@camstack/system 1.2.375 → 1.2.377

package/dist/{dist-ZdSg09GJ.mjs → dist-BWNoS-1S.mjs}

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import "node:crypto";
-//#region ../types/dist/event-category-B_0XEcLF.mjs
+//#region ../types/dist/event-category-DaIZi00R.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -79,6 +79,13 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AddonLoadFailed"] = "addon.load-failed";
 	/**
+	* A keychain value was stored or removed (D787). Carries the ref, its
+	* owner and the new version — NEVER the value. A process holding the ref
+	* drops its cached copy and the owning `BaseAddon` re-resolves its config.
+	* Telemetry (D8): a process that misses it still revalidates by version.
+	*/
+	EventCategory["KeychainChanged"] = "keychain.changed";
+	/**
 	* Addon recovered from a previous failure. Emitted when an addon
 	* transitions from `failed` back to `healthy` (typically via the
 	* monitor's auto-retry loop, or after manual `addons.retryLoad`).
@@ -701,7 +708,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-BNeXenvr.mjs
+//#region ../types/dist/sleep-Cr5YOk3m.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -780,6 +787,144 @@ function buildAlawTable() {
 }
 buildUlawTable();
 buildAlawTable();
+/**
+* The value a redacted secret is replaced with on every read surface.
+*
+* It is also the WRITE-BACK token: an `upsertLocation` that sends this value
+* back for a key means "keep what is stored", which is what lets an operator
+* rename a location without retyping its password. A literal an operator could
+* plausibly choose as a real password would turn that convenience into a way
+* to lock yourself out, hence the sentinel shape.
+*/
+var REDACTED_SECRET = "__camstack_redacted__";
+/** Is this field's stored value a credential? */
+function isSecretConfigField(field) {
+	if (field.type === "password") return true;
+	return "secret" in field && field.secret === true;
+}
+/**
+* Is this field's value stored in the KEYCHAIN (D787)? Every secret field is,
+* by its TYPE, unless it opts out with `storage: 'inline'` — never by its name.
+*/
+function isKeychainStoredField(field) {
+	if (!isSecretConfigField(field)) return false;
+	if (field.type === "textarea" && field.isJson === true) return false;
+	return !("storage" in field && field.storage === "inline");
+}
+/**
+* Every config key in `schema` whose value is a secret, including keys nested
+* inside `group` / `sub-tabs` containers.
+*/
+function collectSecretConfigKeys(schema) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
+	return keys;
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sectionsOf(schema) {
+	if (!isRecord$2(schema)) return [];
+	const sections = schema["sections"];
+	return Array.isArray(sections) ? sections : [];
+}
+function fieldsOf(node) {
+	if (!isRecord$2(node)) return [];
+	const fields = node["fields"];
+	return Array.isArray(fields) ? fields : [];
+}
+function walkField(field, out) {
+	if (!isRecord$2(field)) return;
+	const type = field["type"];
+	const key = field["key"];
+	if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
+	if (type === "group") {
+		for (const child of fieldsOf(field)) walkField(child, out);
+		return;
+	}
+	if (type === "sub-tabs") {
+		const tabs = field["tabs"];
+		if (!Array.isArray(tabs)) return;
+		for (const tab of tabs) for (const child of fieldsOf(tab)) walkField(child, out);
+	}
+}
+/**
+* What a settings blob holds where a secret used to be.
+*
+* A keychain-stored field never holds its value. It holds a self-describing
+* MARKER, `{"$secret":"secret://…","v":1}` — an object, never a string, so no
+* code can mistake it for a credential and no form can send it to a camera as
+* a password. The empty state is `null` / absent, never `''`.
+*
+* The same shapes travel to and from the admin UI:
+*
+*  - read: `hydrateSchema` hands a secret field a {@link SecretFieldView}
+*    (`{ $secret, v, set: true }`) or `null` — the browser learns whether a
+*    value is set, never the value.
+*  - write: an untouched field submits the view back unchanged (KEEP); a typed
+*    value is a plain non-empty string (CHANGE); the Clear button submits
+*    {@link SECRET_CLEAR} (CLEAR). `''`, `null` and the legacy redaction tokens
+*    are KEEP — an empty string is what a defaults-fallback pushes back, and
+*    treating it as "clear" is how a save destroyed a stored credential before.
+*
+* Pure and browser-safe.
+*/
+var SECRET_CLEAR = { $secretClear: true };
+/** The `'***'` token D634 redaction writes for non-admins. */
+var LEGACY_DEVICE_REDACTION = "***";
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function makeSecretMarker(ref) {
+	return {
+		$secret: ref,
+		v: 1
+	};
+}
+/** A stored marker: an object whose `$secret` is a non-empty string. */
+function isSecretMarker(value) {
+	if (!isRecord$1(value)) return false;
+	const ref = value["$secret"];
+	return typeof ref === "string" && ref.length > 0;
+}
+function isSecretClear(value) {
+	return isRecord$1(value) && value["$secretClear"] === true;
+}
+/**
+* The UI view of a stored secret field value: a marker becomes "set", inline
+* plaintext becomes "set (inline)", nothing becomes `null`. A value never
+* survives this function.
+*/
+function toSecretFieldView(stored) {
+	if (isSecretMarker(stored)) return {
+		$secret: stored.$secret,
+		v: 1,
+		set: true
+	};
+	if (typeof stored === "string" && stored.length > 0) return {
+		$secret: null,
+		v: 1,
+		set: true,
+		inline: true
+	};
+	return null;
+}
+/**
+* Classify an incoming value for a secret path. Only a non-empty string that is
+* not a redaction token sets a value; only {@link SECRET_CLEAR} clears.
+* Everything else — a marker (ours or anyone's), a UI view, `''`, `null`,
+* `undefined`, a redaction token, a non-string — keeps what is stored.
+*/
+function classifySecretWrite(incoming) {
+	if (isSecretClear(incoming)) return { kind: "clear" };
+	if (typeof incoming !== "string") return { kind: "keep" };
+	if (incoming.length === 0) return { kind: "keep" };
+	if (incoming === "__camstack_redacted__" || incoming === LEGACY_DEVICE_REDACTION) return { kind: "keep" };
+	return {
+		kind: "set",
+		value: incoming
+	};
+}
 /** Lookup map for well-known tabs by ID. */
 var WELL_KNOWN_TAB_MAP = Object.fromEntries([
 	{
@@ -952,33 +1097,19 @@ var WELL_KNOWN_TAB_MAP = Object.fromEntries([
 function isValuelessField(field) {
 	return field.type === "separator" || field.type === "info" || field.type === "qr-code" || field.type === "button" || field.type === "object-array" || field.type === "widget" || field.type === "addon-action-button" || field.type === "device-action-button";
 }
-/**
-* Merge a `ConfigUISchema` with a raw `values` record into a
-* `ConfigUISchemaWithValues`. Used by every `get*Settings` backend endpoint
-* before returning to the admin UI. Groups are walked recursively.
-*
-* For each leaf field:
-*   - structural fields (`separator`, `info`, `button`) pass through unchanged
-*   - other fields get `value = values[key] ?? field.default ?? null`
-*
-* Unknown keys in `values` (keys not declared in the schema) are silently
-* ignored — they don't contribute to the output. Missing keys fall back to
-* the schema default or `null`. This mirrors the old backend behaviour where
-* `FormBuilder` rendered `values[key] ?? field.default`.
-*/
-function hydrateSchema(schema, values) {
+function hydrateSchema(schema, values, options = {}) {
 	return {
 		...schema.tabs ? { tabs: [...schema.tabs] } : {},
 		sections: schema.sections.map((section) => ({
 			...section,
-			fields: section.fields.map((field) => hydrateField(field, values))
+			fields: section.fields.map((field) => hydrateField(field, values, options))
 		}))
 	};
 }
-function hydrateField(field, values) {
+function hydrateField(field, values, options) {
 	if (isValuelessField(field)) return field;
 	if (field.type === "group") {
-		const hydratedChildren = field.fields.map((child) => hydrateField(child, values));
+		const hydratedChildren = field.fields.map((child) => hydrateField(child, values, options));
 		return {
 			...field,
 			fields: hydratedChildren
@@ -987,7 +1118,7 @@ function hydrateField(field, values) {
 	if (field.type === "sub-tabs") {
 		const hydratedTabs = field.tabs.map((tab) => ({
 			...tab,
-			fields: tab.fields.map((child) => hydrateField(child, values))
+			fields: tab.fields.map((child) => hydrateField(child, values, options))
 		}));
 		return {
 			...field,
@@ -997,6 +1128,33 @@ function hydrateField(field, values) {
 	const key = field.key;
 	const storedValue = Object.prototype.hasOwnProperty.call(values, key) ? values[key] : void 0;
 	const defaultValue = field.default;
+	const asView = (v) => isSecretMarker(v) || options.inlineSecretsAsViews === true && v !== void 0;
+	if (isKeychainStoredField(field) && asView(storedValue)) return {
+		...field,
+		value: toSecretFieldView(storedValue)
+	};
+	if (isKeychainStoredField(field) && options.inlineSecretsAsViews === true) return {
+		...field,
+		value: null
+	};
+	if (field.type === "editable-array" && Array.isArray(storedValue)) {
+		const secretItemKeys = field.itemFields.filter((item) => "key" in item && isKeychainStoredField(item)).map((item) => "key" in item ? item.key : "");
+		if (secretItemKeys.length > 0) {
+			const rows = storedValue.map((row) => {
+				if (row === null || typeof row !== "object" || Array.isArray(row)) return row;
+				const out = { ...row };
+				for (const k of secretItemKeys) {
+					const v = Reflect.get(row, k);
+					if (asView(v)) out[k] = toSecretFieldView(v);
+				}
+				return out;
+			});
+			return {
+				...field,
+				value: rows
+			};
+		}
+	}
 	if (field.multiple) {
 		const stored = Array.isArray(storedValue) ? storedValue : storedValue !== void 0 && storedValue !== null ? [storedValue] : [];
 		const itemFallback = field.multiple.itemDefault !== void 0 ? field.multiple.itemDefault : defaultValue !== void 0 ? defaultValue : typeOf(field) === "string" ? "" : null;
@@ -1255,6 +1413,538 @@ function projectStore(store, perNodeKeys, nodeId) {
 	}
 	return out;
 }
+var GLOBAL_SCOPE = { kind: "global" };
+/** The scope every addon-wide (not per-node, not per-device) setting lives in. */
+function globalSecretScope() {
+	return GLOBAL_SCOPE;
+}
+/**
+* An addon id as a ref owner. A hub in-process builtin's context id is
+* `addon:<id>`; the owner of its secrets is `<id>`, exactly as for the same
+* addon running forked.
+*/
+function normalizeSecretOwner(addonId) {
+	return addonId.startsWith("addon:") ? addonId.slice(6) : addonId;
+}
+function encodeSegment(value) {
+	return encodeURIComponent(value);
+}
+function decodeSegment(value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return null;
+	}
+}
+/** The scope as it appears inside a ref (`global`, `node/<id>`, …). */
+function formatSecretScope(scope) {
+	switch (scope.kind) {
+		case "global": return "global";
+		case "node": return `node/${encodeSegment(scope.nodeId)}`;
+		case "device": return `device/${scope.deviceId}`;
+		case "integration": return `integration/${encodeSegment(scope.integrationId)}`;
+		case "row": return `row/${encodeSegment(scope.collection)}/${encodeSegment(scope.rowId)}`;
+	}
+}
+/**
+* The field path of a value inside an array item, addressed by the item's id:
+* `arrayItemFieldPath('providers', 'authentik', 'clientSecret')` →
+* `providers[authentik].clientSecret`.
