@camstack/system 1.2.380 → 1.2.381

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-CZeRUgYF.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-hf-Gce_4.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { Ft as installManifestNativeDeps, H as createUdsLoggerWithControl, It as resolveAddonClass, St as validateProviderRegistrations, U as LocalChildClient, _n as startRunnerHeapWatch, _t as getWorkerNativeCapProvider, bt as setWorkerNativeCapsChangeListener, f as installManifestSystemDeps, g as createUdsAddonContext, i as killOwnRunnerGroupAfterParentLoss, in as RUNNER_RSS_BUDGET_ENV, kn as emitHeapDiagnosticReport, n as createChildCapDispatch, p as installManifestPythonDeps, u as startRunnerParentDeathWatchdog, vt as getWorkerNativeCapSnapshot } from "./child-cap-dispatch-CpjohToR.mjs";
+import { Ft as installManifestNativeDeps, H as createUdsLoggerWithControl, It as resolveAddonClass, St as validateProviderRegistrations, U as LocalChildClient, _n as startRunnerHeapWatch, _t as getWorkerNativeCapProvider, bt as setWorkerNativeCapsChangeListener, f as installManifestSystemDeps, g as createUdsAddonContext, i as killOwnRunnerGroupAfterParentLoss, in as RUNNER_RSS_BUDGET_ENV, kn as emitHeapDiagnosticReport, n as createChildCapDispatch, p as installManifestPythonDeps, u as startRunnerParentDeathWatchdog, vt as getWorkerNativeCapSnapshot } from "./child-cap-dispatch-BTe4eKep.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";

package/dist/addon-utils.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-Cek0wNdY.js");
-const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-mk6WGxir.js");
+const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-CnQ-K6Gn.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 const require_snapshot_courtesy = require("./snapshot-courtesy-D_C5-nC0.js");
 exports.COURTESY_DEFAULT_WIDTH = require_snapshot_courtesy.COURTESY_DEFAULT_WIDTH;

package/dist/addon-utils.mjs

@@ -1,4 +1,4 @@
-import { C as resolveFormatRevision, S as isModelDownloaded, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, f as ModelDownloadHttpError, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, t as STALL_REPORT_MS, v as ensureModel, x as isModelDownloadHttpError } from "./event-loop-stall-monitor-anUH2IE1.mjs";
+import { C as resolveFormatRevision, S as isModelDownloaded, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, f as ModelDownloadHttpError, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, t as STALL_REPORT_MS, v as ensureModel, x as isModelDownloadHttpError } from "./event-loop-stall-monitor-GgpnfAC0.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg, t as COURTESY_DEFAULT_WIDTH } from "./snapshot-courtesy-CyFs1M3I.mjs";
 export { COURTESY_DEFAULT_WIDTH, CustomActionRegistry, ModelDownloadHttpError, ModelDownloadService, STALL_REPORT_MS, STALL_TICK_MS, adoptModelRevisions, attributeStall, collectModelFiles, contentTypeFor, courtesyCacheKey, createFileDataPlaneHandler, deleteModelFromDisk, downloadFile, ensureModel, getModelFilePath, isModelDownloadHttpError, isModelDownloaded, parseRangeHeader, renderCourtesyJpeg, renderCourtesyOverlayJpeg, resolveFormatRevision, startEventLoopStallMonitor };

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { W as addonPagesCapability, cr as errMsg, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { Qr as EventCategory, W as addonPagesCapability, cr as errMsg, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { K as addonWidgetsCapability, cr as errMsg, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { K as addonWidgetsCapability, Qr as EventCategory, cr as errMsg, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Cr as createEvent, cr as errMsg, lr as BaseAddon, n as AlertSchema, q as alertsCapability, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { Qr as EventCategory, cr as errMsg, lr as BaseAddon, n as AlertSchema, q as alertsCapability, wr as createEvent } from "../../dist-BC0GnGeg.mjs";
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { Ar as isEvent, S as FIRST_LEVEL_MACRO_CLASSES, X as bareAddonId, cr as errMsg, gn as ptzAutotrackCapability, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { Qr as EventCategory, S as FIRST_LEVEL_MACRO_CLASSES, X as bareAddonId, cr as errMsg, gn as ptzAutotrackCapability, jr as isEvent, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gr as toNodeId, In as storageOccupancyCapability, Mr as nodePin, Y as backupCapability, g as DATABASE_SNAPSHOT_SUFFIX, lr as BaseAddon, nn as mayWriteToLocation, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { In as storageOccupancyCapability, Ir as nodePin, Qr as EventCategory, Y as backupCapability, Yr as toNodeId, g as DATABASE_SNAPSHOT_SUFFIX, lr as BaseAddon, nn as mayWriteToLocation } from "../../dist-BC0GnGeg.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let zod = require("zod");
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/calendars/calendars.addon.mjs

