@camstack/system 1.2.377 → 1.2.379

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-DlDSoqm1.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-CZeRUgYF.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { Ft as installManifestNativeDeps, H as createUdsLoggerWithControl, It as resolveAddonClass, St as validateProviderRegistrations, U as LocalChildClient, _n as startRunnerHeapWatch, _t as getWorkerNativeCapProvider, bt as setWorkerNativeCapsChangeListener, f as installManifestSystemDeps, g as createUdsAddonContext, i as killOwnRunnerGroupAfterParentLoss, in as RUNNER_RSS_BUDGET_ENV, kn as emitHeapDiagnosticReport, n as createChildCapDispatch, p as installManifestPythonDeps, u as startRunnerParentDeathWatchdog, vt as getWorkerNativeCapSnapshot } from "./child-cap-dispatch-CgmOo0yl.mjs";
+import { Ft as installManifestNativeDeps, H as createUdsLoggerWithControl, It as resolveAddonClass, St as validateProviderRegistrations, U as LocalChildClient, _n as startRunnerHeapWatch, _t as getWorkerNativeCapProvider, bt as setWorkerNativeCapsChangeListener, f as installManifestSystemDeps, g as createUdsAddonContext, i as killOwnRunnerGroupAfterParentLoss, in as RUNNER_RSS_BUDGET_ENV, kn as emitHeapDiagnosticReport, n as createChildCapDispatch, p as installManifestPythonDeps, u as startRunnerParentDeathWatchdog, vt as getWorkerNativeCapSnapshot } from "./child-cap-dispatch-CpjohToR.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { register } from "node:module";
 import * as path$1 from "node:path";

package/dist/addon-utils.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-Cek0wNdY.js");
-const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-DuOn8H1n.js");
+const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-mk6WGxir.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
 const require_snapshot_courtesy = require("./snapshot-courtesy-D_C5-nC0.js");
 exports.COURTESY_DEFAULT_WIDTH = require_snapshot_courtesy.COURTESY_DEFAULT_WIDTH;

package/dist/addon-utils.mjs

@@ -1,4 +1,4 @@
-import { C as resolveFormatRevision, S as isModelDownloaded, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, f as ModelDownloadHttpError, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, t as STALL_REPORT_MS, v as ensureModel, x as isModelDownloadHttpError } from "./event-loop-stall-monitor-ClPhfx7Y.mjs";
+import { C as resolveFormatRevision, S as isModelDownloaded, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, f as ModelDownloadHttpError, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, t as STALL_REPORT_MS, v as ensureModel, x as isModelDownloadHttpError } from "./event-loop-stall-monitor-anUH2IE1.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg, t as COURTESY_DEFAULT_WIDTH } from "./snapshot-courtesy-CyFs1M3I.mjs";
 export { COURTESY_DEFAULT_WIDTH, CustomActionRegistry, ModelDownloadHttpError, ModelDownloadService, STALL_REPORT_MS, STALL_TICK_MS, adoptModelRevisions, attributeStall, collectModelFiles, contentTypeFor, courtesyCacheKey, createFileDataPlaneHandler, deleteModelFromDisk, downloadFile, ensureModel, getModelFilePath, isModelDownloadHttpError, isModelDownloaded, parseRangeHeader, renderCourtesyJpeg, renderCourtesyOverlayJpeg, resolveFormatRevision, startEventLoopStallMonitor };

package/dist/auth/auth-manager.d.ts

@@ -1,5 +1,6 @@
 import { IScopedLogger, TokenPayload, SsoBridgeClaimsSchema } from '@camstack/types';
 import { z } from 'zod';
+import { JwtSigningKeySource } from './jwt-signing-key.js';
 export type { TokenPayload };
 export type AuthConfigReader = {
     /**
@@ -13,7 +14,7 @@ export type AuthConfigReader = {
 };
 export declare class AuthManager {
     private readonly config;
-    private readonly jwtSecret;
+    private readonly signingKey;
     private readonly logger;
     /**
      * Offending `auth.tokenExpiry` values already reported by this instance.
@@ -25,7 +26,14 @@ export declare class AuthManager {
      * rest resolve silently to the same default until the value changes.
      */
     private readonly reportedInvalidExpiries;
-    constructor(config: AuthConfigReader, logger?: IScopedLogger);
+    /**
+     * @param signingKey where the session signing key comes from — the process
+     *   slot `local-auth` fills from the keychain (D797). Never config, never
+     *   env; read on every mint and verify, and it THROWS while unavailable.
+     */
+    constructor(config: AuthConfigReader, logger?: IScopedLogger, signingKey?: JwtSigningKeySource);
+    /** The current signing key; throws `JwtSigningKeyUnavailableError` while there is none. */
+    private get jwtSecret();
     signToken(payload: Omit<TokenPayload, 'iat' | 'exp'>): string;
     /**
      * The operator's `auth.tokenExpiry`, or `undefined` → DEFAULT_TOKEN_EXPIRY.

