@evomap/evolver-proxy 2.0.0-beta.14 → 2.0.0-beta.16

package/dist/bin/evolver-proxy.d.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { mailbox } from '@evomap/evolver-core';
+import { PrivateNodeCredentialStore } from '../private/nodeCredentialStore.js';
 import { loadEnvFileFromEnv } from './envFile.js';
 import { type SelfUpdatePolicy } from '../selfUpdate/policy.js';
 import { type ReleaseBinaryOptions } from '../selfUpdate/releaseBinary.js';
@@ -11,8 +12,9 @@ import type { AtpProxyClient, ProxyDaemonDeps, ProxyTickReport } from '../daemon
 import type { HelloLifecycleMode, HelloResult, HeartbeatOptions, HeartbeatResult } from '../lifecycle/manager.js';
 import type { InboundResult } from '../sync/engine.js';
 /** evolver-proxy 系统级 daemon 入口(M6-7). EVOMAP_HUB_MODE/URL/NODE_SECRET 选址. */
-interface RunProxyMainOptions {
+export interface RunProxyMainOptions {
     environmentPrepared?: boolean;
+    recoveryPrepared?: SelfUpdateRecoveryResult;
 }
 export declare function runProxyMain(options?: RunProxyMainOptions): Promise<void>;
 export declare function recoverBoundDurableSelfUpdate(options: Omit<SelfUpdateRecoveryOptions, 'beforeJournalMutation'>): Promise<SelfUpdateRecoveryResult>;
@@ -45,7 +47,8 @@ export interface RunProxyCliOptions {
     env?: NodeJS.ProcessEnv;
     platform?: NodeJS.Platform;
     processExecPath?: string;
-    runMain?: () => Promise<void>;
+    runMain?: (options?: RunProxyMainOptions) => Promise<void>;
+    recoverStartup?: typeof recoverBoundDurableSelfUpdate;
     runUnixRecoveryController?: typeof maybeRunUnixRecoveryController;
     runWindowsRecoveryController?: typeof maybeRunWindowsRecoveryController;
     runWindowsUpdaterWorker?: typeof maybeRunWindowsUpdaterWorkerFromArgv;
@@ -73,14 +76,22 @@ export interface RuntimeDeps {
     env?: Record<string, string | undefined>;
     now?: () => number;
     privateImporter?: PrivateAdapterImporter;
+    privateNodeCredentialStore?: Pick<PrivateNodeCredentialStore, 'read' | 'write'>;
 }
 export type PublicNodeSecretSource = 'env' | 'store' | 'hub_rotate' | 'legacy_file';
 export interface PublicNodeSecretSelection {
     nodeSecret: string | undefined;
+    nodeId?: string;
     nodeSecretVersion?: number;
     source: PublicNodeSecretSource;
     storeSecret?: string;
 }
+export interface VerifiedPublicSender {
+    senderId: () => string | undefined;
+    adopt: (nodeId: string) => void;
+}
+export declare function createVerifiedPublicSender(initialNodeId?: string): VerifiedPublicSender;
+export declare function adoptVerifiedPublicNodeId(store: mailbox.MailboxStore, selection: PublicNodeSecretSelection, sender: VerifiedPublicSender, nodeId: string): void;
 export interface HubRuntime {
     hub: ProxyDaemonDeps['hub'];
     hello: (opts: {
@@ -113,6 +124,7 @@ export declare function runProxyLoop(daemon: ProxyLoopDaemon, options?: ProxyLoo
 interface CreateProxyDaemonDepsOptions {
     runtime: HubRuntime;
     store: mailbox.MailboxStore;
+    hubMode?: 'public' | 'private';
     ipcToken: string;
     ipcPort?: number;
     evolverVersion: string;
@@ -139,6 +151,7 @@ export declare function resolvePublicNodeSecret(deps: RuntimeDeps): PublicNodeSe
  */
 export declare function clearDivergedPublicNodeSecret(store: mailbox.MailboxStore, env?: NodeJS.ProcessEnv): void;
 export declare function persistSelectedPublicNodeSecret(store: mailbox.MailboxStore, selection: PublicNodeSecretSelection): void;
+export declare function persistRotatedPublicNodeCredentials(store: mailbox.MailboxStore, selection: PublicNodeSecretSelection, secret: string, version: number | undefined): void;
 export declare function persistPublicNodeSecretVersion(store: mailbox.MailboxStore, selection: PublicNodeSecretSelection, version: number | undefined): void;
 export declare function connectHubRuntime(deps: RuntimeDeps): Promise<HubRuntime>;
 export declare function resolveLegacyNodeSecret(envNodeSecret: string | undefined, storedNodeSecret: string | undefined, storedSource: string | undefined): string | undefined;

