@camstack/system 1.2.376 → 1.2.377

package/dist/builtins/keychain/key-sources.d.ts

@@ -0,0 +1,37 @@
+import { KeychainKeySource } from '@camstack/types';
+/** The `keychain` section of `config.yaml`. */
+export interface KeychainKeyConfig {
+    readonly keyFile?: string | undefined;
+    readonly previousKeyFile?: string | undefined;
+}
+export type KeyLoadResult = {
+    readonly kind: 'loaded';
+    readonly key: Buffer;
+} | {
+    readonly kind: 'absent';
+} | {
+    readonly kind: 'unreadable';
+    readonly error: string;
+};
+export interface KeySourceCandidate {
+    readonly source: KeychainKeySource;
+    readonly primary: boolean;
+    load(): Promise<KeyLoadResult>;
+}
+/** The default key file's location under the data root. */
+export declare function defaultKeyFilePath(dataDir: string): string;
+export interface KeySourceOptions {
+    readonly config: KeychainKeyConfig;
+    readonly dataDir: string;
+}
+/** Every candidate, primary first. */
+export declare function buildKeySourceCandidates(opts: KeySourceOptions): readonly KeySourceCandidate[];
+/**
+ * Write a master key to the default location: directory 0700, file 0600,
+ * atomically (temp + rename), never over an existing file unless `replace`.
+ * Returns the previous file's new name when one was moved aside.
+ */
+export declare function writeDefaultKeyFile(dataDir: string, key: Buffer, opts: {
+    readonly replace: boolean;
+    readonly nowMs: number;
+}): Promise<string | null>;

package/dist/builtins/keychain/keychain-crypto.d.ts

@@ -0,0 +1,28 @@
+export declare const KEY_BYTES = 32;
+/** 32 fresh random bytes — a master or a data key. */
+export declare function generateKey(): Buffer;
+/** A short random id for a data key (no dots — it is a segment of `ck1`). */
+export declare function generateKeyId(): string;
+/** The full fingerprint of a master key. */
+export declare function kekFingerprint(kek: Buffer): string;
+/** What the operator sees: the first 16 hex chars. */
+export declare function shortFingerprint(fingerprint: string): string;
+/** Constant-time string equality (lengths may differ). */
+export declare function constantTimeEquals(a: string, b: string): boolean;
+/**
+ * Key material from a key file: base64 (the format we write) or hex of
+ * exactly 32 bytes, surrounding whitespace ignored. Anything else is `null` —
+ * a file holding a password or a PEM is refused, never stretched into a key.
+ */
+export declare function decodeKeyMaterial(text: string): Buffer | null;
+export declare function encodeKeyMaterial(key: Buffer): string;
+/** Wrap a data key under a master key. */
+export declare function wrapDek(kek: Buffer, dek: Buffer, keyId: string): string;
+/** Unwrap; `null` when the master key is not the one that wrapped it. */
+export declare function unwrapDek(kek: Buffer, wrapped: string, keyId: string): Buffer | null;
+/** Encrypt one value for one ref. */
+export declare function encryptValue(dek: Buffer, keyId: string, ref: string, value: string): string;
+/** The data-key id an envelope was written under, or `null` if it is not one. */
+export declare function envelopeKeyId(envelope: string): string | null;
+/** Decrypt; `null` on any failure — wrong key, wrong ref, tampered bytes. */
+export declare function decryptValue(dek: Buffer, ref: string, envelope: string): string | null;