+*/
+function arrayItemFieldPath(arrayKey, itemId, fieldKey) {
+	return `${arrayKey}[${encodeSegment(itemId)}].${fieldKey}`;
+}
+function parseScope(segments) {
+	switch (segments[0]) {
+		case "global": return {
+			scope: GLOBAL_SCOPE,
+			used: 1
+		};
+		case "node": {
+			const nodeId = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			return nodeId === null || nodeId.length === 0 ? null : {
+				scope: {
+					kind: "node",
+					nodeId
+				},
+				used: 2
+			};
+		}
+		case "device": {
+			const raw = segments[1];
+			if (raw === void 0 || !/^\d+$/.test(raw)) return null;
+			return {
+				scope: {
+					kind: "device",
+					deviceId: Number(raw)
+				},
+				used: 2
+			};
+		}
+		case "integration": {
+			const id = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			return id === null || id.length === 0 ? null : {
+				scope: {
+					kind: "integration",
+					integrationId: id
+				},
+				used: 2
+			};
+		}
+		case "row": {
+			const collection = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			const rowId = segments[2] !== void 0 ? decodeSegment(segments[2]) : null;
+			if (collection === null || rowId === null || collection.length === 0 || rowId.length === 0) return null;
+			return {
+				scope: {
+					kind: "row",
+					collection,
+					rowId
+				},
+				used: 3
+			};
+		}
+		default: return null;
+	}
+}
+/** Take a ref apart; `null` when it is not a well-formed ref. */
+function parseSecretRef(ref) {
+	if (!ref.startsWith("secret://")) return null;
+	const segments = ref.slice(9).split("/");
+	const owner = segments[0] !== void 0 ? decodeSegment(segments[0]) : null;
+	if (owner === null || owner.length === 0) return null;
+	const parsed = parseScope(segments.slice(1));
+	if (parsed === null) return null;
+	const fieldPath = segments.slice(1 + parsed.used).join("/");
+	if (fieldPath.length === 0) return null;
+	return {
+		owner,
+		scope: parsed.scope,
+		fieldPath
+	};
+}
+/** A write to a secret path could not be stored in the keychain, so it was refused. */
+var KeychainWriteRefusedError = class extends Error {
+	fieldPath;
+	constructor(fieldPath, cause) {
+		super(`secret "${fieldPath}" was not saved: the keychain could not store it (${cause instanceof Error ? cause.message : String(cause)}). Nothing was written.`);
+		this.fieldPath = fieldPath;
+		this.name = "KeychainWriteRefusedError";
+	}
+};
+var KEEP = { kind: "keep" };
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function defaultMintId() {
+	return globalThis.crypto.randomUUID();
+}
+/** Every marker ref anywhere under `value`. */
+function collectSecretMarkerRefs(value, out = []) {
+	if (isSecretMarker(value)) {
+		out.push(value.$secret);
+		return out;
+	}
+	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
+	else if (isRecord(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	return out;
+}
+async function storedValueEquals(secrets, marker, candidate) {
+	const resolved = (await secrets.resolve([marker.$secret]))[marker.$secret];
+	return resolved?.kind === "value" && resolved.value === candidate;
+}
+async function writeLeaf(ctx, incoming, stored, fieldPath) {
+	const intent = classifySecretWrite(incoming);
+	const ref = ctx.secrets.ref(ctx.scope, fieldPath);
+	const storedIsOurs = isSecretMarker(stored) && stored.$secret === ref;
+	if (intent.kind === "keep") return KEEP;
+	if (intent.kind === "set" && !ctx.operatorWrite && typeof stored === "string" && stored === intent.value) return KEEP;
+	if (intent.kind === "clear") {
+		if (storedIsOurs) ctx.deletes.push(ref);
+		return {
+			kind: "value",
+			value: null
+		};
+	}
+	if (storedIsOurs && await storedValueEquals(ctx.secrets, stored, intent.value)) return {
+		kind: "value",
+		value: stored
+	};
+	try {
+		await ctx.secrets.put(ref, intent.value);
+	} catch (err) {
+		throw new KeychainWriteRefusedError(fieldPath, err);
+	}
+	return {
+		kind: "value",
+		value: makeSecretMarker(ref)
+	};
+}
+/** Apply a member result onto `out`: KEEP restores the stored member, or removes it. */
+function applyMember(out, key, result, storedParent) {
+	if (result.kind === "value") {
+		out[key] = result.value;
+		return;
+	}
+	if (Object.prototype.hasOwnProperty.call(storedParent, key)) out[key] = storedParent[key];
+	else delete out[key];
+}
+async function writeMembers(ctx, children, incoming, stored, pathOf) {
+	const out = { ...incoming };
+	for (const [member, node] of children) applyMember(out, member, await writeNode(ctx, node, incoming[member], stored[member], pathOf(member)), stored);
+	return out;
+}
+function rowId(row, idKey) {
+	const raw = row[idKey];
+	if (typeof raw === "string" && raw.length > 0) return raw;
+	if (typeof raw === "number" && Number.isFinite(raw)) return String(raw);
+	return null;
+}
+async function writeArray(ctx, node, incoming, stored, fieldPath) {
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord) : [];
+	if (!Array.isArray(incoming)) {
+		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
+		return {
+			kind: "value",
+			value: incoming
+		};
+	}
+	const storedById = /* @__PURE__ */ new Map();
+	for (const row of storedRows) {
+		const id = rowId(row, node.idKey);
+		if (id !== null) storedById.set(id, row);
+	}
+	const kept = /* @__PURE__ */ new Set();
+	const rows = [];
+	for (const row of incoming) {
+		if (!isRecord(row)) {
+			rows.push(row);
+			continue;
+		}
+		const id = rowId(row, node.idKey) ?? ctx.mintId();
+		kept.add(id);
+		const withId = {
+			...row,
+			[node.idKey]: row[node.idKey] ?? id
+		};
+		if (rowId(withId, node.idKey) === null) withId[node.idKey] = id;
+		const storedRow = storedById.get(id) ?? {};
+		rows.push(await writeMembers(ctx, node.item, withId, storedRow, (member) => arrayItemFieldPath(fieldPath, id, member)));
+	}
+	for (const [id, row] of storedById) if (!kept.has(id)) ctx.deletes.push(...collectSecretMarkerRefs(row));
+	return {
+		kind: "value",
+		value: rows
+	};
+}
+async function writeNode(ctx, node, incoming, stored, fieldPath) {
+	switch (node.kind) {
+		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
+		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
+		case "object": {
+			if (!isRecord(incoming)) {
+				if (incoming === void 0) return KEEP;
+				ctx.deletes.push(...collectSecretMarkerRefs(stored));
+				return {
+					kind: "value",
+					value: incoming
+				};
+			}
+			const storedObj = isRecord(stored) ? stored : {};
+			return {
+				kind: "value",
+				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
+			};
+		}
+	}
+}
+/** Split a perNode-scoped key (`key@nodeId`). */
+function splitNodeKey(key) {
+	const at = key.indexOf("@");
+	return at <= 0 ? {
+		base: key,
+		nodeId: null
+	} : {
+		base: key.slice(0, at),
+		nodeId: key.slice(at + 1)
+	};
+}
+/** Rewrite a settings patch so no secret value reaches the blob. See the file doc. */
+async function transformSecretWrite(input) {
+	const deletes = [];
+	const base = {
+		secrets: input.secrets,
+		mintId: input.mintId ?? defaultMintId,
+		deletes,
+		operatorWrite: input.operatorWrite === true
+	};
+	const out = {};
+	for (const [key, incoming] of Object.entries(input.patch)) {
+		const { base: baseKey, nodeId } = splitNodeKey(key);
+		const node = input.tree.get(baseKey);
+		if (node === void 0) {
+			out[key] = incoming;
+			continue;
+		}
+		const scope = nodeId !== null && nodeId.length > 0 ? {
+			kind: "node",
+			nodeId
+		} : input.scope ?? globalSecretScope();
+		const result = await writeNode({
+			...base,
+			scope
+		}, node, incoming, input.stored[key], baseKey);
+		if (result.kind === "value") out[key] = result.value;
+	}
+	return {
+		patch: out,
+		afterWrite: async () => {
+			if (deletes.length === 0) return { orphaned: [] };
+			try {
+				await input.secrets.delete([...new Set(deletes)]);
+				return { orphaned: [] };
+			} catch {
+				return { orphaned: [...new Set(deletes)] };
+			}
+		}
+	};
+}
+/**
+* Replace every marker in `value` with its keychain value. Returns the SAME
+* reference when there is no marker (no allocation, no keychain call).
+*/
+async function resolveSecretMarkers(value, secrets) {
+	const refs = collectSecretMarkerRefs(value);
+	if (refs.length === 0) return {
+		value,
+		unresolved: []
+	};
+	const answers = await secrets.resolve(refs);
+	const unresolved = [];
+	for (const ref of new Set(refs)) {
+		const answer = answers[ref];
+		if (answer === void 0) unresolved.push({
+			ref,
+			reason: "not-initialized"
+		});
+		else if (answer.kind === "unavailable") unresolved.push({
+			ref,
+			reason: answer.reason
+		});
+		else if (answer.kind === "missing" || answer.kind === "forbidden") unresolved.push({
+			ref,
+			reason: answer.kind
+		});
+	}
+	const substitute = (v) => {
+		if (isSecretMarker(v)) {
+			const answer = answers[v.$secret];
+			return answer?.kind === "value" ? {
+				keep: true,
+				value: answer.value
+			} : {
+				keep: false,
+				value: void 0
+			};
+		}
+		if (Array.isArray(v)) {
+			const items = [];
+			for (const item of v) {
+				const s = substitute(item);
+				if (s.keep) items.push(s.value);
+			}
+			return {
+				keep: true,
+				value: items
+			};
+		}
+		if (isRecord(v)) {
+			const out = {};
+			for (const [k, child] of Object.entries(v)) {
+				const s = substitute(child);
+				if (s.keep) out[k] = s.value;
+			}
+			return {
+				keep: true,
+				value: out
+			};
+		}
+		return {
+			keep: true,
+			value: v
+		};
+	};
+	return {
+		value: substitute(value).value,
+		unresolved
+	};
+}
+function touchesTree(tree, patch) {
+	if (tree.size === 0) return false;
+	for (const key of Object.keys(patch)) {
+		const at = key.indexOf("@");
+		if (tree.has(at > 0 ? key.slice(0, at) : key)) return true;
+	}
+	return false;
+}
+/** The blob as stored now; a failed read REFUSES the write instead of guessing. */
+async function readStoredAddonBlob(raw) {
+	const threeWay = raw.readAddonStoreResult;
+	if (threeWay === void 0) return raw.readAddonStore();
+	const result = await threeWay.call(raw);
+	if (result.kind === "failed") throw new Error(`settings write refused: the stored blob could not be read (${result.error})`);
+	return result.kind === "missing" ? {} : result.value;
+}
+function createSecretAwareSettings(raw, opts) {
+	const chains = /* @__PURE__ */ new Map();
+	const serialize = (key, fn) => {
+		const next = (chains.get(key) ?? Promise.resolve()).then(fn, fn);
+		const tail = next.catch(() => void 0);
+		chains.set(key, tail);
+		tail.then(() => {
+			if (chains.get(key) === tail) chains.delete(key);
+		});
+		return next;
+	};
+	const write = async (chainKey, tree, scope, patch, readStored, rawWrite) => {
+		if (!touchesTree(tree, patch)) return rawWrite(patch);
+		return serialize(chainKey, async () => {
+			const stored = await readStored();
+			const result = await transformSecretWrite({
+				tree,
+				secrets: opts.secrets,
+				patch,
+				stored,
+				...scope !== void 0 ? { scope } : {},
+				operatorWrite: opts.isOperatorWrite?.() === true
+			});
+			if (Object.keys(result.patch).length > 0) await rawWrite(result.patch);
+			const { orphaned } = await result.afterWrite();
+			if (orphaned.length > 0) opts.onOrphaned(orphaned);
+		});
+	};
+	const wrapped = {
+		writeAddonStore: (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p)),
+		writeDeviceStore: (deviceId, patch) => write(`device:${deviceId}`, opts.deviceTree(), {
+			kind: "device",
+			deviceId
+		}, patch, () => raw.readDeviceStore(deviceId), (p) => raw.writeDeviceStore(deviceId, p))
+	};
+	return new Proxy(raw, { get(target, prop, receiver) {
+		if (prop === "writeAddonStore") return wrapped.writeAddonStore;
+		if (prop === "writeDeviceStore") return wrapped.writeDeviceStore;
+		const value = Reflect.get(target, prop, receiver);
+		return typeof value === "function" ? value.bind(target) : value;
+	} });
+}
+/** The context the addon sees: identical, except that its settings writes are secret-aware. */
+function withSecretAwareSettings(context, opts) {
+	const raw = context.settings;
+	if (raw === void 0) return context;
+	const settings = createSecretAwareSettings(raw, opts);
+	return new Proxy(context, { get(target, prop, receiver) {
+		if (prop === "settings") return settings;
+		return Reflect.get(target, prop, receiver);
+	} });
+}
+var LEAF = { kind: "leaf" };
+var DEFAULT_ITEM_ID_KEY = "id";
+function collectFields(fields, out) {
+	for (const field of fields) {
+		if (field.type === "group") {
+			collectFields(field.fields, out);
+			continue;
+		}
+		if (field.type === "sub-tabs") {
+			for (const tab of field.tabs) collectFields(tab.fields, out);
+			continue;
+		}
+		if (field.type === "editable-array") {
+			const item = /* @__PURE__ */ new Map();
+			for (const itemField of field.itemFields) if ("key" in itemField && isKeychainStoredField(itemField)) item.set(itemField.key, LEAF);
+			if (item.size > 0) out.set(field.key, {
+				kind: "array",
+				idKey: field.itemIdKey ?? DEFAULT_ITEM_ID_KEY,
+				item
+			});
+			continue;
+		}
+		if (!("key" in field) || typeof field.key !== "string") continue;
+		if (isKeychainStoredField(field)) out.set(field.key, LEAF);
+	}
+}
+/** The secret tree a settings schema declares. */
+function secretTreeFromSchema(schema) {
+	const out = /* @__PURE__ */ new Map();
+	if (schema === null) return out;
+	for (const section of schema.sections) collectFields(section.fields, out);
+	return out;
+}
+/** Parse `a.b[id].c` into segments; throws on a malformed path (a declaration bug). */
+function parseSecretStatePath(path) {
+	const segments = [];
+	for (const raw of path.split(".")) {
+		const m = /^([^[\]]+)(?:\[([^[\]]+)\])?$/.exec(raw);
+		if (m === null || m[1] === void 0) throw new Error(`secretStatePaths: malformed path "${path}"`);
+		segments.push(m[2] !== void 0 ? {
+			key: m[1],
+			idKey: m[2]
+		} : { key: m[1] });
+	}
+	if (segments.length === 0) throw new Error(`secretStatePaths: empty path`);
+	if (segments[segments.length - 1]?.idKey !== void 0) throw new Error(`secretStatePaths: "${path}" ends on an array — name the member that is secret`);
+	return segments;
+}
+function insert(into, segments) {
+	const [head, ...rest] = segments;
+	if (head === void 0) return;
+	if (rest.length === 0) {
+		into.set(head.key, LEAF);
+		return;
+	}
+	const existing = into.get(head.key);
+	if (head.idKey !== void 0) {
+		const item = new Map(existing?.kind === "array" ? existing.item : []);
+		insert(item, rest);
+		into.set(head.key, {
+			kind: "array",
+			idKey: head.idKey,
+			item
+		});
+		return;
+	}
+	const children = new Map(existing?.kind === "object" ? existing.children : []);
+	insert(children, rest);
+	into.set(head.key, {
+		kind: "object",
+		children
+	});
+}
+/** Add hidden-state paths (`secretStatePaths`) to a schema-derived tree. */
+function mergeSecretStatePaths(tree, paths) {
+	if (paths.length === 0) return tree;
+	const out = new Map(tree);
+	for (const path of paths) insert(out, parseSecretStatePath(path));
+	return out;
+}
+/**
+* The tree of a DECLARED path list — a device's `secretConfigPaths`
+* (`collectZodSecretPaths`: dotted, `[]` for array items). An array segment
+* without a named id field is addressed by the item's `id`.
+*/
+function secretTreeFromPaths(paths) {
+	const out = /* @__PURE__ */ new Map();
+	for (const path of paths) {
+		if (path.length === 0) continue;
+		insert(out, parseSecretStatePath(path.replace(/\[\]/g, `[${DEFAULT_ITEM_ID_KEY}]`)));
+	}
+	return out;
+}
+/** First retry of a secret the keychain could not serve; doubles to {@link SECRET_RETRY_MAX_MS}. */
+var SECRET_RETRY_FIRST_MS = 5e3;
+var SECRET_RETRY_MAX_MS = 5 * 6e4;
+/** Coalesces a burst of `keychain.changed` events into one re-resolve. */
+var SECRET_CHANGE_DEBOUNCE_MS = 250;
 /**
 * Base class for CamStack addons. Eliminates settings boilerplate:
 *
@@ -1324,6 +2014,25 @@ var BaseAddon = class {
 	settingsStoreReady = false;
 	/** Default config values. Provided via constructor. */
 	defaults;
+	/**
+	* Hidden-state paths that hold secrets (D787) — values the addon writes
+	* itself (`updateGlobalSettings`, `state()`) that no form field declares.
+	* Stored in the keychain exactly like a `password` field. Syntax:
+	* `'snapshotSigningKey'`, `'identity.pincode'`, `'tokens[userId].accessToken'`
+	* (`key[<id field>]` addresses array items by id, never by index).
