0.3.0:0

Update to upstream Spaces 0.3.0 and refresh bundled images (subs v0.1.2c,
certrelay v0.2.8, nacho v1.0.0b). Add Create/Show Registry API Keys for
registry-server, remove Configure Subspaces and SUBS_PUBLISH_REQUIRE_FINALIZED,
and align README/instructions with the new tags.

Co-authored-by: Cursor <cursoragent@cursor.com>

startos/actions/configureSubspaces.ts

@@ -1,65 +0,0 @@
-import { storeJson } from '../fileModels/storeJson'
-import { i18n } from '../i18n'
-import { sdk } from '../sdk'
-
-const { InputSpec, Value } = sdk
-
-const inputSpec = InputSpec.of({
-  subsPublishRequireFinalized: Value.toggle({
-    name: i18n('Require Finalized Publish'),
-    description: i18n(
-      'When on, subs blocks certificate publish until commitments are finalized (150 confirmations). Maps to SUBS_PUBLISH_REQUIRE_FINALIZED in the subs daemon environment. Off by default.',
-    ),
-    warning: null,
-    footnote: null,
-    default: false,
-  }),
-})
-
-export const configureSubspaces = sdk.Action.withInput(
-  // id
-  'configure-subspaces',
-
-  // metadata
-  async ({ effects }) => ({
-    name: i18n('Configure Subspaces'),
-    description: i18n(
-      'Set user-tunable subs options. Saving restarts the service so the subs daemon picks up the new environment.',
-    ),
-    warning: null,
-    allowedStatuses: 'any',
-    group: null,
-    visibility: 'enabled',
-  }),
-
-  // input
-  inputSpec,
-
-  // prefill — current value (unset/null => false)
-  async ({ effects }) => {
-    const enabled = await storeJson
-      .read((s) => s.subsPublishRequireFinalized)
-      .once()
-    return { subsPublishRequireFinalized: enabled === true }
-  },
-
-  // run
-  async ({ effects, input }) => {
-    await storeJson.merge(effects, {
-      subsPublishRequireFinalized: input.subsPublishRequireFinalized,
-    })
-
-    return {
-      version: '1',
-      title: i18n('Success'),
-      message: input.subsPublishRequireFinalized
-        ? i18n(
-            'Subspaces configuration saved. SUBS_PUBLISH_REQUIRE_FINALIZED is enabled; the service is restarting.',
-          )
-        : i18n(
-            'Subspaces configuration saved. SUBS_PUBLISH_REQUIRE_FINALIZED is disabled; the service is restarting.',
-          ),
-      result: null,
-    }
-  },
-)

startos/actions/createRegistryApiKeys.ts

@@ -0,0 +1,62 @@
+import { storeJson } from '../fileModels/storeJson'
+import { i18n } from '../i18n'
+import { sdk } from '../sdk'
+import { generateRegistryApiKeys } from '../utils'
+
+export const createRegistryApiKeys = sdk.Action.withoutInput(
+  // id
+  'create-registry-api-keys',
+
+  // metadata
+  async ({ effects }) => ({
+    name: i18n('Create Registry API Keys'),
+    description: i18n(
+      'Generate (or rotate) REGISTRY_API_KEY and SUBSD_API_KEY for the embedded registry-server. Both are required and must differ. Put SUBSD_API_KEY in subs Settings → Registry Server → Auth Token. REGISTRY_API_KEY is for intake clients calling POST /register. Saving restarts the service so registry-server picks up the new keys.',
+    ),
+    warning: null,
+    allowedStatuses: 'any',
+    group: null,
+    visibility: 'enabled',
+  }),
+
+  // run
+  async ({ effects }) => {
+    const { registryApiKey, subsdApiKey } = generateRegistryApiKeys()
+    await storeJson.merge(effects, { registryApiKey, subsdApiKey })
+
+    return {
+      version: '1',
+      title: i18n('Success'),
+      message: i18n(
+        'Registry API keys saved. Paste SUBSD_API_KEY into subs Settings → Registry Server → Auth Token, then click Test. Use REGISTRY_API_KEY as the Bearer token for POST /register clients. The service is restarting so registry-server picks up the new keys.',
+      ),
+      result: {
+        type: 'group',
+        value: [
+          {
+            type: 'single',
+            name: i18n('REGISTRY_API_KEY'),
+            description: i18n(
+              'Bearer secret for intake/POST /register clients.',
+            ),
+            value: registryApiKey,
+            masked: true,
+            copyable: true,
+            qr: false,
+          },
+          {
+            type: 'single',
+            name: i18n('SUBSD_API_KEY'),
+            description: i18n(
+              'Paste into subs Settings → Registry Server → Auth Token (subs↔registry channel).',
+            ),
+            value: subsdApiKey,
+            masked: true,
+            copyable: true,
+            qr: false,
+          },
+        ],
+      },
+    }
+  },
+)

