@camstack/addon-mqtt-broker 1.2.157 → 1.2.158

package/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.158] - 2026-11-09
+
+### Changed
+
+- Rebuilt against updated dependencies.
+
 ## [1.2.157] - 2026-11-08
 
 ### Changed

package/dist/mqtt-broker.addon.js

@@ -6059,7 +6059,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-CS5Xp1iQ.mjs
+//#region ../types/dist/sleep-CkinsFFb.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8729,16 +8729,6 @@ var BaseAddon = class {
 		return null;
 	}
 	/**
-	* The form schema of ONE integration instance, or `null` to use the scoped form.
-	*
-	* Override it only when an `instanceMode: multiple` addon's instances differ: an NVR integration
-	* needs its connection fields, the default integration the addon's own sections. It is the
-	* SHAPE of the form only — the values live on the instance record.
-	*/
-	async integrationFormSchema(_instance) {
-		return null;
-	}
-	/**
 	* D986 scoped settings: the form shape of the CLUSTER-wide settings one capability this addon
 	* provides owns, or `null` when it has none. `cap` is a capability name the addon's manifest
 	* declares. Stored as `addon-settings` rows `<addonId>.<field>`. The keys of this schema, of
@@ -8766,8 +8756,7 @@ var BaseAddon = class {
 	}
 	/**
 	* The host's read of the scoped declarations: the schema one capability declares for `scope`,
-	* or `null`. Beside {@link getIntegrationFormSchema}, the same shape: the hook is protected, the
-	* host asks this method.
+	* or `null`. The hook is protected, the host asks this method.
 	*/
 	async getScopedSettingsSchema(scope, cap) {
 		switch (scope) {
@@ -8935,22 +8924,6 @@ var BaseAddon = class {
 		return Object.fromEntries([...collectHydratedFieldValues(form)].filter(([, value]) => value !== void 0));
 	}
 	/**
-	* What the create wizard and the integration edit page render for one instance: the addon's
-	* per-instance schema when it declares one, else its global schema (what they always showed).
-	*/
-	async getIntegrationFormSchema(instance, nodeId) {
-		const scoped = await this.integrationFormSchema(instance);
-		if (scoped === null) return this.scopedForm(nodeId);
-		return hydrateSchema(scoped, {}, { inlineSecretsAsViews: true });
-	}
-	/** The form of the scoped schemas this addon declared, hydrated from its store. */
-	async scopedForm(nodeId) {
-		await this.loadScopedSchemas();
-		const schema = this.scopedFormSchema();
-		if (!schema) return { sections: [] };
-		return hydrateSchema(schema, await this.readRawProjectedStore(nodeId), { inlineSecretsAsViews: true });
-	}
-	/**
 	* The raw addon store PROJECTED onto the target node's bare per-node keys:
 	* every `perNode: true` field carries THAT node's scoped value on its bare
 	* key (absent scoped key ⇒ key absent, so the schema `default` wins — no
@@ -9137,12 +9110,6 @@ var BaseAddon = class {
 		this._nodeKeysByCap = /* @__PURE__ */ new Map();
 		this._addonSecretTree = null;
 	}
-	/** The form of an addon's scoped schemas: their sections, each shown once. */
-	scopedFormSchema(cap) {
-		const byId = /* @__PURE__ */ new Map();
-		for (const entry of this.loadedScopedSchemas(cap)) for (const section of entry.schema.sections) if (!byId.has(section.id)) byId.set(section.id, section);
-		return byId.size === 0 ? null : { sections: [...byId.values()] };
-	}
 	/** Every loaded scoped schema of `cap`, or of every loaded capability. */
 	loadedScopedSchemas(cap) {
 		if (cap !== void 0) return this._scopedByCap.get(cap) ?? [];
@@ -9732,6 +9699,10 @@ function normalizeAddonInitResult(result) {
 	if (Array.isArray(result)) return { providers: result };
 	return result;
 }
+object({
+	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
+	params: record(string(), union([string(), number$1()])).optional()
+});
 object({
 	field: string().min(1),
 	on: literal("advance")
@@ -9808,12 +9779,6 @@ function systemMethod(input, output, options) {
 		systemOnly: true
 	};
 }
-/**
-* A method a SOURCE of a collection cap may legitimately not serve — OPTIONAL
-* on `InferProvider`. The `providerOptional: true` literal is what
-* `InferProvider` keys on; see {@link CapabilityMethodSchema.providerOptional}
-* for when this is the honest answer and when it is a soft stub.
