@camstack/types 1.2.327 → 1.2.329

package/dist/{sleep-az1qiFzK.js → sleep-ClNXPpWR.js}

@@ -1,4 +1,4 @@
-const require_event_category = require("./event-category-CtBAl88K.js");
+const require_event_category = require("./event-category-CHduMGvg.js");
 let zod = require("zod");
 //#region src/audio/audio-chunk-format.ts
 /**
@@ -116,6 +116,192 @@ function buildAlawTable() {
 var ULAW_TABLE = buildUlawTable();
 var ALAW_TABLE = buildAlawTable();
 //#endregion
+//#region src/interfaces/config-ui-secrets.ts
+/**
+* The value a redacted secret is replaced with on every read surface.
+*
+* It is also the WRITE-BACK token: an `upsertLocation` that sends this value
+* back for a key means "keep what is stored", which is what lets an operator
+* rename a location without retyping its password. A literal an operator could
+* plausibly choose as a real password would turn that convenience into a way
+* to lock yourself out, hence the sentinel shape.
+*/
+var REDACTED_SECRET = "__camstack_redacted__";
+/** Is this field's stored value a credential? */
+function isSecretConfigField(field) {
+	if (field.type === "password") return true;
+	return "secret" in field && field.secret === true;
+}
+/**
+* Is this field's value stored in the KEYCHAIN (D787)? Every secret field is,
+* by its TYPE, unless it opts out with `storage: 'inline'` — never by its name.
+*/
+function isKeychainStoredField(field) {
+	if (!isSecretConfigField(field)) return false;
+	if (field.type === "textarea" && field.isJson === true) return false;
+	return !("storage" in field && field.storage === "inline");
+}
+/**
+* Every config key in `schema` whose value is a secret, including keys nested
+* inside `group` / `sub-tabs` containers.
+*/
+function collectSecretConfigKeys(schema) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
+	return keys;
+}
+/**
+* Every top-level config key whose value the KEYCHAIN stores (D787) —
+* {@link collectSecretConfigKeys} minus `storage: 'inline'` and minus JSON
+* blobs (see {@link isKeychainStoredField}). What a form sends as
+* `secretKeys` so the owner's door knows which values to keep out of the blob.
+*/
+function collectKeychainStoredKeys(schema) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkKeychainField(field, keys);
+	return keys;
+}
+function walkKeychainField(field, out) {
+	if (!isRecord$2(field)) return;
+	const type = field["type"];
+	const key = field["key"];
+	const isSecret = type === "password" || field["secret"] === true;
+	const isJsonBlob = type === "textarea" && field["isJson"] === true;
+	if (isSecret && !isJsonBlob && field["storage"] !== "inline" && typeof key === "string" && key.length > 0) out.add(key);
+	if (type === "group") {
+		for (const child of fieldsOf(field)) walkKeychainField(child, out);
+		return;
+	}
+	if (type === "sub-tabs") {
+		const tabs = field["tabs"];
+		if (!Array.isArray(tabs)) return;
+		for (const tab of tabs) for (const child of fieldsOf(tab)) walkKeychainField(child, out);
+	}
+}
+/**
+* True when the value is a readable schema declaring at least one field of any
+* kind. Lets a caller tell "this provider has no secrets" from "this provider's
+* schema could not be read", which are the same empty set otherwise.
+*/
+function schemaDeclaresAnyField(schema) {
+	for (const section of sectionsOf(schema)) if (fieldsOf(section).length > 0) return true;
+	return false;
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sectionsOf(schema) {
+	if (!isRecord$2(schema)) return [];
+	const sections = schema["sections"];
+	return Array.isArray(sections) ? sections : [];
+}
+function fieldsOf(node) {
+	if (!isRecord$2(node)) return [];
+	const fields = node["fields"];
+	return Array.isArray(fields) ? fields : [];
+}
+function walkField(field, out) {
+	if (!isRecord$2(field)) return;
+	const type = field["type"];
+	const key = field["key"];
+	if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
+	if (type === "group") {
+		for (const child of fieldsOf(field)) walkField(child, out);
+		return;
+	}
+	if (type === "sub-tabs") {
+		const tabs = field["tabs"];
+		if (!Array.isArray(tabs)) return;
+		for (const tab of tabs) for (const child of fieldsOf(tab)) walkField(child, out);
+	}
+}
+//#endregion
+//#region src/keychain/secret-marker.ts
+/**
+* What a settings blob holds where a secret used to be.
+*
+* A keychain-stored field never holds its value. It holds a self-describing
+* MARKER, `{"$secret":"secret://…","v":1}` — an object, never a string, so no
+* code can mistake it for a credential and no form can send it to a camera as
+* a password. The empty state is `null` / absent, never `''`.
+*
+* The same shapes travel to and from the admin UI:
+*
+*  - read: `hydrateSchema` hands a secret field a {@link SecretFieldView}
+*    (`{ $secret, v, set: true }`) or `null` — the browser learns whether a
+*    value is set, never the value.
+*  - write: an untouched field submits the view back unchanged (KEEP); a typed
+*    value is a plain non-empty string (CHANGE); the Clear button submits
+*    {@link SECRET_CLEAR} (CLEAR). `''`, `null` and the legacy redaction tokens
+*    are KEEP — an empty string is what a defaults-fallback pushes back, and
+*    treating it as "clear" is how a save destroyed a stored credential before.
+*
+* Pure and browser-safe.
+*/
+var SECRET_CLEAR = { $secretClear: true };
+/** The `'***'` token D634 redaction writes for non-admins. */
+var LEGACY_DEVICE_REDACTION = "***";
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function makeSecretMarker(ref) {
+	return {
+		$secret: ref,
+		v: 1
+	};
+}
+/** A stored marker: an object whose `$secret` is a non-empty string. */
+function isSecretMarker(value) {
+	if (!isRecord$1(value)) return false;
+	const ref = value["$secret"];
+	return typeof ref === "string" && ref.length > 0;
+}
+/** Anything carrying a `$secret` key — a stored marker or a UI view of one. */
+function isSecretMarkerLike(value) {
+	return isRecord$1(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
+}
+function isSecretClear(value) {
+	return isRecord$1(value) && value["$secretClear"] === true;
+}
+function isSecretFieldView(value) {
+	return isRecord$1(value) && value["set"] === true && isSecretMarkerLike(value);
+}
+/**
+* The UI view of a stored secret field value: a marker becomes "set", inline
+* plaintext becomes "set (inline)", nothing becomes `null`. A value never
+* survives this function.
+*/
+function toSecretFieldView(stored) {
+	if (isSecretMarker(stored)) return {
+		$secret: stored.$secret,
+		v: 1,
+		set: true
+	};
+	if (typeof stored === "string" && stored.length > 0) return {
+		$secret: null,
+		v: 1,
+		set: true,
+		inline: true
+	};
+	return null;
+}
+/**
+* Classify an incoming value for a secret path. Only a non-empty string that is
+* not a redaction token sets a value; only {@link SECRET_CLEAR} clears.
+* Everything else — a marker (ours or anyone's), a UI view, `''`, `null`,
+* `undefined`, a redaction token, a non-string — keeps what is stored.
+*/
+function classifySecretWrite(incoming) {
+	if (isSecretClear(incoming)) return { kind: "clear" };
+	if (typeof incoming !== "string") return { kind: "keep" };
+	if (incoming.length === 0) return { kind: "keep" };
+	if (incoming === "__camstack_redacted__" || incoming === LEGACY_DEVICE_REDACTION) return { kind: "keep" };
+	return {
+		kind: "set",
+		value: incoming
+	};
+}
+//#endregion
 //#region src/interfaces/config-ui.ts
 /** Predefined tabs with standard label, icon, and sort order.
 *
@@ -358,33 +544,19 @@ function resolveHydratedFieldValue(schema, key) {
 	const entry = collectHydratedFieldEntries(schema).get(key);
 	return entry === void 0 ? void 0 : entry.value ?? entry.default;
 }
-/**
-* Merge a `ConfigUISchema` with a raw `values` record into a
-* `ConfigUISchemaWithValues`. Used by every `get*Settings` backend endpoint
-* before returning to the admin UI. Groups are walked recursively.
-*
-* For each leaf field:
-*   - structural fields (`separator`, `info`, `button`) pass through unchanged
-*   - other fields get `value = values[key] ?? field.default ?? null`
-*
-* Unknown keys in `values` (keys not declared in the schema) are silently
-* ignored — they don't contribute to the output. Missing keys fall back to
-* the schema default or `null`. This mirrors the old backend behaviour where
-* `FormBuilder` rendered `values[key] ?? field.default`.
