@camstack/addon-provider-reolink 1.2.222 → 1.2.224

package/dist/addon.mjs

@@ -105246,6 +105246,12 @@ var numberProcessor = (schema, ctx, _json, _params) => {
 var booleanProcessor = (_schema, _ctx, json, _params) => {
 	json.type = "boolean";
 };
+var bigintProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("BigInt cannot be represented in JSON Schema");
+};
+var symbolProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Symbols cannot be represented in JSON Schema");
+};
 var nullProcessor = (_schema, ctx, json, _params) => {
 	if (ctx.target === "openapi-3.0") {
 		json.type = "string";
@@ -105253,12 +105259,17 @@ var nullProcessor = (_schema, ctx, json, _params) => {
 		json.enum = [null];
 	} else json.type = "null";
 };
+var undefinedProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Undefined cannot be represented in JSON Schema");
+};
 var voidProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Void cannot be represented in JSON Schema");
 };
 var neverProcessor = (_schema, _ctx, json, _params) => {
 	json.not = {};
 };
+var anyProcessor = (_schema, _ctx, _json, _params) => {};
+var unknownProcessor = (_schema, _ctx, _json, _params) => {};
 var dateProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Date cannot be represented in JSON Schema");
 };
@@ -105290,12 +105301,53 @@ var literalProcessor = (schema, ctx, json, _params) => {
 		json.enum = vals;
 	}
 };
+var nanProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("NaN cannot be represented in JSON Schema");
+};
+var templateLiteralProcessor = (schema, _ctx, json, _params) => {
+	const _json = json;
+	const pattern = schema._zod.pattern;
+	if (!pattern) throw new Error("Pattern not found in template literal");
+	_json.type = "string";
+	_json.pattern = pattern.source;
+};
+var fileProcessor = (schema, _ctx, json, _params) => {
+	const _json = json;
+	const file = {
+		type: "string",
+		format: "binary",
+		contentEncoding: "binary"
+	};
+	const { minimum, maximum, mime } = schema._zod.bag;
+	if (minimum !== void 0) file.minLength = minimum;
+	if (maximum !== void 0) file.maxLength = maximum;
+	if (mime) if (mime.length === 1) {
+		file.contentMediaType = mime[0];
+		Object.assign(_json, file);
+	} else {
+		Object.assign(_json, file);
+		_json.anyOf = mime.map((m) => ({ contentMediaType: m }));
+	}
+	else Object.assign(_json, file);
+};
+var successProcessor = (_schema, _ctx, json, _params) => {
+	json.type = "boolean";
+};
 var customProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Custom types cannot be represented in JSON Schema");
 };
+var functionProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Function types cannot be represented in JSON Schema");
+};
 var transformProcessor = (_schema, ctx, _json, _params) => {
 	if (ctx.unrepresentable === "throw") throw new Error("Transforms cannot be represented in JSON Schema");
 };
+var mapProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Map cannot be represented in JSON Schema");
+};
+var setProcessor = (_schema, ctx, _json, _params) => {
+	if (ctx.unrepresentable === "throw") throw new Error("Set cannot be represented in JSON Schema");
+};
 var arrayProcessor = (schema, ctx, _json, params) => {
 	const json = _json;
 	const def = schema._zod.def;
@@ -105500,6 +105552,12 @@ var readonlyProcessor = (schema, ctx, json, params) => {
 	seen.ref = def.innerType;
 	json.readOnly = true;
 };
+var promiseProcessor = (schema, ctx, _json, params) => {
+	const def = schema._zod.def;
+	process$1(def.innerType, ctx, params);
+	const seen = ctx.seen.get(schema);
+	seen.ref = def.innerType;
+};
 var optionalProcessor = (schema, ctx, _json, params) => {
 	const def = schema._zod.def;
 	process$1(def.innerType, ctx, params);
@@ -105512,6 +105570,81 @@ var lazyProcessor = (schema, ctx, _json, params) => {
 	const seen = ctx.seen.get(schema);
 	seen.ref = innerType;
 };
+var allProcessors = {
+	string: stringProcessor,
+	number: numberProcessor,
+	boolean: booleanProcessor,
+	bigint: bigintProcessor,
+	symbol: symbolProcessor,
+	null: nullProcessor,
+	undefined: undefinedProcessor,
+	void: voidProcessor,
+	never: neverProcessor,
+	any: anyProcessor,
+	unknown: unknownProcessor,
+	date: dateProcessor,
+	enum: enumProcessor,
+	literal: literalProcessor,
+	nan: nanProcessor,
+	template_literal: templateLiteralProcessor,
+	file: fileProcessor,
+	success: successProcessor,
+	custom: customProcessor,
+	function: functionProcessor,
+	transform: transformProcessor,
+	map: mapProcessor,
+	set: setProcessor,
+	array: arrayProcessor,
+	object: objectProcessor,
+	union: unionProcessor,
+	intersection: intersectionProcessor,
+	tuple: tupleProcessor,
+	record: recordProcessor,
+	nullable: nullableProcessor,
+	nonoptional: nonoptionalProcessor,
+	default: defaultProcessor,
+	prefault: prefaultProcessor,
+	catch: catchProcessor,
+	pipe: pipeProcessor,
+	readonly: readonlyProcessor,
+	promise: promiseProcessor,
+	optional: optionalProcessor,
+	lazy: lazyProcessor
+};
+function toJSONSchema(input, params) {
+	if ("_idmap" in input) {
+		const registry = input;
+		const ctx = initializeContext({
+			...params,
+			processors: allProcessors
+		});
+		const defs = {};
+		for (const entry of registry._idmap.entries()) {
+			const [_, schema] = entry;
+			process$1(schema, ctx);
+		}
+		const schemas = {};
+		ctx.external = {
+			registry,
+			uri: params?.uri,
+			defs
+		};
+		for (const entry of registry._idmap.entries()) {
+			const [key, schema] = entry;
+			extractDefs(ctx, schema);
+			schemas[key] = finalize(ctx, schema);
+		}
+		if (Object.keys(defs).length > 0) schemas.__shared = { [ctx.target === "draft-2020-12" ? "$defs" : "definitions"]: defs };
+		return { schemas };
+	}
+	const ctx = initializeContext({
+		...params,
+		processors: allProcessors
+	});
+	process$1(input, ctx);
+	extractDefs(ctx, input);
+	return finalize(ctx, input);
+}
 //#endregion
 //#region ../../node_modules/zod/v4/classic/iso.js
 var ZodISODateTime = /*@__PURE__*/ $constructor("ZodISODateTime", (inst, def) => {
@@ -106536,7 +106669,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-Cv4Zmie9.mjs
+//#region ../types/dist/sleep-D1jjWAr8.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -106691,6 +106824,9 @@ function isSecretMarkerLike(value) {
 function isSecretClear(value) {
 	return isRecord$7(value) && value["$secretClear"] === true;
 }
+function isSecretFieldView(value) {
+	return isRecord$7(value) && value["set"] === true && isSecretMarkerLike(value);
+}
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
 * plaintext becomes "set (inline)", nothing becomes `null`. A value never
@@ -107342,11 +107478,36 @@ function projectStore(store, perNodeKeys, nodeId) {
 	}
 	return out;
 }
+/**
+* The address of one keychain value: `secret://<owner>/<scope>/<fieldPath>`.
+*
+* A ref is DETERMINISTIC from where the value lives — the owner addon, the
+* scope (global, one node, one device, one integration, one row of a business
+* collection) and the field path inside that scope — so saving the same field
+* twice updates the same ref, and the ref itself says which settings blob
+* points at it. It is also the AAD of the value's ciphertext: a ciphertext
+* copied onto another ref does not decrypt.
