@omnitron-dev/omnitron 0.2.0 → 0.3.0

package/dist/services/secrets.rpc-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.rpc-service.js","sourceRoot":"","sources":["../../src/services/secrets.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAI1C,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IACC;IAA7B,YAA6B,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IAAG,CAAC;IAExD;;OAEG;IAEG,AAAN,KAAK,CAAC,GAAG,CAAC,IAAqB;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED;;OAEG;IAEG,AAAN,KAAK,CAAC,GAAG,CAAC,IAAoC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IAEG,AAAN,KAAK,CAAC,MAAM,CAAC,IAAqB;QAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAED;;OAEG;IAEG,AAAN,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;CACF,CAAA;AA/BO;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;4CAIxC;AAMK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;4CAIxC;AAMK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;+CAIxC;AAMK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;6CAIxC;AArCU,iBAAiB;IAD7B,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;;GACxB,iBAAiB,CAsC7B"}
+{"version":3,"file":"secrets.rpc-service.js","sourceRoot":"","sources":["../../src/services/secrets.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAM1C,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAET,OAAO;IAQP,KAAK;IATxB,YACmB,OAAuB;IACxC;;;;;;OAMG;IACc,KAA6D;uBAR7D,OAAO;qBAQP,KAAK;IACrB,CAAC;IAEJ;;OAEG;IAEG,AAAN,KAAK,CAAC,GAAG,CAAC,IAAqB;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACvB,MAAM,EAAE,aAAa;YACrB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,IAAI,CAAC,GAAG;YACpB,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,EAAE;SACnC,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED;;OAEG;IAEG,AAAN,KAAK,CAAC,GAAG,CAAC,IAAoC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,iDAAiD;QACjD,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACjG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;;;OASG;IAEG,AAAN,KAAK,CAAC,QAAQ,CAAC,IAId;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,uDAAuD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;QAC3C,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,oDAAoD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,0EAA0E,CAAC,CAAC;QAC7H,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC/H,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IAEG,AAAN,KAAK,CAAC,IAAI,CAAC,IAAkC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAClC,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/G,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACtB,CAAC;IAED;;OAEG;IAEG,AAAN,KAAK,CAAC,MAAM,CAAC,IAAqB;QAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACvB,MAAM,EAAE,eAAe;YACvB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,IAAI,CAAC,GAAG;YACpB,OAAO,EAAE,EAAE,OAAO,EAAE;SACrB,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAED;;OAEG;IAEG,AAAN,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;CACF,CAAA;AA/FO;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;4CAUxC;AAMK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;4CAMxC;AAaK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;iDAuBxC;AASK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;6CAOxC;AAMK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;+CAUxC;AAMK;IADL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;;;;6CAIxC;AA/GU,iBAAiB;IAD7B,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;;GACxB,iBAAiB,CAgH7B"}

package/dist/services/secrets.service.d.ts

@@ -2,19 +2,46 @@
  * Secrets Service — Encrypted Secrets Storage
  *
  * Stores secrets (API keys, DB passwords, signing keys) encrypted at rest
- * in a JSON file using AES-256-GCM.
+ * using AES-256-GCM.
  *
  * Key derivation: scrypt(passphrase + machineId, salt, 64) → 32-byte key
  * Encryption: AES-256-GCM with random IV per encryption
- * Storage: ~/.omnitron/secrets.enc (JSON envelope with salt, iv, ciphertext, tag)
+ * Storage: SQLite-backed `state_kv` row keyed by `secrets:envelope` via
+ *   DaemonStateStore. The encrypted envelope (salt+iv+ciphertext+tag) is
+ *   serialised to JSON exactly as before — the DB swap is transparent to
+ *   the on-wire format. T-7 in the audit.
+ *
+ * One-shot legacy migration: when an existing `~/.omnitron/secrets.enc`
+ * file is present on first load, its envelope is imported into the
+ * `state_kv` row and the file is unlinked. Operators don't have to
+ * re-enter the passphrase or lose secrets across the upgrade.
