@camstack/system 1.2.375 → 1.2.377

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { W as UserRecordSchema, Y as authProviderCapability, cr as BaseAddon, r as ApiKeyRecordSchema, z as ScopedTokenSchema, zn as userManagementCapability } from "../../dist-ZdSg09GJ.mjs";
+import { Bn as userManagementCapability, J as authProviderCapability, R as ScopedTokenSchema, U as UserRecordSchema, lr as BaseAddon, r as ApiKeyRecordSchema } from "../../dist-BWNoS-1S.mjs";
 import { z } from "zod";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
@@ -6324,7 +6324,9 @@ var AuthManager = class {
 			...payload.integrationId !== void 0 ? { integrationId: payload.integrationId } : {},
 			...payload.jti !== void 0 ? { jti: payload.jti } : {},
 			...payload.sessionId !== void 0 ? { sessionId: payload.sessionId } : {},
-			...payload.refreshTtl !== void 0 ? { refreshTtl: payload.refreshTtl } : {}
+			...payload.refreshTtl !== void 0 ? { refreshTtl: payload.refreshTtl } : {},
+			...payload.linkIntent !== void 0 ? { linkIntent: payload.linkIntent } : {},
+			...payload.issuer !== void 0 ? { issuer: payload.issuer } : {}
 		};
 		/**
 		* `'never'` mints with NO `exp` claim, and the option must be OMITTED to do
@@ -6366,6 +6368,8 @@ var AuthManager = class {
 			const integrationId = typeof decoded["integrationId"] === "string" ? decoded["integrationId"] : void 0;
 			const jti = typeof decoded["jti"] === "string" ? decoded["jti"] : void 0;
 			const sessionId = typeof decoded["sessionId"] === "string" ? decoded["sessionId"] : void 0;
+			const linkIntent = typeof decoded["linkIntent"] === "string" ? decoded["linkIntent"] : void 0;
+			const issuer = typeof decoded["issuer"] === "string" ? decoded["issuer"] : void 0;
 			const rawRefreshTtl = decoded["refreshTtl"];
 			const refreshTtl = rawRefreshTtl === "never" || typeof rawRefreshTtl === "number" && rawRefreshTtl > 0 ? rawRefreshTtl : void 0;
 			return {
@@ -6381,7 +6385,9 @@ var AuthManager = class {
 				...integrationId !== void 0 ? { integrationId } : {},
 				...jti !== void 0 ? { jti } : {},
 				...sessionId !== void 0 ? { sessionId } : {},
-				...refreshTtl !== void 0 ? { refreshTtl } : {}
+				...refreshTtl !== void 0 ? { refreshTtl } : {},
+				...linkIntent !== void 0 ? { linkIntent } : {},
+				...issuer !== void 0 ? { issuer } : {}
 			};
 		} catch {
 			return null;
@@ -6762,168 +6768,652 @@ var UserManager = class {
 		if (!user) return false;
 		return this.auth.comparePassword(password, user.passwordHash);
 	}
-}, i$2 = class extends Error {
-	constructor(e, t) {
-		super(e, t), this.name = "OTPError";
-	}
-}, G$3 = class extends i$2 {
-	constructor(e) {
-		super(e), this.name = "PluginError";
-	}
-}, Y$3 = class extends G$3 {
-	constructor() {
-		super("Crypto plugin is required."), this.name = "CryptoPluginMissingError";
-	}
-}, L$2 = class extends G$3 {
-	constructor() {
-		super("Base32 plugin is required."), this.name = "Base32PluginMissingError";
-	}
-}, a$2 = class extends i$2 {
-	constructor(e) {
-		super(e), this.name = "ConfigurationError";
-	}
 };
-new TextEncoder();
-new TextDecoder();
-var ur$3 = 3600, pr$3 = Number.MAX_SAFE_INTEGER, er$3 = Symbol("otplib.guardrails.override");
-function y$2(r, e, t) {
-	if (typeof e != "number" || !Number.isSafeInteger(e)) throw new a$2(`Guardrail '${r}' must be a safe integer`);
-	if (e < t) throw new a$2(`Guardrail '${r}' must be >= ${t}`);
-}
-var d$5 = Object.freeze({
-	MIN_SECRET_BYTES: 16,
-	MAX_SECRET_BYTES: 64,
-	MIN_PERIOD: 1,
-	MAX_PERIOD: ur$3,
-	MAX_COUNTER: pr$3,
-	MAX_WINDOW: 99,
-	[er$3]: !1
-});
-function hr$2(r) {
-	if (!r) return d$5;
-	r.MIN_SECRET_BYTES !== void 0 && y$2("MIN_SECRET_BYTES", r.MIN_SECRET_BYTES, 1), r.MAX_SECRET_BYTES !== void 0 && y$2("MAX_SECRET_BYTES", r.MAX_SECRET_BYTES, 1), r.MIN_PERIOD !== void 0 && y$2("MIN_PERIOD", r.MIN_PERIOD, 1), r.MAX_PERIOD !== void 0 && y$2("MAX_PERIOD", r.MAX_PERIOD, 1), r.MAX_COUNTER !== void 0 && y$2("MAX_COUNTER", r.MAX_COUNTER, 0), r.MAX_WINDOW !== void 0 && y$2("MAX_WINDOW", r.MAX_WINDOW, 1);
-	let e = {
-		...d$5,
-		...r
-	};
-	if (e.MIN_SECRET_BYTES > e.MAX_SECRET_BYTES) throw new a$2("Guardrail 'MIN_SECRET_BYTES' must be <= 'MAX_SECRET_BYTES'");
-	if (e.MIN_PERIOD > e.MAX_PERIOD) throw new a$2("Guardrail 'MIN_PERIOD' must be <= 'MAX_PERIOD'");
-	return Object.freeze({
-		...e,
-		[er$3]: !0
-	});
-}
-function Dr(r) {
-	let { crypto: e, base32: t, length: o = 20 } = r;
-	dr$2(e), nr$2(t);
-	let n = e.randomBytes(o);
-	return t.encode(n, { padding: !1 });
-}
-function dr$2(r) {
-	if (!r) throw new Y$3();
-}
-function nr$2(r) {
-	if (!r) throw new L$2();
-}
 //#endregion
-//#region ../../node_modules/@otplib/hotp/node_modules/@otplib/core/dist/index.js
-var i$1 = class extends Error {
-	constructor(e, t) {
-		super(e, t), this.name = "OTPError";
-	}
-}, x$2 = class extends i$1 {
-	constructor(e) {
-		super(e), this.name = "SecretError";
-	}
-}, h$1 = class extends x$2 {
-	constructor(e, t) {
-		super(`Secret must be at least ${e} bytes (${e * 8} bits), got ${t} bytes`), this.name = "SecretTooShortError";
+//#region src/builtins/local-auth/auth-schema.ts
+/**
+* @durable class=config owner=local-auth
+*   write="an operator creates a user, or `ensureAdminExists` seeds the configured
+*     admin on first boot (or resets its password on the operator's one-shot
+*     RESET_ADMIN_PASSWORD trigger); updated on scope, isAdmin and password edits"
+*   retention="none — a row goes only when an operator deletes the user. A
+*     `declareCollection` that adds a PK/UNIQUE/NOT-NULL-without-default column
+*     REBUILDS the table: every account is wiped and only the configured admin
+*     comes back on the next boot."
+*/
+var USERS_COLLECTION = "users";
+/**
+* @durable class=config owner=local-auth
+*   write="an operator mints an API key; `validateToken` rewrites `lastUsedAt` on
+*     every request the key authorises"
+*   retention="none — an explicit `revoke` is the only delete. API keys have no
+*     expiry column and no sweep, so a key lives until someone removes it (or the
+*     destructive `declareCollection` rebuild takes the table)."
+*/
+var API_KEYS_COLLECTION = "api_keys";
+/**
+* @durable class=config owner=local-auth
+*   write="an operator or the CLI mints a scoped token; `validate` fires
+*     `updateLastUsed` on every accepted call"
+*   retention="`revoke` deletes one. The daily sweep `reapExpired` drops rows past
+*     `expiresAt` — a NULL expiry is a deliberate never-expires token and BETWEEN
+*     never matches it. `cleanupOrphans` drops tokens owned by the legacy 'system'
+*     id or by a user that no longer exists."
+*/
+var SCOPED_TOKENS_COLLECTION = "scoped_tokens";
+/**
+* @durable class=ledger owner=local-auth
+*   write="one row per redeemed OAuth code — every completed account link through
+*     `oauthExchangeCode`; `touch` rewrites `lastUsedAt` on each refresh"
+*   retention="ONLY revoked rows are pruned: the daily sweep deletes sessions
+*     revoked more than OAUTH_REVOKED_RETENTION_MS (30 d) ago. An ACTIVE session
+*     has `revokedAt` NULL, never expires and is never swept — the table grows one
+*     row per login until an operator revokes the link."
+*/
+var OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
+/**
+* TOTP enrollment table — split off from `users` to avoid the
+* destructive drop-+-recreate migration `ensureTable` performs when a
+* new column is added to a typed schema (see `sqlite-settings-backend.ts`).
+*
+* Lifecycle:
+*   - Setup: row inserted with `confirmedAt = null` and a fresh secret.
+*   - Confirm: a valid code from the secret flips `confirmedAt` to now().
+*   - Disable: the row is deleted (next setup starts fresh).
+*
+* "Enabled" means `confirmedAt != null`. A half-enrolled row (`confirmedAt
+* = null`) is INACTIVE — `verifyTotp` returns false until confirmation.
+*
+* @durable class=config owner=local-auth
+*   write="`setup` inserts a fresh secret for the user (deleting any pending row
+*     first); `confirm` flips `confirmedAt` once a valid code proves possession"
+*   retention="`disable` deletes the row, and `setup` deletes before re-inserting.
+*     Nothing else prunes — deleting a USER does not cascade here, so their
+*     enrollment row outlives the account."
+*/
+var USER_TOTP_COLLECTION = "user_totp";
+/**
+* External sign-in identities linked to local users (D782): one row per
+* `(provider, subject)` — the row id IS the identity, so one identity maps to
+* one user by primary key. Written only by the identity's owner completing a
+* "Link" flow from their profile (bound to their session).
+*
+* @durable class=config owner=local-auth
+*   write="`ExternalIdentityManager.link` when a signed-in user completes a
+*     link flow; `unlink` from the profile or the Users page"
+*   retention="`unlink` deletes one row; deleting the user deletes all of its
+*     rows (`deleteUser` → `removeAllForUser`). A row whose provider instance
+*     was renamed or removed stays, inert, until someone unlinks it."
+*/
+var USER_EXTERNAL_IDENTITIES_COLLECTION = "user_external_identities";
+var USERS_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "username",
+		type: "TEXT",
+		notNull: true,
+		unique: true
+	},
+	{
+		name: "passwordHash",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "isAdmin",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "allowedProviders",
+		type: "JSON"
+	},
+	{
+		name: "allowedDevices",
+		type: "JSON"
+	},
+	{
+		name: "scopes",
+		type: "JSON"
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "updatedAt",
+		type: "INTEGER",
+		notNull: true
 	}
-}, P$1 = class extends x$2 {
-	constructor(e, t) {
-		super(`Secret must not exceed ${e} bytes, got ${t} bytes`), this.name = "SecretTooLongError";
+];
+var API_KEYS_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "label",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "isAdmin",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "tokenHash",
+		type: "TEXT",
+		notNull: true,
+		unique: true
+	},
+	{
+		name: "tokenPrefix",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "allowedProviders",
+		type: "JSON"
+	},
+	{
+		name: "allowedDevices",
+		type: "JSON"
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "lastUsedAt",
+		type: "INTEGER"
 	}
-}, m$2 = class extends i$1 {
-	constructor(e) {
-		super(e), this.name = "CounterError";
+];
+var USER_TOTP_COLUMNS = [
+	{
+		name: "userId",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "secret",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "confirmedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
 	}
-}, O$2 = class extends m$2 {
-	constructor() {
-		super("Counter must be non-negative"), this.name = "CounterNegativeError";
+];
+var USER_EXTERNAL_IDENTITIES_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "provider",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "subject",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "issuer",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "userId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "label",
+		type: "TEXT"
+	},
+	{
+		name: "linkedAt",
+		type: "INTEGER",
+		notNull: true
 	}
-}, T$2 = class extends m$2 {
-	constructor() {
-		super("Counter exceeds maximum safe integer value"), this.name = "CounterOverflowError";
+];
+var SCOPED_TOKENS_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "userId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "name",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "tokenHash",
+		type: "TEXT",
+		notNull: true,
+		unique: true
+	},
+	{
+		name: "tokenPrefix",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "scopes",
+		type: "JSON"
+	},
+	{
+		name: "expiresAt",
+		type: "INTEGER"
+	},
+	{
+		name: "lastUsedAt",
+		type: "INTEGER"
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
 	}
-}, b$2 = class extends m$2 {
+];
+var OAUTH_SESSIONS_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "userId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "username",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "integrationId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "scopes",
+		type: "JSON"
+	},
+	{
+		name: "createdAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "lastUsedAt",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "revokedAt",
+		type: "INTEGER"
+	}
+];
+/**
+* Declare every auth collection with the typed schema. Called by
+* `LocalAuthAddon.onInitialize` before constructing the per-collection
+* managers. Idempotent — `declareCollection` is a no-op when the
+* collection has already been declared (same shape).
