@camstack/addon-provider-homematic 1.2.163 → 1.2.165

package/dist/addon.js

@@ -5464,7 +5464,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-63gM_1JR.mjs
+//#region ../types/dist/sleep-CeyhrcOk.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7531,6 +7531,7 @@ var BaseAddon = class {
 	* a warning and falls back rather than crashing boot.
 	*/
 	state(key, schema, fallback) {
+		this._declaredStateKeys.add(key);
 		return createDurableState({
 			key,
 			schema,
@@ -7546,6 +7547,96 @@ var BaseAddon = class {
 			} })
 		});
 	}
+	/** Durable-state keys this process registered through {@link state}. */
+	_declaredStateKeys = /* @__PURE__ */ new Set();
+	/**
+	* Stale-data audit: every global-settings key this addon still declares —
+	* constructor defaults, settings-schema fields (layout containers included),
+	* durable-state keys and the root of each `secretStatePaths` entry. Answered
+	* here, in the addon's own process, so the hub keeps no copy of it.
+	*/
+	async getDeclaredSettingsKeys() {
+		return { keys: [...this.declaredKeySet()].toSorted() };
+	}
+	declaredKeySet() {
+		const keys = new Set(Object.keys(this.defaults));
+		const schema = this.globalSettingsSchema();
+		if (schema) for (const section of schema.sections) for (const key of collectFieldKeys(section.fields)) keys.add(key);
+		for (const key of this._declaredStateKeys) keys.add(key);
+		for (const path of this.secretStatePaths) {
+			const root = path.split(/[.[]/, 1)[0];
+			if (root) keys.add(root);
+		}
+		return keys;
+	}
+	/**
+	* Stale-data audit: remove stored global-settings keys the addon no longer
+	* declares, and clear the keychain values their markers held — except a value
+	* a surviving key still points at. A declared or absent key is refused.
+	*/
+	async unsetStoredSettingsKeys(keys) {
+		const settings = this._ctx?.settings;
+		const raw = this.rawSettings();
+		if (!settings || !raw) return {
+			removed: [],
+			refused: keys.map((key) => ({
+				key,
+				reason: "no settings store"
+			})),
+			secretsCleared: 0
+		};
+		let stored;
+		try {
+			stored = await raw.readAddonStore();
+		} catch (error) {
+			const reason = `store unreadable: ${error instanceof Error ? error.message : "unknown"}`;
+			return {
+				removed: [],
+				refused: keys.map((key) => ({
+					key,
+					reason
+				})),
+				secretsCleared: 0
+			};
+		}
+		const declared = this.declaredKeySet();
+		const removed = [];
+		const refused = [];
+		for (const key of keys) {
+			const base = key.split("@", 1)[0] ?? key;
+			if (declared.has(base)) refused.push({
+				key,
+				reason: "still declared by the addon"
+			});
+			else if (!(key in stored)) refused.push({
+				key,
+				reason: "not stored"
+			});
+			else removed.push(key);
+		}
+		if (removed.length === 0) return {
+			removed,
+			refused,
+			secretsCleared: 0
+		};
+		const kept = /* @__PURE__ */ new Set();
+		const held = /* @__PURE__ */ new Set();
+		for (const [key, value] of Object.entries(stored)) {
+			const target = removed.includes(key) ? held : kept;
+			for (const ref of collectSecretMarkerRefs(value)) target.add(ref);
+		}
+		const refsToClear = [...held].filter((ref) => !kept.has(ref));
+		const patch = {};
+		for (const key of removed) patch[key] = void 0;
+		await settings.writeAddonStore(patch);
+		const secretsCleared = refsToClear.length > 0 && this._ctx?.secrets ? await this._ctx.secrets.delete(refsToClear) : 0;
+		await this.resolveConfig();
+		return {
+			removed,
+			refused,
+			secretsCleared
+		};
+	}
 	/** Per-device variant of {@link state}, backed by the per-device store. */
 	deviceState(deviceId, key, schema, fallback) {
 		return createDurableState({
@@ -7816,6 +7907,21 @@ function dropPerNodeFields(fields) {
 	}
 	return kept;
 }
+function collectFieldKeys(fields) {
+	const collected = [];
+	for (const field of fields) {
+		if (field.type === "group") {
+			collected.push(...collectFieldKeys(field.fields));
+			continue;
+		}
+		if (field.type === "sub-tabs") {
+			for (const tab of field.tabs) collected.push(...collectFieldKeys(tab.fields));
+			continue;
+		}
+		if ("key" in field && typeof field.key === "string") collected.push(field.key);
+	}
+	return collected;
+}
 function collectPerNodeFieldKeys(fields) {
 	const collected = [];
 	for (const field of fields) {
@@ -16165,8 +16271,172 @@ object({
 	quantity: ReadingQuantitySchema,
 	unit: string().min(1)
 });
-/** How a leaf compares a device field to a value. Derived from the field's
-*  `kind` in `deviceManager.getWireableFields`, never hand-maintained. */
+new Set([
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle"
+	},
+	{
+		id: "animal",
+		name: "Animal"
+	},
+	{
+		id: "package",
+		name: "Package"
+	}
+].map((l) => l.id));
+var COCO_TO_MACRO = {
+	mapping: {
+		person: "person",
+		bicycle: "vehicle",
+		car: "vehicle",
+		motorcycle: "vehicle",
+		airplane: "vehicle",
+		bus: "vehicle",
+		train: "vehicle",
+		truck: "vehicle",
+		boat: "vehicle",
+		bird: "animal",
+		cat: "animal",
+		dog: "animal",
+		horse: "animal",
+		sheep: "animal",
+		cow: "animal",
+		elephant: "animal",
+		bear: "animal",
+		zebra: "animal",
+		giraffe: "animal",
+		suitcase: "package",
+		backpack: "package",
+		handbag: "package"
+	},
+	preserveOriginal: false
+};
+/**
+* WHAT a detection-shaped leaf is about: one MACRO class (person, vehicle,
+* animal, package) plus an OPTIONAL label that narrows it.
+*
+* The taxonomy is `COCO_TO_MACRO` (and `CLASS_MAP_MACRO_TARGETS`) — never a
+* second list. The label that fits depends on the macro class:
+*
+*  - `animal`  → a sub-class (`dog`, `cat`, …);
+*  - `person`  → a known face (an identity of the `face-gallery`);
+*  - `vehicle` → a plate (its text) or a sub-class (`car`, `truck`, …);
+*  - `package` → a sub-class.
+*
+* `other` exists only so a class the taxonomy does not know (a custom model's
+* `forklift`) survives the conversion of a stored recipe without widening.
+*
+* A label is decided LATE (D683): face recognition and LPR land after the
+* detection starts. The track-lifecycle `update` event carries the newly
+* resolved `label` / `plateText`, which is why a leaf with a label fires when
+* the subject GETS it — not at the first detection.
+*/
+var SubClassLabelSchema = object({
+	kind: literal("sub-class"),
+	className: string().min(1)
+});
+var IdentityLabelSchema = object({
+	kind: literal("identity"),
+	/** The `face-gallery` identity id (stable across a rename). */
+	identityId: string().min(1),
+	/** The identity's name — what a track-lifecycle event carries as `label`. */
+	name: string().min(1)
+});
+var PlateLabelSchema = object({
+	kind: literal("plate"),
+	text: string().min(1)
+});
+function macroOf$1(className) {
+	return COCO_TO_MACRO.mapping[className.toLowerCase()] ?? className.toLowerCase();
+}
+/** A sub-class label must belong to the macro it is under. */
+function subClassBelongs(macro, label) {
+	return label === void 0 || macroOf$1(label.className) === macro;
+}
+var subClassOf = (macro) => SubClassLabelSchema.refine((l) => subClassBelongs(macro, l), { message: `that class is not a kind of ${macro} in the detection taxonomy` });
+var DetectionSubjectSchema = discriminatedUnion("macro", [
+	object({
+		macro: literal("animal"),
+		label: subClassOf("animal").optional()
+	}),
+	object({
+		macro: literal("person"),
+		label: IdentityLabelSchema.optional()
+	}),
+	object({
+		macro: literal("vehicle"),
+		label: discriminatedUnion("kind", [SubClassLabelSchema.refine((l) => subClassBelongs("vehicle", l), { message: "that class is not a kind of vehicle in the detection taxonomy" }), PlateLabelSchema]).optional()
+	}),
+	object({
+		macro: literal("package"),
+		label: subClassOf("package").optional()
+	}),
+	object({
+		macro: literal("other"),
+		className: string().min(1)
+	})
+]);
+/**
+* The subject of a PARKED object. The stationary registry's event carries a
+* class and a zone, no face and no plate — an identity or plate label there
+* could never match, so the schema refuses it instead of letting it sit dead.
+*/
+var StationarySubjectSchema = DetectionSubjectSchema.refine((s) => s.macro === "other" || s.label === void 0 || s.label.kind === "sub-class", { message: "a parked object carries no face or plate — only a class can narrow it" });
+/**
+* A stored class string as a subject: a macro name stays a macro; a raw class
+* the taxonomy files under a macro becomes that macro plus the sub-class label
+* (`dog` → animal / dog); anything else is `other`, kept verbatim.
+*/
+function subjectFromClassName(className) {
+	const name = className.trim().toLowerCase();
+	const macro = COCO_TO_MACRO.mapping[name];
+	if (new Set(Object.values(COCO_TO_MACRO.mapping)).has(name)) return macroOnly(name);
+	if (macro === void 0) return {
+		macro: "other",
+		className
+	};
+	const label = {
+		kind: "sub-class",
+		className: name
+	};
+	switch (macro) {
+		case "animal": return {
+			macro: "animal",
+			label
+		};
+		case "vehicle": return {
+			macro: "vehicle",
+			label
+		};
+		case "package": return {
+			macro: "package",
+			label
+		};
+		default: return {
+			macro: "other",
+			className
+		};
+	}
+}
+function macroOnly(macro) {
+	switch (macro) {
+		case "animal": return { macro: "animal" };
+		case "person": return { macro: "person" };
+		case "vehicle": return { macro: "vehicle" };
+		case "package": return { macro: "package" };
+		default: return {
+			macro: "other",
+			className: macro
+		};
+	}
+}
+/** How a state leaf compares a device field to a value. Derived from the
+*  field's `kind` in `deviceManager.getWireableFields`, never hand-maintained. */
 var AutomationConditionOperatorSchema = _enum([
 	"eq",
 	"ne",
@@ -16177,12 +16447,76 @@ var AutomationConditionOperatorSchema = _enum([
 	"contains",
 	"in"
 ]);
-var AutomationConditionLeafSchema = object({
-	kind: literal("condition"),
+/**
+* D8 compliance, and it is the reason a "becomes" leaf is not merely an event
+* subscription: it evaluates against the **state mirror**, which is reconciled,
+* and an event only WAKES the evaluation. A dropped event therefore DELAYS a
+* fire; it does not lose it.
+*/
+var DeviceBecomesLeafSchema = object({
+	kind: literal("device-becomes"),
+	deviceId: number().int().nonnegative(),
+	cap: string().min(1),
+	fieldPath: string().min(1),
+	/** Fire when the field takes this value. Omit to fire on any change. */
+	becomes: union([
+		string(),
+		number(),
+		boolean()
+	]).optional(),
+	/** Only on a CHANGE of value, not on every re-report. */
+	edge: boolean().optional(),
+	/** The new value must hold this long before it counts. */
+	forMs: number().int().min(0).max(864e5).optional(),
+	/** Collapse a burst into one occurrence. */
+	debounceMs: number().int().min(0).max(6e5).optional()
+});
+var DeviceEventLeafSchema = object({
+	kind: literal("device-event"),
+	/** An `EventCategory` value. */
+	category: string().min(1),
+	deviceId: number().int().nonnegative().optional()
+});
+var ScheduleLeafSchema = object({
+	kind: literal("schedule"),
+	cron: string().min(1).max(120)
+});
+var ManualLeafSchema = object({ kind: literal("manual") });
+var IntervalLeafSchema = object({
+	kind: literal("interval"),
+	minutes: number().int().min(1).max(1440)
+});
+var DetectionLeafSchema = object({
+	kind: literal("detection"),
+	/** One macro class each, optionally narrowed by a label; a track of any listed subject fires. */
+	subjects: array(DetectionSubjectSchema).min(1),
+	deviceIds: array(number().int().nonnegative()).min(1),
+	/** The track must have visited at least one of these zones. */
+	zones: array(string().min(1)).min(1).optional(),
+	/** Best-so-far confidence the track must reach. */
+	minScore: number().min(0).max(1).optional()
+});
+var StationaryLeafSchema = object({
+	kind: literal("stationary"),
+	deviceIds: array(number().int().nonnegative()).min(1),
+	subjects: array(StationarySubjectSchema).min(1).optional(),
+	zones: array(string().min(1)).min(1).optional(),
+	/** `appeared`: it became parked. `departed`: the registry retired it. */
+	phase: _enum(["appeared", "departed"])
+});
+/** "is": one device field compared to one value, NOW. */
+var DeviceIsLeafSchema = object({
+	kind: literal("device-is"),
 	deviceId: number().int().nonnegative(),
 	cap: string().min(1),
 	fieldPath: string().min(1),
 	operator: AutomationConditionOperatorSchema,
+	/**
+	* The value. A number on a quantity field is stored in the field's base unit
+	* (D944); a quantity value is the WRITE form, which the save boundary
+	* replaces with the converted number and `unit`. A leaf that still carries
+	* one is never evaluated (it fails).
+	*/
 	value: union([
 		string(),
 		number(),
@@ -16190,24 +16524,26 @@ var AutomationConditionLeafSchema = object({
 		array(union([string(), number()])),
 		QuantityValueSchema
 	]),
+	/** The unit the person picked for `value` (display only; `value` is in the base unit). */
 	unit: string().min(1).optional()
 });
-var AutomationConditionStationaryPresentSchema = object({
+/**
+* True when the camera currently has a PARKED object matching `subjects` in at
+* least one of `zones`. Reads the zone-analytics snapshot through the same
+* mirror as every other state leaf, so a dropped event never decides it (D49).
