@camstack/addon-provider-velux 0.2.152 → 0.2.154

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.154] - 2026-11-01
+
+### Changed
+
+- The gateway connection test now names the step that timed out (TCP, secure login, version, close) within 17 s and frees the session, instead of hanging until the wizard gives up; an empty gateway scan is logged.
+
+## [0.2.153] - 2026-11-01
+
+### Changed
+
+- An integration deleted while its provider was down now has its orphan devices removed after two concordant reads of the integration list
+
 ## [0.2.152] - 2026-11-01
 
 ### Changed

package/dist/addon.js

@@ -33,6 +33,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 //#endregion
 let node_tls = require("node:tls");
 let timers_promises = require("timers/promises");
+let node_net = require("node:net");
 //#region ../types/dist/event-category-CaURIwQA.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
@@ -66414,6 +66415,60 @@ onColorChanged: { data: object({
 	*/
 	history: "none"
 };
+/**
+* `connection-test` — pre-creation validation of an integration's settings,
+* system-scoped collection (one provider per integration addon).
+*
+* ── Why this cap exists ─────────────────────────────────────────────────────
+*
+* Before it, `integrations.testConnection` had exactly two behaviours: a broker
+* branch (`settings.brokerId` → `broker.testConnection`) and a DEFAULT branch
+* that probed `settings.main_stream_url ?? settings.url` with ffprobe. Every
+* account-based integration — Dreo, Dreame, Tuya, Petkit, Wyze — fell into that
+* default and was told `{"success":false,"error":"No stream URL provided"}`.
+* That answer neither validated nor refused anything, so:
+*
+*   - the Test button had NEVER worked for an account integration, and
+*   - `integrations.create` had nothing to gate on, so an integration with a
+*     wrong password was created happily and failed later, silently, at
+*     reconcile time.
+*
+* The structural gap was that at CREATE time the integration does not exist
+* yet: there is no `integrationId`, no `brokerId`, no live client — and every
+* existing provider surface (`device-provider`, `device-adoption`) is keyed by
+* one of those. There was no way to ask "are these settings valid?" before the
+* row existed.
+*
+* ── The contract ────────────────────────────────────────────────────────────
+*
+* The provider knows how to validate its OWN settings. The framework does not
+* guess from the shape of the settings — a stream-URL probe is one provider's
+* implementation of this cap, not the universal fallback. A provider that does
+* not register this cap is a KNOWN "cannot validate", never a silent pass.
+*
+* `testSettings` takes the candidate settings blob exactly as the wizard's
+* config step collected it (the same blob that would be handed to
+* `integrations.create`), and MUST NOT persist anything, mint an integration,
+* or mutate live state. It opens a throwaway session, asks, and closes it.
+*
+* ── The three outcomes are NOT interchangeable ──────────────────────────────
+*
+* This is the whole point of the discriminated union: a `null` from a timeout
+* must never look like a `null` from a refusal.
+*
+*   - `validated`    — the remote ACCEPTED these credentials. Observed.
+*   - `rejected`     — the remote REFUSED these credentials. Observed.
+*                      This is the ONLY outcome that blocks creation.
+*   - `inconclusive` — the check could not complete (DNS, timeout, 5xx, an
+*                      unexpected shape). NOTHING was observed about the
+*                      credentials. Never rendered, or counted, as a failure.
+*
+* A provider that cannot tell a refusal from a transport fault must return
+* `inconclusive`. Guessing `rejected` would block creation on a flaky network;
+* guessing `validated` would wave a wrong password through.
+*/
+/** Ceiling on how long a pre-creation probe may hold the wizard. */
+var CONNECTION_TEST_TIMEOUT_MS = 2e4;
 var ConnectionTestOutcomeSchema = discriminatedUnion("outcome", [
 	object({
 		outcome: literal("validated"),
@@ -94566,6 +94621,88 @@ DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.sceneBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
+/**
+* Closes the gap D49 leaves: an integration deleted while its provider was down never emits an
+* event the provider sees. An integration id absent from an ANSWERED list is only a suspect; its
+* devices go (through the provider's own removeDevices) when a SECOND answered read, at least
+* `minIntervalMs` later, still lacks it. A read that threw changes nothing; reappearing clears.
