@camstack/addon-mqtt-broker 1.2.149 → 1.2.151

package/dist/mqtt-broker.addon.mjs

@@ -6021,7 +6021,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BKClVk0K.mjs
+//#region ../types/dist/sleep-DEZaLbiu.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6621,7 +6621,7 @@ var NOT_RUN = {
 * throws: an unreachable or refusing engine is logged and reported `declared: false`,
 * because the hub (and this addon's boot) must not hang on a migration.
 */
-async function runAddonMigrations(host, migrations, logger) {
+async function runAddonMigrations(host, migrations, logger, options = {}) {
 	const first = migrations[0];
 	if (first === void 0) return NOT_RUN;
 	const owner = first.meta.owner;
@@ -6650,7 +6650,9 @@ async function runAddonMigrations(host, migrations, logger) {
 		else if (status === "blocked") blocked.push(id);
 		else skipped.push(id);
 	};
+	const selected = options.only === void 0 ? null : new Set(options.only);
 	for (const step of declaration.steps) {
+		if (selected !== null && !selected.has(step.id)) continue;
 		const bound = byId.get(step.id);
 		if (bound === void 0 || step.action === "skip") {
 			skipped.push(step.id);
@@ -6828,6 +6830,12 @@ function projectStore(store, perNodeKeys, nodeId) {
 	}
 	return out;
 }
+/** Every scope, in the order the guard and the docs list them. */
+var SCOPED_SETTINGS_SCOPES = [
+	"cluster",
+	"device-defaults",
+	"node"
+];
 /**
 * The address of one keychain value: `secret://<owner>/<scope>/<fieldPath>`.
 *
@@ -7719,6 +7727,13 @@ var BaseAddon = class {
 	*/
 	secretStatePaths = [];
 	_addonSecretTree = null;
+	/**
+	* D986 M4: the scoped schemas this addon declared, resolved once per capability
+	* (`loadScopedSchemas`) so the sync readers (`perNodeKeys`, the secret tree, the restart check)
+	* see them. Empty until loaded: the readers then fall back to {@link globalSettingsSchema}.
+	*/
+	_scopedByCap = /* @__PURE__ */ new Map();
+	_nodeKeysByCap = /* @__PURE__ */ new Map();
 	_deviceSecretTree = null;
 	/** Refs the last resolved config pointed at — a change to one re-resolves. */
 	_configSecretRefs = /* @__PURE__ */ new Set();
@@ -7788,6 +7803,7 @@ var BaseAddon = class {
 			this._ctx = context;
 			this._secretSettings = null;
 		}
+		await this.loadScopedSchemas();
 		await this.resolveConfig();
 		if (secrets !== void 0) this._secretChangeUnsub = secrets.onChange((ref) => {
 			if (this._configSecretRefs.has(ref)) this.scheduleSecretReresolve(SECRET_CHANGE_DEBOUNCE_MS);
@@ -7797,6 +7813,7 @@ var BaseAddon = class {
 		const normalized = normalizeAddonInitResult(result);
 		const providers = normalized && "providers" in normalized && normalized.providers ? normalized.providers : [];
 		this._registeredCapNames = providers.map((p) => p.capability.name);
+		await this.loadScopedSchemas();
 		return normalized;
 	}
 	/**
@@ -7810,14 +7827,18 @@ var BaseAddon = class {
 	* nothing; the boot continues. A migration that FAILED (or was blocked by one)
 	* and declares `onFailure: 'block-owner'` makes this throw, so the addon does not
 	* serve data whose shape it cannot trust; `tolerate` migrations never do.
+	*
+	* ALWAYS pass the whole catalogue; a phase that must run only some of it passes
+	* `{ only: [ids] }` — never a filtered catalogue (the engine would judge the
+	* omitted applied ids "newer").
 	*/
-	async runMigrations(migrations) {
+	async runMigrations(migrations, options) {
 		const api = this.ctx.api.migrations;
 		const report = await runAddonMigrations({
 			declareOwner: (input) => api.declareOwner.mutate(input),
 			startMigration: (input) => api.startMigration.mutate(input),
 			finishMigration: (input) => api.finishMigration.mutate(input)
-		}, migrations, this.ctx.logger);
+		}, migrations, this.ctx.logger, options);
 		if (report.blockOwner.length > 0) throw new AddonMigrationsBlockedError(report.blockOwner);
 		return report;
 	}
@@ -7881,6 +7902,16 @@ var BaseAddon = class {
 	schema(schema) {
 		return schema;
 	}
+	/**
+	* The capability names whose scoped settings schemas ({@link clusterSettingsSchema},
+	* {@link nodeSettingsSchema}, {@link deviceDefaultsSchema}) this addon declares. Read BEFORE
+	* `onInitialize`, when the providers it registers are not known yet: the first config resolve
+	* must already know which keys are per node. Names the providers register at init are added
+	* once known.
+	*/
+	scopedSettingsCapabilities() {
+		return [];
+	}
 	/** Override to provide global-level settings UI schema. */
 	globalSettingsSchema(_cap) {
 		return null;
@@ -7924,7 +7955,8 @@ var BaseAddon = class {
 		return [];
 	}
 	async getGlobalSettings(overlay, cap, nodeId) {
-		const schema = this.globalSettingsSchema(cap);
+		await this.loadScopedSchemas(cap);
+		const schema = this.globalSettingsSchema(cap) ?? this.scopedFormSchema(cap);
 		if (!schema) return { sections: [] };
 		const projected = await this.readRawProjectedStore(nodeId, cap);
 		return hydrateSchema(schema, overlay ? await this.overlayKeepingMarkers(projected, overlay) : projected, { inlineSecretsAsViews: true });
@@ -7959,10 +7991,9 @@ var BaseAddon = class {
 	*
 	* Override it only when an `instanceMode: multiple` addon's instances differ: an NVR integration
 	* needs its connection fields, the default integration the addon's own sections. It is the
-	* SHAPE of the form only — the values live in `integrations.getSettings`, and the write path is
-	* unchanged (`integrations.setSettings` for an account integration).
+	* SHAPE of the form only — the values live on the instance record.
 	*/
-	async integrationSettingsSchema(_instance) {
+	async integrationFormSchema(_instance) {
 		return null;
 	}
 	/**
@@ -8008,7 +8039,7 @@ var BaseAddon = class {
 	* per-instance schema when it declares one, else its global schema (what they always showed).
 	*/
 	async getIntegrationFormSchema(instance, nodeId) {
-		const scoped = await this.integrationSettingsSchema(instance);
+		const scoped = await this.integrationFormSchema(instance);
 		if (scoped === null) return this.getGlobalSettings(void 0, void 0, nodeId);
 		return hydrateSchema(scoped, {}, { inlineSecretsAsViews: true });
 	}
@@ -8056,6 +8087,7 @@ var BaseAddon = class {
 	* resolved blob back is a no-op for every unchanged secret.
 	*/
 	async resolveGlobalStore(nodeId, cap) {
+		await this.loadScopedSchemas(cap);
 		const raw = await this._ctx?.settings?.readAddonStore() ?? {};
 		return this.projectForNode(raw, nodeId, cap);
 	}
@@ -8066,6 +8098,7 @@ var BaseAddon = class {
 	}
 	/** The PROJECTED store with its markers — the form hydrate only (D798). */
 	async readRawProjectedStore(nodeId, cap) {
+		await this.loadScopedSchemas(cap);
 		const raw = await this.rawSettings()?.readAddonStore() ?? {};
 		return this.projectForNode(raw, nodeId, cap);
 	}
@@ -8158,12 +8191,17 @@ var BaseAddon = class {
 		const stored = keychain ? await this.readAddonStoreWithRetry() : {};
 		const patch = {};
 		for (const key of keys) {
+			if (tree.get(key)?.kind === "array") {
+				patch[key] = [];
+				continue;
+			}
 			const keychainStored = tree.has(key) || collectSecretMarkerRefs(stored[key]).length > 0;
 			patch[key] = keychain && keychainStored ? SECRET_CLEAR : "";
 		}
 		await this.applyGlobalPatch(patch, nodeId);
 	}
 	async applyGlobalPatch(barePatch, nodeId) {
+		await this.loadScopedSchemas();
 		const keys = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
@@ -8177,7 +8215,8 @@ var BaseAddon = class {
 		await this.resolveConfig();
 		await this.onConfigChanged();
 		this.emitLifecycle(EventCategory.AddonUpdated, { level: "global" });
-		this.maybeAutoRestart(Object.keys(barePatch), this.globalSettingsSchema());
+		const legacy = this.globalSettingsSchema();
+		this.maybeAutoRestart(Object.keys(barePatch), [...legacy === null ? [] : [legacy], ...this.loadedScopedSchemas().map((entry) => entry.schema)]);
 	}
 	/**
 	* The set of field keys the global settings schema declares `perNode: true`
@@ -8185,14 +8224,67 @@ var BaseAddon = class {
 	* declarations). Empty set ⇒ every per-node code path is bypassed and the
 	* settings API behaves exactly like the legacy node-agnostic one.
