@camstack/types 1.2.326 → 1.2.328

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-DPar9AHl.js");
-const require_event_category = require("./event-category-CtBAl88K.js");
+const require_sleep = require("./sleep-i3kl-0Na.js");
+const require_event_category = require("./event-category-CHduMGvg.js");
 const require_composition = require("./composition-BLWAivB2.js");
 const require_err_msg = require("./err-msg-Dx2Kor0g.js");
 const require_enums = require("./enums.js");
@@ -1632,69 +1632,6 @@ function composeSwitchedOff(input) {
 	};
 }
 //#endregion
-//#region src/interfaces/config-ui-secrets.ts
-/**
-* The value a redacted secret is replaced with on every read surface.
-*
-* It is also the WRITE-BACK token: an `upsertLocation` that sends this value
-* back for a key means "keep what is stored", which is what lets an operator
-* rename a location without retyping its password. A literal an operator could
-* plausibly choose as a real password would turn that convenience into a way
-* to lock yourself out, hence the sentinel shape.
-*/
-var REDACTED_SECRET = "__camstack_redacted__";
-/** Is this field's stored value a credential? */
-function isSecretConfigField(field) {
-	if (field.type === "password") return true;
-	return "secret" in field && field.secret === true;
-}
-/**
-* Every config key in `schema` whose value is a secret, including keys nested
-* inside `group` / `sub-tabs` containers.
-*/
-function collectSecretConfigKeys(schema) {
-	const keys = /* @__PURE__ */ new Set();
-	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
-	return keys;
-}
-/**
-* True when the value is a readable schema declaring at least one field of any
-* kind. Lets a caller tell "this provider has no secrets" from "this provider's
-* schema could not be read", which are the same empty set otherwise.
-*/
-function schemaDeclaresAnyField(schema) {
-	for (const section of sectionsOf(schema)) if (fieldsOf(section).length > 0) return true;
-	return false;
-}
-function isRecord$3(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function sectionsOf(schema) {
-	if (!isRecord$3(schema)) return [];
-	const sections = schema["sections"];
-	return Array.isArray(sections) ? sections : [];
-}
-function fieldsOf(node) {
-	if (!isRecord$3(node)) return [];
-	const fields = node["fields"];
-	return Array.isArray(fields) ? fields : [];
-}
-function walkField(field, out) {
-	if (!isRecord$3(field)) return;
-	const type = field["type"];
-	const key = field["key"];
-	if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
-	if (type === "group") {
-		for (const child of fieldsOf(field)) walkField(child, out);
-		return;
-	}
-	if (type === "sub-tabs") {
-		const tabs = field["tabs"];
-		if (!Array.isArray(tabs)) return;
-		for (const tab of tabs) for (const child of fieldsOf(tab)) walkField(child, out);
-	}
-}
-//#endregion
 //#region src/interfaces/birth-decision-ledger.ts
 /**
 * Birth-decision ledger — one durable row per track-birth VERDICT (D409).
@@ -12591,6 +12528,277 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
 	}
 };
 //#endregion
+//#region src/capabilities/keychain.cap.ts
+/**
+* `keychain` — the hub's encrypted store of secret values (D787).
+*
+* Settings blobs never hold a secret: they hold a marker
+* `{"$secret":"secret://<owner>/<scope>/<fieldPath>","v":1}` and the value
+* lives here, AES-256-GCM under a data key that a master key wraps. This cap
+* is the OWNER's door to its own values: every method is owner-checked
+* against the CALLER, never against anything the caller claims.
+*
+* Who the caller is: the transport stamps `callerAddonId` into the args of a
+* call that crossed a process (the parent `LocalChildRegistry` from the UDS
+* connection, the agent from its child's connection carried in
+* `$hub-cap-fwd`'s envelope). A stamp always overwrites; a wire call with no
+* stamp has its claim stripped. Only a hub in-process caller may state its own
+* identity — `ctx.secrets` does that with the addon id closed over. This is
+* identity against BUGS and misrouting, not against a malicious addon (every
+* runner is the same OS user): see the threat model in
+* `docs/design/2026-10-08-secrets-keychain.md`.
+*
+* `callerAddonId` is deliberately NOT in any input schema: the tRPC router
+* parses the input, so a session can never supply it, and the internal mount
+* floors every method to admin anyway (D240).
+*
+* Internal: addons reach it through `ctx.secrets`, never directly.
+*/
+/** Why a value cannot be served right now. Never folded into "missing". */
+var KeychainUnavailableReasonSchema = zod.z.enum([
+	"key-missing",
+	"wrong-key",
+	"key-file-unreadable",
+	"store-unavailable",
+	"not-initialized",
+	"decrypt-failed"
+]);
+var KeychainStateSchema = zod.z.discriminatedUnion("state", [zod.z.object({ state: zod.z.literal("ready") }), zod.z.object({
+	state: zod.z.literal("locked"),
+	reason: KeychainUnavailableReasonSchema
+})]);
+var KeychainResolveEntrySchema = zod.z.discriminatedUnion("kind", [
+	zod.z.object({
+		kind: zod.z.literal("value"),
+		value: zod.z.string(),
+		version: zod.z.number().int()
+	}),
+	zod.z.object({ kind: zod.z.literal("missing") }),
+	zod.z.object({
+		kind: zod.z.literal("unavailable"),
+		reason: KeychainUnavailableReasonSchema
+	}),
+	zod.z.object({ kind: zod.z.literal("forbidden") })
+]);
+var KeychainResolveResultSchema = zod.z.record(zod.z.string(), KeychainResolveEntrySchema);
+/** Metadata of one stored value — never the value. */
+var KeychainSecretMetaSchema = zod.z.object({
+	ref: zod.z.string(),
+	owner: zod.z.string(),
+	/** Formatted scope (`global`, `node/<id>`, `device/<id>`, …). */
+	scope: zod.z.string(),
+	fieldPath: zod.z.string(),
+	version: zod.z.number().int(),
+	createdAt: zod.z.number(),
+	updatedAt: zod.z.number(),
+	/** `addon:<id>` | `user:<id>` | `system`. */
+	updatedBy: zod.z.string(),
+	/** Coarse — written at most once an hour per ref. `null` = never read. */
+	lastReadAt: zod.z.number().nullable()
+});
+/** A batch bound: one `resolveConfig` resolves every marker of one blob at once. */
+var KEYCHAIN_MAX_REFS_PER_CALL = 512;
+var RefListSchema = zod.z.array(zod.z.string().min(1)).max(512);
+var keychainCapability = {
+	name: "keychain",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		/** Store (or replace) the caller's value at `ref`. Refused while locked. */
+		put: require_sleep.method(zod.z.object({
+			ref: zod.z.string().min(1),
+			value: zod.z.string().min(1)
+		}), zod.z.object({
+			ref: zod.z.string(),
+			version: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Resolve the caller's refs in one round-trip. A locked keychain answers
+		* `unavailable` per ref — never `missing`, never an empty value.
+		*/
+		resolve: require_sleep.method(zod.z.object({ refs: RefListSchema }), KeychainResolveResultSchema, { auth: "admin" }),
+		/** Remove the caller's refs. Unknown refs are ignored. */
+		delete: require_sleep.method(zod.z.object({ refs: RefListSchema }), zod.z.object({ deleted: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The caller's own refs, metadata only. */
+		listMeta: require_sleep.method(zod.z.object({}), zod.z.array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }),
+		/** Whether values can be served — the save path refuses a write while locked. */
+		getState: require_sleep.method(zod.z.object({}), KeychainStateSchema, { auth: "admin" })
+	}
+};
+//#endregion
+//#region src/capabilities/keychain-admin.cap.ts
+/**
+* `keychain-admin` — the operator's view of the keychain (System → Secrets).
+*
+* Every method is `admin`. Two methods hand out material, each audited and
+* each named for exactly that: {@link keychainAdminCapability.methods.reveal}
+* (one value, shown briefly by the UI) and `downloadRecoveryKey` (the master
+* key itself, so the operator can keep a copy off the hub). Nothing else
+* returns a value.
+*
+* The master key's LOCATION is configuration, never an env var (D788):
+* `keychain.keyFile` in `config.yaml`, the OS keychain on a desktop hub, else
+* `<dataDir>/.keychain/master.key` — which sits beside the database in every
+* whole-volume backup, and the status says so.
+*/
+/** Where the master key in use came from. */
+var KeychainKeySourceKindSchema = zod.z.enum([
+	"config-file",
+	"previous-config-file",
+	"platform",
+	"default-file"
+]);
+var KeychainKeySourceSchema = zod.z.object({
+	kind: KeychainKeySourceKindSchema,
+	/** File sources only — a path is not a secret. */
+	path: zod.z.string().optional(),
+	/**
+	* True when a whole-volume backup of the data directory carries this key
+	* next to the database it protects (the default file). The page warns.
+	*/
+	sharesBackupWithDatabase: zod.z.boolean()
+});
+var KeychainStatusSchema = zod.z.object({
+	keychain: KeychainStateSchema,
+	/** The source of the master key in use; `null` while locked. */
+	keySource: KeychainKeySourceSchema.nullable(),
+	/** The source configured to be primary — differs from `keySource` while a rotation is pending. */
+	configuredSource: KeychainKeySourceSchema,
+	/** Short fingerprint of the master key in use (`HMAC(KEK, label)`, 16 hex). */
+	fingerprint: zod.z.string().nullable(),
+	activeKeyId: zod.z.string().nullable(),
+	/**
+	* The keychain unlocked with a NON-primary source: the configured primary
+	* key is not the one that wraps the data key yet. `rotateMasterKey` moves it.
+	*/
+	rotationPending: zod.z.boolean(),
+	/** Wrapped copies of the data key under a previous master key, kept until purged. */
+	retiredWraps: zod.z.number().int(),
+	recoveryKeyDownloadedAt: zod.z.number().nullable(),
+	secretCount: zod.z.number().int()
+});
+/**
+* Whether a stored value is still pointed at by its owner's settings.
+* `unknown` is a first-class answer: a scope whose blob could not be read is
+* never reported as an orphan (and never deleted as one).
+*/
+var KeychainSecretUsageSchema = zod.z.enum([
+	"in-use",
+	"orphan",
+	"unknown"
+]);
+var KeychainAdminSecretSchema = KeychainSecretMetaSchema.extend({ usage: KeychainSecretUsageSchema });
+var KeychainAuditActionSchema = zod.z.enum([
+	"put",
+	"delete",
+	"reveal",
+	"rotate-master-key",
+	"purge-retired-keys",
+	"download-recovery-key",
+	"delete-orphans",
+	"reset",
+	"initialize"
+]);
+var KeychainAuditEntrySchema = zod.z.object({
+	id: zod.z.string(),
+	at: zod.z.number(),
+	action: KeychainAuditActionSchema,
+	/** `addon:<id>` | `user:<id>` | `system`. */
+	actor: zod.z.string(),
+	ref: zod.z.string().nullable(),
+	detail: zod.z.string().nullable()
+});
+var KEYCHAIN_RESET_CONFIRMATION = "RESET KEYCHAIN";
+var keychainAdminCapability = {
+	name: "keychain-admin",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		status: require_sleep.method(zod.z.object({}), KeychainStatusSchema, { auth: "admin" }),
+		listSecrets: require_sleep.method(zod.z.object({}), zod.z.array(KeychainAdminSecretSchema).readonly(), { auth: "admin" }),
+		listAudit: require_sleep.method(zod.z.object({ limit: zod.z.number().int().min(1).max(500).optional() }), zod.z.array(KeychainAuditEntrySchema).readonly(), { auth: "admin" }),
+		/**
+		* Show one value to the operator. Audited. The UI hides it again after a
+		* few seconds; nothing caches it.
+		*/
+		reveal: require_sleep.method(zod.z.object({ ref: zod.z.string().min(1) }), zod.z.object({
+			value: zod.z.string(),
+			version: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/** Delete refs no owner points at any more. Re-checked here; `unknown` is kept. */
+		deleteOrphans: require_sleep.method(zod.z.object({ refs: zod.z.array(zod.z.string().min(1)).max(1e3) }), zod.z.object({
+			deleted: zod.z.array(zod.z.string()).readonly(),
+			kept: zod.z.array(zod.z.object({
+				ref: zod.z.string(),
+				usage: KeychainSecretUsageSchema
+			})).readonly()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* Wrap the data key under the configured primary master key.
+		*
+		* Pending rotation (the keychain unlocked with a previous source): re-wrap
+		* under the primary. Otherwise, with the default file as primary: generate
+		* a new master key, write it there, re-wrap. A file or OS-keychain primary
+		* that is already in use cannot be replaced from here — put the new key at
+		* the source, keep the old one as `keychain.previousKeyFile`, restart, and
+		* rotate. No value is re-encrypted either way; the previous wrap is kept
+		* (retired) until purged.
+		*/
+		rotateMasterKey: require_sleep.method(zod.z.object({}), zod.z.object({
+			fingerprint: zod.z.string(),
+			keySource: KeychainKeySourceSchema
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		purgeRetiredKeys: require_sleep.method(zod.z.object({}), zod.z.object({ purged: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/** The master key, base64. Audited; marks the recovery copy as taken. */
+		downloadRecoveryKey: require_sleep.method(zod.z.object({}), zod.z.object({
+			key: zod.z.string(),
+			fingerprint: zod.z.string(),
+			keySource: KeychainKeySourceSchema
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* Lost-key recovery: archive every stored value into a
+		* `keychain:secrets-orphaned-<ts>` table and start over with a new data
+		* key. Every secret field then reads "not set". Requires the typed
+		* confirmation {@link KEYCHAIN_RESET_CONFIRMATION}.
+		*/
+		resetKeychain: require_sleep.method(zod.z.object({ confirm: zod.z.literal(KEYCHAIN_RESET_CONFIRMATION) }), zod.z.object({
+			archivedCollection: zod.z.string().nullable(),
+			archived: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		})
+	}
+};
+//#endregion
 //#region src/capabilities/decoder.cap.ts
 /**
 * Stable UI option list for the `hwaccel` setting. Decoder addons
@@ -14084,6 +14292,10 @@ var DeviceInfoSchema = zod.z.object({
 	isCamera: zod.z.boolean(),
 	/** Current config values — serializable snapshot */
 	config: zod.z.record(zod.z.string(), zod.z.unknown()),
+	/** Paths inside `config` the device's schema declares secret (D783) —
+	*  what the non-admin redaction withholds. Paths, never values. Absent
+	*  when the owning runner has not reported them. */
+	secretConfigPaths: zod.z.array(zod.z.string()).optional(),
 	/** Hardware + identity blob (manufacturer / model / firmware / sn /
 	*  uid / mac / …). Populated by drivers; editable via setMetadata. */
 	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).nullable().optional(),
@@ -14304,12 +14516,22 @@ var DeviceRegisterPayloadSchema = zod.z.object({
 	*  call (workers re-register on init), so probe-driven updates
 	*  (e.g. PTZ flag flipping after the abilities probe) propagate. */
 	features: zod.z.array(zod.z.string()).optional(),
-	config: zod.z.record(zod.z.string(), zod.z.unknown())
+	config: zod.z.record(zod.z.string(), zod.z.unknown()),
+	/** Config paths the device's own schema DECLARES secret
+	*  (`.meta({ secret: true })` — dotted, `[]` for array items, e.g.
+	*  `connection.password`). Re-published on every register; the non-admin
+	*  redaction withholds them at any depth (D783). Optional: an older runner
+	*  omits it and the keyword backstop applies. */
+	secretConfigPaths: zod.z.array(zod.z.string()).optional()
 });
 var DeviceRemovePayloadSchema = zod.z.object({ deviceId: zod.z.number() });
 var DevicePersistConfigPayloadSchema = zod.z.object({
 	deviceId: zod.z.number(),
-	data: zod.z.record(zod.z.string(), zod.z.unknown())
+	data: zod.z.record(zod.z.string(), zod.z.unknown()),
+	/** The paths the device's schema declares secret (D783), when the caller
+	*  knows them — those values are kept in the keychain, not the blob (D787).
+	*  Absent: the paths the device last reported at `registerDevice` apply. */
+	secretConfigPaths: zod.z.array(zod.z.string()).optional()
 });
 /** What a migration actually did, per switch. `unreachable` is a first-class
 *  answer: a camera that could not be asked is not a camera that was silenced. */
@@ -17538,7 +17760,14 @@ var RedirectLoginMethodSchema = zod.z.object({
 	icon: zod.z.string().optional(),
 	/** Addon-owned HTTP route the button navigates to (GET). */
 	startUrl: zod.z.string(),
-	stage: LoginStageEnum
+	stage: LoginStageEnum,
+	/**
+	* The provider names an external identity a signed-in user can link to
+	* their own account (D782): `auth.listLinkableProviders` /
+	* `beginExternalLink` offer exactly the redirect methods that set this,
+	* whatever their id. Absent / false — a login button only (magic-link).
