@camstack/system 1.2.442 → 1.2.444

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
-import { A as DeclaredDevices, Ar as errMsg, Bn as resolveCoreBlockFiles, Cr as compositionSourceKey, Ct as coreBlockAddonId, Dt as coreBlocksCapability, Et as coreBlockSourceKind, Ft as describeComposableCaps, In as replacedFieldKeys, St as compositionSourceRefs, Tn as normalizeCoreBlockWrite, Tt as coreBlockIdFromAddonId, ei as hydrateSchema, ft as buildCapabilityLookup, h as CORE_BLOCK_ADDON_PREFIX, jn as planComposition, jr as BaseAddon, lr as validateComposition, m as CORE_BLOCKS_ADDON_ID, p as COMPOSER_RUNNER_ID, r as ALL_CAPABILITY_DEFINITIONS, v as CoreBlockSchema, vr as composedDeviceRef, wt as coreBlockComposition, zn as resolveCoreBlockEntry } from "../../dist-DsrQYcLm.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-CftPpY4O.mjs";
+import { Ct as compositionSourceRefs, Dr as compositionSourceKey, Dt as coreBlockSourceKind, Ei as hydrateSchema, En as normalizeCoreBlockWrite, Et as coreBlockIdFromAddonId, Fr as BaseAddon, Hn as resolveCoreBlockEntry, It as describeComposableCaps, Mn as planComposition, Ni as isSecretRefOwnedBy, Ot as coreBlocksCapability, Pr as errMsg, Sr as composedDeviceRef, Tt as coreBlockComposition, Un as resolveCoreBlockFiles, Wi as resolveSecretMarkers, Zi as transformSecretWrite, _i as collectSecretMarkerRefs, fr as validateComposition, g as CORE_BLOCK_ADDON_PREFIX, h as CORE_BLOCKS_ADDON_ID, j as DeclaredDevices, ji as isSecretMarker, m as COMPOSER_RUNNER_ID, pt as buildCapabilityLookup, qi as secretTreeFromSchema, r as ALL_CAPABILITY_DEFINITIONS, wt as coreBlockAddonId, y as CoreBlockSchema, zn as replacedFieldKeys } from "../../dist-DERK-gP5.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-C3rKncIF.mjs";
 import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
 import { n as unwrapStoredValue, t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";
 import { createRequire } from "node:module";
@@ -7,6 +7,7 @@ import { randomUUID } from "node:crypto";
 import { customizationBlockName } from "@camstack/types/node";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";
+import { isDeepStrictEqual } from "node:util";
 import * as os$1 from "node:os";
 import { pathToFileURL } from "node:url";
 //#region src/builtins/core-blocks/block-package.ts
@@ -70,6 +71,10 @@ import * as blockModule from './block.js'
 
 const BLOCK_ID = __BLOCK_ID__
 const BLOCK_NAME = __BLOCK_NAME__
+// The block's settings form, embedded so the SDK derives the keychain secret
+// tree from it (a password field is stored as a marker and read back resolved,
+// D880). null = the block declares none.
+const BLOCK_SETTINGS_SCHEMA = __BLOCK_SETTINGS_SCHEMA__
 const blockMain = blockModule.default
 
 export default class CoreBlockAddon extends BaseAddon {
@@ -81,6 +86,10 @@ export default class CoreBlockAddon extends BaseAddon {
     this.disposer = null
   }
 
+  globalSettingsSchema() {
+    return BLOCK_SETTINGS_SCHEMA
+  }
+
   async onInitialize() {
     if (typeof blockMain !== 'function') {
       throw new Error(
@@ -108,8 +117,8 @@ export default class CoreBlockAddon extends BaseAddon {
 `;
 /** Build the wrapper for one block. Exported for the test that asserts the
 *  generated source actually carries the block's identity. */
-function renderBlockWrapper(blockId, blockName) {
-	return WRAPPER_SOURCE.replace("__BLOCK_ID__", JSON.stringify(blockId)).replace("__BLOCK_NAME__", JSON.stringify(blockName));
+function renderBlockWrapper(blockId, blockName, settingsSchema = void 0) {
+	return WRAPPER_SOURCE.replace("__BLOCK_ID__", () => JSON.stringify(blockId)).replace("__BLOCK_NAME__", () => JSON.stringify(blockName)).replace("__BLOCK_SETTINGS_SCHEMA__", () => JSON.stringify(settingsSchema ?? null));
 }
 /** The package manifest the addon runner reads to find the entry point. */
 function renderBlockManifest(blockId, blockName) {
@@ -158,7 +167,7 @@ async function materializeBlock(input) {
 	await Promise.all([
 		fs.writeFile(path$1.join(addonDir, "package.json"), renderBlockManifest(input.blockId, input.blockName), "utf-8"),
 		fs.writeFile(path$1.join(distDir, "block.js"), input.js, "utf-8"),
-		fs.writeFile(path$1.join(distDir, "index.js"), renderBlockWrapper(input.blockId, input.blockName), "utf-8")
+		fs.writeFile(path$1.join(distDir, "index.js"), renderBlockWrapper(input.blockId, input.blockName, input.settingsSchema), "utf-8")
 	]);
 	return {
 		addonDir,
@@ -421,7 +430,8 @@ var BlockSupervisor = class {
 				blockId: block.id,
 				blockName: block.name,
