@camstack/system 1.2.442 → 1.2.444

package/dist/builtins/core-blocks/block-settings-store.d.ts

@@ -1,21 +1,8 @@
-/**
-* Preference values for core blocks.
-*
-* Schema lives on the block record (`settingsSchema`, extracted from the
-* compiled entry's named export or set by the editor). Values live HERE —
-* one JSON blob per blockId — so a settings patch never rewrites the
-* operator's source, and so a block that has not yet declared a schema still
-* keeps any values the UI already wrote.
-*
-* On every patch the same values are mirrored into the block addon's
-* `addon-settings` rows so a running script reads them the same way any
-* addon does: `ctx.settings.readAddonStore()`.
-*/
-import type { SettingsStoreClient } from "@camstack/types";
+import { type ConfigUISchema, type RawSecretMigrationReport, type SecretsAccess, type SettingsStoreClient } from "@camstack/types";
 /**
 * @durable class=config owner=core-blocks
-*   write="`setValues` / `mergeValues` persist the operator's prefs for one block"
-*   retention="`delete` when the block is deleted. Nothing ages out."
+*   write="NOTHING since D880 - the values live in the block addon's `addon-settings` rows. Only the one-shot `migrateRawSecrets` reads it, then deletes each row."
+*   retention="legacy: every row is deleted by the verified operator migration; the declaration goes with it once every hub ran it."
 */
 export declare const CORE_BLOCK_SETTINGS_COLLECTION = "core-blocks:settings";
 export declare const CORE_BLOCK_SETTINGS_COLUMNS: readonly [{
@@ -29,15 +16,74 @@ export declare const CORE_BLOCK_SETTINGS_COLUMNS: readonly [{
 	readonly notNull: true;
 	readonly defaultValue: "{}";
 }];
+/** The keychain door for a given owner, or null when this process has none. */
+export type SecretsForOwner = (owner: string) => SecretsAccess | null;
 export interface BlockSettingsStoreDeps {
 	readonly store: SettingsStoreClient;
+	readonly keychainFor: SecretsForOwner;
+	/** Told about keychain refs a write dropped but could not delete (they are now orphans). */
+	readonly onOrphaned?: (blockId: string, refs: readonly string[]) => void;
+}
+/** The block declares a secret, but this process has no keychain door to put it in. */
+export declare class BlockSecretsUnavailableError extends Error {
+	readonly blockId: string;
+	constructor(blockId: string);
+}
+/** The block addon's settings rows could not be read: never answered as "empty". */
+export declare class BlockSettingsUnreadableError extends Error {
+	readonly blockId: string;
+	constructor(blockId: string, reason: string);
+}
+/** One block as the migration sees it. */
+export interface BlockSecretsSubject {
+	readonly id: string;
+	readonly settingsSchema?: ConfigUISchema | undefined;
 }
 export declare class BlockSettingsStore {
 	private readonly store;
+	private readonly keychainFor;
+	private readonly onOrphaned;
 	constructor(deps: BlockSettingsStoreDeps);
+	/** Declares the LEGACY collection, so the migration can read it. */
 	static declare(store: SettingsStoreClient): Promise<void>;
-	getValues(blockId: string): Promise<Record<string, unknown>>;
-	mergeValues(blockId: string, patch: Record<string, unknown>): Promise<Record<string, unknown>>;
+	private rows;
+	/**
+	* The block's stored values - markers, NOT resolved. For the admin form
+	* (`hydrateSchema` turns a marker into a "set" view) and as the `stored`
+	* side of a write. Absent answers `{}`; an unreadable store THROWS.
+	*/
+	readStored(blockId: string): Promise<Record<string, unknown>>;
+	/**
+	* Patch the block's values. Secret fields (by the schema TYPE) go to the
+	* keychain first and the row gets the marker; a keychain that cannot take
+	* them refuses the whole patch.
+	*/
+	mergeValues(blockId: string, schema: ConfigUISchema | undefined, patch: Record<string, unknown>): Promise<void>;
+	/** The block is gone: its rows, its keychain values and the legacy blob go with it. */
 	delete(blockId: string): Promise<void>;
-	private mirrorToBlockAddon;
+	/**
+	* D880: move every plaintext secret a block's `settingsSchema` declares into
+	* the keychain, and delete the legacy `core-blocks:settings` blob.
