@camstack/addon-provider-enpal 0.1.13 → 0.1.14

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-//#region ../types/dist/event-category-BmPm98n0.mjs
+//#region ../types/dist/event-category-78tcBemo.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -120,6 +120,23 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AddonLoadRecovered"] = "addon.load-recovered";
 	/**
+	* An addon is RUNNING although its installed package is below what the
+	* running server requires (`camstack.requires.addons` of the server, or the
+	* addon's own `requires.server`). Raised once per streak by the unsupported-
+	* addon tracker, on the hub and on agents; AlertCenter turns it into one
+	* operator alert per node and package. The addon is never held back for it.
+	*
+	* Payload: `{ packageName, addonId, nodeId, installedVersion, requiredMinimum, serverVersion, unmet }`.
+	*/
+	EventCategory["AddonUnsupportedVersion"] = "addon.unsupported-version";
+	/**
+	* The package of an {@link AddonUnsupportedVersion} alert reached a supported
+	* version, or is no longer installed on the node. AlertCenter dismisses the matching alert.
+	*
+	* Payload: `{ packageName, addonId, nodeId }`.
+	*/
+	EventCategory["AddonUnsupportedResolved"] = "addon.unsupported-resolved";
+	/**
 	* Monitor scheduled the next retry for a failed addon. Transient —
 	* surfaced to the UI for live-updating the "next retry in Ns"
 	* countdown on the Addons page row, NOT persisted as an alert.
@@ -230,7 +247,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["ProcessRestarted"] = "process.restarted";
 	/**
 	* The SET of storage locations changed — one was created, edited, enabled,
-	* disabled or deleted through `storage.upsertLocation` / `deleteLocation`.
+	* disabled or deleted through the location instances or the forced-delete action.
 	*
 	* Telemetry, not a transaction (D8/D11): every consumer that re-resolves on
 	* it must also converge on its own periodic path, because a dropped event
@@ -785,7 +802,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/device-type-D1fH5kaC.mjs
+//#region ../types/dist/device-type-DxCT0krO.mjs
 /**
 import { errMsg } from '@camstack/types'
 * Extract a human-readable message from an unknown error value.
@@ -947,6 +964,13 @@ var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
 	* filters that want "all devices with on-motion behaviour".
 	*/
 	DeviceFeature["MotionTrigger"] = "motion-trigger";
+	/**
+	* Device can be run for a chosen time and then stopped. Mirrors the
+	* `timed-run` wrapper cap — the cap is bound by the core-blocks addon, not by
+	* a driver, so the flag is derived from the device's bindings
+	* (`featuresOfBoundCaps`). Gates the quick-run control in the viewer.
+	*/
+	DeviceFeature["TimedRun"] = "timed-run";
 	/** Light supports rgb-triplet color via `color` cap. */
 	DeviceFeature["LightColorRgb"] = "light-color-rgb";
 	/** Light supports HSV color via `color` cap. */
@@ -5981,7 +6005,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-D7ZKm4nb.mjs
+//#region ../types/dist/sleep-CGPZyzB5.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6345,6 +6369,59 @@ Object.fromEntries([
 function isValuelessField(field) {
 	return field.type === "separator" || field.type === "info" || field.type === "qr-code" || field.type === "button" || field.type === "object-array" || field.type === "widget" || field.type === "addon-action-button" || field.type === "device-action-button" || field.type === "account-sign-in" || field.type === "secret-presence";
 }
+/**
+* Base collector: flatten a hydrated `ConfigUISchemaWithValues` into
+* `key → { value, default }`, recursing through `group` and `sub-tabs`
+* layout fields. Keeping `value` and `default` SEPARATE (rather than
+* pre-resolving) lets callers both read the effective value AND detect
+* overrides (`value` differs from `default`). Structural over `unknown`;
+* malformed input yields an empty map, never throws.
+*/
+function collectHydratedFieldEntries(schema) {
+	const out = /* @__PURE__ */ new Map();
+	if (typeof schema !== "object" || schema === null) return out;
+	const sections = schema.sections;
+	if (!Array.isArray(sections)) return out;
+	for (const section of sections) if (typeof section === "object" && section !== null) collectFieldEntriesInto(section.fields, out);
+	return out;
+}
+/** Recursive field walker for {@link collectHydratedFieldEntries}. */
+function collectFieldEntriesInto(fields, into) {
+	if (!Array.isArray(fields)) return;
+	for (const field of fields) {
+		if (typeof field !== "object" || field === null) continue;
+		const type = field.type;
+		if (type === "group") {
+			collectFieldEntriesInto(field.fields, into);
+			continue;
+		}
+		if (type === "sub-tabs") {
+			const tabs = field.tabs;
+			if (Array.isArray(tabs)) {
+				for (const tab of tabs) if (typeof tab === "object" && tab !== null) collectFieldEntriesInto(tab.fields, into);
+			}
+			continue;
+		}
+		const key = field.key;
+		if (typeof key !== "string" || key.length === 0) continue;
+		if (!("value" in field)) continue;
+		into.set(key, {
+			value: field.value,
+			default: field.default
+		});
+	}
+}
+/**
+* Flatten a hydrated settings payload into `key → EFFECTIVE value`
+* (`value ?? default`). The read-side inverse of `hydrateSchema` for the
+* common "just give me the resolved values" case. Built on
+* {@link collectHydratedFieldEntries}.
+*/
+function collectHydratedFieldValues(schema) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [key, entry] of collectHydratedFieldEntries(schema)) out.set(key, entry.value ?? entry.default);
+	return out;
+}
 function hydrateSchema(schema, values, options = {}) {
 	return {
 		...schema.tabs ? { tabs: [...schema.tabs] } : {},
@@ -7213,6 +7290,7 @@ var RecordIntegrationInstances = class {
 		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
 		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
 		this.nameField = kind.declaration.entry?.nameField ?? "name";
+		if (hooks.kindOf === void 0 && hooks.description.kinds.length !== 1) throw new Error(`record kind '${kind.name}': describe().kinds has ${hooks.description.kinds.length} entries, so kindOf is required to say which one an instance is`);
 	}
 	/**
 	* One instance read for the addon's own runtime; null when absent. When the keychain is
@@ -7254,10 +7332,21 @@ var RecordIntegrationInstances = class {
 		}
 		return out;
 	}
+	/** The kind an instance body is of: the provider's `kindOf`, else its one declared kind. */
+	kindOfBody(body) {
+		if (this.hooks.kindOf !== void 0) {
+			const id = this.hooks.kindOf(body);
+			if (!this.hooks.description.kinds.some((declared) => declared.id === id)) throw new Error(`record kind '${this.kind.name}': kindOf returned '${id}', which describe().kinds does not declare (D1013)`);
+			return id;
+		}
+		const only = this.hooks.description.kinds[0];
+		if (only === void 0) throw new Error(`record kind '${this.kind.name}' declares no kinds`);
+		return only.id;
+	}
 	viewOf(record) {
 		const shown = secretViewsOf(this.records.owner, this.kind.name, record.id, this.kind.declaration, record.data);
 		const rawName = record.data[this.nameField];
-		const kind = this.hooks.kindOf?.(record.data);
+		const kind = this.kindOfBody(record.data);
 		const health = this.hooks.health?.(record.data, record.id);
 		return {
 			id: record.id,
@@ -7265,7 +7354,7 @@ var RecordIntegrationInstances = class {
 			configured: this.hooks.configured(record.data),
 			enabled: isInstanceEnabled(record.data),
 			formValues: shown,
-			...kind !== void 0 ? { kind } : {},
+			kind,
 			...health?.status !== void 0 ? { status: health.status } : {},
 			...health?.lastCheckedAt !== void 0 ? { lastCheckedAt: health.lastCheckedAt } : {}
 		};
@@ -7298,17 +7387,35 @@ var RecordIntegrationInstances = class {
 			...kind !== void 0 ? { kind } : {}
 		});
 		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
+		const initial = this.hooks.initialBody(name, kind);
+		const patch = this.patchOf(values ?? {});
+		if (Object.keys(patch).length > 0) Object.assign(patch, await this.hooks.validateWrite?.({
+			kind,
+			body: {
+				...initial,
+				...patch
+			}
+		}));
 		await this.handle.put({
 			id: minted,
-			data: this.hooks.initialBody(name, kind)
+			data: initial
 		}, { ifRev: 0 });
-		const patch = this.patchOf(values ?? {});
 		if (Object.keys(patch).length > 0) await this.handle.patch(minted, patch);
 		await this.hooks.onChanged?.(minted, "created");
 		return { id: minted };
 	};
 	updateInstance = async ({ id, name, values }) => {
 		const patch = this.patchOf(values);
+		if (this.hooks.validateWrite !== void 0 && Object.keys(patch).length > 0) {
+			const stored = await this.handle.get(id);
+			if (stored !== null) Object.assign(patch, await this.hooks.validateWrite({
+				kind: void 0,
+				body: {
+					...stored.data,
+					...patch
+				}
+			}));
+		}
 		if (name !== void 0) patch[this.nameField] = name;
 		await this.handle.patch(id, patch);
 		await this.hooks.onChanged?.(id, "updated");
@@ -7619,6 +7726,21 @@ var SCOPED_SETTINGS_SCOPES = [
 	"device-defaults",
 	"node"
 ];
+/** The one refusal of a key a scope did not declare. */
+function assertDeclaredKeys(keys, declared) {
+	const undeclared = keys.filter((key) => !declared.has(key));
+	if (undeclared.length > 0) throw new Error(`scoped settings: [${undeclared.join(", ")}] not declared for this scope (declared: [${[...declared].join(", ")}])`);
+}
+/** Build the handle over an addon's scoped read, write and unset. */
+function createScopedSettings(deps) {
+	return {
+		async get() {
+			return deps.schema.parse(await deps.read());
+		},
+		patch: (patch) => deps.write(Object.fromEntries(Object.entries(patch))),
+		unset: (keys) => deps.unset(keys)
+	};
+}
 /** A write to a secret path could not be stored in the keychain, so it was refused. */
 var KeychainWriteRefusedError = class extends Error {
 	fieldPath;
@@ -8194,7 +8316,16 @@ function createHandle(raw, opts) {
 				return blob;
 			}
 		},
-		writeAddonStore: writeAddon
+		writeAddonStore: writeAddon,
+		removeClearedKeys: (keys) => serialize("addon", async () => {
+			const stored = await readStoredAddonBlob(raw);
+			index.seen("addon", stored);
+			const removable = keys.filter((key) => collectSecretMarkerRefs(stored[key]).length === 0);
+			if (removable.length === 0) return;
+			const patch = Object.fromEntries(removable.map((key) => [key, void 0]));
+			await raw.writeAddonStore(patch);
+			index.wrote("addon", patch);
+		})
 	};
 }
 /** The context the addon sees, plus the private raw view and write outcome. */
@@ -8324,7 +8455,7 @@ function boundOf(list) {
 * Base class for CamStack addons. Eliminates settings boilerplate:
 *
 * - Typed `config` property with automatic resolution from store + defaults
-* - `getGlobalSettings()` / `updateGlobalSettings()` auto-implemented
+* - the scoped settings API (`clusterSettings` / `nodeSettings` / `deviceDefaults`) auto-implemented
 * - `getAddonSettings()` / `updateAddonSettings()` auto-implemented
 * - `getDeviceSettings()` / `updateDeviceSettings()` auto-implemented
 * - `ctx` accessor for the AddonContext (no manual `this.ctxRef` storage)
@@ -8334,7 +8465,7 @@ function boundOf(list) {
 * Subclasses override:
 * - `onInitialize()` — addon-specific init logic, return ProviderRegistration[]
 * - `onShutdown()` — cleanup
-* - `globalSettingsSchema()` / `deviceSettingsSchema()` — UI schemas
+* - `clusterSettingsSchema()` / `nodeSettingsSchema()` / `deviceSettingsSchema()` — UI schemas
 *
 * @example
 * ```ts
@@ -8348,7 +8479,7 @@ function boundOf(list) {
 *     super({ maxRetries: 3, endpoint: 'http://localhost' })
 *   }
 *
-*   protected globalSettingsSchema() {
+*   protected clusterSettingsSchema() {
 *     return this.schema({
 *       sections: [{
 *         id: 'main', title: 'Settings',
@@ -8391,7 +8522,7 @@ var BaseAddon = class {
 	defaults;
 	/**
 	* Hidden-state paths that hold secrets (D787) — values the addon writes
-	* itself (`updateGlobalSettings`, `state()`) that no form field declares.
+	* itself (`state()`, the scoped writers) that no form field declares.
 	* Stored in the keychain exactly like a `password` field. Syntax:
 	* `'snapshotSigningKey'`, `'identity.pincode'`, `'tokens[userId].accessToken'`
 	* (`key[<id field>]` addresses array items by id, never by index).
@@ -8401,7 +8532,7 @@ var BaseAddon = class {
 	/**
 	* D986 M4: the scoped schemas this addon declared, resolved once per capability
 	* (`loadScopedSchemas`) so the sync readers (`perNodeKeys`, the secret tree, the restart check)
-	* see them. Empty until loaded: the readers then fall back to {@link globalSettingsSchema}.
+	* see them. Empty until loaded.
 	*/
 	_scopedByCap = /* @__PURE__ */ new Map();
 	_nodeKeysByCap = /* @__PURE__ */ new Map();
@@ -8587,7 +8718,7 @@ var BaseAddon = class {
 	/** Addon-specific cleanup. Override if needed. */
 	async onShutdown() {}
 	/**
-	* Called after config is resolved during updateGlobalSettings/updateAddonSettings.
+	* Called after config is resolved during a settings write.
 	* Override to react to config changes (e.g. restart a sampler, reconnect a service).
 	* Not called during initialize() — use onInitialize() for initial setup.
 	*/
@@ -8616,82 +8747,12 @@ var BaseAddon = class {
 	scopedSettingsCapabilities() {
 		return [];
 	}
-	/** Override to provide global-level settings UI schema. */
-	globalSettingsSchema(_cap) {
-		return null;
-	}
 	/** Override to provide device-level settings UI schema. */
 	deviceSettingsSchema() {
 		return null;
 	}
 	/**
-	* INTEGRATION-LEVEL SETTINGS — declare which of this addon's global sections
-	* ARE the configuration of its integration.
-	*
-	* Return the `ConfigSection.id`s, from {@link globalSettingsSchema}, that an
-	* operator should find on the addon's integration page (System →
-	* Integrations → <name>) rather than only in the cluster-wide list of every
-	* addon. Empty (the default) means the addon has no integration-level
-	* settings and no such surface is offered — this is opt-in, because whether
-	* an addon's configuration IS its integration's configuration depends on the
-	* nature of the integration.
-	*
-	* WHAT THIS IS NOT. It is not a scope. The selected sections keep living in
-	* the ONE global schema, in the ONE addon store, written by the ONE
-	* `updateGlobalSettings` path. There is deliberately no
-	* `updateIntegrationSettings`: a second write path is how a surface acquires
-	* a second store key, and this repo has shipped that twice (`btmPath@hub`,
-	* D266). Selecting sections cannot introduce a key that selecting cannot.
-	*
-	* WHY IT IS A LIST OF SECTION IDS AND NOT A MARKER ON THE SECTION.
-	* `ConfigFieldBase` used to carry `scope?: 'device' | 'global'` and it was
-	* removed with the reason recorded at
-	* `packages/types/src/interfaces/config-ui.ts:249` — *"a field's scope is
-	* determined by WHICH schema it lives in, not by a field-level marker."* A
-	* marker sprinkled across sections also has to borrow a field that already
-	* means something else; borrowing `section.tab` put the literal word
-	* "integration" into an operator-facing tab bar, because `tab` means "how to
-	* GROUP this visually" and cannot also mean "where this lives" (D269
-	* supersedes D268). One declaration, in one place, next to the schema whose
-	* ids it names.
-	*/
-	integrationSettingSections() {
-		return [];
-	}
-	async getGlobalSettings(overlay, cap, nodeId) {
-		await this.loadScopedSchemas(cap);
-		const schema = this.globalSettingsSchema(cap) ?? this.scopedFormSchema(cap);
-		if (!schema) return { sections: [] };
-		const projected = await this.readRawProjectedStore(nodeId, cap);
-		return hydrateSchema(schema, overlay ? await this.overlayKeepingMarkers(projected, overlay) : projected, { inlineSecretsAsViews: true });
-	}
-	/**
-	* The integration-level view of this addon's settings: exactly the sections
-	* named by {@link integrationSettingSections}, hydrated from the SAME store
-	* `getGlobalSettings` reads, and narrowed to cluster-scoped fields.
-	*
-	* Returns `null` when the addon declared nothing — an addon that opts out has
-	* no integration settings surface at all, rather than an empty one that reads
-	* as a failed load.
-	*
-	* Three properties hold BY CONSTRUCTION, which is why they are here in core
-	* and not in whichever UI happens to render this:
-	*
-	*  1. **One key.** The payload is a SUBSET of the global schema, so a field
-	*     shown here is the same field, with the same bare key, that the addon's
-	*     own page shows. There is no integration-specific writer — callers save
-	*     through `updateGlobalSettings` — so a second store key is unreachable,
-	*     not merely discouraged.
-	*  2. **No node scope.** `perNode: true` fields are DROPPED. Their store key
-	*     is `<key>@<nodeId>` and an integration is not a node; whichever node
-	*     such a field silently picked would be a wrong answer for the operator
-	*     who opened the page (D266).
-	*  3. **No silent typo.** A declared id that names no section throws. The
-	*     alternative — skip it — turns a rename into a surface that quietly
-	*     empties, which looks exactly like an addon with nothing to configure.
-	*/
-	/**
-	* The form schema of ONE integration instance, or `null` to use {@link globalSettingsSchema}.
+	* The form schema of ONE integration instance, or `null` to use the scoped form.
 	*
 	* Override it only when an `instanceMode: multiple` addon's instances differ: an NVR integration
 	* needs its connection fields, the default integration the addon's own sections. It is the
@@ -8739,37 +8800,178 @@ var BaseAddon = class {
 		}
 	}
 	/**
+	* Hook: values layered over the stored ones when the FORM of one scope is served
+	* ({@link getScopedSettings}) — a preview that derives dependent options without writing.
+	* Never applied to {@link ScopedSettings.get} or to a write. `null` ⇒ no overlay.
+	*/
+	async scopedSettingsOverlay(_scope, _cap, _nodeId) {
+		return null;
+	}
+	/**
+	* Hook: a write of one scope changed stored values (not called when the store reports no change,
+	* e.g. the write-back of a stored secret). `keys` are the bare field keys of the write, node keys included.
