@camstack/addon-google-services 0.2.41 → 0.2.43

package/dist/google-services.addon.mjs

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from "node:crypto";
-//#region ../types/dist/event-category-BmPm98n0.mjs
+//#region ../types/dist/event-category-78tcBemo.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -120,6 +120,23 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AddonLoadRecovered"] = "addon.load-recovered";
 	/**
+	* An addon is RUNNING although its installed package is below what the
+	* running server requires (`camstack.requires.addons` of the server, or the
+	* addon's own `requires.server`). Raised once per streak by the unsupported-
+	* addon tracker, on the hub and on agents; AlertCenter turns it into one
+	* operator alert per node and package. The addon is never held back for it.
+	*
+	* Payload: `{ packageName, addonId, nodeId, installedVersion, requiredMinimum, serverVersion, unmet }`.
+	*/
+	EventCategory["AddonUnsupportedVersion"] = "addon.unsupported-version";
+	/**
+	* The package of an {@link AddonUnsupportedVersion} alert reached a supported
+	* version, or is no longer installed on the node. AlertCenter dismisses the matching alert.
+	*
+	* Payload: `{ packageName, addonId, nodeId }`.
+	*/
+	EventCategory["AddonUnsupportedResolved"] = "addon.unsupported-resolved";
+	/**
 	* Monitor scheduled the next retry for a failed addon. Transient —
 	* surfaced to the UI for live-updating the "next retry in Ns"
 	* countdown on the Addons page row, NOT persisted as an alert.
@@ -230,7 +247,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["ProcessRestarted"] = "process.restarted";
 	/**
 	* The SET of storage locations changed — one was created, edited, enabled,
-	* disabled or deleted through `storage.upsertLocation` / `deleteLocation`.
+	* disabled or deleted through the location instances or the forced-delete action.
 	*
 	* Telemetry, not a transaction (D8/D11): every consumer that re-resolves on
 	* it must also converge on its own periodic path, because a dropped event
@@ -5981,7 +5998,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-CdKka2ri.mjs
+//#region ../types/dist/sleep-AEnTN3b4.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6690,10 +6707,33 @@ function integrationRowsApiOver(api) {
 	};
 }
 var PREFIX = "records/";
+/**
+* Cross-realm brand. An addon bundles its own copy of this module (D15) while
+* `ctx.records` is the HOST's door, so an error thrown by the host is an
+* instance of the host's classes, not of the addon's. The brand plus the code
+* make `instanceof` answer by identity of the failure, not of the copy.
+*/
+var RECORDS_ERROR_BRAND = Symbol.for("camstack.records-error");
+function carriesBrand(value) {
+	return typeof value === "object" && value !== null && Reflect.get(value, RECORDS_ERROR_BRAND) === true;
+}
 /** The base of every records failure. `detail` is the human part of the message. */
 var RecordsError = class extends Error {
+	/** The code a subclass stands for; the base stands for every code. */
+	static code = void 0;
+	/**
+	* `instanceof` across copies of this module: any branded error is a
+	* `RecordsError`, and is an instance of a subclass only when its code is the
+	* subclass's code. Same-copy answers are unchanged.
+	*/
+	static [Symbol.hasInstance](value) {
+		if (Function.prototype[Symbol.hasInstance].call(this, value)) return true;
+		if (!carriesBrand(value)) return false;
+		return this.code === void 0 || value.code === this.code;
+	}
 	code;
 	detail;
+	[RECORDS_ERROR_BRAND] = true;
 	constructor(code, detail) {
 		super(`${PREFIX}${code}: ${detail}`);
 		this.name = "RecordsError";
@@ -6702,22 +6742,25 @@ var RecordsError = class extends Error {
 	}
 };
 /** The keychain could not store or serve a value: explicit, never an empty string. */
-var RecordSecretUnavailableError = class extends RecordsError {
+var RecordSecretUnavailableError = class RecordSecretUnavailableError extends RecordsError {
+	static code = "secret-unavailable";
 	constructor(detail) {
-		super("secret-unavailable", detail);
+		super(RecordSecretUnavailableError.code, detail);
 		this.name = "RecordSecretUnavailableError";
 	}
 };
-var InvalidRecordError = class extends RecordsError {
+var InvalidRecordError = class InvalidRecordError extends RecordsError {
+	static code = "invalid-record";
 	constructor(detail) {
-		super("invalid-record", detail);
+		super(InvalidRecordError.code, detail);
 		this.name = "InvalidRecordError";
 	}
 };
 /** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
-var DeclarationRefusedError = class extends RecordsError {
+var DeclarationRefusedError = class DeclarationRefusedError extends RecordsError {
+	static code = "declaration-refused";
 	constructor(detail) {
-		super("declaration-refused", detail);
+		super(DeclarationRefusedError.code, detail);
 		this.name = "DeclarationRefusedError";
 	}
 };
@@ -7204,17 +7247,35 @@ var RecordIntegrationInstances = class {
 			...kind !== void 0 ? { kind } : {}
 		});
 		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
+		const initial = this.hooks.initialBody(name, kind);
+		const patch = this.patchOf(values ?? {});
+		if (Object.keys(patch).length > 0) Object.assign(patch, await this.hooks.validateWrite?.({
+			kind,
+			body: {
+				...initial,
+				...patch
+			}
+		}));
 		await this.handle.put({
 			id: minted,
-			data: this.hooks.initialBody(name, kind)
+			data: initial
 		}, { ifRev: 0 });
-		const patch = this.patchOf(values ?? {});
 		if (Object.keys(patch).length > 0) await this.handle.patch(minted, patch);
 		await this.hooks.onChanged?.(minted, "created");
 		return { id: minted };
 	};
 	updateInstance = async ({ id, name, values }) => {
 		const patch = this.patchOf(values);
+		if (this.hooks.validateWrite !== void 0 && Object.keys(patch).length > 0) {
+			const stored = await this.handle.get(id);
+			if (stored !== null) Object.assign(patch, await this.hooks.validateWrite({
+				kind: void 0,
+				body: {
+					...stored.data,
+					...patch
+				}
+			}));
+		}
 		if (name !== void 0) patch[this.nameField] = name;
 		await this.handle.patch(id, patch);
 		await this.hooks.onChanged?.(id, "updated");
@@ -10556,7 +10617,6 @@ var CAP_NAMES = Object.freeze([
 	"notifier",
 	"numeric-sensor",
 	"oauth-integration",
-	"oidc-connections",
 	"osd",
 	"osd-manager",
 	"pet-feeder",
@@ -12448,8 +12508,7 @@ Object.freeze({
 	"device-provider": { "reloadDevice": 18e4 },
 	"llm": {
 		"generate": 6e5,
-		"generateVision": 6e5,
-		"testProfile": 6e5
+		"generateVision": 6e5
 	},
 	"llm-runtime": {
 		"complete": 6e5,
@@ -14074,17 +14133,18 @@ function composeInstanceKinds(parts, base) {
 * message to what the kind supports — callers never special-case a service.