package/dist/bin/evolver-proxy.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { randomBytes } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import { readFileSync, realpathSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, resolve, win32 } from 'node:path';
@@ -10,12 +10,13 @@ import { ProxyDaemon } from '../daemon/proxyDaemon.js';
 import { resolveHubMode, resolveHubUrl } from '../daemon/selectHub.js';
 import { resolveIpcPort } from '../daemon/ipcConfig.js';
 import { traceCollectionEnabled } from '../llm/traceConfig.js';
-import { connectPrivateProxyHub } from '../private/adapterLoader.js';
+import { connectPrivateProxyHub, resolvePrivateEnterpriseToken, resolvePrivateInvitationToken, resolvePrivateNodeSecret, } from '../private/adapterLoader.js';
+import { PrivateNodeCredentialStore, PrivateNodeCredentialReadError, } from '../private/nodeCredentialStore.js';
 import { createAtpOrderConsentGate } from '../daemon/atpConsent.js';
 import { resolveProxyStorePath } from './proxyStorePath.js';
 import { publishProxySettings } from './proxySettings.js';
 import { expandHomePath, loadEnvFileFromEnv } from './envFile.js';
-import { resolveProxyNodeId } from '../lifecycle/legacyNodeId.js';
+import { readLegacyNodeId, resolveProxyNodeId } from '../lifecycle/legacyNodeId.js';
 import { getCurrentVersion } from '../selfUpdate/version.js';
 import { resolveSelfUpdatePolicy } from '../selfUpdate/policy.js';
 import { atomicReplaceExecutable, downloadGithubReleaseArtifact, resolveGithubReleaseManifest, resolveSelfUpdateTarget, } from '../selfUpdate/releaseBinary.js';
@@ -30,19 +31,23 @@ export async function runProxyMain(options = {}) {
         process.stdout.write(proxyUsage());
         return;
     }
-    if (!options.environmentPrepared) {
-        const envFile = loadProxyEnvFile(process.env);
-        if (envFile.error)
-            process.stderr.write(`[evolver-proxy] failed to load EVOLVER_ENV_FILE: ${safeLoopMessage(envFile.error)}\n`);
-    }
     // Recovery must run before any hub/store/runtime initialization. In particular,
-    // a broken store must not prevent a pending-health update from restoring the old binary.
-    const recovery = await recoverBoundDurableSelfUpdate({ env: process.env, processExecPath: process.execPath });
+    // a broken store or env-file pointer must not prevent a pending-health update from restoring the old binary.
+    const recovery = options.recoveryPrepared
+        ?? await recoverBoundDurableSelfUpdate({
+            env: proxyRecoveryEnvironment(process.env),
+            processExecPath: process.execPath,
+        });
     if (recovery.outcome === 'blocked') {
         throw new Error(`self_update_recovery_blocked:${recovery.failureCode ?? 'unknown'}`);
     }
     if (recovery.restartRequired)
         process.exit(78);
+    if (!options.environmentPrepared) {
+        const envFile = loadProxyEnvFile(process.env);
+        if (envFile.error)
+            throw new Error(`failed to load EVOLVER_ENV_FILE: ${safeLoopMessage(envFile.error)}`);
+    }
     let storePath;
     let store;
     let proxyDaemon;
@@ -92,11 +97,21 @@ export async function runProxyMain(options = {}) {
                 },
             });
         };
-        const runtime = await connectHubRuntime({ mode, hubUrl, senderId, store });
+        const privateNodeCredentialStore = mode === 'private'
+            ? new PrivateNodeCredentialStore(storePath)
+            : undefined;
+        const runtime = await connectHubRuntime({
+            mode,
+            hubUrl,
+            senderId,
+            store,
+            ...(privateNodeCredentialStore ? { privateNodeCredentialStore } : {}),
+        });
         proxyDaemon = new ProxyDaemon({
             ...createProxyDaemonDeps({
                 runtime,
                 store,
+                hubMode: mode,
                 ipcToken,
                 ...(ipcPort !== undefined ? { ipcPort } : {}),
                 evolverVersion,
@@ -152,7 +167,17 @@ export function loadProxyEnvFile(env) {
     const supervisor = env['EVOLVER_SELF_UPDATE_SUPERVISOR'];
     const stateDir = env['EVOLVER_SELF_UPDATE_STATE_DIR'];
     const targetPath = env['EVOLVER_SELF_UPDATE_TARGET_PATH'];
+    const systemRootBindings = Object.entries(env)
+        .filter(([key]) => key.toLowerCase() === 'systemroot');
     const result = loadEnvFileFromEnv(env);
+    for (const key of Object.keys(env)) {
+        if (key.toLowerCase() === 'systemroot')
+            delete env[key];
+    }
+    for (const [key, value] of systemRootBindings) {
+        if (value !== undefined)
+            env[key] = value;
+    }
     if (supervisor === undefined) {
         delete env['EVOLVER_SELF_UPDATE_SUPERVISOR'];
     }
@@ -165,6 +190,11 @@ export function loadProxyEnvFile(env) {
     }
     return result;
 }
+function proxyRecoveryEnvironment(env) {
+    const recoveryEnv = { ...env };
+    loadProxyEnvFile(recoveryEnv);
+    return recoveryEnv;
+}
 function finalizeRecoveryTelemetry(store, recovery) {
     try {
         finalizeSelfUpdateRecoveryLastUpdate(store, recovery);
@@ -302,6 +332,10 @@ export function prepareProxyCliEnvironment(argv, env) {
     if (options.envFile)
         env['EVOLVER_ENV_FILE'] = options.envFile;
     const envFile = loadProxyEnvFile(env);
+    applyProxyCliPathOptions(options, env);
+    return { options, envFile };
+}
+function applyProxyCliPathOptions(options, env) {
     if (options.home) {
         env['EVOMAP_DIR'] = options.home;
         env['EVOLVER_HOME'] = options.home;
@@ -320,7 +354,6 @@ export function prepareProxyCliEnvironment(argv, env) {
         env['EVOLVER_PROXY_STORE'] = options.store;
     if (options.settings)
         env['EVOLVER_PROXY_SETTINGS_FILE'] = options.settings;
-    return { options, envFile };
 }
 export async function runProxyCli(options = {}) {
     const argv = options.argv ?? process.argv.slice(2);
@@ -356,11 +389,28 @@ export async function runProxyCli(options = {}) {
             process.stdout.write(proxyUsage(argv[0] === 'proxy' ? 'evolver proxy' : 'evolver-proxy'));
             return 0;
         }
+        if (cliOptions.envFile)
+            env['EVOLVER_ENV_FILE'] = cliOptions.envFile;
+        applyProxyCliPathOptions(cliOptions, env);
+        const recovery = options.recoverStartup || !options.runMain
+            ? await (options.recoverStartup ?? recoverBoundDurableSelfUpdate)({
+                env: proxyRecoveryEnvironment(env),
+                processExecPath: options.processExecPath ?? process.execPath,
+            })
+            : undefined;
