@camstack/system 1.2.375 → 1.2.376

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-Bfdgkbq3.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-BWtaSmWf.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { $t as RUNNER_RSS_BUDGET_ENV, Ft as resolveAddonClass, H as createUdsLoggerWithControl, Pt as installManifestNativeDeps, U as LocalChildClient, _t as getWorkerNativeCapSnapshot, f as installManifestSystemDeps, fn as startRunnerHeapWatch, g as createUdsAddonContext, gt as getWorkerNativeCapProvider, i as killOwnRunnerGroupAfterParentLoss, n as createChildCapDispatch, p as installManifestPythonDeps, u as startRunnerParentDeathWatchdog, wn as emitHeapDiagnosticReport, xt as validateProviderRegistrations, yt as setWorkerNativeCapsChangeListener } from "./child-cap-dispatch-B9kziY4L.mjs";
+import { $t as RUNNER_RSS_BUDGET_ENV, Ft as resolveAddonClass, H as createUdsLoggerWithControl, Pt as installManifestNativeDeps, U as LocalChildClient, _t as getWorkerNativeCapSnapshot, f as installManifestSystemDeps, fn as startRunnerHeapWatch, g as createUdsAddonContext, gt as getWorkerNativeCapProvider, i as killOwnRunnerGroupAfterParentLoss, n as createChildCapDispatch, p as installManifestPythonDeps, u as startRunnerParentDeathWatchdog, wn as emitHeapDiagnosticReport, xt as validateProviderRegistrations, yt as setWorkerNativeCapsChangeListener } from "./child-cap-dispatch-8qMgog1O.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";

package/dist/addon-utils.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-Cek0wNdY.js");
-const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-CpEH3CoV.js");
+const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-QX4RjNe7.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 const require_snapshot_courtesy = require("./snapshot-courtesy-D_C5-nC0.js");
 exports.COURTESY_DEFAULT_WIDTH = require_snapshot_courtesy.COURTESY_DEFAULT_WIDTH;

package/dist/addon-utils.mjs

@@ -1,4 +1,4 @@
-import { C as resolveFormatRevision, S as isModelDownloaded, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, f as ModelDownloadHttpError, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, t as STALL_REPORT_MS, v as ensureModel, x as isModelDownloadHttpError } from "./event-loop-stall-monitor-DKcYBHdH.mjs";
+import { C as resolveFormatRevision, S as isModelDownloaded, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, f as ModelDownloadHttpError, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, t as STALL_REPORT_MS, v as ensureModel, x as isModelDownloadHttpError } from "./event-loop-stall-monitor-8W4yWNVW.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg, t as COURTESY_DEFAULT_WIDTH } from "./snapshot-courtesy-CyFs1M3I.mjs";
 export { COURTESY_DEFAULT_WIDTH, CustomActionRegistry, ModelDownloadHttpError, ModelDownloadService, STALL_REPORT_MS, STALL_TICK_MS, adoptModelRevisions, attributeStall, collectModelFiles, contentTypeFor, courtesyCacheKey, createFileDataPlaneHandler, deleteModelFromDisk, downloadFile, ensureModel, getModelFilePath, isModelDownloadHttpError, isModelDownloaded, parseRangeHeader, renderCourtesyJpeg, renderCourtesyOverlayJpeg, resolveFormatRevision, startEventLoopStallMonitor };