+	*
+	* Per block: gather the values (the addon-settings rows win; a key only the
+	* blob holds is carried over), put each secret, READ IT BACK and compare,
+	* and only then write the marker. The legacy row is deleted only after the
+	* block's rows hold every key it had and every secret resolves. A block that
+	* fails stays exactly as it was. Dry run unless `apply`; idempotent; counts
+	* only - never a value, a ref or a block id.
+	*/
+	migrateRawSecrets(blocks: readonly BlockSecretsSubject[], apply: boolean): Promise<RawSecretMigrationReport>;
+	/**
+	* The keys of the legacy blob that may be copied into the block's rows: not in
+	* the rows already, not a secret the tree moves, not a credential-named value no
+	* schema declares (flagged instead), and not a marker that points at another
+	* owner's secret (counted as `foreign`, never copied).
+	*/
+	private carryable;
+	private dropLegacy;
+	/** put -> read back -> compare -> only then the marker rows. */
+	private moveBlock;
+	/** Remove the values a failed move put, never one the row already pointed at. */
+	private discard;
+	private report;
 }

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CyIHDLCg.js");
-const require_composition_sources = require("../../composition-sources-DmSEMtUD.js");
+const require_dist = require("../../dist-D1vECb_6.js");
+const require_composition_sources = require("../../composition-sources-NAPZddic.js");
 const require_prefix_range = require("../../prefix-range-D_KueXbQ.js");
 const require_prefix_walk = require("../../prefix-walk-Dv6MLZlM.js");
 let node_crypto = require("node:crypto");
@@ -10,6 +10,7 @@ let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
+let node_util = require("node:util");
 let node_module = require("node:module");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
@@ -75,6 +76,10 @@ import * as blockModule from './block.js'
 
 const BLOCK_ID = __BLOCK_ID__
 const BLOCK_NAME = __BLOCK_NAME__
+// The block's settings form, embedded so the SDK derives the keychain secret
+// tree from it (a password field is stored as a marker and read back resolved,
+// D880). null = the block declares none.
+const BLOCK_SETTINGS_SCHEMA = __BLOCK_SETTINGS_SCHEMA__
 const blockMain = blockModule.default
 
 export default class CoreBlockAddon extends BaseAddon {
@@ -86,6 +91,10 @@ export default class CoreBlockAddon extends BaseAddon {
     this.disposer = null
   }
 
+  globalSettingsSchema() {
+    return BLOCK_SETTINGS_SCHEMA
+  }
+
   async onInitialize() {
     if (typeof blockMain !== 'function') {
       throw new Error(
@@ -113,8 +122,8 @@ export default class CoreBlockAddon extends BaseAddon {
 `;
 /** Build the wrapper for one block. Exported for the test that asserts the
 *  generated source actually carries the block's identity. */
-function renderBlockWrapper(blockId, blockName) {
-	return WRAPPER_SOURCE.replace("__BLOCK_ID__", JSON.stringify(blockId)).replace("__BLOCK_NAME__", JSON.stringify(blockName));
+function renderBlockWrapper(blockId, blockName, settingsSchema = void 0) {
+	return WRAPPER_SOURCE.replace("__BLOCK_ID__", () => JSON.stringify(blockId)).replace("__BLOCK_NAME__", () => JSON.stringify(blockName)).replace("__BLOCK_SETTINGS_SCHEMA__", () => JSON.stringify(settingsSchema ?? null));
 }
 /** The package manifest the addon runner reads to find the entry point. */
 function renderBlockManifest(blockId, blockName) {
@@ -163,7 +172,7 @@ async function materializeBlock(input) {
 	await Promise.all([
 		node_fs_promises.writeFile(node_path.join(addonDir, "package.json"), renderBlockManifest(input.blockId, input.blockName), "utf-8"),
 		node_fs_promises.writeFile(node_path.join(distDir, "block.js"), input.js, "utf-8"),
-		node_fs_promises.writeFile(node_path.join(distDir, "index.js"), renderBlockWrapper(input.blockId, input.blockName), "utf-8")
+		node_fs_promises.writeFile(node_path.join(distDir, "index.js"), renderBlockWrapper(input.blockId, input.blockName, input.settingsSchema), "utf-8")
 	]);
 	return {
 		addonDir,
@@ -426,7 +435,8 @@ var BlockSupervisor = class {
 				blockId: block.id,
 				blockName: block.name,
 				js: compiled.js,
-				files
+				files,
+				settingsSchema: block.settingsSchema
 			});
 			await this.deps.host.spawn({
 				runnerId: pkg.addonId,
@@ -560,9 +570,33 @@ function createAddonSettingsStore(door, addonId) {
 //#endregion
 //#region src/builtins/core-blocks/block-settings-store.ts
 /**
+* Preference values for core blocks.
