@camstack/addon-import-alexa 0.2.193 → 0.2.195

package/dist/addon.js

@@ -48,7 +48,7 @@ node_fs = __toESM(node_fs, 1);
 let node_child_process = require("node:child_process");
 require("node:zlib");
 let node_url = require("node:url");
-//#region ../types/dist/event-category-BmPm98n0.mjs
+//#region ../types/dist/event-category-78tcBemo.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -169,6 +169,23 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AddonLoadRecovered"] = "addon.load-recovered";
 	/**
+	* An addon is RUNNING although its installed package is below what the
+	* running server requires (`camstack.requires.addons` of the server, or the
+	* addon's own `requires.server`). Raised once per streak by the unsupported-
+	* addon tracker, on the hub and on agents; AlertCenter turns it into one
+	* operator alert per node and package. The addon is never held back for it.
+	*
+	* Payload: `{ packageName, addonId, nodeId, installedVersion, requiredMinimum, serverVersion, unmet }`.
+	*/
+	EventCategory["AddonUnsupportedVersion"] = "addon.unsupported-version";
+	/**
+	* The package of an {@link AddonUnsupportedVersion} alert reached a supported
+	* version, or is no longer installed on the node. AlertCenter dismisses the matching alert.
+	*
+	* Payload: `{ packageName, addonId, nodeId }`.
+	*/
+	EventCategory["AddonUnsupportedResolved"] = "addon.unsupported-resolved";
+	/**
 	* Monitor scheduled the next retry for a failed addon. Transient —
 	* surfaced to the UI for live-updating the "next retry in Ns"
 	* countdown on the Addons page row, NOT persisted as an alert.
@@ -279,7 +296,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["ProcessRestarted"] = "process.restarted";
 	/**
 	* The SET of storage locations changed — one was created, edited, enabled,
-	* disabled or deleted through `storage.upsertLocation` / `deleteLocation`.
+	* disabled or deleted through the location instances or the forced-delete action.
 	*
 	* Telemetry, not a transaction (D8/D11): every consumer that re-resolves on
 	* it must also converge on its own periodic path, because a dropped event
@@ -6044,7 +6061,7 @@ function number(params) {
 	return /* @__PURE__ */ _coercedNumber(ZodNumber, params);
 }
 //#endregion
-//#region ../types/dist/sleep-CdKka2ri.mjs
+//#region ../types/dist/sleep-AEnTN3b4.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6753,10 +6770,33 @@ function integrationRowsApiOver(api) {
 	};
 }
 var PREFIX = "records/";
+/**
+* Cross-realm brand. An addon bundles its own copy of this module (D15) while
+* `ctx.records` is the HOST's door, so an error thrown by the host is an
+* instance of the host's classes, not of the addon's. The brand plus the code
+* make `instanceof` answer by identity of the failure, not of the copy.
+*/
+var RECORDS_ERROR_BRAND = Symbol.for("camstack.records-error");
+function carriesBrand(value) {
+	return typeof value === "object" && value !== null && Reflect.get(value, RECORDS_ERROR_BRAND) === true;
+}
 /** The base of every records failure. `detail` is the human part of the message. */
 var RecordsError = class extends Error {
+	/** The code a subclass stands for; the base stands for every code. */
+	static code = void 0;
+	/**
+	* `instanceof` across copies of this module: any branded error is a
+	* `RecordsError`, and is an instance of a subclass only when its code is the
+	* subclass's code. Same-copy answers are unchanged.
