@camstack/system 1.2.381 → 1.2.383

package/dist/{dist-BugrtARh.js → dist-CUNGH0fs.js}

@@ -708,7 +708,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-DujUvOcb.mjs
+//#region ../types/dist/sleep-r3RWkGVx.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -820,21 +820,21 @@ function collectSecretConfigKeys(schema) {
 	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
 	return keys;
 }
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sectionsOf(schema) {
-	if (!isRecord$2(schema)) return [];
+	if (!isRecord$3(schema)) return [];
 	const sections = schema["sections"];
 	return Array.isArray(sections) ? sections : [];
 }
 function fieldsOf(node) {
-	if (!isRecord$2(node)) return [];
+	if (!isRecord$3(node)) return [];
 	const fields = node["fields"];
 	return Array.isArray(fields) ? fields : [];
 }
 function walkField(field, out) {
-	if (!isRecord$2(field)) return;
+	if (!isRecord$3(field)) return;
 	const type = field["type"];
 	const key = field["key"];
 	if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
@@ -872,7 +872,7 @@ function walkField(field, out) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -883,16 +883,16 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$1(value)) return false;
+	if (!isRecord$2(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 /** Anything carrying a `$secret` key — a stored marker or a UI view of one. */
 function isSecretMarkerLike(value) {
-	return isRecord$1(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
+	return isRecord$2(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
 }
 function isSecretClear(value) {
-	return isRecord$1(value) && value["$secretClear"] === true;
+	return isRecord$2(value) && value["$secretClear"] === true;
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -1561,7 +1561,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -1574,7 +1574,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$1(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -1629,7 +1629,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$1) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -1645,7 +1645,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord(row)) {
+		if (!isRecord$1(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -1670,7 +1670,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord(incoming)) {
+			if (!isRecord$1(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -1678,7 +1678,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord(stored) ? stored : {};
+			const storedObj = isRecord$1(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -1737,12 +1737,19 @@ async function transformSecretWrite(input) {
 		}
 	};
 }
+/** Is `ref` one of `owner`'s refs? */
+function isSecretRefOwnedBy(ref, owner) {
+	return parseSecretRef(ref)?.owner === owner;
+}
 /**
 * Replace every marker in `value` with its keychain value. Returns the SAME
 * reference when there is no marker (no allocation, no keychain call).
 */
-async function resolveSecretMarkers(value, secrets) {
-	const refs = collectSecretMarkerRefs(value);
+async function resolveSecretMarkers(value, secrets, options = {}) {
+	const keepMarker = options.unresolved === "keep-marker";
+	const owner = options.ownedBy;
+	const inScope = (ref) => owner === void 0 || isSecretRefOwnedBy(ref, owner);
+	const refs = collectSecretMarkerRefs(value).filter(inScope);
 	if (refs.length === 0) return {
 		value,
 		unresolved: []
@@ -1766,10 +1773,18 @@ async function resolveSecretMarkers(value, secrets) {
 	}
 	const substitute = (v) => {
 		if (isSecretMarker(v)) {
+			if (!inScope(v.$secret)) return {
+				keep: true,
+				value: v
+			};
 			const answer = answers[v.$secret];
-			return answer?.kind === "value" ? {
+			if (answer?.kind === "value") return {
 				keep: true,
 				value: answer.value
+			};
+			return keepMarker ? {
+				keep: true,
+				value: v
 			} : {
 				keep: false,
 				value: void 0
@@ -1786,7 +1801,7 @@ async function resolveSecretMarkers(value, secrets) {
 				value: items
 			};
 		}
-		if (isRecord(v)) {
+		if (isRecord$1(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -1807,14 +1822,152 @@ async function resolveSecretMarkers(value, secrets) {
 		unresolved
 	};
 }
-function touchesTree(tree, patch) {
-	if (tree.size === 0) return false;
-	for (const key of Object.keys(patch)) {
-		const at = key.indexOf("@");
-		if (tree.has(at > 0 ? key.slice(0, at) : key)) return true;
+/** An addon tried to replace a stored secret it could not read. Nothing was written. */
+var SecretOverwriteRefusedError = class extends Error {
+	ref;
+	reason;
+	constructor(ref, reason) {
+		super(`secret ${ref} was not replaced: its stored value cannot be read right now (${reason}), and an addon may not overwrite a secret it cannot see. Nothing was written.`);
+		this.ref = ref;
+		this.reason = reason;
+		this.name = "SecretOverwriteRefusedError";
+	}
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function resolvedValue(pass, marker) {
+	const answer = pass.answers[marker.$secret];
+	return answer?.kind === "value" ? answer.value : null;
+}
+async function atMarker(pass, incoming, stored) {
+	if (incoming === null) return stored;
+	if (typeof incoming !== "string") return incoming;
+	if (incoming === resolvedValue(pass, stored)) return stored;
+	const intent = classifySecretWrite(incoming);
+	if (intent.kind !== "set") return stored;
+	const ref = stored.$secret;
+	if (!isSecretRefOwnedBy(ref, pass.secrets.owner)) return incoming;
+	const answer = pass.answers[ref];
+	if ((answer === void 0 || answer.kind === "unavailable" || answer.kind === "forbidden") && !pass.operatorWrite) throw new SecretOverwriteRefusedError(ref, answer === void 0 ? "not-initialized" : answer.kind === "unavailable" ? answer.reason : answer.kind);
+	try {
+		await pass.secrets.put(ref, intent.value);
+	} catch (err) {
+		throw new KeychainWriteRefusedError(ref, err);
+	}
+	pass.changedRefs.push(ref);
+	return stored;
+}
+function inArray(pass, incoming, stored) {
+	return incoming.map((item, index) => {
+		const twin = stored[index];
+		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
+		if (isRecord(item) && isRecord(twin)) return inArrayRow(pass, item, twin);
+		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
+		return item;
+	});
+}
+function inArrayRow(pass, incoming, stored) {
+	const out = { ...incoming };
+	for (const [key, value] of Object.entries(incoming)) {
+		const twin = stored[key];
+		if (isSecretMarker(twin)) {
+			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
+		} else if (isRecord(value) && isRecord(twin)) out[key] = inArrayRow(pass, value, twin);
+		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
+	}
+	return out;
+}
+async function walk(pass, incoming, stored) {
+	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
+	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
+	if (!isRecord(incoming) || !isRecord(stored)) return incoming;
+	const out = { ...incoming };
+	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
+	return out;
+}
+/** Restore markers a write-back carries as values. See the file doc. */
+async function restoreUnchangedSecrets(input) {
+	const refs = [];
+	for (const key of Object.keys(input.patch)) collectSecretMarkerRefs(input.stored[key], refs);
+	const owned = refs.filter((ref) => isSecretRefOwnedBy(ref, input.secrets.owner));
+	if (owned.length === 0) return {
+		patch: input.patch,
+		changedRefs: []
+	};
+	const pass = {
+		secrets: input.secrets,
+		answers: await input.secrets.resolve([...new Set(owned)]),
+		operatorWrite: input.operatorWrite,
+		changedRefs: []
+	};
+	const out = {};
+	for (const [key, value] of Object.entries(input.patch)) out[key] = await walk(pass, value, input.stored[key]);
+	return {
+		patch: out,
+		changedRefs: pass.changedRefs
+	};
+}
+/** Structural equality over JSON-shaped values (key order does not matter). */
+function isJsonEqual(a, b) {
+	if (Object.is(a, b)) return true;
+	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
+	if (isRecord(a) && isRecord(b)) {
+		const keys = Object.keys(a);
+		if (keys.length !== Object.keys(b).length) return false;
+		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
 	}
 	return false;
 }
+/** The patch without the keys whose value already equals the stored one. */
+function dropUnchangedKeys(patch, stored) {
+	const out = {};
+	for (const [key, value] of Object.entries(patch)) {
+		if (Object.prototype.hasOwnProperty.call(stored, key) && isJsonEqual(value, stored[key])) continue;
+		out[key] = value;
+	}
+	return out;
+}
+/** The top-level keys of a blob that hold at least one of `owner`'s markers. */
+function markerKeysOf(blob, owner) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const [key, value] of Object.entries(blob)) if (collectSecretMarkerRefs(value).some((ref) => isSecretRefOwnedBy(ref, owner))) keys.add(key);
+	return keys;
+}
+function nodeFromStored(value, owner) {
+	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
+	if (!isRecord(value)) return null;
+	const children = /* @__PURE__ */ new Map();
+	for (const [key, child] of Object.entries(value)) {
+		const node = nodeFromStored(child, owner);
+		if (node !== null) children.set(key, node);
+	}
+	return children.size > 0 ? {
+		kind: "object",
+		children
+	} : null;
+}
+/**
+* The declared secret tree, widened by every place the STORED blob holds a
+* marker under one of `keys` — so a marker the schema no longer declares (or
+* never declared: Wyze before b4906cec6) still gets the save path's
+* KEEP / SET / CLEAR semantics instead of being overwritten by whatever the
+* addon writes. Markers inside arrays are not added: a row has no id field to
+* match by unless the schema declares one. Only `owner`'s markers count: a
+* builtin that keeps another addon's marker (device-manager) never takes it
+* over.
+*/
+function widenTreeWithStoredMarkers(declared, stored, keys, owner) {
+	const added = /* @__PURE__ */ new Map();
+	for (const key of keys) {
+		const at = key.indexOf("@");
+		const base = at > 0 ? key.slice(0, at) : key;
+		if (declared.has(base) || added.has(base)) continue;
+		const node = nodeFromStored(stored[key], owner);
+		if (node !== null) added.set(base, node);
+	}
+	return added.size === 0 ? declared : new Map([...declared, ...added]);
+}
 /** The blob as stored now; a failed read REFUSES the write instead of guessing. */
 async function readStoredAddonBlob(raw) {
 	const threeWay = raw.readAddonStoreResult;
@@ -1823,7 +1976,41 @@ async function readStoredAddonBlob(raw) {
 	if (result.kind === "failed") throw new Error(`settings write refused: the stored blob could not be read (${result.error})`);
 	return result.kind === "missing" ? {} : result.value;
 }
-function createSecretAwareSettings(raw, opts) {
+function touchesTree(tree, patch) {
+	if (tree.size === 0) return false;
+	for (const key of Object.keys(patch)) {
+		const at = key.indexOf("@");
+		if (tree.has(at > 0 ? key.slice(0, at) : key)) return true;
+	}
+	return false;
+}
+/**
+* Which top-level keys of each store held markers when last seen. `undefined`
+* for a store not seen yet: its first write reads it, to be safe.
