@camstack/addon-waste-collections 0.1.36 → 0.1.38

package/dist/waste-collections.addon.mjs

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
-//#region ../types/dist/event-category-BmPm98n0.mjs
+//#region ../types/dist/event-category-78tcBemo.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -123,6 +123,23 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AddonLoadRecovered"] = "addon.load-recovered";
 	/**
+	* An addon is RUNNING although its installed package is below what the
+	* running server requires (`camstack.requires.addons` of the server, or the
+	* addon's own `requires.server`). Raised once per streak by the unsupported-
+	* addon tracker, on the hub and on agents; AlertCenter turns it into one
+	* operator alert per node and package. The addon is never held back for it.
+	*
+	* Payload: `{ packageName, addonId, nodeId, installedVersion, requiredMinimum, serverVersion, unmet }`.
+	*/
+	EventCategory["AddonUnsupportedVersion"] = "addon.unsupported-version";
+	/**
+	* The package of an {@link AddonUnsupportedVersion} alert reached a supported
+	* version, or is no longer installed on the node. AlertCenter dismisses the matching alert.
+	*
+	* Payload: `{ packageName, addonId, nodeId }`.
+	*/
+	EventCategory["AddonUnsupportedResolved"] = "addon.unsupported-resolved";
+	/**
 	* Monitor scheduled the next retry for a failed addon. Transient —
 	* surfaced to the UI for live-updating the "next retry in Ns"
 	* countdown on the Addons page row, NOT persisted as an alert.
@@ -233,7 +250,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["ProcessRestarted"] = "process.restarted";
 	/**
 	* The SET of storage locations changed — one was created, edited, enabled,
-	* disabled or deleted through `storage.upsertLocation` / `deleteLocation`.
+	* disabled or deleted through the location instances or the forced-delete action.
 	*
 	* Telemetry, not a transaction (D8/D11): every consumer that re-resolves on
 	* it must also converge on its own periodic path, because a dropped event
@@ -5984,7 +6001,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-D7ZKm4nb.mjs
+//#region ../types/dist/sleep-CQP-REJp.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -6079,16 +6096,6 @@ var AddonMigrationsBlockedError = class extends Error {
 		this.migrationIds = migrationIds;
 	}
 };
-/**
-* The value a redacted secret is replaced with on every read surface.
-*
-* It is also the WRITE-BACK token: an `upsertLocation` that sends this value
-* back for a key means "keep what is stored", which is what lets an operator
-* rename a location without retyping its password. A literal an operator could
-* plausibly choose as a real password would turn that convenience into a way
-* to lock yourself out, hence the sentinel shape.
-*/
-var REDACTED_SECRET = "__camstack_redacted__";
 /** Is this field's stored value a credential? */
 function isSecretConfigField(field) {
 	if (field.type === "password") return true;
@@ -6358,6 +6365,59 @@ Object.fromEntries([
 function isValuelessField(field) {
 	return field.type === "separator" || field.type === "info" || field.type === "qr-code" || field.type === "button" || field.type === "object-array" || field.type === "widget" || field.type === "addon-action-button" || field.type === "device-action-button" || field.type === "account-sign-in" || field.type === "secret-presence";
 }
+/**
+* Base collector: flatten a hydrated `ConfigUISchemaWithValues` into
+* `key → { value, default }`, recursing through `group` and `sub-tabs`
+* layout fields. Keeping `value` and `default` SEPARATE (rather than
+* pre-resolving) lets callers both read the effective value AND detect
+* overrides (`value` differs from `default`). Structural over `unknown`;
+* malformed input yields an empty map, never throws.
+*/
+function collectHydratedFieldEntries(schema) {
+	const out = /* @__PURE__ */ new Map();
+	if (typeof schema !== "object" || schema === null) return out;
+	const sections = schema.sections;
+	if (!Array.isArray(sections)) return out;
+	for (const section of sections) if (typeof section === "object" && section !== null) collectFieldEntriesInto(section.fields, out);
+	return out;
+}
+/** Recursive field walker for {@link collectHydratedFieldEntries}. */
+function collectFieldEntriesInto(fields, into) {
+	if (!Array.isArray(fields)) return;
+	for (const field of fields) {
+		if (typeof field !== "object" || field === null) continue;
+		const type = field.type;
+		if (type === "group") {
+			collectFieldEntriesInto(field.fields, into);
+			continue;
+		}
+		if (type === "sub-tabs") {
+			const tabs = field.tabs;
+			if (Array.isArray(tabs)) {
+				for (const tab of tabs) if (typeof tab === "object" && tab !== null) collectFieldEntriesInto(tab.fields, into);
+			}
+			continue;
+		}
+		const key = field.key;
+		if (typeof key !== "string" || key.length === 0) continue;
+		if (!("value" in field)) continue;
+		into.set(key, {
+			value: field.value,
+			default: field.default
+		});
+	}
+}
+/**
+* Flatten a hydrated settings payload into `key → EFFECTIVE value`
+* (`value ?? default`). The read-side inverse of `hydrateSchema` for the
+* common "just give me the resolved values" case. Built on
+* {@link collectHydratedFieldEntries}.
+*/
+function collectHydratedFieldValues(schema) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [key, entry] of collectHydratedFieldEntries(schema)) out.set(key, entry.value ?? entry.default);
+	return out;
+}
 function hydrateSchema(schema, values, options = {}) {
 	return {
 		...schema.tabs ? { tabs: [...schema.tabs] } : {},
@@ -7399,17 +7459,35 @@ var RecordIntegrationInstances = class {
 			...kind !== void 0 ? { kind } : {}
 		});
 		if (minted === void 0) throw new Error("createInstance needs an id: this provider does not mint one");
+		const initial = this.hooks.initialBody(name, kind);
+		const patch = this.patchOf(values ?? {});
+		if (Object.keys(patch).length > 0) Object.assign(patch, await this.hooks.validateWrite?.({
+			kind,
+			body: {
+				...initial,
+				...patch
+			}
+		}));
 		await this.handle.put({
 			id: minted,
-			data: this.hooks.initialBody(name, kind)
+			data: initial
 		}, { ifRev: 0 });
-		const patch = this.patchOf(values ?? {});
 		if (Object.keys(patch).length > 0) await this.handle.patch(minted, patch);
 		await this.hooks.onChanged?.(minted, "created");
 		return { id: minted };
 	};
 	updateInstance = async ({ id, name, values }) => {
 		const patch = this.patchOf(values);
+		if (this.hooks.validateWrite !== void 0 && Object.keys(patch).length > 0) {
+			const stored = await this.handle.get(id);
+			if (stored !== null) Object.assign(patch, await this.hooks.validateWrite({
+				kind: void 0,
+				body: {
+					...stored.data,
+					...patch
+				}
+			}));
+		}
 		if (name !== void 0) patch[this.nameField] = name;
 		await this.handle.patch(id, patch);
 		await this.hooks.onChanged?.(id, "updated");
@@ -7720,6 +7798,21 @@ var SCOPED_SETTINGS_SCOPES = [
 	"device-defaults",
 	"node"
 ];
+/** The one refusal of a key a scope did not declare. */
+function assertDeclaredKeys(keys, declared) {
+	const undeclared = keys.filter((key) => !declared.has(key));
+	if (undeclared.length > 0) throw new Error(`scoped settings: [${undeclared.join(", ")}] not declared for this scope (declared: [${[...declared].join(", ")}])`);
+}
+/** Build the handle over an addon's scoped read, write and unset. */
+function createScopedSettings(deps) {
+	return {
+		async get() {
+			return deps.schema.parse(await deps.read());
+		},
+		patch: (patch) => deps.write(Object.fromEntries(Object.entries(patch))),
+		unset: (keys) => deps.unset(keys)
+	};
+}
 /** A write to a secret path could not be stored in the keychain, so it was refused. */
 var KeychainWriteRefusedError = class extends Error {
 	fieldPath;
@@ -8295,7 +8388,16 @@ function createHandle(raw, opts) {
 				return blob;
 			}
 		},
-		writeAddonStore: writeAddon
+		writeAddonStore: writeAddon,
+		removeClearedKeys: (keys) => serialize("addon", async () => {
+			const stored = await readStoredAddonBlob(raw);
+			index.seen("addon", stored);
+			const removable = keys.filter((key) => collectSecretMarkerRefs(stored[key]).length === 0);
+			if (removable.length === 0) return;
+			const patch = Object.fromEntries(removable.map((key) => [key, void 0]));
+			await raw.writeAddonStore(patch);
+			index.wrote("addon", patch);
+		})
 	};
 }
 /** The context the addon sees, plus the private raw view and write outcome. */
@@ -8840,6 +8942,151 @@ var BaseAddon = class {
 		}
 	}
 	/**
+	* Hook: values layered over the stored ones when the FORM of one scope is served
+	* ({@link getScopedSettings}) — a preview that derives dependent options without writing.
+	* Never applied to {@link ScopedSettings.get} or to a write. `null` ⇒ no overlay.
