@camstack/addon-osd-manager 0.1.192 → 0.1.194

package/dist/index.js

@@ -5380,7 +5380,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DujUvOcb.mjs
+//#region ../types/dist/sleep-r3RWkGVx.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -5497,7 +5497,7 @@ function isKeychainStoredField(field) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -5508,12 +5508,12 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$1(value)) return false;
+	if (!isRecord$2(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 function isSecretClear(value) {
-	return isRecord$1(value) && value["$secretClear"] === true;
+	return isRecord$2(value) && value["$secretClear"] === true;
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -6029,6 +6029,13 @@ function globalSecretScope() {
 function encodeSegment(value) {
 	return encodeURIComponent(value);
 }
+function decodeSegment(value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return null;
+	}
+}
 /**
 * The field path of a value inside an array item, addressed by the item's id:
 * `arrayItemFieldPath('providers', 'authentik', 'clientSecret')` →
@@ -6037,6 +6044,75 @@ function encodeSegment(value) {
 function arrayItemFieldPath(arrayKey, itemId, fieldKey) {
 	return `${arrayKey}[${encodeSegment(itemId)}].${fieldKey}`;
 }
+function parseScope(segments) {
+	switch (segments[0]) {
+		case "global": return {
+			scope: GLOBAL_SCOPE,
+			used: 1
+		};
+		case "node": {
+			const nodeId = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			return nodeId === null || nodeId.length === 0 ? null : {
+				scope: {
+					kind: "node",
+					nodeId
+				},
+				used: 2
+			};
+		}
+		case "device": {
+			const raw = segments[1];
+			if (raw === void 0 || !/^\d+$/.test(raw)) return null;
+			return {
+				scope: {
+					kind: "device",
+					deviceId: Number(raw)
+				},
+				used: 2
+			};
+		}
+		case "integration": {
+			const id = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			return id === null || id.length === 0 ? null : {
+				scope: {
+					kind: "integration",
+					integrationId: id
+				},
+				used: 2
+			};
+		}
+		case "row": {
+			const collection = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			const rowId = segments[2] !== void 0 ? decodeSegment(segments[2]) : null;
+			if (collection === null || rowId === null || collection.length === 0 || rowId.length === 0) return null;
+			return {
+				scope: {
+					kind: "row",
+					collection,
+					rowId
+				},
+				used: 3
+			};
+		}
+		default: return null;
+	}
+}
+/** Take a ref apart; `null` when it is not a well-formed ref. */
+function parseSecretRef(ref) {
+	if (!ref.startsWith("secret://")) return null;
+	const segments = ref.slice(9).split("/");
+	const owner = segments[0] !== void 0 ? decodeSegment(segments[0]) : null;
+	if (owner === null || owner.length === 0) return null;
+	const parsed = parseScope(segments.slice(1));
+	if (parsed === null) return null;
+	const fieldPath = segments.slice(1 + parsed.used).join("/");
+	if (fieldPath.length === 0) return null;
+	return {
+		owner,
+		scope: parsed.scope,
+		fieldPath
+	};
+}
 /** A write to a secret path could not be stored in the keychain, so it was refused. */
 var KeychainWriteRefusedError = class extends Error {
 	fieldPath;
@@ -6047,7 +6123,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -6060,7 +6136,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -6115,7 +6191,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -6131,7 +6207,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord(row)) {
+		if (!isRecord$1(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -6156,7 +6232,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord(incoming)) {
+			if (!isRecord$1(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -6164,7 +6240,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord(stored) ? stored : {};
+			const storedObj = isRecord$1(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -6223,12 +6299,19 @@ async function transformSecretWrite(input) {
 		}
 	};
 }
+/** Is `ref` one of `owner`'s refs? */
+function isSecretRefOwnedBy(ref, owner) {
+	return parseSecretRef(ref)?.owner === owner;
+}
 /**
 * Replace every marker in `value` with its keychain value. Returns the SAME
 * reference when there is no marker (no allocation, no keychain call).
 */
-async function resolveSecretMarkers(value, secrets) {
-	const refs = collectSecretMarkerRefs(value);
+async function resolveSecretMarkers(value, secrets, options = {}) {
+	const keepMarker = options.unresolved === "keep-marker";
+	const owner = options.ownedBy;
+	const inScope = (ref) => owner === void 0 || isSecretRefOwnedBy(ref, owner);
+	const refs = collectSecretMarkerRefs(value).filter(inScope);
 	if (refs.length === 0) return {
 		value,
 		unresolved: []
@@ -6252,10 +6335,18 @@ async function resolveSecretMarkers(value, secrets) {
 	}
 	const substitute = (v) => {
 		if (isSecretMarker(v)) {
+			if (!inScope(v.$secret)) return {
+				keep: true,
+				value: v
+			};
 			const answer = answers[v.$secret];
-			return answer?.kind === "value" ? {
+			if (answer?.kind === "value") return {
 				keep: true,
 				value: answer.value
+			};
+			return keepMarker ? {
+				keep: true,
+				value: v
 			} : {
 				keep: false,
 				value: void 0
@@ -6272,7 +6363,7 @@ async function resolveSecretMarkers(value, secrets) {
 				value: items
 			};
 		}
-		if (isRecord(v)) {
+		if (isRecord$1(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -6293,14 +6384,152 @@ async function resolveSecretMarkers(value, secrets) {
 		unresolved
 	};
 }
-function touchesTree(tree, patch) {
-	if (tree.size === 0) return false;
-	for (const key of Object.keys(patch)) {
-		const at = key.indexOf("@");
-		if (tree.has(at > 0 ? key.slice(0, at) : key)) return true;
+/** An addon tried to replace a stored secret it could not read. Nothing was written. */
+var SecretOverwriteRefusedError = class extends Error {
+	ref;
+	reason;
+	constructor(ref, reason) {
+		super(`secret ${ref} was not replaced: its stored value cannot be read right now (${reason}), and an addon may not overwrite a secret it cannot see. Nothing was written.`);
+		this.ref = ref;
+		this.reason = reason;
+		this.name = "SecretOverwriteRefusedError";
+	}
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function resolvedValue(pass, marker) {
+	const answer = pass.answers[marker.$secret];
+	return answer?.kind === "value" ? answer.value : null;
+}
+async function atMarker(pass, incoming, stored) {
+	if (incoming === null) return stored;
+	if (typeof incoming !== "string") return incoming;
+	if (incoming === resolvedValue(pass, stored)) return stored;
+	const intent = classifySecretWrite(incoming);
+	if (intent.kind !== "set") return stored;
+	const ref = stored.$secret;
+	if (!isSecretRefOwnedBy(ref, pass.secrets.owner)) return incoming;
+	const answer = pass.answers[ref];
+	if ((answer === void 0 || answer.kind === "unavailable" || answer.kind === "forbidden") && !pass.operatorWrite) throw new SecretOverwriteRefusedError(ref, answer === void 0 ? "not-initialized" : answer.kind === "unavailable" ? answer.reason : answer.kind);
+	try {
+		await pass.secrets.put(ref, intent.value);
+	} catch (err) {
+		throw new KeychainWriteRefusedError(ref, err);
+	}
+	pass.changedRefs.push(ref);
+	return stored;
+}
+function inArray(pass, incoming, stored) {
+	return incoming.map((item, index) => {
+		const twin = stored[index];
+		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
+		if (isRecord(item) && isRecord(twin)) return inArrayRow(pass, item, twin);
+		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
+		return item;
+	});
+}
+function inArrayRow(pass, incoming, stored) {
+	const out = { ...incoming };
+	for (const [key, value] of Object.entries(incoming)) {
+		const twin = stored[key];
+		if (isSecretMarker(twin)) {
+			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
+		} else if (isRecord(value) && isRecord(twin)) out[key] = inArrayRow(pass, value, twin);
+		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
+	}
+	return out;
+}
+async function walk$1(pass, incoming, stored) {
+	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
+	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
+	if (!isRecord(incoming) || !isRecord(stored)) return incoming;
+	const out = { ...incoming };
+	for (const [key, value] of Object.entries(incoming)) out[key] = await walk$1(pass, value, stored[key]);
+	return out;
+}
+/** Restore markers a write-back carries as values. See the file doc. */
+async function restoreUnchangedSecrets(input) {
+	const refs = [];
+	for (const key of Object.keys(input.patch)) collectSecretMarkerRefs(input.stored[key], refs);
+	const owned = refs.filter((ref) => isSecretRefOwnedBy(ref, input.secrets.owner));
+	if (owned.length === 0) return {
+		patch: input.patch,
+		changedRefs: []
+	};
+	const pass = {
+		secrets: input.secrets,
+		answers: await input.secrets.resolve([...new Set(owned)]),
+		operatorWrite: input.operatorWrite,
+		changedRefs: []
+	};
+	const out = {};
+	for (const [key, value] of Object.entries(input.patch)) out[key] = await walk$1(pass, value, input.stored[key]);
+	return {
+		patch: out,
+		changedRefs: pass.changedRefs
+	};
+}
+/** Structural equality over JSON-shaped values (key order does not matter). */
+function isJsonEqual(a, b) {
+	if (Object.is(a, b)) return true;
+	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
+	if (isRecord(a) && isRecord(b)) {
+		const keys = Object.keys(a);
+		if (keys.length !== Object.keys(b).length) return false;
+		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
 	}
 	return false;
 }
+/** The patch without the keys whose value already equals the stored one. */
+function dropUnchangedKeys(patch, stored) {
+	const out = {};
+	for (const [key, value] of Object.entries(patch)) {
+		if (Object.prototype.hasOwnProperty.call(stored, key) && isJsonEqual(value, stored[key])) continue;
+		out[key] = value;
+	}
+	return out;
+}
+/** The top-level keys of a blob that hold at least one of `owner`'s markers. */
+function markerKeysOf(blob, owner) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const [key, value] of Object.entries(blob)) if (collectSecretMarkerRefs(value).some((ref) => isSecretRefOwnedBy(ref, owner))) keys.add(key);
+	return keys;
+}
+function nodeFromStored(value, owner) {
+	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
+	if (!isRecord(value)) return null;
+	const children = /* @__PURE__ */ new Map();
+	for (const [key, child] of Object.entries(value)) {
+		const node = nodeFromStored(child, owner);
+		if (node !== null) children.set(key, node);
+	}
+	return children.size > 0 ? {
+		kind: "object",
+		children
+	} : null;
+}
+/**
+* The declared secret tree, widened by every place the STORED blob holds a
+* marker under one of `keys` — so a marker the schema no longer declares (or
+* never declared: Wyze before b4906cec6) still gets the save path's
+* KEEP / SET / CLEAR semantics instead of being overwritten by whatever the
+* addon writes. Markers inside arrays are not added: a row has no id field to
+* match by unless the schema declares one. Only `owner`'s markers count: a
+* builtin that keeps another addon's marker (device-manager) never takes it
+* over.