 *
 * DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
+*  - A target is an INSTANCE of this function cap (epic #440, step 6): the
+*    providers serve their targets as `integration-instances` records, one
+*    record kind per target kind, and the admin lists, adds, edits, switches
+*    and deletes them through that cap. This cap keeps what an instance cannot
+*    say: the kind catalogue (`listTargetKinds`: capabilities, delivery
+*    parameters, brand icon), dispatch (`send`, `testTarget`) and the form
+*    helpers (`discoverTargets`, `probeTargetConfig`).
+*  - `listTargetKinds` / `discoverTargets` return arrays → the generated
+*    cap-mount auto-`concatCollection`-fans them across every registered
+*    provider so one catalog is routable. `send` / `testTarget` /
+*    `probeTargetConfig` route to ONE provider by the `addonId` the generated
+*    collection router extracts from the call input.
 *  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
 *    transformer) + UDS MsgPack both round-trip typed arrays — already used by
 *    `storage` / `storage-provider` / `recording` caps over the same path. No
@@ -14329,7 +14389,7 @@ var TargetKindCapsSchema = object({
 * the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough$4 = unknown();
+var ConfigSchemaPassthrough$3 = unknown();
 var TargetKindSchema = object({
 	kind: string(),
 	label: string(),
@@ -14366,7 +14426,7 @@ var TargetKindSchema = object({
 	* its raster path, which is the safe default for an unknown image.
 	*/
 	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough$4,
+	configSchema: ConfigSchemaPassthrough$3,
 	/**
 	* The config keys that decide WHERE this kind's secrets are sent (server,
 	* base URL, instance, chat, recipient). A save that changes any of them
@@ -14388,9 +14448,11 @@ var TargetKindSchema = object({
 	caps: TargetKindCapsSchema
 });
 /**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
+* A target as a provider's own code sees it (the notification-center bridge, the
+* send path): the flat record body split into the name, the switch and the
+* kind's fields. `config` holds secrets; a reader that serves it to a client
+* REDACTS secret fields (a presence marker only) — never round-trip a stored
+* secret to the UI.
 */
 var TargetSchema = object({
 	id: string(),
@@ -14433,13 +14495,13 @@ var ProbeTargetConfigResultSchema = object({
 	stateInstance: string().optional(),
 	error: string().optional()
 });
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({ targetId: string() }), TargetSchema, { auth: "admin" }), method(object({
+method(object({}), array(TargetKindSchema)), method(object({
 	kind: string(),
 	config: record(string(), unknown()).optional(),
 	/**
 	* When editing / duplicating, the blank password field never round-trips
 	* the stored token. Pass the source target id so the provider can restore
-	* secrets server-side before dialling (same merge as upsert).
+	* secrets server-side before dialling.
 	*/
 	targetId: string().optional()
 }), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
@@ -14462,27 +14524,6 @@ method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSche
 }), TestResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	target: TargetSchema,
-	/**
-	* Duplicate flow: create a NEW target id while copying secrets from an
-	* existing row. The UI never holds the stored token; blank / redacted
-	* password fields are restored from this source (D634 still applies if
-	* destinations diverge without a re-typed secret).
-	*/
-	cloneSecretsFrom: string().optional()
-}), TargetSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ targetId: string() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	enabled: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
 });
 looseObject({
 	name: string().min(1),
@@ -22750,7 +22791,6 @@ var SYSTEM_CAP_VOCABULARY = {
 	"notification-output": system("notification delivery — reached through notifier devices and rules"),
 	"notification-rules": system("notification rules — authored on their own page"),
 	"oauth-integration": system(IDENTITY),
-	"oidc-connections": system(IDENTITY),
 	"osd-manager": system(PIPELINE),
 	"pipeline-executor": system(PIPELINE),
 	"pipeline-orchestrator": system(PIPELINE),
@@ -54485,7 +54525,7 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 * or the redaction token KEEPS the stored secret; `{ $secretClear: true }`
 * clears it.
 */
-var ConfigSchemaPassthrough$3 = custom();
+var ConfigSchemaPassthrough$2 = custom();
 var IntegrationInstanceIdSchema = string().min(1);
 var IntegrationInstanceModeSchema = _enum(["single", "multiple"]);
 /**
@@ -54531,7 +54571,16 @@ var IntegrationInstanceKindSchema = object({
 	/** Relative hub path to start an interactive account link of an instance of this kind. */
 	connectPath: string().min(1).optional(),
 	/** Relative hub path to disconnect that account. */
-	disconnectPath: string().min(1).optional()
+	disconnectPath: string().min(1).optional(),
+	/**
+	* Parts of the edit dialog the flat form cannot draw (a node picker, a model source), named by a
+	* GENERIC widget id the client maps to a component; a client that knows none of them shows none.
+	* `connection` widgets write connection values, `model` widgets own the model choice.