+*/
+var OrphanIntegrationSweep = class {
+	#logger;
+	#minIntervalMs;
+	#now;
+	#suspects = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.#logger = options.logger;
+		this.#minIntervalMs = options.minIntervalMs ?? 6e4;
+		this.#now = options.now ?? Date.now;
+	}
+	get minIntervalMs() {
+		return this.#minIntervalMs;
+	}
+	async sweep(input) {
+		if (input.listedIds === null) return {
+			newSuspects: 0,
+			removed: []
+		};
+		const listed = new Set(input.listedIds);
+		const owners = new Set(input.ownerIds);
+		const now = this.#now();
+		let newSuspects = 0;
+		const removed = [];
+		for (const id of [...this.#suspects.keys()]) if (listed.has(id) || !owners.has(id)) {
+			this.#suspects.delete(id);
+			this.#logger.info("Orphan integration suspect cleared", { meta: {
+				integrationId: id,
+				reason: listed.has(id) ? "listed again" : "owns no devices"
+			} });
+		}
+		for (const id of owners) {
+			if (listed.has(id)) continue;
+			const since = this.#suspects.get(id);
+			if (since === void 0) {
+				this.#suspects.set(id, now);
+				newSuspects += 1;
+				this.#logger.info("Integration owns devices but is absent from the list — suspect", { meta: {
+					integrationId: id,
+					minIntervalMs: this.#minIntervalMs
+				} });
+				continue;
+			}
+			if (now - since < this.#minIntervalMs) continue;
+			try {
+				const count = await input.removeDevices(id);
+				this.#suspects.delete(id);
+				removed.push(id);
+				this.#logger.warn("Orphan integration devices removed — absent from two answered lists", { meta: {
+					integrationId: id,
+					removed: count,
+					firstMissingAt: since
+				} });
+			} catch (err) {
+				this.#logger.warn("Orphan integration device removal failed — kept as suspect", { meta: {
+					integrationId: id,
+					error: errMsg(err)
+				} });
+			}
+		}
+		return {
+			newSuspects,
+			removed
+		};
+	}
+};
+/** The integration ids that own top-level devices of one provider (a config that cannot be read is skipped). */
+async function collectOwnerIntegrationIds(input) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const d of input.reg.getAllForAddon(input.addonId)) {
+		if (d.parentDeviceId !== null) continue;
+		const cfg = await input.devices.loadConfig(d.id).catch(() => ({}));
+		const owner = input.ownerOf(cfg);
+		if (owner !== null) ids.add(owner);
+	}
+	return [...ids];
+}
 String.raw`(?<=^|["'(\s>,\[{])`;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
@@ -94586,8 +94723,14 @@ object({
 */
 var VeluxReconciler = class {
 	#deps;
+	#sweep;
+	#rerun = null;
 	constructor(deps) {
 		this.#deps = deps;
+		this.#sweep = new OrphanIntegrationSweep({
+			logger: deps.logger,
+			...deps.sweepOptions
+		});
 	}
 	/** Upsert a client per usable enabled integration; drop the CLIENT (never devices) of one the list answered is gone. */
 	async reconcile() {
@@ -94610,6 +94753,37 @@ var VeluxReconciler = class {
 		}
 		const enabledIds = new Set(enabled.map((i) => i.id));
 		for (const id of clients.list()) if (!enabledIds.has(id)) await clients.remove(id);
+		await this.#sweepOrphans(all.map((i) => i.id));
+	}
+	/** Stop the scheduled second read (addon stop). */
+	dispose() {
+		if (this.#rerun !== null) clearTimeout(this.#rerun);
+		this.#rerun = null;
+	}
+	/**
+	* An integration deleted while this addon was down emits nothing it sees: its id owns devices
+	* yet is absent from the ANSWERED list. Removal needs a second answered read later, so one
+	* re-run is scheduled when a suspect appears (bounded: one timer, no retry loop).
+	*/
+	async #sweepOrphans(listedIds) {
+		const { ownerIntegrationIds, removeDevices, logger } = this.#deps;
+		if (ownerIntegrationIds === void 0) return;
+		try {
+			const ownerIds = await ownerIntegrationIds();
+			if ((await this.#sweep.sweep({
+				ownerIds,
+				listedIds,
+				removeDevices
+			})).newSuspects > 0 && this.#rerun === null) {
+				this.#rerun = setTimeout(() => {
+					this.#rerun = null;
+					this.reconcile();
+				}, this.#sweep.minIntervalMs + 1e3);
+				this.#rerun.unref();
+			}
+		} catch (err) {
+			logger.warn("Orphan integration sweep failed — devices left as they are", { meta: { error: errMsg(err) } });
+		}
 	}
 	/** An explicit lifecycle event: only `deleted` / `disabled` of a named integration remove devices. */
 	async onLifecycle(kind, integrationId) {
@@ -103312,8 +103486,69 @@ var VeluxClientRegistry = class {
 };
 //#endregion
 //#region src/klf-probe.ts
-/** Seconds allowed for the TLS handshake plus password exchange of a probe. */
-var PROBE_LOGIN_TIMEOUT_S = 15;
+/** The gateway's TLS API port. */
+var KLF_PORT = 51200;
+/**
+* Defaults add up, worst case, to 3 + 2 x 5 + 2 + 2 = 17 s, under the
+* `CONNECTION_TEST_TIMEOUT_MS` ceiling of the wizard, so a stuck gateway is named
+* here instead of the wizard giving up unnamed.
