@camstack/addon-auth 1.2.134 → 1.2.136

package/dist/{dist-D5CZYR3c.js → dist-DMFGQOff.mjs}

@@ -1,4 +1,3 @@
-require("node:crypto");
 //#region ../types/dist/event-category-DaIZi00R.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
@@ -5377,7 +5376,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DujUvOcb.mjs
+//#region ../types/dist/sleep-r3RWkGVx.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -5494,7 +5493,7 @@ function isKeychainStoredField(field) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -5505,12 +5504,12 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$1(value)) return false;
+	if (!isRecord$2(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 function isSecretClear(value) {
-	return isRecord$1(value) && value["$secretClear"] === true;
+	return isRecord$2(value) && value["$secretClear"] === true;
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -6026,6 +6025,13 @@ function globalSecretScope() {
 function encodeSegment(value) {
 	return encodeURIComponent(value);
 }
+function decodeSegment(value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return null;
+	}
+}
 /**
 * The field path of a value inside an array item, addressed by the item's id:
 * `arrayItemFieldPath('providers', 'authentik', 'clientSecret')` →
@@ -6034,6 +6040,75 @@ function encodeSegment(value) {
 function arrayItemFieldPath(arrayKey, itemId, fieldKey) {
 	return `${arrayKey}[${encodeSegment(itemId)}].${fieldKey}`;
 }
+function parseScope(segments) {
+	switch (segments[0]) {
+		case "global": return {
+			scope: GLOBAL_SCOPE,
+			used: 1
+		};
+		case "node": {
+			const nodeId = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			return nodeId === null || nodeId.length === 0 ? null : {
+				scope: {
+					kind: "node",
+					nodeId
+				},
+				used: 2
+			};
+		}
+		case "device": {
+			const raw = segments[1];
+			if (raw === void 0 || !/^\d+$/.test(raw)) return null;
+			return {
+				scope: {
+					kind: "device",
+					deviceId: Number(raw)
+				},
+				used: 2
+			};
+		}
+		case "integration": {
+			const id = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			return id === null || id.length === 0 ? null : {
+				scope: {
+					kind: "integration",
+					integrationId: id
+				},
+				used: 2
+			};
+		}
+		case "row": {
+			const collection = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			const rowId = segments[2] !== void 0 ? decodeSegment(segments[2]) : null;
+			if (collection === null || rowId === null || collection.length === 0 || rowId.length === 0) return null;
+			return {
+				scope: {
+					kind: "row",
+					collection,
+					rowId
+				},
+				used: 3
+			};
+		}
+		default: return null;
+	}
+}
+/** Take a ref apart; `null` when it is not a well-formed ref. */
+function parseSecretRef(ref) {
+	if (!ref.startsWith("secret://")) return null;
+	const segments = ref.slice(9).split("/");
+	const owner = segments[0] !== void 0 ? decodeSegment(segments[0]) : null;
+	if (owner === null || owner.length === 0) return null;
+	const parsed = parseScope(segments.slice(1));
+	if (parsed === null) return null;
+	const fieldPath = segments.slice(1 + parsed.used).join("/");
+	if (fieldPath.length === 0) return null;
+	return {
+		owner,
+		scope: parsed.scope,
+		fieldPath
+	};
+}
 /** A write to a secret path could not be stored in the keychain, so it was refused. */
 var KeychainWriteRefusedError = class extends Error {
 	fieldPath;
@@ -6044,7 +6119,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -6057,7 +6132,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -6112,7 +6187,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -6128,7 +6203,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord(row)) {
+		if (!isRecord$1(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -6153,7 +6228,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord(incoming)) {
+			if (!isRecord$1(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -6161,7 +6236,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord(stored) ? stored : {};
+			const storedObj = isRecord$1(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -6220,12 +6295,19 @@ async function transformSecretWrite(input) {
 		}
 	};
 }
+/** Is `ref` one of `owner`'s refs? */
+function isSecretRefOwnedBy(ref, owner) {
+	return parseSecretRef(ref)?.owner === owner;
+}
 /**
 * Replace every marker in `value` with its keychain value. Returns the SAME
 * reference when there is no marker (no allocation, no keychain call).
 */
-async function resolveSecretMarkers(value, secrets) {
-	const refs = collectSecretMarkerRefs(value);
+async function resolveSecretMarkers(value, secrets, options = {}) {
+	const keepMarker = options.unresolved === "keep-marker";
+	const owner = options.ownedBy;
+	const inScope = (ref) => owner === void 0 || isSecretRefOwnedBy(ref, owner);
+	const refs = collectSecretMarkerRefs(value).filter(inScope);
 	if (refs.length === 0) return {
 		value,
 		unresolved: []
@@ -6249,10 +6331,18 @@ async function resolveSecretMarkers(value, secrets) {
 	}
 	const substitute = (v) => {
 		if (isSecretMarker(v)) {
+			if (!inScope(v.$secret)) return {
+				keep: true,
+				value: v
+			};
 			const answer = answers[v.$secret];
-			return answer?.kind === "value" ? {
+			if (answer?.kind === "value") return {
 				keep: true,
 				value: answer.value
+			};
+			return keepMarker ? {
+				keep: true,
+				value: v
 			} : {
 				keep: false,
 				value: void 0
@@ -6269,7 +6359,7 @@ async function resolveSecretMarkers(value, secrets) {
 				value: items
 			};
 		}
-		if (isRecord(v)) {
+		if (isRecord$1(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -6290,14 +6380,152 @@ async function resolveSecretMarkers(value, secrets) {
 		unresolved
 	};
 }
-function touchesTree(tree, patch) {
-	if (tree.size === 0) return false;
-	for (const key of Object.keys(patch)) {
-		const at = key.indexOf("@");
-		if (tree.has(at > 0 ? key.slice(0, at) : key)) return true;
+/** An addon tried to replace a stored secret it could not read. Nothing was written. */
+var SecretOverwriteRefusedError = class extends Error {
+	ref;
+	reason;
+	constructor(ref, reason) {
+		super(`secret ${ref} was not replaced: its stored value cannot be read right now (${reason}), and an addon may not overwrite a secret it cannot see. Nothing was written.`);
+		this.ref = ref;
+		this.reason = reason;
+		this.name = "SecretOverwriteRefusedError";
+	}
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function resolvedValue(pass, marker) {
+	const answer = pass.answers[marker.$secret];
+	return answer?.kind === "value" ? answer.value : null;
+}
+async function atMarker(pass, incoming, stored) {
+	if (incoming === null) return stored;
+	if (typeof incoming !== "string") return incoming;
+	if (incoming === resolvedValue(pass, stored)) return stored;
+	const intent = classifySecretWrite(incoming);
+	if (intent.kind !== "set") return stored;
+	const ref = stored.$secret;
+	if (!isSecretRefOwnedBy(ref, pass.secrets.owner)) return incoming;
+	const answer = pass.answers[ref];
+	if ((answer === void 0 || answer.kind === "unavailable" || answer.kind === "forbidden") && !pass.operatorWrite) throw new SecretOverwriteRefusedError(ref, answer === void 0 ? "not-initialized" : answer.kind === "unavailable" ? answer.reason : answer.kind);
+	try {
+		await pass.secrets.put(ref, intent.value);
+	} catch (err) {
+		throw new KeychainWriteRefusedError(ref, err);
+	}
+	pass.changedRefs.push(ref);
+	return stored;
+}
+function inArray(pass, incoming, stored) {
+	return incoming.map((item, index) => {
+		const twin = stored[index];
+		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
+		if (isRecord(item) && isRecord(twin)) return inArrayRow(pass, item, twin);
+		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
+		return item;
+	});
+}
+function inArrayRow(pass, incoming, stored) {
+	const out = { ...incoming };
+	for (const [key, value] of Object.entries(incoming)) {
+		const twin = stored[key];
+		if (isSecretMarker(twin)) {
+			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
+		} else if (isRecord(value) && isRecord(twin)) out[key] = inArrayRow(pass, value, twin);
+		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
+	}
+	return out;
+}
+async function walk(pass, incoming, stored) {
+	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
+	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
+	if (!isRecord(incoming) || !isRecord(stored)) return incoming;
+	const out = { ...incoming };
+	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
+	return out;
+}
+/** Restore markers a write-back carries as values. See the file doc. */
+async function restoreUnchangedSecrets(input) {
+	const refs = [];
+	for (const key of Object.keys(input.patch)) collectSecretMarkerRefs(input.stored[key], refs);
+	const owned = refs.filter((ref) => isSecretRefOwnedBy(ref, input.secrets.owner));
+	if (owned.length === 0) return {
+		patch: input.patch,
+		changedRefs: []
+	};
+	const pass = {
+		secrets: input.secrets,
+		answers: await input.secrets.resolve([...new Set(owned)]),
+		operatorWrite: input.operatorWrite,
+		changedRefs: []
+	};
+	const out = {};
+	for (const [key, value] of Object.entries(input.patch)) out[key] = await walk(pass, value, input.stored[key]);
+	return {
+		patch: out,
+		changedRefs: pass.changedRefs
+	};
+}
+/** Structural equality over JSON-shaped values (key order does not matter). */
+function isJsonEqual(a, b) {
+	if (Object.is(a, b)) return true;
+	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
+	if (isRecord(a) && isRecord(b)) {
+		const keys = Object.keys(a);
+		if (keys.length !== Object.keys(b).length) return false;
+		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
 	}
 	return false;
 }
+/** The patch without the keys whose value already equals the stored one. */
+function dropUnchangedKeys(patch, stored) {
+	const out = {};
+	for (const [key, value] of Object.entries(patch)) {
+		if (Object.prototype.hasOwnProperty.call(stored, key) && isJsonEqual(value, stored[key])) continue;
+		out[key] = value;
+	}
+	return out;
+}
+/** The top-level keys of a blob that hold at least one of `owner`'s markers. */
+function markerKeysOf(blob, owner) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const [key, value] of Object.entries(blob)) if (collectSecretMarkerRefs(value).some((ref) => isSecretRefOwnedBy(ref, owner))) keys.add(key);
+	return keys;
+}
+function nodeFromStored(value, owner) {
+	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
+	if (!isRecord(value)) return null;
+	const children = /* @__PURE__ */ new Map();
+	for (const [key, child] of Object.entries(value)) {
+		const node = nodeFromStored(child, owner);
+		if (node !== null) children.set(key, node);
+	}
+	return children.size > 0 ? {
+		kind: "object",
+		children
+	} : null;
+}
+/**
+* The declared secret tree, widened by every place the STORED blob holds a
+* marker under one of `keys` — so a marker the schema no longer declares (or
+* never declared: Wyze before b4906cec6) still gets the save path's
+* KEEP / SET / CLEAR semantics instead of being overwritten by whatever the
+* addon writes. Markers inside arrays are not added: a row has no id field to
+* match by unless the schema declares one. Only `owner`'s markers count: a
+* builtin that keeps another addon's marker (device-manager) never takes it
+* over.