+*/
+var MarkerKeyIndex = class {
+	owner;
+	byStore = /* @__PURE__ */ new Map();
+	constructor(owner) {
+		this.owner = owner;
+	}
+	seen(store, blob) {
+		this.byStore.set(store, markerKeysOf(blob, this.owner));
+	}
+	wrote(store, patch) {
+		const keys = this.byStore.get(store);
+		if (keys === void 0) return;
+		const now = markerKeysOf(patch, this.owner);
+		for (const key of Object.keys(patch)) if (now.has(key)) keys.add(key);
+		else keys.delete(key);
+	}
+	mayHoldMarkers(store, patch) {
+		const keys = this.byStore.get(store);
+		if (keys === void 0) return true;
+		return Object.keys(patch).some((key) => keys.has(key));
+	}
+};
+function createHandle(raw, opts) {
 	const chains = /* @__PURE__ */ new Map();
 	const serialize = (key, fn) => {
 		const next = (chains.get(key) ?? Promise.resolve()).then(fn, fn);
@@ -1834,46 +2021,130 @@ function createSecretAwareSettings(raw, opts) {
 		});
 		return next;
 	};
-	const write = async (chainKey, tree, scope, patch, readStored, rawWrite) => {
-		if (!touchesTree(tree, patch)) return rawWrite(patch);
-		return serialize(chainKey, async () => {
+	const index = new MarkerKeyIndex(opts.secrets.owner);
+	const resolveRead = async (store, blob) => {
+		index.seen(store, blob);
+		const { value, unresolved } = await resolveSecretMarkers(blob, opts.secrets, {
+			unresolved: "keep-marker",
+			ownedBy: opts.secrets.owner
+		});
+		if (unresolved.length > 0) opts.onUnresolved?.(unresolved);
+		return value;
+	};
+	const write = async (store, declared, scope, patch, readStored, rawWrite) => {
+		if (!touchesTree(declared, patch) && !index.mayHoldMarkers(store, patch)) {
+			await rawWrite(patch);
+			index.wrote(store, patch);
+			return { changed: true };
+		}
+		return serialize(store, async () => {
 			const stored = await readStored();
+			index.seen(store, stored);
+			const operatorWrite = opts.isOperatorWrite?.() === true;
+			const restored = await restoreUnchangedSecrets({
+				patch,
+				stored,
+				secrets: opts.secrets,
+				operatorWrite
+			});
 			const result = await transformSecretWrite({
-				tree,
+				tree: widenTreeWithStoredMarkers(declared, stored, Object.keys(restored.patch), opts.secrets.owner),
 				secrets: opts.secrets,
-				patch,
+				patch: restored.patch,
 				stored,
 				...scope !== void 0 ? { scope } : {},
-				operatorWrite: opts.isOperatorWrite?.() === true
+				operatorWrite
 			});
-			if (Object.keys(result.patch).length > 0) await rawWrite(result.patch);
+			const effective = dropUnchangedKeys(result.patch, stored);
+			const wroteBlob = Object.keys(effective).length > 0;
+			if (wroteBlob) {
+				await rawWrite(effective);
+				index.wrote(store, effective);
+			}
 			const { orphaned } = await result.afterWrite();
 			if (orphaned.length > 0) opts.onOrphaned(orphaned);
+			return { changed: wroteBlob || restored.changedRefs.length > 0 };
 		});
 	};
-	const wrapped = {
-		writeAddonStore: (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p)),
-		writeDeviceStore: (deviceId, patch) => write(`device:${deviceId}`, opts.deviceTree(), {
-			kind: "device",
-			deviceId
-		}, patch, () => raw.readDeviceStore(deviceId), (p) => raw.writeDeviceStore(deviceId, p))
+	const writeAddon = (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p));
+	const readAddonStoreResult = raw.readAddonStoreResult;
+	const readAddonStoreKeyResult = raw.readAddonStoreKeyResult;
+	const readDeviceStoreBatch = raw.readDeviceStoreBatch;
+	const overrides = {
+		readAddonStore: async () => resolveRead("addon", await raw.readAddonStore()),
+		...readAddonStoreResult !== void 0 ? { readAddonStoreResult: async () => {
+			const result = await readAddonStoreResult.call(raw);
+			return result.kind === "value" ? {
+				kind: "value",
+				value: await resolveRead("addon", result.value)
+			} : result;
+		} } : {},
+		...readAddonStoreKeyResult !== void 0 ? { readAddonStoreKeyResult: async (key) => {
+			const result = await readAddonStoreKeyResult.call(raw, key);
+			if (result.kind !== "present") return result;
+			const { value, unresolved } = await resolveSecretMarkers({ [key]: result.value }, opts.secrets, {
+				unresolved: "keep-marker",
+				ownedBy: opts.secrets.owner
+			});
+			if (unresolved.length > 0) opts.onUnresolved?.(unresolved);
+			return {
+				kind: "present",
+				value: value[key]
+			};
+		} } : {},
+		readDeviceStore: async (deviceId) => resolveRead(`device:${deviceId}`, await raw.readDeviceStore(deviceId)),
+		...readDeviceStoreBatch !== void 0 ? { readDeviceStoreBatch: async (deviceIds) => {
+			const rows = await readDeviceStoreBatch.call(raw, deviceIds);
+			const out = /* @__PURE__ */ new Map();
+			for (const [deviceId, blob] of rows) out.set(deviceId, await resolveRead(`device:${deviceId}`, blob));
+			return out;
+		} } : {},
+		writeAddonStore: async (patch) => {
+			await writeAddon(patch);
+		},
+		writeDeviceStore: async (deviceId, patch) => {
+			await write(`device:${deviceId}`, opts.deviceTree(), {
+				kind: "device",
+				deviceId
+			}, patch, () => raw.readDeviceStore(deviceId), (p) => raw.writeDeviceStore(deviceId, p));
+		}
+	};
+	return {
+		settings: new Proxy(raw, { get(target, prop, receiver) {
+			if (typeof prop === "string" && Object.prototype.hasOwnProperty.call(overrides, prop)) return Reflect.get(overrides, prop);
+			const value = Reflect.get(target, prop, receiver);
+			return typeof value === "function" ? value.bind(target) : value;
+		} }),
+		raw: {
+			readAddonStore: async () => {
+				const blob = await raw.readAddonStore();
+				index.seen("addon", blob);
+				return blob;
+			},
+			readDeviceStore: async (deviceId) => {
+				const blob = await raw.readDeviceStore(deviceId);
+				index.seen(`device:${deviceId}`, blob);
+				return blob;
+			}
+		},
+		writeAddonStore: writeAddon
 	};
-	return new Proxy(raw, { get(target, prop, receiver) {
-		if (prop === "writeAddonStore") return wrapped.writeAddonStore;
-		if (prop === "writeDeviceStore") return wrapped.writeDeviceStore;
-		const value = Reflect.get(target, prop, receiver);
-		return typeof value === "function" ? value.bind(target) : value;
-	} });
-}
-/** The context the addon sees: identical, except that its settings writes are secret-aware. */
-function withSecretAwareSettings(context, opts) {
+}
+/** The context the addon sees, plus the private raw view and write outcome. */
+function createSecretAwareContext(context, opts) {
 	const raw = context.settings;
-	if (raw === void 0) return context;
-	const settings = createSecretAwareSettings(raw, opts);
-	return new Proxy(context, { get(target, prop, receiver) {
-		if (prop === "settings") return settings;
-		return Reflect.get(target, prop, receiver);
-	} });
+	if (raw === void 0) return {
+		context,
+		handle: null
+	};
+	const handle = createHandle(raw, opts);
+	return {
+		context: new Proxy(context, { get(target, prop, receiver) {
+			if (prop === "settings") return handle.settings;
+			return Reflect.get(target, prop, receiver);
+		} }),
+		handle
+	};
 }
 var LEAF = { kind: "leaf" };
 var DEFAULT_ITEM_ID_KEY = "id";
@@ -2061,6 +2332,14 @@ var BaseAddon = class {
 	_secretChangeUnsub = null;
 	/** >0 while an OPERATOR's settings write is being applied. */
 	_operatorWriteDepth = 0;
+	/**
+	* The keychain-aware settings handle (D798). Its `raw` view is the ONLY way
+	* to the marker-bearing blobs and stays private to this class: the form
+	* hydrate and config resolution need markers, addon code never does.
+	*/
+	_secretSettings = null;
+	/** Refs an addon-facing read could not resolve — each is logged once per process. */
+	_loggedUnresolvedReads = /* @__PURE__ */ new Set();
 	constructor(defaults) {
 		this.defaults = defaults;
 		this._config = { ...defaults };
@@ -2097,13 +2376,21 @@ var BaseAddon = class {
 	}
 	async initialize(context) {
 		const secrets = context.secrets;
-		this._ctx = secrets !== void 0 ? withSecretAwareSettings(context, {
-			secrets,
-			addonTree: () => this.addonSecretTree(),
-			deviceTree: () => this.deviceSecretTree(),
-			onOrphaned: (refs) => context.logger.warn("keychain refs dropped by a settings write could not be deleted", { meta: { refs: [...refs] } }),
-			isOperatorWrite: () => this._operatorWriteDepth > 0
-		}) : context;
+		if (secrets !== void 0) {
+			const { context: wrapped, handle } = createSecretAwareContext(context, {
+				secrets,
+				addonTree: () => this.addonSecretTree(),
+				deviceTree: () => this.deviceSecretTree(),
+				onOrphaned: (refs) => context.logger.warn("keychain refs dropped by a settings write could not be deleted", { meta: { refs: [...refs] } }),
+				isOperatorWrite: () => this._operatorWriteDepth > 0,
+				onUnresolved: (unresolved) => this.logUnresolvedRead(unresolved)
+			});
+			this._ctx = wrapped;
+			this._secretSettings = handle;
+		} else {
+			this._ctx = context;
+			this._secretSettings = null;
+		}
 		await this.resolveConfig();
 		if (secrets !== void 0) this._secretChangeUnsub = secrets.onChange((ref) => {
 			if (this._configSecretRefs.has(ref)) this.scheduleSecretReresolve(SECRET_CHANGE_DEBOUNCE_MS);
@@ -2220,11 +2507,8 @@ var BaseAddon = class {
 	async getGlobalSettings(overlay, cap, nodeId) {
 		const schema = this.globalSettingsSchema(cap);
 		if (!schema) return { sections: [] };
-		const projected = await this.resolveGlobalStore(nodeId, cap);
-		return hydrateSchema(schema, overlay ? {
-			...projected,
-			...overlay
-		} : projected, { inlineSecretsAsViews: true });
+		const projected = await this.readRawProjectedStore(nodeId, cap);
+		return hydrateSchema(schema, overlay ? await this.overlayKeepingMarkers(projected, overlay) : projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The integration-level view of this addon's settings: exactly the sections
@@ -2269,7 +2553,7 @@ var BaseAddon = class {
 			});
 		}
 		if (sections.length === 0) return null;
-		const projected = await this.resolveGlobalStore(nodeId);
+		const projected = await this.readRawProjectedStore(nodeId);
 		return hydrateSchema({
 			...schema,
 			sections
@@ -2286,12 +2570,50 @@ var BaseAddon = class {
 	* the store for custom option logic (option narrowing, value snapping) to
 	* read it per-node — never `ctx.settings.readAddonStore()` directly.
 	* `nodeId` omitted ⇒ the local node (node-blind injection from ctx).
+	*
+	* Keychain values come back RESOLVED (D798): a secret reads as its value,
+	* never as a `{ $secret }` marker. One the keychain cannot serve right now
+	* stays a marker — "stored, unavailable" (`isSecretMarker()` is true, and it
+	* is listed in {@link unresolvedSecrets}) — never `''` and never absent, so
+	* it cannot be mistaken for "nothing stored, mint a new one". Writing the
+	* resolved blob back is a no-op for every unchanged secret.
