@camstack/addon-provider-reolink 1.2.218 → 1.2.219

package/dist/addon.js

@@ -29171,7 +29171,7 @@ var require_lz4 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports) => {
 	};
 }));
 //#endregion
-//#region node_modules/@apocaliss92/nodelink-js/dist/chunk-OYFAZ255.js
+//#region node_modules/@apocaliss92/nodelink-js/dist/chunk-DBCXE3EJ.js
 var import_fxp = require_fxp();
 var import_lz4 = /* @__PURE__ */ require_chunk.__toESM(require_lz4(), 1);
 function bcHeaderLen(messageClass, buf, bodyLen) {
@@ -31248,6 +31248,13 @@ var BaichuanClient = class _BaichuanClient extends events.EventEmitter {
 	* others wait on the same promise.
 	*/
 	tcpConnectPromise;
+	/**
+	* Bound for a single TCP handshake. Without this (and without rejecting on
+	* `close`), a socket destroyed mid-connect left `tcpConnectPromise` pending
+	* forever — every later `sendXml`/`connect` that joined the same promise
+	* hung past its request timeout (which only started AFTER connect resolved).
+	*/
+	static TCP_CONNECT_TIMEOUT_MS = 1e4;
 	msgNum = 0;
 	loggedIn = false;
 	subscribed = false;
@@ -31843,6 +31850,26 @@ var BaichuanClient = class _BaichuanClient extends events.EventEmitter {
 			}
 		}
 	}
+	/**
+	* Connect, but fail if the handshake does not settle within `timeoutMs`.
+	* Returns remaining ms so callers can apply the rest of their budget to the
+	* request itself (request timers used to start only AFTER connect resolved,
+	* so a wedged `tcpConnectPromise` made every send hang forever).
+	*/
+	async connectWithDeadline(timeoutMs, label) {
+		const started = Date.now();
+		let timer;
+		try {
+			await Promise.race([this.connect(), new Promise((_, reject) => {
+				timer = setTimeout(() => {
+					reject(/* @__PURE__ */ new Error(`Baichuan connect timeout after ${timeoutMs}ms (${label})`));
+				}, Math.max(1, timeoutMs));
+			})]);
+		} finally {
+			if (timer) clearTimeout(timer);
+		}
+		return Math.max(1, timeoutMs - (Date.now() - started));
+	}
 	async connect() {
 		const desired = this.opts.transport ?? "tcp";
 		if (desired === "tcp") {
@@ -31976,8 +32003,30 @@ var BaichuanClient = class _BaichuanClient extends events.EventEmitter {
 			this.emit("error", err);
 		});
 		await new Promise((resolve, reject) => {
-			sock.once("connect", () => resolve());
-			sock.once("error", (e) => reject(e));
+			let settled = false;
+			const settle = (fn) => {
+				if (settled) return;
+				settled = true;
+				clearTimeout(timer);
+				sock.off("connect", onConnect);
+				sock.off("error", onError);
+				sock.off("close", onClose);
+				fn();
+			};
+			const onConnect = () => settle(() => resolve());
+			const onError = (e) => settle(() => reject(e));
+			const onClose = () => settle(() => reject(/* @__PURE__ */ new Error("Baichuan TCP connect aborted: socket closed")));
+			const timer = setTimeout(() => {
+				settle(() => {
+					try {
+						if (!sock.destroyed) sock.destroy();
+					} catch {}
+					reject(/* @__PURE__ */ new Error(`TCP connection timeout after ${_BaichuanClient.TCP_CONNECT_TIMEOUT_MS}ms`));
+				});
+			}, _BaichuanClient.TCP_CONNECT_TIMEOUT_MS);
+			sock.once("connect", onConnect);
+			sock.once("error", onError);
+			sock.once("close", onClose);
 		});
 		const sid = this.socketSessionId;
 		const localAddress = sock.localAddress;
@@ -32888,7 +32937,8 @@ var BaichuanClient = class _BaichuanClient extends events.EventEmitter {
 	async sendXml(params) {
 		const internal = params.internal === true;
 		if (!internal) this.touchUserActivity(`sendXml cmdId=${params.cmdId}`);
-		await this.connect();
+		const timeoutMs = params.timeoutMs ?? 1e4;
+		const remainingMs = await this.connectWithDeadline(timeoutMs, `sendXml cmdId=${params.cmdId}`);
 		if (!internal) this.kickIdleDisconnectTimer();
 		const channel = params.channel ?? this.opts.channel ?? 0;
 		const channelId = params.channelIdOverride ?? (params.channel == null ? this.hostChannelId : channel + 1);
@@ -32913,12 +32963,11 @@ var BaichuanClient = class _BaichuanClient extends events.EventEmitter {
 		const enc = params.encryption ?? this.enc;
 		const bodyBytes = this.encodeBodyXml(extXml, payloadXml, channelId, enc);
 		const wire = Buffer.concat([header, bodyBytes]);
-		const timeoutMs = params.timeoutMs ?? 1e4;
 		const framePromise = new Promise((resolve, reject) => {
 			const t = setTimeout(() => {
 				this.pending.delete(pendingKey);
 				reject(/* @__PURE__ */ new Error(`Baichuan timeout cmdId=${cmdId} msgNum=${msgNum}`));
-			}, timeoutMs);
+			}, remainingMs);
 			this.pending.set(pendingKey, {
 				resolve: (f) => {
 					clearTimeout(t);
@@ -32975,7 +33024,8 @@ var BaichuanClient = class _BaichuanClient extends events.EventEmitter {
 	async sendFrame(params) {
 		const internal = params.internal === true;
 		if (!internal) this.touchUserActivity(`sendFrame cmdId=${params.cmdId}`);
-		await this.connect();
+		const timeoutMs = params.timeoutMs ?? 1e4;
+		const remainingMs = await this.connectWithDeadline(timeoutMs, `sendFrame cmdId=${params.cmdId}`);
 		if (!internal) this.kickIdleDisconnectTimer();
 		const channel = params.channel ?? this.opts.channel ?? 0;
 		const channelId = params.channelIdOverride ?? (params.channel == null ? this.hostChannelId : channel + 1);
@@ -33000,12 +33050,11 @@ var BaichuanClient = class _BaichuanClient extends events.EventEmitter {
 		const enc = params.encryption ?? this.enc;
 		const bodyBytes = this.encodeBodyXml(extXml, payloadXml, channelId, enc);
 		const wire = Buffer.concat([header, bodyBytes]);
-		const timeoutMs = params.timeoutMs ?? 1e4;
 		const framePromise = new Promise((resolve, reject) => {
 			const t = setTimeout(() => {
 				this.pending.delete(pendingKey);
 				reject(/* @__PURE__ */ new Error(`Baichuan timeout cmdId=${cmdId} msgNum=${msgNum}`));
-			}, timeoutMs);
+			}, remainingMs);
 			this.pending.set(pendingKey, {
 				resolve: (f) => {
 					clearTimeout(t);
@@ -37615,10 +37664,18 @@ var mapToSimpleEvent = (event) => {
 	}
 	return null;
 };
-var shouldAcceptSleepPushSource = (source, preference, webhookSupported) => {
+var shouldAcceptSleepPushSource = (source, preference, options) => {
 	if (source !== "email" && source !== "baichuanWebhook") return true;
+	const opts = typeof options === "boolean" ? {
+		webhookSupported: options,
+		webhookDeliverySeen: options
+	} : options;
 	const pref = preference === "webhook" || preference === "email" ? preference : "auto";
-	return pref === "webhook" || pref === "auto" && webhookSupported ? source === "baichuanWebhook" : source === "email";
+	if (pref === "email") return source === "email";
+	if (pref === "webhook") return source === "baichuanWebhook";
+	if (!opts.webhookSupported) return source === "email";
+	if (opts.webhookDeliverySeen) return source === "baichuanWebhook";
+	return true;
 };
 var DEFAULT_SHELTER_CANVAS = {
 	width: 540,
@@ -38966,19 +39023,10 @@ function parsePtzGuardXml(xml) {
 	};
 }
 var emitter = new events.EventEmitter();
-var lastEventByCamera = /* @__PURE__ */ new Map();
-var MAX_GLOBAL_EVENTS = 300;
-var globalRecentEvents = [];
 function onEmailPushEvent(handler) {
 	emitter.on("event", handler);
 	return () => emitter.off("event", handler);
 }
-function emitEmailPushEvent(event) {
-	lastEventByCamera.set(event.cameraId, event);
-	globalRecentEvents.unshift(event);
-	if (globalRecentEvents.length > MAX_GLOBAL_EVENTS) globalRecentEvents.length = MAX_GLOBAL_EVENTS;
-	emitter.emit("event", event);
-}
 function mapEmailPushInferredType(inferred) {
 	switch (inferred) {
 		case "motion":
@@ -38991,6 +39039,52 @@ function mapEmailPushInferredType(inferred) {
 		default: return "motion";
 	}
 }
+var AI_OBJECT_MAP = {
+	people: "people",
+	person: "people",
+	human: "people",
+	vehicle: "vehicle",
+	car: "vehicle",
+	dog_cat: "animal",
+	dog: "animal",
+	cat: "animal",
+	pet: "animal",
+	face: "face",
+	package: "package"
+};
+function xmlTag(xml, tag2) {
+	return (new RegExp(`<${tag2}>([^<]*)</${tag2}>`, "i").exec(xml)?.[1] ?? "").trim().toLowerCase();
+}
+function splitCsv(value) {
+	return value.split(",").map((s) => s.trim().toLowerCase()).filter((s) => s.length > 0);
+}
+function mapBaichuanWebhookAlarmXmlToSimpleEvents(xml) {
+	if (!xml || !/<AlarmEvent\b/i.test(xml)) return [];
+	const out = /* @__PURE__ */ new Set();
+	for (const match of xml.matchAll(/<AlarmEvent\b[^>]*>([\s\S]*?)<\/AlarmEvent>/gi)) {
+		const block = match[1] ?? "";
+		const status = splitCsv(xmlTag(block, "status"));
+		const ai = splitCsv(xmlTag(block, "AItype") || xmlTag(block, "aiType") || xmlTag(block, "aitype"));
+		if (status.includes("visitor")) {
+			out.add("doorbell");
+			continue;
+		}
+		const objects = [];
+		for (const token of ai) {
+			if (token === "none" || token === "other") continue;
+			const mapped = AI_OBJECT_MAP[token];
+			if (mapped) objects.push(mapped);
+		}
+		if (objects.length > 0) {
+			for (const t of objects) out.add(t);
+			continue;
+		}
+		const statusIndicatesMotion = status.some((s) => s !== "none" && s !== "visitor" && s !== "dn" && s !== "daynight");
+		const aiIndicatesMotion = ai.some((a) => a !== "none");
+		if (statusIndicatesMotion || aiIndicatesMotion) out.add("motion");
+	}
+	return [...out];
+}
 var emitter2 = new events.EventEmitter();
 var lastEventByCamera2 = /* @__PURE__ */ new Map();
 var MAX_GLOBAL_EVENTS2 = 300;
@@ -39015,6 +39109,11 @@ function mapBaichuanWebhookToSimpleEvents(event) {
 	if (reason === "pir") return ["motion", "awake"];
 	return ["awake"];
 }
+function mapBaichuanWebhookParsedToSimpleEvents(parsed) {
+	if (parsed.kind === "event") return mapBaichuanWebhookToSimpleEvents(parsed);
+	if (parsed.cmdId === 33) return mapBaichuanWebhookAlarmXmlToSimpleEvents(parsed.xml);
+	return [];
+}
 var parser = new import_fxp.XMLParser({
 	ignoreAttributes: false,
 	attributeNamePrefix: "@_",
@@ -42592,13 +42691,19 @@ var ReolinkBaichuanApi = class _ReolinkBaichuanApi {
 		const matches = "match" in params ? params.match : (event) => event.cameraId === params.cameraId;
 		return onBaichuanWebhookEvent((event) => {
 			if (!matches(event)) return;
-			const types = mapBaichuanWebhookToSimpleEvents(event);
+			const types = mapBaichuanWebhookParsedToSimpleEvents(event.raw);
 			for (const type of types) this.dispatchSimpleEvent({
 				type,
 				channel,
 				timestamp: event.receivedAtMs,
 				source: "baichuanWebhook"
 			});
+			if (types.some((t) => t !== "motion" && t !== "doorbell" && t !== "awake" && t !== "sleeping" && t !== "other") && !types.includes("motion")) this.dispatchSimpleEvent({
+				type: "motion",
+				channel,
+				timestamp: event.receivedAtMs,
+				source: "baichuanWebhook"
+			});
 			if (onEvent) try {
 				onEvent(event);
 			} catch (err) {
@@ -44677,7 +44782,7 @@ var ReolinkBaichuanApi = class _ReolinkBaichuanApi {
 		const uid = await this.ensureUidForRecordings(channel, void 0);
 		const payloadXml = buildFileInfoListReplayByNameXml({
 			channel,
-			xmlChannelId: 0,
+			xmlChannelId: channel,
 			name: params.fileName,
 			uid,
 			streamType
@@ -44733,6 +44838,7 @@ var ReolinkBaichuanApi = class _ReolinkBaichuanApi {
 				});
 				await dedicatedClient.sendXml({
 					cmdId: 7,
+					extensionXml: "",
 					channel,
 					payloadXml: stopXml,
 					messageClass: require_chunk_LXENEW4N.BC_CLASS_MODERN_24,
@@ -44785,7 +44891,7 @@ var ReolinkBaichuanApi = class _ReolinkBaichuanApi {
 		const headerChannelIdOverride = this.resolveHeaderChannelIdForLogicalChannel(channel);
 		const payloadXml = buildFileInfoListReplayByIdXml({
 			channel,
-			xmlChannelId: 0,
+			xmlChannelId: channel,
 			id: params.fileName,
 			...uid ? { uid } : {},
 			streamType
@@ -44842,6 +44948,7 @@ var ReolinkBaichuanApi = class _ReolinkBaichuanApi {
 				});
 				await dedicatedClient.sendXml({
 					cmdId: 7,
+					extensionXml: "",
 					channel,
 					payloadXml: stopXml,
 					messageClass: require_chunk_LXENEW4N.BC_CLASS_MODERN_24,
@@ -45772,13 +45879,13 @@ ${stderr}`));
 		if (isNvr) uid = await this.ensureUidForRecordings(channel, params.uid);
 		const payloadXml = ident.includes("/") ? buildFileInfoListReplayByIdXml({
 			channel,
-			xmlChannelId: 0,
+			xmlChannelId: channel,
