@camstack/addon-provider-bosch 0.1.38 → 0.1.40

package/dist/{bosch-instances-CIuDwXQ8.mjs → bosch-instances-Yqi-WAZN.mjs}

@@ -5981,7 +5981,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DEZaLbiu.mjs
+//#region ../types/dist/sleep-CmjWurK5.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6665,137 +6665,153 @@ async function runAddonMigrations(host, migrations, logger, options = {}) {
 		blockOwner
 	};
 }
-/**
-* Build a {@link DurableState} over a single store key. Transport-agnostic:
-* `read`/`write` are the addon-store or device-store accessors. The whole
-* validated value round-trips on every read/write — the schema is the
-* single source of truth for what is persisted, so no hand-listed field
-* set can drop a key on save.
-*/
-function createDurableState(deps) {
-	const get = async () => {
-		const raw = (await deps.read())[deps.key];
-		if (raw === void 0) return deps.fallback;
-		const parsed = deps.schema.safeParse(raw);
-		if (!parsed.success) {
-			deps.onParseError?.(deps.key, parsed.error);
-			return deps.fallback;
-		}
-		return parsed.data;
-	};
-	const set = async (next) => {
-		const validated = deps.schema.parse(next);
-		await deps.write({ [deps.key]: validated });
-	};
-	const update = async (fn) => {
-		await set(fn(await get()));
-	};
+function secretsOverMigrationApi(api) {
 	return {
-		get,
-		set,
-		update
+		resolve: async (refs) => {
+			const { values } = await api.secrets.resolve({ refs: [...refs] });
+			const out = {};
+			for (const ref of refs) {
+				const value = values[ref];
+				out[ref] = value === null || value === void 0 ? { kind: "missing" } : {
+					kind: "value",
+					value,
+					version: 0
+				};
+			}
+			return out;
+		},
+		delete: async (refs) => (await api.secrets.delete({ refs: [...refs] })).deleted
 	};
 }
-/**
-* Per-node scoping for the shared addon-settings blob.
-*
-* An addon's settings store is hub-central (the `addon-settings` cap is
-* hub-routed — the hub instance answers for every node), so fields whose
-* value is a NODE fact (decoder backend, engine pick, probed hardware
-* capabilities) persist under the node-scoped key `<key>@<nodeId>` inside
-* the single shared blob. The SCHEMA field key stays bare: the write path
-* ({@link scopePatch}) maps the bare field onto the target node's scoped
-* key; the read/hydrate path ({@link projectStore}) maps THIS node's value
-* back, so UI forms and `resolveConfig` only ever see the bare key.
-*
-* Fields opt in via the `perNode: true` schema marker on `ConfigFieldBase`
-* (`interfaces/config-ui.ts`); `BaseAddon` derives the key set from the
-* schema and routes reads/writes through these helpers.
-*
-* ## No bare-key fallback — deliberate
-*
-* {@link readNodeValue} reads the node-scoped key ONLY. A node with no
-* scoped key resolves to `undefined` so the field's schema `default` wins —
-* NEVER `store[base]` and never another node's value. A bare legacy key in
-* the store is invisible to every node, hub included, so one node's
-* selection can never leak onto another. (This generalizes the
-* `decoder-backend-keys.ts` semantics — the no-fallback variant — over an
-* arbitrary set of per-node field keys.)
-*
-* Pure functions only — no I/O, no imports beyond the language. This is a
-* LEAF module: import it via its deep path, never from the root barrel.
-*/
-/**
-* Normalize a raw kernel node id to the bare node id used for scoping.
-* `localNodeId` can carry a `<node>/<addon>` suffix on forked child
-* processes; per-node settings are per-NODE, so strip the addon segment.
-* `undefined` / `null` / empty falls back to `'hub'`.
-*/
-function normalizeNodeId(raw) {
-	if (raw === void 0 || raw === null || raw === "") return "hub";
-	const slashIdx = raw.indexOf("/");
-	if (slashIdx < 0) return raw;
-	const bare = raw.slice(0, slashIdx);
-	return bare === "" ? "hub" : bare;
+/** The record calls the one-switch migration makes, over the migration API. */
+function switchRecordsOverMigrationApi(api) {
+	return { kind: (definition) => {
+		const handle = api.records.kind(definition);
+		return {
+			get: (id) => handle.get({ id }),
+			put: (input, opts) => handle.put({
+				...input,
+				...opts?.ifRev === void 0 ? {} : { ifRev: opts.ifRev }
+			}),
+			patch: (id, partial) => handle.patch({
+				id,
+				partial
+			})
+		};
+	} };
 }
-/** The node-scoped store key for a per-node field: `<base>@<nodeId>`. */
-function nodeScopedKey(base, nodeId) {
-	return `${base}@${normalizeNodeId(nodeId)}`;
+/** `ctx.records` as the migration API offers it: bind a kind, read and write by id. */
+function recordsOverMigrationApi(api) {
+	return { kind: (definition) => {
+		const handle = api.records.kind(definition);
+		return {
+			get: (id) => handle.get({ id }),
+			getResolved: (id) => handle.getResolved({ id }),
+			put: (input, opts) => handle.put({
+				...input,
+				...opts?.ifRev === void 0 ? {} : { ifRev: opts.ifRev }
+			}),
+			delete: (id) => handle.delete({ id })
+		};
+	} };
 }
-/**
-* Read a node's value for a per-node field from the raw shared store:
-* the node-scoped key when present, otherwise `undefined`.
-* Deliberately NO bare-key fallback (see module doc) — the caller lets the
-* schema `default` win on `undefined`.
-*/
-function readNodeValue(store, base, nodeId) {
-	return store[nodeScopedKey(base, nodeId)];
+function integrationRowsApiOver(api) {
+	return {
+		list: async () => (await api.integrations.list({})).integrations,
+		readLegacyIntegrationRows: (input) => api.legacyRows.read(input),
+		clearLegacyIntegrationRows: (input) => api.legacyRows.clear(input)
+	};
 }
 /**
-* Re-map a UI/settings patch so every bare perNode field persists under the
-* TARGET node's scoped key; all other keys pass through unchanged. Used on
-* the write path so a save for one node never clobbers another node's value
-* (and the bare key is never written). Returns a new object — the input
-* patch is not mutated.
+* One serial lane per migration API: a log line is delivered after the line before it, so the
+* order the steps wrote them in is the order the hub reads them in. A delivery that fails
+* is reported once through the same door; if that fails too nothing is left to tell, and the
+* line is dropped rather than thrown into a migration step or left as an unhandled rejection.
 */
-function scopePatch(patch, perNodeKeys, nodeId) {
-	const out = {};
-	for (const [key, value] of Object.entries(patch)) out[perNodeKeys.has(key) ? nodeScopedKey(key, nodeId) : key] = value;
-	return out;
+var lanes = /* @__PURE__ */ new WeakMap();
+function deliver(api, send) {
+	const next = (lanes.get(api) ?? Promise.resolve()).then(send).then(() => void 0).catch(async (error) => {
+		const reason = error instanceof Error ? error.message : String(error);
+		await api.log.warn({ message: `a migration log line could not be delivered: ${reason}` }).catch(() => void 0);
+	});
+	lanes.set(api, next);
+	return next;
 }
-/**
-* Project the raw shared store onto the bare schema keys for ONE node so a
-* UI schema (whose field keys are bare) hydrates from that node's own
-* values:
-*
-* - EVERY `@`-scoped key (any node's) is dropped from the pass-through.
-* - Every bare perNode key is dropped from the pass-through (a stray bare
-*   legacy key must never hydrate any node — no bare fallback).
-* - THIS node's effective value ({@link readNodeValue}) is then laid onto
-*   each bare perNode key; when the node has no scoped key the bare key is
-*   left ABSENT so the field's schema `default` wins.
-*
-* Returns a new object — the input store is not mutated.
-*/
-function projectStore(store, perNodeKeys, nodeId) {
-	const out = {};
-	for (const [key, value] of Object.entries(store)) {
-		if (key.includes("@")) continue;
-		if (perNodeKeys.has(key)) continue;
-		out[key] = value;
+function warnOver(api) {
+	return (message) => deliver(api, () => api.log.warn({ message }));
+}
+/** What the rows-to-records move needs, over the migration API. */
+function rowsDepsOver(api) {
+	return {
+		api: integrationRowsApiOver(api),
+		records: recordsOverMigrationApi(api),
+		secrets: secretsOverMigrationApi(api),
+		warn: warnOver(api)
+	};
+}
+var PREFIX = "records/";
+/** The base of every records failure. `detail` is the human part of the message. */
+var RecordsError = class extends Error {
+	code;
+	detail;
+	constructor(code, detail) {
+		super(`${PREFIX}${code}: ${detail}`);
+		this.name = "RecordsError";
+		this.code = code;
+		this.detail = detail;
 	}
-	for (const base of perNodeKeys) {
-		const value = readNodeValue(store, base, nodeId);
-		if (value !== void 0) out[base] = value;
+};
+/** A write guarded by `ifRev` found another revision (or an existing row for `ifRev: 0`). */
+var RevConflictError = class extends RecordsError {
+	constructor(detail) {
+		super("rev-conflict", detail);
+		this.name = "RevConflictError";
 	}
-	return out;
+};
+/** The keychain could not store or serve a value: explicit, never an empty string. */
+var RecordSecretUnavailableError = class extends RecordsError {
+	constructor(detail) {
+		super("secret-unavailable", detail);
+		this.name = "RecordSecretUnavailableError";
+	}
+};
+var InvalidRecordError = class extends RecordsError {
+	constructor(detail) {
+		super("invalid-record", detail);
+		this.name = "InvalidRecordError";
+	}
+};
+/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
+var DeclarationRefusedError = class extends RecordsError {
+	constructor(detail) {
+		super("declaration-refused", detail);
+		this.name = "DeclarationRefusedError";
+	}
+};
+function linkTargetOf(meta) {
+	if (typeof meta !== "object" || meta === null) return void 0;
+	const link = Reflect.get(meta, "link");
+	const parsed = LinkTargetSchema.safeParse(link);
+	return parsed.success ? parsed.data : void 0;
+}
+var LinkTargetSchema = object({
+	cap: string().min(1),
+	kind: string().min(1).optional()
+});
+/** The links a kind declares, read from the meta of its body fields. */
+function linksOfKind(kind) {
+	const schema = kind.schema;
+	if (!(schema instanceof ZodObject)) return [];
+	const links = [];
+	for (const [field, fieldSchema] of Object.entries(schema.shape)) {
+		const to = linkTargetOf(globalRegistry.get(fieldSchema));
+		if (to !== void 0) links.push({
+			field,
+			to
+		});
+	}
+	return links;
 }
-/** Every scope, in the order the guard and the docs list them. */
-var SCOPED_SETTINGS_SCOPES = [
-	"cluster",
-	"device-defaults",
-	"node"
-];
 /**
 * The address of one keychain value: `secret://<owner>/<scope>/<fieldPath>`.
 *
@@ -6930,6 +6946,652 @@ function parseSecretRef(ref) {
 		fieldPath
 	};
 }
+/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
+/** The files a kind may live in. `history` is device-history's (D850), never records. */
+var RECORD_DATABASES = ["settings", "events"];
+/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
+var RECORD_CLASSES = [
+	"config",
+	"ledger",
+	"audit",
+	"mirror",
+	"ephemeral"
+];
+var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
+var RECORD_MAX_DATA_BYTES = 1024 * 1024;
+var RECORD_BATCH_MAX = 1e3;
+var RECORD_QUERY_MAX = 1e3;
+/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
+var RECORD_SETTINGS_MAX_ROWS = 5e4;
+/** The `Column`-free proof prefix: a ref collection for a kind's secret fields. */
+var RECORD_SECRET_COLLECTION_PREFIX = "records:";
+/**
+* Secret fields of a record, addressed the way a Zod schema declares them
+* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
+* (`auth.accessToken`, `headers[].value`).
+*
+* `{}` after a key means "each value of this map" (`applianceSecrets{}`): the map's own key
+* names the value (`applianceSecrets{fridge}`), so no id key is declared and a body that drops a
+* key releases exactly that key's secret.
+*
+* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
+* `{ headers: 'name' }`), never by index, so reordering a list keeps every
+* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
+* leaf names its element: `headers[X-Api].value`.
+*
+* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
+*/
+/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
+function parseSecretPath(path) {
+	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
+	return path.split(".").map((raw) => {
+		const each = raw.endsWith("[]");
+		const map = raw.endsWith("{}");
+		const key = each || map ? raw.slice(0, -2) : raw;
+		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
+		return {
+			key,
+			each,
+			map
+		};
+	});
+}
+/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
+function secretArrayPrefixes(path) {
+	const segments = parseSecretPath(path);
+	const prefixes = [];
+	const walked = [];
+	for (const segment of segments) {
+		walked.push(segment.key);
+		if (segment.each) prefixes.push(walked.join("."));
+	}
+	return prefixes;
+}
+function isRecord$6(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function elementId(element, idKey, declared, prefix) {
+	const id = isRecord$6(element) ? element[idKey] : void 0;
+	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
+	return id;
+}
+/**
+* Visit every secret leaf PRESENT in `data` (an absent branch has nothing to
+* visit). `replace` returns the new leaf value, or {@link REMOVE_LEAF}; the
+* result is a new body, `data` is untouched.
+*/
+var REMOVE_LEAF = Symbol("remove-leaf");
+function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
+	if (!isRecord$6(node)) return node;
+	const segment = segments[index];
+	if (segment === void 0) return node;
+	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
+	const child = node[segment.key];
+	const keys = [...walkedKeys, segment.key];
+	const last = index === segments.length - 1;
+	if (segment.each) {
+		if (!Array.isArray(child)) return node;
+		const prefix = keys.join(".");
+		const idKey = arrayKeys[prefix];
+		if (idKey === void 0) throw new InvalidRecordError(`"${declared}": no id key declared for the array "${prefix}"`);
+		const mapped = child.map((element) => {
+			const id = elementId(element, idKey, declared, prefix);
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}[${encodeURIComponent(id)}]`;
+			return last ? element : mapAt(element, segments, index + 1, keys, concrete, declared, arrayKeys, visit);
+		});
+		return {
+			...node,
+			[segment.key]: mapped
+		};
+	}
+	if (segment.map) {
+		if (!isRecord$6(child)) return node;
+		const kept = Object.entries(child).map(([mapKey, value]) => {
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}{${encodeURIComponent(mapKey)}}`;
+			if (!last) return [mapKey, mapAt(value, segments, index + 1, keys, concrete, declared, arrayKeys, visit)];
+			return [mapKey, visit({
+				declared,
+				concrete,
+				value
+			})];
+		}).filter(([, value]) => value !== REMOVE_LEAF);
+		return {
+			...node,
+			[segment.key]: Object.fromEntries(kept)
+		};
+	}
+	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
+	if (last) {
+		const replacement = visit({
+			declared,
+			concrete,
+			value: child
+		});
+		if (replacement === REMOVE_LEAF) return Object.fromEntries(Object.entries(node).filter(([key]) => key !== segment.key));
+		return {
+			...node,
+			[segment.key]: replacement
+		};
+	}
+	return {
+		...node,
+		[segment.key]: mapAt(child, segments, index + 1, keys, concrete, declared, arrayKeys, visit)
+	};
+}
+/** Replace/remove every present secret leaf; returns a NEW body. */
+function mapSecretLeaves(data, paths, arrayKeys, visit) {
+	let current = data;
+	for (const declared of paths) current = mapAt(current, parseSecretPath(declared), 0, [], "", declared, arrayKeys, visit);
+	return current;
+}
+/** Every present secret leaf, read-only. */
+function collectSecretLeaves(data, paths, arrayKeys) {
+	const found = [];
+	mapSecretLeaves(data, paths, arrayKeys, (leaf) => {
+		found.push(leaf);
+		return leaf.value;
+	});
+	return found;
+}
+/**
+* The keychain collection name a kind's secrets live under. Prefixed so a
+* record's refs never collide with the refs a legacy collection of the same name
+* already holds during an adoption.
