@omnitron-dev/omnitron 0.3.2 → 0.3.5

package/dist/services/node-manager.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-manager.service.d.ts","sourceRoot":"","sources":["../../src/services/node-manager.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAEL,KAAK,eAAe,EAIrB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAElG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EACV,KAAK,EACL,WAAW,EACX,eAAe,EACf,YAAY,EACZ,eAAe,EACf,UAAU,EACV,kBAAkB,EACnB,MAAM,wBAAwB,CAAC;AAMhC,YAAY,EACV,KAAK,EACL,WAAW,EACX,eAAe,EACf,YAAY,EACZ,eAAe,EACf,UAAU,EACV,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAEhC,iEAAiE;AACjE,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,gBAAgB,CAAC;IACzB,cAAc,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACzC;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/G;AAiBD,qBAAa,kBAAmB,SAAQ,YAAY;IA4BhD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IArC3B,OAAO,CAAC,KAAK,CAAiC;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,OAAO,CAAC,WAAW,CAAuC;IAC1D;;;;;;OAMG;IACH,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,WAAW,CAAyC;IAC5D,qEAAqE;IACrE,OAAO,CAAC,aAAa,CAA2E;IAChG;;;;;;OAMG;IACH,OAAO,CAAC,cAAc,CAA6B;IACnD,mDAAmD;IACnD,OAAO,CAAC,IAAI,CAA+B;IAE3C,YACmB,MAAM,EAAE,OAAO;IAChC;;;;;;;OAOG;IACc,KAAK,EAAE,OAAO,yCAAyC,EAAE,gBAAgB,EACzE,OAAO,CAAC,EAAE,cAAc,YAAA,EAO1C;IAED;;;;;;;;OAQG;IACH,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAcrD;IAED,cAAc,IAAI,eAAe,CAEhC;IAED;;;;;;;OAOG;IACH,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAO1D;IAED,gBAAgB,IAAI,kBAAkB,CAErC;IAED;;;;;;;;;;;;;OAaG;IACH,iBAAiB,CAAC,SAAS,EAAE,cAAc,GAAG,IAAI,GAAG,IAAI,CAExD;IAMD,SAAS,IAAI,eAAe,EAAE,CAK7B;IAED,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAI1C;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,SAAS;IAkBjB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,mBAAmB;IAWrB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAiDjD;IAEK,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,CAiBnE;YAEa,eAAe;IAiG7B;;;;;;;;;;;;OAYG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAY1C;YAEa,sBAAsB;IAuBpC,mDAAmD;IACnD,WAAW,IAAI,UAAU,EAAE,CAoD1B;IAMK,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAuEtD;IAED;;;;;;;;;OASG;YACW,SAAS;IAmEvB,sEAAsE;IAChE,eAAe,CAAC,IAAI,EAAE,KAAK,GAAG,OAAO,CAAC,OAAO,mCAAmC,EAAE,SAAS,CAAC,CA0BjG;IAED;;;;;;;;;;;;;;OAcG;IACG,kBAAkB,CACtB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,OAAO,8BAA8B,EAAE,YAAY,CAAC,CAwB9D;IAED;;;;;;;OAOG;IACG,aAAa,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAoB5C;IAMD;;;;;;;;;OASG;IACH,2BAA2B,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,IAAI,CA0BjE;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAMxD;IAED;;;;;;;;OAQG;IACH,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,GAAG,IAAI,CAMxD;IAED,uEAAuE;IACvE,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,GAAG,IAAI,CAEjD;IAED;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA2BvD;IAMD,OAAO,CAAC,SAAS;IAIjB,0DAA0D;YAC5C,SAAS;YAST,SAAS;YAWT,SAAS;YAQT,YAAY;IAO1B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,WAAW;IA0BnB,4EAA4E;IAC5E,OAAO,CAAC,YAAY;IA4CpB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,UAAU;IAyBlB,OAAO,CAAC,IAAI;IAiEZ;;;;;;;;;;;;;;;OAeG;YACW,iBAAiB;IAkC/B,uEAAuE;IACvE,OAAO,CAAC,eAAe;IAUvB;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAsBnB;;;;OAIG;IACH,OAAO,CAAC,IAAI;IAMZ,OAAO,CAAC,eAAe;IAoBjB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAE7B;CACF"}