+	*/
+	async onScopedSettingsChanged(_scope, _cap, _keys) {}
+	/** Typed handle over the CLUSTER settings `cap` declares (`clusterSettingsSchema`). */
+	clusterSettings(cap, schema) {
+		return this.scopedHandle("cluster", cap, schema);
+	}
+	/** Typed handle over the fleet defaults of the per-device settings `cap` declares. */
+	deviceDefaults(cap, schema) {
+		return this.scopedHandle("device-defaults", cap, schema);
+	}
+	/**
+	* Typed handle over the settings `cap` owns PER NODE. `nodeId` omitted ⇒ the local node. A node
+	* with no row yields the schema defaults — never a bare-key fallback.
+	*/
+	nodeSettings(cap, schema, nodeId) {
+		return this.scopedHandle("node", cap, schema, nodeId);
+	}
+	/**
+	* {@link state} for a value that is kept per node: stored under `<key>@<nodeId>`, and the
+	* settings store carries `nodeId` in the row data (D986 §1), so a forgotten node's rows go in one
+	* central delete. `nodeId` omitted ⇒ the local node.
+	*/
+	nodeState(key, schema, fallback, nodeId) {
+		this._declaredStateKeys.add(key);
+		return createDurableState({
+			key: nodeScopedKey(key, nodeId ?? this._ctx?.kernel?.localNodeId ?? ""),
+			schema,
+			fallback,
+			read: async () => this.resolveStoredSecrets(await this.readAddonStoreWithRetry()),
+			write: async (patch) => {
+				await this._ctx?.settings?.writeAddonStore(patch);
+			},
+			onParseError: (k, e) => this._ctx?.logger?.warn?.(`durable-state: stored "${k}" failed validation — using fallback`, { meta: {
+				addonId: this._ctx?.id,
+				key: k,
+				error: String(e)
+			} })
+		});
+	}
+	/** The loaded schema `cap` declares for `scope`, or `null`. */
+	async declaredScopedSchema(scope, cap) {
+		await this.loadScopedSchemas(cap);
+		return this.loadedScopedSchemas(cap).find((entry) => entry.scope === scope)?.schema ?? null;
+	}
+	async requireScopedSchema(scope, cap) {
+		const schema = await this.declaredScopedSchema(scope, cap);
+		if (schema === null) throw new Error(`${this.constructor.name}: cap "${cap}" declares no ${scope} settings`);
+		return schema;
+	}
+	scopedKeys(schema) {
+		return new Set(schema.sections.flatMap((section) => collectValueFieldKeys(section.fields)));
+	}
+	/** `store` narrowed to the keys `schema` declares. */
+	narrowToScope(store, schema) {
+		const keys = this.scopedKeys(schema);
+		return Object.fromEntries(Object.entries(store).filter(([key]) => keys.has(key)));
+	}
+	scopedHandle(scope, cap, schema, nodeId) {
+		return createScopedSettings({
+			schema,
+			read: async () => {
+				const declared = await this.requireScopedSchema(scope, cap);
+				const stored = this.narrowToScope(await this.resolveGlobalStore(nodeId, cap), declared);
+				const effective = collectHydratedFieldValues(hydrateSchema(declared, stored));
+				return {
+					...Object.fromEntries([...effective].filter(([, value]) => value !== void 0)),
+					...stored
+				};
+			},
+			write: (patch) => this.writeScoped(scope, cap, patch, nodeId),
+			unset: (keys) => this.unsetScoped(scope, cap, keys, nodeId)
+		});
+	}
+	/** The one write path of the scoped API: declared keys only, then the global patch. */
+	async writeScoped(scope, cap, patch, nodeId) {
+		assertDeclaredKeys(Object.keys(patch), this.scopedKeys(await this.requireScopedSchema(scope, cap)));
+		if (await this.applyGlobalPatch(patch, scope === "node" ? nodeId : void 0, cap)) await this.onScopedSettingsChanged(scope, cap, Object.keys(patch));
+	}
+	/**
+	* Remove declared keys of one scope. A secret goes through {@link clearSecrets} — its keychain
+	* value is released exactly as there — and the emptied row is then removed; every other key is
+	* removed by an `undefined` patch (which a secret transform would read as "keep").
+	*/
+	async unsetScoped(scope, cap, keys, nodeId) {
+		assertDeclaredKeys(keys, this.scopedKeys(await this.requireScopedSchema(scope, cap)));
+		const target = scope === "node" ? nodeId : void 0;
+		const tree = this.addonSecretTree();
+		const secretKeys = keys.filter((key) => tree.has(key));
+		const plainKeys = keys.filter((key) => !tree.has(key));
+		let changed = false;
+		if (plainKeys.length > 0) {
+			const patch = Object.fromEntries(plainKeys.map((key) => [key, void 0]));
+			changed = await this.applyGlobalPatch(patch, target, cap) || changed;
+		}
+		if (secretKeys.length > 0) {
+			await this.clearSecretKeys(secretKeys, target, cap);
+			const node = normalizeNodeId(target ?? this._ctx?.kernel?.localNodeId);
+			const rows = secretKeys.map((key) => scope === "node" ? nodeScopedKey(key, node) : key);
+			if (this._secretSettings !== null) await this._secretSettings.removeClearedKeys(rows);
+			else await this._ctx?.settings?.writeAddonStore(Object.fromEntries(rows.map((row) => [row, void 0])));
+			changed = true;
+		}
+		if (changed) await this.onScopedSettingsChanged(scope, cap, [...keys]);
+	}
+	/**
+	* The hydrated form of one scope of one capability's settings (any
+	* {@link scopedSettingsOverlay} applied), or `null` when the capability declares nothing there.
+	*/
+	async getScopedSettings(scope, cap, nodeId) {
+		const schema = await this.declaredScopedSchema(scope, cap);
+		if (schema === null) return null;
+		const stored = this.narrowToScope(await this.readRawProjectedStore(nodeId, cap), schema);
+		const overlay = await this.scopedSettingsOverlay(scope, cap, nodeId);
+		return hydrateSchema(schema, overlay ? await this.overlayKeepingMarkers(stored, overlay) : stored, { inlineSecretsAsViews: true });
+	}
+	/**
+	* The scoped schemas this addon serves: one entry per loaded (capability, scope), capabilities
+	* in declaration order, scopes in {@link SCOPED_SETTINGS_SCOPES} order. `[]` when it declares
+	* nothing.
+	*/
+	async listScopedSettings() {
+		await this.loadScopedSchemas();
+		return [...this._scopedByCap].flatMap(([cap, entries]) => entries.map((entry) => ({
+			cap,
+			scope: entry.scope,
+			sectionIds: entry.schema.sections.map((section) => section.id)
+		})));
+	}
+	/** The OPERATOR's write of declared keys of one scope (D787 secret semantics). */
+	async updateScopedSettings(scope, cap, patch, nodeId) {
+		this._operatorWriteDepth++;
+		try {
+			await this.writeScoped(scope, cap, patch, nodeId);
+		} finally {
+			this._operatorWriteDepth--;
+		}
+	}
+	/**
+	* The effective values (`stored ?? default`) of one scope, a secret as its `set` view — never
+	* its value. `null` when the capability declares nothing for the scope.
+	*/
+	async readScopedValues(scope, cap, nodeId) {
+		const schema = await this.declaredScopedSchema(scope, cap);
+		if (schema === null) return null;
+		const form = hydrateSchema(schema, this.narrowToScope(await this.readRawProjectedStore(nodeId, cap), schema), { inlineSecretsAsViews: true });
+		return Object.fromEntries([...collectHydratedFieldValues(form)].filter(([, value]) => value !== void 0));
+	}
+	/**
 	* What the create wizard and the integration edit page render for one instance: the addon's
 	* per-instance schema when it declares one, else its global schema (what they always showed).
 	*/
 	async getIntegrationFormSchema(instance, nodeId) {
 		const scoped = await this.integrationFormSchema(instance);
-		if (scoped === null) return this.getGlobalSettings(void 0, void 0, nodeId);
+		if (scoped === null) return this.scopedForm(nodeId);
 		return hydrateSchema(scoped, {}, { inlineSecretsAsViews: true });
 	}
-	async getIntegrationSettings(nodeId) {
-		const declared = this.integrationSettingSections();
-		if (declared.length === 0) return null;
-		const schema = this.globalSettingsSchema();
-		if (!schema) throw new Error(`${this.constructor.name}: integrationSettingSections() names [${declared.join(", ")}] but globalSettingsSchema() returns null.`);
-		const byId = new Map(schema.sections.map((section) => [section.id, section]));
-		const sections = [];
-		for (const id of declared) {
-			const section = byId.get(id);
-			if (!section) throw new Error(`${this.constructor.name}: integrationSettingSections() names unknown section "${id}". Known sections: [${[...byId.keys()].join(", ")}].`);
-			const fields = dropPerNodeFields(section.fields);
-			if (fields.length === 0) continue;
-			sections.push({
-				...section,
-				fields
-			});
-		}
-		if (sections.length === 0) return null;
-		const projected = await this.readRawProjectedStore(nodeId);
-		return hydrateSchema({
-			...schema,
-			sections
-		}, projected, { inlineSecretsAsViews: true });
+	/** The form of the scoped schemas this addon declared, hydrated from its store. */
+	async scopedForm(nodeId) {
+		await this.loadScopedSchemas();
+		const schema = this.scopedFormSchema();
+		if (!schema) return { sections: [] };
+		return hydrateSchema(schema, await this.readRawProjectedStore(nodeId), { inlineSecretsAsViews: true });
 	}
 	/**
 	* The raw addon store PROJECTED onto the target node's bare per-node keys:
@@ -8778,8 +8980,8 @@ var BaseAddon = class {
 	* bare fallback), all `@`-scoped and stray bare per-node keys are dropped.
 	* A no-op passthrough when the schema declares no `perNode` field.
 	*
-	* This is the sanctioned way for a `getGlobalSettings` OVERRIDE that needs
-	* the store for custom option logic (option narrowing, value snapping) to
+	* This is the sanctioned way for an addon that needs
+	* the store for custom logic (option narrowing, value snapping) to
 	* read it per-node — never `ctx.settings.readAddonStore()` directly.
 	* `nodeId` omitted ⇒ the local node (node-blind injection from ctx).
 	*
@@ -8831,7 +9033,7 @@ var BaseAddon = class {
 	}
 	/**
 	* Whether ONE global key of this addon's store was written, read three-way
-	* (D651). For a question a hydrated view cannot answer: `getGlobalSettings`
+	* (D651). For a question a hydrated view cannot answer: a hydrated form
 	* reports `value ?? default`, so "the operator chose the default" and "nobody
 	* chose" look the same, and a failed read looks like both. A `perNode` key is
 	* not supported here: its stored name is scoped.
@@ -8865,7 +9067,7 @@ var BaseAddon = class {
 	}
 	/**
 	* The OPERATOR's write — a settings form or an admin API call, dispatched by
-	* the kernel. Identical to {@link updateGlobalSettings}, except that a secret
+	* the kernel. The one in-process write of the addon blob that is not a scoped write; a secret
 	* the operator sends is stored as sent even when it equals a pre-keychain
 	* inline value: the operator re-entering a password is a change, an addon
 	* writing back what it read is not (D787).
@@ -8878,9 +9080,6 @@ var BaseAddon = class {
 			this._operatorWriteDepth--;
 		}
 	}
-	async updateGlobalSettings(patch, nodeId) {
-		await this.applyGlobalPatch(patch, nodeId);
-	}
 	/**
 	* REMOVE stored secrets — their keychain values and their markers (D787).
 	*
@@ -8890,6 +9089,9 @@ var BaseAddon = class {
 	* a keychain (an older kernel) it writes `''`, as such code always did.
 	*/
 	async clearSecrets(keys, nodeId) {
+		await this.clearSecretKeys(keys, nodeId);
+	}
+	async clearSecretKeys(keys, nodeId, cap) {
 		const tree = this.addonSecretTree();
 		const keychain = this._ctx?.secrets !== void 0;
 		const stored = keychain ? await this.readAddonStoreWithRetry() : {};
@@ -8902,25 +9104,26 @@ var BaseAddon = class {
 			const keychainStored = tree.has(key) || collectSecretMarkerRefs(stored[key]).length > 0;
 			patch[key] = keychain && keychainStored ? SECRET_CLEAR : "";
 		}
-		await this.applyGlobalPatch(patch, nodeId);
+		await this.applyGlobalPatch(patch, nodeId, cap);
 	}
-	async applyGlobalPatch(barePatch, nodeId) {
-		await this.loadScopedSchemas();
-		const keys = this.perNodeKeys();
+	/** Resolves `true` when the write changed stored values. */
+	async applyGlobalPatch(barePatch, nodeId, cap) {
+		await this.loadScopedSchemas(cap);
+		const keys = this.perNodeKeys(cap);
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
 		const scoped = keys.size > 0 ? scopePatch(barePatch, keys, target) : barePatch;
 		const handle = this._secretSettings;
 		if (handle !== null) {
 			const { changed } = await handle.writeAddonStore(scoped);
-			if (!changed) return;
+			if (!changed) return false;
 		} else await this._ctx?.settings?.writeAddonStore(scoped);
-		if (target !== localNode) return;
+		if (target !== localNode) return true;
 		await this.resolveConfig();
 		await this.onConfigChanged();
 		this.emitLifecycle(EventCategory.AddonUpdated, { level: "global" });
-		const legacy = this.globalSettingsSchema();
-		this.maybeAutoRestart(Object.keys(barePatch), [...legacy === null ? [] : [legacy], ...this.loadedScopedSchemas().map((entry) => entry.schema)]);
+		this.maybeAutoRestart(Object.keys(barePatch), this.loadedScopedSchemas().map((entry) => entry.schema));
+		return true;
 	}
 	/**
 	* The set of field keys the global settings schema declares `perNode: true`
@@ -8957,10 +9160,7 @@ var BaseAddon = class {
 		this._nodeKeysByCap = /* @__PURE__ */ new Map();
 		this._addonSecretTree = null;
 	}
-	/**
-	* The form the settings API serves while an addon declares no {@link globalSettingsSchema}: the
-	* sections of its scoped schemas, so dropping the old hook does not blank the form.
-	*/
+	/** The form of an addon's scoped schemas: their sections, each shown once. */
 	scopedFormSchema(cap) {
 		const byId = /* @__PURE__ */ new Map();
 		for (const entry of this.loadedScopedSchemas(cap)) for (const section of entry.schema.sections) if (!byId.has(section.id)) byId.set(section.id, section);
@@ -8972,8 +9172,7 @@ var BaseAddon = class {
 		return [...this._scopedByCap.values()].flat();
 	}
 	/**
-	* The field keys that are stored per node: every field of a {@link nodeSettingsSchema}, plus
-	* the fields the legacy {@link globalSettingsSchema} still marks `perNode: true`. Derived once
+	* The field keys that are stored per node: every field of a {@link nodeSettingsSchema}. Derived once
 	* per `cap` argument and memoized (schemas are static declarations). Empty set ⇒ every
 	* per-node code path is bypassed and the settings API behaves like the node-agnostic one.
 	* Call {@link loadScopedSchemas} first (the async seams do).
@@ -8982,8 +9181,7 @@ var BaseAddon = class {
 		const cacheKey = cap ?? "";
 		const cached = this._nodeKeysByCap.get(cacheKey);
 		if (cached) return cached;
-		const legacy = this.globalSettingsSchema(cap);
-		const keys = new Set(legacy ? legacy.sections.flatMap((section) => collectPerNodeFieldKeys(section.fields)) : []);
+		const keys = /* @__PURE__ */ new Set();
 		for (const { scope, schema } of this.loadedScopedSchemas(cap)) {
 			if (scope !== "node") continue;
 			for (const section of schema.sections) for (const key of collectValueFieldKeys(section.fields)) keys.add(key);
@@ -9201,8 +9399,6 @@ var BaseAddon = class {
 	}
 	declaredKeySet() {
 		const keys = new Set(Object.keys(this.defaults));
-		const schema = this.globalSettingsSchema();
-		if (schema) for (const section of schema.sections) for (const key of collectFieldKeys(section.fields)) keys.add(key);
 		for (const { schema: scoped } of this.loadedScopedSchemas()) for (const section of scoped.sections) for (const key of collectFieldKeys(section.fields)) keys.add(key);
 		for (const key of this._declaredStateKeys) keys.add(key);
 		for (const path of this.secretStatePaths) {
@@ -9300,7 +9496,7 @@ var BaseAddon = class {
 	/** The addon store's secret tree: schema fields by TYPE, plus `secretStatePaths`. */
 	addonSecretTree() {
 		if (this._addonSecretTree === null) {
-			const tree = new Map(secretTreeFromSchema(this.globalSettingsSchema()));
+			const tree = /* @__PURE__ */ new Map();
 			for (const { schema } of this.loadedScopedSchemas()) for (const [key, node] of secretTreeFromSchema(schema)) tree.set(key, node);
 			this._addonSecretTree = mergeSecretStatePaths(tree, this.secretStatePaths);
 		}
@@ -9512,47 +9708,6 @@ function classifyStoreError(err) {
 	if (TRANSPORT_PHRASES.some((f) => message.includes(f))) return "transport";
 	return "permanent";
 }
-/**
-* Collect the keys of every field marked `perNode: true`, recursing into
-* layout containers (`group` fields and `sub-tabs` tabs) the same way
-* `hydrateSchema` does. Valueless structural fields (separator/info/…)
-* don't declare `perNode` and are excluded by the `in` narrowing.
-*/
-/**
-* The same fields with every `perNode: true` one removed, recursing into layout
-* containers exactly as {@link collectPerNodeFieldKeys} does. A container left
-* with no child is dropped rather than rendered empty.
-*
-* Used by `getIntegrationSettings`: an integration is not a node, so a field
-* whose store key is `<key>@<nodeId>` has no node to belong to there.
