@camstack/system 1.2.381 → 1.2.382

package/dist/builtins/keychain/index.mjs

@@ -1,6 +1,6 @@
-import { Br as parseSecretRef, Gt as keychainCapability, Lr as normalizeSecretOwner, Or as formatSecretScope, Qr as EventCategory, Wt as keychainAdminCapability, lr as BaseAddon } from "../../dist-BC0GnGeg.mjs";
-import { r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-CsuVKA1W.mjs";
-import { i as CLUSTER_SECRET_SETTINGS_KEY } from "../../cluster-secret-DgJTZ4qY.mjs";
+import { E as KEYCHAIN_RESET_TRIGGER_ACTOR, Gt as keychainAdminCapability, Hr as parseSecretRef, Kt as keychainCapability, ei as EventCategory, kr as formatSecretScope, ur as BaseAddon, zr as normalizeSecretOwner } from "../../dist-CP5TTjwd.mjs";
+import { r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-CAbozwvF.mjs";
+import { i as CLUSTER_SECRET_SETTINGS_KEY } from "../../cluster-secret-DhPdZ0VA.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import * as path$1 from "node:path";
@@ -231,406 +231,120 @@ async function writeKeyFileAt(file, key, opts) {
 	return movedAside;
 }
 //#endregion
-//#region src/builtins/keychain/keychain-store.ts
-/**
-* @durable class=config owner=keychain
-*   write="`keychain.put` upserts one row per ref; `delete` removes it"
-*   retention="none — a row lives until its owner deletes the ref or the
-*     operator deletes it as an orphan. Losing the table loses every secret
-*     value; the settings blobs then point at refs that resolve `missing`."
-*/
-var KEYCHAIN_SECRETS_COLLECTION = "keychain:secrets";
-/**
-* @durable class=config owner=keychain
-*   write="first boot writes the wrapped data key; `rotateMasterKey` adds a
-*     wrap and retires the previous one"
-*   retention="retired wraps until `purgeRetiredKeys`. Losing the table with
-*     the secrets intact makes every value undecryptable."
-*/
-var KEYCHAIN_KEYS_COLLECTION = "keychain:keys";
+//#region src/builtins/keychain/keychain-reset-trigger.ts
 /**
-* @durable class=ring owner=keychain
-*   write="one row per write / delete / rotation / reveal / recovery download"
-*   retention="90 days and at most 20 000 rows, pruned at boot and daily"
+* The one-shot `RESET_KEYCHAIN` trigger file — the way back into a hub whose
+* master key is lost (operator decision 2026-10-09; plan §2).
+*
+* ## Why a file
+*
+* A locked keychain cannot be reset from System → Secrets: the session signing
+* key lives IN the keychain (D797), so no login and no bearer token verifies,
+* and every admin credential is a signing-key JWT. Whoever can write the data
+* directory can already read the default master key, so a file there is the
+* same trust boundary as the key itself — and it needs nothing but host access
+* (works in a stopped container's volume, no extra binary). The pattern is
+* `RESET_ADMIN_PASSWORD`'s (`local-auth/admin-account-boot.ts`).
+*
+* ## Behaviour
+*
+* Checked once at keychain boot, right after the unlock:
+*
+*  - absent → nothing;
+*  - the keychain is UNLOCKED → ignored and deleted, with a warning. A working
+*    store is never destroyed by a file someone forgot;
+*  - locked for a key reason (`wrong-key`, `key-missing`, `key-file-unreadable`)
+*    → `KeychainService.resetAs('trigger-file')`: values and wrapped keys
+*    archived, a new master key and data key, the system-held markers cleared,
+*    the file deleted, and an error-level banner naming what to re-enter;
+*  - a reset that cannot end unlocked (a configured key file that is missing)
+*    is refused BEFORE anything is archived; the file is still deleted (one
+*    shot — fix the key source and create it again);
+*  - locked because the STORE cannot be read → left armed: nothing could be
+*    reset, and the next boot that reaches the store decides.
+*
+* NO environment variable arms it. A flag left in a container template would
+* re-arm on every boot; a file the hub deletes cannot.
 */
-var KEYCHAIN_AUDIT_COLLECTION = "keychain:audit";
-var AUDIT_RETENTION_MS = 2160 * 60 * 6e4;
-var AUDIT_MAX_ROWS = 2e4;
-var SECRET_COLUMNS = [
-	{
-		name: "ref",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "owner",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "scope",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "fieldPath",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "ciphertext",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "keyId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "version",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "updatedAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "updatedBy",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "lastReadAt",
-		type: "INTEGER"
-	}
-];
-var KEY_COLUMNS = [
-	{
-		name: "wrapId",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "keyId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "wrappedDek",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "kekFingerprint",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "kekSource",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "state",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "recoveryDownloadedAt",
-		type: "INTEGER"
-	}
-];
-var AUDIT_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "at",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "action",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "actor",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "ref",
-		type: "TEXT"
-	},
-	{
-		name: "detail",
-		type: "TEXT"
-	}
-];
-function str(data, key) {
-	const v = data[key];
-	return typeof v === "string" ? v : "";
-}
-function num(data, key) {
-	const v = data[key];
-	return typeof v === "number" ? v : Number(v ?? 0);
-}
-function numOrNull(data, key) {
-	const v = data[key];
-	if (v === null || v === void 0) return null;
-	const n = typeof v === "number" ? v : Number(v);
-	return Number.isFinite(n) ? n : null;
-}
-function strOrNull(data, key) {
-	const v = data[key];
-	return typeof v === "string" ? v : null;
-}
-function toSecretRow(id, data) {
-	return {
-		ref: str(data, "ref") || id,
-		owner: str(data, "owner"),
-		scope: str(data, "scope"),
-		fieldPath: str(data, "fieldPath"),
-		ciphertext: str(data, "ciphertext"),
-		keyId: str(data, "keyId"),
-		version: num(data, "version"),
-		createdAt: num(data, "createdAt"),
-		updatedAt: num(data, "updatedAt"),
-		updatedBy: str(data, "updatedBy"),
-		lastReadAt: numOrNull(data, "lastReadAt")
-	};
+/** The trigger's name, inside `<dataDir>/.keychain/`. */
+var KEYCHAIN_RESET_TRIGGER = "RESET_KEYCHAIN";
+/** Lock reasons a reset can cure — the master key, not the store. */
+var RESETTABLE_REASONS = new Set([
+	"wrong-key",
+	"key-missing",
+	"key-file-unreadable"
+]);
+function keychainResetTriggerPath(dataDir) {
+	return path$1.join(dataDir, ".keychain", KEYCHAIN_RESET_TRIGGER);
 }
-function toKeyRow(id, data) {
-	const state = str(data, "state");
-	return {
-		wrapId: str(data, "wrapId") || id,
-		keyId: str(data, "keyId"),
-		wrappedDek: str(data, "wrappedDek"),
-		kekFingerprint: str(data, "kekFingerprint"),
-		kekSource: str(data, "kekSource"),
-		createdAt: num(data, "createdAt"),
-		state: state === "retired" ? "retired" : "active",
-		recoveryDownloadedAt: numOrNull(data, "recoveryDownloadedAt")
-	};
+async function triggerExists(file) {
+	try {
+		await promises.access(file);
+		return true;
+	} catch {
+		return false;
+	}
 }
-var AUDIT_ACTIONS = new Set([
-	"put",
-	"delete",
-	"reveal",
-	"rotate-master-key",
-	"purge-retired-keys",
-	"download-recovery-key",
-	"delete-orphans",
-	"reset",
-	"initialize"
-]);
-function isAuditAction(value) {
-	return AUDIT_ACTIONS.has(value);
+async function consume(file, logger) {
+	try {
+		await promises.rm(file, { force: true });
+	} catch (err) {
+		logger.error("Could not delete the RESET_KEYCHAIN trigger — delete it by hand, or the next boot with a locked keychain resets it again", {
+			trigger: file,
+			error: err instanceof Error ? err.message : String(err)
