@camstack/addon-export-alexa 1.2.138 → 1.2.139

package/dist/export-alexa.addon.mjs

@@ -1,7 +1,7 @@
 import * as crypto$1 from "node:crypto";
 import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import sharp from "sharp";
-//#region ../types/dist/event-category-B_0XEcLF.mjs
+//#region ../types/dist/event-category-DaIZi00R.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -80,6 +80,13 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AddonLoadFailed"] = "addon.load-failed";
 	/**
+	* A keychain value was stored or removed (D787). Carries the ref, its
+	* owner and the new version — NEVER the value. A process holding the ref
+	* drops its cached copy and the owning `BaseAddon` re-resolves its config.
+	* Telemetry (D8): a process that misses it still revalidates by version.
+	*/
+	EventCategory["KeychainChanged"] = "keychain.changed";
+	/**
 	* Addon recovered from a previous failure. Emitted when an addon
 	* transitions from `failed` back to `healthy` (typically via the
 	* monitor's auto-retry loop, or after manual `addons.retryLoad`).
@@ -5372,7 +5379,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-B0JG7-_F.mjs
+//#region ../types/dist/sleep-Cr5YOk3m.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -5451,6 +5458,97 @@ function buildAlawTable() {
 }
 buildUlawTable();
 buildAlawTable();
+/** Is this field's stored value a credential? */
+function isSecretConfigField(field) {
+	if (field.type === "password") return true;
+	return "secret" in field && field.secret === true;
+}
+/**
+* Is this field's value stored in the KEYCHAIN (D787)? Every secret field is,
+* by its TYPE, unless it opts out with `storage: 'inline'` — never by its name.
+*/
+function isKeychainStoredField(field) {
+	if (!isSecretConfigField(field)) return false;
+	if (field.type === "textarea" && field.isJson === true) return false;
+	return !("storage" in field && field.storage === "inline");
+}
+/**
+* What a settings blob holds where a secret used to be.
+*
+* A keychain-stored field never holds its value. It holds a self-describing
+* MARKER, `{"$secret":"secret://…","v":1}` — an object, never a string, so no
+* code can mistake it for a credential and no form can send it to a camera as
+* a password. The empty state is `null` / absent, never `''`.
+*
+* The same shapes travel to and from the admin UI:
+*
+*  - read: `hydrateSchema` hands a secret field a {@link SecretFieldView}
+*    (`{ $secret, v, set: true }`) or `null` — the browser learns whether a
+*    value is set, never the value.
+*  - write: an untouched field submits the view back unchanged (KEEP); a typed
+*    value is a plain non-empty string (CHANGE); the Clear button submits
+*    {@link SECRET_CLEAR} (CLEAR). `''`, `null` and the legacy redaction tokens
+*    are KEEP — an empty string is what a defaults-fallback pushes back, and
+*    treating it as "clear" is how a save destroyed a stored credential before.
+*
+* Pure and browser-safe.
+*/
+var SECRET_CLEAR = { $secretClear: true };
+/** The `'***'` token D634 redaction writes for non-admins. */
+var LEGACY_DEVICE_REDACTION = "***";
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function makeSecretMarker(ref) {
+	return {
+		$secret: ref,
+		v: 1
+	};
+}
+/** A stored marker: an object whose `$secret` is a non-empty string. */
+function isSecretMarker(value) {
+	if (!isRecord$1(value)) return false;
+	const ref = value["$secret"];
+	return typeof ref === "string" && ref.length > 0;
+}
+function isSecretClear(value) {
+	return isRecord$1(value) && value["$secretClear"] === true;
+}
+/**
+* The UI view of a stored secret field value: a marker becomes "set", inline
+* plaintext becomes "set (inline)", nothing becomes `null`. A value never
+* survives this function.
+*/
+function toSecretFieldView(stored) {
+	if (isSecretMarker(stored)) return {
+		$secret: stored.$secret,
+		v: 1,
+		set: true
+	};
+	if (typeof stored === "string" && stored.length > 0) return {
+		$secret: null,
+		v: 1,
+		set: true,
+		inline: true
+	};
+	return null;
+}
+/**
+* Classify an incoming value for a secret path. Only a non-empty string that is
+* not a redaction token sets a value; only {@link SECRET_CLEAR} clears.
+* Everything else — a marker (ours or anyone's), a UI view, `''`, `null`,
+* `undefined`, a redaction token, a non-string — keeps what is stored.
+*/
+function classifySecretWrite(incoming) {
+	if (isSecretClear(incoming)) return { kind: "clear" };
+	if (typeof incoming !== "string") return { kind: "keep" };
+	if (incoming.length === 0) return { kind: "keep" };
+	if (incoming === "__camstack_redacted__" || incoming === LEGACY_DEVICE_REDACTION) return { kind: "keep" };
+	return {
+		kind: "set",
+		value: incoming
+	};
+}
 Object.fromEntries([
 	{
 		id: "overview",
@@ -5622,33 +5720,19 @@ Object.fromEntries([
 function isValuelessField(field) {
 	return field.type === "separator" || field.type === "info" || field.type === "qr-code" || field.type === "button" || field.type === "object-array" || field.type === "widget" || field.type === "addon-action-button" || field.type === "device-action-button";
 }
-/**
-* Merge a `ConfigUISchema` with a raw `values` record into a
-* `ConfigUISchemaWithValues`. Used by every `get*Settings` backend endpoint
-* before returning to the admin UI. Groups are walked recursively.
-*
-* For each leaf field:
-*   - structural fields (`separator`, `info`, `button`) pass through unchanged
-*   - other fields get `value = values[key] ?? field.default ?? null`
-*
-* Unknown keys in `values` (keys not declared in the schema) are silently
-* ignored — they don't contribute to the output. Missing keys fall back to
-* the schema default or `null`. This mirrors the old backend behaviour where
-* `FormBuilder` rendered `values[key] ?? field.default`.
-*/
-function hydrateSchema(schema, values) {
+function hydrateSchema(schema, values, options = {}) {
 	return {
 		...schema.tabs ? { tabs: [...schema.tabs] } : {},
 		sections: schema.sections.map((section) => ({
 			...section,
-			fields: section.fields.map((field) => hydrateField(field, values))
+			fields: section.fields.map((field) => hydrateField(field, values, options))
 		}))
 	};
 }
-function hydrateField(field, values) {
+function hydrateField(field, values, options) {
 	if (isValuelessField(field)) return field;
 	if (field.type === "group") {
-		const hydratedChildren = field.fields.map((child) => hydrateField(child, values));
+		const hydratedChildren = field.fields.map((child) => hydrateField(child, values, options));
 		return {
 			...field,
 			fields: hydratedChildren
@@ -5657,7 +5741,7 @@ function hydrateField(field, values) {
 	if (field.type === "sub-tabs") {
 		const hydratedTabs = field.tabs.map((tab) => ({
 			...tab,
-			fields: tab.fields.map((child) => hydrateField(child, values))
+			fields: tab.fields.map((child) => hydrateField(child, values, options))
 		}));
 		return {
 			...field,
@@ -5667,6 +5751,33 @@ function hydrateField(field, values) {
 	const key = field.key;
 	const storedValue = Object.prototype.hasOwnProperty.call(values, key) ? values[key] : void 0;
 	const defaultValue = field.default;
+	const asView = (v) => isSecretMarker(v) || options.inlineSecretsAsViews === true && v !== void 0;
+	if (isKeychainStoredField(field) && asView(storedValue)) return {
+		...field,
+		value: toSecretFieldView(storedValue)
+	};
+	if (isKeychainStoredField(field) && options.inlineSecretsAsViews === true) return {
+		...field,
+		value: null
+	};
+	if (field.type === "editable-array" && Array.isArray(storedValue)) {
+		const secretItemKeys = field.itemFields.filter((item) => "key" in item && isKeychainStoredField(item)).map((item) => "key" in item ? item.key : "");
+		if (secretItemKeys.length > 0) {
+			const rows = storedValue.map((row) => {
+				if (row === null || typeof row !== "object" || Array.isArray(row)) return row;
+				const out = { ...row };
+				for (const k of secretItemKeys) {
+					const v = Reflect.get(row, k);
+					if (asView(v)) out[k] = toSecretFieldView(v);
+				}
+				return out;
+			});
+			return {
+				...field,
+				value: rows
+			};
+		}
+	}
 	if (field.multiple) {
 		const stored = Array.isArray(storedValue) ? storedValue : storedValue !== void 0 && storedValue !== null ? [storedValue] : [];
 		const itemFallback = field.multiple.itemDefault !== void 0 ? field.multiple.itemDefault : defaultValue !== void 0 ? defaultValue : typeOf(field) === "string" ? "" : null;
@@ -5909,6 +6020,431 @@ function projectStore(store, perNodeKeys, nodeId) {
 	}
 	return out;
 }
+var GLOBAL_SCOPE = { kind: "global" };
+/** The scope every addon-wide (not per-node, not per-device) setting lives in. */
+function globalSecretScope() {
+	return GLOBAL_SCOPE;
+}
+function encodeSegment(value) {
+	return encodeURIComponent(value);
+}
+/**
+* The field path of a value inside an array item, addressed by the item's id:
+* `arrayItemFieldPath('providers', 'authentik', 'clientSecret')` →
+* `providers[authentik].clientSecret`.
+*/
+function arrayItemFieldPath(arrayKey, itemId, fieldKey) {
+	return `${arrayKey}[${encodeSegment(itemId)}].${fieldKey}`;
+}
+/** A write to a secret path could not be stored in the keychain, so it was refused. */
+var KeychainWriteRefusedError = class extends Error {
+	fieldPath;
+	constructor(fieldPath, cause) {
+		super(`secret "${fieldPath}" was not saved: the keychain could not store it (${cause instanceof Error ? cause.message : String(cause)}). Nothing was written.`);
+		this.fieldPath = fieldPath;
+		this.name = "KeychainWriteRefusedError";
+	}
+};
+var KEEP = { kind: "keep" };
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function defaultMintId() {
+	return globalThis.crypto.randomUUID();
+}
+/** Every marker ref anywhere under `value`. */
+function collectSecretMarkerRefs(value, out = []) {
+	if (isSecretMarker(value)) {
+		out.push(value.$secret);
+		return out;
+	}
+	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
+	else if (isRecord(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	return out;
+}
+async function storedValueEquals(secrets, marker, candidate) {
+	const resolved = (await secrets.resolve([marker.$secret]))[marker.$secret];
+	return resolved?.kind === "value" && resolved.value === candidate;
+}
+async function writeLeaf(ctx, incoming, stored, fieldPath) {
+	const intent = classifySecretWrite(incoming);
+	const ref = ctx.secrets.ref(ctx.scope, fieldPath);
+	const storedIsOurs = isSecretMarker(stored) && stored.$secret === ref;
+	if (intent.kind === "keep") return KEEP;
+	if (intent.kind === "set" && !ctx.operatorWrite && typeof stored === "string" && stored === intent.value) return KEEP;
+	if (intent.kind === "clear") {
+		if (storedIsOurs) ctx.deletes.push(ref);
+		return {
+			kind: "value",
+			value: null
+		};
+	}
+	if (storedIsOurs && await storedValueEquals(ctx.secrets, stored, intent.value)) return {
+		kind: "value",
+		value: stored
+	};
+	try {
+		await ctx.secrets.put(ref, intent.value);
+	} catch (err) {
+		throw new KeychainWriteRefusedError(fieldPath, err);
+	}
+	return {
+		kind: "value",
+		value: makeSecretMarker(ref)
+	};
+}
+/** Apply a member result onto `out`: KEEP restores the stored member, or removes it. */
+function applyMember(out, key, result, storedParent) {
+	if (result.kind === "value") {
+		out[key] = result.value;
+		return;
+	}
+	if (Object.prototype.hasOwnProperty.call(storedParent, key)) out[key] = storedParent[key];
+	else delete out[key];
+}
+async function writeMembers(ctx, children, incoming, stored, pathOf) {
+	const out = { ...incoming };
+	for (const [member, node] of children) applyMember(out, member, await writeNode(ctx, node, incoming[member], stored[member], pathOf(member)), stored);
+	return out;
+}
+function rowId(row, idKey) {
+	const raw = row[idKey];
+	if (typeof raw === "string" && raw.length > 0) return raw;
+	if (typeof raw === "number" && Number.isFinite(raw)) return String(raw);
+	return null;
+}
+async function writeArray(ctx, node, incoming, stored, fieldPath) {
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord) : [];
+	if (!Array.isArray(incoming)) {
+		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
+		return {
+			kind: "value",
+			value: incoming
+		};
+	}
+	const storedById = /* @__PURE__ */ new Map();
+	for (const row of storedRows) {
+		const id = rowId(row, node.idKey);
+		if (id !== null) storedById.set(id, row);
+	}
+	const kept = /* @__PURE__ */ new Set();
+	const rows = [];
+	for (const row of incoming) {
+		if (!isRecord(row)) {
+			rows.push(row);
+			continue;
+		}
+		const id = rowId(row, node.idKey) ?? ctx.mintId();
+		kept.add(id);
+		const withId = {
+			...row,
+			[node.idKey]: row[node.idKey] ?? id
+		};
+		if (rowId(withId, node.idKey) === null) withId[node.idKey] = id;
+		const storedRow = storedById.get(id) ?? {};
+		rows.push(await writeMembers(ctx, node.item, withId, storedRow, (member) => arrayItemFieldPath(fieldPath, id, member)));
+	}
+	for (const [id, row] of storedById) if (!kept.has(id)) ctx.deletes.push(...collectSecretMarkerRefs(row));
+	return {
+		kind: "value",
+		value: rows
+	};
+}
+async function writeNode(ctx, node, incoming, stored, fieldPath) {
+	switch (node.kind) {
+		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
+		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
+		case "object": {
+			if (!isRecord(incoming)) {
+				if (incoming === void 0) return KEEP;
+				ctx.deletes.push(...collectSecretMarkerRefs(stored));
+				return {
+					kind: "value",
+					value: incoming
+				};
+			}
+			const storedObj = isRecord(stored) ? stored : {};
+			return {
+				kind: "value",
+				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
+			};
+		}
+	}
+}
+/** Split a perNode-scoped key (`key@nodeId`). */
+function splitNodeKey(key) {
+	const at = key.indexOf("@");
+	return at <= 0 ? {
+		base: key,
+		nodeId: null
+	} : {
+		base: key.slice(0, at),
+		nodeId: key.slice(at + 1)
+	};
+}
+/** Rewrite a settings patch so no secret value reaches the blob. See the file doc. */
+async function transformSecretWrite(input) {
+	const deletes = [];
+	const base = {
+		secrets: input.secrets,
+		mintId: input.mintId ?? defaultMintId,
+		deletes,
+		operatorWrite: input.operatorWrite === true
+	};
+	const out = {};
+	for (const [key, incoming] of Object.entries(input.patch)) {
+		const { base: baseKey, nodeId } = splitNodeKey(key);
+		const node = input.tree.get(baseKey);
+		if (node === void 0) {
+			out[key] = incoming;
+			continue;
+		}
+		const scope = nodeId !== null && nodeId.length > 0 ? {
+			kind: "node",
+			nodeId
+		} : input.scope ?? globalSecretScope();
+		const result = await writeNode({
+			...base,
+			scope
+		}, node, incoming, input.stored[key], baseKey);
+		if (result.kind === "value") out[key] = result.value;
+	}
+	return {
+		patch: out,
+		afterWrite: async () => {
+			if (deletes.length === 0) return { orphaned: [] };
+			try {
+				await input.secrets.delete([...new Set(deletes)]);
+				return { orphaned: [] };
+			} catch {
+				return { orphaned: [...new Set(deletes)] };
+			}
+		}
+	};
+}
+/**
+* Replace every marker in `value` with its keychain value. Returns the SAME
+* reference when there is no marker (no allocation, no keychain call).
