@camstack/system 1.2.376 → 1.2.378

package/dist/builtins/keychain/index.js

@@ -0,0 +1,1442 @@
+Object.defineProperties(exports, {
+	__esModule: { value: true },
+	[Symbol.toStringTag]: { value: "Module" }
+});
+const require_chunk = require("../../chunk-Cek0wNdY.js");
+const require_dist = require("../../dist-KxsOMQik.js");
+const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
+let node_crypto = require("node:crypto");
+let node_path = require("node:path");
+node_path = require_chunk.__toESM(node_path);
+let node_fs = require("node:fs");
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+var VALUE_PREFIX = "ck1";
+var WRAP_PREFIX = "kw1";
+var FINGERPRINT_LABEL = "camstack-keychain-v1";
+/** 32 fresh random bytes — a master or a data key. */
+function generateKey() {
+	return (0, node_crypto.randomBytes)(32);
+}
+/** A short random id for a data key (no dots — it is a segment of `ck1`). */
+function generateKeyId() {
+	return (0, node_crypto.randomBytes)(8).toString("hex");
+}
+/** The full fingerprint of a master key. */
+function kekFingerprint(kek) {
+	return (0, node_crypto.createHmac)("sha256", kek).update(FINGERPRINT_LABEL).digest("hex");
+}
+/** What the operator sees: the first 16 hex chars. */
+function shortFingerprint(fingerprint) {
+	return fingerprint.slice(0, 16);
+}
+/** Constant-time string equality (lengths may differ). */
+function constantTimeEquals(a, b) {
+	const ab = Buffer.from(a, "utf8");
+	const bb = Buffer.from(b, "utf8");
+	if (ab.length !== bb.length) return false;
+	return (0, node_crypto.timingSafeEqual)(ab, bb);
+}
+/**
+* Key material from a key file: base64 (the format we write) or hex of
+* exactly 32 bytes, surrounding whitespace ignored. Anything else is `null` —
+* a file holding a password or a PEM is refused, never stretched into a key.
+*/
+function decodeKeyMaterial(text) {
+	const trimmed = text.trim();
+	if (/^[0-9a-fA-F]{64}$/.test(trimmed)) return Buffer.from(trimmed, "hex");
+	if (!/^[A-Za-z0-9+/=_-]+$/.test(trimmed)) return null;
+	const buf = Buffer.from(trimmed, "base64");
+	return buf.length === 32 ? buf : null;
+}
+function encodeKeyMaterial(key) {
+	return key.toString("base64");
+}
+function seal(key, plaintext, aad) {
+	const iv = (0, node_crypto.randomBytes)(IV_BYTES);
+	const cipher = (0, node_crypto.createCipheriv)("aes-256-gcm", key, iv);
+	cipher.setAAD(Buffer.from(aad, "utf8"));
+	const ct = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+	const tag = cipher.getAuthTag();
+	return [
+		iv.toString("base64"),
+		tag.toString("base64"),
+		ct.toString("base64")
+	];
+}
+function open(key, ivB64, tagB64, ctB64, aad) {
+	try {
+		const iv = Buffer.from(ivB64, "base64");
+		const tag = Buffer.from(tagB64, "base64");
+		if (iv.length !== IV_BYTES || tag.length !== TAG_BYTES) return null;
+		const decipher = (0, node_crypto.createDecipheriv)("aes-256-gcm", key, iv);
+		decipher.setAAD(Buffer.from(aad, "utf8"));
+		decipher.setAuthTag(tag);
+		return Buffer.concat([decipher.update(Buffer.from(ctB64, "base64")), decipher.final()]);
+	} catch {
+		return null;
+	}
+}
+function dekAad(keyId) {
+	return `camstack-keychain-dek:${keyId}`;
+}
+/** Wrap a data key under a master key. */
+function wrapDek(kek, dek, keyId) {
+	const [iv, tag, ct] = seal(kek, dek, dekAad(keyId));
+	return `${WRAP_PREFIX}.${iv}.${tag}.${ct}`;
+}
+/** Unwrap; `null` when the master key is not the one that wrapped it. */
+function unwrapDek(kek, wrapped, keyId) {
+	const parts = wrapped.split(".");
+	if (parts.length !== 4 || parts[0] !== WRAP_PREFIX) return null;
+	const [, iv, tag, ct] = parts;
+	if (iv === void 0 || tag === void 0 || ct === void 0) return null;
+	const dek = open(kek, iv, tag, ct, dekAad(keyId));
+	return dek !== null && dek.length === 32 ? dek : null;
+}
+/** Encrypt one value for one ref. */
+function encryptValue(dek, keyId, ref, value) {
+	const [iv, tag, ct] = seal(dek, Buffer.from(value, "utf8"), ref);
+	return `${VALUE_PREFIX}.${keyId}.${iv}.${tag}.${ct}`;
+}
+/** Decrypt; `null` on any failure — wrong key, wrong ref, tampered bytes. */
+function decryptValue(dek, ref, envelope) {
+	const parts = envelope.split(".");
+	if (parts.length !== 5 || parts[0] !== VALUE_PREFIX) return null;
+	const [, , iv, tag, ct] = parts;
+	if (iv === void 0 || tag === void 0 || ct === void 0) return null;
+	const plain = open(dek, iv, tag, ct, ref);
+	return plain === null ? null : plain.toString("utf8");
+}
+//#endregion
+//#region src/builtins/keychain/key-sources.ts
+/**
+* Where the master key comes from (D788). Configuration only — NO env var
+* carries a key or a key path:
+*
+*  1. `keychain.keyFile` in `config.yaml` — a file outside the data volume
+*     (a read-only bind mount, a Docker secret). Recommended: a whole-volume
+*     backup then holds the ciphertext but not the key.
+*  2. The desktop app's OS keychain (`safeStorage`), handed to the hub over an
+*     inherited pipe. Primary on a desktop hub with no key file configured.
+*  3. `<dataDir>/.keychain/master.key` (0600, directory 0700), generated on
+*     first boot. The fallback: it protects CamStack's own backups and stray
+*     database copies (it is NOT in `DEFAULT_BACKUP_LOCATIONS`), but a tar of
+*     the whole data directory carries key and database together, and the
+*     Secrets page says so.
+*
+* `keychain.previousKeyFile` is consulted only to UNLOCK — so a move from one
+* key to another is a restart plus `rotateMasterKey`, with no window where
+* neither key works.