+*/
+function widenTreeWithStoredMarkers(declared, stored, keys, owner) {
+	const added = /* @__PURE__ */ new Map();
+	for (const key of keys) {
+		const at = key.indexOf("@");
+		const base = at > 0 ? key.slice(0, at) : key;
+		if (declared.has(base) || added.has(base)) continue;
+		const node = nodeFromStored(stored[key], owner);
+		if (node !== null) added.set(base, node);
+	}
+	return added.size === 0 ? declared : new Map([...declared, ...added]);
+}
 /** The blob as stored now; a failed read REFUSES the write instead of guessing. */
 async function readStoredAddonBlob(raw) {
 	const threeWay = raw.readAddonStoreResult;
@@ -6309,7 +6538,41 @@ async function readStoredAddonBlob(raw) {
 	if (result.kind === "failed") throw new Error(`settings write refused: the stored blob could not be read (${result.error})`);
 	return result.kind === "missing" ? {} : result.value;
 }
-function createSecretAwareSettings(raw, opts) {
+function touchesTree(tree, patch) {
+	if (tree.size === 0) return false;
+	for (const key of Object.keys(patch)) {
+		const at = key.indexOf("@");
+		if (tree.has(at > 0 ? key.slice(0, at) : key)) return true;
+	}
+	return false;
+}
+/**
+* Which top-level keys of each store held markers when last seen. `undefined`
+* for a store not seen yet: its first write reads it, to be safe.
+*/
+var MarkerKeyIndex = class {
+	owner;
+	byStore = /* @__PURE__ */ new Map();
+	constructor(owner) {
+		this.owner = owner;
+	}
+	seen(store, blob) {
+		this.byStore.set(store, markerKeysOf(blob, this.owner));
+	}
+	wrote(store, patch) {
+		const keys = this.byStore.get(store);
+		if (keys === void 0) return;
+		const now = markerKeysOf(patch, this.owner);
+		for (const key of Object.keys(patch)) if (now.has(key)) keys.add(key);
+		else keys.delete(key);
+	}
+	mayHoldMarkers(store, patch) {
+		const keys = this.byStore.get(store);
+		if (keys === void 0) return true;
+		return Object.keys(patch).some((key) => keys.has(key));
+	}
+};
+function createHandle(raw, opts) {
 	const chains = /* @__PURE__ */ new Map();
 	const serialize = (key, fn) => {
 		const next = (chains.get(key) ?? Promise.resolve()).then(fn, fn);
@@ -6320,46 +6583,130 @@ function createSecretAwareSettings(raw, opts) {
 		});
 		return next;
 	};
-	const write = async (chainKey, tree, scope, patch, readStored, rawWrite) => {
-		if (!touchesTree(tree, patch)) return rawWrite(patch);
-		return serialize(chainKey, async () => {
+	const index = new MarkerKeyIndex(opts.secrets.owner);
+	const resolveRead = async (store, blob) => {
+		index.seen(store, blob);
+		const { value, unresolved } = await resolveSecretMarkers(blob, opts.secrets, {
+			unresolved: "keep-marker",
+			ownedBy: opts.secrets.owner
+		});
+		if (unresolved.length > 0) opts.onUnresolved?.(unresolved);
+		return value;
+	};
+	const write = async (store, declared, scope, patch, readStored, rawWrite) => {
+		if (!touchesTree(declared, patch) && !index.mayHoldMarkers(store, patch)) {
+			await rawWrite(patch);
+			index.wrote(store, patch);
+			return { changed: true };
+		}
+		return serialize(store, async () => {
 			const stored = await readStored();
+			index.seen(store, stored);
+			const operatorWrite = opts.isOperatorWrite?.() === true;
+			const restored = await restoreUnchangedSecrets({
+				patch,
+				stored,
+				secrets: opts.secrets,
+				operatorWrite
+			});
 			const result = await transformSecretWrite({
-				tree,
+				tree: widenTreeWithStoredMarkers(declared, stored, Object.keys(restored.patch), opts.secrets.owner),
 				secrets: opts.secrets,
-				patch,
+				patch: restored.patch,
 				stored,
 				...scope !== void 0 ? { scope } : {},
-				operatorWrite: opts.isOperatorWrite?.() === true
+				operatorWrite
 			});
-			if (Object.keys(result.patch).length > 0) await rawWrite(result.patch);
+			const effective = dropUnchangedKeys(result.patch, stored);
+			const wroteBlob = Object.keys(effective).length > 0;
+			if (wroteBlob) {
+				await rawWrite(effective);
+				index.wrote(store, effective);
+			}
 			const { orphaned } = await result.afterWrite();
 			if (orphaned.length > 0) opts.onOrphaned(orphaned);
+			return { changed: wroteBlob || restored.changedRefs.length > 0 };
 		});
 	};
-	const wrapped = {
-		writeAddonStore: (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p)),
-		writeDeviceStore: (deviceId, patch) => write(`device:${deviceId}`, opts.deviceTree(), {
-			kind: "device",
-			deviceId
-		}, patch, () => raw.readDeviceStore(deviceId), (p) => raw.writeDeviceStore(deviceId, p))
+	const writeAddon = (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p));
+	const readAddonStoreResult = raw.readAddonStoreResult;
+	const readAddonStoreKeyResult = raw.readAddonStoreKeyResult;
+	const readDeviceStoreBatch = raw.readDeviceStoreBatch;
+	const overrides = {
+		readAddonStore: async () => resolveRead("addon", await raw.readAddonStore()),
+		...readAddonStoreResult !== void 0 ? { readAddonStoreResult: async () => {
+			const result = await readAddonStoreResult.call(raw);
+			return result.kind === "value" ? {
+				kind: "value",
+				value: await resolveRead("addon", result.value)
+			} : result;
+		} } : {},
+		...readAddonStoreKeyResult !== void 0 ? { readAddonStoreKeyResult: async (key) => {
+			const result = await readAddonStoreKeyResult.call(raw, key);
+			if (result.kind !== "present") return result;
+			const { value, unresolved } = await resolveSecretMarkers({ [key]: result.value }, opts.secrets, {
+				unresolved: "keep-marker",
+				ownedBy: opts.secrets.owner
+			});
+			if (unresolved.length > 0) opts.onUnresolved?.(unresolved);
+			return {
+				kind: "present",
+				value: value[key]
+			};
+		} } : {},
+		readDeviceStore: async (deviceId) => resolveRead(`device:${deviceId}`, await raw.readDeviceStore(deviceId)),
+		...readDeviceStoreBatch !== void 0 ? { readDeviceStoreBatch: async (deviceIds) => {
+			const rows = await readDeviceStoreBatch.call(raw, deviceIds);
+			const out = /* @__PURE__ */ new Map();
+			for (const [deviceId, blob] of rows) out.set(deviceId, await resolveRead(`device:${deviceId}`, blob));
+			return out;
+		} } : {},
+		writeAddonStore: async (patch) => {
+			await writeAddon(patch);
+		},
+		writeDeviceStore: async (deviceId, patch) => {
+			await write(`device:${deviceId}`, opts.deviceTree(), {
+				kind: "device",
+				deviceId
+			}, patch, () => raw.readDeviceStore(deviceId), (p) => raw.writeDeviceStore(deviceId, p));
+		}
+	};
+	return {
+		settings: new Proxy(raw, { get(target, prop, receiver) {
+			if (typeof prop === "string" && Object.prototype.hasOwnProperty.call(overrides, prop)) return Reflect.get(overrides, prop);
+			const value = Reflect.get(target, prop, receiver);
+			return typeof value === "function" ? value.bind(target) : value;
+		} }),
+		raw: {
+			readAddonStore: async () => {
+				const blob = await raw.readAddonStore();
+				index.seen("addon", blob);
+				return blob;
+			},
+			readDeviceStore: async (deviceId) => {
+				const blob = await raw.readDeviceStore(deviceId);
+				index.seen(`device:${deviceId}`, blob);
+				return blob;
+			}
+		},
+		writeAddonStore: writeAddon
 	};
-	return new Proxy(raw, { get(target, prop, receiver) {
-		if (prop === "writeAddonStore") return wrapped.writeAddonStore;
-		if (prop === "writeDeviceStore") return wrapped.writeDeviceStore;
-		const value = Reflect.get(target, prop, receiver);
-		return typeof value === "function" ? value.bind(target) : value;
-	} });
 }
-/** The context the addon sees: identical, except that its settings writes are secret-aware. */
-function withSecretAwareSettings(context, opts) {
+/** The context the addon sees, plus the private raw view and write outcome. */
+function createSecretAwareContext(context, opts) {
 	const raw = context.settings;
-	if (raw === void 0) return context;
-	const settings = createSecretAwareSettings(raw, opts);
-	return new Proxy(context, { get(target, prop, receiver) {
-		if (prop === "settings") return settings;
-		return Reflect.get(target, prop, receiver);
-	} });
+	if (raw === void 0) return {
+		context,
+		handle: null
+	};
+	const handle = createHandle(raw, opts);
+	return {
+		context: new Proxy(context, { get(target, prop, receiver) {
+			if (prop === "settings") return handle.settings;
+			return Reflect.get(target, prop, receiver);
+		} }),
+		handle
+	};
 }
 var LEAF = { kind: "leaf" };
 var DEFAULT_ITEM_ID_KEY = "id";
@@ -6534,6 +6881,14 @@ var BaseAddon = class {
 	_secretChangeUnsub = null;
 	/** >0 while an OPERATOR's settings write is being applied. */
 	_operatorWriteDepth = 0;
+	/**
+	* The keychain-aware settings handle (D798). Its `raw` view is the ONLY way
+	* to the marker-bearing blobs and stays private to this class: the form
+	* hydrate and config resolution need markers, addon code never does.