+	*/
+	async scopedSettingsOverlay(_scope, _cap, _nodeId) {
+		return null;
+	}
+	/**
+	* Hook: a write of one scope changed stored values (not called when the store reports no change,
+	* e.g. the write-back of a stored secret). `keys` are the bare field keys of the write, node keys included.
+	*/
+	async onScopedSettingsChanged(_scope, _cap, _keys) {}
+	/** Typed handle over the CLUSTER settings `cap` declares (`clusterSettingsSchema`). */
+	clusterSettings(cap, schema) {
+		return this.scopedHandle("cluster", cap, schema);
+	}
+	/** Typed handle over the fleet defaults of the per-device settings `cap` declares. */
+	deviceDefaults(cap, schema) {
+		return this.scopedHandle("device-defaults", cap, schema);
+	}
+	/**
+	* Typed handle over the settings `cap` owns PER NODE. `nodeId` omitted ⇒ the local node. A node
+	* with no row yields the schema defaults — never a bare-key fallback.
+	*/
+	nodeSettings(cap, schema, nodeId) {
+		return this.scopedHandle("node", cap, schema, nodeId);
+	}
+	/**
+	* {@link state} for a value that is kept per node: stored under `<key>@<nodeId>`, and the
+	* settings store carries `nodeId` in the row data (D986 §1), so a forgotten node's rows go in one
+	* central delete. `nodeId` omitted ⇒ the local node.
+	*/
+	nodeState(key, schema, fallback, nodeId) {
+		this._declaredStateKeys.add(key);
+		return createDurableState({
+			key: nodeScopedKey(key, nodeId ?? this._ctx?.kernel?.localNodeId ?? ""),
+			schema,
+			fallback,
+			read: async () => this.resolveStoredSecrets(await this.readAddonStoreWithRetry()),
+			write: async (patch) => {
+				await this._ctx?.settings?.writeAddonStore(patch);
+			},
+			onParseError: (k, e) => this._ctx?.logger?.warn?.(`durable-state: stored "${k}" failed validation — using fallback`, { meta: {
+				addonId: this._ctx?.id,
+				key: k,
+				error: String(e)
+			} })
+		});
+	}
+	/** The loaded schema `cap` declares for `scope`, or `null`. */
+	async declaredScopedSchema(scope, cap) {
+		await this.loadScopedSchemas(cap);
+		return this.loadedScopedSchemas(cap).find((entry) => entry.scope === scope)?.schema ?? null;
+	}
+	async requireScopedSchema(scope, cap) {
+		const schema = await this.declaredScopedSchema(scope, cap);
+		if (schema === null) throw new Error(`${this.constructor.name}: cap "${cap}" declares no ${scope} settings`);
+		return schema;
+	}
+	scopedKeys(schema) {
+		return new Set(schema.sections.flatMap((section) => collectValueFieldKeys(section.fields)));
+	}
+	/** `store` narrowed to the keys `schema` declares. */
+	narrowToScope(store, schema) {
+		const keys = this.scopedKeys(schema);
+		return Object.fromEntries(Object.entries(store).filter(([key]) => keys.has(key)));
+	}
+	scopedHandle(scope, cap, schema, nodeId) {
+		return createScopedSettings({
+			schema,
+			read: async () => {
+				const declared = await this.requireScopedSchema(scope, cap);
+				const stored = this.narrowToScope(await this.resolveGlobalStore(nodeId, cap), declared);
+				const effective = collectHydratedFieldValues(hydrateSchema(declared, stored));
+				return {
+					...Object.fromEntries([...effective].filter(([, value]) => value !== void 0)),
+					...stored
+				};
+			},
+			write: (patch) => this.writeScoped(scope, cap, patch, nodeId),
+			unset: (keys) => this.unsetScoped(scope, cap, keys, nodeId)
+		});
+	}
+	/** The one write path of the scoped API: declared keys only, then the global patch. */
+	async writeScoped(scope, cap, patch, nodeId) {
+		assertDeclaredKeys(Object.keys(patch), this.scopedKeys(await this.requireScopedSchema(scope, cap)));
+		if (await this.applyGlobalPatch(patch, scope === "node" ? nodeId : void 0, cap)) await this.onScopedSettingsChanged(scope, cap, Object.keys(patch));
+	}
+	/**
+	* Remove declared keys of one scope. A secret goes through {@link clearSecrets} — its keychain
+	* value is released exactly as there — and the emptied row is then removed; every other key is
+	* removed by an `undefined` patch (which a secret transform would read as "keep").
+	*/
+	async unsetScoped(scope, cap, keys, nodeId) {
+		assertDeclaredKeys(keys, this.scopedKeys(await this.requireScopedSchema(scope, cap)));
+		const target = scope === "node" ? nodeId : void 0;
+		const tree = this.addonSecretTree();
+		const secretKeys = keys.filter((key) => tree.has(key));
+		const plainKeys = keys.filter((key) => !tree.has(key));
+		let changed = false;
+		if (plainKeys.length > 0) {
+			const patch = Object.fromEntries(plainKeys.map((key) => [key, void 0]));
+			changed = await this.applyGlobalPatch(patch, target, cap) || changed;
+		}
+		if (secretKeys.length > 0) {
+			await this.clearSecretKeys(secretKeys, target, cap);
+			const node = normalizeNodeId(target ?? this._ctx?.kernel?.localNodeId);
+			const rows = secretKeys.map((key) => scope === "node" ? nodeScopedKey(key, node) : key);
+			if (this._secretSettings !== null) await this._secretSettings.removeClearedKeys(rows);
+			else await this._ctx?.settings?.writeAddonStore(Object.fromEntries(rows.map((row) => [row, void 0])));
+			changed = true;
+		}
+		if (changed) await this.onScopedSettingsChanged(scope, cap, [...keys]);
+	}
+	/**
+	* The hydrated form of one scope of one capability's settings (any
+	* {@link scopedSettingsOverlay} applied), or `null` when the capability declares nothing there.
+	*/
+	async getScopedSettings(scope, cap, nodeId) {
+		const schema = await this.declaredScopedSchema(scope, cap);
+		if (schema === null) return null;
+		const stored = this.narrowToScope(await this.readRawProjectedStore(nodeId, cap), schema);
+		const overlay = await this.scopedSettingsOverlay(scope, cap, nodeId);
+		return hydrateSchema(schema, overlay ? await this.overlayKeepingMarkers(stored, overlay) : stored, { inlineSecretsAsViews: true });
+	}
+	/** The OPERATOR's write of declared keys of one scope (D787 secret semantics). */
+	async updateScopedSettings(scope, cap, patch, nodeId) {
+		this._operatorWriteDepth++;
+		try {
+			await this.writeScoped(scope, cap, patch, nodeId);
+		} finally {
+			this._operatorWriteDepth--;
+		}
+	}
+	/**
+	* The effective values (`stored ?? default`) of one scope, a secret as its `set` view — never
+	* its value. `null` when the capability declares nothing for the scope.
+	*/
+	async readScopedValues(scope, cap, nodeId) {
+		const schema = await this.declaredScopedSchema(scope, cap);
+		if (schema === null) return null;
+		const form = hydrateSchema(schema, this.narrowToScope(await this.readRawProjectedStore(nodeId, cap), schema), { inlineSecretsAsViews: true });
+		return Object.fromEntries([...collectHydratedFieldValues(form)].filter(([, value]) => value !== void 0));
+	}
+	/**
 	* What the create wizard and the integration edit page render for one instance: the addon's
 	* per-instance schema when it declares one, else its global schema (what they always showed).
 	*/
@@ -8991,6 +9238,9 @@ var BaseAddon = class {
 	* a keychain (an older kernel) it writes `''`, as such code always did.
