@camstack/addon-waste-collections 0.1.1 → 0.1.3

package/dist/waste-collections.addon.js

@@ -18084,14 +18084,14 @@ var LlmProfileSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$1 = unknown();
+var ConfigSchemaPassthrough$3 = unknown();
 var LlmProfileKindDescriptorSchema = object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
-	configSchema: ConfigSchemaPassthrough$1
+	configSchema: ConfigSchemaPassthrough$3
 });
 var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
 var LlmDefaultSchema = object({
@@ -19212,7 +19212,7 @@ var TargetKindCapsSchema = object({
 * the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough = unknown();
+var ConfigSchemaPassthrough$2 = unknown();
 var TargetKindSchema = object({
 	kind: string(),
 	label: string(),
@@ -19249,7 +19249,7 @@ var TargetKindSchema = object({
 	* its raster path, which is the safe default for an unknown image.
 	*/
 	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough,
+	configSchema: ConfigSchemaPassthrough$2,
 	/**
 	* The config keys that decide WHERE this kind's secrets are sent (server,
 	* base URL, instance, chat, recipient). A save that changes any of them
@@ -22548,6 +22548,61 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
+* `oidc-connections` — CRUD for IdP rows under `auth-oidc` (D828 sibling).
+*
+* One hub-only singleton (`auth-oidc`). The Settings UI is a DataTable +
+* ItemFormDialog; there is no `editable-array` in `globalSettingsSchema`.
+* Operator-chosen `id` is the URL slug (`/addon/auth-oidc/<id>/…`) and is
+* immutable after create.
+*/
+var ConfigSchemaPassthrough$1 = unknown();
+var OidcConnectionSchema = object({
+	id: string().min(1),
+	displayName: string(),
+	icon: string(),
+	issuerUrl: string(),
+	clientId: string(),
+	/** Client id + secret present — never the secret value. */
+	configured: boolean(),
+	/**
+	* Values for the connection form schema. `clientSecret` is a keychain
+	* {@link SecretFieldView} or `null` / `''`, never plaintext (D789).
+	*/
+	formValues: record(string(), unknown()).optional()
+});
+/**
+* Patch one connection. Omitted or empty `clientSecret` keeps the stored
+* secret (D787). `{ $secretClear: true }` clears it. `id` is never renamed.
+*/
+var OidcConnectionUpdateInputSchema = object({
+	id: string().min(1),
+	displayName: string().min(1),
+	icon: string().optional(),
+	issuerUrl: string().optional(),
+	clientId: string().optional(),
+	clientSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
+	redirectUri: string().optional(),
+	scopes: string().optional(),
+	usernameClaim: _enum([
+		"preferred_username",
+		"email",
+		"sub"
+	]).optional()
+});
+method(object({}), ConfigSchemaPassthrough$1, { auth: "admin" }), method(object({}), array(OidcConnectionSchema).readonly(), { auth: "admin" }), method(object({
+	id: string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug"),
+	displayName: string().min(1)
+}), object({ id: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(OidcConnectionUpdateInputSchema, object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string().min(1) }), object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * What started a camera's onboard motion (D672). `camera` is the camera's own
 * firmware; `sensor` is a device the operator ATTACHED to it. Absent on the
 * wire means the camera: only the camera-sensors bridge ever says `sensor`.
@@ -31572,6 +31627,7 @@ var calendarSourceCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
+	providerKind: "calendar",
 	methods: {
 		listCalendars: method(_void(), array(CalendarInfoSchema).readonly(), { auth: "admin" }),
 		listEvents: method(CalendarListEventsInputSchema, array(CalendarEventSchema).readonly(), { auth: "admin" })
@@ -35053,6 +35109,7 @@ var OsdNamedTemplateSchema = object({
 });
 /** Where a slot's value comes from. */
 var OsdSourceSchema = discriminatedUnion("kind", [
+	object({ kind: literal("none") }),
 	object({
 		kind: literal("static"),
 		text: string().max(64)
@@ -39376,6 +39433,12 @@ var TrainingProviderDefaultsSchema = object({
 	/** Hours a FAILED job's cloud dataset is kept for debugging; 0 = delete at once. */
 	failedDatasetGraceHours: number().nonnegative()
 });
+/**
+* Entry form schema for a provider type — same seam as notification
+* `TargetKind.configSchema` (`z.unknown()` at the wire; callers tighten to
+* {@link ConfigUISchema}). Drives `ConfigFormBuilder` on Training → Providers.