@@ -1,4 +1,4 @@
-import { et as calendarsCapability, lr as BaseAddon, p as CalendarPreferencesSchema } from "../../dist-B9oFw2jh.mjs";
+import { et as calendarsCapability, lr as BaseAddon, p as CalendarPreferencesSchema } from "../../dist-BC0GnGeg.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { z } from "zod";
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/camera-grid/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 let zod = require("zod");
 let _camstack_types_node = require("@camstack/types/node");
 let node_path = require("node:path");

package/dist/builtins/camera-grid/index.mjs

@@ -1,4 +1,4 @@
-import { Cr as createEvent, Jn as buildFfmpegArgs, M as MOTION_CLOSE_AFTER_MS, Nn as snapshotCapability, Or as hydrateSchema, Rn as streamCatalogCapability, ar as DeviceFeature, b as DeclaredDevices, cr as errMsg, i as BaseDevice, lr as BaseAddon, mt as declarationOwnerNodeId, on as motionCapability, qr as EventCategory, rn as memoizePinnedFfmpeg, sr as DeviceType, tt as cameraGridLayoutCapability, y as DERIVED_CAMERA_SILENCED_CAP_NAMES } from "../../dist-B9oFw2jh.mjs";
+import { Jn as buildFfmpegArgs, M as MOTION_CLOSE_AFTER_MS, Nn as snapshotCapability, Qr as EventCategory, Rn as streamCatalogCapability, ar as DeviceFeature, b as DeclaredDevices, cr as errMsg, i as BaseDevice, kr as hydrateSchema, lr as BaseAddon, mt as declarationOwnerNodeId, on as motionCapability, rn as memoizePinnedFfmpeg, sr as DeviceType, tt as cameraGridLayoutCapability, wr as createEvent, y as DERIVED_CAMERA_SILENCED_CAP_NAMES } from "../../dist-BC0GnGeg.mjs";
 import { z } from "zod";
 import { FfmpegProcess } from "@camstack/types/node";
 import { join } from "node:path";

