@camstack/addon-auth 1.2.130 → 1.2.132

package/dist/{hub-browser-origin-B1o5vmQX.mjs → dist-DbaYwR-N.mjs}

@@ -1,4 +1,4 @@
-//#region ../types/dist/event-category-BGmz_oxW.mjs
+//#region ../types/dist/event-category-DaIZi00R.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -77,6 +77,13 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AddonLoadFailed"] = "addon.load-failed";
 	/**
+	* A keychain value was stored or removed (D787). Carries the ref, its
+	* owner and the new version — NEVER the value. A process holding the ref
+	* drops its cached copy and the owning `BaseAddon` re-resolves its config.
+	* Telemetry (D8): a process that misses it still revalidates by version.
+	*/
+	EventCategory["KeychainChanged"] = "keychain.changed";
+	/**
 	* Addon recovered from a previous failure. Emitted when an addon
 	* transitions from `failed` back to `healthy` (typically via the
 	* monitor's auto-retry loop, or after manual `addons.retryLoad`).
@@ -499,15 +506,6 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["AgentWsDisconnected"] = "agent.ws.disconnected";
 	EventCategory["AgentBackupActivated"] = "agent.backup.activated";
 	EventCategory["OrchestrationSettingsUpdated"] = "orchestration.settings-updated";
-	/**
-	* Per-agent hwaccel preference changed (user override set, cleared, or
-	* re-probed). Observability event — decoders pull the current pref at
-	* `createSession`, so running sessions keep their current backend until
-	* they rotate naturally (camera add/remove, stream restart). Future
-	* work can wire a listener in stream-broker that force-rotates live
-	* sessions; for now this event powers logs + admin-UI toast feedback.
-	*/
-	EventCategory["PipelineAgentHwaccelChanged"] = "pipeline.agent-hwaccel-changed";
 	EventCategory["MotionAnalysis"] = "detection.motion-analysis";
 	/** All raw motion zones from CCL before minArea filter — for UI debug overlay. */
 	EventCategory["MotionZonesRaw"] = "detection.motion-zones-raw";
@@ -5378,7 +5376,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-C16NCZR2.mjs
+//#region ../types/dist/sleep-Cr5YOk3m.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -5457,6 +5455,97 @@ function buildAlawTable() {
 }
 buildUlawTable();
 buildAlawTable();
+/** Is this field's stored value a credential? */
+function isSecretConfigField(field) {
+	if (field.type === "password") return true;
+	return "secret" in field && field.secret === true;
+}
+/**
+* Is this field's value stored in the KEYCHAIN (D787)? Every secret field is,
+* by its TYPE, unless it opts out with `storage: 'inline'` — never by its name.
+*/
+function isKeychainStoredField(field) {
+	if (!isSecretConfigField(field)) return false;
+	if (field.type === "textarea" && field.isJson === true) return false;
+	return !("storage" in field && field.storage === "inline");
+}
+/**
+* What a settings blob holds where a secret used to be.
+*
+* A keychain-stored field never holds its value. It holds a self-describing
+* MARKER, `{"$secret":"secret://…","v":1}` — an object, never a string, so no
+* code can mistake it for a credential and no form can send it to a camera as
+* a password. The empty state is `null` / absent, never `''`.
+*
+* The same shapes travel to and from the admin UI:
+*
+*  - read: `hydrateSchema` hands a secret field a {@link SecretFieldView}
+*    (`{ $secret, v, set: true }`) or `null` — the browser learns whether a
+*    value is set, never the value.
+*  - write: an untouched field submits the view back unchanged (KEEP); a typed
+*    value is a plain non-empty string (CHANGE); the Clear button submits
+*    {@link SECRET_CLEAR} (CLEAR). `''`, `null` and the legacy redaction tokens
+*    are KEEP — an empty string is what a defaults-fallback pushes back, and
+*    treating it as "clear" is how a save destroyed a stored credential before.
+*
+* Pure and browser-safe.
+*/
+var SECRET_CLEAR = { $secretClear: true };
+/** The `'***'` token D634 redaction writes for non-admins. */
+var LEGACY_DEVICE_REDACTION = "***";
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function makeSecretMarker(ref) {
+	return {
+		$secret: ref,
+		v: 1
+	};
+}
+/** A stored marker: an object whose `$secret` is a non-empty string. */
+function isSecretMarker(value) {
+	if (!isRecord$1(value)) return false;
+	const ref = value["$secret"];
+	return typeof ref === "string" && ref.length > 0;
+}
+function isSecretClear(value) {
+	return isRecord$1(value) && value["$secretClear"] === true;
+}
+/**
+* The UI view of a stored secret field value: a marker becomes "set", inline
+* plaintext becomes "set (inline)", nothing becomes `null`. A value never
+* survives this function.
+*/
+function toSecretFieldView(stored) {
+	if (isSecretMarker(stored)) return {
+		$secret: stored.$secret,
+		v: 1,
+		set: true
+	};
+	if (typeof stored === "string" && stored.length > 0) return {
+		$secret: null,
+		v: 1,
+		set: true,
+		inline: true
+	};
+	return null;
+}
+/**
+* Classify an incoming value for a secret path. Only a non-empty string that is
+* not a redaction token sets a value; only {@link SECRET_CLEAR} clears.
+* Everything else — a marker (ours or anyone's), a UI view, `''`, `null`,
+* `undefined`, a redaction token, a non-string — keeps what is stored.
+*/
+function classifySecretWrite(incoming) {
+	if (isSecretClear(incoming)) return { kind: "clear" };
+	if (typeof incoming !== "string") return { kind: "keep" };
+	if (incoming.length === 0) return { kind: "keep" };
+	if (incoming === "__camstack_redacted__" || incoming === LEGACY_DEVICE_REDACTION) return { kind: "keep" };
+	return {
+		kind: "set",
+		value: incoming
+	};
+}
 Object.fromEntries([
 	{
 		id: "overview",
@@ -5628,33 +5717,19 @@ Object.fromEntries([
 function isValuelessField(field) {
 	return field.type === "separator" || field.type === "info" || field.type === "qr-code" || field.type === "button" || field.type === "object-array" || field.type === "widget" || field.type === "addon-action-button" || field.type === "device-action-button";
 }
-/**
-* Merge a `ConfigUISchema` with a raw `values` record into a
-* `ConfigUISchemaWithValues`. Used by every `get*Settings` backend endpoint
-* before returning to the admin UI. Groups are walked recursively.
-*
-* For each leaf field:
-*   - structural fields (`separator`, `info`, `button`) pass through unchanged
-*   - other fields get `value = values[key] ?? field.default ?? null`
-*
-* Unknown keys in `values` (keys not declared in the schema) are silently
-* ignored — they don't contribute to the output. Missing keys fall back to
-* the schema default or `null`. This mirrors the old backend behaviour where
-* `FormBuilder` rendered `values[key] ?? field.default`.
-*/
-function hydrateSchema(schema, values) {
+function hydrateSchema(schema, values, options = {}) {
 	return {
 		...schema.tabs ? { tabs: [...schema.tabs] } : {},
 		sections: schema.sections.map((section) => ({
 			...section,
-			fields: section.fields.map((field) => hydrateField(field, values))
+			fields: section.fields.map((field) => hydrateField(field, values, options))
 		}))
 	};
 }
-function hydrateField(field, values) {
+function hydrateField(field, values, options) {
 	if (isValuelessField(field)) return field;
 	if (field.type === "group") {
-		const hydratedChildren = field.fields.map((child) => hydrateField(child, values));
+		const hydratedChildren = field.fields.map((child) => hydrateField(child, values, options));
 		return {
 			...field,
 			fields: hydratedChildren
@@ -5663,7 +5738,7 @@ function hydrateField(field, values) {
 	if (field.type === "sub-tabs") {
 		const hydratedTabs = field.tabs.map((tab) => ({
 			...tab,
-			fields: tab.fields.map((child) => hydrateField(child, values))
+			fields: tab.fields.map((child) => hydrateField(child, values, options))
 		}));
 		return {
 			...field,
@@ -5673,6 +5748,33 @@ function hydrateField(field, values) {
 	const key = field.key;
 	const storedValue = Object.prototype.hasOwnProperty.call(values, key) ? values[key] : void 0;
 	const defaultValue = field.default;
+	const asView = (v) => isSecretMarker(v) || options.inlineSecretsAsViews === true && v !== void 0;
+	if (isKeychainStoredField(field) && asView(storedValue)) return {
+		...field,
+		value: toSecretFieldView(storedValue)
+	};
+	if (isKeychainStoredField(field) && options.inlineSecretsAsViews === true) return {
+		...field,
+		value: null
+	};
+	if (field.type === "editable-array" && Array.isArray(storedValue)) {
+		const secretItemKeys = field.itemFields.filter((item) => "key" in item && isKeychainStoredField(item)).map((item) => "key" in item ? item.key : "");
+		if (secretItemKeys.length > 0) {
+			const rows = storedValue.map((row) => {
+				if (row === null || typeof row !== "object" || Array.isArray(row)) return row;
+				const out = { ...row };
+				for (const k of secretItemKeys) {
+					const v = Reflect.get(row, k);
+					if (asView(v)) out[k] = toSecretFieldView(v);
+				}
+				return out;
+			});
+			return {
+				...field,
+				value: rows
+			};
+		}
+	}
 	if (field.multiple) {
 		const stored = Array.isArray(storedValue) ? storedValue : storedValue !== void 0 && storedValue !== null ? [storedValue] : [];
 		const itemFallback = field.multiple.itemDefault !== void 0 ? field.multiple.itemDefault : defaultValue !== void 0 ? defaultValue : typeOf(field) === "string" ? "" : null;
@@ -5915,6 +6017,431 @@ function projectStore(store, perNodeKeys, nodeId) {
 	}
 	return out;
 }
+var GLOBAL_SCOPE = { kind: "global" };
+/** The scope every addon-wide (not per-node, not per-device) setting lives in. */
+function globalSecretScope() {
+	return GLOBAL_SCOPE;
+}
+function encodeSegment(value) {
+	return encodeURIComponent(value);
+}
+/**
+* The field path of a value inside an array item, addressed by the item's id:
+* `arrayItemFieldPath('providers', 'authentik', 'clientSecret')` →
+* `providers[authentik].clientSecret`.
+*/
+function arrayItemFieldPath(arrayKey, itemId, fieldKey) {
+	return `${arrayKey}[${encodeSegment(itemId)}].${fieldKey}`;
+}
+/** A write to a secret path could not be stored in the keychain, so it was refused. */
+var KeychainWriteRefusedError = class extends Error {
+	fieldPath;
+	constructor(fieldPath, cause) {
+		super(`secret "${fieldPath}" was not saved: the keychain could not store it (${cause instanceof Error ? cause.message : String(cause)}). Nothing was written.`);
+		this.fieldPath = fieldPath;
+		this.name = "KeychainWriteRefusedError";
+	}
+};
+var KEEP = { kind: "keep" };
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function defaultMintId() {
+	return globalThis.crypto.randomUUID();
+}
+/** Every marker ref anywhere under `value`. */
+function collectSecretMarkerRefs(value, out = []) {
+	if (isSecretMarker(value)) {
+		out.push(value.$secret);
+		return out;
+	}
+	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
+	else if (isRecord(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	return out;
+}
+async function storedValueEquals(secrets, marker, candidate) {
+	const resolved = (await secrets.resolve([marker.$secret]))[marker.$secret];
+	return resolved?.kind === "value" && resolved.value === candidate;
+}
+async function writeLeaf(ctx, incoming, stored, fieldPath) {
+	const intent = classifySecretWrite(incoming);
+	const ref = ctx.secrets.ref(ctx.scope, fieldPath);
+	const storedIsOurs = isSecretMarker(stored) && stored.$secret === ref;
+	if (intent.kind === "keep") return KEEP;
+	if (intent.kind === "set" && !ctx.operatorWrite && typeof stored === "string" && stored === intent.value) return KEEP;
+	if (intent.kind === "clear") {
+		if (storedIsOurs) ctx.deletes.push(ref);
+		return {
+			kind: "value",
+			value: null
+		};
+	}
+	if (storedIsOurs && await storedValueEquals(ctx.secrets, stored, intent.value)) return {
+		kind: "value",
+		value: stored
+	};
+	try {
+		await ctx.secrets.put(ref, intent.value);
+	} catch (err) {
+		throw new KeychainWriteRefusedError(fieldPath, err);
+	}
+	return {
+		kind: "value",
+		value: makeSecretMarker(ref)
+	};
+}
+/** Apply a member result onto `out`: KEEP restores the stored member, or removes it. */
+function applyMember(out, key, result, storedParent) {
+	if (result.kind === "value") {
+		out[key] = result.value;
+		return;
+	}
+	if (Object.prototype.hasOwnProperty.call(storedParent, key)) out[key] = storedParent[key];
+	else delete out[key];
+}
+async function writeMembers(ctx, children, incoming, stored, pathOf) {
+	const out = { ...incoming };
+	for (const [member, node] of children) applyMember(out, member, await writeNode(ctx, node, incoming[member], stored[member], pathOf(member)), stored);
+	return out;
+}
+function rowId(row, idKey) {
+	const raw = row[idKey];
+	if (typeof raw === "string" && raw.length > 0) return raw;
+	if (typeof raw === "number" && Number.isFinite(raw)) return String(raw);
+	return null;
+}
+async function writeArray(ctx, node, incoming, stored, fieldPath) {
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord) : [];
+	if (!Array.isArray(incoming)) {
+		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
+		return {
+			kind: "value",
+			value: incoming
+		};
+	}
+	const storedById = /* @__PURE__ */ new Map();
+	for (const row of storedRows) {
+		const id = rowId(row, node.idKey);
+		if (id !== null) storedById.set(id, row);
+	}
+	const kept = /* @__PURE__ */ new Set();
+	const rows = [];
+	for (const row of incoming) {
+		if (!isRecord(row)) {
+			rows.push(row);
+			continue;
+		}
+		const id = rowId(row, node.idKey) ?? ctx.mintId();
+		kept.add(id);
+		const withId = {
+			...row,
+			[node.idKey]: row[node.idKey] ?? id
+		};
+		if (rowId(withId, node.idKey) === null) withId[node.idKey] = id;
+		const storedRow = storedById.get(id) ?? {};
+		rows.push(await writeMembers(ctx, node.item, withId, storedRow, (member) => arrayItemFieldPath(fieldPath, id, member)));
+	}
+	for (const [id, row] of storedById) if (!kept.has(id)) ctx.deletes.push(...collectSecretMarkerRefs(row));
+	return {
+		kind: "value",
+		value: rows
+	};
+}
+async function writeNode(ctx, node, incoming, stored, fieldPath) {
+	switch (node.kind) {
+		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
+		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
+		case "object": {
+			if (!isRecord(incoming)) {
+				if (incoming === void 0) return KEEP;
+				ctx.deletes.push(...collectSecretMarkerRefs(stored));
+				return {
+					kind: "value",
+					value: incoming
+				};
+			}
+			const storedObj = isRecord(stored) ? stored : {};
+			return {
+				kind: "value",
+				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
+			};
+		}
+	}
+}
+/** Split a perNode-scoped key (`key@nodeId`). */
+function splitNodeKey(key) {
+	const at = key.indexOf("@");
+	return at <= 0 ? {
+		base: key,
+		nodeId: null
+	} : {
+		base: key.slice(0, at),
+		nodeId: key.slice(at + 1)
+	};
+}
+/** Rewrite a settings patch so no secret value reaches the blob. See the file doc. */
+async function transformSecretWrite(input) {
+	const deletes = [];
+	const base = {
+		secrets: input.secrets,
+		mintId: input.mintId ?? defaultMintId,
+		deletes,
+		operatorWrite: input.operatorWrite === true
+	};
+	const out = {};
+	for (const [key, incoming] of Object.entries(input.patch)) {
+		const { base: baseKey, nodeId } = splitNodeKey(key);
+		const node = input.tree.get(baseKey);
+		if (node === void 0) {
+			out[key] = incoming;
+			continue;
+		}
+		const scope = nodeId !== null && nodeId.length > 0 ? {
+			kind: "node",
+			nodeId
+		} : input.scope ?? globalSecretScope();
+		const result = await writeNode({
+			...base,
+			scope
+		}, node, incoming, input.stored[key], baseKey);
+		if (result.kind === "value") out[key] = result.value;
+	}
+	return {
+		patch: out,
+		afterWrite: async () => {
+			if (deletes.length === 0) return { orphaned: [] };
+			try {
+				await input.secrets.delete([...new Set(deletes)]);
+				return { orphaned: [] };
+			} catch {
+				return { orphaned: [...new Set(deletes)] };
+			}
+		}
+	};
+}
+/**
+* Replace every marker in `value` with its keychain value. Returns the SAME
+* reference when there is no marker (no allocation, no keychain call).
