@camstack/system 1.2.375 → 1.2.377

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-Bfdgkbq3.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-DlDSoqm1.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
@@ -44,7 +44,8 @@ async function dispatchSettings(addon, addonId, method, args) {
 		case "getGlobalSettings": return typeof addon.getGlobalSettings === "function" ? await addon.getGlobalSettings(args.overlay, args.cap, args.nodeId) ?? null : null;
 		case "updateGlobalSettings":
 			if (typeof addon.updateGlobalSettings !== "function") throw new Error(`child-addon-call: addon "${addonId}" does not implement updateGlobalSettings`);
-			await addon.updateGlobalSettings(args.patch ?? {}, args.nodeId);
+			if (typeof addon.updateGlobalSettingsAsOperator === "function") await addon.updateGlobalSettingsAsOperator(args.patch ?? {}, args.nodeId);
+			else await addon.updateGlobalSettings(args.patch ?? {}, args.nodeId);
 			return { success: true };
 		case "getIntegrationSettings": return typeof addon.getIntegrationSettings === "function" ? await addon.getIntegrationSettings(args.nodeId) ?? null : null;
 		case "getDeviceSettings": return typeof addon.getDeviceSettings === "function" && typeof args.deviceId === "number" ? await addon.getDeviceSettings(args.deviceId) ?? null : null;
@@ -85,7 +86,8 @@ function createChildAddonCallDispatch(deps) {
 				if (typeof action !== "string" || action.length === 0) throw new Error(`child-addon-call: addon "${addonId}" custom call missing action name`);
 				const entry = deps.customActions.resolve(addonId, action);
 				if (entry === null) throw new Error(`child-addon-call: addon "${addonId}" has no custom action "${action}"`);
-				const parsedInput = entry.spec.input.safeParse(call.args);
+				const args = deps.resolveSecretViews !== void 0 ? await deps.resolveSecretViews(addonId, call.args) : call.args;
+				const parsedInput = entry.spec.input.safeParse(args);
 				if (!parsedInput.success) throw new Error(`child-addon-call: addon "${addonId}" custom action "${action}" rejected its input — ` + parsedInput.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; "));
 				const result = await entry.handler(parsedInput.data, call.caller);
 				return entry.spec.output.parse(result);
@@ -529,11 +531,13 @@ async function main() {
 			isProviderOptionalMethod: (capName, method) => (0, _camstack_types_addon.isProviderOptionalMethodName)(capName, method)
 		})
 	});
+	const addonSecrets = /* @__PURE__ */ new Map();
 	udsChildClient.onAddonCall(createChildAddonCallDispatch({
 		getRouteProvider: (addonId) => addonRouteProviders.get(addonId) ?? null,
 		customActions: customActionRegistry,
 		getAddonInstance: (addonId) => loadedAddonInstances.get(addonId) ?? null,
-		getDataPlanes: (addonId) => addonDataPlanes.get(addonId) ?? []
+		getDataPlanes: (addonId) => addonDataPlanes.get(addonId) ?? [],
+		resolveSecretViews: (addonId, args) => (0, _camstack_types_addon.resolveSecretViewsIn)(args, addonSecrets.get(addonId))
 	}));
 	const { logger: runnerLog, control: runnerLogControl } = require_child_cap_dispatch.createUdsLoggerWithControl(udsChildClient, runnerId, nodeId, "addon-runner");
 	udsChildClient.onSetLogLevel((level) => {
@@ -574,6 +578,7 @@ async function main() {
 				addonDataPlanes.set(addonId, endpoints);
 			} }
 		});
+		if (context.secrets !== void 0) addonSecrets.set(spec.addonId, context.secrets);
 		try {
 			const pkgRaw = JSON.parse(node_fs.readFileSync(node_path.join(spec.addonDir, "package.json"), "utf-8"));
 			await require_child_cap_dispatch.installManifestNativeDeps(spec.addonDir, pkgRaw, context.logger);

