@camstack/system 1.2.375 → 1.2.377

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 const require_tls = require("../../tls-CCMX7MjX.js");
 let zod = require("zod");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { Nr as EventCategory, Rt as isAppLinkBase, Sn as resolveHubAddressRoles, Tn as resolveNotificationTapAddress, Vn as validateCustomAddress, Vt as isDefaultAppConnectionEndpoint, Yt as localNetworkCapability, cr as BaseAddon, dn as pickAppLinkHub, rt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, vn as resolveAppConnections } from "../../dist-ZdSg09GJ.mjs";
+import { Cn as resolveHubAddressRoles, En as resolveNotificationTapAddress, Gr as EventCategory, Hn as validateCustomAddress, It as isAppLinkBase, Yt as localNetworkCapability, fn as pickAppLinkHub, lr as BaseAddon, nt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, yn as resolveAppConnections, zt as isDefaultAppConnectionEndpoint } from "../../dist-BWNoS-1S.mjs";
 import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-CJHogwTl.mjs";
 import { z } from "zod";
 import * as os from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, cr as BaseAddon } from "../../dist-ZdSg09GJ.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 const require_proc_stat = require("../../proc-stat-DL-WUOhl.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Nr as EventCategory, Pt as foldSnapshotByFunction, cr as BaseAddon, gn as reducePoints, rn as metricsProviderCapability, sr as errMsg, vr as createEvent, yn as resolveBucketMs } from "../../dist-ZdSg09GJ.mjs";
+import { Gr as EventCategory, Mt as foldSnapshotByFunction, Sr as createEvent, _n as reducePoints, bn as resolveBucketMs, cr as errMsg, in as metricsProviderCapability, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 import { a as parseProcStat, i as nodeProcReader, n as elapsedSecSince, o as parseProcStatusRss, r as lifetimeCpuPercent, t as commandFromCmdline } from "../../proc-stat-CbC55Kqi.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Nr as EventCategory, Tt as enumerateInferenceDevices, br as emitReadiness, cr as BaseAddon, kn as scoreRuntimes, pn as platformProbeCapability, sr as errMsg } from "../../dist-ZdSg09GJ.mjs";
+import { An as scoreRuntimes, Ct as enumerateInferenceDevices, Gr as EventCategory, cr as errMsg, lr as BaseAddon, mn as platformProbeCapability, wr as emitReadiness } from "../../dist-BWNoS-1S.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Nr as EventCategory, cr as BaseAddon } from "../../dist-ZdSg09GJ.mjs";
+import { Gr as EventCategory, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Mn as snapshotCapability, Nr as EventCategory, Q as batteryCapability, Rn as streamQualityLabel, Tr as nodePin, Z as bareAddonId, a as BatteryStatusSchema, cr as BaseAddon, ir as DeviceFeature, nn as memoizePinnedFfmpeg, or as DeviceType, sr as errMsg, yt as deriveBatteryPresence } from "../../dist-ZdSg09GJ.mjs";
+import { Gr as EventCategory, Nn as snapshotCapability, X as bareAddonId, Z as batteryCapability, _t as deriveBatteryPresence, a as BatteryStatusSchema, ar as DeviceFeature, cr as errMsg, jr as nodePin, lr as BaseAddon, rn as memoizePinnedFfmpeg, sr as DeviceType, zn as streamQualityLabel } from "../../dist-BWNoS-1S.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { In as storageProviderCapability, Nt as filesystemBrowseCapability, cr as BaseAddon } from "../../dist-ZdSg09GJ.mjs";
+import { Ln as storageProviderCapability, jt as filesystemBrowseCapability, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/storage-orchestrator/location-store.d.ts

@@ -22,6 +22,12 @@ export interface ILocationStore {
     /** Remove a location by id. */
     delete(id: string): Promise<void>;
 }
+/**
+ * @durable class=config owner=storage-orchestrator
+ *   write="an operator creates or edits a location (basePath, minFreePercent, enabled, node pin); plus the boot reconcile — declared defaults seeded on a fresh install, and in-memory-only locations backfilled when the store is late-wired"
+ *   retention="none — a row goes only when the operator deletes the location, or when the declaration pass prunes one whose declaring addon is gone. Bounded by the storage targets a human configures."
+ */
+export declare const STORAGE_LOCATIONS = "storage_locations";
 /**
  * `ILocationStore` on the `settings-store` collection surface — the same door
  * every other consumer uses. It holds the `data-store-provider` engine object