+*/
+async function resolveSecretMarkers(value, secrets) {
+	const refs = collectSecretMarkerRefs(value);
+	if (refs.length === 0) return {
+		value,
+		unresolved: []
+	};
+	const answers = await secrets.resolve(refs);
+	const unresolved = [];
+	for (const ref of new Set(refs)) {
+		const answer = answers[ref];
+		if (answer === void 0) unresolved.push({
+			ref,
+			reason: "not-initialized"
+		});
+		else if (answer.kind === "unavailable") unresolved.push({
+			ref,
+			reason: answer.reason
+		});
+		else if (answer.kind === "missing" || answer.kind === "forbidden") unresolved.push({
+			ref,
+			reason: answer.kind
+		});
+	}
+	const substitute = (v) => {
+		if (isSecretMarker(v)) {
+			const answer = answers[v.$secret];
+			return answer?.kind === "value" ? {
+				keep: true,
+				value: answer.value
+			} : {
+				keep: false,
+				value: void 0
+			};
+		}
+		if (Array.isArray(v)) {
+			const items = [];
+			for (const item of v) {
+				const s = substitute(item);
+				if (s.keep) items.push(s.value);
+			}
+			return {
+				keep: true,
+				value: items
+			};
+		}
+		if (isRecord(v)) {
+			const out = {};
+			for (const [k, child] of Object.entries(v)) {
+				const s = substitute(child);
+				if (s.keep) out[k] = s.value;
+			}
+			return {
+				keep: true,
+				value: out
+			};
+		}
+		return {
+			keep: true,
+			value: v
+		};
+	};
+	return {
+		value: substitute(value).value,
+		unresolved
+	};
+}
+function touchesTree(tree, patch) {
+	if (tree.size === 0) return false;
+	for (const key of Object.keys(patch)) {
+		const at = key.indexOf("@");
+		if (tree.has(at > 0 ? key.slice(0, at) : key)) return true;
+	}
+	return false;
+}
+/** The blob as stored now; a failed read REFUSES the write instead of guessing. */
+async function readStoredAddonBlob(raw) {
+	const threeWay = raw.readAddonStoreResult;
+	if (threeWay === void 0) return raw.readAddonStore();
+	const result = await threeWay.call(raw);
+	if (result.kind === "failed") throw new Error(`settings write refused: the stored blob could not be read (${result.error})`);
+	return result.kind === "missing" ? {} : result.value;
+}
+function createSecretAwareSettings(raw, opts) {
+	const chains = /* @__PURE__ */ new Map();
+	const serialize = (key, fn) => {
+		const next = (chains.get(key) ?? Promise.resolve()).then(fn, fn);
+		const tail = next.catch(() => void 0);
+		chains.set(key, tail);
+		tail.then(() => {
+			if (chains.get(key) === tail) chains.delete(key);
+		});
+		return next;
+	};
+	const write = async (chainKey, tree, scope, patch, readStored, rawWrite) => {
+		if (!touchesTree(tree, patch)) return rawWrite(patch);
+		return serialize(chainKey, async () => {
+			const stored = await readStored();
+			const result = await transformSecretWrite({
+				tree,
+				secrets: opts.secrets,
+				patch,
+				stored,
+				...scope !== void 0 ? { scope } : {},
+				operatorWrite: opts.isOperatorWrite?.() === true
+			});
+			if (Object.keys(result.patch).length > 0) await rawWrite(result.patch);
+			const { orphaned } = await result.afterWrite();
+			if (orphaned.length > 0) opts.onOrphaned(orphaned);
+		});
+	};
+	const wrapped = {
+		writeAddonStore: (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p)),
+		writeDeviceStore: (deviceId, patch) => write(`device:${deviceId}`, opts.deviceTree(), {
+			kind: "device",
+			deviceId
+		}, patch, () => raw.readDeviceStore(deviceId), (p) => raw.writeDeviceStore(deviceId, p))
+	};
+	return new Proxy(raw, { get(target, prop, receiver) {
+		if (prop === "writeAddonStore") return wrapped.writeAddonStore;
+		if (prop === "writeDeviceStore") return wrapped.writeDeviceStore;
+		const value = Reflect.get(target, prop, receiver);
+		return typeof value === "function" ? value.bind(target) : value;
+	} });
+}
+/** The context the addon sees: identical, except that its settings writes are secret-aware. */
+function withSecretAwareSettings(context, opts) {
+	const raw = context.settings;
+	if (raw === void 0) return context;
+	const settings = createSecretAwareSettings(raw, opts);
+	return new Proxy(context, { get(target, prop, receiver) {
+		if (prop === "settings") return settings;
+		return Reflect.get(target, prop, receiver);
+	} });
+}
+var LEAF = { kind: "leaf" };
+var DEFAULT_ITEM_ID_KEY = "id";
+function collectFields(fields, out) {
+	for (const field of fields) {
+		if (field.type === "group") {
+			collectFields(field.fields, out);
+			continue;
+		}
+		if (field.type === "sub-tabs") {
+			for (const tab of field.tabs) collectFields(tab.fields, out);
+			continue;
+		}
+		if (field.type === "editable-array") {
+			const item = /* @__PURE__ */ new Map();
+			for (const itemField of field.itemFields) if ("key" in itemField && isKeychainStoredField(itemField)) item.set(itemField.key, LEAF);
+			if (item.size > 0) out.set(field.key, {
+				kind: "array",
+				idKey: field.itemIdKey ?? DEFAULT_ITEM_ID_KEY,
+				item
+			});
+			continue;
+		}
+		if (!("key" in field) || typeof field.key !== "string") continue;
+		if (isKeychainStoredField(field)) out.set(field.key, LEAF);
+	}
+}
+/** The secret tree a settings schema declares. */
+function secretTreeFromSchema(schema) {
+	const out = /* @__PURE__ */ new Map();
+	if (schema === null) return out;
+	for (const section of schema.sections) collectFields(section.fields, out);
+	return out;
+}
+/** Parse `a.b[id].c` into segments; throws on a malformed path (a declaration bug). */
+function parseSecretStatePath(path) {
+	const segments = [];
+	for (const raw of path.split(".")) {
+		const m = /^([^[\]]+)(?:\[([^[\]]+)\])?$/.exec(raw);
+		if (m === null || m[1] === void 0) throw new Error(`secretStatePaths: malformed path "${path}"`);
+		segments.push(m[2] !== void 0 ? {
+			key: m[1],
+			idKey: m[2]
+		} : { key: m[1] });
+	}
+	if (segments.length === 0) throw new Error(`secretStatePaths: empty path`);
+	if (segments[segments.length - 1]?.idKey !== void 0) throw new Error(`secretStatePaths: "${path}" ends on an array — name the member that is secret`);
+	return segments;
+}
+function insert(into, segments) {
+	const [head, ...rest] = segments;
+	if (head === void 0) return;
+	if (rest.length === 0) {
+		into.set(head.key, LEAF);
+		return;
+	}
+	const existing = into.get(head.key);
+	if (head.idKey !== void 0) {
+		const item = new Map(existing?.kind === "array" ? existing.item : []);
+		insert(item, rest);
+		into.set(head.key, {
+			kind: "array",
+			idKey: head.idKey,
+			item
+		});
+		return;
+	}
+	const children = new Map(existing?.kind === "object" ? existing.children : []);
+	insert(children, rest);
+	into.set(head.key, {
+		kind: "object",
+		children
+	});
+}
+/** Add hidden-state paths (`secretStatePaths`) to a schema-derived tree. */
+function mergeSecretStatePaths(tree, paths) {
+	if (paths.length === 0) return tree;
+	const out = new Map(tree);
+	for (const path of paths) insert(out, parseSecretStatePath(path));
+	return out;
+}
+/** First retry of a secret the keychain could not serve; doubles to {@link SECRET_RETRY_MAX_MS}. */
+var SECRET_RETRY_FIRST_MS = 5e3;
+var SECRET_RETRY_MAX_MS = 5 * 6e4;
+/** Coalesces a burst of `keychain.changed` events into one re-resolve. */
+var SECRET_CHANGE_DEBOUNCE_MS = 250;
 /**
 * Base class for CamStack addons. Eliminates settings boilerplate:
 *
@@ -5978,6 +6514,25 @@ var BaseAddon = class {
 	settingsStoreReady = false;
 	/** Default config values. Provided via constructor. */
 	defaults;
+	/**
+	* Hidden-state paths that hold secrets (D787) — values the addon writes
+	* itself (`updateGlobalSettings`, `state()`) that no form field declares.
+	* Stored in the keychain exactly like a `password` field. Syntax:
+	* `'snapshotSigningKey'`, `'identity.pincode'`, `'tokens[userId].accessToken'`
+	* (`key[<id field>]` addresses array items by id, never by index).
+	*/
+	secretStatePaths = [];
+	_addonSecretTree = null;
+	_deviceSecretTree = null;
+	/** Refs the last resolved config pointed at — a change to one re-resolves. */
+	_configSecretRefs = /* @__PURE__ */ new Set();
+	_unresolvedSecrets = [];
+	_secretRetryTimer = null;
+	_secretRetryDelayMs = SECRET_RETRY_FIRST_MS;
+	_secretChangeTimer = null;
+	_secretChangeUnsub = null;
+	/** >0 while an OPERATOR's settings write is being applied. */
+	_operatorWriteDepth = 0;
 	constructor(defaults) {
 		this.defaults = defaults;
 		this._config = { ...defaults };
@@ -6013,8 +6568,18 @@ var BaseAddon = class {
 		return this._config;
 	}
 	async initialize(context) {
-		this._ctx = context;
+		const secrets = context.secrets;
+		this._ctx = secrets !== void 0 ? withSecretAwareSettings(context, {
+			secrets,
+			addonTree: () => this.addonSecretTree(),
+			deviceTree: () => this.deviceSecretTree(),
+			onOrphaned: (refs) => context.logger.warn("keychain refs dropped by a settings write could not be deleted", { meta: { refs: [...refs] } }),
+			isOperatorWrite: () => this._operatorWriteDepth > 0
+		}) : context;
 		await this.resolveConfig();
+		if (secrets !== void 0) this._secretChangeUnsub = secrets.onChange((ref) => {
+			if (this._configSecretRefs.has(ref)) this.scheduleSecretReresolve(SECRET_CHANGE_DEBOUNCE_MS);
+		});
 		const result = await this.onInitialize();
 		this.emitLifecycle(EventCategory.AddonStarted);
 		const normalized = normalizeAddonInitResult(result);
@@ -6047,6 +6612,12 @@ var BaseAddon = class {
 	*/
 	async onHubReachable() {}
 	async shutdown() {
+		this._secretChangeUnsub?.();
+		this._secretChangeUnsub = null;
+		if (this._secretRetryTimer !== null) clearTimeout(this._secretRetryTimer);
+		if (this._secretChangeTimer !== null) clearTimeout(this._secretChangeTimer);
+		this._secretRetryTimer = null;
+		this._secretChangeTimer = null;
 		this.emitLifecycle(EventCategory.AddonStopped);
 		if (this.autoEmitReadiness) this.emitReadinessForProviders("down");
 		await this.onShutdown();
@@ -6125,7 +6696,7 @@ var BaseAddon = class {
 		return hydrateSchema(schema, overlay ? {
 			...projected,
 			...overlay
-		} : projected);
+		} : projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The integration-level view of this addon's settings: exactly the sections
@@ -6174,7 +6745,7 @@ var BaseAddon = class {
 		return hydrateSchema({
 			...schema,
 			sections
-		}, projected);
+		}, projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The raw addon store PROJECTED onto the target node's bare per-node keys:
@@ -6228,18 +6799,50 @@ var BaseAddon = class {
 			value: result.value[key]
 		};
 	}
+	/**
+	* The OPERATOR's write — a settings form or an admin API call, dispatched by
+	* the kernel. Identical to {@link updateGlobalSettings}, except that a secret
+	* the operator sends is stored as sent even when it equals a pre-keychain
+	* inline value: the operator re-entering a password is a change, an addon
+	* writing back what it read is not (D787).