package/dist/addon-runner.mjs

@@ -1,10 +1,10 @@
-import { $t as RUNNER_RSS_BUDGET_ENV, Ft as resolveAddonClass, H as createUdsLoggerWithControl, Pt as installManifestNativeDeps, U as LocalChildClient, _t as getWorkerNativeCapSnapshot, f as installManifestSystemDeps, fn as startRunnerHeapWatch, g as createUdsAddonContext, gt as getWorkerNativeCapProvider, i as killOwnRunnerGroupAfterParentLoss, n as createChildCapDispatch, p as installManifestPythonDeps, u as startRunnerParentDeathWatchdog, wn as emitHeapDiagnosticReport, xt as validateProviderRegistrations, yt as setWorkerNativeCapsChangeListener } from "./child-cap-dispatch-B9kziY4L.mjs";
+import { Ft as installManifestNativeDeps, H as createUdsLoggerWithControl, It as resolveAddonClass, St as validateProviderRegistrations, U as LocalChildClient, _n as startRunnerHeapWatch, _t as getWorkerNativeCapProvider, bt as setWorkerNativeCapsChangeListener, f as installManifestSystemDeps, g as createUdsAddonContext, i as killOwnRunnerGroupAfterParentLoss, in as RUNNER_RSS_BUDGET_ENV, kn as emitHeapDiagnosticReport, n as createChildCapDispatch, p as installManifestPythonDeps, u as startRunnerParentDeathWatchdog, vt as getWorkerNativeCapSnapshot } from "./child-cap-dispatch-CgmOo0yl.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";
 import { pathToFileURL } from "node:url";
 import * as fs from "node:fs";
-import { ReadinessRegistry, ReadinessTimeoutError, errMsg, isCollectionArrayMethodName, isProviderOptionalMethodName, normalizeAddonInitResult } from "@camstack/types/addon";
+import { ReadinessRegistry, ReadinessTimeoutError, errMsg, isCollectionArrayMethodName, isProviderOptionalMethodName, normalizeAddonInitResult, resolveSecretViewsIn } from "@camstack/types/addon";
 //#region src/kernel/moleculer/child-addon-call-dispatch.ts
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -41,7 +41,8 @@ async function dispatchSettings(addon, addonId, method, args) {
 		case "getGlobalSettings": return typeof addon.getGlobalSettings === "function" ? await addon.getGlobalSettings(args.overlay, args.cap, args.nodeId) ?? null : null;
 		case "updateGlobalSettings":
 			if (typeof addon.updateGlobalSettings !== "function") throw new Error(`child-addon-call: addon "${addonId}" does not implement updateGlobalSettings`);
-			await addon.updateGlobalSettings(args.patch ?? {}, args.nodeId);
+			if (typeof addon.updateGlobalSettingsAsOperator === "function") await addon.updateGlobalSettingsAsOperator(args.patch ?? {}, args.nodeId);
+			else await addon.updateGlobalSettings(args.patch ?? {}, args.nodeId);
 			return { success: true };
 		case "getIntegrationSettings": return typeof addon.getIntegrationSettings === "function" ? await addon.getIntegrationSettings(args.nodeId) ?? null : null;
 		case "getDeviceSettings": return typeof addon.getDeviceSettings === "function" && typeof args.deviceId === "number" ? await addon.getDeviceSettings(args.deviceId) ?? null : null;
@@ -82,7 +83,8 @@ function createChildAddonCallDispatch(deps) {
 				if (typeof action !== "string" || action.length === 0) throw new Error(`child-addon-call: addon "${addonId}" custom call missing action name`);
 				const entry = deps.customActions.resolve(addonId, action);
 				if (entry === null) throw new Error(`child-addon-call: addon "${addonId}" has no custom action "${action}"`);
-				const parsedInput = entry.spec.input.safeParse(call.args);
+				const args = deps.resolveSecretViews !== void 0 ? await deps.resolveSecretViews(addonId, call.args) : call.args;
+				const parsedInput = entry.spec.input.safeParse(args);
 				if (!parsedInput.success) throw new Error(`child-addon-call: addon "${addonId}" custom action "${action}" rejected its input — ` + parsedInput.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; "));
 				const result = await entry.handler(parsedInput.data, call.caller);
 				return entry.spec.output.parse(result);
@@ -526,11 +528,13 @@ async function main() {
 			isProviderOptionalMethod: (capName, method) => isProviderOptionalMethodName(capName, method)
 		})
 	});
+	const addonSecrets = /* @__PURE__ */ new Map();
 	udsChildClient.onAddonCall(createChildAddonCallDispatch({
 		getRouteProvider: (addonId) => addonRouteProviders.get(addonId) ?? null,
 		customActions: customActionRegistry,
 		getAddonInstance: (addonId) => loadedAddonInstances.get(addonId) ?? null,
-		getDataPlanes: (addonId) => addonDataPlanes.get(addonId) ?? []
+		getDataPlanes: (addonId) => addonDataPlanes.get(addonId) ?? [],
+		resolveSecretViews: (addonId, args) => resolveSecretViewsIn(args, addonSecrets.get(addonId))
 	}));
 	const { logger: runnerLog, control: runnerLogControl } = createUdsLoggerWithControl(udsChildClient, runnerId, nodeId, "addon-runner");
 	udsChildClient.onSetLogLevel((level) => {
@@ -571,6 +575,7 @@ async function main() {
 				addonDataPlanes.set(addonId, endpoints);
 			} }
 		});
+		if (context.secrets !== void 0) addonSecrets.set(spec.addonId, context.secrets);
 		try {
 			const pkgRaw = JSON.parse(fs.readFileSync(path$1.join(spec.addonDir, "package.json"), "utf-8"));
 			await installManifestNativeDeps(spec.addonDir, pkgRaw, context.logger);

