@camstack/addon-matter-broker 0.2.155 → 0.2.157

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.157] - 2026-11-05
+
+### Changed
+
+- A Matter integration links to its fabric through the fabric record
+
+## [0.2.156] - 2026-11-04
+
+### Changed
+
+- The integration states its role (devices, services or both) to the Integrations page
+
 ## [0.2.155] - 2026-11-04
 
 ### Changed

package/dist/addon.js

@@ -5995,7 +5995,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BkzQdpzF.mjs
+//#region ../types/dist/sleep-9TIHFj1w.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6595,7 +6595,7 @@ var NOT_RUN = {
 * throws: an unreachable or refusing engine is logged and reported `declared: false`,
 * because the hub (and this addon's boot) must not hang on a migration.
 */
-async function runAddonMigrations(host, migrations, logger) {
+async function runAddonMigrations(host, migrations, logger, options = {}) {
 	const first = migrations[0];
 	if (first === void 0) return NOT_RUN;
 	const owner = first.meta.owner;
@@ -6624,7 +6624,9 @@ async function runAddonMigrations(host, migrations, logger) {
 		else if (status === "blocked") blocked.push(id);
 		else skipped.push(id);
 	};
+	const selected = options.only === void 0 ? null : new Set(options.only);
 	for (const step of declaration.steps) {
+		if (selected !== null && !selected.has(step.id)) continue;
 		const bound = byId.get(step.id);
 		if (bound === void 0 || step.action === "skip") {
 			skipped.push(step.id);
@@ -7784,14 +7786,18 @@ var BaseAddon = class {
 	* nothing; the boot continues. A migration that FAILED (or was blocked by one)
 	* and declares `onFailure: 'block-owner'` makes this throw, so the addon does not
 	* serve data whose shape it cannot trust; `tolerate` migrations never do.
+	*
+	* ALWAYS pass the whole catalogue; a phase that must run only some of it passes
+	* `{ only: [ids] }` — never a filtered catalogue (the engine would judge the
+	* omitted applied ids "newer").
 	*/
-	async runMigrations(migrations) {
+	async runMigrations(migrations, options) {
 		const api = this.ctx.api.migrations;
 		const report = await runAddonMigrations({
 			declareOwner: (input) => api.declareOwner.mutate(input),
 			startMigration: (input) => api.startMigration.mutate(input),
 			finishMigration: (input) => api.finishMigration.mutate(input)
-		}, migrations, this.ctx.logger);
+		}, migrations, this.ctx.logger, options);
 		if (report.blockOwner.length > 0) throw new AddonMigrationsBlockedError(report.blockOwner);
 		return report;
 	}
@@ -7933,10 +7939,9 @@ var BaseAddon = class {
 	*
 	* Override it only when an `instanceMode: multiple` addon's instances differ: an NVR integration
 	* needs its connection fields, the default integration the addon's own sections. It is the
-	* SHAPE of the form only — the values live in `integrations.getSettings`, and the write path is
-	* unchanged (`integrations.setSettings` for an account integration).
+	* SHAPE of the form only — the values live on the instance record.
 	*/
-	async integrationSettingsSchema(_instance) {
+	async integrationFormSchema(_instance) {
 		return null;
 	}
 	/**
@@ -7982,7 +7987,7 @@ var BaseAddon = class {
 	* per-instance schema when it declares one, else its global schema (what they always showed).
 	*/
 	async getIntegrationFormSchema(instance, nodeId) {
-		const scoped = await this.integrationSettingsSchema(instance);
+		const scoped = await this.integrationFormSchema(instance);
 		if (scoped === null) return this.getGlobalSettings(void 0, void 0, nodeId);
 		return hydrateSchema(scoped, {}, { inlineSecretsAsViews: true });
 	}
@@ -8831,6 +8836,10 @@ var RECORD_SECRET_COLLECTION_PREFIX = "records:";
 * (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
 * (`auth.accessToken`, `headers[].value`).
 *
+* `{}` after a key means "each value of this map" (`applianceSecrets{}`): the map's own key
+* names the value (`applianceSecrets{fridge}`), so no id key is declared and a body that drops a
+* key releases exactly that key's secret.
+*
 * Array elements are matched by a DECLARED id key (`secretArrayKeys`:
 * `{ headers: 'name' }`), never by index, so reordering a list keeps every
 * keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
@@ -8843,11 +8852,13 @@ function parseSecretPath(path) {
 	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
 	return path.split(".").map((raw) => {
 		const each = raw.endsWith("[]");
-		const key = each ? raw.slice(0, -2) : raw;
+		const map = raw.endsWith("{}");
+		const key = each || map ? raw.slice(0, -2) : raw;
 		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
 		return {
 			key,
-			each
+			each,
+			map
 		};
 	});
 }
@@ -8899,6 +8910,22 @@ function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arra
 			[segment.key]: mapped
 		};
 	}
+	if (segment.map) {
+		if (!isRecord$4$1(child)) return node;
+		const kept = Object.entries(child).map(([mapKey, value]) => {
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}{${encodeURIComponent(mapKey)}}`;
+			if (!last) return [mapKey, mapAt(value, segments, index + 1, keys, concrete, declared, arrayKeys, visit)];
+			return [mapKey, visit({
+				declared,
+				concrete,
+				value
+			})];
+		}).filter(([, value]) => value !== REMOVE_LEAF);
+		return {
+			...node,
+			[segment.key]: Object.fromEntries(kept)
+		};
+	}
 	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
 	if (last) {
 		const replacement = visit({
@@ -9040,7 +9067,8 @@ function isZodSecret(schema) {
 }
 /**
 * Every declared secret path in a config schema: dotted keys, `[]` for "each
-* element of this array" (`connection.password`, `rows[].token`). A declared
+* element of this array" (`connection.password`, `rows[].token`), `{}` for "each value of this
+* map" (`applianceSecrets{}`). A declared
 * object or array is reported as one path and not descended into — everything
 * under it is secret.
