@camstack/system 1.2.390 → 1.2.392

package/dist/builtins/keychain/keychain-service.d.ts

@@ -1,148 +1,148 @@
-import { EventCategory, KeychainAuditEntry, KeychainKeySource, KeychainResetRecord, KeychainResolveResult, KeychainSecretMeta, KeychainSecretUsage, KeychainState, KeychainStatus, KeychainUnavailableReason, SystemHeldSecretName } from '@camstack/types';
-import { KeySourceCandidate } from './key-sources.js';
-import { KeychainRepository, KeychainSecretRow } from './keychain-store.js';
+import { type KeychainAuditEntry, type KeychainKeySource, type KeychainResetRecord, type KeychainResolveResult, type KeychainSecretMeta, type KeychainSecretUsage, type KeychainState, type KeychainStatus, type KeychainUnavailableReason, type KnownEventCategory, type SystemHeldSecretName } from "@camstack/types";
+import { type KeySourceCandidate } from "./key-sources.js";
+import type { KeychainRepository, KeychainSecretRow } from "./keychain-store.js";
 /** `lastReadAt` is written at most this often per ref (hub I/O is the bottleneck). */
 export declare const LAST_READ_GRANULARITY_MS: number;
 export declare class KeychainLockedError extends Error {
-    readonly reason: KeychainUnavailableReason;
-    constructor(reason: KeychainUnavailableReason);
+	readonly reason: KeychainUnavailableReason;
+	constructor(reason: KeychainUnavailableReason);
 }
 /** A reset that would archive the values and still end locked — refused before it starts. */
 export declare class KeychainResetRefusedError extends Error {
-    constructor(reason: string);
+	constructor(reason: string);
 }
 export declare class KeychainForbiddenError extends Error {
-    readonly ref: string;
-    constructor(ref: string, caller: string | null);
+	readonly ref: string;
+	constructor(ref: string, caller: string | null);
 }
 export interface KeychainEventSink {
-    emit(payload: {
-        readonly ref: string;
-        readonly owner: string;
-        readonly version: number | null;
-        readonly change: 'put' | 'delete';
-    }): void;
+	emit(payload: {
+		readonly ref: string;
+		readonly owner: string;
+		readonly version: number | null;
+		readonly change: "put" | "delete";
+	}): void;
 }
 export interface KeychainLogger {
-    info(message: string, meta?: Record<string, unknown>): void;
-    warn(message: string, meta?: Record<string, unknown>): void;
-    error(message: string, meta?: Record<string, unknown>): void;
+	info(message: string, meta?: Record<string, unknown>): void;
+	warn(message: string, meta?: Record<string, unknown>): void;
+	error(message: string, meta?: Record<string, unknown>): void;
 }
 /** Answers whether a stored ref is still pointed at by its owner's settings. */
 export type KeychainUsageCheck = (rows: readonly KeychainSecretRow[]) => Promise<ReadonlyMap<string, KeychainSecretUsage>>;
 export interface KeychainServiceDeps {
-    readonly repo: KeychainRepository;
-    /** Rebuilt on every unlock / rotation — the configuration may have changed. */
-    readonly candidates: () => Promise<readonly KeySourceCandidate[]>;
-    readonly dataDir: string;
-    readonly events: KeychainEventSink;
-    readonly logger: KeychainLogger;
-    /** The runner id hosting an addon (its group, or itself). */
-    readonly runnerIdOf: (addonId: string) => string;
-    readonly usage: KeychainUsageCheck;
-    readonly now?: () => number;
+	readonly repo: KeychainRepository;
+	/** Rebuilt on every unlock / rotation — the configuration may have changed. */
+	readonly candidates: () => Promise<readonly KeySourceCandidate[]>;
+	readonly dataDir: string;
+	readonly events: KeychainEventSink;
+	readonly logger: KeychainLogger;
+	/** The runner id hosting an addon (its group, or itself). */
+	readonly runnerIdOf: (addonId: string) => string;
+	readonly usage: KeychainUsageCheck;
+	readonly now?: () => number;
 }
 export declare class KeychainService {
-    private readonly deps;
-    private unlock;
-    private configuredSource;
-    private readonly now;
-    constructor(deps: KeychainServiceDeps);
-    /** Load the keys and unlock. Never throws for a key problem — it locks. */
-    init(): Promise<KeychainState>;
-    private computeUnlock;
-    /** No wrapped data key yet: create one — only when nothing could be lost. */