 	*/
-	_perNodeKeysCache = /* @__PURE__ */ new Map();
+	/**
+	* Load the scoped schemas of every capability this addon declares (the override and the
+	* providers registered at init, plus `extraCap`) that is not loaded yet, then drop what was
+	* derived from the previous set. Idempotent.
+	*/
+	async loadScopedSchemas(extraCap) {
+		const caps = new Set([
+			...this.scopedSettingsCapabilities(),
+			...this._registeredCapNames,
+			...extraCap === void 0 ? [] : [extraCap]
+		]);
+		let added = false;
+		for (const cap of caps) {
+			if (this._scopedByCap.has(cap)) continue;
+			const loaded = [];
+			for (const scope of SCOPED_SETTINGS_SCOPES) {
+				const schema = await this.getScopedSettingsSchema(scope, cap);
+				if (schema !== null) loaded.push({
+					scope,
+					schema
+				});
+			}
+			this._scopedByCap.set(cap, loaded);
+			added = true;
+		}
+		if (!added) return;
+		this._nodeKeysByCap = /* @__PURE__ */ new Map();
+		this._addonSecretTree = null;
+	}
+	/**
+	* The form the settings API serves while an addon declares no {@link globalSettingsSchema}: the
+	* sections of its scoped schemas, so dropping the old hook does not blank the form.
+	*/
+	scopedFormSchema(cap) {
+		const byId = /* @__PURE__ */ new Map();
+		for (const entry of this.loadedScopedSchemas(cap)) for (const section of entry.schema.sections) if (!byId.has(section.id)) byId.set(section.id, section);
+		return byId.size === 0 ? null : { sections: [...byId.values()] };
+	}
+	/** Every loaded scoped schema of `cap`, or of every loaded capability. */
+	loadedScopedSchemas(cap) {
+		if (cap !== void 0) return this._scopedByCap.get(cap) ?? [];
+		return [...this._scopedByCap.values()].flat();
+	}
+	/**
+	* The field keys that are stored per node: every field of a {@link nodeSettingsSchema}, plus
+	* the fields the legacy {@link globalSettingsSchema} still marks `perNode: true`. Derived once
+	* per `cap` argument and memoized (schemas are static declarations). Empty set ⇒ every
+	* per-node code path is bypassed and the settings API behaves like the node-agnostic one.
+	* Call {@link loadScopedSchemas} first (the async seams do).
+	*/
 	perNodeKeys(cap) {
 		const cacheKey = cap ?? "";
-		const cached = this._perNodeKeysCache.get(cacheKey);
+		const cached = this._nodeKeysByCap.get(cacheKey);
 		if (cached) return cached;
-		const schema = this.globalSettingsSchema(cap);
-		const keys = new Set(schema ? schema.sections.flatMap((section) => collectPerNodeFieldKeys(section.fields)) : []);
-		this._perNodeKeysCache.set(cacheKey, keys);
+		const legacy = this.globalSettingsSchema(cap);
+		const keys = new Set(legacy ? legacy.sections.flatMap((section) => collectPerNodeFieldKeys(section.fields)) : []);
+		for (const { scope, schema } of this.loadedScopedSchemas(cap)) {
+			if (scope !== "node") continue;
+			for (const section of schema.sections) for (const key of collectValueFieldKeys(section.fields)) keys.add(key);
+		}
+		this._nodeKeysByCap.set(cacheKey, keys);
 		return keys;
 	}
 	/**
@@ -8202,10 +8294,9 @@ var BaseAddon = class {
 	* time to return its response before the addon is torn down and
 	* re-initialised by `AddonRegistryService.restartAddon`.
 	*/
-	maybeAutoRestart(patchKeys, schema) {
-		if (!schema) return;
+	maybeAutoRestart(patchKeys, schemas) {
 		const restartKeys = /* @__PURE__ */ new Set();
-		for (const section of schema.sections) for (const field of section.fields) {
+		for (const schema of schemas) for (const section of schema.sections) for (const field of section.fields) {
 			if (field.type === "separator" || field.type === "info") continue;
 			if (field.requiresRestart) restartKeys.add(field.key);
 		}
@@ -8401,12 +8492,14 @@ var BaseAddon = class {
 	* here, in the addon's own process, so the hub keeps no copy of it.
 	*/
 	async getDeclaredSettingsKeys() {
+		await this.loadScopedSchemas();
 		return { keys: [...this.declaredKeySet()].toSorted() };
 	}
 	declaredKeySet() {
 		const keys = new Set(Object.keys(this.defaults));
 		const schema = this.globalSettingsSchema();
 		if (schema) for (const section of schema.sections) for (const key of collectFieldKeys(section.fields)) keys.add(key);
+		for (const { schema: scoped } of this.loadedScopedSchemas()) for (const section of scoped.sections) for (const key of collectFieldKeys(section.fields)) keys.add(key);
 		for (const key of this._declaredStateKeys) keys.add(key);
 		for (const path of this.secretStatePaths) {
 			const root = path.split(/[.[]/, 1)[0];
@@ -8502,7 +8595,11 @@ var BaseAddon = class {
 	}
 	/** The addon store's secret tree: schema fields by TYPE, plus `secretStatePaths`. */
 	addonSecretTree() {
-		this._addonSecretTree ??= mergeSecretStatePaths(secretTreeFromSchema(this.globalSettingsSchema()), this.secretStatePaths);
+		if (this._addonSecretTree === null) {
+			const tree = new Map(secretTreeFromSchema(this.globalSettingsSchema()));
+			for (const { schema } of this.loadedScopedSchemas()) for (const [key, node] of secretTreeFromSchema(schema)) tree.set(key, node);
+			this._addonSecretTree = mergeSecretStatePaths(tree, this.secretStatePaths);
+		}
 		return this._addonSecretTree;
 	}
 	deviceSecretTree() {
@@ -8752,6 +8849,23 @@ function dropPerNodeFields(fields) {
 	}
 	return kept;
 }
+/** The keys of the value-holding fields, recursing into layout containers. */
+function collectValueFieldKeys(fields) {
+	const collected = [];
+	for (const field of fields) {
+		if (field.type === "group") {
+			collected.push(...collectValueFieldKeys(field.fields));
+			continue;
+		}
+		if (field.type === "sub-tabs") {
+			for (const tab of field.tabs) collected.push(...collectValueFieldKeys(tab.fields));
+			continue;
+		}
+		if (field.type === "separator" || field.type === "info") continue;
+		if ("key" in field && typeof field.key === "string") collected.push(field.key);
+	}
+	return collected;
+}
 function collectFieldKeys(fields) {
 	const collected = [];
 	for (const field of fields) {
@@ -8853,6 +8967,10 @@ var RECORD_SECRET_COLLECTION_PREFIX = "records:";
 * (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
 * (`auth.accessToken`, `headers[].value`).
 *
+* `{}` after a key means "each value of this map" (`applianceSecrets{}`): the map's own key
+* names the value (`applianceSecrets{fridge}`), so no id key is declared and a body that drops a
+* key releases exactly that key's secret.