package/dist/builtins/keychain/keychain-service.d.ts

@@ -0,0 +1,103 @@
+import { EventCategory, KeychainAuditEntry, KeychainKeySource, KeychainResolveResult, KeychainSecretMeta, KeychainSecretUsage, KeychainState, KeychainStatus, KeychainUnavailableReason } from '@camstack/types';
+import { KeychainRepository, KeychainSecretRow } from './keychain-store.js';
+import { KeySourceCandidate } from './key-sources.js';
+/** `lastReadAt` is written at most this often per ref (hub I/O is the bottleneck). */
+export declare const LAST_READ_GRANULARITY_MS: number;
+export declare class KeychainLockedError extends Error {
+    readonly reason: KeychainUnavailableReason;
+    constructor(reason: KeychainUnavailableReason);
+}
+export declare class KeychainForbiddenError extends Error {
+    readonly ref: string;
+    constructor(ref: string, caller: string | null);
+}
+export interface KeychainEventSink {
+    emit(payload: {
+        readonly ref: string;
+        readonly owner: string;
+        readonly version: number | null;
+        readonly change: 'put' | 'delete';
+    }): void;
+}
+export interface KeychainLogger {
+    info(message: string, meta?: Record<string, unknown>): void;
+    warn(message: string, meta?: Record<string, unknown>): void;
+    error(message: string, meta?: Record<string, unknown>): void;
+}
+/** Answers whether a stored ref is still pointed at by its owner's settings. */
+export type KeychainUsageCheck = (rows: readonly KeychainSecretRow[]) => Promise<ReadonlyMap<string, KeychainSecretUsage>>;
+export interface KeychainServiceDeps {
+    readonly repo: KeychainRepository;
+    /** Rebuilt on every unlock / rotation — the configuration may have changed. */
+    readonly candidates: () => Promise<readonly KeySourceCandidate[]>;
+    readonly dataDir: string;
+    readonly events: KeychainEventSink;
+    readonly logger: KeychainLogger;
+    /** The runner id hosting an addon (its group, or itself). */
+    readonly runnerIdOf: (addonId: string) => string;
+    readonly usage: KeychainUsageCheck;
+    readonly now?: () => number;
+}
+export declare class KeychainService {
+    private readonly deps;
+    private unlock;
+    private configuredSource;
+    private readonly now;
+    constructor(deps: KeychainServiceDeps);
+    /** Load the keys and unlock. Never throws for a key problem — it locks. */
+    init(): Promise<KeychainState>;
+    private computeUnlock;
+    /** No wrapped data key yet: create one — only when nothing could be lost. */
+    private firstBoot;
+    getState(): KeychainState;
+    private requireReady;
+    /** May `caller` touch values owned by `owner`? */
+    owns(caller: string | null, owner: string): boolean;
+    private ownerOf;
+    put(caller: string | null, ref: string, value: string): Promise<{
+        ref: string;
+        version: number;
+    }>;
+    resolve(caller: string | null, refs: readonly string[]): Promise<KeychainResolveResult>;
+    private touchLastRead;
+    delete(caller: string | null, refs: readonly string[]): Promise<number>;
+    listMeta(caller: string | null): Promise<readonly KeychainSecretMeta[]>;
+    status(): Promise<KeychainStatus>;
+    listSecrets(): Promise<readonly (KeychainSecretMeta & {
+        usage: KeychainSecretUsage;
+    })[]>;
+    listAudit(limit: number): Promise<readonly KeychainAuditEntry[]>;
+    reveal(userId: string, ref: string): Promise<{
+        value: string;
+        version: number;
+    }>;
+    deleteOrphans(userId: string, refs: readonly string[]): Promise<{
+        deleted: readonly string[];
+        kept: readonly {
+            ref: string;
+            usage: KeychainSecretUsage;
+        }[];
+    }>;
+    downloadRecoveryKey(userId: string): Promise<{
+        key: string;
+        fingerprint: string;
+        keySource: KeychainKeySource;
+    }>;
+    /** See `keychain-admin.rotateMasterKey`. */
+    rotateMasterKey(userId: string): Promise<{
+        fingerprint: string;
+        keySource: KeychainKeySource;
+    }>;
+    /** Delete retired wraps, and the default file's previous copies with them. */
+    purgeRetiredKeys(userId: string): Promise<number>;
+    /** Lost-key recovery — see `keychain-admin.resetKeychain`. */
+    resetKeychain(userId: string): Promise<{
+        archivedCollection: string | null;
+        archived: number;
+    }>;
+    private audit;
+    /** Daily ring prune, driven by the addon's timer. */
+    pruneAudit(): Promise<void>;
+}
+/** The event the provider emits — exported for the addon's bus adapter. */
+export declare const KEYCHAIN_CHANGED = EventCategory.KeychainChanged;

