@camstack/types 1.2.326 → 1.2.328

package/dist/{sleep-BNeXenvr.mjs → sleep-Cr5YOk3m.mjs}

@@ -1,4 +1,4 @@
-import { t as EventCategory } from "./event-category-B_0XEcLF.mjs";
+import { t as EventCategory } from "./event-category-DaIZi00R.mjs";
 import { z } from "zod";
 //#region src/audio/audio-chunk-format.ts
 /**
@@ -116,6 +116,192 @@ function buildAlawTable() {
 var ULAW_TABLE = buildUlawTable();
 var ALAW_TABLE = buildAlawTable();
 //#endregion
+//#region src/interfaces/config-ui-secrets.ts
+/**
+* The value a redacted secret is replaced with on every read surface.
+*
+* It is also the WRITE-BACK token: an `upsertLocation` that sends this value
+* back for a key means "keep what is stored", which is what lets an operator
+* rename a location without retyping its password. A literal an operator could
+* plausibly choose as a real password would turn that convenience into a way
+* to lock yourself out, hence the sentinel shape.
+*/
+var REDACTED_SECRET = "__camstack_redacted__";
+/** Is this field's stored value a credential? */
+function isSecretConfigField(field) {
+	if (field.type === "password") return true;
+	return "secret" in field && field.secret === true;
+}
+/**
+* Is this field's value stored in the KEYCHAIN (D787)? Every secret field is,
+* by its TYPE, unless it opts out with `storage: 'inline'` — never by its name.
+*/
+function isKeychainStoredField(field) {
+	if (!isSecretConfigField(field)) return false;
+	if (field.type === "textarea" && field.isJson === true) return false;
+	return !("storage" in field && field.storage === "inline");
+}
+/**
+* Every config key in `schema` whose value is a secret, including keys nested
+* inside `group` / `sub-tabs` containers.
+*/
+function collectSecretConfigKeys(schema) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
+	return keys;
+}
+/**
+* Every top-level config key whose value the KEYCHAIN stores (D787) —
+* {@link collectSecretConfigKeys} minus `storage: 'inline'` and minus JSON
+* blobs (see {@link isKeychainStoredField}). What a form sends as
+* `secretKeys` so the owner's door knows which values to keep out of the blob.
+*/
+function collectKeychainStoredKeys(schema) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkKeychainField(field, keys);
+	return keys;
+}
+function walkKeychainField(field, out) {
+	if (!isRecord$2(field)) return;
+	const type = field["type"];
+	const key = field["key"];
+	const isSecret = type === "password" || field["secret"] === true;
+	const isJsonBlob = type === "textarea" && field["isJson"] === true;
+	if (isSecret && !isJsonBlob && field["storage"] !== "inline" && typeof key === "string" && key.length > 0) out.add(key);
+	if (type === "group") {
+		for (const child of fieldsOf(field)) walkKeychainField(child, out);
+		return;
+	}
+	if (type === "sub-tabs") {
+		const tabs = field["tabs"];
+		if (!Array.isArray(tabs)) return;
+		for (const tab of tabs) for (const child of fieldsOf(tab)) walkKeychainField(child, out);
+	}
+}
+/**
+* True when the value is a readable schema declaring at least one field of any
+* kind. Lets a caller tell "this provider has no secrets" from "this provider's
+* schema could not be read", which are the same empty set otherwise.
+*/
+function schemaDeclaresAnyField(schema) {
+	for (const section of sectionsOf(schema)) if (fieldsOf(section).length > 0) return true;
+	return false;
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sectionsOf(schema) {
+	if (!isRecord$2(schema)) return [];
+	const sections = schema["sections"];
+	return Array.isArray(sections) ? sections : [];
+}
+function fieldsOf(node) {
+	if (!isRecord$2(node)) return [];
+	const fields = node["fields"];
+	return Array.isArray(fields) ? fields : [];
+}
+function walkField(field, out) {
+	if (!isRecord$2(field)) return;
+	const type = field["type"];
+	const key = field["key"];
+	if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
+	if (type === "group") {
+		for (const child of fieldsOf(field)) walkField(child, out);
+		return;
+	}
+	if (type === "sub-tabs") {
+		const tabs = field["tabs"];
+		if (!Array.isArray(tabs)) return;
+		for (const tab of tabs) for (const child of fieldsOf(tab)) walkField(child, out);
+	}
+}
+//#endregion
+//#region src/keychain/secret-marker.ts
+/**
+* What a settings blob holds where a secret used to be.
+*
+* A keychain-stored field never holds its value. It holds a self-describing
+* MARKER, `{"$secret":"secret://…","v":1}` — an object, never a string, so no
+* code can mistake it for a credential and no form can send it to a camera as
+* a password. The empty state is `null` / absent, never `''`.
+*
+* The same shapes travel to and from the admin UI:
+*
+*  - read: `hydrateSchema` hands a secret field a {@link SecretFieldView}
+*    (`{ $secret, v, set: true }`) or `null` — the browser learns whether a
+*    value is set, never the value.
+*  - write: an untouched field submits the view back unchanged (KEEP); a typed
+*    value is a plain non-empty string (CHANGE); the Clear button submits
+*    {@link SECRET_CLEAR} (CLEAR). `''`, `null` and the legacy redaction tokens
+*    are KEEP — an empty string is what a defaults-fallback pushes back, and
+*    treating it as "clear" is how a save destroyed a stored credential before.
+*
+* Pure and browser-safe.
+*/
+var SECRET_CLEAR = { $secretClear: true };
+/** The `'***'` token D634 redaction writes for non-admins. */
+var LEGACY_DEVICE_REDACTION = "***";
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function makeSecretMarker(ref) {
+	return {
+		$secret: ref,
+		v: 1
+	};
+}
+/** A stored marker: an object whose `$secret` is a non-empty string. */
+function isSecretMarker(value) {
+	if (!isRecord$1(value)) return false;
+	const ref = value["$secret"];
+	return typeof ref === "string" && ref.length > 0;
+}
+/** Anything carrying a `$secret` key — a stored marker or a UI view of one. */
+function isSecretMarkerLike(value) {
+	return isRecord$1(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
+}
+function isSecretClear(value) {
+	return isRecord$1(value) && value["$secretClear"] === true;
+}
+function isSecretFieldView(value) {
+	return isRecord$1(value) && value["set"] === true && isSecretMarkerLike(value);
+}
+/**
+* The UI view of a stored secret field value: a marker becomes "set", inline
+* plaintext becomes "set (inline)", nothing becomes `null`. A value never
+* survives this function.
+*/
+function toSecretFieldView(stored) {
+	if (isSecretMarker(stored)) return {
+		$secret: stored.$secret,
+		v: 1,
+		set: true
+	};
+	if (typeof stored === "string" && stored.length > 0) return {
+		$secret: null,
+		v: 1,
+		set: true,
+		inline: true
+	};
+	return null;
+}
+/**
+* Classify an incoming value for a secret path. Only a non-empty string that is
+* not a redaction token sets a value; only {@link SECRET_CLEAR} clears.
+* Everything else — a marker (ours or anyone's), a UI view, `''`, `null`,
+* `undefined`, a redaction token, a non-string — keeps what is stored.
+*/
+function classifySecretWrite(incoming) {
+	if (isSecretClear(incoming)) return { kind: "clear" };
+	if (typeof incoming !== "string") return { kind: "keep" };
+	if (incoming.length === 0) return { kind: "keep" };
+	if (incoming === "__camstack_redacted__" || incoming === LEGACY_DEVICE_REDACTION) return { kind: "keep" };
+	return {
+		kind: "set",
+		value: incoming
+	};
+}
+//#endregion
 //#region src/interfaces/config-ui.ts
 /** Predefined tabs with standard label, icon, and sort order.
 *
@@ -358,33 +544,19 @@ function resolveHydratedFieldValue(schema, key) {
 	const entry = collectHydratedFieldEntries(schema).get(key);
 	return entry === void 0 ? void 0 : entry.value ?? entry.default;
 }
-/**
-* Merge a `ConfigUISchema` with a raw `values` record into a
-* `ConfigUISchemaWithValues`. Used by every `get*Settings` backend endpoint
-* before returning to the admin UI. Groups are walked recursively.
