@camstack/addon-provider-bosch 0.1.36 → 0.1.37

package/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.37] - 2026-11-05
+
+### Changed
+
+- Copying an integration into its record reads the leftover rows through the migration-only door and resolves their secrets in this addon
+
 ## [0.1.36] - 2026-11-04
 
 ### Changed

package/dist/{account-integration-offline-Bnm17sAE.js → account-integration-offline-VItxeiJg.js}

@@ -1,4 +1,4 @@
-const require_bosch_instances = require("./bosch-instances-CXmuRkef.js");
+const require_bosch_instances = require("./bosch-instances-CO8yIFzJ.js");
 let node_crypto = require("node:crypto");
 //#region src/shared/oauth-callback.ts
 /** A code on its own: no scheme, no query, no separators. */

package/dist/{account-integration-offline-9ooJuNrN.mjs → account-integration-offline-nChgZUlC.mjs}

@@ -1,4 +1,4 @@
-import { $ as errMsg } from "./bosch-instances-BIvOtuzj.mjs";
+import { $ as errMsg } from "./bosch-instances-BQiyzlPt.mjs";
 import { randomBytes } from "node:crypto";
 //#region src/shared/oauth-callback.ts
 /** A code on its own: no scheme, no query, no separators. */

package/dist/{bosch-instances-BIvOtuzj.mjs → bosch-instances-BQiyzlPt.mjs}

@@ -5981,7 +5981,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-D1jjWAr8.mjs
+//#region ../types/dist/sleep-9TIHFj1w.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7925,10 +7925,9 @@ var BaseAddon = class {
 	*
 	* Override it only when an `instanceMode: multiple` addon's instances differ: an NVR integration
 	* needs its connection fields, the default integration the addon's own sections. It is the
-	* SHAPE of the form only — the values live in `integrations.getSettings`, and the write path is
-	* unchanged (`integrations.setSettings` for an account integration).
+	* SHAPE of the form only — the values live on the instance record.
 	*/
-	async integrationSettingsSchema(_instance) {
+	async integrationFormSchema(_instance) {
 		return null;
 	}
 	/**
@@ -7974,7 +7973,7 @@ var BaseAddon = class {
 	* per-instance schema when it declares one, else its global schema (what they always showed).
 	*/
 	async getIntegrationFormSchema(instance, nodeId) {
-		const scoped = await this.integrationSettingsSchema(instance);
+		const scoped = await this.integrationFormSchema(instance);
 		if (scoped === null) return this.getGlobalSettings(void 0, void 0, nodeId);
 		return hydrateSchema(scoped, {}, { inlineSecretsAsViews: true });
 	}
@@ -11956,7 +11955,7 @@ object({
 	params: record(string(), union([string(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/composition-CRNwcFYY.mjs
+//#region ../types/dist/composition-pOHbTzRB.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -14664,20 +14663,28 @@ async function moveIntegrationRowsToRecords(ports, spec) {
 	};
 }
 /**
-* The addon-side ports of `moveIntegrationRowsToRecords` (planning#416): an addon runs the move
-* from its own process, so the legacy rows are reached through the hub (`ctx.api.integrations`:
-* `list`, `getSettings` - which answers the OWNER its secrets resolved - and `clearSettings`) and
-* the new record through the addon's own records handle. The hub deletes the rows and their
-* keychain values; the addon never touches the registry.
-*/
+* The addon-side ports of `moveIntegrationRowsToRecords` (planning#416). An addon runs the move
+* from its own process, so the leftover rows are reached through the migration-only door
+* (`migrations.readLegacyIntegrationRows` / `clearLegacyIntegrationRows`) on the hub's connection.
+* The door returns markers. This process is the owner, so it resolves and releases them with
+* `resolveSecretMarkers` — the same call the old settings door used — and only then asks the
+* door to delete the rows. The addon's own record kind is its records handle.
+*/
+async function resolvedRows(stored, secrets) {
+	if (secrets === null) return stored;
+	const { value, unresolved } = await resolveSecretMarkers(stored, secrets);
+	if (unresolved.length > 0) throw new Error(`${unresolved.length} secret(s) cannot be read from the keychain`);
+	return value;
+}
 function integrationRowsPortsOverApi(deps) {