+*/
+var StationaryPresentLeafSchema = object({
 	kind: literal("stationary-present"),
 	deviceId: number().int().nonnegative(),
-	/** Class names; a macro class matches every raw class that maps to it. */
-	classes: array(string().min(1)).min(1).optional(),
-	/** The parked object must be in at least one of these zones. */
+	subjects: array(StationarySubjectSchema).min(1).optional(),
 	zones: array(string().min(1)).min(1).optional()
 });
 /**
-* The expression leaf, declared as a plain object rather than an intersection
-* with {@link ExpressionSourceSchema}: a discriminated union has to be able to
-* read `kind` off each option, and an intersection hides it. The author-time
-* validation is the SAME function `ExpressionSourceSchema` runs, so the two
-* cannot drift — an expression that one accepts, the other accepts.
+* The escape hatch: the bounded expression engine over named device bindings.
+* Declared as a plain object so a discriminated union can read `kind`; the
+* author-time validation is the SAME function `ExpressionSourceSchema` runs.
 */
-var AutomationConditionExpressionSchema = object({
+var ExpressionLeafSchema = object({
 	kind: literal("expression"),
 	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
 	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
@@ -16219,55 +16555,62 @@ var AutomationConditionExpressionSchema = object({
 		path: ["expr"]
 	});
 });
-var AutomationConditionSchema = lazy(() => discriminatedUnion("kind", [
+var AutomationWhenSchema = lazy(() => discriminatedUnion("kind", [
 	object({
 		kind: literal("all"),
-		children: array(AutomationConditionSchema)
+		children: array(AutomationWhenSchema)
 	}),
 	object({
 		kind: literal("any"),
-		children: array(AutomationConditionSchema)
+		children: array(AutomationWhenSchema)
 	}),
 	object({
 		kind: literal("not"),
-		child: AutomationConditionSchema
+		child: AutomationWhenSchema
 	}),
-	AutomationConditionLeafSchema,
-	AutomationConditionExpressionSchema,
-	AutomationConditionStationaryPresentSchema
+	DeviceBecomesLeafSchema,
+	DeviceEventLeafSchema,
+	ScheduleLeafSchema,
+	ManualLeafSchema,
+	IntervalLeafSchema,
+	DetectionLeafSchema,
+	StationaryLeafSchema,
+	DeviceIsLeafSchema,
+	StationaryPresentLeafSchema,
+	ExpressionLeafSchema
 ]));
 /**
-* What starts a run.
-*
-* D8 compliance, and it is the reason `device-state` is not merely an event
-* subscription: the trigger evaluates against the **state mirror**, which is
-* reconciled, and an event only WAKES the evaluation. A dropped event therefore
-* DELAYS a trigger; it does not lose it. `schedule` uses `croner` — the one
-* already in the repo — because `setInterval(24h)` drifts and "at 23:30" does
-* not.
-*/
-var AutomationTriggerSchema = discriminatedUnion("kind", [
+* The recipe shape before the single `when` tree: a flat list of triggers
+* (OR'd, each an instant) and an optional condition tree. Stored recipes —
+* the `AUTOMATION_RECIPE` literal of every block saved so far, and whatever an
+* older client still posts — are in this shape, so it stays READABLE here, and
+* {@link convertLegacyRecipe} turns it into the new one, losslessly and one
+* way. Nothing writes this shape any more.
+*
+*   `{ triggers: [t1…tn], conditions?: C }`
+*      → `when = all(any(t1…tn), C)`, or `any(t1…tn)` without `C`;
+*        a single trigger is not wrapped in `any`.
+*   a `condition` leaf → a `device-is` leaf (the "is" verb);
+*   a `device-state` trigger → a `device-becomes` leaf (the "becomes" verb);
+*   `classes: ['dog']` → the macro `animal` with the label `dog`.
+*/
+var LegacyTriggerSchema = discriminatedUnion("kind", [
 	object({
 		kind: literal("device-state"),
 		deviceId: number().int().nonnegative(),
 		cap: string().min(1),
 		fieldPath: string().min(1),
-		/** Fire when the field takes this value. Omit to fire on any change. */
 		becomes: union([
 			string(),
 			number(),
 			boolean()
 		]).optional(),
-		/** Only on a CHANGE of value, not on every re-report. */
 		edge: boolean().optional(),
-		/** The condition must hold this long before the run starts. */
 		forMs: number().int().min(0).max(864e5).optional(),
-		/** Collapse a burst into one run. */
 		debounceMs: number().int().min(0).max(6e5).optional()
 	}),
 	object({
 		kind: literal("device-event"),
-		/** An `EventCategory` value. */
 		category: string().min(1),
 		deviceId: number().int().nonnegative().optional()
 	}),
@@ -16278,25 +16621,16 @@ var AutomationTriggerSchema = discriminatedUnion("kind", [
 	object({ kind: literal("manual") }),
 	object({
 		kind: literal("detection"),
-		/** Class names. A macro class (`animal`, `vehicle`, `person`, `package`)
-		*  matches every raw class that maps to it; any other name matches
-		*  exactly. */
 		classes: array(string().min(1)).min(1),
 		deviceIds: array(number().int().nonnegative()).min(1),
-		/** The track must have visited at least one of these zones. */
 		zones: array(string().min(1)).min(1).optional(),
-		/** Best-so-far confidence the track must reach. */
 		minScore: number().min(0).max(1).optional()
 	}),
 	object({
 		kind: literal("stationary"),
 		deviceIds: array(number().int().nonnegative()).min(1),
-		/** Class names; a macro class matches like the detection trigger. */
 		classes: array(string().min(1)).min(1).optional(),
-		/** The parked object must be in at least one of these zones. */
 		zones: array(string().min(1)).min(1).optional(),
-		/** `appeared`: it became parked. `departed`: the registry retired it.
-		*  The vocabulary of `PipelineAnalyticsStationaryChanged`. */
 		phase: _enum(["appeared", "departed"])
 	}),
 	object({
@@ -16304,6 +16638,143 @@ var AutomationTriggerSchema = discriminatedUnion("kind", [
 		minutes: number().int().min(1).max(1440)
 	})
 ]);
+var LegacyConditionLeafSchema = object({
+	kind: literal("condition"),
+	deviceId: number().int().nonnegative(),
+	cap: string().min(1),
+	fieldPath: string().min(1),
+	operator: AutomationConditionOperatorSchema,
+	value: union([
+		string(),
+		number(),
+		boolean(),
+		array(union([string(), number()])),
+		QuantityValueSchema
+	]),
+	unit: string().min(1).optional()
+});
+var LegacyStationaryPresentSchema = object({
+	kind: literal("stationary-present"),
+	deviceId: number().int().nonnegative(),
+	classes: array(string().min(1)).min(1).optional(),
+	zones: array(string().min(1)).min(1).optional()
+});
+var LegacyExpressionSchema = object({
+	kind: literal("expression"),
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+var LegacyConditionSchema = lazy(() => discriminatedUnion("kind", [
+	object({
+		kind: literal("all"),
+		children: array(LegacyConditionSchema)
+	}),
+	object({
+		kind: literal("any"),
+		children: array(LegacyConditionSchema)
+	}),
+	object({
+		kind: literal("not"),
+		child: LegacyConditionSchema
+	}),
+	LegacyConditionLeafSchema,
+	LegacyExpressionSchema,
+	LegacyStationaryPresentSchema
+]));
+function convertTrigger(trigger) {
+	switch (trigger.kind) {
+		case "device-state": return {
+			...trigger,
+			kind: "device-becomes"
+		};
+		case "detection": {
+			const { classes, ...rest } = trigger;
+			return {
+				...rest,
+				subjects: classes.map(subjectFromClassName)
+			};
+		}
+		case "stationary": {
+			const { classes, ...rest } = trigger;
+			return {
+				...rest,
+				...classes === void 0 ? {} : { subjects: classes.map(subjectFromClassName) }
+			};
+		}
+		default: return trigger;
+	}
+}
+/** An old condition tree as a `when` subtree: `condition` → "is", classes → subjects. */
+function convertLegacyCondition(condition) {
+	switch (condition.kind) {
+		case "condition": return {
+			...condition,
+			kind: "device-is"
+		};
+		case "stationary-present": {
+			const { classes, ...rest } = condition;
+			return {
+				...rest,
+				...classes === void 0 ? {} : { subjects: classes.map(subjectFromClassName) }
+			};
+		}
+		case "expression": return condition;
+		case "not": return {
+			kind: "not",
+			child: convertLegacyCondition(condition.child)
+		};
+		case "all":
+		case "any": return {
+			kind: condition.kind,
+			children: condition.children.map(convertLegacyCondition)
+		};
+	}
+}
+/** `all(any(t1…tn), C)`, or `any(t1…tn)`; a single trigger is not wrapped in `any`. */
+function convertLegacyWhen(half) {
+	const leaves = half.triggers.map(convertTrigger);
+	const first = leaves[0];
+	const triggers = leaves.length === 1 && first !== void 0 ? first : {
+		kind: "any",
+		children: leaves
+	};
+	if (half.conditions === void 0) return triggers;
+	return {
+		kind: "all",
+		children: [triggers, convertLegacyCondition(half.conditions)]
+	};
+}
+/**
+* The automation RECIPE — what a visually-authored automation is, before it
+* becomes code.
+*
+* This is the data half of `docs/design/2026-08-08-automation-scripts-custom-devices.md`
+* Phase 6. A recipe is not an engine and never evaluates anything: it is a
+* declarative description that {@link generateAutomationBlock} compiles to the
+* TypeScript of an ordinary core block. There is therefore no second rule
+* engine, no second store and no second runtime — the block runner is the
+* runtime, `core_blocks` is the store (§2.1).
+*
+* Two parts:
+*
+*  - **`when`** — ONE tree (`./when.ts`) of all/any/not over event leaves
+*    (instants) and state leaves (durations). It replaces the flat trigger list
+*    plus the separate condition tree; the firing rule is in that file and in
+*    ADR "one tree".
+*  - **Actions** — `NcRuleActionSchema`'s two steps, plus the `{kind:'code'}`
+*    fragment of §3.2.2. See {@link AutomationActionSchema} for the ONE place
+*    this had to diverge from "verbatim", and why.
+*
+* A recipe stored in the old shape (`triggers` + `conditions`) still LOADS:
+* {@link AutomationRecipeSchema} (the parse-anywhere schema) converts it on parse. Nothing writes it.
+*/
 /**
 * One action step.
 *
@@ -16406,69 +16877,49 @@ var AutomationRunModeSchema = discriminatedUnion("mode", [
 		minutes: number().int().min(1).max(1440)
 	})
 ]);
-var AutomationRecipeSchema = object({
-	triggers: array(AutomationTriggerSchema),
-	conditions: AutomationConditionSchema.optional(),
+var CurrentAutomationRecipeSchema = object({
+	when: AutomationWhenSchema,
 	actions: array(AutomationActionSchema),
 	runMode: AutomationRunModeSchema.optional(),
 	/** How many run traces the automation keeps (default {@link DEFAULT_TRACE_KEEP}). */
 	keepTraces: number().int().min(1).max(100).optional()
 });
-new Set([
-	{
-		id: "person",
-		name: "Person"
-	},
-	{
-		id: "vehicle",
-		name: "Vehicle"
-	},
-	{
-		id: "animal",
-		name: "Animal"
-	},
-	{
-		id: "package",
-		name: "Package"
-	}
-].map((l) => l.id));
-var COCO_TO_MACRO = {
-	mapping: {
-		person: "person",
-		bicycle: "vehicle",
-		car: "vehicle",
-		motorcycle: "vehicle",
-		airplane: "vehicle",
-		bus: "vehicle",
-		train: "vehicle",
-		truck: "vehicle",
-		boat: "vehicle",
-		bird: "animal",
-		cat: "animal",
-		dog: "animal",
-		horse: "animal",
-		sheep: "animal",
-		cow: "animal",
-		elephant: "animal",
-		bear: "animal",
-		zebra: "animal",
-		giraffe: "animal",
-		suitcase: "package",
-		backpack: "package",
-		handbag: "package"
-	},
-	preserveOriginal: false
-};
+/** A recipe as it was stored before the single tree. Read-only: nothing writes this. */
+var LegacyAutomationRecipeSchema = object({
+	triggers: array(LegacyTriggerSchema),
+	conditions: LegacyConditionSchema.optional(),
+	actions: array(AutomationActionSchema),
+	runMode: AutomationRunModeSchema.optional(),
+	keepTraces: number().int().min(1).max(100).optional()
+});
+/** The old shape as the new one, lossless. */
+function convertLegacyRecipe(legacy) {
+	const { triggers, conditions, ...rest } = legacy;
+	return {
+		when: convertLegacyWhen({
+			triggers,
+			conditions
+		}),
+		...rest
+	};
+}
+/**
+* Where recipes are PARSED (the core-blocks cap, the MCP tool, the literal a
+* saved block carries): the new shape as it is, or the old shape converted to
+* it. The output type is always the new one.
+*/
+var AutomationRecipeSchema = union([CurrentAutomationRecipeSchema, LegacyAutomationRecipeSchema.transform(convertLegacyRecipe)]);
 new Set(Object.values(COCO_TO_MACRO.mapping));
 /**
 * Run traces — what an automation (or, later, an Action run) DID, node by node,
 * so the editor can paint every block green or red with its reason.
 *
-* A trace is data, not a log: it covers the WHOLE tree — the trigger stage,
-* every condition node (containers and leaves, including the ones a
-* short-circuit never reached), the run-mode verdict and every action step —
-* each addressed by a stable path (`conditions.0.1`, `actions.2`, or `steps.N`
-* for an Action run). Skipped
+* A trace is data, not a log: it covers the WHOLE tree — the event leaf that
+* fired, every node of the `when` tree (containers and leaves, including the
+* ones a short-circuit never reached), the run-mode verdict and every action
+* step — each addressed by a stable path (`when.0.1`, `actions.2`, or `steps.N`
+* for an Action run). Traces written before the single tree carry
+* `conditions.*` paths and still parse. Skipped
 * evaluations are traced too, and identical consecutive skips collapse into a
 * repeat count so a trigger that fails every 5 minutes cannot flush real runs.