+	*/
+	secretStatePaths = [];
+	_addonSecretTree = null;
+	_deviceSecretTree = null;
+	/** Refs the last resolved config pointed at — a change to one re-resolves. */
+	_configSecretRefs = /* @__PURE__ */ new Set();
+	_unresolvedSecrets = [];
+	_secretRetryTimer = null;
+	_secretRetryDelayMs = SECRET_RETRY_FIRST_MS;
+	_secretChangeTimer = null;
+	_secretChangeUnsub = null;
+	/** >0 while an OPERATOR's settings write is being applied. */
+	_operatorWriteDepth = 0;
 	constructor(defaults) {
 		this.defaults = defaults;
 		this._config = { ...defaults };
@@ -1359,8 +2068,18 @@ var BaseAddon = class {
 		return this._config;
 	}
 	async initialize(context) {
-		this._ctx = context;
+		const secrets = context.secrets;
+		this._ctx = secrets !== void 0 ? withSecretAwareSettings(context, {
+			secrets,
+			addonTree: () => this.addonSecretTree(),
+			deviceTree: () => this.deviceSecretTree(),
+			onOrphaned: (refs) => context.logger.warn("keychain refs dropped by a settings write could not be deleted", { meta: { refs: [...refs] } }),
+			isOperatorWrite: () => this._operatorWriteDepth > 0
+		}) : context;
 		await this.resolveConfig();
+		if (secrets !== void 0) this._secretChangeUnsub = secrets.onChange((ref) => {
+			if (this._configSecretRefs.has(ref)) this.scheduleSecretReresolve(SECRET_CHANGE_DEBOUNCE_MS);
+		});
 		const result = await this.onInitialize();
 		this.emitLifecycle(EventCategory.AddonStarted);
 		const normalized = normalizeAddonInitResult(result);
@@ -1393,6 +2112,12 @@ var BaseAddon = class {
 	*/
 	async onHubReachable() {}
 	async shutdown() {
+		this._secretChangeUnsub?.();
+		this._secretChangeUnsub = null;
+		if (this._secretRetryTimer !== null) clearTimeout(this._secretRetryTimer);
+		if (this._secretChangeTimer !== null) clearTimeout(this._secretChangeTimer);
+		this._secretRetryTimer = null;
+		this._secretChangeTimer = null;
 		this.emitLifecycle(EventCategory.AddonStopped);
 		if (this.autoEmitReadiness) this.emitReadinessForProviders("down");
 		await this.onShutdown();
@@ -1471,7 +2196,7 @@ var BaseAddon = class {
 		return hydrateSchema(schema, overlay ? {
 			...projected,
 			...overlay
-		} : projected);
+		} : projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The integration-level view of this addon's settings: exactly the sections
@@ -1520,7 +2245,7 @@ var BaseAddon = class {
 		return hydrateSchema({
 			...schema,
 			sections
-		}, projected);
+		}, projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The raw addon store PROJECTED onto the target node's bare per-node keys:
@@ -1574,18 +2299,50 @@ var BaseAddon = class {
 			value: result.value[key]
 		};
 	}
+	/**
+	* The OPERATOR's write — a settings form or an admin API call, dispatched by
+	* the kernel. Identical to {@link updateGlobalSettings}, except that a secret
+	* the operator sends is stored as sent even when it equals a pre-keychain
+	* inline value: the operator re-entering a password is a change, an addon
+	* writing back what it read is not (D787).
+	*/
+	async updateGlobalSettingsAsOperator(patch, nodeId) {
+		this._operatorWriteDepth++;
+		try {
+			await this.applyGlobalPatch(patch, nodeId);
+		} finally {
+			this._operatorWriteDepth--;
+		}
+	}
 	async updateGlobalSettings(patch, nodeId) {
+		await this.applyGlobalPatch(patch, nodeId);
+	}
+	/**
+	* REMOVE stored secrets — their keychain values and their markers (D787).
+	*
+	* Writing `''` to a secret field KEEPS what is stored (an empty string is
+	* what a defaults fallback writes back, and it must never destroy a
+	* credential), so code that means "forget this token" says so here. Without
+	* a keychain (an older kernel) it writes `''`, as such code always did.
+	*/
+	async clearSecrets(keys, nodeId) {
+		const tree = this.addonSecretTree();
+		const keychain = this._ctx?.secrets !== void 0;
+		const patch = {};
+		for (const key of keys) patch[key] = keychain && tree.has(key) ? SECRET_CLEAR : "";
+		await this.applyGlobalPatch(patch, nodeId);
+	}
+	async applyGlobalPatch(barePatch, nodeId) {
 		const keys = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
-		const barePatch = patch;
 		const scoped = keys.size > 0 ? scopePatch(barePatch, keys, target) : barePatch;
 		await this._ctx?.settings?.writeAddonStore(scoped);
 		if (target !== localNode) return;
 		await this.resolveConfig();
 		await this.onConfigChanged();
 		this.emitLifecycle(EventCategory.AddonUpdated, { level: "global" });
-		this.maybeAutoRestart(patch, this.globalSettingsSchema());
+		this.maybeAutoRestart(Object.keys(barePatch), this.globalSettingsSchema());
 	}
 	/**
 	* The set of field keys the global settings schema declares `perNode: true`
@@ -1610,7 +2367,7 @@ var BaseAddon = class {
 	* time to return its response before the addon is torn down and
 	* re-initialised by `AddonRegistryService.restartAddon`.
 	*/
-	maybeAutoRestart(patch, schema) {
+	maybeAutoRestart(patchKeys, schema) {
 		if (!schema) return;
 		const restartKeys = /* @__PURE__ */ new Set();
 		for (const section of schema.sections) for (const field of section.fields) {
@@ -1618,13 +2375,13 @@ var BaseAddon = class {
 			if (field.requiresRestart) restartKeys.add(field.key);
 		}
 		if (restartKeys.size === 0) return;
-		if (!Object.keys(patch).some((k) => restartKeys.has(k))) return;
+		if (!patchKeys.some((k) => restartKeys.has(k))) return;
 		const ctx = this._ctx;
 		if (!ctx) return;
 		const addonId = ctx.id;
 		setImmediate(() => {
 			ctx.api.addons?.restartAddon?.mutate({ addonId }).then(() => {
-				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: Object.keys(patch).filter((k) => restartKeys.has(k)) } });
+				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: patchKeys.filter((k) => restartKeys.has(k)) } });
 			}).catch((err) => {
 				ctx.logger.error("addon auto-restart failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
 			});
@@ -1633,7 +2390,7 @@ var BaseAddon = class {
 	async getDeviceSettings(deviceId) {
 		const schema = this.deviceSettingsSchema();
 		if (!schema) return { sections: [] };
-		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {});
+		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, { inlineSecretsAsViews: true });
 	}
 	async updateDeviceSettings(deviceId, patch) {
 		await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
@@ -1763,7 +2520,7 @@ var BaseAddon = class {
 	* selection at boot (absent scoped key ⇒ the constructor default wins).
 	*/
 	async resolveConfig() {
-		const stored = await this.readAddonStoreWithRetry();
+		const stored = await this.resolveStoredSecrets(await this.readAddonStoreWithRetry());
 		const perNode = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const resolved = { ...this.defaults };
@@ -1788,7 +2545,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: () => this.readAddonStoreWithRetry(),
+			read: async () => this.resolveStoredSecrets(await this.readAddonStoreWithRetry()),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeAddonStore(patch);
 			},
@@ -1805,7 +2562,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: async () => await this._ctx?.settings?.readDeviceStore(deviceId) ?? {},
+			read: async () => this.resolveStoredSecrets(await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, false),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
 			},
@@ -1817,6 +2574,70 @@ var BaseAddon = class {
 			} })
 		});
 	}
+	/** The addon store's secret tree: schema fields by TYPE, plus `secretStatePaths`. */
+	addonSecretTree() {
+		this._addonSecretTree ??= mergeSecretStatePaths(secretTreeFromSchema(this.globalSettingsSchema()), this.secretStatePaths);
+		return this._addonSecretTree;
+	}
+	deviceSecretTree() {
+		this._deviceSecretTree ??= secretTreeFromSchema(this.deviceSettingsSchema());
+		return this._deviceSecretTree;
+	}
+	/**
+	* Secrets of this addon's stored config that could not be resolved on the
+	* last read, with why. Non-empty means the addon is running WITHOUT them —
+	* an addon whose function needs one should report itself degraded rather
+	* than start on an empty credential.
+	*/
+	get unresolvedSecrets() {
+		return this._unresolvedSecrets;
+	}
+	/**
+	* Substitute every keychain marker in a stored blob with its value. With no
+	* keychain (no `ctx.secrets`) or no marker, the blob comes back unchanged.
+	* An unresolvable value is LEFT OUT (never `''`), logged by ref — never by
+	* value — and, when the cause can pass, retried with backoff. Nothing is
+	* ever written back from here.
+	*/
+	async resolveStoredSecrets(blob, trackForConfig = true) {
+		const secrets = this._ctx?.secrets;
+		if (secrets === void 0) return blob;
+		const refs = collectSecretMarkerRefs(blob);
+		if (trackForConfig) this._configSecretRefs = new Set(refs);
+		if (refs.length === 0) {
+			if (trackForConfig) this._unresolvedSecrets = [];
+			return blob;
+		}
+		const { value, unresolved } = await resolveSecretMarkers(blob, secrets);
+		if (trackForConfig) {
+			this._unresolvedSecrets = unresolved;
+			if (unresolved.length > 0) {
+				this._ctx?.logger?.error?.("secret unavailable — running without it, will retry", { meta: { secrets: unresolved.map((u) => ({
+					ref: u.ref,
+					reason: u.reason
+				})) } });
+				if (unresolved.some((u) => u.reason !== "missing" && u.reason !== "forbidden")) {
+					this.scheduleSecretReresolve(this._secretRetryDelayMs);
+					this._secretRetryDelayMs = Math.min(this._secretRetryDelayMs * 2, SECRET_RETRY_MAX_MS);
+				}
+			} else this._secretRetryDelayMs = SECRET_RETRY_FIRST_MS;
+		}
+		return value;
+	}
+	/** Re-resolve the config (a keychain-only change, or a retry) and apply it. */
+	scheduleSecretReresolve(delayMs) {
+		const timerOf = delayMs === SECRET_CHANGE_DEBOUNCE_MS ? "_secretChangeTimer" : "_secretRetryTimer";
+		if (this[timerOf] !== null) return;
+		const timer = setTimeout(() => {
+			this[timerOf] = null;
+			if (this._ctx === null) return;
+			this.resolveConfig().then(() => this.onConfigChanged()).catch((err) => {
+				this._ctx?.logger?.error?.("re-resolving secrets failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			});
+		}, delayMs);
+		timer.unref?.();
+		this[timerOf] = timer;
+	}
 	/**
 	* Wrap `ctx.settings.readAddonStore()` with a short retry budget so a
 	* transient settings-store outage (mid-restart of sqlite-settings, tsx-watch
@@ -1950,6 +2771,31 @@ var PeerBytesTicketSchema = z.object({
 	*/
 	declaredBytes: z.number().int().nonnegative().nullable()
 });
+/**
+* One store per PROCESS, even when two copies of this module are loaded (an
+* addon bundle next to the framework's): keyed on a registered symbol.
+*/
+var STORE_KEY = Symbol.for("camstack.keychain.known-secrets");
+function store() {
+	const existing = Reflect.get(globalThis, STORE_KEY);
+	if (existing !== void 0 && existing !== null) return existing;
+	const created = {
+		values: /* @__PURE__ */ new Map(),
+		compiled: null
+	};
+	Reflect.set(globalThis, STORE_KEY, created);
+	return created;
+}
+/** Replace every registered value inside `text` with its label. */
+function scrubKnownSecrets(text) {
+	const s = store();
+	const re = s.compiled;
+	if (re === null || text.length < 8) return text;
+	re.lastIndex = 0;
+	if (!re.test(text)) return text;
+	re.lastIndex = 0;
+	return text.replace(re, (match) => s.values.get(match) ?? "‹secret›");
+}
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = z.enum([
 	"high",
@@ -3078,6 +3924,69 @@ var deviceOpsCapability = {
 		getRawState: method(z.object({ deviceId: z.number() }), RawStateResultSchema.nullable(), { auth: "protected" })
 	}
 };
+function defOf(schema) {
+	return schema._zod?.def ?? {};
+}
+function declaredHere(schema) {
+	return z.globalRegistry.get(schema)?.secret === true;
+}
+/** Wrapper kinds whose `innerType` is the field itself. */
+var WRAPPERS = new Set([
+	"optional",
+	"nullable",
+	"default",
+	"prefault",
+	"catch",
+	"readonly",
+	"nonoptional"
+]);
+/**
+* The schema layers that make up ONE field: the schema itself and every
+* wrapper below it (optional / default / nullable / readonly / catch), plus
+* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
+* `.transform` on `in`).
+*/
+function layersOf(schema) {
+	const out = [];
+	const queue = [schema];
+	while (queue.length > 0) {
+		const s = queue.shift();
+		if (!s || out.includes(s)) continue;
+		out.push(s);
+		const def = defOf(s);
+		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
+		if (def.type === "pipe") {
+			if (def.in) queue.push(def.in);
+			if (def.out) queue.push(def.out);
+		}
+	}
+	return out;
+}
+/** True when any layer of this field declares `.meta({ secret: true })`. */
+function isZodSecret(schema) {
+	return layersOf(schema).some(declaredHere);
+}
+/**
+* Every declared secret path in a config schema: dotted keys, `[]` for "each
+* element of this array" (`connection.password`, `rows[].token`). A declared
+* object or array is reported as one path and not descended into — everything
+* under it is secret.
+*/
+function collectZodSecretPaths(schema, prefix = "") {
+	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
+	const paths = [];
+	for (const layer of layersOf(schema)) {
+		const def = defOf(layer);
+		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
+		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
+		else if (def.type === "intersection") {
+			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
+			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
+		}
+	}
+	return [...new Set(paths)];
+}
 /**
 * Type-safe JSON parsing helpers.
 *
@@ -5715,53 +6624,6 @@ var DERIVED_CAMERA_SILENCED_CAP_NAMES = [
 	"scene-monitor"
 ];
 /**
-* The value a redacted secret is replaced with on every read surface.
-*
-* It is also the WRITE-BACK token: an `upsertLocation` that sends this value
-* back for a key means "keep what is stored", which is what lets an operator
-* rename a location without retyping its password. A literal an operator could
-* plausibly choose as a real password would turn that convenience into a way
-* to lock yourself out, hence the sentinel shape.
-*/
-var REDACTED_SECRET = "__camstack_redacted__";
-/**
-* Every config key in `schema` whose value is a secret, including keys nested
-* inside `group` / `sub-tabs` containers.
-*/
-function collectSecretConfigKeys(schema) {
-	const keys = /* @__PURE__ */ new Set();
-	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
-	return keys;
-}
-function isRecord$3(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function sectionsOf(schema) {
-	if (!isRecord$3(schema)) return [];
-	const sections = schema["sections"];
-	return Array.isArray(sections) ? sections : [];
-}
-function fieldsOf(node) {
-	if (!isRecord$3(node)) return [];
-	const fields = node["fields"];
-	return Array.isArray(fields) ? fields : [];
-}
-function walkField(field, out) {
-	if (!isRecord$3(field)) return;
-	const type = field["type"];
-	const key = field["key"];
-	if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
-	if (type === "group") {
-		for (const child of fieldsOf(field)) walkField(child, out);
-		return;
-	}
-	if (type === "sub-tabs") {
-		const tabs = field["tabs"];
-		if (!Array.isArray(tabs)) return;
-		for (const tab of tabs) for (const child of fieldsOf(tab)) walkField(child, out);
-	}
-}
-/**
 * What the gate decided about a birth, from the CALLER's point of view.
 *
 * Deliberately not `ConfirmationVerdict`: `undecided` is not a birth decision
@@ -13962,6 +14824,270 @@ id: z.union([z.string(), z.number()]) }), {
 		})
 	}
 };
+/**
+* `keychain` — the hub's encrypted store of secret values (D787).
+*
+* Settings blobs never hold a secret: they hold a marker
+* `{"$secret":"secret://<owner>/<scope>/<fieldPath>","v":1}` and the value
+* lives here, AES-256-GCM under a data key that a master key wraps. This cap
+* is the OWNER's door to its own values: every method is owner-checked
+* against the CALLER, never against anything the caller claims.
+*
+* Who the caller is: the transport stamps `callerAddonId` into the args of a
+* call that crossed a process (the parent `LocalChildRegistry` from the UDS
+* connection, the agent from its child's connection carried in
+* `$hub-cap-fwd`'s envelope). A stamp always overwrites; a wire call with no
+* stamp has its claim stripped. Only a hub in-process caller may state its own
+* identity — `ctx.secrets` does that with the addon id closed over. This is
+* identity against BUGS and misrouting, not against a malicious addon (every
+* runner is the same OS user): see the threat model in
+* `docs/design/2026-10-08-secrets-keychain.md`.
