@camstack/addon-mqtt-broker 1.2.153 → 1.2.155

package/dist/mqtt-broker.addon.js

@@ -6028,7 +6028,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-CmjWurK5.mjs
+//#region ../types/dist/sleep-D7ZKm4nb.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6737,10 +6737,33 @@ function integrationRowsApiOver(api) {
 	};
 }
 var PREFIX = "records/";
+/**
+* Cross-realm brand. An addon bundles its own copy of this module (D15) while
+* `ctx.records` is the HOST's door, so an error thrown by the host is an
+* instance of the host's classes, not of the addon's. The brand plus the code
+* make `instanceof` answer by identity of the failure, not of the copy.
+*/
+var RECORDS_ERROR_BRAND = Symbol.for("camstack.records-error");
+function carriesBrand(value) {
+	return typeof value === "object" && value !== null && Reflect.get(value, RECORDS_ERROR_BRAND) === true;
+}
 /** The base of every records failure. `detail` is the human part of the message. */
 var RecordsError = class extends Error {
+	/** The code a subclass stands for; the base stands for every code. */
+	static code = void 0;
+	/**
+	* `instanceof` across copies of this module: any branded error is a
+	* `RecordsError`, and is an instance of a subclass only when its code is the
+	* subclass's code. Same-copy answers are unchanged.
+	*/
+	static [Symbol.hasInstance](value) {
+		if (Function.prototype[Symbol.hasInstance].call(this, value)) return true;
+		if (!carriesBrand(value)) return false;
+		return this.code === void 0 || value.code === this.code;
+	}
 	code;
 	detail;
+	[RECORDS_ERROR_BRAND] = true;
 	constructor(code, detail) {
 		super(`${PREFIX}${code}: ${detail}`);
 		this.name = "RecordsError";
@@ -6749,22 +6772,25 @@ var RecordsError = class extends Error {
 	}
 };
 /** The keychain could not store or serve a value: explicit, never an empty string. */
-var RecordSecretUnavailableError = class extends RecordsError {
+var RecordSecretUnavailableError = class RecordSecretUnavailableError extends RecordsError {
+	static code = "secret-unavailable";
 	constructor(detail) {
-		super("secret-unavailable", detail);
+		super(RecordSecretUnavailableError.code, detail);
 		this.name = "RecordSecretUnavailableError";
 	}
 };
-var InvalidRecordError = class extends RecordsError {
+var InvalidRecordError = class InvalidRecordError extends RecordsError {
+	static code = "invalid-record";
 	constructor(detail) {
-		super("invalid-record", detail);
+		super(InvalidRecordError.code, detail);
 		this.name = "InvalidRecordError";
 	}
 };
 /** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
-var DeclarationRefusedError = class extends RecordsError {
+var DeclarationRefusedError = class DeclarationRefusedError extends RecordsError {
+	static code = "declaration-refused";
 	constructor(detail) {
-		super("declaration-refused", detail);
+		super(DeclarationRefusedError.code, detail);
 		this.name = "DeclarationRefusedError";
 	}
 };
@@ -9559,286 +9585,6 @@ function normalizeAddonInitResult(result) {
 	if (Array.isArray(result)) return { providers: result };
 	return result;
 }
-/**
-* The share-view scope kinds a share-link token can carry. The hub mints
-* and validates them (`ShareViewGrantSchema` builds its
-* enum from this list); a data plane names the kinds it ACCEPTS in `share`.
-*/
-var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
-/** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
-var PeerBytesTicketSchema = object({
-	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
-	url: string().min(1),
-	/**
-	* The HOST node this URL means something on — the hub or a named agent,
-	* never a runner. {@link AddonPeerBytes.open} compares it to its own and
-	* refuses `cross-node` by name when they differ, without dialling.
-	*/
-	hostNodeId: string().min(1),
-	expiresAtMs: number().int().nonnegative(),
-	/**
-	* What the producer DECLARED the body to be, when it knows — `null` when it
-	* does not. Never `0` for unknown (D393): a consumer sizing a bound off this
-	* must be able to tell "the producer did not say" from "the body is empty".
-	*/
-	declaredBytes: number().int().nonnegative().nullable()
-});
-function defOf(schema) {
-	const zodBag = Reflect.get(schema, "_zod");
-	if (typeof zodBag !== "object" || zodBag === null) return {};
-	const def = Reflect.get(zodBag, "def");
-	if (typeof def !== "object" || def === null) return {};
-	return def;
-}
-function declaredHere(schema) {
-	return globalRegistry.get(schema)?.secret === true;
-}
-/** Wrapper kinds whose `innerType` is the field itself. */
-var WRAPPERS = new Set([
-	"optional",
-	"nullable",
-	"default",
-	"prefault",
-	"catch",
-	"readonly",
-	"nonoptional"
-]);
-/**
-* The schema layers that make up ONE field: the schema itself and every
-* wrapper below it (optional / default / nullable / readonly / catch), plus
-* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
-* `.transform` on `in`).
-*/
-function layersOf(schema) {
-	const out = [];
-	const queue = [schema];
-	while (queue.length > 0) {
-		const s = queue.shift();
-		if (!s || out.includes(s)) continue;
-		out.push(s);
-		const def = defOf(s);
-		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
-		if (def.type === "pipe") {
-			if (def.in) queue.push(def.in);
-			if (def.out) queue.push(def.out);
-		}
-	}
-	return out;
-}
-/** True when any layer of this field declares `.meta({ secret: true })`. */
-function isZodSecret(schema) {
-	return layersOf(schema).some(declaredHere);
-}
-/**
-* Every declared secret path in a config schema: dotted keys, `[]` for "each
-* element of this array" (`connection.password`, `rows[].token`), `{}` for "each value of this
-* map" (`applianceSecrets{}`). A declared
-* object or array is reported as one path and not descended into — everything
-* under it is secret.
-*/
-function collectZodSecretPaths(schema, prefix = "") {
-	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
-	const paths = [];
-	for (const layer of layersOf(schema)) {
-		const def = defOf(layer);
-		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
-		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
-		else if (def.type === "record" && def.valueType) paths.push(...collectZodSecretPaths(def.valueType, `${prefix}{}`));
-		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
-		else if (def.type === "intersection") {
-			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
-			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
-		}
-	}
-	return [...new Set(paths)];
-}
-/**
-* Record kinds (D881): the declaration an addon makes of one kind of fact, the
-* Zod row schema that describes it, and the helper that turns the two into the
-* JSON the engine stores.
-*
-* A kind is declared ONCE, next to the code that owns it, and the engine's
-* reconciler creates its indexes - nothing creates DDL at runtime from a write.
-* Everything the generic machinery needs (secret fields, the entry descriptor)
-* is DERIVED from the Zod schema: `.meta({ secret: true })` marks a credential,
-* never a field name (D879).
