Build SpacesOps StartOS package (v1.0.0:0)

Initial .s9pk for SpacesOps, targeting StartOS 0.4.0.x with SDK 1.5.1.

- Single managed daemon from spacesops/spacesops:v1.0.0 (x86_64 + aarch64),
  keeping the image entrypoint (/app/docker-entrypoint.sh node server.js).
  Forces PLATFORM_HOST=0.0.0.0 / PLATFORM_PORT=7264 so the StartOS proxy can
  reach the app. Single `ui` interface on 7264.
- Depends on the Spaces service (>=0.0.9:3) and auto-wires the spaced RPC creds:
  main.ts mounts the Spaces `main` volume read-only at /spaces-data, execs a
  read of its store.json inside the subcontainer, and injects SPACED_RPC_USER/
  PASSWORD + SPACED_RPC_URL=http://spaces.startos:7225. Throws to retry until
  Spaces is installed and seeded.
- Generates a Nostr operator keypair (nostr-tools, bundled by ncc) and a strong
  session secret in idempotent init tasks (.once() reads, allowWriteAfterConst
  merges). Actions: show-operator-credentials, import-operator-key,
  show-admin-credentials (surfaces the fixed admin/Whatever! login with a
  warning), configure-platform (optional relay/mode/CoinGecko/SUBSD).
- Install alert warns to install Spaces first and about the fixed admin
  credential. Backs up the `main` volume.
- Icon: icon.svg (source spacesops.svg). The `spaces` dependency uses
  assets/spaces-icon.png for its Marketplace metadata.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

startos/actions/importOperatorKey.ts

@@ -0,0 +1,101 @@
+import { storeJson } from '../fileModels/storeJson'
+import { i18n } from '../i18n'
+import { isValidSecretHex, secretHexToPublicHex } from '../nostr'
+import { sdk } from '../sdk'
+
+const { InputSpec, Value } = sdk
+
+const inputSpec = InputSpec.of({
+  secretHex: Value.text({
+    name: i18n('Operator Secret Key (hex)'),
+    description: i18n(
+      'A 64-character hex-encoded secp256k1 / Nostr secret key. The public key is derived automatically.',
+    ),
+    warning: null,
+    footnote: null,
+    default: null,
+    required: true,
+    masked: true,
+    placeholder: '64 hexadecimal characters',
+    minLength: 64,
+    maxLength: 64,
+    patterns: [
+      {
+        regex: '^[0-9a-fA-F]{64}$',
+        description: i18n('Must be exactly 64 hexadecimal characters.'),
+      },
+    ],
+  }),
+})
+
+export const importOperatorKey = sdk.Action.withInput(
+  // id
+  'import-operator-key',
+
+  // metadata
+  async ({ effects }) => ({
+    name: i18n('Import Operator Key'),
+    description: i18n(
+      'Replace the operator keypair with one you provide (hex secret key).',
+    ),
+    warning: i18n(
+      'This changes the operator identity SpacesOps signs events with. Events already published under the old key stay under it. The service restarts to apply the new key.',
+    ),
+    allowedStatuses: 'any',
+    group: null,
+    visibility: 'enabled',
+  }),
+
+  // input
+  inputSpec,
+
+  // prefill — never pre-populate a secret
+  async ({ effects }) => {},
+
+  // run
+  async ({ effects, input }) => {
+    const secretHex = input.secretHex.trim().toLowerCase()
+
+    if (!isValidSecretHex(secretHex)) {
+      return {
+        version: '1',
+        title: i18n('Failure'),
+        message: i18n(
+          'The secret key must be exactly 64 hexadecimal characters.',
+        ),
+        result: null,
+      }
+    }
+
+    let operatorPublicHex: string
+    try {
+      operatorPublicHex = secretHexToPublicHex(secretHex)
+    } catch (e) {
+      return {
+        version: '1',
+        title: i18n('Failure'),
+        message: i18n(
+          'Could not derive a public key from that secret: ${error}',
+          {
+            error: (e as Error).message,
+          },
+        ),
+        result: null,
+      }
+    }
+
+    await storeJson.merge(effects, {
+      operatorSecretHex: secretHex,
+      operatorPublicHex,
+    })
+
+    return {
+      version: '1',
+      title: i18n('Success'),
+      message: i18n(
+        'Operator key imported. The service is restarting to apply the new identity.',
+      ),
+      result: null,
+    }
+  },
+)