+*/
+var DEFAULT_KLF_PROBE_TIMEOUTS_MS = {
+	tcp: 3e3,
+	login: 5e3,
+	version: 2e3,
+	logout: 2e3
+};
+var PHASE_TEXT = {
+	tcp: "did not accept a TCP connection on port 51200",
+	login: "did not complete the secure login (TLS handshake or password answer)",
+	version: "did not answer the version request",
+	logout: "did not close the session"
+};
+/** A probe step ran out of time. Names the step, so a bound is never a silent hang. */
+var KlfProbeTimeoutError = class extends Error {
+	phase;
+	host;
+	limitMs;
+	constructor(phase, host, limitMs) {
+		super(`The gateway ${host} ${PHASE_TEXT[phase]} within ${Math.round(limitMs / 100) / 10}s (timed out)`);
+		this.phase = phase;
+		this.host = host;
+		this.limitMs = limitMs;
+		this.name = "KlfProbeTimeoutError";
+	}
+};
+async function withDeadline(work, ms, onTimeout) {
+	let timer;
+	try {
+		return await Promise.race([work, new Promise((_resolve, reject) => {
+			timer = setTimeout(() => reject(onTimeout()), ms);
+		})]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/** A bare TCP connect to the gateway port: tells "nothing listens" from "TLS is stuck". */
+function tcpReachable(host, ms) {
+	return new Promise((resolve, reject) => {
+		const socket = (0, node_net.connect)({
+			host,
+			port: KLF_PORT
+		});
+		socket.setTimeout(ms, () => {
+			socket.destroy();
+			reject(new KlfProbeTimeoutError("tcp", host, ms));
+		});
+		socket.once("connect", () => {
+			socket.destroy();
+			resolve();
+		});
+		socket.once("error", (err) => {
+			socket.destroy();
+			reject(err);
+		});
+	});
+}
 /**
 * Opens ONE session, authenticates, reads the firmware version and closes the
 * session again, whatever happens. The gateway accepts two sessions in total, so
@@ -103321,28 +103556,46 @@ var PROBE_LOGIN_TIMEOUT_S = 15;
 * list. A refused password rejects with `VeluxLoginRefusedError`.
 */
 async function probeKlfGateway(options) {
+	const limits = {
+		...DEFAULT_KLF_PROBE_TIMEOUTS_MS,
+		...options.timeoutsMs
+	};
+	await tcpReachable(options.host, limits.tcp);
 	const connection = options.tls === void 0 ? new Connection(options.host) : new Connection(options.host, options.tls);
+	const loginError = () => new KlfProbeTimeoutError("login", options.host, limits.login);
 	try {
 		try {
-			await connection.loginAsync(options.password, PROBE_LOGIN_TIMEOUT_S);
+			await withDeadline(connection.loginAsync(options.password, limits.login / 1e3), limits.login * 2 + 500, loginError);
 		} catch (err) {
+			if (err instanceof KlfProbeTimeoutError) throw err;
+			if (/^timeout$/i.test(errMsg(err)) || err instanceof Error && err.name === "TimeoutError") throw loginError();
 			throw loginFailure(err);
 		}
 		try {
-			const { SoftwareVersion } = await new Gateway(connection).getVersionAsync();
+			const { SoftwareVersion } = await withDeadline(new Gateway(connection).getVersionAsync(), limits.version, () => new KlfProbeTimeoutError("version", options.host, limits.version));
 			return { firmware: SoftwareVersion.toString() };
 		} catch {
 			return { firmware: null };
 		}
 	} finally {
 		try {
-			await connection.logoutAsync();
+			await withDeadline(connection.logoutAsync(limits.logout / 1e3), limits.logout + 500, () => new KlfProbeTimeoutError("logout", options.host, limits.logout));
 		} catch (err) {
 			errMsg(err);
+			await connection[Symbol.asyncDispose]().catch(() => void 0);
 		}
 	}
 }
 var TEST_LABEL = "Logs in to the gateway with this password, then closes the session";
+/** Under `CONNECTION_TEST_TIMEOUT_MS`, so the reason reaches the operator first. */
+var DEFAULT_TEST_DEADLINE_MS = CONNECTION_TEST_TIMEOUT_MS - 2e3;
+/** The whole test outlived its ceiling; no step of the probe answered in time. */
+var KlfTestDeadlineError = class extends Error {
+	constructor(host, limitMs) {
+		super(`The gateway ${host} did not answer within ${Math.round(limitMs / 1e3)}s (timed out)`);
+		this.name = "KlfTestDeadlineError";
+	}
+};
 var UNREACHABLE_CODES = new Set([
 	"ECONNREFUSED",
 	"EHOSTUNREACH",
@@ -103364,6 +103617,10 @@ function classifyProbeFailure(err) {
 		kind: "wrong-password",
 		text: err.message
 	};
+	if (err instanceof KlfProbeTimeoutError || err instanceof KlfTestDeadlineError) return {