+*/
+var ConfigSchemaPassthrough = unknown();
 /** One creatable provider type, for the Add-entry dialog. */
 var TrainingProviderTypeSchema = object({
 	typeId: string(),
@@ -39383,7 +39446,13 @@ var TrainingProviderTypeSchema = object({
 	/** Path under the addon package (e.g. `assets/training-modal/icon.svg`). */
 	iconAsset: string(),
 	/** Owning `training-provider` addon — collection selector for createEntry. */
-	addonId: string()
+	addonId: string(),
+	/**
+	* Fields for one entry of this type (credentials + defaults). Absent on a
+	* type that only needs a name. Password fields are keychain-backed on the
+	* provider addon (`secretStatePaths`), not D634 plaintext.
+	*/
+	configSchema: ConfigSchemaPassthrough.optional()
 });
 /** One configured account / workspace under a provider type. */
 var TrainingProviderEntrySchema = object({
@@ -39413,7 +39482,30 @@ var TrainingProviderDescriptorSchema = object({
 	dataResidencyNote: string(),
 	/** Credentials are present — never the values. */
 	configured: boolean(),
-	defaults: TrainingProviderDefaultsSchema
+	defaults: TrainingProviderDefaultsSchema,
+	/**
+	* Values for {@link TrainingProviderTypeSchema}'s `configSchema` — password
+	* fields are keychain {@link SecretFieldView} or `null` / `''` (create),
+	* never plaintext. Same hydrate contract as settings forms (D789).
+	*/
+	formValues: record(string(), unknown()).optional()
+});
+/**
+* Patch one entry's name, credentials and defaults. Pin with owning `{ addonId }`.
+* An omitted or empty `tokenSecret` means KEEP the stored secret (D787).
+* `{ $secretClear: true }` clears it.
+*/
+var TrainingProviderUpdateEntryInputSchema = object({
+	entryId: string().min(1),
+	name: string().min(1),
+	tokenId: string().optional(),
+	tokenSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
+	environment: string().optional(),
+	gpuType: string().optional(),
+	region: string().optional(),
+	costCapUsd: number().nonnegative().optional(),
+	maxRuntimeSec: number().int().positive().optional(),
+	failedDatasetGraceHours: number().nonnegative().optional()
 });
 var TrainingCredentialCheckSchema = object({
 	ok: boolean(),
@@ -39483,6 +39575,9 @@ method(object({}), array(TrainingProviderDescriptorSchema).readonly(), { auth: "
 }), method(object({ entryId: string().min(1) }), object({ ok: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(TrainingProviderUpdateEntryInputSchema, object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ entryId: string().min(1) }), TrainingCredentialCheckSchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -43858,6 +43953,36 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"oidcConnections.connectionFormSchema": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"oidcConnections.createConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"oidcConnections.deleteConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"oidcConnections.listConnections": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"oidcConnections.updateConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"osd.getStatus": {
 		capName: "osd",
 		capScope: "device",
@@ -47044,6 +47169,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"trainingProvider.updateEntry": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"trainingProvider.uploadDataset": {
 		capName: "training-provider",
 		capScope: "system",
@@ -51589,6 +51720,7 @@ Object.freeze({
 });
 Object.freeze({
 	"broker": "broker",
+	"calendar-source": "calendar",
 	"device-export": "device-export",
 	"llm": "ai",
 	"mesh-network": "mesh",
@@ -52628,18 +52760,6 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
-//#region src/custom-actions.ts
-var wasteCollectionsActions = defineCustomActions({ fetchNow: customAction(object({ 
-/** When set, refresh only this configured source id; otherwise all enabled. */
-sourceId: string().min(1).optional() }).optional(), object({
-	ok: literal(true),
-	refreshed: array(object({
-		sourceId: string(),
-		entryCount: number().int(),
-		error: string().optional()
-	}))
-}), { kind: "mutation" }) });
-//#endregion
 //#region src/waste-types.ts
 var WasteSourceConfigSchema = object({
 	id: string().min(1),
@@ -52680,6 +52800,54 @@ var WasteFetchResultSchema = discriminatedUnion("ok", [object({
 	error: string()
 })]);
 //#endregion
+//#region src/custom-actions.ts
+var SourceIdSchema = string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug");
+var WasteSourceRowSchema = WasteSourceConfigSchema.extend({ formValues: record(string(), unknown()).optional() });
+var wasteCollectionsActions = defineCustomActions({
+	fetchNow: customAction(object({ 
+	/** When set, refresh only this configured source id; otherwise all enabled. */
+sourceId: string().min(1).optional() }).optional(), object({
+		ok: literal(true),
+		refreshed: array(object({
+			sourceId: string(),
+			entryCount: number().int(),
+			error: string().optional()
+		}))
+	}), {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	listSources: customAction(object({}), array(WasteSourceRowSchema).readonly(), {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	sourceFormSchema: customAction(object({}), unknown(), {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	createSource: customAction(object({
+		id: SourceIdSchema,
+		label: string().min(1)
+	}), object({ id: string() }), {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	updateSource: customAction(object({
+		id: string().min(1),
+		label: string().min(1),
+		module: string().min(1).optional(),
+		argsJson: string().optional(),
+		enabled: boolean().optional()
+	}), object({ ok: literal(true) }), {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	deleteSource: customAction(object({ id: string().min(1) }), object({ ok: literal(true) }), {
+		kind: "mutation",
+		auth: "admin"
+	})
+});
+//#endregion
 //#region src/fetch-source.ts
 /**
 * Spawn the embedded Python bridge once per source fetch.