+*
+* `callerAddonId` is deliberately NOT in any input schema: the tRPC router
+* parses the input, so a session can never supply it, and the internal mount
+* floors every method to admin anyway (D240).
+*
+* Internal: addons reach it through `ctx.secrets`, never directly.
+*/
+/** Why a value cannot be served right now. Never folded into "missing". */
+var KeychainUnavailableReasonSchema = z.enum([
+	"key-missing",
+	"wrong-key",
+	"key-file-unreadable",
+	"store-unavailable",
+	"not-initialized",
+	"decrypt-failed"
+]);
+var KeychainStateSchema = z.discriminatedUnion("state", [z.object({ state: z.literal("ready") }), z.object({
+	state: z.literal("locked"),
+	reason: KeychainUnavailableReasonSchema
+})]);
+var KeychainResolveEntrySchema = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("value"),
+		value: z.string(),
+		version: z.number().int()
+	}),
+	z.object({ kind: z.literal("missing") }),
+	z.object({
+		kind: z.literal("unavailable"),
+		reason: KeychainUnavailableReasonSchema
+	}),
+	z.object({ kind: z.literal("forbidden") })
+]);
+var KeychainResolveResultSchema = z.record(z.string(), KeychainResolveEntrySchema);
+/** Metadata of one stored value — never the value. */
+var KeychainSecretMetaSchema = z.object({
+	ref: z.string(),
+	owner: z.string(),
+	/** Formatted scope (`global`, `node/<id>`, `device/<id>`, …). */
+	scope: z.string(),
+	fieldPath: z.string(),
+	version: z.number().int(),
+	createdAt: z.number(),
+	updatedAt: z.number(),
+	/** `addon:<id>` | `user:<id>` | `system`. */
+	updatedBy: z.string(),
+	/** Coarse — written at most once an hour per ref. `null` = never read. */
+	lastReadAt: z.number().nullable()
+});
+var RefListSchema = z.array(z.string().min(1)).max(512);
+var keychainCapability = {
+	name: "keychain",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		/** Store (or replace) the caller's value at `ref`. Refused while locked. */
+		put: method(z.object({
+			ref: z.string().min(1),
+			value: z.string().min(1)
+		}), z.object({
+			ref: z.string(),
+			version: z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Resolve the caller's refs in one round-trip. A locked keychain answers
+		* `unavailable` per ref — never `missing`, never an empty value.
+		*/
+		resolve: method(z.object({ refs: RefListSchema }), KeychainResolveResultSchema, { auth: "admin" }),
+		/** Remove the caller's refs. Unknown refs are ignored. */
+		delete: method(z.object({ refs: RefListSchema }), z.object({ deleted: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The caller's own refs, metadata only. */
+		listMeta: method(z.object({}), z.array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }),
+		/** Whether values can be served — the save path refuses a write while locked. */
+		getState: method(z.object({}), KeychainStateSchema, { auth: "admin" })
+	}
+};
+/**
+* `keychain-admin` — the operator's view of the keychain (System → Secrets).
+*
+* Every method is `admin`. Two methods hand out material, each audited and
+* each named for exactly that: {@link keychainAdminCapability.methods.reveal}
+* (one value, shown briefly by the UI) and `downloadRecoveryKey` (the master
+* key itself, so the operator can keep a copy off the hub). Nothing else
+* returns a value.
+*
+* The master key's LOCATION is configuration, never an env var (D788):
+* `keychain.keyFile` in `config.yaml`, the OS keychain on a desktop hub, else
+* `<dataDir>/.keychain/master.key` — which sits beside the database in every
+* whole-volume backup, and the status says so.
+*/
+/** Where the master key in use came from. */
+var KeychainKeySourceKindSchema = z.enum([
+	"config-file",
+	"previous-config-file",
+	"platform",
+	"default-file"
+]);
+var KeychainKeySourceSchema = z.object({
+	kind: KeychainKeySourceKindSchema,
+	/** File sources only — a path is not a secret. */
+	path: z.string().optional(),
+	/**
+	* True when a whole-volume backup of the data directory carries this key
+	* next to the database it protects (the default file). The page warns.
+	*/
+	sharesBackupWithDatabase: z.boolean()
+});
+var KeychainStatusSchema = z.object({
+	keychain: KeychainStateSchema,
+	/** The source of the master key in use; `null` while locked. */
+	keySource: KeychainKeySourceSchema.nullable(),
+	/** The source configured to be primary — differs from `keySource` while a rotation is pending. */
+	configuredSource: KeychainKeySourceSchema,
+	/** Short fingerprint of the master key in use (`HMAC(KEK, label)`, 16 hex). */
+	fingerprint: z.string().nullable(),
+	activeKeyId: z.string().nullable(),
+	/**
+	* The keychain unlocked with a NON-primary source: the configured primary
+	* key is not the one that wraps the data key yet. `rotateMasterKey` moves it.
+	*/
+	rotationPending: z.boolean(),
+	/** Wrapped copies of the data key under a previous master key, kept until purged. */
+	retiredWraps: z.number().int(),
+	recoveryKeyDownloadedAt: z.number().nullable(),
+	secretCount: z.number().int()
+});
+/**
+* Whether a stored value is still pointed at by its owner's settings.
+* `unknown` is a first-class answer: a scope whose blob could not be read is
+* never reported as an orphan (and never deleted as one).
+*/
+var KeychainSecretUsageSchema = z.enum([
+	"in-use",
+	"orphan",
+	"unknown"
+]);
+var KeychainAdminSecretSchema = KeychainSecretMetaSchema.extend({ usage: KeychainSecretUsageSchema });
+var KeychainAuditActionSchema = z.enum([
+	"put",
+	"delete",
+	"reveal",
+	"rotate-master-key",
+	"purge-retired-keys",
+	"download-recovery-key",
+	"delete-orphans",
+	"reset",
+	"initialize"
+]);
+var KeychainAuditEntrySchema = z.object({
+	id: z.string(),
+	at: z.number(),
+	action: KeychainAuditActionSchema,
+	/** `addon:<id>` | `user:<id>` | `system`. */
+	actor: z.string(),
+	ref: z.string().nullable(),
+	detail: z.string().nullable()
+});
+var keychainAdminCapability = {
+	name: "keychain-admin",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		status: method(z.object({}), KeychainStatusSchema, { auth: "admin" }),
+		listSecrets: method(z.object({}), z.array(KeychainAdminSecretSchema).readonly(), { auth: "admin" }),
+		listAudit: method(z.object({ limit: z.number().int().min(1).max(500).optional() }), z.array(KeychainAuditEntrySchema).readonly(), { auth: "admin" }),
+		/**
+		* Show one value to the operator. Audited. The UI hides it again after a
+		* few seconds; nothing caches it.
+		*/
+		reveal: method(z.object({ ref: z.string().min(1) }), z.object({
+			value: z.string(),
+			version: z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/** Delete refs no owner points at any more. Re-checked here; `unknown` is kept. */
+		deleteOrphans: method(z.object({ refs: z.array(z.string().min(1)).max(1e3) }), z.object({
+			deleted: z.array(z.string()).readonly(),
+			kept: z.array(z.object({
+				ref: z.string(),
+				usage: KeychainSecretUsageSchema
+			})).readonly()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* Wrap the data key under the configured primary master key.
+		*
+		* Pending rotation (the keychain unlocked with a previous source): re-wrap
+		* under the primary. Otherwise, with the default file as primary: generate
+		* a new master key, write it there, re-wrap. A file or OS-keychain primary
+		* that is already in use cannot be replaced from here — put the new key at
+		* the source, keep the old one as `keychain.previousKeyFile`, restart, and
+		* rotate. No value is re-encrypted either way; the previous wrap is kept
+		* (retired) until purged.
+		*/
+		rotateMasterKey: method(z.object({}), z.object({
+			fingerprint: z.string(),
+			keySource: KeychainKeySourceSchema
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		purgeRetiredKeys: method(z.object({}), z.object({ purged: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/** The master key, base64. Audited; marks the recovery copy as taken. */
+		downloadRecoveryKey: method(z.object({}), z.object({
+			key: z.string(),
+			fingerprint: z.string(),
+			keySource: KeychainKeySourceSchema
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* Lost-key recovery: archive every stored value into a
+		* `keychain:secrets-orphaned-<ts>` table and start over with a new data
+		* key. Every secret field then reads "not set". Requires the typed
+		* confirmation {@link KEYCHAIN_RESET_CONFIRMATION}.
+		*/
+		resetKeychain: method(z.object({ confirm: z.literal("RESET KEYCHAIN") }), z.object({
+			archivedCollection: z.string().nullable(),
+			archived: z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		})
+	}
+};
 var decoderCapability = {
 	name: "decoder",
 	scope: "system",
@@ -15146,6 +16272,10 @@ var DeviceInfoSchema = z.object({
 	isCamera: z.boolean(),
 	/** Current config values — serializable snapshot */
 	config: z.record(z.string(), z.unknown()),
+	/** Paths inside `config` the device's schema declares secret (D783) —
+	*  what the non-admin redaction withholds. Paths, never values. Absent
+	*  when the owning runner has not reported them. */
+	secretConfigPaths: z.array(z.string()).optional(),
 	/** Hardware + identity blob (manufacturer / model / firmware / sn /
 	*  uid / mac / …). Populated by drivers; editable via setMetadata. */
 	metadata: z.record(z.string(), z.unknown()).nullable().optional(),
@@ -15366,12 +16496,22 @@ var DeviceRegisterPayloadSchema = z.object({
 	*  call (workers re-register on init), so probe-driven updates
 	*  (e.g. PTZ flag flipping after the abilities probe) propagate. */
 	features: z.array(z.string()).optional(),
-	config: z.record(z.string(), z.unknown())
+	config: z.record(z.string(), z.unknown()),
+	/** Config paths the device's own schema DECLARES secret
+	*  (`.meta({ secret: true })` — dotted, `[]` for array items, e.g.
+	*  `connection.password`). Re-published on every register; the non-admin
+	*  redaction withholds them at any depth (D783). Optional: an older runner
+	*  omits it and the keyword backstop applies. */
+	secretConfigPaths: z.array(z.string()).optional()
 });
 var DeviceRemovePayloadSchema = z.object({ deviceId: z.number() });
 var DevicePersistConfigPayloadSchema = z.object({
 	deviceId: z.number(),
-	data: z.record(z.string(), z.unknown())
+	data: z.record(z.string(), z.unknown()),
+	/** The paths the device's schema declares secret (D783), when the caller
+	*  knows them — those values are kept in the keychain, not the blob (D787).
+	*  Absent: the paths the device last reported at `registerDevice` apply. */
+	secretConfigPaths: z.array(z.string()).optional()
 });
 /** What a migration actually did, per switch. `unreachable` is a first-class
 *  answer: a camera that could not be asked is not a camera that was silenced. */
@@ -18285,7 +19425,14 @@ var RedirectLoginMethodSchema = z.object({
 	icon: z.string().optional(),
 	/** Addon-owned HTTP route the button navigates to (GET). */
 	startUrl: z.string(),
-	stage: LoginStageEnum
+	stage: LoginStageEnum,
+	/**
+	* The provider names an external identity a signed-in user can link to
+	* their own account (D782): `auth.listLinkableProviders` /
+	* `beginExternalLink` offer exactly the redirect methods that set this,
+	* whatever their id. Absent / false — a login button only (magic-link).
+	*/
+	linkable: z.boolean().optional()
 });
 /**
 * A Module-Federation widget the login page mounts for an in-page
@@ -24082,8 +25229,23 @@ var RetrainMacroClassSchema = z.enum([
 ]);
 /** A subject to learn, or a phantom to unlearn (taught by OMISSION). */
 var RetrainAnnotationKindSchema = z.enum(["subject", "model_error"]);
-/** Did a human draw this box, or did the assist propose it? */
-var RetrainAnnotationSourceSchema = z.enum(["operator", "assist"]);
+/**
+* Where a box came from. A machine-sourced box is a DRAFT on the page until
+* the operator confirms it; once saved it keeps its source as provenance.
+*
+* - `operator` — drawn by hand.
+* - `assist`   — proposed by a detector run on the copy (the camera's own
+*   model, or a larger teacher model).
+* - `pipeline` — the box the live pipeline actually drew on that frame, read
+*   back from the track store (never a re-run).
+* - `llm`      — proposed by a vision-capable LLM profile.
+*/
+var RetrainAnnotationSourceSchema = z.enum([
+	"operator",
+	"assist",
+	"pipeline",
+	"llm"
+]);
 /** Normalised `[0,1]` rectangle against the FULL frame — the canonical form. */
 var RetrainBboxSchema = z.object({
 	x: z.number(),
@@ -24101,7 +25263,8 @@ var RetrainBboxSchema = z.object({
 */
 var RetrainAnnotationSchema = z.object({
 	id: z.string(),
-	trackId: z.string(),
+	/** The frame's track. Absent on a recording still, which has none. */
+	trackId: z.string().optional(),
 	deviceId: z.number(),
 	/** The COPY in retrain storage — never the source track's media key. */
 	mediaKey: z.string(),
@@ -24150,18 +25313,63 @@ var RetrainFrameCandidateSchema = z.object({
 	*  fail, whatever became of the original. */
 	copied: z.boolean()
 });
+/**
+* One box the live pipeline drew on a copied frame — what a correction starts
+* from. Derived when the frame is listed, from the track store: the subject
+* box recorded on the source media row when there is one, else the track
+* position nearest the frame's capture time. Never stored as an annotation
+* until the operator confirms it.
+*/
+var RetrainPipelineBoxSchema = z.object({
+	/** Normalised `[0,1]` against the full frame. */
+	bbox: RetrainBboxSchema,
+	macroClass: RetrainMacroClassSchema,
+	label: z.string().optional(),
+	subLabel: z.string().optional(),
+	/** The detection score of the position used, when it was recorded. */
+	score: z.number().optional(),
+	/** The root model that produced the track, when it was recorded. */
+	modelId: z.string().optional(),
+	trackId: z.string(),
+	/** `subject-box`: recorded on this very frame. `position`: the track's
+	*  position nearest the capture time, `deltaMs` away. */
+	basis: z.enum(["subject-box", "position"]),
+	deltaMs: z.number()
+});
+/**
+* Where a retrain frame came from: a TRACK's stored media (copy-on-select),
+* or the RECORDING at an instant — the frame a model saw nothing in has no
+* track at all.
+*/
+var RetrainFrameOriginSchema = z.enum(["track", "recording"]);
 /** A frame the dataset OWNS: bytes copied at selection time. */
 var RetrainFrameSchema = z.object({
 	frameId: z.string(),
 	deviceId: z.number(),
-	trackId: z.string(),
-	/** Provenance only. It may already point at nothing — that is expected. */
-	sourceMediaId: z.number().int(),
+	origin: RetrainFrameOriginSchema,
+	/** The track it was copied from. Absent on a recording still. */
+	trackId: z.string().optional(),
+	/** Provenance only. It may already point at nothing — that is expected.
