@camstack/addon-provider-bosch 0.1.34 → 0.1.36

package/dist/home-connect/addon.js

@@ -1,32 +1,32 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_dist = require("../dist-DOr0p9V1.js");
-const require_account_integration_offline = require("../account-integration-offline-B7f80oHo.js");
+const require_bosch_instances = require("../bosch-instances-CXmuRkef.js");
+const require_account_integration_offline = require("../account-integration-offline-Bnm17sAE.js");
 let node_crypto = require("node:crypto");
 let node_tls = require("node:tls");
 let node_zlib = require("node:zlib");
 let node_dns_promises = require("node:dns/promises");
 //#region src/home-connect/custom-actions.ts
-var homeConnectActions = require_dist.defineCustomActions({
-	beginSignIn: require_dist.customAction(require_dist.object({}), require_dist.object({
-		attemptId: require_dist.string().min(1),
-		authorizeUrl: require_dist.string().min(1),
-		summary: require_dist.string()
+var homeConnectActions = require_bosch_instances.defineCustomActions({
+	beginSignIn: require_bosch_instances.customAction(require_bosch_instances.object({}), require_bosch_instances.object({
+		attemptId: require_bosch_instances.string().min(1),
+		authorizeUrl: require_bosch_instances.string().min(1),
+		summary: require_bosch_instances.string()
 	}), {
 		kind: "mutation",
 		auth: "admin"
 	}),
-	finishSignIn: require_dist.customAction(require_dist.object({
-		attemptId: require_dist.string().min(1),
-		callback: require_dist.string().min(1)
-	}), require_dist.object({
-		token: require_dist.string().min(1).meta({ secret: true }),
-		refresh: require_dist.string().optional().meta({ secret: true }),
-		accountLabel: require_dist.string(),
+	finishSignIn: require_bosch_instances.customAction(require_bosch_instances.object({
+		attemptId: require_bosch_instances.string().min(1),
+		callback: require_bosch_instances.string().min(1)
+	}), require_bosch_instances.object({
+		token: require_bosch_instances.string().min(1).meta({ secret: true }),
+		refresh: require_bosch_instances.string().optional().meta({ secret: true }),
+		accountLabel: require_bosch_instances.string(),
 		/** JSON of the paired appliances — no credential on it. */
-		appliances: require_dist.string().min(1),
+		appliances: require_bosch_instances.string().min(1),
 		/** JSON of `haId -> { psk, iv64? }`; stored in the keychain, never in `appliances`. */
-		applianceSecrets: require_dist.string().min(1).meta({ secret: true }),
-		summary: require_dist.string()
+		applianceSecrets: require_bosch_instances.string().min(1).meta({ secret: true }),
+		summary: require_bosch_instances.string()
 	}), {
 		kind: "mutation",
 		auth: "admin"
@@ -36,21 +36,21 @@ var homeConnectActions = require_dist.defineCustomActions({
 	* app-scheme redirect and finished the exchange, then the same fields `finishSignIn` returns.
 	* Claimed once. A failed exchange answers with its operator-facing message as an error.
 	*/
-	claimSignIn: require_dist.customAction(require_dist.object({ attemptId: require_dist.string().min(1) }), require_dist.object({
-		pending: require_dist.boolean(),
-		token: require_dist.string().optional().meta({ secret: true }),
-		refresh: require_dist.string().optional().meta({ secret: true }),
-		accountLabel: require_dist.string().optional(),
-		appliances: require_dist.string().optional(),
-		applianceSecrets: require_dist.string().optional().meta({ secret: true }),
-		summary: require_dist.string().optional()
+	claimSignIn: require_bosch_instances.customAction(require_bosch_instances.object({ attemptId: require_bosch_instances.string().min(1) }), require_bosch_instances.object({
+		pending: require_bosch_instances.boolean(),
+		token: require_bosch_instances.string().optional().meta({ secret: true }),
+		refresh: require_bosch_instances.string().optional().meta({ secret: true }),
+		accountLabel: require_bosch_instances.string().optional(),
+		appliances: require_bosch_instances.string().optional(),
+		applianceSecrets: require_bosch_instances.string().optional().meta({ secret: true }),
+		summary: require_bosch_instances.string().optional()
 	}), {
 		kind: "mutation",
 		auth: "admin"
 	}),
-	signOut: require_dist.customAction(require_dist.object({}), require_dist.object({
-		signedOut: require_dist.literal(true),
-		summary: require_dist.string()
+	signOut: require_bosch_instances.customAction(require_bosch_instances.object({}), require_bosch_instances.object({
+		signedOut: require_bosch_instances.literal(true),
+		summary: require_bosch_instances.string()
 	}), {
 		kind: "mutation",
 		auth: "admin"
@@ -73,12 +73,12 @@ async function trackHomeConnectContainers(deps, trigger) {
 	} catch (err) {
 		deps.logger.warn("Home Connect could not list its devices to watch their children", { meta: {
 			trigger,
-			error: require_dist.errMsg(err)
+			error: require_bosch_instances.errMsg(err)
 		} });
 		return 0;
 	}
 	for (const d of devices) {
-		if (d.type !== require_dist.DeviceType.Container || deps.reconciler.tracks(d.id)) continue;
+		if (d.type !== require_bosch_instances.DeviceType.Container || deps.reconciler.tracks(d.id)) continue;
 		const cfg = await deps.loadConfig(d.id).catch(() => ({}));
 		const brokerId = cfg["brokerId"];
 		const haId = cfg["haId"];
@@ -1004,35 +1004,26 @@ async function finishHomeConnectSignIn(input, store, fetchImpl = homeConnectLogi
 	}, fetchImpl);
 }
 var homeConnectSignInAttempts = require_account_integration_offline.createSignInAttemptStore();
-var HomeConnectModeSchema = require_dist._enum(["AES", "TLS"]);
+var HomeConnectModeSchema = require_bosch_instances._enum(["AES", "TLS"]);
 function isPlainObject$1(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-var homeConnectDeviceDescriptionSchema = require_dist.union([require_dist.string(), require_dist.record(require_dist.string(), require_dist.unknown())]).optional();
-require_dist.object({
-	host: require_dist.string().min(1),
-	psk: require_dist.string().min(1).meta({ secret: true }),
+var homeConnectDeviceDescriptionSchema = require_bosch_instances.union([require_bosch_instances.string(), require_bosch_instances.record(require_bosch_instances.string(), require_bosch_instances.unknown())]).optional();
+require_bosch_instances.object({
+	host: require_bosch_instances.string().min(1),
+	psk: require_bosch_instances.string().min(1).meta({ secret: true }),
 	mode: HomeConnectModeSchema.default("AES"),
-	iv64: require_dist.string().optional(),
+	iv64: require_bosch_instances.string().optional(),
 	deviceDescription: homeConnectDeviceDescriptionSchema
 });
 /** Setting key of the keychain-stored credentials of every paired appliance. */
 var APPLIANCE_SECRETS_KEY = "applianceSecrets";
-/**
-* The integration-settings keys that hold a credential — what a write from this addon names
-* as `secretKeys` so the hub moves them into the keychain.
-*/
-var HOME_CONNECT_SECRET_KEYS = [
-	"token",
-	"refresh",
-	APPLIANCE_SECRETS_KEY
-];
 /** One appliance as persisted in the integration's `appliances` setting: no credential on it. */
-var homeConnectApplianceRowSchema = require_dist.object({
-	haId: require_dist.string().min(1),
-	name: require_dist.string(),
-	type: require_dist.string(),
-	host: require_dist.string().min(1),
+var homeConnectApplianceRowSchema = require_bosch_instances.object({
+	haId: require_bosch_instances.string().min(1),
+	name: require_bosch_instances.string(),
+	type: require_bosch_instances.string(),
+	host: require_bosch_instances.string().min(1),
 	mode: HomeConnectModeSchema,
 	deviceDescription: homeConnectDeviceDescriptionSchema
 });
@@ -1042,28 +1033,28 @@ var homeConnectApplianceRowSchema = require_dist.object({
 * Read once, adopted into the keychain, then never written again.