+	*/
+	widgets: array(object({
+		id: string().min(1),
+		placement: _enum(["connection", "model"])
+	})).optional()
 });
 /**
 * How devices of an instance are found. `none`: the operator adds them by hand; `lan`: the addon
@@ -54636,7 +54685,7 @@ var integrationInstancesCapability = {
 			id: IntegrationInstanceIdSchema.nullable(),
 			/** The kind of the create form (`id: null`) of a provider with several. */
 			kind: string().min(1).optional()
-		}), ConfigSchemaPassthrough$3, { auth: "admin" }),
+		}), ConfigSchemaPassthrough$2, { auth: "admin" }),
 		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
 		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
 		/**
@@ -55587,12 +55636,12 @@ var LlmModelInfoSchema = object({
 });
 /**
 * The provider-specific part of a profile, validated by the provider that owns
-* the kind (`upsertProfile` refuses what it does not accept). A field its
+* the kind (saving an instance refuses what it does not accept). A field its
 * `connectionSchema` declares `type: 'password'` is a secret: it is held in the
 * keychain, never in the row, and reads back as the redaction marker.
 */
 var LlmProviderConfigSchema = record(string(), unknown());
-var LlmProfileSchema = object({
+object({
 	id: string(),
 	name: string(),
 	/** The provider-declared kind (`LlmProfileKindDescriptor.kind`). */
@@ -55686,8 +55735,8 @@ var LlmProviderWidgetSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$2 = unknown();
-var LlmProfileKindDescriptorSchema = object({
+var ConfigSchemaPassthrough$1 = unknown();
+object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	/** A generic icon name (`cloud`, `plug`, `cpu`) — never a glyph or a logo. */
@@ -55695,9 +55744,9 @@ var LlmProfileKindDescriptorSchema = object({
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
 	/** The provider's own fields (`providerConfig`); `password` fields are keychain-held. */
-	connectionSchema: ConfigSchemaPassthrough$2,
+	connectionSchema: ConfigSchemaPassthrough$1,
 	/** Provider fields that belong under "Advanced" (extra headers, runtime tuning). */
-	advancedSchema: ConfigSchemaPassthrough$2.optional(),
+	advancedSchema: ConfigSchemaPassthrough$1.optional(),
 	/** The kind's defaults; a model from `listModels` may override any of them. */
 	features: LlmModelFeaturesSchema,
 	/** `false` = the provider stamps `supportsVision` itself (from what a node reports). */
@@ -55826,20 +55875,7 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, {
 }), method(object({
 	addonId: string().optional(),
 	requestId: string()
-}), _void(), { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(ProfileRefInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(ProfileRefInputSchema, LlmGenerateResultSchema, {
-	kind: "mutation",
-	auth: "admin",
-	timeoutMs: AI_CAP_TRANSPORT_TIMEOUT_MS
-}), method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
+}), _void(), { kind: "mutation" }), method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), array(LlmDefaultSchema)), method(object({
@@ -56834,20 +56870,7 @@ method(_void(), MeshStatusSchema), method(object({
 /** Optional hostname override the host should advertise once joined. */
 hostname: string().optional() }), object({ 
 /** Authentication URL the operator should open in a browser. */
-loginUrl: string() }), { kind: "mutation" }), method(_void(), object({ left: literal(true) }), { kind: "mutation" }), method(_void(), object({ loggedOut: literal(true) }), { kind: "mutation" }), method(_void(), object({ peers: array(MeshPeerSchema).readonly() })), method(object({ 
-/** Optional auth key — when provided, probes the key validity
-*  against the provider's API. Omit when already joined to
-*  just ping the daemon. */
-authKey: string().optional() }), object({
-	ok: boolean(),
-	/** Provider-side identifier resolved by the probe (tailnet
-	*  name for Tailscale, network id for ZeroTier, etc.). */
-	tenant: string().optional(),
-	/** Daemon binary version, when reachable. */
-	daemonVersion: string().optional(),
-	/** Human-readable error when `ok: false`. */
-	error: string().optional()
-}), { kind: "mutation" });
+loginUrl: string() }), { kind: "mutation" }), method(_void(), object({ left: literal(true) }), { kind: "mutation" }), method(_void(), object({ loggedOut: literal(true) }), { kind: "mutation" }), method(_void(), object({ peers: array(MeshPeerSchema).readonly() }));
 object({
 	value: number().nullable().meta(readingMeta("device", { label: "Total" })),
 	lastFetchedAt: number()
@@ -66505,61 +66528,6 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
-* `oidc-connections` — CRUD for IdP rows under `auth-oidc` (D828 sibling).
-*
-* One hub-only singleton (`auth-oidc`). The Settings UI is a DataTable +
-* ItemFormDialog; there is no `editable-array` in `globalSettingsSchema`.
-* Operator-chosen `id` is the URL slug (`/addon/auth-oidc/<id>/…`) and is
-* immutable after create.
-*/
-var ConfigSchemaPassthrough$1 = unknown();
-var OidcConnectionSchema = object({
-	id: string().min(1),
-	displayName: string(),
-	icon: string(),
-	issuerUrl: string(),
-	clientId: string(),
-	/** Client id + secret present — never the secret value. */
-	configured: boolean(),
-	/**
-	* Values for the connection form schema. `clientSecret` is a keychain
-	* {@link SecretFieldView} or `null` / `''`, never plaintext (D789).
-	*/
-	formValues: record(string(), unknown()).optional()
-});
-/**
-* Patch one connection. Omitted or empty `clientSecret` keeps the stored
-* secret (D787). `{ $secretClear: true }` clears it. `id` is never renamed.
