@camstack/system 1.2.376 → 1.2.377

package/dist/{dist-BcUWQGr9.js → dist-D_a9mUiM.js}

@@ -1,6 +1,6 @@
 let zod = require("zod");
 require("node:crypto");
-//#region ../types/dist/event-category-B_0XEcLF.mjs
+//#region ../types/dist/event-category-DaIZi00R.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -79,6 +79,13 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AddonLoadFailed"] = "addon.load-failed";
 	/**
+	* A keychain value was stored or removed (D787). Carries the ref, its
+	* owner and the new version — NEVER the value. A process holding the ref
+	* drops its cached copy and the owning `BaseAddon` re-resolves its config.
+	* Telemetry (D8): a process that misses it still revalidates by version.
+	*/
+	EventCategory["KeychainChanged"] = "keychain.changed";
+	/**
 	* Addon recovered from a previous failure. Emitted when an addon
 	* transitions from `failed` back to `healthy` (typically via the
 	* monitor's auto-retry loop, or after manual `addons.retryLoad`).
@@ -701,7 +708,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-B0JG7-_F.mjs
+//#region ../types/dist/sleep-Cr5YOk3m.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -780,6 +787,144 @@ function buildAlawTable() {
 }
 buildUlawTable();
 buildAlawTable();
+/**
+* The value a redacted secret is replaced with on every read surface.
+*
+* It is also the WRITE-BACK token: an `upsertLocation` that sends this value
+* back for a key means "keep what is stored", which is what lets an operator
+* rename a location without retyping its password. A literal an operator could
+* plausibly choose as a real password would turn that convenience into a way
+* to lock yourself out, hence the sentinel shape.
+*/
+var REDACTED_SECRET = "__camstack_redacted__";
+/** Is this field's stored value a credential? */
+function isSecretConfigField(field) {
+	if (field.type === "password") return true;
+	return "secret" in field && field.secret === true;
+}
+/**
+* Is this field's value stored in the KEYCHAIN (D787)? Every secret field is,
+* by its TYPE, unless it opts out with `storage: 'inline'` — never by its name.
+*/
+function isKeychainStoredField(field) {
+	if (!isSecretConfigField(field)) return false;
+	if (field.type === "textarea" && field.isJson === true) return false;
+	return !("storage" in field && field.storage === "inline");
+}
+/**
+* Every config key in `schema` whose value is a secret, including keys nested
+* inside `group` / `sub-tabs` containers.
+*/
+function collectSecretConfigKeys(schema) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
+	return keys;
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sectionsOf(schema) {
+	if (!isRecord$2(schema)) return [];
+	const sections = schema["sections"];
+	return Array.isArray(sections) ? sections : [];
+}
+function fieldsOf(node) {
+	if (!isRecord$2(node)) return [];
+	const fields = node["fields"];
+	return Array.isArray(fields) ? fields : [];
+}
+function walkField(field, out) {
+	if (!isRecord$2(field)) return;
+	const type = field["type"];
+	const key = field["key"];
+	if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
+	if (type === "group") {
+		for (const child of fieldsOf(field)) walkField(child, out);
+		return;
+	}
+	if (type === "sub-tabs") {
+		const tabs = field["tabs"];
+		if (!Array.isArray(tabs)) return;
+		for (const tab of tabs) for (const child of fieldsOf(tab)) walkField(child, out);
+	}
+}
+/**
+* What a settings blob holds where a secret used to be.
+*
+* A keychain-stored field never holds its value. It holds a self-describing
+* MARKER, `{"$secret":"secret://…","v":1}` — an object, never a string, so no
+* code can mistake it for a credential and no form can send it to a camera as
+* a password. The empty state is `null` / absent, never `''`.
+*
+* The same shapes travel to and from the admin UI:
+*
+*  - read: `hydrateSchema` hands a secret field a {@link SecretFieldView}
+*    (`{ $secret, v, set: true }`) or `null` — the browser learns whether a
+*    value is set, never the value.
+*  - write: an untouched field submits the view back unchanged (KEEP); a typed
+*    value is a plain non-empty string (CHANGE); the Clear button submits
+*    {@link SECRET_CLEAR} (CLEAR). `''`, `null` and the legacy redaction tokens
+*    are KEEP — an empty string is what a defaults-fallback pushes back, and
+*    treating it as "clear" is how a save destroyed a stored credential before.
+*
+* Pure and browser-safe.
+*/
+var SECRET_CLEAR = { $secretClear: true };
+/** The `'***'` token D634 redaction writes for non-admins. */
+var LEGACY_DEVICE_REDACTION = "***";
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function makeSecretMarker(ref) {
+	return {
+		$secret: ref,
+		v: 1
+	};
+}
+/** A stored marker: an object whose `$secret` is a non-empty string. */
+function isSecretMarker(value) {
+	if (!isRecord$1(value)) return false;
+	const ref = value["$secret"];
+	return typeof ref === "string" && ref.length > 0;
+}
+function isSecretClear(value) {
+	return isRecord$1(value) && value["$secretClear"] === true;
+}
+/**
+* The UI view of a stored secret field value: a marker becomes "set", inline
+* plaintext becomes "set (inline)", nothing becomes `null`. A value never
+* survives this function.
+*/
+function toSecretFieldView(stored) {
+	if (isSecretMarker(stored)) return {
+		$secret: stored.$secret,
+		v: 1,
+		set: true
+	};
+	if (typeof stored === "string" && stored.length > 0) return {
+		$secret: null,
+		v: 1,
+		set: true,
+		inline: true
+	};
+	return null;
+}
+/**
+* Classify an incoming value for a secret path. Only a non-empty string that is
+* not a redaction token sets a value; only {@link SECRET_CLEAR} clears.
+* Everything else — a marker (ours or anyone's), a UI view, `''`, `null`,
+* `undefined`, a redaction token, a non-string — keeps what is stored.
+*/
+function classifySecretWrite(incoming) {
+	if (isSecretClear(incoming)) return { kind: "clear" };
+	if (typeof incoming !== "string") return { kind: "keep" };
+	if (incoming.length === 0) return { kind: "keep" };
+	if (incoming === "__camstack_redacted__" || incoming === LEGACY_DEVICE_REDACTION) return { kind: "keep" };
+	return {
+		kind: "set",
+		value: incoming
+	};
+}
 /** Lookup map for well-known tabs by ID. */
 var WELL_KNOWN_TAB_MAP = Object.fromEntries([
 	{
@@ -952,33 +1097,19 @@ var WELL_KNOWN_TAB_MAP = Object.fromEntries([
 function isValuelessField(field) {
 	return field.type === "separator" || field.type === "info" || field.type === "qr-code" || field.type === "button" || field.type === "object-array" || field.type === "widget" || field.type === "addon-action-button" || field.type === "device-action-button";
 }
-/**
-* Merge a `ConfigUISchema` with a raw `values` record into a
-* `ConfigUISchemaWithValues`. Used by every `get*Settings` backend endpoint
-* before returning to the admin UI. Groups are walked recursively.
-*
-* For each leaf field:
-*   - structural fields (`separator`, `info`, `button`) pass through unchanged
-*   - other fields get `value = values[key] ?? field.default ?? null`
-*
-* Unknown keys in `values` (keys not declared in the schema) are silently
-* ignored — they don't contribute to the output. Missing keys fall back to
-* the schema default or `null`. This mirrors the old backend behaviour where
-* `FormBuilder` rendered `values[key] ?? field.default`.
-*/
-function hydrateSchema(schema, values) {
+function hydrateSchema(schema, values, options = {}) {
 	return {
 		...schema.tabs ? { tabs: [...schema.tabs] } : {},
 		sections: schema.sections.map((section) => ({
 			...section,
-			fields: section.fields.map((field) => hydrateField(field, values))
+			fields: section.fields.map((field) => hydrateField(field, values, options))
 		}))
 	};
 }
-function hydrateField(field, values) {
+function hydrateField(field, values, options) {
 	if (isValuelessField(field)) return field;
 	if (field.type === "group") {
-		const hydratedChildren = field.fields.map((child) => hydrateField(child, values));
+		const hydratedChildren = field.fields.map((child) => hydrateField(child, values, options));
 		return {
 			...field,
 			fields: hydratedChildren
@@ -987,7 +1118,7 @@ function hydrateField(field, values) {
 	if (field.type === "sub-tabs") {
 		const hydratedTabs = field.tabs.map((tab) => ({
 			...tab,
-			fields: tab.fields.map((child) => hydrateField(child, values))
+			fields: tab.fields.map((child) => hydrateField(child, values, options))
 		}));
 		return {
 			...field,
@@ -997,6 +1128,33 @@ function hydrateField(field, values) {
 	const key = field.key;
 	const storedValue = Object.prototype.hasOwnProperty.call(values, key) ? values[key] : void 0;
 	const defaultValue = field.default;
+	const asView = (v) => isSecretMarker(v) || options.inlineSecretsAsViews === true && v !== void 0;
+	if (isKeychainStoredField(field) && asView(storedValue)) return {
+		...field,
+		value: toSecretFieldView(storedValue)
+	};
+	if (isKeychainStoredField(field) && options.inlineSecretsAsViews === true) return {
+		...field,
+		value: null
+	};
+	if (field.type === "editable-array" && Array.isArray(storedValue)) {
+		const secretItemKeys = field.itemFields.filter((item) => "key" in item && isKeychainStoredField(item)).map((item) => "key" in item ? item.key : "");
+		if (secretItemKeys.length > 0) {
+			const rows = storedValue.map((row) => {
+				if (row === null || typeof row !== "object" || Array.isArray(row)) return row;
+				const out = { ...row };
+				for (const k of secretItemKeys) {
+					const v = Reflect.get(row, k);
+					if (asView(v)) out[k] = toSecretFieldView(v);
+				}
+				return out;
+			});
+			return {
+				...field,
+				value: rows
+			};
+		}
+	}
 	if (field.multiple) {
 		const stored = Array.isArray(storedValue) ? storedValue : storedValue !== void 0 && storedValue !== null ? [storedValue] : [];
 		const itemFallback = field.multiple.itemDefault !== void 0 ? field.multiple.itemDefault : defaultValue !== void 0 ? defaultValue : typeOf(field) === "string" ? "" : null;
@@ -1255,6 +1413,538 @@ function projectStore(store, perNodeKeys, nodeId) {
 	}
 	return out;
 }
+var GLOBAL_SCOPE = { kind: "global" };
+/** The scope every addon-wide (not per-node, not per-device) setting lives in. */
+function globalSecretScope() {
+	return GLOBAL_SCOPE;
+}
+/**
+* An addon id as a ref owner. A hub in-process builtin's context id is
+* `addon:<id>`; the owner of its secrets is `<id>`, exactly as for the same
+* addon running forked.
+*/
+function normalizeSecretOwner(addonId) {
+	return addonId.startsWith("addon:") ? addonId.slice(6) : addonId;
+}
+function encodeSegment(value) {
+	return encodeURIComponent(value);
+}
+function decodeSegment(value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return null;
+	}
+}
+/** The scope as it appears inside a ref (`global`, `node/<id>`, …). */
+function formatSecretScope(scope) {
+	switch (scope.kind) {
+		case "global": return "global";
+		case "node": return `node/${encodeSegment(scope.nodeId)}`;
+		case "device": return `device/${scope.deviceId}`;
+		case "integration": return `integration/${encodeSegment(scope.integrationId)}`;
+		case "row": return `row/${encodeSegment(scope.collection)}/${encodeSegment(scope.rowId)}`;
+	}
+}
+/**
+* The field path of a value inside an array item, addressed by the item's id:
+* `arrayItemFieldPath('providers', 'authentik', 'clientSecret')` →
+* `providers[authentik].clientSecret`.
