@camstack/addon-provider-homeassistant 1.2.654 → 1.2.656

package/dist/{ha-instance-settings-g5pwb3Fi.mjs → ha-instance-settings-EQ5Ey3Q-.mjs}

@@ -5980,7 +5980,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BKClVk0K.mjs
+//#region ../types/dist/sleep-BaWhXZFm.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6075,6 +6075,16 @@ var AddonMigrationsBlockedError = class extends Error {
 		this.migrationIds = migrationIds;
 	}
 };
+/**
+* The value a redacted secret is replaced with on every read surface.
+*
+* It is also the WRITE-BACK token: an `upsertLocation` that sends this value
+* back for a key means "keep what is stored", which is what lets an operator
+* rename a location without retyping its password. A literal an operator could
+* plausibly choose as a real password would turn that convenience into a way
+* to lock yourself out, hence the sentinel shape.
+*/
+var REDACTED_SECRET = "__camstack_redacted__";
 /** Is this field's stored value a credential? */
 function isSecretConfigField(field) {
 	if (field.type === "password") return true;
@@ -6128,9 +6138,16 @@ function isSecretMarker(value) {
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
+/** Anything carrying a `$secret` key — a stored marker or a UI view of one. */
+function isSecretMarkerLike(value) {
+	return isRecord$7(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
+}
 function isSecretClear(value) {
 	return isRecord$7(value) && value["$secretClear"] === true;
 }
+function isSecretFieldView(value) {
+	return isRecord$7(value) && value["set"] === true && isSecretMarkerLike(value);
+}
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
 * plaintext becomes "set (inline)", nothing becomes `null`. A value never
@@ -6780,11 +6797,36 @@ function projectStore(store, perNodeKeys, nodeId) {
 	}
 	return out;
 }
+/**
+* The address of one keychain value: `secret://<owner>/<scope>/<fieldPath>`.
+*
+* A ref is DETERMINISTIC from where the value lives — the owner addon, the
+* scope (global, one node, one device, one integration, one row of a business
+* collection) and the field path inside that scope — so saving the same field
+* twice updates the same ref, and the ref itself says which settings blob
+* points at it. It is also the AAD of the value's ciphertext: a ciphertext
+* copied onto another ref does not decrypt.
+*
+* Array items are addressed by ITEM ID, never by index
+* (`providers[authentik].clientSecret`), so reordering a list keeps every ref.
+*
+* Pure and browser-safe: no node builtins, no I/O.
+*/
+/** The URI scheme of every keychain ref. */
+var SECRET_REF_SCHEME = "secret://";
 var GLOBAL_SCOPE = { kind: "global" };
 /** The scope every addon-wide (not per-node, not per-device) setting lives in. */
 function globalSecretScope() {
 	return GLOBAL_SCOPE;
 }
+/**
+* An addon id as a ref owner. A hub in-process builtin's context id is
+* `addon:<id>`; the owner of its secrets is `<id>`, exactly as for the same
+* addon running forked.
+*/
+function normalizeSecretOwner(addonId) {
+	return addonId.startsWith("addon:") ? addonId.slice(6) : addonId;
+}
 function encodeSegment(value) {
 	return encodeURIComponent(value);
 }
@@ -6795,6 +6837,16 @@ function decodeSegment(value) {
 		return null;
 	}
 }
+/** The scope as it appears inside a ref (`global`, `node/<id>`, …). */
+function formatSecretScope(scope) {
+	switch (scope.kind) {
+		case "global": return "global";
+		case "node": return `node/${encodeSegment(scope.nodeId)}`;
+		case "device": return `device/${scope.deviceId}`;
+		case "integration": return `integration/${encodeSegment(scope.integrationId)}`;
+		case "row": return `row/${encodeSegment(scope.collection)}/${encodeSegment(scope.rowId)}`;
+	}
+}
 /**
 * The field path of a value inside an array item, addressed by the item's id:
 * `arrayItemFieldPath('providers', 'authentik', 'clientSecret')` →
@@ -6803,6 +6855,13 @@ function decodeSegment(value) {
 function arrayItemFieldPath(arrayKey, itemId, fieldKey) {
 	return `${arrayKey}[${encodeSegment(itemId)}].${fieldKey}`;
 }
+/** Build a ref. Throws on an empty owner or field path — both are bugs. */
+function buildSecretRef(parts) {
+	const owner = normalizeSecretOwner(parts.owner);
+	if (owner.length === 0) throw new Error("buildSecretRef: owner is empty");
+	if (parts.fieldPath.length === 0) throw new Error("buildSecretRef: fieldPath is empty");
+	return `${SECRET_REF_SCHEME}${encodeSegment(owner)}/${formatSecretScope(parts.scope)}/${parts.fieldPath}`;
+}
 function parseScope(segments) {
 	switch (segments[0]) {
 		case "global": return {
@@ -8068,6 +8127,10 @@ var BaseAddon = class {
 		const stored = keychain ? await this.readAddonStoreWithRetry() : {};
 		const patch = {};
 		for (const key of keys) {
+			if (tree.get(key)?.kind === "array") {
+				patch[key] = [];
+				continue;
+			}
 			const keychainStored = tree.has(key) || collectSecretMarkerRefs(stored[key]).length > 0;
 			patch[key] = keychain && keychainStored ? SECRET_CLEAR : "";
 		}
@@ -8719,6 +8782,13 @@ var RecordsError = class extends Error {
 		this.detail = detail;
 	}
 };
+/** A write guarded by `ifRev` found another revision (or an existing row for `ifRev: 0`). */
+var RevConflictError = class extends RecordsError {
+	constructor(detail) {
+		super("rev-conflict", detail);
+		this.name = "RevConflictError";
+	}
+};
 /** The keychain could not store or serve a value: explicit, never an empty string. */
 var RecordSecretUnavailableError = class extends RecordsError {
 	constructor(detail) {
@@ -8756,11 +8826,17 @@ var RECORD_BATCH_MAX = 1e3;
 var RECORD_QUERY_MAX = 1e3;
 /** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
 var RECORD_SETTINGS_MAX_ROWS = 5e4;
+/** The `Column`-free proof prefix: a ref collection for a kind's secret fields. */
+var RECORD_SECRET_COLLECTION_PREFIX = "records:";
 /**
 * Secret fields of a record, addressed the way a Zod schema declares them
 * (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
 * (`auth.accessToken`, `headers[].value`).
 *
+* `{}` after a key means "each value of this map" (`applianceSecrets{}`): the map's own key
+* names the value (`applianceSecrets{fridge}`), so no id key is declared and a body that drops a
+* key releases exactly that key's secret.
+*
 * Array elements are matched by a DECLARED id key (`secretArrayKeys`:
 * `{ headers: 'name' }`), never by index, so reordering a list keeps every
 * keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
@@ -8773,11 +8849,13 @@ function parseSecretPath(path) {
 	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
 	return path.split(".").map((raw) => {
 		const each = raw.endsWith("[]");
-		const key = each ? raw.slice(0, -2) : raw;
+		const map = raw.endsWith("{}");
+		const key = each || map ? raw.slice(0, -2) : raw;
 		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
 		return {
 			key,
-			each
+			each,
+			map
 		};
 	});
 }
@@ -8792,6 +8870,128 @@ function secretArrayPrefixes(path) {
 	}
 	return prefixes;
 }
+function isRecord$4(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function elementId(element, idKey, declared, prefix) {
+	const id = isRecord$4(element) ? element[idKey] : void 0;
+	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
+	return id;
+}
+/**
+* Visit every secret leaf PRESENT in `data` (an absent branch has nothing to
+* visit). `replace` returns the new leaf value, or {@link REMOVE_LEAF}; the
+* result is a new body, `data` is untouched.
+*/
+var REMOVE_LEAF = Symbol("remove-leaf");
+function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
+	if (!isRecord$4(node)) return node;
+	const segment = segments[index];
+	if (segment === void 0) return node;
+	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
+	const child = node[segment.key];
+	const keys = [...walkedKeys, segment.key];
+	const last = index === segments.length - 1;
+	if (segment.each) {
+		if (!Array.isArray(child)) return node;
+		const prefix = keys.join(".");
+		const idKey = arrayKeys[prefix];
+		if (idKey === void 0) throw new InvalidRecordError(`"${declared}": no id key declared for the array "${prefix}"`);
+		const mapped = child.map((element) => {
+			const id = elementId(element, idKey, declared, prefix);
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}[${encodeURIComponent(id)}]`;
+			return last ? element : mapAt(element, segments, index + 1, keys, concrete, declared, arrayKeys, visit);
+		});
+		return {
+			...node,
+			[segment.key]: mapped
+		};
+	}
+	if (segment.map) {
+		if (!isRecord$4(child)) return node;
+		const kept = Object.entries(child).map(([mapKey, value]) => {
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}{${encodeURIComponent(mapKey)}}`;
+			if (!last) return [mapKey, mapAt(value, segments, index + 1, keys, concrete, declared, arrayKeys, visit)];
+			return [mapKey, visit({
+				declared,
+				concrete,
+				value
+			})];
+		}).filter(([, value]) => value !== REMOVE_LEAF);
+		return {
+			...node,
+			[segment.key]: Object.fromEntries(kept)
+		};
+	}
+	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
+	if (last) {
+		const replacement = visit({
+			declared,
+			concrete,
+			value: child
+		});
+		if (replacement === REMOVE_LEAF) return Object.fromEntries(Object.entries(node).filter(([key]) => key !== segment.key));
+		return {
+			...node,
+			[segment.key]: replacement
+		};
+	}
+	return {
+		...node,
+		[segment.key]: mapAt(child, segments, index + 1, keys, concrete, declared, arrayKeys, visit)
+	};
+}
+/** Replace/remove every present secret leaf; returns a NEW body. */
+function mapSecretLeaves(data, paths, arrayKeys, visit) {
+	let current = data;
+	for (const declared of paths) current = mapAt(current, parseSecretPath(declared), 0, [], "", declared, arrayKeys, visit);
+	return current;
+}
+/**
+* The keychain collection name a kind's secrets live under. Prefixed so a
+* record's refs never collide with the refs a legacy collection of the same name
+* already holds during an adoption.