+*/
+function widenTreeWithStoredMarkers(declared, stored, keys, owner) {
+	const added = /* @__PURE__ */ new Map();
+	for (const key of keys) {
+		const at = key.indexOf("@");
+		const base = at > 0 ? key.slice(0, at) : key;
+		if (declared.has(base) || added.has(base)) continue;
+		const node = nodeFromStored(stored[key], owner);
+		if (node !== null) added.set(base, node);
+	}
+	return added.size === 0 ? declared : new Map([...declared, ...added]);
+}
 /** The blob as stored now; a failed read REFUSES the write instead of guessing. */
 async function readStoredAddonBlob(raw) {
 	const threeWay = raw.readAddonStoreResult;
@@ -6306,7 +6534,41 @@ async function readStoredAddonBlob(raw) {
 	if (result.kind === "failed") throw new Error(`settings write refused: the stored blob could not be read (${result.error})`);
 	return result.kind === "missing" ? {} : result.value;
 }
-function createSecretAwareSettings(raw, opts) {
+function touchesTree(tree, patch) {
+	if (tree.size === 0) return false;
+	for (const key of Object.keys(patch)) {
+		const at = key.indexOf("@");
+		if (tree.has(at > 0 ? key.slice(0, at) : key)) return true;
+	}
+	return false;
+}
+/**
+* Which top-level keys of each store held markers when last seen. `undefined`
+* for a store not seen yet: its first write reads it, to be safe.
+*/
+var MarkerKeyIndex = class {
+	owner;
+	byStore = /* @__PURE__ */ new Map();
+	constructor(owner) {
+		this.owner = owner;
+	}
+	seen(store, blob) {
+		this.byStore.set(store, markerKeysOf(blob, this.owner));
+	}
+	wrote(store, patch) {
+		const keys = this.byStore.get(store);
+		if (keys === void 0) return;
+		const now = markerKeysOf(patch, this.owner);
+		for (const key of Object.keys(patch)) if (now.has(key)) keys.add(key);
+		else keys.delete(key);
+	}
+	mayHoldMarkers(store, patch) {
+		const keys = this.byStore.get(store);
+		if (keys === void 0) return true;
+		return Object.keys(patch).some((key) => keys.has(key));
+	}
+};
+function createHandle(raw, opts) {
 	const chains = /* @__PURE__ */ new Map();
 	const serialize = (key, fn) => {
 		const next = (chains.get(key) ?? Promise.resolve()).then(fn, fn);
@@ -6317,46 +6579,130 @@ function createSecretAwareSettings(raw, opts) {
 		});
 		return next;
 	};
-	const write = async (chainKey, tree, scope, patch, readStored, rawWrite) => {
-		if (!touchesTree(tree, patch)) return rawWrite(patch);
-		return serialize(chainKey, async () => {
+	const index = new MarkerKeyIndex(opts.secrets.owner);
+	const resolveRead = async (store, blob) => {
+		index.seen(store, blob);
+		const { value, unresolved } = await resolveSecretMarkers(blob, opts.secrets, {
+			unresolved: "keep-marker",
+			ownedBy: opts.secrets.owner
+		});
+		if (unresolved.length > 0) opts.onUnresolved?.(unresolved);
+		return value;
+	};
+	const write = async (store, declared, scope, patch, readStored, rawWrite) => {
+		if (!touchesTree(declared, patch) && !index.mayHoldMarkers(store, patch)) {
+			await rawWrite(patch);
+			index.wrote(store, patch);
+			return { changed: true };
+		}
+		return serialize(store, async () => {
 			const stored = await readStored();
+			index.seen(store, stored);
+			const operatorWrite = opts.isOperatorWrite?.() === true;
+			const restored = await restoreUnchangedSecrets({
+				patch,
+				stored,
+				secrets: opts.secrets,
+				operatorWrite
+			});
 			const result = await transformSecretWrite({
-				tree,
+				tree: widenTreeWithStoredMarkers(declared, stored, Object.keys(restored.patch), opts.secrets.owner),
 				secrets: opts.secrets,
-				patch,
+				patch: restored.patch,
 				stored,
 				...scope !== void 0 ? { scope } : {},
-				operatorWrite: opts.isOperatorWrite?.() === true
+				operatorWrite
 			});
-			if (Object.keys(result.patch).length > 0) await rawWrite(result.patch);
+			const effective = dropUnchangedKeys(result.patch, stored);
+			const wroteBlob = Object.keys(effective).length > 0;
+			if (wroteBlob) {
+				await rawWrite(effective);
+				index.wrote(store, effective);
+			}
 			const { orphaned } = await result.afterWrite();
 			if (orphaned.length > 0) opts.onOrphaned(orphaned);
+			return { changed: wroteBlob || restored.changedRefs.length > 0 };
 		});
 	};
-	const wrapped = {
-		writeAddonStore: (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p)),
-		writeDeviceStore: (deviceId, patch) => write(`device:${deviceId}`, opts.deviceTree(), {
-			kind: "device",
-			deviceId
-		}, patch, () => raw.readDeviceStore(deviceId), (p) => raw.writeDeviceStore(deviceId, p))
+	const writeAddon = (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p));
+	const readAddonStoreResult = raw.readAddonStoreResult;
+	const readAddonStoreKeyResult = raw.readAddonStoreKeyResult;
+	const readDeviceStoreBatch = raw.readDeviceStoreBatch;
+	const overrides = {
+		readAddonStore: async () => resolveRead("addon", await raw.readAddonStore()),
+		...readAddonStoreResult !== void 0 ? { readAddonStoreResult: async () => {
+			const result = await readAddonStoreResult.call(raw);
+			return result.kind === "value" ? {
+				kind: "value",
+				value: await resolveRead("addon", result.value)
+			} : result;
+		} } : {},
+		...readAddonStoreKeyResult !== void 0 ? { readAddonStoreKeyResult: async (key) => {
+			const result = await readAddonStoreKeyResult.call(raw, key);
+			if (result.kind !== "present") return result;
+			const { value, unresolved } = await resolveSecretMarkers({ [key]: result.value }, opts.secrets, {
+				unresolved: "keep-marker",
+				ownedBy: opts.secrets.owner
+			});
+			if (unresolved.length > 0) opts.onUnresolved?.(unresolved);
+			return {
+				kind: "present",
+				value: value[key]
+			};
+		} } : {},
+		readDeviceStore: async (deviceId) => resolveRead(`device:${deviceId}`, await raw.readDeviceStore(deviceId)),
+		...readDeviceStoreBatch !== void 0 ? { readDeviceStoreBatch: async (deviceIds) => {
+			const rows = await readDeviceStoreBatch.call(raw, deviceIds);
+			const out = /* @__PURE__ */ new Map();
+			for (const [deviceId, blob] of rows) out.set(deviceId, await resolveRead(`device:${deviceId}`, blob));
+			return out;
+		} } : {},
+		writeAddonStore: async (patch) => {
+			await writeAddon(patch);
+		},
+		writeDeviceStore: async (deviceId, patch) => {
+			await write(`device:${deviceId}`, opts.deviceTree(), {
+				kind: "device",
+				deviceId
+			}, patch, () => raw.readDeviceStore(deviceId), (p) => raw.writeDeviceStore(deviceId, p));
+		}
+	};
+	return {
+		settings: new Proxy(raw, { get(target, prop, receiver) {
+			if (typeof prop === "string" && Object.prototype.hasOwnProperty.call(overrides, prop)) return Reflect.get(overrides, prop);
+			const value = Reflect.get(target, prop, receiver);
+			return typeof value === "function" ? value.bind(target) : value;
+		} }),
+		raw: {
+			readAddonStore: async () => {
+				const blob = await raw.readAddonStore();
+				index.seen("addon", blob);
+				return blob;
+			},
+			readDeviceStore: async (deviceId) => {
+				const blob = await raw.readDeviceStore(deviceId);
+				index.seen(`device:${deviceId}`, blob);
+				return blob;
+			}
+		},
+		writeAddonStore: writeAddon
 	};
-	return new Proxy(raw, { get(target, prop, receiver) {
-		if (prop === "writeAddonStore") return wrapped.writeAddonStore;
-		if (prop === "writeDeviceStore") return wrapped.writeDeviceStore;
-		const value = Reflect.get(target, prop, receiver);
-		return typeof value === "function" ? value.bind(target) : value;
-	} });
 }
-/** The context the addon sees: identical, except that its settings writes are secret-aware. */
-function withSecretAwareSettings(context, opts) {
+/** The context the addon sees, plus the private raw view and write outcome. */
+function createSecretAwareContext(context, opts) {
 	const raw = context.settings;
-	if (raw === void 0) return context;
-	const settings = createSecretAwareSettings(raw, opts);
-	return new Proxy(context, { get(target, prop, receiver) {
-		if (prop === "settings") return settings;
-		return Reflect.get(target, prop, receiver);
-	} });
+	if (raw === void 0) return {
+		context,
+		handle: null
+	};
+	const handle = createHandle(raw, opts);
+	return {
+		context: new Proxy(context, { get(target, prop, receiver) {
+			if (prop === "settings") return handle.settings;
+			return Reflect.get(target, prop, receiver);
+		} }),
+		handle
+	};
 }
 var LEAF = { kind: "leaf" };
 var DEFAULT_ITEM_ID_KEY = "id";
@@ -6531,6 +6877,14 @@ var BaseAddon = class {
 	_secretChangeUnsub = null;
 	/** >0 while an OPERATOR's settings write is being applied. */
 	_operatorWriteDepth = 0;
+	/**
+	* The keychain-aware settings handle (D798). Its `raw` view is the ONLY way
+	* to the marker-bearing blobs and stays private to this class: the form
+	* hydrate and config resolution need markers, addon code never does.
