@camstack/types 1.2.331 → 1.2.333

package/dist/index.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-ClNXPpWR.js");
+const require_sleep = require("./sleep-DiQYrfm9.js");
 const require_event_category = require("./event-category-CHduMGvg.js");
 const require_composition = require("./composition-BLWAivB2.js");
 const require_err_msg = require("./err-msg-Dx2Kor0g.js");
@@ -1632,6 +1632,298 @@ function composeSwitchedOff(input) {
 	};
 }
 //#endregion
+//#region src/training/trainer-contract.ts
+/**
+* The trainer contract — what the hub hands the cloud trainer and what it
+* gets back (cloud training, D805+).
+*
+* The trainer (`hf/camstack-trainer`, published as the Hugging Face repo
+* `camstack/camstack-trainer`) is a separate AGPL program the hub never
+* imports: `job.json` goes in, files come out, and progress is `CAMSTACK_EVENT`
+* lines on stdout. These schemas are the hub's half of that boundary; the
+* trainer's pydantic models (and the JSON Schemas generated from them under
+* `hf/camstack-trainer/schemas/`) are the other half. A change here is a
+* change there, in the same piece of work.
+*
+* No `.default()` anywhere: defaults do not run on the addon cap path, so the
+* orchestrator fills every field of a job spec explicitly.
+*/
+var TRAINING_JOB_SCHEMA = "camstack.training/v1";
+var TRAINING_RESULT_SCHEMA = "camstack.training-result/v1";
+/** The stdout prefix of a progress line. Anything else on stdout is log text. */
+var CAMSTACK_EVENT_PREFIX = "CAMSTACK_EVENT ";
+/** What the trainer can export. Edge TPU is a later, separate image. */
+var TrainingExportSchema = zod.z.enum([
+	"onnx",
+	"openvino-fp16",
+	"openvino-int8",
+	"coreml-fp16"
+]);
+var FloorsSchema = zod.z.record(zod.z.string(), zod.z.number().min(0).max(1));
+var TrainingJobSpecSchema = zod.z.object({
+	schema: zod.z.literal(TRAINING_JOB_SCHEMA),
+	jobKey: zod.z.string().uuid(),
+	target: zod.z.object({
+		kind: zod.z.literal("detector"),
+		step: zod.z.literal("object-detection")
+	}),
+	base: zod.z.object({
+		modelId: zod.z.string().min(1),
+		/** Ultralytics weights id, e.g. `yolov9m.pt`. */
+		weights: zod.z.string().min(1),
+		imgsz: zod.z.number().int().positive()
+	}),
+	baseline: zod.z.object({
+		modelId: zod.z.string().min(1),
+		/** The baseline ONNX the holdout comparison runs; public mirror URL. */
+		onnxUrl: zod.z.string().url(),
+		imgsz: zod.z.number().int().positive(),
+		floors: FloorsSchema
+	}),
+	dataset: zod.z.object({
+		versionId: zod.z.string().min(1),
+		annotationHash: zod.z.string(),
+		/** sha256 of the uploaded archive; the trainer refuses a mismatch (exit 65). */
+		sha256: zod.z.string().regex(/^[0-9a-f]{64}$/)
+	}),
+	split: zod.z.object({
+		holdoutCameras: zod.z.array(zod.z.number().int()),
+		/** When no camera is held out: the last N days of every camera. */
+		holdoutLastDays: zod.z.number().int().nonnegative(),
+		valFraction: zod.z.number().min(0).max(.5),
+		seed: zod.z.number().int()
+	}),
+	hyper: zod.z.object({
+		epochs: zod.z.number().int().positive(),
+		batch: zod.z.number().int().positive(),
+		lr0: zod.z.number().positive(),
+		/** Layers frozen from the start of the backbone; 0 = none. */
+		freeze: zod.z.number().int().nonnegative(),
+		patience: zod.z.number().int().nonnegative(),
+		seed: zod.z.number().int()
+	}),
+	replay: zod.z.object({
+		source: zod.z.literal("coco2017"),
+		count: zod.z.number().int().nonnegative()
+	}),
+	exports: zod.z.array(TrainingExportSchema).min(1),
+	calibration: zod.z.object({ maxFrames: zod.z.number().int().positive() }),
+	floors: zod.z.object({
+		minSupport: zod.z.number().int().positive(),
+		clamp: zod.z.number().min(0).max(1)
+	}),
+	int8Gate: zod.z.object({ maxMap50Drop: zod.z.number().min(0).max(1) }),
+	catalog: zod.z.object({
+		id: zod.z.string().regex(/^[a-z0-9][a-z0-9-]{2,80}$/),
+		name: zod.z.string().min(1).max(160)
+	})
+});
+/** One regular file of the bundle. An mlpackage contributes one row per member. */
+var TrainingResultFileSchema = zod.z.object({
+	path: zod.z.string().min(1),
+	bytes: zod.z.number().int().nonnegative(),
+	sha256: zod.z.string().regex(/^[0-9a-f]{64}$/),
+	format: zod.z.enum([
+		"onnx",
+		"openvino",
+		"coreml",
+		"pt"
+	]),
+	variant: zod.z.enum(["base", "int8"])
+});
+var DraftFormatSchema = zod.z.object({
+	/** RELATIVE path inside the bundle; the hub rewrites it to `camstack-local://`. */
+	url: zod.z.string().min(1),
+	sizeMB: zod.z.number().nonnegative(),
+	isDirectory: zod.z.boolean().optional(),
+	files: zod.z.array(zod.z.string()).optional(),
+	runtimes: zod.z.array(zod.z.literal("python")).optional(),
+	revision: zod.z.string().min(1)
+});
+/** The trainer's half of a catalog entry; the hub completes it (labels, licence, group). */
+var TrainingCatalogDraftSchema = zod.z.object({
+	id: zod.z.string().min(1),
+	name: zod.z.string().min(1),
+	description: zod.z.string(),
+	labels: zod.z.array(zod.z.unknown()),
+	inputSize: zod.z.object({
+		width: zod.z.number().int().positive(),
+		height: zod.z.number().int().positive()
+	}),
+	preprocessMode: zod.z.literal("letterbox"),
+	defaultClassFloors: FloorsSchema,
+	formats: zod.z.object({
+		onnx: DraftFormatSchema.optional(),
+		openvino: DraftFormatSchema.optional(),
+		coreml: DraftFormatSchema.optional()
+	})
+});
+/** One class of one model's holdout report (the eval harness's summary). */
+var TrainingEvalClassSchema = zod.z.object({
+	positives: zod.z.number().int(),
+	floor: zod.z.number().nullable(),
+	tp: zod.z.number().int(),
+	fp: zod.z.number().int(),
+	fn: zod.z.number().int(),
+	precision: zod.z.number().nullable(),
+	recall: zod.z.number().nullable(),
+	ap50: zod.z.number().nullable(),
+	recallByCamera: zod.z.record(zod.z.string(), zod.z.number().nullable()).optional(),
+	recallByLight: zod.z.record(zod.z.string(), zod.z.number().nullable()).optional(),
+	fpByCamera: zod.z.record(zod.z.string(), zod.z.number()).optional(),
+	smallFound: zod.z.number().int().optional(),
+	smallTotal: zod.z.number().int().optional()
+}).passthrough();
+var TrainingEvalReportSchema = zod.z.object({
+	frames: zod.z.number().int(),
+	classes: zod.z.record(zod.z.string(), TrainingEvalClassSchema)
+}).passthrough();
+/**
+* A succeeded result carries every block; a failed one carries the error and
+* whatever was known by then — the other blocks are ABSENT, not null. The
+* orchestrator checks the blocks it needs before it trusts a success.
+*/
+var TrainingResultSchema = zod.z.object({
+	schema: zod.z.literal(TRAINING_RESULT_SCHEMA),
+	jobKey: zod.z.string(),
+	status: zod.z.enum(["succeeded", "failed"]),
+	error: zod.z.object({
+		stage: zod.z.string(),
+		code: zod.z.string(),
+		message: zod.z.string()
+	}).nullable(),
+	trainer: zod.z.object({
+		version: zod.z.string(),
+		revision: zod.z.string()
+	}),
+	toolchain: zod.z.record(zod.z.string(), zod.z.string().nullable()),
+	dataset: zod.z.object({
+		versionId: zod.z.string(),
+		annotationHash: zod.z.string(),
+		sha256: zod.z.string(),
+		frames: zod.z.object({
+			train: zod.z.number().int(),
+			val: zod.z.number().int(),
+			holdout: zod.z.number().int()
+		}),
+		holdoutCameras: zod.z.array(zod.z.number().int()),
+		replayImages: zod.z.number().int()
+	}).optional(),
+	training: zod.z.object({
+		epochsRun: zod.z.number().int(),
+		bestEpoch: zod.z.number().int(),
+		bestMap50: zod.z.number(),
+		bestMap50_95: zod.z.number(),
+		seconds: zod.z.number()
+	}).optional(),
+	evaluation: zod.z.object({
+		holdoutFrames: zod.z.number().int(),
+		baseline: TrainingEvalReportSchema.nullable(),
+		candidate: TrainingEvalReportSchema.nullable(),
+		candidateInt8: TrainingEvalReportSchema.nullable(),
+		recallDeltaByCamera: zod.z.record(zod.z.string(), zod.z.record(zod.z.string(), zod.z.number())).nullable(),
+		map50: zod.z.record(zod.z.string(), zod.z.number().nullable())
+	}).optional(),
+	floors: zod.z.object({
+		baseline: FloorsSchema,
+		candidate: FloorsSchema,
+		candidateInt8: FloorsSchema.nullable(),
+		notes: zod.z.array(zod.z.string())
+	}).optional(),
+	int8: zod.z.object({
+		kept: zod.z.boolean(),
+		map50Fp16: zod.z.number().nullable(),
+		map50Int8: zod.z.number().nullable(),
+		reason: zod.z.string().nullable()
+	}).optional(),
+	exportsDropped: zod.z.array(zod.z.object({
+		export: zod.z.string(),
+		reason: zod.z.string()
+	})).optional(),
+	files: zod.z.array(TrainingResultFileSchema).optional(),
+	bundle: zod.z.object({
+		path: zod.z.literal("bundle.tar"),
+		bytes: zod.z.number().int().nonnegative(),
+		sha256: zod.z.string().regex(/^[0-9a-f]{64}$/)
+	}).nullable().optional(),
+	catalogDraft: zod.z.object({
+		base: TrainingCatalogDraftSchema,
+		int8: TrainingCatalogDraftSchema.nullable()
+	}).nullable().optional(),
+	licence: zod.z.string()
+});
+var TrainingStageSchema = zod.z.enum([
+	"prepare",
+	"replay",
+	"train",
+	"eval",
+	"export",
+	"package"
+]);
+var EventBase = {
+	v: zod.z.literal(1),
+	ts: zod.z.number()
+};
+var TrainingEventSchema = zod.z.discriminatedUnion("type", [
+	zod.z.object({
+		...EventBase,
+		type: zod.z.literal("stage"),
+		stage: TrainingStageSchema
+	}),
+	zod.z.object({
+		...EventBase,
+		type: zod.z.literal("epoch"),
+		epoch: zod.z.number().int(),
+		epochs: zod.z.number().int(),
+		boxLoss: zod.z.number().nullable().optional(),
+		map50: zod.z.number().nullable().optional(),
+		map50_95: zod.z.number().nullable().optional(),
+		etaSec: zod.z.number().nullable().optional()
+	}),
+	zod.z.object({
+		...EventBase,
+		type: zod.z.literal("metric"),
+		name: zod.z.string(),
+		value: zod.z.number()
+	}),
+	zod.z.object({
+		...EventBase,
+		type: zod.z.literal("artifact"),
+		path: zod.z.string(),
+		bytes: zod.z.number(),
+		sha256: zod.z.string()
+	}),
+	zod.z.object({
+		...EventBase,
+		type: zod.z.literal("done"),
+		status: zod.z.enum(["succeeded", "failed"]),
+		resultSha256: zod.z.string().nullable().optional()
+	}),
+	zod.z.object({
+		...EventBase,
+		type: zod.z.literal("error"),
+		stage: zod.z.string(),
+		code: zod.z.string(),
+		message: zod.z.string()
+	})
+]);
+/**
+* Parse one stdout line. `null` = not an event (plain log text, or an event
+* line this hub does not understand — a newer trainer may add types).