+*/
+async function resolveSecretMarkers(value, secrets) {
+	const refs = collectSecretMarkerRefs(value);
+	if (refs.length === 0) return {
+		value,
+		unresolved: []
+	};
+	const answers = await secrets.resolve(refs);
+	const unresolved = [];
+	for (const ref of new Set(refs)) {
+		const answer = answers[ref];
+		if (answer === void 0) unresolved.push({
+			ref,
+			reason: "not-initialized"
+		});
+		else if (answer.kind === "unavailable") unresolved.push({
+			ref,
+			reason: answer.reason
+		});
+		else if (answer.kind === "missing" || answer.kind === "forbidden") unresolved.push({
+			ref,
+			reason: answer.kind
+		});
+	}
+	const substitute = (v) => {
+		if (isSecretMarker(v)) {
+			const answer = answers[v.$secret];
+			return answer?.kind === "value" ? {
+				keep: true,
+				value: answer.value
+			} : {
+				keep: false,
+				value: void 0
+			};
+		}
+		if (Array.isArray(v)) {
+			const items = [];
+			for (const item of v) {
+				const s = substitute(item);
+				if (s.keep) items.push(s.value);
+			}
+			return {
+				keep: true,
+				value: items
+			};
+		}
+		if (isRecord(v)) {
+			const out = {};
+			for (const [k, child] of Object.entries(v)) {
+				const s = substitute(child);
+				if (s.keep) out[k] = s.value;
+			}
+			return {
+				keep: true,
+				value: out
+			};
+		}
+		return {
+			keep: true,
+			value: v
+		};
+	};
+	return {
+		value: substitute(value).value,
+		unresolved
+	};
+}
+function touchesTree(tree, patch) {
+	if (tree.size === 0) return false;
+	for (const key of Object.keys(patch)) {
+		const at = key.indexOf("@");
+		if (tree.has(at > 0 ? key.slice(0, at) : key)) return true;
+	}
+	return false;
+}
+/** The blob as stored now; a failed read REFUSES the write instead of guessing. */
+async function readStoredAddonBlob(raw) {
+	const threeWay = raw.readAddonStoreResult;
+	if (threeWay === void 0) return raw.readAddonStore();
+	const result = await threeWay.call(raw);
+	if (result.kind === "failed") throw new Error(`settings write refused: the stored blob could not be read (${result.error})`);
+	return result.kind === "missing" ? {} : result.value;
+}
+function createSecretAwareSettings(raw, opts) {
+	const chains = /* @__PURE__ */ new Map();
+	const serialize = (key, fn) => {
+		const next = (chains.get(key) ?? Promise.resolve()).then(fn, fn);
+		const tail = next.catch(() => void 0);
+		chains.set(key, tail);
+		tail.then(() => {
+			if (chains.get(key) === tail) chains.delete(key);
+		});
+		return next;
+	};
+	const write = async (chainKey, tree, scope, patch, readStored, rawWrite) => {
+		if (!touchesTree(tree, patch)) return rawWrite(patch);
+		return serialize(chainKey, async () => {
+			const stored = await readStored();
+			const result = await transformSecretWrite({
+				tree,
+				secrets: opts.secrets,
+				patch,
+				stored,
+				...scope !== void 0 ? { scope } : {},
+				operatorWrite: opts.isOperatorWrite?.() === true
+			});
+			if (Object.keys(result.patch).length > 0) await rawWrite(result.patch);
+			const { orphaned } = await result.afterWrite();
+			if (orphaned.length > 0) opts.onOrphaned(orphaned);
+		});
+	};
+	const wrapped = {
+		writeAddonStore: (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p)),
+		writeDeviceStore: (deviceId, patch) => write(`device:${deviceId}`, opts.deviceTree(), {
+			kind: "device",
+			deviceId
+		}, patch, () => raw.readDeviceStore(deviceId), (p) => raw.writeDeviceStore(deviceId, p))
+	};
+	return new Proxy(raw, { get(target, prop, receiver) {
+		if (prop === "writeAddonStore") return wrapped.writeAddonStore;
+		if (prop === "writeDeviceStore") return wrapped.writeDeviceStore;
+		const value = Reflect.get(target, prop, receiver);
+		return typeof value === "function" ? value.bind(target) : value;
+	} });
+}
+/** The context the addon sees: identical, except that its settings writes are secret-aware. */
+function withSecretAwareSettings(context, opts) {
+	const raw = context.settings;
+	if (raw === void 0) return context;
+	const settings = createSecretAwareSettings(raw, opts);
+	return new Proxy(context, { get(target, prop, receiver) {
+		if (prop === "settings") return settings;
+		return Reflect.get(target, prop, receiver);
+	} });
+}
+var LEAF = { kind: "leaf" };
+var DEFAULT_ITEM_ID_KEY = "id";
+function collectFields(fields, out) {
+	for (const field of fields) {
+		if (field.type === "group") {
+			collectFields(field.fields, out);
+			continue;
+		}
+		if (field.type === "sub-tabs") {
+			for (const tab of field.tabs) collectFields(tab.fields, out);
+			continue;
+		}
+		if (field.type === "editable-array") {
+			const item = /* @__PURE__ */ new Map();
+			for (const itemField of field.itemFields) if ("key" in itemField && isKeychainStoredField(itemField)) item.set(itemField.key, LEAF);
+			if (item.size > 0) out.set(field.key, {
+				kind: "array",
+				idKey: field.itemIdKey ?? DEFAULT_ITEM_ID_KEY,
+				item
+			});
+			continue;
+		}
+		if (!("key" in field) || typeof field.key !== "string") continue;
+		if (isKeychainStoredField(field)) out.set(field.key, LEAF);
+	}
+}
+/** The secret tree a settings schema declares. */
+function secretTreeFromSchema(schema) {
+	const out = /* @__PURE__ */ new Map();
+	if (schema === null) return out;
+	for (const section of schema.sections) collectFields(section.fields, out);
+	return out;
+}
+/** Parse `a.b[id].c` into segments; throws on a malformed path (a declaration bug). */
+function parseSecretStatePath(path) {
+	const segments = [];
+	for (const raw of path.split(".")) {
+		const m = /^([^[\]]+)(?:\[([^[\]]+)\])?$/.exec(raw);
+		if (m === null || m[1] === void 0) throw new Error(`secretStatePaths: malformed path "${path}"`);
+		segments.push(m[2] !== void 0 ? {
+			key: m[1],
+			idKey: m[2]
+		} : { key: m[1] });
+	}
+	if (segments.length === 0) throw new Error(`secretStatePaths: empty path`);
+	if (segments[segments.length - 1]?.idKey !== void 0) throw new Error(`secretStatePaths: "${path}" ends on an array — name the member that is secret`);
+	return segments;
+}
+function insert(into, segments) {
+	const [head, ...rest] = segments;
+	if (head === void 0) return;
+	if (rest.length === 0) {
+		into.set(head.key, LEAF);
+		return;
+	}
+	const existing = into.get(head.key);
+	if (head.idKey !== void 0) {
+		const item = new Map(existing?.kind === "array" ? existing.item : []);
+		insert(item, rest);
+		into.set(head.key, {
+			kind: "array",
+			idKey: head.idKey,
+			item
+		});
+		return;
+	}
+	const children = new Map(existing?.kind === "object" ? existing.children : []);
+	insert(children, rest);
+	into.set(head.key, {
+		kind: "object",
+		children
+	});
+}
+/** Add hidden-state paths (`secretStatePaths`) to a schema-derived tree. */
+function mergeSecretStatePaths(tree, paths) {
+	if (paths.length === 0) return tree;
+	const out = new Map(tree);
+	for (const path of paths) insert(out, parseSecretStatePath(path));
+	return out;
+}
+/** First retry of a secret the keychain could not serve; doubles to {@link SECRET_RETRY_MAX_MS}. */
+var SECRET_RETRY_FIRST_MS = 5e3;
+var SECRET_RETRY_MAX_MS = 5 * 6e4;
+/** Coalesces a burst of `keychain.changed` events into one re-resolve. */
+var SECRET_CHANGE_DEBOUNCE_MS = 250;
 /**
 * Base class for CamStack addons. Eliminates settings boilerplate:
 *
@@ -5984,6 +6511,25 @@ var BaseAddon = class {
 	settingsStoreReady = false;
 	/** Default config values. Provided via constructor. */
 	defaults;
+	/**
+	* Hidden-state paths that hold secrets (D787) — values the addon writes
+	* itself (`updateGlobalSettings`, `state()`) that no form field declares.
+	* Stored in the keychain exactly like a `password` field. Syntax:
+	* `'snapshotSigningKey'`, `'identity.pincode'`, `'tokens[userId].accessToken'`
+	* (`key[<id field>]` addresses array items by id, never by index).
+	*/
+	secretStatePaths = [];
+	_addonSecretTree = null;
+	_deviceSecretTree = null;
+	/** Refs the last resolved config pointed at — a change to one re-resolves. */
+	_configSecretRefs = /* @__PURE__ */ new Set();
+	_unresolvedSecrets = [];
+	_secretRetryTimer = null;
+	_secretRetryDelayMs = SECRET_RETRY_FIRST_MS;
+	_secretChangeTimer = null;
+	_secretChangeUnsub = null;
+	/** >0 while an OPERATOR's settings write is being applied. */
+	_operatorWriteDepth = 0;
 	constructor(defaults) {
 		this.defaults = defaults;
 		this._config = { ...defaults };
@@ -6019,8 +6565,18 @@ var BaseAddon = class {
 		return this._config;
 	}
 	async initialize(context) {
-		this._ctx = context;
+		const secrets = context.secrets;
+		this._ctx = secrets !== void 0 ? withSecretAwareSettings(context, {
+			secrets,
+			addonTree: () => this.addonSecretTree(),
+			deviceTree: () => this.deviceSecretTree(),
+			onOrphaned: (refs) => context.logger.warn("keychain refs dropped by a settings write could not be deleted", { meta: { refs: [...refs] } }),
+			isOperatorWrite: () => this._operatorWriteDepth > 0
+		}) : context;
 		await this.resolveConfig();
+		if (secrets !== void 0) this._secretChangeUnsub = secrets.onChange((ref) => {
+			if (this._configSecretRefs.has(ref)) this.scheduleSecretReresolve(SECRET_CHANGE_DEBOUNCE_MS);
+		});
 		const result = await this.onInitialize();
 		this.emitLifecycle(EventCategory.AddonStarted);
 		const normalized = normalizeAddonInitResult(result);
@@ -6053,6 +6609,12 @@ var BaseAddon = class {
 	*/
 	async onHubReachable() {}
 	async shutdown() {
+		this._secretChangeUnsub?.();
+		this._secretChangeUnsub = null;
+		if (this._secretRetryTimer !== null) clearTimeout(this._secretRetryTimer);
+		if (this._secretChangeTimer !== null) clearTimeout(this._secretChangeTimer);
+		this._secretRetryTimer = null;
+		this._secretChangeTimer = null;
 		this.emitLifecycle(EventCategory.AddonStopped);
 		if (this.autoEmitReadiness) this.emitReadinessForProviders("down");
 		await this.onShutdown();
@@ -6131,7 +6693,7 @@ var BaseAddon = class {
 		return hydrateSchema(schema, overlay ? {
 			...projected,
 			...overlay
-		} : projected);
+		} : projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The integration-level view of this addon's settings: exactly the sections
@@ -6180,7 +6742,7 @@ var BaseAddon = class {
 		return hydrateSchema({
 			...schema,
 			sections
-		}, projected);
+		}, projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The raw addon store PROJECTED onto the target node's bare per-node keys:
@@ -6234,18 +6796,50 @@ var BaseAddon = class {
 			value: result.value[key]
 		};
 	}
+	/**
+	* The OPERATOR's write — a settings form or an admin API call, dispatched by
+	* the kernel. Identical to {@link updateGlobalSettings}, except that a secret
+	* the operator sends is stored as sent even when it equals a pre-keychain
+	* inline value: the operator re-entering a password is a change, an addon
+	* writing back what it read is not (D787).
+	*/
+	async updateGlobalSettingsAsOperator(patch, nodeId) {
+		this._operatorWriteDepth++;
+		try {
+			await this.applyGlobalPatch(patch, nodeId);
+		} finally {
+			this._operatorWriteDepth--;
+		}
+	}
 	async updateGlobalSettings(patch, nodeId) {
+		await this.applyGlobalPatch(patch, nodeId);
+	}
+	/**
+	* REMOVE stored secrets — their keychain values and their markers (D787).
+	*
+	* Writing `''` to a secret field KEEPS what is stored (an empty string is
+	* what a defaults fallback writes back, and it must never destroy a
+	* credential), so code that means "forget this token" says so here. Without
+	* a keychain (an older kernel) it writes `''`, as such code always did.
+	*/
+	async clearSecrets(keys, nodeId) {
+		const tree = this.addonSecretTree();
+		const keychain = this._ctx?.secrets !== void 0;
+		const patch = {};
+		for (const key of keys) patch[key] = keychain && tree.has(key) ? SECRET_CLEAR : "";
+		await this.applyGlobalPatch(patch, nodeId);
+	}
+	async applyGlobalPatch(barePatch, nodeId) {
 		const keys = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
-		const barePatch = patch;
 		const scoped = keys.size > 0 ? scopePatch(barePatch, keys, target) : barePatch;
 		await this._ctx?.settings?.writeAddonStore(scoped);
 		if (target !== localNode) return;
 		await this.resolveConfig();
 		await this.onConfigChanged();
 		this.emitLifecycle(EventCategory.AddonUpdated, { level: "global" });
-		this.maybeAutoRestart(patch, this.globalSettingsSchema());
+		this.maybeAutoRestart(Object.keys(barePatch), this.globalSettingsSchema());
 	}
 	/**
 	* The set of field keys the global settings schema declares `perNode: true`
@@ -6270,7 +6864,7 @@ var BaseAddon = class {
 	* time to return its response before the addon is torn down and
 	* re-initialised by `AddonRegistryService.restartAddon`.
 	*/
-	maybeAutoRestart(patch, schema) {
+	maybeAutoRestart(patchKeys, schema) {
 		if (!schema) return;
 		const restartKeys = /* @__PURE__ */ new Set();
 		for (const section of schema.sections) for (const field of section.fields) {
@@ -6278,13 +6872,13 @@ var BaseAddon = class {
 			if (field.requiresRestart) restartKeys.add(field.key);
 		}
 		if (restartKeys.size === 0) return;
-		if (!Object.keys(patch).some((k) => restartKeys.has(k))) return;
+		if (!patchKeys.some((k) => restartKeys.has(k))) return;
 		const ctx = this._ctx;
 		if (!ctx) return;
 		const addonId = ctx.id;
 		setImmediate(() => {
 			ctx.api.addons?.restartAddon?.mutate({ addonId }).then(() => {
-				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: Object.keys(patch).filter((k) => restartKeys.has(k)) } });
+				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: patchKeys.filter((k) => restartKeys.has(k)) } });
 			}).catch((err) => {
 				ctx.logger.error("addon auto-restart failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
 			});
@@ -6293,7 +6887,7 @@ var BaseAddon = class {
 	async getDeviceSettings(deviceId) {
 		const schema = this.deviceSettingsSchema();
 		if (!schema) return { sections: [] };
-		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {});
+		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, { inlineSecretsAsViews: true });
 	}
 	async updateDeviceSettings(deviceId, patch) {
 		await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
@@ -6423,7 +7017,7 @@ var BaseAddon = class {
 	* selection at boot (absent scoped key ⇒ the constructor default wins).
 	*/
 	async resolveConfig() {
-		const stored = await this.readAddonStoreWithRetry();
+		const stored = await this.resolveStoredSecrets(await this.readAddonStoreWithRetry());
 		const perNode = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const resolved = { ...this.defaults };
@@ -6448,7 +7042,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: () => this.readAddonStoreWithRetry(),
+			read: async () => this.resolveStoredSecrets(await this.readAddonStoreWithRetry()),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeAddonStore(patch);
 			},
@@ -6465,7 +7059,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: async () => await this._ctx?.settings?.readDeviceStore(deviceId) ?? {},
+			read: async () => this.resolveStoredSecrets(await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, false),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
 			},
@@ -6477,6 +7071,70 @@ var BaseAddon = class {
 			} })
 		});
 	}
+	/** The addon store's secret tree: schema fields by TYPE, plus `secretStatePaths`. */
+	addonSecretTree() {
+		this._addonSecretTree ??= mergeSecretStatePaths(secretTreeFromSchema(this.globalSettingsSchema()), this.secretStatePaths);
+		return this._addonSecretTree;
+	}
+	deviceSecretTree() {
+		this._deviceSecretTree ??= secretTreeFromSchema(this.deviceSettingsSchema());
+		return this._deviceSecretTree;
+	}
+	/**
+	* Secrets of this addon's stored config that could not be resolved on the
+	* last read, with why. Non-empty means the addon is running WITHOUT them —
+	* an addon whose function needs one should report itself degraded rather
+	* than start on an empty credential.
+	*/
+	get unresolvedSecrets() {
+		return this._unresolvedSecrets;
+	}
+	/**
+	* Substitute every keychain marker in a stored blob with its value. With no
+	* keychain (no `ctx.secrets`) or no marker, the blob comes back unchanged.
+	* An unresolvable value is LEFT OUT (never `''`), logged by ref — never by
+	* value — and, when the cause can pass, retried with backoff. Nothing is
+	* ever written back from here.