 *
@@ -16500,6 +16951,8 @@ var TraceNodeOutcomeSchema = _enum([
 ]);
 var AutomationTriggerTraceSchema = object({
 	kind: string().min(1),
+	/** The event leaf that fired (`when`, `when.0.1`); absent on traces written before the single tree. */
+	path: string().min(1).optional(),
 	outcome: _enum(["pass", "fail"]),
 	/** Why an event was rejected ("class person not in [dog]") or what fired. */
 	reason: string(),
@@ -16507,15 +16960,23 @@ var AutomationTriggerTraceSchema = object({
 	vars: record(string(), TraceValueSchema)
 });
 var AutomationConditionTraceNodeSchema = object({
-	/** `conditions` for the root, `conditions.<i>` for its i-th child, … */
+	/** `when` for the root, `when.<i>` for its i-th child, … (`conditions…` on an old trace). */
 	path: string().min(1),
 	kind: _enum([
 		"all",
 		"any",
 		"not",
 		"condition",
+		"device-is",
 		"expression",
-		"stationary-present"
+		"stationary-present",
+		"device-becomes",
+		"device-event",
+		"schedule",
+		"interval",
+		"manual",
+		"detection",
+		"stationary"
 	]),
 	outcome: TraceNodeOutcomeSchema,
 	reason: string(),
@@ -16549,6 +17010,12 @@ var AutomationStepTraceSchema = object({
 	deviceId: number().int().optional(),
 	startedAt: number().optional(),
 	endedAt: number().optional(),
+	/**
+	* The parameters the step SENT, after `{{vars.x}}` substitution — what the
+	* device was actually asked. Bounded like trigger `vars`; a secret parameter
+	* is shown as {@link REDACTED_ARG}. Absent on traces written before it existed.
+	*/
+	args: record(string(), TraceValueSchema).optional(),
 	outcome: _enum([
 		"ok",
 		"error",
@@ -17298,6 +17765,23 @@ method(object({
 	addonId: string(),
 	nodeId: string().optional()
 }), SettingsSchemaWithValuesSchema.nullable()), method(object({
+	addonId: string(),
+	nodeId: string().optional()
+}), object({ keys: array(string()) }).nullable(), { auth: "admin" }), method(object({
+	addonId: string(),
+	nodeId: string().optional(),
+	keys: array(string())
+}), object({
+	removed: array(string()),
+	refused: array(object({
+		key: string(),
+		reason: string()
+	})),
+	secretsCleared: number()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	addonId: string(),
 	deviceId: number(),
 	nodeId: string().optional()
@@ -21327,6 +21811,8 @@ var StorageKindSchema = object({
 		"orphaned",
 		"dropped"
 	]),
+	/** An owner declared this kind since the engine started. */
+	declaredThisBoot: boolean(),
 	/** `null` when the caller asked for no counts (`counts: false`). */
 	rows: number().int().nonnegative().nullable(),
 	/** Rows x the average size of a sample; null for an empty kind. */
@@ -21338,6 +21824,51 @@ var StorageKindSchema = object({
 	/** The whole declaration, secret paths and entry descriptor included (the entries service builds its handle from it). */
 	declaration: RecordKindDeclarationSchema
 });
+_enum([
+	"orphaned",
+	"stale",
+	"unknown"
+]);
+/** A record kind nobody declared since its owner started, or whose owner is gone. */
+var StaleKindFindingSchema = object({
+	owner: string(),
+	kind: string(),
+	/** `unknown`: the owner could not be judged (not running, or its state unreadable) - never dropped. */
+	verdict: _enum(["orphaned", "unknown"]),
+	reason: string(),
+	rows: number().int().nonnegative().nullable(),
+	/** local-auth's tables are never dropped by this audit. */
+	protected: boolean()
+});
+/** A stored global-settings key the running addon no longer declares. */
+var StaleSettingsKeyFindingSchema = object({
+	addonId: string(),
+	/** The stored key as written, a per-node `<key>@<nodeId>` suffix included. */
+	key: string(),
+	/**
+	* Keychain refs whose ONLY marker sits under this key: in use by stale data,
+	* not orphans yet. Removing the key releases them.
+	*/
+	secretRefs: array(string())
+});
+/** An addon the audit could not judge, with the reason. Never reported as stale. */
+var StaleUnknownSchema = object({
+	subject: string(),
+	reason: string()
+});
+var StaleDataReportSchema = object({
+	/** Epoch ms of the last finished scan; `null` before the first. */
+	scannedAt: number().nullable(),
+	scanning: boolean(),
+	trigger: _enum([
+		"boot",
+		"interval",
+		"manual"
+	]).nullable(),
+	kinds: array(StaleKindFindingSchema),
+	settingsKeys: array(StaleSettingsKeyFindingSchema),
+	unknown: array(StaleUnknownSchema)
+});
 method(object({ ownerPrefix: string().min(1).optional() }), object({ tables: array(StorageTableSchema) }), { auth: "admin" }), method(object({
 	owner: string().min(1).optional(),
 	/** `false` skips the per-kind row count (a catalog read only). Default true. */
@@ -21345,7 +21876,30 @@ method(object({ ownerPrefix: string().min(1).optional() }), object({ tables: arr
 }), object({ kinds: array(StorageKindSchema) }), { auth: "admin" }), method(RecordQueryInputSchema.extend({
 	owner: string().min(1),
 	kind: RecordKindNameSchema
-}), RecordQueryResultSchema, { auth: "admin" });
+}), RecordQueryResultSchema, { auth: "admin" }), method(object({}), StaleDataReportSchema, { auth: "admin" }), method(object({}), StaleDataReportSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	owner: string().min(1),
+	kind: RecordKindNameSchema
+}), object({
+	deleted: number().int().nonnegative(),
+	secretsReleased: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({
+	addonId: string().min(1),
+	key: string().min(1)
+}), object({
+	removed: boolean(),
+	secretsCleared: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+});
 /**
 * record-entries - the ONE admin surface for every list of user-created entries
 * (D881): notification targets, brokers, LLM profiles, anything an addon
@@ -21484,6 +22038,12 @@ method(object({
 }), method(object({ deviceId: number().int() }), object({ refs: array(string()).readonly() }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	refs: RefListSchema,
+	onBehalfOf: string().min(1)
+}), object({ released: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({}), array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }), method(object({}), KeychainStateSchema, { auth: "admin" });
 /**
 * device-history — the ONE mechanism for numeric history (D850).
@@ -22386,7 +22946,9 @@ var DiscoveredChildDeviceSchema = lazy(() => object({
 	/** Upstream-system identity + rendering hints for the candidate. */
 	sourceInfo: SourceInfoSchema.optional(),
 	/** Nested entity-children for accordion preview — integrations populate, Hubs omit. */
-	children: array(DiscoveredChildDeviceSchema).readonly().optional()
+	children: array(DiscoveredChildDeviceSchema).readonly().optional(),
+	/** `childNativeId` of the gateway candidate in the same list this device sits behind. */
+	parentStableId: string().optional()
 }));
 /**
 * Status block — populated by the integration after each
@@ -42769,6 +43331,79 @@ object({
 	metadata: record(string(), unknown()).optional()
 });
 /**
+* HOW a provider can be found on the network. The provider only DECLARES the
+* mode; the `local-network` scan engine runs it once for every provider that
+* asked (one multicast browse, one host sweep) and hands the raw hits back to
+* `classifyDiscoveryHits`. A provider never opens a discovery socket itself,
+* except through a `custom` mode.
+*/
+var DiscoveryModeSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("mdns"),
+		/** DNS-SD service type, e.g. `_esphomelib._tcp`. */
+		serviceType: string().min(1),
+		/** Regular expression an instance name must match (case-insensitive). */
+		instancePattern: string().optional()
+	}),
+	object({
+		kind: literal("ws-discovery"),
+		/** Probe types (e.g. `dn:NetworkVideoTransmitter`); omitted = any device. */
+		types: array(string()).optional()
+	}),
+	object({
+		kind: literal("ssdp"),
+		searchTarget: string().min(1)
+	}),
+	object({
+		kind: literal("udp-broadcast"),
+		port: number().int().min(1).max(65535),
+		payloadHex: string().regex(/^([0-9a-fA-F]{2})*$/),
+		/** Port replies arrive on, when the device answers somewhere other than the source port. */
+		listenPort: number().int().min(1).max(65535).optional()
+	}),
+	object({
+		kind: literal("http-probe"),
+		port: number().int().min(1).max(65535),
+		path: string().startsWith("/"),
+		method: _enum(["GET", "POST"]).default("GET"),
+		bodyText: string().optional(),
+		contentType: string().optional(),
+		tls: boolean().default(false),
+		/** Status codes that count as a hit. Omitted = any HTTP answer. */
+		acceptStatus: array(number().int()).optional()
+	}),
+	object({
+		kind: literal("custom"),
+		/** Why the engine cannot do it (an allowlisted exception, e.g. a vendor UDP protocol). */
+		reason: string().min(1)
+	})
+]);
+/** What the engine saw on the wire for ONE declared mode; the provider classifies it. */
+var DiscoveryHitSchema = object({
+	/** Index into the provider's own `getDiscoveryModes()` array. */
+	modeIndex: number().int().min(0),
+	host: string(),
+	port: number().int(),
+	http: object({
+		status: number().int(),
+		headers: record(string(), string()),
+		/** At most 16 KiB. */
+		bodyText: string()
+	}).optional(),
+	mdns: object({
+		instance: string(),
+		host: string(),
+		port: number().int(),
+		txt: record(string(), string())
+	}).optional(),
+	udp: object({ payloadHex: string() }).optional(),
+	wsd: object({
+		xaddrs: array(string()),
+		types: array(string()),
+		scopes: array(string())
+	}).optional()
+});
+/**
 * Candidate handed back from discovery and accepted by
 * `adoptDiscoveredDevice`. Shape mirrors the in-process
 * `DiscoveredDevice` interface used by `DeviceDiscovery`.
@@ -42803,7 +43438,17 @@ var DiscoveryCandidateSchema = object({
 	/** Numeric id of the device this candidate was matched to. Set with `alreadyOnboarded`. */
 	onboardedDeviceId: number().optional(),
 	/** Operator-facing name of the matched device, so the UI can say WHICH one it is. */
-	onboardedName: string().optional()
+	onboardedName: string().optional(),
+	/**
+	* This candidate is an INTEGRATION to set up (a gateway, a hub, a controller),
+	* not a device to adopt. Replaces the `prefilledConfig.setupIntegration` marker,
+	* which is still read for one release.
+	*/
+	setupIntegration: boolean().optional(),
+	/** `stableId` of the gateway candidate this device was found BEHIND. */
+	parentStableId: string().optional(),
+	/** `false` = shown for context but not pickable. Default true. */
+	selectable: boolean().optional()
 });
 /**
 * Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
@@ -42900,6 +43545,24 @@ var deviceProviderCapability = {
 			auth: "admin"
 		}),
 		/**
+		* How this provider is found on the network. `[]` = the provider has no
+		* declarative mode and keeps answering `discoverDevices` itself.
+		*/
+		getDiscoveryModes: method(object({}), array(DiscoveryModeSchema)),
+		/**
+		* Turn the engine's raw hits into candidates. The provider may make
+		* follow-up UNICAST requests to a hit host (an authenticated call, an
+		* identity check) and never sweeps a subnet. `params` is the per-scan form
+		* from `getDiscoveryParamsSchema`.
+		*/
+		classifyDiscoveryHits: method(object({
+			hits: array(DiscoveryHitSchema),
+			params: record(string(), unknown()).optional()
+		}), array(DiscoveryCandidateSchema), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Optional form schema (`ConfigUISchema`) for the EXTRA per-scan inputs a
 		* provider accepts (e.g. Gree's broadcast address for a different subnet).
 		* `null` when the provider takes no extra scan params — the generic
@@ -43664,17 +44327,23 @@ method(object({
 }), method(object({}), object({ providers: array(object({
 	addonId: string(),
 	label: string()
-})).readonly() }), { auth: "admin" }), method(object({}), object({ groups: array(object({
-	addonId: string(),
-	label: string(),
-	candidates: array(DiscoveryCandidateSchema).readonly(),
-	error: string().nullable()
-})).readonly() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
+})).readonly() }), { auth: "admin" }), method(
+	/** `subnets`: extra CIDRs for THIS scan, on top of the hub's own and the saved list. */
+	object({ subnets: array(string()).optional() }),
+	object({ groups: array(object({
+		addonId: string(),
+		label: string(),
+		candidates: array(DiscoveryCandidateSchema).readonly(),
+		error: string().nullable()
+	})).readonly() }),
+	{
+		kind: "mutation",
+		auth: "admin"
+	}
+), method(object({
 	addonId: string(),
-	params: record(string(), unknown()).optional()
+	params: record(string(), unknown()).optional(),
+	subnets: array(string()).optional()
 }), object({ candidates: array(DiscoveryCandidateSchema).readonly() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -56341,6 +57010,12 @@ var TerminalInstanceInfoSchema = object({
 	instanceId: string(),
 	cameraStableId: string(),
 	nodeId: string(),
+	/**
+	* False while the node the instance is bound to is not in the cluster
+	* topology (forgotten, renamed, re-paired). The instance is kept; the
+	* operator re-points it with `updateInstance({ targetNodeId })`.