  *
  * Zero external dependencies — uses Node.js native crypto.
  */
+import type { DaemonStateStore } from '../daemon/daemon-state-store.service.js';
 export declare class SecretsService {
-    private readonly filePath;
+    private readonly store;
     private passphrase;
+    private readonly legacyFilePath?;
     private cache;
-    constructor(filePath: string, passphrase: string);
+    /** The resolved machine binding; see `resolveMachineId`. */
+    private machineId;
+    /**
+     * T-2 part 2 — @Inject + useClass. Passphrase + legacy-path
+     * arrive via dedicated config-value tokens (useValue providers
+     * registered in DaemonModule) so the framework's DI metadata is
+     * authoritative for every ctor position. The crypto contract
+     * (AES-256-GCM + scrypt + machine-id binding) is unchanged.
+     *
+     * @param store — DaemonStateStore handle (state_kv row holds the
+     *   encrypted envelope).
+     * @param passphrase — operator-supplied passphrase. Combined
+     *   with the machine ID via scrypt to derive the 256-bit AES key.
+     * @param legacyFilePath — optional path to the pre-T-7 encrypted
+     *   file. When present + the SQLite row is empty on first load,
+     *   the file is imported into the row and unlinked.
+     */
+    constructor(store: DaemonStateStore, passphrase: string, legacyFilePath?: string | null | undefined);
     /**
      * Get a secret by key.
      * Returns null if the key doesn't exist or the secrets file is missing.
@@ -25,6 +52,17 @@ export declare class SecretsService {
      * Writes the encrypted file immediately.
      */
     set(key: string, value: string): Promise<void>;
+    /**
+     * A second key holding the same secret, made here: the value is read and
+     * written inside this service and handed to nobody.
+     *
+     * For splitting one secret into two before rotating either — the new key
+     * starts as the old one's value, so a deployment that begins reading it
+     * changes nothing on the day it lands. `set` would have carried the value
+     * through a terminal and a process table to get it here. A key that already
+     * exists is refused, not replaced, as `generate` refuses one.
+     */
+    copy(from: string, to: string): Promise<void>;
     /**
      * Delete a secret by key.
      * Returns true if the key existed and was deleted.
@@ -40,18 +78,79 @@ export declare class SecretsService {
      */
     rotate(oldPassphrase: string, newPassphrase: string): Promise<void>;
     /**
-     * Check if the secrets file exists.
+     * Check if any encrypted envelope exists (in SQLite or the legacy
+     * file). Pre-T-7 this only checked the filesystem; the SQLite
+     * check is async so this method is now async too.
      */
-    exists(): boolean;
+    exists(): Promise<boolean>;
     private deriveKey;
+    /**
+     * The machine binding, resolved once and then remembered.
+     *
+     * `probeMachineId` asks the OS, and on macOS that means shelling out to
+     * `ioreg` with a five-second deadline. A host busy enough to miss that
+     * deadline falls through to the hostname — silently, and in the middle of
+     * `save()`, which re-encrypts the WHOLE map. One degraded write therefore
+     * re-keys every secret the daemon holds, and the next read, taken when the
+     * probe is fast again, cannot open it.
+     *
+     * That is not hypothetical. Measured 2026-09-14 on the development daemon:
+     * the envelope in `state_kv` held both of the fleet's SSH secrets and
+     * decrypted under `hostname` while the daemon derived under
+     * `IOPlatformUUID`. The console reported "Failed to decrypt secrets. Wrong
+     * passphrase?" — the passphrase was never wrong, and nothing had been lost;
+     * the key had simply been built from a different answer to the same
+     * question. It surfaced only at a restart, because `NodeManagerService`
+     * keeps a pending-secret map that had been serving the plaintext from
+     * memory for as long as the process lived.
+     *
+     * Persisting the answer removes the load dependency: after the first
+     * resolution the probe never runs again, so there is no second answer for
+     * it to give.