+	*/
+	async resolveStoredSecrets(blob, trackForConfig = true) {
+		const secrets = this._ctx?.secrets;
+		if (secrets === void 0) return blob;
+		const refs = collectSecretMarkerRefs(blob);
+		if (trackForConfig) this._configSecretRefs = new Set(refs);
+		if (refs.length === 0) {
+			if (trackForConfig) this._unresolvedSecrets = [];
+			return blob;
+		}
+		const { value, unresolved } = await resolveSecretMarkers(blob, secrets);
+		if (trackForConfig) {
+			this._unresolvedSecrets = unresolved;
+			if (unresolved.length > 0) {
+				this._ctx?.logger?.error?.("secret unavailable — running without it, will retry", { meta: { secrets: unresolved.map((u) => ({
+					ref: u.ref,
+					reason: u.reason
+				})) } });
+				if (unresolved.some((u) => u.reason !== "missing" && u.reason !== "forbidden")) {
+					this.scheduleSecretReresolve(this._secretRetryDelayMs);
+					this._secretRetryDelayMs = Math.min(this._secretRetryDelayMs * 2, SECRET_RETRY_MAX_MS);
+				}
+			} else this._secretRetryDelayMs = SECRET_RETRY_FIRST_MS;
+		}
+		return value;
+	}
+	/** Re-resolve the config (a keychain-only change, or a retry) and apply it. */
+	scheduleSecretReresolve(delayMs) {
+		const timerOf = delayMs === SECRET_CHANGE_DEBOUNCE_MS ? "_secretChangeTimer" : "_secretRetryTimer";
+		if (this[timerOf] !== null) return;
+		const timer = setTimeout(() => {
+			this[timerOf] = null;
+			if (this._ctx === null) return;
+			this.resolveConfig().then(() => this.onConfigChanged()).catch((err) => {
+				this._ctx?.logger?.error?.("re-resolving secrets failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			});
+		}, delayMs);
+		timer.unref?.();
+		this[timerOf] = timer;
+	}
 	/**
 	* Wrap `ctx.settings.readAddonStore()` with a short retry budget so a
 	* transient settings-store outage (mid-restart of sqlite-settings, tsx-watch
@@ -6744,32 +7402,12 @@ object({
 	audioCodec: string().optional(),
 	metadata: record(string(), unknown()).readonly().optional()
 });
-var EncodedPacketSchema = object({
-	type: _enum(["video", "audio"]),
-	data: _instanceof(Uint8Array),
-	pts: number(),
-	dts: number(),
-	keyframe: boolean(),
-	codec: string()
-});
-var DecodedFrameSchema = object({
-	data: _instanceof(Uint8Array),
-	width: number(),
-	height: number(),
-	format: _enum([
-		"jpeg",
-		"rgb",
-		"bgr",
-		"yuv420",
-		"gray"
-	]),
-	timestamp: number()
-});
 /**
 * Wire schema for `FrameHandle` — a zero-pixel, serialisable reference to a
 * frame in a shared-memory ring (Phase 5 / D9). Mirrors the `FrameHandle` TS
-* interface in `interfaces/frame-handle.ts` field-for-field so a decoder cap
-* method (`pullHandles`) can carry handles over tRPC / Moleculer.
+* interface in `interfaces/frame-handle.ts` field-for-field so a cap method
+* (the runner's native-crop and pipeline-executor inputs) can carry handles
+* over tRPC / Moleculer.
 *
 * The `satisfies` assertion below pins this schema to the interface: if a
 * field is added to / removed from `FrameHandle` without a matching schema
@@ -6795,50 +7433,6 @@ var FrameHandleSchema = object({
 	slotCount: number().int().positive()
 });
 /**
-* Pixel format a frame-handle subscriber can request from the broker
-* (Phase 5 / D9). The packed, raster subset of `FrameFormat` — the formats a
-* `frameSink: 'shm'` decoder session can write into a `FrameRing` slot.
-* `jpeg` is excluded: a variable-length stream is not a fixed-stride ring
-* payload, and no decoded-frame consumer requests it over the shm plane.
-*/
-var FrameHandleFormatSchema = _enum([
-	"rgb",
-	"bgr",
-	"yuv420",
-	"gray"
-]);
-/**
-* Input for `stream-broker.subscribeFrames` (Phase 5 / D9). A consumer asks the
-* broker for a `FrameHandle` stream of one `format`; the broker maintains one
-* shared-memory ring per `(brokerId, format)` actually requested, so a `gray`
-* subscriber (motion) and an `rgb` subscriber (detection) each read the format
-* they asked for with no broker-side conversion.
-*/
-var SubscribeFramesInputSchema = object({
-	brokerId: string(),
-	format: FrameHandleFormatSchema,
-	/**
-	* Optional reader-side cadence hint in frames per second. The broker does
-	* NOT throttle — latest-wins ring reads drop frames implicitly for a slow
-	* consumer. The value is echoed back in `SubscribeFramesResult.maxFps` so
-	* the consumer can pace its own `pullFrameHandles` polling.
-	*/
-	maxFps: number().positive().optional(),
-	/** Short caller-identity tag (`motion`, `detection`, …) for diagnostics. */
-	tag: string().optional()
-});
-/**
-* Result of `stream-broker.subscribeFrames`. The consumer then polls
-* `pullFrameHandles({ subscriptionId, maxCount })` and feeds each returned
-* `FrameHandle` to a `FrameRingReader`.
-*/
-var SubscribeFramesResultSchema = object({
-	/** Opaque id the consumer passes to `pullFrameHandles` / `unsubscribeFrames`. */
-	subscriptionId: string(),
-	/** Reader-side cadence hint (frames/s) — echoes `SubscribeFramesInput.maxFps`. */
-	maxFps: number().nonnegative()
-});
-/**
 * Wire schema for a decoded audio chunk (Phase 5 / D9). Mirrors the
 * `DecodedAudioChunk` TS interface in `interfaces/stream-broker.ts`: PCM
 * sample bytes plus the track parameters a consumer needs to interpret them.
@@ -6846,8 +7440,8 @@ var SubscribeFramesResultSchema = object({
 * Audio chunks are tiny (a ~500ms AudioCodecSession window is a few KB of
 * Float32 PCM), so unlike video frames they ship their bytes INLINE over
 * tRPC / Moleculer — no shared-memory plane. `data` is typed `Uint8Array`
-* (the wire-serialisable supertype of `Buffer`) to match `DecodedFrameSchema`
-* / `EncodedPacketSchema`'s precedent; a `Buffer` is assignable to it.
+* (the wire-serialisable supertype of `Buffer`); a `Buffer` is assignable to
+* it.
 */
 var AudioChunkFormatSchema = _enum(AUDIO_CHUNK_FORMATS);
 var DecodedAudioChunkSchema = object({
@@ -6865,11 +7459,10 @@ var DecodedAudioChunkSchema = object({
 	format: AudioChunkFormatSchema.optional()
 });
 /**
-* Input for `stream-broker.subscribeAudioChunks` (Phase 5 / D9). The
-* handle-free, ship-bytes-inline analogue of `subscribeFrames`: a consumer
-* asks the broker for the decoded audio-chunk stream of one broker; the
-* broker keeps a per-subscription bounded FIFO queue the consumer drains via
-* `pullAudioChunks`.
+* Input for `stream-broker.subscribeAudioChunks` (Phase 5 / D9). Audio ships
+* its bytes inline: a consumer asks the broker for the decoded audio-chunk
+* stream of one broker; the broker keeps a per-subscription bounded FIFO queue
+* the consumer drains via `pullAudioChunks`.
 */
 var SubscribeAudioChunksInputSchema = object({
 	brokerId: string(),
@@ -6900,9 +7493,7 @@ var BrokerStatsSchema = object({
 		"stopped"
 	]),
 	inputFps: number(),
-	decodeFps: number(),
 	encodedSubscribers: number(),
-	decodedSubscribers: number(),
 	uptimeMs: number(),
 	bitrateKbps: number(),
 	idrIntervalMs: number(),
@@ -6915,14 +7506,6 @@ var BrokerStatsSchema = object({
 	preBufferMs: number(),
 	preBufferPackets: number(),
 	/**
-	* Moleculer node id of the decoder provider currently servicing this
-	* stream's decoded subscribers. `null` until the deferred decoder is
-	* created (no decoded clients yet, or codec not detected). Surfaces the
-	* runtime decoder placement so the UI can show "Decoder: <agent>" without
-	* a separate cap call per broker.
-	*/
-	decoderNodeId: string().nullable(),
-	/**
 	* Detected audio track parameters from the RTSP DESCRIBE / SDP. `null`
 	* when the stream has no audio track or the broker is in cold start.
 	* `supported = false` means the codec was detected but the local
@@ -8388,8 +8971,8 @@ function buildAddonRouteProvider(id, routes) {
 			const reply = buildCapturingReply(envelope);
 			const request = {
 				params: {
-					...input.params,
-					...match.params
+					...match.params,
+					...input.params
 				},
 				query: input.query,
 				body: input.body,
@@ -10371,70 +10954,6 @@ var StorageLocationDeclarationSchema = object({
 		"backup"
 	]).optional()
 });
-var DecoderStatsSchema = object({
-	inputFps: number(),
-	outputFps: number(),
-	avgDecodeTimeMs: number(),
-	droppedFrames: number(),
-	/**
-	* Pull-mode adaptive-fps telemetry (optional — only pull sessions run the
-	* lag-driven controller; push sessions omit these). `lagMs` is the EWMA of
-	* the decoder's real-time drift (rising = falling behind live); `adaptiveFps`
-	* is the current lag-throttled emit rate (≤ `effectiveFps` ceiling).
-	*/
-	lagMs: number().optional(),
-	effectiveFps: number().optional(),
-	adaptiveFps: number().optional()
-});
-var DecoderSessionConfigSchema = object({
-	codec: string(),
-	maxFps: number().default(0),
-	outputFormat: _enum([
-		"jpeg",
-		"rgb",
-		"bgr",
-		"yuv420",
-		"gray"
-	]).default("jpeg"),
-	scale: number().default(1),
-	width: number().optional(),
-	height: number().optional(),
-	/**
-	* Identifier of the camera this decoder session serves. Optional
-	* because the cap is generic (any caller could request decode), but
-	* stream-broker passes it so decoder logs include `deviceId` for
-	* per-camera filtering when diagnosing failures (e.g. node-av
-	* sendPacket errors on a single hung camera).
-	*/
-	deviceId: number().int().nonnegative().optional(),
-	/**
-	* Free-form tag for log scoping. Stream-broker uses
-	* `broker:<deviceId>/<profile>`. Decoder session logger surfaces it
-	* on every line so `grep tag=broker:5/high` filters one camera
-	* profile cleanly.
-	*/
-	tag: string().optional(),
-	/**
-	* Where the session delivers decoded frames (Phase 5 / D9):
-	*
-	* - `'callback'` (default) — the legacy pixel path: decoded frames are
-	*   buffered as `DecodedFrame`s and drained via `pullFrames`.
-	* - `'shm'` — the shared-memory frame plane: decoded frames are written
-	*   into an OS shared-memory ring and drained as zero-pixel
-	*   `FrameHandle`s via `pullHandles`. A session is one mode or the
-	*   other — `pullFrames` returns nothing for an `'shm'` session and
-	*   `pullHandles` returns nothing for a `'callback'` session.
-	*/
-	frameSink: _enum(["callback", "shm"]).default("callback"),
-	/**
-	* Per-camera decoder DEBUG facility. When `true`, a pull-mode session emits
-	* a throttled (~1Hz) structured `decoder debug` line (effective/adaptive fps,
-	* real-time lag, dropped-frame delta, avg decode time, hwaccel). Mirrors the
-	* stream-broker's `streamingDebug` gate — off by default so production logs
-	* stay quiet and the emit path pays zero per-frame cost when disabled.
-	*/
-	debug: boolean().optional()
-});
 /**
 * Per-component log CHANNELS — the gate a hot path consults, and the registry
 * an addon declares its channels in.
@@ -10585,7 +11104,18 @@ var LABEL_SUPPLY_STEP_IDS = [
 ];
 /** Steps whose box a root detection can BE. */
 var CROP_SUPPLY_STEP_IDS = ["plate-detection", "face-detection"];
-[...LABEL_SUPPLY_STEP_IDS, ...CROP_SUPPLY_STEP_IDS];
+/**
+* Steps whose per-detection MASK a root detection can carry (D737). The live
+* mask step is `segmentation` — a frame-plane refiner that runs its own model
+* once per detection crop. (`instance-segmentation` is a dormant step id that
+* no camera tree carries.)
+*/
+var MASK_SUPPLY_STEP_IDS = ["segmentation"];
+[
+	...LABEL_SUPPLY_STEP_IDS,
+	...CROP_SUPPLY_STEP_IDS,
+	...MASK_SUPPLY_STEP_IDS
+];
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -10614,7 +11144,53 @@ var ModelFormatEntrySchema = object({
 	/** Multi-file payload (directory members or sibling files). */
 	files: array(string()).readonly().optional(),
 	/** Runtime(s) that can use this format. If omitted, inferred from ModelFormat key */
-	runtimes: array(_enum(["python"])).readonly().optional()
+	runtimes: array(_enum(["python"])).readonly().optional(),
+	/**
+	* Content revision of the artefact, for one hosted OFF the CamStack mirror.
+	* A format on the mirror leaves it unset: its revision (the sha256 of its
+	* weight file) comes from the downloader's generated table, kept in step
+	* with the mirror by `scripts/check-hosted-model-revisions.ts` (D744). A
+	* node records the revision it downloaded next to the file
+	* (`<file>.revision`); a copy with no record or a different one is stale
+	* unless its weight file hashes to the revision, and a stale copy is
+	* downloaded again, the old one serving until the new one is complete. No
+	* revision at all ⇒ a file on disk is current, whatever it holds (D743).
+	*/
+	revision: string().min(1).optional()
+});
+/**
+* What a node holds for one (model, format) (D746). `current` is a complete
+* copy at its catalog revision — exactly what `downloaded: true` means.
+* `stale` is bytes on disk that are not (yet) proven current under D743/D744:
+* no or a different revision record, or a missing sibling. `missing` is no
+* copy. `downloaded` alone folds `stale` into "not downloaded", which hid
+* reclaimable bytes and a copy about to be replaced.
+*/
+var ModelOnDiskStateSchema = _enum([
+	"current",
+	"stale",
+	"missing"
+]);
+/**
+* The numeric precision of one format's BUILD (D746) — reported only when the
+* build states it (file-name token, an INT8 variant, an EdgeTPU compile, a
+* CamStack Core ML export). Absent means "not stated", never "fp32".
+*/
+var ModelFormatPrecisionSchema = _enum([
+	"fp32",
+	"fp16",
+	"int8"
+]);
+/**
+* One format of one model as a node's `pipelineExecutor.getSchema` reports it.
+* `onDisk` / `precision` are optional for version skew: a runner that predates
+* them omits them, and a reader falls back to `downloaded`.
+*/
+var PipelineModelFormatStatusSchema = object({
+	downloaded: boolean(),
+	sizeMB: number(),
+	onDisk: ModelOnDiskStateSchema.optional(),
+	precision: ModelFormatPrecisionSchema.optional()
 });
 /**
 * Extra file that must be downloaded alongside the model (e.g., labels JSON, dict.txt).
@@ -10728,25 +11304,36 @@ var ModelLicenseSchema = preprocess((value) => typeof value === "string" ? { wei
 * - `crop`: the root draws the box the step would have found (`license_plate`
 *   for plate-detection, `face` for face-detection). The box becomes a detail
 *   child of the `parentMacro` detection that contains it — never a track.
+* - `mask`: the root's decode emits an instance mask with every detection (a
+*   YOLO26-seg root, D737) — the `segmentation` step's result, carried on the
+*   detection in the shape that step produces. Derived from the model's
+*   postprocessor on read, never stored by an import.
 */
-var RootStepSupplySchema = discriminatedUnion("kind", [object({
-	kind: literal("label"),
-	stepId: _enum(LABEL_SUPPLY_STEP_IDS),
-	labelToEffect: record(string(), string()),
-	uncovered: array(string()).readonly()
-}), object({
-	kind: literal("crop"),
-	stepId: _enum(CROP_SUPPLY_STEP_IDS),
-	rootLabels: array(string()).readonly(),
-	parentMacro: _enum(["vehicle", "person"]),
-	childClass: _enum(["plate", "face"]),
-	/**
-	* The root's smaller input side, stamped on read by `rootSuppliesOf` from
-	* the model entry — what a step's `minRootInputPx` gate judges. Never
-	* stored by an import.
-	*/
-	rootInputPx: number().int().positive().optional()
-})]);
+var RootStepSupplySchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("label"),
+		stepId: _enum(LABEL_SUPPLY_STEP_IDS),
+		labelToEffect: record(string(), string()),
+		uncovered: array(string()).readonly()
+	}),
+	object({
+		kind: literal("crop"),
+		stepId: _enum(CROP_SUPPLY_STEP_IDS),
+		rootLabels: array(string()).readonly(),
+		parentMacro: _enum(["vehicle", "person"]),
+		childClass: _enum(["plate", "face"]),
+		/**
+		* The root's smaller input side, stamped on read by `rootSuppliesOf` from
+		* the model entry — what a step's `minRootInputPx` gate judges. Never
+		* stored by an import.
+		*/
+		rootInputPx: number().int().positive().optional()
+	}),
+	object({
+		kind: literal("mask"),
+		stepId: _enum(MASK_SUPPLY_STEP_IDS)
+	})
+]);
 var ModelCatalogEntrySchema = object({
 	id: string(),
 	name: string(),
@@ -10812,6 +11399,35 @@ var ModelCatalogEntrySchema = object({
 	*/
 	defaultConfidence: number().min(0).max(1).optional(),
 	/**
+	* Per-MODEL default of the per-class confidence floors (`minConfidence<Macro>`
+	* on a detector step), keyed by macro class: `{ person: 0.45 }`. A class
+	* absent here runs at the step slider's global default. The same row shape
+	* the floor measurement produces (`model-floors.json`: modelId → floors), so
+	* a measured table is copied in as-is. An operator override is bound to the
+	* model it was made for and does not survive a model change (D738). A custom
+	* / imported model may declare it; without it, the global defaults apply.
+	*/
+	defaultClassFloors: record(string(), number().min(0).max(1)).optional(),
+	/**
+	* The inference precision this model's OpenVINO IR needs on an Intel GPU.
+	* Absent ⇒ the device default (f16 on a GPU). Set to `'f32'` for an FP32 IR
+	* that produces invalid output at f16 — measured 2026-10-07 for YOLO26
+	* base IRs (`yolo26s`: 0 true / 146 false positives; `yolo26m*`: NaN
+	* scores) on the Core Ultra iGPU and the N100. Threaded to the pool as
+	* `PoolModelConfig.gpuInferencePrecision`; the pool sets
+	* INFERENCE_PRECISION_HINT on a GPU only. Costs ~60% latency on the GPU.