-    private firstBoot;
-    getState(): KeychainState;
-    private requireReady;
-    /** May `caller` touch values owned by `owner`? */
-    owns(caller: string | null, owner: string): boolean;
-    private ownerOf;
-    /**
-     * @param actor who the audit names — the owner addon by default; the
-     *   operator (`user:<id>`) for {@link setSystemSecret}.
-     */
-    put(caller: string | null, ref: string, value: string, actor?: string): Promise<{
-        ref: string;
-        version: number;
-    }>;
-    resolve(caller: string | null, refs: readonly string[]): Promise<KeychainResolveResult>;
-    private touchLastRead;
-    delete(caller: string | null, refs: readonly string[]): Promise<number>;
-    listMeta(caller: string | null): Promise<readonly KeychainSecretMeta[]>;
-    status(): Promise<KeychainStatus>;
-    listSecrets(): Promise<readonly (KeychainSecretMeta & {
-        usage: KeychainSecretUsage;
-    })[]>;
-    /**
-     * The operator replaces a system-held secret no form edits (D797) — the
-     * session signing key. Stored under owner `system`, audited as the user.
-     */
-    setSystemSecret(userId: string, name: SystemHeldSecretName, value: string): Promise<{
-        ref: string;
-        version: number;
-    }>;
-    listAudit(limit: number): Promise<readonly KeychainAuditEntry[]>;
-    reveal(userId: string, ref: string): Promise<{
-        value: string;
-        version: number;
-    }>;
-    deleteOrphans(userId: string, refs: readonly string[]): Promise<{
-        deleted: readonly string[];
-        kept: readonly {
-            ref: string;
-            usage: KeychainSecretUsage;
-        }[];
-    }>;
-    downloadRecoveryKey(userId: string): Promise<{
-        key: string;
-        fingerprint: string;
-        keySource: KeychainKeySource;
-    }>;
-    /** See `keychain-admin.rotateMasterKey`. */
-    rotateMasterKey(userId: string): Promise<{
-        fingerprint: string;
-        keySource: KeychainKeySource;
-    }>;
-    /** Delete retired wraps, and the default file's previous copies with them. */
-    purgeRetiredKeys(userId: string): Promise<number>;
-    /** Lost-key recovery from System → Secrets — see `keychain-admin.resetKeychain`. */
-    resetKeychain(userId: string): Promise<{
-        archivedCollection: string | null;
-        archived: number;
-    }>;
-    /**
-     * Start over with a new master key and a new data key.
-     *
-     * 1. Refuse BEFORE touching anything when the configured primary source
-     *    cannot give a key (a configured file that is missing or unreadable, a
-     *    desktop key that did not arrive): archiving the values and then staying
-     *    locked would lose them for nothing. The default file is always usable —
-     *    the reset writes a new one (the old one is kept as `master.key.prev-*`).
-     * 2. Archive every value AND every wrapped data key — the archive stays
-     *    openable if the lost master key turns up.
-     * 3. New data key under the new master key ({@link firstBoot}).
-     * 4. Clear the system-held markers (the cluster secret's): a marker pointing
-     *    at an archived value would refuse every agent forever (D797). The
-     *    session signing key has no marker; it now resolves `missing`, and
-     *    `local-auth` generates a new one (everyone signs in again).
-     * 5. One `delete` event per archived ref, so every keeper reloads.
-     * 6. A reset record for the Secrets page, and an audit row.
-     */
-    resetAs(actor: string): Promise<KeychainResetRecord>;
-    /** Throws {@link KeychainResetRefusedError} when no new master key could be had. */
-    private assertResettable;
-    /** What the last reset left to re-enter (see `keychain-admin.resetReport`). */
-    resetReport(): Promise<{
-        reset: KeychainResetRecord | null;
-        pendingReentry: readonly KeychainSecretMeta[];
-    }>;
-    acknowledgeReset(userId: string): Promise<{
-        acknowledged: boolean;
-    }>;
-    private audit;
-    /** Daily ring prune, driven by the addon's timer. */
-    pruneAudit(): Promise<void>;
+	private readonly deps;
+	private unlock;
+	private configuredSource;