+*/
+function recordSecretCollection(kind) {
+	return `${RECORD_SECRET_COLLECTION_PREFIX}${kind}`;
+}
+/** The ONE ref a row's secret field may carry: the engine and the facade both build it here. */
+function recordSecretRef(owner, kind, rowId, concretePath) {
+	return buildSecretRef({
+		owner,
+		scope: {
+			kind: "row",
+			collection: recordSecretCollection(kind),
+			rowId
+		},
+		fieldPath: concretePath
+	});
+}
+/**
+* A stored secret, as an admin read shows it: a VIEW naming the row's own
+* keychain ref (`set: true`), never the value and no longer the bare redaction
+* token. The form hands it to the secret field, which reveals the value by ref
+* through the audited `keychain-admin.reveal`; sent back untouched it keeps the
+* stored secret (the records door reads a view as KEEP).
+*
+* ONE implementation for the entries service and for every addon that serves
+* its own instances (`RecordIntegrationInstances`).
+*/
+function isRecord$3(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function secretViewsOf(owner, kind, id, decl, data) {
+	if (decl.secretPaths.length === 0) return data;
+	const shown = mapSecretLeaves(data, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
+		if (leaf.value !== "__camstack_redacted__") return leaf.value;
+		return {
+			$secret: recordSecretRef(owner, kind, id, leaf.concrete),
+			v: 1,
+			set: true
+		};
+	});
+	return isRecord$3(shown) ? shown : data;
+}
 /**
 * The share-view scope kinds a share-link token can carry. The hub mints
 * and validates them (`ShareViewGrantSchema` builds its
@@ -8864,7 +9064,8 @@ function isZodSecret(schema) {
 }
 /**
 * Every declared secret path in a config schema: dotted keys, `[]` for "each
-* element of this array" (`connection.password`, `rows[].token`). A declared
+* element of this array" (`connection.password`, `rows[].token`), `{}` for "each value of this
+* map" (`applianceSecrets{}`). A declared
 * object or array is reported as one path and not descended into — everything
 * under it is secret.
 */
@@ -8875,6 +9076,7 @@ function collectZodSecretPaths(schema, prefix = "") {
 		const def = defOf(layer);
 		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
 		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "record" && def.valueType) paths.push(...collectZodSecretPaths(def.valueType, `${prefix}{}`));
 		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
 		else if (def.type === "intersection") {
 			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
@@ -9014,7 +9216,7 @@ function defineRecordKinds(specs) {
 			retention: spec.retention,
 			deviceRemoval: spec.deviceRemoval,
 			maxDataBytes: spec.maxDataBytes,
-			secretPaths: [...secretPaths],
+			secretPaths: [...new Set([...secretPaths, ...spec.retiredSecretPaths ?? []])],
 			secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
 			transactFamily: spec.transactFamily,
 			entry: spec.entry === void 0 ? void 0 : {
@@ -9059,6 +9261,7 @@ function defineEntryKind(name, spec) {
 		...spec.database === void 0 ? {} : { database: spec.database },
 		...spec.indexes === void 0 ? {} : { indexes: spec.indexes },
 		...spec.secretArrayKeys === void 0 ? {} : { secretArrayKeys: spec.secretArrayKeys },
+		...spec.retiredSecretPaths === void 0 ? {} : { retiredSecretPaths: spec.retiredSecretPaths },
 		entry: {
 			title: spec.title,
 			...spec.nameField === void 0 ? {} : { nameField: spec.nameField }
@@ -11786,7 +11989,7 @@ object({
 	params: record(string(), union([string(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/composition-BodkvOV0.mjs
+//#region ../types/dist/composition-CRNwcFYY.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -12549,38 +12752,6 @@ function validateExpressionSource(src) {
 	return null;
 }
 /**
-* One power reading becomes a washer, dryer or dishwasher (D944 helper).
-*
-* Standby of the control board is under 5 W; a motor or a heater is far
-* above that, so 5 W is the line. A door lock or a short pump spike is not
-* a cycle, so running starts only after 30 s above the line.
-*
-* A wash, dry or dishwasher pause (soak, heat-wait, heater off between
-* bursts) lasts several minutes. Ending the cycle on the first dip would
-* report "finished" in the middle of the program, so the stop dwell is
-* 10 minutes on every type. The number is stored per type so one machine
-* can move later without moving the others.
-*/
-var APPLIANCE_TEMPLATE_ID = "appliance";
-var APPLIANCE_KINDS = [
-	"washer",
-	"dryer",
-	"dishwasher"
-];
-DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher;
-/**
-* A dumb plug-in stove or heater, built from a smart plug (a `Heater`).
-*
-* The plug is the actuator: `switch.setState` is a FORWARD to the plug's own
-* (D967), so the heater switches exactly as the plug does. Running is the
-* plug being on; when a power reading is also named, running is the draw
-* staying above the line instead (a plug left on with the stove's own
-* thermostat open is not heating). 50 W is far above any standby and below
-* the smallest radiator.
-*/
-var HEATER_TEMPLATE_ID = "heater";
-DeviceType.Heater;
-/**
 * Statistics and integrals over a history read (D944).
 *
 * Pure: the same points always give the same answer, so a restart recomputes
@@ -12724,34 +12895,6 @@ var HelperSpecSchema = discriminatedUnion("kind", [
 		/** Actuator groups only. Readings leave this unset. */
 		active: ActiveCriterionSchema.optional()
 	}),
-	object({
-		kind: literal("appliance"),
-		templateId: literal(APPLIANCE_TEMPLATE_ID),
-		appliance: _enum(APPLIANCE_KINDS),
-		thresholdWatts: number().positive(),
-		startDwellMs: number().int().nonnegative(),
-		stopDwellMs: number().int().nonnegative(),
-		member: HelperMemberSchema,
-		/**
-		* The plug that powers the appliance (`switch.on`). Optional: when set, the
-		* composition carries a `power-source` feature, so the hub can cut and restore
-		* that plug (power-source link of a NEW-target composition).
-		*/
-		powerSwitch: HelperMemberSchema.optional(),
-		/** How long a forced restart keeps the plug off; the cap's default when unset. */
-		offSeconds: number().optional()
-	}),
-	object({
-		kind: literal("heater"),
-		templateId: literal(HEATER_TEMPLATE_ID),
-		/** The plug, read and commanded at `switch.on`. */
-		plug: HelperMemberSchema,
-		/** The plug's power reading, when it has one: running is then the draw, not the switch. */
-		meter: HelperMemberSchema.optional(),
-		thresholdWatts: number().positive(),
-		startDwellMs: number().int().nonnegative(),
-		stopDwellMs: number().int().nonnegative()
-	}),
 	object({
 		kind: literal("statistic"),
 		stat: _enum(STATISTIC_STATS),
@@ -12975,7 +13118,7 @@ var CompositionSchema = object({
 		kind: literal("existing"),
 		device: CompositionSourceRefSchema
 	})]),
-	features: array(CompositionFeatureSchema).min(1).max(16),
+	features: array(CompositionFeatureSchema).min(0).max(16),
 	/**
 	* Present when the block is a helper template. Absent on a free
 	* composition (the room example, device 4603). The editor reads this,
@@ -13310,6 +13453,205 @@ function buildCapturingReply(envelope) {
 	};
 	return wrapper;
 }
+/**
+* `RecordIntegrationInstances` - the `integration-instances` provider over ONE
+* entry kind, so an addon that holds a connection serves it in ~30 lines.
+*
+* Every instance is one record of the addon's own kind, keyed by the
+* `integrations` registry id. The records door does the secret work: a field the
+* kind marks `.meta({ secret: true })` is a keychain marker bound to the row, so
+* deleting the row deletes the secret, and one row's value is never another's.
+*
+* Patch rules for a secret (`updateInstance`): omitted, `''`, the redaction
+* token or the view the form was given KEEP the stored secret;
+* `{ $secretClear: true }` clears it; any other string replaces it.