package/dist/builtins/composer/composer.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
-const require_composition_sources = require("../../composition-sources-CHvLMrFI.js");
+const require_dist = require("../../dist-BugrtARh.js");
+const require_composition_sources = require("../../composition-sources-4SmsP0O4.js");
 let zod = require("zod");
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { $n as compositionItemFieldPath, Cr as createEvent, Et as evaluateCompositionField, Q as buildCapabilityLookup, Qn as compositionFeatureEnabled, Xn as composedDeviceRef, Yn as cloneStatefulExpressionMemory, Zn as composedDeviceStableId, b as DeclaredDevices, cr as errMsg, er as compositionSliceKey, i as BaseDevice, ir as toExpressionValue, it as compositionFieldKey, kt as expressionContainsBuiltinCall, l as COMPOSED_ITEM_FIXED_FIELDS, lr as BaseAddon, nr as createStatefulExpressionMemory, pn as planComposition, qn as COMPOSER_ADDON_ID, qr as EventCategory, rr as disarmRoseMemory, rt as composerCapability, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey } from "../../dist-B9oFw2jh.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-DT_uJwI3.mjs";
+import { $n as compositionItemFieldPath, Et as evaluateCompositionField, Q as buildCapabilityLookup, Qn as compositionFeatureEnabled, Qr as EventCategory, Xn as composedDeviceRef, Yn as cloneStatefulExpressionMemory, Zn as composedDeviceStableId, b as DeclaredDevices, cr as errMsg, er as compositionSliceKey, i as BaseDevice, ir as toExpressionValue, it as compositionFieldKey, kt as expressionContainsBuiltinCall, l as COMPOSED_ITEM_FIXED_FIELDS, lr as BaseAddon, nr as createStatefulExpressionMemory, pn as planComposition, qn as COMPOSER_ADDON_ID, rr as disarmRoseMemory, rt as composerCapability, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey, wr as createEvent } from "../../dist-BC0GnGeg.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-CgOQVIwa.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-BugrtARh.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
-const require_composition_sources = require("../../composition-sources-CHvLMrFI.js");
+const require_dist = require("../../dist-BugrtARh.js");
+const require_composition_sources = require("../../composition-sources-4SmsP0O4.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
-import { Or as hydrateSchema, Q as buildCapabilityLookup, Sn as resolveCoreBlockFiles, Vn as validateComposition, Xn as composedDeviceRef, at as compositionSourceRefs, b as DeclaredDevices, cr as errMsg, ct as coreBlockIdFromAddonId, d as CORE_BLOCKS_ADDON_ID, f as CORE_BLOCK_ADDON_PREFIX, lr as BaseAddon, lt as coreBlockSourceKind, m as CoreBlockSchema, ot as coreBlockAddonId, pn as planComposition, sn as normalizeCoreBlockWrite, st as coreBlockComposition, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey, u as COMPOSER_RUNNER_ID, ut as coreBlocksCapability, vn as replacedFieldKeys, vt as describeComposableCaps, xn as resolveCoreBlockEntry } from "../../dist-B9oFw2jh.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-DT_uJwI3.mjs";
+import { Q as buildCapabilityLookup, Sn as resolveCoreBlockFiles, Vn as validateComposition, Xn as composedDeviceRef, at as compositionSourceRefs, b as DeclaredDevices, cr as errMsg, ct as coreBlockIdFromAddonId, d as CORE_BLOCKS_ADDON_ID, f as CORE_BLOCK_ADDON_PREFIX, kr as hydrateSchema, lr as BaseAddon, lt as coreBlockSourceKind, m as CoreBlockSchema, ot as coreBlockAddonId, pn as planComposition, sn as normalizeCoreBlockWrite, st as coreBlockComposition, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey, u as COMPOSER_RUNNER_ID, ut as coreBlocksCapability, vn as replacedFieldKeys, vt as describeComposableCaps, xn as resolveCoreBlockEntry } from "../../dist-BC0GnGeg.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-CgOQVIwa.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { customizationBlockName } from "@camstack/types/node";

package/dist/builtins/device-manager/device-aggregation.d.ts

@@ -12,6 +12,18 @@ export interface AggregationDeps {
     readonly capabilityRegistry: ICapabilityRegistry | undefined;
     readonly remoteNativeCaps: RemoteNativeCaps;
     readonly bindingsDeps: BindingsDeps;
+    /**
+     * The keychain side of a driver's device form (D789): the STORED blob (its
+     * markers, never resolved), the device's declared secret paths, and the
+     * door's explicit clear. Without it a driver form carries what the driver
+     * hydrated and a clear cannot be applied.
+     */
+    readonly deviceFormSecrets?: DeviceFormSecretsDeps;
+}
+export interface DeviceFormSecretsDeps {
+    readonly readStored: (deviceId: number) => Promise<Record<string, unknown>>;
+    readonly declaredPaths: (deviceId: number) => readonly string[];
+    readonly clear: (deviceId: number, keys: readonly string[]) => Promise<void>;
 }
 type IDeviceManagerProvider = InferProvider<typeof deviceManagerCapability>;
 export declare function getDeviceAggregate(deps: AggregationDeps, deviceId: number, kind: 'settings' | 'live'): Promise<ContributionShape | null>;

