camstack 1.2.181 → 1.2.183

package/dist/{chunk-4MQR56VQ.js → chunk-RBYTYOMU.js}

@@ -14681,7 +14681,7 @@ function date4(params) {
 // ../../node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../types/dist/sleep-DujUvOcb.mjs
+// ../types/dist/sleep-DwAQ9sqX.mjs
 var AUDIO_CHUNK_FORMATS = [
   "f32le",
   "pcmu",
@@ -16264,6 +16264,19 @@ var CompositionSchema = external_exports.object({
   });
 });
 
+// ../types/dist/node-color.mjs
+var NODE_COLOR_IDS = [
+  "node-a",
+  "node-b",
+  "node-c",
+  "node-d",
+  "node-e",
+  "node-f",
+  "node-g",
+  "node-h"
+];
+var NodeColorIdSchema = external_exports.enum(NODE_COLOR_IDS);
+
 // ../types/dist/index.mjs
 var MEDIA_OWNER_TYPES = [
   "track",
@@ -16554,6 +16567,254 @@ var CameraSwitchGroupSchema = external_exports.object({
   /** Unix ms when the group was composed server-side. */
   fetchedAt: external_exports.number()
 });
+var TRAINING_JOB_SCHEMA = "camstack.training/v1";
+var TRAINING_RESULT_SCHEMA = "camstack.training-result/v1";
+var TrainingExportSchema = external_exports.enum([
+  "onnx",
+  "openvino-fp16",
+  "openvino-int8",
+  "coreml-fp16"
+]);
+var FloorsSchema = external_exports.record(external_exports.string(), external_exports.number().min(0).max(1));
+var TrainingJobSpecSchema = external_exports.object({
+  schema: external_exports.literal(TRAINING_JOB_SCHEMA),
+  jobKey: external_exports.string().uuid(),
+  target: external_exports.object({
+    kind: external_exports.literal("detector"),
+    step: external_exports.literal("object-detection")
+  }),
+  base: external_exports.object({
+    modelId: external_exports.string().min(1),
+    /** Ultralytics weights id, e.g. `yolov9m.pt`. */
+    weights: external_exports.string().min(1),
+    imgsz: external_exports.number().int().positive()
+  }),
+  baseline: external_exports.object({
+    modelId: external_exports.string().min(1),
+    /** The baseline ONNX the holdout comparison runs; public mirror URL. */
+    onnxUrl: external_exports.string().url(),
+    imgsz: external_exports.number().int().positive(),
+    floors: FloorsSchema
+  }),
+  dataset: external_exports.object({
+    versionId: external_exports.string().min(1),
+    annotationHash: external_exports.string(),
+    /** sha256 of the uploaded archive; the trainer refuses a mismatch (exit 65). */
+    sha256: external_exports.string().regex(/^[0-9a-f]{64}$/)
+  }),
+  split: external_exports.object({
+    holdoutCameras: external_exports.array(external_exports.number().int()),
+    /** When no camera is held out: the last N days of every camera. */
+    holdoutLastDays: external_exports.number().int().nonnegative(),
+    valFraction: external_exports.number().min(0).max(0.5),
+    seed: external_exports.number().int()
+  }),
+  hyper: external_exports.object({
+    epochs: external_exports.number().int().positive(),
+    batch: external_exports.number().int().positive(),
+    lr0: external_exports.number().positive(),
+    /** Layers frozen from the start of the backbone; 0 = none. */
+    freeze: external_exports.number().int().nonnegative(),
+    patience: external_exports.number().int().nonnegative(),
+    seed: external_exports.number().int()
+  }),
+  replay: external_exports.object({
+    source: external_exports.literal("coco2017"),
+    count: external_exports.number().int().nonnegative()
+  }),
+  exports: external_exports.array(TrainingExportSchema).min(1),
+  calibration: external_exports.object({ maxFrames: external_exports.number().int().positive() }),
+  floors: external_exports.object({
+    minSupport: external_exports.number().int().positive(),
+    clamp: external_exports.number().min(0).max(1)
+  }),
+  int8Gate: external_exports.object({ maxMap50Drop: external_exports.number().min(0).max(1) }),
+  catalog: external_exports.object({
+    id: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{2,80}$/),
+    name: external_exports.string().min(1).max(160)
+  })
+});
+var TrainingResultFileSchema = external_exports.object({
+  path: external_exports.string().min(1),
+  bytes: external_exports.number().int().nonnegative(),
+  sha256: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  format: external_exports.enum([
+    "onnx",
+    "openvino",
+    "coreml",
+    "pt"
+  ]),
+  variant: external_exports.enum(["base", "int8"])
+});
+var DraftFormatSchema = external_exports.object({
+  /** RELATIVE path inside the bundle; the hub rewrites it to `camstack-local://`. */
+  url: external_exports.string().min(1),
+  sizeMB: external_exports.number().nonnegative(),
+  isDirectory: external_exports.boolean().optional(),
+  files: external_exports.array(external_exports.string()).optional(),
+  runtimes: external_exports.array(external_exports.literal("python")).optional(),
+  revision: external_exports.string().min(1)
+});
+var TrainingCatalogDraftSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  name: external_exports.string().min(1),
+  description: external_exports.string(),
+  labels: external_exports.array(external_exports.unknown()),
+  inputSize: external_exports.object({
+    width: external_exports.number().int().positive(),
+    height: external_exports.number().int().positive()
+  }),
+  preprocessMode: external_exports.literal("letterbox"),
+  defaultClassFloors: FloorsSchema,
+  formats: external_exports.object({
+    onnx: DraftFormatSchema.optional(),
+    openvino: DraftFormatSchema.optional(),
+    coreml: DraftFormatSchema.optional()
+  })
+});
+var TrainingEvalClassSchema = external_exports.object({
+  positives: external_exports.number().int(),
+  floor: external_exports.number().nullable(),
+  tp: external_exports.number().int(),
+  fp: external_exports.number().int(),
+  fn: external_exports.number().int(),
+  precision: external_exports.number().nullable(),
+  recall: external_exports.number().nullable(),
+  ap50: external_exports.number().nullable(),
+  recallByCamera: external_exports.record(external_exports.string(), external_exports.number().nullable()).optional(),
+  recallByLight: external_exports.record(external_exports.string(), external_exports.number().nullable()).optional(),
+  fpByCamera: external_exports.record(external_exports.string(), external_exports.number()).optional(),
+  smallFound: external_exports.number().int().optional(),
+  smallTotal: external_exports.number().int().optional()
+}).passthrough();
+var TrainingEvalReportSchema = external_exports.object({
+  frames: external_exports.number().int(),
+  classes: external_exports.record(external_exports.string(), TrainingEvalClassSchema)
+}).passthrough();
+var TrainingResultSchema = external_exports.object({
+  schema: external_exports.literal(TRAINING_RESULT_SCHEMA),
+  jobKey: external_exports.string(),
+  status: external_exports.enum(["succeeded", "failed"]),
+  error: external_exports.object({
+    stage: external_exports.string(),
+    code: external_exports.string(),
+    message: external_exports.string()
+  }).nullable(),
+  trainer: external_exports.object({
+    version: external_exports.string(),
+    revision: external_exports.string()
+  }),
+  toolchain: external_exports.record(external_exports.string(), external_exports.string().nullable()),
+  dataset: external_exports.object({
+    versionId: external_exports.string(),
+    annotationHash: external_exports.string(),
+    sha256: external_exports.string(),
+    frames: external_exports.object({
+      train: external_exports.number().int(),
+      val: external_exports.number().int(),
+      holdout: external_exports.number().int()
+    }),
+    holdoutCameras: external_exports.array(external_exports.number().int()),
+    replayImages: external_exports.number().int()
+  }).optional(),
+  training: external_exports.object({
+    epochsRun: external_exports.number().int(),
+    bestEpoch: external_exports.number().int(),
+    bestMap50: external_exports.number(),
+    bestMap50_95: external_exports.number(),
+    seconds: external_exports.number()
+  }).optional(),
+  evaluation: external_exports.object({
+    holdoutFrames: external_exports.number().int(),
+    baseline: TrainingEvalReportSchema.nullable(),
+    candidate: TrainingEvalReportSchema.nullable(),
+    candidateInt8: TrainingEvalReportSchema.nullable(),
+    recallDeltaByCamera: external_exports.record(external_exports.string(), external_exports.record(external_exports.string(), external_exports.number())).nullable(),
+    map50: external_exports.record(external_exports.string(), external_exports.number().nullable())
+  }).optional(),
+  floors: external_exports.object({
+    baseline: FloorsSchema,
+    candidate: FloorsSchema,
+    candidateInt8: FloorsSchema.nullable(),
+    notes: external_exports.array(external_exports.string())
+  }).optional(),
+  int8: external_exports.object({
+    kept: external_exports.boolean(),
+    map50Fp16: external_exports.number().nullable(),
+    map50Int8: external_exports.number().nullable(),
+    reason: external_exports.string().nullable()
+  }).optional(),
+  exportsDropped: external_exports.array(external_exports.object({
+    export: external_exports.string(),
+    reason: external_exports.string()
+  })).optional(),
+  files: external_exports.array(TrainingResultFileSchema).optional(),
+  bundle: external_exports.object({
+    path: external_exports.literal("bundle.tar"),
+    bytes: external_exports.number().int().nonnegative(),
+    sha256: external_exports.string().regex(/^[0-9a-f]{64}$/)
+  }).nullable().optional(),
+  catalogDraft: external_exports.object({
+    base: TrainingCatalogDraftSchema,
+    int8: TrainingCatalogDraftSchema.nullable()
+  }).nullable().optional(),
+  licence: external_exports.string()
+});
+var TrainingStageSchema = external_exports.enum([
+  "prepare",
+  "replay",
+  "train",
+  "eval",
+  "export",
+  "package"
+]);
+var EventBase = {
+  v: external_exports.literal(1),
+  ts: external_exports.number()
+};
+var TrainingEventSchema = external_exports.discriminatedUnion("type", [
+  external_exports.object({
+    ...EventBase,
+    type: external_exports.literal("stage"),
+    stage: TrainingStageSchema
+  }),
+  external_exports.object({
+    ...EventBase,
+    type: external_exports.literal("epoch"),