+		kind: "unreachable",
+		text: err.message
+	};
 	const text = typeof err === "string" ? err : errMsg(err);
 	const code = typeof err === "object" && err !== null ? Reflect.get(err, "code") : void 0;
 	if (typeof code === "string" && UNREACHABLE_CODES.has(code)) return {
@@ -103388,7 +103645,7 @@ function classifyProbeFailure(err) {
 	};
 }
 function buildVeluxConnectionTestProvider(deps) {
-	const { logger, probe = probeKlfGateway, liveSessions = () => 0 } = deps;
+	const { logger, probe = probeKlfGateway, liveSessions = () => 0, deadlineMs = DEFAULT_TEST_DEADLINE_MS } = deps;
 	/** The tail of the test queue per host: a second test waits for the first to log out. */
 	const queues = /* @__PURE__ */ new Map();
 	async function run(host, password) {
@@ -103404,10 +103661,13 @@ function buildVeluxConnectionTestProvider(deps) {
 		}
 		const startedAt = Date.now();
 		try {
-			const result = await probe({
+			let timer;
+			const result = await Promise.race([probe({
 				host,
 				password
-			});
+			}), new Promise((_resolve, reject) => {
+				timer = setTimeout(() => reject(new KlfTestDeadlineError(host, deadlineMs)), deadlineMs);
+			})]).finally(() => clearTimeout(timer));
 			return {
 				outcome: "validated",
 				latencyMs: Date.now() - startedAt,
@@ -103642,7 +103902,12 @@ var VeluxProviderAddon = class extends BaseDeviceProvider {
 			],
 			customActions: veluxActions,
 			actionHandlers: { discoverGateway: async () => {
+				const startedAt = Date.now();
 				const { candidates } = await this.ctx.api.deviceManager.discoverProvider.mutate({ addonId: this.ctx.id });
+				this.ctx.logger.info("Velux gateway scan finished", { meta: {
+					found: candidates.length,
+					ms: Date.now() - startedAt
+				} });
 				const hosts = candidates.map((candidate) => ({
 					host: String(candidate.prefilledConfig["host"] ?? ""),
 					name: candidate.suggestedName,
@@ -103662,6 +103927,7 @@ var VeluxProviderAddon = class extends BaseDeviceProvider {
 			this.ctx.logger.warn("Velux: shutdown error", { meta: { error: errMsg(err) } });
 		}
 		this.clients = null;
+		this.integrationReconciler?.dispose();
 		this.integrationReconciler = null;
 		setKlfLibraryLogSink(null);
 		await super.onShutdown();
@@ -103746,7 +104012,8 @@ var VeluxProviderAddon = class extends BaseDeviceProvider {
 				await this.requireClients().upsert(integration.id, integration.name, connection);
 				return true;
 			},
-			removeDevices: (integrationId) => this.cascadeRemoveDevicesForIntegration(integrationId)
+			removeDevices: (integrationId) => this.cascadeRemoveDevicesForIntegration(integrationId),
+			ownerIntegrationIds: () => this.ownerIntegrationIds()
 		});
 		return this.integrationReconciler;
 	}
@@ -103766,6 +104033,21 @@ var VeluxProviderAddon = class extends BaseDeviceProvider {
 		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationDisabled }, on("disabled"));
 		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationDeleted }, on("deleted"));
 	}
+	/** The integrations that own devices here, for the orphan sweep. */
+	async ownerIntegrationIds() {
+		const reg = this.ctx.kernel.deviceRegistry;
+		const devices = this.ctx.kernel.devices;
+		if (!reg || !devices) return [];
+		return await collectOwnerIntegrationIds({
+			reg,
+			devices,
+			addonId: this.addonId,
+			ownerOf: (cfg) => {
+				const owner = cfg["integrationId"];
+				return cfg["system"] === "velux" && typeof owner === "string" ? owner : null;
+			}
+		});
+	}
 	async cascadeRemoveDevicesForIntegration(integrationId) {
 		const reg = this.ctx.kernel.deviceRegistry;
 		const devices = this.ctx.kernel.devices;

package/dist/addon.mjs

@@ -1,6 +1,7 @@
 import { createRequire } from "node:module";
 import { connect } from "node:tls";
 import { setImmediate as setImmediate$1 } from "timers/promises";
+import { connect as connect$1 } from "node:net";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -66415,6 +66416,60 @@ onColorChanged: { data: object({
 	*/
 	history: "none"
 };
+/**
+* `connection-test` — pre-creation validation of an integration's settings,
+* system-scoped collection (one provider per integration addon).