+*/
+function recordSecretCollection(kind) {
+	return `${RECORD_SECRET_COLLECTION_PREFIX}${kind}`;
+}
+/** The ONE ref a row's secret field may carry: the engine and the facade both build it here. */
+function recordSecretRef(owner, kind, rowId, concretePath) {
+	return buildSecretRef({
+		owner,
+		scope: {
+			kind: "row",
+			collection: recordSecretCollection(kind),
+			rowId
+		},
+		fieldPath: concretePath
+	});
+}
+/**
+* A stored secret, as an admin read shows it: a VIEW naming the row's own
+* keychain ref (`set: true`), never the value and no longer the bare redaction
+* token. The form hands it to the secret field, which reveals the value by ref
+* through the audited `keychain-admin.reveal`; sent back untouched it keeps the
+* stored secret (the records door reads a view as KEEP).
+*
+* ONE implementation for the entries service and for every addon that serves
+* its own instances (`RecordIntegrationInstances`).
+*/
+function isRecord$5(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function secretViewsOf(owner, kind, id, decl, data) {
+	if (decl.secretPaths.length === 0) return data;
+	const shown = mapSecretLeaves(data, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
+		if (leaf.value !== "__camstack_redacted__") return leaf.value;
+		return {
+			$secret: recordSecretRef(owner, kind, id, leaf.concrete),
+			v: 1,
+			set: true
+		};
+	});
+	return isRecord$5(shown) ? shown : data;
+}
+/** The most instances one addon lists (an integrations page, not a table). */
+var INSTANCES_LIST_MAX = 1e3;
+/**
+* The ONE reader of an instance's switch (D996): an absent field means on, so a row written
+* before the field existed needs no migration. Every consumer of an instance body asks this.
+*/
+function isInstanceEnabled(body) {
+	return body.enabled !== false;
+}
+/** The body key of the switch; only {@link RecordIntegrationInstances.setInstanceEnabled} writes it. */
+var SWITCH_KEY = "enabled";
+/** The keys of the kind's secret fields that sit at the top level of the body. */
+function topLevelSecretKeys(paths) {
+	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[") && !p.includes("{")));
+}
+/** The keys of the kind's top-level MAPS whose values are secrets (`applianceSecrets{}`). */
+function secretMapKeys(paths) {
+	return new Set(paths.filter((p) => p.endsWith("{}") && !p.slice(0, -2).match(/[.[{]/)).map((p) => p.slice(0, -2)));
+}
+/**
+* A patch value for a map of secrets: an entry that is omitted, `''`, the redaction token or the
+* view the form was given KEEPS its stored secret (it is left out of the merge); `{ $secretClear }`
+* or `null` removes the entry; any other string replaces it. Null when nothing is left to merge.
+*/
+function secretMapPatch(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) if (entry === null || isSecretClear(entry)) out[key] = null;
+	else if (typeof entry === "string" && entry !== "" && entry !== "__camstack_redacted__" && !isSecretFieldView(entry)) out[key] = entry;
+	return Object.keys(out).length > 0 ? out : null;
+}
+var RecordIntegrationInstances = class {
+	records;
+	kind;
+	hooks;
+	handle;
+	secretKeys;
+	secretMaps;
+	nameField;
+	switchListeners = /* @__PURE__ */ new Set();
+	constructor(records, kind, hooks) {
+		this.records = records;
+		this.kind = kind;
+		this.hooks = hooks;
+		this.handle = records.kind(kind);
+		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
+		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
+		this.nameField = kind.declaration.entry?.nameField ?? "name";
+	}
+	/**
+	* One instance read for the addon's own runtime; null when absent. When the keychain is
+	* locked the row is served WITHOUT its secrets and says so (`secrets: 'unavailable'`), so the
+	* caller can keep what it had instead of reconfiguring with an empty secret (D49).
+	*/
+	async readResolved(id) {
+		try {
+			const record = await this.handle.getResolved(id);
+			return record === null ? null : {
+				id,
+				body: record.data,
+				enabled: isInstanceEnabled(record.data),
+				secrets: "resolved"
+			};
+		} catch (err) {
+			if (!(err instanceof RecordSecretUnavailableError)) throw err;
+			const stored = await this.handle.get(id);
+			if (stored === null) return null;
+			return {
+				id,
+				body: Object.fromEntries(Object.entries(stored.data).filter(([key]) => !this.secretKeys.has(key))),
+				enabled: isInstanceEnabled(stored.data),
+				secrets: "unavailable"
+			};
+		}
+	}
+	/** The body of {@link readResolved} alone; a locked keychain yields the row without secrets. */
+	async getResolved(id) {
+		return (await this.readResolved(id))?.body ?? null;
+	}
+	/** Every instance, secrets resolved where the keychain allows; an absent one is skipped. */
+	async listResolved() {
+		const page = await this.handle.query({ limit: INSTANCES_LIST_MAX });
+		const out = [];
+		for (const record of page.records) {
+			const read = await this.readResolved(record.id);
+			if (read !== null) out.push(read);
+		}
+		return out;
+	}
+	viewOf(record) {
+		const shown = secretViewsOf(this.records.owner, this.kind.name, record.id, this.kind.declaration, record.data);
+		const rawName = record.data[this.nameField];
+		const kind = this.hooks.kindOf?.(record.data);
+		const health = this.hooks.health?.(record.data, record.id);
+		return {
+			id: record.id,
+			name: typeof rawName === "string" ? rawName : record.id,
+			configured: this.hooks.configured(record.data),
+			enabled: isInstanceEnabled(record.data),
+			formValues: shown,
+			...kind !== void 0 ? { kind } : {},
+			...health?.status !== void 0 ? { status: health.status } : {},
+			...health?.lastCheckedAt !== void 0 ? { lastCheckedAt: health.lastCheckedAt } : {}
+		};
+	}
+	describe = async () => {
+		const declared = linksOfKind(this.kind);
+		const links = this.hooks.description.links !== void 0 || declared.length === 0 ? {} : { links: declared.map((link) => ({
+			kind: this.kind.name,
+			field: link.field,
+			to: link.to
+		})) };
+		return {
+			...this.hooks.description,
+			...links,
+			...this.hooks.mintId === void 0 ? {} : { mintsId: true }
+		};
+	};
+	instanceFormSchema = async ({ id }) => this.hooks.formSchema(id);
+	listInstances = async () => {
+		return (await this.handle.query({ limit: INSTANCES_LIST_MAX })).records.map((record) => this.viewOf(record));
+	};
+	getInstance = async ({ id }) => {
+		const record = await this.handle.get(id);
+		return record === null ? null : this.viewOf(record);
+	};
+	/** Insert ONE row (`ifRev: 0`: an existing id is refused, never overwritten). */
+	createInstance = async ({ id, name, kind, values }) => {
+		const minted = id ?? this.hooks.mintId?.({
+			name,
+			...kind !== void 0 ? { kind } : {}
+		});
+		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
+		await this.handle.put({
+			id: minted,
+			data: this.hooks.initialBody(name, kind)
+		}, { ifRev: 0 });
+		const patch = this.patchOf(values ?? {});
+		if (Object.keys(patch).length > 0) await this.handle.patch(minted, patch);
+		await this.hooks.onChanged?.(minted, "created");
+		return { id: minted };
+	};
+	updateInstance = async ({ id, name, values }) => {
+		const patch = this.patchOf(values);
+		if (name !== void 0) patch[this.nameField] = name;
+		await this.handle.patch(id, patch);
+		await this.hooks.onChanged?.(id, "updated");
+		return { ok: true };
+	};
+	/** The record patch a form `values` object means: secrets kept, cleared or replaced. */
+	patchOf(values) {
+		const patch = {};
+		for (const [key, value] of Object.entries(values)) {
+			if (value === void 0) continue;
+			if (key === "enabled") continue;
+			if (this.secretMaps.has(key)) {
+				const entries = secretMapPatch(value);
+				if (entries !== null) patch[key] = entries;
+			} else if (!this.secretKeys.has(key)) patch[key] = value;
+			else if (isSecretClear(value)) patch[key] = null;
+			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
+		}
+		return patch;
+	}
+	/**
+	* Listen to the switch of ANY instance of this helper (in the process that serves it). The
+	* durable replacement of the `integration.enabled` / `integration.disabled` events (D8): the
+	* addon reconciles from the record, whichever way it flipped.
+	*/
+	onSwitched(listener) {
+		this.switchListeners.add(listener);
+	}
+	/**
+	* The ONE writer of the switch (D996, D1014): the record body's `enabled`, for every role. A
+	* configured thing is an instance, so an id with no record yet (a default integration that was
+	* never configured) gets its record from `initialBody` before the switch is written.
+	*/
+	setInstanceEnabled = async ({ id, enabled }) => {
+		if (await this.handle.get(id) === null) await this.handle.put({
+			id,
+			data: this.hooks.initialBody(id)
+		}, { ifRev: 0 });
+		await this.handle.patch(id, { [SWITCH_KEY]: enabled });
+		await this.hooks.onChanged?.(id, "enabled");
+		for (const listener of this.switchListeners) await listener(id, enabled);
+		return { ok: true };
+	};
+	/** The row and its keychain refs go together (the records door). */
+	deleteInstance = async ({ id }) => {
+		await this.handle.delete(id);
+		await this.hooks.onChanged?.(id, "deleted");
+		return { ok: true };
+	};
+	testInstance = async (input) => {
+		if (this.hooks.test === void 0) return {
+			success: false,
+			status: "unsupported",
+			error: "This integration declares no connection test"
+		};
+		return this.hooks.test(input);
+	};
+	/** The flat provider object to hand to `registerProvider`. */
+	toProvider() {
+		return {
+			describe: this.describe,
+			instanceFormSchema: this.instanceFormSchema,
+			listInstances: this.listInstances,
+			getInstance: this.getInstance,
+			createInstance: this.createInstance,
+			updateInstance: this.updateInstance,
+			setInstanceEnabled: this.setInstanceEnabled,
+			deleteInstance: this.deleteInstance,
+			testInstance: this.testInstance
+		};
+	}
+};
+/**
+* The one-switch migration (epic #440, step 3). An integration's on/off state used to live in the
+* registry's `enabled` column for a device addon; it now lives only in the instance record's
+* body (`enabled`, D1007 superseded). This moves a registry `enabled = false` into the body, once.
+*
+* For every registry row of the addon that is OFF:
+*  - no record under its id: the record is created from `initialBody(name)` with `enabled: false`
+*    (a default integration that never had settings, Reolink's among them);
+*  - a record whose body states no `enabled`: `enabled: false` is written into it;
+*  - a record that already states `enabled` (either way) is the newer truth and is left alone.
+* A row that is ON writes nothing: an absent field reads as on. A rerun finds every off row with
+* a stated switch and does nothing, so nothing switched off comes back on and nothing switched on
+* goes off. The registry column itself is neither read afterwards nor written; its drop is step 5.
+*
+* It runs in the addon process, BEFORE the addon registers its `integration-instances` provider,
+* which is also why `integrations.list` still answers the stored column at that point.
+*/
+function registrySwitchToBodyId(addonId, date) {
+	return `${addonId}/${date}-registry-switch-to-body`;
+}
+async function moveRegistrySwitchToBody(ports, spec) {
+	const rows = await ports.listIntegrations(spec.addonId);
+	let created = 0;
+	let switched = 0;
+	let kept = 0;
+	for (const row of rows) {
+		if (row.enabled) continue;
+		const body = await ports.readBody(row.id);
+		if (body === null) {
+			if (await ports.createRecord(row.id, {
+				...spec.initialBody(row.name),
+				["enabled"]: false
+			}) === "created") created += 1;
+			else kept += 1;
+			continue;
+		}
+		if ("enabled" in body) {
+			kept += 1;
+			continue;
+		}
+		await ports.switchOff(row.id);
+		switched += 1;
+	}
+	const summary = {
+		integrations: rows.length,
+		off: rows.filter((r) => !r.enabled).length,
+		created,
+		switched,
+		kept
+	};
+	return created === 0 && switched === 0 ? {
+		outcome: "already-done",
+		summary
+	} : {
+		outcome: "done",
+		summary
+	};
+}
+/** A migration entry: an addon states its kind and how a new body starts, nothing else. */
+function registrySwitchToBodyMigration(spec) {
+	return {
+		meta: {
+			id: registrySwitchToBodyId(spec.addonId, spec.date),
+			owner: spec.addonId,
+			level: "addon-state",
+			seq: spec.seq,
+			dependsOn: [],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "block-owner",
+			bodyKind: "procedure",
+			description: "Move the registry enabled flag of every switched-off integration into its instance record body, creating the record when there is none",
+			fixtureMark: "enabled"
+		},
+		procedure: (ports) => moveRegistrySwitchToBody(ports, {
+			addonId: spec.addonId,
+			initialBody: spec.initialBody
+		})
+	};
+}
+/** The hub and records sides of {@link registrySwitchToBodyMigration}. */
+function registrySwitchPortsOver(deps) {
+	const handle = deps.records.kind({
+		name: deps.kind.name,
+		declaration: deps.kind.declaration,
+		schema: record(string(), unknown())
+	});
+	return {
+		listIntegrations: async (addonId) => (await deps.api.list()).filter((i) => i.addonId === addonId).map((i) => ({
+			id: i.id,
+			name: i.name,
+			enabled: i.enabled !== false
+		})),
+		readBody: async (id) => (await handle.get(id))?.data ?? null,
+		createRecord: async (id, body) => {
+			if (await handle.get(id) !== null) return "exists";
+			await handle.put({
+				id,
+				data: body
+			}, { ifRev: 0 });
+			return "created";
+		},
+		switchOff: async (id) => {
+			await handle.patch(id, { [SWITCH_KEY]: false });
+		}
+	};
+}
+/**
+* Build a {@link DurableState} over a single store key. Transport-agnostic:
+* `read`/`write` are the addon-store or device-store accessors. The whole
+* validated value round-trips on every read/write — the schema is the
+* single source of truth for what is persisted, so no hand-listed field
+* set can drop a key on save.
+*/
+function createDurableState(deps) {
+	const get = async () => {
+		const raw = (await deps.read())[deps.key];
+		if (raw === void 0) return deps.fallback;
+		const parsed = deps.schema.safeParse(raw);
+		if (!parsed.success) {
+			deps.onParseError?.(deps.key, parsed.error);
+			return deps.fallback;
+		}
+		return parsed.data;
+	};
+	const set = async (next) => {
+		const validated = deps.schema.parse(next);
+		await deps.write({ [deps.key]: validated });
+	};
+	const update = async (fn) => {
+		await set(fn(await get()));
+	};
+	return {
+		get,
+		set,
+		update
+	};
+}
+/**
+* Per-node scoping for the shared addon-settings blob.