+	*/
+	linkable: zod.z.boolean().optional()
 });
 /**
 * A Module-Federation widget the login page mounts for an in-page
@@ -24689,8 +24918,23 @@ var RetrainMacroClassSchema = zod.z.enum([
 ]);
 /** A subject to learn, or a phantom to unlearn (taught by OMISSION). */
 var RetrainAnnotationKindSchema = zod.z.enum(["subject", "model_error"]);
-/** Did a human draw this box, or did the assist propose it? */
-var RetrainAnnotationSourceSchema = zod.z.enum(["operator", "assist"]);
+/**
+* Where a box came from. A machine-sourced box is a DRAFT on the page until
+* the operator confirms it; once saved it keeps its source as provenance.
+*
+* - `operator` — drawn by hand.
+* - `assist`   — proposed by a detector run on the copy (the camera's own
+*   model, or a larger teacher model).
+* - `pipeline` — the box the live pipeline actually drew on that frame, read
+*   back from the track store (never a re-run).
+* - `llm`      — proposed by a vision-capable LLM profile.
+*/
+var RetrainAnnotationSourceSchema = zod.z.enum([
+	"operator",
+	"assist",
+	"pipeline",
+	"llm"
+]);
 /** Normalised `[0,1]` rectangle against the FULL frame — the canonical form. */
 var RetrainBboxSchema = zod.z.object({
 	x: zod.z.number(),
@@ -24708,7 +24952,8 @@ var RetrainBboxSchema = zod.z.object({
 */
 var RetrainAnnotationSchema = zod.z.object({
 	id: zod.z.string(),
-	trackId: zod.z.string(),
+	/** The frame's track. Absent on a recording still, which has none. */
+	trackId: zod.z.string().optional(),
 	deviceId: zod.z.number(),
 	/** The COPY in retrain storage — never the source track's media key. */
 	mediaKey: zod.z.string(),
@@ -24757,18 +25002,63 @@ var RetrainFrameCandidateSchema = zod.z.object({
 	*  fail, whatever became of the original. */
 	copied: zod.z.boolean()
 });
+/**
+* One box the live pipeline drew on a copied frame — what a correction starts
+* from. Derived when the frame is listed, from the track store: the subject
+* box recorded on the source media row when there is one, else the track
+* position nearest the frame's capture time. Never stored as an annotation
+* until the operator confirms it.
+*/
+var RetrainPipelineBoxSchema = zod.z.object({
+	/** Normalised `[0,1]` against the full frame. */
+	bbox: RetrainBboxSchema,
+	macroClass: RetrainMacroClassSchema,
+	label: zod.z.string().optional(),
+	subLabel: zod.z.string().optional(),
+	/** The detection score of the position used, when it was recorded. */
+	score: zod.z.number().optional(),
+	/** The root model that produced the track, when it was recorded. */
+	modelId: zod.z.string().optional(),
+	trackId: zod.z.string(),
+	/** `subject-box`: recorded on this very frame. `position`: the track's
+	*  position nearest the capture time, `deltaMs` away. */
+	basis: zod.z.enum(["subject-box", "position"]),
+	deltaMs: zod.z.number()
+});
+/**
+* Where a retrain frame came from: a TRACK's stored media (copy-on-select),
+* or the RECORDING at an instant — the frame a model saw nothing in has no
+* track at all.
+*/
+var RetrainFrameOriginSchema = zod.z.enum(["track", "recording"]);
 /** A frame the dataset OWNS: bytes copied at selection time. */
 var RetrainFrameSchema = zod.z.object({
 	frameId: zod.z.string(),
 	deviceId: zod.z.number(),
-	trackId: zod.z.string(),
-	/** Provenance only. It may already point at nothing — that is expected. */
-	sourceMediaId: zod.z.number().int(),
+	origin: RetrainFrameOriginSchema,
+	/** The track it was copied from. Absent on a recording still. */
+	trackId: zod.z.string().optional(),
+	/** Provenance only. It may already point at nothing — that is expected.
+	*  Absent on a recording still. */
+	sourceMediaId: zod.z.number().int().optional(),
+	/** A recording still: the playhead instant it was taken at. */
+	epochMs: zod.z.number().optional(),
 	sourceKind: MediaFileKindEnum,
 	sizeBytes: zod.z.number().int(),
 	width: zod.z.number().int(),
 	height: zod.z.number().int(),
-	copiedAt: zod.z.number()
+	copiedAt: zod.z.number(),
+	/** When the CAMERA captured the frame. Absent on a copy taken before D785. */
+	capturedAt: zod.z.number().optional(),
+	/** The operator's "every subject in this frame is boxed". Detector
+	*  evaluation keeps only complete frames: an unboxed subject would count as
+	*  a false positive. */
+	complete: zod.z.boolean(),
+	/** The boxes the pipeline drew on this frame. Present on list answers;
+	*  empty when nothing the track store holds can be placed on it. */
+	pipelineBoxes: zod.z.array(RetrainPipelineBoxSchema).readonly().optional(),
+	/** The named collections this frame belongs to. Present on list answers. */
+	collectionIds: zod.z.array(zod.z.string()).readonly().optional()
 });
 /** Why a copy-on-select could not be honoured — named, never a silent skip. */
 var RetrainCopyRefusalSchema = zod.z.enum([
@@ -24789,6 +25079,53 @@ var RetrainFrameListSchema = zod.z.object({
 	/** What the page pre-selects — the native key frame when one survives. */
 	autoPickMediaId: zod.z.number().int().optional()
 });
+/**
+* Which frames an annotated export carries. Every field narrows; an empty
+* filter is every annotated copy. A dataset VERSION is a frozen `frameIds`
+* list owned by whoever trains (the training orchestrator), so `frameIds` is
+* the primitive a version export uses; `batchId` re-selects what an earlier
+* export carried (`exportedInBatch`).
+*/
+var RetrainExportFilterSchema = zod.z.object({
+	deviceIds: zod.z.array(zod.z.number()).optional(),
+	frameIds: zod.z.array(zod.z.string()).max(2e4).optional(),
+	/** Only frames in at least one of these named collections. */
+	collectionIds: zod.z.array(zod.z.string()).max(200).optional(),
+	batchId: zod.z.string().optional(),
+	/** Only frames the operator marked complete (all subjects boxed). */
+	completeOnly: zod.z.boolean().optional()
+});
+/**
+* `frames`: the full frame copies, boxes in `annotations.json`.
+* `crops`: additionally one JPEG per subject, cut with the runtime detail-crop
+* convention — the classifier layout.
+*/
+var RetrainExportLayoutSchema = zod.z.enum(["frames", "crops"]);
+/**
+* Where `writeRetrainArchive` streams the tar: one HTTP request whose body is
+* the archive, sent chunk by chunk. Covers a presigned PUT and a provider
+* addon's data-plane upload route alike. Headers are sent verbatim and never
+* logged.
+*/
+var RetrainArchiveTargetSchema = zod.z.object({
+	kind: zod.z.literal("http"),
+	method: zod.z.enum(["PUT", "POST"]),
+	url: zod.z.string().url(),
+	headers: zod.z.record(zod.z.string(), zod.z.string()).optional()
+});
+var RetrainArchiveResultSchema = zod.z.object({
+	batchId: zod.z.string(),
+	frames: zod.z.number().int(),
+	crops: zod.z.number().int(),
+	annotations: zod.z.number().int(),
+	/** Frames planned but not shipped (unreadable copy, path too long). */
+	missing: zod.z.number().int(),
+	bytes: zod.z.number().int(),
+	/** sha256 of the exact bytes sent. */
+	sha256: zod.z.string(),
+	/** The target's HTTP status. */
+	status: zod.z.number().int()
+});
 /** What the operator asked the assist to look for. */
 var RetrainAssistSubjectSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
 	kind: zod.z.literal("package"),
@@ -24818,6 +25155,109 @@ var RetrainAssistResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
 	reason: zod.z.string(),
 	detail: zod.z.string().optional()
 })]);
+/** A named set over the retrain corpus — membership only, it owns no pixels. */
+var RetrainCollectionSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	createdAt: zod.z.number(),
+	frameCount: zod.z.number().int()
+});
+var RetrainCollectionCreateResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("created"),
+	collection: RetrainCollectionSchema
+}), zod.z.object({
+	kind: zod.z.literal("refused"),
+	reason: zod.z.enum(["empty-name", "duplicate-name"])
+})]);
+var RetrainCollectionRenameResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("renamed"),
+	collection: RetrainCollectionSchema
+}), zod.z.object({
+	kind: zod.z.literal("refused"),
+	reason: zod.z.enum([
+		"empty-name",
+		"duplicate-name",
+		"unknown-collection"
+	])
+})]);
+/**
+* The outcome of adding the frame at a recording instant. Every refusal is
+* named: `still-unavailable` (not recording, a gap, or an undecodable frame —
+* `detail` says which), `still-busy` (the recorder is at its decode bound; try
+* again), `unreadable-image`, `write-failed`, `unknown-collection`.
+*/
+var AddRetrainFrameFromRecordingResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("added"),
+	collectionId: zod.z.string(),
+	frame: RetrainFrameSchema,
+	/** The moment was already in the dataset; nothing was decoded. */
+	reused: zod.z.boolean()
+}), zod.z.object({
+	kind: zod.z.literal("refused"),
+	reason: zod.z.enum([
+		"unknown-collection",
+		"still-unavailable",
+		"still-busy",
+		"unreadable-image",
+		"write-failed"
+	]),
+	detail: zod.z.string().optional()
+})]);
+/** A vision LLM profile the AI assist may use, and where it sends the frame. */
+var RetrainAssistProfileSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	model: zod.z.string(),
+	kind: zod.z.string(),
+	/** `true` when the frame would leave the house (a cloud vendor, or an
+	*  endpoint that is not on the local network). The page confirms each such
+	*  run, and the provider refuses one without `allowCloud`. */
+	leavesHouse: zod.z.boolean()
+});
+/** A box the AI assist proposed: a draft, plus the model's own reason. */
+var RetrainLlmProposalSchema = RetrainAnnotationDraftSchema.extend({ reason: zod.z.string() });
+/** What the AI assist said about a box that was already on the canvas. */
+var RetrainLlmReviewSchema = zod.z.object({
+	/** The `ref` the page sent the box under. */
+	ref: zod.z.string(),
+	verdict: zod.z.enum([
+		"confirmed",
+		"wrong-class",
+		"not-an-object",
+		"uncertain"
+	]),
+	suggestedClass: RetrainMacroClassSchema.optional(),
+	reason: zod.z.string()
+});
+/**
+* The AI assist's answer. `proposed` carries drafts (`source: 'llm'`, the
+* model and its confidence) and reviews; items the model got wrong (a box off
+* the frame, an unasked class, an unknown ref) are dropped and counted in
+* `rejected`. A whole answer that is not the schema is `malformed-answer`.
+*/
+var RetrainLlmAssistResultSchema = zod.z.discriminatedUnion("kind", [zod.z.object({
+	kind: zod.z.literal("proposed"),
+	profileId: zod.z.string(),
+	model: zod.z.string(),
+	/** The frame was sent outside the house for this answer. */
+	leftHouse: zod.z.boolean(),
+	proposals: zod.z.array(RetrainLlmProposalSchema).readonly(),
+	reviews: zod.z.array(RetrainLlmReviewSchema).readonly(),
+	rejected: zod.z.number().int()
+}), zod.z.object({
+	kind: zod.z.literal("refused"),
+	reason: zod.z.enum([
+		"unknown-frame",
+		"unreadable-frame",
+		"unknown-profile",
+		"profile-disabled",
+		"no-vision",
+		"cloud-not-confirmed",
+		"llm-error",
+		"malformed-answer"
+	]),
+	detail: zod.z.string().optional()
+})]);
 /** The outcome of a lifecycle move owned by the retrain page. */
 var RetrainTransitionResultSchema = zod.z.object({
 	trackId: zod.z.string(),
@@ -26053,7 +26493,7 @@ var pipelineAnalyticsCapability = {
 		*  a frame leaves the dataset before export. */
 		deselectRetrainFrame: require_sleep.method(zod.z.object({
 			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
+			trackId: zod.z.string().optional(),
 			frameId: zod.z.string()
 		}), zod.z.object({
 			removed: zod.z.boolean(),
@@ -26096,7 +26536,8 @@ var pipelineAnalyticsCapability = {
 		*/
 		proposeRetrainAnnotations: require_sleep.method(zod.z.object({
 			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
+			/** The frame's track, when it has one — checked against the frame. */
+			trackId: zod.z.string().optional(),
 			frameId: zod.z.string(),
 			subject: RetrainAssistSubjectSchema,
 			/** Which node runs it. Absent ⇒ wherever an unowned call lands. */
@@ -26105,8 +26546,12 @@ var pipelineAnalyticsCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		/** Every annotation on a track, oldest first. */
-		listRetrainAnnotations: require_sleep.method(zod.z.object({ trackId: zod.z.string() }), zod.z.array(RetrainAnnotationSchema).readonly(), {
+		/** Every annotation on a track, or on named frames (a recording still has
+		*  no track), oldest first. One of the two is required. */
+		listRetrainAnnotations: require_sleep.method(zod.z.object({
+			trackId: zod.z.string().optional(),
+			frameIds: zod.z.array(zod.z.string()).max(2e3).optional()
+		}), zod.z.array(RetrainAnnotationSchema).readonly(), {
 			kind: "query",
 			auth: "admin"
 		}),
@@ -26125,7 +26570,8 @@ var pipelineAnalyticsCapability = {
 		*/
 		saveRetrainAnnotations: require_sleep.method(zod.z.object({
 			deviceId: zod.z.number(),
-			trackId: zod.z.string(),
+			/** The frame's track, when it has one — checked against the frame. */
+			trackId: zod.z.string().optional(),
 			frameId: zod.z.string(),
 			annotations: zod.z.array(RetrainAnnotationDraftSchema)
 		}), zod.z.array(RetrainAnnotationSchema).readonly(), {
@@ -26177,7 +26623,146 @@ var pipelineAnalyticsCapability = {
 		* out, so two crops of the same subject can never end up in one feature
 		* space (D52).
 		*/
-		getRetrainExportUrl: require_sleep.method(zod.z.object({ deviceIds: zod.z.array(zod.z.number()).optional() }), zod.z.object({ url: zod.z.string() }), {
+		getRetrainExportUrl: require_sleep.method(RetrainExportFilterSchema.extend({ layout: RetrainExportLayoutSchema.optional() }), zod.z.object({ url: zod.z.string() }), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* The operator's "every subject in this frame is boxed" — set and cleared
+		* by hand, never derived: a frame with no box may be a complete hard
+		* negative, and a frame with three boxes may still miss a fourth person.
+		*/
+		setRetrainFrameComplete: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string().optional(),
+			frameId: zod.z.string(),
+			complete: zod.z.boolean()
+		}), RetrainFrameSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Stream the annotated archive to a TARGET instead of a browser — the
+		* same tar `getRetrainExportUrl` serves (manifest first, one JPEG in
+		* memory at a time, paced), written chunk by chunk into one HTTP request.
+		* The bytes never cross this cap and never land on the hub's disk; the
+		* answer is what was sent, with its sha256.
+		*/
+		writeRetrainArchive: require_sleep.method(zod.z.object({
+			filter: RetrainExportFilterSchema,
+			layout: RetrainExportLayoutSchema,
+			target: RetrainArchiveTargetSchema
+		}), RetrainArchiveResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 60 * 6e4
+		}),
+		/** The enabled, vision-capable LLM profiles, each saying whether a frame
+		*  sent to it leaves the house. */
+		listRetrainAssistProfiles: require_sleep.method(zod.z.object({}), zod.z.array(RetrainAssistProfileSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
+		* Ask a vision LLM (the `llm` capability) about ONE copied frame: list the
+		* objects of `classes` with boxes, and review the boxes already on the
+		* canvas (sent by `ref`). Answers drafts (`source: 'llm'`) and reviews —
+		* nothing is stored, nothing is accepted. A profile that sends the frame
+		* outside the house is refused unless `allowCloud` says the operator
+		* confirmed this run.
