@camstack/system 1.2.380 → 1.2.382

package/dist/builtins/backup-orchestrator/encryption-key-store.d.ts

@@ -0,0 +1,36 @@
+import { ISettingsStoreProvider } from '@camstack/types';
+/**
+ * @durable class=config owner=backup-orchestrator
+ *   write="`setupEncryption` inserts one row per generated key and retires the
+ *     previous active row; `disableEncryption` retires the active row"
+ *   retention="none — one small row per key ever generated; a retired row
+ *     names the key older archives need"
+ */
+export declare const BACKUP_ENCRYPTION_KEYS_COLLECTION = "backup_encryption_keys";
+export interface BackupEncryptionKeyRecord {
+    readonly keyId: string;
+    readonly publicKey: string;
+    readonly createdAt: number;
+    readonly retiredAt: number | null;
+}
+type Store = Pick<ISettingsStoreProvider, 'declareCollection' | 'query' | 'insert' | 'deleteWhere'>;
+export declare class BackupEncryptionKeyStore {
+    private readonly store;
+    private readonly now;
+    private declared;
+    constructor(store: Store, now?: () => number);
+    private ensureDeclared;
+    /** Every key, newest first. */
+    list(): Promise<readonly BackupEncryptionKeyRecord[]>;
+    /** The key new archives are encrypted to; `null` = encryption off. */
+    active(): Promise<BackupEncryptionKeyRecord | null>;
+    /** Make `publicKey` the active key; the previous one is retired, kept listed. */
+    activate(input: {
+        readonly publicKey: string;
+    }): Promise<BackupEncryptionKeyRecord>;
+    /** Encryption off: the active key is retired. Archives already made keep needing it. */
+    disable(): Promise<void>;
+    private retireActive;
+    private write;
+}
+export {};

package/dist/builtins/backup-orchestrator/manifest-store.d.ts

@@ -9,8 +9,19 @@ export interface ManifestArchiveEntry {
     readonly createdAt: number;
     readonly sizeBytes: number;
     readonly label?: string;
-    /** Snapshot of the embedded `.camstack-backup-manifest.json`. */
+    /**
+     * Snapshot of the embedded `.camstack-backup-manifest.json`. For an
+     * ENCRYPTED archive only its outline (locations, totals, no file list): the
+     * destination holds this index in clear, and the file list stays inside the
+     * ciphertext.
+     */
     readonly manifest: ArchiveManifest;
+    /** Present when the archive is encrypted to a backup key. */
+    readonly encryption?: ManifestArchiveEncryption;
+}
+export interface ManifestArchiveEncryption {
+    readonly scheme: string;
+    readonly keyId: string;
 }
 export interface LocationBackupManifest {
     readonly version: 1;
@@ -38,6 +49,12 @@ export declare function writeLocationManifest(api: ManifestStorageApi, locationI
  * stance as the legacy `LocalBackupService.ensureManifestsLoaded`.
  */
 export declare function parseManifestBytes(bytes: Uint8Array): LocationBackupManifest;
+/**
+ * What the destination's clear-text index may say about an encrypted archive:
+ * the outline a restore needs (locations, sizes, the snapshot promise) — not
+ * the list of files, which stays inside the ciphertext.
+ */
+export declare function outlineOfManifest(manifest: ArchiveManifest): ArchiveManifest;
 /**
  * Build a `ManifestArchiveEntry` from the raw inputs collected during
  * a successful upload. Pure transform — no I/O — kept here so the
@@ -50,6 +67,7 @@ export declare function buildArchiveEntry(input: {
     sizeBytes: number;
     label?: string;
     manifest: ArchiveManifest;
+    encryption?: ManifestArchiveEncryption;
 }): ManifestArchiveEntry;
 /**
  * Pure retention split: given an archive list and the operator's