-*/
-function hydrateSchema(schema, values) {
+function hydrateSchema(schema, values, options = {}) {
 	return {
 		...schema.tabs ? { tabs: [...schema.tabs] } : {},
 		sections: schema.sections.map((section) => ({
 			...section,
-			fields: section.fields.map((field) => hydrateField(field, values))
+			fields: section.fields.map((field) => hydrateField(field, values, options))
 		}))
 	};
 }
-function hydrateField(field, values) {
+function hydrateField(field, values, options) {
 	if (isValuelessField(field)) return field;
 	if (field.type === "group") {
-		const hydratedChildren = field.fields.map((child) => hydrateField(child, values));
+		const hydratedChildren = field.fields.map((child) => hydrateField(child, values, options));
 		return {
 			...field,
 			fields: hydratedChildren
@@ -393,7 +565,7 @@ function hydrateField(field, values) {
 	if (field.type === "sub-tabs") {
 		const hydratedTabs = field.tabs.map((tab) => ({
 			...tab,
-			fields: tab.fields.map((child) => hydrateField(child, values))
+			fields: tab.fields.map((child) => hydrateField(child, values, options))
 		}));
 		return {
 			...field,
@@ -403,6 +575,33 @@ function hydrateField(field, values) {
 	const key = field.key;
 	const storedValue = Object.prototype.hasOwnProperty.call(values, key) ? values[key] : void 0;
 	const defaultValue = field.default;
+	const asView = (v) => isSecretMarker(v) || options.inlineSecretsAsViews === true && v !== void 0;
+	if (isKeychainStoredField(field) && asView(storedValue)) return {
+		...field,
+		value: toSecretFieldView(storedValue)
+	};
+	if (isKeychainStoredField(field) && options.inlineSecretsAsViews === true) return {
+		...field,
+		value: null
+	};
+	if (field.type === "editable-array" && Array.isArray(storedValue)) {
+		const secretItemKeys = field.itemFields.filter((item) => "key" in item && isKeychainStoredField(item)).map((item) => "key" in item ? item.key : "");
+		if (secretItemKeys.length > 0) {
+			const rows = storedValue.map((row) => {
+				if (row === null || typeof row !== "object" || Array.isArray(row)) return row;
+				const out = { ...row };
+				for (const k of secretItemKeys) {
+					const v = Reflect.get(row, k);
+					if (asView(v)) out[k] = toSecretFieldView(v);
+				}
+				return out;
+			});
+			return {
+				...field,
+				value: rows
+			};
+		}
+	}
 	if (field.multiple) {
 		const stored = Array.isArray(storedValue) ? storedValue : storedValue !== void 0 && storedValue !== null ? [storedValue] : [];
 		const itemFallback = field.multiple.itemDefault !== void 0 ? field.multiple.itemDefault : defaultValue !== void 0 ? defaultValue : typeOf(field) === "string" ? "" : null;
@@ -668,7 +867,575 @@ function projectStore(store, perNodeKeys, nodeId) {
 	return out;
 }
 //#endregion
+//#region src/keychain/secret-ref.ts
+/**
+* The address of one keychain value: `secret://<owner>/<scope>/<fieldPath>`.
+*
+* A ref is DETERMINISTIC from where the value lives — the owner addon, the
+* scope (global, one node, one device, one integration, one row of a business
+* collection) and the field path inside that scope — so saving the same field
+* twice updates the same ref, and the ref itself says which settings blob
+* points at it. It is also the AAD of the value's ciphertext: a ciphertext
+* copied onto another ref does not decrypt.
+*
+* Array items are addressed by ITEM ID, never by index
+* (`providers[authentik].clientSecret`), so reordering a list keeps every ref.
+*
+* Pure and browser-safe: no node builtins, no I/O.
+*/
+/** The URI scheme of every keychain ref. */
+var SECRET_REF_SCHEME = "secret://";
+var GLOBAL_SCOPE = { kind: "global" };
+/** The scope every addon-wide (not per-node, not per-device) setting lives in. */
+function globalSecretScope() {
+	return GLOBAL_SCOPE;
+}
+/**
+* An addon id as a ref owner. A hub in-process builtin's context id is
+* `addon:<id>`; the owner of its secrets is `<id>`, exactly as for the same
+* addon running forked.
+*/
+function normalizeSecretOwner(addonId) {
+	return addonId.startsWith("addon:") ? addonId.slice(6) : addonId;
+}
+function encodeSegment(value) {
+	return encodeURIComponent(value);
+}
+function decodeSegment(value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return null;
+	}
+}
+/** The scope as it appears inside a ref (`global`, `node/<id>`, …). */
+function formatSecretScope(scope) {
+	switch (scope.kind) {
+		case "global": return "global";
+		case "node": return `node/${encodeSegment(scope.nodeId)}`;
+		case "device": return `device/${scope.deviceId}`;
+		case "integration": return `integration/${encodeSegment(scope.integrationId)}`;
+		case "row": return `row/${encodeSegment(scope.collection)}/${encodeSegment(scope.rowId)}`;
+	}
+}
+/**
+* The field path of a value inside an array item, addressed by the item's id:
+* `arrayItemFieldPath('providers', 'authentik', 'clientSecret')` →
+* `providers[authentik].clientSecret`.
+*/
+function arrayItemFieldPath(arrayKey, itemId, fieldKey) {
+	return `${arrayKey}[${encodeSegment(itemId)}].${fieldKey}`;
+}
+/** Build a ref. Throws on an empty owner or field path — both are bugs. */
+function buildSecretRef(parts) {
+	const owner = normalizeSecretOwner(parts.owner);
+	if (owner.length === 0) throw new Error("buildSecretRef: owner is empty");
+	if (parts.fieldPath.length === 0) throw new Error("buildSecretRef: fieldPath is empty");
+	return `${SECRET_REF_SCHEME}${encodeSegment(owner)}/${formatSecretScope(parts.scope)}/${parts.fieldPath}`;
+}
+/** True when `value` is shaped like a keychain ref (not that it exists). */
+function isSecretRef(value) {
+	return typeof value === "string" && parseSecretRef(value) !== null;
+}
+function parseScope(segments) {
+	switch (segments[0]) {
+		case "global": return {
+			scope: GLOBAL_SCOPE,
+			used: 1
+		};
+		case "node": {
+			const nodeId = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			return nodeId === null || nodeId.length === 0 ? null : {
+				scope: {
+					kind: "node",
+					nodeId
+				},
+				used: 2
+			};
+		}
+		case "device": {
+			const raw = segments[1];
+			if (raw === void 0 || !/^\d+$/.test(raw)) return null;
+			return {
+				scope: {
+					kind: "device",
+					deviceId: Number(raw)
+				},
+				used: 2
+			};
+		}
+		case "integration": {
+			const id = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			return id === null || id.length === 0 ? null : {
+				scope: {
+					kind: "integration",
+					integrationId: id
+				},
+				used: 2
+			};
+		}
+		case "row": {
+			const collection = segments[1] !== void 0 ? decodeSegment(segments[1]) : null;
+			const rowId = segments[2] !== void 0 ? decodeSegment(segments[2]) : null;
+			if (collection === null || rowId === null || collection.length === 0 || rowId.length === 0) return null;
+			return {
+				scope: {
+					kind: "row",
+					collection,
+					rowId
+				},
+				used: 3
+			};
+		}
+		default: return null;
+	}
+}
+/** Take a ref apart; `null` when it is not a well-formed ref. */
+function parseSecretRef(ref) {
+	if (!ref.startsWith("secret://")) return null;
+	const segments = ref.slice(9).split("/");
+	const owner = segments[0] !== void 0 ? decodeSegment(segments[0]) : null;
+	if (owner === null || owner.length === 0) return null;
+	const parsed = parseScope(segments.slice(1));
+	if (parsed === null) return null;
+	const fieldPath = segments.slice(1 + parsed.used).join("/");
+	if (fieldPath.length === 0) return null;
+	return {
+		owner,
+		scope: parsed.scope,
+		fieldPath
+	};
+}
+//#endregion
+//#region src/addon/secret-settings-view.ts
+/** A write to a secret path could not be stored in the keychain, so it was refused. */
+var KeychainWriteRefusedError = class extends Error {
+	fieldPath;
+	constructor(fieldPath, cause) {
+		super(`secret "${fieldPath}" was not saved: the keychain could not store it (${cause instanceof Error ? cause.message : String(cause)}). Nothing was written.`);
+		this.fieldPath = fieldPath;
+		this.name = "KeychainWriteRefusedError";
+	}
+};
+var KEEP = { kind: "keep" };
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function defaultMintId() {
+	return globalThis.crypto.randomUUID();
+}
+/** Every marker ref anywhere under `value`. */
+function collectSecretMarkerRefs(value, out = []) {
+	if (isSecretMarker(value)) {
+		out.push(value.$secret);
+		return out;
+	}
+	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
+	else if (isRecord(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	return out;
+}
+async function storedValueEquals(secrets, marker, candidate) {
+	const resolved = (await secrets.resolve([marker.$secret]))[marker.$secret];
+	return resolved?.kind === "value" && resolved.value === candidate;
+}
+async function writeLeaf(ctx, incoming, stored, fieldPath) {
+	const intent = classifySecretWrite(incoming);
+	const ref = ctx.secrets.ref(ctx.scope, fieldPath);
+	const storedIsOurs = isSecretMarker(stored) && stored.$secret === ref;
+	if (intent.kind === "keep") return KEEP;