+	private readonly now;
+	constructor(deps: KeychainServiceDeps);
+	/** Load the keys and unlock. Never throws for a key problem — it locks. */
+	init(): Promise<KeychainState>;
+	private computeUnlock;
+	/** No wrapped data key yet: create one — only when nothing could be lost. */
+	private firstBoot;
+	getState(): KeychainState;
+	private requireReady;
+	/** May `caller` touch values owned by `owner`? */
+	owns(caller: string | null, owner: string): boolean;
+	private ownerOf;
+	/**
+	* @param actor who the audit names — the owner addon by default; the
+	*   operator (`user:<id>`) for {@link setSystemSecret}.
+	*/
+	put(caller: string | null, ref: string, value: string, actor?: string): Promise<{
+		ref: string;
+		version: number;
+	}>;
+	resolve(caller: string | null, refs: readonly string[]): Promise<KeychainResolveResult>;
+	private touchLastRead;
+	delete(caller: string | null, refs: readonly string[]): Promise<number>;
+	listMeta(caller: string | null): Promise<readonly KeychainSecretMeta[]>;
+	status(): Promise<KeychainStatus>;
+	listSecrets(): Promise<readonly (KeychainSecretMeta & {
+		usage: KeychainSecretUsage;
+	})[]>;
+	/**
+	* The operator replaces a system-held secret no form edits (D797) — the
+	* session signing key. Stored under owner `system`, audited as the user.
+	*/
+	setSystemSecret(userId: string, name: SystemHeldSecretName, value: string): Promise<{
+		ref: string;
+		version: number;
+	}>;
+	listAudit(limit: number): Promise<readonly KeychainAuditEntry[]>;
+	reveal(userId: string, ref: string): Promise<{
+		value: string;
+		version: number;
+	}>;
+	deleteOrphans(userId: string, refs: readonly string[]): Promise<{
+		deleted: readonly string[];
+		kept: readonly {
+			ref: string;
+			usage: KeychainSecretUsage;
+		}[];
+	}>;
+	downloadRecoveryKey(userId: string): Promise<{
+		key: string;
+		fingerprint: string;
+		keySource: KeychainKeySource;
+	}>;
+	/** See `keychain-admin.rotateMasterKey`. */
+	rotateMasterKey(userId: string): Promise<{
+		fingerprint: string;
+		keySource: KeychainKeySource;
+	}>;
+	/** Delete retired wraps, and the default file's previous copies with them. */
+	purgeRetiredKeys(userId: string): Promise<number>;
+	/** Lost-key recovery from System → Secrets — see `keychain-admin.resetKeychain`. */
+	resetKeychain(userId: string): Promise<{
+		archivedCollection: string | null;
+		archived: number;
+	}>;
+	/**
+	* Start over with a new master key and a new data key.
+	*
+	* 1. Refuse BEFORE touching anything when the configured primary source
+	*    cannot give a key (a configured file that is missing or unreadable, a
+	*    desktop key that did not arrive): archiving the values and then staying
+	*    locked would lose them for nothing. The default file is always usable —
+	*    the reset writes a new one (the old one is kept as `master.key.prev-*`).
+	* 2. Archive every value AND every wrapped data key — the archive stays
+	*    openable if the lost master key turns up.
+	* 3. New data key under the new master key ({@link firstBoot}).
+	* 4. Clear the system-held markers (the cluster secret's): a marker pointing
+	*    at an archived value would refuse every agent forever (D797). The
+	*    session signing key has no marker; it now resolves `missing`, and
+	*    `local-auth` generates a new one (everyone signs in again).
+	* 5. One `delete` event per archived ref, so every keeper reloads.
+	* 6. A reset record for the Secrets page, and an audit row.
+	*/
+	resetAs(actor: string): Promise<KeychainResetRecord>;
+	/** Throws {@link KeychainResetRefusedError} when no new master key could be had. */
+	private assertResettable;
+	/** What the last reset left to re-enter (see `keychain-admin.resetReport`). */
+	resetReport(): Promise<{
+		reset: KeychainResetRecord | null;
+		pendingReentry: readonly KeychainSecretMeta[];
+	}>;
+	acknowledgeReset(userId: string): Promise<{
+		acknowledged: boolean;
+	}>;
+	private audit;
+	/** Daily ring prune, driven by the addon's timer. */
+	pruneAudit(): Promise<void>;
 }
 /** The event the provider emits — exported for the addon's bus adapter. */
-export declare const KEYCHAIN_CHANGED = EventCategory.KeychainChanged;
+export declare const KEYCHAIN_CHANGED: KnownEventCategory;