+*
 * Array elements are matched by a DECLARED id key (`secretArrayKeys`:
 * `{ headers: 'name' }`), never by index, so reordering a list keeps every
 * keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
@@ -8865,11 +8983,13 @@ function parseSecretPath(path) {
 	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
 	return path.split(".").map((raw) => {
 		const each = raw.endsWith("[]");
-		const key = each ? raw.slice(0, -2) : raw;
+		const map = raw.endsWith("{}");
+		const key = each || map ? raw.slice(0, -2) : raw;
 		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
 		return {
 			key,
-			each
+			each,
+			map
 		};
 	});
 }
@@ -8921,6 +9041,22 @@ function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arra
 			[segment.key]: mapped
 		};
 	}
+	if (segment.map) {
+		if (!isRecord$4(child)) return node;
+		const kept = Object.entries(child).map(([mapKey, value]) => {
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}{${encodeURIComponent(mapKey)}}`;
+			if (!last) return [mapKey, mapAt(value, segments, index + 1, keys, concrete, declared, arrayKeys, visit)];
+			return [mapKey, visit({
+				declared,
+				concrete,
+				value
+			})];
+		}).filter(([, value]) => value !== REMOVE_LEAF);
+		return {
+			...node,
+			[segment.key]: Object.fromEntries(kept)
+		};
+	}
 	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
 	if (last) {
 		const replacement = visit({
@@ -9062,7 +9198,8 @@ function isZodSecret(schema) {
 }
 /**
 * Every declared secret path in a config schema: dotted keys, `[]` for "each
-* element of this array" (`connection.password`, `rows[].token`). A declared
+* element of this array" (`connection.password`, `rows[].token`), `{}` for "each value of this
+* map" (`applianceSecrets{}`). A declared
 * object or array is reported as one path and not descended into — everything
 * under it is secret.
 */
@@ -9073,6 +9210,7 @@ function collectZodSecretPaths(schema, prefix = "") {
 		const def = defOf(layer);
 		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
 		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "record" && def.valueType) paths.push(...collectZodSecretPaths(def.valueType, `${prefix}{}`));
 		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
 		else if (def.type === "intersection") {
 			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
@@ -9212,7 +9350,7 @@ function defineRecordKinds(specs) {
 			retention: spec.retention,
 			deviceRemoval: spec.deviceRemoval,
 			maxDataBytes: spec.maxDataBytes,
-			secretPaths: [...secretPaths],
+			secretPaths: [...new Set([...secretPaths, ...spec.retiredSecretPaths ?? []])],
 			secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
 			transactFamily: spec.transactFamily,
 			entry: spec.entry === void 0 ? void 0 : {
@@ -9254,9 +9392,11 @@ function defineEntryKind(name, spec) {
 		class: "config",
 		writeTrigger: spec.writeTrigger ?? "an operator adds or edits an entry in the entries UI",
 		retention: { none: "an entry goes only when the operator deletes it" },
+		...spec.maxDataBytes === void 0 ? {} : { maxDataBytes: spec.maxDataBytes },
 		...spec.database === void 0 ? {} : { database: spec.database },
 		...spec.indexes === void 0 ? {} : { indexes: spec.indexes },
 		...spec.secretArrayKeys === void 0 ? {} : { secretArrayKeys: spec.secretArrayKeys },
+		...spec.retiredSecretPaths === void 0 ? {} : { retiredSecretPaths: spec.retiredSecretPaths },
 		entry: {
 			title: spec.title,
 			...spec.nameField === void 0 ? {} : { nameField: spec.nameField }
@@ -11918,7 +12058,7 @@ object({
 	params: record(string(), union([string(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/composition-BodkvOV0.mjs
+//#region ../types/dist/composition-pOHbTzRB.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -12681,38 +12821,6 @@ function validateExpressionSource(src) {
 	return null;
 }
 /**
-* One power reading becomes a washer, dryer or dishwasher (D944 helper).
-*
-* Standby of the control board is under 5 W; a motor or a heater is far
-* above that, so 5 W is the line. A door lock or a short pump spike is not
-* a cycle, so running starts only after 30 s above the line.
-*
-* A wash, dry or dishwasher pause (soak, heat-wait, heater off between
-* bursts) lasts several minutes. Ending the cycle on the first dip would
-* report "finished" in the middle of the program, so the stop dwell is
-* 10 minutes on every type. The number is stored per type so one machine
-* can move later without moving the others.
-*/
-var APPLIANCE_TEMPLATE_ID = "appliance";
-var APPLIANCE_KINDS = [
-	"washer",
-	"dryer",
-	"dishwasher"
-];
-DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher;
-/**
-* A dumb plug-in stove or heater, built from a smart plug (a `Heater`).
-*
-* The plug is the actuator: `switch.setState` is a FORWARD to the plug's own
-* (D967), so the heater switches exactly as the plug does. Running is the
-* plug being on; when a power reading is also named, running is the draw
-* staying above the line instead (a plug left on with the stove's own
-* thermostat open is not heating). 50 W is far above any standby and below
-* the smallest radiator.
-*/
-var HEATER_TEMPLATE_ID = "heater";
-DeviceType.Heater;
-/**
 * Statistics and integrals over a history read (D944).
 *
 * Pure: the same points always give the same answer, so a restart recomputes
@@ -12856,34 +12964,6 @@ var HelperSpecSchema = discriminatedUnion("kind", [
 		/** Actuator groups only. Readings leave this unset. */
 		active: ActiveCriterionSchema.optional()
 	}),
-	object({
-		kind: literal("appliance"),
-		templateId: literal(APPLIANCE_TEMPLATE_ID),
-		appliance: _enum(APPLIANCE_KINDS),
-		thresholdWatts: number().positive(),
-		startDwellMs: number().int().nonnegative(),
-		stopDwellMs: number().int().nonnegative(),
-		member: HelperMemberSchema,
-		/**
-		* The plug that powers the appliance (`switch.on`). Optional: when set, the
-		* composition carries a `power-source` feature, so the hub can cut and restore
-		* that plug (power-source link of a NEW-target composition).
-		*/
-		powerSwitch: HelperMemberSchema.optional(),
-		/** How long a forced restart keeps the plug off; the cap's default when unset. */
-		offSeconds: number().optional()
-	}),
-	object({
-		kind: literal("heater"),
-		templateId: literal(HEATER_TEMPLATE_ID),
-		/** The plug, read and commanded at `switch.on`. */
-		plug: HelperMemberSchema,
-		/** The plug's power reading, when it has one: running is then the draw, not the switch. */
-		meter: HelperMemberSchema.optional(),
-		thresholdWatts: number().positive(),
-		startDwellMs: number().int().nonnegative(),
-		stopDwellMs: number().int().nonnegative()
-	}),
 	object({
 		kind: literal("statistic"),
 		stat: _enum(STATISTIC_STATS),
@@ -13107,7 +13187,7 @@ var CompositionSchema = object({
 		kind: literal("existing"),
 		device: CompositionSourceRefSchema
 	})]),
-	features: array(CompositionFeatureSchema).min(1).max(16),
+	features: array(CompositionFeatureSchema).min(0).max(16),
 	/**
 	* Present when the block is a helper template. Absent on a free
 	* composition (the room example, device 4603). The editor reads this,
@@ -13325,11 +13405,49 @@ var IntegrationInstanceRefSchema = object({
 	]),
 	candidateStableId: string().optional()
 });
+/**
+* `RecordIntegrationInstances` - the `integration-instances` provider over ONE
+* entry kind, so an addon that holds a connection serves it in ~30 lines.
+*
+* Every instance is one record of the addon's own kind, keyed by the
+* `integrations` registry id. The records door does the secret work: a field the
+* kind marks `.meta({ secret: true })` is a keychain marker bound to the row, so
+* deleting the row deletes the secret, and one row's value is never another's.
+*
+* Patch rules for a secret (`updateInstance`): omitted, `''`, the redaction
+* token or the view the form was given KEEP the stored secret;
+* `{ $secretClear: true }` clears it; any other string replaces it.
+*/
 /** The most instances one addon lists (an integrations page, not a table). */
 var INSTANCES_LIST_MAX = 1e3;
 /** The keys of the kind's secret fields that sit at the top level of the body. */
 function topLevelSecretKeys(paths) {
-	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[")));
+	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[") && !p.includes("{")));
+}
+/** The keys of the kind's top-level MAPS whose values are secrets (`applianceSecrets{}`). */
+function secretMapKeys(paths) {
+	return new Set(paths.filter((p) => p.endsWith("{}") && !p.slice(0, -2).match(/[.[{]/)).map((p) => p.slice(0, -2)));
+}
+/**
+* A patch value for a map of secrets: an entry that is omitted, `''`, the redaction token or the
+* view the form was given KEEPS its stored secret (it is left out of the merge); `{ $secretClear }`
+* or `null` removes the entry; any other string replaces it. Null when nothing is left to merge.