+	if (intent.kind === "set" && !ctx.operatorWrite && typeof stored === "string" && stored === intent.value) return KEEP;
+	if (intent.kind === "clear") {
+		if (storedIsOurs) ctx.deletes.push(ref);
+		return {
+			kind: "value",
+			value: null
+		};
+	}
+	if (storedIsOurs && await storedValueEquals(ctx.secrets, stored, intent.value)) return {
+		kind: "value",
+		value: stored
+	};
+	try {
+		await ctx.secrets.put(ref, intent.value);
+	} catch (err) {
+		throw new KeychainWriteRefusedError(fieldPath, err);
+	}
+	return {
+		kind: "value",
+		value: makeSecretMarker(ref)
+	};
+}
+/** Apply a member result onto `out`: KEEP restores the stored member, or removes it. */
+function applyMember(out, key, result, storedParent) {
+	if (result.kind === "value") {
+		out[key] = result.value;
+		return;
+	}
+	if (Object.prototype.hasOwnProperty.call(storedParent, key)) out[key] = storedParent[key];
+	else delete out[key];
+}
+async function writeMembers(ctx, children, incoming, stored, pathOf) {
+	const out = { ...incoming };
+	for (const [member, node] of children) applyMember(out, member, await writeNode(ctx, node, incoming[member], stored[member], pathOf(member)), stored);
+	return out;
+}
+function rowId(row, idKey) {
+	const raw = row[idKey];
+	if (typeof raw === "string" && raw.length > 0) return raw;
+	if (typeof raw === "number" && Number.isFinite(raw)) return String(raw);
+	return null;
+}
+async function writeArray(ctx, node, incoming, stored, fieldPath) {
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord) : [];
+	if (!Array.isArray(incoming)) {
+		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
+		return {
+			kind: "value",
+			value: incoming
+		};
+	}
+	const storedById = /* @__PURE__ */ new Map();
+	for (const row of storedRows) {
+		const id = rowId(row, node.idKey);
+		if (id !== null) storedById.set(id, row);
+	}
+	const kept = /* @__PURE__ */ new Set();
+	const rows = [];
+	for (const row of incoming) {
+		if (!isRecord(row)) {
+			rows.push(row);
+			continue;
+		}
+		const id = rowId(row, node.idKey) ?? ctx.mintId();
+		kept.add(id);
+		const withId = {
+			...row,
+			[node.idKey]: row[node.idKey] ?? id
+		};
+		if (rowId(withId, node.idKey) === null) withId[node.idKey] = id;
+		const storedRow = storedById.get(id) ?? {};
+		rows.push(await writeMembers(ctx, node.item, withId, storedRow, (member) => arrayItemFieldPath(fieldPath, id, member)));
+	}
+	for (const [id, row] of storedById) if (!kept.has(id)) ctx.deletes.push(...collectSecretMarkerRefs(row));
+	return {
+		kind: "value",
+		value: rows
+	};
+}
+async function writeNode(ctx, node, incoming, stored, fieldPath) {
+	switch (node.kind) {
+		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
+		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
+		case "object": {
+			if (!isRecord(incoming)) {
+				if (incoming === void 0) return KEEP;
+				ctx.deletes.push(...collectSecretMarkerRefs(stored));
+				return {
+					kind: "value",
+					value: incoming
+				};
+			}
+			const storedObj = isRecord(stored) ? stored : {};
+			return {
+				kind: "value",
+				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
+			};
+		}
+	}
+}
+/** Split a perNode-scoped key (`key@nodeId`). */
+function splitNodeKey(key) {
+	const at = key.indexOf("@");
+	return at <= 0 ? {
+		base: key,
+		nodeId: null
+	} : {
+		base: key.slice(0, at),
+		nodeId: key.slice(at + 1)
+	};
+}
+/** Rewrite a settings patch so no secret value reaches the blob. See the file doc. */
+async function transformSecretWrite(input) {
+	const deletes = [];
+	const base = {
+		secrets: input.secrets,
+		mintId: input.mintId ?? defaultMintId,
+		deletes,
+		operatorWrite: input.operatorWrite === true
+	};
+	const out = {};
+	for (const [key, incoming] of Object.entries(input.patch)) {
+		const { base: baseKey, nodeId } = splitNodeKey(key);
+		const node = input.tree.get(baseKey);
+		if (node === void 0) {
+			out[key] = incoming;
+			continue;
+		}
+		const scope = nodeId !== null && nodeId.length > 0 ? {
+			kind: "node",
+			nodeId
+		} : input.scope ?? globalSecretScope();
+		const result = await writeNode({
+			...base,
+			scope
+		}, node, incoming, input.stored[key], baseKey);
+		if (result.kind === "value") out[key] = result.value;
+	}
+	return {
+		patch: out,
+		afterWrite: async () => {
+			if (deletes.length === 0) return { orphaned: [] };
+			try {
+				await input.secrets.delete([...new Set(deletes)]);
+				return { orphaned: [] };
+			} catch {
+				return { orphaned: [...new Set(deletes)] };
+			}
+		}
+	};
+}
+/**
+* Replace every marker in `value` with its keychain value. Returns the SAME
+* reference when there is no marker (no allocation, no keychain call).
+*/
+async function resolveSecretMarkers(value, secrets) {
+	const refs = collectSecretMarkerRefs(value);
+	if (refs.length === 0) return {
+		value,
+		unresolved: []
+	};
+	const answers = await secrets.resolve(refs);
+	const unresolved = [];
+	for (const ref of new Set(refs)) {
+		const answer = answers[ref];
+		if (answer === void 0) unresolved.push({
+			ref,
+			reason: "not-initialized"
+		});
+		else if (answer.kind === "unavailable") unresolved.push({
+			ref,
+			reason: answer.reason
+		});
+		else if (answer.kind === "missing" || answer.kind === "forbidden") unresolved.push({
+			ref,
+			reason: answer.kind
+		});
+	}
+	const substitute = (v) => {
+		if (isSecretMarker(v)) {
+			const answer = answers[v.$secret];
+			return answer?.kind === "value" ? {
+				keep: true,
+				value: answer.value
+			} : {
+				keep: false,
+				value: void 0
+			};
+		}
+		if (Array.isArray(v)) {
+			const items = [];
+			for (const item of v) {
+				const s = substitute(item);
+				if (s.keep) items.push(s.value);
+			}
+			return {
+				keep: true,
+				value: items
+			};
+		}
+		if (isRecord(v)) {
+			const out = {};
+			for (const [k, child] of Object.entries(v)) {
+				const s = substitute(child);
+				if (s.keep) out[k] = s.value;
+			}
+			return {
+				keep: true,
+				value: out
+			};
+		}
+		return {
+			keep: true,
+			value: v
+		};
+	};
+	return {
+		value: substitute(value).value,
+		unresolved
+	};
+}
+//#endregion
+//#region src/addon/secret-aware-context.ts
+function touchesTree(tree, patch) {
+	if (tree.size === 0) return false;
+	for (const key of Object.keys(patch)) {
+		const at = key.indexOf("@");
+		if (tree.has(at > 0 ? key.slice(0, at) : key)) return true;
+	}
+	return false;
+}
+/** The blob as stored now; a failed read REFUSES the write instead of guessing. */
+async function readStoredAddonBlob(raw) {
+	const threeWay = raw.readAddonStoreResult;
+	if (threeWay === void 0) return raw.readAddonStore();
+	const result = await threeWay.call(raw);
+	if (result.kind === "failed") throw new Error(`settings write refused: the stored blob could not be read (${result.error})`);
+	return result.kind === "missing" ? {} : result.value;
+}
+function createSecretAwareSettings(raw, opts) {
+	const chains = /* @__PURE__ */ new Map();
+	const serialize = (key, fn) => {
+		const next = (chains.get(key) ?? Promise.resolve()).then(fn, fn);
+		const tail = next.catch(() => void 0);
+		chains.set(key, tail);
+		tail.then(() => {
+			if (chains.get(key) === tail) chains.delete(key);
+		});
+		return next;
+	};
+	const write = async (chainKey, tree, scope, patch, readStored, rawWrite) => {
+		if (!touchesTree(tree, patch)) return rawWrite(patch);
+		return serialize(chainKey, async () => {
+			const stored = await readStored();
+			const result = await transformSecretWrite({
+				tree,
+				secrets: opts.secrets,
+				patch,
+				stored,
+				...scope !== void 0 ? { scope } : {},
+				operatorWrite: opts.isOperatorWrite?.() === true
+			});
+			if (Object.keys(result.patch).length > 0) await rawWrite(result.patch);
+			const { orphaned } = await result.afterWrite();
+			if (orphaned.length > 0) opts.onOrphaned(orphaned);
+		});
+	};
+	const wrapped = {
+		writeAddonStore: (patch) => write("addon", opts.addonTree(), void 0, patch, () => readStoredAddonBlob(raw), (p) => raw.writeAddonStore(p)),
+		writeDeviceStore: (deviceId, patch) => write(`device:${deviceId}`, opts.deviceTree(), {
+			kind: "device",
+			deviceId
+		}, patch, () => raw.readDeviceStore(deviceId), (p) => raw.writeDeviceStore(deviceId, p))
+	};
+	return new Proxy(raw, { get(target, prop, receiver) {
+		if (prop === "writeAddonStore") return wrapped.writeAddonStore;
+		if (prop === "writeDeviceStore") return wrapped.writeDeviceStore;
+		const value = Reflect.get(target, prop, receiver);
+		return typeof value === "function" ? value.bind(target) : value;
+	} });
+}
+/** The context the addon sees: identical, except that its settings writes are secret-aware. */
+function withSecretAwareSettings(context, opts) {
+	const raw = context.settings;
+	if (raw === void 0) return context;
+	const settings = createSecretAwareSettings(raw, opts);
+	return new Proxy(context, { get(target, prop, receiver) {
+		if (prop === "settings") return settings;
+		return Reflect.get(target, prop, receiver);
+	} });
+}
+//#endregion
+//#region src/addon/secret-paths.ts