+*/
+function parseTrainingEventLine(line) {
+	const start = line.indexOf(CAMSTACK_EVENT_PREFIX);
+	if (start < 0) return null;
+	let raw;
+	try {
+		raw = JSON.parse(line.slice(start + 15));
+	} catch {
+		return null;
+	}
+	const parsed = TrainingEventSchema.safeParse(raw);
+	return parsed.success ? parsed.data : null;
+}
+//#endregion
 //#region src/interfaces/birth-decision-ledger.ts
 /**
 * Birth-decision ledger — one durable row per track-birth VERDICT (D409).
@@ -6110,6 +6402,62 @@ function principalMayReachAddon(input) {
 	};
 }
 //#endregion
+//#region src/auth/app-callback.ts
+/**
+* The viewer app's custom-scheme callback — the ONE list of URLs a hub flow
+* may hand a browser back to the native app at.
+*
+* Two readers, one answer: the admin-ui login page (`redirect=` for the
+* native sign-in handoff) and the hub itself (`auth.beginExternalLink`'s
+* `returnTo` for a native account link, D801). Both validate against this
+* list, so a scheme added for one flow can never be accepted by one side and
+* refused by the other.
+*
+* `camstack` is the production app; `camstack.dev` the dev client
+* (`APP_VARIANT=development`). Exact match after canonicalisation — no
+* query or fragment riders, no http(s).
+*/
+var APP_AUTH_CALLBACK_URLS = ["camstack://auth-callback", "camstack.dev://auth-callback"];
+/** Longest raw callback value considered at all. */
+var APP_AUTH_CALLBACK_MAX_LENGTH = 512;
+/**
+* The variants the OS / linking layer produces for the same callback:
+* `scheme:///auth-callback` (expo-linking's empty-host standalone form — three
+* slashes) and a trailing `/` both mean `scheme://auth-callback`. Nothing else
+* is normalised: riders keep failing the exact match.
+*/
+function canonicalizeAppCallback(raw) {
+	return raw.replace(/^([a-z][a-z0-9.+-]*):\/\/\/(?!\/)/i, "$1://").replace(/\/$/, "");
+}
+/** The canonical allowlisted callback `raw` names, or `null`. */
+function parseAppAuthCallback(raw) {
+	if (typeof raw !== "string" || raw.length === 0 || raw.length > 512) return null;
+	const canonical = canonicalizeAppCallback(raw);
+	return APP_AUTH_CALLBACK_URLS.includes(canonical) ? canonical : null;
+}
+/** True for a URL with a scheme (`camstack://…`, `https://…`) — not a hub-relative path. */
+function hasUrlScheme(url) {
+	return /^[a-z][a-z0-9+.-]*:/i.test(url);
+}
+//#endregion
+//#region src/auth/sso-state.ts
+/**
+* The cookie that binds an SSO sign-in to the browser that started it.
+*
+* An IdP `/start` sets it to a random value and keeps only its SHA-256 in the
+* server-side pending state; the login bridge carries that hash. The hub's
+* `/api/auth/sso/finish` swaps a bridge for a session only when the request
+* presents the cookie whose hash the bridge names — so a bridge copied out of
+* a URL (history, a proxy log, a screenshot) is useless in any other browser.
+* The finish clears the cookie, and records the bridge's `jti` so the same
+* bridge never finishes twice.
+*
+* One name, two readers (the OIDC addon that sets it, the hub that checks it).
+*/
+var SSO_STATE_COOKIE = "camstack_sso_state";
+/** Seconds the state cookie lives — the pending IdP state lasts 5 minutes, the bridge 5 more. */
+var SSO_STATE_COOKIE_MAX_AGE_SEC = 600;
+//#endregion
 //#region src/expression/binding-source.ts
 /**
 * What an expression's named bindings READ from.
@@ -6933,7 +7281,9 @@ var AddonHttpRouteSchema = zod.z.object({
 		"authenticated",
 		"admin"
 	]).optional(),
-	description: zod.z.string().optional()
+	description: zod.z.string().optional(),
+	/** The hub limits this route per client address before the handler runs. */
+	rateLimit: zod.z.enum(["auth"]).optional()
 });
 /**
 * Cross-process route invocation envelope. The hub captures the
@@ -7960,6 +8310,37 @@ var BackupDestinationInfoSchema = zod.z.object({
 	lastError: zod.z.string().optional()
 });
 /**
+* How an archive is encrypted (operator decision 2026-10-09): to a backup
+* PUBLIC key the hub holds, so only the operator's secret key opens it.
+* Absent on a plain `.tar.gz` — every archive made before encryption, or
+* with it off — which restores without a key.
+*/
+var BackupArchiveEncryptionSchema = zod.z.object({
+	/** `x25519-hkdf-aes256gcm-stream-v1`. */
+	scheme: zod.z.string(),
+	/** 16 hex — the backup key whose secret restores this archive. */
+	keyId: zod.z.string()
+});
+/**
+* The backup encryption setting. The hub keeps PUBLIC keys only: the active
+* one new archives are encrypted to, and the retired ones older archives
+* still need. The secret key is shown once, at `setupEncryption`.
+*/
+var BackupEncryptionStatusSchema = zod.z.object({
+	enabled: zod.z.boolean(),
+	active: zod.z.object({
+		keyId: zod.z.string(),
+		publicKey: zod.z.string(),
+		createdAt: zod.z.number()
+	}).nullable(),
+	/** Every key ever set up, newest first. */
+	keys: zod.z.array(zod.z.object({
+		keyId: zod.z.string(),
+		createdAt: zod.z.number(),
+		retiredAt: zod.z.number().nullable()
+	})).readonly()
+});
+/**
 * Per-archive entry returned by `backup.listArchives({ destinationId })`.
 * Same shape the destination drill-in renders. Sourced from the per-
 * location `manifests.json` (no per-archive tarball read required).
@@ -7971,7 +8352,9 @@ var BackupArchiveEntrySchema = zod.z.object({
 	sizeBytes: zod.z.number(),
 	label: zod.z.string().optional(),
 	/** Top-level locations included in the archive (db, addons, tls, …). */
-	locations: zod.z.array(zod.z.string()).readonly()
+	locations: zod.z.array(zod.z.string()).readonly(),
+	/** Present when the archive is encrypted; restore then needs that key. */
+	encryption: BackupArchiveEncryptionSchema.optional()
 });
 var BackupEntrySchema = zod.z.object({
 	id: zod.z.string(),
@@ -7980,7 +8363,8 @@ var BackupEntrySchema = zod.z.object({
 	label: zod.z.string().optional(),
 	createdAt: zod.z.number(),
 	sizeBytes: zod.z.number(),
-	locations: zod.z.array(zod.z.string()).optional()
+	locations: zod.z.array(zod.z.string()).optional(),
+	encryption: BackupArchiveEncryptionSchema.optional()
 });
 var ArchiveEntrySchema = zod.z.object({
 	path: zod.z.string(),
@@ -8235,11 +8619,58 @@ var backupCapability = {
 			* this list and skips entries whose path doesn't start with
 			* any of them.
 			*/
-			locations: zod.z.array(zod.z.string()).optional()
+			locations: zod.z.array(zod.z.string()).optional(),
+			/**
+			* The backup SECRET key, for an encrypted archive (ignored for a plain
+			* one). The archive is decrypted into the hub's private staging
+			* before the restart; the key is not stored. A wrong or missing key
+			* is refused before the archive is downloaded.
+			*/
+			backupSecretKey: zod.z.string().optional()
 		}), zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/** The encryption setting — public keys only. */
+		getEncryption: require_sleep.method(zod.z.void(), BackupEncryptionStatusSchema, { auth: "admin" }),
+		/**
+		* Turn encryption on, or replace the key: generates a new key pair, keeps
+		* the PUBLIC key, and returns the SECRET key — once. It is never stored
+		* on the hub and cannot be shown again; archives made from now on need
+		* it to be restored. A previous key is retired: archives made with it
+		* still need IT.
+		*/
+		setupEncryption: require_sleep.method(zod.z.object({}), zod.z.object({
+			keyId: zod.z.string(),
+			secretKey: zod.z.string(),
+			publicKey: zod.z.string(),
+			createdAt: zod.z.number(),
+			replacedKeyId: zod.z.string().nullable()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** New archives are plain again. Existing encrypted archives keep needing their key. */
+		disableEncryption: require_sleep.method(zod.z.object({}), zod.z.object({ disabledKeyId: zod.z.string().nullable() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Does this secret key parse, and which backup key is it? A mutation so
+		* the key never travels in a URL. Nothing is stored.
+		*/
+		checkBackupKey: require_sleep.method(zod.z.object({ backupSecretKey: zod.z.string() }), zod.z.object({
+			valid: zod.z.boolean(),
+			keyId: zod.z.string().nullable(),
+			/** The hub knows this key (active or retired). */
+			known: zod.z.boolean(),
+			/** It is the key new archives are encrypted to. */
+			active: zod.z.boolean(),
+			error: zod.z.string().optional()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		delete: require_sleep.method(zod.z.object({
 			destinationId: zod.z.string(),
 			backupId: zod.z.string()
@@ -11833,22 +12264,87 @@ var CustomModelDescriptorSchema = zod.z.object({
 	stepId: zod.z.string(),
 	entry: ModelCatalogEntrySchema
 });
+/** One regular file of an imported bundle, as the producer measured it. */
+var ModelBundleFileSchema = zod.z.object({
+	/** Relative path inside the bundle tar; an mlpackage member is `<x>.mlpackage/<member>`. */
+	path: zod.z.string().min(1),
+	bytes: zod.z.number().int().nonnegative(),
+	sha256: zod.z.string().regex(/^[0-9a-f]{64}$/)
+});
+var ImportModelBundleInputSchema = zod.z.object({
+	/** The registry provider that keeps the model (Model Studio). */
+	addonId: zod.z.string(),
+	stepId: zod.z.string().min(1),
+	/**
+	* The catalog rows to register, complete, every format URL already
+	* `camstack-local://<modelId>/<file>` naming a file of the bundle. One
+	* bundle may carry several rows (a base and its INT8 variant).