+	*/
+	nodeInCluster: boolean(),
 	profileId: string(),
 	profileLabel: string(),
 	name: string(),
@@ -56390,6 +57065,8 @@ method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }),
 	auth: "admin"
 }), method(object({
 	instanceId: string().min(1),
+	/** Re-point the instance to another node; the profile must exist there. */
+	targetNodeId: string().min(1).max(256).optional(),
 	name: string().trim().min(1).max(160).optional(),
 	executable: string().max(1024).optional(),
 	args: array(string().max(2048)).max(64).optional(),
@@ -63016,7 +63693,9 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 	id: string(),
 	settings: record(string(), unknown()),
 	/** Keys the form's schema declares secret (by type) — keychain-stored (D787). */
-	secretKeys: array(string()).optional()
+	secretKeys: array(string()).optional(),
+	/** The integration's own addon applies the change in-process and asks the hub not to respawn it. */
+	skipRestart: boolean().optional()
 }), object({ success: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -63644,6 +64323,39 @@ var TlsStatusSchema = object({
 		hasCa: boolean()
 	}).nullable()
 });
+/** One provider's ask of the scan engine: the modes it declared. */
+var ScanRequestSchema = object({
+	providerId: string().min(1),
+	modes: array(DiscoveryModeSchema)
+});
+var ScanErrorSchema = object({
+	/** Absent for a failure that is the scan's own (a bad subnet, a socket that would not open). */
+	providerId: string().optional(),
+	/** The mode family that failed (`mdns`, `http-probe`, …). */
+	mode: string().optional(),
+	message: string()
+});
+/** What one scan did, per mode family; the engine logs the same numbers once. */
+var ScanStatsSchema = object({
+	hostsProbed: number().int(),
+	hits: number().int(),
+	timeouts: number().int(),
+	byMode: record(string(), object({
+		probed: number().int(),
+		hits: number().int(),
+		timeouts: number().int()
+	}))
+});
+var ScanNetworkResultSchema = object({
+	hits: array(object({
+		providerId: string(),
+		hit: DiscoveryHitSchema
+	})),
+	/** CIDRs actually covered: the hub's own /24s, the saved list and the per-call list. */
+	subnetsScanned: array(string()),
+	errors: array(ScanErrorSchema),
+	stats: ScanStatsSchema
+});
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
 	/**
 	* LEGACY HINT — do not send from new code. Kept optional so clients
@@ -63698,6 +64410,16 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 }), method(_void(), object({ pem: string() })), method(_void(), TlsStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	requests: array(ScanRequestSchema),
+	subnets: array(string()).optional()
+}), ScanNetworkResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 9e4
+}), method(_void(), object({ subnets: array(string()) }), { auth: "admin" }), method(object({ subnets: array(string()) }), object({ subnets: array(string()) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(_void(), TlsStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -73280,6 +74002,17 @@ var BaseDeviceProvider = class extends BaseAddon {
 	async discoverDevices(_input) {
 		return [];
 	}
+	/**
+	* How the scan engine finds this provider. Default `[]`: the provider is
+	* not migrated and keeps answering `discoverDevices` itself.
+	*/
+	async getDiscoveryModes() {
+		return [];
+	}
+	/** Turn the scan engine's raw hits into candidates. Default: none. */
+	async classifyDiscoveryHits(_input) {
+		return [];
+	}
 	/** Extra per-scan input form (e.g. a broadcast address for another subnet).
 	*  Null = no extra params. Override in providers that support scoped scans. */
 	async getDiscoveryParamsSchema() {
@@ -74148,6 +74881,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"addonSettings.getDeclaredSettingsKeys": {
+		capName: "addon-settings",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"addonSettings.getDeviceSettings": {
 		capName: "addon-settings",
 		capScope: "system",
@@ -74169,6 +74909,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"addonSettings.unsetStoredSettingsKeys": {
+		capName: "addon-settings",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"addonSettings.updateDeviceSettings": {
 		capName: "addon-settings",
 		capScope: "system",
@@ -76584,6 +77331,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"deviceProvider.classifyDiscoveryHits": {
+		capName: "device-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"deviceProvider.createDevice": {
 		capName: "device-provider",
 		capScope: "system",
@@ -76612,6 +77366,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"deviceProvider.getDiscoveryModes": {
+		capName: "device-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"deviceProvider.getDiscoveryParamsSchema": {
 		capName: "device-provider",
 		capScope: "system",
@@ -77389,6 +78150,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"keychain.releaseRecordRefs": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"keychain.resolve": {
 		capName: "keychain",
 		capScope: "system",
@@ -77809,6 +78577,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"localNetwork.getScanSubnets": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"localNetwork.getTlsStatus": {
 		capName: "local-network",
 		capScope: "system",
@@ -77858,6 +78633,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"localNetwork.scanNetwork": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"localNetwork.setAddressRole": {
 		capName: "local-network",
 		capScope: "system",
@@ -77879,6 +78661,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"localNetwork.setScanSubnets": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"localNetwork.setViewerEndpoints": {
 		capName: "local-network",
 		capScope: "system",
@@ -82100,6 +82889,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"storageAdmin.dropOrphanedKind": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
 	"storageAdmin.listKinds": {
 		capName: "storage-admin",
 		capScope: "system",
@@ -82121,6 +82917,27 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"storageAdmin.scanStaleData": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"storageAdmin.staleDataReport": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"storageAdmin.unsetStaleSettingsKey": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"storageEvictable.evict": {
 		capName: "storage-evictable",
 		capScope: "system",
@@ -95072,36 +95889,22 @@ function buildHmAdoptionProvider(deps) {
 		}
 	};
 }
-//#endregion
-//#region src/homematic-ccu-discovery.ts
-/** `prefilledConfig` flag: the scan opens the integration form instead of adopting a device. */
-var HOMEMATIC_SETUP_INTEGRATION_KEY = "setupIntegration";
-var JSON_RPC_PATH$2 = "/api/homematic.cgi";
-/** How long one host gets to answer before the sweep moves on. */
-var HOMEMATIC_DISCOVERY_TIMEOUT_MS = 1200;
-/** Upper bound on the hosts one scan probes, so a wide interface list cannot flood the LAN. */
-var MAX_HOSTS = 1024;
-var fetchPost = async (url, body, timeoutMs) => {
-	const response = await fetch(url, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body,
-		signal: AbortSignal.timeout(timeoutMs)
-	});
-	return {
-		status: response.status,
-		text: await response.text()
-	};
-};
-function osAddresses() {
-	const out = [];
-	for (const list of Object.values((0, node_os.networkInterfaces)())) for (const a of list ?? []) out.push({
-		family: String(a.family),
-		address: a.address,
-		internal: a.internal
-	});
-	return out;
-}
+/** The question the WebUI asks before it shows a login; the engine sends it to every host once. */
+var HOMEMATIC_DISCOVERY_MODES = [{
+	kind: "http-probe",
+	port: 80,
+	path: "/api/homematic.cgi",
+	method: "POST",
+	bodyText: JSON.stringify({
+		method: "CCU.getAuthEnabled",
+		params: {},
+		jsonrpc: "1.1",
+		id: 0
+	}),
+	contentType: "application/json",
+	tls: false,
+	acceptStatus: [200]
+}];
 /**
 * Read the answer of `CCU.getAuthEnabled`, the question the WebUI asks before
 * it shows a login. A CCU answers a boolean; one that already requires a login
@@ -95128,63 +95931,26 @@ function parseAuthEnabledAnswer(status, text) {
 	if (result === false || result === "false") return { authEnabled: false };
 	return null;
 }
-/**
-* The hosts to ask: every address of the /24 of each external IPv4 address of
-* this machine, minus the network and broadcast addresses and this machine itself.
-*/
-function lanHostsToProbe(addresses) {
-	const own = /* @__PURE__ */ new Set();
-	const subnets = [];
-	for (const a of addresses) {
-		if (a.internal || a.family !== "IPv4" && a.family !== "4") continue;
-		own.add(a.address);
-		const prefix = a.address.split(".").slice(0, 3).join(".");
-		if (prefix.split(".").length === 3 && !subnets.includes(prefix)) subnets.push(prefix);
-	}
-	const hosts = [];
-	for (const prefix of subnets) for (let last = 1; last <= 254; last++) {
-		const host = `${prefix}.${last}`;
-		if (!own.has(host)) hosts.push(host);
-	}
-	return hosts.slice(0, MAX_HOSTS);
-}
 /** Slugify a host into a readable, stable id fragment. */
 function slugifyHost(value) {
 	return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
-/**
-* Sweep the local /24 networks for CCU3 / RaspberryMatic WebUIs: each host is
-* asked `CCU.getAuthEnabled` on the JSON-RPC endpoint, with a short timeout and
-* a bounded number of probes in flight.
-*/
-async function browseHomematicCcus(options = {}) {
-	const { addresses = osAddresses, post = fetchPost, concurrency = 64, timeoutMs = HOMEMATIC_DISCOVERY_TIMEOUT_MS } = options;
-	const hosts = lanHostsToProbe(addresses());
-	const body = JSON.stringify({
-		method: "CCU.getAuthEnabled",
-		params: {},
-		jsonrpc: "1.1",
-		id: 0
-	});
+/** CCUs among the engine's http-probe hits: the hosts whose answer is the JSON-RPC one. */
+function ccusFromHits(hits) {
 	const found = [];
-	let next = 0;
-	const worker = async () => {
-		for (;;) {
-			const host = hosts[next++];
-			if (host === void 0) return;
-			try {
-				const reply = await post(`http://${host}${JSON_RPC_PATH$2}`, body, timeoutMs);
-				const answer = parseAuthEnabledAnswer(reply.status, reply.text);
-				if (answer !== null) found.push({
-					host,
-					name: `Homematic CCU (${host})`,
-					id: slugifyHost(host),
-					authEnabled: answer.authEnabled
-				});
-			} catch {}
-		}
-	};
-	await Promise.all(Array.from({ length: Math.max(1, concurrency) }, () => worker()));
+	const seen = /* @__PURE__ */ new Set();
+	for (const hit of hits) {
+		if (hit.http === void 0 || seen.has(hit.host)) continue;
+		const answer = parseAuthEnabledAnswer(hit.http.status, hit.http.bodyText);
+		if (answer === null) continue;
+		seen.add(hit.host);
+		found.push({
+			host: hit.host,
+			name: `Homematic CCU (${hit.host})`,
+			id: slugifyHost(hit.host),
+			authEnabled: answer.authEnabled
+		});
+	}
 	return found.sort((a, b) => a.host.localeCompare(b.host, void 0, { numeric: true }));
 }
 /** CCUs whose host is already stored on an integration are not proposed again. */
@@ -95195,11 +95961,10 @@ function proposeHomematicCcus(found, existingHosts) {
 function homematicDiscoveryCandidates(proposals) {
 	return proposals.map((found) => ({
 		stableId: `homematic:${found.id}`,
+		type: DeviceType.Gateway,
 		suggestedName: found.name,
-		prefilledConfig: {
-			host: found.host,
-			[HOMEMATIC_SETUP_INTEGRATION_KEY]: true
-		}
+		prefilledConfig: { host: found.host },
+		setupIntegration: true
 	}));
 }
 function homematicDiscoverySummary(foundCount, proposedCount) {
@@ -112471,6 +113236,19 @@ var CircuitBreakerOpenError = class extends BaseHomematicError {};
 var AuthFailureError = class extends BaseHomematicError {};
 var InternalBackendError = class extends BaseHomematicError {};
 var CommandSupersededError = class extends BaseHomematicError {};
+var CcuManagementError = class extends BaseHomematicError {
+	/** The XML-RPC / JSON-RPC method that failed. */
+	method;
+	/** The underlying typed error (or whatever was thrown). */
+	original;
+	constructor(method, original) {
+		const detail = original instanceof Error ? original.message : String(original);
+		super(`${method} failed: ${detail}`);
+		this.method = method;
+		this.original = original;
+	}
+};
+var GroupWriteVerificationError = class extends BaseHomematicError {};
 var DescriptionNotFoundError = class extends BaseHomematicError {};
 var InvalidStateTransitionError = class extends BaseHomematicError {};
 var TimeoutError = class extends BaseHomematicError {};
@@ -113224,6 +114002,54 @@ var InterfaceClient = class {
 		const result = await this.callGuarded("getInstallMode", []);
 		return typeof result === "number" ? result : 0;
 	}
+	/**
+	* `listBidcosInterfaces()` → the radio gateways of a BidCos interface.
+	*
+	* Source: HomeMatic XML-RPC interface spec (rfd), as consumed by the WebUI in
+	* eq-3/occu `WebUI/www/api/methods/interface/listbidcosinterfaces.tcl`
+	* (fields ADDRESS, DESCRIPTION, DUTY_CYCLE, CONNECTED, DEFAULT,
+	* FIRMWARE_VERSION, TYPE). A field the CCU did not send is `null`, never 0.
+	*/
+	async listBidcosInterfaces() {
+		const result = await this.managementCall("listBidcosInterfaces", []);
+		if (!Array.isArray(result)) return [];
+		const gateways = [];
+		for (const entry of result) if (isStruct(entry)) gateways.push(toRadioGateway(entry));
+		return gateways;
+	}
+	/**
+	* `setInstallMode(on[, seconds[, mode]])` — open or close the pairing window.
+	*
+	* Source: HomeMatic XML-RPC interface spec; the WebUI forwards the same call
+	* in eq-3/occu `WebUI/www/api/methods/interface/setinstallmode.tcl` and
+	* `setinstallmodehmip.tcl` (`setInstallMode(bool on, int time)`). `mode`
+	* (1 normal, 2 with the HomeMatic Secure key) is BidCos-only and is sent only
+	* when given.
+	*/
+	async setInstallMode(request) {
+		const params = [request.on];
+		if (request.seconds !== void 0) params.push(request.seconds);
+		if (request.mode !== void 0) params.push(request.mode);
+		await this.managementCall("setInstallMode", params);
+	}
+	/**
+	* `getInstallMode()` → seconds left of the pairing window, or `null` when the
+	* CCU answered something that is not an integer (never a fake 0).
+	*/
+	async getInstallModeRemaining() {
+		const result = await this.managementCall("getInstallMode", []);
+		return typeof result === "number" && Number.isInteger(result) ? result : null;
+	}
+	/**
+	* `deleteDevice(address, flags)` — remove a device from the interface.
+	*
+	* Source: eq-3/occu `WebUI/www/api/methods/interface/deletedevice.tcl`:
+	* flags 0x01 reset to factory, 0x02 force (also when unreachable), 0x04 defer
+	* until the device is next reachable.
+	*/
+	async deleteDevice(address, flags) {
+		await this.managementCall("deleteDevice", [address, flags]);
+	}
 	/** `getVersion()` (bypass) → backend version string. */
 	async getVersion() {
 		return scalarToString(await this.callGuarded("getVersion", [], { bypassBreaker: true }));
@@ -113234,6 +114060,18 @@ var InterfaceClient = class {
 		return Array.isArray(result) ? result.map(scalarToString) : [];
 	}
 	/**
+	* A management call: guarded like any other, but a failure is rethrown as a
+	* {@link CcuManagementError} naming the method and keeping the CCU fault text.
