@camstack/system 1.2.381 → 1.2.382

package/dist/{dist-BC0GnGeg.mjs → dist-CP5TTjwd.mjs}

@@ -708,7 +708,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-DujUvOcb.mjs
+//#region ../types/dist/sleep-r3RWkGVx.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -820,21 +820,21 @@ function collectSecretConfigKeys(schema) {
 	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
 	return keys;
 }
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sectionsOf(schema) {
-	if (!isRecord$2(schema)) return [];
+	if (!isRecord$3(schema)) return [];
 	const sections = schema["sections"];
 	return Array.isArray(sections) ? sections : [];
 }
 function fieldsOf(node) {
-	if (!isRecord$2(node)) return [];
+	if (!isRecord$3(node)) return [];
 	const fields = node["fields"];
 	return Array.isArray(fields) ? fields : [];
 }
 function walkField(field, out) {
-	if (!isRecord$2(field)) return;
+	if (!isRecord$3(field)) return;
 	const type = field["type"];
 	const key = field["key"];
 	if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
@@ -872,7 +872,7 @@ function walkField(field, out) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -883,16 +883,16 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$1(value)) return false;
+	if (!isRecord$2(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 /** Anything carrying a `$secret` key — a stored marker or a UI view of one. */
 function isSecretMarkerLike(value) {
-	return isRecord$1(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
+	return isRecord$2(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
 }
 function isSecretClear(value) {
-	return isRecord$1(value) && value["$secretClear"] === true;
+	return isRecord$2(value) && value["$secretClear"] === true;
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -1561,7 +1561,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -1574,7 +1574,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -1629,7 +1629,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -1645,7 +1645,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord(row)) {
+		if (!isRecord$1(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -1670,7 +1670,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord(incoming)) {
+			if (!isRecord$1(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -1678,7 +1678,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord(stored) ? stored : {};
+			const storedObj = isRecord$1(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -1737,12 +1737,19 @@ async function transformSecretWrite(input) {
 		}
 	};
 }
+/** Is `ref` one of `owner`'s refs? */
+function isSecretRefOwnedBy(ref, owner) {
+	return parseSecretRef(ref)?.owner === owner;
+}
 /**
 * Replace every marker in `value` with its keychain value. Returns the SAME
 * reference when there is no marker (no allocation, no keychain call).
 */
-async function resolveSecretMarkers(value, secrets) {
-	const refs = collectSecretMarkerRefs(value);
+async function resolveSecretMarkers(value, secrets, options = {}) {
+	const keepMarker = options.unresolved === "keep-marker";
+	const owner = options.ownedBy;
+	const inScope = (ref) => owner === void 0 || isSecretRefOwnedBy(ref, owner);
+	const refs = collectSecretMarkerRefs(value).filter(inScope);
 	if (refs.length === 0) return {
 		value,
 		unresolved: []
@@ -1766,10 +1773,18 @@ async function resolveSecretMarkers(value, secrets) {
 	}
 	const substitute = (v) => {
 		if (isSecretMarker(v)) {
+			if (!inScope(v.$secret)) return {
+				keep: true,
+				value: v
+			};
 			const answer = answers[v.$secret];
-			return answer?.kind === "value" ? {
+			if (answer?.kind === "value") return {
 				keep: true,
 				value: answer.value
+			};
+			return keepMarker ? {
+				keep: true,
+				value: v
 			} : {
 				keep: false,
 				value: void 0
@@ -1786,7 +1801,7 @@ async function resolveSecretMarkers(value, secrets) {
 				value: items
 			};
 		}
-		if (isRecord(v)) {
+		if (isRecord$1(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -1807,14 +1822,152 @@ async function resolveSecretMarkers(value, secrets) {
 		unresolved
 	};
 }
-function touchesTree(tree, patch) {
-	if (tree.size === 0) return false;
-	for (const key of Object.keys(patch)) {
-		const at = key.indexOf("@");
-		if (tree.has(at > 0 ? key.slice(0, at) : key)) return true;
+/** An addon tried to replace a stored secret it could not read. Nothing was written. */
+var SecretOverwriteRefusedError = class extends Error {
+	ref;
+	reason;
+	constructor(ref, reason) {
+		super(`secret ${ref} was not replaced: its stored value cannot be read right now (${reason}), and an addon may not overwrite a secret it cannot see. Nothing was written.`);
+		this.ref = ref;
+		this.reason = reason;
+		this.name = "SecretOverwriteRefusedError";
+	}
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function resolvedValue(pass, marker) {
+	const answer = pass.answers[marker.$secret];
+	return answer?.kind === "value" ? answer.value : null;
+}
+async function atMarker(pass, incoming, stored) {
+	if (incoming === null) return stored;
+	if (typeof incoming !== "string") return incoming;
+	if (incoming === resolvedValue(pass, stored)) return stored;
+	const intent = classifySecretWrite(incoming);
+	if (intent.kind !== "set") return stored;
+	const ref = stored.$secret;
+	if (!isSecretRefOwnedBy(ref, pass.secrets.owner)) return incoming;
+	const answer = pass.answers[ref];
+	if ((answer === void 0 || answer.kind === "unavailable" || answer.kind === "forbidden") && !pass.operatorWrite) throw new SecretOverwriteRefusedError(ref, answer === void 0 ? "not-initialized" : answer.kind === "unavailable" ? answer.reason : answer.kind);
+	try {
+		await pass.secrets.put(ref, intent.value);
+	} catch (err) {
+		throw new KeychainWriteRefusedError(ref, err);
+	}
+	pass.changedRefs.push(ref);
+	return stored;
+}
+function inArray(pass, incoming, stored) {
+	return incoming.map((item, index) => {
+		const twin = stored[index];
+		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
+		if (isRecord(item) && isRecord(twin)) return inArrayRow(pass, item, twin);
+		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
+		return item;
+	});
+}
+function inArrayRow(pass, incoming, stored) {
+	const out = { ...incoming };
+	for (const [key, value] of Object.entries(incoming)) {
+		const twin = stored[key];
+		if (isSecretMarker(twin)) {
+			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
+		} else if (isRecord(value) && isRecord(twin)) out[key] = inArrayRow(pass, value, twin);
+		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
+	}
+	return out;
+}
+async function walk(pass, incoming, stored) {
+	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
+	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
+	if (!isRecord(incoming) || !isRecord(stored)) return incoming;
+	const out = { ...incoming };
+	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
+	return out;
+}
+/** Restore markers a write-back carries as values. See the file doc. */
+async function restoreUnchangedSecrets(input) {
+	const refs = [];
+	for (const key of Object.keys(input.patch)) collectSecretMarkerRefs(input.stored[key], refs);
+	const owned = refs.filter((ref) => isSecretRefOwnedBy(ref, input.secrets.owner));
+	if (owned.length === 0) return {
+		patch: input.patch,
+		changedRefs: []
+	};
+	const pass = {
+		secrets: input.secrets,
+		answers: await input.secrets.resolve([...new Set(owned)]),
+		operatorWrite: input.operatorWrite,
+		changedRefs: []
+	};
+	const out = {};
+	for (const [key, value] of Object.entries(input.patch)) out[key] = await walk(pass, value, input.stored[key]);
+	return {
+		patch: out,
+		changedRefs: pass.changedRefs
+	};
+}
+/** Structural equality over JSON-shaped values (key order does not matter). */
+function isJsonEqual(a, b) {
+	if (Object.is(a, b)) return true;
+	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
+	if (isRecord(a) && isRecord(b)) {
+		const keys = Object.keys(a);
+		if (keys.length !== Object.keys(b).length) return false;
+		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
 	}
 	return false;
 }
+/** The patch without the keys whose value already equals the stored one. */
+function dropUnchangedKeys(patch, stored) {
+	const out = {};
+	for (const [key, value] of Object.entries(patch)) {
+		if (Object.prototype.hasOwnProperty.call(stored, key) && isJsonEqual(value, stored[key])) continue;
+		out[key] = value;
+	}
+	return out;
+}
+/** The top-level keys of a blob that hold at least one of `owner`'s markers. */
+function markerKeysOf(blob, owner) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const [key, value] of Object.entries(blob)) if (collectSecretMarkerRefs(value).some((ref) => isSecretRefOwnedBy(ref, owner))) keys.add(key);
+	return keys;
+}
+function nodeFromStored(value, owner) {
+	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
+	if (!isRecord(value)) return null;
+	const children = /* @__PURE__ */ new Map();
+	for (const [key, child] of Object.entries(value)) {
+		const node = nodeFromStored(child, owner);
+		if (node !== null) children.set(key, node);
+	}
+	return children.size > 0 ? {
+		kind: "object",
+		children
+	} : null;
+}
+/**
+* The declared secret tree, widened by every place the STORED blob holds a
+* marker under one of `keys` — so a marker the schema no longer declares (or
+* never declared: Wyze before b4906cec6) still gets the save path's
+* KEEP / SET / CLEAR semantics instead of being overwritten by whatever the
+* addon writes. Markers inside arrays are not added: a row has no id field to
+* match by unless the schema declares one. Only `owner`'s markers count: a
+* builtin that keeps another addon's marker (device-manager) never takes it
+* over.
+*/
+function widenTreeWithStoredMarkers(declared, stored, keys, owner) {
+	const added = /* @__PURE__ */ new Map();
+	for (const key of keys) {
+		const at = key.indexOf("@");
+		const base = at > 0 ? key.slice(0, at) : key;
+		if (declared.has(base) || added.has(base)) continue;
+		const node = nodeFromStored(stored[key], owner);
+		if (node !== null) added.set(base, node);
+	}
+	return added.size === 0 ? declared : new Map([...declared, ...added]);
+}
 /** The blob as stored now; a failed read REFUSES the write instead of guessing. */
 async function readStoredAddonBlob(raw) {
 	const threeWay = raw.readAddonStoreResult;
@@ -1823,7 +1976,41 @@ async function readStoredAddonBlob(raw) {
 	if (result.kind === "failed") throw new Error(`settings write refused: the stored blob could not be read (${result.error})`);
 	return result.kind === "missing" ? {} : result.value;
 }
-function createSecretAwareSettings(raw, opts) {
+function touchesTree(tree, patch) {
+	if (tree.size === 0) return false;
+	for (const key of Object.keys(patch)) {
+		const at = key.indexOf("@");
+		if (tree.has(at > 0 ? key.slice(0, at) : key)) return true;
+	}
+	return false;
+}
+/**
+* Which top-level keys of each store held markers when last seen. `undefined`
+* for a store not seen yet: its first write reads it, to be safe.
