@camstack/system 1.2.380 → 1.2.382

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { $ as buildStreamParamsConfigSchema, A as MINUTES_PER_DAY, C as FieldClaimModeSchema, Dn as runtimeStatePolicyFor, Hr as secretTreeFromPaths, Kr as transformSecretWrite, Kt as legacyAutoLinkIds, L as STREAM_PROFILE_META, Mn as siteZoneKey, Nt as formatMinutes, O as LocationIconIdSchema, Ot as expandContainer, Sr as collectZodSecretPaths, St as deviceStatusCapability, Tt as enumerateSchemaFields, Wr as sleep$1, Xt as locationIconKey, ar as DeviceFeature, bt as deviceManagerCapability, c as CAP_NAMES_WITH_STATUS, cn as normalizeUnit, cr as errMsg, dn as parseStreamParamsFormPatch, dt as createDeviceExtensionProvider, gr as WELL_KNOWN_TAB_MAP, gt as defineExtensionSlotProvider, kr as isDeviceConfigCap, lr as BaseAddon, o as CAMERA_SWITCH_ORDER, or as DeviceRole, qr as EventCategory, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, v as DAY_NAMES, w as FieldClaimSchema, wt as enumerateItemArrayFields, x as DeviceStatusSchema, xt as deviceStateCapability, yt as deviceExtensionCapability, zr as resolveSecretMarkers } from "../../dist-B9oFw2jh.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-DlZ3VV6x.mjs";
+import { $r as transformSecretWrite, C as FieldClaimModeSchema, Ct as deviceStatusCapability, Et as enumerateSchemaFields, Fr as isSecretMarker, Gr as resolveSecretMarkers, Ir as isSecretMarkerLike, Jr as secretTreeFromPaths, Nn as siteZoneKey, Nr as isKeychainStoredField, On as runtimeStatePolicyFor, Pr as isSecretClear, Pt as formatMinutes, Qr as toSecretFieldView, R as STREAM_PROFILE_META, St as deviceStateCapability, Tt as enumerateItemArrayFields, Xr as sleep$1, Zt as locationIconKey, _r as SECRET_CLEAR, _t as defineExtensionSlotProvider, bt as deviceExtensionCapability, c as CAP_NAMES_WITH_STATUS, cr as DeviceType, ei as EventCategory, et as buildStreamParamsConfigSchema, fn as parseStreamParamsFormPatch, ft as createDeviceExtensionProvider, j as MINUTES_PER_DAY, jr as isDeviceConfigCap, k as LocationIconIdSchema, kt as expandContainer, ln as normalizeUnit, lr as errMsg, o as CAMERA_SWITCH_ORDER, or as DeviceFeature, qt as legacyAutoLinkIds, sr as DeviceRole, t as ALL_CAPABILITY_DEFINITIONS, ur as BaseAddon, v as DAY_NAMES, vr as WELL_KNOWN_TAB_MAP, w as FieldClaimSchema, wr as collectZodSecretPaths, x as DeviceStatusSchema, xt as deviceManagerCapability } from "../../dist-CP5TTjwd.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CzpIkwS-.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
@@ -1028,6 +1028,105 @@ function mergeAggregates(parts) {
 	return out;
 }
 //#endregion
+//#region src/builtins/device-manager/device-form-secrets.ts
+/**
+* A driver's device-settings form, kept on the keychain side of the wire
+* (D787 / D789 for device forms).
+*
+* A driver hydrates its own form from the config `loadConfig` RESOLVED for it,
+* so a camera password reaches the form as plaintext even though the stored
+* blob holds a keychain marker. This module closes that in ONE place — the
+* device-manager aggregate every device form goes through — for every driver:
+*
+*  - READ ({@link viewStoredSecrets}): a form field whose key names a stored
+*    MARKER (a declared `secretConfigPaths` entry, or a field secret by type)
+*    is handed the marker's VIEW instead of the driver's plaintext. A value
+*    that is still inline plaintext in the blob (not migrated) is left as the
+*    driver hydrated it: there is nothing to reveal it by.
+*  - WRITE ({@link applyDriverFormPatch}): the form sends the view back for an
+*    untouched field and `{ $secretClear: true }` for an explicit clear. The
+*    driver understands neither (its schema wants a string), so a view is
+*    dropped from the driver's patch (KEEP — the driver still holds the
+*    resolved value) and a clear reaches the driver as `''` while the stored
+*    marker is removed at the keychain door. A typed value passes through and
+*    the driver's own persist stores it in the keychain.
