@camstack/system 1.2.376 → 1.2.378

package/dist/{event-loop-stall-monitor-QX4RjNe7.js → event-loop-stall-monitor-CbSmCWkp.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BcUWQGr9.js");
+const require_dist = require("./dist-KxsOMQik.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
@@ -193,12 +193,13 @@ function collectModelFiles(entry, format) {
 	for (const extra of entry.extraFiles ?? []) names.push(extra.filename);
 	return names;
 }
-/** Build fetch headers, including HF auth token for huggingface.co URLs */
-function buildHeaders(url) {
-	const headers = { "User-Agent": "CamStack/1.0" };
-	const hfToken = process.env["HF_TOKEN"] ?? process.env["HUGGING_FACE_HUB_TOKEN"];
-	if (hfToken && url.includes("huggingface.co")) headers["Authorization"] = `Bearer ${hfToken}`;
-	return headers;
+/**
+* Fetch headers for a model download. No credential: the CamStack model repos
+* are public, and no secret is ever read from the environment (operator rule —
+* a token, if a gated source ever needs one, is a keychain-backed setting).
+*/
+function buildHeaders(_url) {
+	return { "User-Agent": "CamStack/1.0" };
 }
 /**
 * A download that the server ANSWERED with a non-2xx status. Typed so a caller

package/dist/{event-loop-stall-monitor-8W4yWNVW.mjs → event-loop-stall-monitor-D8rqSWfW.mjs}

@@ -1,4 +1,4 @@
-import { Lt as hfModelUrl, T as HF_REPO, j as MODEL_FORMATS } from "./dist-D732NygW.mjs";
+import { Ft as hfModelUrl, T as HF_REPO, j as MODEL_FORMATS } from "./dist-Bvl5JgNt.mjs";
 import { createHash } from "node:crypto";
 import * as path$1 from "node:path";
 import path from "node:path";
@@ -192,12 +192,13 @@ function collectModelFiles(entry, format) {
 	for (const extra of entry.extraFiles ?? []) names.push(extra.filename);
 	return names;
 }
-/** Build fetch headers, including HF auth token for huggingface.co URLs */
-function buildHeaders(url) {
-	const headers = { "User-Agent": "CamStack/1.0" };
-	const hfToken = process.env["HF_TOKEN"] ?? process.env["HUGGING_FACE_HUB_TOKEN"];
-	if (hfToken && url.includes("huggingface.co")) headers["Authorization"] = `Bearer ${hfToken}`;
-	return headers;
+/**
+* Fetch headers for a model download. No credential: the CamStack model repos
+* are public, and no secret is ever read from the environment (operator rule —
+* a token, if a gated source ever needs one, is a keychain-backed setting).
+*/
+function buildHeaders(_url) {
+	return { "User-Agent": "CamStack/1.0" };
 }
 /**
 * A download that the server ANSWERED with a non-2xx status. Typed so a caller

package/dist/{hub-cap-forward-BdT320dq.mjs → hub-cap-forward-CH6_VWVO.mjs}

@@ -15,13 +15,15 @@ function narrowParams(raw) {
 	const deviceId = Reflect.get(raw, "deviceId");
 	const nodeId = Reflect.get(raw, "nodeId");
 	const native = Reflect.get(raw, "native");
+	const callerAddonId = Reflect.get(raw, "callerAddonId");
 	return {
 		capName,
 		method,
 		args: Reflect.get(raw, "args"),
 		deviceId: typeof deviceId === "number" ? deviceId : void 0,
 		nodeId: typeof nodeId === "string" && nodeId.length > 0 ? nodeId : void 0,
-		native: native === true ? true : void 0
+		native: native === true ? true : void 0,
+		callerAddonId: typeof callerAddonId === "string" && callerAddonId.length > 0 ? callerAddonId : void 0
 	};
 }
 /**
@@ -33,18 +35,25 @@ function narrowParams(raw) {
 *                       `createParentUnownedCallHandler`). Reused verbatim so
 *                       forwarded calls route exactly like a hub-local child's.
 */
-function createHubCapForwardService(onUnownedCall) {
+function createHubCapForwardService(onUnownedCall, options = {}) {
 	return {
 		name: HUB_CAP_FWD_SERVICE,
 		actions: { forward: { handler: async (ctx) => {
-			const { capName, method, args, deviceId, nodeId, native } = narrowParams(ctx.params);
+			const { capName, method, args, deviceId, nodeId, native, callerAddonId } = narrowParams(ctx.params);
+			const sender = typeof ctx.nodeID === "string" ? ctx.nodeID : null;
+			let caller = callerAddonId;
+			if (caller !== void 0 && options.isCallerOnNode !== void 0 && (sender === null || !options.isCallerOnNode(sender, caller))) {
+				options.onRejectedCaller?.(sender ?? "(unknown node)", caller);
+				caller = void 0;
+			}
 			return onUnownedCall({
 				capName,
 				method,
 				args,
 				...deviceId !== void 0 ? { deviceId } : {},
 				...nodeId !== void 0 ? { nodeId } : {},
-				...native === true ? { native: true } : {}
+				...native === true ? { native: true } : {},
+				...caller !== void 0 ? { callerAddonId: caller } : {}
 			});
 		} } }
 	};