+	*/
+	static [Symbol.hasInstance](value) {
+		if (Function.prototype[Symbol.hasInstance].call(this, value)) return true;
+		if (!carriesBrand(value)) return false;
+		return this.code === void 0 || value.code === this.code;
+	}
 	code;
 	detail;
+	[RECORDS_ERROR_BRAND] = true;
 	constructor(code, detail) {
 		super(`${PREFIX}${code}: ${detail}`);
 		this.name = "RecordsError";
@@ -6765,29 +6805,33 @@ var RecordsError = class extends Error {
 	}
 };
 /** A write guarded by `ifRev` found another revision (or an existing row for `ifRev: 0`). */
-var RevConflictError = class extends RecordsError {
+var RevConflictError = class RevConflictError extends RecordsError {
+	static code = "rev-conflict";
 	constructor(detail) {
-		super("rev-conflict", detail);
+		super(RevConflictError.code, detail);
 		this.name = "RevConflictError";
 	}
 };
 /** The keychain could not store or serve a value: explicit, never an empty string. */
-var RecordSecretUnavailableError = class extends RecordsError {
+var RecordSecretUnavailableError = class RecordSecretUnavailableError extends RecordsError {
+	static code = "secret-unavailable";
 	constructor(detail) {
-		super("secret-unavailable", detail);
+		super(RecordSecretUnavailableError.code, detail);
 		this.name = "RecordSecretUnavailableError";
 	}
 };
-var InvalidRecordError = class extends RecordsError {
+var InvalidRecordError = class InvalidRecordError extends RecordsError {
+	static code = "invalid-record";
 	constructor(detail) {
-		super("invalid-record", detail);
+		super(InvalidRecordError.code, detail);
 		this.name = "InvalidRecordError";
 	}
 };
 /** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
-var DeclarationRefusedError = class extends RecordsError {
+var DeclarationRefusedError = class DeclarationRefusedError extends RecordsError {
+	static code = "declaration-refused";
 	constructor(detail) {
-		super("declaration-refused", detail);
+		super(DeclarationRefusedError.code, detail);
 		this.name = "DeclarationRefusedError";
 	}
 };
@@ -7281,17 +7325,35 @@ var RecordIntegrationInstances = class {
 			...kind !== void 0 ? { kind } : {}
 		});
 		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
+		const initial = this.hooks.initialBody(name, kind);
+		const patch = this.patchOf(values ?? {});
+		if (Object.keys(patch).length > 0) Object.assign(patch, await this.hooks.validateWrite?.({
+			kind,
+			body: {
+				...initial,
+				...patch
+			}
+		}));
 		await this.handle.put({
 			id: minted,
-			data: this.hooks.initialBody(name, kind)
+			data: initial
 		}, { ifRev: 0 });
-		const patch = this.patchOf(values ?? {});
 		if (Object.keys(patch).length > 0) await this.handle.patch(minted, patch);
 		await this.hooks.onChanged?.(minted, "created");
 		return { id: minted };
 	};
 	updateInstance = async ({ id, name, values }) => {
 		const patch = this.patchOf(values);
+		if (this.hooks.validateWrite !== void 0 && Object.keys(patch).length > 0) {
+			const stored = await this.handle.get(id);
+			if (stored !== null) Object.assign(patch, await this.hooks.validateWrite({
+				kind: void 0,
+				body: {
+					...stored.data,
+					...patch
+				}
+			}));
+		}
 		if (name !== void 0) patch[this.nameField] = name;
 		await this.handle.patch(id, patch);
 		await this.hooks.onChanged?.(id, "updated");
@@ -10637,7 +10699,6 @@ var CAP_NAMES = Object.freeze([
 	"notifier",
 	"numeric-sensor",
 	"oauth-integration",
-	"oidc-connections",
 	"osd",
 	"osd-manager",
 	"pet-feeder",
@@ -12529,8 +12590,7 @@ Object.freeze({
 	"device-provider": { "reloadDevice": 18e4 },
 	"llm": {
 		"generate": 6e5,
-		"generateVision": 6e5,
-		"testProfile": 6e5
+		"generateVision": 6e5
 	},
 	"llm-runtime": {
 		"complete": 6e5,
@@ -14141,17 +14201,18 @@ function composeInstanceKinds(parts, base) {
 * message to what the kind supports — callers never special-case a service.
 *
 * DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
+*  - A target is an INSTANCE of this function cap (epic #440, step 6): the
+*    providers serve their targets as `integration-instances` records, one
+*    record kind per target kind, and the admin lists, adds, edits, switches
+*    and deletes them through that cap. This cap keeps what an instance cannot
+*    say: the kind catalogue (`listTargetKinds`: capabilities, delivery
+*    parameters, brand icon), dispatch (`send`, `testTarget`) and the form
+*    helpers (`discoverTargets`, `probeTargetConfig`).