+     */
+    private resolveMachineId;
+    /**
+     * Every machine id this host could plausibly have been sealed under.
+     *
+     * Ordered by how a pre-persistence daemon would have answered: whatever is
+     * stored, then the probe's own chain. Used only to recover an envelope the
+     * current binding cannot open.
+     */
+    private machineIdCandidates;
     private encrypt;
     private decrypt;
     private load;
+    /**
+     * One-shot migration for stores written under the CLI's old default.
+     *
+     * Returns the secrets if they decrypt under the retired passphrase, null
+     * otherwise — including when a passphrase is configured, where a failure
+     * is the operator's to resolve.
+     */
+    private tryRetiredPassphrase;
+    /**
+     * Open an envelope sealed under a machine id this host no longer derives.
+     *
+     * The binding is not a secret and its candidates are a short, known list,
+     * so trying them costs one scrypt each and settles the question the error
+     * message could not: whether the passphrase is wrong, or whether the same
+     * passphrase was combined with a different answer about the machine.
+     *
+     * On success the id that worked becomes the persisted binding, so the next
+     * derivation opens the envelope directly rather than recovering it again —
+     * and `load()` re-encrypts under it, which is a no-op in key terms and
+     * leaves the store in the state the rest of this class expects.
+     */
+    private tryOtherMachineIds;
     private save;
     /**
-     * Get a stable machine identifier for key derivation.
-     * Falls back to hostname if machine-id is unavailable.
+     * Ask the OS what machine this is.
+     *
+     * Called at most once per store — `resolveMachineId` persists the answer —
+     * because this is a chain of fallbacks and which link answers depends on
+     * the host's load at the moment it runs. Everything that derives a key uses
+     * the persisted value, never this.
      */
-    private getMachineId;
+    private probeMachineId;
 }
 //# sourceMappingURL=secrets.service.d.ts.map

package/dist/services/secrets.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.service.d.ts","sourceRoot":"","sources":["../../src/services/secrets.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAoDH,qBAAa,cAAc;IAIvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,UAAU;IAJpB,OAAO,CAAC,KAAK,CAA2B;gBAGrB,QAAQ,EAAE,MAAM,EACzB,UAAU,EAAE,MAAM;IAO5B;;;OAGG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAK9C;;;OAGG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpD;;;OAGG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ3C;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAK/B;;;OAGG;IACG,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAczE;;OAEG;IACH,MAAM,IAAI,OAAO;YAQH,SAAS;YAOT,OAAO;YAqBP,OAAO;YAmBP,IAAI;YAwBJ,IAAI;IAiBlB;;;OAGG;YACW,YAAY;CA+B3B"}
+{"version":3,"file":"secrets.service.d.ts","sourceRoot":"","sources":["../../src/services/secrets.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAkBH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAkEhF,qBACa,cAAc;IAqBW,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,UAAU;IACL,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IAtBjF,OAAO,CAAC,KAAK,CAA2B;IACxC,4DAA4D;IAC5D,OAAO,CAAC,SAAS,CAAuB;IAExC;;;;;;;;;;;;;;OAcG;IACH,YACqD,KAAK,EAAE,gBAAgB,EAChC,UAAU,EAAE,MAAM,EACI,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,YAAA,EAC5F;IAMJ;;;OAGG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAG7C;IAED;;;OAGG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAInD;IAED;;;;;;;;;OASG;IACG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWlD;IAED;;;OAGG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAM1C;IAED;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAG9B;IAED;;;OAGG;IACG,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAaxE;IAED;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAK/B;YAMa,SAAS;IAOvB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gBAAgB;IAe9B;;;;;;OAMG;YACW,mBAAmB;YAYnB,OAAO;YAqBP,OAAO;YAmBP,IAAI;IAiElB;;;;;;OAMG;YACW,oBAAoB;IAiBlC;;;;;;;;;;;;OAYG;YACW,kBAAkB;YAgBlB,IAAI;IAclB;;;;;;;OAOG;YACW,cAAc;CAuC7B"}

package/dist/services/secrets.service.js

@@ -2,20 +2,50 @@
  * Secrets Service — Encrypted Secrets Storage
  *
  * Stores secrets (API keys, DB passwords, signing keys) encrypted at rest
- * in a JSON file using AES-256-GCM.
