@camstack/addon-provider-homeassistant 1.2.647 → 1.2.649

package/dist/{ha-broker-source-BFFi4NDH.js → ha-broker-source-CE3nHkyW.js}

@@ -5972,7 +5972,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-B-vp7x15.mjs
+//#region ../types/dist/sleep-CdJHPm-k.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6089,7 +6089,7 @@ function isKeychainStoredField(field) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$6(value) {
+function isRecord$7(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -6100,12 +6100,12 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$6(value)) return false;
+	if (!isRecord$7(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 function isSecretClear(value) {
-	return isRecord$6(value) && value["$secretClear"] === true;
+	return isRecord$7(value) && value["$secretClear"] === true;
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -6488,6 +6488,53 @@ function emitReadiness(bus, params) {
 		ts
 	}));
 }
+/** Why a catalogue entry is not a runnable body of its declared kind. */
+var AddonMigrationDefinitionError = class extends Error {
+	id;
+	constructor(id, message) {
+		super(`${id}: ${message}`);
+		this.id = id;
+		this.name = "AddonMigrationDefinitionError";
+	}
+};
+/**
+* Bind a catalogue to the addon's ports. Throws {@link AddonMigrationDefinitionError} when
+* an entry's `bodyKind` does not match the body it carries, or is `sql` (a hub-only
+* body). A throwing body never escapes `execute`: it is reported as a failed result.
+*/
+function defineAddonMigrations(catalogue, ports) {
+	return catalogue.map((entry) => {
+		const { meta } = entry;
+		if ("plan" in entry) {
+			if (meta.bodyKind !== "plan") throw new AddonMigrationDefinitionError(meta.id, `carries a plan body but declares "${meta.bodyKind}"`);
+			return {
+				meta,
+				execute: () => guarded(async () => ({
+					kind: "plan",
+					plan: await entry.plan(ports)
+				}))
+			};
+		}
+		if (meta.bodyKind !== "procedure") throw new AddonMigrationDefinitionError(meta.id, `carries a procedure body but declares "${meta.bodyKind}"`);
+		return {
+			meta,
+			execute: () => guarded(async () => ({
+				kind: "procedure",
+				result: await entry.procedure(ports)
+			}))
+		};
+	});
+}
+async function guarded(work) {
+	try {
+		return await work();
+	} catch (err) {
+		return {
+			kind: "failed",
+			error: errMsg(err)
+		};
+	}
+}
 var NOT_RUN = {
 	declared: false,
 	snapshot: null,
@@ -6811,7 +6858,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$5(value) {
+function isRecord$6(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -6824,7 +6871,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$5(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$6(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -6879,7 +6926,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$5) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$6) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -6895,7 +6942,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$5(row)) {
+		if (!isRecord$6(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -6920,7 +6967,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$5(incoming)) {
+			if (!isRecord$6(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -6928,7 +6975,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$5(stored) ? stored : {};
+			const storedObj = isRecord$6(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -7051,7 +7098,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$5(v)) {
+		if (isRecord$6(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -7083,7 +7130,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord$4(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -7112,7 +7159,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord$4(item) && isRecord$4(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$5(item) && isRecord$5(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -7123,7 +7170,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord$4(value) && isRecord$4(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$5(value) && isRecord$5(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -7131,7 +7178,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord$4(incoming) || !isRecord$4(stored)) return incoming;
+	if (!isRecord$5(incoming) || !isRecord$5(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -7162,7 +7209,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord$4(a) && isRecord$4(b)) {
+	if (isRecord$5(a) && isRecord$5(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -7186,7 +7233,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord$4(value)) return null;
+	if (!isRecord$5(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -7805,6 +7852,44 @@ var BaseAddon = class {
 		return null;
 	}
 	/**
+	* D986 scoped settings: the form shape of the CLUSTER-wide settings one capability this addon
+	* provides owns, or `null` when it has none. `cap` is a capability name the addon's manifest
+	* declares. Stored as `addon-settings` rows `<addonId>.<field>`. The keys of this schema, of
+	* {@link nodeSettingsSchema} and of {@link deviceDefaultsSchema} are disjoint, and a key never
+	* contains `@` (guard `check-scoped-settings-declared`). SHAPE only: values are read by scope.
