@camstack/system 1.2.438 → 1.2.440

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,7 @@
-import { Bt as enumerateItemArrayFields, C as DAY_NAMES, Dn as parseStreamParamsFormPatch, Dr as errMsg, Er as DeviceType, Et as createDeviceExtensionProvider, Ft as deviceExtensionCapability, Ir as SECRET_CLEAR, It as deviceManagerCapability, Lr as WELL_KNOWN_TAB_MAP, Lt as deviceStateCapability, N as FieldClaimModeSchema, Or as BaseAddon, P as FieldClaimSchema, Qr as isDeviceConfigCap, Rt as deviceStatusCapability, Tr as DeviceRole, Un as runtimeStatePolicyFor, Ur as collectZodSecretPaths, V as MINUTES_PER_DAY, Vt as enumerateSchemaFields, Wt as expandContainer, Xt as formatMinutes, Yn as siteZoneKey, _i as transformSecretWrite, c as CAMERA_SWITCH_ORDER, di as resolveSecretMarkers, ei as isKeychainStoredField, gi as toSecretFieldView, gt as canonicalIconKey, j as DeviceStatusSchema, jt as defineExtensionSlotProvider, ln as legacyAutoLinkIds, mi as sleep$1, ni as isSecretMarker, pi as secretTreeFromPaths, pn as locationIconKey, pt as buildStreamParamsConfigSchema, q as STREAM_PROFILE_META, r as ALL_CAPABILITY_DEFINITIONS, ri as isSecretMarkerLike, ti as isSecretClear, u as CAP_NAMES_WITH_STATUS, vi as userError, wn as normalizeUnit, wr as DeviceFeature, yi as EventCategory } from "../../dist-Dc8GKC5H.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-Is0zO8gX.mjs";
+import { Ar as errMsg, Br as WELL_KNOWN_TAB_MAP, Bt as deviceStatusCapability, C as DAY_NAMES, Dr as DeviceFeature, En as normalizeUnit, Gn as runtimeStatePolicyFor, Ht as enumerateItemArrayFields, Kr as collectZodSecretPaths, Kt as expandContainer, Lt as deviceExtensionCapability, N as FieldClaimModeSchema, Nt as defineExtensionSlotProvider, Or as DeviceRole, Ot as createDeviceExtensionProvider, P as FieldClaimSchema, Qt as formatMinutes, Rt as deviceManagerCapability, Si as EventCategory, Ut as enumerateSchemaFields, V as MINUTES_PER_DAY, Y as STREAM_PROFILE_META, Zn as siteZoneKey, _i as sleep$1, ai as isSecretMarker, bi as transformSecretWrite, c as CAMERA_SWITCH_ORDER, dn as legacyAutoLinkIds, gi as secretTreeFromPaths, hn as locationIconKey, ht as buildStreamParamsConfigSchema, ii as isSecretClear, j as DeviceStatusSchema, jr as BaseAddon, kn as parseStreamParamsFormPatch, kr as DeviceType, mi as resolveSecretMarkers, oi as isSecretMarkerLike, r as ALL_CAPABILITY_DEFINITIONS, ri as isKeychainStoredField, ti as isDeviceConfigCap, u as CAP_NAMES_WITH_STATUS, vt as canonicalIconKey, xi as userError, yi as toSecretFieldView, zr as SECRET_CLEAR, zt as deviceStateCapability } from "../../dist-9fcsrFU3.mjs";
+import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
+import { t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";
+import { r as purgeRetiredSettingsRows } from "../../retired-settings-keys-Bhwe4ymb.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
@@ -2725,30 +2727,13 @@ async function listPersistedByAddon(pctx, input) {
 	return saved;
 }
 /**
-* Every requested device's persisted config, in as few store round trips as the
-* settings view allows.
-*
-* One call when the view can batch (the in-process door, which keys
-* `addon-device-settings` by `<addonId>:<deviceId>.` and answers a whole addon
-* with one indexed range scan). Otherwise the per-device form, unchanged — a
-* fallback and not a silent downgrade: `readDeviceStoreBatch` is optional
-* precisely because a forked addon's view has nothing to batch, and refusing
-* would break the only implementation that cannot comply.
-*
-* A read that THROWS yields `{}` for that device rather than failing the whole
-* listing: one unreadable settings row must not make the fleet unlistable.