package/dist/auth/external-identity-manager.d.ts

@@ -0,0 +1,43 @@
+import { SettingsStoreClient } from '@camstack/types';
+export interface ExternalIdentityRecord {
+    readonly provider: string;
+    readonly subject: string;
+    /** Verified `iss` the identity was linked under. */
+    readonly issuer: string;
+    readonly userId: string;
+    readonly label?: string;
+    readonly linkedAt: number;
+}
+export interface ExternalIdentityKey {
+    readonly provider: string;
+    readonly subject: string;
+}
+/** The identity is already linked to a different user. */
+export declare class ExternalIdentityConflictError extends Error {
+    constructor();
+}
+export declare class ExternalIdentityManager {
+    private readonly store;
+    constructor(store: SettingsStoreClient);
+    private find;
+    /** The link of `(provider, subject)`, or `null`. */
+    findLink(provider: string, subject: string): Promise<ExternalIdentityRecord | null>;
+    /** The user `(provider, subject)` is linked to, or `null`. */
+    findUser(provider: string, subject: string): Promise<string | null>;
+    listForUser(userId: string): Promise<readonly ExternalIdentityRecord[]>;
+    /**
+     * Link `(provider, subject)` to `userId`. Idempotent for the same user;
+     * {@link ExternalIdentityConflictError} when another user holds it.
+     */
+    link(input: ExternalIdentityKey & {
+        userId: string;
+        issuer: string;
+        label?: string;
+    }): Promise<void>;
+    /** Remove one link of `userId`; `false` when that user did not hold it. */
+    unlink(input: ExternalIdentityKey & {
+        userId: string;
+    }): Promise<boolean>;
+    /** Delete every link of a user being deleted. Returns how many were removed. */
+    removeAllForUser(userId: string): Promise<number>;
+}

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-BcUWQGr9.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { G as addonPagesCapability, Nr as EventCategory, cr as BaseAddon, sr as errMsg } from "../../dist-ZdSg09GJ.mjs";
+import { G as addonPagesCapability, Pr as EventCategory, cr as BaseAddon, sr as errMsg } from "../../dist-D732NygW.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-BcUWQGr9.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Nr as EventCategory, cr as BaseAddon, q as addonWidgetsCapability, sr as errMsg } from "../../dist-ZdSg09GJ.mjs";
+import { Pr as EventCategory, cr as BaseAddon, q as addonWidgetsCapability, sr as errMsg } from "../../dist-D732NygW.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-BcUWQGr9.js");
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { J as alertsCapability, Nr as EventCategory, cr as BaseAddon, n as AlertSchema, sr as errMsg, vr as createEvent } from "../../dist-ZdSg09GJ.mjs";
+import { J as alertsCapability, Pr as EventCategory, cr as BaseAddon, n as AlertSchema, sr as errMsg, yr as createEvent } from "../../dist-D732NygW.mjs";
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-BcUWQGr9.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { Nr as EventCategory, S as FIRST_LEVEL_MACRO_CLASSES, Z as bareAddonId, cr as BaseAddon, hn as ptzAutotrackCapability, sr as errMsg, wr as isEvent } from "../../dist-ZdSg09GJ.mjs";
+import { Pr as EventCategory, S as FIRST_LEVEL_MACRO_CLASSES, Tr as isEvent, Z as bareAddonId, cr as BaseAddon, hn as ptzAutotrackCapability, sr as errMsg } from "../../dist-D732NygW.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-BcUWQGr9.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Fn as storageOccupancyCapability, Mr as toNodeId, Nr as EventCategory, Tr as nodePin, X as backupCapability, cr as BaseAddon, g as DATABASE_SNAPSHOT_SUFFIX, tn as mayWriteToLocation } from "../../dist-ZdSg09GJ.mjs";
+import { Er as nodePin, Fn as storageOccupancyCapability, Nr as toNodeId, Pr as EventCategory, X as backupCapability, cr as BaseAddon, g as DATABASE_SNAPSHOT_SUFFIX, tn as mayWriteToLocation } from "../../dist-D732NygW.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-BcUWQGr9.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let zod = require("zod");
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/calendars/calendars.addon.mjs

@@ -1,4 +1,4 @@
-import { cr as BaseAddon, p as CalendarPreferencesSchema, tt as calendarsCapability } from "../../dist-ZdSg09GJ.mjs";
+import { cr as BaseAddon, p as CalendarPreferencesSchema, tt as calendarsCapability } from "../../dist-D732NygW.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { z } from "zod";
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/camera-grid/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-BcUWQGr9.js");
 let zod = require("zod");
 let _camstack_types_node = require("@camstack/types/node");
 let node_path = require("node:path");

