@camstack/addon-provider-velux 0.2.150 → 0.2.151

package/dist/addon.mjs

@@ -1,7 +1,6 @@
 import { createRequire } from "node:module";
 import { connect } from "node:tls";
 import { setImmediate as setImmediate$1 } from "timers/promises";
-import { createSocket } from "node:dgram";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -1387,7 +1386,7 @@ var _emoji$1 = `^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`;
 function emoji() {
 	return new RegExp(_emoji$1, "u");
 }
-var ipv4$1 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
+var ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
 var ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
 var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
 var cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
@@ -2062,7 +2061,7 @@ var $ZodISODuration = /*@__PURE__*/ $constructor("$ZodISODuration", (inst, def)
 	$ZodStringFormat.init(inst, def);
 });
 var $ZodIPv4 = /*@__PURE__*/ $constructor("$ZodIPv4", (inst, def) => {
-	def.pattern ?? (def.pattern = ipv4$1);
+	def.pattern ?? (def.pattern = ipv4);
 	$ZodStringFormat.init(inst, def);
 	inst._zod.bag.format = `ipv4`;
 });
@@ -5491,7 +5490,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-63gM_1JR.mjs
+//#region ../types/dist/sleep-CeyhrcOk.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7558,6 +7557,7 @@ var BaseAddon = class {
 	* a warning and falls back rather than crashing boot.
 	*/
 	state(key, schema, fallback) {
+		this._declaredStateKeys.add(key);
 		return createDurableState({
 			key,
 			schema,
@@ -7573,6 +7573,96 @@ var BaseAddon = class {
 			} })
 		});
 	}
+	/** Durable-state keys this process registered through {@link state}. */
+	_declaredStateKeys = /* @__PURE__ */ new Set();
+	/**
+	* Stale-data audit: every global-settings key this addon still declares —
+	* constructor defaults, settings-schema fields (layout containers included),
+	* durable-state keys and the root of each `secretStatePaths` entry. Answered
+	* here, in the addon's own process, so the hub keeps no copy of it.
+	*/
+	async getDeclaredSettingsKeys() {
+		return { keys: [...this.declaredKeySet()].toSorted() };
+	}
+	declaredKeySet() {
+		const keys = new Set(Object.keys(this.defaults));
+		const schema = this.globalSettingsSchema();
+		if (schema) for (const section of schema.sections) for (const key of collectFieldKeys(section.fields)) keys.add(key);
+		for (const key of this._declaredStateKeys) keys.add(key);
+		for (const path of this.secretStatePaths) {
+			const root = path.split(/[.[]/, 1)[0];
+			if (root) keys.add(root);
+		}
+		return keys;
+	}
+	/**
+	* Stale-data audit: remove stored global-settings keys the addon no longer
+	* declares, and clear the keychain values their markers held — except a value
+	* a surviving key still points at. A declared or absent key is refused.
+	*/
+	async unsetStoredSettingsKeys(keys) {
+		const settings = this._ctx?.settings;
+		const raw = this.rawSettings();
+		if (!settings || !raw) return {
+			removed: [],
+			refused: keys.map((key) => ({
+				key,
+				reason: "no settings store"
+			})),
+			secretsCleared: 0
+		};
+		let stored;
+		try {
+			stored = await raw.readAddonStore();
+		} catch (error) {
+			const reason = `store unreadable: ${error instanceof Error ? error.message : "unknown"}`;
+			return {
+				removed: [],
+				refused: keys.map((key) => ({
+					key,
+					reason
+				})),
+				secretsCleared: 0
+			};
+		}
+		const declared = this.declaredKeySet();
+		const removed = [];
+		const refused = [];
+		for (const key of keys) {
+			const base = key.split("@", 1)[0] ?? key;
+			if (declared.has(base)) refused.push({
+				key,
+				reason: "still declared by the addon"
+			});
+			else if (!(key in stored)) refused.push({
+				key,
+				reason: "not stored"
+			});
+			else removed.push(key);
+		}
+		if (removed.length === 0) return {
+			removed,
+			refused,
+			secretsCleared: 0
+		};
+		const kept = /* @__PURE__ */ new Set();
+		const held = /* @__PURE__ */ new Set();
+		for (const [key, value] of Object.entries(stored)) {
+			const target = removed.includes(key) ? held : kept;
+			for (const ref of collectSecretMarkerRefs(value)) target.add(ref);
+		}
+		const refsToClear = [...held].filter((ref) => !kept.has(ref));
+		const patch = {};
+		for (const key of removed) patch[key] = void 0;
+		await settings.writeAddonStore(patch);
+		const secretsCleared = refsToClear.length > 0 && this._ctx?.secrets ? await this._ctx.secrets.delete(refsToClear) : 0;
+		await this.resolveConfig();
+		return {
+			removed,
+			refused,
+			secretsCleared
+		};
+	}
 	/** Per-device variant of {@link state}, backed by the per-device store. */
 	deviceState(deviceId, key, schema, fallback) {
 		return createDurableState({
@@ -7843,6 +7933,21 @@ function dropPerNodeFields(fields) {
 	}
 	return kept;
 }
+function collectFieldKeys(fields) {
+	const collected = [];
+	for (const field of fields) {
+		if (field.type === "group") {
+			collected.push(...collectFieldKeys(field.fields));
+			continue;
+		}
+		if (field.type === "sub-tabs") {
+			for (const tab of field.tabs) collected.push(...collectFieldKeys(tab.fields));
+			continue;
+		}
+		if ("key" in field && typeof field.key === "string") collected.push(field.key);
+	}
+	return collected;
+}
 function collectPerNodeFieldKeys(fields) {
 	const collected = [];
 	for (const field of fields) {
@@ -16114,8 +16219,172 @@ object({
 	quantity: ReadingQuantitySchema,
 	unit: string().min(1)
 });
-/** How a leaf compares a device field to a value. Derived from the field's
-*  `kind` in `deviceManager.getWireableFields`, never hand-maintained. */
+new Set([
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle"
+	},
+	{
+		id: "animal",
+		name: "Animal"
+	},
+	{
+		id: "package",
+		name: "Package"
+	}
+].map((l) => l.id));
+var COCO_TO_MACRO = {
+	mapping: {
+		person: "person",
+		bicycle: "vehicle",
+		car: "vehicle",
+		motorcycle: "vehicle",
+		airplane: "vehicle",
+		bus: "vehicle",
+		train: "vehicle",
+		truck: "vehicle",
+		boat: "vehicle",
+		bird: "animal",
+		cat: "animal",
+		dog: "animal",
+		horse: "animal",
+		sheep: "animal",
+		cow: "animal",
+		elephant: "animal",
+		bear: "animal",
+		zebra: "animal",
+		giraffe: "animal",
+		suitcase: "package",
+		backpack: "package",
+		handbag: "package"
+	},
+	preserveOriginal: false
+};
+/**
+* WHAT a detection-shaped leaf is about: one MACRO class (person, vehicle,
+* animal, package) plus an OPTIONAL label that narrows it.
+*
+* The taxonomy is `COCO_TO_MACRO` (and `CLASS_MAP_MACRO_TARGETS`) — never a
+* second list. The label that fits depends on the macro class:
+*
+*  - `animal`  → a sub-class (`dog`, `cat`, …);
+*  - `person`  → a known face (an identity of the `face-gallery`);
+*  - `vehicle` → a plate (its text) or a sub-class (`car`, `truck`, …);
+*  - `package` → a sub-class.
+*
+* `other` exists only so a class the taxonomy does not know (a custom model's
+* `forklift`) survives the conversion of a stored recipe without widening.
