camstack 1.2.181 → 1.2.182

package/dist/{chunk-4MQR56VQ.js → chunk-6MF6DVWI.js}

@@ -14681,7 +14681,7 @@ function date4(params) {
 // ../../node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../types/dist/sleep-DujUvOcb.mjs
+// ../types/dist/sleep-r3RWkGVx.mjs
 var AUDIO_CHUNK_FORMATS = [
   "f32le",
   "pcmu",
@@ -16554,6 +16554,254 @@ var CameraSwitchGroupSchema = external_exports.object({
   /** Unix ms when the group was composed server-side. */
   fetchedAt: external_exports.number()
 });
+var TRAINING_JOB_SCHEMA = "camstack.training/v1";
+var TRAINING_RESULT_SCHEMA = "camstack.training-result/v1";
+var TrainingExportSchema = external_exports.enum([
+  "onnx",
+  "openvino-fp16",
+  "openvino-int8",
+  "coreml-fp16"
+]);
+var FloorsSchema = external_exports.record(external_exports.string(), external_exports.number().min(0).max(1));
+var TrainingJobSpecSchema = external_exports.object({
+  schema: external_exports.literal(TRAINING_JOB_SCHEMA),
+  jobKey: external_exports.string().uuid(),
+  target: external_exports.object({
+    kind: external_exports.literal("detector"),
+    step: external_exports.literal("object-detection")
+  }),
+  base: external_exports.object({
+    modelId: external_exports.string().min(1),
+    /** Ultralytics weights id, e.g. `yolov9m.pt`. */
+    weights: external_exports.string().min(1),
+    imgsz: external_exports.number().int().positive()
+  }),
+  baseline: external_exports.object({
+    modelId: external_exports.string().min(1),
+    /** The baseline ONNX the holdout comparison runs; public mirror URL. */
+    onnxUrl: external_exports.string().url(),
+    imgsz: external_exports.number().int().positive(),
+    floors: FloorsSchema
+  }),
+  dataset: external_exports.object({
+    versionId: external_exports.string().min(1),
+    annotationHash: external_exports.string(),
+    /** sha256 of the uploaded archive; the trainer refuses a mismatch (exit 65). */
+    sha256: external_exports.string().regex(/^[0-9a-f]{64}$/)
+  }),
+  split: external_exports.object({
+    holdoutCameras: external_exports.array(external_exports.number().int()),
+    /** When no camera is held out: the last N days of every camera. */
+    holdoutLastDays: external_exports.number().int().nonnegative(),
+    valFraction: external_exports.number().min(0).max(0.5),
+    seed: external_exports.number().int()
+  }),
+  hyper: external_exports.object({
+    epochs: external_exports.number().int().positive(),
+    batch: external_exports.number().int().positive(),
+    lr0: external_exports.number().positive(),
+    /** Layers frozen from the start of the backbone; 0 = none. */
+    freeze: external_exports.number().int().nonnegative(),
+    patience: external_exports.number().int().nonnegative(),
+    seed: external_exports.number().int()
+  }),
+  replay: external_exports.object({
+    source: external_exports.literal("coco2017"),
+    count: external_exports.number().int().nonnegative()
+  }),
+  exports: external_exports.array(TrainingExportSchema).min(1),
+  calibration: external_exports.object({ maxFrames: external_exports.number().int().positive() }),
+  floors: external_exports.object({
+    minSupport: external_exports.number().int().positive(),
+    clamp: external_exports.number().min(0).max(1)
+  }),
+  int8Gate: external_exports.object({ maxMap50Drop: external_exports.number().min(0).max(1) }),
+  catalog: external_exports.object({
+    id: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{2,80}$/),
+    name: external_exports.string().min(1).max(160)
+  })
+});
+var TrainingResultFileSchema = external_exports.object({
+  path: external_exports.string().min(1),
+  bytes: external_exports.number().int().nonnegative(),
+  sha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  format: external_exports.enum([
+    "onnx",
+    "openvino",
+    "coreml",
+    "pt"
+  ]),
+  variant: external_exports.enum(["base", "int8"])
+});
+var DraftFormatSchema = external_exports.object({
+  /** RELATIVE path inside the bundle; the hub rewrites it to `camstack-local://`. */
+  url: external_exports.string().min(1),
+  sizeMB: external_exports.number().nonnegative(),
+  isDirectory: external_exports.boolean().optional(),
+  files: external_exports.array(external_exports.string()).optional(),
+  runtimes: external_exports.array(external_exports.literal("python")).optional(),
+  revision: external_exports.string().min(1)
+});
+var TrainingCatalogDraftSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  name: external_exports.string().min(1),
+  description: external_exports.string(),
+  labels: external_exports.array(external_exports.unknown()),
+  inputSize: external_exports.object({
+    width: external_exports.number().int().positive(),
+    height: external_exports.number().int().positive()
+  }),
+  preprocessMode: external_exports.literal("letterbox"),
+  defaultClassFloors: FloorsSchema,
+  formats: external_exports.object({
+    onnx: DraftFormatSchema.optional(),
+    openvino: DraftFormatSchema.optional(),
+    coreml: DraftFormatSchema.optional()
+  })
+});
+var TrainingEvalClassSchema = external_exports.object({
+  positives: external_exports.number().int(),
+  floor: external_exports.number().nullable(),
+  tp: external_exports.number().int(),
+  fp: external_exports.number().int(),
+  fn: external_exports.number().int(),
+  precision: external_exports.number().nullable(),
+  recall: external_exports.number().nullable(),
+  ap50: external_exports.number().nullable(),
+  recallByCamera: external_exports.record(external_exports.string(), external_exports.number().nullable()).optional(),
+  recallByLight: external_exports.record(external_exports.string(), external_exports.number().nullable()).optional(),
+  fpByCamera: external_exports.record(external_exports.string(), external_exports.number()).optional(),
+  smallFound: external_exports.number().int().optional(),
+  smallTotal: external_exports.number().int().optional()
+}).passthrough();
+var TrainingEvalReportSchema = external_exports.object({
+  frames: external_exports.number().int(),
+  classes: external_exports.record(external_exports.string(), TrainingEvalClassSchema)
+}).passthrough();
+var TrainingResultSchema = external_exports.object({
+  schema: external_exports.literal(TRAINING_RESULT_SCHEMA),
+  jobKey: external_exports.string(),
+  status: external_exports.enum(["succeeded", "failed"]),
+  error: external_exports.object({
+    stage: external_exports.string(),
+    code: external_exports.string(),
+    message: external_exports.string()
+  }).nullable(),
+  trainer: external_exports.object({
+    version: external_exports.string(),
+    revision: external_exports.string()
+  }),
+  toolchain: external_exports.record(external_exports.string(), external_exports.string().nullable()),
+  dataset: external_exports.object({
+    versionId: external_exports.string(),
+    annotationHash: external_exports.string(),
+    sha256: external_exports.string(),
