@camstack/addon-waste-collections 0.1.36 → 0.1.37

package/dist/waste-collections.addon.mjs

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
-//#region ../types/dist/event-category-BmPm98n0.mjs
+//#region ../types/dist/event-category-78tcBemo.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -123,6 +123,23 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AddonLoadRecovered"] = "addon.load-recovered";
 	/**
+	* An addon is RUNNING although its installed package is below what the
+	* running server requires (`camstack.requires.addons` of the server, or the
+	* addon's own `requires.server`). Raised once per streak by the unsupported-
+	* addon tracker, on the hub and on agents; AlertCenter turns it into one
+	* operator alert per node and package. The addon is never held back for it.
+	*
+	* Payload: `{ packageName, addonId, nodeId, installedVersion, requiredMinimum, serverVersion, unmet }`.
+	*/
+	EventCategory["AddonUnsupportedVersion"] = "addon.unsupported-version";
+	/**
+	* The package of an {@link AddonUnsupportedVersion} alert reached a supported
+	* version, or is no longer installed on the node. AlertCenter dismisses the matching alert.
+	*
+	* Payload: `{ packageName, addonId, nodeId }`.
+	*/
+	EventCategory["AddonUnsupportedResolved"] = "addon.unsupported-resolved";
+	/**
 	* Monitor scheduled the next retry for a failed addon. Transient —
 	* surfaced to the UI for live-updating the "next retry in Ns"
 	* countdown on the Addons page row, NOT persisted as an alert.
@@ -233,7 +250,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["ProcessRestarted"] = "process.restarted";
 	/**
 	* The SET of storage locations changed — one was created, edited, enabled,
-	* disabled or deleted through `storage.upsertLocation` / `deleteLocation`.
+	* disabled or deleted through the location instances or the forced-delete action.
 	*
 	* Telemetry, not a transaction (D8/D11): every consumer that re-resolves on
 	* it must also converge on its own periodic path, because a dropped event
@@ -5984,7 +6001,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-D7ZKm4nb.mjs
+//#region ../types/dist/sleep-AEnTN3b4.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6079,16 +6096,6 @@ var AddonMigrationsBlockedError = class extends Error {
 		this.migrationIds = migrationIds;
 	}
 };
-/**
-* The value a redacted secret is replaced with on every read surface.
-*
-* It is also the WRITE-BACK token: an `upsertLocation` that sends this value
-* back for a key means "keep what is stored", which is what lets an operator
-* rename a location without retyping its password. A literal an operator could
-* plausibly choose as a real password would turn that convenience into a way
-* to lock yourself out, hence the sentinel shape.
-*/
-var REDACTED_SECRET = "__camstack_redacted__";
 /** Is this field's stored value a credential? */
 function isSecretConfigField(field) {
 	if (field.type === "password") return true;
@@ -7399,17 +7406,35 @@ var RecordIntegrationInstances = class {
 			...kind !== void 0 ? { kind } : {}
 		});
 		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
+		const initial = this.hooks.initialBody(name, kind);
+		const patch = this.patchOf(values ?? {});
+		if (Object.keys(patch).length > 0) Object.assign(patch, await this.hooks.validateWrite?.({
+			kind,
+			body: {
+				...initial,
+				...patch
+			}
+		}));
 		await this.handle.put({
 			id: minted,
-			data: this.hooks.initialBody(name, kind)
+			data: initial
 		}, { ifRev: 0 });
-		const patch = this.patchOf(values ?? {});
 		if (Object.keys(patch).length > 0) await this.handle.patch(minted, patch);
 		await this.hooks.onChanged?.(minted, "created");
 		return { id: minted };
 	};
 	updateInstance = async ({ id, name, values }) => {
 		const patch = this.patchOf(values);
+		if (this.hooks.validateWrite !== void 0 && Object.keys(patch).length > 0) {
+			const stored = await this.handle.get(id);
+			if (stored !== null) Object.assign(patch, await this.hooks.validateWrite({
+				kind: void 0,
+				body: {
+					...stored.data,
+					...patch
+				}
+			}));
+		}
 		if (name !== void 0) patch[this.nameField] = name;
 		await this.handle.patch(id, patch);
 		await this.hooks.onChanged?.(id, "updated");
@@ -10773,7 +10798,6 @@ var CAP_NAMES = Object.freeze([
 	"notifier",
 	"numeric-sensor",
 	"oauth-integration",
-	"oidc-connections",
 	"osd",
 	"osd-manager",
 	"pet-feeder",
@@ -12665,8 +12689,7 @@ Object.freeze({
 	"device-provider": { "reloadDevice": 18e4 },
 	"llm": {
 		"generate": 6e5,
-		"generateVision": 6e5,
-		"testProfile": 6e5
+		"generateVision": 6e5
 	},
 	"llm-runtime": {
 		"complete": 6e5,
@@ -14069,17 +14092,18 @@ var IntegrationInstanceRefSchema = object({
 * message to what the kind supports — callers never special-case a service.
