@camstack/addon-auth 1.2.136 → 1.2.139

package/dist/{dist-DMFGQOff.mjs → dist-CiG_dP05.js}

@@ -1,3 +1,37 @@
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+require("node:crypto");
 //#region ../types/dist/event-category-DaIZi00R.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
@@ -5376,7 +5410,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-r3RWkGVx.mjs
+//#region ../types/dist/sleep-DwAQ9sqX.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -9315,6 +9349,16 @@ var CompositionSchema = object({
 		seen.add(feature.cap);
 	});
 });
+var NodeColorIdSchema = _enum([
+	"node-a",
+	"node-b",
+	"node-c",
+	"node-d",
+	"node-e",
+	"node-f",
+	"node-g",
+	"node-h"
+]);
 new Set([
 	"track",
 	"face",
@@ -18236,14 +18280,14 @@ var LlmProfileSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$1 = unknown();
+var ConfigSchemaPassthrough$3 = unknown();
 var LlmProfileKindDescriptorSchema = object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
-	configSchema: ConfigSchemaPassthrough$1
+	configSchema: ConfigSchemaPassthrough$3
 });
 var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
 var LlmDefaultSchema = object({
@@ -19372,7 +19416,7 @@ var TargetKindCapsSchema = object({
 * the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough = unknown();
+var ConfigSchemaPassthrough$2 = unknown();
 var TargetKindSchema = object({
 	kind: string(),
 	label: string(),
@@ -19409,7 +19453,7 @@ var TargetKindSchema = object({
 	* its raster path, which is the safe default for an unknown image.
 	*/
 	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough,
+	configSchema: ConfigSchemaPassthrough$2,
 	/**
 	* The config keys that decide WHERE this kind's secrets are sent (server,
 	* base URL, instance, chat, recipient). A save that changes any of them
@@ -22708,6 +22752,77 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
+* `oidc-connections` — CRUD for IdP rows under `auth-oidc` (D828 sibling).
+*
+* One hub-only singleton (`auth-oidc`). The Settings UI is a DataTable +
+* ItemFormDialog; there is no `editable-array` in `globalSettingsSchema`.
+* Operator-chosen `id` is the URL slug (`/addon/auth-oidc/<id>/…`) and is
+* immutable after create.
+*/
+var ConfigSchemaPassthrough$1 = unknown();
+var OidcConnectionSchema = object({
+	id: string().min(1),
+	displayName: string(),
+	icon: string(),
+	issuerUrl: string(),
+	clientId: string(),
+	/** Client id + secret present — never the secret value. */
+	configured: boolean(),
+	/**
+	* Values for the connection form schema. `clientSecret` is a keychain
+	* {@link SecretFieldView} or `null` / `''`, never plaintext (D789).
+	*/
+	formValues: record(string(), unknown()).optional()
+});
+/**
+* Patch one connection. Omitted or empty `clientSecret` keeps the stored
+* secret (D787). `{ $secretClear: true }` clears it. `id` is never renamed.
+*/
+var OidcConnectionUpdateInputSchema = object({
+	id: string().min(1),
+	displayName: string().min(1),
+	icon: string().optional(),
+	issuerUrl: string().optional(),
+	clientId: string().optional(),
+	clientSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
+	redirectUri: string().optional(),
+	scopes: string().optional(),
+	usernameClaim: _enum([
+		"preferred_username",
+		"email",
+		"sub"
+	]).optional()
+});
+var oidcConnectionsCapability = {
+	name: "oidc-connections",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/** Form fields for Add/Edit (ConfigFormBuilder). */
+		connectionFormSchema: method(object({}), ConfigSchemaPassthrough$1, { auth: "admin" }),
+		listConnections: method(object({}), array(OidcConnectionSchema).readonly(), { auth: "admin" }),
+		/**
+		* Create a row with the operator-chosen URL slug. Credentials follow via
+		* `updateConnection` (same Save path as Training Providers).
+		*/
+		createConnection: method(object({
+			id: string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug"),
+			displayName: string().min(1)
+		}), object({ id: string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		updateConnection: method(OidcConnectionUpdateInputSchema, object({ ok: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteConnection: method(object({ id: string().min(1) }), object({ ok: literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
 * What started a camera's onboard motion (D672). `camera` is the camera's own
 * firmware; `sensor` is a device the operator ATTACHED to it. Absent on the
 * wire means the camera: only the camera-sensors bridge ever says `sensor`.