+ * using AES-256-GCM.
  *
  * Key derivation: scrypt(passphrase + machineId, salt, 64) → 32-byte key
  * Encryption: AES-256-GCM with random IV per encryption
- * Storage: ~/.omnitron/secrets.enc (JSON envelope with salt, iv, ciphertext, tag)
+ * Storage: SQLite-backed `state_kv` row keyed by `secrets:envelope` via
+ *   DaemonStateStore. The encrypted envelope (salt+iv+ciphertext+tag) is
+ *   serialised to JSON exactly as before — the DB swap is transparent to
+ *   the on-wire format. T-7 in the audit.
+ *
+ * One-shot legacy migration: when an existing `~/.omnitron/secrets.enc`
+ * file is present on first load, its envelope is imported into the
+ * `state_kv` row and the file is unlinked. Operators don't have to
+ * re-enter the passphrase or lose secrets across the upgrade.
  *
  * Zero external dependencies — uses Node.js native crypto.
  */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var SecretsService_1;
 import { createCipheriv, createDecipheriv, randomBytes, scrypt, } from 'node:crypto';
 import { promisify } from 'node:util';
-import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { readFile, unlink } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
-import path from 'node:path';
+import { hostname } from 'node:os';
+import { Injectable, Inject, Optional } from '@omnitron-dev/titan/decorators';
+import { DAEMON_STATE_STORE_TOKEN, SECRETS_PASSPHRASE_TOKEN, SECRETS_LEGACY_PATH_TOKEN, } from '../shared/tokens.js';
+import { DEFAULT_SECRETS_PASSPHRASE } from '../config/defaults.js';
 const scryptAsync = promisify(scrypt);
+/**
+ * The passphrase `commands/secret.ts` used to fall back to, before both
+ * entry points were pointed at `DEFAULT_SECRETS_PASSPHRASE`. Kept only to
+ * read stores written under it; nothing encrypts with it.
+ */
+const RETIRED_CLI_PASSPHRASE = 'omnitron-default-passphrase';
 // =============================================================================
 // Constants
 // =============================================================================
@@ -29,13 +59,46 @@ const IV_LENGTH = 16;
 // =============================================================================
 // Service
 // =============================================================================
-export class SecretsService {
-    filePath;
+/** state_kv row key holding the encrypted envelope. */
+const SECRETS_KV_KEY = 'secrets:envelope';
+/**
+ * state_kv row key holding the machine binding the envelope was sealed with.
+ *
+ * Not a secret — every value it can hold is readable by anyone on the host
+ * (`ioreg`, `hostname`). It is here because the binding has to be the SAME
+ * string at every derivation, and `probeMachineId` below cannot promise that:
+ * it is a chain of fallbacks, and which link answers depends on whether a
+ * shell command returned in time.
+ */
+const MACHINE_ID_KV_KEY = 'secrets:machine-id';
+/** The hard-coded last resort of `probeMachineId`. */
+const FALLBACK_MACHINE_ID = 'omnitron-default-machine-id';
+let SecretsService = SecretsService_1 = class SecretsService {
+    store;
     passphrase;
+    legacyFilePath;
     cache = null;
-    constructor(filePath, passphrase) {
-        this.filePath = filePath;
+    /** The resolved machine binding; see `resolveMachineId`. */
+    machineId = null;
+    /**
+     * T-2 part 2 — @Inject + useClass. Passphrase + legacy-path
+     * arrive via dedicated config-value tokens (useValue providers
+     * registered in DaemonModule) so the framework's DI metadata is
+     * authoritative for every ctor position. The crypto contract
+     * (AES-256-GCM + scrypt + machine-id binding) is unchanged.