+*
+* An addon's settings store is hub-central (the `addon-settings` cap is
+* hub-routed — the hub instance answers for every node), so fields whose
+* value is a NODE fact (decoder backend, engine pick, probed hardware
+* capabilities) persist under the node-scoped key `<key>@<nodeId>` inside
+* the single shared blob. The SCHEMA field key stays bare: the write path
+* ({@link scopePatch}) maps the bare field onto the target node's scoped
+* key; the read/hydrate path ({@link projectStore}) maps THIS node's value
+* back, so UI forms and `resolveConfig` only ever see the bare key.
+*
+* Fields opt in via the `perNode: true` schema marker on `ConfigFieldBase`
+* (`interfaces/config-ui.ts`); `BaseAddon` derives the key set from the
+* schema and routes reads/writes through these helpers.
+*
+* ## No bare-key fallback — deliberate
+*
+* {@link readNodeValue} reads the node-scoped key ONLY. A node with no
+* scoped key resolves to `undefined` so the field's schema `default` wins —
+* NEVER `store[base]` and never another node's value. A bare legacy key in
+* the store is invisible to every node, hub included, so one node's
+* selection can never leak onto another. (This generalizes the
+* `decoder-backend-keys.ts` semantics — the no-fallback variant — over an
+* arbitrary set of per-node field keys.)
+*
+* Pure functions only — no I/O, no imports beyond the language. This is a
+* LEAF module: import it via its deep path, never from the root barrel.
+*/
+/**
+* Normalize a raw kernel node id to the bare node id used for scoping.
+* `localNodeId` can carry a `<node>/<addon>` suffix on forked child
+* processes; per-node settings are per-NODE, so strip the addon segment.
+* `undefined` / `null` / empty falls back to `'hub'`.
+*/
+function normalizeNodeId(raw) {
+	if (raw === void 0 || raw === null || raw === "") return "hub";
+	const slashIdx = raw.indexOf("/");
+	if (slashIdx < 0) return raw;
+	const bare = raw.slice(0, slashIdx);
+	return bare === "" ? "hub" : bare;
+}
+/** The node-scoped store key for a per-node field: `<base>@<nodeId>`. */
+function nodeScopedKey(base, nodeId) {
+	return `${base}@${normalizeNodeId(nodeId)}`;
+}
+/**
+* Read a node's value for a per-node field from the raw shared store:
+* the node-scoped key when present, otherwise `undefined`.
+* Deliberately NO bare-key fallback (see module doc) — the caller lets the
+* schema `default` win on `undefined`.
+*/
+function readNodeValue(store, base, nodeId) {
+	return store[nodeScopedKey(base, nodeId)];
+}
+/**
+* Re-map a UI/settings patch so every bare perNode field persists under the
+* TARGET node's scoped key; all other keys pass through unchanged. Used on
+* the write path so a save for one node never clobbers another node's value
+* (and the bare key is never written). Returns a new object — the input
+* patch is not mutated.
+*/
+function scopePatch(patch, perNodeKeys, nodeId) {
+	const out = {};
+	for (const [key, value] of Object.entries(patch)) out[perNodeKeys.has(key) ? nodeScopedKey(key, nodeId) : key] = value;
+	return out;
+}
+/**
+* Project the raw shared store onto the bare schema keys for ONE node so a
+* UI schema (whose field keys are bare) hydrates from that node's own
+* values:
+*
+* - EVERY `@`-scoped key (any node's) is dropped from the pass-through.
+* - Every bare perNode key is dropped from the pass-through (a stray bare
+*   legacy key must never hydrate any node — no bare fallback).
+* - THIS node's effective value ({@link readNodeValue}) is then laid onto
+*   each bare perNode key; when the node has no scoped key the bare key is
+*   left ABSENT so the field's schema `default` wins.
+*
+* Returns a new object — the input store is not mutated.
+*/
+function projectStore(store, perNodeKeys, nodeId) {
+	const out = {};
+	for (const [key, value] of Object.entries(store)) {
+		if (key.includes("@")) continue;
+		if (perNodeKeys.has(key)) continue;
+		out[key] = value;
+	}
+	for (const base of perNodeKeys) {
+		const value = readNodeValue(store, base, nodeId);
+		if (value !== void 0) out[base] = value;
+	}
+	return out;
+}
+/** Every scope, in the order the guard and the docs list them. */
+var SCOPED_SETTINGS_SCOPES = [
+	"cluster",
+	"device-defaults",
+	"node"
+];
 /** A write to a secret path could not be stored in the keychain, so it was refused. */
 var KeychainWriteRefusedError = class extends Error {
 	fieldPath;
@@ -6940,7 +7602,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$6(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -6953,7 +7615,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$6(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$4(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -7008,7 +7670,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$6) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$4) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -7024,7 +7686,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$6(row)) {
+		if (!isRecord$4(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -7049,7 +7711,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$6(incoming)) {
+			if (!isRecord$4(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -7057,7 +7719,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$6(stored) ? stored : {};
+			const storedObj = isRecord$4(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -7180,7 +7842,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$6(v)) {
+		if (isRecord$4(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -7212,7 +7874,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord$5(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -7241,7 +7903,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord$5(item) && isRecord$5(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$3(item) && isRecord$3(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -7252,7 +7914,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord$5(value) && isRecord$5(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$3(value) && isRecord$3(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -7260,7 +7922,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord$5(incoming) || !isRecord$5(stored)) return incoming;
+	if (!isRecord$3(incoming) || !isRecord$3(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -7291,7 +7953,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord$5(a) && isRecord$5(b)) {
+	if (isRecord$3(a) && isRecord$3(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -7315,7 +7977,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord$5(value)) return null;
+	if (!isRecord$3(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -7610,6 +8272,28 @@ var SECRET_RETRY_MAX_MS = 5 * 6e4;
 /** Coalesces a burst of `keychain.changed` events into one re-resolve. */
 var SECRET_CHANGE_DEBOUNCE_MS = 250;
 /**
+* Pair a catalogue with the function that builds its ports FROM THE MIGRATION API. The one
+* place a catalogue is bound: a migration reaches nothing a ports binder cannot reach
+* through `api` (guard `check-migration-ports-surface`).
+*/
+function migrationSet(catalogue, bindPorts) {
+	return { bind: (api) => defineAddonMigrations(catalogue, bindPorts(api)) };
+}
+/** A mixed array is a mistake: the other kind would be dropped without a word. */
+function refuseMixed(form, kept, dropped) {
+	if (dropped > 0) throw new Error(`runMigrations(${form}): ${dropped} of ${kept + dropped} entries are of the other kind and would be dropped; pass one kind per call`);
+}
+function catalogueOf(list) {
+	const kept = list.filter((entry) => !("execute" in entry));
+	refuseMixed("catalogue, (api) => ports", kept.length, list.length - kept.length);
+	return kept;
+}
+function boundOf(list) {
+	const kept = list.filter((entry) => "execute" in entry);
+	refuseMixed("bound migrations", kept.length, list.length - kept.length);
+	return kept;
+}
+/**
 * Base class for CamStack addons. Eliminates settings boilerplate:
 *
 * - Typed `config` property with automatic resolution from store + defaults
@@ -7776,29 +8460,62 @@ var BaseAddon = class {
 		await this.loadScopedSchemas();
 		return normalized;
 	}
+	async runMigrations(first, second, third) {
+		if (typeof second === "function") return this.runMigrationSets([migrationSet(catalogueOf(first), second)], third);
+		return this.runBound(boundOf(first), second);
+	}
 	/**
-	* Run this addon's migration catalogue (D987 M3) through the hub's `migrations`
-	* engine. Call it at the point of the boot where the data must already have the new
-	* shape — `onInitialize`, or `onRestoreDevices` for a migration that needs the
-	* restored devices — with the catalogue bound to the addon's ports
-	* (`defineAddonMigrations(ADDON_MIGRATIONS, ports)`).
-	*
-	* An engine that cannot be reached or refuses the catalogue is logged and runs
-	* nothing; the boot continues. A migration that FAILED (or was blocked by one)
-	* and declares `onFailure: 'block-owner'` makes this throw, so the addon does not
-	* serve data whose shape it cannot trust; `tolerate` migrations never do.
-	*
-	* ALWAYS pass the whole catalogue; a phase that must run only some of it passes
-	* `{ only: [ids] }` — never a filtered catalogue (the engine would judge the
-	* omitted applied ids "newer").
+	* Several catalogues of ONE owner in one declaration (the engine replaces an owner's
+	* catalogue on every declare, so two calls would each judge the other's ids "newer").
+	* Build each entry with `migrationSet(catalogue, (api) => ports)`.
 	*/
-	async runMigrations(migrations, options) {
+	async runMigrationSets(sets, options) {
+		const api = this.ctx.migrationApi;
+		if (api === void 0) throw new Error(`${this.ctx.id}: the migration API is not available on this context`);
+		return this.runBound(sets.flatMap((set) => set.bind(api)), options);
+	}
+	/**
+	* A device addon states its instance kind once, before its migrations run, and the one-switch
+	* migration (registry `enabled` to the instance body, epic #440 step 3) joins whatever
+	* catalogue the addon runs, in the SAME declaration (the engine replaces an owner's catalogue
+	* on every declare).
+	*/
+	declareRegistrySwitch(spec) {
+		this.registrySwitchSpec = spec;
+	}
+	registrySwitchSpec = null;
+	registrySwitchBound() {
+		const spec = this.registrySwitchSpec;
+		if (spec === null) return [];
+		const api = this.ctx.migrationApi;
+		if (api === void 0) {
+			this.ctx.logger.warn("the registry switch migration is skipped: the migration API is not available on this context");
+			return [];
+		}
+		return migrationSet([registrySwitchToBodyMigration({
+			addonId: this.ctx.id,
+			date: "2026-11-06",
+			seq: 1e3,
+			initialBody: spec.initialBody
+		})], (a) => registrySwitchPortsOver({
+			api: integrationRowsApiOver(a),
+			records: switchRecordsOverMigrationApi(a),
+			kind: spec.kind
+		})).bind(api);
+	}
+	async runBound(declared, options) {
+		const added = this.registrySwitchBound();
+		const migrations = [...declared, ...added];
+		const phased = options?.only === void 0 || added.length === 0 ? options : {
+			...options,
+			only: [...options.only, ...added.map((m) => m.meta.id)]
+		};
 		const api = this.ctx.api.migrations;
 		const report = await runAddonMigrations({
 			declareOwner: (input) => api.declareOwner.mutate(input),
 			startMigration: (input) => api.startMigration.mutate(input),
 			finishMigration: (input) => api.finishMigration.mutate(input)
-		}, migrations, this.ctx.logger, options);
+		}, migrations, this.ctx.logger, phased);
 		if (report.blockOwner.length > 0) throw new AddonMigrationsBlockedError(report.blockOwner);
 		return report;
 	}
@@ -8871,237 +9588,6 @@ function normalizeAddonInitResult(result) {
 	if (Array.isArray(result)) return { providers: result };
 	return result;
 }
-var PREFIX = "records/";
-/** The base of every records failure. `detail` is the human part of the message. */
-var RecordsError = class extends Error {
-	code;
-	detail;
-	constructor(code, detail) {
-		super(`${PREFIX}${code}: ${detail}`);
-		this.name = "RecordsError";
-		this.code = code;
-		this.detail = detail;
-	}
-};
-/** A write guarded by `ifRev` found another revision (or an existing row for `ifRev: 0`). */
-var RevConflictError = class extends RecordsError {
-	constructor(detail) {
-		super("rev-conflict", detail);
-		this.name = "RevConflictError";
-	}
-};
-/** The keychain could not store or serve a value: explicit, never an empty string. */
-var RecordSecretUnavailableError = class extends RecordsError {
-	constructor(detail) {
-		super("secret-unavailable", detail);
-		this.name = "RecordSecretUnavailableError";
-	}
-};
-var InvalidRecordError = class extends RecordsError {
-	constructor(detail) {
-		super("invalid-record", detail);
-		this.name = "InvalidRecordError";
-	}
-};
-/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
-var DeclarationRefusedError = class extends RecordsError {
-	constructor(detail) {
-		super("declaration-refused", detail);
-		this.name = "DeclarationRefusedError";
-	}
-};
-/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
-/** The files a kind may live in. `history` is device-history's (D850), never records. */
-var RECORD_DATABASES = ["settings", "events"];
-/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
-var RECORD_CLASSES = [
-	"config",
-	"ledger",
-	"audit",
-	"mirror",
-	"ephemeral"
-];
-var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
-var RECORD_MAX_DATA_BYTES = 1024 * 1024;
-var RECORD_BATCH_MAX = 1e3;
-var RECORD_QUERY_MAX = 1e3;
-/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
-var RECORD_SETTINGS_MAX_ROWS = 5e4;
-/** The `Column`-free proof prefix: a ref collection for a kind's secret fields. */
-var RECORD_SECRET_COLLECTION_PREFIX = "records:";
-/**
-* Secret fields of a record, addressed the way a Zod schema declares them
-* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
-* (`auth.accessToken`, `headers[].value`).
-*
-* `{}` after a key means "each value of this map" (`applianceSecrets{}`): the map's own key
-* names the value (`applianceSecrets{fridge}`), so no id key is declared and a body that drops a
-* key releases exactly that key's secret.
-*
-* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
-* `{ headers: 'name' }`), never by index, so reordering a list keeps every
-* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
-* leaf names its element: `headers[X-Api].value`.
-*
-* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
-*/
-/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
-function parseSecretPath(path) {
-	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
-	return path.split(".").map((raw) => {
-		const each = raw.endsWith("[]");
-		const map = raw.endsWith("{}");
-		const key = each || map ? raw.slice(0, -2) : raw;
-		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
-		return {
-			key,
-			each,
-			map
-		};
-	});
-}
-/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
-function secretArrayPrefixes(path) {
-	const segments = parseSecretPath(path);
-	const prefixes = [];
-	const walked = [];
-	for (const segment of segments) {
-		walked.push(segment.key);
-		if (segment.each) prefixes.push(walked.join("."));
-	}
-	return prefixes;
-}
-function isRecord$4(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function elementId(element, idKey, declared, prefix) {
-	const id = isRecord$4(element) ? element[idKey] : void 0;
-	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
-	return id;
-}
-/**
-* Visit every secret leaf PRESENT in `data` (an absent branch has nothing to
-* visit). `replace` returns the new leaf value, or {@link REMOVE_LEAF}; the
-* result is a new body, `data` is untouched.