+var LEAF = { kind: "leaf" };
+var DEFAULT_ITEM_ID_KEY = "id";
+function collectFields(fields, out) {
+	for (const field of fields) {
+		if (field.type === "group") {
+			collectFields(field.fields, out);
+			continue;
+		}
+		if (field.type === "sub-tabs") {
+			for (const tab of field.tabs) collectFields(tab.fields, out);
+			continue;
+		}
+		if (field.type === "editable-array") {
+			const item = /* @__PURE__ */ new Map();
+			for (const itemField of field.itemFields) if ("key" in itemField && isKeychainStoredField(itemField)) item.set(itemField.key, LEAF);
+			if (item.size > 0) out.set(field.key, {
+				kind: "array",
+				idKey: field.itemIdKey ?? DEFAULT_ITEM_ID_KEY,
+				item
+			});
+			continue;
+		}
+		if (!("key" in field) || typeof field.key !== "string") continue;
+		if (isKeychainStoredField(field)) out.set(field.key, LEAF);
+	}
+}
+/** The secret tree a settings schema declares. */
+function secretTreeFromSchema(schema) {
+	const out = /* @__PURE__ */ new Map();
+	if (schema === null) return out;
+	for (const section of schema.sections) collectFields(section.fields, out);
+	return out;
+}
+/** Parse `a.b[id].c` into segments; throws on a malformed path (a declaration bug). */
+function parseSecretStatePath(path) {
+	const segments = [];
+	for (const raw of path.split(".")) {
+		const m = /^([^[\]]+)(?:\[([^[\]]+)\])?$/.exec(raw);
+		if (m === null || m[1] === void 0) throw new Error(`secretStatePaths: malformed path "${path}"`);
+		segments.push(m[2] !== void 0 ? {
+			key: m[1],
+			idKey: m[2]
+		} : { key: m[1] });
+	}
+	if (segments.length === 0) throw new Error(`secretStatePaths: empty path`);
+	if (segments[segments.length - 1]?.idKey !== void 0) throw new Error(`secretStatePaths: "${path}" ends on an array — name the member that is secret`);
+	return segments;
+}
+function insert(into, segments) {
+	const [head, ...rest] = segments;
+	if (head === void 0) return;
+	if (rest.length === 0) {
+		into.set(head.key, LEAF);
+		return;
+	}
+	const existing = into.get(head.key);
+	if (head.idKey !== void 0) {
+		const item = new Map(existing?.kind === "array" ? existing.item : []);
+		insert(item, rest);
+		into.set(head.key, {
+			kind: "array",
+			idKey: head.idKey,
+			item
+		});
+		return;
+	}
+	const children = new Map(existing?.kind === "object" ? existing.children : []);
+	insert(children, rest);
+	into.set(head.key, {
+		kind: "object",
+		children
+	});
+}
+/** Add hidden-state paths (`secretStatePaths`) to a schema-derived tree. */
+function mergeSecretStatePaths(tree, paths) {
+	if (paths.length === 0) return tree;
+	const out = new Map(tree);
+	for (const path of paths) insert(out, parseSecretStatePath(path));
+	return out;
+}
+/**
+* The tree of a DECLARED path list — a device's `secretConfigPaths`
+* (`collectZodSecretPaths`: dotted, `[]` for array items). An array segment
+* without a named id field is addressed by the item's `id`.
+*/
+function secretTreeFromPaths(paths) {
+	const out = /* @__PURE__ */ new Map();
+	for (const path of paths) {
+		if (path.length === 0) continue;
+		insert(out, parseSecretStatePath(path.replace(/\[\]/g, `[${DEFAULT_ITEM_ID_KEY}]`)));
+	}
+	return out;
+}
+//#endregion
 //#region src/addon/base-addon.ts
+/** First retry of a secret the keychain could not serve; doubles to {@link SECRET_RETRY_MAX_MS}. */
+var SECRET_RETRY_FIRST_MS = 5e3;
+var SECRET_RETRY_MAX_MS = 5 * 6e4;
+/** Coalesces a burst of `keychain.changed` events into one re-resolve. */
+var SECRET_CHANGE_DEBOUNCE_MS = 250;
 /**
 * Base class for CamStack addons. Eliminates settings boilerplate:
 *
@@ -738,6 +1505,25 @@ var BaseAddon = class {
 	settingsStoreReady = false;
 	/** Default config values. Provided via constructor. */
 	defaults;
+	/**
+	* Hidden-state paths that hold secrets (D787) — values the addon writes
+	* itself (`updateGlobalSettings`, `state()`) that no form field declares.
+	* Stored in the keychain exactly like a `password` field. Syntax:
+	* `'snapshotSigningKey'`, `'identity.pincode'`, `'tokens[userId].accessToken'`
+	* (`key[<id field>]` addresses array items by id, never by index).
+	*/
+	secretStatePaths = [];
+	_addonSecretTree = null;
+	_deviceSecretTree = null;
+	/** Refs the last resolved config pointed at — a change to one re-resolves. */
+	_configSecretRefs = /* @__PURE__ */ new Set();
+	_unresolvedSecrets = [];
+	_secretRetryTimer = null;
+	_secretRetryDelayMs = SECRET_RETRY_FIRST_MS;
+	_secretChangeTimer = null;
+	_secretChangeUnsub = null;
+	/** >0 while an OPERATOR's settings write is being applied. */
+	_operatorWriteDepth = 0;
 	constructor(defaults) {
 		this.defaults = defaults;
 		this._config = { ...defaults };
@@ -773,8 +1559,18 @@ var BaseAddon = class {
 		return this._config;
 	}
 	async initialize(context) {
-		this._ctx = context;
+		const secrets = context.secrets;
+		this._ctx = secrets !== void 0 ? withSecretAwareSettings(context, {
+			secrets,
+			addonTree: () => this.addonSecretTree(),
+			deviceTree: () => this.deviceSecretTree(),
+			onOrphaned: (refs) => context.logger.warn("keychain refs dropped by a settings write could not be deleted", { meta: { refs: [...refs] } }),
+			isOperatorWrite: () => this._operatorWriteDepth > 0
+		}) : context;
 		await this.resolveConfig();
+		if (secrets !== void 0) this._secretChangeUnsub = secrets.onChange((ref) => {
+			if (this._configSecretRefs.has(ref)) this.scheduleSecretReresolve(SECRET_CHANGE_DEBOUNCE_MS);
+		});
 		const result = await this.onInitialize();
 		this.emitLifecycle(require_event_category.EventCategory.AddonStarted);
 		const normalized = normalizeAddonInitResult(result);
@@ -807,6 +1603,12 @@ var BaseAddon = class {
 	*/
 	async onHubReachable() {}
 	async shutdown() {
+		this._secretChangeUnsub?.();
+		this._secretChangeUnsub = null;
+		if (this._secretRetryTimer !== null) clearTimeout(this._secretRetryTimer);
+		if (this._secretChangeTimer !== null) clearTimeout(this._secretChangeTimer);
+		this._secretRetryTimer = null;
+		this._secretChangeTimer = null;
 		this.emitLifecycle(require_event_category.EventCategory.AddonStopped);
 		if (this.autoEmitReadiness) this.emitReadinessForProviders("down");
 		await this.onShutdown();
@@ -885,7 +1687,7 @@ var BaseAddon = class {
 		return hydrateSchema(schema, overlay ? {
 			...projected,
 			...overlay
-		} : projected);
+		} : projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The integration-level view of this addon's settings: exactly the sections
@@ -934,7 +1736,7 @@ var BaseAddon = class {
 		return hydrateSchema({
 			...schema,
 			sections
-		}, projected);
+		}, projected, { inlineSecretsAsViews: true });
 	}
 	/**
 	* The raw addon store PROJECTED onto the target node's bare per-node keys:
@@ -988,18 +1790,50 @@ var BaseAddon = class {
 			value: result.value[key]
 		};
 	}
+	/**
+	* The OPERATOR's write — a settings form or an admin API call, dispatched by
+	* the kernel. Identical to {@link updateGlobalSettings}, except that a secret
+	* the operator sends is stored as sent even when it equals a pre-keychain
+	* inline value: the operator re-entering a password is a change, an addon
+	* writing back what it read is not (D787).
+	*/
+	async updateGlobalSettingsAsOperator(patch, nodeId) {
+		this._operatorWriteDepth++;
+		try {
+			await this.applyGlobalPatch(patch, nodeId);
+		} finally {
+			this._operatorWriteDepth--;
+		}
+	}
 	async updateGlobalSettings(patch, nodeId) {
+		await this.applyGlobalPatch(patch, nodeId);
+	}
+	/**
+	* REMOVE stored secrets — their keychain values and their markers (D787).
+	*
+	* Writing `''` to a secret field KEEPS what is stored (an empty string is
+	* what a defaults fallback writes back, and it must never destroy a
+	* credential), so code that means "forget this token" says so here. Without
+	* a keychain (an older kernel) it writes `''`, as such code always did.
+	*/
+	async clearSecrets(keys, nodeId) {
+		const tree = this.addonSecretTree();
+		const keychain = this._ctx?.secrets !== void 0;
+		const patch = {};
+		for (const key of keys) patch[key] = keychain && tree.has(key) ? SECRET_CLEAR : "";
+		await this.applyGlobalPatch(patch, nodeId);
+	}
+	async applyGlobalPatch(barePatch, nodeId) {
 		const keys = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
-		const barePatch = patch;
 		const scoped = keys.size > 0 ? scopePatch(barePatch, keys, target) : barePatch;
 		await this._ctx?.settings?.writeAddonStore(scoped);
 		if (target !== localNode) return;
 		await this.resolveConfig();
 		await this.onConfigChanged();
 		this.emitLifecycle(require_event_category.EventCategory.AddonUpdated, { level: "global" });
-		this.maybeAutoRestart(patch, this.globalSettingsSchema());
+		this.maybeAutoRestart(Object.keys(barePatch), this.globalSettingsSchema());
 	}
 	/**
 	* The set of field keys the global settings schema declares `perNode: true`
@@ -1024,7 +1858,7 @@ var BaseAddon = class {
 	* time to return its response before the addon is torn down and
 	* re-initialised by `AddonRegistryService.restartAddon`.
