@camstack/addon-matter-broker 0.2.158 → 0.2.160

package/dist/addon.mjs

@@ -5993,7 +5993,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DEZaLbiu.mjs
+//#region ../types/dist/sleep-BX_MqzUe.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7622,6 +7622,28 @@ var SECRET_RETRY_MAX_MS = 5 * 6e4;
 /** Coalesces a burst of `keychain.changed` events into one re-resolve. */
 var SECRET_CHANGE_DEBOUNCE_MS = 250;
 /**
+* Pair a catalogue with the function that builds its ports FROM THE MIGRATION API. The one
+* place a catalogue is bound: a migration reaches nothing a ports binder cannot reach
+* through `api` (guard `check-migration-ports-surface`).
+*/
+function migrationSet(catalogue, bindPorts) {
+	return { bind: (api) => defineAddonMigrations(catalogue, bindPorts(api)) };
+}
+/** A mixed array is a mistake: the other kind would be dropped without a word. */
+function refuseMixed(form, kept, dropped) {
+	if (dropped > 0) throw new Error(`runMigrations(${form}): ${dropped} of ${kept + dropped} entries are of the other kind and would be dropped; pass one kind per call`);
+}
+function catalogueOf(list) {
+	const kept = list.filter((entry) => !("execute" in entry));
+	refuseMixed("catalogue, (api) => ports", kept.length, list.length - kept.length);
+	return kept;
+}
+function boundOf(list) {
+	const kept = list.filter((entry) => "execute" in entry);
+	refuseMixed("bound migrations", kept.length, list.length - kept.length);
+	return kept;
+}
+/**
 * Base class for CamStack addons. Eliminates settings boilerplate:
 *
 * - Typed `config` property with automatic resolution from store + defaults
@@ -7788,23 +7810,21 @@ var BaseAddon = class {
 		await this.loadScopedSchemas();
 		return normalized;
 	}
+	async runMigrations(first, second, third) {
+		if (typeof second === "function") return this.runMigrationSets([migrationSet(catalogueOf(first), second)], third);
+		return this.runBound(boundOf(first), second);
+	}
 	/**
-	* Run this addon's migration catalogue (D987 M3) through the hub's `migrations`
-	* engine. Call it at the point of the boot where the data must already have the new
-	* shape — `onInitialize`, or `onRestoreDevices` for a migration that needs the
-	* restored devices — with the catalogue bound to the addon's ports
-	* (`defineAddonMigrations(ADDON_MIGRATIONS, ports)`).
-	*
-	* An engine that cannot be reached or refuses the catalogue is logged and runs
-	* nothing; the boot continues. A migration that FAILED (or was blocked by one)
-	* and declares `onFailure: 'block-owner'` makes this throw, so the addon does not
-	* serve data whose shape it cannot trust; `tolerate` migrations never do.
-	*
-	* ALWAYS pass the whole catalogue; a phase that must run only some of it passes
-	* `{ only: [ids] }` — never a filtered catalogue (the engine would judge the
-	* omitted applied ids "newer").
+	* Several catalogues of ONE owner in one declaration (the engine replaces an owner's
+	* catalogue on every declare, so two calls would each judge the other's ids "newer").
+	* Build each entry with `migrationSet(catalogue, (api) => ports)`.
 	*/
-	async runMigrations(migrations, options) {
+	async runMigrationSets(sets, options) {
+		const api = this.ctx.migrationApi;
+		if (api === void 0) throw new Error(`${this.ctx.id}: the migration API is not available on this context`);
+		return this.runBound(sets.flatMap((set) => set.bind(api)), options);
+	}
+	async runBound(migrations, options) {
 		const api = this.ctx.api.migrations;
 		const report = await runAddonMigrations({
 			declareOwner: (input) => api.declareOwner.mutate(input),
@@ -13515,7 +13535,7 @@ var RecordIntegrationInstances = class {
 		return record === null ? null : this.viewOf(record);
 	};
 	/** Insert ONE row (`ifRev: 0`: an existing id is refused, never overwritten). */
-	createInstance = async ({ id, name, kind }) => {
+	createInstance = async ({ id, name, kind, values }) => {
 		const minted = id ?? this.hooks.mintId?.({
 			name,
 			...kind !== void 0 ? { kind } : {}
@@ -13525,10 +13545,20 @@ var RecordIntegrationInstances = class {
 			id: minted,
 			data: this.hooks.initialBody(name, kind)
 		}, { ifRev: 0 });
+		const patch = this.patchOf(values ?? {});
+		if (Object.keys(patch).length > 0) await this.handle.patch(minted, patch);
 		await this.hooks.onChanged?.(minted, "created");
 		return { id: minted };
 	};
 	updateInstance = async ({ id, name, values }) => {
+		const patch = this.patchOf(values);
+		if (name !== void 0) patch[this.nameField] = name;
+		await this.handle.patch(id, patch);
+		await this.hooks.onChanged?.(id, "updated");
+		return { ok: true };
+	};
+	/** The record patch a form `values` object means: secrets kept, cleared or replaced. */
+	patchOf(values) {
 		const patch = {};
 		for (const [key, value] of Object.entries(values)) {
 			if (value === void 0) continue;
@@ -13539,11 +13569,8 @@ var RecordIntegrationInstances = class {
 			else if (isSecretClear(value)) patch[key] = null;
 			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
 		}
-		if (name !== void 0) patch[this.nameField] = name;
-		await this.handle.patch(id, patch);
-		await this.hooks.onChanged?.(id, "updated");
-		return { ok: true };
-	};
+		return patch;
+	}
 	/** The switch lives in the record body; the addon is told so it applies it (D996). */
 	setInstanceEnabled = async ({ id, enabled }) => {
 		if (this.registryOwnsEnabled) throw new Error(`instance "${id}": the integrations registry owns the on/off switch of this addon; set it with integrations.update`);
@@ -13580,6 +13607,76 @@ var RecordIntegrationInstances = class {
 		};
 	}
 };
+/** No part holds the id a call named. */
+var UnknownInstanceError = class extends Error {
+	instanceId;
+	constructor(instanceId) {
+		super(`Unknown instance '${instanceId}'`);
+		this.instanceId = instanceId;
+		this.name = "UnknownInstanceError";
+	}
+};
+/** A create or a form named no kind, or a kind no part serves. */
+var UnknownInstanceKindError = class extends Error {
+	kindId;
+	constructor(kindId) {
+		super(kindId === void 0 ? "This provider has several kinds: name one" : `Unknown instance kind '${kindId}'`);
+		this.kindId = kindId;
+		this.name = "UnknownInstanceKindError";
+	}
+};
+function composeInstanceKinds(parts, base) {
+	const byKind = (kindId) => {
+		if (kindId === void 0) {
+			const only = parts.length === 1 ? parts[0] : void 0;
+			if (only === void 0) throw new UnknownInstanceKindError(void 0);
+			return only;
+		}
+		const part = parts.find((candidate) => candidate.kind.id === kindId);
+		if (part === void 0) throw new UnknownInstanceKindError(kindId);
+		return part;
+	};
+	const holderOf = async (id) => {
+		for (const part of parts) if (await part.provider.getInstance({ id }) !== null) return part;
+		throw new UnknownInstanceError(id);
+	};
+	const tagged = (part, instance) => ({
+		...instance,
+		kind: part.kind.id
+	});
+	return {
+		describe: async () => ({
+			...base,
+			kinds: parts.map((part) => part.kind)
+		}),
+		instanceFormSchema: async ({ id, kind }) => {
+			return (id === null ? byKind(kind) : await holderOf(id)).provider.instanceFormSchema({ id });
+		},
+		listInstances: async () => {
+			return (await Promise.all(parts.map(async (part) => (await part.provider.listInstances()).map((instance) => tagged(part, instance))))).flat();
+		},
+		getInstance: async ({ id }) => {
+			for (const part of parts) {
+				const found = await part.provider.getInstance({ id });
+				if (found !== null) return tagged(part, found);
+			}
+			return null;
+		},
+		createInstance: async (input) => byKind(input.kind).provider.createInstance(input),
+		updateInstance: async (input) => (await holderOf(input.id)).provider.updateInstance(input),
+		setInstanceEnabled: async (input) => (await holderOf(input.id)).provider.setInstanceEnabled(input),
+		deleteInstance: async (input) => (await holderOf(input.id)).provider.deleteInstance(input),
+		testInstance: async (input) => {
+			const test = (input.id === null ? byKind(input.kind) : await holderOf(input.id)).provider.testInstance;
+			if (test === void 0) return {
+				success: false,
+				status: "inconclusive",
+				error: "This kind cannot be tested"
+			};
+			return test(input);
+		}
+	};
+}
 var EncodeProfileSchema = object({
 	video: object({
 		codec: _enum([
@@ -15794,6 +15891,39 @@ var UnstampedEventMediaCountSchema = object({
 	/** Sum across both, or `null` when either lane could not be counted. */
 	total: number().int().nonnegative().nullable()
 }).nullable();
+/**
+* Where the stored event media sits, per storage location: how many media rows
+* and how many bytes carry each location id, how many carry none (legacy,
+* resolved to the default `eventMedia` location), and how many name a location
+* that was not asked about (a deleted or never-listed one).
+*
+* One covering-index aggregate per asked location plus the NULL one, and one
+* unfiltered total that scans the covering index: O(rows), not a walk of the
+* rows themselves. `unlisted` is total minus the ASKED locations minus NULL, so
+* it is a deleted location only when every location id was asked.
+* `null` is "could not be measured", never zero.
+*/
+var MediaLocationCensusInputSchema = object({ locationIds: array(string$2().min(1)).max(50).readonly() });
+var MediaLocationCensusSchema = object({
+	locations: array(object({
+		locationId: string$2(),
+		rows: number().int().nonnegative(),
+		bytes: number().nonnegative()
+	})).readonly(),
+	unstamped: object({
+		rows: number().int().nonnegative(),
+		bytes: number().nonnegative()
+	}),
+	/** Rows stamped with a location id that was not in the asked list. */
+	unlisted: object({
+		rows: number().int().nonnegative(),
+		bytes: number().nonnegative()
+	}),
+	total: object({
+		rows: number().int().nonnegative(),
+		bytes: number().nonnegative()
+	})
+});
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string$2().min(1) });
 /** The independently selectable logical storage classes — every class
 * `storage.listLocationDeclarations` reports, so an operator never meets a
@@ -46830,52 +46960,7 @@ onBrightnessChanged: { data: object({
 		minIntervalMs: 0
 	} } }
 };
-/**
-* `broker` — unified pub/sub broker registry, system-scoped collection.
-*
-* The cap models any kind-tagged message broker the user wants to
-* register and that other addons might consume. The first two kinds
-* are MQTT (mosquitto / aedes embedded / cloud bridge) and
-* Home Assistant (HA WebSocket — subscribe_entities + call_service).
-* Future kinds (Zigbee2MQTT bridge, ZHA, KNX, Telegram, …) plug in
-* the same surface.
-*
-* Why one cap, not one cap per kind:
-*   - The integrations page wants a single table of "every broker"
-*     across kinds; a unified cap drives it without join logic.
-*   - Generic admin operations (add / remove / test / status) are
-*     identical across kinds — duplicating them per cap was busywork.
-*   - The `network-access` cap precedent: same interface, many
-*     `providerKind: 'ingress'` implementations (Tailscale, ngrok, …).
-*
-* What stays kind-specific:
-*   - `getBrokerConfig` payload (kind decides whether it returns
-*     mqtt URL+creds, HA baseUrl+token, …) — typed as
-*     `Record<string, unknown>` at the wire; consumers narrow.
-*   - `publish` / `subscribe` / `getState` arguments (target / filter /
-*     key) — also typed as `Record<string, unknown>` so each kind can
-*     evolve its surface (MQTT topic+qos vs HA entity_id+domain)
-*     without rebreaking the cap signature.
-*   - `add` `settings` payload (different fields per kind, validated by
-*     the kind-specific provider).
-*
-* Bidirectionality:
-*   - `publish` is RPC — synchronous result (provider-defined).