 	*/
 	async clearSecrets(keys, nodeId) {
+		await this.clearSecretKeys(keys, nodeId);
+	}
+	async clearSecretKeys(keys, nodeId, cap) {
 		const tree = this.addonSecretTree();
 		const keychain = this._ctx?.secrets !== void 0;
 		const stored = keychain ? await this.readAddonStoreWithRetry() : {};
@@ -9003,25 +9253,27 @@ var BaseAddon = class {
 			const keychainStored = tree.has(key) || collectSecretMarkerRefs(stored[key]).length > 0;
 			patch[key] = keychain && keychainStored ? SECRET_CLEAR : "";
 		}
-		await this.applyGlobalPatch(patch, nodeId);
+		await this.applyGlobalPatch(patch, nodeId, cap);
 	}
-	async applyGlobalPatch(barePatch, nodeId) {
-		await this.loadScopedSchemas();
-		const keys = this.perNodeKeys();
+	/** Resolves `true` when the write changed stored values. */
+	async applyGlobalPatch(barePatch, nodeId, cap) {
+		await this.loadScopedSchemas(cap);
+		const keys = this.perNodeKeys(cap);
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
 		const scoped = keys.size > 0 ? scopePatch(barePatch, keys, target) : barePatch;
 		const handle = this._secretSettings;
 		if (handle !== null) {
 			const { changed } = await handle.writeAddonStore(scoped);
-			if (!changed) return;
+			if (!changed) return false;
 		} else await this._ctx?.settings?.writeAddonStore(scoped);
-		if (target !== localNode) return;
+		if (target !== localNode) return true;
 		await this.resolveConfig();
 		await this.onConfigChanged();
 		this.emitLifecycle(EventCategory.AddonUpdated, { level: "global" });
 		const legacy = this.globalSettingsSchema();
 		this.maybeAutoRestart(Object.keys(barePatch), [...legacy === null ? [] : [legacy], ...this.loadedScopedSchemas().map((entry) => entry.schema)]);
+		return true;
 	}
 	/**
 	* The set of field keys the global settings schema declares `perNode: true`
@@ -10773,7 +11025,6 @@ var CAP_NAMES = Object.freeze([
 	"notifier",
 	"numeric-sensor",
 	"oauth-integration",
-	"oidc-connections",
 	"osd",
 	"osd-manager",
 	"pet-feeder",
@@ -12665,8 +12916,7 @@ Object.freeze({
 	"device-provider": { "reloadDevice": 18e4 },
 	"llm": {
 		"generate": 6e5,
-		"generateVision": 6e5,
-		"testProfile": 6e5
+		"generateVision": 6e5
 	},
 	"llm-runtime": {
 		"complete": 6e5,
@@ -14069,17 +14319,18 @@ var IntegrationInstanceRefSchema = object({
 * message to what the kind supports — callers never special-case a service.
 *
 * DESIGN DECISIONS (locked):
-*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
-*    `setTargetEnabled`), each provider persisting via the `settings-store`
-*    cap. Rationale: the admin UI needs one uniform surface across the
-*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
-*    alternative would fork the UI per addon and cannot host the
-*    discovery→adopt flow.
-*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
-*    the generated cap-mount auto-`concatCollection`-fans them across every
-*    registered provider (notifiers addon + HA addon) so one catalog is
-*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
-*    `addonId` the generated collection router extracts from the call input.
+*  - A target is an INSTANCE of this function cap (epic #440, step 6): the
+*    providers serve their targets as `integration-instances` records, one
+*    record kind per target kind, and the admin lists, adds, edits, switches
+*    and deletes them through that cap. This cap keeps what an instance cannot
+*    say: the kind catalogue (`listTargetKinds`: capabilities, delivery
+*    parameters, brand icon), dispatch (`send`, `testTarget`) and the form
+*    helpers (`discoverTargets`, `probeTargetConfig`).
+*  - `listTargetKinds` / `discoverTargets` return arrays → the generated
+*    cap-mount auto-`concatCollection`-fans them across every registered
+*    provider so one catalog is routable. `send` / `testTarget` /
+*    `probeTargetConfig` route to ONE provider by the `addonId` the generated
+*    collection router extracts from the call input.
 *  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
 *    transformer) + UDS MsgPack both round-trip typed arrays — already used by
 *    `storage` / `storage-provider` / `recording` caps over the same path. No
@@ -14324,7 +14575,7 @@ var TargetKindCapsSchema = object({
 * the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough$4 = unknown();
+var ConfigSchemaPassthrough$3 = unknown();
 var TargetKindSchema = object({
 	kind: string(),
 	label: string(),
@@ -14361,7 +14612,7 @@ var TargetKindSchema = object({
 	* its raster path, which is the safe default for an unknown image.
 	*/
 	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough$4,
+	configSchema: ConfigSchemaPassthrough$3,
 	/**
 	* The config keys that decide WHERE this kind's secrets are sent (server,
 	* base URL, instance, chat, recipient). A save that changes any of them
@@ -14383,9 +14634,11 @@ var TargetKindSchema = object({
 	caps: TargetKindCapsSchema
 });
 /**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
+* A target as a provider's own code sees it (the notification-center bridge, the
+* send path): the flat record body split into the name, the switch and the
+* kind's fields. `config` holds secrets; a reader that serves it to a client
+* REDACTS secret fields (a presence marker only) — never round-trip a stored
+* secret to the UI.
 */
 var TargetSchema = object({
 	id: string(),
@@ -14428,13 +14681,13 @@ var ProbeTargetConfigResultSchema = object({
 	stateInstance: string().optional(),
 	error: string().optional()
 });
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({ targetId: string() }), TargetSchema, { auth: "admin" }), method(object({
+method(object({}), array(TargetKindSchema)), method(object({
 	kind: string(),
 	config: record(string(), unknown()).optional(),
 	/**
 	* When editing / duplicating, the blank password field never round-trips
 	* the stored token. Pass the source target id so the provider can restore
-	* secrets server-side before dialling (same merge as upsert).
+	* secrets server-side before dialling.
 	*/
 	targetId: string().optional()
 }), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
@@ -14457,27 +14710,6 @@ method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSche
 }), TestResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	target: TargetSchema,
-	/**
-	* Duplicate flow: create a NEW target id while copying secrets from an
-	* existing row. The UI never holds the stored token; blank / redacted
-	* password fields are restored from this source (D634 still applies if
-	* destinations diverge without a re-typed secret).
-	*/
-	cloneSecretsFrom: string().optional()
-}), TargetSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ targetId: string() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	enabled: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
 });
 looseObject({
 	name: string().min(1),
@@ -22735,7 +22967,6 @@ var SYSTEM_CAP_VOCABULARY = {
 	"notification-output": system("notification delivery — reached through notifier devices and rules"),
 	"notification-rules": system("notification rules — authored on their own page"),
 	"oauth-integration": system(IDENTITY),
-	"oidc-connections": system(IDENTITY),
 	"osd-manager": system(PIPELINE),
 	"pipeline-executor": system(PIPELINE),
 	"pipeline-orchestrator": system(PIPELINE),
@@ -44877,6 +45108,8 @@ var SettingsSchemaWithValuesSchema = object({
 });
 /** Patch object — keys are field names, values are the new field values. */
 var SettingsPatchSchema = record(string(), unknown());
+/** The scope of a scoped-settings call (D986): where the capability declared the values. */
+var ScopedSettingsScopeSchema = _enum(SCOPED_SETTINGS_SCOPES);
 /** Standard success response for update operations. */
 var SettingsUpdateResultSchema = object({ success: literal(true) });
 method(object({
@@ -44892,6 +45125,25 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
+	addonId: string(),
+	cap: string(),
+	scope: ScopedSettingsScopeSchema,
+	nodeId: string().optional()
+}), SettingsSchemaWithValuesSchema.nullable()), method(object({
+	addonId: string(),
+	cap: string(),
+	scope: ScopedSettingsScopeSchema,
+	nodeId: string().optional(),
+	patch: SettingsPatchSchema
+}), SettingsUpdateResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	addonId: string(),
+	cap: string(),
+	scope: ScopedSettingsScopeSchema,
+	nodeId: string().optional()
+}), record(string(), unknown()).nullable()), method(object({
 	addonId: string(),
 	nodeId: string().optional()
 }), SettingsSchemaWithValuesSchema.nullable()), method(object({
@@ -54423,7 +54675,7 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 * or the redaction token KEEPS the stored secret; `{ $secretClear: true }`
 * clears it.
 */
-var ConfigSchemaPassthrough$3 = custom();
+var ConfigSchemaPassthrough$2 = custom();
 var IntegrationInstanceIdSchema = string().min(1);
 var IntegrationInstanceModeSchema = _enum(["single", "multiple"]);
 /**
@@ -54469,7 +54721,16 @@ var IntegrationInstanceKindSchema = object({
 	/** Relative hub path to start an interactive account link of an instance of this kind. */
 	connectPath: string().min(1).optional(),
 	/** Relative hub path to disconnect that account. */
-	disconnectPath: string().min(1).optional()
+	disconnectPath: string().min(1).optional(),
+	/**
+	* Parts of the edit dialog the flat form cannot draw (a node picker, a model source), named by a
+	* GENERIC widget id the client maps to a component; a client that knows none of them shows none.
+	* `connection` widgets write connection values, `model` widgets own the model choice.
+	*/
+	widgets: array(object({
+		id: string().min(1),
+		placement: _enum(["connection", "model"])
+	})).optional()
 });
 /**
 * How devices of an instance are found. `none`: the operator adds them by hand; `lan`: the addon
@@ -54574,7 +54835,7 @@ var integrationInstancesCapability = {
 			id: IntegrationInstanceIdSchema.nullable(),
 			/** The kind of the create form (`id: null`) of a provider with several. */
 			kind: string().min(1).optional()
-		}), ConfigSchemaPassthrough$3, { auth: "admin" }),
+		}), ConfigSchemaPassthrough$2, { auth: "admin" }),
 		listInstances: method(_void(), array(IntegrationInstanceSchema).readonly(), { auth: "admin" }),
 		getInstance: method(object({ id: IntegrationInstanceIdSchema }), IntegrationInstanceSchema.nullable(), { auth: "admin" }),
 		/**
@@ -55525,12 +55786,12 @@ var LlmModelInfoSchema = object({
 });
 /**
 * The provider-specific part of a profile, validated by the provider that owns
-* the kind (`upsertProfile` refuses what it does not accept). A field its
+* the kind (saving an instance refuses what it does not accept). A field its
 * `connectionSchema` declares `type: 'password'` is a secret: it is held in the
 * keychain, never in the row, and reads back as the redaction marker.