+    epoch: external_exports.number().int(),
+    epochs: external_exports.number().int(),
+    boxLoss: external_exports.number().nullable().optional(),
+    map50: external_exports.number().nullable().optional(),
+    map50_95: external_exports.number().nullable().optional(),
+    etaSec: external_exports.number().nullable().optional()
+  }),
+  external_exports.object({
+    ...EventBase,
+    type: external_exports.literal("metric"),
+    name: external_exports.string(),
+    value: external_exports.number()
+  }),
+  external_exports.object({
+    ...EventBase,
+    type: external_exports.literal("artifact"),
+    path: external_exports.string(),
+    bytes: external_exports.number(),
+    sha256: external_exports.string()
+  }),
+  external_exports.object({
+    ...EventBase,
+    type: external_exports.literal("done"),
+    status: external_exports.enum(["succeeded", "failed"]),
+    resultSha256: external_exports.string().nullable().optional()
+  }),
+  external_exports.object({
+    ...EventBase,
+    type: external_exports.literal("error"),
+    stage: external_exports.string(),
+    code: external_exports.string(),
+    message: external_exports.string()
+  })
+]);
 var BirthDecisionVerdictSchema = external_exports.enum([
   "confirmed",
   "suppressed",
@@ -18230,7 +18491,9 @@ var AddonHttpRouteSchema = external_exports.object({
     "authenticated",
     "admin"
   ]).optional(),
-  description: external_exports.string().optional()
+  description: external_exports.string().optional(),
+  /** The hub limits this route per client address before the handler runs. */
+  rateLimit: external_exports.enum(["auth"]).optional()
 });
 var InvokeRequestSchema = external_exports.object({
   method: external_exports.string(),
@@ -18940,6 +19203,26 @@ var BackupDestinationInfoSchema = external_exports.object({
   */
   lastError: external_exports.string().optional()
 });
+var BackupArchiveEncryptionSchema = external_exports.object({
+  /** `x25519-hkdf-aes256gcm-stream-v1`. */
+  scheme: external_exports.string(),
+  /** 16 hex — the backup key whose secret restores this archive. */
+  keyId: external_exports.string()
+});
+var BackupEncryptionStatusSchema = external_exports.object({
+  enabled: external_exports.boolean(),
+  active: external_exports.object({
+    keyId: external_exports.string(),
+    publicKey: external_exports.string(),
+    createdAt: external_exports.number()
+  }).nullable(),
+  /** Every key ever set up, newest first. */
+  keys: external_exports.array(external_exports.object({
+    keyId: external_exports.string(),
+    createdAt: external_exports.number(),
+    retiredAt: external_exports.number().nullable()
+  })).readonly()
+});
 var BackupArchiveEntrySchema = external_exports.object({
   id: external_exports.string(),
   filename: external_exports.string(),
@@ -18947,7 +19230,9 @@ var BackupArchiveEntrySchema = external_exports.object({
   sizeBytes: external_exports.number(),
   label: external_exports.string().optional(),
   /** Top-level locations included in the archive (db, addons, tls, …). */
-  locations: external_exports.array(external_exports.string()).readonly()
+  locations: external_exports.array(external_exports.string()).readonly(),
+  /** Present when the archive is encrypted; restore then needs that key. */
+  encryption: BackupArchiveEncryptionSchema.optional()
 });
 var BackupEntrySchema = external_exports.object({
   id: external_exports.string(),
@@ -18956,7 +19241,8 @@ var BackupEntrySchema = external_exports.object({
   label: external_exports.string().optional(),
   createdAt: external_exports.number(),
   sizeBytes: external_exports.number(),
-  locations: external_exports.array(external_exports.string()).optional()
+  locations: external_exports.array(external_exports.string()).optional(),
+  encryption: BackupArchiveEncryptionSchema.optional()
 });
 var ArchiveEntrySchema = external_exports.object({
   path: external_exports.string(),
@@ -19169,11 +19455,58 @@ var backupCapability = {
       * this list and skips entries whose path doesn't start with
       * any of them.
       */
-      locations: external_exports.array(external_exports.string()).optional()
+      locations: external_exports.array(external_exports.string()).optional(),
+      /**
+      * The backup SECRET key, for an encrypted archive (ignored for a plain
+      * one). The archive is decrypted into the hub's private staging
+      * before the restart; the key is not stored. A wrong or missing key
+      * is refused before the archive is downloaded.
+      */
+      backupSecretKey: external_exports.string().optional()
     }), external_exports.void(), {
       kind: "mutation",
       auth: "admin"
     }),
+    /** The encryption setting — public keys only. */
+    getEncryption: method(external_exports.void(), BackupEncryptionStatusSchema, { auth: "admin" }),
+    /**
+    * Turn encryption on, or replace the key: generates a new key pair, keeps
+    * the PUBLIC key, and returns the SECRET key — once. It is never stored
+    * on the hub and cannot be shown again; archives made from now on need
+    * it to be restored. A previous key is retired: archives made with it
+    * still need IT.
+    */
+    setupEncryption: method(external_exports.object({}), external_exports.object({
+      keyId: external_exports.string(),
+      secretKey: external_exports.string(),
+      publicKey: external_exports.string(),
+      createdAt: external_exports.number(),
+      replacedKeyId: external_exports.string().nullable()
+    }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** New archives are plain again. Existing encrypted archives keep needing their key. */
+    disableEncryption: method(external_exports.object({}), external_exports.object({ disabledKeyId: external_exports.string().nullable() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /**
+    * Does this secret key parse, and which backup key is it? A mutation so
+    * the key never travels in a URL. Nothing is stored.
+    */
+    checkBackupKey: method(external_exports.object({ backupSecretKey: external_exports.string() }), external_exports.object({
+      valid: external_exports.boolean(),
+      keyId: external_exports.string().nullable(),
+      /** The hub knows this key (active or retired). */
+      known: external_exports.boolean(),
+      /** It is the key new archives are encrypted to. */
+      active: external_exports.boolean(),
+      error: external_exports.string().optional()
+    }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
     delete: method(external_exports.object({
       destinationId: external_exports.string(),
       backupId: external_exports.string()
@@ -21121,6 +21454,54 @@ var CustomModelDescriptorSchema = external_exports.object({
   stepId: external_exports.string(),
   entry: ModelCatalogEntrySchema
 });
+var ModelBundleFileSchema = external_exports.object({
+  /** Relative path inside the bundle tar; an mlpackage member is `<x>.mlpackage/<member>`. */
+  path: external_exports.string().min(1),
+  bytes: external_exports.number().int().nonnegative(),
+  sha256: external_exports.string().regex(/^[0-9a-f]{64}$/)
+});
+var ImportModelBundleInputSchema = external_exports.object({
+  /** The registry provider that keeps the model (Model Studio). */
+  addonId: external_exports.string(),
+  stepId: external_exports.string().min(1),
+  /**
+  * The catalog rows to register, complete, every format URL already
+  * `camstack-local://<modelId>/<file>` naming a file of the bundle. One
+  * bundle may carry several rows (a base and its INT8 variant).
+  */
+  entries: external_exports.array(ModelCatalogEntrySchema).min(1).max(4),
+  /** The bundle tar, offered by the producer over `ctx.peerBytes` (same host). */
+  bundle: external_exports.object({
+    ticket: PeerBytesTicketSchema,
+    bytes: external_exports.number().int().positive(),
+    sha256: external_exports.string().regex(/^[0-9a-f]{64}$/)
+  }),
+  /** Every file the tar must hold; anything missing, extra or different is refused. */
+  files: external_exports.array(ModelBundleFileSchema).min(1).max(64),
+  /** Convert missing engine formats and push the model to every agent afterwards. */
+  distribute: external_exports.boolean()
+});
+var ImportModelBundleResultSchema = external_exports.discriminatedUnion("kind", [external_exports.object({
+  kind: external_exports.literal("imported"),
+  modelIds: external_exports.array(external_exports.string()).readonly(),
+  distributed: external_exports.array(external_exports.object({
+    modelId: external_exports.string(),
+    nodeId: external_exports.string(),
+    format: external_exports.enum(MODEL_FORMATS),
+    ok: external_exports.boolean(),
+    error: external_exports.string().optional()
+  })).readonly()
+}), external_exports.object({
+  kind: external_exports.literal("refused"),
+  reason: external_exports.enum([
+    "transfer-failed",
+    "checksum-mismatch",
+    "bundle-mismatch",
+    "invalid-entry",
+    "id-taken"
+  ]),
+  detail: external_exports.string()
+})]);
 var customModelRegistryCapability = {
   name: "custom-model-registry",
   scope: "system",
@@ -21136,7 +21517,22 @@ var customModelRegistryCapability = {
     * `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
     * never tRPC — so `auth: 'admin'` costs it nothing.
     */
-    listModels: method(external_exports.void(), external_exports.array(CustomModelDescriptorSchema).readonly(), { auth: "admin" })
+    listModels: method(external_exports.void(), external_exports.array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }),
+    /**
+    * Register a model whose files arrive as ONE bundle tar (D806): the tar
+    * is taken over `ctx.peerBytes`, checked against `bundle.sha256` and
+    * every row of `files`, unpacked into the hub's flat modelsDir (directory
+    * formats included), each format's `.revision` record written, the rows
+    * upserted under the operator's name, the hub marked available and —
+    * when asked — engine formats converted and the model distributed. A
+    * model id already registered by another source is refused, never
+    * overwritten.