+	*/
+	async clusterSettingsSchema(_cap) {
+		return null;
+	}
+	/**
+	* D986: the form shape of the settings one capability owns PER NODE, or `null`. Stored as
+	* `addon-settings` rows `<addonId>.<field>@<nodeId>` carrying `nodeId` in the row data, so a
+	* forgotten node's rows go in one central delete.
+	*/
+	async nodeSettingsSchema(_cap) {
+		return null;
+	}
+	/**
+	* D986: the form shape of the FLEET DEFAULTS of the per-device settings one capability owns,
+	* or `null`. Stored as `addon-settings` rows `<addonId>.<field>`; a device resolves its value
+	* as device row, then this default, then the schema default (`resolveDeviceSettings`).
+	*/
+	async deviceDefaultsSchema(_cap) {
+		return null;
+	}
+	/**
+	* The host's read of the scoped declarations: the schema one capability declares for `scope`,
+	* or `null`. Beside {@link getIntegrationFormSchema}, the same shape: the hook is protected, the
+	* host asks this method.
+	*/
+	async getScopedSettingsSchema(scope, cap) {
+		switch (scope) {
+			case "cluster": return this.clusterSettingsSchema(cap);
+			case "node": return this.nodeSettingsSchema(cap);
+			case "device-defaults": return this.deviceDefaultsSchema(cap);
+		}
+	}
+	/**
 	* What the create wizard and the integration edit page render for one instance: the addon's
 	* per-instance schema when it declares one, else its global schema (what they always showed).
 	*/
@@ -8598,47 +8683,6 @@ function normalizeAddonInitResult(result) {
 	if (Array.isArray(result)) return { providers: result };
 	return result;
 }
-/**
-* The share-view scope kinds a share-link token can carry. The hub mints
-* and validates them (`ShareViewGrantSchema` builds its
-* enum from this list); a data plane names the kinds it ACCEPTS in `share`.
-*/
-var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
-/** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
-var PeerBytesTicketSchema = object({
-	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
-	url: string().min(1),
-	/**
-	* The HOST node this URL means something on — the hub or a named agent,
-	* never a runner. {@link AddonPeerBytes.open} compares it to its own and
-	* refuses `cross-node` by name when they differ, without dialling.
-	*/
-	hostNodeId: string().min(1),
-	expiresAtMs: number().int().nonnegative(),
-	/**
-	* What the producer DECLARED the body to be, when it knows — `null` when it
-	* does not. Never `0` for unknown (D393): a consumer sizing a bound off this
-	* must be able to tell "the producer did not say" from "the body is empty".
-	*/
-	declaredBytes: number().int().nonnegative().nullable()
-});
-/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
-/** The files a kind may live in. `history` is device-history's (D850), never records. */
-var RECORD_DATABASES = ["settings", "events"];
-/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
-var RECORD_CLASSES = [
-	"config",
-	"ledger",
-	"audit",
-	"mirror",
-	"ephemeral"
-];
-var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
-var RECORD_MAX_DATA_BYTES = 1024 * 1024;
-var RECORD_BATCH_MAX = 1e3;
-var RECORD_QUERY_MAX = 1e3;
-/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
-var RECORD_SETTINGS_MAX_ROWS = 5e4;
 var PREFIX = "records/";
 /** The base of every records failure. `detail` is the human part of the message. */
 var RecordsError = class extends Error {
@@ -8671,6 +8715,83 @@ var DeclarationRefusedError = class extends RecordsError {
 		this.name = "DeclarationRefusedError";
 	}
 };
+/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
+/** The files a kind may live in. `history` is device-history's (D850), never records. */
+var RECORD_DATABASES = ["settings", "events"];
+/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
+var RECORD_CLASSES = [
+	"config",
+	"ledger",
+	"audit",
+	"mirror",
+	"ephemeral"
+];
+var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
+var RECORD_MAX_DATA_BYTES = 1024 * 1024;
+var RECORD_BATCH_MAX = 1e3;
+var RECORD_QUERY_MAX = 1e3;
+/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
+var RECORD_SETTINGS_MAX_ROWS = 5e4;
+/**
+* Secret fields of a record, addressed the way a Zod schema declares them
+* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
+* (`auth.accessToken`, `headers[].value`).
+*
+* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
+* `{ headers: 'name' }`), never by index, so reordering a list keeps every
+* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
+* leaf names its element: `headers[X-Api].value`.