+	*/
+	async updateGlobalSettingsAsOperator(patch, nodeId) {
+		this._operatorWriteDepth++;
+		try {
+			await this.applyGlobalPatch(patch, nodeId);
+		} finally {
+			this._operatorWriteDepth--;
+		}
+	}
 	async updateGlobalSettings(patch, nodeId) {
+		await this.applyGlobalPatch(patch, nodeId);
+	}
+	/**
+	* REMOVE stored secrets — their keychain values and their markers (D787).
+	*
+	* Writing `''` to a secret field KEEPS what is stored (an empty string is
+	* what a defaults fallback writes back, and it must never destroy a
+	* credential), so code that means "forget this token" says so here. Without
+	* a keychain (an older kernel) it writes `''`, as such code always did.
+	*/
+	async clearSecrets(keys, nodeId) {
+		const tree = this.addonSecretTree();
+		const keychain = this._ctx?.secrets !== void 0;
+		const patch = {};
+		for (const key of keys) patch[key] = keychain && tree.has(key) ? SECRET_CLEAR : "";
+		await this.applyGlobalPatch(patch, nodeId);
+	}
+	async applyGlobalPatch(barePatch, nodeId) {
 		const keys = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
-		const barePatch = patch;
 		const scoped = keys.size > 0 ? scopePatch(barePatch, keys, target) : barePatch;
 		await this._ctx?.settings?.writeAddonStore(scoped);
 		if (target !== localNode) return;
 		await this.resolveConfig();
 		await this.onConfigChanged();
 		this.emitLifecycle(EventCategory.AddonUpdated, { level: "global" });
-		this.maybeAutoRestart(patch, this.globalSettingsSchema());
+		this.maybeAutoRestart(Object.keys(barePatch), this.globalSettingsSchema());
 	}
 	/**
 	* The set of field keys the global settings schema declares `perNode: true`
@@ -6264,7 +6867,7 @@ var BaseAddon = class {
 	* time to return its response before the addon is torn down and
 	* re-initialised by `AddonRegistryService.restartAddon`.
 	*/
-	maybeAutoRestart(patch, schema) {
+	maybeAutoRestart(patchKeys, schema) {
 		if (!schema) return;
 		const restartKeys = /* @__PURE__ */ new Set();
 		for (const section of schema.sections) for (const field of section.fields) {
@@ -6272,13 +6875,13 @@ var BaseAddon = class {
 			if (field.requiresRestart) restartKeys.add(field.key);
 		}
 		if (restartKeys.size === 0) return;
-		if (!Object.keys(patch).some((k) => restartKeys.has(k))) return;
+		if (!patchKeys.some((k) => restartKeys.has(k))) return;
 		const ctx = this._ctx;
 		if (!ctx) return;
 		const addonId = ctx.id;
 		setImmediate(() => {
 			ctx.api.addons?.restartAddon?.mutate({ addonId }).then(() => {
-				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: Object.keys(patch).filter((k) => restartKeys.has(k)) } });
+				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: patchKeys.filter((k) => restartKeys.has(k)) } });
 			}).catch((err) => {
 				ctx.logger.error("addon auto-restart failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
 			});
@@ -6287,7 +6890,7 @@ var BaseAddon = class {
 	async getDeviceSettings(deviceId) {
 		const schema = this.deviceSettingsSchema();
 		if (!schema) return { sections: [] };
-		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {});
+		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, { inlineSecretsAsViews: true });
 	}
 	async updateDeviceSettings(deviceId, patch) {
 		await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
@@ -6417,7 +7020,7 @@ var BaseAddon = class {
 	* selection at boot (absent scoped key ⇒ the constructor default wins).
 	*/
 	async resolveConfig() {
-		const stored = await this.readAddonStoreWithRetry();
+		const stored = await this.resolveStoredSecrets(await this.readAddonStoreWithRetry());
 		const perNode = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const resolved = { ...this.defaults };
@@ -6442,7 +7045,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: () => this.readAddonStoreWithRetry(),
+			read: async () => this.resolveStoredSecrets(await this.readAddonStoreWithRetry()),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeAddonStore(patch);
 			},
@@ -6459,7 +7062,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: async () => await this._ctx?.settings?.readDeviceStore(deviceId) ?? {},
+			read: async () => this.resolveStoredSecrets(await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, false),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
 			},
@@ -6471,6 +7074,70 @@ var BaseAddon = class {
 			} })
 		});
 	}
+	/** The addon store's secret tree: schema fields by TYPE, plus `secretStatePaths`. */
+	addonSecretTree() {
+		this._addonSecretTree ??= mergeSecretStatePaths(secretTreeFromSchema(this.globalSettingsSchema()), this.secretStatePaths);
+		return this._addonSecretTree;
+	}
+	deviceSecretTree() {
+		this._deviceSecretTree ??= secretTreeFromSchema(this.deviceSettingsSchema());
+		return this._deviceSecretTree;
+	}
+	/**
+	* Secrets of this addon's stored config that could not be resolved on the
+	* last read, with why. Non-empty means the addon is running WITHOUT them —
+	* an addon whose function needs one should report itself degraded rather
+	* than start on an empty credential.
+	*/
+	get unresolvedSecrets() {
+		return this._unresolvedSecrets;
+	}
+	/**
+	* Substitute every keychain marker in a stored blob with its value. With no
+	* keychain (no `ctx.secrets`) or no marker, the blob comes back unchanged.
+	* An unresolvable value is LEFT OUT (never `''`), logged by ref — never by
+	* value — and, when the cause can pass, retried with backoff. Nothing is
+	* ever written back from here.
+	*/
+	async resolveStoredSecrets(blob, trackForConfig = true) {
+		const secrets = this._ctx?.secrets;
+		if (secrets === void 0) return blob;
+		const refs = collectSecretMarkerRefs(blob);
+		if (trackForConfig) this._configSecretRefs = new Set(refs);
+		if (refs.length === 0) {
+			if (trackForConfig) this._unresolvedSecrets = [];
+			return blob;
+		}
+		const { value, unresolved } = await resolveSecretMarkers(blob, secrets);
+		if (trackForConfig) {
+			this._unresolvedSecrets = unresolved;
+			if (unresolved.length > 0) {
+				this._ctx?.logger?.error?.("secret unavailable — running without it, will retry", { meta: { secrets: unresolved.map((u) => ({
+					ref: u.ref,
+					reason: u.reason
+				})) } });
+				if (unresolved.some((u) => u.reason !== "missing" && u.reason !== "forbidden")) {
+					this.scheduleSecretReresolve(this._secretRetryDelayMs);
+					this._secretRetryDelayMs = Math.min(this._secretRetryDelayMs * 2, SECRET_RETRY_MAX_MS);
+				}
+			} else this._secretRetryDelayMs = SECRET_RETRY_FIRST_MS;
+		}
+		return value;
+	}
+	/** Re-resolve the config (a keychain-only change, or a retry) and apply it. */
+	scheduleSecretReresolve(delayMs) {
+		const timerOf = delayMs === SECRET_CHANGE_DEBOUNCE_MS ? "_secretChangeTimer" : "_secretRetryTimer";
+		if (this[timerOf] !== null) return;
+		const timer = setTimeout(() => {
+			this[timerOf] = null;
+			if (this._ctx === null) return;
+			this.resolveConfig().then(() => this.onConfigChanged()).catch((err) => {
+				this._ctx?.logger?.error?.("re-resolving secrets failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			});
+		}, delayMs);
+		timer.unref?.();
+		this[timerOf] = timer;
+	}
 	/**
 	* Wrap `ctx.settings.readAddonStore()` with a short retry budget so a
 	* transient settings-store outage (mid-restart of sqlite-settings, tsx-watch
@@ -14275,6 +14942,196 @@ id: union([string(), number()]) }), {
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* `keychain` — the hub's encrypted store of secret values (D787).
+*
+* Settings blobs never hold a secret: they hold a marker
+* `{"$secret":"secret://<owner>/<scope>/<fieldPath>","v":1}` and the value
+* lives here, AES-256-GCM under a data key that a master key wraps. This cap
+* is the OWNER's door to its own values: every method is owner-checked
+* against the CALLER, never against anything the caller claims.
+*
+* Who the caller is: the transport stamps `callerAddonId` into the args of a
+* call that crossed a process (the parent `LocalChildRegistry` from the UDS
+* connection, the agent from its child's connection carried in
+* `$hub-cap-fwd`'s envelope). A stamp always overwrites; a wire call with no
+* stamp has its claim stripped. Only a hub in-process caller may state its own
+* identity — `ctx.secrets` does that with the addon id closed over. This is
+* identity against BUGS and misrouting, not against a malicious addon (every
+* runner is the same OS user): see the threat model in
+* `docs/design/2026-10-08-secrets-keychain.md`.
+*
+* `callerAddonId` is deliberately NOT in any input schema: the tRPC router
+* parses the input, so a session can never supply it, and the internal mount
+* floors every method to admin anyway (D240).
+*
+* Internal: addons reach it through `ctx.secrets`, never directly.
+*/
+/** Why a value cannot be served right now. Never folded into "missing". */
+var KeychainUnavailableReasonSchema = _enum([
+	"key-missing",
+	"wrong-key",
+	"key-file-unreadable",
+	"store-unavailable",
+	"not-initialized",
+	"decrypt-failed"
+]);
+var KeychainStateSchema = discriminatedUnion("state", [object({ state: literal("ready") }), object({
+	state: literal("locked"),
+	reason: KeychainUnavailableReasonSchema
+})]);
+var KeychainResolveEntrySchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("value"),
+		value: string(),
+		version: number().int()
+	}),
+	object({ kind: literal("missing") }),
+	object({
+		kind: literal("unavailable"),
+		reason: KeychainUnavailableReasonSchema
+	}),
+	object({ kind: literal("forbidden") })
+]);
+var KeychainResolveResultSchema = record(string(), KeychainResolveEntrySchema);
+/** Metadata of one stored value — never the value. */
+var KeychainSecretMetaSchema = object({
+	ref: string(),
+	owner: string(),
+	/** Formatted scope (`global`, `node/<id>`, `device/<id>`, …). */
+	scope: string(),
+	fieldPath: string(),
+	version: number().int(),
+	createdAt: number(),
+	updatedAt: number(),
+	/** `addon:<id>` | `user:<id>` | `system`. */
+	updatedBy: string(),
+	/** Coarse — written at most once an hour per ref. `null` = never read. */
+	lastReadAt: number().nullable()
+});
+var RefListSchema = array(string().min(1)).max(512);
+method(object({
+	ref: string().min(1),
+	value: string().min(1)
+}), object({
+	ref: string(),
+	version: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ refs: RefListSchema }), KeychainResolveResultSchema, { auth: "admin" }), method(object({ refs: RefListSchema }), object({ deleted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }), method(object({}), KeychainStateSchema, { auth: "admin" });
+var KeychainKeySourceSchema = object({
+	kind: _enum([
+		"config-file",
+		"previous-config-file",
+		"platform",
+		"default-file"
+	]),
+	/** File sources only — a path is not a secret. */
+	path: string().optional(),
+	/**
+	* True when a whole-volume backup of the data directory carries this key
+	* next to the database it protects (the default file). The page warns.
+	*/
+	sharesBackupWithDatabase: boolean()
+});
+var KeychainStatusSchema = object({
+	keychain: KeychainStateSchema,
+	/** The source of the master key in use; `null` while locked. */
+	keySource: KeychainKeySourceSchema.nullable(),
+	/** The source configured to be primary — differs from `keySource` while a rotation is pending. */
+	configuredSource: KeychainKeySourceSchema,
+	/** Short fingerprint of the master key in use (`HMAC(KEK, label)`, 16 hex). */
+	fingerprint: string().nullable(),
+	activeKeyId: string().nullable(),
+	/**
+	* The keychain unlocked with a NON-primary source: the configured primary
+	* key is not the one that wraps the data key yet. `rotateMasterKey` moves it.
+	*/
+	rotationPending: boolean(),
+	/** Wrapped copies of the data key under a previous master key, kept until purged. */
+	retiredWraps: number().int(),
+	recoveryKeyDownloadedAt: number().nullable(),
+	secretCount: number().int()
+});
+/**
+* Whether a stored value is still pointed at by its owner's settings.
+* `unknown` is a first-class answer: a scope whose blob could not be read is
+* never reported as an orphan (and never deleted as one).
+*/
+var KeychainSecretUsageSchema = _enum([
+	"in-use",
+	"orphan",
+	"unknown"
+]);
+var KeychainAdminSecretSchema = KeychainSecretMetaSchema.extend({ usage: KeychainSecretUsageSchema });
+var KeychainAuditActionSchema = _enum([
+	"put",
+	"delete",
+	"reveal",
+	"rotate-master-key",
+	"purge-retired-keys",
+	"download-recovery-key",
+	"delete-orphans",
+	"reset",
+	"initialize"
+]);
+var KeychainAuditEntrySchema = object({
+	id: string(),
+	at: number(),
+	action: KeychainAuditActionSchema,
+	/** `addon:<id>` | `user:<id>` | `system`. */
+	actor: string(),
+	ref: string().nullable(),
+	detail: string().nullable()
+});
+method(object({}), KeychainStatusSchema, { auth: "admin" }), method(object({}), array(KeychainAdminSecretSchema).readonly(), { auth: "admin" }), method(object({ limit: number().int().min(1).max(500).optional() }), array(KeychainAuditEntrySchema).readonly(), { auth: "admin" }), method(object({ ref: string().min(1) }), object({
+	value: string(),
+	version: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ refs: array(string().min(1)).max(1e3) }), object({
+	deleted: array(string()).readonly(),
+	kept: array(object({
+		ref: string(),
+		usage: KeychainSecretUsageSchema
+	})).readonly()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({}), object({
+	fingerprint: string(),
+	keySource: KeychainKeySourceSchema
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({}), object({ purged: number().int() }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({}), object({
+	key: string(),
+	fingerprint: string(),
+	keySource: KeychainKeySourceSchema
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ confirm: literal("RESET KEYCHAIN") }), object({
+	archivedCollection: string().nullable(),
+	archived: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+});
 method(_void(), object({
 	id: string(),
 	name: string(),
@@ -15337,7 +16194,11 @@ var DeviceRegisterPayloadSchema = object({
 var DeviceRemovePayloadSchema = object({ deviceId: number() });
 var DevicePersistConfigPayloadSchema = object({
 	deviceId: number(),
-	data: record(string(), unknown())
+	data: record(string(), unknown()),
+	/** The paths the device's schema declares secret (D783), when the caller
+	*  knows them — those values are kept in the keychain, not the blob (D787).