+		});
+	}
 }
-function toAuditRow(id, data) {
-	const action = str(data, "action");
-	if (!isAuditAction(action)) return null;
+async function applyKeychainResetTrigger(input) {
+	const { service, logger } = input;
+	const file = keychainResetTriggerPath(input.dataDir);
+	if (!await triggerExists(file)) return { kind: "absent" };
+	const state = service.getState();
+	if (state.state === "ready") {
+		logger.warn("RESET_KEYCHAIN ignored: the keychain is unlocked, so nothing is lost and nothing is reset. The trigger file was deleted.", { trigger: file });
+		await consume(file, logger);
+		return { kind: "ignored-unlocked" };
+	}
+	if (!RESETTABLE_REASONS.has(state.reason)) {
+		logger.error("RESET_KEYCHAIN not acted on yet: the keychain is locked because its store cannot be read, not because of the master key. The trigger stays until a boot can reach the store.", {
+			trigger: file,
+			reason: state.reason
+		});
+		return {
+			kind: "deferred",
+			reason: state.reason
+		};
+	}
+	let record;
+	try {
+		record = await service.resetAs(KEYCHAIN_RESET_TRIGGER_ACTOR);
+	} catch (err) {
+		const error = err instanceof Error ? err.message : String(err);
+		logger.error(`RESET_KEYCHAIN refused — nothing was archived, the keychain is still locked: ${error}. The trigger file was deleted; fix the key source and create it again.`, {
+			trigger: file,
+			reason: state.reason
+		});
+		await consume(file, logger);
+		return {
+			kind: "refused",
+			error
+		};
+	}
+	await consume(file, logger);
+	const toReenter = ((await service.resetReport().catch(() => null))?.pendingReentry ?? []).map((m) => `${m.owner}:${m.scope}:${m.fieldPath}`);
+	logger.error("*** KEYCHAIN RESET by the RESET_KEYCHAIN trigger file *** Every stored secret was archived (unreadable without the lost master key) and a new master key and data key were created. Every secret field now reads \"not set\" — re-enter them (System → Secrets lists them). The session signing key is regenerated: everyone signs in again. The cluster secret was cleared: set it again in System → Cluster if agents used one.", {
+		lockedReason: state.reason,
+		archived: record.archived,
+		archivedCollection: record.archivedCollection,
+		archivedKeysCollection: record.archivedKeysCollection,
+		clearedSettingsKeys: record.clearedSettingsKeys,
+		toReenter
+	});
 	return {
-		id: str(data, "id") || id,
-		at: num(data, "at"),
-		action,
-		actor: str(data, "actor"),
-		ref: strOrNull(data, "ref"),
-		detail: strOrNull(data, "detail")
+		kind: "reset",
+		record
 	};
 }
-/** Rows one listing page asks for — the table is small, but a read names its bound. */
-var PAGE = 1e3;
-var KeychainRepository = class {
-	door;
-	constructor(door) {
-		this.door = door;
-	}
-	async init() {
-		await this.door.declareCollection({
-			collection: KEYCHAIN_SECRETS_COLLECTION,
-			columns: SECRET_COLUMNS,
-			indexes: [{
-				name: "idx_keychain_secrets_owner",
-				columns: ["owner"]
-			}]
-		});
-		await this.door.declareCollection({
-			collection: KEYCHAIN_KEYS_COLLECTION,
-			columns: KEY_COLUMNS
-		});
-		await this.door.declareCollection({
-			collection: KEYCHAIN_AUDIT_COLLECTION,
-			columns: AUDIT_COLUMNS,
-			indexes: [{
-				name: "idx_keychain_audit_at",
-				columns: ["at"]
-			}]
-		});
-	}
-	async getSecrets(refs) {
-		const out = /* @__PURE__ */ new Map();
-		if (refs.length === 0) return out;
-		const rows = await this.door.query({
-			collection: KEYCHAIN_SECRETS_COLLECTION,
-			filter: {
-				whereIn: { ref: [...refs] },
-				limit: refs.length
-			}
-		});
-		for (const row of rows) {
-			const parsed = toSecretRow(row.id, row.data);
-			out.set(parsed.ref, parsed);
-		}
-		return out;
-	}
-	/** Every row, paged by primary key. */
-	async listSecrets() {
-		const out = [];
-		for (let offset = 0;; offset += PAGE) {
-			const rows = await this.door.query({
-				collection: KEYCHAIN_SECRETS_COLLECTION,
-				filter: {
-					orderBy: {
-						field: "ref",
-						direction: "asc"
-					},
-					limit: PAGE,
-					offset
-				}
-			});
-			for (const row of rows) out.push(toSecretRow(row.id, row.data));
-			if (rows.length < PAGE) return out;
-		}
-	}
-	async putSecret(row) {
-		await this.door.set({
-			collection: KEYCHAIN_SECRETS_COLLECTION,
-			key: row.ref,
-			value: row
-		});
-	}
-	async deleteSecrets(refs) {
-		if (refs.length === 0) return 0;
-		return (await this.door.deleteWhere({
-			collection: KEYCHAIN_SECRETS_COLLECTION,
-			filter: { whereIn: { ref: [...refs] } }
-		})).deleted;
-	}
-	async listKeys() {
-		return (await this.door.query({
-			collection: KEYCHAIN_KEYS_COLLECTION,
-			filter: {
-				orderBy: {
-					field: "createdAt",
-					direction: "asc"
-				},
-				limit: PAGE
-			}
-		})).map((row) => toKeyRow(row.id, row.data));
-	}
-	async putKey(row) {
-		await this.door.set({
-			collection: KEYCHAIN_KEYS_COLLECTION,
-			key: row.wrapId,
-			value: row
-		});
-	}
-	async deleteKey(wrapId) {
-		await this.door.delete({
-			collection: KEYCHAIN_KEYS_COLLECTION,
-			key: wrapId
-		});
-	}
-	async appendAudit(row) {
-		await this.door.set({
-			collection: KEYCHAIN_AUDIT_COLLECTION,
-			key: row.id,
-			value: row
-		});
-	}
-	async listAudit(limit) {
-		const rows = await this.door.query({
-			collection: KEYCHAIN_AUDIT_COLLECTION,
-			filter: {
-				orderBy: {
-					field: "at",
-					direction: "desc"
-				},
-				limit
-			}
-		});
-		const out = [];
-		for (const row of rows) {
-			const parsed = toAuditRow(row.id, row.data);
-			if (parsed !== null) out.push(parsed);
-		}
-		return out;
-	}
-	/** Drop audit rows older than the retention window, then beyond the row bound. */
-	async pruneAudit(nowMs) {
-		const aged = await this.door.deleteWhere({
-			collection: KEYCHAIN_AUDIT_COLLECTION,
-			filter: { whereBetween: { at: [0, nowMs - AUDIT_RETENTION_MS] } }
-		});
-		const cutoff = (await this.door.query({
-			collection: KEYCHAIN_AUDIT_COLLECTION,
-			filter: {
-				orderBy: {
-					field: "at",
-					direction: "desc"
-				},
-				limit: 1,
-				offset: AUDIT_MAX_ROWS
-			}
-		}))[0]?.data["at"];
-		if (typeof cutoff !== "number") return aged.deleted;
-		const bounded = await this.door.deleteWhere({
-			collection: KEYCHAIN_AUDIT_COLLECTION,
-			filter: { whereBetween: { at: [0, cutoff] } }
-		});
-		return aged.deleted + bounded.deleted;
-	}
-	/**
-	* Lost-key recovery: copy every secret row into `archive`, then empty the
-	* live table. The archive is ciphertext under a key nobody has — it exists
-	* so a key that turns up later can still recover it.
-	*/
-	async archiveAllSecrets(archive) {
-		const rows = await this.listSecrets();
-		if (rows.length === 0) return 0;
-		await this.door.declareCollection({
-			collection: archive,
-			columns: SECRET_COLUMNS
-		});
-		for (const row of rows) await this.door.set({
-			collection: archive,
-			key: row.ref,
-			value: row
-		});
-		await this.deleteSecrets(rows.map((r) => r.ref));
-		return rows.length;
-	}
-};
 //#endregion
 //#region src/builtins/keychain/system-held-secrets.ts
 /** The refs `keychain-admin.setSystemSecret` may write, by name. */
@@ -647,6 +361,13 @@ var KeychainLockedError = class extends Error {
 		this.name = "KeychainLockedError";
 	}
 };
+/** A reset that would archive the values and still end locked — refused before it starts. */
+var KeychainResetRefusedError = class extends Error {
+	constructor(reason) {
+		super(`keychain reset refused: ${reason}`);
+		this.name = "KeychainResetRefusedError";
+	}
+};
 var KeychainForbiddenError = class extends Error {
 	ref;
 	constructor(ref, caller) {
@@ -849,370 +570,1011 @@ var KeychainService = class {
 		if (parts === null || !this.owns(caller, parts.owner)) throw new KeychainForbiddenError(ref, caller);
 		return parts.owner;
 	}
-	/**
-	* @param actor who the audit names — the owner addon by default; the
-	*   operator (`user:<id>`) for {@link setSystemSecret}.