+*
+* Schema lives on the block record (`settingsSchema`, extracted from the
+* compiled entry's named export or set by the editor). The VALUES live where a
+* running script reads them and nowhere else: the block addon's own
+* `addon-settings` rows (`core-block-<id>.<field>`, D870), so
+* `ctx.settings.readAddonStore()` answers them like any addon's settings and a
+* settings patch never rewrites the operator's source.
+*
+* A field the block's `settingsSchema` declares `password` / `secret: true` is
+* keychain-backed (D783 / D787), owner = the block's addon id, scope `global`:
+* the row holds the marker, the value lives in the keychain. The block's
+* generated wrapper declares the same schema, so the running script reads the
+* resolved VALUE. A marker is honoured only for its own ref (an incoming marker
+* is never stored - the write path treats it as "keep"), a REDACTED / view
+* value keeps what is stored, and a keychain that cannot take a write refuses
+* it rather than storing plaintext.
+*
+* Before D880 the values were ALSO kept as one blob per block in
+* `core-blocks:settings`: two raw copies of every password. That collection is
+* now LEGACY - read only by {@link BlockSettingsStore.migrateRawSecrets}, which
+* moves the secrets, copies any key the rows lack, and deletes the blob.
+*/
+/**
 * @durable class=config owner=core-blocks
-*   write="`setValues` / `mergeValues` persist the operator's prefs for one block"
-*   retention="`delete` when the block is deleted. Nothing ages out."
+*   write="NOTHING since D880 - the values live in the block addon's `addon-settings` rows. Only the one-shot `migrateRawSecrets` reads it, then deletes each row."
+*   retention="legacy: every row is deleted by the verified operator migration; the declaration goes with it once every hub ran it."
 */
 var CORE_BLOCK_SETTINGS_COLLECTION = "core-blocks:settings";
 var CORE_BLOCK_SETTINGS_COLUMNS = [{
@@ -576,54 +610,335 @@ var CORE_BLOCK_SETTINGS_COLUMNS = [{
 	notNull: true,
 	defaultValue: "{}"
 }];
+/** The block declares a secret, but this process has no keychain door to put it in. */
+var BlockSecretsUnavailableError = class extends Error {
+	blockId;
+	constructor(blockId) {
+		super(`core block "${blockId}" declares a password field, but this process has no keychain door - nothing was saved. Unlock the keychain (System -> Secrets) and save again.`);
+		this.blockId = blockId;
+		this.name = "BlockSecretsUnavailableError";
+	}
+};
+/** The block addon's settings rows could not be read: never answered as "empty". */
+var BlockSettingsUnreadableError = class extends Error {
+	blockId;
+	constructor(blockId, reason) {
+		super(`core block "${blockId}": its settings rows cannot be read (${reason})`);
+		this.blockId = blockId;
+		this.name = "BlockSettingsUnreadableError";
+	}
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Walk `blob` along the secret `tree`: how many declared secret values are raw / markers. */
+function countSecretLeaves(tree, blob) {
+	const counts = {
+		raw: 0,
+		markers: 0
+	};
+	if (!isRecord(blob)) return counts;
+	const visit = (node, value) => {
+		if (node.kind === "leaf") {
+			if (require_dist.isSecretMarker(value)) counts.markers += 1;
+			else if (typeof value === "string" && value.length > 0) counts.raw += 1;
+			return;
+		}
+		if (node.kind === "object") {
+			if (isRecord(value)) for (const [key, child] of node.children) visit(child, value[key]);
+			return;
+		}
+		if (Array.isArray(value)) for (const row of value) {
+			if (!isRecord(row)) continue;
+			for (const [key, child] of node.item) visit(child, row[key]);
+		}
+	};
+	for (const [key, node] of tree) visit(node, blob[key]);
+	return counts;
+}
+/** Only the top-level keys the secret tree names (and, when given, `only` holds). */
+function secretKeysOf(tree, blob, only) {
+	const out = {};
+	for (const key of tree.keys()) if (key in blob && (only === void 0 || key in only)) out[key] = blob[key];
+	return out;
+}
+/**
+* Names that LOOK like a credential. Only used on a block whose schema does not
+* declare the field (none, or a partial one): such a value cannot be moved by type,
+* so it is FLAGGED, never copied and never silently dropped.