+	*  Absent: the paths the device last reported at `registerDevice` apply. */
+	secretConfigPaths: array(string()).optional()
 });
 /** What a migration actually did, per switch. `unreachable` is a first-class
 *  answer: a camera that could not be asked is not a camera that was silenced. */
@@ -22332,8 +23193,23 @@ var RetrainMacroClassSchema = _enum([
 ]);
 /** A subject to learn, or a phantom to unlearn (taught by OMISSION). */
 var RetrainAnnotationKindSchema = _enum(["subject", "model_error"]);
-/** Did a human draw this box, or did the assist propose it? */
-var RetrainAnnotationSourceSchema = _enum(["operator", "assist"]);
+/**
+* Where a box came from. A machine-sourced box is a DRAFT on the page until
+* the operator confirms it; once saved it keeps its source as provenance.
+*
+* - `operator` — drawn by hand.
+* - `assist`   — proposed by a detector run on the copy (the camera's own
+*   model, or a larger teacher model).
+* - `pipeline` — the box the live pipeline actually drew on that frame, read
+*   back from the track store (never a re-run).
+* - `llm`      — proposed by a vision-capable LLM profile.
+*/
+var RetrainAnnotationSourceSchema = _enum([
+	"operator",
+	"assist",
+	"pipeline",
+	"llm"
+]);
 /** Normalised `[0,1]` rectangle against the FULL frame — the canonical form. */
 var RetrainBboxSchema = object({
 	x: number(),
@@ -22351,7 +23227,8 @@ var RetrainBboxSchema = object({
 */
 var RetrainAnnotationSchema = object({
 	id: string(),
-	trackId: string(),
+	/** The frame's track. Absent on a recording still, which has none. */
+	trackId: string().optional(),
 	deviceId: number(),
 	/** The COPY in retrain storage — never the source track's media key. */
 	mediaKey: string(),
@@ -22400,13 +23277,47 @@ var RetrainFrameCandidateSchema = object({
 	*  fail, whatever became of the original. */
 	copied: boolean()
 });
+/**
+* One box the live pipeline drew on a copied frame — what a correction starts
+* from. Derived when the frame is listed, from the track store: the subject
+* box recorded on the source media row when there is one, else the track
+* position nearest the frame's capture time. Never stored as an annotation
+* until the operator confirms it.
+*/
+var RetrainPipelineBoxSchema = object({
+	/** Normalised `[0,1]` against the full frame. */
+	bbox: RetrainBboxSchema,
+	macroClass: RetrainMacroClassSchema,
+	label: string().optional(),
+	subLabel: string().optional(),
+	/** The detection score of the position used, when it was recorded. */
+	score: number().optional(),
+	/** The root model that produced the track, when it was recorded. */
+	modelId: string().optional(),
+	trackId: string(),
+	/** `subject-box`: recorded on this very frame. `position`: the track's
+	*  position nearest the capture time, `deltaMs` away. */
+	basis: _enum(["subject-box", "position"]),
+	deltaMs: number()
+});
+/**
+* Where a retrain frame came from: a TRACK's stored media (copy-on-select),
+* or the RECORDING at an instant — the frame a model saw nothing in has no
+* track at all.
+*/
+var RetrainFrameOriginSchema = _enum(["track", "recording"]);
 /** A frame the dataset OWNS: bytes copied at selection time. */
 var RetrainFrameSchema = object({
 	frameId: string(),
 	deviceId: number(),
-	trackId: string(),
-	/** Provenance only. It may already point at nothing — that is expected. */
-	sourceMediaId: number().int(),
+	origin: RetrainFrameOriginSchema,
+	/** The track it was copied from. Absent on a recording still. */
+	trackId: string().optional(),
+	/** Provenance only. It may already point at nothing — that is expected.
+	*  Absent on a recording still. */
+	sourceMediaId: number().int().optional(),
+	/** A recording still: the playhead instant it was taken at. */
+	epochMs: number().optional(),
 	sourceKind: MediaFileKindEnum,
 	sizeBytes: number().int(),
 	width: number().int(),
@@ -22417,7 +23328,12 @@ var RetrainFrameSchema = object({
 	/** The operator's "every subject in this frame is boxed". Detector
 	*  evaluation keeps only complete frames: an unboxed subject would count as
 	*  a false positive. */
-	complete: boolean()
+	complete: boolean(),
+	/** The boxes the pipeline drew on this frame. Present on list answers;
+	*  empty when nothing the track store holds can be placed on it. */
+	pipelineBoxes: array(RetrainPipelineBoxSchema).readonly().optional(),
+	/** The named collections this frame belongs to. Present on list answers. */
+	collectionIds: array(string()).readonly().optional()
 });
 /** Why a copy-on-select could not be honoured — named, never a silent skip. */
 var RetrainCopyRefusalSchema = _enum([
@@ -22448,6 +23364,8 @@ var RetrainFrameListSchema = object({
 var RetrainExportFilterSchema = object({
 	deviceIds: array(number()).optional(),
 	frameIds: array(string()).max(2e4).optional(),
+	/** Only frames in at least one of these named collections. */
+	collectionIds: array(string()).max(200).optional(),
 	batchId: string().optional(),
 	/** Only frames the operator marked complete (all subjects boxed). */
 	completeOnly: boolean().optional()
@@ -22512,6 +23430,109 @@ var RetrainAssistResultSchema = discriminatedUnion("kind", [object({
 	reason: string(),
 	detail: string().optional()
 })]);
+/** A named set over the retrain corpus — membership only, it owns no pixels. */
+var RetrainCollectionSchema = object({
+	id: string(),
+	name: string(),
+	createdAt: number(),
+	frameCount: number().int()
+});
+var RetrainCollectionCreateResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("created"),
+	collection: RetrainCollectionSchema
+}), object({
+	kind: literal("refused"),
+	reason: _enum(["empty-name", "duplicate-name"])
+})]);
+var RetrainCollectionRenameResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("renamed"),
+	collection: RetrainCollectionSchema
+}), object({
+	kind: literal("refused"),
+	reason: _enum([
+		"empty-name",
+		"duplicate-name",
+		"unknown-collection"
+	])
+})]);
+/**
+* The outcome of adding the frame at a recording instant. Every refusal is
+* named: `still-unavailable` (not recording, a gap, or an undecodable frame —
+* `detail` says which), `still-busy` (the recorder is at its decode bound; try
+* again), `unreadable-image`, `write-failed`, `unknown-collection`.
+*/
+var AddRetrainFrameFromRecordingResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("added"),
+	collectionId: string(),
+	frame: RetrainFrameSchema,
+	/** The moment was already in the dataset; nothing was decoded. */
+	reused: boolean()
+}), object({
+	kind: literal("refused"),
+	reason: _enum([
+		"unknown-collection",
+		"still-unavailable",
+		"still-busy",
+		"unreadable-image",
+		"write-failed"
+	]),
+	detail: string().optional()
+})]);
+/** A vision LLM profile the AI assist may use, and where it sends the frame. */
+var RetrainAssistProfileSchema = object({
+	id: string(),
+	name: string(),
+	model: string(),
+	kind: string(),
+	/** `true` when the frame would leave the house (a cloud vendor, or an
+	*  endpoint that is not on the local network). The page confirms each such
+	*  run, and the provider refuses one without `allowCloud`. */
+	leavesHouse: boolean()
+});
+/** A box the AI assist proposed: a draft, plus the model's own reason. */
+var RetrainLlmProposalSchema = RetrainAnnotationDraftSchema.extend({ reason: string() });
+/** What the AI assist said about a box that was already on the canvas. */
+var RetrainLlmReviewSchema = object({
+	/** The `ref` the page sent the box under. */
+	ref: string(),
+	verdict: _enum([
+		"confirmed",
+		"wrong-class",
+		"not-an-object",
+		"uncertain"
+	]),
+	suggestedClass: RetrainMacroClassSchema.optional(),
+	reason: string()
+});
+/**
+* The AI assist's answer. `proposed` carries drafts (`source: 'llm'`, the
+* model and its confidence) and reviews; items the model got wrong (a box off
+* the frame, an unasked class, an unknown ref) are dropped and counted in
+* `rejected`. A whole answer that is not the schema is `malformed-answer`.
+*/
+var RetrainLlmAssistResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("proposed"),
+	profileId: string(),
+	model: string(),
+	/** The frame was sent outside the house for this answer. */
+	leftHouse: boolean(),
+	proposals: array(RetrainLlmProposalSchema).readonly(),
+	reviews: array(RetrainLlmReviewSchema).readonly(),
+	rejected: number().int()
+}), object({
+	kind: literal("refused"),
+	reason: _enum([
+		"unknown-frame",
+		"unreadable-frame",
+		"unknown-profile",
+		"profile-disabled",
+		"no-vision",
+		"cloud-not-confirmed",
+		"llm-error",
+		"malformed-answer"
+	]),
+	detail: string().optional()
+})]);
 /** The outcome of a lifecycle move owned by the retrain page. */
 var RetrainTransitionResultSchema = object({
 	trackId: string(),
@@ -23229,7 +24250,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema$1).r
 	auth: "admin"
 }), method(object({
 	deviceId: number(),
-	trackId: string(),
+	trackId: string().optional(),
 	frameId: string()
 }), object({
 	removed: boolean(),
@@ -23246,7 +24267,8 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema$1).r
 	auth: "admin"
 }), method(object({
 	deviceId: number(),
-	trackId: string(),
+	/** The frame's track, when it has one — checked against the frame. */
+	trackId: string().optional(),
 	frameId: string(),
 	subject: RetrainAssistSubjectSchema,
 	/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
@@ -23254,12 +24276,16 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema$1).r
 }), RetrainAssistResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ trackId: string() }), array(RetrainAnnotationSchema).readonly(), {
+}), method(object({
+	trackId: string().optional(),
+	frameIds: array(string()).max(2e3).optional()
+}), array(RetrainAnnotationSchema).readonly(), {
 	kind: "query",
 	auth: "admin"
 }), method(object({
 	deviceId: number(),
-	trackId: string(),
+	/** The frame's track, when it has one — checked against the frame. */
+	trackId: string().optional(),
 	frameId: string(),
 	annotations: array(RetrainAnnotationDraftSchema)
 }), array(RetrainAnnotationSchema).readonly(), {
@@ -23282,7 +24308,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema$1).r
 	auth: "admin"
 }), method(object({
 	deviceId: number(),
-	trackId: string(),
+	trackId: string().optional(),
 	frameId: string(),
 	complete: boolean()
 }), RetrainFrameSchema, {
@@ -23296,6 +24322,74 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema$1).r
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 60 * 6e4
+}), method(object({}), array(RetrainAssistProfileSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string().optional(),
+	frameId: string(),
+	profileId: string(),
+	classes: array(RetrainMacroClassSchema).min(1),
+	boxes: array(object({
+		ref: string(),
+		bbox: RetrainBboxSchema,
+		macroClass: RetrainMacroClassSchema,
+		label: string().optional()
+	})).max(50),
+	allowCloud: boolean()
+}), RetrainLlmAssistResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 18e4
+}), method(object({ name: string().max(120) }), RetrainCollectionCreateResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(RetrainCollectionSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	id: string(),
+	name: string().max(120)
+}), RetrainCollectionRenameResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string() }), object({
+	deleted: boolean(),
+	removedFrames: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	collectionId: string(),
+	deviceId: number(),
+	epochMs: number()
+}), AddRetrainFrameFromRecordingResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 6e4
+}), method(object({
+	collectionId: string(),
+	frameIds: array(string()).min(1).max(500)
+}), object({
+	added: number().int(),
+	alreadyMember: number().int(),
+	unknownFrameIds: array(string()).readonly()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	collectionId: string(),
+	frameId: string()
+}), object({
+	removed: boolean(),
+	deletedFrame: boolean()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ collectionId: string() }), array(RetrainFrameSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
 }), method(object({
 	/** Which of the three event tables owns the row. */
 	ownerType: EventOwnerTypeSchema,
@@ -23919,13 +25013,31 @@ var RecommendationReasonSchema = discriminatedUnion("kind", [
 	object({
 		kind: literal("no-family-build"),
 		format: ModelFormatSchema$1
+	}),
+	object({
+		kind: literal("kept-custom-pin"),
+		modelId: string(),
+		deviceKey: string()
 	})
 ]);
+/** Why a device is left exactly as it is, whatever the plan would pick (D786). */
+var KeptReasonSchema = _enum(["custom-pin"]);
+/**
+* Where a choice's latency came from (D791): this node's own benchmark
+* result, or the hardware-class table. Measured on the node beats the table.
