@camstack/addon-smtp-nodemailer 1.2.150 → 1.2.152

package/dist/smtp.addon.js

@@ -38,7 +38,7 @@ var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["modu
 //#endregion
 let node_crypto = require("node:crypto");
 let node_net = require("node:net");
-//#region ../types/dist/event-category-BmPm98n0.mjs
+//#region ../types/dist/event-category-78tcBemo.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -159,6 +159,23 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AddonLoadRecovered"] = "addon.load-recovered";
 	/**
+	* An addon is RUNNING although its installed package is below what the
+	* running server requires (`camstack.requires.addons` of the server, or the
+	* addon's own `requires.server`). Raised once per streak by the unsupported-
+	* addon tracker, on the hub and on agents; AlertCenter turns it into one
+	* operator alert per node and package. The addon is never held back for it.
+	*
+	* Payload: `{ packageName, addonId, nodeId, installedVersion, requiredMinimum, serverVersion, unmet }`.
+	*/
+	EventCategory["AddonUnsupportedVersion"] = "addon.unsupported-version";
+	/**
+	* The package of an {@link AddonUnsupportedVersion} alert reached a supported
+	* version, or is no longer installed on the node. AlertCenter dismisses the matching alert.
+	*
+	* Payload: `{ packageName, addonId, nodeId }`.
+	*/
+	EventCategory["AddonUnsupportedResolved"] = "addon.unsupported-resolved";
+	/**
 	* Monitor scheduled the next retry for a failed addon. Transient —
 	* surfaced to the UI for live-updating the "next retry in Ns"
 	* countdown on the Addons page row, NOT persisted as an alert.
@@ -269,7 +286,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["ProcessRestarted"] = "process.restarted";
 	/**
 	* The SET of storage locations changed — one was created, edited, enabled,
-	* disabled or deleted through `storage.upsertLocation` / `deleteLocation`.
+	* disabled or deleted through the location instances or the forced-delete action.
 	*
 	* Telemetry, not a transaction (D8/D11): every consumer that re-resolves on
 	* it must also converge on its own periodic path, because a dropped event
@@ -6020,7 +6037,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-CmjWurK5.mjs
+//#region ../types/dist/sleep-CQP-REJp.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6384,6 +6401,59 @@ Object.fromEntries([
 function isValuelessField(field) {
 	return field.type === "separator" || field.type === "info" || field.type === "qr-code" || field.type === "button" || field.type === "object-array" || field.type === "widget" || field.type === "addon-action-button" || field.type === "device-action-button" || field.type === "account-sign-in" || field.type === "secret-presence";
 }
+/**
+* Base collector: flatten a hydrated `ConfigUISchemaWithValues` into
+* `key → { value, default }`, recursing through `group` and `sub-tabs`
+* layout fields. Keeping `value` and `default` SEPARATE (rather than
+* pre-resolving) lets callers both read the effective value AND detect
+* overrides (`value` differs from `default`). Structural over `unknown`;
+* malformed input yields an empty map, never throws.
+*/
+function collectHydratedFieldEntries(schema) {
+	const out = /* @__PURE__ */ new Map();
+	if (typeof schema !== "object" || schema === null) return out;
+	const sections = schema.sections;
+	if (!Array.isArray(sections)) return out;
+	for (const section of sections) if (typeof section === "object" && section !== null) collectFieldEntriesInto(section.fields, out);
+	return out;
+}
+/** Recursive field walker for {@link collectHydratedFieldEntries}. */
+function collectFieldEntriesInto(fields, into) {
+	if (!Array.isArray(fields)) return;
+	for (const field of fields) {
+		if (typeof field !== "object" || field === null) continue;
+		const type = field.type;
+		if (type === "group") {
+			collectFieldEntriesInto(field.fields, into);
+			continue;
+		}
+		if (type === "sub-tabs") {
+			const tabs = field.tabs;
+			if (Array.isArray(tabs)) {
+				for (const tab of tabs) if (typeof tab === "object" && tab !== null) collectFieldEntriesInto(tab.fields, into);
+			}
+			continue;
+		}
+		const key = field.key;
+		if (typeof key !== "string" || key.length === 0) continue;
+		if (!("value" in field)) continue;
+		into.set(key, {
+			value: field.value,
+			default: field.default
+		});
+	}
+}
+/**
+* Flatten a hydrated settings payload into `key → EFFECTIVE value`
+* (`value ?? default`). The read-side inverse of `hydrateSchema` for the
+* common "just give me the resolved values" case. Built on
+* {@link collectHydratedFieldEntries}.
+*/
+function collectHydratedFieldValues(schema) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [key, entry] of collectHydratedFieldEntries(schema)) out.set(key, entry.value ?? entry.default);
+	return out;
+}
 function hydrateSchema(schema, values, options = {}) {
 	return {
 		...schema.tabs ? { tabs: [...schema.tabs] } : {},
@@ -6729,10 +6799,33 @@ function integrationRowsApiOver(api) {
 	};
 }
 var PREFIX = "records/";
+/**
+* Cross-realm brand. An addon bundles its own copy of this module (D15) while
+* `ctx.records` is the HOST's door, so an error thrown by the host is an
+* instance of the host's classes, not of the addon's. The brand plus the code
+* make `instanceof` answer by identity of the failure, not of the copy.
+*/
+var RECORDS_ERROR_BRAND = Symbol.for("camstack.records-error");
+function carriesBrand(value) {
+	return typeof value === "object" && value !== null && Reflect.get(value, RECORDS_ERROR_BRAND) === true;
+}
 /** The base of every records failure. `detail` is the human part of the message. */
 var RecordsError = class extends Error {
+	/** The code a subclass stands for; the base stands for every code. */
+	static code = void 0;
+	/**
+	* `instanceof` across copies of this module: any branded error is a
+	* `RecordsError`, and is an instance of a subclass only when its code is the
+	* subclass's code. Same-copy answers are unchanged.
+	*/
+	static [Symbol.hasInstance](value) {
+		if (Function.prototype[Symbol.hasInstance].call(this, value)) return true;
+		if (!carriesBrand(value)) return false;
+		return this.code === void 0 || value.code === this.code;
+	}
 	code;
 	detail;
+	[RECORDS_ERROR_BRAND] = true;
 	constructor(code, detail) {
 		super(`${PREFIX}${code}: ${detail}`);
 		this.name = "RecordsError";
@@ -6741,29 +6834,33 @@ var RecordsError = class extends Error {
 	}
 };
 /** A write guarded by `ifRev` found another revision (or an existing row for `ifRev: 0`). */
-var RevConflictError = class extends RecordsError {
+var RevConflictError = class RevConflictError extends RecordsError {
+	static code = "rev-conflict";
 	constructor(detail) {
-		super("rev-conflict", detail);
+		super(RevConflictError.code, detail);
 		this.name = "RevConflictError";
 	}
 };
 /** The keychain could not store or serve a value: explicit, never an empty string. */
-var RecordSecretUnavailableError = class extends RecordsError {
+var RecordSecretUnavailableError = class RecordSecretUnavailableError extends RecordsError {
+	static code = "secret-unavailable";
 	constructor(detail) {
-		super("secret-unavailable", detail);
+		super(RecordSecretUnavailableError.code, detail);
 		this.name = "RecordSecretUnavailableError";
 	}
 };
-var InvalidRecordError = class extends RecordsError {
+var InvalidRecordError = class InvalidRecordError extends RecordsError {
+	static code = "invalid-record";
 	constructor(detail) {
-		super("invalid-record", detail);
+		super(InvalidRecordError.code, detail);
 		this.name = "InvalidRecordError";
 	}
 };
 /** A kind declaration the engine refuses (non-additive change, bad shape, wrong file). */
-var DeclarationRefusedError = class extends RecordsError {
+var DeclarationRefusedError = class DeclarationRefusedError extends RecordsError {
+	static code = "declaration-refused";
 	constructor(detail) {
-		super("declaration-refused", detail);
+		super(DeclarationRefusedError.code, detail);
 		this.name = "DeclarationRefusedError";
 	}
 };
@@ -7241,17 +7338,35 @@ var RecordIntegrationInstances = class {
 			...kind !== void 0 ? { kind } : {}
 		});
 		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
+		const initial = this.hooks.initialBody(name, kind);
+		const patch = this.patchOf(values ?? {});
+		if (Object.keys(patch).length > 0) Object.assign(patch, await this.hooks.validateWrite?.({
+			kind,
+			body: {
+				...initial,
+				...patch
+			}
+		}));
 		await this.handle.put({
 			id: minted,
-			data: this.hooks.initialBody(name, kind)
+			data: initial
 		}, { ifRev: 0 });
-		const patch = this.patchOf(values ?? {});
 		if (Object.keys(patch).length > 0) await this.handle.patch(minted, patch);
 		await this.hooks.onChanged?.(minted, "created");
 		return { id: minted };
 	};
 	updateInstance = async ({ id, name, values }) => {
 		const patch = this.patchOf(values);
+		if (this.hooks.validateWrite !== void 0 && Object.keys(patch).length > 0) {
+			const stored = await this.handle.get(id);
+			if (stored !== null) Object.assign(patch, await this.hooks.validateWrite({
+				kind: void 0,
+				body: {
+					...stored.data,
+					...patch
+				}
+			}));
+		}
 		if (name !== void 0) patch[this.nameField] = name;
 		await this.handle.patch(id, patch);
 		await this.hooks.onChanged?.(id, "updated");
@@ -7562,6 +7677,21 @@ var SCOPED_SETTINGS_SCOPES = [
 	"device-defaults",
 	"node"
 ];
+/** The one refusal of a key a scope did not declare. */
+function assertDeclaredKeys(keys, declared) {
+	const undeclared = keys.filter((key) => !declared.has(key));
+	if (undeclared.length > 0) throw new Error(`scoped settings: [${undeclared.join(", ")}] not declared for this scope (declared: [${[...declared].join(", ")}])`);
+}
+/** Build the handle over an addon's scoped read, write and unset. */
+function createScopedSettings(deps) {
+	return {
+		async get() {
+			return deps.schema.parse(await deps.read());
+		},
+		patch: (patch) => deps.write(Object.fromEntries(Object.entries(patch))),
+		unset: (keys) => deps.unset(keys)
+	};
+}
 /** A write to a secret path could not be stored in the keychain, so it was refused. */
 var KeychainWriteRefusedError = class extends Error {
 	fieldPath;
@@ -8137,7 +8267,16 @@ function createHandle(raw, opts) {
 				return blob;
 			}
 		},
-		writeAddonStore: writeAddon
+		writeAddonStore: writeAddon,
+		removeClearedKeys: (keys) => serialize("addon", async () => {
+			const stored = await readStoredAddonBlob(raw);
+			index.seen("addon", stored);
+			const removable = keys.filter((key) => collectSecretMarkerRefs(stored[key]).length === 0);
+			if (removable.length === 0) return;
+			const patch = Object.fromEntries(removable.map((key) => [key, void 0]));
+			await raw.writeAddonStore(patch);
+			index.wrote("addon", patch);
+		})
 	};
 }
 /** The context the addon sees, plus the private raw view and write outcome. */
@@ -8682,6 +8821,151 @@ var BaseAddon = class {
 		}
 	}
 	/**
+	* Hook: values layered over the stored ones when the FORM of one scope is served
+	* ({@link getScopedSettings}) — a preview that derives dependent options without writing.