 			id: ident,
 			...uid ? { uid } : {},
 			streamType
 		}) : buildFileInfoListReplayByNameXml({
 			channel,
-			xmlChannelId: 0,
+			xmlChannelId: channel,
 			name: ident,
 			...uid ? { uid } : {},
 			streamType
@@ -45945,6 +46052,7 @@ ${stderr}`));
 		try {
 			await this.client.sendXml({
 				cmdId: 7,
+				extensionXml: "",
 				channel: params.channel,
 				payloadXml: buildFileInfoListStopXml({
 					channel: params.channel,
@@ -98122,10 +98230,8 @@ var require_mailparser = /* @__PURE__ */ require_chunk.__commonJSMin(((exports,
 		simpleParser: require_simple_parser()
 	};
 }));
-//#endregion
-//#region node_modules/@apocaliss92/nodelink-js/dist/index.js
-var import_smtp_server = require_smtp_server();
-var import_mailparser = require_mailparser();
+require_smtp_server();
+require_mailparser();
 function buildRfc4571Sdp(video, audio) {
 	let out = "v=0\r\n";
 	out += "o=- 0 0 IN IP4 0.0.0.0\r\n";
@@ -100533,271 +100639,18 @@ function resolveAlawmulaw() {
 	throw new Error("alawmulaw: unable to resolve mulaw/alaw codecs from module exports");
 }
 var { mulaw, alaw } = resolveAlawmulaw();
-async function loadEmailPushTls(params) {
-	const certPath = path.default.join(params.dir, "cert.pem");
-	const keyPath = path.default.join(params.dir, "key.pem");
-	const warn = params.warn ?? ((m) => console.warn(`[email-push-tls] ${m}`));
-	if (!fs.default.existsSync(certPath) || !fs.default.existsSync(keyPath)) {
-		warn(`Email-push TLS requested but ${certPath} or ${keyPath} is missing. Place a PEM cert+key under that directory to enable STARTTLS, or disable TLS in the consumer config to silence this warning.`);
-		return;
-	}
-	return {
-		cert: fs.default.readFileSync(certPath),
-		key: fs.default.readFileSync(keyPath)
-	};
-}
-async function defaultLoadTls(dir, warn) {
-	return loadEmailPushTls({
-		dir,
-		warn
-	});
-}
-function classifyMessage(parsed) {
-	const haystack = `${parsed.subject ?? ""} ${parsed.text ?? ""}`.toLowerCase();
+function classifyEmailPushMessage(input) {
+	const haystack = `${(input.subject ?? "").toLowerCase()} ${(input.text ?? "").toLowerCase()}`;
 	if (/person|people|human/.test(haystack)) return "people";
 	if (/vehicle|car|truck/.test(haystack)) return "vehicle";
 	if (/dog[_\s-]?cat|pet|animal/.test(haystack)) return "animal";
 	if (/face/.test(haystack)) return "face";
 	if (/package|parcel/.test(haystack)) return "package";
-	if (/doorbell|ring(?:ing)?\s+button/.test(haystack)) return "doorbell";
+	if (/ring(?:ing)?\s+button|doorbell\s+(?:press|ring|button)|visitor\s+at|someone\s+rang/.test(haystack)) return "doorbell";
 	if (/motion|alarm|alert|detect/.test(haystack)) return "motion";
+	if (/\bdoorbell\b/.test(haystack) && !/\bfrom\s+[^\n]*doorbell/.test(haystack)) return "doorbell";
 	return "other";
 }
-function createEmailPushServer(params) {
-	const log = {
-		debug: params.logger?.debug ?? (() => {}),
-		info: params.logger?.info ?? (() => {}),
-		warn: params.logger?.warn ?? (() => {}),
-		error: params.logger?.error ?? (() => {})
-	};
-	let config = params.config;
-	let server;
-	let status = buildInitialStatus(config);
-	function parseRecipient(rcpt) {
-		const at = rcpt.lastIndexOf("@");
-		if (at <= 0 || at === rcpt.length - 1) return void 0;
-		return {
-			local: rcpt.slice(0, at),
-			domain: rcpt.slice(at + 1).toLowerCase()
-		};
-	}
-	function resolveCameraIdFromRecipient(rcpt) {
-		const parsed = parseRecipient(rcpt);
-		if (!parsed) return void 0;
-		if (parsed.domain !== config.domain.toLowerCase()) return void 0;
-		const match = parsed.local.match(/^cam-(.+)$/);
-		if (!match || !match[1]) return void 0;
-		return params.cameraResolver(match[1]);
-	}
-	async function handleIncomingMessage(cameraId, recipient, raw) {
-		let parsed;
-		try {
-			parsed = await (0, import_mailparser.simpleParser)(raw);
-		} catch (err) {
-			log.warn(`Failed to parse mail for ${cameraId}: ${err instanceof Error ? err.message : err}`);
-			status.messagesRejected++;
-			return;
-		}
-		const receivedAtMs = Date.now();
-		const event = {
-			cameraId,
-			recipient,
-			inferredType: classifyMessage(parsed),
-			receivedAtMs,
-			subject: parsed.subject ?? "",
-			from: typeof parsed.from === "object" && parsed.from !== null && "text" in parsed.from ? String(parsed.from.text) : "",
-			bodyExcerpt: (parsed.text ?? "").slice(0, 500)
-		};
-		status.messagesAccepted++;
-		log.info(`Email push for camera=${cameraId} type=${event.inferredType} subject="${event.subject.slice(0, 80)}"`);
-		emitEmailPushEvent(event);
-	}
-	async function start() {
-		if (server) {
-			log.debug("startEmailPushServer called but server already running");
-			return;
-		}
-		const tlsOptions = config.tls ? await (params.loadTls ?? defaultLoadTls)(config.tlsDir ?? "./email-push-tls", (m) => log.warn(m)) : void 0;
-		status = buildInitialStatus(config);
-		const next = new import_smtp_server.SMTPServer({
-			authOptional: !config.requireAuth,
-			disabledCommands: config.requireAuth ? [] : ["AUTH"],
-			allowInsecureAuth: !config.tls,
-			size: config.maxMessageBytes,
-			maxClients: 50,
-			socketTimeout: 6e4,
-			closeTimeout: 3e4,
-			logger: {
-				info: (...args) => log.info(formatSmtpLogArgs(args)),
-				debug: (...args) => log.debug(formatSmtpLogArgs(args)),
-				error: (...args) => log.warn(formatSmtpLogArgs(args))
-			},
-			...tlsOptions ? {
-				secure: false,
-				...tlsOptions
-			} : {},
-			onConnect(session, callback) {
-				log.info(`SMTP connect from ${session.remoteAddress} (sessionId=${session.id})`);
-				callback();
-			},
-			onClose(session) {
-				log.debug(`SMTP close ${session.remoteAddress} (sessionId=${session.id})`);
-			},
-			onMailFrom(address, session, callback) {
-				log.info(`SMTP MAIL FROM ${address.address} (sessionId=${session.id})`);
-				callback();
-			},
-			onAuth(auth, session, callback) {
-				const expectedUser = config.authUsername;
-				const expectedPass = config.authPassword;
-				if (!expectedUser || !expectedPass) {
-					log.warn(`SMTP AUTH rejected from ${session.remoteAddress} (sessionId=${session.id}): server has no credentials configured`);
-					return callback(/* @__PURE__ */ new Error("Email push auth not configured"));
-				}
-				const stripDomain = (u) => {
-					const at = u.lastIndexOf("@");
-					if (at < 0) return u;
-					const local = u.slice(0, at);
-					return u.slice(at + 1).toLowerCase() === config.domain.toLowerCase() ? local : u;
-				};
-				if (stripDomain(auth.username ?? "") === stripDomain(expectedUser) && auth.password === expectedPass) {
-					log.info(`SMTP AUTH ok method=${auth.method} user=${auth.username} (sessionId=${session.id})`);
-					return callback(null, { user: auth.username });
-				}
-				log.warn(`SMTP AUTH FAIL method=${auth.method} from=${session.remoteAddress} triedUser="${auth.username}" expectedUser="${expectedUser}" triedPasswordLen=${auth.password?.length ?? 0} (sessionId=${session.id})`);
-				return callback(/* @__PURE__ */ new Error("Invalid username or password"));
-			},
-			onRcptTo(address, session, callback) {
-				const cameraId = resolveCameraIdFromRecipient(address.address);
-				if (!cameraId) {
-					status.messagesRejected++;
-					log.warn(`SMTP RCPT TO rejected ${address.address} \u2014 unknown recipient (sessionId=${session.id})`);
-					return callback(/* @__PURE__ */ new Error(`Unknown recipient ${address.address} (not registered)`));
-				}
-				log.info(`SMTP RCPT TO ${address.address} \u2192 camera=${cameraId} (sessionId=${session.id})`);
-				callback();
-			},
-			onData(stream$5, session, callback) {
-				const startedAt = Date.now();
-				log.debug(`SMTP DATA start (sessionId=${session.id} from=${session.envelope.mailFrom ? session.envelope.mailFrom.address : "?"})`);
-				const chunks = [];
-				stream$5.on("data", (chunk) => chunks.push(chunk));
-				stream$5.on("end", () => {
-					const recipients = session.envelope.rcptTo?.map((r) => r.address) ?? [];
-					const buffer = Buffer.concat(chunks);
-					log.info(`SMTP DATA received ${buffer.length}B in ${Date.now() - startedAt}ms for ${recipients.length} recipient(s) (sessionId=${session.id})`);
-					const matched = recipients.map((r) => ({
-						recipient: r,
-						cameraId: resolveCameraIdFromRecipient(r)
-					})).filter((m) => Boolean(m.cameraId));
-					if (matched.length === 0) {
-						status.messagesRejected++;
-						log.warn(`SMTP DATA dropped \u2014 no recognised recipients in [${recipients.join(", ")}] (sessionId=${session.id})`);
-						return callback(/* @__PURE__ */ new Error("No recognised recipients"));
-					}
-					Promise.all(matched.map((m) => handleIncomingMessage(m.cameraId, m.recipient, buffer))).then(() => callback()).catch((err) => {
-						const msg = err instanceof Error ? err.message : String(err);
-						log.error(`Email push pipeline error (sessionId=${session.id}): ${msg}`);
-						status.lastErrorMessage = msg;
-						callback(new Error(msg));
-					});
-				});
-				stream$5.on("error", (err) => {
-					log.warn(`SMTP stream error (sessionId=${session.id}): ${err.message}`);
-					callback(err);
-				});
-			}
-		});
-		next.on("error", (err) => {
-			status.lastErrorMessage = err.message;
-			log.error(`Email push server error: ${err.code ?? ""} ${err.message}`);
-			const netServer = next.server;
-			if (server === next && netServer && netServer.listening === false) {
-				status.running = false;
-				setTimeout(() => {
-					if (server !== next) return;
-					try {
-						next.listen(config.port, config.bindHost, () => {
-							status.running = true;
-							log.warn(`Email push SMTP re-listened on ${config.bindHost}:${config.port} after error`);
-						});
-					} catch (e) {
-						log.error(`Email push re-listen failed: ${e.message}`);
-					}
-				}, 5e3).unref?.();
-			}
-		});
-		await new Promise((resolve, reject) => {
-			next.listen(config.port, config.bindHost, () => {
-				status.running = true;
-				status.startedAtMs = Date.now();
-				log.info(`Email push SMTP listening on ${config.bindHost}:${config.port} (domain=${config.domain}, auth=${config.requireAuth}, tls=${config.tls})`);
-				resolve();
-			});
-			next.once("error", reject);
-		});
-		server = next;
-	}
-	async function stop() {
-		if (!server) return;
-		const active = server;
-		server = void 0;
-		await new Promise((resolve) => {
-			active.close(() => resolve());
-		});
-		status.running = false;
-		log.info("Email push SMTP server stopped");
-	}
-	async function restart() {
-		await stop();
-		await start();
-	}
-	return {
-		start,
-		stop,
-		restart,
-		getStatus() {
-			return { ...status };
-		},
-		updateConfig(next) {
-			config = next;
-		}
-	};
-}
-function formatSmtpLogArgs(args) {
-	if (args.length === 0) return "[smtp]";
-	const [first, ...rest] = args;
-	let tag = "";
-	let formatArgs = args;
-	if (first && typeof first === "object" && !Array.isArray(first)) {
-		const meta = first;
-		const tnx = typeof meta.tnx === "string" ? meta.tnx : void 0;
-		const cid = typeof meta.cid === "string" ? meta.cid : void 0;
-		const sid = typeof meta.sid === "string" ? meta.sid : void 0;
-		const bits = [];
-		if (tnx) bits.push(tnx);
-		if (cid) bits.push(`cid=${cid}`);
-		if (sid) bits.push(`sid=${sid}`);
-		if (bits.length > 0) tag = ` [${bits.join(" ")}]`;
-		formatArgs = rest;
-	}
-	return `[smtp]${tag} ${(0, util.format)(...formatArgs)}`;
-}
-function buildInitialStatus(config) {
-	return {
-		enabled: true,
-		running: false,
-		port: config.port,
-		bindHost: config.bindHost,
-		domain: config.domain,
-		requireAuth: config.requireAuth,
-		tls: config.tls,
-		messagesAccepted: 0,
-		messagesRejected: 0,
-		startedAtMs: void 0,
-		lastErrorMessage: void 0
-	};
-}
 function asRecord(value) {
 	if (value && typeof value === "object" && !Array.isArray(value)) return value;
 }
@@ -101814,13 +101667,13 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/device-type-BOWLtoOt.mjs
+//#region ../types/dist/device-type-CfHw_quR.mjs
 /**
 import { errMsg } from '@camstack/types'
 * Extract a human-readable message from an unknown error value.
 * Replaces the ubiquitous `errMsg(err)` pattern.