+	*/
+	_secretSettings = null;
+	/** Refs an addon-facing read could not resolve — each is logged once per process. */
+	_loggedUnresolvedReads = /* @__PURE__ */ new Set();
 	constructor(defaults) {
 		this.defaults = defaults;
 		this._config = { ...defaults };
@@ -6570,13 +6925,21 @@ var BaseAddon = class {
 	}
 	async initialize(context) {
 		const secrets = context.secrets;
-		this._ctx = secrets !== void 0 ? withSecretAwareSettings(context, {
-			secrets,
-			addonTree: () => this.addonSecretTree(),
-			deviceTree: () => this.deviceSecretTree(),
-			onOrphaned: (refs) => context.logger.warn("keychain refs dropped by a settings write could not be deleted", { meta: { refs: [...refs] } }),
-			isOperatorWrite: () => this._operatorWriteDepth > 0
-		}) : context;
+		if (secrets !== void 0) {
+			const { context: wrapped, handle } = createSecretAwareContext(context, {
+				secrets,
+				addonTree: () => this.addonSecretTree(),
+				deviceTree: () => this.deviceSecretTree(),
+				onOrphaned: (refs) => context.logger.warn("keychain refs dropped by a settings write could not be deleted", { meta: { refs: [...refs] } }),
+				isOperatorWrite: () => this._operatorWriteDepth > 0,
+				onUnresolved: (unresolved) => this.logUnresolvedRead(unresolved)
+			});
+			this._ctx = wrapped;
+			this._secretSettings = handle;
+		} else {
+			this._ctx = context;
+			this._secretSettings = null;
+		}
 		await this.resolveConfig();
 		if (secrets !== void 0) this._secretChangeUnsub = secrets.onChange((ref) => {
 			if (this._configSecretRefs.has(ref)) this.scheduleSecretReresolve(SECRET_CHANGE_DEBOUNCE_MS);
@@ -6693,11 +7056,8 @@ var BaseAddon = class {
 	async getGlobalSettings(overlay, cap, nodeId) {
 		const schema = this.globalSettingsSchema(cap);
 		if (!schema) return { sections: [] };
-		const projected = await this.resolveGlobalStore(nodeId, cap);
-		return hydrateSchema(schema, overlay ? {
-			...projected,
-			...overlay
-		} : projected, { inlineSecretsAsViews: true });
+		const projected = await this.readRawProjectedStore(nodeId, cap);
+		return hydrateSchema(schema, overlay ? await this.overlayKeepingMarkers(projected, overlay) : projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The integration-level view of this addon's settings: exactly the sections
@@ -6742,7 +7102,7 @@ var BaseAddon = class {
 			});
 		}
 		if (sections.length === 0) return null;
-		const projected = await this.resolveGlobalStore(nodeId);
+		const projected = await this.readRawProjectedStore(nodeId);
 		return hydrateSchema({
 			...schema,
 			sections
@@ -6759,12 +7119,50 @@ var BaseAddon = class {
 	* the store for custom option logic (option narrowing, value snapping) to
 	* read it per-node — never `ctx.settings.readAddonStore()` directly.
 	* `nodeId` omitted ⇒ the local node (node-blind injection from ctx).
+	*
+	* Keychain values come back RESOLVED (D798): a secret reads as its value,
+	* never as a `{ $secret }` marker. One the keychain cannot serve right now
+	* stays a marker — "stored, unavailable" (`isSecretMarker()` is true, and it
+	* is listed in {@link unresolvedSecrets}) — never `''` and never absent, so
+	* it cannot be mistaken for "nothing stored, mint a new one". Writing the
+	* resolved blob back is a no-op for every unchanged secret.
 	*/
 	async resolveGlobalStore(nodeId, cap) {
 		const raw = await this._ctx?.settings?.readAddonStore() ?? {};
+		return this.projectForNode(raw, nodeId, cap);
+	}
+	projectForNode(store, nodeId, cap) {
 		const keys = this.perNodeKeys(cap);
 		const node = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
-		return keys.size > 0 ? projectStore(raw, keys, node) : raw;
+		return keys.size > 0 ? projectStore(store, keys, node) : store;
+	}
+	/** The PROJECTED store with its markers — the form hydrate only (D798). */
+	async readRawProjectedStore(nodeId, cap) {
+		const raw = await this.rawSettings()?.readAddonStore() ?? {};
+		return this.projectForNode(raw, nodeId, cap);
+	}
+	/**
+	* `{ ...stored, ...overlay }`, except that an overlay member equal to the
+	* RESOLVED stored one keeps the stored (marker-bearing) member — so a form
+	* hydrated from a resolved overlay still shows a secret as "set", never as
+	* its value.
+	*/
+	async overlayKeepingMarkers(stored, overlay) {
+		const secrets = this._ctx?.secrets;
+		const merged = {
+			...stored,
+			...overlay
+		};
+		if (secrets === void 0 || collectSecretMarkerRefs(stored).length === 0) return merged;
+		const { value: resolved } = await resolveSecretMarkers(stored, secrets, {
+			unresolved: "keep-marker",
+			ownedBy: secrets.owner
+		});
+		for (const key of Object.keys(overlay)) {
+			if (collectSecretMarkerRefs(stored[key]).length === 0) continue;
+			if (isJsonEqual(overlay[key], resolved[key])) merged[key] = stored[key];
+		}
+		return merged;
 	}
 	/**
 	* Whether ONE global key of this addon's store was written, read three-way
@@ -6829,8 +7227,12 @@ var BaseAddon = class {
 	async clearSecrets(keys, nodeId) {
 		const tree = this.addonSecretTree();
 		const keychain = this._ctx?.secrets !== void 0;
+		const stored = keychain ? await this.readAddonStoreWithRetry() : {};
 		const patch = {};
-		for (const key of keys) patch[key] = keychain && tree.has(key) ? SECRET_CLEAR : "";
+		for (const key of keys) {
+			const keychainStored = tree.has(key) || collectSecretMarkerRefs(stored[key]).length > 0;
+			patch[key] = keychain && keychainStored ? SECRET_CLEAR : "";
+		}
 		await this.applyGlobalPatch(patch, nodeId);
 	}
 	async applyGlobalPatch(barePatch, nodeId) {
@@ -6838,7 +7240,11 @@ var BaseAddon = class {
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
 		const scoped = keys.size > 0 ? scopePatch(barePatch, keys, target) : barePatch;
-		await this._ctx?.settings?.writeAddonStore(scoped);
+		const handle = this._secretSettings;
+		if (handle !== null) {
+			const { changed } = await handle.writeAddonStore(scoped);
+			if (!changed) return;
+		} else await this._ctx?.settings?.writeAddonStore(scoped);
 		if (target !== localNode) return;
 		await this.resolveConfig();
 		await this.onConfigChanged();
@@ -6891,7 +7297,7 @@ var BaseAddon = class {
 	async getDeviceSettings(deviceId) {
 		const schema = this.deviceSettingsSchema();
 		if (!schema) return { sections: [] };
-		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, { inlineSecretsAsViews: true });
+		return hydrateSchema(schema, await this.rawSettings()?.readDeviceStore(deviceId) ?? {}, { inlineSecretsAsViews: true });
 	}
 	async updateDeviceSettings(deviceId, patch) {
 		await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
@@ -7063,7 +7469,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: async () => this.resolveStoredSecrets(await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, false),
+			read: async () => this.resolveStoredSecrets(await this.rawSettings()?.readDeviceStore(deviceId) ?? {}, false),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
 			},
@@ -7125,6 +7531,23 @@ var BaseAddon = class {
 		}
 		return value;
 	}
+	/**
+	* The marker-bearing settings reads (D798) — private on purpose. Without a
+	* keychain the context's own view is already raw.
+	*/
+	rawSettings() {
+		return this._secretSettings?.raw ?? this._ctx?.settings;
+	}
+	/** An addon-facing read met markers it could not resolve: say so once per ref. */
+	logUnresolvedRead(unresolved) {
+		const fresh = unresolved.filter((u) => !this._loggedUnresolvedReads.has(u.ref));
+		if (fresh.length === 0) return;
+		for (const u of fresh) this._loggedUnresolvedReads.add(u.ref);
+		this._ctx?.logger?.warn?.("settings read: a stored secret is unavailable — it reads as its marker, not as a value", { meta: { secrets: fresh.map((u) => ({
+			ref: u.ref,
+			reason: u.reason
+		})) } });
+	}
 	/** Re-resolve the config (a keychain-only change, or a retry) and apply it. */
 	scheduleSecretReresolve(delayMs) {
 		const timerOf = delayMs === SECRET_CHANGE_DEBOUNCE_MS ? "_secretChangeTimer" : "_secretRetryTimer";
@@ -7151,7 +7574,7 @@ var BaseAddon = class {
 	* `{}` (defaults) — the addon's first successful patch will rehydrate.
 	*/
 	async readAddonStoreWithRetry() {
-		const settings = this._ctx?.settings;
+		const settings = this.rawSettings();
 		if (!settings) return {};
 		const delaysMs = [
 			150,
@@ -9489,6 +9912,278 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
+* The trainer contract — what the hub hands the cloud trainer and what it
+* gets back (cloud training, D805+).