 *
 * DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
+*  - A target is an INSTANCE of this function cap (epic #440, step 6): the
+*    providers serve their targets as `integration-instances` records, one
+*    record kind per target kind, and the admin lists, adds, edits, switches
+*    and deletes them through that cap. This cap keeps what an instance cannot
+*    say: the kind catalogue (`listTargetKinds`: capabilities, delivery
+*    parameters, brand icon), dispatch (`send`, `testTarget`) and the form
+*    helpers (`discoverTargets`, `probeTargetConfig`).
+*  - `listTargetKinds` / `discoverTargets` return arrays → the generated
+*    cap-mount auto-`concatCollection`-fans them across every registered
+*    provider so one catalog is routable. `send` / `testTarget` /
+*    `probeTargetConfig` route to ONE provider by the `addonId` the generated
+*    collection router extracts from the call input.
 *  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
 *    transformer) + UDS MsgPack both round-trip typed arrays — already used by
 *    `storage` / `storage-provider` / `recording` caps over the same path. No
@@ -14324,7 +14348,7 @@ var TargetKindCapsSchema = object({
 * the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough$4 = unknown();
+var ConfigSchemaPassthrough$3 = unknown();
 var TargetKindSchema = object({
 	kind: string(),
 	label: string(),
@@ -14361,7 +14385,7 @@ var TargetKindSchema = object({
 	* its raster path, which is the safe default for an unknown image.
 	*/
 	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough$4,
+	configSchema: ConfigSchemaPassthrough$3,
 	/**
 	* The config keys that decide WHERE this kind's secrets are sent (server,
 	* base URL, instance, chat, recipient). A save that changes any of them
@@ -14383,9 +14407,11 @@ var TargetKindSchema = object({
 	caps: TargetKindCapsSchema
 });
 /**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
+* A target as a provider's own code sees it (the notification-center bridge, the
+* send path): the flat record body split into the name, the switch and the
+* kind's fields. `config` holds secrets; a reader that serves it to a client
+* REDACTS secret fields (a presence marker only) — never round-trip a stored
+* secret to the UI.
 */
 var TargetSchema = object({
 	id: string(),
@@ -14428,13 +14454,13 @@ var ProbeTargetConfigResultSchema = object({
 	stateInstance: string().optional(),
 	error: string().optional()
 });
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({ targetId: string() }), TargetSchema, { auth: "admin" }), method(object({
+method(object({}), array(TargetKindSchema)), method(object({
 	kind: string(),
 	config: record(string(), unknown()).optional(),
 	/**
 	* When editing / duplicating, the blank password field never round-trips
 	* the stored token. Pass the source target id so the provider can restore
-	* secrets server-side before dialling (same merge as upsert).
+	* secrets server-side before dialling.
 	*/
 	targetId: string().optional()
 }), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
@@ -14457,27 +14483,6 @@ method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSche
 }), TestResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	target: TargetSchema,
-	/**
-	* Duplicate flow: create a NEW target id while copying secrets from an
-	* existing row. The UI never holds the stored token; blank / redacted
-	* password fields are restored from this source (D634 still applies if
-	* destinations diverge without a re-typed secret).
-	*/
-	cloneSecretsFrom: string().optional()
-}), TargetSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ targetId: string() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	enabled: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
 });
 looseObject({
 	name: string().min(1),
@@ -22735,7 +22740,6 @@ var SYSTEM_CAP_VOCABULARY = {
 	"notification-output": system("notification delivery — reached through notifier devices and rules"),
 	"notification-rules": system("notification rules — authored on their own page"),
 	"oauth-integration": system(IDENTITY),
-	"oidc-connections": system(IDENTITY),
 	"osd-manager": system(PIPELINE),
 	"pipeline-executor": system(PIPELINE),
 	"pipeline-orchestrator": system(PIPELINE),
@@ -54423,7 +54427,7 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 * or the redaction token KEEPS the stored secret; `{ $secretClear: true }`
 * clears it.
 */
-var ConfigSchemaPassthrough$3 = custom();
+var ConfigSchemaPassthrough$2 = custom();
 var IntegrationInstanceIdSchema = string().min(1);
 var IntegrationInstanceModeSchema = _enum(["single", "multiple"]);
 /**
@@ -54469,7 +54473,16 @@ var IntegrationInstanceKindSchema = object({
 	/** Relative hub path to start an interactive account link of an instance of this kind. */
 	connectPath: string().min(1).optional(),
 	/** Relative hub path to disconnect that account. */
-	disconnectPath: string().min(1).optional()
+	disconnectPath: string().min(1).optional(),
+	/**
+	* Parts of the edit dialog the flat form cannot draw (a node picker, a model source), named by a
+	* GENERIC widget id the client maps to a component; a client that knows none of them shows none.
+	* `connection` widgets write connection values, `model` widgets own the model choice.