+	*  Absent on a recording still. */
+	sourceMediaId: z.number().int().optional(),
+	/** A recording still: the playhead instant it was taken at. */
+	epochMs: z.number().optional(),
 	sourceKind: MediaFileKindEnum,
 	sizeBytes: z.number().int(),
 	width: z.number().int(),
 	height: z.number().int(),
-	copiedAt: z.number()
+	copiedAt: z.number(),
+	/** When the CAMERA captured the frame. Absent on a copy taken before D785. */
+	capturedAt: z.number().optional(),
+	/** The operator's "every subject in this frame is boxed". Detector
+	*  evaluation keeps only complete frames: an unboxed subject would count as
+	*  a false positive. */
+	complete: z.boolean(),
+	/** The boxes the pipeline drew on this frame. Present on list answers;
+	*  empty when nothing the track store holds can be placed on it. */
+	pipelineBoxes: z.array(RetrainPipelineBoxSchema).readonly().optional(),
+	/** The named collections this frame belongs to. Present on list answers. */
+	collectionIds: z.array(z.string()).readonly().optional()
 });
 /** Why a copy-on-select could not be honoured — named, never a silent skip. */
 var RetrainCopyRefusalSchema = z.enum([
@@ -24182,6 +25390,53 @@ var RetrainFrameListSchema = z.object({
 	/** What the page pre-selects — the native key frame when one survives. */
 	autoPickMediaId: z.number().int().optional()
 });
+/**
+* Which frames an annotated export carries. Every field narrows; an empty
+* filter is every annotated copy. A dataset VERSION is a frozen `frameIds`
+* list owned by whoever trains (the training orchestrator), so `frameIds` is
+* the primitive a version export uses; `batchId` re-selects what an earlier
+* export carried (`exportedInBatch`).
+*/
+var RetrainExportFilterSchema = z.object({
+	deviceIds: z.array(z.number()).optional(),
+	frameIds: z.array(z.string()).max(2e4).optional(),
+	/** Only frames in at least one of these named collections. */
+	collectionIds: z.array(z.string()).max(200).optional(),
+	batchId: z.string().optional(),
+	/** Only frames the operator marked complete (all subjects boxed). */
+	completeOnly: z.boolean().optional()
+});
+/**
+* `frames`: the full frame copies, boxes in `annotations.json`.
+* `crops`: additionally one JPEG per subject, cut with the runtime detail-crop
+* convention — the classifier layout.
+*/
+var RetrainExportLayoutSchema = z.enum(["frames", "crops"]);
+/**
+* Where `writeRetrainArchive` streams the tar: one HTTP request whose body is
+* the archive, sent chunk by chunk. Covers a presigned PUT and a provider
+* addon's data-plane upload route alike. Headers are sent verbatim and never
+* logged.
+*/
+var RetrainArchiveTargetSchema = z.object({
+	kind: z.literal("http"),
+	method: z.enum(["PUT", "POST"]),
+	url: z.string().url(),
+	headers: z.record(z.string(), z.string()).optional()
+});
+var RetrainArchiveResultSchema = z.object({
+	batchId: z.string(),
+	frames: z.number().int(),
+	crops: z.number().int(),
+	annotations: z.number().int(),
+	/** Frames planned but not shipped (unreadable copy, path too long). */
+	missing: z.number().int(),
+	bytes: z.number().int(),
+	/** sha256 of the exact bytes sent. */
+	sha256: z.string(),
+	/** The target's HTTP status. */
+	status: z.number().int()
+});
 /** What the operator asked the assist to look for. */
 var RetrainAssistSubjectSchema = z.discriminatedUnion("kind", [z.object({
 	kind: z.literal("package"),
@@ -24211,6 +25466,109 @@ var RetrainAssistResultSchema = z.discriminatedUnion("kind", [z.object({
 	reason: z.string(),
 	detail: z.string().optional()
 })]);
+/** A named set over the retrain corpus — membership only, it owns no pixels. */
+var RetrainCollectionSchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	createdAt: z.number(),
+	frameCount: z.number().int()
+});
+var RetrainCollectionCreateResultSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("created"),
+	collection: RetrainCollectionSchema
+}), z.object({
+	kind: z.literal("refused"),
+	reason: z.enum(["empty-name", "duplicate-name"])
+})]);
+var RetrainCollectionRenameResultSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("renamed"),
+	collection: RetrainCollectionSchema
+}), z.object({
+	kind: z.literal("refused"),
+	reason: z.enum([
+		"empty-name",
+		"duplicate-name",
+		"unknown-collection"
+	])
+})]);
+/**
+* The outcome of adding the frame at a recording instant. Every refusal is
+* named: `still-unavailable` (not recording, a gap, or an undecodable frame —
+* `detail` says which), `still-busy` (the recorder is at its decode bound; try
+* again), `unreadable-image`, `write-failed`, `unknown-collection`.
+*/
+var AddRetrainFrameFromRecordingResultSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("added"),
+	collectionId: z.string(),
+	frame: RetrainFrameSchema,
+	/** The moment was already in the dataset; nothing was decoded. */
+	reused: z.boolean()
+}), z.object({
+	kind: z.literal("refused"),
+	reason: z.enum([
+		"unknown-collection",
+		"still-unavailable",
+		"still-busy",
+		"unreadable-image",
+		"write-failed"
+	]),
+	detail: z.string().optional()
+})]);
+/** A vision LLM profile the AI assist may use, and where it sends the frame. */
+var RetrainAssistProfileSchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	model: z.string(),
+	kind: z.string(),
+	/** `true` when the frame would leave the house (a cloud vendor, or an
+	*  endpoint that is not on the local network). The page confirms each such
+	*  run, and the provider refuses one without `allowCloud`. */
+	leavesHouse: z.boolean()
+});
+/** A box the AI assist proposed: a draft, plus the model's own reason. */
+var RetrainLlmProposalSchema = RetrainAnnotationDraftSchema.extend({ reason: z.string() });
+/** What the AI assist said about a box that was already on the canvas. */
+var RetrainLlmReviewSchema = z.object({
+	/** The `ref` the page sent the box under. */
+	ref: z.string(),
+	verdict: z.enum([
+		"confirmed",
+		"wrong-class",
+		"not-an-object",
+		"uncertain"
+	]),
+	suggestedClass: RetrainMacroClassSchema.optional(),
+	reason: z.string()
+});
+/**
+* The AI assist's answer. `proposed` carries drafts (`source: 'llm'`, the
+* model and its confidence) and reviews; items the model got wrong (a box off
+* the frame, an unasked class, an unknown ref) are dropped and counted in
+* `rejected`. A whole answer that is not the schema is `malformed-answer`.
+*/
+var RetrainLlmAssistResultSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("proposed"),
+	profileId: z.string(),
+	model: z.string(),
+	/** The frame was sent outside the house for this answer. */
+	leftHouse: z.boolean(),
+	proposals: z.array(RetrainLlmProposalSchema).readonly(),
+	reviews: z.array(RetrainLlmReviewSchema).readonly(),
+	rejected: z.number().int()
+}), z.object({
+	kind: z.literal("refused"),
+	reason: z.enum([
+		"unknown-frame",
+		"unreadable-frame",
+		"unknown-profile",
+		"profile-disabled",
+		"no-vision",
+		"cloud-not-confirmed",
+		"llm-error",
+		"malformed-answer"
+	]),
+	detail: z.string().optional()
+})]);
 /** The outcome of a lifecycle move owned by the retrain page. */
 var RetrainTransitionResultSchema = z.object({
 	trackId: z.string(),
@@ -25397,7 +26755,7 @@ var pipelineAnalyticsCapability = {
 		*  a frame leaves the dataset before export. */
 		deselectRetrainFrame: method(z.object({
 			deviceId: z.number(),
-			trackId: z.string(),
+			trackId: z.string().optional(),
 			frameId: z.string()
 		}), z.object({
 			removed: z.boolean(),
@@ -25440,7 +26798,8 @@ var pipelineAnalyticsCapability = {
 		*/
 		proposeRetrainAnnotations: method(z.object({
 			deviceId: z.number(),
-			trackId: z.string(),
+			/** The frame's track, when it has one — checked against the frame. */
+			trackId: z.string().optional(),
 			frameId: z.string(),
 			subject: RetrainAssistSubjectSchema,
 			/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
@@ -25449,8 +26808,12 @@ var pipelineAnalyticsCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Every annotation on a track, oldest first. */
-		listRetrainAnnotations: method(z.object({ trackId: z.string() }), z.array(RetrainAnnotationSchema).readonly(), {
+		/** Every annotation on a track, or on named frames (a recording still has
+		*  no track), oldest first. One of the two is required. */
+		listRetrainAnnotations: method(z.object({
+			trackId: z.string().optional(),
+			frameIds: z.array(z.string()).max(2e3).optional()
+		}), z.array(RetrainAnnotationSchema).readonly(), {
 			kind: "query",
 			auth: "admin"
 		}),
@@ -25469,7 +26832,8 @@ var pipelineAnalyticsCapability = {
 		*/
 		saveRetrainAnnotations: method(z.object({
 			deviceId: z.number(),
-			trackId: z.string(),
+			/** The frame's track, when it has one — checked against the frame. */
+			trackId: z.string().optional(),
 			frameId: z.string(),
 			annotations: z.array(RetrainAnnotationDraftSchema)
 		}), z.array(RetrainAnnotationSchema).readonly(), {
@@ -25521,7 +26885,146 @@ var pipelineAnalyticsCapability = {
 		* out, so two crops of the same subject can never end up in one feature
 		* space (D52).
 		*/
-		getRetrainExportUrl: method(z.object({ deviceIds: z.array(z.number()).optional() }), z.object({ url: z.string() }), {
+		getRetrainExportUrl: method(RetrainExportFilterSchema.extend({ layout: RetrainExportLayoutSchema.optional() }), z.object({ url: z.string() }), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* The operator's "every subject in this frame is boxed" — set and cleared
+		* by hand, never derived: a frame with no box may be a complete hard
+		* negative, and a frame with three boxes may still miss a fourth person.
+		*/
+		setRetrainFrameComplete: method(z.object({
+			deviceId: z.number(),
+			trackId: z.string().optional(),
+			frameId: z.string(),
+			complete: z.boolean()
+		}), RetrainFrameSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Stream the annotated archive to a TARGET instead of a browser — the
+		* same tar `getRetrainExportUrl` serves (manifest first, one JPEG in
+		* memory at a time, paced), written chunk by chunk into one HTTP request.
+		* The bytes never cross this cap and never land on the hub's disk; the
+		* answer is what was sent, with its sha256.
+		*/
+		writeRetrainArchive: method(z.object({
+			filter: RetrainExportFilterSchema,
+			layout: RetrainExportLayoutSchema,
+			target: RetrainArchiveTargetSchema
+		}), RetrainArchiveResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 60 * 6e4
+		}),
+		/** The enabled, vision-capable LLM profiles, each saying whether a frame
+		*  sent to it leaves the house. */
+		listRetrainAssistProfiles: method(z.object({}), z.array(RetrainAssistProfileSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* Ask a vision LLM (the `llm` capability) about ONE copied frame: list the
+		* objects of `classes` with boxes, and review the boxes already on the
+		* canvas (sent by `ref`). Answers drafts (`source: 'llm'`) and reviews —
+		* nothing is stored, nothing is accepted. A profile that sends the frame
+		* outside the house is refused unless `allowCloud` says the operator
+		* confirmed this run.
+		*/
+		proposeRetrainAnnotationsWithLlm: method(z.object({
+			deviceId: z.number(),
+			trackId: z.string().optional(),
+			frameId: z.string(),
+			profileId: z.string(),
+			classes: z.array(RetrainMacroClassSchema).min(1),
+			boxes: z.array(z.object({
+				ref: z.string(),
+				bbox: RetrainBboxSchema,
+				macroClass: RetrainMacroClassSchema,
+				label: z.string().optional()
+			})).max(50),
+			allowCloud: z.boolean()
+		}), RetrainLlmAssistResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 18e4
+		}),
+		/**
+		* Create a named collection — a set over the retrain corpus ("packages
+		* porch night"). Names are unique case-insensitively and never empty;
+		* both refusals are named.
+		*/
+		createRetrainCollection: method(z.object({ name: z.string().max(120) }), RetrainCollectionCreateResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Every collection, newest first, with its frame count. */
+		listRetrainCollections: method(z.object({}), z.array(RetrainCollectionSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		renameRetrainCollection: method(z.object({
+			id: z.string(),
+			name: z.string().max(120)
+		}), RetrainCollectionRenameResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Delete a collection. Its recording stills that no other collection
+		* holds are deleted with their annotations (nothing else reaches them);
+		* frames copied from tracks always stay in the dataset.
+		*/
+		deleteRetrainCollection: method(z.object({ id: z.string() }), z.object({
+			deleted: z.boolean(),
+			removedFrames: z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Add the frame at a recording instant to a collection — the frame the
+		* model may have seen NOTHING in. The recorder re-decodes the native
+		* frame at `epochMs`; the dataset copies it (trackless, durable). The same
+		* moment twice is one copy. Every refusal is named.
+		*/
+		addRetrainFrameFromRecording: method(z.object({
+			collectionId: z.string(),
+			deviceId: z.number(),
+			epochMs: z.number()
+		}), AddRetrainFrameFromRecordingResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/** Add frames already in the dataset to a collection. */
+		addRetrainFramesToCollection: method(z.object({
+			collectionId: z.string(),
+			frameIds: z.array(z.string()).min(1).max(500)
+		}), z.object({
+			added: z.number().int(),
+			alreadyMember: z.number().int(),
+			unknownFrameIds: z.array(z.string()).readonly()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Remove a frame from a collection. A recording still left in no
+		*  collection is deleted with its annotations (`deletedFrame`). */
+		removeRetrainFrameFromCollection: method(z.object({
+			collectionId: z.string(),
+			frameId: z.string()
+		}), z.object({
+			removed: z.boolean(),
+			deletedFrame: z.boolean()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The frames of a collection, with their pipeline boxes. */
+		listRetrainCollectionFrames: method(z.object({ collectionId: z.string() }), z.array(RetrainFrameSchema).readonly(), {
 			kind: "query",
 			auth: "admin"
 		}),
@@ -26465,13 +27968,31 @@ var RecommendationReasonSchema = z.discriminatedUnion("kind", [
 	z.object({
 		kind: z.literal("no-family-build"),
 		format: ModelFormatSchema$1
+	}),
+	z.object({
+		kind: z.literal("kept-custom-pin"),
+		modelId: z.string(),
+		deviceKey: z.string()
 	})
 ]);
+/** Why a device is left exactly as it is, whatever the plan would pick (D786). */
+var KeptReasonSchema = z.enum(["custom-pin"]);
+/**
+* Where a choice's latency came from (D791): this node's own benchmark
+* result, or the hardware-class table. Measured on the node beats the table.
+*/
+var LatencySourceSchema = z.discriminatedUnion("kind", [z.object({ kind: z.literal("table") }), z.object({
+	kind: z.literal("node-benchmark"),
+	resultId: z.string(),
+	measuredAtMs: z.number()
+})]);
 var DeviceModelChoiceSchema = z.object({
 	modelId: z.string(),
 	p50Ms: z.number(),
 	fps: z.number(),
 	measured: z.boolean(),
+	/** Absent on a plan from before D791 — read as the table. */
+	source: LatencySourceSchema.optional(),
 	/** Parallel sessions at the camera rate with the headroom kept free: ⌊fps × (1 − headroom) / camera fps⌋. */
 	capacitySessions: z.number(),
 	personRecall: z.number()
@@ -26482,6 +28003,8 @@ var DeviceRecommendationSchema = z.object({
 	enabled: z.boolean(),
 	available: z.boolean(),
 	chosen: DeviceModelChoiceSchema.nullable(),
+	/** Present when the device is kept as is: Apply writes nothing on it. */
+	kept: KeptReasonSchema.optional(),
 	reasons: z.array(RecommendationReasonSchema).readonly()
 });
 var NodeRecommendationSchema = z.object({
@@ -26535,6 +28058,17 @@ var AutoTuneWarningSchema = z.discriminatedUnion("kind", [
 		kind: z.literal("coral-enabled"),
 		nodeId: z.string(),
 		deviceKey: z.string()
+	}),
+	z.object({
+		kind: z.literal("custom-pin-kept"),
+		nodeId: z.string(),
+		deviceKey: z.string().nullable(),
+		deviceId: z.number().nullable(),
+		modelId: z.string()
+	}),
+	z.object({
+		kind: z.literal("custom-registry-unreadable"),
+		error: z.string()
 	})
 ]);
 var AutoTuneOptionsSchema = z.object({
@@ -26713,13 +28247,14 @@ var SuggestSharesResultSchema = z.object({
 	nodes: z.array(SuggestedNodeShareSchema).readonly()
 });
 /**
-* Where the node and device shares come from (D750, D755).