-*/
-var OidcConnectionUpdateInputSchema = object({
-	id: string().min(1),
-	displayName: string().min(1),
-	icon: string().optional(),
-	issuerUrl: string().optional(),
-	clientId: string().optional(),
-	clientSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
-	redirectUri: string().optional(),
-	scopes: string().optional(),
-	usernameClaim: _enum([
-		"preferred_username",
-		"email",
-		"sub"
-	]).optional()
-});
-method(object({}), ConfigSchemaPassthrough$1, { auth: "admin" }), method(object({}), array(OidcConnectionSchema).readonly(), { auth: "admin" }), method(object({
-	id: string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug"),
-	displayName: string().min(1)
-}), object({ id: string() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(OidcConnectionUpdateInputSchema, object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ id: string().min(1) }), object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * Generic on-screen-display (video overlay) cap. Each camera exposes
 * a firmware-defined list of overlays (channel name, timestamp,
 * watermark, logo, …); the cap models them as a homogeneous array of
@@ -72745,21 +72713,6 @@ method(object({
 	*/
 	ttlSec: union([number().int().positive(), literal("never")]).optional()
 }), object({ token: string() }), { auth: "admin" }), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable(), { auth: "admin" });
-var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object({
-	providerId: string().min(1),
-	displayName: string().min(1),
-	configSchema: unknown(),
-	nodeLocal: boolean(),
-	shouldSaveDiskSpace: literal(true),
-	minFreePercent: number().min(0).max(100)
-}), object({
-	providerId: string().min(1),
-	displayName: string().min(1),
-	configSchema: unknown(),
-	nodeLocal: boolean(),
-	shouldSaveDiskSpace: literal(false),
-	minFreePercent: literal(null)
-})]);
 method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
@@ -72821,42 +72774,7 @@ method(object({
 }), _instanceof(Uint8Array), { auth: "admin" }), method(object({ downloadId: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
-	createdAt: true,
-	updatedAt: true
-}), StorageLocationSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	id: string(),
-	force: boolean().optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(StorageDrainProgressSchema).readonly()), method(object({ id: string() }), object({
-	ok: boolean(),
-	error: string().optional()
-}), { auth: "admin" }), method(_void(), array(ProviderListEntrySchema).readonly()), method(object({
-	providerId: string(),
-	/**
-	* The location this config is an UNSAVED edit of, when there is one.
-	*
-	* `listLocations` replaces every declared secret with the redaction
-	* sentinel, so the edit modal's form state holds the sentinel for any
-	* credential the operator did not retype — and posting that here
-	* without a way to resolve it makes the provider try to authenticate
-	* as `__camstack_redacted__` and report the operator's own working
-	* password as wrong. Given this id, the orchestrator restores each
-	* sentinel from the stored config (same rule as `upsertLocation`)
-	* before dispatching. Omitted by the "Add location" wizard, where
-	* every value was typed just now and nothing is stored yet.
-	*/
-	locationId: string().optional(),
-	config: record(string(), unknown())
-}), object({
-	ok: boolean(),
-	error: string().optional()
-}), { auth: "admin" });
+}), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(_void(), array(StorageDrainProgressSchema).readonly());
 /** One table of the settings database. */
 var StorageTableSchema = object({
 	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
@@ -80449,13 +80367,6 @@ Object.freeze({
 		access: "delete",
 		role: "admin"
 	},
-	"llm.deleteProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"llm.generate": {
 		capName: "llm",
 		capScope: "system",
@@ -80519,20 +80430,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"llm.listProfileKinds": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"llm.listProfiles": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"llm.listRuntimeNodes": {
 		capName: "llm",
 		capScope: "system",
@@ -80540,13 +80437,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"llm.migrateRawSecrets": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"llm.resolveModelRef": {
 		capName: "llm",
 		capScope: "system",
@@ -80575,20 +80465,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"llm.testProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"llm.upsertProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"llmRuntime.appleAvailability": {
 		capName: "llm-runtime",
 		capScope: "system",
@@ -81093,13 +80969,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"meshNetwork.testConnection": {
-		capName: "mesh-network",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"meter.getStatus": {
 		capName: "meter",
 		capScope: "device",
@@ -81758,13 +81627,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.deleteTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"notificationOutput.discoverTargets": {
 		capName: "notification-output",
 		capScope: "system",
@@ -81772,13 +81634,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"notificationOutput.getTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"notificationOutput.listTargetKinds": {
 		capName: "notification-output",
 		capScope: "system",
@@ -81786,13 +81641,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"notificationOutput.listTargets": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"notificationOutput.probeTargetConfig": {
 		capName: "notification-output",
 		capScope: "system",
@@ -81807,13 +81655,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.setTargetEnabled": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"notificationOutput.testTarget": {
 		capName: "notification-output",
 		capScope: "system",
@@ -81821,13 +81662,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.upsertTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"notificationRules.activateAlarmProfile": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -82087,41 +81921,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"oidcConnections.connectionFormSchema": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"oidcConnections.createConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"oidcConnections.deleteConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
-	"oidcConnections.listConnections": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"oidcConnections.updateConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"osd.getStatus": {
 		capName: "osd",
 		capScope: "device",
@@ -85153,13 +84952,6 @@ Object.freeze({
 		access: "delete",
 		role: "admin"
 	},
-	"storage.deleteLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"storage.endDownload": {
 		capName: "storage",
 		capScope: "system",
@@ -85216,13 +85008,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"storage.listProviders": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"storage.read": {
 		capName: "storage",
 		capScope: "system",
@@ -85244,27 +85029,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"storage.testConfig": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"storage.testLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"storage.upsertLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"storage.write": {
 		capName: "storage",
 		capScope: "system",
@@ -91817,222 +91581,6 @@ var GoogleBrokerRegistry = class {
 	}
 };
 //#endregion
-//#region src/google-settings-copy.ts
-/**
-* Operator-facing setup copy for Connectivity → Calendars / Email.
-* Keep Connect as a same-origin relative link so the admin session cookie
-* rides along (an absolute Public URL from a LAN admin tab drops the cookie).
-* Root-relative hrefs must survive `sanitizeInfoHtml` in ui-library.