+*/
+var MarkerKeyIndex = class {
+	owner;
+	byStore = /* @__PURE__ */ new Map();
+	constructor(owner) {
+		this.owner = owner;
+	}
+	seen(store, blob) {
+		this.byStore.set(store, markerKeysOf(blob, this.owner));
+	}
+	wrote(store, patch) {
+		const keys = this.byStore.get(store);
+		if (keys === void 0) return;
+		const now = markerKeysOf(patch, this.owner);
+		for (const key of Object.keys(patch)) if (now.has(key)) keys.add(key);
+		else keys.delete(key);
+	}
+	mayHoldMarkers(store, patch) {
+		const keys = this.byStore.get(store);
+		if (keys === void 0) return true;
+		return Object.keys(patch).some((key) => keys.has(key));
+	}
+};
+function createHandle(raw, opts) {
 	const chains = /* @__PURE__ */ new Map();
 	const serialize = (key, fn) => {
 		const next = (chains.get(key) ?? Promise.resolve()).then(fn, fn);
@@ -1834,46 +2021,130 @@ function createSecretAwareSettings(raw, opts) {
 		});
 		return next;
 	};
-	const write = async (chainKey, tree, scope, patch, readStored, rawWrite) => {
-		if (!touchesTree(tree, patch)) return rawWrite(patch);
-		return serialize(chainKey, async () => {
+	const index = new MarkerKeyIndex(opts.secrets.owner);
+	const resolveRead = async (store, blob) => {
+		index.seen(store, blob);
+		const { value, unresolved } = await resolveSecretMarkers(blob, opts.secrets, {
+			unresolved: "keep-marker",
+			ownedBy: opts.secrets.owner
+		});
+		if (unresolved.length > 0) opts.onUnresolved?.(unresolved);
+		return value;
+	};
+	const write = async (store, declared, scope, patch, readStored, rawWrite) => {
+		if (!touchesTree(declared, patch) && !index.mayHoldMarkers(store, patch)) {
+			await rawWrite(patch);
+			index.wrote(store, patch);
+			return { changed: true };
+		}
+		return serialize(store, async () => {
 			const stored = await readStored();
+			index.seen(store, stored);
+			const operatorWrite = opts.isOperatorWrite?.() === true;
+			const restored = await restoreUnchangedSecrets({
+				patch,
+				stored,
+				secrets: opts.secrets,
+				operatorWrite
+			});
 			const result = await transformSecretWrite({
-				tree,
+				tree: widenTreeWithStoredMarkers(declared, stored, Object.keys(restored.patch), opts.secrets.owner),
 				secrets: opts.secrets,
-				patch,
+				patch: restored.patch,
 				stored,
 				...scope !== void 0 ? { scope } : {},
-				operatorWrite: opts.isOperatorWrite?.() === true
+				operatorWrite
 			});
-			if (Object.keys(result.patch).length > 0) await rawWrite(result.patch);
+			const effective = dropUnchangedKeys(result.patch, stored);
+			const wroteBlob = Object.keys(effective).length > 0;
+			if (wroteBlob) {
+				await rawWrite(effective);
+				index.wrote(store, effective);
+			}
 			const { orphaned } = await result.afterWrite();
 			if (orphaned.length > 0) opts.onOrphaned(orphaned);
+			return { changed: wroteBlob || restored.changedRefs.length > 0 };
 		});
 	};
-	const wrapped = {
-		writeAddonStore: (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p)),
-		writeDeviceStore: (deviceId, patch) => write(`device:${deviceId}`, opts.deviceTree(), {
-			kind: "device",
-			deviceId
-		}, patch, () => raw.readDeviceStore(deviceId), (p) => raw.writeDeviceStore(deviceId, p))
+	const writeAddon = (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p));
+	const readAddonStoreResult = raw.readAddonStoreResult;
+	const readAddonStoreKeyResult = raw.readAddonStoreKeyResult;
+	const readDeviceStoreBatch = raw.readDeviceStoreBatch;
+	const overrides = {
+		readAddonStore: async () => resolveRead("addon", await raw.readAddonStore()),
+		...readAddonStoreResult !== void 0 ? { readAddonStoreResult: async () => {
+			const result = await readAddonStoreResult.call(raw);
+			return result.kind === "value" ? {
+				kind: "value",
+				value: await resolveRead("addon", result.value)
+			} : result;
+		} } : {},
+		...readAddonStoreKeyResult !== void 0 ? { readAddonStoreKeyResult: async (key) => {
+			const result = await readAddonStoreKeyResult.call(raw, key);
+			if (result.kind !== "present") return result;
+			const { value, unresolved } = await resolveSecretMarkers({ [key]: result.value }, opts.secrets, {
+				unresolved: "keep-marker",
+				ownedBy: opts.secrets.owner
+			});
+			if (unresolved.length > 0) opts.onUnresolved?.(unresolved);
+			return {
+				kind: "present",
+				value: value[key]
+			};
+		} } : {},
+		readDeviceStore: async (deviceId) => resolveRead(`device:${deviceId}`, await raw.readDeviceStore(deviceId)),
+		...readDeviceStoreBatch !== void 0 ? { readDeviceStoreBatch: async (deviceIds) => {
+			const rows = await readDeviceStoreBatch.call(raw, deviceIds);
+			const out = /* @__PURE__ */ new Map();
+			for (const [deviceId, blob] of rows) out.set(deviceId, await resolveRead(`device:${deviceId}`, blob));
+			return out;
+		} } : {},
+		writeAddonStore: async (patch) => {
+			await writeAddon(patch);
+		},
+		writeDeviceStore: async (deviceId, patch) => {
+			await write(`device:${deviceId}`, opts.deviceTree(), {
+				kind: "device",
+				deviceId
+			}, patch, () => raw.readDeviceStore(deviceId), (p) => raw.writeDeviceStore(deviceId, p));
+		}
+	};
+	return {
+		settings: new Proxy(raw, { get(target, prop, receiver) {
+			if (typeof prop === "string" && Object.prototype.hasOwnProperty.call(overrides, prop)) return Reflect.get(overrides, prop);
+			const value = Reflect.get(target, prop, receiver);
+			return typeof value === "function" ? value.bind(target) : value;
+		} }),
+		raw: {
+			readAddonStore: async () => {
+				const blob = await raw.readAddonStore();
+				index.seen("addon", blob);
+				return blob;
+			},
+			readDeviceStore: async (deviceId) => {
+				const blob = await raw.readDeviceStore(deviceId);
+				index.seen(`device:${deviceId}`, blob);
+				return blob;
+			}
+		},
+		writeAddonStore: writeAddon
 	};
-	return new Proxy(raw, { get(target, prop, receiver) {
-		if (prop === "writeAddonStore") return wrapped.writeAddonStore;
-		if (prop === "writeDeviceStore") return wrapped.writeDeviceStore;
-		const value = Reflect.get(target, prop, receiver);
-		return typeof value === "function" ? value.bind(target) : value;
-	} });
-}
-/** The context the addon sees: identical, except that its settings writes are secret-aware. */
-function withSecretAwareSettings(context, opts) {
+}
+/** The context the addon sees, plus the private raw view and write outcome. */
+function createSecretAwareContext(context, opts) {
 	const raw = context.settings;
-	if (raw === void 0) return context;
-	const settings = createSecretAwareSettings(raw, opts);
-	return new Proxy(context, { get(target, prop, receiver) {
-		if (prop === "settings") return settings;
-		return Reflect.get(target, prop, receiver);
-	} });
+	if (raw === void 0) return {
+		context,
+		handle: null
+	};
+	const handle = createHandle(raw, opts);
+	return {
+		context: new Proxy(context, { get(target, prop, receiver) {
+			if (prop === "settings") return handle.settings;
+			return Reflect.get(target, prop, receiver);
+		} }),
+		handle
+	};
 }
 var LEAF = { kind: "leaf" };
 var DEFAULT_ITEM_ID_KEY = "id";
@@ -2061,6 +2332,14 @@ var BaseAddon = class {
 	_secretChangeUnsub = null;
 	/** >0 while an OPERATOR's settings write is being applied. */
 	_operatorWriteDepth = 0;
+	/**
+	* The keychain-aware settings handle (D798). Its `raw` view is the ONLY way
+	* to the marker-bearing blobs and stays private to this class: the form
+	* hydrate and config resolution need markers, addon code never does.
+	*/
+	_secretSettings = null;
+	/** Refs an addon-facing read could not resolve — each is logged once per process. */
+	_loggedUnresolvedReads = /* @__PURE__ */ new Set();
 	constructor(defaults) {
 		this.defaults = defaults;
 		this._config = { ...defaults };
@@ -2097,13 +2376,21 @@ var BaseAddon = class {
 	}
 	async initialize(context) {
 		const secrets = context.secrets;
-		this._ctx = secrets !== void 0 ? withSecretAwareSettings(context, {
-			secrets,
-			addonTree: () => this.addonSecretTree(),
-			deviceTree: () => this.deviceSecretTree(),
-			onOrphaned: (refs) => context.logger.warn("keychain refs dropped by a settings write could not be deleted", { meta: { refs: [...refs] } }),
-			isOperatorWrite: () => this._operatorWriteDepth > 0
-		}) : context;
+		if (secrets !== void 0) {
+			const { context: wrapped, handle } = createSecretAwareContext(context, {
+				secrets,
+				addonTree: () => this.addonSecretTree(),
+				deviceTree: () => this.deviceSecretTree(),
+				onOrphaned: (refs) => context.logger.warn("keychain refs dropped by a settings write could not be deleted", { meta: { refs: [...refs] } }),
+				isOperatorWrite: () => this._operatorWriteDepth > 0,
+				onUnresolved: (unresolved) => this.logUnresolvedRead(unresolved)
+			});
+			this._ctx = wrapped;
+			this._secretSettings = handle;
+		} else {
+			this._ctx = context;
+			this._secretSettings = null;
+		}
 		await this.resolveConfig();
 		if (secrets !== void 0) this._secretChangeUnsub = secrets.onChange((ref) => {
 			if (this._configSecretRefs.has(ref)) this.scheduleSecretReresolve(SECRET_CHANGE_DEBOUNCE_MS);
@@ -2220,11 +2507,8 @@ var BaseAddon = class {
 	async getGlobalSettings(overlay, cap, nodeId) {
 		const schema = this.globalSettingsSchema(cap);
 		if (!schema) return { sections: [] };
-		const projected = await this.resolveGlobalStore(nodeId, cap);
-		return hydrateSchema(schema, overlay ? {
-			...projected,
-			...overlay
-		} : projected, { inlineSecretsAsViews: true });
+		const projected = await this.readRawProjectedStore(nodeId, cap);
+		return hydrateSchema(schema, overlay ? await this.overlayKeepingMarkers(projected, overlay) : projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The integration-level view of this addon's settings: exactly the sections
@@ -2269,7 +2553,7 @@ var BaseAddon = class {
 			});
 		}
 		if (sections.length === 0) return null;
-		const projected = await this.resolveGlobalStore(nodeId);
+		const projected = await this.readRawProjectedStore(nodeId);
 		return hydrateSchema({
 			...schema,
 			sections
@@ -2286,12 +2570,50 @@ var BaseAddon = class {
 	* the store for custom option logic (option narrowing, value snapping) to
 	* read it per-node — never `ctx.settings.readAddonStore()` directly.
 	* `nodeId` omitted ⇒ the local node (node-blind injection from ctx).
+	*
+	* Keychain values come back RESOLVED (D798): a secret reads as its value,
+	* never as a `{ $secret }` marker. One the keychain cannot serve right now
+	* stays a marker — "stored, unavailable" (`isSecretMarker()` is true, and it
+	* is listed in {@link unresolvedSecrets}) — never `''` and never absent, so
+	* it cannot be mistaken for "nothing stored, mint a new one". Writing the
+	* resolved blob back is a no-op for every unchanged secret.
 	*/
 	async resolveGlobalStore(nodeId, cap) {
 		const raw = await this._ctx?.settings?.readAddonStore() ?? {};
+		return this.projectForNode(raw, nodeId, cap);
+	}
+	projectForNode(store, nodeId, cap) {
 		const keys = this.perNodeKeys(cap);
 		const node = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
-		return keys.size > 0 ? projectStore(raw, keys, node) : raw;
+		return keys.size > 0 ? projectStore(store, keys, node) : store;
+	}
+	/** The PROJECTED store with its markers — the form hydrate only (D798). */
+	async readRawProjectedStore(nodeId, cap) {
+		const raw = await this.rawSettings()?.readAddonStore() ?? {};
+		return this.projectForNode(raw, nodeId, cap);
+	}
+	/**
+	* `{ ...stored, ...overlay }`, except that an overlay member equal to the
+	* RESOLVED stored one keeps the stored (marker-bearing) member — so a form
+	* hydrated from a resolved overlay still shows a secret as "set", never as
+	* its value.
