@camstack/system 1.2.375 → 1.2.377

package/dist/{child-cap-dispatch-Bfdgkbq3.js → child-cap-dispatch-DlDSoqm1.js}

@@ -1,7 +1,7 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CNbnikIh.js");
+const require_dist = require("./dist-D_a9mUiM.js");
 const require_proc_stat = require("./proc-stat-DL-WUOhl.js");
-require("./hub-cap-forward-DmHNjbB0.js");
+require("./hub-cap-forward-COCmYaup.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let _camstack_types_node = require("@camstack/types/node");
@@ -3178,6 +3178,118 @@ function createAddonPeerBytesFacility(args) {
 	};
 }
 //#endregion
+//#region src/logging/log-redactor.ts
+/**
+* The central log redactor (D787 §8). Every line passes through it before any
+* destination, ring buffer or subscriber sees it — in hub-main's `LogManager`,
+* in a forked runner's UDS logger (which alone knows the values that runner
+* resolved), and on an agent before a child's line is forwarded to the hub.
+*
+* Three nets, cheapest first:
+*  1. KNOWN VALUES — every secret this process resolved through `ctx.secrets`
+*     is replaced wherever it appears (`‹secret:<ref hash>›`). The only net
+*     that catches a value inside a library's error message.
+*  2. URL CREDENTIALS — `user:pass@` and credential query params in any URL
+*     inside a string (`maskUrlCredentials`), and the value after a
+*     credential-looking CLI flag (`--token X`, `--auth-key=X`).
+*  3. KEY NAMES — a `meta` value under a credential-named key, at any depth.
+*
+* Key names are a LOG heuristic only: whether a field is STORED in the
+* keychain is decided by its schema type, never by its name.
+*
+* Hot path: a line with no meta, no `://`, no `--` and no registered values
+* costs a few `includes` checks.
+*/
+var REDACTED = "***";
+/** Credential-named keys. Substring, case-insensitive; only STRING values are replaced. */
+var SECRET_KEY_SUBSTRINGS = [
+	"password",
+	"passwd",
+	"secret",
+	"token",
+	"apikey",
+	"api_key",
+	"authkey",
+	"auth_key",
+	"privatekey",
+	"private_key",
+	"passphrase",
+	"credential",
+	"cookie"
+];
+/** True when a meta key names a credential. */
+function isCredentialKeyName(key) {
+	const lower = key.toLowerCase();
+	return SECRET_KEY_SUBSTRINGS.some((needle) => lower.includes(needle));
+}
+var URL_IN_TEXT = /\b[a-z][a-z0-9+.-]*:\/\/[^\s"'<>`]+/gi;
+var CREDENTIAL_FLAG = /(--(?:token|auth-?key|password|passwd|pass|secret|api-?key|access-?token|refresh-?token)(?:=|\s+))(\S+)/gi;
+/** Redact one free-form string. */
+function redactLogText(text) {
+	let out = require_dist.scrubKnownSecrets(text);
+	if (out.includes("://")) out = out.replace(URL_IN_TEXT, (url) => require_dist.maskUrlCredentials(url));
+	if (out.includes("--")) out = out.replace(CREDENTIAL_FLAG, (_m, flag, value) => value.startsWith("‹secret:") ? `${flag}${value}` : `${flag}${REDACTED}`);
+	return out;
+}
+/** Bounds on the meta walk — a log line is not a place to traverse a graph. */
+var MAX_DEPTH = 8;
+var MAX_NODES = 2e3;
+/**
+* Redact a value, returning the SAME reference when nothing in it changed —
+* most lines carry clean meta, and copying every one would put an allocation
+* per log line on hub-main's event loop.