+*  - `listTargetKinds` / `discoverTargets` return arrays → the generated
+*    cap-mount auto-`concatCollection`-fans them across every registered
+*    provider so one catalog is routable. `send` / `testTarget` /
+*    `probeTargetConfig` route to ONE provider by the `addonId` the generated
+*    collection router extracts from the call input.
 *  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
 *    transformer) + UDS MsgPack both round-trip typed arrays — already used by
 *    `storage` / `storage-provider` / `recording` caps over the same path. No
@@ -14396,7 +14457,7 @@ var TargetKindCapsSchema = object({
 * the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough$4 = unknown();
+var ConfigSchemaPassthrough$3 = unknown();
 var TargetKindSchema = object({
 	kind: string(),
 	label: string(),
@@ -14433,7 +14494,7 @@ var TargetKindSchema = object({
 	* its raster path, which is the safe default for an unknown image.
 	*/
 	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough$4,
+	configSchema: ConfigSchemaPassthrough$3,
 	/**
 	* The config keys that decide WHERE this kind's secrets are sent (server,
 	* base URL, instance, chat, recipient). A save that changes any of them
@@ -14455,9 +14516,11 @@ var TargetKindSchema = object({
 	caps: TargetKindCapsSchema
 });
 /**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
+* A target as a provider's own code sees it (the notification-center bridge, the
+* send path): the flat record body split into the name, the switch and the
+* kind's fields. `config` holds secrets; a reader that serves it to a client
+* REDACTS secret fields (a presence marker only) — never round-trip a stored
+* secret to the UI.
 */
 var TargetSchema = object({
 	id: string(),
@@ -14506,21 +14569,13 @@ var notificationOutputCapability = {
 	mode: "collection",
 	methods: {
 		listTargetKinds: method(object({}), array(TargetKindSchema)),
-		listTargets: method(object({}), array(TargetSchema), { auth: "admin" }),
-		/**
-		* One target WITH secrets — admin edit / duplicate hydration only.
-		* `listTargets` stays redacted; the editor loads this so password fields
-		* are filled (masked in the input) and a save can round-trip the token
-		* when a destination changes (Duplicate with a new chatId, etc.).
-		*/
-		getTarget: method(object({ targetId: string() }), TargetSchema, { auth: "admin" }),
 		discoverTargets: method(object({
 			kind: string(),
 			config: record(string(), unknown()).optional(),
 			/**
 			* When editing / duplicating, the blank password field never round-trips
 			* the stored token. Pass the source target id so the provider can restore
-			* secrets server-side before dialling (same merge as upsert).
+			* secrets server-side before dialling.
 			*/
 			targetId: string().optional()
 		}), array(DiscoveredTargetSchema), { auth: "admin" }),
@@ -14546,30 +14601,6 @@ var notificationOutputCapability = {
 		}), TestResultSchema, {
 			kind: "mutation",
 			auth: "admin"
-		}),
-		upsertTarget: method(object({
-			target: TargetSchema,
-			/**
-			* Duplicate flow: create a NEW target id while copying secrets from an
-			* existing row. The UI never holds the stored token; blank / redacted
-			* password fields are restored from this source (D634 still applies if
-			* destinations diverge without a re-typed secret).
-			*/
-			cloneSecretsFrom: string().optional()
-		}), TargetSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		deleteTarget: method(object({ targetId: string() }), _void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		setTargetEnabled: method(object({
-			targetId: string(),
-			enabled: boolean()
-		}), _void(), {
-			kind: "mutation",
-			auth: "admin"
 		})
 	}
 };
@@ -14585,8 +14616,9 @@ var notificationOutputCapability = {
 *
 * Three providers (notifiers, Home Assistant, Alexa) serve the same shape, so the pieces are shared:
 *  - {@link defineNotificationTargetKind}: the record kind of one `TargetKind` descriptor;
-*  - {@link NotificationTargetStore}: the `Target`-shaped facade the existing provider code keeps
-*    using, over one handle per kind (the old `notification-output` CRUD keeps working on it);
+*  - {@link NotificationTargetStore}: the `Target`-shaped facade the provider's own code keeps
+*    using (send, the notification-center bridge), over one handle per kind;
+*  - {@link listNotificationTargets}: the targets as an addon on `ctx.api` reads them;
 *  - {@link buildNotificationTargetInstances}: the `integration-instances` provider, one kind each;
 *  - {@link moveTargetRows}: the D987 procedure that flattens the old `config` blobs into the bodies.