+    frames: external_exports.object({
+      train: external_exports.number().int(),
+      val: external_exports.number().int(),
+      holdout: external_exports.number().int()
+    }),
+    holdoutCameras: external_exports.array(external_exports.number().int()),
+    replayImages: external_exports.number().int()
+  }).optional(),
+  training: external_exports.object({
+    epochsRun: external_exports.number().int(),
+    bestEpoch: external_exports.number().int(),
+    bestMap50: external_exports.number(),
+    bestMap50_95: external_exports.number(),
+    seconds: external_exports.number()
+  }).optional(),
+  evaluation: external_exports.object({
+    holdoutFrames: external_exports.number().int(),
+    baseline: TrainingEvalReportSchema.nullable(),
+    candidate: TrainingEvalReportSchema.nullable(),
+    candidateInt8: TrainingEvalReportSchema.nullable(),
+    recallDeltaByCamera: external_exports.record(external_exports.string(), external_exports.record(external_exports.string(), external_exports.number())).nullable(),
+    map50: external_exports.record(external_exports.string(), external_exports.number().nullable())
+  }).optional(),
+  floors: external_exports.object({
+    baseline: FloorsSchema,
+    candidate: FloorsSchema,
+    candidateInt8: FloorsSchema.nullable(),
+    notes: external_exports.array(external_exports.string())
+  }).optional(),
+  int8: external_exports.object({
+    kept: external_exports.boolean(),
+    map50Fp16: external_exports.number().nullable(),
+    map50Int8: external_exports.number().nullable(),
+    reason: external_exports.string().nullable()
+  }).optional(),
+  exportsDropped: external_exports.array(external_exports.object({
+    export: external_exports.string(),
+    reason: external_exports.string()
+  })).optional(),
+  files: external_exports.array(TrainingResultFileSchema).optional(),
+  bundle: external_exports.object({
+    path: external_exports.literal("bundle.tar"),
+    bytes: external_exports.number().int().nonnegative(),
+    sha256: external_exports.string().regex(/^[0-9a-f]{64}$/)
+  }).nullable().optional(),
+  catalogDraft: external_exports.object({
+    base: TrainingCatalogDraftSchema,
+    int8: TrainingCatalogDraftSchema.nullable()
+  }).nullable().optional(),
+  licence: external_exports.string()
+});
+var TrainingStageSchema = external_exports.enum([
+  "prepare",
+  "replay",
+  "train",
+  "eval",
+  "export",
+  "package"
+]);
+var EventBase = {
+  v: external_exports.literal(1),
+  ts: external_exports.number()
+};
+var TrainingEventSchema = external_exports.discriminatedUnion("type", [
+  external_exports.object({
+    ...EventBase,
+    type: external_exports.literal("stage"),
+    stage: TrainingStageSchema
+  }),
+  external_exports.object({
+    ...EventBase,
+    type: external_exports.literal("epoch"),
+    epoch: external_exports.number().int(),
+    epochs: external_exports.number().int(),
+    boxLoss: external_exports.number().nullable().optional(),
+    map50: external_exports.number().nullable().optional(),
+    map50_95: external_exports.number().nullable().optional(),
+    etaSec: external_exports.number().nullable().optional()
+  }),
+  external_exports.object({
+    ...EventBase,
+    type: external_exports.literal("metric"),
+    name: external_exports.string(),
+    value: external_exports.number()
+  }),
+  external_exports.object({
+    ...EventBase,
+    type: external_exports.literal("artifact"),
+    path: external_exports.string(),
+    bytes: external_exports.number(),
+    sha256: external_exports.string()
+  }),
+  external_exports.object({
+    ...EventBase,
+    type: external_exports.literal("done"),
+    status: external_exports.enum(["succeeded", "failed"]),
+    resultSha256: external_exports.string().nullable().optional()
+  }),
+  external_exports.object({
+    ...EventBase,
+    type: external_exports.literal("error"),
+    stage: external_exports.string(),
+    code: external_exports.string(),
+    message: external_exports.string()
+  })
+]);
 var BirthDecisionVerdictSchema = external_exports.enum([
   "confirmed",
   "suppressed",
@@ -18230,7 +18478,9 @@ var AddonHttpRouteSchema = external_exports.object({
     "authenticated",
     "admin"
   ]).optional(),
-  description: external_exports.string().optional()
+  description: external_exports.string().optional(),
+  /** The hub limits this route per client address before the handler runs. */
+  rateLimit: external_exports.enum(["auth"]).optional()
 });
 var InvokeRequestSchema = external_exports.object({
   method: external_exports.string(),
@@ -18940,6 +19190,26 @@ var BackupDestinationInfoSchema = external_exports.object({
   */
   lastError: external_exports.string().optional()
 });
+var BackupArchiveEncryptionSchema = external_exports.object({
+  /** `x25519-hkdf-aes256gcm-stream-v1`. */
+  scheme: external_exports.string(),
+  /** 16 hex — the backup key whose secret restores this archive. */
+  keyId: external_exports.string()
+});
+var BackupEncryptionStatusSchema = external_exports.object({
+  enabled: external_exports.boolean(),
+  active: external_exports.object({
+    keyId: external_exports.string(),
+    publicKey: external_exports.string(),
+    createdAt: external_exports.number()
+  }).nullable(),
+  /** Every key ever set up, newest first. */
+  keys: external_exports.array(external_exports.object({
+    keyId: external_exports.string(),
+    createdAt: external_exports.number(),
+    retiredAt: external_exports.number().nullable()
+  })).readonly()
+});
 var BackupArchiveEntrySchema = external_exports.object({
   id: external_exports.string(),
   filename: external_exports.string(),
@@ -18947,7 +19217,9 @@ var BackupArchiveEntrySchema = external_exports.object({
   sizeBytes: external_exports.number(),
   label: external_exports.string().optional(),
   /** Top-level locations included in the archive (db, addons, tls, …). */
-  locations: external_exports.array(external_exports.string()).readonly()
+  locations: external_exports.array(external_exports.string()).readonly(),
+  /** Present when the archive is encrypted; restore then needs that key. */
+  encryption: BackupArchiveEncryptionSchema.optional()
 });
 var BackupEntrySchema = external_exports.object({
   id: external_exports.string(),
@@ -18956,7 +19228,8 @@ var BackupEntrySchema = external_exports.object({
   label: external_exports.string().optional(),
   createdAt: external_exports.number(),
   sizeBytes: external_exports.number(),
-  locations: external_exports.array(external_exports.string()).optional()
+  locations: external_exports.array(external_exports.string()).optional(),
+  encryption: BackupArchiveEncryptionSchema.optional()
 });
 var ArchiveEntrySchema = external_exports.object({
   path: external_exports.string(),
@@ -19169,11 +19442,58 @@ var backupCapability = {
       * this list and skips entries whose path doesn't start with
       * any of them.