-*   - `subscribe` returns a subscription handle; the actual message
-*     stream flows over the typed event-bus as `broker.message` events
-*     keyed by `(brokerId, subscriptionId)`. Consumers filter in their
-*     event handler. Subscriptions persist across reconnects — the
-*     provider re-subscribes upstream after a transport drop.
-*
-* Why event-bus push (not a subscription RPC stream):
-*   - Matches the rest of CamStack's D8 contract — events for telemetry,
-*     RPC for loss-is-a-bug. Broker messages are telemetry (a single
-*     drop is recoverable via `getState({key})`).
-*   - Frees `broker.subscribe` from holding a long-lived RPC channel.
-*   - Cross-process: events already route through `$event-bus`; no
-*     per-broker wire-shaping needed.
-*/
-var BrokerStatusEnum = _enum([
+_enum([
 	"connected",
 	"disconnected",
 	"connecting",
@@ -46883,141 +46968,12 @@ var BrokerStatusEnum = _enum([
 	"unreachable",
 	"error"
 ]);
-var BrokerInfoSchema = object({
-	/** Stable broker id. Persisted; survives addon restarts. */
-	id: string$2(),
-	/** Addon id of the provider that OWNS this broker.
-	*
-	*  The `broker` cap is a system-scoped collection: several addons
-	*  register a `broker` provider, each owning a DISJOINT set of
-	*  brokers (mqtt-broker owns `mqtt_*`, provider-homeassistant owns
-	*  `ha_*`). A broker therefore belongs to exactly one addon — like a
-	*  device belongs to one integration. The admin UI threads this id
-	*  back as the `{ addonId }` system-collection selector on every
-	*  id-keyed call (`get` / `getSettings` / `setSettings` / `remove` /
-	*  `testConnection`), so the call routes to the OWNING provider
-	*  instead of defaulting to the first-registered one. */
-	addonId: string$2(),
-	/** Human-readable name (operator-chosen at add-time). */
-	name: string$2(),
-	/** Provider-defined kind tag — `mqtt` / `home-assistant` / future. */
-	kind: string$2(),
-	status: BrokerStatusEnum,
-	/** Free-form provider-specific info (HA version, MQTT broker
-	*  flavour, latency, mTLS active, …). */
-	info: record(string$2(), unknown()),
-	/** Ms epoch of the last connection probe / status update. */
-	lastCheckedAt: number().nullable(),
-	/** Last error message, when `status` indicates failure. */
-	error: string$2().nullable()
-});
 var RegistryStatusSchema = object({
 	brokerCount: number().int().nonnegative(),
 	connectedCount: number().int().nonnegative()
 });
-/**
-* One entry per `broker` provider — which addon provides which broker
-* kind(s). The unified create picker reads this to know, for each
-* (addonId, kind) pair the operator can pick, where to route the
-* follow-up `getSettingsSchema` / `testSettings` / `add` calls (via the
-* `{ addonId }` selector). A provider only advertises a kind here when
-* it implements `getSettingsSchema` for that kind (so the picker never
-* offers a kind whose creation form can't be rendered).
-*/
-var BrokerProviderInfoSchema = object({
-	/** Addon id of the `broker` provider this entry describes. */
-	addonId: string$2(),
-	/** Broker kinds this provider can create, with a display label. */
-	kinds: array(object({
-		kind: string$2(),
-		label: string$2(),
-		/**
-		* Relative hub path to start an interactive account link (OAuth popup).
-		* May include `{{brokerId}}`; admin-ui substitutes and appends `?popup=1`.
-		*/
-		interactiveConnectPath: string$2().min(1).optional(),
-		/** Relative hub path to disconnect the linked account (same popup pattern). */
-		interactiveDisconnectPath: string$2().min(1).optional(),
-		/**
-		* The kind signs in through a server-held interactive session instead of
-		* (or before) typed credentials. `basePath` is a hub-relative route set
-		* served by the owning addon (`/addon/<id>/...`) speaking the sign-in
-		* contract: `POST {basePath}/start` (body: the form's settings) answers
-		* `{ sessionId, loginUrl }`; `GET {basePath}/status?sessionId=` answers
-		* `{ phase: 'starting' | 'awaiting-login' | 'captured' | 'error' |
-		* 'cancelled', loginUrl, error }`; `POST {basePath}/commit`
-		* (`{ sessionId, name, brokerId? }`) stores the credentials on a new or
-		* existing broker and answers `{ brokerId }`; `POST {basePath}/cancel`
-		* (`{ sessionId }`) drops the session. The dialog that edits a broker
-		* offers it as the default path; the fields the session fills are
-		* marked `filledBySignIn` in the kind's settings schema.
-		*
-		* `methods` lists the ways the session can sign in, recommended first:
-		* `'device-code'` adds `POST {basePath}/code/start` (body: the form's
-		* settings) answering `{ sessionId, userCode, verificationUrl,
-		* expiresAt }` — the operator types `userCode` at `verificationUrl` on
-		* any device, and the same `status` / `commit` / `cancel` routes follow
-		* (status then carries `method`, `userCode`, `verificationUrl`,
-		* `expiresAt` and the phases `'awaiting-code'` / `'expired'`);
-		* `'proxy'` is the `{basePath}/start` flow above. Absent means
-		* `['proxy']`.
-		*/
-		signIn: object({
-			basePath: string$2().min(1),
-			methods: array(_enum(["device-code", "proxy"])).optional()
-		}).optional()
-	}))
-});
-var ListInputSchema = object({ 
-/** Optional kind filter — `list({kind:'home-assistant'})` returns
-*  only HA brokers. Omit to list every broker. */
-kind: string$2().optional() });
 var GetInputSchema = object({ id: string$2() });
-var AddInputSchema = object({
-	kind: string$2().min(1),
-	name: string$2().min(1),
-	/**
-	* ADOPT an existing id instead of minting a new one.
-	*
-	* Written the day this cost an outage. A broker's id is not a detail: HA
-	* devices carry it inside their `stableId` (`ha:ha_004:dev:…`), so a broker
-	* lost from config and re-added as `ha_001` leaves every one of its devices
-	* bound to a broker that no longer exists. Re-entering the password under the
-	* ORIGINAL id turns a multi-step device migration back into re-entering a
-	* password.
-	*
-	* A provider MUST refuse an id that is already in use — adopting a live
-	* broker's id would silently take it over.
-	*/
-	id: string$2().min(1).optional(),
-	/** Kind-specific settings (e.g. MQTT `{url,username,password}` or HA
-	*  `{baseUrl,accessToken}`). Validated by the kind-specific provider
-	*  branch on receipt — invalid shape rejects the add. */
-	settings: record(string$2(), unknown())
-});
-var AddResultSchema = object({ id: string$2() });
-var RemoveInputSchema = object({ id: string$2() });
-var TestConnectionResultSchema = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number().nonnegative()
-}), object({
-	ok: literal(false),
-	error: string$2()
-})]);
 var SettingsRecordSchema$1 = record(string$2(), unknown());
-var SettingsSchemaInputSchema = object({ kind: string$2() });
-var TestSettingsInputSchema = object({
-	kind: string$2(),
-	settings: SettingsRecordSchema$1
-});
-var TestSettingsResultSchema = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number().nonnegative().optional()
-}).strict(), object({
-	ok: literal(false),
-	error: string$2()
-})]);
-var SettingsSchemaResultSchema = unknown().nullable();
 var PublishInputSchema = object({
 	brokerId: string$2(),
 	/** Kind-specific routing target.
@@ -47061,51 +47017,12 @@ var brokerCapability = {
 		kind: "poll"
 	},
 	methods: {
-		list: method(ListInputSchema, array(BrokerInfoSchema)),
-		get: method(GetInputSchema, BrokerInfoSchema.nullable()),
-		/** Enumerate which addon provides which broker kind(s) for the
-		*  unified create picker. The auto-mount fans this array across
-		*  every registered `broker` provider (array-output method), so the
-		*  picker sees every kind from every provider in one call. */
-		listProviders: method(_void(), array(BrokerProviderInfoSchema), { auth: "admin" }),
-		add: method(AddInputSchema, AddResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		remove: method(RemoveInputSchema, _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		testConnection: method(GetInputSchema, TestConnectionResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		/** Read the persisted settings record for a broker (kind-specific
-		*  shape). Admin-only — settings may contain secrets. Returns `null`
-		*  when the broker id is unknown to the provider (the collection
-		*  fallback may route a foreign id to the first provider). */
-		getSettings: method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }),
-		/** Overwrite the persisted settings record. The kind-specific
-		*  provider validates the shape and applies the change (reconnects
-		*  if credentials changed). */
-		setSettings: method(object({
-			id: string$2(),
-			settings: SettingsRecordSchema$1
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
 		/** Returns the kind-specific connection config the consumer needs
 		*  to open its own client (MQTT pattern: `{url, username, password,
 		*  clientIdPrefix}`). HA providers MAY return the auth envelope
 		*  but typical HA consumers use `publish` / `subscribe` instead.
 		*  Returns `null` when the broker id is unknown to the provider. */
 		getBrokerConfig: method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }),
-		getSettingsSchema: method(SettingsSchemaInputSchema, SettingsSchemaResultSchema, { auth: "admin" }),
-		testSettings: method(TestSettingsInputSchema, TestSettingsResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
 		publish: method(PublishInputSchema, unknown(), {
 			kind: "mutation",
 			auth: "admin"
@@ -51952,7 +51869,14 @@ var DiscoveryCandidateSchema = object({
 	/** `stableId` of the gateway candidate this device was found BEHIND. */
 	parentStableId: string$2().optional(),
 	/** `false` = shown for context but not pickable. Default true. */
-	selectable: boolean().optional()
+	selectable: boolean().optional(),
+	/**
+	* Keys of the provider's creation form (`getChildCreationSchema`) this candidate
+	* cannot be adopted without — a key for an encrypted board, a pairing code. The
+	* admin asks for exactly these, on the creation form prefilled with
+	* `prefilledConfig`, before it adopts. Absent or empty = adopt as it is.
+	*/
+	needsParams: array(string$2()).optional()
 });
 /**
 * Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
@@ -52079,8 +52003,14 @@ var deviceProviderCapability = {
 		* provider does not support manual creation. Lets the Add-Device dialog
 		* pick the right type instead of assuming Camera.
 		*/
-		getManualCreationType: method(object({}), object({ deviceType: _enum(DeviceType).nullable() })),
-		adoptDiscoveredDevice: method(object({ candidate: DiscoveryCandidateSchema }), DeviceSummarySchema, {
+		getManualCreationType: method(object({ 
+		/** The integration asked about; a provider whose integrations differ answers per one. */
+integrationId: string$2().optional() }), object({ deviceType: _enum(DeviceType).nullable() })),
+		adoptDiscoveredDevice: method(object({
+			candidate: DiscoveryCandidateSchema,
+			/** The integration the operator adopts into; a provider with several instances needs it. */
+			integrationId: string$2().optional()
+		}), DeviceSummarySchema, {
 			kind: "mutation",
 			auth: "admin"
 		}),
@@ -52091,10 +52021,16 @@ var deviceProviderCapability = {
 		* devices of that type. The output is a `ConfigUISchema` — the
 		* router type-asserts it at the boundary.