+	*/
+	async managementCall(method, params) {
+		try {
+			return await this.callGuarded(method, params);
+		} catch (err) {
+			if (err instanceof BaseHomematicError) throw new CcuManagementError(method, err);
+			throw err;
+		}
+	}
+	/**
 	* Invoke `method`, gating non-bypass calls behind the circuit breaker.
 	* Bypass methods skip the breaker entirely (no success/failure recorded).
 	*/
@@ -113288,17 +114126,48 @@ function asDeviceDescriptionArray(value) {
 function asParamsetDescription(value) {
 	return asStruct(value);
 }
+function stringOrNull(value) {
+	return typeof value === "string" && value !== "" ? value : null;
+}
+function numberOrNull(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function flagOrNull(value) {
+	if (typeof value === "boolean") return value;
+	if (value === 1) return true;
+	if (value === 0) return false;
+	return null;
+}
+function toRadioGateway(entry) {
+	const connected = flagOrNull(entry["CONNECTED"]);
+	return {
+		address: stringOrNull(entry["ADDRESS"]) ?? "",
+		description: stringOrNull(entry["DESCRIPTION"]),
+		dutyCycle: numberOrNull(entry["DUTY_CYCLE"]),
+		connected,
+		isDefault: flagOrNull(entry["DEFAULT"]) === true,
+		firmware: stringOrNull(entry["FIRMWARE_VERSION"]),
+		type: stringOrNull(entry["TYPE"])
+	};
+}
 var SESSION_ID_PARAM = "_session_id_";
 var JsonRpcMethod = {
 	CCU_GET_AUTH_ENABLED: "CCU.getAuthEnabled",
 	CCU_GET_HTTPS_REDIRECT_ENABLED: "CCU.getHttpsRedirectEnabled",
+	CCU_GET_VERSION: "CCU.getVersion",
+	CCU_GET_SERIAL: "CCU.getSerial",
+	CCU_GET_HEATING_GROUP_LIST: "CCU.getHeatingGroupList",
 	DEVICE_LIST_ALL_DETAIL: "Device.listAllDetail",
+	DEVICE_GET_REGA_ID_BY_ADDRESS: "Device.getReGaIDByAddress",
 	DEVICE_SET_NAME: "Device.setName",
 	CHANNEL_SET_NAME: "Channel.setName",
 	INTERFACE_LIST_INTERFACES: "Interface.listInterfaces",
 	INTERFACE_LIST_DEVICES: "Interface.listDevices",
+	INTERFACE_IS_PRESENT: "Interface.isPresent",
+	INTERFACE_GET_DUTY_CYCLE: "Interface.getDutyCycle",
 	INTERFACE_GET_INSTALL_MODE: "Interface.getInstallMode",
 	INTERFACE_SET_INSTALL_MODE_HMIP: "Interface.setInstallModeHMIP",
+	INTERFACE_SET_METADATA: "Interface.setMetadata",
 	PROGRAM_GET_ALL: "Program.getAll",
 	PROGRAM_EXECUTE: "Program.execute",
 	SYSVAR_GET_ALL: "SysVar.getAll",
@@ -113507,6 +114376,691 @@ var SessionManager = class {
 		return Math.min(exp, MAX_BACKOFF_MS);
 	}
 };
+var FORM_CONTENT_TYPE = "application/x-www-form-urlencoded; charset=UTF-8";
+var ESCAPE_SAFE = /[A-Za-z0-9@*_+\-./]/;
+function jsEscape(text) {
+	let out = "";
+	for (const ch of text) {
+		const unit = ch.charCodeAt(0);
+		if (ESCAPE_SAFE.test(ch)) out += ch;
+		else if (ch.length === 1 && unit < 256) out += `%${unit.toString(16).toUpperCase().padStart(2, "0")}`;
+		else for (let i = 0; i < ch.length; i += 1) out += `%u${ch.charCodeAt(i).toString(16).toUpperCase().padStart(4, "0")}`;
+	}
+	return out;
+}
+var WebUiHttpClient = class {
+	base;
+	timeoutMs;
+	fetchFn;
+	dispatcher;
+	constructor(options) {
+		this.base = options.url.replace(/\/+$/, "");
+		this.timeoutMs = options.timeoutMs ?? TIMEOUTS.rpc;
+		this.dispatcher = options.rejectUnauthorized === false ? new import_undici.Agent({ connect: { rejectUnauthorized: false } }) : void 0;
+		this.fetchFn = options.fetch ?? this.defaultFetch.bind(this);
+	}
+	get(path$2, sessionId) {
+		return this.request("GET", path$2, sessionId, void 0);
+	}
+	post(path$3, sessionId, body) {
+		return this.request("POST", path$3, sessionId, body);
+	}
+	async close() {
+		await this.dispatcher?.close();
+	}
+	async request(method, path$4, sessionId, body) {
+		const url = `${this.base}${path$4}?sid=${encodeURIComponent(sessionId)}`;
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+		try {
+			const response = await this.fetchFn(url, {
+				method,
+				headers: body === void 0 ? {} : { "Content-Type": FORM_CONTENT_TYPE },
+				body,
+				signal: controller.signal
+			});
+			const text = await response.text();
+			if (response.status < 200 || response.status >= 300) throw new ClientError(`HTTP ${response.status}`);
+			return text;
+		} catch (err) {
+			const mapped = err instanceof ClientError ? err : mapTransportError(err);
+			throw new CcuManagementError(`${method} ${path$4}`, /* @__PURE__ */ new Error(`${mapped.name}: ${mapped.message.split(sessionId).join("<sid>")}`));
+		} finally {
+			clearTimeout(timer);
+		}
+	}
+	async defaultFetch(url, init) {
+		const req = {
+			method: init.method,
+			headers: init.headers,
+			signal: init.signal
+		};
+		if (init.body !== void 0) req.body = init.body;
+		if (this.dispatcher) req.dispatcher = this.dispatcher;
+		return (0, import_undici.fetch)(url, req);
+	}
+};
+function escapeRegaString(s) {
+	return s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
+}
+var CONTROL_CHARS = /[\u0000-\u001F]/g;
+function sanitizeJsonControlChars(s) {
+	return s.replace(CONTROL_CHARS, "");
+}
+function decodeRegaName(encoded) {
+	const bytes = [];
+	for (let i = 0; i < encoded.length; i += 1) {
+		const ch = encoded[i];
+		if (ch === "%" && i + 2 < encoded.length) {
+			const hex = encoded.slice(i + 1, i + 3);
+			const byte = Number.parseInt(hex, 16);
+			if (!Number.isNaN(byte) && /^[0-9a-fA-F]{2}$/.test(hex)) {
+				bytes.push(byte);
+				i += 2;
+				continue;
+			}
+		}
+		if (ch === "+") {
+			bytes.push(32);
+			continue;
+		}
+		bytes.push(ch.charCodeAt(0) & 255);
+	}
+	return Buffer.from(bytes).toString("latin1");
+}
+function substitute(body, params) {
+	let out = body;
+	for (const [key, value] of Object.entries(params)) {
+		const escaped = escapeRegaString(String(value));
+		out = out.split(`##${key}##`).join(escaped);
+	}
+	return out;
+}
+async function runScript(client, sessionId, body, params) {
+	const script = params ? substitute(body, params) : body;
+	const result = await client.post(JsonRpcMethod.REGA_RUN_SCRIPT, { script }, sessionId !== void 0 ? { sessionId } : void 0);
+	if (result === void 0 || result === null) throw new ClientError("ReGa.runScript returned no result");
+	if (typeof result === "string") return JSON.parse(sanitizeJsonControlChars(result));
+	return result;
+}
+var SET_SYSTEM_VARIABLE = `object sv = dom.GetObject("##name##");
+if (sv) {
+    sv.State("##value##");
+}`;
+var SET_PROGRAM_STATE = `object prog = dom.GetObject(##id##);
+if (prog) {
+    prog.Active(##state##);
+}`;
+var SYSVAR_DESCRIPTIONS = `string sSysVarId;
+string sSep = "";
+WriteLine("[");
+foreach(sSysVarId, dom.GetObject(ID_SYSTEM_VARIABLES).EnumUsedIDs()) {
+    object oSysVar = dom.GetObject(sSysVarId);
+    Write(sSep);
+    Write("{");
+    Write("\\"id\\":");
+    Write(oSysVar.ID());
+    Write(",\\"description\\":\\"");
+    Write(oSysVar.DPInfo().UriEncode());
+    Write("\\"}");
+    sSep = ",";
+}
+WriteLine("]");`;
+var GET_ROOMS_FUNCTIONS = `string sChnId;
+string sRoomId;
+string sFuncId;
+string sChnSepR = "";
+string sChnSepF = "";
+Write("{\\"rooms\\":{");
+foreach(sChnId, dom.GetObject(ID_CHANNELS).EnumUsedIDs()) {
+    object oChn = dom.GetObject(sChnId);
+    if (oChn) {
+        string sAddr = oChn.Address();
+        object oRooms = oChn.ChnRoom();
+        if (oRooms && oRooms.Count() > 0) {
+            Write(sChnSepR);
+            Write("\\"");
+            Write(sAddr);
+            Write("\\":[");
+            string sRoomSep = "";
+            foreach(sRoomId, oRooms) {
+                object oRoom = dom.GetObject(sRoomId);
+                Write(sRoomSep);
+                Write("\\"");
+                Write(oRoom.Name().UriEncode());
+                Write("\\"");
+                sRoomSep = ",";
+            }
+            Write("]");
+            sChnSepR = ",";
+        }
+    }
+}
+Write("},\\"functions\\":{");
+foreach(sChnId, dom.GetObject(ID_CHANNELS).EnumUsedIDs()) {
+    object oChn = dom.GetObject(sChnId);
+    if (oChn) {
+        string sAddr = oChn.Address();
+        object oFuncs = oChn.ChnFunction();
+        if (oFuncs && oFuncs.Count() > 0) {
+            Write(sChnSepF);
+            Write("\\"");
+            Write(sAddr);
+            Write("\\":[");
+            string sFuncSep = "";
+            foreach(sFuncId, oFuncs) {
+                object oFunc = dom.GetObject(sFuncId);
+                Write(sFuncSep);
+                Write("\\"");
+                Write(oFunc.Name().UriEncode());
+                Write("\\"");
+                sFuncSep = ",";
+            }
+            Write("]");
+            sChnSepF = ",";
+        }
+    }
+}
+Write("}}");`;
+var GET_SERVICE_MESSAGES = `string sAID;
+string sSep = "";
+Write("[");
+foreach(sAID, dom.GetObject(ID_SERVICES).EnumIDs()) {
+    object oAlarm = dom.GetObject(sAID);
+    if (oAlarm) {
+        if (oAlarm.IsTypeOf(OT_ALARMDP)) {
+            if (oAlarm.AlState() == asOncoming) {
+                string sAddr = "";
+                string sType = "";
+                string sAck = "true";
+                object oLast = dom.GetObject(oAlarm.LastTriggerID());
+                if (oLast) {
+                    sType = oLast.HSSID();
+                    object oChn = dom.GetObject(oLast.Channel());
+                    if (oChn) {
+                        sAddr = oChn.Address();
+                    }
+                }
+                object oTrig = dom.GetObject(oAlarm.AlTriggerDP());
+                if (oTrig) {
+                    if (!(oTrig.Operations() & OPERATION_WRITE)) {
+                        sAck = "false";
+                    }
+                }
+                Write(sSep);
+                Write("{\\"id\\":");
+                Write(oAlarm.ID());
+                Write(",\\"name\\":\\"");
+                Write(oAlarm.Name().UriEncode());
+                Write("\\",\\"address\\":\\"");
+                Write(sAddr);
+                Write("\\",\\"type\\":\\"");
+                Write(sType);
+                Write("\\",\\"timestamp\\":");
+                Write(oAlarm.AlOccurrenceTime().ToInteger());
+                Write(",\\"acknowledgeable\\":");
+                Write(sAck);
+                Write("}");
+                sSep = ",";
+            }
+        }
+    }
+}
+Write("]");`;
+var ACKNOWLEDGE_SERVICE_MESSAGE = `object oAlarm = dom.GetObject(##id##);
+if (oAlarm) {
+    oAlarm.AlReceipt();
+    Write("{\\"ok\\":true}");
+} else {
+    Write("{\\"ok\\":false}");
+}`;
+var GET_CCU_PLATFORM = `string sRelease;
+string sHost;
+string sErr;
+system.Exec("cat /VERSION", &sRelease, &sErr);
+system.Exec("hostname", &sHost, &sErr);
+Write("{\\"release\\":\\"");
+Write(sRelease.UriEncode());
+Write("\\",\\"host\\":\\"");
+Write(sHost.UriEncode());
+Write("\\"}");`;
+var GROUP_CREATE_PATH = "/pages/jpages/group/create";
+var GROUP_SAVE_PATH = "/pages/jpages/group/save";
+var GROUP_DELETE_PATH = "/pages/jpages/group/delete";
+var DRAFT_GROUP_ID = /self\.groupId\s*=\s*(\d+)/;
+var KNOWN_GROUP_TYPES = ["hmip.heating.group", "HomeMatic.heating"];
+var CHANNEL_ADDRESS = /^[0-9A-Za-z_-]+:\d+$/;
+var MAX_GROUP_NAME = 64;
+var DEFAULT_INSTALL_SECONDS = 60;
+var MAX_INSTALL_SECONDS = 3600;
+var SERVICE_MESSAGE_ID = /^\d+$/;
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function asRecordArray(value) {
+	return Array.isArray(value) ? value.filter(isRecord) : [];
+}
+function strOrNull(value) {
+	if (typeof value === "string") return value === "" ? null : value;
+	if (typeof value === "number" && Number.isFinite(value)) return String(value);
+	return null;
+}
+function numOrNull(value) {
+	if (value === null || value === void 0 || value === "") return null;
+	const num = typeof value === "number" ? value : Number(value);
+	return Number.isFinite(num) ? num : null;
+}
+var INTERFACES_BY_NAME = new Map(Object.values(Interface).map((iface) => [iface.toString(), iface]));
+function toInterface(name) {
+	const match = INTERFACES_BY_NAME.get(name);
+	if (match === void 0) throw new ValidationError(`Unknown interface "${name}".`);
+	return match;
+}
+function toGateway(info) {
+	return { ...info };
+}
+function decodedOrNull(value) {
+	if (typeof value !== "string") return null;
+	const text = decodeRegaName(value).trim();
+	return text === "" ? null : text;
+}
+function parseKeyValueLines(text) {
+	const out = /* @__PURE__ */ new Map();
+	for (const line of text.split(/\r?\n/)) {
+		const eq = line.indexOf("=");
+		if (eq > 0) out.set(line.slice(0, eq).trim(), line.slice(eq + 1).trim());
+	}
+	return out;
+}
+var OPENCCU_PRODUCTS = /* @__PURE__ */ new Set([
+	"raspberrymatic",
+	"openccu",
+	"ova"
+]);
+function productFamily(raw) {
+	if (raw === null) return "unknown";
+	const key = raw.toLowerCase();
+	if (key === "ccu3") return "ccu3";
+	return OPENCCU_PRODUCTS.has(key) ? "openccu" : "unknown";
+}
+var CcuManagement = class {
+	json;
+	webUi;
+	getSessionId;
+	interfaceClient;
+	configuredInterfaces;
+	constructor(options) {
+		this.json = options.json;
+		this.webUi = options.webUi;
+		this.getSessionId = options.getSessionId;
+		this.interfaceClient = options.interfaceClient;
+		this.configuredInterfaces = options.configuredInterfaces;
+	}
+	/**
+	* Every interface the CCU offers (JSON-RPC `Interface.listInterfaces`), with
+	* connection state, duty cycle and, for BidCos, the radio gateways. Without a
+	* JSON-RPC client only the configured interfaces are listed and every probe
+	* result is `null`.