+	const secrets = deps.secrets ?? null;
 	return {
 		warn: (message) => deps.log.warn(message),
 		listIntegrations: async (addonId) => (await deps.api.list()).filter((i) => i.addonId === addonId).map((i) => ({
 			id: i.id,
 			name: i.name
 		})),
-		readRows: (integrationId) => deps.api.getSettings({ id: integrationId }),
+		readRows: async (integrationId) => resolvedRows(await deps.api.readLegacyIntegrationRows({ integrationId }), secrets),
 		putRecord: async (id, body) => {
 			if (await deps.records.get(id) !== null) return "exists";
 			try {
@@ -14696,15 +14703,17 @@ function integrationRowsPortsOverApi(deps) {
 			await deps.records.delete(id);
 		},
 		clearRows: async (integrationId) => {
-			await deps.api.clearSettings({ id: integrationId });
+			const refs = collectSecretMarkerRefs(await deps.api.readLegacyIntegrationRows({ integrationId }));
+			if (refs.length > 0 && secrets !== null) await secrets.delete(refs);
+			await deps.api.clearLegacyIntegrationRows({ integrationId });
 		}
 	};
 }
 function defaultIntegrationApiOver(api) {
 	return {
 		list: () => api.integrations.list.query(),
-		getSettings: (input) => api.integrations.getSettings.query(input),
-		clearSettings: (input) => api.integrations.clearSettings.mutate(input),
+		readLegacyIntegrationRows: (input) => api.migrations.readLegacyIntegrationRows.query(input),
+		clearLegacyIntegrationRows: (input) => api.migrations.clearLegacyIntegrationRows.mutate(input),
 		listDevices: (addonId) => api.deviceManager.listAll.query({
 			addonId,
 			projection: "slim"
@@ -50390,6 +50399,9 @@ var RunningProposalEvidenceSchema = object({
 	runsFound: number().int().nonnegative(),
 	pausesFound: number().int().nonnegative(),
 	longestPauseMs: number().nonnegative(),
+	/** Episodes shorter than ~90 s (an anti-crease pulse, a display waking): never a run, never a pause. */
+	pulsesFound: number().int().nonnegative(),
+	longestPulseMs: number().nonnegative(),
 	idleFloorW: number(),
 	noiseCeilingW: number(),
 	plateauW: number(),
@@ -56235,11 +56247,7 @@ var CreateIntegrationInputSchema = object({
 	info: record(string(), unknown()).optional(),
 	/** `stableId` of the discovery candidate the form was seeded from (D984). */
 	originStableId: string().optional(),
-	settings: record(string(), unknown()).optional(),
-	/** Keys of `settings` the form's schema declares secret (by type) — kept in
-	*  the keychain, not the table (D787). */
-	secretKeys: array(string()).optional(),
-	skipRestart: boolean().optional()
+	settings: record(string(), unknown()).optional()
 });
 var UpdateIntegrationInputSchema = object({
 	id: string(),
@@ -56260,22 +56268,6 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 }), method(object({ id: string() }), DeleteIntegrationResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ id: string() }), record(string(), unknown()), { auth: "admin" }), method(object({
-	id: string(),
-	settings: record(string(), unknown()),
-	/** Keys the form's schema declares secret (by type) — keychain-stored (D787). */
-	secretKeys: array(string()).optional(),
-	/** The integration's own addon applies the change in-process and asks the hub not to respawn it. */
-	skipRestart: boolean().optional()
-}), object({ success: boolean() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ id: string() }), object({
-	rows: number().int().nonnegative(),
-	secrets: number().int().nonnegative()
-}), {
-	kind: "mutation",
-	auth: "admin"
 }), method(_void(), array(AvailableIntegrationTypeSchema), { auth: "admin" }), method(object({
 	addonId: string(),
 	settings: record(string(), unknown())
@@ -59252,6 +59244,27 @@ method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { aut
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ integrationId: string().min(1) }), record(string(), unknown()), { auth: "admin" }), method(object({ integrationId: string().min(1) }), object({
+	rows: number().int().nonnegative(),
+	secrets: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	integrationId: string().min(1),
+	patch: record(string(), unknown())
+}), object({ written: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	integrationId: string().min(1),