+    */
+    importModelBundle: method(ImportModelBundleInputSchema, ImportModelBundleResultSchema, {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 30 * 6e4
+    })
   }
 };
 var QueryFilterSchema = external_exports.object({
@@ -21772,6 +22168,31 @@ var KeychainKeySourceSchema = external_exports.object({
   */
   sharesBackupWithDatabase: external_exports.boolean()
 });
+var KeychainResetRecordSchema = external_exports.object({
+  id: external_exports.string(),
+  at: external_exports.number(),
+  /** `user:<id>` or {@link KEYCHAIN_RESET_TRIGGER_ACTOR}. */
+  actor: external_exports.string(),
+  /** Why the keychain was locked when it was reset; `null` when it was not locked. */
+  lockedReason: external_exports.string().nullable(),
+  /** Values moved into the archive table (ciphertext under the lost key). */
+  archived: external_exports.number().int(),
+  /** `keychain:secrets-orphaned-<ts>`, or `null` when nothing was stored. */
+  archivedCollection: external_exports.string().nullable(),
+  /**
+  * `keychain:keys-orphaned-<ts>`: the wrapped data keys of the archive, kept
+  * so the archive can still be opened if the lost master key turns up.
+  */
+  archivedKeysCollection: external_exports.string().nullable(),
+  /**
+  * `system-settings` keys whose marker the reset cleared — the cluster
+  * secret's: a marker left pointing at an archived value would refuse every
+  * agent forever (D797).
+  */
+  clearedSettingsKeys: external_exports.array(external_exports.string()).readonly(),
+  /** When an operator dismissed the notice on the Secrets page; `null` until then. */
+  acknowledgedAt: external_exports.number().nullable()
+});
 var KeychainStatusSchema = external_exports.object({
   keychain: KeychainStateSchema,
   /** The source of the master key in use; `null` while locked. */
@@ -21789,7 +22210,9 @@ var KeychainStatusSchema = external_exports.object({
   /** Wrapped copies of the data key under a previous master key, kept until purged. */
   retiredWraps: external_exports.number().int(),
   recoveryKeyDownloadedAt: external_exports.number().nullable(),
-  secretCount: external_exports.number().int()
+  secretCount: external_exports.number().int(),
+  /** The most recent reset, acknowledged or not; `null` when the keychain was never reset. */
+  lastReset: KeychainResetRecordSchema.nullable()
 });
 var KeychainSecretUsageSchema = external_exports.enum([
   "in-use",
@@ -21806,13 +22229,14 @@ var KeychainAuditActionSchema = external_exports.enum([
   "download-recovery-key",
   "delete-orphans",
   "reset",
+  "acknowledge-reset",
   "initialize"
 ]);
 var KeychainAuditEntrySchema = external_exports.object({
   id: external_exports.string(),
   at: external_exports.number(),
   action: KeychainAuditActionSchema,
-  /** `addon:<id>` | `user:<id>` | `system`. */
+  /** `addon:<id>` | `user:<id>` | `system` | `trigger-file`. */
   actor: external_exports.string(),
   ref: external_exports.string().nullable(),
   detail: external_exports.string().nullable()
@@ -21916,6 +22340,21 @@ var keychainAdminCapability = {
       kind: "mutation",
       auth: "admin",
       caller: "required"
+    }),
+    /**
+    * What the last reset left to re-enter: the archived refs (owner, scope,
+    * field — never a value) that hold no value again yet. Process-held refs
+    * the hub regenerates itself (the session signing key) are not listed.
+    */
+    resetReport: method(external_exports.object({}), external_exports.object({
+      reset: KeychainResetRecordSchema.nullable(),
+      pendingReentry: external_exports.array(KeychainSecretMetaSchema).readonly()
+    }), { auth: "admin" }),
+    /** Dismiss the "keychain was reset" notice. Audited. */
+    acknowledgeReset: method(external_exports.object({}), external_exports.object({ acknowledged: external_exports.boolean() }), {
+      kind: "mutation",
+      auth: "admin",
+      caller: "required"
     })
   }
 };
@@ -24725,14 +25164,14 @@ var LlmProfileSchema = external_exports.object({
   */
   appleFoundation: external_exports.object({ nodeId: external_exports.string() }).optional()
 });
-var ConfigSchemaPassthrough$1 = external_exports.unknown();
+var ConfigSchemaPassthrough$2 = external_exports.unknown();
 var LlmProfileKindDescriptorSchema = external_exports.object({
   kind: LlmProfileKindSchema,
   label: external_exports.string(),
   icon: external_exports.string(),
   /** Stamped by each provider so the concat-fanned catalog stays routable. */
   addonId: external_exports.string(),
-  configSchema: ConfigSchemaPassthrough$1
+  configSchema: ConfigSchemaPassthrough$2
 });
 var LlmDefaultSelectorSchema = external_exports.union([external_exports.object({ consumer: external_exports.string() }), external_exports.object({ purpose: external_exports.enum(["text", "vision"]) })]);
 var LlmDefaultSchema = external_exports.object({
@@ -25066,7 +25505,7 @@ var RedirectLoginMethodSchema = external_exports.object({
   * The provider names an external identity a signed-in user can link to
   * their own account (D782): `auth.listLinkableProviders` /
   * `beginExternalLink` offer exactly the redirect methods that set this,
-  * whatever their id. Absent / false — a login button only (magic-link).
+  * whatever their id. Absent / false — a login button only.
   */
   linkable: external_exports.boolean().optional()
 });
@@ -25835,7 +26274,7 @@ var TargetKindCapsSchema = external_exports.object({
   ttl: external_exports.boolean(),
   bodyMaxLen: external_exports.number().int().positive()
 });
-var ConfigSchemaPassthrough = external_exports.unknown();
+var ConfigSchemaPassthrough$1 = external_exports.unknown();
 var TargetKindSchema = external_exports.object({
   kind: external_exports.string(),
   label: external_exports.string(),
@@ -25872,7 +26311,7 @@ var TargetKindSchema = external_exports.object({
   * its raster path, which is the safe default for an unknown image.
   */
   iconMediaType: external_exports.string().optional(),
-  configSchema: ConfigSchemaPassthrough,
+  configSchema: ConfigSchemaPassthrough$1,
   /**
   * The config keys that decide WHERE this kind's secrets are sent (server,
   * base URL, instance, chat, recipient). A save that changes any of them
@@ -29576,17 +30015,58 @@ var RetrainFrameListSchema = external_exports.object({
   /** What the page pre-selects — the native key frame when one survives. */
   autoPickMediaId: external_exports.number().int().optional()
 });
+var RetrainFrameWorkStateSchema = external_exports.enum([
+  "unannotated",
+  "annotated",
+  "complete"
+]);
+var RetrainCorpusFilterSchema = external_exports.object({
+  workState: RetrainFrameWorkStateSchema.optional(),
+  deviceIds: external_exports.array(external_exports.number()).max(500).optional(),
+  /** When set, only frames in this named collection. */
+  collectionId: external_exports.string().optional(),
+  /** Frames that carry at least one saved annotation in one of these classes. */
+  classes: external_exports.array(RetrainMacroClassSchema).optional(),
+  page: external_exports.number().int().positive().default(1),
+  pageSize: external_exports.number().int().positive().max(100).default(50)
+});
+var RetrainCorpusPageFrameSchema = RetrainFrameSchema.extend({ workState: RetrainFrameWorkStateSchema });
+var RetrainCorpusPageSchema = external_exports.object({
+  frames: external_exports.array(RetrainCorpusPageFrameSchema).readonly(),
+  total: external_exports.number().int().nonnegative(),
+  page: external_exports.number().int().positive(),
+  pageSize: external_exports.number().int().positive()
+});
+var RetrainCorpusKpiCameraRowSchema = external_exports.object({
+  deviceId: external_exports.number(),
+  unannotated: external_exports.number().int().nonnegative(),
+  annotated: external_exports.number().int().nonnegative(),
+  complete: external_exports.number().int().nonnegative(),
+  /** This camera's `complete` count divided by corpus `total`, in `[0,1]`.
+  *  `null` when the corpus is empty (no ratio). */
+  pctOfCorpus: external_exports.number().min(0).max(1).nullable()
+});
+var RetrainCorpusKpiSchema = external_exports.object({
+  total: external_exports.number().int().nonnegative(),
+  unannotated: external_exports.number().int().nonnegative(),
+  annotated: external_exports.number().int().nonnegative(),
+  complete: external_exports.number().int().nonnegative(),
+  cameras: external_exports.array(RetrainCorpusKpiCameraRowSchema).readonly()
+});
 var RetrainExportFilterSchema = external_exports.object({
   deviceIds: external_exports.array(external_exports.number()).optional(),
   frameIds: external_exports.array(external_exports.string()).max(2e4).optional(),
   /** Only frames in at least one of these named collections. */
   collectionIds: external_exports.array(external_exports.string()).max(200).optional(),
-  /** Exactly the frames of this dataset version (and its completeOnly). An
-  *  unknown id selects nothing. */
-  datasetVersionId: external_exports.string().optional(),
+  /** Single collection (Frames filter bar). ANDed with `collectionIds` when both set. */
+  collectionId: external_exports.string().optional(),
   batchId: external_exports.string().optional(),
   /** Only frames the operator marked complete (all subjects boxed). */
-  completeOnly: external_exports.boolean().optional()
+  completeOnly: external_exports.boolean().optional(),
+  /** Exclusive work-state partition (`workStateOf`); same as the corpus list. */
+  workState: RetrainFrameWorkStateSchema.optional(),
+  /** Frames with at least one saved annotation in one of these classes. */
+  classes: external_exports.array(RetrainMacroClassSchema).optional()
 });
 var RetrainExportLayoutSchema = external_exports.enum(["frames", "crops"]);
 var RetrainArchiveTargetSchema = external_exports.object({
@@ -29759,22 +30239,28 @@ var RetrainDatasetVersionSchema = external_exports.object({
   layout: RetrainExportLayoutSchema,
   completeOnly: external_exports.boolean(),
   frameCount: external_exports.number().int(),
-  /** sha256 of what the frames taught when the version was frozen. */
   annotationHash: external_exports.string(),
-  /** The export manifest schema the version was cut under. */
   manifestSchema: external_exports.string(),
   stats: RetrainDatasetStatsSchema
 });
-var CreateRetrainDatasetVersionResultSchema = external_exports.discriminatedUnion("kind", [external_exports.object({
-  kind: external_exports.literal("created"),
-  version: RetrainDatasetVersionSchema
+var RetrainTrainingCorpusSelectionSchema = external_exports.object({
+  collectionIds: external_exports.array(external_exports.string()).min(1),
+  workState: external_exports.enum([
+    "complete",
+    "annotated_or_complete",
+    "any_annotated"
+  ]).default("complete")
+});
+var RetrainTrainingCorpusResolveResultSchema = external_exports.discriminatedUnion("kind", [external_exports.object({
+  kind: external_exports.literal("resolved"),
+  frameIds: external_exports.array(external_exports.string()).max(2e4).readonly(),
+  stats: RetrainDatasetStatsSchema,
+  annotationHash: external_exports.string(),
+  layout: RetrainExportLayoutSchema
 }), external_exports.object({
   kind: external_exports.literal("refused"),
-  reason: external_exports.enum([
-    "empty-name",
-    "duplicate-name",
-    "no-frames"
-  ])
+  reason: external_exports.enum(["unknown-collection", "no-frames"]),
+  detail: external_exports.string()
 })]);
 var RetrainTransitionResultSchema = external_exports.object({
   trackId: external_exports.string(),
@@ -30795,6 +31281,26 @@ var pipelineAnalyticsCapability = {
       auth: "admin"
     }),
     /**
+    * Paginated corpus copies for the Frames grid — index reads only.