package/dist/builtins/keychain/keychain-store.d.ts

@@ -0,0 +1,82 @@
+import { ISettingsStoreProvider, KeychainAuditAction } from '@camstack/types';
+/**
+ * @durable class=config owner=keychain
+ *   write="`keychain.put` upserts one row per ref; `delete` removes it"
+ *   retention="none — a row lives until its owner deletes the ref or the
+ *     operator deletes it as an orphan. Losing the table loses every secret
+ *     value; the settings blobs then point at refs that resolve `missing`."
+ */
+export declare const KEYCHAIN_SECRETS_COLLECTION = "keychain:secrets";
+/**
+ * @durable class=config owner=keychain
+ *   write="first boot writes the wrapped data key; `rotateMasterKey` adds a
+ *     wrap and retires the previous one"
+ *   retention="retired wraps until `purgeRetiredKeys`. Losing the table with
+ *     the secrets intact makes every value undecryptable."
+ */
+export declare const KEYCHAIN_KEYS_COLLECTION = "keychain:keys";
+/**
+ * @durable class=ring owner=keychain
+ *   write="one row per write / delete / rotation / reveal / recovery download"
+ *   retention="90 days and at most 20 000 rows, pruned at boot and daily"
+ */
+export declare const KEYCHAIN_AUDIT_COLLECTION = "keychain:audit";
+export declare const AUDIT_RETENTION_MS: number;
+export declare const AUDIT_MAX_ROWS = 20000;
+export interface KeychainSecretRow {
+    readonly ref: string;
+    readonly owner: string;
+    readonly scope: string;
+    readonly fieldPath: string;
+    readonly ciphertext: string;
+    readonly keyId: string;
+    readonly version: number;
+    readonly createdAt: number;
+    readonly updatedAt: number;
+    readonly updatedBy: string;
+    readonly lastReadAt: number | null;
+}
+export type KeyWrapState = 'active' | 'retired';
+export interface KeychainKeyRow {
+    readonly wrapId: string;
+    readonly keyId: string;
+    readonly wrappedDek: string;
+    readonly kekFingerprint: string;
+    readonly kekSource: string;
+    readonly createdAt: number;
+    readonly state: KeyWrapState;
+    readonly recoveryDownloadedAt: number | null;
+}
+export interface KeychainAuditRow {
+    readonly id: string;
+    readonly at: number;
+    readonly action: KeychainAuditAction;
+    readonly actor: string;
+    readonly ref: string | null;
+    readonly detail: string | null;
+}
+/** The subset of the settings door the repository uses. */
+export type KeychainDoor = Pick<ISettingsStoreProvider, 'declareCollection' | 'get' | 'set' | 'query' | 'delete' | 'deleteWhere'>;
+export declare class KeychainRepository {
+    private readonly door;
+    constructor(door: KeychainDoor);
+    init(): Promise<void>;
+    getSecrets(refs: readonly string[]): Promise<ReadonlyMap<string, KeychainSecretRow>>;
+    /** Every row, paged by primary key. */
+    listSecrets(): Promise<readonly KeychainSecretRow[]>;
+    putSecret(row: KeychainSecretRow): Promise<void>;
+    deleteSecrets(refs: readonly string[]): Promise<number>;
+    listKeys(): Promise<readonly KeychainKeyRow[]>;
+    putKey(row: KeychainKeyRow): Promise<void>;
+    deleteKey(wrapId: string): Promise<void>;
+    appendAudit(row: KeychainAuditRow): Promise<void>;
+    listAudit(limit: number): Promise<readonly KeychainAuditRow[]>;
+    /** Drop audit rows older than the retention window, then beyond the row bound. */
+    pruneAudit(nowMs: number): Promise<number>;
+    /**
+     * Lost-key recovery: copy every secret row into `archive`, then empty the
+     * live table. The archive is ciphertext under a key nobody has — it exists
+     * so a key that turns up later can still recover it.
+     */
+    archiveAllSecrets(archive: string): Promise<number>;
+}