+	*/
+	_secretSettings = null;
+	/** Refs an addon-facing read could not resolve — each is logged once per process. */
+	_loggedUnresolvedReads = /* @__PURE__ */ new Set();
 	constructor(defaults) {
 		this.defaults = defaults;
 		this._config = { ...defaults };
@@ -6567,13 +6921,21 @@ var BaseAddon = class {
 	}
 	async initialize(context) {
 		const secrets = context.secrets;
-		this._ctx = secrets !== void 0 ? withSecretAwareSettings(context, {
-			secrets,
-			addonTree: () => this.addonSecretTree(),
-			deviceTree: () => this.deviceSecretTree(),
-			onOrphaned: (refs) => context.logger.warn("keychain refs dropped by a settings write could not be deleted", { meta: { refs: [...refs] } }),
-			isOperatorWrite: () => this._operatorWriteDepth > 0
-		}) : context;
+		if (secrets !== void 0) {
+			const { context: wrapped, handle } = createSecretAwareContext(context, {
+				secrets,
+				addonTree: () => this.addonSecretTree(),
+				deviceTree: () => this.deviceSecretTree(),
+				onOrphaned: (refs) => context.logger.warn("keychain refs dropped by a settings write could not be deleted", { meta: { refs: [...refs] } }),
+				isOperatorWrite: () => this._operatorWriteDepth > 0,
+				onUnresolved: (unresolved) => this.logUnresolvedRead(unresolved)
+			});
+			this._ctx = wrapped;
+			this._secretSettings = handle;
+		} else {
+			this._ctx = context;
+			this._secretSettings = null;
+		}
 		await this.resolveConfig();
 		if (secrets !== void 0) this._secretChangeUnsub = secrets.onChange((ref) => {
 			if (this._configSecretRefs.has(ref)) this.scheduleSecretReresolve(SECRET_CHANGE_DEBOUNCE_MS);
@@ -6690,11 +7052,8 @@ var BaseAddon = class {
 	async getGlobalSettings(overlay, cap, nodeId) {
 		const schema = this.globalSettingsSchema(cap);
 		if (!schema) return { sections: [] };
-		const projected = await this.resolveGlobalStore(nodeId, cap);
-		return hydrateSchema(schema, overlay ? {
-			...projected,
-			...overlay
-		} : projected, { inlineSecretsAsViews: true });
+		const projected = await this.readRawProjectedStore(nodeId, cap);
+		return hydrateSchema(schema, overlay ? await this.overlayKeepingMarkers(projected, overlay) : projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The integration-level view of this addon's settings: exactly the sections
@@ -6739,7 +7098,7 @@ var BaseAddon = class {
 			});
 		}
 		if (sections.length === 0) return null;
-		const projected = await this.resolveGlobalStore(nodeId);
+		const projected = await this.readRawProjectedStore(nodeId);
 		return hydrateSchema({
 			...schema,
 			sections
@@ -6756,12 +7115,50 @@ var BaseAddon = class {
 	* the store for custom option logic (option narrowing, value snapping) to
 	* read it per-node — never `ctx.settings.readAddonStore()` directly.
 	* `nodeId` omitted ⇒ the local node (node-blind injection from ctx).
+	*
+	* Keychain values come back RESOLVED (D798): a secret reads as its value,
+	* never as a `{ $secret }` marker. One the keychain cannot serve right now
+	* stays a marker — "stored, unavailable" (`isSecretMarker()` is true, and it
+	* is listed in {@link unresolvedSecrets}) — never `''` and never absent, so
+	* it cannot be mistaken for "nothing stored, mint a new one". Writing the
+	* resolved blob back is a no-op for every unchanged secret.
 	*/
 	async resolveGlobalStore(nodeId, cap) {
 		const raw = await this._ctx?.settings?.readAddonStore() ?? {};
+		return this.projectForNode(raw, nodeId, cap);
+	}
+	projectForNode(store, nodeId, cap) {
 		const keys = this.perNodeKeys(cap);
 		const node = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
-		return keys.size > 0 ? projectStore(raw, keys, node) : raw;
+		return keys.size > 0 ? projectStore(store, keys, node) : store;
+	}
+	/** The PROJECTED store with its markers — the form hydrate only (D798). */
+	async readRawProjectedStore(nodeId, cap) {
+		const raw = await this.rawSettings()?.readAddonStore() ?? {};
+		return this.projectForNode(raw, nodeId, cap);
+	}
+	/**
+	* `{ ...stored, ...overlay }`, except that an overlay member equal to the
+	* RESOLVED stored one keeps the stored (marker-bearing) member — so a form
+	* hydrated from a resolved overlay still shows a secret as "set", never as
+	* its value.
+	*/
+	async overlayKeepingMarkers(stored, overlay) {
+		const secrets = this._ctx?.secrets;
+		const merged = {
+			...stored,
+			...overlay
+		};
+		if (secrets === void 0 || collectSecretMarkerRefs(stored).length === 0) return merged;
+		const { value: resolved } = await resolveSecretMarkers(stored, secrets, {
+			unresolved: "keep-marker",
+			ownedBy: secrets.owner
+		});
+		for (const key of Object.keys(overlay)) {
+			if (collectSecretMarkerRefs(stored[key]).length === 0) continue;
+			if (isJsonEqual(overlay[key], resolved[key])) merged[key] = stored[key];
+		}
+		return merged;
 	}
 	/**
 	* Whether ONE global key of this addon's store was written, read three-way
@@ -6826,8 +7223,12 @@ var BaseAddon = class {
 	async clearSecrets(keys, nodeId) {
 		const tree = this.addonSecretTree();
 		const keychain = this._ctx?.secrets !== void 0;
+		const stored = keychain ? await this.readAddonStoreWithRetry() : {};
 		const patch = {};
-		for (const key of keys) patch[key] = keychain && tree.has(key) ? SECRET_CLEAR : "";
+		for (const key of keys) {
+			const keychainStored = tree.has(key) || collectSecretMarkerRefs(stored[key]).length > 0;
+			patch[key] = keychain && keychainStored ? SECRET_CLEAR : "";
+		}
 		await this.applyGlobalPatch(patch, nodeId);
 	}
 	async applyGlobalPatch(barePatch, nodeId) {
@@ -6835,7 +7236,11 @@ var BaseAddon = class {
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
 		const scoped = keys.size > 0 ? scopePatch(barePatch, keys, target) : barePatch;
-		await this._ctx?.settings?.writeAddonStore(scoped);
+		const handle = this._secretSettings;
+		if (handle !== null) {
+			const { changed } = await handle.writeAddonStore(scoped);
+			if (!changed) return;
+		} else await this._ctx?.settings?.writeAddonStore(scoped);
 		if (target !== localNode) return;
 		await this.resolveConfig();
 		await this.onConfigChanged();
@@ -6888,7 +7293,7 @@ var BaseAddon = class {
 	async getDeviceSettings(deviceId) {
 		const schema = this.deviceSettingsSchema();
 		if (!schema) return { sections: [] };
-		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, { inlineSecretsAsViews: true });
+		return hydrateSchema(schema, await this.rawSettings()?.readDeviceStore(deviceId) ?? {}, { inlineSecretsAsViews: true });
 	}
 	async updateDeviceSettings(deviceId, patch) {
 		await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
@@ -7060,7 +7465,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: async () => this.resolveStoredSecrets(await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, false),
+			read: async () => this.resolveStoredSecrets(await this.rawSettings()?.readDeviceStore(deviceId) ?? {}, false),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
 			},
@@ -7122,6 +7527,23 @@ var BaseAddon = class {
 		}
 		return value;
 	}
+	/**
+	* The marker-bearing settings reads (D798) — private on purpose. Without a
+	* keychain the context's own view is already raw.
+	*/
+	rawSettings() {
+		return this._secretSettings?.raw ?? this._ctx?.settings;
+	}
+	/** An addon-facing read met markers it could not resolve: say so once per ref. */
+	logUnresolvedRead(unresolved) {
+		const fresh = unresolved.filter((u) => !this._loggedUnresolvedReads.has(u.ref));
+		if (fresh.length === 0) return;
+		for (const u of fresh) this._loggedUnresolvedReads.add(u.ref);
+		this._ctx?.logger?.warn?.("settings read: a stored secret is unavailable — it reads as its marker, not as a value", { meta: { secrets: fresh.map((u) => ({
+			ref: u.ref,
+			reason: u.reason
+		})) } });
+	}
 	/** Re-resolve the config (a keychain-only change, or a retry) and apply it. */
 	scheduleSecretReresolve(delayMs) {
 		const timerOf = delayMs === SECRET_CHANGE_DEBOUNCE_MS ? "_secretChangeTimer" : "_secretRetryTimer";
@@ -7148,7 +7570,7 @@ var BaseAddon = class {
 	* `{}` (defaults) — the addon's first successful patch will rehydrate.