       */
-      locations: external_exports.array(external_exports.string()).optional()
+      locations: external_exports.array(external_exports.string()).optional(),
+      /**
+      * The backup SECRET key, for an encrypted archive (ignored for a plain
+      * one). The archive is decrypted into the hub's private staging
+      * before the restart; the key is not stored. A wrong or missing key
+      * is refused before the archive is downloaded.
+      */
+      backupSecretKey: external_exports.string().optional()
     }), external_exports.void(), {
       kind: "mutation",
       auth: "admin"
     }),
+    /** The encryption setting — public keys only. */
+    getEncryption: method(external_exports.void(), BackupEncryptionStatusSchema, { auth: "admin" }),
+    /**
+    * Turn encryption on, or replace the key: generates a new key pair, keeps
+    * the PUBLIC key, and returns the SECRET key — once. It is never stored
+    * on the hub and cannot be shown again; archives made from now on need
+    * it to be restored. A previous key is retired: archives made with it
+    * still need IT.
+    */
+    setupEncryption: method(external_exports.object({}), external_exports.object({
+      keyId: external_exports.string(),
+      secretKey: external_exports.string(),
+      publicKey: external_exports.string(),
+      createdAt: external_exports.number(),
+      replacedKeyId: external_exports.string().nullable()
+    }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** New archives are plain again. Existing encrypted archives keep needing their key. */
+    disableEncryption: method(external_exports.object({}), external_exports.object({ disabledKeyId: external_exports.string().nullable() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /**
+    * Does this secret key parse, and which backup key is it? A mutation so
+    * the key never travels in a URL. Nothing is stored.
+    */
+    checkBackupKey: method(external_exports.object({ backupSecretKey: external_exports.string() }), external_exports.object({
+      valid: external_exports.boolean(),
+      keyId: external_exports.string().nullable(),
+      /** The hub knows this key (active or retired). */
+      known: external_exports.boolean(),
+      /** It is the key new archives are encrypted to. */
+      active: external_exports.boolean(),
+      error: external_exports.string().optional()
+    }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
     delete: method(external_exports.object({
       destinationId: external_exports.string(),
       backupId: external_exports.string()
@@ -21121,6 +21441,54 @@ var CustomModelDescriptorSchema = external_exports.object({
   stepId: external_exports.string(),
   entry: ModelCatalogEntrySchema
 });
+var ModelBundleFileSchema = external_exports.object({
+  /** Relative path inside the bundle tar; an mlpackage member is `<x>.mlpackage/<member>`. */
+  path: external_exports.string().min(1),
+  bytes: external_exports.number().int().nonnegative(),
+  sha256: external_exports.string().regex(/^[0-9a-f]{64}$/)
+});
+var ImportModelBundleInputSchema = external_exports.object({
+  /** The registry provider that keeps the model (Model Studio). */
+  addonId: external_exports.string(),
+  stepId: external_exports.string().min(1),
+  /**
+  * The catalog rows to register, complete, every format URL already
+  * `camstack-local://<modelId>/<file>` naming a file of the bundle. One
+  * bundle may carry several rows (a base and its INT8 variant).
+  */
+  entries: external_exports.array(ModelCatalogEntrySchema).min(1).max(4),
+  /** The bundle tar, offered by the producer over `ctx.peerBytes` (same host). */
+  bundle: external_exports.object({
+    ticket: PeerBytesTicketSchema,
+    bytes: external_exports.number().int().positive(),
+    sha256: external_exports.string().regex(/^[0-9a-f]{64}$/)
+  }),
+  /** Every file the tar must hold; anything missing, extra or different is refused. */
+  files: external_exports.array(ModelBundleFileSchema).min(1).max(64),
+  /** Convert missing engine formats and push the model to every agent afterwards. */
+  distribute: external_exports.boolean()
+});
+var ImportModelBundleResultSchema = external_exports.discriminatedUnion("kind", [external_exports.object({
+  kind: external_exports.literal("imported"),
+  modelIds: external_exports.array(external_exports.string()).readonly(),
+  distributed: external_exports.array(external_exports.object({
+    modelId: external_exports.string(),
+    nodeId: external_exports.string(),
+    format: external_exports.enum(MODEL_FORMATS),
+    ok: external_exports.boolean(),
+    error: external_exports.string().optional()
+  })).readonly()
+}), external_exports.object({
+  kind: external_exports.literal("refused"),
+  reason: external_exports.enum([
+    "transfer-failed",
+    "checksum-mismatch",
+    "bundle-mismatch",
+    "invalid-entry",
+    "id-taken"
+  ]),
+  detail: external_exports.string()
+})]);
 var customModelRegistryCapability = {
   name: "custom-model-registry",
   scope: "system",
@@ -21136,7 +21504,22 @@ var customModelRegistryCapability = {
     * `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
     * never tRPC — so `auth: 'admin'` costs it nothing.
     */
-    listModels: method(external_exports.void(), external_exports.array(CustomModelDescriptorSchema).readonly(), { auth: "admin" })
+    listModels: method(external_exports.void(), external_exports.array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }),
+    /**
+    * Register a model whose files arrive as ONE bundle tar (D806): the tar
+    * is taken over `ctx.peerBytes`, checked against `bundle.sha256` and
+    * every row of `files`, unpacked into the hub's flat modelsDir (directory
+    * formats included), each format's `.revision` record written, the rows
+    * upserted under the operator's name, the hub marked available and —
+    * when asked — engine formats converted and the model distributed. A
+    * model id already registered by another source is refused, never
+    * overwritten.