+	* Never applied to {@link ScopedSettings.get} or to a write. `null` ⇒ no overlay.
+	*/
+	async scopedSettingsOverlay(_scope, _cap, _nodeId) {
+		return null;
+	}
+	/**
+	* Hook: a write of one scope changed stored values (not called when the store reports no change,
+	* e.g. the write-back of a stored secret). `keys` are the bare field keys of the write, node keys included.
+	*/
+	async onScopedSettingsChanged(_scope, _cap, _keys) {}
+	/** Typed handle over the CLUSTER settings `cap` declares (`clusterSettingsSchema`). */
+	clusterSettings(cap, schema) {
+		return this.scopedHandle("cluster", cap, schema);
+	}
+	/** Typed handle over the fleet defaults of the per-device settings `cap` declares. */
+	deviceDefaults(cap, schema) {
+		return this.scopedHandle("device-defaults", cap, schema);
+	}
+	/**
+	* Typed handle over the settings `cap` owns PER NODE. `nodeId` omitted ⇒ the local node. A node
+	* with no row yields the schema defaults — never a bare-key fallback.
+	*/
+	nodeSettings(cap, schema, nodeId) {
+		return this.scopedHandle("node", cap, schema, nodeId);
+	}
+	/**
+	* {@link state} for a value that is kept per node: stored under `<key>@<nodeId>`, and the
+	* settings store carries `nodeId` in the row data (D986 §1), so a forgotten node's rows go in one
+	* central delete. `nodeId` omitted ⇒ the local node.
+	*/
+	nodeState(key, schema, fallback, nodeId) {
+		this._declaredStateKeys.add(key);
+		return createDurableState({
+			key: nodeScopedKey(key, nodeId ?? this._ctx?.kernel?.localNodeId ?? ""),
+			schema,
+			fallback,
+			read: async () => this.resolveStoredSecrets(await this.readAddonStoreWithRetry()),
+			write: async (patch) => {
+				await this._ctx?.settings?.writeAddonStore(patch);
+			},
+			onParseError: (k, e) => this._ctx?.logger?.warn?.(`durable-state: stored "${k}" failed validation — using fallback`, { meta: {
+				addonId: this._ctx?.id,
+				key: k,
+				error: String(e)
+			} })
+		});
+	}
+	/** The loaded schema `cap` declares for `scope`, or `null`. */
+	async declaredScopedSchema(scope, cap) {
+		await this.loadScopedSchemas(cap);
+		return this.loadedScopedSchemas(cap).find((entry) => entry.scope === scope)?.schema ?? null;
+	}
+	async requireScopedSchema(scope, cap) {
+		const schema = await this.declaredScopedSchema(scope, cap);
+		if (schema === null) throw new Error(`${this.constructor.name}: cap "${cap}" declares no ${scope} settings`);
+		return schema;
+	}
+	scopedKeys(schema) {
+		return new Set(schema.sections.flatMap((section) => collectValueFieldKeys(section.fields)));
+	}
+	/** `store` narrowed to the keys `schema` declares. */
+	narrowToScope(store, schema) {
+		const keys = this.scopedKeys(schema);
+		return Object.fromEntries(Object.entries(store).filter(([key]) => keys.has(key)));
+	}
+	scopedHandle(scope, cap, schema, nodeId) {
+		return createScopedSettings({
+			schema,
+			read: async () => {
+				const declared = await this.requireScopedSchema(scope, cap);
+				const stored = this.narrowToScope(await this.resolveGlobalStore(nodeId, cap), declared);
+				const effective = collectHydratedFieldValues(hydrateSchema(declared, stored));
+				return {
+					...Object.fromEntries([...effective].filter(([, value]) => value !== void 0)),
+					...stored
+				};
+			},
+			write: (patch) => this.writeScoped(scope, cap, patch, nodeId),
+			unset: (keys) => this.unsetScoped(scope, cap, keys, nodeId)
+		});
+	}
+	/** The one write path of the scoped API: declared keys only, then the global patch. */
+	async writeScoped(scope, cap, patch, nodeId) {
+		assertDeclaredKeys(Object.keys(patch), this.scopedKeys(await this.requireScopedSchema(scope, cap)));
+		if (await this.applyGlobalPatch(patch, scope === "node" ? nodeId : void 0, cap)) await this.onScopedSettingsChanged(scope, cap, Object.keys(patch));
+	}
+	/**
+	* Remove declared keys of one scope. A secret goes through {@link clearSecrets} — its keychain
+	* value is released exactly as there — and the emptied row is then removed; every other key is
+	* removed by an `undefined` patch (which a secret transform would read as "keep").
+	*/
+	async unsetScoped(scope, cap, keys, nodeId) {
+		assertDeclaredKeys(keys, this.scopedKeys(await this.requireScopedSchema(scope, cap)));
+		const target = scope === "node" ? nodeId : void 0;
+		const tree = this.addonSecretTree();
+		const secretKeys = keys.filter((key) => tree.has(key));
+		const plainKeys = keys.filter((key) => !tree.has(key));
+		let changed = false;
+		if (plainKeys.length > 0) {
+			const patch = Object.fromEntries(plainKeys.map((key) => [key, void 0]));
+			changed = await this.applyGlobalPatch(patch, target, cap) || changed;
+		}
+		if (secretKeys.length > 0) {
+			await this.clearSecretKeys(secretKeys, target, cap);
+			const node = normalizeNodeId(target ?? this._ctx?.kernel?.localNodeId);
+			const rows = secretKeys.map((key) => scope === "node" ? nodeScopedKey(key, node) : key);
+			if (this._secretSettings !== null) await this._secretSettings.removeClearedKeys(rows);
+			else await this._ctx?.settings?.writeAddonStore(Object.fromEntries(rows.map((row) => [row, void 0])));
+			changed = true;
+		}
+		if (changed) await this.onScopedSettingsChanged(scope, cap, [...keys]);
+	}
+	/**
+	* The hydrated form of one scope of one capability's settings (any
+	* {@link scopedSettingsOverlay} applied), or `null` when the capability declares nothing there.
+	*/
+	async getScopedSettings(scope, cap, nodeId) {
+		const schema = await this.declaredScopedSchema(scope, cap);
+		if (schema === null) return null;
+		const stored = this.narrowToScope(await this.readRawProjectedStore(nodeId, cap), schema);
+		const overlay = await this.scopedSettingsOverlay(scope, cap, nodeId);
+		return hydrateSchema(schema, overlay ? await this.overlayKeepingMarkers(stored, overlay) : stored, { inlineSecretsAsViews: true });
+	}
+	/** The OPERATOR's write of declared keys of one scope (D787 secret semantics). */
+	async updateScopedSettings(scope, cap, patch, nodeId) {
+		this._operatorWriteDepth++;
+		try {
+			await this.writeScoped(scope, cap, patch, nodeId);
+		} finally {
+			this._operatorWriteDepth--;
+		}
+	}
+	/**
+	* The effective values (`stored ?? default`) of one scope, a secret as its `set` view — never
+	* its value. `null` when the capability declares nothing for the scope.
+	*/
+	async readScopedValues(scope, cap, nodeId) {
+		const schema = await this.declaredScopedSchema(scope, cap);
+		if (schema === null) return null;
+		const form = hydrateSchema(schema, this.narrowToScope(await this.readRawProjectedStore(nodeId, cap), schema), { inlineSecretsAsViews: true });
+		return Object.fromEntries([...collectHydratedFieldValues(form)].filter(([, value]) => value !== void 0));
+	}
+	/**
 	* What the create wizard and the integration edit page render for one instance: the addon's
 	* per-instance schema when it declares one, else its global schema (what they always showed).
 	*/
@@ -8833,6 +9117,9 @@ var BaseAddon = class {
 	* a keychain (an older kernel) it writes `''`, as such code always did.
 	*/
 	async clearSecrets(keys, nodeId) {
+		await this.clearSecretKeys(keys, nodeId);
+	}
+	async clearSecretKeys(keys, nodeId, cap) {
 		const tree = this.addonSecretTree();
 		const keychain = this._ctx?.secrets !== void 0;
 		const stored = keychain ? await this.readAddonStoreWithRetry() : {};
@@ -8845,25 +9132,27 @@ var BaseAddon = class {
 			const keychainStored = tree.has(key) || collectSecretMarkerRefs(stored[key]).length > 0;
 			patch[key] = keychain && keychainStored ? SECRET_CLEAR : "";
 		}
-		await this.applyGlobalPatch(patch, nodeId);
+		await this.applyGlobalPatch(patch, nodeId, cap);
 	}
-	async applyGlobalPatch(barePatch, nodeId) {
-		await this.loadScopedSchemas();
-		const keys = this.perNodeKeys();
+	/** Resolves `true` when the write changed stored values. */
+	async applyGlobalPatch(barePatch, nodeId, cap) {
+		await this.loadScopedSchemas(cap);
+		const keys = this.perNodeKeys(cap);
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
 		const scoped = keys.size > 0 ? scopePatch(barePatch, keys, target) : barePatch;
 		const handle = this._secretSettings;
 		if (handle !== null) {
 			const { changed } = await handle.writeAddonStore(scoped);
-			if (!changed) return;
+			if (!changed) return false;
 		} else await this._ctx?.settings?.writeAddonStore(scoped);
-		if (target !== localNode) return;
+		if (target !== localNode) return true;
 		await this.resolveConfig();
 		await this.onConfigChanged();
 		this.emitLifecycle(EventCategory.AddonUpdated, { level: "global" });
 		const legacy = this.globalSettingsSchema();
 		this.maybeAutoRestart(Object.keys(barePatch), [...legacy === null ? [] : [legacy], ...this.loadedScopedSchemas().map((entry) => entry.schema)]);
+		return true;
 	}
 	/**
 	* The set of field keys the global settings schema declares `perNode: true`
@@ -9558,30 +9847,94 @@ function normalizeAddonInitResult(result) {
 	if (Array.isArray(result)) return { providers: result };
 	return result;
 }
+object({
+	field: string().min(1),
+	on: literal("advance")
+});
 /**
-* The share-view scope kinds a share-link token can carry. The hub mints
-* and validates them (`ShareViewGrantSchema` builds its
-* enum from this list); a data plane names the kinds it ACCEPTS in `share`.