+    *
+    * Filters AND (`workState`, cameras, one collection, annotated classes).
+    * An answered empty match is `{ frames: [], total: 0, … }` (D315), never a
+    * pending masquerade. Classification uses `workStateOf` (annotation count
+    * wins over a stray `complete` flag).
+    */
+    listRetrainCorpusPage: method(RetrainCorpusFilterSchema, RetrainCorpusPageSchema, {
+      kind: "query",
+      auth: "admin"
+    }),
+    /**
+    * Global + per-camera corpus KPI. Unfiltered totals; `%` on a camera row is
+    * `complete(camera) / corpus total`, or `null` when the corpus is empty.
+    */
+    getRetrainCorpusKpi: method(external_exports.object({}), RetrainCorpusKpiSchema, {
+      kind: "query",
+      auth: "admin"
+    }),
+    /**
     * What a track can contribute, and what it already has.
     *
     * `candidates` are the track's whole, unannotated frames — index rows only,
@@ -31001,50 +31507,23 @@ var pipelineAnalyticsCapability = {
       auth: "admin",
       timeoutMs: 60 * 6e4
     }),
-    /** The counts a selection would freeze — class × camera × day/night,
-    *  completeness — without freezing anything. Index reads only. */
-    previewRetrainDataset: method(external_exports.object({
-      selection: RetrainDatasetSelectionSchema,
-      completeOnly: external_exports.boolean().optional()
-    }), RetrainDatasetStatsSchema, {
-      kind: "query",
-      auth: "admin"
-    }),
     /**
-    * Freeze a dataset version: the frames the selection yields (the same plan
-    * the annotated export builds), the hash of what they teach, the export
-    * parameters and the counts. Immutable — a different selection is a new
-    * version. Export it with `getRetrainExportUrl({ datasetVersionId })`.
+    * OFFER the annotated archive instead of pushing it (D805): the same tar
+    * `writeRetrainArchive` streams, behind a one-shot `ctx.peerBytes` ticket
+    * the caller dials at once (same host). For a consumer that cannot expose
+    * an upload URL — a training provider streaming straight into its cloud.
+    * The answer is the plan; the bytes and their sha256 are the consumer's
+    * to measure as they arrive.
     */
-    createRetrainDatasetVersion: method(external_exports.object({
-      name: external_exports.string().max(120),
-      selection: RetrainDatasetSelectionSchema,
-      layout: RetrainExportLayoutSchema,
-      completeOnly: external_exports.boolean()
-    }), CreateRetrainDatasetVersionResultSchema, {
-      kind: "mutation",
-      auth: "admin",
-      timeoutMs: 12e4
-    }),
-    /** Every dataset version, newest first. */
-    listRetrainDatasetVersions: method(external_exports.object({}), external_exports.array(RetrainDatasetVersionSchema).readonly(), {
-      kind: "query",
-      auth: "admin"
-    }),
-    /** Delete a version. Its frames stay in the dataset. */
-    deleteRetrainDatasetVersion: method(external_exports.object({ id: external_exports.string() }), external_exports.object({ deleted: external_exports.boolean() }), {
-      kind: "mutation",
-      auth: "admin"
-    }),
-    /** Does the corpus still teach what the version froze? `missingFrames`
-    *  counts frames that left the dataset (or lost every box and tick). */
-    verifyRetrainDatasetVersion: method(external_exports.object({ id: external_exports.string() }), external_exports.object({
-      found: external_exports.boolean(),
-      annotationHash: external_exports.string(),
-      matches: external_exports.boolean(),
-      missingFrames: external_exports.number().int()
+    offerRetrainArchive: method(external_exports.object({
+      filter: RetrainExportFilterSchema,
+      layout: RetrainExportLayoutSchema
+    }), external_exports.object({
+      ticket: PeerBytesTicketSchema,
+      frames: external_exports.number().int(),
+      annotations: external_exports.number().int()
     }), {
-      kind: "query",
+      kind: "mutation",
       auth: "admin",
       timeoutMs: 12e4
     }),
@@ -31094,6 +31573,16 @@ var pipelineAnalyticsCapability = {
       kind: "query",
       auth: "admin"
     }),
+    /**
+    * Resolve a live training corpus selection to frame ids + stats (index
+    * reads only). Same plan the annotated export builds — training plan/start
+    * calls this instead of a frozen dataset version.
+    */
+    resolveRetrainTrainingCorpus: method(RetrainTrainingCorpusSelectionSchema, RetrainTrainingCorpusResolveResultSchema, {
+      kind: "query",
+      auth: "admin",
+      timeoutMs: 6e4
+    }),
     renameRetrainCollection: method(external_exports.object({
       id: external_exports.string(),
       name: external_exports.string().max(120)
@@ -31999,11 +32488,14 @@ var HardwareClassIdSchema = external_exports.enum([
   "intel-n-series",
   "apple-m-base",
   "apple-m-pro",
+  "amd-phoenix",
   "unknown"
 ]);
 var AcceleratorKindSchema = external_exports.enum([
   "intel-npu",
   "intel-igpu",
+  "amd-igpu",
+  "amd-npu",
   "x86-cpu",
   "arm-cpu",
   "apple-ane",
@@ -33929,6 +34421,8 @@ var AgentPipelineSettingsSchema = external_exports.object({
   * address is wrong (multi-homed host, NAT, custom interface).
   */
   reachableHost: external_exports.string().optional(),
+  /** Hub-persisted UI colour (`--color-node-*` theme tokens). */
+  color: NodeColorIdSchema.optional(),
   /**
   * Multi-device inference opt-in (Phase 4). Per-node map deviceKey → {enabled,
   * weight, steps}. Absent / all-disabled ⇒ the node's single default
@@ -34565,8 +35059,9 @@ var pipelineOrchestratorCapability = {
     */
     setAgentReachableHost: method(external_exports.object({
       agentNodeId: external_exports.string(),
-      reachableHost: external_exports.string().nullable()
-    }), external_exports.object({ success: external_exports.literal(true) }), {
+      reachableHost: external_exports.string().nullable().optional(),
+      color: NodeColorIdSchema.nullable().optional()
+    }).refine((v) => v.reachableHost !== void 0 || v.color !== void 0, { message: "reachableHost or color required" }), external_exports.object({ success: external_exports.literal(true) }), {
       kind: "mutation",
       auth: "admin"
     }),
@@ -35510,7 +36005,14 @@ var SsoBridgeClaimsSchema = external_exports.object({
   * Verified `iss` of the id_token behind an OIDC login bridge (D782). A
   * subject is unique only per issuer, so a link is bound to it.
   */
-  issuer: external_exports.string().optional()
+  issuer: external_exports.string().optional(),
+  /**
+  * SHA-256 (hex) of the `camstack_sso_state` cookie the IdP `/start` set in
+  * the browser that began this sign-in. `/api/auth/sso/finish` requires the
+  * request to present the matching cookie — a login bridge is useless in
+  * any other browser.
+  */
+  browserBinding: external_exports.string().optional()
 });
 var ssoBridgeCapability = {
   name: "sso-bridge",
@@ -35528,7 +36030,7 @@ var ssoBridgeCapability = {
     * `/api/auth/sso/finish` to become admin — a full privilege escalation
     * through the exact surface this cap exists to close (see the module
     * docblock). Every real caller (`oauth-grants.ts`, `main.ts`
-    * registration, the OIDC/magic-link addons) reaches this through
+    * registration, the OIDC addon) reaches this through
     * `ctx.api` / the in-process registry — never through tRPC — so
     * `auth: 'admin'` costs those callers nothing.
     */
@@ -38054,7 +38556,13 @@ var addonsCapability = {
   mode: "singleton",
   nodeIdMode: "data",
   methods: {
-    list: method(external_exports.void(), external_exports.array(AddonListItemSchema).readonly()),
+    /**
+    * Installed addon roster for a node. `nodeId` omitted (or `'hub'`)
+    * is the hub's own registry; an agent `nodeId` overlays that agent's
+    * installed package versions (via `$agent.status`) onto hub manifests
+    * and drops packages the agent does not have.