+*/
+var LatencySourceSchema = discriminatedUnion("kind", [object({ kind: literal("table") }), object({
+	kind: literal("node-benchmark"),
+	resultId: string(),
+	measuredAtMs: number()
+})]);
 var DeviceModelChoiceSchema = object({
 	modelId: string(),
 	p50Ms: number(),
 	fps: number(),
 	measured: boolean(),
+	/** Absent on a plan from before D791 — read as the table. */
+	source: LatencySourceSchema.optional(),
 	/** Parallel sessions at the camera rate with the headroom kept free: ⌊fps × (1 − headroom) / camera fps⌋. */
 	capacitySessions: number(),
 	personRecall: number()
@@ -23936,6 +25048,8 @@ var DeviceRecommendationSchema = object({
 	enabled: boolean(),
 	available: boolean(),
 	chosen: DeviceModelChoiceSchema.nullable(),
+	/** Present when the device is kept as is: Apply writes nothing on it. */
+	kept: KeptReasonSchema.optional(),
 	reasons: array(RecommendationReasonSchema).readonly()
 });
 var NodeRecommendationSchema = object({
@@ -23989,6 +25103,17 @@ var AutoTuneWarningSchema = discriminatedUnion("kind", [
 		kind: literal("coral-enabled"),
 		nodeId: string(),
 		deviceKey: string()
+	}),
+	object({
+		kind: literal("custom-pin-kept"),
+		nodeId: string(),
+		deviceKey: string().nullable(),
+		deviceId: number().nullable(),
+		modelId: string()
+	}),
+	object({
+		kind: literal("custom-registry-unreadable"),
+		error: string()
 	})
 ]);
 var AutoTuneOptionsSchema = object({
@@ -24167,13 +25292,14 @@ var SuggestSharesResultSchema = object({
 	nodes: array(SuggestedNodeShareSchema).readonly()
 });
 /**
-* Where the node and device shares come from (D750, D755).
-*  - `hardware` (default) — computed by the system from each node's static
-*    capacity (its accelerators at their Auto tune models, from the measured
-*    latency table), recomputed whenever a node or device joins, leaves, is
-*    switched on or off, or changes model. No load input.
-*  - `benchmark` — the same, from each node's measured capacity (node
-*    benchmark results); a node without results falls back to `hardware`.
+* Where the node and device shares come from (D750, D755, D791).
+*  - `benchmark` (default since D791) — each node's capacity as its own node
+*    benchmark measured it; a node without fresh results is sized from
+*    `hardware` and says so. Measured on the node beats the table.
+*  - `hardware` — computed from each node's static capacity only (its
+*    accelerators at their Auto tune models, from the latency table).
+*  Both are recomputed whenever a node or device joins, leaves, is switched
+*  on or off, changes model, or a benchmark result is written. No load input.
 *  - `manual` — the operator's stored sliders.
 * Either way a node or device that cannot take sessions gives its share to
 * the others in proportion; the stored values are never rewritten for that.
@@ -24222,6 +25348,362 @@ var EffectiveSharesSchema = object({
 	nodeWeights: record(string(), number()),
 	deviceWeights: record(string(), record(string(), number()))
 });
+/**
+* Wire shapes of the node benchmark (D791): the operator's plan, the
+* preflight the confirmation shows, the run the orchestrator owns, what the
+* measuring runner reports, and the result rows Auto tune and the automatic
+* shares read.
+*
+* ONE node at a time, owned by the pipeline orchestrator. While a run is
+* active the cluster is in BENCHMARK MODE for that node: it is not a
+* detection candidate, camera pins naming it are ignored so its sessions move
+* elsewhere, and both come back when the mode ends — after a crash or a hub
+* restart too (a persisted manifest, reconciled against the registry).
+*
+* Two measurements, both on the node, driven by its own runner (frames never
+* cross a process at frame rate, D9):
+*  - `device` — one accelerator × one candidate detector, root only, open
+*    loop: how many streams at the camera rate it carries inside the frame
+*    interval;
+*  - `pipeline` — the chosen detector plus the operator's detail steps
+*    (faces, plates, classifiers, CLIP…), on varied frames from the bench
+*    clip: how many parallel sessions the node carries before latency, drops,
+*    CPU, RAM or the event loop give out.
+*/
+/** Defaults and bounds, one place. */
+var NODE_BENCHMARK_DEFAULTS = {
+	fpsPerStream: 10,
+	budgetMinutes: 45,
+	minBudgetMinutes: 10,
+	maxBudgetMinutes: 120,
+	/** A result older than this no longer beats the table. */
+	staleAfterDays: 30,
+	/** Warm-in per ramp step (not accounted). */
+	settleSec: 5,
+	/** Accounted window per ramp step. */
+	measureSec: 20,
+	/** Longest the drain may take before the run is refused. */
+	drainTimeoutSec: 120,
+	/** Candidate models per device in one run. */
+	maxModelsPerDevice: 6
+};
+/** The two measurements a run can make. */
+var NodeBenchmarkPhaseSchema = _enum(["device", "pipeline"]);
+var NodeBenchmarkDevicePlanSchema = object({
+	/** `<backend>:<device>` — `openvino:npu`, `coreml:all`, `cpu`. */
+	deviceKey: string().min(1),
+	/**
+	* Root detector candidates for the `device` measurement, in the order
+	* measured. The FIRST is the one the `pipeline` measurement runs.
+	*/
+	modelIds: array(string().min(1)).min(1).max(NODE_BENCHMARK_DEFAULTS.maxModelsPerDevice)
+});
+/** What the operator confirmed. */
+var NodeBenchmarkPlanSchema = object({
+	nodeId: string().min(1),
+	devices: array(NodeBenchmarkDevicePlanSchema).min(1),
+	/** Which measurements run. At least one. */
+	phases: array(NodeBenchmarkPhaseSchema).min(1).default(["device", "pipeline"]),
+	/**
+	* Detail steps (catalog step ids under the root: faces, plates,
+	* classifiers, CLIP…) the `pipeline` measurement enables. The root
+	* detector always runs.
+	*/
+	steps: array(string().min(1)).default([]),
+	/** Offered rate of one stream / session. */
+	fpsPerStream: number().int().min(1).max(30).default(NODE_BENCHMARK_DEFAULTS.fpsPerStream),
+	/** Hard deadline: the mode ends and the cluster is restored when it passes. */
+	budgetMinutes: number().int().min(NODE_BENCHMARK_DEFAULTS.minBudgetMinutes).max(NODE_BENCHMARK_DEFAULTS.maxBudgetMinutes).default(NODE_BENCHMARK_DEFAULTS.budgetMinutes),
+	/** Keep the models the run downloaded (default: delete what was not installed before). */
+	keepDownloadedModels: boolean().default(false),
+	/** Start although the other nodes' capacity does not cover the sessions running now. */
+	acceptInsufficientHeadroom: boolean().default(false)
+});
+var NodeBenchmarkRefusalSchema = object({
+	kind: _enum([
+		"benchmark-active",
+		"node-offline",
+		"unknown-device",
+		"no-phase",
+		"insufficient-headroom"
+	]),
+	detail: string(),
+	overridable: boolean()
+});
+/** A camera whose detection leaves the node for the run. */
+var NodeBenchmarkMovingCameraSchema = object({
+	deviceId: number(),
+	/** Placed on the node now (a standing attach or a running session). */
+	placedOnNode: boolean(),
+	/** A node pin naming this node, ignored for the run. */
+	pinnedToNode: boolean()
+});
+/** A camera that cannot leave: no other node can obtain its frames. */
+var NodeBenchmarkStayingCameraSchema = object({
+	deviceId: number(),
+	reason: literal("only-frame-source")
+});
+var NodeBenchmarkPreflightSchema = object({
+	nodeId: string(),
+	online: boolean(),
+	moving: array(NodeBenchmarkMovingCameraSchema).readonly(),
+	/** Keep running on the node during the run; the result is flagged contaminated. */
+	staying: array(NodeBenchmarkStayingCameraSchema).readonly(),
+	estimatedDurationMs: number(),
+	/** The run ends and the cluster is restored at the latest after this long. */
+	budgetMs: number(),
+	phases: array(NodeBenchmarkPhaseSchema).readonly(),
+	steps: array(string()).readonly(),
+	devices: array(NodeBenchmarkDevicePlanSchema).readonly(),
+	/** Parallel sessions the cluster runs now, and what the other nodes can carry. */
+	headroom: object({
+		sessionsNow: number(),
+		otherNodesCapacitySessions: number().nullable()
+	}),
+	refusals: array(NodeBenchmarkRefusalSchema).readonly(),
+	canStart: boolean()
+});
+/** Where the measuring runner is. */
+var NodeBenchProgressSchema = object({
+	phase: _enum([
+		"preparing",
+		"device",
+		"pipeline",
+		"cleanup"
+	]),
+	deviceKey: string().nullable(),
+	modelId: string().nullable(),
+	/** Streams (device) or sessions (pipeline) of the step running now. */
+	load: number().nullable(),
+	cellsDone: number(),
+	cellsTotal: number(),
+	message: string()
+});
+/** What limited a ramp. `none` = the ramp ran out of steps still passing. */
+var NodeBenchLimitSchema = _enum([
+	"p95",
+	"drops",
+	"errors",
+	"stall",
+	"cpu",
+	"ram",
+	"none"
+]);
+var NodeBenchRampStepSchema = object({
+	load: number(),
+	pass: boolean(),
+	p95Ms: number(),
+	dropRatio: number(),
+	/** Completed frames per second over the accounted window. */
+	fps: number(),
+	cpuPct: number().nullable(),
+	ramFreePct: number().nullable(),
+	failReasons: array(string()).readonly()
+});
+var NodeBenchCellSchema = discriminatedUnion("phase", [object({
+	phase: literal("device"),
+	deviceKey: string(),
+	modelId: string(),
+	/** Single-stream latency (the K = 1 step). */
+	p50Ms: number(),
+	p95Ms: number(),
+	p99Ms: number(),
+	/** Frames per second sustained at the last passing step. */
+	fps: number(),
+	/** Streams at the camera rate the device carried inside the frame interval; 0 = not even one. */
+	kMax: number(),
+	limitedBy: NodeBenchLimitSchema,
+	/** First call (model load + warm-up). */
+	warmupMs: number(),
+	ramp: array(NodeBenchRampStepSchema).readonly()
+}), object({
+	phase: literal("pipeline"),
+	deviceKey: string(),
+	modelId: string(),
+	steps: array(string()).readonly(),
+	/** Parallel sessions at the camera rate the node carried; 0 = not even one. */
+	maxSessions: number(),
+	limitedBy: NodeBenchLimitSchema,
+	/** Detail steps that produced at least one result on the clip — a step that never fired measured nothing. */
+	stepsFired: array(string()).readonly(),
+	warmupMs: number(),
+	ramp: array(NodeBenchRampStepSchema).readonly()
+})]);
+/**
+* What a result was measured ON. A result whose fingerprint no longer matches
+* the node no longer beats the table.
+*/
+var NodeBenchFingerprintSchema = object({
+	pipelineVersion: string().nullable(),
+	cpuModel: string().nullable(),
+	ramGb: number().nullable(),
+	os: string().nullable(),
+	/** Per device: the pool the cells ran on (runtime + tuning). */
+	pools: record(string(), object({
+		runtime: string(),
+		numWorkers: number(),
+		concurrency: number(),
+		batchMode: string()
+	})).default({})
+});
+/** The frames the run used. */
+var NodeBenchClipSchema = object({
+	/** `camstack-bench-v1` or `reference-images` (the fallback when the clip is not reachable). */
+	id: string(),
+	revision: string().nullable(),
+	frames: number(),
+	width: number(),
+	height: number()
+});
+var NodeBenchRunnerInputSchema = object({
+	runId: string().min(1),
+	devices: array(NodeBenchmarkDevicePlanSchema).min(1),
+	phases: array(NodeBenchmarkPhaseSchema).min(1),
+	/** The full detail step tree root for the `pipeline` measurement is built on the node from these ids. */
+	steps: array(string()).default([]),
+	fpsPerStream: number().int().min(1).max(30),
+	/** The runner stops on its own past this instant, whatever the hub does. */
+	deadlineAtMs: number(),
+	settleSec: number().min(0).max(60).default(NODE_BENCHMARK_DEFAULTS.settleSec),
+	measureSec: number().min(2).max(300).default(NODE_BENCHMARK_DEFAULTS.measureSec),
+	keepDownloadedModels: boolean().default(false)
+});
+var NodeBenchRunnerStateSchema = _enum([
+	"running",
+	"done",
+	"failed",
+	"aborted"
+]);
+var NodeBenchRunnerStatusSchema = object({
+	runId: string(),
+	nodeId: string(),
+	state: NodeBenchRunnerStateSchema,
+	progress: NodeBenchProgressSchema.nullable(),
+	/** Every finished cell so far — a run stopped half way keeps what it measured. */
+	cells: array(NodeBenchCellSchema).readonly(),
+	fingerprint: NodeBenchFingerprintSchema.nullable(),
+	clip: NodeBenchClipSchema.nullable(),
+	/** Cameras seen running on the node during the run (they share its pools). */
+	activeCameraIds: array(number()).readonly(),
+	/** Models the run downloaded and then deleted (not installed before). */
+	deletedModels: array(string()).readonly(),
+	error: string().nullable(),
+	startedAtMs: number(),
+	finishedAtMs: number().nullable()
+});
+var NodeBenchmarkStateSchema = _enum([
+	"draining",
+	"measuring",
+	"restoring",
+	"done",
+	"failed",
+	"aborted"
+]);
+/** Why a run ended. */
+var NodeBenchmarkEndReasonSchema = _enum([
+	"completed",
+	"operator-abort",
+	"deadline",
+	"node-lost",
+	"runner-lost",
+	"hub-restart",
+	"drain-timeout",
+	"failed"
+]);
+var NodeBenchmarkRunSchema = object({
+	runId: string(),
+	nodeId: string(),
+	state: NodeBenchmarkStateSchema,
+	plan: NodeBenchmarkPlanSchema,
+	startedAtMs: number(),
+	deadlineAtMs: number(),
+	finishedAtMs: number().nullable(),
+	endReason: NodeBenchmarkEndReasonSchema.nullable(),
+	error: string().nullable(),
+	/** Cameras moved off the node for the run. */
+	moved: array(number()).readonly(),
+	/** Cameras that stayed (their only frame source is the node). */
+	staying: array(number()).readonly(),
+	/** Something else ran on the node's pools during the run. */
+	contaminated: boolean(),
+	progress: NodeBenchProgressSchema.nullable(),
+	resultIds: array(string()).readonly()
+});
+/** `getNodeBenchmarkStatus`: the active run (or the last one), and whether benchmark mode is on. */
+var NodeBenchmarkStatusSchema = object({
+	/** The node the cluster is in benchmark mode for; null = none. */
+	modeNodeId: string().nullable(),
+	run: NodeBenchmarkRunSchema.nullable()
+});
+/**
+* One stored measurement — the only authority Auto tune and the automatic
+* shares read measured capacity from. Written by the orchestrator when a run
+* ends, never by anyone else.