 */
@@ -14843,6 +14875,10 @@ function notificationTargetParts(records, spec) {
 			initialBody: (name) => ({ name }),
 			mintId: () => spec.mintId(),
 			configured: () => true,
+			validateWrite: ({ body }) => spec.validate?.({
+				kind: descriptor.kind,
+				config: body
+			}),
 			test: async ({ id, values }) => {
 				if (spec.probe === void 0 || !canTest) return {
 					success: false,
@@ -23238,7 +23274,6 @@ var SYSTEM_CAP_VOCABULARY = {
 	"notification-output": system("notification delivery — reached through notifier devices and rules"),
 	"notification-rules": system("notification rules — authored on their own page"),
 	"oauth-integration": system(IDENTITY),
-	"oidc-connections": system(IDENTITY),
 	"osd-manager": system(PIPELINE),
 	"pipeline-executor": system(PIPELINE),
 	"pipeline-orchestrator": system(PIPELINE),
@@ -57030,7 +57065,7 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 * or the redaction token KEEPS the stored secret; `{ $secretClear: true }`
 * clears it.
 */
-var ConfigSchemaPassthrough$3 = custom();
+var ConfigSchemaPassthrough$2 = custom();
 var IntegrationInstanceIdSchema = string().min(1);
 var IntegrationInstanceModeSchema = _enum(["single", "multiple"]);
 /**
@@ -57076,7 +57111,16 @@ var IntegrationInstanceKindSchema = object({
 	/** Relative hub path to start an interactive account link of an instance of this kind. */
 	connectPath: string().min(1).optional(),
 	/** Relative hub path to disconnect that account. */
-	disconnectPath: string().min(1).optional()
+	disconnectPath: string().min(1).optional(),
+	/**
+	* Parts of the edit dialog the flat form cannot draw (a node picker, a model source), named by a
+	* GENERIC widget id the client maps to a component; a client that knows none of them shows none.
+	* `connection` widgets write connection values, `model` widgets own the model choice.
+	*/
+	widgets: array(object({
+		id: string().min(1),
+		placement: _enum(["connection", "model"])
+	})).optional()
 });
 /**
 * How devices of an instance are found. `none`: the operator adds them by hand; `lan`: the addon
@@ -57181,7 +57225,7 @@ var integrationInstancesCapability = {
 			id: IntegrationInstanceIdSchema.nullable(),
 			/** The kind of the create form (`id: null`) of a provider with several. */
 			kind: string().min(1).optional()
-		}), ConfigSchemaPassthrough$3, { auth: "admin" }),
+		}), ConfigSchemaPassthrough$2, { auth: "admin" }),
 		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
 		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
 		/**
@@ -58283,12 +58327,12 @@ var LlmModelInfoSchema = object({
 });
 /**
 * The provider-specific part of a profile, validated by the provider that owns
-* the kind (`upsertProfile` refuses what it does not accept). A field its
+* the kind (saving an instance refuses what it does not accept). A field its
 * `connectionSchema` declares `type: 'password'` is a secret: it is held in the
 * keychain, never in the row, and reads back as the redaction marker.