+*
+* Array items are addressed by ITEM ID, never by index
+* (`providers[authentik].clientSecret`), so reordering a list keeps every ref.
+*
+* Pure and browser-safe: no node builtins, no I/O.
+*/
+/** The URI scheme of every keychain ref. */
+var SECRET_REF_SCHEME = "secret://";
 var GLOBAL_SCOPE = { kind: "global" };
 /** The scope every addon-wide (not per-node, not per-device) setting lives in. */
 function globalSecretScope() {
 	return GLOBAL_SCOPE;
 }
+/**
+* An addon id as a ref owner. A hub in-process builtin's context id is
+* `addon:<id>`; the owner of its secrets is `<id>`, exactly as for the same
+* addon running forked.
+*/
+function normalizeSecretOwner(addonId) {
+	return addonId.startsWith("addon:") ? addonId.slice(6) : addonId;
+}
 function encodeSegment(value) {
 	return encodeURIComponent(value);
 }
@@ -107357,6 +107518,16 @@ function decodeSegment(value) {
 		return null;
 	}
 }
+/** The scope as it appears inside a ref (`global`, `node/<id>`, …). */
+function formatSecretScope(scope) {
+	switch (scope.kind) {
+		case "global": return "global";
+		case "node": return `node/${encodeSegment(scope.nodeId)}`;
+		case "device": return `device/${scope.deviceId}`;
+		case "integration": return `integration/${encodeSegment(scope.integrationId)}`;
+		case "row": return `row/${encodeSegment(scope.collection)}/${encodeSegment(scope.rowId)}`;
+	}
+}
 /**
 * The field path of a value inside an array item, addressed by the item's id:
 * `arrayItemFieldPath('providers', 'authentik', 'clientSecret')` →
@@ -107365,6 +107536,13 @@ function decodeSegment(value) {
 function arrayItemFieldPath(arrayKey, itemId, fieldKey) {
 	return `${arrayKey}[${encodeSegment(itemId)}].${fieldKey}`;
 }
+/** Build a ref. Throws on an empty owner or field path — both are bugs. */
+function buildSecretRef(parts) {
+	const owner = normalizeSecretOwner(parts.owner);
+	if (owner.length === 0) throw new Error("buildSecretRef: owner is empty");
+	if (parts.fieldPath.length === 0) throw new Error("buildSecretRef: fieldPath is empty");
+	return `${SECRET_REF_SCHEME}${encodeSegment(owner)}/${formatSecretScope(parts.scope)}/${parts.fieldPath}`;
+}
 function parseScope(segments) {
 	switch (segments[0]) {
 		case "global": return {
@@ -109277,6 +109455,45 @@ function normalizeAddonInitResult(result) {
 	if (Array.isArray(result)) return { providers: result };
 	return result;
 }
+var PREFIX = "records/";
+/** The base of every records failure. `detail` is the human part of the message. */
+var RecordsError = class extends Error {
+	code;
+	detail;
+	constructor(code, detail) {
+		super(`${PREFIX}${code}: ${detail}`);
+		this.name = "RecordsError";
+		this.code = code;
+		this.detail = detail;
+	}
+};
+/** A write guarded by `ifRev` found another revision (or an existing row for `ifRev: 0`). */
+var RevConflictError = class extends RecordsError {
+	constructor(detail) {
+		super("rev-conflict", detail);
+		this.name = "RevConflictError";
+	}
+};
+/** The keychain could not store or serve a value: explicit, never an empty string. */
+var RecordSecretUnavailableError = class extends RecordsError {
+	constructor(detail) {
+		super("secret-unavailable", detail);
+		this.name = "RecordSecretUnavailableError";
+	}
+};
+var InvalidRecordError = class extends RecordsError {
+	constructor(detail) {
+		super("invalid-record", detail);
+		this.name = "InvalidRecordError";
+	}
+};
+/** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
+var DeclarationRefusedError = class extends RecordsError {
+	constructor(detail) {
+		super("declaration-refused", detail);
+		this.name = "DeclarationRefusedError";
+	}
+};
 /** Limits and names of `ctx.records` (D881). One authority; the engine and the facade read it. */
 /** The files a kind may live in. `history` is device-history's (D850), never records. */
 var RECORD_DATABASES = ["settings", "events"];
@@ -109292,6 +109509,183 @@ var RECORD_DEFAULT_MAX_DATA_BYTES = 64 * 1024;
 var RECORD_MAX_DATA_BYTES = 1024 * 1024;
 var RECORD_BATCH_MAX = 1e3;
 var RECORD_QUERY_MAX = 1e3;
+/** A kind in the `settings` file may not bound itself above this (D447: high volume is `events`). */
+var RECORD_SETTINGS_MAX_ROWS = 5e4;
+/** The `Column`-free proof prefix: a ref collection for a kind's secret fields. */
+var RECORD_SECRET_COLLECTION_PREFIX = "records:";
+/**
+* Secret fields of a record, addressed the way a Zod schema declares them
+* (`collectZodSecretPaths`): dotted keys, `[]` for "each element of this array"
+* (`auth.accessToken`, `headers[].value`).
+*
+* `{}` after a key means "each value of this map" (`applianceSecrets{}`): the map's own key
+* names the value (`applianceSecrets{fridge}`), so no id key is declared and a body that drops a
+* key releases exactly that key's secret.
+*
+* Array elements are matched by a DECLARED id key (`secretArrayKeys`:
+* `{ headers: 'name' }`), never by index, so reordering a list keeps every
+* keychain ref (the same rule as `arrayItemFieldPath`). The concrete path of a
+* leaf names its element: `headers[X-Api].value`.
+*
+* Pure and browser-safe. Nothing here mutates: every transform returns a new value.
+*/
+/** The array prefixes (declared form, e.g. `headers` or `a.headers`) of a path. */
+function parseSecretPath(path) {
+	if (path.length === 0) throw new InvalidRecordError("an empty secret path");
+	return path.split(".").map((raw) => {
+		const each = raw.endsWith("[]");
+		const map = raw.endsWith("{}");
+		const key = each || map ? raw.slice(0, -2) : raw;
+		if (key.length === 0) throw new InvalidRecordError(`secret path "${path}" has an empty segment`);
+		return {
+			key,
+			each,
+			map
+		};
+	});
+}
+/** The declared array prefixes of `path` that need an id key (`headers`, `a.rows`). */
+function secretArrayPrefixes(path) {
+	const segments = parseSecretPath(path);
+	const prefixes = [];
+	const walked = [];
+	for (const segment of segments) {
+		walked.push(segment.key);
+		if (segment.each) prefixes.push(walked.join("."));
+	}
+	return prefixes;
+}
+function isRecord$4(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function elementId(element, idKey, declared, prefix) {
+	const id = isRecord$4(element) ? element[idKey] : void 0;
+	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
+	return id;
+}
+/**
+* Visit every secret leaf PRESENT in `data` (an absent branch has nothing to
+* visit). `replace` returns the new leaf value, or {@link REMOVE_LEAF}; the
+* result is a new body, `data` is untouched.