+    */
+    importModelBundle: method(ImportModelBundleInputSchema, ImportModelBundleResultSchema, {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 30 * 6e4
+    })
   }
 };
 var QueryFilterSchema = external_exports.object({
@@ -21772,6 +22155,31 @@ var KeychainKeySourceSchema = external_exports.object({
   */
   sharesBackupWithDatabase: external_exports.boolean()
 });
+var KeychainResetRecordSchema = external_exports.object({
+  id: external_exports.string(),
+  at: external_exports.number(),
+  /** `user:<id>` or {@link KEYCHAIN_RESET_TRIGGER_ACTOR}. */
+  actor: external_exports.string(),
+  /** Why the keychain was locked when it was reset; `null` when it was not locked. */
+  lockedReason: external_exports.string().nullable(),
+  /** Values moved into the archive table (ciphertext under the lost key). */
+  archived: external_exports.number().int(),
+  /** `keychain:secrets-orphaned-<ts>`, or `null` when nothing was stored. */
+  archivedCollection: external_exports.string().nullable(),
+  /**
+  * `keychain:keys-orphaned-<ts>`: the wrapped data keys of the archive, kept
+  * so the archive can still be opened if the lost master key turns up.
+  */
+  archivedKeysCollection: external_exports.string().nullable(),
+  /**
+  * `system-settings` keys whose marker the reset cleared — the cluster
+  * secret's: a marker left pointing at an archived value would refuse every
+  * agent forever (D797).
+  */
+  clearedSettingsKeys: external_exports.array(external_exports.string()).readonly(),
+  /** When an operator dismissed the notice on the Secrets page; `null` until then. */
+  acknowledgedAt: external_exports.number().nullable()
+});
 var KeychainStatusSchema = external_exports.object({
   keychain: KeychainStateSchema,
   /** The source of the master key in use; `null` while locked. */
@@ -21789,7 +22197,9 @@ var KeychainStatusSchema = external_exports.object({
   /** Wrapped copies of the data key under a previous master key, kept until purged. */
   retiredWraps: external_exports.number().int(),
   recoveryKeyDownloadedAt: external_exports.number().nullable(),
-  secretCount: external_exports.number().int()
+  secretCount: external_exports.number().int(),
+  /** The most recent reset, acknowledged or not; `null` when the keychain was never reset. */
+  lastReset: KeychainResetRecordSchema.nullable()
 });
 var KeychainSecretUsageSchema = external_exports.enum([
   "in-use",
@@ -21806,13 +22216,14 @@ var KeychainAuditActionSchema = external_exports.enum([
   "download-recovery-key",
   "delete-orphans",
   "reset",
+  "acknowledge-reset",
   "initialize"
 ]);
 var KeychainAuditEntrySchema = external_exports.object({
   id: external_exports.string(),
   at: external_exports.number(),
   action: KeychainAuditActionSchema,
-  /** `addon:<id>` | `user:<id>` | `system`. */
+  /** `addon:<id>` | `user:<id>` | `system` | `trigger-file`. */
   actor: external_exports.string(),
   ref: external_exports.string().nullable(),
   detail: external_exports.string().nullable()
@@ -21916,6 +22327,21 @@ var keychainAdminCapability = {
       kind: "mutation",
       auth: "admin",
       caller: "required"
+    }),
+    /**
+    * What the last reset left to re-enter: the archived refs (owner, scope,
+    * field — never a value) that hold no value again yet. Process-held refs
+    * the hub regenerates itself (the session signing key) are not listed.
+    */
+    resetReport: method(external_exports.object({}), external_exports.object({
+      reset: KeychainResetRecordSchema.nullable(),
+      pendingReentry: external_exports.array(KeychainSecretMetaSchema).readonly()
+    }), { auth: "admin" }),
+    /** Dismiss the "keychain was reset" notice. Audited. */
+    acknowledgeReset: method(external_exports.object({}), external_exports.object({ acknowledged: external_exports.boolean() }), {
+      kind: "mutation",
+      auth: "admin",
+      caller: "required"
     })
   }
 };
@@ -25066,7 +25492,7 @@ var RedirectLoginMethodSchema = external_exports.object({
   * The provider names an external identity a signed-in user can link to
   * their own account (D782): `auth.listLinkableProviders` /
   * `beginExternalLink` offer exactly the redirect methods that set this,
-  * whatever their id. Absent / false — a login button only (magic-link).
+  * whatever their id. Absent / false — a login button only.
   */
   linkable: external_exports.boolean().optional()
 });
@@ -31001,6 +31427,26 @@ var pipelineAnalyticsCapability = {
       auth: "admin",
       timeoutMs: 60 * 6e4
     }),
+    /**
+    * OFFER the annotated archive instead of pushing it (D805): the same tar
+    * `writeRetrainArchive` streams, behind a one-shot `ctx.peerBytes` ticket
+    * the caller dials at once (same host). For a consumer that cannot expose
+    * an upload URL — a training provider streaming straight into its cloud.
+    * The answer is the plan; the bytes and their sha256 are the consumer's
+    * to measure as they arrive.
+    */
+    offerRetrainArchive: method(external_exports.object({
+      filter: RetrainExportFilterSchema,
+      layout: RetrainExportLayoutSchema
+    }), external_exports.object({
+      ticket: PeerBytesTicketSchema,
+      frames: external_exports.number().int(),
+      annotations: external_exports.number().int()
+    }), {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 12e4
+    }),
     /** The counts a selection would freeze — class × camera × day/night,
     *  completeness — without freezing anything. Index reads only. */
     previewRetrainDataset: method(external_exports.object({
@@ -35510,7 +35956,14 @@ var SsoBridgeClaimsSchema = external_exports.object({
   * Verified `iss` of the id_token behind an OIDC login bridge (D782). A
   * subject is unique only per issuer, so a link is bound to it.
   */
-  issuer: external_exports.string().optional()
+  issuer: external_exports.string().optional(),
+  /**
+  * SHA-256 (hex) of the `camstack_sso_state` cookie the IdP `/start` set in
+  * the browser that began this sign-in. `/api/auth/sso/finish` requires the
+  * request to present the matching cookie — a login bridge is useless in
+  * any other browser.
+  */
+  browserBinding: external_exports.string().optional()
 });
 var ssoBridgeCapability = {
   name: "sso-bridge",
@@ -35528,7 +35981,7 @@ var ssoBridgeCapability = {
     * `/api/auth/sso/finish` to become admin — a full privilege escalation
     * through the exact surface this cap exists to close (see the module
     * docblock). Every real caller (`oauth-grants.ts`, `main.ts`
-    * registration, the OIDC/magic-link addons) reaches this through
+    * registration, the OIDC addon) reaches this through
     * `ctx.api` / the in-process registry — never through tRPC — so
     * `auth: 'admin'` costs those callers nothing.