 	*/
 	async readAddonStoreWithRetry() {
-		const settings = this._ctx?.settings;
+		const settings = this.rawSettings();
 		if (!settings) return {};
 		const delaysMs = [
 			150,
@@ -9501,6 +9923,278 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
+* The trainer contract — what the hub hands the cloud trainer and what it
+* gets back (cloud training, D805+).
+*
+* The trainer (`hf/camstack-trainer`, published as the Hugging Face repo
+* `camstack/camstack-trainer`) is a separate AGPL program the hub never
+* imports: `job.json` goes in, files come out, and progress is `CAMSTACK_EVENT`
+* lines on stdout. These schemas are the hub's half of that boundary; the
+* trainer's pydantic models (and the JSON Schemas generated from them under
+* `hf/camstack-trainer/schemas/`) are the other half. A change here is a
+* change there, in the same piece of work.
+*
+* No `.default()` anywhere: defaults do not run on the addon cap path, so the
+* orchestrator fills every field of a job spec explicitly.
+*/
+var TRAINING_JOB_SCHEMA = "camstack.training/v1";
+var TRAINING_RESULT_SCHEMA = "camstack.training-result/v1";
+/** What the trainer can export. Edge TPU is a later, separate image. */
+var TrainingExportSchema = _enum([
+	"onnx",
+	"openvino-fp16",
+	"openvino-int8",
+	"coreml-fp16"
+]);
+var FloorsSchema = record(string(), number().min(0).max(1));
+object({
+	schema: literal(TRAINING_JOB_SCHEMA),
+	jobKey: string().uuid(),
+	target: object({
+		kind: literal("detector"),
+		step: literal("object-detection")
+	}),
+	base: object({
+		modelId: string().min(1),
+		/** Ultralytics weights id, e.g. `yolov9m.pt`. */
+		weights: string().min(1),
+		imgsz: number().int().positive()
+	}),
+	baseline: object({
+		modelId: string().min(1),
+		/** The baseline ONNX the holdout comparison runs; public mirror URL. */
+		onnxUrl: string().url(),
+		imgsz: number().int().positive(),
+		floors: FloorsSchema
+	}),
+	dataset: object({
+		versionId: string().min(1),
+		annotationHash: string(),
+		/** sha256 of the uploaded archive; the trainer refuses a mismatch (exit 65). */
+		sha256: string().regex(/^[0-9a-f]{64}$/)
+	}),
+	split: object({
+		holdoutCameras: array(number().int()),
+		/** When no camera is held out: the last N days of every camera. */
+		holdoutLastDays: number().int().nonnegative(),
+		valFraction: number().min(0).max(.5),
+		seed: number().int()
+	}),
+	hyper: object({
+		epochs: number().int().positive(),
+		batch: number().int().positive(),
+		lr0: number().positive(),
+		/** Layers frozen from the start of the backbone; 0 = none. */
+		freeze: number().int().nonnegative(),
+		patience: number().int().nonnegative(),
+		seed: number().int()
+	}),
+	replay: object({
+		source: literal("coco2017"),
+		count: number().int().nonnegative()
+	}),
+	exports: array(TrainingExportSchema).min(1),
+	calibration: object({ maxFrames: number().int().positive() }),
+	floors: object({
+		minSupport: number().int().positive(),
+		clamp: number().min(0).max(1)
+	}),
+	int8Gate: object({ maxMap50Drop: number().min(0).max(1) }),
+	catalog: object({
+		id: string().regex(/^[a-z0-9][a-z0-9-]{2,80}$/),
+		name: string().min(1).max(160)
+	})
+});
+/** One regular file of the bundle. An mlpackage contributes one row per member. */
+var TrainingResultFileSchema = object({
+	path: string().min(1),
+	bytes: number().int().nonnegative(),
+	sha256: string().regex(/^[0-9a-f]{64}$/),
+	format: _enum([
+		"onnx",
+		"openvino",
+		"coreml",
+		"pt"
+	]),
+	variant: _enum(["base", "int8"])
+});
+var DraftFormatSchema = object({
+	/** RELATIVE path inside the bundle; the hub rewrites it to `camstack-local://`. */
+	url: string().min(1),
+	sizeMB: number().nonnegative(),
+	isDirectory: boolean().optional(),
+	files: array(string()).optional(),
+	runtimes: array(literal("python")).optional(),
+	revision: string().min(1)
+});
+/** The trainer's half of a catalog entry; the hub completes it (labels, licence, group). */
+var TrainingCatalogDraftSchema = object({
+	id: string().min(1),
+	name: string().min(1),
+	description: string(),
+	labels: array(unknown()),
+	inputSize: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	preprocessMode: literal("letterbox"),
+	defaultClassFloors: FloorsSchema,
+	formats: object({
+		onnx: DraftFormatSchema.optional(),
+		openvino: DraftFormatSchema.optional(),
+		coreml: DraftFormatSchema.optional()
+	})
+});
+/** One class of one model's holdout report (the eval harness's summary). */
+var TrainingEvalClassSchema = object({
+	positives: number().int(),
+	floor: number().nullable(),
+	tp: number().int(),
+	fp: number().int(),
+	fn: number().int(),
+	precision: number().nullable(),
+	recall: number().nullable(),
+	ap50: number().nullable(),
+	recallByCamera: record(string(), number().nullable()).optional(),
+	recallByLight: record(string(), number().nullable()).optional(),
+	fpByCamera: record(string(), number()).optional(),
+	smallFound: number().int().optional(),
+	smallTotal: number().int().optional()
+}).passthrough();
+var TrainingEvalReportSchema = object({
+	frames: number().int(),
+	classes: record(string(), TrainingEvalClassSchema)
+}).passthrough();
+/**
+* A succeeded result carries every block; a failed one carries the error and
+* whatever was known by then — the other blocks are ABSENT, not null. The
+* orchestrator checks the blocks it needs before it trusts a success.
+*/
+var TrainingResultSchema = object({
+	schema: literal(TRAINING_RESULT_SCHEMA),
+	jobKey: string(),
+	status: _enum(["succeeded", "failed"]),
+	error: object({
+		stage: string(),
+		code: string(),
+		message: string()
+	}).nullable(),
+	trainer: object({
+		version: string(),
+		revision: string()
+	}),
+	toolchain: record(string(), string().nullable()),
+	dataset: object({
+		versionId: string(),
+		annotationHash: string(),
+		sha256: string(),
+		frames: object({
+			train: number().int(),
+			val: number().int(),
+			holdout: number().int()
+		}),
+		holdoutCameras: array(number().int()),
+		replayImages: number().int()
+	}).optional(),
+	training: object({
+		epochsRun: number().int(),
+		bestEpoch: number().int(),
+		bestMap50: number(),
+		bestMap50_95: number(),
+		seconds: number()
+	}).optional(),
+	evaluation: object({
+		holdoutFrames: number().int(),
+		baseline: TrainingEvalReportSchema.nullable(),
+		candidate: TrainingEvalReportSchema.nullable(),
+		candidateInt8: TrainingEvalReportSchema.nullable(),
+		recallDeltaByCamera: record(string(), record(string(), number())).nullable(),
+		map50: record(string(), number().nullable())
+	}).optional(),
+	floors: object({
+		baseline: FloorsSchema,
+		candidate: FloorsSchema,
+		candidateInt8: FloorsSchema.nullable(),
+		notes: array(string())
+	}).optional(),
+	int8: object({
+		kept: boolean(),
+		map50Fp16: number().nullable(),
+		map50Int8: number().nullable(),
+		reason: string().nullable()
+	}).optional(),
+	exportsDropped: array(object({
+		export: string(),
+		reason: string()
+	})).optional(),
+	files: array(TrainingResultFileSchema).optional(),
+	bundle: object({
+		path: literal("bundle.tar"),
+		bytes: number().int().nonnegative(),
+		sha256: string().regex(/^[0-9a-f]{64}$/)
+	}).nullable().optional(),
+	catalogDraft: object({
+		base: TrainingCatalogDraftSchema,
+		int8: TrainingCatalogDraftSchema.nullable()
+	}).nullable().optional(),
+	licence: string()
+});
+var TrainingStageSchema = _enum([
+	"prepare",
+	"replay",
+	"train",
+	"eval",
+	"export",
+	"package"
+]);
+var EventBase = {
+	v: literal(1),
+	ts: number()
+};
+discriminatedUnion("type", [
+	object({
+		...EventBase,
+		type: literal("stage"),
+		stage: TrainingStageSchema
+	}),
+	object({
+		...EventBase,
+		type: literal("epoch"),
+		epoch: number().int(),
+		epochs: number().int(),
+		boxLoss: number().nullable().optional(),
+		map50: number().nullable().optional(),
+		map50_95: number().nullable().optional(),
+		etaSec: number().nullable().optional()
+	}),
+	object({
+		...EventBase,
+		type: literal("metric"),
+		name: string(),
+		value: number()
+	}),
+	object({
+		...EventBase,
+		type: literal("artifact"),
+		path: string(),
+		bytes: number(),
+		sha256: string()
+	}),
+	object({
+		...EventBase,
+		type: literal("done"),
+		status: _enum(["succeeded", "failed"]),
+		resultSha256: string().nullable().optional()
+	}),
+	object({
+		...EventBase,
+		type: literal("error"),
+		stage: string(),
+		code: string(),
+		message: string()
+	})
+]);
+/**
 * What the gate decided about a birth, from the CALLER's point of view.