+*/
+/** The most instances one addon lists (an integrations page, not a table). */
+var INSTANCES_LIST_MAX = 1e3;
+/** The keys of the kind's secret fields that sit at the top level of the body. */
+function topLevelSecretKeys(paths) {
+	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[") && !p.includes("{")));
+}
+/** The keys of the kind's top-level MAPS whose values are secrets (`applianceSecrets{}`). */
+function secretMapKeys(paths) {
+	return new Set(paths.filter((p) => p.endsWith("{}") && !p.slice(0, -2).match(/[.[{]/)).map((p) => p.slice(0, -2)));
+}
+/**
+* A patch value for a map of secrets: an entry that is omitted, `''`, the redaction token or the
+* view the form was given KEEPS its stored secret (it is left out of the merge); `{ $secretClear }`
+* or `null` removes the entry; any other string replaces it. Null when nothing is left to merge.
+*/
+function secretMapPatch(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) if (entry === null || isSecretClear(entry)) out[key] = null;
+	else if (typeof entry === "string" && entry !== "" && entry !== "__camstack_redacted__" && !isSecretFieldView(entry)) out[key] = entry;
+	return Object.keys(out).length > 0 ? out : null;
+}
+/** Does the kind's body schema carry an `enabled` field? */
+function declaresEnabled(kind) {
+	const json = toJSONSchema(kind.schema, {
+		unrepresentable: "any",
+		io: "input"
+	});
+	const properties = Reflect.get(json, "properties");
+	return typeof properties === "object" && properties !== null && "enabled" in properties;
+}
+var RecordIntegrationInstances = class {
+	records;
+	kind;
+	hooks;
+	handle;
+	secretKeys;
+	secretMaps;
+	nameField;
+	/** The `integrations` registry owns the on/off switch (`role: devices`); the body has none. */
+	registryOwnsEnabled;
+	constructor(records, kind, hooks) {
+		this.records = records;
+		this.kind = kind;
+		this.hooks = hooks;
+		this.handle = records.kind(kind);
+		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
+		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
+		this.nameField = kind.declaration.entry?.nameField ?? "name";
+		this.registryOwnsEnabled = hooks.description.role === "devices";
+		if (this.registryOwnsEnabled && declaresEnabled(kind)) throw new Error(`kind "${kind.name}": the integrations registry owns the on/off switch of a role "devices" addon, so the body must not declare "enabled"`);
+	}
+	/**
+	* One instance read for the addon's own runtime; null when absent. When the keychain is
+	* locked the row is served WITHOUT its secrets and says so (`secrets: 'unavailable'`), so the
+	* caller can keep what it had instead of reconfiguring with an empty secret (D49).
+	*/
+	async readResolved(id) {
+		try {
+			const record = await this.handle.getResolved(id);
+			return record === null ? null : {
+				id,
+				body: record.data,
+				enabled: record.data.enabled !== false,
+				secrets: "resolved"
+			};
+		} catch (err) {
+			if (!(err instanceof RecordSecretUnavailableError)) throw err;
+			const stored = await this.handle.get(id);
+			if (stored === null) return null;
+			return {
+				id,
+				body: Object.fromEntries(Object.entries(stored.data).filter(([key]) => !this.secretKeys.has(key))),
+				enabled: stored.data.enabled !== false,
+				secrets: "unavailable"
+			};
+		}
+	}
+	/** The body of {@link readResolved} alone; a locked keychain yields the row without secrets. */
+	async getResolved(id) {
+		return (await this.readResolved(id))?.body ?? null;
+	}
+	/** Every instance, secrets resolved where the keychain allows; an absent one is skipped. */
+	async listResolved() {
+		const page = await this.handle.query({ limit: INSTANCES_LIST_MAX });
+		const out = [];
+		for (const record of page.records) {
+			const read = await this.readResolved(record.id);
+			if (read !== null) out.push(read);
+		}
+		return out;
+	}
+	viewOf(record) {
+		const shown = secretViewsOf(this.records.owner, this.kind.name, record.id, this.kind.declaration, record.data);
+		const rawName = record.data[this.nameField];
+		const kind = this.hooks.kindOf?.(record.data);
+		const health = this.hooks.health?.(record.data, record.id);
+		return {
+			id: record.id,
+			name: typeof rawName === "string" ? rawName : record.id,
+			configured: this.hooks.configured(record.data),
+			...this.registryOwnsEnabled ? {} : { enabled: record.data.enabled !== false },
+			formValues: shown,
+			...kind !== void 0 ? { kind } : {},
+			...health?.status !== void 0 ? { status: health.status } : {},
+			...health?.lastCheckedAt !== void 0 ? { lastCheckedAt: health.lastCheckedAt } : {}
+		};
+	}
+	describe = async () => this.hooks.mintId === void 0 ? this.hooks.description : {
+		...this.hooks.description,
+		mintsId: true
+	};
+	instanceFormSchema = async ({ id }) => this.hooks.formSchema(id);
+	listInstances = async () => {
+		return (await this.handle.query({ limit: INSTANCES_LIST_MAX })).records.map((record) => this.viewOf(record));
+	};
+	getInstance = async ({ id }) => {
+		const record = await this.handle.get(id);
+		return record === null ? null : this.viewOf(record);
+	};
+	/** Insert ONE row (`ifRev: 0`: an existing id is refused, never overwritten). */
+	createInstance = async ({ id, name, kind }) => {
+		const minted = id ?? this.hooks.mintId?.({
+			name,
+			...kind !== void 0 ? { kind } : {}
+		});
+		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
+		await this.handle.put({
+			id: minted,
+			data: this.hooks.initialBody(name, kind)
+		}, { ifRev: 0 });
+		await this.hooks.onChanged?.(minted, "created");
+		return { id: minted };
+	};
+	updateInstance = async ({ id, name, values }) => {
+		const patch = {};
+		for (const [key, value] of Object.entries(values)) {
+			if (value === void 0) continue;
+			if (this.secretMaps.has(key)) {
+				const entries = secretMapPatch(value);
+				if (entries !== null) patch[key] = entries;
+			} else if (!this.secretKeys.has(key)) patch[key] = value;
+			else if (isSecretClear(value)) patch[key] = null;
+			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
+		}
+		if (name !== void 0) patch[this.nameField] = name;
+		await this.handle.patch(id, patch);
+		await this.hooks.onChanged?.(id, "updated");
+		return { ok: true };
+	};
+	/** The switch lives in the record body; the addon is told so it applies it (D996). */
+	setInstanceEnabled = async ({ id, enabled }) => {
+		if (this.registryOwnsEnabled) throw new Error(`instance "${id}": the integrations registry owns the on/off switch of this addon; set it with integrations.update`);
+		await this.handle.patch(id, { enabled });
+		await this.hooks.onChanged?.(id, "enabled");
+		return { ok: true };
+	};
+	/** The row and its keychain refs go together (the records door). */
+	deleteInstance = async ({ id }) => {
+		await this.handle.delete(id);
+		await this.hooks.onChanged?.(id, "deleted");
+		return { ok: true };
+	};
+	testInstance = async (input) => {
+		if (this.hooks.test === void 0) return {
+			success: false,
+			status: "unsupported",
+			error: "This integration declares no connection test"
+		};
+		return this.hooks.test(input);
+	};
+	/** The flat provider object to hand to `registerProvider`. */
+	toProvider() {
+		return {
+			describe: this.describe,
+			instanceFormSchema: this.instanceFormSchema,
+			listInstances: this.listInstances,
+			getInstance: this.getInstance,
+			createInstance: this.createInstance,
+			updateInstance: this.updateInstance,
+			setInstanceEnabled: this.setInstanceEnabled,
+			deleteInstance: this.deleteInstance,
+			testInstance: this.testInstance
+		};
+	}
+};
 var EncodeProfileSchema = object({
 	video: object({
 		codec: _enum([
@@ -14415,6 +14757,58 @@ var MigrationOwnerStepSchema = object({
 	/** The ledger state the engine found: `pending` has no row yet. */
 	state: union([literal("pending"), MigrationStatusSchema])
 });
+function isPlain(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function flattenNestedRecords(ports, spec) {
+	const ids = await ports.listNested(spec.legacyKey);
+	if (ids.length === 0) return {
+		outcome: "already-done",
+		summary: { converted: 0 }
+	};
+	const rows = /* @__PURE__ */ new Map();
+	for (const id of ids) try {
+		rows.set(id, await ports.readResolved(id));
+	} catch (err) {
+		const why = err instanceof Error ? err.message : String(err);
+		throw new Error(`record '${id}': cannot be read with its secrets (${why}) - nothing moved`);
+	}
+	for (const [id, row] of rows) {
+		const legacy = row[spec.legacyKey];
+		if (!isPlain(legacy)) throw new Error(`record '${id}': '${spec.legacyKey}' is not an object - nothing moved`);
+		const flat = spec.toFlat(legacy, row);
+		await ports.patch(id, flat);
+		const back = await ports.readResolved(id);
+		const wrong = spec.flatSecretKeys.filter((key) => {
+			const sent = flat[key];
+			const got = back[key];
+			return (typeof sent === "string" ? sent : "") !== (typeof got === "string" ? got : "");
+		});
+		if (wrong.length > 0) {
+			await ports.patch(id, Object.fromEntries(Object.keys(flat).map((key) => [key, null])));
+			throw new Error(`record '${id}': ${wrong.join(", ")} did not read back from its new home - the row is unchanged`);
+		}
+		await ports.patch(id, { [spec.legacyKey]: null });
+	}
+	return {
+		outcome: "done",
+		summary: { converted: rows.size }
+	};
+}
+/** The ports over one kind's records handle. */
+function flattenPortsOver(handle) {
+	return {
+		listNested: async (legacyKey) => (await handle.query({ limit: 1e3 })).records.filter((r) => legacyKey in r.data).map((r) => r.id),
+		readResolved: async (id) => {
+			const row = await handle.getResolved(id);
+			if (row === null) throw new Error("the record is gone");
+			return row.data;
+		},
+		patch: async (id, patch) => {
+			await handle.patch(id, patch);
+		}
+	};
+}
 /**
 * The trainer contract — what the hub hands the cloud trainer and what it
 * gets back (cloud training, D805+).