-*
-* For each leaf field:
-*   - structural fields (`separator`, `info`, `button`) pass through unchanged
-*   - other fields get `value = values[key] ?? field.default ?? null`
-*
-* Unknown keys in `values` (keys not declared in the schema) are silently
-* ignored — they don't contribute to the output. Missing keys fall back to
-* the schema default or `null`. This mirrors the old backend behaviour where
-* `FormBuilder` rendered `values[key] ?? field.default`.
-*/
-function hydrateSchema(schema, values) {
+function hydrateSchema(schema, values, options = {}) {
 	return {
 		...schema.tabs ? { tabs: [...schema.tabs] } : {},
 		sections: schema.sections.map((section) => ({
 			...section,
-			fields: section.fields.map((field) => hydrateField(field, values))
+			fields: section.fields.map((field) => hydrateField(field, values, options))
 		}))
 	};
 }
-function hydrateField(field, values) {
+function hydrateField(field, values, options) {
 	if (isValuelessField(field)) return field;
 	if (field.type === "group") {
-		const hydratedChildren = field.fields.map((child) => hydrateField(child, values));
+		const hydratedChildren = field.fields.map((child) => hydrateField(child, values, options));
 		return {
 			...field,
 			fields: hydratedChildren
@@ -393,7 +565,7 @@ function hydrateField(field, values) {
 	if (field.type === "sub-tabs") {
 		const hydratedTabs = field.tabs.map((tab) => ({
 			...tab,
-			fields: tab.fields.map((child) => hydrateField(child, values))
+			fields: tab.fields.map((child) => hydrateField(child, values, options))
 		}));
 		return {
 			...field,
@@ -403,6 +575,33 @@ function hydrateField(field, values) {
 	const key = field.key;
 	const storedValue = Object.prototype.hasOwnProperty.call(values, key) ? values[key] : void 0;
 	const defaultValue = field.default;
+	const asView = (v) => isSecretMarker(v) || options.inlineSecretsAsViews === true && v !== void 0;
+	if (isKeychainStoredField(field) && asView(storedValue)) return {
+		...field,
+		value: toSecretFieldView(storedValue)
+	};
+	if (isKeychainStoredField(field) && options.inlineSecretsAsViews === true) return {
+		...field,
+		value: null
+	};
+	if (field.type === "editable-array" && Array.isArray(storedValue)) {
+		const secretItemKeys = field.itemFields.filter((item) => "key" in item && isKeychainStoredField(item)).map((item) => "key" in item ? item.key : "");
+		if (secretItemKeys.length > 0) {
+			const rows = storedValue.map((row) => {
+				if (row === null || typeof row !== "object" || Array.isArray(row)) return row;
+				const out = { ...row };
+				for (const k of secretItemKeys) {
+					const v = Reflect.get(row, k);
+					if (asView(v)) out[k] = toSecretFieldView(v);
+				}
+				return out;
+			});
+			return {
+				...field,
+				value: rows
+			};
+		}
+	}
 	if (field.multiple) {
 		const stored = Array.isArray(storedValue) ? storedValue : storedValue !== void 0 && storedValue !== null ? [storedValue] : [];
 		const itemFallback = field.multiple.itemDefault !== void 0 ? field.multiple.itemDefault : defaultValue !== void 0 ? defaultValue : typeOf(field) === "string" ? "" : null;
@@ -668,7 +867,575 @@ function projectStore(store, perNodeKeys, nodeId) {
 	return out;
 }
 //#endregion
+//#region src/keychain/secret-ref.ts
+/**
+* The address of one keychain value: `secret://<owner>/<scope>/<fieldPath>`.
+*
+* A ref is DETERMINISTIC from where the value lives — the owner addon, the
+* scope (global, one node, one device, one integration, one row of a business
+* collection) and the field path inside that scope — so saving the same field
+* twice updates the same ref, and the ref itself says which settings blob
+* points at it. It is also the AAD of the value's ciphertext: a ciphertext
+* copied onto another ref does not decrypt.
+*
+* Array items are addressed by ITEM ID, never by index
+* (`providers[authentik].clientSecret`), so reordering a list keeps every ref.
+*
+* Pure and browser-safe: no node builtins, no I/O.
+*/
+/** The URI scheme of every keychain ref. */
+var SECRET_REF_SCHEME = "secret://";
+var GLOBAL_SCOPE = { kind: "global" };
+/** The scope every addon-wide (not per-node, not per-device) setting lives in. */
+function globalSecretScope() {
+	return GLOBAL_SCOPE;
+}
+/**
+* An addon id as a ref owner. A hub in-process builtin's context id is
+* `addon:<id>`; the owner of its secrets is `<id>`, exactly as for the same
+* addon running forked.
+*/
+function normalizeSecretOwner(addonId) {
+	return addonId.startsWith("addon:") ? addonId.slice(6) : addonId;
+}
+function encodeSegment(value) {
+	return encodeURIComponent(value);
+}
+function decodeSegment(value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return null;
+	}
+}
+/** The scope as it appears inside a ref (`global`, `node/<id>`, …). */
+function formatSecretScope(scope) {
+	switch (scope.kind) {
+		case "global": return "global";
+		case "node": return `node/${encodeSegment(scope.nodeId)}`;
+		case "device": return `device/${scope.deviceId}`;
+		case "integration": return `integration/${encodeSegment(scope.integrationId)}`;
+		case "row": return `row/${encodeSegment(scope.collection)}/${encodeSegment(scope.rowId)}`;
+	}
+}
+/**
+* The field path of a value inside an array item, addressed by the item's id:
+* `arrayItemFieldPath('providers', 'authentik', 'clientSecret')` →
+* `providers[authentik].clientSecret`.
+*/
+function arrayItemFieldPath(arrayKey, itemId, fieldKey) {
+	return `${arrayKey}[${encodeSegment(itemId)}].${fieldKey}`;
+}
+/** Build a ref. Throws on an empty owner or field path — both are bugs. */
+function buildSecretRef(parts) {
+	const owner = normalizeSecretOwner(parts.owner);
+	if (owner.length === 0) throw new Error("buildSecretRef: owner is empty");
+	if (parts.fieldPath.length === 0) throw new Error("buildSecretRef: fieldPath is empty");
+	return `${SECRET_REF_SCHEME}${encodeSegment(owner)}/${formatSecretScope(parts.scope)}/${parts.fieldPath}`;
+}
+/** True when `value` is shaped like a keychain ref (not that it exists). */
+function isSecretRef(value) {
+	return typeof value === "string" && parseSecretRef(value) !== null;
+}
+function parseScope(segments) {
+	switch (segments[0]) {
+		case "global": return {
+			scope: GLOBAL_SCOPE,
+			used: 1
+		};
+		case "node": {
+			const nodeId = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			return nodeId === null || nodeId.length === 0 ? null : {
+				scope: {
+					kind: "node",
+					nodeId
+				},
+				used: 2
+			};
+		}
+		case "device": {
+			const raw = segments[1];
+			if (raw === void 0 || !/^\d+$/.test(raw)) return null;
+			return {
+				scope: {
+					kind: "device",
+					deviceId: Number(raw)
+				},
+				used: 2
+			};
+		}
+		case "integration": {
+			const id = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			return id === null || id.length === 0 ? null : {
+				scope: {
+					kind: "integration",
+					integrationId: id
+				},
+				used: 2
+			};
+		}
+		case "row": {
+			const collection = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			const rowId = segments[2] !== void 0 ? decodeSegment(segments[2]) : null;