+*/
+var CREDENTIAL_NAME = /(password|passwd|passphrase|secret|token|api_?key|private_?key|access_?code|credential|cookie|pincode|pin$)/i;
+var NOT_A_VALUE_SUFFIX = /(hash|hashed|fingerprint|count|length|expires|expiry|type|kind|version|status|label|ref|path|id|name)$/i;
+function holdsRawCredential(value, depth = 0) {
+	if (depth > 8) return false;
+	if (Array.isArray(value)) return value.some((v) => holdsRawCredential(v, depth + 1));
+	if (!isRecord(value) || require_dist.isSecretMarker(value)) return false;
+	return Object.entries(value).some(([key, child]) => CREDENTIAL_NAME.test(key) && !NOT_A_VALUE_SUFFIX.test(key) ? typeof child === "string" && child.length > 0 || holdsRawCredential(child, depth + 1) : holdsRawCredential(child, depth + 1));
+}
+/** Top-level keys the schema does not declare secret that nevertheless hold a raw credential-named value. */
+function untrackedCredentialKeys(tree, blob) {
+	const out = /* @__PURE__ */ new Set();
+	for (const [key, value] of Object.entries(blob)) {
+		if (tree.has(key)) continue;
+		if (CREDENTIAL_NAME.test(key) && !NOT_A_VALUE_SUFFIX.test(key) && typeof value === "string" && value.length > 0 || !require_dist.isSecretMarker(value) && holdsRawCredential(value)) out.add(key);
+	}
+	return out;
+}
+/** The legacy row's values, tolerating the old bare-blob shape. */
+function legacyValuesOf(row) {
+	if (!isRecord(row)) return {};
+	const values = row["values"];
+	if (isRecord(values)) return { ...values };
+	return "values" in row ? {} : { ...row };
+}
 var BlockSettingsStore = class {
 	store;
+	keychainFor;
+	onOrphaned;
 	constructor(deps) {
 		this.store = deps.store;
+		this.keychainFor = deps.keychainFor;
+		this.onOrphaned = deps.onOrphaned ?? (() => void 0);
 	}
+	/** Declares the LEGACY collection, so the migration can read it. */
 	static async declare(store) {
 		await store.declareCollection.mutate({
 			collection: CORE_BLOCK_SETTINGS_COLLECTION,
 			columns: [...CORE_BLOCK_SETTINGS_COLUMNS]
 		});
 	}
-	async getValues(blockId) {
-		const row = await this.store.get.query({
+	rows(blockId) {
+		const store = this.store;
+		return createAddonSettingsStore({
+			query: (input) => store.query.query(input),
+			get: (input) => store.get.query(input),
+			transact: (input) => store.transact.mutate(input)
+		}, require_dist.coreBlockAddonId(blockId));
+	}
+	/**
+	* The block's stored values - markers, NOT resolved. For the admin form
+	* (`hydrateSchema` turns a marker into a "set" view) and as the `stored`
+	* side of a write. Absent answers `{}`; an unreadable store THROWS.
+	*/
+	async readStored(blockId) {
+		const read = await this.rows(blockId).read();
+		if (read.kind === "unreadable") throw new BlockSettingsUnreadableError(blockId, read.error);
+		return read.kind === "present" ? { ...read.value } : {};
+	}
+	/**
+	* Patch the block's values. Secret fields (by the schema TYPE) go to the
+	* keychain first and the row gets the marker; a keychain that cannot take
+	* them refuses the whole patch.