+*/
+function arrayItemFieldPath(arrayKey, itemId, fieldKey) {
+	return `${arrayKey}[${encodeSegment(itemId)}].${fieldKey}`;
+}
+function parseScope(segments) {
+	switch (segments[0]) {
+		case "global": return {
+			scope: GLOBAL_SCOPE,
+			used: 1
+		};
+		case "node": {
+			const nodeId = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			return nodeId === null || nodeId.length === 0 ? null : {
+				scope: {
+					kind: "node",
+					nodeId
+				},
+				used: 2
+			};
+		}
+		case "device": {
+			const raw = segments[1];
+			if (raw === void 0 || !/^\d+$/.test(raw)) return null;
+			return {
+				scope: {
+					kind: "device",
+					deviceId: Number(raw)
+				},
+				used: 2
+			};
+		}
+		case "integration": {
+			const id = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			return id === null || id.length === 0 ? null : {
+				scope: {
+					kind: "integration",
+					integrationId: id
+				},
+				used: 2
+			};
+		}
+		case "row": {
+			const collection = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			const rowId = segments[2] !== void 0 ? decodeSegment(segments[2]) : null;
+			if (collection === null || rowId === null || collection.length === 0 || rowId.length === 0) return null;
+			return {
+				scope: {
+					kind: "row",
+					collection,
+					rowId
+				},
+				used: 3
+			};
+		}
+		default: return null;
+	}
+}
+/** Take a ref apart; `null` when it is not a well-formed ref. */
+function parseSecretRef(ref) {
+	if (!ref.startsWith("secret://")) return null;
+	const segments = ref.slice(9).split("/");
+	const owner = segments[0] !== void 0 ? decodeSegment(segments[0]) : null;
+	if (owner === null || owner.length === 0) return null;
+	const parsed = parseScope(segments.slice(1));
+	if (parsed === null) return null;
+	const fieldPath = segments.slice(1 + parsed.used).join("/");
+	if (fieldPath.length === 0) return null;
+	return {
+		owner,
+		scope: parsed.scope,
+		fieldPath
+	};
+}
+/** A write to a secret path could not be stored in the keychain, so it was refused. */
+var KeychainWriteRefusedError = class extends Error {
+	fieldPath;
+	constructor(fieldPath, cause) {
+		super(`secret "${fieldPath}" was not saved: the keychain could not store it (${cause instanceof Error ? cause.message : String(cause)}). Nothing was written.`);
+		this.fieldPath = fieldPath;
+		this.name = "KeychainWriteRefusedError";
+	}
+};
+var KEEP = { kind: "keep" };
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function defaultMintId() {
+	return globalThis.crypto.randomUUID();
+}
+/** Every marker ref anywhere under `value`. */
+function collectSecretMarkerRefs(value, out = []) {
+	if (isSecretMarker(value)) {
+		out.push(value.$secret);
+		return out;
+	}
+	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
+	else if (isRecord(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	return out;
+}
+async function storedValueEquals(secrets, marker, candidate) {
+	const resolved = (await secrets.resolve([marker.$secret]))[marker.$secret];
+	return resolved?.kind === "value" && resolved.value === candidate;
+}
+async function writeLeaf(ctx, incoming, stored, fieldPath) {
+	const intent = classifySecretWrite(incoming);
+	const ref = ctx.secrets.ref(ctx.scope, fieldPath);
+	const storedIsOurs = isSecretMarker(stored) && stored.$secret === ref;
+	if (intent.kind === "keep") return KEEP;
+	if (intent.kind === "set" && !ctx.operatorWrite && typeof stored === "string" && stored === intent.value) return KEEP;
+	if (intent.kind === "clear") {
+		if (storedIsOurs) ctx.deletes.push(ref);
+		return {
+			kind: "value",
+			value: null
+		};
+	}
+	if (storedIsOurs && await storedValueEquals(ctx.secrets, stored, intent.value)) return {
+		kind: "value",
+		value: stored
+	};
+	try {
+		await ctx.secrets.put(ref, intent.value);
+	} catch (err) {
+		throw new KeychainWriteRefusedError(fieldPath, err);
+	}
+	return {
+		kind: "value",
+		value: makeSecretMarker(ref)
+	};
+}
+/** Apply a member result onto `out`: KEEP restores the stored member, or removes it. */
+function applyMember(out, key, result, storedParent) {
+	if (result.kind === "value") {
+		out[key] = result.value;
+		return;
+	}
+	if (Object.prototype.hasOwnProperty.call(storedParent, key)) out[key] = storedParent[key];
+	else delete out[key];
+}
+async function writeMembers(ctx, children, incoming, stored, pathOf) {
+	const out = { ...incoming };
+	for (const [member, node] of children) applyMember(out, member, await writeNode(ctx, node, incoming[member], stored[member], pathOf(member)), stored);
+	return out;
+}
+function rowId(row, idKey) {
+	const raw = row[idKey];
+	if (typeof raw === "string" && raw.length > 0) return raw;
+	if (typeof raw === "number" && Number.isFinite(raw)) return String(raw);
+	return null;
+}
+async function writeArray(ctx, node, incoming, stored, fieldPath) {
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord) : [];
+	if (!Array.isArray(incoming)) {
+		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
+		return {
+			kind: "value",
+			value: incoming
+		};
+	}
+	const storedById = /* @__PURE__ */ new Map();
+	for (const row of storedRows) {
+		const id = rowId(row, node.idKey);
+		if (id !== null) storedById.set(id, row);
+	}
+	const kept = /* @__PURE__ */ new Set();
+	const rows = [];
+	for (const row of incoming) {
+		if (!isRecord(row)) {
+			rows.push(row);
+			continue;
+		}
+		const id = rowId(row, node.idKey) ?? ctx.mintId();
+		kept.add(id);
+		const withId = {
+			...row,
+			[node.idKey]: row[node.idKey] ?? id
+		};
+		if (rowId(withId, node.idKey) === null) withId[node.idKey] = id;
+		const storedRow = storedById.get(id) ?? {};
+		rows.push(await writeMembers(ctx, node.item, withId, storedRow, (member) => arrayItemFieldPath(fieldPath, id, member)));
+	}
+	for (const [id, row] of storedById) if (!kept.has(id)) ctx.deletes.push(...collectSecretMarkerRefs(row));
+	return {
+		kind: "value",
+		value: rows
+	};
+}
+async function writeNode(ctx, node, incoming, stored, fieldPath) {
+	switch (node.kind) {
+		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
+		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
+		case "object": {
+			if (!isRecord(incoming)) {
+				if (incoming === void 0) return KEEP;
+				ctx.deletes.push(...collectSecretMarkerRefs(stored));
+				return {
+					kind: "value",
+					value: incoming
+				};
+			}
+			const storedObj = isRecord(stored) ? stored : {};
+			return {
+				kind: "value",
+				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
+			};
+		}
+	}
+}
+/** Split a perNode-scoped key (`key@nodeId`). */
+function splitNodeKey(key) {
+	const at = key.indexOf("@");
+	return at <= 0 ? {
+		base: key,
+		nodeId: null
+	} : {
+		base: key.slice(0, at),
+		nodeId: key.slice(at + 1)
+	};
+}
+/** Rewrite a settings patch so no secret value reaches the blob. See the file doc. */
+async function transformSecretWrite(input) {
+	const deletes = [];
+	const base = {
+		secrets: input.secrets,
+		mintId: input.mintId ?? defaultMintId,
+		deletes,
+		operatorWrite: input.operatorWrite === true
+	};
+	const out = {};
+	for (const [key, incoming] of Object.entries(input.patch)) {
+		const { base: baseKey, nodeId } = splitNodeKey(key);
+		const node = input.tree.get(baseKey);
+		if (node === void 0) {
+			out[key] = incoming;
+			continue;
+		}
+		const scope = nodeId !== null && nodeId.length > 0 ? {
+			kind: "node",
+			nodeId
+		} : input.scope ?? globalSecretScope();
+		const result = await writeNode({
+			...base,
+			scope
+		}, node, incoming, input.stored[key], baseKey);
+		if (result.kind === "value") out[key] = result.value;
+	}
+	return {
+		patch: out,
+		afterWrite: async () => {
+			if (deletes.length === 0) return { orphaned: [] };
+			try {
+				await input.secrets.delete([...new Set(deletes)]);
+				return { orphaned: [] };
+			} catch {
+				return { orphaned: [...new Set(deletes)] };
+			}
+		}
+	};
+}
+/**
+* Replace every marker in `value` with its keychain value. Returns the SAME
+* reference when there is no marker (no allocation, no keychain call).
+*/
+async function resolveSecretMarkers(value, secrets) {
+	const refs = collectSecretMarkerRefs(value);
+	if (refs.length === 0) return {
+		value,
+		unresolved: []
+	};
+	const answers = await secrets.resolve(refs);
+	const unresolved = [];
+	for (const ref of new Set(refs)) {
+		const answer = answers[ref];
+		if (answer === void 0) unresolved.push({
+			ref,
+			reason: "not-initialized"
+		});
+		else if (answer.kind === "unavailable") unresolved.push({
+			ref,
+			reason: answer.reason
+		});
+		else if (answer.kind === "missing" || answer.kind === "forbidden") unresolved.push({
+			ref,
+			reason: answer.kind
+		});
+	}
+	const substitute = (v) => {
+		if (isSecretMarker(v)) {
+			const answer = answers[v.$secret];
+			return answer?.kind === "value" ? {
+				keep: true,
+				value: answer.value
+			} : {
+				keep: false,
+				value: void 0
+			};
+		}
+		if (Array.isArray(v)) {
+			const items = [];
+			for (const item of v) {
+				const s = substitute(item);
+				if (s.keep) items.push(s.value);
+			}
+			return {
+				keep: true,
+				value: items
+			};
+		}
+		if (isRecord(v)) {
+			const out = {};
+			for (const [k, child] of Object.entries(v)) {
+				const s = substitute(child);
+				if (s.keep) out[k] = s.value;
+			}
+			return {
+				keep: true,
+				value: out
+			};
+		}
+		return {
+			keep: true,
+			value: v
+		};
+	};
+	return {
+		value: substitute(value).value,
+		unresolved
+	};
+}
+function touchesTree(tree, patch) {
+	if (tree.size === 0) return false;
+	for (const key of Object.keys(patch)) {
+		const at = key.indexOf("@");
+		if (tree.has(at > 0 ? key.slice(0, at) : key)) return true;
+	}
+	return false;
+}
+/** The blob as stored now; a failed read REFUSES the write instead of guessing. */
+async function readStoredAddonBlob(raw) {
+	const threeWay = raw.readAddonStoreResult;
+	if (threeWay === void 0) return raw.readAddonStore();
+	const result = await threeWay.call(raw);
+	if (result.kind === "failed") throw new Error(`settings write refused: the stored blob could not be read (${result.error})`);
+	return result.kind === "missing" ? {} : result.value;
+}
+function createSecretAwareSettings(raw, opts) {
+	const chains = /* @__PURE__ */ new Map();
+	const serialize = (key, fn) => {
+		const next = (chains.get(key) ?? Promise.resolve()).then(fn, fn);
+		const tail = next.catch(() => void 0);
+		chains.set(key, tail);
+		tail.then(() => {
+			if (chains.get(key) === tail) chains.delete(key);
+		});
+		return next;
+	};
+	const write = async (chainKey, tree, scope, patch, readStored, rawWrite) => {
+		if (!touchesTree(tree, patch)) return rawWrite(patch);
+		return serialize(chainKey, async () => {
+			const stored = await readStored();
+			const result = await transformSecretWrite({
+				tree,
+				secrets: opts.secrets,
+				patch,
+				stored,
+				...scope !== void 0 ? { scope } : {},
+				operatorWrite: opts.isOperatorWrite?.() === true
+			});
+			if (Object.keys(result.patch).length > 0) await rawWrite(result.patch);
+			const { orphaned } = await result.afterWrite();
+			if (orphaned.length > 0) opts.onOrphaned(orphaned);
+		});
+	};
+	const wrapped = {
+		writeAddonStore: (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p)),
+		writeDeviceStore: (deviceId, patch) => write(`device:${deviceId}`, opts.deviceTree(), {
+			kind: "device",
+			deviceId
+		}, patch, () => raw.readDeviceStore(deviceId), (p) => raw.writeDeviceStore(deviceId, p))
+	};
+	return new Proxy(raw, { get(target, prop, receiver) {
+		if (prop === "writeAddonStore") return wrapped.writeAddonStore;
+		if (prop === "writeDeviceStore") return wrapped.writeDeviceStore;
+		const value = Reflect.get(target, prop, receiver);
+		return typeof value === "function" ? value.bind(target) : value;
+	} });
+}
+/** The context the addon sees: identical, except that its settings writes are secret-aware. */
+function withSecretAwareSettings(context, opts) {
+	const raw = context.settings;
+	if (raw === void 0) return context;
+	const settings = createSecretAwareSettings(raw, opts);
+	return new Proxy(context, { get(target, prop, receiver) {
+		if (prop === "settings") return settings;
+		return Reflect.get(target, prop, receiver);
+	} });
+}
+var LEAF = { kind: "leaf" };
+var DEFAULT_ITEM_ID_KEY = "id";
+function collectFields(fields, out) {
+	for (const field of fields) {
+		if (field.type === "group") {
+			collectFields(field.fields, out);
+			continue;
+		}
+		if (field.type === "sub-tabs") {
+			for (const tab of field.tabs) collectFields(tab.fields, out);
+			continue;
+		}
+		if (field.type === "editable-array") {
+			const item = /* @__PURE__ */ new Map();
+			for (const itemField of field.itemFields) if ("key" in itemField && isKeychainStoredField(itemField)) item.set(itemField.key, LEAF);
+			if (item.size > 0) out.set(field.key, {
+				kind: "array",
+				idKey: field.itemIdKey ?? DEFAULT_ITEM_ID_KEY,
+				item
+			});
+			continue;
+		}
+		if (!("key" in field) || typeof field.key !== "string") continue;
+		if (isKeychainStoredField(field)) out.set(field.key, LEAF);
+	}
+}
+/** The secret tree a settings schema declares. */
+function secretTreeFromSchema(schema) {
+	const out = /* @__PURE__ */ new Map();
+	if (schema === null) return out;
+	for (const section of schema.sections) collectFields(section.fields, out);
+	return out;
+}
+/** Parse `a.b[id].c` into segments; throws on a malformed path (a declaration bug). */
+function parseSecretStatePath(path) {
+	const segments = [];
+	for (const raw of path.split(".")) {
+		const m = /^([^[\]]+)(?:\[([^[\]]+)\])?$/.exec(raw);
+		if (m === null || m[1] === void 0) throw new Error(`secretStatePaths: malformed path "${path}"`);
+		segments.push(m[2] !== void 0 ? {
+			key: m[1],
+			idKey: m[2]
+		} : { key: m[1] });
+	}
+	if (segments.length === 0) throw new Error(`secretStatePaths: empty path`);
+	if (segments[segments.length - 1]?.idKey !== void 0) throw new Error(`secretStatePaths: "${path}" ends on an array — name the member that is secret`);
+	return segments;
+}
+function insert(into, segments) {
+	const [head, ...rest] = segments;
+	if (head === void 0) return;
+	if (rest.length === 0) {
+		into.set(head.key, LEAF);
+		return;
+	}
+	const existing = into.get(head.key);
+	if (head.idKey !== void 0) {
+		const item = new Map(existing?.kind === "array" ? existing.item : []);
+		insert(item, rest);
+		into.set(head.key, {
+			kind: "array",
+			idKey: head.idKey,
+			item
+		});
+		return;
+	}
+	const children = new Map(existing?.kind === "object" ? existing.children : []);
+	insert(children, rest);
+	into.set(head.key, {
+		kind: "object",
+		children
+	});
+}
+/** Add hidden-state paths (`secretStatePaths`) to a schema-derived tree. */
+function mergeSecretStatePaths(tree, paths) {
+	if (paths.length === 0) return tree;
+	const out = new Map(tree);
+	for (const path of paths) insert(out, parseSecretStatePath(path));
+	return out;
+}
+/**
+* The tree of a DECLARED path list — a device's `secretConfigPaths`
+* (`collectZodSecretPaths`: dotted, `[]` for array items). An array segment
+* without a named id field is addressed by the item's `id`.
