Update: round-trip withOverrides config and redact secrets in diffs

[taylortom]

Update

Config migrations previously imported each conf/*.config.js default export and rewrote it as flat JSON.stringify(...). For an instance using the withOverrides({...}) baseline pattern that export is the fully merged object, so the rewrite inlined every inherited default and dropped the wrapper (and would break the baseline defaults.config.js itself). In read-only/dry-run modes the diff also printed raw secret values.

This makes the engine round-trip both config styles and stop leaking secrets:

• withOverrides round-trip — each file is classified via non-enumerable Symbol.for('adapt-authoring:configOverrides'/'…configDefaults') markers a withOverrides helper attaches. Overrides files transform the authored overrides only and re-emit export default withOverrides({...}); the baseline is skipped (hand-maintained per release); plain object exports keep their existing behaviour.
• Secret redaction — logConfigDiff masks sensitive leaf keys (secret/password/token/apiKey/connectionUri/…) as [redacted], recursively into nested values, with an additive redactKeys config option.
• Read-only auto-detection — a non-writable conf dir (pre-flight W_OK check, plus a defensive catch of EACCES/EROFS/EPERM on write) degrades to the report-only path automatically. readOnlyConfig remains as an override for writable-but-hands-off (version-controlled) conf.

Fix

• Preserve key: undefined entries (used to unset an inherited default) by emitting valid JS instead of JSON, which dropped them.
• Compose multiple config migrations on the same file within one boot via a per-run working-copy cache (previously a second migration overwrote the first).
• mutate(fn) receives a second context.merged arg (read baseline values on overrides installs); a null-unsafe mutate is now a per-file warning rather than a boot failure.

Docs

• New "withOverrides round-trip", secret-redaction, and auto-detection sections in docs/migrations.md.
• Corrected the "Restart required" description — no such error is thrown; config file changes take effect on the next restart.

Testing

• 119 unit/integration tests pass (node --test), standard clean.
• Verified end-to-end against real config: withOverrides write round-trip (wrapper kept, defaults not inlined, baseline untouched), full runMigrations() against an isolated DB, secret redaction, and a real read-only (chmod 0555) conf dir degrading to report-only.

[github-actions]

🎉 This PR is included in version 2.1.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