+	*/
+	async listInterfaces() {
+		const offered = await this.offeredInterfaces();
+		const gatewaysByName = /* @__PURE__ */ new Map();
+		for (const entry of offered) {
+			const iface = INTERFACES_BY_NAME.get(entry.name);
+			const client = iface === void 0 ? void 0 : this.interfaceClient(iface);
+			if (client === void 0 || iface !== "BidCos-RF" && iface !== "HmIP-RF") continue;
+			const gateways = await this.tryOrNull(() => client.listBidcosInterfaces());
+			if (gateways !== null) gatewaysByName.set(entry.name, gateways.map(toGateway));
+		}
+		const fallbackDuty = offered.some((e) => e.name === "BidCos-RF".toString() && (gatewaysByName.get(e.name) ?? []).every((g) => g.dutyCycle === null)) ? await this.ownRadioDutyCycle() : null;
+		const result = [];
+		for (const entry of offered) {
+			const gateways = gatewaysByName.get(entry.name) ?? [];
+			const primary = gateways.find((g) => g.isDefault) ?? gateways[0];
+			const connected = primary?.connected ?? await this.isPresent(entry.name);
+			const dutyCycle = primary?.dutyCycle ?? (entry.name === "BidCos-RF".toString() ? fallbackDuty : null);
+			result.push({
+				name: entry.name,
+				port: entry.port,
+				info: entry.info,
+				connected,
+				dutyCycle,
+				firmware: primary?.firmware ?? null,
+				type: primary?.type ?? null,
+				gateways
+			});
+		}
+		return result;
+	}
+	/** Open (default 60 s) or close the pairing window of a configured interface. */
+	async setInstallMode(request) {
+		const client = this.requireClient(request.interface);
+		if (!request.on) {
+			await client.setInstallMode({ on: false });
+			return;
+		}
+		const seconds = request.seconds ?? DEFAULT_INSTALL_SECONDS;
+		if (!Number.isInteger(seconds) || seconds < 1 || seconds > MAX_INSTALL_SECONDS) throw new ValidationError(`seconds must be an integer between 1 and ${MAX_INSTALL_SECONDS}, got ${String(seconds)}.`);
+		const call = request.mode === void 0 ? {
+			on: true,
+			seconds
+		} : {
+			on: true,
+			seconds,
+			mode: request.mode === "secure" ? 2 : 1
+		};
+		await client.setInstallMode(call);
+	}
+	/** Seconds left of the pairing window; `null` when the CCU's answer was unusable. */
+	async getInstallMode(interfaceName) {
+		return this.requireClient(interfaceName).getInstallModeRemaining();
+	}
+	/** Every active service message (ReGa listing of `ID_SERVICES`). */
+	async serviceMessages() {
+		return asRecordArray(await this.rega("ReGa.runScript(serviceMessages)", GET_SERVICE_MESSAGES)).flatMap((entry) => {
+			const id = strOrNull(entry["id"]);
+			if (id === null) return [];
+			const address = strOrNull(entry["address"]);
+			const colon = address === null ? -1 : address.lastIndexOf(":");
+			const device = address === null ? null : colon === -1 ? address : address.slice(0, colon);
+			const channel = address === null || colon === -1 ? null : numOrNull(address.slice(colon + 1));
+			const seconds = numOrNull(entry["timestamp"]);
+			return [{
+				id,
+				name: decodedOrNull(entry["name"]),
+				address: device,
+				channel,
+				type: strOrNull(entry["type"]),
+				timestamp: seconds === null || seconds <= 0 ? null : seconds * 1e3,
+				acknowledgeable: entry["acknowledgeable"] === true
+			}];
+		});
+	}
+	/** Acknowledge one service message by its id. */
+	async acknowledgeServiceMessage(id) {
+		if (!SERVICE_MESSAGE_ID.test(id)) throw new ValidationError(`Invalid service message id "${id}".`);
+		const raw = await this.rega("ReGa.runScript(acknowledgeServiceMessage)", ACKNOWLEDGE_SERVICE_MESSAGE, { id });
+		if (!isRecord(raw) || raw["ok"] !== true) throw new ValidationError(`Unknown service message "${id}".`);
+	}
+	/** Version, product, serial and hostname; each `null` when unanswered. */
+	async ccuInfo() {
+		const [version, serial, platform] = await Promise.allSettled([
+			this.call(JsonRpcMethod.CCU_GET_VERSION),
+			this.call(JsonRpcMethod.CCU_GET_SERIAL),
+			this.rega("ReGa.runScript(ccuPlatform)", GET_CCU_PLATFORM)
+		]);
+		if (version.status === "rejected" && serial.status === "rejected" && platform.status === "rejected") throw version.reason instanceof CcuManagementError ? version.reason : new CcuManagementError(JsonRpcMethod.CCU_GET_VERSION, version.reason);
+		const release = platform.status === "fulfilled" && isRecord(platform.value) ? parseKeyValueLines(decodeRegaName(releaseText(platform.value))) : /* @__PURE__ */ new Map();
+		const hostname = platform.status === "fulfilled" && isRecord(platform.value) ? decodedOrNull(platform.value["host"]) : null;
+		const product = strOrNull(release.get("PRODUCT"));
+		return {
+			version: version.status === "fulfilled" ? strOrNull(version.value) : null,
+			product,
+			productFamily: productFamily(product),
+			platform: strOrNull(release.get("PLATFORM")),
+			serial: serial.status === "fulfilled" ? strOrNull(serial.value) : null,
+			hostname
+		};
+	}
+	/**
+	* The heating groups of the CCU ("Gruppen"), read from `CCU.getHeatingGroupList`
+	* (the HMServer's `/etc/config/groups.gson`). `[]` when the CCU has no groups
+	* file. Writes (`createGroup` / `updateGroup` / `deleteGroup`) go through the
+	* HMServer's WebUI pages instead, see the group-writes section below.
+	*/
+	async groups() {
+		const raw = await this.call(JsonRpcMethod.CCU_GET_HEATING_GROUP_LIST);
+		if (typeof raw !== "string" || raw.trim() === "") return [];
+		let parsed;
+		try {
+			parsed = JSON.parse(raw);
+		} catch (err) {
+			throw new CcuManagementError(JsonRpcMethod.CCU_GET_HEATING_GROUP_LIST, err);
+		}
+		if (!isRecord(parsed)) return [];
+		return Object.keys(parsed).sort().flatMap((key) => asRecordArray(parsed[key])).flatMap((entry) => {
+			const group = toGroup(entry);
+			return group === null ? [] : [group];
+		});
+	}
+	/** Create a group; resolves with the group as read back from the CCU. */
+	async createGroup(input) {
+		const name = validateGroupName(input.name);
+		const members = validateMembers(input.members);
+		const before = await this.groups();
+		this.validateType(input.type, before);
+		const { webUi, sid } = await this.requireWebUi("group/create");
+		const page = checkWebUiResponse(GROUP_CREATE_PATH, await webUi.get(GROUP_CREATE_PATH, sid));
+		const draft = DRAFT_GROUP_ID.exec(page);
+		if (draft === null || draft[1] === void 0) throw new CcuManagementError(GROUP_CREATE_PATH, new ClientError("no group id in the page"));
+		const draftId = Number(draft[1]);
+		const id = numOrNull(await this.saveGroup(webUi, sid, {
+			groupId: draftId,
+			groupName: jsEscape(name),
+			groupTypeId: input.type,
+			forbidSingleOperation: false,
+			assignedDevicesIds: members,
+			isNewGroup: true,
+			groupDeviceName: `${name} `
+		})) ?? draftId;
+		await this.flagMembers(members, "true");
+		return this.verifyPresent(id, {
+			name,
+			type: input.type,
+			members
+		});
+	}
+	/** Change a group's name and/or member list; resolves with the group read back. */
+	async updateGroup(id, patch) {
+		if (patch.name === void 0 && patch.members === void 0) throw new ValidationError("updateGroup needs a name and/or members.");
+		const name = patch.name === void 0 ? void 0 : validateGroupName(patch.name);
+		const members = patch.members === void 0 ? void 0 : validateMembers(patch.members);
+		const current = await this.requireGroup(id);
+		const { webUi, sid } = await this.requireWebUi("group/save");
+		const nextName = name ?? current.name;
+		const nextMembers = members ?? current.members.map((m) => m.address);
+		await this.saveGroup(webUi, sid, {
+			groupId: id,
+			groupName: jsEscape(nextName),
+			groupTypeId: current.type,
+			forbidSingleOperation: current.forbidSingleOperation,
+			assignedDevicesIds: nextMembers,
+			isNewGroup: false,
+			groupDeviceName: current.deviceAddress === null ? nextName : `${nextName} ${virtualDeviceSerial(id)}`
+		});
+		await this.flagMembers(nextMembers, "true");
+		const kept = new Set(nextMembers);
+		await this.flagMembers(current.members.map((m) => m.address).filter((a) => !kept.has(a)), "false");
+		return this.verifyPresent(id, {
+			name: nextName,
+			type: current.type,
+			members: nextMembers
+		});
+	}
+	/** Delete a group; verified by the group being gone from the read-back. */
+	async deleteGroup(id) {
+		const current = await this.requireGroup(id);
+		const { webUi, sid } = await this.requireWebUi("group/delete");
+		checkWebUiResponse(GROUP_DELETE_PATH, await webUi.post(GROUP_DELETE_PATH, sid, JSON.stringify({ groupId: id })));
+		await this.flagMembers(current.members.map((m) => m.address), "false");
+		if ((await this.groups()).some((g) => g.id === id)) throw new GroupWriteVerificationError(`Group ${id} is still listed after deleteGroup.`);
+	}
+	async requireGroup(id) {
+		if (!Number.isInteger(id)) throw new ValidationError(`Invalid group id ${String(id)}.`);
+		const found = (await this.groups()).find((g) => g.id === id);
+		if (found === void 0) throw new ValidationError(`Unknown group ${id}.`);
+		return found;
+	}
+	validateType(type, existing) {
+		const known = /* @__PURE__ */ new Set([...KNOWN_GROUP_TYPES, ...existing.map((g) => g.type)]);
+		if (!known.has(type)) throw new ValidationError(`Unknown group type "${type}" (known: ${[...known].join(", ")}).`);
+	}
+	async requireWebUi(label) {
+		if (this.webUi === void 0) throw new ValidationError(`${label} needs WebUI credentials (HMServer pages); none are configured.`);
+		const sid = await this.getSessionId();
+		if (sid === void 0) throw new ValidationError(`${label} needs a WebUI session.`);
+		return {
+			webUi: this.webUi,
+			sid
+		};
+	}
+	/** POST `group/save`; returns the response `content` (the group id as text). */
+	async saveGroup(webUi, sid, payload) {
+		return checkWebUiResponse(GROUP_SAVE_PATH, await webUi.post(GROUP_SAVE_PATH, sid, JSON.stringify(payload)));
+	}
+	/**
+	* The WebUI marks every device it puts in / takes out of a heating group with
+	* `Interface.setMetadata inHeatingGroup` (its pages use the flag to hide
+	* grouped devices). Best effort: the hint is cosmetic and the group itself is
+	* verified separately.