package/dist/{hub-cap-forward-DmHNjbB0.js → hub-cap-forward-COCmYaup.js}

@@ -15,13 +15,15 @@ function narrowParams(raw) {
 	const deviceId = Reflect.get(raw, "deviceId");
 	const nodeId = Reflect.get(raw, "nodeId");
 	const native = Reflect.get(raw, "native");
+	const callerAddonId = Reflect.get(raw, "callerAddonId");
 	return {
 		capName,
 		method,
 		args: Reflect.get(raw, "args"),
 		deviceId: typeof deviceId === "number" ? deviceId : void 0,
 		nodeId: typeof nodeId === "string" && nodeId.length > 0 ? nodeId : void 0,
-		native: native === true ? true : void 0
+		native: native === true ? true : void 0,
+		callerAddonId: typeof callerAddonId === "string" && callerAddonId.length > 0 ? callerAddonId : void 0
 	};
 }
 /**
@@ -33,18 +35,25 @@ function narrowParams(raw) {
 *                       `createParentUnownedCallHandler`). Reused verbatim so
 *                       forwarded calls route exactly like a hub-local child's.
 */
-function createHubCapForwardService(onUnownedCall) {
+function createHubCapForwardService(onUnownedCall, options = {}) {
 	return {
 		name: HUB_CAP_FWD_SERVICE,
 		actions: { forward: { handler: async (ctx) => {
-			const { capName, method, args, deviceId, nodeId, native } = narrowParams(ctx.params);
+			const { capName, method, args, deviceId, nodeId, native, callerAddonId } = narrowParams(ctx.params);
+			const sender = typeof ctx.nodeID === "string" ? ctx.nodeID : null;
+			let caller = callerAddonId;
+			if (caller !== void 0 && options.isCallerOnNode !== void 0 && (sender === null || !options.isCallerOnNode(sender, caller))) {
+				options.onRejectedCaller?.(sender ?? "(unknown node)", caller);
+				caller = void 0;
+			}
 			return onUnownedCall({
 				capName,
 				method,
 				args,
 				...deviceId !== void 0 ? { deviceId } : {},
 				...nodeId !== void 0 ? { nodeId } : {},
-				...native === true ? { native: true } : {}
+				...native === true ? { native: true } : {},
+				...caller !== void 0 ? { callerAddonId: caller } : {}
 			});
 		} } }
 	};

package/dist/index.d.ts

@@ -80,6 +80,8 @@ export { LifecycleStateMachine } from './lifecycle/lifecycle-state-machine.js';
 export { formatLogLine } from './logging/formatter.js';
 export type { ILogDestination } from './logging/log-manager.js';
 export { LogManager } from './logging/log-manager.js';
+export { isCredentialKeyName, redactLogEntry, redactLogMeta, redactLogText, } from './logging/log-redactor.js';
+export { clearPlatformKeychainKey, getPlatformKeychainKey, type PlatformKeychainKey, setPlatformKeychainKey, } from './builtins/keychain/platform-key-source.js';
 export type { LogEntry, LogFilter, LogLevel } from './logging/log-ring-buffer.js';
 export { LogRingBuffer } from './logging/log-ring-buffer.js';
 export type { LevelBearing } from './logging/logging-gate.js';