+*/
+async function declareAuthSchema(store) {
+	await store.declareCollection.mutate({
+		collection: USERS_COLLECTION,
+		columns: USERS_COLUMNS
+	});
+	await store.declareCollection.mutate({
+		collection: API_KEYS_COLLECTION,
+		columns: API_KEYS_COLUMNS,
+		indexes: [{
+			name: "idx_api_keys_token_prefix",
+			columns: ["tokenPrefix"]
+		}]
+	});
+	await store.declareCollection.mutate({
+		collection: SCOPED_TOKENS_COLLECTION,
+		columns: SCOPED_TOKENS_COLUMNS,
+		indexes: [{
+			name: "idx_scoped_tokens_user_id",
+			columns: ["userId"]
+		}]
+	});
+	await store.declareCollection.mutate({
+		collection: USER_TOTP_COLLECTION,
+		columns: USER_TOTP_COLUMNS
+	});
+	await store.declareCollection.mutate({
+		collection: USER_EXTERNAL_IDENTITIES_COLLECTION,
+		columns: USER_EXTERNAL_IDENTITIES_COLUMNS,
+		indexes: [{
+			name: "idx_user_external_identities_user_id",
+			columns: ["userId"]
+		}]
+	});
+	await store.declareCollection.mutate({
+		collection: OAUTH_SESSIONS_COLLECTION,
+		columns: OAUTH_SESSIONS_COLUMNS,
+		indexes: [{
+			name: "idx_oauth_sessions_user_id",
+			columns: ["userId"]
+		}]
+	});
+}
+//#endregion
+//#region src/auth/external-identity-manager.ts
+/** The identity is already linked to a different user. */
+var ExternalIdentityConflictError = class extends Error {
 	constructor() {
-		super("Counter must be a finite integer"), this.name = "CounterNotIntegerError";
+		super("This sign-in account is already linked to another CamStack user");
+		this.name = "ExternalIdentityConflictError";
 	}
-}, R$2 = class extends i$1 {
-	constructor(e) {
-		super(e), this.name = "TokenError";
+};
+function rowId(key) {
+	return JSON.stringify([key.provider, key.subject]);
+}
+function parseRow$1(data) {
+	const { provider, subject, issuer, userId, label, linkedAt } = data;
+	if (typeof provider !== "string" || typeof subject !== "string") return null;
+	if (typeof issuer !== "string") return null;
+	if (typeof userId !== "string" || typeof linkedAt !== "number") return null;
+	return {
+		provider,
+		subject,
+		issuer,
+		userId,
+		linkedAt,
+		...typeof label === "string" && label.length > 0 ? { label } : {}
+	};
+}
+var ExternalIdentityManager = class {
+	store;
+	constructor(store) {
+		this.store = store;
 	}
-}, I$2 = class extends R$2 {
-	constructor(e, t) {
-		super(`Token must be ${e} digits, got ${t}`), this.name = "TokenLengthError";
+	async find(key) {
+		const rows = await this.store.query.query({
+			collection: USER_EXTERNAL_IDENTITIES_COLLECTION,
+			filter: { where: {
+				provider: key.provider,
+				subject: key.subject
+			} }
+		});
+		for (const row of rows) {
+			const parsed = parseRow$1(row.data);
+			if (parsed !== null) return parsed;
+		}
+		return null;
 	}
-}, M$1 = class extends R$2 {
-	constructor() {
-		super("Token must contain only digits"), this.name = "TokenFormatError";
+	/** The link of `(provider, subject)`, or `null`. */
+	async findLink(provider, subject) {
+		return this.find({
+			provider,
+			subject
+		});
 	}
-}, N$1 = class extends i$1 {
-	constructor(e, t) {
-		super(e, t), this.name = "CryptoError";
+	/** The user `(provider, subject)` is linked to, or `null`. */
+	async findUser(provider, subject) {
+		return (await this.find({
+			provider,
+			subject
+		}))?.userId ?? null;
 	}
-}, c$2 = class extends N$1 {
-	constructor(e, t) {
-		super(`HMAC computation failed: ${e}`, t), this.name = "HMACError";
+	async listForUser(userId) {
+		return (await this.store.query.query({
+			collection: USER_EXTERNAL_IDENTITIES_COLLECTION,
+			filter: { where: { userId } }
+		})).flatMap((row) => {
+			const parsed = parseRow$1(row.data);
+			return parsed === null ? [] : [parsed];
+		});
 	}
-}, v$2 = class extends N$1 {
-	constructor(e, t) {
-		super(`Random byte generation failed: ${e}`, t), this.name = "RandomBytesError";
+	/**
+	* Link `(provider, subject)` to `userId`. Idempotent for the same user;
+	* {@link ExternalIdentityConflictError} when another user holds it.
+	*/
+	async link(input) {
+		const existing = await this.find(input);
+		if (existing !== null) {
+			if (existing.userId === input.userId) return;
+			throw new ExternalIdentityConflictError();
+		}
+		const record = {
+			provider: input.provider,
+			subject: input.subject,
+			issuer: input.issuer,
+			userId: input.userId,
+			linkedAt: Date.now(),
+			...input.label !== void 0 && input.label.length > 0 ? { label: input.label } : {}
+		};
+		try {
+			await this.store.insert.mutate({
+				collection: USER_EXTERNAL_IDENTITIES_COLLECTION,
+				record: {
+					id: rowId(input),
+					data: { ...record }
+				}
+			});
+		} catch (err) {
+			const winner = await this.find(input);
+			if (winner?.userId === input.userId) return;
+			if (winner !== null) throw new ExternalIdentityConflictError();
+			throw err;
+		}
 	}
-}, g$1 = class extends i$1 {
-	constructor(e) {
-		super(e), this.name = "CounterToleranceError";
+	/** Remove one link of `userId`; `false` when that user did not hold it. */
+	async unlink(input) {
+		const existing = await this.find(input);
+		if (existing === null || existing.userId !== input.userId) return false;
+		await this.store.delete.mutate({
+			collection: USER_EXTERNAL_IDENTITIES_COLLECTION,
+			key: rowId(input)
+		});
+		return true;
 	}
-}, U$2 = class extends g$1 {
-	constructor(e, t) {
-		super(`Counter tolerance validation failed: total checks (${t}) exceeds MAX_WINDOW (${e})`), this.name = "CounterToleranceTooLargeError";
+	/** Delete every link of a user being deleted. Returns how many were removed. */
+	async removeAllForUser(userId) {
+		const links = await this.listForUser(userId);
+		for (const link of links) await this.store.delete.mutate({
+			collection: USER_EXTERNAL_IDENTITIES_COLLECTION,
+			key: rowId(link)
+		});
+		return links.length;
 	}
-}, X$1 = class extends g$1 {
-	constructor() {
-		super("Counter tolerance cannot contain negative values"), this.name = "CounterToleranceNegativeError";
+}, i$2 = class extends Error {
+	constructor(e, t) {
+		super(e, t), this.name = "OTPError";
 	}
-}, G$2 = class extends i$1 {
+}, G$3 = class extends i$2 {
 	constructor(e) {
 		super(e), this.name = "PluginError";
 	}
-}, Y$2 = class extends G$2 {
+}, Y$3 = class extends G$3 {
 	constructor() {
 		super("Crypto plugin is required."), this.name = "CryptoPluginMissingError";
 	}
-}, L$1 = class extends G$2 {
+}, L$2 = class extends G$3 {
 	constructor() {
 		super("Base32 plugin is required."), this.name = "Base32PluginMissingError";
 	}
-}, a$1 = class extends i$1 {
+}, a$2 = class extends i$2 {
 	constructor(e) {
 		super(e), this.name = "ConfigurationError";
 	}
-}, W$1 = class extends a$1 {
-	constructor() {
-		super("Secret is required. Use generateSecret() to create one, or provide via { secret: 'YOUR_BASE32_SECRET' }"), this.name = "SecretMissingError";
-	}
 };
 new TextEncoder();
 new TextDecoder();
-var ur$2 = 3600, pr$2 = Number.MAX_SAFE_INTEGER, er$2 = Symbol("otplib.guardrails.override");
-function y$1(r, e, t) {
-	if (typeof e != "number" || !Number.isSafeInteger(e)) throw new a$1(`Guardrail '${r}' must be a safe integer`);
-	if (e < t) throw new a$1(`Guardrail '${r}' must be >= ${t}`);
+var ur$3 = 3600, pr$3 = Number.MAX_SAFE_INTEGER, er$3 = Symbol("otplib.guardrails.override");
+function y$2(r, e, t) {
+	if (typeof e != "number" || !Number.isSafeInteger(e)) throw new a$2(`Guardrail '${r}' must be a safe integer`);
+	if (e < t) throw new a$2(`Guardrail '${r}' must be >= ${t}`);
 }
-var d$4 = Object.freeze({
+var d$5 = Object.freeze({
+	MIN_SECRET_BYTES: 16,
+	MAX_SECRET_BYTES: 64,
+	MIN_PERIOD: 1,
+	MAX_PERIOD: ur$3,
+	MAX_COUNTER: pr$3,
+	MAX_WINDOW: 99,
+	[er$3]: !1
+});
+function hr$2(r) {
+	if (!r) return d$5;
+	r.MIN_SECRET_BYTES !== void 0 && y$2("MIN_SECRET_BYTES", r.MIN_SECRET_BYTES, 1), r.MAX_SECRET_BYTES !== void 0 && y$2("MAX_SECRET_BYTES", r.MAX_SECRET_BYTES, 1), r.MIN_PERIOD !== void 0 && y$2("MIN_PERIOD", r.MIN_PERIOD, 1), r.MAX_PERIOD !== void 0 && y$2("MAX_PERIOD", r.MAX_PERIOD, 1), r.MAX_COUNTER !== void 0 && y$2("MAX_COUNTER", r.MAX_COUNTER, 0), r.MAX_WINDOW !== void 0 && y$2("MAX_WINDOW", r.MAX_WINDOW, 1);
+	let e = {
+		...d$5,
+		...r
+	};
+	if (e.MIN_SECRET_BYTES > e.MAX_SECRET_BYTES) throw new a$2("Guardrail 'MIN_SECRET_BYTES' must be <= 'MAX_SECRET_BYTES'");
+	if (e.MIN_PERIOD > e.MAX_PERIOD) throw new a$2("Guardrail 'MIN_PERIOD' must be <= 'MAX_PERIOD'");
+	return Object.freeze({
+		...e,
+		[er$3]: !0
+	});
+}
+function Dr(r) {
+	let { crypto: e, base32: t, length: o = 20 } = r;
+	dr$2(e), nr$2(t);
+	let n = e.randomBytes(o);
+	return t.encode(n, { padding: !1 });
+}
+function dr$2(r) {
+	if (!r) throw new Y$3();
+}
+function nr$2(r) {
+	if (!r) throw new L$2();
+}
+//#endregion
+//#region ../../node_modules/@otplib/hotp/node_modules/@otplib/core/dist/index.js
+var i$1 = class extends Error {
+	constructor(e, t) {
+		super(e, t), this.name = "OTPError";