-*/
-/** A JSON field path: `trackId`, `auth.accessToken`. Charset-restricted: it is rendered into DDL. */
-var RecordFieldPathSchema = string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,63}(\.[A-Za-z_][A-Za-z0-9_]{0,63}){0,3}$/);
-var RecordIndexSchema = object({
-	name: string().regex(/^[a-z][a-z0-9_]{0,31}$/),
-	fields: array(RecordFieldPathSchema).min(1).max(4),
-	unique: boolean().optional()
-}).strict();
-var RecordRetentionSchema = union([
-	object({
-		ttlMs: number().int().positive(),
-		from: _enum(["at", "write"])
-	}).strict(),
-	object({
-		maxRows: number().int().positive().optional(),
-		maxRowsPerDevice: number().int().positive().optional()
-	}).strict().refine((r) => r.maxRows !== void 0 || r.maxRowsPerDevice !== void 0, { message: "name maxRows, maxRowsPerDevice or both" }),
-	object({
-		owner: string().min(1),
-		reason: string().min(1)
-	}).strict(),
-	object({ none: string().min(1) }).strict()
-]);
-/** The descriptor a generic entries UI reads (D881 "generic entries"). */
-var EntryDescriptorSchema = object({
-	title: string().min(1),
-	/** The record body field shown as the entry's name. */
-	nameField: string().min(1),
-	/** JSON Schema of the entry body; `secret: true` marks a password field. */
-	fields: record(string(), unknown())
-}).strict();
-/** What crosses the wire from an addon: JSON only, no Zod. An unknown key is refused. */
-var RecordKindDeclarationSchema = object({
-	database: _enum(RECORD_DATABASES).default("settings"),
-	class: _enum(RECORD_CLASSES),
-	writeTrigger: string().min(1),
-	device: _enum([
-		"required",
-		"optional",
-		"none"
-	]).default("none"),
-	at: _enum(["required", "none"]).default("none"),
-	indexes: array(RecordIndexSchema).max(8).default([]),
-	retention: RecordRetentionSchema,
-	deviceRemoval: _enum(["delete", "none"]).default("none"),
-	maxDataBytes: number().int().positive().max(RECORD_MAX_DATA_BYTES).default(RECORD_DEFAULT_MAX_DATA_BYTES),
-	/** Derived from the Zod schema; never written by hand. */
-	secretPaths: array(string().min(1)).default([]),
-	/** The id key of each array that carries a secret (`{ headers: 'name' }`). */
-	secretArrayKeys: record(string(), string()).default({}),
-	/** Kinds that must agree through `transact` sit in one file under one family name. */
-	transactFamily: string().min(1).optional(),
-	entry: EntryDescriptorSchema.optional()
-}).strict();
-/** The kind names: lower-case, dash separated, short enough for an index name. */
-var RecordKindNameSchema = string().regex(/^[a-z][a-z0-9-]{0,47}$/);
-/** Cross-field rules a declaration must satisfy. Throws {@link DeclarationRefusedError}. */
-function assertValidDeclaration(name, decl) {
-	const refuse = (why) => {
-		throw new DeclarationRefusedError(`kind "${name}": ${why}`);
-	};
-	if (!RecordKindNameSchema.safeParse(name).success) refuse("the name must be lower-case-dashed");
-	const seen = /* @__PURE__ */ new Set();
-	for (const index of decl.indexes) {
-		if (seen.has(index.name)) refuse(`index name "${index.name}" is declared twice`);
-		seen.add(index.name);
-	}
-	const { retention } = decl;
-	const hasSecrets = decl.secretPaths.length > 0;
-	if ("ttlMs" in retention) {
-		if (retention.from === "at" && decl.at !== "required") refuse("a ttl from \"at\" needs at: \"required\"");
-		if (hasSecrets) refuse("a kind with secret fields cannot use engine TTL (its keychain values would be orphaned)");
-	}
-	if ("maxRows" in retention || "maxRowsPerDevice" in retention) {
-		if (retention.maxRowsPerDevice !== void 0 && decl.device !== "required") refuse("maxRowsPerDevice needs device: \"required\"");
-		if (decl.at !== "required") refuse("a row bound trims the oldest \"at\": it needs at: \"required\"");
-		if (hasSecrets) refuse("a kind with secret fields cannot use an engine row bound");
-		const bound = Math.max(retention.maxRows ?? 0, retention.maxRowsPerDevice ?? 0);
-		if (decl.database === "settings" && bound > 5e4) refuse(`a row bound above ${RECORD_SETTINGS_MAX_ROWS} belongs in database: "events" (a big delete on the settings thread stalls every configuration read)`);
-	}
-	if (decl.deviceRemoval === "delete" && decl.device === "none") refuse("deviceRemoval: \"delete\" needs a device: \"required\" or \"optional\"");
-	for (const path of decl.secretPaths) for (const prefix of secretArrayPrefixes(path)) if (decl.secretArrayKeys[prefix] === void 0) refuse(`secret path "${path}" crosses the array "${prefix}": declare its id key in secretArrayKeys`);
-}
-function bodyFieldsOf(schema) {
-	return { ...toJSONSchema(schema, {
-		unrepresentable: "any",
-		io: "input"
-	}) };
-}
-function isRecordLike(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/** Does every branch of the body schema carry `field`? (A discriminated union has several.) */
-function hasNameField(json, field) {
-	const branches = json["oneOf"] ?? json["anyOf"];
-	if (Array.isArray(branches)) return branches.length > 0 && branches.every((b) => isRecordLike(b) && hasNameField(b, field));
-	const properties = json["properties"];
-	return isRecordLike(properties) && Object.prototype.hasOwnProperty.call(properties, field);
-}
-/**
-* Declare the kinds of a package. The keys are the kind names. The result is
-* what `ctx.records.declare` sends to the engine and what `ctx.records.kind`
-* types its handle from.
-*/
-function defineRecordKinds(specs) {
-	const out = {};
-	for (const [name, spec] of Object.entries(specs)) {
-		const secretPaths = collectZodSecretPaths(spec.schema);
-		const nameField = spec.entry?.nameField ?? "name";
-		const fields = bodyFieldsOf(spec.schema);
-		if (spec.entry !== void 0 && !hasNameField(fields, nameField)) throw new DeclarationRefusedError(`kind "${name}": an entry kind's schema needs a "${nameField}" field`);
-		const parsed = RecordKindDeclarationSchema.parse({
-			database: spec.database,
-			class: spec.class,
-			writeTrigger: spec.writeTrigger,
-			device: spec.device,
-			at: spec.at,
-			indexes: spec.indexes === void 0 ? void 0 : [...spec.indexes],
-			retention: spec.retention,
-			deviceRemoval: spec.deviceRemoval,
-			maxDataBytes: spec.maxDataBytes,
-			secretPaths: [...new Set([...secretPaths, ...spec.retiredSecretPaths ?? []])],
-			secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
-			transactFamily: spec.transactFamily,
-			entry: spec.entry === void 0 ? void 0 : {
-				title: spec.entry.title,
-				nameField,
-				fields
-			}
-		});
-		assertValidDeclaration(name, parsed);
-		out[name] = {
-			name,
-			schema: spec.schema,
-			declaration: parsed
-		};
-	}
-	return out;
-}
-/**
-* Entry kinds (D881): every list of user-created entries (notification
-* targets, brokers, LLM profiles) is ONE record kind with an id, a name and a
-* kind-specific body, and the admin UI lists/adds/edits/deletes all of them
-* through the `record-entries` capability with password fields derived from
-* the schema (`.meta({ secret: true })`).
-*/
-/** The body of a plain entry: a name and the fields the kind adds. */
-function entryBody(shape) {
-	return object({
-		name: string().min(1),
-		enabled: boolean().optional(),
-		...shape
-	});
-}
-/**
-* Declare one entry kind. An entry is configuration: never trimmed by the
-* engine, never aged, belonging to no device.