 	*/
-	maybeAutoRestart(patch, schema) {
+	maybeAutoRestart(patchKeys, schema) {
 		if (!schema) return;
 		const restartKeys = /* @__PURE__ */ new Set();
 		for (const section of schema.sections) for (const field of section.fields) {
@@ -1032,13 +1866,13 @@ var BaseAddon = class {
 			if (field.requiresRestart) restartKeys.add(field.key);
 		}
 		if (restartKeys.size === 0) return;
-		if (!Object.keys(patch).some((k) => restartKeys.has(k))) return;
+		if (!patchKeys.some((k) => restartKeys.has(k))) return;
 		const ctx = this._ctx;
 		if (!ctx) return;
 		const addonId = ctx.id;
 		setImmediate(() => {
 			ctx.api.addons?.restartAddon?.mutate({ addonId }).then(() => {
-				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: Object.keys(patch).filter((k) => restartKeys.has(k)) } });
+				ctx.logger.info("addon auto-restart triggered by restart-required setting change", { meta: { changedFields: patchKeys.filter((k) => restartKeys.has(k)) } });
 			}).catch((err) => {
 				ctx.logger.error("addon auto-restart failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
 			});
@@ -1047,7 +1881,7 @@ var BaseAddon = class {
 	async getDeviceSettings(deviceId) {
 		const schema = this.deviceSettingsSchema();
 		if (!schema) return { sections: [] };
-		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {});
+		return hydrateSchema(schema, await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, { inlineSecretsAsViews: true });
 	}
 	async updateDeviceSettings(deviceId, patch) {
 		await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
@@ -1177,7 +2011,7 @@ var BaseAddon = class {
 	* selection at boot (absent scoped key ⇒ the constructor default wins).
 	*/
 	async resolveConfig() {
-		const stored = await this.readAddonStoreWithRetry();
+		const stored = await this.resolveStoredSecrets(await this.readAddonStoreWithRetry());
 		const perNode = this.perNodeKeys();
 		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const resolved = { ...this.defaults };
@@ -1202,7 +2036,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: () => this.readAddonStoreWithRetry(),
+			read: async () => this.resolveStoredSecrets(await this.readAddonStoreWithRetry()),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeAddonStore(patch);
 			},
@@ -1219,7 +2053,7 @@ var BaseAddon = class {
 			key,
 			schema,
 			fallback,
-			read: async () => await this._ctx?.settings?.readDeviceStore(deviceId) ?? {},
+			read: async () => this.resolveStoredSecrets(await this._ctx?.settings?.readDeviceStore(deviceId) ?? {}, false),
 			write: async (patch) => {
 				await this._ctx?.settings?.writeDeviceStore(deviceId, patch);
 			},
@@ -1231,6 +2065,70 @@ var BaseAddon = class {
 			} })
 		});
 	}
+	/** The addon store's secret tree: schema fields by TYPE, plus `secretStatePaths`. */
+	addonSecretTree() {
+		this._addonSecretTree ??= mergeSecretStatePaths(secretTreeFromSchema(this.globalSettingsSchema()), this.secretStatePaths);
+		return this._addonSecretTree;
+	}
+	deviceSecretTree() {
+		this._deviceSecretTree ??= secretTreeFromSchema(this.deviceSettingsSchema());
+		return this._deviceSecretTree;
+	}
+	/**
+	* Secrets of this addon's stored config that could not be resolved on the
+	* last read, with why. Non-empty means the addon is running WITHOUT them —
+	* an addon whose function needs one should report itself degraded rather
+	* than start on an empty credential.
+	*/
+	get unresolvedSecrets() {
+		return this._unresolvedSecrets;
+	}
+	/**
+	* Substitute every keychain marker in a stored blob with its value. With no
+	* keychain (no `ctx.secrets`) or no marker, the blob comes back unchanged.
+	* An unresolvable value is LEFT OUT (never `''`), logged by ref — never by
+	* value — and, when the cause can pass, retried with backoff. Nothing is
+	* ever written back from here.
+	*/
+	async resolveStoredSecrets(blob, trackForConfig = true) {
+		const secrets = this._ctx?.secrets;
+		if (secrets === void 0) return blob;
+		const refs = collectSecretMarkerRefs(blob);
+		if (trackForConfig) this._configSecretRefs = new Set(refs);
+		if (refs.length === 0) {
+			if (trackForConfig) this._unresolvedSecrets = [];
+			return blob;
+		}
+		const { value, unresolved } = await resolveSecretMarkers(blob, secrets);
+		if (trackForConfig) {
+			this._unresolvedSecrets = unresolved;
+			if (unresolved.length > 0) {
+				this._ctx?.logger?.error?.("secret unavailable — running without it, will retry", { meta: { secrets: unresolved.map((u) => ({
+					ref: u.ref,
+					reason: u.reason
+				})) } });
+				if (unresolved.some((u) => u.reason !== "missing" && u.reason !== "forbidden")) {
+					this.scheduleSecretReresolve(this._secretRetryDelayMs);
+					this._secretRetryDelayMs = Math.min(this._secretRetryDelayMs * 2, SECRET_RETRY_MAX_MS);
+				}
+			} else this._secretRetryDelayMs = SECRET_RETRY_FIRST_MS;
+		}
+		return value;
+	}
+	/** Re-resolve the config (a keychain-only change, or a retry) and apply it. */
+	scheduleSecretReresolve(delayMs) {
+		const timerOf = delayMs === SECRET_CHANGE_DEBOUNCE_MS ? "_secretChangeTimer" : "_secretRetryTimer";
+		if (this[timerOf] !== null) return;
+		const timer = setTimeout(() => {
+			this[timerOf] = null;
+			if (this._ctx === null) return;
+			this.resolveConfig().then(() => this.onConfigChanged()).catch((err) => {
+				this._ctx?.logger?.error?.("re-resolving secrets failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			});
+		}, delayMs);
+		timer.unref?.();
+		this[timerOf] = timer;
+	}
 	/**
 	* Wrap `ctx.settings.readAddonStore()` with a short retry budget so a
 	* transient settings-store outage (mid-restart of sqlite-settings, tsx-watch
@@ -1470,6 +2368,312 @@ var PeerBytesTicketSchema = zod.z.object({
 	declaredBytes: zod.z.number().int().nonnegative().nullable()
 });
 //#endregion
+//#region src/keychain/known-secrets.ts
+/**
+* The per-process set of secret VALUES this process has resolved, so the log
+* pipeline can scrub them wherever they turn up — a library's error message,
+* an argv a spawn logged, a URL someone interpolated.
+*
+* Key-name redaction cannot catch `Command failed: cloudflared --token eyJ…`:
+* the value is in a message, not under a named key. The only thing that can is
+* knowing the value. `ctx.secrets` registers every value it resolves (and every
+* value it stores), and `scrubKnownSecrets` replaces each occurrence with
+* `‹secret:<hash of its ref>›` — enough to say WHICH secret leaked, nothing of
+* what it is.
+*
+* Process-global on purpose: a forked runner scrubs its own logs before they
+* leave over UDS, and hub-main scrubs what it resolved. Values shorter than
+* {@link MIN_SCRUBBED_LENGTH} are not registered — a 4-digit PIN would turn
+* every timestamp containing it into a redaction.
+*/
+/** Below this length a value is too likely to collide with ordinary text. */
+var MIN_SCRUBBED_LENGTH = 8;
+/**
+* One store per PROCESS, even when two copies of this module are loaded (an
+* addon bundle next to the framework's): keyed on a registered symbol.