 	*/
 	async resolveGlobalStore(nodeId, cap) {
 		const raw = await this._ctx?.settings?.readAddonStore() ?? {};
+		return this.projectForNode(raw, nodeId, cap);
+	}
+	projectForNode(store, nodeId, cap) {
 		const keys = this.perNodeKeys(cap);
 		const node = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
-		return keys.size > 0 ? projectStore(raw, keys, node) : raw;
+		return keys.size > 0 ? projectStore(store, keys, node) : store;
+	}
+	/** The PROJECTED store with its markers — the form hydrate only (D798). */
+	async readRawProjectedStore(nodeId, cap) {
+		const raw = await this.rawSettings()?.readAddonStore() ?? {};
+		return this.projectForNode(raw, nodeId, cap);
+	}
+	/**
+	* `{ ...stored, ...overlay }`, except that an overlay member equal to the
+	* RESOLVED stored one keeps the stored (marker-bearing) member — so a form
+	* hydrated from a resolved overlay still shows a secret as "set", never as
+	* its value.
+	*/
+	async overlayKeepingMarkers(stored, overlay) {
+		const secrets = this._ctx?.secrets;
+		const merged = {
+			...stored,
+			...overlay
+		};
+		if (secrets === void 0 || collectSecretMarkerRefs(stored).length === 0) return merged;
+		const { value: resolved } = await resolveSecretMarkers(stored, secrets, {
+			unresolved: "keep-marker",
+			ownedBy: secrets.owner
+		});
+		for (const key of Object.keys(overlay)) {
+			if (collectSecretMarkerRefs(stored[key]).length === 0) continue;
+			if (isJsonEqual(overlay[key], resolved[key])) merged[key] = stored[key];
+		}
+		return merged;
 	}
 	/**
 	* Whether ONE global key of this addon's store was written, read three-way
@@ -2356,8 +2678,12 @@ var BaseAddon = class {
 	async clearSecrets(keys, nodeId) {
 		const tree = this.addonSecretTree();
 		const keychain = this._ctx?.secrets !== void 0;
+		const stored = keychain ? await this.readAddonStoreWithRetry() : {};
 		const patch = {};
-		for (const key of keys) patch[key] = keychain && tree.has(key) ? SECRET_CLEAR : "";
+		for (const key of keys) {
+			const keychainStored = tree.has(key) || collectSecretMarkerRefs(stored[key]).length > 0;
+			patch[key] = keychain && keychainStored ? SECRET_CLEAR : "";
+		}
 		await this.applyGlobalPatch(patch, nodeId);
 	}
 	async applyGlobalPatch(barePatch, nodeId) {
@@ -2365,7 +2691,11 @@ var BaseAddon = class {
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
 		const scoped = keys.size > 0 ? scopePatch(barePatch, keys, target) : barePatch;
-		await this._ctx?.settings?.writeAddonStore(scoped);
+		const handle = this._secretSettings;
+		if (handle !== null) {
+			const { changed } = await handle.writeAddonStore(scoped);
+			if (!changed) return;
+		} else await this._ctx?.settings?.writeAddonStore(scoped);
 		if (target !== localNode) return;
 		await this.resolveConfig();
 		await this.onConfigChanged();
@@ -2418,7 +2748,7 @@ var BaseAddon = class {
 	async getDeviceSettings(deviceId) {
 		const schema = this.deviceSettingsSchema();
 		if (!schema) return { sections: [] };
-		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, { inlineSecretsAsViews: true });
+		return hydrateSchema(schema, await this.rawSettings()?.readDeviceStore(deviceId) ?? {}, { inlineSecretsAsViews: true });
 	}
 	async updateDeviceSettings(deviceId, patch) {
 		await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
@@ -2590,7 +2920,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: async () => this.resolveStoredSecrets(await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, false),
+			read: async () => this.resolveStoredSecrets(await this.rawSettings()?.readDeviceStore(deviceId) ?? {}, false),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
 			},
@@ -2652,6 +2982,23 @@ var BaseAddon = class {
 		}
 		return value;
 	}
+	/**
+	* The marker-bearing settings reads (D798) — private on purpose. Without a
+	* keychain the context's own view is already raw.
+	*/
+	rawSettings() {
+		return this._secretSettings?.raw ?? this._ctx?.settings;
+	}
+	/** An addon-facing read met markers it could not resolve: say so once per ref. */
+	logUnresolvedRead(unresolved) {
+		const fresh = unresolved.filter((u) => !this._loggedUnresolvedReads.has(u.ref));
+		if (fresh.length === 0) return;
+		for (const u of fresh) this._loggedUnresolvedReads.add(u.ref);
+		this._ctx?.logger?.warn?.("settings read: a stored secret is unavailable — it reads as its marker, not as a value", { meta: { secrets: fresh.map((u) => ({
+			ref: u.ref,
+			reason: u.reason
+		})) } });
+	}
 	/** Re-resolve the config (a keychain-only change, or a retry) and apply it. */
 	scheduleSecretReresolve(delayMs) {
 		const timerOf = delayMs === SECRET_CHANGE_DEBOUNCE_MS ? "_secretChangeTimer" : "_secretRetryTimer";
@@ -2678,7 +3025,7 @@ var BaseAddon = class {
 	* `{}` (defaults) — the addon's first successful patch will rehydrate.
 	*/
 	async readAddonStoreWithRetry() {
-		const settings = this._ctx?.settings;
+		const settings = this.rawSettings();
 		if (!settings) return {};
 		const delaysMs = [
 			150,
@@ -3796,6 +4143,28 @@ var adminUiCapability = {
 		getVersion: method(zod.z.void(), VersionOutputSchema$1, { auth: "admin" })
 	}
 };
+/**
+* Identity — preserves literal types for downstream inference.
+*
+* The constraint is `Record<string, unknown>` (not `CustomActionsSpec`) so
+* TypeScript does not widen each entry's literal `kind`/`auth` fields to
+* the broader unions declared on `CustomActionSpec`'s default generics.
+* Shape validity is enforced separately by the `customAction(...)` helper
+* whose return type is already a `CustomActionSpec<...>`.
+*/
+function defineCustomActions(spec) {
+	return spec;
+}
+function customAction(input, output, options) {
+	return {
+		input,
+		output,
+		kind: options?.kind ?? "query",
+		auth: options?.auth ?? "protected",
+		scope: options?.scope ?? { kind: "system" },
+		...options?.caller ? { caller: "required" } : {}
+	};
+}
 var StaticDirOutputSchema = zod.z.object({ staticDir: zod.z.string() });
 var VersionOutputSchema = zod.z.object({ version: zod.z.string() });
 /**
@@ -6652,6 +7021,278 @@ var DERIVED_CAMERA_SILENCED_CAP_NAMES = [
 	"scene-monitor"
 ];
 /**
+* The trainer contract — what the hub hands the cloud trainer and what it
+* gets back (cloud training, D805+).
+*
+* The trainer (`hf/camstack-trainer`, published as the Hugging Face repo
+* `camstack/camstack-trainer`) is a separate AGPL program the hub never
+* imports: `job.json` goes in, files come out, and progress is `CAMSTACK_EVENT`
+* lines on stdout. These schemas are the hub's half of that boundary; the
+* trainer's pydantic models (and the JSON Schemas generated from them under
+* `hf/camstack-trainer/schemas/`) are the other half. A change here is a
+* change there, in the same piece of work.
+*
+* No `.default()` anywhere: defaults do not run on the addon cap path, so the
+* orchestrator fills every field of a job spec explicitly.
+*/
+var TRAINING_JOB_SCHEMA = "camstack.training/v1";
+var TRAINING_RESULT_SCHEMA = "camstack.training-result/v1";
+/** What the trainer can export. Edge TPU is a later, separate image. */
+var TrainingExportSchema = zod.z.enum([
+	"onnx",
+	"openvino-fp16",
+	"openvino-int8",
+	"coreml-fp16"
+]);
+var FloorsSchema = zod.z.record(zod.z.string(), zod.z.number().min(0).max(1));
+zod.z.object({
+	schema: zod.z.literal(TRAINING_JOB_SCHEMA),
+	jobKey: zod.z.string().uuid(),
+	target: zod.z.object({
+		kind: zod.z.literal("detector"),
+		step: zod.z.literal("object-detection")
+	}),
+	base: zod.z.object({
+		modelId: zod.z.string().min(1),
+		/** Ultralytics weights id, e.g. `yolov9m.pt`. */
+		weights: zod.z.string().min(1),
+		imgsz: zod.z.number().int().positive()
+	}),
+	baseline: zod.z.object({
+		modelId: zod.z.string().min(1),
+		/** The baseline ONNX the holdout comparison runs; public mirror URL. */
+		onnxUrl: zod.z.string().url(),
+		imgsz: zod.z.number().int().positive(),
+		floors: FloorsSchema
+	}),
+	dataset: zod.z.object({
+		versionId: zod.z.string().min(1),
+		annotationHash: zod.z.string(),
+		/** sha256 of the uploaded archive; the trainer refuses a mismatch (exit 65). */
+		sha256: zod.z.string().regex(/^[0-9a-f]{64}$/)
+	}),
+	split: zod.z.object({
+		holdoutCameras: zod.z.array(zod.z.number().int()),
+		/** When no camera is held out: the last N days of every camera. */
+		holdoutLastDays: zod.z.number().int().nonnegative(),
+		valFraction: zod.z.number().min(0).max(.5),
+		seed: zod.z.number().int()
+	}),
+	hyper: zod.z.object({
+		epochs: zod.z.number().int().positive(),
+		batch: zod.z.number().int().positive(),
+		lr0: zod.z.number().positive(),
+		/** Layers frozen from the start of the backbone; 0 = none. */
+		freeze: zod.z.number().int().nonnegative(),
+		patience: zod.z.number().int().nonnegative(),
+		seed: zod.z.number().int()
+	}),
+	replay: zod.z.object({
+		source: zod.z.literal("coco2017"),
+		count: zod.z.number().int().nonnegative()
+	}),
+	exports: zod.z.array(TrainingExportSchema).min(1),
+	calibration: zod.z.object({ maxFrames: zod.z.number().int().positive() }),
+	floors: zod.z.object({
+		minSupport: zod.z.number().int().positive(),
+		clamp: zod.z.number().min(0).max(1)
+	}),
+	int8Gate: zod.z.object({ maxMap50Drop: zod.z.number().min(0).max(1) }),
+	catalog: zod.z.object({
+		id: zod.z.string().regex(/^[a-z0-9][a-z0-9-]{2,80}$/),
+		name: zod.z.string().min(1).max(160)
+	})
+});
+/** One regular file of the bundle. An mlpackage contributes one row per member. */
+var TrainingResultFileSchema = zod.z.object({
+	path: zod.z.string().min(1),
+	bytes: zod.z.number().int().nonnegative(),
+	sha256: zod.z.string().regex(/^[0-9a-f]{64}$/),
+	format: zod.z.enum([
+		"onnx",
+		"openvino",
+		"coreml",
+		"pt"
+	]),
+	variant: zod.z.enum(["base", "int8"])
+});
+var DraftFormatSchema = zod.z.object({
+	/** RELATIVE path inside the bundle; the hub rewrites it to `camstack-local://`. */
+	url: zod.z.string().min(1),
+	sizeMB: zod.z.number().nonnegative(),
+	isDirectory: zod.z.boolean().optional(),
+	files: zod.z.array(zod.z.string()).optional(),
+	runtimes: zod.z.array(zod.z.literal("python")).optional(),
+	revision: zod.z.string().min(1)
+});
+/** The trainer's half of a catalog entry; the hub completes it (labels, licence, group). */
+var TrainingCatalogDraftSchema = zod.z.object({
+	id: zod.z.string().min(1),
+	name: zod.z.string().min(1),
+	description: zod.z.string(),
+	labels: zod.z.array(zod.z.unknown()),
+	inputSize: zod.z.object({
+		width: zod.z.number().int().positive(),
+		height: zod.z.number().int().positive()
+	}),
+	preprocessMode: zod.z.literal("letterbox"),
+	defaultClassFloors: FloorsSchema,
+	formats: zod.z.object({
+		onnx: DraftFormatSchema.optional(),
+		openvino: DraftFormatSchema.optional(),
+		coreml: DraftFormatSchema.optional()
+	})
+});
+/** One class of one model's holdout report (the eval harness's summary). */
+var TrainingEvalClassSchema = zod.z.object({
+	positives: zod.z.number().int(),
+	floor: zod.z.number().nullable(),
+	tp: zod.z.number().int(),
+	fp: zod.z.number().int(),
+	fn: zod.z.number().int(),
+	precision: zod.z.number().nullable(),
+	recall: zod.z.number().nullable(),
+	ap50: zod.z.number().nullable(),
+	recallByCamera: zod.z.record(zod.z.string(), zod.z.number().nullable()).optional(),
+	recallByLight: zod.z.record(zod.z.string(), zod.z.number().nullable()).optional(),
+	fpByCamera: zod.z.record(zod.z.string(), zod.z.number()).optional(),
+	smallFound: zod.z.number().int().optional(),
+	smallTotal: zod.z.number().int().optional()
+}).passthrough();
+var TrainingEvalReportSchema = zod.z.object({
+	frames: zod.z.number().int(),
+	classes: zod.z.record(zod.z.string(), TrainingEvalClassSchema)
+}).passthrough();
+/**
+* A succeeded result carries every block; a failed one carries the error and
+* whatever was known by then — the other blocks are ABSENT, not null. The
+* orchestrator checks the blocks it needs before it trusts a success.