+*/
+/** The default key file's location under the data root. */
+function defaultKeyFilePath(dataDir) {
+	return node_path.join(dataDir, ".keychain", "master.key");
+}
+async function loadKeyFile(file) {
+	let text;
+	try {
+		text = await node_fs.promises.readFile(file, "utf8");
+	} catch (err) {
+		if ((err !== null && typeof err === "object" ? Reflect.get(err, "code") : void 0) === "ENOENT") return { kind: "absent" };
+		return {
+			kind: "unreadable",
+			error: err instanceof Error ? err.message : String(err)
+		};
+	}
+	const key = decodeKeyMaterial(text);
+	return key === null ? {
+		kind: "unreadable",
+		error: "not 32 bytes of base64 or hex key material"
+	} : {
+		kind: "loaded",
+		key
+	};
+}
+function fileSource(kind, file, sharesBackupWithDatabase) {
+	return {
+		kind,
+		path: file,
+		sharesBackupWithDatabase
+	};
+}
+/** Every candidate, primary first. */
+function buildKeySourceCandidates(opts) {
+	const out = [];
+	const defaultFile = defaultKeyFilePath(opts.dataDir);
+	const platform = require_platform_key_source.getPlatformKeychainKey();
+	const keyFile = opts.config.keyFile?.trim();
+	const previousKeyFile = opts.config.previousKeyFile?.trim();
+	const primaryKind = keyFile !== void 0 && keyFile.length > 0 ? "config-file" : platform !== null ? "platform" : "default-file";
+	if (keyFile !== void 0 && keyFile.length > 0) out.push({
+		source: fileSource("config-file", keyFile, false),
+		primary: true,
+		load: () => loadKeyFile(keyFile)
+	});
+	if (previousKeyFile !== void 0 && previousKeyFile.length > 0) out.push({
+		source: fileSource("previous-config-file", previousKeyFile, false),
+		primary: false,
+		load: () => loadKeyFile(previousKeyFile)
+	});
+	if (platform !== null) out.push({
+		source: {
+			kind: "platform",
+			sharesBackupWithDatabase: false
+		},
+		primary: primaryKind === "platform",
+		load: async () => ({
+			kind: "loaded",
+			key: platform.key
+		})
+	});
+	out.push({
+		source: fileSource("default-file", defaultFile, true),
+		primary: primaryKind === "default-file",
+		load: () => loadKeyFile(defaultFile)
+	});
+	return out;
+}
+/**
+* Write a master key to the default location: directory 0700, file 0600,
+* atomically (temp + rename), never over an existing file unless `replace`.
+* Returns the previous file's new name when one was moved aside.
+*/
+async function writeDefaultKeyFile(dataDir, key, opts) {
+	const file = defaultKeyFilePath(dataDir);
+	try {
+		return await writeKeyFileAt(file, key, opts);
+	} catch (err) {
+		throw new Error(`could not write the master key at ${file}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+	}
+}
+async function writeKeyFileAt(file, key, opts) {
+	const dir = node_path.dirname(file);
+	await node_fs.promises.mkdir(dir, {
+		recursive: true,
+		mode: 448
+	});
+	await node_fs.promises.chmod(dir, 448);
+	let movedAside = null;
+	try {
+		await node_fs.promises.access(file);
+		if (!opts.replace) throw new Error(`refusing to overwrite the existing master key at ${file}`);
+		movedAside = `${file}.prev-${opts.nowMs}`;
+		await node_fs.promises.copyFile(file, movedAside);
+		await node_fs.promises.chmod(movedAside, 384);
+	} catch (err) {
+		if ((err !== null && typeof err === "object" ? Reflect.get(err, "code") : void 0) !== "ENOENT") throw err;
+	}
+	const tmp = `${file}.tmp-${process.pid}`;
+	await node_fs.promises.writeFile(tmp, `${encodeKeyMaterial(key)}\n`, { mode: 384 });
+	await node_fs.promises.rename(tmp, file);
+	await node_fs.promises.chmod(file, 384);
+	const back = await loadKeyFile(file);
+	if (back.kind !== "loaded" || !back.key.equals(key)) throw new Error("the written key file does not read back as the generated key");
+	return movedAside;
+}
+//#endregion
+//#region src/builtins/keychain/keychain-store.ts
+/**
+* @durable class=config owner=keychain
+*   write="`keychain.put` upserts one row per ref; `delete` removes it"
+*   retention="none — a row lives until its owner deletes the ref or the
+*     operator deletes it as an orphan. Losing the table loses every secret
+*     value; the settings blobs then point at refs that resolve `missing`."
+*/
+var KEYCHAIN_SECRETS_COLLECTION = "keychain:secrets";
+/**
+* @durable class=config owner=keychain
+*   write="first boot writes the wrapped data key; `rotateMasterKey` adds a
+*     wrap and retires the previous one"
+*   retention="retired wraps until `purgeRetiredKeys`. Losing the table with
+*     the secrets intact makes every value undecryptable."