 */
-function errMsg$2(err) {
+function errMsg$3(err) {
 	if (err instanceof Error) return err.message;
 	if (typeof err === "string") return err;
 	return String(err);
@@ -102003,6 +101856,9 @@ var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
 	DeviceFeature["CoverPositionable"] = "cover-positionable";
 	/** Cover exposes slat-tilt control. Gates the tilt slider UI. */
 	DeviceFeature["CoverTilt"] = "cover-tilt";
+	/** Cover has a real stop: `stop` halts the travel in place. Gates the stop
+	*  control in exporters; a provider whose `stop` is a no-op never declares it. */
+	DeviceFeature["CoverStoppable"] = "cover-stoppable";
 	/** Valve exposes intermediate position control (0..100). Gates the
 	*  position slider / drag surface UI. */
 	DeviceFeature["ValvePositionable"] = "valve-positionable";
@@ -106868,7 +106724,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-B-vp7x15.mjs
+//#region ../types/dist/sleep-QsoHs66J.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -106985,7 +106841,7 @@ function isKeychainStoredField(field) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$6(value) {
+function isRecord$7(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -106996,16 +106852,16 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$6(value)) return false;
+	if (!isRecord$7(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 /** Anything carrying a `$secret` key — a stored marker or a UI view of one. */
 function isSecretMarkerLike(value) {
-	return isRecord$6(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
+	return isRecord$7(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
 }
 function isSecretClear(value) {
-	return isRecord$6(value) && value["$secretClear"] === true;
+	return isRecord$7(value) && value["$secretClear"] === true;
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -107388,6 +107244,53 @@ function emitReadiness(bus, params) {
 		ts
 	}));
 }
+/** Why a catalogue entry is not a runnable body of its declared kind. */
+var AddonMigrationDefinitionError = class extends Error {
+	id;
+	constructor(id, message) {
+		super(`${id}: ${message}`);
+		this.id = id;
+		this.name = "AddonMigrationDefinitionError";
+	}
+};
+/**
+* Bind a catalogue to the addon's ports. Throws {@link AddonMigrationDefinitionError} when
+* an entry's `bodyKind` does not match the body it carries, or is `sql` (a hub-only
+* body). A throwing body never escapes `execute`: it is reported as a failed result.
+*/
+function defineAddonMigrations(catalogue, ports) {
+	return catalogue.map((entry) => {
+		const { meta } = entry;
+		if ("plan" in entry) {
+			if (meta.bodyKind !== "plan") throw new AddonMigrationDefinitionError(meta.id, `carries a plan body but declares "${meta.bodyKind}"`);
+			return {
+				meta,
+				execute: () => guarded(async () => ({
+					kind: "plan",
+					plan: await entry.plan(ports)
+				}))
+			};
+		}
+		if (meta.bodyKind !== "procedure") throw new AddonMigrationDefinitionError(meta.id, `carries a procedure body but declares "${meta.bodyKind}"`);
+		return {
+			meta,
+			execute: () => guarded(async () => ({
+				kind: "procedure",
+				result: await entry.procedure(ports)
+			}))
+		};
+	});
+}
+async function guarded(work) {
+	try {
+		return await work();
+	} catch (err) {
+		return {
+			kind: "failed",
+			error: errMsg$3(err)
+		};
+	}
+}
 var NOT_RUN = {
 	declared: false,
 	snapshot: null,
@@ -107415,7 +107318,7 @@ async function runAddonMigrations(host, migrations, logger) {
 			metas: migrations.map((m) => m.meta)
 		});
 	} catch (err) {
-		log.error("the migration engine refused or could not take this addon catalogue — none ran", { meta: { error: errMsg$2(err) } });
+		log.error("the migration engine refused or could not take this addon catalogue — none ran", { meta: { error: errMsg$3(err) } });
 		return {
 			...NOT_RUN,
 			blockOwner: migrations.filter((m) => m.meta.onFailure === "block-owner").map((m) => m.meta.id)
@@ -107468,7 +107371,7 @@ async function runAddonMigrations(host, migrations, logger) {
 		} catch (err) {
 			log.error("migration could not be completed with the engine", {
 				tags,
-				meta: { error: errMsg$2(err) }
+				meta: { error: errMsg$3(err) }
 			});
 			failed.push(step.id);
 		}
@@ -107711,7 +107614,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$5(value) {
+function isRecord$6(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -107724,7 +107627,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$5(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$6(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -107779,7 +107682,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$5) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$6) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -107795,7 +107698,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$5(row)) {
+		if (!isRecord$6(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -107820,7 +107723,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$5(incoming)) {
+			if (!isRecord$6(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -107828,7 +107731,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$5(stored) ? stored : {};
+			const storedObj = isRecord$6(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -107951,7 +107854,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$5(v)) {
+		if (isRecord$6(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -107983,7 +107886,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord$4(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -108012,7 +107915,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord$4(item) && isRecord$4(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$5(item) && isRecord$5(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -108023,7 +107926,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord$4(value) && isRecord$4(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$5(value) && isRecord$5(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -108031,7 +107934,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord$4(incoming) || !isRecord$4(stored)) return incoming;
+	if (!isRecord$5(incoming) || !isRecord$5(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -108062,7 +107965,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord$4(a) && isRecord$4(b)) {
+	if (isRecord$5(a) && isRecord$5(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -108086,7 +107989,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord$4(value)) return null;
+	if (!isRecord$5(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -108705,6 +108608,44 @@ var BaseAddon = class {
 		return null;
 	}
 	/**
+	* D986 scoped settings: the form shape of the CLUSTER-wide settings one capability this addon
+	* provides owns, or `null` when it has none. `cap` is a capability name the addon's manifest
+	* declares. Stored as `addon-settings` rows `<addonId>.<field>`. The keys of this schema, of
+	* {@link nodeSettingsSchema} and of {@link deviceDefaultsSchema} are disjoint, and a key never
+	* contains `@` (guard `check-scoped-settings-declared`). SHAPE only: values are read by scope.
+	*/
+	async clusterSettingsSchema(_cap) {
+		return null;
+	}
+	/**
+	* D986: the form shape of the settings one capability owns PER NODE, or `null`. Stored as
+	* `addon-settings` rows `<addonId>.<field>@<nodeId>` carrying `nodeId` in the row data, so a
+	* forgotten node's rows go in one central delete.
+	*/
+	async nodeSettingsSchema(_cap) {
+		return null;
+	}
+	/**
+	* D986: the form shape of the FLEET DEFAULTS of the per-device settings one capability owns,
+	* or `null`. Stored as `addon-settings` rows `<addonId>.<field>`; a device resolves its value
+	* as device row, then this default, then the schema default (`resolveDeviceSettings`).
+	*/
+	async deviceDefaultsSchema(_cap) {
+		return null;
+	}
+	/**
+	* The host's read of the scoped declarations: the schema one capability declares for `scope`,
+	* or `null`. Beside {@link getIntegrationFormSchema}, the same shape: the hook is protected, the
+	* host asks this method.
+	*/
+	async getScopedSettingsSchema(scope, cap) {
+		switch (scope) {
+			case "cluster": return this.clusterSettingsSchema(cap);
+			case "node": return this.nodeSettingsSchema(cap);
+			case "device-defaults": return this.deviceDefaultsSchema(cap);
+		}
+	}
+	/**
 	* What the create wizard and the integration edit page render for one instance: the addon's
 	* per-instance schema when it declares one, else its global schema (what they always showed).
 	*/
@@ -109498,6 +109439,21 @@ function normalizeAddonInitResult(result) {
 	if (Array.isArray(result)) return { providers: result };
 	return result;
 }
+/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
+/** The files a kind may live in. `history` is device-history's (D850), never records. */
+var RECORD_DATABASES = ["settings", "events"];
+/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
+var RECORD_CLASSES = [
+	"config",
+	"ledger",
+	"audit",
+	"mirror",
+	"ephemeral"
+];
+var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
+var RECORD_MAX_DATA_BYTES = 1024 * 1024;
+var RECORD_BATCH_MAX = 1e3;
+var RECORD_QUERY_MAX = 1e3;
 /**
 * The share-view scope kinds a share-link token can carry. The hub mints
 * and validates them (`ShareViewGrantSchema` builds its
@@ -109522,21 +109478,6 @@ var PeerBytesTicketSchema = object({
 	*/
 	declaredBytes: number().int().nonnegative().nullable()
 });
-/** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
-/** The files a kind may live in. `history` is device-history's (D850), never records. */
-var RECORD_DATABASES = ["settings", "events"];
-/** The classes of a kind: the `@durable` vocabulary, one authority (replaces the annotation). */
-var RECORD_CLASSES = [
-	"config",
-	"ledger",
-	"audit",
-	"mirror",
-	"ephemeral"
-];
-var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
-var RECORD_MAX_DATA_BYTES = 1024 * 1024;
-var RECORD_BATCH_MAX = 1e3;
-var RECORD_QUERY_MAX = 1e3;
 function defOf(schema) {
 	const zodBag = Reflect.get(schema, "_zod");
 	if (typeof zodBag !== "object" || zodBag === null) return {};
@@ -110148,6 +110089,81 @@ var ProfileRtspEntrySchema = object({
 	codec: string().optional(),
 	resolution: CamStreamResolutionSchema.optional()
 });
+/** Every debug channel's name starts with this; the ring denies it by default. */
+var DEBUG_CHANNEL_PREFIX = "debug.";
+function isDebugChannelName(name) {
+	return name.startsWith(DEBUG_CHANNEL_PREFIX);
+}
+/**
+* Who is watching what, in THIS process. In-memory, moved off the log path.
+*
+* `active` is a plain boolean FIELD, read first: with no watch anywhere, a
+* `ctx.debug` call is one load and one branch.
+*/
+var DebugInterest = class {
+	active = false;
+	windows = /* @__PURE__ */ new Map();
+	/**
+	* Replace the interest with the FULL set of windows. Non-debug windows are
+	* ignored and an absent one is dropped, so a lost disarm cannot leave a
+	* channel running.
+	*/
+	apply(windows, nowMs) {
+		this.windows.clear();
+		for (const window of windows) {
+			if (!isDebugChannelName(window.channel) || window.armedUntilMs <= nowMs) continue;
+			const ids = window.deviceIds;
+			this.windows.set(window.channel, {
+				untilMs: window.armedUntilMs,
+				devices: ids === null || ids.length === 0 ? null : new Set(ids)
+			});
+		}
+		this.active = this.windows.size > 0;
+	}
+	/** Drop what has lapsed. Called on a timer, never from a log path. */
+	tick(nowMs) {
+		const closed = [];
+		for (const [name, window] of this.windows) if (window.untilMs <= nowMs) {
+			this.windows.delete(name);
+			closed.push(name);
+		}
+		this.active = this.windows.size > 0;
+		return closed;
+	}
+	/** `channel` is the full name, `debug.<channel>`. */
+	wants(channel, deviceId) {
+		if (!this.active) return false;
+		const window = this.windows.get(channel);
+		if (window === void 0) return false;
+		return window.devices === null || window.devices.has(deviceId);
+	}
+};
+var interestInstance = null;
+function getDebugInterest() {
+	interestInstance ??= new DebugInterest();
+	return interestInstance;
+}
+/**
+* Build `ctx.debug`. The thunk runs ONLY when somebody watches this
+* (channel, device) pair, and the line carries `tags: { deviceId }` plus the
+* `debug.<channel>` name as `logChannel`.
+*/
+function createDebugEmitter(logger, interest = getDebugInterest()) {
+	return (channel, deviceId, thunk) => {
+		if (!interest.active) return;
+		const name = `${DEBUG_CHANNEL_PREFIX}${channel}`;
+		if (!interest.wants(name, deviceId)) return;
+		const line = thunk();
+		const tags = {
+			deviceId,
+			logChannel: name
+		};
+		logger.info(line.message, line.meta === void 0 ? { tags } : {
+			tags,
+			meta: line.meta
+		});
+	};
+}
 /**
 * The model weight formats a catalog entry can ship. Schema-free on purpose:
 * `types/models.ts` builds Zod schemas from it, but a runner-closure consumer
@@ -110423,6 +110439,7 @@ var CAP_NAMES = Object.freeze([
 	"humidity-sensor",
 	"image",
 	"image-settings",
+	"integration-instances",
 	"integrations",
 	"intercom",
 	"ir-transmitter",
@@ -112394,7 +112411,7 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
 }
 //#endregion
-//#region ../types/dist/composition-kKKOdFIG.mjs
+//#region ../types/dist/composition-Dh3RfMx5.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -113608,6 +113625,94 @@ var NodeColorIdSchema = _enum([
 	"node-g",
 	"node-h"
 ]);
+//#endregion
+//#region ../types/dist/index.mjs
+/**
+* The `smtp-inbound` broker kind (D999): a mailbox a device can send mail to.
+*
+* The `broker` cap carries these as `Record<string, unknown>` on the wire; the
+* provider and its consumers parse them with the schemas below at BOTH ends, so
+* the shape is declared once.
+*/
+/** The broker kind tag. */
+var SMTP_INBOUND_KIND = "smtp-inbound";
+/** The id the first mailbox is minted under (adopt-id), so a consumer can find it again. */
+var SMTP_INBOUND_DEFAULT_ID = "smtp-inbound-default";
+var SMTP_INBOUND_DEFAULT_PORT = 2525;
+var SMTP_INBOUND_DEFAULT_DOMAIN = "camstack.local";
+var SMTP_INBOUND_DEFAULT_MAX_MESSAGE_BYTES = 25 * 1024 * 1024;
+/** The text excerpt a message carries on the bus. */
+var SMTP_INBOUND_TEXT_MAX_CHARS = 4096;
+var PortSchema = number().int().min(1).max(65535);
+/** A recipient local-part: what stands before the `@`. */
+var SmtpRecipientSchema = string().min(1).max(64).regex(/^[A-Za-z0-9._+-]+$/);
+object({
+	port: PortSchema.default(SMTP_INBOUND_DEFAULT_PORT),
+	bindHost: string().min(1).default("0.0.0.0"),
+	domain: string().min(1).default(SMTP_INBOUND_DEFAULT_DOMAIN),
+	requireAuth: boolean().default(true),
+	username: string().default(""),
+	password: string().default("").meta({ secret: true }),
+	starttls: boolean().default(false),
+	maxMessageBytes: number().int().positive().default(SMTP_INBOUND_DEFAULT_MAX_MESSAGE_BYTES)
+});
+/**
+* What `getBrokerConfig` answers: what a device needs to send mail here.