 				js: compiled.js,
-				files
+				files,
+				settingsSchema: block.settingsSchema
 			});
 			await this.deps.host.spawn({
 				runnerId: pkg.addonId,
@@ -555,9 +565,33 @@ function createAddonSettingsStore(door, addonId) {
 //#endregion
 //#region src/builtins/core-blocks/block-settings-store.ts
 /**
+* Preference values for core blocks.
+*
+* Schema lives on the block record (`settingsSchema`, extracted from the
+* compiled entry's named export or set by the editor). The VALUES live where a
+* running script reads them and nowhere else: the block addon's own
+* `addon-settings` rows (`core-block-<id>.<field>`, D870), so
+* `ctx.settings.readAddonStore()` answers them like any addon's settings and a
+* settings patch never rewrites the operator's source.
+*
+* A field the block's `settingsSchema` declares `password` / `secret: true` is
+* keychain-backed (D783 / D787), owner = the block's addon id, scope `global`:
+* the row holds the marker, the value lives in the keychain. The block's
+* generated wrapper declares the same schema, so the running script reads the
+* resolved VALUE. A marker is honoured only for its own ref (an incoming marker
+* is never stored - the write path treats it as "keep"), a REDACTED / view
+* value keeps what is stored, and a keychain that cannot take a write refuses
+* it rather than storing plaintext.
+*
+* Before D880 the values were ALSO kept as one blob per block in
+* `core-blocks:settings`: two raw copies of every password. That collection is
+* now LEGACY - read only by {@link BlockSettingsStore.migrateRawSecrets}, which
+* moves the secrets, copies any key the rows lack, and deletes the blob.
+*/
+/**
 * @durable class=config owner=core-blocks
-*   write="`setValues` / `mergeValues` persist the operator's prefs for one block"
-*   retention="`delete` when the block is deleted. Nothing ages out."
+*   write="NOTHING since D880 - the values live in the block addon's `addon-settings` rows. Only the one-shot `migrateRawSecrets` reads it, then deletes each row."
+*   retention="legacy: every row is deleted by the verified operator migration; the declaration goes with it once every hub ran it."
 */
 var CORE_BLOCK_SETTINGS_COLLECTION = "core-blocks:settings";
 var CORE_BLOCK_SETTINGS_COLUMNS = [{
@@ -571,54 +605,335 @@ var CORE_BLOCK_SETTINGS_COLUMNS = [{
 	notNull: true,
 	defaultValue: "{}"
 }];
+/** The block declares a secret, but this process has no keychain door to put it in. */
+var BlockSecretsUnavailableError = class extends Error {
+	blockId;
+	constructor(blockId) {
+		super(`core block "${blockId}" declares a password field, but this process has no keychain door - nothing was saved. Unlock the keychain (System -> Secrets) and save again.`);
+		this.blockId = blockId;
+		this.name = "BlockSecretsUnavailableError";
+	}
+};
+/** The block addon's settings rows could not be read: never answered as "empty". */
+var BlockSettingsUnreadableError = class extends Error {
+	blockId;
+	constructor(blockId, reason) {
+		super(`core block "${blockId}": its settings rows cannot be read (${reason})`);
+		this.blockId = blockId;
+		this.name = "BlockSettingsUnreadableError";
+	}
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Walk `blob` along the secret `tree`: how many declared secret values are raw / markers. */
+function countSecretLeaves(tree, blob) {
+	const counts = {
+		raw: 0,
+		markers: 0
+	};
+	if (!isRecord(blob)) return counts;
+	const visit = (node, value) => {
+		if (node.kind === "leaf") {
+			if (isSecretMarker(value)) counts.markers += 1;
+			else if (typeof value === "string" && value.length > 0) counts.raw += 1;
+			return;
+		}
+		if (node.kind === "object") {
+			if (isRecord(value)) for (const [key, child] of node.children) visit(child, value[key]);
+			return;
+		}
+		if (Array.isArray(value)) for (const row of value) {
+			if (!isRecord(row)) continue;
+			for (const [key, child] of node.item) visit(child, row[key]);
+		}
+	};
+	for (const [key, node] of tree) visit(node, blob[key]);
+	return counts;
+}
+/** Only the top-level keys the secret tree names (and, when given, `only` holds). */
+function secretKeysOf(tree, blob, only) {
+	const out = {};
+	for (const key of tree.keys()) if (key in blob && (only === void 0 || key in only)) out[key] = blob[key];
+	return out;
+}
+/**
+* Names that LOOK like a credential. Only used on a block whose schema does not
+* declare the field (none, or a partial one): such a value cannot be moved by type,
+* so it is FLAGGED, never copied and never silently dropped.