+	*/
+	async flagMembers(addresses, value) {
+		const devices = [...new Set(addresses.map((a) => a.slice(0, a.lastIndexOf(":"))))];
+		for (const address of devices) try {
+			const objectId = await this.call(JsonRpcMethod.DEVICE_GET_REGA_ID_BY_ADDRESS, { address });
+			if (typeof objectId !== "string" || objectId === "" || objectId === "noDeviceFound") continue;
+			await this.call(JsonRpcMethod.INTERFACE_SET_METADATA, {
+				objectId,
+				dataId: "inHeatingGroup",
+				value
+			});
+		} catch {}
+	}
+	async verifyPresent(id, want) {
+		const found = (await this.groups()).find((g) => g.id === id);
+		if (found === void 0) throw new GroupWriteVerificationError(`Group ${id} is not listed after the write.`);
+		const have = found.members.map((m) => m.address).sort();
+		const expected = [...want.members].sort();
+		const sameMembers = have.length === expected.length && have.every((a, i) => a === expected[i]);
+		if (found.name !== want.name || found.type !== want.type || !sameMembers) throw new GroupWriteVerificationError(`Group ${id} reads back as "${found.name}" (${found.type}, ${have.length} members), expected "${want.name}" (${want.type}, ${expected.length} members).`);
+		return found;
+	}
+	requireClient(interfaceName) {
+		const iface = toInterface(interfaceName);
+		const client = this.interfaceClient(iface);
+		if (client === void 0) throw new ValidationError(`Interface "${interfaceName}" is not configured.`);
+		return client;
+	}
+	requireJson(method) {
+		if (this.json === void 0) throw new ValidationError(`${method} needs WebUI credentials (JSON-RPC); none are configured.`);
+		return this.json;
+	}
+	/** A session-bound JSON-RPC call whose failure names the method. */
+	async call(method, params) {
+		const json = this.requireJson(method);
+		try {
+			const sessionId = await this.getSessionId();
+			return await json.post(method, params, sessionId !== void 0 ? { sessionId } : void 0);
+		} catch (err) {
+			throw err instanceof ValidationError ? err : new CcuManagementError(method, err);
+		}
+	}
+	async rega(label, script, params) {
+		const json = this.requireJson(label);
+		try {
+			return await runScript(json, await this.getSessionId(), script, params);
+		} catch (err) {
+			throw err instanceof ValidationError ? err : new CcuManagementError(label, err);
+		}
+	}
+	async tryOrNull(fn) {
+		try {
+			return await fn();
+		} catch {
+			return null;
+		}
+	}
+	async offeredInterfaces() {
+		if (this.json === void 0) return this.configuredInterfaces().map((iface) => ({
+			name: iface,
+			port: null,
+			info: null
+		}));
+		return asRecordArray(await this.call(JsonRpcMethod.INTERFACE_LIST_INTERFACES)).flatMap((entry) => {
+			const name = strOrNull(entry["name"]);
+			return name === null ? [] : [{
+				name,
+				port: numOrNull(entry["port"]),
+				info: strOrNull(entry["info"])
+			}];
+		});
+	}
+	async isPresent(name) {
+		if (this.json === void 0) return null;
+		const answer = await this.tryOrNull(() => this.call(JsonRpcMethod.INTERFACE_IS_PRESENT, { interface: name }));
+		if (typeof answer === "boolean") return answer;
+		if (answer === "true") return true;
+		if (answer === "false") return false;
+		return null;
+	}
+	/**
+	* Fallback when `listBidcosInterfaces` gave no answer: `Interface.getDutyCycle`
+	* (RaspberryMatic / OpenCCU) reports the CCU's own radio module as ONE entry
+	* with string numbers (`"7"`). It cannot be attributed to HmIP, so it only
+	* ever stands in for BidCos-RF; non-numeric or absent is `null`.
+	*/
+	async ownRadioDutyCycle() {
+		if (this.json === void 0) return null;
+		const entries = asRecordArray(await this.tryOrNull(() => this.call(JsonRpcMethod.INTERFACE_GET_DUTY_CYCLE)));
+		return entries.length === 1 ? numOrNull(entries[0]?.["dutyCycle"]) : null;
+	}
+};
+function releaseText(value) {
+	const release = value["release"];
+	return typeof release === "string" ? release : "";
+}
+var DEVICE_ADDRESS_SUFFIX = /\b(INT\d{7})\s*$/;
+function toGroup(entry) {
+	const id = numOrNull(entry["id"]);
+	if (id === null) return null;
+	const props = isRecord(entry["groupProperties"]) ? entry["groupProperties"] : {};
+	const groupType = isRecord(entry["groupType"]) ? entry["groupType"] : {};
+	const deviceName = strOrNull(props["GROUP_DEVICE_NAME"]);
+	const deviceMatch = deviceName === null ? null : DEVICE_ADDRESS_SUFFIX.exec(deviceName);
+	const members = asRecordArray(entry["groupMembers"]).flatMap((m) => {
+		const address = strOrNull(m["id"]);
+		if (address === null) return [];
+		return [{
+			address,
+			type: (isRecord(m["memberType"]) ? strOrNull(m["memberType"]["id"]) : null) ?? ""
+		}];
+	});
+	return {
+		id,
+		name: (strOrNull(props["NAME"]) ?? "").trim(),
+		type: strOrNull(groupType["id"]) ?? "",
+		typeLabel: strOrNull(groupType["label"]),
+		deviceAddress: deviceMatch === null ? null : deviceMatch[1] ?? null,
+		forbidSingleOperation: props["FORBID_SINGLE_OPERATION"] === true,
+		members
+	};
+}
+function virtualDeviceSerial(id) {
+	return `INT${String(id).padStart(7, "0")}`;
+}
+function validateGroupName(raw) {
+	const name = raw.replace(/"/g, "'").trim();
+	if (name === "" || name.length > MAX_GROUP_NAME) throw new ValidationError(`Group name must be 1..${MAX_GROUP_NAME} characters.`);
+	return name;
+}
+function validateMembers(members) {
+	for (const address of members) if (!CHANNEL_ADDRESS.test(address)) throw new ValidationError(`Invalid member channel address "${address}".`);
+	return [...new Set(members)];
+}
+function checkWebUiResponse(path$5, text) {
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		throw new CcuManagementError(path$5, new ClientError("response was not JSON"));
+	}
+	if (!isRecord(parsed) || parsed["isSuccessful"] !== true) {
+		const code = isRecord(parsed) ? strOrNull(parsed["errorCode"]) : null;
+		throw new CcuManagementError(path$5, new ClientError(code === "42" ? "session expired (errorCode 42)" : `refused (errorCode ${code ?? "none"})`));
+	}
+	const content = parsed["content"];
+	return typeof content === "string" || typeof content === "number" ? String(content) : "";
+}
 var FAULT_METHOD_NOT_FOUND = -32601;
 var FAULT_INTERNAL_ERROR = -32603;
 var MethodNotFoundError = class extends BaseHomematicError {};
@@ -114414,128 +115968,6 @@ function asString(value) {
 	if (typeof value === "string" && value !== "") return value;
 	if (typeof value === "number") return String(value);
 }
-function escapeRegaString(s) {
-	return s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
-}
-var CONTROL_CHARS = /[\u0000-\u001F]/g;
-function sanitizeJsonControlChars(s) {
-	return s.replace(CONTROL_CHARS, "");
-}
-function decodeRegaName(encoded) {
-	const bytes = [];
-	for (let i = 0; i < encoded.length; i += 1) {
-		const ch = encoded[i];
-		if (ch === "%" && i + 2 < encoded.length) {
-			const hex = encoded.slice(i + 1, i + 3);
-			const byte = Number.parseInt(hex, 16);
-			if (!Number.isNaN(byte) && /^[0-9a-fA-F]{2}$/.test(hex)) {
-				bytes.push(byte);
-				i += 2;
-				continue;
-			}
-		}
-		if (ch === "+") {
-			bytes.push(32);
-			continue;
-		}
-		bytes.push(ch.charCodeAt(0) & 255);
-	}
-	return Buffer.from(bytes).toString("latin1");
-}
-function substitute(body, params) {
-	let out = body;
-	for (const [key, value] of Object.entries(params)) {
-		const escaped = escapeRegaString(String(value));
-		out = out.split(`##${key}##`).join(escaped);
-	}
-	return out;
-}
-async function runScript(client, sessionId, body, params) {
-	const script = params ? substitute(body, params) : body;
-	const result = await client.post(JsonRpcMethod.REGA_RUN_SCRIPT, { script }, sessionId !== void 0 ? { sessionId } : void 0);
-	if (result === void 0 || result === null) throw new ClientError("ReGa.runScript returned no result");
-	if (typeof result === "string") return JSON.parse(sanitizeJsonControlChars(result));
-	return result;
-}
-var SET_SYSTEM_VARIABLE = `object sv = dom.GetObject("##name##");
-if (sv) {
-    sv.State("##value##");
-}`;
-var SET_PROGRAM_STATE = `object prog = dom.GetObject(##id##);
-if (prog) {
-    prog.Active(##state##);
-}`;
-var SYSVAR_DESCRIPTIONS = `string sSysVarId;
-string sSep = "";
-WriteLine("[");
-foreach(sSysVarId, dom.GetObject(ID_SYSTEM_VARIABLES).EnumUsedIDs()) {
-    object oSysVar = dom.GetObject(sSysVarId);
-    Write(sSep);
-    Write("{");
-    Write("\\"id\\":");
-    Write(oSysVar.ID());
-    Write(",\\"description\\":\\"");
-    Write(oSysVar.DPInfo().UriEncode());
-    Write("\\"}");
-    sSep = ",";
-}
-WriteLine("]");`;
-var GET_ROOMS_FUNCTIONS = `string sChnId;
-string sRoomId;
-string sFuncId;
-string sChnSepR = "";
-string sChnSepF = "";
-Write("{\\"rooms\\":{");
-foreach(sChnId, dom.GetObject(ID_CHANNELS).EnumUsedIDs()) {
-    object oChn = dom.GetObject(sChnId);
-    if (oChn) {
-        string sAddr = oChn.Address();
-        object oRooms = oChn.ChnRoom();
-        if (oRooms && oRooms.Count() > 0) {
-            Write(sChnSepR);
-            Write("\\"");
-            Write(sAddr);
-            Write("\\":[");
-            string sRoomSep = "";
-            foreach(sRoomId, oRooms) {
-                object oRoom = dom.GetObject(sRoomId);
-                Write(sRoomSep);
-                Write("\\"");
-                Write(oRoom.Name().UriEncode());
-                Write("\\"");
-                sRoomSep = ",";
-            }
-            Write("]");
-            sChnSepR = ",";
-        }
-    }
-}
-Write("},\\"functions\\":{");
-foreach(sChnId, dom.GetObject(ID_CHANNELS).EnumUsedIDs()) {
-    object oChn = dom.GetObject(sChnId);
-    if (oChn) {
-        string sAddr = oChn.Address();
-        object oFuncs = oChn.ChnFunction();
-        if (oFuncs && oFuncs.Count() > 0) {
-            Write(sChnSepF);
-            Write("\\"");
-            Write(sAddr);
-            Write("\\":[");
-            string sFuncSep = "";
-            foreach(sFuncId, oFuncs) {
-                object oFunc = dom.GetObject(sFuncId);
-                Write(sFuncSep);
-                Write("\\"");
-                Write(oFunc.Name().UriEncode());
-                Write("\\"");
-                sFuncSep = ",";
-            }
-            Write("]");
-            sChnSepF = ",";
-        }
-    }
-}
-Write("}}");`;
 var HubValueType = /* @__PURE__ */ ((HubValueType2) => {
 	HubValueType2["ALARM"] = "ALARM";
 	HubValueType2["FLOAT"] = "FLOAT";
@@ -114574,7 +116006,7 @@ function parseSysVarValue(type, raw) {
 	}
 }
 var WRITABLE_MARKER = "HAHM";
-function isRecord(value) {
+function isRecord2(value) {
 	return value !== null && typeof value === "object";
 }
 function asString2(value) {
@@ -114593,9 +116025,9 @@ function asOptionalNumber(value) {
 	const num = Number(value);
 	return Number.isFinite(num) ? num : void 0;
 }
-function asRecordArray(value) {
+function asRecordArray2(value) {
 	if (!Array.isArray(value)) return [];
-	return value.filter(isRecord);
+	return value.filter(isRecord2);
 }
 var HubFetcher = class {
 	client;
@@ -114614,7 +116046,7 @@ var HubFetcher = class {
 	*/
 	async fetchSystemVariables() {
 		const sid = this.sid();
-		const entries = asRecordArray(await this.client.post(JsonRpcMethod.SYSVAR_GET_ALL, void 0, sidOpts(sid)));
+		const entries = asRecordArray2(await this.client.post(JsonRpcMethod.SYSVAR_GET_ALL, void 0, sidOpts(sid)));
 		const descriptions = await this.fetchSysVarDescriptions();
 		return entries.map((entry) => this.toSystemVariable(entry, descriptions));
 	}
@@ -114656,7 +116088,7 @@ var HubFetcher = class {
 	/** Fetch all programs, coercing flags to booleans. */
 	async fetchPrograms() {
 		const sid = this.sid();
-		return asRecordArray(await this.client.post(JsonRpcMethod.PROGRAM_GET_ALL, void 0, sidOpts(sid))).map((entry) => {
+		return asRecordArray2(await this.client.post(JsonRpcMethod.PROGRAM_GET_ALL, void 0, sidOpts(sid))).map((entry) => {
 			const lastExecuteTime = entry.lastExecuteTime;
 			return {
 				id: asString2(entry.id),
@@ -114688,8 +116120,8 @@ var HubFetcher = class {
 		const sid = this.sid();
 		const parsed = await runScript(this.client, sid, GET_ROOMS_FUNCTIONS);
 		return {
-			rooms: toDecodedMap(isRecord(parsed) ? parsed.rooms : void 0),
-			functions: toDecodedMap(isRecord(parsed) ? parsed.functions : void 0)
+			rooms: toDecodedMap(isRecord2(parsed) ? parsed.rooms : void 0),
+			functions: toDecodedMap(isRecord2(parsed) ? parsed.functions : void 0)
 		};
 	}
 	/** Build the `SYSVAR_DESCRIPTIONS` map: sysvar id → description text. */
@@ -114698,7 +116130,7 @@ var HubFetcher = class {
 		const out = /* @__PURE__ */ new Map();
 		try {
 			const parsed = await runScript(this.client, sid, SYSVAR_DESCRIPTIONS);
-			for (const entry of asRecordArray(parsed)) {
+			for (const entry of asRecordArray2(parsed)) {
 				const id = asString2(entry.id);
 				if (id !== "") out.set(id, asString2(entry.description));
 			}
@@ -114735,7 +116167,7 @@ function sidOpts(sid) {
 }
 function toDecodedMap(value) {
 	const map = /* @__PURE__ */ new Map();
-	if (!isRecord(value)) return map;
+	if (!isRecord2(value)) return map;
 	for (const [addr, names] of Object.entries(value)) if (Array.isArray(names)) map.set(addr, names.filter((n) => typeof n === "string").map((n) => decodeRegaName(n)));
 	return map;
 }
@@ -115264,6 +116696,7 @@ var CentralUnit = class {
 	ifaceById = /* @__PURE__ */ new Map();
 	jsonClient;
 	session;
+	webUi;
 	callbackServer;
 	router;
 	recovery;
@@ -115331,6 +116764,30 @@ var CentralUnit = class {
 		});
 	}
 	/**
+	* Build the {@link CcuManagement} bound to this central's interface clients and
+	* (when credentialed) its JSON-RPC client. The session id is ensured per call
+	* through the {@link SessionManager}, so renews apply. INTERNAL: the facade
+	* exposes it; it is not part of the published surface.