+*
+* A label is decided LATE (D683): face recognition and LPR land after the
+* detection starts. The track-lifecycle `update` event carries the newly
+* resolved `label` / `plateText`, which is why a leaf with a label fires when
+* the subject GETS it — not at the first detection.
+*/
+var SubClassLabelSchema = object({
+	kind: literal("sub-class"),
+	className: string().min(1)
+});
+var IdentityLabelSchema = object({
+	kind: literal("identity"),
+	/** The `face-gallery` identity id (stable across a rename). */
+	identityId: string().min(1),
+	/** The identity's name — what a track-lifecycle event carries as `label`. */
+	name: string().min(1)
+});
+var PlateLabelSchema = object({
+	kind: literal("plate"),
+	text: string().min(1)
+});
+function macroOf$1(className) {
+	return COCO_TO_MACRO.mapping[className.toLowerCase()] ?? className.toLowerCase();
+}
+/** A sub-class label must belong to the macro it is under. */
+function subClassBelongs(macro, label) {
+	return label === void 0 || macroOf$1(label.className) === macro;
+}
+var subClassOf = (macro) => SubClassLabelSchema.refine((l) => subClassBelongs(macro, l), { message: `that class is not a kind of ${macro} in the detection taxonomy` });
+var DetectionSubjectSchema = discriminatedUnion("macro", [
+	object({
+		macro: literal("animal"),
+		label: subClassOf("animal").optional()
+	}),
+	object({
+		macro: literal("person"),
+		label: IdentityLabelSchema.optional()
+	}),
+	object({
+		macro: literal("vehicle"),
+		label: discriminatedUnion("kind", [SubClassLabelSchema.refine((l) => subClassBelongs("vehicle", l), { message: "that class is not a kind of vehicle in the detection taxonomy" }), PlateLabelSchema]).optional()
+	}),
+	object({
+		macro: literal("package"),
+		label: subClassOf("package").optional()
+	}),
+	object({
+		macro: literal("other"),
+		className: string().min(1)
+	})
+]);
+/**
+* The subject of a PARKED object. The stationary registry's event carries a
+* class and a zone, no face and no plate — an identity or plate label there
+* could never match, so the schema refuses it instead of letting it sit dead.
+*/
+var StationarySubjectSchema = DetectionSubjectSchema.refine((s) => s.macro === "other" || s.label === void 0 || s.label.kind === "sub-class", { message: "a parked object carries no face or plate — only a class can narrow it" });
+/**
+* A stored class string as a subject: a macro name stays a macro; a raw class
+* the taxonomy files under a macro becomes that macro plus the sub-class label
+* (`dog` → animal / dog); anything else is `other`, kept verbatim.
+*/
+function subjectFromClassName(className) {
+	const name = className.trim().toLowerCase();
+	const macro = COCO_TO_MACRO.mapping[name];
+	if (new Set(Object.values(COCO_TO_MACRO.mapping)).has(name)) return macroOnly(name);
+	if (macro === void 0) return {
+		macro: "other",
+		className
+	};
+	const label = {
+		kind: "sub-class",
+		className: name
+	};
+	switch (macro) {
+		case "animal": return {
+			macro: "animal",
+			label
+		};
+		case "vehicle": return {
+			macro: "vehicle",
+			label
+		};
+		case "package": return {
+			macro: "package",
+			label
+		};
+		default: return {
+			macro: "other",
+			className
+		};
+	}
+}
+function macroOnly(macro) {
+	switch (macro) {
+		case "animal": return { macro: "animal" };
+		case "person": return { macro: "person" };
+		case "vehicle": return { macro: "vehicle" };
+		case "package": return { macro: "package" };
+		default: return {
+			macro: "other",
+			className: macro
+		};
+	}
+}
+/** How a state leaf compares a device field to a value. Derived from the
+*  field's `kind` in `deviceManager.getWireableFields`, never hand-maintained. */
 var AutomationConditionOperatorSchema = _enum([
 	"eq",
 	"ne",
@@ -16126,12 +16395,76 @@ var AutomationConditionOperatorSchema = _enum([
 	"contains",
 	"in"
 ]);
-var AutomationConditionLeafSchema = object({
-	kind: literal("condition"),
+/**
+* D8 compliance, and it is the reason a "becomes" leaf is not merely an event
+* subscription: it evaluates against the **state mirror**, which is reconciled,
+* and an event only WAKES the evaluation. A dropped event therefore DELAYS a
+* fire; it does not lose it.
+*/
+var DeviceBecomesLeafSchema = object({
+	kind: literal("device-becomes"),
+	deviceId: number().int().nonnegative(),
+	cap: string().min(1),
+	fieldPath: string().min(1),
+	/** Fire when the field takes this value. Omit to fire on any change. */
+	becomes: union([
+		string(),
+		number(),
+		boolean()
+	]).optional(),
+	/** Only on a CHANGE of value, not on every re-report. */
+	edge: boolean().optional(),
+	/** The new value must hold this long before it counts. */
+	forMs: number().int().min(0).max(864e5).optional(),
+	/** Collapse a burst into one occurrence. */
+	debounceMs: number().int().min(0).max(6e5).optional()
+});
+var DeviceEventLeafSchema = object({
+	kind: literal("device-event"),
+	/** An `EventCategory` value. */
+	category: string().min(1),
+	deviceId: number().int().nonnegative().optional()
+});
+var ScheduleLeafSchema = object({
+	kind: literal("schedule"),
+	cron: string().min(1).max(120)
+});
+var ManualLeafSchema = object({ kind: literal("manual") });
+var IntervalLeafSchema = object({
+	kind: literal("interval"),
+	minutes: number().int().min(1).max(1440)
+});
+var DetectionLeafSchema = object({
+	kind: literal("detection"),
+	/** One macro class each, optionally narrowed by a label; a track of any listed subject fires. */
+	subjects: array(DetectionSubjectSchema).min(1),
+	deviceIds: array(number().int().nonnegative()).min(1),
+	/** The track must have visited at least one of these zones. */
+	zones: array(string().min(1)).min(1).optional(),
+	/** Best-so-far confidence the track must reach. */
+	minScore: number().min(0).max(1).optional()
+});
+var StationaryLeafSchema = object({
+	kind: literal("stationary"),
+	deviceIds: array(number().int().nonnegative()).min(1),
+	subjects: array(StationarySubjectSchema).min(1).optional(),
+	zones: array(string().min(1)).min(1).optional(),
+	/** `appeared`: it became parked. `departed`: the registry retired it. */
+	phase: _enum(["appeared", "departed"])
+});
+/** "is": one device field compared to one value, NOW. */
+var DeviceIsLeafSchema = object({
+	kind: literal("device-is"),
 	deviceId: number().int().nonnegative(),
 	cap: string().min(1),
 	fieldPath: string().min(1),
 	operator: AutomationConditionOperatorSchema,
+	/**
+	* The value. A number on a quantity field is stored in the field's base unit
+	* (D944); a quantity value is the WRITE form, which the save boundary
+	* replaces with the converted number and `unit`. A leaf that still carries
+	* one is never evaluated (it fails).
+	*/
 	value: union([
 		string(),
 		number(),
@@ -16139,24 +16472,26 @@ var AutomationConditionLeafSchema = object({
 		array(union([string(), number()])),
 		QuantityValueSchema
 	]),
+	/** The unit the person picked for `value` (display only; `value` is in the base unit). */
 	unit: string().min(1).optional()
 });
-var AutomationConditionStationaryPresentSchema = object({
+/**
+* True when the camera currently has a PARKED object matching `subjects` in at
+* least one of `zones`. Reads the zone-analytics snapshot through the same
+* mirror as every other state leaf, so a dropped event never decides it (D49).