 		*/
-		getChildCreationSchema: method(object({ type: _enum(DeviceType) }), CreationSchemaOutputSchema),
+		getChildCreationSchema: method(object({
+			type: _enum(DeviceType),
+			/** The integration asked about; a provider whose integrations differ answers per one. */
+			integrationId: string$2().optional()
+		}), CreationSchemaOutputSchema),
 		createDevice: method(object({
 			type: _enum(DeviceType),
-			config: record(string$2(), unknown())
+			config: record(string$2(), unknown()),
+			/** The integration the operator adds the device to; a provider with several instances needs it. */
+			integrationId: string$2().optional()
 		}), DeviceSummarySchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -52819,7 +52755,10 @@ method(object({
 	auth: "admin"
 }), method(object({
 	addonId: string$2(),
-	type: _enum(DeviceType)
+	type: _enum(DeviceType),
+	/** The integration the form is for; a provider whose integrations differ (a hub
+	*  integration takes no manual add) answers per integration. Absent = the addon's own. */
+	integrationId: string$2().optional()
 }), unknown().nullable()), method(object({
 	addonId: string$2(),
 	type: _enum(DeviceType),
@@ -52903,7 +52842,11 @@ method(object({
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 12e4
-}), method(object({ addonId: string$2() }), object({ deviceType: _enum(DeviceType).nullable() }), { auth: "admin" }), method(object({ addonId: string$2() }), unknown(), { auth: "admin" }), method(object({
+}), method(object({
+	addonId: string$2(),
+	/** The integration the Add-Device dialog is open on; absent = the addon's own. */
+	integrationId: string$2().optional()
+}), object({ deviceType: _enum(DeviceType).nullable() }), { auth: "admin" }), method(object({ addonId: string$2() }), unknown(), { auth: "admin" }), method(object({
 	deviceId: number(),
 	key: string$2(),
 	value: unknown()
@@ -56183,7 +56126,7 @@ var TestConnectionStatusEnum = _enum([
 	"inconclusive",
 	"unsupported"
 ]);
-var TestConnectionResultSchema$1 = object({
+var TestConnectionResultSchema = object({
 	/** True ONLY for `validated`. Never true for a test that did not run. */
 	success: boolean(),
 	error: string$2().optional(),
@@ -56228,7 +56171,7 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string$2
 }), method(_void(), array(AvailableIntegrationTypeSchema), { auth: "admin" }), method(object({
 	addonId: string$2(),
 	settings: record(string$2(), unknown())
-}), TestConnectionResultSchema$1, {
+}), TestConnectionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -56255,6 +56198,14 @@ var ConfigSchemaPassthrough$3 = custom();
 var IntegrationInstanceIdSchema = string$2().min(1);
 var IntegrationInstanceModeSchema = _enum(["single", "multiple"]);
 /**
+* What the addon's instances ARE for the Integrations page (planning#416). `devices`: each
+* instance is an integration that brings devices (the registry owns its on/off switch);
+* `services`: a connection configured from the addon's own function page, never listed on
+* Integrations.
+* It is the same vocabulary as the manifest's `integrationRole`, which stays as an override.
+*/
+var IntegrationInstanceRoleSchema = _enum(["devices", "services"]);
+/**
 * One kind of instance a provider can create (an adapter, an account type). The sign-in and
 * connect fields follow the `broker` contract (`broker.cap.ts`): `signIn.basePath` is a
 * hub-relative route set speaking the sign-in contract, `connectPath` / `disconnectPath` open an
@@ -56265,6 +56216,22 @@ var IntegrationInstanceKindSchema = object({
 	/** Stable id of the kind, sent back as `createInstance.kind`. */
 	id: string$2().min(1),
 	label: string$2().min(1),
+	/**
+	* The function capability this kind is configured for (`broker`, `smtp-provider`,
+	* `device-provider`, ...). A page section is the kinds whose `functionCap` it names (D1013); a
+	* provider with more than one section must name it on every kind.
+	*/
+	functionCap: string$2().min(1),
+	/**
+	* For `functionCap: 'broker'`: the registry kind of the broker an instance of this kind is
+	* (`matter`, `home-assistant`, ...). A caller that needs a broker of one kind (a link field)
+	* finds the instances whose kind names it; absent takes the kind `id`.
+	*/
+	brokerKind: string$2().min(1).optional(),
+	/** What instances of this kind are for the Integrations page; absent takes the provider's `role`. */
+	role: IntegrationInstanceRoleSchema.optional(),
+	/** `testInstance` really probes the remote for this kind; absent takes the provider's `canTest`. */
+	canTest: boolean().optional(),
 	/** The kind signs in through a server-held interactive session. */
 	signIn: object({
 		basePath: string$2().min(1),
@@ -56277,11 +56244,7 @@ var IntegrationInstanceKindSchema = object({
 });
 var IntegrationInstanceDescriptionSchema = object({
 	/** What the instances are for the Integrations page; see {@link IntegrationInstanceRoleSchema}. */
-	role: _enum([
-		"devices",
-		"services",
-		"both"
-	]),
+	role: IntegrationInstanceRoleSchema,
 	/** How the devices of an instance are found; absent means `{ mode: 'none' }`. */
 	discovery: object({
 		mode: _enum([
@@ -56356,7 +56319,11 @@ var integrationInstancesCapability = {
 	methods: {
 		describe: method(_void(), IntegrationInstanceDescriptionSchema, { auth: "admin" }),
 		/** The form; `id: null` is the create form. */
-		instanceFormSchema: method(object({ id: IntegrationInstanceIdSchema.nullable() }), ConfigSchemaPassthrough$3, { auth: "admin" }),
+		instanceFormSchema: method(object({
+			id: IntegrationInstanceIdSchema.nullable(),
+			/** The kind of the create form (`id: null`) of a provider with several. */
+			kind: string$2().min(1).optional()
+		}), ConfigSchemaPassthrough$3, { auth: "admin" }),
 		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
 		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
 		/**
@@ -56366,7 +56333,9 @@ var integrationInstancesCapability = {
 		createInstance: method(object({
 			id: IntegrationInstanceIdSchema.optional(),
 			name: string$2().min(1),
-			kind: string$2().min(1).optional()
+			kind: string$2().min(1).optional(),
+			/** Form values written with the record (a link picked in the create dialog). */
+			values: record(string$2(), unknown()).optional()
 		}), object({ id: string$2() }), {
 			kind: "mutation",
 			auth: "admin"
@@ -56393,8 +56362,10 @@ var integrationInstancesCapability = {
 		}),
 		testInstance: optionalMethod(object({
 			id: IntegrationInstanceIdSchema.nullable(),
-			values: record(string$2(), unknown())
-		}), TestConnectionResultSchema$1, {
+			values: record(string$2(), unknown()),
+			/** The kind to test when `id` is null and the provider has several. */
+			kind: string$2().min(1).optional()
+		}), TestConnectionResultSchema, {
 			kind: "mutation",
 			auth: "admin"
 		})
@@ -59151,6 +59122,380 @@ var SystemMetricsSchema = object({
 	gpuMemoryPercent: number().optional()
 });
 method(_void(), SystemResourceSnapshotSchema), method(_void(), SystemResourceSnapshotSchema.nullable()), method(_void(), SystemMetricsSchema), method(object({ dirPath: string$2() }), DiskSpaceInfoSchema), method(_void(), MetricsGpuInfoSchema.nullable()), method(_void(), number().nullable()), method(object({ pids: array(number()) }), array(PidResourceStatsSchema)), method(_void(), array(AddonInstanceSchema).readonly()), method(object({ addonId: string$2() }), PidResourceStatsSchema.nullable()), method(_void(), array(NodeProcessSchema).readonly()), method(GetLoadSeriesInputSchema, NodeLoadSeriesSchema);
+/**
+* records - an addon's own facts and documents (D881): ledgers, audit rows,
+* config documents, mirrors. The third storage API next to `ctx.settings`
+* (operator intent, D870) and device-history (numbers over time, D850).
+*
+* Who the OWNER is: `callerAddonId`, stamped by the transport on a call that
+* crossed a process and stated by a hub in-process caller (`ctx.records` does
+* that with the addon id closed over). It is deliberately NOT in any input
+* schema, so a session can never supply it, and a call with no stamp is refused
+* `records/no-caller`. A kind is readable and writable only by its owner; other
+* addons go through the owner's capability.
+*
+* Every read is three-way: a row, `null`, or the call THROWS. A failed read is
+* never `[]`. Secret fields are never on the wire: a read shows the
+* redaction token, `secretRefs` hands the owner's `ctx.secrets` the refs it
+* resolves itself, and a write may carry only a keychain marker bound to the
+* row's own ref.
+*
+* Internal: addons reach it through `ctx.records`, never directly.
+*/
+var RecordIdSchema = string$2().min(1).max(256);
+/** A JSON object body. Size is the engine's check (`maxDataBytes`), not a schema's. */
+var RecordBodySchema = record(string$2(), unknown());
+var RecordInputSchema = object({
+	id: RecordIdSchema,
+	/** The device this row belongs to (D865 removal, per-device reads). */
+	deviceId: number().int().optional(),
+	/** The domain clock, ms: observed / created / opened. */
+	at: number().int().optional(),
+	/** Producer-set expiry, ms. Refused on a kind whose retention is an engine TTL. */
+	expiresAt: number().int().optional(),
+	data: RecordBodySchema
+});
+var RecordViewSchema = object({
+	id: string$2(),
+	deviceId: number().int().nullable(),
+	at: number().nullable(),
+	expiresAt: number().nullable(),
+	rev: number().int(),
+	updatedAt: number(),
+	data: RecordBodySchema
+});
+/** Declared index fields only. Anything else does not compile, by design. */
+var RecordWhereSchema = record(RecordFieldPathSchema, union([
+	string$2(),
+	number(),
+	boolean(),
+	object({ in: array(union([
+		string$2(),
+		number(),
+		boolean()
+	])).min(1).max(RECORD_BATCH_MAX) }),
+	object({
+		gt: union([string$2(), number()]).optional(),
+		gte: union([string$2(), number()]).optional(),
+		lt: union([string$2(), number()]).optional(),
+		lte: union([string$2(), number()]).optional()
+	}).refine((r) => Object.keys(r).length > 0, { message: "name at least one bound" })
+]));
+var KindShape = { kind: RecordKindNameSchema };
+var TimeWindowShape = {
+	deviceId: number().int().optional(),
+	atFrom: number().optional(),
+	atTo: number().optional()
+};
+var RecordQueryInputSchema = object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional(),
+	/** Without `where`: `at` (default for a kind with a clock) or `id`. With `where` the order is the index's. */
+	order: _enum(["at", "id"]).optional(),
+	desc: boolean().optional(),
+	limit: number().int().min(1).max(RECORD_QUERY_MAX).default(100),
+	/** Opaque keyset cursor from a previous answer. There is no offset. */
+	cursor: string$2().min(1).optional()
+});
+var RecordQueryResultSchema = object({
+	records: array(RecordViewSchema),
+	nextCursor: string$2().nullable()
+});
+var RecordKindStateSchema = _enum([
+	"created",
+	"unchanged",
+	"updated"
+]);
+var DeclareKindResultSchema = object({
+	kindId: number().int(),
+	state: RecordKindStateSchema,
+	createdIndexes: array(string$2())
+});
+/** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
+var SecretRefsList = array(string$2());
+/**
+* One op of a `transact`: the single-row writes, each on a kind of the caller.
+* All ops of one call share ONE database file and ONE `transactFamily`.
+*/
+var RecordTransactOpSchema = discriminatedUnion("op", [
+	object({
+		op: literal("put"),
+		kind: RecordKindNameSchema,
+		record: RecordInputSchema,
+		ifRev: number().int().min(0).optional()
+	}),
+	object({
+		op: literal("patch"),
+		kind: RecordKindNameSchema,
+		id: RecordIdSchema,
+		data: RecordBodySchema,
+		at: number().int().nullable().optional(),
+		expiresAt: number().int().nullable().optional(),
+		ifRev: number().int().min(1).optional()
+	}),
+	object({
+		op: literal("delete"),
+		kind: RecordKindNameSchema,
+		id: RecordIdSchema
+	})
+]);
+var RecordSecretRefsSchema = record(string$2(), record(string$2(), string$2()));
+method(object({ kinds: record(RecordKindNameSchema, RecordKindDeclarationSchema) }), object({ kinds: record(string$2(), DeclareKindResultSchema) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), RecordViewSchema.nullable(), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), array(RecordViewSchema), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), RecordSecretRefsSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	record: RecordInputSchema,
+	/** Compare-and-set. `0` means "the row must not exist". */
+	ifRev: number().int().min(0).optional()
+}), object({
+	rev: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	records: array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	count: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema,
+	data: RecordBodySchema,
+	at: number().int().nullable().optional(),
+	expiresAt: number().int().nullable().optional(),
+	ifRev: number().int().min(1).optional()
+}), object({
+	rev: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), object({
+	deleted: boolean(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	deleted: number().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(RecordQueryInputSchema, RecordQueryResultSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional()
+}), object({ count: number().int() }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number().int().optional(),
+	from: number(),
+	to: number(),
+	bucketMs: number().int().positive()
+}), object({ buckets: array(object({
+	bucketStart: number(),
+	count: number().int()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	op: _enum([
+		"sum",
+		"min",
+		"max",
+		"count"
+	]),
+	field: RecordFieldPathSchema.optional(),
+	groupBy: RecordFieldPathSchema.optional(),
+	where: RecordWhereSchema.optional()
+}), object({ rows: array(object({
+	group: union([
+		string$2(),
+		number(),
+		_null()
+	]),
+	value: number().nullable()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number().int().optional(),
+	atBefore: number().optional(),
+	where: RecordWhereSchema.optional()
+}), object({
+	deleted: number().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ ops: array(RecordTransactOpSchema).min(1).max(RECORD_BATCH_MAX) }), object({
+	results: array(object({
+		rev: number().int().nullable(),
+		deleted: boolean()
+	})),
+	releasedRefs: SecretRefsList,
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int(),
+	kinds: array(RecordKindNameSchema).optional()
+}), object({
+	deleted: record(string$2(), number().int()),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object(KindShape), object({ id: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* The wire shapes of the migration API, version 1 (planning#447).