-*/
-function defineEntryKind(name, spec) {
-	const defined = defineRecordKinds({ [name]: {
-		schema: spec.schema,
-		class: "config",
-		writeTrigger: spec.writeTrigger ?? "an operator adds or edits an entry in the entries UI",
-		retention: { none: "an entry goes only when the operator deletes it" },
-		...spec.maxDataBytes === void 0 ? {} : { maxDataBytes: spec.maxDataBytes },
-		...spec.database === void 0 ? {} : { database: spec.database },
-		...spec.indexes === void 0 ? {} : { indexes: spec.indexes },
-		...spec.secretArrayKeys === void 0 ? {} : { secretArrayKeys: spec.secretArrayKeys },
-		...spec.retiredSecretPaths === void 0 ? {} : { retiredSecretPaths: spec.retiredSecretPaths },
-		entry: {
-			title: spec.title,
-			...spec.nameField === void 0 ? {} : { nameField: spec.nameField }
-		}
-	} })[name];
-	if (defined === void 0) throw new DeclarationRefusedError(`entry kind "${name}" was not built`);
-	return defined;
-}
 object({
 	field: string().min(1),
 	on: literal("advance")
@@ -9927,6 +9673,286 @@ function optionalMethod(input, output, options) {
 		providerOptional: true
 	};
 }
+function defOf(schema) {
+	const zodBag = Reflect.get(schema, "_zod");
+	if (typeof zodBag !== "object" || zodBag === null) return {};
+	const def = Reflect.get(zodBag, "def");
+	if (typeof def !== "object" || def === null) return {};
+	return def;
+}
+function declaredHere(schema) {
+	return globalRegistry.get(schema)?.secret === true;
+}
+/** Wrapper kinds whose `innerType` is the field itself. */
+var WRAPPERS = new Set([
+	"optional",
+	"nullable",
+	"default",
+	"prefault",
+	"catch",
+	"readonly",
+	"nonoptional"
+]);
+/**
+* The schema layers that make up ONE field: the schema itself and every
+* wrapper below it (optional / default / nullable / readonly / catch), plus
+* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
+* `.transform` on `in`).
+*/
+function layersOf(schema) {
+	const out = [];
+	const queue = [schema];
+	while (queue.length > 0) {
+		const s = queue.shift();
+		if (!s || out.includes(s)) continue;
+		out.push(s);
+		const def = defOf(s);
+		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
+		if (def.type === "pipe") {
+			if (def.in) queue.push(def.in);
+			if (def.out) queue.push(def.out);
+		}
+	}
+	return out;
+}
+/** True when any layer of this field declares `.meta({ secret: true })`. */
+function isZodSecret(schema) {
+	return layersOf(schema).some(declaredHere);
+}
+/**
+* Every declared secret path in a config schema: dotted keys, `[]` for "each
+* element of this array" (`connection.password`, `rows[].token`), `{}` for "each value of this
+* map" (`applianceSecrets{}`). A declared
+* object or array is reported as one path and not descended into — everything
+* under it is secret.
+*/
+function collectZodSecretPaths(schema, prefix = "") {
+	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
+	const paths = [];
+	for (const layer of layersOf(schema)) {
+		const def = defOf(layer);
+		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
+		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "record" && def.valueType) paths.push(...collectZodSecretPaths(def.valueType, `${prefix}{}`));
+		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
+		else if (def.type === "intersection") {
+			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
+			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
+		}
+	}
+	return [...new Set(paths)];
+}
+/**
+* Record kinds (D881): the declaration an addon makes of one kind of fact, the
+* Zod row schema that describes it, and the helper that turns the two into the
+* JSON the engine stores.
+*
+* A kind is declared ONCE, next to the code that owns it, and the engine's
+* reconciler creates its indexes - nothing creates DDL at runtime from a write.
+* Everything the generic machinery needs (secret fields, the entry descriptor)
+* is DERIVED from the Zod schema: `.meta({ secret: true })` marks a credential,
+* never a field name (D879).
+*/
+/** A JSON field path: `trackId`, `auth.accessToken`. Charset-restricted: it is rendered into DDL. */
+var RecordFieldPathSchema = string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,63}(\.[A-Za-z_][A-Za-z0-9_]{0,63}){0,3}$/);
+var RecordIndexSchema = object({
+	name: string().regex(/^[a-z][a-z0-9_]{0,31}$/),
+	fields: array(RecordFieldPathSchema).min(1).max(4),
+	unique: boolean().optional()
+}).strict();
+var RecordRetentionSchema = union([
+	object({
+		ttlMs: number().int().positive(),
+		from: _enum(["at", "write"])
+	}).strict(),
+	object({
+		maxRows: number().int().positive().optional(),
+		maxRowsPerDevice: number().int().positive().optional()
+	}).strict().refine((r) => r.maxRows !== void 0 || r.maxRowsPerDevice !== void 0, { message: "name maxRows, maxRowsPerDevice or both" }),
+	object({
+		owner: string().min(1),
+		reason: string().min(1)
+	}).strict(),
+	object({ none: string().min(1) }).strict()
+]);
+/** The descriptor a generic entries UI reads (D881 "generic entries"). */
+var EntryDescriptorSchema = object({
+	title: string().min(1),
+	/** The record body field shown as the entry's name. */
+	nameField: string().min(1),
+	/** JSON Schema of the entry body; `secret: true` marks a password field. */
+	fields: record(string(), unknown())
+}).strict();
+/** What crosses the wire from an addon: JSON only, no Zod. An unknown key is refused. */
+var RecordKindDeclarationSchema = object({
+	database: _enum(RECORD_DATABASES).default("settings"),
+	class: _enum(RECORD_CLASSES),
+	writeTrigger: string().min(1),
+	device: _enum([
+		"required",
+		"optional",
+		"none"
+	]).default("none"),
+	at: _enum(["required", "none"]).default("none"),
+	indexes: array(RecordIndexSchema).max(8).default([]),
+	retention: RecordRetentionSchema,
+	deviceRemoval: _enum(["delete", "none"]).default("none"),
+	maxDataBytes: number().int().positive().max(RECORD_MAX_DATA_BYTES).default(RECORD_DEFAULT_MAX_DATA_BYTES),
+	/** Derived from the Zod schema; never written by hand. */
+	secretPaths: array(string().min(1)).default([]),
+	/** The id key of each array that carries a secret (`{ headers: 'name' }`). */
+	secretArrayKeys: record(string(), string()).default({}),
+	/** Kinds that must agree through `transact` sit in one file under one family name. */
+	transactFamily: string().min(1).optional(),
+	entry: EntryDescriptorSchema.optional()
+}).strict();
+/** The kind names: lower-case, dash separated, short enough for an index name. */
+var RecordKindNameSchema = string().regex(/^[a-z][a-z0-9-]{0,47}$/);
+/** Cross-field rules a declaration must satisfy. Throws {@link DeclarationRefusedError}. */
+function assertValidDeclaration(name, decl) {
+	const refuse = (why) => {
+		throw new DeclarationRefusedError(`kind "${name}": ${why}`);
+	};
+	if (!RecordKindNameSchema.safeParse(name).success) refuse("the name must be lower-case-dashed");
+	const seen = /* @__PURE__ */ new Set();
+	for (const index of decl.indexes) {
+		if (seen.has(index.name)) refuse(`index name "${index.name}" is declared twice`);
+		seen.add(index.name);
+	}
+	const { retention } = decl;
+	const hasSecrets = decl.secretPaths.length > 0;
+	if ("ttlMs" in retention) {
+		if (retention.from === "at" && decl.at !== "required") refuse("a ttl from \"at\" needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use engine TTL (its keychain values would be orphaned)");
+	}
+	if ("maxRows" in retention || "maxRowsPerDevice" in retention) {
+		if (retention.maxRowsPerDevice !== void 0 && decl.device !== "required") refuse("maxRowsPerDevice needs device: \"required\"");
+		if (decl.at !== "required") refuse("a row bound trims the oldest \"at\": it needs at: \"required\"");
+		if (hasSecrets) refuse("a kind with secret fields cannot use an engine row bound");
+		const bound = Math.max(retention.maxRows ?? 0, retention.maxRowsPerDevice ?? 0);
+		if (decl.database === "settings" && bound > 5e4) refuse(`a row bound above ${RECORD_SETTINGS_MAX_ROWS} belongs in database: "events" (a big delete on the settings thread stalls every configuration read)`);
+	}
+	if (decl.deviceRemoval === "delete" && decl.device === "none") refuse("deviceRemoval: \"delete\" needs a device: \"required\" or \"optional\"");
+	for (const path of decl.secretPaths) for (const prefix of secretArrayPrefixes(path)) if (decl.secretArrayKeys[prefix] === void 0) refuse(`secret path "${path}" crosses the array "${prefix}": declare its id key in secretArrayKeys`);
+}
+function bodyFieldsOf(schema) {
+	return { ...toJSONSchema(schema, {
+		unrepresentable: "any",
+		io: "input"
+	}) };
+}
+function isRecordLike(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Does every branch of the body schema carry `field`? (A discriminated union has several.) */
+function hasNameField(json, field) {
+	const branches = json["oneOf"] ?? json["anyOf"];
+	if (Array.isArray(branches)) return branches.length > 0 && branches.every((b) => isRecordLike(b) && hasNameField(b, field));
+	const properties = json["properties"];
+	return isRecordLike(properties) && Object.prototype.hasOwnProperty.call(properties, field);
+}
+/**
+* Declare the kinds of a package. The keys are the kind names. The result is
+* what `ctx.records.declare` sends to the engine and what `ctx.records.kind`
+* types its handle from.