+*/
+var StationaryPresentLeafSchema = object({
 	kind: literal("stationary-present"),
 	deviceId: number().int().nonnegative(),
-	/** Class names; a macro class matches every raw class that maps to it. */
-	classes: array(string().min(1)).min(1).optional(),
-	/** The parked object must be in at least one of these zones. */
+	subjects: array(StationarySubjectSchema).min(1).optional(),
 	zones: array(string().min(1)).min(1).optional()
 });
 /**
-* The expression leaf, declared as a plain object rather than an intersection
-* with {@link ExpressionSourceSchema}: a discriminated union has to be able to
-* read `kind` off each option, and an intersection hides it. The author-time
-* validation is the SAME function `ExpressionSourceSchema` runs, so the two
-* cannot drift — an expression that one accepts, the other accepts.
+* The escape hatch: the bounded expression engine over named device bindings.
+* Declared as a plain object so a discriminated union can read `kind`; the
+* author-time validation is the SAME function `ExpressionSourceSchema` runs.
 */
-var AutomationConditionExpressionSchema = object({
+var ExpressionLeafSchema = object({
 	kind: literal("expression"),
 	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
 	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
@@ -16168,55 +16503,62 @@ var AutomationConditionExpressionSchema = object({
 		path: ["expr"]
 	});
 });
-var AutomationConditionSchema = lazy(() => discriminatedUnion("kind", [
+var AutomationWhenSchema = lazy(() => discriminatedUnion("kind", [
 	object({
 		kind: literal("all"),
-		children: array(AutomationConditionSchema)
+		children: array(AutomationWhenSchema)
 	}),
 	object({
 		kind: literal("any"),
-		children: array(AutomationConditionSchema)
+		children: array(AutomationWhenSchema)
 	}),
 	object({
 		kind: literal("not"),
-		child: AutomationConditionSchema
+		child: AutomationWhenSchema
 	}),
-	AutomationConditionLeafSchema,
-	AutomationConditionExpressionSchema,
-	AutomationConditionStationaryPresentSchema
+	DeviceBecomesLeafSchema,
+	DeviceEventLeafSchema,
+	ScheduleLeafSchema,
+	ManualLeafSchema,
+	IntervalLeafSchema,
+	DetectionLeafSchema,
+	StationaryLeafSchema,
+	DeviceIsLeafSchema,
+	StationaryPresentLeafSchema,
+	ExpressionLeafSchema
 ]));
 /**
-* What starts a run.
-*
-* D8 compliance, and it is the reason `device-state` is not merely an event
-* subscription: the trigger evaluates against the **state mirror**, which is
-* reconciled, and an event only WAKES the evaluation. A dropped event therefore
-* DELAYS a trigger; it does not lose it. `schedule` uses `croner` — the one
-* already in the repo — because `setInterval(24h)` drifts and "at 23:30" does
-* not.
-*/
-var AutomationTriggerSchema = discriminatedUnion("kind", [
+* The recipe shape before the single `when` tree: a flat list of triggers
+* (OR'd, each an instant) and an optional condition tree. Stored recipes —
+* the `AUTOMATION_RECIPE` literal of every block saved so far, and whatever an
+* older client still posts — are in this shape, so it stays READABLE here, and
+* {@link convertLegacyRecipe} turns it into the new one, losslessly and one
+* way. Nothing writes this shape any more.
+*
+*   `{ triggers: [t1…tn], conditions?: C }`
+*      → `when = all(any(t1…tn), C)`, or `any(t1…tn)` without `C`;
+*        a single trigger is not wrapped in `any`.
+*   a `condition` leaf → a `device-is` leaf (the "is" verb);
+*   a `device-state` trigger → a `device-becomes` leaf (the "becomes" verb);
+*   `classes: ['dog']` → the macro `animal` with the label `dog`.
+*/
+var LegacyTriggerSchema = discriminatedUnion("kind", [
 	object({
 		kind: literal("device-state"),
 		deviceId: number().int().nonnegative(),
 		cap: string().min(1),
 		fieldPath: string().min(1),
-		/** Fire when the field takes this value. Omit to fire on any change. */
 		becomes: union([
 			string(),
 			number(),
 			boolean()
 		]).optional(),
-		/** Only on a CHANGE of value, not on every re-report. */
 		edge: boolean().optional(),
-		/** The condition must hold this long before the run starts. */
 		forMs: number().int().min(0).max(864e5).optional(),
-		/** Collapse a burst into one run. */
 		debounceMs: number().int().min(0).max(6e5).optional()
 	}),
 	object({
 		kind: literal("device-event"),
-		/** An `EventCategory` value. */
 		category: string().min(1),
 		deviceId: number().int().nonnegative().optional()
 	}),
@@ -16227,25 +16569,16 @@ var AutomationTriggerSchema = discriminatedUnion("kind", [
 	object({ kind: literal("manual") }),
 	object({
 		kind: literal("detection"),
-		/** Class names. A macro class (`animal`, `vehicle`, `person`, `package`)
-		*  matches every raw class that maps to it; any other name matches
-		*  exactly. */
 		classes: array(string().min(1)).min(1),
 		deviceIds: array(number().int().nonnegative()).min(1),
-		/** The track must have visited at least one of these zones. */
 		zones: array(string().min(1)).min(1).optional(),
-		/** Best-so-far confidence the track must reach. */
 		minScore: number().min(0).max(1).optional()
 	}),
 	object({
 		kind: literal("stationary"),
 		deviceIds: array(number().int().nonnegative()).min(1),
-		/** Class names; a macro class matches like the detection trigger. */
 		classes: array(string().min(1)).min(1).optional(),
-		/** The parked object must be in at least one of these zones. */
 		zones: array(string().min(1)).min(1).optional(),
-		/** `appeared`: it became parked. `departed`: the registry retired it.
-		*  The vocabulary of `PipelineAnalyticsStationaryChanged`. */
 		phase: _enum(["appeared", "departed"])
 	}),
 	object({
@@ -16253,6 +16586,143 @@ var AutomationTriggerSchema = discriminatedUnion("kind", [
 		minutes: number().int().min(1).max(1440)
 	})
 ]);
+var LegacyConditionLeafSchema = object({
+	kind: literal("condition"),
+	deviceId: number().int().nonnegative(),
+	cap: string().min(1),
+	fieldPath: string().min(1),
+	operator: AutomationConditionOperatorSchema,
+	value: union([
+		string(),
+		number(),
+		boolean(),
+		array(union([string(), number()])),
+		QuantityValueSchema
+	]),
+	unit: string().min(1).optional()
+});
+var LegacyStationaryPresentSchema = object({
+	kind: literal("stationary-present"),
+	deviceId: number().int().nonnegative(),
+	classes: array(string().min(1)).min(1).optional(),
+	zones: array(string().min(1)).min(1).optional()
+});
+var LegacyExpressionSchema = object({
+	kind: literal("expression"),
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), ExpressionBindingSourceSchema)
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
+var LegacyConditionSchema = lazy(() => discriminatedUnion("kind", [
+	object({
+		kind: literal("all"),
+		children: array(LegacyConditionSchema)
+	}),
+	object({
+		kind: literal("any"),
+		children: array(LegacyConditionSchema)
+	}),
+	object({
+		kind: literal("not"),
+		child: LegacyConditionSchema
+	}),
+	LegacyConditionLeafSchema,
+	LegacyExpressionSchema,
+	LegacyStationaryPresentSchema
+]));
+function convertTrigger(trigger) {
+	switch (trigger.kind) {
+		case "device-state": return {
+			...trigger,
+			kind: "device-becomes"
+		};
+		case "detection": {
+			const { classes, ...rest } = trigger;
+			return {
+				...rest,
+				subjects: classes.map(subjectFromClassName)
+			};
+		}
+		case "stationary": {
+			const { classes, ...rest } = trigger;
+			return {
+				...rest,
+				...classes === void 0 ? {} : { subjects: classes.map(subjectFromClassName) }
+			};
+		}
+		default: return trigger;
+	}
+}
+/** An old condition tree as a `when` subtree: `condition` → "is", classes → subjects. */
+function convertLegacyCondition(condition) {
+	switch (condition.kind) {
+		case "condition": return {
+			...condition,
+			kind: "device-is"
+		};
+		case "stationary-present": {
+			const { classes, ...rest } = condition;
+			return {
+				...rest,
+				...classes === void 0 ? {} : { subjects: classes.map(subjectFromClassName) }
+			};
+		}
+		case "expression": return condition;
+		case "not": return {
+			kind: "not",
+			child: convertLegacyCondition(condition.child)
+		};
+		case "all":
+		case "any": return {
+			kind: condition.kind,
+			children: condition.children.map(convertLegacyCondition)
+		};
+	}
+}
+/** `all(any(t1…tn), C)`, or `any(t1…tn)`; a single trigger is not wrapped in `any`. */
+function convertLegacyWhen(half) {
+	const leaves = half.triggers.map(convertTrigger);
+	const first = leaves[0];
+	const triggers = leaves.length === 1 && first !== void 0 ? first : {
+		kind: "any",
+		children: leaves
+	};
+	if (half.conditions === void 0) return triggers;
+	return {
+		kind: "all",
+		children: [triggers, convertLegacyCondition(half.conditions)]
+	};
+}
+/**
+* The automation RECIPE — what a visually-authored automation is, before it
+* becomes code.