+     *
+     * @param store — DaemonStateStore handle (state_kv row holds the
+     *   encrypted envelope).
+     * @param passphrase — operator-supplied passphrase. Combined
+     *   with the machine ID via scrypt to derive the 256-bit AES key.
+     * @param legacyFilePath — optional path to the pre-T-7 encrypted
+     *   file. When present + the SQLite row is empty on first load,
+     *   the file is imported into the row and unlinked.
+     */
+    constructor(store, passphrase, legacyFilePath) {
+        this.store = store;
         this.passphrase = passphrase;
+        this.legacyFilePath = legacyFilePath;
     }
     // ===========================================================================
     // Public API
@@ -57,6 +120,31 @@ export class SecretsService {
         secrets[key] = value;
         await this.save(secrets);
     }
+    /**
+     * A second key holding the same secret, made here: the value is read and
+     * written inside this service and handed to nobody.
+     *
+     * For splitting one secret into two before rotating either — the new key
+     * starts as the old one's value, so a deployment that begins reading it
+     * changes nothing on the day it lands. `set` would have carried the value
+     * through a terminal and a process table to get it here. A key that already
+     * exists is refused, not replaced, as `generate` refuses one.
+     */
+    async copy(from, to) {
+        if (!from || !to)
+            throw new Error('A copy needs the key to copy and the key to make');
+        if (from === to)
+            throw new Error(`'${from}' cannot be copied onto itself`);
+        const secrets = await this.load();
+        const value = secrets[from];
+        if (value === undefined)
+            throw new Error(`The vault has no '${from}' — nothing was copied`);
+        if (to in secrets) {
+            throw new Error(`The vault already holds '${to}' — nothing was copied. Delete it first if replacing it is the intent`);
+        }
+        secrets[to] = value;
+        await this.save(secrets);
+    }
     /**
      * Delete a secret by key.
      * Returns true if the key existed and was deleted.
@@ -81,31 +169,96 @@ export class SecretsService {
      * The old passphrase must match the current encryption.
      */
     async rotate(oldPassphrase, newPassphrase) {
-        // Decrypt with old passphrase
-        const oldService = new SecretsService(this.filePath, oldPassphrase);
+        // Decrypt with the old passphrase via a transient service that
+        // shares the same store + legacy-path so the import side-effect
+        // (if it hasn't happened yet) lands on the disk we expect.
+        const oldService = new SecretsService_1(this.store, oldPassphrase, this.legacyFilePath ?? null);
         const secrets = await oldService.load();
-        // Re-encrypt with new passphrase
-        const newService = new SecretsService(this.filePath, newPassphrase);
-        await newService.save(secrets);
-        // Update our own passphrase reference
+        // Re-encrypt under the new passphrase. Same store, so the
+        // upsert below replaces the row atomically — readers either
+        // see the old or the new envelope, never a mix.
         this.passphrase = newPassphrase;
-        this.cache = secrets;
+        this.cache = null;
+        await this.save(secrets);
     }
     /**
-     * Check if the secrets file exists.
+     * Check if any encrypted envelope exists (in SQLite or the legacy
+     * file). Pre-T-7 this only checked the filesystem; the SQLite
+     * check is async so this method is now async too.
      */
-    exists() {
-        return existsSync(this.filePath);
+    async exists() {
+        const envelope = await this.store.kvGet(SECRETS_KV_KEY);
+        if (envelope)
+            return true;
+        if (this.legacyFilePath && existsSync(this.legacyFilePath))
+            return true;
+        return false;
     }
     // ===========================================================================
     // Encryption / Decryption
     // ===========================================================================
-    async deriveKey(salt) {
+    async deriveKey(salt, machineId) {
         // Combine passphrase with machine-id for additional binding
-        const machineId = await this.getMachineId();
-        const combined = `${this.passphrase}:${machineId}`;
+        const id = machineId ?? (await this.resolveMachineId());
+        const combined = `${this.passphrase}:${id}`;
         return scryptAsync(combined, salt, KEY_LENGTH);
     }
+    /**
+     * The machine binding, resolved once and then remembered.