package/dist/builtins/backup-orchestrator/restore-archive.d.ts

@@ -0,0 +1,24 @@
+/** An encrypted backup was asked to restore without its key. */
+export declare class BackupKeyRequiredError extends Error {
+    readonly keyId: string;
+    constructor(keyId: string);
+}
+/**
+ * Before downloading gigabytes: does the operator's key fit what the
+ * destination's manifest says the archive needs? `archiveKeyId` undefined =
+ * the manifest records no encryption (the header check after the download
+ * remains the authority).
+ */
+export declare function precheckRestoreKey(archiveKeyId: string | undefined, secretKey: string | undefined): void;
+export interface PrepareRestoreInput {
+    /** The archive as downloaded from the destination. Consumed (deleted or renamed). */
+    readonly downloaded: string;
+    /** Where the restore marker will point: a plain `.tar.gz`. */
+    readonly target: string;
+    readonly secretKey?: string;
+}
+export interface PreparedRestore {
+    readonly encrypted: boolean;
+    readonly keyId?: string;
+}
+export declare function prepareRestoreArchive(input: PrepareRestoreInput): Promise<PreparedRestore>;

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-tnAO12ak.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let zod = require("zod");
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/calendars/calendars.addon.mjs

@@ -1,4 +1,4 @@
-import { et as calendarsCapability, lr as BaseAddon, p as CalendarPreferencesSchema } from "../../dist-B9oFw2jh.mjs";
+import { p as CalendarPreferencesSchema, tt as calendarsCapability, ur as BaseAddon } from "../../dist-CP5TTjwd.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { z } from "zod";
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/camera-grid/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-tnAO12ak.js");
 let zod = require("zod");
 let _camstack_types_node = require("@camstack/types/node");
 let node_path = require("node:path");

package/dist/builtins/camera-grid/index.mjs

@@ -1,4 +1,4 @@
-import { Cr as createEvent, Jn as buildFfmpegArgs, M as MOTION_CLOSE_AFTER_MS, Nn as snapshotCapability, Or as hydrateSchema, Rn as streamCatalogCapability, ar as DeviceFeature, b as DeclaredDevices, cr as errMsg, i as BaseDevice, lr as BaseAddon, mt as declarationOwnerNodeId, on as motionCapability, qr as EventCategory, rn as memoizePinnedFfmpeg, sr as DeviceType, tt as cameraGridLayoutCapability, y as DERIVED_CAMERA_SILENCED_CAP_NAMES } from "../../dist-B9oFw2jh.mjs";
+import { Ar as hydrateSchema, N as MOTION_CLOSE_AFTER_MS, Pn as snapshotCapability, Tr as createEvent, Yn as buildFfmpegArgs, b as DeclaredDevices, cr as DeviceType, ei as EventCategory, ht as declarationOwnerNodeId, i as BaseDevice, in as memoizePinnedFfmpeg, lr as errMsg, nt as cameraGridLayoutCapability, or as DeviceFeature, sn as motionCapability, ur as BaseAddon, y as DERIVED_CAMERA_SILENCED_CAP_NAMES, zn as streamCatalogCapability } from "../../dist-CP5TTjwd.mjs";
 import { z } from "zod";
 import { FfmpegProcess } from "@camstack/types/node";
 import { join } from "node:path";