+*/
+var TrainingResultSchema = zod.z.object({
+	schema: zod.z.literal(TRAINING_RESULT_SCHEMA),
+	jobKey: zod.z.string(),
+	status: zod.z.enum(["succeeded", "failed"]),
+	error: zod.z.object({
+		stage: zod.z.string(),
+		code: zod.z.string(),
+		message: zod.z.string()
+	}).nullable(),
+	trainer: zod.z.object({
+		version: zod.z.string(),
+		revision: zod.z.string()
+	}),
+	toolchain: zod.z.record(zod.z.string(), zod.z.string().nullable()),
+	dataset: zod.z.object({
+		versionId: zod.z.string(),
+		annotationHash: zod.z.string(),
+		sha256: zod.z.string(),
+		frames: zod.z.object({
+			train: zod.z.number().int(),
+			val: zod.z.number().int(),
+			holdout: zod.z.number().int()
+		}),
+		holdoutCameras: zod.z.array(zod.z.number().int()),
+		replayImages: zod.z.number().int()
+	}).optional(),
+	training: zod.z.object({
+		epochsRun: zod.z.number().int(),
+		bestEpoch: zod.z.number().int(),
+		bestMap50: zod.z.number(),
+		bestMap50_95: zod.z.number(),
+		seconds: zod.z.number()
+	}).optional(),
+	evaluation: zod.z.object({
+		holdoutFrames: zod.z.number().int(),
+		baseline: TrainingEvalReportSchema.nullable(),
+		candidate: TrainingEvalReportSchema.nullable(),
+		candidateInt8: TrainingEvalReportSchema.nullable(),
+		recallDeltaByCamera: zod.z.record(zod.z.string(), zod.z.record(zod.z.string(), zod.z.number())).nullable(),
+		map50: zod.z.record(zod.z.string(), zod.z.number().nullable())
+	}).optional(),
+	floors: zod.z.object({
+		baseline: FloorsSchema,
+		candidate: FloorsSchema,
+		candidateInt8: FloorsSchema.nullable(),
+		notes: zod.z.array(zod.z.string())
+	}).optional(),
+	int8: zod.z.object({
+		kept: zod.z.boolean(),
+		map50Fp16: zod.z.number().nullable(),
+		map50Int8: zod.z.number().nullable(),
+		reason: zod.z.string().nullable()
+	}).optional(),
+	exportsDropped: zod.z.array(zod.z.object({
+		export: zod.z.string(),
+		reason: zod.z.string()
+	})).optional(),
+	files: zod.z.array(TrainingResultFileSchema).optional(),
+	bundle: zod.z.object({
+		path: zod.z.literal("bundle.tar"),
+		bytes: zod.z.number().int().nonnegative(),
+		sha256: zod.z.string().regex(/^[0-9a-f]{64}$/)
+	}).nullable().optional(),
+	catalogDraft: zod.z.object({
+		base: TrainingCatalogDraftSchema,
+		int8: TrainingCatalogDraftSchema.nullable()
+	}).nullable().optional(),
+	licence: zod.z.string()
+});
+var TrainingStageSchema = zod.z.enum([
+	"prepare",
+	"replay",
+	"train",
+	"eval",
+	"export",
+	"package"
+]);
+var EventBase = {
+	v: zod.z.literal(1),
+	ts: zod.z.number()
+};
+zod.z.discriminatedUnion("type", [
+	zod.z.object({
+		...EventBase,
+		type: zod.z.literal("stage"),
+		stage: TrainingStageSchema
+	}),
+	zod.z.object({
+		...EventBase,
+		type: zod.z.literal("epoch"),
+		epoch: zod.z.number().int(),
+		epochs: zod.z.number().int(),
+		boxLoss: zod.z.number().nullable().optional(),
+		map50: zod.z.number().nullable().optional(),
+		map50_95: zod.z.number().nullable().optional(),
+		etaSec: zod.z.number().nullable().optional()
+	}),
+	zod.z.object({
+		...EventBase,
+		type: zod.z.literal("metric"),
+		name: zod.z.string(),
+		value: zod.z.number()
+	}),
+	zod.z.object({
+		...EventBase,
+		type: zod.z.literal("artifact"),
+		path: zod.z.string(),
+		bytes: zod.z.number(),
+		sha256: zod.z.string()
+	}),
+	zod.z.object({
+		...EventBase,
+		type: zod.z.literal("done"),
+		status: zod.z.enum(["succeeded", "failed"]),
+		resultSha256: zod.z.string().nullable().optional()
+	}),
+	zod.z.object({
+		...EventBase,
+		type: zod.z.literal("error"),
+		stage: zod.z.string(),
+		code: zod.z.string(),
+		message: zod.z.string()
+	})
+]);
+/**
 * What the gate decided about a birth, from the CALLER's point of view.
 *
 * Deliberately not `ConfirmationVerdict`: `undecided` is not a birth decision
@@ -9408,7 +10049,9 @@ var AddonHttpRouteSchema = zod.z.object({
 		"authenticated",
 		"admin"
 	]).optional(),
-	description: zod.z.string().optional()
+	description: zod.z.string().optional(),
+	/** The hub limits this route per client address before the handler runs. */
+	rateLimit: zod.z.enum(["auth"]).optional()
 });
 /**
 * Cross-process route invocation envelope. The hub captures the
@@ -10372,6 +11015,37 @@ var BackupDestinationInfoSchema = zod.z.object({
 	lastError: zod.z.string().optional()
 });
 /**
+* How an archive is encrypted (operator decision 2026-10-09): to a backup
+* PUBLIC key the hub holds, so only the operator's secret key opens it.
+* Absent on a plain `.tar.gz` — every archive made before encryption, or
+* with it off — which restores without a key.
+*/
+var BackupArchiveEncryptionSchema = zod.z.object({
+	/** `x25519-hkdf-aes256gcm-stream-v1`. */
+	scheme: zod.z.string(),
+	/** 16 hex — the backup key whose secret restores this archive. */
+	keyId: zod.z.string()
+});
+/**
+* The backup encryption setting. The hub keeps PUBLIC keys only: the active
+* one new archives are encrypted to, and the retired ones older archives
+* still need. The secret key is shown once, at `setupEncryption`.
+*/
+var BackupEncryptionStatusSchema = zod.z.object({
+	enabled: zod.z.boolean(),
+	active: zod.z.object({
+		keyId: zod.z.string(),
+		publicKey: zod.z.string(),
+		createdAt: zod.z.number()
+	}).nullable(),
+	/** Every key ever set up, newest first. */
+	keys: zod.z.array(zod.z.object({
+		keyId: zod.z.string(),
+		createdAt: zod.z.number(),
+		retiredAt: zod.z.number().nullable()
+	})).readonly()
+});
+/**
 * Per-archive entry returned by `backup.listArchives({ destinationId })`.
 * Same shape the destination drill-in renders. Sourced from the per-
 * location `manifests.json` (no per-archive tarball read required).
@@ -10383,7 +11057,9 @@ var BackupArchiveEntrySchema = zod.z.object({
 	sizeBytes: zod.z.number(),
 	label: zod.z.string().optional(),
 	/** Top-level locations included in the archive (db, addons, tls, …). */
-	locations: zod.z.array(zod.z.string()).readonly()
+	locations: zod.z.array(zod.z.string()).readonly(),
+	/** Present when the archive is encrypted; restore then needs that key. */
+	encryption: BackupArchiveEncryptionSchema.optional()
 });
 var BackupEntrySchema = zod.z.object({
 	id: zod.z.string(),
@@ -10392,7 +11068,8 @@ var BackupEntrySchema = zod.z.object({
 	label: zod.z.string().optional(),
 	createdAt: zod.z.number(),
 	sizeBytes: zod.z.number(),
-	locations: zod.z.array(zod.z.string()).optional()
+	locations: zod.z.array(zod.z.string()).optional(),
+	encryption: BackupArchiveEncryptionSchema.optional()
 });
 var ArchiveEntrySchema = zod.z.object({
 	path: zod.z.string(),
@@ -10647,11 +11324,58 @@ var backupCapability = {
 			* this list and skips entries whose path doesn't start with
 			* any of them.
 			*/
-			locations: zod.z.array(zod.z.string()).optional()
+			locations: zod.z.array(zod.z.string()).optional(),
+			/**
+			* The backup SECRET key, for an encrypted archive (ignored for a plain
+			* one). The archive is decrypted into the hub's private staging
+			* before the restart; the key is not stored. A wrong or missing key
+			* is refused before the archive is downloaded.
+			*/
+			backupSecretKey: zod.z.string().optional()
 		}), zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/** The encryption setting — public keys only. */
+		getEncryption: method(zod.z.void(), BackupEncryptionStatusSchema, { auth: "admin" }),
+		/**
+		* Turn encryption on, or replace the key: generates a new key pair, keeps
+		* the PUBLIC key, and returns the SECRET key — once. It is never stored
+		* on the hub and cannot be shown again; archives made from now on need
+		* it to be restored. A previous key is retired: archives made with it
+		* still need IT.
+		*/
+		setupEncryption: method(zod.z.object({}), zod.z.object({
+			keyId: zod.z.string(),
+			secretKey: zod.z.string(),
+			publicKey: zod.z.string(),
+			createdAt: zod.z.number(),
+			replacedKeyId: zod.z.string().nullable()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** New archives are plain again. Existing encrypted archives keep needing their key. */
+		disableEncryption: method(zod.z.object({}), zod.z.object({ disabledKeyId: zod.z.string().nullable() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Does this secret key parse, and which backup key is it? A mutation so
+		* the key never travels in a URL. Nothing is stored.