+* Every requested device's persisted config in ONE store round trip (D870). A
+* store that cannot be asked THROWS and the listing fails with it: an
+* unreadable row is not a device with no settings (D49).
 */
 async function readDeviceConfigs(pctx, deviceIds) {
 	if (deviceIds.length === 0) return /* @__PURE__ */ new Map();
-	const batch = pctx.settings.readDeviceStoreBatch;
-	if (batch !== void 0) return batch.call(pctx.settings, deviceIds);
-	const out = /* @__PURE__ */ new Map();
-	for (const id of deviceIds) try {
-		out.set(id, await pctx.settings.readDeviceStore(id));
-	} catch {
-		out.set(id, {});
-	}
-	return out;
+	return pctx.settings.readDeviceStoreBatch(deviceIds);
 }
 async function listAll(pctx, input) {
 	const ownerFilter = Reflect.get(input, "addonId");
@@ -4851,6 +4836,170 @@ function createDeviceManagerExtensionProvider(pctx) {
 	});
 }
 //#endregion
+//#region src/kernel/device-settings-store.ts
+/** The collection every addon's per-device settings share. Named nowhere else. */
+var DEVICE_SETTINGS_COLLECTION = "addon-device-settings";
+function scopeOf(addonId, deviceId) {
+	return `${addonId}:${String(deviceId)}.`;
+}
+function assertDeviceId(deviceId) {
+	if (!Number.isInteger(deviceId) || deviceId <= 0) throw new Error(`device settings: "${String(deviceId)}" is not a device id`);
+}
+function deviceIdOfSuffix(suffix) {
+	const dot = suffix.indexOf(".");
+	if (dot <= 0) return null;
+	const id = Number(suffix.slice(0, dot));
+	return Number.isInteger(id) && id > 0 ? id : null;
+}
+/** Every field row of one device scope, or a throw. */
+async function readScope(door, addonId, deviceId) {
+	return loadPrefixed(door, DEVICE_SETTINGS_COLLECTION, scopeOf(addonId, deviceId));
+}
+function createDeviceSettingsStore(door, addonId) {
+	return {
+		async read(deviceId) {
+			try {
+				assertDeviceId(deviceId);
+				const value = await readScope(door, addonId, deviceId);
+				return Object.keys(value).length === 0 ? { kind: "absent" } : {
+					kind: "present",
+					value
+				};
+			} catch (err) {
+				return {
+					kind: "unreadable",
+					error: err instanceof Error ? err.message : String(err)
+				};
+			}
+		},
+		async readBatch(deviceIds) {
+			const out = /* @__PURE__ */ new Map();
+			if (deviceIds.length === 0) return out;
+			for (const id of deviceIds) out.set(id, {});
+			const wanted = new Set(deviceIds);
+			const all = await loadPrefixed(door, DEVICE_SETTINGS_COLLECTION, `${addonId}:`);
+			for (const [suffix, value] of Object.entries(all)) {
+				const id = deviceIdOfSuffix(suffix);
+				if (id === null || !wanted.has(id)) continue;
+				const blob = out.get(id);
+				if (blob !== void 0) blob[suffix.slice(suffix.indexOf(".") + 1)] = value;
+			}
+			return out;
+		},
+		async listIds() {
+			const all = await loadPrefixed(door, DEVICE_SETTINGS_COLLECTION, `${addonId}:`, () => null);
+			const ids = /* @__PURE__ */ new Set();
+			for (const suffix of Object.keys(all)) {
+				const id = deviceIdOfSuffix(suffix);
+				if (id !== null) ids.add(id);
+			}
+			return [...ids].toSorted((a, b) => a - b);
+		},
+		async merge(deviceId, patch) {
+			assertDeviceId(deviceId);
+			const scope = scopeOf(addonId, deviceId);
+			const records = [];
+			const removed = [];
+			for (const [key, value] of Object.entries(patch)) if (value === void 0) removed.push(`${scope}${key}`);
+			else records.push({
+				id: `${scope}${key}`,
+				data: {
+					addonId,