+*
+* The trainer (`hf/camstack-trainer`, published as the Hugging Face repo
+* `camstack/camstack-trainer`) is a separate AGPL program the hub never
+* imports: `job.json` goes in, files come out, and progress is `CAMSTACK_EVENT`
+* lines on stdout. These schemas are the hub's half of that boundary; the
+* trainer's pydantic models (and the JSON Schemas generated from them under
+* `hf/camstack-trainer/schemas/`) are the other half. A change here is a
+* change there, in the same piece of work.
+*
+* No `.default()` anywhere: defaults do not run on the addon cap path, so the
+* orchestrator fills every field of a job spec explicitly.
+*/
+var TRAINING_JOB_SCHEMA = "camstack.training/v1";
+var TRAINING_RESULT_SCHEMA = "camstack.training-result/v1";
+/** What the trainer can export. Edge TPU is a later, separate image. */
+var TrainingExportSchema = _enum([
+	"onnx",
+	"openvino-fp16",
+	"openvino-int8",
+	"coreml-fp16"
+]);
+var FloorsSchema = record(string(), number().min(0).max(1));
+object({
+	schema: literal(TRAINING_JOB_SCHEMA),
+	jobKey: string().uuid(),
+	target: object({
+		kind: literal("detector"),
+		step: literal("object-detection")
+	}),
+	base: object({
+		modelId: string().min(1),
+		/** Ultralytics weights id, e.g. `yolov9m.pt`. */
+		weights: string().min(1),
+		imgsz: number().int().positive()
+	}),
+	baseline: object({
+		modelId: string().min(1),
+		/** The baseline ONNX the holdout comparison runs; public mirror URL. */
+		onnxUrl: string().url(),
+		imgsz: number().int().positive(),
+		floors: FloorsSchema
+	}),
+	dataset: object({
+		versionId: string().min(1),
+		annotationHash: string(),
+		/** sha256 of the uploaded archive; the trainer refuses a mismatch (exit 65). */
+		sha256: string().regex(/^[0-9a-f]{64}$/)
+	}),
+	split: object({
+		holdoutCameras: array(number().int()),
+		/** When no camera is held out: the last N days of every camera. */
+		holdoutLastDays: number().int().nonnegative(),
+		valFraction: number().min(0).max(.5),
+		seed: number().int()
+	}),
+	hyper: object({
+		epochs: number().int().positive(),
+		batch: number().int().positive(),
+		lr0: number().positive(),
+		/** Layers frozen from the start of the backbone; 0 = none. */
+		freeze: number().int().nonnegative(),
+		patience: number().int().nonnegative(),
+		seed: number().int()
+	}),
+	replay: object({
+		source: literal("coco2017"),
+		count: number().int().nonnegative()
+	}),
+	exports: array(TrainingExportSchema).min(1),
+	calibration: object({ maxFrames: number().int().positive() }),
+	floors: object({
+		minSupport: number().int().positive(),
+		clamp: number().min(0).max(1)
+	}),
+	int8Gate: object({ maxMap50Drop: number().min(0).max(1) }),
+	catalog: object({
+		id: string().regex(/^[a-z0-9][a-z0-9-]{2,80}$/),
+		name: string().min(1).max(160)
+	})
+});
+/** One regular file of the bundle. An mlpackage contributes one row per member. */
+var TrainingResultFileSchema = object({
+	path: string().min(1),
+	bytes: number().int().nonnegative(),
+	sha256: string().regex(/^[0-9a-f]{64}$/),
+	format: _enum([
+		"onnx",
+		"openvino",
+		"coreml",
+		"pt"
+	]),
+	variant: _enum(["base", "int8"])
+});
+var DraftFormatSchema = object({
+	/** RELATIVE path inside the bundle; the hub rewrites it to `camstack-local://`. */
+	url: string().min(1),
+	sizeMB: number().nonnegative(),
+	isDirectory: boolean().optional(),
+	files: array(string()).optional(),
+	runtimes: array(literal("python")).optional(),
+	revision: string().min(1)
+});
+/** The trainer's half of a catalog entry; the hub completes it (labels, licence, group). */
+var TrainingCatalogDraftSchema = object({
+	id: string().min(1),
+	name: string().min(1),
+	description: string(),
+	labels: array(unknown()),
+	inputSize: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	preprocessMode: literal("letterbox"),
+	defaultClassFloors: FloorsSchema,
+	formats: object({
+		onnx: DraftFormatSchema.optional(),
+		openvino: DraftFormatSchema.optional(),
+		coreml: DraftFormatSchema.optional()
+	})
+});
+/** One class of one model's holdout report (the eval harness's summary). */
+var TrainingEvalClassSchema = object({
+	positives: number().int(),
+	floor: number().nullable(),
+	tp: number().int(),
+	fp: number().int(),
+	fn: number().int(),
+	precision: number().nullable(),
+	recall: number().nullable(),
+	ap50: number().nullable(),
+	recallByCamera: record(string(), number().nullable()).optional(),
+	recallByLight: record(string(), number().nullable()).optional(),
+	fpByCamera: record(string(), number()).optional(),
+	smallFound: number().int().optional(),
+	smallTotal: number().int().optional()
+}).passthrough();
+var TrainingEvalReportSchema = object({
+	frames: number().int(),
+	classes: record(string(), TrainingEvalClassSchema)
+}).passthrough();
+/**
+* A succeeded result carries every block; a failed one carries the error and
+* whatever was known by then — the other blocks are ABSENT, not null. The
+* orchestrator checks the blocks it needs before it trusts a success.
+*/
+var TrainingResultSchema = object({
+	schema: literal(TRAINING_RESULT_SCHEMA),
+	jobKey: string(),
+	status: _enum(["succeeded", "failed"]),
+	error: object({
+		stage: string(),
+		code: string(),
+		message: string()
+	}).nullable(),
+	trainer: object({
+		version: string(),
+		revision: string()
+	}),
+	toolchain: record(string(), string().nullable()),
+	dataset: object({
+		versionId: string(),
+		annotationHash: string(),
+		sha256: string(),
+		frames: object({
+			train: number().int(),
+			val: number().int(),
+			holdout: number().int()
+		}),
+		holdoutCameras: array(number().int()),
+		replayImages: number().int()
+	}).optional(),
+	training: object({
+		epochsRun: number().int(),
+		bestEpoch: number().int(),
+		bestMap50: number(),
+		bestMap50_95: number(),
+		seconds: number()
+	}).optional(),
+	evaluation: object({
+		holdoutFrames: number().int(),
+		baseline: TrainingEvalReportSchema.nullable(),
+		candidate: TrainingEvalReportSchema.nullable(),
+		candidateInt8: TrainingEvalReportSchema.nullable(),
+		recallDeltaByCamera: record(string(), record(string(), number())).nullable(),
+		map50: record(string(), number().nullable())
+	}).optional(),
+	floors: object({
+		baseline: FloorsSchema,
+		candidate: FloorsSchema,
+		candidateInt8: FloorsSchema.nullable(),
+		notes: array(string())
+	}).optional(),
+	int8: object({
+		kept: boolean(),
+		map50Fp16: number().nullable(),
+		map50Int8: number().nullable(),
+		reason: string().nullable()
+	}).optional(),
+	exportsDropped: array(object({
+		export: string(),
+		reason: string()
+	})).optional(),
+	files: array(TrainingResultFileSchema).optional(),
+	bundle: object({
+		path: literal("bundle.tar"),
+		bytes: number().int().nonnegative(),
+		sha256: string().regex(/^[0-9a-f]{64}$/)
+	}).nullable().optional(),
+	catalogDraft: object({
+		base: TrainingCatalogDraftSchema,
+		int8: TrainingCatalogDraftSchema.nullable()
+	}).nullable().optional(),
+	licence: string()
+});
+var TrainingStageSchema = _enum([
+	"prepare",
+	"replay",
+	"train",
+	"eval",
+	"export",
+	"package"
+]);
+var EventBase = {
+	v: literal(1),
+	ts: number()
+};
+discriminatedUnion("type", [
+	object({
+		...EventBase,
+		type: literal("stage"),
+		stage: TrainingStageSchema
+	}),
+	object({
+		...EventBase,
+		type: literal("epoch"),
+		epoch: number().int(),
+		epochs: number().int(),
+		boxLoss: number().nullable().optional(),
+		map50: number().nullable().optional(),
+		map50_95: number().nullable().optional(),
+		etaSec: number().nullable().optional()
+	}),
+	object({
+		...EventBase,
+		type: literal("metric"),
+		name: string(),
+		value: number()
+	}),
+	object({
+		...EventBase,
+		type: literal("artifact"),
+		path: string(),
+		bytes: number(),
+		sha256: string()
+	}),
+	object({
+		...EventBase,
+		type: literal("done"),
+		status: _enum(["succeeded", "failed"]),
+		resultSha256: string().nullable().optional()
+	}),
+	object({
+		...EventBase,
+		type: literal("error"),
+		stage: string(),
+		code: string(),
+		message: string()
+	})
+]);
+/**
 * What the gate decided about a birth, from the CALLER's point of view.
 *
 * Deliberately not `ConfirmationVerdict`: `undecided` is not a birth decision
@@ -11838,7 +12533,9 @@ var AddonHttpRouteSchema = object({
 		"authenticated",
 		"admin"
 	]).optional(),
-	description: string().optional()
+	description: string().optional(),
+	/** The hub limits this route per client address before the handler runs. */
+	rateLimit: _enum(["auth"]).optional()
 });
 /**
 * Cross-process route invocation envelope. The hub captures the
@@ -12788,6 +13485,37 @@ var BackupDestinationInfoSchema = object({
 	lastError: string().optional()
 });
 /**
+* How an archive is encrypted (operator decision 2026-10-09): to a backup
+* PUBLIC key the hub holds, so only the operator's secret key opens it.
+* Absent on a plain `.tar.gz` — every archive made before encryption, or
+* with it off — which restores without a key.
+*/
+var BackupArchiveEncryptionSchema = object({
+	/** `x25519-hkdf-aes256gcm-stream-v1`. */
+	scheme: string(),
+	/** 16 hex — the backup key whose secret restores this archive. */
+	keyId: string()
+});
+/**
+* The backup encryption setting. The hub keeps PUBLIC keys only: the active
+* one new archives are encrypted to, and the retired ones older archives
+* still need. The secret key is shown once, at `setupEncryption`.