 */
 var legacyApplianceRowSchema = homeConnectApplianceRowSchema.extend({
-	psk: require_dist.string().optional(),
-	iv64: require_dist.string().optional()
+	psk: require_bosch_instances.string().optional(),
+	iv64: require_bosch_instances.string().optional()
 });
 /** What the keychain holds per appliance. */
-var homeConnectApplianceSecretSchema = require_dist.object({
-	psk: require_dist.string().min(1),
-	iv64: require_dist.string().optional()
+var homeConnectApplianceSecretSchema = require_bosch_instances.object({
+	psk: require_bosch_instances.string().min(1),
+	iv64: require_bosch_instances.string().optional()
 });
 /** `applianceSecrets`: one string in the keychain, JSON of `haId -> { psk, iv64? }`. */
-var homeConnectApplianceSecretsSchema = require_dist.record(require_dist.string(), homeConnectApplianceSecretSchema);
+var homeConnectApplianceSecretsSchema = require_bosch_instances.record(require_bosch_instances.string(), homeConnectApplianceSecretSchema);
 /** One appliance in memory: its row and its credential together. */
 var homeConnectStoredApplianceSchema = homeConnectApplianceRowSchema.extend({
-	psk: require_dist.string().min(1),
-	iv64: require_dist.string().optional()
+	psk: require_bosch_instances.string().min(1),
+	iv64: require_bosch_instances.string().optional()
 });
 /** The integration is the Home Connect account. Profiles are downloaded once at sign-in. */
-var homeConnectConfigSchema = require_dist.object({
-	token: require_dist.string().min(1).describe("Home Connect access token").meta({ secret: true }),
-	refresh: require_dist.string().optional().describe("Home Connect refresh token").meta({ secret: true }),
-	appliances: require_dist.array(homeConnectStoredApplianceSchema).optional(),
+var homeConnectConfigSchema = require_bosch_instances.object({
+	token: require_bosch_instances.string().min(1).describe("Home Connect access token").meta({ secret: true }),
+	refresh: require_bosch_instances.string().optional().describe("Home Connect refresh token").meta({ secret: true }),
+	appliances: require_bosch_instances.array(homeConnectStoredApplianceSchema).optional(),
 	/** Shown on the sign-in field. The JWT subject, not a credential. */
-	accountLabel: require_dist.string().optional()
+	accountLabel: require_bosch_instances.string().optional()
 });
 function parseJsonValue(raw) {
 	if (typeof raw !== "string") return raw;
@@ -1086,7 +1077,7 @@ function legacyRowsOf(raw) {
 	return rows;
 }
 function readApplianceSecrets(raw) {
-	if (require_dist.isSecretMarker(raw) || require_dist.isSecretMarkerLike(raw)) return { kind: "unresolved" };
+	if (require_bosch_instances.isSecretMarker(raw) || require_bosch_instances.isSecretMarkerLike(raw)) return { kind: "unresolved" };
 	const value = parseJsonValue(raw);
 	if (value === void 0 || value === null) return { kind: "none" };
 	const parsed = homeConnectApplianceSecretsSchema.safeParse(value);
@@ -1128,7 +1119,7 @@ function splitApplianceSecrets(appliances) {
 	};
 }
 /**
-* Before `integrations.setSettings`: keep objects as-is (serializes as `json`), parse
+* Before the record write: keep objects as-is (serializes as `json`), parse
 * textarea JSON strings into objects so they are not re-serialized as `string` and
 * corrupted on read by `deserializeSetting(String(object))` — and move any credential
 * still sitting on an appliance row into `applianceSecrets`, so a row is never written
@@ -1185,29 +1176,6 @@ function moveInlineSecrets(settings) {
 		...Object.keys(merged).length > 0 ? { [APPLIANCE_SECRETS_KEY]: JSON.stringify(merged) } : {}
 	};
 }
-/**
-* One-time adopt: the settings that must be written so a pairing key found on an appliance
-* row moves into the keychain. `null` when nothing needs moving. The caller writes it with
-* {@link HOME_CONNECT_SECRET_KEYS} as `secretKeys`.
-*/
-function legacyApplianceSecretPatch(settings) {
-	const moved = moveInlineSecrets({
-		...settings,
-		appliances: parseJsonValue(settings["appliances"])
-	});
-	const rows = moved["appliances"];
-	const secrets = moved[APPLIANCE_SECRETS_KEY];
-	if (!Array.isArray(rows) || typeof secrets !== "string") return null;
-	const parsedRows = [];
-	for (const row of rows) {
-		const parsed = homeConnectApplianceRowSchema.safeParse(row);
-		if (parsed.success) parsedRows.push(parsed.data);
-	}
-	return {
-		appliances: parsedRows,
-		applianceSecrets: secrets
-	};
-}
 function connectionFromSettings(settings) {
 	const normalized = homeConnectSettingsForPersist(settings);
 	const rows = legacyRowsOf(normalized["appliances"]);
@@ -1238,7 +1206,7 @@ function hasNonEmptyString(settings, key) {
 function homeConnectSettingsGap(settings) {
 	if (connectionFromSettings(settings) !== null) return null;
 	const token = settings["token"];
-	if (require_dist.isSecretMarker(token) || require_dist.isSecretMarkerLike(token)) return "token-unresolved-marker";
+	if (require_bosch_instances.isSecretMarker(token) || require_bosch_instances.isSecretMarkerLike(token)) return "token-unresolved-marker";
 	if (!hasNonEmptyString(settings, "token")) return "token-missing";
 	return "schema-invalid";
 }
@@ -1250,7 +1218,7 @@ function logHomeConnectSettingsGap(logger, integrationId, settings) {
 	logger.warn("Home Connect integration has incomplete account settings — skipping", { meta: {
 		integrationId,
 		gap,
-		tokenIsSecretMarker: require_dist.isSecretMarker(token),
+		tokenIsSecretMarker: require_bosch_instances.isSecretMarker(token),
 		tokenType: typeof token,
 		hasToken: hasNonEmptyString(settings, "token"),
 		hasRefresh: hasNonEmptyString(settings, "refresh")
@@ -1478,7 +1446,7 @@ function homeConnectDishwasherEntityName(containerName) {
 	return base.length > 0 ? `Dishwasher ${base}` : "Dishwasher";
 }
 function deviceTypeForApplianceType(type) {
-	if (type.toLowerCase().includes("dishwasher")) return require_dist.DeviceType.Container;
+	if (type.toLowerCase().includes("dishwasher")) return require_bosch_instances.DeviceType.Container;
 	return null;
 }
 /**
@@ -1491,7 +1459,7 @@ function dishwasherContainerCandidate(app, adoptedId) {
 	const children = [{
 		childNativeId: `${app.haId}#dishwasher`,
 		name: homeConnectDishwasherEntityName(name),
-		type: require_dist.DeviceType.Dishwasher,
+		type: require_bosch_instances.DeviceType.Dishwasher,
 		status: "online",
 		metadata: {
 			serialNumber: app.haId,
@@ -1504,7 +1472,7 @@ function dishwasherContainerCandidate(app, adoptedId) {
 	return {
 		childNativeId: app.haId,
 		name,
-		type: require_dist.DeviceType.Container,
+		type: require_bosch_instances.DeviceType.Container,
 		status: "online",
 		metadata: {
 			serialNumber: app.haId,
@@ -1580,7 +1548,7 @@ function buildHomeConnectAdoptionProvider(deps) {
 					lastDiscoveryAt: null,
 					candidateCount: 0,
 					adoptedCount: 0,
-					lastError: require_dist.errMsg(err)
+					lastError: require_bosch_instances.errMsg(err)
 				};
 			}
 		},
@@ -1629,7 +1597,7 @@ function buildHomeConnectAdoptionProvider(deps) {
 				logger.warn("home-connect adopt failed", { meta: {
 					haId,
 					integrationId,
-					error: require_dist.errMsg(err)
+					error: require_bosch_instances.errMsg(err)
 				} });
 				failures++;
 			}
@@ -2403,7 +2371,7 @@ var HomeConnectSession = class {
 		this.#logger?.warn("Home Connect frame dropped — undecodable", {
 			tags: this.#logTags,
 			meta: {
-				error: require_dist.errMsg(err),
+				error: require_bosch_instances.errMsg(err),
 				droppedSoFar: n
 			}
 		});
@@ -2411,7 +2379,7 @@ var HomeConnectSession = class {
 	#warn(message, err) {
 		this.#logger?.warn(`Home Connect ${message}`, {
 			tags: this.#logTags,
-			meta: { error: require_dist.errMsg(err) }
+			meta: { error: require_bosch_instances.errMsg(err) }
 		});
 	}
 	#handleWireClosed() {
@@ -2523,7 +2491,7 @@ var HomeConnectSession = class {
 			} catch (err) {
 				clearTimeout(timer);
 				this.#pending.delete(outgoing.msgID);
-				reject(err instanceof Error ? err : new Error(require_dist.errMsg(err)));
+				reject(err instanceof Error ? err : new Error(require_bosch_instances.errMsg(err)));
 			}
 		});
 	}
@@ -2762,7 +2730,7 @@ function createProtocolHomeConnectClient(input) {
 					meta: {
 						haId,
 						attempt,
-						error: require_dist.errMsg(err)
+						error: require_bosch_instances.errMsg(err)
 					}
 				});
 				setLink("disconnected");
@@ -3171,7 +3139,7 @@ async function enrichHomeConnectConnection(connection, fetchImpl, hooks = {}) {
 		missing: []
 	};
 	const token = connection.token;
-	if (require_dist.isSecretMarker(token) || require_dist.isSecretMarkerLike(token)) return {
+	if (require_bosch_instances.isSecretMarker(token) || require_bosch_instances.isSecretMarkerLike(token)) return {
 		connection,
 		changed: false,
 		tokenRotated: false,
@@ -3180,7 +3148,7 @@ async function enrichHomeConnectConnection(connection, fetchImpl, hooks = {}) {