+					deviceId: String(deviceId),
+					key,
+					value
+				}
+			});
+			if (records.length === 0 && removed.length === 0) return;
+			await door.transact({ ops: [...removed.length > 0 ? [{
+				op: "deleteWhere",
+				collection: DEVICE_SETTINGS_COLLECTION,
+				filter: { whereIn: { id: removed } }
+			}] : [], ...records.length > 0 ? [{
+				op: "upsertMany",
+				collection: DEVICE_SETTINGS_COLLECTION,
+				conflict: ["id"],
+				records
+			}] : []] });
+		},
+		async clear(deviceId) {
+			assertDeviceId(deviceId);
+			const range = prefixRange(scopeOf(addonId, deviceId));
+			if (range === null) throw new Error(`device settings: no id range for addon "${addonId}"`);
+			await door.deleteWhere({
+				collection: DEVICE_SETTINGS_COLLECTION,
+				filter: { whereBetween: { id: [range.lo, range.hi] } }
+			});
+		}
+	};
+}
+/** The `Record` form of a read: `{}` for a store that answered with no row, a THROW for one that did not. */
+async function readDeviceOrThrow(store, deviceId) {
+	const read = await store.read(deviceId);
+	switch (read.kind) {
+		case "present": return { ...read.value };
+		case "absent": return {};
+		case "unreadable": throw new Error(`device settings of ${String(deviceId)} could not be read: ${read.error}`);
+	}
+}
+/**
+* Remove a device's rows for EVERY addon, in one statement (D865's central
+* delete). Matched on the device id each row carries, so no addon needs a
+* handler. Returns how many rows went.
+*/
+async function clearDeviceSettings(door, deviceId) {
+	assertDeviceId(deviceId);
+	const { deleted } = await door.deleteWhere({
+		collection: DEVICE_SETTINGS_COLLECTION,
+		filter: { where: { deviceId: String(deviceId) } }
+	});
+	return deleted;
+}
+/** Rows one page of the scope walk asks for. */
+var SCOPE_PAGE_ROWS = 1e3;
+/** Pages the walk may take before it refuses (a bound, never a silent cut). */
+var SCOPE_PAGE_BUDGET = 512;
+/** Above every id: ids are ASCII. */
+var SCOPE_TAIL = "";
+/**
+* Every (addon, device) pair holding rows, across all addons - the admin
+* "deleted devices" listing. A keyset walk by primary key (never one query cut
+* at a row cap): a read that cannot be completed THROWS.
+*/
+async function listDeviceSettingsScopes(door) {
+	const seen = /* @__PURE__ */ new Map();
+	let cursor = "";
+	for (let page = 0;; page++) {
+		if (page >= SCOPE_PAGE_BUDGET) throw new Error(`device settings scopes: more than ${SCOPE_PAGE_BUDGET} pages - refusing a partial list`);
+		const rows = await door.query({
+			collection: DEVICE_SETTINGS_COLLECTION,
+			filter: {
+				whereBetween: { id: [cursor, SCOPE_TAIL] },
+				orderBy: {
+					field: "id",
+					direction: "asc"
+				},
+				limit: SCOPE_PAGE_ROWS
+			}
+		});
+		for (const row of rows) {
+			const addonId = row.data["addonId"];
+			const raw = row.data["deviceId"];
+			if (typeof addonId !== "string" || typeof raw !== "string") continue;
+			const deviceId = Number(raw);
+			if (!Number.isInteger(deviceId) || deviceId <= 0) continue;
+			seen.set(`${addonId}:${deviceId}`, {
+				deviceId,
+				addonId
+			});
+		}
+		const last = rows[rows.length - 1];
+		if (rows.length < SCOPE_PAGE_ROWS || last === void 0) return [...seen.values()];
+		if (last.id === cursor) throw new Error(`device settings scopes: no progress at "${last.id}"`);
+		cursor = last.id;
+	}
+}
+//#endregion
 //#region src/builtins/device-manager/migration-refused.ts
 /**
 * A migration step that REFUSED with nothing moved.