+		*/
+		checkBackupKey: method(zod.z.object({ backupSecretKey: zod.z.string() }), zod.z.object({
+			valid: zod.z.boolean(),
+			keyId: zod.z.string().nullable(),
+			/** The hub knows this key (active or retired). */
+			known: zod.z.boolean(),
+			/** It is the key new archives are encrypted to. */
+			active: zod.z.boolean(),
+			error: zod.z.string().optional()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		delete: method(zod.z.object({
 			destinationId: zod.z.string(),
 			backupId: zod.z.string()
@@ -14162,22 +14886,87 @@ var CustomModelDescriptorSchema = zod.z.object({
 	stepId: zod.z.string(),
 	entry: ModelCatalogEntrySchema
 });
+/** One regular file of an imported bundle, as the producer measured it. */
+var ModelBundleFileSchema = zod.z.object({
+	/** Relative path inside the bundle tar; an mlpackage member is `<x>.mlpackage/<member>`. */
+	path: zod.z.string().min(1),
+	bytes: zod.z.number().int().nonnegative(),
+	sha256: zod.z.string().regex(/^[0-9a-f]{64}$/)
+});
+var ImportModelBundleInputSchema = zod.z.object({
+	/** The registry provider that keeps the model (Model Studio). */
+	addonId: zod.z.string(),
+	stepId: zod.z.string().min(1),
+	/**
+	* The catalog rows to register, complete, every format URL already
+	* `camstack-local://<modelId>/<file>` naming a file of the bundle. One
+	* bundle may carry several rows (a base and its INT8 variant).
+	*/
+	entries: zod.z.array(ModelCatalogEntrySchema).min(1).max(4),
+	/** The bundle tar, offered by the producer over `ctx.peerBytes` (same host). */
+	bundle: zod.z.object({
+		ticket: PeerBytesTicketSchema,
+		bytes: zod.z.number().int().positive(),
+		sha256: zod.z.string().regex(/^[0-9a-f]{64}$/)
+	}),
+	/** Every file the tar must hold; anything missing, extra or different is refused. */
+	files: zod.z.array(ModelBundleFileSchema).min(1).max(64),
+	/** Convert missing engine formats and push the model to every agent afterwards. */
+	distribute: zod.z.boolean()
+});
+var ImportModelBundleResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("imported"),
+	modelIds: zod.z.array(zod.z.string()).readonly(),
+	distributed: zod.z.array(zod.z.object({
+		modelId: zod.z.string(),
+		nodeId: zod.z.string(),
+		format: zod.z.enum(MODEL_FORMATS),
+		ok: zod.z.boolean(),
+		error: zod.z.string().optional()
+	})).readonly()
+}), zod.z.object({
+	kind: zod.z.literal("refused"),
+	reason: zod.z.enum([
+		"transfer-failed",
+		"checksum-mismatch",
+		"bundle-mismatch",
+		"invalid-entry",
+		"id-taken"
+	]),
+	detail: zod.z.string()
+})]);
 var customModelRegistryCapability = {
 	name: "custom-model-registry",
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { 
-	/**
-	* `internal: true` did not gate the mount (see the 2026-08-26 note on
-	* `data-store-provider`) — this was reachable on the AppRouter by ANY
-	* authenticated session at the default `auth: 'protected'`. The only
-	* consumer, the detection-pipeline's model resolution
-	* (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
-	* `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
-	* never tRPC — so `auth: 'admin'` costs it nothing.
-	*/
-listModels: method(zod.z.void(), zod.z.array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }) }
+	methods: {
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — this was reachable on the AppRouter by ANY
+		* authenticated session at the default `auth: 'protected'`. The only
+		* consumer, the detection-pipeline's model resolution
+		* (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
+		* `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
+		* never tRPC — so `auth: 'admin'` costs it nothing.
+		*/
+		listModels: method(zod.z.void(), zod.z.array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }),
+		/**
+		* Register a model whose files arrive as ONE bundle tar (D806): the tar
+		* is taken over `ctx.peerBytes`, checked against `bundle.sha256` and
+		* every row of `files`, unpacked into the hub's flat modelsDir (directory
+		* formats included), each format's `.revision` record written, the rows
+		* upserted under the operator's name, the hub marked available and —
+		* when asked — engine formats converted and the model distributed. A
+		* model id already registered by another source is refused, never
+		* overwritten.
+		*/
+		importModelBundle: method(ImportModelBundleInputSchema, ImportModelBundleResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 30 * 6e4
+		})
+	}
 };
 /**
 * Query filter for settings-store collections.
@@ -14984,6 +15773,42 @@ var KeychainKeySourceSchema = zod.z.object({
 	*/
 	sharesBackupWithDatabase: zod.z.boolean()
 });
+/**
+* Who reset the keychain: an operator from System → Secrets (`user:<id>`), or
+* the one-shot `<dataDir>/.keychain/RESET_KEYCHAIN` trigger file at boot
+* (`trigger-file`) — the only way back into a hub whose master key is lost,
+* because a locked keychain leaves no session that could reach the page (D797).
+*/
+var KEYCHAIN_RESET_TRIGGER_ACTOR = "trigger-file";
+/**
+* One keychain reset, as the Secrets page reports it until the operator
+* acknowledges it. Never a value: refs, counts and table names only.
+*/
+var KeychainResetRecordSchema = zod.z.object({
+	id: zod.z.string(),
+	at: zod.z.number(),
+	/** `user:<id>` or {@link KEYCHAIN_RESET_TRIGGER_ACTOR}. */
+	actor: zod.z.string(),
+	/** Why the keychain was locked when it was reset; `null` when it was not locked. */
+	lockedReason: zod.z.string().nullable(),
+	/** Values moved into the archive table (ciphertext under the lost key). */
+	archived: zod.z.number().int(),
+	/** `keychain:secrets-orphaned-<ts>`, or `null` when nothing was stored. */
+	archivedCollection: zod.z.string().nullable(),
+	/**
+	* `keychain:keys-orphaned-<ts>`: the wrapped data keys of the archive, kept
+	* so the archive can still be opened if the lost master key turns up.
+	*/
+	archivedKeysCollection: zod.z.string().nullable(),
+	/**
+	* `system-settings` keys whose marker the reset cleared — the cluster
+	* secret's: a marker left pointing at an archived value would refuse every
+	* agent forever (D797).
+	*/
+	clearedSettingsKeys: zod.z.array(zod.z.string()).readonly(),
+	/** When an operator dismissed the notice on the Secrets page; `null` until then. */
+	acknowledgedAt: zod.z.number().nullable()
+});
 var KeychainStatusSchema = zod.z.object({
 	keychain: KeychainStateSchema,
 	/** The source of the master key in use; `null` while locked. */
@@ -15001,7 +15826,9 @@ var KeychainStatusSchema = zod.z.object({
 	/** Wrapped copies of the data key under a previous master key, kept until purged. */
 	retiredWraps: zod.z.number().int(),
 	recoveryKeyDownloadedAt: zod.z.number().nullable(),
-	secretCount: zod.z.number().int()
+	secretCount: zod.z.number().int(),
+	/** The most recent reset, acknowledged or not; `null` when the keychain was never reset. */
+	lastReset: KeychainResetRecordSchema.nullable()
 });
 /**
 * Whether a stored value is still pointed at by its owner's settings.
@@ -15023,13 +15850,14 @@ var KeychainAuditActionSchema = zod.z.enum([
 	"download-recovery-key",
 	"delete-orphans",
 	"reset",
+	"acknowledge-reset",
 	"initialize"
 ]);
 var KeychainAuditEntrySchema = zod.z.object({
 	id: zod.z.string(),
 	at: zod.z.number(),
 	action: KeychainAuditActionSchema,
-	/** `addon:<id>` | `user:<id>` | `system`. */
+	/** `addon:<id>` | `user:<id>` | `system` | `trigger-file`. */
 	actor: zod.z.string(),
 	ref: zod.z.string().nullable(),
 	detail: zod.z.string().nullable()
@@ -15139,6 +15967,21 @@ var keychainAdminCapability = {
 			kind: "mutation",
 			auth: "admin",
 			caller: "required"
+		}),
+		/**
+		* What the last reset left to re-enter: the archived refs (owner, scope,
+		* field — never a value) that hold no value again yet. Process-held refs
+		* the hub regenerates itself (the session signing key) are not listed.
+		*/
+		resetReport: method(zod.z.object({}), zod.z.object({
+			reset: KeychainResetRecordSchema.nullable(),
+			pendingReentry: zod.z.array(KeychainSecretMetaSchema).readonly()
+		}), { auth: "admin" }),
+		/** Dismiss the "keychain was reset" notice. Audited. */
+		acknowledgeReset: method(zod.z.object({}), zod.z.object({ acknowledged: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
 		})
 	}
 };
@@ -18395,8 +19238,8 @@ var PUBLIC_ENDPOINT_HTTP_REASON = "The public endpoint needs an https:// address
 * May `baseUrl` carry `role`? The address check above, plus two role rules:
 * the app link carries `notificationTaps` only (it is not a hub address), and
 * a plain-http address carries `publicEndpoint` only when the operator
-* explicitly accepted it (`acceptInsecureHttp`) — a LAN-only password or
-* magic-link sign-in works over http, a passkey or an OIDC callback does not.
+* explicitly accepted it (`acceptInsecureHttp`) — a LAN-only password
+* sign-in works over http, a passkey or an OIDC callback does not.
 */
 function checkRoleAddress(role, baseUrl, options = {}) {
 	if (isAppLinkBase(baseUrl)) return role === "notificationTaps" ? {
@@ -19426,7 +20269,7 @@ var logDestinationCapability = {
 * `login-method` — collection cap through which auth addons contribute
 * their pre-auth login surfaces to the login page. This is the SINGLE,
 * generic mechanism that supersedes the dead `auth.listProviders` reader:
-* every auth addon (OIDC, magic-link, WebAuthn/passkey) registers a
+* every auth addon (OIDC, WebAuthn/passkey) registers a
 * `login-method` provider and the PUBLIC `auth.listLoginMethods`
 * procedure aggregates them for the unauthenticated login page.
 *
@@ -19434,8 +20277,7 @@ var logDestinationCapability = {
 *
 *  - `redirect` — a declarative button. The login page renders a generic
 *    button that navigates to `startUrl` (an addon-owned HTTP route).
-*    Covers OIDC (`/addon/auth-oidc/<id>/start`) and magic-link with
-*    ZERO shell-side JS. A future SSO addon plugs in the same way — the
+*    Covers OIDC (`/addon/auth-oidc/<id>/start`) with ZERO shell-side JS. A future SSO addon plugs in the same way — the
 *    login page needs NO change.
 *
 *  - `widget` — a Module-Federation widget the login page mounts (via
@@ -19454,8 +20296,8 @@ var logDestinationCapability = {
 *    decision.
 *
 * Every contribution carries a `stage`:
-*  - `primary`        — shown on the first credentials screen (OIDC /
-*                       magic-link buttons; a future usernameless passkey).
+*  - `primary`        — shown on the first credentials screen (OIDC
+*                       buttons; a usernameless passkey).
 *  - `second-factor`  — shown AFTER the password leg, gated on the
 *                       returned `factors` (passkey-as-2FA today).