+* Output schema shared by the contribution + live methods.
+*
+* Mirrors the `ConfigUISchemaWithValues` shape (sections[] + optional
+* tabs[]) without importing from `../interfaces/config-ui.js` — a
+* concrete-but-lenient Zod object keeps tRPC output inference happy
+* (using `z.unknown()` here collapses unrelated router branches to
+* `unknown` when the generator re-inlines the huge AppRouter type).
+*
+* `.passthrough()` on sections/fields accepts whatever FormBuilder
+* extensions the caller adds (showWhen, displayScale, …) without
+* rebuilding every time a new field kind is introduced.
 */
-var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
-/** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
-var PeerBytesTicketSchema = object({
-	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
-	url: string().min(1),
-	/**
-	* The HOST node this URL means something on — the hub or a named agent,
-	* never a runner. {@link AddonPeerBytes.open} compares it to its own and
-	* refuses `cross-node` by name when they differ, without dialling.
-	*/
-	hostNodeId: string().min(1),
-	expiresAtMs: number().int().nonnegative(),
-	/**
-	* What the producer DECLARED the body to be, when it knows — `null` when it
-	* does not. Never `0` for unknown (D393): a consumer sizing a bound off this
-	* must be able to tell "the producer did not say" from "the body is empty".
-	*/
-	declaredBytes: number().int().nonnegative().nullable()
+var ContributionSectionSchema = object({
+	id: string(),
+	title: string(),
+	description: string().optional(),
+	style: _enum(["card", "accordion"]).optional(),
+	defaultCollapsed: boolean().optional(),
+	columns: union([
+		literal(1),
+		literal(2),
+		literal(3),
+		literal(4)
+	]).optional(),
+	tab: string().optional(),
+	location: _enum([
+		"settings",
+		"top-tab",
+		"hero"
+	]).optional(),
+	order: number().optional(),
+	fields: array(any())
 });
+object({
+	tabs: array(object({
+		id: string(),
+		label: string(),
+		icon: string(),
+		order: number().optional()
+	})).optional(),
+	sections: array(ContributionSectionSchema)
+}).nullable();
+object({ deviceId: number() }), object({ deviceId: number() }), object({
+	deviceId: number(),
+	patch: record(string(), unknown())
+}), object({ success: literal(true) });
+object({ deviceId: number() }), unknown().nullable();
+function method(input, output, options) {
+	return {
+		input,
+		output,
+		kind: options?.kind ?? "query",
+		...options?.auth !== void 0 ? { auth: options.auth } : {},
+		...options?.access !== void 0 ? { access: options.access } : {},
+		...options?.role !== void 0 ? { role: options.role } : {},
+		...options?.caller !== void 0 ? { caller: options.caller } : {},
+		timeoutMs: options?.timeoutMs
+	};
+}
+/**
+* A wrapper/system-only method: served exclusively by the cap's system-level
+* provider (`InferProvider`), and OPTIONAL on `InferNativeProvider` so per-device
+* driver natives don't stub out a wrapper concern (e.g. a cross-device cache
+* overview). The `systemOnly: true` literal is what `InferNativeProvider` keys on.
+*/
+function systemMethod(input, output, options) {
+	return {
+		...method(input, output, options),
+		systemOnly: true
+	};
+}
+/**
+* A method a SOURCE of a collection cap may legitimately not serve — OPTIONAL
+* on `InferProvider`. The `providerOptional: true` literal is what
+* `InferProvider` keys on; see {@link CapabilityMethodSchema.providerOptional}
+* for when this is the honest answer and when it is a soft stub.
+*/
+function optionalMethod(input, output, options) {
+	return {
+		...method(input, output, options),
+		providerOptional: true
+	};
+}
 function defOf(schema) {
 	const zodBag = Reflect.get(schema, "_zod");
 	if (typeof zodBag !== "object" || zodBag === null) return {};
@@ -9838,94 +10191,30 @@ function defineEntryKind(name, spec) {
 	if (defined === void 0) throw new DeclarationRefusedError(`entry kind "${name}" was not built`);
 	return defined;
 }
-object({
-	field: string().min(1),
-	on: literal("advance")
-});
 /**
-* Output schema shared by the contribution + live methods.
-*
-* Mirrors the `ConfigUISchemaWithValues` shape (sections[] + optional
-* tabs[]) without importing from `../interfaces/config-ui.js` — a
-* concrete-but-lenient Zod object keeps tRPC output inference happy
-* (using `z.unknown()` here collapses unrelated router branches to
-* `unknown` when the generator re-inlines the huge AppRouter type).
-*
-* `.passthrough()` on sections/fields accepts whatever FormBuilder
-* extensions the caller adds (showWhen, displayScale, …) without
-* rebuilding every time a new field kind is introduced.
+* The share-view scope kinds a share-link token can carry. The hub mints
+* and validates them (`ShareViewGrantSchema` builds its
+* enum from this list); a data plane names the kinds it ACCEPTS in `share`.
 */
-var ContributionSectionSchema = object({
-	id: string(),
-	title: string(),
-	description: string().optional(),
-	style: _enum(["card", "accordion"]).optional(),
-	defaultCollapsed: boolean().optional(),
-	columns: union([
-		literal(1),
-		literal(2),
-		literal(3),
-		literal(4)
-	]).optional(),
-	tab: string().optional(),
-	location: _enum([
-		"settings",
-		"top-tab",
-		"hero"
-	]).optional(),
-	order: number().optional(),
-	fields: array(any())
+var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
+/** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
+var PeerBytesTicketSchema = object({
+	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
+	url: string().min(1),
+	/**
+	* The HOST node this URL means something on — the hub or a named agent,
+	* never a runner. {@link AddonPeerBytes.open} compares it to its own and
+	* refuses `cross-node` by name when they differ, without dialling.
+	*/
+	hostNodeId: string().min(1),
+	expiresAtMs: number().int().nonnegative(),
+	/**
+	* What the producer DECLARED the body to be, when it knows — `null` when it
+	* does not. Never `0` for unknown (D393): a consumer sizing a bound off this
+	* must be able to tell "the producer did not say" from "the body is empty".
+	*/
+	declaredBytes: number().int().nonnegative().nullable()
 });
-object({
-	tabs: array(object({
-		id: string(),
-		label: string(),
-		icon: string(),
-		order: number().optional()
-	})).optional(),
-	sections: array(ContributionSectionSchema)
-}).nullable();
-object({ deviceId: number() }), object({ deviceId: number() }), object({
-	deviceId: number(),
-	patch: record(string(), unknown())
-}), object({ success: literal(true) });
-object({ deviceId: number() }), unknown().nullable();
-function method(input, output, options) {
-	return {
-		input,
-		output,
-		kind: options?.kind ?? "query",
-		...options?.auth !== void 0 ? { auth: options.auth } : {},
-		...options?.access !== void 0 ? { access: options.access } : {},
-		...options?.role !== void 0 ? { role: options.role } : {},
-		...options?.caller !== void 0 ? { caller: options.caller } : {},
-		timeoutMs: options?.timeoutMs
-	};
-}
-/**
-* A wrapper/system-only method: served exclusively by the cap's system-level
-* provider (`InferProvider`), and OPTIONAL on `InferNativeProvider` so per-device
-* driver natives don't stub out a wrapper concern (e.g. a cross-device cache
-* overview). The `systemOnly: true` literal is what `InferNativeProvider` keys on.
-*/
-function systemMethod(input, output, options) {
-	return {
-		...method(input, output, options),
-		systemOnly: true
-	};
-}
-/**
-* A method a SOURCE of a collection cap may legitimately not serve — OPTIONAL
-* on `InferProvider`. The `providerOptional: true` literal is what
-* `InferProvider` keys on; see {@link CapabilityMethodSchema.providerOptional}
-* for when this is the honest answer and when it is a soft stub.
-*/
-function optionalMethod(input, output, options) {
-	return {
-		...method(input, output, options),
-		providerOptional: true
-	};
-}
 var READING_QUANTITIES = [
 	"temperature",
 	"pressure",
@@ -10504,7 +10793,6 @@ var CAP_NAMES = Object.freeze([
 	"climate-control",
 	"color",
 	"composer",
-	"connection-test",
 	"connectivity",
 	"consumables",
 	"contact",
@@ -10594,7 +10882,6 @@ var CAP_NAMES = Object.freeze([
 	"notifier",
 	"numeric-sensor",
 	"oauth-integration",
-	"oidc-connections",
 	"osd",
 	"osd-manager",
 	"pet-feeder",
@@ -12486,8 +12773,7 @@ Object.freeze({
 	"device-provider": { "reloadDevice": 18e4 },
 	"llm": {
 		"generate": 6e5,
-		"generateVision": 6e5,
-		"testProfile": 6e5
+		"generateVision": 6e5
 	},
 	"llm-runtime": {
 		"complete": 6e5,
@@ -12524,8 +12810,7 @@ Object.freeze({
 		"offerArtifact": 3e5,
 		"readResult": 3e5,
 		"submitJob": 18e5,
-		"uploadDataset": 72e5,
-		"validateCredentials": 3e4
+		"uploadDataset": 72e5
 	}
 });
 object({
@@ -13940,6 +14225,17 @@ function composeInstanceKinds(parts, base) {
 		if (part === void 0) throw new UnknownInstanceKindError(kindId);
 		return part;
 	};
+	/**
+	* The part a DRAFT test runs on. A named kind is that kind; an unnamed one is the provider's only
+	* testable kind. Several testable kinds and none named is a typed refusal that lists them, never a throw.