+* `host` is null when the `internal` role of the network palette is not set;
+* `hostReason` then says where to set it.
+*/
+var SmtpInboundConfigSchema = object({
+	host: string().min(1).nullable(),
+	hostReason: string().nullable(),
+	port: PortSchema,
+	domain: string().min(1),
+	requireAuth: boolean(),
+	username: string(),
+	password: string(),
+	starttls: boolean()
+});
+object({
+	recipients: array(SmtpRecipientSchema).min(1),
+	/**
+	* Who is subscribing. A second `subscribe` with the same id REPLACES that subscriber's
+	* recipients (the way a consumer that restarted, or lost a device, declares its set again);
+	* a recipient held by another subscriber is refused with `smtp-inbound/recipient-claimed`.
+	* Absent, the subscriber is anonymous and unique.
+	*/
+	subscriberId: string().min(1).max(64).optional()
+});
+var SmtpInboundAttachmentSchema = object({
+	filename: string(),
+	contentType: string(),
+	bytes: number().int().nonnegative()
+});
+/** The payload of one `broker.message` (the key is the recipient local-part). */
+var SmtpInboundMessageSchema = object({
+	/** Monotonic per mailbox; a gap tells a consumer it missed an event. */
+	seq: number().int().positive(),
+	messageId: string(),
+	receivedAt: number().int().nonnegative(),
+	from: string(),
+	to: string(),
+	subject: string(),
+	text: string().max(SMTP_INBOUND_TEXT_MAX_CHARS),
+	attachments: array(SmtpInboundAttachmentSchema)
+});
+/** What `getState('since:<seq>')` answers: every retained message after `seq`. */
+var SmtpInboundSinceSchema = object({
+	/** The newest seq issued so far (0 before any mail). */
+	lastSeq: number().int().nonnegative(),
+	/** The oldest seq still retained; messages below it are gone. */
+	oldestSeq: number().int().nonnegative(),
+	messages: array(object({
+		key: string(),
+		message: SmtpInboundMessageSchema
+	}))
+});
+/** The key a consumer passes to `getState` to replay the ring, and its parser. */
+function smtpSinceKey(seq) {
+	return `since:${seq}`;
+}
 new Set([
 	"track",
 	"face",
@@ -116773,81 +116878,6 @@ var TIMEZONES = [
 function findTimezone(id) {
 	return TIMEZONES.find((tz) => tz.id === id);
 }
-/** Every debug channel's name starts with this; the ring denies it by default. */
-var DEBUG_CHANNEL_PREFIX = "debug.";
-function isDebugChannelName(name) {
-	return name.startsWith(DEBUG_CHANNEL_PREFIX);
-}
-/**
-* Who is watching what, in THIS process. In-memory, moved off the log path.
-*
-* `active` is a plain boolean FIELD, read first: with no watch anywhere, a
-* `ctx.debug` call is one load and one branch.
-*/
-var DebugInterest = class {
-	active = false;
-	windows = /* @__PURE__ */ new Map();
-	/**
-	* Replace the interest with the FULL set of windows. Non-debug windows are
-	* ignored and an absent one is dropped, so a lost disarm cannot leave a
-	* channel running.
-	*/
-	apply(windows, nowMs) {
-		this.windows.clear();
-		for (const window of windows) {
-			if (!isDebugChannelName(window.channel) || window.armedUntilMs <= nowMs) continue;
-			const ids = window.deviceIds;
-			this.windows.set(window.channel, {
-				untilMs: window.armedUntilMs,
-				devices: ids === null || ids.length === 0 ? null : new Set(ids)
-			});
-		}
-		this.active = this.windows.size > 0;
-	}
-	/** Drop what has lapsed. Called on a timer, never from a log path. */
-	tick(nowMs) {
-		const closed = [];
-		for (const [name, window] of this.windows) if (window.untilMs <= nowMs) {
-			this.windows.delete(name);
-			closed.push(name);
-		}
-		this.active = this.windows.size > 0;
-		return closed;
-	}
-	/** `channel` is the full name, `debug.<channel>`. */
-	wants(channel, deviceId) {
-		if (!this.active) return false;
-		const window = this.windows.get(channel);
-		if (window === void 0) return false;
-		return window.devices === null || window.devices.has(deviceId);
-	}
-};
-var interestInstance = null;
-function getDebugInterest() {
-	interestInstance ??= new DebugInterest();
-	return interestInstance;
-}
-/**
-* Build `ctx.debug`. The thunk runs ONLY when somebody watches this
-* (channel, device) pair, and the line carries `tags: { deviceId }` plus the
-* `debug.<channel>` name as `logChannel`.
-*/
-function createDebugEmitter(logger, interest = getDebugInterest()) {
-	return (channel, deviceId, thunk) => {
-		if (!interest.active) return;
-		const name = `${DEBUG_CHANNEL_PREFIX}${channel}`;
-		if (!interest.wants(name, deviceId)) return;
-		const line = thunk();
-		const tags = {
-			deviceId,
-			logChannel: name
-		};
-		logger.info(line.message, line.meta === void 0 ? { tags } : {
-			tags,
-			meta: line.meta
-		});
-	};
-}
 /**
 * Per-component log CHANNELS — the gate a hot path consults, and the registry
 * an addon declares its channels in.
@@ -122524,6 +122554,7 @@ var SYSTEM_CAP_VOCABULARY = {
 	"load-contribution": system(INTERNAL),
 	"local-network": system(NETWORK),
 	"log-channels": system(INTERNAL),
+	"integration-instances": system(INTERNAL),
 	"log-destination": system(INTERNAL),
 	"login-method": system(IDENTITY),
 	"mesh-network": system(NETWORK),
@@ -144730,7 +144761,7 @@ var TargetKindCapsSchema = object({
 * the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough$3 = unknown();
+var ConfigSchemaPassthrough$4 = unknown();
 var TargetKindSchema = object({
 	kind: string(),
 	label: string(),
@@ -144767,7 +144798,7 @@ var TargetKindSchema = object({
 	* its raster path, which is the safe default for an unknown image.
 	*/
 	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough$3,
+	configSchema: ConfigSchemaPassthrough$4,
 	/**
 	* The config keys that decide WHERE this kind's secrets are sent (server,
 	* base URL, instance, chat, recipient). A save that changes any of them
@@ -153663,10 +153694,23 @@ var DeviceDataEntrySchema = object({
 	/** Rows (or files) held for the device in the store. */
 	count: number().int().nonnegative()
 });
-method(DeviceRemovedInputSchema, DeviceRemovedResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(DeviceDataEntrySchema).readonly(), { auth: "admin" });
+var deviceRemovalHookCapability = {
+	name: "device-removal-hook",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		/** Delete everything this addon keeps for the deleted device. Idempotent. */
+		onDeviceRemoved: method(DeviceRemovedInputSchema, DeviceRemovedResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Which devices this addon holds data for, per store. Reads only. */
+		listDeviceData: method(_void(), array(DeviceDataEntrySchema).readonly(), { auth: "admin" })
+	},
+	/** In-process only — enumerated through `addons.listCapabilityProviders`. */
+	mount: { kind: "skip" }
+};
 /**
 * device-runs - the durable record of ONE run of a device: a washing cycle, a
 * dishwasher cycle, later a mow or a clean (D992).
@@ -156529,6 +156573,89 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 	auth: "admin"
 });
 /**
+* `integration-instances` - the connection of an addon that holds ONE or SEVERAL
+* (an account, a relay, a destination) as typed records (D985, D986). The addon's
+* own function page reads and writes them (Logging for Loki); the Integrations
+* page lists only the integrations that bring devices (D996).
+*
+* A collection of providers: each addon that holds connections registers one and a
+* caller reaches a provider with the pinned `addonId`.
+*
+* Identity: the instance id is immutable and opaque to the caller. A record the
+* Loki migration made keeps the `integrations` registry id it was created under
+* (`int_NNNN`); a single instance made by its function page takes the addon id.
+* `name` is the editable label.
+*
+* Secrets: every field the instance kind marks `.meta({ secret: true })` reaches
+* the form as a `SecretFieldView`, never text (D789). A patch value omitted, `''`
+* or the redaction token KEEPS the stored secret; `{ $secretClear: true }`
+* clears it.
+*/
+var ConfigSchemaPassthrough$3 = custom();
+var IntegrationInstanceIdSchema = string().min(1);
+var IntegrationInstanceDescriptionSchema = object({
+	/** `single`: at most one instance can exist (Loki). `multiple`: an account each. */
+	instanceMode: _enum(["single", "multiple"]),
+	/** What the instance is, for the UI (`destination`, `relay`, `account`). */
+	kind: string(),
+	/** True when `testInstance` really probes the remote. */
+	canTest: boolean()
+});
+var IntegrationInstanceStatusSchema = object({
+	state: _enum([
+		"ok",
+		"off",
+		"error",
+		"unknown"
+	]),
+	detail: string().optional()
+});
+var IntegrationInstanceSchema = object({
+	id: IntegrationInstanceIdSchema,
+	name: string(),
+	/** The addon's own rule (an URL is present, a client id is present...). */
+	configured: boolean(),
+	/**
+	* The instance's own on/off switch (D996): always present, derived from the record body
+	* (`enabled !== false`, so a row written before the field existed is on).
+	*/
+	enabled: boolean(),
+	/** Values for the instance form; a secret is a `SecretFieldView`, never text. */
+	formValues: record(string(), unknown()),
+	status: IntegrationInstanceStatusSchema.optional()
+});
+var IntegrationInstancePatchSchema = object({
+	id: IntegrationInstanceIdSchema,
+	name: string().min(1).optional(),
+	/** Omitted / '' / redaction token keeps a secret; `{ $secretClear: true }` clears it. */
+	values: record(string(), unknown())
+});
+method(_void(), IntegrationInstanceDescriptionSchema, { auth: "admin" }), method(object({ id: IntegrationInstanceIdSchema.nullable() }), ConfigSchemaPassthrough$3, { auth: "admin" }), method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }), method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }), method(object({
+	id: IntegrationInstanceIdSchema,
+	name: string().min(1)
+}), object({ id: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(IntegrationInstancePatchSchema, object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	id: IntegrationInstanceIdSchema,
+	enabled: boolean()
+}), object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: IntegrationInstanceIdSchema }), object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), optionalMethod(object({
+	id: IntegrationInstanceIdSchema.nullable(),
+	values: record(string(), unknown())
+}), TestConnectionResultSchema$1, {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * Two-way audio / talk-back cap. Clients open a WebRTC audio-only
 * session (server-initiated offer pattern, identical to the main
 * video WebRTC flow) and the browser captures the mic; the server
@@ -167337,7 +167464,14 @@ var NcMediaPolicySchema = object({
 	*/
 	profile: CamProfileSchema.optional(),
 	/** See {@link NcLinkedCameraModeSchema}. */
-	linkedCameras: NcLinkedCameraModeSchema.optional()
+	linkedCameras: NcLinkedCameraModeSchema.optional(),
+	/**
+	* Sensor rules only: may this rule wake a SLEEPING battery camera to take
+	* the linked still it attaches (D998)? Absent means yes, an explicit `false`
+	* opts out. Deliberately not a Zod default: a rule that never chose keeps
+	* following the hub's. One bounded wake per event; nothing is attached later.
+	*/
+	wakeSleepingCamera: boolean().optional()
 });
 /**
 * Cooldown GRANULARITY over the subject's class — how much a fired
@@ -176500,7 +176634,16 @@ var smokeCapability = {
 * future fields without breaking the existing call sites.
 */
 var EmailAddressSchema = email();
+/**
+* Which relay of a multi-relay provider answers (D996). Absent = the provider's first / default
+* relay, so a caller written before relays existed keeps working unchanged. A provider with one
+* fixed relay ignores it. This is the integration instance id (`int_NNNN`), NOT the addon id: the
+* collection pin `addonId` still picks the provider, `instanceId` picks the relay inside it.
+*/
+var InstanceIdSchema = string().min(1).optional();
+var RelayPinSchema = object({ instanceId: InstanceIdSchema });
 var SendEmailInputSchema = object({
+	instanceId: InstanceIdSchema,
 	to: union([EmailAddressSchema, array(EmailAddressSchema).min(1)]),
 	cc: array(EmailAddressSchema).optional(),
 	bcc: array(EmailAddressSchema).optional(),
@@ -176536,11 +176679,11 @@ method(SendEmailInputSchema, SendEmailResultSchema, {
 	kind: "mutation",
 	auth: "admin",
 	access: "create"
-}), method(_void(), SmtpStatusSchema, {
+}), method(RelayPinSchema, SmtpStatusSchema, {
 	kind: "mutation",
 	auth: "admin",
 	access: "view"
-}), method(_void(), SmtpStatusSchema, { auth: "admin" });
+}), method(RelayPinSchema, SmtpStatusSchema, { auth: "admin" });
 /**
 * A single device snapshot returned as base64 JPEG/PNG.
 *
@@ -176608,10 +176751,12 @@ var snapshotCapability = {
 			* even when the cache is well within the device's
 			* `snapshotMaxAgeS` window.
 			*
-			* **`force` is an OPERATOR signal, not a freshness preference.** On a
+			* **`force` is a demand with a named principal, not a freshness
+			* preference** — an operator button, the scheduled refresh (D847), or a
+			* notification rule that left the camera's wake allowed (D998). On a
 			* battery camera it is the one thing that walks past the wrapper's
-			* sleep gate and wakes the camera, so a background caller — a poller,
-			* an event handler, a thumbnail — must NEVER set it. Every such caller
+			* sleep gate and wakes the camera, so a poller, a thumbnail or a
+			* prestream must NEVER set it. Every such caller
 			* gets the cached frame, which on a sleeping battery camera is the
 			* correct answer: stale but honest beats woken.