 	const refreshStored = connection.refresh ?? "";
 	const state = {
 		token,
-		refresh: require_dist.isSecretMarker(refreshStored) || require_dist.isSecretMarkerLike(refreshStored) ? "" : refreshStored,
+		refresh: require_bosch_instances.isSecretMarker(refreshStored) || require_bosch_instances.isSecretMarkerLike(refreshStored) ? "" : refreshStored,
 		rotated: false,
 		refreshTried: false
 	};
@@ -3199,7 +3167,7 @@ async function enrichHomeConnectConnection(connection, fetchImpl, hooks = {}) {
 		} catch (err) {
 			hooks.onWarn?.("Home Connect IDDF fetch failed", {
 				haId: row.haId,
-				error: require_dist.errMsg(err)
+				error: require_bosch_instances.errMsg(err)
 			});
 		}
 		if (result === null || !result.ok) {
@@ -3266,9 +3234,9 @@ async function openStoredOrAccount(connection, deps) {
 	let missing = [];
 	if ((working.appliances ?? []).length > 0) {
 		const token = working.token;
-		if (require_dist.isSecretMarker(token) || require_dist.isSecretMarkerLike(token)) deps.logger?.warn("Home Connect skipping IDDF enrich — access token not resolved yet", {
+		if (require_bosch_instances.isSecretMarker(token) || require_bosch_instances.isSecretMarkerLike(token)) deps.logger?.warn("Home Connect skipping IDDF enrich — access token not resolved yet", {
 			tags: { integrationId: deps.integrationId },
-			meta: { tokenIsSecretMarker: require_dist.isSecretMarker(token) }
+			meta: { tokenIsSecretMarker: require_bosch_instances.isSecretMarker(token) }
 		});
 		const enriched = await enrichHomeConnectConnection(working, deps.fetchImpl ?? homeConnectLoginFetch, enrichLogHooks(deps.logger, deps.integrationId));
 		working = enriched.connection;
@@ -3396,7 +3364,7 @@ var HomeConnectIntegrationManager = class {
 			this.#refreshStatus();
 			this.#scheduleIddfRetry();
 		} catch (err) {
-			this.#error = require_dist.errMsg(err);
+			this.#error = require_bosch_instances.errMsg(err);
 			this.#lastCheckedAt = Date.now();
 			this.#refreshStatus();
 			const appliances = client.getAppliances();
@@ -3472,7 +3440,7 @@ var HomeConnectIntegrationManager = class {
 							tags: { integrationId: this.#id },
 							meta: {
 								haId: row.haId,
-								error: require_dist.errMsg(err)
+								error: require_bosch_instances.errMsg(err)
 							}
 						});
 					});
@@ -3486,7 +3454,7 @@ var HomeConnectIntegrationManager = class {
 		} catch (err) {
 			this.#logger.warn("Home Connect IDDF retry failed", {
 				tags: { integrationId: this.#id },
-				meta: { error: require_dist.errMsg(err) }
+				meta: { error: require_bosch_instances.errMsg(err) }
 			});
 		}
 		this.#scheduleIddfRetry();
@@ -3507,7 +3475,7 @@ var HomeConnectIntegrationManager = class {
 		} catch (err) {
 			this.#logger.warn("HomeConnectIntegrationManager: client close failed", {
 				tags: { integrationId: this.#id },
-				meta: { error: require_dist.errMsg(err) }
+				meta: { error: require_bosch_instances.errMsg(err) }
 			});
 		}
 		this.#onDisconnected(this.#id);
@@ -3566,7 +3534,7 @@ var HomeConnectClientRegistry = class {
 			} catch (err) {
 				this.#logger.warn("HomeConnectClientRegistry: applyConnection failed", { meta: {
 					integrationId,
-					error: require_dist.errMsg(err)
+					error: require_bosch_instances.errMsg(err)
 				} });
 			}
 			return;
@@ -3592,7 +3560,7 @@ var HomeConnectClientRegistry = class {
 		} catch (err) {
 			this.#logger.warn("HomeConnectClientRegistry: manager start failed", { meta: {
 				integrationId,
-				error: require_dist.errMsg(err)
+				error: require_bosch_instances.errMsg(err)
 			} });
 		}
 	}
@@ -3605,7 +3573,7 @@ var HomeConnectClientRegistry = class {
 		} catch (err) {
 			this.#logger.warn("HomeConnectClientRegistry: remove stop failed", { meta: {
 				integrationId,
-				error: require_dist.errMsg(err)
+				error: require_bosch_instances.errMsg(err)
 			} });
 		}
 	}
@@ -3621,7 +3589,7 @@ var HomeConnectClientRegistry = class {
 			} catch (err) {
 				this.#logger.warn("HomeConnectClientRegistry: shutdown stop failed", { meta: {
 					integrationId: id,
-					error: require_dist.errMsg(err)
+					error: require_bosch_instances.errMsg(err)
 				} });
 			}
 		}));
@@ -3675,7 +3643,7 @@ function buildHomeConnectConnectionTestProvider(deps) {
 					detail: account.summary
 				};
 			} catch (err) {
-				const message = require_dist.errMsg(err);
+				const message = require_bosch_instances.errMsg(err);
 				if (message.includes("rejected")) return {
 					outcome: "rejected",
 					error: "Home Connect refused this account token. Sign in again."
@@ -3691,33 +3659,23 @@ function buildHomeConnectConnectionTestProvider(deps) {
 }
 //#endregion
 //#region src/home-connect/home-connect-connection-persist.ts
-function locked(value) {
-	return require_dist.isSecretMarker(value) || require_dist.isSecretMarkerLike(value);
-}
 /**
 * Persist what a connection learned at runtime — enriched IDDF entity maps and a rotated
-* access / refresh token — in ONE `setSettings` write. The tokens are named in `secretKeys`
-* so they land in the keychain, never on the plain blob. Writes nothing when a stored secret
-* cannot be read right now: the write would drop a key it cannot see or be refused. Never
-* throws and never logs a value.
+* access / refresh token — in ONE patch of the record. Writes nothing when the stored secrets
+* cannot be read right now: the patch would replace a key it cannot see. Never throws and
+* never logs a value.
 */
 function buildHomeConnectConnectionPersister(deps) {
 	return async (integrationId, connection) => {
 		if (!connection.appliances || connection.appliances.length === 0) return;
 		try {
-			const settings = await deps.getSettings(integrationId);
-			const stored = readApplianceSecrets(settings[APPLIANCE_SECRETS_KEY]);
-			const lockedTokens = ["token", "refresh"].filter((key) => locked(settings[key]));
-			if (stored.kind === "unresolved" || stored.kind === "invalid" || lockedTokens.length > 0) {
-				deps.logger.warn("Home Connect not persisting the connection — stored secrets are locked or unreadable", {
-					tags: { integrationId },
-					meta: {
-						applianceSecrets: stored.kind,
-						lockedTokens
-					}
-				});
+			const stored = await deps.read(integrationId);
+			if (stored === null) return;
+			if (stored.locked) {
+				deps.logger.warn("Home Connect not persisting the connection — stored secrets are locked or unreadable", { tags: { integrationId } });
 				return;
 			}
+			const settings = stored.settings;
 			const refresh = connection.refresh ?? "";
 			const merged = homeConnectSettingsForPersist({
 				...settings,
@@ -3725,15 +3683,16 @@ function buildHomeConnectConnectionPersister(deps) {
 				...refresh.length > 0 ? { refresh } : {},
 				appliances: mergeAppliancesForPersist(settings["appliances"], connection.appliances)
 			});
-			await deps.setSettings({
-				id: integrationId,
-				settings: merged,
-				secretKeys: [...HOME_CONNECT_SECRET_KEYS]
+			await deps.patch(integrationId, {
+				token: merged["token"],
+				...merged["refresh"] !== void 0 ? { refresh: merged["refresh"] } : {},
+				appliances: merged["appliances"],
+				...merged["applianceSecrets"] !== void 0 ? { [APPLIANCE_SECRETS_KEY]: merged[APPLIANCE_SECRETS_KEY] } : {}
 			});
 		} catch (err) {
 			deps.logger.warn("Home Connect failed to persist the connection", {
 				tags: { integrationId },
-				meta: { error: require_dist.errMsg(err) }
+				meta: { error: require_bosch_instances.errMsg(err) }
 			});
 		}
 	};
@@ -3850,7 +3809,7 @@ var OPERATION_TO_STATE = {
 	Error: "error"
 };
 function operationStateOf(raw) {
-	const parsed = require_dist.DishwasherOperationStateSchema.safeParse(raw);
+	const parsed = require_bosch_instances.DishwasherOperationStateSchema.safeParse(raw);
 	return parsed.success ? parsed.data : null;
 }
 /** The reported state of EVERY listed event the description has — each read on its own. */
@@ -4108,14 +4067,14 @@ function dishwasherConsumablesFromFeatures(view) {
 //#endregion
 //#region src/home-connect/home-connect-child-bindings.ts
 /** The capability a bound child registers. */
-var HomeConnectChildCapSchema = require_dist._enum([
+var HomeConnectChildCapSchema = require_bosch_instances._enum([
 	"numeric-sensor",
 	"power-meter",
 	"enum-sensor",
 	"binary"
 ]);
 /** How the raw value becomes the slice value. */
-var HomeConnectChildConvertSchema = require_dist._enum([
+var HomeConnectChildConvertSchema = require_bosch_instances._enum([
 	"none",
 	"energy-total-kwh",
 	"event-active"
@@ -4124,18 +4083,18 @@ var HomeConnectChildConvertSchema = require_dist._enum([
 * One appliance entity exposed as one child device. Persisted on the container, so a
 * child's identity (`stableIdSuffix`) survives restarts and description reloads.