 */
 var LlmProviderConfigSchema = record(string(), unknown());
-var LlmProfileSchema = object({
+object({
 	id: string(),
 	name: string(),
 	/** The provider-declared kind (`LlmProfileKindDescriptor.kind`). */
@@ -58382,8 +58426,8 @@ var LlmProviderWidgetSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$2 = unknown();
-var LlmProfileKindDescriptorSchema = object({
+var ConfigSchemaPassthrough$1 = unknown();
+object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	/** A generic icon name (`cloud`, `plug`, `cpu`) — never a glyph or a logo. */
@@ -58391,9 +58435,9 @@ var LlmProfileKindDescriptorSchema = object({
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
 	/** The provider's own fields (`providerConfig`); `password` fields are keychain-held. */
-	connectionSchema: ConfigSchemaPassthrough$2,
+	connectionSchema: ConfigSchemaPassthrough$1,
 	/** Provider fields that belong under "Advanced" (extra headers, runtime tuning). */
-	advancedSchema: ConfigSchemaPassthrough$2.optional(),
+	advancedSchema: ConfigSchemaPassthrough$1.optional(),
 	/** The kind's defaults; a model from `listModels` may override any of them. */
 	features: LlmModelFeaturesSchema,
 	/** `false` = the provider stamps `supportsVision` itself (from what a node reports). */
@@ -58522,20 +58566,7 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, {
 }), method(object({
 	addonId: string().optional(),
 	requestId: string()
-}), _void(), { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(ProfileRefInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(ProfileRefInputSchema, LlmGenerateResultSchema, {
-	kind: "mutation",
-	auth: "admin",
-	timeoutMs: AI_CAP_TRANSPORT_TIMEOUT_MS
-}), method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
+}), _void(), { kind: "mutation" }), method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), array(LlmDefaultSchema)), method(object({
@@ -59598,20 +59629,7 @@ method(_void(), MeshStatusSchema), method(object({
 /** Optional hostname override the host should advertise once joined. */
 hostname: string().optional() }), object({ 
 /** Authentication URL the operator should open in a browser. */
-loginUrl: string() }), { kind: "mutation" }), method(_void(), object({ left: literal(true) }), { kind: "mutation" }), method(_void(), object({ loggedOut: literal(true) }), { kind: "mutation" }), method(_void(), object({ peers: array(MeshPeerSchema).readonly() })), method(object({ 
-/** Optional auth key — when provided, probes the key validity
-*  against the provider's API. Omit when already joined to
-*  just ping the daemon. */
-authKey: string().optional() }), object({
-	ok: boolean(),
-	/** Provider-side identifier resolved by the probe (tailnet
-	*  name for Tailscale, network id for ZeroTier, etc.). */
-	tenant: string().optional(),
-	/** Daemon binary version, when reachable. */
-	daemonVersion: string().optional(),
-	/** Human-readable error when `ok: false`. */
-	error: string().optional()
-}), { kind: "mutation" });
+loginUrl: string() }), { kind: "mutation" }), method(_void(), object({ left: literal(true) }), { kind: "mutation" }), method(_void(), object({ loggedOut: literal(true) }), { kind: "mutation" }), method(_void(), object({ peers: array(MeshPeerSchema).readonly() }));
 /**
 * A monotonic total between resets (D944). Energy uses `power-meter.energy`
 * so dashboards keep one series; every other instantaneous reading lands here.
@@ -69818,61 +69836,6 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
-* `oidc-connections` — CRUD for IdP rows under `auth-oidc` (D828 sibling).
-*
-* One hub-only singleton (`auth-oidc`). The Settings UI is a DataTable +
-* ItemFormDialog; there is no `editable-array` in `globalSettingsSchema`.
-* Operator-chosen `id` is the URL slug (`/addon/auth-oidc/<id>/…`) and is
-* immutable after create.
-*/
-var ConfigSchemaPassthrough$1 = unknown();
-var OidcConnectionSchema = object({
-	id: string().min(1),
-	displayName: string(),
-	icon: string(),
-	issuerUrl: string(),
-	clientId: string(),
-	/** Client id + secret present — never the secret value. */
-	configured: boolean(),
-	/**
-	* Values for the connection form schema. `clientSecret` is a keychain
-	* {@link SecretFieldView} or `null` / `''`, never plaintext (D789).
-	*/
-	formValues: record(string(), unknown()).optional()
-});
-/**
-* Patch one connection. Omitted or empty `clientSecret` keeps the stored
-* secret (D787). `{ $secretClear: true }` clears it. `id` is never renamed.