-*/
 function optionalMethod(input, output, options) {
 	return {
 		...method(input, output, options),
@@ -17208,10 +17173,6 @@ Object.freeze({
 		"uploadDataset": 72e5
 	}
 });
-object({
-	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
-	params: record(string(), union([string(), number$1()])).optional()
-});
 //#endregion
 //#region ../types/dist/composition-CXCX78IR.mjs
 /**
@@ -18922,25 +18883,6 @@ var RequiredAddonUpdateSchema = object({
 	/** What this node has; `null` when the addon is not installed. */
 	installed: string().nullable()
 });
-/**
-* Which integration instance a settings form is for. An addon that serves several instances
-* (`instanceMode: multiple`) can show a different form per instance — an NVR integration
-* needs its connection, the default integration needs the addon's own sections.
-*
-* - `integrationId` is `null` in the create wizard: nothing exists yet, the operator is
-*   setting up a NEW instance.
-* - `mode` is the wizard mode of the integration type (`getAvailableTypes`).
-* - `candidateStableId` is the discovery candidate a wizard was seeded from, if any.
-*/
-var IntegrationInstanceRefSchema = object({
-	integrationId: string().nullable(),
-	mode: _enum([
-		"standalone",
-		"account",
-		"broker"
-	]),
-	candidateStableId: string().optional()
-});
 /** No part holds the id a call named. */
 var UnknownInstanceError = class extends Error {
 	instanceId;
@@ -19001,8 +18943,8 @@ function composeInstanceKinds(parts, base) {
 		instanceFormSchema: async ({ id, kind }) => {
 			return (id === null ? byKind(kind) : await holderOf(id)).provider.instanceFormSchema({ id });
 		},
-		listInstances: async () => {
-			return (await Promise.all(parts.map(async (part) => (await part.provider.listInstances()).map((instance) => tagged(part, instance))))).flat();
+		listInstances: async (input) => {
+			return (await Promise.all(parts.map(async (part) => (await part.provider.listInstances(input)).map((instance) => tagged(part, instance))))).flat();
 		},
 		getInstance: async ({ id }) => {
 			for (const part of parts) {
@@ -45128,10 +45070,6 @@ method(object({
 	scope: ScopedSettingsScopeSchema,
 	nodeId: string().optional()
 }), record(string(), unknown()).nullable()), method(object({
-	addonId: string(),
-	nodeId: string().optional(),
-	instance: IntegrationInstanceRefSchema
-}), SettingsSchemaWithValuesSchema.nullable()), method(object({
 	addonId: string(),
 	nodeId: string().optional()
 }), object({ keys: array(string()) }).nullable(), { auth: "admin" }), method(object({
@@ -47167,7 +47105,14 @@ var CalendarInfoSchema = object({
 	id: string().min(1),
 	name: string().min(1),
 	source: CalendarSourceKindSchema,
-	enabled: boolean()
+	enabled: boolean(),
+	/**
+	* The `integration-instances` record that owns this calendar (the record the switch writes).
+	* Every source stamps it from the record it read the calendar from, so a consumer joins on
+	* it instead of rebuilding an id from form values. Optional on the wire so a source addon
+	* that predates the field still lists its calendars: such a row simply has no switch.
+	*/
+	instanceId: string().min(1).optional()
 });
 /**
 * Time contract of {@link CalendarEvent}.
@@ -49163,8 +49108,12 @@ var RemoteSourceSchema = discriminatedUnion("kind", [
 	object({
 		...sourceBase,
 		kind: literal("ir"),
-		/** The `ir-transmitter` device the code is sent through. */
-		transmitterId: number$1().int().nonnegative(),
+		/**
+		* The `ir-transmitter` device the code is sent through. Absent = the remote's
+		* `defaultTransmitterId` at run time (a source stored before this field was
+		* optional keeps the emitter it names).
+		*/
+		transmitterId: number$1().int().nonnegative().optional(),
 		/** The code itself; whether a transmitter could send it is `irSourceProblem`. */
 		payload: IrPayloadSchema
 	})
@@ -55515,6 +55464,12 @@ var IntegrationWithStateSchema = object({
 	name: string(),
 	/** A projection of the instance body's switch (`setInstanceEnabled` is the only writer). */
 	enabled: boolean(),
+	/**
+	* True when the addon that holds the switch did not answer (down, failed, or keeps no record for
+	* this row): `enabled` is then the stored registry flag, a stale value, not the state. A reader
+	* must not draw it as on or off (D315).
+	*/
+	switchUnknown: literal(true).optional(),
 	info: record(string(), unknown()).readonly(),
 	/** The discovery candidate this integration was set up from (D984). */
 	originStableId: string().optional(),
@@ -55528,6 +55483,12 @@ var IntegrationLiteSchema = object({
 	name: string(),
 	/** A projection of the instance body's switch (`setInstanceEnabled` is the only writer). */
 	enabled: boolean(),
+	/**
+	* True when the addon that holds the switch did not answer (down, failed, or keeps no record for
+	* this row): `enabled` is then the stored registry flag, a stale value, not the state. A reader
+	* must not draw it as on or off (D315).