+        if (recovery?.outcome === 'blocked') {
+            throw new Error(`self_update_recovery_blocked:${recovery.failureCode ?? 'unknown'}`);
+        }
+        if (recovery?.restartRequired)
+            return 78;
         const prepared = prepareProxyCliEnvironment(argv, env);
         if (prepared.envFile.error) {
-            process.stderr.write(`[evolver-proxy] failed to load EVOLVER_ENV_FILE: ${safeLoopMessage(prepared.envFile.error)}\n`);
+            throw new Error(`failed to load EVOLVER_ENV_FILE: ${safeLoopMessage(prepared.envFile.error)}`);
         }
-        await (options.runMain ?? (() => runProxyMain({ environmentPrepared: true })))();
+        await (options.runMain ?? runProxyMain)({
+            environmentPrepared: true,
+            ...(recovery ? { recoveryPrepared: recovery } : {}),
+        });
         return 0;
     }
     catch (error) {
@@ -376,6 +426,20 @@ if (isDirectRun(import.meta.url, process.argv[1])) {
         process.exitCode = exitCode;
     });
 }
+export function createVerifiedPublicSender(initialNodeId) {
+    let verifiedNodeId = initialNodeId;
+    return {
+        senderId: () => verifiedNodeId,
+        adopt: (nodeId) => {
+            verifiedNodeId = nodeId;
+        },
+    };
+}
+export function adoptVerifiedPublicNodeId(store, selection, sender, nodeId) {
+    store.setState('node_id', nodeId);
+    selection.nodeId = nodeId;
+    sender.adopt(nodeId);
+}
 export async function runProxyLoop(daemon, options = {}) {
     const minDelayMs = options.minDelayMs ?? 1_000;
     const errorDelayMs = options.errorDelayMs ?? 5_000;
@@ -451,6 +515,7 @@ export function createProxyDaemonDeps(options) {
     const traceBackfill = resolveTraceBackfillConfig(options.env ?? process.env);
     return {
         hub: options.runtime.hub,
+        ...(options.hubMode ? { hubMode: options.hubMode } : {}),
         store: options.store,
         ipcToken: options.ipcToken,
         ...(options.ipcPort !== undefined ? { ipcPort: options.ipcPort } : {}),
@@ -675,29 +740,80 @@ function selfUpdateSupervisorAttested(env) {
         || supervisor === 'windows-scheduled-task';
 }
 export function resolvePublicNodeSecret(deps) {
-    const envNodeSecret = process.env['EVOMAP_NODE_SECRET'] ?? process.env['A2A_NODE_SECRET'];
-    // version env precedence MUST mirror the node_secret precedence above (EVOMAP-first) so an operator
-    // who sets both env pairs always resolves a matched (secret, version). v2 standardizes on EVOMAP_*-first
-    // for BOTH secret and version; v1 uses A2A_*-first but pairs the two identically. Do not flip one alone.
-    const envNodeSecretVersion = parseNodeSecretVersion(process.env['EVOMAP_NODE_SECRET_VERSION'] ?? process.env['A2A_NODE_SECRET_VERSION']);
+    const explicit = resolveExplicitPublicNodeCredentials(process.env);
     const storedNodeSecret = deps.store.getState('node_secret');
+    const storedNodeId = deps.store.getState('node_id')?.trim() || undefined;
     const storedSource = deps.store.getState('node_secret_source');
     const storedNodeSecretVersion = parseNodeSecretVersion(deps.store.getState('node_secret_version'));
-    const storeSecret = storedNodeSecret && isNodeSecret(storedNodeSecret) ? storedNodeSecret : undefined;
-    if (storedSource === 'hub_rotate' && storeSecret) {
-        return { nodeSecret: storeSecret, nodeSecretVersion: storedNodeSecretVersion, source: 'hub_rotate', storeSecret };
+    const storeSecret = storedSource?.startsWith('pending_')
+        ? undefined
+        : storedNodeSecret && isNodeSecret(storedNodeSecret) ? storedNodeSecret : undefined;
+    const legacy = readLegacyNodeSecret(process.env);
+    const pairedStoreNodeId = storedNodeId
+        ?? (explicit.nodeSecret === storeSecret ? explicit.nodeId : undefined)
+        ?? (legacy && legacy.nodeSecret === storeSecret ? legacy.nodeId : undefined);
+    const completeExplicitOverridesOrphan = Boolean(explicit.nodeId
+        && explicit.nodeSecret
+        && explicit.nodeSecret !== storeSecret
+        && pairedStoreNodeId !== explicit.nodeId);
+    if (storedSource === 'hub_rotate' && storeSecret && !completeExplicitOverridesOrphan) {
+        return {
+            nodeSecret: storeSecret,
+            ...(pairedStoreNodeId ? { nodeId: pairedStoreNodeId } : {}),
+            nodeSecretVersion: storedNodeSecretVersion,
+            source: 'hub_rotate',
+            storeSecret,
+        };
     }
-    if (envNodeSecret) {
-        const pairedStoreVersion = envNodeSecret === storeSecret ? storedNodeSecretVersion : undefined;
-        return { nodeSecret: envNodeSecret, nodeSecretVersion: envNodeSecretVersion ?? pairedStoreVersion, source: 'env', storeSecret };
+    if (explicit.nodeSecret) {
+        const pairedNodeId = explicit.nodeId
+            ?? (legacy?.nodeSecret === explicit.nodeSecret ? legacy.nodeId : undefined);
+        const pairedStoreVersion = explicit.nodeSecret === storeSecret ? storedNodeSecretVersion : undefined;
+        return {
+            nodeSecret: explicit.nodeSecret,
+            ...(pairedNodeId ? { nodeId: pairedNodeId } : {}),
+            nodeSecretVersion: explicit.nodeSecretVersion ?? pairedStoreVersion,
+            source: 'env',
+            storeSecret,
+        };
+    }
+    if (storeSecret) {
+        return {
+            nodeSecret: storeSecret,
+            ...(pairedStoreNodeId ? { nodeId: pairedStoreNodeId } : {}),
+            nodeSecretVersion: storedNodeSecretVersion,
+            source: 'store',
+            storeSecret,
+        };
     }
-    if (storeSecret)
-        return { nodeSecret: storeSecret, nodeSecretVersion: storedNodeSecretVersion, source: 'store', storeSecret };
-    const legacy = readLegacyNodeSecret(process.env);
     if (legacy)
         return { ...legacy, source: 'legacy_file' };
     return { nodeSecret: undefined, source: 'store' };
 }
+function resolveExplicitPublicNodeCredentials(env) {
+    const evomap = publicCredentialNamespace(env, 'EVOMAP');
+    const a2a = publicCredentialNamespace(env, 'A2A');
+    if (evomap.nodeId && evomap.nodeSecret)
+        return evomap;
+    if (a2a.nodeId && a2a.nodeSecret)
+        return a2a;
+    if (evomap.nodeId && a2a.nodeId && evomap.nodeId === a2a.nodeId) {
+        return evomap.nodeSecret ? evomap : a2a.nodeSecret ? a2a : {};
+    }
+    if (evomap.nodeId || a2a.nodeId)
+        return {};
+    return evomap.nodeSecret ? evomap : a2a.nodeSecret ? a2a : {};
+}
+function publicCredentialNamespace(env, prefix) {
+    const nodeId = env[`${prefix}_NODE_ID`]?.trim() || undefined;