-	*/
-	async put(caller, ref, value, actor = actorOfAddon(caller)) {
-		const owner = this.ownerOf(ref, caller);
-		const unlocked = this.requireReady();
-		if (value.length === 0) throw new Error("keychain.put: an empty value is not stored — delete the ref");
-		const parts = parseSecretRef(ref);
-		if (parts === null) throw new KeychainForbiddenError(ref, caller);
-		const existing = (await this.deps.repo.getSecrets([ref])).get(ref);
-		if (existing !== void 0) {
-			const current = decryptValue(unlocked.dek, ref, existing.ciphertext);
-			if (current !== null && constantTimeEquals(current, value)) return {
-				ref,
-				version: existing.version
-			};
-		}
-		const t = this.now();
-		const version = (existing?.version ?? 0) + 1;
-		await this.deps.repo.putSecret({
-			ref,
-			owner,
-			scope: formatSecretScope(parts.scope),
-			fieldPath: parts.fieldPath,
-			ciphertext: encryptValue(unlocked.dek, unlocked.keyId, ref, value),
-			keyId: unlocked.keyId,
-			version,
-			createdAt: existing?.createdAt ?? t,
-			updatedAt: t,
-			updatedBy: actor,
-			lastReadAt: existing?.lastReadAt ?? null
+	/**
+	* @param actor who the audit names — the owner addon by default; the
+	*   operator (`user:<id>`) for {@link setSystemSecret}.
+	*/
+	async put(caller, ref, value, actor = actorOfAddon(caller)) {
+		const owner = this.ownerOf(ref, caller);
+		const unlocked = this.requireReady();
+		if (value.length === 0) throw new Error("keychain.put: an empty value is not stored — delete the ref");
+		const parts = parseSecretRef(ref);
+		if (parts === null) throw new KeychainForbiddenError(ref, caller);
+		const existing = (await this.deps.repo.getSecrets([ref])).get(ref);
+		if (existing !== void 0) {
+			const current = decryptValue(unlocked.dek, ref, existing.ciphertext);
+			if (current !== null && constantTimeEquals(current, value)) return {
+				ref,
+				version: existing.version
+			};
+		}
+		const t = this.now();
+		const version = (existing?.version ?? 0) + 1;
+		await this.deps.repo.putSecret({
+			ref,
+			owner,
+			scope: formatSecretScope(parts.scope),
+			fieldPath: parts.fieldPath,
+			ciphertext: encryptValue(unlocked.dek, unlocked.keyId, ref, value),
+			keyId: unlocked.keyId,
+			version,
+			createdAt: existing?.createdAt ?? t,
+			updatedAt: t,
+			updatedBy: actor,
+			lastReadAt: existing?.lastReadAt ?? null
+		});
+		await this.audit("put", actor, ref, `version=${version}`);
+		this.deps.events.emit({
+			ref,
+			owner,
+			version,
+			change: "put"
+		});
+		return {
+			ref,
+			version
+		};
+	}
+	async resolve(caller, refs) {
+		const out = {};
+		const owned = [];
+		for (const ref of new Set(refs)) {
+			const parts = parseSecretRef(ref);
+			if (parts === null || !this.owns(caller, parts.owner)) {
+				out[ref] = { kind: "forbidden" };
+				continue;
+			}
+			owned.push(ref);
+		}
+		if (owned.length === 0) return out;
+		if (this.unlock.state !== "ready") {
+			for (const ref of owned) out[ref] = {
+				kind: "unavailable",
+				reason: this.unlock.reason
+			};
+			return out;
+		}
+		const unlocked = this.unlock;
+		let rows;
+		try {
+			rows = await this.deps.repo.getSecrets(owned);
+		} catch {
+			for (const ref of owned) out[ref] = {
+				kind: "unavailable",
+				reason: "store-unavailable"
+			};
+			return out;
+		}
+		const t = this.now();
+		const stale = [];
+		for (const ref of owned) {
+			const row = rows.get(ref);
+			if (row === void 0) {
+				out[ref] = { kind: "missing" };
+				continue;
+			}
+			const value = decryptValue(unlocked.dek, ref, row.ciphertext);
+			if (value === null) {
+				out[ref] = {
+					kind: "unavailable",
+					reason: "decrypt-failed"
+				};
+				this.deps.logger.error("keychain value did not authenticate", { ref });
+				continue;
+			}
+			out[ref] = {
+				kind: "value",
+				value,
+				version: row.version
+			};
+			if (row.lastReadAt === null || t - row.lastReadAt >= 36e5) stale.push(row);
+		}
+		if (stale.length > 0) this.touchLastRead(stale, t);
+		return out;
+	}
+	async touchLastRead(rows, at) {
+		try {
+			for (const row of rows) await this.deps.repo.putSecret({
+				...row,
+				lastReadAt: at
+			});
+		} catch (err) {
+			this.deps.logger.warn("keychain lastReadAt not recorded", { error: errMsg(err) });
+		}
+	}
+	async delete(caller, refs) {
+		const owners = /* @__PURE__ */ new Map();
+		for (const ref of new Set(refs)) owners.set(ref, this.ownerOf(ref, caller));
+		if (owners.size === 0) return 0;
+		const existing = await this.deps.repo.getSecrets([...owners.keys()]);
+		const present = [...owners.keys()].filter((ref) => existing.has(ref));
+		if (present.length === 0) return 0;
+		const deleted = await this.deps.repo.deleteSecrets(present);
+		for (const ref of present) {
+			await this.audit("delete", actorOfAddon(caller), ref, null);
+			this.deps.events.emit({
+				ref,
+				owner: owners.get(ref) ?? "",
+				version: null,
+				change: "delete"
+			});
+		}
+		return deleted;
+	}
+	async listMeta(caller) {
+		return (await this.deps.repo.listSecrets()).filter((row) => this.owns(caller, row.owner)).map(toMeta);
+	}
+	async status() {
+		const wraps = await this.deps.repo.listKeys().catch(() => []);
+		const secrets = await this.deps.repo.listSecrets().catch(() => []);
+		const unlocked = this.unlock.state === "ready" ? this.unlock : null;
+		const configured = this.configuredSource ?? {
+			kind: "default-file",
+			path: defaultKeyFilePath(this.deps.dataDir),
+			sharesBackupWithDatabase: true
+		};
+		return {
+			keychain: this.getState(),
+			keySource: unlocked?.source ?? null,
+			configuredSource: configured,
+			fingerprint: unlocked !== null ? shortFingerprint(unlocked.fingerprint) : null,
+			activeKeyId: unlocked?.keyId ?? null,
+			rotationPending: unlocked?.rotationPending ?? false,
+			retiredWraps: wraps.filter((w) => w.state === "retired").length,
+			recoveryKeyDownloadedAt: unlocked !== null ? wraps.find((w) => w.wrapId === unlocked.wrap.wrapId)?.recoveryDownloadedAt ?? null : null,
+			secretCount: secrets.length,
+			lastReset: await this.deps.repo.latestReset().catch(() => null)
+		};
+	}
+	async listSecrets() {
+		const rows = await this.deps.repo.listSecrets();
+		const usage = await this.deps.usage(rows).catch(() => /* @__PURE__ */ new Map());
+		return rows.map((row) => ({
+			...toMeta(row),
+			usage: usage.get(row.ref) ?? "unknown"
+		}));
+	}
+	/**
+	* The operator replaces a system-held secret no form edits (D797) — the
+	* session signing key. Stored under owner `system`, audited as the user.