+	*/
+	switchUnknown: literal(true).optional(),
 	info: record(string(), unknown()).readonly(),
 	/** The discovery candidate this integration was set up from (D984). */
 	originStableId: string().optional(),
@@ -55626,9 +55587,9 @@ var UpdateIntegrationInputSchema = object({
 	id: string(),
 	name: string().optional(),
 	/**
-	* Accepted for a FIXED builtin only (`info.fixed`: alarm panel, camera grid, core blocks,
-	* terminal), which keeps no instance record: the registry flag is its one store. Any other
-	* integration is switched through `integration-instances.setInstanceEnabled`.
+	* Honoured ONLY for a fixed builtin (`info.fixed`), whose switch is the hub's own registry flag
+	* and works while its addon is down. Any other row is refused (a typed `BAD_REQUEST`): its
+	* switch is `integration-instances.setInstanceEnabled`.
 	*/
 	enabled: boolean().optional(),
 	info: record(string(), unknown()).optional()
@@ -55662,6 +55623,12 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 * the form as a `SecretFieldView`, never text (D789). A patch value omitted, `''`
 * or the redaction token KEEPS the stored secret; `{ $secretClear: true }`
 * clears it.
+*
+* Who may call (epic #440): every method but `describe` and `instanceFormSchema` is open to any
+* session (`caller: 'scoped'`) and default-denies. An admin passes everywhere. A non-admin passes
+* only on a call pinned to one addon whose `describe().userScoped` is true, and that provider
+* filters every row on the `caller` the router injected (a notification target is somebody's
+* phone: a user sees and changes only their own). An addon that says nothing keeps the admin door.
 */
 var ConfigSchemaPassthrough$2 = custom();
 var IntegrationInstanceIdSchema = string().min(1);
@@ -55775,7 +55742,15 @@ var IntegrationInstanceDescriptionSchema = object({
 	*/
 	mintsId: boolean().optional(),
 	/** The links to other instances the provider's kinds declare; absent means none. */
-	links: array(IntegrationInstanceLinkSchema).optional()
+	links: array(IntegrationInstanceLinkSchema).optional(),
+	/**
+	* The rows belong to individual users (a notification target is somebody's phone). The router
+	* then opens `listInstances`, `getInstance`, `createInstance`, `updateInstance`,
+	* `setInstanceEnabled`, `deleteInstance` and `testInstance` to a NON-admin session on a call
+	* pinned to this addon, and hands the provider the `caller` so it keeps a user to their own rows.
+	* Absent means admin only, as it always was.
+	*/
+	userScoped: boolean().optional()
 });
 var IntegrationInstanceStatusSchema = object({
 	state: _enum([
@@ -55833,8 +55808,14 @@ var integrationInstancesCapability = {
 			/** The discovery candidate the wizard was seeded from (`stableId`), if any. */
 			candidateStableId: string().min(1).optional()
 		}), ConfigSchemaPassthrough$2, { auth: "admin" }),
-		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
-		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
+		listInstances: method(looseObject({}), array(IntegrationInstanceSchema).readonly(), {
+			auth: "protected",
+			caller: "scoped"
+		}),
+		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), {
+			auth: "protected",
+			caller: "scoped"
+		}),
 		/**
 		* Insert the typed record. With `id` it is stored under that id (a duplicate id is refused);
 		* without one the PROVIDER mints it and answers it. `kind` picks one of `describe().kinds`.