@@ -50287,117 +50681,6 @@ function actuator(input) {
 	};
 }
 new Map(GROUP_TEMPLATES.map((template) => [template.id, template]));
-var PowerSourceRefusalReasonSchema = _enum([
-	"no-power-source",
-	"switch-missing",
-	"switch-offline",
-	"switch-unknown",
-	"restart-in-progress",
-	"switch-call-failed"
-]);
-var PowerSourceActionResultSchema = discriminatedUnion("accepted", [object({ accepted: literal(true) }), object({
-	accepted: literal(false),
-	reason: PowerSourceRefusalReasonSchema,
-	/** One line for the operator, naming the switch. */
-	message: string()
-})]);
-var PowerSourceInfoSchema = object({
-	/** False when the device has no power source linked; the rest is then empty. */
-	linked: boolean(),
-	switchDeviceId: number().nullable(),
-	switchName: string().nullable(),
-	/** The switch's on/off state, or null when it is unknown. Never false for unknown (D393). */
-	switchOn: boolean().nullable(),
-	switchOnline: boolean().nullable(),
-	restartInProgress: boolean(),
-	offSeconds: number().int()
-});
-/** The composed slice: the switch state the link mirrors, plus the stored off time. */
-var PowerSourceStateSchema = object({
-	/** Null while the switch has not reported: unknown is never `false` (D393). */
-	switchOn: boolean().nullable(),
-	offSeconds: number().int(),
-	lastFetchedAt: number()
-});
-var POWER_SOURCE_DEVICE_TYPES = [
-	DeviceType.Gateway,
-	DeviceType.Hub,
-	DeviceType.Camera,
-	DeviceType.Sensor,
-	DeviceType.MediaPlayer,
-	DeviceType.Vacuum,
-	DeviceType.Generic,
-	DeviceType.Washer,
-	DeviceType.Dryer,
-	DeviceType.Dishwasher,
-	DeviceType.PetFountain,
-	DeviceType.Fan,
-	DeviceType.Humidifier,
-	DeviceType.Climate,
-	DeviceType.WaterHeater
-];
-var powerSourceCustomize = {
-	version: 1,
-	targets: [{
-		id: "switch",
-		cardinality: "scalar",
-		vocabulary: {
-			cap: "power-source",
-			stateField: "switchOn"
-		},
-		deviceTypes: POWER_SOURCE_DEVICE_TYPES,
-		apply: "add",
-		path: "switchOn",
-		sources: [{
-			kind: "switch",
-			transforms: [{ kind: "identity" }]
-		}],
-		companions: [{
-			kind: "constant",
-			path: "offSeconds",
-			value: 10,
-			when: "add"
-		}, {
-			kind: "clock",
-			path: "lastFetchedAt",
-			when: "always"
-		}],
-		sourceReport: { status: "assignment-status" }
-	}]
-};
-var deviceInput$2 = object({ deviceId: number().int().nonnegative() });
-var powerSourceCapability = {
-	name: "power-source",
-	scope: "device",
-	mode: "singleton",
-	deviceTypes: POWER_SOURCE_DEVICE_TYPES,
-	methods: {
-		getStatus: systemMethod(deviceInput$2, PowerSourceInfoSchema, { auth: "admin" }),
-		powerOn: systemMethod(deviceInput$2, PowerSourceActionResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		powerOff: systemMethod(deviceInput$2, PowerSourceActionResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		forceRestart: systemMethod(deviceInput$2, PowerSourceActionResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		})
-	},
-	runtimeState: PowerSourceStateSchema,
-	customize: powerSourceCustomize,
-	/**
-	* Runtime-state durability: **session** — mirrored from the linked switch on
-	* its next report; a restored value would outlive the reading it names.
-	*
-	* See `RuntimeStateDurability`. Enforced by
-	* `scripts/check-runtime-state-durability.ts`.
-	*/
-	durability: "session",
-	history: "none"
-};
 DeviceFeature.LightColorRgb, DeviceFeature.LightColorHsv, DeviceFeature.LightColorMired;
 DeviceType.Camera;
 `${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
@@ -50425,6 +50708,165 @@ var ComposableCapabilitiesSchema = object({ caps: array(object({
 	}).optional()
 })) });
 /**
+* A saved Customize assignment (D936). The schema is the type: callers use
+* `z.infer`, they do not restate the shape.
+*/
+var OverrideSourceSchema = object({
+	addonId: string().min(1),
+	stableId: string().min(1),
+	cap: string().min(1),
+	fieldPath: string().min(1)
+});
+var IdentityTransformDraftSchema = object({ kind: literal("identity") });
+var InvertTransformDraftSchema = object({ kind: literal("invert") });
+var ThresholdTransformDraftSchema = object({
+	kind: literal("threshold"),
+	comparison: _enum(["gte", "lte"]),
+	threshold: number(),
+	startDwellMs: number().nonnegative(),
+	stopDwellMs: number().nonnegative()
+});
+var CustomizeTransformDraftSchema = discriminatedUnion("kind", [
+	IdentityTransformDraftSchema,
+	InvertTransformDraftSchema,
+	ThresholdTransformDraftSchema,
+	object({
+		kind: literal("linear"),
+		scale: number(),
+		offset: number(),
+		clampMin: number().optional(),
+		clampMax: number().optional()
+	}),
+	object({
+		kind: literal("enum-map"),
+		mapping: record(string(), string().nullable())
+	}),
+	object({ kind: literal("number") })
+]);
+var ScalarOverrideDraftSchema = object({
+	kind: literal("scalar"),
+	cap: string().min(1),
+	targetId: string().min(1),
+	source: OverrideSourceSchema,
+	transform: CustomizeTransformDraftSchema
+});
+var KeyedArrayOverrideDraftSchema = object({
+	kind: literal("keyedArray"),
+	cap: string().min(1),
+	targetId: string().min(1),
+	key: string().min(1),
+	label: string().min(1),
+	fieldPath: string().min(1),
+	source: OverrideSourceSchema,
+	transform: CustomizeTransformDraftSchema
+});
+var PulseOverrideDraftSchema = object({
+	kind: literal("pulse"),
+	cap: string().min(1),
+	targetId: string().min(1),
+	enabled: boolean(),
+	debounceMs: number().nonnegative(),
+	edges: array(_enum([
+		"rising",
+		"button",
+		"native-event"
+	])).min(1).optional(),
+	sources: array(OverrideSourceSchema).min(1)
+});
+var SpanSourceDraftSchema = OverrideSourceSchema.extend({ mode: _enum([
+	"in-addition",
+	"confirm",
+	"replace"
+]).optional() });
+discriminatedUnion("kind", [
+	ScalarOverrideDraftSchema,
+	KeyedArrayOverrideDraftSchema,
+	PulseOverrideDraftSchema,
+	object({
+		kind: literal("span"),
+		cap: string().min(1),
+		targetId: string().min(1),
+		timeoutMs: number().nonnegative(),
+		cooldownMs: number().nonnegative().optional(),
+		sources: array(SpanSourceDraftSchema)
+	})
+]);
+object({
+	targetId: string().min(1),
+	configured: boolean(),
+	source: _enum(["native", "assigned"]),
+	state: _enum([
+		"active",
+		"stale",
+		"released",
+		"unavailable"
+	]),
+	reason: string().nullable()
+});
+/**
+* What a running-threshold proposal says (planning#405). The schema is the
+* type: the algorithm, the capability method and the UI all read `z.infer`.
+*
+* A proposal is read-only advice: it carries the numbers it was derived from
+* (`evidence`) so the operator can judge it, and an `insufficient` answer names
+* WHY with a typed reason and the catalog defaults, never an invented number.