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BcUWQGr9.js");
+const require_dist = require("./dist-KxsOMQik.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -23,15 +23,16 @@ const require_builtins_native_metrics_native_metrics_addon = require("./builtins
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
-const require_hub_cap_forward = require("./hub-cap-forward-DmHNjbB0.js");
+const require_hub_cap_forward = require("./hub-cap-forward-COCmYaup.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
-const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-QX4RjNe7.js");
+const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-CbSmCWkp.js");
 const require_tls$1 = require("./tls-CCMX7MjX.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-BWtaSmWf.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-C9lmrWFT.js");
+const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-BgWGRxN5.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let zod = require("zod");
@@ -1212,7 +1213,7 @@ var LogManager = class {
 	}
 	createLogger(scope) {
 		return new ScopedLogger(scope, (entry) => {
-			const enriched = this.enrichDeviceName(entry);
+			const enriched = require_child_cap_dispatch.redactLogEntry(this.enrichDeviceName(entry));
 			if (this.isDestinationEnabled?.("log-buffer") !== false) this.ringBuffer.push(enriched);
 			if (this.gate.allowsDestination(enriched)) for (const entry of this.destinations) {
 				if (entry.addonId !== void 0 && this.isDestinationEnabled?.(entry.addonId) === false) continue;
@@ -7474,6 +7475,10 @@ var INFRA_CAPABILITIES = [
 		name: "settings-store",
 		required: true
 	},
+	{
+		name: "keychain",
+		required: false
+	},
 	{
 		name: "log-destination",
 		required: false
@@ -10335,7 +10340,8 @@ var BOOTSTRAP_OWNED_SECTIONS = new Set([
 	"hub",
 	"agent",
 	"tls",
-	"bootstrap"
+	"bootstrap",
+	"keychain"
 ]);
 /** The only keys under a bootstrap-owned section the store may answer. */
 var STORE_READABLE_BOOTSTRAP_KEYS = new Set(["auth.tokenExpiry"]);
@@ -96521,6 +96527,7 @@ exports.classifyAddonDir = classifyAddonDir;
 exports.classifyCapRoute = require_child_cap_dispatch.classifyCapRoute;
 exports.clearHttpsListener = require_tls$1.clearHttpsListener;
 exports.clearPendingRestart = clearPendingRestart;
+exports.clearPlatformKeychainKey = require_platform_key_source.clearPlatformKeychainKey;
 exports.closeLanHttp = require_tls$1.closeLanHttp;
 exports.clusterEventTopic = require_child_cap_dispatch.clusterEventTopic;
 exports.clusterSecretMatches = clusterSecretMatches;
@@ -96648,6 +96655,7 @@ Object.defineProperty(exports, "getPlatformInfo", {
 		return _camstack_types_node.getPlatformInfo;
 	}
 });
+exports.getPlatformKeychainKey = require_platform_key_source.getPlatformKeychainKey;
 Object.defineProperty(exports, "getPythonDownloadUrl", {
 	enumerable: true,
 	get: function() {
@@ -96684,6 +96692,7 @@ exports.isArrayBufferCensusReport = require_child_cap_dispatch.isArrayBufferCens
 exports.isArrayOutputSchema = require_dist.isArrayOutputSchema;
 exports.isClusterSecretMismatchError = isClusterSecretMismatchError;
 exports.isCollectionArrayMethod = require_dist.isCollectionArrayMethod;
+exports.isCredentialKeyName = require_child_cap_dispatch.isCredentialKeyName;
 exports.isInfraCapability = isInfraCapability;
 exports.isModelDownloaded = require_event_loop_stall_monitor.isModelDownloaded;
 exports.isSettingsReadUnavailable = require_builtins_local_auth_local_auth_addon.isSettingsReadUnavailable;
@@ -96714,6 +96723,9 @@ exports.readTlsMode = require_tls$1.readTlsMode;
 exports.readinessKey = require_dist.readinessKey;
 exports.reclaimIntervalMs = require_child_cap_dispatch.reclaimIntervalMs;
 exports.recordSocketFrame = require_child_cap_dispatch.recordSocketFrame;
+exports.redactLogEntry = require_child_cap_dispatch.redactLogEntry;
+exports.redactLogMeta = require_child_cap_dispatch.redactLogMeta;
+exports.redactLogText = require_child_cap_dispatch.redactLogText;
 exports.regenerateCertificate = require_tls$1.regenerateCertificate;
 exports.registerEventBusService = require_child_cap_dispatch.registerEventBusService;
 exports.registerHttpsListener = require_tls$1.registerHttpsListener;
@@ -96739,12 +96751,14 @@ exports.serializeTypedArrays = require_child_cap_dispatch.serializeTypedArrays;
 exports.servedHttpsLeafFingerprint = require_tls$1.servedHttpsLeafFingerprint;
 exports.setHubConnected = require_child_cap_dispatch.setHubConnected;
 exports.setNodeEventInterest = require_child_cap_dispatch.setNodeEventInterest;
+exports.setPlatformKeychainKey = require_platform_key_source.setPlatformKeychainKey;
 exports.setWrapperActive = require_builtins_device_manager_device_manager_addon.setWrapperActive;
 exports.shouldReclaim = require_child_cap_dispatch.shouldReclaim;
 exports.signalAllRunnerGroups = require_child_cap_dispatch.signalAllRunnerGroups;
 exports.socketDirectionBytes = require_child_cap_dispatch.socketDirectionBytes;
 exports.socketDirectionMessages = require_child_cap_dispatch.socketDirectionMessages;
 exports.splitPemCertificates = require_tls$1.splitPemCertificates;
+exports.stampCallerAddonId = require_child_cap_dispatch.stampCallerAddonId;
 exports.startEventLoopStallMonitor = require_event_loop_stall_monitor.startEventLoopStallMonitor;
 exports.startHeapWatch = require_child_cap_dispatch.startHeapWatch;
 exports.startRunnerHeapWatch = require_child_cap_dispatch.startRunnerHeapWatch;