package/dist/builtins/camera-grid/index.mjs

@@ -1,4 +1,4 @@
-import { Ln as streamCatalogCapability, M as MOTION_CLOSE_AFTER_MS, Mn as snapshotCapability, Nr as EventCategory, Sr as hydrateSchema, an as motionCapability, b as DeclaredDevices, cr as BaseAddon, gt as declarationOwnerNodeId, i as BaseDevice, ir as DeviceFeature, nn as memoizePinnedFfmpeg, nt as cameraGridLayoutCapability, or as DeviceType, qn as buildFfmpegArgs, sr as errMsg, vr as createEvent, y as DERIVED_CAMERA_SILENCED_CAP_NAMES } from "../../dist-ZdSg09GJ.mjs";
+import { Cr as hydrateSchema, Ln as streamCatalogCapability, M as MOTION_CLOSE_AFTER_MS, Mn as snapshotCapability, Pr as EventCategory, an as motionCapability, b as DeclaredDevices, cr as BaseAddon, gt as declarationOwnerNodeId, i as BaseDevice, ir as DeviceFeature, nn as memoizePinnedFfmpeg, nt as cameraGridLayoutCapability, or as DeviceType, qn as buildFfmpegArgs, sr as errMsg, y as DERIVED_CAMERA_SILENCED_CAP_NAMES, yr as createEvent } from "../../dist-D732NygW.mjs";
 import { z } from "zod";
 import { FfmpegProcess } from "@camstack/types/node";
 import { join } from "node:path";

package/dist/builtins/composer/composer.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
-const require_composition_sources = require("../../composition-sources-DYlXX2qW.js");
+const require_dist = require("../../dist-BcUWQGr9.js");
+const require_composition_sources = require("../../composition-sources-DW7CgMsg.js");
 let zod = require("zod");
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { $ as buildCapabilityLookup, $n as compositionSliceKey, Jn as cloneStatefulExpressionMemory, Kn as COMPOSER_ADDON_ID, Nr as EventCategory, Ot as evaluateCompositionField, Qn as compositionItemFieldPath, Xn as composedDeviceStableId, Yn as composedDeviceRef, Zn as compositionFeatureEnabled, at as composerCapability, b as DeclaredDevices, cr as BaseAddon, er as compositionSourceKey, fn as planComposition, i as BaseDevice, jt as expressionContainsBuiltinCall, l as COMPOSED_ITEM_FIXED_FIELDS, nr as disarmRoseMemory, or as DeviceType, ot as compositionFieldKey, rr as toExpressionValue, sr as errMsg, t as ALL_CAPABILITY_DEFINITIONS, tr as createStatefulExpressionMemory, vr as createEvent } from "../../dist-ZdSg09GJ.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-BfZgiTYD.mjs";