-*/
-/** Enable APIs library in Google Cloud Console. */
-var GOOGLE_CONSOLE_APIS_URL = "https://console.cloud.google.com/apis/library";
-/** Create / manage OAuth Web clients. */
-var GOOGLE_CONSOLE_CREDENTIALS_URL = "https://console.cloud.google.com/apis/credentials";
-function redirectUriDisplay(publicOrigin) {
-	if (publicOrigin === null || publicOrigin.length === 0) return `<public-hub>${OAUTH_CALLBACK_SUFFIX}`;
-	return `${publicOrigin.replace(/\/$/, "")}${OAUTH_CALLBACK_SUFFIX}`;
-}
-function consoleLinksHtml$1() {
-	return [
-		`<a href="${GOOGLE_CONSOLE_APIS_URL}">API library</a>`,
-		` · `,
-		`<a href="${GOOGLE_CONSOLE_CREDENTIALS_URL}">Credentials</a>`
-	].join("");
-}
-function introHtml(cap, publicOrigin) {
-	const redirect = escapeHtml$1(redirectUriDisplay(publicOrigin));
-	const console = consoleLinksHtml$1();
-	if (cap === "smtp-provider") return [
-		"<ol>",
-		`<li>Open Google Cloud Console (${console}) and enable the <strong>Gmail API</strong> (and Calendar API if you also use Calendars).</li>`,
-		"<li>Under Credentials, create an OAuth client of type <strong>Web application</strong>.</li>",
-		`<li>Add this authorized redirect URI (Network → <strong>Public endpoint</strong>, not Internal): <code>${redirect}</code></li>`,
-		"<li>Paste Client ID and Client secret below, then <strong>Save</strong>.</li>",
-		`<li>Open <a href="${OAUTH_START_PATH}">Connect Google</a> while signed in as admin (same browser tab as this hub).</li>`,
-		"<li>Set From address (connected account or a verified send-as). Turn this integration off with the page <strong>Enable</strong> toggle when you do not want Gmail send — Calendar can stay connected.</li>",
-		"</ol>"
-	].join("");
-	if (cap === "calendar-source") return [
-		"<ol>",
-		`<li>Open Google Cloud Console (${console}) and enable the <strong>Google Calendar API</strong> (and Gmail API if you also use Email).</li>`,
-		"<li>Under Credentials, create an OAuth client of type <strong>Web application</strong>.</li>",
-		`<li>Add this authorized redirect URI (Network → <strong>Public endpoint</strong>, not Internal): <code>${redirect}</code></li>`,
-		"<li>Paste Client ID and Client secret below, then <strong>Save</strong>.</li>",
-		`<li>Open <a href="${OAUTH_START_PATH}">Connect Google</a> while signed in as admin (same browser tab as this hub).</li>`,
-		"<li>Optionally restrict which calendars are exposed with the filter below.</li>",
-		"</ol>"
-	].join("");
-	return [
-		"<ol>",
-		`<li>Open Google Cloud Console (${console}) and enable <strong>Google Calendar API</strong> and <strong>Gmail API</strong>.</li>`,
-		"<li>Create a <strong>Web application</strong> OAuth client under Credentials.</li>",
-		`<li>Register redirect URI: <code>${redirect}</code> (Network → Public endpoint).</li>`,
-		`<li>Paste Client ID / secret, Save, then <a href="${OAUTH_START_PATH}">Connect Google</a>.</li>`,
-		"<li>Calendars and Email share one Google account; use each page’s <strong>Enable</strong> toggle to turn a capability off without revoking OAuth.</li>",
-		"</ol>"
-	].join("");
-}
-function connectHtml(cap, publicOrigin) {
-	const redirect = escapeHtml$1(redirectUriDisplay(publicOrigin));
-	if (cap === "smtp-provider") return [
-		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a> in this hub (admin session required). `,
-		"Connect requests <code>gmail.send</code> (and Calendar read for the Calendars page). ",
-		`Google must list exactly: <code>${redirect}</code>. `,
-		"If an older Connect predates Gmail send, revoke CamStack in Google Account → Security and Connect again. ",
-		`Console: ${consoleLinksHtml$1()}.`
-	].join("");
-	if (cap === "calendar-source") return [
-		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a> in this hub (admin session required). `,
-		"Connect requests <code>calendar.readonly</code> (and Gmail send for the Email page). ",
-		`Google must list exactly: <code>${redirect}</code>. `,
-		`Console: ${consoleLinksHtml$1()}.`
-	].join("");
-	return [
-		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a>. `,
-		`Redirect URI registered in Google Cloud must be <code>${redirect}</code>. `,
-		`Console: ${consoleLinksHtml$1()}.`
-	].join("");
-}
-function escapeHtml$1(s) {
-	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-//#endregion
-//#region src/google-broker-settings-schema.ts
-/**
-* Per-kind broker creation/edit form for kind=`google`.
-* Account linking (Sign in) is driven by the kind's `connectPath`
-* on the instances page — not a hard-coded Connect link in this form.