+*
+* This is the data half of `docs/design/2026-08-08-automation-scripts-custom-devices.md`
+* Phase 6. A recipe is not an engine and never evaluates anything: it is a
+* declarative description that {@link generateAutomationBlock} compiles to the
+* TypeScript of an ordinary core block. There is therefore no second rule
+* engine, no second store and no second runtime — the block runner is the
+* runtime, `core_blocks` is the store (§2.1).
+*
+* Two parts:
+*
+*  - **`when`** — ONE tree (`./when.ts`) of all/any/not over event leaves
+*    (instants) and state leaves (durations). It replaces the flat trigger list
+*    plus the separate condition tree; the firing rule is in that file and in
+*    ADR "one tree".
+*  - **Actions** — `NcRuleActionSchema`'s two steps, plus the `{kind:'code'}`
+*    fragment of §3.2.2. See {@link AutomationActionSchema} for the ONE place
+*    this had to diverge from "verbatim", and why.
+*
+* A recipe stored in the old shape (`triggers` + `conditions`) still LOADS:
+* {@link AutomationRecipeSchema} (the parse-anywhere schema) converts it on parse. Nothing writes it.
+*/
 /**
 * One action step.
 *
@@ -16355,69 +16825,49 @@ var AutomationRunModeSchema = discriminatedUnion("mode", [
 		minutes: number().int().min(1).max(1440)
 	})
 ]);
-var AutomationRecipeSchema = object({
-	triggers: array(AutomationTriggerSchema),
-	conditions: AutomationConditionSchema.optional(),
+var CurrentAutomationRecipeSchema = object({
+	when: AutomationWhenSchema,
 	actions: array(AutomationActionSchema),
 	runMode: AutomationRunModeSchema.optional(),
 	/** How many run traces the automation keeps (default {@link DEFAULT_TRACE_KEEP}). */
 	keepTraces: number().int().min(1).max(100).optional()
 });
-new Set([
-	{
-		id: "person",
-		name: "Person"
-	},
-	{
-		id: "vehicle",
-		name: "Vehicle"
-	},
-	{
-		id: "animal",
-		name: "Animal"
-	},
-	{
-		id: "package",
-		name: "Package"
-	}
-].map((l) => l.id));
-var COCO_TO_MACRO = {
-	mapping: {
-		person: "person",
-		bicycle: "vehicle",
-		car: "vehicle",
-		motorcycle: "vehicle",
-		airplane: "vehicle",
-		bus: "vehicle",
-		train: "vehicle",
-		truck: "vehicle",
-		boat: "vehicle",
-		bird: "animal",
-		cat: "animal",
-		dog: "animal",
-		horse: "animal",
-		sheep: "animal",
-		cow: "animal",
-		elephant: "animal",
-		bear: "animal",
-		zebra: "animal",
-		giraffe: "animal",
-		suitcase: "package",
-		backpack: "package",
-		handbag: "package"
-	},
-	preserveOriginal: false
-};
+/** A recipe as it was stored before the single tree. Read-only: nothing writes this. */
+var LegacyAutomationRecipeSchema = object({
+	triggers: array(LegacyTriggerSchema),
+	conditions: LegacyConditionSchema.optional(),
+	actions: array(AutomationActionSchema),
+	runMode: AutomationRunModeSchema.optional(),
+	keepTraces: number().int().min(1).max(100).optional()
+});
+/** The old shape as the new one, lossless. */
+function convertLegacyRecipe(legacy) {
+	const { triggers, conditions, ...rest } = legacy;
+	return {
+		when: convertLegacyWhen({
+			triggers,
+			conditions
+		}),
+		...rest
+	};
+}
+/**
+* Where recipes are PARSED (the core-blocks cap, the MCP tool, the literal a
+* saved block carries): the new shape as it is, or the old shape converted to
+* it. The output type is always the new one.
+*/
+var AutomationRecipeSchema = union([CurrentAutomationRecipeSchema, LegacyAutomationRecipeSchema.transform(convertLegacyRecipe)]);
 new Set(Object.values(COCO_TO_MACRO.mapping));
 /**
 * Run traces — what an automation (or, later, an Action run) DID, node by node,
 * so the editor can paint every block green or red with its reason.
 *
-* A trace is data, not a log: it covers the WHOLE tree — the trigger stage,
-* every condition node (containers and leaves, including the ones a
-* short-circuit never reached), the run-mode verdict and every action step —
-* each addressed by a stable path (`conditions.0.1`, `actions.2`, or `steps.N`
-* for an Action run). Skipped
+* A trace is data, not a log: it covers the WHOLE tree — the event leaf that
+* fired, every node of the `when` tree (containers and leaves, including the
+* ones a short-circuit never reached), the run-mode verdict and every action
+* step — each addressed by a stable path (`when.0.1`, `actions.2`, or `steps.N`
+* for an Action run). Traces written before the single tree carry
+* `conditions.*` paths and still parse. Skipped
 * evaluations are traced too, and identical consecutive skips collapse into a
 * repeat count so a trigger that fails every 5 minutes cannot flush real runs.
 *
@@ -16449,6 +16899,8 @@ var TraceNodeOutcomeSchema = _enum([
 ]);
 var AutomationTriggerTraceSchema = object({
 	kind: string().min(1),
+	/** The event leaf that fired (`when`, `when.0.1`); absent on traces written before the single tree. */
+	path: string().min(1).optional(),
 	outcome: _enum(["pass", "fail"]),
 	/** Why an event was rejected ("class person not in [dog]") or what fired. */
 	reason: string(),
@@ -16456,15 +16908,23 @@ var AutomationTriggerTraceSchema = object({
 	vars: record(string(), TraceValueSchema)
 });
 var AutomationConditionTraceNodeSchema = object({
-	/** `conditions` for the root, `conditions.<i>` for its i-th child, … */
+	/** `when` for the root, `when.<i>` for its i-th child, … (`conditions…` on an old trace). */
 	path: string().min(1),
 	kind: _enum([
 		"all",
 		"any",
 		"not",
 		"condition",
+		"device-is",
 		"expression",
-		"stationary-present"
+		"stationary-present",
+		"device-becomes",
+		"device-event",
+		"schedule",
+		"interval",
+		"manual",
+		"detection",
+		"stationary"
 	]),
 	outcome: TraceNodeOutcomeSchema,
 	reason: string(),
@@ -16498,6 +16958,12 @@ var AutomationStepTraceSchema = object({
 	deviceId: number().int().optional(),
 	startedAt: number().optional(),
 	endedAt: number().optional(),
+	/**
+	* The parameters the step SENT, after `{{vars.x}}` substitution — what the
+	* device was actually asked. Bounded like trigger `vars`; a secret parameter
+	* is shown as {@link REDACTED_ARG}. Absent on traces written before it existed.