+	*/
+	async mergeValues(blockId, schema, patch) {
+		const tree = require_dist.secretTreeFromSchema(schema ?? null);
+		if (tree.size === 0) {
+			await this.rows(blockId).merge(patch);
+			return;
+		}
+		const secrets = this.keychainFor(require_dist.coreBlockAddonId(blockId));
+		if (secrets === null) throw new BlockSecretsUnavailableError(blockId);
+		const result = await require_dist.transformSecretWrite({
+			tree,
+			secrets,
+			patch,
+			stored: await this.readStored(blockId),
+			operatorWrite: true
+		});
+		await this.rows(blockId).merge(result.patch);
+		const { orphaned } = await result.afterWrite();
+		if (orphaned.length > 0) this.onOrphaned(blockId, orphaned);
+	}
+	/** The block is gone: its rows, its keychain values and the legacy blob go with it. */
+	async delete(blockId) {
+		const stored = await this.readStored(blockId);
+		const owner = require_dist.coreBlockAddonId(blockId);
+		const refs = require_dist.collectSecretMarkerRefs(stored);
+		const removal = {};
+		for (const key of Object.keys(stored)) removal[key] = void 0;
+		await this.rows(blockId).merge(removal);
+		await this.store.delete.mutate({
 			collection: CORE_BLOCK_SETTINGS_COLLECTION,
 			key: blockId
 		});
-		if (row === null || typeof row !== "object") return {};
-		const values = row.values;
-		if (values !== null && typeof values === "object" && !Array.isArray(values)) return { ...values };
-		if (!("values" in row)) return { ...row };
-		return {};
+		if (refs.length === 0) return;
+		const secrets = this.keychainFor(owner);
+		try {
+			await secrets?.delete(refs);
+			if (secrets === null) this.onOrphaned(blockId, refs);
+		} catch {
+			this.onOrphaned(blockId, refs);
+		}
 	}
-	async mergeValues(blockId, patch) {
-		const next = {
-			...await this.getValues(blockId),
-			...patch
+	/**
+	* D880: move every plaintext secret a block's `settingsSchema` declares into
+	* the keychain, and delete the legacy `core-blocks:settings` blob.
+	*
+	* Per block: gather the values (the addon-settings rows win; a key only the
+	* blob holds is carried over), put each secret, READ IT BACK and compare,
+	* and only then write the marker. The legacy row is deleted only after the
+	* block's rows hold every key it had and every secret resolves. A block that
+	* fails stays exactly as it was. Dry run unless `apply`; idempotent; counts
+	* only - never a value, a ref or a block id.
+	*/
+	async migrateRawSecrets(blocks, apply) {
+		const legacyRows = await this.store.query.query({ collection: CORE_BLOCK_SETTINGS_COLLECTION });
+		const legacyById = /* @__PURE__ */ new Map();
+		for (const row of legacyRows) legacyById.set(row.id, legacyValuesOf(row.data));
+		const tally = {
+			rows: 0,
+			raw: 0,
+			markers: 0,
+			migrated: 0,
+			failed: 0,
+			redundant: 0
 		};
-		await this.store.set.mutate({
-			collection: CORE_BLOCK_SETTINGS_COLLECTION,
-			key: blockId,
-			value: { values: next }
-		});
-		await this.mirrorToBlockAddon(blockId, next);
-		return next;
+		const verifyAfter = [];
+		for (const block of blocks) {
+			const tree = require_dist.secretTreeFromSchema(block.settingsSchema ?? null);
+			const legacy = legacyById.get(block.id);
+			const stored = await this.readStored(block.id);
+			const effective = {
+				...legacy,
+				...stored
+			};
+			const counts = countSecretLeaves(tree, effective);
+			const untracked = untrackedCredentialKeys(tree, effective);
+			if (tree.size > 0 || untracked.size > 0) {
+				tally.rows += 1;
+				if (counts.raw > 0 || untracked.size > 0) tally.raw += 1;
+				else if (counts.markers > 0) tally.markers += 1;
+				verifyAfter.push(block);
+			}
+			const hasLegacy = legacy !== void 0;