+			if (collection === null || rowId === null || collection.length === 0 || rowId.length === 0) return null;
+			return {
+				scope: {
+					kind: "row",
+					collection,
+					rowId
+				},
+				used: 3
+			};
+		}
+		default: return null;
+	}
+}
+/** Take a ref apart; `null` when it is not a well-formed ref. */
+function parseSecretRef(ref) {
+	if (!ref.startsWith("secret://")) return null;
+	const segments = ref.slice(9).split("/");
+	const owner = segments[0] !== void 0 ? decodeSegment(segments[0]) : null;
+	if (owner === null || owner.length === 0) return null;
+	const parsed = parseScope(segments.slice(1));
+	if (parsed === null) return null;
+	const fieldPath = segments.slice(1 + parsed.used).join("/");
+	if (fieldPath.length === 0) return null;
+	return {
+		owner,
+		scope: parsed.scope,
+		fieldPath
+	};
+}
+//#endregion
+//#region src/addon/secret-settings-view.ts
+/** A write to a secret path could not be stored in the keychain, so it was refused. */
+var KeychainWriteRefusedError = class extends Error {
+	fieldPath;
+	constructor(fieldPath, cause) {
+		super(`secret "${fieldPath}" was not saved: the keychain could not store it (${cause instanceof Error ? cause.message : String(cause)}). Nothing was written.`);
+		this.fieldPath = fieldPath;
+		this.name = "KeychainWriteRefusedError";
+	}
+};
+var KEEP = { kind: "keep" };
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function defaultMintId() {
+	return globalThis.crypto.randomUUID();
+}
+/** Every marker ref anywhere under `value`. */
+function collectSecretMarkerRefs(value, out = []) {
+	if (isSecretMarker(value)) {
+		out.push(value.$secret);
+		return out;
+	}
+	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
+	else if (isRecord(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	return out;
+}
+async function storedValueEquals(secrets, marker, candidate) {
+	const resolved = (await secrets.resolve([marker.$secret]))[marker.$secret];
+	return resolved?.kind === "value" && resolved.value === candidate;
+}
+async function writeLeaf(ctx, incoming, stored, fieldPath) {
+	const intent = classifySecretWrite(incoming);
+	const ref = ctx.secrets.ref(ctx.scope, fieldPath);
+	const storedIsOurs = isSecretMarker(stored) && stored.$secret === ref;
+	if (intent.kind === "keep") return KEEP;
+	if (intent.kind === "set" && !ctx.operatorWrite && typeof stored === "string" && stored === intent.value) return KEEP;
+	if (intent.kind === "clear") {
+		if (storedIsOurs) ctx.deletes.push(ref);
+		return {
+			kind: "value",
+			value: null
+		};
+	}
+	if (storedIsOurs && await storedValueEquals(ctx.secrets, stored, intent.value)) return {
+		kind: "value",
+		value: stored
+	};
+	try {
+		await ctx.secrets.put(ref, intent.value);
+	} catch (err) {
+		throw new KeychainWriteRefusedError(fieldPath, err);
+	}
+	return {
+		kind: "value",
+		value: makeSecretMarker(ref)
+	};
+}
+/** Apply a member result onto `out`: KEEP restores the stored member, or removes it. */
+function applyMember(out, key, result, storedParent) {
+	if (result.kind === "value") {
+		out[key] = result.value;
+		return;
+	}
+	if (Object.prototype.hasOwnProperty.call(storedParent, key)) out[key] = storedParent[key];
+	else delete out[key];
+}
+async function writeMembers(ctx, children, incoming, stored, pathOf) {
+	const out = { ...incoming };
+	for (const [member, node] of children) applyMember(out, member, await writeNode(ctx, node, incoming[member], stored[member], pathOf(member)), stored);
+	return out;
+}
+function rowId(row, idKey) {
+	const raw = row[idKey];
+	if (typeof raw === "string" && raw.length > 0) return raw;
+	if (typeof raw === "number" && Number.isFinite(raw)) return String(raw);
+	return null;
+}
+async function writeArray(ctx, node, incoming, stored, fieldPath) {
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord) : [];
+	if (!Array.isArray(incoming)) {
+		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
+		return {
+			kind: "value",
+			value: incoming
+		};
+	}
+	const storedById = /* @__PURE__ */ new Map();
+	for (const row of storedRows) {
+		const id = rowId(row, node.idKey);
+		if (id !== null) storedById.set(id, row);
+	}
+	const kept = /* @__PURE__ */ new Set();
+	const rows = [];
+	for (const row of incoming) {
+		if (!isRecord(row)) {
+			rows.push(row);
+			continue;
+		}
+		const id = rowId(row, node.idKey) ?? ctx.mintId();
+		kept.add(id);
+		const withId = {
+			...row,
+			[node.idKey]: row[node.idKey] ?? id
+		};
+		if (rowId(withId, node.idKey) === null) withId[node.idKey] = id;
+		const storedRow = storedById.get(id) ?? {};
+		rows.push(await writeMembers(ctx, node.item, withId, storedRow, (member) => arrayItemFieldPath(fieldPath, id, member)));
+	}
+	for (const [id, row] of storedById) if (!kept.has(id)) ctx.deletes.push(...collectSecretMarkerRefs(row));
+	return {
+		kind: "value",
+		value: rows
+	};
+}
+async function writeNode(ctx, node, incoming, stored, fieldPath) {
+	switch (node.kind) {
+		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
+		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
+		case "object": {
+			if (!isRecord(incoming)) {
+				if (incoming === void 0) return KEEP;
+				ctx.deletes.push(...collectSecretMarkerRefs(stored));
+				return {
+					kind: "value",
+					value: incoming
+				};
+			}
+			const storedObj = isRecord(stored) ? stored : {};
+			return {
+				kind: "value",
+				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
+			};
+		}
+	}
+}
+/** Split a perNode-scoped key (`key@nodeId`). */
+function splitNodeKey(key) {
+	const at = key.indexOf("@");
+	return at <= 0 ? {
+		base: key,
+		nodeId: null
+	} : {
+		base: key.slice(0, at),
+		nodeId: key.slice(at + 1)
+	};
+}
+/** Rewrite a settings patch so no secret value reaches the blob. See the file doc. */
+async function transformSecretWrite(input) {
+	const deletes = [];
+	const base = {
+		secrets: input.secrets,
+		mintId: input.mintId ?? defaultMintId,
+		deletes,
+		operatorWrite: input.operatorWrite === true
+	};
+	const out = {};
+	for (const [key, incoming] of Object.entries(input.patch)) {
+		const { base: baseKey, nodeId } = splitNodeKey(key);
+		const node = input.tree.get(baseKey);
+		if (node === void 0) {
+			out[key] = incoming;
+			continue;
+		}
+		const scope = nodeId !== null && nodeId.length > 0 ? {
+			kind: "node",
+			nodeId
+		} : input.scope ?? globalSecretScope();
+		const result = await writeNode({
+			...base,
+			scope
+		}, node, incoming, input.stored[key], baseKey);
+		if (result.kind === "value") out[key] = result.value;
+	}
+	return {
+		patch: out,
+		afterWrite: async () => {
+			if (deletes.length === 0) return { orphaned: [] };
+			try {
+				await input.secrets.delete([...new Set(deletes)]);
+				return { orphaned: [] };
+			} catch {
+				return { orphaned: [...new Set(deletes)] };
+			}
+		}
+	};
+}
+/**
+* Replace every marker in `value` with its keychain value. Returns the SAME
+* reference when there is no marker (no allocation, no keychain call).