+	*/
+	async overlayKeepingMarkers(stored, overlay) {
+		const secrets = this._ctx?.secrets;
+		const merged = {
+			...stored,
+			...overlay
+		};
+		if (secrets === void 0 || collectSecretMarkerRefs(stored).length === 0) return merged;
+		const { value: resolved } = await resolveSecretMarkers(stored, secrets, {
+			unresolved: "keep-marker",
+			ownedBy: secrets.owner
+		});
+		for (const key of Object.keys(overlay)) {
+			if (collectSecretMarkerRefs(stored[key]).length === 0) continue;
+			if (isJsonEqual(overlay[key], resolved[key])) merged[key] = stored[key];
+		}
+		return merged;
 	}
 	/**
 	* Whether ONE global key of this addon's store was written, read three-way
@@ -2356,8 +2678,12 @@ var BaseAddon = class {
 	async clearSecrets(keys, nodeId) {
 		const tree = this.addonSecretTree();
 		const keychain = this._ctx?.secrets !== void 0;
+		const stored = keychain ? await this.readAddonStoreWithRetry() : {};
 		const patch = {};
-		for (const key of keys) patch[key] = keychain && tree.has(key) ? SECRET_CLEAR : "";
+		for (const key of keys) {
+			const keychainStored = tree.has(key) || collectSecretMarkerRefs(stored[key]).length > 0;
+			patch[key] = keychain && keychainStored ? SECRET_CLEAR : "";
+		}
 		await this.applyGlobalPatch(patch, nodeId);
 	}
 	async applyGlobalPatch(barePatch, nodeId) {
@@ -2365,7 +2691,11 @@ var BaseAddon = class {
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
 		const scoped = keys.size > 0 ? scopePatch(barePatch, keys, target) : barePatch;
-		await this._ctx?.settings?.writeAddonStore(scoped);
+		const handle = this._secretSettings;
+		if (handle !== null) {
+			const { changed } = await handle.writeAddonStore(scoped);
+			if (!changed) return;
+		} else await this._ctx?.settings?.writeAddonStore(scoped);
 		if (target !== localNode) return;
 		await this.resolveConfig();
 		await this.onConfigChanged();
@@ -2418,7 +2748,7 @@ var BaseAddon = class {
 	async getDeviceSettings(deviceId) {
 		const schema = this.deviceSettingsSchema();
 		if (!schema) return { sections: [] };
-		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, { inlineSecretsAsViews: true });
+		return hydrateSchema(schema, await this.rawSettings()?.readDeviceStore(deviceId) ?? {}, { inlineSecretsAsViews: true });
 	}
 	async updateDeviceSettings(deviceId, patch) {
 		await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
@@ -2590,7 +2920,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: async () => this.resolveStoredSecrets(await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, false),
+			read: async () => this.resolveStoredSecrets(await this.rawSettings()?.readDeviceStore(deviceId) ?? {}, false),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
 			},
@@ -2652,6 +2982,23 @@ var BaseAddon = class {
 		}
 		return value;
 	}
+	/**
+	* The marker-bearing settings reads (D798) — private on purpose. Without a
+	* keychain the context's own view is already raw.
+	*/
+	rawSettings() {
+		return this._secretSettings?.raw ?? this._ctx?.settings;
+	}
+	/** An addon-facing read met markers it could not resolve: say so once per ref. */
+	logUnresolvedRead(unresolved) {
+		const fresh = unresolved.filter((u) => !this._loggedUnresolvedReads.has(u.ref));
+		if (fresh.length === 0) return;
+		for (const u of fresh) this._loggedUnresolvedReads.add(u.ref);
+		this._ctx?.logger?.warn?.("settings read: a stored secret is unavailable — it reads as its marker, not as a value", { meta: { secrets: fresh.map((u) => ({
+			ref: u.ref,
+			reason: u.reason
+		})) } });
+	}
 	/** Re-resolve the config (a keychain-only change, or a retry) and apply it. */
 	scheduleSecretReresolve(delayMs) {
 		const timerOf = delayMs === SECRET_CHANGE_DEBOUNCE_MS ? "_secretChangeTimer" : "_secretRetryTimer";
@@ -2678,7 +3025,7 @@ var BaseAddon = class {
 	* `{}` (defaults) — the addon's first successful patch will rehydrate.
 	*/
 	async readAddonStoreWithRetry() {
-		const settings = this._ctx?.settings;
+		const settings = this.rawSettings();
 		if (!settings) return {};
 		const delaysMs = [
 			150,
@@ -6652,6 +6999,278 @@ var DERIVED_CAMERA_SILENCED_CAP_NAMES = [
 	"scene-monitor"
 ];
 /**
+* The trainer contract — what the hub hands the cloud trainer and what it
+* gets back (cloud training, D805+).
+*
+* The trainer (`hf/camstack-trainer`, published as the Hugging Face repo
+* `camstack/camstack-trainer`) is a separate AGPL program the hub never
+* imports: `job.json` goes in, files come out, and progress is `CAMSTACK_EVENT`
+* lines on stdout. These schemas are the hub's half of that boundary; the
+* trainer's pydantic models (and the JSON Schemas generated from them under
+* `hf/camstack-trainer/schemas/`) are the other half. A change here is a
+* change there, in the same piece of work.
+*
+* No `.default()` anywhere: defaults do not run on the addon cap path, so the
+* orchestrator fills every field of a job spec explicitly.
+*/
+var TRAINING_JOB_SCHEMA = "camstack.training/v1";
+var TRAINING_RESULT_SCHEMA = "camstack.training-result/v1";
+/** What the trainer can export. Edge TPU is a later, separate image. */
+var TrainingExportSchema = z.enum([
+	"onnx",
+	"openvino-fp16",
+	"openvino-int8",
+	"coreml-fp16"
+]);
+var FloorsSchema = z.record(z.string(), z.number().min(0).max(1));
+z.object({
+	schema: z.literal(TRAINING_JOB_SCHEMA),
+	jobKey: z.string().uuid(),
+	target: z.object({
+		kind: z.literal("detector"),
+		step: z.literal("object-detection")
+	}),
+	base: z.object({
+		modelId: z.string().min(1),
+		/** Ultralytics weights id, e.g. `yolov9m.pt`. */
+		weights: z.string().min(1),
+		imgsz: z.number().int().positive()
+	}),
+	baseline: z.object({
+		modelId: z.string().min(1),
+		/** The baseline ONNX the holdout comparison runs; public mirror URL. */
+		onnxUrl: z.string().url(),
+		imgsz: z.number().int().positive(),
+		floors: FloorsSchema
+	}),
+	dataset: z.object({
+		versionId: z.string().min(1),
+		annotationHash: z.string(),
+		/** sha256 of the uploaded archive; the trainer refuses a mismatch (exit 65). */
+		sha256: z.string().regex(/^[0-9a-f]{64}$/)
+	}),
+	split: z.object({
+		holdoutCameras: z.array(z.number().int()),
+		/** When no camera is held out: the last N days of every camera. */
+		holdoutLastDays: z.number().int().nonnegative(),
+		valFraction: z.number().min(0).max(.5),
+		seed: z.number().int()
+	}),
+	hyper: z.object({
+		epochs: z.number().int().positive(),
+		batch: z.number().int().positive(),
+		lr0: z.number().positive(),
+		/** Layers frozen from the start of the backbone; 0 = none. */
+		freeze: z.number().int().nonnegative(),
+		patience: z.number().int().nonnegative(),
+		seed: z.number().int()
+	}),
+	replay: z.object({
+		source: z.literal("coco2017"),
+		count: z.number().int().nonnegative()
+	}),
+	exports: z.array(TrainingExportSchema).min(1),
+	calibration: z.object({ maxFrames: z.number().int().positive() }),
+	floors: z.object({
+		minSupport: z.number().int().positive(),
+		clamp: z.number().min(0).max(1)
+	}),
+	int8Gate: z.object({ maxMap50Drop: z.number().min(0).max(1) }),
+	catalog: z.object({
+		id: z.string().regex(/^[a-z0-9][a-z0-9-]{2,80}$/),
+		name: z.string().min(1).max(160)
+	})
+});
+/** One regular file of the bundle. An mlpackage contributes one row per member. */
+var TrainingResultFileSchema = z.object({
+	path: z.string().min(1),
+	bytes: z.number().int().nonnegative(),
+	sha256: z.string().regex(/^[0-9a-f]{64}$/),
+	format: z.enum([
+		"onnx",
+		"openvino",
+		"coreml",
+		"pt"
+	]),
+	variant: z.enum(["base", "int8"])
+});
+var DraftFormatSchema = z.object({
+	/** RELATIVE path inside the bundle; the hub rewrites it to `camstack-local://`. */
+	url: z.string().min(1),
+	sizeMB: z.number().nonnegative(),
+	isDirectory: z.boolean().optional(),
+	files: z.array(z.string()).optional(),
+	runtimes: z.array(z.literal("python")).optional(),
+	revision: z.string().min(1)
+});
+/** The trainer's half of a catalog entry; the hub completes it (labels, licence, group). */
+var TrainingCatalogDraftSchema = z.object({
+	id: z.string().min(1),
+	name: z.string().min(1),
+	description: z.string(),
+	labels: z.array(z.unknown()),
+	inputSize: z.object({
+		width: z.number().int().positive(),
+		height: z.number().int().positive()
+	}),
+	preprocessMode: z.literal("letterbox"),
+	defaultClassFloors: FloorsSchema,
+	formats: z.object({
+		onnx: DraftFormatSchema.optional(),
+		openvino: DraftFormatSchema.optional(),
+		coreml: DraftFormatSchema.optional()
+	})
+});
+/** One class of one model's holdout report (the eval harness's summary). */
+var TrainingEvalClassSchema = z.object({
+	positives: z.number().int(),
+	floor: z.number().nullable(),
+	tp: z.number().int(),
+	fp: z.number().int(),
+	fn: z.number().int(),
+	precision: z.number().nullable(),
+	recall: z.number().nullable(),
+	ap50: z.number().nullable(),
+	recallByCamera: z.record(z.string(), z.number().nullable()).optional(),
+	recallByLight: z.record(z.string(), z.number().nullable()).optional(),
+	fpByCamera: z.record(z.string(), z.number()).optional(),
+	smallFound: z.number().int().optional(),
+	smallTotal: z.number().int().optional()
+}).passthrough();
+var TrainingEvalReportSchema = z.object({
+	frames: z.number().int(),
+	classes: z.record(z.string(), TrainingEvalClassSchema)
+}).passthrough();
+/**
+* A succeeded result carries every block; a failed one carries the error and
+* whatever was known by then — the other blocks are ABSENT, not null. The
+* orchestrator checks the blocks it needs before it trusts a success.
+*/
+var TrainingResultSchema = z.object({
+	schema: z.literal(TRAINING_RESULT_SCHEMA),
+	jobKey: z.string(),
+	status: z.enum(["succeeded", "failed"]),
+	error: z.object({
+		stage: z.string(),
+		code: z.string(),
+		message: z.string()
+	}).nullable(),
+	trainer: z.object({
+		version: z.string(),
+		revision: z.string()
+	}),
+	toolchain: z.record(z.string(), z.string().nullable()),
+	dataset: z.object({
+		versionId: z.string(),
+		annotationHash: z.string(),
+		sha256: z.string(),
+		frames: z.object({
+			train: z.number().int(),
+			val: z.number().int(),
+			holdout: z.number().int()
+		}),
+		holdoutCameras: z.array(z.number().int()),
+		replayImages: z.number().int()
+	}).optional(),
+	training: z.object({
+		epochsRun: z.number().int(),
+		bestEpoch: z.number().int(),
+		bestMap50: z.number(),
+		bestMap50_95: z.number(),
+		seconds: z.number()
+	}).optional(),
+	evaluation: z.object({
+		holdoutFrames: z.number().int(),
+		baseline: TrainingEvalReportSchema.nullable(),
+		candidate: TrainingEvalReportSchema.nullable(),
+		candidateInt8: TrainingEvalReportSchema.nullable(),
+		recallDeltaByCamera: z.record(z.string(), z.record(z.string(), z.number())).nullable(),
+		map50: z.record(z.string(), z.number().nullable())
+	}).optional(),
+	floors: z.object({
+		baseline: FloorsSchema,
+		candidate: FloorsSchema,
+		candidateInt8: FloorsSchema.nullable(),
+		notes: z.array(z.string())
+	}).optional(),
+	int8: z.object({
+		kept: z.boolean(),
+		map50Fp16: z.number().nullable(),
+		map50Int8: z.number().nullable(),
+		reason: z.string().nullable()
+	}).optional(),
+	exportsDropped: z.array(z.object({
+		export: z.string(),
+		reason: z.string()
+	})).optional(),
+	files: z.array(TrainingResultFileSchema).optional(),
+	bundle: z.object({
+		path: z.literal("bundle.tar"),
+		bytes: z.number().int().nonnegative(),
+		sha256: z.string().regex(/^[0-9a-f]{64}$/)
+	}).nullable().optional(),
+	catalogDraft: z.object({
+		base: TrainingCatalogDraftSchema,
+		int8: TrainingCatalogDraftSchema.nullable()
+	}).nullable().optional(),
+	licence: z.string()
+});
+var TrainingStageSchema = z.enum([
+	"prepare",
+	"replay",
+	"train",
+	"eval",
+	"export",
+	"package"
+]);
+var EventBase = {
+	v: z.literal(1),
+	ts: z.number()
+};
+z.discriminatedUnion("type", [
+	z.object({
+		...EventBase,
+		type: z.literal("stage"),
+		stage: TrainingStageSchema
+	}),
+	z.object({
+		...EventBase,
+		type: z.literal("epoch"),
+		epoch: z.number().int(),
+		epochs: z.number().int(),
+		boxLoss: z.number().nullable().optional(),
+		map50: z.number().nullable().optional(),
+		map50_95: z.number().nullable().optional(),
+		etaSec: z.number().nullable().optional()
+	}),
+	z.object({
+		...EventBase,
+		type: z.literal("metric"),
+		name: z.string(),
+		value: z.number()
+	}),
+	z.object({
+		...EventBase,
+		type: z.literal("artifact"),
+		path: z.string(),
+		bytes: z.number(),
+		sha256: z.string()
+	}),
+	z.object({
+		...EventBase,
+		type: z.literal("done"),
+		status: z.enum(["succeeded", "failed"]),
+		resultSha256: z.string().nullable().optional()
+	}),
+	z.object({
+		...EventBase,
+		type: z.literal("error"),
+		stage: z.string(),
+		code: z.string(),
+		message: z.string()
+	})
+]);
+/**
 * What the gate decided about a birth, from the CALLER's point of view.