+	keys: array(string().min(1))
+}), object({
+	present: boolean(),
+	removed: record(string(), unknown())
+}), {
+	kind: "mutation",
+	auth: "admin"
 });
 method(object({
 	sourceUrl: string(),
@@ -80617,11 +80630,15 @@ function runningFromDishwasherOperation(operation, program, previous, fetchedAt,
 *  1. idle floor F = time-weighted median; noise ceiling N = highest value seen
 *     near F. A device that is not near one level most of the time has no floor.
 *  2. coarse activity = above max(2N, N + 5 W); consecutive stretches are episodes.
-*  3. gaps between episodes split in two by the largest log-scale jump (>= 3x):
-*     the short ones are pauses INSIDE a run (a soak), the long ones separate runs.
+*  3. an episode shorter than `PULSE_MAX_MS` is a PULSE (an anti-crease tumble, a
+*     display waking): it is neither a run nor a pause. Among the remaining
+*     episodes, gaps over `PAUSE_MAX_MS` always separate runs; the rest split in
+*     two by the largest log-scale jump (>= 3x): the short ones are pauses INSIDE
+*     a run (a soak), the long ones separate runs. A stretch under `MIN_RUN_MS`
+*     is no run.
 *  4. T = geometric mean of N and the plateau's 10th percentile, snapped to a
-*     grid a person would type; stop dwell covers the longest pause; start dwell
-*     covers the longest standby blip above T.
+*     grid a person would type; stop dwell covers the longest pause and the
+*     kind's floor; start dwell covers the longest pulse and standby blip above T.
 *  5. the numbers are proved by REPLAY through the real `dwell` evaluation: each
 *     run must hold exactly one true interval and nothing may flap outside.
 */
@@ -80632,6 +80649,10 @@ var MINUTE_MS$1 = 60 * SECOND_MS;
 30 * SECOND_MS;
 60 * SECOND_MS;
 20 * MINUTE_MS$1;
+90 * SECOND_MS;
+30 * MINUTE_MS$1;
+10 * MINUTE_MS$1;
+DeviceType.Dryer, 3 * MINUTE_MS$1, DeviceType.Dishwasher, 3 * MINUTE_MS$1, DeviceType.Washer, 10 * MINUTE_MS$1;
 10 * SECOND_MS;
 10 * SECOND_MS;
 DeviceFeature.FanSpeed, DeviceFeature.FanPreset, DeviceFeature.FanDirection, DeviceFeature.FanOscillating, DeviceFeature.CoverStoppable, DeviceFeature.CoverPositionable, DeviceFeature.CoverTilt, DeviceFeature.ValvePositionable, DeviceFeature.MediaPlayerVolume, DeviceFeature.ClimateFanMode;
@@ -85916,13 +85937,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"integrations.clearSettings": {
-		capName: "integrations",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"integrations.create": {
 		capName: "integrations",
 		capScope: "system",
@@ -85958,13 +85972,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"integrations.getSettings": {
-		capName: "integrations",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"integrations.list": {
 		capName: "integrations",
 		capScope: "system",
@@ -85972,13 +85979,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"integrations.setSettings": {
-		capName: "integrations",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"integrations.testConnection": {
 		capName: "integrations",
 		capScope: "system",
@@ -86973,6 +86973,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"migrations.clearLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
 	"migrations.declareOwner": {
 		capName: "migrations",
 		capScope: "system",
@@ -86980,6 +86987,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"migrations.deleteLegacyIntegrationRowKeys": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
 	"migrations.dryRun": {
 		capName: "migrations",
 		capScope: "system",
@@ -87015,6 +87029,20 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"migrations.patchLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.readLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"migrations.restorePreMigration": {
 		capName: "migrations",
 		capScope: "system",
@@ -98082,6 +98110,7 @@ function boschRowsMigration(spec) {
 function boschRowsPorts(deps) {
 	return integrationRowsPortsOverApi({
 		api: deps.api,
+		...deps.secrets !== void 0 ? { secrets: deps.secrets } : {},
 		records: deps.records.kind({
 			name: deps.kind.name,
 			declaration: deps.kind.declaration,