+		*/
+		proposeRetrainAnnotationsWithLlm: require_sleep.method(zod.z.object({
+			deviceId: zod.z.number(),
+			trackId: zod.z.string().optional(),
+			frameId: zod.z.string(),
+			profileId: zod.z.string(),
+			classes: zod.z.array(RetrainMacroClassSchema).min(1),
+			boxes: zod.z.array(zod.z.object({
+				ref: zod.z.string(),
+				bbox: RetrainBboxSchema,
+				macroClass: RetrainMacroClassSchema,
+				label: zod.z.string().optional()
+			})).max(50),
+			allowCloud: zod.z.boolean()
+		}), RetrainLlmAssistResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 18e4
+		}),
+		/**
+		* Create a named collection — a set over the retrain corpus ("packages
+		* porch night"). Names are unique case-insensitively and never empty;
+		* both refusals are named.
+		*/
+		createRetrainCollection: require_sleep.method(zod.z.object({ name: zod.z.string().max(120) }), RetrainCollectionCreateResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Every collection, newest first, with its frame count. */
+		listRetrainCollections: require_sleep.method(zod.z.object({}), zod.z.array(RetrainCollectionSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		renameRetrainCollection: require_sleep.method(zod.z.object({
+			id: zod.z.string(),
+			name: zod.z.string().max(120)
+		}), RetrainCollectionRenameResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Delete a collection. Its recording stills that no other collection
+		* holds are deleted with their annotations (nothing else reaches them);
+		* frames copied from tracks always stay in the dataset.
+		*/
+		deleteRetrainCollection: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.object({
+			deleted: zod.z.boolean(),
+			removedFrames: zod.z.number().int()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Add the frame at a recording instant to a collection — the frame the
+		* model may have seen NOTHING in. The recorder re-decodes the native
+		* frame at `epochMs`; the dataset copies it (trackless, durable). The same
+		* moment twice is one copy. Every refusal is named.
+		*/
+		addRetrainFrameFromRecording: require_sleep.method(zod.z.object({
+			collectionId: zod.z.string(),
+			deviceId: zod.z.number(),
+			epochMs: zod.z.number()
+		}), AddRetrainFrameFromRecordingResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 6e4
+		}),
+		/** Add frames already in the dataset to a collection. */
+		addRetrainFramesToCollection: require_sleep.method(zod.z.object({
+			collectionId: zod.z.string(),
+			frameIds: zod.z.array(zod.z.string()).min(1).max(500)
+		}), zod.z.object({
+			added: zod.z.number().int(),
+			alreadyMember: zod.z.number().int(),
+			unknownFrameIds: zod.z.array(zod.z.string()).readonly()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Remove a frame from a collection. A recording still left in no
+		*  collection is deleted with its annotations (`deletedFrame`). */
+		removeRetrainFrameFromCollection: require_sleep.method(zod.z.object({
+			collectionId: zod.z.string(),
+			frameId: zod.z.string()
+		}), zod.z.object({
+			removed: zod.z.boolean(),
+			deletedFrame: zod.z.boolean()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The frames of a collection, with their pipeline boxes. */
+		listRetrainCollectionFrames: require_sleep.method(zod.z.object({ collectionId: zod.z.string() }), zod.z.array(RetrainFrameSchema).readonly(), {
 			kind: "query",
 			auth: "admin"
 		}),
@@ -27127,13 +27712,31 @@ var RecommendationReasonSchema = zod.z.discriminatedUnion("kind", [
 	zod.z.object({
 		kind: zod.z.literal("no-family-build"),
 		format: ModelFormatSchema$1
+	}),
+	zod.z.object({
+		kind: zod.z.literal("kept-custom-pin"),
+		modelId: zod.z.string(),
+		deviceKey: zod.z.string()
 	})
 ]);
+/** Why a device is left exactly as it is, whatever the plan would pick (D786). */
+var KeptReasonSchema = zod.z.enum(["custom-pin"]);
+/**
+* Where a choice's latency came from (D791): this node's own benchmark
+* result, or the hardware-class table. Measured on the node beats the table.
+*/
+var LatencySourceSchema = zod.z.discriminatedUnion("kind", [zod.z.object({ kind: zod.z.literal("table") }), zod.z.object({
+	kind: zod.z.literal("node-benchmark"),
+	resultId: zod.z.string(),
+	measuredAtMs: zod.z.number()
+})]);
 var DeviceModelChoiceSchema = zod.z.object({
 	modelId: zod.z.string(),
 	p50Ms: zod.z.number(),
 	fps: zod.z.number(),
 	measured: zod.z.boolean(),
+	/** Absent on a plan from before D791 — read as the table. */
+	source: LatencySourceSchema.optional(),
 	/** Parallel sessions at the camera rate with the headroom kept free: ⌊fps × (1 − headroom) / camera fps⌋. */
 	capacitySessions: zod.z.number(),
 	personRecall: zod.z.number()
@@ -27144,6 +27747,8 @@ var DeviceRecommendationSchema = zod.z.object({
 	enabled: zod.z.boolean(),
 	available: zod.z.boolean(),
 	chosen: DeviceModelChoiceSchema.nullable(),
+	/** Present when the device is kept as is: Apply writes nothing on it. */
+	kept: KeptReasonSchema.optional(),
 	reasons: zod.z.array(RecommendationReasonSchema).readonly()
 });
 var NodeRecommendationSchema = zod.z.object({
@@ -27197,6 +27802,17 @@ var AutoTuneWarningSchema = zod.z.discriminatedUnion("kind", [
 		kind: zod.z.literal("coral-enabled"),
 		nodeId: zod.z.string(),
 		deviceKey: zod.z.string()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("custom-pin-kept"),
+		nodeId: zod.z.string(),
+		deviceKey: zod.z.string().nullable(),
+		deviceId: zod.z.number().nullable(),
+		modelId: zod.z.string()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("custom-registry-unreadable"),
+		error: zod.z.string()
 	})
 ]);
 var AutoTuneOptionsSchema = zod.z.object({
@@ -27389,13 +28005,14 @@ var SuggestSharesResultSchema = zod.z.object({
 	nodes: zod.z.array(SuggestedNodeShareSchema).readonly()
 });
 /**
-* Where the node and device shares come from (D750, D755).
-*  - `hardware` (default) — computed by the system from each node's static
-*    capacity (its accelerators at their Auto tune models, from the measured
-*    latency table), recomputed whenever a node or device joins, leaves, is
-*    switched on or off, or changes model. No load input.
-*  - `benchmark` — the same, from each node's measured capacity (node
-*    benchmark results); a node without results falls back to `hardware`.
+* Where the node and device shares come from (D750, D755, D791).
+*  - `benchmark` (default since D791) — each node's capacity as its own node
+*    benchmark measured it; a node without fresh results is sized from
+*    `hardware` and says so. Measured on the node beats the table.
+*  - `hardware` — computed from each node's static capacity only (its
+*    accelerators at their Auto tune models, from the latency table).
+*  Both are recomputed whenever a node or device joins, leaves, is switched
+*  on or off, changes model, or a benchmark result is written. No load input.
 *  - `manual` — the operator's stored sliders.
 * Either way a node or device that cannot take sessions gives its share to
 * the others in proportion; the stored values are never rewritten for that.
@@ -27405,7 +28022,7 @@ var ShareSourceSchema = zod.z.enum([
 	"benchmark",
 	"manual"
 ]);
-var DEFAULT_SHARE_SOURCE = "hardware";
+var DEFAULT_SHARE_SOURCE = "benchmark";
 /** `hardware` or `benchmark`: the system computes the shares. */
 function isAutomaticShareSource(source) {
 	return source !== "manual";
@@ -27419,6 +28036,7 @@ var SHARE_SOURCE_SETTING_KEY = "shareSource";
 * D755 split it) reads as `hardware` — that is what it computed.
 */
 function parseShareSource(value) {
+	if (value === "auto") return "hardware";
 	const parsed = ShareSourceSchema.safeParse(value);
 	return parsed.success ? parsed.data : DEFAULT_SHARE_SOURCE;
 }
@@ -27463,6 +28081,371 @@ var EffectiveSharesSchema = zod.z.object({
 	deviceWeights: zod.z.record(zod.z.string(), zod.z.record(zod.z.string(), zod.z.number()))
 });
 //#endregion
+//#region src/pipeline/node-benchmark/schemas.ts
+/**
+* Wire shapes of the node benchmark (D791): the operator's plan, the
+* preflight the confirmation shows, the run the orchestrator owns, what the
+* measuring runner reports, and the result rows Auto tune and the automatic
+* shares read.
+*
+* ONE node at a time, owned by the pipeline orchestrator. While a run is
+* active the cluster is in BENCHMARK MODE for that node: it is not a
+* detection candidate, camera pins naming it are ignored so its sessions move
+* elsewhere, and both come back when the mode ends — after a crash or a hub
+* restart too (a persisted manifest, reconciled against the registry).
+*
+* Two measurements, both on the node, driven by its own runner (frames never
+* cross a process at frame rate, D9):
+*  - `device` — one accelerator × one candidate detector, root only, open
+*    loop: how many streams at the camera rate it carries inside the frame
+*    interval;
+*  - `pipeline` — the chosen detector plus the operator's detail steps
+*    (faces, plates, classifiers, CLIP…), on varied frames from the bench
+*    clip: how many parallel sessions the node carries before latency, drops,
+*    CPU, RAM or the event loop give out.
+*/
+/** Defaults and bounds, one place. */
+var NODE_BENCHMARK_DEFAULTS = {
+	fpsPerStream: 10,
+	budgetMinutes: 45,
+	minBudgetMinutes: 10,
+	maxBudgetMinutes: 120,
+	/** A result older than this no longer beats the table. */
+	staleAfterDays: 30,
+	/** Warm-in per ramp step (not accounted). */
+	settleSec: 5,
+	/** Accounted window per ramp step. */
+	measureSec: 20,
+	/** Longest the drain may take before the run is refused. */
+	drainTimeoutSec: 120,
+	/** Candidate models per device in one run. */
+	maxModelsPerDevice: 6
+};
+/** The two measurements a run can make. */
+var NodeBenchmarkPhaseSchema = zod.z.enum(["device", "pipeline"]);
+var NodeBenchmarkDevicePlanSchema = zod.z.object({
+	/** `<backend>:<device>` — `openvino:npu`, `coreml:all`, `cpu`. */
+	deviceKey: zod.z.string().min(1),
+	/**
+	* Root detector candidates for the `device` measurement, in the order
+	* measured. The FIRST is the one the `pipeline` measurement runs.
+	*/
+	modelIds: zod.z.array(zod.z.string().min(1)).min(1).max(NODE_BENCHMARK_DEFAULTS.maxModelsPerDevice)
+});
+/** What the operator confirmed. */
+var NodeBenchmarkPlanSchema = zod.z.object({
+	nodeId: zod.z.string().min(1),
+	devices: zod.z.array(NodeBenchmarkDevicePlanSchema).min(1),
+	/** Which measurements run. At least one. */
+	phases: zod.z.array(NodeBenchmarkPhaseSchema).min(1).default(["device", "pipeline"]),
+	/**
+	* Detail steps (catalog step ids under the root: faces, plates,
+	* classifiers, CLIP…) the `pipeline` measurement enables. The root
+	* detector always runs.
+	*/
+	steps: zod.z.array(zod.z.string().min(1)).default([]),
+	/** Offered rate of one stream / session. */
+	fpsPerStream: zod.z.number().int().min(1).max(30).default(NODE_BENCHMARK_DEFAULTS.fpsPerStream),
+	/** Hard deadline: the mode ends and the cluster is restored when it passes. */
+	budgetMinutes: zod.z.number().int().min(NODE_BENCHMARK_DEFAULTS.minBudgetMinutes).max(NODE_BENCHMARK_DEFAULTS.maxBudgetMinutes).default(NODE_BENCHMARK_DEFAULTS.budgetMinutes),
+	/** Keep the models the run downloaded (default: delete what was not installed before). */
+	keepDownloadedModels: zod.z.boolean().default(false),
+	/** Start although the other nodes' capacity does not cover the sessions running now. */
+	acceptInsufficientHeadroom: zod.z.boolean().default(false)
+});
+/** Why a run cannot start. `overridable` ones are lifted by a plan flag. */
+var NodeBenchmarkRefusalKindSchema = zod.z.enum([
+	"benchmark-active",
+	"node-offline",
+	"unknown-device",
+	"no-phase",
+	"insufficient-headroom"
+]);
+var NodeBenchmarkRefusalSchema = zod.z.object({
+	kind: NodeBenchmarkRefusalKindSchema,
+	detail: zod.z.string(),
+	overridable: zod.z.boolean()
+});
+/** A camera whose detection leaves the node for the run. */
+var NodeBenchmarkMovingCameraSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	/** Placed on the node now (a standing attach or a running session). */
+	placedOnNode: zod.z.boolean(),
+	/** A node pin naming this node, ignored for the run. */
+	pinnedToNode: zod.z.boolean()
+});
+/** A camera that cannot leave: no other node can obtain its frames. */
+var NodeBenchmarkStayingCameraSchema = zod.z.object({
+	deviceId: zod.z.number(),
+	reason: zod.z.literal("only-frame-source")
+});
+var NodeBenchmarkPreflightSchema = zod.z.object({
+	nodeId: zod.z.string(),
+	online: zod.z.boolean(),
+	moving: zod.z.array(NodeBenchmarkMovingCameraSchema).readonly(),
+	/** Keep running on the node during the run; the result is flagged contaminated. */
+	staying: zod.z.array(NodeBenchmarkStayingCameraSchema).readonly(),
+	estimatedDurationMs: zod.z.number(),
+	/** The run ends and the cluster is restored at the latest after this long. */
+	budgetMs: zod.z.number(),
+	phases: zod.z.array(NodeBenchmarkPhaseSchema).readonly(),
+	steps: zod.z.array(zod.z.string()).readonly(),
+	devices: zod.z.array(NodeBenchmarkDevicePlanSchema).readonly(),
+	/** Parallel sessions the cluster runs now, and what the other nodes can carry. */
+	headroom: zod.z.object({
+		sessionsNow: zod.z.number(),
+		otherNodesCapacitySessions: zod.z.number().nullable()
+	}),
+	refusals: zod.z.array(NodeBenchmarkRefusalSchema).readonly(),
+	canStart: zod.z.boolean()
+});
+/** Where the measuring runner is. */
+var NodeBenchProgressSchema = zod.z.object({
+	phase: zod.z.enum([
+		"preparing",
+		"device",
+		"pipeline",
+		"cleanup"
+	]),
+	deviceKey: zod.z.string().nullable(),
+	modelId: zod.z.string().nullable(),
+	/** Streams (device) or sessions (pipeline) of the step running now. */
+	load: zod.z.number().nullable(),
+	cellsDone: zod.z.number(),
+	cellsTotal: zod.z.number(),
+	message: zod.z.string()
+});
+/** What limited a ramp. `none` = the ramp ran out of steps still passing. */
+var NodeBenchLimitSchema = zod.z.enum([
+	"p95",
+	"drops",
+	"errors",
+	"stall",
+	"cpu",
+	"ram",
+	"none"
+]);
+var NodeBenchRampStepSchema = zod.z.object({
+	load: zod.z.number(),
+	pass: zod.z.boolean(),
+	p95Ms: zod.z.number(),
+	dropRatio: zod.z.number(),
+	/** Completed frames per second over the accounted window. */
+	fps: zod.z.number(),
+	cpuPct: zod.z.number().nullable(),
+	ramFreePct: zod.z.number().nullable(),
+	failReasons: zod.z.array(zod.z.string()).readonly()
+});
+/** One measured device × detector (the `device` measurement). */
+var NodeBenchDeviceCellSchema = zod.z.object({
+	phase: zod.z.literal("device"),
+	deviceKey: zod.z.string(),
+	modelId: zod.z.string(),
+	/** Single-stream latency (the K = 1 step). */
+	p50Ms: zod.z.number(),
+	p95Ms: zod.z.number(),
+	p99Ms: zod.z.number(),
+	/** Frames per second sustained at the last passing step. */
+	fps: zod.z.number(),
+	/** Streams at the camera rate the device carried inside the frame interval; 0 = not even one. */
+	kMax: zod.z.number(),
+	limitedBy: NodeBenchLimitSchema,
+	/** First call (model load + warm-up). */
+	warmupMs: zod.z.number(),
+	ramp: zod.z.array(NodeBenchRampStepSchema).readonly()
+});
+/** One measured pipeline (the `pipeline` measurement) on a device. */
+var NodeBenchPipelineCellSchema = zod.z.object({
+	phase: zod.z.literal("pipeline"),
+	deviceKey: zod.z.string(),
+	modelId: zod.z.string(),
+	steps: zod.z.array(zod.z.string()).readonly(),
+	/** Parallel sessions at the camera rate the node carried; 0 = not even one. */
+	maxSessions: zod.z.number(),
+	limitedBy: NodeBenchLimitSchema,
+	/** Detail steps that produced at least one result on the clip — a step that never fired measured nothing. */
+	stepsFired: zod.z.array(zod.z.string()).readonly(),
+	warmupMs: zod.z.number(),
+	ramp: zod.z.array(NodeBenchRampStepSchema).readonly()
+});
+var NodeBenchCellSchema = zod.z.discriminatedUnion("phase", [NodeBenchDeviceCellSchema, NodeBenchPipelineCellSchema]);
+/**
+* What a result was measured ON. A result whose fingerprint no longer matches
+* the node no longer beats the table.
