@camstack/system 1.2.379 → 1.2.381

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-YOOKLA3v.js");
+const require_dist = require("../../dist-BugrtARh.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-DCuetwOt.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -1033,6 +1033,105 @@ function mergeAggregates(parts) {
 	return out;
 }
 //#endregion
+//#region src/builtins/device-manager/device-form-secrets.ts
+/**
+* A driver's device-settings form, kept on the keychain side of the wire
+* (D787 / D789 for device forms).
+*
+* A driver hydrates its own form from the config `loadConfig` RESOLVED for it,
+* so a camera password reaches the form as plaintext even though the stored
+* blob holds a keychain marker. This module closes that in ONE place — the
+* device-manager aggregate every device form goes through — for every driver:
+*
+*  - READ ({@link viewStoredSecrets}): a form field whose key names a stored
+*    MARKER (a declared `secretConfigPaths` entry, or a field secret by type)
+*    is handed the marker's VIEW instead of the driver's plaintext. A value
+*    that is still inline plaintext in the blob (not migrated) is left as the
+*    driver hydrated it: there is nothing to reveal it by.
+*  - WRITE ({@link applyDriverFormPatch}): the form sends the view back for an
+*    untouched field and `{ $secretClear: true }` for an explicit clear. The
+*    driver understands neither (its schema wants a string), so a view is
+*    dropped from the driver's patch (KEEP — the driver still holds the
+*    resolved value) and a clear reaches the driver as `''` while the stored
+*    marker is removed at the keychain door. A typed value passes through and
+*    the driver's own persist stores it in the keychain.
+*
+* Top-level keys only: a driver form's field key is its config key for every
+* declared device secret today (`password`, `apiKey`, `localKey`). A nested or
+* per-row path (`connection.password`, `rows[].pin`) is not mapped onto a form
+* field and keeps the driver's hydration.
+*/
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The declared paths that name a top-level config key. */
+function topLevelKeys(paths) {
+	return new Set(paths.filter((p) => p.length > 0 && !p.includes(".") && !p.includes("[")));
+}
+function viewField(field, stored, declared) {
+	if (!isRecord$2(field)) return field;
+	const nested = field["fields"];
+	if (Array.isArray(nested)) return {
+		...field,
+		fields: nested.map((f) => viewField(f, stored, declared))
+	};
+	const tabs = field["tabs"];
+	if (Array.isArray(tabs)) return {
+		...field,
+		tabs: tabs.map((tab) => isRecord$2(tab) && Array.isArray(tab["fields"]) ? {
+			...tab,
+			fields: tab["fields"].map((f) => viewField(f, stored, declared))
+		} : tab)
+	};
+	const key = field["key"];
+	if (typeof key !== "string" || !("value" in field)) return field;
+	const marker = stored[key];
+	if (!require_dist.isSecretMarker(marker)) return field;
+	const secretByType = require_dist.isKeychainStoredField(field);
+	if (!secretByType && !declared.has(key)) return field;
+	const type = secretByType ? field["type"] : "password";
+	return {
+		...field,
+		type,
+		value: require_dist.toSecretFieldView(marker)
+	};
+}
+/**
+* The driver's hydrated sections with every keychain-stored secret replaced
+* by its view. Returns the input unchanged when the blob holds no marker.
+*/
+function viewStoredSecrets(sections, stored, declaredPaths) {
+	if (!Object.values(stored).some(require_dist.isSecretMarker)) return sections;
+	const declared = topLevelKeys(declaredPaths);
+	return sections.map((section) => ({
+		...section,
+		fields: section.fields.map((f) => viewField(f, stored, declared))
+	}));
+}
+/** Split a device-settings form patch (see the module doc). */
+function splitDriverFormPatch(patch) {
+	const driverPatch = {};
+	const clearKeys = [];
+	for (const [key, value] of Object.entries(patch)) if (require_dist.isSecretClear(value)) {
+		driverPatch[key] = "";
+		clearKeys.push(key);
+	} else if (!require_dist.isSecretMarkerLike(value)) driverPatch[key] = value;
+	return {
+		driverPatch,
+		clearKeys
+	};
+}
+/**
+* Apply a device-settings form patch: the driver gets plain values only, then
+* an explicit clear removes the stored secret at the keychain door (after the
+* driver's own persist, whose `''` the door reads as KEEP).