@@ -24064,24 +24179,69 @@ var RetrainFrameListSchema = object({
 	/** What the page pre-selects — the native key frame when one survives. */
 	autoPickMediaId: number().int().optional()
 });
+/** Exclusive partition of a corpus copy's annotation progress (design §4.2). */
+var RetrainFrameWorkStateSchema = _enum([
+	"unannotated",
+	"annotated",
+	"complete"
+]);
+/**
+* Filters for paginated corpus list, KPI, and matching export (design §4.4).
+* Every narrowing field is ANDed; omitted fields impose no constraint.
+*/
+var RetrainCorpusFilterSchema = object({
+	workState: RetrainFrameWorkStateSchema.optional(),
+	deviceIds: array(number()).max(500).optional(),
+	/** When set, only frames in this named collection. */
+	collectionId: string().optional(),
+	/** Frames that carry at least one saved annotation in one of these classes. */
+	classes: array(RetrainMacroClassSchema).optional(),
+	page: number().int().positive().default(1),
+	pageSize: number().int().positive().max(100).default(50)
+});
+var RetrainCorpusPageSchema = object({
+	frames: array(RetrainFrameSchema.extend({ workState: RetrainFrameWorkStateSchema })).readonly(),
+	total: number().int().nonnegative(),
+	page: number().int().positive(),
+	pageSize: number().int().positive()
+});
+var RetrainCorpusKpiCameraRowSchema = object({
+	deviceId: number(),
+	unannotated: number().int().nonnegative(),
+	annotated: number().int().nonnegative(),
+	complete: number().int().nonnegative(),
+	/** This camera's `complete` count divided by corpus `total`, in `[0,1]`.
+	*  `null` when the corpus is empty (no ratio). */
+	pctOfCorpus: number().min(0).max(1).nullable()
+});
+var RetrainCorpusKpiSchema = object({
+	total: number().int().nonnegative(),
+	unannotated: number().int().nonnegative(),
+	annotated: number().int().nonnegative(),
+	complete: number().int().nonnegative(),
+	cameras: array(RetrainCorpusKpiCameraRowSchema).readonly()
+});
 /**
 * Which frames an annotated export carries. Every field narrows; an empty
-* filter is every annotated copy. A dataset VERSION is a frozen `frameIds`
-* list owned by whoever trains (the training orchestrator), so `frameIds` is
-* the primitive a version export uses; `batchId` re-selects what an earlier
-* export carried (`exportedInBatch`).
+* filter is every annotated copy. `frameIds` is the primitive a job or
+* download uses; `batchId` re-selects what an earlier export carried
+* (`exportedInBatch`). Frozen dataset versions were removed — live selection
+* resolves to `frameIds` at plan/start.
 */
 var RetrainExportFilterSchema = object({
 	deviceIds: array(number()).optional(),
 	frameIds: array(string()).max(2e4).optional(),
 	/** Only frames in at least one of these named collections. */
 	collectionIds: array(string()).max(200).optional(),
-	/** Exactly the frames of this dataset version (and its completeOnly). An
-	*  unknown id selects nothing. */
-	datasetVersionId: string().optional(),
+	/** Single collection (Frames filter bar). ANDed with `collectionIds` when both set. */
+	collectionId: string().optional(),
 	batchId: string().optional(),
 	/** Only frames the operator marked complete (all subjects boxed). */
-	completeOnly: boolean().optional()
+	completeOnly: boolean().optional(),
+	/** Exclusive work-state partition (`workStateOf`); same as the corpus list. */
+	workState: RetrainFrameWorkStateSchema.optional(),
+	/** Frames with at least one saved annotation in one of these classes. */
+	classes: array(RetrainMacroClassSchema).optional()
 });
 /**
 * `frames`: the full frame copies, boxes in `annotations.json`.
@@ -24281,8 +24441,7 @@ var RetrainDatasetStatsSchema = object({
 		completeFrames: number().int()
 	})).readonly()
 });
-/** An immutable dataset version, without its frame list. */
-var RetrainDatasetVersionSchema = object({
+object({
 	id: string(),
 	name: string(),
 	createdAt: number(),
@@ -24290,22 +24449,33 @@ var RetrainDatasetVersionSchema = object({
 	layout: RetrainExportLayoutSchema,
 	completeOnly: boolean(),
 	frameCount: number().int(),
-	/** sha256 of what the frames taught when the version was frozen. */
 	annotationHash: string(),
-	/** The export manifest schema the version was cut under. */
 	manifestSchema: string(),
 	stats: RetrainDatasetStatsSchema
 });
-var CreateRetrainDatasetVersionResultSchema = discriminatedUnion("kind", [object({
-	kind: literal("created"),
-	version: RetrainDatasetVersionSchema
+/**
+* Live training corpus criteria — same shape as `TrainingCorpusSelection` on
+* the training cap. Resolved here so plan/start and the annotated export share
+* one definition of "the frames" (`buildRetrainExportPlan`).