+*/
+var RunningProposalTierSchema = _enum(["raw", "5m"]);
+var RunningProposalConfidenceSchema = _enum([
+	"high",
+	"medium",
+	"low"
+]);
+var RunningProposalInsufficientReasonSchema = _enum([
+	"no-history",
+	"span-too-short",
+	"truncated",
+	"no-idle-floor",
+	"no-runs",
+	"no-separation"
+]);
+var RunningProposalReplaySchema = object({
+	/** Intervals the real dwell expression held true over the window. */
+	intervals: number().int().nonnegative(),
+	/** Intervals outside every run, or a second interval inside one. */
+	extra: number().int().nonnegative(),
+	/** Runs without an interval of their own (none, or merged into a neighbour). */
+	missed: number().int().nonnegative()
+});
+var RunningProposalEvidenceSchema = object({
+	tier: RunningProposalTierSchema,
+	spanMs: number().nonnegative(),
+	from: number(),
+	to: number(),
+	points: number().int().nonnegative(),
+	runsFound: number().int().nonnegative(),
+	pausesFound: number().int().nonnegative(),
+	longestPauseMs: number().nonnegative(),
+	idleFloorW: number(),
+	noiseCeilingW: number(),
+	plateauW: number(),
+	replay: RunningProposalReplaySchema
+});
+var RunningProposalInsufficientEvidenceSchema = object({
+	spanMs: number().nonnegative(),
+	points: number().int().nonnegative(),
+	runsFound: number().int().nonnegative()
+});
+var RunningThresholdProposalSchema = discriminatedUnion("state", [object({
+	state: literal("proposal"),
+	transform: ThresholdTransformDraftSchema,
+	evidence: RunningProposalEvidenceSchema,
+	confidence: RunningProposalConfidenceSchema,
+	/** Why the confidence is not higher; empty when nothing held it back. */
+	notes: array(string())
+}), object({
+	state: literal("insufficient"),
+	reason: RunningProposalInsufficientReasonSchema,
+	evidence: RunningProposalInsufficientEvidenceSchema,
+	/** The catalog defaults, offered as what stands when nothing better is known. */
+	fallback: ThresholdTransformDraftSchema
+})]);
+/**
 * The report of a one-shot "move this owner's plaintext secrets into the
 * keychain" run (D878). COUNTS only - never a value, never a ref.
 *
@@ -50714,6 +51156,14 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 	kind: "mutation",
 	auth: "admin",
 	access: "view"
+}), method(object({
+	deviceId: number().int(),
+	cap: string().min(1),
+	fieldPath: string().min(1),
+	deviceType: _enum(DeviceType).optional()
+}), RunningThresholdProposalSchema, {
+	auth: "admin",
+	access: "view"
 }), method(object({
 	blockId: string().min(1),
 	trace: AutomationRunTraceSchema.optional(),
@@ -51690,7 +52140,46 @@ method(object({
 * exposes only the COMMON surface: link state, supported device
 * kinds (so the UI can filter the device picker), and per-device
 * expose/unexpose.
+*
+* INSTANCES. One export addon can serve several independent targets (a
+* HomeKit bridge, a Home Assistant broker). `listInstances` names them.
+* `instanceId` on a READ is optional: absent = the whole addon (linked if any
+* enabled instance is, `exposedDeviceCount` = distinct devices, `setup` = the
+* default instance's); present = that instance; an id the provider does not
+* serve is refused with `ExportInstanceUnknownError` (`export-instance-unknown`),
+* never answered empty. `instanceId` on a WRITE is REQUIRED: a membership
+* change always names the target it changes. A single-instance provider
+* accepts an absent id on a read or its own id, and refuses any other.
+*/
+/** Which instance of an export addon a call addresses. Absent on a read = the whole addon. */
+var InstanceIdSchema$1 = string().min(1);
+var InstancePinSchema = object({ instanceId: InstanceIdSchema$1.optional() });
+/** One independent export target of an addon. */
+var ExportInstanceSchema = object({
+	instanceId: InstanceIdSchema$1,
+	name: string(),
+	enabled: boolean(),
+	kind: string().optional()
+});
+var EXPORT_INSTANCE_UNKNOWN = "export-instance-unknown";
+/** The named failure of an `instanceId` the provider does not serve. The message starts with the code. */
+var ExportInstanceUnknownError = class extends Error {
+	code = EXPORT_INSTANCE_UNKNOWN;
+	instanceId;
+	constructor(addon, instanceId) {
+		super(`${EXPORT_INSTANCE_UNKNOWN}: ${addon} serves no instance "${instanceId}"`);
+		this.name = "ExportInstanceUnknownError";
+		this.instanceId = instanceId;
+	}
+};
+/**
+* The instance a `getStatus` call names. The cap's `status` block injects a per-device
+* `getStatus({ deviceId })` beside the method's own `{ instanceId? }`, so the provider sees
+* both shapes; only the second names an instance (a per-device status read is addon-wide).
 */
+function statusInstanceOf(input) {
+	return "instanceId" in input ? input.instanceId : void 0;
+}
 var LinkStateSchema = _enum([
 	"unlinked",
 	"linked",
@@ -51741,10 +52230,14 @@ var ExposedDeviceSchema = object({
 	capabilities: array(string()).optional()
 });
 var ExposeInputSchema = object({
+	instanceId: InstanceIdSchema$1,
 	deviceId: string(),
 	capabilities: array(string()).optional()
 });
-var UnexposeInputSchema = object({ deviceId: string() });
+var UnexposeInputSchema = object({
+	instanceId: InstanceIdSchema$1,
+	deviceId: string()
+});
 /**
 * What an exporter may expose besides devices (D968). An action and a
 * notification target are LIST ENTRIES, never devices (D954): they enter an
@@ -51773,8 +52266,14 @@ var ExposedEntitySchema = object({
 	entity: ExportEntityRefSchema,
 	exposedAs: string().optional()
 });
-var ExposeEntityInputSchema = object({ entity: ExportEntityRefSchema });
-var UnexposeEntityInputSchema = object({ entity: ExportEntityRefSchema });
+var ExposeEntityInputSchema = object({
+	instanceId: InstanceIdSchema$1,
+	entity: ExportEntityRefSchema
+});
+var UnexposeEntityInputSchema = object({
+	instanceId: InstanceIdSchema$1,
+	entity: ExportEntityRefSchema
+});
 var deviceExportCapability = {
 	name: "device-export",
 	scope: "system",
@@ -51794,9 +52293,10 @@ var deviceExportCapability = {
 	*/
 	exposesDeviceSettings: true,
 	methods: {
-		getStatus: method(_void(), DeviceExportStatusSchema),
-		listSupportedDeviceKinds: method(_void(), array(DeviceKindSchema)),
-		listExposedDevices: method(_void(), array(ExposedDeviceSchema)),
+		getStatus: method(InstancePinSchema, DeviceExportStatusSchema),
+		listInstances: method(_void(), array(ExportInstanceSchema)),
+		listSupportedDeviceKinds: method(InstancePinSchema, array(DeviceKindSchema)),
+		listExposedDevices: method(InstancePinSchema, array(ExposedDeviceSchema)),
 		exposeDevice: method(ExposeInputSchema, _void(), {
 			kind: "mutation",
 			auth: "admin"
@@ -51806,7 +52306,7 @@ var deviceExportCapability = {
 			auth: "admin"
 		}),
 		listSupportedEntityKinds: optionalMethod(_void(), array(ExportEntityKindSchema)),
-		listExposedEntities: optionalMethod(_void(), array(ExposedEntitySchema)),
+		listExposedEntities: optionalMethod(InstancePinSchema, array(ExposedEntitySchema)),
 		exposeEntity: optionalMethod(ExposeEntityInputSchema, _void(), {
 			kind: "mutation",
 			auth: "admin"
@@ -55411,15 +55911,15 @@ var FanPresetCaptureResultSchema = object({
 	items: array(FanCaptureItemSchema),
 	omitted: array(FanCaptureOmissionSchema)
 });
-var deviceInput$1 = object({ deviceId: number().int().nonnegative() });
+var deviceInput$2 = object({ deviceId: number().int().nonnegative() });
 DeviceType.Fan;
-method(deviceInput$1, array(FanPresetSchema), { auth: "protected" }), method(deviceInput$1.extend({ presets: array(FanPresetSchema).max(12) }), FanPresetsSetResultSchema, {
+method(deviceInput$2, array(FanPresetSchema), { auth: "protected" }), method(deviceInput$2.extend({ presets: array(FanPresetSchema).max(12) }), FanPresetsSetResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(deviceInput$1.extend({ presetId: string().min(1) }), FanPresetApplyResultSchema, {
+}), method(deviceInput$2.extend({ presetId: string().min(1) }), FanPresetApplyResultSchema, {
 	kind: "mutation",
 	auth: "protected"
-}), method(deviceInput$1.extend({
+}), method(deviceInput$2.extend({
 	fields: array(FanCaptureFieldSchema).optional(),
 	steps: array(ActionStepSchema).max(20).default([])
 }), FanPresetCaptureResultSchema, { auth: "protected" });
@@ -56330,13 +56830,65 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 */
 var ConfigSchemaPassthrough$3 = custom();
 var IntegrationInstanceIdSchema = string().min(1);
+var IntegrationInstanceModeSchema = _enum(["single", "multiple"]);
+/**
+* One kind of instance a provider can create (an adapter, an account type). The sign-in and
+* connect fields follow the `broker` contract (`broker.cap.ts`): `signIn.basePath` is a
+* hub-relative route set speaking the sign-in contract, `connectPath` / `disconnectPath` open an
+* interactive account link (popup) and may carry `{{brokerId}}`, which the UI replaces with the
+* instance id.