package/dist/addon-utils.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-Cek0wNdY.js");
-const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-CpEH3CoV.js");
+const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-DuOn8H1n.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 const require_snapshot_courtesy = require("./snapshot-courtesy-D_C5-nC0.js");
 exports.COURTESY_DEFAULT_WIDTH = require_snapshot_courtesy.COURTESY_DEFAULT_WIDTH;

package/dist/addon-utils.mjs

@@ -1,4 +1,4 @@
-import { C as resolveFormatRevision, S as isModelDownloaded, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, f as ModelDownloadHttpError, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, t as STALL_REPORT_MS, v as ensureModel, x as isModelDownloadHttpError } from "./event-loop-stall-monitor-DKcYBHdH.mjs";
+import { C as resolveFormatRevision, S as isModelDownloaded, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, f as ModelDownloadHttpError, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, t as STALL_REPORT_MS, v as ensureModel, x as isModelDownloadHttpError } from "./event-loop-stall-monitor-ClPhfx7Y.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg, t as COURTESY_DEFAULT_WIDTH } from "./snapshot-courtesy-CyFs1M3I.mjs";
 export { COURTESY_DEFAULT_WIDTH, CustomActionRegistry, ModelDownloadHttpError, ModelDownloadService, STALL_REPORT_MS, STALL_TICK_MS, adoptModelRevisions, attributeStall, collectModelFiles, contentTypeFor, courtesyCacheKey, createFileDataPlaneHandler, deleteModelFromDisk, downloadFile, ensureModel, getModelFilePath, isModelDownloadHttpError, isModelDownloaded, parseRangeHeader, renderCourtesyJpeg, renderCourtesyOverlayJpeg, resolveFormatRevision, startEventLoopStallMonitor };

package/dist/auth/external-identity-manager.d.ts

@@ -0,0 +1,43 @@
+import { SettingsStoreClient } from '@camstack/types';
+export interface ExternalIdentityRecord {
+    readonly provider: string;
+    readonly subject: string;
+    /** Verified `iss` the identity was linked under. */
+    readonly issuer: string;
+    readonly userId: string;
+    readonly label?: string;
+    readonly linkedAt: number;
+}
+export interface ExternalIdentityKey {
+    readonly provider: string;
+    readonly subject: string;
+}
+/** The identity is already linked to a different user. */
+export declare class ExternalIdentityConflictError extends Error {
+    constructor();
+}
+export declare class ExternalIdentityManager {
+    private readonly store;
+    constructor(store: SettingsStoreClient);
+    private find;
+    /** The link of `(provider, subject)`, or `null`. */
+    findLink(provider: string, subject: string): Promise<ExternalIdentityRecord | null>;
+    /** The user `(provider, subject)` is linked to, or `null`. */
+    findUser(provider: string, subject: string): Promise<string | null>;
+    listForUser(userId: string): Promise<readonly ExternalIdentityRecord[]>;
+    /**
+     * Link `(provider, subject)` to `userId`. Idempotent for the same user;
+     * {@link ExternalIdentityConflictError} when another user holds it.
+     */
+    link(input: ExternalIdentityKey & {
+        userId: string;
+        issuer: string;
+        label?: string;
+    }): Promise<void>;
+    /** Remove one link of `userId`; `false` when that user did not hold it. */
+    unlink(input: ExternalIdentityKey & {
+        userId: string;
+    }): Promise<boolean>;
+    /** Delete every link of a user being deleted. Returns how many were removed. */
+    removeAllForUser(userId: string): Promise<number>;
+}