-*/
-var REMOVE_LEAF = Symbol("remove-leaf");
-function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
-	if (!isRecord$4(node)) return node;
-	const segment = segments[index];
-	if (segment === void 0) return node;
-	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
-	const child = node[segment.key];
-	const keys = [...walkedKeys, segment.key];
-	const last = index === segments.length - 1;
-	if (segment.each) {
-		if (!Array.isArray(child)) return node;
-		const prefix = keys.join(".");
-		const idKey = arrayKeys[prefix];
-		if (idKey === void 0) throw new InvalidRecordError(`"${declared}": no id key declared for the array "${prefix}"`);
-		const mapped = child.map((element) => {
-			const id = elementId(element, idKey, declared, prefix);
-			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}[${encodeURIComponent(id)}]`;
-			return last ? element : mapAt(element, segments, index + 1, keys, concrete, declared, arrayKeys, visit);
-		});
-		return {
-			...node,
-			[segment.key]: mapped
-		};
-	}
-	if (segment.map) {
-		if (!isRecord$4(child)) return node;
-		const kept = Object.entries(child).map(([mapKey, value]) => {
-			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}{${encodeURIComponent(mapKey)}}`;
-			if (!last) return [mapKey, mapAt(value, segments, index + 1, keys, concrete, declared, arrayKeys, visit)];
-			return [mapKey, visit({
-				declared,
-				concrete,
-				value
-			})];
-		}).filter(([, value]) => value !== REMOVE_LEAF);
-		return {
-			...node,
-			[segment.key]: Object.fromEntries(kept)
-		};
-	}
-	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
-	if (last) {
-		const replacement = visit({
-			declared,
-			concrete,
-			value: child
-		});
-		if (replacement === REMOVE_LEAF) return Object.fromEntries(Object.entries(node).filter(([key]) => key !== segment.key));
-		return {
-			...node,
-			[segment.key]: replacement
-		};
-	}
-	return {
-		...node,
-		[segment.key]: mapAt(child, segments, index + 1, keys, concrete, declared, arrayKeys, visit)
-	};
-}
-/** Replace/remove every present secret leaf; returns a NEW body. */
-function mapSecretLeaves(data, paths, arrayKeys, visit) {
-	let current = data;
-	for (const declared of paths) current = mapAt(current, parseSecretPath(declared), 0, [], "", declared, arrayKeys, visit);
-	return current;
-}
-/** Every present secret leaf, read-only. */
-function collectSecretLeaves(data, paths, arrayKeys) {
-	const found = [];
-	mapSecretLeaves(data, paths, arrayKeys, (leaf) => {
-		found.push(leaf);
-		return leaf.value;
-	});
-	return found;
-}
-/**
-* The keychain collection name a kind's secrets live under. Prefixed so a
-* record's refs never collide with the refs a legacy collection of the same name
-* already holds during an adoption.
-*/
-function recordSecretCollection(kind) {
-	return `${RECORD_SECRET_COLLECTION_PREFIX}${kind}`;
-}
-/** The ONE ref a row's secret field may carry: the engine and the facade both build it here. */
-function recordSecretRef(owner, kind, rowId, concretePath) {
-	return buildSecretRef({
-		owner,
-		scope: {
-			kind: "row",
-			collection: recordSecretCollection(kind),
-			rowId
-		},
-		fieldPath: concretePath
-	});
-}
-/**
-* A stored secret, as an admin read shows it: a VIEW naming the row's own
-* keychain ref (`set: true`), never the value and no longer the bare redaction
-* token. The form hands it to the secret field, which reveals the value by ref
-* through the audited `keychain-admin.reveal`; sent back untouched it keeps the
-* stored secret (the records door reads a view as KEEP).
-*
-* ONE implementation for the entries service and for every addon that serves
-* its own instances (`RecordIntegrationInstances`).
-*/
-function isRecord$3(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function secretViewsOf(owner, kind, id, decl, data) {
-	if (decl.secretPaths.length === 0) return data;
-	const shown = mapSecretLeaves(data, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
-		if (leaf.value !== "__camstack_redacted__") return leaf.value;
-		return {
-			$secret: recordSecretRef(owner, kind, id, leaf.concrete),
-			v: 1,
-			set: true
-		};
-	});
-	return isRecord$3(shown) ? shown : data;
-}
 /**
 * The share-view scope kinds a share-link token can carry. The hub mints
 * and validates them (`ShareViewGrantSchema` builds its
@@ -9355,6 +9841,7 @@ function defineRecordKinds(specs) {
 function entryBody(shape) {
 	return object({
 		name: string().min(1),
+		enabled: boolean().optional(),
 		...shape
 	});
 }
@@ -11220,6 +11707,10 @@ Object.freeze({
 				"all",
 				"one"
 			]
+		},
+		{
+			"path": "positionUpdatedAt",
+			"valueType": "number"
 		}
 	],
 	"meter": [{
@@ -11474,22 +11965,6 @@ Object.freeze({
 			"path": "pumpRunning",
 			"valueType": "boolean"
 		},
-		{
-			"path": "lastDrink",
-			"valueType": "number"
-		},
-		{
-			"path": "currentHourDrink",
-			"valueType": "number"
-		},
-		{
-			"path": "last24hDrink",
-			"valueType": "number"
-		},
-		{
-			"path": "todayDrink",
-			"valueType": "number"
-		},
 		{
 			"path": "error",
 			"valueType": "string"
@@ -12055,12 +12530,66 @@ Object.freeze({
 		}
 	]
 });
+Object.freeze({
+	"actions": { "run": 363e4 },
+	"audio-analyzer": { "classify": 3e4 },
+	"custom-model-registry": { "importModelBundle": 18e5 },
+	"database-snapshot": { "writeSnapshot": 18e5 },
+	"device-manager": {
+		"migrateDevice": 72e4,
+		"runDiscoverySweep": 12e4
+	},
+	"device-provider": { "reloadDevice": 18e4 },
+	"llm": {
+		"generate": 6e5,
+		"generateVision": 6e5,
+		"testProfile": 6e5
+	},
+	"llm-runtime": {
+		"complete": 6e5,
+		"completeApple": 6e5,
+		"ensureStarted": 6e5,
+		"installModel": 36e5
+	},
+	"local-network": { "scanNetwork": 9e4 },
+	"model-convert": { "convert": 6e5 },
+	"pipeline-analytics": {
+		"addRetrainFrameFromRecording": 6e4,
+		"offerRetrainArchive": 12e4,
+		"proposeRetrainAnnotationsWithLlm": 18e4,
+		"resolveRetrainTrainingCorpus": 6e4,
+		"writeRetrainArchive": 36e5
+	},
+	"server-management": { "applyServerUpdate": 96e4 },
+	"terminal-session": { "pullOutput": 15e3 },
+	"training": {
+		"canaryResult": 12e4,
+		"cancelJob": 12e4,
+		"planJob": 6e4,
+		"registerResult": 18e5,
+		"rollbackCanary": 12e4,
+		"startJob": 12e4,
+		"startJobBatch": 12e4
+	},
+	"training-provider": {
+		"cancelJob": 6e4,
+		"cleanupJob": 3e5,
+		"getJob": 6e4,
+		"listJobEvents": 6e4,
+		"listJobs": 12e4,
+		"offerArtifact": 3e5,
+		"readResult": 3e5,
+		"submitJob": 18e5,
+		"uploadDataset": 72e5,
+		"validateCredentials": 3e4
+	}
+});
 object({
 	code: string().regex(/^[a-z][a-z0-9-]*(\.[a-z0-9-]+)+$/),
 	params: record(string(), union([string(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/composition-pOHbTzRB.mjs
+//#region ../types/dist/composition-BmBHuDTQ.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -12364,7 +12893,7 @@ var table = {
 	},
 	dwell: {
 		minArgs: 3,
-		maxArgs: 3,
+		maxArgs: 4,
 		apply: () => {
 			throw new ExpressionEvalError("dwell: stateful evaluation context is required");
 		}
@@ -13407,219 +13936,6 @@ var IntegrationInstanceRefSchema = object({
 	]),
 	candidateStableId: string().optional()
 });
-/**
-* `RecordIntegrationInstances` - the `integration-instances` provider over ONE
-* entry kind, so an addon that holds a connection serves it in ~30 lines.
-*
-* Every instance is one record of the addon's own kind, keyed by the
-* `integrations` registry id. The records door does the secret work: a field the
-* kind marks `.meta({ secret: true })` is a keychain marker bound to the row, so
-* deleting the row deletes the secret, and one row's value is never another's.
-*
-* Patch rules for a secret (`updateInstance`): omitted, `''`, the redaction
-* token or the view the form was given KEEP the stored secret;
-* `{ $secretClear: true }` clears it; any other string replaces it.
-*/
-/** The most instances one addon lists (an integrations page, not a table). */
-var INSTANCES_LIST_MAX = 1e3;
-/** The keys of the kind's secret fields that sit at the top level of the body. */
-function topLevelSecretKeys(paths) {
-	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[") && !p.includes("{")));
-}
-/** The keys of the kind's top-level MAPS whose values are secrets (`applianceSecrets{}`). */
-function secretMapKeys(paths) {
-	return new Set(paths.filter((p) => p.endsWith("{}") && !p.slice(0, -2).match(/[.[{]/)).map((p) => p.slice(0, -2)));
-}
-/**
-* A patch value for a map of secrets: an entry that is omitted, `''`, the redaction token or the
-* view the form was given KEEPS its stored secret (it is left out of the merge); `{ $secretClear }`
-* or `null` removes the entry; any other string replaces it. Null when nothing is left to merge.
-*/
-function secretMapPatch(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
-	const out = {};
-	for (const [key, entry] of Object.entries(value)) if (entry === null || isSecretClear(entry)) out[key] = null;
-	else if (typeof entry === "string" && entry !== "" && entry !== "__camstack_redacted__" && !isSecretFieldView(entry)) out[key] = entry;
-	return Object.keys(out).length > 0 ? out : null;
-}
-/** Does the kind's body schema carry an `enabled` field? */
-function declaresEnabled(kind) {
-	const json = toJSONSchema(kind.schema, {
-		unrepresentable: "any",
-		io: "input"
-	});
-	const properties = Reflect.get(json, "properties");
-	return typeof properties === "object" && properties !== null && "enabled" in properties;
-}
-var RecordIntegrationInstances = class {
-	records;
-	kind;
-	hooks;
-	handle;
-	secretKeys;
-	secretMaps;
-	nameField;
-	/** The `integrations` registry owns the on/off switch (`role: devices`); the body has none. */
-	registryOwnsEnabled;
-	constructor(records, kind, hooks) {
-		this.records = records;
-		this.kind = kind;
-		this.hooks = hooks;
-		this.handle = records.kind(kind);
-		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
-		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
-		this.nameField = kind.declaration.entry?.nameField ?? "name";
-		this.registryOwnsEnabled = hooks.description.role === "devices";
-		if (this.registryOwnsEnabled && declaresEnabled(kind)) throw new Error(`kind "${kind.name}": the integrations registry owns the on/off switch of a role "devices" addon, so the body must not declare "enabled"`);
-	}
-	/**
-	* One instance read for the addon's own runtime; null when absent. When the keychain is
-	* locked the row is served WITHOUT its secrets and says so (`secrets: 'unavailable'`), so the
-	* caller can keep what it had instead of reconfiguring with an empty secret (D49).
-	*/
-	async readResolved(id) {
-		try {
-			const record = await this.handle.getResolved(id);
-			return record === null ? null : {
-				id,
-				body: record.data,
-				enabled: record.data.enabled !== false,
-				secrets: "resolved"
-			};
-		} catch (err) {
-			if (!(err instanceof RecordSecretUnavailableError)) throw err;
-			const stored = await this.handle.get(id);
-			if (stored === null) return null;
-			return {
-				id,
-				body: Object.fromEntries(Object.entries(stored.data).filter(([key]) => !this.secretKeys.has(key))),
-				enabled: stored.data.enabled !== false,
-				secrets: "unavailable"
-			};
-		}
-	}
-	/** The body of {@link readResolved} alone; a locked keychain yields the row without secrets. */
-	async getResolved(id) {
-		return (await this.readResolved(id))?.body ?? null;
-	}
-	/** Every instance, secrets resolved where the keychain allows; an absent one is skipped. */
-	async listResolved() {
-		const page = await this.handle.query({ limit: INSTANCES_LIST_MAX });
-		const out = [];
-		for (const record of page.records) {
-			const read = await this.readResolved(record.id);
-			if (read !== null) out.push(read);
-		}
-		return out;
-	}
-	viewOf(record) {
-		const shown = secretViewsOf(this.records.owner, this.kind.name, record.id, this.kind.declaration, record.data);
-		const rawName = record.data[this.nameField];
-		const kind = this.hooks.kindOf?.(record.data);
-		const health = this.hooks.health?.(record.data, record.id);
-		return {
-			id: record.id,
-			name: typeof rawName === "string" ? rawName : record.id,
-			configured: this.hooks.configured(record.data),
-			...this.registryOwnsEnabled ? {} : { enabled: record.data.enabled !== false },
-			formValues: shown,
-			...kind !== void 0 ? { kind } : {},
-			...health?.status !== void 0 ? { status: health.status } : {},
-			...health?.lastCheckedAt !== void 0 ? { lastCheckedAt: health.lastCheckedAt } : {}
-		};
-	}
-	describe = async () => this.hooks.mintId === void 0 ? this.hooks.description : {
-		...this.hooks.description,
-		mintsId: true
-	};
-	/**
-	* The record an id names. A caller holding the `integrations` registry id (the Integrations
-	* page) reaches a kind whose body links to it through `integrationId`; an id that is itself a
-	* record id answers as it is. An id that names nothing comes back unchanged.
-	*/
-	async resolveRecordId(id) {
-		if (await this.handle.get(id) !== null) return id;
-		const linked = (await this.handle.query({ limit: INSTANCES_LIST_MAX })).records.find((record) => record.data["integrationId"] === id);
-		return linked === void 0 ? id : linked.id;
-	}
-	instanceFormSchema = async ({ id }) => this.hooks.formSchema(id === null ? null : await this.resolveRecordId(id));
-	listInstances = async () => {
-		return (await this.handle.query({ limit: INSTANCES_LIST_MAX })).records.map((record) => this.viewOf(record));
-	};
-	getInstance = async ({ id }) => {
-		const record = await this.handle.get(await this.resolveRecordId(id));
-		return record === null ? null : this.viewOf(record);
-	};
-	/** Insert ONE row (`ifRev: 0`: an existing id is refused, never overwritten). */
-	createInstance = async ({ id, name, kind }) => {
-		const minted = id ?? this.hooks.mintId?.({
-			name,
-			...kind !== void 0 ? { kind } : {}
-		});
-		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
-		await this.handle.put({
-			id: minted,
-			data: this.hooks.initialBody(name, kind)
-		}, { ifRev: 0 });
-		await this.hooks.onChanged?.(minted, "created");
-		return { id: minted };
-	};
-	updateInstance = async ({ id: askedId, name, values }) => {
-		const id = await this.resolveRecordId(askedId);
-		const patch = {};
-		for (const [key, value] of Object.entries(values)) {
-			if (value === void 0) continue;
-			if (this.secretMaps.has(key)) {
-				const entries = secretMapPatch(value);
-				if (entries !== null) patch[key] = entries;
-			} else if (!this.secretKeys.has(key)) patch[key] = value;
-			else if (isSecretClear(value)) patch[key] = null;
-			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
-		}
-		if (name !== void 0) patch[this.nameField] = name;
-		await this.handle.patch(id, patch);
-		await this.hooks.onChanged?.(id, "updated");
-		return { ok: true };
-	};
-	/** The switch lives in the record body; the addon is told so it applies it (D996). */
-	setInstanceEnabled = async ({ id, enabled }) => {
-		if (this.registryOwnsEnabled) throw new Error(`instance "${id}": the integrations registry owns the on/off switch of this addon; set it with integrations.update`);
-		await this.handle.patch(id, { enabled });
-		await this.hooks.onChanged?.(id, "enabled");
-		return { ok: true };
-	};
-	/** The row and its keychain refs go together (the records door). */
-	deleteInstance = async ({ id }) => {
-		await this.handle.delete(id);
-		await this.hooks.onChanged?.(id, "deleted");
-		return { ok: true };
-	};
-	testInstance = async (input) => {
-		if (this.hooks.test === void 0) return {
-			success: false,
-			status: "unsupported",
-			error: "This integration declares no connection test"
-		};
-		return this.hooks.test(input.id === null ? input : {
-			...input,
-			id: await this.resolveRecordId(input.id)
-		});
-	};
-	/** The flat provider object to hand to `registerProvider`. */
-	toProvider() {
-		return {
-			describe: this.describe,
-			instanceFormSchema: this.instanceFormSchema,
-			listInstances: this.listInstances,
-			getInstance: this.getInstance,
-			createInstance: this.createInstance,
-			updateInstance: this.updateInstance,
-			setInstanceEnabled: this.setInstanceEnabled,
-			deleteInstance: this.deleteInstance,
-			testInstance: this.testInstance
-		};
-	}
-};
 var EncodeProfileSchema = object({
 	video: object({
 		codec: _enum([
@@ -14828,25 +15144,6 @@ function integrationRowsPortsOverApi(deps) {
 		}
 	};
 }
-function defaultIntegrationApiOver(api) {
-	return {
-		list: () => api.integrations.list.query(),
-		readLegacyIntegrationRows: (input) => api.migrations.readLegacyIntegrationRows.query(input),
-		clearLegacyIntegrationRows: (input) => api.migrations.clearLegacyIntegrationRows.mutate(input),
-		listDevices: (addonId) => api.deviceManager.listAll.query({
-			addonId,
-			projection: "slim"
-		}),
-		setDeviceIntegrationId: async (deviceId, integrationId) => {
-			await api.deviceManager.setIntegrationId.mutate({
-				deviceId,
-				integrationId
-			});
-		},
-		readDeviceHasConfig: async (deviceId) => Object.keys((await api.deviceManager.getDevice.query({ deviceId }))?.config ?? {}).length > 0,
-		readDeviceIntegrationId: async (deviceId) => (await api.deviceManager.getDevice.query({ deviceId }))?.integrationId ?? null
-	};
-}
 /**
 * The trainer contract — what the hub hands the cloud trainer and what it
 * gets back (cloud training, D805+).