+*/
+function secretTreeFromPaths(paths) {
+	const out = /* @__PURE__ */ new Map();
+	for (const path of paths) {
+		if (path.length === 0) continue;
+		insert(out, parseSecretStatePath(path.replace(/\[\]/g, `[${DEFAULT_ITEM_ID_KEY}]`)));
+	}
+	return out;
+}
+/** First retry of a secret the keychain could not serve; doubles to {@link SECRET_RETRY_MAX_MS}. */
+var SECRET_RETRY_FIRST_MS = 5e3;
+var SECRET_RETRY_MAX_MS = 5 * 6e4;
+/** Coalesces a burst of `keychain.changed` events into one re-resolve. */
+var SECRET_CHANGE_DEBOUNCE_MS = 250;
 /**
 * Base class for CamStack addons. Eliminates settings boilerplate:
 *
@@ -1324,6 +2014,25 @@ var BaseAddon = class {
 	settingsStoreReady = false;
 	/** Default config values. Provided via constructor. */
 	defaults;
+	/**
+	* Hidden-state paths that hold secrets (D787) — values the addon writes
+	* itself (`updateGlobalSettings`, `state()`) that no form field declares.
+	* Stored in the keychain exactly like a `password` field. Syntax:
+	* `'snapshotSigningKey'`, `'identity.pincode'`, `'tokens[userId].accessToken'`
+	* (`key[<id field>]` addresses array items by id, never by index).
+	*/
+	secretStatePaths = [];
+	_addonSecretTree = null;
+	_deviceSecretTree = null;
+	/** Refs the last resolved config pointed at — a change to one re-resolves. */
+	_configSecretRefs = /* @__PURE__ */ new Set();
+	_unresolvedSecrets = [];
+	_secretRetryTimer = null;
+	_secretRetryDelayMs = SECRET_RETRY_FIRST_MS;
+	_secretChangeTimer = null;
+	_secretChangeUnsub = null;
+	/** >0 while an OPERATOR's settings write is being applied. */
+	_operatorWriteDepth = 0;
 	constructor(defaults) {
 		this.defaults = defaults;
 		this._config = { ...defaults };
@@ -1359,8 +2068,18 @@ var BaseAddon = class {
 		return this._config;
 	}
 	async initialize(context) {
-		this._ctx = context;
+		const secrets = context.secrets;
+		this._ctx = secrets !== void 0 ? withSecretAwareSettings(context, {
+			secrets,
+			addonTree: () => this.addonSecretTree(),
+			deviceTree: () => this.deviceSecretTree(),
+			onOrphaned: (refs) => context.logger.warn("keychain refs dropped by a settings write could not be deleted", { meta: { refs: [...refs] } }),
+			isOperatorWrite: () => this._operatorWriteDepth > 0
+		}) : context;
 		await this.resolveConfig();
+		if (secrets !== void 0) this._secretChangeUnsub = secrets.onChange((ref) => {
+			if (this._configSecretRefs.has(ref)) this.scheduleSecretReresolve(SECRET_CHANGE_DEBOUNCE_MS);
+		});
 		const result = await this.onInitialize();
 		this.emitLifecycle(EventCategory.AddonStarted);
 		const normalized = normalizeAddonInitResult(result);
@@ -1393,6 +2112,12 @@ var BaseAddon = class {
 	*/
 	async onHubReachable() {}
 	async shutdown() {
+		this._secretChangeUnsub?.();
+		this._secretChangeUnsub = null;
+		if (this._secretRetryTimer !== null) clearTimeout(this._secretRetryTimer);
+		if (this._secretChangeTimer !== null) clearTimeout(this._secretChangeTimer);
+		this._secretRetryTimer = null;
+		this._secretChangeTimer = null;
 		this.emitLifecycle(EventCategory.AddonStopped);
 		if (this.autoEmitReadiness) this.emitReadinessForProviders("down");
 		await this.onShutdown();
@@ -1471,7 +2196,7 @@ var BaseAddon = class {
 		return hydrateSchema(schema, overlay ? {
 			...projected,
 			...overlay
-		} : projected);
+		} : projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The integration-level view of this addon's settings: exactly the sections
@@ -1520,7 +2245,7 @@ var BaseAddon = class {
 		return hydrateSchema({
 			...schema,
 			sections
-		}, projected);
+		}, projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The raw addon store PROJECTED onto the target node's bare per-node keys:
@@ -1574,18 +2299,50 @@ var BaseAddon = class {
 			value: result.value[key]
 		};
 	}
+	/**
+	* The OPERATOR's write — a settings form or an admin API call, dispatched by
+	* the kernel. Identical to {@link updateGlobalSettings}, except that a secret
+	* the operator sends is stored as sent even when it equals a pre-keychain
+	* inline value: the operator re-entering a password is a change, an addon
+	* writing back what it read is not (D787).
+	*/
+	async updateGlobalSettingsAsOperator(patch, nodeId) {
+		this._operatorWriteDepth++;
+		try {
+			await this.applyGlobalPatch(patch, nodeId);
+		} finally {
+			this._operatorWriteDepth--;
+		}
+	}
 	async updateGlobalSettings(patch, nodeId) {
+		await this.applyGlobalPatch(patch, nodeId);
+	}
+	/**
+	* REMOVE stored secrets — their keychain values and their markers (D787).
+	*
+	* Writing `''` to a secret field KEEPS what is stored (an empty string is
+	* what a defaults fallback writes back, and it must never destroy a
+	* credential), so code that means "forget this token" says so here. Without
+	* a keychain (an older kernel) it writes `''`, as such code always did.
+	*/
+	async clearSecrets(keys, nodeId) {
+		const tree = this.addonSecretTree();
+		const keychain = this._ctx?.secrets !== void 0;
+		const patch = {};
+		for (const key of keys) patch[key] = keychain && tree.has(key) ? SECRET_CLEAR : "";
+		await this.applyGlobalPatch(patch, nodeId);
+	}
+	async applyGlobalPatch(barePatch, nodeId) {
 		const keys = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
-		const barePatch = patch;
 		const scoped = keys.size > 0 ? scopePatch(barePatch, keys, target) : barePatch;
 		await this._ctx?.settings?.writeAddonStore(scoped);
 		if (target !== localNode) return;
 		await this.resolveConfig();
 		await this.onConfigChanged();
 		this.emitLifecycle(EventCategory.AddonUpdated, { level: "global" });
-		this.maybeAutoRestart(patch, this.globalSettingsSchema());
+		this.maybeAutoRestart(Object.keys(barePatch), this.globalSettingsSchema());
 	}
 	/**
 	* The set of field keys the global settings schema declares `perNode: true`
@@ -1610,7 +2367,7 @@ var BaseAddon = class {
 	* time to return its response before the addon is torn down and
 	* re-initialised by `AddonRegistryService.restartAddon`.
 	*/
-	maybeAutoRestart(patch, schema) {
+	maybeAutoRestart(patchKeys, schema) {
 		if (!schema) return;
 		const restartKeys = /* @__PURE__ */ new Set();
 		for (const section of schema.sections) for (const field of section.fields) {
@@ -1618,13 +2375,13 @@ var BaseAddon = class {
 			if (field.requiresRestart) restartKeys.add(field.key);
 		}
 		if (restartKeys.size === 0) return;
-		if (!Object.keys(patch).some((k) => restartKeys.has(k))) return;
+		if (!patchKeys.some((k) => restartKeys.has(k))) return;
 		const ctx = this._ctx;
 		if (!ctx) return;
 		const addonId = ctx.id;
 		setImmediate(() => {
 			ctx.api.addons?.restartAddon?.mutate({ addonId }).then(() => {
-				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: Object.keys(patch).filter((k) => restartKeys.has(k)) } });
+				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: patchKeys.filter((k) => restartKeys.has(k)) } });
 			}).catch((err) => {
 				ctx.logger.error("addon auto-restart failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
 			});
@@ -1633,7 +2390,7 @@ var BaseAddon = class {
 	async getDeviceSettings(deviceId) {
 		const schema = this.deviceSettingsSchema();
 		if (!schema) return { sections: [] };
-		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {});
+		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, { inlineSecretsAsViews: true });
 	}
 	async updateDeviceSettings(deviceId, patch) {
 		await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
@@ -1763,7 +2520,7 @@ var BaseAddon = class {
 	* selection at boot (absent scoped key ⇒ the constructor default wins).
 	*/
 	async resolveConfig() {
-		const stored = await this.readAddonStoreWithRetry();
+		const stored = await this.resolveStoredSecrets(await this.readAddonStoreWithRetry());
 		const perNode = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const resolved = { ...this.defaults };
@@ -1788,7 +2545,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: () => this.readAddonStoreWithRetry(),
+			read: async () => this.resolveStoredSecrets(await this.readAddonStoreWithRetry()),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeAddonStore(patch);
 			},
@@ -1805,7 +2562,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: async () => await this._ctx?.settings?.readDeviceStore(deviceId) ?? {},
+			read: async () => this.resolveStoredSecrets(await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, false),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
 			},
@@ -1817,6 +2574,70 @@ var BaseAddon = class {
 			} })
 		});
 	}
+	/** The addon store's secret tree: schema fields by TYPE, plus `secretStatePaths`. */
+	addonSecretTree() {
+		this._addonSecretTree ??= mergeSecretStatePaths(secretTreeFromSchema(this.globalSettingsSchema()), this.secretStatePaths);
+		return this._addonSecretTree;
+	}
+	deviceSecretTree() {
+		this._deviceSecretTree ??= secretTreeFromSchema(this.deviceSettingsSchema());
+		return this._deviceSecretTree;
+	}
+	/**
+	* Secrets of this addon's stored config that could not be resolved on the
+	* last read, with why. Non-empty means the addon is running WITHOUT them —
+	* an addon whose function needs one should report itself degraded rather
+	* than start on an empty credential.
+	*/
+	get unresolvedSecrets() {
+		return this._unresolvedSecrets;
+	}
+	/**
+	* Substitute every keychain marker in a stored blob with its value. With no
+	* keychain (no `ctx.secrets`) or no marker, the blob comes back unchanged.
+	* An unresolvable value is LEFT OUT (never `''`), logged by ref — never by
+	* value — and, when the cause can pass, retried with backoff. Nothing is
+	* ever written back from here.
+	*/
+	async resolveStoredSecrets(blob, trackForConfig = true) {
+		const secrets = this._ctx?.secrets;
+		if (secrets === void 0) return blob;
+		const refs = collectSecretMarkerRefs(blob);
+		if (trackForConfig) this._configSecretRefs = new Set(refs);
+		if (refs.length === 0) {
+			if (trackForConfig) this._unresolvedSecrets = [];
+			return blob;
+		}
+		const { value, unresolved } = await resolveSecretMarkers(blob, secrets);
+		if (trackForConfig) {
+			this._unresolvedSecrets = unresolved;
+			if (unresolved.length > 0) {
+				this._ctx?.logger?.error?.("secret unavailable — running without it, will retry", { meta: { secrets: unresolved.map((u) => ({
+					ref: u.ref,
+					reason: u.reason
+				})) } });
+				if (unresolved.some((u) => u.reason !== "missing" && u.reason !== "forbidden")) {
+					this.scheduleSecretReresolve(this._secretRetryDelayMs);
+					this._secretRetryDelayMs = Math.min(this._secretRetryDelayMs * 2, SECRET_RETRY_MAX_MS);
+				}
+			} else this._secretRetryDelayMs = SECRET_RETRY_FIRST_MS;
+		}
+		return value;
+	}
+	/** Re-resolve the config (a keychain-only change, or a retry) and apply it. */
+	scheduleSecretReresolve(delayMs) {
+		const timerOf = delayMs === SECRET_CHANGE_DEBOUNCE_MS ? "_secretChangeTimer" : "_secretRetryTimer";
+		if (this[timerOf] !== null) return;
+		const timer = setTimeout(() => {
+			this[timerOf] = null;
+			if (this._ctx === null) return;
+			this.resolveConfig().then(() => this.onConfigChanged()).catch((err) => {
+				this._ctx?.logger?.error?.("re-resolving secrets failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			});
+		}, delayMs);
+		timer.unref?.();
+		this[timerOf] = timer;
+	}
 	/**
 	* Wrap `ctx.settings.readAddonStore()` with a short retry budget so a
 	* transient settings-store outage (mid-restart of sqlite-settings, tsx-watch
@@ -1950,6 +2771,31 @@ var PeerBytesTicketSchema = zod.z.object({
 	*/
 	declaredBytes: zod.z.number().int().nonnegative().nullable()
 });
+/**
+* One store per PROCESS, even when two copies of this module are loaded (an
+* addon bundle next to the framework's): keyed on a registered symbol.