@@ -55867,11 +55848,13 @@ var integrationInstancesCapability = {
 			seed: object({ info: record(string(), unknown()) }).optional()
 		}), object({ id: string() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		}),
 		updateInstance: method(IntegrationInstancePatchSchema, object({ ok: literal(true) }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		}),
 		/**
 		* Switch ONE instance on or off, for every role; a missing record is created from the addon's
@@ -55883,7 +55866,8 @@ var integrationInstancesCapability = {
 			enabled: boolean()
 		}), object({ ok: literal(true) }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		}),
 		/**
 		* Delete the record and its keychain refs together. For an instance that brings devices the hub
@@ -55892,7 +55876,8 @@ var integrationInstancesCapability = {
 		*/
 		deleteInstance: method(object({ id: IntegrationInstanceIdSchema }), object({ ok: literal(true) }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		}),
 		testInstance: optionalMethod(object({
 			id: IntegrationInstanceIdSchema.nullable(),
@@ -55901,7 +55886,8 @@ var integrationInstancesCapability = {
 			kind: string().min(1).optional()
 		}), TestConnectionResultSchema, {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		})
 	}
 };
@@ -72382,7 +72368,6 @@ var RemoteCustomButtonSchema = object({
 	/** What the operator calls it, and what a voice command may name. */
 	name: string().min(1).max(60)
 });
-var RemotePowerModeSchema = _enum(["toggle", "discrete"]);
 /**
 * The source rules: every step role is bound, ids and names are unique, a
 * channel number belongs to one `digits` source, and no name or id is another
@@ -72463,7 +72448,6 @@ var RemoteConfigSchema = object({
 	sources: array(RemoteSourceSchema).max(200).default([]),
 	/** The pause between two steps of a source: the television's receiver, not a repeat. */
 	stepDelayMs: number$1().int().min(100).max(REMOTE_STEP_DELAY_MAX_MS).default(500),
-	power: object({ mode: RemotePowerModeSchema }),
 	/**
 	* READ-ONLY: sources a stored configuration carries that no longer parse,
 	* left out of `sources` with the reason (`readStoredRemoteConfig`). Never
@@ -72567,6 +72551,11 @@ var RemoteLayoutButtonSchema = object({
 	/** Absent = the plain rendering every layout had before shapes existed. */
 	shape: RemoteButtonShapeSchema.optional(),
 	tone: RemoteButtonToneSchema.optional(),
+	/**
+	* Draw the label on a colour-toned key. A colour key shows only its colour
+	* by default; a remote whose plastic prints letters on them (A B C D) sets it.
+	*/
+	showLegend: boolean().optional(),
 	/** The group this button belongs to; it must lie inside that group's rectangle. */
 	groupId: string().min(1).max(40).optional()
 });
@@ -72704,7 +72693,6 @@ var RemoteBoundCommandSchema = object({
 });
 var RemoteCommandListSchema = object({
 	layoutTemplateId: string().nullable(),
-	power: object({ mode: RemotePowerModeSchema }),
 	/** Only the roles that are BOUND — the ones a press can reach. */
 	commands: array(RemoteBoundCommandSchema),
 	/** The sources the operator declared; empty when none (planning#460). */
@@ -72717,7 +72705,8 @@ var RemoteRefusalReasonSchema = _enum([
 	"unknown-source",
 	"unbound-step",
 	"undeclared-channel",
-	"press-timeout"
+	"press-timeout",
+	"no-transmitter"
 ]);
 var RemoteSendResultSchema = discriminatedUnion("status", [
 	object({
@@ -72810,7 +72799,8 @@ var RemoteComponentButtonSchema = object({
 	icon: string().min(1).max(60).optional(),
 	label: string().min(1).max(40).optional(),
 	shape: RemoteButtonShapeSchema.optional(),
-	tone: RemoteButtonToneSchema.optional()
+	tone: RemoteButtonToneSchema.optional(),
+	showLegend: boolean().optional()
 });
 var RemoteLayoutComponentSchema = object({
 	id: string().max(80).regex(COMPONENT_ID_RE, { message: "<namespace>:<name>, lowercase" }),
@@ -73765,6 +73755,11 @@ var SendEmailResultSchema = object({
 var SmtpStatusSchema = object({
 	/** True iff the addon has successfully verified the relay. */
 	ready: boolean(),
+	/**
+	* The tri-state behind `ready` (D315): true when the last send worked, false when it failed,
+	* ABSENT when the relay has not sent yet (unknown, never "not verified").
+	*/
+	verified: boolean().optional(),
 	/** Operator-visible host string (no credentials). */
 	host: string(),
 	/** Last error message reported by the relay, when not ready. */
@@ -73776,10 +73771,6 @@ method(SendEmailInputSchema, SendEmailResultSchema, {
 	kind: "mutation",
 	auth: "admin",
 	access: "create"
-}), method(RelayPinSchema, SmtpStatusSchema, {
-	kind: "mutation",
-	auth: "admin",
-	access: "view"
 }), method(RelayPinSchema, SmtpStatusSchema, { auth: "admin" });
 /**
 * A single device snapshot returned as base64 JPEG/PNG.
@@ -80448,13 +80439,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"addonSettings.getIntegrationFormSchema": {
-		capName: "addon-settings",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"addonSettings.getScopedSettings": {
 		capName: "addon-settings",
 		capScope: "system",
@@ -88477,13 +88461,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"smtpProvider.verify": {
-		capName: "smtp-provider",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"snapshot.applyDeviceSettingsPatch": {
 		capName: "snapshot",
 		capScope: "device",

package/dist/mqtt-broker.addon.mjs

@@ -6052,7 +6052,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-CS5Xp1iQ.mjs
+//#region ../types/dist/sleep-CkinsFFb.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8722,16 +8722,6 @@ var BaseAddon = class {
 		return null;
 	}
 	/**
-	* The form schema of ONE integration instance, or `null` to use the scoped form.