+    const nodeSecret = env[`${prefix}_NODE_SECRET`]?.trim() || undefined;
+    const nodeSecretVersion = parseNodeSecretVersion(env[`${prefix}_NODE_SECRET_VERSION`]);
+    return {
+        ...(nodeId ? { nodeId } : {}),
+        ...(nodeSecret ? { nodeSecret } : {}),
+        ...(nodeSecretVersion !== undefined ? { nodeSecretVersion } : {}),
+    };
+}
 function setOptionalStoreState(store, key, value) {
     store.setState(key, value ?? '');
 }
@@ -732,8 +848,13 @@ function readLegacyNodeSecret(env = process.env) {
         const nodeSecret = readTrimmedFile(join(home, 'node_secret'));
         if (!nodeSecret || !isNodeSecret(nodeSecret))
             continue;
+        const nodeId = readLegacyNodeId({ candidates: [join(home, 'node_id')] });
         const nodeSecretVersion = parseNodeSecretVersion(readTrimmedFile(join(home, 'node_secret_version')));
-        return { nodeSecret, ...(nodeSecretVersion !== undefined ? { nodeSecretVersion } : {}) };
+        return {
+            ...(nodeId ? { nodeId } : {}),
+            nodeSecret,
+            ...(nodeSecretVersion !== undefined ? { nodeSecretVersion } : {}),
+        };
     }
     return undefined;
 }
@@ -768,9 +889,20 @@ export function clearDivergedPublicNodeSecret(store, env = process.env) {
 export function persistSelectedPublicNodeSecret(store, selection) {
     if (selection.source !== 'legacy_file' || !selection.nodeSecret)
         return;
+    store.setState('node_secret_source', 'pending_legacy');
+    if (selection.nodeId)
+        store.setState('node_id', selection.nodeId);
     store.setState('node_secret', selection.nodeSecret);
-    store.setState('node_secret_source', 'legacy_file');
     setOptionalStoreState(store, 'node_secret_version', selection.nodeSecretVersion !== undefined ? String(selection.nodeSecretVersion) : undefined);
+    store.setState('node_secret_source', 'legacy_file');
+}
+export function persistRotatedPublicNodeCredentials(store, selection, secret, version) {
+    store.setState('node_secret_source', 'pending_rotate');
+    if (selection.nodeId)
+        store.setState('node_id', selection.nodeId);
+    store.setState('node_secret', secret);
+    setOptionalStoreState(store, 'node_secret_version', version !== undefined ? String(version) : undefined);
+    store.setState('node_secret_source', 'hub_rotate');
 }
 export function persistPublicNodeSecretVersion(store, selection, version) {
     const currentStoreSecret = store.getState('node_secret');
@@ -801,10 +933,33 @@ function isDirectRun(metaUrl, argv1) {
 }
 export async function connectHubRuntime(deps) {
     if (deps.mode === 'private') {
+        const storedInvitationFingerprint = deps.store.getState('private_invitation_fingerprint')?.trim();
+        const runtimeEnv = deps.env ?? process.env;
+        let storedNodeSecret;
+        try {
+            storedNodeSecret = deps.privateNodeCredentialStore?.read();
+        }
+        catch (error) {
+            if (!(error instanceof PrivateNodeCredentialReadError)
+                || !hasPrivateEnrollmentFallback(runtimeEnv, storedInvitationFingerprint)) {
+                throw error;
+            }
+        }
         const runtime = await connectPrivateProxyHub({
             hubUrl: deps.hubUrl,
             senderId: deps.senderId,
-            env: deps.env ?? process.env,
+            env: runtimeEnv,
+            ...(storedNodeSecret ? { storedNodeSecret } : {}),
+            ...(storedInvitationFingerprint ? { storedInvitationFingerprint } : {}),
+            ...(deps.privateNodeCredentialStore ? {
+                onNodeSecretAdopted: (nodeSecret) => {
+                    deps.privateNodeCredentialStore?.write(nodeSecret);
+                    deps.store.setState('private_node_secret_source', 'hub_enrollment');
+                },
+            } : {}),
+            onInvitationRedeemed: (fingerprint) => {
+                deps.store.setState('private_invitation_fingerprint', fingerprint);
+            },
             ...(deps.now ? { now: deps.now } : {}),
             ...(deps.privateImporter ? { importer: deps.privateImporter } : {}),
         });
@@ -820,17 +975,17 @@ export async function connectHubRuntime(deps) {
     if (!nodeSecret)
         throw new Error('public legacy 模式需 EVOMAP_NODE_SECRET');
     persistSelectedPublicNodeSecret(deps.store, selection);
+    const verifiedSender = createVerifiedPublicSender(selection.nodeId);
+    const senderId = verifiedSender.senderId;
     const { hub, auth } = connectPublicHub({
         hubUrl: deps.hubUrl,
         authMode: 'legacy',
         nodeSecret,
         ...(nodeSecretVersion !== undefined ? { nodeSecretVersion } : {}),
-        senderId: deps.senderId,
+        senderId,
         antiAbuse: { source: 'evolver-proxy', proxyPortConfigured: true },
         onNodeSecretRotated: (secret, version) => {
-            deps.store.setState('node_secret', secret);
-            deps.store.setState('node_secret_source', 'hub_rotate');
-            setOptionalStoreState(deps.store, 'node_secret_version', version !== undefined ? String(version) : undefined);
+            persistRotatedPublicNodeCredentials(deps.store, selection, secret, version);
         },
         onNodeSecretVersionUpdated: (version) => {
             persistPublicNodeSecretVersion(deps.store, selection, version);
@@ -843,11 +998,25 @@ export async function connectHubRuntime(deps) {
     });
     return {
         hub,
-        atp: new AtpHubClient({ baseUrl: deps.hubUrl, auth, fetchFn: globalFetchLike, senderId: deps.senderId }),
-        hello: (opts) => hub.hello(opts),
+        atp: new AtpHubClient({ baseUrl: deps.hubUrl, auth, fetchFn: globalFetchLike, senderId }),
+        hello: async (opts) => {
+            const result = await hub.hello(opts);
+            if (result.nodeId) {
+                adoptVerifiedPublicNodeId(deps.store, selection, verifiedSender, result.nodeId);
+            }
+            return result;
+        },
         heartbeat: (opts) => hub.heartbeat(opts),
     };
 }
+function hasPrivateEnrollmentFallback(env, storedInvitationFingerprint) {
+    if (resolvePrivateNodeSecret(env) || resolvePrivateEnterpriseToken(env))
+        return true;
+    const invitationToken = resolvePrivateInvitationToken(env);
+    if (!invitationToken)
+        return false;
+    return createHash('sha256').update(invitationToken).digest('hex') !== storedInvitationFingerprint;
+}
 export function resolveLegacyNodeSecret(envNodeSecret, storedNodeSecret, storedSource) {
     if (envNodeSecret)
         return envNodeSecret;