+*/
+var CREDENTIAL_NAME = /(password|passwd|passphrase|secret|token|api_?key|private_?key|access_?code|credential|cookie|pincode|pin$)/i;
+var NOT_A_VALUE_SUFFIX = /(hash|hashed|fingerprint|count|length|expires|expiry|type|kind|version|status|label|ref|path|id|name)$/i;
+function holdsRawCredential(value, depth = 0) {
+	if (depth > 8) return false;
+	if (Array.isArray(value)) return value.some((v) => holdsRawCredential(v, depth + 1));
+	if (!isRecord(value) || isSecretMarker(value)) return false;
+	return Object.entries(value).some(([key, child]) => CREDENTIAL_NAME.test(key) && !NOT_A_VALUE_SUFFIX.test(key) ? typeof child === "string" && child.length > 0 || holdsRawCredential(child, depth + 1) : holdsRawCredential(child, depth + 1));
+}
+/** Top-level keys the schema does not declare secret that nevertheless hold a raw credential-named value. */
+function untrackedCredentialKeys(tree, blob) {
+	const out = /* @__PURE__ */ new Set();
+	for (const [key, value] of Object.entries(blob)) {
+		if (tree.has(key)) continue;
+		if (CREDENTIAL_NAME.test(key) && !NOT_A_VALUE_SUFFIX.test(key) && typeof value === "string" && value.length > 0 || !isSecretMarker(value) && holdsRawCredential(value)) out.add(key);
+	}
+	return out;
+}
+/** The legacy row's values, tolerating the old bare-blob shape. */
+function legacyValuesOf(row) {
+	if (!isRecord(row)) return {};
+	const values = row["values"];
+	if (isRecord(values)) return { ...values };
+	return "values" in row ? {} : { ...row };
+}
 var BlockSettingsStore = class {
 	store;
+	keychainFor;
+	onOrphaned;
 	constructor(deps) {
 		this.store = deps.store;
+		this.keychainFor = deps.keychainFor;
+		this.onOrphaned = deps.onOrphaned ?? (() => void 0);
 	}
+	/** Declares the LEGACY collection, so the migration can read it. */
 	static async declare(store) {
 		await store.declareCollection.mutate({
 			collection: CORE_BLOCK_SETTINGS_COLLECTION,
 			columns: [...CORE_BLOCK_SETTINGS_COLUMNS]
 		});
 	}
-	async getValues(blockId) {
-		const row = await this.store.get.query({
+	rows(blockId) {
+		const store = this.store;
+		return createAddonSettingsStore({
+			query: (input) => store.query.query(input),
+			get: (input) => store.get.query(input),
+			transact: (input) => store.transact.mutate(input)
+		}, coreBlockAddonId(blockId));
+	}
+	/**
+	* The block's stored values - markers, NOT resolved. For the admin form
+	* (`hydrateSchema` turns a marker into a "set" view) and as the `stored`
+	* side of a write. Absent answers `{}`; an unreadable store THROWS.
+	*/
+	async readStored(blockId) {
+		const read = await this.rows(blockId).read();
+		if (read.kind === "unreadable") throw new BlockSettingsUnreadableError(blockId, read.error);
+		return read.kind === "present" ? { ...read.value } : {};
+	}
+	/**
+	* Patch the block's values. Secret fields (by the schema TYPE) go to the
+	* keychain first and the row gets the marker; a keychain that cannot take
+	* them refuses the whole patch.