-*/
-var OidcConnectionUpdateInputSchema = object({
-	id: string().min(1),
-	displayName: string().min(1),
-	icon: string().optional(),
-	issuerUrl: string().optional(),
-	clientId: string().optional(),
-	clientSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
-	redirectUri: string().optional(),
-	scopes: string().optional(),
-	usernameClaim: _enum([
-		"preferred_username",
-		"email",
-		"sub"
-	]).optional()
-});
-method(object({}), ConfigSchemaPassthrough$1, { auth: "admin" }), method(object({}), array(OidcConnectionSchema).readonly(), { auth: "admin" }), method(object({
-	id: string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug"),
-	displayName: string().min(1)
-}), object({ id: string() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(OidcConnectionUpdateInputSchema, object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ id: string().min(1) }), object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * Generic on-screen-display (video overlay) cap. Each camera exposes
 * a firmware-defined list of overlays (channel name, timestamp,
 * watermark, logo, …); the cap models them as a homogeneous array of
@@ -76954,21 +76917,6 @@ method(object({
 	*/
 	ttlSec: union([number$1().int().positive(), literal("never")]).optional()
 }), object({ token: string() }), { auth: "admin" }), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable(), { auth: "admin" });
-var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object({
-	providerId: string().min(1),
-	displayName: string().min(1),
-	configSchema: unknown(),
-	nodeLocal: boolean(),
-	shouldSaveDiskSpace: literal(true),
-	minFreePercent: number$1().min(0).max(100)
-}), object({
-	providerId: string().min(1),
-	displayName: string().min(1),
-	configSchema: unknown(),
-	nodeLocal: boolean(),
-	shouldSaveDiskSpace: literal(false),
-	minFreePercent: literal(null)
-})]);
 method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
@@ -77030,42 +76978,7 @@ method(object({
 }), _instanceof(Uint8Array), { auth: "admin" }), method(object({ downloadId: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
-	createdAt: true,
-	updatedAt: true
-}), StorageLocationSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	id: string(),
-	force: boolean().optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(StorageDrainProgressSchema).readonly()), method(object({ id: string() }), object({
-	ok: boolean(),
-	error: string().optional()
-}), { auth: "admin" }), method(_void(), array(ProviderListEntrySchema).readonly()), method(object({
-	providerId: string(),
-	/**
-	* The location this config is an UNSAVED edit of, when there is one.
-	*
-	* `listLocations` replaces every declared secret with the redaction
-	* sentinel, so the edit modal's form state holds the sentinel for any
-	* credential the operator did not retype — and posting that here
-	* without a way to resolve it makes the provider try to authenticate
-	* as `__camstack_redacted__` and report the operator's own working
-	* password as wrong. Given this id, the orchestrator restores each
-	* sentinel from the stored config (same rule as `upsertLocation`)
-	* before dispatching. Omitted by the "Add location" wizard, where
-	* every value was typed just now and nothing is stored yet.
-	*/
-	locationId: string().optional(),
-	config: record(string(), unknown())
-}), object({
-	ok: boolean(),
-	error: string().optional()
-}), { auth: "admin" });
+}), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(_void(), array(StorageDrainProgressSchema).readonly());
 /** One table of the settings database. */
 var StorageTableSchema = object({
 	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
@@ -86951,13 +86864,6 @@ Object.freeze({
 		access: "delete",
 		role: "admin"
 	},
-	"llm.deleteProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"llm.generate": {
 		capName: "llm",
 		capScope: "system",
@@ -87021,20 +86927,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"llm.listProfileKinds": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"llm.listProfiles": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"llm.listRuntimeNodes": {
 		capName: "llm",
 		capScope: "system",
@@ -87042,13 +86934,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"llm.migrateRawSecrets": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"llm.resolveModelRef": {
 		capName: "llm",
 		capScope: "system",
@@ -87077,20 +86962,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"llm.testProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"llm.upsertProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"llmRuntime.appleAvailability": {
 		capName: "llm-runtime",
 		capScope: "system",
@@ -87595,13 +87466,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"meshNetwork.testConnection": {
-		capName: "mesh-network",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"meter.getStatus": {
 		capName: "meter",
 		capScope: "device",