@@ -5783,41 +5932,16 @@ async function cleanupDeletedDevicesData(deps, input) {
 		unreachable: [...unreachable]
 	};
 }
-/** The settings-store collection every addon's per-device settings share. */
-var ADDON_DEVICE_SETTINGS_COLLECTION = "addon-device-settings";
-/** The engine's hard ceiling on one read; a result this long may be a truncated one. */
-var SCOPE_READ_LIMIT = 2e4;
 /** Scope access over the settings store; undefined when the store is unavailable. */
 function settingsScopes(store) {
 	if (store === void 0) return void 0;
+	const door = {
+		query: (input) => store.query.query(input),
+		deleteWhere: (input) => store.deleteWhere.mutate(input)
+	};
 	return {
-		list: async () => {
-			const rows = await store.query.query({
-				collection: ADDON_DEVICE_SETTINGS_COLLECTION,
-				filter: { limit: SCOPE_READ_LIMIT }
-			});
-			if (rows.length >= SCOPE_READ_LIMIT) throw new Error(`the settings read returned ${rows.length} rows — possibly truncated`);
-			const seen = /* @__PURE__ */ new Map();
-			for (const row of rows) {
-				const addonId = row.data["addonId"];
-				const raw = row.data["deviceId"];
-				if (typeof addonId !== "string" || typeof raw !== "string") continue;
-				const deviceId = Number(raw);
-				if (!Number.isInteger(deviceId) || deviceId <= 0) continue;
-				seen.set(`${addonId}:${deviceId}`, {
-					deviceId,
-					addonId
-				});
-			}
-			return [...seen.values()];
-		},
-		clear: async (deviceId) => {
-			const { deleted } = await store.deleteWhere.mutate({
-				collection: ADDON_DEVICE_SETTINGS_COLLECTION,
-				filter: { where: { deviceId: String(deviceId) } }
-			});
-			return deleted;
-		}
+		list: () => listDeviceSettingsScopes(door),
+		clear: (deviceId) => clearDeviceSettings(door, deviceId)
 	};
 }
 //#endregion
@@ -6262,11 +6386,7 @@ function removalSteps(pctx, deviceId, providerAddonId, deletedAt) {
 			run: async () => {
 				const api = pctx.host.ctx.api?.settingsStore;
 				if (api === void 0) throw new Error("settings-store api not available");
-				const { deleted } = await api.deleteWhere.mutate({
-					collection: "addon-device-settings",
-					filter: { where: { deviceId: String(deviceId) } }
-				});
-				return deleted;
+				return clearDeviceSettings({ deleteWhere: (input) => api.deleteWhere.mutate(input) }, deviceId);
 			}
 		},
 		{
@@ -8735,7 +8855,17 @@ var DeviceTombstoneStore = class {
 		this.now = opts.now ?? (() => Date.now());
 		this.retentionMs = opts.retentionMs ?? 7776e6;
 	}
-	/** Lazy, idempotent declaration; a rejection is not latched. */
+	/**
+	* Declare the collection now. Idempotent; a rejection is not latched.
+	*
+	* Called at device-manager init (D871) so the table exists on a hub that has
+	* not deleted a device yet. It used to be declared only by the first
+	* `record` / `listSince`, i.e. by the first delete or by an implementer's
+	* reconcile — so a hub whose implementers had not been redeployed, and where
+	* nothing was deleted, never had the table, and the census read that as
+	* "D865 is not running". A DECLARATION only: nothing is read, written or
+	* purged here.
+	*/
 	declare() {
 		if (this.declared !== null) return this.declared;
 		const run = this.backend.declareCollection({
@@ -10733,6 +10863,11 @@ var DeviceManagerAddon = class extends BaseAddon {
 			backend: deviceRowBackendOf(settingsStoreApi),
 			logger: this.ctx.logger.child("tombstones")
 		});
+		try {
+			await tombstones.declare();
+		} catch (err) {
+			this.ctx.logger.warn("device tombstones collection not declared at init — retried on first use", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
 		this.staleWrapperActivations.checkOnce(() => readBindingsStore(this.bindingsDeps));
 		try {
 			await purgeRetiredSettingsRows(deviceRows.retiredRowStore(), this.ctx.logger.child("RetiredRows"));
@@ -11067,4 +11202,4 @@ var DeviceManagerAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-export { DeviceManagerAddon, DeviceManagerAddon as default, mergeAggregates, setWrapperActive as t };
+export { DeviceManagerAddon, DeviceManagerAddon as default, mergeAggregates, readDeviceOrThrow as n, setWrapperActive as r, createDeviceSettingsStore as t };

package/dist/builtins/device-manager/device-removal-hooks.d.ts

@@ -1,12 +1,3 @@
-/**
-* device-manager's side of `device-removal-hook` (D865): tell every implementer
-* a device was deleted, and answer the admin question "which stored data belongs
-* to devices that no longer exist?".