+{"version":3,"file":"node-manager.service.d.ts","sourceRoot":"","sources":["../../src/services/node-manager.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAEL,KAAK,eAAe,EAIrB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAElG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EACV,KAAK,EACL,WAAW,EACX,eAAe,EACf,YAAY,EACZ,eAAe,EACf,UAAU,EACV,kBAAkB,EACnB,MAAM,wBAAwB,CAAC;AAMhC,YAAY,EACV,KAAK,EACL,WAAW,EACX,eAAe,EACf,YAAY,EACZ,eAAe,EACf,UAAU,EACV,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAEhC,iEAAiE;AACjE,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,gBAAgB,CAAC;IACzB,cAAc,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACzC;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/G;AAqBD,qBAAa,kBAAmB,SAAQ,YAAY;IA6BhD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAtC3B,OAAO,CAAC,KAAK,CAAiC;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,OAAO,CAAC,WAAW,CAAuC;IAC1D;;;;;;OAMG;IACH,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,WAAW,CAAyC;IAC5D,qEAAqE;IACrE,OAAO,CAAC,aAAa,CAA2E;IAChG;;;;;;OAMG;IACH,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;IAC9D,mDAAmD;IACnD,OAAO,CAAC,IAAI,CAA+B;IAE3C,YACmB,MAAM,EAAE,OAAO;IAChC;;;;;;;OAOG;IACc,KAAK,EAAE,OAAO,yCAAyC,EAAE,gBAAgB,EACzE,OAAO,CAAC,EAAE,cAAc,YAAA,EAO1C;IAED;;;;;;;;OAQG;IACH,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAcrD;IAED,cAAc,IAAI,eAAe,CAEhC;IAED;;;;;;;OAOG;IACH,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAO1D;IAED,gBAAgB,IAAI,kBAAkB,CAErC;IAED;;;;;;;;;;;;;OAaG;IACH,iBAAiB,CAAC,SAAS,EAAE,cAAc,GAAG,IAAI,GAAG,IAAI,CAExD;IAMD,SAAS,IAAI,eAAe,EAAE,CAK7B;IAED,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAI1C;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,SAAS;IAkBjB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,mBAAmB;IAWrB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,CAgDjD;IAEK,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,CAkBnE;YAEa,eAAe;IAkG7B;;;;;;;;;;;;OAYG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAa1C;YAEa,sBAAsB;IAuBpC,mDAAmD;IACnD,WAAW,IAAI,UAAU,EAAE,CAoD1B;IAMK,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAuEtD;IAED;;;;;;;;;OASG;YACW,SAAS;IAmEvB,sEAAsE;IAChE,eAAe,CAAC,IAAI,EAAE,KAAK,GAAG,OAAO,CAAC,OAAO,mCAAmC,EAAE,SAAS,CAAC,CAgCjG;IAED;;;;;;;;;;;;;;OAcG;IACG,kBAAkB,CACtB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,OAAO,8BAA8B,EAAE,YAAY,CAAC,CAwB9D;IAED;;;;;;;OAOG;IACG,aAAa,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAoB5C;IAMD;;;;;;;;;OASG;IACH,2BAA2B,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,IAAI,CA0BjE;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAMxD;IAED;;;;;;;;OAQG;IACH,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,GAAG,IAAI,CAMxD;IAED,uEAAuE;IACvE,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,GAAG,IAAI,CAEjD;IAED;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA2BvD;YAMa,gBAAgB;IAa9B,OAAO,CAAC,SAAS;YAIH,SAAS;YAWT,SAAS;YAOT,YAAY;IAK1B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,WAAW;IA0BnB,4EAA4E;IAC5E,OAAO,CAAC,YAAY;IA4CpB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,UAAU;IAyBlB,OAAO,CAAC,IAAI;IAoEZ,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,iBAAiB;YASX,uBAAuB;IAYrC,uEAAuE;IACvE,OAAO,CAAC,eAAe;IAUvB;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAsBnB,OAAO,CAAC,eAAe;IAqBjB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAE7B;CACF"}

package/dist/services/node-manager.service.js

@@ -24,6 +24,8 @@ const NODES_FILE = path.join(OMNITRON_HOME, 'nodes.json');
 const LOCAL_NODE_ID = 'local';
 /** DaemonStateStore key holding the operator-set check configuration. */
 const CHECK_CONFIG_KEY = 'nodes:check-config';
+const LEGACY_IMPORT_KEY = 'nodes:legacy-import-in-progress';
+const NODE_SECRET_FIELDS = ['privateKey', 'passphrase', 'password'];
 // =============================================================================
 // Service
 // =============================================================================
@@ -54,6 +56,7 @@ export class NodeManagerService extends EventEmitter {
      * report a perfectly reachable node as unreachable.
