@camstack/system 1.2.376 → 1.2.377

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BcUWQGr9.js");
-const require_hub_cap_forward = require("../../hub-cap-forward-DmHNjbB0.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
+const require_hub_cap_forward = require("../../hub-cap-forward-COCmYaup.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -3474,9 +3474,10 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 			upsertLocation: async (input) => {
 				const stored = service.getLocationById(input.id);
 				const config = restoreRedactedSecrets(input.config, stored?.config, this.secretKeysFor(input.providerId, stored?.config ?? {}));
-				const next = config === input.config ? input : {
+				const keychained = await this.keepSecretsInKeychain(input.id, input.providerId, config, stored?.config ?? {});
+				const next = keychained === input.config ? input : {
 					...input,
-					config
+					config: keychained
 				};
 				await this.carryDataOnRepoint(stored, next);
 				const saved = service.upsertLocation(next);
@@ -3495,7 +3496,9 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 					error: `Location "${id}" not found`
 				};
 				try {
-					return (await service.getProviderFor(loc)).testLocation({ config: loc.config });
+					const p = await service.getProviderFor(loc);
+					const live = await this.withResolvedSecrets(loc);
+					return p.testLocation({ config: live.config });
 				} catch (err) {
 					return {
 						ok: false,
@@ -3531,7 +3534,7 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 				};
 			},
 			resolve: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				this.refuseRemoteResolve(loc);
 				return (await service.getProviderFor(loc)).resolve({
 					location: loc,
@@ -3539,7 +3542,7 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 				});
 			},
 			write: async ({ location, relativePath, data }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).write({
 					location: loc,
 					relativePath,
@@ -3547,21 +3550,21 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 				});
 			},
 			read: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).read({
 					location: loc,
 					relativePath
 				});
 			},
 			exists: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).exists({
 					location: loc,
 					relativePath
 				});
 			},
 			list: async ({ location, prefix }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				const p = await service.getProviderFor(loc);
 				return prefix !== void 0 ? p.list({
 					location: loc,
@@ -3569,18 +3572,18 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 				}) : p.list({ location: loc });
 			},
 			delete: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).delete({
 					location: loc,
 					relativePath
 				});
 			},
 			getAvailableSpace: async ({ location }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).getAvailableSpace({ location: loc });
 			},
 			beginUpload: async ({ location, relativePath, sizeBytes }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				const p = await service.getProviderFor(loc);
 				const result = sizeBytes !== void 0 ? await p.beginUpload({
 					location: loc,
@@ -3613,7 +3616,7 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 				}
 			},
 			beginDownload: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				const result = await (await service.getProviderFor(loc)).beginDownload({
 					location: loc,
 					relativePath
@@ -4075,6 +4078,63 @@ var StorageOrchestratorAddon = class extends require_dist.BaseAddon {
 		}
 	}
 	/** A location with its provider's declared secrets replaced by the sentinel. */
+	/**
+	* The location as a PROVIDER must see it: every keychain marker in its
+	* config resolved (D787). The same object when it holds none — a filesystem
+	* location costs nothing. An unresolvable secret is left out and logged by
+	* ref; the provider then fails its own connection, by name.
+	*/
+	async withResolvedSecrets(location) {
+		const secrets = this.ctx.secrets;
+		if (secrets === void 0) return location;
+		const { value, unresolved } = await require_dist.resolveSecretMarkers(location.config, secrets);
+		if (unresolved.length > 0) this.ctx.logger.error("storage location secret unavailable", { meta: {
+			locationId: location.id,
+			secrets: unresolved.map((u) => ({
+				ref: u.ref,
+				reason: u.reason
+			}))
+		} });
+		return value === location.config ? location : {
+			...location,
+			config: value
+		};
+	}
+	/**
+	* Strip the provider's DECLARED secrets (its form schema, by type) out of a
+	* location config into the keychain, under `row/storage_locations/<id>`.
+	* A provider that has not registered declares nothing: only keys that
+	* already hold a marker are handled then — a new plaintext is never guessed
+	* at, it stays as sent until the provider is back and the location is saved.