+*/
+var IntegrationInstanceKindSchema = object({
+	/** Stable id of the kind, sent back as `createInstance.kind`. */
+	id: string().min(1),
+	label: string().min(1),
+	/** The kind signs in through a server-held interactive session. */
+	signIn: object({
+		basePath: string().min(1),
+		methods: array(_enum(["device-code", "proxy"])).optional()
+	}).optional(),
+	/** Relative hub path to start an interactive account link of an instance of this kind. */
+	connectPath: string().min(1).optional(),
+	/** Relative hub path to disconnect that account. */
+	disconnectPath: string().min(1).optional()
+});
 var IntegrationInstanceDescriptionSchema = object({
+	/** What the instances are for the Integrations page; see {@link IntegrationInstanceRoleSchema}. */
+	role: _enum([
+		"devices",
+		"services",
+		"both"
+	]),
+	/** How the devices of an instance are found; absent means `{ mode: 'none' }`. */
+	discovery: object({
+		mode: _enum([
+			"none",
+			"lan",
+			"account"
+		]),
+		scopedToInstance: boolean()
+	}).optional(),
 	/** `single`: at most one instance can exist (Loki). `multiple`: an account each. */
-	instanceMode: _enum(["single", "multiple"]),
+	instanceMode: IntegrationInstanceModeSchema,
 	/** What the instance is, for the UI (`destination`, `relay`, `account`). */
 	kind: string(),
 	/** True when `testInstance` really probes the remote. */
-	canTest: boolean()
+	canTest: boolean(),
+	/**
+	* The kinds an instance can be of. Absent or one entry: nothing to choose; more than one: the
+	* Add flow asks which first and sends it as `createInstance.kind`.
+	*/
+	kinds: array(IntegrationInstanceKindSchema).optional(),
+	/**
+	* The provider accepts `createInstance.id` for an id that once existed (an adopted id, because
+	* devices carry it). The UI then offers "restore under its old id" on Add. Absent means no.
+	*/
+	allowRestoreId: boolean().optional(),
+	/**
+	* `createInstance` without an `id` works: the provider mints it. Absent means the caller must
+	* send an id (the UI then mints an opaque one).
+	*/
+	mintsId: boolean().optional()
 });
 var IntegrationInstanceStatusSchema = object({
 	state: _enum([
@@ -56345,7 +56897,9 @@ var IntegrationInstanceStatusSchema = object({
 		"error",
 		"unknown"
 	]),
-	detail: string().optional()
+	detail: string().optional(),
+	/** A short human word for the state ("Signed in", "Token expired"); shown instead of `state`. */
+	label: string().optional()
 });
 var IntegrationInstanceSchema = object({
 	id: IntegrationInstanceIdSchema,
@@ -56353,13 +56907,18 @@ var IntegrationInstanceSchema = object({
 	/** The addon's own rule (an URL is present, a client id is present...). */
 	configured: boolean(),
 	/**
-	* The instance's own on/off switch (D996): always present, derived from the record body
-	* (`enabled !== false`, so a row written before the field existed is on).
+	* The instance's own on/off switch (D996), derived from the record body (`enabled !== false`,
+	* so a row written before the field existed is on). Absent when the `integrations` registry
+	* owns the switch (`describe().role` is `devices`): read it from the registry row.
 	*/
-	enabled: boolean(),
+	enabled: boolean().optional(),
+	/** The kind of this instance (one of `describe().kinds[].id`), when the provider has kinds. */
+	kind: string().optional(),
 	/** Values for the instance form; a secret is a `SecretFieldView`, never text. */
 	formValues: record(string(), unknown()),
-	status: IntegrationInstanceStatusSchema.optional()
+	status: IntegrationInstanceStatusSchema.optional(),
+	/** Epoch ms of the last probe of the remote that produced `status`; absent when never checked. */
+	lastCheckedAt: number().optional()
 });
 var IntegrationInstancePatchSchema = object({
 	id: IntegrationInstanceIdSchema,
@@ -56367,31 +56926,57 @@ var IntegrationInstancePatchSchema = object({
 	/** Omitted / '' / redaction token keeps a secret; `{ $secretClear: true }` clears it. */
 	values: record(string(), unknown())
 });
-method(_void(), IntegrationInstanceDescriptionSchema, { auth: "admin" }), method(object({ id: IntegrationInstanceIdSchema.nullable() }), ConfigSchemaPassthrough$3, { auth: "admin" }), method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }), method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }), method(object({
-	id: IntegrationInstanceIdSchema,
-	name: string().min(1)
-}), object({ id: string() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(IntegrationInstancePatchSchema, object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	id: IntegrationInstanceIdSchema,
-	enabled: boolean()
-}), object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ id: IntegrationInstanceIdSchema }), object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), optionalMethod(object({
-	id: IntegrationInstanceIdSchema.nullable(),
-	values: record(string(), unknown())
-}), TestConnectionResultSchema$1, {
-	kind: "mutation",
-	auth: "admin"
-});
+var integrationInstancesCapability = {
+	name: "integration-instances",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		describe: method(_void(), IntegrationInstanceDescriptionSchema, { auth: "admin" }),
+		/** The form; `id: null` is the create form. */
+		instanceFormSchema: method(object({ id: IntegrationInstanceIdSchema.nullable() }), ConfigSchemaPassthrough$3, { auth: "admin" }),
+		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
+		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
+		/**
+		* Insert the typed record. With `id` it is stored under that id (a duplicate id is refused);
+		* without one the PROVIDER mints it and answers it. `kind` picks one of `describe().kinds`.
+		*/
+		createInstance: method(object({
+			id: IntegrationInstanceIdSchema.optional(),
+			name: string().min(1),
+			kind: string().min(1).optional()
+		}), object({ id: string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateInstance: method(IntegrationInstancePatchSchema, object({ ok: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Switch ONE instance on or off. A row control, not a form field: `updateInstance.values` is the
+		* form patch (D62, D996). An off instance keeps its record and secrets and does no work.
+		*/
+		setInstanceEnabled: method(object({
+			id: IntegrationInstanceIdSchema,
+			enabled: boolean()
+		}), object({ ok: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Delete the record and its keychain refs together. */
+		deleteInstance: method(object({ id: IntegrationInstanceIdSchema }), object({ ok: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		testInstance: optionalMethod(object({
+			id: IntegrationInstanceIdSchema.nullable(),
+			values: record(string(), unknown())
+		}), TestConnectionResultSchema$1, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
 /**
 * Two-way audio / talk-back cap. Clients open a WebRTC audio-only
 * session (server-initiated offer pattern, identical to the main
@@ -58409,6 +58994,11 @@ var LogEntrySchema = object({
 * flight, and not asking for the next slice ends the scan.
 */
 var LogReadQuerySchema = object({
+	/**
+	* Which destination INSTANCE answers (a destination addon may hold several records). Absent ⇒
+	* the provider's first readable one, so a caller written before instances existed is unchanged.
+	*/
+	instanceId: string().min(1).max(200).optional(),
 	/** Correlates `cancelRead`. Caller-chosen, unique per in-flight read. */
 	requestId: string().min(1).max(64).optional(),
 	/** The device the line is about (`tags.deviceId`, numeric). */
@@ -58471,6 +59061,8 @@ var LogReadResultSchema = object({
 	/** True when `cancelRead` ended this slice early. */
 	cancelled: boolean().optional()
 });
+/** Names one destination instance; absent ⇒ the provider's first readable one. */
+var LogInstanceSelectorSchema = object({ instanceId: string().min(1).max(200).optional() });
 var LogReadCapabilitiesSchema = object({
 	/** False ⇒ this destination only ships lines (console, forwarder, an unconfigured Loki). */
 	readable: boolean(),
@@ -58489,7 +59081,7 @@ var LogReadCapabilitiesSchema = object({
 	/** How far back the store reaches, when the provider knows (days). */
 	retentionDays: number().nullable()
 });
-method(LogEntrySchema, _void(), { kind: "mutation" }), optionalMethod(_void(), LogReadCapabilitiesSchema, { auth: "admin" }), optionalMethod(LogReadQuerySchema, LogReadResultSchema, { auth: "admin" }), optionalMethod(object({ requestId: string().min(1).max(64) }), object({ cancelled: boolean() }), {