+*/
+var REMOVE_LEAF = Symbol("remove-leaf");
+function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
+	if (!isRecord$4(node)) return node;
+	const segment = segments[index];
+	if (segment === void 0) return node;
+	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
+	const child = node[segment.key];
+	const keys = [...walkedKeys, segment.key];
+	const last = index === segments.length - 1;
+	if (segment.each) {
+		if (!Array.isArray(child)) return node;
+		const prefix = keys.join(".");
+		const idKey = arrayKeys[prefix];
+		if (idKey === void 0) throw new InvalidRecordError(`"${declared}": no id key declared for the array "${prefix}"`);
+		const mapped = child.map((element) => {
+			const id = elementId(element, idKey, declared, prefix);
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}[${encodeURIComponent(id)}]`;
+			return last ? element : mapAt(element, segments, index + 1, keys, concrete, declared, arrayKeys, visit);
+		});
+		return {
+			...node,
+			[segment.key]: mapped
+		};
+	}
+	if (segment.map) {
+		if (!isRecord$4(child)) return node;
+		const kept = Object.entries(child).map(([mapKey, value]) => {
+			const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}{${encodeURIComponent(mapKey)}}`;
+			if (!last) return [mapKey, mapAt(value, segments, index + 1, keys, concrete, declared, arrayKeys, visit)];
+			return [mapKey, visit({
+				declared,
+				concrete,
+				value
+			})];
+		}).filter(([, value]) => value !== REMOVE_LEAF);
+		return {
+			...node,
+			[segment.key]: Object.fromEntries(kept)
+		};
+	}
+	const concrete = `${concretePrefix}${concretePrefix.length > 0 ? "." : ""}${segment.key}`;
+	if (last) {
+		const replacement = visit({
+			declared,
+			concrete,
+			value: child
+		});
+		if (replacement === REMOVE_LEAF) return Object.fromEntries(Object.entries(node).filter(([key]) => key !== segment.key));
+		return {
+			...node,
+			[segment.key]: replacement
+		};
+	}
+	return {
+		...node,
+		[segment.key]: mapAt(child, segments, index + 1, keys, concrete, declared, arrayKeys, visit)
+	};
+}
+/** Replace/remove every present secret leaf; returns a NEW body. */
+function mapSecretLeaves(data, paths, arrayKeys, visit) {
+	let current = data;
+	for (const declared of paths) current = mapAt(current, parseSecretPath(declared), 0, [], "", declared, arrayKeys, visit);
+	return current;
+}
+/** Every present secret leaf, read-only. */
+function collectSecretLeaves(data, paths, arrayKeys) {
+	const found = [];
+	mapSecretLeaves(data, paths, arrayKeys, (leaf) => {
+		found.push(leaf);
+		return leaf.value;
+	});
+	return found;
+}
+/**
+* The keychain collection name a kind's secrets live under. Prefixed so a
+* record's refs never collide with the refs a legacy collection of the same name
+* already holds during an adoption.
+*/
+function recordSecretCollection(kind) {
+	return `${RECORD_SECRET_COLLECTION_PREFIX}${kind}`;
+}
+/** The ONE ref a row's secret field may carry: the engine and the facade both build it here. */
+function recordSecretRef(owner, kind, rowId, concretePath) {
+	return buildSecretRef({
+		owner,
+		scope: {
+			kind: "row",
+			collection: recordSecretCollection(kind),
+			rowId
+		},
+		fieldPath: concretePath
+	});
+}
+/**
+* A stored secret, as an admin read shows it: a VIEW naming the row's own
+* keychain ref (`set: true`), never the value and no longer the bare redaction
+* token. The form hands it to the secret field, which reveals the value by ref
+* through the audited `keychain-admin.reveal`; sent back untouched it keeps the
+* stored secret (the records door reads a view as KEEP).
+*
+* ONE implementation for the entries service and for every addon that serves
+* its own instances (`RecordIntegrationInstances`).
+*/
+function isRecord$3(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function secretViewsOf(owner, kind, id, decl, data) {
+	if (decl.secretPaths.length === 0) return data;
+	const shown = mapSecretLeaves(data, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
+		if (leaf.value !== "__camstack_redacted__") return leaf.value;
+		return {
+			$secret: recordSecretRef(owner, kind, id, leaf.concrete),
+			v: 1,
+			set: true
+		};
+	});
+	return isRecord$3(shown) ? shown : data;
+}
 /**
 * The share-view scope kinds a share-link token can carry. The hub mints
 * and validates them (`ShareViewGrantSchema` builds its
@@ -109451,6 +109845,126 @@ var RecordKindDeclarationSchema = object({
 }).strict();
 /** The kind names: lower-case, dash separated, short enough for an index name. */
 var RecordKindNameSchema = string().regex(/^[a-z][a-z0-9-]{0,47}$/);
+/** Cross-field rules a declaration must satisfy. Throws {@link DeclarationRefusedError}. */
+function assertValidDeclaration(name, decl) {
+	const refuse = (why) => {
+		throw new DeclarationRefusedError(`kind "${name}": ${why}`);
+	};
+	if (!RecordKindNameSchema.safeParse(name).success) refuse("the name must be lower-case-dashed");
+	const seen = /* @__PURE__ */ new Set();
+	for (const index of decl.indexes) {
+		if (seen.has(index.name)) refuse(`index name "${index.name}" is declared twice`);
+		seen.add(index.name);
+	}
+	const { retention } = decl;
+	const hasSecrets = decl.secretPaths.length > 0;
+	if ("ttlMs" in retention) {
+		if (retention.from === "at" && decl.at !== "required") refuse("a ttl from \"at\" needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use engine TTL (its keychain values would be orphaned)");
+	}
+	if ("maxRows" in retention || "maxRowsPerDevice" in retention) {
+		if (retention.maxRowsPerDevice !== void 0 && decl.device !== "required") refuse("maxRowsPerDevice needs device: \"required\"");
+		if (decl.at !== "required") refuse("a row bound trims the oldest \"at\": it needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use an engine row bound");
+		const bound = Math.max(retention.maxRows ?? 0, retention.maxRowsPerDevice ?? 0);
+		if (decl.database === "settings" && bound > 5e4) refuse(`a row bound above ${RECORD_SETTINGS_MAX_ROWS} belongs in database: "events" (a big delete on the settings thread stalls every configuration read)`);
+	}
+	if (decl.deviceRemoval === "delete" && decl.device === "none") refuse("deviceRemoval: \"delete\" needs a device: \"required\" or \"optional\"");
+	for (const path of decl.secretPaths) for (const prefix of secretArrayPrefixes(path)) if (decl.secretArrayKeys[prefix] === void 0) refuse(`secret path "${path}" crosses the array "${prefix}": declare its id key in secretArrayKeys`);
+}
+function bodyFieldsOf(schema) {
+	return { ...toJSONSchema(schema, {
+		unrepresentable: "any",
+		io: "input"
+	}) };
+}
+function isRecordLike(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Does every branch of the body schema carry `field`? (A discriminated union has several.) */
+function hasNameField(json, field) {
+	const branches = json["oneOf"] ?? json["anyOf"];
+	if (Array.isArray(branches)) return branches.length > 0 && branches.every((b) => isRecordLike(b) && hasNameField(b, field));
+	const properties = json["properties"];
+	return isRecordLike(properties) && Object.prototype.hasOwnProperty.call(properties, field);
+}
+/**
+* Declare the kinds of a package. The keys are the kind names. The result is
+* what `ctx.records.declare` sends to the engine and what `ctx.records.kind`
+* types its handle from.