+*/
+var KEYCHAIN_KEYS_COLLECTION = "keychain:keys";
+/**
+* @durable class=ring owner=keychain
+*   write="one row per write / delete / rotation / reveal / recovery download"
+*   retention="90 days and at most 20 000 rows, pruned at boot and daily"
+*/
+var KEYCHAIN_AUDIT_COLLECTION = "keychain:audit";
+var AUDIT_RETENTION_MS = 2160 * 60 * 6e4;
+var AUDIT_MAX_ROWS = 2e4;
+var SECRET_COLUMNS = [
+	{
+		name: "ref",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "owner",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "scope",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "fieldPath",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "ciphertext",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "keyId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "version",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "updatedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "updatedBy",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "lastReadAt",
+		type: "INTEGER"
+	}
+];
+var KEY_COLUMNS = [
+	{
+		name: "wrapId",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "keyId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "wrappedDek",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "kekFingerprint",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "kekSource",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "state",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "recoveryDownloadedAt",
+		type: "INTEGER"
+	}
+];
+var AUDIT_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "at",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "action",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "actor",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "ref",
+		type: "TEXT"
+	},
+	{
+		name: "detail",
+		type: "TEXT"
+	}
+];
+function str(data, key) {
+	const v = data[key];
+	return typeof v === "string" ? v : "";
+}
+function num(data, key) {
+	const v = data[key];
+	return typeof v === "number" ? v : Number(v ?? 0);
+}
+function numOrNull(data, key) {
+	const v = data[key];
+	if (v === null || v === void 0) return null;
+	const n = typeof v === "number" ? v : Number(v);
+	return Number.isFinite(n) ? n : null;
+}
+function strOrNull(data, key) {
+	const v = data[key];
+	return typeof v === "string" ? v : null;
+}
+function toSecretRow(id, data) {
+	return {
+		ref: str(data, "ref") || id,
+		owner: str(data, "owner"),
+		scope: str(data, "scope"),
+		fieldPath: str(data, "fieldPath"),
+		ciphertext: str(data, "ciphertext"),
+		keyId: str(data, "keyId"),
+		version: num(data, "version"),
+		createdAt: num(data, "createdAt"),
+		updatedAt: num(data, "updatedAt"),
+		updatedBy: str(data, "updatedBy"),
+		lastReadAt: numOrNull(data, "lastReadAt")
+	};
+}
+function toKeyRow(id, data) {
+	const state = str(data, "state");
+	return {
+		wrapId: str(data, "wrapId") || id,
+		keyId: str(data, "keyId"),
+		wrappedDek: str(data, "wrappedDek"),
+		kekFingerprint: str(data, "kekFingerprint"),
+		kekSource: str(data, "kekSource"),
+		createdAt: num(data, "createdAt"),
+		state: state === "retired" ? "retired" : "active",
+		recoveryDownloadedAt: numOrNull(data, "recoveryDownloadedAt")
+	};
+}
+var AUDIT_ACTIONS = new Set([
+	"put",
+	"delete",
+	"reveal",
+	"rotate-master-key",
+	"purge-retired-keys",
+	"download-recovery-key",
+	"delete-orphans",
+	"reset",
+	"initialize"
+]);
+function isAuditAction(value) {
+	return AUDIT_ACTIONS.has(value);
+}
+function toAuditRow(id, data) {
+	const action = str(data, "action");
+	if (!isAuditAction(action)) return null;
+	return {
+		id: str(data, "id") || id,
+		at: num(data, "at"),
+		action,
+		actor: str(data, "actor"),
+		ref: strOrNull(data, "ref"),
+		detail: strOrNull(data, "detail")
+	};
+}
+/** Rows one listing page asks for — the table is small, but a read names its bound. */
+var PAGE = 1e3;
+var KeychainRepository = class {
+	door;
+	constructor(door) {
+		this.door = door;
+	}
+	async init() {
+		await this.door.declareCollection({
+			collection: KEYCHAIN_SECRETS_COLLECTION,
+			columns: SECRET_COLUMNS,
+			indexes: [{
+				name: "idx_keychain_secrets_owner",
+				columns: ["owner"]
+			}]
+		});
+		await this.door.declareCollection({
+			collection: KEYCHAIN_KEYS_COLLECTION,
+			columns: KEY_COLUMNS
+		});
+		await this.door.declareCollection({
+			collection: KEYCHAIN_AUDIT_COLLECTION,
+			columns: AUDIT_COLUMNS,
+			indexes: [{
+				name: "idx_keychain_audit_at",
+				columns: ["at"]
+			}]
+		});
+	}
+	async getSecrets(refs) {
+		const out = /* @__PURE__ */ new Map();
+		if (refs.length === 0) return out;
+		const rows = await this.door.query({
+			collection: KEYCHAIN_SECRETS_COLLECTION,
+			filter: {
+				whereIn: { ref: [...refs] },
+				limit: refs.length
+			}
+		});
+		for (const row of rows) {
+			const parsed = toSecretRow(row.id, row.data);
+			out.set(parsed.ref, parsed);
+		}
+		return out;
+	}
+	/** Every row, paged by primary key. */
+	async listSecrets() {
+		const out = [];
+		for (let offset = 0;; offset += PAGE) {
+			const rows = await this.door.query({
+				collection: KEYCHAIN_SECRETS_COLLECTION,
+				filter: {
+					orderBy: {
+						field: "ref",
+						direction: "asc"
+					},
+					limit: PAGE,
+					offset
+				}
+			});
+			for (const row of rows) out.push(toSecretRow(row.id, row.data));
+			if (rows.length < PAGE) return out;
+		}
+	}
+	async putSecret(row) {
+		await this.door.set({
+			collection: KEYCHAIN_SECRETS_COLLECTION,
+			key: row.ref,
+			value: row
+		});
+	}
+	async deleteSecrets(refs) {
+		if (refs.length === 0) return 0;
+		return (await this.door.deleteWhere({
+			collection: KEYCHAIN_SECRETS_COLLECTION,
+			filter: { whereIn: { ref: [...refs] } }
+		})).deleted;
+	}
+	async listKeys() {
+		return (await this.door.query({
+			collection: KEYCHAIN_KEYS_COLLECTION,
+			filter: {
+				orderBy: {
+					field: "createdAt",
+					direction: "asc"
+				},
+				limit: PAGE
+			}
+		})).map((row) => toKeyRow(row.id, row.data));
+	}
+	async putKey(row) {
+		await this.door.set({
+			collection: KEYCHAIN_KEYS_COLLECTION,
+			key: row.wrapId,
+			value: row
+		});
+	}
+	async deleteKey(wrapId) {
+		await this.door.delete({
+			collection: KEYCHAIN_KEYS_COLLECTION,
+			key: wrapId
+		});
+	}
+	async appendAudit(row) {
+		await this.door.set({
+			collection: KEYCHAIN_AUDIT_COLLECTION,
+			key: row.id,
+			value: row
+		});
+	}
+	async listAudit(limit) {
+		const rows = await this.door.query({
+			collection: KEYCHAIN_AUDIT_COLLECTION,
+			filter: {
+				orderBy: {
+					field: "at",
+					direction: "desc"
+				},
+				limit
+			}
+		});
+		const out = [];
+		for (const row of rows) {
+			const parsed = toAuditRow(row.id, row.data);
+			if (parsed !== null) out.push(parsed);
+		}
+		return out;
+	}
+	/** Drop audit rows older than the retention window, then beyond the row bound. */
+	async pruneAudit(nowMs) {
+		const aged = await this.door.deleteWhere({
+			collection: KEYCHAIN_AUDIT_COLLECTION,
+			filter: { whereBetween: { at: [0, nowMs - AUDIT_RETENTION_MS] } }
+		});
+		const cutoff = (await this.door.query({
+			collection: KEYCHAIN_AUDIT_COLLECTION,
+			filter: {
+				orderBy: {
+					field: "at",
+					direction: "desc"
+				},
+				limit: 1,
+				offset: AUDIT_MAX_ROWS
+			}
+		}))[0]?.data["at"];
+		if (typeof cutoff !== "number") return aged.deleted;
+		const bounded = await this.door.deleteWhere({
+			collection: KEYCHAIN_AUDIT_COLLECTION,
+			filter: { whereBetween: { at: [0, cutoff] } }
+		});
+		return aged.deleted + bounded.deleted;
+	}
+	/**
+	* Lost-key recovery: copy every secret row into `archive`, then empty the
+	* live table. The archive is ciphertext under a key nobody has — it exists
+	* so a key that turns up later can still recover it.