+	*/
+	async setSystemSecret(userId, name, value) {
+		const ref = SYSTEM_HELD_SECRET_REFS[name];
+		return this.put(SYSTEM_SECRET_OWNER, ref, value, `user:${userId}`);
+	}
+	async listAudit(limit) {
+		return this.deps.repo.listAudit(limit);
+	}
+	async reveal(userId, ref) {
+		const unlocked = this.requireReady();
+		const row = (await this.deps.repo.getSecrets([ref])).get(ref);
+		if (row === void 0) throw new Error(`keychain: no value stored at ${ref}`);
+		const value = decryptValue(unlocked.dek, ref, row.ciphertext);
+		if (value === null) throw new Error(`keychain: the value at ${ref} did not authenticate`);
+		await this.audit("reveal", `user:${userId}`, ref, null);
+		return {
+			value,
+			version: row.version
+		};
+	}
+	async deleteOrphans(userId, refs) {
+		const rows = [...(await this.deps.repo.getSecrets(refs)).values()];
+		const usage = await this.deps.usage(rows);
+		const deleted = [];
+		const kept = [];
+		for (const row of rows) {
+			const u = usage.get(row.ref) ?? "unknown";
+			if (u === "orphan") deleted.push(row.ref);
+			else kept.push({
+				ref: row.ref,
+				usage: u
+			});
+		}
+		if (deleted.length > 0) {
+			await this.deps.repo.deleteSecrets(deleted);
+			for (const ref of deleted) {
+				const owner = parseSecretRef(ref)?.owner ?? "";
+				this.deps.events.emit({
+					ref,
+					owner,
+					version: null,
+					change: "delete"
+				});
+			}
+			await this.audit("delete-orphans", `user:${userId}`, null, `deleted=${deleted.length}`);
+		}
+		return {
+			deleted,
+			kept
+		};
+	}
+	async downloadRecoveryKey(userId) {
+		const unlocked = this.requireReady();
+		const t = this.now();
+		await this.deps.repo.putKey({
+			...unlocked.wrap,
+			recoveryDownloadedAt: t
+		});
+		this.unlock = {
+			...unlocked,
+			wrap: {
+				...unlocked.wrap,
+				recoveryDownloadedAt: t
+			}
+		};
+		await this.audit("download-recovery-key", `user:${userId}`, null, `source=${unlocked.source.kind}`);
+		return {
+			key: encodeKeyMaterial(unlocked.kek),
+			fingerprint: shortFingerprint(unlocked.fingerprint),
+			keySource: unlocked.source
+		};
+	}
+	/** See `keychain-admin.rotateMasterKey`. */
+	async rotateMasterKey(userId) {
+		const unlocked = this.requireReady();
+		const primary = (await this.deps.candidates()).find((c) => c.primary);
+		if (primary === void 0) throw new Error("keychain: no primary key source is configured");
+		let newKek;
+		if (unlocked.rotationPending && primary.source.kind !== unlocked.source.kind) {
+			const loaded = await primary.load();
+			if (loaded.kind !== "loaded") throw new Error(`keychain: the configured ${primary.source.kind} key could not be loaded`);
+			newKek = loaded.key;
+		} else if (primary.source.kind === "default-file") {
+			newKek = generateKey();
+			await writeDefaultKeyFile(this.deps.dataDir, newKek, {
+				replace: true,
+				nowMs: this.now()
+			});
+		} else throw new Error(`keychain: the ${primary.source.kind} key is already in use. Put the new key at its source, set the old one as keychain.previousKeyFile, restart, then rotate.`);
+		const fingerprint = kekFingerprint(newKek);
+		if (constantTimeEquals(fingerprint, unlocked.fingerprint)) throw new Error("keychain: the new master key is the one already in use");
+		const wrap = {
+			wrapId: randomUUID(),
+			keyId: unlocked.keyId,
+			wrappedDek: wrapDek(newKek, unlocked.dek, unlocked.keyId),
+			kekFingerprint: fingerprint,
+			kekSource: primary.source.kind,
+			createdAt: this.now(),
+			state: "active",
+			recoveryDownloadedAt: null
+		};
+		await this.deps.repo.putKey(wrap);
+		for (const old of await this.deps.repo.listKeys()) if (old.wrapId !== wrap.wrapId && old.state === "active") await this.deps.repo.putKey({
+			...old,
+			state: "retired"
+		});
+		this.unlock = {
+			state: "ready",
+			dek: unlocked.dek,
+			keyId: unlocked.keyId,
+			kek: newKek,
+			fingerprint,
+			source: primary.source,
+			wrap,
+			rotationPending: false
+		};
+		this.configuredSource = primary.source;
+		await this.audit("rotate-master-key", `user:${userId}`, null, `source=${primary.source.kind}`);
+		return {
+			fingerprint: shortFingerprint(fingerprint),
+			keySource: primary.source
+		};
+	}
+	/** Delete retired wraps, and the default file's previous copies with them. */
+	async purgeRetiredKeys(userId) {
+		this.requireReady();
+		const retired = (await this.deps.repo.listKeys()).filter((w) => w.state === "retired");
+		for (const wrap of retired) await this.deps.repo.deleteKey(wrap.wrapId);
+		const dir = path$1.dirname(defaultKeyFilePath(this.deps.dataDir));
+		try {
+			for (const name of await promises.readdir(dir)) if (name.startsWith("master.key.prev-")) await promises.rm(path$1.join(dir, name), { force: true });
+		} catch {}
+		await this.audit("purge-retired-keys", `user:${userId}`, null, `purged=${retired.length}`);
+		return retired.length;
+	}
+	/** Lost-key recovery from System → Secrets — see `keychain-admin.resetKeychain`. */
+	async resetKeychain(userId) {
+		const record = await this.resetAs(`user:${userId}`);
+		return {
+			archivedCollection: record.archivedCollection,
+			archived: record.archived
+		};
+	}
+	/**
+	* Start over with a new master key and a new data key.
+	*
+	* 1. Refuse BEFORE touching anything when the configured primary source
+	*    cannot give a key (a configured file that is missing or unreadable, a
+	*    desktop key that did not arrive): archiving the values and then staying
+	*    locked would lose them for nothing. The default file is always usable —
+	*    the reset writes a new one (the old one is kept as `master.key.prev-*`).
+	* 2. Archive every value AND every wrapped data key — the archive stays
+	*    openable if the lost master key turns up.
+	* 3. New data key under the new master key ({@link firstBoot}).
+	* 4. Clear the system-held markers (the cluster secret's): a marker pointing
+	*    at an archived value would refuse every agent forever (D797). The
+	*    session signing key has no marker; it now resolves `missing`, and
+	*    `local-auth` generates a new one (everyone signs in again).
+	* 5. One `delete` event per archived ref, so every keeper reloads.
+	* 6. A reset record for the Secrets page, and an audit row.