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $t as looseSchema, Ar as resolveCapMount, Bt as isCollectionArrayMethod, Dn as scopesAllowAddon, Dr as parseJsonObject, E as LOG_LEVEL_RANK, F as RUNTIME_DEFAULTS, Gt as kebabToCamel, Jt as lifecycleJobSchema, K as addonSettingsCapability, Mt as extractNestedAddonId, On as scopesAllowDeviceCap, Or as parseJsonUnknown, Pr as EventCategory$1, Qt as logLevelAtMost, Sr as expandCapMethods, Ut as isObjectInput, Wt as isVoidInput, _r as asString$1, br as emitDownForOwnedCaps, cn as objectInputDeclaresAddonId, dr as DEVICE_STATUS_METHOD, fr as ReadinessRegistry, gr as asNumber, hr as asJsonObject$1, jr as scopeKey, k as METHOD_ACCESS_MAP, kr as readinessKey, ln as objectInputDeclaresRequiredDeviceId, lr as DATAPLANE_SECRET_HEADER$1, mn as procedureAuthKey, pr as ReadinessTimeoutError, sr as errMsg$1, t as ALL_CAPABILITY_DEFINITIONS, ur as DEVICE_SETTINGS_CONTRIBUTION_METHODS, wn as resolveMethodAuth, yr as createEvent, zt as isArrayOutputSchema } from "./dist-D732NygW.mjs";
+import { $t as looseSchema, At as extractNestedAddonId, Cr as emitDownForOwnedCaps, E as LOG_LEVEL_RANK, G as addonSettingsCapability, Gr as EventCategory$1, Ht as isVoidInput, Ir as readinessKey, Jt as lifecycleJobSchema, Lr as resolveCapMount, Lt as isArrayOutputSchema, Nr as parseJsonObject, On as scopesAllowAddon, P as RUNTIME_DEFAULTS, Pr as parseJsonUnknown, Qt as logLevelAtMost, Rt as isCollectionArrayMethod, Sr as createEvent, Tn as resolveMethodAuth, Tr as expandCapMethods, Ut as kebabToCamel, Vt as isObjectInput, _r as asJsonObject$1, cr as errMsg$1, dr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, fr as DEVICE_STATUS_METHOD, hn as procedureAuthKey, hr as ReadinessTimeoutError, k as METHOD_ACCESS_MAP, kn as scopesAllowDeviceCap, ln as objectInputDeclaresAddonId, mr as ReadinessRegistry, t as ALL_CAPABILITY_DEFINITIONS, un as objectInputDeclaresRequiredDeviceId, ur as DATAPLANE_SECRET_HEADER$1, vr as asNumber, yr as asString$1, zr as scopeKey } from "./dist-Bvl5JgNt.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -22,15 +22,16 @@ import NativeMetricsAddon, { t as NativeMetricsProvider } from "./builtins/nativ
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
 import { SqliteSettingsAddon, o as SqliteSettingsBackend, s as prefixRange } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
-import { n as HUB_CAP_FWD_SERVICE, r as createHubCapForwardService, t as HUB_CAP_FWD_ACTION } from "./hub-cap-forward-BdT320dq.mjs";
+import { n as HUB_CAP_FWD_SERVICE, r as createHubCapForwardService, t as HUB_CAP_FWD_ACTION } from "./hub-cap-forward-CH6_VWVO.mjs";
 import { StorageOrchestratorAddon, n as buildStorageLocationRegistry, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
 import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
-import { C as resolveFormatRevision, S as isModelDownloaded, _ as downloadModel, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as ensureModel, w as revisionWeightUrl, y as fetchJson } from "./event-loop-stall-monitor-8W4yWNVW.mjs";
+import { C as resolveFormatRevision, S as isModelDownloaded, _ as downloadModel, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as ensureModel, w as revisionWeightUrl, y as fetchJson } from "./event-loop-stall-monitor-D8rqSWfW.mjs";
 import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-CJHogwTl.mjs";
-import { $ as CapRouteError, $n as EMPTY_CAP_ACTION_READING, $t as RUNNER_RSS_BUDGET_ENV, A as resolveHwAccel, An as OUTBOUND_QUEUE_SUSTAIN_MS, At as DeviceRegistry, B as udsChildLogToWorkerEntry, Bn as createSocketPlaneMeter, Bt as hostNodeIdOf, C as getBrokerEventBus, Cn as HEAP_SPACE_REPORT_MIN_MB, Ct as capActionName, D as subscribePassthrough, Dn as readHeapSpaces, Dt as parseCapAction, E as setNodeEventInterest, En as heapSpaceField, Et as capServiceName, F as ipcParentLink, Fn as createMeshQueueReader, Ft as resolveAddonClass, G as UDS_NO_ROUTE_PREFIX, Gn as EMPTY_SOCKET_DIRECTION, Gt as HEAP_WATCH_INTERVAL_MS, H as createUdsLoggerWithControl, Hn as diffSocketPlane, Ht as HEAP_RECLAIM_MIN_INTERVAL_MS, I as localProviderLink, In as formatMeshQueue, It as buildNpmChildEnv, J as answerClaimedGetStatus, Jn as sampleSocketDirection, Jt as HUB_MAIN_RSS_BUDGET_MB, K as afterWorkerOnlineAnnounce, Kn as createSocketDirectionCounters, Kt as HEAP_WATCH_WARN_RATIO, L as createParentUnownedCallHandler, Ln as EMPTY_SOCKET_PLANE_BASELINE, Lt as resolveNpmInvocation, M as brokerTransportLink, Mn as createOutboundQueueGate, Mt as CapabilityUnavailableError, N as buildLinkChain, Nn as formatOutboundQueueVerdict, Nt as copyBundledNativeModules, O as AddonDepsManager, On as selectReportedSpaces, Ot as deserializeTypedArrays, P as deviceCapResolverLink, Pn as MESH_QUEUE_TOP_N, Pt as installManifestNativeDeps, Q as CapRouteResolver, Qn as CAP_ACTION_UNLABELLED, Qt as RUNNER_HEAP_WATCH_INTERVAL_MS, R