- schema: userDotfiles (one encrypted row per file, HOME-relative path) and userEnvironment (home username + optional public dotfiles repo + setup command) - userDotfiles.ts: list/remove/removeDirectory/rename + internal upsert/getRaw - userDotfilesNode.ts ('use node'): putFile/importFiles/getFileContent (encrypt /decrypt via secretCrypto) + getEnvironmentForJob (worker-token, returns the owner's decrypted dotfiles + repo/setup config) - userEnvironment.ts: getMine/updateMine + getRawEnvironmentForJobInternal - model.ts: deriveHomeUsername + normalizeDotfilePath helpers