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { G as addonPagesCapability, Nr as EventCategory, cr as BaseAddon, sr as errMsg } from "../../dist-ZdSg09GJ.mjs";
+import { Gr as EventCategory, W as addonPagesCapability, cr as errMsg, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Nr as EventCategory, cr as BaseAddon, q as addonWidgetsCapability, sr as errMsg } from "../../dist-ZdSg09GJ.mjs";
+import { Gr as EventCategory, K as addonWidgetsCapability, cr as errMsg, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { J as alertsCapability, Nr as EventCategory, cr as BaseAddon, n as AlertSchema, sr as errMsg, vr as createEvent } from "../../dist-ZdSg09GJ.mjs";
+import { Gr as EventCategory, Sr as createEvent, cr as errMsg, lr as BaseAddon, n as AlertSchema, q as alertsCapability } from "../../dist-BWNoS-1S.mjs";
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { Nr as EventCategory, S as FIRST_LEVEL_MACRO_CLASSES, Z as bareAddonId, cr as BaseAddon, hn as ptzAutotrackCapability, sr as errMsg, wr as isEvent } from "../../dist-ZdSg09GJ.mjs";
+import { Gr as EventCategory, S as FIRST_LEVEL_MACRO_CLASSES, X as bareAddonId, cr as errMsg, gn as ptzAutotrackCapability, kr as isEvent, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Fn as storageOccupancyCapability, Mr as toNodeId, Nr as EventCategory, Tr as nodePin, X as backupCapability, cr as BaseAddon, g as DATABASE_SNAPSHOT_SUFFIX, tn as mayWriteToLocation } from "../../dist-ZdSg09GJ.mjs";
+import { Gr as EventCategory, In as storageOccupancyCapability, Ur as toNodeId, Y as backupCapability, g as DATABASE_SNAPSHOT_SUFFIX, jr as nodePin, lr as BaseAddon, nn as mayWriteToLocation } from "../../dist-BWNoS-1S.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let zod = require("zod");
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/calendars/calendars.addon.mjs

@@ -1,4 +1,4 @@
-import { cr as BaseAddon, p as CalendarPreferencesSchema, tt as calendarsCapability } from "../../dist-ZdSg09GJ.mjs";
+import { et as calendarsCapability, lr as BaseAddon, p as CalendarPreferencesSchema } from "../../dist-BWNoS-1S.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { z } from "zod";
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/camera-grid/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 let zod = require("zod");
 let _camstack_types_node = require("@camstack/types/node");
 let node_path = require("node:path");

package/dist/builtins/camera-grid/index.mjs

@@ -1,4 +1,4 @@
-import { Ln as streamCatalogCapability, M as MOTION_CLOSE_AFTER_MS, Mn as snapshotCapability, Nr as EventCategory, Sr as hydrateSchema, an as motionCapability, b as DeclaredDevices, cr as BaseAddon, gt as declarationOwnerNodeId, i as BaseDevice, ir as DeviceFeature, nn as memoizePinnedFfmpeg, nt as cameraGridLayoutCapability, or as DeviceType, qn as buildFfmpegArgs, sr as errMsg, vr as createEvent, y as DERIVED_CAMERA_SILENCED_CAP_NAMES } from "../../dist-ZdSg09GJ.mjs";
+import { Dr as hydrateSchema, Gr as EventCategory, Jn as buildFfmpegArgs, M as MOTION_CLOSE_AFTER_MS, Nn as snapshotCapability, Rn as streamCatalogCapability, Sr as createEvent, ar as DeviceFeature, b as DeclaredDevices, cr as errMsg, i as BaseDevice, lr as BaseAddon, mt as declarationOwnerNodeId, on as motionCapability, rn as memoizePinnedFfmpeg, sr as DeviceType, tt as cameraGridLayoutCapability, y as DERIVED_CAMERA_SILENCED_CAP_NAMES } from "../../dist-BWNoS-1S.mjs";
 import { z } from "zod";
 import { FfmpegProcess } from "@camstack/types/node";
 import { join } from "node:path";