+*/
+function defineRecordKinds(specs) {
+	const out = {};
+	for (const [name, spec] of Object.entries(specs)) {
+		const secretPaths = collectZodSecretPaths(spec.schema);
+		const nameField = spec.entry?.nameField ?? "name";
+		const fields = bodyFieldsOf(spec.schema);
+		if (spec.entry !== void 0 && !hasNameField(fields, nameField)) throw new DeclarationRefusedError(`kind "${name}": an entry kind's schema needs a "${nameField}" field`);
+		const parsed = RecordKindDeclarationSchema.parse({
+			database: spec.database,
+			class: spec.class,
+			writeTrigger: spec.writeTrigger,
+			device: spec.device,
+			at: spec.at,
+			indexes: spec.indexes === void 0 ? void 0 : [...spec.indexes],
+			retention: spec.retention,
+			deviceRemoval: spec.deviceRemoval,
+			maxDataBytes: spec.maxDataBytes,
+			secretPaths: [...new Set([...secretPaths, ...spec.retiredSecretPaths ?? []])],
+			secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
+			transactFamily: spec.transactFamily,
+			entry: spec.entry === void 0 ? void 0 : {
+				title: spec.entry.title,
+				nameField,
+				fields
+			}
+		});
+		assertValidDeclaration(name, parsed);
+		out[name] = {
+			name,
+			schema: spec.schema,
+			declaration: parsed
+		};
+	}
+	return out;
+}
+/**
+* Entry kinds (D881): every list of user-created entries (notification
+* targets, brokers, LLM profiles) is ONE record kind with an id, a name and a
+* kind-specific body, and the admin UI lists/adds/edits/deletes all of them
+* through the `record-entries` capability with password fields derived from
+* the schema (`.meta({ secret: true })`).
+*/
+/** The body of a plain entry: a name and the fields the kind adds. */
+function entryBody(shape) {
+	return object({
+		name: string().min(1),
+		...shape
+	});
+}
+/**
+* Declare one entry kind. An entry is configuration: never trimmed by the
+* engine, never aged, belonging to no device.
+*/
+function defineEntryKind(name, spec) {
+	const defined = defineRecordKinds({ [name]: {
+		schema: spec.schema,
+		class: "config",
+		writeTrigger: spec.writeTrigger ?? "an operator adds or edits an entry in the entries UI",
+		retention: { none: "an entry goes only when the operator deletes it" },
+		...spec.maxDataBytes === void 0 ? {} : { maxDataBytes: spec.maxDataBytes },
+		...spec.database === void 0 ? {} : { database: spec.database },
+		...spec.indexes === void 0 ? {} : { indexes: spec.indexes },
+		...spec.secretArrayKeys === void 0 ? {} : { secretArrayKeys: spec.secretArrayKeys },
+		...spec.retiredSecretPaths === void 0 ? {} : { retiredSecretPaths: spec.retiredSecretPaths },
+		entry: {
+			title: spec.title,
+			...spec.nameField === void 0 ? {} : { nameField: spec.nameField }
+		}
+	} })[name];
+	if (defined === void 0) throw new DeclarationRefusedError(`entry kind "${name}" was not built`);
+	return defined;
+}
 object({
 	field: string().min(1),
 	on: literal("advance")
@@ -113623,6 +114137,205 @@ var IntegrationInstanceRefSchema = object({
 	]),
 	candidateStableId: string().optional()
 });
+/**
+* `RecordIntegrationInstances` - the `integration-instances` provider over ONE
+* entry kind, so an addon that holds a connection serves it in ~30 lines.
+*
+* Every instance is one record of the addon's own kind, keyed by the
+* `integrations` registry id. The records door does the secret work: a field the
+* kind marks `.meta({ secret: true })` is a keychain marker bound to the row, so
+* deleting the row deletes the secret, and one row's value is never another's.
+*
+* Patch rules for a secret (`updateInstance`): omitted, `''`, the redaction
+* token or the view the form was given KEEP the stored secret;
+* `{ $secretClear: true }` clears it; any other string replaces it.
+*/
+/** The most instances one addon lists (an integrations page, not a table). */
+var INSTANCES_LIST_MAX = 1e3;
+/** The keys of the kind's secret fields that sit at the top level of the body. */
+function topLevelSecretKeys(paths) {
+	return new Set(paths.filter((p) => !p.includes(".") && !p.includes("[") && !p.includes("{")));
+}
+/** The keys of the kind's top-level MAPS whose values are secrets (`applianceSecrets{}`). */
+function secretMapKeys(paths) {
+	return new Set(paths.filter((p) => p.endsWith("{}") && !p.slice(0, -2).match(/[.[{]/)).map((p) => p.slice(0, -2)));
+}
+/**
+* A patch value for a map of secrets: an entry that is omitted, `''`, the redaction token or the
+* view the form was given KEEPS its stored secret (it is left out of the merge); `{ $secretClear }`
+* or `null` removes the entry; any other string replaces it. Null when nothing is left to merge.
+*/
+function secretMapPatch(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const out = {};
+	for (const [key, entry] of Object.entries(value)) if (entry === null || isSecretClear(entry)) out[key] = null;
+	else if (typeof entry === "string" && entry !== "" && entry !== "__camstack_redacted__" && !isSecretFieldView(entry)) out[key] = entry;
+	return Object.keys(out).length > 0 ? out : null;
+}
+/** Does the kind's body schema carry an `enabled` field? */
+function declaresEnabled(kind) {
+	const json = toJSONSchema(kind.schema, {
+		unrepresentable: "any",
+		io: "input"
+	});
+	const properties = Reflect.get(json, "properties");
+	return typeof properties === "object" && properties !== null && "enabled" in properties;
+}
+var RecordIntegrationInstances = class {
+	records;
+	kind;
+	hooks;
+	handle;
+	secretKeys;
+	secretMaps;
+	nameField;
+	/** The `integrations` registry owns the on/off switch (`role: devices`); the body has none. */
+	registryOwnsEnabled;
+	constructor(records, kind, hooks) {
+		this.records = records;
+		this.kind = kind;
+		this.hooks = hooks;
+		this.handle = records.kind(kind);
+		this.secretKeys = topLevelSecretKeys(kind.declaration.secretPaths);
+		this.secretMaps = secretMapKeys(kind.declaration.secretPaths);
+		this.nameField = kind.declaration.entry?.nameField ?? "name";
+		this.registryOwnsEnabled = hooks.description.role === "devices";
+		if (this.registryOwnsEnabled && declaresEnabled(kind)) throw new Error(`kind "${kind.name}": the integrations registry owns the on/off switch of a role "devices" addon, so the body must not declare "enabled"`);
+	}
+	/**
+	* One instance read for the addon's own runtime; null when absent. When the keychain is
+	* locked the row is served WITHOUT its secrets and says so (`secrets: 'unavailable'`), so the
+	* caller can keep what it had instead of reconfiguring with an empty secret (D49).