+	*/
+	const draftPart = (kindId) => {
+		if (kindId !== void 0) return parts.find((candidate) => candidate.kind.id === kindId) ?? { error: `Unknown instance kind '${kindId}'` };
+		const testable = parts.filter((part) => part.kind.canTest !== false);
+		const only = testable.length === 1 ? testable[0] : parts.length === 1 ? parts[0] : void 0;
+		if (only !== void 0) return only;
+		return { error: `This provider has several kinds: name one of ${(testable.length > 0 ? testable : parts).map((part) => part.kind.id).join(", ")}` };
+	};
 	const holderOf = async (id) => {
 		for (const part of parts) if (await part.provider.getInstance({ id }) !== null) return part;
 		throw new UnknownInstanceError(id);
@@ -13975,7 +14271,13 @@ function composeInstanceKinds(parts, base) {
 		setInstanceEnabled: async (input) => (await holderOf(input.id)).provider.setInstanceEnabled(input),
 		deleteInstance: async (input) => (await holderOf(input.id)).provider.deleteInstance(input),
 		testInstance: async (input) => {
-			const test = (input.id === null ? byKind(input.kind) : await holderOf(input.id)).provider.testInstance;
+			const resolved = input.id === null ? draftPart(input.kind) : await holderOf(input.id);
+			if ("error" in resolved) return {
+				success: false,
+				status: "inconclusive",
+				error: resolved.error
+			};
+			const test = resolved.provider.testInstance;
 			if (test === void 0) return {
 				success: false,
 				status: "inconclusive",
@@ -13985,6 +14287,414 @@ function composeInstanceKinds(parts, base) {
 		}
 	};
 }
+/**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - A target is an INSTANCE of this function cap (epic #440, step 6): the
+*    providers serve their targets as `integration-instances` records, one
+*    record kind per target kind, and the admin lists, adds, edits, switches
+*    and deletes them through that cap. This cap keeps what an instance cannot
+*    say: the kind catalogue (`listTargetKinds`: capabilities, delivery
+*    parameters, brand icon), dispatch (`send`, `testTarget`) and the form
+*    helpers (`discoverTargets`, `probeTargetConfig`).
+*  - `listTargetKinds` / `discoverTargets` return arrays → the generated
+*    cap-mount auto-`concatCollection`-fans them across every registered
+*    provider so one catalog is routable. `send` / `testTarget` /
+*    `probeTargetConfig` route to ONE provider by the `addonId` the generated
+*    collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = _enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: string().optional(),
+	bytes: _instanceof(Uint8Array).optional(),
+	mime: string().optional(),
+	name: string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = _enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/**
+* The CLOSED icon vocabulary an action button may use.
+*
+* A closed set, not a free string, and that is the whole point: an arbitrary
+* icon name is one that ntfy renders, zentik silently drops, and nobody
+* notices — the same class of gap as a zone vocabulary nothing produced
+* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
+* declares `actionIcons: false` and the degrade engine strips the field.
+*
+* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
+* renderer's icon set; "acknowledge" survives an adapter that draws it
+* differently.
+*
+* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
+*
+* These names are for US. **No adapter may forward one verbatim.** Each maps
+* the whole set onto its own renderer's vocabulary through a
+* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
+* fallback, so adding a member here fails every adapter's build until someone
+* decides its glyph, which is the only place that decision can be made
+* honestly.
+*
+* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
+* `disarm` straight through; iOS feeds that string to
+* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
+* and every snooze and alarm button arrived BLANK. A pass-through is not a
+* mapping, and "the field is documented" is not "the value renders".
+*
+* Adding a member is TRAIN-BOUND. The enum lives in the published
+* `@camstack/server` closure and the cap seam validates against the HUB's copy,
+* so an addon that emits a token the running hub does not know does not lose an
+* icon — its whole `send` fails Zod validation and the notification never
+* arrives. Never emit a new token from an addon before the train carrying it.
+*/
+var NotificationActionIconSchema = _enum([
+	"acknowledge",
+	"dismiss",
+	"silence",
+	"snooze",
+	"view",
+	"play",
+	"open",
+	"close",
+	"lock",
+	"unlock",
+	"arm",
+	"arm-home",
+	"arm-away",
+	"arm-night",
+	"disarm",
+	"light",
+	"alert",
+	"camera"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = object({
+	id: string(),
+	label: string(),
+	url: string().optional(),
+	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
+	icon: NotificationActionIconSchema.optional(),
+	/**
+	* Renders in a warning style where the notifier supports it.
+	*
+	* A HINT, never a gate. The callback's authority is its token and nothing
+	* else — see `notification-center/action-token.ts` for what that does and
+	* does not buy.
+	*/
+	destructive: boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: _enum(["navigate", "background"]).optional()
+});
+/** A delivery parameter value: what a notifier declared it takes. */
+var DeliveryParamValueSchema = union([
+	string(),
+	number(),
+	boolean()
+]);
+/**
+* One extra delivery parameter a notifier KIND declares (D938). A rule that
+* addresses a target of that kind may set it; a kind that declares nothing is
+* never handed one. The admin UI derives its control from this descriptor —
+* no editor knows a service by name.
+*
+* Optional fields are `.optional()`, never `.default()` (a Zod default does not
+* run on the addon cap path).
+*/
+var DeliveryParamSchema = object({
+	key: string().min(1),
+	label: string(),
+	/** i18n key of the label, resolved by the declaring addon's namespace. */
+	labelKey: string().optional(),
+	type: _enum([
+		"enum",
+		"number",
+		"boolean",
+		"string"
+	]),
+	/** `enum` only: the closed set of accepted values. */
+	options: array(object({
+		value: string(),
+		label: string()
+	})).optional(),
+	/** `number` only. */
+	min: number().optional(),
+	max: number().optional(),
+	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
+	default: DeliveryParamValueSchema.optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = object({
+	body: string(),
+	title: string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: number().int().min(1).max(5).default(3),
+	level: string().optional(),
+	attachments: array(AttachmentSchema).optional(),
+	clickUrl: string().optional(),
+	actions: array(NotificationActionSchema).optional(),
+	sound: string().optional(),
+	ttl: number().optional(),
+	tag: string().optional(),
+	deviceId: number().optional(),
+	eventId: string().optional(),
+	metadata: record(string(), unknown()).optional(),
+	/**
+	* Values for the parameters the target's kind DECLARES in
+	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
+	* declaration by the sender; a notifier reads only the keys it declared.
+	*/
+	delivery: record(string(), DeliveryParamValueSchema).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = object({
+	id: string(),
+	label: string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: number().int().min(1).max(5).nullable(),
+	flags: object({
+		critical: boolean().optional(),
+		silent: boolean().optional(),
+		noPush: boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: array(string()).optional(),
+	description: string().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = object({
+	attachments: object({
+		mediaTypes: array(AttachmentMediaTypeSchema),
+		mode: _enum([
+			"url",
+			"bytes",
+			"both"
+		]),
+		max: number().int().nonnegative(),
+		maxBytes: number().int().positive().optional()
+	}),
+	/** Max action buttons (0 = none). */
+	actions: number().int().nonnegative(),
+	/**
+	* Whether this kind renders a per-action ICON.
+	*
+	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
+	* run on the addon cap path — three production failures in one day taught
+	* this repo that once. Absent is read as false by the degrade engine, which
+	* is the safe direction: an icon that is not rendered costs nothing, an icon
+	* assumed and dropped costs the operator's trust in the field.
+	*/
+	actionIcons: boolean().optional(),
+	levels: array(TargetKindLevelSchema),
+	format: array(NotificationFormatSchema),
+	clickUrl: boolean(),
+	sound: boolean(),
+	ttl: boolean(),
+	bodyMaxLen: number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough$3 = unknown();
+var TargetKindSchema = object({
+	kind: string(),
+	label: string(),
+	icon: string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: string().optional(),
+	configSchema: ConfigSchemaPassthrough$3,
+	/**
+	* The config keys that decide WHERE this kind's secrets are sent (server,
+	* base URL, instance, chat, recipient). A save that changes any of them
+	* while leaving a secret redacted is refused by the provider (D634), so an
+	* editor uses this to ask for the secret on exactly those edits instead of
+	* on every edit.
+	*
+	* Optional: absent from a provider that holds no secret (the Home Assistant
+	* kinds) and from a provider older than this field — an editor that finds
+	* it absent must assume ANY edit may need the secret.
+	*/
+	destinationKeys: array(string()).optional(),
+	supportsDiscovery: boolean(),
+	/**
+	* Extra delivery parameters a rule may set for a target of this kind (D938).
+	* Absent = none; the rule editor then offers nothing.
+	*/
+	deliveryParams: array(DeliveryParamSchema).optional(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A target as a provider's own code sees it (the notification-center bridge, the
+* send path): the flat record body split into the name, the switch and the
+* kind's fields. `config` holds secrets; a reader that serves it to a client
+* REDACTS secret fields (a presence marker only) — never round-trip a stored
+* secret to the UI.
+*/
+var TargetSchema = object({
+	id: string(),
+	name: string(),
+	kind: string(),
+	addonId: string(),
+	enabled: boolean(),
+	config: record(string(), unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = object({
+	kind: string(),
+	suggestedName: string(),
+	config: record(string(), unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = object({
+	level: string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: number().int().nonnegative(),
+	actionsSent: number().int().nonnegative(),
+	truncated: boolean(),
+	dropped: array(string())
+});
+var SendResultSchema = object({
+	success: boolean(),
+	error: string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+/**
+* Pre-save credential probe against a partial (unsaved) target config.
+* `resolvedUrl` never includes secrets (token stripped from path).
+*/
+var ProbeTargetConfigResultSchema = object({
+	ok: boolean(),
+	resolvedUrl: string(),
+	httpStatus: number().int().optional(),
+	stateInstance: string().optional(),
+	error: string().optional()
+});
+method(object({}), array(TargetKindSchema)), method(object({
+	kind: string(),
+	config: record(string(), unknown()).optional(),
+	/**
+	* When editing / duplicating, the blank password field never round-trips
+	* the stored token. Pass the source target id so the provider can restore
+	* secrets server-side before dialling.