 */
@@ -9051,6 +9079,7 @@ function collectZodSecretPaths(schema, prefix = "") {
 		const def = defOf(layer);
 		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
 		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "record" && def.valueType) paths.push(...collectZodSecretPaths(def.valueType, `${prefix}{}`));
 		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
 		else if (def.type === "intersection") {
 			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
@@ -9232,6 +9261,7 @@ function defineEntryKind(name, spec) {
 		class: "config",
 		writeTrigger: spec.writeTrigger ?? "an operator adds or edits an entry in the entries UI",
 		retention: { none: "an entry goes only when the operator deletes it" },
+		...spec.maxDataBytes === void 0 ? {} : { maxDataBytes: spec.maxDataBytes },
 		...spec.database === void 0 ? {} : { database: spec.database },
 		...spec.indexes === void 0 ? {} : { indexes: spec.indexes },
 		...spec.secretArrayKeys === void 0 ? {} : { secretArrayKeys: spec.secretArrayKeys },
@@ -11901,7 +11931,7 @@ object({
 	params: record(string$2(), union([string$2(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/composition-CRNwcFYY.mjs
+//#region ../types/dist/composition-pOHbTzRB.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -13248,11 +13278,49 @@ var IntegrationInstanceRefSchema = object({
 	]),
 	candidateStableId: string$2().optional()
 });
+/**
+* `RecordIntegrationInstances` - the `integration-instances` provider over ONE
+* entry kind, so an addon that holds a connection serves it in ~30 lines.
+*
+* Every instance is one record of the addon's own kind, keyed by the
+* `integrations` registry id. The records door does the secret work: a field the
+* kind marks `.meta({ secret: true })` is a keychain marker bound to the row, so
+* deleting the row deletes the secret, and one row's value is never another's.
+*
+* Patch rules for a secret (`updateInstance`): omitted, `''`, the redaction
+* token or the view the form was given KEEP the stored secret;
+* `{ $secretClear: true }` clears it; any other string replaces it.
+*/
 /** The most instances one addon lists (an integrations page, not a table). */
 var INSTANCES_LIST_MAX = 1e3;
 /** The keys of the kind's secret fields that sit at the top level of the body. */
 function topLevelSecretKeys(paths) {
-	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[")));
+	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[") && !p.includes("{")));
+}
+/** The keys of the kind's top-level MAPS whose values are secrets (`applianceSecrets{}`). */
+function secretMapKeys(paths) {
+	return new Set(paths.filter((p) => p.endsWith("{}") && !p.slice(0, -2).match(/[.[{]/)).map((p) => p.slice(0, -2)));
+}
+/**
+* A patch value for a map of secrets: an entry that is omitted, `''`, the redaction token or the
+* view the form was given KEEPS its stored secret (it is left out of the merge); `{ $secretClear }`
+* or `null` removes the entry; any other string replaces it. Null when nothing is left to merge.
+*/
+function secretMapPatch(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) if (entry === null || isSecretClear(entry)) out[key] = null;
+	else if (typeof entry === "string" && entry !== "" && entry !== "__camstack_redacted__" && !isSecretFieldView(entry)) out[key] = entry;
+	return Object.keys(out).length > 0 ? out : null;
+}
+/** Does the kind's body schema carry an `enabled` field? */
+function declaresEnabled(kind) {
+	const json = toJSONSchema(kind.schema, {
+		unrepresentable: "any",
+		io: "input"
+	});
+	const properties = Reflect.get(json, "properties");
+	return typeof properties === "object" && properties !== null && "enabled" in properties;
 }
 var RecordIntegrationInstances = class {
 	records;
@@ -13260,14 +13328,20 @@ var RecordIntegrationInstances = class {
 	hooks;
 	handle;
 	secretKeys;
+	secretMaps;
 	nameField;
+	/** The `integrations` registry owns the on/off switch (`role: devices`); the body has none. */
+	registryOwnsEnabled;
 	constructor(records, kind, hooks) {
 		this.records = records;
 		this.kind = kind;
 		this.hooks = hooks;
 		this.handle = records.kind(kind);
 		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
+		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
 		this.nameField = kind.declaration.entry?.nameField ?? "name";
+		this.registryOwnsEnabled = hooks.description.role === "devices";
+		if (this.registryOwnsEnabled && declaresEnabled(kind)) throw new Error(`kind "${kind.name}": the integrations registry owns the on/off switch of a role "devices" addon, so the body must not declare "enabled"`);
 	}
 	/**
 	* One instance read for the addon's own runtime; null when absent. When the keychain is
@@ -13318,7 +13392,7 @@ var RecordIntegrationInstances = class {
 			id: record.id,
 			name: typeof rawName === "string" ? rawName : record.id,
 			configured: this.hooks.configured(record.data),
-			enabled: record.data.enabled !== false,
+			...this.registryOwnsEnabled ? {} : { enabled: record.data.enabled !== false },
 			formValues: shown,
 			...kind !== void 0 ? { kind } : {},
 			...health?.status !== void 0 ? { status: health.status } : {},
@@ -13348,32 +13422,36 @@ var RecordIntegrationInstances = class {
 			id: minted,
 			data: this.hooks.initialBody(name, kind)
 		}, { ifRev: 0 });
-		await this.hooks.onChanged?.(minted);
+		await this.hooks.onChanged?.(minted, "created");
 		return { id: minted };
 	};
 	updateInstance = async ({ id, name, values }) => {
 		const patch = {};
 		for (const [key, value] of Object.entries(values)) {
 			if (value === void 0) continue;
-			if (!this.secretKeys.has(key)) patch[key] = value;
+			if (this.secretMaps.has(key)) {
+				const entries = secretMapPatch(value);
+				if (entries !== null) patch[key] = entries;
+			} else if (!this.secretKeys.has(key)) patch[key] = value;
 			else if (isSecretClear(value)) patch[key] = null;
 			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
 		}
 		if (name !== void 0) patch[this.nameField] = name;
 		await this.handle.patch(id, patch);
-		await this.hooks.onChanged?.(id);
+		await this.hooks.onChanged?.(id, "updated");
 		return { ok: true };
 	};
 	/** The switch lives in the record body; the addon is told so it applies it (D996). */
 	setInstanceEnabled = async ({ id, enabled }) => {
+		if (this.registryOwnsEnabled) throw new Error(`instance "${id}": the integrations registry owns the on/off switch of this addon; set it with integrations.update`);
 		await this.handle.patch(id, { enabled });
-		await this.hooks.onChanged?.(id);
+		await this.hooks.onChanged?.(id, "enabled");
 		return { ok: true };
 	};
 	/** The row and its keychain refs go together (the records door). */
 	deleteInstance = async ({ id }) => {
 		await this.handle.delete(id);
-		await this.hooks.onChanged?.(id);
+		await this.hooks.onChanged?.(id, "deleted");
 		return { ok: true };
 	};
 	testInstance = async (input) => {
@@ -14434,7 +14512,13 @@ var MigrationLedgerEntrySchema = object({
 	* joined by the engine from the catalogues it knows this boot. Absent when no
 	* catalogue lists the id (a newer database).