+*
+* ── Why this cap exists ─────────────────────────────────────────────────────
+*
+* Before it, `integrations.testConnection` had exactly two behaviours: a broker
+* branch (`settings.brokerId` → `broker.testConnection`) and a DEFAULT branch
+* that probed `settings.main_stream_url ?? settings.url` with ffprobe. Every
+* account-based integration — Dreo, Dreame, Tuya, Petkit, Wyze — fell into that
+* default and was told `{"success":false,"error":"No stream URL provided"}`.
+* That answer neither validated nor refused anything, so:
+*
+*   - the Test button had NEVER worked for an account integration, and
+*   - `integrations.create` had nothing to gate on, so an integration with a
+*     wrong password was created happily and failed later, silently, at
+*     reconcile time.
+*
+* The structural gap was that at CREATE time the integration does not exist
+* yet: there is no `integrationId`, no `brokerId`, no live client — and every
+* existing provider surface (`device-provider`, `device-adoption`) is keyed by
+* one of those. There was no way to ask "are these settings valid?" before the
+* row existed.
+*
+* ── The contract ────────────────────────────────────────────────────────────
+*
+* The provider knows how to validate its OWN settings. The framework does not
+* guess from the shape of the settings — a stream-URL probe is one provider's
+* implementation of this cap, not the universal fallback. A provider that does
+* not register this cap is a KNOWN "cannot validate", never a silent pass.
+*
+* `testSettings` takes the candidate settings blob exactly as the wizard's
+* config step collected it (the same blob that would be handed to
+* `integrations.create`), and MUST NOT persist anything, mint an integration,
+* or mutate live state. It opens a throwaway session, asks, and closes it.
+*
+* ── The three outcomes are NOT interchangeable ──────────────────────────────
+*
+* This is the whole point of the discriminated union: a `null` from a timeout
+* must never look like a `null` from a refusal.
+*
+*   - `validated`    — the remote ACCEPTED these credentials. Observed.
+*   - `rejected`     — the remote REFUSED these credentials. Observed.
+*                      This is the ONLY outcome that blocks creation.
+*   - `inconclusive` — the check could not complete (DNS, timeout, 5xx, an
+*                      unexpected shape). NOTHING was observed about the
+*                      credentials. Never rendered, or counted, as a failure.
+*
+* A provider that cannot tell a refusal from a transport fault must return
+* `inconclusive`. Guessing `rejected` would block creation on a flaky network;
+* guessing `validated` would wave a wrong password through.
+*/
+/** Ceiling on how long a pre-creation probe may hold the wizard. */
+var CONNECTION_TEST_TIMEOUT_MS = 2e4;
 var ConnectionTestOutcomeSchema = discriminatedUnion("outcome", [
 	object({
 		outcome: literal("validated"),
@@ -94567,6 +94622,88 @@ DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.sceneBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
+/**
+* Closes the gap D49 leaves: an integration deleted while its provider was down never emits an
+* event the provider sees. An integration id absent from an ANSWERED list is only a suspect; its
+* devices go (through the provider's own removeDevices) when a SECOND answered read, at least
+* `minIntervalMs` later, still lacks it. A read that threw changes nothing; reappearing clears.