package/dist/auth/jwt-signing-key.d.ts

@@ -0,0 +1,42 @@
+import { SecretsAccess } from '@camstack/types';
+/** The keychain owner of every system-held secret. */
+export declare const SYSTEM_SECRET_OWNER = "system";
+/** `secret://system/global/jwtSigningKey`. */
+export declare const JWT_SIGNING_KEY_REF: string;
+export type JwtSigningKeyState = {
+    readonly state: 'ready';
+    readonly key: string;
+} | {
+    readonly state: 'unavailable';
+    readonly reason: string;
+};
+/** Sessions cannot be minted or verified: the signing key is not loaded. */
+export declare class JwtSigningKeyUnavailableError extends Error {
+    readonly reason: string;
+    constructor(reason: string);
+}
+/** Where an `AuthManager` gets its key. `current()` throws while there is none. */
+export interface JwtSigningKeySource {
+    current(): string;
+}
+/** Register the loaded (or unloadable) key. Called by the hub's `local-auth`. */
+export declare function setProcessJwtSigningKey(state: JwtSigningKeyState): void;
+/** Forget the key (tests, shutdown). */
+export declare function clearProcessJwtSigningKey(): void;
+export declare function getProcessJwtSigningKeyState(): JwtSigningKeyState;
+/** The process slot — the default source of every `AuthManager`. */
+export declare const processJwtSigningKey: JwtSigningKeySource;
+/** A fixed key — tests, and nothing else. */
+export declare function staticJwtSigningKey(key: string): JwtSigningKeySource;
+/** 32 random bytes, hex. */
+export declare function generateJwtSigningKey(): string;
+export interface LoadJwtSigningKeyDeps {
+    /** A keychain handle acting for owner `system`. */
+    readonly secrets: SecretsAccess;
+    readonly generate?: () => string;
+}
+/**
+ * Read the key from the keychain; generate and store one ONLY when the
+ * keychain answers that none exists. Never throws.
+ */
+export declare function loadJwtSigningKey(deps: LoadJwtSigningKeyDeps): Promise<JwtSigningKeyState>;