@@ -52824,11 +52992,56 @@ function createWasteCalendarSource(deps) {
 	};
 }
 //#endregion
+//#region src/waste-source-schema.ts
+var WASTE_SOURCE_FORM_SCHEMA = { sections: [{
+	id: "source",
+	title: "Source",
+	columns: 2,
+	fields: [
+		{
+			type: "text",
+			key: "label",
+			label: "Label",
+			description: "Shown under System → Calendars.",
+			default: "New source"
+		},
+		{
+			type: "text",
+			key: "module",
+			label: "Source module",
+			description: "HACS provider name, e.g. `ics`, `junker_app`, `abfallnavi_de`.",
+			default: "ics"
+		},
+		{
+			type: "textarea",
+			key: "argsJson",
+			label: "Args (JSON object)",
+			description: "Constructor kwargs for the HACS source, e.g. `{\"url\":\"https://…/calendar.ics\"}`.",
+			rows: 4,
+			default: "{}",
+			span: 2
+		},
+		{
+			type: "boolean",
+			key: "enabled",
+			label: "Enabled",
+			default: true
+		}
+	]
+}] };
+var WASTE_SOURCE_CREATE_VALUES = {
+	label: "New source",
+	module: "ics",
+	argsJson: "{}",
+	enabled: true
+};
+//#endregion
 //#region src/waste-collections.addon.ts
 /**
 * Waste Collections — hub-only calendar-source over the vendored HACS
 * `waste_collection_schedule` Python core (full source catalog).
 */
+var SOURCE_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
 var DAY_MS = 1440 * 60 * 1e3;
 var WasteCollectionsAddon = class extends BaseAddon {
 	pythonPath = null;
@@ -52876,7 +53089,14 @@ var WasteCollectionsAddon = class extends BaseAddon {
 				provider
 			}],
 			customActions: wasteCollectionsActions,
-			actionHandlers: { fetchNow: async (input) => this.fetchNow(input) }
+			actionHandlers: {
+				fetchNow: async (input) => this.fetchNow(input),
+				listSources: async () => this.listSources(),
+				sourceFormSchema: async () => WASTE_SOURCE_FORM_SCHEMA,
+				createSource: async (input) => this.createSource(input),
+				updateSource: async (input) => this.updateSource(input),
+				deleteSource: async (input) => this.deleteSource(input)
+			}
 		};
 	}
 	async onConfigChanged() {
@@ -52885,6 +53105,49 @@ var WasteCollectionsAddon = class extends BaseAddon {
 		this.persistCache();
 		this.refreshAll("config-changed");
 	}
+	listSources() {
+		return this.config.sources.map((s) => ({
+			...s,
+			formValues: {
+				label: s.label,
+				module: s.module,
+				argsJson: s.argsJson,
+				enabled: s.enabled
+			}
+		}));
+	}
+	async createSource(input) {
+		if (!SOURCE_ID_PATTERN.test(input.id)) throw new Error("id must be a lowercase slug (e.g. ics-home, junker)");
+		if (this.config.sources.some((s) => s.id === input.id)) throw new Error(`source '${input.id}' already exists`);
+		const row = WasteSourceConfigSchema.parse({
+			...WASTE_SOURCE_CREATE_VALUES,
+			id: input.id,
+			label: input.label
+		});
+		await this.updateGlobalSettings({ sources: [...this.config.sources, row] });
+		return { id: input.id };
+	}
+	async updateSource(input) {
+		const idx = this.config.sources.findIndex((s) => s.id === input.id);
+		if (idx < 0) throw new Error(`source '${input.id}' not found`);
+		const prev = this.config.sources[idx];
+		const next = WasteSourceConfigSchema.parse({
+			id: prev.id,
+			label: input.label,