+*/
+async function resolveSecretMarkers(value, secrets) {
+	const refs = collectSecretMarkerRefs(value);
+	if (refs.length === 0) return {
+		value,
+		unresolved: []
+	};
+	const answers = await secrets.resolve(refs);
+	const unresolved = [];
+	for (const ref of new Set(refs)) {
+		const answer = answers[ref];
+		if (answer === void 0) unresolved.push({
+			ref,
+			reason: "not-initialized"
+		});
+		else if (answer.kind === "unavailable") unresolved.push({
+			ref,
+			reason: answer.reason
+		});
+		else if (answer.kind === "missing" || answer.kind === "forbidden") unresolved.push({
+			ref,
+			reason: answer.kind
+		});
+	}
+	const substitute = (v) => {
+		if (isSecretMarker(v)) {
+			const answer = answers[v.$secret];
+			return answer?.kind === "value" ? {
+				keep: true,
+				value: answer.value
+			} : {
+				keep: false,
+				value: void 0
+			};
+		}
+		if (Array.isArray(v)) {
+			const items = [];
+			for (const item of v) {
+				const s = substitute(item);
+				if (s.keep) items.push(s.value);
+			}
+			return {
+				keep: true,
+				value: items
+			};
+		}
+		if (isRecord(v)) {
+			const out = {};
+			for (const [k, child] of Object.entries(v)) {
+				const s = substitute(child);
+				if (s.keep) out[k] = s.value;
+			}
+			return {
+				keep: true,
+				value: out
+			};
+		}
+		return {
+			keep: true,
+			value: v
+		};
+	};
+	return {
+		value: substitute(value).value,
+		unresolved
+	};
+}
+//#endregion
+//#region src/addon/secret-aware-context.ts
+function touchesTree(tree, patch) {
+	if (tree.size === 0) return false;
+	for (const key of Object.keys(patch)) {
+		const at = key.indexOf("@");
+		if (tree.has(at > 0 ? key.slice(0, at) : key)) return true;
+	}
+	return false;
+}
+/** The blob as stored now; a failed read REFUSES the write instead of guessing. */
+async function readStoredAddonBlob(raw) {
+	const threeWay = raw.readAddonStoreResult;
+	if (threeWay === void 0) return raw.readAddonStore();
+	const result = await threeWay.call(raw);
+	if (result.kind === "failed") throw new Error(`settings write refused: the stored blob could not be read (${result.error})`);
+	return result.kind === "missing" ? {} : result.value;
+}
+function createSecretAwareSettings(raw, opts) {
+	const chains = /* @__PURE__ */ new Map();
+	const serialize = (key, fn) => {
+		const next = (chains.get(key) ?? Promise.resolve()).then(fn, fn);
+		const tail = next.catch(() => void 0);
+		chains.set(key, tail);
+		tail.then(() => {
+			if (chains.get(key) === tail) chains.delete(key);
+		});
+		return next;
+	};
+	const write = async (chainKey, tree, scope, patch, readStored, rawWrite) => {
+		if (!touchesTree(tree, patch)) return rawWrite(patch);
+		return serialize(chainKey, async () => {
+			const stored = await readStored();
+			const result = await transformSecretWrite({
+				tree,
+				secrets: opts.secrets,
+				patch,
+				stored,
+				...scope !== void 0 ? { scope } : {},
+				operatorWrite: opts.isOperatorWrite?.() === true
+			});
+			if (Object.keys(result.patch).length > 0) await rawWrite(result.patch);
+			const { orphaned } = await result.afterWrite();
+			if (orphaned.length > 0) opts.onOrphaned(orphaned);
+		});
+	};
+	const wrapped = {
+		writeAddonStore: (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p)),
+		writeDeviceStore: (deviceId, patch) => write(`device:${deviceId}`, opts.deviceTree(), {
+			kind: "device",
+			deviceId
+		}, patch, () => raw.readDeviceStore(deviceId), (p) => raw.writeDeviceStore(deviceId, p))
+	};
+	return new Proxy(raw, { get(target, prop, receiver) {
+		if (prop === "writeAddonStore") return wrapped.writeAddonStore;
+		if (prop === "writeDeviceStore") return wrapped.writeDeviceStore;
+		const value = Reflect.get(target, prop, receiver);
+		return typeof value === "function" ? value.bind(target) : value;
+	} });
+}
+/** The context the addon sees: identical, except that its settings writes are secret-aware. */
+function withSecretAwareSettings(context, opts) {
+	const raw = context.settings;
+	if (raw === void 0) return context;
+	const settings = createSecretAwareSettings(raw, opts);
+	return new Proxy(context, { get(target, prop, receiver) {
+		if (prop === "settings") return settings;
+		return Reflect.get(target, prop, receiver);
+	} });
+}
+//#endregion
+//#region src/addon/secret-paths.ts
+var LEAF = { kind: "leaf" };
+var DEFAULT_ITEM_ID_KEY = "id";
+function collectFields(fields, out) {
+	for (const field of fields) {
+		if (field.type === "group") {
+			collectFields(field.fields, out);
+			continue;
+		}
+		if (field.type === "sub-tabs") {
+			for (const tab of field.tabs) collectFields(tab.fields, out);
+			continue;
+		}
+		if (field.type === "editable-array") {
+			const item = /* @__PURE__ */ new Map();
+			for (const itemField of field.itemFields) if ("key" in itemField && isKeychainStoredField(itemField)) item.set(itemField.key, LEAF);
+			if (item.size > 0) out.set(field.key, {
+				kind: "array",
+				idKey: field.itemIdKey ?? DEFAULT_ITEM_ID_KEY,
+				item
+			});
+			continue;
+		}
+		if (!("key" in field) || typeof field.key !== "string") continue;
+		if (isKeychainStoredField(field)) out.set(field.key, LEAF);
+	}
+}
+/** The secret tree a settings schema declares. */
+function secretTreeFromSchema(schema) {
+	const out = /* @__PURE__ */ new Map();
+	if (schema === null) return out;
+	for (const section of schema.sections) collectFields(section.fields, out);
+	return out;
+}
+/** Parse `a.b[id].c` into segments; throws on a malformed path (a declaration bug). */
+function parseSecretStatePath(path) {
+	const segments = [];
+	for (const raw of path.split(".")) {
+		const m = /^([^[\]]+)(?:\[([^[\]]+)\])?$/.exec(raw);
+		if (m === null || m[1] === void 0) throw new Error(`secretStatePaths: malformed path "${path}"`);
+		segments.push(m[2] !== void 0 ? {
+			key: m[1],
+			idKey: m[2]
+		} : { key: m[1] });
+	}
+	if (segments.length === 0) throw new Error(`secretStatePaths: empty path`);
+	if (segments[segments.length - 1]?.idKey !== void 0) throw new Error(`secretStatePaths: "${path}" ends on an array — name the member that is secret`);
+	return segments;
+}
+function insert(into, segments) {
+	const [head, ...rest] = segments;
+	if (head === void 0) return;
+	if (rest.length === 0) {
+		into.set(head.key, LEAF);
+		return;
+	}
+	const existing = into.get(head.key);
+	if (head.idKey !== void 0) {
+		const item = new Map(existing?.kind === "array" ? existing.item : []);
+		insert(item, rest);
+		into.set(head.key, {
+			kind: "array",
+			idKey: head.idKey,
+			item
+		});
+		return;
+	}
+	const children = new Map(existing?.kind === "object" ? existing.children : []);
+	insert(children, rest);
+	into.set(head.key, {
+		kind: "object",
+		children
+	});
+}
+/** Add hidden-state paths (`secretStatePaths`) to a schema-derived tree. */
+function mergeSecretStatePaths(tree, paths) {
+	if (paths.length === 0) return tree;
+	const out = new Map(tree);
+	for (const path of paths) insert(out, parseSecretStatePath(path));
+	return out;
+}
+/**
+* The tree of a DECLARED path list — a device's `secretConfigPaths`
+* (`collectZodSecretPaths`: dotted, `[]` for array items). An array segment
+* without a named id field is addressed by the item's `id`.
+*/
+function secretTreeFromPaths(paths) {
+	const out = /* @__PURE__ */ new Map();
+	for (const path of paths) {
+		if (path.length === 0) continue;
+		insert(out, parseSecretStatePath(path.replace(/\[\]/g, `[${DEFAULT_ITEM_ID_KEY}]`)));
+	}
+	return out;
+}
+//#endregion
 //#region src/addon/base-addon.ts
+/** First retry of a secret the keychain could not serve; doubles to {@link SECRET_RETRY_MAX_MS}. */
+var SECRET_RETRY_FIRST_MS = 5e3;
+var SECRET_RETRY_MAX_MS = 5 * 6e4;
+/** Coalesces a burst of `keychain.changed` events into one re-resolve. */
+var SECRET_CHANGE_DEBOUNCE_MS = 250;
 /**
 * Base class for CamStack addons. Eliminates settings boilerplate:
 *
@@ -738,6 +1505,25 @@ var BaseAddon = class {
 	settingsStoreReady = false;
 	/** Default config values. Provided via constructor. */
 	defaults;
+	/**
+	* Hidden-state paths that hold secrets (D787) — values the addon writes
+	* itself (`updateGlobalSettings`, `state()`) that no form field declares.
+	* Stored in the keychain exactly like a `password` field. Syntax:
+	* `'snapshotSigningKey'`, `'identity.pincode'`, `'tokens[userId].accessToken'`
+	* (`key[<id field>]` addresses array items by id, never by index).