+*
+* Top-level keys only: a driver form's field key is its config key for every
+* declared device secret today (`password`, `apiKey`, `localKey`). A nested or
+* per-row path (`connection.password`, `rows[].pin`) is not mapped onto a form
+* field and keeps the driver's hydration.
+*/
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The declared paths that name a top-level config key. */
+function topLevelKeys(paths) {
+	return new Set(paths.filter((p) => p.length > 0 && !p.includes(".") && !p.includes("[")));
+}
+function viewField(field, stored, declared) {
+	if (!isRecord$2(field)) return field;
+	const nested = field["fields"];
+	if (Array.isArray(nested)) return {
+		...field,
+		fields: nested.map((f) => viewField(f, stored, declared))
+	};
+	const tabs = field["tabs"];
+	if (Array.isArray(tabs)) return {
+		...field,
+		tabs: tabs.map((tab) => isRecord$2(tab) && Array.isArray(tab["fields"]) ? {
+			...tab,
+			fields: tab["fields"].map((f) => viewField(f, stored, declared))
+		} : tab)
+	};
+	const key = field["key"];
+	if (typeof key !== "string" || !("value" in field)) return field;
+	const marker = stored[key];
+	if (!isSecretMarker(marker)) return field;
+	const secretByType = isKeychainStoredField(field);
+	if (!secretByType && !declared.has(key)) return field;
+	const type = secretByType ? field["type"] : "password";
+	return {
+		...field,
+		type,
+		value: toSecretFieldView(marker)
+	};
+}
+/**
+* The driver's hydrated sections with every keychain-stored secret replaced
+* by its view. Returns the input unchanged when the blob holds no marker.
+*/
+function viewStoredSecrets(sections, stored, declaredPaths) {
+	if (!Object.values(stored).some(isSecretMarker)) return sections;
+	const declared = topLevelKeys(declaredPaths);
+	return sections.map((section) => ({
+		...section,
+		fields: section.fields.map((f) => viewField(f, stored, declared))
+	}));
+}
+/** Split a device-settings form patch (see the module doc). */
+function splitDriverFormPatch(patch) {
+	const driverPatch = {};
+	const clearKeys = [];
+	for (const [key, value] of Object.entries(patch)) if (isSecretClear(value)) {
+		driverPatch[key] = "";
+		clearKeys.push(key);
+	} else if (!isSecretMarkerLike(value)) driverPatch[key] = value;
+	return {
+		driverPatch,
+		clearKeys
+	};
+}
+/**
+* Apply a device-settings form patch: the driver gets plain values only, then
+* an explicit clear removes the stored secret at the keychain door (after the
+* driver's own persist, whose `''` the door reads as KEEP).
+*/
+async function applyDriverFormPatch(input) {
+	const { driverPatch, clearKeys } = splitDriverFormPatch(input.patch);
+	if (Object.keys(driverPatch).length > 0) await input.applyToDriver(driverPatch);
+	if (clearKeys.length > 0) await input.clearSecrets(clearKeys);
+}
+//#endregion
 //#region src/builtins/device-manager/stale-wrapper-activations.ts
 /**
 * A stored wrapper activation that names a cap with NO wrapper any more.
@@ -3446,6 +3545,25 @@ function refusedLinkedPicks(params) {
 //#endregion
 //#region src/builtins/device-manager/device-aggregation.ts
 /**
+* A driver's hydrated sections as the browser may see them: every secret the
+* keychain stores is its VIEW, never the plaintext the driver was handed by
+* `loadConfig`. An unreadable blob withholds nothing new — the non-admin
+* redaction still runs at the transport — but it is logged.
+*/
+async function driverSectionsWithSecretViews(deps, deviceId, sections) {
+	const door = deps.deviceFormSecrets;
+	if (!door) return sections;
+	try {
+		return viewStoredSecrets(sections, await door.readStored(deviceId), door.declaredPaths(deviceId));
+	} catch (err) {
+		deps.ctx.logger.warn("device form: stored config unreadable — secret views not applied", {
+			tags: { deviceId },
+			meta: { error: errMsg(err) }
+		});
+		return sections;
+	}
+}
+/**
 * One process-wide cache behind every device-details fan-out.