+*/
+async function applyDriverFormPatch(input) {
+	const { driverPatch, clearKeys } = splitDriverFormPatch(input.patch);
+	if (Object.keys(driverPatch).length > 0) await input.applyToDriver(driverPatch);
+	if (clearKeys.length > 0) await input.clearSecrets(clearKeys);
+}
+//#endregion
 //#region src/builtins/device-manager/stale-wrapper-activations.ts
 /**
 * A stored wrapper activation that names a cap with NO wrapper any more.
@@ -3451,6 +3550,25 @@ function refusedLinkedPicks(params) {
 //#endregion
 //#region src/builtins/device-manager/device-aggregation.ts
 /**
+* A driver's hydrated sections as the browser may see them: every secret the
+* keychain stores is its VIEW, never the plaintext the driver was handed by
+* `loadConfig`. An unreadable blob withholds nothing new — the non-admin
+* redaction still runs at the transport — but it is logged.
+*/
+async function driverSectionsWithSecretViews(deps, deviceId, sections) {
+	const door = deps.deviceFormSecrets;
+	if (!door) return sections;
+	try {
+		return viewStoredSecrets(sections, await door.readStored(deviceId), door.declaredPaths(deviceId));
+	} catch (err) {
+		deps.ctx.logger.warn("device form: stored config unreadable — secret views not applied", {
+			tags: { deviceId },
+			meta: { error: require_dist.errMsg(err) }
+		});
+		return sections;
+	}
+}
+/**
 * One process-wide cache behind every device-details fan-out.
 *
 * Module-level on purpose: the page re-polls every 2.5 s and a per-call cache
@@ -3676,16 +3794,18 @@ async function buildBaseDeviceSection(deps, deviceId) {
 	if (!hubLocal && !nativeOwner) return null;
 	const sections = [];
 	const driverResult = await resolveDriverConfigSchema(deps, deviceId, hubLocal);
-	if (driverResult.status === "ok") for (const section of driverResult.schema.sections) sections.push({
-		id: section.id,
-		title: section.title,
-		tab: section.tab ?? "general",
-		order: section.order ?? 1,
-		fields: [...section.fields],
-		...section.description !== void 0 ? { description: section.description } : {},
-		...section.columns !== void 0 ? { columns: section.columns } : {}
-	});
-	else if (driverResult.status === "unavailable") sections.push({
+	if (driverResult.status === "ok") {
+		const driverSections = await driverSectionsWithSecretViews(deps, deviceId, driverResult.schema.sections);
+		for (const section of driverSections) sections.push({
+			id: section.id,
+			title: section.title,
+			tab: section.tab ?? "general",
+			order: section.order ?? 1,
+			fields: [...section.fields],
+			...section.description !== void 0 ? { description: section.description } : {},
+			...section.columns !== void 0 ? { columns: section.columns } : {}
+		});
+	} else if (driverResult.status === "unavailable") sections.push({
 		id: "driver-settings-unavailable",
 		title: "Driver Settings",
 		tab: "general",
@@ -4079,19 +4199,26 @@ async function applyGroupPatch(deps, deviceId, group) {
 			});
 			throw new Error(`[device-manager] ${retired.join(", ")} can no longer be saved from the settings section — reload the page and use the Extensions section`);
 		}
-		const driverPatch = group.patch;
-		if (Object.keys(driverPatch).length === 0) return;
-		const hubRegistry = deps.ctx.kernel?.deviceRegistry;
-		const found = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
-		if (found) {
-			await found.device.applySettingsPatch(driverPatch);
-			return;
-		}
-		const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
-		if (!ops) throw new Error(`[device-manager] device "${deviceId}" not found (no hub-local entry, no device-ops native provider)`);
-		await ops.setConfig({
-			deviceId,
-			values: driverPatch
+		await applyDriverFormPatch({
+			patch: group.patch,
+			applyToDriver: async (driverPatch) => {
+				const hubRegistry = deps.ctx.kernel?.deviceRegistry;
+				const found = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