+import { $ as buildCapabilityLookup, $n as compositionSliceKey, Jn as cloneStatefulExpressionMemory, Kn as COMPOSER_ADDON_ID, Ot as evaluateCompositionField, Pr as EventCategory, Qn as compositionItemFieldPath, Xn as composedDeviceStableId, Yn as composedDeviceRef, Zn as compositionFeatureEnabled, at as composerCapability, b as DeclaredDevices, cr as BaseAddon, er as compositionSourceKey, fn as planComposition, i as BaseDevice, jt as expressionContainsBuiltinCall, l as COMPOSED_ITEM_FIXED_FIELDS, nr as disarmRoseMemory, or as DeviceType, ot as compositionFieldKey, rr as toExpressionValue, sr as errMsg, t as ALL_CAPABILITY_DEFINITIONS, tr as createStatefulExpressionMemory, yr as createEvent } from "../../dist-D732NygW.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-zxQPPtP_.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-BcUWQGr9.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, cr as BaseAddon } from "../../dist-ZdSg09GJ.mjs";
+import { Zt as logDestinationCapability, cr as BaseAddon } from "../../dist-D732NygW.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
-const require_composition_sources = require("../../composition-sources-DYlXX2qW.js");
+const require_dist = require("../../dist-BcUWQGr9.js");
+const require_composition_sources = require("../../composition-sources-DW7CgMsg.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
-import { $ as buildCapabilityLookup, Bn as validateComposition, Sr as hydrateSchema, Yn as composedDeviceRef, _n as replacedFieldKeys, b as DeclaredDevices, bn as resolveCoreBlockEntry, bt as describeComposableCaps, cr as BaseAddon, ct as coreBlockAddonId, d as CORE_BLOCKS_ADDON_ID, dt as coreBlockSourceKind, er as compositionSourceKey, f as CORE_BLOCK_ADDON_PREFIX, fn as planComposition, ft as coreBlocksCapability, lt as coreBlockComposition, m as CoreBlockSchema, on as normalizeCoreBlockWrite, sr as errMsg, st as compositionSourceRefs, t as ALL_CAPABILITY_DEFINITIONS, u as COMPOSER_RUNNER_ID, ut as coreBlockIdFromAddonId, xn as resolveCoreBlockFiles } from "../../dist-ZdSg09GJ.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-BfZgiTYD.mjs";
+import { $ as buildCapabilityLookup, Bn as validateComposition, Cr as hydrateSchema, Yn as composedDeviceRef, _n as replacedFieldKeys, b as DeclaredDevices, bn as resolveCoreBlockEntry, bt as describeComposableCaps, cr as BaseAddon, ct as coreBlockAddonId, d as CORE_BLOCKS_ADDON_ID, dt as coreBlockSourceKind, er as compositionSourceKey, f as CORE_BLOCK_ADDON_PREFIX, fn as planComposition, ft as coreBlocksCapability, lt as coreBlockComposition, m as CoreBlockSchema, on as normalizeCoreBlockWrite, sr as errMsg, st as compositionSourceRefs, t as ALL_CAPABILITY_DEFINITIONS, u as COMPOSER_RUNNER_ID, ut as coreBlockIdFromAddonId, xn as resolveCoreBlockFiles } from "../../dist-D732NygW.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-zxQPPtP_.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { customizationBlockName } from "@camstack/types/node";