     */
@@ -47057,16 +47510,6 @@ var ApiKeySummarySchema = external_exports.object({
   createdAt: external_exports.number(),
   lastUsedAt: external_exports.number().optional()
 });
-var CreateApiKeyInputSchema = external_exports.object({
-  label: external_exports.string(),
-  isAdmin: external_exports.boolean().default(false),
-  allowedProviders: external_exports.union([external_exports.array(external_exports.string()), external_exports.literal("*")]).optional(),
-  allowedDevices: external_exports.record(external_exports.string(), external_exports.union([external_exports.array(external_exports.string()), external_exports.literal("*")])).optional()
-});
-var CreateApiKeyResultSchema = external_exports.object({
-  token: external_exports.string(),
-  record: ApiKeySummarySchema
-});
 var ScopedTokenSummarySchema = external_exports.object({
   id: external_exports.string(),
   userId: external_exports.string(),
@@ -47168,20 +47611,11 @@ var userManagementCapability = {
       access: "view"
     }),
     listApiKeys: method(external_exports.void(), external_exports.array(ApiKeySummarySchema), { auth: "admin" }),
-    createApiKey: method(CreateApiKeyInputSchema, CreateApiKeyResultSchema, {
-      kind: "mutation",
-      auth: "admin",
-      access: "create"
-    }),
     revokeApiKey: method(external_exports.object({ id: external_exports.string() }), external_exports.object({ success: external_exports.literal(true) }), {
       kind: "mutation",
       auth: "admin",
       access: "delete"
     }),
-    validateApiKey: method(external_exports.object({ token: external_exports.string() }), ApiKeySummarySchema.nullable(), {
-      kind: "mutation",
-      access: "view"
-    }),
     createScopedToken: method(CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, {
       kind: "mutation",
       auth: "admin",
@@ -47271,20 +47705,6 @@ var userManagementCapability = {
       userId: external_exports.string(),
       issuer: external_exports.string()
     }).nullable(), { auth: "admin" }),
-    /**
-    * Link `(provider, subject)` to `userId`. Idempotent for the same user;
-    * REFUSES (throws) an identity already linked to another user, and a
-    * user that does not exist.
-    */
-    linkExternalIdentity: method(ExternalIdentityKeySchema.extend({
-      userId: external_exports.string(),
-      issuer: external_exports.string().min(1),
-      label: external_exports.string().optional()
-    }), external_exports.object({ success: external_exports.literal(true) }), {
-      kind: "mutation",
-      auth: "admin",
-      access: "create"
-    }),
     /** Remove one link of `userId`. `success: false` when it was not linked to that user. */
     unlinkExternalIdentity: method(ExternalIdentityKeySchema.extend({ userId: external_exports.string() }), external_exports.object({ success: external_exports.boolean() }), {
       kind: "mutation",
@@ -47815,6 +48235,472 @@ var zoneRulesCapability = {
   */
   durability: "restored"
 };
+var TrainingGpuOptionSchema = external_exports.object({
+  id: external_exports.string(),
+  label: external_exports.string(),
+  /** List price, USD per GPU-hour, before any region multiplier. */
+  usdPerHour: external_exports.number().nonnegative(),
+  vramGb: external_exports.number().nonnegative()
+});
+var TrainingRegionOptionSchema = external_exports.object({
+  /** `''` = any region (the provider's choice). */
+  id: external_exports.string(),
+  label: external_exports.string(),
+  priceMultiplier: external_exports.number().positive()
+});
+var TrainingProviderDefaultsSchema = external_exports.object({
+  gpuType: external_exports.string(),
+  region: external_exports.string(),
+  costCapUsd: external_exports.number().nonnegative(),
+  maxRuntimeSec: external_exports.number().int().positive(),
+  /** Hours a FAILED job's cloud dataset is kept for debugging; 0 = delete at once. */
+  failedDatasetGraceHours: external_exports.number().nonnegative()
+});
+var TrainingProviderDescriptorSchema = external_exports.object({
+  addonId: external_exports.string(),
+  /** `modal`, `runpod`, `fake`, … */
+  kind: external_exports.string(),
+  label: external_exports.string(),
+  gpuTypes: external_exports.array(TrainingGpuOptionSchema).readonly(),
+  regions: external_exports.array(TrainingRegionOptionSchema).readonly(),
+  maxDatasetBytes: external_exports.number().int().positive(),
+  maxRuntimeSec: external_exports.number().int().positive(),
+  freeTierNote: external_exports.string().optional(),
+  /** Where the data goes, in one sentence the confirm dialog repeats. */
+  dataResidencyNote: external_exports.string(),
+  /** Credentials are present — never the values. */
+  configured: external_exports.boolean(),
+  defaults: TrainingProviderDefaultsSchema
+});
+var TrainingCredentialCheckSchema = external_exports.object({
+  ok: external_exports.boolean(),
+  /** Workspace / account name, when the provider says. */
+  account: external_exports.string().optional(),
+  reason: external_exports.enum([
+    "missing",
+    "invalid",
+    "forbidden",
+    "network",
+    "quota"
+  ]).optional(),
+  detail: external_exports.string().optional()
+});
+var ProviderJobStateSchema = external_exports.enum([
+  "pending",
+  "starting",
+  "running",
+  "succeeded",
+  "failed",
+  "cancelled",
+  "lost"
+]);
+var ProviderJobStatusSchema = external_exports.object({
+  jobKey: external_exports.string(),
+  providerJobId: external_exports.string().optional(),
+  state: ProviderJobStateSchema,
+  startedAt: external_exports.number().optional(),
+  endedAt: external_exports.number().optional(),
+  exitCode: external_exports.number().int().optional(),
+  failureReason: external_exports.string().optional(),
+  gpuType: external_exports.string(),
+  region: external_exports.string().optional(),
+  billedSeconds: external_exports.number().nonnegative(),
+  costUsd: external_exports.number().nonnegative(),
+  /** True when `costUsd` is runtime × list price, not a billing answer. */
+  costIsEstimate: external_exports.boolean(),
+  lastFetchedAt: external_exports.number()
+});
+var TrainerSourceRefSchema = external_exports.object({
+  /** Hugging Face repo id, e.g. `camstack/camstack-trainer`. */
+  repo: external_exports.string().min(1),
+  /** A commit sha (never a branch) — the job must be reproducible. */
+  revision: external_exports.string().regex(/^[0-9a-f]{7,64}$/)
+});
+var JobRef = {
+  addonId: external_exports.string(),
+  jobKey: external_exports.string().uuid()
+};
+var TrainingLogLineSchema = external_exports.object({
+  ts: external_exports.number(),
+  text: external_exports.string()
+});
+var trainingProviderCapability = {
+  name: "training-provider",
+  scope: "system",
+  mode: "collection",
+  internal: true,
+  methods: {
+    /** Every provider's offer and settings. Concat-fans across providers. */
+    describe: method(external_exports.object({}), external_exports.array(TrainingProviderDescriptorSchema).readonly(), { auth: "admin" }),
+    /** Call the provider with the stored credentials. Never returns them. */
+    validateCredentials: method(external_exports.object({ addonId: external_exports.string() }), TrainingCredentialCheckSchema, {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 3e4
+    }),
+    /** USD range for a run of `gpuSeconds` on `gpuType` in `region`. */
+    estimateJob: method(external_exports.object({
+      addonId: external_exports.string(),
+      gpuType: external_exports.string(),
+      region: external_exports.string(),
+      datasetBytes: external_exports.number().int().nonnegative(),
+      gpuSecondsLow: external_exports.number().nonnegative(),
+      gpuSecondsHigh: external_exports.number().nonnegative()
+    }), external_exports.object({
+      usdLow: external_exports.number().nonnegative(),
+      usdHigh: external_exports.number().nonnegative(),
+      notes: external_exports.array(external_exports.string()).readonly()
+    }), { auth: "admin" }),
+    /**
+    * Take the dataset archive behind `ticket` (minted by pipeline-analytics,
+    * same host) and land it as the job's dataset in the cloud, streamed —
+    * nothing is staged on the hub's disk. Idempotent per `jobKey`: a second
+    * call replaces a partial upload. Answers what actually landed.