+    */
+    list: method(external_exports.object({ nodeId: external_exports.string().optional() }).optional(), external_exports.array(AddonListItemSchema).readonly()),
     getLogs: method(external_exports.object({
       addonId: external_exports.string(),
       limit: external_exports.number().min(1).max(500).default(100),
@@ -38846,6 +39354,7 @@ var calendarSourceCapability = {
   scope: "system",
   mode: "collection",
   internal: true,
+  providerKind: "calendar",
   methods: {
     listCalendars: method(external_exports.void(), external_exports.array(CalendarInfoSchema).readonly(), { auth: "admin" }),
     listEvents: method(CalendarListEventsInputSchema, external_exports.array(CalendarEventSchema).readonly(), { auth: "admin" })
@@ -42681,7 +43190,13 @@ var TopologyNodeSchema = external_exports.object({
   })).readonly(),
   processes: external_exports.array(TopologyProcessSchema).readonly(),
   categories: external_exports.array(TopologyCategorySchema).readonly(),
-  rootPackage: TopologyRootPackageSchema.nullable()
+  rootPackage: TopologyRootPackageSchema.nullable(),
+  /**
+  * How an online AGENT reaches the hub (mesh mTLS Release A): `tls` once it has
+  * completed a mutual-TLS handshake, `clear` otherwise. Absent for the hub,
+  * for offline rows and when the hub cannot tell.
+  */
+  meshTransport: external_exports.enum(["tls", "clear"]).optional()
 });
 var CapUsageEdgeSchema = external_exports.object({
   callerAddonId: external_exports.string(),
@@ -43106,6 +43621,7 @@ var OsdNamedTemplateSchema = external_exports.object({
   parser: external_exports.string().max(256).default("")
 });
 var OsdSourceSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({ kind: external_exports.literal("none") }),
   external_exports.object({
     kind: external_exports.literal("static"),
     text: external_exports.string().max(64)
@@ -43253,6 +43769,19 @@ var osdManagerCapability = {
       auth: "admin"
     }),
     /**
+    * Toggle the camera firmware overlay on/off (`osd.setOverlay` `enabled`).
+    * Distinct from the binding's own `enabled` flag — this is what the
+    * operator sees on the live picture (e.g. Reolink camera name layer).
+    */
+    setSlotCameraEnabled: method(external_exports.object({
+      deviceId: external_exports.number().int(),
+      slotId: external_exports.string().min(1),
+      enabled: external_exports.boolean()
+    }), external_exports.object({ success: external_exports.literal(true) }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /**
     * Replace one camera's binding configuration from another. Writable source
     * slots are mapped by ordinal onto writable target slots so different
     * provider slot ids do not make the copied configuration disappear.
@@ -43715,7 +44244,15 @@ var GpuInfoSchema = external_exports.object({
   name: external_exports.string(),
   memoryMB: external_exports.number().optional()
 });
-var NpuInfoSchema = external_exports.object({ type: external_exports.enum(["apple-ane", "intel-npu"]) });
+var NpuInfoSchema = external_exports.object({
+  type: external_exports.enum([
+    "apple-ane",
+    "intel-npu",
+    "amd-xdna"
+  ]),
+  name: external_exports.string().optional(),
+  generation: external_exports.enum(["xdna1", "xdna2"]).optional()
+});
 var CoralInfoSchema = external_exports.object({
   type: external_exports.literal("coral-edgetpu"),
   bus: external_exports.string().optional()
@@ -47057,16 +47594,6 @@ var ApiKeySummarySchema = external_exports.object({
   createdAt: external_exports.number(),
   lastUsedAt: external_exports.number().optional()
 });
-var CreateApiKeyInputSchema = external_exports.object({
-  label: external_exports.string(),
-  isAdmin: external_exports.boolean().default(false),
-  allowedProviders: external_exports.union([external_exports.array(external_exports.string()), external_exports.literal("*")]).optional(),
-  allowedDevices: external_exports.record(external_exports.string(), external_exports.union([external_exports.array(external_exports.string()), external_exports.literal("*")])).optional()
-});
-var CreateApiKeyResultSchema = external_exports.object({
-  token: external_exports.string(),
-  record: ApiKeySummarySchema
-});
 var ScopedTokenSummarySchema = external_exports.object({
   id: external_exports.string(),
   userId: external_exports.string(),
@@ -47168,20 +47695,11 @@ var userManagementCapability = {
       access: "view"
     }),
     listApiKeys: method(external_exports.void(), external_exports.array(ApiKeySummarySchema), { auth: "admin" }),
-    createApiKey: method(CreateApiKeyInputSchema, CreateApiKeyResultSchema, {
-      kind: "mutation",
-      auth: "admin",
-      access: "create"
-    }),
     revokeApiKey: method(external_exports.object({ id: external_exports.string() }), external_exports.object({ success: external_exports.literal(true) }), {
       kind: "mutation",
       auth: "admin",
       access: "delete"
     }),
-    validateApiKey: method(external_exports.object({ token: external_exports.string() }), ApiKeySummarySchema.nullable(), {
-      kind: "mutation",
-      access: "view"
-    }),
     createScopedToken: method(CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, {
       kind: "mutation",
       auth: "admin",
@@ -47271,20 +47789,6 @@ var userManagementCapability = {
       userId: external_exports.string(),
       issuer: external_exports.string()
     }).nullable(), { auth: "admin" }),
-    /**
-    * Link `(provider, subject)` to `userId`. Idempotent for the same user;
-    * REFUSES (throws) an identity already linked to another user, and a
-    * user that does not exist.
-    */
-    linkExternalIdentity: method(ExternalIdentityKeySchema.extend({
-      userId: external_exports.string(),
-      issuer: external_exports.string().min(1),
-      label: external_exports.string().optional()
-    }), external_exports.object({ success: external_exports.literal(true) }), {
-      kind: "mutation",
-      auth: "admin",
-      access: "create"
-    }),
     /** Remove one link of `userId`. `success: false` when it was not linked to that user. */
     unlinkExternalIdentity: method(ExternalIdentityKeySchema.extend({ userId: external_exports.string() }), external_exports.object({ success: external_exports.boolean() }), {
       kind: "mutation",
@@ -47815,6 +48319,586 @@ var zoneRulesCapability = {
   */
   durability: "restored"
 };
+var TrainingGpuOptionSchema = external_exports.object({
+  id: external_exports.string(),
+  label: external_exports.string(),
+  /** List price, USD per GPU-hour, before any region multiplier. */
+  usdPerHour: external_exports.number().nonnegative(),
+  vramGb: external_exports.number().nonnegative()
+});
+var TrainingRegionOptionSchema = external_exports.object({
+  /** `''` = any region (the provider's choice). */
+  id: external_exports.string(),
+  label: external_exports.string(),
+  priceMultiplier: external_exports.number().positive()
+});
+var TrainingProviderDefaultsSchema = external_exports.object({
+  gpuType: external_exports.string(),
+  region: external_exports.string(),
+  costCapUsd: external_exports.number().nonnegative(),
+  maxRuntimeSec: external_exports.number().int().positive(),
+  /** Hours a FAILED job's cloud dataset is kept for debugging; 0 = delete at once. */
+  failedDatasetGraceHours: external_exports.number().nonnegative()
+});
+var ConfigSchemaPassthrough = external_exports.unknown();
+var TrainingProviderTypeSchema = external_exports.object({
+  typeId: external_exports.string(),
+  label: external_exports.string(),
+  /** Path under the addon package (e.g. `assets/training-modal/icon.svg`). */
+  iconAsset: external_exports.string(),
+  /** Owning `training-provider` addon — collection selector for createEntry. */
+  addonId: external_exports.string(),
+  /**
+  * Fields for one entry of this type (credentials + defaults). Absent on a
+  * type that only needs a name. Password fields are keychain-backed on the
+  * provider addon (`secretStatePaths`), not D634 plaintext.
+  */
+  configSchema: ConfigSchemaPassthrough.optional()
+});
+var TrainingProviderEntrySchema = external_exports.object({
+  entryId: external_exports.string(),
+  typeId: external_exports.string(),
+  name: external_exports.string(),
+  addonId: external_exports.string(),
+  /** Credentials are present — never the values. */
+  configured: external_exports.boolean()
+});
+var TrainingProviderDescriptorSchema = external_exports.object({
+  addonId: external_exports.string(),
+  entryId: external_exports.string(),
+  typeId: external_exports.string(),
+  /** Operator-chosen entry name. */
+  name: external_exports.string(),
+  iconAsset: external_exports.string(),
+  /** `modal`, `runpod`, `fake`, … — same as typeId for current providers. */
+  kind: external_exports.string(),
+  label: external_exports.string(),
+  gpuTypes: external_exports.array(TrainingGpuOptionSchema).readonly(),
+  regions: external_exports.array(TrainingRegionOptionSchema).readonly(),
+  maxDatasetBytes: external_exports.number().int().positive(),
+  maxRuntimeSec: external_exports.number().int().positive(),
+  freeTierNote: external_exports.string().optional(),
+  /** Where the data goes, in one sentence the confirm dialog repeats. */
+  dataResidencyNote: external_exports.string(),
+  /** Credentials are present — never the values. */
+  configured: external_exports.boolean(),
+  defaults: TrainingProviderDefaultsSchema,
+  /**
+  * Values for {@link TrainingProviderTypeSchema}'s `configSchema` — password
+  * fields are keychain {@link SecretFieldView} or `null` / `''` (create),
+  * never plaintext. Same hydrate contract as settings forms (D789).