 *
 * Deliberately not `ConfirmationVerdict`: `undecided` is not a birth decision
@@ -9408,7 +10027,9 @@ var AddonHttpRouteSchema = z.object({
 		"authenticated",
 		"admin"
 	]).optional(),
-	description: z.string().optional()
+	description: z.string().optional(),
+	/** The hub limits this route per client address before the handler runs. */
+	rateLimit: z.enum(["auth"]).optional()
 });
 /**
 * Cross-process route invocation envelope. The hub captures the
@@ -10372,6 +10993,37 @@ var BackupDestinationInfoSchema = z.object({
 	lastError: z.string().optional()
 });
 /**
+* How an archive is encrypted (operator decision 2026-10-09): to a backup
+* PUBLIC key the hub holds, so only the operator's secret key opens it.
+* Absent on a plain `.tar.gz` — every archive made before encryption, or
+* with it off — which restores without a key.
+*/
+var BackupArchiveEncryptionSchema = z.object({
+	/** `x25519-hkdf-aes256gcm-stream-v1`. */
+	scheme: z.string(),
+	/** 16 hex — the backup key whose secret restores this archive. */
+	keyId: z.string()
+});
+/**
+* The backup encryption setting. The hub keeps PUBLIC keys only: the active
+* one new archives are encrypted to, and the retired ones older archives
+* still need. The secret key is shown once, at `setupEncryption`.
+*/
+var BackupEncryptionStatusSchema = z.object({
+	enabled: z.boolean(),
+	active: z.object({
+		keyId: z.string(),
+		publicKey: z.string(),
+		createdAt: z.number()
+	}).nullable(),
+	/** Every key ever set up, newest first. */
+	keys: z.array(z.object({
+		keyId: z.string(),
+		createdAt: z.number(),
+		retiredAt: z.number().nullable()
+	})).readonly()
+});
+/**
 * Per-archive entry returned by `backup.listArchives({ destinationId })`.
 * Same shape the destination drill-in renders. Sourced from the per-
 * location `manifests.json` (no per-archive tarball read required).
@@ -10383,7 +11035,9 @@ var BackupArchiveEntrySchema = z.object({
 	sizeBytes: z.number(),
 	label: z.string().optional(),
 	/** Top-level locations included in the archive (db, addons, tls, …). */
-	locations: z.array(z.string()).readonly()
+	locations: z.array(z.string()).readonly(),
+	/** Present when the archive is encrypted; restore then needs that key. */
+	encryption: BackupArchiveEncryptionSchema.optional()
 });
 var BackupEntrySchema = z.object({
 	id: z.string(),
@@ -10392,7 +11046,8 @@ var BackupEntrySchema = z.object({
 	label: z.string().optional(),
 	createdAt: z.number(),
 	sizeBytes: z.number(),
-	locations: z.array(z.string()).optional()
+	locations: z.array(z.string()).optional(),
+	encryption: BackupArchiveEncryptionSchema.optional()
 });
 var ArchiveEntrySchema = z.object({
 	path: z.string(),
@@ -10647,11 +11302,58 @@ var backupCapability = {
 			* this list and skips entries whose path doesn't start with
 			* any of them.
 			*/
-			locations: z.array(z.string()).optional()
+			locations: z.array(z.string()).optional(),
+			/**
+			* The backup SECRET key, for an encrypted archive (ignored for a plain
+			* one). The archive is decrypted into the hub's private staging
+			* before the restart; the key is not stored. A wrong or missing key
+			* is refused before the archive is downloaded.
+			*/
+			backupSecretKey: z.string().optional()
 		}), z.void(), {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/** The encryption setting — public keys only. */
+		getEncryption: method(z.void(), BackupEncryptionStatusSchema, { auth: "admin" }),
+		/**
+		* Turn encryption on, or replace the key: generates a new key pair, keeps
+		* the PUBLIC key, and returns the SECRET key — once. It is never stored
+		* on the hub and cannot be shown again; archives made from now on need
+		* it to be restored. A previous key is retired: archives made with it
+		* still need IT.
+		*/
+		setupEncryption: method(z.object({}), z.object({
+			keyId: z.string(),
+			secretKey: z.string(),
+			publicKey: z.string(),
+			createdAt: z.number(),
+			replacedKeyId: z.string().nullable()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** New archives are plain again. Existing encrypted archives keep needing their key. */
+		disableEncryption: method(z.object({}), z.object({ disabledKeyId: z.string().nullable() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Does this secret key parse, and which backup key is it? A mutation so
+		* the key never travels in a URL. Nothing is stored.
+		*/
+		checkBackupKey: method(z.object({ backupSecretKey: z.string() }), z.object({
+			valid: z.boolean(),
+			keyId: z.string().nullable(),
+			/** The hub knows this key (active or retired). */
+			known: z.boolean(),
+			/** It is the key new archives are encrypted to. */
+			active: z.boolean(),
+			error: z.string().optional()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		delete: method(z.object({
 			destinationId: z.string(),
 			backupId: z.string()
@@ -14162,22 +14864,87 @@ var CustomModelDescriptorSchema = z.object({
 	stepId: z.string(),
 	entry: ModelCatalogEntrySchema
 });
+/** One regular file of an imported bundle, as the producer measured it. */
+var ModelBundleFileSchema = z.object({
+	/** Relative path inside the bundle tar; an mlpackage member is `<x>.mlpackage/<member>`. */
+	path: z.string().min(1),
+	bytes: z.number().int().nonnegative(),
+	sha256: z.string().regex(/^[0-9a-f]{64}$/)
+});
+var ImportModelBundleInputSchema = z.object({
+	/** The registry provider that keeps the model (Model Studio). */
+	addonId: z.string(),
+	stepId: z.string().min(1),
+	/**
+	* The catalog rows to register, complete, every format URL already
+	* `camstack-local://<modelId>/<file>` naming a file of the bundle. One
+	* bundle may carry several rows (a base and its INT8 variant).
+	*/
+	entries: z.array(ModelCatalogEntrySchema).min(1).max(4),
+	/** The bundle tar, offered by the producer over `ctx.peerBytes` (same host). */
+	bundle: z.object({
+		ticket: PeerBytesTicketSchema,
+		bytes: z.number().int().positive(),
+		sha256: z.string().regex(/^[0-9a-f]{64}$/)
+	}),
+	/** Every file the tar must hold; anything missing, extra or different is refused. */
+	files: z.array(ModelBundleFileSchema).min(1).max(64),
+	/** Convert missing engine formats and push the model to every agent afterwards. */
+	distribute: z.boolean()
+});
+var ImportModelBundleResultSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("imported"),
+	modelIds: z.array(z.string()).readonly(),
+	distributed: z.array(z.object({
+		modelId: z.string(),
+		nodeId: z.string(),
+		format: z.enum(MODEL_FORMATS),
+		ok: z.boolean(),
+		error: z.string().optional()
+	})).readonly()
+}), z.object({
+	kind: z.literal("refused"),
+	reason: z.enum([
+		"transfer-failed",
+		"checksum-mismatch",
+		"bundle-mismatch",
+		"invalid-entry",
+		"id-taken"
+	]),
+	detail: z.string()
+})]);
 var customModelRegistryCapability = {
 	name: "custom-model-registry",
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { 
-	/**
-	* `internal: true` did not gate the mount (see the 2026-08-26 note on
-	* `data-store-provider`) — this was reachable on the AppRouter by ANY
-	* authenticated session at the default `auth: 'protected'`. The only
-	* consumer, the detection-pipeline's model resolution
-	* (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
-	* `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
-	* never tRPC — so `auth: 'admin'` costs it nothing.
-	*/
-listModels: method(z.void(), z.array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }) }
+	methods: {
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — this was reachable on the AppRouter by ANY
+		* authenticated session at the default `auth: 'protected'`. The only
+		* consumer, the detection-pipeline's model resolution
+		* (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
+		* `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
+		* never tRPC — so `auth: 'admin'` costs it nothing.
+		*/
+		listModels: method(z.void(), z.array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }),
+		/**
+		* Register a model whose files arrive as ONE bundle tar (D806): the tar
+		* is taken over `ctx.peerBytes`, checked against `bundle.sha256` and
+		* every row of `files`, unpacked into the hub's flat modelsDir (directory
+		* formats included), each format's `.revision` record written, the rows
+		* upserted under the operator's name, the hub marked available and —
+		* when asked — engine formats converted and the model distributed. A
+		* model id already registered by another source is refused, never
+		* overwritten.
+		*/
+		importModelBundle: method(ImportModelBundleInputSchema, ImportModelBundleResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 30 * 6e4
+		})
+	}
 };
 /**
 * Query filter for settings-store collections.
@@ -14984,6 +15751,42 @@ var KeychainKeySourceSchema = z.object({
 	*/
 	sharesBackupWithDatabase: z.boolean()
 });
+/**
+* Who reset the keychain: an operator from System → Secrets (`user:<id>`), or
+* the one-shot `<dataDir>/.keychain/RESET_KEYCHAIN` trigger file at boot
+* (`trigger-file`) — the only way back into a hub whose master key is lost,
+* because a locked keychain leaves no session that could reach the page (D797).
+*/
+var KEYCHAIN_RESET_TRIGGER_ACTOR = "trigger-file";
+/**
+* One keychain reset, as the Secrets page reports it until the operator
+* acknowledges it. Never a value: refs, counts and table names only.
+*/
+var KeychainResetRecordSchema = z.object({
+	id: z.string(),
+	at: z.number(),
+	/** `user:<id>` or {@link KEYCHAIN_RESET_TRIGGER_ACTOR}. */
+	actor: z.string(),
+	/** Why the keychain was locked when it was reset; `null` when it was not locked. */
+	lockedReason: z.string().nullable(),
+	/** Values moved into the archive table (ciphertext under the lost key). */
+	archived: z.number().int(),
+	/** `keychain:secrets-orphaned-<ts>`, or `null` when nothing was stored. */
+	archivedCollection: z.string().nullable(),
+	/**
+	* `keychain:keys-orphaned-<ts>`: the wrapped data keys of the archive, kept
+	* so the archive can still be opened if the lost master key turns up.
+	*/
+	archivedKeysCollection: z.string().nullable(),
+	/**
+	* `system-settings` keys whose marker the reset cleared — the cluster
+	* secret's: a marker left pointing at an archived value would refuse every
+	* agent forever (D797).
+	*/
+	clearedSettingsKeys: z.array(z.string()).readonly(),
+	/** When an operator dismissed the notice on the Secrets page; `null` until then. */
+	acknowledgedAt: z.number().nullable()
+});
 var KeychainStatusSchema = z.object({
 	keychain: KeychainStateSchema,
 	/** The source of the master key in use; `null` while locked. */
@@ -15001,7 +15804,9 @@ var KeychainStatusSchema = z.object({
 	/** Wrapped copies of the data key under a previous master key, kept until purged. */
 	retiredWraps: z.number().int(),
 	recoveryKeyDownloadedAt: z.number().nullable(),
-	secretCount: z.number().int()
+	secretCount: z.number().int(),
+	/** The most recent reset, acknowledged or not; `null` when the keychain was never reset. */
+	lastReset: KeychainResetRecordSchema.nullable()
 });
 /**
 * Whether a stored value is still pointed at by its owner's settings.