+*/
+var NodeBenchmarkResultSchema = object({
+	id: string(),
+	runId: string(),
+	nodeId: string(),
+	cell: NodeBenchCellSchema,
+	fpsPerStream: number(),
+	fingerprint: NodeBenchFingerprintSchema.nullable(),
+	clip: NodeBenchClipSchema.nullable(),
+	/** Other work shared the node's pools (a camera that could not move, or the hub's own duties). */
+	contaminated: boolean(),
+	stayingCameras: array(number()).readonly(),
+	/** The run ended early; the cell itself completed. */
+	partialRun: boolean(),
+	measuredAtMs: number()
+});
+var ListNodeBenchmarkResultsInputSchema = object({
+	nodeId: string().optional(),
+	deviceKey: string().optional()
+});
+/** A result with its standing today: does it still beat the table? */
+var NodeBenchmarkResultViewSchema = NodeBenchmarkResultSchema.extend({
+	/** `fresh` beats the table; `stale` falls back to it; `superseded` = a newer row covers the same cell. */
+	standing: _enum([
+		"fresh",
+		"stale",
+		"superseded"
+	]),
+	staleWhy: _enum([
+		"age",
+		"runtime",
+		"pool-tuning"
+	]).nullable()
+});
+object({
+	runId: string(),
+	nodeId: string(),
+	startedAtMs: number(),
+	deadlineAtMs: number(),
+	plan: NodeBenchmarkPlanSchema,
+	moved: array(number()).readonly(),
+	staying: array(number()).readonly()
+});
+/** Candidate detectors per device, for the plan editor. */
+var NodeBenchmarkCandidatesSchema = object({
+	nodeId: string(),
+	reachable: boolean(),
+	devices: array(object({
+		deviceKey: string(),
+		enabled: boolean(),
+		available: boolean(),
+		/** Ordered: what Auto tune would pick first, then the rest of the family by accuracy. */
+		suggested: array(string()).readonly(),
+		/** Every root detector the device has a build for. */
+		all: array(string()).readonly(),
+		/** The model the device runs now, when pinned. */
+		currentModelId: string().nullable()
+	})).readonly(),
+	/** Detail steps the node's catalog offers under the root (for the `pipeline` measurement). */
+	steps: array(object({
+		id: string(),
+		name: string(),
+		slot: string()
+	})).readonly()
+});
 object({
 	activeCameras: number(),
 	throttledCameras: number(),
@@ -25310,7 +26792,16 @@ method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mu
 }), ParkedTrackFrameSchema.nullable()), method(object({
 	deviceId: number(),
 	trackId: string()
-}), object({ released: number().int().nonnegative() }), { kind: "mutation" });
+}), object({ released: number().int().nonnegative() }), { kind: "mutation" }), method(NodeBenchRunnerInputSchema, object({
+	accepted: literal(true),
+	runId: string()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ runId: string() }), NodeBenchRunnerStatusSchema.nullable(), { auth: "admin" }), method(object({ runId: string() }), object({ aborted: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+});
 var CameraPipelineConfigSchema = object({
 	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).readonly(),
@@ -25949,6 +27440,21 @@ method(object({
 }), method(PlacementStatsInputSchema, PlacementStatsSchema, { auth: "admin" }), method(SuggestSharesInputSchema, SuggestSharesResultSchema, { auth: "admin" }), method(_void(), EffectiveSharesSchema, { auth: "admin" }), method(SetShareSourceInputSchema, object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(NodeBenchmarkPlanSchema, NodeBenchmarkPreflightSchema, { auth: "admin" }), method(NodeBenchmarkPlanSchema, discriminatedUnion("kind", [object({
+	kind: literal("started"),
+	runId: string()
+}), object({
+	kind: literal("refused"),
+	preflight: NodeBenchmarkPreflightSchema
+})]), {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), NodeBenchmarkStatusSchema, { auth: "admin" }), method(object({ runId: string() }), object({ aborted: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ nodeId: string() }), NodeBenchmarkCandidatesSchema, { auth: "admin" }), method(ListNodeBenchmarkResultsInputSchema, array(NodeBenchmarkResultViewSchema).readonly(), { auth: "admin" }), method(object({ id: string() }), object({ deleted: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ deviceId: number() }), CameraPipelineSettingsSchema.nullable()), method(object({
 	deviceId: number(),
 	addonId: string(),
@@ -31062,6 +32568,9 @@ var CreateIntegrationInputSchema = object({
 	enabled: boolean().optional(),
 	info: record(string(), unknown()).optional(),
 	settings: record(string(), unknown()).optional(),
+	/** Keys of `settings` the form's schema declares secret (by type) — kept in
+	*  the keychain, not the table (D787). */
+	secretKeys: array(string()).optional(),
 	skipRestart: boolean().optional()
 });
 var UpdateIntegrationInputSchema = object({
@@ -31085,7 +32594,9 @@ method(_void(), array(IntegrationWithStateSchema)), method(object({ id: string()
 	auth: "admin"
 }), method(object({ id: string() }), record(string(), unknown()), { auth: "admin" }), method(object({
 	id: string(),
-	settings: record(string(), unknown())
+	settings: record(string(), unknown()),
+	/** Keys the form's schema declares secret (by type) — keychain-stored (D787). */
+	secretKeys: array(string()).optional()
 }), object({ success: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -39813,6 +41324,90 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychain.delete": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychain.getState": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychain.listMeta": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychain.put": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychain.resolve": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.deleteOrphans": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.downloadRecoveryKey": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.listAudit": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.listSecrets": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.purgeRetiredKeys": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.resetKeychain": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.reveal": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.rotateMasterKey": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.status": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"lawnMowerControl.dock": {
 		capName: "lawn-mower-control",
 		capScope: "device",
@@ -41187,6 +42782,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.addRetrainFrameFromRecording": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"pipelineAnalytics.addRetrainFramesToCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.applyDeviceSettingsPatch": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -41235,12 +42842,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.createRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.deleteRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineAnalytics.deleteTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -41445,6 +43064,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRetrainAssistProfiles": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainCollectionFrames": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainCollections": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainFrames": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -41493,6 +43130,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.proposeRetrainAnnotationsWithLlm": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.pruneEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -41547,6 +43190,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.removeRetrainFrameFromCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
+	"pipelineAnalytics.renameRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.restageRetrainTrack": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -41835,6 +43490,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.abortNodeBenchmark": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.applyAutoTune": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -41859,6 +43520,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.deleteNodeBenchmarkResult": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineOrchestrator.getAgentLoad": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -41967,6 +43634,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getNodeBenchmarkCandidates": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineOrchestrator.getNodeBenchmarkPreflight": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineOrchestrator.getNodeBenchmarkStatus": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getNodeInferenceDevices": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -42009,6 +43694,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.listNodeBenchmarkResults": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.pauseForStorageMigration": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -42153,6 +43844,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.startNodeBenchmark": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.suggestShares": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -42171,6 +43868,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.abortNodeBench": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineRunner.attachCamera": {
 		capName: "pipeline-runner",
 		capScope: "system",
@@ -42219,6 +43922,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineRunner.getNodeBenchStatus": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineRunner.getParkedTrackFrame": {
 		capName: "pipeline-runner",
 		capScope: "system",
@@ -42261,6 +43970,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.startNodeBench": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"plateGallery.assignPlate": {
 		capName: "plate-gallery",
 		capScope: "system",
@@ -47190,6 +48905,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.addRetrainFrameFromRecording": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.applyDeviceSettingsPatch": [{
 		name: "deviceId",
 		form: "single",
@@ -47380,6 +49100,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.proposeRetrainAnnotationsWithLlm": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.pruneEventsBefore": [{
 		name: "deviceId",
 		form: "single",
@@ -50791,10 +52516,12 @@ var BRIGHTNESS_CONTROLLER = {
 };
 /**
 * PTZ directional toggle — one `Alexa.ToggleController` instance per
-* pan/tilt direction. Each is MOMENTARY: turning the toggle ON pulses
-* a `continuousMove({direction})` for `ptzPulseMs` then `stop`, and
-* the toggle auto-resets to OFF (handler returns the OFF state in
-* `context.properties`). Alexa renders one row per instance in the
+* pan/tilt direction. Each is MOMENTARY: turning the toggle ON moves the
+* head ~1 s through the driver's own self-terminating `ptz.move` pulses
+* (`round(TARGET_TRAVEL_MS / getOptions().moveImpulseMs)` of them, one
+* when the impulse is unknown — see `handlers/ptz-travel.ts`; never
+* `continuousMove` / `stop`), and the toggle auto-resets to OFF (handler
+* returns the OFF state in `context.properties`). Alexa renders one row per instance in the
 * device detail; users can also say "Alexa, turn on Salone Pan Left".
 *
 * Instance ids match the directive routing in `ptz-direction.ts`.
@@ -52163,8 +53890,10 @@ var DetectionTracker = class {
 * (R4, D779).
 *
 *  - `objectIdentifier`: "a UUID identifying a specific physical object" — one
-*    per pipeline track. A UUIDv5 of `<deviceId>:<trackId>` under this hub's
-*    namespace, so it is stable for the track's life and across restarts.
+*    per pipeline track. Amazon types it "Version 4 UUID String", so it is
+*    v4-shaped like the event id: a hash of `object|<deviceId>:<trackId>` under
+*    this hub's namespace, stable for the track's life and across restarts.
+*    (The first build sent a UUIDv5 here — D779 amendment.)
 *  - `eventIdentifier`: Amazon requires a version-4 UUID per event in the
 *    history. This skill posts ONE event per track, so the event id is derived
 *    from the track too — a v4-shaped UUID whose 122 "random" bits are a
@@ -52191,10 +53920,6 @@ function stamp$1(bytes, version) {
 	out[8] = (out[8] ?? 0) & 63 | 128;
 	return out;
 }
-/** RFC 4122 UUIDv5 (SHA-1, name-based). */
-function uuidV5(namespace, name) {
-	return formatUuid(stamp$1(createHash("sha1").update(uuidBytes(namespace)).update(Buffer.from(name, "utf8")).digest(), 5));
-}
 /** A version-4-formatted UUID whose bits are a hash — see the file header. */
 function hashedUuidV4(namespace, name) {
 	return formatUuid(stamp$1(createHash("sha256").update(uuidBytes(namespace)).update(name, "utf8").digest(), 4));
@@ -52203,7 +53928,7 @@ function trackName(deviceId, trackId) {
 	return `${deviceId}:${trackId}`;
 }
 function objectIdentifierFor(namespace, deviceId, trackId) {
-	return uuidV5(namespace, trackName(deviceId, trackId));
+	return hashedUuidV4(namespace, `object|${trackName(deviceId, trackId)}`);
 }
 /** One event per track AND class: a track re-classified person → package is a
 *  second event about the same object. */
@@ -52702,18 +54427,80 @@ async function handlePower(header, endpointRaw, deps, _callerIdentity) {
 	};
 }
 //#endregion
-//#region src/handlers/ptz-direction.ts
+//#region src/handlers/ptz-travel.ts
+/**
+* One Alexa PTZ voice command = ~1 s of head travel, built ONLY from the PTZ
+* cap's `ptz.move`.
+*
+* `move` is a self-terminating burst: the driver runs it for the pulse it
+* calibrated and stops the head itself, and reports that pulse as
+* `getOptions().moveImpulseMs` (ptz.cap.ts) — 200 reolink, 350 amcrest,
+* 500 hikvision, 1000 onvif. One pulse is too short a nudge for a voice
+* command, so the travel issues `round(TARGET_TRAVEL_MS / moveImpulseMs)` of
+* them back to back. There is no `continuousMove` / timer / `stop` here:
+* ONVIF does not implement `continuousMove`, and `move` needs no stop.
+*
+* Drivers differ in WHEN `move` resolves: hikvision awaits its own pulse,
+* reolink / amcrest / onvif return as soon as the burst has started. Each pulse
+* is awaited, then the remainder of its impulse is waited out, so both kinds
+* yield consecutive pulses rather than overlapping ones (which a driver would
+* collapse into one). An unknown impulse is a single `move`.
+*/
+/** How far a voice command moves the head, in driver-pulse milliseconds. */
+var TARGET_TRAVEL_MS = 1e3;
+var realClock = {
+	now: () => Date.now(),
+	sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+};
+/** `max(1, round(TARGET_TRAVEL_MS / moveImpulseMs))`; unknown impulse → 1. */
+function ptzTravelPulses(moveImpulseMs) {
+	if (moveImpulseMs === null || !(moveImpulseMs > 0)) return 1;
+	return Math.max(1, Math.round(TARGET_TRAVEL_MS / moveImpulseMs));
+}
+/** `getOptions().moveImpulseMs`, or `null` when unreported or unreadable. */
+async function readImpulse(ptz, deviceId) {
+	try {
+		const ms = (await ptz.getOptions.query({ deviceId })).moveImpulseMs;
+		return typeof ms === "number" && ms > 0 ? ms : null;
+	} catch {
+		return null;
+	}
+}
 /**
-* `Alexa.ToggleController/{TurnOn,TurnOff}` handler — restricted to PTZ
-* directional instances (`ptz.panLeft` / `ptz.panRight` / `ptz.tiltUp`
-* / `ptz.tiltDown`). Mirrors the HAP momentary-switch pattern: every
-* `TurnOn` pulses a `continuousMove({pan|tilt: ±1})` and schedules a
-* `stop` after `ptzPulseMs`. The handler returns immediately with
-* `toggleState=OFF` so Alexa reflects the momentary nature in its UI.
-*
-* `TurnOff` is a no-op (success response) — Alexa never delivers it in
-* normal momentary usage, but accept it for resilience.