+  */
+  formValues: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+});
+var TrainingProviderUpdateEntryInputSchema = external_exports.object({
+  entryId: external_exports.string().min(1),
+  name: external_exports.string().min(1),
+  tokenId: external_exports.string().optional(),
+  tokenSecret: external_exports.union([external_exports.string(), external_exports.object({ $secretClear: external_exports.literal(true) })]).optional(),
+  environment: external_exports.string().optional(),
+  gpuType: external_exports.string().optional(),
+  region: external_exports.string().optional(),
+  costCapUsd: external_exports.number().nonnegative().optional(),
+  maxRuntimeSec: external_exports.number().int().positive().optional(),
+  failedDatasetGraceHours: external_exports.number().nonnegative().optional()
+});
+var TrainingCredentialCheckSchema = external_exports.object({
+  ok: external_exports.boolean(),
+  /** Workspace / account name, when the provider says. */
+  account: external_exports.string().optional(),
+  reason: external_exports.enum([
+    "missing",
+    "invalid",
+    "forbidden",
+    "network",
+    "quota"
+  ]).optional(),
+  detail: external_exports.string().optional()
+});
+var ProviderJobStateSchema = external_exports.enum([
+  "pending",
+  "starting",
+  "running",
+  "succeeded",
+  "failed",
+  "cancelled",
+  "lost"
+]);
+var ProviderJobStatusSchema = external_exports.object({
+  jobKey: external_exports.string(),
+  providerJobId: external_exports.string().optional(),
+  state: ProviderJobStateSchema,
+  startedAt: external_exports.number().optional(),
+  endedAt: external_exports.number().optional(),
+  exitCode: external_exports.number().int().optional(),
+  failureReason: external_exports.string().optional(),
+  gpuType: external_exports.string(),
+  region: external_exports.string().optional(),
+  billedSeconds: external_exports.number().nonnegative(),
+  costUsd: external_exports.number().nonnegative(),
+  /** True when `costUsd` is runtime × list price, not a billing answer. */
+  costIsEstimate: external_exports.boolean(),
+  lastFetchedAt: external_exports.number()
+});
+var TrainerSourceRefSchema = external_exports.object({
+  /** Hugging Face repo id, e.g. `camstack/camstack-trainer`. */
+  repo: external_exports.string().min(1),
+  /** A commit sha (never a branch) — the job must be reproducible. */
+  revision: external_exports.string().regex(/^[0-9a-f]{7,64}$/)
+});
+var JobRef = {
+  entryId: external_exports.string().min(1),
+  jobKey: external_exports.string().uuid()
+};
+var TrainingLogLineSchema = external_exports.object({
+  ts: external_exports.number(),
+  text: external_exports.string()
+});
+var trainingProviderCapability = {
+  name: "training-provider",
+  scope: "system",
+  mode: "collection",
+  internal: true,
+  methods: {
+    /** Every entry's offer and settings. Concat-fans across providers. */
+    describe: method(external_exports.object({}), external_exports.array(TrainingProviderDescriptorSchema).readonly(), { auth: "admin" }),
+    /** Creatable types for the Add-entry dialog. Concat-fans. */
+    describeTypes: method(external_exports.object({}), external_exports.array(TrainingProviderTypeSchema).readonly(), { auth: "admin" }),
+    /** Configured entries (pills). Concat-fans. */
+    listEntries: method(external_exports.object({}), external_exports.array(TrainingProviderEntrySchema).readonly(), { auth: "admin" }),
+    /**
+    * Create an entry under this provider type. Pin with `{ addonId }` of the
+    * type's owning addon (from describeTypes).
+    */
+    createEntry: method(external_exports.object({
+      typeId: external_exports.string().min(1),
+      name: external_exports.string().min(1)
+    }), external_exports.object({ entryId: external_exports.string() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** Delete an entry. Pin with the owning `{ addonId }`. */
+    deleteEntry: method(external_exports.object({ entryId: external_exports.string().min(1) }), external_exports.object({ ok: external_exports.literal(true) }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /**
+    * Update one entry (name, credentials, defaults). Pin with owning
+    * `{ addonId }`. Empty/omitted `tokenSecret` keeps the stored secret.
+    */
+    updateEntry: method(TrainingProviderUpdateEntryInputSchema, external_exports.object({ ok: external_exports.literal(true) }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** Call the provider with the entry's stored credentials. Never returns them. */
+    validateCredentials: method(external_exports.object({ entryId: external_exports.string().min(1) }), TrainingCredentialCheckSchema, {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 3e4
+    }),
+    /** USD range for a run of `gpuSeconds` on `gpuType` in `region`. */
+    estimateJob: method(external_exports.object({
+      entryId: external_exports.string().min(1),
+      gpuType: external_exports.string(),
+      region: external_exports.string(),
+      datasetBytes: external_exports.number().int().nonnegative(),
+      gpuSecondsLow: external_exports.number().nonnegative(),
+      gpuSecondsHigh: external_exports.number().nonnegative()
+    }), external_exports.object({
+      usdLow: external_exports.number().nonnegative(),
+      usdHigh: external_exports.number().nonnegative(),
+      notes: external_exports.array(external_exports.string()).readonly()
+    }), { auth: "admin" }),
+    /**
+    * Take the dataset archive behind `ticket` (minted by pipeline-analytics,
+    * same host) and land it as the job's dataset in the cloud, streamed —
+    * nothing is staged on the hub's disk. Idempotent per `jobKey`: a second
+    * call replaces a partial upload. Answers what actually landed.
+    */
+    uploadDataset: method(external_exports.object({
+      ...JobRef,
+      ticket: PeerBytesTicketSchema
+    }), external_exports.object({
+      bytes: external_exports.number().int().nonnegative(),
+      sha256: external_exports.string()
+    }), {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 120 * 6e4
+    }),
+    /**
+    * Start the trainer on a GPU. Looks the job up by `jobKey` first, so a
+    * retried submit never starts a second GPU. `jobSpecJson` is written next
+    * to the dataset as `job.json`; `maxRuntimeSec` is enforced by the
+    * provider (a hard timeout), not by the hub.
+    */
+    submitJob: method(external_exports.object({
+      ...JobRef,
+      trainer: TrainerSourceRefSchema,
+      jobSpecJson: external_exports.string().min(2).max(64e3),
+      gpuType: external_exports.string(),
+      region: external_exports.string(),
+      maxRuntimeSec: external_exports.number().int().positive()
+    }), ProviderJobStatusSchema, {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 30 * 6e4
+    }),
+    getJob: method(external_exports.object(JobRef), ProviderJobStatusSchema, {
+      auth: "admin",
+      timeoutMs: 6e4
+    }),
+    /** Stdout/stderr since `cursor` (opaque), oldest first, at most `max` lines. */
+    listJobEvents: method(external_exports.object({
+      ...JobRef,
+      cursor: external_exports.string().optional(),
+      max: external_exports.number().int().min(1).max(500)
+    }), external_exports.object({
+      lines: external_exports.array(TrainingLogLineSchema).readonly(),
+      cursor: external_exports.string()
+    }), {
+      auth: "admin",
+      timeoutMs: 6e4
+    }),
+    /** Stop the job. Idempotent: an unknown or finished job is a no-op. */
+    cancelJob: method(external_exports.object(JobRef), external_exports.object({ ok: external_exports.literal(true) }), {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 6e4
+    }),
+    /** The job's `result.json`, as text (small, JSON). `found: false` before it exists. */
+    readResult: method(external_exports.object(JobRef), external_exports.object({
+      found: external_exports.boolean(),
+      text: external_exports.string().optional()
+    }), {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 5 * 6e4
+    }),
+    /**
+    * Offer one output file of the job (`bundle.tar`) to the caller as a
+    * one-shot `ctx.peerBytes` ticket, streamed from the cloud — the provider
+    * stages nothing on disk. The caller dials it at once.
+    */
+    offerArtifact: method(external_exports.object({
+      ...JobRef,
+      path: external_exports.enum(["bundle.tar"])
+    }), external_exports.object({ ticket: PeerBytesTicketSchema }), {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 5 * 6e4
+    }),
+    /** Delete every cloud object tagged with `jobKey` (the dataset first). Idempotent. */
+    cleanupJob: method(external_exports.object(JobRef), external_exports.object({ deleted: external_exports.array(external_exports.string()).readonly() }), {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 5 * 6e4
+    }),
+    /**
+    * Jobs this provider can still see. Optional `entryId` filters; omit to
+    * list every entry (orphan sweep). Pin with `{ addonId }`.
+    */
+    listJobs: method(external_exports.object({ entryId: external_exports.string().min(1).optional() }), external_exports.array(ProviderJobStatusSchema).readonly(), {
+      auth: "admin",
+      timeoutMs: 2 * 6e4
+    })
+  }
+};
+var TrainingCorpusSelectionSchema = external_exports.object({
+  collectionIds: external_exports.array(external_exports.string()).min(1),
+  /** Default complete-only for v1 */
+  workState: external_exports.enum([
+    "complete",
+    "annotated_or_complete",
+    "any_annotated"
+  ]).default("complete")
+});
+var TrainingBaseModelSchema = external_exports.object({
+  modelId: external_exports.string(),
+  label: external_exports.string(),
+  weights: external_exports.string(),
+  imgsz: external_exports.number().int(),
+  baselineOnnxUrl: external_exports.string(),
+  baselineFloors: external_exports.record(external_exports.string(), external_exports.number()),
+  /** The base the fleet runs most — the UI's default. */
+  recommended: external_exports.boolean()
+});
+var TrainingPresetSchema = external_exports.enum([
+  "quick",
+  "standard",
+  "thorough"
+]);
+var TrainingJobRequestSchema = external_exports.object({
+  /** Live collection + work-state criteria; resolved at plan/start. */
+  selection: TrainingCorpusSelectionSchema,
+  /**
+  * The provider **entry** that runs it (credentials + defaults).
+  * Resolve to an owning addon via `training-provider.describe` / `listEntries`.
