@camstack/system 1.2.375 → 1.2.377

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { A as MINUTES_PER_DAY, At as expandContainer, C as FieldClaimModeSchema, Cr as isDeviceConfigCap, Ct as deviceStateCapability, Dt as enumerateSchemaFields, En as runtimeStatePolicyFor, Et as enumerateItemArrayFields, Ft as formatMinutes, Kt as legacyAutoLinkIds, Nr as EventCategory, O as LocationIconIdSchema, R as STREAM_PROFILE_META, St as deviceManagerCapability, Xt as locationIconKey, ar as DeviceRole, c as CAP_NAMES_WITH_STATUS, cr as BaseAddon, et as buildStreamParamsConfigSchema, ir as DeviceFeature, jn as siteZoneKey, jr as sleep$1, mr as WELL_KNOWN_TAB_MAP, o as CAMERA_SWITCH_ORDER, or as DeviceType, pt as createDeviceExtensionProvider, sn as normalizeUnit, sr as errMsg, t as ALL_CAPABILITY_DEFINITIONS, un as parseStreamParamsFormPatch, v as DAY_NAMES, vt as defineExtensionSlotProvider, w as FieldClaimSchema, wt as deviceStatusCapability, x as DeviceStatusSchema, xt as deviceExtensionCapability } from "../../dist-ZdSg09GJ.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-B4ZeKrbR.mjs";
+import { $ as buildStreamParamsConfigSchema, A as MINUTES_PER_DAY, C as FieldClaimModeSchema, Dn as runtimeStatePolicyFor, Gr as EventCategory, Hr as sleep$1, Kt as legacyAutoLinkIds, L as STREAM_PROFILE_META, Mn as siteZoneKey, Nt as formatMinutes, O as LocationIconIdSchema, Or as isDeviceConfigCap, Ot as expandContainer, Rr as resolveSecretMarkers, St as deviceStatusCapability, Tt as enumerateSchemaFields, Vr as secretTreeFromPaths, Wr as transformSecretWrite, Xt as locationIconKey, ar as DeviceFeature, bt as deviceManagerCapability, c as CAP_NAMES_WITH_STATUS, cn as normalizeUnit, cr as errMsg, dn as parseStreamParamsFormPatch, dt as createDeviceExtensionProvider, gr as WELL_KNOWN_TAB_MAP, gt as defineExtensionSlotProvider, lr as BaseAddon, o as CAMERA_SWITCH_ORDER, or as DeviceRole, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, v as DAY_NAMES, w as FieldClaimSchema, wt as enumerateItemArrayFields, x as DeviceStatusSchema, xr as collectZodSecretPaths, xt as deviceStateCapability, yt as deviceExtensionCapability } from "../../dist-BWNoS-1S.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-iGcmzwLV.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
@@ -391,6 +391,13 @@ function isDeviceRole(value) {
 function toDeviceRole(value) {
 	return value != null && isDeviceRole(value) ? value : null;
 }
+/** The secret paths a live device's config schema declares (D783), as a spreadable field. */
+function liveSecretConfigPaths(device) {
+	const schema = device.config?.schema;
+	if (schema === void 0 || schema === null || typeof schema !== "object") return {};
+	const paths = collectZodSecretPaths(schema);
+	return paths.length > 0 ? { secretConfigPaths: [...paths] } : {};
+}
 function toDeviceInfo(addonId, device, metadata = null, metaRow = null) {
 	const configValues = {};
 	for (const entry of device.config.entries()) configValues[entry.key] = entry.value;
@@ -414,6 +421,7 @@ function toDeviceInfo(addonId, device, metadata = null, metaRow = null) {
 		features: device.features.length > 0 ? [...device.features] : persistedFeatures(metaRow?.features),
 		isCamera: isCameraDevice(device),
 		config: configValues,
+		...liveSecretConfigPaths(device),
 		metadata,
 		...metaRow?.integrationId !== void 0 ? { integrationId: metaRow.integrationId } : {},
 		...metaRow?.linkDeviceId !== void 0 ? { linkDeviceId: metaRow.linkDeviceId } : {},
@@ -2486,6 +2494,24 @@ function persistedOnlineFallback(input) {
 	return Object.keys(input.config ?? {}).length > 0;
 }
 //#endregion
+//#region src/builtins/device-manager/secret-config-paths.ts
+function createSecretConfigPathRegistry() {
+	const byDevice = /* @__PURE__ */ new Map();
+	return {
+		get: (deviceId) => byDevice.get(deviceId),
+		set: (deviceId, paths) => {
+			byDevice.set(deviceId, Object.freeze([...new Set(paths)]));