package/dist/daemon/atpConsent.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { events } from '@evomap/evolver-core';
 export class AtpProxySpendConsentError extends Error {
     source;
     constructor(source) {
@@ -10,7 +10,10 @@ export class AtpProxySpendConsentError extends Error {
     }
 }
 function atpProxyConsentPath(env = process.env) {
-    const home = env['EVOMAP_DIR'] ?? env['EVOLVER_HOME'] ?? env['EVOMAP_HOME'] ?? events.evomapHome();
+    const home = [env['EVOMAP_DIR'], env['EVOLVER_HOME'], env['EVOMAP_HOME']]
+        .map((value) => value?.trim())
+        .find((value) => Boolean(value))
+        ?? join(homedir(), '.evomap');
     return join(home, 'evolution', 'atp-autobuy-ack.json');
 }
 export function getAtpProxyConsent(env = process.env, ackPath = atpProxyConsentPath(env)) {

package/dist/daemon/proxyDaemon.d.ts

@@ -8,6 +8,8 @@ type AssetStoreProvider = assetstore.AssetStoreProvider;
 export declare const DEFAULT_IPC_PORT = 19820;
 export interface ProxyDaemonDeps {
     hub: HubCapability;
+    /** Immutable Hub selection for IPC callers that must fail closed across public/private runtimes. */
+    hubMode?: 'public' | 'private';
     /** 二选一: 传 storePath 让 ProxyDaemon 建 store, 或传已建 store(供 hub senderId 共享同一 node_id). */
     storePath?: string;
     store?: mailbox.MailboxStore;