+*/
+function secretMapPatch(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) if (entry === null || isSecretClear(entry)) out[key] = null;
+	else if (typeof entry === "string" && entry !== "" && entry !== "__camstack_redacted__" && !isSecretFieldView(entry)) out[key] = entry;
+	return Object.keys(out).length > 0 ? out : null;
+}
+/** Does the kind's body schema carry an `enabled` field? */
+function declaresEnabled(kind) {
+	const json = toJSONSchema(kind.schema, {
+		unrepresentable: "any",
+		io: "input"
+	});
+	const properties = Reflect.get(json, "properties");
+	return typeof properties === "object" && properties !== null && "enabled" in properties;
 }
 var RecordIntegrationInstances = class {
 	records;
@@ -13337,14 +13455,20 @@ var RecordIntegrationInstances = class {
 	hooks;
 	handle;
 	secretKeys;
+	secretMaps;
 	nameField;
+	/** The `integrations` registry owns the on/off switch (`role: devices`); the body has none. */
+	registryOwnsEnabled;
 	constructor(records, kind, hooks) {
 		this.records = records;
 		this.kind = kind;
 		this.hooks = hooks;
 		this.handle = records.kind(kind);
 		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
+		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
 		this.nameField = kind.declaration.entry?.nameField ?? "name";
+		this.registryOwnsEnabled = hooks.description.role === "devices";
+		if (this.registryOwnsEnabled && declaresEnabled(kind)) throw new Error(`kind "${kind.name}": the integrations registry owns the on/off switch of a role "devices" addon, so the body must not declare "enabled"`);
 	}
 	/**
 	* One instance read for the addon's own runtime; null when absent. When the keychain is
@@ -13389,15 +13513,23 @@ var RecordIntegrationInstances = class {
 	viewOf(record) {
 		const shown = secretViewsOf(this.records.owner, this.kind.name, record.id, this.kind.declaration, record.data);
 		const rawName = record.data[this.nameField];
+		const kind = this.hooks.kindOf?.(record.data);
+		const health = this.hooks.health?.(record.data, record.id);
 		return {
 			id: record.id,
 			name: typeof rawName === "string" ? rawName : record.id,
 			configured: this.hooks.configured(record.data),
-			enabled: record.data.enabled !== false,
-			formValues: shown
+			...this.registryOwnsEnabled ? {} : { enabled: record.data.enabled !== false },
+			formValues: shown,
+			...kind !== void 0 ? { kind } : {},
+			...health?.status !== void 0 ? { status: health.status } : {},
+			...health?.lastCheckedAt !== void 0 ? { lastCheckedAt: health.lastCheckedAt } : {}
 		};
 	}
-	describe = async () => this.hooks.description;
+	describe = async () => this.hooks.mintId === void 0 ? this.hooks.description : {
+		...this.hooks.description,
+		mintsId: true
+	};
 	instanceFormSchema = async ({ id }) => this.hooks.formSchema(id);
 	listInstances = async () => {
 		return (await this.handle.query({ limit: INSTANCES_LIST_MAX })).records.map((record) => this.viewOf(record));
@@ -13407,37 +13539,46 @@ var RecordIntegrationInstances = class {
 		return record === null ? null : this.viewOf(record);
 	};
 	/** Insert ONE row (`ifRev: 0`: an existing id is refused, never overwritten). */
-	createInstance = async ({ id, name }) => {
+	createInstance = async ({ id, name, kind }) => {
+		const minted = id ?? this.hooks.mintId?.({
+			name,
+			...kind !== void 0 ? { kind } : {}
+		});
+		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
 		await this.handle.put({
-			id,
-			data: this.hooks.initialBody(name)
+			id: minted,
+			data: this.hooks.initialBody(name, kind)
 		}, { ifRev: 0 });
-		await this.hooks.onChanged?.(id);
-		return { id };
+		await this.hooks.onChanged?.(minted, "created");
+		return { id: minted };
 	};
 	updateInstance = async ({ id, name, values }) => {
 		const patch = {};
 		for (const [key, value] of Object.entries(values)) {
 			if (value === void 0) continue;
-			if (!this.secretKeys.has(key)) patch[key] = value;
+			if (this.secretMaps.has(key)) {
+				const entries = secretMapPatch(value);
+				if (entries !== null) patch[key] = entries;
+			} else if (!this.secretKeys.has(key)) patch[key] = value;
 			else if (isSecretClear(value)) patch[key] = null;
 			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
 		}
 		if (name !== void 0) patch[this.nameField] = name;
 		await this.handle.patch(id, patch);
-		await this.hooks.onChanged?.(id);
+		await this.hooks.onChanged?.(id, "updated");
 		return { ok: true };
 	};
 	/** The switch lives in the record body; the addon is told so it applies it (D996). */
 	setInstanceEnabled = async ({ id, enabled }) => {
+		if (this.registryOwnsEnabled) throw new Error(`instance "${id}": the integrations registry owns the on/off switch of this addon; set it with integrations.update`);
 		await this.handle.patch(id, { enabled });
-		await this.hooks.onChanged?.(id);
+		await this.hooks.onChanged?.(id, "enabled");
 		return { ok: true };
 	};
 	/** The row and its keychain refs go together (the records door). */
 	deleteInstance = async ({ id }) => {
 		await this.handle.delete(id);
-		await this.hooks.onChanged?.(id);
+		await this.hooks.onChanged?.(id, "deleted");
 		return { ok: true };
 	};
 	testInstance = async (input) => {
@@ -14508,7 +14649,13 @@ var MigrationLedgerEntrySchema = object({
 	* joined by the engine from the catalogues it knows this boot. Absent when no
 	* catalogue lists the id (a newer database).
 	*/
-	meta: MigrationMetaSchema.optional()
+	meta: MigrationMetaSchema.optional(),
+	/**
+	* Set when this is an applied row of an addon owner whose catalogue the answering
+	* process has not loaded (the owner has not declared yet): the row is applied, the
+	* process just cannot judge it. Never `skipped-newer` — that needs the owner loaded.
+	*/
+	ownerNotLoaded: boolean().optional()
 });
 /** A catalogued migration that is not applied, with where it stands. */
 var MigrationPendingEntrySchema = object({
@@ -48887,49 +49034,6 @@ function actuator(input) {
 	};
 }
 new Map(GROUP_TEMPLATES.map((template) => [template.id, template]));
-var PowerSourceRefusalReasonSchema = _enum([
-	"no-power-source",
-	"switch-missing",
-	"switch-offline",
-	"switch-unknown",
-	"restart-in-progress",
-	"switch-call-failed"
-]);
-var PowerSourceActionResultSchema = discriminatedUnion("accepted", [object({ accepted: literal(true) }), object({
-	accepted: literal(false),
-	reason: PowerSourceRefusalReasonSchema,
-	/** One line for the operator, naming the switch. */
-	message: string()
-})]);
-var PowerSourceInfoSchema = object({
-	/** False when the device has no power source linked; the rest is then empty. */
-	linked: boolean(),
-	switchDeviceId: number().nullable(),
-	switchName: string().nullable(),
-	/** The switch's on/off state, or null when it is unknown. Never false for unknown (D393). */
-	switchOn: boolean().nullable(),
-	switchOnline: boolean().nullable(),
-	restartInProgress: boolean(),
-	offSeconds: number().int()
-});
-object({
-	/** Null while the switch has not reported: unknown is never `false` (D393). */
-	switchOn: boolean().nullable(),
-	offSeconds: number().int(),
-	lastFetchedAt: number()
-});
-DeviceType.Gateway, DeviceType.Hub, DeviceType.Camera, DeviceType.Sensor, DeviceType.MediaPlayer, DeviceType.Vacuum, DeviceType.Generic, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.PetFountain, DeviceType.Fan, DeviceType.Humidifier, DeviceType.Climate, DeviceType.WaterHeater;
-var deviceInput$2 = object({ deviceId: number().int().nonnegative() });
-systemMethod(deviceInput$2, PowerSourceInfoSchema, { auth: "admin" }), systemMethod(deviceInput$2, PowerSourceActionResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), systemMethod(deviceInput$2, PowerSourceActionResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), systemMethod(deviceInput$2, PowerSourceActionResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
 DeviceFeature.LightColorRgb, DeviceFeature.LightColorHsv, DeviceFeature.LightColorMired;
 DeviceType.Camera;
 `${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
@@ -48957,6 +49061,168 @@ var ComposableCapabilitiesSchema = object({ caps: array(object({
 	}).optional()
 })) });
 /**
+* A saved Customize assignment (D936). The schema is the type: callers use
+* `z.infer`, they do not restate the shape.