-*
-* Two entry points, one rule: **an implementer is told to delete only on a
-* recorded delete (a tombstone), or on an explicit operator confirm.** Nothing
-* here infers a deletion from a device being absent from a single read.
-*/
 import { type CleanupDeletedDevicesResult, type DeviceDataEntry, type DeviceRemovedInput, type DeviceRemovedResult, type IScopedLogger, type OrphanDeviceData, type SettingsStoreClient } from "@camstack/types";
 import type { RemovalCleanup, RemovalStep } from "./removal-cleanup.js";
 /** The capability name implementers register under. */
@@ -97,7 +88,5 @@ export interface CleanupDeps {
 export declare function cleanupDeletedDevicesData(deps: CleanupDeps, input: {
 	readonly confirm: boolean;
 }): Promise<CleanupDeletedDevicesResult>;
-/** The settings-store collection every addon's per-device settings share. */
-export declare const ADDON_DEVICE_SETTINGS_COLLECTION = "addon-device-settings";
 /** Scope access over the settings store; undefined when the store is unavailable. */
 export declare function settingsScopes(store: Pick<SettingsStoreClient, "query" | "deleteWhere"> | undefined): SettingsScopeAccess | undefined;

package/dist/builtins/device-manager/device-tombstone-store.d.ts

@@ -47,8 +47,18 @@ export declare class DeviceTombstoneStore {
 	private readonly retentionMs;
 	private declared;
 	constructor(opts: DeviceTombstoneStoreOptions);
-	/** Lazy, idempotent declaration; a rejection is not latched. */
-	private declare;
+	/**
+	* Declare the collection now. Idempotent; a rejection is not latched.
+	*
+	* Called at device-manager init (D871) so the table exists on a hub that has
+	* not deleted a device yet. It used to be declared only by the first
+	* `record` / `listSince`, i.e. by the first delete or by an implementer's
+	* reconcile — so a hub whose implementers had not been redeployed, and where
+	* nothing was deleted, never had the table, and the census read that as
+	* "D865 is not running". A DECLARATION only: nothing is read, written or
+	* purged here.
+	*/
+	declare(): Promise<void>;
 	/** Record a deletion. Re-recording the same id keeps the EARLIER `deletedAt`. */
 	record(tombstone: DeviceTombstone): Promise<void>;
 	/** Tombstones with `deletedAt >= sinceMs`, oldest first. Expired ones are pruned first. */

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-GgG-7amw.js");
+const require_dist = require("../../dist-BKhlcYz6.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { Or as BaseAddon, mn as logDestinationCapability } from "../../dist-Dc8GKC5H.mjs";
+import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-9fcsrFU3.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-GgG-7amw.js");
-const require_device_ca = require("../../device-ca-BSvkXqyI.js");
-const require_constants = require("../../constants-wkcn5Ij3.js");
+const require_dist = require("../../dist-BKhlcYz6.js");
+const require_device_ca = require("../../device-ca-DNHjts4_.js");
+const require_constants = require("../../constants-CRI3QzT4.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -388,6 +388,8 @@ var NOT_INITIALIZED = {
 	state: "locked",
 	reason: "not-initialized"
 };
+/** The only refs `importSecret` accepts: a camera's restream tokens (D870 migration). */
+var IMPORTABLE_REF = /^secret:\/\/stream-broker\/device\/[0-9]+\/rtspTokens$/;
 var KeychainService = class {
 	deps;
 	unlock = NOT_INITIALIZED;
@@ -782,6 +784,17 @@ var KeychainService = class {
 		const ref = SYSTEM_HELD_SECRET_REFS[name];
 		return this.put(require_device_ca.SYSTEM_SECRET_OWNER, ref, value, `user:${userId}`);
 	}
+	/**
+	* An operator tool stores a carried-over value at an addon's own ref (D870).
+	* Stored under the ref's owner, audited as the operator.