-*/
-function dropPerNodeFields(fields) {
-	const kept = [];
-	for (const field of fields) {
-		if (field.type === "group") {
-			const inner = dropPerNodeFields(field.fields);
-			if (inner.length > 0) kept.push({
-				...field,
-				fields: inner
-			});
-			continue;
-		}
-		if (field.type === "sub-tabs") {
-			const tabs = field.tabs.map((tab) => ({
-				...tab,
-				fields: dropPerNodeFields(tab.fields)
-			})).filter((tab) => tab.fields.length > 0);
-			if (tabs.length > 0) kept.push({
-				...field,
-				tabs
-			});
-			continue;
-		}
-		if ("perNode" in field && field.perNode === true) continue;
-		kept.push(field);
-	}
-	return kept;
-}
 /** The keys of the value-holding fields, recursing into layout containers. */
 function collectValueFieldKeys(fields) {
 	const collected = [];
@@ -9585,21 +9740,6 @@ function collectFieldKeys(fields) {
 	}
 	return collected;
 }
-function collectPerNodeFieldKeys(fields) {
-	const collected = [];
-	for (const field of fields) {
-		if (field.type === "group") {
-			collected.push(...collectPerNodeFieldKeys(field.fields));
-			continue;
-		}
-		if (field.type === "sub-tabs") {
-			for (const tab of field.tabs) collected.push(...collectPerNodeFieldKeys(tab.fields));
-			continue;
-		}
-		if ("perNode" in field && field.perNode === true) collected.push(field.key);
-	}
-	return collected;
-}
 /**
 * Normalize an `ICamstackAddon.initialize()` return value into the
 * `AddonInitResult` envelope. Arrays are wrapped into `{ providers }`;
@@ -10654,7 +10794,6 @@ var CAP_NAMES = Object.freeze([
 	"notifier",
 	"numeric-sensor",
 	"oauth-integration",
-	"oidc-connections",
 	"osd",
 	"osd-manager",
 	"pet-feeder",
@@ -12361,13 +12500,25 @@ Object.freeze({
 		"path": "temperature",
 		"valueType": "number"
 	}],
-	"timed-run": [{
-		"path": "activeUntil",
-		"valueType": "number"
-	}, {
-		"path": "requestedBy",
-		"valueType": "string"
-	}],
+	"timed-run": [
+		{
+			"path": "activeUntil",
+			"valueType": "number"
+		},
+		{
+			"path": "requestedBy",
+			"valueType": "string"
+		},
+		{
+			"path": "quickRun.duration",
+			"valueType": "number"
+		},
+		{
+			"path": "quickRun.unit",
+			"valueType": "enum",
+			"enumValues": ["s", "min"]
+		}
+	],
 	"update": [
 		{
 			"path": "currentVersion",
@@ -12546,8 +12697,7 @@ Object.freeze({
 	"device-provider": { "reloadDevice": 18e4 },
 	"llm": {
 		"generate": 6e5,
-		"generateVision": 6e5,
-		"testProfile": 6e5
+		"generateVision": 6e5
 	},
 	"llm-runtime": {
 		"complete": 6e5,
@@ -12592,7 +12742,7 @@ object({
 	params: record(string(), union([string(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/composition-BmBHuDTQ.mjs
+//#region ../types/dist/composition-Bx0JvKUU.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -13754,458 +13904,844 @@ var NodeColorIdSchema = _enum([
 	"node-h"
 ]);
 //#endregion
-//#region ../types/dist/index.mjs
-var SMTP_INBOUND_DEFAULT_PORT = 2525;
-var SMTP_INBOUND_DEFAULT_DOMAIN = "camstack.local";
-var SMTP_INBOUND_DEFAULT_MAX_MESSAGE_BYTES = 25 * 1024 * 1024;
-/** The text excerpt a message carries on the bus. */
-var SMTP_INBOUND_TEXT_MAX_CHARS = 4096;
-var PortSchema = number().int().min(1).max(65535);
-/** A recipient local-part: what stands before the `@`. */
-var SmtpRecipientSchema = string().min(1).max(64).regex(/^[A-Za-z0-9._+-]+$/);
-object({
-	port: PortSchema.default(SMTP_INBOUND_DEFAULT_PORT),
-	bindHost: string().min(1).default("0.0.0.0"),
-	domain: string().min(1).default(SMTP_INBOUND_DEFAULT_DOMAIN),
-	requireAuth: boolean().default(true),
-	username: string().default(""),
-	password: string().default("").meta({ secret: true }),
-	starttls: boolean().default(false),
-	maxMessageBytes: number().int().positive().default(SMTP_INBOUND_DEFAULT_MAX_MESSAGE_BYTES)
-});
-object({
-	host: string().min(1).nullable(),
-	hostReason: string().nullable(),
-	port: PortSchema,
-	domain: string().min(1),
-	requireAuth: boolean(),
-	username: string(),
-	password: string(),
-	starttls: boolean()
-});
-object({
-	recipients: array(SmtpRecipientSchema).min(1),
-	/**
-	* Who is subscribing. A second `subscribe` with the same id REPLACES that subscriber's
-	* recipients (the way a consumer that restarted, or lost a device, declares its set again);
-	* a recipient held by another subscriber is refused with `smtp-inbound/recipient-claimed`.
-	* Absent, the subscriber is anonymous and unique.
-	*/
-	subscriberId: string().min(1).max(64).optional()
-});
-var SmtpInboundAttachmentSchema = object({
-	filename: string(),
-	contentType: string(),
-	bytes: number().int().nonnegative()
-});
-/** The payload of one `broker.message` (the key is the recipient local-part). */
-var SmtpInboundMessageSchema = object({
-	/** Monotonic per mailbox; a gap tells a consumer it missed an event. */
-	seq: number().int().positive(),
-	messageId: string(),
-	receivedAt: number().int().nonnegative(),
-	from: string(),
-	to: string(),
-	subject: string(),
-	text: string().max(SMTP_INBOUND_TEXT_MAX_CHARS),
-	attachments: array(SmtpInboundAttachmentSchema)
-});
-object({
-	/** The newest seq issued so far (0 before any mail). */
-	lastSeq: number().int().nonnegative(),
-	/** The oldest seq still retained; messages below it are gone. */
-	oldestSeq: number().int().nonnegative(),
-	messages: array(object({
-		key: string(),
-		message: SmtpInboundMessageSchema
-	}))
-});
-new Set([
-	"track",
-	"face",
-	"identity",
-	"plate",
-	"vehicle",
-	"scene",
-	"motion",
-	"object",
-	"audio",
-	"mosaic"
-]);
-/**
-* The owner types that are event tables, in the order the event-media resolver
-* should consider them. Exported so a consumer asking "is this key an event?"
-* does not re-spell the list and drift from it.
-*/
-var EVENT_OWNER_TYPES = [
-	"motion",
-	"object",
-	"audio"
-];
-/**
-* The same list as a Zod enum, for the cap inputs that must NAME the table
-* (D482: `getEventMedia` / `listEventMedia` take an owner, and an owner is
-* `(table, id)`).
-*
-* Built FROM {@link EVENT_OWNER_TYPES} rather than re-spelled: a fourth event
-* table would otherwise be accepted by the codec and refused at the door, with
-* nothing failing until a caller asked.
-*/
-var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
-/** The same list as a Zod enum, for the cap input that carries it. */
-var MediaPresenceOwnerKindSchema = _enum([...EVENT_OWNER_TYPES, "track"]);
-new Set(EVENT_OWNER_TYPES);
-/**
-* What a published package needs from the rest of the install (D989).
-*
-* One published framework package (`@camstack/server`) carries the kernel, the
-* builtins and the capability contracts, so "which addon runs on which
-* framework" is a question of version, and the answer is DECLARED by the
-* package that knows it:
-*
-*   - an addon says the oldest server it runs on (`requires.server: ">=X"`);
-*   - the server says the oldest addon it works with
-*     (`requires.addons: { "@camstack/addon-x": ">=Y" }`) and the oldest shell
-*     around it (`requires.wrapper: { desktop, image }`);
-*   - a wrapper (the desktop app, the container starter) says which server
-*     range it can host, and reports its own kind and version.
-*
-* The publish workflow STAMPS these after the version bump
-* (`scripts/ci/stamp-requires.mjs`); nobody types a number by hand.
-*
-* A requirement that cannot be checked is NOT met: a shell that reports no
-* version counts as below the minimum, and an unreadable running version is
-* named in the result (a failed read is never a pass).
-*/
-/** `>=MAJOR.MINOR.PATCH[-prerelease]` — the only range shape a requirement uses. */
-var MinVersionSchema = string().regex(/^>=\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/, "a minimum is written \">=X.Y.Z\"");
-object({
-	/** The oldest `@camstack/server` this package runs on. */
-	server: MinVersionSchema.optional(),
-	/** The oldest installed version of each named addon package. */
-	addons: record(string(), MinVersionSchema).optional(),
-	/** The oldest shell around the server, per shell kind. */
-	wrapper: object({
-		desktop: MinVersionSchema.optional(),
-		image: MinVersionSchema.optional()
-	}).optional()
-});
-/** One unmet requirement; each names the versions on both sides. */
-var UnmetRequirementSchema = discriminatedUnion("kind", [
-	object({
-		kind: literal("server-too-old"),
-		required: string(),
-		/** `null` — the running server version could not be read. */
-		running: string().nullable()
-	}),
-	object({
-		kind: literal("addon-too-old"),
-		packageName: string(),
-		required: string(),
-		/** `null` — the addon is not installed (or its version is unreadable). */
-		running: string().nullable()
-	}),
-	object({
-		kind: literal("wrapper-too-old"),
-		wrapper: _enum(["desktop", "image"]),
-		required: string(),
-		/** `null` — the wrapper reported no version. */
-		running: string().nullable()
-	})
-]);
-var RequiredAddonUpdateSchema = object({
-	packageName: string(),
-	/** The minimum the target server declares. */
-	required: string(),
-	/** What this node has; `null` when the addon is not installed. */
-	installed: string().nullable()
-});
-/**
-* Which integration instance a settings form is for. An addon that serves several instances
-* (`instanceMode: multiple`) can show a different form per instance — an NVR integration
-* needs its connection, the default integration needs the addon's own sections.
-*
-* - `integrationId` is `null` in the create wizard: nothing exists yet, the operator is
-*   setting up a NEW instance.
-* - `mode` is the wizard mode of the integration type (`getAvailableTypes`).
-* - `candidateStableId` is the discovery candidate a wizard was seeded from, if any.
-*/
-var IntegrationInstanceRefSchema = object({
-	integrationId: string().nullable(),
-	mode: _enum([
-		"standalone",
-		"account",
-		"broker"
-	]),
-	candidateStableId: string().optional()
-});
-/**
-* notification-output — canonical, capability-gated notification delivery.
-*
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
-*
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
-*
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = _enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: string().optional(),
-	bytes: _instanceof(Uint8Array).optional(),
-	mime: string().optional(),
-	name: string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = _enum([
-	"text",
-	"markdown",
-	"html"
-]);
+//#region ../types/dist/convert-BAzH15HU.mjs
 /**
-* The CLOSED icon vocabulary an action button may use.
-*
-* A closed set, not a free string, and that is the whole point: an arbitrary
-* icon name is one that ntfy renders, zentik silently drops, and nobody
-* notices — the same class of gap as a zone vocabulary nothing produced
-* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
-* declares `actionIcons: false` and the degrade engine strips the field.
-*
-* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
-* renderer's icon set; "acknowledge" survives an adapter that draws it
-* differently.
-*
-* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
-*
-* These names are for US. **No adapter may forward one verbatim.** Each maps
-* the whole set onto its own renderer's vocabulary through a
-* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
-* fallback, so adding a member here fails every adapter's build until someone
-* decides its glyph, which is the only place that decision can be made
-* honestly.
-*
-* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
-* `disarm` straight through; iOS feeds that string to
-* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
-* and every snooze and alarm button arrived BLANK. A pass-through is not a
-* mapping, and "the field is documented" is not "the value renders".
-*
-* Adding a member is TRAIN-BOUND. The enum lives in the published
-* `@camstack/server` closure and the cap seam validates against the HUB's copy,
-* so an addon that emits a token the running hub does not know does not lose an
-* icon — its whole `send` fails Zod validation and the notification never
-* arrives. Never emit a new token from an addon before the train carrying it.
+* Frozen unit → spec table. `•` in the doc marks each dimension's canonical
+* unit (`factor: 1, offset: 0`). °F derives from `°C = (°F − 32) × 5/9` ⇒
+* `factor = 5/9`, `offset = -160/9` (kept as exact expressions, not rounded
+* decimals). K derives from `°C = K − 273.15`.
 */
-var NotificationActionIconSchema = _enum([
-	"acknowledge",
-	"dismiss",
-	"silence",
-	"snooze",
-	"view",
-	"play",
-	"open",
-	"close",
-	"lock",
-	"unlock",
-	"arm",
-	"arm-home",
-	"arm-away",
-	"arm-night",
-	"disarm",
-	"light",
-	"alert",
-	"camera"
-]);
-/** A single tap-through action button. */
-var NotificationActionSchema = object({
-	id: string(),
-	label: string(),
-	url: string().optional(),
-	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
-	icon: NotificationActionIconSchema.optional(),
-	/**
-	* Renders in a warning style where the notifier supports it.
-	*
-	* A HINT, never a gate. The callback's authority is its token and nothing
-	* else — see `notification-center/action-token.ts` for what that does and
-	* does not buy.
-	*/
-	destructive: boolean().optional(),
-	/**
-	* How the tap should REACH the url.
-	*
-	* `navigate` (absent, and every button authored before this field) opens it:
-	* the phone leaves the notification and shows whatever the callback returns.
-	* That is right for a button whose answer the operator wants to read.
-	*
-	* `background` fires it as a POST and stays put. It exists for the buttons
-	* whose whole point is not to interrupt — "silence this for 30 minutes" is
-	* an answer to the notification, and being thrown into a browser tab to
-	* confirm it costs more attention than the notification did. A backend that
-	* cannot do a background call renders it as an ordinary link (the adapters
-	* fall back rather than dropping the button), so this is a preference, never
-	* a requirement.
-	*/
-	mode: _enum(["navigate", "background"]).optional()
-});
-/** A delivery parameter value: what a notifier declared it takes. */
-var DeliveryParamValueSchema = union([
-	string(),
-	number(),
-	boolean()
-]);
-/**
-* One extra delivery parameter a notifier KIND declares (D938). A rule that
-* addresses a target of that kind may set it; a kind that declares nothing is
-* never handed one. The admin UI derives its control from this descriptor —
-* no editor knows a service by name.
-*
-* Optional fields are `.optional()`, never `.default()` (a Zod default does not
-* run on the addon cap path).
-*/
-var DeliveryParamSchema = object({
-	key: string().min(1),
-	label: string(),
-	/** i18n key of the label, resolved by the declaring addon's namespace. */
-	labelKey: string().optional(),
-	type: _enum([
-		"enum",
-		"number",
-		"boolean",
-		"string"
-	]),
-	/** `enum` only: the closed set of accepted values. */
-	options: array(object({
-		value: string(),
-		label: string()
-	})).optional(),
-	/** `number` only. */
-	min: number().optional(),
-	max: number().optional(),
-	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
-	default: DeliveryParamValueSchema.optional()
-});
+var UNIT_TABLE = {
+	"°C": {
+		dimension: "temperature",
+		factor: 1,
+		offset: 0
+	},
+	"°F": {
+		dimension: "temperature",
+		factor: 5 / 9,
+		offset: -160 / 9
+	},
+	K: {
+		dimension: "temperature",
+		factor: 1,
+		offset: -273.15
+	},
+	hPa: {
+		dimension: "pressure",
+		factor: 1,
+		offset: 0
+	},
+	kPa: {
+		dimension: "pressure",
+		factor: 10,
+		offset: 0
+	},
+	Pa: {
+		dimension: "pressure",
+		factor: .01,
+		offset: 0
+	},
+	mbar: {
+		dimension: "pressure",
+		factor: 1,
+		offset: 0
+	},
+	bar: {
+		dimension: "pressure",
+		factor: 1e3,
+		offset: 0
+	},
+	inHg: {
+		dimension: "pressure",
+		factor: 33.8639,
+		offset: 0
+	},
+	mmHg: {
+		dimension: "pressure",
+		factor: 1.33322,
+		offset: 0
+	},
+	psi: {
+		dimension: "pressure",
+		factor: 68.9476,
+		offset: 0
+	},
+	"m/s": {
+		dimension: "speed",
+		factor: 1,
+		offset: 0
+	},
+	"km/h": {
+		dimension: "speed",
+		factor: 1 / 3.6,
+		offset: 0
+	},
+	mph: {
+		dimension: "speed",
+		factor: .44704,
+		offset: 0
+	},
+	kn: {
+		dimension: "speed",
+		factor: .514444,
+		offset: 0
+	},
+	"mm/h": {
+		dimension: "precipitation-rate",
+		factor: 1,
+		offset: 0
+	},
+	"in/h": {
+		dimension: "precipitation-rate",
+		factor: 25.4,
+		offset: 0
+	},
+	m: {
+		dimension: "length",
+		factor: 1,
+		offset: 0
+	},
+	mm: {
+		dimension: "length",
+		factor: .001,
+		offset: 0
+	},
+	cm: {
+		dimension: "length",
+		factor: .01,
+		offset: 0
+	},
+	km: {
+		dimension: "length",
+		factor: 1e3,
+		offset: 0
+	},
+	in: {
+		dimension: "length",
+		factor: .0254,
+		offset: 0
+	},
+	ft: {
+		dimension: "length",
+		factor: .3048,
+		offset: 0
+	},
+	mi: {
+		dimension: "length",
+		factor: 1609.344,
+		offset: 0
+	},
+	"m²": {
+		dimension: "area",
+		factor: 1,
+		offset: 0
+	},
+	lx: {
+		dimension: "illuminance",
+		factor: 1,
+		offset: 0
+	},
+	"W/m²": {
+		dimension: "irradiance",
+		factor: 1,
+		offset: 0
+	},
+	W: {
+		dimension: "power",
+		factor: 1,
+		offset: 0
+	},
+	kW: {
+		dimension: "power",
+		factor: 1e3,
+		offset: 0
+	},
+	VA: {
+		dimension: "apparent-power",
+		factor: 1,
+		offset: 0
+	},
+	Wh: {
+		dimension: "energy",
+		factor: 1,
+		offset: 0
+	},
+	kWh: {
+		dimension: "energy",
+		factor: 1e3,
+		offset: 0
+	},
+	MWh: {
+		dimension: "energy",
+		factor: 1e6,
+		offset: 0
+	},
+	V: {
+		dimension: "voltage",
+		factor: 1,
+		offset: 0
+	},
+	mV: {
+		dimension: "voltage",
+		factor: .001,
+		offset: 0
+	},
+	A: {
+		dimension: "current",
+		factor: 1,
+		offset: 0
+	},
+	mA: {
+		dimension: "current",
+		factor: .001,
+		offset: 0
+	},
+	ppm: {
+		dimension: "concentration-volume",
+		factor: 1,
+		offset: 0
+	},
+	ppb: {
+		dimension: "concentration-volume",
+		factor: .001,
+		offset: 0
+	},
+	"µg/m³": {
+		dimension: "concentration-mass",
+		factor: 1,
+		offset: 0
+	},
+	"mg/m³": {
+		dimension: "concentration-mass",
+		factor: 1e3,
+		offset: 0
+	},
+	kg: {
+		dimension: "mass",
+		factor: 1,
+		offset: 0
+	},
+	g: {
+		dimension: "mass",
+		factor: .001,
+		offset: 0
+	},
+	lb: {
+		dimension: "mass",
+		factor: .453592,
+		offset: 0
+	},
+	oz: {
+		dimension: "mass",
+		factor: .0283495,
+		offset: 0
+	},
+	"%": {
+		dimension: "percentage",
+		factor: 1,
+		offset: 0
+	},
+	L: {
+		dimension: "volume",
+		factor: 1,
+		offset: 0
+	},
+	mL: {
+		dimension: "volume",
+		factor: .001,
+		offset: 0
+	},
+	gal: {
+		dimension: "volume",
+		factor: 3.785411784,
+		offset: 0
+	},
+	s: {
+		dimension: "duration",
+		factor: 1,
+		offset: 0
+	},
+	ms: {
+		dimension: "duration",
+		factor: .001,
+		offset: 0
+	},
+	min: {
+		dimension: "duration",
+		factor: 60,
+		offset: 0
+	},
+	h: {
+		dimension: "duration",
+		factor: 3600,
+		offset: 0
+	},
+	d: {
+		dimension: "duration",
+		factor: 86400,
+		offset: 0
+	},
+	B: {
+		dimension: "information",
+		factor: 1,
+		offset: 0
+	},
+	KiB: {
+		dimension: "information",
+		factor: 1024,
+		offset: 0
+	},
+	MiB: {
+		dimension: "information",
+		factor: 1024 ** 2,
+		offset: 0
+	},
+	GiB: {
+		dimension: "information",
+		factor: 1024 ** 3,
+		offset: 0
+	},
+	TiB: {
+		dimension: "information",
+		factor: 1024 ** 4,
+		offset: 0
+	},
+	kB: {
+		dimension: "information",
+		factor: 1e3,
+		offset: 0
+	},
+	MB: {
+		dimension: "information",
+		factor: 1e6,
+		offset: 0
+	},
+	GB: {
+		dimension: "information",
+		factor: 1e9,
+		offset: 0
+	},
+	"°": {
+		dimension: "angle",
+		factor: 1,
+		offset: 0
+	},
+	dBFS: {
+		dimension: "sound-level",
+		factor: 1,
+		offset: 0
+	},
+	dBm: {
+		dimension: "signal-level",
+		factor: 1,
+		offset: 0
+	},
+	mired: {
+		dimension: "colour-temperature",
+		factor: 1,
+		offset: 0
+	},
+	kbps: {
+		dimension: "bitrate",
+		factor: 1,
+		offset: 0
+	},
+	Mbps: {
+		dimension: "bitrate",
+		factor: 1e3,
+		offset: 0
+	},
+	fps: {
+		dimension: "rate",
+		factor: 1,
+		offset: 0
+	}
+};
+/** Resolve a unit's `UnitSpec`, or `undefined` when the spelling is unknown. */
+function specFor(unit) {
+	return Object.hasOwn(UNIT_TABLE, unit) ? UNIT_TABLE[unit] : void 0;
+}
+/** The dimension a unit belongs to, or `undefined` for an unknown unit. */
+function unitDimension(unit) {
+	return specFor(unit)?.dimension;
+}
+/** Value in `spec`'s unit → its dimension's canonical unit. */
+function toCanonical(value, spec) {
+	return value * spec.factor + spec.offset;
+}
+/** Canonical-unit value → the unit described by `spec`. */
+function fromCanonical(canonical, spec) {
+	return (canonical - spec.offset) / spec.factor;
+}
 /**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
+* Graceful variant for the render path: returns the converted value, or
+* `undefined` when the conversion is refused (unknown unit / cross-dimension).