+*
+* A migration is code that outlives the server it was written against: an addon at
+* version 1.4 that is brought to 1.9 in one jump still runs its 1.4 catalogue, against
+* the 1.9 kernel. The only thing that code may call is {@link MigrationApiV1}; this file
+* is the contract of every method of it, one Zod pair per method.
+*
+* APPEND-ONLY. A released method is never removed and never changes meaning: an input
+* field is never removed or made required, an enum never narrows, an output field is
+* never removed. A change that cannot be expressed that way is `migration-api.v2`, next
+* to this file. `scripts/check-migration-api-append-only.ts` holds the line against
+* `scripts/migration-api-contract.json`, and every `behaviours` id below must have an
+* `it('<id>'` in `migration-api.contract.spec.ts`.
+*/
+var Rows = record(string$2(), unknown());
+var IntegrationId = object({ integrationId: string$2().min(1) });
+var RecordId = object({ id: string$2().min(1) });
+var RecordRowSchema = object({
+	id: string$2(),
+	deviceId: number().int().nullable(),
+	at: number().nullable(),
+	expiresAt: number().nullable(),
+	rev: number().int(),
+	updatedAt: number(),
+	data: Rows
+});
+var RecordPutShape = {
+	id: string$2().min(1),
+	deviceId: number().int().optional(),
+	at: number().int().optional(),
+	expiresAt: number().int().optional(),
+	data: Rows
+};
+var MigrationIntegrationSchema = object({
+	id: string$2(),
+	addonId: string$2(),
+	name: string$2(),
+	info: Rows,
+	originStableId: string$2().optional()
+});
+var MigrationDeviceSchema = object({
+	id: number().int(),
+	integrationId: string$2().nullable().optional(),
+	/** The owning device; null or absent for a root. */
+	parentDeviceId: number().int().nullable().optional(),
+	type: string$2().optional(),
+	name: string$2().optional(),
+	stableId: string$2().optional()
+});
+/** What the engine says about the migration API it serves: lets an addon notice an older server. */
+var MigrationApiInfoSchema = object({
+	version: number().int(),
+	methods: array(string$2())
+});
+object({
+	message: string$2(),
+	meta: Rows.optional(),
+	/** Grouping tags of the line; a line about a device carries `{ deviceId }`. */
+	tags: object({ deviceId: number().int().optional() }).optional()
+});
+object({
+	owner: string$2().min(1),
+	metas: array(MigrationMetaSchema)
+}), object({
+	bootId: string$2(),
+	snapshot: _enum([
+		"none",
+		"written",
+		"refused"
+	]),
+	steps: array(MigrationOwnerStepSchema),
+	/** The migration API the engine serves; absent from a server that predates it. */
+	migrationApi: MigrationApiInfoSchema.optional()
+}), object({ id: string$2().min(1) }), object({
+	proceed: boolean(),
+	state: union([literal("pending"), MigrationStatusSchema]),
+	reason: string$2().nullable()
+}), object({
+	id: string$2().min(1),
+	result: MigrationOwnerResultSchema
+}), object({
+	status: MigrationStatusSchema,
+	error: string$2().nullable(),
+	rowsChanged: number().int().nonnegative()
+}), object({
+	rows: number().int().nonnegative(),
+	secrets: number().int().nonnegative()
+}), IntegrationId.extend({ patch: Rows }), object({ written: boolean() }), IntegrationId.extend({ keys: array(string$2().min(1)) }), object({
+	present: boolean(),
+	removed: Rows
+}), RecordRowSchema.nullable(), RecordRowSchema.nullable(), object({
+	...RecordPutShape,
+	ifRev: number().int().optional()
+}), object({ rev: number().int() }), object({ records: array(object(RecordPutShape)) }), object({ count: number().int().nonnegative() }), RecordId.extend({
+	partial: Rows,
+	ifRev: number().int().optional()
+}), object({ rev: number().int() }), object({ deleted: boolean() }), object({
+	deviceId: number().int().optional(),
+	atFrom: number().optional(),
+	atTo: number().optional(),
+	where: RecordWhereSchema.optional(),
+	limit: number().int().min(1).optional(),
+	cursor: string$2().min(1).optional(),
+	resolveSecrets: boolean().optional()
+}), object({
+	records: array(RecordRowSchema),
+	nextCursor: string$2().nullable()
+}), object({
+	deviceId: number().int().optional(),
+	atBefore: number().optional(),
+	where: RecordWhereSchema.optional()
+}), object({ count: number().int().nonnegative() }), object({}), object({ store: Rows }), object({ patch: Rows }), object({}), object({ keys: array(string$2().min(1)) }), object({ removed: array(string$2()) }), object({ refs: array(string$2()) }), object({ values: record(string$2(), string$2().nullable()) }), object({
+	ref: string$2().min(1),
+	value: string$2()
+}), object({}), object({ refs: array(string$2()) }), object({ deleted: number().int().nonnegative() }), object({}), object({ integrations: array(MigrationIntegrationSchema) }), object({ id: string$2().min(1) }), MigrationIntegrationSchema.nullable(), object({
+	addonId: string$2().min(1),
+	integrationId: string$2().min(1).optional()
+}), object({ devices: array(MigrationDeviceSchema) }), object({ deviceId: number().int() }), object({
+	id: number().int(),
+	integrationId: string$2().nullable(),
+	/** Whether the device carries any stored config; its content is not offered. */
+	hasConfig: boolean()
+}).nullable(), object({
+	deviceId: number().int(),
+	integrationId: string$2().min(1)
+}), object({}), object({}), object({ nodeId: string$2() }), object({}), object({});
 method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { auth: "admin" }), method(object({ owner: string$2().optional() }), object({ pending: array(MigrationPendingEntrySchema) }), { auth: "admin" }), method(object({ id: string$2().min(1) }), MigrationDryRunResultSchema, { auth: "admin" }), method(object({
 	id: string$2().min(1),
 	error: string$2().min(1)
@@ -59180,7 +59525,9 @@ method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { aut
 		"written",
 		"refused"
 	]),
-	steps: array(MigrationOwnerStepSchema)
+	steps: array(MigrationOwnerStepSchema),
+	/** The migration API this engine serves (additive: a server that predates it omits it). */
+	migrationApi: MigrationApiInfoSchema.optional()
 }), {
 	kind: "mutation",
 	auth: "admin"
@@ -61847,7 +62194,10 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(RelocateMediaInputSchema, object({ jobId: string$2() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }), method(RelocatableMediaCountInputSchema, RelocatableMediaCountSchema, {
+}), method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }), method(MediaLocationCensusInputSchema, MediaLocationCensusSchema, {
+	kind: "query",
+	auth: "admin"
+}), method(RelocatableMediaCountInputSchema, RelocatableMediaCountSchema, {
 	kind: "query",
 	auth: "admin"
 }), method(object({}), array(RelocateJobSchema).readonly(), {
@@ -64502,7 +64852,7 @@ var BrokerStatusSchema$1 = _enum([
 	"unreachable",
 	"tls-error"
 ]);
-var BrokerInfoSchema$1 = object({
+var BrokerInfoSchema = object({
 	id: string$2(),
 	name: string$2(),
 	url: string$2(),
@@ -64565,7 +64915,7 @@ var StatusSchema = object({
 	brokerCount: number(),
 	embeddedRunning: boolean()
 });
-method(_void(), array(BrokerInfoSchema$1)), method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }), method(AddBrokerInputSchema, AddBrokerResultSchema, {
+method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }), method(AddBrokerInputSchema, AddBrokerResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(IdInputSchema, _void(), {
@@ -71747,253 +72097,6 @@ DeviceType.Camera, DeviceType.Sensor, DeviceType.Switch, DeviceType.Gateway, met
 	auth: "admin"
 });
 /**
-* records - an addon's own facts and documents (D881): ledgers, audit rows,
-* config documents, mirrors. The third storage API next to `ctx.settings`
-* (operator intent, D870) and device-history (numbers over time, D850).
-*
-* Who the OWNER is: `callerAddonId`, stamped by the transport on a call that
-* crossed a process and stated by a hub in-process caller (`ctx.records` does
-* that with the addon id closed over). It is deliberately NOT in any input
-* schema, so a session can never supply it, and a call with no stamp is refused
-* `records/no-caller`. A kind is readable and writable only by its owner; other
-* addons go through the owner's capability.
-*
-* Every read is three-way: a row, `null`, or the call THROWS. A failed read is
-* never `[]`. Secret fields are never on the wire: a read shows the
-* redaction token, `secretRefs` hands the owner's `ctx.secrets` the refs it
-* resolves itself, and a write may carry only a keychain marker bound to the
-* row's own ref.
-*
-* Internal: addons reach it through `ctx.records`, never directly.
-*/
-var RecordIdSchema = string$2().min(1).max(256);
-/** A JSON object body. Size is the engine's check (`maxDataBytes`), not a schema's. */
-var RecordBodySchema = record(string$2(), unknown());
-var RecordInputSchema = object({
-	id: RecordIdSchema,
-	/** The device this row belongs to (D865 removal, per-device reads). */
-	deviceId: number().int().optional(),
-	/** The domain clock, ms: observed / created / opened. */
-	at: number().int().optional(),
-	/** Producer-set expiry, ms. Refused on a kind whose retention is an engine TTL. */
-	expiresAt: number().int().optional(),
-	data: RecordBodySchema
-});
-var RecordViewSchema = object({
-	id: string$2(),
-	deviceId: number().int().nullable(),
-	at: number().nullable(),
-	expiresAt: number().nullable(),
-	rev: number().int(),
-	updatedAt: number(),
-	data: RecordBodySchema
-});
-/** Declared index fields only. Anything else does not compile, by design. */
-var RecordWhereSchema = record(RecordFieldPathSchema, union([
-	string$2(),
-	number(),
-	boolean(),
-	object({ in: array(union([
-		string$2(),
-		number(),
-		boolean()
-	])).min(1).max(RECORD_BATCH_MAX) }),
-	object({
-		gt: union([string$2(), number()]).optional(),
-		gte: union([string$2(), number()]).optional(),
-		lt: union([string$2(), number()]).optional(),
-		lte: union([string$2(), number()]).optional()
-	}).refine((r) => Object.keys(r).length > 0, { message: "name at least one bound" })
-]));
-var KindShape = { kind: RecordKindNameSchema };
-var TimeWindowShape = {
-	deviceId: number().int().optional(),
-	atFrom: number().optional(),
-	atTo: number().optional()
-};
-var RecordQueryInputSchema = object({
-	...KindShape,
-	...TimeWindowShape,
-	where: RecordWhereSchema.optional(),
-	/** Without `where`: `at` (default for a kind with a clock) or `id`. With `where` the order is the index's. */
-	order: _enum(["at", "id"]).optional(),
-	desc: boolean().optional(),
-	limit: number().int().min(1).max(RECORD_QUERY_MAX).default(100),
-	/** Opaque keyset cursor from a previous answer. There is no offset. */
-	cursor: string$2().min(1).optional()
-});
-var RecordQueryResultSchema = object({
-	records: array(RecordViewSchema),
-	nextCursor: string$2().nullable()
-});
-var RecordKindStateSchema = _enum([
-	"created",
-	"unchanged",
-	"updated"
-]);
-var DeclareKindResultSchema = object({
-	kindId: number().int(),
-	state: RecordKindStateSchema,
-	createdIndexes: array(string$2())
-});
-/** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
-var SecretRefsList = array(string$2());
-/**
-* One op of a `transact`: the single-row writes, each on a kind of the caller.