package/dist/builtins/keychain/keychain-usage.d.ts

@@ -0,0 +1,6 @@
+import { KeychainSecretUsage } from '@camstack/types';
+import { KeychainDoor, KeychainSecretRow } from './keychain-store.js';
+/** Every `$secret` ref inside a value, at any depth. */
+export declare function collectMarkerRefs(value: unknown, out?: Set<string>): Set<string>;
+/** Build the usage check the service uses. */
+export declare function createKeychainUsageCheck(door: KeychainDoor): (rows: readonly KeychainSecretRow[]) => Promise<ReadonlyMap<string, KeychainSecretUsage>>;

package/dist/builtins/keychain/keychain.addon.d.ts

@@ -0,0 +1,11 @@
+import { BaseAddon, ProviderRegistration } from '@camstack/types';
+/** The caller the transport stamped (or an in-process caller stated). */
+export declare function callerOf(input: unknown): string | null;
+export declare class KeychainAddon extends BaseAddon {
+    readonly id = "keychain";
+    private pruneTimer;
+    constructor();
+    protected onInitialize(): Promise<ProviderRegistration[]>;
+    protected onShutdown(): Promise<void>;
+}
+export default KeychainAddon;

package/dist/builtins/keychain/platform-key-source.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The OS-keychain master key of a DESKTOP hub.
+ *
+ * Electron's `safeStorage` exists only in the Electron main process, and the
+ * hub runs as a plain Node child of it. So the desktop app reads (or creates)
+ * the master key through `safeStorage`, and hands the raw bytes to the hub
+ * over an inherited pipe (`--keychain-key-fd=<n>`) — never an env var, never a
+ * file at rest in the clear. The hub's boot reads the descriptor once and
+ * registers the key here; the keychain builtin, in the same process, asks.
+ *
+ * Process-global through a registered symbol, so a second copy of this module
+ * (an addon bundle) sees the same key rather than none.
+ */
+export interface PlatformKeychainKey {
+    /** Where it came from, for the status page (`macOS Keychain`, `Windows DPAPI`, …). */
+    readonly label: string;
+    readonly key: Buffer;
+}
+/** Register the platform key. Called once, by the hub's boot. */
+export declare function setPlatformKeychainKey(entry: PlatformKeychainKey): void;
+/** Drop the platform key (tests). */
+export declare function clearPlatformKeychainKey(): void;
+/** The platform key, when this hub was started by the desktop app with one. */
+export declare function getPlatformKeychainKey(): PlatformKeychainKey | null;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BcUWQGr9.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { I as RecordingStatusSchema, N as RECORDING_SOURCE_CAMSTACK_ADDON, Pr as EventCategory, cr as BaseAddon, sr as errMsg, yr as createEvent } from "../../dist-D732NygW.mjs";
+import { F as RecordingStatusSchema, Gr as EventCategory, N as RECORDING_SOURCE_CAMSTACK_ADDON, Sr as createEvent, cr as errMsg, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BcUWQGr9.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -9677,6 +9677,21 @@ var bootstrapAddonsSchema = zod.z.object({
 	*/
 	forceDisable: zod.z.array(zod.z.string()).default([])
 });
+/**
+* Where the keychain's master key lives (D788). config.yaml ONLY: no env var
+* maps here, and the settings store may not answer it
+* (`BOOTSTRAP_OWNED_SECTIONS`). Absent → the desktop OS keychain when the hub
+* runs inside the desktop app, else `<dataDir>/.keychain/master.key`.
+*/
+var keychainSchema = zod.z.object({
+	/** A file holding 32 random bytes, base64 (or hex). Keep it OFF the data volume. */
+	keyFile: zod.z.string().min(1).optional(),
+	/**
+	* The key being rotated away from — consulted only to UNLOCK, so a move to a
+	* new key file is: new file, old one here, restart, rotate, remove this.
+	*/
+	previousKeyFile: zod.z.string().min(1).optional()
+});
 /** Bootstrap config -- loaded from config.yaml ONLY at startup.
 *  All other settings live in SQL (system_settings table). */
 var bootstrapSchema = zod.z.object({
@@ -9695,7 +9710,9 @@ var bootstrapSchema = zod.z.object({
 	* kernel can reach the settings-store. See bootstrapAddonsSchema.
 	* Spec: docs/superpowers/specs/2026-05-15-yaml-bootstrap-expansion.md
 	*/
-	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({}))
+	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({})),
+	/** Keychain master-key location (config.yaml only). */
+	keychain: keychainSchema.default({})
 });
 //#endregion
 //#region src/builtins/local-auth/admin-account-boot.ts