+	*/
+	targetId: string().optional()
+}), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
+	kind: string(),
+	config: record(string(), unknown()),
+	/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
+	targetId: string().optional()
+}), ProbeTargetConfigResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	targetId: string(),
+	notification: NotificationSchema
+}), SendResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	targetId: string(),
+	sample: NotificationSchema.optional()
+}), TestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
+looseObject({
+	name: string().min(1),
+	enabled: boolean().optional()
+});
+TargetSchema.omit({ id: true });
 var EncodeProfileSchema = object({
 	video: object({
 		codec: _enum([
@@ -22202,7 +22912,6 @@ var SYSTEM_CAP_VOCABULARY = {
 	"calendar-source": system(INTERNAL),
 	calendars: system("calendars feed schedules and conditions, not device actions"),
 	composer: system("device composition — an authoring tool, not an action"),
-	"connection-test": system(INTERNAL),
 	"core-blocks": system(INTERNAL),
 	"custom-model-registry": system(ML),
 	"data-store-provider": system(INTERNAL),
@@ -22247,7 +22956,6 @@ var SYSTEM_CAP_VOCABULARY = {
 	"notification-output": system("notification delivery — reached through notifier devices and rules"),
 	"notification-rules": system("notification rules — authored on their own page"),
 	"oauth-integration": system(IDENTITY),
-	"oidc-connections": system(IDENTITY),
 	"osd-manager": system(PIPELINE),
 	"pipeline-executor": system(PIPELINE),
 	"pipeline-orchestrator": system(PIPELINE),
@@ -44119,427 +44827,6 @@ var UnitWarningSchema = object({
 	assumedUnit: string(),
 	message: string()
 });
-/**
-* notification-output — canonical, capability-gated notification delivery.
-*
-* Apprise-derived model (see
-* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
-* callers emit ONE canonical `Notification`; each provider declares a
-* per-kind capability descriptor (`TargetKind`), and the pure degrade
-* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
-* message to what the kind supports — callers never special-case a service.
-*
-* DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
-*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
-*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
-*    `storage` / `storage-provider` / `recording` caps over the same path. No
-*    base64 fallback needed.
-*
-* TODO (deferred, closed-set change — separate decision): add
-* `providerKind: 'notify'` so notification providers surface on the unified
-* admin "Integrations" page.
-*/
-/**
-* Zentik-derived typed-media enum — the superset across every kind. Each
-* adapter picks what it supports and the degrade engine filters the rest.
-*/
-var AttachmentMediaTypeSchema = _enum([
-	"image",
-	"video",
-	"gif",
-	"audio",
-	"icon"
-]);
-/**
-* A single attachment. Exactly one of `url` (remote source, most adapters
-* prefer this) or `bytes` (inline source; required for Pushover-style
-* bytes-only kinds) MUST be present — the degrade engine expresses a
-* url→bytes fetch as a `needsFetch` directive the adapter executes.
-*/
-var AttachmentSchema = object({
-	mediaType: AttachmentMediaTypeSchema,
-	url: string().optional(),
-	bytes: _instanceof(Uint8Array).optional(),
-	mime: string().optional(),
-	name: string().optional()
-}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
-var NotificationFormatSchema = _enum([
-	"text",
-	"markdown",
-	"html"
-]);
-/**
-* The CLOSED icon vocabulary an action button may use.
-*
-* A closed set, not a free string, and that is the whole point: an arbitrary
-* icon name is one that ntfy renders, zentik silently drops, and nobody
-* notices — the same class of gap as a zone vocabulary nothing produced
-* ([D35](../../../docs/decisions/adr-0035.md)). Every adapter maps this set or
-* declares `actionIcons: false` and the degrade engine strips the field.
-*
-* Named by INTENT, never by glyph. "check" would tie the vocabulary to one
-* renderer's icon set; "acknowledge" survives an adapter that draws it
-* differently.
-*
-* ── A TOKEN IS NOT A WIRE VALUE ─────────────────────────────────────
-*
-* These names are for US. **No adapter may forward one verbatim.** Each maps
-* the whole set onto its own renderer's vocabulary through a
-* `Record<NotificationActionIcon, string>` — a Record, never a lookup with a
-* fallback, so adding a member here fails every adapter's build until someone
-* decides its glyph, which is the only place that decision can be made
-* honestly.
-*
-* This paragraph is the bug. Zentik declared `actionIcons: true` and passed
-* `disarm` straight through; iOS feeds that string to
-* `UNNotificationActionIcon(systemImageName:)`, `disarm` is not an SF Symbol,
-* and every snooze and alarm button arrived BLANK. A pass-through is not a
-* mapping, and "the field is documented" is not "the value renders".
-*
-* Adding a member is TRAIN-BOUND. The enum lives in the published
-* `@camstack/server` closure and the cap seam validates against the HUB's copy,
-* so an addon that emits a token the running hub does not know does not lose an
-* icon — its whole `send` fails Zod validation and the notification never
-* arrives. Never emit a new token from an addon before the train carrying it.
-*/
-var NotificationActionIconSchema = _enum([
-	"acknowledge",
-	"dismiss",
-	"silence",
-	"snooze",
-	"view",
-	"play",
-	"open",
-	"close",
-	"lock",
-	"unlock",
-	"arm",
-	"arm-home",
-	"arm-away",
-	"arm-night",
-	"disarm",
-	"light",
-	"alert",
-	"camera"
-]);
-/** A single tap-through action button. */
-var NotificationActionSchema = object({
-	id: string(),
-	label: string(),
-	url: string().optional(),
-	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
-	icon: NotificationActionIconSchema.optional(),
-	/**
-	* Renders in a warning style where the notifier supports it.
-	*
-	* A HINT, never a gate. The callback's authority is its token and nothing
-	* else — see `notification-center/action-token.ts` for what that does and
-	* does not buy.
-	*/
-	destructive: boolean().optional(),
-	/**
-	* How the tap should REACH the url.
-	*
-	* `navigate` (absent, and every button authored before this field) opens it:
-	* the phone leaves the notification and shows whatever the callback returns.
-	* That is right for a button whose answer the operator wants to read.
-	*
-	* `background` fires it as a POST and stays put. It exists for the buttons
-	* whose whole point is not to interrupt — "silence this for 30 minutes" is
-	* an answer to the notification, and being thrown into a browser tab to
-	* confirm it costs more attention than the notification did. A backend that
-	* cannot do a background call renders it as an ordinary link (the adapters
-	* fall back rather than dropping the button), so this is a preference, never
-	* a requirement.
-	*/
-	mode: _enum(["navigate", "background"]).optional()
-});
-/** A delivery parameter value: what a notifier declared it takes. */
-var DeliveryParamValueSchema = union([
-	string(),
-	number(),
-	boolean()
-]);
-/**
-* One extra delivery parameter a notifier KIND declares (D938). A rule that
-* addresses a target of that kind may set it; a kind that declares nothing is
-* never handed one. The admin UI derives its control from this descriptor —
-* no editor knows a service by name.
-*
-* Optional fields are `.optional()`, never `.default()` (a Zod default does not
-* run on the addon cap path).
-*/
-var DeliveryParamSchema = object({
-	key: string().min(1),
-	label: string(),
-	/** i18n key of the label, resolved by the declaring addon's namespace. */
-	labelKey: string().optional(),
-	type: _enum([
-		"enum",
-		"number",
-		"boolean",
-		"string"
-	]),
-	/** `enum` only: the closed set of accepted values. */
-	options: array(object({
-		value: string(),
-		label: string()
-	})).optional(),
-	/** `number` only. */
-	min: number().optional(),
-	max: number().optional(),
-	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
-	default: DeliveryParamValueSchema.optional()
-});
-/**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
-*/
-var NotificationSchema = object({
-	body: string(),
-	title: string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: number().int().min(1).max(5).default(3),
-	level: string().optional(),
-	attachments: array(AttachmentSchema).optional(),
-	clickUrl: string().optional(),
-	actions: array(NotificationActionSchema).optional(),
-	sound: string().optional(),
-	ttl: number().optional(),
-	tag: string().optional(),
-	deviceId: number().optional(),
-	eventId: string().optional(),
-	metadata: record(string(), unknown()).optional(),
-	/**
-	* Values for the parameters the target's kind DECLARES in
-	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
-	* declaration by the sender; a notifier reads only the keys it declared.
-	*/
-	delivery: record(string(), DeliveryParamValueSchema).optional()
-});
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = object({
-	id: string(),
-	label: string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: number().int().min(1).max(5).nullable(),
-	flags: object({
-		critical: boolean().optional(),
-		silent: boolean().optional(),
-		noPush: boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: array(string()).optional(),
-	description: string().optional()
-});
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = object({
-	attachments: object({
-		mediaTypes: array(AttachmentMediaTypeSchema),
-		mode: _enum([
-			"url",
-			"bytes",
-			"both"
-		]),
-		max: number().int().nonnegative(),
-		maxBytes: number().int().positive().optional()
-	}),
-	/** Max action buttons (0 = none). */
-	actions: number().int().nonnegative(),
-	/**
-	* Whether this kind renders a per-action ICON.
-	*
-	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
-	* run on the addon cap path — three production failures in one day taught
-	* this repo that once. Absent is read as false by the degrade engine, which
-	* is the safe direction: an icon that is not rendered costs nothing, an icon
-	* assumed and dropped costs the operator's trust in the field.
-	*/
-	actionIcons: boolean().optional(),
-	levels: array(TargetKindLevelSchema),
-	format: array(NotificationFormatSchema),
-	clickUrl: boolean(),
-	sound: boolean(),
-	ttl: boolean(),
-	bodyMaxLen: number().int().positive()
-});
-/**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
-*/
-var ConfigSchemaPassthrough$4 = unknown();
-var TargetKindSchema = object({
-	kind: string(),
-	label: string(),
-	icon: string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: string(),
-	/**
-	* URL of the kind's bundled BRAND icon, served by the providing addon over
-	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
-	* when the addon bundles no icon for that kind — the client then falls back
-	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
-	*
-	* Root-relative on purpose: it resolves against whatever origin serves a web
-	* client, and a native client joins it onto its own hub base.