+				if (found) {
+					await found.device.applySettingsPatch(driverPatch);
+					return;
+				}
+				const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
+				if (!ops) throw new Error(`[device-manager] device "${deviceId}" not found (no hub-local entry, no device-ops native provider)`);
+				await ops.setConfig({
+					deviceId,
+					values: driverPatch
+				});
+			},
+			clearSecrets: async (keys) => {
+				if (!deps.deviceFormSecrets) throw new Error(`[device-manager] cannot clear ${keys.join(", ")}: no keychain door`);
+				await deps.deviceFormSecrets.clear(deviceId, keys);
+			}
 		});
 		return;
 	}
@@ -9717,6 +9844,8 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 	removalFence = createRemovalFence();
 	/** Declared secret config paths per device, as last registered (D783). */
 	secretConfigPaths = createSecretConfigPathRegistry();
+	/** The keychain side of driver device forms (D789), wired in onInitialize. */
+	deviceFormSecrets;
 	/** The runtime-state mirror, asserted present (constructed in onInitialize). */
 	get stateMirror() {
 		if (!this.stateMirrorImpl) throw new Error("DeviceManagerAddon: state mirror accessed before onInitialize");
@@ -9869,7 +9998,8 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 			ctx: this.ctx,
 			capabilityRegistry: this.capabilityRegistry,
 			remoteNativeCaps: this.remoteNativeCaps,
-			bindingsDeps: this.bindingsDeps
+			bindingsDeps: this.bindingsDeps,
+			...this.deviceFormSecrets ? { deviceFormSecrets: this.deviceFormSecrets } : {}
 		};
 	}
 	async getDeviceAggregate(deviceId, kind) {
@@ -9965,6 +10095,15 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 				return provider;
 			}
 		};
+		this.deviceFormSecrets = {
+			readStored: (deviceId) => settings.readDeviceStore(deviceId),
+			declaredPaths: (deviceId) => this.secretConfigPaths.get(deviceId) ?? [],
+			clear: (deviceId, keys) => persistConfig(pctx, {
+				deviceId,
+				data: Object.fromEntries(keys.map((key) => [key, require_dist.SECRET_CLEAR])),
+				secretConfigPaths: [...new Set([...this.secretConfigPaths.get(deviceId) ?? [], ...keys])]
+			})
+		};
 		try {
 			await runLocationBackfillAtBoot(pctx, bootRows);
 		} catch (err) {

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { $ as buildStreamParamsConfigSchema, A as MINUTES_PER_DAY, C as FieldClaimModeSchema, Dn as runtimeStatePolicyFor, Hr as secretTreeFromPaths, Kr as transformSecretWrite, Kt as legacyAutoLinkIds, L as STREAM_PROFILE_META, Mn as siteZoneKey, Nt as formatMinutes, O as LocationIconIdSchema, Ot as expandContainer, Sr as collectZodSecretPaths, St as deviceStatusCapability, Tt as enumerateSchemaFields, Wr as sleep$1, Xt as locationIconKey, ar as DeviceFeature, bt as deviceManagerCapability, c as CAP_NAMES_WITH_STATUS, cn as normalizeUnit, cr as errMsg, dn as parseStreamParamsFormPatch, dt as createDeviceExtensionProvider, gr as WELL_KNOWN_TAB_MAP, gt as defineExtensionSlotProvider, kr as isDeviceConfigCap, lr as BaseAddon, o as CAMERA_SWITCH_ORDER, or as DeviceRole, qr as EventCategory, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, v as DAY_NAMES, w as FieldClaimSchema, wt as enumerateItemArrayFields, x as DeviceStatusSchema, xt as deviceStateCapability, yt as deviceExtensionCapability, zr as resolveSecretMarkers } from "../../dist-B9oFw2jh.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-DlZ3VV6x.mjs";