+	*/
+	async resetAs(actor) {
+		const t = this.now();
+		const lockedReason = this.unlock.state === "locked" ? this.unlock.reason : null;
+		const primary = (await this.deps.candidates()).find((c) => c.primary) ?? null;
+		await this.assertResettable(primary);
+		const archiveName = `keychain:secrets-orphaned-${t}`;
+		const keysArchiveName = `keychain:keys-orphaned-${t}`;
+		const archivedRows = await this.deps.repo.listSecrets();
+		const archivedKeys = await this.deps.repo.archiveAllKeys(keysArchiveName);
+		const archived = await this.deps.repo.archiveAllSecrets(archiveName);
+		for (const wrap of await this.deps.repo.listKeys()) await this.deps.repo.deleteKey(wrap.wrapId);
+		if (primary?.source.kind === "default-file") {
+			if ((await primary.load()).kind !== "absent") await writeDefaultKeyFile(this.deps.dataDir, generateKey(), {
+				replace: true,
+				nowMs: t
+			});
+		}
+		this.unlock = await this.firstBoot(primary);
+		const clearedSettingsKeys = await this.deps.repo.clearSystemSettingsKeys(SYSTEM_SECRET_SETTINGS_KEYS);
+		for (const row of archivedRows) this.deps.events.emit({
+			ref: row.ref,
+			owner: row.owner,
+			version: null,
+			change: "delete"
+		});
+		const record = {
+			id: randomUUID(),
+			at: t,
+			actor,
+			lockedReason,
+			archived,
+			archivedCollection: archived > 0 ? archiveName : null,
+			archivedKeysCollection: archivedKeys > 0 ? keysArchiveName : null,
+			clearedSettingsKeys,
+			acknowledgedAt: null
+		};
+		await this.deps.repo.putReset(record);
+		await this.audit("reset", actor, null, `archived=${archived} lockedReason=${lockedReason ?? "none"} cleared=${clearedSettingsKeys.join(",") || "none"}`);
+		return record;
+	}
+	/** Throws {@link KeychainResetRefusedError} when no new master key could be had. */
+	async assertResettable(primary) {
+		if (primary === null) throw new KeychainResetRefusedError("no key source is configured");
+		if (primary.source.kind === "default-file") return;
+		const loaded = await primary.load();
+		if (loaded.kind === "loaded") return;
+		const where = primary.source.path ?? primary.source.kind;
+		throw new KeychainResetRefusedError(loaded.kind === "absent" ? `the configured master key ${where} does not exist — put a new 32-byte key there (or remove keychain.keyFile to use the default file) first` : `the configured master key ${where} cannot be read (${loaded.error})`);
+	}
+	/** What the last reset left to re-enter (see `keychain-admin.resetReport`). */
+	async resetReport() {
+		const reset = await this.deps.repo.latestReset();
+		if (reset === null || reset.archivedCollection === null) return {
+			reset,
+			pendingReentry: []
+		};
+		const archived = await this.deps.repo.listArchivedSecrets(reset.archivedCollection);
+		const live = await this.deps.repo.getSecrets(archived.map((r) => r.ref));
+		return {
+			reset,
+			pendingReentry: archived.filter((r) => !live.has(r.ref) && !PROCESS_HELD_SECRET_REFS.has(r.ref)).map(toMeta)
+		};
+	}
+	async acknowledgeReset(userId) {
+		const reset = await this.deps.repo.latestReset();
+		if (reset === null || reset.acknowledgedAt !== null) return { acknowledged: false };
+		await this.deps.repo.putReset({
+			...reset,
+			acknowledgedAt: this.now()
+		});
+		await this.audit("acknowledge-reset", `user:${userId}`, null, `reset=${reset.id}`);
+		return { acknowledged: true };
+	}
+	async audit(action, actor, ref, detail) {
+		try {
+			await this.deps.repo.appendAudit({
+				id: randomUUID(),
+				at: this.now(),
+				action,
+				actor,
+				ref,
+				detail
+			});
+		} catch (err) {
+			this.deps.logger.warn("keychain audit row not written", {
+				action,
+				ref,
+				error: errMsg(err)
+			});
+		}
+	}
+	/** Daily ring prune, driven by the addon's timer. */
+	async pruneAudit() {
+		await this.deps.repo.pruneAudit(this.now());
+	}
+};
+function toMeta(row) {
+	return {
+		ref: row.ref,
+		owner: row.owner,
+		scope: row.scope,
+		fieldPath: row.fieldPath,
+		version: row.version,
+		createdAt: row.createdAt,
+		updatedAt: row.updatedAt,
+		updatedBy: row.updatedBy,
+		lastReadAt: row.lastReadAt
+	};
+}
+function actorOfAddon(caller) {
+	return caller === null ? "system" : `addon:${normalizeSecretOwner(caller)}`;
+}
+function errMsg(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+EventCategory.KeychainChanged;
+//#endregion
+//#region src/builtins/keychain/keychain-store.ts
+/**
+* @durable class=config owner=keychain
+*   write="`keychain.put` upserts one row per ref; `delete` removes it"
+*   retention="none — a row lives until its owner deletes the ref or the
+*     operator deletes it as an orphan. Losing the table loses every secret
+*     value; the settings blobs then point at refs that resolve `missing`."
+*/
+var KEYCHAIN_SECRETS_COLLECTION = "keychain:secrets";
+/**
+* @durable class=config owner=keychain
+*   write="first boot writes the wrapped data key; `rotateMasterKey` adds a
+*     wrap and retires the previous one"
+*   retention="retired wraps until `purgeRetiredKeys`. Losing the table with
+*     the secrets intact makes every value undecryptable."
+*/
+var KEYCHAIN_KEYS_COLLECTION = "keychain:keys";
+/**
+* @durable class=ring owner=keychain
+*   write="one row per write / delete / rotation / reveal / recovery download"
+*   retention="90 days and at most 20 000 rows, pruned at boot and daily"
+*/
+var KEYCHAIN_AUDIT_COLLECTION = "keychain:audit";
+/**
+* @durable class=config owner=keychain
+*   write="one row per keychain reset (System → Secrets, or the RESET_KEYCHAIN
+*     trigger file); `acknowledgeReset` stamps `acknowledgedAt`"
+*   retention="none — a handful of rows over a hub's life; they name the
+*     archive tables a reset left behind"
+*/
+var KEYCHAIN_RESETS_COLLECTION = "keychain:resets";
+var AUDIT_RETENTION_MS = 2160 * 60 * 6e4;
+var AUDIT_MAX_ROWS = 2e4;
+var SECRET_COLUMNS = [
+	{
+		name: "ref",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "owner",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "scope",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "fieldPath",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "ciphertext",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "keyId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "version",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "updatedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "updatedBy",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "lastReadAt",
+		type: "INTEGER"
+	}
+];
+var KEY_COLUMNS = [
+	{
+		name: "wrapId",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "keyId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "wrappedDek",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "kekFingerprint",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "kekSource",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "state",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "recoveryDownloadedAt",
+		type: "INTEGER"
+	}
+];
+var RESET_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "at",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "actor",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "lockedReason",
+		type: "TEXT"
+	},
+	{
+		name: "archived",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "archivedCollection",
+		type: "TEXT"
+	},
+	{
+		name: "archivedKeysCollection",
+		type: "TEXT"
+	},
+	{
+		name: "clearedSettingsKeys",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "acknowledgedAt",
+		type: "INTEGER"
+	}
+];
+var AUDIT_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "at",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "action",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "actor",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "ref",
+		type: "TEXT"
+	},
+	{
+		name: "detail",
+		type: "TEXT"
+	}
+];
+function str(data, key) {
+	const v = data[key];
+	return typeof v === "string" ? v : "";
+}
+function num(data, key) {
+	const v = data[key];
+	return typeof v === "number" ? v : Number(v ?? 0);
+}
+function numOrNull(data, key) {
+	const v = data[key];
+	if (v === null || v === void 0) return null;
+	const n = typeof v === "number" ? v : Number(v);
+	return Number.isFinite(n) ? n : null;
+}
+function strOrNull(data, key) {
+	const v = data[key];
+	return typeof v === "string" ? v : null;
+}
+function toSecretRow(id, data) {
+	return {
+		ref: str(data, "ref") || id,
+		owner: str(data, "owner"),
+		scope: str(data, "scope"),
+		fieldPath: str(data, "fieldPath"),