      */
     pendingSecrets = new Map();
+    repairing = new Map();
     /** The master's mesh — see `setSlaveConnector`. */
     mesh = null;
     constructor(logger, 
@@ -236,7 +239,6 @@ export class NodeManagerService extends EventEmitter {
             sshPort: assertPort('SSH port', input.sshPort ?? 22),
             sshUser: input.sshUser ?? 'root',
             sshAuthMethod: input.sshAuthMethod ?? 'key',
-            ...(input.sshPrivateKey && { sshPrivateKey: input.sshPrivateKey }),
             runtime: input.runtime ?? 'node',
             daemonPort: assertPort('daemon port', input.daemonPort ?? 9700),
             tags: input.tags ?? [],
@@ -248,8 +250,8 @@ export class NodeManagerService extends EventEmitter {
         if (!node.name.trim())
             throw new Error('Node name is required');
         this.assertAddressIsFree(node.host, node.daemonPort);
-        // Store secrets encrypted (passphrase, password) — only boolean markers in nodes.json.
-        // Must await before connectivity check, otherwise getSecret() reads stale file.
+        if (input.sshPrivateKey)
+            await this.assignPrivateKey(node, input.sshPrivateKey);
         if (input.sshPassphrase) {
             node.hasPassphrase = true;
             await this.setSecret(id, 'passphrase', input.sshPassphrase);
@@ -258,8 +260,9 @@ export class NodeManagerService extends EventEmitter {
             node.hasPassword = true;
             await this.setSecret(id, 'password', input.sshPassword);
         }
+        this.assertAddressIsFree(node.host, node.daemonPort);
+        this.persistNode(node, true);
         this.nodes.set(id, node);
-        this.save();
         this.emit('node:added', node);
         this.logger.info({ nodeId: id, name: node.name, host: node.host }, 'Node added');
         // Check connectivity in background — secrets are already persisted.
@@ -280,6 +283,8 @@ export class NodeManagerService extends EventEmitter {
             throw new Error('Node registration is changing; retry after the current operation');
         this.changingNodes.add(id);
         try {
+            if (this.hasPendingCredentials(id))
+                await this.repairCredentials(previous);
             return await this.writeNodeUpdate(previous, input);
         }
         finally {
@@ -298,22 +303,28 @@ export class NodeManagerService extends EventEmitter {
         const id = node.id;
         if (node.isLocal && input.host)
             throw new Error('Cannot change host of local node');
-        // Extract secrets before spreading into node (they must not be saved to nodes.json)
-        const { sshPassphrase, sshPassword, ...safeInput } = input;
-        if (safeInput.host !== undefined)
-            safeInput.host = assertNodeHost(safeInput.host);
-        if (safeInput.sshPort !== undefined)
-            safeInput.sshPort = assertPort('SSH port', safeInput.sshPort);
-        if (safeInput.daemonPort !== undefined)
-            safeInput.daemonPort = assertPort('daemon port', safeInput.daemonPort);
-        const updated = {
-            ...node,
-            ...safeInput,
-            id: node.id,
-            isLocal: node.isLocal,
-            createdAt: node.createdAt,
-            updatedAt: new Date().toISOString(),
-        };
+        const { sshPassphrase, sshPassword, sshPrivateKey } = input;
+        const updated = { ...node, updatedAt: new Date().toISOString() };
+        if (input.name !== undefined)
+            updated.name = input.name;
+        if (input.host !== undefined)
+            updated.host = assertNodeHost(input.host);
+        if (input.sshPort !== undefined)
+            updated.sshPort = assertPort('SSH port', input.sshPort);
+        if (input.daemonPort !== undefined)
+            updated.daemonPort = assertPort('daemon port', input.daemonPort);
+        if (input.sshUser !== undefined)
+            updated.sshUser = input.sshUser;
+        if (input.sshAuthMethod !== undefined)
+            updated.sshAuthMethod = input.sshAuthMethod;
+        if (input.runtime !== undefined)
+            updated.runtime = input.runtime;
+        if (input.tags !== undefined)
+            updated.tags = input.tags;
+        if (input.offlineTimeout !== undefined)
+            updated.offlineTimeout = input.offlineTimeout;
+        if (!updated.name.trim())
+            throw new Error('Node name is required');
         // An edit can collide as readily as an add — correcting one node's host
         // to the address another already holds is exactly how a duplicate gets
         // made. Checked before any secret is written, so a refused edit leaves
@@ -337,17 +348,22 @@ export class NodeManagerService extends EventEmitter {
             const passwordCleared = updated.sshAuthMethod !== node.sshAuthMethod && updated.sshAuthMethod === 'key';
             const keyCleared = updated.sshAuthMethod !== node.sshAuthMethod && updated.sshAuthMethod === 'password';
             if ((!passwordCleared && node.hasPassword && sshPassword === undefined)
-                || (!keyCleared && (node.sshPrivateKey && safeInput.sshPrivateKey === undefined
+                || (!keyCleared && ((node.sshPrivateKey || node.hasPrivateKey) && sshPrivateKey === undefined
                     || node.hasPassphrase && sshPassphrase === undefined)))
                 throw new Error('SSH destination changed. Explicitly supply or clear the SSH credential for the new host, port and account.');
             // Commit the replacement address without credentials before changing its ID-keyed vault slots.