-* All ops of one call share ONE database file and ONE `transactFamily`.
-*/
-var RecordTransactOpSchema = discriminatedUnion("op", [
-	object({
-		op: literal("put"),
-		kind: RecordKindNameSchema,
-		record: RecordInputSchema,
-		ifRev: number().int().min(0).optional()
-	}),
-	object({
-		op: literal("patch"),
-		kind: RecordKindNameSchema,
-		id: RecordIdSchema,
-		data: RecordBodySchema,
-		at: number().int().nullable().optional(),
-		expiresAt: number().int().nullable().optional(),
-		ifRev: number().int().min(1).optional()
-	}),
-	object({
-		op: literal("delete"),
-		kind: RecordKindNameSchema,
-		id: RecordIdSchema
-	})
-]);
-var RecordSecretRefsSchema = record(string$2(), record(string$2(), string$2()));
-method(object({ kinds: record(RecordKindNameSchema, RecordKindDeclarationSchema) }), object({ kinds: record(string$2(), DeclareKindResultSchema) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	id: RecordIdSchema
-}), RecordViewSchema.nullable(), { auth: "admin" }), method(object({
-	...KindShape,
-	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
-}), array(RecordViewSchema), { auth: "admin" }), method(object({
-	...KindShape,
-	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
-}), RecordSecretRefsSchema, { auth: "admin" }), method(object({
-	...KindShape,
-	record: RecordInputSchema,
-	/** Compare-and-set. `0` means "the row must not exist". */
-	ifRev: number().int().min(0).optional()
-}), object({
-	rev: number().int(),
-	releasedRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	records: array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX)
-}), object({
-	count: number().int(),
-	releasedRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	id: RecordIdSchema,
-	data: RecordBodySchema,
-	at: number().int().nullable().optional(),
-	expiresAt: number().int().nullable().optional(),
-	ifRev: number().int().min(1).optional()
-}), object({
-	rev: number().int(),
-	releasedRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	id: RecordIdSchema
-}), object({
-	deleted: boolean(),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
-}), object({
-	deleted: number().int(),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(RecordQueryInputSchema, RecordQueryResultSchema, { auth: "admin" }), method(object({
-	...KindShape,
-	...TimeWindowShape,
-	where: RecordWhereSchema.optional()
-}), object({ count: number().int() }), { auth: "admin" }), method(object({
-	...KindShape,
-	deviceId: number().int().optional(),
-	from: number(),
-	to: number(),
-	bucketMs: number().int().positive()
-}), object({ buckets: array(object({
-	bucketStart: number(),
-	count: number().int()
-})) }), { auth: "admin" }), method(object({
-	...KindShape,
-	op: _enum([
-		"sum",
-		"min",
-		"max",
-		"count"
-	]),
-	field: RecordFieldPathSchema.optional(),
-	groupBy: RecordFieldPathSchema.optional(),
-	where: RecordWhereSchema.optional()
-}), object({ rows: array(object({
-	group: union([
-		string$2(),
-		number(),
-		_null()
-	]),
-	value: number().nullable()
-})) }), { auth: "admin" }), method(object({
-	...KindShape,
-	deviceId: number().int().optional(),
-	atBefore: number().optional(),
-	where: RecordWhereSchema.optional()
-}), object({
-	deleted: number().int(),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ ops: array(RecordTransactOpSchema).min(1).max(RECORD_BATCH_MAX) }), object({
-	results: array(object({
-		rev: number().int().nullable(),
-		deleted: boolean()
-	})),
-	releasedRefs: SecretRefsList,
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int(),
-	kinds: array(RecordKindNameSchema).optional()
-}), object({
-	deleted: record(string$2(), number().int()),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object(KindShape), object({ id: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * record-entries - the ONE admin surface for every list of user-created entries
 * (D881): notification targets, brokers, LLM profiles, anything an addon
 * declares as an ENTRY kind (`entry: { title }` in `defineRecordKinds`).
@@ -81721,7 +81824,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 	* `deviceClasses` map (first registered type). `null` when manual creation is
 	* unsupported. Lets the Add-Device dialog pick the right type per provider.
 	*/
-	async getManualCreationType() {
+	async getManualCreationType(_input) {
 		if (!await this.supportsManualCreation()) return { deviceType: null };
 		return { deviceType: Object.values(DeviceType).find((t) => this.deviceClasses[t] !== void 0) ?? null };
 	}
@@ -81732,7 +81835,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 		return true;
 	}
 	async getChildCreationSchema(input) {
-		return this.onGetCreationSchema(input.type);
+		return this.onGetCreationSchema(input.type, { integrationId: input.integrationId });
 	}
 	/**
 	* Default kernel-orchestrated `createDevice` implementation. The
@@ -81744,7 +81847,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 	* `deviceClasses` instead.
 	*/
 	async createDevice(input) {
-		const spec = await this.onCreateDevice(input.type, input.config);
+		const spec = await this.onCreateDevice(input.type, input.config, { ...input.integrationId !== void 0 ? { integrationId: input.integrationId } : {} });
 		const Class = this.deviceClasses[spec.meta.type];
 		if (!Class) throw new Error(`${this.providerName} provider: no device class registered for type "${spec.meta.type}" — add it to the deviceClasses map`);
 		const stableId = this.generateStableId(spec.meta.type, spec.config);
@@ -83153,20 +83256,6 @@ Object.freeze({
 		access: "create",
 		role: "viewer"
 	},
-	"broker.add": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"broker.get": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"broker.getBrokerConfig": {
 		capName: "broker",
 		capScope: "system",
@@ -83174,20 +83263,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"broker.getSettings": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"broker.getSettingsSchema": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"broker.getState": {
 		capName: "broker",
 		capScope: "system",
@@ -83202,20 +83277,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"broker.list": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"broker.listProviders": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"broker.publish": {
 		capName: "broker",
 		capScope: "system",
@@ -83223,20 +83284,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"broker.remove": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
-	"broker.setSettings": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"broker.subscribe": {
 		capName: "broker",
 		capScope: "system",
@@ -83244,20 +83291,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"broker.testConnection": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"broker.testSettings": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"broker.unsubscribe": {
 		capName: "broker",
 		capScope: "system",
@@ -88221,6 +88254,13 @@ Object.freeze({
 		access: "view",
 		role: "viewer"
 	},
+	"pipelineAnalytics.getMediaLocationCensus": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"pipelineAnalytics.getMediaReclaimStatus": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -97162,6 +97202,275 @@ object({
 	delay: number().nonnegative().optional(),
 	commands: record(string$2(), unknown())
 });
+var BrokerInUseError = class extends Error {
+	brokerId;
+	users;
+	name = "BrokerInUseError";
+	constructor(brokerId, users) {
+		super(`broker '${brokerId}' is still in use by ${users.map((u) => `${u.kind} '${u.name ?? u.id}' (${u.id})`).join(", ")}; unlink them first`);
+		this.brokerId = brokerId;
+		this.users = users;
+	}
+};
+/** Throw {@link BrokerInUseError} when any finder names a user of `brokerId`. */
+async function assertBrokerUnused(brokerId, finders) {
+	const users = [];
+	for (const finder of finders) users.push(...await finder.find(brokerId));
+	if (users.length > 0) throw new BrokerInUseError(brokerId, users);
+}
+/**
+* An account provider whose `deleteInstance` is refused while anything still uses the account
+* (D1012). The account is an `integration-instances` kind (D1013), so the refusal lives on the
+* delete the instances page calls, not on a separate broker cap.
+*/
+function guardBrokerDelete(base, users) {
+	return {
+		...base,
+		deleteInstance: async (input) => {
+			await assertBrokerUnused(input.id, users());
+			return base.deleteInstance(input);
+		}
+	};
+}
+/**
+* The generic binding of a service to a broker (D1012). A service (an integration today; a
+* notifier target, a calendar source or an exporter later) names the broker it runs through by id
+* and keeps only its OWN link settings: never a copy of the broker's host, sign-in or secrets,
+* which stay with the broker and are edited on the Brokers page.
+*
+* One primitive serves every consumer:
+*  - {@link declareBrokerLinkKind}: the record kind, body `{ name, brokerId, ...linkFields }`;
+*  - {@link buildBrokerLinkForm}: the form, a `broker-select` picker plus the service's link
+*    sections, which may be DYNAMIC (a list read from the chosen broker, like HA calendars);
+*  - {@link buildBrokerLinkInstances}: the `integration-instances` provider of an integration;
+*  - {@link resolveBrokerId} / {@link brokerLinkUserFinder}: which broker a record names and which
+*    records name a broker, so a delete of a broker still in use can name its users generically.
+*/
+/** The record kind an integration is stored under. */
+var BROKER_LINK_KIND_NAME = "connections";
+/** What every broker-linked record carries; `brokerId` is always present, `''` is a row whose broker is not picked yet; link fields of the service come on top. */
+var BrokerLinkBodySchema = entryBody({ brokerId: string$2() });
+function declareBrokerLinkKind(spec) {
+	return defineEntryKind(BROKER_LINK_KIND_NAME, {
+		title: spec.title,
+		schema: BrokerLinkBodySchema.extend(spec.linkFields ?? {}),
+		writeTrigger: spec.writeTrigger
+	});
+}
+/** The form: a picker over the brokers of `brokerKind`, then the service's link sections. */
+async function buildBrokerLinkForm(spec, brokerId) {
+	const dynamic = brokerId !== void 0 && spec.dynamicSections !== void 0 ? await spec.dynamicSections(brokerId) : [];
+	return { sections: [
+		{
+			id: "broker-link",
+			title: spec.brokerLabel,
+			description: `Each integration links to a ${spec.brokerLabel} connection (Connectivity → Brokers). The connection and its sign-in are edited there.`,
+			columns: 1,
+			fields: [{
+				type: "broker-select",
+				key: "brokerId",
+				label: spec.brokerLabel,
+				brokerKind: spec.brokerKind
+			}]
+		},
+		...spec.linkSections ?? [],
+		...dynamic
+	] };
+}
+/** The broker a record names; undefined while it names none. */
+function resolveBrokerId(record) {
+	return record.brokerId === void 0 || record.brokerId === "" ? void 0 : record.brokerId;
+}
+/** The broker an integration links to, from its record. */
+async function brokerIdOf(instances, integrationId) {
+	const body = await instances.getResolved(integrationId);
+	return body === null ? void 0 : resolveBrokerId(body);
+}
+/** Every record of the kind that names `brokerId`, as users of that broker. */
+function brokerLinkUserFinder(instances, userKind = "integration") {
+	return { find: async (brokerId) => (await instances.listResolved()).filter((entry) => resolveBrokerId(entry.body) === brokerId).map((entry) => ({
+		kind: userKind,
+		id: entry.id,
+		name: entry.body.name
+	})) };
+}
+/** The `integration-instances` provider of an addon whose integrations link to a broker. */
+function buildBrokerLinkInstances(records, spec) {
+	const instances = new RecordIntegrationInstances(records, spec.kind, {
+		description: {
+			role: "devices",
+			instanceMode: "multiple",
+			kind: "connection",
+			canTest: false
+		},
+		formSchema: async (id) => buildBrokerLinkForm(spec, id === null ? void 0 : await brokerIdOf(instances, id)),
+		initialBody: (name) => spec.kind.schema.parse({
+			name,
+			brokerId: ""
+		}),
+		configured: (body) => resolveBrokerId(body) !== void 0,
+		...spec.onChanged !== void 0 ? { onChanged: spec.onChanged } : {}
+	});
+	return instances;
+}
+var BROKER_ROWS_MAX = 1e3;
+var STRAY_REGISTRY_ID = /^int_\d+$/;
+async function moveBrokerLinksToConnections(ports) {
+	const brokers = await ports.listBrokers();
+	const strays = brokers.filter((b) => STRAY_REGISTRY_ID.test(b.id));
+	if (strays.length > 0) ports.warn(`${strays.length} broker row(s) are keyed like a registry integration and are left as they are: ${strays.map((s) => s.id).join(", ")}`);
+	let moved = 0;
+	for (const broker of brokers) {
+		const integrationId = broker.integrationId;
+		if (integrationId === void 0 || integrationId === "") continue;
+		const existing = await ports.readConnection(integrationId);
+		if (existing === null) await ports.putConnection(integrationId, {
+			name: broker.name,
+			brokerId: broker.id
+		});
+		else if (existing.brokerId !== broker.id) {
+			ports.warn(`integration '${integrationId}' already names broker '${existing.brokerId ?? "none"}', not '${broker.id}'; the link stays on the broker`);
+			continue;
+		}
+		if ((await ports.readConnection(integrationId))?.brokerId !== broker.id) throw new Error(`integration '${integrationId}': the link did not read back - broker '${broker.id}' keeps it`);
+		await ports.clearBrokerLink(broker.id);
+		moved += 1;
+	}
+	return {
+		outcome: moved === 0 ? "already-done" : "done",
+		summary: {
+			brokers: brokers.length,
+			moved,
+			strayIntegrationRows: strays.length
+		}
+	};
+}
+/** The ports over the two record kinds of the addon. */
+function brokerLinkPortsOver(deps) {
+	return {
+		warn: deps.warn,
+		listBrokers: async () => {
+			return (await deps.brokers.query({ limit: BROKER_ROWS_MAX })).records.map((row) => {
+				const name = row.data["name"];
+				const link = row.data["integrationId"];
+				return {
+					id: row.id,
+					name: typeof name === "string" && name.length > 0 ? name : row.id,
+					integrationId: typeof link === "string" ? link : void 0
+				};
+			});
+		},
+		readConnection: async (id) => {
+			const row = await deps.connections.get(id);
+			return row === null ? null : { brokerId: row.data.brokerId };
+		},
+		putConnection: async (id, body) => {
+			await deps.connections.put({
+				id,
+				data: body
+			}, { ifRev: 0 });
+		},
+		clearBrokerLink: async (brokerId) => {
+			await deps.brokers.patch(brokerId, { integrationId: null });
+		}
+	};
+}
+//#endregion
+//#region src/config.ts
+/**
+* Matter broker connection settings for ONE fabric/controller (one broker entry).