+	*/
+	args: record(string(), TraceValueSchema).optional(),
 	outcome: _enum([
 		"ok",
 		"error",
@@ -17247,6 +17713,23 @@ method(object({
 	addonId: string(),
 	nodeId: string().optional()
 }), SettingsSchemaWithValuesSchema.nullable()), method(object({
+	addonId: string(),
+	nodeId: string().optional()
+}), object({ keys: array(string()) }).nullable(), { auth: "admin" }), method(object({
+	addonId: string(),
+	nodeId: string().optional(),
+	keys: array(string())
+}), object({
+	removed: array(string()),
+	refused: array(object({
+		key: string(),
+		reason: string()
+	})),
+	secretsCleared: number()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	addonId: string(),
 	deviceId: number(),
 	nodeId: string().optional()
@@ -21276,6 +21759,8 @@ var StorageKindSchema = object({
 		"orphaned",
 		"dropped"
 	]),
+	/** An owner declared this kind since the engine started. */
+	declaredThisBoot: boolean(),
 	/** `null` when the caller asked for no counts (`counts: false`). */
 	rows: number().int().nonnegative().nullable(),
 	/** Rows x the average size of a sample; null for an empty kind. */
@@ -21287,6 +21772,51 @@ var StorageKindSchema = object({
 	/** The whole declaration, secret paths and entry descriptor included (the entries service builds its handle from it). */
 	declaration: RecordKindDeclarationSchema
 });
+_enum([
+	"orphaned",
+	"stale",
+	"unknown"
+]);
+/** A record kind nobody declared since its owner started, or whose owner is gone. */
+var StaleKindFindingSchema = object({
+	owner: string(),
+	kind: string(),
+	/** `unknown`: the owner could not be judged (not running, or its state unreadable) - never dropped. */
+	verdict: _enum(["orphaned", "unknown"]),
+	reason: string(),
+	rows: number().int().nonnegative().nullable(),
+	/** local-auth's tables are never dropped by this audit. */
+	protected: boolean()
+});
+/** A stored global-settings key the running addon no longer declares. */
+var StaleSettingsKeyFindingSchema = object({
+	addonId: string(),
+	/** The stored key as written, a per-node `<key>@<nodeId>` suffix included. */
+	key: string(),
+	/**
+	* Keychain refs whose ONLY marker sits under this key: in use by stale data,
+	* not orphans yet. Removing the key releases them.
+	*/
+	secretRefs: array(string())
+});
+/** An addon the audit could not judge, with the reason. Never reported as stale. */
+var StaleUnknownSchema = object({
+	subject: string(),
+	reason: string()
+});
+var StaleDataReportSchema = object({
+	/** Epoch ms of the last finished scan; `null` before the first. */
+	scannedAt: number().nullable(),
+	scanning: boolean(),
+	trigger: _enum([
+		"boot",
+		"interval",
+		"manual"
+	]).nullable(),
+	kinds: array(StaleKindFindingSchema),
+	settingsKeys: array(StaleSettingsKeyFindingSchema),
+	unknown: array(StaleUnknownSchema)
+});
 method(object({ ownerPrefix: string().min(1).optional() }), object({ tables: array(StorageTableSchema) }), { auth: "admin" }), method(object({
 	owner: string().min(1).optional(),
 	/** `false` skips the per-kind row count (a catalog read only). Default true. */
@@ -21294,7 +21824,30 @@ method(object({ ownerPrefix: string().min(1).optional() }), object({ tables: arr
 }), object({ kinds: array(StorageKindSchema) }), { auth: "admin" }), method(RecordQueryInputSchema.extend({
 	owner: string().min(1),
 	kind: RecordKindNameSchema
-}), RecordQueryResultSchema, { auth: "admin" });
+}), RecordQueryResultSchema, { auth: "admin" }), method(object({}), StaleDataReportSchema, { auth: "admin" }), method(object({}), StaleDataReportSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	owner: string().min(1),
+	kind: RecordKindNameSchema
+}), object({
+	deleted: number().int().nonnegative(),
+	secretsReleased: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({
+	addonId: string().min(1),
+	key: string().min(1)
+}), object({
+	removed: boolean(),
+	secretsCleared: number().int().nonnegative()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+});
 /**
 * record-entries - the ONE admin surface for every list of user-created entries
 * (D881): notification targets, brokers, LLM profiles, anything an addon
@@ -21433,6 +21986,12 @@ method(object({
 }), method(object({ deviceId: number().int() }), object({ refs: array(string()).readonly() }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	refs: RefListSchema,
+	onBehalfOf: string().min(1)
+}), object({ released: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({}), array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }), method(object({}), KeychainStateSchema, { auth: "admin" });
 /**
 * device-history — the ONE mechanism for numeric history (D850).
@@ -22335,7 +22894,9 @@ var DiscoveredChildDeviceSchema = lazy(() => object({
 	/** Upstream-system identity + rendering hints for the candidate. */
 	sourceInfo: SourceInfoSchema.optional(),
 	/** Nested entity-children for accordion preview — integrations populate, Hubs omit. */
-	children: array(DiscoveredChildDeviceSchema).readonly().optional()
+	children: array(DiscoveredChildDeviceSchema).readonly().optional(),
+	/** `childNativeId` of the gateway candidate in the same list this device sits behind. */
+	parentStableId: string().optional()
 }));
 /**
 * Status block — populated by the integration after each
@@ -42718,6 +43279,79 @@ object({
 	metadata: record(string(), unknown()).optional()
 });
 /**
+* HOW a provider can be found on the network. The provider only DECLARES the
+* mode; the `local-network` scan engine runs it once for every provider that
+* asked (one multicast browse, one host sweep) and hands the raw hits back to
+* `classifyDiscoveryHits`. A provider never opens a discovery socket itself,
+* except through a `custom` mode.