+*/
+var NodeBenchFingerprintSchema = zod.z.object({
+	pipelineVersion: zod.z.string().nullable(),
+	cpuModel: zod.z.string().nullable(),
+	ramGb: zod.z.number().nullable(),
+	os: zod.z.string().nullable(),
+	/** Per device: the pool the cells ran on (runtime + tuning). */
+	pools: zod.z.record(zod.z.string(), zod.z.object({
+		runtime: zod.z.string(),
+		numWorkers: zod.z.number(),
+		concurrency: zod.z.number(),
+		batchMode: zod.z.string()
+	})).default({})
+});
+/** The frames the run used. */
+var NodeBenchClipSchema = zod.z.object({
+	/** `camstack-bench-v1` or `reference-images` (the fallback when the clip is not reachable). */
+	id: zod.z.string(),
+	revision: zod.z.string().nullable(),
+	frames: zod.z.number(),
+	width: zod.z.number(),
+	height: zod.z.number()
+});
+var NodeBenchRunnerInputSchema = zod.z.object({
+	runId: zod.z.string().min(1),
+	devices: zod.z.array(NodeBenchmarkDevicePlanSchema).min(1),
+	phases: zod.z.array(NodeBenchmarkPhaseSchema).min(1),
+	/** The full detail step tree root for the `pipeline` measurement is built on the node from these ids. */
+	steps: zod.z.array(zod.z.string()).default([]),
+	fpsPerStream: zod.z.number().int().min(1).max(30),
+	/** The runner stops on its own past this instant, whatever the hub does. */
+	deadlineAtMs: zod.z.number(),
+	settleSec: zod.z.number().min(0).max(60).default(NODE_BENCHMARK_DEFAULTS.settleSec),
+	measureSec: zod.z.number().min(2).max(300).default(NODE_BENCHMARK_DEFAULTS.measureSec),
+	keepDownloadedModels: zod.z.boolean().default(false)
+});
+var NodeBenchRunnerStateSchema = zod.z.enum([
+	"running",
+	"done",
+	"failed",
+	"aborted"
+]);
+var NodeBenchRunnerStatusSchema = zod.z.object({
+	runId: zod.z.string(),
+	nodeId: zod.z.string(),
+	state: NodeBenchRunnerStateSchema,
+	progress: NodeBenchProgressSchema.nullable(),
+	/** Every finished cell so far — a run stopped half way keeps what it measured. */
+	cells: zod.z.array(NodeBenchCellSchema).readonly(),
+	fingerprint: NodeBenchFingerprintSchema.nullable(),
+	clip: NodeBenchClipSchema.nullable(),
+	/** Cameras seen running on the node during the run (they share its pools). */
+	activeCameraIds: zod.z.array(zod.z.number()).readonly(),
+	/** Models the run downloaded and then deleted (not installed before). */
+	deletedModels: zod.z.array(zod.z.string()).readonly(),
+	error: zod.z.string().nullable(),
+	startedAtMs: zod.z.number(),
+	finishedAtMs: zod.z.number().nullable()
+});
+var NodeBenchmarkStateSchema = zod.z.enum([
+	"draining",
+	"measuring",
+	"restoring",
+	"done",
+	"failed",
+	"aborted"
+]);
+/** Why a run ended. */
+var NodeBenchmarkEndReasonSchema = zod.z.enum([
+	"completed",
+	"operator-abort",
+	"deadline",
+	"node-lost",
+	"runner-lost",
+	"hub-restart",
+	"drain-timeout",
+	"failed"
+]);
+var NodeBenchmarkRunSchema = zod.z.object({
+	runId: zod.z.string(),
+	nodeId: zod.z.string(),
+	state: NodeBenchmarkStateSchema,
+	plan: NodeBenchmarkPlanSchema,
+	startedAtMs: zod.z.number(),
+	deadlineAtMs: zod.z.number(),
+	finishedAtMs: zod.z.number().nullable(),
+	endReason: NodeBenchmarkEndReasonSchema.nullable(),
+	error: zod.z.string().nullable(),
+	/** Cameras moved off the node for the run. */
+	moved: zod.z.array(zod.z.number()).readonly(),
+	/** Cameras that stayed (their only frame source is the node). */
+	staying: zod.z.array(zod.z.number()).readonly(),
+	/** Something else ran on the node's pools during the run. */
+	contaminated: zod.z.boolean(),
+	progress: NodeBenchProgressSchema.nullable(),
+	resultIds: zod.z.array(zod.z.string()).readonly()
+});
+/** `getNodeBenchmarkStatus`: the active run (or the last one), and whether benchmark mode is on. */
+var NodeBenchmarkStatusSchema = zod.z.object({
+	/** The node the cluster is in benchmark mode for; null = none. */
+	modeNodeId: zod.z.string().nullable(),
+	run: NodeBenchmarkRunSchema.nullable()
+});
+/**
+* One stored measurement — the only authority Auto tune and the automatic
+* shares read measured capacity from. Written by the orchestrator when a run
+* ends, never by anyone else.
+*/
+var NodeBenchmarkResultSchema = zod.z.object({
+	id: zod.z.string(),
+	runId: zod.z.string(),
+	nodeId: zod.z.string(),
+	cell: NodeBenchCellSchema,
+	fpsPerStream: zod.z.number(),
+	fingerprint: NodeBenchFingerprintSchema.nullable(),
+	clip: NodeBenchClipSchema.nullable(),
+	/** Other work shared the node's pools (a camera that could not move, or the hub's own duties). */
+	contaminated: zod.z.boolean(),
+	stayingCameras: zod.z.array(zod.z.number()).readonly(),
+	/** The run ended early; the cell itself completed. */
+	partialRun: zod.z.boolean(),
+	measuredAtMs: zod.z.number()
+});
+var ListNodeBenchmarkResultsInputSchema = zod.z.object({
+	nodeId: zod.z.string().optional(),
+	deviceKey: zod.z.string().optional()
+});
+/** A result with its standing today: does it still beat the table? */
+var NodeBenchmarkResultViewSchema = NodeBenchmarkResultSchema.extend({
+	/** `fresh` beats the table; `stale` falls back to it; `superseded` = a newer row covers the same cell. */
+	standing: zod.z.enum([
+		"fresh",
+		"stale",
+		"superseded"
+	]),
+	staleWhy: zod.z.enum([
+		"age",
+		"runtime",
+		"pool-tuning"
+	]).nullable()
+});
+/** The manifest persisted BEFORE benchmark mode changes anything; its presence means "restore". */
+var NodeBenchmarkManifestSchema = zod.z.object({
+	runId: zod.z.string(),
+	nodeId: zod.z.string(),
+	startedAtMs: zod.z.number(),
+	deadlineAtMs: zod.z.number(),
+	plan: NodeBenchmarkPlanSchema,
+	moved: zod.z.array(zod.z.number()).readonly(),
+	staying: zod.z.array(zod.z.number()).readonly()
+});
+/** Candidate detectors per device, for the plan editor. */
+var NodeBenchmarkCandidatesSchema = zod.z.object({
+	nodeId: zod.z.string(),
+	reachable: zod.z.boolean(),
+	devices: zod.z.array(zod.z.object({
+		deviceKey: zod.z.string(),
+		enabled: zod.z.boolean(),
+		available: zod.z.boolean(),
+		/** Ordered: what Auto tune would pick first, then the rest of the family by accuracy. */
+		suggested: zod.z.array(zod.z.string()).readonly(),
+		/** Every root detector the device has a build for. */
+		all: zod.z.array(zod.z.string()).readonly(),
+		/** The model the device runs now, when pinned. */
+		currentModelId: zod.z.string().nullable()
+	})).readonly(),
+	/** Detail steps the node's catalog offers under the root (for the `pipeline` measurement). */
+	steps: zod.z.array(zod.z.object({
+		id: zod.z.string(),
+		name: zod.z.string(),
+		slot: zod.z.string()
+	})).readonly()
+});
+//#endregion
 //#region src/capabilities/schemas/orchestrator-metrics.ts
 /** Shared Zod schemas for the runtime pipeline orchestrator metrics. */
 var OrchestratorMetricsSchema = zod.z.object({
@@ -28980,7 +29963,30 @@ var pipelineRunnerCapability = {
 		releaseParkedTrackFrames: require_sleep.method(zod.z.object({
 			deviceId: zod.z.number(),
 			trackId: zod.z.string()
-		}), zod.z.object({ released: zod.z.number().int().nonnegative() }), { kind: "mutation" })
+		}), zod.z.object({ released: zod.z.number().int().nonnegative() }), { kind: "mutation" }),
+		/**
+		* Start measuring THIS node for the orchestrator's node benchmark: the
+		* bench clip decoded once into RAM, each device × candidate detector on an
+		* open-loop ramp (`device`), then the chosen pipeline with the requested
+		* detail steps (`pipeline`). Everything runs in-process with the executor
+		* — no frame crosses a node (D9) — and writes nothing: no track, event,
+		* media or notification. Reached by `nodePin(nodeId)`. Answers at once;
+		* one run per node; the run stops itself at `deadlineAtMs`.
+		*/
+		startNodeBench: require_sleep.method(NodeBenchRunnerInputSchema, zod.z.object({
+			accepted: zod.z.literal(true),
+			runId: zod.z.string()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The run's progress and every finished cell; null when this runner does not know `runId`. */
+		getNodeBenchStatus: require_sleep.method(zod.z.object({ runId: zod.z.string() }), NodeBenchRunnerStatusSchema.nullable(), { auth: "admin" }),
+		/** Stop the run; what it finished is kept. */
+		abortNodeBench: require_sleep.method(zod.z.object({ runId: zod.z.string() }), zod.z.object({ aborted: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 //#endregion
@@ -29956,6 +30962,51 @@ var pipelineOrchestratorCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* Node benchmark — what a run of this plan would do, without doing it:
+		* the cameras that leave the node, those that cannot (the node is their
+		* only frame source; they stay and flag the run), the estimated duration
+		* and every reason it may not start. The confirmation shows this.
+		*/
+		getNodeBenchmarkPreflight: require_sleep.method(NodeBenchmarkPlanSchema, NodeBenchmarkPreflightSchema, { auth: "admin" }),
+		/**
+		* Node benchmark — start ONE run (cluster-wide lock). The orchestrator
+		* persists a restore manifest, enters benchmark mode for the node (out of
+		* placement, its camera pins ignored, nothing rewritten), drains it, drives
+		* the node's own runner, then restores — always, including after an
+		* abort, a lost node or a hub restart. Answers at once; poll
+		* `getNodeBenchmarkStatus`. Refused runs carry the preflight.
+		*/
+		startNodeBenchmark: require_sleep.method(NodeBenchmarkPlanSchema, zod.z.discriminatedUnion("kind", [zod.z.object({
+			kind: zod.z.literal("started"),
+			runId: zod.z.string()
+		}), zod.z.object({
+			kind: zod.z.literal("refused"),
+			preflight: NodeBenchmarkPreflightSchema
+		})]), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Node benchmark — the active run (or the last one) and the node in benchmark mode. */
+		getNodeBenchmarkStatus: require_sleep.method(zod.z.void(), NodeBenchmarkStatusSchema, { auth: "admin" }),
+		/** Node benchmark — stop the active run; the cluster is restored as it was. */
+		abortNodeBenchmark: require_sleep.method(zod.z.object({ runId: zod.z.string() }), zod.z.object({ aborted: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Node benchmark — root detector candidates per device (what Auto tune
+		* would pick first, then the family) and the detail steps the node's
+		* catalog offers, for the plan editor.
+		*/
+		getNodeBenchmarkCandidates: require_sleep.method(zod.z.object({ nodeId: zod.z.string() }), NodeBenchmarkCandidatesSchema, { auth: "admin" }),
+		/** Node benchmark — stored results, newest first, each with its standing today. */
+		listNodeBenchmarkResults: require_sleep.method(ListNodeBenchmarkResultsInputSchema, zod.z.array(NodeBenchmarkResultViewSchema).readonly(), { auth: "admin" }),
+		/** Node benchmark — delete one result; Auto tune and the shares stop reading it. */
+		deleteNodeBenchmarkResult: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.object({ deleted: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Read one camera's settings. Null when never touched (inherits agent defaults fully). */
 		getCameraSettings: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), CameraPipelineSettingsSchema.nullable()),
 		/** Set or clear the 3-state toggle for one (camera, addonId). Pass `enabled: null` to clear and revert to agent default. */
@@ -30951,7 +32002,19 @@ var SsoBridgeClaimsSchema = zod.z.object({
 	* editing a descriptor must not retroactively extend or shorten a link the
 	* operator already consented to.
 	*/
-	refreshTtl: zod.z.union([zod.z.number().int().positive(), zod.z.literal("never")]).optional()
+	refreshTtl: zod.z.union([zod.z.number().int().positive(), zod.z.literal("never")]).optional(),
+	/**
+	* Opaque handle of a hub-side LINK intent (D782). Set by an OIDC callback
+	* that was started from a signed-in user's "Link" button: the finish then
+	* links this identity to the intent's user instead of signing anyone in.
+	* The handle carries no user id — the hub resolves it, single-use.
+	*/
+	linkIntent: zod.z.string().optional(),
+	/**
+	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
+	* subject is unique only per issuer, so a link is bound to it.
+	*/
+	issuer: zod.z.string().optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -38052,6 +39115,9 @@ var CreateIntegrationInputSchema = zod.z.object({
 	enabled: zod.z.boolean().optional(),
 	info: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
 	settings: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+	/** Keys of `settings` the form's schema declares secret (by type) — kept in
+	*  the keychain, not the table (D787). */
+	secretKeys: zod.z.array(zod.z.string()).optional(),
 	skipRestart: zod.z.boolean().optional()
 });
 var UpdateIntegrationInputSchema = zod.z.object({
@@ -38087,7 +39153,9 @@ var integrationsCapability = {
 		getSettings: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.record(zod.z.string(), zod.z.unknown()), { auth: "admin" }),
 		setSettings: require_sleep.method(zod.z.object({
 			id: zod.z.string(),
-			settings: zod.z.record(zod.z.string(), zod.z.unknown())
+			settings: zod.z.record(zod.z.string(), zod.z.unknown()),
+			/** Keys the form's schema declares secret (by type) — keychain-stored (D787). */
+			secretKeys: zod.z.array(zod.z.string()).optional()
 		}), zod.z.object({ success: zod.z.boolean() }), {
 			kind: "mutation",
 			auth: "admin"
@@ -47165,6 +48233,22 @@ var TotpStatusSchema = zod.z.object({
 * delegation, structural caller-scope subset check goes inside the
 * provider.
 */
+var ExternalIdentitySchema = zod.z.object({
+	/** Login-method id of the provider instance, e.g. `auth-oidc/authentik`. */
+	provider: zod.z.string(),
+	/** The IdP's stable subject (`sub`) for this account. */
+	subject: zod.z.string(),
+	/** The verified `iss` of the IdP the identity was linked under — `sub` is unique only per issuer. */
+	issuer: zod.z.string(),
+	userId: zod.z.string(),
+	/** What the IdP called the account at link time (username / email) — display only. */
+	label: zod.z.string().optional(),
+	linkedAt: zod.z.number()
+});
+var ExternalIdentityKeySchema = zod.z.object({
+	provider: zod.z.string().min(1),
+	subject: zod.z.string().min(1)
+});
 var userManagementCapability = {
 	name: "user-management",
 	scope: "system",
@@ -47307,6 +48391,32 @@ var userManagementCapability = {
 			username: zod.z.string(),
 			scopes: zod.z.array(TokenScopeSchema)
 		}).nullable(), { access: "view" }),
+		listExternalIdentities: require_sleep.method(zod.z.object({ userId: zod.z.string() }), zod.z.array(ExternalIdentitySchema), { auth: "admin" }),
+		/** The user an identity is linked to, or `null`. */
+		findUserByExternalIdentity: require_sleep.method(ExternalIdentityKeySchema, zod.z.object({
+			userId: zod.z.string(),
+			issuer: zod.z.string()
+		}).nullable(), { auth: "admin" }),
+		/**
+		* Link `(provider, subject)` to `userId`. Idempotent for the same user;
+		* REFUSES (throws) an identity already linked to another user, and a
+		* user that does not exist.