package/dist/builtins/device-manager/device-manager.addon.d.ts

@@ -69,6 +69,8 @@ export declare class DeviceManagerAddon extends BaseAddon {
      * `allocateDeviceId` never consults.
      */
     private readonly removalFence;
+    /** Declared secret config paths per device, as last registered (D783). */
+    private readonly secretConfigPaths;
     /** The runtime-state mirror, asserted present (constructed in onInitialize). */
     private get stateMirror();
     /**

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-CcWvdy6u.js");
+const require_dist = require("../../dist-BcUWQGr9.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-MaESpO18.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -396,6 +396,13 @@ function isDeviceRole(value) {
 function toDeviceRole(value) {
 	return value != null && isDeviceRole(value) ? value : null;
 }
+/** The secret paths a live device's config schema declares (D783), as a spreadable field. */
+function liveSecretConfigPaths(device) {
+	const schema = device.config?.schema;
+	if (schema === void 0 || schema === null || typeof schema !== "object") return {};
+	const paths = require_dist.collectZodSecretPaths(schema);
+	return paths.length > 0 ? { secretConfigPaths: [...paths] } : {};
+}
 function toDeviceInfo(addonId, device, metadata = null, metaRow = null) {
 	const configValues = {};
 	for (const entry of device.config.entries()) configValues[entry.key] = entry.value;
@@ -419,6 +426,7 @@ function toDeviceInfo(addonId, device, metadata = null, metaRow = null) {
 		features: device.features.length > 0 ? [...device.features] : persistedFeatures(metaRow?.features),
 		isCamera: isCameraDevice(device),
 		config: configValues,
+		...liveSecretConfigPaths(device),
 		metadata,
 		...metaRow?.integrationId !== void 0 ? { integrationId: metaRow.integrationId } : {},
 		...metaRow?.linkDeviceId !== void 0 ? { linkDeviceId: metaRow.linkDeviceId } : {},
@@ -2491,6 +2499,24 @@ function persistedOnlineFallback(input) {
 	return Object.keys(input.config ?? {}).length > 0;
 }
 //#endregion
+//#region src/builtins/device-manager/secret-config-paths.ts
+function createSecretConfigPathRegistry() {
+	const byDevice = /* @__PURE__ */ new Map();
+	return {
+		get: (deviceId) => byDevice.get(deviceId),
+		set: (deviceId, paths) => {
+			byDevice.set(deviceId, Object.freeze([...new Set(paths)]));
+		},
+		delete: (deviceId) => {
+			byDevice.delete(deviceId);
+		}
+	};
+}
+/** `{ secretConfigPaths }` when any are known, `{}` otherwise — spread into a `DeviceInfo`. */
+function secretConfigPathsField(paths) {
+	return paths !== void 0 && paths.length > 0 ? { secretConfigPaths: [...paths] } : {};
+}
+//#endregion
 //#region src/builtins/device-manager/device-queries.ts
 /**
 * The ORIGINATING addon id off a cap-channel call's `args`, or `undefined`.
@@ -2629,6 +2655,7 @@ async function listAll(pctx, input) {
 			features: persistedFeatures(m.features),
 			isCamera: persistedIsCamera(persistedType),
 			config: persistedConfig ?? {},
+			...secretConfigPathsField(pctx.secretConfigPaths.get(m.id)),
 			metadata,
 			...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
 			...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
@@ -2678,6 +2705,7 @@ async function getDevice(pctx, input) {
 		features: persistedFeatures(m.features),
 		isCamera: persistedIsCamera(m.type),
 		config: persistedConfig ?? {},
+		...secretConfigPathsField(pctx.secretConfigPaths.get(deviceId)),
 		metadata,
 		...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
 		...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
@@ -2754,6 +2782,7 @@ function projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChil
 			features: persistedFeatures(m.features),
 			isCamera: persistedIsCamera(m.type),
 			config: persistedConfig,
+			...secretConfigPathsField(pctx.secretConfigPaths.get(m.id)),
 			metadata,
 			...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
 			...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
@@ -5547,6 +5576,7 @@ async function registerDevice(pctx, input) {
 		});
 		throw new Error(`[device-manager] registerDevice: device ${id} (${addonId}/${stableId}) was removed — refusing to resurrect it`);
 	}
+	if (Array.isArray(input.secretConfigPaths)) pctx.secretConfigPaths.set(id, input.secretConfigPaths);
 	const { isFirstRegistration, exportFingerprint, fingerprintChanged, inheritedLocation, inheritedDescendantIds, inheritFailed } = await pctx.metaStore.withMetaWriteLock(async () => {
 		const existingRow = await pctx.metaStore.rows.get(id);
 		const existingMeta = existingRow?.meta;
@@ -5693,6 +5723,7 @@ async function removeDevice(pctx, input) {
 			stableId
 		});
 	});
+	pctx.secretConfigPaths.delete(deviceId);
 	await pctx.settings.clearDeviceStore(deviceId);
 	await pctx.host.forgetMirrorDevice(deviceId);
 	await pctx.settings.clearDeviceRuntimeState(deviceId);
@@ -9605,6 +9636,8 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 	* `allocateDeviceId` never consults.
 	*/
 	removalFence = createRemovalFence();
+	/** Declared secret config paths per device, as last registered (D783). */
+	secretConfigPaths = createSecretConfigPathRegistry();
 	/** The runtime-state mirror, asserted present (constructed in onInitialize). */
 	get stateMirror() {
 		if (!this.stateMirrorImpl) throw new Error("DeviceManagerAddon: state mirror accessed before onInitialize");
@@ -9846,6 +9879,7 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 			bindingsDeps: this.bindingsDeps,
 			migrationGuard: createMigrationGuard(),
 			removalFence: this.removalFence,
+			secretConfigPaths: this.secretConfigPaths,
 			requireDeviceOps,
 			stampIntegrationId: stampIntegrationId$1,
 			get provider() {