 */
 var LlmProviderConfigSchema = record(string(), unknown());
-var LlmProfileSchema = object({
+object({
 	id: string(),
 	name: string(),
 	/** The provider-declared kind (`LlmProfileKindDescriptor.kind`). */
@@ -55624,8 +55885,8 @@ var LlmProviderWidgetSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$2 = unknown();
-var LlmProfileKindDescriptorSchema = object({
+var ConfigSchemaPassthrough$1 = unknown();
+object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	/** A generic icon name (`cloud`, `plug`, `cpu`) — never a glyph or a logo. */
@@ -55633,9 +55894,9 @@ var LlmProfileKindDescriptorSchema = object({
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
 	/** The provider's own fields (`providerConfig`); `password` fields are keychain-held. */
-	connectionSchema: ConfigSchemaPassthrough$2,
+	connectionSchema: ConfigSchemaPassthrough$1,
 	/** Provider fields that belong under "Advanced" (extra headers, runtime tuning). */
-	advancedSchema: ConfigSchemaPassthrough$2.optional(),
+	advancedSchema: ConfigSchemaPassthrough$1.optional(),
 	/** The kind's defaults; a model from `listModels` may override any of them. */
 	features: LlmModelFeaturesSchema,
 	/** `false` = the provider stamps `supportsVision` itself (from what a node reports). */
@@ -55764,20 +56025,7 @@ method(LlmGenerateBaseInputSchema, LlmGenerateResultSchema, {
 }), method(object({
 	addonId: string().optional(),
 	requestId: string()
-}), _void(), { kind: "mutation" }), method(object({}), array(LlmProfileKindDescriptorSchema)), method(object({}), array(LlmProfileSchema)), method(object({ profile: LlmProfileSchema }), LlmProfileSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(ProfileRefInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(ProfileRefInputSchema, LlmGenerateResultSchema, {
-	kind: "mutation",
-	auth: "admin",
-	timeoutMs: AI_CAP_TRANSPORT_TIMEOUT_MS
-}), method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
+}), _void(), { kind: "mutation" }), method(LlmListModelsInputSchema, LlmListModelsResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), array(LlmDefaultSchema)), method(object({
@@ -56772,20 +57020,7 @@ method(_void(), MeshStatusSchema), method(object({
 /** Optional hostname override the host should advertise once joined. */
 hostname: string().optional() }), object({ 
 /** Authentication URL the operator should open in a browser. */
-loginUrl: string() }), { kind: "mutation" }), method(_void(), object({ left: literal(true) }), { kind: "mutation" }), method(_void(), object({ loggedOut: literal(true) }), { kind: "mutation" }), method(_void(), object({ peers: array(MeshPeerSchema).readonly() })), method(object({ 
-/** Optional auth key — when provided, probes the key validity
-*  against the provider's API. Omit when already joined to
-*  just ping the daemon. */
-authKey: string().optional() }), object({
-	ok: boolean(),
-	/** Provider-side identifier resolved by the probe (tailnet
-	*  name for Tailscale, network id for ZeroTier, etc.). */
-	tenant: string().optional(),
-	/** Daemon binary version, when reachable. */
-	daemonVersion: string().optional(),
-	/** Human-readable error when `ok: false`. */
-	error: string().optional()
-}), { kind: "mutation" });
+loginUrl: string() }), { kind: "mutation" }), method(_void(), object({ left: literal(true) }), { kind: "mutation" }), method(_void(), object({ loggedOut: literal(true) }), { kind: "mutation" }), method(_void(), object({ peers: array(MeshPeerSchema).readonly() }));
 object({
 	value: number().nullable().meta(readingMeta("device", { label: "Total" })),
 	lastFetchedAt: number()
@@ -66443,61 +66678,6 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
-* `oidc-connections` — CRUD for IdP rows under `auth-oidc` (D828 sibling).
-*
-* One hub-only singleton (`auth-oidc`). The Settings UI is a DataTable +
-* ItemFormDialog; there is no `editable-array` in `globalSettingsSchema`.
-* Operator-chosen `id` is the URL slug (`/addon/auth-oidc/<id>/…`) and is
-* immutable after create.
-*/
-var ConfigSchemaPassthrough$1 = unknown();
-var OidcConnectionSchema = object({
-	id: string().min(1),
-	displayName: string(),
-	icon: string(),
-	issuerUrl: string(),
-	clientId: string(),
-	/** Client id + secret present — never the secret value. */
-	configured: boolean(),
-	/**
-	* Values for the connection form schema. `clientSecret` is a keychain
-	* {@link SecretFieldView} or `null` / `''`, never plaintext (D789).
-	*/
-	formValues: record(string(), unknown()).optional()
-});
-/**
-* Patch one connection. Omitted or empty `clientSecret` keeps the stored
-* secret (D787). `{ $secretClear: true }` clears it. `id` is never renamed.
-*/
-var OidcConnectionUpdateInputSchema = object({
-	id: string().min(1),
-	displayName: string().min(1),
-	icon: string().optional(),
-	issuerUrl: string().optional(),
-	clientId: string().optional(),
-	clientSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
-	redirectUri: string().optional(),
-	scopes: string().optional(),
-	usernameClaim: _enum([
-		"preferred_username",
-		"email",
-		"sub"
-	]).optional()
-});
-method(object({}), ConfigSchemaPassthrough$1, { auth: "admin" }), method(object({}), array(OidcConnectionSchema).readonly(), { auth: "admin" }), method(object({
-	id: string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug"),
-	displayName: string().min(1)
-}), object({ id: string() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(OidcConnectionUpdateInputSchema, object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ id: string().min(1) }), object({ ok: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-});
-/**
 * Generic on-screen-display (video overlay) cap. Each camera exposes
 * a firmware-defined list of overlays (channel name, timestamp,
 * watermark, logo, …); the cap models them as a homogeneous array of
@@ -72670,21 +72850,6 @@ method(object({
 	*/
 	ttlSec: union([number().int().positive(), literal("never")]).optional()
 }), object({ token: string() }), { auth: "admin" }), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable(), { auth: "admin" });
-var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object({
-	providerId: string().min(1),
-	displayName: string().min(1),
-	configSchema: unknown(),
-	nodeLocal: boolean(),
-	shouldSaveDiskSpace: literal(true),
-	minFreePercent: number().min(0).max(100)
-}), object({
-	providerId: string().min(1),
-	displayName: string().min(1),
-	configSchema: unknown(),
-	nodeLocal: boolean(),
-	shouldSaveDiskSpace: literal(false),
-	minFreePercent: literal(null)
-})]);
 method(object({
 	location: StorageLocationRefSchema,
 	relativePath: string()
@@ -72746,42 +72911,7 @@ method(object({
 }), _instanceof(Uint8Array), { auth: "admin" }), method(object({ downloadId: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
-	createdAt: true,
-	updatedAt: true
-}), StorageLocationSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	id: string(),
-	force: boolean().optional()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), array(StorageDrainProgressSchema).readonly()), method(object({ id: string() }), object({
-	ok: boolean(),
-	error: string().optional()
-}), { auth: "admin" }), method(_void(), array(ProviderListEntrySchema).readonly()), method(object({
-	providerId: string(),
-	/**
-	* The location this config is an UNSAVED edit of, when there is one.
-	*
-	* `listLocations` replaces every declared secret with the redaction
-	* sentinel, so the edit modal's form state holds the sentinel for any
-	* credential the operator did not retype — and posting that here
-	* without a way to resolve it makes the provider try to authenticate
-	* as `__camstack_redacted__` and report the operator's own working
-	* password as wrong. Given this id, the orchestrator restores each
-	* sentinel from the stored config (same rule as `upsertLocation`)
-	* before dispatching. Omitted by the "Add location" wizard, where
-	* every value was typed just now and nothing is stored yet.