 	*/
-	meta: MigrationMetaSchema.optional()
+	meta: MigrationMetaSchema.optional(),
+	/**
+	* Set when this is an applied row of an addon owner whose catalogue the answering
+	* process has not loaded (the owner has not declared yet): the row is applied, the
+	* process just cannot judge it. Never `skipped-newer` — that needs the owner loaded.
+	*/
+	ownerNotLoaded: boolean().optional()
 });
 /** A catalogued migration that is not applied, with where it stands. */
 var MigrationPendingEntrySchema = object({
@@ -50169,6 +50253,9 @@ var RunningProposalEvidenceSchema = object({
 	runsFound: number().int().nonnegative(),
 	pausesFound: number().int().nonnegative(),
 	longestPauseMs: number().nonnegative(),
+	/** Episodes shorter than ~90 s (an anti-crease pulse, a display waking): never a run, never a pause. */
+	pulsesFound: number().int().nonnegative(),
+	longestPulseMs: number().nonnegative(),
 	idleFloorW: number(),
 	noiseCeilingW: number(),
 	plateauW: number(),
@@ -56014,11 +56101,7 @@ var CreateIntegrationInputSchema = object({
 	info: record(string$2(), unknown()).optional(),
 	/** `stableId` of the discovery candidate the form was seeded from (D984). */
 	originStableId: string$2().optional(),
-	settings: record(string$2(), unknown()).optional(),
-	/** Keys of `settings` the form's schema declares secret (by type) — kept in
-	*  the keychain, not the table (D787). */
-	secretKeys: array(string$2()).optional(),
-	skipRestart: boolean().optional()
+	settings: record(string$2(), unknown()).optional()
 });
 var UpdateIntegrationInputSchema = object({
 	id: string$2(),
@@ -56039,16 +56122,6 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string$2
 }), method(object({ id: string$2() }), DeleteIntegrationResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ id: string$2() }), record(string$2(), unknown()), { auth: "admin" }), method(object({
-	id: string$2(),
-	settings: record(string$2(), unknown()),
-	/** Keys the form's schema declares secret (by type) — keychain-stored (D787). */
-	secretKeys: array(string$2()).optional(),
-	/** The integration's own addon applies the change in-process and asks the hub not to respawn it. */
-	skipRestart: boolean().optional()
-}), object({ success: boolean() }), {
-	kind: "mutation",
-	auth: "admin"
 }), method(_void(), array(AvailableIntegrationTypeSchema), { auth: "admin" }), method(object({
 	addonId: string$2(),
 	settings: record(string$2(), unknown())
@@ -56100,6 +56173,21 @@ var IntegrationInstanceKindSchema = object({
 	disconnectPath: string$2().min(1).optional()
 });
 var IntegrationInstanceDescriptionSchema = object({
+	/** What the instances are for the Integrations page; see {@link IntegrationInstanceRoleSchema}. */
+	role: _enum([
+		"devices",
+		"services",
+		"both"
+	]),
+	/** How the devices of an instance are found; absent means `{ mode: 'none' }`. */
+	discovery: object({
+		mode: _enum([
+			"none",
+			"lan",
+			"account"
+		]),
+		scopedToInstance: boolean()
+	}).optional(),
 	/** `single`: at most one instance can exist (Loki). `multiple`: an account each. */
 	instanceMode: IntegrationInstanceModeSchema,
 	/** What the instance is, for the UI (`destination`, `relay`, `account`). */
@@ -56139,10 +56227,11 @@ var IntegrationInstanceSchema = object({
 	/** The addon's own rule (an URL is present, a client id is present...). */
 	configured: boolean(),
 	/**
-	* The instance's own on/off switch (D996): always present, derived from the record body
-	* (`enabled !== false`, so a row written before the field existed is on).
+	* The instance's own on/off switch (D996), derived from the record body (`enabled !== false`,
+	* so a row written before the field existed is on). Absent when the `integrations` registry
+	* owns the switch (`describe().role` is `devices`): read it from the registry row.
 	*/
-	enabled: boolean(),
+	enabled: boolean().optional(),
 	/** The kind of this instance (one of `describe().kinds[].id`), when the provider has kinds. */
 	kind: string$2().optional(),
 	/** Values for the instance form; a secret is a `SecretFieldView`, never text. */
@@ -59009,6 +59098,27 @@ method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { aut
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ integrationId: string$2().min(1) }), record(string$2(), unknown()), { auth: "admin" }), method(object({ integrationId: string$2().min(1) }), object({
+	rows: number().int().nonnegative(),
+	secrets: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	integrationId: string$2().min(1),
+	patch: record(string$2(), unknown())
+}), object({ written: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	integrationId: string$2().min(1),
+	keys: array(string$2().min(1))
+}), object({
+	present: boolean(),
+	removed: record(string$2(), unknown())
+}), {
+	kind: "mutation",
+	auth: "admin"
 });
 method(object({
 	sourceUrl: string$2(),
@@ -80335,11 +80445,15 @@ discriminatedUnion("kind", [object({
 *  1. idle floor F = time-weighted median; noise ceiling N = highest value seen
 *     near F. A device that is not near one level most of the time has no floor.