+*
+* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
+*/
+/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
+function parseSecretPath(path) {
+	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
+	return path.split(".").map((raw) => {
+		const each = raw.endsWith("[]");
+		const key = each ? raw.slice(0, -2) : raw;
+		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
+		return {
+			key,
+			each
+		};
+	});
+}
+/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
+function secretArrayPrefixes(path) {
+	const segments = parseSecretPath(path);
+	const prefixes = [];
+	const walked = [];
+	for (const segment of segments) {
+		walked.push(segment.key);
+		if (segment.each) prefixes.push(walked.join("."));
+	}
+	return prefixes;
+}
+/**
+* The share-view scope kinds a share-link token can carry. The hub mints
+* and validates them (`ShareViewGrantSchema` builds its
+* enum from this list); a data plane names the kinds it ACCEPTS in `share`.
+*/
+var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
+/** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
+var PeerBytesTicketSchema = object({
+	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
+	url: string().min(1),
+	/**
+	* The HOST node this URL means something on — the hub or a named agent,
+	* never a runner. {@link AddonPeerBytes.open} compares it to its own and
+	* refuses `cross-node` by name when they differ, without dialling.
+	*/
+	hostNodeId: string().min(1),
+	expiresAtMs: number().int().nonnegative(),
+	/**
+	* What the producer DECLARED the body to be, when it knows — `null` when it
+	* does not. Never `0` for unknown (D393): a consumer sizing a bound off this
+	* must be able to tell "the producer did not say" from "the body is empty".
+	*/
+	declaredBytes: number().int().nonnegative().nullable()
+});
 function defOf(schema) {
 	const zodBag = Reflect.get(schema, "_zod");
 	if (typeof zodBag !== "object" || zodBag === null) return {};
@@ -8739,42 +8860,6 @@ function collectZodSecretPaths(schema, prefix = "") {
 	return [...new Set(paths)];
 }
 /**
-* Secret fields of a record, addressed the way a Zod schema declares them
-* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
-* (`auth.accessToken`, `headers[].value`).
-*
-* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
-* `{ headers: 'name' }`), never by index, so reordering a list keeps every
-* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
-* leaf names its element: `headers[X-Api].value`.
-*
-* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
-*/
-/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
-function parseSecretPath(path) {
-	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
-	return path.split(".").map((raw) => {
-		const each = raw.endsWith("[]");
-		const key = each ? raw.slice(0, -2) : raw;
-		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
-		return {
-			key,
-			each
-		};
-	});
-}
-/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
-function secretArrayPrefixes(path) {
-	const segments = parseSecretPath(path);
-	const prefixes = [];
-	const walked = [];
-	for (const segment of segments) {
-		walked.push(segment.key);
-		if (segment.each) prefixes.push(walked.join("."));
-	}
-	return prefixes;
-}
-/**
 * Record kinds (D881): the declaration an addon makes of one kind of fact, the
 * Zod row schema that describes it, and the helper that turns the two into the
 * JSON the engine stores.
@@ -9739,6 +9824,7 @@ var CAP_NAMES = Object.freeze([
 	"humidity-sensor",
 	"image",
 	"image-settings",
+	"integration-instances",
 	"integrations",
 	"intercom",
 	"ir-transmitter",
@@ -11672,7 +11758,7 @@ object({
 	params: record(string(), union([string(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/composition-kKKOdFIG.mjs
+//#region ../types/dist/composition-BDUoQsw9.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -14124,6 +14210,16 @@ var MigrationPlanSchema = object({ edits: array(discriminatedUnion("op", [
 		precondition: PreconditionSchema
 	})
 ])) });
+/** `JSON.stringify` with object keys sorted, so equal values spell the same. */
+function canonicalJson(value) {
+	if (Array.isArray(value)) return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
+	if (typeof value === "object" && value !== null) return `{${Object.entries(value).filter(([, item]) => item !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`).join(",")}}`;
+	return JSON.stringify(value) ?? "null";
+}
+/** The precondition string for a value a plan read (`null` when it read nothing). */
+function preconditionOf(value) {
+	return canonicalJson(value ?? null);
+}
 /**
 * What a `procedure` body reports. `already-done` means the rerun observed the
 * work finished (a crash between the work and the ledger row, or a manual fix)
@@ -16072,8 +16168,18 @@ var LogChannelDescriptorSchema = object({
 	* the operator narrows to one camera, sees nothing, and concludes the code
 	* path was never taken.