-*/
-function consoleLinksHtml() {
-	return [
-		`<a href="${GOOGLE_CONSOLE_APIS_URL}">API library</a>`,
-		` · `,
-		`<a href="${GOOGLE_CONSOLE_CREDENTIALS_URL}">Credentials</a>`
-	].join("");
-}
-/** Setup steps shown on Add / Edit — includes Audience / Test users. */
-function googleBrokerSetupHtml(publicOrigin) {
-	const redirect = escapeHtml(redirectUriDisplay(publicOrigin));
-	return [
-		"<ol>",
-		`<li>Open Google Cloud Console (${consoleLinksHtml()}). Create a <strong>new project</strong> (or pick an existing one) from the project picker at the top.</li>`,
-		"<li>In that project, enable <strong>Google Calendar API</strong> and/or <strong>Gmail API</strong> (API library).</li>",
-		"<li>Open <strong>Google Auth Platform → Audience</strong> (or APIs &amp; Services → OAuth consent screen → <strong>Audience</strong>). User type <strong>External</strong> + publishing status <strong>Testing</strong> is fine for a personal hub. Under <strong>Test users</strong>, add the Google account(s) that will Sign in — otherwise Google returns <code>403: access_denied</code>. (If you only see Branding / Data Access, open the <strong>Audience</strong> tab in the left sidebar of Google Auth Platform.) Publishing / verification is optional for a private hub.</li>",
-		"<li>Under Credentials, create an OAuth client of type <strong>Web application</strong>.</li>",
-		`<li>Add this authorized redirect URI (Network → <strong>Public endpoint</strong>, not Internal): <code>${redirect}</code></li>`,
-		"<li>Paste Client ID and Client secret below. <strong>Test connection</strong> checks those with Google (not the account yet).</li>",
-		"<li>Add the broker — the hub then opens Google sign-in in a popup to link the account (Calendar + Gmail). Use <strong>Sign in</strong> on the row if you skip or cancel.</li>",
-		"</ol>"
-	].join("");
-}
-function buildGoogleBrokerSettingsSchema(publicOrigin) {
-	return { sections: [
-		{
-			id: "setup-intro",
-			title: "Setup",
-			titleKey: "google-services:googleBrokerSettings.s_setup-intro.title",
-			description: "Google Cloud Console — register the hub redirect before Add / Sign in.",
-			descriptionKey: "google-services:googleBrokerSettings.s_setup-intro.description",
-			columns: 1,
-			fields: [{
-				type: "info",
-				key: "_setupSteps",
-				label: "Steps",
-				labelKey: "google-services:googleBrokerSettings.s_setup-intro._setupSteps.label",
-				format: "html",
-				content: googleBrokerSetupHtml(publicOrigin)
-			}]
-		},
-		{
-			id: "google-oauth-client",
-			title: "Google OAuth client",
-			titleKey: "google-services:googleBrokerSettings.s_google-oauth-client.title",
-			description: "Web application client from Google Cloud Console. The same Cloud project can be reused across Google brokers.",
-			descriptionKey: "google-services:googleBrokerSettings.s_google-oauth-client.description",
-			columns: 1,
-			fields: [{
-				type: "text",
-				key: "clientId",
-				label: "Client ID",
-				labelKey: "google-services:googleBrokerSettings.s_google-oauth-client.clientId.label"
-			}, {
-				type: "password",
-				key: "clientSecret",
-				label: "Client secret",
-				labelKey: "google-services:googleBrokerSettings.s_google-oauth-client.clientSecret.label",
-				showToggle: true
-			}]
-		},
-		{
-			id: "gmail-send",
-			title: "Gmail send",
-			titleKey: "google-services:googleBrokerSettings.s_gmail-send.title",
-			description: "From must be this connected account or a verified send-as. Disable Email on Connectivity to turn Gmail off without removing the broker.",
-			descriptionKey: "google-services:googleBrokerSettings.s_gmail-send.description",
-			columns: 1,
-			fields: [{
-				type: "text",
-				key: "fromAddress",
-				label: "From address",
-				labelKey: "google-services:googleBrokerSettings.s_gmail-send.fromAddress.label",
-				description: "Defaults to the connected Google account email when empty.",
-				descriptionKey: "google-services:googleBrokerSettings.s_gmail-send.fromAddress.description"
-			}, {
-				type: "text",
-				key: "fromName",
-				label: "From display name (optional)",
-				labelKey: "google-services:googleBrokerSettings.s_gmail-send.fromName.label"
-			}]
-		}
-	] };
-}
-/** Connectivity Calendars / Email pages — the calendar import picker is on each broker. */
-function buildGoogleFeatureSettingsSchema(cap, publicOrigin) {
-	const redirect = escapeHtml(redirectUriDisplay(publicOrigin));
-	if (cap === "calendar-source") return { sections: [{
-		id: "setup-intro",
-		title: "Google brokers",
-		titleKey: "google-services:googleFeatureSettings.s_setup-intro.title",
-		columns: 1,
-		fields: [{
-			type: "info",
-			key: "_setupSteps",
-			label: "Setup",
-			labelKey: "google-services:googleFeatureSettings.s_setup-intro._setupSteps.label",
-			format: "html",
-			content: [
-				"<p>Link a Google account under Connectivity → <strong>Brokers</strong> ",
-				"(Client ID / secret + Sign in), then add a calendar under Connectivity → <strong>Calendars</strong>. ",
-				`OAuth redirect URI: <code>${redirect}</code>.</p>`
-			].join("")
-		}]
-	}] };
-	return { sections: [{
-		id: "setup-intro",
-		title: cap === "smtp-provider" ? "Gmail send uses Google brokers" : "Google brokers",
-		columns: 1,
-		fields: [{
-			type: "info",
-			key: "_setupSteps",
-			label: "Setup",
-			labelKey: "google-services:googleFeatureSettings._setupSteps.label",
-			format: "html",
-			content: cap === "smtp-provider" ? [
-				"<p>Add or edit a <strong>Google</strong> broker under Connectivity → <strong>Brokers</strong> ",
-				"(Client ID / secret + Sign in). From address and send-as live on that broker. ",
-				`OAuth redirect URI: <code>${redirect}</code>.</p>`
-			].join("") : [
-				"<p>Add or edit a <strong>Google</strong> broker under Connectivity → <strong>Brokers</strong> ",
-				"(Client ID / secret + Sign in). ",
-				`OAuth redirect URI: <code>${redirect}</code>.</p>`
-			].join("")
-		}]
-	}] };
-}
-function escapeHtml(s) {
-	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-//#endregion
 //#region src/google-calendar-source.ts
 function parseGoogleInstant(value) {
 	const ms = Date.parse(value);
@@ -92553,6 +92101,179 @@ function buildGoogleCalendarInstances(records, deps) {
 	});
 }
 //#endregion
+//#region src/google-settings-copy.ts
+/**
+* Operator-facing setup copy for Connectivity → Calendars / Email.
+* Keep Connect as a same-origin relative link so the admin session cookie
+* rides along (an absolute Public URL from a LAN admin tab drops the cookie).
+* Root-relative hrefs must survive `sanitizeInfoHtml` in ui-library.