 *  2. coarse activity = above max(2N, N + 5 W); consecutive stretches are episodes.
-*  3. gaps between episodes split in two by the largest log-scale jump (>= 3x):
-*     the short ones are pauses INSIDE a run (a soak), the long ones separate runs.
+*  3. an episode shorter than `PULSE_MAX_MS` is a PULSE (an anti-crease tumble, a
+*     display waking): it is neither a run nor a pause. Among the remaining
+*     episodes, gaps over `PAUSE_MAX_MS` always separate runs; the rest split in
+*     two by the largest log-scale jump (>= 3x): the short ones are pauses INSIDE
+*     a run (a soak), the long ones separate runs. A stretch under `MIN_RUN_MS`
+*     is no run.
 *  4. T = geometric mean of N and the plateau's 10th percentile, snapped to a
-*     grid a person would type; stop dwell covers the longest pause; start dwell
-*     covers the longest standby blip above T.
+*     grid a person would type; stop dwell covers the longest pause and the
+*     kind's floor; start dwell covers the longest pulse and standby blip above T.
 *  5. the numbers are proved by REPLAY through the real `dwell` evaluation: each
 *     run must hold exactly one true interval and nothing may flap outside.
 */
@@ -80350,6 +80464,10 @@ var MINUTE_MS$1 = 60 * SECOND_MS;
 30 * SECOND_MS;
 60 * SECOND_MS;
 20 * MINUTE_MS$1;
+90 * SECOND_MS;
+30 * MINUTE_MS$1;
+10 * MINUTE_MS$1;
+DeviceType.Dryer, 3 * MINUTE_MS$1, DeviceType.Dishwasher, 3 * MINUTE_MS$1, DeviceType.Washer, 10 * MINUTE_MS$1;
 10 * SECOND_MS;
 10 * SECOND_MS;
 DeviceFeature.FanSpeed, DeviceFeature.FanPreset, DeviceFeature.FanDirection, DeviceFeature.FanOscillating, DeviceFeature.CoverStoppable, DeviceFeature.CoverPositionable, DeviceFeature.CoverTilt, DeviceFeature.ValvePositionable, DeviceFeature.MediaPlayerVolume, DeviceFeature.ClimateFanMode;
@@ -85669,13 +85787,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"integrations.getSettings": {
-		capName: "integrations",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"integrations.list": {
 		capName: "integrations",
 		capScope: "system",
@@ -85683,13 +85794,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"integrations.setSettings": {
-		capName: "integrations",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"integrations.testConnection": {
 		capName: "integrations",
 		capScope: "system",
@@ -86684,6 +86788,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"migrations.clearLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
 	"migrations.declareOwner": {
 		capName: "migrations",
 		capScope: "system",
@@ -86691,6 +86802,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"migrations.deleteLegacyIntegrationRowKeys": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
 	"migrations.dryRun": {
 		capName: "migrations",
 		capScope: "system",
@@ -86726,6 +86844,20 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"migrations.patchLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.readLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"migrations.restorePreMigration": {
 		capName: "migrations",
 		capScope: "system",
@@ -208592,6 +208724,7 @@ function statusOf(info) {
 function buildMatterInstances(records, deps) {
 	return new RecordIntegrationInstances(records, matterBrokersEntryKind, {
 		description: {
+			role: "both",
 			instanceMode: "multiple",
 			kind: "connection",
 			canTest: true,
@@ -209011,18 +209144,10 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 		try {
 			const mine = (await this.ctx.api.integrations.list.query()).filter((i) => i.addonId === this.ctx.id);
 			const surviving = new Set(mine.map((i) => i.id));
-			for (const integration of mine) {
-				const settings = await this.ctx.api.integrations.getSettings.query({ id: integration.id });
-				const brokerId = typeof settings["brokerId"] === "string" ? settings["brokerId"] : void 0;
-				if (brokerId === void 0) continue;
-				if (!this.activeBrokers.some((b) => b.id === brokerId)) {
-					this.ctx.logger.warn("Matter integration→broker: linked broker not found", { meta: {
-						integrationId: integration.id,
-						brokerId
-					} });
-					continue;
-				}
-				this.requireRegistry().linkIntegration(integration.id, brokerId);
+			for (const broker of this.activeBrokers) {
+				const integrationId = broker.integrationId;
+				if (integrationId === void 0 || !surviving.has(integrationId)) continue;
+				this.requireRegistry().linkIntegration(integrationId, broker.id);
 			}
 			const toRemove = this.activeBrokers.filter((b) => b.integrationId !== void 0 && !surviving.has(b.integrationId)).map((b) => b.id);
 			if (toRemove.length === 0) return;
@@ -209063,9 +209188,9 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 			},
 			logger: this.ctx.logger,
 			getBrokerIdForIntegration: async (id) => {
-				const brokerId = (await this.ctx.api.integrations.getSettings.query({ id }))["brokerId"];
-				if (typeof brokerId !== "string") throw new Error(`integration ${id} has no linked brokerId`);
-				return brokerId;
+				const broker = this.activeBrokers.find((entry) => entry.integrationId === id);
+				if (broker === void 0) throw new Error(`integration ${id} has no linked brokerId`);
+				return broker.id;
 			},
 			listAdoptedMatter: async () => {
 				const reg = this.ctx.kernel.deviceRegistry;

package/dist/addon.mjs

@@ -5993,7 +5993,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BkzQdpzF.mjs
+//#region ../types/dist/sleep-9TIHFj1w.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6593,7 +6593,7 @@ var NOT_RUN = {
 * throws: an unreachable or refusing engine is logged and reported `declared: false`,
 * because the hub (and this addon's boot) must not hang on a migration.