+* Runs the travel. REJECTS when the first `move` fails (nothing moved, the
+* caller answers with an error); a later failure stops the travel and is
+* returned in `error`, since the head has already moved.
 */
+async function runPtzTravel(ptz, deviceId, direction, clock = realClock) {
+	const impulse = await readImpulse(ptz, deviceId);
+	const pulses = ptzTravelPulses(impulse);
+	for (let i = 0; i < pulses; i++) {
+		const startedAt = clock.now();
+		try {
+			await ptz.move.mutate({
+				deviceId,
+				...direction
+			});
+		} catch (err) {
+			if (i === 0) throw err;
+			return {
+				pulses,
+				issued: i,
+				error: err instanceof Error ? err : new Error(String(err))
+			};
+		}
+		if (!(i === pulses - 1) && impulse !== null) {
+			const remaining = impulse - (clock.now() - startedAt);
+			if (remaining > 0) await clock.sleep(remaining);
+		}
+	}
+	return {
+		pulses,
+		issued: pulses
+	};
+}
+//#endregion
+//#region src/handlers/ptz-direction.ts
 var ToggleDirectiveSchema = object({
 	header: object({
 		namespace: literal("Alexa.ToggleController"),
@@ -52747,27 +54534,24 @@ async function handlePtzDirection(header, endpointRaw, deps, _callerIdentity) {
 	const move = INSTANCE_TO_MOVE[instance];
 	if (!move) return errorEnvelope(header, "INVALID_DIRECTIVE", `ToggleController instance not supported: ${instance}`);
 	const api = deps.ctx.api;
+	const deviceId = parsedId.deviceId;
 	try {
-		await api.ptz.continuousMove.mutate({
-			deviceId: parsedId.deviceId,
-			...move
-		});
-		setTimeout(() => {
-			api.ptz.stop.mutate({ deviceId: parsedId.deviceId }).catch((err) => {
-				deps.logger.debug("alexa ptz-direction: stop after pulse failed (non-fatal)", { meta: {
-					deviceId: parsedId.deviceId,
-					instance,
-					error: err instanceof Error ? err.message : String(err)
-				} });
-			});
-		}, deps.ptzPulseMs);
+		const travel = await runPtzTravel(api.ptz, deviceId, move);
+		if (travel.error) deps.logger.warn("alexa ptz-direction: ptz.move failed mid-travel", { meta: {
+			deviceId,
+			instance,
+			issued: travel.issued,
+			pulses: travel.pulses,
+			error: travel.error.message
+		} });
 	} catch (err) {
-		deps.logger.warn("alexa ptz-direction: continuousMove failed", { meta: {
-			deviceId: parsedId.deviceId,
+		const message = err instanceof Error ? err.message : String(err);
+		deps.logger.warn("alexa ptz-direction: ptz.move failed", { meta: {
+			deviceId,
 			instance,
-			error: err instanceof Error ? err.message : String(err)
+			error: message
 		} });
-		return errorEnvelope(header, "INTERNAL_ERROR", `ptz.continuousMove failed: ${err instanceof Error ? err.message : String(err)}`);
+		return errorEnvelope(header, "INTERNAL_ERROR", `ptz.move failed: ${message}`);
 	}
 	return successResponse(header, endpointId, "OFF", instance);
 }
@@ -52796,18 +54580,6 @@ function successResponse(header, endpointId, toggleState, instance) {
 }
 //#endregion
 //#region src/handlers/ptz-preset.ts
-/**
-* `Alexa.ModeController/SetMode` handler — dispatches three PTZ instances:
-*
-*   `ptz.preset` — preset-recall. Decodes the preset name from the mode
-*     value and calls `ptz.goToPreset({deviceId, presetId})`.
-*
-*   `ptz.pan`  — momentary pan. `ptz.pan.left|right|center` issues a
-*     continuousMove pulse stopped on a timer; the dropdown reverts to
-*     `center` server-side so subsequent picks re-trigger the move.
-*
-*   `ptz.tilt` — momentary tilt. Mirrors ptz.pan with up|down|center.
-*/
 var SetModeDirectiveSchema = object({
 	header: object({
 		namespace: literal("Alexa.ModeController"),
@@ -52818,7 +54590,6 @@ var SetModeDirectiveSchema = object({
 	payload: SetModePayloadSchema
 });
 var PTZ_PRESET_MODE_PREFIX = "ptz.preset.";
-var PTZ_DIRECTION_PULSE_MS = 1e3;
 var PTZ_PAN_MOVES = {
 	"ptz.pan.left": { pan: -1 },
 	"ptz.pan.right": { pan: 1 },
@@ -52850,29 +54621,28 @@ async function handleSetMode(header, endpointRaw, payloadRaw, deps, _callerIdent
 	if (instance === "ptz.pan" || instance === "ptz.tilt") {
 		const move = (instance === "ptz.pan" ? PTZ_PAN_MOVES : PTZ_TILT_MOVES)[mode];
 		if (!move) return errorEnvelope(header, "INVALID_DIRECTIVE", `mode '${mode}' is not a valid ${instance} mode`);
-		if (Object.keys(move).length === 0) await api.ptz.stop.mutate({ deviceId: parsedId.deviceId }).catch((err) => {
-			deps.logger.debug("alexa ptz-mode: stop (center) failed (non-fatal)", { meta: {
-				deviceId: parsedId.deviceId,
-				instance,
-				error: err instanceof Error ? err.message : String(err)
-			} });
-		});
-		else try {
-			await api.ptz.continuousMove.mutate({
-				deviceId: parsedId.deviceId,
-				...move
-			});
-			setTimeout(() => {
-				api.ptz.stop.mutate({ deviceId: parsedId.deviceId }).catch((err) => {
-					deps.logger.debug("alexa ptz-mode: stop after pulse failed (non-fatal)", { meta: {
-						deviceId: parsedId.deviceId,
-						instance,
-						error: err instanceof Error ? err.message : String(err)
-					} });
-				});
-			}, PTZ_DIRECTION_PULSE_MS);
-		} catch (err) {
-			return errorEnvelope(header, "INTERNAL_ERROR", `ptz.continuousMove failed: ${err instanceof Error ? err.message : String(err)}`);
+		if (Object.keys(move).length > 0) {
+			const deviceId = parsedId.deviceId;
+			try {
+				const travel = await runPtzTravel(api.ptz, deviceId, move);
+				if (travel.error) deps.logger.warn("alexa ptz-mode: ptz.move failed mid-travel", { meta: {
+					deviceId,
+					instance,
+					mode,
+					issued: travel.issued,
+					pulses: travel.pulses,
+					error: travel.error.message
+				} });
+			} catch (err) {
+				const message = err instanceof Error ? err.message : String(err);
+				deps.logger.warn("alexa ptz-mode: ptz.move failed", { meta: {
+					deviceId,
+					instance,
+					mode,
+					error: message
+				} });
+				return errorEnvelope(header, "INTERNAL_ERROR", `ptz.move failed: ${message}`);
+			}
 		}
 		return modeSuccessResponse(header, endpointId, instance, instance === "ptz.pan" ? "ptz.pan.center" : "ptz.tilt.center");
 	}
@@ -53174,6 +54944,7 @@ async function handleReportState(header, endpointRaw, deps, _callerIdentity) {
 			});
 		}
 	} catch (err) {
+		if (err instanceof ChildUnreachableError) return errorEnvelope(header, "ENDPOINT_UNREACHABLE", err.message);
 		deps.logger.warn("alexa report-state: collection failed", { meta: {
 			endpointId,
 			error: err instanceof Error ? err.message : String(err)
@@ -53321,16 +55092,35 @@ async function collectAutotrackProperties(api, parentDeviceId, properties, timeO
 		uncertaintyInMilliseconds: 0
 	});
 }
+/** The child's `switch` cannot be read: answered `ENDPOINT_UNREACHABLE`. */
+var ChildUnreachableError = class extends Error {};
+/** One warning per child per window (a sleeping battery camera's accessories
+*  are polled by Alexa for as long as it sleeps). */
+var CHILD_WARN_EVERY_MS = 10 * 6e4;
+var childWarnedAt = /* @__PURE__ */ new Map();
+function warnChildUnreadable(logger, childDeviceId, error) {
+	const now = Date.now();
+	const last = childWarnedAt.get(childDeviceId);
+	if (last !== void 0 && now - last < CHILD_WARN_EVERY_MS) return;
+	childWarnedAt.set(childDeviceId, now);
+	logger.warn("alexa report-state: child accessory switch unreadable — answered ENDPOINT_UNREACHABLE", { meta: {
+		childDeviceId,
+		error,
+		repeatsSuppressedForMs: CHILD_WARN_EVERY_MS
+	} });
+}
 async function collectChildProperties(api, childDeviceId, properties, timeOfSample, logger) {
+	let failure = null;
 	const switchState = await api.switch.getStatus.query({ deviceId: childDeviceId }).catch((err) => {
-		logger.warn("alexa report-state: switch.getStatus FAILED — Alexa will show endpoint as \"unavailable\"", { meta: {
-			childDeviceId,
-			error: err instanceof Error ? err.message : String(err)
-		} });
+		failure = err instanceof Error ? err.message : String(err);
 		return null;
 	});
-	if (switchState === null || switchState === void 0) logger.warn("alexa report-state: switch.getStatus returned no payload — surfacing as unavailable", { meta: { childDeviceId } });
-	else logger.info("alexa report-state: switch.getStatus payload", { meta: {
+	if (switchState === null || switchState === void 0) {
+		warnChildUnreadable(logger, childDeviceId, failure ?? "no payload");
+		throw new ChildUnreachableError(`accessory ${childDeviceId} cannot be read right now`);
+	}
+	childWarnedAt.delete(childDeviceId);
+	logger.debug("alexa report-state: switch.getStatus payload", { meta: {
 		childDeviceId,
 		payload: switchState
 	} });
@@ -54151,44 +55941,84 @@ function refuse(reply, status, error) {
 	reply.code(status).type("application/json").header("cache-control", "no-store").header("content-encoding", "identity");
 	reply.send({ error });
 }
+function headerOf(headers, name) {
+	for (const [key, value] of Object.entries(headers)) if (key.toLowerCase() === name) return value;
+}
+/**
+* Exactly one line per fetch, whatever the answer (D779 amendment): "did Amazon ever
+* fetch the image, and what did it get?" is otherwise unanswerable — a served
+* image used to log nothing. Never the signature, never the token.
+*/
+function logFetch(deps, req, started, outcome) {
+	const level = outcome.status === 401 || outcome.status === 403 ? "warn" : "info";
+	deps.logger[level]("alexa snapshot: fetch answered", {
+		...outcome.deviceId !== void 0 ? { tags: { deviceId: outcome.deviceId } } : {},
+		meta: {
+			status: outcome.status,
+			...outcome.imageId !== void 0 ? { imageId: outcome.imageId } : {},
+			...outcome.reason !== void 0 ? { reason: outcome.reason } : {},
+			...outcome.lazy !== void 0 ? { lazy: outcome.lazy } : {},
+			...outcome.bytes !== void 0 ? { bytes: outcome.bytes } : {},
+			tookMs: Date.now() - started,
+			userAgent: headerOf(req.headers, "user-agent") ?? null,
+			...outcome.extra
+		}
+	});
+}
 async function handleSnapshotFetch(req, reply, deps) {
+	const started = Date.now();
 	if (!deps.enabled()) {
+		logFetch(deps, req, started, {
+			status: 410,
+			reason: "switched-off"
+		});
 		refuse(reply, 410, "snapshots are switched off");
 		return;
 	}
 	const imageId = IMAGE_FILE.exec(req.params["file"] ?? "")?.[1];
 	if (imageId === void 0) {
+		logFetch(deps, req, started, {
+			status: 410,
+			reason: "not-a-snapshot-address"
+		});
 		refuse(reply, 410, "not a snapshot address");
 		return;
 	}
 	const found = deps.store.lookup(imageId, req.query["exp"], req.query["sig"]);
 	if (found.kind === "gone") {
-		deps.logger.debug("alexa snapshot: fetch of a gone image", { meta: {
+		logFetch(deps, req, started, {
+			status: 410,
 			imageId,
 			reason: found.reason
-		} });
+		});
 		refuse(reply, 410, found.reason);
 		return;
 	}
 	const image = found.image;
+	const lazy = image.load !== void 0 || image.bytes.byteLength === 0;
+	const base = {
+		imageId,
+		deviceId: image.deviceId,
+		lazy
+	};
 	const token = bearerOf(req.headers);
 	const verified = token === null ? null : await deps.verifyToken(token).catch(() => null);
 	if (verified === null) {
-		deps.logger.warn("alexa snapshot: refused a fetch without a valid account-link token", {
-			tags: { deviceId: image.deviceId },
-			meta: {
-				imageId,
-				hadToken: token !== null
-			}
+		logFetch(deps, req, started, {
+			...base,
+			status: 401,
+			reason: "no valid account-link token",
+			extra: { hadToken: token !== null }
 		});
 		refuse(reply, 401, "a valid Alexa account-link token is required");
 		return;
 	}
 	if (verified.userId !== image.userId || !await deps.mayView(verified.userId, image.deviceId)) {
-		deps.logger.warn("alexa snapshot: refused — the token does not belong to the user this image was made for, or that user lost the camera", {
-			tags: { deviceId: image.deviceId },
-			meta: {
-				imageId,
+		logFetch(deps, req, started, {
+			...base,
+			status: 403,
+			reason: "token of another user, or the user lost the camera",
+			extra: {
 				tokenUser: verified.userId,
 				imageUser: image.userId
 			}
@@ -54198,13 +56028,19 @@ async function handleSnapshotFetch(req, reply, deps) {
 	}
 	const bytes = await deps.store.bytesOf(image);
 	if (bytes === null || bytes.byteLength === 0) {
-		deps.logger.debug("alexa snapshot: no image to serve for this event", {
-			tags: { deviceId: image.deviceId },
-			meta: { imageId }
+		logFetch(deps, req, started, {
+			...base,
+			status: 410,
+			reason: "no image for this event"
 		});
 		refuse(reply, 410, "no image is available for this event");
 		return;
 	}
+	logFetch(deps, req, started, {
+		...base,
+		status: 200,
+		bytes: bytes.byteLength
+	});
 	reply.code(200).type(image.contentType).header("cache-control", "private, no-store").header("content-encoding", "identity").header("content-length", String(bytes.byteLength));
 	reply.send(bytes);
 }
@@ -54687,6 +56523,8 @@ var LwaEventGateway = class {
 	/** Per-endpoint count of `ObjectDetection` events dropped because the
 	*  endpoint does not declare {@link SMART_VISION_INTERFACE}. */
 	smartVisionDropped = /* @__PURE__ */ new Map();
+	/** Endpoints whose redacted ObjectDetection body was logged (D779 amendment). */
+	smartVisionSampled = /* @__PURE__ */ new Set();
 	/** Latches the "no grant at all" warning so it's logged ONCE, not on every
 	*  doorbell/motion event while no account has a push grant. */
 	warnedNoGrant = false;
@@ -54739,6 +56577,7 @@ var LwaEventGateway = class {
 		this.lastSentAt.clear();
 		this.motionHold.clear();
 		this.smartVisionDropped.clear();
+		this.smartVisionSampled.clear();
 		this.warnedNoToken.clear();
 		this.warnedLegacyWaiting.clear();
 		this.migrationRetryAt.clear();
@@ -54943,6 +56782,24 @@ var LwaEventGateway = class {
 		for (const account of linked) {
 			if (!this.mayPush(account.userId, opts.deviceId, "object detection")) continue;
 			const images = opts.imagesFor?.(account.userId) ?? {};
+			if (!this.smartVisionSampled.has(endpointId)) {
+				this.smartVisionSampled.add(endpointId);
+				this.deps.logger.info("alexa lwa-gateway: ObjectDetection body sample (redacted)", {
+					tags: { deviceId: opts.deviceId },
+					meta: { body: redactedObjectDetectionSample({
+						userId: account.userId,
+						endpointId,
+						detections: [{
+							eventIdentifier: d.eventIdentifier,
+							imageNetClass: d.imageNetClass,
+							objectIdentifier: d.objectIdentifier,
+							...images
+						}],
+						timestamp: d.timestamp,
+						accessToken: ""
+					}) }
+				});
+			}
 			await this.postEventBody(account.userId, endpointId, (accessToken) => buildSmartVisionObjectDetectionEvent({
 				userId: account.userId,
 				endpointId,
@@ -55493,6 +57350,29 @@ function buildSmartVisionObjectDetectionEvent(opts) {
 		})) }
 	} };
 }
+/** Every `sig=` query value in a URI, for a log line. */
+function redactSignature(uri) {
+	return uri?.replace(/([?&]sig=)[^&]*/g, "$1<redacted>");
+}
+/**
+* The ObjectDetection body exactly as built for the wire, minus its secrets
+* (D779 amendment): the scope token and every image URI's signature. Logged once per
+* endpoint per process so the shape can be compared with Amazon's example.