+*/
+function defineRecordKinds(specs) {
+	const out = {};
+	for (const [name, spec] of Object.entries(specs)) {
+		const secretPaths = collectZodSecretPaths(spec.schema);
+		const nameField = spec.entry?.nameField ?? "name";
+		const fields = bodyFieldsOf(spec.schema);
+		if (spec.entry !== void 0 && !hasNameField(fields, nameField)) throw new DeclarationRefusedError(`kind "${name}": an entry kind's schema needs a "${nameField}" field`);
+		const parsed = RecordKindDeclarationSchema.parse({
+			database: spec.database,
+			class: spec.class,
+			writeTrigger: spec.writeTrigger,
+			device: spec.device,
+			at: spec.at,
+			indexes: spec.indexes === void 0 ? void 0 : [...spec.indexes],
+			retention: spec.retention,
+			deviceRemoval: spec.deviceRemoval,
+			maxDataBytes: spec.maxDataBytes,
+			secretPaths: [...new Set([...secretPaths, ...spec.retiredSecretPaths ?? []])],
+			secretArrayKeys: spec.secretArrayKeys === void 0 ? void 0 : { ...spec.secretArrayKeys },
+			transactFamily: spec.transactFamily,
+			entry: spec.entry === void 0 ? void 0 : {
+				title: spec.entry.title,
+				nameField,
+				fields
+			}
+		});
+		assertValidDeclaration(name, parsed);
+		out[name] = {
+			name,
+			schema: spec.schema,
+			declaration: parsed
+		};
+	}
+	return out;
+}
+/**
+* Entry kinds (D881): every list of user-created entries (notification
+* targets, brokers, LLM profiles) is ONE record kind with an id, a name and a
+* kind-specific body, and the admin UI lists/adds/edits/deletes all of them
+* through the `record-entries` capability with password fields derived from
+* the schema (`.meta({ secret: true })`).
+*/
+/** The body of a plain entry: a name and the fields the kind adds. */
+function entryBody(shape) {
+	return object({
+		name: string().min(1),
+		enabled: boolean().optional(),
+		...shape
+	});
+}
+/**
+* Declare one entry kind. An entry is configuration: never trimmed by the
+* engine, never aged, belonging to no device.
+*/
+function defineEntryKind(name, spec) {
+	const defined = defineRecordKinds({ [name]: {
+		schema: spec.schema,
+		class: "config",
+		writeTrigger: spec.writeTrigger ?? "an operator adds or edits an entry in the entries UI",
+		retention: { none: "an entry goes only when the operator deletes it" },
+		...spec.maxDataBytes === void 0 ? {} : { maxDataBytes: spec.maxDataBytes },
+		...spec.database === void 0 ? {} : { database: spec.database },
+		...spec.indexes === void 0 ? {} : { indexes: spec.indexes },
+		...spec.secretArrayKeys === void 0 ? {} : { secretArrayKeys: spec.secretArrayKeys },
+		...spec.retiredSecretPaths === void 0 ? {} : { retiredSecretPaths: spec.retiredSecretPaths },
+		entry: {
+			title: spec.title,
+			...spec.nameField === void 0 ? {} : { nameField: spec.nameField }
+		}
+	} })[name];
+	if (defined === void 0) throw new DeclarationRefusedError(`entry kind "${name}" was not built`);
+	return defined;
+}
+/**
+* The share-view scope kinds a share-link token can carry. The hub mints
+* and validates them (`ShareViewGrantSchema` builds its
+* enum from this list); a data plane names the kinds it ACCEPTS in `share`.
+*/
+var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
+/** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
+var PeerBytesTicketSchema = object({
+	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
+	url: string().min(1),
+	/**
+	* The HOST node this URL means something on — the hub or a named agent,
+	* never a runner. {@link AddonPeerBytes.open} compares it to its own and
+	* refuses `cross-node` by name when they differ, without dialling.
+	*/
+	hostNodeId: string().min(1),
+	expiresAtMs: number().int().nonnegative(),
+	/**
+	* What the producer DECLARED the body to be, when it knows — `null` when it
+	* does not. Never `0` for unknown (D393): a consumer sizing a bound off this
+	* must be able to tell "the producer did not say" from "the body is empty".
+	*/
+	declaredBytes: number().int().nonnegative().nullable()
+});
 var READING_QUANTITIES = [
 	"temperature",
 	"pressure",
@@ -10505,7 +10531,6 @@ var CAP_NAMES = Object.freeze([
 	"climate-control",
 	"color",
 	"composer",
-	"connection-test",
 	"connectivity",
 	"consumables",
 	"contact",
@@ -12525,8 +12550,7 @@ Object.freeze({
 		"offerArtifact": 3e5,
 		"readResult": 3e5,
 		"submitJob": 18e5,
-		"uploadDataset": 72e5,
-		"validateCredentials": 3e4
+		"uploadDataset": 72e5
 	}
 });
 object({
@@ -13881,6 +13905,432 @@ var IntegrationInstanceRefSchema = object({
 	]),
 	candidateStableId: string().optional()
 });
+/**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = _enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: string().optional(),
+	bytes: _instanceof(Uint8Array).optional(),
+	mime: string().optional(),
+	name: string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = _enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/**
+* The CLOSED icon vocabulary an action button may use.
+*
+* A closed set, not a free string, and that is the whole point: an arbitrary
+* icon name is one that ntfy renders, zentik silently drops, and nobody
+* notices — the same class of gap as a zone vocabulary nothing produced
+* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
+* declares `actionIcons: false` and the degrade engine strips the field.