+			module: input.module ?? prev.module,
+			argsJson: input.argsJson ?? prev.argsJson,
+			enabled: input.enabled ?? prev.enabled
+		});
+		parseSourceArgs(next);
+		const sources = this.config.sources.map((s, i) => i === idx ? next : s);
+		await this.updateGlobalSettings({ sources });
+		return { ok: true };
+	}
+	async deleteSource(input) {
+		if (!this.config.sources.some((s) => s.id === input.id)) throw new Error(`source '${input.id}' not found`);
+		await this.updateGlobalSettings({ sources: this.config.sources.filter((s) => s.id !== input.id) });
+		return { ok: true };
+	}
 	async fetchNow(input) {
 		const targets = this.config.sources.filter((s) => {
 			if (!s.enabled) return false;
@@ -52987,76 +53250,29 @@ var WasteCollectionsAddon = class extends BaseAddon {
 	}
 	globalSettingsSchema() {
 		return this.schema({ sections: [{
-			id: "sources",
-			title: "Waste sources",
-			description: "Each row becomes one calendar under System → Calendars. `module` must be a HACS source name from the bundled catalog (978 providers). `args` are the provider kwargs — see the HACS docs for that module. Use Fetch now after editing.",
-			columns: 1,
-			fields: [
-				{
-					type: "editable-array",
-					key: "sources",
-					label: "Configured sources",
-					itemIdKey: "id",
-					itemFields: [
-						{
-							type: "text",
-							key: "id",
-							label: "Id",
-							description: "Stable id (calendar local id)."
-						},
-						{
-							type: "text",
-							key: "label",
-							label: "Label"
-						},
-						{
-							type: "text",
-							key: "module",
-							label: "Source module",
-							description: "e.g. `ics`, `junker_app`, `abfallnavi_de`."
-						},
-						{
-							type: "textarea",
-							key: "argsJson",
-							label: "Args (JSON object)",
-							description: "Constructor kwargs for the HACS source, e.g. `{\"url\":\"https://…/calendar.ics\"}`.",
-							rows: 4
-						},
-						{
-							type: "boolean",
-							key: "enabled",
-							label: "Enabled"
-						}
-					],
-					defaultItem: {
-						id: "",
-						label: "New source",
-						module: "ics",
-						argsJson: "{}",
-						enabled: true
-					}
-				},
-				{
-					type: "number",
-					key: "fetchHour",
-					label: "Daily fetch hour (local)",
-					min: 0,
-					max: 23,
-					step: 1,
-					description: "Informational — the addon refreshes about once per day from boot; use Fetch now to force."
-				},
-				{
-					type: "addon-action-button",
-					key: "_fetchNow",
-					label: "Refresh",
-					buttonLabel: "Fetch now",
-					description: "Refresh every enabled source immediately.",
-					addonId: "waste-collections",
-					action: "fetchNow",
-					variant: "primary",
-					paramsStatic: {}
-				}
-			]
+			id: "refresh",
+			title: "Refresh",
+			description: "Sources are managed in the table above (Add / Edit). Each source becomes one calendar under System → Calendars.",
+			columns: 2,
+			fields: [{
+				type: "number",
+				key: "fetchHour",
+				label: "Daily fetch hour (local)",
+				min: 0,
+				max: 23,
+				step: 1,
+				description: "Informational — the addon refreshes about once per day from boot; use Fetch now to force."