+	*/
+	async readResolved(id) {
+		try {
+			const record = await this.handle.getResolved(id);
+			return record === null ? null : {
+				id,
+				body: record.data,
+				enabled: record.data.enabled !== false,
+				secrets: "resolved"
+			};
+		} catch (err) {
+			if (!(err instanceof RecordSecretUnavailableError)) throw err;
+			const stored = await this.handle.get(id);
+			if (stored === null) return null;
+			return {
+				id,
+				body: Object.fromEntries(Object.entries(stored.data).filter(([key]) => !this.secretKeys.has(key))),
+				enabled: stored.data.enabled !== false,
+				secrets: "unavailable"
+			};
+		}
+	}
+	/** The body of {@link readResolved} alone; a locked keychain yields the row without secrets. */
+	async getResolved(id) {
+		return (await this.readResolved(id))?.body ?? null;
+	}
+	/** Every instance, secrets resolved where the keychain allows; an absent one is skipped. */
+	async listResolved() {
+		const page = await this.handle.query({ limit: INSTANCES_LIST_MAX });
+		const out = [];
+		for (const record of page.records) {
+			const read = await this.readResolved(record.id);
+			if (read !== null) out.push(read);
+		}
+		return out;
+	}
+	viewOf(record) {
+		const shown = secretViewsOf(this.records.owner, this.kind.name, record.id, this.kind.declaration, record.data);
+		const rawName = record.data[this.nameField];
+		const kind = this.hooks.kindOf?.(record.data);
+		const health = this.hooks.health?.(record.data, record.id);
+		return {
+			id: record.id,
+			name: typeof rawName === "string" ? rawName : record.id,
+			configured: this.hooks.configured(record.data),
+			...this.registryOwnsEnabled ? {} : { enabled: record.data.enabled !== false },
+			formValues: shown,
+			...kind !== void 0 ? { kind } : {},
+			...health?.status !== void 0 ? { status: health.status } : {},
+			...health?.lastCheckedAt !== void 0 ? { lastCheckedAt: health.lastCheckedAt } : {}
+		};
+	}
+	describe = async () => this.hooks.mintId === void 0 ? this.hooks.description : {
+		...this.hooks.description,
+		mintsId: true
+	};
+	instanceFormSchema = async ({ id }) => this.hooks.formSchema(id);
+	listInstances = async () => {
+		return (await this.handle.query({ limit: INSTANCES_LIST_MAX })).records.map((record) => this.viewOf(record));
+	};
+	getInstance = async ({ id }) => {
+		const record = await this.handle.get(id);
+		return record === null ? null : this.viewOf(record);
+	};
+	/** Insert ONE row (`ifRev: 0`: an existing id is refused, never overwritten). */
+	createInstance = async ({ id, name, kind }) => {
+		const minted = id ?? this.hooks.mintId?.({
+			name,
+			...kind !== void 0 ? { kind } : {}
+		});
+		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
+		await this.handle.put({
+			id: minted,
+			data: this.hooks.initialBody(name, kind)
+		}, { ifRev: 0 });
+		await this.hooks.onChanged?.(minted, "created");
+		return { id: minted };
+	};
+	updateInstance = async ({ id, name, values }) => {
+		const patch = {};
+		for (const [key, value] of Object.entries(values)) {
+			if (value === void 0) continue;
+			if (this.secretMaps.has(key)) {
+				const entries = secretMapPatch(value);
+				if (entries !== null) patch[key] = entries;
+			} else if (!this.secretKeys.has(key)) patch[key] = value;
+			else if (isSecretClear(value)) patch[key] = null;
+			else if (typeof value === "string" && value !== "" && value !== "__camstack_redacted__" && !isSecretFieldView(value)) patch[key] = value;
+		}
+		if (name !== void 0) patch[this.nameField] = name;
+		await this.handle.patch(id, patch);
+		await this.hooks.onChanged?.(id, "updated");
+		return { ok: true };
+	};
+	/** The switch lives in the record body; the addon is told so it applies it (D996). */
+	setInstanceEnabled = async ({ id, enabled }) => {
+		if (this.registryOwnsEnabled) throw new Error(`instance "${id}": the integrations registry owns the on/off switch of this addon; set it with integrations.update`);
+		await this.handle.patch(id, { enabled });
+		await this.hooks.onChanged?.(id, "enabled");
+		return { ok: true };
+	};
+	/** The row and its keychain refs go together (the records door). */
+	deleteInstance = async ({ id }) => {
+		await this.handle.delete(id);
+		await this.hooks.onChanged?.(id, "deleted");
+		return { ok: true };
+	};
+	testInstance = async (input) => {
+		if (this.hooks.test === void 0) return {
+			success: false,
+			status: "unsupported",
+			error: "This integration declares no connection test"
+		};
+		return this.hooks.test(input);
+	};
+	/** The flat provider object to hand to `registerProvider`. */
+	toProvider() {
+		return {
+			describe: this.describe,
+			instanceFormSchema: this.instanceFormSchema,
+			listInstances: this.listInstances,
+			getInstance: this.getInstance,
+			createInstance: this.createInstance,
+			updateInstance: this.updateInstance,
+			setInstanceEnabled: this.setInstanceEnabled,
+			deleteInstance: this.deleteInstance,
+			testInstance: this.testInstance
+		};
+	}
+};
 var EncodeProfileSchema = object({
 	video: object({
 		codec: _enum([
@@ -114727,6 +115440,130 @@ var MigrationOwnerStepSchema = object({
 	/** The ledger state the engine found: `pending` has no row yet. */
 	state: union([literal("pending"), MigrationStatusSchema])
 });
+/**
+* Move an integration's legacy `integration_settings` rows into a typed record of the addon's own
+* kind (planning#416, the one store). The record is keyed by the `integrations` registry id, so
+* the integration id, the devices stamped with it and the automations that name it do not change.
+*
+* Order, so a crash or a locked keychain is safe at every point:
+*
+*  1. Phase A, read only: every row of every integration of the addon is read with its secrets
+*     resolved. One that cannot be read (a locked keychain) throws, naming the integration, before
+*     anything is written; `block-owner` then holds the addon.
+*  2. Phase B, per integration: the addon's `bodyFrom` builds the body; the record is put with
+*     `ifRev: 0` (an existing record is never overwritten). A record this pass CREATED is read back
+*     and every secret leaf must equal what the rows held, else the record is deleted and the pass
+*     throws; an EXISTING record must hold every secret the rows carry, else the rows are kept and
+*     a warning names the path. Only then are the rows (and their keychain values) cleared.
+*
+* Idempotent: an integration whose rows are gone and whose record exists is skipped, so a rerun is
+* a no-op. A default integration with no rows still gets its record (an empty body, D985).
+* Never logs or throws a secret value; messages name integration ids and secret PATHS only.
+*/
+function secretLeavesOf(body, spec) {
+	const out = /* @__PURE__ */ new Map();
+	for (const leaf of collectSecretLeaves(body, spec.secretPaths, spec.secretArrayKeys ?? {})) if (typeof leaf.value === "string" && leaf.value.length > 0) out.set(leaf.concrete, leaf.value);
+	return out;
+}
+function why(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+async function moveIntegrationRowsToRecords(ports, spec) {
+	const integrations = await ports.listIntegrations(spec.addonId);
+	if (integrations.length === 0) return {
+		outcome: "already-done",
+		summary: { integrations: 0 }
+	};
+	const rowsOf = /* @__PURE__ */ new Map();
+	for (const integration of integrations) try {
+		rowsOf.set(integration.id, await ports.readRows(integration.id));
+	} catch (err) {
+		throw new Error(`integration '${integration.id}': the legacy settings cannot be read with their secrets (${why(err)}) - nothing moved`, { cause: err });
+	}
+	let created = 0;
+	let cleared = 0;
+	let kept = 0;
+	for (const integration of integrations) {
+		const values = rowsOf.get(integration.id) ?? {};
+		const hasRows = Object.keys(values).length > 0;
+		const body = spec.bodyFrom(values, ports, integration);
+		const put = await ports.putRecord(integration.id, body);
+		if (put === "created") created += 1;
+		if (!hasRows) continue;
+		const wanted = secretLeavesOf(body, spec);
+		const back = await ports.readRecord(integration.id);
+		if (back === null) throw new Error(`integration '${integration.id}': the record is gone after it was put`);
+		const held = secretLeavesOf(back, spec);
+		if (put === "created") {
+			const wrong = [...wanted].filter(([path, value]) => held.get(path) !== value).map(([p]) => p);
+			if (wrong.length > 0) {
+				await ports.deleteRecord(integration.id);
+				throw new Error(`integration '${integration.id}': ${wrong.join(", ")} did not read back from the record - the record was removed and the legacy settings are kept`);
+			}
+		} else {
+			const missing = [...wanted].filter(([path]) => !held.has(path)).map(([p]) => p);
+			if (missing.length > 0) {
+				ports.warn(`integration '${integration.id}': the existing record holds no ${missing.join(", ")}; the legacy settings are kept, not cleared`);
+				kept += 1;
+				continue;
+			}
+		}
+		await ports.clearRows(integration.id);
+		cleared += 1;
+	}
+	return created === 0 && cleared === 0 ? {
+		outcome: "already-done",
+		summary: {
+			integrations: integrations.length,
+			kept
+		}
+	} : {
+		outcome: "done",
+		summary: {
+			integrations: integrations.length,
+			created,
+			cleared,
+			kept
+		}
+	};
+}
+/**
+* The addon-side ports of `moveIntegrationRowsToRecords` (planning#416): an addon runs the move
+* from its own process, so the legacy rows are reached through the hub (`ctx.api.integrations`:
+* `list`, `getSettings` - which answers the OWNER its secrets resolved - and `clearSettings`) and
+* the new record through the addon's own records handle. The hub deletes the rows and their
+* keychain values; the addon never touches the registry.