+*
+* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
+* renderer's icon set; "acknowledge" survives an adapter that draws it
+* differently.
+*
+* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
+*
+* These names are for US. **No adapter may forward one verbatim.** Each maps
+* the whole set onto its own renderer's vocabulary through a
+* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
+* fallback, so adding a member here fails every adapter's build until someone
+* decides its glyph, which is the only place that decision can be made
+* honestly.
+*
+* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
+* `disarm` straight through; iOS feeds that string to
+* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
+* and every snooze and alarm button arrived BLANK. A pass-through is not a
+* mapping, and "the field is documented" is not "the value renders".
+*
+* Adding a member is TRAIN-BOUND. The enum lives in the published
+* `@camstack/server` closure and the cap seam validates against the HUB's copy,
+* so an addon that emits a token the running hub does not know does not lose an
+* icon — its whole `send` fails Zod validation and the notification never
+* arrives. Never emit a new token from an addon before the train carrying it.
+*/
+var NotificationActionIconSchema = _enum([
+	"acknowledge",
+	"dismiss",
+	"silence",
+	"snooze",
+	"view",
+	"play",
+	"open",
+	"close",
+	"lock",
+	"unlock",
+	"arm",
+	"arm-home",
+	"arm-away",
+	"arm-night",
+	"disarm",
+	"light",
+	"alert",
+	"camera"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = object({
+	id: string(),
+	label: string(),
+	url: string().optional(),
+	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
+	icon: NotificationActionIconSchema.optional(),
+	/**
+	* Renders in a warning style where the notifier supports it.
+	*
+	* A HINT, never a gate. The callback's authority is its token and nothing
+	* else — see `notification-center/action-token.ts` for what that does and
+	* does not buy.
+	*/
+	destructive: boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: _enum(["navigate", "background"]).optional()
+});
+/** A delivery parameter value: what a notifier declared it takes. */
+var DeliveryParamValueSchema = union([
+	string(),
+	number(),
+	boolean()
+]);
+/**
+* One extra delivery parameter a notifier KIND declares (D938). A rule that
+* addresses a target of that kind may set it; a kind that declares nothing is
+* never handed one. The admin UI derives its control from this descriptor —
+* no editor knows a service by name.
+*
+* Optional fields are `.optional()`, never `.default()` (a Zod default does not
+* run on the addon cap path).
+*/
+var DeliveryParamSchema = object({
+	key: string().min(1),
+	label: string(),
+	/** i18n key of the label, resolved by the declaring addon's namespace. */
+	labelKey: string().optional(),
+	type: _enum([
+		"enum",
+		"number",
+		"boolean",
+		"string"
+	]),
+	/** `enum` only: the closed set of accepted values. */
+	options: array(object({
+		value: string(),
+		label: string()
+	})).optional(),
+	/** `number` only. */
+	min: number().optional(),
+	max: number().optional(),
+	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
+	default: DeliveryParamValueSchema.optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = object({
+	body: string(),
+	title: string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: number().int().min(1).max(5).default(3),
+	level: string().optional(),
+	attachments: array(AttachmentSchema).optional(),
+	clickUrl: string().optional(),
+	actions: array(NotificationActionSchema).optional(),
+	sound: string().optional(),
+	ttl: number().optional(),
+	tag: string().optional(),
+	deviceId: number().optional(),
+	eventId: string().optional(),
+	metadata: record(string(), unknown()).optional(),
+	/**
+	* Values for the parameters the target's kind DECLARES in
+	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
+	* declaration by the sender; a notifier reads only the keys it declared.
+	*/
+	delivery: record(string(), DeliveryParamValueSchema).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = object({
+	id: string(),
+	label: string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: number().int().min(1).max(5).nullable(),
+	flags: object({
+		critical: boolean().optional(),
+		silent: boolean().optional(),
+		noPush: boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: array(string()).optional(),
+	description: string().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = object({
+	attachments: object({
+		mediaTypes: array(AttachmentMediaTypeSchema),
+		mode: _enum([
+			"url",
+			"bytes",
+			"both"
+		]),
+		max: number().int().nonnegative(),
+		maxBytes: number().int().positive().optional()
+	}),
+	/** Max action buttons (0 = none). */
+	actions: number().int().nonnegative(),
+	/**
+	* Whether this kind renders a per-action ICON.
+	*
+	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
+	* run on the addon cap path — three production failures in one day taught
+	* this repo that once. Absent is read as false by the degrade engine, which
+	* is the safe direction: an icon that is not rendered costs nothing, an icon
+	* assumed and dropped costs the operator's trust in the field.
+	*/
+	actionIcons: boolean().optional(),
+	levels: array(TargetKindLevelSchema),
+	format: array(NotificationFormatSchema),
+	clickUrl: boolean(),
+	sound: boolean(),
+	ttl: boolean(),
+	bodyMaxLen: number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough$4 = unknown();
+var TargetKindSchema = object({
+	kind: string(),
+	label: string(),
+	icon: string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: string().optional(),
+	configSchema: ConfigSchemaPassthrough$4,
+	/**
+	* The config keys that decide WHERE this kind's secrets are sent (server,
+	* base URL, instance, chat, recipient). A save that changes any of them
+	* while leaving a secret redacted is refused by the provider (D634), so an
+	* editor uses this to ask for the secret on exactly those edits instead of
+	* on every edit.
+	*
+	* Optional: absent from a provider that holds no secret (the Home Assistant
+	* kinds) and from a provider older than this field — an editor that finds
+	* it absent must assume ANY edit may need the secret.
+	*/
+	destinationKeys: array(string()).optional(),
+	supportsDiscovery: boolean(),
+	/**
+	* Extra delivery parameters a rule may set for a target of this kind (D938).
+	* Absent = none; the rule editor then offers nothing.
+	*/
+	deliveryParams: array(DeliveryParamSchema).optional(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = object({
+	id: string(),
+	name: string(),
+	kind: string(),
+	addonId: string(),
+	enabled: boolean(),
+	config: record(string(), unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = object({
+	kind: string(),
+	suggestedName: string(),
+	config: record(string(), unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = object({
+	level: string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: number().int().nonnegative(),
+	actionsSent: number().int().nonnegative(),
+	truncated: boolean(),
+	dropped: array(string())
+});
+var SendResultSchema = object({
+	success: boolean(),
+	error: string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+/**
+* Pre-save credential probe against a partial (unsaved) target config.
+* `resolvedUrl` never includes secrets (token stripped from path).
+*/
+var ProbeTargetConfigResultSchema = object({
+	ok: boolean(),
+	resolvedUrl: string(),
+	httpStatus: number().int().optional(),
+	stateInstance: string().optional(),
+	error: string().optional()
+});
+method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({ targetId: string() }), TargetSchema, { auth: "admin" }), method(object({
+	kind: string(),
+	config: record(string(), unknown()).optional(),
+	/**
+	* When editing / duplicating, the blank password field never round-trips
+	* the stored token. Pass the source target id so the provider can restore
+	* secrets server-side before dialling (same merge as upsert).
+	*/
+	targetId: string().optional()
+}), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
+	kind: string(),
+	config: record(string(), unknown()),
+	/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
+	targetId: string().optional()
+}), ProbeTargetConfigResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	targetId: string(),
+	notification: NotificationSchema
+}), SendResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	targetId: string(),
+	sample: NotificationSchema.optional()
+}), TestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	target: TargetSchema,
+	/**
+	* Duplicate flow: create a NEW target id while copying secrets from an
+	* existing row. The UI never holds the stored token; blank / redacted
+	* password fields are restored from this source (D634 still applies if
+	* destinations diverge without a re-typed secret).