as createUdsEventBridge, Rn as SOCKET_PLANE_TOP_N, Rt as runNpm, S as clusterEventTopic, Sn as DECISIVE_HEAP_SPACES, St as NATIVE_PROVIDER_SERVICE_INFIX, T as registerEventBusService, Tn as formatHeapSpaces, Tt as capBareAction, U as LocalChildClient, Un as formatSocketPlane, Ut as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, V as createUdsLogger, Vn as createSocketPlaneReader, Vt as createAddonDataPlaneFacility, W as LocalChildRegistry, Wn as readSocketQueues, Wt as HEAP_RECLAIM_TRIGGER_MB, X as AGENT_CAP_FWD_ACTION, Xn as socketDirectionMessages, Xt as RSS_BUDGET_REANNOUNCE_MIN_MS, Y as deviceOfGetStatus, Yn as socketDirectionBytes, Yt as HUB_RSS_BUDGET_ENV, Z as AGENT_CAP_FWD_SERVICE, Zn as CAP_ACTION_OVERFLOW_LABEL, Zt as RSS_BUDGET_RELEASE_RATIO, _ as getWorkerDeviceRegistry, _n as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, a as reapProcessGroup, an as describeRss, ar as createEventPlaneMeter, at as getCapUsageRegistry, b as setHubConnected, bn as formatArrayBufferCensus, bt as createAddonService, c as runnerOwnsProcessGroup, cn as parseRssBudgetMb, cr as formatEventPlane, ct as UdsLocalTransportServer, d as summarizeMembers, dn as startHeapWatch, dt as localEndpointPath, en as ZERO_LOOP_DELAY, er as MAX_CAP_ACTIONS_PER_PEER, et as classifyCapRoute, f as installManifestSystemDeps, fn as startRunnerHeapWatch, ft as FrameDecoder, g as createUdsAddonContext, gn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, h as createAddonContext, hn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ht as createBrokerDeviceManagerApi, in as createV8Reclaimer, ir as EVENT_PLANE_TOP_N, it as __resetCapUsageRegistryForTests, j as brokerCallForCap, jn as OUTBOUND_QUEUE_THRESHOLD_BYTES, jt as CapabilityHandle, k as createKernelHwAccel, kn as OUTBOUND_QUEUE_COOLDOWN_MS, kt as serializeTypedArrays, l as signalAllRunnerGroups, ln as reclaimIntervalMs, lt as SocketChannel, m as adaptBrokerToCluster, mn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, mt as buildNativeCapProxy, nn as createDeferredHeapWatchSink, nr as createCapActionCensus, nt as CapUsageRegistry, o as registerRunnerGroup, on as hubMainRssBudget, or as createEventPlaneReader, ot as createLocalTransport, p as installManifestPythonDeps, pn as strandedMb, pt as encodeFrame, q as GET_STATUS_METHOD, qn as recordSocketFrame, qt as HUB_MAIN_HEAP_WATCH_LABEL, r as defaultProcessGroupOps, rn as createLoopDelayMeter, rr as diffCapActionCensus, rt as PARENT_ROUTED_PROVIDER_ADDON_ID, s as releaseRunnerGroup, sn as nextRssBudgetState, sr as diffEventPlane, st as UdsLocalTransportClient, t as CAP_METHOD_NOT_IMPLEMENTED, tn as buildHeapSample, tr as capActionLabel, tt as callWithServiceDiscovery, un as shouldReclaim, ut as PeerAnsweredError, v as getOrInitReadinessRegistry, vn as createArrayBufferCensusGate, vt as mountNativeCapService, w as getMoleculerEventStats, wn as emitHeapDiagnosticReport, wt as capActionSuffix, x as EVENT_TOPIC_PREFIX, xn as isArrayBufferCensusReport, xt as validateProviderRegistrations, y as getOrInitReadinessRegistryForClient, yn as createInspectorArrayBufferCensus, z as createUdsEventBus, zn as SOCKET_QUEUE_TOP_N, zt as createAddonPeerBytesFacility } from "./child-cap-dispatch-8qMgog1O.mjs";
+import { $ as stampCallerAddonId, $n as sampleSocketDirection, $t as HUB_MAIN_RSS_BUDGET_MB, A as resolveHwAccel, An as formatHeapSpaces, At as serializeTypedArrays, B as udsChildLogToWorkerEntry, Bn as createMeshQueueReader, Bt as isCredentialKeyName, C as getBrokerEventBus, Cn as createArrayBufferCensusGate, Ct as NATIVE_PROVIDER_SERVICE_INFIX, D as subscribePassthrough, Dn as DECISIVE_HEAP_SPACES, Dt as capServiceName, E as setNodeEventInterest, En as isArrayBufferCensusReport, Et as capBareAction, F as ipcParentLink, Fn as OUTBOUND_QUEUE_SUSTAIN_MS, Ft as installManifestNativeDeps, G as UDS_NO_ROUTE_PREFIX, Gn as createSocketPlaneMeter, Gt as hostNodeIdOf, H as createUdsLoggerWithControl, Hn as EMPTY_SOCKET_PLANE_BASELINE, Ht as redactLogMeta, I as localProviderLink, In as OUTBOUND_QUEUE_THRESHOLD_BYTES, It as resolveAddonClass, J as answerClaimedGetStatus, Jn as formatSocketPlane, Jt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, K as afterWorkerOnlineAnnounce, Kn as createSocketPlaneReader, Kt as createAddonDataPlaneFacility, L as createParentUnownedCallHandler, Ln as createOutboundQueueGate, Lt as buildNpmChildEnv, M as brokerTransportLink, Mn as readHeapSpaces, Mt as CapabilityHandle, N as buildLinkChain, Nn as selectReportedSpaces, Nt as CapabilityUnavailableError, O as AddonDepsManager, On as HEAP_SPACE_REPORT_MIN_MB, Ot as parseCapAction, P as deviceCapResolverLink, Pn as OUTBOUND_QUEUE_COOLDOWN_MS, Pt as copyBundledNativeModules, Q as CapRouteResolver, Qn as recordSocketFrame, Qt as HUB_MAIN_HEAP_WATCH_LABEL, R as createUdsEventBridge, Rn as formatOutboundQueueVerdict, Rt as