@@ -15935,6 +16232,39 @@ var UnstampedEventMediaCountSchema = object({
 	/** Sum across both, or `null` when either lane could not be counted. */
 	total: number().int().nonnegative().nullable()
 }).nullable();
+/**
+* Where the stored event media sits, per storage location: how many media rows
+* and how many bytes carry each location id, how many carry none (legacy,
+* resolved to the default `eventMedia` location), and how many name a location
+* that was not asked about (a deleted or never-listed one).
+*
+* One covering-index aggregate per asked location plus the NULL one, and one
+* unfiltered total that scans the covering index: O(rows), not a walk of the
+* rows themselves. `unlisted` is total minus the ASKED locations minus NULL, so
+* it is a deleted location only when every location id was asked.
+* `null` is "could not be measured", never zero.
+*/
+var MediaLocationCensusInputSchema = object({ locationIds: array(string().min(1)).max(50).readonly() });
+var MediaLocationCensusSchema = object({
+	locations: array(object({
+		locationId: string(),
+		rows: number().int().nonnegative(),
+		bytes: number().nonnegative()
+	})).readonly(),
+	unstamped: object({
+		rows: number().int().nonnegative(),
+		bytes: number().nonnegative()
+	}),
+	/** Rows stamped with a location id that was not in the asked list. */
+	unlisted: object({
+		rows: number().int().nonnegative(),
+		bytes: number().nonnegative()
+	}),
+	total: object({
+		rows: number().int().nonnegative(),
+		bytes: number().nonnegative()
+	})
+});
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
 /** The independently selectable logical storage classes — every class
 * `storage.listLocationDeclarations` reports, so an operator never meets a
@@ -19914,31 +20244,21 @@ var APPLIANCE_CAP_VOCABULARY = {
 	"pet-fountain": {
 		scope: "device",
 		noun: t("Pet fountain", "Fontana per animali"),
-		actions: [
-			{
-				id: "petFountain.pumpOn",
-				method: "setPump",
-				label: t("Pump on", "Pompa accesa"),
-				phrase: t("Start the pump of {device}", "Avvia la pompa di {device}"),
-				icon: "play",
-				args: { on: true }
-			},
-			{
-				id: "petFountain.pumpOff",
-				method: "setPump",
-				label: t("Pump off", "Pompa spenta"),
-				phrase: t("Stop the pump of {device}", "Ferma la pompa di {device}"),
-				icon: "square",
-				args: { on: false }
-			},
-			{
-				id: "petFountain.resetDailyConsumption",
-				method: "resetDailyConsumption",
-				label: t("Clear daily consumption", "Azzera il consumo giornaliero"),
-				phrase: t("Clear the daily water consumption of {device}", "Azzera il consumo giornaliero di acqua di {device}"),
-				icon: "rotate-ccw"
-			}
-		],
+		actions: [{
+			id: "petFountain.pumpOn",
+			method: "setPump",
+			label: t("Pump on", "Pompa accesa"),
+			phrase: t("Start the pump of {device}", "Avvia la pompa di {device}"),
+			icon: "play",
+			args: { on: true }
+		}, {
+			id: "petFountain.pumpOff",
+			method: "setPump",
+			label: t("Pump off", "Pompa spenta"),
+			phrase: t("Stop the pump of {device}", "Ferma la pompa di {device}"),
+			icon: "square",
+			args: { on: false }
+		}],
 		state: [{
 			kind: "boolean",
 			field: "empty",
@@ -43971,8 +44291,15 @@ var ActionInputSchema = object({
 var ActionRunOriginSchema = object({ 
 /** The automation block whose step started it. */
 blockId: string().min(1).optional() });
-/** `started` = the caller did not ask to wait. */
-var ActionRunOutcomeSchema = union([AutomationRunOutcomeSchema, literal("started")]);
+/**
+* `started` = the caller did not ask to wait. `timed-out` = the run reached the
+* ceiling (`ACTION_RUN_MAX_MS`) and was stopped; it is never a `ran`.
+*/
+var ActionRunOutcomeSchema = union([
+	AutomationRunOutcomeSchema,
+	literal("started"),
+	literal("timed-out")
+]);
 var ActionRunResultSchema = object({
 	runId: string().min(1),
 	outcome: ActionRunOutcomeSchema,
@@ -44494,6 +44821,8 @@ method(object({}), array(ActionEntrySchema), { auth: "admin" }), method(object({
 	kind: "mutation",
 	auth: "admin"
 });
+/** `timeoutMs` of `actions.run`: a waited call outlives any legal run. */
+var ACTION_RUN_TIMEOUT_MS = 363e4;
 /**
 * actions — the ONE surface for runnable actions, for the UI and for
 * automations. Provided by the core-blocks builtin on the hub.
@@ -44512,6 +44841,12 @@ method(object({}), array(ActionEntrySchema), { auth: "admin" }), method(object({
 * An admin, and an in-process caller (an automation block), may run any action.
 * Every refusal is typed (`[not-linked] …`) and logged.
 *
+* **A run lasts at most `ACTION_RUN_MAX_MS` (60 min).** The provider stops a
+* run that reaches it and answers `timed-out` (never `ran`); an action whose
+* `wait` steps alone add up to more is refused at create/update
+* (`[invalid-steps]`). `run` declares a `timeoutMs` above that ceiling, so a
+* waited call (an automation step) is never cut by the 60 s transport default.
+*
 * A second `run` of an action that is already running is REFUSED — traced and
 * logged — never queued.
 */
@@ -44538,7 +44873,8 @@ method(object({}), array(ActionEntrySchema), { auth: "admin" }), method(object({
 	role: "viewer",
 	auth: "protected",
 	kind: "mutation",
-	caller: "required"
+	caller: "required",
+	timeoutMs: ACTION_RUN_TIMEOUT_MS
 }), method(ActionIdInput, _void(), {
 	kind: "mutation",
 	auth: "admin"
@@ -47050,52 +47386,7 @@ onBrightnessChanged: { data: object({
 		minIntervalMs: 0
 	} } }
 };
-/**
-* `broker` — unified pub/sub broker registry, system-scoped collection.
-*
-* The cap models any kind-tagged message broker the user wants to
-* register and that other addons might consume. The first two kinds
-* are MQTT (mosquitto / aedes embedded / cloud bridge) and
-* Home Assistant (HA WebSocket — subscribe_entities + call_service).
-* Future kinds (Zigbee2MQTT bridge, ZHA, KNX, Telegram, …) plug in
-* the same surface.
-*
-* Why one cap, not one cap per kind:
-*   - The integrations page wants a single table of "every broker"
-*     across kinds; a unified cap drives it without join logic.
-*   - Generic admin operations (add / remove / test / status) are
-*     identical across kinds — duplicating them per cap was busywork.
-*   - The `network-access` cap precedent: same interface, many
-*     `providerKind: 'ingress'` implementations (Tailscale, ngrok, …).
-*
-* What stays kind-specific:
-*   - `getBrokerConfig` payload (kind decides whether it returns
-*     mqtt URL+creds, HA baseUrl+token, …) — typed as
-*     `Record<string, unknown>` at the wire; consumers narrow.
-*   - `publish` / `subscribe` / `getState` arguments (target / filter /
-*     key) — also typed as `Record<string, unknown>` so each kind can
-*     evolve its surface (MQTT topic+qos vs HA entity_id+domain)
-*     without rebreaking the cap signature.
-*   - `add` `settings` payload (different fields per kind, validated by
-*     the kind-specific provider).
-*
-* Bidirectionality:
-*   - `publish` is RPC — synchronous result (provider-defined).
-*   - `subscribe` returns a subscription handle; the actual message
-*     stream flows over the typed event-bus as `broker.message` events
-*     keyed by `(brokerId, subscriptionId)`. Consumers filter in their
-*     event handler. Subscriptions persist across reconnects — the
-*     provider re-subscribes upstream after a transport drop.
-*
-* Why event-bus push (not a subscription RPC stream):
-*   - Matches the rest of CamStack's D8 contract — events for telemetry,
-*     RPC for loss-is-a-bug. Broker messages are telemetry (a single
-*     drop is recoverable via `getState({key})`).
-*   - Frees `broker.subscribe` from holding a long-lived RPC channel.
-*   - Cross-process: events already route through `$event-bus`; no
-*     per-broker wire-shaping needed.
-*/
-var BrokerStatusEnum = _enum([
+_enum([
 	"connected",
 	"disconnected",
 	"connecting",
@@ -47103,141 +47394,12 @@ var BrokerStatusEnum = _enum([
 	"unreachable",
 	"error"
 ]);
-var BrokerInfoSchema = object({
-	/** Stable broker id. Persisted; survives addon restarts. */
-	id: string(),
-	/** Addon id of the provider that OWNS this broker.
-	*
-	*  The `broker` cap is a system-scoped collection: several addons
-	*  register a `broker` provider, each owning a DISJOINT set of
-	*  brokers (mqtt-broker owns `mqtt_*`, provider-homeassistant owns
-	*  `ha_*`). A broker therefore belongs to exactly one addon — like a
-	*  device belongs to one integration. The admin UI threads this id
-	*  back as the `{ addonId }` system-collection selector on every
-	*  id-keyed call (`get` / `getSettings` / `setSettings` / `remove` /
-	*  `testConnection`), so the call routes to the OWNING provider
-	*  instead of defaulting to the first-registered one. */
-	addonId: string(),
-	/** Human-readable name (operator-chosen at add-time). */
-	name: string(),
-	/** Provider-defined kind tag — `mqtt` / `home-assistant` / future. */
-	kind: string(),
-	status: BrokerStatusEnum,
-	/** Free-form provider-specific info (HA version, MQTT broker
-	*  flavour, latency, mTLS active, …). */
-	info: record(string(), unknown()),
-	/** Ms epoch of the last connection probe / status update. */
-	lastCheckedAt: number().nullable(),
-	/** Last error message, when `status` indicates failure. */
-	error: string().nullable()
-});
 var RegistryStatusSchema = object({
 	brokerCount: number().int().nonnegative(),
 	connectedCount: number().int().nonnegative()
 });
-/**
-* One entry per `broker` provider — which addon provides which broker
-* kind(s). The unified create picker reads this to know, for each
-* (addonId, kind) pair the operator can pick, where to route the
-* follow-up `getSettingsSchema` / `testSettings` / `add` calls (via the
-* `{ addonId }` selector). A provider only advertises a kind here when
-* it implements `getSettingsSchema` for that kind (so the picker never
-* offers a kind whose creation form can't be rendered).
-*/
-var BrokerProviderInfoSchema = object({
-	/** Addon id of the `broker` provider this entry describes. */
-	addonId: string(),
-	/** Broker kinds this provider can create, with a display label. */
-	kinds: array(object({
-		kind: string(),
-		label: string(),
-		/**
-		* Relative hub path to start an interactive account link (OAuth popup).
-		* May include `{{brokerId}}`; admin-ui substitutes and appends `?popup=1`.
-		*/
-		interactiveConnectPath: string().min(1).optional(),
-		/** Relative hub path to disconnect the linked account (same popup pattern). */
-		interactiveDisconnectPath: string().min(1).optional(),
-		/**
-		* The kind signs in through a server-held interactive session instead of
-		* (or before) typed credentials. `basePath` is a hub-relative route set
-		* served by the owning addon (`/addon/<id>/...`) speaking the sign-in
-		* contract: `POST {basePath}/start` (body: the form's settings) answers
-		* `{ sessionId, loginUrl }`; `GET {basePath}/status?sessionId=` answers
-		* `{ phase: 'starting' | 'awaiting-login' | 'captured' | 'error' |
-		* 'cancelled', loginUrl, error }`; `POST {basePath}/commit`
-		* (`{ sessionId, name, brokerId? }`) stores the credentials on a new or
-		* existing broker and answers `{ brokerId }`; `POST {basePath}/cancel`
-		* (`{ sessionId }`) drops the session. The dialog that edits a broker
-		* offers it as the default path; the fields the session fills are
-		* marked `filledBySignIn` in the kind's settings schema.
-		*
-		* `methods` lists the ways the session can sign in, recommended first:
-		* `'device-code'` adds `POST {basePath}/code/start` (body: the form's
-		* settings) answering `{ sessionId, userCode, verificationUrl,
-		* expiresAt }` — the operator types `userCode` at `verificationUrl` on
-		* any device, and the same `status` / `commit` / `cancel` routes follow
-		* (status then carries `method`, `userCode`, `verificationUrl`,
-		* `expiresAt` and the phases `'awaiting-code'` / `'expired'`);
-		* `'proxy'` is the `{basePath}/start` flow above. Absent means
-		* `['proxy']`.
-		*/
-		signIn: object({
-			basePath: string().min(1),
-			methods: array(_enum(["device-code", "proxy"])).optional()
-		}).optional()
-	}))
-});
-var ListInputSchema = object({ 
-/** Optional kind filter — `list({kind:'home-assistant'})` returns
-*  only HA brokers. Omit to list every broker. */
-kind: string().optional() });
 var GetInputSchema = object({ id: string() });
-var AddInputSchema = object({
-	kind: string().min(1),
-	name: string().min(1),
-	/**
-	* ADOPT an existing id instead of minting a new one.
-	*
-	* Written the day this cost an outage. A broker's id is not a detail: HA
-	* devices carry it inside their `stableId` (`ha:ha_004:dev:…`), so a broker
-	* lost from config and re-added as `ha_001` leaves every one of its devices
-	* bound to a broker that no longer exists. Re-entering the password under the
-	* ORIGINAL id turns a multi-step device migration back into re-entering a
-	* password.