+			if (hasLegacy) tally.redundant += 1;
+			if (!apply) continue;
+			const carry = this.carryable(block.id, effective, stored, tree, untracked);
+			if (carry.foreign > 0) tally.failed += 1;
+			if (counts.raw > 0) if (await this.moveBlock(block, tree, carry.rest, effective, stored)) tally.migrated += 1;
+			else {
+				tally.failed += 1;
+				continue;
+			}
+			else if (hasLegacy && Object.keys(carry.rest).length > 0) await this.rows(block.id).merge(carry.rest);
+			const legacyUntracked = untrackedCredentialKeys(tree, legacy ?? {});
+			if (hasLegacy && legacyUntracked.size === 0) await this.dropLegacy(block.id);
+		}
+		const known = new Set(blocks.map((b) => b.id));
+		for (const id of legacyById.keys()) {
+			if (known.has(id)) continue;
+			tally.redundant += 1;
+			if (apply) await this.dropLegacy(id);
+		}
+		return this.report(apply, tally, verifyAfter);
 	}
-	async delete(blockId) {
+	/**
+	* The keys of the legacy blob that may be copied into the block's rows: not in
+	* the rows already, not a secret the tree moves, not a credential-named value no
+	* schema declares (flagged instead), and not a marker that points at another
+	* owner's secret (counted as `foreign`, never copied).
+	*/
+	carryable(blockId, effective, stored, tree, untracked) {
+		const owner = require_dist.coreBlockAddonId(blockId);
+		const rest = {};
+		let foreign = 0;
+		for (const [key, value] of Object.entries(effective)) {
+			if (key in stored || tree.has(key) || untracked.has(key)) continue;
+			if (require_dist.collectSecretMarkerRefs(value).some((ref) => !require_dist.isSecretRefOwnedBy(ref, owner))) {
+				foreign += 1;
+				continue;
+			}
+			rest[key] = value;
+		}
+		return {
+			rest,
+			foreign
+		};
+	}
+	async dropLegacy(blockId) {
 		await this.store.delete.mutate({
 			collection: CORE_BLOCK_SETTINGS_COLLECTION,
 			key: blockId
 		});
 	}
-	async mirrorToBlockAddon(blockId, values) {
-		const store = this.store;
-		await createAddonSettingsStore({
-			query: (input) => store.query.query(input),
-			get: (input) => store.get.query(input),
-			transact: (input) => store.transact.mutate(input)
-		}, require_dist.coreBlockAddonId(blockId)).merge(values);
+	/** put -> read back -> compare -> only then the marker rows. */
+	async moveBlock(block, tree, rest, effective, stored) {
+		const secrets = this.keychainFor(require_dist.coreBlockAddonId(block.id));
+		if (secrets === null) return false;
+		const original = secretKeysOf(tree, effective);
+		let written = null;
+		try {
+			written = await require_dist.transformSecretWrite({
+				tree,
+				secrets,
+				patch: original,
+				stored: secretKeysOf(tree, stored),
+				operatorWrite: true
+			});
+			const back = await require_dist.resolveSecretMarkers(written.patch, secrets, { unresolved: "omit" });
+			const expected = await require_dist.resolveSecretMarkers(secretKeysOf(tree, original, written.patch), secrets, { unresolved: "omit" });
+			if (back.unresolved.length > 0 || expected.unresolved.length > 0 || !(0, node_util.isDeepStrictEqual)(back.value, expected.value)) {
+				await this.discard(secrets, written.patch, stored);
+				return false;
+			}
+			await this.rows(block.id).merge({
+				...rest,
+				...written.patch
+			});
+			await written.afterWrite();
+			return true;
+		} catch {
+			if (written !== null) await this.discard(secrets, written.patch, stored);
+			return false;
+		}
+	}
+	/** Remove the values a failed move put, never one the row already pointed at. */
+	async discard(secrets, patch, stored) {
+		const had = new Set(require_dist.collectSecretMarkerRefs(stored));
+		const fresh = require_dist.collectSecretMarkerRefs(patch).filter((ref) => !had.has(ref));
+		if (fresh.length === 0) return;