+*/
+var RetrainTrainingCorpusSelectionSchema = object({
+	collectionIds: array(string()).min(1),
+	workState: _enum([
+		"complete",
+		"annotated_or_complete",
+		"any_annotated"
+	]).default("complete")
+});
+var RetrainTrainingCorpusResolveResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("resolved"),
+	frameIds: array(string()).max(2e4).readonly(),
+	stats: RetrainDatasetStatsSchema,
+	annotationHash: string(),
+	layout: RetrainExportLayoutSchema
 }), object({
 	kind: literal("refused"),
-	reason: _enum([
-		"empty-name",
-		"duplicate-name",
-		"no-frames"
-	])
+	reason: _enum(["unknown-collection", "no-frames"]),
+	detail: string()
 })]);
 /** The outcome of a lifecycle move owned by the retrain page. */
 var RetrainTransitionResultSchema = object({
@@ -25012,6 +25182,12 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), array(RetrainTrackSchema).readonly(), {
 	kind: "query",
 	auth: "admin"
+}), method(RetrainCorpusFilterSchema, RetrainCorpusPageSchema, {
+	kind: "query",
+	auth: "admin"
+}), method(object({}), RetrainCorpusKpiSchema, {
+	kind: "query",
+	auth: "admin"
 }), method(object({ trackId: string() }), RetrainFrameListSchema, {
 	kind: "query",
 	auth: "admin"
@@ -25107,36 +25283,6 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 12e4
-}), method(object({
-	selection: RetrainDatasetSelectionSchema,
-	completeOnly: boolean().optional()
-}), RetrainDatasetStatsSchema, {
-	kind: "query",
-	auth: "admin"
-}), method(object({
-	name: string().max(120),
-	selection: RetrainDatasetSelectionSchema,
-	layout: RetrainExportLayoutSchema,
-	completeOnly: boolean()
-}), CreateRetrainDatasetVersionResultSchema, {
-	kind: "mutation",
-	auth: "admin",
-	timeoutMs: 12e4
-}), method(object({}), array(RetrainDatasetVersionSchema).readonly(), {
-	kind: "query",
-	auth: "admin"
-}), method(object({ id: string() }), object({ deleted: boolean() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ id: string() }), object({
-	found: boolean(),
-	annotationHash: string(),
-	matches: boolean(),
-	missingFrames: number().int()
-}), {
-	kind: "query",
-	auth: "admin",
-	timeoutMs: 12e4
 }), method(object({}), array(RetrainAssistProfileSchema).readonly(), {
 	kind: "query",
 	auth: "admin"
@@ -25163,6 +25309,10 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(object({}), array(RetrainCollectionSchema).readonly(), {
 	kind: "query",
 	auth: "admin"
+}), method(RetrainTrainingCorpusSelectionSchema, RetrainTrainingCorpusResolveResultSchema, {
+	kind: "query",
+	auth: "admin",
+	timeoutMs: 6e4
 }), method(object({
 	id: string(),
 	name: string().max(120)
@@ -25779,11 +25929,14 @@ var HardwareClassIdSchema = _enum([
 	"intel-n-series",
 	"apple-m-base",
 	"apple-m-pro",
+	"amd-phoenix",
 	"unknown"
 ]);
 var AcceleratorKindSchema = _enum([
 	"intel-npu",
 	"intel-igpu",
+	"amd-igpu",
+	"amd-npu",
 	"x86-cpu",
 	"arm-cpu",
 	"apple-ane",
@@ -27673,6 +27826,8 @@ var AgentPipelineSettingsSchema = object({
 	* address is wrong (multi-homed host, NAT, custom interface).