+*/
+var OrphanIntegrationSweep = class {
+	#logger;
+	#minIntervalMs;
+	#now;
+	#suspects = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.#logger = options.logger;
+		this.#minIntervalMs = options.minIntervalMs ?? 6e4;
+		this.#now = options.now ?? Date.now;
+	}
+	get minIntervalMs() {
+		return this.#minIntervalMs;
+	}
+	async sweep(input) {
+		if (input.listedIds === null) return {
+			newSuspects: 0,
+			removed: []
+		};
+		const listed = new Set(input.listedIds);
+		const owners = new Set(input.ownerIds);
+		const now = this.#now();
+		let newSuspects = 0;
+		const removed = [];
+		for (const id of [...this.#suspects.keys()]) if (listed.has(id) || !owners.has(id)) {
+			this.#suspects.delete(id);
+			this.#logger.info("Orphan integration suspect cleared", { meta: {
+				integrationId: id,
+				reason: listed.has(id) ? "listed again" : "owns no devices"
+			} });
+		}
+		for (const id of owners) {
+			if (listed.has(id)) continue;
+			const since = this.#suspects.get(id);
+			if (since === void 0) {
+				this.#suspects.set(id, now);
+				newSuspects += 1;
+				this.#logger.info("Integration owns devices but is absent from the list — suspect", { meta: {
+					integrationId: id,
+					minIntervalMs: this.#minIntervalMs
+				} });
+				continue;
+			}
+			if (now - since < this.#minIntervalMs) continue;
+			try {
+				const count = await input.removeDevices(id);
+				this.#suspects.delete(id);
+				removed.push(id);
+				this.#logger.warn("Orphan integration devices removed — absent from two answered lists", { meta: {
+					integrationId: id,
+					removed: count,
+					firstMissingAt: since
+				} });
+			} catch (err) {
+				this.#logger.warn("Orphan integration device removal failed — kept as suspect", { meta: {
+					integrationId: id,
+					error: errMsg(err)
+				} });
+			}
+		}
+		return {
+			newSuspects,
+			removed
+		};
+	}
+};
+/** The integration ids that own top-level devices of one provider (a config that cannot be read is skipped). */
+async function collectOwnerIntegrationIds(input) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const d of input.reg.getAllForAddon(input.addonId)) {
+		if (d.parentDeviceId !== null) continue;
+		const cfg = await input.devices.loadConfig(d.id).catch(() => ({}));
+		const owner = input.ownerOf(cfg);
+		if (owner !== null) ids.add(owner);
+	}
+	return [...ids];
+}
 String.raw`(?<=^|["'(\s>,\[{])`;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
@@ -94587,8 +94724,14 @@ object({
 */
 var VeluxReconciler = class {
 	#deps;
+	#sweep;
+	#rerun = null;
 	constructor(deps) {
 		this.#deps = deps;
+		this.#sweep = new OrphanIntegrationSweep({
+			logger: deps.logger,
+			...deps.sweepOptions
+		});
 	}
 	/** Upsert a client per usable enabled integration; drop the CLIENT (never devices) of one the list answered is gone. */
 	async reconcile() {
@@ -94611,6 +94754,37 @@ var VeluxReconciler = class {
 		}
 		const enabledIds = new Set(enabled.map((i) => i.id));
 		for (const id of clients.list()) if (!enabledIds.has(id)) await clients.remove(id);
+		await this.#sweepOrphans(all.map((i) => i.id));
+	}
+	/** Stop the scheduled second read (addon stop). */
+	dispose() {
+		if (this.#rerun !== null) clearTimeout(this.#rerun);
+		this.#rerun = null;
+	}
+	/**
+	* An integration deleted while this addon was down emits nothing it sees: its id owns devices
+	* yet is absent from the ANSWERED list. Removal needs a second answered read later, so one
+	* re-run is scheduled when a suspect appears (bounded: one timer, no retry loop).
+	*/
+	async #sweepOrphans(listedIds) {
+		const { ownerIntegrationIds, removeDevices, logger } = this.#deps;
+		if (ownerIntegrationIds === void 0) return;
+		try {
+			const ownerIds = await ownerIntegrationIds();
+			if ((await this.#sweep.sweep({
+				ownerIds,
+				listedIds,
+				removeDevices
+			})).newSuspects > 0 && this.#rerun === null) {
+				this.#rerun = setTimeout(() => {
+					this.#rerun = null;
+					this.reconcile();
+				}, this.#sweep.minIntervalMs + 1e3);
+				this.#rerun.unref();
+			}
+		} catch (err) {
+			logger.warn("Orphan integration sweep failed — devices left as they are", { meta: { error: errMsg(err) } });
+		}
 	}
 	/** An explicit lifecycle event: only `deleted` / `disabled` of a named integration remove devices. */
 	async onLifecycle(kind, integrationId) {
@@ -103313,8 +103487,69 @@ var VeluxClientRegistry = class {
 };
 //#endregion
 //#region src/klf-probe.ts
-/** Seconds allowed for the TLS handshake plus password exchange of a probe. */
-var PROBE_LOGIN_TIMEOUT_S = 15;
+/** The gateway's TLS API port. */
+var KLF_PORT = 51200;
+/**
+* Defaults add up, worst case, to 3 + 2 x 5 + 2 + 2 = 17 s, under the
+* `CONNECTION_TEST_TIMEOUT_MS` ceiling of the wizard, so a stuck gateway is named
+* here instead of the wizard giving up unnamed.