 *
@@ -19467,7 +20309,7 @@ var logDestinationCapability = {
 var LoginStageEnum = zod.z.enum(["primary", "second-factor"]);
 /**
 * A declarative redirect button — the login page navigates to `startUrl`.
-* OIDC and magic-link contribute this; a future SSO addon does too.
+* OIDC contributes this; a future SSO addon does too.
 */
 var RedirectLoginMethodSchema = zod.z.object({
 	kind: zod.z.literal("redirect"),
@@ -19484,7 +20326,7 @@ var RedirectLoginMethodSchema = zod.z.object({
 	* The provider names an external identity a signed-in user can link to
 	* their own account (D782): `auth.listLinkableProviders` /
 	* `beginExternalLink` offer exactly the redirect methods that set this,
-	* whatever their id. Absent / false — a login button only (magic-link).
+	* whatever their id. Absent / false — a login button only.
 	*/
 	linkable: zod.z.boolean().optional()
 });
@@ -23755,8 +24597,7 @@ var notificationRulesCapability = {
 * `super_admin` — collapsed onto the single boolean because every
 * non-admin caller is governed by the same scope-check rules; the
 * distinction was only ever used to route role-specific procedures
-* which we no longer have. Agents are admin sessions issued via
-* `createServiceToken`; CLI / webhook integrations are `cst_*` tokens
+* which we no longer have. CLI / webhook integrations are `cst_*` tokens
 * with `isAdmin: false` + an explicit scope list.
 */
 /** Per-method access flavour. Materialised on every cap method via codegen. */
@@ -27037,6 +27878,26 @@ var pipelineAnalyticsCapability = {
 			auth: "admin",
 			timeoutMs: 60 * 6e4
 		}),
+		/**
+		* OFFER the annotated archive instead of pushing it (D805): the same tar
+		* `writeRetrainArchive` streams, behind a one-shot `ctx.peerBytes` ticket
+		* the caller dials at once (same host). For a consumer that cannot expose
+		* an upload URL — a training provider streaming straight into its cloud.
+		* The answer is the plan; the bytes and their sha256 are the consumer's
+		* to measure as they arrive.
+		*/
+		offerRetrainArchive: method(zod.z.object({
+			filter: RetrainExportFilterSchema,
+			layout: RetrainExportLayoutSchema
+		}), zod.z.object({
+			ticket: PeerBytesTicketSchema,
+			frames: zod.z.number().int(),
+			annotations: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
 		/** The counts a selection would freeze — class × camera × day/night,
 		*  completeness — without freezing anything. Index reads only. */
 		previewRetrainDataset: method(zod.z.object({
@@ -31783,8 +32644,8 @@ version: zod.z.string().optional() }), ServerUpdateActionResultSchema, {
 * `smtp-provider` — pluggable email delivery surface.
 *
 * Collection cap: a deployment may install multiple SMTP relays (e.g.
-* one for transactional / one for notifications). Consumers (magic-link,
-* notifier addons, …) walk the collection and pick the first
+* one for transactional / one for notifications). Consumers (notifier
+* addons, …) walk the collection and pick the first
 * ready provider OR target a specific addonId.
 *
 * The shape stays small on purpose — `sendEmail` is enough for the
@@ -32080,7 +32941,7 @@ targets: zod.z.array(zod.z.object({
 };
 /**
 * `sso-bridge` — internal hub-only cap that lets SSO-style auth
-* providers (OIDC, SAML, magic-link, …) mint an HMAC-signed token
+* providers (OIDC, SAML, …) mint an HMAC-signed token
 * carrying the post-callback claims before redirecting back to
 * `/api/auth/sso/finish`.
 *
@@ -32143,7 +33004,14 @@ var SsoBridgeClaimsSchema = zod.z.object({
 	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
 	* subject is unique only per issuer, so a link is bound to it.
 	*/
-	issuer: zod.z.string().optional()
+	issuer: zod.z.string().optional(),
+	/**
+	* SHA-256 (hex) of the `camstack_sso_state` cookie the IdP `/start` set in
+	* the browser that began this sign-in. `/api/auth/sso/finish` requires the
+	* request to present the matching cookie — a login bridge is useless in
+	* any other browser.
+	*/
+	browserBinding: zod.z.string().optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -32161,7 +33029,7 @@ var ssoBridgeCapability = {
 		* `/api/auth/sso/finish` to become admin — a full privilege escalation
 		* through the exact surface this cap exists to close (see the module
 		* docblock). Every real caller (`oauth-grants.ts`, `main.ts`
-		* registration, the OIDC/magic-link addons) reaches this through
+		* registration, the OIDC addon) reaches this through
 		* `ctx.api` / the in-process registry — never through tRPC — so
 		* `auth: 'admin'` costs those callers nothing.
 		*/
@@ -46957,16 +47825,6 @@ var ApiKeySummarySchema = zod.z.object({
 	createdAt: zod.z.number(),
 	lastUsedAt: zod.z.number().optional()
 });
-var CreateApiKeyInputSchema = zod.z.object({
-	label: zod.z.string(),
-	isAdmin: zod.z.boolean().default(false),
-	allowedProviders: zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")]).optional(),
-	allowedDevices: zod.z.record(zod.z.string(), zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")])).optional()
-});
-var CreateApiKeyResultSchema = zod.z.object({
-	token: zod.z.string(),
-	record: ApiKeySummarySchema
-});
 var ScopedTokenSummarySchema = zod.z.object({
 	id: zod.z.string(),
 	userId: zod.z.string(),
@@ -47078,20 +47936,11 @@ var userManagementCapability = {
 			access: "view"
 		}),
 		listApiKeys: method(zod.z.void(), zod.z.array(ApiKeySummarySchema), { auth: "admin" }),
-		createApiKey: method(CreateApiKeyInputSchema, CreateApiKeyResultSchema, {
-			kind: "mutation",
-			auth: "admin",
-			access: "create"
-		}),
 		revokeApiKey: method(zod.z.object({ id: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), {
 			kind: "mutation",
 			auth: "admin",
 			access: "delete"
 		}),
-		validateApiKey: method(zod.z.object({ token: zod.z.string() }), ApiKeySummarySchema.nullable(), {
-			kind: "mutation",
-			access: "view"
-		}),
 		createScopedToken: method(CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, {
 			kind: "mutation",
 			auth: "admin",
@@ -47181,20 +48030,6 @@ var userManagementCapability = {
 			userId: zod.z.string(),
 			issuer: zod.z.string()
 		}).nullable(), { auth: "admin" }),
-		/**
-		* Link `(provider, subject)` to `userId`. Idempotent for the same user;
-		* REFUSES (throws) an identity already linked to another user, and a
-		* user that does not exist.
-		*/
-		linkExternalIdentity: method(ExternalIdentityKeySchema.extend({
-			userId: zod.z.string(),
-			issuer: zod.z.string().min(1),
-			label: zod.z.string().optional()
-		}), zod.z.object({ success: zod.z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin",
-			access: "create"
-		}),
 		/** Remove one link of `userId`. `success: false` when it was not linked to that user. */
 		unlinkExternalIdentity: method(ExternalIdentityKeySchema.extend({ userId: zod.z.string() }), zod.z.object({ success: zod.z.boolean() }), {
 			kind: "mutation",
@@ -47923,6 +48758,531 @@ var zoneRulesCapability = {
 	*/
 	durability: "restored"
 };
+/**
+* `training-provider` — ONE cloud that can run the CamStack trainer.
+*
+* A thin, mockable translation layer: it knows how to run a container with a
+* GPU, move a dataset in, read the job's stdout and hand artefacts back. It
+* knows nothing about datasets, splits, floors, cost policy or Model Studio —
+* those are the `training` orchestrator's (D805). Every rule written there
+* once is what makes a second provider (RunPod, a local NVIDIA node) a new
+* manifest entry and nothing else.
+*
+* Collection, routed by the `addonId` in every single-row input (the `llm` /
+* `notification-output` posture); `describe` concat-fans across providers.
+* Every method is `admin`: these spend money.
+*
+* Every cloud object a provider creates is tagged with the orchestrator's
+* `jobKey`, so a retried submit finds the job it already started instead of
+* starting a second GPU, and `listJobs` can find orphans.
+*
+* Bytes never ride a cap field: the dataset arrives as a `ctx.peerBytes`
+* ticket the producer (pipeline-analytics) minted, and artefacts leave as a
+* ticket the provider mints (D613).
+*/
+var TrainingGpuOptionSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	/** List price, USD per GPU-hour, before any region multiplier. */
+	usdPerHour: zod.z.number().nonnegative(),
+	vramGb: zod.z.number().nonnegative()
+});
+var TrainingRegionOptionSchema = zod.z.object({
+	/** `''` = any region (the provider's choice). */
+	id: zod.z.string(),
+	label: zod.z.string(),
+	priceMultiplier: zod.z.number().positive()
+});
+/**
+* The provider's per-account settings, as the orchestrator reads them. They
+* live in the PROVIDER addon's settings (operator decision 2026-10-08: they
+* depend on the user's account), never hard-coded in the orchestrator.
+*/
+var TrainingProviderDefaultsSchema = zod.z.object({
+	gpuType: zod.z.string(),
+	region: zod.z.string(),
+	costCapUsd: zod.z.number().nonnegative(),
+	maxRuntimeSec: zod.z.number().int().positive(),
+	/** Hours a FAILED job's cloud dataset is kept for debugging; 0 = delete at once. */
+	failedDatasetGraceHours: zod.z.number().nonnegative()
+});
+var TrainingProviderDescriptorSchema = zod.z.object({
+	addonId: zod.z.string(),
+	/** `modal`, `runpod`, `fake`, … */
+	kind: zod.z.string(),
+	label: zod.z.string(),
+	gpuTypes: zod.z.array(TrainingGpuOptionSchema).readonly(),
+	regions: zod.z.array(TrainingRegionOptionSchema).readonly(),
+	maxDatasetBytes: zod.z.number().int().positive(),
+	maxRuntimeSec: zod.z.number().int().positive(),
+	freeTierNote: zod.z.string().optional(),
+	/** Where the data goes, in one sentence the confirm dialog repeats. */
+	dataResidencyNote: zod.z.string(),
+	/** Credentials are present — never the values. */
+	configured: zod.z.boolean(),
+	defaults: TrainingProviderDefaultsSchema
+});
+var TrainingCredentialCheckSchema = zod.z.object({
+	ok: zod.z.boolean(),
+	/** Workspace / account name, when the provider says. */
+	account: zod.z.string().optional(),
+	reason: zod.z.enum([
+		"missing",
+		"invalid",
+		"forbidden",
+		"network",
+		"quota"
+	]).optional(),
+	detail: zod.z.string().optional()
+});
+var ProviderJobStateSchema = zod.z.enum([
+	"pending",
+	"starting",
+	"running",
+	"succeeded",
+	"failed",
+	"cancelled",
+	"lost"
+]);
+var ProviderJobStatusSchema = zod.z.object({
+	jobKey: zod.z.string(),
+	providerJobId: zod.z.string().optional(),
+	state: ProviderJobStateSchema,
+	startedAt: zod.z.number().optional(),
+	endedAt: zod.z.number().optional(),
+	exitCode: zod.z.number().int().optional(),
+	failureReason: zod.z.string().optional(),
+	gpuType: zod.z.string(),
+	region: zod.z.string().optional(),
+	billedSeconds: zod.z.number().nonnegative(),
+	costUsd: zod.z.number().nonnegative(),
+	/** True when `costUsd` is runtime × list price, not a billing answer. */
+	costIsEstimate: zod.z.boolean(),
+	lastFetchedAt: zod.z.number()
+});
+/**
+* The trainer the job runs, by SOURCE revision: the provider turns it into an
+* image its own way (Modal builds the published Dockerfile at that revision;
+* a registry-pull provider maps it to a tag). Recorded on the job and echoed
+* in `result.json`.