+		*/
+		linkExternalIdentity: require_sleep.method(ExternalIdentityKeySchema.extend({
+			userId: zod.z.string(),
+			issuer: zod.z.string().min(1),
+			label: zod.z.string().optional()
+		}), zod.z.object({ success: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
+		}),
+		/** Remove one link of `userId`. `success: false` when it was not linked to that user. */
+		unlinkExternalIdentity: require_sleep.method(ExternalIdentityKeySchema.extend({ userId: zod.z.string() }), zod.z.object({ success: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "delete"
+		}),
 		listOauthSessions: require_sleep.method(zod.z.void(), zod.z.array(OauthSessionSummarySchema), { auth: "admin" }),
 		revokeOauthSession: require_sleep.method(zod.z.object({ id: zod.z.string() }), zod.z.object({ success: zod.z.boolean() }), {
 			kind: "mutation",
@@ -49739,7 +50849,8 @@ var BaseDevice = class {
 		this.role = options.role;
 		this.parentDeviceId = ctx.parentDeviceId;
 		const seedData = ctx.persistedConfig ?? {};
-		this.config = DeviceConfig.fromSchema(schema, (data) => ctx.persistConfig(data), seedData, ({ droppedKeys, issues }) => {
+		const declaredSecretPaths = require_sleep.collectZodSecretPaths(schema);
+		this.config = DeviceConfig.fromSchema(schema, (data) => ctx.persistConfig(data, { secretConfigPaths: declaredSecretPaths }), seedData, ({ droppedKeys, issues }) => {
 			ctx.logger.warn("Device config recovery: dropping invalid persisted fields", {
 				tags: {
 					deviceId: ctx.id,
@@ -54243,6 +55354,90 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychain.delete": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychain.getState": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychain.listMeta": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychain.put": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychain.resolve": {
+		capName: "keychain",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.deleteOrphans": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.downloadRecoveryKey": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.listAudit": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.listSecrets": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"keychainAdmin.purgeRetiredKeys": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.resetKeychain": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"keychainAdmin.reveal": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.rotateMasterKey": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"keychainAdmin.status": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"lawnMowerControl.dock": {
 		capName: "lawn-mower-control",
 		capScope: "device",
@@ -55617,6 +56812,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.addRetrainFrameFromRecording": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"pipelineAnalytics.addRetrainFramesToCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.applyDeviceSettingsPatch": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -55665,12 +56872,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.createRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.deleteRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineAnalytics.deleteTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -55875,6 +57094,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRetrainAssistProfiles": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainCollectionFrames": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineAnalytics.listRetrainCollections": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainFrames": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -55923,6 +57160,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.proposeRetrainAnnotationsWithLlm": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.pruneEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -55977,6 +57220,18 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.removeRetrainFrameFromCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
+	"pipelineAnalytics.renameRetrainCollection": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.restageRetrainTrack": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -56007,6 +57262,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.setRetrainFrameComplete": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -56043,6 +57304,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.writeRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineExecutor.cacheFrameInPool": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -56253,6 +57520,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.abortNodeBenchmark": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.applyAutoTune": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -56277,6 +57550,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.deleteNodeBenchmarkResult": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineOrchestrator.getAgentLoad": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -56385,6 +57664,24 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.getNodeBenchmarkCandidates": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineOrchestrator.getNodeBenchmarkPreflight": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"pipelineOrchestrator.getNodeBenchmarkStatus": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.getNodeInferenceDevices": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -56427,6 +57724,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineOrchestrator.listNodeBenchmarkResults": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineOrchestrator.pauseForStorageMigration": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -56571,6 +57874,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.startNodeBenchmark": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.suggestShares": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -56589,6 +57898,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.abortNodeBench": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineRunner.attachCamera": {
 		capName: "pipeline-runner",
 		capScope: "system",
@@ -56637,6 +57952,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineRunner.getNodeBenchStatus": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineRunner.getParkedTrackFrame": {
 		capName: "pipeline-runner",
 		capScope: "system",
@@ -56679,6 +58000,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineRunner.startNodeBench": {
+		capName: "pipeline-runner",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"plateGallery.assignPlate": {
 		capName: "plate-gallery",
 		capScope: "system",
@@ -58395,18 +59722,36 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userManagement.findUserByExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.getTotpStatus": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.linkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.listExternalIdentities": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.listOauthSessions": {
 		capName: "user-management",
 		capScope: "system",
@@ -58485,6 +59830,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userManagement.unlinkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"userManagement.updateUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -59001,6 +60352,8 @@ var KNOWN_CAP_NAMES = [
 	"image-settings",
 	"integrations",
 	"intercom",
+	"keychain",
+	"keychain-admin",
 	"lawn-mower-control",
 	"llm",
 	"llm-runtime",
@@ -59218,6 +60571,8 @@ var SYSTEM_CAP_NAMES = [
 	"failure-contribution",
 	"filesystem-browse",
 	"integrations",
+	"keychain",
+	"keychain-admin",
 	"llm",
 	"llm-runtime",
 	"load-contribution",
@@ -61350,6 +62705,15 @@ var ENTRY_BY_KEY = new Map(DISPLAY_ICON_VOCABULARY.map((e) => [e.key, e]));
 function isDisplayIconKey(value) {
 	return typeof value === "string" && ENTRY_BY_KEY.has(value);
 }
+/**
+* A stored icon value as a vocabulary key: `value` when it IS one, `fallback`
+* otherwise. For an `icon` settings field (D780) whose stored value may
+* predate the vocabulary (a free-text lucide name) — the field's default is
+* drawn rather than nothing.
+*/
+function resolveDisplayIconKey(value, fallback) {
+	return typeof value === "string" && isDisplayIconKey(value) ? value : fallback;
+}
 /** The entry for a key, or `undefined` — never a guessed one. */
 function displayIconEntry(key) {
 	return ENTRY_BY_KEY.get(key);
@@ -62438,6 +63802,11 @@ function zodToConfigField(key, schema, description) {
 		description,
 		default: defaultValue
 	};
+	if (inner instanceof zod.z.ZodString && require_sleep.isZodSecret(schema)) return {
+		...base,
+		type: "password",
+		showToggle: true
+	};
 	if (inner instanceof zod.z.ZodString) return buildStringField(key, base);
 	if (inner instanceof zod.z.ZodNumber) return buildNumberField(inner, base);
 	if (inner instanceof zod.z.ZodBoolean) return {
@@ -62445,12 +63814,16 @@ function zodToConfigField(key, schema, description) {
 		type: "boolean"
 	};
 	if (inner instanceof zod.z.ZodEnum) return buildEnumField(inner, base);
-	if (inner instanceof zod.z.ZodArray || inner instanceof zod.z.ZodObject) return {
-		...base,
-		type: "textarea",
-		rows: 6,
-		isJson: true
-	};
+	if (inner instanceof zod.z.ZodArray || inner instanceof zod.z.ZodObject) {
+		const holdsSecret = require_sleep.isZodSecret(schema) || require_sleep.collectZodSecretPaths(schema).length > 0;
+		return {
+			...base,
+			type: "textarea",
+			rows: 6,
+			isJson: true,
+			...holdsSecret ? { secret: true } : {}
+		};
+	}
 	return {
 		...base,
 		type: "text"
@@ -62669,6 +64042,8 @@ var CAPABILITY_NAMES = {
 	imageSettings: "image-settings",
 	integrations: "integrations",
 	intercom: "intercom",
+	keychain: "keychain",
+	keychainAdmin: "keychain-admin",
 	lawnMowerControl: "lawn-mower-control",
 	llm: "llm",
 	llmRuntime: "llm-runtime",
@@ -63062,6 +64437,14 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "intercom",
 		name: "intercom"
 	},
+	{
+		key: "keychain",
+		name: "keychain"
+	},
+	{
+		key: "keychainAdmin",
+		name: "keychain-admin"
+	},
 	{
 		key: "lawnMowerControl",
 		name: "lawn-mower-control"
@@ -63508,6 +64891,8 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	imageSettingsCapability,
 	integrationsCapability,
 	intercomCapability,
+	keychainCapability,
+	keychainAdminCapability,
 	lawnMowerControlCapability,
 	llmCapability,
 	llmRuntimeCapability,
@@ -64936,6 +66321,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.addRetrainFrameFromRecording": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.applyDeviceSettingsPatch": [{
 		name: "deviceId",
 		form: "single",
@@ -65126,6 +66516,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.proposeRetrainAnnotationsWithLlm": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.pruneEventsBefore": [{
 		name: "deviceId",
 		form: "single",
@@ -65176,6 +66571,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.setRetrainFrameComplete": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.setTrackFlags": [{
 		name: "deviceId",
 		form: "single",
@@ -67086,6 +68486,17 @@ function createSystemProxy(api) {
 			getAvailableTypes: (input) => dispatch("integrations", "getAvailableTypes", "query", input),
 			testConnection: (input) => dispatch("integrations", "testConnection", "mutation", input)
 		},
+		keychainAdmin: {
+			status: (input) => dispatch("keychainAdmin", "status", "query", input),
+			listSecrets: (input) => dispatch("keychainAdmin", "listSecrets", "query", input),
+			listAudit: (input) => dispatch("keychainAdmin", "listAudit", "query", input),
+			reveal: (input) => dispatch("keychainAdmin", "reveal", "mutation", input),
+			deleteOrphans: (input) => dispatch("keychainAdmin", "deleteOrphans", "mutation", input),
+			rotateMasterKey: (input) => dispatch("keychainAdmin", "rotateMasterKey", "mutation", input),
+			purgeRetiredKeys: (input) => dispatch("keychainAdmin", "purgeRetiredKeys", "mutation", input),
+			downloadRecoveryKey: (input) => dispatch("keychainAdmin", "downloadRecoveryKey", "mutation", input),
+			resetKeychain: (input) => dispatch("keychainAdmin", "resetKeychain", "mutation", input)
+		},
 		llm: {
 			generate: (input) => dispatch("llm", "generate", "mutation", input),
 			generateVision: (input) => dispatch("llm", "generateVision", "mutation", input),
@@ -67305,6 +68716,13 @@ function createSystemProxy(api) {
 			suggestShares: (input) => dispatch("pipelineOrchestrator", "suggestShares", "query", input),
 			getEffectiveShares: (input) => dispatch("pipelineOrchestrator", "getEffectiveShares", "query", input),
 			setShareSource: (input) => dispatch("pipelineOrchestrator", "setShareSource", "mutation", input),
+			getNodeBenchmarkPreflight: (input) => dispatch("pipelineOrchestrator", "getNodeBenchmarkPreflight", "query", input),
+			startNodeBenchmark: (input) => dispatch("pipelineOrchestrator", "startNodeBenchmark", "mutation", input),
+			getNodeBenchmarkStatus: (input) => dispatch("pipelineOrchestrator", "getNodeBenchmarkStatus", "query", input),
+			abortNodeBenchmark: (input) => dispatch("pipelineOrchestrator", "abortNodeBenchmark", "mutation", input),
+			getNodeBenchmarkCandidates: (input) => dispatch("pipelineOrchestrator", "getNodeBenchmarkCandidates", "query", input),
+			listNodeBenchmarkResults: (input) => dispatch("pipelineOrchestrator", "listNodeBenchmarkResults", "query", input),
+			deleteNodeBenchmarkResult: (input) => dispatch("pipelineOrchestrator", "deleteNodeBenchmarkResult", "mutation", input),
 			getCameraStatuses: (input) => dispatch("pipelineOrchestrator", "getCameraStatuses", "query", input),
 			setCameraSensors: (input) => dispatch("pipelineOrchestrator", "setCameraSensors", "mutation", input),
 			reconcileFromDisk: (input) => dispatch("pipelineOrchestrator", "reconcileFromDisk", "mutation", input),
@@ -67318,7 +68736,10 @@ function createSystemProxy(api) {
 			getAllCameraMetrics: (input) => dispatch("pipelineRunner", "getAllCameraMetrics", "query", input),
 			getLocalCameras: (input) => dispatch("pipelineRunner", "getLocalCameras", "query", input),
 			getNativeCrop: (input) => dispatch("pipelineRunner", "getNativeCrop", "query", input),
-			runStatelessStep: (input) => dispatch("pipelineRunner", "runStatelessStep", "mutation", input)
+			runStatelessStep: (input) => dispatch("pipelineRunner", "runStatelessStep", "mutation", input),
+			startNodeBench: (input) => dispatch("pipelineRunner", "startNodeBench", "mutation", input),
+			getNodeBenchStatus: (input) => dispatch("pipelineRunner", "getNodeBenchStatus", "query", input),
+			abortNodeBench: (input) => dispatch("pipelineRunner", "abortNodeBench", "mutation", input)
 		},
 		plateGallery: {
 			getPlateMedia: (input) => dispatch("plateGallery", "getPlateMedia", "query", input),
@@ -67512,6 +68933,10 @@ function createSystemProxy(api) {
 			oauthExchangeCode: (input) => dispatch("userManagement", "oauthExchangeCode", "mutation", input),
 			oauthRefresh: (input) => dispatch("userManagement", "oauthRefresh", "mutation", input),
 			oauthVerifyAccessToken: (input) => dispatch("userManagement", "oauthVerifyAccessToken", "query", input),
+			listExternalIdentities: (input) => dispatch("userManagement", "listExternalIdentities", "query", input),
+			findUserByExternalIdentity: (input) => dispatch("userManagement", "findUserByExternalIdentity", "query", input),
+			linkExternalIdentity: (input) => dispatch("userManagement", "linkExternalIdentity", "mutation", input),
+			unlinkExternalIdentity: (input) => dispatch("userManagement", "unlinkExternalIdentity", "mutation", input),
 			listOauthSessions: (input) => dispatch("userManagement", "listOauthSessions", "query", input),
 			revokeOauthSession: (input) => dispatch("userManagement", "revokeOauthSession", "mutation", input)
 		}
@@ -72901,6 +74326,22 @@ function capacitySessionsOf(fps, headroom, cameraFps) {
 	if (!(fps > 0) || !(cameraFps > 0)) return 0;
 	return Math.max(0, Math.floor(fps * (1 - headroom) / cameraFps + 1e-9));
 }
+/** The table column with the node's own measurements laid over it. */
+function overlayMeasured(table, measured) {
+	if (measured === void 0 || Object.keys(measured).length === 0) return table;
+	const out = { ...table };
+	for (const [modelId, m] of Object.entries(measured)) out[modelId] = {
+		p50Ms: m.p50Ms,
+		fps: m.fps,
+		measured: true,
+		source: {
+			kind: "node-benchmark",
+			resultId: m.resultId,
+			measuredAtMs: m.measuredAtMs
+		}
+	};
+	return out;
+}
 function round(value, digits = 3) {
 	const f = 10 ** digits;
 	return Math.round(value * f) / f;
@@ -72973,6 +74414,7 @@ function choiceOn(ctx, modelId, sizing) {
 		p50Ms: cell.p50Ms,
 		fps: cell.fps,
 		measured: cell.measured,
+		source: cell.source ?? { kind: "table" },
 		capacitySessions: sessionsOn(cell, sizing),
 		personRecall: DETECTOR_ACCURACY[modelId]?.personRecall ?? 0
 	};
@@ -73021,11 +74463,14 @@ function recommendNode(input) {
 	if (node.hardware === null) return skippedNode(node, { kind: "no-hardware-facts" }, null);
 	const hardware = node.hardware;
 	const { hardwareClass, cpuModel } = classifyInferenceHardware(hardware);
-	const classTable = perf[hardwareClass];
-	if (hardwareClass === "unknown" || classTable === void 0) return skippedNode(node, {
+	const measured = input.measured ?? {};
+	const hasMeasured = Object.values(measured).some((m) => Object.keys(m).length > 0);
+	const knownTable = hardwareClass === "unknown" ? void 0 : perf[hardwareClass];
+	if (knownTable === void 0 && !hasMeasured) return skippedNode(node, {
 		kind: "no-measured-data",
 		hardwareClass
 	}, hardwareClass);
+	const classTable = knownTable ?? {};
 	const devices = node.devices.toSorted((a, b) => a.key.localeCompare(b.key));
 	const contexts = /* @__PURE__ */ new Map();
 	const early = /* @__PURE__ */ new Map();
@@ -73043,7 +74488,7 @@ function recommendNode(input) {
 			early.set(device.key, [{ kind: "device-unavailable" }]);
 			continue;
 		}
-		const column = accelerator === null ? void 0 : classTable[accelerator];
+		const column = accelerator === null ? void 0 : overlayMeasured(classTable[accelerator], measured[device.key]);
 		if (accelerator === null || column === void 0) {
 			early.set(device.key, [{
 				kind: "no-family-build",
@@ -73058,13 +74503,28 @@ function recommendNode(input) {
 		});
 	}
 	const isCpu = (a) => a === "x86-cpu" || a === "arm-cpu";
-	const accelerators = [...contexts.values()].filter((c) => !isCpu(c.accelerator));
-	const cpus = [...contexts.values()].filter((c) => isCpu(c.accelerator));
+	const keptByKey = /* @__PURE__ */ new Map();
+	const keptReasonOf = (group) => {
+		const pinned = group.find((c) => c.device.customPinModelId !== void 0);
+		if (pinned?.device.customPinModelId === void 0) return null;
+		const reason = {
+			kind: "kept-custom-pin",
+			modelId: pinned.device.customPinModelId,
+			deviceKey: pinned.device.key
+		};
+		for (const c of group) keptByKey.set(c.device.key, [reason]);
+		return reason;
+	};
+	const acceleratorGroup = [...contexts.values()].filter((c) => !isCpu(c.accelerator));
+	const acceleratorKept = keptReasonOf(acceleratorGroup);
+	const accelerators = acceleratorKept === null ? acceleratorGroup : [];
+	const cpus = [...contexts.values()].filter((c) => isCpu(c.accelerator)).filter((c) => keptReasonOf([c]) === null);
 	const chosenByKey = /* @__PURE__ */ new Map();
 	const reasonsByKey = /* @__PURE__ */ new Map();
 	const nodeReasons = [];
 	let acceleratorModelId = null;
 	const groupPick = accelerators.length > 0 ? pickForGroup(accelerators, node.formatsByModel, sizing) : null;
+	if (acceleratorKept !== null) nodeReasons.push(acceleratorKept);
 	if (groupPick !== null) {
 		acceleratorModelId = groupPick.modelId;
 		nodeReasons.push(...groupPick.reasons);
@@ -73108,7 +74568,8 @@ function recommendNode(input) {
 			enabled: device.enabled,
 			available: device.available,
 			chosen: chosenByKey.get(device.key) ?? null,
-			reasons: early.get(device.key) ?? reasonsByKey.get(device.key) ?? []
+			...keptByKey.has(device.key) ? { kept: "custom-pin" } : {},
+			reasons: early.get(device.key) ?? keptByKey.get(device.key) ?? reasonsByKey.get(device.key) ?? []
 		})),
 		reasons: nodeReasons
 	};
@@ -73358,6 +74819,287 @@ function computeCapacityShares(input) {
 	};
 }
 //#endregion
+//#region src/pipeline/node-benchmark/benchmark-mode.ts
+/**
+* Benchmark mode (D791) — the pure rules of "one node under test". Pure.