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { A as MINUTES_PER_DAY, At as expandContainer, C as FieldClaimModeSchema, Cr as isDeviceConfigCap, Ct as deviceStateCapability, Dt as enumerateSchemaFields, En as runtimeStatePolicyFor, Et as enumerateItemArrayFields, Ft as formatMinutes, Kt as legacyAutoLinkIds, Nr as EventCategory, O as LocationIconIdSchema, R as STREAM_PROFILE_META, St as deviceManagerCapability, Xt as locationIconKey, ar as DeviceRole, c as CAP_NAMES_WITH_STATUS, cr as BaseAddon, et as buildStreamParamsConfigSchema, ir as DeviceFeature, jn as siteZoneKey, jr as sleep$1, mr as WELL_KNOWN_TAB_MAP, o as CAMERA_SWITCH_ORDER, or as DeviceType, pt as createDeviceExtensionProvider, sn as normalizeUnit, sr as errMsg, t as ALL_CAPABILITY_DEFINITIONS, un as parseStreamParamsFormPatch, v as DAY_NAMES, vt as defineExtensionSlotProvider, w as FieldClaimSchema, wt as deviceStatusCapability, x as DeviceStatusSchema, xt as deviceExtensionCapability } from "../../dist-ZdSg09GJ.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-B4ZeKrbR.mjs";
+import { A as MINUTES_PER_DAY, At as expandContainer, C as FieldClaimModeSchema, Ct as deviceStateCapability, Dt as enumerateSchemaFields, En as runtimeStatePolicyFor, Et as enumerateItemArrayFields, Ft as formatMinutes, Kt as legacyAutoLinkIds, Mr as sleep$1, O as LocationIconIdSchema, Pr as EventCategory, R as STREAM_PROFILE_META, St as deviceManagerCapability, Xt as locationIconKey, ar as DeviceRole, c as CAP_NAMES_WITH_STATUS, cr as BaseAddon, et as buildStreamParamsConfigSchema, ir as DeviceFeature, jn as siteZoneKey, mr as WELL_KNOWN_TAB_MAP, o as CAMERA_SWITCH_ORDER, or as DeviceType, pt as createDeviceExtensionProvider, sn as normalizeUnit, sr as errMsg, t as ALL_CAPABILITY_DEFINITIONS, un as parseStreamParamsFormPatch, v as DAY_NAMES, vr as collectZodSecretPaths, vt as defineExtensionSlotProvider, w as FieldClaimSchema, wr as isDeviceConfigCap, wt as deviceStatusCapability, x as DeviceStatusSchema, xt as deviceExtensionCapability } from "../../dist-D732NygW.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CxPOg7BF.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
@@ -391,6 +391,13 @@ function isDeviceRole(value) {
 function toDeviceRole(value) {
 	return value != null && isDeviceRole(value) ? value : null;
 }
+/** The secret paths a live device's config schema declares (D783), as a spreadable field. */
+function liveSecretConfigPaths(device) {
+	const schema = device.config?.schema;
+	if (schema === void 0 || schema === null || typeof schema !== "object") return {};
+	const paths = collectZodSecretPaths(schema);
+	return paths.length > 0 ? { secretConfigPaths: [...paths] } : {};
+}
 function toDeviceInfo(addonId, device, metadata = null, metaRow = null) {
 	const configValues = {};
 	for (const entry of device.config.entries()) configValues[entry.key] = entry.value;
@@ -414,6 +421,7 @@ function toDeviceInfo(addonId, device, metadata = null, metaRow = null) {
 		features: device.features.length > 0 ? [...device.features] : persistedFeatures(metaRow?.features),
 		isCamera: isCameraDevice(device),
 		config: configValues,
+		...liveSecretConfigPaths(device),
 		metadata,
 		...metaRow?.integrationId !== void 0 ? { integrationId: metaRow.integrationId } : {},
 		...metaRow?.linkDeviceId !== void 0 ? { linkDeviceId: metaRow.linkDeviceId } : {},
@@ -2486,6 +2494,24 @@ function persistedOnlineFallback(input) {
 	return Object.keys(input.config ?? {}).length > 0;
 }
 //#endregion
+//#region src/builtins/device-manager/secret-config-paths.ts