+	*/
+	async archiveAllSecrets(archive) {
+		const rows = await this.listSecrets();
+		if (rows.length === 0) return 0;
+		await this.door.declareCollection({
+			collection: archive,
+			columns: SECRET_COLUMNS
+		});
+		for (const row of rows) await this.door.set({
+			collection: archive,
+			key: row.ref,
+			value: row
+		});
+		await this.deleteSecrets(rows.map((r) => r.ref));
+		return rows.length;
+	}
+};
+var KeychainLockedError = class extends Error {
+	reason;
+	constructor(reason) {
+		super(`keychain is locked (${reason}) — no value can be stored or revealed`);
+		this.reason = reason;
+		this.name = "KeychainLockedError";
+	}
+};
+var KeychainForbiddenError = class extends Error {
+	ref;
+	constructor(ref, caller) {
+		super(`keychain: ${caller === null ? "an unidentified caller" : `"${caller}"`} does not own ${ref}`);
+		this.ref = ref;
+		this.name = "KeychainForbiddenError";
+	}
+};
+var NOT_INITIALIZED = {
+	state: "locked",
+	reason: "not-initialized"
+};
+var KeychainService = class {
+	deps;
+	unlock = NOT_INITIALIZED;
+	configuredSource = null;
+	now;
+	constructor(deps) {
+		this.deps = deps;
+		this.now = deps.now ?? Date.now;
+	}
+	/** Load the keys and unlock. Never throws for a key problem — it locks. */
+	async init() {
+		try {
+			await this.deps.repo.init();
+		} catch (err) {
+			this.unlock = {
+				state: "locked",
+				reason: "store-unavailable"
+			};
+			this.deps.logger.error("keychain tables could not be declared — locked", { error: errMsg(err) });
+			return this.getState();
+		}
+		this.unlock = await this.computeUnlock();
+		if (this.unlock.state === "ready") this.deps.logger.info("keychain unlocked", {
+			source: this.unlock.source.kind,
+			path: this.unlock.source.path,
+			fingerprint: shortFingerprint(this.unlock.fingerprint),
+			rotationPending: this.unlock.rotationPending
+		});
+		else this.deps.logger.error("keychain LOCKED — every secret resolves unavailable", {
+			reason: this.unlock.reason,
+			path: this.configuredSource?.path
+		});
+		try {
+			await this.deps.repo.pruneAudit(this.now());
+		} catch (err) {
+			this.deps.logger.warn("keychain audit prune failed", { error: errMsg(err) });
+		}
+		return this.getState();
+	}
+	async computeUnlock() {
+		const candidates = await this.deps.candidates();
+		const primary = candidates.find((c) => c.primary) ?? null;
+		this.configuredSource = primary?.source ?? null;
+		let wraps;
+		try {
+			wraps = await this.deps.repo.listKeys();
+		} catch {
+			return {
+				state: "locked",
+				reason: "store-unavailable"
+			};
+		}
+		if (wraps.length === 0) return this.firstBoot(primary);
+		let anyLoaded = false;
+		let primaryUnreadable = false;
+		for (const candidate of candidates) {
+			const loaded = await candidate.load();
+			if (loaded.kind === "unreadable") {
+				if (candidate.primary) primaryUnreadable = true;
+				this.deps.logger.warn("keychain key source unreadable", {
+					source: candidate.source.kind,
+					path: candidate.source.path,
+					error: loaded.error
+				});
+				continue;
+			}
+			if (loaded.kind !== "loaded") continue;
+			anyLoaded = true;
+			const fingerprint = kekFingerprint(loaded.key);
+			const ordered = [...wraps].toSorted((a, b) => a.state === b.state ? b.createdAt - a.createdAt : a.state === "active" ? -1 : 1);
+			for (const wrap of ordered) {
+				if (!constantTimeEquals(wrap.kekFingerprint, fingerprint)) continue;
+				const dek = unwrapDek(loaded.key, wrap.wrappedDek, wrap.keyId);
+				if (dek === null) continue;
+				return {
+					state: "ready",
+					dek,
+					keyId: wrap.keyId,
+					kek: loaded.key,
+					fingerprint,
+					source: candidate.source,
+					wrap,
+					rotationPending: !candidate.primary || wrap.state !== "active"
+				};
+			}
+		}
+		if (primaryUnreadable) return {
+			state: "locked",
+			reason: "key-file-unreadable"
+		};
+		return {
+			state: "locked",
+			reason: anyLoaded ? "wrong-key" : "key-missing"
+		};
+	}
+	/** No wrapped data key yet: create one — only when nothing could be lost. */
+	async firstBoot(primary) {
+		let existing;
+		try {
+			existing = await this.deps.repo.listSecrets();
+		} catch {
+			return {
+				state: "locked",
+				reason: "store-unavailable"
+			};
+		}
+		if (existing.length > 0) return {
+			state: "locked",
+			reason: "key-missing"
+		};
+		if (primary === null) return {
+			state: "locked",
+			reason: "key-missing"
+		};
+		const loaded = await primary.load();
+		let kek;
+		if (loaded.kind === "loaded") kek = loaded.key;
+		else if (loaded.kind === "unreadable") return {
+			state: "locked",
+			reason: "key-file-unreadable"
+		};
+		else if (primary.source.kind === "default-file") {
+			kek = generateKey();
+			try {
+				await writeDefaultKeyFile(this.deps.dataDir, kek, {
+					replace: false,
+					nowMs: this.now()
+				});
+			} catch (err) {
+				this.deps.logger.error("keychain master key could NOT be generated — no key stored", {
+					path: primary.source.path,
+					error: errMsg(err)
+				});
+				throw err;
+			}
+			this.deps.logger.info("keychain master key generated", { path: primary.source.path });
+		} else return {
+			state: "locked",
+			reason: "key-missing"
+		};
+		const dek = generateKey();
+		const keyId = generateKeyId();
+		const fingerprint = kekFingerprint(kek);
+		const wrap = {
+			wrapId: (0, node_crypto.randomUUID)(),
+			keyId,
+			wrappedDek: wrapDek(kek, dek, keyId),
+			kekFingerprint: fingerprint,
+			kekSource: primary.source.kind,
+			createdAt: this.now(),
+			state: "active",
+			recoveryDownloadedAt: null
+		};
+		await this.deps.repo.putKey(wrap);
+		await this.audit("initialize", "system", null, `source=${primary.source.kind}`);