+    */
+    uploadDataset: method(external_exports.object({
+      ...JobRef,
+      ticket: PeerBytesTicketSchema
+    }), external_exports.object({
+      bytes: external_exports.number().int().nonnegative(),
+      sha256: external_exports.string()
+    }), {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 120 * 6e4
+    }),
+    /**
+    * Start the trainer on a GPU. Looks the job up by `jobKey` first, so a
+    * retried submit never starts a second GPU. `jobSpecJson` is written next
+    * to the dataset as `job.json`; `maxRuntimeSec` is enforced by the
+    * provider (a hard timeout), not by the hub.
+    */
+    submitJob: method(external_exports.object({
+      ...JobRef,
+      trainer: TrainerSourceRefSchema,
+      jobSpecJson: external_exports.string().min(2).max(64e3),
+      gpuType: external_exports.string(),
+      region: external_exports.string(),
+      maxRuntimeSec: external_exports.number().int().positive()
+    }), ProviderJobStatusSchema, {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 30 * 6e4
+    }),
+    getJob: method(external_exports.object(JobRef), ProviderJobStatusSchema, {
+      auth: "admin",
+      timeoutMs: 6e4
+    }),
+    /** Stdout/stderr since `cursor` (opaque), oldest first, at most `max` lines. */
+    listJobEvents: method(external_exports.object({
+      ...JobRef,
+      cursor: external_exports.string().optional(),
+      max: external_exports.number().int().min(1).max(500)
+    }), external_exports.object({
+      lines: external_exports.array(TrainingLogLineSchema).readonly(),
+      cursor: external_exports.string()
+    }), {
+      auth: "admin",
+      timeoutMs: 6e4
+    }),
+    /** Stop the job. Idempotent: an unknown or finished job is a no-op. */
+    cancelJob: method(external_exports.object(JobRef), external_exports.object({ ok: external_exports.literal(true) }), {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 6e4
+    }),
+    /** The job's `result.json`, as text (small, JSON). `found: false` before it exists. */
+    readResult: method(external_exports.object(JobRef), external_exports.object({
+      found: external_exports.boolean(),
+      text: external_exports.string().optional()
+    }), {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 5 * 6e4
+    }),
+    /**
+    * Offer one output file of the job (`bundle.tar`) to the caller as a
+    * one-shot `ctx.peerBytes` ticket, streamed from the cloud — the provider
+    * stages nothing on disk. The caller dials it at once.
+    */
+    offerArtifact: method(external_exports.object({
+      ...JobRef,
+      path: external_exports.enum(["bundle.tar"])
+    }), external_exports.object({ ticket: PeerBytesTicketSchema }), {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 5 * 6e4
+    }),
+    /** Delete every cloud object tagged with `jobKey` (the dataset first). Idempotent. */
+    cleanupJob: method(external_exports.object(JobRef), external_exports.object({ deleted: external_exports.array(external_exports.string()).readonly() }), {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 5 * 6e4
+    }),
+    /** Every job the provider can still see — the orphan sweep diffs it against our records. */
+    listJobs: method(external_exports.object({ addonId: external_exports.string() }), external_exports.array(ProviderJobStatusSchema).readonly(), {
+      auth: "admin",
+      timeoutMs: 2 * 6e4
+    })
+  }
+};
+var TrainingDatasetVersionRowSchema = RetrainDatasetVersionSchema.omit({ frameCount: true }).extend({ frameIds: external_exports.array(external_exports.string()).max(2e4).readonly() });
+var TrainingBaseModelSchema = external_exports.object({
+  modelId: external_exports.string(),
+  label: external_exports.string(),
+  weights: external_exports.string(),
+  imgsz: external_exports.number().int(),
+  baselineOnnxUrl: external_exports.string(),
+  baselineFloors: external_exports.record(external_exports.string(), external_exports.number()),
+  /** The base the fleet runs most — the UI's default. */
+  recommended: external_exports.boolean()
+});
+var TrainingPresetSchema = external_exports.enum([
+  "quick",
+  "standard",
+  "thorough"
+]);
+var TrainingJobRequestSchema = external_exports.object({
+  datasetVersionId: external_exports.string().min(1),
+  /** The `training-provider` addon that runs it. */
+  addonId: external_exports.string().min(1),
+  gpuType: external_exports.string().min(1),
+  region: external_exports.string(),
+  baseModelId: external_exports.string().min(1),
+  preset: TrainingPresetSchema,
+  /** Freeze the backbone's first N layers; `null` = the preset's choice. */
+  freeze: external_exports.number().int().nonnegative().nullable(),
+  /** Cameras held out whole for evaluation; `null` = the orchestrator's default. */
+  holdoutCameras: external_exports.array(external_exports.number().int()).nullable()
+});
+var TrainingSplitPlanSchema = external_exports.object({
+  holdoutCameras: external_exports.array(external_exports.number().int()).readonly(),
+  /** Used when no camera is held out: the last N days of every camera. */
+  holdoutLastDays: external_exports.number().int().nonnegative(),
+  /** Holdout subjects per class (camera holdout only; `null` = known only after the split). */
+  holdoutSupport: external_exports.record(external_exports.string(), external_exports.number().int()).nullable(),
+  trainSubjects: external_exports.number().int()
+});
+var TrainingRefusalReasonSchema = external_exports.enum([
+  "unknown-dataset",
+  "unknown-provider",
+  "provider-not-configured",
+  "unknown-base-model",
+  "unknown-gpu",
+  "dataset-too-large",
+  "no-training-subjects",
+  "job-already-running"
+]);
+var TrainingJobPlanSchema = external_exports.object({
+  refusal: external_exports.object({
+    reason: TrainingRefusalReasonSchema,
+    detail: external_exports.string()
+  }).nullable(),
+  warnings: external_exports.array(external_exports.string()).readonly(),
+  split: TrainingSplitPlanSchema.nullable(),
+  estimate: external_exports.object({
+    datasetBytes: external_exports.number().int(),
+    uploadMinutesAt20Mbps: external_exports.number(),
+    gpuSecondsLow: external_exports.number(),
+    gpuSecondsHigh: external_exports.number(),
+    usdLow: external_exports.number(),
+    usdHigh: external_exports.number(),