+		ciphertext: str(data, "ciphertext"),
+		keyId: str(data, "keyId"),
+		version: num(data, "version"),
+		createdAt: num(data, "createdAt"),
+		updatedAt: num(data, "updatedAt"),
+		updatedBy: str(data, "updatedBy"),
+		lastReadAt: numOrNull(data, "lastReadAt")
+	};
+}
+function toKeyRow(id, data) {
+	const state = str(data, "state");
+	return {
+		wrapId: str(data, "wrapId") || id,
+		keyId: str(data, "keyId"),
+		wrappedDek: str(data, "wrappedDek"),
+		kekFingerprint: str(data, "kekFingerprint"),
+		kekSource: str(data, "kekSource"),
+		createdAt: num(data, "createdAt"),
+		state: state === "retired" ? "retired" : "active",
+		recoveryDownloadedAt: numOrNull(data, "recoveryDownloadedAt")
+	};
+}
+var AUDIT_ACTIONS = new Set([
+	"put",
+	"delete",
+	"reveal",
+	"rotate-master-key",
+	"purge-retired-keys",
+	"download-recovery-key",
+	"delete-orphans",
+	"reset",
+	"acknowledge-reset",
+	"initialize"
+]);
+function isAuditAction(value) {
+	return AUDIT_ACTIONS.has(value);
+}
+function toAuditRow(id, data) {
+	const action = str(data, "action");
+	if (!isAuditAction(action)) return null;
+	return {
+		id: str(data, "id") || id,
+		at: num(data, "at"),
+		action,
+		actor: str(data, "actor"),
+		ref: strOrNull(data, "ref"),
+		detail: strOrNull(data, "detail")
+	};
+}
+function toResetRecord(id, data) {
+	const cleared = data["clearedSettingsKeys"];
+	let keys = [];
+	if (typeof cleared === "string") try {
+		const parsed = JSON.parse(cleared);
+		if (Array.isArray(parsed)) keys = parsed.filter((k) => typeof k === "string");
+	} catch {
+		keys = [];
+	}
+	else if (Array.isArray(cleared)) keys = cleared.filter((k) => typeof k === "string");
+	return {
+		id: str(data, "id") || id,
+		at: num(data, "at"),
+		actor: str(data, "actor"),
+		lockedReason: strOrNull(data, "lockedReason"),
+		archived: num(data, "archived"),
+		archivedCollection: strOrNull(data, "archivedCollection"),
+		archivedKeysCollection: strOrNull(data, "archivedKeysCollection"),
+		clearedSettingsKeys: keys,
+		acknowledgedAt: numOrNull(data, "acknowledgedAt")
+	};
+}
+/** Rows one listing page asks for — the table is small, but a read names its bound. */
+var PAGE = 1e3;
+var KeychainRepository = class {
+	door;
+	constructor(door) {
+		this.door = door;
+	}
+	async init() {
+		await this.door.declareCollection({
+			collection: KEYCHAIN_SECRETS_COLLECTION,
+			columns: SECRET_COLUMNS,
+			indexes: [{
+				name: "idx_keychain_secrets_owner",
+				columns: ["owner"]
+			}]
 		});
-		await this.audit("put", actor, ref, `version=${version}`);
-		this.deps.events.emit({
-			ref,
-			owner,
-			version,
-			change: "put"
+		await this.door.declareCollection({
+			collection: KEYCHAIN_KEYS_COLLECTION,
+			columns: KEY_COLUMNS
+		});
+		await this.door.declareCollection({
+			collection: KEYCHAIN_RESETS_COLLECTION,
+			columns: RESET_COLUMNS
+		});
+		await this.door.declareCollection({
+			collection: KEYCHAIN_AUDIT_COLLECTION,
+			columns: AUDIT_COLUMNS,
+			indexes: [{
+				name: "idx_keychain_audit_at",
+				columns: ["at"]
+			}]
 		});
-		return {
-			ref,
-			version
-		};
 	}
-	async resolve(caller, refs) {
-		const out = {};
-		const owned = [];
-		for (const ref of new Set(refs)) {
-			const parts = parseSecretRef(ref);
-			if (parts === null || !this.owns(caller, parts.owner)) {
-				out[ref] = { kind: "forbidden" };
-				continue;
-			}
-			owned.push(ref);
-		}
-		if (owned.length === 0) return out;
-		if (this.unlock.state !== "ready") {
-			for (const ref of owned) out[ref] = {
-				kind: "unavailable",
-				reason: this.unlock.reason
-			};
-			return out;
-		}
-		const unlocked = this.unlock;
-		let rows;
-		try {
-			rows = await this.deps.repo.getSecrets(owned);
-		} catch {
-			for (const ref of owned) out[ref] = {
-				kind: "unavailable",
-				reason: "store-unavailable"
-			};
-			return out;
-		}
-		const t = this.now();
-		const stale = [];
-		for (const ref of owned) {
-			const row = rows.get(ref);
-			if (row === void 0) {
-				out[ref] = { kind: "missing" };
-				continue;
-			}
-			const value = decryptValue(unlocked.dek, ref, row.ciphertext);
-			if (value === null) {
-				out[ref] = {
-					kind: "unavailable",
-					reason: "decrypt-failed"
-				};
-				this.deps.logger.error("keychain value did not authenticate", { ref });
-				continue;
+	async getSecrets(refs) {
+		const out = /* @__PURE__ */ new Map();
+		if (refs.length === 0) return out;
+		const rows = await this.door.query({
+			collection: KEYCHAIN_SECRETS_COLLECTION,
+			filter: {
+				whereIn: { ref: [...refs] },
+				limit: refs.length
 			}
-			out[ref] = {
-				kind: "value",
-				value,
-				version: row.version
-			};
-			if (row.lastReadAt === null || t - row.lastReadAt >= 36e5) stale.push(row);
+		});
+		for (const row of rows) {
+			const parsed = toSecretRow(row.id, row.data);
+			out.set(parsed.ref, parsed);
 		}
-		if (stale.length > 0) this.touchLastRead(stale, t);
 		return out;
 	}
-	async touchLastRead(rows, at) {
-		try {
-			for (const row of rows) await this.deps.repo.putSecret({
-				...row,
-				lastReadAt: at
-			});
-		} catch (err) {
-			this.deps.logger.warn("keychain lastReadAt not recorded", { error: errMsg(err) });
-		}
-	}
-	async delete(caller, refs) {
-		const owners = /* @__PURE__ */ new Map();
-		for (const ref of new Set(refs)) owners.set(ref, this.ownerOf(ref, caller));
-		if (owners.size === 0) return 0;
-		const existing = await this.deps.repo.getSecrets([...owners.keys()]);
-		const present = [...owners.keys()].filter((ref) => existing.has(ref));
-		if (present.length === 0) return 0;
-		const deleted = await this.deps.repo.deleteSecrets(present);
-		for (const ref of present) {
-			await this.audit("delete", actorOfAddon(caller), ref, null);
-			this.deps.events.emit({
-				ref,
-				owner: owners.get(ref) ?? "",
-				version: null,
-				change: "delete"
+	/** Every row, paged by primary key. */
+	async listSecrets() {
+		const out = [];
+		for (let offset = 0;; offset += PAGE) {
+			const rows = await this.door.query({
+				collection: KEYCHAIN_SECRETS_COLLECTION,
+				filter: {
+					orderBy: {
+						field: "ref",
+						direction: "asc"
+					},
+					limit: PAGE,
+					offset
+				}
 			});
+			for (const row of rows) out.push(toSecretRow(row.id, row.data));
+			if (rows.length < PAGE) return out;
 		}
-		return deleted;
 	}
-	async listMeta(caller) {
-		return (await this.deps.repo.listSecrets()).filter((row) => this.owns(caller, row.owner)).map(toMeta);
+	async putSecret(row) {
+		await this.door.set({
+			collection: KEYCHAIN_SECRETS_COLLECTION,
+			key: row.ref,
+			value: row
+		});
 	}
-	async status() {
-		const wraps = await this.deps.repo.listKeys().catch(() => []);
-		const secrets = await this.deps.repo.listSecrets().catch(() => []);
-		const unlocked = this.unlock.state === "ready" ? this.unlock : null;
-		const configured = this.configuredSource ?? {
-			kind: "default-file",
-			path: defaultKeyFilePath(this.deps.dataDir),
-			sharesBackupWithDatabase: true
-		};
-		return {
-			keychain: this.getState(),
-			keySource: unlocked?.source ?? null,
-			configuredSource: configured,
-			fingerprint: unlocked !== null ? shortFingerprint(unlocked.fingerprint) : null,
-			activeKeyId: unlocked?.keyId ?? null,
-			rotationPending: unlocked?.rotationPending ?? false,
-			retiredWraps: wraps.filter((w) => w.state === "retired").length,
-			recoveryKeyDownloadedAt: unlocked !== null ? wraps.find((w) => w.wrapId === unlocked.wrap.wrapId)?.recoveryDownloadedAt ?? null : null,
-			secretCount: secrets.length
-		};
+	async deleteSecrets(refs) {
+		if (refs.length === 0) return 0;
+		return (await this.door.deleteWhere({
+			collection: KEYCHAIN_SECRETS_COLLECTION,
+			filter: { whereIn: { ref: [...refs] } }
+		})).deleted;
 	}
-	async listSecrets() {
-		const rows = await this.deps.repo.listSecrets();
-		const usage = await this.deps.usage(rows).catch(() => /* @__PURE__ */ new Map());
-		return rows.map((row) => ({
-			...toMeta(row),
-			usage: usage.get(row.ref) ?? "unknown"
-		}));
+	async listKeys() {
+		return (await this.door.query({
+			collection: KEYCHAIN_KEYS_COLLECTION,
+			filter: {
+				orderBy: {
+					field: "createdAt",
+					direction: "asc"
+				},
+				limit: PAGE
+			}
+		})).map((row) => toKeyRow(row.id, row.data));
 	}
-	/**
-	* The operator replaces a system-held secret no form edits (D797) — the
-	* session signing key. Stored under owner `system`, audited as the user.