+	*/
+	gpuInferencePrecision: _enum(["f32", "f16"]).optional(),
+	/**
+	* ROOT detectors only: per supplied step (`animal-classifier`, …), the
+	* minimum DETECTION score from which this root's own fine label (species,
+	* vehicle type — D736 root supply) is taken (D741). Below it the detection
+	* keeps its macro class without the fine label. `1` = never take it from
+	* this root. Absent ⇒ no floor beyond the macro floor. The supplied step's
+	* `minConfidence` slider, bound to the ROOT model, overrides it.
+	*/
+	suppliedLabelFloors: record(string(), number().min(0).max(1)).optional(),
+	/**
 	* When true, the executor produces a landmark-aligned crop (similarity warp
 	* onto the canonical template) before this step runs, instead of a plain
 	* axis-aligned bbox crop. Required for face-recognition embedders (ArcFace):
@@ -12535,13 +13151,6 @@ var BrokerRtspClientSchema = object({
 	lastRtpAt: number(),
 	bytesSent: number()
 });
-var BrokerDecodedClientSchema = object({
-	tag: string(),
-	subscribedAt: number(),
-	maxFps: number(),
-	framesDelivered: number(),
-	framesDropped: number()
-});
 var BrokerAudioClientSchema = object({
 	tag: string(),
 	subscribedAt: number(),
@@ -12633,7 +13242,6 @@ var BrokerEncodedClientSchema = object({
 });
 var BrokerClientsSchema = object({
 	rtsp: array(BrokerRtspClientSchema).readonly(),
-	decoded: array(BrokerDecodedClientSchema).readonly(),
 	audio: array(BrokerAudioClientSchema).readonly(),
 	encoded: array(BrokerEncodedClientSchema).readonly(),
 	pipeClients: number(),
@@ -13002,11 +13610,7 @@ method(object({
 	auth: "admin"
 }), method(object({ brokerId: string() }), BrokerClientsSchema), method(object({
 	brokerId: string(),
-	channel: _enum([
-		"rtsp",
-		"decoded",
-		"audio"
-	]),
+	channel: _enum(["rtsp", "audio"]),
 	handle: string()
 }), object({ killed: boolean() }), {
 	kind: "mutation",
@@ -13041,10 +13645,7 @@ method(object({
 }), method(SubscribeAudioChunksInputSchema, SubscribeAudioChunksResultSchema, { kind: "mutation" }), method(object({
 	subscriptionId: string(),
 	maxCount: number().int().positive().default(8)
-}), array(DecodedAudioChunkSchema).readonly()), method(object({ subscriptionId: string() }), object({ released: boolean() }), { kind: "mutation" }), method(SubscribeFramesInputSchema, SubscribeFramesResultSchema, { kind: "mutation" }), method(object({
-	subscriptionId: string(),
-	maxCount: number().int().positive().default(4)
-}), array(FrameHandleSchema).readonly()), method(object({ subscriptionId: string() }), object({ released: boolean() }), { kind: "mutation" }), method(object({
+}), array(DecodedAudioChunkSchema).readonly()), method(object({ subscriptionId: string() }), object({ released: boolean() }), { kind: "mutation" }), method(object({
 	brokerId: string(),
 	seconds: number().min(0).max(30)
 }), _void(), {
@@ -14202,53 +14803,201 @@ id: union([string(), number()]) }), {
 	auth: "admin"
 });
 /**
-* shm ring usage stats for a `frameSink: 'shm'` decoder session —
-* exposed via `decoder.getShmStats` so downstream consumers can
-* observe ring pressure (slot count, byte budget, hit/miss ratio).
+* `keychain` — the hub's encrypted store of secret values (D787).
+*
+* Settings blobs never hold a secret: they hold a marker
+* `{"$secret":"secret://<owner>/<scope>/<fieldPath>","v":1}` and the value
+* lives here, AES-256-GCM under a data key that a master key wraps. This cap
+* is the OWNER's door to its own values: every method is owner-checked
+* against the CALLER, never against anything the caller claims.
+*
+* Who the caller is: the transport stamps `callerAddonId` into the args of a
+* call that crossed a process (the parent `LocalChildRegistry` from the UDS
+* connection, the agent from its child's connection carried in
+* `$hub-cap-fwd`'s envelope). A stamp always overwrites; a wire call with no
+* stamp has its claim stripped. Only a hub in-process caller may state its own
+* identity — `ctx.secrets` does that with the addon id closed over. This is
+* identity against BUGS and misrouting, not against a malicious addon (every
+* runner is the same OS user): see the threat model in
+* `docs/design/2026-10-08-secrets-keychain.md`.
+*
+* `callerAddonId` is deliberately NOT in any input schema: the tRPC router
+* parses the input, so a session can never supply it, and the internal mount
+* floors every method to admin anyway (D240).
+*
+* Internal: addons reach it through `ctx.secrets`, never directly.
 */
-var ShmRingStatsSchema = object({
-	sessionId: string(),
-	slotCount: number().int(),
-	slotByteLength: number().int(),
-	segmentBytes: number().int(),
-	budgetMb: number().int(),
-	framesWritten: number().int(),
-	getFrameHits: number().int(),
-	getFrameMisses: number().int()
-});
-method(object({ codec: string() }), boolean()), method(_void(), object({
+/** Why a value cannot be served right now. Never folded into "missing". */
+var KeychainUnavailableReasonSchema = _enum([
+	"key-missing",
+	"wrong-key",
+	"key-file-unreadable",
+	"store-unavailable",
+	"not-initialized",
+	"decrypt-failed"
+]);
+var KeychainStateSchema = discriminatedUnion("state", [object({ state: literal("ready") }), object({
+	state: literal("locked"),
+	reason: KeychainUnavailableReasonSchema
+})]);
+var KeychainResolveEntrySchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("value"),
+		value: string(),
+		version: number().int()
+	}),
+	object({ kind: literal("missing") }),
+	object({
+		kind: literal("unavailable"),
+		reason: KeychainUnavailableReasonSchema
+	}),
+	object({ kind: literal("forbidden") })
+]);
+var KeychainResolveResultSchema = record(string(), KeychainResolveEntrySchema);
+/** Metadata of one stored value — never the value. */
+var KeychainSecretMetaSchema = object({
+	ref: string(),
+	owner: string(),
+	/** Formatted scope (`global`, `node/<id>`, `device/<id>`, …). */
+	scope: string(),
+	fieldPath: string(),
+	version: number().int(),
+	createdAt: number(),
+	updatedAt: number(),
+	/** `addon:<id>` | `user:<id>` | `system`. */
+	updatedBy: string(),
+	/** Coarse — written at most once an hour per ref. `null` = never read. */
+	lastReadAt: number().nullable()
+});
+var RefListSchema = array(string().min(1)).max(512);
+method(object({
+	ref: string().min(1),
+	value: string().min(1)
+}), object({
+	ref: string(),
+	version: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ refs: RefListSchema }), KeychainResolveResultSchema, { auth: "admin" }), method(object({ refs: RefListSchema }), object({ deleted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }), method(object({}), KeychainStateSchema, { auth: "admin" });
+var KeychainKeySourceSchema = object({
+	kind: _enum([
+		"config-file",
+		"previous-config-file",
+		"platform",
+		"default-file"
+	]),
+	/** File sources only — a path is not a secret. */
+	path: string().optional(),
+	/**
+	* True when a whole-volume backup of the data directory carries this key
+	* next to the database it protects (the default file). The page warns.
+	*/
+	sharesBackupWithDatabase: boolean()
+});
+var KeychainStatusSchema = object({
+	keychain: KeychainStateSchema,
+	/** The source of the master key in use; `null` while locked. */
+	keySource: KeychainKeySourceSchema.nullable(),
+	/** The source configured to be primary — differs from `keySource` while a rotation is pending. */
+	configuredSource: KeychainKeySourceSchema,
+	/** Short fingerprint of the master key in use (`HMAC(KEK, label)`, 16 hex). */
+	fingerprint: string().nullable(),
+	activeKeyId: string().nullable(),
+	/**
+	* The keychain unlocked with a NON-primary source: the configured primary
+	* key is not the one that wraps the data key yet. `rotateMasterKey` moves it.
+	*/
+	rotationPending: boolean(),
+	/** Wrapped copies of the data key under a previous master key, kept until purged. */
+	retiredWraps: number().int(),
+	recoveryKeyDownloadedAt: number().nullable(),
+	secretCount: number().int()
+});
+/**
+* Whether a stored value is still pointed at by its owner's settings.
+* `unknown` is a first-class answer: a scope whose blob could not be read is
+* never reported as an orphan (and never deleted as one).
+*/
+var KeychainSecretUsageSchema = _enum([
+	"in-use",
+	"orphan",
+	"unknown"
+]);
+var KeychainAdminSecretSchema = KeychainSecretMetaSchema.extend({ usage: KeychainSecretUsageSchema });
+var KeychainAuditActionSchema = _enum([
+	"put",
+	"delete",
+	"reveal",
+	"rotate-master-key",
+	"purge-retired-keys",
+	"download-recovery-key",
+	"delete-orphans",
+	"reset",
+	"initialize"
+]);
+var KeychainAuditEntrySchema = object({
+	id: string(),
+	at: number(),
+	action: KeychainAuditActionSchema,
+	/** `addon:<id>` | `user:<id>` | `system`. */
+	actor: string(),
+	ref: string().nullable(),
+	detail: string().nullable()
+});
+method(object({}), KeychainStatusSchema, { auth: "admin" }), method(object({}), array(KeychainAdminSecretSchema).readonly(), { auth: "admin" }), method(object({ limit: number().int().min(1).max(500).optional() }), array(KeychainAuditEntrySchema).readonly(), { auth: "admin" }), method(object({ ref: string().min(1) }), object({
+	value: string(),
+	version: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ refs: array(string().min(1)).max(1e3) }), object({
+	deleted: array(string()).readonly(),
+	kept: array(object({
+		ref: string(),
+		usage: KeychainSecretUsageSchema
+	})).readonly()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({}), object({
+	fingerprint: string(),
+	keySource: KeychainKeySourceSchema
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({}), object({ purged: number().int() }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({}), object({
+	key: string(),
+	fingerprint: string(),
+	keySource: KeychainKeySourceSchema
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ confirm: literal("RESET KEYCHAIN") }), object({
+	archivedCollection: string().nullable(),
+	archived: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+});
+method(_void(), object({
 	id: string(),
 	name: string(),
-	isPullMode: boolean().optional(),
-	priority: number().optional(),
 	hwaccel: string().optional(),
 	probedBestHwaccel: string().optional()
-})), method(DecoderSessionConfigSchema, object({
-	sessionId: string(),
-	nodeId: string()
-})), method(object({ sessionId: string() }), _void()), method(object({
-	sessionId: string(),
-	packet: EncodedPacketSchema
-}), _void()), method(object({
-	sessionId: string(),
-	url: string()
-}), _void()), method(object({
-	sessionId: string(),
-	maxCount: number().default(1),
-	waitMs: number().optional()
-}), array(DecodedFrameSchema)), method(object({
-	sessionId: string(),
-	maxCount: number().default(1),
-	waitMs: number().optional()
-}), array(FrameHandleSchema)), method(object({ handle: FrameHandleSchema }), DecodedFrameSchema.nullable()), method(object({ sessionId: string() }), ShmRingStatsSchema.nullable()), method(object({
-	sessionId: string(),
-	config: DecoderSessionConfigSchema.partial()
-}), _void()), method(object({ sessionId: string() }), DecoderStatsSchema), method(_void(), array(object({
-	sessionId: string(),
-	codec: string(),
-	outputFormat: string(),
-	createdAtMs: number()
-})).readonly()), method(_void(), object({ backend: string() }), {
+})), method(_void(), object({ backend: string() }), {
 	kind: "mutation",
 	auth: "admin"
 });
@@ -15060,6 +15809,10 @@ var DeviceInfoSchema = object({
 	isCamera: boolean(),
 	/** Current config values — serializable snapshot */
 	config: record(string(), unknown()),
+	/** Paths inside `config` the device's schema declares secret (D783) —
+	*  what the non-admin redaction withholds. Paths, never values. Absent
+	*  when the owning runner has not reported them. */
+	secretConfigPaths: array(string()).optional(),
 	/** Hardware + identity blob (manufacturer / model / firmware / sn /
 	*  uid / mac / …). Populated by drivers; editable via setMetadata. */
 	metadata: record(string(), unknown()).nullable().optional(),
@@ -15265,12 +16018,22 @@ var DeviceRegisterPayloadSchema = object({
 	*  call (workers re-register on init), so probe-driven updates
 	*  (e.g. PTZ flag flipping after the abilities probe) propagate. */
 	features: array(string()).optional(),
-	config: record(string(), unknown())
+	config: record(string(), unknown()),
+	/** Config paths the device's own schema DECLARES secret
+	*  (`.meta({ secret: true })` — dotted, `[]` for array items, e.g.
+	*  `connection.password`). Re-published on every register; the non-admin
+	*  redaction withholds them at any depth (D783). Optional: an older runner
+	*  omits it and the keyword backstop applies. */
+	secretConfigPaths: array(string()).optional()
 });
 var DeviceRemovePayloadSchema = object({ deviceId: number() });
 var DevicePersistConfigPayloadSchema = object({
 	deviceId: number(),
-	data: record(string(), unknown())
+	data: record(string(), unknown()),
+	/** The paths the device's schema declares secret (D783), when the caller
+	*  knows them — those values are kept in the keychain, not the blob (D787).
+	*  Absent: the paths the device last reported at `registerDevice` apply. */
+	secretConfigPaths: array(string()).optional()
 });
 /** What a migration actually did, per switch. `unreachable` is a first-class
 *  answer: a camera that could not be asked is not a camera that was silenced. */
@@ -16924,7 +17687,14 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		icon: string().optional(),
 		/** Addon-owned HTTP route the button navigates to (GET). */
 		startUrl: string(),
-		stage: LoginStageEnum
+		stage: LoginStageEnum,
+		/**
+		* The provider names an external identity a signed-in user can link to
+		* their own account (D782): `auth.listLinkableProviders` /
+		* `beginExternalLink` offer exactly the redirect methods that set this,
+		* whatever their id. Absent / false — a login button only (magic-link).
+		*/
+		linkable: boolean().optional()
 	}),
 	object({
 		kind: literal("widget"),
@@ -21276,8 +22046,8 @@ Object.freeze(Object.fromEntries([{
 var CLUSTER_STEP_SETTING_FIELDS = [{
 	stepId: "face-embedding",
 	key: "minLandmarkFaceSize",
-	label: "Min face size for recognition (detection px)",
-	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	label: "Min face size to embed (detection-frame px)",
+	description: "Faces smaller than this in the small frame the detector sees are not embedded, so they can never be recognised. Below it the face cannot be aligned reliably and a bad embedding matches everyone. Same value on every node. 0 = no limit.",
 	type: "slider",
 	min: 0,
 	max: 64,
@@ -22250,8 +23020,23 @@ var RetrainMacroClassSchema = _enum([
 ]);
 /** A subject to learn, or a phantom to unlearn (taught by OMISSION). */
 var RetrainAnnotationKindSchema = _enum(["subject", "model_error"]);
-/** Did a human draw this box, or did the assist propose it? */
-var RetrainAnnotationSourceSchema = _enum(["operator", "assist"]);
+/**
+* Where a box came from. A machine-sourced box is a DRAFT on the page until
+* the operator confirms it; once saved it keeps its source as provenance.
+*
+* - `operator` — drawn by hand.
+* - `assist`   — proposed by a detector run on the copy (the camera's own
+*   model, or a larger teacher model).
+* - `pipeline` — the box the live pipeline actually drew on that frame, read
+*   back from the track store (never a re-run).
+* - `llm`      — proposed by a vision-capable LLM profile.
+*/
+var RetrainAnnotationSourceSchema = _enum([
+	"operator",
+	"assist",
+	"pipeline",
+	"llm"
+]);
 /** Normalised `[0,1]` rectangle against the FULL frame — the canonical form. */
 var RetrainBboxSchema = object({
 	x: number(),
@@ -22269,7 +23054,8 @@ var RetrainBboxSchema = object({
 */
 var RetrainAnnotationSchema = object({
 	id: string(),
-	trackId: string(),
+	/** The frame's track. Absent on a recording still, which has none. */
+	trackId: string().optional(),
 	deviceId: number(),
 	/** The COPY in retrain storage — never the source track's media key. */
 	mediaKey: string(),
@@ -22318,18 +23104,63 @@ var RetrainFrameCandidateSchema = object({
 	*  fail, whatever became of the original. */
 	copied: boolean()
 });
+/**
+* One box the live pipeline drew on a copied frame — what a correction starts
+* from. Derived when the frame is listed, from the track store: the subject
+* box recorded on the source media row when there is one, else the track
+* position nearest the frame's capture time. Never stored as an annotation
+* until the operator confirms it.
+*/
+var RetrainPipelineBoxSchema = object({
+	/** Normalised `[0,1]` against the full frame. */
+	bbox: RetrainBboxSchema,
+	macroClass: RetrainMacroClassSchema,
+	label: string().optional(),
+	subLabel: string().optional(),
+	/** The detection score of the position used, when it was recorded. */
+	score: number().optional(),
+	/** The root model that produced the track, when it was recorded. */
+	modelId: string().optional(),
+	trackId: string(),
+	/** `subject-box`: recorded on this very frame. `position`: the track's
+	*  position nearest the capture time, `deltaMs` away. */
+	basis: _enum(["subject-box", "position"]),
+	deltaMs: number()
+});
+/**
+* Where a retrain frame came from: a TRACK's stored media (copy-on-select),
+* or the RECORDING at an instant — the frame a model saw nothing in has no
+* track at all.