 *
 * Module-level on purpose: the page re-polls every 2.5 s and a per-call cache
@@ -3671,16 +3789,18 @@ async function buildBaseDeviceSection(deps, deviceId) {
 	if (!hubLocal && !nativeOwner) return null;
 	const sections = [];
 	const driverResult = await resolveDriverConfigSchema(deps, deviceId, hubLocal);
-	if (driverResult.status === "ok") for (const section of driverResult.schema.sections) sections.push({
-		id: section.id,
-		title: section.title,
-		tab: section.tab ?? "general",
-		order: section.order ?? 1,
-		fields: [...section.fields],
-		...section.description !== void 0 ? { description: section.description } : {},
-		...section.columns !== void 0 ? { columns: section.columns } : {}
-	});
-	else if (driverResult.status === "unavailable") sections.push({
+	if (driverResult.status === "ok") {
+		const driverSections = await driverSectionsWithSecretViews(deps, deviceId, driverResult.schema.sections);
+		for (const section of driverSections) sections.push({
+			id: section.id,
+			title: section.title,
+			tab: section.tab ?? "general",
+			order: section.order ?? 1,
+			fields: [...section.fields],
+			...section.description !== void 0 ? { description: section.description } : {},
+			...section.columns !== void 0 ? { columns: section.columns } : {}
+		});
+	} else if (driverResult.status === "unavailable") sections.push({
 		id: "driver-settings-unavailable",
 		title: "Driver Settings",
 		tab: "general",
@@ -4074,19 +4194,26 @@ async function applyGroupPatch(deps, deviceId, group) {
 			});
 			throw new Error(`[device-manager] ${retired.join(", ")} can no longer be saved from the settings section — reload the page and use the Extensions section`);
 		}
-		const driverPatch = group.patch;
-		if (Object.keys(driverPatch).length === 0) return;
-		const hubRegistry = deps.ctx.kernel?.deviceRegistry;
-		const found = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
-		if (found) {
-			await found.device.applySettingsPatch(driverPatch);
-			return;
-		}
-		const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
-		if (!ops) throw new Error(`[device-manager] device "${deviceId}" not found (no hub-local entry, no device-ops native provider)`);
-		await ops.setConfig({
-			deviceId,
-			values: driverPatch
+		await applyDriverFormPatch({
+			patch: group.patch,
+			applyToDriver: async (driverPatch) => {
+				const hubRegistry = deps.ctx.kernel?.deviceRegistry;
+				const found = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
+				if (found) {
+					await found.device.applySettingsPatch(driverPatch);
+					return;
+				}
+				const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
+				if (!ops) throw new Error(`[device-manager] device "${deviceId}" not found (no hub-local entry, no device-ops native provider)`);
+				await ops.setConfig({
+					deviceId,
+					values: driverPatch
+				});
+			},
+			clearSecrets: async (keys) => {
+				if (!deps.deviceFormSecrets) throw new Error(`[device-manager] cannot clear ${keys.join(", ")}: no keychain door`);
+				await deps.deviceFormSecrets.clear(deviceId, keys);
+			}
 		});
 		return;
 	}
@@ -9712,6 +9839,8 @@ var DeviceManagerAddon = class extends BaseAddon {
 	removalFence = createRemovalFence();
 	/** Declared secret config paths per device, as last registered (D783). */
 	secretConfigPaths = createSecretConfigPathRegistry();
+	/** The keychain side of driver device forms (D789), wired in onInitialize. */
+	deviceFormSecrets;
 	/** The runtime-state mirror, asserted present (constructed in onInitialize). */
 	get stateMirror() {
 		if (!this.stateMirrorImpl) throw new Error("DeviceManagerAddon: state mirror accessed before onInitialize");
@@ -9864,7 +9993,8 @@ var DeviceManagerAddon = class extends BaseAddon {
 			ctx: this.ctx,
 			capabilityRegistry: this.capabilityRegistry,
 			remoteNativeCaps: this.remoteNativeCaps,
-			bindingsDeps: this.bindingsDeps
+			bindingsDeps: this.bindingsDeps,
+			...this.deviceFormSecrets ? { deviceFormSecrets: this.deviceFormSecrets } : {}
 		};
 	}
 	async getDeviceAggregate(deviceId, kind) {
@@ -9960,6 +10090,15 @@ var DeviceManagerAddon = class extends BaseAddon {
 				return provider;
 			}
 		};
+		this.deviceFormSecrets = {
+			readStored: (deviceId) => settings.readDeviceStore(deviceId),
+			declaredPaths: (deviceId) => this.secretConfigPaths.get(deviceId) ?? [],
+			clear: (deviceId, keys) => persistConfig(pctx, {
+				deviceId,
+				data: Object.fromEntries(keys.map((key) => [key, SECRET_CLEAR])),
+				secretConfigPaths: [...new Set([...this.secretConfigPaths.get(deviceId) ?? [], ...keys])]
+			})
+		};
 		try {
 			await runLocationBackfillAtBoot(pctx, bootRows);
 		} catch (err) {

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_dist = require("../../dist-tnAO12ak.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
+import { Qt as logDestinationCapability, ur as BaseAddon } from "../../dist-CP5TTjwd.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;