 	*/
 	reachableHost: string().optional(),
+	/** Hub-persisted UI colour (`--color-node-*` theme tokens). */
+	color: NodeColorIdSchema.optional(),
 	/**
 	* Multi-device inference opt-in (Phase 4). Per-node map deviceKey → {enabled,
 	* weight, steps}. Absent / all-disabled ⇒ the node's single default
@@ -28222,8 +28377,9 @@ method(object({
 	auth: "admin"
 }), method(object({
 	agentNodeId: string(),
-	reachableHost: string().nullable()
-}), object({ success: literal(true) }), {
+	reachableHost: string().nullable().optional(),
+	color: NodeColorIdSchema.nullable().optional()
+}).refine((v) => v.reachableHost !== void 0 || v.color !== void 0, { message: "reachableHost or color required" }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
@@ -31305,7 +31461,7 @@ var CustomActionInputSchema = object({
 	action: string().min(1),
 	input: unknown()
 });
-method(_void(), array(AddonListItemSchema).readonly()), method(object({
+method(object({ nodeId: string().optional() }).optional(), array(AddonListItemSchema).readonly()), method(object({
 	addonId: string(),
 	limit: number().min(1).max(500).default(100),
 	level: LogLevelSchema$2.optional()
@@ -35198,6 +35354,7 @@ var OsdNamedTemplateSchema = object({
 });
 /** Where a slot's value comes from. */
 var OsdSourceSchema = discriminatedUnion("kind", [
+	object({ kind: literal("none") }),
 	object({
 		kind: literal("static"),
 		text: string().max(64)
@@ -35324,6 +35481,13 @@ method(object({ deviceId: number().int() }), object({
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number().int(),
+	slotId: string().min(1),
+	enabled: boolean()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	sourceDeviceId: number().int(),
 	targetDeviceId: number().int()
@@ -35704,7 +35868,15 @@ var GpuInfoSchema = object({
 	name: string(),
 	memoryMB: number().optional()
 });
-var NpuInfoSchema = object({ type: _enum(["apple-ane", "intel-npu"]) });
+var NpuInfoSchema = object({
+	type: _enum([
+		"apple-ane",
+		"intel-npu",
+		"amd-xdna"
+	]),
+	name: string().optional(),
+	generation: _enum(["xdna1", "xdna2"]).optional()
+});
 var CoralInfoSchema = object({
 	type: literal("coral-edgetpu"),
 	bus: string().optional()
@@ -39466,9 +39638,11 @@ DeviceType.Camera, method(object({
 * once is what makes a second provider (RunPod, a local NVIDIA node) a new
 * manifest entry and nothing else.
 *
-* Collection, routed by the `addonId` in every single-row input (the `llm` /
-* `notification-output` posture); `describe` concat-fans across providers.
-* Every method is `admin`: these spend money.
+* Collection of provider **types** (addons). Each addon owns zero or more
+* **entries** (credentials + defaults). Concat-fans: `describe`,
+* `describeTypes`, `listEntries`, `listJobs`. Single-row work is keyed by
+* `entryId`; callers also pass the owning `addonId` as the collection
+* selector (broker posture). Every method is `admin`: these spend money.
 *
 * Every cloud object a provider creates is tagged with the orchestrator's
 * `jobKey`, so a retried submit finds the job it already started instead of
@@ -39492,8 +39666,8 @@ var TrainingRegionOptionSchema = object({
 	priceMultiplier: number().positive()
 });
 /**
-* The provider's per-account settings, as the orchestrator reads them. They
-* live in the PROVIDER addon's settings (operator decision 2026-10-08: they
+* The provider's per-entry settings, as the orchestrator reads them. They
+* live on the PROVIDER addon's entry (operator decision 2026-10-08: they
 * depend on the user's account), never hard-coded in the orchestrator.
 */
 var TrainingProviderDefaultsSchema = object({
@@ -39504,9 +39678,44 @@ var TrainingProviderDefaultsSchema = object({
 	/** Hours a FAILED job's cloud dataset is kept for debugging; 0 = delete at once. */
 	failedDatasetGraceHours: number().nonnegative()
 });
+/**
+* Entry form schema for a provider type — same seam as notification
+* `TargetKind.configSchema` (`z.unknown()` at the wire; callers tighten to
+* {@link ConfigUISchema}). Drives `ConfigFormBuilder` on Training → Providers.
+*/
+var ConfigSchemaPassthrough = unknown();
+/** One creatable provider type, for the Add-entry dialog. */
+var TrainingProviderTypeSchema = object({
+	typeId: string(),
+	label: string(),
+	/** Path under the addon package (e.g. `assets/training-modal/icon.svg`). */
+	iconAsset: string(),
+	/** Owning `training-provider` addon — collection selector for createEntry. */
+	addonId: string(),
+	/**
+	* Fields for one entry of this type (credentials + defaults). Absent on a
+	* type that only needs a name. Password fields are keychain-backed on the
+	* provider addon (`secretStatePaths`), not D634 plaintext.