resolveNpmInvocation, S as clusterEventTopic, Sn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, St as validateProviderRegistrations, T as registerEventBusService, Tn as formatArrayBufferCensus, Tt as capActionSuffix, U as LocalChildClient, Un as SOCKET_PLANE_TOP_N, Ut as redactLogText, V as createUdsLogger, Vn as formatMeshQueue, Vt as redactLogEntry, W as LocalChildRegistry, Wn as SOCKET_QUEUE_TOP_N, Wt as createAddonPeerBytesFacility, X as AGENT_CAP_FWD_ACTION, Xn as EMPTY_SOCKET_DIRECTION, Xt as HEAP_WATCH_INTERVAL_MS, Y as deviceOfGetStatus, Yn as readSocketQueues, Yt as HEAP_RECLAIM_TRIGGER_MB, Z as AGENT_CAP_FWD_SERVICE, Zn as createSocketDirectionCounters, Zt as HEAP_WATCH_WARN_RATIO, _ as getWorkerDeviceRegistry, _n as startRunnerHeapWatch, a as reapProcessGroup, an as ZERO_LOOP_DELAY, ar as MAX_CAP_ACTIONS_PER_PEER, at as __resetCapUsageRegistryForTests, b as setHubConnected, bn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, c as runnerOwnsProcessGroup, cn as createLoopDelayMeter, cr as diffCapActionCensus, ct as UdsLocalTransportClient, d as summarizeMembers, dn as hubMainRssBudget, dr as createEventPlaneReader, dt as PeerAnsweredError, en as HUB_RSS_BUDGET_ENV, er as socketDirectionBytes, et as CapRouteError, f as installManifestSystemDeps, fn as nextRssBudgetState, fr as diffEventPlane, ft as localEndpointPath, g as createUdsAddonContext, gn as startHeapWatch, gt as createBrokerDeviceManagerApi, h as createAddonContext, hn as shouldReclaim, ht as buildNativeCapProxy, in as RUNNER_RSS_BUDGET_ENV, ir as EMPTY_CAP_ACTION_READING, it as PARENT_ROUTED_PROVIDER_ADDON_ID, j as brokerCallForCap, jn as heapSpaceField, jt as DeviceRegistry, k as createKernelHwAccel, kn as emitHeapDiagnosticReport, kt as deserializeTypedArrays, l as signalAllRunnerGroups, ln as createV8Reclaimer, lr as EVENT_PLANE_TOP_N, lt as UdsLocalTransportServer, m as adaptBrokerToCluster, mn as reclaimIntervalMs, mt as encodeFrame, nn as RSS_BUDGET_RELEASE_RATIO, nr as CAP_ACTION_OVERFLOW_LABEL, nt as callWithServiceDiscovery, o as registerRunnerGroup, on as buildHeapSample, or as capActionLabel, ot as getCapUsageRegistry, p as installManifestPythonDeps, pn as parseRssBudgetMb, pr as formatEventPlane, pt as FrameDecoder, q as GET_STATUS_METHOD, qn as diffSocketPlane, qt as HEAP_RECLAIM_MIN_INTERVAL_MS, r as defaultProcessGroupOps, rn as RUNNER_HEAP_WATCH_INTERVAL_MS, rr as CAP_ACTION_UNLABELLED, rt as CapUsageRegistry, s as releaseRunnerGroup, sn as createDeferredHeapWatchSink, sr as createCapActionCensus, st as createLocalTransport, t as CAP_METHOD_NOT_IMPLEMENTED, tn as RSS_BUDGET_REANNOUNCE_MIN_MS, tr as socketDirectionMessages, tt as classifyCapRoute, un as describeRss, ur as createEventPlaneMeter, ut as SocketChannel, v as getOrInitReadinessRegistry, vn as strandedMb, w as getMoleculerEventStats, wn as createInspectorArrayBufferCensus, wt as capActionName, x as EVENT_TOPIC_PREFIX, xn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, xt as createAddonService, y as getOrInitReadinessRegistryForClient, yn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, yt as mountNativeCapService, z as createUdsEventBus, zn as MESH_QUEUE_TOP_N, zt as runNpm } from "./child-cap-dispatch-DpHovtQd.mjs";
+import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B2WZ8_q9.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { z } from "zod";
@@ -1205,7 +1206,7 @@ var LogManager = class {
 	}
 	createLogger(scope) {
 		return new ScopedLogger(scope, (entry) => {
-			const enriched = this.enrichDeviceName(entry);
+			const enriched = redactLogEntry(this.enrichDeviceName(entry));
 			if (this.isDestinationEnabled?.("log-buffer") !== false) this.ringBuffer.push(enriched);
 			if (this.gate.allowsDestination(enriched)) for (const entry of this.destinations) {
 				if (entry.addonId !== void 0 && this.isDestinationEnabled?.(entry.addonId) === false) continue;
@@ -7467,6 +7468,10 @@ var INFRA_CAPABILITIES = [
 		name: "settings-store",
 		required: true
 	},
+	{
+		name: "keychain",
+		required: false
+	},
 	{
 		name: "log-destination",
 		required: false
@@ -10328,7 +10333,8 @@ var BOOTSTRAP_OWNED_SECTIONS = new Set([
 	"hub",
 	"agent",
 	"tls",
-	"bootstrap"
+	"bootstrap",
+	"keychain"
 ]);
 /** The only keys under a bootstrap-owned section the store may answer. */
 var STORE_READABLE_BOOTSTRAP_KEYS = new Set(["auth.tokenExpiry"]);
@@ -96310,4 +96316,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, leafFingerprintOf, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, overlayGetStatus, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isCredentialKeyName, isInfraCapability, isModelDownloaded, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, leafFingerprintOf, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, overlayGetStatus, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/config-schema.d.ts