+	*/
+	async mergeValues(blockId, schema, patch) {
+		const tree = secretTreeFromSchema(schema ?? null);
+		if (tree.size === 0) {
+			await this.rows(blockId).merge(patch);
+			return;
+		}
+		const secrets = this.keychainFor(coreBlockAddonId(blockId));
+		if (secrets === null) throw new BlockSecretsUnavailableError(blockId);
+		const result = await transformSecretWrite({
+			tree,
+			secrets,
+			patch,
+			stored: await this.readStored(blockId),
+			operatorWrite: true
+		});
+		await this.rows(blockId).merge(result.patch);
+		const { orphaned } = await result.afterWrite();
+		if (orphaned.length > 0) this.onOrphaned(blockId, orphaned);
+	}
+	/** The block is gone: its rows, its keychain values and the legacy blob go with it. */
+	async delete(blockId) {
+		const stored = await this.readStored(blockId);
+		const owner = coreBlockAddonId(blockId);
+		const refs = collectSecretMarkerRefs(stored);
+		const removal = {};
+		for (const key of Object.keys(stored)) removal[key] = void 0;
+		await this.rows(blockId).merge(removal);
+		await this.store.delete.mutate({
 			collection: CORE_BLOCK_SETTINGS_COLLECTION,
 			key: blockId
 		});
-		if (row === null || typeof row !== "object") return {};
-		const values = row.values;
-		if (values !== null && typeof values === "object" && !Array.isArray(values)) return { ...values };
-		if (!("values" in row)) return { ...row };
-		return {};
+		if (refs.length === 0) return;
+		const secrets = this.keychainFor(owner);
+		try {
+			await secrets?.delete(refs);
+			if (secrets === null) this.onOrphaned(blockId, refs);
+		} catch {
+			this.onOrphaned(blockId, refs);
+		}
 	}
-	async mergeValues(blockId, patch) {
-		const next = {
-			...await this.getValues(blockId),
-			...patch
+	/**
+	* D880: move every plaintext secret a block's `settingsSchema` declares into
+	* the keychain, and delete the legacy `core-blocks:settings` blob.
+	*
+	* Per block: gather the values (the addon-settings rows win; a key only the
+	* blob holds is carried over), put each secret, READ IT BACK and compare,
+	* and only then write the marker. The legacy row is deleted only after the
+	* block's rows hold every key it had and every secret resolves. A block that
+	* fails stays exactly as it was. Dry run unless `apply`; idempotent; counts
+	* only - never a value, a ref or a block id.
+	*/
+	async migrateRawSecrets(blocks, apply) {
+		const legacyRows = await this.store.query.query({ collection: CORE_BLOCK_SETTINGS_COLLECTION });
+		const legacyById = /* @__PURE__ */ new Map();
+		for (const row of legacyRows) legacyById.set(row.id, legacyValuesOf(row.data));
+		const tally = {
+			rows: 0,
+			raw: 0,
+			markers: 0,
+			migrated: 0,
+			failed: 0,
+			redundant: 0
 		};
-		await this.store.set.mutate({
-			collection: CORE_BLOCK_SETTINGS_COLLECTION,
-			key: blockId,
-			value: { values: next }
-		});
-		await this.mirrorToBlockAddon(blockId, next);
-		return next;
+		const verifyAfter = [];
+		for (const block of blocks) {
+			const tree = secretTreeFromSchema(block.settingsSchema ?? null);
+			const legacy = legacyById.get(block.id);
+			const stored = await this.readStored(block.id);
+			const effective = {
+				...legacy,
+				...stored
+			};
+			const counts = countSecretLeaves(tree, effective);
+			const untracked = untrackedCredentialKeys(tree, effective);
+			if (tree.size > 0 || untracked.size > 0) {
+				tally.rows += 1;
+				if (counts.raw > 0 || untracked.size > 0) tally.raw += 1;
+				else if (counts.markers > 0) tally.markers += 1;
+				verifyAfter.push(block);
+			}
+			const hasLegacy = legacy !== void 0;
+			if (hasLegacy) tally.redundant += 1;
+			if (!apply) continue;
+			const carry = this.carryable(block.id, effective, stored, tree, untracked);
+			if (carry.foreign > 0) tally.failed += 1;
+			if (counts.raw > 0) if (await this.moveBlock(block, tree, carry.rest, effective, stored)) tally.migrated += 1;
+			else {
+				tally.failed += 1;
+				continue;
+			}
+			else if (hasLegacy && Object.keys(carry.rest).length > 0) await this.rows(block.id).merge(carry.rest);
+			const legacyUntracked = untrackedCredentialKeys(tree, legacy ?? {});
+			if (hasLegacy && legacyUntracked.size === 0) await this.dropLegacy(block.id);
+		}
+		const known = new Set(blocks.map((b) => b.id));
+		for (const id of legacyById.keys()) {
+			if (known.has(id)) continue;
+			tally.redundant += 1;
+			if (apply) await this.dropLegacy(id);
+		}
+		return this.report(apply, tally, verifyAfter);
 	}
-	async delete(blockId) {
+	/**
+	* The keys of the legacy blob that may be copied into the block's rows: not in
+	* the rows already, not a secret the tree moves, not a credential-named value no
+	* schema declares (flagged instead), and not a marker that points at another
+	* owner's secret (counted as `foreign`, never copied).