package/dist/{bosch-instances-CXmuRkef.js → bosch-instances-CO8yIFzJ.js}

@@ -5981,7 +5981,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-D1jjWAr8.mjs
+//#region ../types/dist/sleep-9TIHFj1w.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7925,10 +7925,9 @@ var BaseAddon = class {
 	*
 	* Override it only when an `instanceMode: multiple` addon's instances differ: an NVR integration
 	* needs its connection fields, the default integration the addon's own sections. It is the
-	* SHAPE of the form only — the values live in `integrations.getSettings`, and the write path is
-	* unchanged (`integrations.setSettings` for an account integration).
+	* SHAPE of the form only — the values live on the instance record.
 	*/
-	async integrationSettingsSchema(_instance) {
+	async integrationFormSchema(_instance) {
 		return null;
 	}
 	/**
@@ -7974,7 +7973,7 @@ var BaseAddon = class {
 	* per-instance schema when it declares one, else its global schema (what they always showed).
 	*/
 	async getIntegrationFormSchema(instance, nodeId) {
-		const scoped = await this.integrationSettingsSchema(instance);
+		const scoped = await this.integrationFormSchema(instance);
 		if (scoped === null) return this.getGlobalSettings(void 0, void 0, nodeId);
 		return hydrateSchema(scoped, {}, { inlineSecretsAsViews: true });
 	}
@@ -11956,7 +11955,7 @@ object({
 	params: record(string(), union([string(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/composition-CRNwcFYY.mjs
+//#region ../types/dist/composition-pOHbTzRB.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -14664,20 +14663,28 @@ async function moveIntegrationRowsToRecords(ports, spec) {
 	};
 }
 /**
-* The addon-side ports of `moveIntegrationRowsToRecords` (planning#416): an addon runs the move
-* from its own process, so the legacy rows are reached through the hub (`ctx.api.integrations`:
-* `list`, `getSettings` - which answers the OWNER its secrets resolved - and `clearSettings`) and
-* the new record through the addon's own records handle. The hub deletes the rows and their
-* keychain values; the addon never touches the registry.
-*/
+* The addon-side ports of `moveIntegrationRowsToRecords` (planning#416). An addon runs the move
+* from its own process, so the leftover rows are reached through the migration-only door
+* (`migrations.readLegacyIntegrationRows` / `clearLegacyIntegrationRows`) on the hub's connection.
+* The door returns markers. This process is the owner, so it resolves and releases them with
+* `resolveSecretMarkers` — the same call the old settings door used — and only then asks the
+* door to delete the rows. The addon's own record kind is its records handle.
+*/
+async function resolvedRows(stored, secrets) {
+	if (secrets === null) return stored;
+	const { value, unresolved } = await resolveSecretMarkers(stored, secrets);
+	if (unresolved.length > 0) throw new Error(`${unresolved.length} secret(s) cannot be read from the keychain`);
+	return value;
+}
 function integrationRowsPortsOverApi(deps) {
+	const secrets = deps.secrets ?? null;
 	return {
 		warn: (message) => deps.log.warn(message),
 		listIntegrations: async (addonId) => (await deps.api.list()).filter((i) => i.addonId === addonId).map((i) => ({
 			id: i.id,
 			name: i.name
 		})),
-		readRows: (integrationId) => deps.api.getSettings({ id: integrationId }),
+		readRows: async (integrationId) => resolvedRows(await deps.api.readLegacyIntegrationRows({ integrationId }), secrets),
 		putRecord: async (id, body) => {
 			if (await deps.records.get(id) !== null) return "exists";
 			try {
@@ -14696,15 +14703,17 @@ function integrationRowsPortsOverApi(deps) {
 			await deps.records.delete(id);
 		},
 		clearRows: async (integrationId) => {
-			await deps.api.clearSettings({ id: integrationId });
+			const refs = collectSecretMarkerRefs(await deps.api.readLegacyIntegrationRows({ integrationId }));
+			if (refs.length > 0 && secrets !== null) await secrets.delete(refs);
+			await deps.api.clearLegacyIntegrationRows({ integrationId });
 		}
 	};
 }
 function defaultIntegrationApiOver(api) {
 	return {
 		list: () => api.integrations.list.query(),
-		getSettings: (input) => api.integrations.getSettings.query(input),
-		clearSettings: (input) => api.integrations.clearSettings.mutate(input),
+		readLegacyIntegrationRows: (input) => api.migrations.readLegacyIntegrationRows.query(input),
+		clearLegacyIntegrationRows: (input) => api.migrations.clearLegacyIntegrationRows.mutate(input),
 		listDevices: (addonId) => api.deviceManager.listAll.query({
 			addonId,
 			projection: "slim"
@@ -50390,6 +50399,9 @@ var RunningProposalEvidenceSchema = object({
 	runsFound: number().int().nonnegative(),
 	pausesFound: number().int().nonnegative(),
 	longestPauseMs: number().nonnegative(),
+	/** Episodes shorter than ~90 s (an anti-crease pulse, a display waking): never a run, never a pause. */
+	pulsesFound: number().int().nonnegative(),
+	longestPulseMs: number().nonnegative(),
 	idleFloorW: number(),
 	noiseCeilingW: number(),
 	plateauW: number(),
@@ -56235,11 +56247,7 @@ var CreateIntegrationInputSchema = object({
 	info: record(string(), unknown()).optional(),
 	/** `stableId` of the discovery candidate the form was seeded from (D984). */
 	originStableId: string().optional(),
-	settings: record(string(), unknown()).optional(),
-	/** Keys of `settings` the form's schema declares secret (by type) — kept in
-	*  the keychain, not the table (D787). */
-	secretKeys: array(string()).optional(),
-	skipRestart: boolean().optional()
+	settings: record(string(), unknown()).optional()
 });
 var UpdateIntegrationInputSchema = object({
 	id: string(),