+		return {
+			state: "ready",
+			dek,
+			keyId,
+			kek,
+			fingerprint,
+			source: primary.source,
+			wrap,
+			rotationPending: false
+		};
+	}
+	getState() {
+		return this.unlock.state === "ready" ? { state: "ready" } : {
+			state: "locked",
+			reason: this.unlock.reason
+		};
+	}
+	requireReady() {
+		if (this.unlock.state !== "ready") throw new KeychainLockedError(this.unlock.reason);
+		return this.unlock;
+	}
+	/** May `caller` touch values owned by `owner`? */
+	owns(caller, owner) {
+		if (caller === null) return false;
+		const c = require_dist.normalizeSecretOwner(caller);
+		const o = require_dist.normalizeSecretOwner(owner);
+		if (c.length === 0) return false;
+		if (c === o) return true;
+		return this.deps.runnerIdOf(o) === c;
+	}
+	ownerOf(ref, caller) {
+		const parts = require_dist.parseSecretRef(ref);
+		if (parts === null || !this.owns(caller, parts.owner)) throw new KeychainForbiddenError(ref, caller);
+		return parts.owner;
+	}
+	async put(caller, ref, value) {
+		const owner = this.ownerOf(ref, caller);
+		const unlocked = this.requireReady();
+		if (value.length === 0) throw new Error("keychain.put: an empty value is not stored — delete the ref");
+		const parts = require_dist.parseSecretRef(ref);
+		if (parts === null) throw new KeychainForbiddenError(ref, caller);
+		const existing = (await this.deps.repo.getSecrets([ref])).get(ref);
+		if (existing !== void 0) {
+			const current = decryptValue(unlocked.dek, ref, existing.ciphertext);
+			if (current !== null && constantTimeEquals(current, value)) return {
+				ref,
+				version: existing.version
+			};
+		}
+		const t = this.now();
+		const version = (existing?.version ?? 0) + 1;
+		await this.deps.repo.putSecret({
+			ref,
+			owner,
+			scope: require_dist.formatSecretScope(parts.scope),
+			fieldPath: parts.fieldPath,
+			ciphertext: encryptValue(unlocked.dek, unlocked.keyId, ref, value),
+			keyId: unlocked.keyId,
+			version,
+			createdAt: existing?.createdAt ?? t,
+			updatedAt: t,
+			updatedBy: actorOfAddon(caller),
+			lastReadAt: existing?.lastReadAt ?? null
+		});
+		await this.audit("put", actorOfAddon(caller), ref, `version=${version}`);
+		this.deps.events.emit({
+			ref,
+			owner,
+			version,
+			change: "put"
+		});
+		return {
+			ref,
+			version
+		};
+	}
+	async resolve(caller, refs) {
+		const out = {};
+		const owned = [];
+		for (const ref of new Set(refs)) {
+			const parts = require_dist.parseSecretRef(ref);
+			if (parts === null || !this.owns(caller, parts.owner)) {
+				out[ref] = { kind: "forbidden" };
+				continue;
+			}
+			owned.push(ref);
+		}
+		if (owned.length === 0) return out;
+		if (this.unlock.state !== "ready") {
+			for (const ref of owned) out[ref] = {
+				kind: "unavailable",
+				reason: this.unlock.reason
+			};
+			return out;
+		}
+		const unlocked = this.unlock;
+		let rows;
+		try {
+			rows = await this.deps.repo.getSecrets(owned);
+		} catch {
+			for (const ref of owned) out[ref] = {
+				kind: "unavailable",
+				reason: "store-unavailable"
+			};
+			return out;
+		}
+		const t = this.now();
+		const stale = [];
+		for (const ref of owned) {
+			const row = rows.get(ref);
+			if (row === void 0) {
+				out[ref] = { kind: "missing" };
+				continue;
+			}
+			const value = decryptValue(unlocked.dek, ref, row.ciphertext);
+			if (value === null) {
+				out[ref] = {
+					kind: "unavailable",
+					reason: "decrypt-failed"
+				};
+				this.deps.logger.error("keychain value did not authenticate", { ref });
+				continue;
+			}
+			out[ref] = {
+				kind: "value",
+				value,
+				version: row.version
+			};
+			if (row.lastReadAt === null || t - row.lastReadAt >= 36e5) stale.push(row);
+		}
+		if (stale.length > 0) this.touchLastRead(stale, t);
+		return out;
+	}
+	async touchLastRead(rows, at) {
+		try {
+			for (const row of rows) await this.deps.repo.putSecret({
+				...row,
+				lastReadAt: at
+			});
+		} catch (err) {
+			this.deps.logger.warn("keychain lastReadAt not recorded", { error: errMsg(err) });
+		}
+	}
+	async delete(caller, refs) {
+		const owners = /* @__PURE__ */ new Map();
+		for (const ref of new Set(refs)) owners.set(ref, this.ownerOf(ref, caller));
+		if (owners.size === 0) return 0;
+		const existing = await this.deps.repo.getSecrets([...owners.keys()]);
+		const present = [...owners.keys()].filter((ref) => existing.has(ref));
+		if (present.length === 0) return 0;
+		const deleted = await this.deps.repo.deleteSecrets(present);
+		for (const ref of present) {
+			await this.audit("delete", actorOfAddon(caller), ref, null);
+			this.deps.events.emit({
+				ref,
+				owner: owners.get(ref) ?? "",
+				version: null,
+				change: "delete"
+			});
+		}
+		return deleted;
+	}
+	async listMeta(caller) {
+		return (await this.deps.repo.listSecrets()).filter((row) => this.owns(caller, row.owner)).map(toMeta);
+	}
+	async status() {
+		const wraps = await this.deps.repo.listKeys().catch(() => []);
+		const secrets = await this.deps.repo.listSecrets().catch(() => []);
+		const unlocked = this.unlock.state === "ready" ? this.unlock : null;
+		const configured = this.configuredSource ?? {
+			kind: "default-file",
+			path: defaultKeyFilePath(this.deps.dataDir),
+			sharesBackupWithDatabase: true
+		};
+		return {
+			keychain: this.getState(),
+			keySource: unlocked?.source ?? null,
+			configuredSource: configured,
+			fingerprint: unlocked !== null ? shortFingerprint(unlocked.fingerprint) : null,
+			activeKeyId: unlocked?.keyId ?? null,
+			rotationPending: unlocked?.rotationPending ?? false,
+			retiredWraps: wraps.filter((w) => w.state === "retired").length,