+*/
+var DEFAULT_KLF_PROBE_TIMEOUTS_MS = {
+	tcp: 3e3,
+	login: 5e3,
+	version: 2e3,
+	logout: 2e3
+};
+var PHASE_TEXT = {
+	tcp: "did not accept a TCP connection on port 51200",
+	login: "did not complete the secure login (TLS handshake or password answer)",
+	version: "did not answer the version request",
+	logout: "did not close the session"
+};
+/** A probe step ran out of time. Names the step, so a bound is never a silent hang. */
+var KlfProbeTimeoutError = class extends Error {
+	phase;
+	host;
+	limitMs;
+	constructor(phase, host, limitMs) {
+		super(`The gateway ${host} ${PHASE_TEXT[phase]} within ${Math.round(limitMs / 100) / 10}s (timed out)`);
+		this.phase = phase;
+		this.host = host;
+		this.limitMs = limitMs;
+		this.name = "KlfProbeTimeoutError";
+	}
+};
+async function withDeadline(work, ms, onTimeout) {
+	let timer;
+	try {
+		return await Promise.race([work, new Promise((_resolve, reject) => {
+			timer = setTimeout(() => reject(onTimeout()), ms);
+		})]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/** A bare TCP connect to the gateway port: tells "nothing listens" from "TLS is stuck". */
+function tcpReachable(host, ms) {
+	return new Promise((resolve, reject) => {
+		const socket = connect$1({
+			host,
+			port: KLF_PORT
+		});
+		socket.setTimeout(ms, () => {
+			socket.destroy();
+			reject(new KlfProbeTimeoutError("tcp", host, ms));
+		});
+		socket.once("connect", () => {
+			socket.destroy();
+			resolve();
+		});
+		socket.once("error", (err) => {
+			socket.destroy();
+			reject(err);
+		});
+	});
+}
 /**
 * Opens ONE session, authenticates, reads the firmware version and closes the
 * session again, whatever happens. The gateway accepts two sessions in total, so
@@ -103322,28 +103557,46 @@ var PROBE_LOGIN_TIMEOUT_S = 15;
 * list. A refused password rejects with `VeluxLoginRefusedError`.
 */
 async function probeKlfGateway(options) {
+	const limits = {
+		...DEFAULT_KLF_PROBE_TIMEOUTS_MS,
+		...options.timeoutsMs
+	};
+	await tcpReachable(options.host, limits.tcp);
 	const connection = options.tls === void 0 ? new Connection(options.host) : new Connection(options.host, options.tls);
+	const loginError = () => new KlfProbeTimeoutError("login", options.host, limits.login);
 	try {
 		try {
-			await connection.loginAsync(options.password, PROBE_LOGIN_TIMEOUT_S);
+			await withDeadline(connection.loginAsync(options.password, limits.login / 1e3), limits.login * 2 + 500, loginError);
 		} catch (err) {
+			if (err instanceof KlfProbeTimeoutError) throw err;
+			if (/^timeout$/i.test(errMsg(err)) || err instanceof Error && err.name === "TimeoutError") throw loginError();
 			throw loginFailure(err);
 		}
 		try {
-			const { SoftwareVersion } = await new Gateway(connection).getVersionAsync();
+			const { SoftwareVersion } = await withDeadline(new Gateway(connection).getVersionAsync(), limits.version, () => new KlfProbeTimeoutError("version", options.host, limits.version));
 			return { firmware: SoftwareVersion.toString() };
 		} catch {
 			return { firmware: null };
 		}
 	} finally {
 		try {
-			await connection.logoutAsync();
+			await withDeadline(connection.logoutAsync(limits.logout / 1e3), limits.logout + 500, () => new KlfProbeTimeoutError("logout", options.host, limits.logout));
 		} catch (err) {
 			errMsg(err);
+			await connection[Symbol.asyncDispose]().catch(() => void 0);
 		}
 	}
 }
 var TEST_LABEL = "Logs in to the gateway with this password, then closes the session";
+/** Under `CONNECTION_TEST_TIMEOUT_MS`, so the reason reaches the operator first. */
+var DEFAULT_TEST_DEADLINE_MS = CONNECTION_TEST_TIMEOUT_MS - 2e3;
+/** The whole test outlived its ceiling; no step of the probe answered in time. */
+var KlfTestDeadlineError = class extends Error {
+	constructor(host, limitMs) {
+		super(`The gateway ${host} did not answer within ${Math.round(limitMs / 1e3)}s (timed out)`);
+		this.name = "KlfTestDeadlineError";
+	}
+};
 var UNREACHABLE_CODES = new Set([
 	"ECONNREFUSED",
 	"EHOSTUNREACH",
@@ -103365,6 +103618,10 @@ function classifyProbeFailure(err) {
 		kind: "wrong-password",
 		text: err.message
 	};