+*/
+function integrationRowsPortsOverApi(deps) {
+	return {
+		warn: (message) => deps.log.warn(message),
+		listIntegrations: async (addonId) => (await deps.api.list()).filter((i) => i.addonId === addonId).map((i) => ({
+			id: i.id,
+			name: i.name
+		})),
+		readRows: (integrationId) => deps.api.getSettings({ id: integrationId }),
+		putRecord: async (id, body) => {
+			if (await deps.records.get(id) !== null) return "exists";
+			try {
+				await deps.records.put({
+					id,
+					data: body
+				}, { ifRev: 0 });
+			} catch (err) {
+				if (err instanceof RevConflictError) return "exists";
+				throw err;
+			}
+			return "created";
+		},
+		readRecord: async (id) => (await deps.records.getResolved(id))?.data ?? null,
+		deleteRecord: async (id) => {
+			await deps.records.delete(id);
+		},
+		clearRows: async (integrationId) => {
+			await deps.api.clearSettings({ id: integrationId });
+		}
+	};
+}
 function ordinalOf(id) {
 	const digits = id.replace(/\D+/g, "");
 	return digits.length > 0 ? Number(digits) : Number.POSITIVE_INFINITY;
@@ -114801,6 +115638,40 @@ async function claimDevicesToDefaultIntegration(ports, spec) {
 		}
 	};
 }
+/**
+* The two migrations of a device addon whose integrations hold NO settings of their own
+* (planning#416, S-A): every integration becomes a record of the addon's own kind with a name and
+* nothing else (D985, the default integration is an instance with an empty body), then the devices
+* that carry no `integrationId` are claimed to the addon's default integration.
+*
+*  1. `rows-to-record` (block-owner): `moveIntegrationRowsToRecords` over the hub API. Rows an
+*     addon of this shape does not own (a key nothing reads) are named in a warning, by key, and
+*     dropped with the rows once the record is read back.
+*  2. `claim-devices` (tolerate): `claimDevicesToDefaultIntegration`; with no integration to claim
+*     to it fails and is retried on the next boot.
+*
+* Both run in the addon process through the hub API (`ctx.api`), BEFORE the addon registers its
+* `integration-instances` provider: while a provider is registered the hub answers `getSettings`
+* from the record, not from the rows.
+*/
+function defaultIntegrationPortsOver(deps) {
+	return {
+		...integrationRowsPortsOverApi({
+			api: deps.api,
+			records: deps.records.kind({
+				name: deps.kind.name,
+				declaration: deps.kind.declaration,
+				schema: record(string(), unknown())
+			}),
+			log: { warn: deps.warn }
+		}),
+		...claimDevicesPortsOver({
+			api: deps.api,
+			info: deps.info,
+			warnDevice: deps.warnDevice
+		})
+	};
+}
 /** The hub side of the device claim, over `ctx.api`. */
 function claimDevicesPortsOver(deps) {
 	return {
@@ -157066,32 +157937,57 @@ var IntegrationInstancePatchSchema = object({
 	/** Omitted / '' / redaction token keeps a secret; `{ $secretClear: true }` clears it. */
 	values: record(string(), unknown())
 });
-method(_void(), IntegrationInstanceDescriptionSchema, { auth: "admin" }), method(object({ id: IntegrationInstanceIdSchema.nullable() }), ConfigSchemaPassthrough$3, { auth: "admin" }), method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }), method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }), method(object({
-	id: IntegrationInstanceIdSchema.optional(),
-	name: string().min(1),
-	kind: string().min(1).optional()
-}), object({ id: string() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(IntegrationInstancePatchSchema, object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	id: IntegrationInstanceIdSchema,
-	enabled: boolean()
-}), object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ id: IntegrationInstanceIdSchema }), object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), optionalMethod(object({
-	id: IntegrationInstanceIdSchema.nullable(),
-	values: record(string(), unknown())
-}), TestConnectionResultSchema$1, {
-	kind: "mutation",
-	auth: "admin"
-});
+var integrationInstancesCapability = {
+	name: "integration-instances",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		describe: method(_void(), IntegrationInstanceDescriptionSchema, { auth: "admin" }),
+		/** The form; `id: null` is the create form. */
+		instanceFormSchema: method(object({ id: IntegrationInstanceIdSchema.nullable() }), ConfigSchemaPassthrough$3, { auth: "admin" }),
+		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
+		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
+		/**
+		* Insert the typed record. With `id` it is stored under that id (a duplicate id is refused);
+		* without one the PROVIDER mints it and answers it. `kind` picks one of `describe().kinds`.
+		*/
+		createInstance: method(object({
+			id: IntegrationInstanceIdSchema.optional(),
+			name: string().min(1),
+			kind: string().min(1).optional()
+		}), object({ id: string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateInstance: method(IntegrationInstancePatchSchema, object({ ok: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Switch ONE instance on or off. A row control, not a form field: `updateInstance.values` is the
+		* form patch (D62, D996). An off instance keeps its record and secrets and does no work.
+		*/
+		setInstanceEnabled: method(object({
+			id: IntegrationInstanceIdSchema,
+			enabled: boolean()
+		}), object({ ok: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Delete the record and its keychain refs together. */
+		deleteInstance: method(object({ id: IntegrationInstanceIdSchema }), object({ ok: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		testInstance: optionalMethod(object({
+			id: IntegrationInstanceIdSchema.nullable(),
+			values: record(string(), unknown())
+		}), TestConnectionResultSchema$1, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
 /**
 * Two-way audio / talk-back cap. Clients open a WebRTC audio-only
 * session (server-initiated offer pattern, identical to the main
@@ -220342,7 +221238,7 @@ function text(stored, key) {
 	const value = stored[key];
 	return typeof value === "string" && value.length > 0 ? value : null;
 }
-function portOf(stored, ports) {
+function portOf$1(stored, ports) {
 	const value = stored["emailPushPort"];
 	const numeric = typeof value === "number" ? value : typeof value === "string" ? Number(value) : NaN;
 	if (Number.isInteger(numeric) && numeric >= 1 && numeric <= 65535) return numeric;
@@ -220364,7 +221260,7 @@ async function moveEmailPushToMailbox(ports) {
 	};
 	const bindHost = text(stored, "emailPushBindHost");
 	await ports.stashPending({
-		port: portOf(stored, ports),
+		port: portOf$1(stored, ports),
 		...bindHost === null ? {} : { bindHost },
 		domain: text(stored, "emailPushDomain") ?? DEFAULT_DOMAIN,
 		requireAuth: stored["emailPushRequireAuth"] !== false,
@@ -220376,6 +221272,188 @@ async function moveEmailPushToMailbox(ports) {
 		summary: { moved: true }
 	};
 }
+var reolinkConnectionsEntryKind = defineEntryKind("connections", {
+	title: "Reolink integrations",
+	schema: entryBody({
+		host: string().nullish(),
+		port: number().int().min(1).max(65535).nullish(),
+		rtspPort: number().int().min(1).max(65535).nullish(),
+		username: string().nullish(),
+		password: string().optional().meta({ secret: true }),
+		transport: _enum(["tcp", "udp"]).nullish(),
+		uid: string().nullish(),
+		debugGeneral: boolean().nullish(),
+		debugSocketLogs: array(ReolinkSocketDebugFlagSchema).nullish()
+	}),
+	writeTrigger: "an operator adds, edits or removes a Reolink integration, or a Hub device is migrated into one"
+});
+/** Every kind this addon declares, keyed by its name. */
+var reolinkRecordKinds = { connections: reolinkConnectionsEntryKind };
+/** The record body as the connection form's flat values: no name, no unset keys. */
+function hubSettingsOf(body) {
+	const out = {};
+	for (const [key, value] of Object.entries(body)) {
+		if (key === "name" || value === null || value === void 0) continue;
+		out[key] = value;
+	}
+	return out;
+}
+/**
+* What a resolved record says about its hub. A keychain that is locked yields a record WITHOUT
+* its password: that is `password-locked`, never an empty password (D49).