+* Never throws — a render caller falls back to the raw value + source unit.
 */
-var NotificationSchema = object({
-	body: string(),
-	title: string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: number().int().min(1).max(5).default(3),
-	level: string().optional(),
-	attachments: array(AttachmentSchema).optional(),
-	clickUrl: string().optional(),
-	actions: array(NotificationActionSchema).optional(),
-	sound: string().optional(),
-	ttl: number().optional(),
-	tag: string().optional(),
-	deviceId: number().optional(),
-	eventId: string().optional(),
-	metadata: record(string(), unknown()).optional(),
-	/**
-	* Values for the parameters the target's kind DECLARES in
-	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
-	* declaration by the sender; a notifier reads only the keys it declared.
-	*/
-	delivery: record(string(), DeliveryParamValueSchema).optional()
+function tryConvertUnit(value, from, to) {
+	if (from === to) return value;
+	const fromSpec = specFor(from);
+	if (!fromSpec) return void 0;
+	const toSpec = specFor(to);
+	if (!toSpec) return void 0;
+	if (fromSpec.dimension !== toSpec.dimension) return void 0;
+	return fromCanonical(toCanonical(value, fromSpec), toSpec);
+}
+//#endregion
+//#region ../types/dist/index.mjs
+var SMTP_INBOUND_DEFAULT_PORT = 2525;
+var SMTP_INBOUND_DEFAULT_DOMAIN = "camstack.local";
+var SMTP_INBOUND_DEFAULT_MAX_MESSAGE_BYTES = 25 * 1024 * 1024;
+/** The text excerpt a message carries on the bus. */
+var SMTP_INBOUND_TEXT_MAX_CHARS = 4096;
+var PortSchema = number().int().min(1).max(65535);
+/** A recipient local-part: what stands before the `@`. */
+var SmtpRecipientSchema = string().min(1).max(64).regex(/^[A-Za-z0-9._+-]+$/);
+object({
+	port: PortSchema.default(SMTP_INBOUND_DEFAULT_PORT),
+	bindHost: string().min(1).default("0.0.0.0"),
+	domain: string().min(1).default(SMTP_INBOUND_DEFAULT_DOMAIN),
+	requireAuth: boolean().default(true),
+	username: string().default(""),
+	password: string().default("").meta({ secret: true }),
+	starttls: boolean().default(false),
+	maxMessageBytes: number().int().positive().default(SMTP_INBOUND_DEFAULT_MAX_MESSAGE_BYTES)
 });
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = object({
-	id: string(),
-	label: string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: number().int().min(1).max(5).nullable(),
-	flags: object({
-		critical: boolean().optional(),
-		silent: boolean().optional(),
-		noPush: boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: array(string()).optional(),
-	description: string().optional()
+object({
+	host: string().min(1).nullable(),
+	hostReason: string().nullable(),
+	port: PortSchema,
+	domain: string().min(1),
+	requireAuth: boolean(),
+	username: string(),
+	password: string(),
+	starttls: boolean()
 });
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = object({
-	attachments: object({
-		mediaTypes: array(AttachmentMediaTypeSchema),
-		mode: _enum([
-			"url",
-			"bytes",
-			"both"
-		]),
-		max: number().int().nonnegative(),
-		maxBytes: number().int().positive().optional()
-	}),
-	/** Max action buttons (0 = none). */
-	actions: number().int().nonnegative(),
+object({
+	recipients: array(SmtpRecipientSchema).min(1),
 	/**
-	* Whether this kind renders a per-action ICON.
-	*
-	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
-	* run on the addon cap path — three production failures in one day taught
-	* this repo that once. Absent is read as false by the degrade engine, which
-	* is the safe direction: an icon that is not rendered costs nothing, an icon
-	* assumed and dropped costs the operator's trust in the field.
+	* Who is subscribing. A second `subscribe` with the same id REPLACES that subscriber's
+	* recipients (the way a consumer that restarted, or lost a device, declares its set again);
+	* a recipient held by another subscriber is refused with `smtp-inbound/recipient-claimed`.
+	* Absent, the subscriber is anonymous and unique.
 	*/
-	actionIcons: boolean().optional(),
-	levels: array(TargetKindLevelSchema),
-	format: array(NotificationFormatSchema),
-	clickUrl: boolean(),
-	sound: boolean(),
-	ttl: boolean(),
-	bodyMaxLen: number().int().positive()
+	subscriberId: string().min(1).max(64).optional()
 });
-/**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
+var SmtpInboundAttachmentSchema = object({
+	filename: string(),
+	contentType: string(),
+	bytes: number().int().nonnegative()
+});
+/** The payload of one `broker.message` (the key is the recipient local-part). */
+var SmtpInboundMessageSchema = object({
+	/** Monotonic per mailbox; a gap tells a consumer it missed an event. */
+	seq: number().int().positive(),
+	messageId: string(),
+	receivedAt: number().int().nonnegative(),
+	from: string(),
+	to: string(),
+	subject: string(),
+	text: string().max(SMTP_INBOUND_TEXT_MAX_CHARS),
+	attachments: array(SmtpInboundAttachmentSchema)
+});
+object({
+	/** The newest seq issued so far (0 before any mail). */
+	lastSeq: number().int().nonnegative(),
+	/** The oldest seq still retained; messages below it are gone. */
+	oldestSeq: number().int().nonnegative(),
+	messages: array(object({
+		key: string(),
+		message: SmtpInboundMessageSchema
+	}))
+});
+new Set([
+	"track",
+	"face",
+	"identity",
+	"plate",
+	"vehicle",
+	"scene",
+	"motion",
+	"object",
+	"audio",
+	"mosaic"
+]);
+/**
+* The owner types that are event tables, in the order the event-media resolver
+* should consider them. Exported so a consumer asking "is this key an event?"
+* does not re-spell the list and drift from it.
+*/
+var EVENT_OWNER_TYPES = [
+	"motion",
+	"object",
+	"audio"
+];
+/**
+* The same list as a Zod enum, for the cap inputs that must NAME the table
+* (D482: `getEventMedia` / `listEventMedia` take an owner, and an owner is
+* `(table, id)`).
+*
+* Built FROM {@link EVENT_OWNER_TYPES} rather than re-spelled: a fourth event
+* table would otherwise be accepted by the codec and refused at the door, with
+* nothing failing until a caller asked.
+*/
+var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
+/** The same list as a Zod enum, for the cap input that carries it. */
+var MediaPresenceOwnerKindSchema = _enum([...EVENT_OWNER_TYPES, "track"]);
+new Set(EVENT_OWNER_TYPES);
+/**
+* What a published package needs from the rest of the install (D989).
+*
+* One published framework package (`@camstack/server`) carries the kernel, the
+* builtins and the capability contracts, so "which addon runs on which
+* framework" is a question of version, and the answer is DECLARED by the
+* package that knows it:
+*
+*   - an addon says the oldest server it runs on (`requires.server: ">=X"`);
+*   - the server says the oldest addon it works with
+*     (`requires.addons: { "@camstack/addon-x": ">=Y" }`) and the oldest shell
+*     around it (`requires.wrapper: { desktop, image }`);
+*   - a wrapper (the desktop app, the container starter) says which server
+*     range it can host, and reports its own kind and version.
+*
+* The publish workflow STAMPS these after the version bump
+* (`scripts/ci/stamp-requires.mjs`); nobody types a number by hand.
+*
+* A requirement that cannot be checked is NOT met: a shell that reports no
+* version counts as below the minimum, and an unreadable running version is
+* named in the result (a failed read is never a pass).
+*/
+/** `>=MAJOR.MINOR.PATCH[-prerelease]` — the only range shape a requirement uses. */
+var MinVersionSchema = string().regex(/^>=\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/, "a minimum is written \">=X.Y.Z\"");
+object({
+	/** The oldest `@camstack/server` this package runs on. */
+	server: MinVersionSchema.optional(),
+	/** The oldest installed version of each named addon package. */
+	addons: record(string(), MinVersionSchema).optional(),
+	/** The oldest shell around the server, per shell kind. */
+	wrapper: object({
+		desktop: MinVersionSchema.optional(),
+		image: MinVersionSchema.optional()
+	}).optional()
+});
+/** One unmet requirement; each names the versions on both sides. */
+var UnmetRequirementSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("server-too-old"),
+		required: string(),
+		/** `null` — the running server version could not be read. */
+		running: string().nullable()
+	}),
+	object({
+		kind: literal("addon-too-old"),
+		packageName: string(),
+		required: string(),
+		/** `null` — the addon is not installed (or its version is unreadable). */
+		running: string().nullable()
+	}),
+	object({
+		kind: literal("wrapper-too-old"),
+		wrapper: _enum(["desktop", "image"]),
+		required: string(),
+		/** `null` — the wrapper reported no version. */
+		running: string().nullable()
+	})
+]);
+var RequiredAddonUpdateSchema = object({
+	packageName: string(),
+	/** The minimum the target server declares. */
+	required: string(),
+	/** What this node has; `null` when the addon is not installed. */
+	installed: string().nullable()
+});
+/**
+* Which integration instance a settings form is for. An addon that serves several instances
+* (`instanceMode: multiple`) can show a different form per instance — an NVR integration
+* needs its connection, the default integration needs the addon's own sections.
+*
+* - `integrationId` is `null` in the create wizard: nothing exists yet, the operator is
+*   setting up a NEW instance.
+* - `mode` is the wizard mode of the integration type (`getAvailableTypes`).
+* - `candidateStableId` is the discovery candidate a wizard was seeded from, if any.
+*/
+var IntegrationInstanceRefSchema = object({
+	integrationId: string().nullable(),
+	mode: _enum([
+		"standalone",
+		"account",
+		"broker"
+	]),
+	candidateStableId: string().optional()
+});
+/**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - A target is an INSTANCE of this function cap (epic #440, step 6): the
+*    providers serve their targets as `integration-instances` records, one
+*    record kind per target kind, and the admin lists, adds, edits, switches
+*    and deletes them through that cap. This cap keeps what an instance cannot
+*    say: the kind catalogue (`listTargetKinds`: capabilities, delivery
+*    parameters, brand icon), dispatch (`send`, `testTarget`) and the form
+*    helpers (`discoverTargets`, `probeTargetConfig`).
+*  - `listTargetKinds` / `discoverTargets` return arrays → the generated
+*    cap-mount auto-`concatCollection`-fans them across every registered
+*    provider so one catalog is routable. `send` / `testTarget` /
+*    `probeTargetConfig` route to ONE provider by the `addonId` the generated
+*    collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = _enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: string().optional(),
+	bytes: _instanceof(Uint8Array).optional(),
+	mime: string().optional(),
+	name: string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = _enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/**
+* The CLOSED icon vocabulary an action button may use.
+*
+* A closed set, not a free string, and that is the whole point: an arbitrary
+* icon name is one that ntfy renders, zentik silently drops, and nobody
+* notices — the same class of gap as a zone vocabulary nothing produced
+* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
+* declares `actionIcons: false` and the degrade engine strips the field.
+*
+* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
+* renderer's icon set; "acknowledge" survives an adapter that draws it
+* differently.
+*
+* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
+*
+* These names are for US. **No adapter may forward one verbatim.** Each maps
+* the whole set onto its own renderer's vocabulary through a
+* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
+* fallback, so adding a member here fails every adapter's build until someone
+* decides its glyph, which is the only place that decision can be made
+* honestly.
+*
+* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
+* `disarm` straight through; iOS feeds that string to
+* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
+* and every snooze and alarm button arrived BLANK. A pass-through is not a
+* mapping, and "the field is documented" is not "the value renders".
+*
+* Adding a member is TRAIN-BOUND. The enum lives in the published
+* `@camstack/server` closure and the cap seam validates against the HUB's copy,
+* so an addon that emits a token the running hub does not know does not lose an
+* icon — its whole `send` fails Zod validation and the notification never
+* arrives. Never emit a new token from an addon before the train carrying it.
+*/
+var NotificationActionIconSchema = _enum([
+	"acknowledge",
+	"dismiss",
+	"silence",
+	"snooze",
+	"view",
+	"play",
+	"open",
+	"close",
+	"lock",
+	"unlock",
+	"arm",
+	"arm-home",
+	"arm-away",
+	"arm-night",
+	"disarm",
+	"light",
+	"alert",
+	"camera"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = object({
+	id: string(),
+	label: string(),
+	url: string().optional(),
+	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
+	icon: NotificationActionIconSchema.optional(),
+	/**
+	* Renders in a warning style where the notifier supports it.
+	*
+	* A HINT, never a gate. The callback's authority is its token and nothing
+	* else — see `notification-center/action-token.ts` for what that does and
+	* does not buy.
+	*/
+	destructive: boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: _enum(["navigate", "background"]).optional()
+});
+/** A delivery parameter value: what a notifier declared it takes. */
+var DeliveryParamValueSchema = union([
+	string(),
+	number(),
+	boolean()
+]);
+/**
+* One extra delivery parameter a notifier KIND declares (D938). A rule that
+* addresses a target of that kind may set it; a kind that declares nothing is
+* never handed one. The admin UI derives its control from this descriptor —
+* no editor knows a service by name.
+*
+* Optional fields are `.optional()`, never `.default()` (a Zod default does not
+* run on the addon cap path).
+*/
+var DeliveryParamSchema = object({
+	key: string().min(1),
+	label: string(),
+	/** i18n key of the label, resolved by the declaring addon's namespace. */
+	labelKey: string().optional(),
+	type: _enum([
+		"enum",
+		"number",
+		"boolean",
+		"string"
+	]),
+	/** `enum` only: the closed set of accepted values. */
+	options: array(object({
+		value: string(),
+		label: string()
+	})).optional(),
+	/** `number` only. */
+	min: number().optional(),
+	max: number().optional(),
+	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
+	default: DeliveryParamValueSchema.optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = object({
+	body: string(),
+	title: string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: number().int().min(1).max(5).default(3),
+	level: string().optional(),
+	attachments: array(AttachmentSchema).optional(),
+	clickUrl: string().optional(),
+	actions: array(NotificationActionSchema).optional(),
+	sound: string().optional(),
+	ttl: number().optional(),
+	tag: string().optional(),
+	deviceId: number().optional(),
+	eventId: string().optional(),
+	metadata: record(string(), unknown()).optional(),
+	/**
+	* Values for the parameters the target's kind DECLARES in
+	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
+	* declaration by the sender; a notifier reads only the keys it declared.
+	*/
+	delivery: record(string(), DeliveryParamValueSchema).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = object({
+	id: string(),
+	label: string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: number().int().min(1).max(5).nullable(),
+	flags: object({
+		critical: boolean().optional(),
+		silent: boolean().optional(),
+		noPush: boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: array(string()).optional(),
+	description: string().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = object({
+	attachments: object({
+		mediaTypes: array(AttachmentMediaTypeSchema),
+		mode: _enum([
+			"url",
+			"bytes",
+			"both"
+		]),
+		max: number().int().nonnegative(),
+		maxBytes: number().int().positive().optional()
+	}),
+	/** Max action buttons (0 = none). */
+	actions: number().int().nonnegative(),
+	/**
+	* Whether this kind renders a per-action ICON.
+	*
+	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
+	* run on the addon cap path — three production failures in one day taught
+	* this repo that once. Absent is read as false by the degrade engine, which
+	* is the safe direction: an icon that is not rendered costs nothing, an icon
+	* assumed and dropped costs the operator's trust in the field.
+	*/
+	actionIcons: boolean().optional(),
+	levels: array(TargetKindLevelSchema),
+	format: array(NotificationFormatSchema),
+	clickUrl: boolean(),
+	sound: boolean(),
+	ttl: boolean(),
+	bodyMaxLen: number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough$4 = unknown();
+var ConfigSchemaPassthrough$3 = unknown();
 var TargetKindSchema = object({
 	kind: string(),
 	label: string(),
@@ -14242,7 +14778,7 @@ var TargetKindSchema = object({
 	* its raster path, which is the safe default for an unknown image.