+	*/
+	async keepSecretsInKeychain(locationId, providerId, config, stored) {
+		const secrets = this.ctx.secrets;
+		if (secrets === void 0) return config;
+		const declared = this.declaredSecretKeys(providerId) ?? /* @__PURE__ */ new Set();
+		const markerKeys = Object.entries(stored).filter(([, v]) => require_dist.isSecretMarker(v)).map(([k]) => k);
+		const tree = require_dist.secretTreeFromPaths([...new Set([...declared, ...markerKeys])]);
+		if (tree.size === 0) return config;
+		const result = await require_dist.transformSecretWrite({
+			tree,
+			secrets,
+			patch: { ...config },
+			stored: { ...stored },
+			scope: {
+				kind: "row",
+				collection: STORAGE_LOCATIONS,
+				rowId: locationId
+			}
+		});
+		const merged = { ...result.patch };
+		for (const key of tree.keys()) if (!(key in merged) && key in stored) merged[key] = stored[key];
+		result.afterWrite().then(({ orphaned }) => {
+			if (orphaned.length > 0) this.ctx.logger.warn("storage location: dropped keychain refs could not be deleted", { meta: {
+				locationId,
+				refs: [...orphaned]
+			} });
+		});
+		return merged;
+	}
 	redacted(location) {
 		return redactLocation(location, this.secretKeysFor(location.providerId, location.config));
 	}

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,5 +1,5 @@
-import { An as settingsStoreCapability, B as StorageCleanupJobSchema, Cn as resolveLocationMode, D as LegacyStorageLocationDefaultSchema, Dr as parseJsonObject, Gn as withLocationMode, H as StorageLocationTypeSchema, Ht as isLocationEnabled, It as gbToBytes, Nn as storageCapability, P as REDACTED_SECRET, Pn as storageMigrationCapability, Pr as EventCategory, U as StorageMigrationJobSchema, V as StorageLocationModeSchema, cr as BaseAddon, en as mayReadLocation, in as modeMayWrite, it as collectSecretConfigKeys, kt as evictionPolicyOfLocation, qt as legacyModeOf, tn as mayWriteToLocation } from "../../dist-D732NygW.mjs";
-import { t as HUB_CAP_FWD_ACTION } from "../../hub-cap-forward-BdT320dq.mjs";
+import { Ar as isSecretMarker, B as StorageLocationModeSchema, Bt as isLocationEnabled, D as LegacyStorageLocationDefaultSchema, Dt as evictionPolicyOfLocation, Fn as storageMigrationCapability, Gr as EventCategory, H as StorageMigrationJobSchema, Kn as withLocationMode, Nr as parseJsonObject, Pn as storageCapability, Pt as gbToBytes, Rr as resolveSecretMarkers, V as StorageLocationTypeSchema, Vr as secretTreeFromPaths, Wr as transformSecretWrite, an as modeMayWrite, br as collectSecretConfigKeys, jn as settingsStoreCapability, lr as BaseAddon, nn as mayWriteToLocation, pr as REDACTED_SECRET, qt as legacyModeOf, tn as mayReadLocation, wn as resolveLocationMode, z as StorageCleanupJobSchema } from "../../dist-BWNoS-1S.mjs";
+import { t as HUB_CAP_FWD_ACTION } from "../../hub-cap-forward-CH6_VWVO.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { containsOrEquals, physicalRootOf } from "@camstack/types/node";
@@ -3469,9 +3469,10 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 			upsertLocation: async (input) => {
 				const stored = service.getLocationById(input.id);
 				const config = restoreRedactedSecrets(input.config, stored?.config, this.secretKeysFor(input.providerId, stored?.config ?? {}));
-				const next = config === input.config ? input : {
+				const keychained = await this.keepSecretsInKeychain(input.id, input.providerId, config, stored?.config ?? {});
+				const next = keychained === input.config ? input : {
 					...input,
-					config
+					config: keychained
 				};
 				await this.carryDataOnRepoint(stored, next);
 				const saved = service.upsertLocation(next);
@@ -3490,7 +3491,9 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 					error: `Location "${id}" not found`
 				};
 				try {
-					return (await service.getProviderFor(loc)).testLocation({ config: loc.config });
+					const p = await service.getProviderFor(loc);
+					const live = await this.withResolvedSecrets(loc);
+					return p.testLocation({ config: live.config });
 				} catch (err) {
 					return {
 						ok: false,
@@ -3526,7 +3529,7 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 				};
 			},
 			resolve: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				this.refuseRemoteResolve(loc);
 				return (await service.getProviderFor(loc)).resolve({
 					location: loc,
@@ -3534,7 +3537,7 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 				});
 			},
 			write: async ({ location, relativePath, data }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).write({
 					location: loc,
 					relativePath,
@@ -3542,21 +3545,21 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 				});