+*/
+var DiscoveryModeSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("mdns"),
+		/** DNS-SD service type, e.g. `_esphomelib._tcp`. */
+		serviceType: string().min(1),
+		/** Regular expression an instance name must match (case-insensitive). */
+		instancePattern: string().optional()
+	}),
+	object({
+		kind: literal("ws-discovery"),
+		/** Probe types (e.g. `dn:NetworkVideoTransmitter`); omitted = any device. */
+		types: array(string()).optional()
+	}),
+	object({
+		kind: literal("ssdp"),
+		searchTarget: string().min(1)
+	}),
+	object({
+		kind: literal("udp-broadcast"),
+		port: number().int().min(1).max(65535),
+		payloadHex: string().regex(/^([0-9a-fA-F]{2})*$/),
+		/** Port replies arrive on, when the device answers somewhere other than the source port. */
+		listenPort: number().int().min(1).max(65535).optional()
+	}),
+	object({
+		kind: literal("http-probe"),
+		port: number().int().min(1).max(65535),
+		path: string().startsWith("/"),
+		method: _enum(["GET", "POST"]).default("GET"),
+		bodyText: string().optional(),
+		contentType: string().optional(),
+		tls: boolean().default(false),
+		/** Status codes that count as a hit. Omitted = any HTTP answer. */
+		acceptStatus: array(number().int()).optional()
+	}),
+	object({
+		kind: literal("custom"),
+		/** Why the engine cannot do it (an allowlisted exception, e.g. a vendor UDP protocol). */
+		reason: string().min(1)
+	})
+]);
+/** What the engine saw on the wire for ONE declared mode; the provider classifies it. */
+var DiscoveryHitSchema = object({
+	/** Index into the provider's own `getDiscoveryModes()` array. */
+	modeIndex: number().int().min(0),
+	host: string(),
+	port: number().int(),
+	http: object({
+		status: number().int(),
+		headers: record(string(), string()),
+		/** At most 16 KiB. */
+		bodyText: string()
+	}).optional(),
+	mdns: object({
+		instance: string(),
+		host: string(),
+		port: number().int(),
+		txt: record(string(), string())
+	}).optional(),
+	udp: object({ payloadHex: string() }).optional(),
+	wsd: object({
+		xaddrs: array(string()),
+		types: array(string()),
+		scopes: array(string())
+	}).optional()
+});
+/**
 * Candidate handed back from discovery and accepted by
 * `adoptDiscoveredDevice`. Shape mirrors the in-process
 * `DiscoveredDevice` interface used by `DeviceDiscovery`.
@@ -42752,7 +43386,17 @@ var DiscoveryCandidateSchema = object({
 	/** Numeric id of the device this candidate was matched to. Set with `alreadyOnboarded`. */
 	onboardedDeviceId: number().optional(),
 	/** Operator-facing name of the matched device, so the UI can say WHICH one it is. */
-	onboardedName: string().optional()
+	onboardedName: string().optional(),
+	/**
+	* This candidate is an INTEGRATION to set up (a gateway, a hub, a controller),
+	* not a device to adopt. Replaces the `prefilledConfig.setupIntegration` marker,
+	* which is still read for one release.
+	*/
+	setupIntegration: boolean().optional(),
+	/** `stableId` of the gateway candidate this device was found BEHIND. */
+	parentStableId: string().optional(),
+	/** `false` = shown for context but not pickable. Default true. */
+	selectable: boolean().optional()
 });
 /**
 * Flat device summary returned by `createDevice` / `adoptDiscoveredDevice`.
@@ -42849,6 +43493,24 @@ var deviceProviderCapability = {
 			auth: "admin"
 		}),
 		/**
+		* How this provider is found on the network. `[]` = the provider has no
+		* declarative mode and keeps answering `discoverDevices` itself.
+		*/
+		getDiscoveryModes: method(object({}), array(DiscoveryModeSchema)),
+		/**
+		* Turn the engine's raw hits into candidates. The provider may make
+		* follow-up UNICAST requests to a hit host (an authenticated call, an
+		* identity check) and never sweeps a subnet. `params` is the per-scan form
+		* from `getDiscoveryParamsSchema`.
+		*/
+		classifyDiscoveryHits: method(object({
+			hits: array(DiscoveryHitSchema),
+			params: record(string(), unknown()).optional()
+		}), array(DiscoveryCandidateSchema), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
 		* Optional form schema (`ConfigUISchema`) for the EXTRA per-scan inputs a
 		* provider accepts (e.g. Gree's broadcast address for a different subnet).
 		* `null` when the provider takes no extra scan params — the generic
@@ -43613,17 +44275,23 @@ method(object({
 }), method(object({}), object({ providers: array(object({
 	addonId: string(),
 	label: string()
-})).readonly() }), { auth: "admin" }), method(object({}), object({ groups: array(object({
-	addonId: string(),
-	label: string(),
-	candidates: array(DiscoveryCandidateSchema).readonly(),
-	error: string().nullable()
-})).readonly() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
+})).readonly() }), { auth: "admin" }), method(
+	/** `subnets`: extra CIDRs for THIS scan, on top of the hub's own and the saved list. */
+	object({ subnets: array(string()).optional() }),
+	object({ groups: array(object({
+		addonId: string(),
+		label: string(),
+		candidates: array(DiscoveryCandidateSchema).readonly(),
+		error: string().nullable()
+	})).readonly() }),
+	{
+		kind: "mutation",
+		auth: "admin"
+	}
+), method(object({
 	addonId: string(),
-	params: record(string(), unknown()).optional()
+	params: record(string(), unknown()).optional(),
+	subnets: array(string()).optional()
 }), object({ candidates: array(DiscoveryCandidateSchema).readonly() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -62965,7 +63633,9 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 	id: string(),
 	settings: record(string(), unknown()),
 	/** Keys the form's schema declares secret (by type) — keychain-stored (D787). */
-	secretKeys: array(string()).optional()
+	secretKeys: array(string()).optional(),
+	/** The integration's own addon applies the change in-process and asks the hub not to respawn it. */
+	skipRestart: boolean().optional()
 }), object({ success: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -63593,6 +64263,39 @@ var TlsStatusSchema = object({
 		hasCa: boolean()
 	}).nullable()
 });
+/** One provider's ask of the scan engine: the modes it declared. */
+var ScanRequestSchema = object({
+	providerId: string().min(1),
+	modes: array(DiscoveryModeSchema)
+});
+var ScanErrorSchema = object({
+	/** Absent for a failure that is the scan's own (a bad subnet, a socket that would not open). */
+	providerId: string().optional(),
+	/** The mode family that failed (`mdns`, `http-probe`, …). */
+	mode: string().optional(),
+	message: string()
+});
+/** What one scan did, per mode family; the engine logs the same numbers once. */
+var ScanStatsSchema = object({
+	hostsProbed: number().int(),
+	hits: number().int(),
+	timeouts: number().int(),
+	byMode: record(string(), object({
+		probed: number().int(),
+		hits: number().int(),
+		timeouts: number().int()
+	}))
+});
+var ScanNetworkResultSchema = object({
+	hits: array(object({
+		providerId: string(),
+		hit: DiscoveryHitSchema
+	})),
+	/** CIDRs actually covered: the hub's own /24s, the saved list and the per-call list. */
+	subnetsScanned: array(string()),
+	errors: array(ScanErrorSchema),
+	stats: ScanStatsSchema
+});
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
 	/**
 	* LEGACY HINT — do not send from new code. Kept optional so clients
@@ -63647,6 +64350,16 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 }), method(_void(), object({ pem: string() })), method(_void(), TlsStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	requests: array(ScanRequestSchema),
+	subnets: array(string()).optional()
+}), ScanNetworkResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 9e4
+}), method(_void(), object({ subnets: array(string()) }), { auth: "admin" }), method(object({ subnets: array(string()) }), object({ subnets: array(string()) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(_void(), TlsStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -73255,6 +73968,17 @@ var BaseDeviceProvider = class extends BaseAddon {
 	async discoverDevices(_input) {
 		return [];
 	}
+	/**
+	* How the scan engine finds this provider. Default `[]`: the provider is
+	* not migrated and keeps answering `discoverDevices` itself.
+	*/
+	async getDiscoveryModes() {
+		return [];
+	}
+	/** Turn the scan engine's raw hits into candidates. Default: none. */
+	async classifyDiscoveryHits(_input) {
+		return [];
+	}
 	/** Extra per-scan input form (e.g. a broadcast address for another subnet).