+	}
+}, x$2 = class extends i$1 {
+	constructor(e) {
+		super(e), this.name = "SecretError";
+	}
+}, h$1 = class extends x$2 {
+	constructor(e, t) {
+		super(`Secret must be at least ${e} bytes (${e * 8} bits), got ${t} bytes`), this.name = "SecretTooShortError";
+	}
+}, P$1 = class extends x$2 {
+	constructor(e, t) {
+		super(`Secret must not exceed ${e} bytes, got ${t} bytes`), this.name = "SecretTooLongError";
+	}
+}, m$2 = class extends i$1 {
+	constructor(e) {
+		super(e), this.name = "CounterError";
+	}
+}, O$2 = class extends m$2 {
+	constructor() {
+		super("Counter must be non-negative"), this.name = "CounterNegativeError";
+	}
+}, T$2 = class extends m$2 {
+	constructor() {
+		super("Counter exceeds maximum safe integer value"), this.name = "CounterOverflowError";
+	}
+}, b$2 = class extends m$2 {
+	constructor() {
+		super("Counter must be a finite integer"), this.name = "CounterNotIntegerError";
+	}
+}, R$2 = class extends i$1 {
+	constructor(e) {
+		super(e), this.name = "TokenError";
+	}
+}, I$2 = class extends R$2 {
+	constructor(e, t) {
+		super(`Token must be ${e} digits, got ${t}`), this.name = "TokenLengthError";
+	}
+}, M$1 = class extends R$2 {
+	constructor() {
+		super("Token must contain only digits"), this.name = "TokenFormatError";
+	}
+}, N$1 = class extends i$1 {
+	constructor(e, t) {
+		super(e, t), this.name = "CryptoError";
+	}
+}, c$2 = class extends N$1 {
+	constructor(e, t) {
+		super(`HMAC computation failed: ${e}`, t), this.name = "HMACError";
+	}
+}, v$2 = class extends N$1 {
+	constructor(e, t) {
+		super(`Random byte generation failed: ${e}`, t), this.name = "RandomBytesError";
+	}
+}, g$1 = class extends i$1 {
+	constructor(e) {
+		super(e), this.name = "CounterToleranceError";
+	}
+}, U$2 = class extends g$1 {
+	constructor(e, t) {
+		super(`Counter tolerance validation failed: total checks (${t}) exceeds MAX_WINDOW (${e})`), this.name = "CounterToleranceTooLargeError";
+	}
+}, X$1 = class extends g$1 {
+	constructor() {
+		super("Counter tolerance cannot contain negative values"), this.name = "CounterToleranceNegativeError";
+	}
+}, G$2 = class extends i$1 {
+	constructor(e) {
+		super(e), this.name = "PluginError";
+	}
+}, Y$2 = class extends G$2 {
+	constructor() {
+		super("Crypto plugin is required."), this.name = "CryptoPluginMissingError";
+	}
+}, L$1 = class extends G$2 {
+	constructor() {
+		super("Base32 plugin is required."), this.name = "Base32PluginMissingError";
+	}
+}, a$1 = class extends i$1 {
+	constructor(e) {
+		super(e), this.name = "ConfigurationError";
+	}
+}, W$1 = class extends a$1 {
+	constructor() {
+		super("Secret is required. Use generateSecret() to create one, or provide via { secret: 'YOUR_BASE32_SECRET' }"), this.name = "SecretMissingError";
+	}
+};
+new TextEncoder();
+new TextDecoder();
+var ur$2 = 3600, pr$2 = Number.MAX_SAFE_INTEGER, er$2 = Symbol("otplib.guardrails.override");
+function y$1(r, e, t) {
+	if (typeof e != "number" || !Number.isSafeInteger(e)) throw new a$1(`Guardrail '${r}' must be a safe integer`);
+	if (e < t) throw new a$1(`Guardrail '${r}' must be >= ${t}`);
+}
+var d$4 = Object.freeze({
 	MIN_SECRET_BYTES: 16,
 	MAX_SECRET_BYTES: 64,
 	MIN_PERIOD: 1,
@@ -8568,1038 +9058,751 @@ var K512 = /* @__PURE__ */ (() => split([
 	"0xc76c51a30654be30",
 	"0xd192e819d6ef5218",
 	"0xd69906245565a910",
-	"0xf40e35855771202a",
-	"0x106aa07032bbd1b8",
-	"0x19a4c116b8d2d0c8",
-	"0x1e376c085141ab53",
-	"0x2748774cdf8eeb99",
-	"0x34b0bcb5e19b48a8",
-	"0x391c0cb3c5c95a63",
-	"0x4ed8aa4ae3418acb",
-	"0x5b9cca4f7763e373",
-	"0x682e6ff3d6b2b8a3",
-	"0x748f82ee5defb2fc",
-	"0x78a5636f43172f60",
-	"0x84c87814a1f0ab72",
-	"0x8cc702081a6439ec",
-	"0x90befffa23631e28",
-	"0xa4506cebde82bde9",
-	"0xbef9a3f7b2c67915",
-	"0xc67178f2e372532b",
-	"0xca273eceea26619c",
-	"0xd186b8c721c0c207",
-	"0xeada7dd6cde0eb1e",
-	"0xf57d4f7fee6ed178",
-	"0x06f067aa72176fba",
-	"0x0a637dc5a2c898a6",
-	"0x113f9804bef90dae",
-	"0x1b710b35131c471b",
-	"0x28db77f523047d84",
-	"0x32caab7b40c72493",
-	"0x3c9ebe0a15c9bebc",
-	"0x431d67c49c100d4c",
-	"0x4cc5d4becb3e42b6",
-	"0x597f299cfc657e2a",
-	"0x5fcb6fab3ad6faec",
-	"0x6c44198c4a475817"
-].map((n) => BigInt(n))))();
-var SHA512_Kh = /* @__PURE__ */ (() => K512[0])();
-var SHA512_Kl = /* @__PURE__ */ (() => K512[1])();
-var SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
-var SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
-/** Internal SHA-384 / SHA-512 compression engine from RFC 6234 §6.4. */
-var SHA2_64B = class extends HashMD {
-	constructor(outputLen) {
-		super(128, outputLen, 16, false);
-	}
-	get() {
-		const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
-		return [
-			Ah,
-			Al,
-			Bh,
-			Bl,
-			Ch,
-			Cl,
-			Dh,
-			Dl,
-			Eh,
-			El,
-			Fh,
-			Fl,
-			Gh,
-			Gl,
-			Hh,
-			Hl
-		];
-	}
-	set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {
-		this.Ah = Ah | 0;
-		this.Al = Al | 0;
-		this.Bh = Bh | 0;
-		this.Bl = Bl | 0;
-		this.Ch = Ch | 0;
-		this.Cl = Cl | 0;
-		this.Dh = Dh | 0;
-		this.Dl = Dl | 0;
-		this.Eh = Eh | 0;
-		this.El = El | 0;
-		this.Fh = Fh | 0;
-		this.Fl = Fl | 0;
-		this.Gh = Gh | 0;
-		this.Gl = Gl | 0;
-		this.Hh = Hh | 0;
-		this.Hl = Hl | 0;
-	}
-	process(view, offset) {
-		for (let i = 0; i < 16; i++, offset += 4) {
-			SHA512_W_H[i] = view.getUint32(offset);
-			SHA512_W_L[i] = view.getUint32(offset += 4);
-		}
-		for (let i = 16; i < 80; i++) {
-			const W15h = SHA512_W_H[i - 15] | 0;
-			const W15l = SHA512_W_L[i - 15] | 0;
-			const s0h = rotrSH(W15h, W15l, 1) ^ rotrSH(W15h, W15l, 8) ^ shrSH(W15h, W15l, 7);
-			const s0l = rotrSL(W15h, W15l, 1) ^ rotrSL(W15h, W15l, 8) ^ shrSL(W15h, W15l, 7);
-			const W2h = SHA512_W_H[i - 2] | 0;
-			const W2l = SHA512_W_L[i - 2] | 0;
-			const s1h = rotrSH(W2h, W2l, 19) ^ rotrBH(W2h, W2l, 61) ^ shrSH(W2h, W2l, 6);
-			const SUMl = add4L(s0l, rotrSL(W2h, W2l, 19) ^ rotrBL(W2h, W2l, 61) ^ shrSL(W2h, W2l, 6), SHA512_W_L[i - 7], SHA512_W_L[i - 16]);
-			SHA512_W_H[i] = add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]) | 0;
-			SHA512_W_L[i] = SUMl | 0;
-		}
-		let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
-		for (let i = 0; i < 80; i++) {
-			const sigma1h = rotrSH(Eh, El, 14) ^ rotrSH(Eh, El, 18) ^ rotrBH(Eh, El, 41);
-			const sigma1l = rotrSL(Eh, El, 14) ^ rotrSL(Eh, El, 18) ^ rotrBL(Eh, El, 41);
-			const CHIh = Eh & Fh ^ ~Eh & Gh;
-			const CHIl = El & Fl ^ ~El & Gl;
-			const T1ll = add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);
-			const T1h = add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);
-			const T1l = T1ll | 0;
-			const sigma0h = rotrSH(Ah, Al, 28) ^ rotrBH(Ah, Al, 34) ^ rotrBH(Ah, Al, 39);
-			const sigma0l = rotrSL(Ah, Al, 28) ^ rotrBL(Ah, Al, 34) ^ rotrBL(Ah, Al, 39);
-			const MAJh = Ah & Bh ^ Ah & Ch ^ Bh & Ch;
-			const MAJl = Al & Bl ^ Al & Cl ^ Bl & Cl;
-			Hh = Gh | 0;
-			Hl = Gl | 0;
-			Gh = Fh | 0;
-			Gl = Fl | 0;
-			Fh = Eh | 0;
-			Fl = El | 0;
-			({h: Eh, l: El} = add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));
-			Dh = Ch | 0;
-			Dl = Cl | 0;
-			Ch = Bh | 0;
-			Cl = Bl | 0;
-			Bh = Ah | 0;
-			Bl = Al | 0;
-			const All = add3L(T1l, sigma0l, MAJl);
-			Ah = add3H(All, T1h, sigma0h, MAJh);
-			Al = All | 0;
-		}
-		({h: Ah, l: Al} = add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));
-		({h: Bh, l: Bl} = add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));
-		({h: Ch, l: Cl} = add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));
-		({h: Dh, l: Dl} = add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));
-		({h: Eh, l: El} = add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));
-		({h: Fh, l: Fl} = add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));
-		({h: Gh, l: Gl} = add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));
-		({h: Hh, l: Hl} = add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));
-		this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);
-	}
-	roundClean() {
-		clean(SHA512_W_H, SHA512_W_L);
-	}
-	destroy() {
-		this.destroyed = true;
-		clean(this.buffer);
-		this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
-	}
-};
-/** Internal SHA-512 hash class grounded in RFC 6234 §6.3 and §6.4. */
-var _SHA512 = class extends SHA2_64B {
-	Ah = SHA512_IV[0] | 0;
-	Al = SHA512_IV[1] | 0;
-	Bh = SHA512_IV[2] | 0;
-	Bl = SHA512_IV[3] | 0;
-	Ch = SHA512_IV[4] | 0;
-	Cl = SHA512_IV[5] | 0;
-	Dh = SHA512_IV[6] | 0;
-	Dl = SHA512_IV[7] | 0;
-	Eh = SHA512_IV[8] | 0;
-	El = SHA512_IV[9] | 0;
-	Fh = SHA512_IV[10] | 0;
-	Fl = SHA512_IV[11] | 0;
-	Gh = SHA512_IV[12] | 0;
-	Gl = SHA512_IV[13] | 0;
-	Hh = SHA512_IV[14] | 0;
-	Hl = SHA512_IV[15] | 0;
-	constructor() {
-		super(64);
-	}
-};
-/**
-* SHA2-256 hash function from RFC 4634. In JS it's the fastest: even faster than Blake3. Some info:
-*
-* - Trying 2^128 hashes would get 50% chance of collision, using birthday attack.
-* - BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.
-* - Each sha256 hash is executing 2^18 bit operations.
-* - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.
-* @param msg - message bytes to hash
-* @returns Digest bytes.
-* @example
-* Hash a message with SHA2-256.
-* ```ts
-* sha256(new Uint8Array([97, 98, 99]));
-* ```
-*/
-var sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), /* @__PURE__ */ oidNist(1));
-/**
-* SHA2-512 hash function from RFC 4634.
-* @param msg - message bytes to hash
-* @returns Digest bytes.
-* @example
-* Hash a message with SHA2-512.
-* ```ts
-* sha512(new Uint8Array([97, 98, 99]));
-* ```
-*/
-var sha512 = /* @__PURE__ */ createHasher(() => new _SHA512(), /* @__PURE__ */ oidNist(3)), yr = new TextEncoder();
-new TextDecoder();
-//#endregion
-//#region ../../node_modules/@otplib/plugin-crypto-noble/node_modules/@otplib/core/dist/index.js
-var ur = 3600, pr = Number.MAX_SAFE_INTEGER;
-Object.freeze({
-	MIN_SECRET_BYTES: 16,
-	MAX_SECRET_BYTES: 64,
-	MIN_PERIOD: 1,
-	MAX_PERIOD: ur,
-	MAX_COUNTER: pr,
-	MAX_WINDOW: 99,
-	[Symbol("otplib.guardrails.override")]: !1
-});
-function gr(r, e) {
-	return r.length === e.length;
-}
-function tr(r, e) {
-	let t = rr(r), o = rr(e);
-	if (!gr(t, o)) return !1;
-	let n = 0;
-	for (let s = 0; s < t.length; s++) n |= t[s] ^ o[s];
-	return n === 0;
-}
-function rr(r) {
-	return typeof r == "string" ? yr.encode(r) : r;
-}
-//#endregion
-//#region ../../node_modules/@otplib/plugin-crypto-noble/dist/index.js
-var t = class {
-	name = "noble";
-	hmac(r, n, a) {
-		return hmac(r === "sha1" ? sha1 : r === "sha256" ? sha256 : sha512, n, a);
-	}
-	randomBytes(r) {
-		return randomBytes$1(r);
-	}
-	constantTimeEqual(r, n) {
-		return tr(r, n);
-	}
-}, A = Object.freeze(new t());
-//#endregion
-//#region node_modules/otplib/dist/index.js
-function c(t) {
-	return {
-		secret: t.secret,
-		strategy: t.strategy ?? "totp",
-		crypto: t.crypto ?? A,
-		base32: t.base32 ?? d$2,
-		algorithm: t.algorithm ?? "sha1",
-		digits: t.digits ?? 6,
-		period: t.period ?? 30,
-		epoch: t.epoch ?? Math.floor(Date.now() / 1e3),
-		t0: t.t0 ?? 0,
-		counter: t.counter,
-		guardrails: t.guardrails ?? hr$2(),
-		hooks: t.hooks
-	};
-}
-function O(t) {
-	return {
-		...c(t),
-		token: t.token,
-		epochTolerance: t.epochTolerance ?? 0,
-		counterTolerance: t.counterTolerance ?? 0,
-		afterTimeStep: t.afterTimeStep
-	};
-}
-function l(t, e, r) {
-	if (t === "totp") return r.totp();
-	if (t === "hotp") {
-		if (e === void 0) throw new a$2("Counter is required for HOTP strategy. Example: { strategy: 'hotp', counter: 0 }");
-		return r.hotp(e);
-	}
-	throw new a$2(`Unknown OTP strategy: ${t}. Valid strategies are 'totp' or 'hotp'.`);
-}
-function I(t) {
-	let { crypto: e = A, base32: r = d$2, length: a = 20 } = t || {};
-	return Dr({
-		crypto: e,
-		base32: r,
-		length: a
-	});
-}
-function T(t) {
-	let { strategy: e = "totp", issuer: r, label: a, secret: o, algorithm: i = "sha1", digits: s = 6, period: n = 30, counter: p } = t;
-	return l(e, p, {
-		totp: () => x$1({
-			issuer: r,
-			label: a,
-			secret: o,
-			algorithm: i,
-			digits: s,
-			period: n
-		}),
-		hotp: (y) => U$1({
-			issuer: r,
-			label: a,
-			secret: o,
-			algorithm: i,
-			digits: s,
-			counter: y
-		})
-	});
-}
-function d(t) {
-	let e = O(t), { secret: r, token: a, crypto: o, base32: i, algorithm: s, digits: n, hooks: p } = e, y = {
-		secret: r,
-		token: a,
-		crypto: o,
-		base32: i,
-		algorithm: s,
-		digits: n,
-		hooks: p
-	};
-	return l(e.strategy, e.counter, {
-		totp: () => ie({
-			...y,
-			period: e.period,
-			epoch: e.epoch,
-			t0: e.t0,
-			epochTolerance: e.epochTolerance,
-			afterTimeStep: e.afterTimeStep,
-			guardrails: e.guardrails
-		}),
-		hotp: (f) => Y$1({
-			...y,
-			counter: f,
-			counterTolerance: e.counterTolerance,
-			guardrails: e.guardrails
-		})
-	});
-}
-//#endregion
-//#region src/auth/totp-manager.ts
-/**
-* TOTP / 2FA enrollment manager.
-*
-* Three-state lifecycle keyed by `userId` (PK of `user_totp` collection):
-*
-*   - No row              → not set up. `setup()` inserts a row with a
-*                           fresh secret and `confirmedAt = null`.
-*   - `confirmedAt = null` → setup in progress; user has the secret but
-*                            hasn't proved possession of the
-*                            authenticator yet. `verify()` returns
-*                            false even with a valid code — the row is
-*                            inert until confirmed.
-*   - `confirmedAt != null` → enrolled; `verify()` accepts codes.
-*
-* Disable removes the row entirely. The next `setup()` starts fresh —
-* we do NOT reuse the old secret on re-enroll (avoids the case where a
-* leaked secret stays valid after a "rotation").
-*
-* `otplib` v13's functional API (`generateSync`/`verifySync`) uses RFC 6238
-* TOTP with a default 30-second period. We pass a per-call `epochTolerance`
-* of one step in either direction (±30 s) — operator clock skew is the usual
-* culprit for "valid code rejected" complaints.
-*/
-var TOTP_COLLECTION = "user_totp";
-var ISSUER = "CamStack";
-/** RFC 6238 default time step. otplib v13 measures `epochTolerance` in
-*  seconds, so a `window` of N steps maps to `N * TOTP_PERIOD_SECONDS`. */
-var TOTP_PERIOD_SECONDS = 30;
-function parseRow(data) {
-	const userId = data["userId"];
-	const secret = data["secret"];
-	const confirmedAt = data["confirmedAt"];
-	const createdAt = data["createdAt"];
-	if (typeof userId !== "string") throw new Error("user_totp row: missing userId");
-	if (typeof secret !== "string") throw new Error("user_totp row: missing secret");
-	if (typeof createdAt !== "number") throw new Error("user_totp row: missing createdAt");
-	return {
-		userId,
-		secret,
-		confirmedAt: typeof confirmedAt === "number" ? confirmedAt : null,
-		createdAt
-	};
-}
-var TotpManager = class {
-	store;
-	/** ±N steps of clock-skew tolerance, expressed in seconds for otplib v13's
-	*  per-call `epochTolerance`. Default window 1 = ±30 s. */
-	epochTolerance;
-	constructor(store, opts = {}) {
-		this.store = store;
-		this.epochTolerance = (opts.window ?? 1) * TOTP_PERIOD_SECONDS;
-	}
-	/**
-	* Begin enrollment. Always generates a fresh secret — calling `setup`
-	* a second time on the same user replaces any pending half-enrollment
-	* (the user must rescan the QR / re-enter the secret).
-	*
-	* The user identity (`label`) is what an authenticator displays as
-	* the account name; we use the supplied `username` for human-readable
-	* recognition. `ISSUER` is the CamStack brand.
-	*/
-	async setup(userId, username) {
-		const secret = I();
-		const otpauthUrl = T({
-			secret,
-			label: username,
-			issuer: ISSUER
-		});
-		const row = {
-			userId,
-			secret,
-			confirmedAt: null,
-			createdAt: Date.now()
-		};
-		await this.store.delete.mutate({
-			collection: TOTP_COLLECTION,
-			key: userId
-		});
-		await this.store.insert.mutate({
-			collection: TOTP_COLLECTION,
-			record: {
-				id: userId,
-				data: { ...row }
-			}
-		});
-		return {
-			secret,
-			otpauthUrl
-		};
+	"0xf40e35855771202a",
+	"0x106aa07032bbd1b8",
+	"0x19a4c116b8d2d0c8",
+	"0x1e376c085141ab53",
+	"0x2748774cdf8eeb99",
+	"0x34b0bcb5e19b48a8",
+	"0x391c0cb3c5c95a63",
+	"0x4ed8aa4ae3418acb",
+	"0x5b9cca4f7763e373",
+	"0x682e6ff3d6b2b8a3",
+	"0x748f82ee5defb2fc",
+	"0x78a5636f43172f60",
+	"0x84c87814a1f0ab72",
+	"0x8cc702081a6439ec",
+	"0x90befffa23631e28",
+	"0xa4506cebde82bde9",
+	"0xbef9a3f7b2c67915",
+	"0xc67178f2e372532b",
+	"0xca273eceea26619c",
+	"0xd186b8c721c0c207",
+	"0xeada7dd6cde0eb1e",
+	"0xf57d4f7fee6ed178",
+	"0x06f067aa72176fba",
+	"0x0a637dc5a2c898a6",
+	"0x113f9804bef90dae",
+	"0x1b710b35131c471b",
+	"0x28db77f523047d84",
+	"0x32caab7b40c72493",
+	"0x3c9ebe0a15c9bebc",
+	"0x431d67c49c100d4c",
+	"0x4cc5d4becb3e42b6",
+	"0x597f299cfc657e2a",
+	"0x5fcb6fab3ad6faec",
+	"0x6c44198c4a475817"
+].map((n) => BigInt(n))))();
+var SHA512_Kh = /* @__PURE__ */ (() => K512[0])();
+var SHA512_Kl = /* @__PURE__ */ (() => K512[1])();
+var SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
+var SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
+/** Internal SHA-384 / SHA-512 compression engine from RFC 6234 §6.4. */
+var SHA2_64B = class extends HashMD {
+	constructor(outputLen) {
+		super(128, outputLen, 16, false);
 	}
-	/**
-	* Confirm enrollment by checking a code from the authenticator
-	* against the pending secret. On success, flips `confirmedAt` so
-	* `verify()` starts accepting codes. Idempotent on already-confirmed
-	* rows: re-confirming a valid code just succeeds with no state
-	* change.
-	*/
-	async confirm(userId, code) {
-		const row = await this.find(userId);
-		if (!row) return false;
-		if (!d({
-			token: code,
-			secret: row.secret,
-			epochTolerance: this.epochTolerance
-		}).valid) return false;
-		if (row.confirmedAt === null) {
-			const next = {
-				...row,
-				confirmedAt: Date.now()
-			};
-			await this.store.update.mutate({
-				collection: TOTP_COLLECTION,
-				id: userId,
-				data: { ...next }
-			});
-		}
-		return true;
+	get() {
+		const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+		return [
+			Ah,
+			Al,
+			Bh,
+			Bl,
+			Ch,
+			Cl,
+			Dh,
+			Dl,
+			Eh,
+			El,
+			Fh,
+			Fl,
+			Gh,
+			Gl,
+			Hh,
+			Hl
+		];
 	}
-	/**
-	* Remove enrollment. Idempotent — no error if the user had no row.