+*/
+var STORE_KEY = Symbol.for("camstack.keychain.known-secrets");
+function store() {
+	const existing = Reflect.get(globalThis, STORE_KEY);
+	if (existing !== void 0 && existing !== null) return existing;
+	const created = {
+		values: /* @__PURE__ */ new Map(),
+		compiled: null
+	};
+	Reflect.set(globalThis, STORE_KEY, created);
+	return created;
+}
+/** Replace every registered value inside `text` with its label. */
+function scrubKnownSecrets(text) {
+	const s = store();
+	const re = s.compiled;
+	if (re === null || text.length < 8) return text;
+	re.lastIndex = 0;
+	if (!re.test(text)) return text;
+	re.lastIndex = 0;
+	return text.replace(re, (match) => s.values.get(match) ?? "‹secret›");
+}
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = zod.z.enum([
 	"high",
@@ -5778,53 +6624,6 @@ var DERIVED_CAMERA_SILENCED_CAP_NAMES = [
 	"scene-monitor"
 ];
 /**
-* The value a redacted secret is replaced with on every read surface.
-*
-* It is also the WRITE-BACK token: an `upsertLocation` that sends this value
-* back for a key means "keep what is stored", which is what lets an operator
-* rename a location without retyping its password. A literal an operator could
-* plausibly choose as a real password would turn that convenience into a way
-* to lock yourself out, hence the sentinel shape.
-*/
-var REDACTED_SECRET = "__camstack_redacted__";
-/**
-* Every config key in `schema` whose value is a secret, including keys nested
-* inside `group` / `sub-tabs` containers.
-*/
-function collectSecretConfigKeys(schema) {
-	const keys = /* @__PURE__ */ new Set();
-	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
-	return keys;
-}
-function isRecord$3(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function sectionsOf(schema) {
-	if (!isRecord$3(schema)) return [];
-	const sections = schema["sections"];
-	return Array.isArray(sections) ? sections : [];
-}
-function fieldsOf(node) {
-	if (!isRecord$3(node)) return [];
-	const fields = node["fields"];
-	return Array.isArray(fields) ? fields : [];
-}
-function walkField(field, out) {
-	if (!isRecord$3(field)) return;
-	const type = field["type"];
-	const key = field["key"];
-	if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
-	if (type === "group") {
-		for (const child of fieldsOf(field)) walkField(child, out);
-		return;
-	}
-	if (type === "sub-tabs") {
-		const tabs = field["tabs"];
-		if (!Array.isArray(tabs)) return;
-		for (const tab of tabs) for (const child of fieldsOf(tab)) walkField(child, out);
-	}
-}
-/**
 * What the gate decided about a birth, from the CALLER's point of view.
 *
 * Deliberately not `ConfirmationVerdict`: `undecided` is not a birth decision
@@ -14025,6 +14824,270 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
 		})
 	}
 };
+/**
+* `keychain` — the hub's encrypted store of secret values (D787).
+*
+* Settings blobs never hold a secret: they hold a marker
+* `{"$secret":"secret://<owner>/<scope>/<fieldPath>","v":1}` and the value
+* lives here, AES-256-GCM under a data key that a master key wraps. This cap
+* is the OWNER's door to its own values: every method is owner-checked
+* against the CALLER, never against anything the caller claims.
+*
+* Who the caller is: the transport stamps `callerAddonId` into the args of a
+* call that crossed a process (the parent `LocalChildRegistry` from the UDS
+* connection, the agent from its child's connection carried in
+* `$hub-cap-fwd`'s envelope). A stamp always overwrites; a wire call with no
+* stamp has its claim stripped. Only a hub in-process caller may state its own
+* identity — `ctx.secrets` does that with the addon id closed over. This is
+* identity against BUGS and misrouting, not against a malicious addon (every
+* runner is the same OS user): see the threat model in
+* `docs/design/2026-10-08-secrets-keychain.md`.
+*
+* `callerAddonId` is deliberately NOT in any input schema: the tRPC router
+* parses the input, so a session can never supply it, and the internal mount
+* floors every method to admin anyway (D240).
+*
+* Internal: addons reach it through `ctx.secrets`, never directly.
+*/
+/** Why a value cannot be served right now. Never folded into "missing". */
+var KeychainUnavailableReasonSchema = zod.z.enum([
+	"key-missing",
+	"wrong-key",
+	"key-file-unreadable",
+	"store-unavailable",
+	"not-initialized",
+	"decrypt-failed"
+]);
+var KeychainStateSchema = zod.z.discriminatedUnion("state", [zod.z.object({ state: zod.z.literal("ready") }), zod.z.object({
+	state: zod.z.literal("locked"),
+	reason: KeychainUnavailableReasonSchema
+})]);
+var KeychainResolveEntrySchema = zod.z.discriminatedUnion("kind", [
+	zod.z.object({
+		kind: zod.z.literal("value"),
+		value: zod.z.string(),
+		version: zod.z.number().int()
+	}),
+	zod.z.object({ kind: zod.z.literal("missing") }),
+	zod.z.object({
+		kind: zod.z.literal("unavailable"),
+		reason: KeychainUnavailableReasonSchema
+	}),
+	zod.z.object({ kind: zod.z.literal("forbidden") })
+]);
+var KeychainResolveResultSchema = zod.z.record(zod.z.string(), KeychainResolveEntrySchema);
+/** Metadata of one stored value — never the value. */
+var KeychainSecretMetaSchema = zod.z.object({
+	ref: zod.z.string(),
+	owner: zod.z.string(),
+	/** Formatted scope (`global`, `node/<id>`, `device/<id>`, …). */
+	scope: zod.z.string(),
+	fieldPath: zod.z.string(),
+	version: zod.z.number().int(),
+	createdAt: zod.z.number(),
+	updatedAt: zod.z.number(),
+	/** `addon:<id>` | `user:<id>` | `system`. */
+	updatedBy: zod.z.string(),
+	/** Coarse — written at most once an hour per ref. `null` = never read. */
+	lastReadAt: zod.z.number().nullable()
+});
+var RefListSchema = zod.z.array(zod.z.string().min(1)).max(512);
+var keychainCapability = {
+	name: "keychain",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		/** Store (or replace) the caller's value at `ref`. Refused while locked. */
+		put: method(zod.z.object({
+			ref: zod.z.string().min(1),
+			value: zod.z.string().min(1)
+		}), zod.z.object({
+			ref: zod.z.string(),
+			version: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Resolve the caller's refs in one round-trip. A locked keychain answers
+		* `unavailable` per ref — never `missing`, never an empty value.
+		*/
+		resolve: method(zod.z.object({ refs: RefListSchema }), KeychainResolveResultSchema, { auth: "admin" }),
+		/** Remove the caller's refs. Unknown refs are ignored. */
+		delete: method(zod.z.object({ refs: RefListSchema }), zod.z.object({ deleted: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The caller's own refs, metadata only. */
+		listMeta: method(zod.z.object({}), zod.z.array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }),
+		/** Whether values can be served — the save path refuses a write while locked. */
+		getState: method(zod.z.object({}), KeychainStateSchema, { auth: "admin" })
+	}
+};
+/**
+* `keychain-admin` — the operator's view of the keychain (System → Secrets).
+*
+* Every method is `admin`. Two methods hand out material, each audited and
+* each named for exactly that: {@link keychainAdminCapability.methods.reveal}
+* (one value, shown briefly by the UI) and `downloadRecoveryKey` (the master
+* key itself, so the operator can keep a copy off the hub). Nothing else
+* returns a value.
+*
+* The master key's LOCATION is configuration, never an env var (D788):
+* `keychain.keyFile` in `config.yaml`, the OS keychain on a desktop hub, else
+* `<dataDir>/.keychain/master.key` — which sits beside the database in every
+* whole-volume backup, and the status says so.
+*/
+/** Where the master key in use came from. */
+var KeychainKeySourceKindSchema = zod.z.enum([
+	"config-file",
+	"previous-config-file",
+	"platform",
+	"default-file"
+]);
+var KeychainKeySourceSchema = zod.z.object({
+	kind: KeychainKeySourceKindSchema,
+	/** File sources only — a path is not a secret. */
+	path: zod.z.string().optional(),
+	/**
+	* True when a whole-volume backup of the data directory carries this key
+	* next to the database it protects (the default file). The page warns.
+	*/
+	sharesBackupWithDatabase: zod.z.boolean()
+});
+var KeychainStatusSchema = zod.z.object({
+	keychain: KeychainStateSchema,
+	/** The source of the master key in use; `null` while locked. */
+	keySource: KeychainKeySourceSchema.nullable(),
+	/** The source configured to be primary — differs from `keySource` while a rotation is pending. */
+	configuredSource: KeychainKeySourceSchema,
+	/** Short fingerprint of the master key in use (`HMAC(KEK, label)`, 16 hex). */
+	fingerprint: zod.z.string().nullable(),
+	activeKeyId: zod.z.string().nullable(),
+	/**
+	* The keychain unlocked with a NON-primary source: the configured primary
+	* key is not the one that wraps the data key yet. `rotateMasterKey` moves it.
+	*/
+	rotationPending: zod.z.boolean(),
+	/** Wrapped copies of the data key under a previous master key, kept until purged. */
+	retiredWraps: zod.z.number().int(),
+	recoveryKeyDownloadedAt: zod.z.number().nullable(),
+	secretCount: zod.z.number().int()
+});
+/**
+* Whether a stored value is still pointed at by its owner's settings.
+* `unknown` is a first-class answer: a scope whose blob could not be read is
+* never reported as an orphan (and never deleted as one).
+*/
+var KeychainSecretUsageSchema = zod.z.enum([
+	"in-use",
+	"orphan",
+	"unknown"
+]);
+var KeychainAdminSecretSchema = KeychainSecretMetaSchema.extend({ usage: KeychainSecretUsageSchema });
+var KeychainAuditActionSchema = zod.z.enum([
+	"put",
+	"delete",
+	"reveal",
+	"rotate-master-key",
+	"purge-retired-keys",
+	"download-recovery-key",
+	"delete-orphans",
+	"reset",
+	"initialize"
+]);
+var KeychainAuditEntrySchema = zod.z.object({
+	id: zod.z.string(),
+	at: zod.z.number(),
+	action: KeychainAuditActionSchema,
+	/** `addon:<id>` | `user:<id>` | `system`. */
+	actor: zod.z.string(),
+	ref: zod.z.string().nullable(),
+	detail: zod.z.string().nullable()
+});
+var keychainAdminCapability = {
+	name: "keychain-admin",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		status: method(zod.z.object({}), KeychainStatusSchema, { auth: "admin" }),
+		listSecrets: method(zod.z.object({}), zod.z.array(KeychainAdminSecretSchema).readonly(), { auth: "admin" }),
+		listAudit: method(zod.z.object({ limit: zod.z.number().int().min(1).max(500).optional() }), zod.z.array(KeychainAuditEntrySchema).readonly(), { auth: "admin" }),
+		/**
+		* Show one value to the operator. Audited. The UI hides it again after a
+		* few seconds; nothing caches it.
+		*/
+		reveal: method(zod.z.object({ ref: zod.z.string().min(1) }), zod.z.object({
+			value: zod.z.string(),
+			version: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/** Delete refs no owner points at any more. Re-checked here; `unknown` is kept. */
+		deleteOrphans: method(zod.z.object({ refs: zod.z.array(zod.z.string().min(1)).max(1e3) }), zod.z.object({
+			deleted: zod.z.array(zod.z.string()).readonly(),
+			kept: zod.z.array(zod.z.object({
+				ref: zod.z.string(),
+				usage: KeychainSecretUsageSchema
+			})).readonly()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* Wrap the data key under the configured primary master key.
+		*
+		* Pending rotation (the keychain unlocked with a previous source): re-wrap
+		* under the primary. Otherwise, with the default file as primary: generate
+		* a new master key, write it there, re-wrap. A file or OS-keychain primary
+		* that is already in use cannot be replaced from here — put the new key at
+		* the source, keep the old one as `keychain.previousKeyFile`, restart, and
+		* rotate. No value is re-encrypted either way; the previous wrap is kept
+		* (retired) until purged.
+		*/
+		rotateMasterKey: method(zod.z.object({}), zod.z.object({
+			fingerprint: zod.z.string(),
+			keySource: KeychainKeySourceSchema
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		purgeRetiredKeys: method(zod.z.object({}), zod.z.object({ purged: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/** The master key, base64. Audited; marks the recovery copy as taken. */
+		downloadRecoveryKey: method(zod.z.object({}), zod.z.object({
+			key: zod.z.string(),
+			fingerprint: zod.z.string(),
+			keySource: KeychainKeySourceSchema
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* Lost-key recovery: archive every stored value into a
+		* `keychain:secrets-orphaned-<ts>` table and start over with a new data
+		* key. Every secret field then reads "not set". Requires the typed
+		* confirmation {@link KEYCHAIN_RESET_CONFIRMATION}.