 	*  Null = no extra params. Override in providers that support scoped scans. */
 	async getDiscoveryParamsSchema() {
@@ -74123,6 +74847,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"addonSettings.getDeclaredSettingsKeys": {
+		capName: "addon-settings",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"addonSettings.getDeviceSettings": {
 		capName: "addon-settings",
 		capScope: "system",
@@ -74144,6 +74875,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"addonSettings.unsetStoredSettingsKeys": {
+		capName: "addon-settings",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"addonSettings.updateDeviceSettings": {
 		capName: "addon-settings",
 		capScope: "system",
@@ -76559,6 +77297,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"deviceProvider.classifyDiscoveryHits": {
+		capName: "device-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"deviceProvider.createDevice": {
 		capName: "device-provider",
 		capScope: "system",
@@ -76587,6 +77332,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"deviceProvider.getDiscoveryModes": {
+		capName: "device-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"deviceProvider.getDiscoveryParamsSchema": {
 		capName: "device-provider",
 		capScope: "system",
@@ -77364,6 +78116,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"keychain.releaseRecordRefs": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"keychain.resolve": {
 		capName: "keychain",
 		capScope: "system",
@@ -77784,6 +78543,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"localNetwork.getScanSubnets": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"localNetwork.getTlsStatus": {
 		capName: "local-network",
 		capScope: "system",
@@ -77833,6 +78599,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"localNetwork.scanNetwork": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"localNetwork.setAddressRole": {
 		capName: "local-network",
 		capScope: "system",
@@ -77854,6 +78627,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"localNetwork.setScanSubnets": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"localNetwork.setViewerEndpoints": {
 		capName: "local-network",
 		capScope: "system",
@@ -82075,6 +82855,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"storageAdmin.dropOrphanedKind": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
 	"storageAdmin.listKinds": {
 		capName: "storage-admin",
 		capScope: "system",
@@ -82096,6 +82883,27 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"storageAdmin.scanStaleData": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"storageAdmin.staleDataReport": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"storageAdmin.unsetStaleSettingsKey": {
+		capName: "storage-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"storageEvictable.evict": {
 		capName: "storage-evictable",
 		capScope: "system",
@@ -100918,79 +101726,18 @@ function setIntegrationDevicesOnline(devices, integrationId, online) {
 }
 //#endregion
 //#region src/velux-gateway-discovery.ts
-/** `prefilledConfig` flag: the scan opens the integration form instead of adopting a device. */
-var VELUX_SETUP_INTEGRATION_KEY = "setupIntegration";
-/** Top bit of the question class: ask for a unicast reply (RFC 6762). */
-var MDNS_QU_CLASS = 32769;
 /** The KLF-200 announces itself as an `_http._tcp` service named `VELUX_KLF_<id>`. */
-var VELUX_MDNS_SERVICE = "_http._tcp.local";
+var VELUX_MDNS_SERVICE = "_http._tcp";
 var VELUX_GATEWAY_NAME_PREFIX = "VELUX_KLF";
-var VELUX_DISCOVERY_TIMEOUT_MS = 1500;
-var MDNS_PORT = 5353;
-var MDNS_ADDRESS = "224.0.0.251";
-var PTR = 12;
-var A = 1;
-var SRV = 33;
+/** How the scan engine finds a KLF-200: one mDNS browse, filtered on the instance name. */
+var VELUX_DISCOVERY_MODES = [{
+	kind: "mdns",
+	serviceType: VELUX_MDNS_SERVICE,
+	instancePattern: `^${VELUX_GATEWAY_NAME_PREFIX}`
+}];
 function isVeluxGatewayName(name) {
 	return (name.split("._")[0] ?? name).toLowerCase().startsWith(VELUX_GATEWAY_NAME_PREFIX.toLowerCase());
 }
-function readName(buf, start) {
-	const labels = [];
-	let pos = start;
-	let end = start;
-	let jumped = false;
-	for (let hops = 0; hops < 16; hops++) {
-		if (pos < 0 || pos >= buf.length) return null;
-		const len = buf[pos] ?? 0;
-		if (len === 0) {
-			if (!jumped) end = pos + 1;
-			return {
-				name: labels.join("."),
-				end
-			};
-		}
-		if ((len & 192) === 192) {
-			if (pos + 1 >= buf.length) return null;
-			if (!jumped) end = pos + 2;
-			jumped = true;
-			pos = (len & 63) << 8 | (buf[pos + 1] ?? 0);
-			continue;
-		}
-		if ((len & 192) !== 0 || pos + 1 + len > buf.length) return null;
-		labels.push(buf.subarray(pos + 1, pos + 1 + len).toString("utf8"));
-		pos += 1 + len;
-		if (!jumped) end = pos;
-	}
-	return null;
-}
-function readRecords(buf, offset, count) {
-	const records = [];
-	let pos = offset;
-	for (let i = 0; i < count; i++) {
-		const name = readName(buf, pos);
-		if (name === null || name.end + 10 > buf.length) return null;
-		const type = buf.readUInt16BE(name.end);
-		const dataLength = buf.readUInt16BE(name.end + 8);
-		const dataOffset = name.end + 10;
-		if (dataOffset + dataLength > buf.length) return null;
-		records.push({
-			name: name.name,
-			type,
-			message: buf,
-			dataOffset,
-			dataLength
-		});
-		pos = dataOffset + dataLength;
-	}
-	return {
-		records,
-		next: pos
-	};
-}
-function ipv4(buf, offset, length) {
-	if (length !== 4 || offset + 4 > buf.length) return null;
-	return `${buf[offset] ?? 0}.${buf[offset + 1] ?? 0}.${buf[offset + 2] ?? 0}.${buf[offset + 3] ?? 0}`;
-}
 /** Identity used to recognise a gateway already stored on an integration. */
 function veluxGatewayId(input) {
 	const service = input.serviceHost?.trim().toLowerCase() ?? "";
@@ -100999,40 +101746,24 @@ function veluxGatewayId(input) {
 	if (serial.length > 0) return serial;
 	return input.host;
 }
-function gatewaysFromRecords(records) {
-	const instances = [];
-	const srv = /* @__PURE__ */ new Map();
-	const addresses = /* @__PURE__ */ new Map();
-	for (const rec of records) {
-		const key = rec.name.toLowerCase();
-		if (rec.type === PTR) {
-			const target = readName(rec.message, rec.dataOffset);
-			if (target !== null && isVeluxGatewayName(target.name)) instances.push(target.name);
-		} else if (rec.type === SRV && rec.dataLength >= 6) {
-			const target = readName(rec.message, rec.dataOffset + 6);
-			if (target !== null) srv.set(key, target.name);
-		} else if (rec.type === A) {
-			const ip = ipv4(rec.message, rec.dataOffset, rec.dataLength);
-			if (ip !== null) addresses.set(key, ip);
-		}
-	}
+/** Gateways among the engine's mDNS hits (a `VELUX_KLF…` instance), one per host. */
+function veluxGatewaysFromHits(hits) {
 	const out = [];
 	const seen = /* @__PURE__ */ new Set();
-	for (const instance of instances) {
-		const viaSrv = srv.get(instance.toLowerCase());
-		const host = (viaSrv !== void 0 ? addresses.get(viaSrv.toLowerCase()) : void 0) ?? addresses.get(instance.toLowerCase());
-		if (host === void 0 || seen.has(host)) continue;
-		seen.add(host);
-		const label = instance.split("._")[0] ?? instance;