+*/
+var TrainerSourceRefSchema = zod.z.object({
+	/** Hugging Face repo id, e.g. `camstack/camstack-trainer`. */
+	repo: zod.z.string().min(1),
+	/** A commit sha (never a branch) — the job must be reproducible. */
+	revision: zod.z.string().regex(/^[0-9a-f]{7,64}$/)
+});
+var JobRef = {
+	addonId: zod.z.string(),
+	jobKey: zod.z.string().uuid()
+};
+var TrainingLogLineSchema = zod.z.object({
+	ts: zod.z.number(),
+	text: zod.z.string()
+});
+var trainingProviderCapability = {
+	name: "training-provider",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		/** Every provider's offer and settings. Concat-fans across providers. */
+		describe: method(zod.z.object({}), zod.z.array(TrainingProviderDescriptorSchema).readonly(), { auth: "admin" }),
+		/** Call the provider with the stored credentials. Never returns them. */
+		validateCredentials: method(zod.z.object({ addonId: zod.z.string() }), TrainingCredentialCheckSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 3e4
+		}),
+		/** USD range for a run of `gpuSeconds` on `gpuType` in `region`. */
+		estimateJob: method(zod.z.object({
+			addonId: zod.z.string(),
+			gpuType: zod.z.string(),
+			region: zod.z.string(),
+			datasetBytes: zod.z.number().int().nonnegative(),
+			gpuSecondsLow: zod.z.number().nonnegative(),
+			gpuSecondsHigh: zod.z.number().nonnegative()
+		}), zod.z.object({
+			usdLow: zod.z.number().nonnegative(),
+			usdHigh: zod.z.number().nonnegative(),
+			notes: zod.z.array(zod.z.string()).readonly()
+		}), { auth: "admin" }),
+		/**
+		* Take the dataset archive behind `ticket` (minted by pipeline-analytics,
+		* same host) and land it as the job's dataset in the cloud, streamed —
+		* nothing is staged on the hub's disk. Idempotent per `jobKey`: a second
+		* call replaces a partial upload. Answers what actually landed.
+		*/
+		uploadDataset: method(zod.z.object({
+			...JobRef,
+			ticket: PeerBytesTicketSchema
+		}), zod.z.object({
+			bytes: zod.z.number().int().nonnegative(),
+			sha256: zod.z.string()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 120 * 6e4
+		}),
+		/**
+		* Start the trainer on a GPU. Looks the job up by `jobKey` first, so a
+		* retried submit never starts a second GPU. `jobSpecJson` is written next
+		* to the dataset as `job.json`; `maxRuntimeSec` is enforced by the
+		* provider (a hard timeout), not by the hub.
+		*/
+		submitJob: method(zod.z.object({
+			...JobRef,
+			trainer: TrainerSourceRefSchema,
+			jobSpecJson: zod.z.string().min(2).max(64e3),
+			gpuType: zod.z.string(),
+			region: zod.z.string(),
+			maxRuntimeSec: zod.z.number().int().positive()
+		}), ProviderJobStatusSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 30 * 6e4
+		}),
+		getJob: method(zod.z.object(JobRef), ProviderJobStatusSchema, {
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/** Stdout/stderr since `cursor` (opaque), oldest first, at most `max` lines. */
+		listJobEvents: method(zod.z.object({
+			...JobRef,
+			cursor: zod.z.string().optional(),
+			max: zod.z.number().int().min(1).max(500)
+		}), zod.z.object({
+			lines: zod.z.array(TrainingLogLineSchema).readonly(),
+			cursor: zod.z.string()
+		}), {
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/** Stop the job. Idempotent: an unknown or finished job is a no-op. */
+		cancelJob: method(zod.z.object(JobRef), zod.z.object({ ok: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/** The job's `result.json`, as text (small, JSON). `found: false` before it exists. */
+		readResult: method(zod.z.object(JobRef), zod.z.object({
+			found: zod.z.boolean(),
+			text: zod.z.string().optional()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 5 * 6e4
+		}),
+		/**
+		* Offer one output file of the job (`bundle.tar`) to the caller as a
+		* one-shot `ctx.peerBytes` ticket, streamed from the cloud — the provider
+		* stages nothing on disk. The caller dials it at once.
+		*/
+		offerArtifact: method(zod.z.object({
+			...JobRef,
+			path: zod.z.enum(["bundle.tar"])
+		}), zod.z.object({ ticket: PeerBytesTicketSchema }), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 5 * 6e4
+		}),
+		/** Delete every cloud object tagged with `jobKey` (the dataset first). Idempotent. */
+		cleanupJob: method(zod.z.object(JobRef), zod.z.object({ deleted: zod.z.array(zod.z.string()).readonly() }), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 5 * 6e4
+		}),
+		/** Every job the provider can still see — the orphan sweep diffs it against our records. */
+		listJobs: method(zod.z.object({ addonId: zod.z.string() }), zod.z.array(ProviderJobStatusSchema).readonly(), {
+			auth: "admin",
+			timeoutMs: 2 * 6e4
+		})
+	}
+};
+/**
+* `training` — the cloud-training orchestrator (D805). Hub-only singleton,
+* provided by `addon-training`.
+*
+* It owns what every provider must agree on, written once:
+*
+* - **Dataset versions.** Taken over from pipeline-analytics (D796): the rows
+*   live here (D808); pipeline-analytics still CUTS a version (it owns the corpus and
+*   the export plan) and reaches this store through the five row methods
+*   below, so the Retrain page and the export did not change.
+* - **Jobs.** A persisted state machine, a reconcile loop against the
+*   provider, a cost guard, a daily orphan sweep and the retention rules.
+* - **The return flow.** Verified artefacts → Model Studio
+*   (`custom-model-registry.importModelBundle`) → canary on cameras →
+*   rollback. Nothing is ever registered automatically.
+*
+* Every method is `admin`.
+*/
+/** A version WITH its frame list — what the export and a job read. */
+var TrainingDatasetVersionRowSchema = RetrainDatasetVersionSchema.omit({ frameCount: true }).extend({ frameIds: zod.z.array(zod.z.string()).max(2e4).readonly() });
+/** A base model a detector job can fine-tune, and the baseline it is judged against. */
+var TrainingBaseModelSchema = zod.z.object({
+	modelId: zod.z.string(),
+	label: zod.z.string(),
+	weights: zod.z.string(),
+	imgsz: zod.z.number().int(),
+	baselineOnnxUrl: zod.z.string(),
+	baselineFloors: zod.z.record(zod.z.string(), zod.z.number()),
+	/** The base the fleet runs most — the UI's default. */
+	recommended: zod.z.boolean()
+});
+var TrainingPresetSchema = zod.z.enum([
+	"quick",
+	"standard",
+	"thorough"
+]);
+var TrainingJobRequestSchema = zod.z.object({
+	datasetVersionId: zod.z.string().min(1),
+	/** The `training-provider` addon that runs it. */
+	addonId: zod.z.string().min(1),
+	gpuType: zod.z.string().min(1),
+	region: zod.z.string(),
+	baseModelId: zod.z.string().min(1),
+	preset: TrainingPresetSchema,
+	/** Freeze the backbone's first N layers; `null` = the preset's choice. */
+	freeze: zod.z.number().int().nonnegative().nullable(),
+	/** Cameras held out whole for evaluation; `null` = the orchestrator's default. */
+	holdoutCameras: zod.z.array(zod.z.number().int()).nullable()
+});
+var TrainingSplitPlanSchema = zod.z.object({
+	holdoutCameras: zod.z.array(zod.z.number().int()).readonly(),
+	/** Used when no camera is held out: the last N days of every camera. */
+	holdoutLastDays: zod.z.number().int().nonnegative(),
+	/** Holdout subjects per class (camera holdout only; `null` = known only after the split). */
+	holdoutSupport: zod.z.record(zod.z.string(), zod.z.number().int()).nullable(),
+	trainSubjects: zod.z.number().int()
+});
+var TrainingRefusalReasonSchema = zod.z.enum([
+	"unknown-dataset",
+	"unknown-provider",
+	"provider-not-configured",
+	"unknown-base-model",
+	"unknown-gpu",
+	"dataset-too-large",
+	"no-training-subjects",
+	"job-already-running"
+]);
+var TrainingJobPlanSchema = zod.z.object({
+	refusal: zod.z.object({
+		reason: TrainingRefusalReasonSchema,
+		detail: zod.z.string()
+	}).nullable(),
+	warnings: zod.z.array(zod.z.string()).readonly(),
+	split: TrainingSplitPlanSchema.nullable(),
+	estimate: zod.z.object({
+		datasetBytes: zod.z.number().int(),
+		uploadMinutesAt20Mbps: zod.z.number(),
+		gpuSecondsLow: zod.z.number(),
+		gpuSecondsHigh: zod.z.number(),
+		usdLow: zod.z.number(),
+		usdHigh: zod.z.number(),
+		notes: zod.z.array(zod.z.string()).readonly()
+	}).nullable(),
+	/** Pre-filled from the provider's settings; the operator may lower or raise them. */
+	defaults: zod.z.object({
+		maxCostUsd: zod.z.number(),
+		maxRuntimeSec: zod.z.number().int()
+	}).nullable(),
+	/** The sentence the confirm dialog repeats: where the frames go and when they are deleted. */
+	dataNotice: zod.z.string()
+});
+/**
+* Orchestrator-owned states, persisted. `uploading` covers exporting the
+* archive (it is streamed, never staged). Terminal: `failed`, `cancelled`,
+* `lost`, `expired`, `discarded`. `registered` and `canary` are where a
+* result lives after the operator acted on it.