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { W as UserRecordSchema, Y as authProviderCapability, cr as BaseAddon, r as ApiKeyRecordSchema, z as ScopedTokenSchema, zn as userManagementCapability } from "../../dist-D732NygW.mjs";
+import { Bn as userManagementCapability, J as authProviderCapability, R as ScopedTokenSchema, U as UserRecordSchema, lr as BaseAddon, r as ApiKeyRecordSchema } from "../../dist-BWNoS-1S.mjs";
 import { z } from "zod";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
@@ -9667,6 +9667,21 @@ var bootstrapAddonsSchema = z.object({
 	*/
 	forceDisable: z.array(z.string()).default([])
 });
+/**
+* Where the keychain's master key lives (D788). config.yaml ONLY: no env var
+* maps here, and the settings store may not answer it
+* (`BOOTSTRAP_OWNED_SECTIONS`). Absent → the desktop OS keychain when the hub
+* runs inside the desktop app, else `<dataDir>/.keychain/master.key`.
+*/
+var keychainSchema = z.object({
+	/** A file holding 32 random bytes, base64 (or hex). Keep it OFF the data volume. */
+	keyFile: z.string().min(1).optional(),
+	/**
+	* The key being rotated away from — consulted only to UNLOCK, so a move to a
+	* new key file is: new file, old one here, restart, rotate, remove this.
+	*/
+	previousKeyFile: z.string().min(1).optional()
+});
 /** Bootstrap config -- loaded from config.yaml ONLY at startup.
 *  All other settings live in SQL (system_settings table). */
 var bootstrapSchema = z.object({
@@ -9685,7 +9700,9 @@ var bootstrapSchema = z.object({
 	* kernel can reach the settings-store. See bootstrapAddonsSchema.
 	* Spec: docs/superpowers/specs/2026-05-15-yaml-bootstrap-expansion.md
 	*/
-	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({}))
+	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({})),
+	/** Keychain master-key location (config.yaml only). */
+	keychain: keychainSchema.default({})
 });
 //#endregion
 //#region src/builtins/local-auth/admin-account-boot.ts