 */
-async function runAddonMigrations(host, migrations, logger) {
+async function runAddonMigrations(host, migrations, logger, options = {}) {
 	const first = migrations[0];
 	if (first === void 0) return NOT_RUN;
 	const owner = first.meta.owner;
@@ -6622,7 +6622,9 @@ async function runAddonMigrations(host, migrations, logger) {
 		else if (status === "blocked") blocked.push(id);
 		else skipped.push(id);
 	};
+	const selected = options.only === void 0 ? null : new Set(options.only);
 	for (const step of declaration.steps) {
+		if (selected !== null && !selected.has(step.id)) continue;
 		const bound = byId.get(step.id);
 		if (bound === void 0 || step.action === "skip") {
 			skipped.push(step.id);
@@ -7782,14 +7784,18 @@ var BaseAddon = class {
 	* nothing; the boot continues. A migration that FAILED (or was blocked by one)
 	* and declares `onFailure: 'block-owner'` makes this throw, so the addon does not
 	* serve data whose shape it cannot trust; `tolerate` migrations never do.
+	*
+	* ALWAYS pass the whole catalogue; a phase that must run only some of it passes
+	* `{ only: [ids] }` — never a filtered catalogue (the engine would judge the
+	* omitted applied ids "newer").
 	*/
-	async runMigrations(migrations) {
+	async runMigrations(migrations, options) {
 		const api = this.ctx.api.migrations;
 		const report = await runAddonMigrations({
 			declareOwner: (input) => api.declareOwner.mutate(input),
 			startMigration: (input) => api.startMigration.mutate(input),
 			finishMigration: (input) => api.finishMigration.mutate(input)
-		}, migrations, this.ctx.logger);
+		}, migrations, this.ctx.logger, options);
 		if (report.blockOwner.length > 0) throw new AddonMigrationsBlockedError(report.blockOwner);
 		return report;
 	}
@@ -7931,10 +7937,9 @@ var BaseAddon = class {
 	*
 	* Override it only when an `instanceMode: multiple` addon's instances differ: an NVR integration
 	* needs its connection fields, the default integration the addon's own sections. It is the
-	* SHAPE of the form only — the values live in `integrations.getSettings`, and the write path is
-	* unchanged (`integrations.setSettings` for an account integration).
+	* SHAPE of the form only — the values live on the instance record.
 	*/
-	async integrationSettingsSchema(_instance) {
+	async integrationFormSchema(_instance) {
 		return null;
 	}
 	/**
@@ -7980,7 +7985,7 @@ var BaseAddon = class {
 	* per-instance schema when it declares one, else its global schema (what they always showed).
 	*/
 	async getIntegrationFormSchema(instance, nodeId) {
-		const scoped = await this.integrationSettingsSchema(instance);
+		const scoped = await this.integrationFormSchema(instance);
 		if (scoped === null) return this.getGlobalSettings(void 0, void 0, nodeId);
 		return hydrateSchema(scoped, {}, { inlineSecretsAsViews: true });
 	}
@@ -8829,6 +8834,10 @@ var RECORD_SECRET_COLLECTION_PREFIX = "records:";
 * (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
 * (`auth.accessToken`, `headers[].value`).
 *
+* `{}` after a key means "each value of this map" (`applianceSecrets{}`): the map's own key
+* names the value (`applianceSecrets{fridge}`), so no id key is declared and a body that drops a
+* key releases exactly that key's secret.
+*
 * Array elements are matched by a DECLARED id key (`secretArrayKeys`:
 * `{ headers: 'name' }`), never by index, so reordering a list keeps every
 * keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
@@ -8841,11 +8850,13 @@ function parseSecretPath(path) {
 	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
 	return path.split(".").map((raw) => {
 		const each = raw.endsWith("[]");
-		const key = each ? raw.slice(0, -2) : raw;
+		const map = raw.endsWith("{}");
+		const key = each || map ? raw.slice(0, -2) : raw;
 		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
 		return {
 			key,
-			each
+			each,
+			map
 		};
 	});
 }
@@ -8897,6 +8908,22 @@ function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arra
 			[segment.key]: mapped
 		};
 	}
+	if (segment.map) {
+		if (!isRecord$4$1(child)) return node;
+		const kept = Object.entries(child).map(([mapKey, value]) => {
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}{${encodeURIComponent(mapKey)}}`;
+			if (!last) return [mapKey, mapAt(value, segments, index + 1, keys, concrete, declared, arrayKeys, visit)];
+			return [mapKey, visit({
+				declared,
+				concrete,
+				value
+			})];
+		}).filter(([, value]) => value !== REMOVE_LEAF);
+		return {
+			...node,
+			[segment.key]: Object.fromEntries(kept)
+		};
+	}
 	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
 	if (last) {
 		const replacement = visit({
@@ -9038,7 +9065,8 @@ function isZodSecret(schema) {
 }
 /**
 * Every declared secret path in a config schema: dotted keys, `[]` for "each
-* element of this array" (`connection.password`, `rows[].token`). A declared
+* element of this array" (`connection.password`, `rows[].token`), `{}` for "each value of this
+* map" (`applianceSecrets{}`). A declared
 * object or array is reported as one path and not descended into — everything
 * under it is secret.