+			}, {
+				type: "addon-action-button",
+				key: "_fetchNow",
+				label: "Refresh",
+				buttonLabel: "Fetch now",
+				description: "Refresh every enabled source immediately.",
+				addonId: "waste-collections",
+				action: "fetchNow",
+				variant: "primary",
+				paramsStatic: {}
+			}]
 		}] });
 	}
 };

package/dist/waste-collections.addon.mjs

@@ -18080,14 +18080,14 @@ var LlmProfileSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$1 = unknown();
+var ConfigSchemaPassthrough$3 = unknown();
 var LlmProfileKindDescriptorSchema = object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
-	configSchema: ConfigSchemaPassthrough$1
+	configSchema: ConfigSchemaPassthrough$3
 });
 var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
 var LlmDefaultSchema = object({
@@ -19208,7 +19208,7 @@ var TargetKindCapsSchema = object({
 * the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough = unknown();
+var ConfigSchemaPassthrough$2 = unknown();
 var TargetKindSchema = object({
 	kind: string(),
 	label: string(),
@@ -19245,7 +19245,7 @@ var TargetKindSchema = object({
 	* its raster path, which is the safe default for an unknown image.
 	*/
 	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough,
+	configSchema: ConfigSchemaPassthrough$2,
 	/**
 	* The config keys that decide WHERE this kind's secrets are sent (server,
 	* base URL, instance, chat, recipient). A save that changes any of them
@@ -22544,6 +22544,61 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
+* `oidc-connections` — CRUD for IdP rows under `auth-oidc` (D828 sibling).
+*
+* One hub-only singleton (`auth-oidc`). The Settings UI is a DataTable +
+* ItemFormDialog; there is no `editable-array` in `globalSettingsSchema`.
+* Operator-chosen `id` is the URL slug (`/addon/auth-oidc/<id>/…`) and is
+* immutable after create.
+*/
+var ConfigSchemaPassthrough$1 = unknown();
+var OidcConnectionSchema = object({
+	id: string().min(1),
+	displayName: string(),
+	icon: string(),
+	issuerUrl: string(),
+	clientId: string(),
+	/** Client id + secret present — never the secret value. */
+	configured: boolean(),
+	/**
+	* Values for the connection form schema. `clientSecret` is a keychain
+	* {@link SecretFieldView} or `null` / `''`, never plaintext (D789).
+	*/
+	formValues: record(string(), unknown()).optional()
+});
+/**
+* Patch one connection. Omitted or empty `clientSecret` keeps the stored
+* secret (D787). `{ $secretClear: true }` clears it. `id` is never renamed.
+*/
+var OidcConnectionUpdateInputSchema = object({
+	id: string().min(1),
+	displayName: string().min(1),
+	icon: string().optional(),
+	issuerUrl: string().optional(),
+	clientId: string().optional(),
+	clientSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
+	redirectUri: string().optional(),
+	scopes: string().optional(),
+	usernameClaim: _enum([
+		"preferred_username",
+		"email",
+		"sub"
+	]).optional()
+});
+method(object({}), ConfigSchemaPassthrough$1, { auth: "admin" }), method(object({}), array(OidcConnectionSchema).readonly(), { auth: "admin" }), method(object({
+	id: string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug"),
+	displayName: string().min(1)
+}), object({ id: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(OidcConnectionUpdateInputSchema, object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string().min(1) }), object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * What started a camera's onboard motion (D672). `camera` is the camera's own
 * firmware; `sensor` is a device the operator ATTACHED to it. Absent on the
 * wire means the camera: only the camera-sensors bridge ever says `sensor`.
@@ -31568,6 +31623,7 @@ var calendarSourceCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
+	providerKind: "calendar",
 	methods: {
 		listCalendars: method(_void(), array(CalendarInfoSchema).readonly(), { auth: "admin" }),
 		listEvents: method(CalendarListEventsInputSchema, array(CalendarEventSchema).readonly(), { auth: "admin" })
@@ -35049,6 +35105,7 @@ var OsdNamedTemplateSchema = object({
 });
 /** Where a slot's value comes from. */
 var OsdSourceSchema = discriminatedUnion("kind", [
+	object({ kind: literal("none") }),
 	object({
 		kind: literal("static"),
 		text: string().max(64)
@@ -39372,6 +39429,12 @@ var TrainingProviderDefaultsSchema = object({
 	/** Hours a FAILED job's cloud dataset is kept for debugging; 0 = delete at once. */
 	failedDatasetGraceHours: number().nonnegative()
 });
+/**
+* Entry form schema for a provider type — same seam as notification
+* `TargetKind.configSchema` (`z.unknown()` at the wire; callers tighten to
+* {@link ConfigUISchema}). Drives `ConfigFormBuilder` on Training → Providers.