+  */
+  entryId: external_exports.string().min(1),
+  gpuType: external_exports.string().min(1),
+  region: external_exports.string(),
+  baseModelId: external_exports.string().min(1),
+  preset: TrainingPresetSchema,
+  /** Freeze the backbone's first N layers; `null` = the preset's choice. */
+  freeze: external_exports.number().int().nonnegative().nullable(),
+  /** Cameras held out whole for evaluation; `null` = the orchestrator's default. */
+  holdoutCameras: external_exports.array(external_exports.number().int()).nullable()
+});
+var TrainingSplitPlanSchema = external_exports.object({
+  holdoutCameras: external_exports.array(external_exports.number().int()).readonly(),
+  /** Used when no camera is held out: the last N days of every camera. */
+  holdoutLastDays: external_exports.number().int().nonnegative(),
+  /** Holdout subjects per class (camera holdout only; `null` = known only after the split). */
+  holdoutSupport: external_exports.record(external_exports.string(), external_exports.number().int()).nullable(),
+  trainSubjects: external_exports.number().int()
+});
+var TrainingRefusalReasonSchema = external_exports.enum([
+  "unknown-dataset",
+  "unknown-provider",
+  "provider-not-configured",
+  "unknown-base-model",
+  "unknown-gpu",
+  "dataset-too-large",
+  "no-training-subjects",
+  "job-already-running"
+]);
+var TrainingJobPlanSchema = external_exports.object({
+  refusal: external_exports.object({
+    reason: TrainingRefusalReasonSchema,
+    detail: external_exports.string()
+  }).nullable(),
+  warnings: external_exports.array(external_exports.string()).readonly(),
+  split: TrainingSplitPlanSchema.nullable(),
+  estimate: external_exports.object({
+    datasetBytes: external_exports.number().int(),
+    uploadMinutesAt20Mbps: external_exports.number(),
+    gpuSecondsLow: external_exports.number(),
+    gpuSecondsHigh: external_exports.number(),
+    usdLow: external_exports.number(),
+    usdHigh: external_exports.number(),
+    notes: external_exports.array(external_exports.string()).readonly()
+  }).nullable(),
+  /** Pre-filled from the provider's settings; the operator may lower or raise them. */
+  defaults: external_exports.object({
+    maxCostUsd: external_exports.number(),
+    maxRuntimeSec: external_exports.number().int()
+  }).nullable(),
+  /** The sentence the confirm dialog repeats: where the frames go and when they are deleted. */
+  dataNotice: external_exports.string()
+});
+var TrainingJobStateSchema = external_exports.enum([
+  "queued",
+  "uploading",
+  "submitted",
+  "starting",
+  "running",
+  "collecting",
+  "ready",
+  "registered",
+  "canary",
+  "failed",
+  "cancelling",
+  "cancelled",
+  "lost",
+  "expired",
+  "discarded"
+]);
+var TrainingFailureReasonSchema = external_exports.enum([
+  "cost-cap",
+  "runtime-cap",
+  "upload-failed",
+  "submit-failed",
+  "trainer-failed",
+  "result-invalid",
+  "checksum-mismatch",
+  "fetch-failed",
+  "provider-error",
+  "hub-restart-during-upload"
+]);
+var TrainingProgressPointSchema = external_exports.object({
+  epoch: external_exports.number().int(),
+  map50: external_exports.number().nullable(),
+  map50_95: external_exports.number().nullable()
+});
+var TrainingCanarySchema = external_exports.object({
+  deviceIds: external_exports.array(external_exports.number().int()).readonly(),
+  since: external_exports.number(),
+  /** Every override the canary replaced, exactly, so rollback restores it. */
+  previous: external_exports.array(external_exports.object({
+    deviceId: external_exports.number().int(),
+    nodeId: external_exports.string(),
+    deviceKey: external_exports.string(),
+    patch: external_exports.object({
+      modelId: external_exports.string().optional(),
+      settings: external_exports.record(external_exports.string(), external_exports.unknown()).readonly().optional()
+    }).nullable()
+  })).readonly()
+});
+var TrainingJobSchema = external_exports.object({
+  id: external_exports.string(),
+  idempotencyKey: external_exports.string(),
+  name: external_exports.string(),
+  createdAt: external_exports.number(),
+  updatedAt: external_exports.number(),
+  state: TrainingJobStateSchema,
+  /**
+  * Shared by every job enqueued together via `startJobBatch`.
+  * `null` for a lone `startJob`. The engine advances queued siblings by this id.
+  */
+  batchId: external_exports.string().nullable().default(null),
+  stage: TrainingStageSchema.nullable(),
+  failure: external_exports.object({
+    reason: TrainingFailureReasonSchema,
+    stage: external_exports.string().nullable(),
+    detail: external_exports.string()
+  }).nullable(),
+  request: TrainingJobRequestSchema,
+  maxCostUsd: external_exports.number().nonnegative(),
+  maxRuntimeSec: external_exports.number().int().positive(),
+  trainer: TrainerSourceRefSchema,
+  datasetLayout: RetrainExportLayoutSchema,
+  /** Frame count snapshotted when the job started (audit; equals `frameIds.length`). */
+  frameCount: external_exports.number().int().nonnegative(),
+  /** Resolved frame ids at start — the archive ships exactly these. */
+  frameIds: external_exports.array(external_exports.string()).max(2e4).readonly(),
+  /** Hash of what those frames taught at start (trainer `dataset.annotationHash`). */
+  annotationHash: external_exports.string(),
+  dataset: external_exports.object({
+    bytes: external_exports.number().int(),
+    sha256: external_exports.string(),
+    uploadedAt: external_exports.number()
+  }).nullable(),
+  split: TrainingSplitPlanSchema,
+  provider: external_exports.object({
+    state: ProviderJobStateSchema.nullable(),
+    providerJobId: external_exports.string().nullable(),
+    startedAt: external_exports.number().nullable(),
+    endedAt: external_exports.number().nullable(),
+    billedSeconds: external_exports.number(),
+    costUsd: external_exports.number(),
+    costIsEstimate: external_exports.boolean(),
+    lastPolledAt: external_exports.number().nullable()
+  }),
+  progress: external_exports.object({
+    epoch: external_exports.number().int().nullable(),
+    epochs: external_exports.number().int().nullable(),
+    etaSec: external_exports.number().nullable(),
+    series: external_exports.array(TrainingProgressPointSchema).readonly()
+  }),
+  /** The last lines of the job's output (≤ 200), newest last. Never frame paths. */
+  logTail: external_exports.array(external_exports.string()).readonly(),
+  logCursor: external_exports.string().nullable(),
+  artifacts: external_exports.object({
+    bundleBytes: external_exports.number().int(),
+    bundleSha256: external_exports.string(),
+    fetchedAt: external_exports.number(),
+    /** When the staged artefacts are deleted from the hub. */
+    expiresAt: external_exports.number()
+  }).nullable(),
+  /** When the provider-side copy of the frames was deleted; null while it exists. */
+  cloudDatasetDeletedAt: external_exports.number().nullable(),
+  /** A failed job's dataset is kept until then (the provider's grace), then deleted. */
+  cloudCleanupDueAt: external_exports.number().nullable(),
+  /** Model ids registered from this job (base, and int8 when kept). */
+  registeredModelIds: external_exports.array(external_exports.string()).readonly(),
+  canary: TrainingCanarySchema.nullable()
+});
+var IdInput = external_exports.object({ id: external_exports.string().min(1) });
+var trainingCapability = {
+  name: "training",
+  scope: "system",
+  mode: "singleton",
+  mount: { kind: "hub-only" },
+  methods: {
+    listBaseModels: method(external_exports.object({}), external_exports.array(TrainingBaseModelSchema).readonly(), { auth: "admin" }),
+    /** Split, estimate, defaults and any named refusal — nothing is started. */
+    planJob: method(TrainingJobRequestSchema, TrainingJobPlanSchema, {
+      auth: "admin",
+      timeoutMs: 6e4
+    }),
+    /**
+    * Start a job. The same `idempotencyKey` returns the job it already
+    * started. Answers at once (`uploading`); the upload and the submit run in
+    * the background and the job record says how far they got.
+    */
+    startJob: method(TrainingJobRequestSchema.extend({
+      name: external_exports.string().min(1).max(120),
+      maxCostUsd: external_exports.number().positive(),
+      maxRuntimeSec: external_exports.number().int().positive(),
+      idempotencyKey: external_exports.string().min(8).max(80)
+    }), external_exports.discriminatedUnion("kind", [external_exports.object({
+      kind: external_exports.literal("started"),
+      job: TrainingJobSchema
+    }), external_exports.object({
+      kind: external_exports.literal("refused"),
+      reason: TrainingRefusalReasonSchema,
+      detail: external_exports.string()
+    })]), {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 12e4
+    }),
+    /**
+    * Enqueue one job per base model (same selection, entry, caps). The first
+    * becomes `uploading`; the rest stay `queued` until the prior job settles.
+    * One ACTIVE job at a time — a parallel `startJob` still gets
+    * `job-already-running`. The same `idempotencyKey` returns the batch it
+    * already started.