+* v1 is intentionally minimal: optional Thread / Wi-Fi credentials supplied up
+* front for wireless commissioning. The pairing code itself is NOT stored here —
+* it is passed transiently to the commissioning action.
+*
+* The fabric credentials (root cert / NOC / node registry) live in the addon
+* `dataDir` via the controller's storage, NEVER in this typed KV.
+*/
+var matterConnectionSchema = object({
+	/** Optional Thread operational dataset (hex) for Thread device onboarding. */
+	threadDataset: string$2().default("").describe("Thread operational dataset (hex) — required only for Thread devices").meta({ secret: true }),
+	/** Optional Wi-Fi SSID for Wi-Fi device onboarding over BLE. */
+	wifiSsid: string$2().default("").describe("Wi-Fi SSID — required only for BLE Wi-Fi onboarding"),
+	/** Optional Wi-Fi password for Wi-Fi device onboarding over BLE. */
+	wifiPassword: string$2().default("").describe("Wi-Fi password (optional)").meta({ secret: true }),
+	/** PULL-reconcile interval for the commissioned-node inventory. */
+	reconcileIntervalMs: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(1e4).max(864e5).default(3e5)).describe("Node-inventory reconcile interval (ms)")
+});
+/** A single registered Matter fabric ("broker"). */
+var MatterBrokerEntrySchema = object({
+	id: string$2().min(1),
+	name: string$2().min(1),
+	connection: matterConnectionSchema,
+	/** Absent means on; the instances page switches a fabric off without deleting it. */
+	enabled: boolean().optional()
+});
+/** Top-level addon config — the fabrics are records, so nothing is left here. */
+var matterAddonConfigSchema = object({});
+/** Narrow an `unknown` to a shallow plain-object record (cast-free boundary). */
+function toRecord(value) {
+	if (typeof value === "object" && value !== null && !Array.isArray(value)) return Object.fromEntries(Object.entries(value));
+	return {};
+}
+/** Coerce a loose settings blob through the connection schema, applying defaults. */
+function settingsToMatterConnection(settings) {
+	return matterConnectionSchema.parse(toRecord(settings));
+}
+/**
+* Settings readers see an empty string for both secrets. The stored value
+* stays in the keychain (records `secret` meta). An empty round-trip must
+* not wipe it — see {@link mergeMatterSecrets}.
+*/
+function publicMatterConnection(connection) {
+	return {
+		...connection,
+		wifiPassword: "",
+		threadDataset: ""
+	};
+}
+/** Hand-written connection form for the broker/integration creation UI. */
+function buildConnectionFormSchema() {
+	return { sections: [{
+		id: "matter-fabric",
+		title: "Matter fabric",
+		titleKey: "matter-broker:connection.s_matter-fabric.title",
+		description: "CamStack owns a Matter fabric on this hub. Add wireless onboarding credentials only if you will commission Thread or BLE-Wi-Fi devices. On-network (Ethernet/Wi-Fi) Matter devices need none of these.",
+		descriptionKey: "matter-broker:connection.s_matter-fabric.description",
+		columns: 1,
+		fields: [
+			{
+				type: "password",
+				key: "threadDataset",
+				secret: true,
+				showToggle: true,
+				label: "Thread operational dataset (hex, optional)",
+				labelKey: "matter-broker:connection.s_matter-fabric.threadDataset.label",
+				placeholder: "0e08000000000001…"
+			},
+			{
+				type: "text",
+				key: "wifiSsid",
+				label: "Wi-Fi SSID (optional)",
+				labelKey: "matter-broker:connection.s_matter-fabric.wifiSsid.label"
+			},
+			{
+				type: "password",
+				key: "wifiPassword",
+				label: "Wi-Fi password (optional)",
+				labelKey: "matter-broker:connection.s_matter-fabric.wifiPassword.label",
+				showToggle: true
+			},
+			{
+				type: "number",
+				key: "reconcileIntervalMs",
+				label: "Node reconcile interval (ms)",
+				labelKey: "matter-broker:connection.s_matter-fabric.reconcileIntervalMs.label",
+				min: 1e4,
+				max: 864e5,
+				default: 3e5
+			}
+		]
+	}] };
+}
 //#endregion
 //#region ../../node_modules/@matter/general/dist/esm/net/tcp/TcpConnection.js
 /**
@@ -207501,7 +207810,6 @@ var MatterBrokerRegistry = class {
 	#onAttributeReport;
 	#makeManager;
 	#managers = /* @__PURE__ */ new Map();
-	#integrationToBroker = /* @__PURE__ */ new Map();
 	#nextId = 1;
 	constructor(logger, deps) {
 		this.#logger = logger;
@@ -207550,7 +207858,6 @@ var MatterBrokerRegistry = class {
 			}
 		}));
 		this.#managers.clear();
-		this.#integrationToBroker.clear();
 	}
 	setOnBrokerConnected(cb) {
 		this.#onBrokerConnected = cb;
@@ -207570,17 +207877,14 @@ var MatterBrokerRegistry = class {
 		const entry = {
 			id,
 			name,
-			connection,
-			...opts.integrationId !== void 0 ? { integrationId: opts.integrationId } : {}
+			connection
 		};
 		await this.#startManager(entry);
-		if (opts.integrationId !== void 0) this.#integrationToBroker.set(opts.integrationId, id);
 		return entry;
 	}
 	async removeEntry(id) {
 		const mgr = this.#managers.get(id);
 		if (!mgr) return;
-		for (const [integrationId, brokerId] of this.#integrationToBroker.entries()) if (brokerId === id) this.#integrationToBroker.delete(integrationId);
 		this.#managers.delete(id);
 		try {
 			await mgr.stop();
@@ -207621,9 +207925,6 @@ var MatterBrokerRegistry = class {
 		if (!mgr) throw new Error(`MatterBrokerRegistry: unknown broker id "${brokerId}"`);
 		await mgr.invokeCommand(invocation);
 	}
-	linkIntegration(integrationId, brokerId) {
-		this.#integrationToBroker.set(integrationId, brokerId);
-	}
 	list() {
 		return Array.from(this.#managers.values()).map((m) => m.getInfo());
 	}
@@ -207642,10 +207943,7 @@ var MatterBrokerRegistry = class {
 		return count;
 	}
 	async #startManager(entry) {
-		if (this.#managers.has(entry.id)) {
-			if (entry.integrationId !== void 0) this.#integrationToBroker.set(entry.integrationId, entry.id);
-			return;
-		}
+		if (this.#managers.has(entry.id)) return;
 		const mgr = this.#makeManager({
 			id: entry.id,
 			name: entry.name,
@@ -207658,7 +207956,6 @@ var MatterBrokerRegistry = class {
 			onAttributeReport: (id, report) => this.#onAttributeReport(id, report)
 		});
 		this.#managers.set(entry.id, mgr);
-		if (entry.integrationId !== void 0) this.#integrationToBroker.set(entry.integrationId, entry.id);
 		await mgr.start();
 	}
 	/** The next free broker id, for a record minted before its manager exists. */
@@ -207678,111 +207975,6 @@ var MatterBrokerRegistry = class {
 	}
 };
 //#endregion
-//#region src/config.ts
-/**
-* Matter broker connection settings for ONE fabric/controller (one broker entry).
-* v1 is intentionally minimal: optional Thread / Wi-Fi credentials supplied up
-* front for wireless commissioning. The pairing code itself is NOT stored here —
-* it is passed transiently to the commissioning action.
-*
-* The fabric credentials (root cert / NOC / node registry) live in the addon
-* `dataDir` via the controller's storage, NEVER in this typed KV.
-*/
-var matterConnectionSchema = object({
-	/** Optional Thread operational dataset (hex) for Thread device onboarding. */
-	threadDataset: string$2().default("").describe("Thread operational dataset (hex) — required only for Thread devices").meta({ secret: true }),
-	/** Optional Wi-Fi SSID for Wi-Fi device onboarding over BLE. */
-	wifiSsid: string$2().default("").describe("Wi-Fi SSID — required only for BLE Wi-Fi onboarding"),
-	/** Optional Wi-Fi password for Wi-Fi device onboarding over BLE. */
-	wifiPassword: string$2().default("").describe("Wi-Fi password (optional)").meta({ secret: true }),
-	/** PULL-reconcile interval for the commissioned-node inventory. */
-	reconcileIntervalMs: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(1e4).max(864e5).default(3e5)).describe("Node-inventory reconcile interval (ms)")
-});
-/** A single registered Matter fabric ("broker"). */
-var MatterBrokerEntrySchema = object({
-	id: string$2().min(1),
-	name: string$2().min(1),
-	connection: matterConnectionSchema,
-	integrationId: string$2().optional(),
-	/** Absent means on; the instances page switches a fabric off without deleting it. */
-	enabled: boolean().optional()
-});
-/** Top-level addon config — the fabrics are records, so nothing is left here. */
-var matterAddonConfigSchema = object({});
-/** Narrow an `unknown` to a shallow plain-object record (cast-free boundary). */
-function toRecord(value) {
-	if (typeof value === "object" && value !== null && !Array.isArray(value)) return Object.fromEntries(Object.entries(value));
-	return {};
-}
-/** Coerce a loose settings blob through the connection schema, applying defaults. */
-function settingsToMatterConnection(settings) {
-	return matterConnectionSchema.parse(toRecord(settings));
-}
-/**
-* Settings readers see an empty string for both secrets. The stored value
-* stays in the keychain (records `secret` meta). An empty round-trip must
-* not wipe it — see {@link mergeMatterSecrets}.