-	*
-	* Override it only when an `instanceMode: multiple` addon's instances differ: an NVR integration
-	* needs its connection fields, the default integration the addon's own sections. It is the
-	* SHAPE of the form only — the values live on the instance record.
-	*/
-	async integrationFormSchema(_instance) {
-		return null;
-	}
-	/**
 	* D986 scoped settings: the form shape of the CLUSTER-wide settings one capability this addon
 	* provides owns, or `null` when it has none. `cap` is a capability name the addon's manifest
 	* declares. Stored as `addon-settings` rows `<addonId>.<field>`. The keys of this schema, of
@@ -8759,8 +8749,7 @@ var BaseAddon = class {
 	}
 	/**
 	* The host's read of the scoped declarations: the schema one capability declares for `scope`,
-	* or `null`. Beside {@link getIntegrationFormSchema}, the same shape: the hook is protected, the
-	* host asks this method.
+	* or `null`. The hook is protected, the host asks this method.
 	*/
 	async getScopedSettingsSchema(scope, cap) {
 		switch (scope) {
@@ -8928,22 +8917,6 @@ var BaseAddon = class {
 		return Object.fromEntries([...collectHydratedFieldValues(form)].filter(([, value]) => value !== void 0));
 	}
 	/**
-	* What the create wizard and the integration edit page render for one instance: the addon's
-	* per-instance schema when it declares one, else its global schema (what they always showed).
-	*/
-	async getIntegrationFormSchema(instance, nodeId) {
-		const scoped = await this.integrationFormSchema(instance);
-		if (scoped === null) return this.scopedForm(nodeId);
-		return hydrateSchema(scoped, {}, { inlineSecretsAsViews: true });
-	}
-	/** The form of the scoped schemas this addon declared, hydrated from its store. */
-	async scopedForm(nodeId) {
-		await this.loadScopedSchemas();
-		const schema = this.scopedFormSchema();
-		if (!schema) return { sections: [] };
-		return hydrateSchema(schema, await this.readRawProjectedStore(nodeId), { inlineSecretsAsViews: true });
-	}
-	/**
 	* The raw addon store PROJECTED onto the target node's bare per-node keys:
 	* every `perNode: true` field carries THAT node's scoped value on its bare
 	* key (absent scoped key ⇒ key absent, so the schema `default` wins — no
@@ -9130,12 +9103,6 @@ var BaseAddon = class {
 		this._nodeKeysByCap = /* @__PURE__ */ new Map();
 		this._addonSecretTree = null;
 	}
-	/** The form of an addon's scoped schemas: their sections, each shown once. */
-	scopedFormSchema(cap) {
-		const byId = /* @__PURE__ */ new Map();
-		for (const entry of this.loadedScopedSchemas(cap)) for (const section of entry.schema.sections) if (!byId.has(section.id)) byId.set(section.id, section);
-		return byId.size === 0 ? null : { sections: [...byId.values()] };
-	}
 	/** Every loaded scoped schema of `cap`, or of every loaded capability. */
 	loadedScopedSchemas(cap) {
 		if (cap !== void 0) return this._scopedByCap.get(cap) ?? [];
@@ -9725,6 +9692,10 @@ function normalizeAddonInitResult(result) {
 	if (Array.isArray(result)) return { providers: result };
 	return result;
 }
+object({
+	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
+	params: record(string(), union([string(), number$1()])).optional()
+});
 object({
 	field: string().min(1),
 	on: literal("advance")
@@ -9801,12 +9772,6 @@ function systemMethod(input, output, options) {
 		systemOnly: true
 	};
 }
-/**
-* A method a SOURCE of a collection cap may legitimately not serve — OPTIONAL
-* on `InferProvider`. The `providerOptional: true` literal is what
-* `InferProvider` keys on; see {@link CapabilityMethodSchema.providerOptional}
-* for when this is the honest answer and when it is a soft stub.
-*/
 function optionalMethod(input, output, options) {
 	return {
 		...method(input, output, options),
@@ -17201,10 +17166,6 @@ Object.freeze({
 		"uploadDataset": 72e5
 	}
 });
-object({
-	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
-	params: record(string(), union([string(), number$1()])).optional()
-});
 //#endregion
 //#region ../types/dist/composition-CXCX78IR.mjs
 /**
@@ -18915,25 +18876,6 @@ var RequiredAddonUpdateSchema = object({
 	/** What this node has; `null` when the addon is not installed. */
 	installed: string().nullable()
 });
-/**
-* Which integration instance a settings form is for. An addon that serves several instances
-* (`instanceMode: multiple`) can show a different form per instance — an NVR integration
-* needs its connection, the default integration needs the addon's own sections.