 	*/
-	perDevice: boolean()
-});
+	perDevice: boolean(),
+	/**
+	* What the channel is FOR, so the UI can list the channels an addon offers.
+	*
+	* - `diagnostic` (the default): a per-component diagnostic armed from the
+	*   Levels page, emitted at its declared level.
+	* - `debug`: a `debug.<channel>` dump watched live for a short window
+	*   (`ctx.debug`). Always per-device, and its lines are denied by the log
+	*   ring unless somebody is watching that device.
+	*/
+	kind: _enum(["diagnostic", "debug"]).default("diagnostic")
+}).refine((d) => d.kind !== "debug" || d.name.startsWith("debug.") && d.perDevice, { message: "a debug channel is named debug.<channel> and is per-device" });
 /**
 * An armed window over one channel, as the document hands it to a mirror.
 *
@@ -21289,6 +21395,7 @@ var SYSTEM_CAP_VOCABULARY = {
 	"load-contribution": system(INTERNAL),
 	"local-network": system(NETWORK),
 	"log-channels": system(INTERNAL),
+	"integration-instances": system(INTERNAL),
 	"log-destination": system(INTERNAL),
 	"login-method": system(IDENTITY),
 	"mesh-network": system(NETWORK),
@@ -43589,7 +43696,7 @@ var TargetKindCapsSchema = object({
 * the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough$3 = unknown();
+var ConfigSchemaPassthrough$4 = unknown();
 var TargetKindSchema = object({
 	kind: string(),
 	label: string(),
@@ -43626,7 +43733,7 @@ var TargetKindSchema = object({
 	* its raster path, which is the safe default for an unknown image.
 	*/
 	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough$3,
+	configSchema: ConfigSchemaPassthrough$4,
 	/**
 	* The config keys that decide WHERE this kind's secrets are sent (server,
 	* base URL, instance, chat, recipient). A save that changes any of them
@@ -51615,6 +51722,45 @@ var deviceProviderCapability = {
 	}
 };
 /**
+* What the passive listener of `local-network` saw on the wire, before any
+* provider classified it. Device-manager turns an observation into the hits
+* of the providers whose declared discovery modes it matches.
+*/
+var DiscoveryObservationSchema = discriminatedUnion("kind", [object({
+	kind: literal("mdns"),
+	/** Normalised DNS-SD service type, e.g. `_esphomelib._tcp`. */
+	serviceType: string(),
+	instance: string(),
+	host: string(),
+	/** The A record address when the announcement carried one. */
+	address: string().nullable(),
+	port: number().int(),
+	txt: record(string(), string())
+}), object({
+	kind: literal("ssdp"),
+	/** Sender address of the datagram. */
+	host: string(),
+	port: number().int(),
+	/** `NT` of a NOTIFY, `ST` of a search response. */
+	target: string(),
+	headers: record(string(), string())
+})]);
+object({
+	addonId: string(),
+	candidate: DiscoveryCandidateSchema,
+	firstSeenAt: number(),
+	lastSeenAt: number(),
+	dismissed: boolean()
+});
+var DiscoveryProposalSchema = object({
+	id: string(),
+	addonId: string(),
+	candidate: DiscoveryCandidateSchema,
+	firstSeenAt: number(),
+	lastSeenAt: number(),
+	dismissed: boolean()
+});
+/**
 * Device Manager capability — hub-side singleton that unifies device persistence,
 * live registry access, and all management operations into a single tRPC surface.
 *
@@ -52343,6 +52489,19 @@ method(object({
 }), object({ candidates: array(DiscoveryCandidateSchema).readonly() }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({}), object({ proposals: array(DiscoveryProposalSchema).readonly() }), { auth: "admin" }), method(object({ id: string() }), object({ dismissed: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ observations: array(DiscoveryObservationSchema).max(512) }), object({ proposed: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({
+	providers: number().int(),
+	proposed: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 12e4
 }), method(object({ addonId: string() }), object({ deviceType: _enum(DeviceType).nullable() }), { auth: "admin" }), method(object({ addonId: string() }), unknown(), { auth: "admin" }), method(object({
 	deviceId: number(),
 	key: string(),
@@ -55582,9 +55741,15 @@ var AvailableIntegrationTypeSchema = object({
 	* branch on CAP — never on addon name. `device-adoption` integrations
 	* (Home Assistant, …) route through the broker step (Approach A);
 	* `device-provider` integrations (Reolink/ONVIF) keep the
-	* legacy config → discovery flow.