+*/
+var RetrainFrameOriginSchema = _enum(["track", "recording"]);
 /** A frame the dataset OWNS: bytes copied at selection time. */
 var RetrainFrameSchema = object({
 	frameId: string(),
 	deviceId: number(),
-	trackId: string(),
-	/** Provenance only. It may already point at nothing — that is expected. */
-	sourceMediaId: number().int(),
+	origin: RetrainFrameOriginSchema,
+	/** The track it was copied from. Absent on a recording still. */
+	trackId: string().optional(),
+	/** Provenance only. It may already point at nothing — that is expected.
+	*  Absent on a recording still. */
+	sourceMediaId: number().int().optional(),
+	/** A recording still: the playhead instant it was taken at. */
+	epochMs: number().optional(),
 	sourceKind: MediaFileKindEnum,
 	sizeBytes: number().int(),
 	width: number().int(),
 	height: number().int(),
-	copiedAt: number()
+	copiedAt: number(),
+	/** When the CAMERA captured the frame. Absent on a copy taken before D785. */
+	capturedAt: number().optional(),
+	/** The operator's "every subject in this frame is boxed". Detector
+	*  evaluation keeps only complete frames: an unboxed subject would count as
+	*  a false positive. */
+	complete: boolean(),
+	/** The boxes the pipeline drew on this frame. Present on list answers;
+	*  empty when nothing the track store holds can be placed on it. */
+	pipelineBoxes: array(RetrainPipelineBoxSchema).readonly().optional(),
+	/** The named collections this frame belongs to. Present on list answers. */
+	collectionIds: array(string()).readonly().optional()
 });
 /** Why a copy-on-select could not be honoured — named, never a silent skip. */
 var RetrainCopyRefusalSchema = _enum([
@@ -22350,6 +23181,53 @@ var RetrainFrameListSchema = object({
 	/** What the page pre-selects — the native key frame when one survives. */
 	autoPickMediaId: number().int().optional()
 });
+/**
+* Which frames an annotated export carries. Every field narrows; an empty
+* filter is every annotated copy. A dataset VERSION is a frozen `frameIds`
+* list owned by whoever trains (the training orchestrator), so `frameIds` is
+* the primitive a version export uses; `batchId` re-selects what an earlier
+* export carried (`exportedInBatch`).
+*/
+var RetrainExportFilterSchema = object({
+	deviceIds: array(number()).optional(),
+	frameIds: array(string()).max(2e4).optional(),
+	/** Only frames in at least one of these named collections. */
+	collectionIds: array(string()).max(200).optional(),
+	batchId: string().optional(),
+	/** Only frames the operator marked complete (all subjects boxed). */
+	completeOnly: boolean().optional()
+});
+/**
+* `frames`: the full frame copies, boxes in `annotations.json`.
+* `crops`: additionally one JPEG per subject, cut with the runtime detail-crop
+* convention — the classifier layout.
+*/
+var RetrainExportLayoutSchema = _enum(["frames", "crops"]);
+/**
+* Where `writeRetrainArchive` streams the tar: one HTTP request whose body is
+* the archive, sent chunk by chunk. Covers a presigned PUT and a provider
+* addon's data-plane upload route alike. Headers are sent verbatim and never
+* logged.
+*/
+var RetrainArchiveTargetSchema = object({
+	kind: literal("http"),
+	method: _enum(["PUT", "POST"]),
+	url: string().url(),
+	headers: record(string(), string()).optional()
+});
+var RetrainArchiveResultSchema = object({
+	batchId: string(),
+	frames: number().int(),
+	crops: number().int(),
+	annotations: number().int(),
+	/** Frames planned but not shipped (unreadable copy, path too long). */
+	missing: number().int(),
+	bytes: number().int(),
+	/** sha256 of the exact bytes sent. */
+	sha256: string(),
+	/** The target's HTTP status. */
+	status: number().int()
+});
 /** What the operator asked the assist to look for. */
 var RetrainAssistSubjectSchema = discriminatedUnion("kind", [object({
 	kind: literal("package"),
@@ -22379,6 +23257,109 @@ var RetrainAssistResultSchema = discriminatedUnion("kind", [object({
 	reason: string(),
 	detail: string().optional()
 })]);
+/** A named set over the retrain corpus — membership only, it owns no pixels. */
+var RetrainCollectionSchema = object({
+	id: string(),
+	name: string(),
+	createdAt: number(),
+	frameCount: number().int()
+});
+var RetrainCollectionCreateResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("created"),
+	collection: RetrainCollectionSchema
+}), object({
+	kind: literal("refused"),
+	reason: _enum(["empty-name", "duplicate-name"])
+})]);
+var RetrainCollectionRenameResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("renamed"),
+	collection: RetrainCollectionSchema
+}), object({
+	kind: literal("refused"),
+	reason: _enum([
+		"empty-name",
+		"duplicate-name",
+		"unknown-collection"
+	])
+})]);
+/**
+* The outcome of adding the frame at a recording instant. Every refusal is
+* named: `still-unavailable` (not recording, a gap, or an undecodable frame —
+* `detail` says which), `still-busy` (the recorder is at its decode bound; try
+* again), `unreadable-image`, `write-failed`, `unknown-collection`.
+*/
+var AddRetrainFrameFromRecordingResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("added"),
+	collectionId: string(),
+	frame: RetrainFrameSchema,
+	/** The moment was already in the dataset; nothing was decoded. */
+	reused: boolean()
+}), object({
+	kind: literal("refused"),
+	reason: _enum([
+		"unknown-collection",
+		"still-unavailable",
+		"still-busy",
+		"unreadable-image",
+		"write-failed"
+	]),
+	detail: string().optional()
+})]);
+/** A vision LLM profile the AI assist may use, and where it sends the frame. */
+var RetrainAssistProfileSchema = object({
+	id: string(),
+	name: string(),
+	model: string(),
+	kind: string(),
+	/** `true` when the frame would leave the house (a cloud vendor, or an
+	*  endpoint that is not on the local network). The page confirms each such
+	*  run, and the provider refuses one without `allowCloud`. */
+	leavesHouse: boolean()
+});
+/** A box the AI assist proposed: a draft, plus the model's own reason. */
+var RetrainLlmProposalSchema = RetrainAnnotationDraftSchema.extend({ reason: string() });
+/** What the AI assist said about a box that was already on the canvas. */
+var RetrainLlmReviewSchema = object({
+	/** The `ref` the page sent the box under. */
+	ref: string(),
+	verdict: _enum([
+		"confirmed",
+		"wrong-class",
+		"not-an-object",
+		"uncertain"
+	]),
+	suggestedClass: RetrainMacroClassSchema.optional(),
+	reason: string()
+});
+/**
+* The AI assist's answer. `proposed` carries drafts (`source: 'llm'`, the
+* model and its confidence) and reviews; items the model got wrong (a box off
+* the frame, an unasked class, an unknown ref) are dropped and counted in
+* `rejected`. A whole answer that is not the schema is `malformed-answer`.
+*/
+var RetrainLlmAssistResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("proposed"),
+	profileId: string(),
+	model: string(),
+	/** The frame was sent outside the house for this answer. */
+	leftHouse: boolean(),
+	proposals: array(RetrainLlmProposalSchema).readonly(),
+	reviews: array(RetrainLlmReviewSchema).readonly(),
+	rejected: number().int()
+}), object({
+	kind: literal("refused"),
+	reason: _enum([
+		"unknown-frame",
+		"unreadable-frame",
+		"unknown-profile",
+		"profile-disabled",
+		"no-vision",
+		"cloud-not-confirmed",
+		"llm-error",
+		"malformed-answer"
+	]),
+	detail: string().optional()
+})]);
 /** The outcome of a lifecycle move owned by the retrain page. */
 var RetrainTransitionResultSchema = object({
 	trackId: string(),
@@ -23096,7 +24077,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	auth: "admin"
 }), method(object({
 	deviceId: number(),
-	trackId: string(),
+	trackId: string().optional(),
 	frameId: string()
 }), object({
 	removed: boolean(),
@@ -23113,7 +24094,8 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	auth: "admin"
 }), method(object({
 	deviceId: number(),
-	trackId: string(),
+	/** The frame's track, when it has one — checked against the frame. */
+	trackId: string().optional(),
 	frameId: string(),
 	subject: RetrainAssistSubjectSchema,
 	/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
@@ -23121,12 +24103,16 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), RetrainAssistResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ trackId: string() }), array(RetrainAnnotationSchema).readonly(), {
+}), method(object({
+	trackId: string().optional(),
+	frameIds: array(string()).max(2e3).optional()
+}), array(RetrainAnnotationSchema).readonly(), {
 	kind: "query",
 	auth: "admin"
 }), method(object({
 	deviceId: number(),
-	trackId: string(),
+	/** The frame's track, when it has one — checked against the frame. */
+	trackId: string().optional(),
 	frameId: string(),
 	annotations: array(RetrainAnnotationDraftSchema)
 }), array(RetrainAnnotationSchema).readonly(), {
@@ -23144,7 +24130,91 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), RetrainTransitionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
+}), method(RetrainExportFilterSchema.extend({ layout: RetrainExportLayoutSchema.optional() }), object({ url: string() }), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string().optional(),
+	frameId: string(),
+	complete: boolean()
+}), RetrainFrameSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	filter: RetrainExportFilterSchema,
+	layout: RetrainExportLayoutSchema,
+	target: RetrainArchiveTargetSchema
+}), RetrainArchiveResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 60 * 6e4
+}), method(object({}), array(RetrainAssistProfileSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string().optional(),
+	frameId: string(),
+	profileId: string(),
+	classes: array(RetrainMacroClassSchema).min(1),
+	boxes: array(object({
+		ref: string(),
+		bbox: RetrainBboxSchema,
+		macroClass: RetrainMacroClassSchema,
+		label: string().optional()
+	})).max(50),
+	allowCloud: boolean()
+}), RetrainLlmAssistResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 18e4
+}), method(object({ name: string().max(120) }), RetrainCollectionCreateResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(RetrainCollectionSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	id: string(),
+	name: string().max(120)
+}), RetrainCollectionRenameResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string() }), object({
+	deleted: boolean(),
+	removedFrames: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	collectionId: string(),
+	deviceId: number(),
+	epochMs: number()
+}), AddRetrainFrameFromRecordingResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 6e4
+}), method(object({
+	collectionId: string(),
+	frameIds: array(string()).min(1).max(500)
+}), object({
+	added: number().int(),
+	alreadyMember: number().int(),
+	unknownFrameIds: array(string()).readonly()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	collectionId: string(),
+	frameId: string()
+}), object({
+	removed: boolean(),
+	deletedFrame: boolean()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ collectionId: string() }), array(RetrainFrameSchema).readonly(), {
 	kind: "query",
 	auth: "admin"
 }), method(object({
@@ -23272,7 +24342,7 @@ var FrameRefSchema = object({
 	timestamp: number(),
 	capturedAt: number().optional()
 });
-var ModelFormatSchema$1 = _enum([
+var ModelFormatSchema$2 = _enum([
 	"onnx",
 	"coreml",
 	"openvino",
@@ -23290,7 +24360,7 @@ var PipelineSlotSchema = _enum([
 var PipelineEngineChoiceSchema = object({
 	runtime: literal("python"),
 	backend: string(),
-	format: ModelFormatSchema$1,
+	format: ModelFormatSchema$2,
 	device: string().optional()
 });
 /**
@@ -23329,28 +24399,10 @@ var PipelineDefaultStepSchema = lazy(() => object({
 	group: string().optional(),
 	settings: record(string(), unknown()).optional()
 }));
-var PipelineTemplateStepSchema = lazy(() => object({
-	addonId: string(),
-	enabled: boolean(),
-	modelId: string(),
-	children: array(PipelineTemplateStepSchema).readonly(),
-	settings: record(string(), unknown()).optional()
-}));
-var PipelineTemplateSchema$1 = object({
-	id: string(),
-	name: string(),
-	createdAt: string(),
-	updatedAt: string(),
-	engine: PipelineEngineChoiceSchema,
-	steps: array(PipelineTemplateStepSchema).readonly()
-});
 var PipelineModelOptionSchema = object({
 	id: string(),
 	name: string(),
-	formats: record(string(), object({
-		downloaded: boolean(),
-		sizeMB: number()
-	})),
+	formats: record(string(), PipelineModelFormatStatusSchema),
 	group: ModelVariantGroupSchema.optional(),
 	legacy: boolean().optional(),
 	provider: ModelProviderIdSchema.optional(),
@@ -23517,6 +24569,22 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	nodeId: string(),
+	deviceIds: array(number()).readonly().optional(),
+	dryRun: boolean()
+}), object({
+	entries: array(object({
+		deviceId: number(),
+		keys: array(string()).readonly()
+	})).readonly(),
+	refused: array(object({
+		deviceId: number(),
+		reason: string()
+	})).readonly()
+}), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ nodeId: string() }), object({ unhealthy: array(object({
 	/** `<backend>:<device>`, e.g. `openvino:gpu`. */
 	deviceKey: string(),
@@ -23542,22 +24610,14 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 }), method(_void(), PipelineSchemaSchema), method(_void(), array(PipelineDefaultStepSchema).readonly().nullable()), method(_void(), PipelineConfigBridge), method(_void(), ConfigUISchemaBridge), method(object({
 	steps: array(PipelineStepInputSchema),
 	deviceKey: string().optional()
-}), PipelineValidationResultSchema), method(_void(), array(PipelineTemplateSchema$1).readonly()), method(object({
-	name: string(),
-	steps: array(PipelineTemplateStepSchema).readonly(),
-	engine: PipelineEngineChoiceSchema
-}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({
-	id: string(),
-	name: string().optional(),
-	steps: array(PipelineTemplateStepSchema).readonly().optional()
-}), PipelineTemplateSchema$1, { kind: "mutation" }), method(object({ id: string() }), _void(), { kind: "mutation" }), method(_void(), InferenceCapabilitiesBridge), method(object({ addonId: string() }), ModelAvailabilityListBridge), method(object({
+}), PipelineValidationResultSchema), method(_void(), InferenceCapabilitiesBridge), method(object({ addonId: string() }), ModelAvailabilityListBridge), method(object({
 	addonId: string(),
 	modelId: string(),
-	format: ModelFormatSchema$1
+	format: ModelFormatSchema$2
 }), DownloadModelResultSchema, { kind: "mutation" }), method(object({
 	addonId: string(),
 	modelId: string(),
-	format: ModelFormatSchema$1
+	format: ModelFormatSchema$2
 }), object({ success: literal(true) }), { kind: "mutation" }), method(object({
 	steps: array(PipelineStepInputSchema).min(1),
 	frame: FrameInputSchema.optional(),
@@ -23714,6 +24774,763 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	filename: string().optional(),
 	settings: record(string(), unknown()).optional()
 }), AudioTestResultSchema, { kind: "mutation" }), method(_void(), ConfigUISchemaNullableBridge);
+/**
+* The wire shapes of the Auto tune plan and apply (D745), used by the
+* `pipeline-orchestrator` cap. The recommender's own types
+* (`recommend.ts`) are the TS face of the same data; these
+* schemas are what crosses the cap boundary.
+*/
+var ModelFormatSchema$1 = _enum(MODEL_FORMATS);
+/** The operator's range for it. */
+var MIN_SESSIONS_PER_DEVICE_RANGE = {
+	min: 1,
+	max: 8
+};
+var HardwareClassIdSchema = _enum([
+	"intel-core-ultra",
+	"intel-n-series",
+	"apple-m-base",
+	"apple-m-pro",
+	"unknown"
+]);
+var AcceleratorKindSchema = _enum([
+	"intel-npu",
+	"intel-igpu",
+	"x86-cpu",
+	"arm-cpu",
+	"apple-ane",
+	"coral"
+]);
+var RecommendationReasonSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("capacity"),
+		sessions: number(),
+		minSessions: number()
+	}),
+	object({
+		kind: literal("tie-faster"),
+		over: string(),
+		recallDelta: number()
+	}),
+	object({
+		kind: literal("stepped-down"),
+		from: string(),
+		to: string(),
+		limitedBy: string()
+	}),
+	object({
+		kind: literal("no-fit-lightest"),
+		sessions: number(),
+		minSessions: number()
+	}),
+	object({
+		kind: literal("derived-latency"),
+		modelId: string()
+	}),
+	object({ kind: literal("cpu-device") }),
+	object({ kind: literal("coral-untouched") }),
+	object({ kind: literal("device-disabled") }),
+	object({ kind: literal("device-unavailable") }),
+	object({ kind: literal("node-offline") }),
+	object({ kind: literal("no-hardware-facts") }),
+	object({
+		kind: literal("no-measured-data"),
+		hardwareClass: HardwareClassIdSchema
+	}),
+	object({
+		kind: literal("no-family-build"),
+		format: ModelFormatSchema$1
+	}),
+	object({
+		kind: literal("kept-custom-pin"),
+		modelId: string(),
+		deviceKey: string()
+	})
+]);
+/** Why a device is left exactly as it is, whatever the plan would pick (D786). */
+var KeptReasonSchema = _enum(["custom-pin"]);
+/**
+* Where a choice's latency came from (D791): this node's own benchmark
+* result, or the hardware-class table. Measured on the node beats the table.