package/dist/builtins/device-manager/device-form-secrets.d.ts

@@ -0,0 +1,25 @@
+import { ContributionShape } from './device-meta-types.js';
+type Sections = ContributionShape['sections'];
+/**
+ * The driver's hydrated sections with every keychain-stored secret replaced
+ * by its view. Returns the input unchanged when the blob holds no marker.
+ */
+export declare function viewStoredSecrets(sections: Sections, stored: Record<string, unknown>, declaredPaths: readonly string[]): Sections;
+/** A form patch split into what the driver applies and what the door clears. */
+export interface DriverFormPatch {
+    readonly driverPatch: Record<string, unknown>;
+    readonly clearKeys: readonly string[];
+}
+/** Split a device-settings form patch (see the module doc). */
+export declare function splitDriverFormPatch(patch: Record<string, unknown>): DriverFormPatch;
+/**
+ * Apply a device-settings form patch: the driver gets plain values only, then
+ * an explicit clear removes the stored secret at the keychain door (after the
+ * driver's own persist, whose `''` the door reads as KEEP).
+ */
+export declare function applyDriverFormPatch(input: {
+    readonly patch: Record<string, unknown>;
+    readonly applyToDriver: (driverPatch: Record<string, unknown>) => Promise<void>;
+    readonly clearSecrets: (keys: readonly string[]) => Promise<void>;
+}): Promise<void>;
+export {};

package/dist/builtins/device-manager/device-manager.addon.d.ts

@@ -71,6 +71,8 @@ export declare class DeviceManagerAddon extends BaseAddon {
     private readonly removalFence;
     /** Declared secret config paths per device, as last registered (D783). */
     private readonly secretConfigPaths;
+    /** The keychain side of driver device forms (D789), wired in onInitialize. */
+    private deviceFormSecrets;
     /** The runtime-state mirror, asserted present (constructed in onInitialize). */
     private get stateMirror();
     /**