+    notes: external_exports.array(external_exports.string()).readonly()
+  }).nullable(),
+  /** Pre-filled from the provider's settings; the operator may lower or raise them. */
+  defaults: external_exports.object({
+    maxCostUsd: external_exports.number(),
+    maxRuntimeSec: external_exports.number().int()
+  }).nullable(),
+  /** The sentence the confirm dialog repeats: where the frames go and when they are deleted. */
+  dataNotice: external_exports.string()
+});
+var TrainingJobStateSchema = external_exports.enum([
+  "uploading",
+  "submitted",
+  "starting",
+  "running",
+  "collecting",
+  "ready",
+  "registered",
+  "canary",
+  "failed",
+  "cancelling",
+  "cancelled",
+  "lost",
+  "expired",
+  "discarded"
+]);
+var TrainingFailureReasonSchema = external_exports.enum([
+  "cost-cap",
+  "runtime-cap",
+  "upload-failed",
+  "submit-failed",
+  "trainer-failed",
+  "result-invalid",
+  "checksum-mismatch",
+  "fetch-failed",
+  "provider-error",
+  "hub-restart-during-upload"
+]);
+var TrainingProgressPointSchema = external_exports.object({
+  epoch: external_exports.number().int(),
+  map50: external_exports.number().nullable(),
+  map50_95: external_exports.number().nullable()
+});
+var TrainingCanarySchema = external_exports.object({
+  deviceIds: external_exports.array(external_exports.number().int()).readonly(),
+  since: external_exports.number(),
+  /** Every override the canary replaced, exactly, so rollback restores it. */
+  previous: external_exports.array(external_exports.object({
+    deviceId: external_exports.number().int(),
+    nodeId: external_exports.string(),
+    deviceKey: external_exports.string(),
+    patch: external_exports.object({
+      modelId: external_exports.string().optional(),
+      settings: external_exports.record(external_exports.string(), external_exports.unknown()).readonly().optional()
+    }).nullable()
+  })).readonly()
+});
+var TrainingJobSchema = external_exports.object({
+  id: external_exports.string(),
+  idempotencyKey: external_exports.string(),
+  name: external_exports.string(),
+  createdAt: external_exports.number(),
+  updatedAt: external_exports.number(),
+  state: TrainingJobStateSchema,
+  stage: TrainingStageSchema.nullable(),
+  failure: external_exports.object({
+    reason: TrainingFailureReasonSchema,
+    stage: external_exports.string().nullable(),
+    detail: external_exports.string()
+  }).nullable(),
+  request: TrainingJobRequestSchema,
+  maxCostUsd: external_exports.number().nonnegative(),
+  maxRuntimeSec: external_exports.number().int().positive(),
+  trainer: TrainerSourceRefSchema,
+  datasetLayout: RetrainExportLayoutSchema,
+  dataset: external_exports.object({
+    bytes: external_exports.number().int(),
+    sha256: external_exports.string(),
+    uploadedAt: external_exports.number()
+  }).nullable(),
+  split: TrainingSplitPlanSchema,
+  provider: external_exports.object({
+    state: ProviderJobStateSchema.nullable(),
+    providerJobId: external_exports.string().nullable(),
+    startedAt: external_exports.number().nullable(),
+    endedAt: external_exports.number().nullable(),
+    billedSeconds: external_exports.number(),
+    costUsd: external_exports.number(),
+    costIsEstimate: external_exports.boolean(),
+    lastPolledAt: external_exports.number().nullable()
+  }),
+  progress: external_exports.object({
+    epoch: external_exports.number().int().nullable(),
+    epochs: external_exports.number().int().nullable(),
+    etaSec: external_exports.number().nullable(),
+    series: external_exports.array(TrainingProgressPointSchema).readonly()
+  }),
+  /** The last lines of the job's output (≤ 200), newest last. Never frame paths. */
+  logTail: external_exports.array(external_exports.string()).readonly(),
+  logCursor: external_exports.string().nullable(),
+  artifacts: external_exports.object({
+    bundleBytes: external_exports.number().int(),
+    bundleSha256: external_exports.string(),
+    fetchedAt: external_exports.number(),
+    /** When the staged artefacts are deleted from the hub. */
+    expiresAt: external_exports.number()
+  }).nullable(),
+  /** When the provider-side copy of the frames was deleted; null while it exists. */
+  cloudDatasetDeletedAt: external_exports.number().nullable(),
+  /** A failed job's dataset is kept until then (the provider's grace), then deleted. */
+  cloudCleanupDueAt: external_exports.number().nullable(),
+  /** Model ids registered from this job (base, and int8 when kept). */
+  registeredModelIds: external_exports.array(external_exports.string()).readonly(),
+  canary: TrainingCanarySchema.nullable()
+});
+var IdInput = external_exports.object({ id: external_exports.string().min(1) });
+var trainingCapability = {
+  name: "training",
+  scope: "system",
+  mode: "singleton",
+  mount: { kind: "hub-only" },
+  methods: {
+    /** Store a version once. `stored: false` = that id already exists (immutable). */
+    putDatasetVersion: method(TrainingDatasetVersionRowSchema, external_exports.object({ stored: external_exports.boolean() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    getDatasetVersion: method(IdInput, TrainingDatasetVersionRowSchema.nullable(), { auth: "admin" }),
+    /** Every version without its frame list, newest first. */
+    listDatasetVersions: method(external_exports.object({}), external_exports.array(RetrainDatasetVersionSchema).readonly(), { auth: "admin" }),
+    findDatasetVersionIdByName: method(external_exports.object({ name: external_exports.string() }), external_exports.object({ id: external_exports.string().nullable() }), { auth: "admin" }),
+    removeDatasetVersion: method(IdInput, external_exports.object({ removed: external_exports.boolean() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    listBaseModels: method(external_exports.object({}), external_exports.array(TrainingBaseModelSchema).readonly(), { auth: "admin" }),
+    /** Split, estimate, defaults and any named refusal — nothing is started. */
+    planJob: method(TrainingJobRequestSchema, TrainingJobPlanSchema, {
+      auth: "admin",
+      timeoutMs: 6e4
+    }),
+    /**
+    * Start a job. The same `idempotencyKey` returns the job it already
+    * started. Answers at once (`uploading`); the upload and the submit run in
+    * the background and the job record says how far they got.