+*/
+function redactValue(value, depth, budget, seen) {
+	if (budget.nodes++ > MAX_NODES) return value;
+	if (typeof value === "string") return redactLogText(value);
+	if (value === null || typeof value !== "object") return value;
+	if (depth >= MAX_DEPTH || seen.has(value)) return value;
+	if (value instanceof Error) {
+		const message = redactLogText(value.message);
+		return message === value.message ? value : message;
+	}
+	if (value instanceof Date || ArrayBuffer.isView(value) || value instanceof ArrayBuffer) return value;
+	seen.add(value);
+	if (Array.isArray(value)) {
+		let copy = null;
+		for (let i = 0; i < value.length; i++) {
+			const item = value[i];
+			const next = redactValue(item, depth + 1, budget, seen);
+			if (next !== item) {
+				copy ??= [...value];
+				copy[i] = next;
+			}
+		}
+		return copy ?? value;
+	}
+	let copy = null;
+	for (const [key, child] of Object.entries(value)) {
+		const next = typeof child === "string" && child.length > 0 && isCredentialKeyName(key) ? REDACTED : redactValue(child, depth + 1, budget, seen);
+		if (next !== child) {
+			copy ??= { ...value };
+			copy[key] = next;
+		}
+	}
+	return copy ?? value;
+}
+/** Redact a `meta` record; the same object back when it was already clean. */
+function redactLogMeta(meta) {
+	const out = redactValue(meta, 0, { nodes: 0 }, /* @__PURE__ */ new WeakSet());
+	if (out === meta) return meta;
+	return out !== null && typeof out === "object" && !Array.isArray(out) ? Object.fromEntries(Object.entries(out)) : meta;
+}
+/** Redact a whole entry: message and meta. Tags are identifiers, left alone. */
+function redactLogEntry(entry) {
+	const message = redactLogText(entry.message);
+	const meta = entry.meta !== void 0 ? redactLogMeta(entry.meta) : void 0;
+	if (message === entry.message && meta === entry.meta) return entry;
+	return {
+		...entry,
+		message,
+		...meta !== void 0 ? { meta } : {}
+	};
+}
+//#endregion
 //#region src/kernel/deps/npm-command.ts
 /**
 * npm invocation resolver — makes "is npm available?" a solved problem for
@@ -4712,6 +4824,16 @@ function buildDeviceOpsProvider(device) {
 		}
 	};
 }
+/**
+* The secret paths a live device's config schema declares (D783). A device
+* whose `config` carries no readable schema (a test double) declares none —
+* the hub's keyword backstop still applies to it.
+*/
+function declaredSecretConfigPaths(device) {
+	const schema = device.config?.schema;
+	if (schema === void 0 || schema === null || typeof schema !== "object") return [];
+	return [...(0, _camstack_types_addon.collectZodSecretPaths)(schema)];
+}
 function callDeviceManager(api, method, input) {
 	const leaf = Reflect.get(Reflect.get(api, "deviceManager"), method);
 	return (leaf.mutate ?? leaf.query)(input);
@@ -4763,12 +4885,13 @@ function createBrokerDeviceManagerApi(opts) {
 			bindRuntimeState: (state) => {
 				runtimeStateRef = state;
 			},
-			persistConfig: async (data) => {
+			persistConfig: async (data, options) => {
 				const dataRecord = toPlainRecord(data);
 				if (!dataRecord) throw new Error(`worker-device-manager: persistConfig expected a plain object, got ${data === null ? "null" : typeof data}`);
 				await callDeviceManager(api, "persistConfig", {
 					deviceId: id,
-					data: dataRecord
+					data: dataRecord,
+					...options?.secretConfigPaths !== void 0 ? { secretConfigPaths: [...options.secretConfigPaths] } : {}
 				});
 			},
 			initialRuntimeState,
@@ -5158,7 +5281,8 @@ function createBrokerDeviceManagerApi(opts) {
 					name: device.name,
 					parentDeviceId: device.parentDeviceId,
 					features: [...device.features],
-					config: {}
+					config: {},
+					secretConfigPaths: declaredSecretConfigPaths(device)
 				});
 			} catch (err) {
 				registry.remove(device.id);
@@ -5177,7 +5301,8 @@ function createBrokerDeviceManagerApi(opts) {
 						name: device.name,
 						parentDeviceId: device.parentDeviceId,
 						features: [...device.features],
-						config: {}
+						config: {},
+						secretConfigPaths: declaredSecretConfigPaths(device)
 					});
 				} catch (err) {
 					opts.logger.debug("post-probe features meta refresh failed (non-fatal)", {
@@ -8289,22 +8414,33 @@ function extractNodeId(args) {
 	return typeof raw === "string" && raw.length > 0 ? raw : void 0;
 }
 /**
-* Merge `callerAddonId` into `args` as an extra field — the SAME "provider
+* Stamp the CALLER identity into a cap call's args — the SAME "provider
 * destructures what it needs and ignores the rest" convention
 * {@link extractNodeId} already relies on for the inline `nodeId` pin.
-* `undefined` (the overwhelmingly common case: no caller hint, or the census
-* consuming it is disarmed) returns `args` unchanged — no allocation. A
-* non-object `args` (or `null`/array) is returned unchanged too: there is
-* nowhere to attach an extra key without changing the payload's shape, and a
-* provider taking a bare value never reads `callerAddonId` off it anyway.
-*/
-function withCallerAddonId(args, callerAddonId) {
-	if (callerAddonId === void 0) return args;
+*
+* The stamp is the transport's, never the caller's (D787):
+*  - a stamp (`callerAddonId` known to the transport) OVERWRITES whatever the
+*    args carry under that key;
+*  - NO stamp STRIPS the key: a call that crossed a wire with no identity the
+*    transport can vouch for must not arrive carrying a claimed one. The
+*    keychain owner-checks on this field, and until 2026-10-08 an unstamped
+*    call let a child's own `callerAddonId` through untouched.