+	*/
+	carryable(blockId, effective, stored, tree, untracked) {
+		const owner = coreBlockAddonId(blockId);
+		const rest = {};
+		let foreign = 0;
+		for (const [key, value] of Object.entries(effective)) {
+			if (key in stored || tree.has(key) || untracked.has(key)) continue;
+			if (collectSecretMarkerRefs(value).some((ref) => !isSecretRefOwnedBy(ref, owner))) {
+				foreign += 1;
+				continue;
+			}
+			rest[key] = value;
+		}
+		return {
+			rest,
+			foreign
+		};
+	}
+	async dropLegacy(blockId) {
 		await this.store.delete.mutate({
 			collection: CORE_BLOCK_SETTINGS_COLLECTION,
 			key: blockId
 		});
 	}
-	async mirrorToBlockAddon(blockId, values) {
-		const store = this.store;
-		await createAddonSettingsStore({
-			query: (input) => store.query.query(input),
-			get: (input) => store.get.query(input),
-			transact: (input) => store.transact.mutate(input)
-		}, coreBlockAddonId(blockId)).merge(values);
+	/** put -> read back -> compare -> only then the marker rows. */
+	async moveBlock(block, tree, rest, effective, stored) {
+		const secrets = this.keychainFor(coreBlockAddonId(block.id));
+		if (secrets === null) return false;
+		const original = secretKeysOf(tree, effective);
+		let written = null;
+		try {
+			written = await transformSecretWrite({
+				tree,
+				secrets,
+				patch: original,
+				stored: secretKeysOf(tree, stored),
+				operatorWrite: true
+			});
+			const back = await resolveSecretMarkers(written.patch, secrets, { unresolved: "omit" });
+			const expected = await resolveSecretMarkers(secretKeysOf(tree, original, written.patch), secrets, { unresolved: "omit" });
+			if (back.unresolved.length > 0 || expected.unresolved.length > 0 || !isDeepStrictEqual(back.value, expected.value)) {
+				await this.discard(secrets, written.patch, stored);
+				return false;
+			}
+			await this.rows(block.id).merge({
+				...rest,
+				...written.patch
+			});
+			await written.afterWrite();
+			return true;
+		} catch {
+			if (written !== null) await this.discard(secrets, written.patch, stored);
+			return false;
+		}
+	}
+	/** Remove the values a failed move put, never one the row already pointed at. */
+	async discard(secrets, patch, stored) {
+		const had = new Set(collectSecretMarkerRefs(stored));
+		const fresh = collectSecretMarkerRefs(patch).filter((ref) => !had.has(ref));
+		if (fresh.length === 0) return;
+		try {
+			await secrets.delete(fresh);
+		} catch {}
+	}
+	async report(apply, tally, subjects) {
+		let remainingRaw = 0;
+		let unresolvedMarkers = 0;
+		const legacyById = /* @__PURE__ */ new Map();
+		for (const row of await this.store.query.query({ collection: CORE_BLOCK_SETTINGS_COLLECTION })) legacyById.set(row.id, legacyValuesOf(row.data));
+		for (const block of subjects) {
+			const tree = secretTreeFromSchema(block.settingsSchema ?? null);
+			const after = await this.readStored(block.id);
+			const counts = countSecretLeaves(tree, after);
+			remainingRaw += counts.raw;
+			const legacyKeys = legacyById.get(block.id) ?? {};
+			for (const key of untrackedCredentialKeys(tree, after)) if (!(key in legacyKeys)) remainingRaw += 1;
+			if (counts.markers === 0) continue;
+			const secrets = this.keychainFor(coreBlockAddonId(block.id));
+			if (secrets === null) {
+				unresolvedMarkers += counts.markers;
+				continue;
+			}
+			const resolved = await resolveSecretMarkers(secretKeysOf(tree, after), secrets, { unresolved: "omit" });
+			unresolvedMarkers += resolved.unresolved.length;
+		}
+		const bySchema = new Map(subjects.map((b) => [b.id, b.settingsSchema]));
+		for (const [id, values] of legacyById) {