+		*/
+		resetKeychain: method(zod.z.object({ confirm: zod.z.literal("RESET KEYCHAIN") }), zod.z.object({
+			archivedCollection: zod.z.string().nullable(),
+			archived: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		})
+	}
+};
 var decoderCapability = {
 	name: "decoder",
 	scope: "system",
@@ -15444,7 +16507,11 @@ var DeviceRegisterPayloadSchema = zod.z.object({
 var DeviceRemovePayloadSchema = zod.z.object({ deviceId: zod.z.number() });
 var DevicePersistConfigPayloadSchema = zod.z.object({
 	deviceId: zod.z.number(),
-	data: zod.z.record(zod.z.string(), zod.z.unknown())
+	data: zod.z.record(zod.z.string(), zod.z.unknown()),
+	/** The paths the device's schema declares secret (D783), when the caller
+	*  knows them — those values are kept in the keychain, not the blob (D787).
+	*  Absent: the paths the device last reported at `registerDevice` apply. */
+	secretConfigPaths: zod.z.array(zod.z.string()).optional()
 });
 /** What a migration actually did, per switch. `unreachable` is a first-class
 *  answer: a camera that could not be asked is not a camera that was silenced. */
@@ -24162,8 +25229,23 @@ var RetrainMacroClassSchema = zod.z.enum([
 ]);
 /** A subject to learn, or a phantom to unlearn (taught by OMISSION). */
 var RetrainAnnotationKindSchema = zod.z.enum(["subject", "model_error"]);
-/** Did a human draw this box, or did the assist propose it? */
-var RetrainAnnotationSourceSchema = zod.z.enum(["operator", "assist"]);
+/**
+* Where a box came from. A machine-sourced box is a DRAFT on the page until
+* the operator confirms it; once saved it keeps its source as provenance.
+*
+* - `operator` — drawn by hand.
+* - `assist`   — proposed by a detector run on the copy (the camera's own
+*   model, or a larger teacher model).
+* - `pipeline` — the box the live pipeline actually drew on that frame, read
+*   back from the track store (never a re-run).
+* - `llm`      — proposed by a vision-capable LLM profile.
+*/
+var RetrainAnnotationSourceSchema = zod.z.enum([
+	"operator",
+	"assist",
+	"pipeline",
+	"llm"
+]);
 /** Normalised `[0,1]` rectangle against the FULL frame — the canonical form. */
 var RetrainBboxSchema = zod.z.object({
 	x: zod.z.number(),
@@ -24181,7 +25263,8 @@ var RetrainBboxSchema = zod.z.object({
 */
 var RetrainAnnotationSchema = zod.z.object({
 	id: zod.z.string(),
-	trackId: zod.z.string(),
+	/** The frame's track. Absent on a recording still, which has none. */
+	trackId: zod.z.string().optional(),
 	deviceId: zod.z.number(),
 	/** The COPY in retrain storage — never the source track's media key. */
 	mediaKey: zod.z.string(),
@@ -24230,13 +25313,47 @@ var RetrainFrameCandidateSchema = zod.z.object({
 	*  fail, whatever became of the original. */
 	copied: zod.z.boolean()
 });
+/**
+* One box the live pipeline drew on a copied frame — what a correction starts
+* from. Derived when the frame is listed, from the track store: the subject
+* box recorded on the source media row when there is one, else the track
+* position nearest the frame's capture time. Never stored as an annotation
+* until the operator confirms it.
+*/
+var RetrainPipelineBoxSchema = zod.z.object({
+	/** Normalised `[0,1]` against the full frame. */
+	bbox: RetrainBboxSchema,
+	macroClass: RetrainMacroClassSchema,
+	label: zod.z.string().optional(),
+	subLabel: zod.z.string().optional(),
+	/** The detection score of the position used, when it was recorded. */
+	score: zod.z.number().optional(),
+	/** The root model that produced the track, when it was recorded. */
+	modelId: zod.z.string().optional(),
+	trackId: zod.z.string(),
+	/** `subject-box`: recorded on this very frame. `position`: the track's
+	*  position nearest the capture time, `deltaMs` away. */
+	basis: zod.z.enum(["subject-box", "position"]),
+	deltaMs: zod.z.number()
+});
+/**
+* Where a retrain frame came from: a TRACK's stored media (copy-on-select),
+* or the RECORDING at an instant — the frame a model saw nothing in has no
+* track at all.
+*/
+var RetrainFrameOriginSchema = zod.z.enum(["track", "recording"]);
 /** A frame the dataset OWNS: bytes copied at selection time. */
 var RetrainFrameSchema = zod.z.object({
 	frameId: zod.z.string(),
 	deviceId: zod.z.number(),
-	trackId: zod.z.string(),
-	/** Provenance only. It may already point at nothing — that is expected. */
-	sourceMediaId: zod.z.number().int(),
+	origin: RetrainFrameOriginSchema,
+	/** The track it was copied from. Absent on a recording still. */
+	trackId: zod.z.string().optional(),
+	/** Provenance only. It may already point at nothing — that is expected.
+	*  Absent on a recording still. */
+	sourceMediaId: zod.z.number().int().optional(),
+	/** A recording still: the playhead instant it was taken at. */
+	epochMs: zod.z.number().optional(),
 	sourceKind: MediaFileKindEnum,
 	sizeBytes: zod.z.number().int(),
 	width: zod.z.number().int(),
@@ -24247,7 +25364,12 @@ var RetrainFrameSchema = zod.z.object({
 	/** The operator's "every subject in this frame is boxed". Detector
 	*  evaluation keeps only complete frames: an unboxed subject would count as
 	*  a false positive. */
-	complete: zod.z.boolean()
+	complete: zod.z.boolean(),
+	/** The boxes the pipeline drew on this frame. Present on list answers;
+	*  empty when nothing the track store holds can be placed on it. */
+	pipelineBoxes: zod.z.array(RetrainPipelineBoxSchema).readonly().optional(),
+	/** The named collections this frame belongs to. Present on list answers. */
+	collectionIds: zod.z.array(zod.z.string()).readonly().optional()
 });
 /** Why a copy-on-select could not be honoured — named, never a silent skip. */
 var RetrainCopyRefusalSchema = zod.z.enum([
@@ -24278,6 +25400,8 @@ var RetrainFrameListSchema = zod.z.object({
 var RetrainExportFilterSchema = zod.z.object({
 	deviceIds: zod.z.array(zod.z.number()).optional(),
 	frameIds: zod.z.array(zod.z.string()).max(2e4).optional(),
+	/** Only frames in at least one of these named collections. */
+	collectionIds: zod.z.array(zod.z.string()).max(200).optional(),
 	batchId: zod.z.string().optional(),
 	/** Only frames the operator marked complete (all subjects boxed). */
 	completeOnly: zod.z.boolean().optional()
@@ -24342,6 +25466,109 @@ var RetrainAssistResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
 	reason: zod.z.string(),
 	detail: zod.z.string().optional()
 })]);
+/** A named set over the retrain corpus — membership only, it owns no pixels. */
+var RetrainCollectionSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	createdAt: zod.z.number(),
+	frameCount: zod.z.number().int()
+});
+var RetrainCollectionCreateResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("created"),
+	collection: RetrainCollectionSchema
+}), zod.z.object({
+	kind: zod.z.literal("refused"),
+	reason: zod.z.enum(["empty-name", "duplicate-name"])
+})]);
+var RetrainCollectionRenameResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("renamed"),
+	collection: RetrainCollectionSchema
+}), zod.z.object({
+	kind: zod.z.literal("refused"),
+	reason: zod.z.enum([
+		"empty-name",
+		"duplicate-name",
+		"unknown-collection"
+	])
+})]);
+/**
+* The outcome of adding the frame at a recording instant. Every refusal is
+* named: `still-unavailable` (not recording, a gap, or an undecodable frame —
+* `detail` says which), `still-busy` (the recorder is at its decode bound; try
+* again), `unreadable-image`, `write-failed`, `unknown-collection`.
+*/
+var AddRetrainFrameFromRecordingResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("added"),
+	collectionId: zod.z.string(),
+	frame: RetrainFrameSchema,
+	/** The moment was already in the dataset; nothing was decoded. */
+	reused: zod.z.boolean()
+}), zod.z.object({
+	kind: zod.z.literal("refused"),
+	reason: zod.z.enum([
+		"unknown-collection",
+		"still-unavailable",
+		"still-busy",
+		"unreadable-image",
+		"write-failed"
+	]),
+	detail: zod.z.string().optional()
+})]);
+/** A vision LLM profile the AI assist may use, and where it sends the frame. */
+var RetrainAssistProfileSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	model: zod.z.string(),
+	kind: zod.z.string(),
+	/** `true` when the frame would leave the house (a cloud vendor, or an
+	*  endpoint that is not on the local network). The page confirms each such
+	*  run, and the provider refuses one without `allowCloud`. */
+	leavesHouse: zod.z.boolean()
+});
+/** A box the AI assist proposed: a draft, plus the model's own reason. */
+var RetrainLlmProposalSchema = RetrainAnnotationDraftSchema.extend({ reason: zod.z.string() });
+/** What the AI assist said about a box that was already on the canvas. */
+var RetrainLlmReviewSchema = zod.z.object({
+	/** The `ref` the page sent the box under. */
+	ref: zod.z.string(),
+	verdict: zod.z.enum([
+		"confirmed",
+		"wrong-class",
+		"not-an-object",
+		"uncertain"
+	]),
+	suggestedClass: RetrainMacroClassSchema.optional(),
+	reason: zod.z.string()
+});
+/**
+* The AI assist's answer. `proposed` carries drafts (`source: 'llm'`, the
+* model and its confidence) and reviews; items the model got wrong (a box off
+* the frame, an unasked class, an unknown ref) are dropped and counted in
+* `rejected`. A whole answer that is not the schema is `malformed-answer`.
+*/
+var RetrainLlmAssistResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("proposed"),
+	profileId: zod.z.string(),
+	model: zod.z.string(),
+	/** The frame was sent outside the house for this answer. */
+	leftHouse: zod.z.boolean(),
+	proposals: zod.z.array(RetrainLlmProposalSchema).readonly(),
+	reviews: zod.z.array(RetrainLlmReviewSchema).readonly(),
+	rejected: zod.z.number().int()
+}), zod.z.object({
+	kind: zod.z.literal("refused"),
+	reason: zod.z.enum([
+		"unknown-frame",
+		"unreadable-frame",
+		"unknown-profile",
+		"profile-disabled",
+		"no-vision",
+		"cloud-not-confirmed",
+		"llm-error",
+		"malformed-answer"
+	]),
+	detail: zod.z.string().optional()
+})]);
 /** The outcome of a lifecycle move owned by the retrain page. */
 var RetrainTransitionResultSchema = zod.z.object({
 	trackId: zod.z.string(),
@@ -25528,7 +26755,7 @@ var pipelineAnalyticsCapability = {
 		*  a frame leaves the dataset before export. */
 		deselectRetrainFrame: method(zod.z.object({
 			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
+			trackId: zod.z.string().optional(),
 			frameId: zod.z.string()
 		}), zod.z.object({
 			removed: zod.z.boolean(),
@@ -25571,7 +26798,8 @@ var pipelineAnalyticsCapability = {
 		*/
 		proposeRetrainAnnotations: method(zod.z.object({
 			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
+			/** The frame's track, when it has one — checked against the frame. */
+			trackId: zod.z.string().optional(),
 			frameId: zod.z.string(),
 			subject: RetrainAssistSubjectSchema,
 			/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
@@ -25580,8 +26808,12 @@ var pipelineAnalyticsCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Every annotation on a track, oldest first. */
-		listRetrainAnnotations: method(zod.z.object({ trackId: zod.z.string() }), zod.z.array(RetrainAnnotationSchema).readonly(), {
+		/** Every annotation on a track, or on named frames (a recording still has
+		*  no track), oldest first. One of the two is required. */
+		listRetrainAnnotations: method(zod.z.object({
+			trackId: zod.z.string().optional(),
+			frameIds: zod.z.array(zod.z.string()).max(2e3).optional()
+		}), zod.z.array(RetrainAnnotationSchema).readonly(), {
 			kind: "query",
 			auth: "admin"
 		}),
@@ -25600,7 +26832,8 @@ var pipelineAnalyticsCapability = {
 		*/
 		saveRetrainAnnotations: method(zod.z.object({
 			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
+			/** The frame's track, when it has one — checked against the frame. */
+			trackId: zod.z.string().optional(),
 			frameId: zod.z.string(),
 			annotations: zod.z.array(RetrainAnnotationDraftSchema)
 		}), zod.z.array(RetrainAnnotationSchema).readonly(), {
@@ -25663,7 +26896,7 @@ var pipelineAnalyticsCapability = {
 		*/
 		setRetrainFrameComplete: method(zod.z.object({
 			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
+			trackId: zod.z.string().optional(),
 			frameId: zod.z.string(),
 			complete: zod.z.boolean()
 		}), RetrainFrameSchema, {
@@ -25686,6 +26919,115 @@ var pipelineAnalyticsCapability = {
 			auth: "admin",
 			timeoutMs: 60 * 6e4
 		}),
+		/** The enabled, vision-capable LLM profiles, each saying whether a frame
+		*  sent to it leaves the house. */
+		listRetrainAssistProfiles: method(zod.z.object({}), zod.z.array(RetrainAssistProfileSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* Ask a vision LLM (the `llm` capability) about ONE copied frame: list the
+		* objects of `classes` with boxes, and review the boxes already on the
+		* canvas (sent by `ref`). Answers drafts (`source: 'llm'`) and reviews —
+		* nothing is stored, nothing is accepted. A profile that sends the frame
+		* outside the house is refused unless `allowCloud` says the operator
+		* confirmed this run.