+	*/
+	cloneSecretsFrom: string().optional()
+}), TargetSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ targetId: string() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	targetId: string(),
+	enabled: boolean()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
+looseObject({
+	name: string().min(1),
+	enabled: boolean().optional()
+});
+TargetSchema.omit({ id: true });
 var EncodeProfileSchema = object({
 	video: object({
 		codec: _enum([
@@ -22098,7 +22548,6 @@ var SYSTEM_CAP_VOCABULARY = {
 	"calendar-source": system(INTERNAL),
 	calendars: system("calendars feed schedules and conditions, not device actions"),
 	composer: system("device composition — an authoring tool, not an action"),
-	"connection-test": system(INTERNAL),
 	"core-blocks": system(INTERNAL),
 	"custom-model-registry": system(ML),
 	"data-store-provider": system(INTERNAL),
@@ -44015,427 +44464,6 @@ var UnitWarningSchema = object({
 	assumedUnit: string(),
 	message: string()
 });
-/**
-* notification-output — canonical, capability-gated notification delivery.
-*
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
-*
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
-*
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = _enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: string().optional(),
-	bytes: _instanceof(Uint8Array).optional(),
-	mime: string().optional(),
-	name: string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = _enum([
-	"text",
-	"markdown",
-	"html"
-]);
-/**
-* The CLOSED icon vocabulary an action button may use.
-*
-* A closed set, not a free string, and that is the whole point: an arbitrary
-* icon name is one that ntfy renders, zentik silently drops, and nobody
-* notices — the same class of gap as a zone vocabulary nothing produced
-* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
-* declares `actionIcons: false` and the degrade engine strips the field.
-*
-* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
-* renderer's icon set; "acknowledge" survives an adapter that draws it
-* differently.
-*
-* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
-*
-* These names are for US. **No adapter may forward one verbatim.** Each maps
-* the whole set onto its own renderer's vocabulary through a
-* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
-* fallback, so adding a member here fails every adapter's build until someone
-* decides its glyph, which is the only place that decision can be made
-* honestly.
-*
-* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
-* `disarm` straight through; iOS feeds that string to
-* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
-* and every snooze and alarm button arrived BLANK. A pass-through is not a
-* mapping, and "the field is documented" is not "the value renders".
-*
-* Adding a member is TRAIN-BOUND. The enum lives in the published
-* `@camstack/server` closure and the cap seam validates against the HUB's copy,
-* so an addon that emits a token the running hub does not know does not lose an
-* icon — its whole `send` fails Zod validation and the notification never
-* arrives. Never emit a new token from an addon before the train carrying it.
-*/
-var NotificationActionIconSchema = _enum([
-	"acknowledge",
-	"dismiss",
-	"silence",
-	"snooze",
-	"view",
-	"play",
-	"open",
-	"close",
-	"lock",
-	"unlock",
-	"arm",
-	"arm-home",
-	"arm-away",
-	"arm-night",
-	"disarm",
-	"light",
-	"alert",
-	"camera"
-]);
-/** A single tap-through action button. */
-var NotificationActionSchema = object({
-	id: string(),
-	label: string(),
-	url: string().optional(),
-	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
-	icon: NotificationActionIconSchema.optional(),
-	/**
-	* Renders in a warning style where the notifier supports it.
-	*
-	* A HINT, never a gate. The callback's authority is its token and nothing
-	* else — see `notification-center/action-token.ts` for what that does and
-	* does not buy.
-	*/
-	destructive: boolean().optional(),
-	/**
-	* How the tap should REACH the url.
-	*
-	* `navigate` (absent, and every button authored before this field) opens it:
-	* the phone leaves the notification and shows whatever the callback returns.
-	* That is right for a button whose answer the operator wants to read.
-	*
-	* `background` fires it as a POST and stays put. It exists for the buttons
-	* whose whole point is not to interrupt — "silence this for 30 minutes" is
-	* an answer to the notification, and being thrown into a browser tab to
-	* confirm it costs more attention than the notification did. A backend that
-	* cannot do a background call renders it as an ordinary link (the adapters
-	* fall back rather than dropping the button), so this is a preference, never
-	* a requirement.
-	*/
-	mode: _enum(["navigate", "background"]).optional()
-});
-/** A delivery parameter value: what a notifier declared it takes. */
-var DeliveryParamValueSchema = union([
-	string(),
-	number(),
-	boolean()
-]);
-/**
-* One extra delivery parameter a notifier KIND declares (D938). A rule that
-* addresses a target of that kind may set it; a kind that declares nothing is
-* never handed one. The admin UI derives its control from this descriptor —
-* no editor knows a service by name.
-*
-* Optional fields are `.optional()`, never `.default()` (a Zod default does not
-* run on the addon cap path).
-*/
-var DeliveryParamSchema = object({
-	key: string().min(1),
-	label: string(),
-	/** i18n key of the label, resolved by the declaring addon's namespace. */
-	labelKey: string().optional(),
-	type: _enum([
-		"enum",
-		"number",
-		"boolean",
-		"string"
-	]),
-	/** `enum` only: the closed set of accepted values. */
-	options: array(object({
-		value: string(),
-		label: string()
-	})).optional(),
-	/** `number` only. */
-	min: number().optional(),
-	max: number().optional(),
-	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
-	default: DeliveryParamValueSchema.optional()
-});
-/**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
-*/
-var NotificationSchema = object({
-	body: string(),
-	title: string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: number().int().min(1).max(5).default(3),
-	level: string().optional(),
-	attachments: array(AttachmentSchema).optional(),
-	clickUrl: string().optional(),
-	actions: array(NotificationActionSchema).optional(),
-	sound: string().optional(),
-	ttl: number().optional(),
-	tag: string().optional(),
-	deviceId: number().optional(),
-	eventId: string().optional(),
-	metadata: record(string(), unknown()).optional(),
-	/**
-	* Values for the parameters the target's kind DECLARES in
-	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
-	* declaration by the sender; a notifier reads only the keys it declared.
-	*/
-	delivery: record(string(), DeliveryParamValueSchema).optional()
-});
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = object({
-	id: string(),
-	label: string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: number().int().min(1).max(5).nullable(),
-	flags: object({
-		critical: boolean().optional(),
-		silent: boolean().optional(),
-		noPush: boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: array(string()).optional(),
-	description: string().optional()
-});
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = object({
-	attachments: object({
-		mediaTypes: array(AttachmentMediaTypeSchema),
-		mode: _enum([
-			"url",
-			"bytes",
-			"both"
-		]),
-		max: number().int().nonnegative(),
-		maxBytes: number().int().positive().optional()
-	}),
-	/** Max action buttons (0 = none). */
-	actions: number().int().nonnegative(),
-	/**
-	* Whether this kind renders a per-action ICON.
-	*
-	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
-	* run on the addon cap path — three production failures in one day taught
-	* this repo that once. Absent is read as false by the degrade engine, which
-	* is the safe direction: an icon that is not rendered costs nothing, an icon
-	* assumed and dropped costs the operator's trust in the field.