+	*/
+	entries: zod.z.array(ModelCatalogEntrySchema).min(1).max(4),
+	/** The bundle tar, offered by the producer over `ctx.peerBytes` (same host). */
+	bundle: zod.z.object({
+		ticket: require_sleep.PeerBytesTicketSchema,
+		bytes: zod.z.number().int().positive(),
+		sha256: zod.z.string().regex(/^[0-9a-f]{64}$/)
+	}),
+	/** Every file the tar must hold; anything missing, extra or different is refused. */
+	files: zod.z.array(ModelBundleFileSchema).min(1).max(64),
+	/** Convert missing engine formats and push the model to every agent afterwards. */
+	distribute: zod.z.boolean()
+});
+var ImportModelBundleResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("imported"),
+	modelIds: zod.z.array(zod.z.string()).readonly(),
+	distributed: zod.z.array(zod.z.object({
+		modelId: zod.z.string(),
+		nodeId: zod.z.string(),
+		format: zod.z.enum(MODEL_FORMATS),
+		ok: zod.z.boolean(),
+		error: zod.z.string().optional()
+	})).readonly()
+}), zod.z.object({
+	kind: zod.z.literal("refused"),
+	reason: zod.z.enum([
+		"transfer-failed",
+		"checksum-mismatch",
+		"bundle-mismatch",
+		"invalid-entry",
+		"id-taken"
+	]),
+	detail: zod.z.string()
+})]);
 var customModelRegistryCapability = {
 	name: "custom-model-registry",
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { 
-	/**
-	* `internal: true` did not gate the mount (see the 2026-08-26 note on
-	* `data-store-provider`) — this was reachable on the AppRouter by ANY
-	* authenticated session at the default `auth: 'protected'`. The only
-	* consumer, the detection-pipeline's model resolution
-	* (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
-	* `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
-	* never tRPC — so `auth: 'admin'` costs it nothing.
-	*/
-listModels: require_sleep.method(zod.z.void(), zod.z.array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }) }
+	methods: {
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — this was reachable on the AppRouter by ANY
+		* authenticated session at the default `auth: 'protected'`. The only
+		* consumer, the detection-pipeline's model resolution
+		* (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
+		* `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
+		* never tRPC — so `auth: 'admin'` costs it nothing.
+		*/
+		listModels: require_sleep.method(zod.z.void(), zod.z.array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }),
+		/**
+		* Register a model whose files arrive as ONE bundle tar (D806): the tar
+		* is taken over `ctx.peerBytes`, checked against `bundle.sha256` and
+		* every row of `files`, unpacked into the hub's flat modelsDir (directory
+		* formats included), each format's `.revision` record written, the rows
+		* upserted under the operator's name, the hub marked available and —
+		* when asked — engine formats converted and the model distributed. A
+		* model id already registered by another source is refused, never
+		* overwritten.
+		*/
+		importModelBundle: require_sleep.method(ImportModelBundleInputSchema, ImportModelBundleResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 30 * 6e4
+		})
+	}
 };
 //#endregion
 //#region src/capabilities/settings-store.cap.ts
@@ -12665,6 +13161,42 @@ var KeychainKeySourceSchema = zod.z.object({
 	*/
 	sharesBackupWithDatabase: zod.z.boolean()
 });
+/**
+* Who reset the keychain: an operator from System → Secrets (`user:<id>`), or
+* the one-shot `<dataDir>/.keychain/RESET_KEYCHAIN` trigger file at boot
+* (`trigger-file`) — the only way back into a hub whose master key is lost,
+* because a locked keychain leaves no session that could reach the page (D797).
+*/
+var KEYCHAIN_RESET_TRIGGER_ACTOR = "trigger-file";
+/**
+* One keychain reset, as the Secrets page reports it until the operator
+* acknowledges it. Never a value: refs, counts and table names only.
+*/
+var KeychainResetRecordSchema = zod.z.object({
+	id: zod.z.string(),
+	at: zod.z.number(),
+	/** `user:<id>` or {@link KEYCHAIN_RESET_TRIGGER_ACTOR}. */
+	actor: zod.z.string(),
+	/** Why the keychain was locked when it was reset; `null` when it was not locked. */
+	lockedReason: zod.z.string().nullable(),
+	/** Values moved into the archive table (ciphertext under the lost key). */
+	archived: zod.z.number().int(),
+	/** `keychain:secrets-orphaned-<ts>`, or `null` when nothing was stored. */
+	archivedCollection: zod.z.string().nullable(),
+	/**
+	* `keychain:keys-orphaned-<ts>`: the wrapped data keys of the archive, kept
+	* so the archive can still be opened if the lost master key turns up.
+	*/
+	archivedKeysCollection: zod.z.string().nullable(),
+	/**
+	* `system-settings` keys whose marker the reset cleared — the cluster
+	* secret's: a marker left pointing at an archived value would refuse every
+	* agent forever (D797).
+	*/
+	clearedSettingsKeys: zod.z.array(zod.z.string()).readonly(),
+	/** When an operator dismissed the notice on the Secrets page; `null` until then. */
+	acknowledgedAt: zod.z.number().nullable()
+});
 var KeychainStatusSchema = zod.z.object({
 	keychain: KeychainStateSchema,
 	/** The source of the master key in use; `null` while locked. */
@@ -12682,7 +13214,9 @@ var KeychainStatusSchema = zod.z.object({
 	/** Wrapped copies of the data key under a previous master key, kept until purged. */
 	retiredWraps: zod.z.number().int(),
 	recoveryKeyDownloadedAt: zod.z.number().nullable(),
-	secretCount: zod.z.number().int()
+	secretCount: zod.z.number().int(),
+	/** The most recent reset, acknowledged or not; `null` when the keychain was never reset. */
+	lastReset: KeychainResetRecordSchema.nullable()
 });
 /**
 * Whether a stored value is still pointed at by its owner's settings.
@@ -12704,13 +13238,14 @@ var KeychainAuditActionSchema = zod.z.enum([
 	"download-recovery-key",
 	"delete-orphans",
 	"reset",
+	"acknowledge-reset",
 	"initialize"
 ]);
 var KeychainAuditEntrySchema = zod.z.object({
 	id: zod.z.string(),
 	at: zod.z.number(),
 	action: KeychainAuditActionSchema,
-	/** `addon:<id>` | `user:<id>` | `system`. */
+	/** `addon:<id>` | `user:<id>` | `system` | `trigger-file`. */
 	actor: zod.z.string(),
 	ref: zod.z.string().nullable(),
 	detail: zod.z.string().nullable()
@@ -12820,6 +13355,21 @@ var keychainAdminCapability = {
 			kind: "mutation",
 			auth: "admin",
 			caller: "required"
+		}),
+		/**
+		* What the last reset left to re-enter: the archived refs (owner, scope,
+		* field — never a value) that hold no value again yet. Process-held refs
+		* the hub regenerates itself (the session signing key) are not listed.
+		*/
+		resetReport: require_sleep.method(zod.z.object({}), zod.z.object({
+			reset: KeychainResetRecordSchema.nullable(),
+			pendingReentry: zod.z.array(KeychainSecretMetaSchema).readonly()
+		}), { auth: "admin" }),
+		/** Dismiss the "keychain was reset" notice. Audited. */
+		acknowledgeReset: require_sleep.method(zod.z.object({}), zod.z.object({ acknowledged: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
 		})
 	}
 };
@@ -16581,8 +17131,8 @@ var PUBLIC_ENDPOINT_HTTP_REASON = "The public endpoint needs an https:// address
 * May `baseUrl` carry `role`? The address check above, plus two role rules:
 * the app link carries `notificationTaps` only (it is not a hub address), and
 * a plain-http address carries `publicEndpoint` only when the operator
-* explicitly accepted it (`acceptInsecureHttp`) — a LAN-only password or
-* magic-link sign-in works over http, a passkey or an OIDC callback does not.
+* explicitly accepted it (`acceptInsecureHttp`) — a LAN-only password
+* sign-in works over http, a passkey or an OIDC callback does not.
 */
 function checkRoleAddress(role, baseUrl, options = {}) {
 	if (isAppLinkBase(baseUrl)) return role === "notificationTaps" ? {
@@ -17732,7 +18282,7 @@ var logDestinationCapability = {
 * `login-method` — collection cap through which auth addons contribute
 * their pre-auth login surfaces to the login page. This is the SINGLE,
 * generic mechanism that supersedes the dead `auth.listProviders` reader:
-* every auth addon (OIDC, magic-link, WebAuthn/passkey) registers a
+* every auth addon (OIDC, WebAuthn/passkey) registers a
 * `login-method` provider and the PUBLIC `auth.listLoginMethods`
 * procedure aggregates them for the unauthenticated login page.
 *
@@ -17740,8 +18290,7 @@ var logDestinationCapability = {
 *
 *  - `redirect` — a declarative button. The login page renders a generic
 *    button that navigates to `startUrl` (an addon-owned HTTP route).
-*    Covers OIDC (`/addon/auth-oidc/<id>/start`) and magic-link with
-*    ZERO shell-side JS. A future SSO addon plugs in the same way — the
+*    Covers OIDC (`/addon/auth-oidc/<id>/start`) with ZERO shell-side JS. A future SSO addon plugs in the same way — the
 *    login page needs NO change.
 *
 *  - `widget` — a Module-Federation widget the login page mounts (via
@@ -17760,8 +18309,8 @@ var logDestinationCapability = {
 *    decision.
 *
 * Every contribution carries a `stage`:
-*  - `primary`        — shown on the first credentials screen (OIDC /
-*                       magic-link buttons; a future usernameless passkey).
+*  - `primary`        — shown on the first credentials screen (OIDC
+*                       buttons; a usernameless passkey).
 *  - `second-factor`  — shown AFTER the password leg, gated on the
 *                       returned `factors` (passkey-as-2FA today).
 *
@@ -17773,7 +18322,7 @@ var logDestinationCapability = {
 var LoginStageEnum = zod.z.enum(["primary", "second-factor"]);
 /**
 * A declarative redirect button — the login page navigates to `startUrl`.
-* OIDC and magic-link contribute this; a future SSO addon does too.
+* OIDC contributes this; a future SSO addon does too.