package/dist/builtins/composer/composer.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
-const require_composition_sources = require("../../composition-sources-CHvLMrFI.js");
+const require_dist = require("../../dist-tnAO12ak.js");
+const require_composition_sources = require("../../composition-sources-C6ZynCZ2.js");
 let zod = require("zod");
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { $n as compositionItemFieldPath, Cr as createEvent, Et as evaluateCompositionField, Q as buildCapabilityLookup, Qn as compositionFeatureEnabled, Xn as composedDeviceRef, Yn as cloneStatefulExpressionMemory, Zn as composedDeviceStableId, b as DeclaredDevices, cr as errMsg, er as compositionSliceKey, i as BaseDevice, ir as toExpressionValue, it as compositionFieldKey, kt as expressionContainsBuiltinCall, l as COMPOSED_ITEM_FIXED_FIELDS, lr as BaseAddon, nr as createStatefulExpressionMemory, pn as planComposition, qn as COMPOSER_ADDON_ID, qr as EventCategory, rr as disarmRoseMemory, rt as composerCapability, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey } from "../../dist-B9oFw2jh.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-DT_uJwI3.mjs";
+import { $ as buildCapabilityLookup, $n as compositionFeatureEnabled, At as expressionContainsBuiltinCall, Dt as evaluateCompositionField, Jn as COMPOSER_ADDON_ID, Qn as composedDeviceStableId, Tr as createEvent, Xn as cloneStatefulExpressionMemory, Zn as composedDeviceRef, ar as toExpressionValue, at as compositionFieldKey, b as DeclaredDevices, cr as DeviceType, ei as EventCategory, er as compositionItemFieldPath, i as BaseDevice, ir as disarmRoseMemory, it as composerCapability, l as COMPOSED_ITEM_FIXED_FIELDS, lr as errMsg, mn as planComposition, nr as compositionSourceKey, rr as createStatefulExpressionMemory, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSliceKey, ur as BaseAddon } from "../../dist-CP5TTjwd.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-XqRX51db.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-tnAO12ak.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
+import { Qt as logDestinationCapability, ur as BaseAddon } from "../../dist-CP5TTjwd.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
-const require_composition_sources = require("../../composition-sources-CHvLMrFI.js");
+const require_dist = require("../../dist-tnAO12ak.js");
+const require_composition_sources = require("../../composition-sources-C6ZynCZ2.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
-import { Or as hydrateSchema, Q as buildCapabilityLookup, Sn as resolveCoreBlockFiles, Vn as validateComposition, Xn as composedDeviceRef, at as compositionSourceRefs, b as DeclaredDevices, cr as errMsg, ct as coreBlockIdFromAddonId, d as CORE_BLOCKS_ADDON_ID, f as CORE_BLOCK_ADDON_PREFIX, lr as BaseAddon, lt as coreBlockSourceKind, m as CoreBlockSchema, ot as coreBlockAddonId, pn as planComposition, sn as normalizeCoreBlockWrite, st as coreBlockComposition, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey, u as COMPOSER_RUNNER_ID, ut as coreBlocksCapability, vn as replacedFieldKeys, vt as describeComposableCaps, xn as resolveCoreBlockEntry } from "../../dist-B9oFw2jh.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-DT_uJwI3.mjs";
+import { $ as buildCapabilityLookup, Ar as hydrateSchema, Cn as resolveCoreBlockFiles, Hn as validateComposition, Sn as resolveCoreBlockEntry, Zn as composedDeviceRef, b as DeclaredDevices, cn as normalizeCoreBlockWrite, ct as coreBlockComposition, d as CORE_BLOCKS_ADDON_ID, dt as coreBlocksCapability, f as CORE_BLOCK_ADDON_PREFIX, lr as errMsg, lt as coreBlockIdFromAddonId, m as CoreBlockSchema, mn as planComposition, nr as compositionSourceKey, ot as compositionSourceRefs, st as coreBlockAddonId, t as ALL_CAPABILITY_DEFINITIONS, u as COMPOSER_RUNNER_ID, ur as BaseAddon, ut as coreBlockSourceKind, yn as replacedFieldKeys, yt as describeComposableCaps } from "../../dist-CP5TTjwd.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-XqRX51db.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { customizationBlockName } from "@camstack/types/node";

package/dist/builtins/device-manager/device-aggregation.d.ts

@@ -12,6 +12,18 @@ export interface AggregationDeps {
     readonly capabilityRegistry: ICapabilityRegistry | undefined;
     readonly remoteNativeCaps: RemoteNativeCaps;
     readonly bindingsDeps: BindingsDeps;
+    /**
+     * The keychain side of a driver's device form (D789): the STORED blob (its
+     * markers, never resolved), the device's declared secret paths, and the
+     * door's explicit clear. Without it a driver form carries what the driver
+     * hydrated and a clear cannot be applied.
+     */
+    readonly deviceFormSecrets?: DeviceFormSecretsDeps;
+}
+export interface DeviceFormSecretsDeps {
+    readonly readStored: (deviceId: number) => Promise<Record<string, unknown>>;
+    readonly declaredPaths: (deviceId: number) => readonly string[];
+    readonly clear: (deviceId: number, keys: readonly string[]) => Promise<void>;
 }
 type IDeviceManagerProvider = InferProvider<typeof deviceManagerCapability>;
 export declare function getDeviceAggregate(deps: AggregationDeps, deviceId: number, kind: 'settings' | 'live'): Promise<ContributionShape | null>;