package/dist/builtins/keychain/keychain-store.d.ts

@@ -1,105 +1,114 @@
-import { ISettingsStoreProvider, KeychainAuditAction, KeychainResetRecord } from '@camstack/types';
 /**
- * @durable class=config owner=keychain
- *   write="`keychain.put` upserts one row per ref; `delete` removes it"
- *   retention="none — a row lives until its owner deletes the ref or the
- *     operator deletes it as an orphan. Losing the table loses every secret
- *     value; the settings blobs then point at refs that resolve `missing`."
- */
+* The keychain's three tables, behind the `settings-store` door (D44) — the
+* same database file as every other collection, which is the point: what a
+* stray copy of `camstack.db` holds of them is ciphertext, wrapped key material
+* and an audit trail, never a value.
+*
+* The repository takes a narrow door port rather than the whole tRPC client so
+* the service can be exercised against an in-memory door in tests.
+*/
+import type { ISettingsStoreProvider, KeychainAuditAction, KeychainResetRecord } from "@camstack/types";
+/**
+* @durable class=config owner=keychain
+*   write="`keychain.put` upserts one row per ref; `delete` removes it"
+*   retention="none — a row lives until its owner deletes the ref or the
+*     operator deletes it as an orphan. Losing the table loses every secret
+*     value; the settings blobs then point at refs that resolve `missing`."
+*/
 export declare const KEYCHAIN_SECRETS_COLLECTION = "keychain:secrets";
 /**
- * @durable class=config owner=keychain
- *   write="first boot writes the wrapped data key; `rotateMasterKey` adds a
- *     wrap and retires the previous one"
- *   retention="retired wraps until `purgeRetiredKeys`. Losing the table with
- *     the secrets intact makes every value undecryptable."
- */
+* @durable class=config owner=keychain
+*   write="first boot writes the wrapped data key; `rotateMasterKey` adds a
+*     wrap and retires the previous one"
+*   retention="retired wraps until `purgeRetiredKeys`. Losing the table with
+*     the secrets intact makes every value undecryptable."
+*/
 export declare const KEYCHAIN_KEYS_COLLECTION = "keychain:keys";
 /**
- * @durable class=ring owner=keychain
- *   write="one row per write / delete / rotation / reveal / recovery download"
- *   retention="90 days and at most 20 000 rows, pruned at boot and daily"
- */
+* @durable class=ring owner=keychain
+*   write="one row per write / delete / rotation / reveal / recovery download"
+*   retention="90 days and at most 20 000 rows, pruned at boot and daily"
+*/
 export declare const KEYCHAIN_AUDIT_COLLECTION = "keychain:audit";
 /**
- * @durable class=config owner=keychain
- *   write="one row per keychain reset (System → Secrets, or the RESET_KEYCHAIN
- *     trigger file); `acknowledgeReset` stamps `acknowledgedAt`"
- *   retention="none — a handful of rows over a hub's life; they name the
- *     archive tables a reset left behind"
- */
+* @durable class=config owner=keychain
+*   write="one row per keychain reset (System → Secrets, or the RESET_KEYCHAIN
+*     trigger file); `acknowledgeReset` stamps `acknowledgedAt`"
+*   retention="none — a handful of rows over a hub's life; they name the
+*     archive tables a reset left behind"
+*/
 export declare const KEYCHAIN_RESETS_COLLECTION = "keychain:resets";
 export declare const AUDIT_RETENTION_MS: number;
-export declare const AUDIT_MAX_ROWS = 20000;
+export declare const AUDIT_MAX_ROWS = 2e4;
 export interface KeychainSecretRow {
-    readonly ref: string;
-    readonly owner: string;
-    readonly scope: string;
-    readonly fieldPath: string;
-    readonly ciphertext: string;
-    readonly keyId: string;
-    readonly version: number;
-    readonly createdAt: number;
-    readonly updatedAt: number;
-    readonly updatedBy: string;
-    readonly lastReadAt: number | null;
+	readonly ref: string;
+	readonly owner: string;
+	readonly scope: string;
+	readonly fieldPath: string;
+	readonly ciphertext: string;
+	readonly keyId: string;
+	readonly version: number;
+	readonly createdAt: number;
+	readonly updatedAt: number;
+	readonly updatedBy: string;
+	readonly lastReadAt: number | null;
 }
-export type KeyWrapState = 'active' | 'retired';
+export type KeyWrapState = "active" | "retired";
 export interface KeychainKeyRow {
-    readonly wrapId: string;
-    readonly keyId: string;
-    readonly wrappedDek: string;
-    readonly kekFingerprint: string;
-    readonly kekSource: string;
-    readonly createdAt: number;
-    readonly state: KeyWrapState;
-    readonly recoveryDownloadedAt: number | null;
+	readonly wrapId: string;
+	readonly keyId: string;
+	readonly wrappedDek: string;
+	readonly kekFingerprint: string;