package/dist/builtins/composer/composer.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
-const require_composition_sources = require("../../composition-sources-DYlXX2qW.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
+const require_composition_sources = require("../../composition-sources-BNyXPSs_.js");
 let zod = require("zod");
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { $ as buildCapabilityLookup, $n as compositionSliceKey, Jn as cloneStatefulExpressionMemory, Kn as COMPOSER_ADDON_ID, Nr as EventCategory, Ot as evaluateCompositionField, Qn as compositionItemFieldPath, Xn as composedDeviceStableId, Yn as composedDeviceRef, Zn as compositionFeatureEnabled, at as composerCapability, b as DeclaredDevices, cr as BaseAddon, er as compositionSourceKey, fn as planComposition, i as BaseDevice, jt as expressionContainsBuiltinCall, l as COMPOSED_ITEM_FIXED_FIELDS, nr as disarmRoseMemory, or as DeviceType, ot as compositionFieldKey, rr as toExpressionValue, sr as errMsg, t as ALL_CAPABILITY_DEFINITIONS, tr as createStatefulExpressionMemory, vr as createEvent } from "../../dist-ZdSg09GJ.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-BfZgiTYD.mjs";
+import { $n as compositionItemFieldPath, Et as evaluateCompositionField, Gr as EventCategory, Q as buildCapabilityLookup, Qn as compositionFeatureEnabled, Sr as createEvent, Xn as composedDeviceRef, Yn as cloneStatefulExpressionMemory, Zn as composedDeviceStableId, b as DeclaredDevices, cr as errMsg, er as compositionSliceKey, i as BaseDevice, ir as toExpressionValue, it as compositionFieldKey, kt as expressionContainsBuiltinCall, l as COMPOSED_ITEM_FIXED_FIELDS, lr as BaseAddon, nr as createStatefulExpressionMemory, pn as planComposition, qn as COMPOSER_ADDON_ID, rr as disarmRoseMemory, rt as composerCapability, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey } from "../../dist-BWNoS-1S.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-D39bl0nP.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, cr as BaseAddon } from "../../dist-ZdSg09GJ.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
-const require_composition_sources = require("../../composition-sources-DYlXX2qW.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
+const require_composition_sources = require("../../composition-sources-BNyXPSs_.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
-import { $ as buildCapabilityLookup, Bn as validateComposition, Sr as hydrateSchema, Yn as composedDeviceRef, _n as replacedFieldKeys, b as DeclaredDevices, bn as resolveCoreBlockEntry, bt as describeComposableCaps, cr as BaseAddon, ct as coreBlockAddonId, d as CORE_BLOCKS_ADDON_ID, dt as coreBlockSourceKind, er as compositionSourceKey, f as CORE_BLOCK_ADDON_PREFIX, fn as planComposition, ft as coreBlocksCapability, lt as coreBlockComposition, m as CoreBlockSchema, on as normalizeCoreBlockWrite, sr as errMsg, st as compositionSourceRefs, t as ALL_CAPABILITY_DEFINITIONS, u as COMPOSER_RUNNER_ID, ut as coreBlockIdFromAddonId, xn as resolveCoreBlockFiles } from "../../dist-ZdSg09GJ.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-BfZgiTYD.mjs";
+import { Dr as hydrateSchema, Q as buildCapabilityLookup, Sn as resolveCoreBlockFiles, Vn as validateComposition, Xn as composedDeviceRef, at as compositionSourceRefs, b as DeclaredDevices, cr as errMsg, ct as coreBlockIdFromAddonId, d as CORE_BLOCKS_ADDON_ID, f as CORE_BLOCK_ADDON_PREFIX, lr as BaseAddon, lt as coreBlockSourceKind, m as CoreBlockSchema, ot as coreBlockAddonId, pn as planComposition, sn as normalizeCoreBlockWrite, st as coreBlockComposition, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey, u as COMPOSER_RUNNER_ID, ut as coreBlocksCapability, vn as replacedFieldKeys, vt as describeComposableCaps, xn as resolveCoreBlockEntry } from "../../dist-BWNoS-1S.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-D39bl0nP.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { customizationBlockName } from "@camstack/types/node";