 */
-var HomeConnectChildBindingSchema = require_dist.object({
+var HomeConnectChildBindingSchema = require_bosch_instances.object({
 	/** Stable, derived from the feature key — never from a uid, which differs per model. */
-	stableIdSuffix: require_dist.string().min(1),
+	stableIdSuffix: require_bosch_instances.string().min(1),
 	/** Feature key the child reads (`BSH.Common.Status.DoorState`, `HomeConnect.Network.rssi`). */
-	key: require_dist.string().min(1),
+	key: require_bosch_instances.string().min(1),
 	cap: HomeConnectChildCapSchema,
 	convert: HomeConnectChildConvertSchema,
-	role: require_dist._enum(require_dist.DeviceRole),
+	role: require_bosch_instances._enum(require_bosch_instances.DeviceRole),
 	/** Display name, without the appliance label. */
-	name: require_dist.string().min(1),
+	name: require_bosch_instances.string().min(1),
 	/** Unit of an info field the description does not declare (`dBm` for a signal strength). */
-	unit: require_dist.string().min(1).optional()
+	unit: require_bosch_instances.string().min(1).optional()
 });
 function slugFeatureKey(key) {
 	return key.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
@@ -4171,10 +4130,10 @@ function valueClassOf(entity, current) {
 	return null;
 }
 function roleFor(entity, cls, unit) {
-	if (cls === "enum") return require_dist.DeviceRole.EnumSensor;
-	if (cls === "binary") return entity.name.endsWith("Connected") ? require_dist.DeviceRole.ConnectivitySensor : require_dist.DeviceRole.BinarySensor;
-	if (unit === "°C" || unit === "°F") return require_dist.DeviceRole.TemperatureSensor;
-	return require_dist.DeviceRole.NumericSensor;
+	if (cls === "enum") return require_bosch_instances.DeviceRole.EnumSensor;
+	if (cls === "binary") return entity.name.endsWith("Connected") ? require_bosch_instances.DeviceRole.ConnectivitySensor : require_bosch_instances.DeviceRole.BinarySensor;
+	if (unit === "°C" || unit === "°F") return require_bosch_instances.DeviceRole.TemperatureSensor;
+	return require_bosch_instances.DeviceRole.NumericSensor;
 }
 function isCumulativeEnergy(entity) {
 	return featureShortName(entity.name) === "EnergyConsumption" && entity.name.includes(".Statistic.");
@@ -4216,7 +4175,7 @@ function bindingForEntity(entity, current) {
 		name: "Energy total",
 		cap: "power-meter",
 		convert: "energy-total-kwh",
-		role: require_dist.DeviceRole.EnergySensor
+		role: require_bosch_instances.DeviceRole.EnergySensor
 	};
 	return {
 		...base,
@@ -4244,7 +4203,7 @@ function bindingForInfo(key, current) {
 			...base,
 			cap: "numeric-sensor",
 			convert: "none",
-			role: require_dist.DeviceRole.NumericSensor,
+			role: require_bosch_instances.DeviceRole.NumericSensor,
 			...unit !== void 0 ? { unit } : {}
 		};
 	}
@@ -4252,13 +4211,13 @@ function bindingForInfo(key, current) {
 		...base,
 		cap: "binary",
 		convert: "none",
-		role: require_dist.DeviceRole.BinarySensor
+		role: require_bosch_instances.DeviceRole.BinarySensor
 	};
 	if (typeof current === "string") return {
 		...base,
 		cap: "enum-sensor",
 		convert: "none",
-		role: require_dist.DeviceRole.EnumSensor
+		role: require_bosch_instances.DeviceRole.EnumSensor
 	};
 	return null;
 }
@@ -4323,8 +4282,8 @@ function childSliceFromValue(input) {
 		case "numeric-sensor": {
 			if (typeof raw !== "number" || !Number.isFinite(raw)) return null;
 			const unit = input.entity === void 0 ? binding.unit ?? null : resolveUnit(input.entity);
-			const quantity = unit === null ? "none" : require_dist.quantityFromUnit(unit);
-			const stored = quantity === void 0 || quantity === "device" ? null : require_dist.ingestReading({
+			const quantity = unit === null ? "none" : require_bosch_instances.quantityFromUnit(unit);
+			const stored = quantity === void 0 || quantity === "device" ? null : require_bosch_instances.ingestReading({
 				value: raw,
 				rawUnit: unit ?? void 0,
 				quantity
@@ -4343,47 +4302,47 @@ var LEGACY_CHILD_KEYS = {
 	"energy-forecast": {
 		key: "BSH.Common.Option.EnergyForecast",
 		cap: "numeric-sensor",
-		role: require_dist.DeviceRole.NumericSensor
+		role: require_bosch_instances.DeviceRole.NumericSensor
 	},
 	"water-forecast": {
 		key: "BSH.Common.Option.WaterForecast",
 		cap: "numeric-sensor",
-		role: require_dist.DeviceRole.NumericSensor
+		role: require_bosch_instances.DeviceRole.NumericSensor
 	},
 	"energy-consumed": {
 		key: "BSH.Common.Option.EnergyConsumption",
 		cap: "numeric-sensor",
-		role: require_dist.DeviceRole.NumericSensor
+		role: require_bosch_instances.DeviceRole.NumericSensor
 	},
 	"water-consumed": {
 		key: "BSH.Common.Option.WaterConsumption",
 		cap: "numeric-sensor",
-		role: require_dist.DeviceRole.NumericSensor
+		role: require_bosch_instances.DeviceRole.NumericSensor
 	},
 	"remote-control-level": {
 		key: "BSH.Common.Setting.RemoteControlLevel",
 		cap: "enum-sensor",
-		role: require_dist.DeviceRole.EnumSensor
+		role: require_bosch_instances.DeviceRole.EnumSensor
 	},
 	"delayed-start": {
 		key: "BSH.Common.Option.StartInRelative",
 		cap: "numeric-sensor",
-		role: require_dist.DeviceRole.NumericSensor
+		role: require_bosch_instances.DeviceRole.NumericSensor
 	},
 	"interior-light": {
 		key: "BSH.Common.Setting.AmbientLightEnabled",
 		cap: "binary",
-		role: require_dist.DeviceRole.BinarySensor
+		role: require_bosch_instances.DeviceRole.BinarySensor
 	},
 	connectivity: {
 		key: "BSH.Common.Status.BackendConnected",
 		cap: "binary",
-		role: require_dist.DeviceRole.ConnectivitySensor
+		role: require_bosch_instances.DeviceRole.ConnectivitySensor
 	},
 	"program-phase": {
 		key: "Dishcare.Dishwasher.Status.ProgramPhase",
 		cap: "enum-sensor",
-		role: require_dist.DeviceRole.EnumSensor
+		role: require_bosch_instances.DeviceRole.EnumSensor
 	}
 };
 /**
@@ -4586,7 +4545,7 @@ var HomeConnectChildReconciler = class {
 		} catch (err) {
 			this.#deps.logger.warn("Home Connect child reconcile failed", {
 				tags: { deviceId },
-				meta: { error: require_dist.errMsg(err) }
+				meta: { error: require_bosch_instances.errMsg(err) }
 			});
 		}
 	}
@@ -4691,12 +4650,12 @@ function assertProgramOptions(description, program, options) {
 }
 //#endregion
 //#region src/home-connect/devices/home-connect-dishwasher-device.ts
-var homeConnectDishwasherSchema = require_dist.object({
-	haId: require_dist.string().min(1),
-	brokerId: require_dist.string().min(1),
-	applianceType: require_dist.string().optional(),
-	system: require_dist.literal("home-connect").optional(),
-	integrationId: require_dist.string().optional()
+var homeConnectDishwasherSchema = require_bosch_instances.object({
+	haId: require_bosch_instances.string().min(1),
+	brokerId: require_bosch_instances.string().min(1),
+	applianceType: require_bosch_instances.string().optional(),
+	system: require_bosch_instances.literal("home-connect").optional(),
+	integrationId: require_bosch_instances.string().optional()