+*
+* While the cluster is in benchmark mode for node N:
+*  - N is not a detection candidate for any camera that another node can
+*    serve ({@link eligibleUnderBenchmark});
+*  - a node pin naming N is ignored for such a camera
+*    ({@link pinUnderBenchmark}) — the stored pin is never rewritten, so it
+*    is "restored" the moment the mode ends;
+*  - a camera whose ONLY frame source is N stays on N (never blind) and the
+*    run is flagged contaminated.
+*/
+/** The detection candidates of one camera while `benchNodeId` is under test. */
+function eligibleUnderBenchmark(eligible, benchNodeId) {
+	if (benchNodeId === null || !eligible.includes(benchNodeId)) return eligible;
+	const others = eligible.filter((n) => n !== benchNodeId);
+	return others.length > 0 ? others : eligible;
+}
+/** A camera's node pin while `benchNodeId` is under test (null = no pin). */
+function pinUnderBenchmark(pin, benchNodeId, eligible) {
+	if (pin === null || benchNodeId === null || pin !== benchNodeId) return pin;
+	return eligible.some((n) => n !== benchNodeId) ? null : pin;
+}
+/** Which cameras leave the node for the run, and which cannot. */
+function classifyCamerasForBenchmark(nodeId, cameras) {
+	const moving = [];
+	const staying = [];
+	for (const cam of cameras.toSorted((a, b) => a.deviceId - b.deviceId)) {
+		const placedOnNode = cam.placedNodeId === nodeId;
+		const pinnedToNode = cam.nodePin === nodeId;
+		if (!placedOnNode && !pinnedToNode) continue;
+		if (!cam.frameSourceNodes.some((n) => n !== nodeId)) staying.push({
+			deviceId: cam.deviceId,
+			reason: "only-frame-source"
+		});
+		else moving.push({
+			deviceId: cam.deviceId,
+			placedOnNode,
+			pinnedToNode
+		});
+	}
+	return {
+		moving,
+		staying
+	};
+}
+/** Ramp steps the runner tries per cell, at most. */
+var DEVICE_RAMP = [
+	1,
+	2,
+	4,
+	6,
+	8,
+	12,
+	16,
+	24,
+	32
+];
+var PIPELINE_RAMP = [
+	1,
+	2,
+	3,
+	4,
+	6,
+	8,
+	10,
+	12,
+	16
+];
+/** Fixed costs around the measurement: drain, clip, warm-ups, restore. */
+var OVERHEAD_MS = 3 * 6e4;
+var WARMUP_PER_CELL_MS = 2e4;
+/**
+* An upper bound on how long the run takes: every ramp step of every cell,
+* plus the drain, the clip and the restore — capped at the budget, which is
+* the hard deadline anyway. A ramp usually stops well before its last step.
+*/
+function estimateNodeBenchmarkDurationMs(plan, timing = {}) {
+	const stepMs = ((timing.settleSec ?? NODE_BENCHMARK_DEFAULTS.settleSec) + (timing.measureSec ?? NODE_BENCHMARK_DEFAULTS.measureSec)) * 1e3;
+	let total = OVERHEAD_MS;
+	if (plan.phases.includes("device")) for (const device of plan.devices) total += device.modelIds.length * (WARMUP_PER_CELL_MS + DEVICE_RAMP.length * stepMs);
+	if (plan.phases.includes("pipeline")) total += plan.devices.length * (WARMUP_PER_CELL_MS + PIPELINE_RAMP.length * stepMs);
+	return Math.min(total, plan.budgetMinutes * 6e4);
+}
+/** Why a run cannot start, in the order the operator should read them. */
+function nodeBenchmarkRefusals(input) {
+	const out = [];
+	if (input.activeRunNodeId !== null) out.push({
+		kind: "benchmark-active",
+		detail: `A benchmark of ${input.activeRunNodeId} is running — one node at a time.`,
+		overridable: false
+	});
+	if (!input.online) out.push({
+		kind: "node-offline",
+		detail: `${input.plan.nodeId} is not online.`,
+		overridable: false
+	});
+	const unknown = input.plan.devices.map((d) => d.deviceKey).filter((k) => !input.knownDeviceKeys.includes(k));
+	if (unknown.length > 0) out.push({
+		kind: "unknown-device",
+		detail: `${input.plan.nodeId} reports no device ${unknown.join(", ")}.`,
+		overridable: false
+	});
+	if (input.plan.phases.length === 0) out.push({
+		kind: "no-phase",
+		detail: "Choose at least one measurement.",
+		overridable: false
+	});
+	const capacity = input.otherNodesCapacitySessions;
+	if (capacity !== null && input.sessionsNow > capacity && !input.plan.acceptInsufficientHeadroom) out.push({
+		kind: "insufficient-headroom",
+		detail: `The cluster runs ${input.sessionsNow} sessions now; the other nodes can carry ${capacity}.`,
+		overridable: true
+	});
+	return out;
+}
+//#endregion
+//#region src/pipeline/node-benchmark/results.ts
+/** The cell a row measures — two rows with the same key measure the same thing. */
+function resultCellKey(row) {
+	const { cell } = row;
+	const steps = cell.phase === "pipeline" ? cell.steps.toSorted().join(",") : "";
+	return [
+		row.nodeId,
+		cell.deviceKey,
+		cell.phase,
+		cell.modelId,
+		steps
+	].join("|");
+}
+function staleWhy(row, ctx) {
+	const bound = ctx.staleAfterMs ?? NODE_BENCHMARK_DEFAULTS.staleAfterDays * 864e5;
+	if (ctx.nowMs - row.measuredAtMs > bound) return "age";
+	const now = ctx.currentPools[row.nodeId]?.[row.cell.deviceKey];
+	const then = row.fingerprint?.pools[row.cell.deviceKey];
+	if (now === void 0 || then === void 0) return null;
+	if (now.runtime !== then.runtime) return "runtime";
+	if (now.numWorkers !== then.numWorkers || now.concurrency !== then.concurrency || now.batchMode !== then.batchMode) return "pool-tuning";
+	return null;
+}
+/** The standing of every row, by id. */
+function resultStandings(rows, ctx) {
+	const newest = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const key = resultCellKey(row);
+		const held = newest.get(key);
+		if (held === void 0 || row.measuredAtMs > held.measuredAtMs) newest.set(key, row);
+	}
+	const out = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		if (newest.get(resultCellKey(row))?.id !== row.id) {
+			out.set(row.id, {
+				standing: "superseded",
+				staleWhy: null
+			});
+			continue;
+		}
+		const why = staleWhy(row, ctx);
+		out.set(row.id, why === null ? {
+			standing: "fresh",
+			staleWhy: null
+		} : {
+			standing: "stale",
+			staleWhy: why
+		});
+	}
+	return out;
+}
+/** Rows that beat the table today. */
+function freshResults(rows, ctx) {
+	const standings = resultStandings(rows, ctx);
+	return rows.filter((r) => standings.get(r.id)?.standing === "fresh");
+}
+/** deviceKey → modelId → the fresh `device` measurement on `nodeId`. */
+function measuredDetectorCells(rows, nodeId, ctx) {
+	const out = {};
+	for (const row of freshResults(rows, ctx)) {
+		if (row.nodeId !== nodeId || row.cell.phase !== "device") continue;
+		const perDevice = out[row.cell.deviceKey] ?? {};
+		perDevice[row.cell.modelId] = {
+			p50Ms: Math.round(row.cell.p50Ms * 100) / 100,
+			fps: row.cell.fps,
+			resultId: row.id,
+			measuredAtMs: row.measuredAtMs
+		};
+		out[row.cell.deviceKey] = perDevice;
+	}
+	return out;
+}
+/**
+* Per node, each device at its newest fresh `pipeline` measurement — the
+* `NodeCapacitySource` answer the automatic shares read.
+*/
+function measuredCapacityFromResults(rows, nodeIds, ctx) {
+	const byNode = /* @__PURE__ */ new Map();
+	for (const row of freshResults(rows, ctx)) {
+		if (!nodeIds.includes(row.nodeId) || row.cell.phase !== "pipeline") continue;
+		const devices = byNode.get(row.nodeId) ?? /* @__PURE__ */ new Map();
+		const held = devices.get(row.cell.deviceKey);
+		if (held === void 0 || row.measuredAtMs > held.measuredAtMs) devices.set(row.cell.deviceKey, row);
+		byNode.set(row.nodeId, devices);
+	}
+	const out = /* @__PURE__ */ new Map();
+	for (const nodeId of nodeIds) {
+		const devices = byNode.get(nodeId);
+		if (devices === void 0) continue;
+		out.set(nodeId, {
+			nodeId,
+			devices: [...devices.values()].toSorted((a, b) => a.cell.deviceKey.localeCompare(b.cell.deviceKey)).map((r) => ({
+				deviceKey: r.cell.deviceKey,
+				maxSessions: r.cell.phase === "pipeline" ? r.cell.maxSessions : 0,
+				modelId: r.cell.modelId,
+				measuredAtMs: r.measuredAtMs
+			}))
+		});
+	}
+	return out;
+}
+//#endregion
+//#region src/pipeline/node-benchmark/step-tree.ts
+var BENCH_ROOT_STEP_ID = "object-detection";
+function slotAddons(schema, slot) {
+	return schema.slots.find((s) => s.id === slot)?.addons ?? [];
+}
+var feeds = (from, to) => to.inputClasses.some((c) => from.outputClasses.includes(c));
+function layout(schema) {
+	const root = slotAddons(schema, "detector").find((a) => a.id === BENCH_ROOT_STEP_ID);
+	if (root === void 0) return null;
+	const classifiers = slotAddons(schema, "classifier");
+	const croppers = slotAddons(schema, "cropper").filter((c) => feeds(root, c)).map((cropper) => ({
+		cropper,
+		recognizers: classifiers.filter((k) => feeds(cropper, k))
+	}));
+	const underCropper = new Set(croppers.flatMap((c) => c.recognizers.map((r) => r.id)));
+	return {
+		root,
+		croppers,
+		classifiers: classifiers.filter((k) => feeds(root, k) && !underCropper.has(k.id)),
+		refiners: slotAddons(schema, "refiner")
+	};
+}
+/** The detail steps the operator can choose, in tree order. */
+function listBenchDetailSteps(schema) {
+	const l = layout(schema);
+	if (l === null) return [];
+	const of = (a) => ({
+		id: a.id,
+		name: a.name,
+		slot: a.slot
+	});
+	return [
+		...l.croppers.flatMap((c) => [of(c.cropper), ...c.recognizers.map(of)]),
+		...l.classifiers.map(of),
+		...l.refiners.map(of)
+	];
+}
+/** Build the tree. Throws when the node's catalog has no object-detection root. */
+function buildBenchStepTree(schema, rootModelId, enabledStepIds) {
+	const l = layout(schema);
+	if (l === null) throw new Error(`the node's catalog has no ${BENCH_ROOT_STEP_ID} step`);
+	const on = new Set(enabledStepIds);
+	const step = (a, enabled) => ({
+		addonId: a.id,
+		enabled
+	});
+	return [{
+		addonId: l.root.id,
+		modelId: rootModelId,
+		enabled: true,
+		children: [
+			...l.croppers.map(({ cropper, recognizers }) => ({
+				...step(cropper, on.has(cropper.id) || recognizers.some((r) => on.has(r.id))),
+				children: recognizers.map((r) => step(r, on.has(r.id)))
+			})),
+			...l.classifiers.map((k) => step(k, on.has(k.id))),
+			...l.refiners.map((r) => step(r, on.has(r.id)))
+		]
+	}];
+}
+//#endregion
 //#region src/pipeline/root-face-crop.ts
 /** Side of the square, as a multiple of the face box's longer side. */
 var ROOT_FACE_REFINE_SCALE = 1.6;
@@ -75508,6 +77250,7 @@ exports.AcceleratorKindSchema = AcceleratorKindSchema;
 exports.AccessoriesStatusSchema = AccessoriesStatusSchema;
 exports.AccessoryKind = AccessoryKind;
 exports.AddBrokerInputSchema = AddBrokerInputSchema;
+exports.AddRetrainFrameFromRecordingResultSchema = AddRetrainFrameFromRecordingResultSchema;
 exports.AddonAutoUpdateSchema = AddonAutoUpdateSchema;
 exports.AddonListItemSchema = AddonListItemSchema;
 exports.AddonPageDeclarationSchema = AddonPageDeclarationSchema;
@@ -75589,6 +77332,7 @@ exports.BASE_DEVICE_CAPS = BASE_DEVICE_CAPS;
 exports.BASE_LIVE_EGRESS_PROFILE = BASE_LIVE_EGRESS_PROFILE;
 exports.BATTERY_DEVICE_PROFILE = BATTERY_DEVICE_PROFILE;
 exports.BATTERY_UNREACHABLE_AFTER_MS = BATTERY_UNREACHABLE_AFTER_MS;
+exports.BENCH_ROOT_STEP_ID = BENCH_ROOT_STEP_ID;
 exports.BIRTH_DECISION_DEFAULT_LIMIT = BIRTH_DECISION_DEFAULT_LIMIT;
 exports.BOOT_RECOVERY_BACKOFF_MS = require_sleep.BOOT_RECOVERY_BACKOFF_MS;
 exports.BUILTIN_RESULT_KINDS = BUILTIN_RESULT_KINDS;
@@ -75897,6 +77641,7 @@ exports.DEVICE_CAP_NAMES = DEVICE_CAP_NAMES;
 exports.DEVICE_CHILDREN_BATCH_MAX = require_sleep.DEVICE_CHILDREN_BATCH_MAX;
 exports.DEVICE_DO_ACTIONS = DEVICE_DO_ACTIONS;
 exports.DEVICE_PROFILES = DEVICE_PROFILES;
+exports.DEVICE_RAMP = DEVICE_RAMP;
 exports.DEVICE_RESTORE_RETRY_CONCURRENCY = DEVICE_RESTORE_RETRY_CONCURRENCY;
 exports.DEVICE_RESTORE_RETRY_DELAYS_MS = DEVICE_RESTORE_RETRY_DELAYS_MS;
 exports.DEVICE_SCOPED_CAPS = require_sleep.DEVICE_SCOPED_CAPS;
@@ -76051,6 +77796,8 @@ exports.ExtensionSlotValueSchema = ExtensionSlotValueSchema;
 exports.ExtensionSourceAvailabilitySchema = ExtensionSourceAvailabilitySchema;
 exports.ExtensionSourceHealthSchema = ExtensionSourceHealthSchema;
 exports.ExtensionSourceSchema = ExtensionSourceSchema;
+exports.ExternalIdentityKeySchema = ExternalIdentityKeySchema;
+exports.ExternalIdentitySchema = ExternalIdentitySchema;
 exports.FEEDER_EXAMPLE_ADDON_ID = FEEDER_EXAMPLE_ADDON_ID;
 exports.FEEDER_EXAMPLE_HA_DEVICE_ID = FEEDER_EXAMPLE_HA_DEVICE_ID;
 exports.FFMPEG_PATH_ENV = require_composition.FFMPEG_PATH_ENV;
@@ -76117,8 +77864,24 @@ exports.IntegrationLiteSchema = IntegrationLiteSchema;
 exports.IntegrationWithStateSchema = IntegrationWithStateSchema;
 exports.IntercomAbilitySchema = IntercomAbilitySchema;