package/dist/builtins/device-manager/device-config-secrets.d.ts

@@ -0,0 +1,21 @@
+import { AddonContext } from '@camstack/types';
+export interface DeviceConfigSecretDeps {
+    readonly ctx: AddonContext;
+    readonly readStored: () => Promise<Record<string, unknown>>;
+    readonly write: (patch: Record<string, unknown>) => Promise<void>;
+}
+/** Persist a device config patch with its declared secrets kept in the keychain. */
+export declare function persistDeviceConfigWithSecrets(deps: DeviceConfigSecretDeps, input: {
+    readonly deviceId: number;
+    readonly ownerAddonId: string;
+    readonly data: Record<string, unknown>;
+    readonly secretPaths: readonly string[];
+    /** The write was made by the operator (no driver stamped it). */
+    readonly operatorWrite: boolean;
+}): Promise<void>;
+/** A stored device config with its markers resolved for the driver. */
+export declare function loadDeviceConfigWithSecrets(ctx: AddonContext, input: {
+    readonly deviceId: number;
+    readonly ownerAddonId: string;
+    readonly stored: Record<string, unknown>;
+}): Promise<Record<string, unknown>>;

package/dist/builtins/device-manager/device-manager.addon.d.ts

@@ -69,6 +69,8 @@ export declare class DeviceManagerAddon extends BaseAddon {
      * `allocateDeviceId` never consults.
      */
     private readonly removalFence;
+    /** Declared secret config paths per device, as last registered (D783). */
+    private readonly secretConfigPaths;
     /** The runtime-state mirror, asserted present (constructed in onInitialize). */
     private get stateMirror();
     /**