+import { $ as buildStreamParamsConfigSchema, A as MINUTES_PER_DAY, Ar as isDeviceConfigCap, C as FieldClaimModeSchema, Cr as collectZodSecretPaths, Dn as runtimeStatePolicyFor, Fr as isSecretMarkerLike, Jr as sleep$1, Kr as secretTreeFromPaths, Kt as legacyAutoLinkIds, L as STREAM_PROFILE_META, Mn as siteZoneKey, Mr as isKeychainStoredField, Nr as isSecretClear, Nt as formatMinutes, O as LocationIconIdSchema, Ot as expandContainer, Pr as isSecretMarker, Qr as EventCategory, St as deviceStatusCapability, Tt as enumerateSchemaFields, Ur as resolveSecretMarkers, Xr as toSecretFieldView, Xt as locationIconKey, Zr as transformSecretWrite, _r as WELL_KNOWN_TAB_MAP, ar as DeviceFeature, bt as deviceManagerCapability, c as CAP_NAMES_WITH_STATUS, cn as normalizeUnit, cr as errMsg, dn as parseStreamParamsFormPatch, dt as createDeviceExtensionProvider, gr as SECRET_CLEAR, gt as defineExtensionSlotProvider, lr as BaseAddon, o as CAMERA_SWITCH_ORDER, or as DeviceRole, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, v as DAY_NAMES, w as FieldClaimSchema, wt as enumerateItemArrayFields, x as DeviceStatusSchema, xt as deviceStateCapability, yt as deviceExtensionCapability } from "../../dist-BC0GnGeg.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-MCVhxPkJ.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
@@ -1028,6 +1028,105 @@ function mergeAggregates(parts) {
 	return out;
 }
 //#endregion
+//#region src/builtins/device-manager/device-form-secrets.ts
+/**
+* A driver's device-settings form, kept on the keychain side of the wire
+* (D787 / D789 for device forms).
+*
+* A driver hydrates its own form from the config `loadConfig` RESOLVED for it,
+* so a camera password reaches the form as plaintext even though the stored
+* blob holds a keychain marker. This module closes that in ONE place — the
+* device-manager aggregate every device form goes through — for every driver:
+*
+*  - READ ({@link viewStoredSecrets}): a form field whose key names a stored
+*    MARKER (a declared `secretConfigPaths` entry, or a field secret by type)
+*    is handed the marker's VIEW instead of the driver's plaintext. A value
+*    that is still inline plaintext in the blob (not migrated) is left as the
+*    driver hydrated it: there is nothing to reveal it by.
+*  - WRITE ({@link applyDriverFormPatch}): the form sends the view back for an
+*    untouched field and `{ $secretClear: true }` for an explicit clear. The
+*    driver understands neither (its schema wants a string), so a view is
+*    dropped from the driver's patch (KEEP — the driver still holds the
+*    resolved value) and a clear reaches the driver as `''` while the stored
+*    marker is removed at the keychain door. A typed value passes through and
+*    the driver's own persist stores it in the keychain.
+*
+* Top-level keys only: a driver form's field key is its config key for every
+* declared device secret today (`password`, `apiKey`, `localKey`). A nested or
+* per-row path (`connection.password`, `rows[].pin`) is not mapped onto a form
+* field and keeps the driver's hydration.
+*/
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The declared paths that name a top-level config key. */
+function topLevelKeys(paths) {
+	return new Set(paths.filter((p) => p.length > 0 && !p.includes(".") && !p.includes("[")));
+}
+function viewField(field, stored, declared) {
+	if (!isRecord$2(field)) return field;
+	const nested = field["fields"];
+	if (Array.isArray(nested)) return {
+		...field,
+		fields: nested.map((f) => viewField(f, stored, declared))
+	};
+	const tabs = field["tabs"];
+	if (Array.isArray(tabs)) return {
+		...field,
+		tabs: tabs.map((tab) => isRecord$2(tab) && Array.isArray(tab["fields"]) ? {
+			...tab,
+			fields: tab["fields"].map((f) => viewField(f, stored, declared))
+		} : tab)
+	};
+	const key = field["key"];
+	if (typeof key !== "string" || !("value" in field)) return field;
+	const marker = stored[key];
+	if (!isSecretMarker(marker)) return field;
+	const secretByType = isKeychainStoredField(field);
+	if (!secretByType && !declared.has(key)) return field;
+	const type = secretByType ? field["type"] : "password";
+	return {
+		...field,
+		type,
+		value: toSecretFieldView(marker)
+	};
+}
+/**
+* The driver's hydrated sections with every keychain-stored secret replaced
+* by its view. Returns the input unchanged when the blob holds no marker.