+*/
+function hubConnectionOf(resolved) {
+	const read = readHubConnection(hubSettingsOf(resolved.body));
+	return read.kind === "no-password" && resolved.secrets === "unavailable" ? { kind: "password-locked" } : read;
+}
+/**
+* What each enabled integration's RECORD says about its hub: the one reader of the connection.
+* A record that is absent reads as `no-host` (no session), exactly as an empty settings blob did.
+*/
+async function readHubConnections(instances, integrations) {
+	const out = [];
+	for (const integration of integrations) {
+		const resolved = await instances.readResolved(integration.id);
+		out.push({
+			id: integration.id,
+			name: integration.name,
+			read: resolved === null ? { kind: "no-host" } : hubConnectionOf(resolved)
+		});
+	}
+	return out;
+}
+function buildReolinkInstances(records, deps) {
+	return new RecordIntegrationInstances(records, reolinkConnectionsEntryKind, {
+		description: {
+			role: "devices",
+			discovery: {
+				mode: "lan",
+				scopedToInstance: false
+			},
+			instanceMode: "multiple",
+			kind: "connection",
+			canTest: false
+		},
+		formSchema: () => buildHubInstanceSchema(),
+		initialBody: (name) => ({ name }),
+		configured: (body) => (body.host ?? "").length === 0 || (body.password ?? "").length > 0,
+		onChanged: () => deps.onChanged()
+	});
+}
+/**
+* The provider handed to the hub: the default integration (no connection) shows no hub form, an
+* NVR / Home Hub one does, and a create wizard (no id yet) sets up a hub.
+*/
+function reolinkInstancesProvider(instances, deps) {
+	return {
+		...instances.toProvider(),
+		instanceFormSchema: async ({ id }) => {
+			if (id === null) return buildHubInstanceSchema();
+			const [evidence, body] = await Promise.all([deps.registryEvidenceOf(id), instances.getResolved(id)]);
+			return evidence !== null && isHubIntegration({
+				originStableId: evidence.originStableId,
+				info: evidence.info,
+				settings: body === null ? {} : hubSettingsOf(body)
+			}) || body === null ? buildHubInstanceSchema() : { sections: [] };
+		}
+	};
+}
+//#endregion
+//#region src/migrations/integration-rows-to-record.ts
+/**
+* Every Reolink integration moves from legacy `integration_settings` rows into its own
+* `connections` record under the registry id (planning#416, D1007). An NVR / Home Hub integration
+* carries its connection (host, ports, username, transport, uid, the two debug fields) and its
+* password, a keychain secret declared by the kind; the default integration carries a name only.
+* Each integration's record is built from ITS OWN rows, never from another's.
+*
+* Keys nothing reads any more are named in a warning, by key, and dropped with the rows once the
+* record has been read back. A value of the wrong type is left out and named by key as well.
+*/
+var REOLINK_ROWS_TO_RECORD_ID = "provider-reolink/2026-11-05-integration-rows-to-record";
+var TEXT_KEYS = [
+	"host",
+	"username",
+	"uid"
+];
+var PORT_KEYS = ["port", "rtspPort"];
+function portOf(value) {
+	const n = typeof value === "string" && value.trim() !== "" ? Number(value) : value;
+	return typeof n === "number" && Number.isInteger(n) && n >= 1 && n <= 65535 ? n : null;
+}
+function textOf(value) {
+	return typeof value === "string" && value.trim() !== "" ? value.trim() : null;
+}
+/** The record body of one integration, from its resolved legacy rows. Never logs a value. */
+function reolinkBodyFromRows(values, log, integration) {
+	const body = { name: integration.name };
+	const unusable = [];
+	const known = new Set([
+		...TEXT_KEYS,
+		...PORT_KEYS,
+		"password",
+		"transport",
+		"debugGeneral",
+		"debugSocketLogs"
+	]);
+	for (const key of TEXT_KEYS) {
+		if (!(key in values)) continue;
+		const text = textOf(values[key]);
+		if (text === null) unusable.push(key);
+		else body[key] = text;
+	}
+	for (const key of PORT_KEYS) {
+		if (!(key in values)) continue;
+		const port = portOf(values[key]);
+		if (port === null) unusable.push(key);
+		else body[key] = port;
+	}
+	if ("password" in values) {
+		const password = values["password"];
+		if (typeof password === "string" && password.length > 0) body["password"] = password;
+		else unusable.push("password");
+	}
+	if ("transport" in values) {
+		const transport = values["transport"];
+		if (transport === "tcp" || transport === "udp") body["transport"] = transport;
+		else unusable.push("transport");
+	}
+	if ("debugGeneral" in values) {
+		const flag = values["debugGeneral"];
+		if (typeof flag === "boolean") body["debugGeneral"] = flag;
+		else unusable.push("debugGeneral");
+	}
+	if ("debugSocketLogs" in values) {
+		const flags = values["debugSocketLogs"];
+		const parsed = Array.isArray(flags) ? flags.map((f) => ReolinkSocketDebugFlagSchema.safeParse(f)) : null;
+		if (parsed !== null && parsed.every((p) => p.success)) body["debugSocketLogs"] = parsed.flatMap((p) => p.success ? [p.data] : []);
+		else unusable.push("debugSocketLogs");
+	}
+	const unknown = Object.keys(values).filter((key) => !known.has(key));
+	if (unknown.length > 0) log.warn(`integration '${integration.id}': legacy settings nothing reads any more are dropped: ${unknown.join(", ")}`);
+	if (unusable.length > 0) log.warn(`integration '${integration.id}': legacy settings with an unusable value are left out: ${unusable.join(", ")}`);
+	return reolinkConnectionsEntryKind.schema.parse(body);
+}
+var REOLINK_ROWS_TO_RECORD_MIGRATION = {
+	meta: {
+		id: REOLINK_ROWS_TO_RECORD_ID,
+		owner: "provider-reolink",
+		level: "addon-state",
+		seq: 4,
+		dependsOn: [],
+		store: "settings",
+		scope: "cluster",
+		onFailure: "block-owner",
+		bodyKind: "procedure",
+		description: "Move every Reolink integration (the default one and each NVR / Home Hub) into its own connection record keyed by its registry id, the password as a keychain secret, then clear its legacy integration settings rows",
+		fixtureMark: "a legacy setting key the migration does not know"
+	},
+	procedure: (ports) => moveIntegrationRowsToRecords(ports, {
+		addonId: "provider-reolink",
+		secretPaths: reolinkConnectionsEntryKind.declaration.secretPaths,
+		bodyFrom: reolinkBodyFromRows
+	})
+};
 /** The `provider-reolink` catalogue (D987): offered to the engine when the addon initialises. */
 var REOLINK_MIGRATIONS = [{
 	meta: {
@@ -220409,17 +221487,17 @@ var REOLINK_MIGRATIONS = [{
 	plan: planDropWebhookIntakeSettings
 }];
 /**
-* Every persisted camera that names no integration is claimed to the addon's default one. The
-* integration a hub migration created is never the default, so it is not eligible. The integration
-* settings themselves stay where they are until this addon's own wave moves them.