package/dist/auth/user-manager.d.ts

@@ -10,14 +10,20 @@ interface CreateUserInput {
     scopes?: TokenScope[];
 }
 type UpdatableUserFields = Partial<Pick<UserRecord, 'isAdmin' | 'allowedProviders' | 'allowedDevices' | 'scopes'>>;
+/**
+ * The account a fresh hub seeds on its first boot (D797). Not configurable —
+ * no env variable, no config.yaml key: the first sign-in with this password
+ * forces a change (admin-ui `mustChangePassword`), and an existing user is
+ * never overwritten (D728).
+ */
+export declare const FIRST_BOOT_ADMIN_USERNAME = "admin";
+export declare const FIRST_BOOT_ADMIN_PASSWORD = "changeme";
 export interface EnsureAdminOptions {
     /** The operator's explicit, one-shot recovery request. Never a default. */
     readonly resetPassword?: boolean;
 }
 /** What `ensureAdminExists` did — every branch is named so the caller can log it. */
 export type AdminSeedOutcome = {
-    readonly kind: 'not-configured';
-} | {
     readonly kind: 'seeded';
     readonly username: string;
 } | {
@@ -33,15 +39,10 @@ export type AdminSeedOutcome = {
 export interface UserStorageAccess {
     getStore(): SettingsStoreClient;
 }
-export interface UserConfigReader {
-    /** See `AuthConfigReader.get` — a reader answers only the paths it resolved. */
-    get<T>(path: string): T | undefined;
-}
 export declare class UserManager {
     private readonly storageAccess;
     private readonly auth;
-    private readonly config;
-    constructor(storageAccess: UserStorageAccess, auth: AuthManager, config: UserConfigReader);
+    constructor(storageAccess: UserStorageAccess, auth: AuthManager);
     private get store();
     create(input: CreateUserInput): Promise<UserRecord>;
     findByUsername(username: string): Promise<UserRecord | null>;
@@ -52,20 +53,19 @@ export declare class UserManager {
     delete(id: string): Promise<void>;
     resetPassword(id: string, newPassword: string): Promise<void>;
     /**
-     * Seed the configured admin (`auth.adminUsername` / `auth.adminPassword`,
-     * i.e. `CAMSTACK_ADMIN_USER` / `CAMSTACK_ADMIN_PASS`) — on FIRST boot only.
+     * Seed {@link FIRST_BOOT_ADMIN_USERNAME} / {@link FIRST_BOOT_ADMIN_PASSWORD}
+     * — on FIRST boot only, i.e. when no admin account exists.
      *
-     * The configured password is a seed, never an authority. Once any admin
-     * exists, this never writes a password: the operator's own change in the
-     * admin UI is the truth from then on. This method used to compare the stored
-     * hash with the configured password on every boot and rewrite it when they
-     * differed, so a password changed in the UI went back to the configured one
-     * (`changeme` on a Mac hub and on any container without `CAMSTACK_ADMIN_PASS`)
-     * at the next restart.
+     * The seed is never an authority. Once any admin exists, this never writes a
+     * password: the operator's own change in the admin UI is the truth from then
+     * on (D728). This method once compared the stored hash with a configured
+     * password on every boot and rewrote it when they differed, so a password
+     * changed in the UI went back at the next restart.
      *
      * `resetPassword: true` is the one explicit exception — the operator's
-     * one-shot recovery request (see `admin-password-reset.ts`): the configured
-     * admin's password is set back to the configured one.
+     * one-shot recovery request (`RESET_ADMIN_PASSWORD`, see
+     * `admin-account-boot.ts`): the `admin` user's password goes back to
+     * `changeme`, and the next sign-in forces a change again.
      */
     ensureAdminExists(options?: EnsureAdminOptions): Promise<AdminSeedOutcome>;
     /**

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gr as EventCategory, W as addonPagesCapability, cr as errMsg, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
+import { W as addonPagesCapability, cr as errMsg, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gr as EventCategory, K as addonWidgetsCapability, cr as errMsg, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
+import { K as addonWidgetsCapability, cr as errMsg, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Gr as EventCategory, Sr as createEvent, cr as errMsg, lr as BaseAddon, n as AlertSchema, q as alertsCapability } from "../../dist-BWNoS-1S.mjs";
+import { Cr as createEvent, cr as errMsg, lr as BaseAddon, n as AlertSchema, q as alertsCapability, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
 //#region src/builtins/alerts/device-label.ts
 /**
 * Operator-facing device label for alert messages.

package/dist/builtins/autotrack/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/autotrack/index.mjs

@@ -1,4 +1,4 @@
-import { Gr as EventCategory, S as FIRST_LEVEL_MACRO_CLASSES, X as bareAddonId, cr as errMsg, gn as ptzAutotrackCapability, kr as isEvent, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
+import { Ar as isEvent, S as FIRST_LEVEL_MACRO_CLASSES, X as bareAddonId, cr as errMsg, gn as ptzAutotrackCapability, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
 //#region src/builtins/autotrack/autotrack-config.ts
 var DEFAULT_AUTOTRACK_LOOP_CONFIG = {
 	deadZoneFraction: .5,

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gr as EventCategory, In as storageOccupancyCapability, Ur as toNodeId, Y as backupCapability, g as DATABASE_SNAPSHOT_SUFFIX, jr as nodePin, lr as BaseAddon, nn as mayWriteToLocation } from "../../dist-BWNoS-1S.mjs";
+import { Gr as toNodeId, In as storageOccupancyCapability, Mr as nodePin, Y as backupCapability, g as DATABASE_SNAPSHOT_SUFFIX, lr as BaseAddon, nn as mayWriteToLocation, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/calendars/calendars.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let zod = require("zod");
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/calendars/calendars.addon.mjs