@@ -15023,13 +15828,14 @@ var KeychainAuditActionSchema = z.enum([
 	"download-recovery-key",
 	"delete-orphans",
 	"reset",
+	"acknowledge-reset",
 	"initialize"
 ]);
 var KeychainAuditEntrySchema = z.object({
 	id: z.string(),
 	at: z.number(),
 	action: KeychainAuditActionSchema,
-	/** `addon:<id>` | `user:<id>` | `system`. */
+	/** `addon:<id>` | `user:<id>` | `system` | `trigger-file`. */
 	actor: z.string(),
 	ref: z.string().nullable(),
 	detail: z.string().nullable()
@@ -15139,6 +15945,21 @@ var keychainAdminCapability = {
 			kind: "mutation",
 			auth: "admin",
 			caller: "required"
+		}),
+		/**
+		* What the last reset left to re-enter: the archived refs (owner, scope,
+		* field — never a value) that hold no value again yet. Process-held refs
+		* the hub regenerates itself (the session signing key) are not listed.
+		*/
+		resetReport: method(z.object({}), z.object({
+			reset: KeychainResetRecordSchema.nullable(),
+			pendingReentry: z.array(KeychainSecretMetaSchema).readonly()
+		}), { auth: "admin" }),
+		/** Dismiss the "keychain was reset" notice. Audited. */
+		acknowledgeReset: method(z.object({}), z.object({ acknowledged: z.boolean() }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
 		})
 	}
 };
@@ -18395,8 +19216,8 @@ var PUBLIC_ENDPOINT_HTTP_REASON = "The public endpoint needs an https:// address
 * May `baseUrl` carry `role`? The address check above, plus two role rules:
 * the app link carries `notificationTaps` only (it is not a hub address), and
 * a plain-http address carries `publicEndpoint` only when the operator
-* explicitly accepted it (`acceptInsecureHttp`) — a LAN-only password or
-* magic-link sign-in works over http, a passkey or an OIDC callback does not.
+* explicitly accepted it (`acceptInsecureHttp`) — a LAN-only password
+* sign-in works over http, a passkey or an OIDC callback does not.
 */
 function checkRoleAddress(role, baseUrl, options = {}) {
 	if (isAppLinkBase(baseUrl)) return role === "notificationTaps" ? {
@@ -19426,7 +20247,7 @@ var logDestinationCapability = {
 * `login-method` — collection cap through which auth addons contribute
 * their pre-auth login surfaces to the login page. This is the SINGLE,
 * generic mechanism that supersedes the dead `auth.listProviders` reader:
-* every auth addon (OIDC, magic-link, WebAuthn/passkey) registers a
+* every auth addon (OIDC, WebAuthn/passkey) registers a
 * `login-method` provider and the PUBLIC `auth.listLoginMethods`
 * procedure aggregates them for the unauthenticated login page.
 *
@@ -19434,8 +20255,7 @@ var logDestinationCapability = {
 *
 *  - `redirect` — a declarative button. The login page renders a generic
 *    button that navigates to `startUrl` (an addon-owned HTTP route).
-*    Covers OIDC (`/addon/auth-oidc/<id>/start`) and magic-link with
-*    ZERO shell-side JS. A future SSO addon plugs in the same way — the
+*    Covers OIDC (`/addon/auth-oidc/<id>/start`) with ZERO shell-side JS. A future SSO addon plugs in the same way — the
 *    login page needs NO change.
 *
 *  - `widget` — a Module-Federation widget the login page mounts (via
@@ -19454,8 +20274,8 @@ var logDestinationCapability = {
 *    decision.
 *
 * Every contribution carries a `stage`:
-*  - `primary`        — shown on the first credentials screen (OIDC /
-*                       magic-link buttons; a future usernameless passkey).
+*  - `primary`        — shown on the first credentials screen (OIDC
+*                       buttons; a usernameless passkey).
 *  - `second-factor`  — shown AFTER the password leg, gated on the
 *                       returned `factors` (passkey-as-2FA today).
 *
@@ -19467,7 +20287,7 @@ var logDestinationCapability = {
 var LoginStageEnum = z.enum(["primary", "second-factor"]);
 /**
 * A declarative redirect button — the login page navigates to `startUrl`.
-* OIDC and magic-link contribute this; a future SSO addon does too.
+* OIDC contributes this; a future SSO addon does too.
 */
 var RedirectLoginMethodSchema = z.object({
 	kind: z.literal("redirect"),
@@ -19484,7 +20304,7 @@ var RedirectLoginMethodSchema = z.object({
 	* The provider names an external identity a signed-in user can link to
 	* their own account (D782): `auth.listLinkableProviders` /
 	* `beginExternalLink` offer exactly the redirect methods that set this,
-	* whatever their id. Absent / false — a login button only (magic-link).
+	* whatever their id. Absent / false — a login button only.
 	*/
 	linkable: z.boolean().optional()
 });
@@ -23755,8 +24575,7 @@ var notificationRulesCapability = {
 * `super_admin` — collapsed onto the single boolean because every
 * non-admin caller is governed by the same scope-check rules; the
 * distinction was only ever used to route role-specific procedures
-* which we no longer have. Agents are admin sessions issued via
-* `createServiceToken`; CLI / webhook integrations are `cst_*` tokens
+* which we no longer have. CLI / webhook integrations are `cst_*` tokens
 * with `isAdmin: false` + an explicit scope list.
 */
 /** Per-method access flavour. Materialised on every cap method via codegen. */
@@ -27037,6 +27856,26 @@ var pipelineAnalyticsCapability = {
 			auth: "admin",
 			timeoutMs: 60 * 6e4
 		}),
+		/**
+		* OFFER the annotated archive instead of pushing it (D805): the same tar
+		* `writeRetrainArchive` streams, behind a one-shot `ctx.peerBytes` ticket
+		* the caller dials at once (same host). For a consumer that cannot expose
+		* an upload URL — a training provider streaming straight into its cloud.
+		* The answer is the plan; the bytes and their sha256 are the consumer's
+		* to measure as they arrive.
+		*/
+		offerRetrainArchive: method(z.object({
+			filter: RetrainExportFilterSchema,
+			layout: RetrainExportLayoutSchema
+		}), z.object({
+			ticket: PeerBytesTicketSchema,
+			frames: z.number().int(),
+			annotations: z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
 		/** The counts a selection would freeze — class × camera × day/night,
 		*  completeness — without freezing anything. Index reads only. */
 		previewRetrainDataset: method(z.object({
@@ -31783,8 +32622,8 @@ version: z.string().optional() }), ServerUpdateActionResultSchema, {
 * `smtp-provider` — pluggable email delivery surface.
 *
 * Collection cap: a deployment may install multiple SMTP relays (e.g.
-* one for transactional / one for notifications). Consumers (magic-link,
-* notifier addons, …) walk the collection and pick the first
+* one for transactional / one for notifications). Consumers (notifier
+* addons, …) walk the collection and pick the first
 * ready provider OR target a specific addonId.
 *
 * The shape stays small on purpose — `sendEmail` is enough for the
@@ -32080,7 +32919,7 @@ targets: z.array(z.object({
 };
 /**
 * `sso-bridge` — internal hub-only cap that lets SSO-style auth
-* providers (OIDC, SAML, magic-link, …) mint an HMAC-signed token
+* providers (OIDC, SAML, …) mint an HMAC-signed token
 * carrying the post-callback claims before redirecting back to
 * `/api/auth/sso/finish`.
 *
@@ -32143,7 +32982,14 @@ var SsoBridgeClaimsSchema = z.object({
 	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
 	* subject is unique only per issuer, so a link is bound to it.
 	*/
-	issuer: z.string().optional()
+	issuer: z.string().optional(),
+	/**
+	* SHA-256 (hex) of the `camstack_sso_state` cookie the IdP `/start` set in
+	* the browser that began this sign-in. `/api/auth/sso/finish` requires the
+	* request to present the matching cookie — a login bridge is useless in
+	* any other browser.
+	*/
+	browserBinding: z.string().optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -32161,7 +33007,7 @@ var ssoBridgeCapability = {
 		* `/api/auth/sso/finish` to become admin — a full privilege escalation
 		* through the exact surface this cap exists to close (see the module
 		* docblock). Every real caller (`oauth-grants.ts`, `main.ts`
-		* registration, the OIDC/magic-link addons) reaches this through
+		* registration, the OIDC addon) reaches this through
 		* `ctx.api` / the in-process registry — never through tRPC — so
 		* `auth: 'admin'` costs those callers nothing.
 		*/
@@ -46957,16 +47803,6 @@ var ApiKeySummarySchema = z.object({
 	createdAt: z.number(),
 	lastUsedAt: z.number().optional()
 });
-var CreateApiKeyInputSchema = z.object({
-	label: z.string(),
-	isAdmin: z.boolean().default(false),
-	allowedProviders: z.union([z.array(z.string()), z.literal("*")]).optional(),
-	allowedDevices: z.record(z.string(), z.union([z.array(z.string()), z.literal("*")])).optional()
-});
-var CreateApiKeyResultSchema = z.object({
-	token: z.string(),
-	record: ApiKeySummarySchema
-});
 var ScopedTokenSummarySchema = z.object({
 	id: z.string(),
 	userId: z.string(),
@@ -47078,20 +47914,11 @@ var userManagementCapability = {
 			access: "view"
 		}),
 		listApiKeys: method(z.void(), z.array(ApiKeySummarySchema), { auth: "admin" }),
-		createApiKey: method(CreateApiKeyInputSchema, CreateApiKeyResultSchema, {
-			kind: "mutation",
-			auth: "admin",
-			access: "create"
-		}),
 		revokeApiKey: method(z.object({ id: z.string() }), z.object({ success: z.literal(true) }), {
 			kind: "mutation",
 			auth: "admin",
 			access: "delete"
 		}),
-		validateApiKey: method(z.object({ token: z.string() }), ApiKeySummarySchema.nullable(), {
-			kind: "mutation",
-			access: "view"
-		}),
 		createScopedToken: method(CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, {
 			kind: "mutation",
 			auth: "admin",
@@ -47181,20 +48008,6 @@ var userManagementCapability = {
 			userId: z.string(),
 			issuer: z.string()
 		}).nullable(), { auth: "admin" }),
-		/**
-		* Link `(provider, subject)` to `userId`. Idempotent for the same user;
-		* REFUSES (throws) an identity already linked to another user, and a
-		* user that does not exist.
-		*/
-		linkExternalIdentity: method(ExternalIdentityKeySchema.extend({
-			userId: z.string(),
-			issuer: z.string().min(1),
-			label: z.string().optional()
-		}), z.object({ success: z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin",
-			access: "create"
-		}),
 		/** Remove one link of `userId`. `success: false` when it was not linked to that user. */
 		unlinkExternalIdentity: method(ExternalIdentityKeySchema.extend({ userId: z.string() }), z.object({ success: z.boolean() }), {
 			kind: "mutation",
@@ -47923,6 +48736,531 @@ var zoneRulesCapability = {
 	*/
 	durability: "restored"
 };
+/**
+* `training-provider` — ONE cloud that can run the CamStack trainer.
+*
+* A thin, mockable translation layer: it knows how to run a container with a
+* GPU, move a dataset in, read the job's stdout and hand artefacts back. It
+* knows nothing about datasets, splits, floors, cost policy or Model Studio —
+* those are the `training` orchestrator's (D805). Every rule written there
+* once is what makes a second provider (RunPod, a local NVIDIA node) a new
+* manifest entry and nothing else.
+*
+* Collection, routed by the `addonId` in every single-row input (the `llm` /
+* `notification-output` posture); `describe` concat-fans across providers.
+* Every method is `admin`: these spend money.
+*
+* Every cloud object a provider creates is tagged with the orchestrator's
+* `jobKey`, so a retried submit finds the job it already started instead of
+* starting a second GPU, and `listJobs` can find orphans.
+*
+* Bytes never ride a cap field: the dataset arrives as a `ctx.peerBytes`
+* ticket the producer (pipeline-analytics) minted, and artefacts leave as a
+* ticket the provider mints (D613).