@@ -45,6 +45,10 @@ export declare const bootstrapSchema: z.ZodObject<{
         requiredAddons: z.ZodOptional<z.ZodArray<z.ZodString>>;
         forceDisable: z.ZodDefault<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
+    keychain: z.ZodDefault<z.ZodObject<{
+        keyFile: z.ZodOptional<z.ZodString>;
+        previousKeyFile: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type BootstrapConfig = z.infer<typeof bootstrapSchema>;
 /**

package/dist/kernel/moleculer/child-addon-call-dispatch.d.ts

@@ -31,6 +31,12 @@ export interface ChildAddonCallDispatchDeps {
     /** Resolve an addon's live HTTP data-plane endpoints (published by its
      *  `ctx.dataPlane` facility). Empty when the addon serves no data-plane. */
     getDataPlanes: (addonId: string) => readonly AddonDataPlaneEndpoint[];
+    /**
+     * Swap the secret VIEWS a form sent as action input for their values,
+     * through the owner addon's own `ctx.secrets` (D789). Absent → the input is
+     * parsed as it arrived.
+     */
+    resolveSecretViews?: (addonId: string, args: unknown) => Promise<unknown>;
 }
 /**
  * Creates the addon-level dispatcher the addon-runner wires to

package/dist/kernel/transport/cap-route-resolver.d.ts

@@ -148,6 +148,25 @@ export declare function extractDeviceId(args: unknown): number | undefined;
  * `getEngineProvisioning({nodeId})`) still receive it unchanged.
  */
 export declare function extractNodeId(args: unknown): string | undefined;
+/**
+ * Stamp the CALLER identity into a cap call's args — the SAME "provider
+ * destructures what it needs and ignores the rest" convention
+ * {@link extractNodeId} already relies on for the inline `nodeId` pin.
+ *
+ * The stamp is the transport's, never the caller's (D787):
+ *  - a stamp (`callerAddonId` known to the transport) OVERWRITES whatever the
+ *    args carry under that key;
+ *  - NO stamp STRIPS the key: a call that crossed a wire with no identity the
+ *    transport can vouch for must not arrive carrying a claimed one. The
+ *    keychain owner-checks on this field, and until 2026-10-08 an unstamped
+ *    call let a child's own `callerAddonId` through untouched.
+ *
+ * A hub in-process caller never reaches this function (`localProviderLink`
+ * calls the provider directly), which is the one place a stated identity is
+ * trusted. A non-object `args` (or `null`/array) is returned unchanged: there
+ * is nowhere to attach a key, and nowhere one could hide.
+ */
+export declare function stampCallerAddonId(args: unknown, callerAddonId: string | undefined): unknown;
 export declare class CapRouteResolver {
     private readonly hubNodeId;
     private readonly broker;

package/dist/kernel/transport/hub-cap-forward.d.ts

@@ -24,6 +24,27 @@ export interface HubCapForwardParams {
      * trying to skip.
      */
     readonly native?: boolean;
+    /**
+     * The ORIGINATING addon, stamped by the AGENT's `LocalChildRegistry` off the
+     * child connection the call arrived on (D787) — the agent-side equivalent of
+     * what the hub's own registry stamps for a hub-local child. The hub trusts it
+     * because the agent node is authenticated by the cluster secret, and checks
+     * it against the node the request came from ({@link HubCapForwardOptions}).
+     * Absent → the call is anonymous, and an owner-checked cap refuses it.
+     */
+    readonly callerAddonId?: string;
+}
+/** How the hub decides whether an agent's caller stamp is believable. */
+export interface HubCapForwardOptions {
+    /**
+     * Is `callerAddonId` (a runner id) actually running on `nodeId`, the agent
+     * this request came from? A stamp that fails the check is DROPPED — the call
+     * proceeds anonymous, it is not refused here. Omitted → stamps are trusted
+     * as the cluster secret already authenticates the node.
+     */
+    readonly isCallerOnNode?: (nodeId: string, callerAddonId: string) => boolean;
+    /** Told about a dropped stamp — a misrouted or lying runner deserves a line. */
+    readonly onRejectedCaller?: (nodeId: string, callerAddonId: string) => void;
 }
 /**
  * Handler that routes an agent-originated cap call through the hub's own
@@ -39,4 +60,4 @@ export type HubUnownedCallHandler = (input: CapCallInput) => Promise<unknown>;
  *                       `createParentUnownedCallHandler`). Reused verbatim so
  *                       forwarded calls route exactly like a hub-local child's.
  */
-export declare function createHubCapForwardService(onUnownedCall: HubUnownedCallHandler): ServiceSchema;
+export declare function createHubCapForwardService(onUnownedCall: HubUnownedCallHandler, options?: HubCapForwardOptions): ServiceSchema;

package/dist/kernel/transport/index.d.ts

@@ -16,7 +16,7 @@ export type { LocalChildClientOptions, AddonCallHandler } from './local-child-cl
 export { LocalChildClient } from './local-child-client.js';
 export type { CapRoute, CapRouteBase, CapRouteOpts, HubInProcessRoute, HubLocalUdsRoute, RemoteMoleculerRoute, AgentChildForwardRoute, CapInvoker, InProcessProviderRef, CapRouteReason, RejectedRoute, CapRouteErrorDetail, } from './cap-route.js';
 export { CapRouteError, classifyCapRoute } from './cap-route.js';
-export { CapRouteResolver, AGENT_CAP_FWD_SERVICE, AGENT_CAP_FWD_ACTION, } from './cap-route-resolver.js';
+export { CapRouteResolver, AGENT_CAP_FWD_SERVICE, AGENT_CAP_FWD_ACTION, stampCallerAddonId, } from './cap-route-resolver.js';
 export type { NodeCapAuthority, InProcessProviderLookup, CapRouteResolverDeps, AgentCapForwardParams, HubLocalChildDispatcher, } from './cap-route-resolver.js';
 export { NATIVE_PROVIDER_SERVICE_INFIX, capServiceName, capActionName, capActionSuffix, capBareAction, parseCapAction, } from './cap-action-name.js';
 export type { ParsedCapAction } from './cap-action-name.js';
@@ -33,4 +33,4 @@ export { answerClaimedGetStatus, deviceOfGetStatus, GET_STATUS_METHOD, } from '.
 export type { ClaimedGetStatusAnswer, ClaimedGetStatusCall } from './claimed-get-status.js';
 export type { ParentUnownedCallDeps, ParentUnownedCallLogger } from './parent-unowned-call.js';
 export { createHubCapForwardService, HUB_CAP_FWD_SERVICE, HUB_CAP_FWD_ACTION, } from './hub-cap-forward.js';
-export type { HubCapForwardParams, HubUnownedCallHandler } from './hub-cap-forward.js';
+export type { HubCapForwardOptions, HubCapForwardParams, HubUnownedCallHandler, } from './hub-cap-forward.js';