 */
 var RedirectLoginMethodSchema = zod.z.object({
 	kind: zod.z.literal("redirect"),
@@ -17790,7 +18339,7 @@ var RedirectLoginMethodSchema = zod.z.object({
 	* The provider names an external identity a signed-in user can link to
 	* their own account (D782): `auth.listLinkableProviders` /
 	* `beginExternalLink` offer exactly the redirect methods that set this,
-	* whatever their id. Absent / false — a login button only (magic-link).
+	* whatever their id. Absent / false — a login button only.
 	*/
 	linkable: zod.z.boolean().optional()
 });
@@ -23208,8 +23757,7 @@ var notificationRulesCapability = {
 * `super_admin` — collapsed onto the single boolean because every
 * non-admin caller is governed by the same scope-check rules; the
 * distinction was only ever used to route role-specific procedures
-* which we no longer have. Agents are admin sessions issued via
-* `createServiceToken`; CLI / webhook integrations are `cst_*` tokens
+* which we no longer have. CLI / webhook integrations are `cst_*` tokens
 * with `isAdmin: false` + an explicit scope list.
 */
 /** Per-method access flavour. Materialised on every cap method via codegen. */
@@ -26746,6 +27294,26 @@ var pipelineAnalyticsCapability = {
 			auth: "admin",
 			timeoutMs: 60 * 6e4
 		}),
+		/**
+		* OFFER the annotated archive instead of pushing it (D805): the same tar
+		* `writeRetrainArchive` streams, behind a one-shot `ctx.peerBytes` ticket
+		* the caller dials at once (same host). For a consumer that cannot expose
+		* an upload URL — a training provider streaming straight into its cloud.
+		* The answer is the plan; the bytes and their sha256 are the consumer's
+		* to measure as they arrive.
+		*/
+		offerRetrainArchive: require_sleep.method(zod.z.object({
+			filter: RetrainExportFilterSchema,
+			layout: RetrainExportLayoutSchema
+		}), zod.z.object({
+			ticket: require_sleep.PeerBytesTicketSchema,
+			frames: zod.z.number().int(),
+			annotations: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
 		/** The counts a selection would freeze — class × camera × day/night,
 		*  completeness — without freezing anything. Index reads only. */
 		previewRetrainDataset: require_sleep.method(zod.z.object({
@@ -31786,8 +32354,8 @@ version: zod.z.string().optional() }), ServerUpdateActionResultSchema, {
 * `smtp-provider` — pluggable email delivery surface.
 *
 * Collection cap: a deployment may install multiple SMTP relays (e.g.
-* one for transactional / one for notifications). Consumers (magic-link,
-* notifier addons, …) walk the collection and pick the first
+* one for transactional / one for notifications). Consumers (notifier
+* addons, …) walk the collection and pick the first
 * ready provider OR target a specific addonId.
 *
 * The shape stays small on purpose — `sendEmail` is enough for the
@@ -32087,7 +32655,7 @@ targets: zod.z.array(zod.z.object({
 //#region src/capabilities/sso-bridge.cap.ts
 /**
 * `sso-bridge` — internal hub-only cap that lets SSO-style auth
-* providers (OIDC, SAML, magic-link, …) mint an HMAC-signed token
+* providers (OIDC, SAML, …) mint an HMAC-signed token
 * carrying the post-callback claims before redirecting back to
 * `/api/auth/sso/finish`.
 *
@@ -32150,7 +32718,14 @@ var SsoBridgeClaimsSchema = zod.z.object({
 	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
 	* subject is unique only per issuer, so a link is bound to it.
 	*/
-	issuer: zod.z.string().optional()
+	issuer: zod.z.string().optional(),
+	/**
+	* SHA-256 (hex) of the `camstack_sso_state` cookie the IdP `/start` set in
+	* the browser that began this sign-in. `/api/auth/sso/finish` requires the
+	* request to present the matching cookie — a login bridge is useless in
+	* any other browser.
+	*/
+	browserBinding: zod.z.string().optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -32168,7 +32743,7 @@ var ssoBridgeCapability = {
 		* `/api/auth/sso/finish` to become admin — a full privilege escalation
 		* through the exact surface this cap exists to close (see the module
 		* docblock). Every real caller (`oauth-grants.ts`, `main.ts`
-		* registration, the OIDC/magic-link addons) reaches this through
+		* registration, the OIDC addon) reaches this through
 		* `ctx.api` / the in-process registry — never through tRPC — so
 		* `auth: 'admin'` costs those callers nothing.
 		*/
@@ -48309,16 +48884,6 @@ var ApiKeySummarySchema = zod.z.object({
 	createdAt: zod.z.number(),
 	lastUsedAt: zod.z.number().optional()
 });
-var CreateApiKeyInputSchema = zod.z.object({
-	label: zod.z.string(),
-	isAdmin: zod.z.boolean().default(false),
-	allowedProviders: zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")]).optional(),
-	allowedDevices: zod.z.record(zod.z.string(), zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")])).optional()
-});
-var CreateApiKeyResultSchema = zod.z.object({
-	token: zod.z.string(),
-	record: ApiKeySummarySchema
-});
 var ScopedTokenSummarySchema = zod.z.object({
 	id: zod.z.string(),
 	userId: zod.z.string(),
@@ -48430,20 +48995,11 @@ var userManagementCapability = {
 			access: "view"
 		}),
 		listApiKeys: require_sleep.method(zod.z.void(), zod.z.array(ApiKeySummarySchema), { auth: "admin" }),
-		createApiKey: require_sleep.method(CreateApiKeyInputSchema, CreateApiKeyResultSchema, {
-			kind: "mutation",
-			auth: "admin",
-			access: "create"
-		}),
 		revokeApiKey: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), {
 			kind: "mutation",
 			auth: "admin",
 			access: "delete"
 		}),
-		validateApiKey: require_sleep.method(zod.z.object({ token: zod.z.string() }), ApiKeySummarySchema.nullable(), {
-			kind: "mutation",
-			access: "view"
-		}),
 		createScopedToken: require_sleep.method(CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, {
 			kind: "mutation",
 			auth: "admin",
@@ -48533,20 +49089,6 @@ var userManagementCapability = {
 			userId: zod.z.string(),
 			issuer: zod.z.string()
 		}).nullable(), { auth: "admin" }),
-		/**
-		* Link `(provider, subject)` to `userId`. Idempotent for the same user;
-		* REFUSES (throws) an identity already linked to another user, and a
-		* user that does not exist.
-		*/
-		linkExternalIdentity: require_sleep.method(ExternalIdentityKeySchema.extend({
-			userId: zod.z.string(),
-			issuer: zod.z.string().min(1),
-			label: zod.z.string().optional()
-		}), zod.z.object({ success: zod.z.literal(true) }), {
-			kind: "mutation",
-			auth: "admin",
-			access: "create"
-		}),
 		/** Remove one link of `userId`. `success: false` when it was not linked to that user. */
 		unlinkExternalIdentity: require_sleep.method(ExternalIdentityKeySchema.extend({ userId: zod.z.string() }), zod.z.object({ success: zod.z.boolean() }), {
 			kind: "mutation",
@@ -49290,6 +49832,535 @@ var zoneRulesCapability = {
 	durability: "restored"
 };
 //#endregion
+//#region src/capabilities/training-provider.cap.ts
+/**
+* `training-provider` — ONE cloud that can run the CamStack trainer.
+*
+* A thin, mockable translation layer: it knows how to run a container with a
+* GPU, move a dataset in, read the job's stdout and hand artefacts back. It
+* knows nothing about datasets, splits, floors, cost policy or Model Studio —
+* those are the `training` orchestrator's (D805). Every rule written there
+* once is what makes a second provider (RunPod, a local NVIDIA node) a new
+* manifest entry and nothing else.
+*
+* Collection, routed by the `addonId` in every single-row input (the `llm` /
+* `notification-output` posture); `describe` concat-fans across providers.
+* Every method is `admin`: these spend money.
+*
+* Every cloud object a provider creates is tagged with the orchestrator's
+* `jobKey`, so a retried submit finds the job it already started instead of
+* starting a second GPU, and `listJobs` can find orphans.
+*
+* Bytes never ride a cap field: the dataset arrives as a `ctx.peerBytes`
+* ticket the producer (pipeline-analytics) minted, and artefacts leave as a
+* ticket the provider mints (D613).
+*/
+var TrainingGpuOptionSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	/** List price, USD per GPU-hour, before any region multiplier. */
+	usdPerHour: zod.z.number().nonnegative(),
+	vramGb: zod.z.number().nonnegative()
+});
+var TrainingRegionOptionSchema = zod.z.object({
+	/** `''` = any region (the provider's choice). */
+	id: zod.z.string(),
+	label: zod.z.string(),
+	priceMultiplier: zod.z.number().positive()
+});
+/**
+* The provider's per-account settings, as the orchestrator reads them. They
+* live in the PROVIDER addon's settings (operator decision 2026-10-08: they
+* depend on the user's account), never hard-coded in the orchestrator.
+*/
+var TrainingProviderDefaultsSchema = zod.z.object({
+	gpuType: zod.z.string(),
+	region: zod.z.string(),
+	costCapUsd: zod.z.number().nonnegative(),
+	maxRuntimeSec: zod.z.number().int().positive(),
+	/** Hours a FAILED job's cloud dataset is kept for debugging; 0 = delete at once. */
+	failedDatasetGraceHours: zod.z.number().nonnegative()
+});
+var TrainingProviderDescriptorSchema = zod.z.object({
+	addonId: zod.z.string(),
+	/** `modal`, `runpod`, `fake`, … */
+	kind: zod.z.string(),
+	label: zod.z.string(),
+	gpuTypes: zod.z.array(TrainingGpuOptionSchema).readonly(),
+	regions: zod.z.array(TrainingRegionOptionSchema).readonly(),
+	maxDatasetBytes: zod.z.number().int().positive(),
+	maxRuntimeSec: zod.z.number().int().positive(),
+	freeTierNote: zod.z.string().optional(),
+	/** Where the data goes, in one sentence the confirm dialog repeats. */
+	dataResidencyNote: zod.z.string(),
+	/** Credentials are present — never the values. */
+	configured: zod.z.boolean(),
+	defaults: TrainingProviderDefaultsSchema
+});
+var TrainingCredentialCheckSchema = zod.z.object({
+	ok: zod.z.boolean(),
+	/** Workspace / account name, when the provider says. */
+	account: zod.z.string().optional(),
+	reason: zod.z.enum([
+		"missing",
+		"invalid",
+		"forbidden",
+		"network",
+		"quota"
+	]).optional(),
+	detail: zod.z.string().optional()
+});
+var ProviderJobStateSchema = zod.z.enum([
+	"pending",
+	"starting",
+	"running",
+	"succeeded",
+	"failed",
+	"cancelled",
+	"lost"
+]);
+var ProviderJobStatusSchema = zod.z.object({
+	jobKey: zod.z.string(),
+	providerJobId: zod.z.string().optional(),
+	state: ProviderJobStateSchema,
+	startedAt: zod.z.number().optional(),
+	endedAt: zod.z.number().optional(),
+	exitCode: zod.z.number().int().optional(),
+	failureReason: zod.z.string().optional(),
+	gpuType: zod.z.string(),
+	region: zod.z.string().optional(),
+	billedSeconds: zod.z.number().nonnegative(),
+	costUsd: zod.z.number().nonnegative(),
+	/** True when `costUsd` is runtime × list price, not a billing answer. */
+	costIsEstimate: zod.z.boolean(),
+	lastFetchedAt: zod.z.number()
+});
+/**
+* The trainer the job runs, by SOURCE revision: the provider turns it into an
+* image its own way (Modal builds the published Dockerfile at that revision;
+* a registry-pull provider maps it to a tag). Recorded on the job and echoed
+* in `result.json`.