@@ -56260,22 +56268,6 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 }), method(object({ id: string() }), DeleteIntegrationResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ id: string() }), record(string(), unknown()), { auth: "admin" }), method(object({
-	id: string(),
-	settings: record(string(), unknown()),
-	/** Keys the form's schema declares secret (by type) — keychain-stored (D787). */
-	secretKeys: array(string()).optional(),
-	/** The integration's own addon applies the change in-process and asks the hub not to respawn it. */
-	skipRestart: boolean().optional()
-}), object({ success: boolean() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ id: string() }), object({
-	rows: number().int().nonnegative(),
-	secrets: number().int().nonnegative()
-}), {
-	kind: "mutation",
-	auth: "admin"
 }), method(_void(), array(AvailableIntegrationTypeSchema), { auth: "admin" }), method(object({
 	addonId: string(),
 	settings: record(string(), unknown())
@@ -59252,6 +59244,27 @@ method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { aut
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({ integrationId: string().min(1) }), record(string(), unknown()), { auth: "admin" }), method(object({ integrationId: string().min(1) }), object({
+	rows: number().int().nonnegative(),
+	secrets: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	integrationId: string().min(1),
+	patch: record(string(), unknown())
+}), object({ written: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	integrationId: string().min(1),
+	keys: array(string().min(1))
+}), object({
+	present: boolean(),
+	removed: record(string(), unknown())
+}), {
+	kind: "mutation",
+	auth: "admin"
 });
 method(object({
 	sourceUrl: string(),
@@ -80617,11 +80630,15 @@ function runningFromDishwasherOperation(operation, program, previous, fetchedAt,
 *  1. idle floor F = time-weighted median; noise ceiling N = highest value seen
 *     near F. A device that is not near one level most of the time has no floor.
 *  2. coarse activity = above max(2N, N + 5 W); consecutive stretches are episodes.
-*  3. gaps between episodes split in two by the largest log-scale jump (>= 3x):
-*     the short ones are pauses INSIDE a run (a soak), the long ones separate runs.
+*  3. an episode shorter than `PULSE_MAX_MS` is a PULSE (an anti-crease tumble, a
+*     display waking): it is neither a run nor a pause. Among the remaining
+*     episodes, gaps over `PAUSE_MAX_MS` always separate runs; the rest split in
+*     two by the largest log-scale jump (>= 3x): the short ones are pauses INSIDE
+*     a run (a soak), the long ones separate runs. A stretch under `MIN_RUN_MS`
+*     is no run.
 *  4. T = geometric mean of N and the plateau's 10th percentile, snapped to a
-*     grid a person would type; stop dwell covers the longest pause; start dwell
-*     covers the longest standby blip above T.
+*     grid a person would type; stop dwell covers the longest pause and the
+*     kind's floor; start dwell covers the longest pulse and standby blip above T.
 *  5. the numbers are proved by REPLAY through the real `dwell` evaluation: each
 *     run must hold exactly one true interval and nothing may flap outside.
 */
@@ -80632,6 +80649,10 @@ var MINUTE_MS$1 = 60 * SECOND_MS;
 30 * SECOND_MS;
 60 * SECOND_MS;
 20 * MINUTE_MS$1;
+90 * SECOND_MS;
+30 * MINUTE_MS$1;
+10 * MINUTE_MS$1;
+DeviceType.Dryer, 3 * MINUTE_MS$1, DeviceType.Dishwasher, 3 * MINUTE_MS$1, DeviceType.Washer, 10 * MINUTE_MS$1;
 10 * SECOND_MS;
 10 * SECOND_MS;
 DeviceFeature.FanSpeed, DeviceFeature.FanPreset, DeviceFeature.FanDirection, DeviceFeature.FanOscillating, DeviceFeature.CoverStoppable, DeviceFeature.CoverPositionable, DeviceFeature.CoverTilt, DeviceFeature.ValvePositionable, DeviceFeature.MediaPlayerVolume, DeviceFeature.ClimateFanMode;
@@ -85916,13 +85937,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"integrations.clearSettings": {
-		capName: "integrations",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"integrations.create": {
 		capName: "integrations",
 		capScope: "system",
@@ -85958,13 +85972,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"integrations.getSettings": {
-		capName: "integrations",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"integrations.list": {
 		capName: "integrations",
 		capScope: "system",
@@ -85972,13 +85979,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"integrations.setSettings": {
-		capName: "integrations",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"integrations.testConnection": {
 		capName: "integrations",
 		capScope: "system",
@@ -86973,6 +86973,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"migrations.clearLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
 	"migrations.declareOwner": {
 		capName: "migrations",
 		capScope: "system",
@@ -86980,6 +86987,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"migrations.deleteLegacyIntegrationRowKeys": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
 	"migrations.dryRun": {
 		capName: "migrations",
 		capScope: "system",
@@ -87015,6 +87029,20 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"migrations.patchLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"migrations.readLegacyIntegrationRows": {
+		capName: "migrations",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"migrations.restorePreMigration": {
 		capName: "migrations",
 		capScope: "system",
@@ -98082,6 +98110,7 @@ function boschRowsMigration(spec) {
 function boschRowsPorts(deps) {
 	return integrationRowsPortsOverApi({
 		api: deps.api,
+		...deps.secrets !== void 0 ? { secrets: deps.secrets } : {},
 		records: deps.records.kind({
 			name: deps.kind.name,
 			declaration: deps.kind.declaration,

