@camstack/system 1.2.161 → 1.2.163

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as BaseAddon, N as collectSecretConfigKeys, Qt as parseJsonObject, S as StorageMigrationJobSchema, St as settingsStoreCapability, Tt as storageMigrationCapability, m as REDACTED_SECRET, wt as storageCapability, x as StorageLocationTypeSchema } from "../../dist-D4xNBlJM.mjs";
+import { Mt as BaseAddon, N as collectSecretConfigKeys, Qt as parseJsonObject, S as StorageMigrationJobSchema, St as settingsStoreCapability, Tt as storageMigrationCapability, m as REDACTED_SECRET, wt as storageCapability, x as StorageLocationTypeSchema } from "../../dist-DxFjna2a.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";
@@ -1171,47 +1171,62 @@ function createDataStoreDispatch(getEngines) {
 //#endregion
 //#region src/builtins/storage-orchestrator/location-secrets.ts
 /**
-* Credential redaction for `StorageLocation.config`.
+* The config keys the ORCHESTRATOR itself owns, as opposed to the ones a
+* provider owns. Every one of them is read by framework code that has no idea
+* which provider is behind the row:
 *
-* ── What was wrong ─────────────────────────────────────────────────────────
-* `storage.listLocations` carries no `auth` override, so it is `protected` —
-* every authenticated session reaches it, admin or not. The orchestrator
-* spread each stored row verbatim. `StorageLocation.config` is
-* `z.record(z.string(), z.unknown())`, and the SFTP / S3 / WebDAV providers
-* already declare `password`, `privateKey`, `privateKeyPassphrase`,
-* `secretAccessKey` and `token` inside it. Nothing was exposed only because
-* every location on the live hub is `filesystem-storage`, whose config is
-* `basePath` + `maxUsedGb`. The exposure arrives with the first remote
-* location, and three providers that collect one already ship.
+*  - `basePath`     — `localCapacityOf`, `locationOccupancy`, the seed pass,
+*                     `LocationCard`'s summary, `StorageSection`;
+*  - `readOnly`     — drain mode; the recorder and post-analysis both filter on
+*                     it off a `listLocations` row;
+*  - `maxUsedGb`    — `resolveLocationMaxUsedBytes`;
+*  - `minFreePercent` — `resolveLocationThresholds`.
 *
-* ── The mechanism ──────────────────────────────────────────────────────────
-* Schema-driven, never a hardcoded key list: each provider's
-* `getProviderInfo().configSchema` already says which of its fields hold a
-* credential, so it is the one thing that cannot drift from the provider.
-*
-* Two directions, and both are needed:
-*  - **out** — {@link redactLocationConfig} replaces every secret value with
-*    `REDACTED_SECRET` on the way to a caller.
-*  - **in** — {@link restoreRedactedSecrets} treats that same sentinel, sent
-*    back on an upsert, as "keep what is stored". Without it the wizard's
-*    edit-and-save round trip would write the sentinel into the config and
-*    lock the operator out of their own share on the first rename.
-*
-* ── The trap this deliberately avoids ──────────────────────────────────────
-* Keying redaction off `type: 'password'` alone MISSES a secret parked in a
-* `textarea`, and the SFTP provider parks an entire PEM private key there.
-* Discovery goes through `collectSecretConfigKeys`, whose discriminator is
-* `type === 'password' || secret === true`. A redaction that quietly misses a
-* credential is worse than none: it is a leak plus an assurance there is not
-* one.
+* None can be a credential, because the framework interprets all four itself.
+* That is what makes the list safe to hardcode — it is NOT a list of "keys we
+* believe are not secret", which is the rotting kind. It is the closed set of
+* keys this module, not a provider, defines the meaning of.
 */
-/** Shared empty set for providers that declare no secrets (or are unknown). */
-var EMPTY_SECRET_KEYS = /* @__PURE__ */ new Set();
+var FRAMEWORK_CONFIG_KEYS = new Set([
+	"basePath",
+	"readOnly",
+	"maxUsedGb",
+	"minFreePercent"
+]);
 /** Secret config keys a provider declares, derived from its own form schema. */
 function secretKeysOfProviderInfo(info) {
 	return collectSecretConfigKeys(info.configSchema);
 }
 /**
+* Which keys of THIS config must be treated as secret.
+*
+* `declared` is what the provider's own schema said, or `undefined` when the
+* provider has not registered on this node and so has said nothing.