package/dist/kernel/transport/local-child-registry.d.ts

@@ -273,9 +273,10 @@ export interface LocalChildRegistryOptions {
      *     `ml` execution groups have co-located providers at all (D9, D29).
      *  3. **An agent's own runners.** Their parent is the agent process, whose
      *     `LocalChildRegistry` writes to the agent's singleton. Aggregating that
-     *     needs a transport hop; `$hub-cap-fwd`'s envelope carries no
-     *     `callerAddonId` today, so an agent-originated call reaching the hub is
-     *     recorded with no caller at all — i.e. not recorded.
+     *     needs a transport hop. `$hub-cap-fwd`'s envelope has carried the
+     *     agent-stamped `callerAddonId` since D787 (the keychain owner-checks
+     *     it), but the hub does not feed it to this observer — an
+     *     agent-originated call is still not recorded here.
      *
      * MUST NOT throw; the call site catches anyway (see the record site).
      */

package/dist/logging/log-redactor.d.ts

@@ -0,0 +1,9 @@
+import { LogEntry } from '@camstack/types';
+/** True when a meta key names a credential. */
+export declare function isCredentialKeyName(key: string): boolean;
+/** Redact one free-form string. */
+export declare function redactLogText(text: string): string;
+/** Redact a `meta` record; the same object back when it was already clean. */
+export declare function redactLogMeta(meta: Record<string, unknown>): Record<string, unknown>;
+/** Redact a whole entry: message and meta. Tags are identifiers, left alone. */
+export declare function redactLogEntry(entry: LogEntry): LogEntry;

package/dist/platform-key-source-BWlq0jjn.mjs

@@ -0,0 +1,23 @@
+//#region src/builtins/keychain/platform-key-source.ts
+var SLOT = Symbol.for("camstack.keychain.platform-key");
+/** Register the platform key. Called once, by the hub's boot. */
+function setPlatformKeychainKey(entry) {
+	Reflect.set(globalThis, SLOT, entry);
+}
+/** Drop the platform key (tests). */
+function clearPlatformKeychainKey() {
+	Reflect.deleteProperty(globalThis, SLOT);
+}
+function isPlatformKey(value) {
+	if (value === null || typeof value !== "object") return false;
+	const label = Reflect.get(value, "label");
+	const key = Reflect.get(value, "key");
+	return typeof label === "string" && Buffer.isBuffer(key);
+}
+/** The platform key, when this hub was started by the desktop app with one. */
+function getPlatformKeychainKey() {
+	const value = Reflect.get(globalThis, SLOT);
+	return isPlatformKey(value) ? value : null;
+}
+//#endregion
+export { getPlatformKeychainKey as n, setPlatformKeychainKey as r, clearPlatformKeychainKey as t };

package/dist/platform-key-source-Di7HrlGR.js

@@ -0,0 +1,40 @@
+//#region src/builtins/keychain/platform-key-source.ts
+var SLOT = Symbol.for("camstack.keychain.platform-key");
+/** Register the platform key. Called once, by the hub's boot. */
+function setPlatformKeychainKey(entry) {
+	Reflect.set(globalThis, SLOT, entry);
+}
+/** Drop the platform key (tests). */
+function clearPlatformKeychainKey() {
+	Reflect.deleteProperty(globalThis, SLOT);
+}
+function isPlatformKey(value) {
+	if (value === null || typeof value !== "object") return false;
+	const label = Reflect.get(value, "label");
+	const key = Reflect.get(value, "key");
+	return typeof label === "string" && Buffer.isBuffer(key);
+}
+/** The platform key, when this hub was started by the desktop app with one. */
+function getPlatformKeychainKey() {
+	const value = Reflect.get(globalThis, SLOT);
+	return isPlatformKey(value) ? value : null;
+}
+//#endregion
+Object.defineProperty(exports, "clearPlatformKeychainKey", {
+	enumerable: true,
+	get: function() {
+		return clearPlatformKeychainKey;
+	}
+});
+Object.defineProperty(exports, "getPlatformKeychainKey", {
+	enumerable: true,
+	get: function() {
+		return getPlatformKeychainKey;
+	}
+});
+Object.defineProperty(exports, "setPlatformKeychainKey", {
+	enumerable: true,
+	get: function() {
+		return setPlatformKeychainKey;
+	}
+});

package/dist/{retired-settings-keys-CxPOg7BF.mjs → retired-settings-keys-BAcfvFtm.mjs}

@@ -1,4 +1,4 @@
-import { hr as asJsonObject } from "./dist-D732NygW.mjs";
+import { _r as asJsonObject } from "./dist-Bvl5JgNt.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-MaESpO18.js → retired-settings-keys-gTsZfpmP.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BcUWQGr9.js");
+const require_dist = require("./dist-KxsOMQik.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?