-	*/
-	locationId: string().optional(),
-	config: record(string(), unknown())
-}), object({
-	ok: boolean(),
-	error: string().optional()
-}), { auth: "admin" });
+}), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(_void(), array(StorageDrainProgressSchema).readonly());
 /** One table of the settings database. */
 var StorageTableSchema = object({
 	/** The table's full name, e.g. `recorder:addon-settings` or `addon-device-settings`. */
@@ -76902,6 +77032,20 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"addonSettings.getScopedSettings": {
+		capName: "addon-settings",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"addonSettings.readScopedValues": {
+		capName: "addon-settings",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"addonSettings.unsetStoredSettingsKeys": {
 		capName: "addon-settings",
 		capScope: "system",
@@ -76923,6 +77067,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"addonSettings.updateScopedSettings": {
+		capName: "addon-settings",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"addonWidgets.listWidgets": {
 		capName: "addon-widgets",
 		capScope: "system",
@@ -80374,13 +80525,6 @@ Object.freeze({
 		access: "delete",
 		role: "admin"
 	},
-	"llm.deleteProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"llm.generate": {
 		capName: "llm",
 		capScope: "system",
@@ -80444,20 +80588,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"llm.listProfileKinds": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"llm.listProfiles": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"llm.listRuntimeNodes": {
 		capName: "llm",
 		capScope: "system",
@@ -80465,13 +80595,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"llm.migrateRawSecrets": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"llm.resolveModelRef": {
 		capName: "llm",
 		capScope: "system",
@@ -80500,20 +80623,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"llm.testProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"llm.upsertProfile": {
-		capName: "llm",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"llmRuntime.appleAvailability": {
 		capName: "llm-runtime",
 		capScope: "system",
@@ -81018,13 +81127,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"meshNetwork.testConnection": {
-		capName: "mesh-network",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"meter.getStatus": {
 		capName: "meter",
 		capScope: "device",
@@ -81683,13 +81785,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.deleteTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"notificationOutput.discoverTargets": {
 		capName: "notification-output",
 		capScope: "system",
@@ -81697,13 +81792,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"notificationOutput.getTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"notificationOutput.listTargetKinds": {
 		capName: "notification-output",
 		capScope: "system",
@@ -81711,13 +81799,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"notificationOutput.listTargets": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"notificationOutput.probeTargetConfig": {
 		capName: "notification-output",
 		capScope: "system",
@@ -81732,13 +81813,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.setTargetEnabled": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"notificationOutput.testTarget": {
 		capName: "notification-output",
 		capScope: "system",
@@ -81746,13 +81820,6 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
-	"notificationOutput.upsertTarget": {
-		capName: "notification-output",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"notificationRules.activateAlarmProfile": {
 		capName: "notification-rules",
 		capScope: "system",
@@ -82012,41 +82079,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"oidcConnections.connectionFormSchema": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"oidcConnections.createConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
-	"oidcConnections.deleteConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
-	"oidcConnections.listConnections": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"oidcConnections.updateConnection": {
-		capName: "oidc-connections",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"osd.getStatus": {
 		capName: "osd",
 		capScope: "device",
@@ -85078,13 +85110,6 @@ Object.freeze({
 		access: "delete",
 		role: "admin"
 	},
-	"storage.deleteLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "delete",
-		role: "admin"
-	},
 	"storage.endDownload": {
 		capName: "storage",
 		capScope: "system",
@@ -85141,13 +85166,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"storage.listProviders": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
 	"storage.read": {
 		capName: "storage",
 		capScope: "system",
@@ -85169,27 +85187,6 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
-	"storage.testConfig": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"storage.testLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view",
-		role: "admin"
-	},
-	"storage.upsertLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "create",
-		role: "admin"
-	},
 	"storage.write": {
 		capName: "storage",
 		capScope: "system",
@@ -91342,20 +91339,6 @@ object({
 });
 //#endregion
 //#region src/custom-actions.ts
-var SourceIdSchema = string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug");
-/**
-* A source as the admin list shows it. No `args`: a credential never leaves the
-* addon - `formValues` carries the redaction token where one is stored (D880).
-*/
-var WasteSourceRowSchema = object({
-	id: string(),
-	label: string(),
-	module: string(),
-	enabled: boolean(),
-	formValues: record(string(), unknown()).optional(),
-	serviceId: string().optional(),
-	countryId: string().optional()
-});
 var wasteCollectionsActions = defineCustomActions({
 	fetchNow: customAction(object({ 
 	/** When set, refresh only this configured source id; otherwise all enabled. */
@@ -91370,10 +91353,6 @@ sourceId: string().min(1).optional() }).optional(), object({
 		kind: "mutation",
 		auth: "admin"
 	}),
-	listSources: customAction(object({}), array(WasteSourceRowSchema).readonly(), {
-		kind: "mutation",
-		auth: "admin"
-	}),
 	listCountries: customAction(object({}), array(object({
 		id: string(),
 		label: string()
@@ -91391,43 +91370,6 @@ sourceId: string().min(1).optional() }).optional(), object({
 	})).readonly(), {
 		kind: "mutation",
 		auth: "admin"
-	}),
-	serviceFormSchema: customAction(object({ serviceId: string().min(1) }), unknown(), {
-		kind: "mutation",
-		auth: "admin"
-	}),
-	createSource: customAction(object({
-		/** Optional override; when omitted the id is derived from `label`. */
-		id: SourceIdSchema.optional(),
-		label: string().min(1),
-		serviceId: string().min(1),
-		args: record(string(), unknown()).default({}),
-		enabled: boolean().optional()
-	}), object({ id: string() }), {
-		kind: "mutation",
-		auth: "admin"
-	}),
-	updateSource: customAction(object({
-		id: string().min(1),
-		label: string().min(1),
-		serviceId: string().min(1).optional(),
-		args: record(string(), unknown()).optional(),
-		enabled: boolean().optional()
-	}), object({ ok: literal(true) }), {
-		kind: "mutation",
-		auth: "admin"
-	}),
-	/**
-	* D880: rewrite every legacy source (free `argsJson`) as typed `args`, moving its
-	* credentials into the keychain. Dry run unless `apply`; idempotent; counts only.
-	*/
-	migrateSources: customAction(RawSecretMigrationInputSchema, RawSecretMigrationReportSchema, {
-		kind: "mutation",
-		auth: "admin"
-	}),
-	deleteSource: customAction(object({ id: string().min(1) }), object({ ok: literal(true) }), {
-		kind: "mutation",
-		auth: "admin"
 	})
 });
 //#endregion
@@ -91461,33 +91403,6 @@ var WASTE_SECRET_STATE_PATHS = SECRET_ARG_KEYS.map((key) => `sources[id].args.${
 function isSecretArg(key) {
 	return SECRET_ARG_KEYS.includes(key.toLowerCase());
 }
-/** Is a credential stored for this argument (a value, or a marker the keychain could not serve)? */
-function isSet(value) {
-	return isSecretMarker(value) || typeof value === "string" && value.length > 0;
-}
-/** The arguments as a read surface may show them: a stored credential is the redaction token. */
-function redactArgs(args) {
-	const out = {};
-	for (const [key, value] of Object.entries(args)) out[key] = isSecretArg(key) && isSet(value) ? REDACTED_SECRET : value;
-	return out;
-}
-/**
-* The write-back of {@link redactArgs}: a credential sent back as the redaction
-* token means "keep what is stored", so it takes the stored (resolved) value; one
-* with nothing stored is dropped, never saved as the token.
-*/
-function restoreRedactedArgs(incoming, stored) {
-	const out = {};
-	for (const [key, value] of Object.entries(incoming)) {
-		if (isSecretArg(key) && value === "__camstack_redacted__") {
-			const previous = stored[key];
-			if (previous !== void 0) out[key] = previous;
-			continue;
-		}
-		out[key] = value;
-	}
-	return out;
-}
 /**
 * Does this argument bag hold a credential that is NOT a usable value: a MARKER the keychain did
 * not resolve, or the redaction token (a row read without its credential)? Either would reach a
@@ -91496,10 +91411,6 @@ function restoreRedactedArgs(incoming, stored) {
 function hasUnresolvedCredential(args) {
 	return Object.entries(args).some(([key, value]) => isSecretArg(key) && (isSecretMarker(value) || value === "__camstack_redacted__"));
 }
-/** Does it hold a non-empty credential (any form)? */
-function hasCredential(args) {
-	return Object.entries(args).some(([key, value]) => isSecretArg(key) && isSet(value));
-}
 //#endregion
 //#region src/waste-types.ts
 /**
@@ -91781,42 +91692,6 @@ async function copySourcesToRecords(ports) {
 		}
 	};
 }
-/** The `waste-collections` catalogue (D987): offered to the engine when the addon initialises. */
-var ADDON_MIGRATIONS = [{
-	meta: {
-		id: "waste-collections/2026-11-06-sources-from-settings-and-argsjson",
-		owner: "waste-collections",
-		level: "addon-state",
-		seq: 1,
-		dependsOn: [],
-		store: "settings",
-		scope: "cluster",
-		onFailure: "tolerate",
-		bodyKind: "procedure",
-		description: "Copy the addon-level sources setting (typed args, or a legacy argsJson string) into waste-source records, credentials in the keychain, each read back; an existing record is never overwritten",
-		fixtureMark: "the credential of a legacy argsJson row, read back from its record"
-	},
-	procedure: copySourcesToRecords
-}];
-//#endregion
-//#region src/python-paths.ts
-/**
-* Locate the addon's bundled `python/` dir at runtime (deployed package
-* root or workspace package root). Same candidate walk as detection-pipeline.