 			},
 			read: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).read({
 					location: loc,
 					relativePath
 				});
 			},
 			exists: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).exists({
 					location: loc,
 					relativePath
 				});
 			},
 			list: async ({ location, prefix }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				const p = await service.getProviderFor(loc);
 				return prefix !== void 0 ? p.list({
 					location: loc,
@@ -3564,18 +3567,18 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 				}) : p.list({ location: loc });
 			},
 			delete: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).delete({
 					location: loc,
 					relativePath
 				});
 			},
 			getAvailableSpace: async ({ location }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				return (await service.getProviderFor(loc)).getAvailableSpace({ location: loc });
 			},
 			beginUpload: async ({ location, relativePath, sizeBytes }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				const p = await service.getProviderFor(loc);
 				const result = sizeBytes !== void 0 ? await p.beginUpload({
 					location: loc,
@@ -3608,7 +3611,7 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 				}
 			},
 			beginDownload: async ({ location, relativePath }) => {
-				const loc = service.resolveRef(location);
+				const loc = await this.withResolvedSecrets(service.resolveRef(location));
 				const result = await (await service.getProviderFor(loc)).beginDownload({
 					location: loc,
 					relativePath
@@ -4070,6 +4073,63 @@ var StorageOrchestratorAddon = class extends BaseAddon {
 		}
 	}
 	/** A location with its provider's declared secrets replaced by the sentinel. */
+	/**
+	* The location as a PROVIDER must see it: every keychain marker in its
+	* config resolved (D787). The same object when it holds none — a filesystem
+	* location costs nothing. An unresolvable secret is left out and logged by
+	* ref; the provider then fails its own connection, by name.
+	*/
+	async withResolvedSecrets(location) {
+		const secrets = this.ctx.secrets;
+		if (secrets === void 0) return location;
+		const { value, unresolved } = await resolveSecretMarkers(location.config, secrets);
+		if (unresolved.length > 0) this.ctx.logger.error("storage location secret unavailable", { meta: {
+			locationId: location.id,
+			secrets: unresolved.map((u) => ({
+				ref: u.ref,
+				reason: u.reason
+			}))
+		} });
+		return value === location.config ? location : {
+			...location,
+			config: value
+		};
+	}
+	/**
+	* Strip the provider's DECLARED secrets (its form schema, by type) out of a
+	* location config into the keychain, under `row/storage_locations/<id>`.
+	* A provider that has not registered declares nothing: only keys that
+	* already hold a marker are handled then — a new plaintext is never guessed
+	* at, it stays as sent until the provider is back and the location is saved.
+	*/
+	async keepSecretsInKeychain(locationId, providerId, config, stored) {
+		const secrets = this.ctx.secrets;
+		if (secrets === void 0) return config;
+		const declared = this.declaredSecretKeys(providerId) ?? /* @__PURE__ */ new Set();
+		const markerKeys = Object.entries(stored).filter(([, v]) => isSecretMarker(v)).map(([k]) => k);
+		const tree = secretTreeFromPaths([...new Set([...declared, ...markerKeys])]);
+		if (tree.size === 0) return config;
+		const result = await transformSecretWrite({
+			tree,
+			secrets,
+			patch: { ...config },
+			stored: { ...stored },
+			scope: {
+				kind: "row",
+				collection: STORAGE_LOCATIONS,
+				rowId: locationId
+			}
+		});
+		const merged = { ...result.patch };
+		for (const key of tree.keys()) if (!(key in merged) && key in stored) merged[key] = stored[key];
+		result.afterWrite().then(({ orphaned }) => {
+			if (orphaned.length > 0) this.ctx.logger.warn("storage location: dropped keychain refs could not be deleted", { meta: {
+				locationId,
+				refs: [...orphaned]
+			} });
+		});
+		return merged;
+	}
 	redacted(location) {
 		return redactLocation(location, this.secretKeysFor(location.providerId, location.config));
 	}

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BcUWQGr9.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { Cr as hydrateSchema, cr as BaseAddon, sr as errMsg } from "../../dist-D732NygW.mjs";
+import { Dr as hydrateSchema, cr as errMsg, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BcUWQGr9.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, cr as BaseAddon } from "../../dist-D732NygW.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";