+*/
+var OverrideSourceSchema = object({
+	addonId: string().min(1),
+	stableId: string().min(1),
+	cap: string().min(1),
+	fieldPath: string().min(1)
+});
+var IdentityTransformDraftSchema = object({ kind: literal("identity") });
+var InvertTransformDraftSchema = object({ kind: literal("invert") });
+var ThresholdTransformDraftSchema = object({
+	kind: literal("threshold"),
+	comparison: _enum(["gte", "lte"]),
+	threshold: number(),
+	startDwellMs: number().nonnegative(),
+	stopDwellMs: number().nonnegative()
+});
+var CustomizeTransformDraftSchema = discriminatedUnion("kind", [
+	IdentityTransformDraftSchema,
+	InvertTransformDraftSchema,
+	ThresholdTransformDraftSchema,
+	object({
+		kind: literal("linear"),
+		scale: number(),
+		offset: number(),
+		clampMin: number().optional(),
+		clampMax: number().optional()
+	}),
+	object({
+		kind: literal("enum-map"),
+		mapping: record(string(), string().nullable())
+	}),
+	object({ kind: literal("number") })
+]);
+var ScalarOverrideDraftSchema = object({
+	kind: literal("scalar"),
+	cap: string().min(1),
+	targetId: string().min(1),
+	source: OverrideSourceSchema,
+	transform: CustomizeTransformDraftSchema
+});
+var KeyedArrayOverrideDraftSchema = object({
+	kind: literal("keyedArray"),
+	cap: string().min(1),
+	targetId: string().min(1),
+	key: string().min(1),
+	label: string().min(1),
+	fieldPath: string().min(1),
+	source: OverrideSourceSchema,
+	transform: CustomizeTransformDraftSchema
+});
+var PulseOverrideDraftSchema = object({
+	kind: literal("pulse"),
+	cap: string().min(1),
+	targetId: string().min(1),
+	enabled: boolean(),
+	debounceMs: number().nonnegative(),
+	edges: array(_enum([
+		"rising",
+		"button",
+		"native-event"
+	])).min(1).optional(),
+	sources: array(OverrideSourceSchema).min(1)
+});
+var SpanSourceDraftSchema = OverrideSourceSchema.extend({ mode: _enum([
+	"in-addition",
+	"confirm",
+	"replace"
+]).optional() });
+discriminatedUnion("kind", [
+	ScalarOverrideDraftSchema,
+	KeyedArrayOverrideDraftSchema,
+	PulseOverrideDraftSchema,
+	object({
+		kind: literal("span"),
+		cap: string().min(1),
+		targetId: string().min(1),
+		timeoutMs: number().nonnegative(),
+		cooldownMs: number().nonnegative().optional(),
+		sources: array(SpanSourceDraftSchema)
+	})
+]);
+object({
+	targetId: string().min(1),
+	configured: boolean(),
+	source: _enum(["native", "assigned"]),
+	state: _enum([
+		"active",
+		"stale",
+		"released",
+		"unavailable"
+	]),
+	reason: string().nullable()
+});
+/**
+* What a running-threshold proposal says (planning#405). The schema is the
+* type: the algorithm, the capability method and the UI all read `z.infer`.
+*
+* A proposal is read-only advice: it carries the numbers it was derived from
+* (`evidence`) so the operator can judge it, and an `insufficient` answer names
+* WHY with a typed reason and the catalog defaults, never an invented number.
+*/
+var RunningProposalTierSchema = _enum(["raw", "5m"]);
+var RunningProposalConfidenceSchema = _enum([
+	"high",
+	"medium",
+	"low"
+]);
+var RunningProposalInsufficientReasonSchema = _enum([
+	"no-history",
+	"span-too-short",
+	"truncated",
+	"no-idle-floor",
+	"no-runs",
+	"no-separation"
+]);
+var RunningProposalReplaySchema = object({
+	/** Intervals the real dwell expression held true over the window. */
+	intervals: number().int().nonnegative(),
+	/** Intervals outside every run, or a second interval inside one. */
+	extra: number().int().nonnegative(),
+	/** Runs without an interval of their own (none, or merged into a neighbour). */
+	missed: number().int().nonnegative()
+});
+var RunningProposalEvidenceSchema = object({
+	tier: RunningProposalTierSchema,
+	spanMs: number().nonnegative(),
+	from: number(),
+	to: number(),
+	points: number().int().nonnegative(),
+	runsFound: number().int().nonnegative(),
+	pausesFound: number().int().nonnegative(),
+	longestPauseMs: number().nonnegative(),
+	/** Episodes shorter than ~90 s (an anti-crease pulse, a display waking): never a run, never a pause. */
+	pulsesFound: number().int().nonnegative(),
+	longestPulseMs: number().nonnegative(),
+	idleFloorW: number(),
+	noiseCeilingW: number(),
+	plateauW: number(),
+	replay: RunningProposalReplaySchema
+});
+var RunningProposalInsufficientEvidenceSchema = object({
+	spanMs: number().nonnegative(),
+	points: number().int().nonnegative(),
+	runsFound: number().int().nonnegative()
+});
+var RunningThresholdProposalSchema = discriminatedUnion("state", [object({
+	state: literal("proposal"),
+	transform: ThresholdTransformDraftSchema,
+	evidence: RunningProposalEvidenceSchema,
+	confidence: RunningProposalConfidenceSchema,
+	/** Why the confidence is not higher; empty when nothing held it back. */
+	notes: array(string())
+}), object({
+	state: literal("insufficient"),
+	reason: RunningProposalInsufficientReasonSchema,
+	evidence: RunningProposalInsufficientEvidenceSchema,
+	/** The catalog defaults, offered as what stands when nothing better is known. */
+	fallback: ThresholdTransformDraftSchema
+})]);
+/**
 * The report of a one-shot "move this owner's plaintext secrets into the
 * keychain" run (D878). COUNTS only - never a value, never a ref.
 *
@@ -49246,6 +49512,14 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 	kind: "mutation",
 	auth: "admin",
 	access: "view"
+}), method(object({
+	deviceId: number().int(),
+	cap: string().min(1),
+	fieldPath: string().min(1),
+	deviceType: _enum(DeviceType).optional()
+}), RunningThresholdProposalSchema, {
+	auth: "admin",
+	access: "view"
 }), method(object({
 	blockId: string().min(1),
 	trace: AutomationRunTraceSchema.optional(),
@@ -50054,7 +50328,27 @@ method(object({
 * exposes only the COMMON surface: link state, supported device
 * kinds (so the UI can filter the device picker), and per-device
 * expose/unexpose.
-*/
+*
+* INSTANCES. One export addon can serve several independent targets (a
+* HomeKit bridge, a Home Assistant broker). `listInstances` names them.
+* `instanceId` on a READ is optional: absent = the whole addon (linked if any
+* enabled instance is, `exposedDeviceCount` = distinct devices, `setup` = the
+* default instance's); present = that instance; an id the provider does not
+* serve is refused with `ExportInstanceUnknownError` (`export-instance-unknown`),
+* never answered empty. `instanceId` on a WRITE is REQUIRED: a membership
+* change always names the target it changes. A single-instance provider
+* accepts an absent id on a read or its own id, and refuses any other.