+			const tree = secretTreeFromSchema(bySchema.get(id) ?? null);
+			remainingRaw += countSecretLeaves(tree, values).raw + untrackedCredentialKeys(tree, values).size;
+		}
+		return {
+			apply,
+			rows: tally.rows,
+			raw: tally.raw,
+			markers: tally.markers,
+			migrated: tally.migrated,
+			failed: tally.failed,
+			remainingRaw,
+			unresolvedMarkers,
+			redundantCopies: tally.redundant,
+			verified: remainingRaw === 0 && unresolvedMarkers === 0
+		};
 	}
 };
 //#endregion
@@ -1948,7 +2263,14 @@ var CoreBlocksAddon = class extends BaseAddon {
 			store: settingsStore,
 			logger: this.ctx.logger.child("store")
 		});
-		this.prefs = new BlockSettingsStore({ store: settingsStore });
+		this.prefs = new BlockSettingsStore({
+			store: settingsStore,
+			keychainFor: (owner) => this.ctx.secrets?.forOwner?.(owner) ?? null,
+			onOrphaned: (blockId, refs) => this.ctx.logger.warn("core block settings: dropped keychain refs could not be deleted", { meta: {
+				blockId,
+				refs: [...refs]
+			} })
+		});
 		await this.store.load();
 		this.transpiler = await loadTranspiler(this.ctx.logger);
 		armBlocksIntegration({
@@ -2208,13 +2530,18 @@ var CoreBlocksAddon = class extends BaseAddon {
 				if (block === null) return null;
 				const schema = block.settingsSchema;
 				if (schema === void 0) return null;
-				return hydrateSchema(schema, await this.requirePrefs().getValues(blockId));
+				return hydrateSchema(schema, await this.requirePrefs().readStored(blockId), { inlineSecretsAsViews: true });
 			},
 			updateBlockSettings: async ({ blockId, patch }) => {
-				if (this.requireStore().get(blockId) === null) throw new Error(`core-blocks: no block "${blockId}"`);
-				await this.requirePrefs().mergeValues(blockId, patch);
+				const block = this.requireStore().get(blockId);
+				if (block === null) throw new Error(`core-blocks: no block "${blockId}"`);
+				await this.requirePrefs().mergeValues(blockId, block.settingsSchema, patch);
 				return { success: true };
 			},
+			migrateRawSecrets: async ({ apply }) => this.requirePrefs().migrateRawSecrets(this.requireStore().list().map((b) => ({
+				id: b.id,
+				settingsSchema: b.settingsSchema
+			})), apply),
 			getTypeDefs: async () => {
 				this.typeDefs ??= await loadBlockTypeDefs(this.ctx.logger);
 				return { libs: this.typeDefs.map((l) => ({

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CyIHDLCg.js");
+const require_dist = require("../../dist-D1vECb_6.js");
 const require_prefix_range = require("../../prefix-range-D_KueXbQ.js");
 const require_prefix_walk = require("../../prefix-walk-Dv6MLZlM.js");
 const require_retired_settings_keys = require("../../retired-settings-keys-D_VwZiDt.js");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { Ar as errMsg, Br as WELL_KNOWN_TAB_MAP, Bt as deviceStatusCapability, C as DAY_NAMES, Ci as EventCategory, Dr as DeviceFeature, En as normalizeUnit, Gn as runtimeStatePolicyFor, Ht as enumerateItemArrayFields, Kr as collectZodSecretPaths, Kt as expandContainer, Lt as deviceExtensionCapability, N as FieldClaimModeSchema, Nt as defineExtensionSlotProvider, Or as DeviceRole, Ot as createDeviceExtensionProvider, P as FieldClaimSchema, Qt as formatMinutes, Rt as deviceManagerCapability, Si as userError, Ut as enumerateSchemaFields, V as MINUTES_PER_DAY, Y as STREAM_PROFILE_META, Zn as siteZoneKey, _i as secretTreeFromPaths, ai as isSecretMarker, bi as toSecretFieldView, c as CAMERA_SWITCH_ORDER, dn as legacyAutoLinkIds, hi as resolveSecretMarkers, hn as locationIconKey, ht as buildStreamParamsConfigSchema, ii as isSecretClear, j as DeviceStatusSchema, jr as BaseAddon, kn as parseStreamParamsFormPatch, kr as DeviceType, oi as isSecretMarkerLike, r as ALL_CAPABILITY_DEFINITIONS, ri as isKeychainStoredField, ti as isDeviceConfigCap, u as CAP_NAMES_WITH_STATUS, vi as sleep$1, vt as canonicalIconKey, xi as transformSecretWrite, zr as SECRET_CLEAR, zt as deviceStateCapability } from "../../dist-DsrQYcLm.mjs";