-*  - `hardware` (default) — computed by the system from each node's static
-*    capacity (its accelerators at their Auto tune models, from the measured
-*    latency table), recomputed whenever a node or device joins, leaves, is
-*    switched on or off, or changes model. No load input.
-*  - `benchmark` — the same, from each node's measured capacity (node
-*    benchmark results); a node without results falls back to `hardware`.
+* Where the node and device shares come from (D750, D755, D791).
+*  - `benchmark` (default since D791) — each node's capacity as its own node
+*    benchmark measured it; a node without fresh results is sized from
+*    `hardware` and says so. Measured on the node beats the table.
+*  - `hardware` — computed from each node's static capacity only (its
+*    accelerators at their Auto tune models, from the latency table).
+*  Both are recomputed whenever a node or device joins, leaves, is switched
+*  on or off, changes model, or a benchmark result is written. No load input.
 *  - `manual` — the operator's stored sliders.
 * Either way a node or device that cannot take sessions gives its share to
 * the others in proportion; the stored values are never rewritten for that.
@@ -26768,6 +28303,368 @@ var EffectiveSharesSchema = z.object({
 	nodeWeights: z.record(z.string(), z.number()),
 	deviceWeights: z.record(z.string(), z.record(z.string(), z.number()))
 });
+/**
+* Wire shapes of the node benchmark (D791): the operator's plan, the
+* preflight the confirmation shows, the run the orchestrator owns, what the
+* measuring runner reports, and the result rows Auto tune and the automatic
+* shares read.
+*
+* ONE node at a time, owned by the pipeline orchestrator. While a run is
+* active the cluster is in BENCHMARK MODE for that node: it is not a
+* detection candidate, camera pins naming it are ignored so its sessions move
+* elsewhere, and both come back when the mode ends — after a crash or a hub
+* restart too (a persisted manifest, reconciled against the registry).
+*
+* Two measurements, both on the node, driven by its own runner (frames never
+* cross a process at frame rate, D9):
+*  - `device` — one accelerator × one candidate detector, root only, open
+*    loop: how many streams at the camera rate it carries inside the frame
+*    interval;
+*  - `pipeline` — the chosen detector plus the operator's detail steps
+*    (faces, plates, classifiers, CLIP…), on varied frames from the bench
+*    clip: how many parallel sessions the node carries before latency, drops,
+*    CPU, RAM or the event loop give out.
+*/
+/** Defaults and bounds, one place. */
+var NODE_BENCHMARK_DEFAULTS = {
+	fpsPerStream: 10,
+	budgetMinutes: 45,
+	minBudgetMinutes: 10,
+	maxBudgetMinutes: 120,
+	/** A result older than this no longer beats the table. */
+	staleAfterDays: 30,
+	/** Warm-in per ramp step (not accounted). */
+	settleSec: 5,
+	/** Accounted window per ramp step. */
+	measureSec: 20,
+	/** Longest the drain may take before the run is refused. */
+	drainTimeoutSec: 120,
+	/** Candidate models per device in one run. */
+	maxModelsPerDevice: 6
+};
+/** The two measurements a run can make. */
+var NodeBenchmarkPhaseSchema = z.enum(["device", "pipeline"]);
+var NodeBenchmarkDevicePlanSchema = z.object({
+	/** `<backend>:<device>` — `openvino:npu`, `coreml:all`, `cpu`. */
+	deviceKey: z.string().min(1),
+	/**
+	* Root detector candidates for the `device` measurement, in the order
+	* measured. The FIRST is the one the `pipeline` measurement runs.
+	*/
+	modelIds: z.array(z.string().min(1)).min(1).max(NODE_BENCHMARK_DEFAULTS.maxModelsPerDevice)
+});
+/** What the operator confirmed. */
+var NodeBenchmarkPlanSchema = z.object({
+	nodeId: z.string().min(1),
+	devices: z.array(NodeBenchmarkDevicePlanSchema).min(1),
+	/** Which measurements run. At least one. */
+	phases: z.array(NodeBenchmarkPhaseSchema).min(1).default(["device", "pipeline"]),
+	/**
+	* Detail steps (catalog step ids under the root: faces, plates,
+	* classifiers, CLIP…) the `pipeline` measurement enables. The root
+	* detector always runs.
+	*/
+	steps: z.array(z.string().min(1)).default([]),
+	/** Offered rate of one stream / session. */
+	fpsPerStream: z.number().int().min(1).max(30).default(NODE_BENCHMARK_DEFAULTS.fpsPerStream),
+	/** Hard deadline: the mode ends and the cluster is restored when it passes. */
+	budgetMinutes: z.number().int().min(NODE_BENCHMARK_DEFAULTS.minBudgetMinutes).max(NODE_BENCHMARK_DEFAULTS.maxBudgetMinutes).default(NODE_BENCHMARK_DEFAULTS.budgetMinutes),
+	/** Keep the models the run downloaded (default: delete what was not installed before). */
+	keepDownloadedModels: z.boolean().default(false),
+	/** Start although the other nodes' capacity does not cover the sessions running now. */
+	acceptInsufficientHeadroom: z.boolean().default(false)
+});
+/** Why a run cannot start. `overridable` ones are lifted by a plan flag. */
+var NodeBenchmarkRefusalKindSchema = z.enum([
+	"benchmark-active",
+	"node-offline",
+	"unknown-device",
+	"no-phase",
+	"insufficient-headroom"
+]);
+var NodeBenchmarkRefusalSchema = z.object({
+	kind: NodeBenchmarkRefusalKindSchema,
+	detail: z.string(),
+	overridable: z.boolean()
+});
+/** A camera whose detection leaves the node for the run. */
+var NodeBenchmarkMovingCameraSchema = z.object({
+	deviceId: z.number(),
+	/** Placed on the node now (a standing attach or a running session). */
+	placedOnNode: z.boolean(),
+	/** A node pin naming this node, ignored for the run. */
+	pinnedToNode: z.boolean()
+});
+/** A camera that cannot leave: no other node can obtain its frames. */
+var NodeBenchmarkStayingCameraSchema = z.object({
+	deviceId: z.number(),
+	reason: z.literal("only-frame-source")
+});
+var NodeBenchmarkPreflightSchema = z.object({
+	nodeId: z.string(),
+	online: z.boolean(),
+	moving: z.array(NodeBenchmarkMovingCameraSchema).readonly(),
+	/** Keep running on the node during the run; the result is flagged contaminated. */
+	staying: z.array(NodeBenchmarkStayingCameraSchema).readonly(),
+	estimatedDurationMs: z.number(),
+	/** The run ends and the cluster is restored at the latest after this long. */
+	budgetMs: z.number(),
+	phases: z.array(NodeBenchmarkPhaseSchema).readonly(),
+	steps: z.array(z.string()).readonly(),
+	devices: z.array(NodeBenchmarkDevicePlanSchema).readonly(),
+	/** Parallel sessions the cluster runs now, and what the other nodes can carry. */
+	headroom: z.object({
+		sessionsNow: z.number(),
+		otherNodesCapacitySessions: z.number().nullable()
+	}),
+	refusals: z.array(NodeBenchmarkRefusalSchema).readonly(),
+	canStart: z.boolean()
+});
+/** Where the measuring runner is. */
+var NodeBenchProgressSchema = z.object({
+	phase: z.enum([
+		"preparing",
+		"device",
+		"pipeline",
+		"cleanup"
+	]),
+	deviceKey: z.string().nullable(),
+	modelId: z.string().nullable(),
+	/** Streams (device) or sessions (pipeline) of the step running now. */
+	load: z.number().nullable(),
+	cellsDone: z.number(),
+	cellsTotal: z.number(),
+	message: z.string()
+});
+/** What limited a ramp. `none` = the ramp ran out of steps still passing. */
+var NodeBenchLimitSchema = z.enum([
+	"p95",
+	"drops",
+	"errors",
+	"stall",
+	"cpu",
+	"ram",
+	"none"
+]);
+var NodeBenchRampStepSchema = z.object({
+	load: z.number(),
+	pass: z.boolean(),
+	p95Ms: z.number(),
+	dropRatio: z.number(),
+	/** Completed frames per second over the accounted window. */
+	fps: z.number(),
+	cpuPct: z.number().nullable(),
+	ramFreePct: z.number().nullable(),
+	failReasons: z.array(z.string()).readonly()
+});
+/** One measured device × detector (the `device` measurement). */
+var NodeBenchDeviceCellSchema = z.object({
+	phase: z.literal("device"),
+	deviceKey: z.string(),
+	modelId: z.string(),
+	/** Single-stream latency (the K = 1 step). */
+	p50Ms: z.number(),
+	p95Ms: z.number(),
+	p99Ms: z.number(),
+	/** Frames per second sustained at the last passing step. */
+	fps: z.number(),
+	/** Streams at the camera rate the device carried inside the frame interval; 0 = not even one. */
+	kMax: z.number(),
+	limitedBy: NodeBenchLimitSchema,
+	/** First call (model load + warm-up). */
+	warmupMs: z.number(),
+	ramp: z.array(NodeBenchRampStepSchema).readonly()
+});
+/** One measured pipeline (the `pipeline` measurement) on a device. */
+var NodeBenchPipelineCellSchema = z.object({
+	phase: z.literal("pipeline"),
+	deviceKey: z.string(),
+	modelId: z.string(),
+	steps: z.array(z.string()).readonly(),
+	/** Parallel sessions at the camera rate the node carried; 0 = not even one. */
+	maxSessions: z.number(),
+	limitedBy: NodeBenchLimitSchema,
+	/** Detail steps that produced at least one result on the clip — a step that never fired measured nothing. */
+	stepsFired: z.array(z.string()).readonly(),
+	warmupMs: z.number(),
+	ramp: z.array(NodeBenchRampStepSchema).readonly()
+});
+var NodeBenchCellSchema = z.discriminatedUnion("phase", [NodeBenchDeviceCellSchema, NodeBenchPipelineCellSchema]);
+/**
+* What a result was measured ON. A result whose fingerprint no longer matches
+* the node no longer beats the table.
+*/
+var NodeBenchFingerprintSchema = z.object({
+	pipelineVersion: z.string().nullable(),
+	cpuModel: z.string().nullable(),
+	ramGb: z.number().nullable(),
+	os: z.string().nullable(),
+	/** Per device: the pool the cells ran on (runtime + tuning). */
+	pools: z.record(z.string(), z.object({
+		runtime: z.string(),
+		numWorkers: z.number(),
+		concurrency: z.number(),
+		batchMode: z.string()
+	})).default({})
+});
+/** The frames the run used. */
+var NodeBenchClipSchema = z.object({
+	/** `camstack-bench-v1` or `reference-images` (the fallback when the clip is not reachable). */
+	id: z.string(),
+	revision: z.string().nullable(),
+	frames: z.number(),
+	width: z.number(),
+	height: z.number()
+});
+var NodeBenchRunnerInputSchema = z.object({
+	runId: z.string().min(1),
+	devices: z.array(NodeBenchmarkDevicePlanSchema).min(1),
+	phases: z.array(NodeBenchmarkPhaseSchema).min(1),
+	/** The full detail step tree root for the `pipeline` measurement is built on the node from these ids. */
+	steps: z.array(z.string()).default([]),
+	fpsPerStream: z.number().int().min(1).max(30),
+	/** The runner stops on its own past this instant, whatever the hub does. */
+	deadlineAtMs: z.number(),
+	settleSec: z.number().min(0).max(60).default(NODE_BENCHMARK_DEFAULTS.settleSec),
+	measureSec: z.number().min(2).max(300).default(NODE_BENCHMARK_DEFAULTS.measureSec),
+	keepDownloadedModels: z.boolean().default(false)
+});
+var NodeBenchRunnerStateSchema = z.enum([
+	"running",
+	"done",
+	"failed",
+	"aborted"
+]);
+var NodeBenchRunnerStatusSchema = z.object({
+	runId: z.string(),
+	nodeId: z.string(),
+	state: NodeBenchRunnerStateSchema,
+	progress: NodeBenchProgressSchema.nullable(),
+	/** Every finished cell so far — a run stopped half way keeps what it measured. */
+	cells: z.array(NodeBenchCellSchema).readonly(),
+	fingerprint: NodeBenchFingerprintSchema.nullable(),
+	clip: NodeBenchClipSchema.nullable(),
+	/** Cameras seen running on the node during the run (they share its pools). */
+	activeCameraIds: z.array(z.number()).readonly(),
+	/** Models the run downloaded and then deleted (not installed before). */
+	deletedModels: z.array(z.string()).readonly(),
+	error: z.string().nullable(),
+	startedAtMs: z.number(),
+	finishedAtMs: z.number().nullable()
+});
+var NodeBenchmarkStateSchema = z.enum([
+	"draining",
+	"measuring",
+	"restoring",
+	"done",
+	"failed",
+	"aborted"
+]);
+/** Why a run ended. */
+var NodeBenchmarkEndReasonSchema = z.enum([
+	"completed",
+	"operator-abort",
+	"deadline",
+	"node-lost",
+	"runner-lost",
+	"hub-restart",
+	"drain-timeout",
+	"failed"
+]);
+var NodeBenchmarkRunSchema = z.object({
+	runId: z.string(),
+	nodeId: z.string(),
+	state: NodeBenchmarkStateSchema,
+	plan: NodeBenchmarkPlanSchema,
+	startedAtMs: z.number(),
+	deadlineAtMs: z.number(),
+	finishedAtMs: z.number().nullable(),
+	endReason: NodeBenchmarkEndReasonSchema.nullable(),
+	error: z.string().nullable(),
+	/** Cameras moved off the node for the run. */
+	moved: z.array(z.number()).readonly(),
+	/** Cameras that stayed (their only frame source is the node). */
+	staying: z.array(z.number()).readonly(),
+	/** Something else ran on the node's pools during the run. */
+	contaminated: z.boolean(),
+	progress: NodeBenchProgressSchema.nullable(),
+	resultIds: z.array(z.string()).readonly()
+});
+/** `getNodeBenchmarkStatus`: the active run (or the last one), and whether benchmark mode is on. */
+var NodeBenchmarkStatusSchema = z.object({
+	/** The node the cluster is in benchmark mode for; null = none. */
+	modeNodeId: z.string().nullable(),
+	run: NodeBenchmarkRunSchema.nullable()
+});
+/**
+* One stored measurement — the only authority Auto tune and the automatic
+* shares read measured capacity from. Written by the orchestrator when a run
+* ends, never by anyone else.