+*/
+var LatencySourceSchema = discriminatedUnion("kind", [object({ kind: literal("table") }), object({
+	kind: literal("node-benchmark"),
+	resultId: string(),
+	measuredAtMs: number()
+})]);
+var DeviceModelChoiceSchema = object({
+	modelId: string(),
+	p50Ms: number(),
+	fps: number(),
+	measured: boolean(),
+	/** Absent on a plan from before D791 — read as the table. */
+	source: LatencySourceSchema.optional(),
+	/** Parallel sessions at the camera rate with the headroom kept free: ⌊fps × (1 − headroom) / camera fps⌋. */
+	capacitySessions: number(),
+	personRecall: number()
+});
+var DeviceRecommendationSchema = object({
+	deviceKey: string(),
+	accelerator: AcceleratorKindSchema.nullable(),
+	enabled: boolean(),
+	available: boolean(),
+	chosen: DeviceModelChoiceSchema.nullable(),
+	/** Present when the device is kept as is: Apply writes nothing on it. */
+	kept: KeptReasonSchema.optional(),
+	reasons: array(RecommendationReasonSchema).readonly()
+});
+var NodeRecommendationSchema = object({
+	nodeId: string(),
+	reachable: boolean(),
+	hardwareClass: HardwareClassIdSchema.nullable(),
+	cpuModel: string().nullable(),
+	skipped: boolean(),
+	acceleratorModelId: string().nullable(),
+	devices: array(DeviceRecommendationSchema).readonly(),
+	reasons: array(RecommendationReasonSchema).readonly()
+});
+var ModelPinChangeSchema = object({
+	stepId: string(),
+	before: string().nullable(),
+	after: string().nullable()
+});
+var NodeDeviceChangeSchema = object({
+	nodeId: string(),
+	deviceKey: string(),
+	madeExplicit: boolean(),
+	modelPins: array(ModelPinChangeSchema).readonly(),
+	thresholds: array(object({
+		stepId: string(),
+		keys: array(string()).readonly()
+	})).readonly()
+});
+var CameraOverrideClearSchema = object({
+	deviceId: number(),
+	source: _enum(["step-override", "wholesale"]),
+	nodeId: string(),
+	deviceKey: string().nullable(),
+	stepId: string(),
+	modelIdBefore: string().nullable(),
+	keys: array(string()).readonly()
+});
+var DetectorStoreClearSchema = object({
+	deviceId: number(),
+	keys: array(string()).readonly()
+});
+var AutoTuneWarningSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("detector-store-cluster-wide"),
+		skippedNodes: array(string()).readonly()
+	}),
+	object({
+		kind: literal("detector-store-unreadable"),
+		error: string()
+	}),
+	object({
+		kind: literal("coral-enabled"),
+		nodeId: string(),
+		deviceKey: string()
+	}),
+	object({
+		kind: literal("custom-pin-kept"),
+		nodeId: string(),
+		deviceKey: string().nullable(),
+		deviceId: number().nullable(),
+		modelId: string()
+	}),
+	object({
+		kind: literal("custom-registry-unreadable"),
+		error: string()
+	})
+]);
+var AutoTuneOptionsSchema = object({
+	/** Share of each accelerator's throughput kept free (0.3–0.5). */
+	headroom: number().min(.3).max(.5).default(.4),
+	/**
+	* The least number of parallel sessions every device must sustain at the
+	* camera rate with the headroom kept free (D755). The most accurate model
+	* that reaches it wins.
+	*/
+	minSessionsPerDevice: number().int().min(MIN_SESSIONS_PER_DEVICE_RANGE.min).max(MIN_SESSIONS_PER_DEVICE_RANGE.max).default(2)
+});
+var AutoTunePlanSchema = object({
+	/** Hash of everything the apply will write — the apply refuses a different one. */
+	planHash: string(),
+	family: literal("yolov9"),
+	headroom: number(),
+	minSessionsPerDevice: number(),
+	/** The detection rate a session is counted at (the fastest camera running the pipeline root). */
+	cameraFps: number(),
+	generatedAt: number(),
+	nodes: array(NodeRecommendationSchema).readonly(),
+	nodeChanges: array(NodeDeviceChangeSchema).readonly(),
+	cameraClears: array(CameraOverrideClearSchema).readonly(),
+	detectorStoreClears: array(DetectorStoreClearSchema).readonly(),
+	warnings: array(AutoTuneWarningSchema).readonly()
+});
+var AutoTuneApplyInputSchema = object({
+	planHash: string(),
+	headroom: number().min(.3).max(.5).default(.4),
+	minSessionsPerDevice: number().int().min(MIN_SESSIONS_PER_DEVICE_RANGE.min).max(MIN_SESSIONS_PER_DEVICE_RANGE.max).default(2)
+});
+var AutoTunePhaseResultSchema = object({
+	phase: _enum([
+		"download",
+		"camera-overrides",
+		"detector-thresholds",
+		"node-models",
+		"redispatch"
+	]),
+	ok: boolean(),
+	detail: string()
+});
+var AutoTuneApplyResultSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("applied"),
+		planHash: string(),
+		phases: array(AutoTunePhaseResultSchema).readonly()
+	}),
+	object({
+		kind: literal("aborted"),
+		phases: array(AutoTunePhaseResultSchema).readonly()
+	}),
+	object({
+		kind: literal("stale"),
+		plan: AutoTunePlanSchema
+	}),
+	object({
+		kind: literal("refused"),
+		reason: _enum(["apply-in-progress"])
+	})
+]);
+/**
+* Wire shapes of the Load balancing surface (D748): the session placement
+* policy, the atomic share write, the observed placement statistics, the
+* hardware share suggestion and the stale device pins.
+*/
+/**
+* How a new detection session picks its node and device.
+*  - `least-loaded` — the historical rule: lowest `attached / weight`, a
+*    constant node order at a tie (D37). An idle node always ties at 0, so a
+*    weight only bites once a node already holds a session.
+*  - `share` — the share of PARALLEL sessions is held to the weights, and a
+*    full or drowning node yields to a free one (D748).
+*/
+var SessionPlacementPolicySchema = _enum(["least-loaded", "share"]);
+var LoadBalancingSharesInputSchema = object({
+	/** nodeId → share (> 0). A node left out keeps its weight. */
+	nodes: record(string(), number().positive()).default({}),
+	/** nodeId → deviceKey → share (> 0). A device left out keeps its weight. */
+	devices: record(string(), record(string(), number().positive())).default({})
+});
+var PlacementStatsInputSchema = object({ 
+/** Window the observed shares are averaged over (default 1 h, max 24 h). */
+windowMs: number().int().min(6e4).max(1440 * 60 * 1e3).default(3600 * 1e3) });
+var PlacementDeviceStatsSchema = object({
+	deviceKey: string(),
+	/** Sessions running on this device now. */
+	sessionsNow: number(),
+	/** Sessions started on this device inside the window. */
+	sessionsStarted: number(),
+	/** Time-weighted share of the node's parallel sessions over the window (0–1); null = no session ran. */
+	observedShare: number().nullable()
+});
+var PlacementNodeStatsSchema = object({
+	nodeId: string(),
+	sessionsNow: number(),
+	sessionsStarted: number(),
+	/** Time-weighted share of the cluster's parallel sessions over the window (0–1); null = none ran. */
+	observedShare: number().nullable(),
+	/** Most sessions this node ran at once inside the window. */
+	peakSessions: number(),
+	/** Sessions a share election handed elsewhere because this node was full or drowning. */
+	yieldsAway: number(),
+	devices: array(PlacementDeviceStatsSchema).readonly()
+});
+/** A camera's device pin that the session path cannot honour. */
+var StaleDevicePinSchema = object({
+	deviceId: number(),
+	deviceKey: string(),
+	/** `disabled` — the key exists on some node but is not enabled anywhere; `absent` — no node has it. */
+	reason: _enum(["disabled", "absent"])
+});
+var PlacementStatsSchema = object({
+	policy: SessionPlacementPolicySchema,
+	windowMs: number(),
+	/** How much of the window was actually observed (the hub keeps it in memory). */
+	observedForMs: number(),
+	sessionsNow: number(),
+	/** Most parallel sessions across the cluster inside the window. */
+	clusterPeakSessions: number(),
+	nodes: array(PlacementNodeStatsSchema).readonly(),
+	stalePins: array(StaleDevicePinSchema).readonly()
+});
+/**
+* Where an automatic share's capacity comes from (D755).
+*  - `hardware` — the static capacity of each device at its Auto tune model:
+*    the measured latency table for the node's hardware class.
+*  - `benchmark` — the node's own measured capacity (node benchmark results).
+*    A node with no results falls back to `hardware`, and says so.
+*/
+var CapacitySourceSchema = _enum(["hardware", "benchmark"]);
+/** Why a node under the `benchmark` source was sized from hardware instead. */
+var CapacityFallbackSchema = _enum(["no-benchmark-results", "partial-benchmark-results"]);
+var SuggestSharesInputSchema = object({
+	headroom: number().min(.3).max(.5).default(.4),
+	/** Default `hardware`. */
+	source: CapacitySourceSchema.default("hardware")
+});
+var SuggestedDeviceShareSchema = object({
+	deviceKey: string(),
+	/** Share of the node (0–100, rounded). */
+	share: number(),
+	modelId: string().nullable(),
+	/** Inferences per second at that model, from the measured table; null when sized by a benchmark. */
+	fps: number().nullable(),
+	/** False for a table cell derived from another chip; true for a measured cell or a benchmark. */
+	measured: boolean(),
+	/**
+	* Advisory session cap: ⌊fps × (1 − headroom) / camera fps⌋ from the table,
+	* or the benchmark's measured max sessions. Never enforced.
+	*/
+	suggestedMaxSessions: number().nullable()
+});
+var SuggestedNodeShareSchema = object({
+	nodeId: string(),
+	/** Share of the cluster (0–100, rounded); null = node skipped (offline, unknown hardware). */
+	share: number().nullable(),
+	/** Parallel sessions the node sustains at the suggested models with the headroom kept free. */
+	capacitySessions: number(),
+	devices: array(SuggestedDeviceShareSchema).readonly(),
+	skippedReason: string().nullable(),
+	/** What this node's capacity was read from; null when the node is skipped. */
+	capacitySource: CapacitySourceSchema.nullable(),
+	/** Set when the `benchmark` source was asked for and this node used `hardware`. */
+	capacityFallback: CapacityFallbackSchema.nullable()
+});
+var SuggestSharesResultSchema = object({
+	headroom: number(),
+	/** The source asked for; each node says what it actually used. */
+	source: CapacitySourceSchema,
+	/** Camera detection rate the capacity is counted in (the fastest camera's fps). */
+	cameraFps: number(),
+	/** The Auto tune capacity floor the models were picked at. */
+	minSessionsPerDevice: number(),
+	nodes: array(SuggestedNodeShareSchema).readonly()
+});
+/**
+* Where the node and device shares come from (D750, D755, D791).
+*  - `benchmark` (default since D791) — each node's capacity as its own node
+*    benchmark measured it; a node without fresh results is sized from
+*    `hardware` and says so. Measured on the node beats the table.
+*  - `hardware` — computed from each node's static capacity only (its
+*    accelerators at their Auto tune models, from the latency table).
+*  Both are recomputed whenever a node or device joins, leaves, is switched
+*  on or off, changes model, or a benchmark result is written. No load input.
+*  - `manual` — the operator's stored sliders.
+* Either way a node or device that cannot take sessions gives its share to
+* the others in proportion; the stored values are never rewritten for that.
+*/
+var ShareSourceSchema = _enum([
+	"hardware",
+	"benchmark",
+	"manual"
+]);
+var SetShareSourceInputSchema = object({ source: ShareSourceSchema });
+object({
+	nodes: record(string(), number()),
+	devices: record(string(), record(string(), number()))
+});
+var EffectiveDeviceShareSchema = object({
+	deviceKey: string(),
+	/** Can take sessions now (enabled, available, can run the root). */
+	eligible: boolean(),
+	/** The share the source assigns, as a percentage of the node's devices. */
+	configuredPct: number(),
+	/** The share actually used, after an ineligible device's share went to the others. */
+	effectivePct: number()
+});
+var EffectiveNodeShareSchema = object({
+	nodeId: string(),
+	eligible: boolean(),
+	configuredPct: number(),
+	effectivePct: number(),
+	/** Automatic sources: what this node's share was computed from; null under `manual` or before the first answer. */
+	capacitySource: CapacitySourceSchema.nullable(),
+	/** Automatic `benchmark`: why this node used `hardware` instead. */
+	capacityFallback: CapacityFallbackSchema.nullable(),
+	devices: array(EffectiveDeviceShareSchema).readonly()
+});
+var EffectiveSharesSchema = object({
+	source: ShareSourceSchema,
+	policy: SessionPlacementPolicySchema,
+	/** An automatic source with no computed answer yet: the stored sliders are used meanwhile. */
+	autoPending: boolean(),
+	/** When the automatic shares were last computed (ms epoch); null = never. */
+	computedAt: number().nullable(),
+	/** What made the system recompute them last. */
+	trigger: string().nullable(),
+	nodes: array(EffectiveNodeShareSchema).readonly(),
+	/** The relative weights the election reads (before eligibility). */
+	nodeWeights: record(string(), number()),
+	deviceWeights: record(string(), record(string(), number()))
+});
+/**
+* Wire shapes of the node benchmark (D791): the operator's plan, the
+* preflight the confirmation shows, the run the orchestrator owns, what the
+* measuring runner reports, and the result rows Auto tune and the automatic
+* shares read.
+*
+* ONE node at a time, owned by the pipeline orchestrator. While a run is
+* active the cluster is in BENCHMARK MODE for that node: it is not a
+* detection candidate, camera pins naming it are ignored so its sessions move
+* elsewhere, and both come back when the mode ends — after a crash or a hub
+* restart too (a persisted manifest, reconciled against the registry).
+*
+* Two measurements, both on the node, driven by its own runner (frames never
+* cross a process at frame rate, D9):
+*  - `device` — one accelerator × one candidate detector, root only, open
+*    loop: how many streams at the camera rate it carries inside the frame
+*    interval;
+*  - `pipeline` — the chosen detector plus the operator's detail steps
+*    (faces, plates, classifiers, CLIP…), on varied frames from the bench
+*    clip: how many parallel sessions the node carries before latency, drops,
+*    CPU, RAM or the event loop give out.
+*/
+/** Defaults and bounds, one place. */
+var NODE_BENCHMARK_DEFAULTS = {
+	fpsPerStream: 10,
+	budgetMinutes: 45,
+	minBudgetMinutes: 10,
+	maxBudgetMinutes: 120,
+	/** A result older than this no longer beats the table. */
+	staleAfterDays: 30,
+	/** Warm-in per ramp step (not accounted). */
+	settleSec: 5,
+	/** Accounted window per ramp step. */
+	measureSec: 20,
+	/** Longest the drain may take before the run is refused. */
+	drainTimeoutSec: 120,
+	/** Candidate models per device in one run. */
+	maxModelsPerDevice: 6
+};
+/** The two measurements a run can make. */
+var NodeBenchmarkPhaseSchema = _enum(["device", "pipeline"]);
+var NodeBenchmarkDevicePlanSchema = object({
+	/** `<backend>:<device>` — `openvino:npu`, `coreml:all`, `cpu`. */
+	deviceKey: string().min(1),
+	/**
+	* Root detector candidates for the `device` measurement, in the order
+	* measured. The FIRST is the one the `pipeline` measurement runs.
+	*/
+	modelIds: array(string().min(1)).min(1).max(NODE_BENCHMARK_DEFAULTS.maxModelsPerDevice)
+});
+/** What the operator confirmed. */
+var NodeBenchmarkPlanSchema = object({
+	nodeId: string().min(1),
+	devices: array(NodeBenchmarkDevicePlanSchema).min(1),
+	/** Which measurements run. At least one. */
+	phases: array(NodeBenchmarkPhaseSchema).min(1).default(["device", "pipeline"]),
+	/**
+	* Detail steps (catalog step ids under the root: faces, plates,
+	* classifiers, CLIP…) the `pipeline` measurement enables. The root
+	* detector always runs.