-*
-* - `integrationId` is `null` in the create wizard: nothing exists yet, the operator is
-*   setting up a NEW instance.
-* - `mode` is the wizard mode of the integration type (`getAvailableTypes`).
-* - `candidateStableId` is the discovery candidate a wizard was seeded from, if any.
-*/
-var IntegrationInstanceRefSchema = object({
-	integrationId: string().nullable(),
-	mode: _enum([
-		"standalone",
-		"account",
-		"broker"
-	]),
-	candidateStableId: string().optional()
-});
 /** No part holds the id a call named. */
 var UnknownInstanceError = class extends Error {
 	instanceId;
@@ -18994,8 +18936,8 @@ function composeInstanceKinds(parts, base) {
 		instanceFormSchema: async ({ id, kind }) => {
 			return (id === null ? byKind(kind) : await holderOf(id)).provider.instanceFormSchema({ id });
 		},
-		listInstances: async () => {
-			return (await Promise.all(parts.map(async (part) => (await part.provider.listInstances()).map((instance) => tagged(part, instance))))).flat();
+		listInstances: async (input) => {
+			return (await Promise.all(parts.map(async (part) => (await part.provider.listInstances(input)).map((instance) => tagged(part, instance))))).flat();
 		},
 		getInstance: async ({ id }) => {
 			for (const part of parts) {
@@ -45121,10 +45063,6 @@ method(object({
 	scope: ScopedSettingsScopeSchema,
 	nodeId: string().optional()
 }), record(string(), unknown()).nullable()), method(object({
-	addonId: string(),
-	nodeId: string().optional(),
-	instance: IntegrationInstanceRefSchema
-}), SettingsSchemaWithValuesSchema.nullable()), method(object({
 	addonId: string(),
 	nodeId: string().optional()
 }), object({ keys: array(string()) }).nullable(), { auth: "admin" }), method(object({
@@ -47160,7 +47098,14 @@ var CalendarInfoSchema = object({
 	id: string().min(1),
 	name: string().min(1),
 	source: CalendarSourceKindSchema,
-	enabled: boolean()
+	enabled: boolean(),
+	/**
+	* The `integration-instances` record that owns this calendar (the record the switch writes).
+	* Every source stamps it from the record it read the calendar from, so a consumer joins on
+	* it instead of rebuilding an id from form values. Optional on the wire so a source addon
+	* that predates the field still lists its calendars: such a row simply has no switch.
+	*/
+	instanceId: string().min(1).optional()
 });
 /**
 * Time contract of {@link CalendarEvent}.
@@ -49156,8 +49101,12 @@ var RemoteSourceSchema = discriminatedUnion("kind", [
 	object({
 		...sourceBase,
 		kind: literal("ir"),
-		/** The `ir-transmitter` device the code is sent through. */
-		transmitterId: number$1().int().nonnegative(),
+		/**
+		* The `ir-transmitter` device the code is sent through. Absent = the remote's
+		* `defaultTransmitterId` at run time (a source stored before this field was
+		* optional keeps the emitter it names).
+		*/
+		transmitterId: number$1().int().nonnegative().optional(),
 		/** The code itself; whether a transmitter could send it is `irSourceProblem`. */
 		payload: IrPayloadSchema
 	})
@@ -55508,6 +55457,12 @@ var IntegrationWithStateSchema = object({
 	name: string(),
 	/** A projection of the instance body's switch (`setInstanceEnabled` is the only writer). */
 	enabled: boolean(),
+	/**
+	* True when the addon that holds the switch did not answer (down, failed, or keeps no record for
+	* this row): `enabled` is then the stored registry flag, a stale value, not the state. A reader
+	* must not draw it as on or off (D315).
+	*/
+	switchUnknown: literal(true).optional(),
 	info: record(string(), unknown()).readonly(),
 	/** The discovery candidate this integration was set up from (D984). */
 	originStableId: string().optional(),
@@ -55521,6 +55476,12 @@ var IntegrationLiteSchema = object({
 	name: string(),
 	/** A projection of the instance body's switch (`setInstanceEnabled` is the only writer). */
 	enabled: boolean(),
+	/**
+	* True when the addon that holds the switch did not answer (down, failed, or keeps no record for
+	* this row): `enabled` is then the stored registry flag, a stale value, not the state. A reader
+	* must not draw it as on or off (D315).