+     *
+     * `probeMachineId` asks the OS, and on macOS that means shelling out to
+     * `ioreg` with a five-second deadline. A host busy enough to miss that
+     * deadline falls through to the hostname — silently, and in the middle of
+     * `save()`, which re-encrypts the WHOLE map. One degraded write therefore
+     * re-keys every secret the daemon holds, and the next read, taken when the
+     * probe is fast again, cannot open it.
+     *
+     * That is not hypothetical. Measured 2026-09-14 on the development daemon:
+     * the envelope in `state_kv` held both of the fleet's SSH secrets and
+     * decrypted under `hostname` while the daemon derived under
+     * `IOPlatformUUID`. The console reported "Failed to decrypt secrets. Wrong
+     * passphrase?" — the passphrase was never wrong, and nothing had been lost;
+     * the key had simply been built from a different answer to the same
+     * question. It surfaced only at a restart, because `NodeManagerService`
+     * keeps a pending-secret map that had been serving the plaintext from
+     * memory for as long as the process lived.
+     *
+     * Persisting the answer removes the load dependency: after the first
+     * resolution the probe never runs again, so there is no second answer for
+     * it to give.
+     */
+    async resolveMachineId() {
+        if (this.machineId)
+            return this.machineId;
+        const stored = await this.store.kvGet(MACHINE_ID_KV_KEY);
+        if (typeof stored === 'string' && stored.length > 0) {
+            this.machineId = stored;
+            return stored;
+        }
+        const probed = await this.probeMachineId();
+        await this.store.kvSet(MACHINE_ID_KV_KEY, probed);
+        this.machineId = probed;
+        return probed;
+    }
+    /**
+     * Every machine id this host could plausibly have been sealed under.
+     *
+     * Ordered by how a pre-persistence daemon would have answered: whatever is
+     * stored, then the probe's own chain. Used only to recover an envelope the
+     * current binding cannot open.
+     */
+    async machineIdCandidates() {
+        const seen = new Set();
+        const push = (v) => {
+            if (v && !seen.has(v))
+                seen.add(v);
+        };
+        push(await this.resolveMachineId());
+        push(await this.probeMachineId());
+        push(hostname());
+        push(FALLBACK_MACHINE_ID);
+        return [...seen];
+    }
     async encrypt(data) {
         const salt = randomBytes(SALT_LENGTH);
         const iv = randomBytes(IV_LENGTH);
@@ -123,11 +276,11 @@ export class SecretsService {
             tag: tag.toString('hex'),
         };
     }
-    async decrypt(envelope) {
+    async decrypt(envelope, machineId) {
         const salt = Buffer.from(envelope.salt, 'hex');
         const iv = Buffer.from(envelope.iv, 'hex');
         const tag = Buffer.from(envelope.tag, 'hex');
-        const key = await this.deriveKey(salt);
+        const key = await this.deriveKey(salt, machineId);
         const decipher = createDecipheriv(ALGORITHM, key, iv);
         decipher.setAuthTag(tag);
         let plaintext = decipher.update(envelope.ciphertext, 'hex', 'utf8');
@@ -140,43 +293,140 @@ export class SecretsService {
     async load() {
         if (this.cache)
             return this.cache;
-        if (!existsSync(this.filePath)) {
+        // Try the SQLite row first. If it's empty AND the legacy
+        // `secrets.enc` file exists, one-shot migrate the file in-place.
+        // After the first migration boot the file is gone and the
+        // SQLite row is the source of truth.