+	if (err instanceof KlfProbeTimeoutError || err instanceof KlfTestDeadlineError) return {
+		kind: "unreachable",
+		text: err.message
+	};
 	const text = typeof err === "string" ? err : errMsg(err);
 	const code = typeof err === "object" && err !== null ? Reflect.get(err, "code") : void 0;
 	if (typeof code === "string" && UNREACHABLE_CODES.has(code)) return {
@@ -103389,7 +103646,7 @@ function classifyProbeFailure(err) {
 	};
 }
 function buildVeluxConnectionTestProvider(deps) {
-	const { logger, probe = probeKlfGateway, liveSessions = () => 0 } = deps;
+	const { logger, probe = probeKlfGateway, liveSessions = () => 0, deadlineMs = DEFAULT_TEST_DEADLINE_MS } = deps;
 	/** The tail of the test queue per host: a second test waits for the first to log out. */
 	const queues = /* @__PURE__ */ new Map();
 	async function run(host, password) {
@@ -103405,10 +103662,13 @@ function buildVeluxConnectionTestProvider(deps) {
 		}
 		const startedAt = Date.now();
 		try {
-			const result = await probe({
+			let timer;
+			const result = await Promise.race([probe({
 				host,
 				password
-			});
+			}), new Promise((_resolve, reject) => {
+				timer = setTimeout(() => reject(new KlfTestDeadlineError(host, deadlineMs)), deadlineMs);
+			})]).finally(() => clearTimeout(timer));
 			return {
 				outcome: "validated",
 				latencyMs: Date.now() - startedAt,
@@ -103643,7 +103903,12 @@ var VeluxProviderAddon = class extends BaseDeviceProvider {
 			],
 			customActions: veluxActions,
 			actionHandlers: { discoverGateway: async () => {
+				const startedAt = Date.now();
 				const { candidates } = await this.ctx.api.deviceManager.discoverProvider.mutate({ addonId: this.ctx.id });
+				this.ctx.logger.info("Velux gateway scan finished", { meta: {
+					found: candidates.length,
+					ms: Date.now() - startedAt
+				} });
 				const hosts = candidates.map((candidate) => ({
 					host: String(candidate.prefilledConfig["host"] ?? ""),
 					name: candidate.suggestedName,
@@ -103663,6 +103928,7 @@ var VeluxProviderAddon = class extends BaseDeviceProvider {
 			this.ctx.logger.warn("Velux: shutdown error", { meta: { error: errMsg(err) } });
 		}
 		this.clients = null;
+		this.integrationReconciler?.dispose();
 		this.integrationReconciler = null;
 		setKlfLibraryLogSink(null);
 		await super.onShutdown();
@@ -103747,7 +104013,8 @@ var VeluxProviderAddon = class extends BaseDeviceProvider {
 				await this.requireClients().upsert(integration.id, integration.name, connection);
 				return true;
 			},
-			removeDevices: (integrationId) => this.cascadeRemoveDevicesForIntegration(integrationId)
+			removeDevices: (integrationId) => this.cascadeRemoveDevicesForIntegration(integrationId),
+			ownerIntegrationIds: () => this.ownerIntegrationIds()
 		});
 		return this.integrationReconciler;
 	}
@@ -103767,6 +104034,21 @@ var VeluxProviderAddon = class extends BaseDeviceProvider {
 		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationDisabled }, on("disabled"));
 		this.ctx.eventBus.subscribe({ category: EventCategory.IntegrationDeleted }, on("deleted"));
 	}
+	/** The integrations that own devices here, for the orphan sweep. */
+	async ownerIntegrationIds() {
+		const reg = this.ctx.kernel.deviceRegistry;
+		const devices = this.ctx.kernel.devices;
+		if (!reg || !devices) return [];
+		return await collectOwnerIntegrationIds({
+			reg,
+			devices,
+			addonId: this.addonId,
+			ownerOf: (cfg) => {
+				const owner = cfg["integrationId"];
+				return cfg["system"] === "velux" && typeof owner === "string" ? owner : null;
+			}
+		});
+	}
 	async cascadeRemoveDevicesForIntegration(integrationId) {
 		const reg = this.ctx.kernel.deviceRegistry;
 		const devices = this.ctx.kernel.devices;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-velux",
-  "version": "0.2.152",
+  "version": "0.2.154",
   "description": "Velux KLF-200 integration for CamStack — the gateway, local-gateway windows (with rain sensor) and shutter covers (positional, no tilt)",
   "keywords": [
     "camstack",
@@ -62,7 +62,7 @@
       }
     ],
     "requires": {
-      "server": ">=1.2.719"
+      "server": ">=1.2.723"
     }
   },
   "files": [