+*/
+/** Enable APIs library in Google Cloud Console. */
+var GOOGLE_CONSOLE_APIS_URL = "https://console.cloud.google.com/apis/library";
+/** Create / manage OAuth Web clients. */
+var GOOGLE_CONSOLE_CREDENTIALS_URL = "https://console.cloud.google.com/apis/credentials";
+function redirectUriDisplay(publicOrigin) {
+	if (publicOrigin === null || publicOrigin.length === 0) return `<public-hub>${OAUTH_CALLBACK_SUFFIX}`;
+	return `${publicOrigin.replace(/\/$/, "")}${OAUTH_CALLBACK_SUFFIX}`;
+}
+function consoleLinksHtml$1() {
+	return [
+		`<a href="${GOOGLE_CONSOLE_APIS_URL}">API library</a>`,
+		` · `,
+		`<a href="${GOOGLE_CONSOLE_CREDENTIALS_URL}">Credentials</a>`
+	].join("");
+}
+function introHtml(cap, publicOrigin) {
+	const redirect = escapeHtml$1(redirectUriDisplay(publicOrigin));
+	const console = consoleLinksHtml$1();
+	if (cap === "smtp-provider") return [
+		"<ol>",
+		`<li>Open Google Cloud Console (${console}) and enable the <strong>Gmail API</strong> (and Calendar API if you also use Calendars).</li>`,
+		"<li>Under Credentials, create an OAuth client of type <strong>Web application</strong>.</li>",
+		`<li>Add this authorized redirect URI (Network → <strong>Public endpoint</strong>, not Internal): <code>${redirect}</code></li>`,
+		"<li>Paste Client ID and Client secret below, then <strong>Save</strong>.</li>",
+		`<li>Open <a href="${OAUTH_START_PATH}">Connect Google</a> while signed in as admin (same browser tab as this hub).</li>`,
+		"<li>Set From address (connected account or a verified send-as). Turn this integration off with the page <strong>Enable</strong> toggle when you do not want Gmail send — Calendar can stay connected.</li>",
+		"</ol>"
+	].join("");
+	if (cap === "calendar-source") return [
+		"<ol>",
+		`<li>Open Google Cloud Console (${console}) and enable the <strong>Google Calendar API</strong> (and Gmail API if you also use Email).</li>`,
+		"<li>Under Credentials, create an OAuth client of type <strong>Web application</strong>.</li>",
+		`<li>Add this authorized redirect URI (Network → <strong>Public endpoint</strong>, not Internal): <code>${redirect}</code></li>`,
+		"<li>Paste Client ID and Client secret below, then <strong>Save</strong>.</li>",
+		`<li>Open <a href="${OAUTH_START_PATH}">Connect Google</a> while signed in as admin (same browser tab as this hub).</li>`,
+		"<li>Optionally restrict which calendars are exposed with the filter below.</li>",
+		"</ol>"
+	].join("");
+	return [
+		"<ol>",
+		`<li>Open Google Cloud Console (${console}) and enable <strong>Google Calendar API</strong> and <strong>Gmail API</strong>.</li>`,
+		"<li>Create a <strong>Web application</strong> OAuth client under Credentials.</li>",
+		`<li>Register redirect URI: <code>${redirect}</code> (Network → Public endpoint).</li>`,
+		`<li>Paste Client ID / secret, Save, then <a href="${OAUTH_START_PATH}">Connect Google</a>.</li>`,
+		"<li>Calendars and Email share one Google account; use each page’s <strong>Enable</strong> toggle to turn a capability off without revoking OAuth.</li>",
+		"</ol>"
+	].join("");
+}
+function connectHtml(cap, publicOrigin) {
+	const redirect = escapeHtml$1(redirectUriDisplay(publicOrigin));
+	if (cap === "smtp-provider") return [
+		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a> in this hub (admin session required). `,
+		"Connect requests <code>gmail.send</code> (and Calendar read for the Calendars page). ",
+		`Google must list exactly: <code>${redirect}</code>. `,
+		"If an older Connect predates Gmail send, revoke CamStack in Google Account → Security and Connect again. ",
+		`Console: ${consoleLinksHtml$1()}.`
+	].join("");
+	if (cap === "calendar-source") return [
+		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a> in this hub (admin session required). `,
+		"Connect requests <code>calendar.readonly</code> (and Gmail send for the Email page). ",
+		`Google must list exactly: <code>${redirect}</code>. `,
+		`Console: ${consoleLinksHtml$1()}.`
+	].join("");
+	return [
+		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a>. `,
+		`Redirect URI registered in Google Cloud must be <code>${redirect}</code>. `,
+		`Console: ${consoleLinksHtml$1()}.`
+	].join("");
+}
+function escapeHtml$1(s) {
+	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+//#endregion
+//#region src/google-broker-settings-schema.ts
+/**
+* Per-kind broker creation/edit form for kind=`google`.
+* Account linking (Sign in) is driven by the kind's `connectPath`
+* on the instances page — not a hard-coded Connect link in this form.