-	*/
-	async disable(userId) {
-		await this.store.delete.mutate({
-			collection: TOTP_COLLECTION,
-			key: userId
-		});
+	set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {
+		this.Ah = Ah | 0;
+		this.Al = Al | 0;
+		this.Bh = Bh | 0;
+		this.Bl = Bl | 0;
+		this.Ch = Ch | 0;
+		this.Cl = Cl | 0;
+		this.Dh = Dh | 0;
+		this.Dl = Dl | 0;
+		this.Eh = Eh | 0;
+		this.El = El | 0;
+		this.Fh = Fh | 0;
+		this.Fl = Fl | 0;
+		this.Gh = Gh | 0;
+		this.Gl = Gl | 0;
+		this.Hh = Hh | 0;
+		this.Hl = Hl | 0;
 	}
-	/**
-	* Verify a code against the confirmed secret. Returns `false` when:
-	*   - The user has no row (not set up).
-	*   - The row is pending (`confirmedAt === null`).
-	*   - The code doesn't match within the configured window.
-	*/
-	async verify(userId, code) {
-		const row = await this.find(userId);
-		if (!row) return false;
-		if (row.confirmedAt === null) return false;
-		return d({
-			token: code,
-			secret: row.secret,
-			epochTolerance: this.epochTolerance
-		}).valid;
+	process(view, offset) {
+		for (let i = 0; i < 16; i++, offset += 4) {
+			SHA512_W_H[i] = view.getUint32(offset);
+			SHA512_W_L[i] = view.getUint32(offset += 4);
+		}
+		for (let i = 16; i < 80; i++) {
+			const W15h = SHA512_W_H[i - 15] | 0;
+			const W15l = SHA512_W_L[i - 15] | 0;
+			const s0h = rotrSH(W15h, W15l, 1) ^ rotrSH(W15h, W15l, 8) ^ shrSH(W15h, W15l, 7);
+			const s0l = rotrSL(W15h, W15l, 1) ^ rotrSL(W15h, W15l, 8) ^ shrSL(W15h, W15l, 7);
+			const W2h = SHA512_W_H[i - 2] | 0;
+			const W2l = SHA512_W_L[i - 2] | 0;
+			const s1h = rotrSH(W2h, W2l, 19) ^ rotrBH(W2h, W2l, 61) ^ shrSH(W2h, W2l, 6);
+			const SUMl = add4L(s0l, rotrSL(W2h, W2l, 19) ^ rotrBL(W2h, W2l, 61) ^ shrSL(W2h, W2l, 6), SHA512_W_L[i - 7], SHA512_W_L[i - 16]);
+			SHA512_W_H[i] = add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]) | 0;
+			SHA512_W_L[i] = SUMl | 0;
+		}
+		let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+		for (let i = 0; i < 80; i++) {
+			const sigma1h = rotrSH(Eh, El, 14) ^ rotrSH(Eh, El, 18) ^ rotrBH(Eh, El, 41);
+			const sigma1l = rotrSL(Eh, El, 14) ^ rotrSL(Eh, El, 18) ^ rotrBL(Eh, El, 41);
+			const CHIh = Eh & Fh ^ ~Eh & Gh;
+			const CHIl = El & Fl ^ ~El & Gl;
+			const T1ll = add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);
+			const T1h = add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);
+			const T1l = T1ll | 0;
+			const sigma0h = rotrSH(Ah, Al, 28) ^ rotrBH(Ah, Al, 34) ^ rotrBH(Ah, Al, 39);
+			const sigma0l = rotrSL(Ah, Al, 28) ^ rotrBL(Ah, Al, 34) ^ rotrBL(Ah, Al, 39);
+			const MAJh = Ah & Bh ^ Ah & Ch ^ Bh & Ch;
+			const MAJl = Al & Bl ^ Al & Cl ^ Bl & Cl;
+			Hh = Gh | 0;
+			Hl = Gl | 0;
+			Gh = Fh | 0;
+			Gl = Fl | 0;
+			Fh = Eh | 0;
+			Fl = El | 0;
+			({h: Eh, l: El} = add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));
+			Dh = Ch | 0;
+			Dl = Cl | 0;
+			Ch = Bh | 0;
+			Cl = Bl | 0;
+			Bh = Ah | 0;
+			Bl = Al | 0;
+			const All = add3L(T1l, sigma0l, MAJl);
+			Ah = add3H(All, T1h, sigma0h, MAJh);
+			Al = All | 0;
+		}
+		({h: Ah, l: Al} = add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));
+		({h: Bh, l: Bl} = add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));
+		({h: Ch, l: Cl} = add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));
+		({h: Dh, l: Dl} = add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));
+		({h: Eh, l: El} = add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));
+		({h: Fh, l: Fl} = add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));
+		({h: Gh, l: Gl} = add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));
+		({h: Hh, l: Hl} = add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));
+		this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);
 	}
-	/**
-	* Read the user's enrollment status. Pending half-enrollments are
-	* reported as `enabled: false` — only a confirmed row counts.
-	*/
-	async getStatus(userId) {
-		const row = await this.find(userId);
-		if (!row) return {
-			enabled: false,
-			confirmedAt: null
-		};
-		return {
-			enabled: row.confirmedAt !== null,
-			confirmedAt: row.confirmedAt
-		};
+	roundClean() {
+		clean(SHA512_W_H, SHA512_W_L);
 	}
-	async find(userId) {
-		const results = await this.store.query.query({
-			collection: TOTP_COLLECTION,
-			filter: { where: { userId } }
-		});
-		if (results.length === 0) return null;
-		return parseRow(results[0].data);
+	destroy() {
+		this.destroyed = true;
+		clean(this.buffer);
+		this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+	}
+};
+/** Internal SHA-512 hash class grounded in RFC 6234 §6.3 and §6.4. */
+var _SHA512 = class extends SHA2_64B {
+	Ah = SHA512_IV[0] | 0;
+	Al = SHA512_IV[1] | 0;
+	Bh = SHA512_IV[2] | 0;
+	Bl = SHA512_IV[3] | 0;
+	Ch = SHA512_IV[4] | 0;
+	Cl = SHA512_IV[5] | 0;
+	Dh = SHA512_IV[6] | 0;
+	Dl = SHA512_IV[7] | 0;
+	Eh = SHA512_IV[8] | 0;
+	El = SHA512_IV[9] | 0;
+	Fh = SHA512_IV[10] | 0;
+	Fl = SHA512_IV[11] | 0;
+	Gh = SHA512_IV[12] | 0;
+	Gl = SHA512_IV[13] | 0;
+	Hh = SHA512_IV[14] | 0;
+	Hl = SHA512_IV[15] | 0;
+	constructor() {
+		super(64);
 	}
 };
-//#endregion
-//#region src/kernel/config-schema.ts
-/** Default data directory — used when CAMSTACK_DATA env var is not set */
-var DEFAULT_DATA_PATH = "camstack-data";
-/**
-* A list of browser origins from config.yaml (a YAML list) or from the
-* `CAMSTACK_CORS_ORIGINS` env var (one comma-separated string — env carries
-* only strings). Validation of each entry is the CORS policy's job
-* (`server/backend/src/api/cors/cors-policy.ts`), which logs what it rejects;
-* the schema only fixes the SHAPE so a typo cannot stop the hub from booting.
-*/
-var originListSchema = z.preprocess((value) => typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) : value, z.array(z.string()));
-var serverSchema = z.object({
-	port: z.number().default(4443),
-	host: z.string().default("0.0.0.0"),
-	dataPath: z.string().default(DEFAULT_DATA_PATH),
-	/**
-	* EXTRA browser origins allowed to call this hub cross-origin (D707), on
-	* top of the built-ins: the hub's own origin, the hosted viewer PWA and the
-	* native app's opaque `null` origin. Bootstrap-owned on purpose — widening
-	* who may read hub responses in a browser is a security decision, and the
-	* policy is live from the first request, before the settings store exists.
-	*/
-	corsOrigins: originListSchema.default([])
-});
-var authSchema = z.object({
-	jwtSecret: z.string().nullable().default(null),
-	adminUsername: z.string().default("admin"),
-	adminPassword: z.string().default("changeme")
-});
-var hubSchema = z.object({
-	url: z.string().default("ws://localhost:4443/agent"),
-	token: z.string().default("")
-});
-var agentSchema = z.object({
-	name: z.string().default(""),
-	/** Port for the agent status page (minimal HTML) */
-	statusPort: z.number().default(4444)
-});
-var tlsSchema = z.object({ 
 /**
-* Enable HTTPS (default: true). The certificate itself is never configured
-* here: the admin UI (Network → Local access) generates or uploads it
-* (D726), and boot serves whatever `tls/mode` says.
+* SHA2-256 hash function from RFC 4634. In JS it's the fastest: even faster than Blake3. Some info:
+*
+* - Trying 2^128 hashes would get 50% chance of collision, using birthday attack.
+* - BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.
+* - Each sha256 hash is executing 2^18 bit operations.
+* - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.
+* @param msg - message bytes to hash
+* @returns Digest bytes.
+* @example
+* Hash a message with SHA2-256.
+* ```ts
+* sha256(new Uint8Array([97, 98, 99]));
+* ```
 */
-enabled: z.boolean().default(true) });
+var sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), /* @__PURE__ */ oidNist(1));
 /**
-* Bootstrap-time addon configuration — read PURELY from YAML, before the
-* kernel can talk to the settings-store. This breaks the chicken-and-egg
-* where the settings store itself is implemented by an addon: the kernel
-* needs to know WHICH addon to load first to provide the store, and that
-* decision can't itself live in the store.
-*
-* Backward-compatible: every field is optional + defaults reproduce the
-* current hard-coded behavior. Existing config.yaml files keep working.
+* SHA2-512 hash function from RFC 4634.
+* @param msg - message bytes to hash
+* @returns Digest bytes.
+* @example
+* Hash a message with SHA2-512.
+* ```ts
+* sha512(new Uint8Array([97, 98, 99]));
+* ```
 */
-var bootstrapAddonsSchema = z.object({
-	/**
-	* Addon implementing the `settings-store` capability. Loaded FIRST,
-	* before any other addon is enabled — every other addon's enable
-	* state, settings, and ordering lives in the store it provides.
-	*
-	* Default: '@camstack/addon-sqlite-storage' (the workspace's
-	* default SQLite-backed store). Future alternatives could swap this
-	* for postgres/redis without touching kernel code.
-	*/
-	settingsStoreAddon: z.string().default("@camstack/addon-sqlite-storage"),
-	/**
-	* How the launcher provisions REQUIRED_PACKAGES into `data/addons/`
-	* on startup.
-	*
-	*   - `'npm'`     — pull from the npm registry (production default).
-	*   - `'local'`   — copy `packages/<X>/` from the workspace into
-	*                   `data/addons/<X>/`. Use for the Electron-
-	*                   packaged bundle and the e2e harness.
-	*   - `'symlink'` — point `data/addons/<X>` at the workspace source
-	*                   dir via a directory symlink. Dev-only: a
-	*                   workspace rebuild (`npm run build -w <X>`) is
-	*                   immediately reflected at the next addon load,
-	*                   no copy step. Falls back to `'local'` on
-	*                   platforms that reject symlink creation (Windows
-	*                   without developer-mode).
-	*
-	* The `CAMSTACK_INSTALL_SOURCE` env var, when set, wins over this
-	* field. Leave undefined to keep the launcher's default behaviour
-	* (npm when no workspace, local when a bundled addons dir is
-	* present, …).
-	*/
-	installSource: z.enum([
-		"npm",
-		"local",
-		"symlink"
-	]).optional(),
-	/**
-	* Override the kernel's hard-coded `AddonInstaller.REQUIRED_PACKAGES`.
-	* Passing an array here REPLACES the default list entirely — useful
-	* for stripped-down deployments (only the bundle of addons the
-	* operator actually wants) and for forcing a different storage
-	* backend at first boot.
-	*
-	* Leave undefined to use the kernel-shipped defaults.