@@ -88260,13 +88124,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.deleteTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"notificationOutput.discoverTargets": {
 		capName: "notification-output",
 		capScope: "system",
@@ -88274,13 +88131,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"notificationOutput.getTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"notificationOutput.listTargetKinds": {
 		capName: "notification-output",
 		capScope: "system",
@@ -88288,13 +88138,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"notificationOutput.listTargets": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"notificationOutput.probeTargetConfig": {
 		capName: "notification-output",
 		capScope: "system",
@@ -88309,13 +88152,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.setTargetEnabled": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"notificationOutput.testTarget": {
 		capName: "notification-output",
 		capScope: "system",
@@ -88323,13 +88159,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.upsertTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"notificationRules.activateAlarmProfile": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -88589,41 +88418,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"oidcConnections.connectionFormSchema": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"oidcConnections.createConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"oidcConnections.deleteConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
-	"oidcConnections.listConnections": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"oidcConnections.updateConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"osd.getStatus": {
 		capName: "osd",
 		capScope: "device",
@@ -91655,13 +91449,6 @@ Object.freeze({
 		access: "delete",
 		role: "admin"
 	},
-	"storage.deleteLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"storage.endDownload": {
 		capName: "storage",
 		capScope: "system",
@@ -91718,13 +91505,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"storage.listProviders": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"storage.read": {
 		capName: "storage",
 		capScope: "system",
@@ -91746,27 +91526,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"storage.testConfig": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"storage.testLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"storage.upsertLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"storage.write": {
 		capName: "storage",
 		capScope: "system",
@@ -145494,6 +145253,33 @@ function quietLogger$1() {
 	};
 	return logger;
 }
+/**
+* The account a target speaks through: the one it names; else the only one there is; else the one
+* whose Echoes include the target's Echo.
+*/
+function pickBroker(brokers, config) {
+	const named = readString(config, "brokerId");
+	if (named.length > 0) return brokers.find((broker) => broker.id === named);
+	if (brokers.length === 1) return brokers[0];
+	const echoId = readString(config, "echoId");
+	const owners = brokers.filter((broker) => broker.devices.some((device) => device.id === echoId));
+	return owners.length === 1 ? owners[0] : void 0;
+}
+/**
+* The save-time rule of an Echo target: an Echo and an account must be picked, and the account is
+* pinned the moment it is known, so a second account added later cannot silently change where an
+* existing target speaks. Throws the reason; returns the keys to keep with the write.
+*/
+function validateEchoTarget(brokers, config) {
+	if (readString(config, "echoId").length === 0) throw new Error("Pick the Echo that should speak");
+	const owner = pickBroker(brokers, config);
+	if (owner === void 0) {
+		const named = readString(config, "brokerId");
+		if (named.length > 0) throw new Error(`The Amazon account ${named} is not available`);
+		throw new Error(brokers.length === 0 ? "Add an Amazon account first: an Echo speaks through one" : "Pick the Amazon account this Echo belongs to");
+	}
+	return readString(config, "brokerId").length === 0 ? { brokerId: owner.id } : {};
+}
 function readString(config, key) {
 	const value = config[key];
 	return typeof value === "string" ? value : "";
@@ -145523,7 +145309,7 @@ function echoOptionLabel(device) {
 /**
 * The two pickers are not `required`: a required select shows its first option
 * while the form still holds no value, so a save would drop the choice. Left
-* optional they open on "Select", and `upsertTarget` refuses an empty pick.
+* optional they open on "Select", and `validateEchoTarget` refuses an empty pick on save.
 *
 * The account is a broker pick (existing, or created in place); the Echo list
 * is fetched from that account, so a new Echo shows up without a deploy.
@@ -145615,18 +145401,8 @@ function createAlexaNotificationProvider(ports) {
 	function record(row) {
 		deliveries = [...deliveries, row];
 	}
-	/**
-	* The account a target speaks through: the one it names; else the only one
-	* there is; else the one whose Echoes include the target's Echo.