package/dist/daemon/proxyDaemon.js

@@ -585,6 +585,11 @@ export class ProxyDaemon {
         return Number.isFinite(n) && n > 0 ? n : null;
     }
     async handleProxyRoute(ctx) {
+        const expectedHeader = singleHeader(ctx.req.headers['x-evomap-expected-hub-mode']);
+        if (hubModeMismatch(expectedHeader, this.deps.hubMode)) {
+            ctx.json(409, { error: 'proxy_hub_mode_mismatch' });
+            return true;
+        }
         if (await this.collaborationFacade.handle(ctx))
             return true;
         const handledAtp = await this.handleAtpRoute(ctx);
@@ -593,6 +598,7 @@ export class ProxyDaemon {
         if (ctx.route === 'GET /proxy/status') {
             ctx.json(200, {
                 running: true,
+                hub_mode: this.deps.hubMode ?? 'public',
                 node_id: this.lifecycle.nodeId ?? null,
                 outbound_pending: this.store.countPending('proxy', this.deps.runtimeNamespace),
                 inbound_pending: this.store.countPending('agent', this.deps.runtimeNamespace) + this.store.countPending('core', this.deps.runtimeNamespace),
@@ -616,6 +622,10 @@ export class ProxyDaemon {
         }
         if (ctx.route === 'POST /asset/search') {
             const body = (await ctx.readJson());
+            if (hubModeMismatch(body.expected_hub_mode, this.deps.hubMode)) {
+                ctx.json(409, { error: 'proxy_hub_mode_mismatch' });
+                return true;
+            }
             const limit = Math.max(1, Math.min(Number(body.limit ?? 5), 25));
             const rawSignals = Array.isArray(body.signals) ? body.signals : body.signalsAny;
             const signalsAny = Array.isArray(rawSignals) ? rawSignals.filter((s) => typeof s === 'string') : undefined;
@@ -638,6 +648,10 @@ export class ProxyDaemon {
         }
         if (ctx.route === 'POST /asset/fetch') {
             const body = (await ctx.readJson());
+            if (hubModeMismatch(body.expected_hub_mode, this.deps.hubMode)) {
+                ctx.json(409, { error: 'proxy_hub_mode_mismatch' });
+                return true;
+            }
             const ids = uniqueStrings([
                 ...(Array.isArray(body.asset_ids) ? body.asset_ids : []),
                 ...(typeof body.asset_id === 'string' ? [body.asset_id] : []),
@@ -664,6 +678,10 @@ export class ProxyDaemon {
         }
         if (ctx.route === 'POST /asset/submit') {
             const body = (await ctx.readJson());
+            if (hubModeMismatch(body.expected_hub_mode, this.deps.hubMode)) {
+                ctx.json(409, { stored: false, error: 'proxy_hub_mode_mismatch' });
+                return true;
+            }
             if (!body.assets && !body.asset_id) {
                 ctx.json(400, { error: 'assets or asset_id is required' });
                 return true;
@@ -679,6 +697,10 @@ export class ProxyDaemon {
             // Pre-publish dry-run against the hub's quality + content-safety gate (nothing stored, no credits).
             // Same {assets:[…]} bundle shape as /asset/submit; the adapter wraps it in a GEP-A2A envelope.
             const body = (await ctx.readJson());
+            if (hubModeMismatch(body.expected_hub_mode, this.deps.hubMode)) {
+                ctx.json(409, { valid: false, error: 'proxy_hub_mode_mismatch' });
+                return true;
+            }
             const bundle = Array.isArray(body.assets)
                 ? body.assets.filter((a) => Boolean(a && typeof a === 'object'))
                 : (body.asset && typeof body.asset === 'object' && !Array.isArray(body.asset) ? [body.asset] : []);
@@ -704,7 +726,12 @@ export class ProxyDaemon {
             return true;
         }
         if (ctx.route === 'POST /asset/reuse-result') {
-            const parsed = parseReuseResultReport(await ctx.readJson());
+            const body = await ctx.readJson();
+            if (hubModeMismatch(asRecord(body)['expected_hub_mode'], this.deps.hubMode)) {
+                ctx.json(409, { recorded: false, error: 'proxy_hub_mode_mismatch' });
+                return true;
+            }
+            const parsed = parseReuseResultReport(body);
             if ('error' in parsed) {
                 ctx.json(400, { recorded: false, error: parsed.error });
                 return true;
@@ -723,6 +750,10 @@ export class ProxyDaemon {
         }
         if (ctx.route === 'POST /conversation/distill') {
             const body = (await ctx.readJson());
+            if (hubModeMismatch(body.expected_hub_mode, this.deps.hubMode)) {
+                ctx.json(409, { error: 'proxy_hub_mode_mismatch' });
+                return true;
+            }
             const distill = await hubNs.distillConversation(body, { persist: body.persist === true, store: this.assetStore });
             if (!distill.ok) {
                 ctx.json(200, { ...distill, queued: false, submission: null });
@@ -929,7 +960,17 @@ function isValidator(value) {
     return Boolean(value && typeof value === 'object' && typeof value.validate === 'function');
 }
 function assetMatchesId(asset, assetId) {
-    return Boolean(asset && asset.asset_id === assetId);
+    if (!asset)
+        return false;
+    return assetId.startsWith('sha256:')
+        ? asset.asset_id === assetId
+        : asset.asset_id === assetId || asset['id'] === assetId;
+}
+function hubModeMismatch(expected, actual) {
+    return expected !== undefined && expected !== (actual ?? 'public');
+}
+function singleHeader(value) {
+    return Array.isArray(value) ? value[0] : value;
 }
 function uniqueStrings(values) {
     const seen = new Set();

package/dist/daemon/selectHub.js

@@ -12,10 +12,12 @@ export function resolveHubUrl(env) {
     return resolvePublicHubUrl(env);
 }
 function resolvePrivateHubUrl(env) {
-    return trimmed(env['EVOMAP_HUB_URL'])
+    const url = trimmed(env['EVOMAP_HUB_URL'])
         ?? trimmed(env['A2A_HUB_URL'])
-        ?? trimmed(env['EVOLVER_DEFAULT_HUB_URL'])
-        ?? resolvePublicHubUrl({});
+        ?? trimmed(env['EVOLVER_DEFAULT_HUB_URL']);
+    if (!url)
+        throw new Error('private Hub URL is not configured');
+    return url;
 }
 function trimmed(value) {
     const v = value?.trim();

package/dist/private/adapterLoader.d.ts

@@ -52,6 +52,14 @@ export interface ConnectPrivateProxyHubOptions {
     now?: () => number;
     importer?: DynamicImporter;
     fetchFn?: PrivateCompatibilityFetch;
+    /** Durable credential minted by a previous invitation/SSO enrollment. */
+    storedNodeSecret?: string;
+    /** Persist a newly minted credential before the process can restart. */
+    onNodeSecretAdopted?: (nodeSecret: string) => void;
+    /** Fingerprint of the last successfully redeemed one-shot invitation. */
+    storedInvitationFingerprint?: string;
+    /** Persist the non-secret fingerprint after an invitation is redeemed. */
+    onInvitationRedeemed?: (fingerprint: string) => void;
 }
 export declare function resolvePrivateEnterpriseToken(env: Record<string, string | undefined>): string | undefined;
 /** One-shot invitation token (evoinv_…), matching the hub's official onboarding script (A2A_INVITATION_TOKEN).