 exports.IntercomStatusSchema = IntercomStatusSchema;
+exports.KEYCHAIN_MAX_REFS_PER_CALL = KEYCHAIN_MAX_REFS_PER_CALL;
+exports.KEYCHAIN_RESET_CONFIRMATION = KEYCHAIN_RESET_CONFIRMATION;
 exports.KNOWN_CAP_NAMES = KNOWN_CAP_NAMES;
+exports.KeptReasonSchema = KeptReasonSchema;
 exports.KeyEventSchema = KeyEventSchema;
+exports.KeychainAdminSecretSchema = KeychainAdminSecretSchema;
+exports.KeychainAuditActionSchema = KeychainAuditActionSchema;
+exports.KeychainAuditEntrySchema = KeychainAuditEntrySchema;
+exports.KeychainKeySourceKindSchema = KeychainKeySourceKindSchema;
+exports.KeychainKeySourceSchema = KeychainKeySourceSchema;
+exports.KeychainResolveEntrySchema = KeychainResolveEntrySchema;
+exports.KeychainResolveResultSchema = KeychainResolveResultSchema;
+exports.KeychainSecretMetaSchema = KeychainSecretMetaSchema;
+exports.KeychainSecretUsageSchema = KeychainSecretUsageSchema;
+exports.KeychainStateSchema = KeychainStateSchema;
+exports.KeychainStatusSchema = KeychainStatusSchema;
+exports.KeychainUnavailableReasonSchema = KeychainUnavailableReasonSchema;
+exports.KeychainWriteRefusedError = require_sleep.KeychainWriteRefusedError;
 exports.LABEL_SUPPLY_MACRO = LABEL_SUPPLY_MACRO;
 exports.LABEL_SUPPLY_STEP_IDS = LABEL_SUPPLY_STEP_IDS;
 exports.LABEL_SUPPLY_VOCABULARIES = LABEL_SUPPLY_VOCABULARIES;
@@ -76136,6 +77899,7 @@ exports.LTS_SCOPE_CLASS_SEPARATOR = LTS_SCOPE_CLASS_SEPARATOR;
 exports.LabelAttributionSchema = LabelAttributionSchema;
 exports.LabelDefinitionSchema = LabelDefinitionSchema;
 exports.LabelTierSchema = LabelTierSchema;
+exports.LatencySourceSchema = LatencySourceSchema;
 exports.LawnMowerActivitySchema = LawnMowerActivitySchema;
 exports.LawnMowerControlStatusSchema = LawnMowerControlStatusSchema;
 exports.LedgerWalkDeviceReportSchema = LedgerWalkDeviceReportSchema;
@@ -76148,6 +77912,7 @@ exports.LegacyStorageLocationDefaultSchema = LegacyStorageLocationDefaultSchema;
 exports.LinkedDeviceSchema = LinkedDeviceSchema;
 exports.LinkedDevicesModeSchema = LinkedDevicesModeSchema;
 exports.LinkedDevicesSlotValueSchema = LinkedDevicesSlotValueSchema;
+exports.ListNodeBenchmarkResultsInputSchema = ListNodeBenchmarkResultsInputSchema;
 exports.ListTrackRelationsInputSchema = ListTrackRelationsInputSchema;
 exports.ListTrackRelationsResultSchema = ListTrackRelationsResultSchema;
 exports.LlmDefaultSchema = LlmDefaultSchema;
@@ -76235,6 +78000,7 @@ exports.MEDIA_PRESENCE_OWNER_KINDS = MEDIA_PRESENCE_OWNER_KINDS;
 exports.METHOD_ACCESS_MAP = METHOD_ACCESS_MAP;
 exports.METHOD_DEVICE_SELECTORS = METHOD_DEVICE_SELECTORS;
 exports.MINUTES_PER_DAY = MINUTES_PER_DAY;
+exports.MIN_SCRUBBED_LENGTH = require_sleep.MIN_SCRUBBED_LENGTH;
 exports.MIN_SESSIONS_PER_DEVICE_RANGE = MIN_SESSIONS_PER_DEVICE_RANGE;
 exports.MODEL_FORMATS = MODEL_FORMATS;
 exports.MODEL_HOSTING = MODEL_HOSTING;
@@ -76398,6 +78164,7 @@ exports.NC_TEMPLATE_VARS = NC_TEMPLATE_VARS;
 exports.NC_UPDATE_EVENT_PACKAGE_NAMES = NC_UPDATE_EVENT_PACKAGE_NAMES;
 exports.NETWORK_LINK_TYPES = NETWORK_LINK_TYPES;
 exports.NETWORK_LINK_UNKNOWN = NETWORK_LINK_UNKNOWN;
+exports.NODE_BENCHMARK_DEFAULTS = NODE_BENCHMARK_DEFAULTS;
 exports.NO_MEASURED_CAPACITY = NO_MEASURED_CAPACITY;
 exports.NativeCropBboxSchema = NativeCropBboxSchema;
 exports.NativeCropRefSchema = NativeCropRefSchema;
@@ -76519,6 +78286,33 @@ exports.NetworkAccessStatusSchema = NetworkAccessStatusSchema;
 exports.NetworkAddressSchema = NetworkAddressSchema;
 exports.NetworkEndpointSchema = NetworkEndpointSchema;
 exports.NetworkLinkStatusSchema = NetworkLinkStatusSchema;
+exports.NodeBenchCellSchema = NodeBenchCellSchema;
+exports.NodeBenchClipSchema = NodeBenchClipSchema;
+exports.NodeBenchDeviceCellSchema = NodeBenchDeviceCellSchema;
+exports.NodeBenchFingerprintSchema = NodeBenchFingerprintSchema;
+exports.NodeBenchLimitSchema = NodeBenchLimitSchema;
+exports.NodeBenchPipelineCellSchema = NodeBenchPipelineCellSchema;
+exports.NodeBenchProgressSchema = NodeBenchProgressSchema;
+exports.NodeBenchRampStepSchema = NodeBenchRampStepSchema;
+exports.NodeBenchRunnerInputSchema = NodeBenchRunnerInputSchema;
+exports.NodeBenchRunnerStateSchema = NodeBenchRunnerStateSchema;
+exports.NodeBenchRunnerStatusSchema = NodeBenchRunnerStatusSchema;
+exports.NodeBenchmarkCandidatesSchema = NodeBenchmarkCandidatesSchema;
+exports.NodeBenchmarkDevicePlanSchema = NodeBenchmarkDevicePlanSchema;
+exports.NodeBenchmarkEndReasonSchema = NodeBenchmarkEndReasonSchema;
+exports.NodeBenchmarkManifestSchema = NodeBenchmarkManifestSchema;
+exports.NodeBenchmarkMovingCameraSchema = NodeBenchmarkMovingCameraSchema;
+exports.NodeBenchmarkPhaseSchema = NodeBenchmarkPhaseSchema;
+exports.NodeBenchmarkPlanSchema = NodeBenchmarkPlanSchema;
+exports.NodeBenchmarkPreflightSchema = NodeBenchmarkPreflightSchema;
+exports.NodeBenchmarkRefusalKindSchema = NodeBenchmarkRefusalKindSchema;
+exports.NodeBenchmarkRefusalSchema = NodeBenchmarkRefusalSchema;
+exports.NodeBenchmarkResultSchema = NodeBenchmarkResultSchema;
+exports.NodeBenchmarkResultViewSchema = NodeBenchmarkResultViewSchema;
+exports.NodeBenchmarkRunSchema = NodeBenchmarkRunSchema;
+exports.NodeBenchmarkStateSchema = NodeBenchmarkStateSchema;
+exports.NodeBenchmarkStatusSchema = NodeBenchmarkStatusSchema;
+exports.NodeBenchmarkStayingCameraSchema = NodeBenchmarkStayingCameraSchema;
 exports.NodeDeviceChangeSchema = NodeDeviceChangeSchema;
 exports.NodeDirectoryEntrySchema = NodeDirectoryEntrySchema;
 exports.NodeDirectorySchema = NodeDirectorySchema;
@@ -76579,6 +78373,7 @@ exports.PET_FEEDER_MANUAL_FEED_MIN = PET_FEEDER_MANUAL_FEED_MIN;
 exports.PIPELINE_ANALYTICS_CAP_NAME = PIPELINE_ANALYTICS_CAP_NAME;
 exports.PIPELINE_FLOW_CAPABILITY_NAMES = PIPELINE_FLOW_CAPABILITY_NAMES;
 exports.PIPELINE_OWNER_CAPABILITY_NAMES = PIPELINE_OWNER_CAPABILITY_NAMES;
+exports.PIPELINE_RAMP = PIPELINE_RAMP;
 exports.PRIVACY_MASK_CAP_NAME = PRIVACY_MASK_CAP_NAME;
 exports.PROVIDER_KIND_CAP_NAMES = PROVIDER_KIND_CAP_NAMES;
 exports.PROVIDER_PIN_FIELD = require_sleep.PROVIDER_PIN_FIELD;
@@ -76655,11 +78450,12 @@ exports.RECORDING_EXPORT_MAX_READ_BYTES = RECORDING_EXPORT_MAX_READ_BYTES;
 exports.RECORDING_SOURCE_CAMSTACK = RECORDING_SOURCE_CAMSTACK;
 exports.RECORDING_SOURCE_CAMSTACK_ADDON = RECORDING_SOURCE_CAMSTACK_ADDON;
 exports.RECORDING_TIMELINE_BATCH_MAX = RECORDING_TIMELINE_BATCH_MAX;
-exports.REDACTED_SECRET = REDACTED_SECRET;
+exports.REDACTED_SECRET = require_sleep.REDACTED_SECRET;
 exports.REMOVED_MODEL_IDS = REMOVED_MODEL_IDS;
 exports.RESERVED_BINDING_NAMES = require_composition.RESERVED_BINDING_NAMES;
 exports.RESERVED_COLLECTION_SOURCES = RESERVED_COLLECTION_SOURCES;
 exports.RESTORED_CAP_NAMES = RESTORED_CAP_NAMES;
+exports.REVALIDATE_AFTER_MS = require_sleep.REVALIDATE_AFTER_MS;
 exports.ROOM_EXAMPLE_MOTION_SOURCES = ROOM_EXAMPLE_MOTION_SOURCES;
 exports.ROOM_EXAMPLE_TEMPERATURE_SOURCES = ROOM_EXAMPLE_TEMPERATURE_SOURCES;
 exports.ROOM_OCCUPANCY_WINDOW_MS = ROOM_OCCUPANCY_WINDOW_MS;
@@ -76741,14 +78537,27 @@ exports.RetrainAnnotationDraftSchema = RetrainAnnotationDraftSchema;
 exports.RetrainAnnotationKindSchema = RetrainAnnotationKindSchema;
 exports.RetrainAnnotationSchema = RetrainAnnotationSchema;
 exports.RetrainAnnotationSourceSchema = RetrainAnnotationSourceSchema;
+exports.RetrainArchiveResultSchema = RetrainArchiveResultSchema;
+exports.RetrainArchiveTargetSchema = RetrainArchiveTargetSchema;
+exports.RetrainAssistProfileSchema = RetrainAssistProfileSchema;
 exports.RetrainAssistResultSchema = RetrainAssistResultSchema;
 exports.RetrainAssistSubjectSchema = RetrainAssistSubjectSchema;
+exports.RetrainCollectionCreateResultSchema = RetrainCollectionCreateResultSchema;
+exports.RetrainCollectionRenameResultSchema = RetrainCollectionRenameResultSchema;
+exports.RetrainCollectionSchema = RetrainCollectionSchema;
 exports.RetrainCopyRefusalSchema = RetrainCopyRefusalSchema;
+exports.RetrainExportFilterSchema = RetrainExportFilterSchema;
+exports.RetrainExportLayoutSchema = RetrainExportLayoutSchema;
 exports.RetrainFrameCandidateSchema = RetrainFrameCandidateSchema;
 exports.RetrainFrameListSchema = RetrainFrameListSchema;
+exports.RetrainFrameOriginSchema = RetrainFrameOriginSchema;
 exports.RetrainFrameSchema = RetrainFrameSchema;
 exports.RetrainFrameSelectionSchema = RetrainFrameSelectionSchema;
+exports.RetrainLlmAssistResultSchema = RetrainLlmAssistResultSchema;
+exports.RetrainLlmProposalSchema = RetrainLlmProposalSchema;
+exports.RetrainLlmReviewSchema = RetrainLlmReviewSchema;
 exports.RetrainMacroClassSchema = RetrainMacroClassSchema;
+exports.RetrainPipelineBoxSchema = RetrainPipelineBoxSchema;
 exports.RetrainStatusSchema = RetrainStatusSchema;
 exports.RetrainTrackSchema = RetrainTrackSchema;
 exports.RetrainTransitionResultSchema = RetrainTransitionResultSchema;
@@ -76774,6 +78583,9 @@ exports.SCENE_DEFAULT_UNCOVERED_POLICY = SCENE_DEFAULT_UNCOVERED_POLICY;
 exports.SCENE_DIVERGED = SCENE_DIVERGED;
 exports.SCENE_RESET_RECAPTURES = SCENE_RESET_RECAPTURES;
 exports.SCOPE_PRESETS = SCOPE_PRESETS;
+exports.SECRET_CLEAR = require_sleep.SECRET_CLEAR;
+exports.SECRET_META = require_sleep.SECRET_META;
+exports.SECRET_REF_SCHEME = require_sleep.SECRET_REF_SCHEME;
 exports.SENSOR_FEATURES = SENSOR_FEATURES;
 exports.SENSOR_MAP = SENSOR_MAP;
 exports.SESSION_PLACEMENT_SETTING_KEY = SESSION_PLACEMENT_SETTING_KEY;
@@ -77080,6 +78892,7 @@ exports.applyModeDeviceListEdit = applyModeDeviceListEdit;
 exports.applyModelBoundSettings = applyModelBoundSettings;
 exports.applyNonBlockingEdit = applyNonBlockingEdit;
 exports.applySecureOnArmEdit = applySecureOnArmEdit;
+exports.arrayItemFieldPath = require_sleep.arrayItemFieldPath;
 exports.asBoolean = require_sleep.asBoolean;
 exports.asJsonArray = require_sleep.asJsonArray;
 exports.asJsonObject = require_sleep.asJsonObject;
@@ -77111,6 +78924,7 @@ exports.brightnessCapability = brightnessCapability;
 exports.brokerCapability = brokerCapability;
 exports.buildAddonRouteProvider = buildAddonRouteProvider;
 exports.buildAudioArgs = require_composition.buildAudioArgs;
+exports.buildBenchStepTree = buildBenchStepTree;
 exports.buildCapabilityLookup = buildCapabilityLookup;
 exports.buildDeviceAdminUrl = buildDeviceAdminUrl;
 exports.buildDoorbellCompositionFeature = buildDoorbellCompositionFeature;
@@ -77121,6 +78935,7 @@ exports.buildInputArgs = require_composition.buildInputArgs;
 exports.buildModelVariantGroups = buildModelVariantGroups;
 exports.buildNcTaxonomy = buildNcTaxonomy;
 exports.buildRoleScopes = buildRoleScopes;
+exports.buildSecretRef = require_sleep.buildSecretRef;
 exports.buildStreamParamsConfigSchema = buildStreamParamsConfigSchema;
 exports.buildVideoArgs = require_composition.buildVideoArgs;
 exports.buildViewerLink = buildViewerLink;
@@ -77141,9 +78956,12 @@ exports.carbonMonoxideCapability = carbonMonoxideCapability;
 exports.cellsToRects = cellsToRects;
 exports.checkRoleAddress = checkRoleAddress;
 exports.classifyBearerPrincipal = classifyBearerPrincipal;
+exports.classifyCamerasForBenchmark = classifyCamerasForBenchmark;
 exports.classifyInferenceHardware = classifyInferenceHardware;
+exports.classifySecretWrite = require_sleep.classifySecretWrite;
 exports.classifyStream = classifyStream;
 exports.classifyStreams = classifyStreams;
+exports.clearKnownSecrets = require_sleep.clearKnownSecrets;
 exports.clearModelBoundOverrides = clearModelBoundOverrides;
 exports.clearModelBoundSetting = clearModelBoundSetting;
 exports.climateControlCapability = climateControlCapability;
@@ -77158,8 +78976,11 @@ exports.clusterStepSettingKey = clusterStepSettingKey;
 exports.codecIsAccepted = codecIsAccepted;
 exports.collectHydratedFieldEntries = require_sleep.collectHydratedFieldEntries;
 exports.collectHydratedFieldValues = require_sleep.collectHydratedFieldValues;
+exports.collectKeychainStoredKeys = require_sleep.collectKeychainStoredKeys;
 exports.collectModelBoundKeys = collectModelBoundKeys;
-exports.collectSecretConfigKeys = collectSecretConfigKeys;
+exports.collectSecretConfigKeys = require_sleep.collectSecretConfigKeys;
+exports.collectSecretMarkerRefs = require_sleep.collectSecretMarkerRefs;
+exports.collectZodSecretPaths = require_sleep.collectZodSecretPaths;
 exports.colorCapability = colorCapability;
 exports.colorForKind = colorForKind;