 			*/
@@ -181954,7 +182099,7 @@ function withClipEventLabels(provider, deps) {
 		listClips
 	};
 }
-DeviceFeature.FanSpeed, DeviceFeature.FanPreset, DeviceFeature.FanDirection, DeviceFeature.FanOscillating, DeviceFeature.CoverPositionable, DeviceFeature.CoverTilt, DeviceFeature.ValvePositionable, DeviceFeature.MediaPlayerVolume, DeviceFeature.ClimateFanMode;
+DeviceFeature.FanSpeed, DeviceFeature.FanPreset, DeviceFeature.FanDirection, DeviceFeature.FanOscillating, DeviceFeature.CoverStoppable, DeviceFeature.CoverPositionable, DeviceFeature.CoverTilt, DeviceFeature.ValvePositionable, DeviceFeature.MediaPlayerVolume, DeviceFeature.ClimateFanMode;
 SOURCE_CAPS.filter((cap) => cap !== "switch" && cap !== "motion");
 String.raw`rose\(active(\d+), changed(\d+), (\d+(?:\.\d+)?)\)`;
 DeviceRole.BinarySensor, DeviceRole.MotionSensor;
@@ -187152,6 +187297,69 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"integrationInstances.createInstance": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"integrationInstances.deleteInstance": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
+	"integrationInstances.describe": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"integrationInstances.getInstance": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"integrationInstances.instanceFormSchema": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"integrationInstances.listInstances": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"integrationInstances.setInstanceEnabled": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"integrationInstances.testInstance": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"integrationInstances.updateInstance": {
+		capName: "integration-instances",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"integrations.create": {
 		capName: "integrations",
 		capScope: "system",
@@ -205787,7 +205995,7 @@ var ReolinkHubSession = class {
 		this.getApi().catch((err) => {
 			this.#logger.warn("Reolink hub initial connect failed — will retry", {
 				tags: { integrationId: this.integrationId },
-				meta: { error: errMsg$2(err) }
+				meta: { error: errMsg$3(err) }
 			});
 		});
 	}
@@ -205806,7 +206014,7 @@ var ReolinkHubSession = class {
 		this.getApi().catch((err) => {
 			this.#logger.warn("Reolink hub re-dial after settings change failed", {
 				tags: { integrationId: this.integrationId },
-				meta: { error: errMsg$2(err) }
+				meta: { error: errMsg$3(err) }
 			});
 		});
 	}
@@ -205867,7 +206075,7 @@ var ReolinkHubSession = class {
 		api.client.on("error", (err) => {
 			this.#logger.warn("Reolink hub socket error — scheduling reconnect", {
 				tags: { integrationId: this.integrationId },
-				meta: { error: errMsg$2(err) }
+				meta: { error: errMsg$3(err) }
 			});
 			this.#scheduleReconnect("socket-error");
 		});
@@ -205936,7 +206144,7 @@ var ReolinkHubSession = class {
 				isMultifocal: d.isMultifocal === true
 			}));
 		} catch (err) {
-			lastError = errMsg$2(err);
+			lastError = errMsg$3(err);
 			this.#logger.warn("Reolink hub channel refresh failed", {
 				tags: { integrationId: this.integrationId },
 				meta: { error: lastError }
@@ -206010,7 +206218,7 @@ var ReolinkHubSession = class {
 					meta: {
 						from: repair.from,
 						to: repair.to,
-						error: errMsg$2(err)
+						error: errMsg$3(err)
 					}
 				});
 			}
@@ -206123,7 +206331,7 @@ var ReolinkHubSession = class {
 		} catch (err) {
 			this.#logger.debug("Reolink hub: per-channel battery refresh failed", {
 				tags: { integrationId: this.integrationId },
-				meta: { error: errMsg$2(err) }
+				meta: { error: errMsg$3(err) }
 			});
 		}
 	}
@@ -206171,7 +206379,7 @@ var ReolinkHubSession = class {
 				tags: { deviceId: child.id },
 				meta: {
 					channel,
-					error: errMsg$2(err)
+					error: errMsg$3(err)
 				}
 			});
 		}
@@ -209197,7 +209405,7 @@ var IntercomOrchestrator = class {
 		if (this.opts.wakeBeforeStart) try {
 			await this.opts.wakeBeforeStart();
 		} catch (err) {
-			this.opts.logger.warn("intercom: pre-wake failed", { meta: { error: errMsg$1(err) } });
+			this.opts.logger.warn("intercom: pre-wake failed", { meta: { error: errMsg$2(err) } });
 			throw err;
 		}
 		const talkSession = new ReolinkIntercomSession({
@@ -209212,7 +209420,7 @@ var IntercomOrchestrator = class {
 		try {
 			await talkSession.start();
 		} catch (err) {
-			this.opts.logger.warn("intercom: talk session open failed", { meta: { error: errMsg$1(err) } });
+			this.opts.logger.warn("intercom: talk session open failed", { meta: { error: errMsg$2(err) } });
 			throw err;
 		}
 		const realCameraRate = talkSession.sampleRate;
@@ -209231,7 +209439,7 @@ var IntercomOrchestrator = class {
 		} catch (err) {
 			await talkSession.stop().catch(() => {});
 			this.opts.logger.warn("intercom: audio-codec createDecodeSession failed", { meta: {
-				error: errMsg$1(err),
+				error: errMsg$2(err),
 				opusRate,
 				opusChannels,
 				targetRate
@@ -209253,7 +209461,7 @@ var IntercomOrchestrator = class {
 		this.session = active;
 		peer.onOpusFrame((frame, pts) => {
 			this.handleOpusFrame(active, frame, pts).catch((err) => {
-				this.opts.logger.debug("intercom: opus frame pump error (dropped)", { meta: { error: errMsg$1(err) } });
+				this.opts.logger.debug("intercom: opus frame pump error (dropped)", { meta: { error: errMsg$2(err) } });
 			});
 		});
 		let offer;
@@ -209261,7 +209469,7 @@ var IntercomOrchestrator = class {
 			offer = await peer.createOffer();
 		} catch (err) {
 			await this.stop(sessionId, "start-failed-cleanup").catch(() => {});
-			this.opts.logger.warn("intercom: webrtc createOffer failed", { meta: { error: errMsg$1(err) } });
+			this.opts.logger.warn("intercom: webrtc createOffer failed", { meta: { error: errMsg$2(err) } });
 			throw err;
 		}
 		this.opts.logger.info("intercom session opened", { meta: {
@@ -209310,7 +209518,7 @@ var IntercomOrchestrator = class {
 		} catch (err) {
 			this.opts.logger.debug("intercom: peer.close error (continuing)", { meta: {
 				sessionId,
-				error: errMsg$1(err)
+				error: errMsg$2(err)
 			} });
 		}
 		try {
@@ -209321,7 +209529,7 @@ var IntercomOrchestrator = class {
 		} catch (err) {
 			this.opts.logger.debug("intercom: audio-codec.closeSession error (continuing)", { meta: {
 				sessionId,
-				error: errMsg$1(err)
+				error: errMsg$2(err)
 			} });
 		}
 		try {
@@ -209329,7 +209537,7 @@ var IntercomOrchestrator = class {
 		} catch (err) {
 			this.opts.logger.debug("intercom: talk-session.stop error (continuing)", { meta: {
 				sessionId,
-				error: errMsg$1(err)
+				error: errMsg$2(err)
 			} });
 		}
 		this.opts.logger.info("intercom session closed", { meta: {
@@ -209385,7 +209593,7 @@ var IntercomOrchestrator = class {
 function generateSessionId() {
 	return `intercom-${Date.now().toString(36)}-${Math.floor(Math.random() * 16777215).toString(36)}`;
 }
-function errMsg$1(err) {
+function errMsg$2(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -209444,7 +209652,7 @@ var WeriftIntercomPeer = class {
 				for (const cb of this.opusCallbacks) try {
 					cb(payload, ptsMs);
 				} catch (err) {
-					this.opts.logger.debug("intercom-peer: opus callback threw", { meta: { error: errMsg(err) } });
+					this.opts.logger.debug("intercom-peer: opus callback threw", { meta: { error: errMsg$1(err) } });
 				}
 			});
 			if (rtpSub && typeof rtpSub.unsubscribe === "function") this.rtpUnsubscribe = () => rtpSub.unsubscribe?.();
@@ -209492,7 +209700,7 @@ var WeriftIntercomPeer = class {
 		}
 	}
 };
-function errMsg(err) {
+function errMsg$1(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -210968,7 +211176,7 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	* `true` iff this camera can run its own email/SMTP push path. Hub
 	* children are excluded: they share the parent's TCP socket and have
 	* no independent email config, so the NVR/Hub handles email centrally.
-	* Consumed by the provider-level SMTP intake (`email-push-server.ts`)
+	* Consumed by the camera mailbox bridge (`email-push-bridge.ts`)
 	* to decide which cameras accept inbound mail + can be auto-configured.
 	*/
 	get isEmailPushEligible() {
@@ -211674,12 +211882,12 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 		}
 		if (!this.emailPushParamsResolver) {
 			this.ctx.logger.warn("email-push: resolver not wired — restart the Reolink addon", { tags: { deviceId: this.id } });
-			throw userError("reolink.email-push-not-wired", void 0, "Email Push Server is not wired — restart the Reolink addon");
+			throw userError("reolink.email-push-not-wired", void 0, "The camera mailbox is not wired — restart the Reolink addon");
 		}
 		const params = await this.emailPushParamsResolver();
 		if (!params) {
-			this.ctx.logger.warn("email-push: no manager params — enable the server + reachable LAN host", { tags: { deviceId: this.id } });
-			throw new Error("Enable the Email Push Server in the Reolink addon settings, and ensure this host has a reachable LAN address.");
+			this.ctx.logger.warn("email-push: no manager params — this camera cannot use the camera mailbox", { tags: { deviceId: this.id } });
+			throw new Error("This camera cannot use the camera mailbox.");
 		}
 		const triggers = this.config.get("emailPushTriggers") ?? [
 			"MD",
@@ -218663,15 +218871,6 @@ function mapInferredTypeToSimpleEvents(inferred) {
 		default: return ["motion"];
 	}
 }
-/** Default SMTP listen port. Avoid privileged 25; Reolink firmwares are
-*  happy on any port the email config points at. */
-var DEFAULT_EMAIL_PUSH_PORT = 2525;
-/** Virtual mail domain — only used to extract the camera id from the
-*  recipient (`cam-<id>@<domain>`). Never resolved via DNS. */
-var DEFAULT_EMAIL_PUSH_DOMAIN = "camstack.local";
-/** Reolink snapshots fit comfortably; 25 MB covers video attachments
-*  too without letting a runaway upload exhaust memory. */
-var DEFAULT_EMAIL_PUSH_MAX_MESSAGE_BYTES = 25 * 1024 * 1024;
 /**
 * Enumerate candidate camera-facing LAN addresses, best first (private
 * RFC-1918 ranges ranked ahead of public). Link-local and internal
@@ -218698,15 +218897,15 @@ function listLanHosts() {
 }
 //#endregion
 //#region src/baichuan-webhook-server.ts
-function readString$1(raw, key, fallback) {
+function readString(raw, key, fallback) {
 	const v = raw[key];
 	return typeof v === "string" && v.length > 0 ? v : fallback;
 }
-function readNumber$1(raw, key, fallback) {
+function readNumber(raw, key, fallback) {
 	const v = raw[key];
 	return typeof v === "number" && Number.isFinite(v) ? v : fallback;
 }
-function readBoolean$1(raw, key, fallback) {
+function readBoolean(raw, key, fallback) {
 	const v = raw[key];
 	return typeof v === "boolean" ? v : fallback;
 }
@@ -218722,9 +218921,9 @@ var ReolinkBaichuanWebhookServer = class {
 		if (this.settings) return this.settings;
 		const raw = await this.deps.readStore();
 		this.settings = {
-			enabled: readBoolean$1(raw, "baichuanWebhookEnabled", true),
-			port: readNumber$1(raw, "baichuanWebhookPort", DEFAULT_BAICHUAN_WEBHOOK_PORT),
-			bindHost: readString$1(raw, "baichuanWebhookBindHost", "0.0.0.0")
+			enabled: readBoolean(raw, "baichuanWebhookEnabled", true),
+			port: readNumber(raw, "baichuanWebhookPort", DEFAULT_BAICHUAN_WEBHOOK_PORT),
+			bindHost: readString(raw, "baichuanWebhookBindHost", "0.0.0.0")
 		};
 		return this.settings;
 	}
@@ -219031,338 +219230,420 @@ function buildCreationFormSchema() {
 	] };
 }
 //#endregion
-//#region src/email-push-schema.ts
-/**
-* The ids of the sections above, in render order — the value the addon hands
-* to `BaseAddon.integrationSettingSections()`. Exported so the declaration and
-* the schema cannot drift: core throws if an id here names no section.
-*/
-var EMAIL_PUSH_SECTION_IDS = ["email-push", "email-push-auth"];
-/**
-* Addon-level settings UI for the Reolink email/SMTP push intake.
-*
-* Rendered under the provider's addon settings (Cluster → addon config).
-* Edits land in the addon store via `updateGlobalSettings`; the provider
-* restarts the SMTP server on change. The recommended camera-facing host
-* is rendered read-only so the operator knows what to point cameras at if
-* they configure email manually instead of using Auto-configure.
-*
-* `requiresRestart` is intentionally NOT set — the provider handles the
-* restart itself in `onConfigChanged` (a targeted SMTP rebind, not a full
-* addon teardown).
-*
-* ── These sections ARE the Reolink integration's configuration ──────────
-*
-* Both are declared in `ReolinkAddon.integrationSettingSections()`, so core
-* serves them on System → Integrations → Reolink. The operator looks for "the
-* Reolink SMTP port" under Reolink; this puts it there.
-*
-* They EARN that placement, and the reason is the test any future declaration
-* must pass: they configure ONE SMTP server in ONE provider process, serving
-* every Reolink camera at once. There is no per-camera copy to confuse them
-* with, which is exactly why a per-camera home would be nonsense and a
-* per-integration home is correct. A setting that differs per camera belongs
-* in `deviceSettingsSchema`, never here.
-*
-* The declaration does not move the values: they remain the same bare keys in
-* the same addon store, still reachable from System → Settings, still written
-* by `updateGlobalSettings` — there is no integration-specific writer at all.
-* See ADR-0269.
-*
-* `tab` is deliberately NOT used to express this. It means "how to group this
-* visually", and an earlier design that overloaded it put the literal word
-* "integration" into an operator-facing tab bar (D268 → D269).