+*/
+var TrainingJobStateSchema = zod.z.enum([
+	"uploading",
+	"submitted",
+	"starting",
+	"running",
+	"collecting",
+	"ready",
+	"registered",
+	"canary",
+	"failed",
+	"cancelling",
+	"cancelled",
+	"lost",
+	"expired",
+	"discarded"
+]);
+var TrainingFailureReasonSchema = zod.z.enum([
+	"cost-cap",
+	"runtime-cap",
+	"upload-failed",
+	"submit-failed",
+	"trainer-failed",
+	"result-invalid",
+	"checksum-mismatch",
+	"fetch-failed",
+	"provider-error",
+	"hub-restart-during-upload"
+]);
+var TrainingProgressPointSchema = zod.z.object({
+	epoch: zod.z.number().int(),
+	map50: zod.z.number().nullable(),
+	map50_95: zod.z.number().nullable()
+});
+var TrainingCanarySchema = zod.z.object({
+	deviceIds: zod.z.array(zod.z.number().int()).readonly(),
+	since: zod.z.number(),
+	/** Every override the canary replaced, exactly, so rollback restores it. */
+	previous: zod.z.array(zod.z.object({
+		deviceId: zod.z.number().int(),
+		nodeId: zod.z.string(),
+		deviceKey: zod.z.string(),
+		patch: zod.z.object({
+			modelId: zod.z.string().optional(),
+			settings: zod.z.record(zod.z.string(), zod.z.unknown()).readonly().optional()
+		}).nullable()
+	})).readonly()
+});
+var TrainingJobSchema = zod.z.object({
+	id: zod.z.string(),
+	idempotencyKey: zod.z.string(),
+	name: zod.z.string(),
+	createdAt: zod.z.number(),
+	updatedAt: zod.z.number(),
+	state: TrainingJobStateSchema,
+	stage: TrainingStageSchema.nullable(),
+	failure: zod.z.object({
+		reason: TrainingFailureReasonSchema,
+		stage: zod.z.string().nullable(),
+		detail: zod.z.string()
+	}).nullable(),
+	request: TrainingJobRequestSchema,
+	maxCostUsd: zod.z.number().nonnegative(),
+	maxRuntimeSec: zod.z.number().int().positive(),
+	trainer: TrainerSourceRefSchema,
+	datasetLayout: RetrainExportLayoutSchema,
+	dataset: zod.z.object({
+		bytes: zod.z.number().int(),
+		sha256: zod.z.string(),
+		uploadedAt: zod.z.number()
+	}).nullable(),
+	split: TrainingSplitPlanSchema,
+	provider: zod.z.object({
+		state: ProviderJobStateSchema.nullable(),
+		providerJobId: zod.z.string().nullable(),
+		startedAt: zod.z.number().nullable(),
+		endedAt: zod.z.number().nullable(),
+		billedSeconds: zod.z.number(),
+		costUsd: zod.z.number(),
+		costIsEstimate: zod.z.boolean(),
+		lastPolledAt: zod.z.number().nullable()
+	}),
+	progress: zod.z.object({
+		epoch: zod.z.number().int().nullable(),
+		epochs: zod.z.number().int().nullable(),
+		etaSec: zod.z.number().nullable(),
+		series: zod.z.array(TrainingProgressPointSchema).readonly()
+	}),
+	/** The last lines of the job's output (≤ 200), newest last. Never frame paths. */
+	logTail: zod.z.array(zod.z.string()).readonly(),
+	logCursor: zod.z.string().nullable(),
+	artifacts: zod.z.object({
+		bundleBytes: zod.z.number().int(),
+		bundleSha256: zod.z.string(),
+		fetchedAt: zod.z.number(),
+		/** When the staged artefacts are deleted from the hub. */
+		expiresAt: zod.z.number()
+	}).nullable(),
+	/** When the provider-side copy of the frames was deleted; null while it exists. */
+	cloudDatasetDeletedAt: zod.z.number().nullable(),
+	/** A failed job's dataset is kept until then (the provider's grace), then deleted. */
+	cloudCleanupDueAt: zod.z.number().nullable(),
+	/** Model ids registered from this job (base, and int8 when kept). */
+	registeredModelIds: zod.z.array(zod.z.string()).readonly(),
+	canary: TrainingCanarySchema.nullable()
+});
+var IdInput = zod.z.object({ id: zod.z.string().min(1) });
+var trainingCapability = {
+	name: "training",
+	scope: "system",
+	mode: "singleton",
+	mount: { kind: "hub-only" },
+	methods: {
+		/** Store a version once. `stored: false` = that id already exists (immutable). */
+		putDatasetVersion: method(TrainingDatasetVersionRowSchema, zod.z.object({ stored: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getDatasetVersion: method(IdInput, TrainingDatasetVersionRowSchema.nullable(), { auth: "admin" }),
+		/** Every version without its frame list, newest first. */
+		listDatasetVersions: method(zod.z.object({}), zod.z.array(RetrainDatasetVersionSchema).readonly(), { auth: "admin" }),
+		findDatasetVersionIdByName: method(zod.z.object({ name: zod.z.string() }), zod.z.object({ id: zod.z.string().nullable() }), { auth: "admin" }),
+		removeDatasetVersion: method(IdInput, zod.z.object({ removed: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		listBaseModels: method(zod.z.object({}), zod.z.array(TrainingBaseModelSchema).readonly(), { auth: "admin" }),
+		/** Split, estimate, defaults and any named refusal — nothing is started. */
+		planJob: method(TrainingJobRequestSchema, TrainingJobPlanSchema, {
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/**
+		* Start a job. The same `idempotencyKey` returns the job it already
+		* started. Answers at once (`uploading`); the upload and the submit run in
+		* the background and the job record says how far they got.
+		*/
+		startJob: method(TrainingJobRequestSchema.extend({
+			name: zod.z.string().min(1).max(120),
+			maxCostUsd: zod.z.number().positive(),
+			maxRuntimeSec: zod.z.number().int().positive(),
+			idempotencyKey: zod.z.string().min(8).max(80)
+		}), zod.z.discriminatedUnion("kind", [zod.z.object({
+			kind: zod.z.literal("started"),
+			job: TrainingJobSchema
+		}), zod.z.object({
+			kind: zod.z.literal("refused"),
+			reason: TrainingRefusalReasonSchema,
+			detail: zod.z.string()
+		})]), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		listJobs: method(zod.z.object({}), zod.z.array(TrainingJobSchema).readonly(), { auth: "admin" }),
+		getJob: method(IdInput, TrainingJobSchema.nullable(), { auth: "admin" }),
+		cancelJob: method(IdInput, TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		/** The verified `result.json` of a job in `ready` or later; null before. */
+		getJobResult: method(IdInput, TrainingResultSchema.nullable(), { auth: "admin" }),
+		/** Hand the verified bundle to Model Studio; optionally canary right after. */
+		registerResult: method(IdInput.extend({ canaryDeviceIds: zod.z.array(zod.z.number().int()).readonly() }), TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 30 * 6e4
+		}),
+		/** Pin the registered model on these cameras, remembering what it replaced. */
+		canaryResult: method(IdInput.extend({ deviceIds: zod.z.array(zod.z.number().int()).min(1).readonly() }), TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		/** Put every canary camera back exactly as it was. */
+		rollbackCanary: method(IdInput, TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		/** Delete the staged artefacts of an unregistered result. */
+		discardResult: method(IdInput, TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
 function isValueOf(slot, value) {
 	return value.slot === slot;
 }
@@ -50371,6 +51731,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"backup.checkBackupKey": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"backup.delete": {
 		capName: "backup",
 		capScope: "system",
@@ -50383,6 +51749,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"backup.disableEncryption": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"backup.getEncryption": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"backup.getEntries": {
 		capName: "backup",
 		capScope: "system",
@@ -50437,6 +51815,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"backup.setupEncryption": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"backup.trigger": {
 		capName: "backup",
 		capScope: "system",
@@ -50989,6 +52373,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"customModelRegistry.importModelBundle": {
+		capName: "custom-model-registry",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"customModelRegistry.listModels": {
 		capName: "custom-model-registry",
 		capScope: "system",
@@ -52429,6 +53819,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"keychainAdmin.acknowledgeReset": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"keychainAdmin.deleteOrphans": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -52465,6 +53861,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"keychainAdmin.resetReport": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"keychainAdmin.reveal": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -54211,6 +55613,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.offerRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.ownersWithMedia": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -56749,6 +58157,174 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"training.canaryResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.cancelJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.discardResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.findDatasetVersionIdByName": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.getDatasetVersion": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.getJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.getJobResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.listBaseModels": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.listDatasetVersions": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.listJobs": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.planJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.putDatasetVersion": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.registerResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.removeDatasetVersion": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"training.rollbackCanary": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.startJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.cancelJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.cleanupJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.describe": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.estimateJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.getJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.listJobEvents": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.listJobs": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.offerArtifact": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.readResult": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.submitJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.uploadDataset": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.validateCredentials": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"turnProvider.getTurnServers": {
 		capName: "turn-provider",
 		capScope: "system",
@@ -56773,12 +58349,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"userManagement.createApiKey": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"userManagement.createScopedToken": {
 		capName: "user-management",
 		capScope: "system",
@@ -56815,12 +58385,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.linkExternalIdentity": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
@@ -56923,12 +58487,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"userManagement.validateApiKey": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.validateCredentials": {
 		capName: "user-management",
 		capScope: "system",
@@ -58921,6 +60479,8 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	temperatureSensorCapability,
 	terminalSessionCapability,
 	toastCapability,
+	trainingCapability,
+	trainingProviderCapability,
 	turnProviderCapability,
 	updateCapability,
 	userManagementCapability,
@@ -61299,6 +62859,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"training.canaryResult": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"update.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -62936,7 +64501,12 @@ var CREDENTIAL_PARAM_PATTERNS = [
 	/^bearer$/i,
 	/^api[_-]?key$/i,
 	/^access[_-]?token$/i,
-	/^refresh[_-]?token$/i
+	/^refresh[_-]?token$/i,
+	/^bridge$/i,
+	/^code$/i,
+	/^state$/i,
+	/^challenge$/i,
+	/^link$/i
 ];
 function isCredentialParam(name) {
 	return CREDENTIAL_PARAM_PATTERNS.some((re) => re.test(name));
@@ -62958,6 +64528,10 @@ function isCredentialParam(name) {
 * are NOT masked (those are entity references, not credentials).
 */
 function maskUrlCredentials(rawUrl) {
+	if (rawUrl.startsWith("/") && !rawUrl.startsWith("//")) {
+		const masked = maskUrlCredentials(`http://relative.invalid${rawUrl}`);
+		return masked.startsWith("http://relative.invalid") ? masked.slice(23) : rawUrl;
+	}
 	try {
 		const u = new URL(rawUrl);
 		let touched = false;
@@ -63313,6 +64887,12 @@ Object.defineProperty(exports, "HF_REPO", {
 		return HF_REPO;
 	}
 });
+Object.defineProperty(exports, "KEYCHAIN_RESET_TRIGGER_ACTOR", {
+	enumerable: true,
+	get: function() {
+		return KEYCHAIN_RESET_TRIGGER_ACTOR;
+	}
+});
 Object.defineProperty(exports, "LOG_LEVEL_RANK", {
 	enumerable: true,
 	get: function() {
@@ -63679,6 +65259,12 @@ Object.defineProperty(exports, "createStatefulExpressionMemory", {
 		return createStatefulExpressionMemory;
 	}
 });
+Object.defineProperty(exports, "customAction", {
+	enumerable: true,
+	get: function() {
+		return customAction;
+	}
+});
 Object.defineProperty(exports, "dataStoreProviderCapability", {
 	enumerable: true,
 	get: function() {
@@ -63703,6 +65289,12 @@ Object.defineProperty(exports, "decodeVectorBase64", {
 		return decodeVectorBase64;
 	}
 });
+Object.defineProperty(exports, "defineCustomActions", {
+	enumerable: true,
+	get: function() {
+		return defineCustomActions;
+	}
+});
 Object.defineProperty(exports, "defineExtensionSlotProvider", {
 	enumerable: true,
 	get: function() {
@@ -64009,6 +65601,12 @@ Object.defineProperty(exports, "looseSchema", {
 		return looseSchema;
 	}
 });
+Object.defineProperty(exports, "makeSecretMarker", {
+	enumerable: true,
+	get: function() {
+		return makeSecretMarker;
+	}
+});
 Object.defineProperty(exports, "maskUrlCredentials", {
 	enumerable: true,
 	get: function() {