package/dist/home-connect/addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_bosch_instances = require("../bosch-instances-CXmuRkef.js");
-const require_account_integration_offline = require("../account-integration-offline-Bnm17sAE.js");
+const require_bosch_instances = require("../bosch-instances-CO8yIFzJ.js");
+const require_account_integration_offline = require("../account-integration-offline-VItxeiJg.js");
 let node_crypto = require("node:crypto");
 let node_tls = require("node:tls");
 let node_zlib = require("node:zlib");
@@ -5383,6 +5383,7 @@ var BoschHomeConnectProviderAddon = class extends require_bosch_instances.BaseDe
 		await records.declare(homeConnectRecordKinds);
 		await this.runMigrations(require_bosch_instances.defineAddonMigrations(HOME_CONNECT_MIGRATIONS, homeConnectRowsPorts({
 			api: require_bosch_instances.defaultIntegrationApiOver(this.ctx.api),
+			secrets: this.ctx.secrets ?? null,
 			records,
 			warn: (message) => this.ctx.logger.warn(message)
 		})));

package/dist/home-connect/addon.mjs

@@ -1,5 +1,5 @@
-import { $ as errMsg, B as isSecretMarkerLike, C as ingestReading, D as quantityFromUnit, E as powerMeterCapability, F as defineAddonMigrations, H as array, I as defineCustomActions, J as string, K as object, L as defineEntryKind, N as createEvent, O as runningFromDishwasherOperation, P as customAction, Q as DeviceType, R as entryBody, T as numericSensorCapability, U as boolean, V as _enum, W as literal, X as unknown, Y as union, Z as DeviceRole, _ as defaultIntegrationApiOver, a as BaseDevice, b as enumSensorCapability, c as RUNNING_STATE_COLD, d as VendorLoginProxy, et as EventCategory, g as consumablesCapability, h as connectionTestCapability, i as testBoschInstance, k as runningStateCapability, l as RecordIntegrationInstances, n as boschRowsPorts, o as BaseDeviceProvider, p as binaryCapability, q as record, r as keepBodyKeys, s as DishwasherOperationStateSchema, t as boschRowsMigration, v as deviceAdoptionCapability, w as integrationInstancesCapability, x as eventEmitterCapability, y as dishwasherCapability, z as isSecretMarker } from "../bosch-instances-BIvOtuzj.mjs";
-import { a as createSignInAttemptStore, i as openSignInProxy, n as cascadeRemoveDevicesForIntegration, o as loginFailureForAttempt, r as createSignInClaims, s as parseOAuthCallback, t as setIntegrationDevicesOnline } from "../account-integration-offline-9ooJuNrN.mjs";
+import { $ as errMsg, B as isSecretMarkerLike, C as ingestReading, D as quantityFromUnit, E as powerMeterCapability, F as defineAddonMigrations, H as array, I as defineCustomActions, J as string, K as object, L as defineEntryKind, N as createEvent, O as runningFromDishwasherOperation, P as customAction, Q as DeviceType, R as entryBody, T as numericSensorCapability, U as boolean, V as _enum, W as literal, X as unknown, Y as union, Z as DeviceRole, _ as defaultIntegrationApiOver, a as BaseDevice, b as enumSensorCapability, c as RUNNING_STATE_COLD, d as VendorLoginProxy, et as EventCategory, g as consumablesCapability, h as connectionTestCapability, i as testBoschInstance, k as runningStateCapability, l as RecordIntegrationInstances, n as boschRowsPorts, o as BaseDeviceProvider, p as binaryCapability, q as record, r as keepBodyKeys, s as DishwasherOperationStateSchema, t as boschRowsMigration, v as deviceAdoptionCapability, w as integrationInstancesCapability, x as eventEmitterCapability, y as dishwasherCapability, z as isSecretMarker } from "../bosch-instances-BQiyzlPt.mjs";
+import { a as createSignInAttemptStore, i as openSignInProxy, n as cascadeRemoveDevicesForIntegration, o as loginFailureForAttempt, r as createSignInClaims, s as parseOAuthCallback, t as setIntegrationDevicesOnline } from "../account-integration-offline-nChgZUlC.mjs";
 import { createHash, randomBytes } from "node:crypto";
 import { connect } from "node:tls";
 import { inflateRawSync } from "node:zlib";
@@ -5382,6 +5382,7 @@ var BoschHomeConnectProviderAddon = class extends BaseDeviceProvider {
 		await records.declare(homeConnectRecordKinds);
 		await this.runMigrations(defineAddonMigrations(HOME_CONNECT_MIGRATIONS, homeConnectRowsPorts({
 			api: defaultIntegrationApiOver(this.ctx.api),
+			secrets: this.ctx.secrets ?? null,
 			records,
 			warn: (message) => this.ctx.logger.warn(message)
 		})));

