embedded matter.js controller (behind the {@link matterCommands} /
@@ -207581,6 +208857,7 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 	deviceClasses = { [DeviceType.Container]: MatterNodeDevice };
 	registry = null;
 	brokerStore = null;
+	instances = null;
 	activeBrokers = [];
 	constructor() {
 		super({ ...DEFAULTS });
@@ -207591,6 +208868,13 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 		if (records === void 0) throw new Error("matter-broker: ctx.records is required (hub-only addon)");
 		await records.declare({ brokers: matterBrokersEntryKind });
 		this.brokerStore = MatterBrokerStore.of(records);
+		this.instances = buildMatterInstances(records, {
+			mintId: () => this.requireRegistry().allocateId(),
+			infoOf: (id) => this.registry?.get(id) ?? null,
+			onChanged: (id) => this.syncBrokerRuntime(id)
+		});
+		if (this.ctx.secrets === void 0) throw new Error("matter-broker: ctx.secrets is required");
+		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, flattenPortsOver(records.kind(matterBrokersEntryKind))));
 		this.activeBrokers = await this.loadPersistedBrokers();
 		this.registry = new MatterBrokerRegistry(this.ctx.logger, {
 			dataDir: this.ctx.dataDir,
@@ -207619,6 +208903,10 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 				capability: brokerCapability,
 				provider: this.buildBrokerProvider()
 			},
+			{
+				capability: integrationInstancesCapability,
+				provider: this.requireInstances().toProvider()
+			},
 			{
 				capability: deviceAdoptionCapability,
 				provider: this.buildAdoptionProvider()
@@ -207626,21 +208914,50 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 		];
 	}
 	async loadPersistedBrokers() {
-		const store = this.brokerStore;
-		if (store !== null) {
-			const fromRecords = await store.listResolved();
-			if (fromRecords.length > 0) return fromRecords;
+		return this.requireBrokerStore().listResolved();
+	}
+	requireBrokerStore() {
+		if (this.brokerStore === null) throw new Error("matter-broker: broker store not ready");
+		return this.brokerStore;
+	}
+	requireInstances() {
+		if (this.instances === null) throw new Error("matter-broker: instances not ready");
+		return this.instances;
+	}
+	/**
+	* Bring the runtime in line with one record after the instances page changed it: a removed
+	* record stops its controller and cascades its devices, an off record only stops the
+	* controller, a live one re-applies its settings or starts under the record's own id.
+	*/
+	async syncBrokerRuntime(id) {
+		const reg = this.requireRegistry();
+		const entry = await this.requireBrokerStore().getById(id);
+		this.activeBrokers = await this.loadPersistedBrokers();
+		if (entry === null) {
+			await reg.removeEntry(id);
+			await this.cascadeRemoveDevicesForBroker(id);
+			return;
+		}
+		if (entry.enabled === false) {
+			await reg.removeEntry(id);
+			return;
+		}
+		try {
+			if (reg.get(id) !== null) await reg.updateEntry(id, entry.connection);
+			else await reg.createEntry(entry.name, entry.connection, {
+				id,
+				...entry.integrationId !== void 0 ? { integrationId: entry.integrationId } : {}
+			});
+		} catch (err) {
+			this.ctx.logger.warn("matter instance: could not start the fabric", { meta: {
+				brokerId: id,
+				error: errMsg(err)
+			} });
 		}
-		return this.config.brokers;
 	}
 	async persistBrokerEntries(entries) {
 		this.activeBrokers = [...entries];
-		const store = this.brokerStore;
-		if (store !== null) {
-			await store.replaceAll(entries);
-			return;
-		}
-		await this.updateGlobalSettings({ brokers: [...entries] });
+		await this.requireBrokerStore().replaceAll(entries);
 	}
 	async onConfigChanged() {
 		const reg = this.registry;
@@ -207658,6 +208975,7 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 			} });
 		}
 		for (const entry of persisted) {
+			if (entry.enabled === false) continue;
 			if (entry.id && liveIds.has(entry.id)) {
 				if (sameConnection(entry.connection, reg.getConnection(entry.id))) continue;
 				try {