+	*/
+	getManagement() {
+		return new CcuManagement({
+			json: this.jsonClient,
+			webUi: this.webUi,
+			getSessionId: () => this.session !== void 0 ? this.session.ensureSession() : Promise.resolve(void 0),
+			interfaceClient: (iface) => {
+				for (const runtime of this.runtimes.values()) if (runtime.iface === iface) return runtime.client;
+			},
+			configuredInterfaces: () => this.interfaces
+		});
+	}
+	/**
+	* Remove a device from the interface owning it, routing by `interfaceId`.
+	* Throws if the interface is unknown.
+	*/
+	async deleteDevice(interfaceId2, address, flags) {
+		await this.clientFor(interfaceId2).deleteDevice(address, flags);
+	}
+	/**
 	* Read the discovered paramset DESCRIPTION (the spec — types, ranges, flags)
 	* for a channel + paramset key from the in-memory {@link ParamsetDescriptionCache}.
 	* Returns `undefined` if the paramset has not been discovered. This is the
@@ -115429,14 +116886,14 @@ var CentralUnit = class {
 		};
 		const tls = this.tls;
 		const port = this.portFor(iface);
-		const path$2 = INTERFACE_REMOTE_PATH[iface];
+		const path$6 = INTERFACE_REMOTE_PATH[iface];
 		return new InterfaceClient({
 			centralName: this.centralName,
 			interface: iface,
 			host: this.host,
 			port,
 			tls,
-			...path$2 !== void 0 ? { path: path$2 } : {},
+			...path$6 !== void 0 ? { path: path$6 } : {},
 			...auth !== void 0 ? { auth } : {},
 			callbackUrlProvider: () => this.callbackUrl()
 		});
@@ -115462,10 +116919,14 @@ var CentralUnit = class {
 	}
 	buildJsonRpc() {
 		if (this.credentials === void 0) return;
-		if (this.options.jsonClient !== void 0) this.jsonClient = this.options.jsonClient;
-		else {
-			const client = new JsonRpcClient({ url: `${this.tls ? "https" : "http"}://${this.host}` });
+		if (this.options.jsonClient !== void 0) {
+			this.jsonClient = this.options.jsonClient;
+			this.webUi = this.options.webUiClient;
+		} else {
+			const scheme = this.tls ? "https" : "http";
+			const client = new JsonRpcClient({ url: `${scheme}://${this.host}` });
 			this.jsonClient = client;
+			this.webUi = this.options.webUiClient ?? new WebUiHttpClient({ url: `${scheme}://${this.host}` });
 			this.session = new SessionManager({
 				client,
 				username: this.credentials.username,
@@ -116943,7 +118404,7 @@ var TypedEventEmitter = class {
 };
 var DEFAULT_CENTRAL_NAME = "nodehomematic";
 var pendingTestInjectables;
-function toInterface(name) {
+function toInterface2(name) {
 	const match = Object.values(Interface).includes(name) ? name : void 0;
 	if (match === void 0) throw new ValidationError(`Unknown interface "${name}".`);
 	return match;
@@ -116953,7 +118414,7 @@ function deviceAddressOf4(channelAddress2) {
 	return colon === -1 ? channelAddress2 : channelAddress2.slice(0, colon);
 }
 function buildCentral(options, injectables) {
-	const interfaces = options.interfaces.map(toInterface);
+	const interfaces = options.interfaces.map(toInterface2);
 	if (interfaces.length === 0) throw new ValidationError("At least one interface is required.");
 	if (injectables.central !== void 0) return injectables.central;
 	return new CentralUnit({
@@ -116986,6 +118447,8 @@ var Homematic = class {
 	#started = false;
 	/** Bound hub fetcher, or undefined when no JSON-RPC client is available. */
 	#hub;
+	/** CCU-management service, built on first use, cleared at stop(). */
+	#management;
 	/** Snapshot of system variables, refreshed on start / refreshHub. */
 	#sysvars = [];
 	/** Snapshot of programs, refreshed on start / refreshHub. */
@@ -117043,6 +118506,7 @@ var Homematic = class {
 		this.#customEntityList = [];
 		this.#customEntitiesByKey.clear();
 		this.#hub = void 0;
+		this.#management = void 0;
 		this.#sysvars = [];
 		this.#programs = [];
 		this.#roomsByDevice.clear();
@@ -117087,6 +118551,98 @@ var Homematic = class {
 		await this.#central.installFirmware(device.interfaceId, deviceAddress);
 	}
 	/**
+	* Every interface the CCU offers (BidCos-RF, HmIP-RF, VirtualDevices, ...)
+	* with connection state, duty cycle, firmware and type where the CCU reports
+	* them. A value the CCU did not answer is `null`, never `0`. Needs a started
+	* facade.
+	*
+	* CCU methods: JSON-RPC `Interface.listInterfaces` / `Interface.isPresent`
+	* (eq-3/occu `WebUI/www/api/methods/interface/`), XML-RPC
+	* `listBidcosInterfaces` on BidCos-RF, JSON-RPC `Interface.getDutyCycle`
+	* (RaspberryMatic / OpenCCU only) for the HmIP access point.
+	*/
+	async listInterfaces() {
+		return this.#requireManagement().listInterfaces();
+	}
+	/**
+	* Open (default 60 s, 1..3600) or close the pairing window of a configured
+	* interface. XML-RPC `setInstallMode`; `mode: 'secure'` (BidCos only) also
+	* teaches the HomeMatic Secure key.
+	*/
+	async setInstallMode(request) {
+		await this.#requireManagement().setInstallMode(request);
+	}
+	/** Seconds left of an interface's pairing window (`null` when the CCU's answer was unusable). XML-RPC `getInstallMode`. */
+	async getInstallMode(interfaceName) {
+		return this.#requireManagement().getInstallMode(interfaceName);
+	}
+	/**
+	* Remove a device from its interface (XML-RPC `deleteDevice`). `flags` is an OR
+	* of {@link HM_DELETE_FLAGS}: `RESET` (0x01, factory reset), `FORCE` (0x02,
+	* remove even when unreachable), `DEFER` (0x04, remove when next reachable);
+	* `0` is a plain removal. The model drops the device once the CCU reports it
+	* through the `deleteDevices` callback. Throws {@link ValidationError} for an
+	* unknown device or invalid flags.
+	*/
+	async deleteDevice(deviceAddress, flags = 0) {
+		this.#requireManagement();
+		const device = this.#devicesByAddress.get(deviceAddress);
+		if (device === void 0) throw new ValidationError(`Unknown device "${deviceAddress}".`);
+		if (!Number.isInteger(flags) || flags < 0 || flags > 7) throw new ValidationError(`Invalid delete flags ${String(flags)} (expected an integer 0..7).`);
+		await this.#central.deleteDevice(device.interfaceId, deviceAddress, flags);
+	}
+	/**
+	* The CCU's active service messages (UNREACH, LOWBAT, CONFIG_PENDING,
+	* STICKY_UNREACH, ...). Needs WebUI credentials. ReGa script over
+	* `ReGa.runScript` (eq-3/occu `WebUI/www/rega/esp/system.fn`, `ID_SERVICES`).
+	*/
+	async serviceMessages() {
+		return this.#requireManagement().serviceMessages();
+	}
+	/** Acknowledge a service message by its `id` (ReGa `AlReceipt`, as the WebUI does). Needs WebUI credentials. */
+	async acknowledgeServiceMessage(id) {
+		await this.#requireManagement().acknowledgeServiceMessage(id);
+	}
+	/**
+	* Version, product (CCU3 / RaspberryMatic / OpenCCU), serial and hostname.
+	* Needs WebUI credentials. JSON-RPC `CCU.getVersion`, `CCU.getSerial`
+	* (eq-3/occu `WebUI/www/api/methods/ccu/`) plus a ReGa read of `/VERSION`.
+	*/
+	async ccuInfo() {
+		return this.#requireManagement().ccuInfo();
+	}
+	/**
+	* The CCU's heating groups ("Gruppen"): HmIP heating groups and HomeMatic
+	* heating groups with their member channels. Writes are separate and
+	* undocumented: {@link Homematic.createGroup}, `updateGroup`, `deleteGroup`.
+	* JSON-RPC `CCU.getHeatingGroupList` (eq-3/occu
+	* `WebUI/www/api/methods/ccu/getheatinggrouplist.tcl`). Needs WebUI credentials.
+	*/
+	async groups() {
+		return this.#requireManagement().groups();
+	}
+	/**
+	* Create a heating group (`type` e.g. `hmip.heating.group`, `members` channel
+	* addresses). Resolves with the group as read back from the CCU; a write the
+	* read-back does not show rejects with `GroupWriteVerificationError`.
+	*
+	* UNDOCUMENTED and firmware-dependent: no CCU API exists for this, so the call
+	* reproduces the WebUI's own HMServer page requests (eq-3/occu
+	* `HMserver/opt/HMServer/pages/GroupEditPage.ftl`, `GroupListPage.ftl`).
+	* Needs WebUI credentials.
+	*/
+	async createGroup(input) {
+		return this.#requireManagement().createGroup(input);
+	}
+	/** Rename a group and/or replace its member list (same caveats as {@link Homematic.createGroup}). */
+	async updateGroup(id, patch) {
+		return this.#requireManagement().updateGroup(id, patch);
+	}
+	/** Delete a group, verified by the read-back (same caveats as {@link Homematic.createGroup}). */
+	async deleteGroup(id) {
+		await this.#requireManagement().deleteGroup(id);
+	}
+	/**
 	* The MASTER configuration parameters of a channel, with the metadata needed
 	* to render a form. Empty array when nothing is known for the channel.
 	*/
@@ -117474,6 +119030,12 @@ var Homematic = class {
 		if (byName !== void 0) return byName.id;
 		throw new ValidationError(`Unknown program "${idOrName}".`);
 	}
+	/** Return the management service (built on first use), or throw before start(). */
+	#requireManagement() {
+		if (!this.#started) throw new ValidationError("Homematic is not started; call start() first.");
+		this.#management ??= this.#central.getManagement();
+		return this.#management;
+	}
 	/** Return the bound hub fetcher, or throw if none (no credentials). */
 	#requireHub() {
 		if (this.#hub === void 0) throw new ValidationError("Hub is unavailable (no WebUI credentials configured).");
@@ -118491,14 +120053,15 @@ var HomematicProviderAddon = class extends BaseDeviceProvider {
 			],
 			customActions: homematicActions,
 			actionHandlers: { discoverCcu: async () => {
-				const { proposals, summary } = await this.discoverCcus();
+				const { candidates } = await this.ctx.api.deviceManager.discoverProvider.mutate({ addonId: this.ctx.id });
+				const hosts = candidates.map((candidate) => ({
+					host: String(candidate.prefilledConfig["host"] ?? ""),
+					name: candidate.suggestedName,
+					id: candidate.stableId.replace(/^homematic:/, "")
+				}));
 				return {
-					hosts: proposals.map((found) => ({
-						host: found.host,
-						name: found.name,
-						id: found.id
-					})),
-					summary
+					hosts,
+					summary: homematicDiscoverySummary(hosts.length, hosts.length)
 				};
 			} }
 		};
@@ -118533,18 +120096,21 @@ var HomematicProviderAddon = class extends BaseDeviceProvider {
 	async supportsManualCreation() {
 		return false;
 	}
-	/** LAN scan for CCU3 / RaspberryMatic WebUIs over the local /24 networks of this (hub-only) addon's host. */
+	/** A CCU is found by the scan engine's http-probe; this addon classifies the hits. */
 	async supportsDiscovery() {
 		return true;
 	}
-	async discoverDevices() {
-		const { proposals } = await this.discoverCcus();
-		return homematicDiscoveryCandidates(proposals).map((candidate) => ({
-			stableId: candidate.stableId,
-			type: DeviceType.Gateway,
-			suggestedName: candidate.suggestedName,
-			prefilledConfig: { ...candidate.prefilledConfig }
-		}));
+	async getDiscoveryModes() {
+		return HOMEMATIC_DISCOVERY_MODES;
+	}
+	async classifyDiscoveryHits(input) {
+		const found = ccusFromHits(input.hits);
+		const proposals = proposeHomematicCcus(found, await this.knownCcuHosts());
+		this.ctx.logger.info("Homematic CCU discovery finished", { meta: {
+			found: found.length,
+			proposed: proposals.length
+		} });
+		return homematicDiscoveryCandidates(proposals);
 	}
 	async adoptDiscoveredDevice(_input) {
 		throw new Error("A Homematic CCU is added from the integration form");
@@ -118555,23 +120121,6 @@ var HomematicProviderAddon = class extends BaseDeviceProvider {
 	async onCreateDevice(_type, _config) {
 		throw new Error("Homematic devices are adopted from the integration, not created manually");
 	}
-	async discoverCcus() {
-		let found = [];
-		try {
-			found = await browseHomematicCcus();
-		} catch (err) {
-			this.ctx.logger.warn("Homematic CCU discovery failed", { meta: { error: errMsg(err) } });
-		}
-		const proposals = proposeHomematicCcus(found, await this.knownCcuHosts());
-		this.ctx.logger.info("Homematic CCU discovery finished", { meta: {
-			found: found.length,
-			proposed: proposals.length
-		} });
-		return {
-			proposals,
-			summary: homematicDiscoverySummary(found.length, proposals.length)
-		};
-	}
 	async knownCcuHosts() {
 		try {
 			const all = await this.ctx.api.integrations.list.query();