+        let envelope = await this.store.kvGet(SECRETS_KV_KEY);
+        if (!envelope && this.legacyFilePath && existsSync(this.legacyFilePath)) {
+            try {
+                const raw = await readFile(this.legacyFilePath, 'utf8');
+                envelope = JSON.parse(raw);
+                // Persist the imported envelope to SQLite BEFORE unlinking
+                // — a crash between read and write would otherwise lose
+                // the secrets.
+                await this.store.kvSet(SECRETS_KV_KEY, envelope);
+                try {
+                    await unlink(this.legacyFilePath);
+                }
+                catch { /* best-effort */ }
+            }
+            catch (err) {
+                // Failed to read or parse — leave the legacy file in place
+                // and surface the error as an empty store; the operator
+                // will see "wrong passphrase" or similar from the next
+                // decrypt attempt and can recover manually.
+                throw new Error(`Failed to import legacy secrets file (${this.legacyFilePath}): ${err.message}`, { cause: err });
+            }
+        }
+        if (!envelope) {
             this.cache = {};
             return this.cache;
         }
+        if (envelope.version !== 1) {
+            throw new Error(`Unsupported secrets envelope version: ${envelope.version}`);
+        }
         try {
-            const raw = await readFile(this.filePath, 'utf8');
-            const envelope = JSON.parse(raw);
-            if (envelope.version !== 1) {
-                throw new Error(`Unsupported secrets envelope version: ${envelope.version}`);
-            }
             this.cache = await this.decrypt(envelope);
             return this.cache;
         }
         catch (err) {
-            if (err.message.includes('Unsupported'))
-                throw err;
-            throw new Error(`Failed to decrypt secrets file: ${err.message}. Wrong passphrase?`, { cause: err });
+            // Before the two entry points shared one default, the CLI's
+            // direct-file path used a different passphrase from the daemon's, so a
+            // store written through the CLI on a host with no configured
+            // passphrase is encrypted under a value neither side uses any more.
+            // Read it once with the retired default and re-encrypt under the
+            // current one, so unifying the default does not silently strand
+            // secrets that were readable yesterday.
+            //
+            // Only attempted when no passphrase is configured: with an explicit
+            // one, a decryption failure means the operator's passphrase is wrong,
+            // and trying a hardcoded value would be both useless and alarming.
+            const recovered = (await this.tryOtherMachineIds(envelope)) ?? (await this.tryRetiredPassphrase(envelope));
+            if (recovered) {
+                this.cache = recovered;
+                await this.save(recovered);
+                return this.cache;
+            }
+            throw new Error(`Failed to decrypt secrets: ${err.message}. Wrong passphrase?`, { cause: err });
+        }
+    }
+    /**
+     * One-shot migration for stores written under the CLI's old default.
+     *
+     * Returns the secrets if they decrypt under the retired passphrase, null
+     * otherwise — including when a passphrase is configured, where a failure
+     * is the operator's to resolve.
+     */
+    async tryRetiredPassphrase(envelope) {
+        if (this.passphrase !== DEFAULT_SECRETS_PASSPHRASE)
+            return null;
+        const current = this.passphrase;
+        this.passphrase = RETIRED_CLI_PASSPHRASE;
+        try {
+            const secrets = await this.decrypt(envelope);
+            return secrets;
+        }
+        catch {
+            return null;
+        }
+        finally {
+            // Restored before `save()` runs, so the re-encryption below uses the
+            // current passphrase rather than the retired one it just read with.
+            this.passphrase = current;
+        }
+    }
+    /**
+     * Open an envelope sealed under a machine id this host no longer derives.
+     *
+     * The binding is not a secret and its candidates are a short, known list,
+     * so trying them costs one scrypt each and settles the question the error
+     * message could not: whether the passphrase is wrong, or whether the same
+     * passphrase was combined with a different answer about the machine.
+     *
+     * On success the id that worked becomes the persisted binding, so the next
+     * derivation opens the envelope directly rather than recovering it again —
+     * and `load()` re-encrypts under it, which is a no-op in key terms and
+     * leaves the store in the state the rest of this class expects.