+	*/
+	switchUnknown: literal(true).optional(),
 	info: record(string(), unknown()).readonly(),
 	/** The discovery candidate this integration was set up from (D984). */
 	originStableId: string().optional(),
@@ -55619,9 +55580,9 @@ var UpdateIntegrationInputSchema = object({
 	id: string(),
 	name: string().optional(),
 	/**
-	* Accepted for a FIXED builtin only (`info.fixed`: alarm panel, camera grid, core blocks,
-	* terminal), which keeps no instance record: the registry flag is its one store. Any other
-	* integration is switched through `integration-instances.setInstanceEnabled`.
+	* Honoured ONLY for a fixed builtin (`info.fixed`), whose switch is the hub's own registry flag
+	* and works while its addon is down. Any other row is refused (a typed `BAD_REQUEST`): its
+	* switch is `integration-instances.setInstanceEnabled`.
 	*/
 	enabled: boolean().optional(),
 	info: record(string(), unknown()).optional()
@@ -55655,6 +55616,12 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 * the form as a `SecretFieldView`, never text (D789). A patch value omitted, `''`
 * or the redaction token KEEPS the stored secret; `{ $secretClear: true }`
 * clears it.
+*
+* Who may call (epic #440): every method but `describe` and `instanceFormSchema` is open to any
+* session (`caller: 'scoped'`) and default-denies. An admin passes everywhere. A non-admin passes
+* only on a call pinned to one addon whose `describe().userScoped` is true, and that provider
+* filters every row on the `caller` the router injected (a notification target is somebody's
+* phone: a user sees and changes only their own). An addon that says nothing keeps the admin door.
 */
 var ConfigSchemaPassthrough$2 = custom();
 var IntegrationInstanceIdSchema = string().min(1);
@@ -55768,7 +55735,15 @@ var IntegrationInstanceDescriptionSchema = object({
 	*/
 	mintsId: boolean().optional(),
 	/** The links to other instances the provider's kinds declare; absent means none. */
-	links: array(IntegrationInstanceLinkSchema).optional()
+	links: array(IntegrationInstanceLinkSchema).optional(),
+	/**
+	* The rows belong to individual users (a notification target is somebody's phone). The router
+	* then opens `listInstances`, `getInstance`, `createInstance`, `updateInstance`,
+	* `setInstanceEnabled`, `deleteInstance` and `testInstance` to a NON-admin session on a call
+	* pinned to this addon, and hands the provider the `caller` so it keeps a user to their own rows.
+	* Absent means admin only, as it always was.
+	*/
+	userScoped: boolean().optional()
 });
 var IntegrationInstanceStatusSchema = object({
 	state: _enum([
@@ -55826,8 +55801,14 @@ var integrationInstancesCapability = {
 			/** The discovery candidate the wizard was seeded from (`stableId`), if any. */
 			candidateStableId: string().min(1).optional()
 		}), ConfigSchemaPassthrough$2, { auth: "admin" }),
-		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
-		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
+		listInstances: method(looseObject({}), array(IntegrationInstanceSchema).readonly(), {
+			auth: "protected",
+			caller: "scoped"
+		}),
+		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), {
+			auth: "protected",
+			caller: "scoped"
+		}),
 		/**
 		* Insert the typed record. With `id` it is stored under that id (a duplicate id is refused);
 		* without one the PROVIDER mints it and answers it. `kind` picks one of `describe().kinds`.
@@ -55860,11 +55841,13 @@ var integrationInstancesCapability = {
 			seed: object({ info: record(string(), unknown()) }).optional()
 		}), object({ id: string() }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		}),
 		updateInstance: method(IntegrationInstancePatchSchema, object({ ok: literal(true) }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		}),
 		/**
 		* Switch ONE instance on or off, for every role; a missing record is created from the addon's
@@ -55876,7 +55859,8 @@ var integrationInstancesCapability = {
 			enabled: boolean()
 		}), object({ ok: literal(true) }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		}),
 		/**
 		* Delete the record and its keychain refs together. For an instance that brings devices the hub
@@ -55885,7 +55869,8 @@ var integrationInstancesCapability = {
 		*/
 		deleteInstance: method(object({ id: IntegrationInstanceIdSchema }), object({ ok: literal(true) }), {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		}),
 		testInstance: optionalMethod(object({
 			id: IntegrationInstanceIdSchema.nullable(),
@@ -55894,7 +55879,8 @@ var integrationInstancesCapability = {
 			kind: string().min(1).optional()
 		}), TestConnectionResultSchema, {
 			kind: "mutation",
-			auth: "admin"
+			auth: "protected",
+			caller: "scoped"
 		})
 	}
 };
@@ -72375,7 +72361,6 @@ var RemoteCustomButtonSchema = object({
 	/** What the operator calls it, and what a voice command may name. */
 	name: string().min(1).max(60)
 });
-var RemotePowerModeSchema = _enum(["toggle", "discrete"]);
 /**
 * The source rules: every step role is bound, ids and names are unique, a
 * channel number belongs to one `digits` source, and no name or id is another
@@ -72456,7 +72441,6 @@ var RemoteConfigSchema = object({
 	sources: array(RemoteSourceSchema).max(200).default([]),
 	/** The pause between two steps of a source: the television's receiver, not a repeat. */
 	stepDelayMs: number$1().int().min(100).max(REMOTE_STEP_DELAY_MAX_MS).default(500),
-	power: object({ mode: RemotePowerModeSchema }),
 	/**
 	* READ-ONLY: sources a stored configuration carries that no longer parse,
 	* left out of `sources` with the reason (`readStoredRemoteConfig`). Never
@@ -72560,6 +72544,11 @@ var RemoteLayoutButtonSchema = object({
 	/** Absent = the plain rendering every layout had before shapes existed. */
 	shape: RemoteButtonShapeSchema.optional(),
 	tone: RemoteButtonToneSchema.optional(),
+	/**
+	* Draw the label on a colour-toned key. A colour key shows only its colour
+	* by default; a remote whose plastic prints letters on them (A B C D) sets it.