-	*/
-	requiredAddons: z.array(z.string()).optional(),
-	/**
-	* Disable list applied AFTER the settings-store reports the enabled
-	* set. Operator escape hatch — boot without a known-broken addon
-	* without having to mutate the store.
-	*/
-	forceDisable: z.array(z.string()).default([])
-});
-/** Bootstrap config -- loaded from config.yaml ONLY at startup.
-*  All other settings live in SQL (system_settings table). */
-var bootstrapSchema = z.object({
-	/** Server mode: 'hub' (full server) or 'agent' (worker node) */
-	mode: z.enum(["hub", "agent"]).default("hub"),
-	server: serverSchema.default(serverSchema.parse({})),
-	auth: authSchema.default(authSchema.parse({})),
-	/** Hub connection config — only used when mode='agent' */
-	hub: hubSchema.default(hubSchema.parse({})),
-	/** Agent-specific config — only used when mode='agent' */
-	agent: agentSchema.default(agentSchema.parse({})),
-	/** TLS configuration */
-	tls: tlsSchema.default(tlsSchema.parse({})),
-	/**
-	* Addon bootstrap directives — minimum addon set needed before the
-	* kernel can reach the settings-store. See bootstrapAddonsSchema.
-	* Spec: docs/superpowers/specs/2026-05-15-yaml-bootstrap-expansion.md
-	*/
-	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({}))
+var sha512 = /* @__PURE__ */ createHasher(() => new _SHA512(), /* @__PURE__ */ oidNist(3)), yr = new TextEncoder();
+new TextDecoder();
+//#endregion
+//#region ../../node_modules/@otplib/plugin-crypto-noble/node_modules/@otplib/core/dist/index.js
+var ur = 3600, pr = Number.MAX_SAFE_INTEGER;
+Object.freeze({
+	MIN_SECRET_BYTES: 16,
+	MAX_SECRET_BYTES: 64,
+	MIN_PERIOD: 1,
+	MAX_PERIOD: ur,
+	MAX_COUNTER: pr,
+	MAX_WINDOW: 99,
+	[Symbol("otplib.guardrails.override")]: !1
 });
+function gr(r, e) {
+	return r.length === e.length;
+}
+function tr(r, e) {
+	let t = rr(r), o = rr(e);
+	if (!gr(t, o)) return !1;
+	let n = 0;
+	for (let s = 0; s < t.length; s++) n |= t[s] ^ o[s];
+	return n === 0;
+}
+function rr(r) {
+	return typeof r == "string" ? yr.encode(r) : r;
+}
+//#endregion
+//#region ../../node_modules/@otplib/plugin-crypto-noble/dist/index.js
+var t = class {
+	name = "noble";
+	hmac(r, n, a) {
+		return hmac(r === "sha1" ? sha1 : r === "sha256" ? sha256 : sha512, n, a);
+	}
+	randomBytes(r) {
+		return randomBytes$1(r);
+	}
+	constantTimeEqual(r, n) {
+		return tr(r, n);
+	}
+}, A = Object.freeze(new t());
+//#endregion
+//#region node_modules/otplib/dist/index.js
+function c(t) {
+	return {
+		secret: t.secret,
+		strategy: t.strategy ?? "totp",
+		crypto: t.crypto ?? A,
+		base32: t.base32 ?? d$2,
+		algorithm: t.algorithm ?? "sha1",
+		digits: t.digits ?? 6,
+		period: t.period ?? 30,
+		epoch: t.epoch ?? Math.floor(Date.now() / 1e3),
+		t0: t.t0 ?? 0,
+		counter: t.counter,
+		guardrails: t.guardrails ?? hr$2(),
+		hooks: t.hooks
+	};
+}
+function O(t) {
+	return {
+		...c(t),
+		token: t.token,
+		epochTolerance: t.epochTolerance ?? 0,
+		counterTolerance: t.counterTolerance ?? 0,
+		afterTimeStep: t.afterTimeStep
+	};
+}
+function l(t, e, r) {
+	if (t === "totp") return r.totp();
+	if (t === "hotp") {
+		if (e === void 0) throw new a$2("Counter is required for HOTP strategy. Example: { strategy: 'hotp', counter: 0 }");
+		return r.hotp(e);
+	}
+	throw new a$2(`Unknown OTP strategy: ${t}. Valid strategies are 'totp' or 'hotp'.`);
+}
+function I(t) {
+	let { crypto: e = A, base32: r = d$2, length: a = 20 } = t || {};
+	return Dr({
+		crypto: e,
+		base32: r,
+		length: a
+	});
+}
+function T(t) {
+	let { strategy: e = "totp", issuer: r, label: a, secret: o, algorithm: i = "sha1", digits: s = 6, period: n = 30, counter: p } = t;
+	return l(e, p, {
+		totp: () => x$1({
+			issuer: r,
+			label: a,
+			secret: o,
+			algorithm: i,
+			digits: s,
+			period: n
+		}),
+		hotp: (y) => U$1({
+			issuer: r,
+			label: a,
+			secret: o,
+			algorithm: i,
+			digits: s,
+			counter: y
+		})
+	});
+}
+function d(t) {
+	let e = O(t), { secret: r, token: a, crypto: o, base32: i, algorithm: s, digits: n, hooks: p } = e, y = {
+		secret: r,
+		token: a,
+		crypto: o,
+		base32: i,
+		algorithm: s,
+		digits: n,
+		hooks: p
+	};
+	return l(e.strategy, e.counter, {
+		totp: () => ie({
+			...y,
+			period: e.period,
+			epoch: e.epoch,
+			t0: e.t0,
+			epochTolerance: e.epochTolerance,
+			afterTimeStep: e.afterTimeStep,
+			guardrails: e.guardrails
+		}),
+		hotp: (f) => Y$1({
+			...y,
+			counter: f,
+			counterTolerance: e.counterTolerance,
+			guardrails: e.guardrails
+		})
+	});
+}
 //#endregion
-//#region src/builtins/local-auth/admin-account-boot.ts
+//#region src/auth/totp-manager.ts
 /**
-* The admin account at boot: seed it once, reset it only on the operator's
-* explicit one-shot request, and say so when it still has the default password.
+* TOTP / 2FA enrollment manager.
 *
-* ## Why a trigger FILE, not a variable
+* Three-state lifecycle keyed by `userId` (PK of `user_totp` collection):
 *
-* The configured password (`CAMSTACK_ADMIN_PASS` / `auth.adminPassword`) seeds
-* the admin on first boot and is never applied again — a password the operator
-* changes in the admin UI survives every restart. Recovering a forgotten
-* password therefore needs an explicit request, and that request must be
-* ONE-SHOT: an environment flag stays set in a container template until someone
-* remembers to remove it, and while it is set it reverts the password on every
-* boot — the very defect this replaced. A file the hub DELETES after acting on
-* it cannot be left armed: create `RESET_ADMIN_PASSWORD` in the node's data
-* directory (`/data` in the container), restart, and the configured admin's
-* password is set back to the configured one, once.
+*   - No row              → not set up. `setup()` inserts a row with a
+*                           fresh secret and `confirmedAt = null`.
+*   - `confirmedAt = null` → setup in progress; user has the secret but
+*                            hasn't proved possession of the
+*                            authenticator yet. `verify()` returns
+*                            false even with a valid code — the row is
+*                            inert until confirmed.
+*   - `confirmedAt != null` → enrolled; `verify()` accepts codes.
+*
+* Disable removes the row entirely. The next `setup()` starts fresh —
+* we do NOT reuse the old secret on re-enroll (avoids the case where a
+* leaked secret stays valid after a "rotation").
+*
+* `otplib` v13's functional API (`generateSync`/`verifySync`) uses RFC 6238
+* TOTP with a default 30-second period. We pass a per-call `epochTolerance`
+* of one step in either direction (±30 s) — operator clock skew is the usual
+* culprit for "valid code rejected" complaints.
 */
-/** The trigger's name, at the root of the node's data directory. */
-var ADMIN_PASSWORD_RESET_TRIGGER = "RESET_ADMIN_PASSWORD";
-async function reconcileAdminAccountAtBoot(input) {
-	const { users, fs, logger } = input;
-	const triggerPath = path$1.join(input.dataDir, ADMIN_PASSWORD_RESET_TRIGGER);
-	const resetRequested = fs.exists(triggerPath);
-	const outcome = await users.ensureAdminExists({ resetPassword: resetRequested });
-	logOutcome(outcome, logger);
-	if (resetRequested) consumeTrigger(triggerPath, outcome, input);
-	const username = "username" in outcome ? outcome.username : null;
-	const usesDefaultPassword = username !== null && await users.hasPassword(username, "changeme");
-	if (usesDefaultPassword && username !== null) logger.warn("The admin account still uses the default password — change it in the admin UI (the first sign-in with it asks for a new one)", { meta: { username } });
+var TOTP_COLLECTION = "user_totp";
+var ISSUER = "CamStack";
+/** RFC 6238 default time step. otplib v13 measures `epochTolerance` in
+*  seconds, so a `window` of N steps maps to `N * TOTP_PERIOD_SECONDS`. */
+var TOTP_PERIOD_SECONDS = 30;
+function parseRow(data) {
+	const userId = data["userId"];
+	const secret = data["secret"];
+	const confirmedAt = data["confirmedAt"];
+	const createdAt = data["createdAt"];
+	if (typeof userId !== "string") throw new Error("user_totp row: missing userId");
+	if (typeof secret !== "string") throw new Error("user_totp row: missing secret");
+	if (typeof createdAt !== "number") throw new Error("user_totp row: missing createdAt");
 	return {
-		outcome,
-		usesDefaultPassword
+		userId,
+		secret,
+		confirmedAt: typeof confirmedAt === "number" ? confirmedAt : null,
+		createdAt
 	};
 }
-function logOutcome(outcome, logger) {
-	switch (outcome.kind) {
-		case "seeded":
-			logger.info("Admin account seeded from the configured credentials (first boot)", { meta: { username: outcome.username } });
-			return;
-		case "reset":
-			logger.warn("Admin password reset to the configured password, as requested", { meta: { username: outcome.username } });
-			return;
-		case "other-admin-exists":
-			logger.info("Configured admin username not seeded: another admin account already exists", { meta: { username: outcome.username } });
-			return;
-		case "not-configured":
-			logger.warn("No admin username/password configured — no admin account seeded");
-			return;
-		case "exists": return;
-	}
-}
-/** Delete the trigger after acting on it — a reset must never repeat by itself. */
-function consumeTrigger(triggerPath, outcome, input) {
-	if (outcome.kind !== "reset") input.logger.warn("Admin password reset requested, but no configured admin account to reset", { meta: {
-		trigger: triggerPath,
-		outcome: outcome.kind
-	} });
-	try {
-		input.fs.remove(triggerPath);
-	} catch (err) {
-		input.logger.error("Could not delete the admin password reset trigger — delete it by hand, or every restart resets the admin password again", { meta: {
-			trigger: triggerPath,
-			error: err instanceof Error ? err.message : String(err)
-		} });
+var TotpManager = class {
+	store;
+	/** ±N steps of clock-skew tolerance, expressed in seconds for otplib v13's
+	*  per-call `epochTolerance`. Default window 1 = ±30 s. */
+	epochTolerance;
+	constructor(store, opts = {}) {
+		this.store = store;
+		this.epochTolerance = (opts.window ?? 1) * TOTP_PERIOD_SECONDS;
 	}
-}
-//#endregion
-//#region src/builtins/local-auth/auth-config-reader.ts
-/**
-* Every config path this reader can answer. Anything else resolves to
-* `undefined` by construction — see the module docblock.
-*/
-function createAuthConfigReader(resolved, writeAuthSection) {
-	return {
-		get(path) {
-			switch (path) {
-				case "auth.jwtSecret": return narrow(resolved.jwtSecret);
-				case "auth.adminUsername": return narrow(resolved.adminUsername);
-				case "auth.adminPassword": return narrow(resolved.adminPassword);
-				case "auth.tokenExpiry": return narrow(resolved.tokenExpiry);
-				default: return;
+	/**
+	* Begin enrollment. Always generates a fresh secret — calling `setup`
+	* a second time on the same user replaces any pending half-enrollment
+	* (the user must rescan the QR / re-enter the secret).