+*/
+function viewStoredSecrets(sections, stored, declaredPaths) {
+	if (!Object.values(stored).some(isSecretMarker)) return sections;
+	const declared = topLevelKeys(declaredPaths);
+	return sections.map((section) => ({
+		...section,
+		fields: section.fields.map((f) => viewField(f, stored, declared))
+	}));
+}
+/** Split a device-settings form patch (see the module doc). */
+function splitDriverFormPatch(patch) {
+	const driverPatch = {};
+	const clearKeys = [];
+	for (const [key, value] of Object.entries(patch)) if (isSecretClear(value)) {
+		driverPatch[key] = "";
+		clearKeys.push(key);
+	} else if (!isSecretMarkerLike(value)) driverPatch[key] = value;
+	return {
+		driverPatch,
+		clearKeys
+	};
+}
+/**
+* Apply a device-settings form patch: the driver gets plain values only, then
+* an explicit clear removes the stored secret at the keychain door (after the
+* driver's own persist, whose `''` the door reads as KEEP).
+*/
+async function applyDriverFormPatch(input) {
+	const { driverPatch, clearKeys } = splitDriverFormPatch(input.patch);
+	if (Object.keys(driverPatch).length > 0) await input.applyToDriver(driverPatch);
+	if (clearKeys.length > 0) await input.clearSecrets(clearKeys);
+}
+//#endregion
 //#region src/builtins/device-manager/stale-wrapper-activations.ts
 /**
 * A stored wrapper activation that names a cap with NO wrapper any more.
@@ -3446,6 +3545,25 @@ function refusedLinkedPicks(params) {
 //#endregion
 //#region src/builtins/device-manager/device-aggregation.ts
 /**
+* A driver's hydrated sections as the browser may see them: every secret the
+* keychain stores is its VIEW, never the plaintext the driver was handed by
+* `loadConfig`. An unreadable blob withholds nothing new — the non-admin
+* redaction still runs at the transport — but it is logged.
+*/
+async function driverSectionsWithSecretViews(deps, deviceId, sections) {
+	const door = deps.deviceFormSecrets;
+	if (!door) return sections;
+	try {
+		return viewStoredSecrets(sections, await door.readStored(deviceId), door.declaredPaths(deviceId));
+	} catch (err) {
+		deps.ctx.logger.warn("device form: stored config unreadable — secret views not applied", {
+			tags: { deviceId },
+			meta: { error: errMsg(err) }
+		});
+		return sections;
+	}
+}
+/**
 * One process-wide cache behind every device-details fan-out.
 *
 * Module-level on purpose: the page re-polls every 2.5 s and a per-call cache
@@ -3671,16 +3789,18 @@ async function buildBaseDeviceSection(deps, deviceId) {
 	if (!hubLocal && !nativeOwner) return null;
 	const sections = [];
 	const driverResult = await resolveDriverConfigSchema(deps, deviceId, hubLocal);
-	if (driverResult.status === "ok") for (const section of driverResult.schema.sections) sections.push({
-		id: section.id,
-		title: section.title,
-		tab: section.tab ?? "general",
-		order: section.order ?? 1,
-		fields: [...section.fields],
-		...section.description !== void 0 ? { description: section.description } : {},
-		...section.columns !== void 0 ? { columns: section.columns } : {}
-	});
-	else if (driverResult.status === "unavailable") sections.push({
+	if (driverResult.status === "ok") {
+		const driverSections = await driverSectionsWithSecretViews(deps, deviceId, driverResult.schema.sections);
+		for (const section of driverSections) sections.push({
+			id: section.id,
+			title: section.title,
+			tab: section.tab ?? "general",
+			order: section.order ?? 1,
+			fields: [...section.fields],
+			...section.description !== void 0 ? { description: section.description } : {},
+			...section.columns !== void 0 ? { columns: section.columns } : {}
+		});
+	} else if (driverResult.status === "unavailable") sections.push({
 		id: "driver-settings-unavailable",
 		title: "Driver Settings",
 		tab: "general",
@@ -4074,19 +4194,26 @@ async function applyGroupPatch(deps, deviceId, group) {
 			});
 			throw new Error(`[device-manager] ${retired.join(", ")} can no longer be saved from the settings section — reload the page and use the Extensions section`);