-	*/
 	function brokerFor(config) {
-		const all = ports.brokers();
-		const named = readString(config, "brokerId");
-		if (named.length > 0) return all.find((broker) => broker.id === named);
-		if (all.length === 1) return all[0];
-		const echoId = readString(config, "echoId");
-		const owners = all.filter((broker) => broker.devices.some((device) => device.id === echoId));
-		return owners.length === 1 ? owners[0] : void 0;
+		return pickBroker(ports.brokers(), config);
 	}
 	async function deliver(target, notification) {
 		const speech = speechFromNotification(notification);
@@ -145828,14 +145604,6 @@ function createAlexaNotificationProvider(ports) {
 		async listTargetKinds() {
 			return [alexaTargetKind()];
 		},
-		async listTargets() {
-			return [...await ports.loadTargets()];
-		},
-		async getTarget(input) {
-			const found = (await ports.loadTargets()).find((target) => target.id === input.targetId);
-			if (found === void 0) throw new Error(`target not found: ${input.targetId}`);
-			return found;
-		},
 		async discoverTargets(input) {
 			for (const broker of ports.brokers()) if (!broker.ready) ports.logger.warn(`alexa echo discovery: no Echo listed for '${broker.name}', the Amazon account is not signed in for this broker`, { tags: { brokerId: broker.id } });
 			const named = readString(input.config ?? {}, "brokerId");
@@ -145896,33 +145664,6 @@ function createAlexaNotificationProvider(ports) {
 				format: "text",
 				priority: 3
 			});
-		},
-		async upsertTarget(input) {
-			const owner = brokerFor(input.target.config);
-			if (readString(input.target.config, "echoId").length === 0) throw new Error("Pick the Echo that should speak");
-			if (owner === void 0) throw new Error("Pick the Amazon account this Echo belongs to");
-			const pinned = readString(input.target.config, "brokerId").length === 0 ? {
-				...input.target.config,
-				brokerId: owner.id
-			} : input.target.config;
-			const target = {
-				...input.target,
-				config: pinned,
-				addonId: ALEXA_SPEAK_ADDON_ID,
-				kind: ALEXA_SPEAK_KIND
-			};
-			await ports.putTarget(target);
-			return target;
-		},
-		async deleteTarget(input) {
-			await ports.removeTarget(input.targetId);
-		},
-		async setTargetEnabled(input) {
-			const found = (await ports.loadTargets()).find((row) => row.id === input.targetId);
-			if (found !== void 0) await ports.putTarget({
-				...found,
-				enabled: input.enabled
-			});
 		}
 	};
 }
@@ -146013,6 +145754,14 @@ function echoTargetProbe(speak) {
 		});
 	};
 }
+/**
+* The Echo instance's save-time rule over the accounts now (D1013): the check the removed
+* `upsertTarget` made, on the instance door. Speech not started yet has no account to name, so the
+* write is refused with the reason, never accepted blind.
+*/
+function echoTargetValidator(brokers) {
+	return ({ config }) => validateEchoTarget(brokers() ?? [], config);
+}
 process.platform, process.env["SystemRoot"];
 /**
 * Files only their owner may read: the one place a secret-bearing file is
@@ -146853,8 +146602,6 @@ var AlexaSpeakController = class {
 			now: this.now,
 			logger: host.logger,
 			loadTargets: () => host.readTargets(),
-			putTarget: (target) => host.putTarget(target),
-			removeTarget: (targetId) => host.removeTarget(targetId),
 			speak: (command) => this.utter(command.brokerId, command.mode, command.targets, command.text)
 		});
 	}
@@ -146884,6 +146631,7 @@ var AlexaSpeakController = class {
 	echoFor(brokerId) {
 		return this.echoes.get(brokerId) ?? null;
 	}
+	/** The accounts right now, as the provider and the save-time rule see them. */
 	brokerViews() {
 		return this.host.listBrokers().map((ref) => {
 			const echo = this.echoes.get(ref.id);
@@ -147431,8 +147179,6 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		const speak = new AlexaSpeakController({
 			logger: this.ctx.logger.child("speak"),
 			readTargets: () => echoStore.list(),
-			putTarget: (target) => echoStore.upsert(target),
-			removeTarget: (targetId) => echoStore.delete(targetId),
 			listBrokers: () => this.activeBrokers.map((entry) => ({
 				id: entry.id,
 				name: entry.name,
@@ -147534,6 +147280,7 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 				kinds: alexaNotifyRecordKinds,
 				mintId: () => (0, node_crypto.randomUUID)(),
 				probe: echoTargetProbe(() => this.speak),
+				validate: echoTargetValidator(() => this.speak?.brokerViews() ?? null),
 				canProbe: () => true
 			})
 		], {