+function createSecretConfigPathRegistry() {
+	const byDevice = /* @__PURE__ */ new Map();
+	return {
+		get: (deviceId) => byDevice.get(deviceId),
+		set: (deviceId, paths) => {
+			byDevice.set(deviceId, Object.freeze([...new Set(paths)]));
+		},
+		delete: (deviceId) => {
+			byDevice.delete(deviceId);
+		}
+	};
+}
+/** `{ secretConfigPaths }` when any are known, `{}` otherwise — spread into a `DeviceInfo`. */
+function secretConfigPathsField(paths) {
+	return paths !== void 0 && paths.length > 0 ? { secretConfigPaths: [...paths] } : {};
+}
+//#endregion
 //#region src/builtins/device-manager/device-queries.ts
 /**
 * The ORIGINATING addon id off a cap-channel call's `args`, or `undefined`.
@@ -2624,6 +2650,7 @@ async function listAll(pctx, input) {
 			features: persistedFeatures(m.features),
 			isCamera: persistedIsCamera(persistedType),
 			config: persistedConfig ?? {},
+			...secretConfigPathsField(pctx.secretConfigPaths.get(m.id)),
 			metadata,
 			...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
 			...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
@@ -2673,6 +2700,7 @@ async function getDevice(pctx, input) {
 		features: persistedFeatures(m.features),
 		isCamera: persistedIsCamera(m.type),
 		config: persistedConfig ?? {},
+		...secretConfigPathsField(pctx.secretConfigPaths.get(deviceId)),
 		metadata,
 		...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
 		...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
@@ -2749,6 +2777,7 @@ function projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChil
 			features: persistedFeatures(m.features),
 			isCamera: persistedIsCamera(m.type),
 			config: persistedConfig,
+			...secretConfigPathsField(pctx.secretConfigPaths.get(m.id)),
 			metadata,
 			...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
 			...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
@@ -5542,6 +5571,7 @@ async function registerDevice(pctx, input) {
 		});
 		throw new Error(`[device-manager] registerDevice: device ${id} (${addonId}/${stableId}) was removed — refusing to resurrect it`);
 	}
+	if (Array.isArray(input.secretConfigPaths)) pctx.secretConfigPaths.set(id, input.secretConfigPaths);
 	const { isFirstRegistration, exportFingerprint, fingerprintChanged, inheritedLocation, inheritedDescendantIds, inheritFailed } = await pctx.metaStore.withMetaWriteLock(async () => {
 		const existingRow = await pctx.metaStore.rows.get(id);
 		const existingMeta = existingRow?.meta;
@@ -5688,6 +5718,7 @@ async function removeDevice(pctx, input) {
 			stableId
 		});
 	});
+	pctx.secretConfigPaths.delete(deviceId);
 	await pctx.settings.clearDeviceStore(deviceId);
 	await pctx.host.forgetMirrorDevice(deviceId);
 	await pctx.settings.clearDeviceRuntimeState(deviceId);
@@ -9600,6 +9631,8 @@ var DeviceManagerAddon = class extends BaseAddon {
 	* `allocateDeviceId` never consults.
 	*/
 	removalFence = createRemovalFence();
+	/** Declared secret config paths per device, as last registered (D783). */
+	secretConfigPaths = createSecretConfigPathRegistry();
 	/** The runtime-state mirror, asserted present (constructed in onInitialize). */
 	get stateMirror() {
 		if (!this.stateMirrorImpl) throw new Error("DeviceManagerAddon: state mirror accessed before onInitialize");
@@ -9841,6 +9874,7 @@ var DeviceManagerAddon = class extends BaseAddon {
 			bindingsDeps: this.bindingsDeps,
 			migrationGuard: createMigrationGuard(),
 			removalFence: this.removalFence,
+			secretConfigPaths: this.secretConfigPaths,
 			requireDeviceOps,
 			stampIntegrationId: stampIntegrationId$1,
 			get provider() {