+			recoveryKeyDownloadedAt: unlocked !== null ? wraps.find((w) => w.wrapId === unlocked.wrap.wrapId)?.recoveryDownloadedAt ?? null : null,
+			secretCount: secrets.length
+		};
+	}
+	async listSecrets() {
+		const rows = await this.deps.repo.listSecrets();
+		const usage = await this.deps.usage(rows).catch(() => /* @__PURE__ */ new Map());
+		return rows.map((row) => ({
+			...toMeta(row),
+			usage: usage.get(row.ref) ?? "unknown"
+		}));
+	}
+	async listAudit(limit) {
+		return this.deps.repo.listAudit(limit);
+	}
+	async reveal(userId, ref) {
+		const unlocked = this.requireReady();
+		const row = (await this.deps.repo.getSecrets([ref])).get(ref);
+		if (row === void 0) throw new Error(`keychain: no value stored at ${ref}`);
+		const value = decryptValue(unlocked.dek, ref, row.ciphertext);
+		if (value === null) throw new Error(`keychain: the value at ${ref} did not authenticate`);
+		await this.audit("reveal", `user:${userId}`, ref, null);
+		return {
+			value,
+			version: row.version
+		};
+	}
+	async deleteOrphans(userId, refs) {
+		const rows = [...(await this.deps.repo.getSecrets(refs)).values()];
+		const usage = await this.deps.usage(rows);
+		const deleted = [];
+		const kept = [];
+		for (const row of rows) {
+			const u = usage.get(row.ref) ?? "unknown";
+			if (u === "orphan") deleted.push(row.ref);
+			else kept.push({
+				ref: row.ref,
+				usage: u
+			});
+		}
+		if (deleted.length > 0) {
+			await this.deps.repo.deleteSecrets(deleted);
+			for (const ref of deleted) {
+				const owner = require_dist.parseSecretRef(ref)?.owner ?? "";
+				this.deps.events.emit({
+					ref,
+					owner,
+					version: null,
+					change: "delete"
+				});
+			}
+			await this.audit("delete-orphans", `user:${userId}`, null, `deleted=${deleted.length}`);
+		}
+		return {
+			deleted,
+			kept
+		};
+	}
+	async downloadRecoveryKey(userId) {
+		const unlocked = this.requireReady();
+		const t = this.now();
+		await this.deps.repo.putKey({
+			...unlocked.wrap,
+			recoveryDownloadedAt: t
+		});
+		this.unlock = {
+			...unlocked,
+			wrap: {
+				...unlocked.wrap,
+				recoveryDownloadedAt: t
+			}
+		};
+		await this.audit("download-recovery-key", `user:${userId}`, null, `source=${unlocked.source.kind}`);
+		return {
+			key: encodeKeyMaterial(unlocked.kek),
+			fingerprint: shortFingerprint(unlocked.fingerprint),
+			keySource: unlocked.source
+		};
+	}
+	/** See `keychain-admin.rotateMasterKey`. */
+	async rotateMasterKey(userId) {
+		const unlocked = this.requireReady();
+		const primary = (await this.deps.candidates()).find((c) => c.primary);
+		if (primary === void 0) throw new Error("keychain: no primary key source is configured");
+		let newKek;
+		if (unlocked.rotationPending && primary.source.kind !== unlocked.source.kind) {
+			const loaded = await primary.load();
+			if (loaded.kind !== "loaded") throw new Error(`keychain: the configured ${primary.source.kind} key could not be loaded`);
+			newKek = loaded.key;
+		} else if (primary.source.kind === "default-file") {
+			newKek = generateKey();
+			await writeDefaultKeyFile(this.deps.dataDir, newKek, {
+				replace: true,
+				nowMs: this.now()
+			});
+		} else throw new Error(`keychain: the ${primary.source.kind} key is already in use. Put the new key at its source, set the old one as keychain.previousKeyFile, restart, then rotate.`);
+		const fingerprint = kekFingerprint(newKek);
+		if (constantTimeEquals(fingerprint, unlocked.fingerprint)) throw new Error("keychain: the new master key is the one already in use");
+		const wrap = {
+			wrapId: (0, node_crypto.randomUUID)(),
+			keyId: unlocked.keyId,
+			wrappedDek: wrapDek(newKek, unlocked.dek, unlocked.keyId),
+			kekFingerprint: fingerprint,
+			kekSource: primary.source.kind,
+			createdAt: this.now(),
+			state: "active",
+			recoveryDownloadedAt: null
+		};
+		await this.deps.repo.putKey(wrap);
+		for (const old of await this.deps.repo.listKeys()) if (old.wrapId !== wrap.wrapId && old.state === "active") await this.deps.repo.putKey({
+			...old,
+			state: "retired"
+		});
+		this.unlock = {
+			state: "ready",
+			dek: unlocked.dek,
+			keyId: unlocked.keyId,
+			kek: newKek,
+			fingerprint,
+			source: primary.source,
+			wrap,
+			rotationPending: false
+		};
+		this.configuredSource = primary.source;
+		await this.audit("rotate-master-key", `user:${userId}`, null, `source=${primary.source.kind}`);
+		return {
+			fingerprint: shortFingerprint(fingerprint),
+			keySource: primary.source
+		};
+	}
+	/** Delete retired wraps, and the default file's previous copies with them. */
+	async purgeRetiredKeys(userId) {
+		this.requireReady();
+		const retired = (await this.deps.repo.listKeys()).filter((w) => w.state === "retired");
+		for (const wrap of retired) await this.deps.repo.deleteKey(wrap.wrapId);
+		const dir = node_path.dirname(defaultKeyFilePath(this.deps.dataDir));
+		try {
+			for (const name of await node_fs.promises.readdir(dir)) if (name.startsWith("master.key.prev-")) await node_fs.promises.rm(node_path.join(dir, name), { force: true });
+		} catch {}
+		await this.audit("purge-retired-keys", `user:${userId}`, null, `purged=${retired.length}`);
+		return retired.length;
+	}
+	/** Lost-key recovery — see `keychain-admin.resetKeychain`. */
+	async resetKeychain(userId) {
+		const t = this.now();
+		const archiveName = `keychain:secrets-orphaned-${t}`;
+		const archived = await this.deps.repo.archiveAllSecrets(archiveName);
+		for (const wrap of await this.deps.repo.listKeys()) await this.deps.repo.deleteKey(wrap.wrapId);
+		const primary = (await this.deps.candidates()).find((c) => c.primary) ?? null;