+		*/
+		proposeRetrainAnnotationsWithLlm: method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string().optional(),
+			frameId: zod.z.string(),
+			profileId: zod.z.string(),
+			classes: zod.z.array(RetrainMacroClassSchema).min(1),
+			boxes: zod.z.array(zod.z.object({
+				ref: zod.z.string(),
+				bbox: RetrainBboxSchema,
+				macroClass: RetrainMacroClassSchema,
+				label: zod.z.string().optional()
+			})).max(50),
+			allowCloud: zod.z.boolean()
+		}), RetrainLlmAssistResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 18e4
+		}),
+		/**
+		* Create a named collection — a set over the retrain corpus ("packages
+		* porch night"). Names are unique case-insensitively and never empty;
+		* both refusals are named.
+		*/
+		createRetrainCollection: method(zod.z.object({ name: zod.z.string().max(120) }), RetrainCollectionCreateResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Every collection, newest first, with its frame count. */
+		listRetrainCollections: method(zod.z.object({}), zod.z.array(RetrainCollectionSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		renameRetrainCollection: method(zod.z.object({
+			id: zod.z.string(),
+			name: zod.z.string().max(120)
+		}), RetrainCollectionRenameResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Delete a collection. Its recording stills that no other collection
+		* holds are deleted with their annotations (nothing else reaches them);
+		* frames copied from tracks always stay in the dataset.
+		*/
+		deleteRetrainCollection: method(zod.z.object({ id: zod.z.string() }), zod.z.object({
+			deleted: zod.z.boolean(),
+			removedFrames: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Add the frame at a recording instant to a collection — the frame the
+		* model may have seen NOTHING in. The recorder re-decodes the native
+		* frame at `epochMs`; the dataset copies it (trackless, durable). The same
+		* moment twice is one copy. Every refusal is named.
+		*/
+		addRetrainFrameFromRecording: method(zod.z.object({
+			collectionId: zod.z.string(),
+			deviceId: zod.z.number(),
+			epochMs: zod.z.number()
+		}), AddRetrainFrameFromRecordingResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/** Add frames already in the dataset to a collection. */
+		addRetrainFramesToCollection: method(zod.z.object({
+			collectionId: zod.z.string(),
+			frameIds: zod.z.array(zod.z.string()).min(1).max(500)
+		}), zod.z.object({
+			added: zod.z.number().int(),
+			alreadyMember: zod.z.number().int(),
+			unknownFrameIds: zod.z.array(zod.z.string()).readonly()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Remove a frame from a collection. A recording still left in no
+		*  collection is deleted with its annotations (`deletedFrame`). */
+		removeRetrainFrameFromCollection: method(zod.z.object({
+			collectionId: zod.z.string(),
+			frameId: zod.z.string()
+		}), zod.z.object({
+			removed: zod.z.boolean(),
+			deletedFrame: zod.z.boolean()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The frames of a collection, with their pipeline boxes. */
+		listRetrainCollectionFrames: method(zod.z.object({ collectionId: zod.z.string() }), zod.z.array(RetrainFrameSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
 		/**
 		* The media an EVENT owns.
 		*
@@ -26626,13 +27968,31 @@ var RecommendationReasonSchema = zod.z.discriminatedUnion("kind", [
 	zod.z.object({
 		kind: zod.z.literal("no-family-build"),
 		format: ModelFormatSchema$1
+	}),
+	zod.z.object({
+		kind: zod.z.literal("kept-custom-pin"),
+		modelId: zod.z.string(),
+		deviceKey: zod.z.string()
 	})
 ]);
+/** Why a device is left exactly as it is, whatever the plan would pick (D786). */
+var KeptReasonSchema = zod.z.enum(["custom-pin"]);
+/**
+* Where a choice's latency came from (D791): this node's own benchmark
+* result, or the hardware-class table. Measured on the node beats the table.
+*/
+var LatencySourceSchema = zod.z.discriminatedUnion("kind", [zod.z.object({ kind: zod.z.literal("table") }), zod.z.object({
+	kind: zod.z.literal("node-benchmark"),
+	resultId: zod.z.string(),
+	measuredAtMs: zod.z.number()
+})]);
 var DeviceModelChoiceSchema = zod.z.object({
 	modelId: zod.z.string(),
 	p50Ms: zod.z.number(),
 	fps: zod.z.number(),
 	measured: zod.z.boolean(),
+	/** Absent on a plan from before D791 — read as the table. */
+	source: LatencySourceSchema.optional(),
 	/** Parallel sessions at the camera rate with the headroom kept free: ⌊fps × (1 − headroom) / camera fps⌋. */
 	capacitySessions: zod.z.number(),
 	personRecall: zod.z.number()
@@ -26643,6 +28003,8 @@ var DeviceRecommendationSchema = zod.z.object({
 	enabled: zod.z.boolean(),
 	available: zod.z.boolean(),
 	chosen: DeviceModelChoiceSchema.nullable(),
+	/** Present when the device is kept as is: Apply writes nothing on it. */
+	kept: KeptReasonSchema.optional(),
 	reasons: zod.z.array(RecommendationReasonSchema).readonly()
 });
 var NodeRecommendationSchema = zod.z.object({
@@ -26696,6 +28058,17 @@ var AutoTuneWarningSchema = zod.z.discriminatedUnion("kind", [
 		kind: zod.z.literal("coral-enabled"),
 		nodeId: zod.z.string(),
 		deviceKey: zod.z.string()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("custom-pin-kept"),
+		nodeId: zod.z.string(),
+		deviceKey: zod.z.string().nullable(),
+		deviceId: zod.z.number().nullable(),
+		modelId: zod.z.string()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("custom-registry-unreadable"),
+		error: zod.z.string()
 	})
 ]);
 var AutoTuneOptionsSchema = zod.z.object({
@@ -26874,13 +28247,14 @@ var SuggestSharesResultSchema = zod.z.object({
 	nodes: zod.z.array(SuggestedNodeShareSchema).readonly()
 });
 /**
-* Where the node and device shares come from (D750, D755).
-*  - `hardware` (default) — computed by the system from each node's static
-*    capacity (its accelerators at their Auto tune models, from the measured
-*    latency table), recomputed whenever a node or device joins, leaves, is
-*    switched on or off, or changes model. No load input.
-*  - `benchmark` — the same, from each node's measured capacity (node
-*    benchmark results); a node without results falls back to `hardware`.
+* Where the node and device shares come from (D750, D755, D791).
+*  - `benchmark` (default since D791) — each node's capacity as its own node
+*    benchmark measured it; a node without fresh results is sized from
+*    `hardware` and says so. Measured on the node beats the table.
+*  - `hardware` — computed from each node's static capacity only (its
+*    accelerators at their Auto tune models, from the latency table).
+*  Both are recomputed whenever a node or device joins, leaves, is switched
+*  on or off, changes model, or a benchmark result is written. No load input.
 *  - `manual` — the operator's stored sliders.
 * Either way a node or device that cannot take sessions gives its share to
 * the others in proportion; the stored values are never rewritten for that.
@@ -26929,6 +28303,368 @@ var EffectiveSharesSchema = zod.z.object({
 	nodeWeights: zod.z.record(zod.z.string(), zod.z.number()),
 	deviceWeights: zod.z.record(zod.z.string(), zod.z.record(zod.z.string(), zod.z.number()))
 });
+/**
+* Wire shapes of the node benchmark (D791): the operator's plan, the
+* preflight the confirmation shows, the run the orchestrator owns, what the
+* measuring runner reports, and the result rows Auto tune and the automatic
+* shares read.
+*
+* ONE node at a time, owned by the pipeline orchestrator. While a run is
+* active the cluster is in BENCHMARK MODE for that node: it is not a
+* detection candidate, camera pins naming it are ignored so its sessions move
+* elsewhere, and both come back when the mode ends — after a crash or a hub
+* restart too (a persisted manifest, reconciled against the registry).
+*
+* Two measurements, both on the node, driven by its own runner (frames never
+* cross a process at frame rate, D9):
+*  - `device` — one accelerator × one candidate detector, root only, open
+*    loop: how many streams at the camera rate it carries inside the frame
+*    interval;
+*  - `pipeline` — the chosen detector plus the operator's detail steps
+*    (faces, plates, classifiers, CLIP…), on varied frames from the bench
+*    clip: how many parallel sessions the node carries before latency, drops,
+*    CPU, RAM or the event loop give out.
+*/
+/** Defaults and bounds, one place. */
+var NODE_BENCHMARK_DEFAULTS = {
+	fpsPerStream: 10,
+	budgetMinutes: 45,
+	minBudgetMinutes: 10,
+	maxBudgetMinutes: 120,
+	/** A result older than this no longer beats the table. */
+	staleAfterDays: 30,
+	/** Warm-in per ramp step (not accounted). */
+	settleSec: 5,
+	/** Accounted window per ramp step. */
+	measureSec: 20,
+	/** Longest the drain may take before the run is refused. */
+	drainTimeoutSec: 120,
+	/** Candidate models per device in one run. */
+	maxModelsPerDevice: 6
+};
+/** The two measurements a run can make. */
+var NodeBenchmarkPhaseSchema = zod.z.enum(["device", "pipeline"]);
+var NodeBenchmarkDevicePlanSchema = zod.z.object({
+	/** `<backend>:<device>` — `openvino:npu`, `coreml:all`, `cpu`. */
+	deviceKey: zod.z.string().min(1),
+	/**
+	* Root detector candidates for the `device` measurement, in the order
+	* measured. The FIRST is the one the `pipeline` measurement runs.
+	*/
+	modelIds: zod.z.array(zod.z.string().min(1)).min(1).max(NODE_BENCHMARK_DEFAULTS.maxModelsPerDevice)
+});
+/** What the operator confirmed. */
+var NodeBenchmarkPlanSchema = zod.z.object({
+	nodeId: zod.z.string().min(1),
+	devices: zod.z.array(NodeBenchmarkDevicePlanSchema).min(1),
+	/** Which measurements run. At least one. */
+	phases: zod.z.array(NodeBenchmarkPhaseSchema).min(1).default(["device", "pipeline"]),
+	/**
+	* Detail steps (catalog step ids under the root: faces, plates,
+	* classifiers, CLIP…) the `pipeline` measurement enables. The root
+	* detector always runs.