+	*/
+	async importSecret(userId, ref, value) {
+		if (!IMPORTABLE_REF.test(ref)) throw new Error(`keychain: "${ref}" is not an importable ref (restream tokens only)`);
+		if ((await this.deps.repo.getSecrets([ref])).has(ref)) throw new Error(`keychain: a value is already stored at ${ref} - import refuses to overwrite`);
+		const parts = require_dist.parseSecretRef(ref);
+		if (parts === null) throw new Error(`keychain: "${ref}" is not a secret ref`);
+		return this.put(parts.owner, ref, value, `user:${userId}`);
+	}
 	async listAudit(limit) {
 		return this.deps.repo.listAudit(limit);
 	}
@@ -1670,24 +1683,28 @@ async function blobsFor(door, owner, scope) {
 	switch (scope.kind) {
 		case "global":
 		case "node": {
-			const forked = await door.get({
+			const legacyBlob = await door.get({
 				namespace: owner,
 				collection: "addon-settings",
 				key: "root"
 			});
-			const inProcess = await prefixRows(door, "addon-settings", `${owner}.`);
-			if (inProcess === null) return null;
-			return [forked, ...inProcess];
+			const rows = await prefixRows(door, "addon-settings", `${owner}.`);
+			return rows === null ? null : [legacyBlob, ...rows];
 		}
 		case "device": {
-			const forked = await door.get({
+			const legacyBlob = await door.get({
 				namespace: owner,
 				collection: "addon-devices",
 				key: String(scope.deviceId)
 			});
-			const doorRows = await prefixRows(door, "addon-device-settings", `device-manager:${scope.deviceId}.`);
-			if (doorRows === null) return null;
-			return [forked, ...doorRows];
+			const own = await prefixRows(door, "addon-device-settings", `${owner}:${scope.deviceId}.`);
+			const connection = owner === "device-manager" ? [] : await prefixRows(door, "addon-device-settings", `device-manager:${scope.deviceId}.`);
+			if (own === null || connection === null) return null;
+			return [
+				legacyBlob,
+				...own,
+				...connection
+			];
 		}
 		case "integration": return (await door.query({
 			collection: "integration_settings",
@@ -1861,6 +1878,7 @@ var KeychainAddon = class extends require_dist.BaseAddon {
 				listAudit: (input) => service.listAudit(input.limit ?? 100),
 				reveal: (input) => service.reveal(input.caller.userId, input.ref),
 				setSystemSecret: (input) => service.setSystemSecret(input.caller.userId, input.name, input.value),
+				importSecret: (input) => service.importSecret(input.caller.userId, input.ref, input.value),
 				deleteOrphans: (input) => service.deleteOrphans(input.caller.userId, input.refs),
 				rotateMasterKey: (input) => service.rotateMasterKey(input.caller.userId),
 				purgeRetiredKeys: async (input) => ({ purged: await service.purgeRetiredKeys(input.caller.userId) }),

package/dist/builtins/keychain/index.mjs

@@ -1,6 +1,6 @@
-import { L as KEYCHAIN_RESET_TRIGGER_ACTOR, Or as BaseAddon, Xr as formatSecretScope, ai as normalizeSecretOwner, ci as parseSecretRef, cn as keychainCapability, sn as keychainAdminCapability, yi as EventCategory } from "../../dist-Dc8GKC5H.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-DvIZjXIl.mjs";
-import { a as MESH_CA_KEY_REF } from "../../constants-DQK705Sb.mjs";
+import { $r as formatSecretScope, L as KEYCHAIN_RESET_TRIGGER_ACTOR, Si as EventCategory, ci as normalizeSecretOwner, di as parseSecretRef, jr as BaseAddon, ln as keychainAdminCapability, un as keychainCapability } from "../../dist-9fcsrFU3.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-DLKXYseS.mjs";
+import { a as MESH_CA_KEY_REF } from "../../constants-CIzPjw7L.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";
@@ -382,6 +382,8 @@ var NOT_INITIALIZED = {
 	state: "locked",
 	reason: "not-initialized"
 };
+/** The only refs `importSecret` accepts: a camera's restream tokens (D870 migration). */
+var IMPORTABLE_REF = /^secret:\/\/stream-broker\/device\/[0-9]+\/rtspTokens$/;
 var KeychainService = class {
 	deps;
 	unlock = NOT_INITIALIZED;
@@ -776,6 +778,17 @@ var KeychainService = class {
 		const ref = SYSTEM_HELD_SECRET_REFS[name];
 		return this.put(SYSTEM_SECRET_OWNER, ref, value, `user:${userId}`);
 	}
+	/**
+	* An operator tool stores a carried-over value at an addon's own ref (D870).