-	*/
-	actionIcons: boolean().optional(),
-	levels: array(TargetKindLevelSchema),
-	format: array(NotificationFormatSchema),
-	clickUrl: boolean(),
-	sound: boolean(),
-	ttl: boolean(),
-	bodyMaxLen: number().int().positive()
-});
-/**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
-*/
-var ConfigSchemaPassthrough$4 = unknown();
-var TargetKindSchema = object({
-	kind: string(),
-	label: string(),
-	icon: string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: string(),
-	/**
-	* URL of the kind's bundled BRAND icon, served by the providing addon over
-	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
-	* when the addon bundles no icon for that kind — the client then falls back
-	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
-	*
-	* Root-relative on purpose: it resolves against whatever origin serves a web
-	* client, and a native client joins it onto its own hub base.
-	*
-	* DECLARED here deliberately. It used to travel as an undeclared passthrough
-	* field that survived only because the runtime cap-router forwards provider
-	* output verbatim — so every consumer had to re-declare it by hand to stop
-	* its own Zod parse from stripping it, and the whole arrangement would have
-	* broken silently the moment output validation was tightened anywhere.
-	*/
-	iconUrl: string().optional(),
-	/**
-	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
-	*
-	* The server knows this and therefore says it, because the client cannot
-	* safely guess: a React-Native client renders SVG and raster through two
-	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
-	* not decode SVG on iOS/Android), so without this it silently fell back to a
-	* placeholder glyph for every vector icon while the web build looked fine.
-	*
-	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
-	* not been updated — a client that cannot determine the type should prefer
-	* its raster path, which is the safe default for an unknown image.
-	*/
-	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough$4,
-	/**
-	* The config keys that decide WHERE this kind's secrets are sent (server,
-	* base URL, instance, chat, recipient). A save that changes any of them
-	* while leaving a secret redacted is refused by the provider (D634), so an
-	* editor uses this to ask for the secret on exactly those edits instead of
-	* on every edit.
-	*
-	* Optional: absent from a provider that holds no secret (the Home Assistant
-	* kinds) and from a provider older than this field — an editor that finds
-	* it absent must assume ANY edit may need the secret.
-	*/
-	destinationKeys: array(string()).optional(),
-	supportsDiscovery: boolean(),
-	/**
-	* Extra delivery parameters a rule may set for a target of this kind (D938).
-	* Absent = none; the rule editor then offers nothing.
-	*/
-	deliveryParams: array(DeliveryParamSchema).optional(),
-	caps: TargetKindCapsSchema
-});
-/**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
-*/
-var TargetSchema = object({
-	id: string(),
-	name: string(),
-	kind: string(),
-	addonId: string(),
-	enabled: boolean(),
-	config: record(string(), unknown())
-});
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = object({
-	kind: string(),
-	suggestedName: string(),
-	config: record(string(), unknown())
-});
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = object({
-	level: string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: number().int().nonnegative(),
-	actionsSent: number().int().nonnegative(),
-	truncated: boolean(),
-	dropped: array(string())
-});
-var SendResultSchema = object({
-	success: boolean(),
-	error: string().optional(),
-	renderedAs: RenderedAsSchema.optional()
-});
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
-/**
-* Pre-save credential probe against a partial (unsaved) target config.
-* `resolvedUrl` never includes secrets (token stripped from path).
-*/
-var ProbeTargetConfigResultSchema = object({
-	ok: boolean(),
-	resolvedUrl: string(),
-	httpStatus: number().int().optional(),
-	stateInstance: string().optional(),
-	error: string().optional()
-});
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({ targetId: string() }), TargetSchema, { auth: "admin" }), method(object({
-	kind: string(),
-	config: record(string(), unknown()).optional(),
-	/**
-	* When editing / duplicating, the blank password field never round-trips
-	* the stored token. Pass the source target id so the provider can restore
-	* secrets server-side before dialling (same merge as upsert).
-	*/
-	targetId: string().optional()
-}), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
-	kind: string(),
-	config: record(string(), unknown()),
-	/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
-	targetId: string().optional()
-}), ProbeTargetConfigResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	notification: NotificationSchema
-}), SendResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	sample: NotificationSchema.optional()
-}), TestResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	target: TargetSchema,
-	/**
-	* Duplicate flow: create a NEW target id while copying secrets from an
-	* existing row. The UI never holds the stored token; blank / redacted
-	* password fields are restored from this source (D634 still applies if
-	* destinations diverge without a re-typed secret).
-	*/
-	cloneSecretsFrom: string().optional()
-}), TargetSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ targetId: string() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	enabled: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
 _enum([
 	"automation",
 	"action",
@@ -48313,37 +48341,6 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ blockIds: array(string()) }), object({ states: array(CompositionBlockStateSchema) }), { auth: "admin" });
-var ConnectionTestOutcomeSchema = discriminatedUnion("outcome", [
-	object({
-		outcome: literal("validated"),
-		/** Round-trip of the sign-in, when the provider measured it. */
-		latencyMs: number().nonnegative().optional(),
-		/** Optional human detail worth showing next to the tick
-		*  ("3 devices visible on this account"). */
-		detail: string().optional()
-	}).strict(),
-	object({
-		outcome: literal("rejected"),
-		error: string()
-	}).strict(),
-	object({
-		outcome: literal("inconclusive"),
-		error: string()
-	}).strict()
-]);
-var ConnectionTestInputSchema = object({ 
-/** Candidate integration settings, exactly as the create form collected them. */
-settings: record(string(), unknown()) });
-/**
-* What the provider's test actually DOES, so the UI can say it in words before
-* the operator presses the button ("Signs in to the Dreo cloud"). Purely
-* descriptive — it never changes routing.
-*/
-var ConnectionTestDescriptorSchema = object({ label: string() });
-method(ConnectionTestInputSchema, ConnectionTestOutcomeSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), ConnectionTestDescriptorSchema, { auth: "admin" });
 object({
 	/** True when the upstream system considers the entity connected. */
 	connected: boolean(),
@@ -54197,10 +54194,9 @@ var AvailableIntegrationTypeSchema = object({
 	*  locations" checkbox. Provider-declared in the addon manifest. */
 	supportsLocationImport: boolean(),
 	/**
-	* True when this integration DECLARES a pre-creation test (the
-	* `connection-test` cap, or a broker whose settings it stores). Drives the
-	* Test button: an integration that cannot be tested must say so up front
-	* rather than offering a button that always answers the same nonsense.
+	* True when this integration's instances declare a Test (`integration-instances.describe().canTest`,
+	* D1016). An integration that cannot be tested must say so up front rather than offering a
+	* button that always answers the same nonsense.