+	readonly kekSource: string;
+	readonly createdAt: number;
+	readonly state: KeyWrapState;
+	readonly recoveryDownloadedAt: number | null;
 }
 export interface KeychainAuditRow {
-    readonly id: string;
-    readonly at: number;
-    readonly action: KeychainAuditAction;
-    readonly actor: string;
-    readonly ref: string | null;
-    readonly detail: string | null;
+	readonly id: string;
+	readonly at: number;
+	readonly action: KeychainAuditAction;
+	readonly actor: string;
+	readonly ref: string | null;
+	readonly detail: string | null;
 }
 /** The subset of the settings door the repository uses. */
-export type KeychainDoor = Pick<ISettingsStoreProvider, 'declareCollection' | 'get' | 'set' | 'query' | 'delete' | 'deleteWhere'>;
+export type KeychainDoor = Pick<ISettingsStoreProvider, "declareCollection" | "get" | "set" | "query" | "delete" | "deleteWhere">;
 export declare class KeychainRepository {
-    private readonly door;
-    constructor(door: KeychainDoor);
-    init(): Promise<void>;
-    getSecrets(refs: readonly string[]): Promise<ReadonlyMap<string, KeychainSecretRow>>;
-    /** Every row, paged by primary key. */
-    listSecrets(): Promise<readonly KeychainSecretRow[]>;
-    putSecret(row: KeychainSecretRow): Promise<void>;
-    deleteSecrets(refs: readonly string[]): Promise<number>;
-    listKeys(): Promise<readonly KeychainKeyRow[]>;
-    putKey(row: KeychainKeyRow): Promise<void>;
-    deleteKey(wrapId: string): Promise<void>;
-    appendAudit(row: KeychainAuditRow): Promise<void>;
-    listAudit(limit: number): Promise<readonly KeychainAuditRow[]>;
-    /** Drop audit rows older than the retention window, then beyond the row bound. */
-    pruneAudit(nowMs: number): Promise<number>;
-    /**
-     * Lost-key recovery: copy every secret row into `archive`, then empty the
-     * live table. The archive is ciphertext under a key nobody has — it exists
-     * so a key that turns up later can still recover it.
-     */
-    archiveAllSecrets(archive: string): Promise<number>;
-    /**
-     * Copy every wrapped data key into `archive` (the companion of
-     * {@link archiveAllSecrets}): without the wrap, an archived value could
-     * never be opened again even if the lost master key turned up.
-     */
-    archiveAllKeys(archive: string): Promise<number>;
-    /** Every secret row of an archive table (ciphertext — never decrypted here). */
-    listArchivedSecrets(archive: string): Promise<readonly KeychainSecretRow[]>;
-    /**
-     * Delete the `system-settings` rows among `keys` that exist; returns the
-     * keys it deleted. A read that fails throws — never "nothing was there".
-     */
-    clearSystemSettingsKeys(keys: readonly string[]): Promise<readonly string[]>;
-    putReset(record: KeychainResetRecord): Promise<void>;
-    latestReset(): Promise<KeychainResetRecord | null>;
+	private readonly door;
+	constructor(door: KeychainDoor);
+	init(): Promise<void>;
+	getSecrets(refs: readonly string[]): Promise<ReadonlyMap<string, KeychainSecretRow>>;
+	/** Every row, paged by primary key. */
+	listSecrets(): Promise<readonly KeychainSecretRow[]>;
+	putSecret(row: KeychainSecretRow): Promise<void>;
+	deleteSecrets(refs: readonly string[]): Promise<number>;
+	listKeys(): Promise<readonly KeychainKeyRow[]>;
+	putKey(row: KeychainKeyRow): Promise<void>;
+	deleteKey(wrapId: string): Promise<void>;
+	appendAudit(row: KeychainAuditRow): Promise<void>;
+	listAudit(limit: number): Promise<readonly KeychainAuditRow[]>;
+	/** Drop audit rows older than the retention window, then beyond the row bound. */
+	pruneAudit(nowMs: number): Promise<number>;
+	/**
+	* Lost-key recovery: copy every secret row into `archive`, then empty the
+	* live table. The archive is ciphertext under a key nobody has — it exists
+	* so a key that turns up later can still recover it.
+	*/
+	archiveAllSecrets(archive: string): Promise<number>;
+	/**
+	* Copy every wrapped data key into `archive` (the companion of
+	* {@link archiveAllSecrets}): without the wrap, an archived value could
+	* never be opened again even if the lost master key turned up.
+	*/
+	archiveAllKeys(archive: string): Promise<number>;
+	/** Every secret row of an archive table (ciphertext — never decrypted here). */
+	listArchivedSecrets(archive: string): Promise<readonly KeychainSecretRow[]>;
+	/**
+	* Delete the `system-settings` rows among `keys` that exist; returns the
+	* keys it deleted. A read that fails throws — never "nothing was there".
+	*/
+	clearSystemSettingsKeys(keys: readonly string[]): Promise<readonly string[]>;
+	putReset(record: KeychainResetRecord): Promise<void>;
+	latestReset(): Promise<KeychainResetRecord | null>;
 }