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-YOOKLA3v.js");
+const require_dist = require("../../dist-BugrtARh.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-DCuetwOt.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -1033,6 +1033,105 @@ function mergeAggregates(parts) {
 	return out;
 }
 //#endregion
+//#region src/builtins/device-manager/device-form-secrets.ts
+/**
+* A driver's device-settings form, kept on the keychain side of the wire
+* (D787 / D789 for device forms).
+*
+* A driver hydrates its own form from the config `loadConfig` RESOLVED for it,
+* so a camera password reaches the form as plaintext even though the stored
+* blob holds a keychain marker. This module closes that in ONE place — the
+* device-manager aggregate every device form goes through — for every driver:
+*
+*  - READ ({@link viewStoredSecrets}): a form field whose key names a stored
+*    MARKER (a declared `secretConfigPaths` entry, or a field secret by type)
+*    is handed the marker's VIEW instead of the driver's plaintext. A value
+*    that is still inline plaintext in the blob (not migrated) is left as the
+*    driver hydrated it: there is nothing to reveal it by.
+*  - WRITE ({@link applyDriverFormPatch}): the form sends the view back for an
+*    untouched field and `{ $secretClear: true }` for an explicit clear. The
+*    driver understands neither (its schema wants a string), so a view is
+*    dropped from the driver's patch (KEEP — the driver still holds the
+*    resolved value) and a clear reaches the driver as `''` while the stored
+*    marker is removed at the keychain door. A typed value passes through and
+*    the driver's own persist stores it in the keychain.
+*
+* Top-level keys only: a driver form's field key is its config key for every
+* declared device secret today (`password`, `apiKey`, `localKey`). A nested or
+* per-row path (`connection.password`, `rows[].pin`) is not mapped onto a form
+* field and keeps the driver's hydration.
+*/
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The declared paths that name a top-level config key. */
+function topLevelKeys(paths) {
+	return new Set(paths.filter((p) => p.length > 0 && !p.includes(".") && !p.includes("[")));
+}
+function viewField(field, stored, declared) {
+	if (!isRecord$2(field)) return field;
+	const nested = field["fields"];
+	if (Array.isArray(nested)) return {
+		...field,
+		fields: nested.map((f) => viewField(f, stored, declared))
+	};
+	const tabs = field["tabs"];
+	if (Array.isArray(tabs)) return {
+		...field,
+		tabs: tabs.map((tab) => isRecord$2(tab) && Array.isArray(tab["fields"]) ? {
+			...tab,
+			fields: tab["fields"].map((f) => viewField(f, stored, declared))
+		} : tab)
+	};
+	const key = field["key"];
+	if (typeof key !== "string" || !("value" in field)) return field;
+	const marker = stored[key];
+	if (!require_dist.isSecretMarker(marker)) return field;
+	const secretByType = require_dist.isKeychainStoredField(field);
+	if (!secretByType && !declared.has(key)) return field;
+	const type = secretByType ? field["type"] : "password";
+	return {
+		...field,
+		type,
+		value: require_dist.toSecretFieldView(marker)
+	};
+}
+/**
+* The driver's hydrated sections with every keychain-stored secret replaced
+* by its view. Returns the input unchanged when the blob holds no marker.
+*/
+function viewStoredSecrets(sections, stored, declaredPaths) {
+	if (!Object.values(stored).some(require_dist.isSecretMarker)) return sections;
+	const declared = topLevelKeys(declaredPaths);
+	return sections.map((section) => ({
+		...section,
+		fields: section.fields.map((f) => viewField(f, stored, declared))
+	}));
+}
+/** Split a device-settings form patch (see the module doc). */
+function splitDriverFormPatch(patch) {
+	const driverPatch = {};
+	const clearKeys = [];
+	for (const [key, value] of Object.entries(patch)) if (require_dist.isSecretClear(value)) {
+		driverPatch[key] = "";
+		clearKeys.push(key);
+	} else if (!require_dist.isSecretMarkerLike(value)) driverPatch[key] = value;
+	return {
+		driverPatch,
+		clearKeys
+	};
+}
+/**
+* Apply a device-settings form patch: the driver gets plain values only, then
+* an explicit clear removes the stored secret at the keychain door (after the
+* driver's own persist, whose `''` the door reads as KEEP).
+*/
+async function applyDriverFormPatch(input) {
+	const { driverPatch, clearKeys } = splitDriverFormPatch(input.patch);
+	if (Object.keys(driverPatch).length > 0) await input.applyToDriver(driverPatch);
+	if (clearKeys.length > 0) await input.clearSecrets(clearKeys);
+}
+//#endregion
 //#region src/builtins/device-manager/stale-wrapper-activations.ts
 /**
 * A stored wrapper activation that names a cap with NO wrapper any more.
@@ -3451,6 +3550,25 @@ function refusedLinkedPicks(params) {
 //#endregion
 //#region src/builtins/device-manager/device-aggregation.ts
 /**
+* A driver's hydrated sections as the browser may see them: every secret the
+* keychain stores is its VIEW, never the plaintext the driver was handed by
+* `loadConfig`. An unreadable blob withholds nothing new — the non-admin
+* redaction still runs at the transport — but it is logged.
+*/