+*/
+function redactedObjectDetectionSample(opts) {
+	const body = buildSmartVisionObjectDetectionEvent({
+		...opts,
+		accessToken: "<redacted>"
+	});
+	return { event: {
+		...body.event,
+		payload: { events: body.event.payload.events.map((e) => ({
+			...e,
+			...e.frameImageUri !== void 0 ? { frameImageUri: redactSignature(e.frameImageUri) } : {},
+			...e.croppedImageUri !== void 0 ? { croppedImageUri: redactSignature(e.croppedImageUri) } : {}
+		})) }
+	} };
+}
 function buildAddOrUpdateReportPayload(_userId, endpoints, accessToken) {
 	return { event: {
 		header: {
@@ -55565,6 +57445,11 @@ async function removeEndpointsFromAlexa(deps) {
 //#endregion
 //#region src/settings-schema.ts
 var ADDON_ID = "export-alexa";
+/** The rows that exist only for a custom skill. */
+var CUSTOM_SKILL_ONLY = {
+	field: "skillMode",
+	equals: "custom"
+};
 var CONNECTION_DESCRIPTION = [
 	"Public skill (default): enable the \"CamStack\" skill in the Alexa app and link your account. No Amazon developer setup is needed.",
 	"Custom skill: enter your skill id and deploy the skill Lambda from this addon's lambda-template in your own AWS account.",
@@ -55614,13 +57499,14 @@ function connectionSection(input) {
 				],
 				default: defaults.region
 			},
-			...input.skillMode === "custom" ? [{
+			{
 				type: "text",
 				key: "expectedAudience",
 				label: "Alexa skill id",
 				description: "Your skill's id, format amzn1.ask.skill.xxxx, from the Alexa developer console. Directives for any other skill are refused.",
-				default: defaults.expectedAudience
-			}] : [],
+				default: defaults.expectedAudience,
+				showWhen: CUSTOM_SKILL_ONLY
+			},
 			{
 				type: "addon-action-select",
 				key: "publicHubUrl",
@@ -55763,6 +57649,7 @@ function customSkillSecuritySection(input) {
 				key: "__ingress-token-info",
 				label: "Ingress token",
 				variant: "info",
+				showWhen: CUSTOM_SKILL_ONLY,
 				content: "An optional shared secret your skill Lambda sends on every call to this hub. Show it, put it in the Lambda's HUB_INGRESS_TOKEN environment variable, then turn on \"Require ingress token\". After a rotation, update the Lambda."
 			},
 			{
@@ -55774,7 +57661,8 @@ function customSkillSecuritySection(input) {
 				buttonLabel: "Show ingress token",
 				action: "revealIngressToken",
 				variant: "default",
-				successMessage: "Ingress token: {ingressToken}"
+				successMessage: "Ingress token: {ingressToken}",
+				showWhen: CUSTOM_SKILL_ONLY
 			},
 			{
 				type: "addon-action-button",
@@ -55786,14 +57674,16 @@ function customSkillSecuritySection(input) {
 				action: "regenerateIngressToken",
 				variant: "default",
 				successMessage: "New ingress token: {ingressToken} — put it in HUB_INGRESS_TOKEN now.",
-				confirmMessage: "Rotate the ingress token? With \"Require ingress token\" on, the Lambda is refused until you update HUB_INGRESS_TOKEN."
+				confirmMessage: "Rotate the ingress token? With \"Require ingress token\" on, the Lambda is refused until you update HUB_INGRESS_TOKEN.",
+				showWhen: CUSTOM_SKILL_ONLY
 			},
 			{
 				type: "boolean",
 				key: "enforceIngressToken",
 				label: "Require ingress token",
 				description: "When on, this hub refuses skill calls without the matching token. Turn it on only after HUB_INGRESS_TOKEN is set in your Lambda.",
-				default: input.defaults.enforceIngressToken
+				default: input.defaults.enforceIngressToken,
+				showWhen: CUSTOM_SKILL_ONLY
 			}
 		]
 	};
@@ -55804,7 +57694,7 @@ function buildAlexaSettingsSections(input) {
 		featuresSection(input),
 		accountLinkSection(input),
 		troubleshootingSection(),
-		...input.skillMode === "custom" ? [customSkillSecuritySection(input)] : []
+		customSkillSecuritySection(input)
 	];
 }
 //#endregion
@@ -56184,6 +58074,8 @@ function sensorSelectionField(input) {
 		immediate: true
 	};
 }
+/** Minimum spacing of two events of one class on one camera (D779 amendment). */
+var CAMERA_EVENT_MIN_INTERVAL_MS = 3e4;
 /** Bound on the per-track bookkeeping should `end` events be lost (D8). */
 var MAX_TRACKED = 5e3;
 var TrackLifecycleSchema = object({
@@ -56206,6 +58098,9 @@ var ObjectDetectionFeed = class {
 	handled = /* @__PURE__ */ new Map();
 	/** objectIdentifier → last event time. */
 	lastPosted = /* @__PURE__ */ new Map();
+	/** `${deviceId}|${class}` → last event time, and tracks held back since. */
+	lastCameraPost = /* @__PURE__ */ new Map();
+	heldBack = /* @__PURE__ */ new Map();
 	off = null;
 	constructor(deps) {
 		this.deps = deps;
@@ -56230,6 +58125,8 @@ var ObjectDetectionFeed = class {
 		this.off = null;
 		this.handled.clear();
 		this.lastPosted.clear();
+		this.lastCameraPost.clear();
+		this.heldBack.clear();
 	}
 	/** Per-track entries currently held (tests, diagnostics). */
 	trackedCount() {
@@ -56250,6 +58147,12 @@ var ObjectDetectionFeed = class {
 		const objectIdentifier = objectIdentifierFor(namespace, event.deviceId, event.trackId);
 		const last = this.lastPosted.get(objectIdentifier);
 		if (last !== void 0 && now - last < 3e4) return;
+		const cameraKey = `${event.deviceId}|${cls}`;
+		const lastOnCamera = this.lastCameraPost.get(cameraKey);
+		if (lastOnCamera !== void 0 && now - lastOnCamera < 3e4) {
+			if (event.phase === "start") this.heldBack.set(cameraKey, (this.heldBack.get(cameraKey) ?? 0) + 1);
+			return;
+		}
 		this.mark(key, now);
 		if (!(await this.deps.reportableClasses(event.deviceId)).includes(cls)) return;
 		const detection = {
@@ -56260,7 +58163,20 @@ var ObjectDetectionFeed = class {
 			timestamp: now
 		};
 		this.lastPosted.set(objectIdentifier, now);
+		this.lastCameraPost.set(cameraKey, now);
 		this.pruneLastPosted(now);
+		const held = this.heldBack.get(cameraKey) ?? 0;
+		if (held > 0) {
+			this.heldBack.delete(cameraKey);
+			this.deps.logger.info("alexa object detection: tracks held back by the per-camera window", {
+				tags: { deviceId: event.deviceId },
+				meta: {
+					imageNetClass: cls,
+					heldBack: held,
+					windowMs: CAMERA_EVENT_MIN_INTERVAL_MS
+				}
+			});
+		}
 		await this.deps.remember(event.deviceId, {
 			e: detection.eventIdentifier,
 			t: event.trackId,
@@ -56679,7 +58595,15 @@ function verifyExpiringUrl(input) {
 */
 /** How long a minted image URL is valid — Amazon recommends ten minutes. */
 var SNAPSHOT_URL_TTL_MS = 10 * 6e4;
+/** Bound on entries holding pixels (GetSnapshot images, loaded lazy ones). */
 var MAX_IMAGES = 128;
+/**
+* Bound on lazy entries not yet fetched (D779 amendment). They hold no pixels — a closure
+* over (device, track) — so the bound only guards against a runaway. It must
+* cover ten minutes of events: at the measured ~15 events/min, two URIs each,
+* the shared 128 bound evicted a URI ~4 min after Alexa was handed it.
+*/
+var MAX_LAZY_IMAGES = 4096;
 var MAX_TOTAL_BYTES = 24 * 1024 * 1024;
 var SnapshotStore = class {
 	secret;
@@ -56809,9 +58733,18 @@ var SnapshotStore = class {
 		for (const [id, image] of this.images) if (image.expiresAt <= now) this.drop(id, image);
 	}
 	evictOverBounds() {
+		let lazy = 0;
+		for (const image of this.images.values()) if (image.load !== void 0) lazy += 1;
+		let loaded = this.images.size - lazy;
 		for (const [id, image] of this.images) {
-			if (this.images.size <= MAX_IMAGES && this.totalBytes <= MAX_TOTAL_BYTES) return;
+			const overLoaded = loaded > MAX_IMAGES || this.totalBytes > MAX_TOTAL_BYTES;
+			const overLazy = lazy > MAX_LAZY_IMAGES;
+			if (!overLoaded && !overLazy) return;
+			const isLazy = image.load !== void 0;
+			if (isLazy ? !overLazy : !overLoaded) continue;
 			this.drop(id, image);
+			if (isLazy) lazy -= 1;
+			else loaded -= 1;
 		}
 	}
 	drop(id, image) {
@@ -57541,6 +59474,14 @@ var SUPPORTED_KINDS = [
 	DeviceType.Generic
 ];
 var ExportAlexaAddon = class extends BaseAddon {
+	/** Hidden state that is a credential — kept in the keychain, never the blob (D787). */
+	secretStatePaths = [
+		"ingressToken",
+		"snapshotSigningKey",
+		"tokens[userId].accessToken",
+		"tokens[userId].refreshToken",
+		"tokens[userId].brokerCredential"
+	];
 	lwaGateway = null;
 	syncEngine = null;
 	/** S1 (D767): the linking user's live grants. Built in `onInitialize`, the
@@ -57568,7 +59509,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 		if (!this.config.snapshotSigningKey) await this.updateGlobalSettings({ snapshotSigningKey: generateIngressToken() });
 		if (!this.config.visionNamespace) await this.updateGlobalSettings({ visionNamespace: randomUUID() });
 		if (this.config.lwaClientSecret) {
-			await this.updateGlobalSettings({ lwaClientSecret: "" });
+			await this.clearSecrets(["lwaClientSecret"]);
 			this.ctx.logger.warn("export-alexa: removed a stored LWA client secret — the hub no longer uses one; your skill Lambda holds it (D753)");
 		}
 		await this.backfillLinkedAccounts();
@@ -57643,8 +59584,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 				},
 				ptzDirection: {
 					ctx: this.ctx,
-					logger: this.ctx.logger,
-					ptzPulseMs: 1e3
+					logger: this.ctx.logger
 				},
 				powerController: {
 					ctx: this.ctx,
@@ -58396,7 +60336,6 @@ var ExportAlexaAddon = class extends BaseAddon {
 	*  linking rows live in the `device-export` setup block instead. */
 	globalSettingsSchema() {
 		return { sections: buildAlexaSettingsSections({
-			skillMode: this.config.skillMode,
 			linkedAccounts: this.config.linkedAccounts,
 			tokens: this.config.tokens,
 			now: Date.now(),