+*
+* A hub in-process caller never reaches this function (`localProviderLink`
+* calls the provider directly), which is the one place a stated identity is
+* trusted. A non-object `args` (or `null`/array) is returned unchanged: there
+* is nowhere to attach a key, and nowhere one could hide.
+*/
+function stampCallerAddonId(args, callerAddonId) {
 	if (args === null || typeof args !== "object" || Array.isArray(args)) return args;
-	return {
+	if (callerAddonId !== void 0) return {
 		...args,
 		callerAddonId
 	};
+	if (!Object.prototype.hasOwnProperty.call(args, "callerAddonId")) return args;
+	const rest = {};
+	for (const [key, value] of Object.entries(args)) if (key !== "callerAddonId") rest[key] = value;
+	return rest;
 }
 var CapRouteResolver = class {
 	hubNodeId;
@@ -8408,7 +8544,7 @@ var CapRouteResolver = class {
 	*/
 	async dispatchInner(route, method, args, addonId, callerAddonId) {
 		switch (route.kind) {
-			case "hub-in-process": return route.ref.invoke(method, withCallerAddonId(args, callerAddonId));
+			case "hub-in-process": return route.ref.invoke(method, stampCallerAddonId(args, callerAddonId));
 			case "hub-local-uds": {
 				const registry = this.hubLocalRegistry;
 				if (registry === null) throw new CapRouteError(route.capName, method, {
@@ -8968,7 +9104,8 @@ var LocalChildRegistry = class {
 			method: input.method,
 			args: input.args,
 			...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {},
-			...input.addonId !== void 0 ? { addonId: input.addonId } : {}
+			...input.addonId !== void 0 ? { addonId: input.addonId } : {},
+			...input.callerAddonId !== void 0 ? { callerAddonId: input.callerAddonId } : {}
 		};
 	}
 	listChildren() {
@@ -9242,7 +9379,8 @@ var LocalChildRegistry = class {
 							capName: out.capName,
 							method: out.method,
 							args: void 0,
-							...out.deviceId !== void 0 ? { deviceId: out.deviceId } : {}
+							...out.deviceId !== void 0 ? { deviceId: out.deviceId } : {},
+							...childId !== null ? { callerAddonId: childId } : {}
 						};
 						const declared = this.capTimeoutMs?.(out.capName, out.method);
 						return entry.channel.request(forward, {
@@ -9467,13 +9605,14 @@ var LocalChildClient = class {
 		channel.onRequest(async (body, payload) => {
 			const msg = body;
 			if (msg.kind === "cap-call") {
-				const args = payload !== void 0 ? unpackPayload(payload) : msg.args;
+				const args = stampCallerAddonId(payload !== void 0 ? unpackPayload(payload) : msg.args, msg.callerAddonId);
 				const result = await this.options.dispatch({
 					capName: msg.capName,
 					method: msg.method,
 					args,
 					...msg.deviceId !== void 0 ? { deviceId: msg.deviceId } : {},
-					...msg.addonId !== void 0 ? { addonId: msg.addonId } : {}
+					...msg.addonId !== void 0 ? { addonId: msg.addonId } : {},
+					...msg.callerAddonId !== void 0 ? { callerAddonId: msg.callerAddonId } : {}
 				});
 				if (payload !== void 0 && result !== void 0) return new PayloadReply(void 0, packPayload(result));
 				return result;
@@ -9656,12 +9795,12 @@ function createUdsLoggerWithState(client, addonId, nodeId, levelState, scope, ta
 		} : baseTags;
 		const entry = {
 			level,
-			message,
+			message: redactLogText(message),
 			addonId,
 			nodeId,
 			...scope !== void 0 ? { scope } : {},
 			tags: mergedTags,
-			...extras?.meta !== void 0 ? { meta: extras.meta } : {}
+			...extras?.meta !== void 0 ? { meta: redactLogMeta(extras.meta) } : {}
 		};
 		client.sendLog(entry);
 	}
@@ -9883,7 +10022,8 @@ function createParentUnownedCallHandler(deps) {
 				method: input.method,
 				args: input.args,
 				deviceId,
-				native: true
+				native: true,
+				...input.callerAddonId !== void 0 ? { callerAddonId: input.callerAddonId } : {}
 			});
 			throw new Error(`no native provider for capability "${input.capName}" on device ${String(deviceId)}`);
 		}
@@ -9943,7 +10083,8 @@ function createParentUnownedCallHandler(deps) {
 						method: input.method,
 						args: input.args,
 						deviceId,