-*/
-function resolvePythonDir(fromModuleUrl = import.meta.url) {
-	const here = dirname(fileURLToPath(fromModuleUrl));
-	const candidates = [
-		join(here, "../python"),
-		join(here, "../../python"),
-		join(here, "python")
-	];
-	for (const c of candidates) if (existsSync(join(c, "fetch_source.py"))) return c;
-	throw new Error(`addon-waste-collections: python/ dir not found. Searched:\n${candidates.join("\n")}`);
-}
-function resolveFetchScript(fromModuleUrl = import.meta.url) {
-	return join(resolvePythonDir(fromModuleUrl), "fetch_source.py");
-}
 //#endregion
 //#region src/waste-source-record-kinds.ts
 var WASTE_COLLECTIONS_OWNER = "waste-collections";
@@ -91862,6 +91737,202 @@ var plainWasteSourceKind = defineEntryKind("waste-source", {
 	writeTrigger: WRITE_TRIGGER
 });
 //#endregion
+//#region src/waste-source-store.ts
+/**
+* A stored body as a source. A row read while the keychain is locked still carries its markers
+* in `args`; the config schema keeps them, so the source lists and its fetch refuses by name.
+*/
+function rowToSource(id, data) {
+	const parsed = WasteSourceConfigSchema.safeParse({
+		id,
+		label: data.name,
+		module: data.module,
+		args: data.args,
+		enabled: data.enabled
+	});
+	return parsed.success ? parsed.data : null;
+}
+function bodyOf(source) {
+	const { id, label, module, args, enabled } = source;
+	const body = {
+		name: label,
+		module,
+		args,
+		enabled
+	};
+	const parsed = wasteSourceEntryKind.schema.safeParse(body);
+	if (!parsed.success) throw new Error(`invalid waste source '${id}': ${parsed.error.message}`);
+	return parsed.data;
+}
+/**
+* While the sources migration has not landed: every record, plus the legacy rows that have no
+* record yet (a read-only view of those). A legacy row leaves the view as soon as a record has
+* its id, so the two never diverge; writes go to the records.
+*/
+function withUnmigratedLegacyRows(records, legacy) {
+	const have = new Set(records.map((r) => r.id));
+	return [...records, ...legacy.filter((r) => !have.has(r.id))];
+}
+var WasteSourceStore = class WasteSourceStore {
+	kind;
+	constructor(kind) {
+		this.kind = kind;
+	}
+	static of(records, kind = wasteSourceEntryKind) {
+		return new WasteSourceStore(records.kind(kind));
+	}
+	/** The record ids, whatever their content. */
+	async listIds() {
+		return (await this.kind.query({ limit: 1e3 })).records.map((record) => record.id);
+	}
+	/** One source with its credentials resolved; markers stay where the keychain cannot serve. */
+	async readResolved(id) {
+		const stored = await this.kind.get(id);
+		if (stored === null) return null;
+		let data = stored.data;
+		try {
+			const resolved = await this.kind.getResolved(id);
+			if (resolved !== null) data = resolved.data;
+		} catch (err) {
+			if (!(err instanceof RecordSecretUnavailableError)) throw err;
+		}
+		return rowToSource(id, data);
+	}
+	async listResolved() {
+		const out = [];
+		for (const id of await this.listIds()) {
+			const row = await this.readResolved(id);
+			if (row !== null) out.push(row);
+		}
+		return out;
+	}
+	/** Create the record when the id is free; an existing record is never touched. */
+	async putIfAbsent(source) {
+		if (await this.kind.get(source.id) !== null) return false;
+		await this.kind.put({
+			id: source.id,
+			data: bodyOf(source)
+		}, { ifRev: 0 });
+		return true;
+	}
+	/**
+	* Make the records equal `sources`. A source whose credential the keychain did not serve is
+	* left exactly as stored: rewriting it would save a marker as the credential.
+	*/
+	async replaceAll(sources) {
+		const nextIds = new Set(sources.map((s) => s.id));
+		for (const id of await this.listIds()) if (!nextIds.has(id)) await this.kind.delete(id);
+		for (const source of sources) {
+			if (hasUnresolvedCredential(source.args)) continue;
+			await this.kind.put({
+				id: source.id,
+				data: bodyOf(source)
+			});
+		}
+	}
+};
+//#endregion
+//#region src/migrations/ports.ts
+var PAGE = 1e3;
+/**
+* The sources migration's ports over {@link MigrationApiV1}, and nothing else (planning#447): the
+* addon's own settings store, its keychain handle and its `waste-source` record kind.
+*/
+function wasteSourcePortsOver(api, kind) {
+	const handle = api.records.kind(kind);
+	const secrets = { resolve: async (refs) => {
+		const { values } = await api.secrets.resolve({ refs: [...refs] });
+		return Object.fromEntries(refs.map((ref) => {
+			const value = values[ref];
+			return [ref, value === null || value === void 0 ? { kind: "missing" } : {
+				kind: "value",
+				value,
+				version: 0
+			}];
+		}));
+	} };
+	const readStored = async (key) => {
+		let store;
+		try {
+			store = (await api.settings.read({})).store;
+		} catch (err) {
+			return {
+				kind: "unreadable",
+				reason: "store-read-failed",
+				error: err instanceof Error ? err.message : String(err)
+			};
+		}
+		if (!Object.hasOwn(store, key)) return { kind: "absent" };
+		const { value } = await resolveSecretMarkers(store[key], secrets, { unresolved: "keep-marker" });
+		return {
+			kind: "present",
+			value
+		};
+	};
+	const asRow = (row) => rowToSource(row.id, row.data);
+	return {
+		readStored,
+		listSourceIds: async () => (await handle.query({ limit: PAGE })).records.map((row) => row.id),
+		putSource: async (source) => {
+			if (await handle.get({ id: source.id }) !== null) return;
+			await handle.put({
+				id: source.id,
+				data: bodyOf(source),
+				ifRev: 0
+			});
+		},
+		readSource: async (id) => {
+			const stored = await handle.get({ id });
+			if (stored === null) return null;
+			try {
+				return asRow(await handle.getResolved({ id }) ?? stored);
+			} catch (err) {
+				if (!(err instanceof RecordSecretUnavailableError)) throw err;
+				return asRow(stored);
+			}
+		},
+		warn: (message) => {
+			api.log.warn({ message });
+		}
+	};
+}
+/** The `waste-collections` catalogue (D987): offered to the engine when the addon initialises. */
+var ADDON_MIGRATIONS = [{
+	meta: {
+		id: "waste-collections/2026-11-06-sources-from-settings-and-argsjson",
+		owner: "waste-collections",
+		level: "addon-state",
+		seq: 1,
+		dependsOn: [],
+		store: "settings",
+		scope: "cluster",
+		onFailure: "tolerate",
+		bodyKind: "procedure",
+		description: "Copy the addon-level sources setting (typed args, or a legacy argsJson string) into waste-source records, credentials in the keychain, each read back; an existing record is never overwritten",
+		fixtureMark: "the credential of a legacy argsJson row, read back from its record"
+	},
+	procedure: copySourcesToRecords
+}];
+//#endregion
+//#region src/python-paths.ts
+/**
+* Locate the addon's bundled `python/` dir at runtime (deployed package
+* root or workspace package root). Same candidate walk as detection-pipeline.
+*/
+function resolvePythonDir(fromModuleUrl = import.meta.url) {
+	const here = dirname(fileURLToPath(fromModuleUrl));
+	const candidates = [
+		join(here, "../python"),
+		join(here, "../../python"),
+		join(here, "python")
+	];
+	for (const c of candidates) if (existsSync(join(c, "fetch_source.py"))) return c;
+	throw new Error(`addon-waste-collections: python/ dir not found. Searched:\n${candidates.join("\n")}`);
+}
+function resolveFetchScript(fromModuleUrl = import.meta.url) {
+	return join(resolvePythonDir(fromModuleUrl), "fetch_source.py");
+}
+//#endregion
 //#region src/seal-plaintext.ts
 /**
 * A credential an older version stored as plain text in a `waste-source` record is moved into the
@@ -91964,35 +92035,6 @@ function reportFailed(log, failures) {
 	};
 }
 //#endregion
-//#region src/source-id.ts
-/**
-* Stable calendar source ids derived from the operator label.
-* Pattern: `^[a-z0-9][a-z0-9-]{0,63}$` (max 64 chars).
-*/
-var SOURCE_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
-/** Slugify a display label into a candidate source id (may be empty). */
-function slugifySourceLabel(label) {
-	const s = label.normalize("NFKD").replace(/[\u0300-\u036f]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-	if (s.length === 0) return "";
-	return s.slice(0, 64);
-}
-/**
-* Pick an unused id from `label`. Collisions append `-2`, `-3`, …
-* (truncated so the result stays within the 64-char pattern).