+*/
+var BackupEncryptionStatusSchema = object({
+	enabled: boolean(),
+	active: object({
+		keyId: string(),
+		publicKey: string(),
+		createdAt: number()
+	}).nullable(),
+	/** Every key ever set up, newest first. */
+	keys: array(object({
+		keyId: string(),
+		createdAt: number(),
+		retiredAt: number().nullable()
+	})).readonly()
+});
+/**
 * Per-archive entry returned by `backup.listArchives({ destinationId })`.
 * Same shape the destination drill-in renders. Sourced from the per-
 * location `manifests.json` (no per-archive tarball read required).
@@ -12799,7 +13527,9 @@ var BackupArchiveEntrySchema = object({
 	sizeBytes: number(),
 	label: string().optional(),
 	/** Top-level locations included in the archive (db, addons, tls, …). */
-	locations: array(string()).readonly()
+	locations: array(string()).readonly(),
+	/** Present when the archive is encrypted; restore then needs that key. */
+	encryption: BackupArchiveEncryptionSchema.optional()
 });
 var BackupEntrySchema = object({
 	id: string(),
@@ -12808,7 +13538,8 @@ var BackupEntrySchema = object({
 	label: string().optional(),
 	createdAt: number(),
 	sizeBytes: number(),
-	locations: array(string()).optional()
+	locations: array(string()).optional(),
+	encryption: BackupArchiveEncryptionSchema.optional()
 });
 var ArchiveEntrySchema = object({
 	path: string(),
@@ -13063,11 +13794,58 @@ var backupCapability = {
 			* this list and skips entries whose path doesn't start with
 			* any of them.
 			*/
-			locations: array(string()).optional()
+			locations: array(string()).optional(),
+			/**
+			* The backup SECRET key, for an encrypted archive (ignored for a plain
+			* one). The archive is decrypted into the hub's private staging
+			* before the restart; the key is not stored. A wrong or missing key
+			* is refused before the archive is downloaded.
+			*/
+			backupSecretKey: string().optional()
 		}), _void(), {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/** The encryption setting — public keys only. */
+		getEncryption: method(_void(), BackupEncryptionStatusSchema, { auth: "admin" }),
+		/**
+		* Turn encryption on, or replace the key: generates a new key pair, keeps
+		* the PUBLIC key, and returns the SECRET key — once. It is never stored
+		* on the hub and cannot be shown again; archives made from now on need
+		* it to be restored. A previous key is retired: archives made with it
+		* still need IT.
+		*/
+		setupEncryption: method(object({}), object({
+			keyId: string(),
+			secretKey: string(),
+			publicKey: string(),
+			createdAt: number(),
+			replacedKeyId: string().nullable()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** New archives are plain again. Existing encrypted archives keep needing their key. */
+		disableEncryption: method(object({}), object({ disabledKeyId: string().nullable() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Does this secret key parse, and which backup key is it? A mutation so
+		* the key never travels in a URL. Nothing is stored.
+		*/
+		checkBackupKey: method(object({ backupSecretKey: string() }), object({
+			valid: boolean(),
+			keyId: string().nullable(),
+			/** The hub knows this key (active or retired). */
+			known: boolean(),
+			/** It is the key new archives are encrypted to. */
+			active: boolean(),
+			error: string().optional()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		delete: method(object({
 			destinationId: string(),
 			backupId: string()
@@ -15252,22 +16030,87 @@ var CustomModelDescriptorSchema = object({
 	stepId: string(),
 	entry: ModelCatalogEntrySchema
 });
+/** One regular file of an imported bundle, as the producer measured it. */
+var ModelBundleFileSchema = object({
+	/** Relative path inside the bundle tar; an mlpackage member is `<x>.mlpackage/<member>`. */
+	path: string().min(1),
+	bytes: number().int().nonnegative(),
+	sha256: string().regex(/^[0-9a-f]{64}$/)
+});
+var ImportModelBundleInputSchema = object({
+	/** The registry provider that keeps the model (Model Studio). */
+	addonId: string(),
+	stepId: string().min(1),
+	/**
+	* The catalog rows to register, complete, every format URL already
+	* `camstack-local://<modelId>/<file>` naming a file of the bundle. One
+	* bundle may carry several rows (a base and its INT8 variant).
+	*/
+	entries: array(ModelCatalogEntrySchema).min(1).max(4),
+	/** The bundle tar, offered by the producer over `ctx.peerBytes` (same host). */
+	bundle: object({
+		ticket: PeerBytesTicketSchema,
+		bytes: number().int().positive(),
+		sha256: string().regex(/^[0-9a-f]{64}$/)
+	}),
+	/** Every file the tar must hold; anything missing, extra or different is refused. */
+	files: array(ModelBundleFileSchema).min(1).max(64),
+	/** Convert missing engine formats and push the model to every agent afterwards. */
+	distribute: boolean()
+});
+var ImportModelBundleResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("imported"),
+	modelIds: array(string()).readonly(),
+	distributed: array(object({
+		modelId: string(),
+		nodeId: string(),
+		format: _enum(MODEL_FORMATS),
+		ok: boolean(),
+		error: string().optional()
+	})).readonly()
+}), object({
+	kind: literal("refused"),
+	reason: _enum([
+		"transfer-failed",
+		"checksum-mismatch",
+		"bundle-mismatch",
+		"invalid-entry",
+		"id-taken"
+	]),
+	detail: string()
+})]);
 var customModelRegistryCapability = {
 	name: "custom-model-registry",
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { 
-	/**
-	* `internal: true` did not gate the mount (see the 2026-08-26 note on
-	* `data-store-provider`) — this was reachable on the AppRouter by ANY
-	* authenticated session at the default `auth: 'protected'`. The only
-	* consumer, the detection-pipeline's model resolution
-	* (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
-	* `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
-	* never tRPC — so `auth: 'admin'` costs it nothing.
-	*/
-listModels: method(_void(), array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }) }
+	methods: {
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — this was reachable on the AppRouter by ANY
+		* authenticated session at the default `auth: 'protected'`. The only
+		* consumer, the detection-pipeline's model resolution
+		* (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
+		* `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
+		* never tRPC — so `auth: 'admin'` costs it nothing.
+		*/
+		listModels: method(_void(), array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }),
+		/**
+		* Register a model whose files arrive as ONE bundle tar (D806): the tar
+		* is taken over `ctx.peerBytes`, checked against `bundle.sha256` and
+		* every row of `files`, unpacked into the hub's flat modelsDir (directory
+		* formats included), each format's `.revision` record written, the rows
+		* upserted under the operator's name, the hub marked available and —
+		* when asked — engine formats converted and the model distributed. A
+		* model id already registered by another source is refused, never
+		* overwritten.
+		*/
+		importModelBundle: method(ImportModelBundleInputSchema, ImportModelBundleResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 30 * 6e4
+		})
+	}
 };
 /**
 * Query filter for settings-store collections.
@@ -16058,6 +16901,35 @@ var KeychainKeySourceSchema = object({
 	*/
 	sharesBackupWithDatabase: boolean()
 });
+/**
+* One keychain reset, as the Secrets page reports it until the operator
+* acknowledges it. Never a value: refs, counts and table names only.
+*/
+var KeychainResetRecordSchema = object({
+	id: string(),
+	at: number(),
+	/** `user:<id>` or {@link KEYCHAIN_RESET_TRIGGER_ACTOR}. */
+	actor: string(),
+	/** Why the keychain was locked when it was reset; `null` when it was not locked. */
+	lockedReason: string().nullable(),
+	/** Values moved into the archive table (ciphertext under the lost key). */
+	archived: number().int(),
+	/** `keychain:secrets-orphaned-<ts>`, or `null` when nothing was stored. */
+	archivedCollection: string().nullable(),
+	/**
+	* `keychain:keys-orphaned-<ts>`: the wrapped data keys of the archive, kept
+	* so the archive can still be opened if the lost master key turns up.
+	*/
+	archivedKeysCollection: string().nullable(),
+	/**
+	* `system-settings` keys whose marker the reset cleared — the cluster
+	* secret's: a marker left pointing at an archived value would refuse every
+	* agent forever (D797).
+	*/
+	clearedSettingsKeys: array(string()).readonly(),
+	/** When an operator dismissed the notice on the Secrets page; `null` until then. */
+	acknowledgedAt: number().nullable()
+});
 var KeychainStatusSchema = object({
 	keychain: KeychainStateSchema,
 	/** The source of the master key in use; `null` while locked. */
@@ -16075,7 +16947,9 @@ var KeychainStatusSchema = object({
 	/** Wrapped copies of the data key under a previous master key, kept until purged. */
 	retiredWraps: number().int(),
 	recoveryKeyDownloadedAt: number().nullable(),
-	secretCount: number().int()
+	secretCount: number().int(),
+	/** The most recent reset, acknowledged or not; `null` when the keychain was never reset. */
+	lastReset: KeychainResetRecordSchema.nullable()
 });
 /**
 * Whether a stored value is still pointed at by its owner's settings.
@@ -16097,13 +16971,14 @@ var KeychainAuditActionSchema = _enum([
 	"download-recovery-key",
 	"delete-orphans",
 	"reset",
+	"acknowledge-reset",
 	"initialize"
 ]);
 var KeychainAuditEntrySchema = object({
 	id: string(),
 	at: number(),
 	action: KeychainAuditActionSchema,
-	/** `addon:<id>` | `user:<id>` | `system`. */
+	/** `addon:<id>` | `user:<id>` | `system` | `trigger-file`. */
 	actor: string(),
 	ref: string().nullable(),
 	detail: string().nullable()
@@ -16213,6 +17088,21 @@ var keychainAdminCapability = {
 			kind: "mutation",
 			auth: "admin",
 			caller: "required"
+		}),
+		/**
+		* What the last reset left to re-enter: the archived refs (owner, scope,
+		* field — never a value) that hold no value again yet. Process-held refs
+		* the hub regenerates itself (the session signing key) are not listed.