+	*/
+	showLegend: boolean().optional(),
 	/** The group this button belongs to; it must lie inside that group's rectangle. */
 	groupId: string().min(1).max(40).optional()
 });
@@ -72697,7 +72686,6 @@ var RemoteBoundCommandSchema = object({
 });
 var RemoteCommandListSchema = object({
 	layoutTemplateId: string().nullable(),
-	power: object({ mode: RemotePowerModeSchema }),
 	/** Only the roles that are BOUND — the ones a press can reach. */
 	commands: array(RemoteBoundCommandSchema),
 	/** The sources the operator declared; empty when none (planning#460). */
@@ -72710,7 +72698,8 @@ var RemoteRefusalReasonSchema = _enum([
 	"unknown-source",
 	"unbound-step",
 	"undeclared-channel",
-	"press-timeout"
+	"press-timeout",
+	"no-transmitter"
 ]);
 var RemoteSendResultSchema = discriminatedUnion("status", [
 	object({
@@ -72803,7 +72792,8 @@ var RemoteComponentButtonSchema = object({
 	icon: string().min(1).max(60).optional(),
 	label: string().min(1).max(40).optional(),
 	shape: RemoteButtonShapeSchema.optional(),
-	tone: RemoteButtonToneSchema.optional()
+	tone: RemoteButtonToneSchema.optional(),
+	showLegend: boolean().optional()
 });
 var RemoteLayoutComponentSchema = object({
 	id: string().max(80).regex(COMPONENT_ID_RE, { message: "<namespace>:<name>, lowercase" }),
@@ -73758,6 +73748,11 @@ var SendEmailResultSchema = object({
 var SmtpStatusSchema = object({
 	/** True iff the addon has successfully verified the relay. */
 	ready: boolean(),
+	/**
+	* The tri-state behind `ready` (D315): true when the last send worked, false when it failed,
+	* ABSENT when the relay has not sent yet (unknown, never "not verified").
+	*/
+	verified: boolean().optional(),
 	/** Operator-visible host string (no credentials). */
 	host: string(),
 	/** Last error message reported by the relay, when not ready. */
@@ -73769,10 +73764,6 @@ method(SendEmailInputSchema, SendEmailResultSchema, {
 	kind: "mutation",
 	auth: "admin",
 	access: "create"
-}), method(RelayPinSchema, SmtpStatusSchema, {
-	kind: "mutation",
-	auth: "admin",
-	access: "view"
 }), method(RelayPinSchema, SmtpStatusSchema, { auth: "admin" });
 /**
 * A single device snapshot returned as base64 JPEG/PNG.
@@ -80441,13 +80432,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"addonSettings.getIntegrationFormSchema": {
-		capName: "addon-settings",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"addonSettings.getScopedSettings": {
 		capName: "addon-settings",
 		capScope: "system",
@@ -88470,13 +88454,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"smtpProvider.verify": {
-		capName: "smtp-provider",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"snapshot.applyDeviceSettingsPatch": {
 		capName: "snapshot",
 		capScope: "device",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-mqtt-broker",
-  "version": "1.2.157",
+  "version": "1.2.158",
   "description": "MQTT broker registry addon for CamStack — manages external broker entries + an optional embedded aedes broker. Consumers spin up their own `mqtt.js` clients via the `mqtt-broker` cap.",
   "keywords": [
     "camstack",
@@ -60,7 +60,7 @@
       "aedes"
     ],
     "requires": {
-      "server": ">=1.2.817"
+      "server": ">=1.2.820"
     }
   },
   "files": [