+	*/
+	steps: array(string().min(1)).default([]),
+	/** Offered rate of one stream / session. */
+	fpsPerStream: number().int().min(1).max(30).default(NODE_BENCHMARK_DEFAULTS.fpsPerStream),
+	/** Hard deadline: the mode ends and the cluster is restored when it passes. */
+	budgetMinutes: number().int().min(NODE_BENCHMARK_DEFAULTS.minBudgetMinutes).max(NODE_BENCHMARK_DEFAULTS.maxBudgetMinutes).default(NODE_BENCHMARK_DEFAULTS.budgetMinutes),
+	/** Keep the models the run downloaded (default: delete what was not installed before). */
+	keepDownloadedModels: boolean().default(false),
+	/** Start although the other nodes' capacity does not cover the sessions running now. */
+	acceptInsufficientHeadroom: boolean().default(false)
+});
+var NodeBenchmarkRefusalSchema = object({
+	kind: _enum([
+		"benchmark-active",
+		"node-offline",
+		"unknown-device",
+		"no-phase",
+		"insufficient-headroom"
+	]),
+	detail: string(),
+	overridable: boolean()
+});
+/** A camera whose detection leaves the node for the run. */
+var NodeBenchmarkMovingCameraSchema = object({
+	deviceId: number(),
+	/** Placed on the node now (a standing attach or a running session). */
+	placedOnNode: boolean(),
+	/** A node pin naming this node, ignored for the run. */
+	pinnedToNode: boolean()
+});
+/** A camera that cannot leave: no other node can obtain its frames. */
+var NodeBenchmarkStayingCameraSchema = object({
+	deviceId: number(),
+	reason: literal("only-frame-source")
+});
+var NodeBenchmarkPreflightSchema = object({
+	nodeId: string(),
+	online: boolean(),
+	moving: array(NodeBenchmarkMovingCameraSchema).readonly(),
+	/** Keep running on the node during the run; the result is flagged contaminated. */
+	staying: array(NodeBenchmarkStayingCameraSchema).readonly(),
+	estimatedDurationMs: number(),
+	/** The run ends and the cluster is restored at the latest after this long. */
+	budgetMs: number(),
+	phases: array(NodeBenchmarkPhaseSchema).readonly(),
+	steps: array(string()).readonly(),
+	devices: array(NodeBenchmarkDevicePlanSchema).readonly(),
+	/** Parallel sessions the cluster runs now, and what the other nodes can carry. */
+	headroom: object({
+		sessionsNow: number(),
+		otherNodesCapacitySessions: number().nullable()
+	}),
+	refusals: array(NodeBenchmarkRefusalSchema).readonly(),
+	canStart: boolean()
+});
+/** Where the measuring runner is. */
+var NodeBenchProgressSchema = object({
+	phase: _enum([
+		"preparing",
+		"device",
+		"pipeline",
+		"cleanup"
+	]),
+	deviceKey: string().nullable(),
+	modelId: string().nullable(),
+	/** Streams (device) or sessions (pipeline) of the step running now. */
+	load: number().nullable(),
+	cellsDone: number(),
+	cellsTotal: number(),
+	message: string()
+});
+/** What limited a ramp. `none` = the ramp ran out of steps still passing. */
+var NodeBenchLimitSchema = _enum([
+	"p95",
+	"drops",
+	"errors",
+	"stall",
+	"cpu",
+	"ram",
+	"none"
+]);
+var NodeBenchRampStepSchema = object({
+	load: number(),
+	pass: boolean(),
+	p95Ms: number(),
+	dropRatio: number(),
+	/** Completed frames per second over the accounted window. */
+	fps: number(),
+	cpuPct: number().nullable(),
+	ramFreePct: number().nullable(),
+	failReasons: array(string()).readonly()
+});
+var NodeBenchCellSchema = discriminatedUnion("phase", [object({
+	phase: literal("device"),
+	deviceKey: string(),
+	modelId: string(),
+	/** Single-stream latency (the K = 1 step). */
+	p50Ms: number(),
+	p95Ms: number(),
+	p99Ms: number(),
+	/** Frames per second sustained at the last passing step. */
+	fps: number(),
+	/** Streams at the camera rate the device carried inside the frame interval; 0 = not even one. */
+	kMax: number(),
+	limitedBy: NodeBenchLimitSchema,
+	/** First call (model load + warm-up). */
+	warmupMs: number(),
+	ramp: array(NodeBenchRampStepSchema).readonly()
+}), object({
+	phase: literal("pipeline"),
+	deviceKey: string(),
+	modelId: string(),
+	steps: array(string()).readonly(),
+	/** Parallel sessions at the camera rate the node carried; 0 = not even one. */
+	maxSessions: number(),
+	limitedBy: NodeBenchLimitSchema,
+	/** Detail steps that produced at least one result on the clip — a step that never fired measured nothing. */
+	stepsFired: array(string()).readonly(),
+	warmupMs: number(),
+	ramp: array(NodeBenchRampStepSchema).readonly()
+})]);
+/**
+* What a result was measured ON. A result whose fingerprint no longer matches
+* the node no longer beats the table.
+*/
+var NodeBenchFingerprintSchema = object({
+	pipelineVersion: string().nullable(),
+	cpuModel: string().nullable(),
+	ramGb: number().nullable(),
+	os: string().nullable(),
+	/** Per device: the pool the cells ran on (runtime + tuning). */
+	pools: record(string(), object({
+		runtime: string(),
+		numWorkers: number(),
+		concurrency: number(),
+		batchMode: string()
+	})).default({})
+});
+/** The frames the run used. */
+var NodeBenchClipSchema = object({
+	/** `camstack-bench-v1` or `reference-images` (the fallback when the clip is not reachable). */
+	id: string(),
+	revision: string().nullable(),
+	frames: number(),
+	width: number(),
+	height: number()
+});
+var NodeBenchRunnerInputSchema = object({
+	runId: string().min(1),
+	devices: array(NodeBenchmarkDevicePlanSchema).min(1),
+	phases: array(NodeBenchmarkPhaseSchema).min(1),
+	/** The full detail step tree root for the `pipeline` measurement is built on the node from these ids. */
+	steps: array(string()).default([]),
+	fpsPerStream: number().int().min(1).max(30),
+	/** The runner stops on its own past this instant, whatever the hub does. */
+	deadlineAtMs: number(),
+	settleSec: number().min(0).max(60).default(NODE_BENCHMARK_DEFAULTS.settleSec),
+	measureSec: number().min(2).max(300).default(NODE_BENCHMARK_DEFAULTS.measureSec),
+	keepDownloadedModels: boolean().default(false)
+});
+var NodeBenchRunnerStateSchema = _enum([
+	"running",
+	"done",
+	"failed",
+	"aborted"
+]);
+var NodeBenchRunnerStatusSchema = object({
+	runId: string(),
+	nodeId: string(),
+	state: NodeBenchRunnerStateSchema,
+	progress: NodeBenchProgressSchema.nullable(),
+	/** Every finished cell so far — a run stopped half way keeps what it measured. */
+	cells: array(NodeBenchCellSchema).readonly(),
+	fingerprint: NodeBenchFingerprintSchema.nullable(),
+	clip: NodeBenchClipSchema.nullable(),
+	/** Cameras seen running on the node during the run (they share its pools). */
+	activeCameraIds: array(number()).readonly(),
+	/** Models the run downloaded and then deleted (not installed before). */
+	deletedModels: array(string()).readonly(),
+	error: string().nullable(),
+	startedAtMs: number(),
+	finishedAtMs: number().nullable()
+});
+var NodeBenchmarkStateSchema = _enum([
+	"draining",
+	"measuring",
+	"restoring",
+	"done",
+	"failed",
+	"aborted"
+]);
+/** Why a run ended. */
+var NodeBenchmarkEndReasonSchema = _enum([
+	"completed",
+	"operator-abort",
+	"deadline",
+	"node-lost",
+	"runner-lost",
+	"hub-restart",
+	"drain-timeout",
+	"failed"
+]);
+var NodeBenchmarkRunSchema = object({
+	runId: string(),
+	nodeId: string(),
+	state: NodeBenchmarkStateSchema,
+	plan: NodeBenchmarkPlanSchema,
+	startedAtMs: number(),
+	deadlineAtMs: number(),
+	finishedAtMs: number().nullable(),
+	endReason: NodeBenchmarkEndReasonSchema.nullable(),
+	error: string().nullable(),
+	/** Cameras moved off the node for the run. */
+	moved: array(number()).readonly(),
+	/** Cameras that stayed (their only frame source is the node). */
+	staying: array(number()).readonly(),
+	/** Something else ran on the node's pools during the run. */
+	contaminated: boolean(),
+	progress: NodeBenchProgressSchema.nullable(),
+	resultIds: array(string()).readonly()
+});
+/** `getNodeBenchmarkStatus`: the active run (or the last one), and whether benchmark mode is on. */
+var NodeBenchmarkStatusSchema = object({
+	/** The node the cluster is in benchmark mode for; null = none. */
+	modeNodeId: string().nullable(),
+	run: NodeBenchmarkRunSchema.nullable()
+});
+/**
+* One stored measurement — the only authority Auto tune and the automatic
+* shares read measured capacity from. Written by the orchestrator when a run
+* ends, never by anyone else.
+*/
+var NodeBenchmarkResultSchema = object({
+	id: string(),
+	runId: string(),
+	nodeId: string(),
+	cell: NodeBenchCellSchema,
+	fpsPerStream: number(),
+	fingerprint: NodeBenchFingerprintSchema.nullable(),
+	clip: NodeBenchClipSchema.nullable(),
+	/** Other work shared the node's pools (a camera that could not move, or the hub's own duties). */
+	contaminated: boolean(),
+	stayingCameras: array(number()).readonly(),
+	/** The run ended early; the cell itself completed. */
+	partialRun: boolean(),
+	measuredAtMs: number()
+});
+var ListNodeBenchmarkResultsInputSchema = object({
+	nodeId: string().optional(),
+	deviceKey: string().optional()
+});
+/** A result with its standing today: does it still beat the table? */
+var NodeBenchmarkResultViewSchema = NodeBenchmarkResultSchema.extend({
+	/** `fresh` beats the table; `stale` falls back to it; `superseded` = a newer row covers the same cell. */
+	standing: _enum([
+		"fresh",
+		"stale",
+		"superseded"
+	]),
+	staleWhy: _enum([
+		"age",
+		"runtime",
+		"pool-tuning"
+	]).nullable()
+});
+object({
+	runId: string(),
+	nodeId: string(),
+	startedAtMs: number(),
+	deadlineAtMs: number(),
+	plan: NodeBenchmarkPlanSchema,
+	moved: array(number()).readonly(),
+	staying: array(number()).readonly()
+});
+/** Candidate detectors per device, for the plan editor. */
+var NodeBenchmarkCandidatesSchema = object({
+	nodeId: string(),
+	reachable: boolean(),
+	devices: array(object({
+		deviceKey: string(),
+		enabled: boolean(),
+		available: boolean(),
+		/** Ordered: what Auto tune would pick first, then the rest of the family by accuracy. */
+		suggested: array(string()).readonly(),
+		/** Every root detector the device has a build for. */
+		all: array(string()).readonly(),
+		/** The model the device runs now, when pinned. */
+		currentModelId: string().nullable()
+	})).readonly(),
+	/** Detail steps the node's catalog offers under the root (for the `pipeline` measurement). */
+	steps: array(object({
+		id: string(),
+		name: string(),
+		slot: string()
+	})).readonly()
+});
 object({
 	activeCameras: number(),
 	throttledCameras: number(),
@@ -24591,14 +26408,15 @@ var RunnerLocalLoadSchema = object({
 	* Per-inference-device live load (multi-device C4). One entry per deviceKey
 	* this runner currently has attached cameras on, so the orchestrator's second
 	* `balance()` pass (over a node's devices) weights on real per-pool session
-	* counts. Empty on single-device / pre-multi-device runners. `queueDepthTotal`
-	* per device is 0 until the pool backlog gets a public accessor (follow-up).
+	* counts. Empty on single-device / pre-multi-device runners. There is no
+	* per-device queue depth: the inference pool's backlog has no accessor, and
+	* a field that always read 0 was removed rather than shown as a measurement
+	* (D762).
 	*/
 	devices: array(object({
 		deviceKey: string(),
 		backend: string(),
-		attachedCameras: number(),
-		queueDepthTotal: number()
+		attachedCameras: number()
 	})).default([]),
 	/** Hardware capability flags reported by this node. */
 	hardware: object({
@@ -24801,7 +26619,16 @@ method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mu
 }), ParkedTrackFrameSchema.nullable()), method(object({
 	deviceId: number(),
 	trackId: string()
-}), object({ released: number().int().nonnegative() }), { kind: "mutation" });
+}), object({ released: number().int().nonnegative() }), { kind: "mutation" }), method(NodeBenchRunnerInputSchema, object({
+	accepted: literal(true),
+	runId: string()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ runId: string() }), NodeBenchRunnerStatusSchema.nullable(), { auth: "admin" }), method(object({ runId: string() }), object({ aborted: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+});
 var CameraPipelineConfigSchema = object({
 	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).readonly(),
@@ -24812,14 +26639,6 @@ var CameraPipelineConfigSchema = object({
 		settings: record(string(), unknown()).readonly().optional()
 	}).nullable().optional()
 });
-var PipelineTemplateSchema = object({
-	id: string(),
-	name: string(),
-	description: string().optional(),
-	config: CameraPipelineConfigSchema,
-	createdAt: string(),
-	updatedAt: string()
-});
 var DeviceStepConfigSchema = object({
 	modelId: string().optional(),
 	settings: record(string(), unknown()).optional(),
@@ -24893,9 +26712,10 @@ var CameraStepOverridePatchSchema = object({
 	modelId: string().optional(),
 	settings: record(string(), unknown()).readonly().optional()
 });
+var CameraStepSettingsSchema = record(string(), record(string(), unknown()).readonly());
 var CameraPipelineSettingsSchema = object({
-	pinnedAgentNodeId: string().optional(),
 	stepToggles: record(string(), boolean()).optional(),
+	stepSettings: CameraStepSettingsSchema.optional(),
 	stepOverridesByDevice: record(string(), record(string(), record(string(), CameraStepOverridePatchSchema))).optional(),
 	pipelineByAgent: record(string(), CameraPipelineForAgentSchema).optional()
 });
@@ -24928,7 +26748,10 @@ var PipelineAssignmentSchema = object({
 });
 /**
 * Per-agent load summary surfaced to the load balancer + dashboards.
-* Aggregated from each runner's `getLocalLoad` cap call.
+* Aggregated from each runner's `getLocalLoad` cap call. In the
+* `getAgentLoad` report, a single-device node's default-pool sessions (no
+* `deviceKey`) are credited to its one eligible device in `load.devices` —
+* the default pool IS that device (D745); the balancer's census stays raw.
 */
 var AgentLoadSummarySchema = object({
 	nodeId: string(),
@@ -25017,26 +26840,27 @@ var CameraBrokerStatusSchema = object({
 		width: number(),
 		height: number(),
 		subscribers: number(),
-		inFps: number(),
-		outFps: number()
+		/**
+		* Encoded packets/s the broker receives from the camera. null when the
+		* broker's stats read failed — unknown, never 0 (a 0 here reads as a stall).
+		* There is no output rate: decoding runs in the session decode workers, not
+		* in the broker, so the broker's own decoded-frame rate is 0 on every live
+		* camera and is not served (D758).
+		*/
+		inFps: number().nullable()
 	})).readonly(),
 	webrtcSessions: number(),
 	rtspRestream: boolean()
 });
-/** Shared-memory ring statistics within the decoder block. */
-var CameraDecoderShmSchema = object({
-	framesWritten: number(),
-	getFrameHits: number(),
-	getFrameMisses: number(),
-	budgetMb: number()
-});
-/** Decoder block — null when the decoder stage is unreachable or inactive. */
-var CameraDecoderStatusSchema = object({
-	nodeId: string(),
-	formats: array(string()).readonly(),
-	sessionCount: number(),
-	shm: CameraDecoderShmSchema
-});
+/**
+* Decoder block — WHERE decode runs (co-located with the detection node by
+* construction); null when the camera has no detection node. It carries no
+* frame counter: the shared-memory plane whose counters it used to serve is
+* gone, and those fields read 0 forever. Whether frames actually flow is read
+* from `detection.actualFps` (frames delivered to and processed by the
+* detector), never from a counter nothing feeds.
+*/
+var CameraDecoderStatusSchema = object({ nodeId: string() });
 /** Motion block — null when motion detection is not active for this device. */
 var CameraMotionStatusSchema = object({
 	enabled: boolean(),
@@ -25393,12 +27217,6 @@ method(object({
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({
-	agentNodeId: string(),
-	detectWeight: number().positive().nullable()
-}), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
 }), method(object({
 	agentNodeId: string(),
 	detect: boolean().nullable().optional(),
@@ -25440,6 +27258,30 @@ method(object({
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(AutoTuneOptionsSchema, AutoTunePlanSchema, { auth: "admin" }), method(AutoTuneApplyInputSchema, AutoTuneApplyResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(LoadBalancingSharesInputSchema, object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(PlacementStatsInputSchema, PlacementStatsSchema, { auth: "admin" }), method(SuggestSharesInputSchema, SuggestSharesResultSchema, { auth: "admin" }), method(_void(), EffectiveSharesSchema, { auth: "admin" }), method(SetShareSourceInputSchema, object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(NodeBenchmarkPlanSchema, NodeBenchmarkPreflightSchema, { auth: "admin" }), method(NodeBenchmarkPlanSchema, discriminatedUnion("kind", [object({
+	kind: literal("started"),
+	runId: string()
+}), object({
+	kind: literal("refused"),
+	preflight: NodeBenchmarkPreflightSchema
+})]), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), NodeBenchmarkStatusSchema, { auth: "admin" }), method(object({ runId: string() }), object({ aborted: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ nodeId: string() }), NodeBenchmarkCandidatesSchema, { auth: "admin" }), method(ListNodeBenchmarkResultsInputSchema, array(NodeBenchmarkResultViewSchema).readonly(), { auth: "admin" }), method(object({ id: string() }), object({ deleted: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ deviceId: number() }), CameraPipelineSettingsSchema.nullable()), method(object({
 	deviceId: number(),
 	addonId: string(),
@@ -25456,6 +27298,13 @@ method(object({
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	addonId: string(),
+	settings: record(string(), unknown()).nullable()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	agentNodeId: string(),
@@ -25479,25 +27328,7 @@ method(object({
 }), method(_void(), DiskReconcileJobSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), DiskReconcileJobSchema, { auth: "admin" }), method(_void(), array(PipelineTemplateSchema).readonly()), method(object({
-	name: string(),
-	description: string().optional(),
-	config: CameraPipelineConfigSchema
-}), PipelineTemplateSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	id: string(),
-	name: string().optional(),
-	description: string().optional(),
-	config: CameraPipelineConfigSchema.optional()
-}), PipelineTemplateSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ id: string() }), object({ success: literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-});
+}), method(_void(), DiskReconcileJobSchema, { auth: "admin" });
 /**
 * Cap → event-kind mapping for the SENSOR / CONTROL cap families — the table
 * `pipeline-analytics.listEventKinds` uses to turn a linked device's bound
@@ -26087,7 +27918,19 @@ var SsoBridgeClaimsSchema = object({
 	* editing a descriptor must not retroactively extend or shorten a link the
 	* operator already consented to.