 *
 * Deliberately not `ConfirmationVerdict`: `undecided` is not a birth decision
@@ -11548,6 +12242,20 @@ var ConvertResultSchema = object({
 		files: array(string()).readonly()
 	})).readonly()
 });
+/**
+* The cookie that binds an SSO sign-in to the browser that started it.
+*
+* An IdP `/start` sets it to a random value and keeps only its SHA-256 in the
+* server-side pending state; the login bridge carries that hash. The hub's
+* `/api/auth/sso/finish` swaps a bridge for a session only when the request
+* presents the cookie whose hash the bridge names — so a bridge copied out of
+* a URL (history, a proxy log, a screenshot) is useless in any other browser.
+* The finish clears the cookie, and records the bridge's `jti` so the same
+* bridge never finishes twice.
+*
+* One name, two readers (the OIDC addon that sets it, the hub that checks it).
+*/
+var SSO_STATE_COOKIE = "camstack_sso_state";
 var ExpressionBindingSourceSchema = union([
 	object({
 		kind: literal("field").optional(),
@@ -11828,7 +12536,9 @@ var AddonHttpRouteSchema = object({
 		"authenticated",
 		"admin"
 	]).optional(),
-	description: string().optional()
+	description: string().optional(),
+	/** The hub limits this route per client address before the handler runs. */
+	rateLimit: _enum(["auth"]).optional()
 });
 /**
 * Cross-process route invocation envelope. The hub captures the
@@ -12584,6 +13294,37 @@ var BackupDestinationInfoSchema = object({
 	lastError: string().optional()
 });
 /**
+* How an archive is encrypted (operator decision 2026-10-09): to a backup
+* PUBLIC key the hub holds, so only the operator's secret key opens it.
+* Absent on a plain `.tar.gz` — every archive made before encryption, or
+* with it off — which restores without a key.
+*/
+var BackupArchiveEncryptionSchema = object({
+	/** `x25519-hkdf-aes256gcm-stream-v1`. */
+	scheme: string(),
+	/** 16 hex — the backup key whose secret restores this archive. */
+	keyId: string()
+});
+/**
+* The backup encryption setting. The hub keeps PUBLIC keys only: the active
+* one new archives are encrypted to, and the retired ones older archives
+* still need. The secret key is shown once, at `setupEncryption`.
+*/
+var BackupEncryptionStatusSchema = object({
+	enabled: boolean(),
+	active: object({
+		keyId: string(),
+		publicKey: string(),
+		createdAt: number()
+	}).nullable(),
+	/** Every key ever set up, newest first. */
+	keys: array(object({
+		keyId: string(),
+		createdAt: number(),
+		retiredAt: number().nullable()
+	})).readonly()
+});
+/**
 * Per-archive entry returned by `backup.listArchives({ destinationId })`.
 * Same shape the destination drill-in renders. Sourced from the per-
 * location `manifests.json` (no per-archive tarball read required).
@@ -12595,7 +13336,9 @@ var BackupArchiveEntrySchema = object({
 	sizeBytes: number(),
 	label: string().optional(),
 	/** Top-level locations included in the archive (db, addons, tls, …). */
-	locations: array(string()).readonly()
+	locations: array(string()).readonly(),
+	/** Present when the archive is encrypted; restore then needs that key. */
+	encryption: BackupArchiveEncryptionSchema.optional()
 });
 var BackupEntrySchema = object({
 	id: string(),
@@ -12604,7 +13347,8 @@ var BackupEntrySchema = object({
 	label: string().optional(),
 	createdAt: number(),
 	sizeBytes: number(),
-	locations: array(string()).optional()
+	locations: array(string()).optional(),
+	encryption: BackupArchiveEncryptionSchema.optional()
 });
 var ArchiveEntrySchema = object({
 	path: string(),
@@ -12793,10 +13537,40 @@ method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }
 	* this list and skips entries whose path doesn't start with
 	* any of them.
 	*/
-	locations: array(string()).optional()
+	locations: array(string()).optional(),
+	/**
+	* The backup SECRET key, for an encrypted archive (ignored for a plain
+	* one). The archive is decrypted into the hub's private staging
+	* before the restart; the key is not stored. A wrong or missing key
+	* is refused before the archive is downloaded.
+	*/
+	backupSecretKey: string().optional()
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(_void(), BackupEncryptionStatusSchema, { auth: "admin" }), method(object({}), object({
+	keyId: string(),
+	secretKey: string(),
+	publicKey: string(),
+	createdAt: number(),
+	replacedKeyId: string().nullable()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({ disabledKeyId: string().nullable() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ backupSecretKey: string() }), object({
+	valid: boolean(),
+	keyId: string().nullable(),
+	/** The hub knows this key (active or retired). */
+	known: boolean(),
+	/** It is the key new archives are encrypted to. */
+	active: boolean(),
+	error: string().optional()
+}), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	destinationId: string(),
 	backupId: string()
@@ -14420,7 +15194,60 @@ var CustomModelDescriptorSchema = object({
 	stepId: string(),
 	entry: ModelCatalogEntrySchema
 });
-method(_void(), array(CustomModelDescriptorSchema).readonly(), { auth: "admin" });
+/** One regular file of an imported bundle, as the producer measured it. */
+var ModelBundleFileSchema = object({
+	/** Relative path inside the bundle tar; an mlpackage member is `<x>.mlpackage/<member>`. */
+	path: string().min(1),
+	bytes: number().int().nonnegative(),
+	sha256: string().regex(/^[0-9a-f]{64}$/)
+});
+var ImportModelBundleInputSchema = object({
+	/** The registry provider that keeps the model (Model Studio). */
+	addonId: string(),
+	stepId: string().min(1),
+	/**
+	* The catalog rows to register, complete, every format URL already
+	* `camstack-local://<modelId>/<file>` naming a file of the bundle. One
+	* bundle may carry several rows (a base and its INT8 variant).
+	*/
+	entries: array(ModelCatalogEntrySchema).min(1).max(4),
+	/** The bundle tar, offered by the producer over `ctx.peerBytes` (same host). */
+	bundle: object({
+		ticket: PeerBytesTicketSchema,
+		bytes: number().int().positive(),
+		sha256: string().regex(/^[0-9a-f]{64}$/)
+	}),
+	/** Every file the tar must hold; anything missing, extra or different is refused. */
+	files: array(ModelBundleFileSchema).min(1).max(64),
+	/** Convert missing engine formats and push the model to every agent afterwards. */
+	distribute: boolean()
+});
+var ImportModelBundleResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("imported"),
+	modelIds: array(string()).readonly(),
+	distributed: array(object({
+		modelId: string(),
+		nodeId: string(),
+		format: _enum(MODEL_FORMATS),
+		ok: boolean(),
+		error: string().optional()
+	})).readonly()
+}), object({
+	kind: literal("refused"),
+	reason: _enum([
+		"transfer-failed",
+		"checksum-mismatch",
+		"bundle-mismatch",
+		"invalid-entry",
+		"id-taken"
+	]),
+	detail: string()
+})]);
+method(_void(), array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }), method(ImportModelBundleInputSchema, ImportModelBundleResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 30 * 6e4
+});
 /**
 * Query filter for settings-store collections.
 */
@@ -14899,6 +15726,35 @@ var KeychainKeySourceSchema = object({
 	*/
 	sharesBackupWithDatabase: boolean()
 });
+/**
+* One keychain reset, as the Secrets page reports it until the operator
+* acknowledges it. Never a value: refs, counts and table names only.
+*/
+var KeychainResetRecordSchema = object({
+	id: string(),
+	at: number(),
+	/** `user:<id>` or {@link KEYCHAIN_RESET_TRIGGER_ACTOR}. */
+	actor: string(),
+	/** Why the keychain was locked when it was reset; `null` when it was not locked. */
+	lockedReason: string().nullable(),
+	/** Values moved into the archive table (ciphertext under the lost key). */
+	archived: number().int(),
+	/** `keychain:secrets-orphaned-<ts>`, or `null` when nothing was stored. */
+	archivedCollection: string().nullable(),
+	/**
+	* `keychain:keys-orphaned-<ts>`: the wrapped data keys of the archive, kept
+	* so the archive can still be opened if the lost master key turns up.
+	*/
+	archivedKeysCollection: string().nullable(),
+	/**
+	* `system-settings` keys whose marker the reset cleared — the cluster
+	* secret's: a marker left pointing at an archived value would refuse every
+	* agent forever (D797).
+	*/
+	clearedSettingsKeys: array(string()).readonly(),
+	/** When an operator dismissed the notice on the Secrets page; `null` until then. */
+	acknowledgedAt: number().nullable()
+});
 var KeychainStatusSchema = object({
 	keychain: KeychainStateSchema,
 	/** The source of the master key in use; `null` while locked. */
@@ -14916,7 +15772,9 @@ var KeychainStatusSchema = object({
 	/** Wrapped copies of the data key under a previous master key, kept until purged. */
 	retiredWraps: number().int(),
 	recoveryKeyDownloadedAt: number().nullable(),
-	secretCount: number().int()
+	secretCount: number().int(),
+	/** The most recent reset, acknowledged or not; `null` when the keychain was never reset. */
+	lastReset: KeychainResetRecordSchema.nullable()
 });
 /**
 * Whether a stored value is still pointed at by its owner's settings.