package/dist/builtins/device-manager/device-form-secrets.d.ts

@@ -0,0 +1,25 @@
+import { ContributionShape } from './device-meta-types.js';
+type Sections = ContributionShape['sections'];
+/**
+ * The driver's hydrated sections with every keychain-stored secret replaced
+ * by its view. Returns the input unchanged when the blob holds no marker.
+ */
+export declare function viewStoredSecrets(sections: Sections, stored: Record<string, unknown>, declaredPaths: readonly string[]): Sections;
+/** A form patch split into what the driver applies and what the door clears. */
+export interface DriverFormPatch {
+    readonly driverPatch: Record<string, unknown>;
+    readonly clearKeys: readonly string[];
+}
+/** Split a device-settings form patch (see the module doc). */
+export declare function splitDriverFormPatch(patch: Record<string, unknown>): DriverFormPatch;
+/**
+ * Apply a device-settings form patch: the driver gets plain values only, then
+ * an explicit clear removes the stored secret at the keychain door (after the
+ * driver's own persist, whose `''` the door reads as KEEP).
+ */
+export declare function applyDriverFormPatch(input: {
+    readonly patch: Record<string, unknown>;
+    readonly applyToDriver: (driverPatch: Record<string, unknown>) => Promise<void>;
+    readonly clearSecrets: (keys: readonly string[]) => Promise<void>;
+}): Promise<void>;
+export {};

package/dist/builtins/device-manager/device-manager.addon.d.ts

@@ -71,6 +71,8 @@ export declare class DeviceManagerAddon extends BaseAddon {
     private readonly removalFence;
     /** Declared secret config paths per device, as last registered (D783). */
     private readonly secretConfigPaths;
+    /** The keychain side of driver device forms (D789), wired in onInitialize. */
+    private deviceFormSecrets;
     /** The runtime-state mirror, asserted present (constructed in onInitialize). */
     private get stateMirror();
     /**