+		*/
+		resetReport: method(object({}), object({
+			reset: KeychainResetRecordSchema.nullable(),
+			pendingReentry: array(KeychainSecretMetaSchema).readonly()
+		}), { auth: "admin" }),
+		/** Dismiss the "keychain was reset" notice. Audited. */
+		acknowledgeReset: method(object({}), object({ acknowledged: boolean() }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
 		})
 	}
 };
@@ -20128,7 +21018,7 @@ var logDestinationCapability = {
 * `login-method` — collection cap through which auth addons contribute
 * their pre-auth login surfaces to the login page. This is the SINGLE,
 * generic mechanism that supersedes the dead `auth.listProviders` reader:
-* every auth addon (OIDC, magic-link, WebAuthn/passkey) registers a
+* every auth addon (OIDC, WebAuthn/passkey) registers a
 * `login-method` provider and the PUBLIC `auth.listLoginMethods`
 * procedure aggregates them for the unauthenticated login page.
 *
@@ -20136,8 +21026,7 @@ var logDestinationCapability = {
 *
 *  - `redirect` — a declarative button. The login page renders a generic
 *    button that navigates to `startUrl` (an addon-owned HTTP route).
-*    Covers OIDC (`/addon/auth-oidc/<id>/start`) and magic-link with
-*    ZERO shell-side JS. A future SSO addon plugs in the same way — the
+*    Covers OIDC (`/addon/auth-oidc/<id>/start`) with ZERO shell-side JS. A future SSO addon plugs in the same way — the
 *    login page needs NO change.
 *
 *  - `widget` — a Module-Federation widget the login page mounts (via
@@ -20156,8 +21045,8 @@ var logDestinationCapability = {
 *    decision.
 *
 * Every contribution carries a `stage`:
-*  - `primary`        — shown on the first credentials screen (OIDC /
-*                       magic-link buttons; a future usernameless passkey).
+*  - `primary`        — shown on the first credentials screen (OIDC
+*                       buttons; a usernameless passkey).
 *  - `second-factor`  — shown AFTER the password leg, gated on the
 *                       returned `factors` (passkey-as-2FA today).
 *
@@ -20184,7 +21073,7 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		* The provider names an external identity a signed-in user can link to
 		* their own account (D782): `auth.listLinkableProviders` /
 		* `beginExternalLink` offer exactly the redirect methods that set this,
-		* whatever their id. Absent / false — a login button only (magic-link).
+		* whatever their id. Absent / false — a login button only.
 		*/
 		linkable: boolean().optional()
 	}),
@@ -24945,8 +25834,7 @@ var notificationRulesCapability = {
 * `super_admin` — collapsed onto the single boolean because every
 * non-admin caller is governed by the same scope-check rules; the
 * distinction was only ever used to route role-specific procedures
-* which we no longer have. Agents are admin sessions issued via
-* `createServiceToken`; CLI / webhook integrations are `cst_*` tokens
+* which we no longer have. CLI / webhook integrations are `cst_*` tokens
 * with `isAdmin: false` + an explicit scope list.
 */
 /** Per-method access flavour. Materialised on every cap method via codegen. */
@@ -28218,6 +29106,26 @@ var pipelineAnalyticsCapability = {
 			auth: "admin",
 			timeoutMs: 60 * 6e4
 		}),
+		/**
+		* OFFER the annotated archive instead of pushing it (D805): the same tar
+		* `writeRetrainArchive` streams, behind a one-shot `ctx.peerBytes` ticket
+		* the caller dials at once (same host). For a consumer that cannot expose
+		* an upload URL — a training provider streaming straight into its cloud.
+		* The answer is the plan; the bytes and their sha256 are the consumer's
+		* to measure as they arrive.
+		*/
+		offerRetrainArchive: method(object({
+			filter: RetrainExportFilterSchema,
+			layout: RetrainExportLayoutSchema
+		}), object({
+			ticket: PeerBytesTicketSchema,
+			frames: number().int(),
+			annotations: number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
 		/** The counts a selection would freeze — class × camera × day/night,
 		*  completeness — without freezing anything. Index reads only. */
 		previewRetrainDataset: method(object({
@@ -32859,8 +33767,8 @@ version: string().optional() }), ServerUpdateActionResultSchema, {
 * `smtp-provider` — pluggable email delivery surface.
 *
 * Collection cap: a deployment may install multiple SMTP relays (e.g.
-* one for transactional / one for notifications). Consumers (magic-link,
-* notifier addons, …) walk the collection and pick the first
+* one for transactional / one for notifications). Consumers (notifier
+* addons, …) walk the collection and pick the first
 * ready provider OR target a specific addonId.
 *
 * The shape stays small on purpose — `sendEmail` is enough for the
@@ -33156,7 +34064,7 @@ targets: array(object({
 };
 /**
 * `sso-bridge` — internal hub-only cap that lets SSO-style auth
-* providers (OIDC, SAML, magic-link, …) mint an HMAC-signed token
+* providers (OIDC, SAML, …) mint an HMAC-signed token
 * carrying the post-callback claims before redirecting back to
 * `/api/auth/sso/finish`.
 *
@@ -33219,7 +34127,14 @@ var SsoBridgeClaimsSchema = object({
 	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
 	* subject is unique only per issuer, so a link is bound to it.
 	*/
-	issuer: string().optional()
+	issuer: string().optional(),
+	/**
+	* SHA-256 (hex) of the `camstack_sso_state` cookie the IdP `/start` set in
+	* the browser that began this sign-in. `/api/auth/sso/finish` requires the
+	* request to present the matching cookie — a login bridge is useless in
+	* any other browser.
+	*/
+	browserBinding: string().optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -33237,7 +34152,7 @@ var ssoBridgeCapability = {
 		* `/api/auth/sso/finish` to become admin — a full privilege escalation
 		* through the exact surface this cap exists to close (see the module
 		* docblock). Every real caller (`oauth-grants.ts`, `main.ts`
-		* registration, the OIDC/magic-link addons) reaches this through
+		* registration, the OIDC addon) reaches this through
 		* `ctx.api` / the in-process registry — never through tRPC — so
 		* `auth: 'admin'` costs those callers nothing.
 		*/
@@ -47514,16 +48429,6 @@ var ApiKeySummarySchema = object({
 	createdAt: number(),
 	lastUsedAt: number().optional()
 });
-var CreateApiKeyInputSchema = object({
-	label: string(),
-	isAdmin: boolean().default(false),
-	allowedProviders: union([array(string()), literal("*")]).optional(),
-	allowedDevices: record(string(), union([array(string()), literal("*")])).optional()
-});
-var CreateApiKeyResultSchema = object({
-	token: string(),
-	record: ApiKeySummarySchema
-});
 var ScopedTokenSummarySchema = object({
 	id: string(),
 	userId: string(),
@@ -47635,20 +48540,11 @@ var userManagementCapability = {
 			access: "view"
 		}),
 		listApiKeys: method(_void(), array(ApiKeySummarySchema), { auth: "admin" }),
-		createApiKey: method(CreateApiKeyInputSchema, CreateApiKeyResultSchema, {
-			kind: "mutation",
-			auth: "admin",
-			access: "create"
-		}),
 		revokeApiKey: method(object({ id: string() }), object({ success: literal(true) }), {
 			kind: "mutation",
 			auth: "admin",
 			access: "delete"
 		}),
-		validateApiKey: method(object({ token: string() }), ApiKeySummarySchema.nullable(), {
-			kind: "mutation",
-			access: "view"
-		}),
 		createScopedToken: method(CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, {
 			kind: "mutation",
 			auth: "admin",
@@ -47738,20 +48634,6 @@ var userManagementCapability = {
 			userId: string(),
 			issuer: string()
 		}).nullable(), { auth: "admin" }),
-		/**
-		* Link `(provider, subject)` to `userId`. Idempotent for the same user;
-		* REFUSES (throws) an identity already linked to another user, and a
-		* user that does not exist.
-		*/
-		linkExternalIdentity: method(ExternalIdentityKeySchema.extend({
-			userId: string(),
-			issuer: string().min(1),
-			label: string().optional()
-		}), object({ success: literal(true) }), {
-			kind: "mutation",
-			auth: "admin",
-			access: "create"
-		}),
 		/** Remove one link of `userId`. `success: false` when it was not linked to that user. */
 		unlinkExternalIdentity: method(ExternalIdentityKeySchema.extend({ userId: string() }), object({ success: boolean() }), {
 			kind: "mutation",
@@ -48463,6 +49345,531 @@ var zoneRulesCapability = {
 	durability: "restored"
 };
 /**
+* `training-provider` — ONE cloud that can run the CamStack trainer.
+*
+* A thin, mockable translation layer: it knows how to run a container with a
+* GPU, move a dataset in, read the job's stdout and hand artefacts back. It
+* knows nothing about datasets, splits, floors, cost policy or Model Studio —
+* those are the `training` orchestrator's (D805). Every rule written there
+* once is what makes a second provider (RunPod, a local NVIDIA node) a new
+* manifest entry and nothing else.
+*
+* Collection, routed by the `addonId` in every single-row input (the `llm` /
+* `notification-output` posture); `describe` concat-fans across providers.
+* Every method is `admin`: these spend money.
+*
+* Every cloud object a provider creates is tagged with the orchestrator's
+* `jobKey`, so a retried submit finds the job it already started instead of
+* starting a second GPU, and `listJobs` can find orphans.
+*
+* Bytes never ride a cap field: the dataset arrives as a `ctx.peerBytes`
+* ticket the producer (pipeline-analytics) minted, and artefacts leave as a
+* ticket the provider mints (D613).
+*/
+var TrainingGpuOptionSchema = object({
+	id: string(),
+	label: string(),
+	/** List price, USD per GPU-hour, before any region multiplier. */
+	usdPerHour: number().nonnegative(),
+	vramGb: number().nonnegative()
+});
+var TrainingRegionOptionSchema = object({
+	/** `''` = any region (the provider's choice). */
+	id: string(),
+	label: string(),
+	priceMultiplier: number().positive()
+});
+/**
+* The provider's per-account settings, as the orchestrator reads them. They
+* live in the PROVIDER addon's settings (operator decision 2026-10-08: they
+* depend on the user's account), never hard-coded in the orchestrator.