+*
+* The `undefined` branch is the one that matters. Redaction is schema-driven
+* and the schema arrives with the provider, so "no provider" used to mean "no
+* secret keys" — which redacted nothing while `listLocations` happily served
+* the row, because that method reads the store and never needs a provider.
+* That is a real window on every hub restart (the `remote-storage` group is a
+* separate runner that registers after the orchestrator boots) and it is
+* PERMANENT for a runner the CrashSupervisor marked terminally failed.
+*
+* So an unknown provider fails CLOSED: every key the framework does not itself
+* define is withheld. It over-redacts — a host name is hidden alongside the
+* password — and that is the correct direction, because the admin UI cannot
+* render a provider's form without that same provider's `configSchema` either,
+* so nothing that was working stops working.
+*
+* Withholding is done with the sentinel, never by dropping the key, so a save
+* performed in this degraded state still round-trips every value back intact.
+*/
+function secretKeysForConfig(config, declared) {
+	if (declared !== void 0) return declared;
+	const out = /* @__PURE__ */ new Set();
+	for (const key of Object.keys(config)) if (!FRAMEWORK_CONFIG_KEYS.has(key)) out.add(key);
+	return out;
+}
+/**
 * A copy of `config` with every declared secret replaced by the sentinel.
 * Returns the SAME object when there is nothing to redact, so the common case
 * (a filesystem location) allocates nothing.
@@ -2293,7 +2308,7 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 			listLocationDeclarations: async () => service.listDeclarations(),
 			upsertLocation: async (input) => {
 				const stored = service.getLocationById(input.id);
-				const config = restoreRedactedSecrets(input.config, stored?.config, this.secretKeysFor(input.providerId));
+				const config = restoreRedactedSecrets(input.config, stored?.config, this.secretKeysFor(input.providerId, stored?.config ?? {}));
 				const saved = service.upsertLocation(config === input.config ? input : {
 					...input,
 					config
@@ -2326,11 +2341,14 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 					} });
 				});
 			},
-			testConfig: async ({ providerId, config }) => {
+			testConfig: async ({ providerId, locationId, config }) => {
+				const stored = locationId === void 0 ? void 0 : service.getLocationById(locationId);
+				const base = stored?.providerId === providerId ? stored.config : void 0;
+				const resolved = restoreRedactedSecrets(config, base, this.secretKeysFor(providerId, base ?? {}));
 				const providers = getProviders();
 				for (const p of providers) try {
 					if ((await p.getProviderInfo()).providerId !== providerId) continue;
-					return p.testLocation({ config });
+					return p.testLocation({ config: resolved });
 				} catch (err) {
 					return {
 						ok: false,
@@ -2648,13 +2666,21 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 		}
 		return out;
 	}
-	/** Declared secret config keys for a provider; empty when unknown. */
-	secretKeysFor(providerId) {
-		return this.secretKeysByProvider.get(providerId) ?? EMPTY_SECRET_KEYS;
+	/**
+	* What the provider's own schema declared secret, or `undefined` when this
+	* node has never heard from that provider. The distinction is the whole
+	* point — see `secretKeysForConfig`, which fails CLOSED on `undefined`.
+	*/
+	declaredSecretKeys(providerId) {
+		return this.secretKeysByProvider.get(providerId);
+	}
+	/** Which keys of a given stored config must never leave this process. */
+	secretKeysFor(providerId, config) {
+		return secretKeysForConfig(config, this.declaredSecretKeys(providerId));
 	}
 	/** A location with its provider's declared secrets replaced by the sentinel. */
 	redacted(location) {
-		return redactLocation(location, this.secretKeysFor(location.providerId));
+		return redactLocation(location, this.secretKeysFor(location.providerId, location.config));
 	}
 	/**
 	* Is this location backed by a provider that serves a genuine local

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Keu5TDO7.js");
+const require_dist = require("../../dist-B29Skpzo.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as BaseAddon, Yt as hydrateSchema, jt as errMsg } from "../../dist-D4xNBlJM.mjs";
+import { Mt as BaseAddon, Yt as hydrateSchema, jt as errMsg } from "../../dist-DxFjna2a.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Keu5TDO7.js");
+const require_dist = require("../../dist-B29Skpzo.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Mt as BaseAddon, ot as logDestinationCapability } from "../../dist-D4xNBlJM.mjs";
+import { Mt as BaseAddon, ot as logDestinationCapability } from "../../dist-DxFjna2a.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";