+*/
+var STORE_KEY = Symbol.for("camstack.keychain.known-secrets");
+function store() {
+	const existing = Reflect.get(globalThis, STORE_KEY);
+	if (existing !== void 0 && existing !== null) return existing;
+	const created = {
+		values: /* @__PURE__ */ new Map(),
+		compiled: null
+	};
+	Reflect.set(globalThis, STORE_KEY, created);
+	return created;
+}
+/** FNV-1a, 32-bit, as 8 hex chars — a label, not a security property. */
+function shortSecretRefHash(ref) {
+	let hash = 2166136261;
+	for (let i = 0; i < ref.length; i++) {
+		hash ^= ref.charCodeAt(i);
+		hash = Math.imul(hash, 16777619) >>> 0;
+	}
+	return hash.toString(16).padStart(8, "0");
+}
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function recompile() {
+	const s = store();
+	if (s.values.size === 0) {
+		s.compiled = null;
+		return;
+	}
+	const values = [...s.values.keys()].toSorted((a, b) => b.length - a.length);
+	s.compiled = new RegExp(values.map(escapeRegExp).join("|"), "g");
+}
+/** Remember a value this process holds. A no-op for short or empty values. */
+function registerKnownSecret(value, ref) {
+	if (value.length < 8) return;
+	const label = `‹secret:${shortSecretRefHash(ref)}›`;
+	const values = store().values;
+	if (values.get(value) === label) return;
+	values.set(value, label);
+	recompile();
+}
+/** Forget a value (it was replaced or deleted). */
+function forgetKnownSecret(value) {
+	if (!store().values.delete(value)) return;
+	recompile();
+}
+/** How many values are registered — for tests and the status page. */
+function knownSecretCount() {
+	return store().values.size;
+}
+/** Test seam: drop every registered value. */
+function clearKnownSecrets() {
+	const s = store();
+	s.values.clear();
+	s.compiled = null;
+}
+/** Replace every registered value inside `text` with its label. */
+function scrubKnownSecrets(text) {
+	const s = store();
+	const re = s.compiled;
+	if (re === null || text.length < 8) return text;
+	re.lastIndex = 0;
+	if (!re.test(text)) return text;
+	re.lastIndex = 0;
+	return text.replace(re, (match) => s.values.get(match) ?? "‹secret›");
+}
+//#endregion
+//#region src/keychain/secrets-access.ts
+/** Re-fetch a cached value after this long, even with no change event. */
+var REVALIDATE_AFTER_MS = 15 * 6e4;
+function unavailableAll(refs) {
+	const out = {};
+	for (const ref of refs) out[ref] = {
+		kind: "unavailable",
+		reason: "not-initialized"
+	};
+	return out;
+}
+function createSecretsAccess(opts) {
+	const owner = normalizeSecretOwner(opts.owner);
+	const now = opts.now ?? Date.now;
+	const cache = /* @__PURE__ */ new Map();
+	const handlers = /* @__PURE__ */ new Set();
+	/** One delegate handle per owner — each holds a cache and a subscription. */
+	const delegates = /* @__PURE__ */ new Map();
+	const drop = (ref) => {
+		const entry = cache.get(ref);
+		if (entry === void 0) return;
+		cache.delete(ref);
+		forgetKnownSecret(entry.value);
+		for (const handler of handlers) try {
+			handler(ref);
+		} catch {}
+	};
+	opts.eventBus?.subscribe({ category: require_event_category.EventCategory.KeychainChanged }, (event) => {
+		const data = event.data;
+		if (data === null || typeof data !== "object") return;
+		const ref = Reflect.get(data, "ref");
+		const version = Reflect.get(data, "version");
+		if (typeof ref !== "string") return;
+		const entry = cache.get(ref);
+		if (entry === void 0) return;
+		if (typeof version === "number" && version === entry.version) return;
+		drop(ref);
+	});
+	const remember = (ref, value, version) => {
+		const previous = cache.get(ref);
+		if (previous !== void 0 && previous.value !== value) forgetKnownSecret(previous.value);
+		cache.set(ref, {
+			value,
+			version,
+			fetchedAt: now()
+		});
+		registerKnownSecret(value, ref);
+	};
+	return {
+		owner,
+		ref: (scope, fieldPath) => buildSecretRef({
+			owner,
+			scope,
+			fieldPath
+		}),
+		async resolve(refs) {
+			const out = {};
+			const toFetch = [];
+			const t = now();
+			for (const ref of new Set(refs)) {
+				const hit = cache.get(ref);
+				if (hit !== void 0 && t - hit.fetchedAt < 9e5) out[ref] = {
+					kind: "value",
+					value: hit.value,
+					version: hit.version
+				};
+				else toFetch.push(ref);
+			}
+			if (toFetch.length === 0) return out;
+			let fetched;
+			try {
+				fetched = await opts.transport.resolve({ refs: toFetch });
+			} catch {
+				fetched = unavailableAll(toFetch);
+			}
+			for (const ref of toFetch) {
+				const entry = fetched[ref] ?? {
+					kind: "unavailable",
+					reason: "not-initialized"
+				};
+				if (entry.kind === "value") {
+					remember(ref, entry.value, entry.version);
+					out[ref] = entry;
+					continue;
+				}
+				if (entry.kind === "unavailable") {
+					const stale = cache.get(ref);
+					out[ref] = stale !== void 0 ? {
+						kind: "value",
+						value: stale.value,
+						version: stale.version
+					} : entry;
+					continue;
+				}
+				if (cache.has(ref)) drop(ref);
+				out[ref] = entry;
+			}
+			return out;
+		},
+		async put(ref, value) {
+			const result = await opts.transport.put({
+				ref,
+				value
+			});
+			remember(ref, value, result.version);
+			return result.version;
+		},
+		async delete(refs) {
+			if (refs.length === 0) return 0;
+			const result = await opts.transport.delete({ refs });
+			for (const ref of refs) drop(ref);
+			return result.deleted;
+		},
+		state: () => opts.transport.getState(),
+		onChange(handler) {
+			handlers.add(handler);
+			return () => {
+				handlers.delete(handler);
+			};
+		},
+		forOwner: opts.transportForOwner === void 0 ? null : (other) => {
+			const target = normalizeSecretOwner(other);
+			const existing = delegates.get(target);
+			if (existing !== void 0) return existing;
+			const build = opts.transportForOwner;
+			if (build === void 0) throw new Error("forOwner: no delegate transport");
+			const delegate = createSecretsAccess({
+				owner: target,
+				transport: build(target),
+				...opts.eventBus !== void 0 ? { eventBus: opts.eventBus } : {},
+				now
+			});
+			delegates.set(target, delegate);
+			return delegate;
+		}
+	};
+}
+//#endregion
+//#region src/keychain/resolve-secret-views.ts
+/**
+* Resolve the secret VIEWS a form sends as action input (D789).
+*
+* A settings form knows a stored secret only as `{ $secret: ref, set: true }`.
+* An action that reads one from the form (`paramsFromForm`, e.g. "list my
+* Cloudflare zones with the stored token") therefore receives the view. The
+* owner's process swaps each view for its value before the action's input
+* schema runs — through the owner's own `ctx.secrets`, so a view naming
+* another addon's ref resolves to nothing (owner-checked by the keychain).
+*
+* A view that cannot be resolved (pre-keychain inline value, missing,
+* unavailable, forbidden) and an explicit clear instruction are DROPPED: the
+* action sees the parameter as absent, never as an object it would mis-read.
+*/
+function viewRef(value) {
+	if (!isSecretMarkerLike(value)) return null;
+	const ref = Reflect.get(value, "$secret");
+	return typeof ref === "string" && ref.length > 0 ? ref : null;
+}
+function collect(value, out) {
+	if (isSecretClear(value) || isSecretMarkerLike(value)) {
+		const ref = viewRef(value);
+		if (ref !== null) out.add(ref);
+		return true;
+	}
+	let found = false;
+	if (Array.isArray(value)) for (const item of value) found = collect(item, out) || found;
+	else if (value !== null && typeof value === "object") for (const child of Object.values(value)) found = collect(child, out) || found;
+	return found;
+}
+async function resolveSecretViewsIn(args, secrets) {
+	const refs = /* @__PURE__ */ new Set();
+	if (!collect(args, refs)) return args;
+	const answers = secrets !== void 0 && refs.size > 0 ? await secrets.resolve([...refs]) : {};
+	const swap = (value) => {
+		if (isSecretClear(value) || isSecretMarkerLike(value)) {
+			const ref = viewRef(value);
+			const answer = ref !== null ? answers[ref] : void 0;
+			return answer?.kind === "value" ? {
+				keep: true,
+				value: answer.value
+			} : {
+				keep: false,
+				value: void 0
+			};
+		}
+		if (Array.isArray(value)) {
+			const items = [];
+			for (const item of value) {
+				const s = swap(item);
+				if (s.keep) items.push(s.value);
+			}
+			return {
+				keep: true,
+				value: items
+			};
+		}
+		if (value !== null && typeof value === "object") {
+			const out = {};
+			for (const [k, child] of Object.entries(value)) {
+				const s = swap(child);
+				if (s.keep) out[k] = s.value;
+			}
+			return {
+				keep: true,
+				value: out
+			};
+		}
+		return {
+			keep: true,
+			value
+		};
+	};
+	return swap(args).value;
+}
+//#endregion
 //#region src/capabilities/schemas/streaming-shared.ts
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = zod.z.enum([
@@ -2782,7 +3986,95 @@ var deviceOpsCapability = {
 		*/
 		getRawState: method(zod.z.object({ deviceId: zod.z.number() }), RawStateResultSchema.nullable(), { auth: "protected" })
 	}
-};
+};
+//#endregion
+//#region src/device/zod-secret.ts
+/**
+* Secret declaration on a Zod config schema (D783).
+*
+* A field is a secret because its schema SAYS so — `.meta({ secret: true })`,
+* spelled {@link SECRET_META} — never because its key looks like a credential.
+* It is the Zod twin of `secret: true` / `type: 'password'` on a config-UI
+* field (`isSecretConfigField`), and every consumer that treats secrets
+* specially reads it: the settings form (`zodEntriesToConfigUI`), the paths a
+* device advertises at `registerDevice` (`secretConfigPaths`, which the
+* non-admin redaction withholds at any depth), and the keychain later.
+*
+* Zod keeps `.meta()` in `z.globalRegistry`, which lives on `globalThis`, so a
+* declaration made by an addon's own copy of zod is visible here.
+*/
+/**
+* `{ secret: true }` — the one spelling of "this field holds a credential".
+*
+* Addons write the LITERAL `.meta({ secret: true })` rather than importing
+* this constant: an addon running against an older `@camstack/types` would
+* otherwise call `.meta(undefined)`, which in zod v4 is the metadata GETTER
+* and returns no schema at all.