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.d.ts

@@ -167,6 +167,21 @@ export declare class StorageOrchestratorAddon extends BaseAddon<StorageOrchestra
      */
     private announceLocationsChanged;
     /** A location with its provider's declared secrets replaced by the sentinel. */
+    /**
+     * The location as a PROVIDER must see it: every keychain marker in its
+     * config resolved (D787). The same object when it holds none — a filesystem
+     * location costs nothing. An unresolvable secret is left out and logged by
+     * ref; the provider then fails its own connection, by name.
+     */
+    private withResolvedSecrets;
+    /**
+     * Strip the provider's DECLARED secrets (its form schema, by type) out of a
+     * location config into the keychain, under `row/storage_locations/<id>`.
+     * A provider that has not registered declares nothing: only keys that
+     * already hold a marker are handled then — a new plaintext is never guessed
+     * at, it stays as sent until the provider is back and the location is saved.
+     */
+    private keepSecretsInKeychain;
     private redacted;
     /**
      * Is this location backed by a provider that serves a genuine local

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
-const require_hub_cap_forward = require("../../hub-cap-forward-DmHNjbB0.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
+const require_hub_cap_forward = require("../../hub-cap-forward-COCmYaup.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -3474,9 +3474,10 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 			upsertLocation: async (input) => {
 				const stored = service.getLocationById(input.id);
 				const config = restoreRedactedSecrets(input.config, stored?.config, this.secretKeysFor(input.providerId, stored?.config ?? {}));
-				const next = config === input.config ? input : {
+				const keychained = await this.keepSecretsInKeychain(input.id, input.providerId, config, stored?.config ?? {});
+				const next = keychained === input.config ? input : {
 					...input,
-					config
+					config: keychained
 				};
 				await this.carryDataOnRepoint(stored, next);
 				const saved = service.upsertLocation(next);
@@ -3495,7 +3496,9 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 					error: `Location "${id}" not found`
 				};
 				try {
-					return (await service.getProviderFor(loc)).testLocation({ config: loc.config });
+					const p = await service.getProviderFor(loc);
+					const live = await this.withResolvedSecrets(loc);
+					return p.testLocation({ config: live.config });
 				} catch (err) {
 					return {
 						ok: false,
@@ -3531,7 +3534,7 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 				};
 			},
 			resolve: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				this.refuseRemoteResolve(loc);
 				return (await service.getProviderFor(loc)).resolve({
 					location: loc,
@@ -3539,7 +3542,7 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 				});
 			},
 			write: async ({ location, relativePath, data }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).write({
 					location: loc,
 					relativePath,
@@ -3547,21 +3550,21 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 				});
 			},
 			read: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).read({
 					location: loc,
 					relativePath
 				});
 			},
 			exists: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).exists({
 					location: loc,
 					relativePath
 				});
 			},
 			list: async ({ location, prefix }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				const p = await service.getProviderFor(loc);
 				return prefix !== void 0 ? p.list({
 					location: loc,
@@ -3569,18 +3572,18 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 				}) : p.list({ location: loc });
 			},
 			delete: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).delete({
 					location: loc,
 					relativePath
 				});
 			},
 			getAvailableSpace: async ({ location }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).getAvailableSpace({ location: loc });
 			},
 			beginUpload: async ({ location, relativePath, sizeBytes }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				const p = await service.getProviderFor(loc);
 				const result = sizeBytes !== void 0 ? await p.beginUpload({
 					location: loc,
@@ -3613,7 +3616,7 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 				}
 			},
 			beginDownload: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				const result = await (await service.getProviderFor(loc)).beginDownload({
 					location: loc,
 					relativePath
@@ -4075,6 +4078,63 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 		}
 	}
 	/** A location with its provider's declared secrets replaced by the sentinel. */
+	/**
+	* The location as a PROVIDER must see it: every keychain marker in its
+	* config resolved (D787). The same object when it holds none — a filesystem
+	* location costs nothing. An unresolvable secret is left out and logged by
+	* ref; the provider then fails its own connection, by name.
+	*/
+	async withResolvedSecrets(location) {
+		const secrets = this.ctx.secrets;
+		if (secrets === void 0) return location;
+		const { value, unresolved } = await require_dist.resolveSecretMarkers(location.config, secrets);
+		if (unresolved.length > 0) this.ctx.logger.error("storage location secret unavailable", { meta: {
+			locationId: location.id,
+			secrets: unresolved.map((u) => ({
+				ref: u.ref,
+				reason: u.reason
+			}))
+		} });
+		return value === location.config ? location : {
+			...location,
+			config: value
+		};
+	}
+	/**
+	* Strip the provider's DECLARED secrets (its form schema, by type) out of a
+	* location config into the keychain, under `row/storage_locations/<id>`.
+	* A provider that has not registered declares nothing: only keys that
+	* already hold a marker are handled then — a new plaintext is never guessed
+	* at, it stays as sent until the provider is back and the location is saved.
+	*/
+	async keepSecretsInKeychain(locationId, providerId, config, stored) {
+		const secrets = this.ctx.secrets;
+		if (secrets === void 0) return config;
+		const declared = this.declaredSecretKeys(providerId) ?? /* @__PURE__ */ new Set();
+		const markerKeys = Object.entries(stored).filter(([, v]) => require_dist.isSecretMarker(v)).map(([k]) => k);
+		const tree = require_dist.secretTreeFromPaths([...new Set([...declared, ...markerKeys])]);
+		if (tree.size === 0) return config;
+		const result = await require_dist.transformSecretWrite({
+			tree,
+			secrets,
+			patch: { ...config },
+			stored: { ...stored },
+			scope: {
+				kind: "row",
+				collection: STORAGE_LOCATIONS,
+				rowId: locationId
+			}
+		});
+		const merged = { ...result.patch };
+		for (const key of tree.keys()) if (!(key in merged) && key in stored) merged[key] = stored[key];
+		result.afterWrite().then(({ orphaned }) => {
+			if (orphaned.length > 0) this.ctx.logger.warn("storage location: dropped keychain refs could not be deleted", { meta: {
+				locationId,
+				refs: [...orphaned]
+			} });
+		});
+		return merged;
+	}
 	redacted(location) {
 		return redactLocation(location, this.secretKeysFor(location.providerId, location.config));
 	}