+*/
+var ConfigSchemaPassthrough = unknown();
 /** One creatable provider type, for the Add-entry dialog. */
 var TrainingProviderTypeSchema = object({
 	typeId: string(),
@@ -39379,7 +39442,13 @@ var TrainingProviderTypeSchema = object({
 	/** Path under the addon package (e.g. `assets/training-modal/icon.svg`). */
 	iconAsset: string(),
 	/** Owning `training-provider` addon — collection selector for createEntry. */
-	addonId: string()
+	addonId: string(),
+	/**
+	* Fields for one entry of this type (credentials + defaults). Absent on a
+	* type that only needs a name. Password fields are keychain-backed on the
+	* provider addon (`secretStatePaths`), not D634 plaintext.
+	*/
+	configSchema: ConfigSchemaPassthrough.optional()
 });
 /** One configured account / workspace under a provider type. */
 var TrainingProviderEntrySchema = object({
@@ -39409,7 +39478,30 @@ var TrainingProviderDescriptorSchema = object({
 	dataResidencyNote: string(),
 	/** Credentials are present — never the values. */
 	configured: boolean(),
-	defaults: TrainingProviderDefaultsSchema
+	defaults: TrainingProviderDefaultsSchema,
+	/**
+	* Values for {@link TrainingProviderTypeSchema}'s `configSchema` — password
+	* fields are keychain {@link SecretFieldView} or `null` / `''` (create),
+	* never plaintext. Same hydrate contract as settings forms (D789).
+	*/
+	formValues: record(string(), unknown()).optional()
+});
+/**
+* Patch one entry's name, credentials and defaults. Pin with owning `{ addonId }`.
+* An omitted or empty `tokenSecret` means KEEP the stored secret (D787).
+* `{ $secretClear: true }` clears it.
+*/
+var TrainingProviderUpdateEntryInputSchema = object({
+	entryId: string().min(1),
+	name: string().min(1),
+	tokenId: string().optional(),
+	tokenSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
+	environment: string().optional(),
+	gpuType: string().optional(),
+	region: string().optional(),
+	costCapUsd: number().nonnegative().optional(),
+	maxRuntimeSec: number().int().positive().optional(),
+	failedDatasetGraceHours: number().nonnegative().optional()
 });
 var TrainingCredentialCheckSchema = object({
 	ok: boolean(),
@@ -39479,6 +39571,9 @@ method(object({}), array(TrainingProviderDescriptorSchema).readonly(), { auth: "
 }), method(object({ entryId: string().min(1) }), object({ ok: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(TrainingProviderUpdateEntryInputSchema, object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ entryId: string().min(1) }), TrainingCredentialCheckSchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -43854,6 +43949,36 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"oidcConnections.connectionFormSchema": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"oidcConnections.createConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"oidcConnections.deleteConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"oidcConnections.listConnections": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"oidcConnections.updateConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"osd.getStatus": {
 		capName: "osd",
 		capScope: "device",
@@ -47040,6 +47165,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"trainingProvider.updateEntry": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"trainingProvider.uploadDataset": {
 		capName: "training-provider",
 		capScope: "system",
@@ -51585,6 +51716,7 @@ Object.freeze({
 });
 Object.freeze({
 	"broker": "broker",
+	"calendar-source": "calendar",
 	"device-export": "device-export",
 	"llm": "ai",
 	"mesh-network": "mesh",
@@ -52624,18 +52756,6 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
-//#region src/custom-actions.ts
-var wasteCollectionsActions = defineCustomActions({ fetchNow: customAction(object({ 
-/** When set, refresh only this configured source id; otherwise all enabled. */
-sourceId: string().min(1).optional() }).optional(), object({
-	ok: literal(true),
-	refreshed: array(object({
-		sourceId: string(),
-		entryCount: number().int(),
-		error: string().optional()
-	}))
-}), { kind: "mutation" }) });
-//#endregion
 //#region src/waste-types.ts
 var WasteSourceConfigSchema = object({
 	id: string().min(1),
@@ -52676,6 +52796,54 @@ var WasteFetchResultSchema = discriminatedUnion("ok", [object({
 	error: string()
 })]);
 //#endregion
+//#region src/custom-actions.ts
+var SourceIdSchema = string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug");
+var WasteSourceRowSchema = WasteSourceConfigSchema.extend({ formValues: record(string(), unknown()).optional() });
+var wasteCollectionsActions = defineCustomActions({
+	fetchNow: customAction(object({ 
+	/** When set, refresh only this configured source id; otherwise all enabled. */
+sourceId: string().min(1).optional() }).optional(), object({
+		ok: literal(true),
+		refreshed: array(object({
+			sourceId: string(),
+			entryCount: number().int(),
+			error: string().optional()
+		}))
+	}), {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	listSources: customAction(object({}), array(WasteSourceRowSchema).readonly(), {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	sourceFormSchema: customAction(object({}), unknown(), {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	createSource: customAction(object({
+		id: SourceIdSchema,
+		label: string().min(1)
+	}), object({ id: string() }), {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	updateSource: customAction(object({
+		id: string().min(1),
+		label: string().min(1),
+		module: string().min(1).optional(),
+		argsJson: string().optional(),
+		enabled: boolean().optional()
+	}), object({ ok: literal(true) }), {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	deleteSource: customAction(object({ id: string().min(1) }), object({ ok: literal(true) }), {
+		kind: "mutation",
+		auth: "admin"
+	})
+});
+//#endregion
 //#region src/fetch-source.ts
 /**
 * Spawn the embedded Python bridge once per source fetch.