+*/
+var SECRET_META = { secret: true };
+function defOf(schema) {
+	return schema._zod?.def ?? {};
+}
+function declaredHere(schema) {
+	return zod.z.globalRegistry.get(schema)?.secret === true;
+}
+/** Wrapper kinds whose `innerType` is the field itself. */
+var WRAPPERS = new Set([
+	"optional",
+	"nullable",
+	"default",
+	"prefault",
+	"catch",
+	"readonly",
+	"nonoptional"
+]);
+/**
+* The schema layers that make up ONE field: the schema itself and every
+* wrapper below it (optional / default / nullable / readonly / catch), plus
+* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
+* `.transform` on `in`).
+*/
+function layersOf(schema) {
+	const out = [];
+	const queue = [schema];
+	while (queue.length > 0) {
+		const s = queue.shift();
+		if (!s || out.includes(s)) continue;
+		out.push(s);
+		const def = defOf(s);
+		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
+		if (def.type === "pipe") {
+			if (def.in) queue.push(def.in);
+			if (def.out) queue.push(def.out);
+		}
+	}
+	return out;
+}
+/** True when any layer of this field declares `.meta({ secret: true })`. */
+function isZodSecret(schema) {
+	return layersOf(schema).some(declaredHere);
+}
+/**
+* Every declared secret path in a config schema: dotted keys, `[]` for "each
+* element of this array" (`connection.password`, `rows[].token`). A declared
+* object or array is reported as one path and not descended into — everything
+* under it is secret.
+*/
+function collectZodSecretPaths(schema, prefix = "") {
+	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
+	const paths = [];
+	for (const layer of layersOf(schema)) {
+		const def = defOf(layer);
+		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
+		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
+		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
+		else if (def.type === "intersection") {
+			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
+			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
+		}
+	}
+	return [...new Set(paths)];
+}
 //#endregion
 //#region src/device/device-state-handle.ts
 var DEVICE_STATE_EVENT_CATEGORY = "device.state-changed";
@@ -3417,6 +4709,21 @@ function createDeviceProxy(api, binding, opts) {
 		getRetrainExportUrl: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getRetrainExportUrl", "query", input),
 		setRetrainFrameComplete: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "setRetrainFrameComplete", "mutation", input),
 		writeRetrainArchive: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "writeRetrainArchive", "mutation", input),
+		previewRetrainDataset: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "previewRetrainDataset", "query", input),
+		createRetrainDatasetVersion: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "createRetrainDatasetVersion", "mutation", input),
+		listRetrainDatasetVersions: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRetrainDatasetVersions", "query", input),
+		deleteRetrainDatasetVersion: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "deleteRetrainDatasetVersion", "mutation", input),
+		verifyRetrainDatasetVersion: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "verifyRetrainDatasetVersion", "query", input),
+		listRetrainAssistProfiles: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRetrainAssistProfiles", "query", input),
+		proposeRetrainAnnotationsWithLlm: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "proposeRetrainAnnotationsWithLlm", "mutation", input),
+		createRetrainCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "createRetrainCollection", "mutation", input),
+		listRetrainCollections: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRetrainCollections", "query", input),
+		renameRetrainCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "renameRetrainCollection", "mutation", input),
+		deleteRetrainCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "deleteRetrainCollection", "mutation", input),
+		addRetrainFrameFromRecording: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "addRetrainFrameFromRecording", "mutation", input),
+		addRetrainFramesToCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "addRetrainFramesToCollection", "mutation", input),
+		removeRetrainFrameFromCollection: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "removeRetrainFrameFromCollection", "mutation", input),
+		listRetrainCollectionFrames: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRetrainCollectionFrames", "query", input),
 		getEventMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getEventMedia", "query", input),
 		getTrackMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "getTrackMedia", "query", input),
 		listTrackMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listTrackMedia", "query", input),
@@ -3923,94 +5230,6 @@ function createDeviceProxy(api, binding, opts) {
 	};
 }
 //#endregion
-//#region src/device/zod-secret.ts
-/**
-* Secret declaration on a Zod config schema (D783).
-*
-* A field is a secret because its schema SAYS so — `.meta({ secret: true })`,
-* spelled {@link SECRET_META} — never because its key looks like a credential.
-* It is the Zod twin of `secret: true` / `type: 'password'` on a config-UI
-* field (`isSecretConfigField`), and every consumer that treats secrets
-* specially reads it: the settings form (`zodEntriesToConfigUI`), the paths a
-* device advertises at `registerDevice` (`secretConfigPaths`, which the
-* non-admin redaction withholds at any depth), and the keychain later.
-*
-* Zod keeps `.meta()` in `z.globalRegistry`, which lives on `globalThis`, so a
-* declaration made by an addon's own copy of zod is visible here.
-*/
-/**
-* `{ secret: true }` — the one spelling of "this field holds a credential".
-*
-* Addons write the LITERAL `.meta({ secret: true })` rather than importing
-* this constant: an addon running against an older `@camstack/types` would
-* otherwise call `.meta(undefined)`, which in zod v4 is the metadata GETTER
-* and returns no schema at all.
-*/
-var SECRET_META = { secret: true };
-function defOf(schema) {
-	return schema._zod?.def ?? {};
-}
-function declaredHere(schema) {
-	return zod.z.globalRegistry.get(schema)?.secret === true;
-}
-/** Wrapper kinds whose `innerType` is the field itself. */
-var WRAPPERS = new Set([
-	"optional",
-	"nullable",
-	"default",
-	"prefault",
-	"catch",
-	"readonly",
-	"nonoptional"
-]);
-/**
-* The schema layers that make up ONE field: the schema itself and every
-* wrapper below it (optional / default / nullable / readonly / catch), plus
-* both sides of a pipe (`z.preprocess` puts the real schema on `out`,
-* `.transform` on `in`).
-*/
-function layersOf(schema) {
-	const out = [];
-	const queue = [schema];
-	while (queue.length > 0) {
-		const s = queue.shift();
-		if (!s || out.includes(s)) continue;
-		out.push(s);
-		const def = defOf(s);
-		if (def.type !== void 0 && WRAPPERS.has(def.type) && def.innerType) queue.push(def.innerType);
-		if (def.type === "pipe") {
-			if (def.in) queue.push(def.in);
-			if (def.out) queue.push(def.out);
-		}
-	}
-	return out;
-}
-/** True when any layer of this field declares `.meta({ secret: true })`. */
-function isZodSecret(schema) {
-	return layersOf(schema).some(declaredHere);
-}
-/**
-* Every declared secret path in a config schema: dotted keys, `[]` for "each
-* element of this array" (`connection.password`, `rows[].token`). A declared
-* object or array is reported as one path and not descended into — everything
-* under it is secret.
-*/
-function collectZodSecretPaths(schema, prefix = "") {
-	if (isZodSecret(schema)) return prefix.length > 0 ? [prefix] : [];
-	const paths = [];
-	for (const layer of layersOf(schema)) {
-		const def = defOf(layer);
-		if (def.type === "object" && def.shape) for (const [key, child] of Object.entries(def.shape)) paths.push(...collectZodSecretPaths(child, prefix ? `${prefix}.${key}` : key));
-		else if (def.type === "array" && def.element) paths.push(...collectZodSecretPaths(def.element, `${prefix}[]`));
-		else if (def.type === "union" && def.options) for (const option of def.options) paths.push(...collectZodSecretPaths(option, prefix));
-		else if (def.type === "intersection") {
-			if (def.left) paths.push(...collectZodSecretPaths(def.left, prefix));
-			if (def.right) paths.push(...collectZodSecretPaths(def.right, prefix));
-		}
-	}
-	return [...new Set(paths)];
-}
-//#endregion
 //#region src/generated/device-scoped-caps.ts
 /**
 * AUTO-GENERATED by scripts/generate-device-scoped-caps.ts — DO NOT EDIT.