 	*/
 	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough$4,
+	configSchema: ConfigSchemaPassthrough$3,
 	/**
 	* The config keys that decide WHERE this kind's secrets are sent (server,
 	* base URL, instance, chat, recipient). A save that changes any of them
@@ -14264,9 +14800,11 @@ var TargetKindSchema = object({
 	caps: TargetKindCapsSchema
 });
 /**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
+* A target as a provider's own code sees it (the notification-center bridge, the
+* send path): the flat record body split into the name, the switch and the
+* kind's fields. `config` holds secrets; a reader that serves it to a client
+* REDACTS secret fields (a presence marker only) — never round-trip a stored
+* secret to the UI.
 */
 var TargetSchema = object({
 	id: string(),
@@ -14309,13 +14847,13 @@ var ProbeTargetConfigResultSchema = object({
 	stateInstance: string().optional(),
 	error: string().optional()
 });
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({ targetId: string() }), TargetSchema, { auth: "admin" }), method(object({
+method(object({}), array(TargetKindSchema)), method(object({
 	kind: string(),
 	config: record(string(), unknown()).optional(),
 	/**
 	* When editing / duplicating, the blank password field never round-trips
 	* the stored token. Pass the source target id so the provider can restore
-	* secrets server-side before dialling (same merge as upsert).
+	* secrets server-side before dialling.
 	*/
 	targetId: string().optional()
 }), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
@@ -14338,27 +14876,6 @@ method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSche
 }), TestResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	target: TargetSchema,
-	/**
-	* Duplicate flow: create a NEW target id while copying secrets from an
-	* existing row. The UI never holds the stored token; blank / redacted
-	* password fields are restored from this source (D634 still applies if
-	* destinations diverge without a re-typed secret).
-	*/
-	cloneSecretsFrom: string().optional()
-}), TargetSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ targetId: string() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	enabled: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
 });
 looseObject({
 	name: string().min(1),
@@ -22823,7 +23340,6 @@ var SYSTEM_CAP_VOCABULARY = {
 	"notification-output": system("notification delivery — reached through notifier devices and rules"),
 	"notification-rules": system("notification rules — authored on their own page"),
 	"oauth-integration": system(IDENTITY),
-	"oidc-connections": system(IDENTITY),
 	"osd-manager": system(PIPELINE),
 	"pipeline-executor": system(PIPELINE),
 	"pipeline-orchestrator": system(PIPELINE),
@@ -42706,726 +43222,344 @@ var LEGACY_ICON_ALIASES = { gauge2: "gauge" };
 * ## What is persisted
 *
 * The canonical kebab-case lucide id ({@link IconKey}). Spellings that a lucide
-* package still accepts (`home` for `house`) and this repo's own legacy ones
-* (`gauge2`) RESOLVE ({@link canonicalIconKey}) so a stored value never goes
-* stale, but they are never OFFERED by search.
-*
-* ## Search
-*
-* Over the key, the Italian/English overlay in `icon-synonyms.ts`, any words
-* the caller adds, and lucide's English tags — in that order of weight.
-*/
-var KEY_SET$2 = new Set(ICON_KEYS);
-new Map([...Object.entries(ICON_ALIASES), ...Object.entries(LEGACY_ICON_ALIASES)]);
-/** Is this a canonical key of the catalog? (An alias is not — see {@link canonicalIconKey}.) */
-function isIconKey(value) {
-	return typeof value === "string" && KEY_SET$2.has(value);
-}
-/**
-* Wire/storage schema for one icon key.
-*
-* Deliberately NOT a `z.enum` of the catalog: ~1,700 literals would be inlined
-* into every cap router, type and API-reference row that carries an icon. The
-* check is membership in the catalog and the type is {@link IconKey}.
-*/
-var IconKeySchema = custom(isIconKey, "Not an icon of the catalog");
-var ENTRIES = ICON_KEYS.map((key, index) => {
-	const [categoryIndexes, tags] = ICON_META[index] ?? [[], []];
-	const categories = categoryIndexes.flatMap((i) => {
-		const id = ICON_CATEGORY_IDS[i];
-		return id === void 0 ? [] : [id];
-	});
-	return {
-		key,
-		categories,
-		primaryCategory: categories[0] ?? ICON_CATEGORY_IDS[0],
-		tags,
-		synonyms: ICON_SYNONYMS[key] ?? []
-	};
-});
-new Map(ENTRIES.map((e) => [e.key, e]));
-/** Categories a picker offers first: the ones this product's icons mostly live in. */
-var LEADING_CATEGORIES = [
-	"devices",
-	"home",
-	"security",
-	"buildings",
-	"connectivity",
-	"multimedia",
-	"nature",
-	"weather",
-	"transportation",
-	"animals"
-];
-var PRIMARY_CATEGORIES = new Set(ENTRIES.map((e) => e.primaryCategory));
-[...LEADING_CATEGORIES, ...ICON_CATEGORY_IDS.filter((c) => !LEADING_CATEGORIES.includes(c))].filter((c) => PRIMARY_CATEGORIES.has(c));
-/**
-* One (location, icon) assignment as it travels.
-*
-* `locationKey` is ALWAYS {@link locationIconKey} of the label — never the
-* operator's casing. The registry matches labels trimmed + case-insensitively
-* everywhere (`addLocation`, `removeLocation`, `renameLocation`), and a
-* case-only rename (`kitchen` → `Kitchen`) is a real edit this repo supports; a
-* map keyed on the displayed casing would orphan its entry on exactly that
-* edit. Consumers join by keying their own label through `locationIconKey`.
-*/
-var LocationIconAssignmentSchema = object({
-	locationKey: string(),
-	icon: IconKeySchema
-});
-/**
-* One (location, description) assignment as it travels.
-*
-* Same key discipline as {@link LocationIconAssignmentSchema}, and for the same
-* reason: this lived for a while in the post-analysis addon's own settings,
-* keyed by a HAND-TYPED label matched exactly and case-sensitively. A rename in
-* the Locations page carried the icon and silently orphaned the description —
-* two authorities for one thing, joined by two different rules. Now both hang
-* off the location itself, on `locationIconKey`.
-*/
-var LocationDescriptionAssignmentSchema = object({
-	locationKey: string(),
-	description: string()
-});
-/**
-* WHO an action step acts on (D983) — one target shape for every place that
-* performs an action (automation steps, Action entries, notification
-* sequences, scheduler points):
-*
-*  - `devices` — device ids the operator picked, frozen at save time;
-*  - `domain`  — every device that offers the step's VOCABULARY action,
-*    optionally narrowed to one device type and one room, resolved WHEN THE
-*    STEP RUNS (a device added later is included). The action always comes
-*    from the vocabulary (`cover.open`), never from a raw cap name, so a
-*    `domain` target needs an `actionId` (enforced on the step schema);
-*  - `var`     — a `$var` resolved from the run's scope.
-*
-* {@link ActionTargetResolver} turns a target into device ids. It is pure
-* (a {@link DeviceDirectory} is handed in) so the hub's core-blocks service and
-* a generated automation block share it.
-*
-* A room is the device's `location` label (`DeviceInfo.location`); two labels
-* name the same room when `locationIconKey` agrees (trimmed, lower-cased).
-*/
-var ActionTargetSchema = discriminatedUnion("kind", [
-	object({
-		kind: literal("devices"),
-		ids: array(number().int()).min(1)
-	}),
-	object({
-		kind: literal("domain"),
-		/** Narrow to one kind of device. */
-		deviceType: _enum(DeviceType).optional(),
-		/** Narrow to one room: the `location` label devices carry. */
-		roomId: string().min(1).optional()
-	}),
-	object({
-		kind: literal("var"),
-		name: string().min(1)
-	})
-]);
-EventCategory.DeviceRegistered, EventCategory.DeviceUnregistered, EventCategory.DeviceUpdated, EventCategory.DeviceMetaChanged, EventCategory.DeviceBindingsChanged;
-var ExpressionBindingSourceSchema = union([
-	object({
-		kind: literal("field").optional(),
-		sourceKey: string(),
-		cap: string(),
-		fieldPath: string()
-	}),
-	object({
-		kind: literal("literal"),
-		value: union([
-			string(),
-			number(),
-			boolean(),
-			_null()
-		])
-	}),
-	object({
-		kind: literal("global"),
-		sourceStableId: string(),
-		cap: string(),
-		fieldPath: string()
-	})
-]);
-object({
-	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
-	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
-}).superRefine((src, ctx) => {
-	const err = validateExpressionSource(src);
-	if (err !== null) ctx.addIssue({
-		code: "custom",
-		message: err,
-		path: ["expr"]
-	});
-});
-/**
-* Identity envelope for a device's upstream-system metadata.
-*
-* Two jobs:
-*
-*   1. **Dispatch key.** `id` is the natural identifier the SOURCE system
-*      uses to address this device (HA `entity_id`, Reolink MAC, ONVIF
-*      WS-Discovery endpoint UUID, …). Provider code keeps a
-*      `Map<sourceInfo.id, IDevice>` to route inbound push events in O(1)
-*      without round-tripping through `stableId` / `id` mappings.
-*
-*   2. **Stability bridge.** `uniqueId` is the *immutable* upstream id when
-*      one exists (HA `entity.unique_id`, Reolink MAC again — same as `id`
-*      for vendors where MAC is the natural key). For systems where the
-*      live dispatch key can be renamed (HA `entity_id` can be edited),
-*      providers detect renames by matching `uniqueId` and patch `id`
-*      in-place so dispatch keeps working.
-*
-* **Display unit and precision are NOT stored here.** They are a read-time
-* preference (D944). A polymorphic reading stores its `quantity` here once,
-* at adopt, and a date/time value stores `dateTimeShape` the same way —
-* neither is repeated on each sample. The `device_class` tag is an
-* HA-specific input consumed at the discovery boundary (`ha-domain-mapping`)
-* to derive the CamStack `DeviceRole`; it is never stored after that point.
-*
-* The `raw` escape hatch carries provider-specific attributes that don't
-* fit the structured slots (HA `attributes` whitelist, Reolink `deviceCache`
-* details, …). Providers control what lands here.
-*/
-var SourceInfoSchema = object({
-	/** Live dispatch key — mutable when the source system allows rename. */
-	id: string(),
-	/** Source system tag — e.g. 'homeassistant' | 'reolink' | 'onvif'. */
-	system: string(),
-	/** Immutable upstream identifier when available (HA `unique_id`, … ).
-	*  Used to detect rename when `id` changes. */
-	uniqueId: string().optional(),
-	/** Quantity of a polymorphic reading, written once at adopt (D944). */
-	quantity: ReadingQuantitySchema.optional(),
-	/** Date / time / datetime shape of a string reading, written once at adopt. */
-	dateTimeShape: _enum([
-		"date",
-		"time",
-		"datetime"
-	]).optional(),
-	/** Provider-specific extras that don't fit the structured slots.
-	*  Whitelist what goes here per provider — do NOT dump entire HA
-	*  attribute blobs (would explode the meta JSON column). */
-	raw: record(string(), unknown()).optional()
-});
-/**
-* Build the synthetic SourceInfo every existing provider falls back to
-* when no upstream value has been persisted. Keeps non-migrated providers
-* (Reolink / Hikvision / ONVIF / RTSP) functional without code
-* changes — `id` reuses the CamStack stableId, `system` reuses the addon
-* id. Real upstream identity replaces this once a provider migrates and
-* calls `updateSourceInfo()` with concrete values.
-*/
-function synthesizeSourceInfo(input) {
-	return {
-		id: input.stableId,
-		system: input.addonId
-	};
-}
-/**
-* Shallow-merge a partial patch over a prior SourceInfo. `undefined`
-* patch values are ignored (no field clobber); to clear a field
-* explicitly, providers omit it from the patch and rebuild from scratch
-* via `updateSourceInfo({})` cycles — uncommon enough that we don't
-* bother with a `null`-means-delete sentinel.
-*
-* The `raw` field is also shallow-merged: passing `raw: { foo: 1 }`
-* merges over existing `raw` keys instead of replacing the whole bag.
-*/
-function mergeSourceInfo(prev, patch) {
-	const next = { ...prev };
-	for (const [k, v] of Object.entries(patch)) {
-		if (v === void 0) continue;
-		if (k === "raw" && typeof v === "object" && v !== null) {
-			next.raw = {
-				...prev.raw,
-				...v
-			};
-			continue;
-		}
-		next[k] = v;
-	}
-	return next;
-}
-/**
-* Coerce common unit-of-measurement string variants to a canonical form
-* so the UI's display templates can rely on stable strings. Pure
-* passthrough for unknown units — kept conservative on purpose, the goal
-* is to normalise the long tail of HA `unit_of_measurement` values that
-* have multiple historical spellings (`'°C'` vs `'C'` vs `'celsius'`).
-*
-* Extend the map as we encounter real-world data. Returning the raw
-* input for unknown values is intentional: providers should never
-* lose information silently here.
-*/
-function normalizeUnit(raw) {
-	if (raw == null) return void 0;
-	const trimmed = raw.trim();
-	if (trimmed === "") return void 0;
-	const lower = trimmed.toLowerCase();
-	if (lower === "°c" || lower === "c" || lower === "celsius") return "°C";
-	if (lower === "°f" || lower === "f" || lower === "fahrenheit") return "°F";
-	if (lower === "k" || lower === "kelvin") return "K";
-	if (lower === "%" || lower === "percent" || lower === "percentage") return "%";
-	if (lower === "lx" || lower === "lux") return "lx";
-	if (lower === "hpa" || lower === "hectopascal") return "hPa";
-	if (lower === "kpa") return "kPa";
-	if (lower === "pa") return "Pa";
-	if (lower === "mbar" || lower === "millibar") return "mbar";
-	if (lower === "w" || lower === "watt") return "W";
-	if (lower === "kw" || lower === "kilowatt") return "kW";
-	if (lower === "wh" || lower === "watt-hour") return "Wh";
-	if (lower === "kwh" || lower === "kilowatt-hour") return "kWh";
-	if (lower === "v" || lower === "volt") return "V";
-	if (lower === "a" || lower === "amp" || lower === "ampere") return "A";
-	if (lower === "ma" || lower === "milliampere") return "mA";
-	if (lower === "va") return "VA";
-	if (lower === "ppm") return "ppm";
-	if (lower === "ppb") return "ppb";
-	if (lower === "µg/m³" || lower === "ug/m3" || lower === "µg/m3") return "µg/m³";
-	if (lower === "km/h" || lower === "kph") return "km/h";
-	if (lower === "mph") return "mph";
-	if (lower === "m/s") return "m/s";
-	if (lower === "m") return "m";
-	if (lower === "m²" || lower === "m2") return "m²";
-	if (lower === "mm") return "mm";
-	if (lower === "cm") return "cm";
-	if (lower === "km") return "km";
-	if (lower === "in" || lower === "inch" || lower === "inches") return "in";
-	if (lower === "ft" || lower === "foot" || lower === "feet") return "ft";
-	if (lower === "kg") return "kg";
-	if (lower === "g") return "g";
-	if (lower === "l" || lower === "liter" || lower === "litre" || lower === "liters" || lower === "litres") return "L";
-	if (lower === "ml") return "mL";
-	if (lower === "gal" || lower === "gallon" || lower === "gallons") return "gal";
-	if (lower === "s" || lower === "sec" || lower === "second" || lower === "seconds") return "s";
-	if (lower === "ms") return "ms";
-	if (lower === "min" || lower === "minute" || lower === "minutes") return "min";
-	if (lower === "h" || lower === "hr" || lower === "hour" || lower === "hours") return "h";
-	if (lower === "d" || lower === "day" || lower === "days") return "d";
-	if (lower === "b" || lower === "byte" || lower === "bytes") return "B";
-	if (lower === "kib") return "KiB";
-	if (lower === "mib") return "MiB";
-	if (lower === "gib") return "GiB";
-	if (lower === "tib") return "TiB";
-	if (lower === "kb") return "kB";
-	if (lower === "mb") return "MB";
-	if (lower === "gb") return "GB";
-	if (lower === "dbm") return "dBm";
-	if (lower === "dbfs") return "dBFS";
-	if (lower === "inhg") return "inHg";
-	if (lower === "mm/h" || lower === "mm/hr") return "mm/h";
-	if (lower === "in/h" || lower === "in/hr") return "in/h";
-	if (lower === "w/m²" || lower === "w/m2") return "W/m²";
-	if (lower === "°" || lower === "deg" || lower === "degree" || lower === "degrees") return "°";
-	if (lower === "kbps") return "kbps";
-	if (lower === "fps") return "fps";
-	return trimmed;
-}
-/**
-* Key under which `SourceInfo` lives inside `DeviceMeta.metadata`. The
-* blob is a free-form `Record<string, unknown>` shared with hardware-
-* identity fields (`manufacturer`, `model`, `firmware`, …); SourceInfo
-* lives under a single nested key to keep it composable with those.
-*/
-var SOURCE_INFO_METADATA_KEY = "sourceInfo";
-/**
-* Extract a SourceInfo from a `DeviceMeta.metadata` blob, validating
-* with Zod. Returns `null` when the blob is missing or the nested
-* `sourceInfo` key fails validation — callers fall back to the
-* synthetic default in that case (see `synthesizeSourceInfo`).
-*/
-function extractSourceInfoFromMetadata(metadata) {
-	if (!metadata) return null;
-	const raw = metadata[SOURCE_INFO_METADATA_KEY];
-	if (!raw) return null;
-	const parsed = SourceInfoSchema.safeParse(raw);
-	if (!parsed.success) return null;
-	return parsed.data;
-}
-/**
-* Frozen unit → spec table. `•` in the doc marks each dimension's canonical
-* unit (`factor: 1, offset: 0`). °F derives from `°C = (°F − 32) × 5/9` ⇒
-* `factor = 5/9`, `offset = -160/9` (kept as exact expressions, not rounded
-* decimals). K derives from `°C = K − 273.15`.