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BcUWQGr9.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 const require_tls = require("../../tls-CCMX7MjX.js");
 let zod = require("zod");
 let node_os = require("node:os");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { Pr as EventCategory, Rt as isAppLinkBase, Sn as resolveHubAddressRoles, Tn as resolveNotificationTapAddress, Vn as validateCustomAddress, Vt as isDefaultAppConnectionEndpoint, Yt as localNetworkCapability, cr as BaseAddon, dn as pickAppLinkHub, rt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, vn as resolveAppConnections } from "../../dist-D732NygW.mjs";
+import { Cn as resolveHubAddressRoles, En as resolveNotificationTapAddress, Gr as EventCategory, Hn as validateCustomAddress, It as isAppLinkBase, Yt as localNetworkCapability, fn as pickAppLinkHub, lr as BaseAddon, nt as checkRoleAddress, s as CAMSTACK_APP_LINK_ORIGIN, yn as resolveAppConnections, zt as isDefaultAppConnectionEndpoint } from "../../dist-BWNoS-1S.mjs";
 import { P as readLanHttpState, _ as writeExtraSans, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, m as readTlsAccessStatus, n as regenerateCertificate, p as readExtraSans, r as revertToGeneratedCertificate, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, y as ensureTlsCert } from "../../tls-CJHogwTl.mjs";
 import { z } from "zod";
 import * as os from "node:os";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BcUWQGr9.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, cr as BaseAddon } from "../../dist-D732NygW.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BcUWQGr9.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 const require_proc_stat = require("../../proc-stat-DL-WUOhl.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Pr as EventCategory, Pt as foldSnapshotByFunction, cr as BaseAddon, gn as reducePoints, rn as metricsProviderCapability, sr as errMsg, yn as resolveBucketMs, yr as createEvent } from "../../dist-D732NygW.mjs";
+import { Gr as EventCategory, Mt as foldSnapshotByFunction, Sr as createEvent, _n as reducePoints, bn as resolveBucketMs, cr as errMsg, in as metricsProviderCapability, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 import { a as parseProcStat, i as nodeProcReader, n as elapsedSecSince, o as parseProcStatusRss, r as lifetimeCpuPercent, t as commandFromCmdline } from "../../proc-stat-CbC55Kqi.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os from "node:os";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BcUWQGr9.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Pr as EventCategory, Tt as enumerateInferenceDevices, cr as BaseAddon, kn as scoreRuntimes, pn as platformProbeCapability, sr as errMsg, xr as emitReadiness } from "../../dist-D732NygW.mjs";
+import { An as scoreRuntimes, Ct as enumerateInferenceDevices, Gr as EventCategory, cr as errMsg, lr as BaseAddon, mn as platformProbeCapability, wr as emitReadiness } from "../../dist-BWNoS-1S.mjs";
 import * as os from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BcUWQGr9.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Pr as EventCategory, cr as BaseAddon } from "../../dist-D732NygW.mjs";
+import { Gr as EventCategory, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BcUWQGr9.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Er as nodePin, Mn as snapshotCapability, Pr as EventCategory, Q as batteryCapability, Rn as streamQualityLabel, Z as bareAddonId, a as BatteryStatusSchema, cr as BaseAddon, ir as DeviceFeature, nn as memoizePinnedFfmpeg, or as DeviceType, sr as errMsg, yt as deriveBatteryPresence } from "../../dist-D732NygW.mjs";
+import { Gr as EventCategory, Nn as snapshotCapability, X as bareAddonId, Z as batteryCapability, _t as deriveBatteryPresence, a as BatteryStatusSchema, ar as DeviceFeature, cr as errMsg, jr as nodePin, lr as BaseAddon, rn as memoizePinnedFfmpeg, sr as DeviceType, zn as streamQualityLabel } from "../../dist-BWNoS-1S.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BcUWQGr9.js");
+const require_dist = require("../../dist-D_a9mUiM.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { In as storageProviderCapability, Nt as filesystemBrowseCapability, cr as BaseAddon } from "../../dist-D732NygW.mjs";
+import { Ln as storageProviderCapability, jt as filesystemBrowseCapability, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/storage-orchestrator/location-store.d.ts

@@ -22,6 +22,12 @@ export interface ILocationStore {
     /** Remove a location by id. */
     delete(id: string): Promise<void>;
 }
+/**
+ * @durable class=config owner=storage-orchestrator
+ *   write="an operator creates or edits a location (basePath, minFreePercent, enabled, node pin); plus the boot reconcile — declared defaults seeded on a fresh install, and in-memory-only locations backfilled when the store is late-wired"
+ *   retention="none — a row goes only when the operator deletes the location, or when the declaration pass prunes one whose declaring addon is gone. Bounded by the storage targets a human configures."
+ */
+export declare const STORAGE_LOCATIONS = "storage_locations";
 /**
  * `ILocationStore` on the `settings-store` collection surface — the same door
  * every other consumer uses. It holds the `data-store-provider` engine object

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.d.ts

@@ -167,6 +167,21 @@ export declare class StorageOrchestratorAddon extends BaseAddon<StorageOrchestra
      */
     private announceLocationsChanged;
     /** A location with its provider's declared secrets replaced by the sentinel. */
+    /**
+     * The location as a PROVIDER must see it: every keychain marker in its
+     * config resolved (D787). The same object when it holds none — a filesystem
+     * location costs nothing. An unresolvable secret is left out and logged by
+     * ref; the provider then fails its own connection, by name.
+     */
+    private withResolvedSecrets;
+    /**
+     * Strip the provider's DECLARED secrets (its form schema, by type) out of a
+     * location config into the keychain, under `row/storage_locations/<id>`.
+     * A provider that has not registered declares nothing: only keys that
+     * already hold a marker are handled then — a new plaintext is never guessed
+     * at, it stays as sent until the provider is back and the location is saved.
+     */
+    private keepSecretsInKeychain;
     private redacted;
     /**
      * Is this location backed by a provider that serves a genuine local