-	*
-	* DECLARED here deliberately. It used to travel as an undeclared passthrough
-	* field that survived only because the runtime cap-router forwards provider
-	* output verbatim — so every consumer had to re-declare it by hand to stop
-	* its own Zod parse from stripping it, and the whole arrangement would have
-	* broken silently the moment output validation was tightened anywhere.
-	*/
-	iconUrl: string().optional(),
-	/**
-	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
-	*
-	* The server knows this and therefore says it, because the client cannot
-	* safely guess: a React-Native client renders SVG and raster through two
-	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
-	* not decode SVG on iOS/Android), so without this it silently fell back to a
-	* placeholder glyph for every vector icon while the web build looked fine.
-	*
-	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
-	* not been updated — a client that cannot determine the type should prefer
-	* its raster path, which is the safe default for an unknown image.
-	*/
-	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough$4,
-	/**
-	* The config keys that decide WHERE this kind's secrets are sent (server,
-	* base URL, instance, chat, recipient). A save that changes any of them
-	* while leaving a secret redacted is refused by the provider (D634), so an
-	* editor uses this to ask for the secret on exactly those edits instead of
-	* on every edit.
-	*
-	* Optional: absent from a provider that holds no secret (the Home Assistant
-	* kinds) and from a provider older than this field — an editor that finds
-	* it absent must assume ANY edit may need the secret.
-	*/
-	destinationKeys: array(string()).optional(),
-	supportsDiscovery: boolean(),
-	/**
-	* Extra delivery parameters a rule may set for a target of this kind (D938).
-	* Absent = none; the rule editor then offers nothing.
-	*/
-	deliveryParams: array(DeliveryParamSchema).optional(),
-	caps: TargetKindCapsSchema
-});
-/**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
-*/
-var TargetSchema = object({
-	id: string(),
-	name: string(),
-	kind: string(),
-	addonId: string(),
-	enabled: boolean(),
-	config: record(string(), unknown())
-});
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = object({
-	kind: string(),
-	suggestedName: string(),
-	config: record(string(), unknown())
-});
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = object({
-	level: string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: number().int().nonnegative(),
-	actionsSent: number().int().nonnegative(),
-	truncated: boolean(),
-	dropped: array(string())
-});
-var SendResultSchema = object({
-	success: boolean(),
-	error: string().optional(),
-	renderedAs: RenderedAsSchema.optional()
-});
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
-/**
-* Pre-save credential probe against a partial (unsaved) target config.
-* `resolvedUrl` never includes secrets (token stripped from path).
-*/
-var ProbeTargetConfigResultSchema = object({
-	ok: boolean(),
-	resolvedUrl: string(),
-	httpStatus: number().int().optional(),
-	stateInstance: string().optional(),
-	error: string().optional()
-});
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({ targetId: string() }), TargetSchema, { auth: "admin" }), method(object({
-	kind: string(),
-	config: record(string(), unknown()).optional(),
-	/**
-	* When editing / duplicating, the blank password field never round-trips
-	* the stored token. Pass the source target id so the provider can restore
-	* secrets server-side before dialling (same merge as upsert).
-	*/
-	targetId: string().optional()
-}), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
-	kind: string(),
-	config: record(string(), unknown()),
-	/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
-	targetId: string().optional()
-}), ProbeTargetConfigResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	notification: NotificationSchema
-}), SendResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	sample: NotificationSchema.optional()
-}), TestResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	target: TargetSchema,
-	/**
-	* Duplicate flow: create a NEW target id while copying secrets from an
-	* existing row. The UI never holds the stored token; blank / redacted
-	* password fields are restored from this source (D634 still applies if
-	* destinations diverge without a re-typed secret).
-	*/
-	cloneSecretsFrom: string().optional()
-}), TargetSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ targetId: string() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	enabled: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
 _enum([
 	"automation",
 	"action",
@@ -44810,6 +45097,8 @@ var SettingsSchemaWithValuesSchema = object({
 });
 /** Patch object — keys are field names, values are the new field values. */
 var SettingsPatchSchema = record(string(), unknown());
+/** The scope of a scoped-settings call (D986): where the capability declared the values. */
+var ScopedSettingsScopeSchema = _enum(SCOPED_SETTINGS_SCOPES);
 /** Standard success response for update operations. */
 var SettingsUpdateResultSchema = object({ success: literal(true) });
 method(object({
@@ -44825,6 +45114,25 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
+	addonId: string(),
+	cap: string(),
+	scope: ScopedSettingsScopeSchema,
+	nodeId: string().optional()
+}), SettingsSchemaWithValuesSchema.nullable()), method(object({
+	addonId: string(),
+	cap: string(),
+	scope: ScopedSettingsScopeSchema,
+	nodeId: string().optional(),
+	patch: SettingsPatchSchema
+}), SettingsUpdateResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	addonId: string(),
+	cap: string(),
+	scope: ScopedSettingsScopeSchema,
+	nodeId: string().optional()
+}), record(string(), unknown()).nullable()), method(object({
 	addonId: string(),
 	nodeId: string().optional()
 }), SettingsSchemaWithValuesSchema.nullable()), method(object({
@@ -48417,37 +48725,6 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ blockIds: array(string()) }), object({ states: array(CompositionBlockStateSchema) }), { auth: "admin" });
-var ConnectionTestOutcomeSchema = discriminatedUnion("outcome", [
-	object({
-		outcome: literal("validated"),
-		/** Round-trip of the sign-in, when the provider measured it. */
-		latencyMs: number().nonnegative().optional(),
-		/** Optional human detail worth showing next to the tick
-		*  ("3 devices visible on this account"). */
-		detail: string().optional()
-	}).strict(),
-	object({
-		outcome: literal("rejected"),
-		error: string()
-	}).strict(),
-	object({
-		outcome: literal("inconclusive"),
-		error: string()
-	}).strict()
-]);
-var ConnectionTestInputSchema = object({ 
-/** Candidate integration settings, exactly as the create form collected them. */
-settings: record(string(), unknown()) });
-/**
-* What the provider's test actually DOES, so the UI can say it in words before
-* the operator presses the button ("Signs in to the Dreo cloud"). Purely
-* descriptive — it never changes routing.
-*/
-var ConnectionTestDescriptorSchema = object({ label: string() });
-method(ConnectionTestInputSchema, ConnectionTestOutcomeSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), ConnectionTestDescriptorSchema, { auth: "admin" });
 object({
 	/** True when the upstream system considers the entity connected. */
 	connected: boolean(),
@@ -54301,10 +54578,9 @@ var AvailableIntegrationTypeSchema = object({
 	*  locations" checkbox. Provider-declared in the addon manifest. */
 	supportsLocationImport: boolean(),
 	/**
-	* True when this integration DECLARES a pre-creation test (the
-	* `connection-test` cap, or a broker whose settings it stores). Drives the
-	* Test button: an integration that cannot be tested must say so up front
-	* rather than offering a button that always answers the same nonsense.
+	* True when this integration's instances declare a Test (`integration-instances.describe().canTest`,
+	* D1016). An integration that cannot be tested must say so up front rather than offering a
+	* button that always answers the same nonsense.
 	*/
 	canTest: boolean(),
 	existingInstances: array(object({
@@ -54358,7 +54634,9 @@ var CreateIntegrationInputSchema = object({
 	info: record(string(), unknown()).optional(),
 	/** `stableId` of the discovery candidate the form was seeded from (D984). */
 	originStableId: string().optional(),
-	settings: record(string(), unknown()).optional()
+	settings: record(string(), unknown()).optional(),
+	/** The instance kind being created, for a provider with several; omitted = its only testable kind. */
+	kind: string().min(1).optional()
 });
 var UpdateIntegrationInputSchema = object({
 	id: string(),
@@ -54384,13 +54662,7 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 }), method(object({ id: string() }), DeleteIntegrationResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), array(AvailableIntegrationTypeSchema), { auth: "admin" }), method(object({
-	addonId: string(),
-	settings: record(string(), unknown())
-}), TestConnectionResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
+}), method(_void(), array(AvailableIntegrationTypeSchema), { auth: "admin" });
 /**
 * `integration-instances` - the connection of an addon that holds ONE or SEVERAL
 * (an account, a relay, a destination) as typed records (D985, D986). The addon's
@@ -54410,7 +54682,7 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 * or the redaction token KEEPS the stored secret; `{ $secretClear: true }`
 * clears it.
 */
-var ConfigSchemaPassthrough$3 = custom();
+var ConfigSchemaPassthrough$2 = custom();
 var IntegrationInstanceIdSchema = string().min(1);
 var IntegrationInstanceModeSchema = _enum(["single", "multiple"]);
 /**
@@ -54456,7 +54728,16 @@ var IntegrationInstanceKindSchema = object({
 	/** Relative hub path to start an interactive account link of an instance of this kind. */
 	connectPath: string().min(1).optional(),
 	/** Relative hub path to disconnect that account. */
-	disconnectPath: string().min(1).optional()
+	disconnectPath: string().min(1).optional(),
+	/**
+	* Parts of the edit dialog the flat form cannot draw (a node picker, a model source), named by a
+	* GENERIC widget id the client maps to a component; a client that knows none of them shows none.
+	* `connection` widgets write connection values, `model` widgets own the model choice.
+	*/
+	widgets: array(object({
+		id: string().min(1),
+		placement: _enum(["connection", "model"])
+	})).optional()
 });
 /**
 * How devices of an instance are found. `none`: the operator adds them by hand; `lan`: the addon
@@ -54561,7 +54842,7 @@ var integrationInstancesCapability = {
 			id: IntegrationInstanceIdSchema.nullable(),
 			/** The kind of the create form (`id: null`) of a provider with several. */
 			kind: string().min(1).optional()
-		}), ConfigSchemaPassthrough$3, { auth: "admin" }),
+		}), ConfigSchemaPassthrough$2, { auth: "admin" }),
 		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
 		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
 		/**
@@ -55512,12 +55793,12 @@ var LlmModelInfoSchema = object({
 });
 /**
 * The provider-specific part of a profile, validated by the provider that owns
-* the kind (`upsertProfile` refuses what it does not accept). A field its
+* the kind (saving an instance refuses what it does not accept). A field its
 * `connectionSchema` declares `type: 'password'` is a secret: it is held in the
 * keychain, never in the row, and reads back as the redaction marker.