-*/
-var UNIT_TABLE = {
-	"°C": {
-		dimension: "temperature",
-		factor: 1,
-		offset: 0
-	},
-	"°F": {
-		dimension: "temperature",
-		factor: 5 / 9,
-		offset: -160 / 9
-	},
-	K: {
-		dimension: "temperature",
-		factor: 1,
-		offset: -273.15
-	},
-	hPa: {
-		dimension: "pressure",
-		factor: 1,
-		offset: 0
-	},
-	kPa: {
-		dimension: "pressure",
-		factor: 10,
-		offset: 0
-	},
-	Pa: {
-		dimension: "pressure",
-		factor: .01,
-		offset: 0
-	},
-	mbar: {
-		dimension: "pressure",
-		factor: 1,
-		offset: 0
-	},
-	bar: {
-		dimension: "pressure",
-		factor: 1e3,
-		offset: 0
-	},
-	inHg: {
-		dimension: "pressure",
-		factor: 33.8639,
-		offset: 0
-	},
-	mmHg: {
-		dimension: "pressure",
-		factor: 1.33322,
-		offset: 0
-	},
-	psi: {
-		dimension: "pressure",
-		factor: 68.9476,
-		offset: 0
-	},
-	"m/s": {
-		dimension: "speed",
-		factor: 1,
-		offset: 0
-	},
-	"km/h": {
-		dimension: "speed",
-		factor: 1 / 3.6,
-		offset: 0
-	},
-	mph: {
-		dimension: "speed",
-		factor: .44704,
-		offset: 0
-	},
-	kn: {
-		dimension: "speed",
-		factor: .514444,
-		offset: 0
-	},
-	"mm/h": {
-		dimension: "precipitation-rate",
-		factor: 1,
-		offset: 0
-	},
-	"in/h": {
-		dimension: "precipitation-rate",
-		factor: 25.4,
-		offset: 0
-	},
-	m: {
-		dimension: "length",
-		factor: 1,
-		offset: 0
-	},
-	mm: {
-		dimension: "length",
-		factor: .001,
-		offset: 0
-	},
-	cm: {
-		dimension: "length",
-		factor: .01,
-		offset: 0
-	},
-	km: {
-		dimension: "length",
-		factor: 1e3,
-		offset: 0
-	},
-	in: {
-		dimension: "length",
-		factor: .0254,
-		offset: 0
-	},
-	ft: {
-		dimension: "length",
-		factor: .3048,
-		offset: 0
-	},
-	mi: {
-		dimension: "length",
-		factor: 1609.344,
-		offset: 0
-	},
-	"m²": {
-		dimension: "area",
-		factor: 1,
-		offset: 0
-	},
-	lx: {
-		dimension: "illuminance",
-		factor: 1,
-		offset: 0
-	},
-	"W/m²": {
-		dimension: "irradiance",
-		factor: 1,
-		offset: 0
-	},
-	W: {
-		dimension: "power",
-		factor: 1,
-		offset: 0
-	},
-	kW: {
-		dimension: "power",
-		factor: 1e3,
-		offset: 0
-	},
-	VA: {
-		dimension: "apparent-power",
-		factor: 1,
-		offset: 0
-	},
-	Wh: {
-		dimension: "energy",
-		factor: 1,
-		offset: 0
-	},
-	kWh: {
-		dimension: "energy",
-		factor: 1e3,
-		offset: 0
-	},
-	MWh: {
-		dimension: "energy",
-		factor: 1e6,
-		offset: 0
-	},
-	V: {
-		dimension: "voltage",
-		factor: 1,
-		offset: 0
-	},
-	mV: {
-		dimension: "voltage",
-		factor: .001,
-		offset: 0
-	},
-	A: {
-		dimension: "current",
-		factor: 1,
-		offset: 0
-	},
-	mA: {
-		dimension: "current",
-		factor: .001,
-		offset: 0
-	},
-	ppm: {
-		dimension: "concentration-volume",
-		factor: 1,
-		offset: 0
-	},
-	ppb: {
-		dimension: "concentration-volume",
-		factor: .001,
-		offset: 0
-	},
-	"µg/m³": {
-		dimension: "concentration-mass",
-		factor: 1,
-		offset: 0
-	},
-	"mg/m³": {
-		dimension: "concentration-mass",
-		factor: 1e3,
-		offset: 0
-	},
-	kg: {
-		dimension: "mass",
-		factor: 1,
-		offset: 0
-	},
-	g: {
-		dimension: "mass",
-		factor: .001,
-		offset: 0
-	},
-	lb: {
-		dimension: "mass",
-		factor: .453592,
-		offset: 0
-	},
-	oz: {
-		dimension: "mass",
-		factor: .0283495,
-		offset: 0
-	},
-	"%": {
-		dimension: "percentage",
-		factor: 1,
-		offset: 0
-	},
-	L: {
-		dimension: "volume",
-		factor: 1,
-		offset: 0
-	},
-	mL: {
-		dimension: "volume",
-		factor: .001,
-		offset: 0
-	},
-	gal: {
-		dimension: "volume",
-		factor: 3.785411784,
-		offset: 0
-	},
-	s: {
-		dimension: "duration",
-		factor: 1,
-		offset: 0
-	},
-	ms: {
-		dimension: "duration",
-		factor: .001,
-		offset: 0
-	},
-	min: {
-		dimension: "duration",
-		factor: 60,
-		offset: 0
-	},
-	h: {
-		dimension: "duration",
-		factor: 3600,
-		offset: 0
-	},
-	d: {
-		dimension: "duration",
-		factor: 86400,
-		offset: 0
-	},
-	B: {
-		dimension: "information",
-		factor: 1,
-		offset: 0
-	},
-	KiB: {
-		dimension: "information",
-		factor: 1024,
-		offset: 0
-	},
-	MiB: {
-		dimension: "information",
-		factor: 1024 ** 2,
-		offset: 0
-	},
-	GiB: {
-		dimension: "information",
-		factor: 1024 ** 3,
-		offset: 0
-	},
-	TiB: {
-		dimension: "information",
-		factor: 1024 ** 4,
-		offset: 0
-	},
-	kB: {
-		dimension: "information",
-		factor: 1e3,
-		offset: 0
-	},
-	MB: {
-		dimension: "information",
-		factor: 1e6,
-		offset: 0
-	},
-	GB: {
-		dimension: "information",
-		factor: 1e9,
-		offset: 0
-	},
-	"°": {
-		dimension: "angle",
-		factor: 1,
-		offset: 0
-	},
-	dBFS: {
-		dimension: "sound-level",
-		factor: 1,
-		offset: 0
-	},
-	dBm: {
-		dimension: "signal-level",
-		factor: 1,
-		offset: 0
-	},
-	mired: {
-		dimension: "colour-temperature",
-		factor: 1,
-		offset: 0
-	},
-	kbps: {
-		dimension: "bitrate",
-		factor: 1,
-		offset: 0
-	},
-	Mbps: {
-		dimension: "bitrate",
-		factor: 1e3,
-		offset: 0
-	},
-	fps: {
-		dimension: "rate",
-		factor: 1,
-		offset: 0
-	}
-};
-/** Resolve a unit's `UnitSpec`, or `undefined` when the spelling is unknown. */
-function specFor(unit) {
-	return Object.hasOwn(UNIT_TABLE, unit) ? UNIT_TABLE[unit] : void 0;
+* package still accepts (`home` for `house`) and this repo's own legacy ones
+* (`gauge2`) RESOLVE ({@link canonicalIconKey}) so a stored value never goes
+* stale, but they are never OFFERED by search.
+*
+* ## Search
+*
+* Over the key, the Italian/English overlay in `icon-synonyms.ts`, any words
+* the caller adds, and lucide's English tags — in that order of weight.
+*/
+var KEY_SET$2 = new Set(ICON_KEYS);
+new Map([...Object.entries(ICON_ALIASES), ...Object.entries(LEGACY_ICON_ALIASES)]);
+/** Is this a canonical key of the catalog? (An alias is not — see {@link canonicalIconKey}.) */
+function isIconKey(value) {
+	return typeof value === "string" && KEY_SET$2.has(value);
 }
-/** The dimension a unit belongs to, or `undefined` for an unknown unit. */
-function unitDimension(unit) {
-	return specFor(unit)?.dimension;
+/**
+* Wire/storage schema for one icon key.
+*
+* Deliberately NOT a `z.enum` of the catalog: ~1,700 literals would be inlined
+* into every cap router, type and API-reference row that carries an icon. The
+* check is membership in the catalog and the type is {@link IconKey}.
+*/
+var IconKeySchema = custom(isIconKey, "Not an icon of the catalog");
+var ENTRIES = ICON_KEYS.map((key, index) => {
+	const [categoryIndexes, tags] = ICON_META[index] ?? [[], []];
+	const categories = categoryIndexes.flatMap((i) => {
+		const id = ICON_CATEGORY_IDS[i];
+		return id === void 0 ? [] : [id];
+	});
+	return {
+		key,
+		categories,
+		primaryCategory: categories[0] ?? ICON_CATEGORY_IDS[0],
+		tags,
+		synonyms: ICON_SYNONYMS[key] ?? []
+	};
+});
+new Map(ENTRIES.map((e) => [e.key, e]));
+/** Categories a picker offers first: the ones this product's icons mostly live in. */
+var LEADING_CATEGORIES = [
+	"devices",
+	"home",
+	"security",
+	"buildings",
+	"connectivity",
+	"multimedia",
+	"nature",
+	"weather",
+	"transportation",
+	"animals"
+];
+var PRIMARY_CATEGORIES = new Set(ENTRIES.map((e) => e.primaryCategory));
+[...LEADING_CATEGORIES, ...ICON_CATEGORY_IDS.filter((c) => !LEADING_CATEGORIES.includes(c))].filter((c) => PRIMARY_CATEGORIES.has(c));
+/**
+* One (location, icon) assignment as it travels.
+*
+* `locationKey` is ALWAYS {@link locationIconKey} of the label — never the
+* operator's casing. The registry matches labels trimmed + case-insensitively
+* everywhere (`addLocation`, `removeLocation`, `renameLocation`), and a
+* case-only rename (`kitchen` → `Kitchen`) is a real edit this repo supports; a
+* map keyed on the displayed casing would orphan its entry on exactly that
+* edit. Consumers join by keying their own label through `locationIconKey`.
+*/
+var LocationIconAssignmentSchema = object({
+	locationKey: string(),
+	icon: IconKeySchema
+});
+/**
+* One (location, description) assignment as it travels.
+*
+* Same key discipline as {@link LocationIconAssignmentSchema}, and for the same
+* reason: this lived for a while in the post-analysis addon's own settings,
+* keyed by a HAND-TYPED label matched exactly and case-sensitively. A rename in
+* the Locations page carried the icon and silently orphaned the description —
+* two authorities for one thing, joined by two different rules. Now both hang
+* off the location itself, on `locationIconKey`.
+*/
+var LocationDescriptionAssignmentSchema = object({
+	locationKey: string(),
+	description: string()
+});
+/**
+* WHO an action step acts on (D983) — one target shape for every place that
+* performs an action (automation steps, Action entries, notification
+* sequences, scheduler points):
+*
+*  - `devices` — device ids the operator picked, frozen at save time;
+*  - `domain`  — every device that offers the step's VOCABULARY action,
+*    optionally narrowed to one device type and one room, resolved WHEN THE
+*    STEP RUNS (a device added later is included). The action always comes
+*    from the vocabulary (`cover.open`), never from a raw cap name, so a
+*    `domain` target needs an `actionId` (enforced on the step schema);
+*  - `var`     — a `$var` resolved from the run's scope.
+*
+* {@link ActionTargetResolver} turns a target into device ids. It is pure
+* (a {@link DeviceDirectory} is handed in) so the hub's core-blocks service and
+* a generated automation block share it.
+*
+* A room is the device's `location` label (`DeviceInfo.location`); two labels
+* name the same room when `locationIconKey` agrees (trimmed, lower-cased).
+*/
+var ActionTargetSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("devices"),
+		ids: array(number().int()).min(1)
+	}),
+	object({
+		kind: literal("domain"),
+		/** Narrow to one kind of device. */
+		deviceType: _enum(DeviceType).optional(),
+		/** Narrow to one room: the `location` label devices carry. */
+		roomId: string().min(1).optional()
+	}),
+	object({
+		kind: literal("var"),
+		name: string().min(1)
+	})
+]);
+EventCategory.DeviceRegistered, EventCategory.DeviceUnregistered, EventCategory.DeviceUpdated, EventCategory.DeviceMetaChanged, EventCategory.DeviceBindingsChanged;
+var ExpressionBindingSourceSchema = union([
+	object({
+		kind: literal("field").optional(),
+		sourceKey: string(),
+		cap: string(),
+		fieldPath: string()
+	}),
+	object({
+		kind: literal("literal"),
+		value: union([
+			string(),
+			number(),
+			boolean(),
+			_null()
+		])
+	}),
+	object({
+		kind: literal("global"),
+		sourceStableId: string(),
+		addonId: string().optional(),
+		cap: string(),
+		fieldPath: string()
+	})
+]);
+object({
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+/**
+* Identity envelope for a device's upstream-system metadata.
+*
+* Two jobs:
+*
+*   1. **Dispatch key.** `id` is the natural identifier the SOURCE system
+*      uses to address this device (HA `entity_id`, Reolink MAC, ONVIF
+*      WS-Discovery endpoint UUID, …). Provider code keeps a
+*      `Map<sourceInfo.id, IDevice>` to route inbound push events in O(1)
+*      without round-tripping through `stableId` / `id` mappings.
+*
+*   2. **Stability bridge.** `uniqueId` is the *immutable* upstream id when
+*      one exists (HA `entity.unique_id`, Reolink MAC again — same as `id`
+*      for vendors where MAC is the natural key). For systems where the
+*      live dispatch key can be renamed (HA `entity_id` can be edited),
+*      providers detect renames by matching `uniqueId` and patch `id`
+*      in-place so dispatch keeps working.
+*
+* **Display unit and precision are NOT stored here.** They are a read-time
+* preference (D944). A polymorphic reading stores its `quantity` here once,
+* at adopt, and a date/time value stores `dateTimeShape` the same way —
+* neither is repeated on each sample. The `device_class` tag is an
+* HA-specific input consumed at the discovery boundary (`ha-domain-mapping`)
+* to derive the CamStack `DeviceRole`; it is never stored after that point.
+*
+* The `raw` escape hatch carries provider-specific attributes that don't
+* fit the structured slots (HA `attributes` whitelist, Reolink `deviceCache`
+* details, …). Providers control what lands here.
+*/
+var SourceInfoSchema = object({
+	/** Live dispatch key — mutable when the source system allows rename. */
+	id: string(),
+	/** Source system tag — e.g. 'homeassistant' | 'reolink' | 'onvif'. */
+	system: string(),
+	/** Immutable upstream identifier when available (HA `unique_id`, … ).
+	*  Used to detect rename when `id` changes. */
+	uniqueId: string().optional(),
+	/** Quantity of a polymorphic reading, written once at adopt (D944). */
+	quantity: ReadingQuantitySchema.optional(),
+	/** Date / time / datetime shape of a string reading, written once at adopt. */
+	dateTimeShape: _enum([
+		"date",
+		"time",
+		"datetime"
+	]).optional(),
+	/** Provider-specific extras that don't fit the structured slots.
+	*  Whitelist what goes here per provider — do NOT dump entire HA
+	*  attribute blobs (would explode the meta JSON column). */
+	raw: record(string(), unknown()).optional()
+});
+/**
+* Build the synthetic SourceInfo every existing provider falls back to
+* when no upstream value has been persisted. Keeps non-migrated providers
+* (Reolink / Hikvision / ONVIF / RTSP) functional without code
+* changes — `id` reuses the CamStack stableId, `system` reuses the addon
+* id. Real upstream identity replaces this once a provider migrates and
+* calls `updateSourceInfo()` with concrete values.
+*/
+function synthesizeSourceInfo(input) {
+	return {
+		id: input.stableId,
+		system: input.addonId
+	};
 }
-/** Value in `spec`'s unit → its dimension's canonical unit. */
-function toCanonical(value, spec) {
-	return value * spec.factor + spec.offset;
+/**
+* Shallow-merge a partial patch over a prior SourceInfo. `undefined`
+* patch values are ignored (no field clobber); to clear a field
+* explicitly, providers omit it from the patch and rebuild from scratch
+* via `updateSourceInfo({})` cycles — uncommon enough that we don't
+* bother with a `null`-means-delete sentinel.
+*
+* The `raw` field is also shallow-merged: passing `raw: { foo: 1 }`
+* merges over existing `raw` keys instead of replacing the whole bag.
+*/
+function mergeSourceInfo(prev, patch) {
+	const next = { ...prev };
+	for (const [k, v] of Object.entries(patch)) {
+		if (v === void 0) continue;
+		if (k === "raw" && typeof v === "object" && v !== null) {
+			next.raw = {
+				...prev.raw,
+				...v
+			};
+			continue;
+		}
+		next[k] = v;
+	}
+	return next;
 }
-/** Canonical-unit value → the unit described by `spec`. */
-function fromCanonical(canonical, spec) {
-	return (canonical - spec.offset) / spec.factor;
+/**
+* Coerce common unit-of-measurement string variants to a canonical form
+* so the UI's display templates can rely on stable strings. Pure
+* passthrough for unknown units — kept conservative on purpose, the goal
+* is to normalise the long tail of HA `unit_of_measurement` values that
+* have multiple historical spellings (`'°C'` vs `'C'` vs `'celsius'`).
+*
+* Extend the map as we encounter real-world data. Returning the raw
+* input for unknown values is intentional: providers should never
+* lose information silently here.
+*/
+function normalizeUnit(raw) {
+	if (raw == null) return void 0;
+	const trimmed = raw.trim();
+	if (trimmed === "") return void 0;
+	const lower = trimmed.toLowerCase();
+	if (lower === "°c" || lower === "c" || lower === "celsius") return "°C";
+	if (lower === "°f" || lower === "f" || lower === "fahrenheit") return "°F";
+	if (lower === "k" || lower === "kelvin") return "K";
+	if (lower === "%" || lower === "percent" || lower === "percentage") return "%";
+	if (lower === "lx" || lower === "lux") return "lx";
+	if (lower === "hpa" || lower === "hectopascal") return "hPa";
+	if (lower === "kpa") return "kPa";
+	if (lower === "pa") return "Pa";
+	if (lower === "mbar" || lower === "millibar") return "mbar";
+	if (lower === "w" || lower === "watt") return "W";
+	if (lower === "kw" || lower === "kilowatt") return "kW";
+	if (lower === "wh" || lower === "watt-hour") return "Wh";
+	if (lower === "kwh" || lower === "kilowatt-hour") return "kWh";
+	if (lower === "v" || lower === "volt") return "V";
+	if (lower === "a" || lower === "amp" || lower === "ampere") return "A";
+	if (lower === "ma" || lower === "milliampere") return "mA";
+	if (lower === "va") return "VA";
+	if (lower === "ppm") return "ppm";
+	if (lower === "ppb") return "ppb";
+	if (lower === "µg/m³" || lower === "ug/m3" || lower === "µg/m3") return "µg/m³";
+	if (lower === "km/h" || lower === "kph") return "km/h";
+	if (lower === "mph") return "mph";
+	if (lower === "m/s") return "m/s";
+	if (lower === "m") return "m";
+	if (lower === "m²" || lower === "m2") return "m²";
+	if (lower === "mm") return "mm";
+	if (lower === "cm") return "cm";
+	if (lower === "km") return "km";
+	if (lower === "in" || lower === "inch" || lower === "inches") return "in";
+	if (lower === "ft" || lower === "foot" || lower === "feet") return "ft";
+	if (lower === "kg") return "kg";
+	if (lower === "g") return "g";
+	if (lower === "l" || lower === "liter" || lower === "litre" || lower === "liters" || lower === "litres") return "L";
+	if (lower === "ml") return "mL";
+	if (lower === "gal" || lower === "gallon" || lower === "gallons") return "gal";
+	if (lower === "s" || lower === "sec" || lower === "second" || lower === "seconds") return "s";
+	if (lower === "ms") return "ms";
+	if (lower === "min" || lower === "minute" || lower === "minutes") return "min";
+	if (lower === "h" || lower === "hr" || lower === "hour" || lower === "hours") return "h";
+	if (lower === "d" || lower === "day" || lower === "days") return "d";
+	if (lower === "b" || lower === "byte" || lower === "bytes") return "B";
+	if (lower === "kib") return "KiB";
+	if (lower === "mib") return "MiB";
+	if (lower === "gib") return "GiB";
+	if (lower === "tib") return "TiB";
+	if (lower === "kb") return "kB";
+	if (lower === "mb") return "MB";
+	if (lower === "gb") return "GB";
+	if (lower === "dbm") return "dBm";
+	if (lower === "dbfs") return "dBFS";
+	if (lower === "inhg") return "inHg";
+	if (lower === "mm/h" || lower === "mm/hr") return "mm/h";
+	if (lower === "in/h" || lower === "in/hr") return "in/h";
+	if (lower === "w/m²" || lower === "w/m2") return "W/m²";
+	if (lower === "°" || lower === "deg" || lower === "degree" || lower === "degrees") return "°";
+	if (lower === "kbps") return "kbps";
+	if (lower === "fps") return "fps";
+	return trimmed;
 }
 /**
-* Graceful variant for the render path: returns the converted value, or
-* `undefined` when the conversion is refused (unknown unit / cross-dimension).