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-CcWvdy6u.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-CDyOGAje.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -396,6 +396,13 @@ function isDeviceRole(value) {
 function toDeviceRole(value) {
 	return value != null && isDeviceRole(value) ? value : null;
 }
+/** The secret paths a live device's config schema declares (D783), as a spreadable field. */
+function liveSecretConfigPaths(device) {
+	const schema = device.config?.schema;
+	if (schema === void 0 || schema === null || typeof schema !== "object") return {};
+	const paths = require_dist.collectZodSecretPaths(schema);
+	return paths.length > 0 ? { secretConfigPaths: [...paths] } : {};
+}
 function toDeviceInfo(addonId, device, metadata = null, metaRow = null) {
 	const configValues = {};
 	for (const entry of device.config.entries()) configValues[entry.key] = entry.value;
@@ -419,6 +426,7 @@ function toDeviceInfo(addonId, device, metadata = null, metaRow = null) {
 		features: device.features.length > 0 ? [...device.features] : persistedFeatures(metaRow?.features),
 		isCamera: isCameraDevice(device),
 		config: configValues,
+		...liveSecretConfigPaths(device),
 		metadata,
 		...metaRow?.integrationId !== void 0 ? { integrationId: metaRow.integrationId } : {},
 		...metaRow?.linkDeviceId !== void 0 ? { linkDeviceId: metaRow.linkDeviceId } : {},
@@ -2491,6 +2499,24 @@ function persistedOnlineFallback(input) {
 	return Object.keys(input.config ?? {}).length > 0;
 }
 //#endregion
+//#region src/builtins/device-manager/secret-config-paths.ts
+function createSecretConfigPathRegistry() {
+	const byDevice = /* @__PURE__ */ new Map();
+	return {
+		get: (deviceId) => byDevice.get(deviceId),
+		set: (deviceId, paths) => {
+			byDevice.set(deviceId, Object.freeze([...new Set(paths)]));
+		},
+		delete: (deviceId) => {
+			byDevice.delete(deviceId);
+		}
+	};
+}
+/** `{ secretConfigPaths }` when any are known, `{}` otherwise — spread into a `DeviceInfo`. */
+function secretConfigPathsField(paths) {
+	return paths !== void 0 && paths.length > 0 ? { secretConfigPaths: [...paths] } : {};
+}
+//#endregion
 //#region src/builtins/device-manager/device-queries.ts
 /**
 * The ORIGINATING addon id off a cap-channel call's `args`, or `undefined`.
@@ -2629,6 +2655,7 @@ async function listAll(pctx, input) {
 			features: persistedFeatures(m.features),
 			isCamera: persistedIsCamera(persistedType),
 			config: persistedConfig ?? {},
+			...secretConfigPathsField(pctx.secretConfigPaths.get(m.id)),
 			metadata,
 			...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
 			...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
@@ -2678,6 +2705,7 @@ async function getDevice(pctx, input) {
 		features: persistedFeatures(m.features),
 		isCamera: persistedIsCamera(m.type),
 		config: persistedConfig ?? {},
+		...secretConfigPathsField(pctx.secretConfigPaths.get(deviceId)),
 		metadata,
 		...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
 		...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
@@ -2754,6 +2782,7 @@ function projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChil
 			features: persistedFeatures(m.features),
 			isCamera: persistedIsCamera(m.type),
 			config: persistedConfig,
+			...secretConfigPathsField(pctx.secretConfigPaths.get(m.id)),
 			metadata,
 			...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
 			...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
@@ -5073,6 +5102,69 @@ async function swapHardwareState(settings, sourceId, targetId) {
 	};
 }
 //#endregion
+//#region src/builtins/device-manager/device-config-secrets.ts
+/**
+* The device-config door of the keychain (D787) — device CONNECTION config
+* (camera passwords, controller API keys) lives in device-manager's per-device
+* store, written by the driver's `persistConfig` and read back by its
+* `loadConfig`. Resolving HERE, at the door, means no driver ever sees a
+* marker and no driver has to change.
+*
+* - WRITE: the paths the device's own schema declares secret (D783:
+*   `secretConfigPaths`, from the persist call or from its last
+*   `registerDevice`) go through the keychain save path, owned by the DRIVER
+*   addon (`device/<id>` scope). A value equal to an inline pre-keychain one
+*   stays inline (no silent migration); `''` keeps.
+* - READ: every marker in the stored blob is resolved for the driver; one that
+*   cannot be is LEFT OUT (the driver's schema default applies) and logged by
+*   ref — never answered as `''`, never written back.
+*
+* device-manager runs in hub-main, so it acts for the driver through
+* `ctx.secrets.forOwner` — the in-process delegate no forked addon has.
+*/
+function ownerSecrets(ctx, ownerAddonId) {
+	const forOwner = ctx.secrets?.forOwner ?? null;
+	return forOwner === null ? null : forOwner(ownerAddonId);