+	*/
+	secretStatePaths = [];
+	_addonSecretTree = null;
+	_deviceSecretTree = null;
+	/** Refs the last resolved config pointed at — a change to one re-resolves. */
+	_configSecretRefs = /* @__PURE__ */ new Set();
+	_unresolvedSecrets = [];
+	_secretRetryTimer = null;
+	_secretRetryDelayMs = SECRET_RETRY_FIRST_MS;
+	_secretChangeTimer = null;
+	_secretChangeUnsub = null;
+	/** >0 while an OPERATOR's settings write is being applied. */
+	_operatorWriteDepth = 0;
 	constructor(defaults) {
 		this.defaults = defaults;
 		this._config = { ...defaults };
@@ -773,8 +1559,18 @@ var BaseAddon = class {
 		return this._config;
 	}
 	async initialize(context) {
-		this._ctx = context;
+		const secrets = context.secrets;
+		this._ctx = secrets !== void 0 ? withSecretAwareSettings(context, {
+			secrets,
+			addonTree: () => this.addonSecretTree(),
+			deviceTree: () => this.deviceSecretTree(),
+			onOrphaned: (refs) => context.logger.warn("keychain refs dropped by a settings write could not be deleted", { meta: { refs: [...refs] } }),
+			isOperatorWrite: () => this._operatorWriteDepth > 0
+		}) : context;
 		await this.resolveConfig();
+		if (secrets !== void 0) this._secretChangeUnsub = secrets.onChange((ref) => {
+			if (this._configSecretRefs.has(ref)) this.scheduleSecretReresolve(SECRET_CHANGE_DEBOUNCE_MS);
+		});
 		const result = await this.onInitialize();
 		this.emitLifecycle(EventCategory.AddonStarted);
 		const normalized = normalizeAddonInitResult(result);
@@ -807,6 +1603,12 @@ var BaseAddon = class {
 	*/
 	async onHubReachable() {}
 	async shutdown() {
+		this._secretChangeUnsub?.();
+		this._secretChangeUnsub = null;
+		if (this._secretRetryTimer !== null) clearTimeout(this._secretRetryTimer);
+		if (this._secretChangeTimer !== null) clearTimeout(this._secretChangeTimer);
+		this._secretRetryTimer = null;
+		this._secretChangeTimer = null;
 		this.emitLifecycle(EventCategory.AddonStopped);
 		if (this.autoEmitReadiness) this.emitReadinessForProviders("down");
 		await this.onShutdown();
@@ -885,7 +1687,7 @@ var BaseAddon = class {
 		return hydrateSchema(schema, overlay ? {
 			...projected,
 			...overlay
-		} : projected);
+		} : projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The integration-level view of this addon's settings: exactly the sections
@@ -934,7 +1736,7 @@ var BaseAddon = class {
 		return hydrateSchema({
 			...schema,
 			sections
-		}, projected);
+		}, projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The raw addon store PROJECTED onto the target node's bare per-node keys:
@@ -988,18 +1790,50 @@ var BaseAddon = class {
 			value: result.value[key]
 		};
 	}
+	/**
+	* The OPERATOR's write — a settings form or an admin API call, dispatched by
+	* the kernel. Identical to {@link updateGlobalSettings}, except that a secret
+	* the operator sends is stored as sent even when it equals a pre-keychain
+	* inline value: the operator re-entering a password is a change, an addon
+	* writing back what it read is not (D787).
+	*/
+	async updateGlobalSettingsAsOperator(patch, nodeId) {
+		this._operatorWriteDepth++;
+		try {
+			await this.applyGlobalPatch(patch, nodeId);
+		} finally {
+			this._operatorWriteDepth--;
+		}
+	}
 	async updateGlobalSettings(patch, nodeId) {
+		await this.applyGlobalPatch(patch, nodeId);
+	}
+	/**
+	* REMOVE stored secrets — their keychain values and their markers (D787).
+	*
+	* Writing `''` to a secret field KEEPS what is stored (an empty string is
+	* what a defaults fallback writes back, and it must never destroy a
+	* credential), so code that means "forget this token" says so here. Without
+	* a keychain (an older kernel) it writes `''`, as such code always did.
+	*/
+	async clearSecrets(keys, nodeId) {
+		const tree = this.addonSecretTree();
+		const keychain = this._ctx?.secrets !== void 0;
+		const patch = {};
+		for (const key of keys) patch[key] = keychain && tree.has(key) ? SECRET_CLEAR : "";
+		await this.applyGlobalPatch(patch, nodeId);
+	}
+	async applyGlobalPatch(barePatch, nodeId) {
 		const keys = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
-		const barePatch = patch;
 		const scoped = keys.size > 0 ? scopePatch(barePatch, keys, target) : barePatch;
 		await this._ctx?.settings?.writeAddonStore(scoped);
 		if (target !== localNode) return;
 		await this.resolveConfig();
 		await this.onConfigChanged();
 		this.emitLifecycle(EventCategory.AddonUpdated, { level: "global" });
-		this.maybeAutoRestart(patch, this.globalSettingsSchema());
+		this.maybeAutoRestart(Object.keys(barePatch), this.globalSettingsSchema());
 	}
 	/**
 	* The set of field keys the global settings schema declares `perNode: true`
@@ -1024,7 +1858,7 @@ var BaseAddon = class {
 	* time to return its response before the addon is torn down and
 	* re-initialised by `AddonRegistryService.restartAddon`.
 	*/
-	maybeAutoRestart(patch, schema) {
+	maybeAutoRestart(patchKeys, schema) {
 		if (!schema) return;
 		const restartKeys = /* @__PURE__ */ new Set();
 		for (const section of schema.sections) for (const field of section.fields) {
@@ -1032,13 +1866,13 @@ var BaseAddon = class {
 			if (field.requiresRestart) restartKeys.add(field.key);
 		}
 		if (restartKeys.size === 0) return;
-		if (!Object.keys(patch).some((k) => restartKeys.has(k))) return;
+		if (!patchKeys.some((k) => restartKeys.has(k))) return;
 		const ctx = this._ctx;
 		if (!ctx) return;
 		const addonId = ctx.id;
 		setImmediate(() => {
 			ctx.api.addons?.restartAddon?.mutate({ addonId }).then(() => {
-				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: Object.keys(patch).filter((k) => restartKeys.has(k)) } });
+				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: patchKeys.filter((k) => restartKeys.has(k)) } });
 			}).catch((err) => {
 				ctx.logger.error("addon auto-restart failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
 			});
@@ -1047,7 +1881,7 @@ var BaseAddon = class {
 	async getDeviceSettings(deviceId) {
 		const schema = this.deviceSettingsSchema();
 		if (!schema) return { sections: [] };
-		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {});
+		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, { inlineSecretsAsViews: true });
 	}
 	async updateDeviceSettings(deviceId, patch) {
 		await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
@@ -1177,7 +2011,7 @@ var BaseAddon = class {
 	* selection at boot (absent scoped key ⇒ the constructor default wins).
 	*/
 	async resolveConfig() {
-		const stored = await this.readAddonStoreWithRetry();
+		const stored = await this.resolveStoredSecrets(await this.readAddonStoreWithRetry());
 		const perNode = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const resolved = { ...this.defaults };
@@ -1202,7 +2036,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: () => this.readAddonStoreWithRetry(),
+			read: async () => this.resolveStoredSecrets(await this.readAddonStoreWithRetry()),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeAddonStore(patch);
 			},
@@ -1219,7 +2053,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: async () => await this._ctx?.settings?.readDeviceStore(deviceId) ?? {},
+			read: async () => this.resolveStoredSecrets(await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, false),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
 			},
@@ -1231,6 +2065,70 @@ var BaseAddon = class {
 			} })
 		});
 	}
+	/** The addon store's secret tree: schema fields by TYPE, plus `secretStatePaths`. */
+	addonSecretTree() {
+		this._addonSecretTree ??= mergeSecretStatePaths(secretTreeFromSchema(this.globalSettingsSchema()), this.secretStatePaths);
+		return this._addonSecretTree;
+	}
+	deviceSecretTree() {
+		this._deviceSecretTree ??= secretTreeFromSchema(this.deviceSettingsSchema());
+		return this._deviceSecretTree;
+	}
+	/**
+	* Secrets of this addon's stored config that could not be resolved on the
+	* last read, with why. Non-empty means the addon is running WITHOUT them —
+	* an addon whose function needs one should report itself degraded rather
+	* than start on an empty credential.
+	*/
+	get unresolvedSecrets() {
+		return this._unresolvedSecrets;
+	}
+	/**
+	* Substitute every keychain marker in a stored blob with its value. With no
+	* keychain (no `ctx.secrets`) or no marker, the blob comes back unchanged.
+	* An unresolvable value is LEFT OUT (never `''`), logged by ref — never by
+	* value — and, when the cause can pass, retried with backoff. Nothing is
+	* ever written back from here.