+		},
+		delete: (deviceId) => {
+			byDevice.delete(deviceId);
+		}
+	};
+}
+/** `{ secretConfigPaths }` when any are known, `{}` otherwise — spread into a `DeviceInfo`. */
+function secretConfigPathsField(paths) {
+	return paths !== void 0 && paths.length > 0 ? { secretConfigPaths: [...paths] } : {};
+}
+//#endregion
 //#region src/builtins/device-manager/device-queries.ts
 /**
 * The ORIGINATING addon id off a cap-channel call's `args`, or `undefined`.
@@ -2624,6 +2650,7 @@ async function listAll(pctx, input) {
 			features: persistedFeatures(m.features),
 			isCamera: persistedIsCamera(persistedType),
 			config: persistedConfig ?? {},
+			...secretConfigPathsField(pctx.secretConfigPaths.get(m.id)),
 			metadata,
 			...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
 			...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
@@ -2673,6 +2700,7 @@ async function getDevice(pctx, input) {
 		features: persistedFeatures(m.features),
 		isCamera: persistedIsCamera(m.type),
 		config: persistedConfig ?? {},
+		...secretConfigPathsField(pctx.secretConfigPaths.get(deviceId)),
 		metadata,
 		...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
 		...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
@@ -2749,6 +2777,7 @@ function projectChildren(pctx, parentDeviceId, ownerAddonId, childRows, liveChil
 			features: persistedFeatures(m.features),
 			isCamera: persistedIsCamera(m.type),
 			config: persistedConfig,
+			...secretConfigPathsField(pctx.secretConfigPaths.get(m.id)),
 			metadata,
 			...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
 			...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
@@ -5068,6 +5097,69 @@ async function swapHardwareState(settings, sourceId, targetId) {
 	};
 }
 //#endregion
+//#region src/builtins/device-manager/device-config-secrets.ts
+/**
+* The device-config door of the keychain (D787) — device CONNECTION config
+* (camera passwords, controller API keys) lives in device-manager's per-device
+* store, written by the driver's `persistConfig` and read back by its
+* `loadConfig`. Resolving HERE, at the door, means no driver ever sees a
+* marker and no driver has to change.
+*
+* - WRITE: the paths the device's own schema declares secret (D783:
+*   `secretConfigPaths`, from the persist call or from its last
+*   `registerDevice`) go through the keychain save path, owned by the DRIVER
+*   addon (`device/<id>` scope). A value equal to an inline pre-keychain one
+*   stays inline (no silent migration); `''` keeps.
+* - READ: every marker in the stored blob is resolved for the driver; one that
+*   cannot be is LEFT OUT (the driver's schema default applies) and logged by
+*   ref — never answered as `''`, never written back.
+*
+* device-manager runs in hub-main, so it acts for the driver through
+* `ctx.secrets.forOwner` — the in-process delegate no forked addon has.
+*/
+function ownerSecrets(ctx, ownerAddonId) {
+	const forOwner = ctx.secrets?.forOwner ?? null;
+	return forOwner === null ? null : forOwner(ownerAddonId);
+}
+/** Persist a device config patch with its declared secrets kept in the keychain. */
+async function persistDeviceConfigWithSecrets(deps, input) {
+	const secrets = ownerSecrets(deps.ctx, input.ownerAddonId);
+	const tree = secretTreeFromPaths(input.secretPaths);
+	if (secrets === null || tree.size === 0) return deps.write(input.data);
+	const stored = await deps.readStored();
+	const result = await transformSecretWrite({
+		tree,
+		secrets,
+		patch: input.data,
+		stored,
+		scope: {
+			kind: "device",
+			deviceId: input.deviceId
+		},
+		operatorWrite: input.operatorWrite
+	});
+	if (Object.keys(result.patch).length > 0) await deps.write(result.patch);
+	const { orphaned } = await result.afterWrite();
+	if (orphaned.length > 0) deps.ctx.logger.warn("device config: dropped keychain refs could not be deleted", {
+		tags: { deviceId: input.deviceId },