startos/actions/index.ts

@@ -1,7 +1,7 @@
 import { sdk } from '../sdk'
 import { configureCertrelay } from './configureCertrelay'
 import { configureNacho } from './configureNacho'
-import { configureSubspaces } from './configureSubspaces'
+import { createRegistryApiKeys } from './createRegistryApiKeys'
 import { disableSubsAuth } from './disableSubsAuth'
 import { disableSubsProverAuth } from './disableSubsProverAuth'
 import { disableSubspaces } from './disableSubspaces'
@@ -19,6 +19,7 @@ import { setSubsProver } from './setSubsProver'
 import { setSubsProverCredentials } from './setSubsProverCredentials'
 import { showCredentials } from './showCredentials'
 import { showPassword } from './showPassword'
+import { showRegistryApiKeys } from './showRegistryApiKeys'
 import { showSpacedCredentials } from './showSpacedCredentials'
 import { showSubsCredentials } from './showSubsCredentials'
 import { showSubsProverCredentials } from './showSubsProverCredentials'
@@ -49,5 +50,6 @@ export const actions = sdk.Actions.of()
   .addAction(resetSubspacesState)
   .addAction(configureCertrelay)
   .addAction(configureNacho)
-  .addAction(configureSubspaces)
+  .addAction(createRegistryApiKeys)
+  .addAction(showRegistryApiKeys)
   .addAction(uploadSupportPdf)

startos/actions/showRegistryApiKeys.ts

@@ -0,0 +1,74 @@
+import { storeJson } from '../fileModels/storeJson'
+import { i18n } from '../i18n'
+import { sdk } from '../sdk'
+
+export const showRegistryApiKeys = sdk.Action.withoutInput(
+  // id
+  'show-registry-api-keys',
+
+  // metadata
+  async ({ effects }) => ({
+    name: i18n('Show Registry API Keys'),
+    description: i18n(
+      'Display the stored REGISTRY_API_KEY and SUBSD_API_KEY used by registry-server. Returns blanks if Create Registry API Keys has not been run yet.',
+    ),
+    warning: null,
+    allowedStatuses: 'any',
+    group: null,
+    visibility: 'enabled',
+  }),
+
+  // run
+  async ({ effects }) => {
+    const [registryApiKey, subsdApiKey] = await Promise.all([
+      storeJson.read((s) => s.registryApiKey).once(),
+      storeJson.read((s) => s.subsdApiKey).once(),
+    ])
+
+    const ready =
+      !!registryApiKey &&
+      !!subsdApiKey &&
+      registryApiKey.length > 0 &&
+      subsdApiKey.length > 0 &&
+      registryApiKey !== subsdApiKey
+
+    return {
+      version: '1',
+      title: i18n('Show Registry API Keys'),
+      message: ready
+        ? i18n(
+            'Paste SUBSD_API_KEY into subs Settings → Registry Server → Auth Token. Use REGISTRY_API_KEY as the Bearer token for POST /register clients.',
+          )
+        : i18n(
+            'No valid registry API keys are stored yet. Run Create Registry API Keys first (both keys must be non-empty and different).',
+          ),
+      result: {
+        type: 'group',
+        value: [
+          {
+            type: 'single',
+            name: i18n('REGISTRY_API_KEY'),
+            description: i18n(
+              'Bearer secret for intake/POST /register clients.',
+            ),
+            value: registryApiKey ?? '',
+            masked: true,
+            copyable: true,
+            qr: false,
+          },
+          {
+            type: 'single',
+            name: i18n('SUBSD_API_KEY'),
+            description: i18n(
+              'Paste into subs Settings → Registry Server → Auth Token (subs↔registry channel).',
+            ),
+            value: subsdApiKey ?? '',
+            masked: true,
+            copyable: true,
+            qr: false,
+          },
+        ],
+      },
+    }
+  },
+)