-	*
-	* A provider MUST refuse an id that is already in use — adopting a live
-	* broker's id would silently take it over.
-	*/
-	id: string().min(1).optional(),
-	/** Kind-specific settings (e.g. MQTT `{url,username,password}` or HA
-	*  `{baseUrl,accessToken}`). Validated by the kind-specific provider
-	*  branch on receipt — invalid shape rejects the add. */
-	settings: record(string(), unknown())
-});
-var AddResultSchema = object({ id: string() });
-var RemoveInputSchema = object({ id: string() });
-var TestConnectionResultSchema = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number().nonnegative()
-}), object({
-	ok: literal(false),
-	error: string()
-})]);
 var SettingsRecordSchema$1 = record(string(), unknown());
-var SettingsSchemaInputSchema = object({ kind: string() });
-var TestSettingsInputSchema = object({
-	kind: string(),
-	settings: SettingsRecordSchema$1
-});
-var TestSettingsResultSchema = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number().nonnegative().optional()
-}).strict(), object({
-	ok: literal(false),
-	error: string()
-})]);
-var SettingsSchemaResultSchema = unknown().nullable();
 var PublishInputSchema = object({
 	brokerId: string(),
 	/** Kind-specific routing target.
@@ -47271,25 +47433,7 @@ var GetStateInputSchema = object({
 	*  HA:   entity_id (returns the cached entity state). */
 	key: string()
 });
-method(ListInputSchema, array(BrokerInfoSchema)), method(GetInputSchema, BrokerInfoSchema.nullable()), method(_void(), array(BrokerProviderInfoSchema), { auth: "admin" }), method(AddInputSchema, AddResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(RemoveInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(GetInputSchema, TestConnectionResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }), method(object({
-	id: string(),
-	settings: SettingsRecordSchema$1
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }), method(SettingsSchemaInputSchema, SettingsSchemaResultSchema, { auth: "admin" }), method(TestSettingsInputSchema, TestSettingsResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(PublishInputSchema, unknown(), {
+method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }), method(PublishInputSchema, unknown(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(SubscribeInputSchema, SubscribeResultSchema, {
@@ -49765,6 +49909,9 @@ var MediaPlayerStatusSchema = object({
 	/** Repeat mode. Null when no repeat surface.
 	*  Pair with `DeviceFeature.MediaPlayerRepeat`. */
 	repeat: MediaPlayerRepeatSchema.nullable(),
+	/** Ms epoch when `position` was read from the device. Null when the driver
+	*  does not say; a UI that advances the position while playing counts from it. */
+	positionUpdatedAt: number().nullable().default(null),
 	/** Ms epoch when the slice was last updated. */
 	lastChangedAt: number()
 });
@@ -50400,7 +50547,9 @@ var ThresholdTransformDraftSchema = object({
 	comparison: _enum(["gte", "lte"]),
 	threshold: number(),
 	startDwellMs: number().nonnegative(),
-	stopDwellMs: number().nonnegative()
+	stopDwellMs: number().nonnegative(),
+	/** Samples a start needs; absent = the compiler's default for the source (2 for running power, else 1). */
+	minSamples: number().int().min(1).optional()
 });
 var CustomizeTransformDraftSchema = discriminatedUnion("kind", [
 	IdentityTransformDraftSchema,
@@ -52248,7 +52397,9 @@ var deviceProviderCapability = {
 		* provider does not support manual creation. Lets the Add-Device dialog
 		* pick the right type instead of assuming Camera.
 		*/
-		getManualCreationType: method(object({}), object({ deviceType: _enum(DeviceType).nullable() })),
+		getManualCreationType: method(object({ 
+		/** The integration asked about; a provider whose integrations differ answers per one. */
+integrationId: string().optional() }), object({ deviceType: _enum(DeviceType).nullable() })),
 		adoptDiscoveredDevice: method(object({
 			candidate: DiscoveryCandidateSchema,
 			/** The integration the operator adopts into; a provider with several instances needs it. */
@@ -52264,7 +52415,11 @@ var deviceProviderCapability = {
 		* devices of that type. The output is a `ConfigUISchema` — the
 		* router type-asserts it at the boundary.
 		*/
-		getChildCreationSchema: method(object({ type: _enum(DeviceType) }), CreationSchemaOutputSchema),
+		getChildCreationSchema: method(object({
+			type: _enum(DeviceType),
+			/** The integration asked about; a provider whose integrations differ answers per one. */
+			integrationId: string().optional()
+		}), CreationSchemaOutputSchema),
 		createDevice: method(object({
 			type: _enum(DeviceType),
 			config: record(string(), unknown()),
@@ -52994,7 +53149,10 @@ method(object({
 	auth: "admin"
 }), method(object({
 	addonId: string(),
-	type: _enum(DeviceType)
+	type: _enum(DeviceType),
+	/** The integration the form is for; a provider whose integrations differ (a hub
+	*  integration takes no manual add) answers per integration. Absent = the addon's own. */
+	integrationId: string().optional()
 }), unknown().nullable()), method(object({
 	addonId: string(),
 	type: _enum(DeviceType),
@@ -53078,7 +53236,11 @@ method(object({
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 12e4
-}), method(object({ addonId: string() }), object({ deviceType: _enum(DeviceType).nullable() }), { auth: "admin" }), method(object({ addonId: string() }), unknown(), { auth: "admin" }), method(object({
+}), method(object({
+	addonId: string(),
+	/** The integration the Add-Device dialog is open on; absent = the addon's own. */
+	integrationId: string().optional()
+}), object({ deviceType: _enum(DeviceType).nullable() }), { auth: "admin" }), method(object({ addonId: string() }), unknown(), { auth: "admin" }), method(object({
 	deviceId: number(),
 	key: string(),
 	value: unknown()
@@ -56264,6 +56426,7 @@ var IntegrationWithStateSchema = object({
 	id: string(),
 	addonId: string(),
 	name: string(),
+	/** A projection of the instance body's switch (`setInstanceEnabled` is the only writer). */
 	enabled: boolean(),
 	info: record(string(), unknown()).readonly(),
 	/** The discovery candidate this integration was set up from (D984). */
@@ -56276,6 +56439,7 @@ var IntegrationLiteSchema = object({
 	id: string(),
 	addonId: string(),
 	name: string(),
+	/** A projection of the instance body's switch (`setInstanceEnabled` is the only writer). */
 	enabled: boolean(),
 	info: record(string(), unknown()).readonly(),
 	/** The discovery candidate this integration was set up from (D984). */
@@ -56358,7 +56522,7 @@ var TestConnectionStatusEnum = _enum([
 	"inconclusive",
 	"unsupported"
 ]);
-var TestConnectionResultSchema$1 = object({
+var TestConnectionResultSchema = object({
 	/** True ONLY for `validated`. Never true for a test that did not run. */
 	success: boolean(),
 	error: string().optional(),
@@ -56375,7 +56539,6 @@ var TestConnectionResultSchema$1 = object({
 var CreateIntegrationInputSchema = object({
 	addonId: string(),
 	name: string(),
-	enabled: boolean().optional(),
 	info: record(string(), unknown()).optional(),
 	/** `stableId` of the discovery candidate the form was seeded from (D984). */
 	originStableId: string().optional(),
@@ -56384,6 +56547,11 @@ var CreateIntegrationInputSchema = object({
 var UpdateIntegrationInputSchema = object({
 	id: string(),
 	name: string().optional(),
+	/**
+	* Accepted for a FIXED builtin only (`info.fixed`: alarm panel, camera grid, core blocks,
+	* terminal), which keeps no instance record: the registry flag is its one store. Any other
+	* integration is switched through `integration-instances.setInstanceEnabled`.
+	*/
 	enabled: boolean().optional(),
 	info: record(string(), unknown()).optional()
 });
@@ -56403,7 +56571,7 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 }), method(_void(), array(AvailableIntegrationTypeSchema), { auth: "admin" }), method(object({
 	addonId: string(),
 	settings: record(string(), unknown())
-}), TestConnectionResultSchema$1, {
+}), TestConnectionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -56430,6 +56598,14 @@ var ConfigSchemaPassthrough$3 = custom();
 var IntegrationInstanceIdSchema = string().min(1);
 var IntegrationInstanceModeSchema = _enum(["single", "multiple"]);
 /**
+* What the addon's instances ARE for the Integrations page (planning#416). `devices`: each
+* instance is an integration that brings devices (its record body owns the on/off switch);
+* `services`: a connection configured from the addon's own function page, never listed on
+* Integrations.
+* It is the same vocabulary as the manifest's `integrationRole`, which stays as an override.
+*/
+var IntegrationInstanceRoleSchema = _enum(["devices", "services"]);
+/**
 * One kind of instance a provider can create (an adapter, an account type). The sign-in and
 * connect fields follow the `broker` contract (`broker.cap.ts`): `signIn.basePath` is a
 * hub-relative route set speaking the sign-in contract, `connectPath` / `disconnectPath` open an
@@ -56440,6 +56616,22 @@ var IntegrationInstanceKindSchema = object({
 	/** Stable id of the kind, sent back as `createInstance.kind`. */
 	id: string().min(1),
 	label: string().min(1),
+	/**
+	* The function capability this kind is configured for (`broker`, `smtp-provider`,
+	* `device-provider`, ...). A page section is the kinds whose `functionCap` it names (D1013); a
+	* provider with more than one section must name it on every kind.
+	*/
+	functionCap: string().min(1),
+	/**
+	* For `functionCap: 'broker'`: the registry kind of the broker an instance of this kind is
+	* (`matter`, `home-assistant`, ...). A caller that needs a broker of one kind (a link field)
+	* finds the instances whose kind names it; absent takes the kind `id`.
+	*/
+	brokerKind: string().min(1).optional(),
+	/** What instances of this kind are for the Integrations page; absent takes the provider's `role`. */
+	role: IntegrationInstanceRoleSchema.optional(),
+	/** `testInstance` really probes the remote for this kind; absent takes the provider's `canTest`. */
+	canTest: boolean().optional(),
 	/** The kind signs in through a server-held interactive session. */
 	signIn: object({
 		basePath: string().min(1),
@@ -56450,22 +56642,38 @@ var IntegrationInstanceKindSchema = object({
 	/** Relative hub path to disconnect that account. */
 	disconnectPath: string().min(1).optional()
 });
+/**
+* How devices of an instance are found. `none`: the operator adds them by hand; `lan`: the addon
+* scans the network before any instance exists (the wizard offers the candidates); `account`: the
+* devices appear after the instance signs in. `scopedToInstance`: a discovery run belongs to ONE
+* instance and its candidates are claimed by it.
+*/
+var IntegrationInstanceDiscoverySchema = object({
+	mode: _enum([
+		"none",
+		"lan",
+		"account"
+	]),
+	scopedToInstance: boolean()
+});
+/**
+* One link a kind of this provider declares (D1013 rule 5): the body `field` of an instance of
+* `kind` holds the id of an instance of the function cap `to.cap` (of kind `to.kind`, when set).
+* The hub indexes these so the target's delete is refused while a link names it.
+*/
+var IntegrationInstanceLinkSchema = object({
+	kind: string().min(1),
+	field: string().min(1),
+	to: object({
+		cap: string().min(1),
+		kind: string().min(1).optional()
+	})
+});
 var IntegrationInstanceDescriptionSchema = object({
 	/** What the instances are for the Integrations page; see {@link IntegrationInstanceRoleSchema}. */
-	role: _enum([
-		"devices",
-		"services",
-		"both"
-	]),
+	role: IntegrationInstanceRoleSchema,
 	/** How the devices of an instance are found; absent means `{ mode: 'none' }`. */
-	discovery: object({
-		mode: _enum([
-			"none",
-			"lan",
-			"account"
-		]),
-		scopedToInstance: boolean()
-	}).optional(),
+	discovery: IntegrationInstanceDiscoverySchema.optional(),
 	/** `single`: at most one instance can exist (Loki). `multiple`: an account each. */
 	instanceMode: IntegrationInstanceModeSchema,
 	/** What the instance is, for the UI (`destination`, `relay`, `account`). */
@@ -56486,7 +56694,9 @@ var IntegrationInstanceDescriptionSchema = object({
 	* `createInstance` without an `id` works: the provider mints it. Absent means the caller must
 	* send an id (the UI then mints an opaque one).
 	*/
-	mintsId: boolean().optional()
+	mintsId: boolean().optional(),
+	/** The links to other instances the provider's kinds declare; absent means none. */
+	links: array(IntegrationInstanceLinkSchema).optional()
 });
 var IntegrationInstanceStatusSchema = object({
 	state: _enum([
@@ -56506,8 +56716,8 @@ var IntegrationInstanceSchema = object({
 	configured: boolean(),
 	/**
 	* The instance's own on/off switch (D996), derived from the record body (`enabled !== false`,
-	* so a row written before the field existed is on). Absent when the `integrations` registry
-	* owns the switch (`describe().role` is `devices`): read it from the registry row.
+	* so a row written before the field existed is on). The same for every role, `devices` included:
+	* the body is the one store, `setInstanceEnabled` the one writer (epic #440, step 3).
 	*/
 	enabled: boolean().optional(),
 	/** The kind of this instance (one of `describe().kinds[].id`), when the provider has kinds. */
@@ -56531,7 +56741,11 @@ var integrationInstancesCapability = {
 	methods: {
 		describe: method(_void(), IntegrationInstanceDescriptionSchema, { auth: "admin" }),
 		/** The form; `id: null` is the create form. */
-		instanceFormSchema: method(object({ id: IntegrationInstanceIdSchema.nullable() }), ConfigSchemaPassthrough$3, { auth: "admin" }),
+		instanceFormSchema: method(object({
+			id: IntegrationInstanceIdSchema.nullable(),
+			/** The kind of the create form (`id: null`) of a provider with several. */
+			kind: string().min(1).optional()
+		}), ConfigSchemaPassthrough$3, { auth: "admin" }),
 		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
 		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
 		/**
@@ -56541,7 +56755,9 @@ var integrationInstancesCapability = {
 		createInstance: method(object({
 			id: IntegrationInstanceIdSchema.optional(),
 			name: string().min(1),
-			kind: string().min(1).optional()
+			kind: string().min(1).optional(),
+			/** Form values written with the record (a link picked in the create dialog). */
+			values: record(string(), unknown()).optional()
 		}), object({ id: string() }), {
 			kind: "mutation",
 			auth: "admin"
@@ -56551,7 +56767,8 @@ var integrationInstancesCapability = {
 			auth: "admin"
 		}),
 		/**
-		* Switch ONE instance on or off. A row control, not a form field: `updateInstance.values` is the
+		* Switch ONE instance on or off, for every role; a missing record is created from the addon's
+		* initial body. A row control, not a form field: `updateInstance.values` is the
 		* form patch (D62, D996). An off instance keeps its record and secrets and does no work.