+}
+/** Persist a device config patch with its declared secrets kept in the keychain. */
+async function persistDeviceConfigWithSecrets(deps, input) {
+	const secrets = ownerSecrets(deps.ctx, input.ownerAddonId);
+	const tree = require_dist.secretTreeFromPaths(input.secretPaths);
+	if (secrets === null || tree.size === 0) return deps.write(input.data);
+	const stored = await deps.readStored();
+	const result = await require_dist.transformSecretWrite({
+		tree,
+		secrets,
+		patch: input.data,
+		stored,
+		scope: {
+			kind: "device",
+			deviceId: input.deviceId
+		},
+		operatorWrite: input.operatorWrite
+	});
+	if (Object.keys(result.patch).length > 0) await deps.write(result.patch);
+	const { orphaned } = await result.afterWrite();
+	if (orphaned.length > 0) deps.ctx.logger.warn("device config: dropped keychain refs could not be deleted", {
+		tags: { deviceId: input.deviceId },
+		meta: { refs: [...orphaned] }
+	});
+}
+/** A stored device config with its markers resolved for the driver. */
+async function loadDeviceConfigWithSecrets(ctx, input) {
+	const secrets = ownerSecrets(ctx, input.ownerAddonId);
+	if (secrets === null) return input.stored;
+	const { value, unresolved } = await require_dist.resolveSecretMarkers(input.stored, secrets);
+	if (unresolved.length > 0) ctx.logger.error("device config: secret unavailable — the device starts without it", {
+		tags: { deviceId: input.deviceId },
+		meta: { secrets: unresolved.map((u) => ({
+			ref: u.ref,
+			reason: u.reason
+		})) }
+	});
+	return value;
+}
+//#endregion
 //#region src/builtins/device-manager/location-alignment.ts
 /**
 * Location alignment — closes the RETROACTIVITY hole D252/D329 left open, and
@@ -5547,6 +5639,7 @@ async function registerDevice(pctx, input) {
 		});
 		throw new Error(`[device-manager] registerDevice: device ${id} (${addonId}/${stableId}) was removed — refusing to resurrect it`);
 	}
+	if (Array.isArray(input.secretConfigPaths)) pctx.secretConfigPaths.set(id, input.secretConfigPaths);
 	const { isFirstRegistration, exportFingerprint, fingerprintChanged, inheritedLocation, inheritedDescendantIds, inheritFailed } = await pctx.metaStore.withMetaWriteLock(async () => {
 		const existingRow = await pctx.metaStore.rows.get(id);
 		const existingMeta = existingRow?.meta;
@@ -5693,6 +5786,7 @@ async function removeDevice(pctx, input) {
 			stableId
 		});
 	});
+	pctx.secretConfigPaths.delete(deviceId);
 	await pctx.settings.clearDeviceStore(deviceId);
 	await pctx.host.forgetMirrorDevice(deviceId);
 	await pctx.settings.clearDeviceRuntimeState(deviceId);
@@ -5728,13 +5822,29 @@ async function removeDevice(pctx, input) {
 }
 async function persistConfig(pctx, input) {
 	const { deviceId, data } = input;
-	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] persistConfig: unknown device id=${deviceId}`);
-	await pctx.settings.writeDeviceStore(deviceId, data);
+	const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
+	if (!persisted) throw new Error(`[device-manager] persistConfig: unknown device id=${deviceId}`);
+	await persistDeviceConfigWithSecrets({
+		ctx: pctx.host.ctx,
+		readStored: () => pctx.settings.readDeviceStore(deviceId),
+		write: (patch) => pctx.settings.writeDeviceStore(deviceId, patch)
+	}, {
+		deviceId,
+		ownerAddonId: persisted.addonId,
+		data,
+		secretPaths: input.secretConfigPaths ?? pctx.secretConfigPaths.get(deviceId) ?? [],
+		operatorWrite: typeof Reflect.get(input, "callerAddonId") !== "string"
+	});
 }
 async function loadConfig(pctx, input) {
 	const { deviceId } = input;
-	if (!await pctx.metaStore.resolvePersistedById(deviceId)) return {};
-	return pctx.settings.readDeviceStore(deviceId);
+	const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
+	if (!persisted) return {};
+	return loadDeviceConfigWithSecrets(pctx.host.ctx, {
+		deviceId,
+		ownerAddonId: persisted.addonId,
+		stored: await pctx.settings.readDeviceStore(deviceId)
+	});
 }
 /**
 * Load the operator-organisational meta surface for one device
@@ -9605,6 +9715,8 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 	* `allocateDeviceId` never consults.
 	*/
 	removalFence = createRemovalFence();
+	/** Declared secret config paths per device, as last registered (D783). */
+	secretConfigPaths = createSecretConfigPathRegistry();
 	/** The runtime-state mirror, asserted present (constructed in onInitialize). */
 	get stateMirror() {
 		if (!this.stateMirrorImpl) throw new Error("DeviceManagerAddon: state mirror accessed before onInitialize");
@@ -9846,6 +9958,7 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 			bindingsDeps: this.bindingsDeps,
 			migrationGuard: createMigrationGuard(),
 			removalFence: this.removalFence,
+			secretConfigPaths: this.secretConfigPaths,
 			requireDeviceOps,
 			stampIntegrationId: stampIntegrationId$1,
 			get provider() {