-*/
-function allocateSourceId(label, existingIds) {
-	const taken = existingIds instanceof Set ? existingIds : new Set(existingIds);
-	const baseRaw = slugifySourceLabel(label);
-	const base = baseRaw.length > 0 ? baseRaw : "source";
-	if (!taken.has(base) && SOURCE_ID_PATTERN.test(base)) return base;
-	for (let n = 2; n < 1e4; n++) {
-		const suffix = `-${n}`;
-		const candidate = `${base.slice(0, Math.max(1, 64 - suffix.length)).replace(/-+$/g, "")}${suffix}`;
-		if (SOURCE_ID_PATTERN.test(candidate) && !taken.has(candidate)) return candidate;
-	}
-	throw new Error("could not allocate a unique source id");
-}
-//#endregion
 //#region src/waste-calendar-source.ts
 function startOfUtcDayMs(isoDate) {
 	const [y, m, d] = isoDate.split("-").map((p) => Number(p));
@@ -178037,100 +178079,34 @@ function mergeServiceArgs(service, formValues) {
 	return out;
 }
 //#endregion
-//#region src/waste-source-store.ts
+//#region src/source-id.ts
 /**
-* A stored body as a source. A row read while the keychain is locked still carries its markers
-* in `args`; the config schema keeps them, so the source lists and its fetch refuses by name.
+* Stable calendar source ids derived from the operator label.
+* Pattern: `^[a-z0-9][a-z0-9-]{0,63}$` (max 64 chars).
 */
-function rowToSource(id, data) {
-	const parsed = WasteSourceConfigSchema.safeParse({
-		id,
-		label: data.name,
-		module: data.module,
-		args: data.args,
-		enabled: data.enabled
-	});
-	return parsed.success ? parsed.data : null;
-}
-function bodyOf(source) {
-	const { id, label, module, args, enabled } = source;
-	const body = {
-		name: label,
-		module,
-		args,
-		enabled
-	};
-	const parsed = wasteSourceEntryKind.schema.safeParse(body);
-	if (!parsed.success) throw new Error(`invalid waste source '${id}': ${parsed.error.message}`);
-	return parsed.data;
+var SOURCE_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+/** Slugify a display label into a candidate source id (may be empty). */
+function slugifySourceLabel(label) {
+	const s = label.normalize("NFKD").replace(/[\u0300-\u036f]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+	if (s.length === 0) return "";
+	return s.slice(0, 64);
 }
 /**
-* While the sources migration has not landed: every record, plus the legacy rows that have no
-* record yet (a read-only view of those). A legacy row leaves the view as soon as a record has
-* its id, so the two never diverge; writes go to the records.
+* Pick an unused id from `label`. Collisions append `-2`, `-3`, …
+* (truncated so the result stays within the 64-char pattern).
 */
-function withUnmigratedLegacyRows(records, legacy) {
-	const have = new Set(records.map((r) => r.id));
-	return [...records, ...legacy.filter((r) => !have.has(r.id))];
-}
-var WasteSourceStore = class WasteSourceStore {
-	kind;
-	constructor(kind) {
-		this.kind = kind;
-	}
-	static of(records, kind = wasteSourceEntryKind) {
-		return new WasteSourceStore(records.kind(kind));
-	}
-	/** The record ids, whatever their content. */
-	async listIds() {
-		return (await this.kind.query({ limit: 1e3 })).records.map((record) => record.id);
-	}
-	/** One source with its credentials resolved; markers stay where the keychain cannot serve. */
-	async readResolved(id) {
-		const stored = await this.kind.get(id);
-		if (stored === null) return null;
-		let data = stored.data;
-		try {
-			const resolved = await this.kind.getResolved(id);
-			if (resolved !== null) data = resolved.data;
-		} catch (err) {
-			if (!(err instanceof RecordSecretUnavailableError)) throw err;
-		}
-		return rowToSource(id, data);
-	}
-	async listResolved() {
-		const out = [];
-		for (const id of await this.listIds()) {
-			const row = await this.readResolved(id);
-			if (row !== null) out.push(row);
-		}
-		return out;
-	}
-	/** Create the record when the id is free; an existing record is never touched. */
-	async putIfAbsent(source) {
-		if (await this.kind.get(source.id) !== null) return false;
-		await this.kind.put({
-			id: source.id,
-			data: bodyOf(source)
-		}, { ifRev: 0 });
-		return true;
-	}
-	/**
-	* Make the records equal `sources`. A source whose credential the keychain did not serve is
-	* left exactly as stored: rewriting it would save a marker as the credential.
-	*/
-	async replaceAll(sources) {
-		const nextIds = new Set(sources.map((s) => s.id));
-		for (const id of await this.listIds()) if (!nextIds.has(id)) await this.kind.delete(id);
-		for (const source of sources) {
-			if (hasUnresolvedCredential(source.args)) continue;
-			await this.kind.put({
-				id: source.id,
-				data: bodyOf(source)
-			});
-		}
+function allocateSourceId(label, existingIds) {
+	const taken = existingIds instanceof Set ? existingIds : new Set(existingIds);
+	const baseRaw = slugifySourceLabel(label);
+	const base = baseRaw.length > 0 ? baseRaw : "source";
+	if (!taken.has(base) && SOURCE_ID_PATTERN.test(base)) return base;
+	for (let n = 2; n < 1e4; n++) {
+		const suffix = `-${n}`;
+		const candidate = `${base.slice(0, Math.max(1, 64 - suffix.length)).replace(/-+$/g, "")}${suffix}`;
+		if (SOURCE_ID_PATTERN.test(candidate) && !taken.has(candidate)) return candidate;
 	}
-};
+	throw new Error("could not allocate a unique source id");
+}
 //#endregion
 //#region src/waste-source-instances.ts
 /**
@@ -178492,7 +178468,7 @@ var WasteCollectionsAddon = class extends BaseAddon {
 		if (!plainBoot) await records.declare({ "waste-source": wasteSourceEntryKind });
 		const store = WasteSourceStore.of(records, plainBoot ? plainWasteSourceKind : wasteSourceEntryKind);
 		this.sourceStore = store;
-		await this.migrateLegacySources(store);
+		await this.migrateLegacySources(plainBoot ? plainWasteSourceKind : wasteSourceEntryKind);
 		this.activeSources = await this.loadPersistedSources();
 		const instances = plainBoot ? null : new WasteSourceInstances(records, {
 			onChanged: (id, change) => this.onInstanceChanged(id, change),
@@ -178540,23 +178516,13 @@ var WasteCollectionsAddon = class extends BaseAddon {
 			customActions: wasteCollectionsActions,
 			actionHandlers: {
 				fetchNow: async (input) => this.fetchNow(input),
-				listSources: async () => this.listSources(),
 				listCountries: async () => listCatalogCountries(),
 				listServices: async (input) => listCatalogServices(input.countryId).map((s) => ({
 					id: s.id,
 					label: serviceDisplayLabel(s),
 					title: s.label,
 					module: s.module
-				})),
-				serviceFormSchema: async (input) => {
-					const service = findCatalogService(input.serviceId);
-					if (!service) throw new Error(`unknown service '${input.serviceId}'`);
-					return serviceFormSchema(service);
-				},
-				createSource: async (input) => this.createSource(input),
-				updateSource: async (input) => this.updateSource(input),
-				deleteSource: async (input) => this.deleteSource(input),
-				migrateSources: async (input) => this.migrateSources(input.apply)
+				}))
 			}
 		};
 	}
@@ -178584,16 +178550,8 @@ var WasteCollectionsAddon = class extends BaseAddon {
 	* fails leaves the settings where they are and is logged by id: the sources stay unavailable
 	* until it lands, never half-copied.
 	*/
-	async migrateLegacySources(store) {
-		const report = await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, {
-			readStored: (key) => this.readStoredGlobalKey(key),
-			listSourceIds: () => store.listIds(),
-			putSource: async (source) => {
-				await store.putIfAbsent(source);
-			},
-			readSource: (id) => store.readResolved(id),
-			warn: (message) => this.ctx.logger.warn(message)
-		}));
+	async migrateLegacySources(kind) {
+		const report = await this.runMigrations(ADDON_MIGRATIONS, (api) => wasteSourcePortsOver(api, kind));
 		this.legacyServed = !report.declared || report.failed.includes("waste-collections/2026-11-06-sources-from-settings-and-argsjson") || report.blocked.includes("waste-collections/2026-11-06-sources-from-settings-and-argsjson");
 		if (this.legacyServed) this.ctx.logger.warn("waste-collections: the sources migration has not landed - the legacy sources not yet in records are served read-only beside the records until it does", { meta: {
 			declared: report.declared,
@@ -178623,17 +178581,6 @@ var WasteCollectionsAddon = class extends BaseAddon {
 		if (!this.legacyServed) return records;
 		return withUnmigratedLegacyRows(records, this.parseConfigSources(this.config.sources));
 	}
-	async persistSources(sources) {
-		this.activeSources = [...sources];
-		const store = this.sourceStore;
-		if (store !== null) {
-			await store.replaceAll(sources);
-			const kept = new Set(sources.map((s) => s.id));
-			await this.pruneLegacyRows((legacyId) => kept.has(legacyId));
-			return;
-		}
-		await this.updateGlobalSettings({ sources: [...sources] });
-	}
 	/**
 	* A source deleted at the records leaves the legacy setting too, or it would reappear beside the
 	* records (while the migration is pending) or be copied back by it.