-	*/
-	async setSystemSecret(userId, name, value) {
-		const ref = SYSTEM_HELD_SECRET_REFS[name];
-		return this.put(SYSTEM_SECRET_OWNER, ref, value, `user:${userId}`);
+	async putKey(row) {
+		await this.door.set({
+			collection: KEYCHAIN_KEYS_COLLECTION,
+			key: row.wrapId,
+			value: row
+		});
 	}
-	async listAudit(limit) {
-		return this.deps.repo.listAudit(limit);
+	async deleteKey(wrapId) {
+		await this.door.delete({
+			collection: KEYCHAIN_KEYS_COLLECTION,
+			key: wrapId
+		});
 	}
-	async reveal(userId, ref) {
-		const unlocked = this.requireReady();
-		const row = (await this.deps.repo.getSecrets([ref])).get(ref);
-		if (row === void 0) throw new Error(`keychain: no value stored at ${ref}`);
-		const value = decryptValue(unlocked.dek, ref, row.ciphertext);
-		if (value === null) throw new Error(`keychain: the value at ${ref} did not authenticate`);
-		await this.audit("reveal", `user:${userId}`, ref, null);
-		return {
-			value,
-			version: row.version
-		};
+	async appendAudit(row) {
+		await this.door.set({
+			collection: KEYCHAIN_AUDIT_COLLECTION,
+			key: row.id,
+			value: row
+		});
 	}
-	async deleteOrphans(userId, refs) {
-		const rows = [...(await this.deps.repo.getSecrets(refs)).values()];
-		const usage = await this.deps.usage(rows);
-		const deleted = [];
-		const kept = [];
-		for (const row of rows) {
-			const u = usage.get(row.ref) ?? "unknown";
-			if (u === "orphan") deleted.push(row.ref);
-			else kept.push({
-				ref: row.ref,
-				usage: u
-			});
-		}
-		if (deleted.length > 0) {
-			await this.deps.repo.deleteSecrets(deleted);
-			for (const ref of deleted) {
-				const owner = parseSecretRef(ref)?.owner ?? "";
-				this.deps.events.emit({
-					ref,
-					owner,
-					version: null,
-					change: "delete"
-				});
+	async listAudit(limit) {
+		const rows = await this.door.query({
+			collection: KEYCHAIN_AUDIT_COLLECTION,
+			filter: {
+				orderBy: {
+					field: "at",
+					direction: "desc"
+				},
+				limit
 			}
-			await this.audit("delete-orphans", `user:${userId}`, null, `deleted=${deleted.length}`);
+		});
+		const out = [];
+		for (const row of rows) {
+			const parsed = toAuditRow(row.id, row.data);
+			if (parsed !== null) out.push(parsed);
 		}
-		return {
-			deleted,
-			kept
-		};
+		return out;
 	}
-	async downloadRecoveryKey(userId) {
-		const unlocked = this.requireReady();
-		const t = this.now();
-		await this.deps.repo.putKey({
-			...unlocked.wrap,
-			recoveryDownloadedAt: t
+	/** Drop audit rows older than the retention window, then beyond the row bound. */
+	async pruneAudit(nowMs) {
+		const aged = await this.door.deleteWhere({
+			collection: KEYCHAIN_AUDIT_COLLECTION,
+			filter: { whereBetween: { at: [0, nowMs - AUDIT_RETENTION_MS] } }
 		});
-		this.unlock = {
-			...unlocked,
-			wrap: {
-				...unlocked.wrap,
-				recoveryDownloadedAt: t
+		const cutoff = (await this.door.query({
+			collection: KEYCHAIN_AUDIT_COLLECTION,
+			filter: {
+				orderBy: {
+					field: "at",
+					direction: "desc"
+				},
+				limit: 1,
+				offset: AUDIT_MAX_ROWS
 			}
-		};
-		await this.audit("download-recovery-key", `user:${userId}`, null, `source=${unlocked.source.kind}`);
-		return {
-			key: encodeKeyMaterial(unlocked.kek),
-			fingerprint: shortFingerprint(unlocked.fingerprint),
-			keySource: unlocked.source
-		};
+		}))[0]?.data["at"];
+		if (typeof cutoff !== "number") return aged.deleted;
+		const bounded = await this.door.deleteWhere({
+			collection: KEYCHAIN_AUDIT_COLLECTION,
+			filter: { whereBetween: { at: [0, cutoff] } }
+		});
+		return aged.deleted + bounded.deleted;
 	}
-	/** See `keychain-admin.rotateMasterKey`. */
-	async rotateMasterKey(userId) {
-		const unlocked = this.requireReady();
-		const primary = (await this.deps.candidates()).find((c) => c.primary);
-		if (primary === void 0) throw new Error("keychain: no primary key source is configured");
-		let newKek;
-		if (unlocked.rotationPending && primary.source.kind !== unlocked.source.kind) {
-			const loaded = await primary.load();
-			if (loaded.kind !== "loaded") throw new Error(`keychain: the configured ${primary.source.kind} key could not be loaded`);
-			newKek = loaded.key;
-		} else if (primary.source.kind === "default-file") {
-			newKek = generateKey();
-			await writeDefaultKeyFile(this.deps.dataDir, newKek, {
-				replace: true,
-				nowMs: this.now()
-			});
-		} else throw new Error(`keychain: the ${primary.source.kind} key is already in use. Put the new key at its source, set the old one as keychain.previousKeyFile, restart, then rotate.`);
-		const fingerprint = kekFingerprint(newKek);
-		if (constantTimeEquals(fingerprint, unlocked.fingerprint)) throw new Error("keychain: the new master key is the one already in use");
-		const wrap = {
-			wrapId: randomUUID(),
-			keyId: unlocked.keyId,
-			wrappedDek: wrapDek(newKek, unlocked.dek, unlocked.keyId),
-			kekFingerprint: fingerprint,
-			kekSource: primary.source.kind,
-			createdAt: this.now(),
-			state: "active",
-			recoveryDownloadedAt: null
-		};
-		await this.deps.repo.putKey(wrap);
-		for (const old of await this.deps.repo.listKeys()) if (old.wrapId !== wrap.wrapId && old.state === "active") await this.deps.repo.putKey({
-			...old,
-			state: "retired"
+	/**
+	* Lost-key recovery: copy every secret row into `archive`, then empty the
+	* live table. The archive is ciphertext under a key nobody has — it exists
+	* so a key that turns up later can still recover it.
+	*/
+	async archiveAllSecrets(archive) {
+		const rows = await this.listSecrets();
+		if (rows.length === 0) return 0;
+		await this.door.declareCollection({
+			collection: archive,
+			columns: SECRET_COLUMNS
 		});
-		this.unlock = {
-			state: "ready",
-			dek: unlocked.dek,
-			keyId: unlocked.keyId,
-			kek: newKek,
-			fingerprint,
-			source: primary.source,
-			wrap,
-			rotationPending: false
-		};
-		this.configuredSource = primary.source;
-		await this.audit("rotate-master-key", `user:${userId}`, null, `source=${primary.source.kind}`);
-		return {
-			fingerprint: shortFingerprint(fingerprint),
-			keySource: primary.source
-		};
+		for (const row of rows) await this.door.set({
+			collection: archive,
+			key: row.ref,
+			value: row
+		});
+		await this.deleteSecrets(rows.map((r) => r.ref));
+		return rows.length;
 	}
-	/** Delete retired wraps, and the default file's previous copies with them. */
-	async purgeRetiredKeys(userId) {
-		this.requireReady();
-		const retired = (await this.deps.repo.listKeys()).filter((w) => w.state === "retired");
-		for (const wrap of retired) await this.deps.repo.deleteKey(wrap.wrapId);
-		const dir = path$1.dirname(defaultKeyFilePath(this.deps.dataDir));
-		try {
-			for (const name of await promises.readdir(dir)) if (name.startsWith("master.key.prev-")) await promises.rm(path$1.join(dir, name), { force: true });
-		} catch {}
-		await this.audit("purge-retired-keys", `user:${userId}`, null, `purged=${retired.length}`);
-		return retired.length;
+	/**
+	* Copy every wrapped data key into `archive` (the companion of
+	* {@link archiveAllSecrets}): without the wrap, an archived value could
+	* never be opened again even if the lost master key turned up.