@@ -14938,13 +15796,14 @@ var KeychainAuditActionSchema = _enum([
 	"download-recovery-key",
 	"delete-orphans",
 	"reset",
+	"acknowledge-reset",
 	"initialize"
 ]);
 var KeychainAuditEntrySchema = object({
 	id: string(),
 	at: number(),
 	action: KeychainAuditActionSchema,
-	/** `addon:<id>` | `user:<id>` | `system`. */
+	/** `addon:<id>` | `user:<id>` | `system` | `trigger-file`. */
 	actor: string(),
 	ref: string().nullable(),
 	detail: string().nullable()
@@ -15010,6 +15869,13 @@ method(object({}), KeychainStatusSchema, { auth: "admin" }), method(object({}),
 	kind: "mutation",
 	auth: "admin",
 	caller: "required"
+}), method(object({}), object({
+	reset: KeychainResetRecordSchema.nullable(),
+	pendingReentry: array(KeychainSecretMetaSchema).readonly()
+}), { auth: "admin" }), method(object({}), object({ acknowledged: boolean() }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
 });
 method(_void(), object({
 	id: string(),
@@ -17655,7 +18521,7 @@ method(LogEntrySchema, _void(), { kind: "mutation" }), method(object({
 * `login-method` — collection cap through which auth addons contribute
 * their pre-auth login surfaces to the login page. This is the SINGLE,
 * generic mechanism that supersedes the dead `auth.listProviders` reader:
-* every auth addon (OIDC, magic-link, WebAuthn/passkey) registers a
+* every auth addon (OIDC, WebAuthn/passkey) registers a
 * `login-method` provider and the PUBLIC `auth.listLoginMethods`
 * procedure aggregates them for the unauthenticated login page.
 *
@@ -17663,8 +18529,7 @@ method(LogEntrySchema, _void(), { kind: "mutation" }), method(object({
 *
 *  - `redirect` — a declarative button. The login page renders a generic
 *    button that navigates to `startUrl` (an addon-owned HTTP route).
-*    Covers OIDC (`/addon/auth-oidc/<id>/start`) and magic-link with
-*    ZERO shell-side JS. A future SSO addon plugs in the same way — the
+*    Covers OIDC (`/addon/auth-oidc/<id>/start`) with ZERO shell-side JS. A future SSO addon plugs in the same way — the
 *    login page needs NO change.
 *
 *  - `widget` — a Module-Federation widget the login page mounts (via
@@ -17683,8 +18548,8 @@ method(LogEntrySchema, _void(), { kind: "mutation" }), method(object({
 *    decision.
 *
 * Every contribution carries a `stage`:
-*  - `primary`        — shown on the first credentials screen (OIDC /
-*                       magic-link buttons; a future usernameless passkey).
+*  - `primary`        — shown on the first credentials screen (OIDC
+*                       buttons; a usernameless passkey).
 *  - `second-factor`  — shown AFTER the password leg, gated on the
 *                       returned `factors` (passkey-as-2FA today).
 *
@@ -17711,7 +18576,7 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		* The provider names an external identity a signed-in user can link to
 		* their own account (D782): `auth.listLinkableProviders` /
 		* `beginExternalLink` offer exactly the redirect methods that set this,
-		* whatever their id. Absent / false — a login button only (magic-link).
+		* whatever their id. Absent / false — a login button only.
 		*/
 		linkable: boolean().optional()
 	}),
@@ -21536,8 +22401,7 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 * `super_admin` — collapsed onto the single boolean because every
 * non-admin caller is governed by the same scope-check rules; the
 * distinction was only ever used to route role-specific procedures
-* which we no longer have. Agents are admin sessions issued via
-* `createServiceToken`; CLI / webhook integrations are `cst_*` tokens
+* which we no longer have. CLI / webhook integrations are `cst_*` tokens
 * with `isAdmin: false` + an explicit scope list.
 */
 /** Per-method access flavour. Materialised on every cap method via codegen. */
@@ -24232,6 +25096,17 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 60 * 6e4
+}), method(object({
+	filter: RetrainExportFilterSchema,
+	layout: RetrainExportLayoutSchema
+}), object({
+	ticket: PeerBytesTicketSchema,
+	frames: number().int(),
+	annotations: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 12e4
 }), method(object({
 	selection: RetrainDatasetSelectionSchema,
 	completeOnly: boolean().optional()
@@ -27800,8 +28675,8 @@ version: string().optional() }), ServerUpdateActionResultSchema, {
 * `smtp-provider` — pluggable email delivery surface.
 *
 * Collection cap: a deployment may install multiple SMTP relays (e.g.
-* one for transactional / one for notifications). Consumers (magic-link,
-* notifier addons, …) walk the collection and pick the first
+* one for transactional / one for notifications). Consumers (notifier
+* addons, …) walk the collection and pick the first
 * ready provider OR target a specific addonId.
 *
 * The shape stays small on purpose — `sendEmail` is enough for the
@@ -27980,7 +28855,7 @@ targets: array(object({
 })));
 /**
 * `sso-bridge` — internal hub-only cap that lets SSO-style auth
-* providers (OIDC, SAML, magic-link, …) mint an HMAC-signed token
+* providers (OIDC, SAML, …) mint an HMAC-signed token
 * carrying the post-callback claims before redirecting back to
 * `/api/auth/sso/finish`.
 *
@@ -28043,7 +28918,14 @@ var SsoBridgeClaimsSchema = object({
 	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
 	* subject is unique only per issuer, so a link is bound to it.
 	*/
-	issuer: string().optional()
+	issuer: string().optional(),
+	/**
+	* SHA-256 (hex) of the `camstack_sso_state` cookie the IdP `/start` set in
+	* the browser that began this sign-in. `/api/auth/sso/finish` requires the
+	* request to present the matching cookie — a login bridge is useless in
+	* any other browser.
+	*/
+	browserBinding: string().optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
@@ -33970,7 +34852,13 @@ var TopologyNodeSchema = object({
 	})).readonly(),
 	processes: array(TopologyProcessSchema).readonly(),
 	categories: array(TopologyCategorySchema).readonly(),
-	rootPackage: TopologyRootPackageSchema.nullable()
+	rootPackage: TopologyRootPackageSchema.nullable(),
+	/**
+	* How an online AGENT reaches the hub (mesh mTLS Release A): `tls` once it has
+	* completed a mutual-TLS handshake, `clear` otherwise. Absent for the hub,
+	* for offline rows and when the hub cannot tell.
+	*/
+	meshTransport: _enum(["tls", "clear"]).optional()
 });
 var CapUsageEdgeSchema = object({
 	callerAddonId: string(),
@@ -37998,16 +38886,6 @@ var ApiKeySummarySchema = object({
 	createdAt: number(),
 	lastUsedAt: number().optional()
 });
-var CreateApiKeyInputSchema = object({
-	label: string(),
-	isAdmin: boolean().default(false),
-	allowedProviders: union([array(string()), literal("*")]).optional(),
-	allowedDevices: record(string(), union([array(string()), literal("*")])).optional()
-});
-var CreateApiKeyResultSchema = object({
-	token: string(),
-	record: ApiKeySummarySchema
-});
 var ScopedTokenSummarySchema = object({
 	id: string(),
 	userId: string(),
@@ -38106,17 +38984,10 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 }), UserSummarySchema.extend({ passwordHash: string() }).nullable(), {
 	kind: "mutation",
 	access: "view"
-}), method(_void(), array(ApiKeySummarySchema), { auth: "admin" }), method(CreateApiKeyInputSchema, CreateApiKeyResultSchema, {
-	kind: "mutation",
-	auth: "admin",
-	access: "create"
-}), method(object({ id: string() }), object({ success: literal(true) }), {
+}), method(_void(), array(ApiKeySummarySchema), { auth: "admin" }), method(object({ id: string() }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
-}), method(object({ token: string() }), ApiKeySummarySchema.nullable(), {
-	kind: "mutation",
-	access: "view"
 }), method(CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -38190,15 +39061,7 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 }).nullable(), { access: "view" }), method(object({ userId: string() }), array(ExternalIdentitySchema), { auth: "admin" }), method(ExternalIdentityKeySchema, object({
 	userId: string(),
 	issuer: string()
-}).nullable(), { auth: "admin" }), method(ExternalIdentityKeySchema.extend({
-	userId: string(),
-	issuer: string().min(1),
-	label: string().optional()
-}), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin",
-	access: "create"
-}), method(ExternalIdentityKeySchema.extend({ userId: string() }), object({ success: boolean() }), {
+}).nullable(), { auth: "admin" }), method(ExternalIdentityKeySchema.extend({ userId: string() }), object({ success: boolean() }), {
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
@@ -38593,6 +39456,451 @@ DeviceType.Camera, method(object({
 	detection: array(ZoneRuleSchema).readonly(),
 	package: array(ZoneRuleSchema).readonly()
 });
+/**
+* `training-provider` — ONE cloud that can run the CamStack trainer.
+*
+* A thin, mockable translation layer: it knows how to run a container with a
+* GPU, move a dataset in, read the job's stdout and hand artefacts back. It
+* knows nothing about datasets, splits, floors, cost policy or Model Studio —
+* those are the `training` orchestrator's (D805). Every rule written there
+* once is what makes a second provider (RunPod, a local NVIDIA node) a new
+* manifest entry and nothing else.
+*
+* Collection, routed by the `addonId` in every single-row input (the `llm` /
+* `notification-output` posture); `describe` concat-fans across providers.
+* Every method is `admin`: these spend money.
+*
+* Every cloud object a provider creates is tagged with the orchestrator's
+* `jobKey`, so a retried submit finds the job it already started instead of
+* starting a second GPU, and `listJobs` can find orphans.
+*
+* Bytes never ride a cap field: the dataset arrives as a `ctx.peerBytes`
+* ticket the producer (pipeline-analytics) minted, and artefacts leave as a
+* ticket the provider mints (D613).
+*/
+var TrainingGpuOptionSchema = object({
+	id: string(),
+	label: string(),
+	/** List price, USD per GPU-hour, before any region multiplier. */
+	usdPerHour: number().nonnegative(),
+	vramGb: number().nonnegative()
+});
+var TrainingRegionOptionSchema = object({
+	/** `''` = any region (the provider's choice). */
+	id: string(),
+	label: string(),
+	priceMultiplier: number().positive()
+});
+/**
+* The provider's per-account settings, as the orchestrator reads them. They
+* live in the PROVIDER addon's settings (operator decision 2026-10-08: they
+* depend on the user's account), never hard-coded in the orchestrator.