+	*/
+	steps: zod.z.array(zod.z.string().min(1)).default([]),
+	/** Offered rate of one stream / session. */
+	fpsPerStream: zod.z.number().int().min(1).max(30).default(NODE_BENCHMARK_DEFAULTS.fpsPerStream),
+	/** Hard deadline: the mode ends and the cluster is restored when it passes. */
+	budgetMinutes: zod.z.number().int().min(NODE_BENCHMARK_DEFAULTS.minBudgetMinutes).max(NODE_BENCHMARK_DEFAULTS.maxBudgetMinutes).default(NODE_BENCHMARK_DEFAULTS.budgetMinutes),
+	/** Keep the models the run downloaded (default: delete what was not installed before). */
+	keepDownloadedModels: zod.z.boolean().default(false),
+	/** Start although the other nodes' capacity does not cover the sessions running now. */
+	acceptInsufficientHeadroom: zod.z.boolean().default(false)
+});
+/** Why a run cannot start. `overridable` ones are lifted by a plan flag. */
+var NodeBenchmarkRefusalKindSchema = zod.z.enum([
+	"benchmark-active",
+	"node-offline",
+	"unknown-device",
+	"no-phase",
+	"insufficient-headroom"
+]);
+var NodeBenchmarkRefusalSchema = zod.z.object({
+	kind: NodeBenchmarkRefusalKindSchema,
+	detail: zod.z.string(),
+	overridable: zod.z.boolean()
+});
+/** A camera whose detection leaves the node for the run. */
+var NodeBenchmarkMovingCameraSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	/** Placed on the node now (a standing attach or a running session). */
+	placedOnNode: zod.z.boolean(),
+	/** A node pin naming this node, ignored for the run. */
+	pinnedToNode: zod.z.boolean()
+});
+/** A camera that cannot leave: no other node can obtain its frames. */
+var NodeBenchmarkStayingCameraSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	reason: zod.z.literal("only-frame-source")
+});
+var NodeBenchmarkPreflightSchema = zod.z.object({
+	nodeId: zod.z.string(),
+	online: zod.z.boolean(),
+	moving: zod.z.array(NodeBenchmarkMovingCameraSchema).readonly(),
+	/** Keep running on the node during the run; the result is flagged contaminated. */
+	staying: zod.z.array(NodeBenchmarkStayingCameraSchema).readonly(),
+	estimatedDurationMs: zod.z.number(),
+	/** The run ends and the cluster is restored at the latest after this long. */
+	budgetMs: zod.z.number(),
+	phases: zod.z.array(NodeBenchmarkPhaseSchema).readonly(),
+	steps: zod.z.array(zod.z.string()).readonly(),
+	devices: zod.z.array(NodeBenchmarkDevicePlanSchema).readonly(),
+	/** Parallel sessions the cluster runs now, and what the other nodes can carry. */
+	headroom: zod.z.object({
+		sessionsNow: zod.z.number(),
+		otherNodesCapacitySessions: zod.z.number().nullable()
+	}),
+	refusals: zod.z.array(NodeBenchmarkRefusalSchema).readonly(),
+	canStart: zod.z.boolean()
+});
+/** Where the measuring runner is. */
+var NodeBenchProgressSchema = zod.z.object({
+	phase: zod.z.enum([
+		"preparing",
+		"device",
+		"pipeline",
+		"cleanup"
+	]),
+	deviceKey: zod.z.string().nullable(),
+	modelId: zod.z.string().nullable(),
+	/** Streams (device) or sessions (pipeline) of the step running now. */
+	load: zod.z.number().nullable(),
+	cellsDone: zod.z.number(),
+	cellsTotal: zod.z.number(),
+	message: zod.z.string()
+});
+/** What limited a ramp. `none` = the ramp ran out of steps still passing. */
+var NodeBenchLimitSchema = zod.z.enum([
+	"p95",
+	"drops",
+	"errors",
+	"stall",
+	"cpu",
+	"ram",
+	"none"
+]);
+var NodeBenchRampStepSchema = zod.z.object({
+	load: zod.z.number(),
+	pass: zod.z.boolean(),
+	p95Ms: zod.z.number(),
+	dropRatio: zod.z.number(),
+	/** Completed frames per second over the accounted window. */
+	fps: zod.z.number(),
+	cpuPct: zod.z.number().nullable(),
+	ramFreePct: zod.z.number().nullable(),
+	failReasons: zod.z.array(zod.z.string()).readonly()
+});
+/** One measured device × detector (the `device` measurement). */
+var NodeBenchDeviceCellSchema = zod.z.object({
+	phase: zod.z.literal("device"),
+	deviceKey: zod.z.string(),
+	modelId: zod.z.string(),
+	/** Single-stream latency (the K = 1 step). */
+	p50Ms: zod.z.number(),
+	p95Ms: zod.z.number(),
+	p99Ms: zod.z.number(),
+	/** Frames per second sustained at the last passing step. */
+	fps: zod.z.number(),
+	/** Streams at the camera rate the device carried inside the frame interval; 0 = not even one. */
+	kMax: zod.z.number(),
+	limitedBy: NodeBenchLimitSchema,
+	/** First call (model load + warm-up). */
+	warmupMs: zod.z.number(),
+	ramp: zod.z.array(NodeBenchRampStepSchema).readonly()
+});
+/** One measured pipeline (the `pipeline` measurement) on a device. */
+var NodeBenchPipelineCellSchema = zod.z.object({
+	phase: zod.z.literal("pipeline"),
+	deviceKey: zod.z.string(),
+	modelId: zod.z.string(),
+	steps: zod.z.array(zod.z.string()).readonly(),
+	/** Parallel sessions at the camera rate the node carried; 0 = not even one. */
+	maxSessions: zod.z.number(),
+	limitedBy: NodeBenchLimitSchema,
+	/** Detail steps that produced at least one result on the clip — a step that never fired measured nothing. */
+	stepsFired: zod.z.array(zod.z.string()).readonly(),
+	warmupMs: zod.z.number(),
+	ramp: zod.z.array(NodeBenchRampStepSchema).readonly()
+});
+var NodeBenchCellSchema = zod.z.discriminatedUnion("phase", [NodeBenchDeviceCellSchema, NodeBenchPipelineCellSchema]);
+/**
+* What a result was measured ON. A result whose fingerprint no longer matches
+* the node no longer beats the table.
+*/
+var NodeBenchFingerprintSchema = zod.z.object({
+	pipelineVersion: zod.z.string().nullable(),
+	cpuModel: zod.z.string().nullable(),
+	ramGb: zod.z.number().nullable(),
+	os: zod.z.string().nullable(),
+	/** Per device: the pool the cells ran on (runtime + tuning). */
+	pools: zod.z.record(zod.z.string(), zod.z.object({
+		runtime: zod.z.string(),
+		numWorkers: zod.z.number(),
+		concurrency: zod.z.number(),
+		batchMode: zod.z.string()
+	})).default({})
+});
+/** The frames the run used. */
+var NodeBenchClipSchema = zod.z.object({
+	/** `camstack-bench-v1` or `reference-images` (the fallback when the clip is not reachable). */
+	id: zod.z.string(),
+	revision: zod.z.string().nullable(),
+	frames: zod.z.number(),
+	width: zod.z.number(),
+	height: zod.z.number()
+});
+var NodeBenchRunnerInputSchema = zod.z.object({
+	runId: zod.z.string().min(1),
+	devices: zod.z.array(NodeBenchmarkDevicePlanSchema).min(1),
+	phases: zod.z.array(NodeBenchmarkPhaseSchema).min(1),
+	/** The full detail step tree root for the `pipeline` measurement is built on the node from these ids. */
+	steps: zod.z.array(zod.z.string()).default([]),
+	fpsPerStream: zod.z.number().int().min(1).max(30),
+	/** The runner stops on its own past this instant, whatever the hub does. */
+	deadlineAtMs: zod.z.number(),
+	settleSec: zod.z.number().min(0).max(60).default(NODE_BENCHMARK_DEFAULTS.settleSec),
+	measureSec: zod.z.number().min(2).max(300).default(NODE_BENCHMARK_DEFAULTS.measureSec),
+	keepDownloadedModels: zod.z.boolean().default(false)
+});
+var NodeBenchRunnerStateSchema = zod.z.enum([
+	"running",
+	"done",
+	"failed",
+	"aborted"
+]);
+var NodeBenchRunnerStatusSchema = zod.z.object({
+	runId: zod.z.string(),
+	nodeId: zod.z.string(),
+	state: NodeBenchRunnerStateSchema,
+	progress: NodeBenchProgressSchema.nullable(),
+	/** Every finished cell so far — a run stopped half way keeps what it measured. */
+	cells: zod.z.array(NodeBenchCellSchema).readonly(),
+	fingerprint: NodeBenchFingerprintSchema.nullable(),
+	clip: NodeBenchClipSchema.nullable(),
+	/** Cameras seen running on the node during the run (they share its pools). */
+	activeCameraIds: zod.z.array(zod.z.number()).readonly(),
+	/** Models the run downloaded and then deleted (not installed before). */
+	deletedModels: zod.z.array(zod.z.string()).readonly(),
+	error: zod.z.string().nullable(),
+	startedAtMs: zod.z.number(),
+	finishedAtMs: zod.z.number().nullable()
+});
+var NodeBenchmarkStateSchema = zod.z.enum([
+	"draining",
+	"measuring",
+	"restoring",
+	"done",
+	"failed",
+	"aborted"
+]);
+/** Why a run ended. */
+var NodeBenchmarkEndReasonSchema = zod.z.enum([
+	"completed",
+	"operator-abort",
+	"deadline",
+	"node-lost",
+	"runner-lost",
+	"hub-restart",
+	"drain-timeout",
+	"failed"
+]);
+var NodeBenchmarkRunSchema = zod.z.object({
+	runId: zod.z.string(),
+	nodeId: zod.z.string(),
+	state: NodeBenchmarkStateSchema,
+	plan: NodeBenchmarkPlanSchema,
+	startedAtMs: zod.z.number(),
+	deadlineAtMs: zod.z.number(),
+	finishedAtMs: zod.z.number().nullable(),
+	endReason: NodeBenchmarkEndReasonSchema.nullable(),
+	error: zod.z.string().nullable(),
+	/** Cameras moved off the node for the run. */
+	moved: zod.z.array(zod.z.number()).readonly(),
+	/** Cameras that stayed (their only frame source is the node). */
+	staying: zod.z.array(zod.z.number()).readonly(),
+	/** Something else ran on the node's pools during the run. */
+	contaminated: zod.z.boolean(),
+	progress: NodeBenchProgressSchema.nullable(),
+	resultIds: zod.z.array(zod.z.string()).readonly()
+});
+/** `getNodeBenchmarkStatus`: the active run (or the last one), and whether benchmark mode is on. */
+var NodeBenchmarkStatusSchema = zod.z.object({
+	/** The node the cluster is in benchmark mode for; null = none. */
+	modeNodeId: zod.z.string().nullable(),
+	run: NodeBenchmarkRunSchema.nullable()
+});
+/**
+* One stored measurement — the only authority Auto tune and the automatic
+* shares read measured capacity from. Written by the orchestrator when a run
+* ends, never by anyone else.
+*/
+var NodeBenchmarkResultSchema = zod.z.object({
+	id: zod.z.string(),
+	runId: zod.z.string(),
+	nodeId: zod.z.string(),
+	cell: NodeBenchCellSchema,
+	fpsPerStream: zod.z.number(),
+	fingerprint: NodeBenchFingerprintSchema.nullable(),
+	clip: NodeBenchClipSchema.nullable(),
+	/** Other work shared the node's pools (a camera that could not move, or the hub's own duties). */
+	contaminated: zod.z.boolean(),
+	stayingCameras: zod.z.array(zod.z.number()).readonly(),
+	/** The run ended early; the cell itself completed. */
+	partialRun: zod.z.boolean(),
+	measuredAtMs: zod.z.number()
+});
+var ListNodeBenchmarkResultsInputSchema = zod.z.object({
+	nodeId: zod.z.string().optional(),
+	deviceKey: zod.z.string().optional()
+});
+/** A result with its standing today: does it still beat the table? */
+var NodeBenchmarkResultViewSchema = NodeBenchmarkResultSchema.extend({
+	/** `fresh` beats the table; `stale` falls back to it; `superseded` = a newer row covers the same cell. */
+	standing: zod.z.enum([
+		"fresh",
+		"stale",
+		"superseded"
+	]),
+	staleWhy: zod.z.enum([
+		"age",
+		"runtime",
+		"pool-tuning"
+	]).nullable()
+});
+zod.z.object({
+	runId: zod.z.string(),
+	nodeId: zod.z.string(),
+	startedAtMs: zod.z.number(),
+	deadlineAtMs: zod.z.number(),
+	plan: NodeBenchmarkPlanSchema,
+	moved: zod.z.array(zod.z.number()).readonly(),
+	staying: zod.z.array(zod.z.number()).readonly()
+});
+/** Candidate detectors per device, for the plan editor. */
+var NodeBenchmarkCandidatesSchema = zod.z.object({
+	nodeId: zod.z.string(),
+	reachable: zod.z.boolean(),
+	devices: zod.z.array(zod.z.object({
+		deviceKey: zod.z.string(),
+		enabled: zod.z.boolean(),
+		available: zod.z.boolean(),
+		/** Ordered: what Auto tune would pick first, then the rest of the family by accuracy. */
+		suggested: zod.z.array(zod.z.string()).readonly(),
+		/** Every root detector the device has a build for. */
+		all: zod.z.array(zod.z.string()).readonly(),
+		/** The model the device runs now, when pinned. */
+		currentModelId: zod.z.string().nullable()
+	})).readonly(),
+	/** Detail steps the node's catalog offers under the root (for the `pipeline` measurement). */
+	steps: zod.z.array(zod.z.object({
+		id: zod.z.string(),
+		name: zod.z.string(),
+		slot: zod.z.string()
+	})).readonly()
+});
 zod.z.object({
 	activeCameras: zod.z.number(),
 	throttledCameras: zod.z.number(),
@@ -28247,7 +29983,30 @@ var pipelineRunnerCapability = {
 		releaseParkedTrackFrames: method(zod.z.object({
 			deviceId: zod.z.number(),
 			trackId: zod.z.string()
-		}), zod.z.object({ released: zod.z.number().int().nonnegative() }), { kind: "mutation" })
+		}), zod.z.object({ released: zod.z.number().int().nonnegative() }), { kind: "mutation" }),
+		/**
+		* Start measuring THIS node for the orchestrator's node benchmark: the
+		* bench clip decoded once into RAM, each device × candidate detector on an
+		* open-loop ramp (`device`), then the chosen pipeline with the requested
+		* detail steps (`pipeline`). Everything runs in-process with the executor
+		* — no frame crosses a node (D9) — and writes nothing: no track, event,
+		* media or notification. Reached by `nodePin(nodeId)`. Answers at once;
+		* one run per node; the run stops itself at `deadlineAtMs`.
+		*/
+		startNodeBench: method(NodeBenchRunnerInputSchema, zod.z.object({
+			accepted: zod.z.literal(true),
+			runId: zod.z.string()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The run's progress and every finished cell; null when this runner does not know `runId`. */
+		getNodeBenchStatus: method(zod.z.object({ runId: zod.z.string() }), NodeBenchRunnerStatusSchema.nullable(), { auth: "admin" }),
+		/** Stop the run; what it finished is kept. */
+		abortNodeBench: method(zod.z.object({ runId: zod.z.string() }), zod.z.object({ aborted: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 var CameraPipelineConfigSchema = zod.z.object({
@@ -29205,6 +30964,51 @@ var pipelineOrchestratorCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* Node benchmark — what a run of this plan would do, without doing it:
+		* the cameras that leave the node, those that cannot (the node is their
+		* only frame source; they stay and flag the run), the estimated duration
+		* and every reason it may not start. The confirmation shows this.
+		*/
+		getNodeBenchmarkPreflight: method(NodeBenchmarkPlanSchema, NodeBenchmarkPreflightSchema, { auth: "admin" }),
+		/**
+		* Node benchmark — start ONE run (cluster-wide lock). The orchestrator
+		* persists a restore manifest, enters benchmark mode for the node (out of
+		* placement, its camera pins ignored, nothing rewritten), drains it, drives
+		* the node's own runner, then restores — always, including after an
+		* abort, a lost node or a hub restart. Answers at once; poll
+		* `getNodeBenchmarkStatus`. Refused runs carry the preflight.