+	* legacy config → discovery flow. `connection` is an addon that only holds a
+	* connection as typed records (`integration-instances`, D985): no devices,
+	* no discovery.
 	*/
-	kind: _enum(["device-adoption", "device-provider"]),
+	kind: _enum([
+		"device-adoption",
+		"device-provider",
+		"connection"
+	]),
 	/**
 	* For `device-adoption` addons: the broker kind to create/link
 	* (e.g. `home-assistant`), declared in the addon manifest. `null` for
@@ -55697,6 +55862,67 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 	auth: "admin"
 });
 /**
+* `integration-instances` - the connection of an addon that holds ONE or SEVERAL
+* (an account, a relay, a destination) as typed records, shown on the
+* Integrations page like every other integration (D985, D986).
+*
+* A collection of providers: each addon that holds connections registers one
+* and the hub aggregator (`integrations.*`) reaches a provider with the pinned
+* `addonId`. It is internal and has no route: the operator-facing surface is
+* the `integrations` cap, which keeps ONE list.
+*
+* Identity: the instance id IS the `integrations` registry id (`int_NNNN`,
+* immutable, already in the `/integrations/<id>` URL). A second operator-chosen
+* slug would be a second authority over one identity (D224). `name` is the
+* editable label.
+*
+* Secrets: every field the instance kind marks `.meta({ secret: true })` reaches
+* the form as a `SecretFieldView`, never text (D789). A patch value omitted, `''`
+* or the redaction token KEEPS the stored secret; `{ $secretClear: true }`
+* clears it.
+*/
+var ConfigSchemaPassthrough$3 = custom();
+var IntegrationInstanceIdSchema = string().min(1);
+var IntegrationInstanceDescriptionSchema = object({
+	/** `single`: at most one instance can exist (Loki). `multiple`: an account each. */
+	instanceMode: _enum(["single", "multiple"]),
+	/** What the instance is, for the UI (`destination`, `relay`, `account`). */
+	kind: string(),
+	/** True when `testInstance` really probes the remote. */
+	canTest: boolean()
+});
+var IntegrationInstanceStatusSchema = object({
+	state: _enum([
+		"ok",
+		"off",
+		"error",
+		"unknown"
+	]),
+	detail: string().optional()
+});
+var IntegrationInstanceSchema = object({
+	id: IntegrationInstanceIdSchema,
+	name: string(),
+	/** The addon's own rule (an URL is present, a client id is present...). */
+	configured: boolean(),
+	/** Values for the instance form; a secret is a `SecretFieldView`, never text. */
+	formValues: record(string(), unknown()),
+	status: IntegrationInstanceStatusSchema.optional()
+});
+var IntegrationInstancePatchSchema = object({
+	id: IntegrationInstanceIdSchema,
+	name: string().min(1).optional(),
+	/** Omitted / '' / redaction token keeps a secret; `{ $secretClear: true }` clears it. */
+	values: record(string(), unknown())
+});
+method(_void(), IntegrationInstanceDescriptionSchema), method(object({ id: IntegrationInstanceIdSchema.nullable() }), ConfigSchemaPassthrough$3), method(_void(), array(IntegrationInstanceSchema).readonly()), method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable()), method(object({
+	id: IntegrationInstanceIdSchema,
+	name: string().min(1)
+}), object({ id: string() }), { kind: "mutation" }), method(IntegrationInstancePatchSchema, object({ ok: literal(true) }), { kind: "mutation" }), method(object({ id: IntegrationInstanceIdSchema }), object({ ok: literal(true) }), { kind: "mutation" }), optionalMethod(object({
+	id: IntegrationInstanceIdSchema.nullable(),
+	values: record(string(), unknown())
+}), TestConnectionResultSchema$1, { kind: "mutation" });
+/**
 * Two-way audio / talk-back cap. Clients open a WebRTC audio-only
 * session (server-initiated offer pattern, identical to the main
 * video WebRTC flow) and the browser captures the mic; the server
@@ -76690,6 +76916,40 @@ var LoggingSettingsStateSchema = object({
 	opsLogRetentionDays: number().int().min(0),
 	persisted: boolean()
 });
+/**
+* Debug WATCH — a short, per-device window over `debug.<channel>` lines.