             // A crash between these stores leaves a node that needs credentials. Xec requires explicit auth.
-            const detached = { ...updated, hasPassword: false, hasPassphrase: false };
+            const detached = { ...updated, hasPassword: false, hasPassphrase: false, hasPrivateKey: false };
             delete detached.sshPrivateKey;
             this.persistNode(detached, true);
             this.nodes.set(id, detached);
         }
-        // Update encrypted secrets — await to ensure they're persisted before connectivity check
+        if (updated.sshAuthMethod === 'password' && node.sshAuthMethod !== updated.sshAuthMethod) {
+            await this.assignPrivateKey(updated, '');
+        }
+        else if (sshPrivateKey !== undefined) {
+            await this.assignPrivateKey(updated, sshPrivateKey);
+        }
         if (sshPassphrase !== undefined) {
             if (sshPassphrase) {
                 updated.hasPassphrase = true;
@@ -378,7 +394,6 @@ export class NodeManagerService extends EventEmitter {
                 await this.deleteSecret(id, 'password');
             }
             if (updated.sshAuthMethod === 'password') {
-                delete updated.sshPrivateKey;
                 if (updated.hasPassphrase) {
                     updated.hasPassphrase = false;
                     await this.deleteSecret(id, 'passphrase');
@@ -412,6 +427,8 @@ export class NodeManagerService extends EventEmitter {
             throw new Error('Node registration is changing; retry after the current operation');
         this.changingNodes.add(id);
         try {
+            if (this.hasPendingCredentials(id))
+                await this.repairCredentials(node);
             await this.deleteNodeRegistration(node);
         }
         finally {
@@ -420,11 +437,10 @@ export class NodeManagerService extends EventEmitter {
     }
     async deleteNodeRegistration(node) {
         const id = node.id;
+        if (node.hasPrivateKey)
+            await this.deleteSecret(id, 'privateKey');
         await this.deleteSecret(id, 'passphrase');
         await this.deleteSecret(id, 'password');
-        this.nodes.delete(id);
-        this.statusCache.delete(id);
-        this.summaryCache.delete(id);
         try {
             this.store.deleteNodeSync(id);
         }
@@ -432,7 +448,9 @@ export class NodeManagerService extends EventEmitter {
             this.logger.warn({ nodeId: id, error: err.message }, 'Failed to delete node row');
             throw err;
         }
-        this.save();
+        this.nodes.delete(id);
+        this.statusCache.delete(id);
+        this.summaryCache.delete(id);
         this.emit('node:removed', id);
         this.logger.info({ nodeId: id, name: node.name }, 'Node removed');
     }
@@ -641,18 +659,26 @@ export class NodeManagerService extends EventEmitter {
             port: node.sshPort,
             username: node.sshUser,
         };
-        if (node.sshPrivateKey) {
+        if (node.hasPrivateKey) {
+            const key = await this.getSecret(node.id, 'privateKey');
+            if (!key)
+                throw new Error('Stored SSH private key is unavailable');
+            target.privateKey = key;
+        }
+        else if (node.sshPrivateKey) {
             target.privateKey = readKeyFile(node.sshPrivateKey);
         }
         if (node.hasPassphrase) {
             const passphrase = await this.getSecret(node.id, 'passphrase');
-            if (passphrase)
-                target.passphrase = passphrase;
+            if (!passphrase)
+                throw new Error('Stored SSH key passphrase is unavailable');
+            target.passphrase = passphrase;
         }
         if (node.hasPassword) {
             const password = await this.getSecret(node.id, 'password');
-            if (password)
-                target.password = password;
+            if (!password)
+                throw new Error('Stored SSH password is unavailable');
+            target.password = password;
         }
         if (this.nodes.get(node.id) !== registered || this.changingNodes.has(node.id))
             throw new Error('SSH node registration changed during credential lookup');
@@ -853,20 +879,24 @@ export class NodeManagerService extends EventEmitter {