-*/
-function buildEmailPushSettingsSchema(recommendedHost) {
-	return { sections: [{
-		id: "email-push",
-		title: "Battery-cam Motion (Email/SMTP Push)",
-		titleKey: "provider-reolink:emailPushSettings.s_email-push.title",
-		description: "Lets battery cameras report motion by email without being woken.",
-		descriptionKey: "provider-reolink:emailPushSettings.s_email-push.description",
-		columns: 2,
-		fields: [
-			{
-				type: "boolean",
-				key: "emailPushEnabled",
-				label: "Enable Email Push Server",
-				labelKey: "provider-reolink:emailPushSettings.s_email-push.emailPushEnabled.label",
-				default: true
-			},
-			{
-				type: "info",
-				key: "emailPushRecommendedHost",
-				label: "Camera-facing host",
-				labelKey: "provider-reolink:emailPushSettings.s_email-push.emailPushRecommendedHost.label",
-				content: `Point cameras at this host: ${recommendedHost}`
-			},
-			{
-				type: "number",
-				key: "emailPushPort",
-				label: "SMTP Port",
-				labelKey: "provider-reolink:emailPushSettings.s_email-push.emailPushPort.label",
-				default: DEFAULT_EMAIL_PUSH_PORT,
-				min: 1,
-				max: 65535
-			},
-			{
-				type: "text",
-				key: "emailPushDomain",
-				label: "Virtual Domain",
-				labelKey: "provider-reolink:emailPushSettings.s_email-push.emailPushDomain.label",
-				default: DEFAULT_EMAIL_PUSH_DOMAIN,
-				placeholder: DEFAULT_EMAIL_PUSH_DOMAIN
-			}
-		]
-	}, {
-		id: "email-push-auth",
-		title: "Email Push Authentication",
-		titleKey: "provider-reolink:emailPushSettings.s_email-push-auth.title",
-		description: "Random values are generated on first boot; re-run Auto-configure on cameras after changing them.",
-		descriptionKey: "provider-reolink:emailPushSettings.s_email-push-auth.description",
-		columns: 2,
-		fields: [
-			{
-				type: "boolean",
-				key: "emailPushRequireAuth",
-				label: "Require AUTH",
-				labelKey: "provider-reolink:emailPushSettings.s_email-push-auth.emailPushRequireAuth.label",
-				default: true
-			},
-			{
-				type: "text",
-				key: "emailPushAuthUsername",
-				label: "Auth Username",
-				labelKey: "provider-reolink:emailPushSettings.s_email-push-auth.emailPushAuthUsername.label"
+//#region src/email-push-bridge.ts
+/**
+* The Reolink side of the `smtp-inbound` broker kind (D999).
+*
+* Battery cameras report motion by mail. The mailbox they mail is a `broker` of kind
+* `smtp-inbound` owned by `smtp-nodemailer`; this bridge
+*   - creates it on first need (`ensureMailbox`: one in-process promise, adopt-id, never at a bare boot),
+*   - declares the `cam-<stableId>` recipients of the standalone cameras (`sync`),
+*   - turns each `broker.message` into the camera's `handleSimpleEvent({ source: 'email' })`,
+*   - replays what the bus lost from the broker's ring (seq gap, a broker that came back, subscribe).
+* It never deletes the mailbox: the operator owns it, and the bridge recreates it at the next need.
+* Events are telemetry (D8); the ring is the RPC reconcile.
+*/
+/** The addon that owns `smtp-inbound` mailboxes: routes the id-less calls (`add`). */
+var SMTP_BROKER_ADDON_ID = "smtp-nodemailer";
+/** Who this addon is, among the subscribers of a mailbox. */
+var REOLINK_SUBSCRIBER_ID = "provider-reolink";
+var MAILBOX_NAME = "Camera mailbox";
+var RECIPIENT_PREFIX = "cam-";
+/** The real port: `ctx.api.broker`, every call routed to the addon that owns the kind. */
+function createBrokerPort(api) {
+	const route = { addonId: SMTP_BROKER_ADDON_ID };
+	return {
+		list: async () => api.broker.list.query({ kind: SMTP_INBOUND_KIND }),
+		add: async ({ id, name, settings }) => api.broker.add.mutate({
+			kind: SMTP_INBOUND_KIND,
+			name,
+			id,
+			settings: { ...settings },
+			...route
+		}),
+		getBrokerConfig: async (id) => api.broker.getBrokerConfig.query({
+			id,
+			...route
+		}),
+		subscribe: async (brokerId, recipients) => api.broker.subscribe.mutate({
+			brokerId,
+			filter: {
+				recipients: [...recipients],
+				subscriberId: REOLINK_SUBSCRIBER_ID
 			},
-			{
-				type: "password",
-				key: "emailPushAuthPassword",
-				label: "Auth Password",
-				labelKey: "provider-reolink:emailPushSettings.s_email-push-auth.emailPushAuthPassword.label",
-				showToggle: true
-			}
-		]
-	}] };
-}
-//#endregion
-//#region src/email-push-server.ts
-/** Reads a typed value from the raw addon store with a fallback. */
-function readString(raw, key, fallback) {
-	const v = raw[key];
-	return typeof v === "string" && v.length > 0 ? v : fallback;
+			...route
+		}),
+		unsubscribe: async (brokerId, subscriptionId) => api.broker.unsubscribe.mutate({
+			brokerId,
+			subscriptionId,
+			...route
+		}),
+		getState: async (brokerId, key) => api.broker.getState.query({
+			brokerId,
+			key,
+			...route
+		})
+	};
 }
-function readNumber(raw, key, fallback) {
-	const v = raw[key];
-	return typeof v === "number" && Number.isFinite(v) ? v : fallback;
+var BrokerMessageEventSchema = object({
+	brokerId: string(),
+	subscriptionId: string(),
+	key: string(),
+	payload: unknown()
+});
+var ReadyStateEventSchema = object({
+	capName: string(),
+	state: string()
+});
+var BrokerStatusEventSchema = object({
+	brokerId: string(),
+	status: string(),
+	error: string().optional()
+});
+function errMsg(err) {
+	return err instanceof Error ? err.message : String(err);
 }
-function readBoolean(raw, key, fallback) {
-	const v = raw[key];
-	return typeof v === "boolean" ? v : fallback;
+function isInUse(err) {
+	return /already in use/i.test(errMsg(err));
 }
-/**
-* Owns the lib's SMTP intake for the Reolink addon. Lifecycle:
-*   - `start()` from the provider's `onInitialize` (no-op when disabled).
-*   - `restart()` from `onConfigChanged` so port/domain/auth edits apply.
-*   - `stop()` from the provider's `onShutdown`.
-*/
-var ReolinkEmailPushServer = class {
+var EmailPushBridge = class {
 	deps;
-	instance;
-	busOff;
-	settings;
+	mailbox = null;
+	brokerId = null;
+	subscriptionId = null;
+	/** The recipient set the broker holds for this addon, as a key. */
+	declared = null;
+	lastSeq = 0;
+	/** The seq baseline of the current mailbox was taken (before the first subscribe). */
+	seeded = false;
+	/** The last failure that was reported, so a mailbox provider that stays away is said once. */
+	lastFailure = null;
+	chain = Promise.resolve();
 	constructor(deps) {
 		this.deps = deps;
 	}
-	/**
-	* Hydrate the persisted settings, bootstrapping random AUTH
-	* credentials on first use so the server is never an open relay.
-	* Cached after the first resolution; `reloadSettings` forces a re-read.
-	*/
-	async resolveSettings() {
-		if (this.settings) return this.settings;
-		const raw = await this.deps.readStore();
-		let authUsername = readString(raw, "emailPushAuthUsername", "");
-		let authPassword = readString(raw, "emailPushAuthPassword", "");
-		const passwordUnresolved = isSecretMarkerLike(raw["emailPushAuthPassword"]);
-		const bootstrapped = {};
-		if (!authUsername) {
-			authUsername = `camstack-${(0, node_crypto.randomBytes)(4).toString("hex")}`;
-			bootstrapped.emailPushAuthUsername = authUsername;
-		}
-		if (!authPassword) {
-			authPassword = (0, node_crypto.randomBytes)(18).toString("base64url");
-			if (passwordUnresolved) this.deps.logger.error("email-push: the SMTP password is in the keychain but could not be read — running on a temporary password that is NOT saved; camera mail will fail AUTH until it resolves");
-			else bootstrapped.emailPushAuthPassword = authPassword;
-		}
-		if (Object.keys(bootstrapped).length > 0) try {
-			await this.deps.writeStore(bootstrapped);
+	/** The id of the mailbox, creating it when none exists. One in-flight promise. */
+	ensureMailbox() {
+		this.mailbox ??= this.findOrCreate().catch((err) => {
+			this.mailbox = null;
+			throw err;
+		});
+		return this.mailbox;
+	}
+	async findOrCreate() {
+		const found = pickMailbox(await this.deps.port.list());
+		if (found !== null) {
+			await this.deps.pending?.clear();
+			return found;
+		}
+		const pending = await this.deps.pending?.read() ?? null;
+		try {
+			const created = await this.deps.port.add({
+				id: SMTP_INBOUND_DEFAULT_ID,
+				name: MAILBOX_NAME,
+				...pending === null ? {} : { settings: pending }
+			});
+			await this.deps.pending?.clear();
+			this.deps.logger.info("email-push: created the camera mailbox", { meta: {
+				brokerId: created.id,
+				carriedLegacySettings: pending !== null
+			} });
+			return created.id;
 		} catch (err) {
-			this.deps.logger.warn("email-push: failed to persist bootstrapped credentials", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			if (!isInUse(err)) throw err;
+			const again = pickMailbox(await this.deps.port.list());
+			if (again === null) throw err;
+			await this.deps.pending?.clear();
+			return again;
 		}
-		this.settings = {
-			enabled: readBoolean(raw, "emailPushEnabled", true),
-			port: readNumber(raw, "emailPushPort", DEFAULT_EMAIL_PUSH_PORT),
-			bindHost: readString(raw, "emailPushBindHost", "0.0.0.0"),
-			domain: readString(raw, "emailPushDomain", DEFAULT_EMAIL_PUSH_DOMAIN),
-			requireAuth: readBoolean(raw, "emailPushRequireAuth", true),
-			authUsername,
-			authPassword,
-			maxMessageBytes: readNumber(raw, "emailPushMaxMessageBytes", DEFAULT_EMAIL_PUSH_MAX_MESSAGE_BYTES)
-		};
-		return this.settings;
 	}
-	/** Drop the cached settings so the next start/restart re-reads the
-	*  store (used by `restart`). */
-	reloadSettings() {
-		this.settings = void 0;
-	}
-	buildConfig(settings) {
-		return {
-			port: settings.port,
-			bindHost: settings.bindHost,
-			domain: settings.domain,
-			requireAuth: settings.requireAuth,
-			authUsername: settings.authUsername,
-			authPassword: settings.authPassword,
-			tls: false,
-			maxMessageBytes: settings.maxMessageBytes
-		};
-	}
-	/**
-	* Resolve a recipient local-part (`<id>`, already stripped of the
-	* `cam-` prefix by the lib) to a camera id. Returns the matching
-	* camera's `stableId` (which the lib echoes back as `event.cameraId`)
-	* or `undefined` to reject the recipient at RCPT TO.
-	*
-	* Hub-attached children are skipped: they share the parent's TCP
-	* socket and have no independent email path, so accepting one would
-	* silently mis-route. Match is on `stableId` (durable across
-	* re-adoption) — the same value `buildCameraSetupParams` writes into
-	* the camera's email config.
-	*/
-	resolveCameraId(localPart) {
-		const cam = this.findCameraByStableId(localPart);
-		if (!cam || !cam.isEmailPushEligible) return void 0;
-		return localPart;
+	recipients() {
+		return this.deps.listCameras().filter((cam) => cam.isEmailPushEligible).map((cam) => `${RECIPIENT_PREFIX}${cam.stableId}`).sort();
 	}
-	findCameraByStableId(stableId) {
-		return this.deps.listCameras().find((c) => c.stableId === stableId);
+	enqueue(job) {
+		const run = this.chain.then(job);
+		this.chain = run.then(() => void 0, () => void 0);
+		return run;
 	}
-	/** Route an accepted email-push event into the matched camera's unified
-	*  simple-event handler. */
-	dispatchEvent(event) {
-		const cam = this.findCameraByStableId(event.cameraId);
-		if (!cam) {
-			this.deps.logger.warn("email-push: event for unknown camera id — dropping", { meta: {
-				cameraId: event.cameraId,
-				inferredType: event.inferredType
-			} });
-			return;
-		}
-		this.deps.logger.info("email-push: motion received from battery camera", {
-			tags: { deviceId: cam.id },
-			meta: {
-				inferredType: event.inferredType,
-				subject: event.subject.slice(0, 80)
+	/**
+	* Declare the recipients of the eligible cameras (again). Cheap when nothing changed.
+	* A failure is logged, never thrown: a camera that cannot be declared does not stop the addon.
+	*/
+	sync(options = {}) {
+		return this.enqueue(async () => {
+			try {
+				await this.doSync(options.force === true);
+				this.lastFailure = null;
+			} catch (err) {
+				this.declared = null;
+				this.subscriptionId = null;
+				const message = errMsg(err);
+				if (message !== this.lastFailure) {
+					this.lastFailure = message;
+					this.deps.logger.warn("email-push: the camera mailbox is not available; battery cameras cannot mail motion until it is", { meta: { error: message } });
+				}
 			}
 		});
-		for (const type of mapInferredTypeToSimpleEvents(event.inferredType)) cam.handleSimpleEvent({
-			type,
-			channel: cam.emailPushChannel,
-			timestamp: event.receivedAtMs,
-			source: "email"
-		});
 	}
-	/** Start the SMTP intake when enabled. Idempotent: a second call while
-	*  running re-applies config without rebinding. */
-	async start() {
-		const settings = await this.resolveSettings();
-		if (!settings.enabled) {
-			this.deps.logger.debug("email-push: disabled — SMTP intake not started");
+	async doSync(force) {
+		const recipients = this.recipients();
+		if (recipients.length === 0) {
+			if (this.brokerId !== null && this.subscriptionId !== null) await this.deps.port.unsubscribe(this.brokerId, this.subscriptionId);
+			this.subscriptionId = null;
+			this.declared = null;
 			return;
 		}
-		if (this.instance) {
-			this.instance.updateConfig(this.buildConfig(settings));
+		const key = recipients.join(",");
+		if (!force && this.declared === key && this.subscriptionId !== null) return;
+		const brokerId = await this.ensureMailbox();
+		await this.seedBaseline(brokerId);
+		const { subscriptionId } = await this.deps.port.subscribe(brokerId, recipients);
+		this.brokerId = brokerId;
+		this.subscriptionId = subscriptionId;
+		this.declared = key;
+		await this.reconcile();
+	}
+	/**
+	* What the mailbox retains from BEFORE this subscription is old news (a restart of this addon
+	* must not re-fire a quarter hour of alarms). Nothing for our recipients is accepted before the
+	* subscribe, so the mailbox's seq read now is an exact baseline: only what arrives after it is
+	* processed, and a seq that went back means the mailbox restarted.