+*/
+var NodeBenchmarkResultSchema = z.object({
+	id: z.string(),
+	runId: z.string(),
+	nodeId: z.string(),
+	cell: NodeBenchCellSchema,
+	fpsPerStream: z.number(),
+	fingerprint: NodeBenchFingerprintSchema.nullable(),
+	clip: NodeBenchClipSchema.nullable(),
+	/** Other work shared the node's pools (a camera that could not move, or the hub's own duties). */
+	contaminated: z.boolean(),
+	stayingCameras: z.array(z.number()).readonly(),
+	/** The run ended early; the cell itself completed. */
+	partialRun: z.boolean(),
+	measuredAtMs: z.number()
+});
+var ListNodeBenchmarkResultsInputSchema = z.object({
+	nodeId: z.string().optional(),
+	deviceKey: z.string().optional()
+});
+/** A result with its standing today: does it still beat the table? */
+var NodeBenchmarkResultViewSchema = NodeBenchmarkResultSchema.extend({
+	/** `fresh` beats the table; `stale` falls back to it; `superseded` = a newer row covers the same cell. */
+	standing: z.enum([
+		"fresh",
+		"stale",
+		"superseded"
+	]),
+	staleWhy: z.enum([
+		"age",
+		"runtime",
+		"pool-tuning"
+	]).nullable()
+});
+z.object({
+	runId: z.string(),
+	nodeId: z.string(),
+	startedAtMs: z.number(),
+	deadlineAtMs: z.number(),
+	plan: NodeBenchmarkPlanSchema,
+	moved: z.array(z.number()).readonly(),
+	staying: z.array(z.number()).readonly()
+});
+/** Candidate detectors per device, for the plan editor. */
+var NodeBenchmarkCandidatesSchema = z.object({
+	nodeId: z.string(),
+	reachable: z.boolean(),
+	devices: z.array(z.object({
+		deviceKey: z.string(),
+		enabled: z.boolean(),
+		available: z.boolean(),
+		/** Ordered: what Auto tune would pick first, then the rest of the family by accuracy. */
+		suggested: z.array(z.string()).readonly(),
+		/** Every root detector the device has a build for. */
+		all: z.array(z.string()).readonly(),
+		/** The model the device runs now, when pinned. */
+		currentModelId: z.string().nullable()
+	})).readonly(),
+	/** Detail steps the node's catalog offers under the root (for the `pipeline` measurement). */
+	steps: z.array(z.object({
+		id: z.string(),
+		name: z.string(),
+		slot: z.string()
+	})).readonly()
+});
 z.object({
 	activeCameras: z.number(),
 	throttledCameras: z.number(),
@@ -28086,7 +29983,30 @@ var pipelineRunnerCapability = {
 		releaseParkedTrackFrames: method(z.object({
 			deviceId: z.number(),
 			trackId: z.string()
-		}), z.object({ released: z.number().int().nonnegative() }), { kind: "mutation" })
+		}), z.object({ released: z.number().int().nonnegative() }), { kind: "mutation" }),
+		/**
+		* Start measuring THIS node for the orchestrator's node benchmark: the
+		* bench clip decoded once into RAM, each device × candidate detector on an
+		* open-loop ramp (`device`), then the chosen pipeline with the requested
+		* detail steps (`pipeline`). Everything runs in-process with the executor
+		* — no frame crosses a node (D9) — and writes nothing: no track, event,
+		* media or notification. Reached by `nodePin(nodeId)`. Answers at once;
+		* one run per node; the run stops itself at `deadlineAtMs`.
+		*/
+		startNodeBench: method(NodeBenchRunnerInputSchema, z.object({
+			accepted: z.literal(true),
+			runId: z.string()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The run's progress and every finished cell; null when this runner does not know `runId`. */
+		getNodeBenchStatus: method(z.object({ runId: z.string() }), NodeBenchRunnerStatusSchema.nullable(), { auth: "admin" }),
+		/** Stop the run; what it finished is kept. */
+		abortNodeBench: method(z.object({ runId: z.string() }), z.object({ aborted: z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 var CameraPipelineConfigSchema = z.object({
@@ -29044,6 +30964,51 @@ var pipelineOrchestratorCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* Node benchmark — what a run of this plan would do, without doing it:
+		* the cameras that leave the node, those that cannot (the node is their
+		* only frame source; they stay and flag the run), the estimated duration
+		* and every reason it may not start. The confirmation shows this.
+		*/
+		getNodeBenchmarkPreflight: method(NodeBenchmarkPlanSchema, NodeBenchmarkPreflightSchema, { auth: "admin" }),
+		/**
+		* Node benchmark — start ONE run (cluster-wide lock). The orchestrator
+		* persists a restore manifest, enters benchmark mode for the node (out of
+		* placement, its camera pins ignored, nothing rewritten), drains it, drives
+		* the node's own runner, then restores — always, including after an
+		* abort, a lost node or a hub restart. Answers at once; poll
+		* `getNodeBenchmarkStatus`. Refused runs carry the preflight.
+		*/
+		startNodeBenchmark: method(NodeBenchmarkPlanSchema, z.discriminatedUnion("kind", [z.object({
+			kind: z.literal("started"),
+			runId: z.string()
+		}), z.object({
+			kind: z.literal("refused"),
+			preflight: NodeBenchmarkPreflightSchema
+		})]), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Node benchmark — the active run (or the last one) and the node in benchmark mode. */
+		getNodeBenchmarkStatus: method(z.void(), NodeBenchmarkStatusSchema, { auth: "admin" }),
+		/** Node benchmark — stop the active run; the cluster is restored as it was. */
+		abortNodeBenchmark: method(z.object({ runId: z.string() }), z.object({ aborted: z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Node benchmark — root detector candidates per device (what Auto tune
+		* would pick first, then the family) and the detail steps the node's
+		* catalog offers, for the plan editor.
+		*/
+		getNodeBenchmarkCandidates: method(z.object({ nodeId: z.string() }), NodeBenchmarkCandidatesSchema, { auth: "admin" }),
+		/** Node benchmark — stored results, newest first, each with its standing today. */
+		listNodeBenchmarkResults: method(ListNodeBenchmarkResultsInputSchema, z.array(NodeBenchmarkResultViewSchema).readonly(), { auth: "admin" }),
+		/** Node benchmark — delete one result; Auto tune and the shares stop reading it. */
+		deleteNodeBenchmarkResult: method(z.object({ id: z.string() }), z.object({ deleted: z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Read one camera's settings. Null when never touched (inherits agent defaults fully). */
 		getCameraSettings: method(z.object({ deviceId: z.number() }), CameraPipelineSettingsSchema.nullable()),
 		/** Set or clear the 3-state toggle for one (camera, addonId). Pass `enabled: null` to clear and revert to agent default. */
@@ -30001,7 +31966,19 @@ var SsoBridgeClaimsSchema = z.object({
 	* editing a descriptor must not retroactively extend or shorten a link the
 	* operator already consented to.
 	*/
-	refreshTtl: z.union([z.number().int().positive(), z.literal("never")]).optional()
+	refreshTtl: z.union([z.number().int().positive(), z.literal("never")]).optional(),
+	/**
+	* Opaque handle of a hub-side LINK intent (D782). Set by an OIDC callback
+	* that was started from a signed-in user's "Link" button: the finish then
+	* links this identity to the intent's user instead of signing anyone in.
+	* The handle carries no user id — the hub resolves it, single-use.
+	*/
+	linkIntent: z.string().optional(),
+	/**
+	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
+	* subject is unique only per issuer, so a link is bound to it.
+	*/
+	issuer: z.string().optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -36591,6 +38568,9 @@ var CreateIntegrationInputSchema = z.object({
 	enabled: z.boolean().optional(),
 	info: z.record(z.string(), z.unknown()).optional(),
 	settings: z.record(z.string(), z.unknown()).optional(),
+	/** Keys of `settings` the form's schema declares secret (by type) — kept in
+	*  the keychain, not the table (D787). */
+	secretKeys: z.array(z.string()).optional(),
 	skipRestart: z.boolean().optional()
 });
 var UpdateIntegrationInputSchema = z.object({
@@ -36626,7 +38606,9 @@ var integrationsCapability = {
 		getSettings: method(z.object({ id: z.string() }), z.record(z.string(), z.unknown()), { auth: "admin" }),
 		setSettings: method(z.object({
 			id: z.string(),
-			settings: z.record(z.string(), z.unknown())
+			settings: z.record(z.string(), z.unknown()),
+			/** Keys the form's schema declares secret (by type) — keychain-stored (D787). */
+			secretKeys: z.array(z.string()).optional()
 		}), z.object({ success: z.boolean() }), {
 			kind: "mutation",
 			auth: "admin"
@@ -44870,6 +46852,22 @@ var TotpStatusSchema = z.object({
 * delegation, structural caller-scope subset check goes inside the
 * provider.
 */
+var ExternalIdentitySchema = z.object({
+	/** Login-method id of the provider instance, e.g. `auth-oidc/authentik`. */
+	provider: z.string(),
+	/** The IdP's stable subject (`sub`) for this account. */
+	subject: z.string(),
+	/** The verified `iss` of the IdP the identity was linked under — `sub` is unique only per issuer. */
+	issuer: z.string(),
+	userId: z.string(),
+	/** What the IdP called the account at link time (username / email) — display only. */
+	label: z.string().optional(),
+	linkedAt: z.number()
+});
+var ExternalIdentityKeySchema = z.object({
+	provider: z.string().min(1),
+	subject: z.string().min(1)
+});
 var userManagementCapability = {
 	name: "user-management",
 	scope: "system",
@@ -45012,6 +47010,32 @@ var userManagementCapability = {
 			username: z.string(),
 			scopes: z.array(TokenScopeSchema)
 		}).nullable(), { access: "view" }),
+		listExternalIdentities: method(z.object({ userId: z.string() }), z.array(ExternalIdentitySchema), { auth: "admin" }),
+		/** The user an identity is linked to, or `null`. */
+		findUserByExternalIdentity: method(ExternalIdentityKeySchema, z.object({
+			userId: z.string(),
+			issuer: z.string()
+		}).nullable(), { auth: "admin" }),
+		/**
+		* Link `(provider, subject)` to `userId`. Idempotent for the same user;
+		* REFUSES (throws) an identity already linked to another user, and a
+		* user that does not exist.
+		*/
+		linkExternalIdentity: method(ExternalIdentityKeySchema.extend({
+			userId: z.string(),
+			issuer: z.string().min(1),
+			label: z.string().optional()
+		}), z.object({ success: z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
+		}),
+		/** Remove one link of `userId`. `success: false` when it was not linked to that user. */
+		unlinkExternalIdentity: method(ExternalIdentityKeySchema.extend({ userId: z.string() }), z.object({ success: z.boolean() }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "delete"
+		}),
 		listOauthSessions: method(z.void(), z.array(OauthSessionSummarySchema), { auth: "admin" }),
 		revokeOauthSession: method(z.object({ id: z.string() }), z.object({ success: z.boolean() }), {
 			kind: "mutation",
@@ -46737,7 +48761,8 @@ var BaseDevice = class {
 		this.role = options.role;
 		this.parentDeviceId = ctx.parentDeviceId;
 		const seedData = ctx.persistedConfig ?? {};
-		this.config = DeviceConfig.fromSchema(schema, (data) => ctx.persistConfig(data), seedData, ({ droppedKeys, issues }) => {
+		const declaredSecretPaths = collectZodSecretPaths(schema);
+		this.config = DeviceConfig.fromSchema(schema, (data) => ctx.persistConfig(data, { secretConfigPaths: declaredSecretPaths }), seedData, ({ droppedKeys, issues }) => {
 			ctx.logger.warn("Device config recovery: dropping invalid persisted fields", {
 				tags: {
 					deviceId: ctx.id,
@@ -50209,6 +52234,90 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychain.delete": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychain.getState": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychain.listMeta": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychain.put": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychain.resolve": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.deleteOrphans": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.downloadRecoveryKey": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.listAudit": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.listSecrets": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.purgeRetiredKeys": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.resetKeychain": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.reveal": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.rotateMasterKey": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.status": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"lawnMowerControl.dock": {
 		capName: "lawn-mower-control",
 		capScope: "device",
@@ -51583,6 +53692,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.addRetrainFrameFromRecording": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"pipelineAnalytics.addRetrainFramesToCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.applyDeviceSettingsPatch": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -51631,12 +53752,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.createRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.deleteRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineAnalytics.deleteTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -51841,6 +53974,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRetrainAssistProfiles": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainCollectionFrames": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainCollections": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainFrames": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -51889,6 +54040,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.proposeRetrainAnnotationsWithLlm": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.pruneEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -51943,6 +54100,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.removeRetrainFrameFromCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
+	"pipelineAnalytics.renameRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.restageRetrainTrack": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -51973,6 +54142,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.setRetrainFrameComplete": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -52009,6 +54184,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.writeRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineExecutor.cacheFrameInPool": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -52219,6 +54400,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.abortNodeBenchmark": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.applyAutoTune": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -52243,6 +54430,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.deleteNodeBenchmarkResult": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineOrchestrator.getAgentLoad": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -52351,6 +54544,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getNodeBenchmarkCandidates": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineOrchestrator.getNodeBenchmarkPreflight": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineOrchestrator.getNodeBenchmarkStatus": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getNodeInferenceDevices": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -52393,6 +54604,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.listNodeBenchmarkResults": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.pauseForStorageMigration": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -52537,6 +54754,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.startNodeBenchmark": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.suggestShares": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -52555,6 +54778,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.abortNodeBench": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineRunner.attachCamera": {
 		capName: "pipeline-runner",
 		capScope: "system",
@@ -52603,6 +54832,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineRunner.getNodeBenchStatus": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineRunner.getParkedTrackFrame": {
 		capName: "pipeline-runner",
 		capScope: "system",
@@ -52645,6 +54880,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.startNodeBench": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"plateGallery.assignPlate": {
 		capName: "plate-gallery",
 		capScope: "system",
@@ -54361,18 +56602,36 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userManagement.findUserByExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.getTotpStatus": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.linkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.listExternalIdentities": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.listOauthSessions": {
 		capName: "user-management",
 		capScope: "system",
@@ -54451,6 +56710,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userManagement.unlinkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"userManagement.updateUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -56379,6 +58644,8 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	imageSettingsCapability,
 	integrationsCapability,
 	intercomCapability,
+	keychainCapability,
+	keychainAdminCapability,
 	lawnMowerControlCapability,
 	llmCapability,
 	llmRuntimeCapability,
@@ -57805,6 +60072,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.addRetrainFrameFromRecording": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.applyDeviceSettingsPatch": [{
 		name: "deviceId",
 		form: "single",
@@ -57995,6 +60267,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.proposeRetrainAnnotationsWithLlm": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.pruneEventsBefore": [{
 		name: "deviceId",
 		form: "single",
@@ -58045,6 +60322,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.setRetrainFrameComplete": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.setTrackFlags": [{
 		name: "deviceId",
 		form: "single",
@@ -60428,6 +62710,70 @@ function bareAddonId(id) {
 function hfModelUrl(repo, path) {
 	return `https://huggingface.co/${repo}/resolve/main/${path}`;
 }
+/**
+* Names that, when used as URL query parameters, almost certainly carry
+* a secret. Matching is case-insensitive and anchored to the full param
+* name to avoid false positives like `user_id` (an entity reference, not
+* a credential) or `topic=password-reset` (a value happens to contain
+* the substring "password" but the param name is unrelated).
+*
+* Add new patterns here as we encounter cameras/APIs that leak through
+* the existing list.