 });
 var DISH_CAP = "dishwasher";
 var CONSUMABLES_CAP = "consumables";
@@ -4717,14 +4676,14 @@ var OPTION_NAMES = {
 	intensiveZone: ["IntensivZone", "IntensiveZone"],
 	varioSpeedPlus: ["VarioSpeedPlus", "VarioSpeed"]
 };
-var HomeConnectDishwasherDevice = class extends require_dist.BaseDevice {
+var HomeConnectDishwasherDevice = class extends require_bosch_instances.BaseDevice {
 	features = [];
 	#haId;
 	#brokerId;
 	#unwatch = null;
 	constructor(ctx) {
 		const persisted = homeConnectDishwasherSchema.parse(ctx.persistedConfig ?? {});
-		super(ctx, homeConnectDishwasherSchema, { type: require_dist.DeviceType.Dishwasher });
+		super(ctx, homeConnectDishwasherSchema, { type: require_bosch_instances.DeviceType.Dishwasher });
 		this.#haId = persisted.haId;
 		this.#brokerId = persisted.brokerId;
 		this.updateSourceInfo({
@@ -4738,7 +4697,7 @@ var HomeConnectDishwasherDevice = class extends require_dist.BaseDevice {
 		this.registerConsumablesCap();
 		this.registerRunningCap();
 		this.runtimeState.setCapState(DISH_CAP, COLD_DISHWASHER_STATUS);
-		this.runtimeState.setCapState(RUNNING_CAP, require_dist.RUNNING_STATE_COLD);
+		this.runtimeState.setCapState(RUNNING_CAP, require_bosch_instances.RUNNING_STATE_COLD);
 		this.markOnline(false);
 		this.#unwatch = homeConnectConnections.watch(this.#brokerId, this.#haId, (event) => this.recomputeSlice(event));
 		this.recomputeSlice({ kind: "client" });
@@ -4791,7 +4750,7 @@ var HomeConnectDishwasherDevice = class extends require_dist.BaseDevice {
 		this.runtimeState.setCapState(CONSUMABLES_CAP, next);
 	}
 	registerConsumablesCap() {
-		this.ctx.registerNativeCap(require_dist.consumablesCapability, {
+		this.ctx.registerNativeCap(require_bosch_instances.consumablesCapability, {
 			getStatus: async () => this.runtimeState.getCapState(CONSUMABLES_CAP) ?? CONSUMABLES_EMPTY,
 			reset: async ({ key }) => {
 				throw new Error(`"${key}" has no reset on a dishwasher — refilling it is the reset`);
@@ -4828,13 +4787,13 @@ var HomeConnectDishwasherDevice = class extends require_dist.BaseDevice {
 		} catch (err) {
 			this.ctx.logger.warn(`Home Connect ${what} failed`, {
 				tags: { deviceId: this.id },
-				meta: { error: require_dist.errMsg(err) }
+				meta: { error: require_bosch_instances.errMsg(err) }
 			});
 			throw err;
 		}
 	}
 	registerDishwasherCap() {
-		this.ctx.registerNativeCap(require_dist.dishwasherCapability, {
+		this.ctx.registerNativeCap(require_bosch_instances.dishwasherCapability, {
 			getStatus: async () => this.runtimeState.getCapState(DISH_CAP) ?? COLD_DISHWASHER_STATUS,
 			getOptions: async () => dishwasherOptionsFromDescription(this.view()),
 			start: async ({ program, options }) => {
@@ -4872,22 +4831,22 @@ var HomeConnectDishwasherDevice = class extends require_dist.BaseDevice {
 		});
 	}
 	registerRunningCap() {
-		this.ctx.registerNativeCap(require_dist.runningStateCapability, { getStatus: async () => this.runtimeState.getCapState(RUNNING_CAP) ?? require_dist.RUNNING_STATE_COLD });
+		this.ctx.registerNativeCap(require_bosch_instances.runningStateCapability, { getStatus: async () => this.runtimeState.getCapState(RUNNING_CAP) ?? require_bosch_instances.RUNNING_STATE_COLD });
 	}
 	publishRunningSlice(slice) {
 		const fetchedAt = Date.now();
 		const previous = this.runtimeState.getCapState(RUNNING_CAP);
-		const next = require_dist.runningFromDishwasherOperation(slice.operationState, slice.program, previous, fetchedAt, slice.remaining);
+		const next = require_bosch_instances.runningFromDishwasherOperation(slice.operationState, slice.program, previous, fetchedAt, slice.remaining);
 		this.runtimeState.setCapState(RUNNING_CAP, next);
 	}
 };
 //#endregion
 //#region src/home-connect/devices/home-connect-event-device.ts
-var homeConnectEventSchema = require_dist.object({
-	haId: require_dist.string().min(1),
-	brokerId: require_dist.string().min(1),
-	system: require_dist.literal("home-connect").optional(),
-	integrationId: require_dist.string().optional()
+var homeConnectEventSchema = require_bosch_instances.object({
+	haId: require_bosch_instances.string().min(1),
+	brokerId: require_bosch_instances.string().min(1),
+	system: require_bosch_instances.literal("home-connect").optional(),
+	integrationId: require_bosch_instances.string().optional()
 });
 var EVENT_CAP = "event-emitter";
 /**
@@ -4898,7 +4857,7 @@ var EVENT_CAP = "event-emitter";
 * A value seen while the link is still being established (the handshake's initial values)
 * is the baseline, not a new event: a reconnect must not announce "program finished" again.
 */
-var HomeConnectEventDevice = class extends require_dist.BaseDevice {
+var HomeConnectEventDevice = class extends require_bosch_instances.BaseDevice {
 	features = [];
 	#haId;
 	#brokerId;
@@ -4908,7 +4867,7 @@ var HomeConnectEventDevice = class extends require_dist.BaseDevice {
 	#unwatch = null;
 	constructor(ctx) {
 		const persisted = homeConnectEventSchema.parse(ctx.persistedConfig ?? {});
-		super(ctx, homeConnectEventSchema, { type: require_dist.DeviceType.EventEmitter });
+		super(ctx, homeConnectEventSchema, { type: require_bosch_instances.DeviceType.EventEmitter });
 		this.#haId = persisted.haId;
 		this.#brokerId = persisted.brokerId;
 		this.updateSourceInfo({
@@ -4977,7 +4936,7 @@ var HomeConnectEventDevice = class extends require_dist.BaseDevice {
 			timestamp: Date.now(),
 			seq: ++this.#seq
 		};
-		this.ctx.eventBus.emit(require_dist.createEvent(require_dist.EventCategory.EventEmitted, {
+		this.ctx.eventBus.emit(require_bosch_instances.createEvent(require_bosch_instances.EventCategory.EventEmitted, {
 			type: "device",
 			id: this.stableId,
 			deviceId: this.id,
@@ -4986,7 +4945,7 @@ var HomeConnectEventDevice = class extends require_dist.BaseDevice {
 		this.publish(types, previous, fire);
 	}
 	registerCap() {
-		this.ctx.registerNativeCap(require_dist.eventEmitterCapability, { getStatus: async () => this.runtimeState.getCapState(EVENT_CAP) ?? {
+		this.ctx.registerNativeCap(require_bosch_instances.eventEmitterCapability, { getStatus: async () => this.runtimeState.getCapState(EVENT_CAP) ?? {
 			eventTypes: [],
 			lastEvent: null,
 			eventCountSinceStart: 0
@@ -4995,18 +4954,18 @@ var HomeConnectEventDevice = class extends require_dist.BaseDevice {
 };
 //#endregion
 //#region src/home-connect/devices/home-connect-sensor-device.ts
-var homeConnectSensorSchema = require_dist.object({
-	haId: require_dist.string().min(1),
-	brokerId: require_dist.string().min(1),
+var homeConnectSensorSchema = require_bosch_instances.object({
+	haId: require_bosch_instances.string().min(1),
+	brokerId: require_bosch_instances.string().min(1),
 	/**
 	* The entity this child reads. Absent on a child persisted by the fixed-catalog build,
 	* which wrote `sensorKind` instead — see {@link resolveSensorBinding}.