package/dist/homecom/addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_bosch_instances = require("../bosch-instances-CXmuRkef.js");
-const require_account_integration_offline = require("../account-integration-offline-Bnm17sAE.js");
+const require_bosch_instances = require("../bosch-instances-CO8yIFzJ.js");
+const require_account_integration_offline = require("../account-integration-offline-VItxeiJg.js");
 let node_crypto = require("node:crypto");
 //#region src/homecom/config.ts
 var HOMECOM_BRANDS = ["bosch", "buderus"];
@@ -2193,6 +2193,7 @@ var BoschHomeComProviderAddon = class extends require_bosch_instances.BaseDevice
 		await records.declare(homeComRecordKinds);
 		await this.runMigrations(require_bosch_instances.defineAddonMigrations(HOMECOM_MIGRATIONS, homeComRowsPorts({
 			api: require_bosch_instances.defaultIntegrationApiOver(this.ctx.api),
+			secrets: this.ctx.secrets ?? null,
 			records,
 			warn: (message) => this.ctx.logger.warn(message)
 		})));

package/dist/homecom/addon.mjs

@@ -1,5 +1,5 @@
-import { $ as errMsg, F as defineAddonMigrations, G as number, H as array, I as defineCustomActions, J as string, K as object, L as defineEntryKind, M as waterHeaterCapability, P as customAction, Q as DeviceType, R as entryBody, U as boolean, V as _enum, W as literal, _ as defaultIntegrationApiOver, a as BaseDevice, d as VendorLoginProxy, et as EventCategory, h as connectionTestCapability, i as testBoschInstance, l as RecordIntegrationInstances, m as climateControlCapability, n as boschRowsPorts, o as BaseDeviceProvider, r as keepBodyKeys, t as boschRowsMigration, v as deviceAdoptionCapability, w as integrationInstancesCapability } from "../bosch-instances-BIvOtuzj.mjs";
-import { a as createSignInAttemptStore, i as openSignInProxy, n as cascadeRemoveDevicesForIntegration, o as loginFailureForAttempt, r as createSignInClaims, s as parseOAuthCallback, t as setIntegrationDevicesOnline } from "../account-integration-offline-9ooJuNrN.mjs";
+import { $ as errMsg, F as defineAddonMigrations, G as number, H as array, I as defineCustomActions, J as string, K as object, L as defineEntryKind, M as waterHeaterCapability, P as customAction, Q as DeviceType, R as entryBody, U as boolean, V as _enum, W as literal, _ as defaultIntegrationApiOver, a as BaseDevice, d as VendorLoginProxy, et as EventCategory, h as connectionTestCapability, i as testBoschInstance, l as RecordIntegrationInstances, m as climateControlCapability, n as boschRowsPorts, o as BaseDeviceProvider, r as keepBodyKeys, t as boschRowsMigration, v as deviceAdoptionCapability, w as integrationInstancesCapability } from "../bosch-instances-BQiyzlPt.mjs";
+import { a as createSignInAttemptStore, i as openSignInProxy, n as cascadeRemoveDevicesForIntegration, o as loginFailureForAttempt, r as createSignInClaims, s as parseOAuthCallback, t as setIntegrationDevicesOnline } from "../account-integration-offline-nChgZUlC.mjs";
 import { createHash, randomBytes } from "node:crypto";
 //#region src/homecom/config.ts
 var HOMECOM_BRANDS = ["bosch", "buderus"];
@@ -2192,6 +2192,7 @@ var BoschHomeComProviderAddon = class extends BaseDeviceProvider {
 		await records.declare(homeComRecordKinds);
 		await this.runMigrations(defineAddonMigrations(HOMECOM_MIGRATIONS, homeComRowsPorts({
 			api: defaultIntegrationApiOver(this.ctx.api),
+			secrets: this.ctx.secrets ?? null,
 			records,
 			warn: (message) => this.ctx.logger.warn(message)
 		})));