+		meta: { refs: [...orphaned] }
+	});
+}
+/** A stored device config with its markers resolved for the driver. */
+async function loadDeviceConfigWithSecrets(ctx, input) {
+	const secrets = ownerSecrets(ctx, input.ownerAddonId);
+	if (secrets === null) return input.stored;
+	const { value, unresolved } = await resolveSecretMarkers(input.stored, secrets);
+	if (unresolved.length > 0) ctx.logger.error("device config: secret unavailable — the device starts without it", {
+		tags: { deviceId: input.deviceId },
+		meta: { secrets: unresolved.map((u) => ({
+			ref: u.ref,
+			reason: u.reason
+		})) }
+	});
+	return value;
+}
+//#endregion
 //#region src/builtins/device-manager/location-alignment.ts
 /**
 * Location alignment — closes the RETROACTIVITY hole D252/D329 left open, and
@@ -5542,6 +5634,7 @@ async function registerDevice(pctx, input) {
 		});
 		throw new Error(`[device-manager] registerDevice: device ${id} (${addonId}/${stableId}) was removed — refusing to resurrect it`);
 	}
+	if (Array.isArray(input.secretConfigPaths)) pctx.secretConfigPaths.set(id, input.secretConfigPaths);
 	const { isFirstRegistration, exportFingerprint, fingerprintChanged, inheritedLocation, inheritedDescendantIds, inheritFailed } = await pctx.metaStore.withMetaWriteLock(async () => {
 		const existingRow = await pctx.metaStore.rows.get(id);
 		const existingMeta = existingRow?.meta;
@@ -5688,6 +5781,7 @@ async function removeDevice(pctx, input) {
 			stableId
 		});
 	});
+	pctx.secretConfigPaths.delete(deviceId);
 	await pctx.settings.clearDeviceStore(deviceId);
 	await pctx.host.forgetMirrorDevice(deviceId);
 	await pctx.settings.clearDeviceRuntimeState(deviceId);
@@ -5723,13 +5817,29 @@ async function removeDevice(pctx, input) {
 }
 async function persistConfig(pctx, input) {
 	const { deviceId, data } = input;
-	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] persistConfig: unknown device id=${deviceId}`);
-	await pctx.settings.writeDeviceStore(deviceId, data);
+	const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
+	if (!persisted) throw new Error(`[device-manager] persistConfig: unknown device id=${deviceId}`);
+	await persistDeviceConfigWithSecrets({
+		ctx: pctx.host.ctx,
+		readStored: () => pctx.settings.readDeviceStore(deviceId),
+		write: (patch) => pctx.settings.writeDeviceStore(deviceId, patch)
+	}, {
+		deviceId,
+		ownerAddonId: persisted.addonId,
+		data,
+		secretPaths: input.secretConfigPaths ?? pctx.secretConfigPaths.get(deviceId) ?? [],
+		operatorWrite: typeof Reflect.get(input, "callerAddonId") !== "string"
+	});
 }
 async function loadConfig(pctx, input) {
 	const { deviceId } = input;
-	if (!await pctx.metaStore.resolvePersistedById(deviceId)) return {};
-	return pctx.settings.readDeviceStore(deviceId);
+	const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
+	if (!persisted) return {};
+	return loadDeviceConfigWithSecrets(pctx.host.ctx, {
+		deviceId,
+		ownerAddonId: persisted.addonId,
+		stored: await pctx.settings.readDeviceStore(deviceId)
+	});
 }
 /**
 * Load the operator-organisational meta surface for one device
@@ -9600,6 +9710,8 @@ var DeviceManagerAddon = class extends BaseAddon {
 	* `allocateDeviceId` never consults.
 	*/
 	removalFence = createRemovalFence();
+	/** Declared secret config paths per device, as last registered (D783). */
+	secretConfigPaths = createSecretConfigPathRegistry();
 	/** The runtime-state mirror, asserted present (constructed in onInitialize). */
 	get stateMirror() {
 		if (!this.stateMirrorImpl) throw new Error("DeviceManagerAddon: state mirror accessed before onInitialize");
@@ -9841,6 +9953,7 @@ var DeviceManagerAddon = class extends BaseAddon {
 			bindingsDeps: this.bindingsDeps,
 			migrationGuard: createMigrationGuard(),
 			removalFence: this.removalFence,
+			secretConfigPaths: this.secretConfigPaths,
 			requireDeviceOps,
 			stampIntegrationId: stampIntegrationId$1,
 			get provider() {