 	*/
 	binding: HomeConnectChildBindingSchema.optional(),
 	/** Fixed-catalog children only: the old kind, which is also their stable suffix. */
-	sensorKind: require_dist.string().min(1).optional(),
-	system: require_dist.literal("home-connect").optional(),
-	integrationId: require_dist.string().optional()
+	sensorKind: require_bosch_instances.string().min(1).optional(),
+	system: require_bosch_instances.literal("home-connect").optional(),
+	integrationId: require_bosch_instances.string().optional()
 });
 /**
 * The binding of a persisted child row. A restored child's config is the row the KERNEL
@@ -5045,7 +5004,7 @@ var NEVER_BINARY = {
 * entity it reads is its `binding.key` — one key, never "the first of several that
 * happens to be present".
 */
-var HomeConnectSensorDevice = class extends require_dist.BaseDevice {
+var HomeConnectSensorDevice = class extends require_bosch_instances.BaseDevice {
 	features = [];
 	#haId;
 	#brokerId;
@@ -5111,32 +5070,32 @@ var HomeConnectSensorDevice = class extends require_dist.BaseDevice {
 	registerCap() {
 		switch (this.#binding.cap) {
 			case "numeric-sensor":
-				this.ctx.registerNativeCap(require_dist.numericSensorCapability, { getStatus: async () => this.runtimeState.getCapState("numeric-sensor") ?? NEVER_NUMERIC });
+				this.ctx.registerNativeCap(require_bosch_instances.numericSensorCapability, { getStatus: async () => this.runtimeState.getCapState("numeric-sensor") ?? NEVER_NUMERIC });
 				return;
 			case "power-meter":
-				this.ctx.registerNativeCap(require_dist.powerMeterCapability, { getStatus: async () => this.runtimeState.getCapState("power-meter") ?? NEVER_POWER });
+				this.ctx.registerNativeCap(require_bosch_instances.powerMeterCapability, { getStatus: async () => this.runtimeState.getCapState("power-meter") ?? NEVER_POWER });
 				return;
 			case "enum-sensor":
-				this.ctx.registerNativeCap(require_dist.enumSensorCapability, { getStatus: async () => this.runtimeState.getCapState("enum-sensor") ?? NEVER_ENUM });
+				this.ctx.registerNativeCap(require_bosch_instances.enumSensorCapability, { getStatus: async () => this.runtimeState.getCapState("enum-sensor") ?? NEVER_ENUM });
 				return;
 			case "binary":
-				this.ctx.registerNativeCap(require_dist.binaryCapability, { getStatus: async () => this.runtimeState.getCapState("binary") ?? NEVER_BINARY });
+				this.ctx.registerNativeCap(require_bosch_instances.binaryCapability, { getStatus: async () => this.runtimeState.getCapState("binary") ?? NEVER_BINARY });
 				return;
 		}
 	}
 };
 //#endregion
 //#region src/home-connect/devices/home-connect-appliance-device.ts
-var homeConnectApplianceSchema = require_dist.object({
-	haId: require_dist.string().min(1),
-	brokerId: require_dist.string().min(1),
-	applianceType: require_dist.string().optional(),
+var homeConnectApplianceSchema = require_bosch_instances.object({
+	haId: require_bosch_instances.string().min(1),
+	brokerId: require_bosch_instances.string().min(1),
+	applianceType: require_bosch_instances.string().optional(),
 	/** One entry per appliance entity exposed as a child, maintained from the appliance's description. */
-	entities: require_dist.array(require_dist.unknown()).optional(),
+	entities: require_bosch_instances.array(require_bosch_instances.unknown()).optional(),
 	/** Children persisted before the description-derived model; read only to keep them alive. */
-	children: require_dist.array(require_dist.unknown()).optional(),
-	system: require_dist.literal("home-connect").optional(),
-	integrationId: require_dist.string().optional()
+	children: require_bosch_instances.array(require_bosch_instances.unknown()).optional(),
+	system: require_bosch_instances.literal("home-connect").optional(),
+	integrationId: require_bosch_instances.string().optional()
 });
 /** Device metadata keys the `/ci/info` fields map onto (the conventional `DeviceMetadata` keys). */
 var INFO_TO_METADATA = {
@@ -5151,7 +5110,7 @@ var INFO_TO_METADATA = {
 	mac: "mac"
 };
 /** One Home Connect appliance as a container: the dishwasher, an event emitter, and one child per entity. */
-var HomeConnectApplianceDevice = class extends require_dist.BaseDevice {
+var HomeConnectApplianceDevice = class extends require_bosch_instances.BaseDevice {
 	features = [];
 	integrationId;
 	brokerId;
@@ -5161,7 +5120,7 @@ var HomeConnectApplianceDevice = class extends require_dist.BaseDevice {
 	#lastInfo = "";
 	constructor(ctx) {
 		const cfg = homeConnectApplianceSchema.parse(ctx.persistedConfig ?? {});
-		super(ctx, homeConnectApplianceSchema, { type: require_dist.DeviceType.Container });
+		super(ctx, homeConnectApplianceSchema, { type: require_bosch_instances.DeviceType.Container });
 		this.brokerId = cfg.brokerId;
 		this.haId = cfg.haId;
 		this.integrationId = cfg.integrationId;
@@ -5208,7 +5167,7 @@ var HomeConnectApplianceDevice = class extends require_dist.BaseDevice {
 		} catch (err) {
 			this.ctx.logger.warn("Home Connect could not publish the appliance info", {
 				tags: { deviceId: this.id },
-				meta: { error: require_dist.errMsg(err) }
+				meta: { error: require_bosch_instances.errMsg(err) }
 			});
 		}
 	}
@@ -5226,7 +5185,7 @@ var HomeConnectApplianceDevice = class extends require_dist.BaseDevice {
 		const out = [{
 			stableIdSuffix: "dishwasher",
 			meta: {
-				type: require_dist.DeviceType.Dishwasher,
+				type: require_bosch_instances.DeviceType.Dishwasher,
 				name: homeConnectDishwasherEntityName(containerName),
 				linkDeviceId: this.id,
 				...integration
@@ -5240,7 +5199,7 @@ var HomeConnectApplianceDevice = class extends require_dist.BaseDevice {
 		if (bindings.some((b) => b.convert === "event-active")) out.push({
 			stableIdSuffix: "events",
 			meta: {
-				type: require_dist.DeviceType.EventEmitter,
+				type: require_bosch_instances.DeviceType.EventEmitter,
 				name: `${containerName} — Events`,
 				linkDeviceId: this.id,
 				...integration
@@ -5251,7 +5210,7 @@ var HomeConnectApplianceDevice = class extends require_dist.BaseDevice {
 		for (const binding of bindings) out.push({
 			stableIdSuffix: binding.stableIdSuffix,
 			meta: {
-				type: require_dist.DeviceType.Sensor,
+				type: require_bosch_instances.DeviceType.Sensor,
 				role: binding.role,
 				name: `${containerName} — ${binding.name}`,
 				linkDeviceId: this.id,
@@ -5266,57 +5225,151 @@ var HomeConnectApplianceDevice = class extends require_dist.BaseDevice {
 		return out;
 	}
 };
-//#endregion
-//#region src/home-connect/home-connect-secret-adopt.ts
+var homeConnectConnectionsEntryKind = require_bosch_instances.defineEntryKind("connections", {
+	title: "Home Connect accounts",
+	schema: require_bosch_instances.entryBody({
+		token: require_bosch_instances.string().optional().meta({ secret: true }),
+		refresh: require_bosch_instances.string().optional().meta({ secret: true }),
+		/** JSON of `haId -> { psk, iv64? }`: one string in the keychain. */
+		applianceSecrets: require_bosch_instances.string().optional().meta({ secret: true }),
+		appliances: require_bosch_instances.array(homeConnectApplianceRowSchema).optional(),
+		accountLabel: require_bosch_instances.string().optional()
+	}),
+	writeTrigger: "an operator signs in, edits or removes a Home Connect account, or a connection stores what it learned",
+	maxDataBytes: 1024 * 1024
+});
+/** Every kind this addon declares, keyed by its name. */
+var homeConnectRecordKinds = { connections: homeConnectConnectionsEntryKind };
+var LEGACY_KEYS = [
+	"token",
+	"refresh",
+	APPLIANCE_SECRETS_KEY,
+	"appliances",
+	"accountLabel",
+	"accountEmail",
+	"accountPassword",
+	"authorizeUrl",
+	"verifier",
+	"callback",
+	"state"
+];
+var SECRET_KEYS = [
+	"token",
+	"refresh",
+	APPLIANCE_SECRETS_KEY
+];
+/** The `appliances` row value as an array: a JSON string is parsed, anything else is as stored. */
+function parseStoredRows(raw) {
+	if (typeof raw !== "string") return raw;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return;
+	}
+}
+function text(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
 /**
-* One-time adopt: an integration saved before the keychain move carries each appliance's
-* pairing key (`psk`, `iv64`) on its row, in clear text. Plan the move into `applianceSecrets`
-* (keychain), with the rows stripped.