package/dist/shc/addon.js

@@ -2,7 +2,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 //#region \0rolldown/runtime.js
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 //#endregion
-const require_bosch_instances = require("../bosch-instances-CXmuRkef.js");
+const require_bosch_instances = require("../bosch-instances-CO8yIFzJ.js");
 let node_crypto = require("node:crypto");
 let node_https = require("node:https");
 let node_child_process = require("node:child_process");
@@ -23845,6 +23845,7 @@ var BoschShcProviderAddon = class extends require_bosch_instances.BaseDeviceProv
 		await records.declare(shcRecordKinds);
 		await this.runMigrations(require_bosch_instances.defineAddonMigrations(SHC_MIGRATIONS, shcRowsPorts({
 			api: require_bosch_instances.defaultIntegrationApiOver(this.ctx.api),
+			secrets: this.ctx.secrets ?? null,
 			records,
 			warn: (message) => this.ctx.logger.warn(message)
 		})));

package/dist/shc/addon.mjs

@@ -1,4 +1,4 @@
-import { $ as errMsg, A as switchCapability, F as defineAddonMigrations, G as number, H as array, I as defineCustomActions, J as string, K as object, L as defineEntryKind, P as customAction, Q as DeviceType, R as entryBody, S as heatingValveCapability, V as _enum, W as literal, _ as defaultIntegrationApiOver, a as BaseDevice, et as EventCategory, f as batteryCapability, h as connectionTestCapability, i as testBoschInstance, j as temperatureSensorCapability, l as RecordIntegrationInstances, m as climateControlCapability, n as boschRowsPorts, o as BaseDeviceProvider, r as keepBodyKeys, t as boschRowsMigration, v as deviceAdoptionCapability, w as integrationInstancesCapability } from "../bosch-instances-BIvOtuzj.mjs";
+import { $ as errMsg, A as switchCapability, F as defineAddonMigrations, G as number, H as array, I as defineCustomActions, J as string, K as object, L as defineEntryKind, P as customAction, Q as DeviceType, R as entryBody, S as heatingValveCapability, V as _enum, W as literal, _ as defaultIntegrationApiOver, a as BaseDevice, et as EventCategory, f as batteryCapability, h as connectionTestCapability, i as testBoschInstance, j as temperatureSensorCapability, l as RecordIntegrationInstances, m as climateControlCapability, n as boschRowsPorts, o as BaseDeviceProvider, r as keepBodyKeys, t as boschRowsMigration, v as deviceAdoptionCapability, w as integrationInstancesCapability } from "../bosch-instances-BQiyzlPt.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { request } from "node:https";
@@ -23846,6 +23846,7 @@ var BoschShcProviderAddon = class extends BaseDeviceProvider {
 		await records.declare(shcRecordKinds);
 		await this.runMigrations(defineAddonMigrations(SHC_MIGRATIONS, shcRowsPorts({
 			api: defaultIntegrationApiOver(this.ctx.api),
+			secrets: this.ctx.secrets ?? null,
 			records,
 			warn: (message) => this.ctx.logger.warn(message)
 		})));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-bosch",
-  "version": "0.1.36",
+  "version": "0.1.37",
   "description": "Bosch smart-home device-provider addons for CamStack — SHC, Home Connect, and HomeCom cloud integrations (scaffold)",
   "keywords": [
     "camstack",
@@ -141,7 +141,7 @@
       }
     ],
     "requires": {
-      "server": ">=1.2.765"
+      "server": ">=1.2.770"
     }
   },
   "files": [