+     */
+    async tryOtherMachineIds(envelope) {
+        const current = await this.resolveMachineId();
+        for (const candidate of await this.machineIdCandidates()) {
+            if (candidate === current)
+                continue;
+            try {
+                const secrets = await this.decrypt(envelope, candidate);
+                await this.store.kvSet(MACHINE_ID_KV_KEY, candidate);
+                this.machineId = candidate;
+                return secrets;
+            }
+            catch {
+                // Not this one. The loop is the whole diagnostic.
+            }
         }
+        return null;
     }
     async save(secrets) {
-        // Ensure directory exists
-        const dir = path.dirname(this.filePath);
-        await mkdir(dir, { recursive: true });
         const envelope = await this.encrypt(secrets);
-        await writeFile(this.filePath, JSON.stringify(envelope, null, 2), {
-            mode: 0o600, // Owner-only read/write
-        });
+        // Single atomic SQLite upsert — no torn-write window, no
+        // directory creation, no chmod dance. WAL mode + the
+        // store's per-key UPSERT covers concurrent writers (CLI +
+        // daemon) safely.
+        await this.store.kvSet(SECRETS_KV_KEY, envelope);
         this.cache = secrets;
     }
     // ===========================================================================
     // Machine ID
     // ===========================================================================
     /**
-     * Get a stable machine identifier for key derivation.
-     * Falls back to hostname if machine-id is unavailable.
+     * Ask the OS what machine this is.
+     *
+     * Called at most once per store — `resolveMachineId` persists the answer —
+     * because this is a chain of fallbacks and which link answers depends on
+     * the host's load at the moment it runs. Everything that derives a key uses
+     * the persisted value, never this.
      */
-    async getMachineId() {
+    async probeMachineId() {
         try {
             // Linux: /etc/machine-id
             const { readFile: readFs } = await import('node:fs/promises');
@@ -188,10 +438,17 @@ export class SecretsService {
             catch {
                 // Not Linux
             }
-            // macOS: IOPlatformUUID via system_profiler
+            // macOS: IOPlatformUUID.
+            //
+            // `execFile`, not `execSync`: this used to block the event loop for up
+            // to its own five-second deadline, inside a call that can be reached
+            // from any RPC handler. The shell is gone with it — the pipe into
+            // `grep` was doing work this process can do on the string it gets back.
             try {
-                const { execSync } = await import('node:child_process');
-                const output = execSync('ioreg -rd1 -c IOPlatformExpertDevice | grep IOPlatformUUID', { encoding: 'utf8', timeout: 5000 });
+                const { execFile } = await import('node:child_process');
+                const output = await new Promise((resolve, reject) => {
+                    execFile('ioreg', ['-rd1', '-c', 'IOPlatformExpertDevice'], { encoding: 'utf8', timeout: 5000, maxBuffer: 1024 * 1024 }, (error, stdout) => (error ? reject(error) : resolve(stdout)));
+                });
                 const match = output.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
                 if (match?.[1])
                     return match[1];
@@ -200,12 +457,20 @@ export class SecretsService {
                 // Not macOS or command failed
             }
             // Fallback: hostname
-            const os = await import('node:os');
-            return os.hostname();
+            return hostname();
         }
         catch {
-            return 'omnitron-default-machine-id';
+            return FALLBACK_MACHINE_ID;
         }
     }
-}
+};
+SecretsService = SecretsService_1 = __decorate([
+    Injectable(),
+    __param(0, Inject(DAEMON_STATE_STORE_TOKEN)),
+    __param(1, Inject(SECRETS_PASSPHRASE_TOKEN)),
+    __param(2, Optional()),
+    __param(2, Inject(SECRETS_LEGACY_PATH_TOKEN)),
+    __metadata("design:paramtypes", [Function, String, Object])
+], SecretsService);
+export { SecretsService };
 //# sourceMappingURL=secrets.service.js.map