-*
-* `null` when there is nothing to move — settings already migrated, or the stored keys are
-* locked (the move could not see what it would replace). Idempotent.
+* The record body of one account, from its legacy rows (secrets resolved). A pairing key still
+* sitting on an appliance row (the shape before the keychain move) is carried into
+* `applianceSecrets` here, once, and never again.
 */
-function planLegacyApplianceSecretAdopt(deps, integrationId, settings) {
-	const patch = legacyApplianceSecretPatch(settings);
-	if (patch === null) return null;
-	const next = {
-		...settings,
-		...patch
+function homeConnectBodyFromRows(values, log, integration) {
+	const dropped = Object.keys(values).filter((key) => !LEGACY_KEYS.includes(key));
+	if (dropped.length > 0) log.warn(`integration '${integration.id}': legacy settings nothing reads any more are dropped: ${dropped.join(", ")}`);
+	const normalized = homeConnectSettingsForPersist({ ...values });
+	const storedRows = parseStoredRows(values["appliances"]);
+	if (Array.isArray(storedRows)) for (const row of storedRows) {
+		const parsed = homeConnectApplianceRowSchema.safeParse(row);
+		if (parsed.success) continue;
+		const haId = typeof row === "object" && row !== null && typeof Reflect.get(row, "haId") === "string" ? String(Reflect.get(row, "haId")) : "(no haId)";
+		const paths = parsed.error.issues.map((issue) => issue.path.join(".") || "(row)").join(", ");
+		log.warn(`integration '${integration.id}': appliance row '${haId}' could not be read and is dropped (invalid: ${paths})`);
+	}
+	const appliances = [];
+	const keptRows = normalized["appliances"];
+	if (Array.isArray(keptRows)) for (const row of keptRows) {
+		const parsed = homeConnectApplianceRowSchema.safeParse(row);
+		if (parsed.success) appliances.push(parsed.data);
+	}
+	const token = text(normalized["token"]);
+	const refresh = text(normalized["refresh"]);
+	const applianceSecrets = text(normalized[APPLIANCE_SECRETS_KEY]);
+	const accountLabel = text(normalized["accountLabel"]);
+	return {
+		name: integration.name,
+		...token !== void 0 ? { token } : {},
+		...refresh !== void 0 ? { refresh } : {},
+		...applianceSecrets !== void 0 ? { applianceSecrets } : {},
+		...appliances.length > 0 ? { appliances } : {},
+		...accountLabel !== void 0 ? { accountLabel } : {}
 	};
+}
+/** The whole `bosch-home-connect` catalogue (D987): offered to the engine at `onInitialize`. */
+var HOME_CONNECT_MIGRATIONS = [require_bosch_instances.boschRowsMigration({
+	addonId: "bosch-home-connect",
+	id: "bosch-home-connect/2026-11-05-integration-rows-to-record",
+	description: "Move every Home Connect account into a typed instance record keyed by its registry id (pairing keys still on an appliance row go to the appliance secrets), then clear the legacy integration settings rows and their keychain values",
+	fixtureMark: "a legacy setting key the migration does not know",
+	kind: homeConnectConnectionsEntryKind,
+	bodyFrom: homeConnectBodyFromRows
+})];
+function homeConnectRowsPorts(deps) {
+	return require_bosch_instances.boschRowsPorts({
+		...deps,
+		kind: homeConnectConnectionsEntryKind
+	});
+}
+async function homeConnectStoredOf(instances, id) {
+	const read = await instances.readResolved(id);
+	if (read === null) return null;
 	return {
-		settings: next,
-		persist: async () => {
-			try {
-				await deps.setSettings({
-					id: integrationId,
-					settings: next,
-					secretKeys: [...HOME_CONNECT_SECRET_KEYS]
-				});
-				deps.logger.info("Home Connect moved the appliance pairing keys into the keychain", {
-					tags: { integrationId },
-					meta: { appliances: patch.appliances.length }
-				});
-			} catch (err) {
-				deps.logger.warn("Home Connect could not move the appliance pairing keys into the keychain", {
-					tags: { integrationId },
-					meta: { error: require_dist.errMsg(err) }
-				});
-			}
-		}
+		settings: { ...read.body },
+		locked: read.secrets === "unavailable"
+	};
+}
+function buildHomeConnectInstances(records, deps) {
+	const handle = records.kind(homeConnectConnectionsEntryKind);
+	const instances = new require_bosch_instances.RecordIntegrationInstances(records, homeConnectConnectionsEntryKind, {
+		description: {
+			role: "devices",
+			instanceMode: "multiple",
+			kind: "account",
+			canTest: true
+		},
+		formSchema: () => buildHomeConnectFormSchema(),
+		initialBody: (name) => ({ name }),
+		configured: (body) => connectionFromSettings(body) !== null,
+		onChanged: async (_id, change) => {
+			if (change !== "deleted") await deps.onChanged();
+		},
+		test: (input) => require_bosch_instances.testBoschInstance({
+			...input,
+			tester: deps.tester,
+			handle,
+			secretKeys: SECRET_KEYS
+		})
+	});
+	return {
+		instances,
+		handle,
+		provider: require_bosch_instances.keepBodyKeys(instances.toProvider(), new Set(Object.keys(homeConnectConnectionsEntryKind.schema.shape)))
 	};
 }
 //#endregion
 //#region src/home-connect/addon.ts
-var BoschHomeConnectProviderAddon = class extends require_dist.BaseDeviceProvider {
+var BoschHomeConnectProviderAddon = class extends require_bosch_instances.BaseDeviceProvider {
 	addonId = "bosch-home-connect";
 	providerName = "Bosch Home Connect";
 	deviceClasses = {
-		[require_dist.DeviceType.Container]: HomeConnectApplianceDevice,
-		[require_dist.DeviceType.Dishwasher]: HomeConnectDishwasherDevice,
-		[require_dist.DeviceType.Sensor]: HomeConnectSensorDevice,
-		[require_dist.DeviceType.EventEmitter]: HomeConnectEventDevice
+		[require_bosch_instances.DeviceType.Container]: HomeConnectApplianceDevice,
+		[require_bosch_instances.DeviceType.Dishwasher]: HomeConnectDishwasherDevice,
+		[require_bosch_instances.DeviceType.Sensor]: HomeConnectSensorDevice,
+		[require_bosch_instances.DeviceType.EventEmitter]: HomeConnectEventDevice
 	};
 	clients = null;
+	instances = null;
 	reconciler = null;
 	loginProxy = null;
 	loginPlane = null;
@@ -5325,6 +5378,19 @@ var BoschHomeConnectProviderAddon = class extends require_dist.BaseDeviceProvide
 	}
 	async onInitialize() {
 		const regs = this.providerRegistrationsFromSuper(await super.onInitialize());
+		const records = this.ctx.records;
+		if (records === void 0) throw new Error("bosch-home-connect: ctx.records is required (hub-only addon)");
+		await records.declare(homeConnectRecordKinds);
+		await this.runMigrations(require_bosch_instances.defineAddonMigrations(HOME_CONNECT_MIGRATIONS, homeConnectRowsPorts({
+			api: require_bosch_instances.defaultIntegrationApiOver(this.ctx.api),
+			records,
+			warn: (message) => this.ctx.logger.warn(message)
+		})));
+		const built = buildHomeConnectInstances(records, {
+			onChanged: () => this.reconcileIntegrations(),
+			tester: this.buildConnectionTestProvider()
+		});
+		this.instances = built;
 		await this.serveLoginProxy();
 		this.clients = new HomeConnectClientRegistry(this.ctx.logger, { onConnectionUpdated: (integrationId, connection) => {
 			this.persistIntegrationAppliances(integrationId, connection);
@@ -5344,12 +5410,16 @@ var BoschHomeConnectProviderAddon = class extends require_dist.BaseDeviceProvide
 			providers: [
 				...regs,
 				{
-					capability: require_dist.deviceAdoptionCapability,
+					capability: require_bosch_instances.deviceAdoptionCapability,
 					provider: this.buildAdoptionProvider()
 				},
 				{
-					capability: require_dist.connectionTestCapability,
+					capability: require_bosch_instances.connectionTestCapability,
 					provider: this.buildConnectionTestProvider()
+				},
+				{
+					capability: require_bosch_instances.integrationInstancesCapability,
+					provider: built.provider
 				}
 			],
 			customActions: homeConnectActions,