 		}
-		const driverPatch = group.patch;
-		if (Object.keys(driverPatch).length === 0) return;
-		const hubRegistry = deps.ctx.kernel?.deviceRegistry;
-		const found = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
-		if (found) {
-			await found.device.applySettingsPatch(driverPatch);
-			return;
-		}
-		const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
-		if (!ops) throw new Error(`[device-manager] device "${deviceId}" not found (no hub-local entry, no device-ops native provider)`);
-		await ops.setConfig({
-			deviceId,
-			values: driverPatch
+		await applyDriverFormPatch({
+			patch: group.patch,
+			applyToDriver: async (driverPatch) => {
+				const hubRegistry = deps.ctx.kernel?.deviceRegistry;
+				const found = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
+				if (found) {
+					await found.device.applySettingsPatch(driverPatch);
+					return;
+				}
+				const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
+				if (!ops) throw new Error(`[device-manager] device "${deviceId}" not found (no hub-local entry, no device-ops native provider)`);
+				await ops.setConfig({
+					deviceId,
+					values: driverPatch
+				});
+			},
+			clearSecrets: async (keys) => {
+				if (!deps.deviceFormSecrets) throw new Error(`[device-manager] cannot clear ${keys.join(", ")}: no keychain door`);
+				await deps.deviceFormSecrets.clear(deviceId, keys);
+			}
 		});
 		return;
 	}
@@ -9712,6 +9839,8 @@ var DeviceManagerAddon = class extends BaseAddon {
 	removalFence = createRemovalFence();
 	/** Declared secret config paths per device, as last registered (D783). */
 	secretConfigPaths = createSecretConfigPathRegistry();
+	/** The keychain side of driver device forms (D789), wired in onInitialize. */
+	deviceFormSecrets;
 	/** The runtime-state mirror, asserted present (constructed in onInitialize). */
 	get stateMirror() {
 		if (!this.stateMirrorImpl) throw new Error("DeviceManagerAddon: state mirror accessed before onInitialize");
@@ -9864,7 +9993,8 @@ var DeviceManagerAddon = class extends BaseAddon {
 			ctx: this.ctx,
 			capabilityRegistry: this.capabilityRegistry,
 			remoteNativeCaps: this.remoteNativeCaps,
-			bindingsDeps: this.bindingsDeps
+			bindingsDeps: this.bindingsDeps,
+			...this.deviceFormSecrets ? { deviceFormSecrets: this.deviceFormSecrets } : {}
 		};
 	}
 	async getDeviceAggregate(deviceId, kind) {
@@ -9960,6 +10090,15 @@ var DeviceManagerAddon = class extends BaseAddon {
 				return provider;
 			}
 		};
+		this.deviceFormSecrets = {
+			readStored: (deviceId) => settings.readDeviceStore(deviceId),
+			declaredPaths: (deviceId) => this.secretConfigPaths.get(deviceId) ?? [],
+			clear: (deviceId, keys) => persistConfig(pctx, {
+				deviceId,
+				data: Object.fromEntries(keys.map((key) => [key, SECRET_CLEAR])),
+				secretConfigPaths: [...new Set([...this.secretConfigPaths.get(deviceId) ?? [], ...keys])]
+			})
+		};
 		try {
 			await runLocationBackfillAtBoot(pctx, bootRows);
 		} catch (err) {

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
-const require_jwt_signing_key = require("../../jwt-signing-key-C2rE3wH6.js");
-const require_cluster_secret = require("../../cluster-secret-Dg0OOOSr.js");
+const require_dist = require("../../dist-BugrtARh.js");
+const require_jwt_signing_key = require("../../jwt-signing-key-CjoZcol8.js");
+const require_cluster_secret = require("../../cluster-secret-BUiG8DCo.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/keychain/index.mjs

@@ -1,6 +1,6 @@
-import { Dr as formatSecretScope, Gt as keychainCapability, Ir as parseSecretRef, Nr as normalizeSecretOwner, Wt as keychainAdminCapability, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
-import { r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-Qhde8r82.mjs";
-import { i as CLUSTER_SECRET_SETTINGS_KEY } from "../../cluster-secret-BDue-uJj.mjs";
+import { Br as parseSecretRef, Gt as keychainCapability, Lr as normalizeSecretOwner, Or as formatSecretScope, Qr as EventCategory, Wt as keychainAdminCapability, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