 	*/
-	refreshTtl: union([number().int().positive(), literal("never")]).optional()
+	refreshTtl: union([number().int().positive(), literal("never")]).optional(),
+	/**
+	* Opaque handle of a hub-side LINK intent (D782). Set by an OIDC callback
+	* that was started from a signed-in user's "Link" button: the finish then
+	* links this identity to the intent's user instead of signing anyone in.
+	* The handle carries no user id — the hub resolves it, single-use.
+	*/
+	linkIntent: string().optional(),
+	/**
+	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
+	* subject is unique only per issuer, so a link is bound to it.
+	*/
+	issuer: string().optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
@@ -27752,8 +29595,6 @@ var WebrtcStreamChoiceSchema = object({
 	]).nullable(),
 	/** Input FPS from the camera (null for adaptive). */
 	inputFps: number().nullable(),
-	/** Decoded FPS (null for adaptive). */
-	decodeFps: number().nullable(),
 	/** Bitrate in kbps (null for adaptive). */
 	bitrateKbps: number().nullable()
 });
@@ -28030,7 +29871,22 @@ DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), ar
 	* field their hints were silently stripped by the schema and the
 	* adaptive ladder started blind on the client's display size.
 	*/
-	hints: webrtcClientHintsSchema.optional()
+	hints: webrtcClientHintsSchema.optional(),
+	/**
+	* Talk-back (D771): relay the PEER's audio to the device's speaker
+	* through the `intercom` cap's push-talk triple. When `true` and the
+	* offer lets the peer send audio, the answer's audio is `sendrecv`
+	* and every inbound frame goes to `intercom.pushTalkAudio` for this
+	* `deviceId`; absent/false answers `sendonly`, as for every viewer.
+	*
+	* TRUSTED-CALLER ONLY. Set by the Alexa export for an Echo on a camera
+	* with `intercom`, when the linked user may control that camera. The
+	* hub STRIPS it from every request-bound call (a browser), exactly as
+	* it overwrites `relayOnly` — a viewer's talk permission is the
+	* intercom cap's own surface (share tokens gate it there), and this
+	* flag must not become a second door to the camera's speaker.
+	*/
+	talkback: boolean().optional()
 }), object({
 	sessionId: string(),
 	sdpAnswer: string()
@@ -28332,6 +30188,59 @@ var AddonAutoUpdateSchema = ChannelWithInheritSchema;
 var RestartAddonResultSchema = unknown();
 var InstallPackageResultSchema = unknown();
 var ReloadPackagesResultSchema = unknown();
+/**
+* What an uninstall did on ONE node.
+*  - `uninstalled`       — removed: runner(s) stopped, caps gone, code deleted.
+*  - `not-installed`     — the node did not have it (nothing to do).
+*  - `refused`           — protected / bootstrap package; nothing touched.
+*  - `failed`            — attempted and did not complete; `error` says why.
+*  - `pending-reconnect` — the node is OFFLINE: its record was pruned so the
+*    back-fill never returns the package, and the stale-addon sweep removes the
+*    copy when the node registers again (only once the hub no longer has it).
+*/
+var UninstallNodeOutcomeSchema = _enum([
+	"uninstalled",
+	"not-installed",
+	"refused",
+	"failed",
+	"pending-reconnect"
+]);
+var UninstallNodeResultSchema = object({
+	nodeId: string(),
+	outcome: UninstallNodeOutcomeSchema,
+	error: string().optional(),
+	addonIds: array(string()).readonly(),
+	runnersStopped: array(string()).readonly(),
+	warnings: array(string()).readonly()
+});
+var UninstallPackageResultSchema = object({
+	/** Every targeted node ended `uninstalled`, `not-installed` or `pending-reconnect`. */
+	success: boolean(),
+	packageName: string(),
+	results: array(UninstallNodeResultSchema).readonly()
+});
+/**
+* `unreachable` lists online agents whose status read FAILED — absence from
+* `installations` is only "not installed" for a node that answered (D315).
+*/
+var PackageInstallationsSchema = object({
+	installations: array(object({
+		packageName: string(),
+		nodeId: string(),
+		nodeName: string(),
+		isHub: boolean(),
+		isOnline: boolean(),
+		version: string().nullable(),
+		addonIds: array(string()).readonly(),
+		source: _enum(["live", "recorded"]),
+		/** The hub installs this package too. `false` on an agent row = an orphan. */
+		onHub: boolean()
+	})).readonly(),
+	unreachable: array(object({
+		nodeId: string(),
+		error: string()
+	})).readonly()
+});
 var BulkUpdateItemStatusSchema = _enum([
 	"queued",
 	"updating",
@@ -28414,10 +30323,14 @@ method(_void(), array(AddonListItemSchema).readonly()), method(object({
 }), method(object({ packageName: string() }), InstallPackageResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), boolean()), method(_void(), array(unknown()).readonly()), method(object({ packageName: string() }), unknown(), {
+}), method(_void(), boolean()), method(_void(), array(unknown()).readonly()), method(object({
+	packageName: string().min(1),
+	nodeId: string().optional(),
+	everywhere: boolean().optional()
+}), UninstallPackageResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), ReloadPackagesResultSchema, {
+}), method(object({ packageName: string().optional() }), PackageInstallationsSchema, { auth: "admin" }), method(_void(), ReloadPackagesResultSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ query: string().optional() }), array(SearchResultSchema)), method(object({ nodeId: string().optional() }), array(PackageUpdateSchema).readonly(), { auth: "admin" }), method(object({
@@ -30485,6 +32398,9 @@ var CreateIntegrationInputSchema = object({
 	enabled: boolean().optional(),
 	info: record(string(), unknown()).optional(),
 	settings: record(string(), unknown()).optional(),
+	/** Keys of `settings` the form's schema declares secret (by type) — kept in
+	*  the keychain, not the table (D787). */
+	secretKeys: array(string()).optional(),
 	skipRestart: boolean().optional()
 });
 var UpdateIntegrationInputSchema = object({
@@ -30508,7 +32424,9 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 	auth: "admin"
 }), method(object({ id: string() }), record(string(), unknown()), { auth: "admin" }), method(object({
 	id: string(),
-	settings: record(string(), unknown())
+	settings: record(string(), unknown()),
+	/** Keys the form's schema declares secret (by type) — keychain-stored (D787). */
+	secretKeys: array(string()).optional()
 }), object({ success: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -36017,6 +37935,32 @@ var TotpStatusSchema = object({
 	/** Null when no row exists OR the row is still pending confirmation. */
 	confirmedAt: number().nullable()
 });
+/**
+* user-management — singleton capability for user accounts, API keys,
+* and scoped tokens.
+*
+* v2 model: every method gated by `auth: 'admin'`. Admin-only delegation
+* — the subset check on `setUserScopes` / `createScopedToken` is moot
+* because non-admins never reach these. If/when we open non-admin
+* delegation, structural caller-scope subset check goes inside the
+* provider.
+*/
+var ExternalIdentitySchema = object({
+	/** Login-method id of the provider instance, e.g. `auth-oidc/authentik`. */
+	provider: string(),
+	/** The IdP's stable subject (`sub`) for this account. */
+	subject: string(),
+	/** The verified `iss` of the IdP the identity was linked under — `sub` is unique only per issuer. */
+	issuer: string(),
+	userId: string(),
+	/** What the IdP called the account at link time (username / email) — display only. */
+	label: string().optional(),
+	linkedAt: number()
+});
+var ExternalIdentityKeySchema = object({
+	provider: string().min(1),
+	subject: string().min(1)
+});
 method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserInputSchema, UserSummarySchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -36130,7 +38074,22 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	userId: string(),
 	username: string(),
 	scopes: array(TokenScopeSchema)
-}).nullable(), { access: "view" }), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string() }), object({ success: boolean() }), {
+}).nullable(), { access: "view" }), method(object({ userId: string() }), array(ExternalIdentitySchema), { auth: "admin" }), method(ExternalIdentityKeySchema, object({
+	userId: string(),
+	issuer: string()
+}).nullable(), { auth: "admin" }), method(ExternalIdentityKeySchema.extend({
+	userId: string(),
+	issuer: string().min(1),
+	label: string().optional()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "create"
+}), method(ExternalIdentityKeySchema.extend({ userId: string() }), object({ success: boolean() }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "delete"
+}), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string() }), object({ success: boolean() }), {
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
@@ -36522,6 +38481,16 @@ DeviceType.Camera, method(object({
 	package: array(ZoneRuleSchema).readonly()
 });
 SOURCE_CAPS.filter((cap) => cap !== "switch" && cap !== "motion");
+Object.freeze({
+	person: .5,
+	vehicle: .5,
+	animal: .5
+});
+Object.freeze({
+	person: .65,
+	vehicle: .65,
+	animal: .65
+});
 /**
 * Accessory device helpers — shared across drivers.
 *
@@ -36696,6 +38665,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"addons.listInstallations": {
+		capName: "addons",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"addons.listJobs": {
 		capName: "addons",
 		capScope: "system",
@@ -37878,90 +39853,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"decoder.createSession": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.destroySession": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "delete"
-	},
-	"decoder.getFrame": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"decoder.getInfo": {
 		capName: "decoder",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
-	"decoder.getShmStats": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.getStats": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.listActiveSessions": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.openStream": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.pullFrames": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.pullHandles": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.pushPacket": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"decoder.reprobeHwaccel": {
 		capName: "decoder",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"decoder.supportsCodec": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"decoder.updateConfig": {
-		capName: "decoder",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"detectionPipeline.applyDeviceSettingsPatch": {
 		capName: "detection-pipeline",
 		capScope: "device",
@@ -39228,6 +41131,90 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychain.delete": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychain.getState": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychain.listMeta": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychain.put": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychain.resolve": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.deleteOrphans": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.downloadRecoveryKey": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.listAudit": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.listSecrets": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.purgeRetiredKeys": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.resetKeychain": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.reveal": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.rotateMasterKey": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.status": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"lawnMowerControl.dock": {
 		capName: "lawn-mower-control",
 		capScope: "device",
@@ -40602,6 +42589,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.addRetrainFrameFromRecording": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"pipelineAnalytics.addRetrainFramesToCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.applyDeviceSettingsPatch": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -40650,12 +42649,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.createRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.deleteRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineAnalytics.deleteTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -40860,6 +42871,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRetrainAssistProfiles": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainCollectionFrames": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainCollections": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainFrames": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -40908,6 +42937,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.proposeRetrainAnnotationsWithLlm": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.pruneEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -40962,6 +42997,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.removeRetrainFrameFromCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
+	"pipelineAnalytics.renameRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.restageRetrainTrack": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -40992,6 +43039,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.setRetrainFrameComplete": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -41028,6 +43081,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.writeRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineExecutor.cacheFrameInPool": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -41040,13 +43099,13 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
-	"pipelineExecutor.deleteModel": {
+	"pipelineExecutor.clearModelBoundDeviceOverrides": {
 		capName: "pipeline-executor",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
-	"pipelineExecutor.deleteTemplate": {
+	"pipelineExecutor.deleteModel": {
 		capName: "pipeline-executor",
 		capScope: "system",
 		addonId: null,
@@ -41190,12 +43249,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"pipelineExecutor.listTemplates": {
-		capName: "pipeline-executor",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"pipelineExecutor.rearmInferenceDevice": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -41220,12 +43273,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineExecutor.saveTemplate": {
-		capName: "pipeline-executor",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineExecutor.setVideoPipelineSteps": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -41244,17 +43291,23 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineExecutor.updateTemplate": {
+	"pipelineExecutor.validatePipeline": {
 		capName: "pipeline-executor",
 		capScope: "system",
 		addonId: null,
+		access: "view"
+	},
+	"pipelineOrchestrator.abortNodeBenchmark": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
 		access: "create"
 	},
-	"pipelineExecutor.validatePipeline": {
-		capName: "pipeline-executor",
+	"pipelineOrchestrator.applyAutoTune": {
+		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
-		access: "view"
+		access: "create"
 	},
 	"pipelineOrchestrator.applyDeviceSettingsPatch": {
 		capName: "pipeline-orchestrator",
@@ -41274,7 +43327,7 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.deleteTemplate": {
+	"pipelineOrchestrator.deleteNodeBenchmarkResult": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
@@ -41370,6 +43423,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getEffectiveShares": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getGlobalMetrics": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -41382,6 +43441,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getNodeBenchmarkCandidates": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineOrchestrator.getNodeBenchmarkPreflight": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineOrchestrator.getNodeBenchmarkStatus": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getNodeInferenceDevices": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -41406,6 +43483,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getPlacementStats": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getReconcileFromDiskStatus": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -41418,7 +43501,7 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"pipelineOrchestrator.listTemplates": {
+	"pipelineOrchestrator.listNodeBenchmarkResults": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
@@ -41430,6 +43513,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.planAutoTune": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.rebalance": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -41472,12 +43561,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.saveTemplate": {
-		capName: "pipeline-orchestrator",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineOrchestrator.setAgentCapabilities": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -41490,12 +43573,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.setAgentDetectWeight": {
-		capName: "pipeline-orchestrator",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"pipelineOrchestrator.setAgentInferenceDevices": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -41532,6 +43609,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraStepSettings": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCameraStepToggle": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -41550,12 +43633,36 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setLoadBalancingShares": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setPipelineDevicePin": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setShareSource": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"pipelineOrchestrator.startNodeBenchmark": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"pipelineOrchestrator.suggestShares": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.unassignAudio": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -41568,8 +43675,8 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"pipelineOrchestrator.updateTemplate": {
-		capName: "pipeline-orchestrator",
+	"pipelineRunner.abortNodeBench": {
+		capName: "pipeline-runner",
 		capScope: "system",
 		addonId: null,
 		access: "create"
@@ -41622,6 +43729,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineRunner.getNodeBenchStatus": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineRunner.getParkedTrackFrame": {
 		capName: "pipeline-runner",
 		capScope: "system",
@@ -41664,6 +43777,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.startNodeBench": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"plateGallery.assignPlate": {
 		capName: "plate-gallery",
 		capScope: "system",
@@ -43008,12 +45127,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"streamBroker.pullFrameHandles": {
-		capName: "stream-broker",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"streamBroker.regenerateRtspToken": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -43080,12 +45193,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"streamBroker.subscribeFrames": {
-		capName: "stream-broker",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"streamBroker.unassignProfile": {
 		capName: "stream-broker",
 		capScope: "system",
@@ -43098,12 +45205,6 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
-	"streamBroker.unsubscribeFrames": {
-		capName: "stream-broker",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"streamCatalog.getCatalog": {
 		capName: "stream-catalog",
 		capScope: "device",
@@ -43398,18 +45499,36 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userManagement.findUserByExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.getTotpStatus": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.linkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.listExternalIdentities": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.listOauthSessions": {
 		capName: "user-management",
 		capScope: "system",
@@ -43488,6 +45607,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userManagement.unlinkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"userManagement.updateUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -45251,7 +47376,11 @@ var DISPLAY_ICON_VOCABULARY = [
 ];
 DISPLAY_ICON_VOCABULARY.map((e) => e.key);
 DISPLAY_ICON_VOCABULARY.filter((e) => e.aliasOf === void 0).map((e) => e.key);
-new Map(DISPLAY_ICON_VOCABULARY.map((e) => [e.key, e]));
+var ENTRY_BY_KEY = new Map(DISPLAY_ICON_VOCABULARY.map((e) => [e.key, e]));
+/** Is this a key of the shared vocabulary? */
+function isDisplayIconKey(value) {
+	return typeof value === "string" && ENTRY_BY_KEY.has(value);
+}
 Object.freeze({
 	"accessories.getStatus": [{
 		name: "deviceId",
@@ -45617,11 +47746,6 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
-	"decoder.createSession": [{
-		name: "deviceId",
-		form: "single",
-		optional: true
-	}],
 	"detectionPipeline.applyDeviceSettingsPatch": [{
 		name: "deviceId",
 		form: "single",
@@ -46592,6 +48716,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.addRetrainFrameFromRecording": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.applyDeviceSettingsPatch": [{
 		name: "deviceId",
 		form: "single",
@@ -46782,6 +48911,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.proposeRetrainAnnotationsWithLlm": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.pruneEventsBefore": [{
 		name: "deviceId",
 		form: "single",
@@ -46832,6 +48966,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.setRetrainFrameComplete": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.setTrackFlags": [{
 		name: "deviceId",
 		form: "single",
@@ -46852,6 +48991,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineExecutor.clearModelBoundDeviceOverrides": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
 	"pipelineExecutor.runPipeline": [{
 		name: "deviceId",
 		form: "single",
@@ -46957,6 +49101,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.setCameraStepSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.setCameraStepToggle": [{
 		name: "deviceId",
 		form: "single",
@@ -48873,14 +51022,4 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
-//#region src/hub-browser-origin.ts
-async function hubBrowserOrigin(localNetwork, logger) {
-	try {
-		return (await localNetwork.getAddresses.query()).roles.publicEndpoint.resolved;
-	} catch (err) {
-		logger.warn("hub address unavailable from local-network — using the localhost default", { meta: { error: err instanceof Error ? err.message : String(err) } });
-		return null;
-	}
-}
-//#endregion
-export { buildAddonRouteProvider as a, errMsg as c, boolean as d, number as f, authProviderCapability as i, BaseAddon as l, string as m, addonRoutesCapability as n, loginMethodCapability as o, object as p, addonWidgetsSourceCapability as r, userPasskeysCapability as s, hubBrowserOrigin as t, array as u };
+export { isDisplayIconKey as a, errMsg as c, boolean as d, number as f, buildAddonRouteProvider as i, BaseAddon as l, string as m, addonWidgetsSourceCapability as n, loginMethodCapability as o, object as p, authProviderCapability as r, userPasskeysCapability as s, addonRoutesCapability as t, array as u };