+    */
+    startJobBatch: method(TrainingJobRequestSchema.omit({ baseModelId: true }).extend({
+      baseModelIds: external_exports.array(external_exports.string().min(1)).min(1),
+      name: external_exports.string().min(1).max(120),
+      maxCostUsd: external_exports.number().positive(),
+      maxRuntimeSec: external_exports.number().int().positive(),
+      idempotencyKey: external_exports.string().min(8).max(80)
+    }), external_exports.discriminatedUnion("kind", [external_exports.object({
+      kind: external_exports.literal("started"),
+      batchId: external_exports.string(),
+      jobs: external_exports.array(TrainingJobSchema).min(1).readonly()
+    }), external_exports.object({
+      kind: external_exports.literal("refused"),
+      reason: TrainingRefusalReasonSchema,
+      detail: external_exports.string()
+    })]), {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 12e4
+    }),
+    listJobs: method(external_exports.object({}), external_exports.array(TrainingJobSchema).readonly(), { auth: "admin" }),
+    getJob: method(IdInput, TrainingJobSchema.nullable(), { auth: "admin" }),
+    cancelJob: method(IdInput, TrainingJobSchema, {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 12e4
+    }),
+    /** The verified `result.json` of a job in `ready` or later; null before. */
+    getJobResult: method(IdInput, TrainingResultSchema.nullable(), { auth: "admin" }),
+    /** Hand the verified bundle to Model Studio; optionally canary right after. */
+    registerResult: method(IdInput.extend({ canaryDeviceIds: external_exports.array(external_exports.number().int()).readonly() }), TrainingJobSchema, {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 30 * 6e4
+    }),
+    /** Pin the registered model on these cameras, remembering what it replaced. */
+    canaryResult: method(IdInput.extend({ deviceIds: external_exports.array(external_exports.number().int()).min(1).readonly() }), TrainingJobSchema, {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 12e4
+    }),
+    /** Put every canary camera back exactly as it was. */
+    rollbackCanary: method(IdInput, TrainingJobSchema, {
+      kind: "mutation",
+      auth: "admin",
+      timeoutMs: 12e4
+    }),
+    /** Delete the staged artefacts of an unregistered result. */
+    discardResult: method(IdInput, TrainingJobSchema, {
+      kind: "mutation",
+      auth: "admin"
+    })
+  }
+};
 var PIPELINE_FLOW_CAPABILITY_NAMES = [
   "decoder",
   "motion-detection",
@@ -48694,6 +49778,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "backup.checkBackupKey": {
+    capName: "backup",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "backup.delete": {
     capName: "backup",
     capScope: "system",
@@ -48706,6 +49796,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "delete"
   },
+  "backup.disableEncryption": {
+    capName: "backup",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "backup.getEncryption": {
+    capName: "backup",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
   "backup.getEntries": {
     capName: "backup",
     capScope: "system",
@@ -48760,6 +49862,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "backup.setupEncryption": {
+    capName: "backup",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "backup.trigger": {
     capName: "backup",
     capScope: "system",
@@ -49312,6 +50420,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "customModelRegistry.importModelBundle": {
+    capName: "custom-model-registry",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "customModelRegistry.listModels": {
     capName: "custom-model-registry",
     capScope: "system",
@@ -50752,6 +51866,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "keychainAdmin.acknowledgeReset": {
+    capName: "keychain-admin",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "keychainAdmin.deleteOrphans": {
     capName: "keychain-admin",
     capScope: "system",
@@ -50788,6 +51908,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "delete"
   },
+  "keychainAdmin.resetReport": {
+    capName: "keychain-admin",
+    capScope: "system",
+    addonId: null,
+    access: "delete"
+  },
   "keychainAdmin.reveal": {
     capName: "keychain-admin",
     capScope: "system",
@@ -52114,6 +53240,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "osdManager.setSlotCameraEnabled": {
+    capName: "osd-manager",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "osdManager.upsertTemplate": {
     capName: "osd-manager",
     capScope: "system",
@@ -52252,12 +53384,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
-  "pipelineAnalytics.createRetrainDatasetVersion": {
-    capName: "pipeline-analytics",
-    capScope: "device",
-    addonId: null,
-    access: "create"
-  },
   "pipelineAnalytics.deleteDeviceEvents": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -52270,12 +53396,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "delete"
   },
-  "pipelineAnalytics.deleteRetrainDatasetVersion": {
-    capName: "pipeline-analytics",
-    capScope: "device",
-    addonId: null,
-    access: "delete"
-  },
   "pipelineAnalytics.deleteTracks": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -52378,6 +53498,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "pipelineAnalytics.getRetrainCorpusKpi": {
+    capName: "pipeline-analytics",
+    capScope: "device",
+    addonId: null,
+    access: "view"
+  },
   "pipelineAnalytics.getRetrainExportUrl": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -52498,7 +53624,7 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
-  "pipelineAnalytics.listRetrainDatasetVersions": {
+  "pipelineAnalytics.listRetrainCorpusPage": {
     capName: "pipeline-analytics",
     capScope: "device",
     addonId: null,
@@ -52534,23 +53660,23 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
-  "pipelineAnalytics.ownersWithMedia": {
+  "pipelineAnalytics.offerRetrainArchive": {
     capName: "pipeline-analytics",
     capScope: "device",
     addonId: null,
-    access: "view"
+    access: "create"
   },
-  "pipelineAnalytics.pauseForStorageMigration": {
+  "pipelineAnalytics.ownersWithMedia": {
     capName: "pipeline-analytics",
     capScope: "device",
     addonId: null,
-    access: "create"
+    access: "view"
   },
-  "pipelineAnalytics.previewRetrainDataset": {
+  "pipelineAnalytics.pauseForStorageMigration": {
     capName: "pipeline-analytics",
     capScope: "device",
     addonId: null,
-    access: "view"
+    access: "create"
   },
   "pipelineAnalytics.proposeRetrainAnnotations": {
     capName: "pipeline-analytics",
@@ -52630,6 +53756,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "pipelineAnalytics.resolveRetrainTrainingCorpus": {
+    capName: "pipeline-analytics",
+    capScope: "device",
+    addonId: null,
+    access: "view"
+  },
   "pipelineAnalytics.restageRetrainTrack": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -52690,12 +53822,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
-  "pipelineAnalytics.verifyRetrainDatasetVersion": {
-    capName: "pipeline-analytics",
-    capScope: "device",
-    addonId: null,
-    access: "view"
-  },
   "pipelineAnalytics.wipeAllAnalytics": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -55072,6 +56198,180 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "training.canaryResult": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "training.cancelJob": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "training.discardResult": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "training.getJob": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "training.getJobResult": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "training.listBaseModels": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "training.listJobs": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "training.planJob": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "training.registerResult": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "training.rollbackCanary": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "training.startJob": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "training.startJobBatch": {
+    capName: "training",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "trainingProvider.cancelJob": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "trainingProvider.cleanupJob": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "trainingProvider.createEntry": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "trainingProvider.deleteEntry": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "delete"
+  },
+  "trainingProvider.describe": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "trainingProvider.describeTypes": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "trainingProvider.estimateJob": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "trainingProvider.getJob": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "trainingProvider.listEntries": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "trainingProvider.listJobEvents": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "trainingProvider.listJobs": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "view"
+  },
+  "trainingProvider.offerArtifact": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "trainingProvider.readResult": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "trainingProvider.submitJob": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "trainingProvider.updateEntry": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "trainingProvider.uploadDataset": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
+  "trainingProvider.validateCredentials": {
+    capName: "training-provider",
+    capScope: "system",
+    addonId: null,
+    access: "create"
+  },
   "turnProvider.getTurnServers": {
     capName: "turn-provider",
     capScope: "system",
@@ -55096,12 +56396,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
-  "userManagement.createApiKey": {
-    capName: "user-management",
-    capScope: "system",
-    addonId: null,
-    access: "create"
-  },
   "userManagement.createScopedToken": {
     capName: "user-management",
     capScope: "system",
@@ -55138,12 +56432,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
-  "userManagement.linkExternalIdentity": {
-    capName: "user-management",
-    capScope: "system",
-    addonId: null,
-    access: "create"
-  },
   "userManagement.listApiKeys": {
     capName: "user-management",
     capScope: "system",
@@ -55246,12 +56534,6 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
-  "userManagement.validateApiKey": {
-    capName: "user-management",
-    capScope: "system",
-    addonId: null,
-    access: "view"
-  },
   "userManagement.validateCredentials": {
     capName: "user-management",
     capScope: "system",
@@ -58326,6 +59608,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
     form: "single",
     optional: false
   }],
+  "osdManager.setSlotCameraEnabled": [{
+    name: "deviceId",
+    form: "single",
+    optional: false
+  }],
   "petFeeder.callPet": [{
     name: "deviceId",
     form: "single",
@@ -58546,6 +59833,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
     form: "array",
     optional: false
   }],
+  "pipelineAnalytics.listRetrainCorpusPage": [{
+    name: "deviceIds",
+    form: "array",
+    optional: true
+  }],
   "pipelineAnalytics.listRetrainStaging": [{
     name: "deviceIds",
     form: "array",
@@ -59407,6 +60699,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
     form: "single",
     optional: false
   }],
+  "training.canaryResult": [{
+    name: "deviceIds",
+    form: "array",
+    optional: false
+  }],
   "update.getStatus": [{
     name: "deviceId",
     form: "single",
@@ -59650,6 +60947,7 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 });
 var CAP_PROVIDER_KIND_MAP = Object.freeze({
   "broker": "broker",
+  "calendar-source": "calendar",
   "device-export": "device-export",
   "llm": "ai",
   "mesh-network": "mesh",
@@ -60377,6 +61675,26 @@ var NC_TEMPLATE_VARS = [
       "server-updated"
     ]
   },
+  {
+    name: "nodeName",
+    label: "Node name",
+    example: "little-unraid",
+    group: "system",
+    families: ["rule"],
+    fields: [...RULE_TEXT],
+    kinds: ["system"],
+    systemEventKinds: ["node-online", "node-offline"]
+  },
+  {
+    name: "offlineFor",
+    label: "Offline for",
+    example: "44 min",
+    group: "system",
+    families: ["rule"],
+    fields: [...RULE_TEXT],
+    kinds: ["system"],
+    systemEventKinds: ["node-online"]
+  },
   {
     name: "devices",
     label: "Devices",
@@ -60663,7 +61981,7 @@ var NC_TEMPLATE_VARS = [
   {
     name: "skipped",
     label: "Skipped count",
-    description: "How many named devices the mode cannot arm \u2014 muted, detection off, offline (title: m saltati).",
+    description: "How many named devices the mode cannot arm \u2014 muted, detection off, offline, or Arm-anyway exclusions (title: m saltati).",
     example: "1",
     group: "system",
     families: ["rule"],