 		*/
 		setInstanceEnabled: method(object({
@@ -56568,8 +56785,10 @@ var integrationInstancesCapability = {
 		}),
 		testInstance: optionalMethod(object({
 			id: IntegrationInstanceIdSchema.nullable(),
-			values: record(string(), unknown())
-		}), TestConnectionResultSchema$1, {
+			values: record(string(), unknown()),
+			/** The kind to test when `id` is null and the provider has several. */
+			kind: string().min(1).optional()
+		}), TestConnectionResultSchema, {
 			kind: "mutation",
 			auth: "admin"
 		})
@@ -59326,6 +59545,382 @@ var SystemMetricsSchema = object({
 	gpuMemoryPercent: number().optional()
 });
 method(_void(), SystemResourceSnapshotSchema), method(_void(), SystemResourceSnapshotSchema.nullable()), method(_void(), SystemMetricsSchema), method(object({ dirPath: string() }), DiskSpaceInfoSchema), method(_void(), MetricsGpuInfoSchema.nullable()), method(_void(), number().nullable()), method(object({ pids: array(number()) }), array(PidResourceStatsSchema)), method(_void(), array(AddonInstanceSchema).readonly()), method(object({ addonId: string() }), PidResourceStatsSchema.nullable()), method(_void(), array(NodeProcessSchema).readonly()), method(GetLoadSeriesInputSchema, NodeLoadSeriesSchema);
+/**
+* records - an addon's own facts and documents (D881): ledgers, audit rows,
+* config documents, mirrors. The third storage API next to `ctx.settings`
+* (operator intent, D870) and device-history (numbers over time, D850).
+*
+* Who the OWNER is: `callerAddonId`, stamped by the transport on a call that
+* crossed a process and stated by a hub in-process caller (`ctx.records` does
+* that with the addon id closed over). It is deliberately NOT in any input
+* schema, so a session can never supply it, and a call with no stamp is refused
+* `records/no-caller`. A kind is readable and writable only by its owner; other
+* addons go through the owner's capability.
+*
+* Every read is three-way: a row, `null`, or the call THROWS. A failed read is
+* never `[]`. Secret fields are never on the wire: a read shows the
+* redaction token, `secretRefs` hands the owner's `ctx.secrets` the refs it
+* resolves itself, and a write may carry only a keychain marker bound to the
+* row's own ref.
+*
+* Internal: addons reach it through `ctx.records`, never directly.
+*/
+var RecordIdSchema = string().min(1).max(256);
+/** A JSON object body. Size is the engine's check (`maxDataBytes`), not a schema's. */
+var RecordBodySchema = record(string(), unknown());
+var RecordInputSchema = object({
+	id: RecordIdSchema,
+	/** The device this row belongs to (D865 removal, per-device reads). */
+	deviceId: number().int().optional(),
+	/** The domain clock, ms: observed / created / opened. */
+	at: number().int().optional(),
+	/** Producer-set expiry, ms. Refused on a kind whose retention is an engine TTL. */
+	expiresAt: number().int().optional(),
+	data: RecordBodySchema
+});
+var RecordViewSchema = object({
+	id: string(),
+	deviceId: number().int().nullable(),
+	at: number().nullable(),
+	expiresAt: number().nullable(),
+	rev: number().int(),
+	updatedAt: number(),
+	data: RecordBodySchema
+});
+/** Declared index fields only. Anything else does not compile, by design. */
+var RecordWhereSchema = record(RecordFieldPathSchema, union([
+	string(),
+	number(),
+	boolean(),
+	object({ in: array(union([
+		string(),
+		number(),
+		boolean()
+	])).min(1).max(RECORD_BATCH_MAX) }),
+	object({
+		gt: union([string(), number()]).optional(),
+		gte: union([string(), number()]).optional(),
+		lt: union([string(), number()]).optional(),
+		lte: union([string(), number()]).optional()
+	}).refine((r) => Object.keys(r).length > 0, { message: "name at least one bound" })
+]));
+var KindShape = { kind: RecordKindNameSchema };
+var TimeWindowShape = {
+	deviceId: number().int().optional(),
+	atFrom: number().optional(),
+	atTo: number().optional()
+};
+var RecordQueryInputSchema = object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional(),
+	/** Without `where`: `at` (default for a kind with a clock) or `id`. With `where` the order is the index's. */
+	order: _enum(["at", "id"]).optional(),
+	desc: boolean().optional(),
+	limit: number().int().min(1).max(RECORD_QUERY_MAX).default(100),
+	/** Opaque keyset cursor from a previous answer. There is no offset. */
+	cursor: string().min(1).optional()
+});
+var RecordQueryResultSchema = object({
+	records: array(RecordViewSchema),
+	nextCursor: string().nullable()
+});
+var RecordKindStateSchema = _enum([
+	"created",
+	"unchanged",
+	"updated"
+]);
+var DeclareKindResultSchema = object({
+	kindId: number().int(),
+	state: RecordKindStateSchema,
+	createdIndexes: array(string())
+});
+/** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
+var SecretRefsList = array(string());
+/**
+* One op of a `transact`: the single-row writes, each on a kind of the caller.
+* All ops of one call share ONE database file and ONE `transactFamily`.
+*/
+var RecordTransactOpSchema = discriminatedUnion("op", [
+	object({
+		op: literal("put"),
+		kind: RecordKindNameSchema,
+		record: RecordInputSchema,
+		ifRev: number().int().min(0).optional()
+	}),
+	object({
+		op: literal("patch"),
+		kind: RecordKindNameSchema,
+		id: RecordIdSchema,
+		data: RecordBodySchema,
+		at: number().int().nullable().optional(),
+		expiresAt: number().int().nullable().optional(),
+		ifRev: number().int().min(1).optional()
+	}),
+	object({
+		op: literal("delete"),
+		kind: RecordKindNameSchema,
+		id: RecordIdSchema
+	})
+]);
+var RecordSecretRefsSchema = record(string(), record(string(), string()));
+method(object({ kinds: record(RecordKindNameSchema, RecordKindDeclarationSchema) }), object({ kinds: record(string(), DeclareKindResultSchema) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), RecordViewSchema.nullable(), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), array(RecordViewSchema), { auth: "admin" }), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), RecordSecretRefsSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	record: RecordInputSchema,
+	/** Compare-and-set. `0` means "the row must not exist". */
+	ifRev: number().int().min(0).optional()
+}), object({
+	rev: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	records: array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	count: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema,
+	data: RecordBodySchema,
+	at: number().int().nullable().optional(),
+	expiresAt: number().int().nullable().optional(),
+	ifRev: number().int().min(1).optional()
+}), object({
+	rev: number().int(),
+	releasedRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	id: RecordIdSchema
+}), object({
+	deleted: boolean(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	...KindShape,
+	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
+}), object({
+	deleted: number().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(RecordQueryInputSchema, RecordQueryResultSchema, { auth: "admin" }), method(object({
+	...KindShape,
+	...TimeWindowShape,
+	where: RecordWhereSchema.optional()
+}), object({ count: number().int() }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number().int().optional(),
+	from: number(),
+	to: number(),
+	bucketMs: number().int().positive()
+}), object({ buckets: array(object({
+	bucketStart: number(),
+	count: number().int()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	op: _enum([
+		"sum",
+		"min",
+		"max",
+		"count"
+	]),
+	field: RecordFieldPathSchema.optional(),
+	groupBy: RecordFieldPathSchema.optional(),
+	where: RecordWhereSchema.optional()
+}), object({ rows: array(object({
+	group: union([
+		string(),
+		number(),
+		_null()
+	]),
+	value: number().nullable()
+})) }), { auth: "admin" }), method(object({
+	...KindShape,
+	deviceId: number().int().optional(),
+	atBefore: number().optional(),
+	where: RecordWhereSchema.optional()
+}), object({
+	deleted: number().int(),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ ops: array(RecordTransactOpSchema).min(1).max(RECORD_BATCH_MAX) }), object({
+	results: array(object({
+		rev: number().int().nullable(),
+		deleted: boolean()
+	})),
+	releasedRefs: SecretRefsList,
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int(),
+	kinds: array(RecordKindNameSchema).optional()
+}), object({
+	deleted: record(string(), number().int()),
+	secretRefs: SecretRefsList
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object(KindShape), object({ id: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* The wire shapes of the migration API, version 1 (planning#447).
+*
+* A migration is code that outlives the server it was written against: an addon at
+* version 1.4 that is brought to 1.9 in one jump still runs its 1.4 catalogue, against
+* the 1.9 kernel. The only thing that code may call is {@link MigrationApiV1}; this file
+* is the contract of every method of it, one Zod pair per method.
+*
+* APPEND-ONLY. A released method is never removed and never changes meaning: an input
+* field is never removed or made required, an enum never narrows, an output field is
+* never removed. A change that cannot be expressed that way is `migration-api.v2`, next
+* to this file. `scripts/check-migration-api-append-only.ts` holds the line against
+* `scripts/migration-api-contract.json`, and every `behaviours` id below must have an
+* `it('<id>'` in `migration-api.contract.spec.ts`.
+*/
+var Rows = record(string(), unknown());
+var IntegrationId = object({ integrationId: string().min(1) });
+var RecordId = object({ id: string().min(1) });
+var RecordRowSchema = object({
+	id: string(),
+	deviceId: number().int().nullable(),
+	at: number().nullable(),
+	expiresAt: number().nullable(),
+	rev: number().int(),
+	updatedAt: number(),
+	data: Rows
+});
+var RecordPutShape = {
+	id: string().min(1),
+	deviceId: number().int().optional(),
+	at: number().int().optional(),
+	expiresAt: number().int().optional(),
+	data: Rows
+};
+var MigrationIntegrationSchema = object({
+	id: string(),
+	addonId: string(),
+	name: string(),
+	info: Rows,
+	/** The registry's stored switch: read by the one-switch migration, nothing else. */
+	enabled: boolean().optional(),
+	originStableId: string().optional()
+});
+var MigrationDeviceSchema = object({
+	id: number().int(),
+	integrationId: string().nullable().optional(),
+	/** The owning device; null or absent for a root. */
+	parentDeviceId: number().int().nullable().optional(),
+	type: string().optional(),
+	name: string().optional(),
+	stableId: string().optional()
+});
+/** What the engine says about the migration API it serves: lets an addon notice an older server. */
+var MigrationApiInfoSchema = object({
+	version: number().int(),
+	methods: array(string())
+});
+object({
+	message: string(),
+	meta: Rows.optional(),
+	/** Grouping tags of the line; a line about a device carries `{ deviceId }`. */
+	tags: object({ deviceId: number().int().optional() }).optional()
+});
+object({
+	owner: string().min(1),
+	metas: array(MigrationMetaSchema)
+}), object({
+	bootId: string(),
+	snapshot: _enum([
+		"none",
+		"written",
+		"refused"
+	]),
+	steps: array(MigrationOwnerStepSchema),
+	/** The migration API the engine serves; absent from a server that predates it. */
+	migrationApi: MigrationApiInfoSchema.optional()
+}), object({ id: string().min(1) }), object({
+	proceed: boolean(),
+	state: union([literal("pending"), MigrationStatusSchema]),
+	reason: string().nullable()
+}), object({
+	id: string().min(1),
+	result: MigrationOwnerResultSchema
+}), object({
+	status: MigrationStatusSchema,
+	error: string().nullable(),
+	rowsChanged: number().int().nonnegative()
+}), object({
+	rows: number().int().nonnegative(),
+	secrets: number().int().nonnegative()
+}), IntegrationId.extend({ patch: Rows }), object({ written: boolean() }), IntegrationId.extend({ keys: array(string().min(1)) }), object({
+	present: boolean(),
+	removed: Rows
+}), RecordRowSchema.nullable(), RecordRowSchema.nullable(), object({
+	...RecordPutShape,
+	ifRev: number().int().optional()
+}), object({ rev: number().int() }), object({ records: array(object(RecordPutShape)) }), object({ count: number().int().nonnegative() }), RecordId.extend({
+	partial: Rows,
+	ifRev: number().int().optional()
+}), object({ rev: number().int() }), object({ deleted: boolean() }), object({
+	deviceId: number().int().optional(),
+	atFrom: number().optional(),
+	atTo: number().optional(),
+	where: RecordWhereSchema.optional(),
+	limit: number().int().min(1).optional(),
+	cursor: string().min(1).optional(),
+	resolveSecrets: boolean().optional()
+}), object({
+	records: array(RecordRowSchema),
+	nextCursor: string().nullable()
+}), object({
+	deviceId: number().int().optional(),
+	atBefore: number().optional(),
+	where: RecordWhereSchema.optional()
+}), object({ count: number().int().nonnegative() }), object({}), object({ store: Rows }), object({ patch: Rows }), object({}), object({ keys: array(string().min(1)) }), object({ removed: array(string()) }), object({ refs: array(string()) }), object({ values: record(string(), string().nullable()) }), object({
+	ref: string().min(1),
+	value: string()
+}), object({}), object({ refs: array(string()) }), object({ deleted: number().int().nonnegative() }), object({}), object({ integrations: array(MigrationIntegrationSchema) }), object({ id: string().min(1) }), MigrationIntegrationSchema.nullable(), object({
+	addonId: string().min(1),
+	integrationId: string().min(1).optional()
+}), object({ devices: array(MigrationDeviceSchema) }), object({ deviceId: number().int() }), object({
+	id: number().int(),
+	integrationId: string().nullable(),
+	/** Whether the device carries any stored config; its content is not offered. */
+	hasConfig: boolean()
+}).nullable(), object({
+	deviceId: number().int(),
+	integrationId: string().min(1)
+}), object({}), object({}), object({ nodeId: string() }), object({}), object({});
 method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { auth: "admin" }), method(object({ owner: string().optional() }), object({ pending: array(MigrationPendingEntrySchema) }), { auth: "admin" }), method(object({ id: string().min(1) }), MigrationDryRunResultSchema, { auth: "admin" }), method(object({
 	id: string().min(1),
 	error: string().min(1)
@@ -59355,7 +59950,9 @@ method(object({}), object({ entries: array(MigrationLedgerEntrySchema) }), { aut
 		"written",
 		"refused"
 	]),
-	steps: array(MigrationOwnerStepSchema)
+	steps: array(MigrationOwnerStepSchema),
+	/** The migration API this engine serves (additive: a server that predates it omits it). */
+	migrationApi: MigrationApiInfoSchema.optional()
 }), {
 	kind: "mutation",
 	auth: "admin"
@@ -62022,7 +62619,10 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(RelocateMediaInputSchema, object({ jobId: string() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }), method(RelocatableMediaCountInputSchema, RelocatableMediaCountSchema, {
+}), method(object({}), UnstampedEventMediaCountSchema, { auth: "admin" }), method(MediaLocationCensusInputSchema, MediaLocationCensusSchema, {
+	kind: "query",
+	auth: "admin"
+}), method(RelocatableMediaCountInputSchema, RelocatableMediaCountSchema, {
 	kind: "query",
 	auth: "admin"
 }), method(object({}), array(RelocateJobSchema).readonly(), {
@@ -64677,7 +65277,7 @@ var BrokerStatusSchema$1 = _enum([
 	"unreachable",
 	"tls-error"
 ]);
-var BrokerInfoSchema$1 = object({
+var BrokerInfoSchema = object({
 	id: string(),
 	name: string(),
 	url: string(),
@@ -64740,7 +65340,7 @@ var StatusSchema = object({
 	brokerCount: number(),
 	embeddedRunning: boolean()
 });
-method(_void(), array(BrokerInfoSchema$1)), method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }), method(AddBrokerInputSchema, AddBrokerResultSchema, {
+method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }), method(AddBrokerInputSchema, AddBrokerResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(IdInputSchema, _void(), {
@@ -69362,14 +69962,6 @@ var PetFountainStatusSchema = object({
 	empty: boolean().nullable(),
 	/** True while the pump is running. Null while unknown. */
 	pumpRunning: boolean().nullable(),
-	/** Water drunk in the last drink, in litres. */
-	lastDrink: number().min(0).nullable().meta(readingMeta("volume")),
-	/** Water drunk in the current hour, in litres. */
-	currentHourDrink: number().min(0).nullable().meta(readingMeta("volume")),
-	/** Water drunk over the last 24 hours (rolling), in litres. */
-	last24hDrink: number().min(0).nullable().meta(readingMeta("volume")),
-	/** Water drunk since local midnight, in litres. Null when the fountain has no such sensor. */
-	todayDrink: number().min(0).nullable().meta(readingMeta("volume")),
 	/** Decoded fault message. Null means healthy; a non-null string is an active fault. */
 	error: string().nullable(),
 	/** Ms epoch when the slice was last refreshed. */
@@ -69382,21 +69974,15 @@ var petFountainCapability = {
 	deviceNative: true,
 	mode: "singleton",
 	deviceTypes: [DeviceType.PetFountain],
-	methods: {
-		/** Start or stop the pump. */
-		setPump: method(object({
-			deviceId: DeviceIdSchema$1,
-			on: boolean()
-		}), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		}),
-		/** Clear the rolling daily consumption counters on the device. */
-		resetDailyConsumption: method(object({ deviceId: DeviceIdSchema$1 }), _void(), {
-			kind: "mutation",
-			auth: "protected"
-		})
-	},
+	methods: { 
+	/** Start or stop the pump. */
+setPump: method(object({
+		deviceId: DeviceIdSchema$1,
+		on: boolean()
+	}), _void(), {
+		kind: "mutation",
+		auth: "protected"
+	}) },
 	status: {
 		schema: PetFountainStatusSchema,
 		kind: "push"
@@ -69420,14 +70006,6 @@ var petFountainCapability = {
 		waterVolume: {
 			kind: "gauge",
 			unit: "L"
-		},
-		todayDrink: {
-			kind: "gauge",
-			unit: "L"
-		},
-		last24hDrink: {
-			kind: "gauge",
-			unit: "L"
 		}
 	} }
 };
@@ -71922,253 +72500,6 @@ DeviceType.Camera, DeviceType.Sensor, DeviceType.Switch, DeviceType.Gateway, met
 	auth: "admin"
 });
 /**
-* records - an addon's own facts and documents (D881): ledgers, audit rows,
-* config documents, mirrors. The third storage API next to `ctx.settings`
-* (operator intent, D870) and device-history (numbers over time, D850).