+*/
+var TrainingProviderDefaultsSchema = object({
+	gpuType: string(),
+	region: string(),
+	costCapUsd: number().nonnegative(),
+	maxRuntimeSec: number().int().positive(),
+	/** Hours a FAILED job's cloud dataset is kept for debugging; 0 = delete at once. */
+	failedDatasetGraceHours: number().nonnegative()
+});
+var TrainingProviderDescriptorSchema = object({
+	addonId: string(),
+	/** `modal`, `runpod`, `fake`, … */
+	kind: string(),
+	label: string(),
+	gpuTypes: array(TrainingGpuOptionSchema).readonly(),
+	regions: array(TrainingRegionOptionSchema).readonly(),
+	maxDatasetBytes: number().int().positive(),
+	maxRuntimeSec: number().int().positive(),
+	freeTierNote: string().optional(),
+	/** Where the data goes, in one sentence the confirm dialog repeats. */
+	dataResidencyNote: string(),
+	/** Credentials are present — never the values. */
+	configured: boolean(),
+	defaults: TrainingProviderDefaultsSchema
+});
+var TrainingCredentialCheckSchema = object({
+	ok: boolean(),
+	/** Workspace / account name, when the provider says. */
+	account: string().optional(),
+	reason: _enum([
+		"missing",
+		"invalid",
+		"forbidden",
+		"network",
+		"quota"
+	]).optional(),
+	detail: string().optional()
+});
+var ProviderJobStateSchema = _enum([
+	"pending",
+	"starting",
+	"running",
+	"succeeded",
+	"failed",
+	"cancelled",
+	"lost"
+]);
+var ProviderJobStatusSchema = object({
+	jobKey: string(),
+	providerJobId: string().optional(),
+	state: ProviderJobStateSchema,
+	startedAt: number().optional(),
+	endedAt: number().optional(),
+	exitCode: number().int().optional(),
+	failureReason: string().optional(),
+	gpuType: string(),
+	region: string().optional(),
+	billedSeconds: number().nonnegative(),
+	costUsd: number().nonnegative(),
+	/** True when `costUsd` is runtime × list price, not a billing answer. */
+	costIsEstimate: boolean(),
+	lastFetchedAt: number()
+});
+/**
+* The trainer the job runs, by SOURCE revision: the provider turns it into an
+* image its own way (Modal builds the published Dockerfile at that revision;
+* a registry-pull provider maps it to a tag). Recorded on the job and echoed
+* in `result.json`.
+*/
+var TrainerSourceRefSchema = object({
+	/** Hugging Face repo id, e.g. `camstack/camstack-trainer`. */
+	repo: string().min(1),
+	/** A commit sha (never a branch) — the job must be reproducible. */
+	revision: string().regex(/^[0-9a-f]{7,64}$/)
+});
+var JobRef = {
+	addonId: string(),
+	jobKey: string().uuid()
+};
+var TrainingLogLineSchema = object({
+	ts: number(),
+	text: string()
+});
+var trainingProviderCapability = {
+	name: "training-provider",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		/** Every provider's offer and settings. Concat-fans across providers. */
+		describe: method(object({}), array(TrainingProviderDescriptorSchema).readonly(), { auth: "admin" }),
+		/** Call the provider with the stored credentials. Never returns them. */
+		validateCredentials: method(object({ addonId: string() }), TrainingCredentialCheckSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 3e4
+		}),
+		/** USD range for a run of `gpuSeconds` on `gpuType` in `region`. */
+		estimateJob: method(object({
+			addonId: string(),
+			gpuType: string(),
+			region: string(),
+			datasetBytes: number().int().nonnegative(),
+			gpuSecondsLow: number().nonnegative(),
+			gpuSecondsHigh: number().nonnegative()
+		}), object({
+			usdLow: number().nonnegative(),
+			usdHigh: number().nonnegative(),
+			notes: array(string()).readonly()
+		}), { auth: "admin" }),
+		/**
+		* Take the dataset archive behind `ticket` (minted by pipeline-analytics,
+		* same host) and land it as the job's dataset in the cloud, streamed —
+		* nothing is staged on the hub's disk. Idempotent per `jobKey`: a second
+		* call replaces a partial upload. Answers what actually landed.
+		*/
+		uploadDataset: method(object({
+			...JobRef,
+			ticket: PeerBytesTicketSchema
+		}), object({
+			bytes: number().int().nonnegative(),
+			sha256: string()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 120 * 6e4
+		}),
+		/**
+		* Start the trainer on a GPU. Looks the job up by `jobKey` first, so a
+		* retried submit never starts a second GPU. `jobSpecJson` is written next
+		* to the dataset as `job.json`; `maxRuntimeSec` is enforced by the
+		* provider (a hard timeout), not by the hub.
+		*/
+		submitJob: method(object({
+			...JobRef,
+			trainer: TrainerSourceRefSchema,
+			jobSpecJson: string().min(2).max(64e3),
+			gpuType: string(),
+			region: string(),
+			maxRuntimeSec: number().int().positive()
+		}), ProviderJobStatusSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 30 * 6e4
+		}),
+		getJob: method(object(JobRef), ProviderJobStatusSchema, {
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/** Stdout/stderr since `cursor` (opaque), oldest first, at most `max` lines. */
+		listJobEvents: method(object({
+			...JobRef,
+			cursor: string().optional(),
+			max: number().int().min(1).max(500)
+		}), object({
+			lines: array(TrainingLogLineSchema).readonly(),
+			cursor: string()
+		}), {
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/** Stop the job. Idempotent: an unknown or finished job is a no-op. */
+		cancelJob: method(object(JobRef), object({ ok: literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/** The job's `result.json`, as text (small, JSON). `found: false` before it exists. */
+		readResult: method(object(JobRef), object({
+			found: boolean(),
+			text: string().optional()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 5 * 6e4
+		}),
+		/**
+		* Offer one output file of the job (`bundle.tar`) to the caller as a
+		* one-shot `ctx.peerBytes` ticket, streamed from the cloud — the provider
+		* stages nothing on disk. The caller dials it at once.
+		*/
+		offerArtifact: method(object({
+			...JobRef,
+			path: _enum(["bundle.tar"])
+		}), object({ ticket: PeerBytesTicketSchema }), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 5 * 6e4
+		}),
+		/** Delete every cloud object tagged with `jobKey` (the dataset first). Idempotent. */
+		cleanupJob: method(object(JobRef), object({ deleted: array(string()).readonly() }), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 5 * 6e4
+		}),
+		/** Every job the provider can still see — the orphan sweep diffs it against our records. */
+		listJobs: method(object({ addonId: string() }), array(ProviderJobStatusSchema).readonly(), {
+			auth: "admin",
+			timeoutMs: 2 * 6e4
+		})
+	}
+};
+/**
+* `training` — the cloud-training orchestrator (D805). Hub-only singleton,
+* provided by `addon-training`.
+*
+* It owns what every provider must agree on, written once:
+*
+* - **Dataset versions.** Taken over from pipeline-analytics (D796): the rows
+*   live here (D808); pipeline-analytics still CUTS a version (it owns the corpus and
+*   the export plan) and reaches this store through the five row methods
+*   below, so the Retrain page and the export did not change.
+* - **Jobs.** A persisted state machine, a reconcile loop against the
+*   provider, a cost guard, a daily orphan sweep and the retention rules.
+* - **The return flow.** Verified artefacts → Model Studio
+*   (`custom-model-registry.importModelBundle`) → canary on cameras →
+*   rollback. Nothing is ever registered automatically.
+*
+* Every method is `admin`.
+*/
+/** A version WITH its frame list — what the export and a job read. */
+var TrainingDatasetVersionRowSchema = RetrainDatasetVersionSchema.omit({ frameCount: true }).extend({ frameIds: array(string()).max(2e4).readonly() });
+/** A base model a detector job can fine-tune, and the baseline it is judged against. */
+var TrainingBaseModelSchema = object({
+	modelId: string(),
+	label: string(),
+	weights: string(),
+	imgsz: number().int(),
+	baselineOnnxUrl: string(),
+	baselineFloors: record(string(), number()),
+	/** The base the fleet runs most — the UI's default. */
+	recommended: boolean()
+});
+var TrainingPresetSchema = _enum([
+	"quick",
+	"standard",
+	"thorough"
+]);
+var TrainingJobRequestSchema = object({
+	datasetVersionId: string().min(1),
+	/** The `training-provider` addon that runs it. */
+	addonId: string().min(1),
+	gpuType: string().min(1),
+	region: string(),
+	baseModelId: string().min(1),
+	preset: TrainingPresetSchema,
+	/** Freeze the backbone's first N layers; `null` = the preset's choice. */
+	freeze: number().int().nonnegative().nullable(),
+	/** Cameras held out whole for evaluation; `null` = the orchestrator's default. */
+	holdoutCameras: array(number().int()).nullable()
+});
+var TrainingSplitPlanSchema = object({
+	holdoutCameras: array(number().int()).readonly(),
+	/** Used when no camera is held out: the last N days of every camera. */
+	holdoutLastDays: number().int().nonnegative(),
+	/** Holdout subjects per class (camera holdout only; `null` = known only after the split). */
+	holdoutSupport: record(string(), number().int()).nullable(),
+	trainSubjects: number().int()
+});
+var TrainingRefusalReasonSchema = _enum([
+	"unknown-dataset",
+	"unknown-provider",
+	"provider-not-configured",
+	"unknown-base-model",
+	"unknown-gpu",
+	"dataset-too-large",
+	"no-training-subjects",
+	"job-already-running"
+]);
+var TrainingJobPlanSchema = object({
+	refusal: object({
+		reason: TrainingRefusalReasonSchema,
+		detail: string()
+	}).nullable(),
+	warnings: array(string()).readonly(),
+	split: TrainingSplitPlanSchema.nullable(),
+	estimate: object({
+		datasetBytes: number().int(),
+		uploadMinutesAt20Mbps: number(),
+		gpuSecondsLow: number(),
+		gpuSecondsHigh: number(),
+		usdLow: number(),
+		usdHigh: number(),
+		notes: array(string()).readonly()
+	}).nullable(),
+	/** Pre-filled from the provider's settings; the operator may lower or raise them. */
+	defaults: object({
+		maxCostUsd: number(),
+		maxRuntimeSec: number().int()
+	}).nullable(),
+	/** The sentence the confirm dialog repeats: where the frames go and when they are deleted. */
+	dataNotice: string()
+});
+/**
+* Orchestrator-owned states, persisted. `uploading` covers exporting the
+* archive (it is streamed, never staged). Terminal: `failed`, `cancelled`,
+* `lost`, `expired`, `discarded`. `registered` and `canary` are where a
+* result lives after the operator acted on it.