+	*/
+	async resolveStoredSecrets(blob, trackForConfig = true) {
+		const secrets = this._ctx?.secrets;
+		if (secrets === void 0) return blob;
+		const refs = collectSecretMarkerRefs(blob);
+		if (trackForConfig) this._configSecretRefs = new Set(refs);
+		if (refs.length === 0) {
+			if (trackForConfig) this._unresolvedSecrets = [];
+			return blob;
+		}
+		const { value, unresolved } = await resolveSecretMarkers(blob, secrets);
+		if (trackForConfig) {
+			this._unresolvedSecrets = unresolved;
+			if (unresolved.length > 0) {
+				this._ctx?.logger?.error?.("secret unavailable — running without it, will retry", { meta: { secrets: unresolved.map((u) => ({
+					ref: u.ref,
+					reason: u.reason
+				})) } });
+				if (unresolved.some((u) => u.reason !== "missing" && u.reason !== "forbidden")) {
+					this.scheduleSecretReresolve(this._secretRetryDelayMs);
+					this._secretRetryDelayMs = Math.min(this._secretRetryDelayMs * 2, SECRET_RETRY_MAX_MS);
+				}
+			} else this._secretRetryDelayMs = SECRET_RETRY_FIRST_MS;
+		}
+		return value;
+	}
+	/** Re-resolve the config (a keychain-only change, or a retry) and apply it. */
+	scheduleSecretReresolve(delayMs) {
+		const timerOf = delayMs === SECRET_CHANGE_DEBOUNCE_MS ? "_secretChangeTimer" : "_secretRetryTimer";
+		if (this[timerOf] !== null) return;
+		const timer = setTimeout(() => {
+			this[timerOf] = null;
+			if (this._ctx === null) return;
+			this.resolveConfig().then(() => this.onConfigChanged()).catch((err) => {
+				this._ctx?.logger?.error?.("re-resolving secrets failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			});
+		}, delayMs);
+		timer.unref?.();
+		this[timerOf] = timer;
+	}
 	/**
 	* Wrap `ctx.settings.readAddonStore()` with a short retry budget so a
 	* transient settings-store outage (mid-restart of sqlite-settings, tsx-watch
@@ -1470,6 +2368,312 @@ var PeerBytesTicketSchema = z.object({
 	declaredBytes: z.number().int().nonnegative().nullable()
 });
 //#endregion
+//#region src/keychain/known-secrets.ts
+/**
+* The per-process set of secret VALUES this process has resolved, so the log
+* pipeline can scrub them wherever they turn up — a library's error message,
+* an argv a spawn logged, a URL someone interpolated.
+*
+* Key-name redaction cannot catch `Command failed: cloudflared --token eyJ…`:
+* the value is in a message, not under a named key. The only thing that can is
+* knowing the value. `ctx.secrets` registers every value it resolves (and every
+* value it stores), and `scrubKnownSecrets` replaces each occurrence with
+* `‹secret:<hash of its ref>›` — enough to say WHICH secret leaked, nothing of
+* what it is.
+*
+* Process-global on purpose: a forked runner scrubs its own logs before they
+* leave over UDS, and hub-main scrubs what it resolved. Values shorter than
+* {@link MIN_SCRUBBED_LENGTH} are not registered — a 4-digit PIN would turn
+* every timestamp containing it into a redaction.
+*/
+/** Below this length a value is too likely to collide with ordinary text. */
+var MIN_SCRUBBED_LENGTH = 8;
+/**
+* One store per PROCESS, even when two copies of this module are loaded (an
+* addon bundle next to the framework's): keyed on a registered symbol.
+*/
+var STORE_KEY = Symbol.for("camstack.keychain.known-secrets");
+function store() {
+	const existing = Reflect.get(globalThis, STORE_KEY);
+	if (existing !== void 0 && existing !== null) return existing;
+	const created = {
+		values: /* @__PURE__ */ new Map(),
+		compiled: null
+	};
+	Reflect.set(globalThis, STORE_KEY, created);
+	return created;
+}
+/** FNV-1a, 32-bit, as 8 hex chars — a label, not a security property. */
+function shortSecretRefHash(ref) {
+	let hash = 2166136261;
+	for (let i = 0; i < ref.length; i++) {
+		hash ^= ref.charCodeAt(i);
+		hash = Math.imul(hash, 16777619) >>> 0;
+	}
+	return hash.toString(16).padStart(8, "0");
+}
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function recompile() {
+	const s = store();
+	if (s.values.size === 0) {
+		s.compiled = null;
+		return;
+	}
+	const values = [...s.values.keys()].toSorted((a, b) => b.length - a.length);
+	s.compiled = new RegExp(values.map(escapeRegExp).join("|"), "g");
+}
+/** Remember a value this process holds. A no-op for short or empty values. */
+function registerKnownSecret(value, ref) {
+	if (value.length < 8) return;
+	const label = `‹secret:${shortSecretRefHash(ref)}›`;
+	const values = store().values;
+	if (values.get(value) === label) return;
+	values.set(value, label);
+	recompile();
+}
+/** Forget a value (it was replaced or deleted). */
+function forgetKnownSecret(value) {
+	if (!store().values.delete(value)) return;
+	recompile();
+}
+/** How many values are registered — for tests and the status page. */
+function knownSecretCount() {
+	return store().values.size;
+}
+/** Test seam: drop every registered value. */
+function clearKnownSecrets() {
+	const s = store();
+	s.values.clear();
+	s.compiled = null;
+}
+/** Replace every registered value inside `text` with its label. */
+function scrubKnownSecrets(text) {
+	const s = store();
+	const re = s.compiled;
+	if (re === null || text.length < 8) return text;
+	re.lastIndex = 0;
+	if (!re.test(text)) return text;
+	re.lastIndex = 0;
+	return text.replace(re, (match) => s.values.get(match) ?? "‹secret›");
+}
+//#endregion
+//#region src/keychain/secrets-access.ts
+/** Re-fetch a cached value after this long, even with no change event. */
+var REVALIDATE_AFTER_MS = 15 * 6e4;
+function unavailableAll(refs) {
+	const out = {};
+	for (const ref of refs) out[ref] = {
+		kind: "unavailable",
+		reason: "not-initialized"
+	};
+	return out;
+}
+function createSecretsAccess(opts) {
+	const owner = normalizeSecretOwner(opts.owner);
+	const now = opts.now ?? Date.now;
+	const cache = /* @__PURE__ */ new Map();
+	const handlers = /* @__PURE__ */ new Set();
+	/** One delegate handle per owner — each holds a cache and a subscription. */
+	const delegates = /* @__PURE__ */ new Map();
+	const drop = (ref) => {
+		const entry = cache.get(ref);
+		if (entry === void 0) return;
+		cache.delete(ref);
+		forgetKnownSecret(entry.value);
+		for (const handler of handlers) try {
+			handler(ref);
+		} catch {}
+	};
+	opts.eventBus?.subscribe({ category: EventCategory.KeychainChanged }, (event) => {
+		const data = event.data;
+		if (data === null || typeof data !== "object") return;
+		const ref = Reflect.get(data, "ref");
+		const version = Reflect.get(data, "version");
+		if (typeof ref !== "string") return;
+		const entry = cache.get(ref);
+		if (entry === void 0) return;
+		if (typeof version === "number" && version === entry.version) return;
+		drop(ref);
+	});
+	const remember = (ref, value, version) => {
+		const previous = cache.get(ref);
+		if (previous !== void 0 && previous.value !== value) forgetKnownSecret(previous.value);
+		cache.set(ref, {
+			value,
+			version,
+			fetchedAt: now()
+		});
+		registerKnownSecret(value, ref);
+	};
+	return {
+		owner,
+		ref: (scope, fieldPath) => buildSecretRef({
+			owner,
+			scope,
+			fieldPath
+		}),
+		async resolve(refs) {
+			const out = {};
+			const toFetch = [];
+			const t = now();
+			for (const ref of new Set(refs)) {
+				const hit = cache.get(ref);
+				if (hit !== void 0 && t - hit.fetchedAt < 9e5) out[ref] = {
+					kind: "value",
+					value: hit.value,
+					version: hit.version
+				};
+				else toFetch.push(ref);
+			}
+			if (toFetch.length === 0) return out;
+			let fetched;
+			try {
+				fetched = await opts.transport.resolve({ refs: toFetch });
+			} catch {
+				fetched = unavailableAll(toFetch);
+			}
+			for (const ref of toFetch) {
+				const entry = fetched[ref] ?? {
+					kind: "unavailable",
+					reason: "not-initialized"
+				};
+				if (entry.kind === "value") {
+					remember(ref, entry.value, entry.version);
+					out[ref] = entry;
+					continue;
+				}
+				if (entry.kind === "unavailable") {
+					const stale = cache.get(ref);
+					out[ref] = stale !== void 0 ? {
+						kind: "value",
+						value: stale.value,
+						version: stale.version
+					} : entry;
+					continue;
+				}
+				if (cache.has(ref)) drop(ref);
+				out[ref] = entry;
+			}
+			return out;
+		},
+		async put(ref, value) {
+			const result = await opts.transport.put({
+				ref,
+				value
+			});
+			remember(ref, value, result.version);
+			return result.version;
+		},
+		async delete(refs) {
+			if (refs.length === 0) return 0;
+			const result = await opts.transport.delete({ refs });
+			for (const ref of refs) drop(ref);
+			return result.deleted;
+		},
+		state: () => opts.transport.getState(),
+		onChange(handler) {
+			handlers.add(handler);
+			return () => {
+				handlers.delete(handler);
+			};
+		},
+		forOwner: opts.transportForOwner === void 0 ? null : (other) => {
+			const target = normalizeSecretOwner(other);
+			const existing = delegates.get(target);
+			if (existing !== void 0) return existing;
+			const build = opts.transportForOwner;
+			if (build === void 0) throw new Error("forOwner: no delegate transport");
+			const delegate = createSecretsAccess({
+				owner: target,
+				transport: build(target),
+				...opts.eventBus !== void 0 ? { eventBus: opts.eventBus } : {},
+				now
+			});
+			delegates.set(target, delegate);
+			return delegate;
+		}
+	};
+}
+//#endregion
+//#region src/keychain/resolve-secret-views.ts
+/**
+* Resolve the secret VIEWS a form sends as action input (D789).