+	*/
+	configSchema: ConfigSchemaPassthrough.optional()
+});
+/** One configured account / workspace under a provider type. */
+var TrainingProviderEntrySchema = object({
+	entryId: string(),
+	typeId: string(),
+	name: string(),
+	addonId: string(),
+	/** Credentials are present — never the values. */
+	configured: boolean()
+});
 var TrainingProviderDescriptorSchema = object({
 	addonId: string(),
-	/** `modal`, `runpod`, `fake`, … */
+	entryId: string(),
+	typeId: string(),
+	/** Operator-chosen entry name. */
+	name: string(),
+	iconAsset: string(),
+	/** `modal`, `runpod`, `fake`, … — same as typeId for current providers. */
 	kind: string(),
 	label: string(),
 	gpuTypes: array(TrainingGpuOptionSchema).readonly(),
@@ -39518,7 +39727,30 @@ var TrainingProviderDescriptorSchema = object({
 	dataResidencyNote: string(),
 	/** Credentials are present — never the values. */
 	configured: boolean(),
-	defaults: TrainingProviderDefaultsSchema
+	defaults: TrainingProviderDefaultsSchema,
+	/**
+	* Values for {@link TrainingProviderTypeSchema}'s `configSchema` — password
+	* fields are keychain {@link SecretFieldView} or `null` / `''` (create),
+	* never plaintext. Same hydrate contract as settings forms (D789).
+	*/
+	formValues: record(string(), unknown()).optional()
+});
+/**
+* Patch one entry's name, credentials and defaults. Pin with owning `{ addonId }`.
+* An omitted or empty `tokenSecret` means KEEP the stored secret (D787).
+* `{ $secretClear: true }` clears it.
+*/
+var TrainingProviderUpdateEntryInputSchema = object({
+	entryId: string().min(1),
+	name: string().min(1),
+	tokenId: string().optional(),
+	tokenSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
+	environment: string().optional(),
+	gpuType: string().optional(),
+	region: string().optional(),
+	costCapUsd: number().nonnegative().optional(),
+	maxRuntimeSec: number().int().positive().optional(),
+	failedDatasetGraceHours: number().nonnegative().optional()
 });
 var TrainingCredentialCheckSchema = object({
 	ok: boolean(),
@@ -39570,20 +39802,33 @@ var TrainerSourceRefSchema = object({
 	/** A commit sha (never a branch) — the job must be reproducible. */
 	revision: string().regex(/^[0-9a-f]{7,64}$/)
 });
+/** Cloud job identity — route with the owning addon's `addonId` selector. */
 var JobRef = {
-	addonId: string(),
+	entryId: string().min(1),
 	jobKey: string().uuid()
 };
 var TrainingLogLineSchema = object({
 	ts: number(),
 	text: string()
 });
-method(object({}), array(TrainingProviderDescriptorSchema).readonly(), { auth: "admin" }), method(object({ addonId: string() }), TrainingCredentialCheckSchema, {
+method(object({}), array(TrainingProviderDescriptorSchema).readonly(), { auth: "admin" }), method(object({}), array(TrainingProviderTypeSchema).readonly(), { auth: "admin" }), method(object({}), array(TrainingProviderEntrySchema).readonly(), { auth: "admin" }), method(object({
+	typeId: string().min(1),
+	name: string().min(1)
+}), object({ entryId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ entryId: string().min(1) }), object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(TrainingProviderUpdateEntryInputSchema, object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ entryId: string().min(1) }), TrainingCredentialCheckSchema, {
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 3e4
 }), method(object({
-	addonId: string(),
+	entryId: string().min(1),
 	gpuType: string(),
 	region: string(),
 	datasetBytes: number().int().nonnegative(),
@@ -39649,7 +39894,7 @@ method(object({}), array(TrainingProviderDescriptorSchema).readonly(), { auth: "
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 5 * 6e4
-}), method(object({ addonId: string() }), array(ProviderJobStatusSchema).readonly(), {
+}), method(object({ entryId: string().min(1).optional() }), array(ProviderJobStatusSchema).readonly(), {
 	auth: "admin",
 	timeoutMs: 2 * 6e4
 });
@@ -39659,20 +39904,31 @@ method(object({}), array(TrainingProviderDescriptorSchema).readonly(), { auth: "
 *
 * It owns what every provider must agree on, written once:
 *
-* - **Dataset versions.** Taken over from pipeline-analytics (D796): the rows
-*   live here (D808); pipeline-analytics still CUTS a version (it owns the corpus and
-*   the export plan) and reaches this store through the five row methods
-*   below, so the Retrain page and the export did not change.
 * - **Jobs.** A persisted state machine, a reconcile loop against the
 *   provider, a cost guard, a daily orphan sweep and the retention rules.
 * - **The return flow.** Verified artefacts → Model Studio
 *   (`custom-model-registry.importModelBundle`) → canary on cameras →
 *   rollback. Nothing is ever registered automatically.
 *
+* Plan/start takes a live {@link TrainingCorpusSelection} (collections +
+* work-state rule); frame ids are resolved via pipeline-analytics at that
+* moment and snapshotted on the job. No frozen dataset version.
+*
 * Every method is `admin`.