+	* Stored under the ref's owner, audited as the operator.
+	*/
+	async importSecret(userId, ref, value) {
+		if (!IMPORTABLE_REF.test(ref)) throw new Error(`keychain: "${ref}" is not an importable ref (restream tokens only)`);
+		if ((await this.deps.repo.getSecrets([ref])).has(ref)) throw new Error(`keychain: a value is already stored at ${ref} - import refuses to overwrite`);
+		const parts = parseSecretRef(ref);
+		if (parts === null) throw new Error(`keychain: "${ref}" is not a secret ref`);
+		return this.put(parts.owner, ref, value, `user:${userId}`);
+	}
 	async listAudit(limit) {
 		return this.deps.repo.listAudit(limit);
 	}
@@ -1664,24 +1677,28 @@ async function blobsFor(door, owner, scope) {
 	switch (scope.kind) {
 		case "global":
 		case "node": {
-			const forked = await door.get({
+			const legacyBlob = await door.get({
 				namespace: owner,
 				collection: "addon-settings",
 				key: "root"
 			});
-			const inProcess = await prefixRows(door, "addon-settings", `${owner}.`);
-			if (inProcess === null) return null;
-			return [forked, ...inProcess];
+			const rows = await prefixRows(door, "addon-settings", `${owner}.`);
+			return rows === null ? null : [legacyBlob, ...rows];
 		}
 		case "device": {
-			const forked = await door.get({
+			const legacyBlob = await door.get({
 				namespace: owner,
 				collection: "addon-devices",
 				key: String(scope.deviceId)
 			});
-			const doorRows = await prefixRows(door, "addon-device-settings", `device-manager:${scope.deviceId}.`);
-			if (doorRows === null) return null;
-			return [forked, ...doorRows];
+			const own = await prefixRows(door, "addon-device-settings", `${owner}:${scope.deviceId}.`);
+			const connection = owner === "device-manager" ? [] : await prefixRows(door, "addon-device-settings", `device-manager:${scope.deviceId}.`);
+			if (own === null || connection === null) return null;
+			return [
+				legacyBlob,
+				...own,
+				...connection
+			];
 		}
 		case "integration": return (await door.query({
 			collection: "integration_settings",
@@ -1855,6 +1872,7 @@ var KeychainAddon = class extends BaseAddon {
 				listAudit: (input) => service.listAudit(input.limit ?? 100),
 				reveal: (input) => service.reveal(input.caller.userId, input.ref),
 				setSystemSecret: (input) => service.setSystemSecret(input.caller.userId, input.name, input.value),
+				importSecret: (input) => service.importSecret(input.caller.userId, input.ref, input.value),
 				deleteOrphans: (input) => service.deleteOrphans(input.caller.userId, input.refs),
 				rotateMasterKey: (input) => service.rotateMasterKey(input.caller.userId),
 				purgeRetiredKeys: async (input) => ({ purged: await service.purgeRetiredKeys(input.caller.userId) }),

package/dist/builtins/keychain/keychain-service.d.ts

@@ -96,6 +96,14 @@ export declare class KeychainService {
 		ref: string;
 		version: number;
 	}>;
+	/**
+	* An operator tool stores a carried-over value at an addon's own ref (D870).
+	* Stored under the ref's owner, audited as the operator.