@@ -4405,6 +5624,18 @@ Object.defineProperty(exports, "FrameHandleSchema", {
 		return FrameHandleSchema;
 	}
 });
+Object.defineProperty(exports, "KeychainWriteRefusedError", {
+	enumerable: true,
+	get: function() {
+		return KeychainWriteRefusedError;
+	}
+});
+Object.defineProperty(exports, "MIN_SCRUBBED_LENGTH", {
+	enumerable: true,
+	get: function() {
+		return MIN_SCRUBBED_LENGTH;
+	}
+});
 Object.defineProperty(exports, "PEER_BYTES_CHUNK_BYTES", {
 	enumerable: true,
 	get: function() {
@@ -4459,6 +5690,18 @@ Object.defineProperty(exports, "ProfileSlotStatusSchema", {
 		return ProfileSlotStatusSchema;
 	}
 });
+Object.defineProperty(exports, "REDACTED_SECRET", {
+	enumerable: true,
+	get: function() {
+		return REDACTED_SECRET;
+	}
+});
+Object.defineProperty(exports, "REVALIDATE_AFTER_MS", {
+	enumerable: true,
+	get: function() {
+		return REVALIDATE_AFTER_MS;
+	}
+});
 Object.defineProperty(exports, "RawStateResultSchema", {
 	enumerable: true,
 	get: function() {
@@ -4477,12 +5720,24 @@ Object.defineProperty(exports, "ReadinessTimeoutError", {
 		return ReadinessTimeoutError;
 	}
 });
+Object.defineProperty(exports, "SECRET_CLEAR", {
+	enumerable: true,
+	get: function() {
+		return SECRET_CLEAR;
+	}
+});
 Object.defineProperty(exports, "SECRET_META", {
 	enumerable: true,
 	get: function() {
 		return SECRET_META;
 	}
 });
+Object.defineProperty(exports, "SECRET_REF_SCHEME", {
+	enumerable: true,
+	get: function() {
+		return SECRET_REF_SCHEME;
+	}
+});
 Object.defineProperty(exports, "SHARE_VIEW_KINDS", {
 	enumerable: true,
 	get: function() {
@@ -4531,6 +5786,12 @@ Object.defineProperty(exports, "adminUiCapability", {
 		return adminUiCapability;
 	}
 });
+Object.defineProperty(exports, "arrayItemFieldPath", {
+	enumerable: true,
+	get: function() {
+		return arrayItemFieldPath;
+	}
+});
 Object.defineProperty(exports, "asBoolean", {
 	enumerable: true,
 	get: function() {
@@ -4567,6 +5828,24 @@ Object.defineProperty(exports, "audioChunkBytesPerSample", {
 		return audioChunkBytesPerSample;
 	}
 });
+Object.defineProperty(exports, "buildSecretRef", {
+	enumerable: true,
+	get: function() {
+		return buildSecretRef;
+	}
+});
+Object.defineProperty(exports, "classifySecretWrite", {
+	enumerable: true,
+	get: function() {
+		return classifySecretWrite;
+	}
+});
+Object.defineProperty(exports, "clearKnownSecrets", {
+	enumerable: true,
+	get: function() {
+		return clearKnownSecrets;
+	}
+});
 Object.defineProperty(exports, "collectHydratedFieldEntries", {
 	enumerable: true,
 	get: function() {
@@ -4579,6 +5858,24 @@ Object.defineProperty(exports, "collectHydratedFieldValues", {
 		return collectHydratedFieldValues;
 	}
 });
+Object.defineProperty(exports, "collectKeychainStoredKeys", {
+	enumerable: true,
+	get: function() {
+		return collectKeychainStoredKeys;
+	}
+});
+Object.defineProperty(exports, "collectSecretConfigKeys", {
+	enumerable: true,
+	get: function() {
+		return collectSecretConfigKeys;
+	}
+});
+Object.defineProperty(exports, "collectSecretMarkerRefs", {
+	enumerable: true,
+	get: function() {
+		return collectSecretMarkerRefs;
+	}
+});
 Object.defineProperty(exports, "collectZodSecretPaths", {
 	enumerable: true,
 	get: function() {
@@ -4621,6 +5918,12 @@ Object.defineProperty(exports, "createMirrorSource", {
 		return createMirrorSource;
 	}
 });
+Object.defineProperty(exports, "createSecretsAccess", {
+	enumerable: true,
+	get: function() {
+		return createSecretsAccess;
+	}
+});
 Object.defineProperty(exports, "createSliceHandle", {
 	enumerable: true,
 	get: function() {
@@ -4687,6 +5990,24 @@ Object.defineProperty(exports, "expandCapMethods", {
 		return expandCapMethods;
 	}
 });
+Object.defineProperty(exports, "forgetKnownSecret", {
+	enumerable: true,
+	get: function() {
+		return forgetKnownSecret;
+	}
+});
+Object.defineProperty(exports, "formatSecretScope", {
+	enumerable: true,
+	get: function() {
+		return formatSecretScope;
+	}
+});
+Object.defineProperty(exports, "globalSecretScope", {
+	enumerable: true,
+	get: function() {
+		return globalSecretScope;
+	}
+});
 Object.defineProperty(exports, "hydrateSchema", {
 	enumerable: true,
 	get: function() {
@@ -4717,24 +6038,84 @@ Object.defineProperty(exports, "isEvent", {
 		return isEvent;
 	}
 });
+Object.defineProperty(exports, "isKeychainStoredField", {
+	enumerable: true,
+	get: function() {
+		return isKeychainStoredField;
+	}
+});
+Object.defineProperty(exports, "isSecretClear", {
+	enumerable: true,
+	get: function() {
+		return isSecretClear;
+	}
+});
+Object.defineProperty(exports, "isSecretConfigField", {
+	enumerable: true,
+	get: function() {
+		return isSecretConfigField;
+	}
+});
+Object.defineProperty(exports, "isSecretFieldView", {
+	enumerable: true,
+	get: function() {
+		return isSecretFieldView;
+	}
+});
+Object.defineProperty(exports, "isSecretMarker", {
+	enumerable: true,
+	get: function() {
+		return isSecretMarker;
+	}
+});
+Object.defineProperty(exports, "isSecretMarkerLike", {
+	enumerable: true,
+	get: function() {
+		return isSecretMarkerLike;
+	}
+});
+Object.defineProperty(exports, "isSecretRef", {
+	enumerable: true,
+	get: function() {
+		return isSecretRef;
+	}
+});
 Object.defineProperty(exports, "isZodSecret", {
 	enumerable: true,
 	get: function() {
 		return isZodSecret;
 	}
 });
+Object.defineProperty(exports, "knownSecretCount", {
+	enumerable: true,
+	get: function() {
+		return knownSecretCount;
+	}
+});
 Object.defineProperty(exports, "makeProfileBrokerId", {
 	enumerable: true,
 	get: function() {
 		return makeProfileBrokerId;
 	}
 });
+Object.defineProperty(exports, "makeSecretMarker", {
+	enumerable: true,
+	get: function() {
+		return makeSecretMarker;
+	}
+});
 Object.defineProperty(exports, "makeSourceBrokerId", {
 	enumerable: true,
 	get: function() {
 		return makeSourceBrokerId;
 	}
 });
+Object.defineProperty(exports, "mergeSecretStatePaths", {
+	enumerable: true,
+	get: function() {
+		return mergeSecretStatePaths;
+	}
+});
 Object.defineProperty(exports, "method", {
 	enumerable: true,
 	get: function() {
@@ -4759,6 +6140,12 @@ Object.defineProperty(exports, "normalizeNodeId", {
 		return normalizeNodeId;
 	}
 });
+Object.defineProperty(exports, "normalizeSecretOwner", {
+	enumerable: true,
+	get: function() {
+		return normalizeSecretOwner;
+	}
+});
 Object.defineProperty(exports, "optionalMethod", {
 	enumerable: true,
 	get: function() {
@@ -4789,6 +6176,18 @@ Object.defineProperty(exports, "parseProfileBrokerId", {
 		return parseProfileBrokerId;
 	}
 });
+Object.defineProperty(exports, "parseSecretRef", {
+	enumerable: true,
+	get: function() {
+		return parseSecretRef;
+	}
+});
+Object.defineProperty(exports, "parseSecretStatePath", {
+	enumerable: true,
+	get: function() {
+		return parseSecretStatePath;
+	}
+});
 Object.defineProperty(exports, "readNodePin", {
 	enumerable: true,
 	get: function() {
@@ -4801,6 +6200,12 @@ Object.defineProperty(exports, "readinessKey", {
 		return readinessKey;
 	}
 });
+Object.defineProperty(exports, "registerKnownSecret", {
+	enumerable: true,
+	get: function() {
+		return registerKnownSecret;
+	}
+});
 Object.defineProperty(exports, "resolveCapMount", {
 	enumerable: true,
 	get: function() {
@@ -4813,18 +6218,60 @@ Object.defineProperty(exports, "resolveHydratedFieldValue", {
 		return resolveHydratedFieldValue;
 	}
 });
+Object.defineProperty(exports, "resolveSecretMarkers", {
+	enumerable: true,
+	get: function() {
+		return resolveSecretMarkers;
+	}
+});
+Object.defineProperty(exports, "resolveSecretViewsIn", {
+	enumerable: true,
+	get: function() {
+		return resolveSecretViewsIn;
+	}
+});
+Object.defineProperty(exports, "schemaDeclaresAnyField", {
+	enumerable: true,
+	get: function() {
+		return schemaDeclaresAnyField;
+	}
+});
 Object.defineProperty(exports, "scopeKey", {
 	enumerable: true,
 	get: function() {
 		return scopeKey;
 	}
 });
+Object.defineProperty(exports, "scrubKnownSecrets", {
+	enumerable: true,
+	get: function() {
+		return scrubKnownSecrets;
+	}
+});
+Object.defineProperty(exports, "secretTreeFromPaths", {
+	enumerable: true,
+	get: function() {
+		return secretTreeFromPaths;
+	}
+});
+Object.defineProperty(exports, "secretTreeFromSchema", {
+	enumerable: true,
+	get: function() {
+		return secretTreeFromSchema;
+	}
+});
 Object.defineProperty(exports, "selectAssignedProfileSlots", {
 	enumerable: true,
 	get: function() {
 		return selectAssignedProfileSlots;
 	}
 });
+Object.defineProperty(exports, "shortSecretRefHash", {
+	enumerable: true,
+	get: function() {
+		return shortSecretRefHash;
+	}
+});
 Object.defineProperty(exports, "sleep", {
 	enumerable: true,
 	get: function() {
@@ -4849,6 +6296,18 @@ Object.defineProperty(exports, "toNodeId", {
 		return toNodeId;
 	}
 });
+Object.defineProperty(exports, "toSecretFieldView", {
+	enumerable: true,
+	get: function() {
+		return toSecretFieldView;
+	}
+});
+Object.defineProperty(exports, "transformSecretWrite", {
+	enumerable: true,
+	get: function() {
+		return transformSecretWrite;
+	}
+});
 Object.defineProperty(exports, "viewerUiCapability", {
 	enumerable: true,
 	get: function() {