package/dist/private/adapterLoader.js

@@ -1,4 +1,5 @@
 import { hub as hubNs } from '@evomap/evolver-core';
+import { createHash } from 'node:crypto';
 import { withPrivateAccountAssetCompatibility, } from './accountAssetCompatibility.js';
 const DEFAULT_PRIVATE_ADAPTER_MODULE = '@evomap/evolver-adapter-private';
 export function resolvePrivateEnterpriseToken(env) {
@@ -17,19 +18,26 @@ export function resolvePrivateEnterpriseSubject(env) {
 }
 export async function connectPrivateProxyHub(opts) {
     const invitationToken = resolvePrivateInvitationToken(opts.env);
+    const invitationFingerprint = invitationToken
+        ? createHash('sha256').update(invitationToken).digest('hex')
+        : undefined;
+    const usableInvitationToken = invitationFingerprint !== opts.storedInvitationFingerprint
+        ? invitationToken
+        : undefined;
     const token = resolvePrivateEnterpriseToken(opts.env);
-    const nodeSecret = resolvePrivateNodeSecret(opts.env);
+    const configuredNodeSecret = resolvePrivateNodeSecret(opts.env);
+    const nodeSecret = configuredNodeSecret ?? opts.storedNodeSecret?.trim();
     if (nodeSecret && !isNodeSecret(nodeSecret)) {
         throw new Error('Private Hub node_secret 必须是 64 位十六进制字符串');
     }
-    if (!token && !invitationToken && !nodeSecret) {
+    if (!token && !usableInvitationToken && !nodeSecret) {
         throw new Error('EVOMAP_HUB_MODE=private 需要 A2A_NODE_SECRET / EVOMAP_NODE_SECRET、A2A_INVITATION_TOKEN 或 EVOMAP_ENTERPRISE_TOKEN');
     }
     const moduleName = opts.env['EVOMAP_PRIVATE_ADAPTER_MODULE']?.trim() || DEFAULT_PRIVATE_ADAPTER_MODULE;
     const connectPrivateHub = await loadConnectPrivateHub(moduleName, opts.importer ?? ((specifier) => import(specifier)));
     const now = opts.now ?? (() => Date.now());
     const subject = resolvePrivateEnterpriseSubject(opts.env);
-    const { hub, auth } = connectPrivateHub({
+    const baseConnectionOptions = {
         hubUrl: opts.hubUrl,
         senderId: opts.senderId,
         env: opts.env,
@@ -39,13 +47,34 @@ export async function connectPrivateProxyHub(opts) {
             exchange: async () => ({ token: token ?? nodeSecret ?? '' }),
             now,
         },
-        ...(nodeSecret ? { nodeSecret } : {}),
-        ...(!nodeSecret && invitationToken ? { invitationToken } : {}),
         ...(opts.fetchFn ? { fetchFn: opts.fetchFn } : {}),
+    };
+    const primaryInvitationToken = !nodeSecret && !configuredNodeSecret ? usableInvitationToken : undefined;
+    const { hub, auth } = connectPrivateHub({
+        ...baseConnectionOptions,
+        ...(nodeSecret ? { nodeSecret } : {}),
+        ...(primaryInvitationToken ? { invitationToken: primaryInvitationToken } : {}),
     });
     assertPrivateLifecycle(hub, moduleName);
+    const storedInvitationFallback = nodeSecret && !configuredNodeSecret && usableInvitationToken
+        ? connectPrivateHub({ ...baseConnectionOptions, invitationToken: usableInvitationToken })
+        : undefined;
+    const enterpriseFallback = primaryInvitationToken && token
+        ? connectPrivateHub(baseConnectionOptions)
+        : undefined;
+    if (storedInvitationFallback)
+        assertPrivateLifecycle(storedInvitationFallback.hub, moduleName);
+    if (enterpriseFallback)
+        assertPrivateLifecycle(enterpriseFallback.hub, moduleName);
     if (nodeSecret)
         await adoptReadyNodeSecret(auth, nodeSecret);
+    const primaryAdoptions = trackNodeSecretAdoptions(auth);
+    const storedInvitationAdoptions = storedInvitationFallback
+        ? trackNodeSecretAdoptions(storedInvitationFallback.auth)
+        : undefined;
+    const enterpriseAdoptions = enterpriseFallback
+        ? trackNodeSecretAdoptions(enterpriseFallback.auth)
+        : undefined;
     if (!hub.agentDirectory) {
         hub.agentDirectory = hubNs.unsupportedAgentDirectoryCapability('private_hub_agent_directory_not_supported');
     }
@@ -56,14 +85,152 @@ export async function connectPrivateProxyHub(opts) {
         env: opts.env,
         ...(opts.fetchFn ? { fetchFn: opts.fetchFn } : {}),
     });
+    let readyHelloPending = Boolean(nodeSecret);
+    let invitationRedeemed = false;
+    let enterpriseFallbackSelected = false;
+    let helloInProgress = false;
+    const helloWithFallback = async (fallback, adoptions, helloOpts, rotate) => {
+        if (!adoptions?.available) {
+            throw new Error('private Hub adapter cannot report node_secret adoption');
+        }
+        if (rotate)
+            await fallback.auth.rotate();
+        const { result, adoptedNodeSecret } = await adoptions.capture(() => fallback.hub.hello(helloOpts));
+        if (!result.ok)
+            return result;
+        if (!adoptedNodeSecret)
+            throw new Error('private Hub fallback did not adopt a node_secret');
+        await adoptReadyNodeSecret(fallback.auth, adoptedNodeSecret);
+        await adoptReadyNodeSecret(auth, adoptedNodeSecret);
+        opts.onNodeSecretAdopted?.(adoptedNodeSecret);
+        return result;
+    };
+    const helloOnce = async (helloOpts) => {
+        if (enterpriseFallbackSelected || invitationRedeemed) {
+            if (!enterpriseFallback)
+                return { ok: false, error: 'private_invitation_reenrollment_required' };
+            return helloWithFallback(enterpriseFallback, enterpriseAdoptions, helloOpts, true);
+        }
+        if (primaryInvitationToken && !primaryAdoptions.available) {
+            throw new Error('private Hub adapter cannot report node_secret adoption');
+        }
+        let result;
+        let adoptedNodeSecret;
+        let usedAdapterHello = false;
+        if (nodeSecret && readyHelloPending) {
+            // A stored credential gets one ready probe before a fresh invitation takes over.
+            // Clear this before awaiting so a thrown probe cannot starve the fallback forever.
+            if (storedInvitationFallback)
+                readyHelloPending = false;
+            const tracked = await primaryAdoptions.capture(() => helloWithReadyPrivateCredential(compatibleHub, auth, nodeSecret, opts.senderId, helloOpts, primaryAdoptions.available));
+            readyHelloPending = false;
+            result = tracked.result;
+            adoptedNodeSecret = tracked.adoptedNodeSecret;
+            if (result.ok && !adoptedNodeSecret && !await authenticatesWithNodeSecret(auth, nodeSecret)) {
+                throw new Error('private Hub ready credential hello did not preserve an active node_secret');
+            }
+        }
+        else if (storedInvitationFallback) {
+            result = await helloWithFallback(storedInvitationFallback, storedInvitationAdoptions, helloOpts, false);
+            if (result.ok) {
+                invitationRedeemed = true;
+                if (invitationFingerprint)
+                    opts.onInvitationRedeemed?.(invitationFingerprint);
+            }
+            return result;
+        }
+        else {
+            usedAdapterHello = true;
+            const tracked = await primaryAdoptions.capture(() => compatibleHub.hello(helloOpts));
+            result = tracked.result;
+            adoptedNodeSecret = tracked.adoptedNodeSecret;
+        }
+        if (!result.ok && usedAdapterHello && primaryInvitationToken && enterpriseFallback) {
+            const fallbackResult = await helloWithFallback(enterpriseFallback, enterpriseAdoptions, helloOpts, true);
+            if (fallbackResult.ok)
+                enterpriseFallbackSelected = true;
+            return fallbackResult;
+        }
+        if (result.ok) {
+            if (adoptedNodeSecret && adoptedNodeSecret !== nodeSecret) {
+                await adoptReadyNodeSecret(auth, adoptedNodeSecret);
+                opts.onNodeSecretAdopted?.(adoptedNodeSecret);
+            }
+            if (usedAdapterHello && primaryInvitationToken) {
+                if (!adoptedNodeSecret) {
+                    throw new Error('private Hub enrollment did not adopt a node_secret');
+                }
+                invitationRedeemed = true;
+                if (invitationFingerprint)
+                    opts.onInvitationRedeemed?.(invitationFingerprint);
+            }
+        }
+        return result;
+    };
+    const hello = async (helloOpts) => {
+        if (helloInProgress)
+            throw new Error('concurrent private Hub hello is not supported');
+        helloInProgress = true;
+        try {
+            return await helloOnce(helloOpts);
+        }
+        finally {
+            helloInProgress = false;
+        }
+    };
     return {
         hub: compatibleHub,
         auth,
-        hello: nodeSecret
-            ? async (helloOpts) => await helloWithReadyPrivateCredential(compatibleHub, auth, nodeSecret, opts.senderId, helloOpts)
-            : (helloOpts) => compatibleHub.hello(helloOpts),
+        hello,
     };
 }
+const NODE_SECRET_ADOPTION_TRACKERS = new WeakMap();
+function trackNodeSecretAdoptions(auth) {
+    const existing = NODE_SECRET_ADOPTION_TRACKERS.get(auth);
+    if (existing)
+        return existing;
+    const candidate = auth;
+    const original = candidate.adoptNodeSecret;
+    let capturing = false;
+    let available = false;
+    let adoptedNodeSecret;
+    if (typeof original === 'function') {
+        const wrapped = function (nodeSecret) {
+            original.call(this, nodeSecret);
+            if (capturing)
+                adoptedNodeSecret = isNodeSecret(nodeSecret) ? nodeSecret : undefined;
+        };
+        try {
+            candidate.adoptNodeSecret = wrapped;
+            available = candidate.adoptNodeSecret === wrapped;
+        }
+        catch {
+            // A frozen adapter cannot expose reliable adoption provenance. Enrollment will fail closed below.
+        }
+    }
+    const tracker = {
+        get available() { return available; },
+        capture: async (operation) => {
+            if (capturing)
+                throw new Error('concurrent private Hub credential adoption is not supported');
+            capturing = true;
+            adoptedNodeSecret = undefined;
+            try {
+                const result = await operation();
+                return {
+                    result,
+                    ...(adoptedNodeSecret ? { adoptedNodeSecret } : {}),
+                };
+            }
+            finally {
+                capturing = false;
+                adoptedNodeSecret = undefined;
+            }
+        },
+    };
+    NODE_SECRET_ADOPTION_TRACKERS.set(auth, tracker);
+    return tracker;
+}
 async function loadConnectPrivateHub(moduleName, importer) {
     let loaded;
     try {
@@ -94,16 +261,21 @@ async function adoptReadyNodeSecret(auth, nodeSecret) {
         throw new Error('private Hub adapter cannot activate the configured node_secret');
     }
 }
-async function helloWithReadyPrivateCredential(hub, auth, nodeSecret, senderId, opts) {
-    if (await authenticatesWithNodeSecret(auth, nodeSecret))
-        return readyPrivateHello(senderId);
+async function helloWithReadyPrivateCredential(hub, auth, nodeSecret, senderId, opts, canTrackAdoption = true) {
+    const nodeId = trimmedSenderId(senderId);
+    if (nodeId && await authenticatesWithNodeSecret(auth, nodeSecret))
+        return readyPrivateHello(nodeId);
+    if (!canTrackAdoption)
+        throw new Error('private Hub adapter cannot report node_secret adoption');
     return await hub.hello(opts);
 }
 async function authenticatesWithNodeSecret(auth, nodeSecret) {
     const signed = await auth.authenticate({ method: 'GET', path: '/a2a/assets/published-by-me' });
     const authorization = headerValue(signed.headers, 'authorization');
     const bodySecret = signed.bodyFields?.['node_secret'];
-    return authorization === `Bearer ${nodeSecret}` || bodySecret === nodeSecret;
+    return authorization !== undefined
+        ? authorization === `Bearer ${nodeSecret}`
+        : bodySecret === nodeSecret;
 }
 function headerValue(headers, name) {
     const lower = name.toLowerCase();
@@ -116,9 +288,8 @@ function headerValue(headers, name) {
 function trimmedSenderId(senderId) {
     return senderId()?.trim() || undefined;
 }
-function readyPrivateHello(senderId) {
-    const nodeId = trimmedSenderId(senderId);
-    return { ok: true, ...(nodeId ? { nodeId } : {}) };
+function readyPrivateHello(nodeId) {
+    return { ok: true, nodeId };
 }
 function isNodeSecret(value) {
     return /^[a-f0-9]{64}$/i.test(value);