+	*/
+	async seedBaseline(brokerId) {
+		const since = await this.readSince(brokerId, 0);
+		if (since === null) {
+			if (!this.seeded || this.brokerId !== brokerId) throw new Error("the camera mailbox state could not be read");
 			return;
 		}
-		this.instance = createEmailPushServer({
-			config: this.buildConfig(settings),
-			cameraResolver: (local) => this.resolveCameraId(local),
-			logger: {
-				debug: (m) => this.deps.logger.debug(`[smtp] ${m}`),
-				info: (m) => this.deps.logger.info(`[smtp] ${m}`),
-				warn: (m) => this.deps.logger.warn(`[smtp] ${m}`),
-				error: (m) => this.deps.logger.error(`[smtp] ${m}`)
+		if (!this.seeded || this.brokerId !== brokerId || since.lastSeq < this.lastSeq) {
+			this.lastSeq = since.lastSeq;
+			this.seeded = true;
+		}
+	}
+	/** A `broker.message` event off the bus. */
+	onMessage(raw) {
+		return this.enqueue(async () => {
+			const event = BrokerMessageEventSchema.safeParse(raw);
+			if (!event.success) return;
+			if (this.brokerId === null) {
+				this.deps.logger.warn("email-push: a mailbox message arrived before the mailbox was known — dropped", { meta: {
+					brokerId: event.data.brokerId,
+					key: event.data.key
+				} });
+				return;
+			}
+			if (event.data.brokerId !== this.brokerId) return;
+			const message = SmtpInboundMessageSchema.safeParse(event.data.payload);
+			if (!message.success) {
+				this.deps.logger.warn("email-push: a mailbox message did not parse — dropped", { meta: { key: event.data.key } });
+				return;
+			}
+			if (message.data.seq <= this.lastSeq) return;
+			if (message.data.seq > this.lastSeq + 1) {
+				await this.reconcile();
+				return;
 			}
+			this.process(event.data.key, message.data);
 		});
-		this.busOff = onEmailPushEvent((event) => this.dispatchEvent(event));
-		try {
-			await this.instance.start();
-			this.deps.logger.info("email-push: SMTP intake listening", { meta: {
-				host: settings.bindHost,
-				port: settings.port,
-				domain: settings.domain,
-				requireAuth: settings.requireAuth
+	}
+	/** A `broker.status-changed` event: a mailbox that came back has forgotten its subscriptions. */
+	onStatusChanged(raw) {
+		const event = BrokerStatusEventSchema.safeParse(raw);
+		if (!event.success || event.data.brokerId !== this.brokerId) return Promise.resolve();
+		if (event.data.status !== "connected") {
+			this.deps.logger.warn("email-push: the camera mailbox is not connected", { meta: {
+				status: event.data.status,
+				error: event.data.error
 			} });
-		} catch (err) {
-			this.deps.logger.error("email-push: SMTP intake failed to start", { meta: { error: err instanceof Error ? err.message : String(err) } });
-			this.busOff?.();
-			this.busOff = void 0;
-			this.instance = void 0;
+			return Promise.resolve();
 		}
+		return this.sync({ force: true });
 	}
-	/** Re-read settings and rebind. Used after a settings edit. */
-	async restart() {
-		await this.stop();
-		this.reloadSettings();
-		await this.start();
+	/**
+	* The mailbox provider (any `broker` provider) became ready: the subscription it may have lost
+	* is declared again, and a mailbox that never existed is created if a camera needs one.
+	*/
+	onProviderReady(raw) {
+		const event = ReadyStateEventSchema.safeParse(raw);
+		if (!event.success || event.data.capName !== "broker" || event.data.state !== "ready") return Promise.resolve();
+		return this.sync({ force: true });
 	}
-	/** Stop the SMTP intake + detach the bus subscription. Safe to call
-	*  when never started. */
-	async stop() {
-		this.busOff?.();
-		this.busOff = void 0;
-		if (this.instance) {
-			await this.instance.stop().catch(() => {});
-			this.instance = void 0;
+	/** Replay what the ring holds after the last seq we processed. */
+	async reconcile() {
+		const id = this.brokerId;
+		if (id === null) return;
+		let since = await this.readSince(id, this.lastSeq);
+		if (since !== null && since.lastSeq < this.lastSeq) {
+			this.lastSeq = 0;
+			since = await this.readSince(id, 0);
+		}
+		if (since === null) return;
+		for (const entry of since.messages) this.process(entry.key, entry.message);
+	}
+	async readSince(id, seq) {
+		try {
+			const raw = await this.deps.port.getState(id, smtpSinceKey(seq));
+			const parsed = SmtpInboundSinceSchema.safeParse(raw);
+			if (parsed.success) return parsed.data;
+			this.deps.logger.warn("email-push: the mailbox replay did not parse", { meta: { brokerId: id } });
+		} catch (err) {
+			this.deps.logger.warn("email-push: the mailbox replay could not be read", { meta: {
+				brokerId: id,
+				error: errMsg(err)
+			} });
 		}
+		return null;
+	}
+	process(key, message) {
+		if (message.seq <= this.lastSeq) return;
+		this.lastSeq = message.seq;
+		const cam = this.deps.listCameras().find((c) => `${RECIPIENT_PREFIX}${c.stableId}` === key);
+		if (cam === void 0) {
+			this.deps.logger.warn("email-push: mail for an unknown camera — dropping", { meta: {
+				key,
+				seq: message.seq
+			} });
+			return;
+		}
+		const inferred = classifyEmailPushMessage({
+			subject: message.subject,
+			text: message.text
+		});
+		this.deps.logger.info("email-push: motion received from battery camera", {
+			tags: { deviceId: cam.id },
+			meta: {
+				inferredType: inferred,
+				subject: message.subject.slice(0, 80),
+				seq: message.seq
+			}
+		});
+		for (const type of mapInferredTypeToSimpleEvents(inferred)) cam.handleSimpleEvent({
+			type,
+			channel: cam.emailPushChannel,
+			timestamp: message.receivedAt,
+			source: "email"
+		});
 	}
 	/**
-	* Compute the manager-side parameters a given camera needs to send
-	* email-push to this server. Returns `null` when the server has no
-	* resolvable LAN address (no camera-reachable host), or the camera is
-	* hub-attached / not eligible. The caller passes these straight into
-	* `api.setupEmailPushToManager`.
+	* What a camera needs to mail the mailbox. `null` for a camera that cannot do email push.
+	* Throws the reason when the hub has no internal address: there is no fallback host.
 	*/
 	async buildCameraSetupParams(cam) {
 		if (!cam.isEmailPushEligible) return null;
-		const settings = await this.resolveSettings();
-		const managerHost = listLanHosts()[0];
-		if (!managerHost) return null;
+		const brokerId = await this.ensureMailbox();
+		const parsed = SmtpInboundConfigSchema.safeParse(await this.deps.port.getBrokerConfig(brokerId));
+		if (!parsed.success) throw new Error("The camera mailbox answered a configuration this build cannot read");
+		const config = parsed.data;
+		if (config.host === null) throw new Error(config.hostReason ?? "The hub has no internal address (System → Network)");
+		await this.sync();
 		return {
-			managerHost,
-			managerPort: settings.port,
-			domain: settings.domain,
-			recipientLocalPart: `cam-${cam.stableId}`,
-			...settings.requireAuth ? {
-				authUsername: settings.authUsername,
-				authPassword: settings.authPassword
+			managerHost: config.host,
+			managerPort: config.port,
+			domain: config.domain,
+			recipientLocalPart: `${RECIPIENT_PREFIX}${cam.stableId}`,
+			...config.requireAuth ? {
+				authUsername: config.username,
+				authPassword: config.password
 			} : {}
 		};
 	}
 };
+function pickMailbox(list) {
+	return list.find((b) => b.id === "smtp-inbound-default")?.id ?? list[0]?.id ?? null;
+}
 //#endregion
-//#region src/email-push-store.ts
-async function readEmailPushStore(deps) {
-	const raw = await deps.readRaw();
-	const password = await deps.readPassword();
-	return password.length > 0 ? {
-		...raw,
-		emailPushAuthPassword: password
-	} : raw;
+//#region src/email-push-removal-hook.ts
+/**
+* A removed camera leaves its `cam-<stableId>` recipient in the mailbox (D865). The addon holds
+* no per-device DATA for the intake (the mailbox is owned by the mail addon), so removal only
+* redeclares the recipient set without the camera. Driven by the tombstone, never by absence.
+*/
+function createEmailPushRemovalHook(deps) {
+	return {
+		onDeviceRemoved: async () => {
+			await deps.resync();
+			return { counts: { "mailbox-recipients": 0 } };
+		},
+		listDeviceData: async () => []
+	};
 }
 //#endregion
+//#region src/migrations/email-push-to-mailbox.ts
+/** The pending mailbox as kept in the addon store: everything but the password (a keychain secret). */
+var PendingMailboxSchema = object({
+	port: number().int(),
+	bindHost: string().optional(),
+	domain: string(),
+	requireAuth: boolean(),
+	username: string()
+});
+/** The keys an install that ever used the intake has; any one of them means "carry it over". */
+var LEGACY_KEYS = [
+	"emailPushPort",
+	"emailPushDomain",
+	"emailPushRequireAuth",
+	"emailPushAuthUsername",
+	"emailPushAuthPassword",
+	"emailPushBindHost"
+];
+var DEFAULT_PORT = 2525;
+var DEFAULT_DOMAIN = "camstack.local";
+function text(stored, key) {
+	const value = stored[key];
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
+function portOf(stored, ports) {
+	const value = stored["emailPushPort"];
+	const numeric = typeof value === "number" ? value : typeof value === "string" ? Number(value) : NaN;
+	if (Number.isInteger(numeric) && numeric >= 1 && numeric <= 65535) return numeric;
+	if (value !== void 0) ports.warn(`email-push migration: the legacy port is not usable; using ${DEFAULT_PORT}`);
+	return DEFAULT_PORT;
+}
+async function moveEmailPushToMailbox(ports) {
+	const stored = await ports.readStored();
+	if (!LEGACY_KEYS.some((key) => stored[key] !== void 0)) return {
+		outcome: "already-done",
+		summary: { moved: false }
+	};
+	if (stored["emailPushEnabled"] === false) return {
+		outcome: "already-done",
+		summary: {
+			moved: false,
+			disabled: true
+		}
+	};
+	const bindHost = text(stored, "emailPushBindHost");
+	await ports.stashPending({
+		port: portOf(stored, ports),
+		...bindHost === null ? {} : { bindHost },
+		domain: text(stored, "emailPushDomain") ?? DEFAULT_DOMAIN,
+		requireAuth: stored["emailPushRequireAuth"] !== false,
+		username: text(stored, "emailPushAuthUsername") ?? "",
+		password: text(stored, "emailPushAuthPassword") ?? ""
+	});
+	return {
+		outcome: "done",
+		summary: { moved: true }
+	};
+}
+/** The `provider-reolink` catalogue (D987): offered to the engine when the addon initialises. */
+var REOLINK_MIGRATIONS = [{
+	meta: {
+		id: "provider-reolink/2026-11-02-email-push-to-mailbox",
+		owner: "provider-reolink",
+		level: "addon-state",
+		seq: 1,
+		dependsOn: [],
+		store: "settings",
+		scope: "cluster",
+		onFailure: "tolerate",
+		bodyKind: "procedure",
+		description: "Keep the SMTP intake settings (port, domain, credentials) as the pending camera mailbox, created by the bridge when the smtp-inbound broker is reachable, so no camera is reconfigured",
+		fixtureMark: "a setting key the migration does not know"
+	},
+	procedure: moveEmailPushToMailbox
+}];
+//#endregion
 //#region src/reolink-discovery-map.ts
 /**
 * Flatten a host (IP / hostname) into a flat row-key slug — shared by `generateStableId` and the
@@ -219582,7 +219863,7 @@ function buildReolinkAdoptionProvider(deps) {
 					lastDiscoveryAt: null,
 					candidateCount: 0,
 					adoptedCount: 0,
-					lastError: errMsg$2(err)
+					lastError: errMsg$3(err)
 				};
 			}
 		},
@@ -219643,7 +219924,7 @@ function buildReolinkAdoptionProvider(deps) {
 				logger.warn("reolink adopt: failed to adopt channel", { meta: {
 					childNativeId,
 					integrationId,
-					error: errMsg$2(err)
+					error: errMsg$3(err)
 				} });
 				failures++;
 			}
@@ -219823,7 +220104,7 @@ async function planHubMigration(saved, ports) {
 	try {
 		integrations = await ports.listIntegrations();
 	} catch (err) {
-		ports.logger.warn("Reolink hub migration: integrations unreadable — hubs left in place", { meta: { error: errMsg$2(err) } });
+		ports.logger.warn("Reolink hub migration: integrations unreadable — hubs left in place", { meta: { error: errMsg$3(err) } });
 		return {
 			rows: saved.filter((row) => row.type !== DeviceType.Hub),
 			retirements: []
@@ -219850,7 +220131,7 @@ async function planHubMigration(saved, ports) {
 			ports.logger.warn("Reolink hub migration failed — the hub device is left in place", {
 				tags: { deviceId: hub.id },
 				meta: {
-					error: errMsg$2(err),
+					error: errMsg$3(err),
 					name: hub.name
 				}
 			});
@@ -219888,7 +220169,7 @@ async function retireMigratedHubs(retirements, ports) {
 	} catch (err) {
 		ports.logger.warn("Reolink hub retirement failed — retried next boot", {
 			tags: { deviceId: r.hubDeviceId },
-			meta: { error: errMsg$2(err) }
+			meta: { error: errMsg$3(err) }
 		});
 	}
 	return retired;
@@ -220134,7 +220415,7 @@ async function enrichHostIdentifiersFromLiveApi(detection, logger) {
 }
 var ReolinkProviderAddon = class extends BaseDeviceProvider {
 	/** The email-push SMTP password is hidden state — kept in the keychain (D787). */
-	secretStatePaths = ["emailPushAuthPassword"];
+	secretStatePaths = ["emailPushAuthPassword", "mailboxPendingPassword"];
 	addonId = REOLINK_ADDON_ID;
 	providerName = "Reolink";
 	deviceClasses = {
@@ -220148,14 +220429,13 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 	* so a Test click and the subsequent Save share one Baichuan login.