@@ -52820,11 +52988,56 @@ function createWasteCalendarSource(deps) {
 	};
 }
 //#endregion
+//#region src/waste-source-schema.ts
+var WASTE_SOURCE_FORM_SCHEMA = { sections: [{
+	id: "source",
+	title: "Source",
+	columns: 2,
+	fields: [
+		{
+			type: "text",
+			key: "label",
+			label: "Label",
+			description: "Shown under System → Calendars.",
+			default: "New source"
+		},
+		{
+			type: "text",
+			key: "module",
+			label: "Source module",
+			description: "HACS provider name, e.g. `ics`, `junker_app`, `abfallnavi_de`.",
+			default: "ics"
+		},
+		{
+			type: "textarea",
+			key: "argsJson",
+			label: "Args (JSON object)",
+			description: "Constructor kwargs for the HACS source, e.g. `{\"url\":\"https://…/calendar.ics\"}`.",
+			rows: 4,
+			default: "{}",
+			span: 2
+		},
+		{
+			type: "boolean",
+			key: "enabled",
+			label: "Enabled",
+			default: true
+		}
+	]
+}] };
+var WASTE_SOURCE_CREATE_VALUES = {
+	label: "New source",
+	module: "ics",
+	argsJson: "{}",
+	enabled: true
+};
+//#endregion
 //#region src/waste-collections.addon.ts
 /**
 * Waste Collections — hub-only calendar-source over the vendored HACS
 * `waste_collection_schedule` Python core (full source catalog).
 */
+var SOURCE_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
 var DAY_MS = 1440 * 60 * 1e3;
 var WasteCollectionsAddon = class extends BaseAddon {
 	pythonPath = null;
@@ -52872,7 +53085,14 @@ var WasteCollectionsAddon = class extends BaseAddon {
 				provider
 			}],
 			customActions: wasteCollectionsActions,
-			actionHandlers: { fetchNow: async (input) => this.fetchNow(input) }
+			actionHandlers: {
+				fetchNow: async (input) => this.fetchNow(input),
+				listSources: async () => this.listSources(),
+				sourceFormSchema: async () => WASTE_SOURCE_FORM_SCHEMA,
+				createSource: async (input) => this.createSource(input),
+				updateSource: async (input) => this.updateSource(input),
+				deleteSource: async (input) => this.deleteSource(input)
+			}
 		};
 	}
 	async onConfigChanged() {
@@ -52881,6 +53101,49 @@ var WasteCollectionsAddon = class extends BaseAddon {
 		this.persistCache();
 		this.refreshAll("config-changed");
 	}
+	listSources() {
+		return this.config.sources.map((s) => ({
+			...s,
+			formValues: {
+				label: s.label,
+				module: s.module,
+				argsJson: s.argsJson,
+				enabled: s.enabled
+			}
+		}));
+	}
+	async createSource(input) {
+		if (!SOURCE_ID_PATTERN.test(input.id)) throw new Error("id must be a lowercase slug (e.g. ics-home, junker)");
+		if (this.config.sources.some((s) => s.id === input.id)) throw new Error(`source '${input.id}' already exists`);
+		const row = WasteSourceConfigSchema.parse({
+			...WASTE_SOURCE_CREATE_VALUES,
+			id: input.id,
+			label: input.label
+		});
+		await this.updateGlobalSettings({ sources: [...this.config.sources, row] });
+		return { id: input.id };
+	}
+	async updateSource(input) {
+		const idx = this.config.sources.findIndex((s) => s.id === input.id);
+		if (idx < 0) throw new Error(`source '${input.id}' not found`);
+		const prev = this.config.sources[idx];
+		const next = WasteSourceConfigSchema.parse({
+			id: prev.id,
+			label: input.label,
+			module: input.module ?? prev.module,
+			argsJson: input.argsJson ?? prev.argsJson,
+			enabled: input.enabled ?? prev.enabled
+		});
+		parseSourceArgs(next);
+		const sources = this.config.sources.map((s, i) => i === idx ? next : s);
+		await this.updateGlobalSettings({ sources });
+		return { ok: true };
+	}
+	async deleteSource(input) {
+		if (!this.config.sources.some((s) => s.id === input.id)) throw new Error(`source '${input.id}' not found`);
+		await this.updateGlobalSettings({ sources: this.config.sources.filter((s) => s.id !== input.id) });
+		return { ok: true };
+	}
 	async fetchNow(input) {
 		const targets = this.config.sources.filter((s) => {
 			if (!s.enabled) return false;
@@ -52983,76 +53246,29 @@ var WasteCollectionsAddon = class extends BaseAddon {
 	}
 	globalSettingsSchema() {
 		return this.schema({ sections: [{
-			id: "sources",
-			title: "Waste sources",
-			description: "Each row becomes one calendar under System → Calendars. `module` must be a HACS source name from the bundled catalog (978 providers). `args` are the provider kwargs — see the HACS docs for that module. Use Fetch now after editing.",
-			columns: 1,
-			fields: [
-				{
-					type: "editable-array",
-					key: "sources",
-					label: "Configured sources",
-					itemIdKey: "id",
-					itemFields: [
-						{
-							type: "text",
-							key: "id",
-							label: "Id",
-							description: "Stable id (calendar local id)."
-						},
-						{
-							type: "text",
-							key: "label",
-							label: "Label"
-						},
-						{
-							type: "text",
-							key: "module",
-							label: "Source module",
-							description: "e.g. `ics`, `junker_app`, `abfallnavi_de`."
-						},
-						{
-							type: "textarea",
-							key: "argsJson",
-							label: "Args (JSON object)",
-							description: "Constructor kwargs for the HACS source, e.g. `{\"url\":\"https://…/calendar.ics\"}`.",
-							rows: 4
-						},
-						{
-							type: "boolean",
-							key: "enabled",
-							label: "Enabled"
-						}
-					],
-					defaultItem: {
-						id: "",
-						label: "New source",
-						module: "ics",
-						argsJson: "{}",
-						enabled: true
-					}
-				},
-				{
-					type: "number",
-					key: "fetchHour",
-					label: "Daily fetch hour (local)",
-					min: 0,
-					max: 23,
-					step: 1,
-					description: "Informational — the addon refreshes about once per day from boot; use Fetch now to force."
-				},
-				{
-					type: "addon-action-button",
-					key: "_fetchNow",
-					label: "Refresh",
-					buttonLabel: "Fetch now",
-					description: "Refresh every enabled source immediately.",
-					addonId: "waste-collections",
-					action: "fetchNow",
-					variant: "primary",
-					paramsStatic: {}
-				}
-			]
+			id: "refresh",
+			title: "Refresh",
+			description: "Sources are managed in the table above (Add / Edit). Each source becomes one calendar under System → Calendars.",
+			columns: 2,
+			fields: [{
+				type: "number",
+				key: "fetchHour",
+				label: "Daily fetch hour (local)",
+				min: 0,
+				max: 23,
+				step: 1,
+				description: "Informational — the addon refreshes about once per day from boot; use Fetch now to force."
+			}, {
+				type: "addon-action-button",
+				key: "_fetchNow",
+				label: "Refresh",
+				buttonLabel: "Fetch now",
+				description: "Refresh every enabled source immediately.",
+				addonId: "waste-collections",
+				action: "fetchNow",
+				variant: "primary",
+				paramsStatic: {}
+			}]
 		}] });
 	}
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-waste-collections",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Waste collection schedules via the vendored HACS waste_collection_schedule Python core — full source catalog as calendar-source.",
   "keywords": [
     "camstack",