+*/
+var TrainingProviderDefaultsSchema = object({
+	gpuType: string(),
+	region: string(),
+	costCapUsd: number().nonnegative(),
+	maxRuntimeSec: number().int().positive(),
+	/** Hours a FAILED job's cloud dataset is kept for debugging; 0 = delete at once. */
+	failedDatasetGraceHours: number().nonnegative()
+});
+var TrainingProviderDescriptorSchema = object({
+	addonId: string(),
+	/** `modal`, `runpod`, `fake`, … */
+	kind: string(),
+	label: string(),
+	gpuTypes: array(TrainingGpuOptionSchema).readonly(),
+	regions: array(TrainingRegionOptionSchema).readonly(),
+	maxDatasetBytes: number().int().positive(),
+	maxRuntimeSec: number().int().positive(),
+	freeTierNote: string().optional(),
+	/** Where the data goes, in one sentence the confirm dialog repeats. */
+	dataResidencyNote: string(),
+	/** Credentials are present — never the values. */
+	configured: boolean(),
+	defaults: TrainingProviderDefaultsSchema
+});
+var TrainingCredentialCheckSchema = object({
+	ok: boolean(),
+	/** Workspace / account name, when the provider says. */
+	account: string().optional(),
+	reason: _enum([
+		"missing",
+		"invalid",
+		"forbidden",
+		"network",
+		"quota"
+	]).optional(),
+	detail: string().optional()
+});
+var ProviderJobStateSchema = _enum([
+	"pending",
+	"starting",
+	"running",
+	"succeeded",
+	"failed",
+	"cancelled",
+	"lost"
+]);
+var ProviderJobStatusSchema = object({
+	jobKey: string(),
+	providerJobId: string().optional(),
+	state: ProviderJobStateSchema,
+	startedAt: number().optional(),
+	endedAt: number().optional(),
+	exitCode: number().int().optional(),
+	failureReason: string().optional(),
+	gpuType: string(),
+	region: string().optional(),
+	billedSeconds: number().nonnegative(),
+	costUsd: number().nonnegative(),
+	/** True when `costUsd` is runtime × list price, not a billing answer. */
+	costIsEstimate: boolean(),
+	lastFetchedAt: number()
+});
+/**
+* The trainer the job runs, by SOURCE revision: the provider turns it into an
+* image its own way (Modal builds the published Dockerfile at that revision;
+* a registry-pull provider maps it to a tag). Recorded on the job and echoed
+* in `result.json`.
+*/
+var TrainerSourceRefSchema = object({
+	/** Hugging Face repo id, e.g. `camstack/camstack-trainer`. */
+	repo: string().min(1),
+	/** A commit sha (never a branch) — the job must be reproducible. */
+	revision: string().regex(/^[0-9a-f]{7,64}$/)
+});
+var JobRef = {
+	addonId: string(),
+	jobKey: string().uuid()
+};
+var TrainingLogLineSchema = object({
+	ts: number(),
+	text: string()
+});
+method(object({}), array(TrainingProviderDescriptorSchema).readonly(), { auth: "admin" }), method(object({ addonId: string() }), TrainingCredentialCheckSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 3e4
+}), method(object({
+	addonId: string(),
+	gpuType: string(),
+	region: string(),
+	datasetBytes: number().int().nonnegative(),
+	gpuSecondsLow: number().nonnegative(),
+	gpuSecondsHigh: number().nonnegative()
+}), object({
+	usdLow: number().nonnegative(),
+	usdHigh: number().nonnegative(),
+	notes: array(string()).readonly()
+}), { auth: "admin" }), method(object({
+	...JobRef,
+	ticket: PeerBytesTicketSchema
+}), object({
+	bytes: number().int().nonnegative(),
+	sha256: string()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 120 * 6e4
+}), method(object({
+	...JobRef,
+	trainer: TrainerSourceRefSchema,
+	jobSpecJson: string().min(2).max(64e3),
+	gpuType: string(),
+	region: string(),
+	maxRuntimeSec: number().int().positive()
+}), ProviderJobStatusSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 30 * 6e4
+}), method(object(JobRef), ProviderJobStatusSchema, {
+	auth: "admin",
+	timeoutMs: 6e4
+}), method(object({
+	...JobRef,
+	cursor: string().optional(),
+	max: number().int().min(1).max(500)
+}), object({
+	lines: array(TrainingLogLineSchema).readonly(),
+	cursor: string()
+}), {
+	auth: "admin",
+	timeoutMs: 6e4
+}), method(object(JobRef), object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 6e4
+}), method(object(JobRef), object({
+	found: boolean(),
+	text: string().optional()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 5 * 6e4
+}), method(object({
+	...JobRef,
+	path: _enum(["bundle.tar"])
+}), object({ ticket: PeerBytesTicketSchema }), {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 5 * 6e4
+}), method(object(JobRef), object({ deleted: array(string()).readonly() }), {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 5 * 6e4
+}), method(object({ addonId: string() }), array(ProviderJobStatusSchema).readonly(), {
+	auth: "admin",
+	timeoutMs: 2 * 6e4
+});
+/**
+* `training` — the cloud-training orchestrator (D805). Hub-only singleton,
+* provided by `addon-training`.
+*
+* It owns what every provider must agree on, written once:
+*
+* - **Dataset versions.** Taken over from pipeline-analytics (D796): the rows
+*   live here (D808); pipeline-analytics still CUTS a version (it owns the corpus and
+*   the export plan) and reaches this store through the five row methods
+*   below, so the Retrain page and the export did not change.
+* - **Jobs.** A persisted state machine, a reconcile loop against the
+*   provider, a cost guard, a daily orphan sweep and the retention rules.
+* - **The return flow.** Verified artefacts → Model Studio
+*   (`custom-model-registry.importModelBundle`) → canary on cameras →
+*   rollback. Nothing is ever registered automatically.
+*
+* Every method is `admin`.
+*/
+/** A version WITH its frame list — what the export and a job read. */
+var TrainingDatasetVersionRowSchema = RetrainDatasetVersionSchema.omit({ frameCount: true }).extend({ frameIds: array(string()).max(2e4).readonly() });
+/** A base model a detector job can fine-tune, and the baseline it is judged against. */
+var TrainingBaseModelSchema = object({
+	modelId: string(),
+	label: string(),
+	weights: string(),
+	imgsz: number().int(),
+	baselineOnnxUrl: string(),
+	baselineFloors: record(string(), number()),
+	/** The base the fleet runs most — the UI's default. */
+	recommended: boolean()
+});
+var TrainingPresetSchema = _enum([
+	"quick",
+	"standard",
+	"thorough"
+]);
+var TrainingJobRequestSchema = object({
+	datasetVersionId: string().min(1),
+	/** The `training-provider` addon that runs it. */
+	addonId: string().min(1),
+	gpuType: string().min(1),
+	region: string(),
+	baseModelId: string().min(1),
+	preset: TrainingPresetSchema,
+	/** Freeze the backbone's first N layers; `null` = the preset's choice. */
+	freeze: number().int().nonnegative().nullable(),
+	/** Cameras held out whole for evaluation; `null` = the orchestrator's default. */
+	holdoutCameras: array(number().int()).nullable()
+});
+var TrainingSplitPlanSchema = object({
+	holdoutCameras: array(number().int()).readonly(),
+	/** Used when no camera is held out: the last N days of every camera. */
+	holdoutLastDays: number().int().nonnegative(),
+	/** Holdout subjects per class (camera holdout only; `null` = known only after the split). */
+	holdoutSupport: record(string(), number().int()).nullable(),
+	trainSubjects: number().int()
+});
+var TrainingRefusalReasonSchema = _enum([
+	"unknown-dataset",
+	"unknown-provider",
+	"provider-not-configured",
+	"unknown-base-model",
+	"unknown-gpu",
+	"dataset-too-large",
+	"no-training-subjects",
+	"job-already-running"
+]);
+var TrainingJobPlanSchema = object({
+	refusal: object({
+		reason: TrainingRefusalReasonSchema,
+		detail: string()
+	}).nullable(),
+	warnings: array(string()).readonly(),
+	split: TrainingSplitPlanSchema.nullable(),
+	estimate: object({
+		datasetBytes: number().int(),
+		uploadMinutesAt20Mbps: number(),
+		gpuSecondsLow: number(),
+		gpuSecondsHigh: number(),
+		usdLow: number(),
+		usdHigh: number(),
+		notes: array(string()).readonly()
+	}).nullable(),
+	/** Pre-filled from the provider's settings; the operator may lower or raise them. */
+	defaults: object({
+		maxCostUsd: number(),
+		maxRuntimeSec: number().int()
+	}).nullable(),
+	/** The sentence the confirm dialog repeats: where the frames go and when they are deleted. */
+	dataNotice: string()
+});
+/**
+* Orchestrator-owned states, persisted. `uploading` covers exporting the
+* archive (it is streamed, never staged). Terminal: `failed`, `cancelled`,
+* `lost`, `expired`, `discarded`. `registered` and `canary` are where a
+* result lives after the operator acted on it.