 */
 var LlmProviderConfigSchema = record(string(), unknown());
-var LlmProfileSchema = object({
+object({
 	id: string(),
 	name: string(),
 	/** The provider-declared kind (`LlmProfileKindDescriptor.kind`). */
@@ -55611,8 +55892,8 @@ var LlmProviderWidgetSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$2 = unknown();
-var LlmProfileKindDescriptorSchema = object({
+var ConfigSchemaPassthrough$1 = unknown();
+object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	/** A generic icon name (`cloud`, `plug`, `cpu`) — never a glyph or a logo. */
@@ -55620,9 +55901,9 @@ var LlmProfileKindDescriptorSchema = object({
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
 	/** The provider's own fields (`providerConfig`); `password` fields are keychain-held. */
-	connectionSchema: ConfigSchemaPassthrough$2,
+	connectionSchema: ConfigSchemaPassthrough$1,
 	/** Provider fields that belong under "Advanced" (extra headers, runtime tuning). */
-	advancedSchema: ConfigSchemaPassthrough$2.optional(),
+	advancedSchema: ConfigSchemaPassthrough$1.optional(),
 	/** The kind's defaults; a model from `listModels` may override any of them. */
 	features: LlmModelFeaturesSchema,
 	/** `false` = the provider stamps `supportsVision` itself (from what a node reports). */
@@ -55751,20 +56032,7 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, {
 }), method(object({
 	addonId: string().optional(),
 	requestId: string()
-}), _void(), { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(ProfileRefInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(ProfileRefInputSchema, LlmGenerateResultSchema, {
-	kind: "mutation",
-	auth: "admin",
-	timeoutMs: AI_CAP_TRANSPORT_TIMEOUT_MS
-}), method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
+}), _void(), { kind: "mutation" }), method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), array(LlmDefaultSchema)), method(object({
@@ -56759,20 +57027,7 @@ method(_void(), MeshStatusSchema), method(object({
 /** Optional hostname override the host should advertise once joined. */
 hostname: string().optional() }), object({ 
 /** Authentication URL the operator should open in a browser. */
-loginUrl: string() }), { kind: "mutation" }), method(_void(), object({ left: literal(true) }), { kind: "mutation" }), method(_void(), object({ loggedOut: literal(true) }), { kind: "mutation" }), method(_void(), object({ peers: array(MeshPeerSchema).readonly() })), method(object({ 
-/** Optional auth key — when provided, probes the key validity
-*  against the provider's API. Omit when already joined to
-*  just ping the daemon. */
-authKey: string().optional() }), object({
-	ok: boolean(),
-	/** Provider-side identifier resolved by the probe (tailnet
-	*  name for Tailscale, network id for ZeroTier, etc.). */
-	tenant: string().optional(),
-	/** Daemon binary version, when reachable. */
-	daemonVersion: string().optional(),
-	/** Human-readable error when `ok: false`. */
-	error: string().optional()
-}), { kind: "mutation" });
+loginUrl: string() }), { kind: "mutation" }), method(_void(), object({ left: literal(true) }), { kind: "mutation" }), method(_void(), object({ loggedOut: literal(true) }), { kind: "mutation" }), method(_void(), object({ peers: array(MeshPeerSchema).readonly() }));
 object({
 	value: number().nullable().meta(readingMeta("device", { label: "Total" })),
 	lastFetchedAt: number()
@@ -62633,13 +62888,6 @@ var AddBrokerInputSchema = object({
 });
 var AddBrokerResultSchema = object({ id: string() });
 var IdInputSchema = object({ id: string() });
-var TestResultSchema$1 = discriminatedUnion("ok", [object({
-	ok: literal(true),
-	latencyMs: number()
-}), object({
-	ok: literal(false),
-	error: string()
-})]);
 var StartEmbeddedInputSchema = object({
 	port: number().int().min(1).max(65535).default(1883),
 	/** Allow anonymous connect (no username/password). Default: false. */
@@ -62662,9 +62910,6 @@ method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnection
 }), method(IdInputSchema, _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(IdInputSchema, TestResultSchema$1, {
-	kind: "mutation",
-	auth: "admin"
 }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -66440,61 +66685,6 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
-* `oidc-connections` — CRUD for IdP rows under `auth-oidc` (D828 sibling).
-*
-* One hub-only singleton (`auth-oidc`). The Settings UI is a DataTable +
-* ItemFormDialog; there is no `editable-array` in `globalSettingsSchema`.
-* Operator-chosen `id` is the URL slug (`/addon/auth-oidc/<id>/…`) and is
-* immutable after create.
-*/
-var ConfigSchemaPassthrough$1 = unknown();
-var OidcConnectionSchema = object({
-	id: string().min(1),
-	displayName: string(),
-	icon: string(),
-	issuerUrl: string(),
-	clientId: string(),
-	/** Client id + secret present — never the secret value. */
-	configured: boolean(),
-	/**
-	* Values for the connection form schema. `clientSecret` is a keychain
-	* {@link SecretFieldView} or `null` / `''`, never plaintext (D789).
-	*/
-	formValues: record(string(), unknown()).optional()
-});
-/**
-* Patch one connection. Omitted or empty `clientSecret` keeps the stored
-* secret (D787). `{ $secretClear: true }` clears it. `id` is never renamed.
-*/
-var OidcConnectionUpdateInputSchema = object({
-	id: string().min(1),
-	displayName: string().min(1),
-	icon: string().optional(),
-	issuerUrl: string().optional(),
-	clientId: string().optional(),
-	clientSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
-	redirectUri: string().optional(),
-	scopes: string().optional(),
-	usernameClaim: _enum([
-		"preferred_username",
-		"email",
-		"sub"
-	]).optional()
-});
-method(object({}), ConfigSchemaPassthrough$1, { auth: "admin" }), method(object({}), array(OidcConnectionSchema).readonly(), { auth: "admin" }), method(object({
-	id: string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug"),
-	displayName: string().min(1)
-}), object({ id: string() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(OidcConnectionUpdateInputSchema, object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ id: string().min(1) }), object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * Generic on-screen-display (video overlay) cap. Each camera exposes
 * a firmware-defined list of overlays (channel name, timestamp,
 * watermark, logo, …); the cap models them as a homogeneous array of
@@ -72680,21 +72870,6 @@ method(object({
 	*/
 	ttlSec: union([number().int().positive(), literal("never")]).optional()
 }), object({ token: string() }), { auth: "admin" }), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable(), { auth: "admin" });
-var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object({
-	providerId: string().min(1),
-	displayName: string().min(1),
-	configSchema: unknown(),
-	nodeLocal: boolean(),
-	shouldSaveDiskSpace: literal(true),
-	minFreePercent: number().min(0).max(100)
-}), object({
-	providerId: string().min(1),
-	displayName: string().min(1),
-	configSchema: unknown(),
-	nodeLocal: boolean(),
-	shouldSaveDiskSpace: literal(false),
-	minFreePercent: literal(null)
-})]);
 method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
@@ -72756,42 +72931,7 @@ method(object({
 }), _instanceof(Uint8Array), { auth: "admin" }), method(object({ downloadId: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
-	createdAt: true,
-	updatedAt: true
-}), StorageLocationSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	id: string(),
-	force: boolean().optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(StorageDrainProgressSchema).readonly()), method(object({ id: string() }), object({
-	ok: boolean(),
-	error: string().optional()
-}), { auth: "admin" }), method(_void(), array(ProviderListEntrySchema).readonly()), method(object({
-	providerId: string(),
-	/**
-	* The location this config is an UNSAVED edit of, when there is one.
-	*
-	* `listLocations` replaces every declared secret with the redaction
-	* sentinel, so the edit modal's form state holds the sentinel for any
-	* credential the operator did not retype — and posting that here
-	* without a way to resolve it makes the provider try to authenticate
-	* as `__camstack_redacted__` and report the operator's own working
-	* password as wrong. Given this id, the orchestrator restores each
-	* sentinel from the stored config (same rule as `upsertLocation`)
-	* before dispatching. Omitted by the "Add location" wizard, where
-	* every value was typed just now and nothing is stored yet.
-	*/
-	locationId: string().optional(),
-	config: record(string(), unknown())
-}), object({
-	ok: boolean(),
-	error: string().optional()
-}), { auth: "admin" });
+}), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(_void(), array(StorageDrainProgressSchema).readonly());
 /** One table of the settings database. */
 var StorageTableSchema = object({
 	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
@@ -74022,7 +74162,7 @@ var TerminalInstanceInfoSchema = object({
 	/**
 	* False while the node the instance is bound to is not in the cluster
 	* topology (forgotten, renamed, re-paired). The instance is kept; the
-	* operator re-points it with `updateInstance({ targetNodeId })`.
+	* operator re-points it on the Terminal page.
 	*/
 	nodeInCluster: boolean(),
 	profileId: string(),
@@ -74060,41 +74200,7 @@ var TerminalOutputBatchSchema = object({
 	snapshot: string().optional(),
 	events: array(TerminalOutputEventSchema).readonly()
 });
-method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }), method(_void(), array(TerminalInstanceInfoSchema).readonly(), { auth: "admin" }), method(object({
-	targetNodeId: string().min(1),
-	profileId: string().min(1),
-	name: string().trim().min(1).max(160).optional(),
-	executable: string().max(1024).optional(),
-	args: array(string().max(2048)).max(64).optional(),
-	cwd: string().max(1024).optional(),
-	environment: array(string().max(4096)).max(64).optional(),
-	profileSettings: ProfileSettingsBagSchema.optional()
-}), TerminalInstanceInfoSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	instanceId: string().min(1),
-	/** Re-point the instance to another node; the profile must exist there. */
-	targetNodeId: string().min(1).max(256).optional(),
-	name: string().trim().min(1).max(160).optional(),
-	executable: string().max(1024).optional(),
-	args: array(string().max(2048)).max(64).optional(),
-	cwd: string().max(1024).optional(),
-	environment: array(string().max(4096)).max(64).optional(),
-	profileSettings: ProfileSettingsBagSchema.optional()
-}), TerminalInstanceInfoSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ instanceId: string().min(1) }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	instanceId: string().min(1),
-	enabled: boolean()
-}), TerminalInstanceInfoSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(TerminalLegacyCameraSchema).readonly(), { auth: "admin" }), method(object({
+method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }), method(_void(), array(TerminalLegacyCameraSchema).readonly(), { auth: "admin" }), method(object({
 	stableId: string().min(1),
 	name: string().trim().min(1).max(160).optional()
 }), TerminalInstanceInfoSchema, {
@@ -74289,7 +74395,7 @@ var TrainingProviderTypeSchema = object({
 	label: string(),
 	/** Path under the addon package (e.g. `assets/training-modal/icon.svg`). */
 	iconAsset: string(),
-	/** Owning `training-provider` addon — collection selector for createEntry. */
+	/** Owning `training-provider` addon. */
 	addonId: string(),
 	/**
 	* Fields for one entry of this type (credentials + defaults). Absent on a
@@ -74334,36 +74440,6 @@ var TrainingProviderDescriptorSchema = object({
 	*/
 	formValues: record(string(), unknown()).optional()
 });
-/**
-* Patch one entry's name, credentials and defaults. Pin with owning `{ addonId }`.