package/dist/builtins/device-manager/device-projection.d.ts

@@ -62,6 +62,8 @@ export declare function toDeviceInfo(addonId: string, device: IDevice, metadata?
     primaryChildEntityId?: string | null | undefined;
     linkDeviceId?: number | null | undefined;
     integrationId?: string | undefined;
+    metadata: Record<string, unknown> | null;
+    secretConfigPaths?: string[];
     id: number;
     stableId: string;
     addonId: string;
@@ -76,7 +78,6 @@ export declare function toDeviceInfo(addonId: string, device: IDevice, metadata?
     features: DeviceFeature[];
     isCamera: boolean;
     config: Record<string, unknown>;
-    metadata: Record<string, unknown> | null;
 };
 export declare function resolveDeviceById(registry: IDeviceRegistry, deviceId: number): {
     addonId: string;

package/dist/builtins/device-manager/device-provider-context.d.ts

@@ -6,6 +6,7 @@ import { FieldClaimsIndex } from './field-claims-index.js';
 import { OwnedCaps } from './field-ownership.js';
 import { MigrationGuard } from './migrate-guard.js';
 import { RemovalFence } from './removal-fence.js';
+import { SecretConfigPathRegistry } from './secret-config-paths.js';
 import { SeedMode } from './device-state-mirror.js';
 import { MirrorWriteHold } from './mirror-row-writer.js';
 type IDeviceProviderCap = InferProvider<typeof deviceProviderCapability>;
@@ -85,6 +86,8 @@ export interface ProviderContext {
      *  tears down, which is how a deleted camera came back as a config-less
      *  shell (D376). */
     readonly removalFence: RemovalFence;
+    /** The secret config paths each device declared at `registerDevice` (D783). */
+    readonly secretConfigPaths: SecretConfigPathRegistry;
     /** Resolve the per-device `device-ops` native provider (throws when absent). */
     requireDeviceOps(deviceId: number): IDeviceOpsProvider;
     /** Stamp an integration id onto a device's meta row + emit DeviceMetaChanged. */

package/dist/builtins/device-manager/secret-config-paths.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The secret config paths each device DECLARES (D783) — `connection.password`,
+ * `localKey`, `rows[].token` — as its runner last reported them at
+ * `registerDevice`.
+ *
+ * In memory on purpose: a runner re-registers every device it owns whenever it
+ * (re)starts, and a hub-main restart restarts every runner, so the map refills
+ * on its own. Until a device has registered, its `DeviceInfo` carries no paths
+ * and the non-admin redaction falls back to its keyword backstop — never to
+ * "no redaction". Paths only; never a value.
+ */
+export interface SecretConfigPathRegistry {
+    /** The paths last reported for `deviceId`, or `undefined` when none were. */
+    get(deviceId: number): readonly string[] | undefined;
+    /** Replace the paths for `deviceId` with the runner's latest report. */
+    set(deviceId: number, paths: readonly string[]): void;
+    /** Forget a removed device. */
+    delete(deviceId: number): void;
+}
+export declare function createSecretConfigPathRegistry(): SecretConfigPathRegistry;
+/** `{ secretConfigPaths }` when any are known, `{}` otherwise — spread into a `DeviceInfo`. */
+export declare function secretConfigPathsField(paths: readonly string[] | undefined): {
+    secretConfigPaths?: string[];
+};

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-BcUWQGr9.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, cr as BaseAddon } from "../../dist-ZdSg09GJ.mjs";
+import { Zt as logDestinationCapability, cr as BaseAddon } from "../../dist-D732NygW.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-BcUWQGr9.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { I as RecordingStatusSchema, N as RECORDING_SOURCE_CAMSTACK_ADDON, Nr as EventCategory, cr as BaseAddon, sr as errMsg, vr as createEvent } from "../../dist-ZdSg09GJ.mjs";
+import { I as RecordingStatusSchema, N as RECORDING_SOURCE_CAMSTACK_ADDON, Pr as EventCategory, cr as BaseAddon, sr as errMsg, yr as createEvent } from "../../dist-D732NygW.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/auth-schema.d.ts

@@ -60,6 +60,20 @@ export declare const OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
  *     enrollment row outlives the account."
  */
 export declare const USER_TOTP_COLLECTION = "user_totp";
+/**
+ * External sign-in identities linked to local users (D782): one row per
+ * `(provider, subject)` — the row id IS the identity, so one identity maps to
+ * one user by primary key. Written only by the identity's owner completing a
+ * "Link" flow from their profile (bound to their session).
+ *
+ * @durable class=config owner=local-auth
+ *   write="`ExternalIdentityManager.link` when a signed-in user completes a
+ *     link flow; `unlink` from the profile or the Users page"
+ *   retention="`unlink` deletes one row; deleting the user deletes all of its
+ *     rows (`deleteUser` → `removeAllForUser`). A row whose provider instance
+ *     was renamed or removed stays, inert, until someone unlinks it."
+ */
+export declare const USER_EXTERNAL_IDENTITIES_COLLECTION = "user_external_identities";
 /**
  * Declare every auth collection with the typed schema. Called by
  * `LocalAuthAddon.onInitialize` before constructing the per-collection