+	*/
+	importSecret(userId: string, ref: string, value: string): Promise<{
+		ref: string;
+		version: number;
+	}>;
 	listAudit(limit: number): Promise<readonly KeychainAuditEntry[]>;
 	reveal(userId: string, ref: string): Promise<{
 		value: string;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-GgG-7amw.js");
+const require_dist = require("../../dist-BKhlcYz6.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Dr as errMsg, G as RecordingStatusSchema, Or as BaseAddon, W as RECORDING_SOURCE_CAMSTACK_ADDON, Wr as createEvent, yi as EventCategory } from "../../dist-Dc8GKC5H.mjs";
+import { Ar as errMsg, G as RecordingStatusSchema, Si as EventCategory, W as RECORDING_SOURCE_CAMSTACK_ADDON, jr as BaseAddon, qr as createEvent } from "../../dist-9fcsrFU3.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-GgG-7amw.js");
+const require_dist = require("../../dist-BKhlcYz6.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-BSvkXqyI.js");
+const require_device_ca = require("../../device-ca-DNHjts4_.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,8 +1,8 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { E as DEVICE_NONCE_TTL_MS, J as ScopedTokenSchema, Or as BaseAddon, Pt as deviceCredentialsCapability, T as DEVICE_ENROLLMENT_TTL_MS, X as SsoBridgeClaimsSchema, Yt as formatDeviceRevoker, a as ApiKeyRecordSchema, ar as userManagementCapability, dt as buildDeviceEnrollmentLink, ft as buildDeviceSignatureMessage, ot as authProviderCapability, tt as UserRecordSchema, vi as userError } from "../../dist-Dc8GKC5H.mjs";
+import { E as DEVICE_NONCE_TTL_MS, It as deviceCredentialsCapability, Q as SsoBridgeClaimsSchema, T as DEVICE_ENROLLMENT_TTL_MS, X as ScopedTokenSchema, Zt as formatDeviceRevoker, a as ApiKeyRecordSchema, cr as userManagementCapability, ct as authProviderCapability, jr as BaseAddon, mt as buildDeviceSignatureMessage, pt as buildDeviceEnrollmentLink, rt as UserRecordSchema, xi as userError } from "../../dist-9fcsrFU3.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-DvIZjXIl.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-DLKXYseS.mjs";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-GgG-7amw.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-CBLvq2oj.js");
+const require_dist = require("../../dist-BKhlcYz6.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-3Zc9G9MS.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");
@@ -900,6 +900,11 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 				this.putCertificateOnListener("upload");
 				return this.snapshotTls();
 			},
+			useStoredUploadedCertificate: async () => {
+				await require_hub_mdns_ciao.useStoredUploadedCertificate(this.tlsDataDir());
+				this.putCertificateOnListener("upload");
+				return this.snapshotTls();
+			},
 			downloadCa: async () => {
 				return { pem: this.snapshotTls().caCertPem ?? "" };
 			},

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { $t as isAppLinkBase, F as HUB_MDNS_SERVICE_TYPE, Fn as resolveAppConnections, Hn as resolveNotificationTapAddress, I as HUB_MDNS_TXT_KEYS, On as pickAppLinkHub, Or as BaseAddon, U as NetworkTunnelStartedDataSchema, _t as checkRoleAddress, fn as localNetworkCapability, l as CAMSTACK_APP_LINK_ORIGIN, nn as isDefaultAppConnectionEndpoint, sr as validateCustomAddress, yi as EventCategory, zn as resolveHubAddressRoles } from "../../dist-Dc8GKC5H.mjs";
-import { C as DEFAULT_LAN_HTTP_PORT, O as readLanHttpState, T as applyLanHttp, a as storeUploadedCertificate, b as ensureTlsCert, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, m as readExtraSans, n as applyCertificateToListener, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans } from "../../hub-mdns-ciao-DMlQTdPU.mjs";
+import { An as pickAppLinkHub, F as HUB_MDNS_SERVICE_TYPE, I as HUB_MDNS_TXT_KEYS, Ln as resolveAppConnections, Si as EventCategory, U as NetworkTunnelStartedDataSchema, Vn as resolveHubAddressRoles, Wn as resolveNotificationTapAddress, in as isDefaultAppConnectionEndpoint, jr as BaseAddon, l as CAMSTACK_APP_LINK_ORIGIN, mn as localNetworkCapability, tn as isAppLinkBase, ur as validateCustomAddress, yt as checkRoleAddress } from "../../dist-9fcsrFU3.mjs";
+import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-Dy2YjRqC.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os$1 from "node:os";
@@ -897,6 +897,11 @@ var LocalNetworkAddon = class extends BaseAddon {
 				this.putCertificateOnListener("upload");
 				return this.snapshotTls();
 			},
+			useStoredUploadedCertificate: async () => {
+				await useStoredUploadedCertificate(this.tlsDataDir());
+				this.putCertificateOnListener("upload");
+				return this.snapshotTls();
+			},
 			downloadCa: async () => {
 				return { pem: this.snapshotTls().caCertPem ?? "" };
 			},