+		try {
+			await secrets.delete(fresh);
+		} catch {}
+	}
+	async report(apply, tally, subjects) {
+		let remainingRaw = 0;
+		let unresolvedMarkers = 0;
+		const legacyById = /* @__PURE__ */ new Map();
+		for (const row of await this.store.query.query({ collection: CORE_BLOCK_SETTINGS_COLLECTION })) legacyById.set(row.id, legacyValuesOf(row.data));
+		for (const block of subjects) {
+			const tree = require_dist.secretTreeFromSchema(block.settingsSchema ?? null);
+			const after = await this.readStored(block.id);
+			const counts = countSecretLeaves(tree, after);
+			remainingRaw += counts.raw;
+			const legacyKeys = legacyById.get(block.id) ?? {};
+			for (const key of untrackedCredentialKeys(tree, after)) if (!(key in legacyKeys)) remainingRaw += 1;
+			if (counts.markers === 0) continue;
+			const secrets = this.keychainFor(require_dist.coreBlockAddonId(block.id));
+			if (secrets === null) {
+				unresolvedMarkers += counts.markers;
+				continue;
+			}
+			const resolved = await require_dist.resolveSecretMarkers(secretKeysOf(tree, after), secrets, { unresolved: "omit" });
+			unresolvedMarkers += resolved.unresolved.length;
+		}
+		const bySchema = new Map(subjects.map((b) => [b.id, b.settingsSchema]));
+		for (const [id, values] of legacyById) {
+			const tree = require_dist.secretTreeFromSchema(bySchema.get(id) ?? null);
+			remainingRaw += countSecretLeaves(tree, values).raw + untrackedCredentialKeys(tree, values).size;
+		}
+		return {
+			apply,
+			rows: tally.rows,
+			raw: tally.raw,
+			markers: tally.markers,
+			migrated: tally.migrated,
+			failed: tally.failed,
+			remainingRaw,
+			unresolvedMarkers,
+			redundantCopies: tally.redundant,
+			verified: remainingRaw === 0 && unresolvedMarkers === 0
+		};
 	}
 };
 //#endregion
@@ -1953,7 +2268,14 @@ var CoreBlocksAddon = class extends require_dist.BaseAddon {
 			store: settingsStore,
 			logger: this.ctx.logger.child("store")
 		});
-		this.prefs = new BlockSettingsStore({ store: settingsStore });
+		this.prefs = new BlockSettingsStore({
+			store: settingsStore,
+			keychainFor: (owner) => this.ctx.secrets?.forOwner?.(owner) ?? null,
+			onOrphaned: (blockId, refs) => this.ctx.logger.warn("core block settings: dropped keychain refs could not be deleted", { meta: {
+				blockId,
+				refs: [...refs]
+			} })
+		});
 		await this.store.load();
 		this.transpiler = await loadTranspiler(this.ctx.logger);
 		armBlocksIntegration({
@@ -2213,13 +2535,18 @@ var CoreBlocksAddon = class extends require_dist.BaseAddon {
 				if (block === null) return null;
 				const schema = block.settingsSchema;
 				if (schema === void 0) return null;
-				return require_dist.hydrateSchema(schema, await this.requirePrefs().getValues(blockId));
+				return require_dist.hydrateSchema(schema, await this.requirePrefs().readStored(blockId), { inlineSecretsAsViews: true });
 			},
 			updateBlockSettings: async ({ blockId, patch }) => {
-				if (this.requireStore().get(blockId) === null) throw new Error(`core-blocks: no block "${blockId}"`);
-				await this.requirePrefs().mergeValues(blockId, patch);
+				const block = this.requireStore().get(blockId);
+				if (block === null) throw new Error(`core-blocks: no block "${blockId}"`);
+				await this.requirePrefs().mergeValues(blockId, block.settingsSchema, patch);
 				return { success: true };
 			},
+			migrateRawSecrets: async ({ apply }) => this.requirePrefs().migrateRawSecrets(this.requireStore().list().map((b) => ({
+				id: b.id,
+				settingsSchema: b.settingsSchema
+			})), apply),
 			getTypeDefs: async () => {
 				this.typeDefs ??= await loadBlockTypeDefs(this.ctx.logger);
 				return { libs: this.typeDefs.map((l) => ({