+	*/
+	widgets: array(object({
+		id: string().min(1),
+		placement: _enum(["connection", "model"])
+	})).optional()
 });
 /**
 * How devices of an instance are found. `none`: the operator adds them by hand; `lan`: the addon
@@ -54574,7 +54587,7 @@ var integrationInstancesCapability = {
 			id: IntegrationInstanceIdSchema.nullable(),
 			/** The kind of the create form (`id: null`) of a provider with several. */
 			kind: string().min(1).optional()
-		}), ConfigSchemaPassthrough$3, { auth: "admin" }),
+		}), ConfigSchemaPassthrough$2, { auth: "admin" }),
 		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
 		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
 		/**
@@ -55525,12 +55538,12 @@ var LlmModelInfoSchema = object({
 });
 /**
 * The provider-specific part of a profile, validated by the provider that owns
-* the kind (`upsertProfile` refuses what it does not accept). A field its
+* the kind (saving an instance refuses what it does not accept). A field its
 * `connectionSchema` declares `type: 'password'` is a secret: it is held in the
 * keychain, never in the row, and reads back as the redaction marker.
 */
 var LlmProviderConfigSchema = record(string(), unknown());
-var LlmProfileSchema = object({
+object({
 	id: string(),
 	name: string(),
 	/** The provider-declared kind (`LlmProfileKindDescriptor.kind`). */
@@ -55624,8 +55637,8 @@ var LlmProviderWidgetSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$2 = unknown();
-var LlmProfileKindDescriptorSchema = object({
+var ConfigSchemaPassthrough$1 = unknown();
+object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	/** A generic icon name (`cloud`, `plug`, `cpu`) — never a glyph or a logo. */
@@ -55633,9 +55646,9 @@ var LlmProfileKindDescriptorSchema = object({
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
 	/** The provider's own fields (`providerConfig`); `password` fields are keychain-held. */
-	connectionSchema: ConfigSchemaPassthrough$2,
+	connectionSchema: ConfigSchemaPassthrough$1,
 	/** Provider fields that belong under "Advanced" (extra headers, runtime tuning). */
-	advancedSchema: ConfigSchemaPassthrough$2.optional(),
+	advancedSchema: ConfigSchemaPassthrough$1.optional(),
 	/** The kind's defaults; a model from `listModels` may override any of them. */
 	features: LlmModelFeaturesSchema,
 	/** `false` = the provider stamps `supportsVision` itself (from what a node reports). */
@@ -55764,20 +55777,7 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, {
 }), method(object({
 	addonId: string().optional(),
 	requestId: string()
-}), _void(), { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(ProfileRefInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(ProfileRefInputSchema, LlmGenerateResultSchema, {
-	kind: "mutation",
-	auth: "admin",
-	timeoutMs: AI_CAP_TRANSPORT_TIMEOUT_MS
-}), method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
+}), _void(), { kind: "mutation" }), method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), array(LlmDefaultSchema)), method(object({
@@ -56772,20 +56772,7 @@ method(_void(), MeshStatusSchema), method(object({
 /** Optional hostname override the host should advertise once joined. */
 hostname: string().optional() }), object({ 
 /** Authentication URL the operator should open in a browser. */
-loginUrl: string() }), { kind: "mutation" }), method(_void(), object({ left: literal(true) }), { kind: "mutation" }), method(_void(), object({ loggedOut: literal(true) }), { kind: "mutation" }), method(_void(), object({ peers: array(MeshPeerSchema).readonly() })), method(object({ 
-/** Optional auth key — when provided, probes the key validity
-*  against the provider's API. Omit when already joined to
-*  just ping the daemon. */
-authKey: string().optional() }), object({
-	ok: boolean(),
-	/** Provider-side identifier resolved by the probe (tailnet
-	*  name for Tailscale, network id for ZeroTier, etc.). */
-	tenant: string().optional(),
-	/** Daemon binary version, when reachable. */
-	daemonVersion: string().optional(),
-	/** Human-readable error when `ok: false`. */
-	error: string().optional()
-}), { kind: "mutation" });
+loginUrl: string() }), { kind: "mutation" }), method(_void(), object({ left: literal(true) }), { kind: "mutation" }), method(_void(), object({ loggedOut: literal(true) }), { kind: "mutation" }), method(_void(), object({ peers: array(MeshPeerSchema).readonly() }));
 object({
 	value: number().nullable().meta(readingMeta("device", { label: "Total" })),
 	lastFetchedAt: number()
@@ -66443,61 +66430,6 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
-* `oidc-connections` — CRUD for IdP rows under `auth-oidc` (D828 sibling).
-*
-* One hub-only singleton (`auth-oidc`). The Settings UI is a DataTable +
-* ItemFormDialog; there is no `editable-array` in `globalSettingsSchema`.
-* Operator-chosen `id` is the URL slug (`/addon/auth-oidc/<id>/…`) and is
-* immutable after create.
-*/
-var ConfigSchemaPassthrough$1 = unknown();
-var OidcConnectionSchema = object({
-	id: string().min(1),
-	displayName: string(),
-	icon: string(),
-	issuerUrl: string(),
-	clientId: string(),
-	/** Client id + secret present — never the secret value. */
-	configured: boolean(),
-	/**
-	* Values for the connection form schema. `clientSecret` is a keychain
-	* {@link SecretFieldView} or `null` / `''`, never plaintext (D789).