+method(LogEntrySchema, _void(), { kind: "mutation" }), optionalMethod(LogInstanceSelectorSchema, LogReadCapabilitiesSchema, { auth: "admin" }), optionalMethod(LogReadQuerySchema, LogReadResultSchema, { auth: "admin" }), optionalMethod(object({ requestId: string().min(1).max(64) }), object({ cancelled: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -70832,6 +71424,14 @@ var powerMeterCapability = {
 	deviceNative: true,
 	mode: "singleton",
 	deviceTypes: POWER_METER_DEVICE_TYPES,
+	deviceConfig: { ui: {
+		kind: "widget",
+		widgetId: "host/power-meter-line",
+		tab: "power",
+		placement: "hero",
+		label: "Power",
+		order: 4
+	} },
 	methods: {},
 	status: {
 		schema: PowerMeterStatusSchema,
@@ -70891,6 +71491,117 @@ var powerMeterCapability = {
 	volatileStateFields: ["lastFetchedAt"],
 	customize: powerMeterCustomize
 };
+var PowerSourceRefusalReasonSchema = _enum([
+	"no-power-source",
+	"switch-missing",
+	"switch-offline",
+	"switch-unknown",
+	"restart-in-progress",
+	"switch-call-failed"
+]);
+var PowerSourceActionResultSchema = discriminatedUnion("accepted", [object({ accepted: literal(true) }), object({
+	accepted: literal(false),
+	reason: PowerSourceRefusalReasonSchema,
+	/** One line for the operator, naming the switch. */
+	message: string()
+})]);
+var PowerSourceInfoSchema = object({
+	/** False when the device has no power source linked; the rest is then empty. */
+	linked: boolean(),
+	switchDeviceId: number().nullable(),
+	switchName: string().nullable(),
+	/** The switch's on/off state, or null when it is unknown. Never false for unknown (D393). */
+	switchOn: boolean().nullable(),
+	switchOnline: boolean().nullable(),
+	restartInProgress: boolean(),
+	offSeconds: number().int()
+});
+/** The composed slice: the switch state the link mirrors, plus the stored off time. */
+var PowerSourceStateSchema = object({
+	/** Null while the switch has not reported: unknown is never `false` (D393). */
+	switchOn: boolean().nullable(),
+	offSeconds: number().int(),
+	lastFetchedAt: number()
+});
+var POWER_SOURCE_DEVICE_TYPES = [
+	DeviceType.Gateway,
+	DeviceType.Hub,
+	DeviceType.Camera,
+	DeviceType.Sensor,
+	DeviceType.MediaPlayer,
+	DeviceType.Vacuum,
+	DeviceType.Generic,
+	DeviceType.Washer,
+	DeviceType.Dryer,
+	DeviceType.Dishwasher,
+	DeviceType.PetFountain,
+	DeviceType.Fan,
+	DeviceType.Humidifier,
+	DeviceType.Climate,
+	DeviceType.WaterHeater
+];
+var powerSourceCustomize = {
+	version: 1,
+	targets: [{
+		id: "switch",
+		cardinality: "scalar",
+		vocabulary: {
+			cap: "power-source",
+			stateField: "switchOn"
+		},
+		deviceTypes: POWER_SOURCE_DEVICE_TYPES,
+		apply: "add",
+		path: "switchOn",
+		sources: [{
+			kind: "switch",
+			transforms: [{ kind: "identity" }]
+		}],
+		companions: [{
+			kind: "constant",
+			path: "offSeconds",
+			value: 10,
+			when: "add"
+		}, {
+			kind: "clock",
+			path: "lastFetchedAt",
+			when: "always"
+		}],
+		sourceReport: { status: "assignment-status" }
+	}]
+};
+var deviceInput$1 = object({ deviceId: number().int().nonnegative() });
+var powerSourceCapability = {
+	name: "power-source",
+	scope: "device",
+	mode: "singleton",
+	deviceTypes: POWER_SOURCE_DEVICE_TYPES,
+	methods: {
+		getStatus: systemMethod(deviceInput$1, PowerSourceInfoSchema, { auth: "admin" }),
+		powerOn: systemMethod(deviceInput$1, PowerSourceActionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		powerOff: systemMethod(deviceInput$1, PowerSourceActionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		forceRestart: systemMethod(deviceInput$1, PowerSourceActionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	runtimeState: PowerSourceStateSchema,
+	customize: powerSourceCustomize,
+	/**
+	* Runtime-state durability: **session** — mirrored from the linked switch on
+	* its next report; a restored value would outlive the reading it names.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
+	history: "none"
+};
 /**
 * Presence cap. Models HA `person.*` and `device_tracker.*` entities
 * on `DeviceType.Presence`. Read-only — no setters: presence is
@@ -80386,6 +81097,25 @@ function buildDescriptor(capName, kind) {
 * contributes one entry per bound cap present in this map.
 */
 var EVENT_KIND_BY_CAP = Object.freeze(Object.fromEntries(Object.entries(CAP_TO_KIND).map(([capName, kind]) => [capName, buildDescriptor(capName, kind)])));
+/**
+* What a remote key is CALLED and what it LOOKS like, for every role (D963),
+* shared by the admin UI and the viewer. A role is data on the wire; each
+* client resolves its name from `label` (English and Italian side by side) and
+* its glyph from `icon`, a lucide id from the shared icon catalogue — the
+* server sends an id, a client maps it to its own icon set.
+*
+* `legend` is text printed on the key INSTEAD of a glyph (a digit has no
+* pictogram): a client that can draw text shows it, one that cannot falls back
+* to `icon`.
+*/
+function digit(n) {
+	return {
+		label: t(n, n),
+		icon: "hash",
+		legend: n
+	};
+}
+digit("0"), digit("1"), digit("2"), digit("3"), digit("4"), digit("5"), digit("6"), digit("7"), digit("8"), digit("9");
 DeviceFeature.MediaPlayerPower, DeviceFeature.MediaPlayerVolumeStep, DeviceFeature.MediaPlayerChannelStep, DeviceFeature.MediaPlayerMute, DeviceFeature.MediaPlayerStop, DeviceFeature.MediaPlayerNext, DeviceFeature.MediaPlayerPrevious;
 var btn = (idSuffix, row, col, init) => ({
 	idSuffix,
@@ -80550,6 +81280,34 @@ function runningFromMediaPlayer(state, previous, fetchedAt, transitionAt) {
 	if (state === "paused") return nativeSlice(false, "paused", previous, transitionAtMs, fetchedAt, null);
 	return nativeSlice(false, state, previous, transitionAtMs, fetchedAt, null);
 }
+/**
+* Propose a running threshold from a device's own power history (planning#405).
+*
+* Pure and deterministic: the same series gives the same answer. The series is
+* a HELD-VALUE step series — a point's value stands until the next point — which
+* is how device-history stores a gauge, so "time at a level" is exact, not a
+* count of samples.
+*
+*  1. idle floor F = time-weighted median; noise ceiling N = highest value seen
+*     near F. A device that is not near one level most of the time has no floor.
+*  2. coarse activity = above max(2N, N + 5 W); consecutive stretches are episodes.
+*  3. gaps between episodes split in two by the largest log-scale jump (>= 3x):
+*     the short ones are pauses INSIDE a run (a soak), the long ones separate runs.
+*  4. T = geometric mean of N and the plateau's 10th percentile, snapped to a
+*     grid a person would type; stop dwell covers the longest pause; start dwell
+*     covers the longest standby blip above T.
+*  5. the numbers are proved by REPLAY through the real `dwell` evaluation: each
+*     run must hold exactly one true interval and nothing may flap outside.
+*/
+var SECOND_MS = 1e3;
+var MINUTE_MS$1 = 60 * SECOND_MS;
+24 * (60 * MINUTE_MS$1);
+10 * MINUTE_MS$1;
+30 * SECOND_MS;
+60 * SECOND_MS;
+20 * MINUTE_MS$1;
+10 * SECOND_MS;
+10 * SECOND_MS;
 DeviceFeature.FanSpeed, DeviceFeature.FanPreset, DeviceFeature.FanDirection, DeviceFeature.FanOscillating, DeviceFeature.CoverStoppable, DeviceFeature.CoverPositionable, DeviceFeature.CoverTilt, DeviceFeature.ValvePositionable, DeviceFeature.MediaPlayerVolume, DeviceFeature.ClimateFanMode;
 SOURCE_CAPS.filter((cap) => cap !== "switch" && cap !== "motion");
 String.raw`rose\(active(\d+), changed(\d+), (\d+(?:\.\d+)?)\)`;
@@ -83655,6 +84413,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"coreBlocks.proposeRunningThreshold": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"coreBlocks.reportAutomationRun": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -84166,6 +84931,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"deviceExport.listInstances": {
+		capName: "device-export",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"deviceExport.listSupportedDeviceKinds": {
 		capName: "device-export",
 		capScope: "system",
@@ -93124,6 +93896,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"coreBlocks.proposeRunningThreshold": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"cover.close": [{
 		name: "deviceId",
 		form: "single",
@@ -95787,99 +96564,6 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
-/**
-* A saved Customize assignment (D936). The schema is the type: callers use
-* `z.infer`, they do not restate the shape.