 */
-/** A version WITH its frame list — what the export and a job read. */
-var TrainingDatasetVersionRowSchema = RetrainDatasetVersionSchema.omit({ frameCount: true }).extend({ frameIds: array(string()).max(2e4).readonly() });
+/**
+* Live corpus criteria for plan/start (design §5.2). Default is complete-only.
+* Frame ids are resolved at plan/start — never a frozen version id.
+*/
+var TrainingCorpusSelectionSchema = object({
+	collectionIds: array(string()).min(1),
+	/** Default complete-only for v1 */
+	workState: _enum([
+		"complete",
+		"annotated_or_complete",
+		"any_annotated"
+	]).default("complete")
+});
 /** A base model a detector job can fine-tune, and the baseline it is judged against. */
 var TrainingBaseModelSchema = object({
 	modelId: string(),
@@ -39690,9 +39946,13 @@ var TrainingPresetSchema = _enum([
 	"thorough"
 ]);
 var TrainingJobRequestSchema = object({
-	datasetVersionId: string().min(1),
-	/** The `training-provider` addon that runs it. */
-	addonId: string().min(1),
+	/** Live collection + work-state criteria; resolved at plan/start. */
+	selection: TrainingCorpusSelectionSchema,
+	/**
+	* The provider **entry** that runs it (credentials + defaults).
+	* Resolve to an owning addon via `training-provider.describe` / `listEntries`.
+	*/
+	entryId: string().min(1),
 	gpuType: string().min(1),
 	region: string(),
 	baseModelId: string().min(1),
@@ -39751,6 +40011,7 @@ var TrainingJobPlanSchema = object({
 * result lives after the operator acted on it.
 */
 var TrainingJobStateSchema = _enum([
+	"queued",
 	"uploading",
 	"submitted",
 	"starting",
@@ -39804,6 +40065,11 @@ var TrainingJobSchema = object({
 	createdAt: number(),
 	updatedAt: number(),
 	state: TrainingJobStateSchema,
+	/**
+	* Shared by every job enqueued together via `startJobBatch`.
+	* `null` for a lone `startJob`. The engine advances queued siblings by this id.
+	*/
+	batchId: string().nullable().default(null),
 	stage: TrainingStageSchema.nullable(),
 	failure: object({
 		reason: TrainingFailureReasonSchema,
@@ -39815,6 +40081,12 @@ var TrainingJobSchema = object({
 	maxRuntimeSec: number().int().positive(),
 	trainer: TrainerSourceRefSchema,
 	datasetLayout: RetrainExportLayoutSchema,
+	/** Frame count snapshotted when the job started (audit; equals `frameIds.length`). */
+	frameCount: number().int().nonnegative(),
+	/** Resolved frame ids at start — the archive ships exactly these. */
+	frameIds: array(string()).max(2e4).readonly(),
+	/** Hash of what those frames taught at start (trainer `dataset.annotationHash`). */
+	annotationHash: string(),
 	dataset: object({
 		bytes: number().int(),
 		sha256: string(),
@@ -39856,13 +40128,7 @@ var TrainingJobSchema = object({
 	canary: TrainingCanarySchema.nullable()
 });
 var IdInput = object({ id: string().min(1) });
-method(TrainingDatasetVersionRowSchema, object({ stored: boolean() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(IdInput, TrainingDatasetVersionRowSchema.nullable(), { auth: "admin" }), method(object({}), array(RetrainDatasetVersionSchema).readonly(), { auth: "admin" }), method(object({ name: string() }), object({ id: string().nullable() }), { auth: "admin" }), method(IdInput, object({ removed: boolean() }), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({}), array(TrainingBaseModelSchema).readonly(), { auth: "admin" }), method(TrainingJobRequestSchema, TrainingJobPlanSchema, {
+method(object({}), array(TrainingBaseModelSchema).readonly(), { auth: "admin" }), method(TrainingJobRequestSchema, TrainingJobPlanSchema, {
 	auth: "admin",
 	timeoutMs: 6e4
 }), method(TrainingJobRequestSchema.extend({
@@ -39881,6 +40147,24 @@ method(TrainingDatasetVersionRowSchema, object({ stored: boolean() }), {
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 12e4
+}), method(TrainingJobRequestSchema.omit({ baseModelId: true }).extend({
+	baseModelIds: array(string().min(1)).min(1),
+	name: string().min(1).max(120),
+	maxCostUsd: number().positive(),
+	maxRuntimeSec: number().int().positive(),
+	idempotencyKey: string().min(8).max(80)
+}), discriminatedUnion("kind", [object({
+	kind: literal("started"),
+	batchId: string(),
+	jobs: array(TrainingJobSchema).min(1).readonly()
+}), object({
+	kind: literal("refused"),
+	reason: TrainingRefusalReasonSchema,
+	detail: string()
+})]), {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 12e4
 }), method(object({}), array(TrainingJobSchema).readonly(), { auth: "admin" }), method(IdInput, TrainingJobSchema.nullable(), { auth: "admin" }), method(IdInput, TrainingJobSchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -43914,6 +44198,36 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"oidcConnections.connectionFormSchema": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"oidcConnections.createConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"oidcConnections.deleteConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"oidcConnections.listConnections": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"oidcConnections.updateConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"osd.getStatus": {