+*/
+var TrainingGpuOptionSchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	/** List price, USD per GPU-hour, before any region multiplier. */
+	usdPerHour: z.number().nonnegative(),
+	vramGb: z.number().nonnegative()
+});
+var TrainingRegionOptionSchema = z.object({
+	/** `''` = any region (the provider's choice). */
+	id: z.string(),
+	label: z.string(),
+	priceMultiplier: z.number().positive()
+});
+/**
+* The provider's per-account settings, as the orchestrator reads them. They
+* live in the PROVIDER addon's settings (operator decision 2026-10-08: they
+* depend on the user's account), never hard-coded in the orchestrator.
+*/
+var TrainingProviderDefaultsSchema = z.object({
+	gpuType: z.string(),
+	region: z.string(),
+	costCapUsd: z.number().nonnegative(),
+	maxRuntimeSec: z.number().int().positive(),
+	/** Hours a FAILED job's cloud dataset is kept for debugging; 0 = delete at once. */
+	failedDatasetGraceHours: z.number().nonnegative()
+});
+var TrainingProviderDescriptorSchema = z.object({
+	addonId: z.string(),
+	/** `modal`, `runpod`, `fake`, … */
+	kind: z.string(),
+	label: z.string(),
+	gpuTypes: z.array(TrainingGpuOptionSchema).readonly(),
+	regions: z.array(TrainingRegionOptionSchema).readonly(),
+	maxDatasetBytes: z.number().int().positive(),
+	maxRuntimeSec: z.number().int().positive(),
+	freeTierNote: z.string().optional(),
+	/** Where the data goes, in one sentence the confirm dialog repeats. */
+	dataResidencyNote: z.string(),
+	/** Credentials are present — never the values. */
+	configured: z.boolean(),
+	defaults: TrainingProviderDefaultsSchema
+});
+var TrainingCredentialCheckSchema = z.object({
+	ok: z.boolean(),
+	/** Workspace / account name, when the provider says. */
+	account: z.string().optional(),
+	reason: z.enum([
+		"missing",
+		"invalid",
+		"forbidden",
+		"network",
+		"quota"
+	]).optional(),
+	detail: z.string().optional()
+});
+var ProviderJobStateSchema = z.enum([
+	"pending",
+	"starting",
+	"running",
+	"succeeded",
+	"failed",
+	"cancelled",
+	"lost"
+]);
+var ProviderJobStatusSchema = z.object({
+	jobKey: z.string(),
+	providerJobId: z.string().optional(),
+	state: ProviderJobStateSchema,
+	startedAt: z.number().optional(),
+	endedAt: z.number().optional(),
+	exitCode: z.number().int().optional(),
+	failureReason: z.string().optional(),
+	gpuType: z.string(),
+	region: z.string().optional(),
+	billedSeconds: z.number().nonnegative(),
+	costUsd: z.number().nonnegative(),
+	/** True when `costUsd` is runtime × list price, not a billing answer. */
+	costIsEstimate: z.boolean(),
+	lastFetchedAt: z.number()
+});
+/**
+* The trainer the job runs, by SOURCE revision: the provider turns it into an
+* image its own way (Modal builds the published Dockerfile at that revision;
+* a registry-pull provider maps it to a tag). Recorded on the job and echoed
+* in `result.json`.
+*/
+var TrainerSourceRefSchema = z.object({
+	/** Hugging Face repo id, e.g. `camstack/camstack-trainer`. */
+	repo: z.string().min(1),
+	/** A commit sha (never a branch) — the job must be reproducible. */
+	revision: z.string().regex(/^[0-9a-f]{7,64}$/)
+});
+var JobRef = {
+	addonId: z.string(),
+	jobKey: z.string().uuid()
+};
+var TrainingLogLineSchema = z.object({
+	ts: z.number(),
+	text: z.string()
+});
+var trainingProviderCapability = {
+	name: "training-provider",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		/** Every provider's offer and settings. Concat-fans across providers. */
+		describe: method(z.object({}), z.array(TrainingProviderDescriptorSchema).readonly(), { auth: "admin" }),
+		/** Call the provider with the stored credentials. Never returns them. */
+		validateCredentials: method(z.object({ addonId: z.string() }), TrainingCredentialCheckSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 3e4
+		}),
+		/** USD range for a run of `gpuSeconds` on `gpuType` in `region`. */
+		estimateJob: method(z.object({
+			addonId: z.string(),
+			gpuType: z.string(),
+			region: z.string(),
+			datasetBytes: z.number().int().nonnegative(),
+			gpuSecondsLow: z.number().nonnegative(),
+			gpuSecondsHigh: z.number().nonnegative()
+		}), z.object({
+			usdLow: z.number().nonnegative(),
+			usdHigh: z.number().nonnegative(),
+			notes: z.array(z.string()).readonly()
+		}), { auth: "admin" }),
+		/**
+		* Take the dataset archive behind `ticket` (minted by pipeline-analytics,
+		* same host) and land it as the job's dataset in the cloud, streamed —
+		* nothing is staged on the hub's disk. Idempotent per `jobKey`: a second
+		* call replaces a partial upload. Answers what actually landed.
+		*/
+		uploadDataset: method(z.object({
+			...JobRef,
+			ticket: PeerBytesTicketSchema
+		}), z.object({
+			bytes: z.number().int().nonnegative(),
+			sha256: z.string()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 120 * 6e4
+		}),
+		/**
+		* Start the trainer on a GPU. Looks the job up by `jobKey` first, so a
+		* retried submit never starts a second GPU. `jobSpecJson` is written next
+		* to the dataset as `job.json`; `maxRuntimeSec` is enforced by the
+		* provider (a hard timeout), not by the hub.
+		*/
+		submitJob: method(z.object({
+			...JobRef,
+			trainer: TrainerSourceRefSchema,
+			jobSpecJson: z.string().min(2).max(64e3),
+			gpuType: z.string(),
+			region: z.string(),
+			maxRuntimeSec: z.number().int().positive()
+		}), ProviderJobStatusSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 30 * 6e4
+		}),
+		getJob: method(z.object(JobRef), ProviderJobStatusSchema, {
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/** Stdout/stderr since `cursor` (opaque), oldest first, at most `max` lines. */
+		listJobEvents: method(z.object({
+			...JobRef,
+			cursor: z.string().optional(),
+			max: z.number().int().min(1).max(500)
+		}), z.object({
+			lines: z.array(TrainingLogLineSchema).readonly(),
+			cursor: z.string()
+		}), {
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/** Stop the job. Idempotent: an unknown or finished job is a no-op. */
+		cancelJob: method(z.object(JobRef), z.object({ ok: z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/** The job's `result.json`, as text (small, JSON). `found: false` before it exists. */
+		readResult: method(z.object(JobRef), z.object({
+			found: z.boolean(),
+			text: z.string().optional()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 5 * 6e4
+		}),
+		/**
+		* Offer one output file of the job (`bundle.tar`) to the caller as a
+		* one-shot `ctx.peerBytes` ticket, streamed from the cloud — the provider
+		* stages nothing on disk. The caller dials it at once.
+		*/
+		offerArtifact: method(z.object({
+			...JobRef,
+			path: z.enum(["bundle.tar"])
+		}), z.object({ ticket: PeerBytesTicketSchema }), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 5 * 6e4
+		}),
+		/** Delete every cloud object tagged with `jobKey` (the dataset first). Idempotent. */
+		cleanupJob: method(z.object(JobRef), z.object({ deleted: z.array(z.string()).readonly() }), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 5 * 6e4
+		}),
+		/** Every job the provider can still see — the orphan sweep diffs it against our records. */
+		listJobs: method(z.object({ addonId: z.string() }), z.array(ProviderJobStatusSchema).readonly(), {
+			auth: "admin",
+			timeoutMs: 2 * 6e4
+		})
+	}
+};
+/**
+* `training` — the cloud-training orchestrator (D805). Hub-only singleton,
+* provided by `addon-training`.
+*
+* It owns what every provider must agree on, written once:
+*
+* - **Dataset versions.** Taken over from pipeline-analytics (D796): the rows
+*   live here (D808); pipeline-analytics still CUTS a version (it owns the corpus and
+*   the export plan) and reaches this store through the five row methods
+*   below, so the Retrain page and the export did not change.
+* - **Jobs.** A persisted state machine, a reconcile loop against the
+*   provider, a cost guard, a daily orphan sweep and the retention rules.
+* - **The return flow.** Verified artefacts → Model Studio
+*   (`custom-model-registry.importModelBundle`) → canary on cameras →
+*   rollback. Nothing is ever registered automatically.
+*
+* Every method is `admin`.
+*/
+/** A version WITH its frame list — what the export and a job read. */
+var TrainingDatasetVersionRowSchema = RetrainDatasetVersionSchema.omit({ frameCount: true }).extend({ frameIds: z.array(z.string()).max(2e4).readonly() });
+/** A base model a detector job can fine-tune, and the baseline it is judged against. */
+var TrainingBaseModelSchema = z.object({
+	modelId: z.string(),
+	label: z.string(),
+	weights: z.string(),
+	imgsz: z.number().int(),
+	baselineOnnxUrl: z.string(),
+	baselineFloors: z.record(z.string(), z.number()),
+	/** The base the fleet runs most — the UI's default. */
+	recommended: z.boolean()
+});
+var TrainingPresetSchema = z.enum([
+	"quick",
+	"standard",
+	"thorough"
+]);
+var TrainingJobRequestSchema = z.object({
+	datasetVersionId: z.string().min(1),
+	/** The `training-provider` addon that runs it. */
+	addonId: z.string().min(1),
+	gpuType: z.string().min(1),
+	region: z.string(),
+	baseModelId: z.string().min(1),
+	preset: TrainingPresetSchema,
+	/** Freeze the backbone's first N layers; `null` = the preset's choice. */
+	freeze: z.number().int().nonnegative().nullable(),
+	/** Cameras held out whole for evaluation; `null` = the orchestrator's default. */
+	holdoutCameras: z.array(z.number().int()).nullable()
+});
+var TrainingSplitPlanSchema = z.object({
+	holdoutCameras: z.array(z.number().int()).readonly(),
+	/** Used when no camera is held out: the last N days of every camera. */
+	holdoutLastDays: z.number().int().nonnegative(),
+	/** Holdout subjects per class (camera holdout only; `null` = known only after the split). */
+	holdoutSupport: z.record(z.string(), z.number().int()).nullable(),
+	trainSubjects: z.number().int()
+});
+var TrainingRefusalReasonSchema = z.enum([
+	"unknown-dataset",
+	"unknown-provider",
+	"provider-not-configured",
+	"unknown-base-model",
+	"unknown-gpu",
+	"dataset-too-large",
+	"no-training-subjects",
+	"job-already-running"
+]);
+var TrainingJobPlanSchema = z.object({
+	refusal: z.object({
+		reason: TrainingRefusalReasonSchema,
+		detail: z.string()
+	}).nullable(),
+	warnings: z.array(z.string()).readonly(),
+	split: TrainingSplitPlanSchema.nullable(),
+	estimate: z.object({
+		datasetBytes: z.number().int(),
+		uploadMinutesAt20Mbps: z.number(),
+		gpuSecondsLow: z.number(),
+		gpuSecondsHigh: z.number(),
+		usdLow: z.number(),
+		usdHigh: z.number(),
+		notes: z.array(z.string()).readonly()
+	}).nullable(),
+	/** Pre-filled from the provider's settings; the operator may lower or raise them. */
+	defaults: z.object({
+		maxCostUsd: z.number(),
+		maxRuntimeSec: z.number().int()
+	}).nullable(),
+	/** The sentence the confirm dialog repeats: where the frames go and when they are deleted. */
+	dataNotice: z.string()
+});
+/**
+* Orchestrator-owned states, persisted. `uploading` covers exporting the
+* archive (it is streamed, never staged). Terminal: `failed`, `cancelled`,
+* `lost`, `expired`, `discarded`. `registered` and `canary` are where a
+* result lives after the operator acted on it.