+		*/
+		startNodeBenchmark: method(NodeBenchmarkPlanSchema, zod.z.discriminatedUnion("kind", [zod.z.object({
+			kind: zod.z.literal("started"),
+			runId: zod.z.string()
+		}), zod.z.object({
+			kind: zod.z.literal("refused"),
+			preflight: NodeBenchmarkPreflightSchema
+		})]), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Node benchmark — the active run (or the last one) and the node in benchmark mode. */
+		getNodeBenchmarkStatus: method(zod.z.void(), NodeBenchmarkStatusSchema, { auth: "admin" }),
+		/** Node benchmark — stop the active run; the cluster is restored as it was. */
+		abortNodeBenchmark: method(zod.z.object({ runId: zod.z.string() }), zod.z.object({ aborted: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Node benchmark — root detector candidates per device (what Auto tune
+		* would pick first, then the family) and the detail steps the node's
+		* catalog offers, for the plan editor.
+		*/
+		getNodeBenchmarkCandidates: method(zod.z.object({ nodeId: zod.z.string() }), NodeBenchmarkCandidatesSchema, { auth: "admin" }),
+		/** Node benchmark — stored results, newest first, each with its standing today. */
+		listNodeBenchmarkResults: method(ListNodeBenchmarkResultsInputSchema, zod.z.array(NodeBenchmarkResultViewSchema).readonly(), { auth: "admin" }),
+		/** Node benchmark — delete one result; Auto tune and the shares stop reading it. */
+		deleteNodeBenchmarkResult: method(zod.z.object({ id: zod.z.string() }), zod.z.object({ deleted: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Read one camera's settings. Null when never touched (inherits agent defaults fully). */
 		getCameraSettings: method(zod.z.object({ deviceId: zod.z.number() }), CameraPipelineSettingsSchema.nullable()),
 		/** Set or clear the 3-state toggle for one (camera, addonId). Pass `enabled: null` to clear and revert to agent default. */
@@ -36764,6 +38568,9 @@ var CreateIntegrationInputSchema = zod.z.object({
 	enabled: zod.z.boolean().optional(),
 	info: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
 	settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+	/** Keys of `settings` the form's schema declares secret (by type) — kept in
+	*  the keychain, not the table (D787). */
+	secretKeys: zod.z.array(zod.z.string()).optional(),
 	skipRestart: zod.z.boolean().optional()
 });
 var UpdateIntegrationInputSchema = zod.z.object({
@@ -36799,7 +38606,9 @@ var integrationsCapability = {
 		getSettings: method(zod.z.object({ id: zod.z.string() }), zod.z.record(zod.z.string(), zod.z.unknown()), { auth: "admin" }),
 		setSettings: method(zod.z.object({
 			id: zod.z.string(),
-			settings: zod.z.record(zod.z.string(), zod.z.unknown())
+			settings: zod.z.record(zod.z.string(), zod.z.unknown()),
+			/** Keys the form's schema declares secret (by type) — keychain-stored (D787). */
+			secretKeys: zod.z.array(zod.z.string()).optional()
 		}), zod.z.object({ success: zod.z.boolean() }), {
 			kind: "mutation",
 			auth: "admin"
@@ -46952,7 +48761,8 @@ var BaseDevice = class {
 		this.role = options.role;
 		this.parentDeviceId = ctx.parentDeviceId;
 		const seedData = ctx.persistedConfig ?? {};
-		this.config = DeviceConfig.fromSchema(schema, (data) => ctx.persistConfig(data), seedData, ({ droppedKeys, issues }) => {
+		const declaredSecretPaths = collectZodSecretPaths(schema);
+		this.config = DeviceConfig.fromSchema(schema, (data) => ctx.persistConfig(data, { secretConfigPaths: declaredSecretPaths }), seedData, ({ droppedKeys, issues }) => {
 			ctx.logger.warn("Device config recovery: dropping invalid persisted fields", {
 				tags: {
 					deviceId: ctx.id,
@@ -50424,6 +52234,90 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychain.delete": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychain.getState": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychain.listMeta": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychain.put": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychain.resolve": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.deleteOrphans": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.downloadRecoveryKey": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.listAudit": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.listSecrets": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.purgeRetiredKeys": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.resetKeychain": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.reveal": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.rotateMasterKey": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.status": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"lawnMowerControl.dock": {
 		capName: "lawn-mower-control",
 		capScope: "device",
@@ -51798,6 +53692,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.addRetrainFrameFromRecording": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"pipelineAnalytics.addRetrainFramesToCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.applyDeviceSettingsPatch": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -51846,12 +53752,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.createRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.deleteRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineAnalytics.deleteTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -52056,6 +53974,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRetrainAssistProfiles": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainCollectionFrames": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainCollections": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainFrames": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -52104,6 +54040,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.proposeRetrainAnnotationsWithLlm": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.pruneEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -52158,6 +54100,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.removeRetrainFrameFromCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
+	"pipelineAnalytics.renameRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.restageRetrainTrack": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -52446,6 +54400,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.abortNodeBenchmark": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.applyAutoTune": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -52470,6 +54430,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.deleteNodeBenchmarkResult": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineOrchestrator.getAgentLoad": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -52578,6 +54544,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getNodeBenchmarkCandidates": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineOrchestrator.getNodeBenchmarkPreflight": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineOrchestrator.getNodeBenchmarkStatus": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getNodeInferenceDevices": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -52620,6 +54604,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.listNodeBenchmarkResults": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.pauseForStorageMigration": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -52764,6 +54754,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.startNodeBenchmark": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.suggestShares": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -52782,6 +54778,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.abortNodeBench": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineRunner.attachCamera": {
 		capName: "pipeline-runner",
 		capScope: "system",
@@ -52830,6 +54832,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineRunner.getNodeBenchStatus": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineRunner.getParkedTrackFrame": {
 		capName: "pipeline-runner",
 		capScope: "system",
@@ -52872,6 +54880,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.startNodeBench": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"plateGallery.assignPlate": {
 		capName: "plate-gallery",
 		capScope: "system",
@@ -56630,6 +58644,8 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	imageSettingsCapability,
 	integrationsCapability,
 	intercomCapability,
+	keychainCapability,
+	keychainAdminCapability,
 	lawnMowerControlCapability,
 	llmCapability,
 	llmRuntimeCapability,
@@ -58056,6 +60072,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.addRetrainFrameFromRecording": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.applyDeviceSettingsPatch": [{
 		name: "deviceId",
 		form: "single",
@@ -58246,6 +60267,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.proposeRetrainAnnotationsWithLlm": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.pruneEventsBefore": [{
 		name: "deviceId",
 		form: "single",
@@ -60684,6 +62710,70 @@ function bareAddonId(id) {
 function hfModelUrl(repo, path) {
 	return `https://huggingface.co/${repo}/resolve/main/${path}`;
 }
+/**
+* Names that, when used as URL query parameters, almost certainly carry
+* a secret. Matching is case-insensitive and anchored to the full param
+* name to avoid false positives like `user_id` (an entity reference, not
+* a credential) or `topic=password-reset` (a value happens to contain
+* the substring "password" but the param name is unrelated).
+*
+* Add new patterns here as we encounter cameras/APIs that leak through
+* the existing list.
+*/
+var CREDENTIAL_PARAM_PATTERNS = [
+	/^user$/i,
+	/^usr$/i,
+	/^username$/i,
+	/^password$/i,
+	/^pwd$/i,
+	/^pass$/i,
+	/^passwd$/i,
+	/^secret$/i,
+	/^token$/i,
+	/^auth$/i,
+	/^auth[_-]?token$/i,
+	/^bearer$/i,
+	/^api[_-]?key$/i,
+	/^access[_-]?token$/i,
+	/^refresh[_-]?token$/i
+];
+function isCredentialParam(name) {
+	return CREDENTIAL_PARAM_PATTERNS.some((re) => re.test(name));
+}
+/**
+* Redact secrets we may surface in logs or telemetry:
+*   1. `userinfo` (`user:password@host`) — the classic RTSP shape.
+*   2. Query-string credential params (`?user=...&password=...`) — the
+*      Reolink RTMP shape and several HTTP-pushed-stream APIs.
+*
+* Returns the original string verbatim when the input is not a parseable
+* URL — a log helper must never throw. Param values are replaced with
+* `***` so an operator reading logs still sees WHICH credential was
+* present (useful for debugging "wrong password" issues) without
+* exposing the value.
+*
+* The credential-name match is case-insensitive but anchored to the
+* whole param name; values like `user_id=42` or `topic=password-reset`
+* are NOT masked (those are entity references, not credentials).
+*/
+function maskUrlCredentials(rawUrl) {
+	try {
+		const u = new URL(rawUrl);
+		let touched = false;
+		if (u.username || u.password) {
+			u.username = "";
+			u.password = "";
+			touched = true;
+		}
+		for (const key of Array.from(u.searchParams.keys())) if (isCredentialParam(key)) {
+			u.searchParams.set(key, "***");
+			touched = true;
+		}
+		return touched ? u.toString() : rawUrl;
+	} catch {
+		return rawUrl;
+	}
+}
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 /**
@@ -61538,6 +63628,12 @@ Object.defineProperty(exports, "formatMinutes", {
 		return formatMinutes;
 	}
 });
+Object.defineProperty(exports, "formatSecretScope", {
+	enumerable: true,
+	get: function() {
+		return formatSecretScope;
+	}
+});
 Object.defineProperty(exports, "gbToBytes", {
 	enumerable: true,
 	get: function() {
@@ -61604,6 +63700,12 @@ Object.defineProperty(exports, "isObjectInput", {
 		return isObjectInput;
 	}
 });
+Object.defineProperty(exports, "isSecretMarker", {
+	enumerable: true,
+	get: function() {
+		return isSecretMarker;
+	}
+});
 Object.defineProperty(exports, "isVoidInput", {
 	enumerable: true,
 	get: function() {
@@ -61616,6 +63718,18 @@ Object.defineProperty(exports, "kebabToCamel", {
 		return kebabToCamel;
 	}
 });
+Object.defineProperty(exports, "keychainAdminCapability", {
+	enumerable: true,
+	get: function() {
+		return keychainAdminCapability;
+	}
+});
+Object.defineProperty(exports, "keychainCapability", {
+	enumerable: true,
+	get: function() {
+		return keychainCapability;
+	}
+});
 Object.defineProperty(exports, "legacyAutoLinkIds", {
 	enumerable: true,
 	get: function() {
@@ -61664,6 +63778,12 @@ Object.defineProperty(exports, "looseSchema", {
 		return looseSchema;
 	}
 });
+Object.defineProperty(exports, "maskUrlCredentials", {
+	enumerable: true,
+	get: function() {
+		return maskUrlCredentials;
+	}
+});
 Object.defineProperty(exports, "mayReadLocation", {
 	enumerable: true,
 	get: function() {
@@ -61712,6 +63832,12 @@ Object.defineProperty(exports, "normalizeCoreBlockWrite", {
 		return normalizeCoreBlockWrite;
 	}
 });
+Object.defineProperty(exports, "normalizeSecretOwner", {
+	enumerable: true,
+	get: function() {
+		return normalizeSecretOwner;
+	}
+});
 Object.defineProperty(exports, "normalizeUnit", {
 	enumerable: true,
 	get: function() {
@@ -61742,6 +63868,12 @@ Object.defineProperty(exports, "parseJsonUnknown", {
 		return parseJsonUnknown;
 	}
 });
+Object.defineProperty(exports, "parseSecretRef", {
+	enumerable: true,
+	get: function() {
+		return parseSecretRef;
+	}
+});
 Object.defineProperty(exports, "parseStreamParamsFormPatch", {
 	enumerable: true,
 	get: function() {
@@ -61850,6 +63982,12 @@ Object.defineProperty(exports, "resolveNotificationTapAddress", {
 		return resolveNotificationTapAddress;
 	}
 });
+Object.defineProperty(exports, "resolveSecretMarkers", {
+	enumerable: true,
+	get: function() {
+		return resolveSecretMarkers;
+	}
+});
 Object.defineProperty(exports, "runtimeStatePolicyFor", {
 	enumerable: true,
 	get: function() {
@@ -61880,6 +64018,18 @@ Object.defineProperty(exports, "scoreRuntimes", {
 		return scoreRuntimes;
 	}
 });
+Object.defineProperty(exports, "scrubKnownSecrets", {
+	enumerable: true,
+	get: function() {
+		return scrubKnownSecrets;
+	}
+});
+Object.defineProperty(exports, "secretTreeFromPaths", {
+	enumerable: true,
+	get: function() {
+		return secretTreeFromPaths;
+	}
+});
 Object.defineProperty(exports, "settingsStoreCapability", {
 	enumerable: true,
 	get: function() {
@@ -61952,6 +64102,12 @@ Object.defineProperty(exports, "toNodeId", {
 		return toNodeId;
 	}
 });
+Object.defineProperty(exports, "transformSecretWrite", {
+	enumerable: true,
+	get: function() {
+		return transformSecretWrite;
+	}
+});
 Object.defineProperty(exports, "userManagementCapability", {
 	enumerable: true,
 	get: function() {