@@ -1,4 +1,4 @@
-import { et as calendarsCapability, lr as BaseAddon, p as CalendarPreferencesSchema } from "../../dist-BWNoS-1S.mjs";
+import { et as calendarsCapability, lr as BaseAddon, p as CalendarPreferencesSchema } from "../../dist-B9oFw2jh.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { z } from "zod";
 //#region src/builtins/calendars/calendar-color.ts

package/dist/builtins/camera-grid/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 let zod = require("zod");
 let _camstack_types_node = require("@camstack/types/node");
 let node_path = require("node:path");

package/dist/builtins/camera-grid/index.mjs

@@ -1,4 +1,4 @@
-import { Dr as hydrateSchema, Gr as EventCategory, Jn as buildFfmpegArgs, M as MOTION_CLOSE_AFTER_MS, Nn as snapshotCapability, Rn as streamCatalogCapability, Sr as createEvent, ar as DeviceFeature, b as DeclaredDevices, cr as errMsg, i as BaseDevice, lr as BaseAddon, mt as declarationOwnerNodeId, on as motionCapability, rn as memoizePinnedFfmpeg, sr as DeviceType, tt as cameraGridLayoutCapability, y as DERIVED_CAMERA_SILENCED_CAP_NAMES } from "../../dist-BWNoS-1S.mjs";
+import { Cr as createEvent, Jn as buildFfmpegArgs, M as MOTION_CLOSE_AFTER_MS, Nn as snapshotCapability, Or as hydrateSchema, Rn as streamCatalogCapability, ar as DeviceFeature, b as DeclaredDevices, cr as errMsg, i as BaseDevice, lr as BaseAddon, mt as declarationOwnerNodeId, on as motionCapability, qr as EventCategory, rn as memoizePinnedFfmpeg, sr as DeviceType, tt as cameraGridLayoutCapability, y as DERIVED_CAMERA_SILENCED_CAP_NAMES } from "../../dist-B9oFw2jh.mjs";
 import { z } from "zod";
 import { FfmpegProcess } from "@camstack/types/node";
 import { join } from "node:path";