 */
@@ -9049,6 +9077,7 @@ function collectZodSecretPaths(schema, prefix = "") {
 		const def = defOf(layer);
 		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
 		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "record" && def.valueType) paths.push(...collectZodSecretPaths(def.valueType, `${prefix}{}`));
 		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
 		else if (def.type === "intersection") {
 			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
@@ -9230,6 +9259,7 @@ function defineEntryKind(name, spec) {
 		class: "config",
 		writeTrigger: spec.writeTrigger ?? "an operator adds or edits an entry in the entries UI",
 		retention: { none: "an entry goes only when the operator deletes it" },
+		...spec.maxDataBytes === void 0 ? {} : { maxDataBytes: spec.maxDataBytes },
 		...spec.database === void 0 ? {} : { database: spec.database },
 		...spec.indexes === void 0 ? {} : { indexes: spec.indexes },
 		...spec.secretArrayKeys === void 0 ? {} : { secretArrayKeys: spec.secretArrayKeys },
@@ -11899,7 +11929,7 @@ object({
 	params: record(string$2(), union([string$2(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/composition-CRNwcFYY.mjs
+//#region ../types/dist/composition-pOHbTzRB.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -13246,11 +13276,49 @@ var IntegrationInstanceRefSchema = object({
 	]),
 	candidateStableId: string$2().optional()
 });
+/**
+* `RecordIntegrationInstances` - the `integration-instances` provider over ONE
+* entry kind, so an addon that holds a connection serves it in ~30 lines.
+*
+* Every instance is one record of the addon's own kind, keyed by the
+* `integrations` registry id. The records door does the secret work: a field the
+* kind marks `.meta({ secret: true })` is a keychain marker bound to the row, so
+* deleting the row deletes the secret, and one row's value is never another's.
+*
+* Patch rules for a secret (`updateInstance`): omitted, `''`, the redaction
+* token or the view the form was given KEEP the stored secret;
+* `{ $secretClear: true }` clears it; any other string replaces it.
+*/
 /** The most instances one addon lists (an integrations page, not a table). */
 var INSTANCES_LIST_MAX = 1e3;
 /** The keys of the kind's secret fields that sit at the top level of the body. */
 function topLevelSecretKeys(paths) {
-	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[")));
+	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[") && !p.includes("{")));
+}
+/** The keys of the kind's top-level MAPS whose values are secrets (`applianceSecrets{}`). */
+function secretMapKeys(paths) {
+	return new Set(paths.filter((p) => p.endsWith("{}") && !p.slice(0, -2).match(/[.[{]/)).map((p) => p.slice(0, -2)));
+}
+/**
+* A patch value for a map of secrets: an entry that is omitted, `''`, the redaction token or the
+* view the form was given KEEPS its stored secret (it is left out of the merge); `{ $secretClear }`
+* or `null` removes the entry; any other string replaces it. Null when nothing is left to merge.
+*/
+function secretMapPatch(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) if (entry === null || isSecretClear(entry)) out[key] = null;
+	else if (typeof entry === "string" && entry !== "" && entry !== "__camstack_redacted__" && !isSecretFieldView(entry)) out[key] = entry;
+	return Object.keys(out).length > 0 ? out : null;
+}
+/** Does the kind's body schema carry an `enabled` field? */
+function declaresEnabled(kind) {
+	const json = toJSONSchema(kind.schema, {
+		unrepresentable: "any",
+		io: "input"
+	});
+	const properties = Reflect.get(json, "properties");
+	return typeof properties === "object" && properties !== null && "enabled" in properties;
 }
 var RecordIntegrationInstances = class {
 	records;
@@ -13258,14 +13326,20 @@ var RecordIntegrationInstances = class {
 	hooks;
 	handle;
 	secretKeys;
+	secretMaps;
 	nameField;
+	/** The `integrations` registry owns the on/off switch (`role: devices`); the body has none. */
+	registryOwnsEnabled;
 	constructor(records, kind, hooks) {
 		this.records = records;
 		this.kind = kind;
 		this.hooks = hooks;
 		this.handle = records.kind(kind);
 		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
+		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
 		this.nameField = kind.declaration.entry?.nameField ?? "name";
+		this.registryOwnsEnabled = hooks.description.role === "devices";
+		if (this.registryOwnsEnabled && declaresEnabled(kind)) throw new Error(`kind "${kind.name}": the integrations registry owns the on/off switch of a role "devices" addon, so the body must not declare "enabled"`);
 	}
 	/**
 	* One instance read for the addon's own runtime; null when absent. When the keychain is
@@ -13316,7 +13390,7 @@ var RecordIntegrationInstances = class {
 			id: record.id,
 			name: typeof rawName === "string" ? rawName : record.id,
 			configured: this.hooks.configured(record.data),
-			enabled: record.data.enabled !== false,
+			...this.registryOwnsEnabled ? {} : { enabled: record.data.enabled !== false },
 			formValues: shown,
 			...kind !== void 0 ? { kind } : {},
 			...health?.status !== void 0 ? { status: health.status } : {},
@@ -13346,32 +13420,36 @@ var RecordIntegrationInstances = class {
 			id: minted,
 			data: this.hooks.initialBody(name, kind)
 		}, { ifRev: 0 });
-		await this.hooks.onChanged?.(minted);
+		await this.hooks.onChanged?.(minted, "created");
 		return { id: minted };
 	};
 	updateInstance = async ({ id, name, values }) => {
 		const patch = {};
 		for (const [key, value] of Object.entries(values)) {
 			if (value === void 0) continue;
-			if (!this.secretKeys.has(key)) patch[key] = value;
+			if (this.secretMaps.has(key)) {
+				const entries = secretMapPatch(value);
+				if (entries !== null) patch[key] = entries;
+			} else if (!this.secretKeys.has(key)) patch[key] = value;
 			else if (isSecretClear(value)) patch[key] = null;
 			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
 		}
 		if (name !== void 0) patch[this.nameField] = name;
 		await this.handle.patch(id, patch);
-		await this.hooks.onChanged?.(id);
+		await this.hooks.onChanged?.(id, "updated");
 		return { ok: true };
 	};
 	/** The switch lives in the record body; the addon is told so it applies it (D996). */
 	setInstanceEnabled = async ({ id, enabled }) => {
+		if (this.registryOwnsEnabled) throw new Error(`instance "${id}": the integrations registry owns the on/off switch of this addon; set it with integrations.update`);
 		await this.handle.patch(id, { enabled });
-		await this.hooks.onChanged?.(id);
+		await this.hooks.onChanged?.(id, "enabled");
 		return { ok: true };
 	};
 	/** The row and its keychain refs go together (the records door). */
 	deleteInstance = async ({ id }) => {
 		await this.handle.delete(id);
-		await this.hooks.onChanged?.(id);
+		await this.hooks.onChanged?.(id, "deleted");
 		return { ok: true };
 	};
 	testInstance = async (input) => {
@@ -14432,7 +14510,13 @@ var MigrationLedgerEntrySchema = object({
 	* joined by the engine from the catalogues it knows this boot. Absent when no
 	* catalogue lists the id (a newer database).