-* Never throws — a render caller falls back to the raw value + source unit.
+* Key under which `SourceInfo` lives inside `DeviceMeta.metadata`. The
+* blob is a free-form `Record<string, unknown>` shared with hardware-
+* identity fields (`manufacturer`, `model`, `firmware`, …); SourceInfo
+* lives under a single nested key to keep it composable with those.
 */
-function tryConvertUnit(value, from, to) {
-	if (from === to) return value;
-	const fromSpec = specFor(from);
-	if (!fromSpec) return void 0;
-	const toSpec = specFor(to);
-	if (!toSpec) return void 0;
-	if (fromSpec.dimension !== toSpec.dimension) return void 0;
-	return fromCanonical(toCanonical(value, fromSpec), toSpec);
+var SOURCE_INFO_METADATA_KEY = "sourceInfo";
+/**
+* Extract a SourceInfo from a `DeviceMeta.metadata` blob, validating
+* with Zod. Returns `null` when the blob is missing or the nested
+* `sourceInfo` key fails validation — callers fall back to the
+* synthetic default in that case (see `synthesizeSourceInfo`).
+*/
+function extractSourceInfoFromMetadata(metadata) {
+	if (!metadata) return null;
+	const raw = metadata[SOURCE_INFO_METADATA_KEY];
+	if (!raw) return null;
+	const parsed = SourceInfoSchema.safeParse(raw);
+	if (!parsed.success) return null;
+	return parsed.data;
 }
 /**
 * A number a person types for a physical quantity — the input side of the
@@ -45104,15 +45238,28 @@ var SettingsSchemaWithValuesSchema = object({
 });
 /** Patch object — keys are field names, values are the new field values. */
 var SettingsPatchSchema = record(string(), unknown());
+/** The scope of a scoped-settings call (D986): where the capability declared the values. */
+var ScopedSettingsScopeSchema = _enum(SCOPED_SETTINGS_SCOPES);
+/** One scoped schema an addon serves: its capability, scope and section ids. */
+var ScopedSettingsDeclarationSchema = object({
+	cap: string(),
+	scope: ScopedSettingsScopeSchema,
+	sectionIds: array(string())
+});
 /** Standard success response for update operations. */
 var SettingsUpdateResultSchema = object({ success: literal(true) });
 method(object({
 	addonId: string(),
-	nodeId: string().optional(),
-	overlay: record(string(), unknown()).optional(),
-	cap: string().optional()
+	cap: string(),
+	scope: ScopedSettingsScopeSchema,
+	nodeId: string().optional()
 }), SettingsSchemaWithValuesSchema.nullable()), method(object({
 	addonId: string(),
+	nodeId: string().optional()
+}), array(ScopedSettingsDeclarationSchema).nullable()), method(object({
+	addonId: string(),
+	cap: string(),
+	scope: ScopedSettingsScopeSchema,
 	nodeId: string().optional(),
 	patch: SettingsPatchSchema
 }), SettingsUpdateResultSchema, {
@@ -45120,8 +45267,10 @@ method(object({
 	auth: "admin"
 }), method(object({
 	addonId: string(),
+	cap: string(),
+	scope: ScopedSettingsScopeSchema,
 	nodeId: string().optional()
-}), SettingsSchemaWithValuesSchema.nullable()), method(object({
+}), record(string(), unknown()).nullable()), method(object({
 	addonId: string(),
 	nodeId: string().optional(),
 	instance: IntegrationInstanceRefSchema
@@ -46684,7 +46833,7 @@ var BackupDestinationInfoSchema = object({
 	id: string(),
 	/**
 	* Manifest id of the owning addon. The Settings button on the
-	* destination card opens that addon's `globalSettingsSchema` panel.
+	* destination card opens that addon's scoped settings panel.
 	*/
 	addonId: string(),
 	/** Operator-toggled enable flag from the destination-policy table. */
@@ -50098,7 +50247,7 @@ var mediaPlayerCapability = {
 		isMuted: { kind: "boolean" }
 	} }
 };
-DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.EventEmitter, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.PetFountain, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Heater, DeviceType.Dryer, DeviceType.Gateway, DeviceType.Camera, DeviceType.Fan, DeviceType.Lock, DeviceType.Camera, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Gateway, DeviceType.Hub, DeviceType.Camera, DeviceType.Sensor, DeviceType.MediaPlayer, DeviceType.Vacuum, DeviceType.Generic, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.PetFountain, DeviceType.Fan, DeviceType.Humidifier, DeviceType.Climate, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder, DeviceType.Heater;
+DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.EventEmitter, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.PetFountain, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Heater, DeviceType.Dryer, DeviceType.Gateway, DeviceType.Camera, DeviceType.Fan, DeviceType.Lock, DeviceType.Camera, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.Gateway, DeviceType.Hub, DeviceType.Camera, DeviceType.Sensor, DeviceType.MediaPlayer, DeviceType.Vacuum, DeviceType.Generic, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.PetFountain, DeviceType.Fan, DeviceType.Humidifier, DeviceType.Climate, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder, DeviceType.Heater, DeviceType.MediaPlayer;
 var NUMBER = {
 	kind: "fixed",
 	result: ["number"]
@@ -52137,6 +52286,7 @@ method(InstancePinSchema, DeviceExportStatusSchema), method(_void(), array(Expor
 	kind: "mutation",
 	auth: "admin"
 });
+var DeviceAliasSchema = string().max(64).regex(/^[a-z][a-z0-9_]*$/);
 /**
 * A SITE ZONE — a named part of the property that several locations belong to.
 *
@@ -52623,6 +52773,12 @@ var DeviceInfoSchema = object({
 	addonId: string(),
 	type: _enum(DeviceType),
 	name: string(),
+	/** The name a value template uses for this device (`{{ stufa_veranda.temperature }}`),
+	*  entity_id style. Generated once from the name at first registration, unique
+	*  cluster-wide, editable through `setAlias`, NOT changed by a rename (D1021).
+	*  Optional: a record produced by an older build omits it until the boot
+	*  backfill has run. */
+	alias: DeviceAliasSchema.optional(),
 	/** Operator-organisational location label. `null` when unset. */
 	location: string().nullable(),
 	/** Soft-disabled flag. */
@@ -52942,6 +53098,25 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	alias: string()
+}), discriminatedUnion("ok", [object({
+	ok: literal(true),
+	alias: DeviceAliasSchema
+}), object({
+	ok: literal(false),
+	reason: _enum([
+		"empty",
+		"too-long",
+		"grammar",
+		"reserved",
+		"taken"
+	]),
+	takenBy: number().optional()
+})]), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	location: string().nullable()
@@ -56651,7 +56826,7 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 * or the redaction token KEEPS the stored secret; `{ $secretClear: true }`
 * clears it.
 */
-var ConfigSchemaPassthrough$3 = custom();
+var ConfigSchemaPassthrough$2 = custom();
 var IntegrationInstanceIdSchema = string().min(1);
 var IntegrationInstanceModeSchema = _enum(["single", "multiple"]);
 /**
@@ -56697,7 +56872,16 @@ var IntegrationInstanceKindSchema = object({
 	/** Relative hub path to start an interactive account link of an instance of this kind. */
 	connectPath: string().min(1).optional(),
 	/** Relative hub path to disconnect that account. */
-	disconnectPath: string().min(1).optional()
+	disconnectPath: string().min(1).optional(),
+	/**
+	* Parts of the edit dialog the flat form cannot draw (a node picker, a model source), named by a
+	* GENERIC widget id the client maps to a component; a client that knows none of them shows none.
+	* `connection` widgets write connection values, `model` widgets own the model choice.
+	*/
+	widgets: array(object({
+		id: string().min(1),
+		placement: _enum(["connection", "model"])
+	})).optional()
 });
 /**
 * How devices of an instance are found. `none`: the operator adds them by hand; `lan`: the addon
@@ -56738,10 +56922,11 @@ var IntegrationInstanceDescriptionSchema = object({
 	/** True when `testInstance` really probes the remote. */
 	canTest: boolean(),
 	/**
-	* The kinds an instance can be of. Absent or one entry: nothing to choose; more than one: the
-	* Add flow asks which first and sends it as `createInstance.kind`.
+	* The kinds an instance can be of (D1013 rule 1), each naming its `functionCap`. One entry:
+	* nothing to choose; more than one: the Add flow asks which first and sends it as
+	* `createInstance.kind`. Never empty: every instance belongs to exactly one kind.
 	*/
-	kinds: array(IntegrationInstanceKindSchema).optional(),
+	kinds: array(IntegrationInstanceKindSchema).min(1),
 	/**
 	* The provider accepts `createInstance.id` for an id that once existed (an adopted id, because
 	* devices carry it). The UI then offers "restore under its old id" on Add. Absent means no.
@@ -56777,8 +56962,8 @@ var IntegrationInstanceSchema = object({
 	* the body is the one store, `setInstanceEnabled` the one writer (epic #440, step 3).
 	*/
 	enabled: boolean().optional(),
-	/** The kind of this instance (one of `describe().kinds[].id`), when the provider has kinds. */
-	kind: string().optional(),
+	/** The kind of this instance: exactly one of `describe().kinds[].id` (D1013 rule 2). */
+	kind: string().min(1),
 	/** Values for the instance form; a secret is a `SecretFieldView`, never text. */
 	formValues: record(string(), unknown()),
 	status: IntegrationInstanceStatusSchema.optional(),
@@ -56802,7 +56987,7 @@ var integrationInstancesCapability = {
 			id: IntegrationInstanceIdSchema.nullable(),
 			/** The kind of the create form (`id: null`) of a provider with several. */
 			kind: string().min(1).optional()
-		}), ConfigSchemaPassthrough$3, { auth: "admin" }),
+		}), ConfigSchemaPassthrough$2, { auth: "admin" }),
 		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
 		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
 		/**
@@ -57904,12 +58089,12 @@ var LlmModelInfoSchema = object({
 });
 /**
 * The provider-specific part of a profile, validated by the provider that owns
-* the kind (`upsertProfile` refuses what it does not accept). A field its
+* the kind (saving an instance refuses what it does not accept). A field its
 * `connectionSchema` declares `type: 'password'` is a secret: it is held in the
 * keychain, never in the row, and reads back as the redaction marker.
 */
 var LlmProviderConfigSchema = record(string(), unknown());
-var LlmProfileSchema = object({
+object({
 	id: string(),
 	name: string(),
 	/** The provider-declared kind (`LlmProfileKindDescriptor.kind`). */
@@ -58003,8 +58188,8 @@ var LlmProviderWidgetSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$2 = unknown();
-var LlmProfileKindDescriptorSchema = object({
+var ConfigSchemaPassthrough$1 = unknown();
+object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	/** A generic icon name (`cloud`, `plug`, `cpu`) — never a glyph or a logo. */
@@ -58012,9 +58197,9 @@ var LlmProfileKindDescriptorSchema = object({
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
 	/** The provider's own fields (`providerConfig`); `password` fields are keychain-held. */
-	connectionSchema: ConfigSchemaPassthrough$2,
+	connectionSchema: ConfigSchemaPassthrough$1,
 	/** Provider fields that belong under "Advanced" (extra headers, runtime tuning). */
-	advancedSchema: ConfigSchemaPassthrough$2.optional(),
+	advancedSchema: ConfigSchemaPassthrough$1.optional(),
 	/** The kind's defaults; a model from `listModels` may override any of them. */
 	features: LlmModelFeaturesSchema,
 	/** `false` = the provider stamps `supportsVision` itself (from what a node reports). */
@@ -58143,20 +58328,7 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, {
 }), method(object({
 	addonId: string().optional(),
 	requestId: string()
-}), _void(), { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(ProfileRefInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(ProfileRefInputSchema, LlmGenerateResultSchema, {
-	kind: "mutation",
-	auth: "admin",
-	timeoutMs: AI_CAP_TRANSPORT_TIMEOUT_MS
-}), method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
+}), _void(), { kind: "mutation" }), method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), array(LlmDefaultSchema)), method(object({
@@ -59219,20 +59391,7 @@ method(_void(), MeshStatusSchema), method(object({
 /** Optional hostname override the host should advertise once joined. */
 hostname: string().optional() }), object({ 
 /** Authentication URL the operator should open in a browser. */
-loginUrl: string() }), { kind: "mutation" }), method(_void(), object({ left: literal(true) }), { kind: "mutation" }), method(_void(), object({ loggedOut: literal(true) }), { kind: "mutation" }), method(_void(), object({ peers: array(MeshPeerSchema).readonly() })), method(object({ 
-/** Optional auth key — when provided, probes the key validity
-*  against the provider's API. Omit when already joined to
-*  just ping the daemon. */
-authKey: string().optional() }), object({
-	ok: boolean(),
-	/** Provider-side identifier resolved by the probe (tailnet
-	*  name for Tailscale, network id for ZeroTier, etc.). */
-	tenant: string().optional(),
-	/** Daemon binary version, when reachable. */
-	daemonVersion: string().optional(),
-	/** Human-readable error when `ok: false`. */
-	error: string().optional()
-}), { kind: "mutation" });
+loginUrl: string() }), { kind: "mutation" }), method(_void(), object({ left: literal(true) }), { kind: "mutation" }), method(_void(), object({ loggedOut: literal(true) }), { kind: "mutation" }), method(_void(), object({ peers: array(MeshPeerSchema).readonly() }));
 /**
 * A monotonic total between resets (D944). Energy uses `power-meter.energy`
 * so dashboards keep one series; every other instantaneous reading lands here.
@@ -67059,6 +67218,11 @@ var NcScheduleSchema = object({
 * as a STATE SUMMARY at the end of each window of `schedule`.
 */
 var NcSystemEventDeliveryModeSchema = _enum(["instant", "summary"]);
+_enum([
+	"activation",
+	"deactivation",
+	"schedule"
+]);
 /**
 * How a summary window is SENT (D698): `rule` (absent) = ONE notification with
 * every section; `section` = one notification per section with something to
@@ -67075,11 +67239,26 @@ var NcStateSummarySplitSchema = _enum(["rule", "section"]);
 * midnight crossing); the send time is each window's END. Refused on the
 * `alarm` family, which stays instant (`systemEventDeliveryProblems`).
 */
-var NcSystemEventDeliverySchema = discriminatedUnion("mode", [object({ mode: literal("instant") }), object({
-	mode: literal("summary"),
-	schedule: NcScheduleSchema,
-	split: NcStateSummarySplitSchema.optional()
-})]);
+var NcSystemEventDeliverySchema = discriminatedUnion("mode", [
+	object({ mode: literal("instant") }),
+	object({
+		mode: literal("summary"),
+		schedule: NcScheduleSchema,
+		split: NcStateSummarySplitSchema.optional()
+	}),
+	object({
+		mode: literal("modes"),
+		/** The bad edge, and every kind that has a single edge. */
+		onActivation: boolean(),
+		/** The recovery edges of the classes of the selected kinds (derived, never stored per kind). */
+		onDeactivation: boolean(),
+		/** A state summary at the end of each window; absent = no summary. */
+		onSchedule: object({
+			schedule: NcScheduleSchema,
+			grouping: NcStateSummarySplitSchema
+		}).optional()
+	})
+]);
 /** Fuzzy plate matcher — OCR noise makes exact match useless (spec row 12/13). */
 var NcPlateMatcherSchema = object({
 	/**
@@ -69439,61 +69618,6 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
-* `oidc-connections` — CRUD for IdP rows under `auth-oidc` (D828 sibling).
-*
-* One hub-only singleton (`auth-oidc`). The Settings UI is a DataTable +
-* ItemFormDialog; there is no `editable-array` in `globalSettingsSchema`.
-* Operator-chosen `id` is the URL slug (`/addon/auth-oidc/<id>/…`) and is
-* immutable after create.
-*/
-var ConfigSchemaPassthrough$1 = unknown();
-var OidcConnectionSchema = object({
-	id: string().min(1),
-	displayName: string(),
-	icon: string(),
-	issuerUrl: string(),
-	clientId: string(),
-	/** Client id + secret present — never the secret value. */
-	configured: boolean(),
-	/**
-	* Values for the connection form schema. `clientSecret` is a keychain
-	* {@link SecretFieldView} or `null` / `''`, never plaintext (D789).
-	*/
-	formValues: record(string(), unknown()).optional()
-});
-/**
-* Patch one connection. Omitted or empty `clientSecret` keeps the stored
-* secret (D787). `{ $secretClear: true }` clears it. `id` is never renamed.
-*/
-var OidcConnectionUpdateInputSchema = object({
-	id: string().min(1),
-	displayName: string().min(1),
-	icon: string().optional(),
-	issuerUrl: string().optional(),
-	clientId: string().optional(),
-	clientSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
-	redirectUri: string().optional(),
-	scopes: string().optional(),
-	usernameClaim: _enum([
-		"preferred_username",
-		"email",
-		"sub"
-	]).optional()
-});
-method(object({}), ConfigSchemaPassthrough$1, { auth: "admin" }), method(object({}), array(OidcConnectionSchema).readonly(), { auth: "admin" }), method(object({
-	id: string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug"),
-	displayName: string().min(1)
-}), object({ id: string() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(OidcConnectionUpdateInputSchema, object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ id: string().min(1) }), object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * Generic on-screen-display (video overlay) cap. Each camera exposes
 * a firmware-defined list of overlays (channel name, timestamp,
 * watermark, logo, …); the cap models them as a homogeneous array of
@@ -75208,6 +75332,16 @@ var RemoteLayoutComponentSchema = object({
 method(object({}), array(RemoteLayoutComponentSchema), { auth: "protected" });
 var RUNNING_POWER_START_DELAY_MS = 3e4;
 var RUNNING_POWER_STOP_DELAY_MS = 18e4;
+/**
+* Per-type overrides of the dwell defaults. A media player draws power the
+* moment it is on and stops drawing the moment it is off, so it needs neither
+* a long dwell nor a second sample. A type absent here keeps the global values.