+*/
+var CREDENTIAL_PARAM_PATTERNS = [
+	/^user$/i,
+	/^usr$/i,
+	/^username$/i,
+	/^password$/i,
+	/^pwd$/i,
+	/^pass$/i,
+	/^passwd$/i,
+	/^secret$/i,
+	/^token$/i,
+	/^auth$/i,
+	/^auth[_-]?token$/i,
+	/^bearer$/i,
+	/^api[_-]?key$/i,
+	/^access[_-]?token$/i,
+	/^refresh[_-]?token$/i
+];
+function isCredentialParam(name) {
+	return CREDENTIAL_PARAM_PATTERNS.some((re) => re.test(name));
+}
+/**
+* Redact secrets we may surface in logs or telemetry:
+*   1. `userinfo` (`user:password@host`) — the classic RTSP shape.
+*   2. Query-string credential params (`?user=...&password=...`) — the
+*      Reolink RTMP shape and several HTTP-pushed-stream APIs.
+*
+* Returns the original string verbatim when the input is not a parseable
+* URL — a log helper must never throw. Param values are replaced with
+* `***` so an operator reading logs still sees WHICH credential was
+* present (useful for debugging "wrong password" issues) without
+* exposing the value.
+*
+* The credential-name match is case-insensitive but anchored to the
+* whole param name; values like `user_id=42` or `topic=password-reset`
+* are NOT masked (those are entity references, not credentials).
+*/
+function maskUrlCredentials(rawUrl) {
+	try {
+		const u = new URL(rawUrl);
+		let touched = false;
+		if (u.username || u.password) {
+			u.username = "";
+			u.password = "";
+			touched = true;
+		}
+		for (const key of Array.from(u.searchParams.keys())) if (isCredentialParam(key)) {
+			u.searchParams.set(key, "***");
+			touched = true;
+		}
+		return touched ? u.toString() : rawUrl;
+	} catch {
+		return rawUrl;
+	}
+}
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 /**
@@ -60562,4 +62908,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { buildCapabilityLookup as $, compositionSliceKey as $n, looseSchema as $t, MINUTES_PER_DAY as A, settingsStoreCapability as An, scopeKey as Ar, expandContainer as At, StorageCleanupJobSchema as B, validateComposition as Bn, isCollectionArrayMethod as Bt, FieldClaimModeSchema as C, resolveLocationMode as Cn, isDeviceConfigCap as Cr, deviceStateCapability as Ct, LegacyStorageLocationDefaultSchema as D, scopesAllowAddon as Dn, parseJsonUnknown as Dr, enumerateSchemaFields as Dt, LOG_LEVEL_RANK as E, runtimeStatePolicyFor as En, parseJsonObject as Er, enumerateItemArrayFields as Et, RUNTIME_DEFAULTS as F, storageOccupancyCapability as Fn, formatMinutes as Ft, addonPagesCapability as G, withLocationMode as Gn, kebabToCamel as Gt, StorageLocationTypeSchema as H, vectorDimFromBase64 as Hn, isLocationEnabled as Ht, RecordingStatusSchema as I, storageProviderCapability as In, gbToBytes as It, alertsCapability as J, cloneStatefulExpressionMemory as Jn, lifecycleJobSchema as Jt, addonSettingsCapability as K, COMPOSER_ADDON_ID as Kn, legacyAutoLinkIds as Kt, STORAGE_ACCESS_FALLBACK as L, streamCatalogCapability as Ln, hfModelUrl as Lt, MOTION_CLOSE_AFTER_MS as M, snapshotCapability as Mn, toNodeId as Mr, extractNestedAddonId as Mt, RECORDING_SOURCE_CAMSTACK_ADDON as N, storageCapability as Nn, EventCategory as Nr, filesystemBrowseCapability as Nt, LocationIconIdSchema as O, scopesAllowDeviceCap as On, readinessKey as Or, evaluateCompositionField as Ot, REDACTED_SECRET as P, storageMigrationCapability as Pn, foldSnapshotByFunction as Pt, batteryCapability as Q, compositionItemFieldPath as Qn, logLevelAtMost as Qt, STREAM_PROFILE_META as R, streamQualityLabel as Rn, isAppLinkBase as Rt, FIRST_LEVEL_MACRO_CLASSES as S, resolveHubAddressRoles as Sn, hydrateSchema as Sr, deviceManagerCapability as St, HF_REPO as T, resolveNotificationTapAddress as Tn, nodePin as Tr, enumerateInferenceDevices as Tt, StorageMigrationJobSchema as U, vectorIndexDimConflictError as Un, isObjectInput as Ut, StorageLocationModeSchema as V, validateCustomAddress as Vn, isDefaultAppConnectionEndpoint as Vt, UserRecordSchema as W, vectorStoreCapability as Wn, isVoidInput as Wt, backupCapability as X, composedDeviceStableId as Xn, locationIconKey as Xt, authProviderCapability as Y, composedDeviceRef as Yn, localNetworkCapability as Yt, bareAddonId as Z, compositionFeatureEnabled as Zn, logDestinationCapability as Zt, DATABASE_SNAPSHOT_TIMEOUT_MS as _, replacedFieldKeys as _n, asString$1 as _r, decodeVectorBase64 as _t, BatteryStatusSchema as a, motionCapability as an, DeviceRole as ar, composerCapability as at, DeclaredDevices as b, resolveCoreBlockEntry as bn, emitReadiness as br, describeComposableCaps as bt, CAP_NAMES_WITH_STATUS as c, objectInputDeclaresAddonId as cn, BaseAddon as cr, coreBlockAddonId as ct, CORE_BLOCKS_ADDON_ID as d, pickAppLinkHub as dn, DEVICE_STATUS_METHOD as dr, coreBlockSourceKind as dt, mayReadLocation as en, compositionSourceKey as er, buildStreamParamsConfigSchema as et, CORE_BLOCK_ADDON_PREFIX as f, planComposition as fn, ReadinessRegistry as fr, coreBlocksCapability as ft, DATABASE_SNAPSHOT_SUFFIX as g, reducePoints as gn, asNumber as gr, declarationOwnerNodeId as gt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as h, ptzAutotrackCapability as hn, asJsonObject as hr, databaseSnapshotCapability as ht, BaseDevice as i, modeMayWrite as in, DeviceFeature as ir, collectSecretConfigKeys as it, MODEL_FORMATS as j, siteZoneKey as jn, sleep as jr, expressionContainsBuiltinCall as jt, METHOD_ACCESS_MAP as k, scoreRuntimes as kn, resolveCapMount as kr, evictionPolicyOfLocation as kt, COMPOSED_ITEM_FIXED_FIELDS as l, objectInputDeclaresRequiredDeviceId as ln, DATAPLANE_SECRET_HEADER as lr, coreBlockComposition as lt, CoreBlockSchema as m, procedureAuthKey as mn, WELL_KNOWN_TAB_MAP as mr, dataStoreProviderCapability as mt, AlertSchema as n, memoizePinnedFfmpeg as nn, disarmRoseMemory as nr, cameraGridLayoutCapability as nt, CAMERA_SWITCH_ORDER as o, normalizeCoreBlockWrite as on, DeviceType as or, compositionFieldKey as ot, CalendarPreferencesSchema as p, platformProbeCapability as pn, ReadinessTimeoutError as pr, createDeviceExtensionProvider as pt, addonWidgetsCapability as q, buildFfmpegArgs as qn, legacyModeOf as qt, ApiKeyRecordSchema as r, metricsProviderCapability as rn, toExpressionValue as rr, checkRoleAddress as rt, CAMSTACK_APP_LINK_ORIGIN as s, normalizeUnit as sn, errMsg as sr, compositionSourceRefs as st, ALL_CAPABILITY_DEFINITIONS as t, mayWriteToLocation as tn, createStatefulExpressionMemory as tr, calendarsCapability as tt, COMPOSER_RUNNER_ID as u, parseStreamParamsFormPatch as un, DEVICE_SETTINGS_CONTRIBUTION_METHODS as ur, coreBlockIdFromAddonId as ut, DAY_NAMES as v, resolveAppConnections as vn, createEvent as vr, defineExtensionSlotProvider as vt, FieldClaimSchema as w, resolveMethodAuth as wn, isEvent as wr, deviceStatusCapability as wt, DeviceStatusSchema as x, resolveCoreBlockFiles as xn, expandCapMethods as xr, deviceExtensionCapability as xt, DERIVED_CAMERA_SILENCED_CAP_NAMES as y, resolveBucketMs as yn, emitDownForOwnedCaps as yr, deriveBatteryPresence as yt, ScopedTokenSchema as z, userManagementCapability as zn, isArrayOutputSchema as zt };
+export { buildStreamParamsConfigSchema as $, compositionItemFieldPath as $n, looseSchema as $t, MINUTES_PER_DAY as A, scoreRuntimes as An, isSecretMarker as Ar, extractNestedAddonId as At, StorageLocationModeSchema as B, userManagementCapability as Bn, scrubKnownSecrets as Br, isLocationEnabled as Bt, FieldClaimModeSchema as C, resolveHubAddressRoles as Cn, emitDownForOwnedCaps as Cr, enumerateInferenceDevices as Ct, LegacyStorageLocationDefaultSchema as D, runtimeStatePolicyFor as Dn, hydrateSchema as Dr, evictionPolicyOfLocation as Dt, LOG_LEVEL_RANK as E, resolveNotificationTapAddress as En, formatSecretScope as Er, evaluateCompositionField as Et, RecordingStatusSchema as F, storageMigrationCapability as Fn, parseSecretRef as Fr, hfModelUrl as Ft, addonSettingsCapability as G, vectorStoreCapability as Gn, EventCategory as Gr, keychainCapability as Gt, StorageMigrationJobSchema as H, validateCustomAddress as Hn, sleep as Hr, isVoidInput as Ht, STORAGE_ACCESS_FALLBACK as I, storageOccupancyCapability as In, readinessKey as Ir, isAppLinkBase as It, authProviderCapability as J, buildFfmpegArgs as Jn, lifecycleJobSchema as Jt, addonWidgetsCapability as K, withLocationMode as Kn, legacyAutoLinkIds as Kt, STREAM_PROFILE_META as L, storageProviderCapability as Ln, resolveCapMount as Lr, isArrayOutputSchema as Lt, MOTION_CLOSE_AFTER_MS as M, siteZoneKey as Mn, normalizeSecretOwner as Mr, foldSnapshotByFunction as Mt, RECORDING_SOURCE_CAMSTACK_ADDON as N, snapshotCapability as Nn, parseJsonObject as Nr, formatMinutes as Nt, LocationIconIdSchema as O, scopesAllowAddon as On, isDeviceConfigCap as Or, expandContainer as Ot, RUNTIME_DEFAULTS as P, storageCapability as Pn, parseJsonUnknown as Pr, gbToBytes as Pt, buildCapabilityLookup as Q, compositionFeatureEnabled as Qn, logLevelAtMost as Qt, ScopedTokenSchema as R, streamCatalogCapability as Rn, resolveSecretMarkers as Rr, isCollectionArrayMethod as Rt, FIRST_LEVEL_MACRO_CLASSES as S, resolveCoreBlockFiles as Sn, createEvent as Sr, deviceStatusCapability as St, HF_REPO as T, resolveMethodAuth as Tn, expandCapMethods as Tr, enumerateSchemaFields as Tt, UserRecordSchema as U, vectorDimFromBase64 as Un, toNodeId as Ur, kebabToCamel as Ut, StorageLocationTypeSchema as V, validateComposition as Vn, secretTreeFromPaths as Vr, isObjectInput as Vt, addonPagesCapability as W, vectorIndexDimConflictError as Wn, transformSecretWrite as Wr, keychainAdminCapability as Wt, bareAddonId as X, composedDeviceRef as Xn, locationIconKey as Xt, backupCapability as Y, cloneStatefulExpressionMemory as Yn, localNetworkCapability as Yt, batteryCapability as Z, composedDeviceStableId as Zn, logDestinationCapability as Zt, DATABASE_SNAPSHOT_TIMEOUT_MS as _, reducePoints as _n, asJsonObject as _r, deriveBatteryPresence as _t, BatteryStatusSchema as a, modeMayWrite as an, DeviceFeature as ar, compositionSourceRefs as at, DeclaredDevices as b, resolveBucketMs as bn, collectSecretConfigKeys as br, deviceManagerCapability as bt, CAP_NAMES_WITH_STATUS as c, normalizeUnit as cn, errMsg as cr, coreBlockIdFromAddonId as ct, CORE_BLOCKS_ADDON_ID as d, parseStreamParamsFormPatch as dn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as dr, createDeviceExtensionProvider as dt, maskUrlCredentials as en, compositionSliceKey as er, calendarsCapability as et, CORE_BLOCK_ADDON_PREFIX as f, pickAppLinkHub as fn, DEVICE_STATUS_METHOD as fr, dataStoreProviderCapability as ft, DATABASE_SNAPSHOT_SUFFIX as g, ptzAutotrackCapability as gn, WELL_KNOWN_TAB_MAP as gr, defineExtensionSlotProvider as gt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as h, procedureAuthKey as hn, ReadinessTimeoutError as hr, decodeVectorBase64 as ht, BaseDevice as i, metricsProviderCapability as in, toExpressionValue as ir, compositionFieldKey as it, MODEL_FORMATS as j, settingsStoreCapability as jn, nodePin as jr, filesystemBrowseCapability as jt, METHOD_ACCESS_MAP as k, scopesAllowDeviceCap as kn, isEvent as kr, expressionContainsBuiltinCall as kt, COMPOSED_ITEM_FIXED_FIELDS as l, objectInputDeclaresAddonId as ln, BaseAddon as lr, coreBlockSourceKind as lt, CoreBlockSchema as m, platformProbeCapability as mn, ReadinessRegistry as mr, declarationOwnerNodeId as mt, AlertSchema as n, mayWriteToLocation as nn, createStatefulExpressionMemory as nr, checkRoleAddress as nt, CAMERA_SWITCH_ORDER as o, motionCapability as on, DeviceRole as or, coreBlockAddonId as ot, CalendarPreferencesSchema as p, planComposition as pn, REDACTED_SECRET as pr, databaseSnapshotCapability as pt, alertsCapability as q, COMPOSER_ADDON_ID as qn, legacyModeOf as qt, ApiKeyRecordSchema as r, memoizePinnedFfmpeg as rn, disarmRoseMemory as rr, composerCapability as rt, CAMSTACK_APP_LINK_ORIGIN as s, normalizeCoreBlockWrite as sn, DeviceType as sr, coreBlockComposition as st, ALL_CAPABILITY_DEFINITIONS as t, mayReadLocation as tn, compositionSourceKey as tr, cameraGridLayoutCapability as tt, COMPOSER_RUNNER_ID as u, objectInputDeclaresRequiredDeviceId as un, DATAPLANE_SECRET_HEADER as ur, coreBlocksCapability as ut, DAY_NAMES as v, replacedFieldKeys as vn, asNumber as vr, describeComposableCaps as vt, FieldClaimSchema as w, resolveLocationMode as wn, emitReadiness as wr, enumerateItemArrayFields as wt, DeviceStatusSchema as x, resolveCoreBlockEntry as xn, collectZodSecretPaths as xr, deviceStateCapability as xt, DERIVED_CAMERA_SILENCED_CAP_NAMES as y, resolveAppConnections as yn, asString$1 as yr, deviceExtensionCapability as yt, StorageCleanupJobSchema as z, streamQualityLabel as zn, scopeKey as zr, isDefaultAppConnectionEndpoint as zt };