-*/
-function publicMatterConnection(connection) {
-	return {
-		...connection,
-		wifiPassword: "",
-		threadDataset: ""
-	};
-}
-/** Keep a stored secret when the form sent back the redacted empty string. */
-function mergeMatterSecrets(existing, incoming) {
-	return {
-		...incoming,
-		wifiPassword: incoming.wifiPassword.length > 0 ? incoming.wifiPassword : existing.wifiPassword,
-		threadDataset: incoming.threadDataset.length > 0 ? incoming.threadDataset : existing.threadDataset
-	};
-}
-/** Hand-written connection form for the broker/integration creation UI. */
-function buildConnectionFormSchema() {
-	return { sections: [{
-		id: "matter-fabric",
-		title: "Matter fabric",
-		titleKey: "matter-broker:connection.s_matter-fabric.title",
-		description: "CamStack owns a Matter fabric on this hub. Add wireless onboarding credentials only if you will commission Thread or BLE-Wi-Fi devices. On-network (Ethernet/Wi-Fi) Matter devices need none of these.",
-		descriptionKey: "matter-broker:connection.s_matter-fabric.description",
-		columns: 1,
-		fields: [
-			{
-				type: "password",
-				key: "threadDataset",
-				secret: true,
-				showToggle: true,
-				label: "Thread operational dataset (hex, optional)",
-				labelKey: "matter-broker:connection.s_matter-fabric.threadDataset.label",
-				placeholder: "0e08000000000001…"
-			},
-			{
-				type: "text",
-				key: "wifiSsid",
-				label: "Wi-Fi SSID (optional)",
-				labelKey: "matter-broker:connection.s_matter-fabric.wifiSsid.label"
-			},
-			{
-				type: "password",
-				key: "wifiPassword",
-				label: "Wi-Fi password (optional)",
-				labelKey: "matter-broker:connection.s_matter-fabric.wifiPassword.label",
-				showToggle: true
-			},
-			{
-				type: "number",
-				key: "reconcileIntervalMs",
-				label: "Node reconcile interval (ms)",
-				labelKey: "matter-broker:connection.s_matter-fabric.reconcileIntervalMs.label",
-				min: 1e4,
-				max: 864e5,
-				default: 3e5
-			}
-		]
-	}] };
-}
-//#endregion
 //#region src/matter-commissioning.ts
 /** A clear validation error for a malformed pairing code. */
 var InvalidPairingCodeError = class extends Error {
@@ -207813,7 +208005,7 @@ function parsePairingCode(raw) {
 		normalized: digits
 	};
 }
-/** True when a code parses cleanly (no throw). Convenience for `testSettings`. */
+/** True when a code parses cleanly (no throw). Convenience for validating the pasted code. */
 function isValidPairingCode(raw) {
 	try {
 		parsePairingCode(raw);
@@ -207824,113 +208016,22 @@ function isValidPairingCode(raw) {
 }
 //#endregion
 //#region src/matter-broker-provider.ts
-var MATTER_KIND = "matter";
 /**
-* Construct the `broker` cap provider for the Matter addon. Pure builder.
-* Mirrors `buildEcowittBrokerProvider`. The defining Matter operation —
-* commissioning — is surfaced through `publish` with
-* `target: { action: 'commissionNode' }` and `payload: { pairingCode }`.
-* `threadDataset` and `wifiPassword` are redacted on settings reads and
-* preserved on an empty round-trip. Fabric keys stay in matter.js storage.
+* Construct the `broker` cap provider for the Matter addon: the bus only (D1013). The fabrics
+* themselves are the `account` kind of the addon's `integration-instances` provider. The defining
+* Matter operation, commissioning, is surfaced through `publish` with
+* `target: { action: 'commissionNode' }` and `payload: { pairingCode }`. `threadDataset` and
+* `wifiPassword` are redacted on config reads. Fabric keys stay in matter.js storage.
 */
 function buildMatterBrokerProvider(deps) {
-	const { ownerAddonId, registry, getBrokers, persistBrokers, cascadeRemoveDevices, logger } = deps;
+	const { registry, getBrokers } = deps;
 	const owns = (id) => getBrokers().some((b) => b.id === id);
 	const redact = (entry) => publicMatterConnection(entry.connection);
 	return {
-		list: async ({ kind }) => {
-			if (kind && kind !== MATTER_KIND) return [];
-			return registry.list().map((info) => ({
-				...info,
-				addonId: ownerAddonId
-			}));
-		},
-		get: async ({ id }) => {
-			const info = registry.get(id);
-			return info ? {
-				...info,
-				addonId: ownerAddonId
-			} : null;
-		},
-		listProviders: async () => [{
-			addonId: ownerAddonId,
-			kinds: [{
-				kind: MATTER_KIND,
-				label: "Matter"
-			}]
-		}],
-		add: async ({ kind, name, settings }) => {
-			if (kind !== MATTER_KIND) throw new Error(`matter-broker: only kind '${MATTER_KIND}' is handled here (got '${kind}')`);
-			const entry = await registry.createEntry(name, settingsToMatterConnection(settings));
-			await persistBrokers([...getBrokers(), entry]);
-			return { id: entry.id };
-		},
-		remove: async ({ id }) => {
-			if (!owns(id)) return;
-			await registry.removeEntry(id);
-			await cascadeRemoveDevices(id).catch((err) => {
-				logger.warn("matter: broker cascade-remove threw", {
-					tags: { brokerId: id },
-					meta: { error: errMsg(err) }
-				});
-			});
-			await persistBrokers(getBrokers().filter((b) => b.id !== id));
-		},
-		testConnection: async ({ id }) => {
-			if (!owns(id)) return {
-				ok: false,
-				error: "unknown broker"
-			};
-			const info = registry.get(id);
-			if (!info) return {
-				ok: false,
-				error: "unknown broker"
-			};
-			if (info.status === "connected") return {
-				ok: true,
-				latencyMs: info.lastCheckedAt ? Math.max(0, Date.now() - info.lastCheckedAt) : 0
-			};
-			return {
-				ok: false,
-				error: info.error ?? `status: ${info.status}`
-			};
-		},
-		getSettings: async ({ id }) => {
-			const entry = getBrokers().find((b) => b.id === id);
-			return entry ? redact(entry) : null;
-		},
-		setSettings: async ({ id, settings }) => {
-			if (!owns(id)) return;
-			const existing = getBrokers().find((b) => b.id === id);
-			if (!existing) return;
-			const parsed = settingsToMatterConnection(settings);
-			const merged = mergeMatterSecrets(existing.connection, parsed);
-			const updated = await registry.updateEntry(id, merged);
-			await persistBrokers(getBrokers().map((b) => b.id === id ? updated : b));
-		},
 		getBrokerConfig: async ({ id }) => {
 			const entry = getBrokers().find((b) => b.id === id);
 			return entry ? redact(entry) : null;
 		},
-		getSettingsSchema: async ({ kind }) => {
-			if (kind !== MATTER_KIND) return null;
-			return buildConnectionFormSchema();
-		},
-		testSettings: async ({ kind, settings }) => {
-			if (kind !== MATTER_KIND) return {
-				ok: false,
-				error: `unsupported kind: ${kind}`
-			};
-			try {
-				settingsToMatterConnection(settings);
-				return { ok: true };
-			} catch (err) {
-				return {
-					ok: false,
-					error: errMsg(err)
-				};
-			}
-		},
 		/**
 		* `publish` is the commissioning + control action channel.
 		* `target: { action: 'commissionNode' }`, `payload: { pairingCode }` →
@@ -208150,8 +208251,8 @@ function buildMatterAdoptionProvider(deps) {
 //#region src/matter-broker-device-cascade.ts
 /**
 * Remove every adopted Matter PARENT device (children cascade via the kernel)
-* whose persisted config carries `{ system: 'matter', brokerId }`. Used on
-* broker.remove and integration delete. Best-effort per device; returns the
+* whose persisted config carries `{ system: 'matter', brokerId }`. Used when a
+* fabric instance is deleted and when an integration is deleted. Best-effort per device; returns the
 * count removed. Mirrors the Ecowitt cascade helper.
 */
 async function cascadeRemoveDevicesForBroker(input) {
@@ -208791,20 +208892,26 @@ var matterBrokersEntryKind = defineEntryKind("brokers", {
 	title: "Matter brokers",
 	schema: entryBody({
 		...matterConnectionSchema.shape,
+		/** Retired (D1012): the link lives on the integration's `connections` record. Only the migration reads it. */
 		integrationId: string$2().optional(),
 		enabled: boolean().optional()
 	}),
 	writeTrigger: "an operator adds, edits or removes a Matter fabric broker",
 	retiredSecretPaths: ["connection.threadDataset", "connection.wifiPassword"]
 });
+/** A Matter integration: the link to the fabric (broker) it imports devices from. */
+var matterConnectionsEntryKind = declareBrokerLinkKind({
+	title: "Matter integrations",
+	writeTrigger: "an operator links a Matter integration to a Matter fabric"
+});
 //#endregion
-//#region src/matter-instances.ts
+//#region src/matter-account-instances.ts
 /**
-* The Matter fabrics as `integration-instances` (planning#408 P3): one instance per `brokers`
+* The Matter fabrics as `integration-instances` (planning#408 P3, D1013; the `account` kind of the composed provider, the integrations are `matter-instances.ts`): one instance per `brokers`
 * record, over the SAME records and ids (`matter_NNN`) the `broker` cap serves. The body is flat.
 * A fabric needs no sign-in; commissioning a device stays on the adoption flow, behind the fabric.
 */
-var MATTER_INSTANCE_KIND = "matter";
+var MATTER_ACCOUNT_KIND = "account";
 function statusOf(info) {
 	if (info === null) return {
 		state: "unknown",
@@ -208824,17 +208931,13 @@ function statusOf(info) {
 		...info.error !== null ? { detail: info.error } : {}
 	};
 }
-function buildMatterInstances(records, deps) {
+function buildMatterAccountInstances(records, deps) {
 	return new RecordIntegrationInstances(records, matterBrokersEntryKind, {
 		description: {
-			role: "both",
+			role: "services",
 			instanceMode: "multiple",
 			kind: "connection",
 			canTest: true,
-			kinds: [{
-				id: MATTER_INSTANCE_KIND,
-				label: "Matter"
-			}],
 			allowRestoreId: true
 		},
 		formSchema: () => buildConnectionFormSchema(),
@@ -208846,7 +208949,7 @@ function buildMatterInstances(records, deps) {
 			reconcileIntervalMs: 3e5
 		}),
 		mintId: () => deps.mintId(),
-		kindOf: () => MATTER_INSTANCE_KIND,
+		kindOf: () => MATTER_ACCOUNT_KIND,
 		health: (_body, id) => {
 			const info = deps.infoOf(id);
 			return {
@@ -208875,6 +208978,22 @@ function buildMatterInstances(records, deps) {
 	});
 }
 //#endregion
+//#region src/matter-instances.ts
+/**
+* The Matter integrations as `integration-instances` (D1012): one `connections` record per
+* integration, keyed by the registry id, whose body is the link to a Matter fabric (a `brokers`
+* record, edited on the Brokers page).