     // ===========================================================================
     // Secrets Helpers
     // ===========================================================================
+    async assignPrivateKey(node, input) {
+        if (isKeyMaterial(input)) {
+            await this.setSecret(node.id, 'privateKey', input);
+            node.hasPrivateKey = true;
+            delete node.sshPrivateKey;
+            return;
+        }
+        if (node.hasPrivateKey)
+            await this.deleteSecret(node.id, 'privateKey');
+        delete node.hasPrivateKey;
+        if (input)
+            node.sshPrivateKey = input;
+        else
+            delete node.sshPrivateKey;
+    }
     secretKey(nodeId, field) {
         return `node:${nodeId}:${field}`;
     }
-    /** The vault's own answer, with no in-memory fallback. */
-    async readVault(nodeId, field) {
-        if (!this.secrets)
-            return null;
-        try {
-            return await this.secrets.get(this.secretKey(nodeId, field));
-        }
-        catch {
-            return null;
-        }
-    }
     async getSecret(nodeId, field) {
         const key = this.secretKey(nodeId, field);
         if (this.secrets) {
@@ -881,18 +911,14 @@ export class NodeManagerService extends EventEmitter {
     }
     async setSecret(nodeId, field, value) {
         if (!this.secrets) {
-            this.logger.warn({ nodeId, field }, 'SecretsService not available — secret not stored');
-            return;
+            throw new Error('SSH credential vault is unavailable');
         }
         await this.secrets.set(this.secretKey(nodeId, field), value);
     }
     async deleteSecret(nodeId, field) {
         if (!this.secrets)
             return;
-        try {
-            await this.secrets.delete(this.secretKey(nodeId, field));
-        }
-        catch { /* non-critical */ }
+        await this.secrets.delete(this.secretKey(nodeId, field));
     }
     /**
      * Status of the machine this daemon runs on.
@@ -1006,8 +1032,13 @@ export class NodeManagerService extends EventEmitter {
     // Persistence
     // ===========================================================================
     load() {
-        /** Rows found carrying a plaintext secret; healed after the loop. */
-        const leaked = [];
+        const remember = (raw) => {
+            const { node, strays } = splitStoredSecrets(raw);
+            this.nodes.set(node.id, node);
+            for (const { field, value } of strays)
+                this.pendingSecrets.set(this.secretKey(node.id, field), value);
+            return node;
+        };
         try {
             // First-pass: read from SQLite. Each row's `metadata` column
             // holds the full INode JSON; the denormalised columns are for
@@ -1017,14 +1048,7 @@ export class NodeManagerService extends EventEmitter {
                 if (!row.metadata)
                     continue;
                 try {
-                    const raw = JSON.parse(row.metadata);
-                    const { node, strays } = splitStoredSecrets(raw);
-                    this.nodes.set(node.id, node);
-                    if (strays.length > 0) {
-                        for (const stray of strays)
-                            this.pendingSecrets.set(this.secretKey(node.id, stray.field), stray.value);
-                        leaked.push({ node, strays });
-                    }
+                    const node = remember(JSON.parse(row.metadata));
                     // Restore the last known health, but NOT a status reading: a
                     // reachability answer from a previous daemon is not a current one,
                     // and the console has no way to tell them apart on the dots. What
@@ -1044,77 +1068,65 @@ export class NodeManagerService extends EventEmitter {
                     // Corrupt row — skip and let the next mutation overwrite.
                 }
             }
-            // One-shot legacy import. If the SQLite table is empty but the
-            // pre-T-7 nodes.json file exists, migrate it in-place. The
-            // existing file is then unlinked so subsequent boots skip the
-            // branch.
