@xenosystem/primitives

XENO back-end rung 1. Two families, one subpath each:

• @xenosystem/primitives/dirs – the XENO local home: where every kind of data lives, the area registry, XENO_HOME, the layout version, atomic writes, locks, the copy-only migrator, doctor, and the static check.
• @xenosystem/primitives/secrets – envelope-encrypted credentials; the OS store holds one key per person per machine.
• @xenosystem/primitives/secrets/testing – an in-memory key store for tests only.

Authority: XENO LOCAL HOME - SPEC.md (LOCKED). Zero runtime dependencies. Proprietary (UNLICENSED).

import { createDirs } from '@xenosystem/primitives/dirs';
import { createSecretStore, createOsKeyStore } from '@xenosystem/primitives/secrets';

const dirs = createDirs();                                   // the only place that reads the home directory
dirs.path('data', 'agents/environments', 'claude', 'profiles', 'default', 'profile.json');
dirs.path('cache', 'agents/environments', 'claude', '2.1.0', 'runtime.tgz');
await dirs.withLock('agents/environments', 'claude-2.1.0', async () => { /* exclusive */ });
await dirs.writeFile('data', 'agents/environments', ['claude', 'record.json'], json);   // registry + layout checks, atomic

const secrets = createSecretStore({ dirs, keyStore: createOsKeyStore() });
if (!secrets.status().available) { /* show secrets.status().reason; do not save */ }
await secrets.set('identity', 'refresh-token', value);

Rules: no homedir() and no hand-built XENO path in a product; run npx xeno-dirs-check in CI (--self-test proves it can fail); xeno-home doctor lists unregistered entries; xeno-home migrate is a dry run until --confirm and never deletes anything.