+*/
+var MATTER_BROKER_KIND = "matter";
+function buildMatterInstances(records) {
+	return buildBrokerLinkInstances(records, {
+		kind: matterConnectionsEntryKind,
+		brokerKind: MATTER_BROKER_KIND,
+		brokerLabel: "Matter fabric",
+		onChanged: () => void 0
+	});
+}
+//#endregion
 //#region src/migrations/flatten-broker-records.ts
 /**
 * The Matter broker records keep their fabric settings flat (planning#408 P3): the nested
@@ -208898,6 +209017,21 @@ async function flattenBrokerRecords(ports) {
 	});
 }
 //#endregion
+//#region src/migrations/broker-links-to-connections.ts
+var BROKER_LINKS_TO_CONNECTIONS_ID = "matter-broker/2026-11-05-broker-links-to-connections";
+/** The broker records and the integration (`connections`) records of this addon. */
+function matterBrokerLinkPorts(records, warn) {
+	return brokerLinkPortsOver({
+		brokers: records.kind({
+			name: matterBrokersEntryKind.name,
+			declaration: matterBrokersEntryKind.declaration,
+			schema: record(string$2(), unknown())
+		}),
+		connections: records.kind(matterConnectionsEntryKind),
+		warn
+	});
+}
+//#endregion
 //#region src/migrations/index.ts
 /** The `matter-broker` catalogue (D987): offered to the engine when the addon initialises. */
 var ADDON_MIGRATIONS = [{
@@ -208915,6 +209049,21 @@ var ADDON_MIGRATIONS = [{
 		fixtureMark: "the integration link and the Wi-Fi SSID of each fabric"
 	},
 	procedure: flattenBrokerRecords
+}, {
+	meta: {
+		id: BROKER_LINKS_TO_CONNECTIONS_ID,
+		owner: "matter-broker",
+		level: "addon-state",
+		seq: 2,
+		dependsOn: [FLATTEN_BROKER_RECORDS_ID],
+		store: "settings",
+		scope: "cluster",
+		onFailure: "block-owner",
+		bodyKind: "procedure",
+		description: "Write each integration a connections record naming its Matter fabric (keyed by the integration id), then clear the integration link on the fabric; stray registry-keyed fabric rows are counted and logged, never deleted",
+		fixtureMark: "the name and the Wi-Fi SSID of the fabric that keeps its record"
+	},
+	procedure: moveBrokerLinksToConnections
 }];
 //#endregion
 //#region src/matter-broker-store.ts
@@ -208928,7 +209077,6 @@ function rowToEntry(id, data) {
 			wifiPassword: data.wifiPassword,
 			reconcileIntervalMs: data.reconcileIntervalMs
 		},
-		integrationId: data.integrationId,
 		enabled: data.enabled
 	});
 	return parsed.success ? parsed.data : null;
@@ -208965,11 +209113,10 @@ var MatterBrokerStore = class MatterBrokerStore {
 		const nextIds = new Set(entries.map((e) => e.id));
 		for (const row of page.records) if (!nextIds.has(row.id)) await this.kind.delete(row.id);
 		for (const entry of entries) {
-			const { id, name, connection, integrationId, enabled } = entry;
+			const { id, name, connection, enabled } = entry;
 			const body = {
 				name,
 				...connection,
-				...integrationId === void 0 ? {} : { integrationId },
 				...enabled === void 0 ? {} : { enabled }
 			};
 			const parsed = matterBrokersEntryKind.schema.safeParse(body);
@@ -209007,6 +209154,7 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 	registry = null;
 	brokerStore = null;
 	instances = null;
+	accountInstances = null;
 	activeBrokers = [];
 	constructor() {
 		super({ ...DEFAULTS });
@@ -209015,15 +209163,22 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 		const regs = this.providerRegistrationsFromSuper(await super.onInitialize());
 		const records = this.ctx.records;
 		if (records === void 0) throw new Error("matter-broker: ctx.records is required (hub-only addon)");
-		await records.declare({ brokers: matterBrokersEntryKind });
+		await records.declare({
+			brokers: matterBrokersEntryKind,
+			connections: matterConnectionsEntryKind
+		});
 		this.brokerStore = MatterBrokerStore.of(records);
-		this.instances = buildMatterInstances(records, {
+		this.instances = buildMatterInstances(records);
+		this.accountInstances = buildMatterAccountInstances(records, {
 			mintId: () => this.requireRegistry().allocateId(),
 			infoOf: (id) => this.registry?.get(id) ?? null,
 			onChanged: (id) => this.syncBrokerRuntime(id)
 		});
 		if (this.ctx.secrets === void 0) throw new Error("matter-broker: ctx.secrets is required");
-		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, flattenPortsOver(records.kind(matterBrokersEntryKind))));
+		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, {
+			...flattenPortsOver(records.kind(matterBrokersEntryKind)),
+			...matterBrokerLinkPorts(records, (message) => this.ctx.logger.warn(message))
+		}));
 		this.activeBrokers = await this.loadPersistedBrokers();
 		this.registry = new MatterBrokerRegistry(this.ctx.logger, {
 			dataDir: this.ctx.dataDir,
@@ -209044,8 +209199,6 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 		matterCommands.setDispatcher((brokerId, invocation) => this.requireRegistry().invokeCommand(brokerId, invocation));
 		await this.registry.restore(this.activeBrokers);
 		this.ctx.logger.info("Matter: broker addon initialised", { meta: { brokerCount: this.activeBrokers.length } });
-		await this.reconcileIntegrationsToBrokers();
-		this.subscribeIntegrationLifecycle();
 		return [
 			...regs,
 			{
@@ -209054,7 +209207,7 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 			},
 			{
 				capability: integrationInstancesCapability,
-				provider: this.requireInstances().toProvider()
+				provider: this.buildInstancesProvider()
 			},
 			{
 				capability: deviceAdoptionCapability,
@@ -209073,9 +209226,37 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 		if (this.instances === null) throw new Error("matter-broker: instances not ready");
 		return this.instances;
 	}
+	/** One provider over the two record kinds: the fabric (broker) and the integrations using it. */
+	buildInstancesProvider() {
+		if (this.accountInstances === null) throw new Error("matter-broker: fabric instances not ready");
+		return composeInstanceKinds([{
+			kind: {
+				id: "account",
+				label: "Matter fabric",
+				functionCap: "broker",
+				brokerKind: "matter",
+				role: "services"
+			},
+			provider: guardBrokerDelete(this.accountInstances.toProvider(), () => [brokerLinkUserFinder(this.requireInstances())])
+		}, {
+			kind: {
+				id: "integration",
+				label: "Matter",
+				functionCap: "device-provider",
+				role: "devices"
+			},
+			provider: this.requireInstances().toProvider()
+		}], {
+			role: "devices",
+			instanceMode: "multiple",
+			kind: "account",
+			canTest: true,
+			allowRestoreId: true
+		});
+	}
 	/**
-	* Bring the runtime in line with one record after the instances page changed it: a removed
-	* record stops its controller and cascades its devices, an off record only stops the
+	* Bring the runtime in line with one fabric record after the instances page changed it: a
+	* removed record stops its controller and cascades its devices, an off record only stops the
 	* controller, a live one re-applies its settings or starts under the record's own id.
 	*/
 	async syncBrokerRuntime(id) {
@@ -209093,10 +209274,7 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 		}
 		try {
 			if (reg.get(id) !== null) await reg.updateEntry(id, entry.connection);
-			else await reg.createEntry(entry.name, entry.connection, {
-				id,
-				...entry.integrationId !== void 0 ? { integrationId: entry.integrationId } : {}
-			});
+			else await reg.createEntry(entry.name, entry.connection, { id });
 		} catch (err) {
 			this.ctx.logger.warn("matter instance: could not start the fabric", { meta: {
 				brokerId: id,
@@ -209223,12 +209401,8 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 	}
 	buildBrokerProvider() {
 		return buildMatterBrokerProvider({
-			ownerAddonId: this.ctx.id,
 			registry: this.requireRegistry(),
-			getBrokers: () => this.activeBrokers,
-			persistBrokers: (brokers) => this.persistBrokerEntries(brokers),
-			cascadeRemoveDevices: (brokerId) => this.cascadeRemoveDevicesForBroker(brokerId),
-			logger: this.ctx.logger
+			getBrokers: () => this.activeBrokers
 		});
 	}
 	async cascadeRemoveDevicesForBroker(brokerId) {
@@ -209243,42 +209417,6 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 			logger: this.ctx.logger
 		});
 	}
-	async reconcileIntegrationsToBrokers() {
-		try {
-			const mine = (await this.ctx.api.integrations.list.query()).filter((i) => i.addonId === this.ctx.id);
-			const surviving = new Set(mine.map((i) => i.id));
-			for (const broker of this.activeBrokers) {
-				const integrationId = broker.integrationId;
-				if (integrationId === void 0 || !surviving.has(integrationId)) continue;
-				this.requireRegistry().linkIntegration(integrationId, broker.id);
-			}
-			const toRemove = this.activeBrokers.filter((b) => b.integrationId !== void 0 && !surviving.has(b.integrationId)).map((b) => b.id);
-			if (toRemove.length === 0) return;
-			for (const id of toRemove) try {
-				await this.requireRegistry().removeEntry(id);
-				await this.cascadeRemoveDevicesForBroker(id);
-			} catch (err) {
-				this.ctx.logger.warn("Matter integration→broker: broker cleanup failed", { meta: {
-					brokerId: id,
-					error: errMsg(err)
-				} });
-			}
-			const nextBrokers = this.activeBrokers.filter((b) => !toRemove.includes(b.id));
-			await this.persistBrokerEntries(nextBrokers);
-		} catch (err) {
-			this.ctx.logger.warn("Matter integration→broker reconcile failed", { meta: { error: errMsg(err) } });
-		}
-	}
-	subscribeIntegrationLifecycle() {
-		const handler = (event) => {
-			const addonId = event.data["addonId"];
-			if (typeof addonId === "string" && addonId !== this.ctx.id) return;
-			this.reconcileIntegrationsToBrokers();
-		};
-		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationEnabled }, handler);
-		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationDisabled }, handler);
-		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationDeleted }, handler);
-	}
 	buildAdoptionProvider() {
 		return buildMatterAdoptionProvider({
 			registry: {
@@ -209291,9 +209429,9 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 			},
 			logger: this.ctx.logger,
 			getBrokerIdForIntegration: async (id) => {
-				const broker = this.activeBrokers.find((entry) => entry.integrationId === id);
-				if (broker === void 0) throw new Error(`integration ${id} has no linked brokerId`);
-				return broker.id;
+				const brokerId = await brokerIdOf(this.requireInstances(), id);
+				if (brokerId === void 0) throw new Error(`integration ${id} has no broker`);
+				return brokerId;
 			},
 			listAdoptedMatter: async () => {
 				const reg = this.ctx.kernel.deviceRegistry;
@@ -209344,22 +209482,9 @@ var MatterBrokerAddon = class extends BaseDeviceProvider {
 			}
 		});
 	}
-	globalSettingsSchema() {
-		return this.schema({ sections: [{
-			id: "matter-fabric",
-			title: "Matter fabric",
-			titleKey: "matter-broker:globalSettings.s_matter-fabric.title",
-			description: "Matter fabrics are managed in the External systems → Brokers tab.",
-			descriptionKey: "matter-broker:globalSettings.s_matter-fabric.description",
-			columns: 1,
-			fields: [{
-				type: "info",
-				key: "fabricHelp",
-				label: "Fabrics are managed separately",
-				labelKey: "matter-broker:globalSettings.s_matter-fabric.fabricHelp.label",
-				content: "This integration links to a Matter fabric broker. Add, edit, or remove fabrics from External systems → Brokers, then commission devices into the fabric. The integration only stores a reference to its broker."
-			}]
-		}] });
+	/** The connection form a record carries; the values live on the record, never in `addon-settings`. */
+	async integrationFormSchema(_instance) {
+		return buildConnectionFormSchema();
 	}
 	async supportsManualCreation() {
 		return false;
@@ -209408,4 +209533,4 @@ function endpointsEqual(a, b) {
 	return true;
 }
 //#endregion
-export { MatterBrokerAddon, parsePairingCode as a, matterConnectionSchema as c, endpointLabel as d, mapMatterEndpointToCamStack as f, createMatterController as h, isValidPairingCode as i, settingsToMatterConnection as l, StubMatterController as m, endpointNativeId as n, buildConnectionFormSchema as o, MatterControllerNotWiredError as p, InvalidPairingCodeError as r, matterAddonConfigSchema as s, buildMatterNodeCandidate as t, MatterClusterId as u };
+export { MatterBrokerAddon, parsePairingCode as a, mapMatterEndpointToCamStack as c, createMatterController as d, buildConnectionFormSchema as f, settingsToMatterConnection as h, isValidPairingCode as i, MatterControllerNotWiredError as l, matterConnectionSchema as m, endpointNativeId as n, MatterClusterId as o, matterAddonConfigSchema as p, InvalidPairingCodeError as r, endpointLabel as s, buildMatterNodeCandidate as t, StubMatterController as u };