-            if (this.nodes.size === 0 && fs.existsSync(NODES_FILE)) {
-                try {
-                    const data = JSON.parse(fs.readFileSync(NODES_FILE, 'utf-8'));
-                    if (Array.isArray(data.nodes)) {
-                        for (const node of data.nodes) {
-                            this.nodes.set(node.id, node);
-                            this.persistNode(node);
-                        }
-                    }
-                    try {
-                        fs.unlinkSync(NODES_FILE);
-                    }
-                    catch { /* best-effort */ }
-                }
-                catch (err) {
-                    this.logger.warn({ error: err.message }, 'Legacy nodes.json migration failed — leaving file in place');
+            // Keep the original file until every imported credential and row is durable.
+            // The marker lets an interrupted import finish after some rows already exist.
+            if ((this.nodes.size === 0 || this.store.kvGetSync(LEGACY_IMPORT_KEY)) && fs.existsSync(NODES_FILE)) {
+                const original = fs.readFileSync(NODES_FILE, 'utf8');
+                const { nodes } = JSON.parse(original);
+                if (!Array.isArray(nodes))
+                    throw new Error('Invalid legacy node registry');
+                this.store.kvSetSync(LEGACY_IMPORT_KEY, true);
+                for (const raw of nodes) {
+                    if (this.nodes.has(raw.id))
+                        continue;
+                    const node = remember(raw);
+                    if (!this.hasPendingCredentials(node.id))
+                        this.persistNode(node, true);
                 }
+                // Existing SQLite rows may also still need credential migration.
+                const imported = [...this.nodes.values()].map(node => this.repairCredentials(node));
+                void Promise.all(imported).then(() => {
+                    if (fs.readFileSync(NODES_FILE, 'utf8') !== original)
+                        throw new Error('Legacy node registry changed during import');
+                    fs.unlinkSync(NODES_FILE);
+                    this.store.kvSetSync(LEGACY_IMPORT_KEY, false);
+                }).catch(() => this.logger.error('Legacy node registry retained; retry credential migration after checking the vault and database'));
             }
         }
         catch (err) {
             this.logger.warn({ error: err.message }, 'Failed to load nodes from store');
         }
-        if (leaked.length > 0)
-            void this.healLeakedSecrets(leaked);
+        for (const node of this.nodes.values()) {
+            void this.repairCredentials(node).catch(() => this.logger.error({ nodeId: node.id }, 'SSH credential migration incomplete; source retained for retry'));
+        }
         this.loadCheckConfig();
     }
-    /**
-     * Move a plaintext secret out of a node row and into the vault.
-     *
-     * Observed on a live daemon: a node row whose `metadata` JSON contained
-     * `"sshPassphrase": "<the operator's actual passphrase>"` next to
-     * `"hasPassphrase": true`. An older `updateNode` spread its whole input
-     * into the node — the destructure that stops that was added afterwards, and
-     * it fixed new writes without touching rows already written. `listNodes`
-     * then spread the parsed row onto the wire, so the passphrase went to every
-     * caller with the VIEWER role, and to `omnitron node list`.
-     *
-     * Two things are needed and they are not the same: the wire shape is now
-     * built field by field (`toWireNode`), which stops the leak for any
-     * residue, present or future; and this moves the value to where it should
-     * have been, so the row itself stops holding it.
-     */
-    async healLeakedSecrets(leaked) {
-        for (const { node, strays } of leaked) {
-            for (const { field, value } of strays) {
-                this.logger.warn({ nodeId: node.id, field }, 'Node row held a plaintext SSH secret — moving it to the secret store');
-                // Read the VAULT, not `getSecret`: that one falls back to
-                // `pendingSecrets`, which is where this value already is — so asking
-                // it whether the secret is stored answers "yes" about the copy we are
-                // trying to store, and the write never happens.
-                const existing = await this.readVault(node.id, field);
-                if (!existing) {
-                    if (!this.secrets) {
-                        // Nothing to migrate into. The row keeps the value for now — the
-                        // node would otherwise stop authenticating — but it no longer
-                        // reaches the wire, which is the part that matters.
-                        this.logger.error({ nodeId: node.id, field }, 'No secret store available — plaintext secret left in the node row');
-                        continue;
-                    }
-                    await this.setSecret(node.id, field, value);
-                }
-            }
-            // Rewrite the row from the sanitised node.