-*
-* Who the OWNER is: `callerAddonId`, stamped by the transport on a call that
-* crossed a process and stated by a hub in-process caller (`ctx.records` does
-* that with the addon id closed over). It is deliberately NOT in any input
-* schema, so a session can never supply it, and a call with no stamp is refused
-* `records/no-caller`. A kind is readable and writable only by its owner; other
-* addons go through the owner's capability.
-*
-* Every read is three-way: a row, `null`, or the call THROWS. A failed read is
-* never `[]`. Secret fields are never on the wire: a read shows the
-* redaction token, `secretRefs` hands the owner's `ctx.secrets` the refs it
-* resolves itself, and a write may carry only a keychain marker bound to the
-* row's own ref.
-*
-* Internal: addons reach it through `ctx.records`, never directly.
-*/
-var RecordIdSchema = string().min(1).max(256);
-/** A JSON object body. Size is the engine's check (`maxDataBytes`), not a schema's. */
-var RecordBodySchema = record(string(), unknown());
-var RecordInputSchema = object({
-	id: RecordIdSchema,
-	/** The device this row belongs to (D865 removal, per-device reads). */
-	deviceId: number().int().optional(),
-	/** The domain clock, ms: observed / created / opened. */
-	at: number().int().optional(),
-	/** Producer-set expiry, ms. Refused on a kind whose retention is an engine TTL. */
-	expiresAt: number().int().optional(),
-	data: RecordBodySchema
-});
-var RecordViewSchema = object({
-	id: string(),
-	deviceId: number().int().nullable(),
-	at: number().nullable(),
-	expiresAt: number().nullable(),
-	rev: number().int(),
-	updatedAt: number(),
-	data: RecordBodySchema
-});
-/** Declared index fields only. Anything else does not compile, by design. */
-var RecordWhereSchema = record(RecordFieldPathSchema, union([
-	string(),
-	number(),
-	boolean(),
-	object({ in: array(union([
-		string(),
-		number(),
-		boolean()
-	])).min(1).max(RECORD_BATCH_MAX) }),
-	object({
-		gt: union([string(), number()]).optional(),
-		gte: union([string(), number()]).optional(),
-		lt: union([string(), number()]).optional(),
-		lte: union([string(), number()]).optional()
-	}).refine((r) => Object.keys(r).length > 0, { message: "name at least one bound" })
-]));
-var KindShape = { kind: RecordKindNameSchema };
-var TimeWindowShape = {
-	deviceId: number().int().optional(),
-	atFrom: number().optional(),
-	atTo: number().optional()
-};
-var RecordQueryInputSchema = object({
-	...KindShape,
-	...TimeWindowShape,
-	where: RecordWhereSchema.optional(),
-	/** Without `where`: `at` (default for a kind with a clock) or `id`. With `where` the order is the index's. */
-	order: _enum(["at", "id"]).optional(),
-	desc: boolean().optional(),
-	limit: number().int().min(1).max(RECORD_QUERY_MAX).default(100),
-	/** Opaque keyset cursor from a previous answer. There is no offset. */
-	cursor: string().min(1).optional()
-});
-var RecordQueryResultSchema = object({
-	records: array(RecordViewSchema),
-	nextCursor: string().nullable()
-});
-var RecordKindStateSchema = _enum([
-	"created",
-	"unchanged",
-	"updated"
-]);
-var DeclareKindResultSchema = object({
-	kindId: number().int(),
-	state: RecordKindStateSchema,
-	createdIndexes: array(string())
-});
-/** Keychain refs a write released (the old marker is gone from the row): the owner deletes the values. */
-var SecretRefsList = array(string());
-/**
-* One op of a `transact`: the single-row writes, each on a kind of the caller.
-* All ops of one call share ONE database file and ONE `transactFamily`.
-*/
-var RecordTransactOpSchema = discriminatedUnion("op", [
-	object({
-		op: literal("put"),
-		kind: RecordKindNameSchema,
-		record: RecordInputSchema,
-		ifRev: number().int().min(0).optional()
-	}),
-	object({
-		op: literal("patch"),
-		kind: RecordKindNameSchema,
-		id: RecordIdSchema,
-		data: RecordBodySchema,
-		at: number().int().nullable().optional(),
-		expiresAt: number().int().nullable().optional(),
-		ifRev: number().int().min(1).optional()
-	}),
-	object({
-		op: literal("delete"),
-		kind: RecordKindNameSchema,
-		id: RecordIdSchema
-	})
-]);
-var RecordSecretRefsSchema = record(string(), record(string(), string()));
-method(object({ kinds: record(RecordKindNameSchema, RecordKindDeclarationSchema) }), object({ kinds: record(string(), DeclareKindResultSchema) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	id: RecordIdSchema
-}), RecordViewSchema.nullable(), { auth: "admin" }), method(object({
-	...KindShape,
-	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
-}), array(RecordViewSchema), { auth: "admin" }), method(object({
-	...KindShape,
-	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
-}), RecordSecretRefsSchema, { auth: "admin" }), method(object({
-	...KindShape,
-	record: RecordInputSchema,
-	/** Compare-and-set. `0` means "the row must not exist". */
-	ifRev: number().int().min(0).optional()
-}), object({
-	rev: number().int(),
-	releasedRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	records: array(RecordInputSchema).min(1).max(RECORD_BATCH_MAX)
-}), object({
-	count: number().int(),
-	releasedRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	id: RecordIdSchema,
-	data: RecordBodySchema,
-	at: number().int().nullable().optional(),
-	expiresAt: number().int().nullable().optional(),
-	ifRev: number().int().min(1).optional()
-}), object({
-	rev: number().int(),
-	releasedRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	id: RecordIdSchema
-}), object({
-	deleted: boolean(),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	...KindShape,
-	ids: array(RecordIdSchema).min(1).max(RECORD_BATCH_MAX)
-}), object({
-	deleted: number().int(),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(RecordQueryInputSchema, RecordQueryResultSchema, { auth: "admin" }), method(object({
-	...KindShape,
-	...TimeWindowShape,
-	where: RecordWhereSchema.optional()
-}), object({ count: number().int() }), { auth: "admin" }), method(object({
-	...KindShape,
-	deviceId: number().int().optional(),
-	from: number(),
-	to: number(),
-	bucketMs: number().int().positive()
-}), object({ buckets: array(object({
-	bucketStart: number(),
-	count: number().int()
-})) }), { auth: "admin" }), method(object({
-	...KindShape,
-	op: _enum([
-		"sum",
-		"min",
-		"max",
-		"count"
-	]),
-	field: RecordFieldPathSchema.optional(),
-	groupBy: RecordFieldPathSchema.optional(),
-	where: RecordWhereSchema.optional()
-}), object({ rows: array(object({
-	group: union([
-		string(),
-		number(),
-		_null()
-	]),
-	value: number().nullable()
-})) }), { auth: "admin" }), method(object({
-	...KindShape,
-	deviceId: number().int().optional(),
-	atBefore: number().optional(),
-	where: RecordWhereSchema.optional()
-}), object({
-	deleted: number().int(),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ ops: array(RecordTransactOpSchema).min(1).max(RECORD_BATCH_MAX) }), object({
-	results: array(object({
-		rev: number().int().nullable(),
-		deleted: boolean()
-	})),
-	releasedRefs: SecretRefsList,
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	deviceId: number().int(),
-	kinds: array(RecordKindNameSchema).optional()
-}), object({
-	deleted: record(string(), number().int()),
-	secretRefs: SecretRefsList
-}), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object(KindShape), object({ id: number().int() }), {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * record-entries - the ONE admin surface for every list of user-created entries
 * (D881): notification targets, brokers, LLM profiles, anything an addon
 * declares as an ENTRY kind (`entry: { title }` in `defineRecordKinds`).
@@ -81935,7 +82266,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 	* `deviceClasses` map (first registered type). `null` when manual creation is
 	* unsupported. Lets the Add-Device dialog pick the right type per provider.
 	*/
-	async getManualCreationType() {
+	async getManualCreationType(_input) {
 		if (!await this.supportsManualCreation()) return { deviceType: null };
 		return { deviceType: Object.values(DeviceType).find((t) => this.deviceClasses[t] !== void 0) ?? null };
 	}
@@ -81946,7 +82277,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 		return true;
 	}
 	async getChildCreationSchema(input) {
-		return this.onGetCreationSchema(input.type);
+		return this.onGetCreationSchema(input.type, { integrationId: input.integrationId });
 	}
 	/**
 	* Default kernel-orchestrated `createDevice` implementation. The
@@ -83367,20 +83698,6 @@ Object.freeze({
 		access: "create",
 		role: "viewer"
 	},
-	"broker.add": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"broker.get": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"broker.getBrokerConfig": {
 		capName: "broker",
 		capScope: "system",
@@ -83388,20 +83705,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"broker.getSettings": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"broker.getSettingsSchema": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"broker.getState": {
 		capName: "broker",
 		capScope: "system",
@@ -83416,20 +83719,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"broker.list": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"broker.listProviders": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"broker.publish": {
 		capName: "broker",
 		capScope: "system",
@@ -83437,20 +83726,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"broker.remove": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
-	"broker.setSettings": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"broker.subscribe": {
 		capName: "broker",
 		capScope: "system",
@@ -83458,20 +83733,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"broker.testConnection": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"broker.testSettings": {
-		capName: "broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"broker.unsubscribe": {
 		capName: "broker",
 		capScope: "system",
@@ -88232,13 +88493,6 @@ Object.freeze({
 		access: "view",
 		role: "viewer"
 	},
-	"petFountain.resetDailyConsumption": {
-		capName: "pet-fountain",
-		capScope: "device",
-		addonId: null,
-		access: "delete",
-		role: "viewer"
-	},
 	"petFountain.setPump": {
 		capName: "pet-fountain",
 		capScope: "device",
@@ -88435,6 +88689,13 @@ Object.freeze({
 		access: "view",
 		role: "viewer"
 	},
+	"pipelineAnalytics.getMediaLocationCensus": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"pipelineAnalytics.getMediaReclaimStatus": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -94628,11 +94889,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"petFountain.resetDailyConsumption": [{
-		name: "deviceId",
-		form: "single",
-		optional: false
-	}],
 	"petFountain.setPump": [{
 		name: "deviceId",
 		form: "single",
@@ -98314,4 +98570,4 @@ function keepBodyKeys(provider, keys) {
 	};
 }
 //#endregion
-export { errMsg as $, switchCapability as A, isSecretMarkerLike as B, ingestReading as C, quantityFromUnit as D, powerMeterCapability as E, defineAddonMigrations as F, number as G, array as H, defineCustomActions as I, string as J, object as K, defineEntryKind as L, waterHeaterCapability as M, createEvent as N, runningFromDishwasherOperation as O, customAction as P, DeviceType as Q, entryBody as R, heatingValveCapability as S, numericSensorCapability as T, boolean as U, _enum as V, literal as W, unknown as X, union as Y, DeviceRole as Z, defaultIntegrationApiOver as _, BaseDevice as a, enumSensorCapability as b, RUNNING_STATE_COLD as c, VendorLoginProxy as d, EventCategory as et, batteryCapability as f, consumablesCapability as g, connectionTestCapability as h, testBoschInstance as i, temperatureSensorCapability as j, runningStateCapability as k, RecordIntegrationInstances as l, climateControlCapability as m, boschRowsPorts as n, BaseDeviceProvider as o, binaryCapability as p, record as q, keepBodyKeys as r, DishwasherOperationStateSchema as s, boschRowsMigration as t, VENDOR_LOGIN_PROXY_PREFIX as u, deviceAdoptionCapability as v, integrationInstancesCapability as w, eventEmitterCapability as x, dishwasherCapability as y, isSecretMarker as z };
+export { EventCategory as $, waterHeaterCapability as A, _enum as B, numericSensorCapability as C, runningStateCapability as D, runningFromDishwasherOperation as E, defineEntryKind as F, object as G, boolean as H, entryBody as I, union as J, record as K, isSecretMarker as L, createEvent as M, customAction as N, switchCapability as O, defineCustomActions as P, errMsg as Q, isSecretMarkerLike as R, integrationInstancesCapability as S, quantityFromUnit as T, literal as U, array as V, number as W, DeviceRole as X, unknown as Y, DeviceType as Z, dishwasherCapability as _, BaseDevice as a, heatingValveCapability as b, RUNNING_STATE_COLD as c, batteryCapability as d, binaryCapability as f, deviceAdoptionCapability as g, consumablesCapability as h, testBoschInstance as i, RecordIntegrationInstances as j, temperatureSensorCapability as k, VENDOR_LOGIN_PROXY_PREFIX as l, connectionTestCapability as m, boschRowsPorts as n, BaseDeviceProvider as o, climateControlCapability as p, string as q, keepBodyKeys as r, DishwasherOperationStateSchema as s, boschRowsMigration as t, VendorLoginProxy as u, enumSensorCapability as v, powerMeterCapability as w, ingestReading as x, eventEmitterCapability as y, rowsDepsOver as z };