+*
+* A settings form knows a stored secret only as `{ $secret: ref, set: true }`.
+* An action that reads one from the form (`paramsFromForm`, e.g. "list my
+* Cloudflare zones with the stored token") therefore receives the view. The
+* owner's process swaps each view for its value before the action's input
+* schema runs — through the owner's own `ctx.secrets`, so a view naming
+* another addon's ref resolves to nothing (owner-checked by the keychain).
+*
+* A view that cannot be resolved (pre-keychain inline value, missing,
+* unavailable, forbidden) and an explicit clear instruction are DROPPED: the
+* action sees the parameter as absent, never as an object it would mis-read.
+*/
+function viewRef(value) {
+	if (!isSecretMarkerLike(value)) return null;
+	const ref = Reflect.get(value, "$secret");
+	return typeof ref === "string" && ref.length > 0 ? ref : null;
+}
+function collect(value, out) {
+	if (isSecretClear(value) || isSecretMarkerLike(value)) {
+		const ref = viewRef(value);
+		if (ref !== null) out.add(ref);
+		return true;
+	}
+	let found = false;
+	if (Array.isArray(value)) for (const item of value) found = collect(item, out) || found;
+	else if (value !== null && typeof value === "object") for (const child of Object.values(value)) found = collect(child, out) || found;
+	return found;
+}
+async function resolveSecretViewsIn(args, secrets) {
+	const refs = /* @__PURE__ */ new Set();
+	if (!collect(args, refs)) return args;
+	const answers = secrets !== void 0 && refs.size > 0 ? await secrets.resolve([...refs]) : {};
+	const swap = (value) => {
+		if (isSecretClear(value) || isSecretMarkerLike(value)) {
+			const ref = viewRef(value);
+			const answer = ref !== null ? answers[ref] : void 0;
+			return answer?.kind === "value" ? {
+				keep: true,
+				value: answer.value
+			} : {
+				keep: false,
+				value: void 0
+			};
+		}
+		if (Array.isArray(value)) {
+			const items = [];
+			for (const item of value) {
+				const s = swap(item);
+				if (s.keep) items.push(s.value);
+			}
+			return {
+				keep: true,
+				value: items
+			};
+		}
+		if (value !== null && typeof value === "object") {
+			const out = {};
+			for (const [k, child] of Object.entries(value)) {
+				const s = swap(child);
+				if (s.keep) out[k] = s.value;
+			}
+			return {
+				keep: true,
+				value: out
+			};
+		}
+		return {
+			keep: true,
+			value
+		};
+	};
+	return swap(args).value;
+}
+//#endregion
 //#region src/capabilities/schemas/streaming-shared.ts
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = z.enum([
@@ -2784,6 +3988,94 @@ var deviceOpsCapability = {
 	}
 };
 //#endregion
+//#region src/device/zod-secret.ts
+/**
+* Secret declaration on a Zod config schema (D783).
+*
+* A field is a secret because its schema SAYS so — `.meta({ secret: true })`,
+* spelled {@link SECRET_META} — never because its key looks like a credential.
+* It is the Zod twin of `secret: true` / `type: 'password'` on a config-UI
+* field (`isSecretConfigField`), and every consumer that treats secrets
+* specially reads it: the settings form (`zodEntriesToConfigUI`), the paths a
+* device advertises at `registerDevice` (`secretConfigPaths`, which the
+* non-admin redaction withholds at any depth), and the keychain later.
+*
+* Zod keeps `.meta()` in `z.globalRegistry`, which lives on `globalThis`, so a
+* declaration made by an addon's own copy of zod is visible here.
+*/
+/**
+* `{ secret: true }` — the one spelling of "this field holds a credential".
+*
+* Addons write the LITERAL `.meta({ secret: true })` rather than importing
+* this constant: an addon running against an older `@camstack/types` would
+* otherwise call `.meta(undefined)`, which in zod v4 is the metadata GETTER
+* and returns no schema at all.
+*/
+var SECRET_META = { secret: true };
+function defOf(schema) {
+	return schema._zod?.def ?? {};
+}
+function declaredHere(schema) {
+	return z.globalRegistry.get(schema)?.secret === true;
+}
+/** Wrapper kinds whose `innerType` is the field itself. */
+var WRAPPERS = new Set([
+	"optional",
+	"nullable",
+	"default",
+	"prefault",
+	"catch",
+	"readonly",
+	"nonoptional"
+]);
+/**
+* The schema layers that make up ONE field: the schema itself and every
+* wrapper below it (optional / default / nullable / readonly / catch), plus
+* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
+* `.transform` on `in`).
+*/
+function layersOf(schema) {
+	const out = [];
+	const queue = [schema];
+	while (queue.length > 0) {
+		const s = queue.shift();
+		if (!s || out.includes(s)) continue;
+		out.push(s);
+		const def = defOf(s);
+		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
+		if (def.type === "pipe") {
+			if (def.in) queue.push(def.in);
+			if (def.out) queue.push(def.out);
+		}
+	}
+	return out;
+}
+/** True when any layer of this field declares `.meta({ secret: true })`. */
+function isZodSecret(schema) {
+	return layersOf(schema).some(declaredHere);
+}
+/**
+* Every declared secret path in a config schema: dotted keys, `[]` for "each
+* element of this array" (`connection.password`, `rows[].token`). A declared
+* object or array is reported as one path and not descended into — everything
+* under it is secret.