+* The integration wave (D1007) in declaration order, which must follow `seq`: the device claim
+* shipped first (seq 3) and the rows move follows it (seq 4). The engine refuses the whole
+* catalogue when a seq does not increase, and the addon then does not start.
 */
-var REOLINK_CLAIM_MIGRATION = claimDevicesMigration({
+var REOLINK_INTEGRATION_MIGRATIONS = [claimDevicesMigration({
 	addonId: "provider-reolink",
 	date: "2026-11-04",
 	seq: 3,
 	dependsOn: [],
 	eligible: (integration) => integration.info[MIGRATED_FROM_HUB_KEY] === void 0
-});
+}), REOLINK_ROWS_TO_RECORD_MIGRATION];
 //#endregion
 //#region src/reolink-adoption-provider.ts
 var DEVICES_FILTER = {
@@ -220689,7 +221767,7 @@ var ReolinkHubManager = class {
 		const { logger } = this.#deps;
 		const wanted = /* @__PURE__ */ new Set();
 		for (const integration of integrations) {
-			const read = readHubConnection(integration.settings);
+			const { read } = integration;
 			if (read.kind === "no-host") continue;
 			wanted.add(integration.id);
 			if (read.kind !== "ok") {
@@ -221057,6 +222135,7 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 	*/
 	autodetectCache = new AutodetectCache();
 	hubManager = null;
+	instances = null;
 	/**
 	* The camera mailbox bridge (`email-push-bridge.ts`, D999): battery cameras mail motion to a
 	* mailbox of the `smtp-inbound` broker, the bridge turns each message into the camera's
@@ -221302,25 +222381,17 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 	}
 	/**
 	* Make the hub sessions match the live integration list: one per enabled integration with a
-	* host. Idempotent; runs at boot, after a migration and on every lifecycle event. When any
-	* integration's settings cannot be read the whole pass is skipped — an unreadable list must
+	* host. Idempotent; runs at boot, after a migration, after an instance change and on every
+	* lifecycle event. When any integration's record cannot be read the whole pass is skipped — an unreadable list must
 	* never close a healthy session.
 	*/
 	async reconcileIntegrations() {
 		const manager = this.hubManager;
-		if (manager === null) return;
+		const instances = this.instances;
+		if (manager === null || instances === null) return;
 		try {
-			const mine = (await this.ctx.api.integrations.list.query()).filter((i) => i.addonId === this.ctx.id && i.enabled);
-			const withSettings = [];
-			for (const integration of mine) {
-				const settings = await this.ctx.api.integrations.getSettings.query({ id: integration.id });
-				withSettings.push({
-					id: integration.id,
-					name: integration.name,
-					settings
-				});
-			}
-			await manager.reconcile(withSettings);
+			const withConnection = await readHubConnections(instances, (await this.ctx.api.integrations.list.query()).filter((i) => i.addonId === this.ctx.id && i.enabled));
+			await manager.reconcile(withConnection);
 		} catch (err) {
 			this.ctx.logger.warn("Reolink integration reconcile failed — sessions left as they were", { meta: { error: errMsg$3(err) } });
 		}
@@ -221493,28 +222564,6 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 	globalSettingsSchema() {
 		return { sections: [...buildClipRefreshSettingsSchema().sections] };
 	}
-	/**
-	* Per-instance form (D985): an NVR / Home Hub integration shows its connection only; the
-	* default integration keeps the full schema (`null`). A create wizard has no id yet and is
-	* always setting up a NEW instance — the default one already exists — so it gets the hub form.
-	*/
-	async integrationSettingsSchema(instance) {
-		if (instance.integrationId === null) return buildHubInstanceSchema();
-		try {
-			const [integration, settings] = await Promise.all([this.ctx.api.integrations.get.query({ id: instance.integrationId }), this.ctx.api.integrations.getSettings.query({ id: instance.integrationId })]);
-			return isHubIntegration({
-				originStableId: integration.originStableId,
-				info: integration.info,
-				settings
-			}) ? buildHubInstanceSchema() : null;
-		} catch (err) {
-			this.ctx.logger.warn("Reolink integration form: instance lookup failed — full schema shown", { meta: {
-				integrationId: instance.integrationId,
-				error: errMsg$3(err)
-			} });
-			return null;
-		}
-	}
 	async onInitialize() {
 		const regs = this.providerRegistrationsFromSuper(await super.onInitialize());
 		this.logChannels = createLogChannelsProvider(this.ctx.logger.child("log-channels"));
@@ -221559,11 +222608,38 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 		this.wireClipCatalogRefreshers();
 		await this.serveClipPlanes(this.clipService);
 		await this.serveWebhookPlane();
-		await this.runMigrations([...defineAddonMigrations(REOLINK_MIGRATIONS, this.migrationPorts()), ...defineAddonMigrations([REOLINK_CLAIM_MIGRATION], claimDevicesPortsOver({
+		const records = this.ctx.records;
+		if (records === void 0) throw new Error("provider-reolink: ctx.records is required (hub-only addon)");
+		await records.declare(reolinkRecordKinds);
+		const integrationPorts = defaultIntegrationPortsOver({
 			api: defaultIntegrationApiOver(this.ctx.api),
+			records,
+			kind: reolinkConnectionsEntryKind,
 			info: (message) => this.ctx.logger.info(message),
+			warn: (message) => this.ctx.logger.warn(message),
 			warnDevice: (message, deviceId) => this.ctx.logger.warn(message, { tags: { deviceId } })
-		}))]);
+		});
+		const registryEvidenceOf = async (id) => {
+			try {
+				const integration = await this.ctx.api.integrations.get.query({ id });
+				return {
+					originStableId: integration.originStableId,
+					info: { ...integration.info }
+				};
+			} catch (err) {
+				this.ctx.logger.warn("Reolink integration form: instance lookup failed — hub form shown", { meta: {
+					integrationId: id,
+					error: errMsg$3(err)
+				} });
+				return null;
+			}
+		};
+		const instances = buildReolinkInstances(records, {
+			onChanged: () => this.reconcileIntegrations(),
+			registryEvidenceOf
+		});
+		this.instances = instances;
+		await this.runMigrations([...defineAddonMigrations(REOLINK_MIGRATIONS, this.migrationPorts()), ...defineAddonMigrations(REOLINK_INTEGRATION_MIGRATIONS, integrationPorts)]);
 		this.wireEmailBridge();
 		const wireSleepPushResolvers = (event, via) => {
 			const data = event.data;
@@ -221602,7 +222678,11 @@ var ReolinkProviderAddon = class extends BaseDeviceProvider {
 			capability: deviceRemovalHookCapability,
 			provider: createEmailPushRemovalHook({ resync: () => this.ensureEmailBridge().sync() })
 		});
-		return regs;
+		regs.push({
+			capability: integrationInstancesCapability,
+			provider: reolinkInstancesProvider(instances, { registryEvidenceOf })
+		});
+		return { providers: regs };
 	}
 	/** What the catalogue's migration reads and writes (D987). */
 	migrationPorts() {