package/dist/builtins/composer/composer.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
-const require_composition_sources = require("../../composition-sources-BNyXPSs_.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_composition_sources = require("../../composition-sources-CHvLMrFI.js");
 let zod = require("zod");
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { $n as compositionItemFieldPath, Et as evaluateCompositionField, Gr as EventCategory, Q as buildCapabilityLookup, Qn as compositionFeatureEnabled, Sr as createEvent, Xn as composedDeviceRef, Yn as cloneStatefulExpressionMemory, Zn as composedDeviceStableId, b as DeclaredDevices, cr as errMsg, er as compositionSliceKey, i as BaseDevice, ir as toExpressionValue, it as compositionFieldKey, kt as expressionContainsBuiltinCall, l as COMPOSED_ITEM_FIXED_FIELDS, lr as BaseAddon, nr as createStatefulExpressionMemory, pn as planComposition, qn as COMPOSER_ADDON_ID, rr as disarmRoseMemory, rt as composerCapability, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey } from "../../dist-BWNoS-1S.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-D39bl0nP.mjs";
+import { $n as compositionItemFieldPath, Cr as createEvent, Et as evaluateCompositionField, Q as buildCapabilityLookup, Qn as compositionFeatureEnabled, Xn as composedDeviceRef, Yn as cloneStatefulExpressionMemory, Zn as composedDeviceStableId, b as DeclaredDevices, cr as errMsg, er as compositionSliceKey, i as BaseDevice, ir as toExpressionValue, it as compositionFieldKey, kt as expressionContainsBuiltinCall, l as COMPOSED_ITEM_FIXED_FIELDS, lr as BaseAddon, nr as createStatefulExpressionMemory, pn as planComposition, qn as COMPOSER_ADDON_ID, qr as EventCategory, rr as disarmRoseMemory, rt as composerCapability, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey } from "../../dist-B9oFw2jh.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-DT_uJwI3.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
-const require_composition_sources = require("../../composition-sources-BNyXPSs_.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_composition_sources = require("../../composition-sources-CHvLMrFI.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
-import { Dr as hydrateSchema, Q as buildCapabilityLookup, Sn as resolveCoreBlockFiles, Vn as validateComposition, Xn as composedDeviceRef, at as compositionSourceRefs, b as DeclaredDevices, cr as errMsg, ct as coreBlockIdFromAddonId, d as CORE_BLOCKS_ADDON_ID, f as CORE_BLOCK_ADDON_PREFIX, lr as BaseAddon, lt as coreBlockSourceKind, m as CoreBlockSchema, ot as coreBlockAddonId, pn as planComposition, sn as normalizeCoreBlockWrite, st as coreBlockComposition, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey, u as COMPOSER_RUNNER_ID, ut as coreBlocksCapability, vn as replacedFieldKeys, vt as describeComposableCaps, xn as resolveCoreBlockEntry } from "../../dist-BWNoS-1S.mjs";
-import { t as describeCompositionSources } from "../../composition-sources-D39bl0nP.mjs";
+import { Or as hydrateSchema, Q as buildCapabilityLookup, Sn as resolveCoreBlockFiles, Vn as validateComposition, Xn as composedDeviceRef, at as compositionSourceRefs, b as DeclaredDevices, cr as errMsg, ct as coreBlockIdFromAddonId, d as CORE_BLOCKS_ADDON_ID, f as CORE_BLOCK_ADDON_PREFIX, lr as BaseAddon, lt as coreBlockSourceKind, m as CoreBlockSchema, ot as coreBlockAddonId, pn as planComposition, sn as normalizeCoreBlockWrite, st as coreBlockComposition, t as ALL_CAPABILITY_DEFINITIONS, tr as compositionSourceKey, u as COMPOSER_RUNNER_ID, ut as coreBlocksCapability, vn as replacedFieldKeys, vt as describeComposableCaps, xn as resolveCoreBlockEntry } from "../../dist-B9oFw2jh.mjs";
+import { t as describeCompositionSources } from "../../composition-sources-DT_uJwI3.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { customizationBlockName } from "@camstack/types/node";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-CDyOGAje.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-YOOKLA3v.