+		if (primary?.source.kind === "default-file") {
+			if ((await primary.load()).kind !== "absent") await writeDefaultKeyFile(this.deps.dataDir, generateKey(), {
+				replace: true,
+				nowMs: t
+			});
+		}
+		this.unlock = await this.firstBoot(primary);
+		await this.audit("reset", `user:${userId}`, null, `archived=${archived}`);
+		return {
+			archivedCollection: archived > 0 ? archiveName : null,
+			archived
+		};
+	}
+	async audit(action, actor, ref, detail) {
+		try {
+			await this.deps.repo.appendAudit({
+				id: (0, node_crypto.randomUUID)(),
+				at: this.now(),
+				action,
+				actor,
+				ref,
+				detail
+			});
+		} catch (err) {
+			this.deps.logger.warn("keychain audit row not written", {
+				action,
+				ref,
+				error: errMsg(err)
+			});
+		}
+	}
+	/** Daily ring prune, driven by the addon's timer. */
+	async pruneAudit() {
+		await this.deps.repo.pruneAudit(this.now());
+	}
+};
+function toMeta(row) {
+	return {
+		ref: row.ref,
+		owner: row.owner,
+		scope: row.scope,
+		fieldPath: row.fieldPath,
+		version: row.version,
+		createdAt: row.createdAt,
+		updatedAt: row.updatedAt,
+		updatedBy: row.updatedBy,
+		lastReadAt: row.lastReadAt
+	};
+}
+function actorOfAddon(caller) {
+	return caller === null ? "system" : `addon:${require_dist.normalizeSecretOwner(caller)}`;
+}
+function errMsg(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+require_dist.EventCategory.KeychainChanged;
+//#endregion
+//#region src/builtins/keychain/keychain-usage.ts
+/**
+* Is a stored value still pointed at? — the orphan check behind System →
+* Secrets.
+*
+* A ref says where its marker lives (owner + scope), so the check reads THAT
+* blob and looks for `{"$secret": ref}` anywhere in it. Three answers, and the
+* third is the important one: `unknown` when the blob could not be read, or
+* when the scope's store is not one this check knows how to read. A read that
+* did not answer is never "orphan" — and only an orphan can be deleted from
+* the page (D315: absence is claimed only from a query that answered).
+*/
+/** Every `$secret` ref inside a value, at any depth. */
+function collectMarkerRefs(value, out = /* @__PURE__ */ new Set()) {
+	if (Array.isArray(value)) {
+		for (const item of value) collectMarkerRefs(item, out);
+		return out;
+	}
+	if (value === null || typeof value !== "object") {
+		if (typeof value === "string" && value.includes("\"$secret\"")) try {
+			collectMarkerRefs(JSON.parse(value), out);
+		} catch {}
+		return out;
+	}
+	const ref = Reflect.get(value, "$secret");
+	if (typeof ref === "string") out.add(ref);
+	for (const child of Object.values(value)) collectMarkerRefs(child, out);
+	return out;
+}
+/** Rows under an ASCII id prefix, one bounded page; `null` when the page filled. */
+async function prefixRows(door, collection, prefix) {
+	const hi = `${prefix.slice(0, -1)}${String.fromCharCode(prefix.charCodeAt(prefix.length - 1) + 1)}`;
+	const LIMIT = 2e3;
+	const rows = await door.query({
+		collection,
+		filter: {
+			whereBetween: { id: [prefix, hi] },
+			limit: LIMIT
+		}
+	});
+	if (rows.length >= LIMIT) return null;
+	return rows.filter((r) => r.id.startsWith(prefix)).map((r) => r.data);
+}
+/** The blobs that may hold the marker of a ref in `scope`; `null` = cannot tell. */
+async function blobsFor(door, owner, scope) {
+	switch (scope.kind) {
+		case "global":
+		case "node": {
+			const forked = await door.get({
+				namespace: owner,
+				collection: "addon-settings",
+				key: "root"
+			});
+			const inProcess = await prefixRows(door, "addon-settings", `${owner}.`);
+			if (inProcess === null) return null;
+			return [forked, ...inProcess];
+		}
+		case "device": {
+			const forked = await door.get({
+				namespace: owner,
+				collection: "addon-devices",
+				key: String(scope.deviceId)
+			});
+			const doorRows = await prefixRows(door, "addon-device-settings", `device-manager:${scope.deviceId}.`);
+			if (doorRows === null) return null;
+			return [forked, ...doorRows];
+		}
+		case "integration": return (await door.query({
+			collection: "integration_settings",
+			filter: {
+				where: { integration_id: scope.integrationId },
+				limit: 2e3
+			}
+		})).map((r) => r.data);
+		case "row": return [await door.get({
+			collection: scope.collection,
+			key: scope.rowId
+		})];
+	}
+}
+/** Build the usage check the service uses. */
+function createKeychainUsageCheck(door) {
+	return async (rows) => {
+		const out = /* @__PURE__ */ new Map();
+		const groups = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const parts = require_dist.parseSecretRef(row.ref);
+			if (parts === null) {
+				out.set(row.ref, "unknown");
+				continue;
+			}
+			const key = `${parts.owner}|${row.scope}`;
+			const group = groups.get(key) ?? {
+				owner: parts.owner,
+				scope: parts.scope,
+				refs: []
+			};
+			group.refs.push(row.ref);
+			groups.set(key, group);
+		}
+		for (const group of groups.values()) {
+			let blobs;
+			try {
+				blobs = await blobsFor(door, group.owner, group.scope);
+			} catch {
+				blobs = null;
+			}
+			if (blobs === null) {
+				for (const ref of group.refs) out.set(ref, "unknown");
+				continue;
+			}
+			const seen = /* @__PURE__ */ new Set();
+			for (const blob of blobs) collectMarkerRefs(blob, seen);
+			for (const ref of group.refs) out.set(ref, seen.has(ref) ? "in-use" : "orphan");
+		}
+		return out;
+	};
+}
+//#endregion
+//#region src/builtins/keychain/keychain.addon.ts
+/**
+* `keychain` — hub-only, in-process builtin that owns every secret value
+* (D787). Boots in the infrastructure pass, right after the settings door, so
+* a forked addon's first `resolveConfig` already finds it.