+*/
+var TrainingJobStateSchema = _enum([
+	"uploading",
+	"submitted",
+	"starting",
+	"running",
+	"collecting",
+	"ready",
+	"registered",
+	"canary",
+	"failed",
+	"cancelling",
+	"cancelled",
+	"lost",
+	"expired",
+	"discarded"
+]);
+var TrainingFailureReasonSchema = _enum([
+	"cost-cap",
+	"runtime-cap",
+	"upload-failed",
+	"submit-failed",
+	"trainer-failed",
+	"result-invalid",
+	"checksum-mismatch",
+	"fetch-failed",
+	"provider-error",
+	"hub-restart-during-upload"
+]);
+var TrainingProgressPointSchema = object({
+	epoch: number().int(),
+	map50: number().nullable(),
+	map50_95: number().nullable()
+});
+var TrainingCanarySchema = object({
+	deviceIds: array(number().int()).readonly(),
+	since: number(),
+	/** Every override the canary replaced, exactly, so rollback restores it. */
+	previous: array(object({
+		deviceId: number().int(),
+		nodeId: string(),
+		deviceKey: string(),
+		patch: object({
+			modelId: string().optional(),
+			settings: record(string(), unknown()).readonly().optional()
+		}).nullable()
+	})).readonly()
+});
+var TrainingJobSchema = object({
+	id: string(),
+	idempotencyKey: string(),
+	name: string(),
+	createdAt: number(),
+	updatedAt: number(),
+	state: TrainingJobStateSchema,
+	stage: TrainingStageSchema.nullable(),
+	failure: object({
+		reason: TrainingFailureReasonSchema,
+		stage: string().nullable(),
+		detail: string()
+	}).nullable(),
+	request: TrainingJobRequestSchema,
+	maxCostUsd: number().nonnegative(),
+	maxRuntimeSec: number().int().positive(),
+	trainer: TrainerSourceRefSchema,
+	datasetLayout: RetrainExportLayoutSchema,
+	dataset: object({
+		bytes: number().int(),
+		sha256: string(),
+		uploadedAt: number()
+	}).nullable(),
+	split: TrainingSplitPlanSchema,
+	provider: object({
+		state: ProviderJobStateSchema.nullable(),
+		providerJobId: string().nullable(),
+		startedAt: number().nullable(),
+		endedAt: number().nullable(),
+		billedSeconds: number(),
+		costUsd: number(),
+		costIsEstimate: boolean(),
+		lastPolledAt: number().nullable()
+	}),
+	progress: object({
+		epoch: number().int().nullable(),
+		epochs: number().int().nullable(),
+		etaSec: number().nullable(),
+		series: array(TrainingProgressPointSchema).readonly()
+	}),
+	/** The last lines of the job's output (≤ 200), newest last. Never frame paths. */
+	logTail: array(string()).readonly(),
+	logCursor: string().nullable(),
+	artifacts: object({
+		bundleBytes: number().int(),
+		bundleSha256: string(),
+		fetchedAt: number(),
+		/** When the staged artefacts are deleted from the hub. */
+		expiresAt: number()
+	}).nullable(),
+	/** When the provider-side copy of the frames was deleted; null while it exists. */
+	cloudDatasetDeletedAt: number().nullable(),
+	/** A failed job's dataset is kept until then (the provider's grace), then deleted. */
+	cloudCleanupDueAt: number().nullable(),
+	/** Model ids registered from this job (base, and int8 when kept). */
+	registeredModelIds: array(string()).readonly(),
+	canary: TrainingCanarySchema.nullable()
+});
+var IdInput = object({ id: string().min(1) });
+var trainingCapability = {
+	name: "training",
+	scope: "system",
+	mode: "singleton",
+	mount: { kind: "hub-only" },
+	methods: {
+		/** Store a version once. `stored: false` = that id already exists (immutable). */
+		putDatasetVersion: method(TrainingDatasetVersionRowSchema, object({ stored: boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getDatasetVersion: method(IdInput, TrainingDatasetVersionRowSchema.nullable(), { auth: "admin" }),
+		/** Every version without its frame list, newest first. */
+		listDatasetVersions: method(object({}), array(RetrainDatasetVersionSchema).readonly(), { auth: "admin" }),
+		findDatasetVersionIdByName: method(object({ name: string() }), object({ id: string().nullable() }), { auth: "admin" }),
+		removeDatasetVersion: method(IdInput, object({ removed: boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		listBaseModels: method(object({}), array(TrainingBaseModelSchema).readonly(), { auth: "admin" }),
+		/** Split, estimate, defaults and any named refusal — nothing is started. */
+		planJob: method(TrainingJobRequestSchema, TrainingJobPlanSchema, {
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/**
+		* Start a job. The same `idempotencyKey` returns the job it already
+		* started. Answers at once (`uploading`); the upload and the submit run in
+		* the background and the job record says how far they got.
+		*/
+		startJob: method(TrainingJobRequestSchema.extend({
+			name: string().min(1).max(120),
+			maxCostUsd: number().positive(),
+			maxRuntimeSec: number().int().positive(),
+			idempotencyKey: string().min(8).max(80)
+		}), discriminatedUnion("kind", [object({
+			kind: literal("started"),
+			job: TrainingJobSchema
+		}), object({
+			kind: literal("refused"),
+			reason: TrainingRefusalReasonSchema,
+			detail: string()
+		})]), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		listJobs: method(object({}), array(TrainingJobSchema).readonly(), { auth: "admin" }),
+		getJob: method(IdInput, TrainingJobSchema.nullable(), { auth: "admin" }),
+		cancelJob: method(IdInput, TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		/** The verified `result.json` of a job in `ready` or later; null before. */
+		getJobResult: method(IdInput, TrainingResultSchema.nullable(), { auth: "admin" }),
+		/** Hand the verified bundle to Model Studio; optionally canary right after. */
+		registerResult: method(IdInput.extend({ canaryDeviceIds: array(number().int()).readonly() }), TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 30 * 6e4
+		}),
+		/** Pin the registered model on these cameras, remembering what it replaced. */
+		canaryResult: method(IdInput.extend({ deviceIds: array(number().int()).min(1).readonly() }), TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		/** Put every canary camera back exactly as it was. */
+		rollbackCanary: method(IdInput, TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		/** Delete the staged artefacts of an unregistered result. */
+		discardResult: method(IdInput, TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
 * Frozen unit → spec table. `•` in the doc marks each dimension's canonical
 * unit (`factor: 1, offset: 0`). °F derives from `°C = (°F − 32) × 5/9` ⇒
 * `factor = 5/9`, `offset = -160/9` (kept as exact expressions, not rounded
@@ -49401,6 +50808,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"backup.checkBackupKey": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"backup.delete": {
 		capName: "backup",
 		capScope: "system",
@@ -49413,6 +50826,18 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"backup.disableEncryption": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"backup.getEncryption": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"backup.getEntries": {
 		capName: "backup",
 		capScope: "system",
@@ -49467,6 +50892,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"backup.setupEncryption": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"backup.trigger": {
 		capName: "backup",
 		capScope: "system",
@@ -50019,6 +51450,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"customModelRegistry.importModelBundle": {
+		capName: "custom-model-registry",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"customModelRegistry.listModels": {
 		capName: "custom-model-registry",
 		capScope: "system",
@@ -51459,6 +52896,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"keychainAdmin.acknowledgeReset": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"keychainAdmin.deleteOrphans": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -51495,6 +52938,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"keychainAdmin.resetReport": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"keychainAdmin.reveal": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -53241,6 +54690,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.offerRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.ownersWithMedia": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -55779,6 +57234,174 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"training.canaryResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.cancelJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.discardResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.findDatasetVersionIdByName": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.getDatasetVersion": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.getJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.getJobResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.listBaseModels": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.listDatasetVersions": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.listJobs": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.planJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.putDatasetVersion": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.registerResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.removeDatasetVersion": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"training.rollbackCanary": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.startJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.cancelJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.cleanupJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.describe": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.estimateJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.getJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.listJobEvents": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.listJobs": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.offerArtifact": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.readResult": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.submitJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.uploadDataset": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.validateCredentials": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"turnProvider.getTurnServers": {
 		capName: "turn-provider",
 		capScope: "system",
@@ -55803,12 +57426,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"userManagement.createApiKey": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"userManagement.createScopedToken": {
 		capName: "user-management",
 		capScope: "system",
@@ -55845,12 +57462,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.linkExternalIdentity": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
@@ -55953,12 +57564,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"userManagement.validateApiKey": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.validateCredentials": {
 		capName: "user-management",
 		capScope: "system",
@@ -57872,6 +59477,8 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	temperatureSensorCapability,
 	terminalSessionCapability,
 	toastCapability,
+	trainingCapability,
+	trainingProviderCapability,
 	turnProviderCapability,
 	updateCapability,
 	userManagementCapability,
@@ -60250,6 +61857,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"training.canaryResult": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"update.getStatus": [{
 		name: "deviceId",
 		form: "single",