+async function driverSectionsWithSecretViews(deps, deviceId, sections) {
+	const door = deps.deviceFormSecrets;
+	if (!door) return sections;
+	try {
+		return viewStoredSecrets(sections, await door.readStored(deviceId), door.declaredPaths(deviceId));
+	} catch (err) {
+		deps.ctx.logger.warn("device form: stored config unreadable — secret views not applied", {
+			tags: { deviceId },
+			meta: { error: require_dist.errMsg(err) }
+		});
+		return sections;
+	}
+}
+/**
 * One process-wide cache behind every device-details fan-out.
 *
 * Module-level on purpose: the page re-polls every 2.5 s and a per-call cache
@@ -3676,16 +3794,18 @@ async function buildBaseDeviceSection(deps, deviceId) {
 	if (!hubLocal && !nativeOwner) return null;
 	const sections = [];
 	const driverResult = await resolveDriverConfigSchema(deps, deviceId, hubLocal);
-	if (driverResult.status === "ok") for (const section of driverResult.schema.sections) sections.push({
-		id: section.id,
-		title: section.title,
-		tab: section.tab ?? "general",
-		order: section.order ?? 1,
-		fields: [...section.fields],
-		...section.description !== void 0 ? { description: section.description } : {},
-		...section.columns !== void 0 ? { columns: section.columns } : {}
-	});
-	else if (driverResult.status === "unavailable") sections.push({
+	if (driverResult.status === "ok") {
+		const driverSections = await driverSectionsWithSecretViews(deps, deviceId, driverResult.schema.sections);
+		for (const section of driverSections) sections.push({
+			id: section.id,
+			title: section.title,
+			tab: section.tab ?? "general",
+			order: section.order ?? 1,
+			fields: [...section.fields],
+			...section.description !== void 0 ? { description: section.description } : {},
+			...section.columns !== void 0 ? { columns: section.columns } : {}
+		});
+	} else if (driverResult.status === "unavailable") sections.push({
 		id: "driver-settings-unavailable",
 		title: "Driver Settings",
 		tab: "general",
@@ -4079,19 +4199,26 @@ async function applyGroupPatch(deps, deviceId, group) {
 			});
 			throw new Error(`[device-manager] ${retired.join(", ")} can no longer be saved from the settings section — reload the page and use the Extensions section`);
 		}
-		const driverPatch = group.patch;
-		if (Object.keys(driverPatch).length === 0) return;
-		const hubRegistry = deps.ctx.kernel?.deviceRegistry;
-		const found = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
-		if (found) {
-			await found.device.applySettingsPatch(driverPatch);
-			return;
-		}
-		const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
-		if (!ops) throw new Error(`[device-manager] device "${deviceId}" not found (no hub-local entry, no device-ops native provider)`);
-		await ops.setConfig({
-			deviceId,
-			values: driverPatch
+		await applyDriverFormPatch({
+			patch: group.patch,
+			applyToDriver: async (driverPatch) => {
+				const hubRegistry = deps.ctx.kernel?.deviceRegistry;
+				const found = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
+				if (found) {
+					await found.device.applySettingsPatch(driverPatch);
+					return;
+				}
+				const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
+				if (!ops) throw new Error(`[device-manager] device "${deviceId}" not found (no hub-local entry, no device-ops native provider)`);
+				await ops.setConfig({
+					deviceId,
+					values: driverPatch
+				});
+			},
+			clearSecrets: async (keys) => {
+				if (!deps.deviceFormSecrets) throw new Error(`[device-manager] cannot clear ${keys.join(", ")}: no keychain door`);
+				await deps.deviceFormSecrets.clear(deviceId, keys);
+			}
 		});
 		return;
 	}
@@ -9717,6 +9844,8 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 	removalFence = createRemovalFence();
 	/** Declared secret config paths per device, as last registered (D783). */
 	secretConfigPaths = createSecretConfigPathRegistry();
+	/** The keychain side of driver device forms (D789), wired in onInitialize. */
+	deviceFormSecrets;
 	/** The runtime-state mirror, asserted present (constructed in onInitialize). */
 	get stateMirror() {
 		if (!this.stateMirrorImpl) throw new Error("DeviceManagerAddon: state mirror accessed before onInitialize");
@@ -9869,7 +9998,8 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 			ctx: this.ctx,
 			capabilityRegistry: this.capabilityRegistry,
 			remoteNativeCaps: this.remoteNativeCaps,
-			bindingsDeps: this.bindingsDeps
+			bindingsDeps: this.bindingsDeps,
+			...this.deviceFormSecrets ? { deviceFormSecrets: this.deviceFormSecrets } : {}
 		};
 	}
 	async getDeviceAggregate(deviceId, kind) {
@@ -9965,6 +10095,15 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 				return provider;
 			}
 		};
+		this.deviceFormSecrets = {
+			readStored: (deviceId) => settings.readDeviceStore(deviceId),
+			declaredPaths: (deviceId) => this.secretConfigPaths.get(deviceId) ?? [],
+			clear: (deviceId, keys) => persistConfig(pctx, {
+				deviceId,
+				data: Object.fromEntries(keys.map((key) => [key, require_dist.SECRET_CLEAR])),
+				secretConfigPaths: [...new Set([...this.secretConfigPaths.get(deviceId) ?? [], ...keys])]
+			})
+		};
 		try {
 			await runLocationBackfillAtBoot(pctx, bootRows);
 		} catch (err) {