package/dist/builtins/keychain/keychain-usage.d.ts

@@ -1,5 +1,16 @@
-import { KeychainSecretUsage } from '@camstack/types';
-import { KeychainDoor, KeychainSecretRow } from './keychain-store.js';
+/**
+* Is a stored value still pointed at? — the orphan check behind System →
+* Secrets.
+*
+* A ref says where its marker lives (owner + scope), so the check reads THAT
+* blob and looks for `{"$secret": ref}` anywhere in it. Three answers, and the
+* third is the important one: `unknown` when the blob could not be read, or
+* when the scope's store is not one this check knows how to read. A read that
+* did not answer is never "orphan" — and only an orphan can be deleted from
+* the page (D315: absence is claimed only from a query that answered).
+*/
+import { type KeychainSecretUsage } from "@camstack/types";
+import type { KeychainDoor, KeychainSecretRow } from "./keychain-store.js";
 /** Every `$secret` ref inside a value, at any depth. */
 export declare function collectMarkerRefs(value: unknown, out?: Set<string>): Set<string>;
 /** Build the usage check the service uses. */

package/dist/builtins/keychain/keychain.addon.d.ts

@@ -1,11 +1,36 @@
-import { BaseAddon, ProviderRegistration } from '@camstack/types';
+/**
+* `keychain` — hub-only, in-process builtin that owns every secret value
+* (D787). Boots in the infrastructure pass, right after the settings door, so
+* a forked addon's first `resolveConfig` already finds it.
+*
+* Registers two caps from one service:
+*  - `keychain` (internal): the owner's door — put / resolve / delete /
+*    listMeta / getState, owner-checked against the caller the transport
+*    stamped (`callerAddonId`, never in the input schema);
+*  - `keychain-admin`: System → Secrets — status, list, audit, reveal,
+*    orphans, rotation, recovery key, reset (and its report). Every method
+*    admin; those that change or hand out material take the session's user
+*    for the audit.
+*
+* At boot, right after the unlock, the one-shot `<dataDir>/.keychain/RESET_KEYCHAIN`
+* trigger file is honoured (see `keychain-reset-trigger.ts`) — the only way
+* back into a hub whose master key is lost.
+*
+* It does not run on agents: an agent's Phase 1 drops `keychain` from its infra
+* list (`server/backend/src/agent/agent-infra-capabilities.ts`), and an agent
+* addon reaches it through `$hub-cap-fwd` like every other hub cap. Until
+* 2026-10-08 agents DID boot it — their store door forwards to the hub, so an
+* agent wrote the hub's `keychain:keys` row with a key file on its own disk.
+* Booting first, it left the hub locked `key-missing`.
+*/
+import { BaseAddon, type ProviderRegistration } from "@camstack/types";
 /** The caller the transport stamped (or an in-process caller stated). */
 export declare function callerOf(input: unknown): string | null;
 export declare class KeychainAddon extends BaseAddon {
-    readonly id = "keychain";
-    private pruneTimer;
-    constructor();
-    protected onInitialize(): Promise<ProviderRegistration[]>;
-    protected onShutdown(): Promise<void>;
+	readonly id = "keychain";
+	private pruneTimer;
+	constructor();
+	protected onInitialize(): Promise<ProviderRegistration[]>;
+	protected onShutdown(): Promise<void>;
 }
 export default KeychainAddon;