-            this.persistNode(node);
-            for (const { field } of strays)
-                this.pendingSecrets.delete(this.secretKey(node.id, field));
+    hasPendingCredentials(id) {
+        return NODE_SECRET_FIELDS.some(field => this.pendingSecrets.has(this.secretKey(id, field)));
+    }
+    repairCredentials(node) {
+        const active = this.repairing.get(node.id);
+        if (active)
+            return active;
+        if (!this.hasPendingCredentials(node.id))
+            return Promise.resolve();
+        const repaired = this.storePendingCredentials(node).finally(() => this.repairing.delete(node.id));
+        this.repairing.set(node.id, repaired);
+        return repaired;
+    }
+    async storePendingCredentials(node) {
+        if (!this.secrets)
+            throw new Error('SSH credential vault is unavailable');
+        for (const field of NODE_SECRET_FIELDS) {
+            const key = this.secretKey(node.id, field);
+            const pending = this.pendingSecrets.get(key);
+            if (pending === undefined)
+                continue;
+            await this.secrets.setIfAbsent(key, pending);
         }
+        this.persistNode(node, true);
+        for (const field of NODE_SECRET_FIELDS)
+            this.pendingSecrets.delete(this.secretKey(node.id, field));
     }
     /** Restore the operator's check configuration, if one was ever set. */
     loadCheckConfig() {
@@ -1156,21 +1168,11 @@ export class NodeManagerService extends EventEmitter {
                 throw err;
         }
     }
-    /**
-     * Persist every node currently held in memory. Used after a
-     * batch mutation that affected multiple rows (the previous
-     * fs.writeFileSync semantics).
-     */
-    save() {
-        for (const node of this.nodes.values()) {
-            this.persistNode(node);
-        }
-    }
     ensureLocalNode() {
         if (this.nodes.has(LOCAL_NODE_ID))
             return;
         const now = new Date().toISOString();
-        this.nodes.set(LOCAL_NODE_ID, {
+        const local = {
             id: LOCAL_NODE_ID,
             name: 'Local Machine',
             host: '127.0.0.1',
@@ -1183,8 +1185,9 @@ export class NodeManagerService extends EventEmitter {
             isLocal: true,
             createdAt: now,
             updatedAt: now,
-        });
-        this.save();
+        };
+        this.nodes.set(LOCAL_NODE_ID, local);
+        this.persistNode(local);
     }
     async dispose() {
         await this.remoteOps.dispose();
@@ -1217,10 +1220,10 @@ function toWireNode(node) {
         createdAt: node.createdAt,
         updatedAt: node.updatedAt,
     };
-    // The key is a PATH or key content chosen by the operator; the booleans say
-    // only whether a secret exists. Neither is a secret itself.
-    if (node.sshPrivateKey !== undefined)
+    if (node.sshPrivateKey && !isKeyMaterial(node.sshPrivateKey))
         wire.sshPrivateKey = node.sshPrivateKey;
+    if (node.hasPrivateKey)
+        wire.hasPrivateKey = true;
     if (node.hasPassphrase !== undefined)
         wire.hasPassphrase = node.hasPassphrase;
     if (node.hasPassword !== undefined)
@@ -1234,6 +1237,11 @@ function splitStoredSecrets(raw) {
     const { sshPassphrase, sshPassword, ...rest } = raw;
     const node = rest;
     const strays = [];
+    if (node.sshPrivateKey && isKeyMaterial(node.sshPrivateKey)) {
+        strays.push({ field: 'privateKey', value: node.sshPrivateKey });
+        delete node.sshPrivateKey;
+        node.hasPrivateKey = true;
+    }
     if (typeof sshPassphrase === 'string' && sshPassphrase) {
         node.hasPassphrase = true;
         strays.push({ field: 'passphrase', value: sshPassphrase });
@@ -1242,7 +1250,10 @@ function splitStoredSecrets(raw) {
         node.hasPassword = true;
         strays.push({ field: 'password', value: sshPassword });
     }
-    return { node, strays };
+    return { node: toWireNode(node), strays };
+}
+function isKeyMaterial(value) {
+    return /[\r\n\0]|^\s*(?:-{4,}|PuTTY-User-Key-File-\d+:)/i.test(value);
 }
 /** Fallback offline timeout, matching the health monitor's own default. */
 const DEFAULT_OFFLINE_TIMEOUT_MS = 90_000;