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,5 +1,5 @@
-import { An as settingsStoreCapability, B as StorageCleanupJobSchema, Cn as resolveLocationMode, D as LegacyStorageLocationDefaultSchema, Er as parseJsonObject, Gn as withLocationMode, H as StorageLocationTypeSchema, Ht as isLocationEnabled, It as gbToBytes, Nn as storageCapability, Nr as EventCategory, P as REDACTED_SECRET, Pn as storageMigrationCapability, U as StorageMigrationJobSchema, V as StorageLocationModeSchema, cr as BaseAddon, en as mayReadLocation, in as modeMayWrite, it as collectSecretConfigKeys, kt as evictionPolicyOfLocation, qt as legacyModeOf, tn as mayWriteToLocation } from "../../dist-ZdSg09GJ.mjs";
-import { t as HUB_CAP_FWD_ACTION } from "../../hub-cap-forward-BdT320dq.mjs";
+import { Ar as isSecretMarker, B as StorageLocationModeSchema, Bt as isLocationEnabled, D as LegacyStorageLocationDefaultSchema, Dt as evictionPolicyOfLocation, Fn as storageMigrationCapability, Gr as EventCategory, H as StorageMigrationJobSchema, Kn as withLocationMode, Nr as parseJsonObject, Pn as storageCapability, Pt as gbToBytes, Rr as resolveSecretMarkers, V as StorageLocationTypeSchema, Vr as secretTreeFromPaths, Wr as transformSecretWrite, an as modeMayWrite, br as collectSecretConfigKeys, jn as settingsStoreCapability, lr as BaseAddon, nn as mayWriteToLocation, pr as REDACTED_SECRET, qt as legacyModeOf, tn as mayReadLocation, wn as resolveLocationMode, z as StorageCleanupJobSchema } from "../../dist-BWNoS-1S.mjs";
+import { t as HUB_CAP_FWD_ACTION } from "../../hub-cap-forward-CH6_VWVO.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { containsOrEquals, physicalRootOf } from "@camstack/types/node";
@@ -3469,9 +3469,10 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 			upsertLocation: async (input) => {
 				const stored = service.getLocationById(input.id);
 				const config = restoreRedactedSecrets(input.config, stored?.config, this.secretKeysFor(input.providerId, stored?.config ?? {}));
-				const next = config === input.config ? input : {
+				const keychained = await this.keepSecretsInKeychain(input.id, input.providerId, config, stored?.config ?? {});
+				const next = keychained === input.config ? input : {
 					...input,
-					config
+					config: keychained
 				};
 				await this.carryDataOnRepoint(stored, next);
 				const saved = service.upsertLocation(next);
@@ -3490,7 +3491,9 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 					error: `Location "${id}" not found`
 				};
 				try {
-					return (await service.getProviderFor(loc)).testLocation({ config: loc.config });
+					const p = await service.getProviderFor(loc);
+					const live = await this.withResolvedSecrets(loc);
+					return p.testLocation({ config: live.config });
 				} catch (err) {
 					return {
 						ok: false,
@@ -3526,7 +3529,7 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 				};
 			},
 			resolve: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				this.refuseRemoteResolve(loc);
 				return (await service.getProviderFor(loc)).resolve({
 					location: loc,
@@ -3534,7 +3537,7 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 				});
 			},
 			write: async ({ location, relativePath, data }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).write({
 					location: loc,
 					relativePath,
@@ -3542,21 +3545,21 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 				});
 			},
 			read: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).read({
 					location: loc,
 					relativePath
 				});
 			},
 			exists: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).exists({
 					location: loc,
 					relativePath
 				});
 			},
 			list: async ({ location, prefix }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				const p = await service.getProviderFor(loc);
 				return prefix !== void 0 ? p.list({
 					location: loc,