+*/
+/** Which instance of an export addon a call addresses. Absent on a read = the whole addon. */
+var InstanceIdSchema$1 = string().min(1);
+var InstancePinSchema = object({ instanceId: InstanceIdSchema$1.optional() });
+/** One independent export target of an addon. */
+var ExportInstanceSchema = object({
+	instanceId: InstanceIdSchema$1,
+	name: string(),
+	enabled: boolean(),
+	kind: string().optional()
+});
 var LinkStateSchema = _enum([
 	"unlinked",
 	"linked",
@@ -50105,10 +50399,14 @@ var ExposedDeviceSchema = object({
 	capabilities: array(string()).optional()
 });
 var ExposeInputSchema = object({
+	instanceId: InstanceIdSchema$1,
 	deviceId: string(),
 	capabilities: array(string()).optional()
 });
-var UnexposeInputSchema = object({ deviceId: string() });
+var UnexposeInputSchema = object({
+	instanceId: InstanceIdSchema$1,
+	deviceId: string()
+});
 /**
 * What an exporter may expose besides devices (D968). An action and a
 * notification target are LIST ENTRIES, never devices (D954): they enter an
@@ -50137,15 +50435,21 @@ var ExposedEntitySchema = object({
 	entity: ExportEntityRefSchema,
 	exposedAs: string().optional()
 });
-var ExposeEntityInputSchema = object({ entity: ExportEntityRefSchema });
-var UnexposeEntityInputSchema = object({ entity: ExportEntityRefSchema });
-method(_void(), DeviceExportStatusSchema), method(_void(), array(DeviceKindSchema)), method(_void(), array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), {
+var ExposeEntityInputSchema = object({
+	instanceId: InstanceIdSchema$1,
+	entity: ExportEntityRefSchema
+});
+var UnexposeEntityInputSchema = object({
+	instanceId: InstanceIdSchema$1,
+	entity: ExportEntityRefSchema
+});
+method(InstancePinSchema, DeviceExportStatusSchema), method(_void(), array(ExportInstanceSchema)), method(InstancePinSchema, array(DeviceKindSchema)), method(InstancePinSchema, array(ExposedDeviceSchema)), method(ExposeInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(UnexposeInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), optionalMethod(_void(), array(ExportEntityKindSchema)), optionalMethod(_void(), array(ExposedEntitySchema)), optionalMethod(ExposeEntityInputSchema, _void(), {
+}), optionalMethod(_void(), array(ExportEntityKindSchema)), optionalMethod(InstancePinSchema, array(ExposedEntitySchema)), optionalMethod(ExposeEntityInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), optionalMethod(UnexposeEntityInputSchema, _void(), {
@@ -53346,15 +53650,15 @@ var FanPresetCaptureResultSchema = object({
 	items: array(FanCaptureItemSchema),
 	omitted: array(FanCaptureOmissionSchema)
 });
-var deviceInput$1 = object({ deviceId: number().int().nonnegative() });
+var deviceInput$2 = object({ deviceId: number().int().nonnegative() });
 DeviceType.Fan;
-method(deviceInput$1, array(FanPresetSchema), { auth: "protected" }), method(deviceInput$1.extend({ presets: array(FanPresetSchema).max(12) }), FanPresetsSetResultSchema, {
+method(deviceInput$2, array(FanPresetSchema), { auth: "protected" }), method(deviceInput$2.extend({ presets: array(FanPresetSchema).max(12) }), FanPresetsSetResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(deviceInput$1.extend({ presetId: string().min(1) }), FanPresetApplyResultSchema, {
+}), method(deviceInput$2.extend({ presetId: string().min(1) }), FanPresetApplyResultSchema, {
 	kind: "mutation",
 	auth: "protected"
-}), method(deviceInput$1.extend({
+}), method(deviceInput$2.extend({
 	fields: array(FanCaptureFieldSchema).optional(),
 	steps: array(ActionStepSchema).max(20).default([])
 }), FanPresetCaptureResultSchema, { auth: "protected" });
@@ -53815,11 +54119,7 @@ var CreateIntegrationInputSchema = object({
 	info: record(string(), unknown()).optional(),
 	/** `stableId` of the discovery candidate the form was seeded from (D984). */
 	originStableId: string().optional(),
-	settings: record(string(), unknown()).optional(),
-	/** Keys of `settings` the form's schema declares secret (by type) — kept in
-	*  the keychain, not the table (D787). */
-	secretKeys: array(string()).optional(),
-	skipRestart: boolean().optional()
+	settings: record(string(), unknown()).optional()
 });
 var UpdateIntegrationInputSchema = object({
 	id: string(),
@@ -53840,16 +54140,6 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 }), method(object({ id: string() }), DeleteIntegrationResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ id: string() }), record(string(), unknown()), { auth: "admin" }), method(object({
-	id: string(),
-	settings: record(string(), unknown()),
-	/** Keys the form's schema declares secret (by type) — keychain-stored (D787). */
-	secretKeys: array(string()).optional(),
-	/** The integration's own addon applies the change in-process and asks the hub not to respawn it. */
-	skipRestart: boolean().optional()
-}), object({ success: boolean() }), {
-	kind: "mutation",
-	auth: "admin"
 }), method(_void(), array(AvailableIntegrationTypeSchema), { auth: "admin" }), method(object({
 	addonId: string(),
 	settings: record(string(), unknown())
@@ -53878,13 +54168,65 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 */
 var ConfigSchemaPassthrough$3 = custom();
 var IntegrationInstanceIdSchema = string().min(1);
+var IntegrationInstanceModeSchema = _enum(["single", "multiple"]);
+/**
+* One kind of instance a provider can create (an adapter, an account type). The sign-in and
+* connect fields follow the `broker` contract (`broker.cap.ts`): `signIn.basePath` is a
+* hub-relative route set speaking the sign-in contract, `connectPath` / `disconnectPath` open an
+* interactive account link (popup) and may carry `{{brokerId}}`, which the UI replaces with the
+* instance id.
+*/
+var IntegrationInstanceKindSchema = object({
+	/** Stable id of the kind, sent back as `createInstance.kind`. */
+	id: string().min(1),
+	label: string().min(1),
+	/** The kind signs in through a server-held interactive session. */
+	signIn: object({
+		basePath: string().min(1),
+		methods: array(_enum(["device-code", "proxy"])).optional()
+	}).optional(),
+	/** Relative hub path to start an interactive account link of an instance of this kind. */
+	connectPath: string().min(1).optional(),
+	/** Relative hub path to disconnect that account. */
+	disconnectPath: string().min(1).optional()
+});
 var IntegrationInstanceDescriptionSchema = object({
+	/** What the instances are for the Integrations page; see {@link IntegrationInstanceRoleSchema}. */
+	role: _enum([
+		"devices",
+		"services",
+		"both"
+	]),
+	/** How the devices of an instance are found; absent means `{ mode: 'none' }`. */
+	discovery: object({
+		mode: _enum([
+			"none",
+			"lan",
+			"account"
+		]),
+		scopedToInstance: boolean()
+	}).optional(),
 	/** `single`: at most one instance can exist (Loki). `multiple`: an account each. */
-	instanceMode: _enum(["single", "multiple"]),
+	instanceMode: IntegrationInstanceModeSchema,
 	/** What the instance is, for the UI (`destination`, `relay`, `account`). */
 	kind: string(),
 	/** True when `testInstance` really probes the remote. */
-	canTest: boolean()
+	canTest: boolean(),
+	/**
+	* The kinds an instance can be of. Absent or one entry: nothing to choose; more than one: the
+	* Add flow asks which first and sends it as `createInstance.kind`.
+	*/
+	kinds: array(IntegrationInstanceKindSchema).optional(),
+	/**
+	* The provider accepts `createInstance.id` for an id that once existed (an adopted id, because
+	* devices carry it). The UI then offers "restore under its old id" on Add. Absent means no.
+	*/
+	allowRestoreId: boolean().optional(),
+	/**
+	* `createInstance` without an `id` works: the provider mints it. Absent means the caller must
+	* send an id (the UI then mints an opaque one).
+	*/
+	mintsId: boolean().optional()
 });
 var IntegrationInstanceStatusSchema = object({
 	state: _enum([
@@ -53893,7 +54235,9 @@ var IntegrationInstanceStatusSchema = object({
 		"error",
 		"unknown"
 	]),
-	detail: string().optional()
+	detail: string().optional(),
+	/** A short human word for the state ("Signed in", "Token expired"); shown instead of `state`. */
+	label: string().optional()
 });
 var IntegrationInstanceSchema = object({
 	id: IntegrationInstanceIdSchema,
@@ -53901,13 +54245,18 @@ var IntegrationInstanceSchema = object({
 	/** The addon's own rule (an URL is present, a client id is present...). */
 	configured: boolean(),
 	/**
-	* The instance's own on/off switch (D996): always present, derived from the record body
-	* (`enabled !== false`, so a row written before the field existed is on).
+	* The instance's own on/off switch (D996), derived from the record body (`enabled !== false`,
+	* so a row written before the field existed is on). Absent when the `integrations` registry
+	* owns the switch (`describe().role` is `devices`): read it from the registry row.
 	*/
-	enabled: boolean(),
+	enabled: boolean().optional(),
+	/** The kind of this instance (one of `describe().kinds[].id`), when the provider has kinds. */
+	kind: string().optional(),
 	/** Values for the instance form; a secret is a `SecretFieldView`, never text. */
 	formValues: record(string(), unknown()),
-	status: IntegrationInstanceStatusSchema.optional()
+	status: IntegrationInstanceStatusSchema.optional(),
+	/** Epoch ms of the last probe of the remote that produced `status`; absent when never checked. */
+	lastCheckedAt: number().optional()
 });
 var IntegrationInstancePatchSchema = object({
 	id: IntegrationInstanceIdSchema,
@@ -53925,10 +54274,14 @@ var integrationInstancesCapability = {
 		instanceFormSchema: method(object({ id: IntegrationInstanceIdSchema.nullable() }), ConfigSchemaPassthrough$3, { auth: "admin" }),
 		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
 		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
-		/** Insert the typed record under the given id (a duplicate id is refused). */
+		/**
+		* Insert the typed record. With `id` it is stored under that id (a duplicate id is refused);
+		* without one the PROVIDER mints it and answers it. `kind` picks one of `describe().kinds`.
+		*/
 		createInstance: method(object({
-			id: IntegrationInstanceIdSchema,
-			name: string().min(1)
+			id: IntegrationInstanceIdSchema.optional(),
+			name: string().min(1),
+			kind: string().min(1).optional()
 		}), object({ id: string() }), {
 			kind: "mutation",
 			auth: "admin"
@@ -55760,6 +56113,11 @@ var LogEntrySchema = object({
 * flight, and not asking for the next slice ends the scan.
 */
 var LogReadQuerySchema = object({
+	/**
+	* Which destination INSTANCE answers (a destination addon may hold several records). Absent ⇒
+	* the provider's first readable one, so a caller written before instances existed is unchanged.
+	*/
+	instanceId: string().min(1).max(200).optional(),
 	/** Correlates `cancelRead`. Caller-chosen, unique per in-flight read. */
 	requestId: string().min(1).max(64).optional(),
 	/** The device the line is about (`tags.deviceId`, numeric). */
@@ -55822,6 +56180,8 @@ var LogReadResultSchema = object({
 	/** True when `cancelRead` ended this slice early. */
 	cancelled: boolean().optional()
 });
+/** Names one destination instance; absent ⇒ the provider's first readable one. */
+var LogInstanceSelectorSchema = object({ instanceId: string().min(1).max(200).optional() });
 var LogReadCapabilitiesSchema = object({
 	/** False ⇒ this destination only ships lines (console, forwarder, an unconfigured Loki). */
 	readable: boolean(),
@@ -55840,7 +56200,7 @@ var LogReadCapabilitiesSchema = object({
 	/** How far back the store reaches, when the provider knows (days). */
 	retentionDays: number().nullable()
 });
-method(LogEntrySchema, _void(), { kind: "mutation" }), optionalMethod(_void(), LogReadCapabilitiesSchema, { auth: "admin" }), optionalMethod(LogReadQuerySchema, LogReadResultSchema, { auth: "admin" }), optionalMethod(object({ requestId: string().min(1).max(64) }), object({ cancelled: boolean() }), {
+method(LogEntrySchema, _void(), { kind: "mutation" }), optionalMethod(LogInstanceSelectorSchema, LogReadCapabilitiesSchema, { auth: "admin" }), optionalMethod(LogReadQuerySchema, LogReadResultSchema, { auth: "admin" }), optionalMethod(object({ requestId: string().min(1).max(64) }), object({ cancelled: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -56504,6 +56864,27 @@ method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { aut
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ integrationId: string().min(1) }), record(string(), unknown()), { auth: "admin" }), method(object({ integrationId: string().min(1) }), object({
+	rows: number().int().nonnegative(),
+	secrets: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	integrationId: string().min(1),
+	patch: record(string(), unknown())
+}), object({ written: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	integrationId: string().min(1),
+	keys: array(string().min(1))
+}), object({
+	present: boolean(),
+	removed: record(string(), unknown())
+}), {
+	kind: "mutation",
+	auth: "admin"
 });
 method(object({
 	sourceUrl: string(),
@@ -67431,6 +67812,49 @@ object({
 	DeviceType.PetFeeder,
 	DeviceType.Heater
 ].filter((type) => type !== DeviceType.Sensor);
+var PowerSourceRefusalReasonSchema = _enum([
+	"no-power-source",
+	"switch-missing",
+	"switch-offline",
+	"switch-unknown",
+	"restart-in-progress",
+	"switch-call-failed"
+]);
+var PowerSourceActionResultSchema = discriminatedUnion("accepted", [object({ accepted: literal(true) }), object({
+	accepted: literal(false),
+	reason: PowerSourceRefusalReasonSchema,
+	/** One line for the operator, naming the switch. */
+	message: string()
+})]);
+var PowerSourceInfoSchema = object({
+	/** False when the device has no power source linked; the rest is then empty. */
+	linked: boolean(),
+	switchDeviceId: number().nullable(),
+	switchName: string().nullable(),
+	/** The switch's on/off state, or null when it is unknown. Never false for unknown (D393). */
+	switchOn: boolean().nullable(),
+	switchOnline: boolean().nullable(),
+	restartInProgress: boolean(),
+	offSeconds: number().int()
+});
+object({
+	/** Null while the switch has not reported: unknown is never `false` (D393). */
+	switchOn: boolean().nullable(),
+	offSeconds: number().int(),
+	lastFetchedAt: number()
+});
+DeviceType.Gateway, DeviceType.Hub, DeviceType.Camera, DeviceType.Sensor, DeviceType.MediaPlayer, DeviceType.Vacuum, DeviceType.Generic, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.PetFountain, DeviceType.Fan, DeviceType.Humidifier, DeviceType.Climate, DeviceType.WaterHeater;
+var deviceInput$1 = object({ deviceId: number().int().nonnegative() });
+systemMethod(deviceInput$1, PowerSourceInfoSchema, { auth: "admin" }), systemMethod(deviceInput$1, PowerSourceActionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), systemMethod(deviceInput$1, PowerSourceActionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), systemMethod(deviceInput$1, PowerSourceActionResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * Presence cap. Models HA `person.*` and `device_tracker.*` entities
 * on `DeviceType.Presence`. Read-only — no setters: presence is
@@ -75484,6 +75908,25 @@ function buildDescriptor(capName, kind) {
 * contributes one entry per bound cap present in this map.
 */
 var EVENT_KIND_BY_CAP = Object.freeze(Object.fromEntries(Object.entries(CAP_TO_KIND).map(([capName, kind]) => [capName, buildDescriptor(capName, kind)])));
+/**
+* What a remote key is CALLED and what it LOOKS like, for every role (D963),
+* shared by the admin UI and the viewer. A role is data on the wire; each
+* client resolves its name from `label` (English and Italian side by side) and
+* its glyph from `icon`, a lucide id from the shared icon catalogue — the
+* server sends an id, a client maps it to its own icon set.
+*
+* `legend` is text printed on the key INSTEAD of a glyph (a digit has no
+* pictogram): a client that can draw text shows it, one that cannot falls back
+* to `icon`.
+*/
+function digit(n) {
+	return {
+		label: t(n, n),
+		icon: "hash",
+		legend: n
+	};
+}
+digit("0"), digit("1"), digit("2"), digit("3"), digit("4"), digit("5"), digit("6"), digit("7"), digit("8"), digit("9");
 DeviceFeature.MediaPlayerPower, DeviceFeature.MediaPlayerVolumeStep, DeviceFeature.MediaPlayerChannelStep, DeviceFeature.MediaPlayerMute, DeviceFeature.MediaPlayerStop, DeviceFeature.MediaPlayerNext, DeviceFeature.MediaPlayerPrevious;
 var btn = (idSuffix, row, col, init) => ({
 	idSuffix,
@@ -75611,6 +76054,42 @@ discriminatedUnion("kind", [object({
 	kind: literal("pronto"),
 	code: string()
 })]);
+/**
+* Propose a running threshold from a device's own power history (planning#405).
+*
+* Pure and deterministic: the same series gives the same answer. The series is
+* a HELD-VALUE step series — a point's value stands until the next point — which
+* is how device-history stores a gauge, so "time at a level" is exact, not a
+* count of samples.