 		capName: "osd",
 		capScope: "device",
@@ -43986,6 +44300,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"osdManager.setSlotCameraEnabled": {
+		capName: "osd-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"osdManager.upsertTemplate": {
 		capName: "osd-manager",
 		capScope: "system",
@@ -44124,12 +44444,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineAnalytics.createRetrainDatasetVersion": {
-		capName: "pipeline-analytics",
-		capScope: "device",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -44142,12 +44456,6 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
-	"pipelineAnalytics.deleteRetrainDatasetVersion": {
-		capName: "pipeline-analytics",
-		capScope: "device",
-		addonId: null,
-		access: "delete"
-	},
 	"pipelineAnalytics.deleteTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -44250,6 +44558,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getRetrainCorpusKpi": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getRetrainExportUrl": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -44370,7 +44684,7 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"pipelineAnalytics.listRetrainDatasetVersions": {
+	"pipelineAnalytics.listRetrainCorpusPage": {
 		capName: "pipeline-analytics",
 		capScope: "device",
 		addonId: null,
@@ -44424,12 +44738,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineAnalytics.previewRetrainDataset": {
-		capName: "pipeline-analytics",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
 	"pipelineAnalytics.proposeRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -44508,6 +44816,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.resolveRetrainTrainingCorpus": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.restageRetrainTrack": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -44568,12 +44882,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineAnalytics.verifyRetrainDatasetVersion": {
-		capName: "pipeline-analytics",
-		capScope: "device",
-		addonId: null,
-		access: "view"
-	},
 	"pipelineAnalytics.wipeAllAnalytics": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -46968,18 +47276,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"training.findDatasetVersionIdByName": {
-		capName: "training",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"training.getDatasetVersion": {
-		capName: "training",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"training.getJob": {
 		capName: "training",
 		capScope: "system",
@@ -46998,12 +47294,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"training.listDatasetVersions": {
-		capName: "training",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"training.listJobs": {
 		capName: "training",
 		capScope: "system",
@@ -47016,54 +47306,66 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"training.putDatasetVersion": {
+	"training.registerResult": {
 		capName: "training",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"training.registerResult": {
+	"training.rollbackCanary": {
 		capName: "training",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"training.removeDatasetVersion": {
+	"training.startJob": {
 		capName: "training",
 		capScope: "system",
 		addonId: null,
-		access: "delete"
+		access: "create"
 	},
-	"training.rollbackCanary": {
+	"training.startJobBatch": {
 		capName: "training",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"training.startJob": {
-		capName: "training",
+	"trainingProvider.cancelJob": {
+		capName: "training-provider",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"trainingProvider.cancelJob": {
+	"trainingProvider.cleanupJob": {
 		capName: "training-provider",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"trainingProvider.cleanupJob": {
+	"trainingProvider.createEntry": {
 		capName: "training-provider",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"trainingProvider.deleteEntry": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"trainingProvider.describe": {
 		capName: "training-provider",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"trainingProvider.describeTypes": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"trainingProvider.estimateJob": {
 		capName: "training-provider",
 		capScope: "system",
@@ -47076,6 +47378,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"trainingProvider.listEntries": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"trainingProvider.listJobEvents": {
 		capName: "training-provider",