 	*/
-	meta: MigrationMetaSchema.optional()
+	meta: MigrationMetaSchema.optional(),
+	/**
+	* Set when this is an applied row of an addon owner whose catalogue the answering
+	* process has not loaded (the owner has not declared yet): the row is applied, the
+	* process just cannot judge it. Never `skipped-newer` — that needs the owner loaded.
+	*/
+	ownerNotLoaded: boolean().optional()
 });
 /** A catalogued migration that is not applied, with where it stands. */
 var MigrationPendingEntrySchema = object({
@@ -50167,6 +50251,9 @@ var RunningProposalEvidenceSchema = object({
 	runsFound: number().int().nonnegative(),
 	pausesFound: number().int().nonnegative(),
 	longestPauseMs: number().nonnegative(),
+	/** Episodes shorter than ~90 s (an anti-crease pulse, a display waking): never a run, never a pause. */
+	pulsesFound: number().int().nonnegative(),
+	longestPulseMs: number().nonnegative(),
 	idleFloorW: number(),
 	noiseCeilingW: number(),
 	plateauW: number(),
@@ -56012,11 +56099,7 @@ var CreateIntegrationInputSchema = object({
 	info: record(string$2(), unknown()).optional(),
 	/** `stableId` of the discovery candidate the form was seeded from (D984). */
 	originStableId: string$2().optional(),
-	settings: record(string$2(), unknown()).optional(),
-	/** Keys of `settings` the form's schema declares secret (by type) — kept in
-	*  the keychain, not the table (D787). */
-	secretKeys: array(string$2()).optional(),
-	skipRestart: boolean().optional()
+	settings: record(string$2(), unknown()).optional()
 });
 var UpdateIntegrationInputSchema = object({
 	id: string$2(),
@@ -56037,16 +56120,6 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string$2
 }), method(object({ id: string$2() }), DeleteIntegrationResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ id: string$2() }), record(string$2(), unknown()), { auth: "admin" }), method(object({
-	id: string$2(),
-	settings: record(string$2(), unknown()),
-	/** Keys the form's schema declares secret (by type) — keychain-stored (D787). */
-	secretKeys: array(string$2()).optional(),
-	/** The integration's own addon applies the change in-process and asks the hub not to respawn it. */
-	skipRestart: boolean().optional()
-}), object({ success: boolean() }), {
-	kind: "mutation",
-	auth: "admin"
 }), method(_void(), array(AvailableIntegrationTypeSchema), { auth: "admin" }), method(object({
 	addonId: string$2(),
 	settings: record(string$2(), unknown())
@@ -56098,6 +56171,21 @@ var IntegrationInstanceKindSchema = object({
 	disconnectPath: string$2().min(1).optional()
 });
 var IntegrationInstanceDescriptionSchema = object({
+	/** What the instances are for the Integrations page; see {@link IntegrationInstanceRoleSchema}. */
+	role: _enum([
+		"devices",
+		"services",
+		"both"
+	]),
+	/** How the devices of an instance are found; absent means `{ mode: 'none' }`. */
+	discovery: object({
+		mode: _enum([
+			"none",
+			"lan",
+			"account"
+		]),
+		scopedToInstance: boolean()
+	}).optional(),
 	/** `single`: at most one instance can exist (Loki). `multiple`: an account each. */
 	instanceMode: IntegrationInstanceModeSchema,
 	/** What the instance is, for the UI (`destination`, `relay`, `account`). */
@@ -56137,10 +56225,11 @@ var IntegrationInstanceSchema = object({
 	/** The addon's own rule (an URL is present, a client id is present...). */
 	configured: boolean(),
 	/**
-	* The instance's own on/off switch (D996): always present, derived from the record body
-	* (`enabled !== false`, so a row written before the field existed is on).
+	* The instance's own on/off switch (D996), derived from the record body (`enabled !== false`,
+	* so a row written before the field existed is on). Absent when the `integrations` registry
+	* owns the switch (`describe().role` is `devices`): read it from the registry row.
 	*/
-	enabled: boolean(),
+	enabled: boolean().optional(),
 	/** The kind of this instance (one of `describe().kinds[].id`), when the provider has kinds. */
 	kind: string$2().optional(),
 	/** Values for the instance form; a secret is a `SecretFieldView`, never text. */
@@ -59007,6 +59096,27 @@ method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { aut
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ integrationId: string$2().min(1) }), record(string$2(), unknown()), { auth: "admin" }), method(object({ integrationId: string$2().min(1) }), object({
+	rows: number().int().nonnegative(),
+	secrets: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	integrationId: string$2().min(1),
+	patch: record(string$2(), unknown())
+}), object({ written: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	integrationId: string$2().min(1),
+	keys: array(string$2().min(1))
+}), object({
+	present: boolean(),
+	removed: record(string$2(), unknown())
+}), {
+	kind: "mutation",
+	auth: "admin"
 });
 method(object({
 	sourceUrl: string$2(),
@@ -80333,11 +80443,15 @@ discriminatedUnion("kind", [object({
 *  1. idle floor F = time-weighted median; noise ceiling N = highest value seen
 *     near F. A device that is not near one level most of the time has no floor.