+*/
+var TrainerSourceRefSchema = zod.z.object({
+	/** Hugging Face repo id, e.g. `camstack/camstack-trainer`. */
+	repo: zod.z.string().min(1),
+	/** A commit sha (never a branch) — the job must be reproducible. */
+	revision: zod.z.string().regex(/^[0-9a-f]{7,64}$/)
+});
+var JobRef = {
+	addonId: zod.z.string(),
+	jobKey: zod.z.string().uuid()
+};
+var TrainingLogLineSchema = zod.z.object({
+	ts: zod.z.number(),
+	text: zod.z.string()
+});
+var trainingProviderCapability = {
+	name: "training-provider",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		/** Every provider's offer and settings. Concat-fans across providers. */
+		describe: require_sleep.method(zod.z.object({}), zod.z.array(TrainingProviderDescriptorSchema).readonly(), { auth: "admin" }),
+		/** Call the provider with the stored credentials. Never returns them. */
+		validateCredentials: require_sleep.method(zod.z.object({ addonId: zod.z.string() }), TrainingCredentialCheckSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 3e4
+		}),
+		/** USD range for a run of `gpuSeconds` on `gpuType` in `region`. */
+		estimateJob: require_sleep.method(zod.z.object({
+			addonId: zod.z.string(),
+			gpuType: zod.z.string(),
+			region: zod.z.string(),
+			datasetBytes: zod.z.number().int().nonnegative(),
+			gpuSecondsLow: zod.z.number().nonnegative(),
+			gpuSecondsHigh: zod.z.number().nonnegative()
+		}), zod.z.object({
+			usdLow: zod.z.number().nonnegative(),
+			usdHigh: zod.z.number().nonnegative(),
+			notes: zod.z.array(zod.z.string()).readonly()
+		}), { auth: "admin" }),
+		/**
+		* Take the dataset archive behind `ticket` (minted by pipeline-analytics,
+		* same host) and land it as the job's dataset in the cloud, streamed —
+		* nothing is staged on the hub's disk. Idempotent per `jobKey`: a second
+		* call replaces a partial upload. Answers what actually landed.
+		*/
+		uploadDataset: require_sleep.method(zod.z.object({
+			...JobRef,
+			ticket: require_sleep.PeerBytesTicketSchema
+		}), zod.z.object({
+			bytes: zod.z.number().int().nonnegative(),
+			sha256: zod.z.string()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 120 * 6e4
+		}),
+		/**
+		* Start the trainer on a GPU. Looks the job up by `jobKey` first, so a
+		* retried submit never starts a second GPU. `jobSpecJson` is written next
+		* to the dataset as `job.json`; `maxRuntimeSec` is enforced by the
+		* provider (a hard timeout), not by the hub.
+		*/
+		submitJob: require_sleep.method(zod.z.object({
+			...JobRef,
+			trainer: TrainerSourceRefSchema,
+			jobSpecJson: zod.z.string().min(2).max(64e3),
+			gpuType: zod.z.string(),
+			region: zod.z.string(),
+			maxRuntimeSec: zod.z.number().int().positive()
+		}), ProviderJobStatusSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 30 * 6e4
+		}),
+		getJob: require_sleep.method(zod.z.object(JobRef), ProviderJobStatusSchema, {
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/** Stdout/stderr since `cursor` (opaque), oldest first, at most `max` lines. */
+		listJobEvents: require_sleep.method(zod.z.object({
+			...JobRef,
+			cursor: zod.z.string().optional(),
+			max: zod.z.number().int().min(1).max(500)
+		}), zod.z.object({
+			lines: zod.z.array(TrainingLogLineSchema).readonly(),
+			cursor: zod.z.string()
+		}), {
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/** Stop the job. Idempotent: an unknown or finished job is a no-op. */
+		cancelJob: require_sleep.method(zod.z.object(JobRef), zod.z.object({ ok: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/** The job's `result.json`, as text (small, JSON). `found: false` before it exists. */
+		readResult: require_sleep.method(zod.z.object(JobRef), zod.z.object({
+			found: zod.z.boolean(),
+			text: zod.z.string().optional()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 5 * 6e4
+		}),
+		/**
+		* Offer one output file of the job (`bundle.tar`) to the caller as a
+		* one-shot `ctx.peerBytes` ticket, streamed from the cloud — the provider
+		* stages nothing on disk. The caller dials it at once.
+		*/
+		offerArtifact: require_sleep.method(zod.z.object({
+			...JobRef,
+			path: zod.z.enum(["bundle.tar"])
+		}), zod.z.object({ ticket: require_sleep.PeerBytesTicketSchema }), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 5 * 6e4
+		}),
+		/** Delete every cloud object tagged with `jobKey` (the dataset first). Idempotent. */
+		cleanupJob: require_sleep.method(zod.z.object(JobRef), zod.z.object({ deleted: zod.z.array(zod.z.string()).readonly() }), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 5 * 6e4
+		}),
+		/** Every job the provider can still see — the orphan sweep diffs it against our records. */
+		listJobs: require_sleep.method(zod.z.object({ addonId: zod.z.string() }), zod.z.array(ProviderJobStatusSchema).readonly(), {
+			auth: "admin",
+			timeoutMs: 2 * 6e4
+		})
+	}
+};
+//#endregion
+//#region src/capabilities/training.cap.ts
+/**
+* `training` — the cloud-training orchestrator (D805). Hub-only singleton,
+* provided by `addon-training`.
+*
+* It owns what every provider must agree on, written once:
+*
+* - **Dataset versions.** Taken over from pipeline-analytics (D796): the rows
+*   live here (D808); pipeline-analytics still CUTS a version (it owns the corpus and
+*   the export plan) and reaches this store through the five row methods
+*   below, so the Retrain page and the export did not change.
+* - **Jobs.** A persisted state machine, a reconcile loop against the
+*   provider, a cost guard, a daily orphan sweep and the retention rules.
+* - **The return flow.** Verified artefacts → Model Studio
+*   (`custom-model-registry.importModelBundle`) → canary on cameras →
+*   rollback. Nothing is ever registered automatically.
+*
+* Every method is `admin`.
+*/
+/** A version WITH its frame list — what the export and a job read. */
+var TrainingDatasetVersionRowSchema = RetrainDatasetVersionSchema.omit({ frameCount: true }).extend({ frameIds: zod.z.array(zod.z.string()).max(2e4).readonly() });
+/** A base model a detector job can fine-tune, and the baseline it is judged against. */
+var TrainingBaseModelSchema = zod.z.object({
+	modelId: zod.z.string(),
+	label: zod.z.string(),
+	weights: zod.z.string(),
+	imgsz: zod.z.number().int(),
+	baselineOnnxUrl: zod.z.string(),
+	baselineFloors: zod.z.record(zod.z.string(), zod.z.number()),
+	/** The base the fleet runs most — the UI's default. */
+	recommended: zod.z.boolean()
+});
+var TrainingPresetSchema = zod.z.enum([
+	"quick",
+	"standard",
+	"thorough"
+]);
+var TrainingJobRequestSchema = zod.z.object({
+	datasetVersionId: zod.z.string().min(1),
+	/** The `training-provider` addon that runs it. */
+	addonId: zod.z.string().min(1),
+	gpuType: zod.z.string().min(1),
+	region: zod.z.string(),
+	baseModelId: zod.z.string().min(1),
+	preset: TrainingPresetSchema,
+	/** Freeze the backbone's first N layers; `null` = the preset's choice. */
+	freeze: zod.z.number().int().nonnegative().nullable(),
+	/** Cameras held out whole for evaluation; `null` = the orchestrator's default. */
+	holdoutCameras: zod.z.array(zod.z.number().int()).nullable()
+});
+var TrainingSplitPlanSchema = zod.z.object({
+	holdoutCameras: zod.z.array(zod.z.number().int()).readonly(),
+	/** Used when no camera is held out: the last N days of every camera. */
+	holdoutLastDays: zod.z.number().int().nonnegative(),
+	/** Holdout subjects per class (camera holdout only; `null` = known only after the split). */
+	holdoutSupport: zod.z.record(zod.z.string(), zod.z.number().int()).nullable(),
+	trainSubjects: zod.z.number().int()
+});
+var TrainingRefusalReasonSchema = zod.z.enum([
+	"unknown-dataset",
+	"unknown-provider",
+	"provider-not-configured",
+	"unknown-base-model",
+	"unknown-gpu",
+	"dataset-too-large",
+	"no-training-subjects",
+	"job-already-running"
+]);
+var TrainingJobPlanSchema = zod.z.object({
+	refusal: zod.z.object({
+		reason: TrainingRefusalReasonSchema,
+		detail: zod.z.string()
+	}).nullable(),
+	warnings: zod.z.array(zod.z.string()).readonly(),
+	split: TrainingSplitPlanSchema.nullable(),
+	estimate: zod.z.object({
+		datasetBytes: zod.z.number().int(),
+		uploadMinutesAt20Mbps: zod.z.number(),
+		gpuSecondsLow: zod.z.number(),
+		gpuSecondsHigh: zod.z.number(),
+		usdLow: zod.z.number(),
+		usdHigh: zod.z.number(),
+		notes: zod.z.array(zod.z.string()).readonly()
+	}).nullable(),
+	/** Pre-filled from the provider's settings; the operator may lower or raise them. */
+	defaults: zod.z.object({
+		maxCostUsd: zod.z.number(),
+		maxRuntimeSec: zod.z.number().int()
+	}).nullable(),
+	/** The sentence the confirm dialog repeats: where the frames go and when they are deleted. */
+	dataNotice: zod.z.string()
+});
+/**
+* Orchestrator-owned states, persisted. `uploading` covers exporting the
+* archive (it is streamed, never staged). Terminal: `failed`, `cancelled`,
+* `lost`, `expired`, `discarded`. `registered` and `canary` are where a
+* result lives after the operator acted on it.