+	*
+	* The user identity (`label`) is what an authenticator displays as
+	* the account name; we use the supplied `username` for human-readable
+	* recognition. `ISSUER` is the CamStack brand.
+	*/
+	async setup(userId, username) {
+		const secret = I();
+		const otpauthUrl = T({
+			secret,
+			label: username,
+			issuer: ISSUER
+		});
+		const row = {
+			userId,
+			secret,
+			confirmedAt: null,
+			createdAt: Date.now()
+		};
+		await this.store.delete.mutate({
+			collection: TOTP_COLLECTION,
+			key: userId
+		});
+		await this.store.insert.mutate({
+			collection: TOTP_COLLECTION,
+			record: {
+				id: userId,
+				data: { ...row }
 			}
-		},
-		update(_section, data) {
-			if (typeof data["jwtSecret"] === "string") writeAuthSection({ jwtSecret: data["jwtSecret"] });
+		});
+		return {
+			secret,
+			otpauthUrl
+		};
+	}
+	/**
+	* Confirm enrollment by checking a code from the authenticator
+	* against the pending secret. On success, flips `confirmedAt` so
+	* `verify()` starts accepting codes. Idempotent on already-confirmed
+	* rows: re-confirming a valid code just succeeds with no state
+	* change.
+	*/
+	async confirm(userId, code) {
+		const row = await this.find(userId);
+		if (!row) return false;
+		if (!d({
+			token: code,
+			secret: row.secret,
+			epochTolerance: this.epochTolerance
+		}).valid) return false;
+		if (row.confirmedAt === null) {
+			const next = {
+				...row,
+				confirmedAt: Date.now()
+			};
+			await this.store.update.mutate({
+				collection: TOTP_COLLECTION,
+				id: userId,
+				data: { ...next }
+			});
 		}
-	};
-}
-/**
-* The one documented type boundary in this module. `AuthConfigReader.get` is
-* the legacy `get<T>(path)` shape shared with `ConfigManager.get`, which is
-* likewise unchecked at runtime — every value returned here is a `string |
-* undefined` the caller immediately re-validates (`parseTokenExpiry`, the
-* truthiness gate on `jwtSecret`).
-*/
-function narrow(value) {
-	return value;
-}
-//#endregion
-//#region src/builtins/local-auth/auth-schema.ts
-/**
-* @durable class=config owner=local-auth
-*   write="an operator creates a user, or `ensureAdminExists` seeds the configured
-*     admin on first boot (or resets its password on the operator's one-shot
-*     RESET_ADMIN_PASSWORD trigger); updated on scope, isAdmin and password edits"
-*   retention="none — a row goes only when an operator deletes the user. A
-*     `declareCollection` that adds a PK/UNIQUE/NOT-NULL-without-default column
-*     REBUILDS the table: every account is wiped and only the configured admin
-*     comes back on the next boot."
-*/
-var USERS_COLLECTION = "users";
-/**
-* @durable class=config owner=local-auth
-*   write="an operator mints an API key; `validateToken` rewrites `lastUsedAt` on
-*     every request the key authorises"
-*   retention="none — an explicit `revoke` is the only delete. API keys have no
-*     expiry column and no sweep, so a key lives until someone removes it (or the
-*     destructive `declareCollection` rebuild takes the table)."
-*/
-var API_KEYS_COLLECTION = "api_keys";
+		return true;
+	}
+	/**
+	* Remove enrollment. Idempotent — no error if the user had no row.
+	*/
+	async disable(userId) {
+		await this.store.delete.mutate({
+			collection: TOTP_COLLECTION,
+			key: userId
+		});
+	}
+	/**
+	* Verify a code against the confirmed secret. Returns `false` when:
+	*   - The user has no row (not set up).
+	*   - The row is pending (`confirmedAt === null`).
+	*   - The code doesn't match within the configured window.
+	*/
+	async verify(userId, code) {
+		const row = await this.find(userId);
+		if (!row) return false;
+		if (row.confirmedAt === null) return false;
+		return d({
+			token: code,
+			secret: row.secret,
+			epochTolerance: this.epochTolerance
+		}).valid;
+	}
+	/**
+	* Read the user's enrollment status. Pending half-enrollments are
+	* reported as `enabled: false` — only a confirmed row counts.
+	*/
+	async getStatus(userId) {
+		const row = await this.find(userId);
+		if (!row) return {
+			enabled: false,
+			confirmedAt: null
+		};
+		return {
+			enabled: row.confirmedAt !== null,
+			confirmedAt: row.confirmedAt
+		};
+	}
+	async find(userId) {
+		const results = await this.store.query.query({
+			collection: TOTP_COLLECTION,
+			filter: { where: { userId } }
+		});
+		if (results.length === 0) return null;
+		return parseRow(results[0].data);
+	}
+};
+//#endregion
+//#region src/kernel/config-schema.ts
+/** Default data directory — used when CAMSTACK_DATA env var is not set */
+var DEFAULT_DATA_PATH = "camstack-data";
 /**
-* @durable class=config owner=local-auth
-*   write="an operator or the CLI mints a scoped token; `validate` fires
-*     `updateLastUsed` on every accepted call"
-*   retention="`revoke` deletes one. The daily sweep `reapExpired` drops rows past
-*     `expiresAt` — a NULL expiry is a deliberate never-expires token and BETWEEN
-*     never matches it. `cleanupOrphans` drops tokens owned by the legacy 'system'
-*     id or by a user that no longer exists."
+* A list of browser origins from config.yaml (a YAML list) or from the
+* `CAMSTACK_CORS_ORIGINS` env var (one comma-separated string — env carries
+* only strings). Validation of each entry is the CORS policy's job
+* (`server/backend/src/api/cors/cors-policy.ts`), which logs what it rejects;
+* the schema only fixes the SHAPE so a typo cannot stop the hub from booting.
 */
-var SCOPED_TOKENS_COLLECTION = "scoped_tokens";
+var originListSchema = z.preprocess((value) => typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) : value, z.array(z.string()));
+var serverSchema = z.object({
+	port: z.number().default(4443),
+	host: z.string().default("0.0.0.0"),
+	dataPath: z.string().default(DEFAULT_DATA_PATH),
+	/**
+	* EXTRA browser origins allowed to call this hub cross-origin (D707), on
+	* top of the built-ins: the hub's own origin, the hosted viewer PWA and the
+	* native app's opaque `null` origin. Bootstrap-owned on purpose — widening
+	* who may read hub responses in a browser is a security decision, and the
+	* policy is live from the first request, before the settings store exists.
+	*/
+	corsOrigins: originListSchema.default([])
+});
+var authSchema = z.object({
+	jwtSecret: z.string().nullable().default(null),
+	adminUsername: z.string().default("admin"),
+	adminPassword: z.string().default("changeme")
+});
+var hubSchema = z.object({
+	url: z.string().default("ws://localhost:4443/agent"),
+	token: z.string().default("")
+});
+var agentSchema = z.object({
+	name: z.string().default(""),
+	/** Port for the agent status page (minimal HTML) */
+	statusPort: z.number().default(4444)
+});
+var tlsSchema = z.object({ 
 /**
-* @durable class=ledger owner=local-auth
-*   write="one row per redeemed OAuth code — every completed account link through
-*     `oauthExchangeCode`; `touch` rewrites `lastUsedAt` on each refresh"
-*   retention="ONLY revoked rows are pruned: the daily sweep deletes sessions
-*     revoked more than OAUTH_REVOKED_RETENTION_MS (30 d) ago. An ACTIVE session
-*     has `revokedAt` NULL, never expires and is never swept — the table grows one
-*     row per login until an operator revokes the link."
+* Enable HTTPS (default: true). The certificate itself is never configured
+* here: the admin UI (Network → Local access) generates or uploads it
+* (D726), and boot serves whatever `tls/mode` says.
 */
-var OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
+enabled: z.boolean().default(true) });
 /**
-* TOTP enrollment table — split off from `users` to avoid the
-* destructive drop-+-recreate migration `ensureTable` performs when a
-* new column is added to a typed schema (see `sqlite-settings-backend.ts`).
-*
-* Lifecycle:
-*   - Setup: row inserted with `confirmedAt = null` and a fresh secret.
-*   - Confirm: a valid code from the secret flips `confirmedAt` to now().
-*   - Disable: the row is deleted (next setup starts fresh).
-*
-* "Enabled" means `confirmedAt != null`. A half-enrolled row (`confirmedAt
-* = null`) is INACTIVE — `verifyTotp` returns false until confirmation.
+* Bootstrap-time addon configuration — read PURELY from YAML, before the
+* kernel can talk to the settings-store. This breaks the chicken-and-egg
+* where the settings store itself is implemented by an addon: the kernel
+* needs to know WHICH addon to load first to provide the store, and that
+* decision can't itself live in the store.
 *
-* @durable class=config owner=local-auth
-*   write="`setup` inserts a fresh secret for the user (deleting any pending row
-*     first); `confirm` flips `confirmedAt` once a valid code proves possession"
-*   retention="`disable` deletes the row, and `setup` deletes before re-inserting.
-*     Nothing else prunes — deleting a USER does not cascade here, so their
-*     enrollment row outlives the account."
+* Backward-compatible: every field is optional + defaults reproduce the
+* current hard-coded behavior. Existing config.yaml files keep working.
 */
-var USER_TOTP_COLLECTION = "user_totp";
-var USERS_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "username",
-		type: "TEXT",
-		notNull: true,
-		unique: true
-	},
-	{
-		name: "passwordHash",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "isAdmin",
-		type: "BOOLEAN",
-		notNull: true
-	},
-	{
-		name: "allowedProviders",
-		type: "JSON"
-	},
-	{
-		name: "allowedDevices",
-		type: "JSON"
-	},
-	{
-		name: "scopes",
-		type: "JSON"
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "updatedAt",
-		type: "INTEGER",
-		notNull: true
-	}
-];
-var API_KEYS_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "label",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "isAdmin",
-		type: "BOOLEAN",
-		notNull: true
-	},
-	{
-		name: "tokenHash",
-		type: "TEXT",
-		notNull: true,
-		unique: true
-	},
-	{
-		name: "tokenPrefix",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "allowedProviders",
-		type: "JSON"
-	},
-	{
-		name: "allowedDevices",
-		type: "JSON"
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "lastUsedAt",
-		type: "INTEGER"
-	}
-];
-var USER_TOTP_COLUMNS = [
-	{
-		name: "userId",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "secret",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "confirmedAt",
-		type: "INTEGER"
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	}
-];
-var SCOPED_TOKENS_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "userId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "name",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "tokenHash",
-		type: "TEXT",
-		notNull: true,
-		unique: true
-	},
-	{
-		name: "tokenPrefix",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "scopes",
-		type: "JSON"
-	},
-	{
-		name: "expiresAt",
-		type: "INTEGER"
-	},
-	{
-		name: "lastUsedAt",
-		type: "INTEGER"
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
+var bootstrapAddonsSchema = z.object({
+	/**
+	* Addon implementing the `settings-store` capability. Loaded FIRST,
+	* before any other addon is enabled — every other addon's enable
+	* state, settings, and ordering lives in the store it provides.
+	*
+	* Default: '@camstack/addon-sqlite-storage' (the workspace's
+	* default SQLite-backed store). Future alternatives could swap this
+	* for postgres/redis without touching kernel code.
+	*/
+	settingsStoreAddon: z.string().default("@camstack/addon-sqlite-storage"),
+	/**
+	* How the launcher provisions REQUIRED_PACKAGES into `data/addons/`
+	* on startup.
+	*
+	*   - `'npm'`     — pull from the npm registry (production default).
+	*   - `'local'`   — copy `packages/<X>/` from the workspace into
+	*                   `data/addons/<X>/`. Use for the Electron-
+	*                   packaged bundle and the e2e harness.