+*/
+var RUNNING_POWER_DEFAULTS_BY_TYPE = { [DeviceType.MediaPlayer]: {
+	startDwellMs: 1e4,
+	stopDwellMs: 1e4,
+	minSamples: 1
+} };
 var RunningStateSourceSchema = _enum(["native", "assigned"]);
 var RunningStateStatusSchema = object({
 	/** null = unknown — never coerced to false (D393). */
@@ -75225,93 +75359,27 @@ var RunningFlipEventDataSchema = object({
 	phase: string().nullable()
 });
 var RUNNING_DEVICE_TYPES = Object.values(DeviceType);
-/** Generic Customize target for the running boolean (D936). */
-var runningCustomize = {
-	version: 1,
-	overridable: [{
-		path: "running",
-		by: "running"
-	}],
-	targets: [{
-		id: "running",
-		cardinality: "scalar",
-		vocabulary: {
-			cap: "running-state",
-			stateField: "running"
-		},
-		deviceTypes: [
-			DeviceType.Washer,
-			DeviceType.Dryer,
-			DeviceType.Dishwasher,
-			DeviceType.Vacuum,
-			DeviceType.LawnMower,
-			DeviceType.MediaPlayer,
-			DeviceType.WaterHeater,
-			DeviceType.Humidifier,
-			DeviceType.Fan,
-			DeviceType.Climate,
-			DeviceType.Thermostat,
-			DeviceType.PetFeeder,
-			DeviceType.Heater
-		],
-		apply: "add",
-		path: "running",
-		sources: [
-			{
-				kind: "switch",
-				transforms: [{ kind: "identity" }]
-			},
-			{
-				kind: "binary",
-				transforms: [{ kind: "identity" }, { kind: "invert" }]
-			},
-			{
-				kind: "numeric",
-				requiredUnit: "W",
-				transforms: [{
-					kind: "threshold",
-					comparisons: ["gte", "lte"],
-					comparison: "gte",
-					defaultThreshold: 5,
-					defaultStartDwellMs: RUNNING_POWER_START_DELAY_MS,
-					defaultStopDwellMs: RUNNING_POWER_STOP_DELAY_MS,
-					thresholdUnit: "W"
-				}]
-			}
-		],
-		companions: [
-			{
-				kind: "constant",
-				path: "source",
-				value: "assigned",
-				when: "always"
-			},
-			{
-				kind: "constant",
-				path: "phase",
-				value: null,
-				when: "add"
-			},
-			{
-				kind: "clock",
-				path: "lastFetchedAt",
-				when: "always"
-			},
-			{
-				kind: "transition-time",
-				path: "since",
-				sourceChangedAt: "prefer"
-			}
-		],
-		sourceReport: {
-			status: "assignment-status",
-			runtimeField: "source",
-			nativeValue: "native",
-			assignedValue: "assigned"
-		},
-		advancedExpression: true
-	}]
-};
+/**
+* Customize offers "running" only where a job makes sense (D933): a cycle,
+* a clean, a mow, playback, or another appliance that is on and working.
+* The cap itself stays on every type — a camera can still report running
+* natively; it just has no card.
+*/
+var RUNNING_CUSTOMIZE_DEVICE_TYPES = [
+	DeviceType.Washer,
+	DeviceType.Dryer,
+	DeviceType.Dishwasher,
+	DeviceType.Vacuum,
+	DeviceType.LawnMower,
+	DeviceType.MediaPlayer,
+	DeviceType.WaterHeater,
+	DeviceType.Humidifier,
+	DeviceType.Fan,
+	DeviceType.Climate,
+	DeviceType.Thermostat,
+	DeviceType.PetFeeder,
+	DeviceType.Heater
+];
 var runningStateCapability = {
 	name: "running-state",
 	scope: "device",
@@ -75331,7 +75399,79 @@ var runningStateCapability = {
 	durability: "restored",
 	history: { fields: { running: { kind: "boolean" } } },
 	volatileStateFields: ["lastFetchedAt"],
-	customize: runningCustomize
+	customize: {
+		version: 1,
+		overridable: [{
+			path: "running",
+			by: "running"
+		}],
+		targets: [{
+			id: "running",
+			cardinality: "scalar",
+			vocabulary: {
+				cap: "running-state",
+				stateField: "running"
+			},
+			deviceTypes: RUNNING_CUSTOMIZE_DEVICE_TYPES,
+			apply: "add",
+			path: "running",
+			sources: [
+				{
+					kind: "switch",
+					transforms: [{ kind: "identity" }]
+				},
+				{
+					kind: "binary",
+					transforms: [{ kind: "identity" }, { kind: "invert" }]
+				},
+				{
+					kind: "numeric",
+					requiredUnit: "W",
+					transforms: [{
+						kind: "threshold",
+						comparisons: ["gte", "lte"],
+						comparison: "gte",
+						defaultThreshold: 5,
+						defaultStartDwellMs: RUNNING_POWER_START_DELAY_MS,
+						defaultStopDwellMs: RUNNING_POWER_STOP_DELAY_MS,
+						deviceTypeDefaults: RUNNING_POWER_DEFAULTS_BY_TYPE,
+						thresholdUnit: "W"
+					}]
+				}
+			],
+			companions: [
+				{
+					kind: "constant",
+					path: "source",
+					value: "assigned",
+					when: "always"
+				},
+				{
+					kind: "constant",
+					path: "phase",
+					value: null,
+					when: "add"
+				},
+				{
+					kind: "clock",
+					path: "lastFetchedAt",
+					when: "always"
+				},
+				{
+					kind: "transition-time",
+					path: "since",
+					sourceChangedAt: "prefer"
+				}
+			],
+			sourceReport: {
+				status: "assignment-status",
+				runtimeField: "source",
+				nativeValue: "native",
+				assignedValue: "assigned"
+			},
+			advancedExpression: true
+		}]
+	}
 };
 /**
 * scene-monitor — device-scoped reference-region state cap. An operator marks
@@ -76575,21 +76715,6 @@ method(object({
 	*/
 	ttlSec: union([number().int().positive(), literal("never")]).optional()
 }), object({ token: string() }), { auth: "admin" }), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable(), { auth: "admin" });
-var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object({
-	providerId: string().min(1),
-	displayName: string().min(1),
-	configSchema: unknown(),
-	nodeLocal: boolean(),
-	shouldSaveDiskSpace: literal(true),
-	minFreePercent: number().min(0).max(100)
-}), object({
-	providerId: string().min(1),
-	displayName: string().min(1),
-	configSchema: unknown(),
-	nodeLocal: boolean(),
-	shouldSaveDiskSpace: literal(false),
-	minFreePercent: literal(null)
-})]);
 method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
@@ -76651,42 +76776,7 @@ method(object({
 }), _instanceof(Uint8Array), { auth: "admin" }), method(object({ downloadId: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
-	createdAt: true,
-	updatedAt: true
-}), StorageLocationSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	id: string(),
-	force: boolean().optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(StorageDrainProgressSchema).readonly()), method(object({ id: string() }), object({
-	ok: boolean(),
-	error: string().optional()
-}), { auth: "admin" }), method(_void(), array(ProviderListEntrySchema).readonly()), method(object({
-	providerId: string(),
-	/**
-	* The location this config is an UNSAVED edit of, when there is one.
-	*
-	* `listLocations` replaces every declared secret with the redaction
-	* sentinel, so the edit modal's form state holds the sentinel for any
-	* credential the operator did not retype — and posting that here
-	* without a way to resolve it makes the provider try to authenticate
-	* as `__camstack_redacted__` and report the operator's own working
-	* password as wrong. Given this id, the orchestrator restores each
-	* sentinel from the stored config (same rule as `upsertLocation`)
-	* before dispatching. Omitted by the "Add location" wizard, where
-	* every value was typed just now and nothing is stored yet.
-	*/
-	locationId: string().optional(),
-	config: record(string(), unknown())
-}), object({
-	ok: boolean(),
-	error: string().optional()
-}), { auth: "admin" });
+}), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(_void(), array(StorageDrainProgressSchema).readonly());
 /** One table of the settings database. */
 var StorageTableSchema = object({
 	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
@@ -78208,7 +78298,7 @@ var TerminalInstanceInfoSchema = object({
 	/**
 	* False while the node the instance is bound to is not in the cluster
 	* topology (forgotten, renamed, re-paired). The instance is kept; the
-	* operator re-points it with `updateInstance({ targetNodeId })`.
+	* operator re-points it on the Terminal page.
 	*/
 	nodeInCluster: boolean(),
 	profileId: string(),
@@ -78246,41 +78336,7 @@ var TerminalOutputBatchSchema = object({
 	snapshot: string().optional(),
 	events: array(TerminalOutputEventSchema).readonly()
 });
-method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }), method(_void(), array(TerminalInstanceInfoSchema).readonly(), { auth: "admin" }), method(object({
-	targetNodeId: string().min(1),
-	profileId: string().min(1),
-	name: string().trim().min(1).max(160).optional(),
-	executable: string().max(1024).optional(),
-	args: array(string().max(2048)).max(64).optional(),
-	cwd: string().max(1024).optional(),
-	environment: array(string().max(4096)).max(64).optional(),
-	profileSettings: ProfileSettingsBagSchema.optional()
-}), TerminalInstanceInfoSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	instanceId: string().min(1),
-	/** Re-point the instance to another node; the profile must exist there. */
-	targetNodeId: string().min(1).max(256).optional(),
-	name: string().trim().min(1).max(160).optional(),
-	executable: string().max(1024).optional(),
-	args: array(string().max(2048)).max(64).optional(),
-	cwd: string().max(1024).optional(),
-	environment: array(string().max(4096)).max(64).optional(),
-	profileSettings: ProfileSettingsBagSchema.optional()
-}), TerminalInstanceInfoSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ instanceId: string().min(1) }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	instanceId: string().min(1),
-	enabled: boolean()
-}), TerminalInstanceInfoSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(TerminalLegacyCameraSchema).readonly(), { auth: "admin" }), method(object({
+method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }), method(_void(), array(TerminalLegacyCameraSchema).readonly(), { auth: "admin" }), method(object({
 	stableId: string().min(1),
 	name: string().trim().min(1).max(160).optional()
 }), TerminalInstanceInfoSchema, {
@@ -78349,6 +78405,11 @@ var TimedRunUnitSchema = _enum(["s", "min"]);
 _enum(["switch", "pet-fountain"]);
 DeviceType.Heater, DeviceType.PetFountain;
 var TIMED_RUN_DEVICE_TYPES = [DeviceType.Heater, DeviceType.PetFountain];
+/** One duration, as the one-tap run asks for it. */
+var TimedRunQuickRunSchema = object({
+	duration: number().positive().finite(),
+	unit: TimedRunUnitSchema
+});
 /** Why a request was not carried out. Typed, so a caller can say it in words. */
 var TimedRunRefusalSchema = _enum([
 	"unsupported-device",
@@ -78369,8 +78430,23 @@ var TimedRunStatusSchema = object({
 	activeUntil: number().nullable(),
 	/** Who asked for the run (a user id or an addon id); `null` when nothing is armed or it did not say. */
 	requestedBy: string().nullable(),
+	/**
+	* The one-tap run of THIS device: what a "Run" button on any surface starts. `null` when
+	* the device is gone or its type has no timed run; a status from before this field
+	* existed has none, and a surface falls back to the type's default.
+	*/
+	quickRun: TimedRunQuickRunSchema.nullable(),
 	lastFetchedAt: number()
 });
+/** What the settings form needs: the unit, the bounds and the type's default. */
+var TimedRunOptionsSchema = object({
+	unit: TimedRunUnitSchema,
+	/** The longest run, in `unit`. */
+	maxDuration: number(),
+	defaultDuration: number()
+});
+/** The one-tap run duration, in the type's unit; `null` returns to the type's default. */
+var TimedRunSettingsPatchSchema = object({ quickRunDuration: number().positive().finite().nullable().optional() });
 var timedRunCapability = {
 	name: "timed-run",
 	scope: "device",
@@ -78378,7 +78454,24 @@ var timedRunCapability = {
 	kind: "wrapper",
 	defaultActive: true,
 	deviceTypes: TIMED_RUN_DEVICE_TYPES,
+	deviceConfig: { ui: {
+		kind: "derived-form",
+		builderId: "timed-run",
+		tab: "general"
+	} },
 	methods: {
+		getOptions: method(object({ deviceId: number().int() }), TimedRunOptionsSchema),
+		/**
+		* The one-tap run of this device. A duration above the type's maximum is
+		* REFUSED (thrown), like `runFor`: the maximum is a safety bound.
+		*/
+		setSettings: method(object({
+			deviceId: number().int(),
+			settings: TimedRunSettingsPatchSchema
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/**
 		* Turn the device on and arm its off. A run already armed is replaced (the
 		* new deadline wins). Refuses with a typed reason above the type's maximum.
@@ -83171,21 +83264,28 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"addonSettings.getGlobalSettings": {
+	"addonSettings.getIntegrationFormSchema": {
 		capName: "addon-settings",
 		capScope: "system",
 		addonId: null,
 		access: "view",
 		role: "admin"
 	},
-	"addonSettings.getIntegrationFormSchema": {
+	"addonSettings.getScopedSettings": {
+		capName: "addon-settings",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"addonSettings.listScopedSettings": {
 		capName: "addon-settings",
 		capScope: "system",
 		addonId: null,
 		access: "view",
 		role: "admin"
 	},
-	"addonSettings.getIntegrationSettings": {
+	"addonSettings.readScopedValues": {
 		capName: "addon-settings",
 		capScope: "system",
 		addonId: null,
@@ -83206,7 +83306,7 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"addonSettings.updateGlobalSettings": {
+	"addonSettings.updateScopedSettings": {
 		capName: "addon-settings",
 		capScope: "system",
 		addonId: null,
@@ -85376,6 +85476,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"deviceManager.setAlias": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"deviceManager.setChildLayout": {
 		capName: "device-manager",
 		capScope: "system",
@@ -86664,13 +86771,6 @@ Object.freeze({
 		access: "delete",
 		role: "admin"
 	},
-	"llm.deleteProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"llm.generate": {
 		capName: "llm",
 		capScope: "system",
@@ -86734,20 +86834,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"llm.listProfileKinds": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"llm.listProfiles": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"llm.listRuntimeNodes": {
 		capName: "llm",
 		capScope: "system",
@@ -86755,13 +86841,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"llm.migrateRawSecrets": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"llm.resolveModelRef": {
 		capName: "llm",
 		capScope: "system",
@@ -86790,20 +86869,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"llm.testProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"llm.upsertProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"llmRuntime.appleAvailability": {
 		capName: "llm-runtime",
 		capScope: "system",
@@ -87308,13 +87373,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"meshNetwork.testConnection": {
-		capName: "mesh-network",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"meter.getStatus": {
 		capName: "meter",
 		capScope: "device",
@@ -87973,13 +88031,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.deleteTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"notificationOutput.discoverTargets": {
 		capName: "notification-output",
 		capScope: "system",
@@ -87987,13 +88038,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"notificationOutput.getTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"notificationOutput.listTargetKinds": {
 		capName: "notification-output",
 		capScope: "system",
@@ -88001,13 +88045,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"notificationOutput.listTargets": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"notificationOutput.probeTargetConfig": {
 		capName: "notification-output",
 		capScope: "system",
@@ -88022,13 +88059,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.setTargetEnabled": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"notificationOutput.testTarget": {
 		capName: "notification-output",
 		capScope: "system",
@@ -88036,13 +88066,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.upsertTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"notificationRules.activateAlarmProfile": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -88302,41 +88325,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"oidcConnections.connectionFormSchema": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"oidcConnections.createConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"oidcConnections.deleteConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
-	"oidcConnections.listConnections": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"oidcConnections.updateConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"osd.getStatus": {
 		capName: "osd",
 		capScope: "device",
@@ -91368,13 +91356,6 @@ Object.freeze({
 		access: "delete",
 		role: "admin"
 	},
-	"storage.deleteLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"storage.endDownload": {
 		capName: "storage",
 		capScope: "system",
@@ -91431,13 +91412,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"storage.listProviders": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"storage.read": {
 		capName: "storage",
 		capScope: "system",
@@ -91459,27 +91433,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"storage.testConfig": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"storage.testLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"storage.upsertLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"storage.write": {
 		capName: "storage",
 		capScope: "system",
@@ -92257,27 +92210,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"terminalSession.createInstance": {
-		capName: "terminal-session",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"terminalSession.deleteInstance": {
-		capName: "terminal-session",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
-	"terminalSession.listInstances": {
-		capName: "terminal-session",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"terminalSession.listLegacyCameras": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -92320,20 +92252,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"terminalSession.setInstanceEnabled": {
-		capName: "terminal-session",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"terminalSession.updateInstance": {
-		capName: "terminal-session",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -92348,6 +92266,13 @@ Object.freeze({
 		access: "create",
 		role: "viewer"
 	},
+	"timedRun.getOptions": {
+		capName: "timed-run",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
 	"timedRun.getStatus": {
 		capName: "timed-run",
 		capScope: "device",
@@ -92362,6 +92287,13 @@ Object.freeze({
 		access: "create",
 		role: "viewer"
 	},
+	"timedRun.setSettings": {
+		capName: "timed-run",
+		capScope: "device",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"toast.onToast": {
 		capName: "toast",
 		capScope: "system",
@@ -93292,6 +93224,7 @@ function offered(received) {
 	};
 }
 offered(HA_AS), withheld(HOMEKIT_REASON), withheld(ALEXA_REASON), withheld(GOOGLE_REASON), withheld(MATTER_REASON);
+string().min(1).max(4096);
 Object.freeze({
 	"accessories.getStatus": [{
 		name: "deviceId",
@@ -93975,6 +93908,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.setAlias": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceManager.setChildLayout": [{
 		name: "deviceId",
 		form: "single",
@@ -96039,6 +95977,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"timedRun.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"timedRun.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -96049,6 +95992,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"timedRun.setSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"update.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -96911,6 +96859,7 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
+	[...RULE_TEXT],
 	[...RULE_BODY_ONLY],
 	[...RULE_TEXT],
 	([...RULE_TEXT], [...DEVICE_EVENTS]),
@@ -99278,7 +99227,13 @@ function buildEnpalInstances(records, deps) {
 			},
 			instanceMode: "multiple",
 			kind: "server",
-			canTest: false
+			canTest: false,
+			kinds: [{
+				id: "connection",
+				label: "Enpal",
+				functionCap: "device-provider",
+				role: "devices"
+			}]
 		},
 		formSchema: () => buildConnectionFormSchema(),
 		initialBody: (name) => ({ name }),