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-YOOKLA3v.js");
+const require_dist = require("../../dist-tnAO12ak.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-4bHpL-0m.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -1033,6 +1033,105 @@ function mergeAggregates(parts) {
 	return out;
 }
 //#endregion
+//#region src/builtins/device-manager/device-form-secrets.ts
+/**
+* A driver's device-settings form, kept on the keychain side of the wire
+* (D787 / D789 for device forms).
+*
+* A driver hydrates its own form from the config `loadConfig` RESOLVED for it,
+* so a camera password reaches the form as plaintext even though the stored
+* blob holds a keychain marker. This module closes that in ONE place — the
+* device-manager aggregate every device form goes through — for every driver:
+*
+*  - READ ({@link viewStoredSecrets}): a form field whose key names a stored
+*    MARKER (a declared `secretConfigPaths` entry, or a field secret by type)
+*    is handed the marker's VIEW instead of the driver's plaintext. A value
+*    that is still inline plaintext in the blob (not migrated) is left as the
+*    driver hydrated it: there is nothing to reveal it by.
+*  - WRITE ({@link applyDriverFormPatch}): the form sends the view back for an
+*    untouched field and `{ $secretClear: true }` for an explicit clear. The
+*    driver understands neither (its schema wants a string), so a view is
+*    dropped from the driver's patch (KEEP — the driver still holds the
+*    resolved value) and a clear reaches the driver as `''` while the stored
+*    marker is removed at the keychain door. A typed value passes through and
+*    the driver's own persist stores it in the keychain.
+*
+* Top-level keys only: a driver form's field key is its config key for every
+* declared device secret today (`password`, `apiKey`, `localKey`). A nested or
+* per-row path (`connection.password`, `rows[].pin`) is not mapped onto a form
+* field and keeps the driver's hydration.
+*/
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The declared paths that name a top-level config key. */
+function topLevelKeys(paths) {
+	return new Set(paths.filter((p) => p.length > 0 && !p.includes(".") && !p.includes("[")));
+}
+function viewField(field, stored, declared) {
+	if (!isRecord$2(field)) return field;
+	const nested = field["fields"];
+	if (Array.isArray(nested)) return {
+		...field,
+		fields: nested.map((f) => viewField(f, stored, declared))
+	};
+	const tabs = field["tabs"];
+	if (Array.isArray(tabs)) return {
+		...field,
+		tabs: tabs.map((tab) => isRecord$2(tab) && Array.isArray(tab["fields"]) ? {
+			...tab,
+			fields: tab["fields"].map((f) => viewField(f, stored, declared))
+		} : tab)
+	};
+	const key = field["key"];
+	if (typeof key !== "string" || !("value" in field)) return field;
+	const marker = stored[key];
+	if (!require_dist.isSecretMarker(marker)) return field;
+	const secretByType = require_dist.isKeychainStoredField(field);
+	if (!secretByType && !declared.has(key)) return field;
+	const type = secretByType ? field["type"] : "password";
+	return {
+		...field,
+		type,
+		value: require_dist.toSecretFieldView(marker)
+	};
+}
+/**
+* The driver's hydrated sections with every keychain-stored secret replaced
+* by its view. Returns the input unchanged when the blob holds no marker.
+*/
+function viewStoredSecrets(sections, stored, declaredPaths) {
+	if (!Object.values(stored).some(require_dist.isSecretMarker)) return sections;
+	const declared = topLevelKeys(declaredPaths);
+	return sections.map((section) => ({
+		...section,
+		fields: section.fields.map((f) => viewField(f, stored, declared))
+	}));
+}
+/** Split a device-settings form patch (see the module doc). */
+function splitDriverFormPatch(patch) {
+	const driverPatch = {};
+	const clearKeys = [];
+	for (const [key, value] of Object.entries(patch)) if (require_dist.isSecretClear(value)) {
+		driverPatch[key] = "";
+		clearKeys.push(key);
+	} else if (!require_dist.isSecretMarkerLike(value)) driverPatch[key] = value;
+	return {
+		driverPatch,
+		clearKeys
+	};
+}
+/**
+* Apply a device-settings form patch: the driver gets plain values only, then
+* an explicit clear removes the stored secret at the keychain door (after the
+* driver's own persist, whose `''` the door reads as KEEP).
+*/
+async function applyDriverFormPatch(input) {
+	const { driverPatch, clearKeys } = splitDriverFormPatch(input.patch);
+	if (Object.keys(driverPatch).length > 0) await input.applyToDriver(driverPatch);
+	if (clearKeys.length > 0) await input.clearSecrets(clearKeys);
+}
+//#endregion
 //#region src/builtins/device-manager/stale-wrapper-activations.ts
 /**
 * A stored wrapper activation that names a cap with NO wrapper any more.
@@ -3451,6 +3550,25 @@ function refusedLinkedPicks(params) {
 //#endregion
 //#region src/builtins/device-manager/device-aggregation.ts
 /**
+* A driver's hydrated sections as the browser may see them: every secret the
+* keychain stores is its VIEW, never the plaintext the driver was handed by
+* `loadConfig`. An unreadable blob withholds nothing new — the non-admin
+* redaction still runs at the transport — but it is logged.
+*/