+*/
+var TrainingJobStateSchema = z.enum([
+	"uploading",
+	"submitted",
+	"starting",
+	"running",
+	"collecting",
+	"ready",
+	"registered",
+	"canary",
+	"failed",
+	"cancelling",
+	"cancelled",
+	"lost",
+	"expired",
+	"discarded"
+]);
+var TrainingFailureReasonSchema = z.enum([
+	"cost-cap",
+	"runtime-cap",
+	"upload-failed",
+	"submit-failed",
+	"trainer-failed",
+	"result-invalid",
+	"checksum-mismatch",
+	"fetch-failed",
+	"provider-error",
+	"hub-restart-during-upload"
+]);
+var TrainingProgressPointSchema = z.object({
+	epoch: z.number().int(),
+	map50: z.number().nullable(),
+	map50_95: z.number().nullable()
+});
+var TrainingCanarySchema = z.object({
+	deviceIds: z.array(z.number().int()).readonly(),
+	since: z.number(),
+	/** Every override the canary replaced, exactly, so rollback restores it. */
+	previous: z.array(z.object({
+		deviceId: z.number().int(),
+		nodeId: z.string(),
+		deviceKey: z.string(),
+		patch: z.object({
+			modelId: z.string().optional(),
+			settings: z.record(z.string(), z.unknown()).readonly().optional()
+		}).nullable()
+	})).readonly()
+});
+var TrainingJobSchema = z.object({
+	id: z.string(),
+	idempotencyKey: z.string(),
+	name: z.string(),
+	createdAt: z.number(),
+	updatedAt: z.number(),
+	state: TrainingJobStateSchema,
+	stage: TrainingStageSchema.nullable(),
+	failure: z.object({
+		reason: TrainingFailureReasonSchema,
+		stage: z.string().nullable(),
+		detail: z.string()
+	}).nullable(),
+	request: TrainingJobRequestSchema,
+	maxCostUsd: z.number().nonnegative(),
+	maxRuntimeSec: z.number().int().positive(),
+	trainer: TrainerSourceRefSchema,
+	datasetLayout: RetrainExportLayoutSchema,
+	dataset: z.object({
+		bytes: z.number().int(),
+		sha256: z.string(),
+		uploadedAt: z.number()
+	}).nullable(),
+	split: TrainingSplitPlanSchema,
+	provider: z.object({
+		state: ProviderJobStateSchema.nullable(),
+		providerJobId: z.string().nullable(),
+		startedAt: z.number().nullable(),
+		endedAt: z.number().nullable(),
+		billedSeconds: z.number(),
+		costUsd: z.number(),
+		costIsEstimate: z.boolean(),
+		lastPolledAt: z.number().nullable()
+	}),
+	progress: z.object({
+		epoch: z.number().int().nullable(),
+		epochs: z.number().int().nullable(),
+		etaSec: z.number().nullable(),
+		series: z.array(TrainingProgressPointSchema).readonly()
+	}),
+	/** The last lines of the job's output (≤ 200), newest last. Never frame paths. */
+	logTail: z.array(z.string()).readonly(),
+	logCursor: z.string().nullable(),
+	artifacts: z.object({
+		bundleBytes: z.number().int(),
+		bundleSha256: z.string(),
+		fetchedAt: z.number(),
+		/** When the staged artefacts are deleted from the hub. */
+		expiresAt: z.number()
+	}).nullable(),
+	/** When the provider-side copy of the frames was deleted; null while it exists. */
+	cloudDatasetDeletedAt: z.number().nullable(),
+	/** A failed job's dataset is kept until then (the provider's grace), then deleted. */
+	cloudCleanupDueAt: z.number().nullable(),
+	/** Model ids registered from this job (base, and int8 when kept). */
+	registeredModelIds: z.array(z.string()).readonly(),
+	canary: TrainingCanarySchema.nullable()
+});
+var IdInput = z.object({ id: z.string().min(1) });
+var trainingCapability = {
+	name: "training",
+	scope: "system",
+	mode: "singleton",
+	mount: { kind: "hub-only" },
+	methods: {
+		/** Store a version once. `stored: false` = that id already exists (immutable). */
+		putDatasetVersion: method(TrainingDatasetVersionRowSchema, z.object({ stored: z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getDatasetVersion: method(IdInput, TrainingDatasetVersionRowSchema.nullable(), { auth: "admin" }),
+		/** Every version without its frame list, newest first. */
+		listDatasetVersions: method(z.object({}), z.array(RetrainDatasetVersionSchema).readonly(), { auth: "admin" }),
+		findDatasetVersionIdByName: method(z.object({ name: z.string() }), z.object({ id: z.string().nullable() }), { auth: "admin" }),
+		removeDatasetVersion: method(IdInput, z.object({ removed: z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		listBaseModels: method(z.object({}), z.array(TrainingBaseModelSchema).readonly(), { auth: "admin" }),
+		/** Split, estimate, defaults and any named refusal — nothing is started. */
+		planJob: method(TrainingJobRequestSchema, TrainingJobPlanSchema, {
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/**
+		* Start a job. The same `idempotencyKey` returns the job it already
+		* started. Answers at once (`uploading`); the upload and the submit run in
+		* the background and the job record says how far they got.
+		*/
+		startJob: method(TrainingJobRequestSchema.extend({
+			name: z.string().min(1).max(120),
+			maxCostUsd: z.number().positive(),
+			maxRuntimeSec: z.number().int().positive(),
+			idempotencyKey: z.string().min(8).max(80)
+		}), z.discriminatedUnion("kind", [z.object({
+			kind: z.literal("started"),
+			job: TrainingJobSchema
+		}), z.object({
+			kind: z.literal("refused"),
+			reason: TrainingRefusalReasonSchema,
+			detail: z.string()
+		})]), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		listJobs: method(z.object({}), z.array(TrainingJobSchema).readonly(), { auth: "admin" }),
+		getJob: method(IdInput, TrainingJobSchema.nullable(), { auth: "admin" }),
+		cancelJob: method(IdInput, TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		/** The verified `result.json` of a job in `ready` or later; null before. */
+		getJobResult: method(IdInput, TrainingResultSchema.nullable(), { auth: "admin" }),
+		/** Hand the verified bundle to Model Studio; optionally canary right after. */
+		registerResult: method(IdInput.extend({ canaryDeviceIds: z.array(z.number().int()).readonly() }), TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 30 * 6e4
+		}),
+		/** Pin the registered model on these cameras, remembering what it replaced. */
+		canaryResult: method(IdInput.extend({ deviceIds: z.array(z.number().int()).min(1).readonly() }), TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		/** Put every canary camera back exactly as it was. */
+		rollbackCanary: method(IdInput, TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		/** Delete the staged artefacts of an unregistered result. */
+		discardResult: method(IdInput, TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
 function isValueOf(slot, value) {
 	return value.slot === slot;
 }
@@ -50371,6 +51709,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"backup.checkBackupKey": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"backup.delete": {
 		capName: "backup",
 		capScope: "system",
@@ -50383,6 +51727,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"backup.disableEncryption": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"backup.getEncryption": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"backup.getEntries": {
 		capName: "backup",
 		capScope: "system",
@@ -50437,6 +51793,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"backup.setupEncryption": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"backup.trigger": {
 		capName: "backup",
 		capScope: "system",
@@ -50989,6 +52351,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"customModelRegistry.importModelBundle": {
+		capName: "custom-model-registry",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"customModelRegistry.listModels": {
 		capName: "custom-model-registry",
 		capScope: "system",
@@ -52429,6 +53797,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"keychainAdmin.acknowledgeReset": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"keychainAdmin.deleteOrphans": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -52465,6 +53839,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"keychainAdmin.resetReport": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"keychainAdmin.reveal": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -54211,6 +55591,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.offerRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.ownersWithMedia": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -56749,6 +58135,174 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"training.canaryResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.cancelJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.discardResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.findDatasetVersionIdByName": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.getDatasetVersion": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.getJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.getJobResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.listBaseModels": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.listDatasetVersions": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.listJobs": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.planJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.putDatasetVersion": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.registerResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.removeDatasetVersion": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"training.rollbackCanary": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.startJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.cancelJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.cleanupJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.describe": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.estimateJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.getJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.listJobEvents": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.listJobs": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.offerArtifact": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.readResult": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.submitJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.uploadDataset": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.validateCredentials": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"turnProvider.getTurnServers": {
 		capName: "turn-provider",
 		capScope: "system",
@@ -56773,12 +58327,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"userManagement.createApiKey": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"userManagement.createScopedToken": {
 		capName: "user-management",
 		capScope: "system",
@@ -56815,12 +58363,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.linkExternalIdentity": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
@@ -56923,12 +58465,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"userManagement.validateApiKey": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.validateCredentials": {
 		capName: "user-management",
 		capScope: "system",
@@ -58921,6 +60457,8 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	temperatureSensorCapability,
 	terminalSessionCapability,
 	toastCapability,
+	trainingCapability,
+	trainingProviderCapability,
 	turnProviderCapability,
 	updateCapability,
 	userManagementCapability,
@@ -61299,6 +62837,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"training.canaryResult": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"update.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -62936,7 +64479,12 @@ var CREDENTIAL_PARAM_PATTERNS = [
 	/^bearer$/i,
 	/^api[_-]?key$/i,
 	/^access[_-]?token$/i,
-	/^refresh[_-]?token$/i
+	/^refresh[_-]?token$/i,
+	/^bridge$/i,
+	/^code$/i,
+	/^state$/i,
+	/^challenge$/i,
+	/^link$/i
 ];
 function isCredentialParam(name) {
 	return CREDENTIAL_PARAM_PATTERNS.some((re) => re.test(name));
@@ -62958,6 +64506,10 @@ function isCredentialParam(name) {
 * are NOT masked (those are entity references, not credentials).