+*/
+function collectZodSecretPaths(schema, prefix = "") {
+	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
+	const paths = [];
+	for (const layer of layersOf(schema)) {
+		const def = defOf(layer);
+		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
+		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
+		else if (def.type === "intersection") {
+			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
+			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
+		}
+	}
+	return [...new Set(paths)];
+}
+//#endregion
 //#region src/device/device-state-handle.ts
 var DEVICE_STATE_EVENT_CATEGORY = "device.state-changed";
 /**
@@ -3415,6 +4707,18 @@ function createDeviceProxy(api, binding, opts) {
 		completeRetrainTrack: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "completeRetrainTrack", "mutation", input),
 		restageRetrainTrack: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "restageRetrainTrack", "mutation", input),
 		getRetrainExportUrl: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getRetrainExportUrl", "query", input),
+		setRetrainFrameComplete: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "setRetrainFrameComplete", "mutation", input),
+		writeRetrainArchive: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "writeRetrainArchive", "mutation", input),
+		listRetrainAssistProfiles: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRetrainAssistProfiles", "query", input),
+		proposeRetrainAnnotationsWithLlm: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "proposeRetrainAnnotationsWithLlm", "mutation", input),
+		createRetrainCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "createRetrainCollection", "mutation", input),
+		listRetrainCollections: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRetrainCollections", "query", input),
+		renameRetrainCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "renameRetrainCollection", "mutation", input),
+		deleteRetrainCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "deleteRetrainCollection", "mutation", input),
+		addRetrainFrameFromRecording: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "addRetrainFrameFromRecording", "mutation", input),
+		addRetrainFramesToCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "addRetrainFramesToCollection", "mutation", input),
+		removeRetrainFrameFromCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "removeRetrainFrameFromCollection", "mutation", input),
+		listRetrainCollectionFrames: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRetrainCollectionFrames", "query", input),
 		getEventMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getEventMedia", "query", input),
 		getTrackMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getTrackMedia", "query", input),
 		listTrackMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listTrackMedia", "query", input),
@@ -4183,4 +5487,4 @@ function sleepCancellable(ms, signal) {
 	});
 }
 //#endregion
-export { CamProfileSchema as $, DEVICE_STATUS_METHOD as A, isEvent as At, nodePin as B, isAudioChunkFormat as Bt, customAction as C, DisposerChain as Ct, adminUiCapability as D, createDurableState as Dt, deviceCustomAction as E, normalizeNodeId as Et, method as F, hydrateSchema as Ft, emitDownForOwnedCaps as G, toNodeId as H, optionalMethod as I, resolveHydratedFieldValue as It, AudioChunkFormatSchema as J, readinessKey as K, resolveCapMount as L, AUDIO_CHUNK_FORMATS as Lt, event as M, WELL_KNOWN_TAB_MAP as Mt, expandCapMethods as N, collectHydratedFieldEntries as Nt, DEFAULT_RUNTIME_STATE_DURABILITY as O, createEvent as Ot, isDeviceConfigCap as P, collectHydratedFieldValues as Pt, CAM_PROFILE_ORDER as Q, systemMethod as R, audioChunkBytesPerSample as Rt, DEVICE_CHILDREN_BATCH_MAX as S, SHARE_VIEW_KINDS as St, describeCustomActions as T, normalizeAddonInitResult as Tt, ReadinessRegistry as U, readNodePin as V, ReadinessTimeoutError as W, BrokerStatsSchema as X, AudioStreamPickSchema as Y, BrokerStatusSchema as Z, createMirrorSource as _, PEER_BYTES_MAX_OUTSTANDING as _t, asJsonObject as a, ProfileRtspEntrySchema as at, deviceOpsCapability as b, PeerBytesTicketSchema as bt, parseJsonArray as c, StreamSourceEntrySchema$1 as ct, BOOT_RECOVERY_BACKOFF_MS as d, SubscribeAudioChunksResultSchema as dt, CamStreamKindSchema as et, DEVICE_SCOPED_CAPS as f, makeProfileBrokerId as ft, createLazyTrpcSource as g, PEER_BYTES_CHUNK_BYTES as gt, createEventBusSliceSource as h, selectAssignedProfileSlots as ht, asJsonArray as i, FrameHandleSchema as it, PROVIDER_PIN_FIELD as j, WELL_KNOWN_TABS as jt, DEVICE_SETTINGS_CONTRIBUTION_METHODS as k, emitReadiness as kt, parseJsonObject as l, StreamSourceSchema as lt, createDeviceProxy as m, parseProfileBrokerId as mt, sleepCancellable as n, CameraStreamSchema as nt, asNumber as o, ProfileSlotSchema as ot, isDeviceScopedCap as p, makeSourceBrokerId as pt, scopeKey as q, asBoolean as r, DecodedAudioChunkSchema as rt, asString as s, ProfileSlotStatusSchema as st, sleep as t, CamStreamResolutionSchema as tt, parseJsonUnknown as u, SubscribeAudioChunksInputSchema as ut, createSliceHandle as v, PEER_BYTES_STALL_MS as vt, defineCustomActions as w, BaseAddon as wt, viewerUiCapability as x, DATAPLANE_SECRET_HEADER as xt, RawStateResultSchema as y, PEER_BYTES_TICKET_TTL_MS as yt, CAP_NODE_PIN_CONTEXT_KEY as z, expandAudioChunkToF32le as zt };
+export { BrokerStatsSchema as $, normalizeSecretOwner as $t, adminUiCapability as A, PEER_BYTES_MAX_OUTSTANDING as At, resolveCapMount as B, parseSecretStatePath as Bt, deviceOpsCapability as C, isKeychainStoredField as Cn, clearKnownSecrets as Ct, defineCustomActions as D, audioChunkBytesPerSample as Dn, scrubKnownSecrets as Dt, customAction as E, AUDIO_CHUNK_FORMATS as En, registerKnownSecret as Et, event as F, SHARE_VIEW_KINDS as Ft, toNodeId as G, resolveSecretMarkers as Gt, CAP_NODE_PIN_CONTEXT_KEY as H, secretTreeFromSchema as Ht, expandCapMethods as I, DisposerChain as It, emitDownForOwnedCaps as J, arrayItemFieldPath as Jt, ReadinessRegistry as K, transformSecretWrite as Kt, isDeviceConfigCap as L, BaseAddon as Lt, DEVICE_SETTINGS_CONTRIBUTION_METHODS as M, PEER_BYTES_TICKET_TTL_MS as Mt, DEVICE_STATUS_METHOD as N, PeerBytesTicketSchema as Nt, describeCustomActions as O, expandAudioChunkToF32le as On, shortSecretRefHash as Ot, PROVIDER_PIN_FIELD as P, DATAPLANE_SECRET_HEADER as Pt, AudioStreamPickSchema as Q, isSecretRef as Qt, method as R, normalizeAddonInitResult as Rt, RawStateResultSchema as S, collectSecretConfigKeys as Sn, MIN_SCRUBBED_LENGTH as St, DEVICE_CHILDREN_BATCH_MAX as T, schemaDeclaresAnyField as Tn, knownSecretCount as Tt, nodePin as U, KeychainWriteRefusedError as Ut, systemMethod as V, secretTreeFromPaths as Vt, readNodePin as W, collectSecretMarkerRefs as Wt, scopeKey as X, formatSecretScope as Xt, readinessKey as Y, buildSecretRef as Yt, AudioChunkFormatSchema as Z, globalSecretScope as Zt, createMirrorSource as _, isSecretMarkerLike as _n, parseProfileBrokerId as _t, asJsonObject as a, isEvent as an, CameraStreamSchema as at, collectZodSecretPaths as b, REDACTED_SECRET as bn, REVALIDATE_AFTER_MS as bt, parseJsonArray as c, collectHydratedFieldEntries as cn, ProfileRtspEntrySchema as ct, BOOT_RECOVERY_BACKOFF_MS as d, resolveHydratedFieldValue as dn, StreamSourceEntrySchema$1 as dt, parseSecretRef as en, BrokerStatusSchema as et, DEVICE_SCOPED_CAPS as f, SECRET_CLEAR as fn, StreamSourceSchema as ft, createLazyTrpcSource as g, isSecretMarker as gn, makeSourceBrokerId as gt, createEventBusSliceSource as h, isSecretFieldView as hn, makeProfileBrokerId as ht, asJsonArray as i, emitReadiness as in, CamStreamResolutionSchema as it, DEFAULT_RUNTIME_STATE_DURABILITY as j, PEER_BYTES_STALL_MS as jt, deviceCustomAction as k, isAudioChunkFormat as kn, PEER_BYTES_CHUNK_BYTES as kt, parseJsonObject as l, collectHydratedFieldValues as ln, ProfileSlotSchema as lt, createDeviceProxy as m, isSecretClear as mn, SubscribeAudioChunksResultSchema as mt, sleepCancellable as n, createDurableState as nn, CamProfileSchema as nt, asNumber as o, WELL_KNOWN_TABS as on, DecodedAudioChunkSchema as ot, isDeviceScopedCap as p, classifySecretWrite as pn, SubscribeAudioChunksInputSchema as pt, ReadinessTimeoutError as q, SECRET_REF_SCHEME as qt, asBoolean as r, createEvent as rn, CamStreamKindSchema as rt, asString as s, WELL_KNOWN_TAB_MAP as sn, FrameHandleSchema as st, sleep as t, normalizeNodeId as tn, CAM_PROFILE_ORDER as tt, parseJsonUnknown as u, hydrateSchema as un, ProfileSlotStatusSchema as ut, createSliceHandle as v, makeSecretMarker as vn, selectAssignedProfileSlots as vt, viewerUiCapability as w, isSecretConfigField as wn, forgetKnownSecret as wt, isZodSecret as x, collectKeychainStoredKeys as xn, createSecretsAccess as xt, SECRET_META as y, toSecretFieldView as yn, resolveSecretViewsIn as yt, optionalMethod as z, mergeSecretStatePaths as zt };