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { $ as buildStreamParamsConfigSchema, A as MINUTES_PER_DAY, C as FieldClaimModeSchema, Dn as runtimeStatePolicyFor, Gr as EventCategory, Hr as sleep$1, Kt as legacyAutoLinkIds, L as STREAM_PROFILE_META, Mn as siteZoneKey, Nt as formatMinutes, O as LocationIconIdSchema, Or as isDeviceConfigCap, Ot as expandContainer, Rr as resolveSecretMarkers, St as deviceStatusCapability, Tt as enumerateSchemaFields, Vr as secretTreeFromPaths, Wr as transformSecretWrite, Xt as locationIconKey, ar as DeviceFeature, bt as deviceManagerCapability, c as CAP_NAMES_WITH_STATUS, cn as normalizeUnit, cr as errMsg, dn as parseStreamParamsFormPatch, dt as createDeviceExtensionProvider, gr as WELL_KNOWN_TAB_MAP, gt as defineExtensionSlotProvider, lr as BaseAddon, o as CAMERA_SWITCH_ORDER, or as DeviceRole, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, v as DAY_NAMES, w as FieldClaimSchema, wt as enumerateItemArrayFields, x as DeviceStatusSchema, xr as collectZodSecretPaths, xt as deviceStateCapability, yt as deviceExtensionCapability } from "../../dist-BWNoS-1S.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-iGcmzwLV.mjs";
+import { $ as buildStreamParamsConfigSchema, A as MINUTES_PER_DAY, C as FieldClaimModeSchema, Dn as runtimeStatePolicyFor, Hr as secretTreeFromPaths, Kr as transformSecretWrite, Kt as legacyAutoLinkIds, L as STREAM_PROFILE_META, Mn as siteZoneKey, Nt as formatMinutes, O as LocationIconIdSchema, Ot as expandContainer, Sr as collectZodSecretPaths, St as deviceStatusCapability, Tt as enumerateSchemaFields, Wr as sleep$1, Xt as locationIconKey, ar as DeviceFeature, bt as deviceManagerCapability, c as CAP_NAMES_WITH_STATUS, cn as normalizeUnit, cr as errMsg, dn as parseStreamParamsFormPatch, dt as createDeviceExtensionProvider, gr as WELL_KNOWN_TAB_MAP, gt as defineExtensionSlotProvider, kr as isDeviceConfigCap, lr as BaseAddon, o as CAMERA_SWITCH_ORDER, or as DeviceRole, qr as EventCategory, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, v as DAY_NAMES, w as FieldClaimSchema, wt as enumerateItemArrayFields, x as DeviceStatusSchema, xt as deviceStateCapability, yt as deviceExtensionCapability, zr as resolveSecretMarkers } from "../../dist-B9oFw2jh.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-DlZ3VV6x.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,7 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_jwt_signing_key = require("../../jwt-signing-key-C2rE3wH6.js");
+const require_cluster_secret = require("../../cluster-secret-Dg0OOOSr.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");
@@ -203,6 +205,13 @@ function buildKeySourceCandidates(opts) {
 */
 async function writeDefaultKeyFile(dataDir, key, opts) {
 	const file = defaultKeyFilePath(dataDir);
+	try {
+		return await writeKeyFileAt(file, key, opts);
+	} catch (err) {
+		throw new Error(`could not write the master key at ${file}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+	}
+}
+async function writeKeyFileAt(file, key, opts) {
 	const dir = node_path.dirname(file);
 	await node_fs.promises.mkdir(dir, {
 		recursive: true,
@@ -223,6 +232,8 @@ async function writeDefaultKeyFile(dataDir, key, opts) {
 	await node_fs.promises.writeFile(tmp, `${encodeKeyMaterial(key)}\n`, { mode: 384 });
 	await node_fs.promises.rename(tmp, file);
 	await node_fs.promises.chmod(file, 384);
+	const back = await loadKeyFile(file);
+	if (back.kind !== "loaded" || !back.key.equals(key)) throw new Error("the written key file does not read back as the generated key");
 	return movedAside;
 }
 //#endregion
@@ -626,6 +637,14 @@ var KeychainRepository = class {
 		return rows.length;
 	}
 };
+//#endregion
+//#region src/builtins/keychain/system-held-secrets.ts
+/** The refs `keychain-admin.setSystemSecret` may write, by name. */
+var SYSTEM_HELD_SECRET_REFS = { "jwt-signing-key": require_jwt_signing_key.JWT_SIGNING_KEY_REF };
+/** System refs no blob points at — in use for as long as they exist. */
+var PROCESS_HELD_SECRET_REFS = new Set([require_jwt_signing_key.JWT_SIGNING_KEY_REF]);
+/** `system-settings` keys that may hold a system-owned secret's marker. */
+var SYSTEM_SECRET_SETTINGS_KEYS = [require_cluster_secret.CLUSTER_SECRET_SETTINGS_KEY];
 var KeychainLockedError = class extends Error {
 	reason;
 	constructor(reason) {
@@ -670,10 +689,14 @@ var KeychainService = class {
 		this.unlock = await this.computeUnlock();
 		if (this.unlock.state === "ready") this.deps.logger.info("keychain unlocked", {
 			source: this.unlock.source.kind,
+			path: this.unlock.source.path,
 			fingerprint: shortFingerprint(this.unlock.fingerprint),
 			rotationPending: this.unlock.rotationPending
 		});
-		else this.deps.logger.error("keychain LOCKED — every secret resolves unavailable", { reason: this.unlock.reason });
+		else this.deps.logger.error("keychain LOCKED — every secret resolves unavailable", {
+			reason: this.unlock.reason,
+			path: this.configuredSource?.path