+	*   - `'symlink'` — point `data/addons/<X>` at the workspace source
+	*                   dir via a directory symlink. Dev-only: a
+	*                   workspace rebuild (`npm run build -w <X>`) is
+	*                   immediately reflected at the next addon load,
+	*                   no copy step. Falls back to `'local'` on
+	*                   platforms that reject symlink creation (Windows
+	*                   without developer-mode).
+	*
+	* The `CAMSTACK_INSTALL_SOURCE` env var, when set, wins over this
+	* field. Leave undefined to keep the launcher's default behaviour
+	* (npm when no workspace, local when a bundled addons dir is
+	* present, …).
+	*/
+	installSource: z.enum([
+		"npm",
+		"local",
+		"symlink"
+	]).optional(),
+	/**
+	* Override the kernel's hard-coded `AddonInstaller.REQUIRED_PACKAGES`.
+	* Passing an array here REPLACES the default list entirely — useful
+	* for stripped-down deployments (only the bundle of addons the
+	* operator actually wants) and for forcing a different storage
+	* backend at first boot.
+	*
+	* Leave undefined to use the kernel-shipped defaults.
+	*/
+	requiredAddons: z.array(z.string()).optional(),
+	/**
+	* Disable list applied AFTER the settings-store reports the enabled
+	* set. Operator escape hatch — boot without a known-broken addon
+	* without having to mutate the store.
+	*/
+	forceDisable: z.array(z.string()).default([])
+});
+/**
+* Where the keychain's master key lives (D788). config.yaml ONLY: no env var
+* maps here, and the settings store may not answer it
+* (`BOOTSTRAP_OWNED_SECTIONS`). Absent → the desktop OS keychain when the hub
+* runs inside the desktop app, else `<dataDir>/.keychain/master.key`.
+*/
+var keychainSchema = z.object({
+	/** A file holding 32 random bytes, base64 (or hex). Keep it OFF the data volume. */
+	keyFile: z.string().min(1).optional(),
+	/**
+	* The key being rotated away from — consulted only to UNLOCK, so a move to a
+	* new key file is: new file, old one here, restart, rotate, remove this.
+	*/
+	previousKeyFile: z.string().min(1).optional()
+});
+/** Bootstrap config -- loaded from config.yaml ONLY at startup.
+*  All other settings live in SQL (system_settings table). */
+var bootstrapSchema = z.object({
+	/** Server mode: 'hub' (full server) or 'agent' (worker node) */
+	mode: z.enum(["hub", "agent"]).default("hub"),
+	server: serverSchema.default(serverSchema.parse({})),
+	auth: authSchema.default(authSchema.parse({})),
+	/** Hub connection config — only used when mode='agent' */
+	hub: hubSchema.default(hubSchema.parse({})),
+	/** Agent-specific config — only used when mode='agent' */
+	agent: agentSchema.default(agentSchema.parse({})),
+	/** TLS configuration */
+	tls: tlsSchema.default(tlsSchema.parse({})),
+	/**
+	* Addon bootstrap directives — minimum addon set needed before the
+	* kernel can reach the settings-store. See bootstrapAddonsSchema.
+	* Spec: docs/superpowers/specs/2026-05-15-yaml-bootstrap-expansion.md
+	*/
+	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({})),
+	/** Keychain master-key location (config.yaml only). */
+	keychain: keychainSchema.default({})
+});
+//#endregion
+//#region src/builtins/local-auth/admin-account-boot.ts
+/**
+* The admin account at boot: seed it once, reset it only on the operator's
+* explicit one-shot request, and say so when it still has the default password.
+*
+* ## Why a trigger FILE, not a variable
+*
+* The configured password (`CAMSTACK_ADMIN_PASS` / `auth.adminPassword`) seeds
+* the admin on first boot and is never applied again — a password the operator
+* changes in the admin UI survives every restart. Recovering a forgotten
+* password therefore needs an explicit request, and that request must be
+* ONE-SHOT: an environment flag stays set in a container template until someone
+* remembers to remove it, and while it is set it reverts the password on every
+* boot — the very defect this replaced. A file the hub DELETES after acting on
+* it cannot be left armed: create `RESET_ADMIN_PASSWORD` in the node's data
+* directory (`/data` in the container), restart, and the configured admin's
+* password is set back to the configured one, once.
+*/
+/** The trigger's name, at the root of the node's data directory. */
+var ADMIN_PASSWORD_RESET_TRIGGER = "RESET_ADMIN_PASSWORD";
+async function reconcileAdminAccountAtBoot(input) {
+	const { users, fs, logger } = input;
+	const triggerPath = path$1.join(input.dataDir, ADMIN_PASSWORD_RESET_TRIGGER);
+	const resetRequested = fs.exists(triggerPath);
+	const outcome = await users.ensureAdminExists({ resetPassword: resetRequested });
+	logOutcome(outcome, logger);
+	if (resetRequested) consumeTrigger(triggerPath, outcome, input);
+	const username = "username" in outcome ? outcome.username : null;
+	const usesDefaultPassword = username !== null && await users.hasPassword(username, "changeme");
+	if (usesDefaultPassword && username !== null) logger.warn("The admin account still uses the default password — change it in the admin UI (the first sign-in with it asks for a new one)", { meta: { username } });
+	return {
+		outcome,
+		usesDefaultPassword
+	};
+}
+function logOutcome(outcome, logger) {
+	switch (outcome.kind) {
+		case "seeded":
+			logger.info("Admin account seeded from the configured credentials (first boot)", { meta: { username: outcome.username } });
+			return;
+		case "reset":
+			logger.warn("Admin password reset to the configured password, as requested", { meta: { username: outcome.username } });
+			return;
+		case "other-admin-exists":
+			logger.info("Configured admin username not seeded: another admin account already exists", { meta: { username: outcome.username } });
+			return;
+		case "not-configured":
+			logger.warn("No admin username/password configured — no admin account seeded");
+			return;
+		case "exists": return;
 	}
-];
-var OAUTH_SESSIONS_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "userId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "username",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "integrationId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "scopes",
-		type: "JSON"
-	},
-	{
-		name: "createdAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "lastUsedAt",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "revokedAt",
-		type: "INTEGER"
+}
+/** Delete the trigger after acting on it — a reset must never repeat by itself. */
+function consumeTrigger(triggerPath, outcome, input) {
+	if (outcome.kind !== "reset") input.logger.warn("Admin password reset requested, but no configured admin account to reset", { meta: {
+		trigger: triggerPath,
+		outcome: outcome.kind
+	} });
+	try {
+		input.fs.remove(triggerPath);
+	} catch (err) {
+		input.logger.error("Could not delete the admin password reset trigger — delete it by hand, or every restart resets the admin password again", { meta: {
+			trigger: triggerPath,
+			error: err instanceof Error ? err.message : String(err)
+		} });
 	}
-];
+}
+//#endregion
+//#region src/builtins/local-auth/auth-config-reader.ts
 /**
-* Declare every auth collection with the typed schema. Called by
-* `LocalAuthAddon.onInitialize` before constructing the per-collection
-* managers. Idempotent — `declareCollection` is a no-op when the
-* collection has already been declared (same shape).
+* Every config path this reader can answer. Anything else resolves to
+* `undefined` by construction — see the module docblock.
 */
-async function declareAuthSchema(store) {
-	await store.declareCollection.mutate({
-		collection: USERS_COLLECTION,
-		columns: USERS_COLUMNS
-	});
-	await store.declareCollection.mutate({
-		collection: API_KEYS_COLLECTION,
-		columns: API_KEYS_COLUMNS,
-		indexes: [{
-			name: "idx_api_keys_token_prefix",
-			columns: ["tokenPrefix"]
-		}]
-	});
-	await store.declareCollection.mutate({
-		collection: SCOPED_TOKENS_COLLECTION,
-		columns: SCOPED_TOKENS_COLUMNS,
-		indexes: [{
-			name: "idx_scoped_tokens_user_id",
-			columns: ["userId"]
-		}]
-	});
-	await store.declareCollection.mutate({
-		collection: USER_TOTP_COLLECTION,
-		columns: USER_TOTP_COLUMNS
-	});
-	await store.declareCollection.mutate({
-		collection: OAUTH_SESSIONS_COLLECTION,
-		columns: OAUTH_SESSIONS_COLUMNS,
-		indexes: [{
-			name: "idx_oauth_sessions_user_id",
-			columns: ["userId"]
-		}]
-	});
+function createAuthConfigReader(resolved, writeAuthSection) {
+	return {
+		get(path) {
+			switch (path) {
+				case "auth.jwtSecret": return narrow(resolved.jwtSecret);
+				case "auth.adminUsername": return narrow(resolved.adminUsername);
+				case "auth.adminPassword": return narrow(resolved.adminPassword);
+				case "auth.tokenExpiry": return narrow(resolved.tokenExpiry);
+				default: return;
+			}
+		},
+		update(_section, data) {
+			if (typeof data["jwtSecret"] === "string") writeAuthSection({ jwtSecret: data["jwtSecret"] });
+		}
+	};
+}
+/**
+* The one documented type boundary in this module. `AuthConfigReader.get` is
+* the legacy `get<T>(path)` shape shared with `ConfigManager.get`, which is
+* likewise unchecked at runtime — every value returned here is a `string |
+* undefined` the caller immediately re-validates (`parseTokenExpiry`, the
+* truthiness gate on `jwtSecret`).
+*/
+function narrow(value) {
+	return value;
 }
 //#endregion
 //#region src/builtins/local-auth/oauth-grants.ts
@@ -9955,6 +10158,7 @@ var LocalAuthAddon = class extends BaseAddon {
 	oauthSessionManager = null;
 	reapTimer = null;
 	totpManager = null;
+	externalIdentities = null;
 	constructor() {
 		super({
 			jwtSecret: "",
@@ -9984,6 +10188,7 @@ var LocalAuthAddon = class extends BaseAddon {
 			this.scopedTokenManager = new ScopedTokenManager(store);
 			this.oauthSessionManager = new OauthSessionManager(store);
 			this.totpManager = new TotpManager(store);
+			this.externalIdentities = new ExternalIdentityManager(store);
 			try {
 				await reconcileAdminAccountAtBoot({
 					users: this.userManager,
@@ -10076,6 +10281,7 @@ var LocalAuthAddon = class extends BaseAddon {
 			deleteUser: async (input) => {
 				if (!this.userManager) throw new Error("User management not available");
 				await this.userManager.delete(input.id);
+				await this.externalIdentities?.removeAllForUser(input.id);
 				return { success: true };
 			},
 			resetPassword: async (input) => {
@@ -10169,6 +10375,28 @@ var LocalAuthAddon = class extends BaseAddon {
 					revokedAt: s.revokedAt
 				}));
 			},
+			listExternalIdentities: async (input) => {
+				if (!this.externalIdentities) return [];
+				return [...await this.externalIdentities.listForUser(input.userId)];
+			},
+			findUserByExternalIdentity: async (input) => {
+				if (!this.externalIdentities) return null;
+				const link = await this.externalIdentities.findLink(input.provider, input.subject);
+				return link === null ? null : {
+					userId: link.userId,
+					issuer: link.issuer
+				};
+			},
+			linkExternalIdentity: async (input) => {
+				if (!this.externalIdentities || !this.userManager) throw new Error("External sign-in linking not available");
+				if (!await this.userManager.findById(input.userId)) throw new Error(`User not found: ${input.userId}`);
+				await this.externalIdentities.link(input);
+				return { success: true };
+			},
+			unlinkExternalIdentity: async (input) => {
+				if (!this.externalIdentities) return { success: false };
+				return { success: await this.externalIdentities.unlink(input) };
+			},
 			revokeOauthSession: async (input) => {
 				if (!this.oauthSessionManager) return { success: false };
 				return { success: await this.oauthSessionManager.markRevoked(input.id) };
@@ -10242,6 +10470,7 @@ var LocalAuthAddon = class extends BaseAddon {
 		this.apiKeyManager = null;
 		this.scopedTokenManager = null;
 		this.oauthSessionManager = null;
+		this.externalIdentities = null;
 	}
 };
 //#endregion