+*/
+var TrainingJobStateSchema = _enum([
+	"uploading",
+	"submitted",
+	"starting",
+	"running",
+	"collecting",
+	"ready",
+	"registered",
+	"canary",
+	"failed",
+	"cancelling",
+	"cancelled",
+	"lost",
+	"expired",
+	"discarded"
+]);
+var TrainingFailureReasonSchema = _enum([
+	"cost-cap",
+	"runtime-cap",
+	"upload-failed",
+	"submit-failed",
+	"trainer-failed",
+	"result-invalid",
+	"checksum-mismatch",
+	"fetch-failed",
+	"provider-error",
+	"hub-restart-during-upload"
+]);
+var TrainingProgressPointSchema = object({
+	epoch: number().int(),
+	map50: number().nullable(),
+	map50_95: number().nullable()
+});
+var TrainingCanarySchema = object({
+	deviceIds: array(number().int()).readonly(),
+	since: number(),
+	/** Every override the canary replaced, exactly, so rollback restores it. */
+	previous: array(object({
+		deviceId: number().int(),
+		nodeId: string(),
+		deviceKey: string(),
+		patch: object({
+			modelId: string().optional(),
+			settings: record(string(), unknown()).readonly().optional()
+		}).nullable()
+	})).readonly()
+});
+var TrainingJobSchema = object({
+	id: string(),
+	idempotencyKey: string(),
+	name: string(),
+	createdAt: number(),
+	updatedAt: number(),
+	state: TrainingJobStateSchema,
+	stage: TrainingStageSchema.nullable(),
+	failure: object({
+		reason: TrainingFailureReasonSchema,
+		stage: string().nullable(),
+		detail: string()
+	}).nullable(),
+	request: TrainingJobRequestSchema,
+	maxCostUsd: number().nonnegative(),
+	maxRuntimeSec: number().int().positive(),
+	trainer: TrainerSourceRefSchema,
+	datasetLayout: RetrainExportLayoutSchema,
+	dataset: object({
+		bytes: number().int(),
+		sha256: string(),
+		uploadedAt: number()
+	}).nullable(),
+	split: TrainingSplitPlanSchema,
+	provider: object({
+		state: ProviderJobStateSchema.nullable(),
+		providerJobId: string().nullable(),
+		startedAt: number().nullable(),
+		endedAt: number().nullable(),
+		billedSeconds: number(),
+		costUsd: number(),
+		costIsEstimate: boolean(),
+		lastPolledAt: number().nullable()
+	}),
+	progress: object({
+		epoch: number().int().nullable(),
+		epochs: number().int().nullable(),
+		etaSec: number().nullable(),
+		series: array(TrainingProgressPointSchema).readonly()
+	}),
+	/** The last lines of the job's output (≤ 200), newest last. Never frame paths. */
+	logTail: array(string()).readonly(),
+	logCursor: string().nullable(),
+	artifacts: object({
+		bundleBytes: number().int(),
+		bundleSha256: string(),
+		fetchedAt: number(),
+		/** When the staged artefacts are deleted from the hub. */
+		expiresAt: number()
+	}).nullable(),
+	/** When the provider-side copy of the frames was deleted; null while it exists. */
+	cloudDatasetDeletedAt: number().nullable(),
+	/** A failed job's dataset is kept until then (the provider's grace), then deleted. */
+	cloudCleanupDueAt: number().nullable(),
+	/** Model ids registered from this job (base, and int8 when kept). */
+	registeredModelIds: array(string()).readonly(),
+	canary: TrainingCanarySchema.nullable()
+});
+var IdInput = object({ id: string().min(1) });
+method(TrainingDatasetVersionRowSchema, object({ stored: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(IdInput, TrainingDatasetVersionRowSchema.nullable(), { auth: "admin" }), method(object({}), array(RetrainDatasetVersionSchema).readonly(), { auth: "admin" }), method(object({ name: string() }), object({ id: string().nullable() }), { auth: "admin" }), method(IdInput, object({ removed: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(TrainingBaseModelSchema).readonly(), { auth: "admin" }), method(TrainingJobRequestSchema, TrainingJobPlanSchema, {
+	auth: "admin",
+	timeoutMs: 6e4
+}), method(TrainingJobRequestSchema.extend({
+	name: string().min(1).max(120),
+	maxCostUsd: number().positive(),
+	maxRuntimeSec: number().int().positive(),
+	idempotencyKey: string().min(8).max(80)
+}), discriminatedUnion("kind", [object({
+	kind: literal("started"),
+	job: TrainingJobSchema
+}), object({
+	kind: literal("refused"),
+	reason: TrainingRefusalReasonSchema,
+	detail: string()
+})]), {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 12e4
+}), method(object({}), array(TrainingJobSchema).readonly(), { auth: "admin" }), method(IdInput, TrainingJobSchema.nullable(), { auth: "admin" }), method(IdInput, TrainingJobSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 12e4
+}), method(IdInput, TrainingResultSchema.nullable(), { auth: "admin" }), method(IdInput.extend({ canaryDeviceIds: array(number().int()).readonly() }), TrainingJobSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 30 * 6e4
+}), method(IdInput.extend({ deviceIds: array(number().int()).min(1).readonly() }), TrainingJobSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 12e4
+}), method(IdInput, TrainingJobSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 12e4
+}), method(IdInput, TrainingJobSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 SOURCE_CAPS.filter((cap) => cap !== "switch" && cap !== "motion");
 Object.freeze({
 	person: .5,
@@ -39216,6 +40524,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"backup.checkBackupKey": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"backup.delete": {
 		capName: "backup",
 		capScope: "system",
@@ -39228,6 +40542,18 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"backup.disableEncryption": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"backup.getEncryption": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"backup.getEntries": {
 		capName: "backup",
 		capScope: "system",
@@ -39282,6 +40608,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"backup.setupEncryption": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"backup.trigger": {
 		capName: "backup",
 		capScope: "system",
@@ -39834,6 +41166,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"customModelRegistry.importModelBundle": {
+		capName: "custom-model-registry",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"customModelRegistry.listModels": {
 		capName: "custom-model-registry",
 		capScope: "system",
@@ -41274,6 +42612,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"keychainAdmin.acknowledgeReset": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"keychainAdmin.deleteOrphans": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -41310,6 +42654,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"keychainAdmin.resetReport": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"keychainAdmin.reveal": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -43056,6 +44406,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.offerRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.ownersWithMedia": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -45594,6 +46950,174 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"training.canaryResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.cancelJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.discardResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.findDatasetVersionIdByName": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.getDatasetVersion": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.getJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.getJobResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.listBaseModels": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.listDatasetVersions": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.listJobs": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.planJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.putDatasetVersion": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.registerResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.removeDatasetVersion": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"training.rollbackCanary": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.startJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.cancelJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.cleanupJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.describe": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.estimateJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.getJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.listJobEvents": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.listJobs": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.offerArtifact": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.readResult": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.submitJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.uploadDataset": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.validateCredentials": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"turnProvider.getTurnServers": {
 		capName: "turn-provider",
 		capScope: "system",
@@ -45618,12 +47142,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"userManagement.createApiKey": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"userManagement.createScopedToken": {
 		capName: "user-management",
 		capScope: "system",
@@ -45660,12 +47178,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.linkExternalIdentity": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
@@ -45768,12 +47280,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"userManagement.validateApiKey": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.validateCredentials": {
 		capName: "user-management",
 		capScope: "system",
@@ -49891,6 +51397,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"training.canaryResult": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"update.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -50619,6 +52130,8 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
 	([...RULE_TEXT], [...UPDATES]),
 	([...RULE_TEXT], [...PACKAGE_UPDATES]),
 	([...RULE_TEXT], [...PACKAGE_UPDATES]),
@@ -51171,87 +52684,4 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
-Object.defineProperty(exports, "BaseAddon", {
-	enumerable: true,
-	get: function() {
-		return BaseAddon;
-	}
-});
-Object.defineProperty(exports, "addonRoutesCapability", {
-	enumerable: true,
-	get: function() {
-		return addonRoutesCapability;
-	}
-});
-Object.defineProperty(exports, "addonWidgetsSourceCapability", {
-	enumerable: true,
-	get: function() {
-		return addonWidgetsSourceCapability;
-	}
-});
-Object.defineProperty(exports, "array", {
-	enumerable: true,
-	get: function() {
-		return array;
-	}
-});
-Object.defineProperty(exports, "authProviderCapability", {
-	enumerable: true,
-	get: function() {
-		return authProviderCapability;
-	}
-});
-Object.defineProperty(exports, "boolean", {
-	enumerable: true,
-	get: function() {
-		return boolean;
-	}
-});
-Object.defineProperty(exports, "buildAddonRouteProvider", {
-	enumerable: true,
-	get: function() {
-		return buildAddonRouteProvider;
-	}
-});
-Object.defineProperty(exports, "errMsg", {
-	enumerable: true,
-	get: function() {
-		return errMsg;
-	}
-});
-Object.defineProperty(exports, "isDisplayIconKey", {
-	enumerable: true,
-	get: function() {
-		return isDisplayIconKey;
-	}
-});
-Object.defineProperty(exports, "loginMethodCapability", {
-	enumerable: true,
-	get: function() {
-		return loginMethodCapability;
-	}
-});
-Object.defineProperty(exports, "number", {
-	enumerable: true,
-	get: function() {
-		return number;
-	}
-});
-Object.defineProperty(exports, "object", {
-	enumerable: true,
-	get: function() {
-		return object;
-	}
-});
-Object.defineProperty(exports, "string", {
-	enumerable: true,
-	get: function() {
-		return string;
-	}
-});
-Object.defineProperty(exports, "userPasskeysCapability", {
-	enumerable: true,
-	get: function() {
-		return userPasskeysCapability;
-	}
-});
+export { buildAddonRouteProvider as a, userPasskeysCapability as c, array as d, boolean as f, string as h, authProviderCapability as i, errMsg as l, object as m, addonRoutesCapability as n, isDisplayIconKey as o, number as p, addonWidgetsSourceCapability as r, loginMethodCapability as s, SSO_STATE_COOKIE as t, BaseAddon as u };