+*
+* Registers two caps from one service:
+*  - `keychain` (internal): the owner's door — put / resolve / delete /
+*    listMeta / getState, owner-checked against the caller the transport
+*    stamped (`callerAddonId`, never in the input schema);
+*  - `keychain-admin`: System → Secrets — status, list, audit, reveal,
+*    orphans, rotation, recovery key, reset. Every method admin; the four
+*    that change or hand out material take the session's user for the audit.
+*
+* It does not run on agents: an agent's Phase 1 drops `keychain` from its infra
+* list (`server/backend/src/agent/agent-infra-capabilities.ts`), and an agent
+* addon reaches it through `$hub-cap-fwd` like every other hub cap. Until
+* 2026-10-08 agents DID boot it — their store door forwards to the hub, so an
+* agent wrote the hub's `keychain:keys` row with a key file on its own disk.
+* Booting first, it left the hub locked `key-missing`.
+*/
+var DAY_MS = 1440 * 6e4;
+/** The caller the transport stamped (or an in-process caller stated). */
+function callerOf(input) {
+	if (input === null || typeof input !== "object") return null;
+	const raw = Reflect.get(input, "callerAddonId");
+	return typeof raw === "string" && raw.length > 0 ? raw : null;
+}
+function readKeyConfig(section) {
+	const keyFile = section["keyFile"];
+	const previousKeyFile = section["previousKeyFile"];
+	return {
+		keyFile: typeof keyFile === "string" && keyFile.length > 0 ? keyFile : void 0,
+		previousKeyFile: typeof previousKeyFile === "string" && previousKeyFile.length > 0 ? previousKeyFile : void 0
+	};
+}
+var KeychainAddon = class extends require_dist.BaseAddon {
+	id = "keychain";
+	pruneTimer = null;
+	constructor() {
+		super({});
+	}
+	async onInitialize() {
+		const ctx = this.ctx;
+		const store = ctx.api.settingsStore;
+		const door = {
+			declareCollection: (input) => store.declareCollection.mutate(input),
+			get: (input) => store.get.query(input),
+			set: (input) => store.set.mutate(input),
+			query: (input) => store.query.query(input),
+			delete: (input) => store.delete.mutate(input),
+			deleteWhere: (input) => store.deleteWhere.mutate(input)
+		};
+		const dataDir = ctx.nodeDataDir;
+		const runnerIdOf = ctx.kernel.runnerIdForAddon ?? ((addonId) => addonId);
+		const service = new KeychainService({
+			repo: new KeychainRepository(door),
+			candidates: async () => {
+				return buildKeySourceCandidates({
+					config: readKeyConfig(await ctx.settings?.getSection("keychain") ?? {}),
+					dataDir
+				});
+			},
+			dataDir,
+			events: { emit: (payload) => {
+				ctx.eventBus.emit({
+					id: `keychain-${payload.ref}-${Date.now()}`,
+					timestamp: /* @__PURE__ */ new Date(),
+					source: {
+						type: "addon",
+						id: "keychain"
+					},
+					category: require_dist.EventCategory.KeychainChanged,
+					data: payload
+				});
+			} },
+			logger: {
+				info: (message, meta) => ctx.logger.info(message, meta ? { meta } : void 0),
+				warn: (message, meta) => ctx.logger.warn(message, meta ? { meta } : void 0),
+				error: (message, meta) => ctx.logger.error(message, meta ? { meta } : void 0)
+			},
+			runnerIdOf,
+			usage: createKeychainUsageCheck(door)
+		});
+		await service.init();
+		this.pruneTimer = setInterval(() => {
+			service.pruneAudit().catch((err) => {
+				ctx.logger.warn("keychain audit prune failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			});
+		}, DAY_MS);
+		this.pruneTimer.unref?.();
+		return [{
+			capability: require_dist.keychainCapability,
+			provider: {
+				put: (input) => service.put(callerOf(input), input.ref, input.value),
+				resolve: (input) => service.resolve(callerOf(input), input.refs),
+				delete: async (input) => ({ deleted: await service.delete(callerOf(input), input.refs) }),
+				listMeta: (input) => service.listMeta(callerOf(input)),
+				getState: async () => service.getState()
+			}
+		}, {
+			capability: require_dist.keychainAdminCapability,
+			provider: {
+				status: () => service.status(),
+				listSecrets: () => service.listSecrets(),
+				listAudit: (input) => service.listAudit(input.limit ?? 100),
+				reveal: (input) => service.reveal(input.caller.userId, input.ref),
+				deleteOrphans: (input) => service.deleteOrphans(input.caller.userId, input.refs),
+				rotateMasterKey: (input) => service.rotateMasterKey(input.caller.userId),
+				purgeRetiredKeys: async (input) => ({ purged: await service.purgeRetiredKeys(input.caller.userId) }),
+				downloadRecoveryKey: (input) => service.downloadRecoveryKey(input.caller.userId),
+				resetKeychain: (input) => service.resetKeychain(input.caller.userId)
+			}
+		}];
+	}
+	async onShutdown() {
+		if (this.pruneTimer !== null) clearInterval(this.pruneTimer);
+		this.pruneTimer = null;
+	}
+};
+//#endregion
+exports.KeychainAddon = KeychainAddon;
+exports.default = KeychainAddon;