@@ -178648,195 +178595,6 @@ var WasteCollectionsAddon = class extends BaseAddon {
 		if (this.activeSources.length > 0 || this.sourceStore !== null) return this.activeSources;
 		return this.parseConfigSources(this.config.sources);
 	}
-	listSources() {
-		return this.configuredSources().map((s) => {
-			let args = {};
-			try {
-				args = sourceArgs(s);
-			} catch {
-				args = { ...s.args };
-			}
-			const matched = matchCatalogService(s.module, args);
-			const formValues = {
-				label: s.label,
-				enabled: s.enabled,
-				...redactArgs(args)
-			};
-			if (matched) for (const key of Object.keys(matched.defaultArgs)) delete formValues[key];
-			return {
-				id: s.id,
-				label: s.label,
-				module: s.module,
-				enabled: s.enabled,
-				formValues,
-				serviceId: matched?.id,
-				countryId: matched?.countryId
-			};
-		});
-	}
-	async createSource(input) {
-		const existing = this.configuredSources().map((s) => s.id);
-		let id;
-		if (input.id !== void 0) {
-			if (!SOURCE_ID_PATTERN.test(input.id)) throw new Error("id must be a lowercase slug (e.g. ics-home, junker)");
-			if (existing.includes(input.id)) throw new Error(`source '${input.id}' already exists`);
-			id = input.id;
-		} else id = allocateSourceId(input.label, existing);
-		const service = findCatalogService(input.serviceId);
-		if (!service) throw new Error(`unknown service '${input.serviceId}'`);
-		const row = WasteSourceConfigSchema.parse({
-			id,
-			label: input.label,
-			module: service.module,
-			args: this.typedArgs(mergeServiceArgs(service, restoreRedactedArgs(input.args, {}))),
-			enabled: input.enabled ?? true
-		});
-		await this.persistSources([...this.configuredSources(), row]);
-		return { id };
-	}
-	async updateSource(input) {
-		const sources = this.configuredSources();
-		const idx = sources.findIndex((s) => s.id === input.id);
-		if (idx < 0) throw new Error(`source '${input.id}' not found`);
-		const prev = sources[idx];
-		let prevArgs = {};
-		try {
-			prevArgs = sourceArgs(prev);
-		} catch {
-			prevArgs = { ...prev.args };
-		}
-		let module = prev.module;
-		let args = prevArgs;
-		if (input.serviceId !== void 0) {
-			const service = findCatalogService(input.serviceId);
-			if (!service) throw new Error(`unknown service '${input.serviceId}'`);
-			module = service.module;
-			args = mergeServiceArgs(service, restoreRedactedArgs(input.args ?? {}, prevArgs));
-		} else if (input.args !== void 0) {
-			const sent = restoreRedactedArgs(input.args, prevArgs);
-			const matched = matchCatalogService(prev.module, prevArgs);
-			args = matched ? mergeServiceArgs(matched, sent) : {
-				...prevArgs,
-				...sent
-			};
-		}
-		const next = WasteSourceConfigSchema.parse({
-			id: prev.id,
-			label: input.label,
-			module,
-			args: this.typedArgs(args),
-			enabled: input.enabled ?? prev.enabled
-		});
-		await this.persistSources(sources.map((s, i) => i === idx ? next : s));
-		return { ok: true };
-	}
-	/** Validate an argument bag against the typed value schema (a nested object is refused). */
-	typedArgs(args) {
-		const out = {};
-		for (const [key, value] of Object.entries(args)) out[key] = WasteArgValueSchema.parse(value);
-		return out;
-	}
-	/**
-	* D880: rewrite every legacy source (free `argsJson`) as typed `args`; its
-	* credentials go to the keychain through the normal save path. Then every
-	* credential is read back and compared with what the legacy row held; on any
-	* difference the legacy rows are written back, so nothing is lost. Dry run
-	* unless `apply`. Idempotent. Counts only - never an argument, a ref or an id.
-	*/
-	async migrateSources(apply) {
-		const sources = this.configuredSources();
-		const legacy = sources.filter((s) => s.argsJson !== void 0);
-		const rawRows = legacy.filter((s) => {
-			try {
-				return hasCredential(sourceArgs(s));
-			} catch {
-				return false;
-			}
-		});
-		const markerRows = sources.filter((s) => s.argsJson === void 0 && hasCredential(s.args)).length;
-		const report = (over) => ({
-			apply,
-			rows: sources.length,
-			raw: rawRows.length,
-			markers: markerRows,
-			migrated: 0,
-			failed: 0,
-			remainingRaw: rawRows.length,
-			unresolvedMarkers: this.unresolvedSecrets.length,
-			redundantCopies: legacy.length,
-			verified: rawRows.length === 0 && this.unresolvedSecrets.length === 0,
-			...over
-		});
-		if (!apply || legacy.length === 0) return report({});
-		const expected = /* @__PURE__ */ new Map();
-		const unconverted = /* @__PURE__ */ new Set();
-		const migrated = sources.map((s) => {
-			if (s.argsJson === void 0) return s;
-			try {
-				const args = sourceArgs(s);
-				const row = WasteSourceConfigSchema.parse({
-					id: s.id,
-					label: s.label,
-					module: s.module,
-					args: this.typedArgs(args),
-					enabled: s.enabled
-				});
-				expected.set(s.id, args);
-				return row;
-			} catch {
-				unconverted.add(s.id);
-				return s;
-			}
-		});
-		const failedRows = unconverted.size;
-		if (expected.size === 0) return report({
-			failed: failedRows,
-			remainingRaw: legacy.length
-		});
-		try {
-			await this.persistSources(migrated);
-		} catch {
-			return report({ failed: legacy.length });
-		}
-		const back = new Map(this.configuredSources().map((s) => [s.id, s]));
-		if (![...expected].every(([id, args]) => {
-			const row = back.get(id);
-			return row !== void 0 && row.argsJson === void 0 && JSON.stringify(sortedEntries(row.args)) === JSON.stringify(sortedEntries(args));
-		}) || this.unresolvedSecrets.length > 0) {
-			await this.rollbackMigration(sources, expected);
-			return report({ failed: legacy.length });
-		}
-		return report({
-			migrated: expected.size,
-			failed: failedRows,
-			remainingRaw: failedRows,
-			unresolvedMarkers: 0,
-			redundantCopies: legacy.length,
-			verified: failedRows === 0
-		});
-	}
-	/**
-	* Put the legacy rows back. A converted row's `args` is written as `null`, which
-	* the save path reads as "this object is gone": it deletes the keychain refs the
-	* migration created (a plain `{}` would keep them). Never throws - the report
-	* says failed either way, and the legacy JSON stays authoritative.
-	*/
-	async rollbackMigration(sources, converted) {
-		try {
-			await this.updateGlobalSettingsAsOperator({ sources: sources.map((s) => converted.has(s.id) ? {
-				...s,
-				args: null
-			} : s) });
-		} catch {
-			this.ctx.logger.error("waste-collections: the migration rollback failed - keychain refs may be orphaned (System -> Secrets)");
-		}
-	}
-	async deleteSource(input) {
-		const sources = this.configuredSources();
-		if (!sources.some((s) => s.id === input.id)) throw new Error(`source '${input.id}' not found`);
-		await this.persistSources(sources.filter((s) => s.id !== input.id));
-		return { ok: true };
-	}
 	async fetchNow(input) {
 		const targets = this.configuredSources().filter((s) => {
 			if (!s.enabled) return false;
@@ -178937,32 +178695,10 @@ var WasteCollectionsAddon = class extends BaseAddon {
 			this.ctx.logger.warn("waste-collections: cache persist failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		}
 	}
-	globalSettingsSchema() {
-		return this.schema({ sections: [{
-			id: "refresh",
-			title: "Refresh",
-			description: "Sources are managed in the table above (Add / Edit): pick a country and a service, then fill only that service’s fields. Each source becomes one calendar under System → Calendars.",
-			columns: 2,
-			fields: [{
-				type: "addon-action-button",
-				key: "_fetchNow",
-				label: "Refresh",
-				buttonLabel: "Fetch now",
-				description: "Sources refresh once at boot and then every 24 hours; this refreshes every enabled source immediately.",
-				addonId: "waste-collections",
-				action: "fetchNow",
-				variant: "primary",
-				paramsStatic: {}
-			}]
-		}] });
-	}
 };
 /** Re-parse helper for tests. */
 function parseWasteConfig(raw) {
 	return WasteConfigSchema.parse(raw);
 }
-function sortedEntries(args) {
-	return Object.entries(args).toSorted(([a], [b]) => a < b ? -1 : 1);
-}
 //#endregion
 export { WasteCollectionsAddon, WasteCollectionsAddon as default, sourceArgs as a, wasteCollectionsActions as customActions, WasteConfigSchema as i, createWasteCalendarSource as n, parseWasteConfig, DEFAULT_WASTE_CONFIG as r, collectionsToEvents as t };