package/dist/builtins/device-manager/device-projection.d.ts

@@ -62,6 +62,8 @@ export declare function toDeviceInfo(addonId: string, device: IDevice, metadata?
     primaryChildEntityId?: string | null | undefined;
     linkDeviceId?: number | null | undefined;
     integrationId?: string | undefined;
+    metadata: Record<string, unknown> | null;
+    secretConfigPaths?: string[];
     id: number;
     stableId: string;
     addonId: string;
@@ -76,7 +78,6 @@ export declare function toDeviceInfo(addonId: string, device: IDevice, metadata?
     features: DeviceFeature[];
     isCamera: boolean;
     config: Record<string, unknown>;
-    metadata: Record<string, unknown> | null;
 };
 export declare function resolveDeviceById(registry: IDeviceRegistry, deviceId: number): {
     addonId: string;

package/dist/builtins/device-manager/device-provider-context.d.ts

@@ -6,6 +6,7 @@ import { FieldClaimsIndex } from './field-claims-index.js';
 import { OwnedCaps } from './field-ownership.js';
 import { MigrationGuard } from './migrate-guard.js';
 import { RemovalFence } from './removal-fence.js';
+import { SecretConfigPathRegistry } from './secret-config-paths.js';
 import { SeedMode } from './device-state-mirror.js';
 import { MirrorWriteHold } from './mirror-row-writer.js';
 type IDeviceProviderCap = InferProvider<typeof deviceProviderCapability>;
@@ -85,6 +86,8 @@ export interface ProviderContext {
      *  tears down, which is how a deleted camera came back as a config-less
      *  shell (D376). */
     readonly removalFence: RemovalFence;
+    /** The secret config paths each device declared at `registerDevice` (D783). */
+    readonly secretConfigPaths: SecretConfigPathRegistry;
     /** Resolve the per-device `device-ops` native provider (throws when absent). */
     requireDeviceOps(deviceId: number): IDeviceOpsProvider;
     /** Stamp an integration id onto a device's meta row + emit DeviceMetaChanged. */

package/dist/builtins/device-manager/secret-config-paths.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The secret config paths each device DECLARES (D783) — `connection.password`,
+ * `localKey`, `rows[].token` — as its runner last reported them at
+ * `registerDevice`.
+ *
+ * In memory on purpose: a runner re-registers every device it owns whenever it
+ * (re)starts, and a hub-main restart restarts every runner, so the map refills
+ * on its own. Until a device has registered, its `DeviceInfo` carries no paths
+ * and the non-admin redaction falls back to its keyword backstop — never to
+ * "no redaction". Paths only; never a value.
+ */
+export interface SecretConfigPathRegistry {
+    /** The paths last reported for `deviceId`, or `undefined` when none were. */
+    get(deviceId: number): readonly string[] | undefined;
+    /** Replace the paths for `deviceId` with the runner's latest report. */
+    set(deviceId: number, paths: readonly string[]): void;
+    /** Forget a removed device. */
+    delete(deviceId: number): void;
+}
+export declare function createSecretConfigPathRegistry(): SecretConfigPathRegistry;
+/** `{ secretConfigPaths }` when any are known, `{}` otherwise — spread into a `DeviceInfo`. */
+export declare function secretConfigPathsField(paths: readonly string[] | undefined): {
+    secretConfigPaths?: string[];
+};

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, cr as BaseAddon } from "../../dist-ZdSg09GJ.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.d.ts

@@ -0,0 +1 @@
+export { KeychainAddon, default } from './keychain.addon.js';