+import { r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-CsuVKA1W.mjs";
+import { i as CLUSTER_SECRET_SETTINGS_KEY } from "../../cluster-secret-DgJTZ4qY.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Cr as createEvent, F as RecordingStatusSchema, N as RECORDING_SOURCE_CAMSTACK_ADDON, cr as errMsg, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { F as RecordingStatusSchema, N as RECORDING_SOURCE_CAMSTACK_ADDON, Qr as EventCategory, cr as errMsg, lr as BaseAddon, wr as createEvent } from "../../dist-BC0GnGeg.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
-const require_jwt_signing_key = require("../../jwt-signing-key-C2rE3wH6.js");
+const require_dist = require("../../dist-BugrtARh.js");
+const require_jwt_signing_key = require("../../jwt-signing-key-CjoZcol8.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,6 +1,6 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Bn as userManagementCapability, J as authProviderCapability, R as ScopedTokenSchema, U as UserRecordSchema, lr as BaseAddon, r as ApiKeyRecordSchema } from "../../dist-B9oFw2jh.mjs";
-import { a as loadJwtSigningKey, i as getProcessJwtSigningKeyState, o as processJwtSigningKey, s as setProcessJwtSigningKey, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-Qhde8r82.mjs";
+import { Bn as userManagementCapability, J as authProviderCapability, R as ScopedTokenSchema, U as UserRecordSchema, lr as BaseAddon, r as ApiKeyRecordSchema } from "../../dist-BC0GnGeg.mjs";
+import { a as loadJwtSigningKey, i as getProcessJwtSigningKeyState, o as processJwtSigningKey, s as setProcessJwtSigningKey, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-CsuVKA1W.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 const require_tls = require("../../tls-CCMX7MjX.js");
 let zod = require("zod");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { Cn as resolveHubAddressRoles, En as resolveNotificationTapAddress, Hn as validateCustomAddress, It as isAppLinkBase, Yt as localNetworkCapability, fn as pickAppLinkHub, lr as BaseAddon, nt as checkRoleAddress, qr as EventCategory, s as CAMSTACK_APP_LINK_ORIGIN, yn as resolveAppConnections, zt as isDefaultAppConnectionEndpoint } from "../../dist-B9oFw2jh.mjs";
+import { Cn as resolveHubAddressRoles, En as resolveNotificationTapAddress, Hn as validateCustomAddress, It as isAppLinkBase, Qr as EventCategory, Yt as localNetworkCapability, fn as pickAppLinkHub, lr as BaseAddon, nt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, yn as resolveAppConnections, zt as isDefaultAppConnectionEndpoint } from "../../dist-BC0GnGeg.mjs";
 import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-CJHogwTl.mjs";
 import { z } from "zod";
 import * as os from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 const require_proc_stat = require("../../proc-stat-DL-WUOhl.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Cr as createEvent, Mt as foldSnapshotByFunction, _n as reducePoints, bn as resolveBucketMs, cr as errMsg, in as metricsProviderCapability, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { Mt as foldSnapshotByFunction, Qr as EventCategory, _n as reducePoints, bn as resolveBucketMs, cr as errMsg, in as metricsProviderCapability, lr as BaseAddon, wr as createEvent } from "../../dist-BC0GnGeg.mjs";
 import { a as parseProcStat, i as nodeProcReader, n as elapsedSecSince, o as parseProcStatusRss, r as lifetimeCpuPercent, t as commandFromCmdline } from "../../proc-stat-CbC55Kqi.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { An as scoreRuntimes, Ct as enumerateInferenceDevices, Tr as emitReadiness, cr as errMsg, lr as BaseAddon, mn as platformProbeCapability, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { An as scoreRuntimes, Ct as enumerateInferenceDevices, Er as emitReadiness, Qr as EventCategory, cr as errMsg, lr as BaseAddon, mn as platformProbeCapability } from "../../dist-BC0GnGeg.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";