jcoffey-dev
8bd5b3f697
A stored secret reads back as "****", and a registry write that sent it back stored "****" as the secret: a webhook's password or signing key, a store's or directory's password, a DNS provider's key, an OAuth client's secret. Written straight at a secret it now keeps the stored one; anywhere else, inside a whole object, a create or a variant switch, the write is refused with invalidProperties, since there's no stored secret it could stand for. Accounts keep their own credential checks, which already did this.