-* An omitted or empty `tokenSecret` means KEEP the stored secret (D787).
-* `{ $secretClear: true }` clears it.
-*/
-var TrainingProviderUpdateEntryInputSchema = object({
-	entryId: string().min(1),
-	name: string().min(1),
-	tokenId: string().optional(),
-	tokenSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
-	environment: string().optional(),
-	gpuType: string().optional(),
-	region: string().optional(),
-	costCapUsd: number().nonnegative().optional(),
-	maxRuntimeSec: number().int().positive().optional(),
-	failedDatasetGraceHours: number().nonnegative().optional()
-});
-var TrainingCredentialCheckSchema = object({
-	ok: boolean(),
-	/** Workspace / account name, when the provider says. */
-	account: string().optional(),
-	reason: _enum([
-		"missing",
-		"invalid",
-		"forbidden",
-		"network",
-		"quota"
-	]).optional(),
-	detail: string().optional()
-});
 var ProviderJobStateSchema = _enum([
 	"pending",
 	"starting",
@@ -74411,22 +74487,6 @@ var TrainingLogLineSchema = object({
 	text: string()
 });
 method(object({}), array(TrainingProviderDescriptorSchema).readonly(), { auth: "admin" }), method(object({}), array(TrainingProviderTypeSchema).readonly(), { auth: "admin" }), method(object({}), array(TrainingProviderEntrySchema).readonly(), { auth: "admin" }), method(object({
-	typeId: string().min(1),
-	name: string().min(1)
-}), object({ entryId: string() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ entryId: string().min(1) }), object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(TrainingProviderUpdateEntryInputSchema, object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ entryId: string().min(1) }), TrainingCredentialCheckSchema, {
-	kind: "mutation",
-	auth: "admin",
-	timeoutMs: 3e4
-}), method(object({
 	entryId: string().min(1),
 	gpuType: string(),
 	region: string(),
@@ -76958,6 +77018,20 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"addonSettings.getScopedSettings": {
+		capName: "addon-settings",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"addonSettings.readScopedValues": {
+		capName: "addon-settings",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"addonSettings.unsetStoredSettingsKeys": {
 		capName: "addon-settings",
 		capScope: "system",
@@ -76979,6 +77053,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"addonSettings.updateScopedSettings": {
+		capName: "addon-settings",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"addonWidgets.listWidgets": {
 		capName: "addon-widgets",
 		capScope: "system",
@@ -77812,20 +77893,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"connectionTest.describeTest": {
-		capName: "connection-test",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"connectionTest.testSettings": {
-		capName: "connection-test",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"connectivity.getStatus": {
 		capName: "connectivity",
 		capScope: "device",
@@ -80192,13 +80259,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"integrations.testConnection": {
-		capName: "integrations",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"integrations.update": {
 		capName: "integrations",
 		capScope: "system",
@@ -80451,13 +80511,6 @@ Object.freeze({
 		access: "delete",
 		role: "admin"
 	},
-	"llm.deleteProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"llm.generate": {
 		capName: "llm",
 		capScope: "system",
@@ -80521,20 +80574,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"llm.listProfileKinds": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"llm.listProfiles": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"llm.listRuntimeNodes": {
 		capName: "llm",
 		capScope: "system",
@@ -80542,13 +80581,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"llm.migrateRawSecrets": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"llm.resolveModelRef": {
 		capName: "llm",
 		capScope: "system",
@@ -80577,20 +80609,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"llm.testProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"llm.upsertProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"llmRuntime.appleAvailability": {
 		capName: "llm-runtime",
 		capScope: "system",
@@ -81095,13 +81113,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"meshNetwork.testConnection": {
-		capName: "mesh-network",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"meter.getStatus": {
 		capName: "meter",
 		capScope: "device",
@@ -81431,13 +81442,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"mqttBroker.testConnection": {
-		capName: "mqtt-broker",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"nativeObjectDetection.getOptions": {
 		capName: "native-object-detection",
 		capScope: "device",
@@ -81767,13 +81771,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.deleteTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"notificationOutput.discoverTargets": {
 		capName: "notification-output",
 		capScope: "system",
@@ -81781,13 +81778,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"notificationOutput.getTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"notificationOutput.listTargetKinds": {
 		capName: "notification-output",
 		capScope: "system",
@@ -81795,13 +81785,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"notificationOutput.listTargets": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"notificationOutput.probeTargetConfig": {
 		capName: "notification-output",
 		capScope: "system",
@@ -81816,13 +81799,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.setTargetEnabled": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"notificationOutput.testTarget": {
 		capName: "notification-output",
 		capScope: "system",
@@ -81830,13 +81806,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.upsertTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"notificationRules.activateAlarmProfile": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -82096,41 +82065,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"oidcConnections.connectionFormSchema": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"oidcConnections.createConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"oidcConnections.deleteConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
-	"oidcConnections.listConnections": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"oidcConnections.updateConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"osd.getStatus": {
 		capName: "osd",
 		capScope: "device",
@@ -85162,13 +85096,6 @@ Object.freeze({
 		access: "delete",
 		role: "admin"
 	},
-	"storage.deleteLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"storage.endDownload": {
 		capName: "storage",
 		capScope: "system",
@@ -85225,13 +85152,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"storage.listProviders": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"storage.read": {
 		capName: "storage",
 		capScope: "system",
@@ -85253,27 +85173,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"storage.testConfig": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"storage.testLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"storage.upsertLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"storage.write": {
 		capName: "storage",
 		capScope: "system",
@@ -86051,27 +85950,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"terminalSession.createInstance": {
-		capName: "terminal-session",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"terminalSession.deleteInstance": {
-		capName: "terminal-session",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
-	"terminalSession.listInstances": {
-		capName: "terminal-session",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"terminalSession.listLegacyCameras": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -86114,20 +85992,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"terminalSession.setInstanceEnabled": {
-		capName: "terminal-session",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"terminalSession.updateInstance": {
-		capName: "terminal-session",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -86268,20 +86132,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"trainingProvider.createEntry": {
-		capName: "training-provider",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"trainingProvider.deleteEntry": {
-		capName: "training-provider",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"trainingProvider.describe": {
 		capName: "training-provider",
 		capScope: "system",
@@ -86352,13 +86202,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"trainingProvider.updateEntry": {
-		capName: "training-provider",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"trainingProvider.uploadDataset": {
 		capName: "training-provider",
 		capScope: "system",
@@ -86366,13 +86209,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"trainingProvider.validateCredentials": {
-		capName: "training-provider",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"turnProvider.getTurnServers": {
 		capName: "turn-provider",
 		capScope: "system",
@@ -146087,17 +145923,6 @@ function scrub(message, secret) {
 function mintRelayId() {
 	return `relay-${(0, node_crypto.randomUUID)().slice(0, 8)}`;
 }
-/** The keys the settings page edits: the relay's connection fields. */
-var RELAY_FORM_KEYS = new Set([
-	"host",
-	"port",
-	"secure",
-	"username",
-	"password",
-	"fromAddress",
-	"fromName"
-]);
-var DEFAULT_RELAY_NAME = "Email (SMTP)";
 var RELAY_LIST_MAX = 200;
 function hasText(value) {
 	return typeof value === "string" && value.length > 0;
@@ -146350,44 +146175,10 @@ var SmtpNodemailerAddon = class extends BaseAddon {
 		const rows = (await records.kind(smtpRelaysKind).query({ limit: RELAY_LIST_MAX })).records;
 		return (rows.find((row) => row.data.host.length > 0) ?? rows[0])?.id;
 	}
-	/** The relay form. Its values live on the relay record, never in `addon-settings`. */
+	/** The relay form. */
 	async integrationFormSchema(_instance) {
 		return this.relayForm();
 	}
-	async getGlobalSettings() {
-		const schema = this.relayForm();
-		if (this.instances === null) return hydrateSchema(schema, {}, { inlineSecretsAsViews: true });
-		const id = await this.firstRelayId();
-		return hydrateSchema(schema, (id === void 0 ? null : await this.instances.readResolved(id))?.body ?? {}, { inlineSecretsAsViews: true });
-	}
-	async updateGlobalSettingsAsOperator(patch) {
-		await this.writeDefaultRelay(patch);
-	}
-	async updateGlobalSettings(patch) {
-		await this.writeDefaultRelay(patch);
-	}
-	/** Write the form's values onto the default relay, creating it on the first save. */
-	async writeDefaultRelay(patch) {
-		if (this.instances === null) throw new Error("smtp-nodemailer is not initialised");
-		const values = Object.fromEntries(Object.entries(patch).filter(([key]) => RELAY_FORM_KEYS.has(key)));
-		const existing = await this.firstRelayId();
-		if (existing !== void 0) {
-			await this.instances.updateInstance({
-				id: existing,
-				values
-			});
-			return;
-		}
-		const id = mintRelayId();
-		await this.instances.createInstance({
-			id,
-			name: DEFAULT_RELAY_NAME
-		});
-		await this.instances.updateInstance({
-			id,
-			values
-		});
-	}
 	/** Probe a relay (EHLO + AUTH) with the form's values, falling back to the stored ones. */
 	async probe(id, values) {
 		const stored = id !== null && this.instances !== null ? await this.instances.getResolved(id) : null;