+import { $i as EventCategory, $t as formatMinutes, Ai as isSecretClear, An as parseStreamParamsFormPatch, Bt as deviceStateCapability, Di as isDeviceConfigCap, Dn as normalizeUnit, F as FieldClaimSchema, Fr as BaseAddon, H as MINUTES_PER_DAY, Ji as sleep$1, Jn as runtimeStatePolicyFor, Ki as secretTreeFromPaths, M as DeviceStatusSchema, Mi as isSecretMarkerLike, Mr as DeviceRole, Nr as DeviceType, P as FieldClaimModeSchema, Pr as errMsg, Pt as defineExtensionSlotProvider, Qi as userError, Rt as deviceExtensionCapability, Ut as enumerateItemArrayFields, Vt as deviceStatusCapability, Wi as resolveSecretMarkers, Wt as enumerateSchemaFields, X as STREAM_PROFILE_META, Xi as toSecretFieldView, Zi as transformSecretWrite, d as CAP_NAMES_WITH_STATUS, er as siteZoneKey, fn as legacyAutoLinkIds, gn as locationIconKey, gt as buildStreamParamsConfigSchema, ji as isSecretMarker, jr as DeviceFeature, ki as isKeychainStoredField, kt as createDeviceExtensionProvider, l as CAMERA_SWITCH_ORDER, li as WELL_KNOWN_TAB_MAP, oi as SECRET_CLEAR, qt as expandContainer, r as ALL_CAPABILITY_DEFINITIONS, vi as collectZodSecretPaths, w as DAY_NAMES, yt as canonicalIconKey, zt as deviceManagerCapability } from "../../dist-DERK-gP5.mjs";
 import { t as prefixRange } from "../../prefix-range-Dl0znowN.mjs";
 import { t as loadPrefixed } from "../../prefix-walk-DAOBSyH1.mjs";
 import { r as purgeRetiredSettingsRows } from "../../retired-settings-keys-Bhwe4ymb.mjs";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CyIHDLCg.js");
+const require_dist = require("../../dist-D1vECb_6.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { gn as logDestinationCapability, jr as BaseAddon } from "../../dist-DsrQYcLm.mjs";
+import { Fr as BaseAddon, _n as logDestinationCapability } from "../../dist-DERK-gP5.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CyIHDLCg.js");
-const require_device_ca = require("../../device-ca-tKY_ZS9H.js");
-const require_constants = require("../../constants-b7kpjuO4.js");
+const require_dist = require("../../dist-D1vECb_6.js");
+const require_device_ca = require("../../device-ca-DT9X2S6d.js");
+const require_constants = require("../../constants-BXiNEIeV.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/keychain/index.mjs

@@ -1,6 +1,6 @@
-import { $r as formatSecretScope, Ci as EventCategory, L as KEYCHAIN_RESET_TRIGGER_ACTOR, fi as parseSecretRef, jr as BaseAddon, li as normalizeSecretOwner, ln as keychainAdminCapability, un as keychainCapability } from "../../dist-DsrQYcLm.mjs";
-import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-BJpYTAPg.mjs";
-import { a as MESH_CA_KEY_REF } from "../../constants-2iWQ-Nx-.mjs";
+import { $i as EventCategory, Bi as parseSecretRef, Fr as BaseAddon, Li as normalizeSecretOwner, R as KEYCHAIN_RESET_TRIGGER_ACTOR, Ti as formatSecretScope, dn as keychainCapability, un as keychainAdminCapability } from "../../dist-DERK-gP5.mjs";
+import { d as JWT_SIGNING_KEY_REF, n as DEVICE_CA_KEY_REF, p as SYSTEM_SECRET_OWNER } from "../../device-ca-jxjSL8Ov.mjs";