 exports.commitWatchdogRestart = commitWatchdogRestart;
@@ -77211,6 +79032,7 @@ exports.createLazyTrpcSource = require_sleep.createLazyTrpcSource;
 exports.createLogChannelsProvider = createLogChannelsProvider;
 exports.createMirrorSource = require_sleep.createMirrorSource;
 exports.createRuntimeStateBridge = createRuntimeStateBridge;
+exports.createSecretsAccess = require_sleep.createSecretsAccess;
 exports.createSliceHandle = require_sleep.createSliceHandle;
 exports.createStatefulExpressionMemory = require_composition.createStatefulExpressionMemory;
 exports.createSystemProxy = createSystemProxy;
@@ -77277,6 +79099,7 @@ exports.effectiveStepSettings = effectiveStepSettings;
 exports.egressTranscodeSharingKey = egressTranscodeSharingKey;
 exports.egressTransportFromRequest = egressTransportFromRequest;
 exports.electByShare = electByShare;
+exports.eligibleUnderBenchmark = eligibleUnderBenchmark;
 exports.embeddingEncoderCapability = embeddingEncoderCapability;
 exports.embeddingModelFailedError = embeddingModelFailedError;
 exports.embeddingModelFailedOf = embeddingModelFailedOf;
@@ -77294,6 +79117,7 @@ exports.enumerateInferenceDevices = enumerateInferenceDevices;
 exports.enumerateItemArrayFields = enumerateItemArrayFields;
 exports.enumerateSchemaFields = enumerateSchemaFields;
 exports.errMsg = require_err_msg.errMsg;
+exports.estimateNodeBenchmarkDurationMs = estimateNodeBenchmarkDurationMs;
 exports.evaluateAst = require_composition.evaluateAst;
 exports.evaluateCompositionField = evaluateCompositionField;
 exports.evaluateCount = require_composition.evaluateCount;
@@ -77337,10 +79161,13 @@ exports.findCompositionCycles = findCompositionCycles;
 exports.findTimezone = findTimezone;
 exports.floodCapability = floodCapability;
 exports.foldSnapshotByFunction = foldSnapshotByFunction;
+exports.forgetKnownSecret = require_sleep.forgetKnownSecret;
 exports.formatForRuntime = formatForRuntime;
 exports.formatMediaOwnerKey = formatMediaOwnerKey;
 exports.formatMinutes = formatMinutes;
 exports.formatParkedFor = formatParkedFor;
+exports.formatSecretScope = require_sleep.formatSecretScope;
+exports.freshResults = freshResults;
 exports.frigateDefaultClassFloors = frigateDefaultClassFloors;
 exports.frigateLabelFields = frigateLabelFields;
 exports.gasCapability = gasCapability;
@@ -77354,6 +79181,7 @@ exports.getTaxonomyEntry = getTaxonomyEntry;
 exports.gifDeriveSpeed = gifDeriveSpeed;
 exports.gifFilterComplex = gifFilterComplex;
 exports.gifFromMp4Args = gifFromMp4Args;
+exports.globalSecretScope = require_sleep.globalSecretScope;
 exports.hasModelBoundOverrides = hasModelBoundOverrides;
 exports.hasMotionTrigger = hasMotionTrigger;
 exports.hfModelUrl = hfModelUrl;
@@ -77403,6 +79231,7 @@ exports.isEventOwnerType = isEventOwnerType;
 exports.isFirstLevelMacroClass = isFirstLevelMacroClass;
 exports.isHeldBackTemplateVar = isHeldBackTemplateVar;
 exports.isIsolatedBuiltin = isIsolatedBuiltin;
+exports.isKeychainStoredField = require_sleep.isKeychainStoredField;
 exports.isKnownTemplateVar = isKnownTemplateVar;
 exports.isLabelSupplyStepId = isLabelSupplyStepId;
 exports.isLocationEnabled = isLocationEnabled;
@@ -77417,7 +79246,12 @@ exports.isRetiredClearKey = isRetiredClearKey;
 exports.isRootSuppliableStepId = isRootSuppliableStepId;
 exports.isSameAddonId = isSameAddonId;
 exports.isScheduleActive = isScheduleActive;
-exports.isSecretConfigField = isSecretConfigField;
+exports.isSecretClear = require_sleep.isSecretClear;
+exports.isSecretConfigField = require_sleep.isSecretConfigField;
+exports.isSecretFieldView = require_sleep.isSecretFieldView;
+exports.isSecretMarker = require_sleep.isSecretMarker;
+exports.isSecretMarkerLike = require_sleep.isSecretMarkerLike;
+exports.isSecretRef = require_sleep.isSecretRef;
 exports.isSingleHubAddressRole = isSingleHubAddressRole;
 exports.isSoftwareDecode = require_composition.isSoftwareDecode;
 exports.isSourceCap = require_composition.isSourceCap;
@@ -77430,11 +79264,15 @@ exports.isSystemEventSummaryRule = isSystemEventSummaryRule;
 exports.isSystemRuleKind = isSystemRuleKind;
 exports.isVectorIndexDimConflict = isVectorIndexDimConflict;
 exports.isVoidInput = isVoidInput;
+exports.isZodSecret = require_sleep.isZodSecret;
 exports.ituDbfsFromPreEpoch = ituDbfsFromPreEpoch;
 exports.jobKindSchema = jobKindSchema;
 exports.kebabToCamel = kebabToCamel;
+exports.keychainAdminCapability = keychainAdminCapability;
+exports.keychainCapability = keychainCapability;
 exports.kindOfValue = kindOfValue;
 exports.kindsForDiscriminator = kindsForDiscriminator;
+exports.knownSecretCount = require_sleep.knownSecretCount;
 exports.knownValues = knownValues;
 exports.lawnMowerControlCapability = lawnMowerControlCapability;
 exports.legacyAutoLinkIds = legacyAutoLinkIds;
@@ -77445,6 +79283,7 @@ exports.lifecycleJobStateSchema = lifecycleJobStateSchema;
 exports.lifecycleTaskSchema = lifecycleTaskSchema;
 exports.linkedLabelStepId = linkedLabelStepId;
 exports.linkedStepOf = linkedStepOf;
+exports.listBenchDetailSteps = listBenchDetailSteps;
 exports.llmCapability = llmCapability;
 exports.llmRuntimeCapability = llmRuntimeCapability;
 exports.loadContributionCapability = loadContributionCapability;
@@ -77459,6 +79298,7 @@ exports.logLevelAtMost = logLevelAtMost;
 exports.loginMethodCapability = loginMethodCapability;
 exports.looseSchema = looseSchema;
 exports.makeProfileBrokerId = require_sleep.makeProfileBrokerId;
+exports.makeSecretMarker = require_sleep.makeSecretMarker;
 exports.makeSourceBrokerId = require_sleep.makeSourceBrokerId;
 exports.mapAudioLabelToMacro = mapAudioLabelToMacro;
 exports.markdownToHtmlLite = markdownToHtmlLite;
@@ -77467,8 +79307,11 @@ exports.maskUrlCredentials = maskUrlCredentials;
 exports.matchDoAction = matchDoAction;
 exports.mayReadLocation = mayReadLocation;
 exports.mayWriteToLocation = mayWriteToLocation;
+exports.measuredCapacityFromResults = measuredCapacityFromResults;
+exports.measuredDetectorCells = measuredDetectorCells;
 exports.mediaPlayerCapability = mediaPlayerCapability;
 exports.memoizePinnedFfmpeg = memoizePinnedFfmpeg;
+exports.mergeSecretStatePaths = require_sleep.mergeSecretStatePaths;
 exports.mergeSettingsBags = mergeSettingsBags;
 exports.mergeSourceInfo = mergeSourceInfo;
 exports.meshNetworkCapability = meshNetworkCapability;
@@ -77495,6 +79338,7 @@ exports.ncAlarmSystemDefaultSettings = ncAlarmSystemDefaultSettings;
 exports.networkAccessCapability = networkAccessCapability;
 exports.networkLinkCapability = networkLinkCapability;
 exports.networkQualityCapability = networkQualityCapability;
+exports.nodeBenchmarkRefusals = nodeBenchmarkRefusals;
 exports.nodePickerItems = nodePickerItems;
 exports.nodePin = require_sleep.nodePin;
 exports.nodesCapability = nodesCapability;
@@ -77502,6 +79346,7 @@ exports.normalizeAddonInitResult = require_sleep.normalizeAddonInitResult;
 exports.normalizeAudioLabel = normalizeAudioLabel;
 exports.normalizeCoreBlockWrite = normalizeCoreBlockWrite;
 exports.normalizeNodeId = require_sleep.normalizeNodeId;
+exports.normalizeSecretOwner = require_sleep.normalizeSecretOwner;
 exports.normalizeTokenScopes = normalizeTokenScopes;
 exports.normalizeUnit = normalizeUnit;
 exports.notificationOutputCapability = notificationOutputCapability;
@@ -77529,6 +79374,8 @@ exports.parseOccupancyScope = parseOccupancyScope;
 exports.parseProcStatus = parseProcStatus;
 exports.parseProfileBrokerId = require_sleep.parseProfileBrokerId;
 exports.parseRuleSection = parseRuleSection;
+exports.parseSecretRef = require_sleep.parseSecretRef;
+exports.parseSecretStatePath = require_sleep.parseSecretStatePath;
 exports.parseSessionPlacementPolicy = parseSessionPlacementPolicy;
 exports.parseShareSource = parseShareSource;
 exports.parseStreamParamsFormPatch = parseStreamParamsFormPatch;
@@ -77546,6 +79393,7 @@ exports.pickRestartCandidate = pickRestartCandidate;
 exports.pickVideoEncoder = require_composition.pickVideoEncoder;
 exports.pickerForCondition = pickerForCondition;
 exports.pickerForRuleClasses = pickerForRuleClasses;
+exports.pinUnderBenchmark = pinUnderBenchmark;
 exports.pipelineAnalyticsCapability = pipelineAnalyticsCapability;
 exports.pipelineExecutorCapability = pipelineExecutorCapability;
 exports.pipelineOrchestratorCapability = pipelineOrchestratorCapability;
@@ -77591,6 +79439,7 @@ exports.recordingOnboardCapability = recordingOnboardCapability;
 exports.recordingSignalCapability = recordingSignalCapability;
 exports.rectsToCells = rectsToCells;
 exports.reducePoints = reducePoints;
+exports.registerKnownSecret = require_sleep.registerKnownSecret;
 exports.renameAlarmProfile = renameAlarmProfile;
 exports.replacedFieldKeys = replacedFieldKeys;
 exports.requiredTopLevelKeys = requiredTopLevelKeys;
@@ -77611,6 +79460,7 @@ exports.resolveCoreBlockFiles = resolveCoreBlockFiles;
 exports.resolveCreateExportSubject = resolveCreateExportSubject;
 exports.resolveDeviceControlKind = resolveDeviceControlKind;
 exports.resolveDeviceProfile = resolveDeviceProfile;
+exports.resolveDisplayIconKey = resolveDisplayIconKey;
 exports.resolveEffectiveShares = resolveEffectiveShares;
 exports.resolveEgressDecodeHwAccel = resolveEgressDecodeHwAccel;
 exports.resolveExportProfiles = resolveExportProfiles;
@@ -77631,9 +79481,13 @@ exports.resolvePublicEndpoint = resolvePublicEndpoint;
 exports.resolveRecordingProfiles = resolveRecordingProfiles;
 exports.resolveRootSupply = resolveRootSupply;
 exports.resolveRunnerId = resolveRunnerId;
+exports.resolveSecretMarkers = require_sleep.resolveSecretMarkers;
+exports.resolveSecretViewsIn = require_sleep.resolveSecretViewsIn;
 exports.resolveStreamMaps = require_composition.resolveStreamMaps;
 exports.resolveVariantModelId = resolveVariantModelId;
 exports.resolveViewableDeviceIds = resolveViewableDeviceIds;
+exports.resultCellKey = resultCellKey;
+exports.resultStandings = resultStandings;
 exports.roleSpec = roleSpec;
 exports.roomCompositionExample = roomCompositionExample;
 exports.rootSuppliesOf = rootSuppliesOf;
@@ -77657,14 +79511,17 @@ exports.runtimeStatePolicyFor = runtimeStatePolicyFor;
 exports.sameDoFamily = sameDoFamily;
 exports.sceneMonitorCapability = sceneMonitorCapability;
 exports.scheduleForSendTimes = scheduleForSendTimes;
-exports.schemaDeclaresAnyField = schemaDeclaresAnyField;
+exports.schemaDeclaresAnyField = require_sleep.schemaDeclaresAnyField;
 exports.scopeInherits = scopeInherits;
 exports.scopeKey = require_sleep.scopeKey;
 exports.scopesAllowAddon = scopesAllowAddon;
 exports.scopesAllowDeviceCap = scopesAllowDeviceCap;
 exports.scoreRuntimes = scoreRuntimes;
 exports.scriptRunnerCapability = scriptRunnerCapability;
+exports.scrubKnownSecrets = require_sleep.scrubKnownSecrets;
 exports.searchDisplayIcons = searchDisplayIcons;
+exports.secretTreeFromPaths = require_sleep.secretTreeFromPaths;
+exports.secretTreeFromSchema = require_sleep.secretTreeFromSchema;
 exports.secureActuationFor = secureActuationFor;
 exports.selectAppConnectionEndpoints = selectAppConnectionEndpoints;
 exports.selectAssignedProfileSlots = require_sleep.selectAssignedProfileSlots;
@@ -77679,6 +79536,7 @@ exports.setByPath = setByPath;
 exports.settingValuesEqual = settingValuesEqual;
 exports.settingsBelow = settingsBelow;
 exports.settingsStoreCapability = settingsStoreCapability;
+exports.shortSecretRefHash = require_sleep.shortSecretRefHash;
 exports.signalPercentFromBars = signalPercentFromBars;
 exports.signalPercentFromRssi = signalPercentFromRssi;
 exports.siteZoneKey = siteZoneKey;
@@ -77747,11 +79605,13 @@ exports.toDeviceSummary = toDeviceSummary;
 exports.toExpressionValue = require_composition.toExpressionValue;
 exports.toNodeId = require_sleep.toNodeId;
 exports.toPercentShares = toPercentShares;
+exports.toSecretFieldView = require_sleep.toSecretFieldView;
 exports.toStreamSourceEntry = toStreamSourceEntry;
 exports.toastCapability = toastCapability;
 exports.toggleAudioLabel = toggleAudioLabel;
 exports.tokenize = require_composition.tokenize;
 exports.transcodeBody = transcodeBody;
+exports.transformSecretWrite = require_sleep.transformSecretWrite;
 exports.tryConvertUnit = tryConvertUnit;
 exports.turnProviderCapability = turnProviderCapability;
 exports.unitDimension = unitDimension;