+*/
+function consoleLinksHtml() {
+	return [
+		`<a href="${GOOGLE_CONSOLE_APIS_URL}">API library</a>`,
+		` · `,
+		`<a href="${GOOGLE_CONSOLE_CREDENTIALS_URL}">Credentials</a>`
+	].join("");
+}
+/** Setup steps shown on Add / Edit — includes Audience / Test users. */
+function googleBrokerSetupHtml(publicOrigin) {
+	const redirect = escapeHtml(redirectUriDisplay(publicOrigin));
+	return [
+		"<ol>",
+		`<li>Open Google Cloud Console (${consoleLinksHtml()}). Create a <strong>new project</strong> (or pick an existing one) from the project picker at the top.</li>`,
+		"<li>In that project, enable <strong>Google Calendar API</strong> and/or <strong>Gmail API</strong> (API library).</li>",
+		"<li>Open <strong>Google Auth Platform → Audience</strong> (or APIs &amp; Services → OAuth consent screen → <strong>Audience</strong>). User type <strong>External</strong> + publishing status <strong>Testing</strong> is fine for a personal hub. Under <strong>Test users</strong>, add the Google account(s) that will Sign in — otherwise Google returns <code>403: access_denied</code>. (If you only see Branding / Data Access, open the <strong>Audience</strong> tab in the left sidebar of Google Auth Platform.) Publishing / verification is optional for a private hub.</li>",
+		"<li>Under Credentials, create an OAuth client of type <strong>Web application</strong>.</li>",
+		`<li>Add this authorized redirect URI (Network → <strong>Public endpoint</strong>, not Internal): <code>${redirect}</code></li>`,
+		"<li>Paste Client ID and Client secret below. <strong>Test connection</strong> checks those with Google (not the account yet).</li>",
+		"<li>Add the broker — the hub then opens Google sign-in in a popup to link the account (Calendar + Gmail). Use <strong>Sign in</strong> on the row if you skip or cancel.</li>",
+		"</ol>"
+	].join("");
+}
+function buildGoogleBrokerSettingsSchema(publicOrigin) {
+	return { sections: [
+		{
+			id: "setup-intro",
+			title: "Setup",
+			titleKey: "google-services:googleBrokerSettings.s_setup-intro.title",
+			description: "Google Cloud Console — register the hub redirect before Add / Sign in.",
+			descriptionKey: "google-services:googleBrokerSettings.s_setup-intro.description",
+			columns: 1,
+			fields: [{
+				type: "info",
+				key: "_setupSteps",
+				label: "Steps",
+				labelKey: "google-services:googleBrokerSettings.s_setup-intro._setupSteps.label",
+				format: "html",
+				content: googleBrokerSetupHtml(publicOrigin)
+			}]
+		},
+		{
+			id: "google-oauth-client",
+			title: "Google OAuth client",
+			titleKey: "google-services:googleBrokerSettings.s_google-oauth-client.title",
+			description: "Web application client from Google Cloud Console. The same Cloud project can be reused across Google brokers.",
+			descriptionKey: "google-services:googleBrokerSettings.s_google-oauth-client.description",
+			columns: 1,
+			fields: [{
+				type: "text",
+				key: "clientId",
+				label: "Client ID",
+				labelKey: "google-services:googleBrokerSettings.s_google-oauth-client.clientId.label"
+			}, {
+				type: "password",
+				key: "clientSecret",
+				label: "Client secret",
+				labelKey: "google-services:googleBrokerSettings.s_google-oauth-client.clientSecret.label",
+				showToggle: true
+			}]
+		},
+		{
+			id: "gmail-send",
+			title: "Gmail send",
+			titleKey: "google-services:googleBrokerSettings.s_gmail-send.title",
+			description: "From must be this connected account or a verified send-as. Disable Email on Connectivity to turn Gmail off without removing the broker.",
+			descriptionKey: "google-services:googleBrokerSettings.s_gmail-send.description",
+			columns: 1,
+			fields: [{
+				type: "text",
+				key: "fromAddress",
+				label: "From address",
+				labelKey: "google-services:googleBrokerSettings.s_gmail-send.fromAddress.label",
+				description: "Defaults to the connected Google account email when empty.",
+				descriptionKey: "google-services:googleBrokerSettings.s_gmail-send.fromAddress.description"
+			}, {
+				type: "text",
+				key: "fromName",
+				label: "From display name (optional)",
+				labelKey: "google-services:googleBrokerSettings.s_gmail-send.fromName.label"
+			}]
+		}
+	] };
+}
+function escapeHtml(s) {
+	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+//#endregion
 //#region src/google-instances.ts
 /**
 * The Google accounts as `integration-instances` (planning#408 P3): one instance per broker
@@ -93839,21 +93560,6 @@ var GoogleServicesAddon = class extends BaseAddon {
 			this.publicOrigin = null;
 		}
 	}
-	/**
-	* Connectivity Calendars / Email: point at Brokers (no duplicate OAuth fields).
-	* Addon page without cap: same pointer + note.
-	*/
-	globalSettingsSchema(cap) {
-		const scoped = asSettingsCap(cap);
-		return this.schema(buildGoogleFeatureSettingsSchema(scoped, this.publicOrigin));
-	}
-	async getGlobalSettings(overlay, cap, nodeId) {
-		await this.refreshPublicOrigin();
-		return super.getGlobalSettings(overlay, cap, nodeId);
-	}
 };
-function asSettingsCap(cap) {
-	if (cap === "calendar-source" || cap === "smtp-provider") return cap;
-}
 //#endregion
-export { GOOGLE_OAUTH_SCOPES as C, GoogleServicesAddon, GoogleServicesAddon as default, GOOGLE_GMAIL_SEND_SCOPE as S, OAUTH_START_PATH as T, GoogleBrokerRegistry as _, refreshAccessToken as a, DEFAULT_GOOGLE_CONFIG as b, selectGmailAccount as c, mapGoogleEvent as d, GOOGLE_CONSOLE_APIS_URL as f, redirectUriDisplay as g, introHtml as h, needsRefresh as i, createGoogleCalendarApi as l, connectHtml as m, buildAuthorizeUrl as n, buildRawMime as o, GOOGLE_CONSOLE_CREDENTIALS_URL as p, exchangeCode as r, createGmailSmtpProvider as s, applyTokenResponse as t, createGoogleCalendarSource as u, parseStampedCalendarId as v, GoogleServicesConfigSchema as w, GOOGLE_BROKER_KIND as x, stampCalendarId as y };
+export { GOOGLE_OAUTH_SCOPES as C, GoogleServicesAddon, GoogleServicesAddon as default, GOOGLE_GMAIL_SEND_SCOPE as S, OAUTH_START_PATH as T, GoogleBrokerRegistry as _, redirectUriDisplay as a, DEFAULT_GOOGLE_CONFIG as b, exchangeCode as c, buildRawMime as d, createGmailSmtpProvider as f, mapGoogleEvent as g, createGoogleCalendarSource as h, introHtml as i, needsRefresh as l, createGoogleCalendarApi as m, GOOGLE_CONSOLE_CREDENTIALS_URL as n, applyTokenResponse as o, selectGmailAccount as p, connectHtml as r, buildAuthorizeUrl as s, GOOGLE_CONSOLE_APIS_URL as t, refreshAccessToken as u, parseStampedCalendarId as v, GoogleServicesConfigSchema as w, GOOGLE_BROKER_KIND as x, stampCalendarId as y };