 */
 function maskUrlCredentials(rawUrl) {
+	if (rawUrl.startsWith("/") && !rawUrl.startsWith("//")) {
+		const masked = maskUrlCredentials(`http://relative.invalid${rawUrl}`);
+		return masked.startsWith("http://relative.invalid") ? masked.slice(23) : rawUrl;
+	}
 	try {
 		const u = new URL(rawUrl);
 		let touched = false;
@@ -63109,4 +64661,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { buildStreamParamsConfigSchema as $, compositionItemFieldPath as $n, looseSchema as $t, MINUTES_PER_DAY as A, scoreRuntimes as An, isDeviceConfigCap as Ar, extractNestedAddonId as At, StorageLocationModeSchema as B, userManagementCapability as Bn, parseSecretRef as Br, isLocationEnabled as Bt, FieldClaimModeSchema as C, resolveHubAddressRoles as Cn, collectZodSecretPaths as Cr, enumerateInferenceDevices as Ct, LegacyStorageLocationDefaultSchema as D, runtimeStatePolicyFor as Dn, expandCapMethods as Dr, evictionPolicyOfLocation as Dt, LOG_LEVEL_RANK as E, resolveNotificationTapAddress as En, emitReadiness as Er, evaluateCompositionField as Et, RecordingStatusSchema as F, storageMigrationCapability as Fn, isSecretMarkerLike as Fr, hfModelUrl as Ft, addonSettingsCapability as G, vectorStoreCapability as Gn, scrubKnownSecrets as Gr, keychainCapability as Gt, StorageMigrationJobSchema as H, validateCustomAddress as Hn, resolveCapMount as Hr, isVoidInput as Ht, STORAGE_ACCESS_FALLBACK as I, storageOccupancyCapability as In, nodePin as Ir, isAppLinkBase as It, authProviderCapability as J, buildFfmpegArgs as Jn, sleep as Jr, lifecycleJobSchema as Jt, addonWidgetsCapability as K, withLocationMode as Kn, secretTreeFromPaths as Kr, legacyAutoLinkIds as Kt, STREAM_PROFILE_META as L, storageProviderCapability as Ln, normalizeSecretOwner as Lr, isArrayOutputSchema as Lt, MOTION_CLOSE_AFTER_MS as M, siteZoneKey as Mn, isKeychainStoredField as Mr, foldSnapshotByFunction as Mt, RECORDING_SOURCE_CAMSTACK_ADDON as N, snapshotCapability as Nn, isSecretClear as Nr, formatMinutes as Nt, LocationIconIdSchema as O, scopesAllowAddon as On, formatSecretScope as Or, expandContainer as Ot, RUNTIME_DEFAULTS as P, storageCapability as Pn, isSecretMarker as Pr, gbToBytes as Pt, buildCapabilityLookup as Q, compositionFeatureEnabled as Qn, EventCategory as Qr, logLevelAtMost as Qt, ScopedTokenSchema as R, streamCatalogCapability as Rn, parseJsonObject as Rr, isCollectionArrayMethod as Rt, FIRST_LEVEL_MACRO_CLASSES as S, resolveCoreBlockFiles as Sn, collectSecretConfigKeys as Sr, deviceStatusCapability as St, HF_REPO as T, resolveMethodAuth as Tn, emitDownForOwnedCaps as Tr, enumerateSchemaFields as Tt, UserRecordSchema as U, vectorDimFromBase64 as Un, resolveSecretMarkers as Ur, kebabToCamel as Ut, StorageLocationTypeSchema as V, validateComposition as Vn, readinessKey as Vr, isObjectInput as Vt, addonPagesCapability as W, vectorIndexDimConflictError as Wn, scopeKey as Wr, keychainAdminCapability as Wt, bareAddonId as X, composedDeviceRef as Xn, toSecretFieldView as Xr, locationIconKey as Xt, backupCapability as Y, cloneStatefulExpressionMemory as Yn, toNodeId as Yr, localNetworkCapability as Yt, batteryCapability as Z, composedDeviceStableId as Zn, transformSecretWrite as Zr, logDestinationCapability as Zt, DATABASE_SNAPSHOT_TIMEOUT_MS as _, reducePoints as _n, WELL_KNOWN_TAB_MAP as _r, deriveBatteryPresence as _t, BatteryStatusSchema as a, modeMayWrite as an, DeviceFeature as ar, compositionSourceRefs as at, DeclaredDevices as b, resolveBucketMs as bn, asString$1 as br, deviceManagerCapability as bt, CAP_NAMES_WITH_STATUS as c, normalizeUnit as cn, errMsg as cr, coreBlockIdFromAddonId as ct, CORE_BLOCKS_ADDON_ID as d, parseStreamParamsFormPatch as dn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as dr, createDeviceExtensionProvider as dt, maskUrlCredentials as en, compositionSliceKey as er, calendarsCapability as et, CORE_BLOCK_ADDON_PREFIX as f, pickAppLinkHub as fn, DEVICE_STATUS_METHOD as fr, dataStoreProviderCapability as ft, DATABASE_SNAPSHOT_SUFFIX as g, ptzAutotrackCapability as gn, SECRET_CLEAR as gr, defineExtensionSlotProvider as gt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as h, procedureAuthKey as hn, ReadinessTimeoutError as hr, decodeVectorBase64 as ht, BaseDevice as i, metricsProviderCapability as in, toExpressionValue as ir, compositionFieldKey as it, MODEL_FORMATS as j, settingsStoreCapability as jn, isEvent as jr, filesystemBrowseCapability as jt, METHOD_ACCESS_MAP as k, scopesAllowDeviceCap as kn, hydrateSchema as kr, expressionContainsBuiltinCall as kt, COMPOSED_ITEM_FIXED_FIELDS as l, objectInputDeclaresAddonId as ln, BaseAddon as lr, coreBlockSourceKind as lt, CoreBlockSchema as m, platformProbeCapability as mn, ReadinessRegistry as mr, declarationOwnerNodeId as mt, AlertSchema as n, mayWriteToLocation as nn, createStatefulExpressionMemory as nr, checkRoleAddress as nt, CAMERA_SWITCH_ORDER as o, motionCapability as on, DeviceRole as or, coreBlockAddonId as ot, CalendarPreferencesSchema as p, planComposition as pn, REDACTED_SECRET as pr, databaseSnapshotCapability as pt, alertsCapability as q, COMPOSER_ADDON_ID as qn, secretTreeFromSchema as qr, legacyModeOf as qt, ApiKeyRecordSchema as r, memoizePinnedFfmpeg as rn, disarmRoseMemory as rr, composerCapability as rt, CAMSTACK_APP_LINK_ORIGIN as s, normalizeCoreBlockWrite as sn, DeviceType as sr, coreBlockComposition as st, ALL_CAPABILITY_DEFINITIONS as t, mayReadLocation as tn, compositionSourceKey as tr, cameraGridLayoutCapability as tt, COMPOSER_RUNNER_ID as u, objectInputDeclaresRequiredDeviceId as un, DATAPLANE_SECRET_HEADER as ur, coreBlocksCapability as ut, DAY_NAMES as v, replacedFieldKeys as vn, asJsonObject as vr, describeComposableCaps as vt, FieldClaimSchema as w, resolveLocationMode as wn, createEvent as wr, enumerateItemArrayFields as wt, DeviceStatusSchema as x, resolveCoreBlockEntry as xn, buildSecretRef as xr, deviceStateCapability as xt, DERIVED_CAMERA_SILENCED_CAP_NAMES as y, resolveAppConnections as yn, asNumber as yr, deviceExtensionCapability as yt, StorageCleanupJobSchema as z, streamQualityLabel as zn, parseJsonUnknown as zr, isDefaultAppConnectionEndpoint as zt };
+export { buildCapabilityLookup as $, compositionFeatureEnabled as $n, transformSecretWrite as $r, logLevelAtMost as $t, METHOD_ACCESS_MAP as A, scopesAllowDeviceCap as An, hydrateSchema as Ar, expressionContainsBuiltinCall as At, StorageCleanupJobSchema as B, streamQualityLabel as Bn, parseJsonObject as Br, isDefaultAppConnectionEndpoint as Bt, FieldClaimModeSchema as C, resolveCoreBlockFiles as Cn, collectSecretConfigKeys as Cr, deviceStatusCapability as Ct, LOG_LEVEL_RANK as D, resolveNotificationTapAddress as Dn, emitReadiness as Dr, evaluateCompositionField as Dt, KEYCHAIN_RESET_TRIGGER_ACTOR as E, resolveMethodAuth as En, emitDownForOwnedCaps as Er, enumerateSchemaFields as Et, RUNTIME_DEFAULTS as F, storageCapability as Fn, isSecretMarker as Fr, gbToBytes as Ft, addonPagesCapability as G, vectorIndexDimConflictError as Gn, resolveSecretMarkers as Gr, keychainAdminCapability as Gt, StorageLocationTypeSchema as H, validateComposition as Hn, parseSecretRef as Hr, isObjectInput as Ht, RecordingStatusSchema as I, storageMigrationCapability as In, isSecretMarkerLike as Ir, hfModelUrl as It, alertsCapability as J, COMPOSER_ADDON_ID as Jn, secretTreeFromPaths as Jr, legacyModeOf as Jt, addonSettingsCapability as K, vectorStoreCapability as Kn, scopeKey as Kr, keychainCapability as Kt, STORAGE_ACCESS_FALLBACK as L, storageOccupancyCapability as Ln, makeSecretMarker as Lr, isAppLinkBase as Lt, MODEL_FORMATS as M, settingsStoreCapability as Mn, isEvent as Mr, filesystemBrowseCapability as Mt, MOTION_CLOSE_AFTER_MS as N, siteZoneKey as Nn, isKeychainStoredField as Nr, foldSnapshotByFunction as Nt, LegacyStorageLocationDefaultSchema as O, runtimeStatePolicyFor as On, expandCapMethods as Or, evictionPolicyOfLocation as Ot, RECORDING_SOURCE_CAMSTACK_ADDON as P, snapshotCapability as Pn, isSecretClear as Pr, formatMinutes as Pt, batteryCapability as Q, composedDeviceStableId as Qn, toSecretFieldView as Qr, logDestinationCapability as Qt, STREAM_PROFILE_META as R, storageProviderCapability as Rn, nodePin as Rr, isArrayOutputSchema as Rt, FIRST_LEVEL_MACRO_CLASSES as S, resolveCoreBlockEntry as Sn, buildSecretRef as Sr, deviceStateCapability as St, HF_REPO as T, resolveLocationMode as Tn, createEvent as Tr, enumerateItemArrayFields as Tt, StorageMigrationJobSchema as U, validateCustomAddress as Un, readinessKey as Ur, isVoidInput as Ut, StorageLocationModeSchema as V, userManagementCapability as Vn, parseJsonUnknown as Vr, isLocationEnabled as Vt, UserRecordSchema as W, vectorDimFromBase64 as Wn, resolveCapMount as Wr, kebabToCamel as Wt, backupCapability as X, cloneStatefulExpressionMemory as Xn, sleep as Xr, localNetworkCapability as Xt, authProviderCapability as Y, buildFfmpegArgs as Yn, secretTreeFromSchema as Yr, lifecycleJobSchema as Yt, bareAddonId as Z, composedDeviceRef as Zn, toNodeId as Zr, locationIconKey as Zt, DATABASE_SNAPSHOT_TIMEOUT_MS as _, ptzAutotrackCapability as _n, SECRET_CLEAR as _r, defineExtensionSlotProvider as _t, BatteryStatusSchema as a, metricsProviderCapability as an, toExpressionValue as ar, compositionFieldKey as at, DeclaredDevices as b, resolveAppConnections as bn, asNumber as br, deviceExtensionCapability as bt, CAP_NAMES_WITH_STATUS as c, normalizeCoreBlockWrite as cn, DeviceType as cr, coreBlockComposition as ct, CORE_BLOCKS_ADDON_ID as d, objectInputDeclaresRequiredDeviceId as dn, DATAPLANE_SECRET_HEADER as dr, coreBlocksCapability as dt, EventCategory as ei, looseSchema as en, compositionItemFieldPath as er, buildStreamParamsConfigSchema as et, CORE_BLOCK_ADDON_PREFIX as f, parseStreamParamsFormPatch as fn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as fr, createDeviceExtensionProvider as ft, DATABASE_SNAPSHOT_SUFFIX as g, procedureAuthKey as gn, ReadinessTimeoutError as gr, decodeVectorBase64 as gt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as h, platformProbeCapability as hn, ReadinessRegistry as hr, declarationOwnerNodeId as ht, BaseDevice as i, memoizePinnedFfmpeg as in, disarmRoseMemory as ir, composerCapability as it, MINUTES_PER_DAY as j, scoreRuntimes as jn, isDeviceConfigCap as jr, extractNestedAddonId as jt, LocationIconIdSchema as k, scopesAllowAddon as kn, formatSecretScope as kr, expandContainer as kt, COMPOSED_ITEM_FIXED_FIELDS as l, normalizeUnit as ln, errMsg as lr, coreBlockIdFromAddonId as lt, CoreBlockSchema as m, planComposition as mn, REDACTED_SECRET as mr, databaseSnapshotCapability as mt, AlertSchema as n, mayReadLocation as nn, compositionSourceKey as nr, cameraGridLayoutCapability as nt, CAMERA_SWITCH_ORDER as o, modeMayWrite as on, DeviceFeature as or, compositionSourceRefs as ot, CalendarPreferencesSchema as p, pickAppLinkHub as pn, DEVICE_STATUS_METHOD as pr, dataStoreProviderCapability as pt, addonWidgetsCapability as q, withLocationMode as qn, scrubKnownSecrets as qr, legacyAutoLinkIds as qt, ApiKeyRecordSchema as r, mayWriteToLocation as rn, createStatefulExpressionMemory as rr, checkRoleAddress as rt, CAMSTACK_APP_LINK_ORIGIN as s, motionCapability as sn, DeviceRole as sr, coreBlockAddonId as st, ALL_CAPABILITY_DEFINITIONS as t, maskUrlCredentials as tn, compositionSliceKey as tr, calendarsCapability as tt, COMPOSER_RUNNER_ID as u, objectInputDeclaresAddonId as un, BaseAddon as ur, coreBlockSourceKind as ut, DAY_NAMES as v, reducePoints as vn, WELL_KNOWN_TAB_MAP as vr, deriveBatteryPresence as vt, FieldClaimSchema as w, resolveHubAddressRoles as wn, collectZodSecretPaths as wr, enumerateInferenceDevices as wt, DeviceStatusSchema as x, resolveBucketMs as xn, asString$1 as xr, deviceManagerCapability as xt, DERIVED_CAMERA_SILENCED_CAP_NAMES as y, replacedFieldKeys as yn, asJsonObject as yr, describeComposableCaps as yt, ScopedTokenSchema as z, streamCatalogCapability as zn, normalizeSecretOwner as zr, isCollectionArrayMethod as zt };