 	*/
 	canTest: boolean(),
 	existingInstances: array(object({
@@ -54254,7 +54250,9 @@ var CreateIntegrationInputSchema = object({
 	info: record(string(), unknown()).optional(),
 	/** `stableId` of the discovery candidate the form was seeded from (D984). */
 	originStableId: string().optional(),
-	settings: record(string(), unknown()).optional()
+	settings: record(string(), unknown()).optional(),
+	/** The instance kind being created, for a provider with several; omitted = its only testable kind. */
+	kind: string().min(1).optional()
 });
 var UpdateIntegrationInputSchema = object({
 	id: string(),
@@ -54280,13 +54278,7 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 }), method(object({ id: string() }), DeleteIntegrationResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), array(AvailableIntegrationTypeSchema), { auth: "admin" }), method(object({
-	addonId: string(),
-	settings: record(string(), unknown())
-}), TestConnectionResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
+}), method(_void(), array(AvailableIntegrationTypeSchema), { auth: "admin" });
 /**
 * `integration-instances` - the connection of an addon that holds ONE or SEVERAL
 * (an account, a relay, a destination) as typed records (D985, D986). The addon's
@@ -62529,13 +62521,6 @@ var AddBrokerInputSchema = object({
 });
 var AddBrokerResultSchema = object({ id: string() });
 var IdInputSchema = object({ id: string() });
-var TestResultSchema$1 = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number()
-}), object({
-	ok: literal(false),
-	error: string()
-})]);
 var StartEmbeddedInputSchema = object({
 	port: number().int().min(1).max(65535).default(1883),
 	/** Allow anonymous connect (no username/password). Default: false. */
@@ -62572,10 +62557,6 @@ var mqttBrokerCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		testConnection: method(IdInputSchema, TestResultSchema$1, {
-			kind: "mutation",
-			auth: "admin"
-		}),
 		startEmbeddedBroker: method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -74191,7 +74172,7 @@ var TrainingProviderTypeSchema = object({
 	label: string(),
 	/** Path under the addon package (e.g. `assets/training-modal/icon.svg`). */
 	iconAsset: string(),
-	/** Owning `training-provider` addon — collection selector for createEntry. */
+	/** Owning `training-provider` addon. */
 	addonId: string(),
 	/**
 	* Fields for one entry of this type (credentials + defaults). Absent on a
@@ -74236,36 +74217,6 @@ var TrainingProviderDescriptorSchema = object({
 	*/
 	formValues: record(string(), unknown()).optional()
 });
-/**
-* Patch one entry's name, credentials and defaults. Pin with owning `{ addonId }`.
-* An omitted or empty `tokenSecret` means KEEP the stored secret (D787).
-* `{ $secretClear: true }` clears it.
-*/
-var TrainingProviderUpdateEntryInputSchema = object({
-	entryId: string().min(1),
-	name: string().min(1),
-	tokenId: string().optional(),
-	tokenSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
-	environment: string().optional(),
-	gpuType: string().optional(),
-	region: string().optional(),
-	costCapUsd: number().nonnegative().optional(),
-	maxRuntimeSec: number().int().positive().optional(),
-	failedDatasetGraceHours: number().nonnegative().optional()
-});
-var TrainingCredentialCheckSchema = object({
-	ok: boolean(),
-	/** Workspace / account name, when the provider says. */
-	account: string().optional(),
-	reason: _enum([
-		"missing",
-		"invalid",
-		"forbidden",
-		"network",
-		"quota"
-	]).optional(),
-	detail: string().optional()
-});
 var ProviderJobStateSchema = _enum([
 	"pending",
 	"starting",
@@ -74313,22 +74264,6 @@ var TrainingLogLineSchema = object({
 	text: string()
 });
 method(object({}), array(TrainingProviderDescriptorSchema).readonly(), { auth: "admin" }), method(object({}), array(TrainingProviderTypeSchema).readonly(), { auth: "admin" }), method(object({}), array(TrainingProviderEntrySchema).readonly(), { auth: "admin" }), method(object({
-	typeId: string().min(1),
-	name: string().min(1)
-}), object({ entryId: string() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ entryId: string().min(1) }), object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(TrainingProviderUpdateEntryInputSchema, object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ entryId: string().min(1) }), TrainingCredentialCheckSchema, {
-	kind: "mutation",
-	auth: "admin",
-	timeoutMs: 3e4
-}), method(object({
 	entryId: string().min(1),
 	gpuType: string(),
 	region: string(),
@@ -77714,20 +77649,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"connectionTest.describeTest": {
-		capName: "connection-test",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"connectionTest.testSettings": {
-		capName: "connection-test",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"connectivity.getStatus": {
 		capName: "connectivity",
 		capScope: "device",
@@ -80094,13 +80015,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"integrations.testConnection": {
-		capName: "integrations",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"integrations.update": {
 		capName: "integrations",
 		capScope: "system",
@@ -81333,13 +81247,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"mqttBroker.testConnection": {
-		capName: "mqtt-broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"nativeObjectDetection.getOptions": {
 		capName: "native-object-detection",
 		capScope: "device",
@@ -86170,20 +86077,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"trainingProvider.createEntry": {
-		capName: "training-provider",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"trainingProvider.deleteEntry": {
-		capName: "training-provider",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"trainingProvider.describe": {
 		capName: "training-provider",
 		capScope: "system",
@@ -86254,13 +86147,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"trainingProvider.updateEntry": {
-		capName: "training-provider",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"trainingProvider.uploadDataset": {
 		capName: "training-provider",
 		capScope: "system",
@@ -86268,13 +86154,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"trainingProvider.validateCredentials": {
-		capName: "training-provider",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"turnProvider.getTurnServers": {
 		capName: "turn-provider",
 		capScope: "system",
@@ -123262,7 +123141,7 @@ var BrokerProbeCache = class {
 		}
 		if (this.inflight) await this.inflight.catch(() => void 0);
 	}
-	/** Force a refresh (used by `testConnection` and the page's Refresh button). */
+	/** Force a refresh (used by the page's Refresh button). */
 	async probeNow(id) {
 		const broker = this.getBrokers().find((b) => b.id === id);
 		if (!broker) return void 0;
@@ -124244,8 +124123,8 @@ var MqttAclStore = class MqttAclStore {
 *   - The legacy single embedded broker is an onboard `brokers` record (migrated from the flat
 *     `embedded*` keys, same id); `startEmbeddedBroker` / `stopEmbeddedBroker` act on that record.
 *   - `addBroker` / `removeBroker` mutate the records and the runtime state.
-*   - `testConnection` does a one-shot `mqtt.connect` race against a 3s
-*     timeout AND refreshes the probe cache for the broker.
+*   - The instance test (`integration-instances.testInstance`) does a one-shot `mqtt.connect`
+*     race against a 3s timeout.
 */
 /** bcrypt cost factor — exported for tests. */
 var MQTT_EMBEDDED_BCRYPT_ROUNDS = 10;
@@ -124381,7 +124260,6 @@ var MqttBrokerAddon = class extends BaseAddon {
 			getBrokerConfig: async ({ id }) => this.getBrokerConfig(id),
 			addBroker: async (input) => this.addBroker(input),
 			removeBroker: async ({ id }) => this.removeBroker(id),
-			testConnection: async ({ id }) => this.testConnection(id),
 			startEmbeddedBroker: async (input) => this.startEmbeddedBroker(input),
 			stopEmbeddedBroker: async ({ id }) => this.stopEmbeddedBroker(id),
 			getStatus: async () => ({
@@ -124524,24 +124402,10 @@ var MqttBrokerAddon = class extends BaseAddon {
 			return;
 		}
 	}
-	async testConnection(id) {
-		let cfg;
-		try {
-			cfg = this.getBrokerConfig(id);
-		} catch (err) {
-			return {
-				ok: false,
-				error: errMsg(err)
-			};
-		}
-		this.probeCache?.probeNow(id).catch(() => void 0);
-		return this.probeMqtt(cfg);
-	}
 	/**
 	* One-shot connectivity probe against an MQTT endpoint built from a
-	* flat config (`{url, username?, password?}`). Shared by the
-	* id-keyed `testConnection` (existing broker) and the pre-creation
-	* the instance test (`testInstance`) of a broker not saved yet (the typed values).
+	* flat config (`{url, username?, password?}`), used by the instance test
+	* (`integration-instances.testInstance`), stored or draft.
 	* Never throws — every failure resolves to `{ ok: false, error }`.
 	*/
 	async probeMqtt(cfg) {