+async function driverSectionsWithSecretViews(deps, deviceId, sections) {
+	const door = deps.deviceFormSecrets;
+	if (!door) return sections;
+	try {
+		return viewStoredSecrets(sections, await door.readStored(deviceId), door.declaredPaths(deviceId));
+	} catch (err) {
+		deps.ctx.logger.warn("device form: stored config unreadable — secret views not applied", {
+			tags: { deviceId },
+			meta: { error: require_dist.errMsg(err) }
+		});
+		return sections;
+	}
+}
+/**
 * One process-wide cache behind every device-details fan-out.
 *
 * Module-level on purpose: the page re-polls every 2.5 s and a per-call cache
@@ -3676,16 +3794,18 @@ async function buildBaseDeviceSection(deps, deviceId) {
 	if (!hubLocal && !nativeOwner) return null;
 	const sections = [];
 	const driverResult = await resolveDriverConfigSchema(deps, deviceId, hubLocal);
-	if (driverResult.status === "ok") for (const section of driverResult.schema.sections) sections.push({
-		id: section.id,
-		title: section.title,
-		tab: section.tab ?? "general",
-		order: section.order ?? 1,
-		fields: [...section.fields],
-		...section.description !== void 0 ? { description: section.description } : {},
-		...section.columns !== void 0 ? { columns: section.columns } : {}
-	});
-	else if (driverResult.status === "unavailable") sections.push({
+	if (driverResult.status === "ok") {
+		const driverSections = await driverSectionsWithSecretViews(deps, deviceId, driverResult.schema.sections);
+		for (const section of driverSections) sections.push({
+			id: section.id,
+			title: section.title,
+			tab: section.tab ?? "general",
+			order: section.order ?? 1,
+			fields: [...section.fields],
+			...section.description !== void 0 ? { description: section.description } : {},
+			...section.columns !== void 0 ? { columns: section.columns } : {}
+		});
+	} else if (driverResult.status === "unavailable") sections.push({
 		id: "driver-settings-unavailable",
 		title: "Driver Settings",
 		tab: "general",
@@ -4079,19 +4199,26 @@ async function applyGroupPatch(deps, deviceId, group) {
 			});
 			throw new Error(`[device-manager] ${retired.join(", ")} can no longer be saved from the settings section — reload the page and use the Extensions section`);
 		}
-		const driverPatch = group.patch;
-		if (Object.keys(driverPatch).length === 0) return;
-		const hubRegistry = deps.ctx.kernel?.deviceRegistry;
-		const found = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
-		if (found) {
-			await found.device.applySettingsPatch(driverPatch);
-			return;
-		}
-		const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
-		if (!ops) throw new Error(`[device-manager] device "${deviceId}" not found (no hub-local entry, no device-ops native provider)`);
-		await ops.setConfig({
-			deviceId,
-			values: driverPatch
+		await applyDriverFormPatch({
+			patch: group.patch,
+			applyToDriver: async (driverPatch) => {
+				const hubRegistry = deps.ctx.kernel?.deviceRegistry;
+				const found = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
+				if (found) {
+					await found.device.applySettingsPatch(driverPatch);
+					return;
+				}
+				const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
+				if (!ops) throw new Error(`[device-manager] device "${deviceId}" not found (no hub-local entry, no device-ops native provider)`);
+				await ops.setConfig({
+					deviceId,
+					values: driverPatch
+				});
+			},
+			clearSecrets: async (keys) => {
+				if (!deps.deviceFormSecrets) throw new Error(`[device-manager] cannot clear ${keys.join(", ")}: no keychain door`);
+				await deps.deviceFormSecrets.clear(deviceId, keys);
+			}
 		});
 		return;
 	}
@@ -9717,6 +9844,8 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 	removalFence = createRemovalFence();
 	/** Declared secret config paths per device, as last registered (D783). */
 	secretConfigPaths = createSecretConfigPathRegistry();
+	/** The keychain side of driver device forms (D789), wired in onInitialize. */
+	deviceFormSecrets;
 	/** The runtime-state mirror, asserted present (constructed in onInitialize). */
 	get stateMirror() {
 		if (!this.stateMirrorImpl) throw new Error("DeviceManagerAddon: state mirror accessed before onInitialize");
@@ -9869,7 +9998,8 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 			ctx: this.ctx,
 			capabilityRegistry: this.capabilityRegistry,
 			remoteNativeCaps: this.remoteNativeCaps,
-			bindingsDeps: this.bindingsDeps
+			bindingsDeps: this.bindingsDeps,
+			...this.deviceFormSecrets ? { deviceFormSecrets: this.deviceFormSecrets } : {}
 		};
 	}
 	async getDeviceAggregate(deviceId, kind) {
@@ -9965,6 +10095,15 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 				return provider;
 			}
 		};
+		this.deviceFormSecrets = {
+			readStored: (deviceId) => settings.readDeviceStore(deviceId),
+			declaredPaths: (deviceId) => this.secretConfigPaths.get(deviceId) ?? [],
+			clear: (deviceId, keys) => persistConfig(pctx, {
+				deviceId,
+				data: Object.fromEntries(keys.map((key) => [key, require_dist.SECRET_CLEAR])),
+				secretConfigPaths: [...new Set([...this.secretConfigPaths.get(deviceId) ?? [], ...keys])]
+			})
+		};
 		try {
 			await runLocationBackfillAtBoot(pctx, bootRows);
 		} catch (err) {