 *  2. coarse activity = above max(2N, N + 5 W); consecutive stretches are episodes.
-*  3. gaps between episodes split in two by the largest log-scale jump (>= 3x):
-*     the short ones are pauses INSIDE a run (a soak), the long ones separate runs.
+*  3. an episode shorter than `PULSE_MAX_MS` is a PULSE (an anti-crease tumble, a
+*     display waking): it is neither a run nor a pause. Among the remaining
+*     episodes, gaps over `PAUSE_MAX_MS` always separate runs; the rest split in
+*     two by the largest log-scale jump (>= 3x): the short ones are pauses INSIDE
+*     a run (a soak), the long ones separate runs. A stretch under `MIN_RUN_MS`
+*     is no run.
 *  4. T = geometric mean of N and the plateau's 10th percentile, snapped to a
-*     grid a person would type; stop dwell covers the longest pause; start dwell
-*     covers the longest standby blip above T.
+*     grid a person would type; stop dwell covers the longest pause and the
+*     kind's floor; start dwell covers the longest pulse and standby blip above T.
 *  5. the numbers are proved by REPLAY through the real `dwell` evaluation: each
 *     run must hold exactly one true interval and nothing may flap outside.
 */
@@ -80348,6 +80462,10 @@ var MINUTE_MS$1 = 60 * SECOND_MS;
 30 * SECOND_MS;
 60 * SECOND_MS;
 20 * MINUTE_MS$1;
+90 * SECOND_MS;
+30 * MINUTE_MS$1;
+10 * MINUTE_MS$1;
+DeviceType.Dryer, 3 * MINUTE_MS$1, DeviceType.Dishwasher, 3 * MINUTE_MS$1, DeviceType.Washer, 10 * MINUTE_MS$1;
 10 * SECOND_MS;
 10 * SECOND_MS;
 DeviceFeature.FanSpeed, DeviceFeature.FanPreset, DeviceFeature.FanDirection, DeviceFeature.FanOscillating, DeviceFeature.CoverStoppable, DeviceFeature.CoverPositionable, DeviceFeature.CoverTilt, DeviceFeature.ValvePositionable, DeviceFeature.MediaPlayerVolume, DeviceFeature.ClimateFanMode;
@@ -85667,13 +85785,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"integrations.getSettings": {
-		capName: "integrations",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"integrations.list": {
 		capName: "integrations",
 		capScope: "system",
@@ -85681,13 +85792,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"integrations.setSettings": {
-		capName: "integrations",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"integrations.testConnection": {
 		capName: "integrations",
 		capScope: "system",
@@ -86682,6 +86786,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"migrations.clearLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
 	"migrations.declareOwner": {
 		capName: "migrations",
 		capScope: "system",
@@ -86689,6 +86800,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"migrations.deleteLegacyIntegrationRowKeys": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
 	"migrations.dryRun": {
 		capName: "migrations",
 		capScope: "system",
@@ -86724,6 +86842,20 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"migrations.patchLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.readLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"migrations.restorePreMigration": {
 		capName: "migrations",
 		capScope: "system",
@@ -208590,6 +208722,7 @@ function statusOf(info) {
 function buildMatterInstances(records, deps) {
 	return new RecordIntegrationInstances(records, matterBrokersEntryKind, {
 		description: {
+			role: "both",
 			instanceMode: "multiple",
 			kind: "connection",
 			canTest: true,
@@ -209009,18 +209142,10 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 		try {
 			const mine = (await this.ctx.api.integrations.list.query()).filter((i) => i.addonId === this.ctx.id);
 			const surviving = new Set(mine.map((i) => i.id));
-			for (const integration of mine) {
-				const settings = await this.ctx.api.integrations.getSettings.query({ id: integration.id });
-				const brokerId = typeof settings["brokerId"] === "string" ? settings["brokerId"] : void 0;
-				if (brokerId === void 0) continue;
-				if (!this.activeBrokers.some((b) => b.id === brokerId)) {
-					this.ctx.logger.warn("Matter integration→broker: linked broker not found", { meta: {
-						integrationId: integration.id,
-						brokerId
-					} });
-					continue;
-				}
-				this.requireRegistry().linkIntegration(integration.id, brokerId);
+			for (const broker of this.activeBrokers) {
+				const integrationId = broker.integrationId;
+				if (integrationId === void 0 || !surviving.has(integrationId)) continue;
+				this.requireRegistry().linkIntegration(integrationId, broker.id);
 			}
 			const toRemove = this.activeBrokers.filter((b) => b.integrationId !== void 0 && !surviving.has(b.integrationId)).map((b) => b.id);
 			if (toRemove.length === 0) return;
@@ -209061,9 +209186,9 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 			},
 			logger: this.ctx.logger,
 			getBrokerIdForIntegration: async (id) => {
-				const brokerId = (await this.ctx.api.integrations.getSettings.query({ id }))["brokerId"];
-				if (typeof brokerId !== "string") throw new Error(`integration ${id} has no linked brokerId`);
-				return brokerId;
+				const broker = this.activeBrokers.find((entry) => entry.integrationId === id);
+				if (broker === void 0) throw new Error(`integration ${id} has no linked brokerId`);
+				return broker.id;
 			},
 			listAdoptedMatter: async () => {
 				const reg = this.ctx.kernel.deviceRegistry;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-matter-broker",
-  "version": "0.2.155",
+  "version": "0.2.157",
   "description": "Matter broker addon for CamStack — owns a Matter fabric (commissioning + the long-lived controller) via the matter.js controller and brokers commissioned Matter nodes into CamStack",
   "keywords": [
     "camstack",
@@ -65,7 +65,7 @@
       }
     ],
     "requires": {
-      "server": ">=1.2.761"
+      "server": ">=1.2.770"
     }
   },
   "files": [