+*
+* `start` opens (or re-arms) a 10 minute window; `rearm` extends a LIVE one
+* and never revives a lapsed one; `stop` closes it; `list` only reads. No
+* chain of re-arms outlives 60 minutes from the first start. The hub holds the
+* watches in memory and pushes the interest to every node, so a watch lapses
+* by itself and survives nothing — a restart is a stop.
+*/
+var DebugWatchInputSchema = object({
+	action: _enum([
+		"list",
+		"start",
+		"rearm",
+		"stop"
+	]),
+	/** Full channel names, `debug.<channel>`, each declared with `kind: 'debug'`. */
+	channels: array(string().min(1)).readonly().default([]),
+	/** Numeric device ids. Required (non-empty) for `start`. */
+	deviceIds: array(number().int()).readonly().default([])
+});
+var DebugWatchStateSchema = object({
+	channel: string(),
+	deviceIds: array(number().int()).readonly(),
+	startedAtMs: number(),
+	untilMs: number(),
+	capAtMs: number()
+});
+var DebugWatchResultSchema = object({
+	nowMs: number(),
+	watches: array(DebugWatchStateSchema).readonly(),
+	/** Channels a `rearm` found already lapsed: nothing was revived. */
+	lapsed: array(string()).readonly()
+});
 method(_void(), SystemInfoSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
 	kind: "mutation",
 	auth: "admin"
@@ -76705,6 +76965,9 @@ method(_void(), SystemInfoSchema), method(_void(), HealthStatusSchema), method(_
 }), method(_void(), RequestCensusStatusSchema, { auth: "admin" }), method(_void(), array(ReportedLoadContributionSchema).readonly(), { auth: "admin" }), method(_void(), array(ReportedFailureContributionSchema).readonly(), { auth: "admin" }), method(GetLoggingSettingsInputSchema, LoggingSettingsStateSchema, { auth: "admin" }), method(SetLoggingSettingsInputSchema, LoggingSettingsStateSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(DebugWatchInputSchema, DebugWatchResultSchema, {
+	kind: "mutation",
+	auth: "admin"
 });
 /**
 * Tamper / case-open detection sensor. Drives Home Assistant
@@ -83814,6 +84077,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"deviceManager.dismissDiscoveryProposal": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"deviceManager.enable": {
 		capName: "device-manager",
 		capScope: "system",
@@ -83996,6 +84266,13 @@ Object.freeze({
 		access: "view",
 		role: "viewer"
 	},
+	"deviceManager.listDiscoveryProposals": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"deviceManager.listLocationDescriptions": {
 		capName: "device-manager",
 		capScope: "system",
@@ -84150,6 +84427,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"deviceManager.reportDiscoveryObservations": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"deviceManager.runDeviceAction": {
 		capName: "device-manager",
 		capScope: "system",
@@ -84157,6 +84441,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"deviceManager.runDiscoverySweep": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"deviceManager.setChildLayout": {
 		capName: "device-manager",
 		capScope: "system",
@@ -85088,6 +85379,62 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"integrationInstances.createInstance": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"integrationInstances.deleteInstance": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
+	"integrationInstances.describe": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"integrationInstances.getInstance": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"integrationInstances.instanceFormSchema": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"integrationInstances.listInstances": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"integrationInstances.testInstance": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"integrationInstances.updateInstance": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"integrations.create": {
 		capName: "integrations",
 		capScope: "system",
@@ -90744,6 +91091,13 @@ Object.freeze({
 		access: "create",
 		role: "viewer"
 	},
+	"system.debugWatch": {
+		capName: "system",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"system.detectSiteLocation": {
 		capName: "system",
 		capScope: "system",
@@ -94673,6 +95027,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"system.debugWatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
 	"tamper.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -97157,6 +97516,12 @@ Object.defineProperty(exports, "createEvent", {
 		return createEvent;
 	}
 });
+Object.defineProperty(exports, "defineAddonMigrations", {
+	enumerable: true,
+	get: function() {
+		return defineAddonMigrations;
+	}
+});
 Object.defineProperty(exports, "defineEntryKind", {
 	enumerable: true,
 	get: function() {
@@ -97361,6 +97726,12 @@ Object.defineProperty(exports, "powerMeterCapability", {
 		return powerMeterCapability;
 	}
 });
+Object.defineProperty(exports, "preconditionOf", {
+	enumerable: true,
+	get: function() {
+		return preconditionOf;
+	}
+});
 Object.defineProperty(exports, "prepareNotification", {
 	enumerable: true,
 	get: function() {