 	*/
 	autodetectCache = new AutodetectCache();
+	hubManager = null;
 	/**
-	* Provider-level singleton SMTP intake for battery-cam motion push
-	* (`email-push-server.ts`). Lazily constructed in `onInitialize` once
-	* the addon context is available; started/stopped with the provider
-	* lifecycle and restarted on settings change.
+	* The camera mailbox bridge (`email-push-bridge.ts`, D999): battery cameras mail motion to a
+	* mailbox of the `smtp-inbound` broker, the bridge turns each message into the camera's
+	* simple event. Built in `onInitialize`, once the addon context exists.
 	*/
-	hubManager = null;
-	emailPushServer;
+	emailBridge;
 	baichuanWebhookServer;
 	/** The `log-channels` provider for this process. Stopped on shutdown so a
 	*  diagnostic timer is never the reason a runner refuses to exit. */
@@ -220187,54 +220467,94 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 	}
 	/**
 	* Enumerate this addon's live `ReolinkCamera` instances from the
-	* global device registry. Used by the email-push server to resolve
+	* global device registry. Used by the camera mailbox bridge to resolve
 	* recipients + route inbound motion. Returns `[]` when the registry
 	* isn't available (worker context — providers are hub-only here).
 	*/
 	listReolinkCameras() {
 		const all = this.ctx.kernel.deviceRegistry?.getAll() ?? [];
-		const emailServer = this.emailPushServer;
+		const emailBridge = this.emailBridge;
 		const webhookServer = this.baichuanWebhookServer;
 		const cameras = [];
 		for (const d of all) if (d instanceof ReolinkCamera) {
-			if (emailServer) d.setEmailPushParamsResolver(() => emailServer.buildCameraSetupParams(d));
+			if (emailBridge) d.setEmailPushParamsResolver(() => emailBridge.buildCameraSetupParams(d));
 			if (webhookServer) d.setBaichuanWebhookParamsResolver(() => webhookServer.buildCameraSetupParams(d));
 			cameras.push(d);
 		}
 		return cameras;
 	}
 	/**
-	* Bootstrapped SMTP AUTH credentials — Zod-validated durable handles
-	* over the SAME two store keys the raw writer used. Built lazily
-	* (needs `this.ctx`) and memoised.
+	* The legacy SMTP AUTH password: hidden state, kept in the keychain (D787). Only the
+	* `email-push-to-mailbox` migration reads it, to carry it into the mailbox.
 	*/
-	_emailPushAuthUsernameState = null;
 	_emailPushAuthPasswordState = null;
-	get emailPushAuthUsernameState() {
-		if (!this._emailPushAuthUsernameState) this._emailPushAuthUsernameState = this.state("emailPushAuthUsername", string(), "");
-		return this._emailPushAuthUsernameState;
-	}
 	get emailPushAuthPasswordState() {
 		if (!this._emailPushAuthPasswordState) this._emailPushAuthPasswordState = this.state("emailPushAuthPassword", string(), "");
 		return this._emailPushAuthPasswordState;
 	}
-	/** Lazily build the email-push server, wiring its provider deps. */
-	ensureEmailPushServer() {
-		if (!this.emailPushServer) this.emailPushServer = new ReolinkEmailPushServer({
-			logger: this.ctx.logger.child("email-push"),
+	/**
+	* The mailbox the old intake described, waiting for a provider to create it: the migration
+	* writes it (no network), the bridge reads it when it creates the mailbox and clears it after.
+	* The password is a keychain secret of its own (`mailboxPendingPassword`).
+	*/
+	_mailboxPendingState = null;
+	_mailboxPendingPasswordState = null;
+	get mailboxPendingState() {
+		this._mailboxPendingState ??= this.state("mailboxPending", PendingMailboxSchema.nullable(), null);
+		return this._mailboxPendingState;
+	}
+	get mailboxPendingPasswordState() {
+		this._mailboxPendingPasswordState ??= this.state("mailboxPendingPassword", string(), "");
+		return this._mailboxPendingPasswordState;
+	}
+	async stashPendingMailbox(settings) {
+		const { password, ...rest } = settings;
+		await this.mailboxPendingPasswordState.set(password);
+		await this.mailboxPendingState.set(rest);
+	}
+	/** The pending settings, or null; throws when the stored password cannot be resolved. */
+	async readPendingMailbox() {
+		const pending = await this.mailboxPendingState.get();
+		if (pending === null) return null;
+		const password = await this.mailboxPendingPasswordState.get();
+		const raw = (await this.resolveGlobalStore())["mailboxPendingPassword"];
+		if (password.length === 0 && raw !== void 0 && raw !== "" && isSecretMarker(raw)) throw new Error("the pending camera mailbox password could not be resolved");
+		return {
+			...pending,
+			password
+		};
+	}
+	async clearPendingMailbox() {
+		if (await this.mailboxPendingState.get() === null) return;
+		await this.mailboxPendingState.set(null);
+		await this.mailboxPendingPasswordState.set("");
+	}
+	/** The camera mailbox bridge, built once. */
+	ensureEmailBridge() {
+		this.emailBridge ??= new EmailPushBridge({
+			port: createBrokerPort(this.ctx.api),
 			listCameras: () => this.listReolinkCameras(),
-			readStore: () => readEmailPushStore({
-				readRaw: () => this.resolveGlobalStore(),
-				readPassword: () => this.emailPushAuthPasswordState.get()
-			}),
-			writeStore: async (patch) => {
-				const username = patch["emailPushAuthUsername"];
-				if (typeof username === "string") await this.emailPushAuthUsernameState.set(username);
-				const password = patch["emailPushAuthPassword"];
-				if (typeof password === "string") await this.emailPushAuthPasswordState.set(password);
+			logger: this.ctx.logger.child("email-push"),
+			pending: {
+				read: () => this.readPendingMailbox(),
+				clear: () => this.clearPendingMailbox()
 			}
 		});
-		return this.emailPushServer;
+		return this.emailBridge;
+	}
+	/**
+	* The stored intake settings the migration carries into the mailbox. A password that is
+	* stored but cannot be resolved (a locked keychain) aborts: it is never read as empty.
+	*/
+	async readLegacyEmailPush() {
+		const raw = await this.resolveGlobalStore();
+		const password = await this.emailPushAuthPasswordState.get();
+		const stored = raw["emailPushAuthPassword"];
+		if (password.length === 0 && stored !== void 0 && stored !== "" && isSecretMarker(stored)) throw new Error("the legacy email-push password could not be resolved");
+		return password.length > 0 ? {
+			...raw,
+			emailPushAuthPassword: password
+		} : raw;
 	}
 	/** Lazily build the HaCfg webhook intake, wiring its provider deps. */
 	ensureBaichuanWebhookServer() {
@@ -220311,10 +220631,9 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 		}
 		this.logChannels?.stop();
 		await this.clipService?.disposeClipStreamDial().catch(() => {});
-		await this.emailPushServer?.stop().catch(() => {});
 		await this.baichuanWebhookServer?.stop().catch(() => {});
 		await this.hubManager?.shutdown().catch((err) => {
-			this.ctx.logger.warn("Reolink NVR sessions did not close cleanly", { meta: { error: errMsg$2(err) } });
+			this.ctx.logger.warn("Reolink NVR sessions did not close cleanly", { meta: { error: errMsg$3(err) } });
 		});
 		this.hubManager = null;
 		reolinkHubSessions.clear();
@@ -220342,7 +220661,7 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 			}
 			await manager.reconcile(withSettings);
 		} catch (err) {
-			this.ctx.logger.warn("Reolink integration reconcile failed — sessions left as they were", { meta: { error: errMsg$2(err) } });
+			this.ctx.logger.warn("Reolink integration reconcile failed — sessions left as they were", { meta: { error: errMsg$3(err) } });
 		}
 	}
 	subscribeIntegrationLifecycle() {
@@ -220507,9 +220826,6 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 	*/
 	async onConfigChanged() {
 		await this.refreshClipRefreshGlobalStore();
-		await this.emailPushServer?.restart().catch((err) => {
-			this.ctx.logger.warn("email-push: restart after settings change failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
-		});
 		await this.baichuanWebhookServer?.restart().catch((err) => {
 			this.ctx.logger.warn("baichuan-webhook: restart after settings change failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		});
@@ -220529,12 +220845,7 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 	* for core to select from.
 	*/
 	globalSettingsSchema() {
-		const recommendedHost = listLanHosts()[0] ?? "127.0.0.1";
-		return { sections: [
-			...buildEmailPushSettingsSchema(recommendedHost).sections,
-			...buildBaichuanWebhookSettingsSchema(recommendedHost).sections,
-			...buildClipRefreshSettingsSchema().sections
-		] };
+		return { sections: [...buildBaichuanWebhookSettingsSchema(listLanHosts()[0] ?? "127.0.0.1").sections, ...buildClipRefreshSettingsSchema().sections] };
 	}
 	/**
 	* Per-instance form (D985): an NVR / Home Hub integration shows its connection only; the
@@ -220553,18 +220864,17 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 		} catch (err) {
 			this.ctx.logger.warn("Reolink integration form: instance lookup failed — full schema shown", { meta: {
 				integrationId: instance.integrationId,
-				error: errMsg$2(err)
+				error: errMsg$3(err)
 			} });
 			return null;
 		}
 	}
 	/**
-	* Email-push + HaCfg webhook sections ARE this integration's configuration —
-	* one intake of each kind serving every Reolink camera. See
-	* `email-push-schema.ts` / `baichuan-webhook-schema.ts`.
+	* The HaCfg webhook section IS this integration's configuration — one intake serving
+	* every Reolink camera. See `baichuan-webhook-schema.ts`. (The camera mailbox is a broker.)
 	*/
 	integrationSettingSections() {
-		return [...EMAIL_PUSH_SECTION_IDS, ...BAICHUAN_WEBHOOK_SECTION_IDS];
+		return [...BAICHUAN_WEBHOOK_SECTION_IDS];
 	}
 	async onInitialize() {
 		const regs = this.providerRegistrationsFromSuper(await super.onInitialize());
@@ -220609,9 +220919,8 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 		this.startClipCatalogRefresh(this.clipService);
 		this.wireClipCatalogRefreshers();
 		await this.serveClipPlanes(this.clipService);
-		this.ensureEmailPushServer().start().catch((err) => {
-			this.ctx.logger.warn("email-push: SMTP intake failed to start at init", { meta: { error: err instanceof Error ? err.message : String(err) } });
-		});
+		await this.runMigrations(defineAddonMigrations(REOLINK_MIGRATIONS, this.migrationPorts()));
+		this.wireEmailBridge();
 		this.ensureBaichuanWebhookServer().start().catch((err) => {
 			this.ctx.logger.warn("baichuan-webhook: HTTP intake failed to start at init", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		});
@@ -220621,8 +220930,9 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 			if (typeof data.deviceId !== "number") return;
 			const dev = this.ctx.kernel.deviceRegistry?.getById(data.deviceId);
 			if (dev instanceof ReolinkCamera) {
-				const emailServer = this.ensureEmailPushServer();
-				dev.setEmailPushParamsResolver(() => emailServer.buildCameraSetupParams(dev));
+				const emailBridge = this.ensureEmailBridge();
+				dev.setEmailPushParamsResolver(() => emailBridge.buildCameraSetupParams(dev));
+				emailBridge.sync();
 				const webhookServer = this.ensureBaichuanWebhookServer();
 				dev.setBaichuanWebhookParamsResolver(() => webhookServer.buildCameraSetupParams(dev));
 				this.wireClipCatalogRefreshers();
@@ -220648,8 +220958,36 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 			capability: deviceAdoptionCapability,
 			provider: this.buildAdoptionProvider()
 		});
+		regs.push({
+			capability: deviceRemovalHookCapability,
+			provider: createEmailPushRemovalHook({ resync: () => this.ensureEmailBridge().sync() })
+		});
 		return regs;
 	}
+	/** What the catalogue's migration reads and writes (D987). */
+	migrationPorts() {
+		return {
+			readStored: () => this.readLegacyEmailPush(),
+			stashPending: (settings) => this.stashPendingMailbox(settings),
+			warn: (message) => {
+				this.ctx.logger.warn(message);
+			}
+		};
+	}
+	/** Listen to the mailbox's messages and keep the declared recipients current. */
+	wireEmailBridge() {
+		const bridge = this.ensureEmailBridge();
+		this.subscribe({ category: EventCategory.BrokerMessage }, (e) => {
+			bridge.onMessage(e.data);
+		});
+		this.subscribe({ category: EventCategory.BrokerStatusChanged }, (e) => {
+			bridge.onStatusChanged(e.data);
+		});
+		this.subscribe({ category: EventCategory.SystemReadyState }, (e) => {
+			bridge.onProviderReady(e.data);
+		});
+		bridge.sync();
+	}
 	/** The clip catalog, its thumbnail cache and its two routes (D549). */
 	clipService = null;
 	clipRefreshTimer = null;
@@ -221013,8 +221351,8 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 			onAfterCreate: async (device) => {
 				if (device instanceof ReolinkCamera) {
 					device.adoptApi(detectedApi);
-					const emailServer = this.ensureEmailPushServer();
-					device.setEmailPushParamsResolver(() => emailServer.buildCameraSetupParams(device));
+					const emailBridge = this.ensureEmailBridge();
+					device.setEmailPushParamsResolver(() => emailBridge.buildCameraSetupParams(device));
 					const webhookServer = this.ensureBaichuanWebhookServer();
 					device.setBaichuanWebhookParamsResolver(() => webhookServer.buildCameraSetupParams(device));
 				}