+*/
+var TrainingJobStateSchema = zod.z.enum([
+	"uploading",
+	"submitted",
+	"starting",
+	"running",
+	"collecting",
+	"ready",
+	"registered",
+	"canary",
+	"failed",
+	"cancelling",
+	"cancelled",
+	"lost",
+	"expired",
+	"discarded"
+]);
+var TrainingFailureReasonSchema = zod.z.enum([
+	"cost-cap",
+	"runtime-cap",
+	"upload-failed",
+	"submit-failed",
+	"trainer-failed",
+	"result-invalid",
+	"checksum-mismatch",
+	"fetch-failed",
+	"provider-error",
+	"hub-restart-during-upload"
+]);
+var TrainingProgressPointSchema = zod.z.object({
+	epoch: zod.z.number().int(),
+	map50: zod.z.number().nullable(),
+	map50_95: zod.z.number().nullable()
+});
+var TrainingCanarySchema = zod.z.object({
+	deviceIds: zod.z.array(zod.z.number().int()).readonly(),
+	since: zod.z.number(),
+	/** Every override the canary replaced, exactly, so rollback restores it. */
+	previous: zod.z.array(zod.z.object({
+		deviceId: zod.z.number().int(),
+		nodeId: zod.z.string(),
+		deviceKey: zod.z.string(),
+		patch: zod.z.object({
+			modelId: zod.z.string().optional(),
+			settings: zod.z.record(zod.z.string(), zod.z.unknown()).readonly().optional()
+		}).nullable()
+	})).readonly()
+});
+var TrainingJobSchema = zod.z.object({
+	id: zod.z.string(),
+	idempotencyKey: zod.z.string(),
+	name: zod.z.string(),
+	createdAt: zod.z.number(),
+	updatedAt: zod.z.number(),
+	state: TrainingJobStateSchema,
+	stage: TrainingStageSchema.nullable(),
+	failure: zod.z.object({
+		reason: TrainingFailureReasonSchema,
+		stage: zod.z.string().nullable(),
+		detail: zod.z.string()
+	}).nullable(),
+	request: TrainingJobRequestSchema,
+	maxCostUsd: zod.z.number().nonnegative(),
+	maxRuntimeSec: zod.z.number().int().positive(),
+	trainer: TrainerSourceRefSchema,
+	datasetLayout: RetrainExportLayoutSchema,
+	dataset: zod.z.object({
+		bytes: zod.z.number().int(),
+		sha256: zod.z.string(),
+		uploadedAt: zod.z.number()
+	}).nullable(),
+	split: TrainingSplitPlanSchema,
+	provider: zod.z.object({
+		state: ProviderJobStateSchema.nullable(),
+		providerJobId: zod.z.string().nullable(),
+		startedAt: zod.z.number().nullable(),
+		endedAt: zod.z.number().nullable(),
+		billedSeconds: zod.z.number(),
+		costUsd: zod.z.number(),
+		costIsEstimate: zod.z.boolean(),
+		lastPolledAt: zod.z.number().nullable()
+	}),
+	progress: zod.z.object({
+		epoch: zod.z.number().int().nullable(),
+		epochs: zod.z.number().int().nullable(),
+		etaSec: zod.z.number().nullable(),
+		series: zod.z.array(TrainingProgressPointSchema).readonly()
+	}),
+	/** The last lines of the job's output (≤ 200), newest last. Never frame paths. */
+	logTail: zod.z.array(zod.z.string()).readonly(),
+	logCursor: zod.z.string().nullable(),
+	artifacts: zod.z.object({
+		bundleBytes: zod.z.number().int(),
+		bundleSha256: zod.z.string(),
+		fetchedAt: zod.z.number(),
+		/** When the staged artefacts are deleted from the hub. */
+		expiresAt: zod.z.number()
+	}).nullable(),
+	/** When the provider-side copy of the frames was deleted; null while it exists. */
+	cloudDatasetDeletedAt: zod.z.number().nullable(),
+	/** A failed job's dataset is kept until then (the provider's grace), then deleted. */
+	cloudCleanupDueAt: zod.z.number().nullable(),
+	/** Model ids registered from this job (base, and int8 when kept). */
+	registeredModelIds: zod.z.array(zod.z.string()).readonly(),
+	canary: TrainingCanarySchema.nullable()
+});
+var IdInput = zod.z.object({ id: zod.z.string().min(1) });
+var trainingCapability = {
+	name: "training",
+	scope: "system",
+	mode: "singleton",
+	mount: { kind: "hub-only" },
+	methods: {
+		/** Store a version once. `stored: false` = that id already exists (immutable). */
+		putDatasetVersion: require_sleep.method(TrainingDatasetVersionRowSchema, zod.z.object({ stored: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getDatasetVersion: require_sleep.method(IdInput, TrainingDatasetVersionRowSchema.nullable(), { auth: "admin" }),
+		/** Every version without its frame list, newest first. */
+		listDatasetVersions: require_sleep.method(zod.z.object({}), zod.z.array(RetrainDatasetVersionSchema).readonly(), { auth: "admin" }),
+		findDatasetVersionIdByName: require_sleep.method(zod.z.object({ name: zod.z.string() }), zod.z.object({ id: zod.z.string().nullable() }), { auth: "admin" }),
+		removeDatasetVersion: require_sleep.method(IdInput, zod.z.object({ removed: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		listBaseModels: require_sleep.method(zod.z.object({}), zod.z.array(TrainingBaseModelSchema).readonly(), { auth: "admin" }),
+		/** Split, estimate, defaults and any named refusal — nothing is started. */
+		planJob: require_sleep.method(TrainingJobRequestSchema, TrainingJobPlanSchema, {
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/**
+		* Start a job. The same `idempotencyKey` returns the job it already
+		* started. Answers at once (`uploading`); the upload and the submit run in
+		* the background and the job record says how far they got.
+		*/
+		startJob: require_sleep.method(TrainingJobRequestSchema.extend({
+			name: zod.z.string().min(1).max(120),
+			maxCostUsd: zod.z.number().positive(),
+			maxRuntimeSec: zod.z.number().int().positive(),
+			idempotencyKey: zod.z.string().min(8).max(80)
+		}), zod.z.discriminatedUnion("kind", [zod.z.object({
+			kind: zod.z.literal("started"),
+			job: TrainingJobSchema
+		}), zod.z.object({
+			kind: zod.z.literal("refused"),
+			reason: TrainingRefusalReasonSchema,
+			detail: zod.z.string()
+		})]), {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		listJobs: require_sleep.method(zod.z.object({}), zod.z.array(TrainingJobSchema).readonly(), { auth: "admin" }),
+		getJob: require_sleep.method(IdInput, TrainingJobSchema.nullable(), { auth: "admin" }),
+		cancelJob: require_sleep.method(IdInput, TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		/** The verified `result.json` of a job in `ready` or later; null before. */
+		getJobResult: require_sleep.method(IdInput, TrainingResultSchema.nullable(), { auth: "admin" }),
+		/** Hand the verified bundle to Model Studio; optionally canary right after. */
+		registerResult: require_sleep.method(IdInput.extend({ canaryDeviceIds: zod.z.array(zod.z.number().int()).readonly() }), TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 30 * 6e4
+		}),
+		/** Pin the registered model on these cameras, remembering what it replaced. */
+		canaryResult: require_sleep.method(IdInput.extend({ deviceIds: zod.z.array(zod.z.number().int()).min(1).readonly() }), TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		/** Put every canary camera back exactly as it was. */
+		rollbackCanary: require_sleep.method(IdInput, TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 12e4
+		}),
+		/** Delete the staged artefacts of an unregistered result. */
+		discardResult: require_sleep.method(IdInput, TrainingJobSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+//#endregion
 //#region src/capabilities/index.ts
 /**
 * Capability definitions — Zod-schema-first, single source of truth.
@@ -53462,6 +54533,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"backup.checkBackupKey": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"backup.delete": {
 		capName: "backup",
 		capScope: "system",
@@ -53474,6 +54551,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"backup.disableEncryption": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"backup.getEncryption": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"backup.getEntries": {
 		capName: "backup",
 		capScope: "system",
@@ -53528,6 +54617,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"backup.setupEncryption": {
+		capName: "backup",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"backup.trigger": {
 		capName: "backup",
 		capScope: "system",
@@ -54080,6 +55175,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"customModelRegistry.importModelBundle": {
+		capName: "custom-model-registry",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"customModelRegistry.listModels": {
 		capName: "custom-model-registry",
 		capScope: "system",
@@ -55520,6 +56621,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"keychainAdmin.acknowledgeReset": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"keychainAdmin.deleteOrphans": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -55556,6 +56663,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"keychainAdmin.resetReport": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"keychainAdmin.reveal": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -57302,6 +58415,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.offerRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.ownersWithMedia": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -59840,6 +60959,174 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"training.canaryResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.cancelJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.discardResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.findDatasetVersionIdByName": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.getDatasetVersion": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.getJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.getJobResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.listBaseModels": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.listDatasetVersions": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.listJobs": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.planJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"training.putDatasetVersion": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.registerResult": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.removeDatasetVersion": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"training.rollbackCanary": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"training.startJob": {