 		capScope: "system",
@@ -47106,6 +47414,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"trainingProvider.updateEntry": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"trainingProvider.uploadDataset": {
 		capName: "training-provider",
 		capScope: "system",
@@ -50316,6 +50630,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"osdManager.setSlotCameraEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"petFeeder.callPet": [{
 		name: "deviceId",
 		form: "single",
@@ -50536,6 +50855,11 @@ Object.freeze({
 		form: "array",
 		optional: false
 	}],
+	"pipelineAnalytics.listRetrainCorpusPage": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
 	"pipelineAnalytics.listRetrainStaging": [{
 		name: "deviceIds",
 		form: "array",
@@ -51645,6 +51969,7 @@ Object.freeze({
 });
 Object.freeze({
 	"broker": "broker",
+	"calendar-source": "calendar",
 	"device-export": "device-export",
 	"llm": "ai",
 	"mesh-network": "mesh",
@@ -52684,4 +53009,165 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
-export { buildAddonRouteProvider as a, userPasskeysCapability as c, array as d, boolean as f, string as h, authProviderCapability as i, errMsg as l, object as m, addonRoutesCapability as n, isDisplayIconKey as o, number as p, addonWidgetsSourceCapability as r, loginMethodCapability as s, SSO_STATE_COOKIE as t, BaseAddon as u };
+Object.defineProperty(exports, "BaseAddon", {
+	enumerable: true,
+	get: function() {
+		return BaseAddon;
+	}
+});
+Object.defineProperty(exports, "SECRET_CLEAR", {
+	enumerable: true,
+	get: function() {
+		return SECRET_CLEAR;
+	}
+});
+Object.defineProperty(exports, "SSO_STATE_COOKIE", {
+	enumerable: true,
+	get: function() {
+		return SSO_STATE_COOKIE;
+	}
+});
+Object.defineProperty(exports, "__commonJSMin", {
+	enumerable: true,
+	get: function() {
+		return __commonJSMin;
+	}
+});
+Object.defineProperty(exports, "__esmMin", {
+	enumerable: true,
+	get: function() {
+		return __esmMin;
+	}
+});
+Object.defineProperty(exports, "__exportAll", {
+	enumerable: true,
+	get: function() {
+		return __exportAll;
+	}
+});
+Object.defineProperty(exports, "__toCommonJS", {
+	enumerable: true,
+	get: function() {
+		return __toCommonJS;
+	}
+});
+Object.defineProperty(exports, "__toESM", {
+	enumerable: true,
+	get: function() {
+		return __toESM;
+	}
+});
+Object.defineProperty(exports, "addonRoutesCapability", {
+	enumerable: true,
+	get: function() {
+		return addonRoutesCapability;
+	}
+});
+Object.defineProperty(exports, "addonWidgetsSourceCapability", {
+	enumerable: true,
+	get: function() {
+		return addonWidgetsSourceCapability;
+	}
+});
+Object.defineProperty(exports, "array", {
+	enumerable: true,
+	get: function() {
+		return array;
+	}
+});
+Object.defineProperty(exports, "arrayItemFieldPath", {
+	enumerable: true,
+	get: function() {
+		return arrayItemFieldPath;
+	}
+});
+Object.defineProperty(exports, "authProviderCapability", {
+	enumerable: true,
+	get: function() {
+		return authProviderCapability;
+	}
+});
+Object.defineProperty(exports, "boolean", {
+	enumerable: true,
+	get: function() {
+		return boolean;
+	}
+});
+Object.defineProperty(exports, "buildAddonRouteProvider", {
+	enumerable: true,
+	get: function() {
+		return buildAddonRouteProvider;
+	}
+});
+Object.defineProperty(exports, "errMsg", {
+	enumerable: true,
+	get: function() {
+		return errMsg;
+	}
+});
+Object.defineProperty(exports, "globalSecretScope", {
+	enumerable: true,
+	get: function() {
+		return globalSecretScope;
+	}
+});
+Object.defineProperty(exports, "isDisplayIconKey", {
+	enumerable: true,
+	get: function() {
+		return isDisplayIconKey;
+	}
+});
+Object.defineProperty(exports, "isSecretClear", {
+	enumerable: true,
+	get: function() {
+		return isSecretClear;
+	}
+});
+Object.defineProperty(exports, "isSecretMarker", {
+	enumerable: true,
+	get: function() {
+		return isSecretMarker;
+	}
+});
+Object.defineProperty(exports, "loginMethodCapability", {
+	enumerable: true,
+	get: function() {
+		return loginMethodCapability;
+	}
+});
+Object.defineProperty(exports, "number", {
+	enumerable: true,
+	get: function() {
+		return number;
+	}
+});
+Object.defineProperty(exports, "object", {
+	enumerable: true,
+	get: function() {
+		return object;
+	}
+});
+Object.defineProperty(exports, "oidcConnectionsCapability", {
+	enumerable: true,
+	get: function() {
+		return oidcConnectionsCapability;
+	}
+});
+Object.defineProperty(exports, "string", {
+	enumerable: true,
+	get: function() {
+		return string;
+	}
+});
+Object.defineProperty(exports, "toSecretFieldView", {
+	enumerable: true,
+	get: function() {
+		return toSecretFieldView;
+	}
+});
+Object.defineProperty(exports, "userPasskeysCapability", {
+	enumerable: true,
+	get: function() {
+		return userPasskeysCapability;
+	}
+});