-		const id = veluxGatewayId({
-			name: label,
-			host,
-			...viaSrv !== void 0 ? { serviceHost: viaSrv } : {}
-		});
+	for (const hit of hits) {
+		const mdns = hit.mdns;
+		if (mdns === void 0 || !isVeluxGatewayName(mdns.instance)) continue;
+		if (hit.host.length === 0 || seen.has(hit.host)) continue;
+		seen.add(hit.host);
+		const name = mdns.instance.split("._")[0] ?? mdns.instance;
 		out.push({
-			host,
-			name: label,
-			id
+			host: hit.host,
+			name,
+			id: veluxGatewayId({
+				name,
+				host: hit.host,
+				serviceHost: mdns.host
+			})
 		});
 	}
 	return out;
@@ -101052,11 +101783,10 @@ function proposeVeluxGateways(found, existingHosts) {
 function veluxDiscoveryCandidates(proposals) {
 	return proposals.map((found) => ({
 		stableId: `velux:${found.id}`,
+		type: DeviceType.Gateway,
 		suggestedName: found.name,
-		prefilledConfig: {
-			host: found.host,
-			[VELUX_SETUP_INTEGRATION_KEY]: true
-		}
+		prefilledConfig: { host: found.host },
+		setupIntegration: true
 	}));
 }
 function veluxDiscoverySummary(foundCount, proposedCount) {
@@ -101064,101 +101794,6 @@ function veluxDiscoverySummary(foundCount, proposedCount) {
 	if (proposedCount === 0) return "No gateway found on the network.";
 	return `Found ${proposedCount} ${proposedCount === 1 ? "gateway" : "gateways"}.`;
 }
-/** Gateways advertised as a KLF-200 (`VELUX_KLF…` instance) on one mDNS message. */
-function veluxGatewaysFromDnsMessage(buf) {
-	if (buf.length < 12) return [];
-	const questions = buf.readUInt16BE(4);
-	const answers = buf.readUInt16BE(6);
-	const authorities = buf.readUInt16BE(8);
-	const extra = buf.readUInt16BE(10);
-	let pos = 12;
-	for (let i = 0; i < questions; i++) {
-		const name = readName(buf, pos);
-		if (name === null) return [];
-		pos = name.end + 4;
-		if (pos > buf.length) return [];
-	}
-	const answerRecords = readRecords(buf, pos, answers);
-	if (answerRecords === null) return [];
-	const authorityRecords = readRecords(buf, answerRecords.next, authorities);
-	if (authorityRecords === null) return [];
-	const extraRecords = readRecords(buf, authorityRecords.next, extra);
-	if (extraRecords === null) return [];
-	return gatewaysFromRecords([
-		...answerRecords.records,
-		...authorityRecords.records,
-		...extraRecords.records
-	]);
-}
-function mdnsPtrQuery(service) {
-	const encoded = service.split(".").filter((part) => part.length > 0).map((label) => Buffer.concat([Buffer.from([label.length]), Buffer.from(label)]));
-	const header = Buffer.alloc(12);
-	header.writeUInt16BE(1, 4);
-	const tail = Buffer.alloc(4);
-	tail.writeUInt16BE(PTR, 0);
-	tail.writeUInt16BE(MDNS_QU_CLASS, 2);
-	return Buffer.concat([
-		header,
-		...encoded,
-		Buffer.from([0]),
-		tail
-	]);
-}
-function closeQuietly(socket) {
-	try {
-		socket.close();
-	} catch {}
-}
-function exchangeMdns(query, timeoutMs) {
-	return new Promise((resolve) => {
-		let socket;
-		try {
-			socket = createSocket({
-				type: "udp4",
-				reuseAddr: true
-			});
-		} catch {
-			resolve([]);
-			return;
-		}
-		const packets = [];
-		let settled = false;
-		const finish = () => {
-			if (settled) return;
-			settled = true;
-			closeQuietly(socket);
-			resolve(packets);
-		};
-		socket.on("error", () => finish());
-		socket.on("message", (msg) => {
-			packets.push(Buffer.from(msg));
-		});
-		socket.bind(0, () => {
-			try {
-				socket.send(query, MDNS_PORT, MDNS_ADDRESS);
-			} catch {
-				finish();
-			}
-		});
-		setTimeout(finish, timeoutMs);
-	});
-}
-async function browseVeluxGateways(exchange = exchangeMdns) {
-	let packets;
-	try {
-		packets = await exchange(mdnsPtrQuery(VELUX_MDNS_SERVICE), VELUX_DISCOVERY_TIMEOUT_MS);
-	} catch {
-		return [];
-	}
-	const hosts = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const packet of packets) for (const found of veluxGatewaysFromDnsMessage(packet)) {
-		if (seen.has(found.host)) continue;
-		seen.add(found.host);
-		hosts.push(found);
-	}
-	return hosts;
-}
 //#endregion
 //#region src/addon.ts
 /**
@@ -101213,14 +101848,15 @@ var VeluxProviderAddon = class extends BaseDeviceProvider {
 			],
 			customActions: veluxActions,
 			actionHandlers: { discoverGateway: async () => {
-				const { proposals, summary } = await this.discoverGateways();
+				const { candidates } = await this.ctx.api.deviceManager.discoverProvider.mutate({ addonId: this.ctx.id });
+				const hosts = candidates.map((candidate) => ({
+					host: String(candidate.prefilledConfig["host"] ?? ""),
+					name: candidate.suggestedName,
+					id: candidate.stableId.replace(/^velux:/, "")
+				}));
 				return {
-					hosts: proposals.map((found) => ({
-						host: found.host,
-						name: found.name,
-						id: found.id
-					})),
-					summary
+					hosts,
+					summary: veluxDiscoverySummary(hosts.length, hosts.length)
 				};
 			} }
 		};
@@ -101241,21 +101877,21 @@ var VeluxProviderAddon = class extends BaseDeviceProvider {
 	async supportsManualCreation() {
 		return false;
 	}
-	/**
-	* LAN mDNS probe for a KLF-200. This addon is hub-only, so the socket is the
-	* hub's. The probe asks for a unicast reply and does not bind 5353.
-	*/
+	/** A KLF-200 is found by the scan engine's mDNS browse; this addon only classifies the hits. */
 	async supportsDiscovery() {
 		return true;
 	}
-	async discoverDevices() {
-		const { proposals } = await this.discoverGateways();
-		return veluxDiscoveryCandidates(proposals).map((candidate) => ({
-			stableId: candidate.stableId,
-			type: DeviceType.Gateway,
-			suggestedName: candidate.suggestedName,
-			prefilledConfig: { ...candidate.prefilledConfig }
-		}));
+	async getDiscoveryModes() {
+		return VELUX_DISCOVERY_MODES;
+	}
+	async classifyDiscoveryHits(input) {
+		const found = veluxGatewaysFromHits(input.hits);
+		const proposals = proposeVeluxGateways(found, await this.knownGatewayHosts());
+		if (found.length > proposals.length) this.ctx.logger.info("Velux discovery skipped gateways already added", { meta: {
+			found: found.length,
+			proposed: proposals.length
+		} });
+		return veluxDiscoveryCandidates(proposals);
 	}
 	async adoptDiscoveredDevice(_input) {
 		throw new Error("A Velux gateway is added from the integration form");
@@ -101272,23 +101908,6 @@ var VeluxProviderAddon = class extends BaseDeviceProvider {
 		if (typeof nativeId !== "string" || nativeId.length === 0) throw new Error("provider-velux generateStableId: nativeId required");
 		return `velux:${nativeId}`;
 	}
-	async discoverGateways() {
-		let found = [];
-		try {
-			found = await browseVeluxGateways();
-		} catch (err) {
-			this.ctx.logger.warn("Velux gateway discovery failed", { meta: { error: errMsg(err) } });
-		}
-		const proposals = proposeVeluxGateways(found, await this.knownGatewayHosts());
-		if (found.length > proposals.length) this.ctx.logger.info("Velux discovery skipped gateways already added", { meta: {
-			found: found.length,
-			proposed: proposals.length
-		} });
-		return {
-			proposals,
-			summary: veluxDiscoverySummary(found.length, proposals.length)
-		};
-	}
 	async knownGatewayHosts() {
 		try {
 			const all = await this.ctx.api.integrations.list.query();