+	*/
+	async archiveAllKeys(archive) {
+		const rows = await this.listKeys();
+		if (rows.length === 0) return 0;
+		await this.door.declareCollection({
+			collection: archive,
+			columns: KEY_COLUMNS
+		});
+		for (const row of rows) await this.door.set({
+			collection: archive,
+			key: row.wrapId,
+			value: row
+		});
+		return rows.length;
 	}
-	/** Lost-key recovery — see `keychain-admin.resetKeychain`. */
-	async resetKeychain(userId) {
-		const t = this.now();
-		const archiveName = `keychain:secrets-orphaned-${t}`;
-		const archived = await this.deps.repo.archiveAllSecrets(archiveName);
-		for (const wrap of await this.deps.repo.listKeys()) await this.deps.repo.deleteKey(wrap.wrapId);
-		const primary = (await this.deps.candidates()).find((c) => c.primary) ?? null;
-		if (primary?.source.kind === "default-file") {
-			if ((await primary.load()).kind !== "absent") await writeDefaultKeyFile(this.deps.dataDir, generateKey(), {
-				replace: true,
-				nowMs: t
+	/** Every secret row of an archive table (ciphertext — never decrypted here). */
+	async listArchivedSecrets(archive) {
+		const out = [];
+		for (let offset = 0;; offset += PAGE) {
+			const rows = await this.door.query({
+				collection: archive,
+				filter: {
+					orderBy: {
+						field: "ref",
+						direction: "asc"
+					},
+					limit: PAGE,
+					offset
+				}
 			});
+			for (const row of rows) out.push(toSecretRow(row.id, row.data));
+			if (rows.length < PAGE) return out;
 		}
-		this.unlock = await this.firstBoot(primary);
-		await this.audit("reset", `user:${userId}`, null, `archived=${archived}`);
-		return {
-			archivedCollection: archived > 0 ? archiveName : null,
-			archived
-		};
 	}
-	async audit(action, actor, ref, detail) {
-		try {
-			await this.deps.repo.appendAudit({
-				id: randomUUID(),
-				at: this.now(),
-				action,
-				actor,
-				ref,
-				detail
+	/**
+	* Delete the `system-settings` rows among `keys` that exist; returns the
+	* keys it deleted. A read that fails throws — never "nothing was there".
+	*/
+	async clearSystemSettingsKeys(keys) {
+		const cleared = [];
+		for (const key of keys) {
+			const current = await this.door.get({
+				collection: "system-settings",
+				key
 			});
-		} catch (err) {
-			this.deps.logger.warn("keychain audit row not written", {
-				action,
-				ref,
-				error: errMsg(err)
+			if (current === void 0 || current === null) continue;
+			await this.door.delete({
+				collection: "system-settings",
+				key
 			});
+			cleared.push(key);
 		}
+		return cleared;
 	}
-	/** Daily ring prune, driven by the addon's timer. */
-	async pruneAudit() {
-		await this.deps.repo.pruneAudit(this.now());
+	async putReset(record) {
+		await this.door.set({
+			collection: KEYCHAIN_RESETS_COLLECTION,
+			key: record.id,
+			value: {
+				...record,
+				clearedSettingsKeys: JSON.stringify(record.clearedSettingsKeys)
+			}
+		});
+	}
+	async latestReset() {
+		const row = (await this.door.query({
+			collection: KEYCHAIN_RESETS_COLLECTION,
+			filter: {
+				orderBy: {
+					field: "at",
+					direction: "desc"
+				},
+				limit: 1
+			}
+		}))[0];
+		return row === void 0 ? null : toResetRecord(row.id, row.data);
 	}
 };
-function toMeta(row) {
-	return {
-		ref: row.ref,
-		owner: row.owner,
-		scope: row.scope,
-		fieldPath: row.fieldPath,
-		version: row.version,
-		createdAt: row.createdAt,
-		updatedAt: row.updatedAt,
-		updatedBy: row.updatedBy,
-		lastReadAt: row.lastReadAt
-	};
-}
-function actorOfAddon(caller) {
-	return caller === null ? "system" : `addon:${normalizeSecretOwner(caller)}`;
-}
-function errMsg(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-EventCategory.KeychainChanged;
 //#endregion
 //#region src/builtins/keychain/keychain-usage.ts
 /**
@@ -1351,8 +1713,13 @@ function createKeychainUsageCheck(door) {
 *    listMeta / getState, owner-checked against the caller the transport
 *    stamped (`callerAddonId`, never in the input schema);
 *  - `keychain-admin`: System → Secrets — status, list, audit, reveal,
-*    orphans, rotation, recovery key, reset. Every method admin; the four
-*    that change or hand out material take the session's user for the audit.
+*    orphans, rotation, recovery key, reset (and its report). Every method
+*    admin; those that change or hand out material take the session's user
+*    for the audit.
+*
+* At boot, right after the unlock, the one-shot `<dataDir>/.keychain/RESET_KEYCHAIN`
+* trigger file is honoured (see `keychain-reset-trigger.ts`) — the only way
+* back into a hub whose master key is lost.
 *
 * It does not run on agents: an agent's Phase 1 drops `keychain` from its infra
 * list (`server/backend/src/agent/agent-infra-capabilities.ts`), and an agent
@@ -1395,6 +1762,11 @@ var KeychainAddon = class extends BaseAddon {
 		};
 		const dataDir = ctx.nodeDataDir;
 		const runnerIdOf = ctx.kernel.runnerIdForAddon ?? ((addonId) => addonId);
+		const serviceLogger = {
+			info: (message, meta) => ctx.logger.info(message, meta ? { meta } : void 0),
+			warn: (message, meta) => ctx.logger.warn(message, meta ? { meta } : void 0),
+			error: (message, meta) => ctx.logger.error(message, meta ? { meta } : void 0)
+		};
 		const service = new KeychainService({
 			repo: new KeychainRepository(door),
 			candidates: async () => {
@@ -1416,15 +1788,16 @@ var KeychainAddon = class extends BaseAddon {
 					data: payload
 				});
 			} },
-			logger: {
-				info: (message, meta) => ctx.logger.info(message, meta ? { meta } : void 0),
-				warn: (message, meta) => ctx.logger.warn(message, meta ? { meta } : void 0),
-				error: (message, meta) => ctx.logger.error(message, meta ? { meta } : void 0)
-			},
+			logger: serviceLogger,
 			runnerIdOf,
 			usage: createKeychainUsageCheck(door)
 		});
 		await service.init();
+		await applyKeychainResetTrigger({
+			service,
+			dataDir,
+			logger: serviceLogger
+		});
 		this.pruneTimer = setInterval(() => {
 			service.pruneAudit().catch((err) => {
 				ctx.logger.warn("keychain audit prune failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
@@ -1452,7 +1825,9 @@ var KeychainAddon = class extends BaseAddon {
 				rotateMasterKey: (input) => service.rotateMasterKey(input.caller.userId),
 				purgeRetiredKeys: async (input) => ({ purged: await service.purgeRetiredKeys(input.caller.userId) }),
 				downloadRecoveryKey: (input) => service.downloadRecoveryKey(input.caller.userId),
-				resetKeychain: (input) => service.resetKeychain(input.caller.userId)
+				resetKeychain: (input) => service.resetKeychain(input.caller.userId),
+				resetReport: () => service.resetReport(),
+				acknowledgeReset: (input) => service.acknowledgeReset(input.caller.userId)
 			}
 		}];
 	}