+		capName: "training",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.cancelJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.cleanupJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.describe": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.estimateJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.getJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.listJobEvents": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.listJobs": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"trainingProvider.offerArtifact": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.readResult": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.submitJob": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.uploadDataset": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"trainingProvider.validateCredentials": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"turnProvider.getTurnServers": {
 		capName: "turn-provider",
 		capScope: "system",
@@ -59864,12 +61151,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"userManagement.createApiKey": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"userManagement.createScopedToken": {
 		capName: "user-management",
 		capScope: "system",
@@ -59906,12 +61187,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"userManagement.linkExternalIdentity": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
@@ -60014,12 +61289,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"userManagement.validateApiKey": {
-		capName: "user-management",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"userManagement.validateCredentials": {
 		capName: "user-management",
 		capScope: "system",
@@ -60600,6 +61869,8 @@ var KNOWN_CAP_NAMES = [
 	"temperature-sensor",
 	"terminal-session",
 	"toast",
+	"training",
+	"training-provider",
 	"turn-provider",
 	"update",
 	"user-management",
@@ -60784,6 +62055,8 @@ var SYSTEM_CAP_NAMES = [
 	"system",
 	"terminal-session",
 	"toast",
+	"training",
+	"training-provider",
 	"turn-provider",
 	"user-management",
 	"user-passkeys",
@@ -64290,6 +65563,8 @@ var CAPABILITY_NAMES = {
 	temperatureSensor: "temperature-sensor",
 	terminalSession: "terminal-session",
 	toast: "toast",
+	training: "training",
+	trainingProvider: "training-provider",
 	turnProvider: "turn-provider",
 	update: "update",
 	userManagement: "user-management",
@@ -64913,6 +66188,14 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "toast",
 		name: "toast"
 	},
+	{
+		key: "training",
+		name: "training"
+	},
+	{
+		key: "trainingProvider",
+		name: "training-provider"
+	},
 	{
 		key: "turnProvider",
 		name: "turn-provider"
@@ -65139,6 +66422,8 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	temperatureSensorCapability,
 	terminalSessionCapability,
 	toastCapability,
+	trainingCapability,
+	trainingProviderCapability,
 	turnProviderCapability,
 	updateCapability,
 	userManagementCapability,
@@ -67519,6 +68804,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"training.canaryResult": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"update.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -67923,7 +69213,8 @@ var SYSTEM_SCOPE_DEVICE_METHODS = [
 	"streamBroker.restartProfile",
 	"streamBroker.retractCameraStream",
 	"streamBroker.setDeviceAudioMute",
-	"streamBroker.unassignProfile"
+	"streamBroker.unassignProfile",
+	"training.canaryResult"
 ];
 //#endregion
 //#region src/generated/provider-kind-map.ts
@@ -68481,6 +69772,10 @@ function createSystemProxy(api) {
 			listLocations: (input) => dispatch("backup", "listLocations", "query", input),
 			getEntries: (input) => dispatch("backup", "getEntries", "query", input),
 			restore: (input) => dispatch("backup", "restore", "mutation", input),
+			getEncryption: (input) => dispatch("backup", "getEncryption", "query", input),
+			setupEncryption: (input) => dispatch("backup", "setupEncryption", "mutation", input),
+			disableEncryption: (input) => dispatch("backup", "disableEncryption", "mutation", input),
+			checkBackupKey: (input) => dispatch("backup", "checkBackupKey", "mutation", input),
 			delete: (input) => dispatch("backup", "delete", "mutation", input),
 			listArchives: (input) => dispatch("backup", "listArchives", "query", input),
 			upsertDestinationPolicy: (input) => dispatch("backup", "upsertDestinationPolicy", "mutation", input),
@@ -68668,7 +69963,9 @@ function createSystemProxy(api) {
 			rotateMasterKey: (input) => dispatch("keychainAdmin", "rotateMasterKey", "mutation", input),
 			purgeRetiredKeys: (input) => dispatch("keychainAdmin", "purgeRetiredKeys", "mutation", input),
 			downloadRecoveryKey: (input) => dispatch("keychainAdmin", "downloadRecoveryKey", "mutation", input),
-			resetKeychain: (input) => dispatch("keychainAdmin", "resetKeychain", "mutation", input)
+			resetKeychain: (input) => dispatch("keychainAdmin", "resetKeychain", "mutation", input),
+			resetReport: (input) => dispatch("keychainAdmin", "resetReport", "query", input),
+			acknowledgeReset: (input) => dispatch("keychainAdmin", "acknowledgeReset", "mutation", input)
 		},
 		llm: {
 			generate: (input) => dispatch("llm", "generate", "mutation", input),
@@ -69080,6 +70377,24 @@ function createSystemProxy(api) {
 			close: (input) => dispatch("terminalSession", "close", "mutation", input)
 		},
 		toast: { onToast: (input, push) => dispatch("toast", "onToast", "subscription", input, push) },
+		training: {
+			putDatasetVersion: (input) => dispatch("training", "putDatasetVersion", "mutation", input),
+			getDatasetVersion: (input) => dispatch("training", "getDatasetVersion", "query", input),
+			listDatasetVersions: (input) => dispatch("training", "listDatasetVersions", "query", input),
+			findDatasetVersionIdByName: (input) => dispatch("training", "findDatasetVersionIdByName", "query", input),
+			removeDatasetVersion: (input) => dispatch("training", "removeDatasetVersion", "mutation", input),
+			listBaseModels: (input) => dispatch("training", "listBaseModels", "query", input),
+			planJob: (input) => dispatch("training", "planJob", "query", input),
+			startJob: (input) => dispatch("training", "startJob", "mutation", input),
+			listJobs: (input) => dispatch("training", "listJobs", "query", input),
+			getJob: (input) => dispatch("training", "getJob", "query", input),
+			cancelJob: (input) => dispatch("training", "cancelJob", "mutation", input),
+			getJobResult: (input) => dispatch("training", "getJobResult", "query", input),
+			registerResult: (input) => dispatch("training", "registerResult", "mutation", input),
+			canaryResult: (input) => dispatch("training", "canaryResult", "mutation", input),
+			rollbackCanary: (input) => dispatch("training", "rollbackCanary", "mutation", input),
+			discardResult: (input) => dispatch("training", "discardResult", "mutation", input)
+		},
 		turnProvider: { getTurnServers: (input) => dispatch("turnProvider", "getTurnServers", "query", input) },
 		userManagement: {
 			listUsers: (input) => dispatch("userManagement", "listUsers", "query", input),
@@ -69090,9 +70405,7 @@ function createSystemProxy(api) {
 			setUserScopes: (input) => dispatch("userManagement", "setUserScopes", "mutation", input),
 			validateCredentials: (input) => dispatch("userManagement", "validateCredentials", "mutation", input),
 			listApiKeys: (input) => dispatch("userManagement", "listApiKeys", "query", input),
-			createApiKey: (input) => dispatch("userManagement", "createApiKey", "mutation", input),
 			revokeApiKey: (input) => dispatch("userManagement", "revokeApiKey", "mutation", input),
-			validateApiKey: (input) => dispatch("userManagement", "validateApiKey", "mutation", input),
 			createScopedToken: (input) => dispatch("userManagement", "createScopedToken", "mutation", input),
 			revokeScopedToken: (input) => dispatch("userManagement", "revokeScopedToken", "mutation", input),
 			validateScopedToken: (input) => dispatch("userManagement", "validateScopedToken", "query", input),
@@ -69108,7 +70421,6 @@ function createSystemProxy(api) {
 			oauthVerifyAccessToken: (input) => dispatch("userManagement", "oauthVerifyAccessToken", "query", input),
 			listExternalIdentities: (input) => dispatch("userManagement", "listExternalIdentities", "query", input),
 			findUserByExternalIdentity: (input) => dispatch("userManagement", "findUserByExternalIdentity", "query", input),
-			linkExternalIdentity: (input) => dispatch("userManagement", "linkExternalIdentity", "mutation", input),
 			unlinkExternalIdentity: (input) => dispatch("userManagement", "unlinkExternalIdentity", "mutation", input),
 			listOauthSessions: (input) => dispatch("userManagement", "listOauthSessions", "query", input),
 			revokeOauthSession: (input) => dispatch("userManagement", "revokeOauthSession", "mutation", input)
@@ -76447,7 +77759,12 @@ var CREDENTIAL_PARAM_PATTERNS = [
 	/^bearer$/i,
 	/^api[_-]?key$/i,
 	/^access[_-]?token$/i,
-	/^refresh[_-]?token$/i
+	/^refresh[_-]?token$/i,
+	/^bridge$/i,
+	/^code$/i,
+	/^state$/i,
+	/^challenge$/i,
+	/^link$/i
 ];
 function isCredentialParam(name) {
 	return CREDENTIAL_PARAM_PATTERNS.some((re) => re.test(name));
@@ -76469,6 +77786,10 @@ function isCredentialParam(name) {
 * are NOT masked (those are entity references, not credentials).
 */
 function maskUrlCredentials(rawUrl) {
+	if (rawUrl.startsWith("/") && !rawUrl.startsWith("//")) {
+		const masked = maskUrlCredentials(`http://relative.invalid${rawUrl}`);
+		return masked.startsWith("http://relative.invalid") ? masked.slice(23) : rawUrl;
+	}
 	try {
 		const u = new URL(rawUrl);
 		let touched = false;
@@ -77407,6 +78728,8 @@ exports.APPEARANCE_BLOCKS = APPEARANCE_BLOCKS;
 exports.APPEARANCE_DESCRIPTOR_VERSION = APPEARANCE_DESCRIPTOR_VERSION;
 exports.APPEARANCE_RESOLVES_AMBIGUITY_DEFAULT = APPEARANCE_RESOLVES_AMBIGUITY_DEFAULT;
 exports.APPLE_SA_TO_MACRO = APPLE_SA_TO_MACRO;
+exports.APP_AUTH_CALLBACK_MAX_LENGTH = APP_AUTH_CALLBACK_MAX_LENGTH;
+exports.APP_AUTH_CALLBACK_URLS = APP_AUTH_CALLBACK_URLS;
 exports.ARCHIVED_DEBUG_NOTES_DEFAULT_LIMIT = ARCHIVED_DEBUG_NOTES_DEFAULT_LIMIT;
 exports.AUDIO_ANALYSIS_CAP_NAME = AUDIO_ANALYSIS_CAP_NAME;