-*/
-var OverrideSourceSchema = object({
-	addonId: string().min(1),
-	stableId: string().min(1),
-	cap: string().min(1),
-	fieldPath: string().min(1)
-});
-var CustomizeTransformDraftSchema = discriminatedUnion("kind", [
-	object({ kind: literal("identity") }),
-	object({ kind: literal("invert") }),
-	object({
-		kind: literal("threshold"),
-		comparison: _enum(["gte", "lte"]),
-		threshold: number(),
-		startDwellMs: number().nonnegative(),
-		stopDwellMs: number().nonnegative()
-	}),
-	object({
-		kind: literal("linear"),
-		scale: number(),
-		offset: number(),
-		clampMin: number().optional(),
-		clampMax: number().optional()
-	}),
-	object({
-		kind: literal("enum-map"),
-		mapping: record(string(), string().nullable())
-	}),
-	object({ kind: literal("number") })
-]);
-var ScalarOverrideDraftSchema = object({
-	kind: literal("scalar"),
-	cap: string().min(1),
-	targetId: string().min(1),
-	source: OverrideSourceSchema,
-	transform: CustomizeTransformDraftSchema
-});
-var KeyedArrayOverrideDraftSchema = object({
-	kind: literal("keyedArray"),
-	cap: string().min(1),
-	targetId: string().min(1),
-	key: string().min(1),
-	label: string().min(1),
-	fieldPath: string().min(1),
-	source: OverrideSourceSchema,
-	transform: CustomizeTransformDraftSchema
-});
-var PulseOverrideDraftSchema = object({
-	kind: literal("pulse"),
-	cap: string().min(1),
-	targetId: string().min(1),
-	enabled: boolean(),
-	debounceMs: number().nonnegative(),
-	edges: array(_enum([
-		"rising",
-		"button",
-		"native-event"
-	])).min(1).optional(),
-	sources: array(OverrideSourceSchema).min(1)
-});
-var SpanSourceDraftSchema = OverrideSourceSchema.extend({ mode: _enum([
-	"in-addition",
-	"confirm",
-	"replace"
-]).optional() });
-discriminatedUnion("kind", [
-	ScalarOverrideDraftSchema,
-	KeyedArrayOverrideDraftSchema,
-	PulseOverrideDraftSchema,
-	object({
-		kind: literal("span"),
-		cap: string().min(1),
-		targetId: string().min(1),
-		timeoutMs: number().nonnegative(),
-		cooldownMs: number().nonnegative().optional(),
-		sources: array(SpanSourceDraftSchema)
-	})
-]);
-object({
-	targetId: string().min(1),
-	configured: boolean(),
-	source: _enum(["native", "assigned"]),
-	state: _enum([
-		"active",
-		"stale",
-		"released",
-		"unavailable"
-	]),
-	reason: string().nullable()
-});
 var G711_SCALE_CORRECTION_DB = {
 	PCMU: 20 * Math.log10(4),
 	PCMA: 20 * Math.log10(8)
@@ -97710,20 +98394,5 @@ function haInstanceSettingsPortsOver(api) {
 		}
 	};
 }
-/** The brokerId → settings view of the instances: what a reader keeps per broker. */
-function settingsByBroker(rows) {
-	const out = /* @__PURE__ */ new Map();
-	for (const row of rows) if (row.brokerId !== null) out.set(row.brokerId, row.settings);
-	return out;
-}
-/** Read the instances, or report why not and answer nothing (a reader falls back to the legacy key). */
-async function listInstancesOrNothing(ports, onError) {
-	try {
-		return await ports.listInstances();
-	} catch (err) {
-		onError(errMsg(err));
-		return [];
-	}
-}
 //#endregion
-export { fanControlCapability as $, nodePin as $t, bestLocationMatch as A, scriptRunnerCapability as At, climateControlCapability as B, valveCapability as Bt, accessoriesCapability as C, quantityFromUnit as Ct, ambientLightSensorCapability as D, runningFromMediaPlayer as Dt, alarmPanelCapability as E, runningFromLawnMower as Et, buildAddonRouteProvider as F, temperatureSensorCapability as Ft, contactCapability as G, RecordSecretUnavailableError as Gt, connectivityCapability as H, waterHeaterCapability as Ht, buildDeviceAdminUrl as I, tryConvertDelta as It, deviceAdminLinkCapability as J, defineAddonMigrations as Jt, controlCapability as K, baseUnitOf as Kt, buttonCapability as L, tryConvertUnit as Lt, boardKeySourceCapability as M, smokeCapability as Mt, brightnessCapability as N, switchCapability as Nt, automationControlCapability as O, runningFromVacuumState as Ot, brokerCapability as P, tamperCapability as Pt, eventEmitterCapability as Q, isReadingQuantity as Qt, calendarSourceCapability as R, updateCapability as Rt, TargetSchema as S, publicEndpointReaderFrom as St, airQualitySensorCapability as T, runExportedAction as Tt, consumableFormOf as U, weatherCapability as Ut, colorCapability as V, vibrationCapability as Vt, consumableKindOf as W, BaseAddon as Wt, deviceExportCapability as X, defineRecordKinds as Xt, deviceAdoptionCapability as Y, defineEntryKind as Yt, enumSensorCapability as Z, entryBody as Zt, FanDirectionSchema as _, preconditionOf as _t, HA_PROVIDER_ADDON_ID$1 as a, number as an, ingestReading as at, PLUG_APPLIANCE_TYPES as b, pressureSensorCapability as bt, BaseDevice as c, string as cn, mediaPlayerCapability as ct, COCO_TO_MACRO as d, url as dn, notificationOutputCapability as dt, _enum as en, floodCapability as et, CameraSwitchIdSchema as f, DeviceFeature as fn, notifierCapability as ft, EnumSensorDateTimeFormatSchema as g, EventCategory as gn, powerMeterCapability as gt, ConsumableStatusSchema as h, errMsg as hn, parseAdminBase as ht, HA_BROKER_KIND as i, literal as in, imageCapability as it, binaryCapability as j, sendToExportedTarget as jt, batteryCapability as k, runningStateCapability as kt, BaseDeviceProvider as l, union as ln, motionCapability as lt, ConsumableItemSchema as m, DeviceType as mn, oauthIntegrationCapability as mt, listInstancesOrNothing as n, boolean as nn, humidifierCapability as nt, listHomeAssistantBrokers as o, object as on, lawnMowerControlCapability as ot, ConsumableFormSchema as p, DeviceRole as pn, numericSensorCapability as pt, coverCapability as q, createEvent as qt, settingsByBroker as r, discriminatedUnion as rn, humiditySensorCapability as rt, AlarmArmModeSchema as s, record as sn, lockControlCapability as st, haInstanceSettingsPortsOver as t, array as tn, gasCapability as tt, CAMERA_SWITCH_ORDER as u, unknown as un, normalizeUnit as ut, HvacModeSchema as v, prepareNotification as vt, addonRoutesCapability as w, resolveAttachmentUrls as wt, RUNNING_STATE_COLD as x, pruneDeletedEntities as xt, MediaPlayerRepeatSchema as y, presenceCapability as yt, carbonMonoxideCapability as z, vacuumControlCapability as zt };
+export { fanControlCapability as $, createEvent as $t, bestLocationMatch as A, runningFromMediaPlayer as At, climateControlCapability as B, tryConvertDelta as Bt, accessoriesCapability as C, pressureSensorCapability as Ct, ambientLightSensorCapability as D, resolveAttachmentUrls as Dt, alarmPanelCapability as E, quantityFromUnit as Et, buildAddonRouteProvider as F, smokeCapability as Ft, contactCapability as G, vibrationCapability as Gt, connectivityCapability as H, updateCapability as Ht, buildDeviceAdminUrl as I, statusInstanceOf as It, deviceAdminLinkCapability as J, BaseAddon as Jt, controlCapability as K, waterHeaterCapability as Kt, buttonCapability as L, switchCapability as Lt, boardKeySourceCapability as M, runningStateCapability as Mt, brightnessCapability as N, scriptRunnerCapability as Nt, automationControlCapability as O, runExportedAction as Ot, brokerCapability as P, sendToExportedTarget as Pt, eventEmitterCapability as Q, baseUnitOf as Qt, calendarSourceCapability as R, tamperCapability as Rt, TargetSchema as S, EventCategory as Sn, presenceCapability as St, airQualitySensorCapability as T, publicEndpointReaderFrom as Tt, consumableFormOf as U, vacuumControlCapability as Ut, colorCapability as V, tryConvertUnit as Vt, consumableKindOf as W, valveCapability as Wt, deviceExportCapability as X, RecordSecretUnavailableError as Xt, deviceAdoptionCapability as Y, REDACTED_SECRET as Yt, enumSensorCapability as Z, RevConflictError as Zt, HvacModeSchema as _, url as _n, oauthIntegrationCapability as _t, AlarmArmModeSchema as a, nodePin as an, humiditySensorCapability as at, RUNNING_STATE_COLD as b, DeviceType as bn, preconditionOf as bt, CAMERA_SWITCH_ORDER as c, boolean as cn, integrationInstancesCapability as ct, ConsumableFormSchema as d, number as dn, mediaPlayerCapability as dt, defineAddonMigrations as en, flattenNestedRecords as et, ConsumableItemSchema as f, object as fn, motionCapability as ft, FanDirectionSchema as g, unknown as gn, numericSensorCapability as gt, ExportInstanceUnknownError as h, union as hn, notifierCapability as ht, listHomeAssistantBrokers as i, isReadingQuantity as in, humidifierCapability as it, binaryCapability as j, runningFromVacuumState as jt, batteryCapability as k, runningFromLawnMower as kt, COCO_TO_MACRO as l, discriminatedUnion as ln, lawnMowerControlCapability as lt, EnumSensorDateTimeFormatSchema as m, string as mn, notificationOutputCapability as mt, HA_BROKER_KIND as n, defineRecordKinds as nn, floodCapability as nt, BaseDevice as o, _enum as on, imageCapability as ot, ConsumableStatusSchema as p, record as pn, normalizeUnit as pt, coverCapability as q, weatherCapability as qt, HA_PROVIDER_ADDON_ID$1 as r, entryBody as rn, gasCapability as rt, BaseDeviceProvider as s, array as sn, ingestReading as st, haInstanceSettingsPortsOver as t, defineEntryKind as tn, flattenPortsOver as tt, CameraSwitchIdSchema as u, literal as un, lockControlCapability as ut, MediaPlayerRepeatSchema as v, DeviceFeature as vn, parseAdminBase as vt, addonRoutesCapability as w, pruneDeletedEntities as wt, RecordIntegrationInstances as x, errMsg as xn, prepareNotification as xt, PLUG_APPLIANCE_TYPES as y, DeviceRole as yn, powerMeterCapability as yt, carbonMonoxideCapability as z, temperatureSensorCapability as zt };