+		});
 		try {
 			await this.deps.repo.pruneAudit(this.now());
 		} catch (err) {
@@ -765,10 +788,19 @@ var KeychainService = class {
 		};
 		else if (primary.source.kind === "default-file") {
 			kek = generateKey();
-			await writeDefaultKeyFile(this.deps.dataDir, kek, {
-				replace: false,
-				nowMs: this.now()
-			});
+			try {
+				await writeDefaultKeyFile(this.deps.dataDir, kek, {
+					replace: false,
+					nowMs: this.now()
+				});
+			} catch (err) {
+				this.deps.logger.error("keychain master key could NOT be generated — no key stored", {
+					path: primary.source.path,
+					error: errMsg(err)
+				});
+				throw err;
+			}
+			this.deps.logger.info("keychain master key generated", { path: primary.source.path });
 		} else return {
 			state: "locked",
 			reason: "key-missing"
@@ -823,7 +855,11 @@ var KeychainService = class {
 		if (parts === null || !this.owns(caller, parts.owner)) throw new KeychainForbiddenError(ref, caller);
 		return parts.owner;
 	}
-	async put(caller, ref, value) {
+	/**
+	* @param actor who the audit names — the owner addon by default; the
+	*   operator (`user:<id>`) for {@link setSystemSecret}.
+	*/
+	async put(caller, ref, value, actor = actorOfAddon(caller)) {
 		const owner = this.ownerOf(ref, caller);
 		const unlocked = this.requireReady();
 		if (value.length === 0) throw new Error("keychain.put: an empty value is not stored — delete the ref");
@@ -849,10 +885,10 @@ var KeychainService = class {
 			version,
 			createdAt: existing?.createdAt ?? t,
 			updatedAt: t,
-			updatedBy: actorOfAddon(caller),
+			updatedBy: actor,
 			lastReadAt: existing?.lastReadAt ?? null
 		});
-		await this.audit("put", actorOfAddon(caller), ref, `version=${version}`);
+		await this.audit("put", actor, ref, `version=${version}`);
 		this.deps.events.emit({
 			ref,
 			owner,
@@ -982,6 +1018,14 @@ var KeychainService = class {
 			usage: usage.get(row.ref) ?? "unknown"
 		}));
 	}
+	/**
+	* The operator replaces a system-held secret no form edits (D797) — the
+	* session signing key. Stored under owner `system`, audited as the user.
+	*/
+	async setSystemSecret(userId, name, value) {
+		const ref = SYSTEM_HELD_SECRET_REFS[name];
+		return this.put(require_jwt_signing_key.SYSTEM_SECRET_OWNER, ref, value, `user:${userId}`);
+	}
 	async listAudit(limit) {
 		return this.deps.repo.listAudit(limit);
 	}
@@ -1221,6 +1265,13 @@ async function prefixRows(door, collection, prefix) {
 }
 /** The blobs that may hold the marker of a ref in `scope`; `null` = cannot tell. */
 async function blobsFor(door, owner, scope) {
+	if (owner === "system" && scope.kind === "global") return [[...PROCESS_HELD_SECRET_REFS].map((ref) => ({
+		$secret: ref,
+		v: 1
+	})), ...await Promise.all(SYSTEM_SECRET_SETTINGS_KEYS.map((key) => door.get({
+		collection: "system-settings",
+		key
+	})))];
 	switch (scope.kind) {
 		case "global":
 		case "node": {
@@ -1309,8 +1360,12 @@ function createKeychainUsageCheck(door) {
 *    orphans, rotation, recovery key, reset. Every method admin; the four
 *    that change or hand out material take the session's user for the audit.
 *
-* It does not run on agents: the manifest places it `hub-only`, and an agent
-* addon reaches it through `$hub-cap-fwd` like every other hub cap.
+* It does not run on agents: an agent's Phase 1 drops `keychain` from its infra
+* list (`server/backend/src/agent/agent-infra-capabilities.ts`), and an agent
+* addon reaches it through `$hub-cap-fwd` like every other hub cap. Until
+* 2026-10-08 agents DID boot it — their store door forwards to the hub, so an
+* agent wrote the hub's `keychain:keys` row with a key file on its own disk.
+* Booting first, it left the hub locked `key-missing`.
 */
 var DAY_MS = 1440 * 6e4;
 /** The caller the transport stamped (or an in-process caller stated). */
@@ -1398,6 +1453,7 @@ var KeychainAddon = class extends require_dist.BaseAddon {
 				listSecrets: () => service.listSecrets(),
 				listAudit: (input) => service.listAudit(input.limit ?? 100),
 				reveal: (input) => service.reveal(input.caller.userId, input.ref),
+				setSystemSecret: (input) => service.setSystemSecret(input.caller.userId, input.name, input.value),
 				deleteOrphans: (input) => service.deleteOrphans(input.caller.userId, input.refs),
 				rotateMasterKey: (input) => service.rotateMasterKey(input.caller.userId),
 				purgeRetiredKeys: async (input) => ({ purged: await service.purgeRetiredKeys(input.caller.userId) }),