package/dist/builtins/keychain/platform-key-source.d.ts

@@ -1,20 +1,20 @@
 /**
- * The OS-keychain master key of a DESKTOP hub.
- *
- * Electron's `safeStorage` exists only in the Electron main process, and the
- * hub runs as a plain Node child of it. So the desktop app reads (or creates)
- * the master key through `safeStorage`, and hands the raw bytes to the hub
- * over an inherited pipe (`--keychain-key-fd=<n>`) — never an env var, never a
- * file at rest in the clear. The hub's boot reads the descriptor once and
- * registers the key here; the keychain builtin, in the same process, asks.
- *
- * Process-global through a registered symbol, so a second copy of this module
- * (an addon bundle) sees the same key rather than none.
- */
+* The OS-keychain master key of a DESKTOP hub.
+*
+* Electron's `safeStorage` exists only in the Electron main process, and the
+* hub runs as a plain Node child of it. So the desktop app reads (or creates)
+* the master key through `safeStorage`, and hands the raw bytes to the hub
+* over an inherited pipe (`--keychain-key-fd=<n>`) — never an env var, never a
+* file at rest in the clear. The hub's boot reads the descriptor once and
+* registers the key here; the keychain builtin, in the same process, asks.
+*
+* Process-global through a registered symbol, so a second copy of this module
+* (an addon bundle) sees the same key rather than none.
+*/
 export interface PlatformKeychainKey {
-    /** Where it came from, for the status page (`macOS Keychain`, `Windows DPAPI`, …). */
-    readonly label: string;
-    readonly key: Buffer;
+	/** Where it came from, for the status page (`macOS Keychain`, `Windows DPAPI`, …). */
+	readonly label: string;
+	readonly key: Buffer;
 }
 /** Register the platform key. Called once, by the hub's boot. */
 export declare function setPlatformKeychainKey(entry: PlatformKeychainKey): void;

package/dist/builtins/keychain/system-held-secrets.d.ts

@@ -1,7 +1,20 @@
-import { SystemHeldSecretName } from '@camstack/types';
-import { SYSTEM_SECRET_OWNER } from '../../auth/jwt-signing-key.js';
-import { CLUSTER_SECRET_REF } from '../../kernel/moleculer/cluster-secret.js';
-import { MESH_CA_KEY_REF } from '../../kernel/moleculer/mesh-mtls/constants.js';
+/**
+* Secrets the hub itself owns (keychain owner `system`, D797) and where their
+* markers live — what the orphan check needs to know about them.
+*
+*  - The session signing key is HELD by the process (`local-auth` loads it at
+*    boot); no settings blob points at it, so it is always "in use" and never
+*    offered for deletion as an orphan.
+*  - The mesh CA key is HELD the same way (mesh mTLS issuance); the public
+*    certificate lives in `system-settings` `cluster.meshCa`.
+*  - The cluster secret is a `password` field of `system-config` (System →
+*    Cluster): its marker lives in the `system-settings` row
+*    `cluster.clusterSecret`, like any other form-owned secret.
+*/
+import type { SystemHeldSecretName } from "@camstack/types";
+import { SYSTEM_SECRET_OWNER } from "../../auth/jwt-signing-key.js";
+import { CLUSTER_SECRET_REF } from "../../kernel/moleculer/cluster-secret.js";
+import { MESH_CA_KEY_REF } from "../../kernel/moleculer/mesh-mtls/constants.js";
 export { SYSTEM_SECRET_OWNER };
 /** The refs `keychain-admin.setSystemSecret` may write, by name. */
 export declare const SYSTEM_HELD_SECRET_REFS: Readonly<Record<SystemHeldSecretName, string>>;

package/dist/builtins/liveness-monitor/index.d.ts

@@ -1,2 +1,2 @@
-export { LivenessMonitorAddon } from './liveness-monitor.addon.js';
-export { evaluateLiveness, isLivenessFindingId, type CameraFootage, type LivenessFacts, type LivenessFinding, } from './liveness-checks.js';
+export { LivenessMonitorAddon } from "./liveness-monitor.addon.js";
+export { evaluateLiveness, isLivenessFindingId, type CameraFootage, type LivenessFacts, type LivenessFinding } from "./liveness-checks.js";