+*
+*  1. idle floor F = time-weighted median; noise ceiling N = highest value seen
+*     near F. A device that is not near one level most of the time has no floor.
+*  2. coarse activity = above max(2N, N + 5 W); consecutive stretches are episodes.
+*  3. an episode shorter than `PULSE_MAX_MS` is a PULSE (an anti-crease tumble, a
+*     display waking): it is neither a run nor a pause. Among the remaining
+*     episodes, gaps over `PAUSE_MAX_MS` always separate runs; the rest split in
+*     two by the largest log-scale jump (>= 3x): the short ones are pauses INSIDE
+*     a run (a soak), the long ones separate runs. A stretch under `MIN_RUN_MS`
+*     is no run.
+*  4. T = geometric mean of N and the plateau's 10th percentile, snapped to a
+*     grid a person would type; stop dwell covers the longest pause and the
+*     kind's floor; start dwell covers the longest pulse and standby blip above T.
+*  5. the numbers are proved by REPLAY through the real `dwell` evaluation: each
+*     run must hold exactly one true interval and nothing may flap outside.
+*/
+var SECOND_MS = 1e3;
+var MINUTE_MS$1 = 60 * SECOND_MS;
+24 * (60 * MINUTE_MS$1);
+10 * MINUTE_MS$1;
+30 * SECOND_MS;
+60 * SECOND_MS;
+20 * MINUTE_MS$1;
+90 * SECOND_MS;
+30 * MINUTE_MS$1;
+10 * MINUTE_MS$1;
+DeviceType.Dryer, 3 * MINUTE_MS$1, DeviceType.Dishwasher, 3 * MINUTE_MS$1, DeviceType.Washer, 10 * MINUTE_MS$1;
+10 * SECOND_MS;
+10 * SECOND_MS;
 DeviceFeature.FanSpeed, DeviceFeature.FanPreset, DeviceFeature.FanDirection, DeviceFeature.FanOscillating, DeviceFeature.CoverStoppable, DeviceFeature.CoverPositionable, DeviceFeature.CoverTilt, DeviceFeature.ValvePositionable, DeviceFeature.MediaPlayerVolume, DeviceFeature.ClimateFanMode;
 SOURCE_CAPS.filter((cap) => cap !== "switch" && cap !== "motion");
 String.raw`rose\(active(\d+), changed(\d+), (\d+(?:\.\d+)?)\)`;
@@ -77152,6 +77631,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"coreBlocks.proposeRunningThreshold": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"coreBlocks.reportAutomationRun": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -77663,6 +78149,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"deviceExport.listInstances": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"deviceExport.listSupportedDeviceKinds": {
 		capName: "device-export",
 		capScope: "system",
@@ -79350,13 +79843,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"integrations.getSettings": {
-		capName: "integrations",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"integrations.list": {
 		capName: "integrations",
 		capScope: "system",
@@ -79364,13 +79850,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"integrations.setSettings": {
-		capName: "integrations",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"integrations.testConnection": {
 		capName: "integrations",
 		capScope: "system",
@@ -80365,6 +80844,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"migrations.clearLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
 	"migrations.declareOwner": {
 		capName: "migrations",
 		capScope: "system",
@@ -80372,6 +80858,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"migrations.deleteLegacyIntegrationRowKeys": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
 	"migrations.dryRun": {
 		capName: "migrations",
 		capScope: "system",
@@ -80407,6 +80900,20 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"migrations.patchLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.readLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"migrations.restorePreMigration": {
 		capName: "migrations",
 		capScope: "system",
@@ -86610,6 +87117,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"coreBlocks.proposeRunningThreshold": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"cover.close": [{
 		name: "deviceId",
 		form: "single",
@@ -89273,99 +89785,6 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
-/**
-* A saved Customize assignment (D936). The schema is the type: callers use
-* `z.infer`, they do not restate the shape.
-*/
-var OverrideSourceSchema = object({
-	addonId: string().min(1),
-	stableId: string().min(1),
-	cap: string().min(1),
-	fieldPath: string().min(1)
-});
-var CustomizeTransformDraftSchema = discriminatedUnion("kind", [
-	object({ kind: literal("identity") }),
-	object({ kind: literal("invert") }),
-	object({
-		kind: literal("threshold"),
-		comparison: _enum(["gte", "lte"]),
-		threshold: number(),
-		startDwellMs: number().nonnegative(),
-		stopDwellMs: number().nonnegative()
-	}),
-	object({
-		kind: literal("linear"),
-		scale: number(),
-		offset: number(),
-		clampMin: number().optional(),
-		clampMax: number().optional()
-	}),
-	object({
-		kind: literal("enum-map"),
-		mapping: record(string(), string().nullable())
-	}),
-	object({ kind: literal("number") })
-]);
-var ScalarOverrideDraftSchema = object({
-	kind: literal("scalar"),
-	cap: string().min(1),
-	targetId: string().min(1),
-	source: OverrideSourceSchema,
-	transform: CustomizeTransformDraftSchema
-});
-var KeyedArrayOverrideDraftSchema = object({
-	kind: literal("keyedArray"),
-	cap: string().min(1),
-	targetId: string().min(1),
-	key: string().min(1),
-	label: string().min(1),
-	fieldPath: string().min(1),
-	source: OverrideSourceSchema,
-	transform: CustomizeTransformDraftSchema
-});
-var PulseOverrideDraftSchema = object({
-	kind: literal("pulse"),
-	cap: string().min(1),
-	targetId: string().min(1),
-	enabled: boolean(),
-	debounceMs: number().nonnegative(),
-	edges: array(_enum([
-		"rising",
-		"button",
-		"native-event"
-	])).min(1).optional(),
-	sources: array(OverrideSourceSchema).min(1)
-});
-var SpanSourceDraftSchema = OverrideSourceSchema.extend({ mode: _enum([
-	"in-addition",
-	"confirm",
-	"replace"
-]).optional() });
-discriminatedUnion("kind", [
-	ScalarOverrideDraftSchema,
-	KeyedArrayOverrideDraftSchema,
-	PulseOverrideDraftSchema,
-	object({
-		kind: literal("span"),
-		cap: string().min(1),
-		targetId: string().min(1),
-		timeoutMs: number().nonnegative(),
-		cooldownMs: number().nonnegative().optional(),
-		sources: array(SpanSourceDraftSchema)
-	})
-]);
-object({
-	targetId: string().min(1),
-	configured: boolean(),
-	source: _enum(["native", "assigned"]),
-	state: _enum([
-		"active",
-		"stale",
-		"released",
-		"unavailable"
-	]),
-	reason: string().nullable()
-});
 var G711_SCALE_CORRECTION_DB = {
 	PCMU: 20 * Math.log10(4),
 	PCMA: 20 * Math.log10(8)
@@ -123190,7 +123609,7 @@ var MqttAclStore = class MqttAclStore {
 *   The addon has NO standalone admin page. All configuration — external
 *   broker entries, the embedded `aedes` broker, embedded credentials,
 *   and the topic ACL — is exposed through the standard
-*   `globalSettingsSchema()` and rendered automatically inside the
+*   `clusterSettingsSchema()` and rendered automatically inside the
 *   Integrations → Brokers tab's docked Settings panel, like every other
 *   integration-type addon.
 *
@@ -123377,6 +123796,7 @@ var MqttBrokerAddon = class extends BaseAddon {
 		this.aclStore = MqttAclStore.of(records);
 		this.instances = new RecordIntegrationInstances(records, mqttBrokersEntryKind, {
 			description: {
+				role: "services",
 				instanceMode: "multiple",
 				kind: "brokers",
 				canTest: false
@@ -124260,11 +124680,15 @@ var MqttBrokerAddon = class extends BaseAddon {
 			}
 		};
 	}
+	scopedSettingsCapabilities() {
+		return ["mqtt-broker", "broker"];
+	}
 	/**
 	* The embedded broker, its credentials and the ACL. The external brokers are records, listed
 	* on the Brokers page and edited as integration instances (`brokerForm`).
 	*/
-	globalSettingsSchema() {
+	async clusterSettingsSchema(cap) {
+		if (cap !== "mqtt-broker" && cap !== "broker") return null;
 		return this.schema({ sections: [
 			{
 				id: "mqtt-broker-embedded",