package/dist/private/nodeCredentialStore.d.ts

@@ -0,0 +1,23 @@
+export interface WindowsSecretProtector {
+    protect(secret: string): string;
+    unprotect(protectedValue: string): string;
+    preflight?(): void;
+}
+export interface PrivateNodeCredentialStoreOptions {
+    platform?: NodeJS.Platform;
+    windowsProtector?: WindowsSecretProtector;
+}
+export declare class PrivateNodeCredentialReadError extends Error {
+    constructor();
+}
+export declare class PrivateNodeCredentialStore {
+    private readonly directory;
+    private readonly path;
+    private readonly platform;
+    private readonly windowsProtector;
+    constructor(proxyStorePath: string, options?: PrivateNodeCredentialStoreOptions);
+    read(): string | undefined;
+    write(nodeSecret: string): void;
+    private prepareDirectory;
+    private assertRegularFile;
+}

package/dist/private/nodeCredentialStore.js

@@ -0,0 +1,210 @@
+import { chmodSync, closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+const DIRECTORY_MODE = 0o700;
+const FILE_MODE = 0o600;
+const NODE_SECRET_RE = /^[a-f0-9]{64}$/i;
+const WINDOWS_PROTECTED_VALUE_RE = /^[a-z0-9+/]+={0,2}$/i;
+const MAX_PROTECTED_VALUE_LENGTH = 16_384;
+export class PrivateNodeCredentialReadError extends Error {
+    constructor() {
+        super('stored private node credential is unreadable');
+        this.name = 'PrivateNodeCredentialReadError';
+    }
+}
+export class PrivateNodeCredentialStore {
+    directory;
+    path;
+    platform;
+    windowsProtector;
+    constructor(proxyStorePath, options = {}) {
+        this.platform = options.platform ?? process.platform;
+        this.windowsProtector = this.platform === 'win32'
+            ? options.windowsProtector ?? createWindowsDpapiProtector()
+            : undefined;
+        if (this.windowsProtector)
+            verifyWindowsProtector(this.windowsProtector);
+        this.directory = join(dirname(resolve(proxyStorePath)), '.private-credentials');
+        this.path = join(this.directory, this.platform === 'win32' ? 'node-secret.dpapi' : 'node-secret');
+        this.prepareDirectory();
+    }
+    read() {
+        if (!existsSync(this.path))
+            return undefined;
+        this.assertRegularFile(this.path);
+        if (this.platform !== 'win32')
+            chmodSync(this.path, FILE_MODE);
+        const storedValue = readFileSync(this.path, 'utf8').trim();
+        try {
+            const value = this.windowsProtector
+                ? this.windowsProtector.unprotect(assertWindowsProtectedValue(storedValue))
+                : storedValue;
+            if (!NODE_SECRET_RE.test(value))
+                throw new PrivateNodeCredentialReadError();
+            return value;
+        }
+        catch {
+            throw new PrivateNodeCredentialReadError();
+        }
+    }
+    write(nodeSecret) {
+        if (!NODE_SECRET_RE.test(nodeSecret))
+            throw new Error('private node credential is invalid');
+        const storedValue = this.windowsProtector
+            ? assertWindowsProtectedValue(this.windowsProtector.protect(nodeSecret))
+            : nodeSecret;
+        this.prepareDirectory();
+        if (existsSync(this.path))
+            this.assertRegularFile(this.path);
+        const temporaryPath = join(this.directory, `.node-secret.${process.pid}.${randomBytes(8).toString('hex')}.tmp`);
+        let descriptor;
+        try {
+            descriptor = openSync(temporaryPath, 'wx', FILE_MODE);
+            writeFileSync(descriptor, storedValue, 'utf8');
+            fsyncSync(descriptor);
+            closeSync(descriptor);
+            descriptor = undefined;
+            renameSync(temporaryPath, this.path);
+            if (this.platform !== 'win32')
+                chmodSync(this.path, FILE_MODE);
+            if (this.platform !== 'win32')
+                syncDirectory(this.directory);
+        }
+        catch (error) {
+            if (descriptor !== undefined)
+                closeSync(descriptor);
+            if (existsSync(temporaryPath))
+                unlinkSync(temporaryPath);
+            throw error;
+        }
+    }
+    prepareDirectory() {
+        const parent = dirname(this.directory);
+        const parentStat = lstatSync(parent);
+        if (!parentStat.isDirectory() || parentStat.isSymbolicLink()) {
+            throw new Error(`private credential parent must be a real directory: ${parent}`);
+        }
+        if (this.platform !== 'win32' && (parentStat.mode & 0o022) !== 0) {
+            throw new Error(`private credential parent must not be group/world-writable: ${parent}`);
+        }
+        const directoryExisted = existsSync(this.directory);
+        mkdirSync(this.directory, { recursive: true, mode: DIRECTORY_MODE });
+        const stat = lstatSync(this.directory);
+        if (!stat.isDirectory() || stat.isSymbolicLink()) {
+            throw new Error(`private credential path must be a real directory: ${this.directory}`);
+        }
+        if (this.platform !== 'win32')
+            chmodSync(this.directory, DIRECTORY_MODE);
+        if (!directoryExisted && this.platform !== 'win32')
+            syncDirectory(parent);
+    }
+    assertRegularFile(path) {
+        const stat = lstatSync(path);
+        if (!stat.isFile() || stat.isSymbolicLink()) {
+            throw new Error(`private credential must be a regular file: ${path}`);
+        }
+    }
+}
+function assertWindowsProtectedValue(value) {
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.length > MAX_PROTECTED_VALUE_LENGTH || !WINDOWS_PROTECTED_VALUE_RE.test(trimmed)) {
+        throw new Error('stored private node credential ciphertext is invalid');
+    }
+    return trimmed;
+}
+function createWindowsDpapiProtector() {
+    const systemRoot = process.env['SystemRoot']?.trim();
+    if (!systemRoot || !isAbsolute(systemRoot)) {
+        throw new Error('Windows private credential persistence requires an absolute SystemRoot');
+    }
+    const executable = join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+    let executableIsSafe = false;
+    try {
+        const executableStat = lstatSync(executable);
+        executableIsSafe = executableStat.isFile() && !executableStat.isSymbolicLink();
+    }
+    catch {
+        // Normalize filesystem errors so local paths are not included in startup logs.
+    }
+    if (!executableIsSafe) {
+        throw new Error('Windows private credential persistence requires Windows PowerShell');
+    }
+    return {
+        preflight: () => {
+            const canary = randomBytes(32).toString('hex');
+            if (runWindowsPowerShell(executable, WINDOWS_DPAPI_PREFLIGHT_SCRIPT, canary) !== canary) {
+                throw new Error('Windows private credential protection preflight failed');
+            }
+        },
+        protect: (secret) => runWindowsPowerShell(executable, WINDOWS_DPAPI_PROTECT_SCRIPT, secret),
+        unprotect: (protectedValue) => runWindowsPowerShell(executable, WINDOWS_DPAPI_UNPROTECT_SCRIPT, protectedValue),
+    };
+}
+function verifyWindowsProtector(protector) {
+    try {
+        if (protector.preflight) {
+            protector.preflight();
+            return;
+        }
+        const canary = randomBytes(32).toString('hex');
+        const protectedCanary = assertWindowsProtectedValue(protector.protect(canary));
+        if (protector.unprotect(protectedCanary) !== canary) {
+            throw new Error('round trip mismatch');
+        }
+    }
+    catch {
+        throw new Error('Windows private credential protection preflight failed');
+    }
+}
+function runWindowsPowerShell(executable, script, input) {
+    try {
+        return execFileSync(executable, ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', script], {
+            encoding: 'utf8',
+            input,
+            maxBuffer: 64 * 1024,
+            stdio: ['pipe', 'pipe', 'ignore'],
+            timeout: 15_000,
+            windowsHide: true,
+        }).trim();
+    }
+    catch {
+        throw new Error('Windows private credential protection failed');
+    }
+}
+const WINDOWS_DPAPI_PREFLIGHT_SCRIPT = [
+    "$ErrorActionPreference = 'Stop'",
+    'Add-Type -AssemblyName System.Security',
+    '$plain = [Console]::In.ReadToEnd()',
+    '$bytes = [Text.Encoding]::UTF8.GetBytes($plain)',
+    '$scope = [Security.Cryptography.DataProtectionScope]::CurrentUser',
+    '$protected = [Security.Cryptography.ProtectedData]::Protect($bytes, $null, $scope)',
+    '$restored = [Security.Cryptography.ProtectedData]::Unprotect($protected, $null, $scope)',
+    '[Console]::Out.Write([Text.Encoding]::UTF8.GetString($restored))',
+].join('; ');
+const WINDOWS_DPAPI_PROTECT_SCRIPT = [
+    "$ErrorActionPreference = 'Stop'",
+    'Add-Type -AssemblyName System.Security',
+    '$plain = [Console]::In.ReadToEnd()',
+    '$bytes = [Text.Encoding]::UTF8.GetBytes($plain)',
+    '$scope = [Security.Cryptography.DataProtectionScope]::CurrentUser',
+    '$protected = [Security.Cryptography.ProtectedData]::Protect($bytes, $null, $scope)',
+    '[Console]::Out.Write([Convert]::ToBase64String($protected))',
+].join('; ');
+const WINDOWS_DPAPI_UNPROTECT_SCRIPT = [
+    "$ErrorActionPreference = 'Stop'",
+    'Add-Type -AssemblyName System.Security',
+    '$protected = [Convert]::FromBase64String([Console]::In.ReadToEnd())',
+    '$scope = [Security.Cryptography.DataProtectionScope]::CurrentUser',
+    '$bytes = [Security.Cryptography.ProtectedData]::Unprotect($protected, $null, $scope)',
+    '[Console]::Out.Write([Text.Encoding]::UTF8.GetString($bytes))',
+].join('; ');
+function syncDirectory(path) {
+    const descriptor = openSync(path, 'r');
+    try {
+        fsyncSync(descriptor);
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evomap/evolver-proxy",
-  "version": "2.0.0-beta.14",
+  "version": "2.0.0-beta.16",
   "private": false,
   "type": "module",
   "description": "系统级 mailbox/hub 同步 daemon (Node)",
@@ -26,8 +26,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-bedrock-runtime": "^3.1053.0",
-    "@evomap/evolver-adapter-public": "2.0.0-beta.14",
-    "@evomap/evolver-core": "2.0.0-beta.14"
+    "@evomap/evolver-adapter-public": "2.0.0-beta.16",
+    "@evomap/evolver-core": "2.0.0-beta.16"
   },
   "repository": {
     "type": "git",