@@ -3564,18 +3567,18 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 				}) : p.list({ location: loc });
 			},
 			delete: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).delete({
 					location: loc,
 					relativePath
 				});
 			},
 			getAvailableSpace: async ({ location }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).getAvailableSpace({ location: loc });
 			},
 			beginUpload: async ({ location, relativePath, sizeBytes }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				const p = await service.getProviderFor(loc);
 				const result = sizeBytes !== void 0 ? await p.beginUpload({
 					location: loc,
@@ -3608,7 +3611,7 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 				}
 			},
 			beginDownload: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				const result = await (await service.getProviderFor(loc)).beginDownload({
 					location: loc,
 					relativePath
@@ -4070,6 +4073,63 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 		}
 	}
 	/** A location with its provider's declared secrets replaced by the sentinel. */
+	/**
+	* The location as a PROVIDER must see it: every keychain marker in its
+	* config resolved (D787). The same object when it holds none — a filesystem
+	* location costs nothing. An unresolvable secret is left out and logged by
+	* ref; the provider then fails its own connection, by name.
+	*/
+	async withResolvedSecrets(location) {
+		const secrets = this.ctx.secrets;
+		if (secrets === void 0) return location;
+		const { value, unresolved } = await resolveSecretMarkers(location.config, secrets);
+		if (unresolved.length > 0) this.ctx.logger.error("storage location secret unavailable", { meta: {
+			locationId: location.id,
+			secrets: unresolved.map((u) => ({
+				ref: u.ref,
+				reason: u.reason
+			}))
+		} });
+		return value === location.config ? location : {
+			...location,
+			config: value
+		};
+	}
+	/**
+	* Strip the provider's DECLARED secrets (its form schema, by type) out of a
+	* location config into the keychain, under `row/storage_locations/<id>`.
+	* A provider that has not registered declares nothing: only keys that
+	* already hold a marker are handled then — a new plaintext is never guessed
+	* at, it stays as sent until the provider is back and the location is saved.
+	*/
+	async keepSecretsInKeychain(locationId, providerId, config, stored) {
+		const secrets = this.ctx.secrets;
+		if (secrets === void 0) return config;
+		const declared = this.declaredSecretKeys(providerId) ?? /* @__PURE__ */ new Set();
+		const markerKeys = Object.entries(stored).filter(([, v]) => isSecretMarker(v)).map(([k]) => k);
+		const tree = secretTreeFromPaths([...new Set([...declared, ...markerKeys])]);
+		if (tree.size === 0) return config;
+		const result = await transformSecretWrite({
+			tree,
+			secrets,
+			patch: { ...config },
+			stored: { ...stored },
+			scope: {
+				kind: "row",
+				collection: STORAGE_LOCATIONS,
+				rowId: locationId
+			}
+		});
+		const merged = { ...result.patch };
+		for (const key of tree.keys()) if (!(key in merged) && key in stored) merged[key] = stored[key];
+		result.afterWrite().then(({ orphaned }) => {
+			if (orphaned.length > 0) this.ctx.logger.warn("storage location: dropped keychain refs could not be deleted", { meta: {
+				locationId,
+				refs: [...orphaned]
+			} });
+		});
+		return merged;
+	}
 	redacted(location) {
 		return redactLocation(location, this.secretKeysFor(location.providerId, location.config));
 	}

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { Sr as hydrateSchema, cr as BaseAddon, sr as errMsg } from "../../dist-ZdSg09GJ.mjs";
+import { Dr as hydrateSchema, cr as errMsg, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CNbnikIh.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, cr as BaseAddon } from "../../dist-ZdSg09GJ.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";