-	*/
-	formValues: record(string(), unknown()).optional()
-});
-/**
-* Patch one connection. Omitted or empty `clientSecret` keeps the stored
-* secret (D787). `{ $secretClear: true }` clears it. `id` is never renamed.
-*/
-var OidcConnectionUpdateInputSchema = object({
-	id: string().min(1),
-	displayName: string().min(1),
-	icon: string().optional(),
-	issuerUrl: string().optional(),
-	clientId: string().optional(),
-	clientSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
-	redirectUri: string().optional(),
-	scopes: string().optional(),
-	usernameClaim: _enum([
-		"preferred_username",
-		"email",
-		"sub"
-	]).optional()
-});
-method(object({}), ConfigSchemaPassthrough$1, { auth: "admin" }), method(object({}), array(OidcConnectionSchema).readonly(), { auth: "admin" }), method(object({
-	id: string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug"),
-	displayName: string().min(1)
-}), object({ id: string() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(OidcConnectionUpdateInputSchema, object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ id: string().min(1) }), object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * Generic on-screen-display (video overlay) cap. Each camera exposes
 * a firmware-defined list of overlays (channel name, timestamp,
 * watermark, logo, …); the cap models them as a homogeneous array of
@@ -72670,21 +72602,6 @@ method(object({
 	*/
 	ttlSec: union([number().int().positive(), literal("never")]).optional()
 }), object({ token: string() }), { auth: "admin" }), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable(), { auth: "admin" });
-var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object({
-	providerId: string().min(1),
-	displayName: string().min(1),
-	configSchema: unknown(),
-	nodeLocal: boolean(),
-	shouldSaveDiskSpace: literal(true),
-	minFreePercent: number().min(0).max(100)
-}), object({
-	providerId: string().min(1),
-	displayName: string().min(1),
-	configSchema: unknown(),
-	nodeLocal: boolean(),
-	shouldSaveDiskSpace: literal(false),
-	minFreePercent: literal(null)
-})]);
 method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
@@ -72746,42 +72663,7 @@ method(object({
 }), _instanceof(Uint8Array), { auth: "admin" }), method(object({ downloadId: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
-	createdAt: true,
-	updatedAt: true
-}), StorageLocationSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	id: string(),
-	force: boolean().optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(StorageDrainProgressSchema).readonly()), method(object({ id: string() }), object({
-	ok: boolean(),
-	error: string().optional()
-}), { auth: "admin" }), method(_void(), array(ProviderListEntrySchema).readonly()), method(object({
-	providerId: string(),
-	/**
-	* The location this config is an UNSAVED edit of, when there is one.
-	*
-	* `listLocations` replaces every declared secret with the redaction
-	* sentinel, so the edit modal's form state holds the sentinel for any
-	* credential the operator did not retype — and posting that here
-	* without a way to resolve it makes the provider try to authenticate
-	* as `__camstack_redacted__` and report the operator's own working
-	* password as wrong. Given this id, the orchestrator restores each
-	* sentinel from the stored config (same rule as `upsertLocation`)
-	* before dispatching. Omitted by the "Add location" wizard, where
-	* every value was typed just now and nothing is stored yet.
-	*/
-	locationId: string().optional(),
-	config: record(string(), unknown())
-}), object({
-	ok: boolean(),
-	error: string().optional()
-}), { auth: "admin" });
+}), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(_void(), array(StorageDrainProgressSchema).readonly());
 /** One table of the settings database. */
 var StorageTableSchema = object({
 	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
@@ -80374,13 +80256,6 @@ Object.freeze({
 		access: "delete",
 		role: "admin"
 	},
-	"llm.deleteProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"llm.generate": {
 		capName: "llm",
 		capScope: "system",
@@ -80444,20 +80319,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"llm.listProfileKinds": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"llm.listProfiles": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"llm.listRuntimeNodes": {
 		capName: "llm",
 		capScope: "system",
@@ -80465,13 +80326,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"llm.migrateRawSecrets": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"llm.resolveModelRef": {
 		capName: "llm",
 		capScope: "system",
@@ -80500,20 +80354,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"llm.testProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"llm.upsertProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"llmRuntime.appleAvailability": {
 		capName: "llm-runtime",
 		capScope: "system",
@@ -81018,13 +80858,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"meshNetwork.testConnection": {
-		capName: "mesh-network",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"meter.getStatus": {
 		capName: "meter",
 		capScope: "device",
@@ -81683,13 +81516,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.deleteTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"notificationOutput.discoverTargets": {
 		capName: "notification-output",
 		capScope: "system",
@@ -81697,13 +81523,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"notificationOutput.getTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"notificationOutput.listTargetKinds": {
 		capName: "notification-output",
 		capScope: "system",
@@ -81711,13 +81530,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"notificationOutput.listTargets": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"notificationOutput.probeTargetConfig": {
 		capName: "notification-output",
 		capScope: "system",
@@ -81732,13 +81544,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.setTargetEnabled": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"notificationOutput.testTarget": {
 		capName: "notification-output",
 		capScope: "system",
@@ -81746,13 +81551,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.upsertTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"notificationRules.activateAlarmProfile": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -82012,41 +81810,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"oidcConnections.connectionFormSchema": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"oidcConnections.createConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"oidcConnections.deleteConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
-	"oidcConnections.listConnections": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"oidcConnections.updateConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"osd.getStatus": {
 		capName: "osd",
 		capScope: "device",
@@ -85078,13 +84841,6 @@ Object.freeze({
 		access: "delete",
 		role: "admin"
 	},
-	"storage.deleteLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"storage.endDownload": {
 		capName: "storage",
 		capScope: "system",
@@ -85141,13 +84897,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"storage.listProviders": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"storage.read": {
 		capName: "storage",
 		capScope: "system",
@@ -85169,27 +84918,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"storage.testConfig": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"storage.testLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"storage.upsertLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"storage.write": {
 		capName: "storage",
 		capScope: "system",
@@ -91342,20 +91070,6 @@ object({
 });
 //#endregion
 //#region src/custom-actions.ts
-var SourceIdSchema = string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug");
-/**
-* A source as the admin list shows it. No `args`: a credential never leaves the
-* addon - `formValues` carries the redaction token where one is stored (D880).
-*/
-var WasteSourceRowSchema = object({
-	id: string(),
-	label: string(),
-	module: string(),
-	enabled: boolean(),
-	formValues: record(string(), unknown()).optional(),
-	serviceId: string().optional(),
-	countryId: string().optional()
-});
 var wasteCollectionsActions = defineCustomActions({
 	fetchNow: customAction(object({ 
 	/** When set, refresh only this configured source id; otherwise all enabled. */
@@ -91370,10 +91084,6 @@ sourceId: string().min(1).optional() }).optional(), object({
 		kind: "mutation",
 		auth: "admin"
 	}),
-	listSources: customAction(object({}), array(WasteSourceRowSchema).readonly(), {
-		kind: "mutation",
-		auth: "admin"
-	}),
 	listCountries: customAction(object({}), array(object({
 		id: string(),
 		label: string()
@@ -91391,43 +91101,6 @@ sourceId: string().min(1).optional() }).optional(), object({
 	})).readonly(), {
 		kind: "mutation",
 		auth: "admin"
-	}),
-	serviceFormSchema: customAction(object({ serviceId: string().min(1) }), unknown(), {
-		kind: "mutation",
-		auth: "admin"
-	}),
-	createSource: customAction(object({
-		/** Optional override; when omitted the id is derived from `label`. */
-		id: SourceIdSchema.optional(),
-		label: string().min(1),
-		serviceId: string().min(1),
-		args: record(string(), unknown()).default({}),
-		enabled: boolean().optional()
-	}), object({ id: string() }), {
-		kind: "mutation",
-		auth: "admin"
-	}),
-	updateSource: customAction(object({
-		id: string().min(1),
-		label: string().min(1),
-		serviceId: string().min(1).optional(),
-		args: record(string(), unknown()).optional(),
-		enabled: boolean().optional()
-	}), object({ ok: literal(true) }), {
-		kind: "mutation",
-		auth: "admin"
-	}),
-	/**
-	* D880: rewrite every legacy source (free `argsJson`) as typed `args`, moving its
-	* credentials into the keychain. Dry run unless `apply`; idempotent; counts only.
-	*/
-	migrateSources: customAction(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
-		kind: "mutation",
-		auth: "admin"
-	}),
-	deleteSource: customAction(object({ id: string().min(1) }), object({ ok: literal(true) }), {
-		kind: "mutation",
-		auth: "admin"
 	})
 });
 //#endregion
@@ -91461,33 +91134,6 @@ var WASTE_SECRET_STATE_PATHS = SECRET_ARG_KEYS.map((key) => `sources[id].args.${
 function isSecretArg(key) {
 	return SECRET_ARG_KEYS.includes(key.toLowerCase());
 }
-/** Is a credential stored for this argument (a value, or a marker the keychain could not serve)? */
-function isSet(value) {
-	return isSecretMarker(value) || typeof value === "string" && value.length > 0;
-}
-/** The arguments as a read surface may show them: a stored credential is the redaction token. */
-function redactArgs(args) {
-	const out = {};
-	for (const [key, value] of Object.entries(args)) out[key] = isSecretArg(key) && isSet(value) ? REDACTED_SECRET : value;
-	return out;
-}
-/**
-* The write-back of {@link redactArgs}: a credential sent back as the redaction
-* token means "keep what is stored", so it takes the stored (resolved) value; one
-* with nothing stored is dropped, never saved as the token.
-*/
-function restoreRedactedArgs(incoming, stored) {
-	const out = {};
-	for (const [key, value] of Object.entries(incoming)) {
-		if (isSecretArg(key) && value === "__camstack_redacted__") {
-			const previous = stored[key];
-			if (previous !== void 0) out[key] = previous;
-			continue;
-		}
-		out[key] = value;
-	}
-	return out;
-}
 /**
 * Does this argument bag hold a credential that is NOT a usable value: a MARKER the keychain did
 * not resolve, or the redaction token (a row read without its credential)? Either would reach a
@@ -91496,10 +91142,6 @@ function restoreRedactedArgs(incoming, stored) {
 function hasUnresolvedCredential(args) {
 	return Object.entries(args).some(([key, value]) => isSecretArg(key) && (isSecretMarker(value) || value === "__camstack_redacted__"));
 }
-/** Does it hold a non-empty credential (any form)? */
-function hasCredential(args) {
-	return Object.entries(args).some(([key, value]) => isSecretArg(key) && isSet(value));
-}
 //#endregion
 //#region src/waste-types.ts
 /**
@@ -91964,35 +91606,6 @@ function reportFailed(log, failures) {
 	};
 }
 //#endregion
-//#region src/source-id.ts
-/**
-* Stable calendar source ids derived from the operator label.
-* Pattern: `^[a-z0-9][a-z0-9-]{0,63}$` (max 64 chars).
-*/
-var SOURCE_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
-/** Slugify a display label into a candidate source id (may be empty). */
-function slugifySourceLabel(label) {
-	const s = label.normalize("NFKD").replace(/[\u0300-\u036f]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-	if (s.length === 0) return "";
-	return s.slice(0, 64);
-}
-/**
-* Pick an unused id from `label`. Collisions append `-2`, `-3`, …
-* (truncated so the result stays within the 64-char pattern).
-*/
-function allocateSourceId(label, existingIds) {
-	const taken = existingIds instanceof Set ? existingIds : new Set(existingIds);
-	const baseRaw = slugifySourceLabel(label);
-	const base = baseRaw.length > 0 ? baseRaw : "source";
-	if (!taken.has(base) && SOURCE_ID_PATTERN.test(base)) return base;
-	for (let n = 2; n < 1e4; n++) {
-		const suffix = `-${n}`;
-		const candidate = `${base.slice(0, Math.max(1, 64 - suffix.length)).replace(/-+$/g, "")}${suffix}`;
-		if (SOURCE_ID_PATTERN.test(candidate) && !taken.has(candidate)) return candidate;
-	}
-	throw new Error("could not allocate a unique source id");
-}
-//#endregion
 //#region src/waste-calendar-source.ts
 function startOfUtcDayMs(isoDate) {
 	const [y, m, d] = isoDate.split("-").map((p) => Number(p));
@@ -178037,6 +177650,35 @@ function mergeServiceArgs(service, formValues) {
 	return out;
 }
 //#endregion
+//#region src/source-id.ts
+/**
+* Stable calendar source ids derived from the operator label.
+* Pattern: `^[a-z0-9][a-z0-9-]{0,63}$` (max 64 chars).
+*/
+var SOURCE_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+/** Slugify a display label into a candidate source id (may be empty). */
+function slugifySourceLabel(label) {
+	const s = label.normalize("NFKD").replace(/[\u0300-\u036f]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+	if (s.length === 0) return "";
+	return s.slice(0, 64);
+}
+/**
+* Pick an unused id from `label`. Collisions append `-2`, `-3`, …
+* (truncated so the result stays within the 64-char pattern).
+*/
+function allocateSourceId(label, existingIds) {
+	const taken = existingIds instanceof Set ? existingIds : new Set(existingIds);
+	const baseRaw = slugifySourceLabel(label);
+	const base = baseRaw.length > 0 ? baseRaw : "source";
+	if (!taken.has(base) && SOURCE_ID_PATTERN.test(base)) return base;
+	for (let n = 2; n < 1e4; n++) {
+		const suffix = `-${n}`;
+		const candidate = `${base.slice(0, Math.max(1, 64 - suffix.length)).replace(/-+$/g, "")}${suffix}`;
+		if (SOURCE_ID_PATTERN.test(candidate) && !taken.has(candidate)) return candidate;
+	}
+	throw new Error("could not allocate a unique source id");
+}
+//#endregion
 //#region src/waste-source-store.ts
 /**
 * A stored body as a source. A row read while the keychain is locked still carries its markers
@@ -178540,23 +178182,13 @@ var WasteCollectionsAddon = class extends BaseAddon {
 			customActions: wasteCollectionsActions,
 			actionHandlers: {
 				fetchNow: async (input) => this.fetchNow(input),
-				listSources: async () => this.listSources(),
 				listCountries: async () => listCatalogCountries(),
 				listServices: async (input) => listCatalogServices(input.countryId).map((s) => ({
 					id: s.id,
 					label: serviceDisplayLabel(s),
 					title: s.label,
 					module: s.module
-				})),
-				serviceFormSchema: async (input) => {
-					const service = findCatalogService(input.serviceId);
-					if (!service) throw new Error(`unknown service '${input.serviceId}'`);
-					return serviceFormSchema(service);
-				},
-				createSource: async (input) => this.createSource(input),
-				updateSource: async (input) => this.updateSource(input),
-				deleteSource: async (input) => this.deleteSource(input),
-				migrateSources: async (input) => this.migrateSources(input.apply)
+				}))
 			}
 		};
 	}
@@ -178623,17 +178255,6 @@ var WasteCollectionsAddon = class extends BaseAddon {
 		if (!this.legacyServed) return records;
 		return withUnmigratedLegacyRows(records, this.parseConfigSources(this.config.sources));
 	}
-	async persistSources(sources) {
-		this.activeSources = [...sources];
-		const store = this.sourceStore;
-		if (store !== null) {
-			await store.replaceAll(sources);
-			const kept = new Set(sources.map((s) => s.id));
-			await this.pruneLegacyRows((legacyId) => kept.has(legacyId));
-			return;
-		}
-		await this.updateGlobalSettings({ sources: [...sources] });
-	}
 	/**
 	* A source deleted at the records leaves the legacy setting too, or it would reappear beside the
 	* records (while the migration is pending) or be copied back by it.
@@ -178648,195 +178269,6 @@ var WasteCollectionsAddon = class extends BaseAddon {
 		if (this.activeSources.length > 0 || this.sourceStore !== null) return this.activeSources;
 		return this.parseConfigSources(this.config.sources);
 	}
-	listSources() {
-		return this.configuredSources().map((s) => {
-			let args = {};
-			try {
-				args = sourceArgs(s);
-			} catch {
-				args = { ...s.args };
-			}
-			const matched = matchCatalogService(s.module, args);
-			const formValues = {
-				label: s.label,
-				enabled: s.enabled,
-				...redactArgs(args)
-			};
-			if (matched) for (const key of Object.keys(matched.defaultArgs)) delete formValues[key];
-			return {
-				id: s.id,
-				label: s.label,
-				module: s.module,
-				enabled: s.enabled,
-				formValues,
-				serviceId: matched?.id,
-				countryId: matched?.countryId
-			};
-		});
-	}
-	async createSource(input) {
-		const existing = this.configuredSources().map((s) => s.id);
-		let id;
-		if (input.id !== void 0) {
-			if (!SOURCE_ID_PATTERN.test(input.id)) throw new Error("id must be a lowercase slug (e.g. ics-home, junker)");
-			if (existing.includes(input.id)) throw new Error(`source '${input.id}' already exists`);
-			id = input.id;
-		} else id = allocateSourceId(input.label, existing);
-		const service = findCatalogService(input.serviceId);
-		if (!service) throw new Error(`unknown service '${input.serviceId}'`);
-		const row = WasteSourceConfigSchema.parse({
-			id,
-			label: input.label,
-			module: service.module,
-			args: this.typedArgs(mergeServiceArgs(service, restoreRedactedArgs(input.args, {}))),
-			enabled: input.enabled ?? true
-		});
-		await this.persistSources([...this.configuredSources(), row]);
-		return { id };
-	}
-	async updateSource(input) {
-		const sources = this.configuredSources();
-		const idx = sources.findIndex((s) => s.id === input.id);
-		if (idx < 0) throw new Error(`source '${input.id}' not found`);
-		const prev = sources[idx];
-		let prevArgs = {};
-		try {
-			prevArgs = sourceArgs(prev);
-		} catch {
-			prevArgs = { ...prev.args };
-		}
-		let module = prev.module;
-		let args = prevArgs;
-		if (input.serviceId !== void 0) {
-			const service = findCatalogService(input.serviceId);
-			if (!service) throw new Error(`unknown service '${input.serviceId}'`);
-			module = service.module;
-			args = mergeServiceArgs(service, restoreRedactedArgs(input.args ?? {}, prevArgs));
-		} else if (input.args !== void 0) {
-			const sent = restoreRedactedArgs(input.args, prevArgs);
-			const matched = matchCatalogService(prev.module, prevArgs);
-			args = matched ? mergeServiceArgs(matched, sent) : {
-				...prevArgs,
-				...sent
-			};
-		}
-		const next = WasteSourceConfigSchema.parse({
-			id: prev.id,
-			label: input.label,
-			module,
-			args: this.typedArgs(args),
-			enabled: input.enabled ?? prev.enabled
-		});
-		await this.persistSources(sources.map((s, i) => i === idx ? next : s));
-		return { ok: true };
-	}
-	/** Validate an argument bag against the typed value schema (a nested object is refused). */
-	typedArgs(args) {
-		const out = {};
-		for (const [key, value] of Object.entries(args)) out[key] = WasteArgValueSchema.parse(value);
-		return out;
-	}
-	/**
-	* D880: rewrite every legacy source (free `argsJson`) as typed `args`; its
-	* credentials go to the keychain through the normal save path. Then every
-	* credential is read back and compared with what the legacy row held; on any
-	* difference the legacy rows are written back, so nothing is lost. Dry run
-	* unless `apply`. Idempotent. Counts only - never an argument, a ref or an id.
-	*/
-	async migrateSources(apply) {
-		const sources = this.configuredSources();
-		const legacy = sources.filter((s) => s.argsJson !== void 0);
-		const rawRows = legacy.filter((s) => {
-			try {
-				return hasCredential(sourceArgs(s));
-			} catch {
-				return false;
-			}
-		});
-		const markerRows = sources.filter((s) => s.argsJson === void 0 && hasCredential(s.args)).length;
-		const report = (over) => ({
-			apply,
-			rows: sources.length,
-			raw: rawRows.length,
-			markers: markerRows,
-			migrated: 0,
-			failed: 0,
-			remainingRaw: rawRows.length,
-			unresolvedMarkers: this.unresolvedSecrets.length,
-			redundantCopies: legacy.length,
-			verified: rawRows.length === 0 && this.unresolvedSecrets.length === 0,
-			...over
-		});
-		if (!apply || legacy.length === 0) return report({});
-		const expected = /* @__PURE__ */ new Map();
-		const unconverted = /* @__PURE__ */ new Set();
-		const migrated = sources.map((s) => {
-			if (s.argsJson === void 0) return s;
-			try {
-				const args = sourceArgs(s);
-				const row = WasteSourceConfigSchema.parse({
-					id: s.id,
-					label: s.label,
-					module: s.module,
-					args: this.typedArgs(args),
-					enabled: s.enabled
-				});
-				expected.set(s.id, args);
-				return row;
-			} catch {
-				unconverted.add(s.id);
-				return s;
-			}
-		});
-		const failedRows = unconverted.size;
-		if (expected.size === 0) return report({
-			failed: failedRows,
-			remainingRaw: legacy.length
-		});
-		try {
-			await this.persistSources(migrated);
-		} catch {
-			return report({ failed: legacy.length });
-		}
-		const back = new Map(this.configuredSources().map((s) => [s.id, s]));
-		if (![...expected].every(([id, args]) => {
-			const row = back.get(id);
-			return row !== void 0 && row.argsJson === void 0 && JSON.stringify(sortedEntries(row.args)) === JSON.stringify(sortedEntries(args));
-		}) || this.unresolvedSecrets.length > 0) {
-			await this.rollbackMigration(sources, expected);
-			return report({ failed: legacy.length });
-		}
-		return report({
-			migrated: expected.size,
-			failed: failedRows,
-			remainingRaw: failedRows,
-			unresolvedMarkers: 0,
-			redundantCopies: legacy.length,
-			verified: failedRows === 0
-		});
-	}
-	/**
-	* Put the legacy rows back. A converted row's `args` is written as `null`, which
-	* the save path reads as "this object is gone": it deletes the keychain refs the
-	* migration created (a plain `{}` would keep them). Never throws - the report
-	* says failed either way, and the legacy JSON stays authoritative.
-	*/
-	async rollbackMigration(sources, converted) {
-		try {
-			await this.updateGlobalSettingsAsOperator({ sources: sources.map((s) => converted.has(s.id) ? {
-				...s,
-				args: null
-			} : s) });
-		} catch {
-			this.ctx.logger.error("waste-collections: the migration rollback failed - keychain refs may be orphaned (System -> Secrets)");
-		}
-	}
-	async deleteSource(input) {
-		const sources = this.configuredSources();
-		if (!sources.some((s) => s.id === input.id)) throw new Error(`source '${input.id}' not found`);
-		await this.persistSources(sources.filter((s) => s.id !== input.id));
-		return { ok: true };
-	}
 	async fetchNow(input) {
 		const targets = this.configuredSources().filter((s) => {
 			if (!s.enabled) return false;
@@ -178937,32 +178369,10 @@ var WasteCollectionsAddon = class extends BaseAddon {
 			this.ctx.logger.warn("waste-collections: cache persist failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		}
 	}
-	globalSettingsSchema() {
-		return this.schema({ sections: [{
-			id: "refresh",
-			title: "Refresh",
-			description: "Sources are managed in the table above (Add / Edit): pick a country and a service, then fill only that service’s fields. Each source becomes one calendar under System → Calendars.",
-			columns: 2,
-			fields: [{
-				type: "addon-action-button",
-				key: "_fetchNow",
-				label: "Refresh",
-				buttonLabel: "Fetch now",
-				description: "Sources refresh once at boot and then every 24 hours; this refreshes every enabled source immediately.",
-				addonId: "waste-collections",
-				action: "fetchNow",
-				variant: "primary",
-				paramsStatic: {}
-			}]
-		}] });
-	}
 };
 /** Re-parse helper for tests. */
 function parseWasteConfig(raw) {
 	return WasteConfigSchema.parse(raw);
 }
-function sortedEntries(args) {
-	return Object.entries(args).toSorted(([a], [b]) => a < b ? -1 : 1);
-}
 //#endregion
 export { WasteCollectionsAddon, WasteCollectionsAddon as default, sourceArgs as a, wasteCollectionsActions as customActions, WasteConfigSchema as i, createWasteCalendarSource as n, parseWasteConfig, DEFAULT_WASTE_CONFIG as r, collectionsToEvents as t };