 exports.AUDIO_BACKEND_CHOICES = AUDIO_BACKEND_CHOICES;
@@ -77511,7 +78834,9 @@ exports.BOOT_RECOVERY_BACKOFF_MS = require_sleep.BOOT_RECOVERY_BACKOFF_MS;
 exports.BUILTIN_RESULT_KINDS = BUILTIN_RESULT_KINDS;
 exports.BackgroundRunRegistry = BackgroundRunRegistry;
 exports.BacklightModeSchema = BacklightModeSchema;
+exports.BackupArchiveEncryptionSchema = BackupArchiveEncryptionSchema;
 exports.BackupDestinationInfoSchema = BackupDestinationInfoSchema;
+exports.BackupEncryptionStatusSchema = BackupEncryptionStatusSchema;
 exports.BackupEntrySchema = BackupEntrySchema;
 exports.BackupRunPhaseSchema = BackupRunPhaseSchema;
 exports.BackupRunSchema = BackupRunSchema;
@@ -77554,6 +78879,7 @@ exports.CAMERA_SWITCH_CATALOG = CAMERA_SWITCH_CATALOG;
 exports.CAMERA_SWITCH_ORDER = CAMERA_SWITCH_ORDER;
 exports.CAMERA_TRIGGER = CAMERA_TRIGGER;
 exports.CAMSTACK_APP_LINK_ORIGIN = CAMSTACK_APP_LINK_ORIGIN;
+exports.CAMSTACK_EVENT_PREFIX = CAMSTACK_EVENT_PREFIX;
 exports.CAM_PROFILE_ORDER = require_sleep.CAM_PROFILE_ORDER;
 exports.CAPABILITY_NAMES = CAPABILITY_NAMES;
 exports.CAPABILITY_ROUTER_KEYS = CAPABILITY_ROUTER_KEYS;
@@ -77758,8 +79084,6 @@ exports.CoreBlockSourceSchema = CoreBlockSourceSchema;
 exports.CoreBlockStatusSchema = CoreBlockStatusSchema;
 exports.CoverStateSchema = CoverStateSchema;
 exports.CoverStatusSchema = CoverStatusSchema;
-exports.CreateApiKeyInputSchema = CreateApiKeyInputSchema;
-exports.CreateApiKeyResultSchema = CreateApiKeyResultSchema;
 exports.CreateIntegrationInputSchema = CreateIntegrationInputSchema;
 exports.CreateRetrainDatasetVersionResultSchema = CreateRetrainDatasetVersionResultSchema;
 exports.CreateScopedTokenInputSchema = CreateScopedTokenInputSchema;
@@ -78031,6 +79355,8 @@ exports.ImageSettingsOptionsSchema = ImageSettingsOptionsSchema;
 exports.ImageSettingsPatchSchema = ImageSettingsPatchSchema;
 exports.ImageSettingsStatusSchema = ImageSettingsStatusSchema;
 exports.ImageStatusSchema = ImageStatusSchema;
+exports.ImportModelBundleInputSchema = ImportModelBundleInputSchema;
+exports.ImportModelBundleResultSchema = ImportModelBundleResultSchema;
 exports.InferenceDeviceExclusionReasonSchema = InferenceDeviceExclusionReasonSchema;
 exports.IngestOwnerSchema = IngestOwnerSchema;
 exports.InstalledPackageSchema = InstalledPackageSchema;
@@ -78040,6 +79366,7 @@ exports.IntercomAbilitySchema = IntercomAbilitySchema;
 exports.IntercomStatusSchema = IntercomStatusSchema;
 exports.KEYCHAIN_MAX_REFS_PER_CALL = KEYCHAIN_MAX_REFS_PER_CALL;
 exports.KEYCHAIN_RESET_CONFIRMATION = KEYCHAIN_RESET_CONFIRMATION;
+exports.KEYCHAIN_RESET_TRIGGER_ACTOR = KEYCHAIN_RESET_TRIGGER_ACTOR;
 exports.KNOWN_CAP_NAMES = KNOWN_CAP_NAMES;
 exports.KeptReasonSchema = KeptReasonSchema;
 exports.KeyEventSchema = KeyEventSchema;
@@ -78048,6 +79375,7 @@ exports.KeychainAuditActionSchema = KeychainAuditActionSchema;
 exports.KeychainAuditEntrySchema = KeychainAuditEntrySchema;
 exports.KeychainKeySourceKindSchema = KeychainKeySourceKindSchema;
 exports.KeychainKeySourceSchema = KeychainKeySourceSchema;
+exports.KeychainResetRecordSchema = KeychainResetRecordSchema;
 exports.KeychainResolveEntrySchema = KeychainResolveEntrySchema;
 exports.KeychainResolveResultSchema = KeychainResolveResultSchema;
 exports.KeychainSecretMetaSchema = KeychainSecretMetaSchema;
@@ -78210,6 +79538,7 @@ exports.MethodAccessSchema = MethodAccessSchema;
 exports.MigrateDeviceResultSchema = MigrateDeviceResultSchema;
 exports.MigrateSwitchOutcomeSchema = MigrateSwitchOutcomeSchema;
 exports.MigrateSwitchReportSchema = MigrateSwitchReportSchema;
+exports.ModelBundleFileSchema = ModelBundleFileSchema;
 exports.ModelCatalogEntrySchema = ModelCatalogEntrySchema;
 exports.ModelConvertInputSchema = ModelConvertInputSchema;
 exports.ModelConvertMetadataSchema = ModelConvertMetadataSchema;
@@ -78597,6 +79926,8 @@ exports.ProbeTargetConfigResultSchema = ProbeTargetConfigResultSchema;
 exports.ProfileRtspEntrySchema = require_sleep.ProfileRtspEntrySchema;
 exports.ProfileSlotSchema = require_sleep.ProfileSlotSchema;
 exports.ProfileSlotStatusSchema = require_sleep.ProfileSlotStatusSchema;
+exports.ProviderJobStateSchema = ProviderJobStateSchema;
+exports.ProviderJobStatusSchema = ProviderJobStatusSchema;
 exports.ProviderMotionDataSchema = ProviderMotionDataSchema;
 exports.ProviderStatusSchema = ProviderStatusSchema;
 exports.PtzAutotrackRuntimeStateSchema = PtzAutotrackRuntimeStateSchema;
@@ -78774,6 +80105,8 @@ exports.SOURCE_CAP_ACTIVE_FIELD = require_composition.SOURCE_CAP_ACTIVE_FIELD;
 exports.SOURCE_CAP_CHANGED_AT_FIELD = require_composition.SOURCE_CAP_CHANGED_AT_FIELD;
 exports.SOURCE_DEVICE_TYPES = require_composition.SOURCE_DEVICE_TYPES;
 exports.SOURCE_INFO_METADATA_KEY = SOURCE_INFO_METADATA_KEY;
+exports.SSO_STATE_COOKIE = SSO_STATE_COOKIE;
+exports.SSO_STATE_COOKIE_MAX_AGE_SEC = SSO_STATE_COOKIE_MAX_AGE_SEC;
 exports.STATE_LABELS = STATE_LABELS;
 exports.STATE_LABEL_KEYS = STATE_LABEL_KEYS;
 exports.STATIONARY_OVERLAY_STYLE = STATIONARY_OVERLAY_STYLE;
@@ -78912,6 +80245,8 @@ exports.TAXONOMY_COLORS = TAXONOMY_COLORS;
 exports.TIMELAPSE_DENSE_FLOOR_SEC = TIMELAPSE_DENSE_FLOOR_SEC;
 exports.TIMEZONES = TIMEZONES;
 exports.TRACK_RELATIONS_DEFAULT_LIMIT = TRACK_RELATIONS_DEFAULT_LIMIT;
+exports.TRAINING_JOB_SCHEMA = TRAINING_JOB_SCHEMA;
+exports.TRAINING_RESULT_SCHEMA = TRAINING_RESULT_SCHEMA;
 exports.TRANSCODE_DOWN_MAX_BITRATE_KBPS = TRANSCODE_DOWN_MAX_BITRATE_KBPS;
 exports.TRANSCODE_DOWN_MAX_HEIGHT = TRANSCODE_DOWN_MAX_HEIGHT;
 exports.TamperStatusSchema = TamperStatusSchema;
@@ -78955,8 +80290,36 @@ exports.TrackSourceSchema = TrackSourceSchema;
 exports.TrackStateSchema = TrackStateSchema;
 exports.TrackZoneFilterSchema = TrackZoneFilterSchema;
 exports.TrackedDetectionSchema = TrackedDetectionSchema;
+exports.TrainerSourceRefSchema = TrainerSourceRefSchema;
+exports.TrainingBaseModelSchema = TrainingBaseModelSchema;
+exports.TrainingCanarySchema = TrainingCanarySchema;
+exports.TrainingCatalogDraftSchema = TrainingCatalogDraftSchema;
+exports.TrainingCredentialCheckSchema = TrainingCredentialCheckSchema;
+exports.TrainingDatasetVersionRowSchema = TrainingDatasetVersionRowSchema;
+exports.TrainingEvalClassSchema = TrainingEvalClassSchema;
+exports.TrainingEvalReportSchema = TrainingEvalReportSchema;
+exports.TrainingEventSchema = TrainingEventSchema;
 exports.TrainingExportDeviceTotalsSchema = TrainingExportDeviceTotalsSchema;
+exports.TrainingExportSchema = TrainingExportSchema;
 exports.TrainingExportSummarySchema = TrainingExportSummarySchema;
+exports.TrainingFailureReasonSchema = TrainingFailureReasonSchema;
+exports.TrainingGpuOptionSchema = TrainingGpuOptionSchema;
+exports.TrainingJobPlanSchema = TrainingJobPlanSchema;
+exports.TrainingJobRequestSchema = TrainingJobRequestSchema;
+exports.TrainingJobSchema = TrainingJobSchema;
+exports.TrainingJobSpecSchema = TrainingJobSpecSchema;
+exports.TrainingJobStateSchema = TrainingJobStateSchema;
+exports.TrainingLogLineSchema = TrainingLogLineSchema;
+exports.TrainingPresetSchema = TrainingPresetSchema;
+exports.TrainingProgressPointSchema = TrainingProgressPointSchema;
+exports.TrainingProviderDefaultsSchema = TrainingProviderDefaultsSchema;
+exports.TrainingProviderDescriptorSchema = TrainingProviderDescriptorSchema;
+exports.TrainingRefusalReasonSchema = TrainingRefusalReasonSchema;
+exports.TrainingRegionOptionSchema = TrainingRegionOptionSchema;
+exports.TrainingResultFileSchema = TrainingResultFileSchema;
+exports.TrainingResultSchema = TrainingResultSchema;
+exports.TrainingSplitPlanSchema = TrainingSplitPlanSchema;
+exports.TrainingStageSchema = TrainingStageSchema;
 exports.TransportPlaneCountsSchema = TransportPlaneCountsSchema;
 exports.TransportPlaneSchema = TransportPlaneSchema;
 exports.TurnServerSchema = TurnServerSchema;
@@ -79129,6 +80492,7 @@ exports.cameraSensorRefKey = cameraSensorRefKey;
 exports.cameraStreamsCapability = cameraStreamsCapability;
 exports.canConvertUnit = canConvertUnit;
 exports.canonicalEgressPlan = canonicalEgressPlan;
+exports.canonicalizeAppCallback = canonicalizeAppCallback;
 exports.capacitySessionsOf = capacitySessionsOf;
 exports.carbonMonoxideCapability = carbonMonoxideCapability;
 exports.cellsToRects = cellsToRects;
@@ -79362,6 +80726,7 @@ exports.gifFromMp4Args = gifFromMp4Args;
 exports.globalSecretScope = require_sleep.globalSecretScope;
 exports.hasModelBoundOverrides = hasModelBoundOverrides;
 exports.hasMotionTrigger = hasMotionTrigger;
+exports.hasUrlScheme = hasUrlScheme;
 exports.hfModelUrl = hfModelUrl;
 exports.htmlToText = htmlToText;
 exports.hubAddressHostname = hubAddressHostname;
@@ -79542,6 +80907,7 @@ exports.osdManagerCapability = osdManagerCapability;
 exports.overlayClusterStepSettings = overlayClusterStepSettings;
 exports.packagePickerItems = packagePickerItems;
 exports.parseAdminBase = parseAdminBase;
+exports.parseAppAuthCallback = parseAppAuthCallback;
 exports.parseCameraStreamConfig = parseCameraStreamConfig;
 exports.parseExpression = require_composition.parseExpression;
 exports.parseJsonArray = require_sleep.parseJsonArray;
@@ -79557,6 +80923,7 @@ exports.parseSecretStatePath = require_sleep.parseSecretStatePath;
 exports.parseSessionPlacementPolicy = parseSessionPlacementPolicy;
 exports.parseShareSource = parseShareSource;
 exports.parseStreamParamsFormPatch = parseStreamParamsFormPatch;
+exports.parseTrainingEventLine = parseTrainingEventLine;
 exports.patchAudio = patchAudio;
 exports.petFeederCapability = petFeederCapability;
 exports.pickAccessoryControl = pickAccessoryControl;
@@ -79788,6 +81155,8 @@ exports.toStreamSourceEntry = toStreamSourceEntry;
 exports.toastCapability = toastCapability;
 exports.toggleAudioLabel = toggleAudioLabel;
 exports.tokenize = require_composition.tokenize;
+exports.trainingCapability = trainingCapability;
+exports.trainingProviderCapability = trainingProviderCapability;
 exports.transcodeBody = transcodeBody;
 exports.transformSecretWrite = require_sleep.transformSecretWrite;
 exports.tryConvertUnit = tryConvertUnit;