+import { a as MESH_CA_KEY_REF } from "../../constants-BKX2QnIg.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { restrictDirToOwnerSync, restrictFileToOwnerSync, writeOwnerOnlyFileSync } from "@camstack/types/node";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CyIHDLCg.js");
+const require_dist = require("../../dist-D1vECb_6.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Ar as errMsg, Ci as EventCategory, G as RecordingStatusSchema, W as RECORDING_SOURCE_CAMSTACK_ADDON, jr as BaseAddon, qr as createEvent } from "../../dist-DsrQYcLm.mjs";
+import { $i as EventCategory, Fr as BaseAddon, G as RECORDING_SOURCE_CAMSTACK_ADDON, K as RecordingStatusSchema, Pr as errMsg, yi as createEvent } from "../../dist-DERK-gP5.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CyIHDLCg.js");
+const require_dist = require("../../dist-D1vECb_6.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-tKY_ZS9H.js");
+const require_device_ca = require("../../device-ca-DT9X2S6d.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,8 +1,8 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { E as DEVICE_NONCE_TTL_MS, It as deviceCredentialsCapability, Q as SsoBridgeClaimsSchema, Si as userError, T as DEVICE_ENROLLMENT_TTL_MS, X as ScopedTokenSchema, Zt as formatDeviceRevoker, a as ApiKeyRecordSchema, ai as isSecretMarker, cr as userManagementCapability, ct as authProviderCapability, jr as BaseAddon, mt as buildDeviceSignatureMessage, pt as buildDeviceEnrollmentLink, rt as UserRecordSchema, si as makeSecretMarker } from "../../dist-DsrQYcLm.mjs";
+import { $ as SsoBridgeClaimsSchema, D as DEVICE_NONCE_TTL_MS, E as DEVICE_ENROLLMENT_TTL_MS, Fr as BaseAddon, Lt as deviceCredentialsCapability, Pi as makeSecretMarker, Qi as userError, Qt as formatDeviceRevoker, Z as ScopedTokenSchema, a as ApiKeyRecordSchema, dr as userManagementCapability, ht as buildDeviceSignatureMessage, it as UserRecordSchema, ji as isSecretMarker, lt as authProviderCapability, mt as buildDeviceEnrollmentLink } from "../../dist-DERK-gP5.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-BJpYTAPg.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-jxjSL8Ov.mjs";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CyIHDLCg.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-Da-0NEyr.js");
+const require_dist = require("../../dist-D1vECb_6.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-Cah9GCIg.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,5 +1,5 @@
-import { An as pickAppLinkHub, Ci as EventCategory, F as HUB_MDNS_SERVICE_TYPE, I as HUB_MDNS_TXT_KEYS, Ln as resolveAppConnections, U as NetworkTunnelStartedDataSchema, Vn as resolveHubAddressRoles, Wn as resolveNotificationTapAddress, in as isDefaultAppConnectionEndpoint, jr as BaseAddon, l as CAMSTACK_APP_LINK_ORIGIN, mn as localNetworkCapability, tn as isAppLinkBase, ur as validateCustomAddress, yt as checkRoleAddress } from "../../dist-DsrQYcLm.mjs";
-import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-BS2akjWx.mjs";
+import { $i as EventCategory, Bn as resolveAppConnections, Fr as BaseAddon, I as HUB_MDNS_SERVICE_TYPE, L as HUB_MDNS_TXT_KEYS, W as NetworkTunnelStartedDataSchema, Wn as resolveHubAddressRoles, an as isDefaultAppConnectionEndpoint, bt as checkRoleAddress, hn as localNetworkCapability, jn as pickAppLinkHub, nn as isAppLinkBase, pr as validateCustomAddress, qn as resolveNotificationTapAddress, u as CAMSTACK_APP_LINK_ORIGIN } from "../../dist-DERK-gP5.mjs";
+import { P as readLanHttpState, a as storeUploadedCertificate, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans, w as ensureTlsCert } from "../../hub-mdns-ciao-CRaC97V0.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
 import * as os$1 from "node:os";