+    */
+    startJob: method(TrainingJobRequestSchema.extend({
+      name: external_exports.string().min(1).max(120),
+      maxCostUsd: external_exports.number().positive(),
+      maxRuntimeSec: external_exports.number().int().positive(),
+      idempotencyKey: external_exports.string().min(8).max(80)
+    }), external_exports.discriminatedUnion("kind", [external_exports.object({
+      kind: external_exports.literal("started"),
+      job: TrainingJobSchema
+    }), external_exports.object({
+      kind: external_exports.literal("refused"),
+      reason: TrainingRefusalReasonSchema,
+      detail: external_exports.string()
+    })]), {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 12e4
+    }),
+    listJobs: method(external_exports.object({}), external_exports.array(TrainingJobSchema).readonly(), { auth: "admin" }),
+    getJob: method(IdInput, TrainingJobSchema.nullable(), { auth: "admin" }),
+    cancelJob: method(IdInput, TrainingJobSchema, {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 12e4
+    }),
+    /** The verified `result.json` of a job in `ready` or later; null before. */
+    getJobResult: method(IdInput, TrainingResultSchema.nullable(), { auth: "admin" }),
+    /** Hand the verified bundle to Model Studio; optionally canary right after. */
+    registerResult: method(IdInput.extend({ canaryDeviceIds: external_exports.array(external_exports.number().int()).readonly() }), TrainingJobSchema, {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 30 * 6e4
+    }),
+    /** Pin the registered model on these cameras, remembering what it replaced. */
+    canaryResult: method(IdInput.extend({ deviceIds: external_exports.array(external_exports.number().int()).min(1).readonly() }), TrainingJobSchema, {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 12e4
+    }),
+    /** Put every canary camera back exactly as it was. */
+    rollbackCanary: method(IdInput, TrainingJobSchema, {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 12e4
+    }),
+    /** Delete the staged artefacts of an unregistered result. */
+    discardResult: method(IdInput, TrainingJobSchema, {
+      kind: "mutation",
+      auth: "admin"
+    })
+  }
+};
 var PIPELINE_FLOW_CAPABILITY_NAMES = [
   "decoder",
   "motion-detection",
@@ -48694,6 +49580,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "backup.checkBackupKey": {
+    capName: "backup",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "backup.delete": {
     capName: "backup",
     capScope: "system",
@@ -48706,6 +49598,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "delete"
   },
+  "backup.disableEncryption": {
+    capName: "backup",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "backup.getEncryption": {
+    capName: "backup",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "backup.getEntries": {
     capName: "backup",
     capScope: "system",
@@ -48760,6 +49664,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "backup.setupEncryption": {
+    capName: "backup",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "backup.trigger": {
     capName: "backup",
     capScope: "system",
@@ -49312,6 +50222,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "customModelRegistry.importModelBundle": {
+    capName: "custom-model-registry",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "customModelRegistry.listModels": {
     capName: "custom-model-registry",
     capScope: "system",
@@ -50752,6 +51668,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "keychainAdmin.acknowledgeReset": {
+    capName: "keychain-admin",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "keychainAdmin.deleteOrphans": {
     capName: "keychain-admin",
     capScope: "system",
@@ -50788,6 +51710,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "delete"
   },
+  "keychainAdmin.resetReport": {
+    capName: "keychain-admin",
+    capScope: "system",
+    addonId: null,
+    access: "delete"
+  },
   "keychainAdmin.reveal": {
     capName: "keychain-admin",
     capScope: "system",
@@ -52534,6 +53462,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "pipelineAnalytics.offerRetrainArchive": {
+    capName: "pipeline-analytics",
+    capScope: "device",
+    addonId: null,
+    access: "create"
+  },
   "pipelineAnalytics.ownersWithMedia": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -55072,6 +56006,174 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "training.canaryResult": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "training.cancelJob": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "training.discardResult": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "training.findDatasetVersionIdByName": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "training.getDatasetVersion": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "training.getJob": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "training.getJobResult": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "training.listBaseModels": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "training.listDatasetVersions": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "training.listJobs": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "training.planJob": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "training.putDatasetVersion": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "training.registerResult": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "training.removeDatasetVersion": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "delete"
+  },
+  "training.rollbackCanary": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "training.startJob": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "trainingProvider.cancelJob": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "trainingProvider.cleanupJob": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "trainingProvider.describe": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "trainingProvider.estimateJob": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "trainingProvider.getJob": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "trainingProvider.listJobEvents": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "trainingProvider.listJobs": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "trainingProvider.offerArtifact": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "trainingProvider.readResult": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "trainingProvider.submitJob": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "trainingProvider.uploadDataset": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "trainingProvider.validateCredentials": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "turnProvider.getTurnServers": {
     capName: "turn-provider",
     capScope: "system",
@@ -55096,12 +56198,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
-  "userManagement.createApiKey": {
-    capName: "user-management",
-    capScope: "system",
-    addonId: null,
-    access: "create"
-  },
   "userManagement.createScopedToken": {
     capName: "user-management",
     capScope: "system",
@@ -55138,12 +56234,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
-  "userManagement.linkExternalIdentity": {
-    capName: "user-management",
-    capScope: "system",
-    addonId: null,
-    access: "create"
-  },
   "userManagement.listApiKeys": {
     capName: "user-management",
     capScope: "system",
@@ -55246,12 +56336,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
-  "userManagement.validateApiKey": {
-    capName: "user-management",
-    capScope: "system",
-    addonId: null,
-    access: "view"
-  },
   "userManagement.validateCredentials": {
     capName: "user-management",
     capScope: "system",
@@ -59407,6 +60491,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
     form: "single",
     optional: false
   }],
+  "training.canaryResult": [{
+    name: "deviceIds",
+    form: "array",
+    optional: false
+  }],
   "update.getStatus": [{
     name: "deviceId",
     form: "single",