@@ -5382,7 +5452,7 @@ var BoschHomeConnectProviderAddon = class extends require_dist.BaseDeviceProvide
 	}
 	/** The hub's HTTPS face for the vendor's login pages (D955): admin session only. */
 	async serveLoginProxy() {
-		const proxy = new require_dist.VendorLoginProxy({
+		const proxy = new require_bosch_instances.VendorLoginProxy({
 			addonId: this.ctx.id,
 			logger: this.ctx.logger
 		});
@@ -5394,7 +5464,7 @@ var BoschHomeConnectProviderAddon = class extends require_dist.BaseDeviceProvide
 			}) ?? null;
 			if (this.loginPlane !== null) this.loginProxy = proxy;
 		} catch (err) {
-			this.ctx.logger.warn("Home Connect login proxy failed to serve — sign-in falls back to paste", { meta: { error: require_dist.errMsg(err) } });
+			this.ctx.logger.warn("Home Connect login proxy failed to serve — sign-in falls back to paste", { meta: { error: require_bosch_instances.errMsg(err) } });
 		}
 	}
 	async onShutdown() {
@@ -5406,9 +5476,10 @@ var BoschHomeConnectProviderAddon = class extends require_dist.BaseDeviceProvide
 		try {
 			await this.clients?.shutdown();
 		} catch (err) {
-			this.ctx.logger.warn("Home Connect shutdown error", { meta: { error: require_dist.errMsg(err) } });
+			this.ctx.logger.warn("Home Connect shutdown error", { meta: { error: require_bosch_instances.errMsg(err) } });
 		}
 		this.clients = null;
+		this.instances = null;
 		await super.onShutdown();
 	}
 	requireClients() {
@@ -5420,14 +5491,14 @@ var BoschHomeConnectProviderAddon = class extends require_dist.BaseDeviceProvide
 		if (typeof integrationId !== "string" || integrationId.length === 0) throw new Error("home-connect generateStableId: brokerId required");
 		const haId = config?.["haId"];
 		if (typeof haId !== "string" || haId.length === 0) throw new Error("home-connect generateStableId: haId required");
-		if (type === require_dist.DeviceType.Container) return `home-connect:${integrationId}:${haId}:appliance`;
+		if (type === require_bosch_instances.DeviceType.Container) return `home-connect:${integrationId}:${haId}:appliance`;
 		return `home-connect:${integrationId}:${haId}`;
 	}
 	/** Enriched IDDF maps and a rotated token pair, in one keychain-aware write. */
 	persistIntegrationAppliances(integrationId, connection) {
 		return buildHomeConnectConnectionPersister({
-			getSettings: (id) => this.ctx.api.integrations.getSettings.query({ id }),
-			setSettings: (input) => this.ctx.api.integrations.setSettings.mutate(input),
+			read: (id) => homeConnectStoredOf(this.requireInstances().instances, id),
+			patch: (id, patch) => this.requireInstances().handle.patch(id, patch),
 			logger: this.ctx.logger
 		})(integrationId, connection);
 	}
@@ -5436,15 +5507,14 @@ var BoschHomeConnectProviderAddon = class extends require_dist.BaseDeviceProvide
 		try {
 			const mine = (await this.ctx.api.integrations.list.query()).filter((i) => i.addonId === this.ctx.id && i.enabled);
 			const surviving = /* @__PURE__ */ new Set();
-			const secretMoves = [];
 			for (const integration of mine) try {
-				const stored = await this.ctx.api.integrations.getSettings.query({ id: integration.id });
-				const adopt = planLegacyApplianceSecretAdopt({
-					setSettings: (input) => this.ctx.api.integrations.setSettings.mutate(input),
-					logger: this.ctx.logger
-				}, integration.id, stored);
-				if (adopt !== null) secretMoves.push(adopt);
-				const settings = adopt?.settings ?? stored;
+				const stored = await homeConnectStoredOf(this.requireInstances().instances, integration.id);
+				if (stored === null) continue;
+				if (stored.locked) {
+					this.ctx.logger.warn("Home Connect reconcile skipped: the keychain is locked", { meta: { integrationId: integration.id } });
+					continue;
+				}
+				const settings = stored.settings;
 				const connection = connectionFromSettings(settings);
 				if (!connection) {
 					logHomeConnectSettingsGap(this.ctx.logger, integration.id, settings);
@@ -5465,10 +5535,9 @@ var BoschHomeConnectProviderAddon = class extends require_dist.BaseDeviceProvide
 			} catch (err) {
 				this.ctx.logger.warn("Home Connect reconcile failed for integration", { meta: {
 					integrationId: integration.id,
-					error: require_dist.errMsg(err)
+					error: require_bosch_instances.errMsg(err)
 				} });
 			}
-			for (const move of secretMoves) move.persist();
 			const vanished = reg.list().filter((id) => !surviving.has(id));
 			await reg.retain(surviving);
 			const deviceReg = this.ctx.kernel.deviceRegistry;
@@ -5482,7 +5551,7 @@ var BoschHomeConnectProviderAddon = class extends require_dist.BaseDeviceProvide
 				logger: this.ctx.logger
 			});
 		} catch (err) {
-			this.ctx.logger.warn("Home Connect integration reconcile failed", { meta: { error: require_dist.errMsg(err) } });
+			this.ctx.logger.warn("Home Connect integration reconcile failed", { meta: { error: require_bosch_instances.errMsg(err) } });
 		}
 	}
 	subscribeIntegrationLifecycle() {
@@ -5491,9 +5560,9 @@ var BoschHomeConnectProviderAddon = class extends require_dist.BaseDeviceProvide
 			if (typeof addonId === "string" && addonId !== this.ctx.id) return;
 			this.reconcileIntegrations();
 		};
-		this.ctx.eventBus.subscribe({ category: require_dist.EventCategory.IntegrationEnabled }, handler);
-		this.ctx.eventBus.subscribe({ category: require_dist.EventCategory.IntegrationDisabled }, handler);
-		this.ctx.eventBus.subscribe({ category: require_dist.EventCategory.IntegrationDeleted }, handler);
+		this.ctx.eventBus.subscribe({ category: require_bosch_instances.EventCategory.IntegrationEnabled }, handler);
+		this.ctx.eventBus.subscribe({ category: require_bosch_instances.EventCategory.IntegrationDisabled }, handler);
+		this.ctx.eventBus.subscribe({ category: require_bosch_instances.EventCategory.IntegrationDeleted }, handler);
 	}
 	buildConnectionTestProvider() {
 		return buildHomeConnectConnectionTestProvider({ logger: this.ctx.logger });
@@ -5520,7 +5589,7 @@ var BoschHomeConnectProviderAddon = class extends require_dist.BaseDeviceProvide
 			adoptDevice: async ({ haId, integrationId, type, name, applianceType }) => {
 				const devices = this.ctx.kernel.devices;
 				if (!devices) throw new Error("home-connect adopt: devices unavailable");
-				if (type !== require_dist.DeviceType.Container) throw new Error(`home-connect adopt: expected Container, got ${type}`);
+				if (type !== require_bosch_instances.DeviceType.Container) throw new Error(`home-connect adopt: expected Container, got ${type}`);
 				const config = {
 					haId,
 					brokerId: integrationId,
@@ -5531,7 +5600,7 @@ var BoschHomeConnectProviderAddon = class extends require_dist.BaseDeviceProvide
 				};
 				const stableId = this.generateStableId(type, config);
 				const device = await devices.create(stableId, HomeConnectApplianceDevice, config, null, {
-					type: require_dist.DeviceType.Container,
+					type: require_bosch_instances.DeviceType.Container,
 					name,
 					integrationId
 				});
@@ -5596,9 +5665,6 @@ var BoschHomeConnectProviderAddon = class extends require_dist.BaseDeviceProvide
 			logger: this.ctx.logger
 		}, trigger);
 	}
-	globalSettingsSchema() {
-		return buildHomeConnectFormSchema();
-	}
 	async supportsManualCreation() {
 		return false;
 	}
@@ -5608,6 +5674,10 @@ var BoschHomeConnectProviderAddon = class extends require_dist.BaseDeviceProvide
 	async onCreateDevice(_type, _config) {
 		throw new Error("Home Connect devices are adopted from the gateway");
 	}
+	requireInstances() {
+		if (!this.instances) throw new Error("Home Connect provider not initialised");
+		return this.instances;
+	}
 	setIntegrationDevicesOnline(integrationId, online) {
 		const reg = this.ctx.kernel.deviceRegistry;
 		if (!reg) return;