-						nodeId: owner.nodeId
+						nodeId: owner.nodeId,
+						...input.callerAddonId !== void 0 ? { callerAddonId: input.callerAddonId } : {}
 					});
 					return await brokerCallForCap(deps.broker, input.capName, input.method, input.args, { nodeId: owner.nodeId });
 				}
@@ -9953,7 +10094,8 @@ function createParentUnownedCallHandler(deps) {
 				method: input.method,
 				args: input.args,
 				...deviceId !== void 0 ? { deviceId } : {},
-				...nodeId !== void 0 ? { nodeId } : {}
+				...nodeId !== void 0 ? { nodeId } : {},
+				...input.callerAddonId !== void 0 ? { callerAddonId: input.callerAddonId } : {}
 			});
 			if (deps.isCoreServiceCap !== void 0 && !deps.isCoreServiceCap(input.capName)) {
 				for (let attempt = 1; attempt <= ADDON_CAP_RETRY_ATTEMPTS; attempt++) {
@@ -9964,7 +10106,7 @@ function createParentUnownedCallHandler(deps) {
 							...nodeId !== void 0 ? { nodeId } : {},
 							...deviceId !== void 0 ? { deviceId } : {}
 						});
-						return await retryResolver.dispatch(route, input.method, input.args);
+						return input.callerAddonId !== void 0 ? await retryResolver.dispatch(route, input.method, input.args, void 0, input.callerAddonId) : await retryResolver.dispatch(route, input.method, input.args);
 					} catch (err) {
 						if (!(err instanceof CapRouteError) || err.reason !== "no-provider") throw err;
 					}
@@ -11927,6 +12069,19 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		api,
 		deps: new AddonDepsManager(addonDataDir, scopedLogger),
 		settings: settingsView,
+		secrets: (0, _camstack_types_addon.createSecretsAccess)({
+			owner: addonId,
+			transport: {
+				put: (input) => api.keychain.put.mutate({
+					ref: input.ref,
+					value: input.value
+				}),
+				resolve: (input) => api.keychain.resolve.query({ refs: [...input.refs] }),
+				delete: (input) => api.keychain.delete.mutate({ refs: [...input.refs] }),
+				getState: () => api.keychain.getState.query({})
+			},
+			eventBus: scopedEventBus
+		}),
 		kernel: (() => {
 			const streamProbe = runtime.mode === "broker" ? {
 				probe: (url, probeOptions) => runtime.broker.call("$stream-probe.probe", {
@@ -13545,6 +13700,12 @@ Object.defineProperty(exports, "isArrayBufferCensusReport", {
 		return isArrayBufferCensusReport;
 	}
 });
+Object.defineProperty(exports, "isCredentialKeyName", {
+	enumerable: true,
+	get: function() {
+		return isCredentialKeyName;
+	}
+});
 Object.defineProperty(exports, "killOwnRunnerGroupAfterParentLoss", {
 	enumerable: true,
 	get: function() {
@@ -13617,6 +13778,24 @@ Object.defineProperty(exports, "recordSocketFrame", {
 		return recordSocketFrame;
 	}
 });
+Object.defineProperty(exports, "redactLogEntry", {
+	enumerable: true,
+	get: function() {
+		return redactLogEntry;
+	}
+});
+Object.defineProperty(exports, "redactLogMeta", {
+	enumerable: true,
+	get: function() {
+		return redactLogMeta;
+	}
+});
+Object.defineProperty(exports, "redactLogText", {
+	enumerable: true,
+	get: function() {
+		return redactLogText;
+	}
+});
 Object.defineProperty(exports, "registerEventBusService", {
 	enumerable: true,
 	get: function() {
@@ -13725,6 +13904,12 @@ Object.defineProperty(exports, "socketDirectionMessages", {
 		return socketDirectionMessages;
 	}
 });
+Object.defineProperty(exports, "stampCallerAddonId", {
+	enumerable: true,
+	get: function() {
+		return stampCallerAddonId;
+	}
+});
 Object.defineProperty(exports, "startHeapWatch", {
 	enumerable: true,
 	get: function() {

package/dist/{composition-sources-DYlXX2qW.js → composition-sources-BNyXPSs_.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CNbnikIh.js");
+const require_dist = require("./dist-D_a9mUiM.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-BfZgiTYD.mjs → composition-sources-D39bl0nP.mjs}

@@ -1,4 +1,4 @@
-import { er as compositionSourceKey, sr as errMsg } from "./dist-ZdSg09GJ.mjs";
+import { cr as errMsg, tr as compositionSourceKey } from "./dist-BWNoS-1S.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation