@camstack/system 1.2.377 → 1.2.379

package/dist/jwt-signing-key-Qhde8r82.mjs

@@ -0,0 +1,127 @@
+import { br as buildSecretRef } from "./dist-B9oFw2jh.mjs";
+import { randomBytes } from "node:crypto";
+//#region src/auth/jwt-signing-key.ts
+/**
+* The hub's session signing key — the HMAC key every JWT this hub mints
+* (sessions, SSO bridge, TOTP challenges, service tokens) is signed with.
+*
+* It lives in the keychain, owner `system` ({@link JWT_SIGNING_KEY_REF}), and
+* nowhere else: no environment variable, no `config.yaml` key (D797). The
+* hub's `local-auth` builtin loads it after the keychain booted and registers
+* it here; every `AuthManager` in the process asks this slot on every mint and
+* every verify, so a key that arrives (or changes) after construction is used
+* from the next call on.
+*
+* ## A locked keychain fails closed, visibly
+*
+* While the key cannot be read, sessions can be neither minted nor verified:
+* {@link JwtSigningKeySource.current} throws {@link JwtSigningKeyUnavailableError}
+* (a login answers that error, a bearer check reads it as "not authenticated").
+* There is deliberately NO fallback — not an env var, and not a fresh random
+* key, which would invalidate every session and every app token without
+* anyone having asked for it. A key is generated ONLY when the keychain
+* answers that none is stored (`missing`), i.e. on a fresh hub.
+*
+* Process-global through a registered symbol, like the desktop platform key,
+* so a second copy of this module (an addon bundle) sees the same key.
+*/
+/** The keychain owner of every system-held secret. */
+var SYSTEM_SECRET_OWNER = "system";
+/** `secret://system/global/jwtSigningKey`. */
+var JWT_SIGNING_KEY_REF = buildSecretRef({
+	owner: SYSTEM_SECRET_OWNER,
+	scope: { kind: "global" },
+	fieldPath: "jwtSigningKey"
+});
+/** Sessions cannot be minted or verified: the signing key is not loaded. */
+var JwtSigningKeyUnavailableError = class extends Error {
+	reason;
+	constructor(reason) {
+		super(`sessions are unavailable: the session signing key could not be read from the keychain (${reason}). Unlock the keychain (System → Secrets, or fix keychain.keyFile and restart).`);
+		this.reason = reason;
+		this.name = "JwtSigningKeyUnavailableError";
+	}
+};
+var SLOT = Symbol.for("camstack.auth.jwt-signing-key");
+var NOT_LOADED = {
+	state: "unavailable",
+	reason: "not-loaded"
+};
+function isState(value) {
+	if (value === null || typeof value !== "object") return false;
+	const state = Reflect.get(value, "state");
+	if (state === "ready") return typeof Reflect.get(value, "key") === "string";
+	return state === "unavailable" && typeof Reflect.get(value, "reason") === "string";
+}
+/** Register the loaded (or unloadable) key. Called by the hub's `local-auth`. */
+function setProcessJwtSigningKey(state) {
+	Reflect.set(globalThis, SLOT, state);
+}
+function getProcessJwtSigningKeyState() {
+	const value = Reflect.get(globalThis, SLOT);
+	return isState(value) ? value : NOT_LOADED;
+}
+/** The process slot — the default source of every `AuthManager`. */
+var processJwtSigningKey = { current() {
+	const state = getProcessJwtSigningKeyState();
+	if (state.state === "ready") return state.key;
+	throw new JwtSigningKeyUnavailableError(state.reason);
+} };
+/** A fixed key — tests, and nothing else. */
+function staticJwtSigningKey(key) {
+	return { current: () => key };
+}
+/** 32 random bytes, hex. */
+function generateJwtSigningKey() {
+	return randomBytes(32).toString("hex");
+}
+/**
+* Read the key from the keychain; generate and store one ONLY when the
+* keychain answers that none exists. Never throws.
+*/
+async function loadJwtSigningKey(deps) {
+	let entry;
+	try {
+		entry = (await deps.secrets.resolve([JWT_SIGNING_KEY_REF]))[JWT_SIGNING_KEY_REF];
+	} catch (err) {
+		return {
+			state: "unavailable",
+			reason: err instanceof Error ? err.message : String(err)
+		};
+	}
+	if (entry === void 0) return {
+		state: "unavailable",
+		reason: "no-answer"
+	};
+	switch (entry.kind) {
+		case "value": return {
+			state: "ready",
+			key: entry.value
+		};
+		case "unavailable": return {
+			state: "unavailable",
+			reason: entry.reason
+		};
+		case "forbidden": return {
+			state: "unavailable",
+			reason: "forbidden"
+		};
+		case "missing": {
+			const key = (deps.generate ?? generateJwtSigningKey)();
+			try {
+				await deps.secrets.put(JWT_SIGNING_KEY_REF, key);
+			} catch (err) {
+				return {
+					state: "unavailable",
+					reason: `could not store a new key: ${err instanceof Error ? err.message : String(err)}`
+				};
+			}
+			return {
+				state: "ready",
+				key
+			};
+		}
+	}
+}
+//#endregion
+export { loadJwtSigningKey as a, staticJwtSigningKey as c, getProcessJwtSigningKeyState as i, JwtSigningKeyUnavailableError as n, processJwtSigningKey as o, SYSTEM_SECRET_OWNER as r, setProcessJwtSigningKey as s, JWT_SIGNING_KEY_REF as t };

package/dist/kernel/config-manager.d.ts

@@ -82,7 +82,7 @@ export declare class ConfigManager {
      * implementation (sqlite, redis, in-memory, …) behaves identically here.
      *
      * D675: a bootstrap-owned section takes ONLY allow-listed keys from the
-     * store (a stored `auth.jwtSecret` never replaces env), and with only the
+     * store (a stale stored `auth.jwtSecret` never answers), and with only the
      * door wired this sync read THROWS — the settings view's `getSection` reads
      * the door.
      */

package/dist/kernel/config-schema.d.ts

@@ -1,11 +1,8 @@
 import { z } from 'zod';
 /** Default data directory — used when CAMSTACK_DATA env var is not set */
 export declare const DEFAULT_DATA_PATH = "camstack-data";
-/**
- * The admin password seeded on first boot when none is configured. A SEED
- * only: it never overwrites an existing account's password (`ensureAdminExists`).
- */
-export declare const DEFAULT_ADMIN_PASSWORD = "changeme";
+/** `auth.*` keys a pre-D797 config.yaml may still carry; ignored, and warned about. */
+export declare const RETIRED_AUTH_CONFIG_KEYS: readonly ["jwtSecret", "adminUsername", "adminPassword"];
 /** Bootstrap config -- loaded from config.yaml ONLY at startup.
  *  All other settings live in SQL (system_settings table). */
 export declare const bootstrapSchema: z.ZodObject<{
@@ -19,11 +16,7 @@ export declare const bootstrapSchema: z.ZodObject<{
         dataPath: z.ZodDefault<z.ZodString>;
         corsOrigins: z.ZodDefault<z.ZodPreprocess<z.ZodArray<z.ZodString>>>;
     }, z.core.$strip>>;
-    auth: z.ZodDefault<z.ZodObject<{
-        jwtSecret: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        adminUsername: z.ZodDefault<z.ZodString>;
-        adminPassword: z.ZodDefault<z.ZodString>;
-    }, z.core.$strip>>;
+    auth: z.ZodDefault<z.ZodObject<{}, z.core.$strip>>;
     hub: z.ZodDefault<z.ZodObject<{
         url: z.ZodDefault<z.ZodString>;
         token: z.ZodDefault<z.ZodString>;
@@ -38,8 +31,8 @@ export declare const bootstrapSchema: z.ZodObject<{
     bootstrap: z.ZodDefault<z.ZodObject<{
         settingsStoreAddon: z.ZodDefault<z.ZodString>;
         installSource: z.ZodOptional<z.ZodEnum<{
-            npm: "npm";
             local: "local";
+            npm: "npm";
             symlink: "symlink";
         }>>;
         requiredAddons: z.ZodOptional<z.ZodArray<z.ZodString>>;

package/dist/kernel/index.d.ts

@@ -52,7 +52,8 @@ export { HubNodeRegistry } from './moleculer/node-registry.js';
 export type { CallFn, NodeRootPackageInfo, RegisteredAddonManifest, RegisteredNativeCap, RegisterNodeParams, RegisterNodeResult, NodeCapEntry, NodeNativeCapEntry, } from './moleculer/node-registry.js';
 export { callRegisterNodeWithRetry, buildNodeManifest } from './moleculer/register-node-client.js';
 export type { RegisterNodeBroker, CallRegisterNodeOptions, } from './moleculer/register-node-client.js';
-export { hashClusterSecret, clusterSecretMatches, isClusterSecretMismatchError, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, } from './moleculer/cluster-secret.js';
+export { hashClusterSecret, clusterSecretMatches, isClusterSecretMismatchError, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_REF, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, checkClusterSecret, getProcessClusterSecretGate, setProcessClusterSecretGate, } from './moleculer/cluster-secret.js';
+export type { ClusterSecretGate, ClusterSecretVerdict } from './moleculer/cluster-secret.js';
 export { serializeTypedArrays } from './moleculer/typed-array-serde.js';
 export { createReadinessService, createReadinessServiceForRegistry, AGENT_READINESS_SERVICE_NAME, } from './moleculer/readiness-service.js';
 export type { ReadinessServiceDeps } from './moleculer/readiness-service.js';

package/dist/kernel/moleculer/broker-factory.d.ts

@@ -4,8 +4,6 @@ interface BrokerConfig {
     readonly mode: 'hub' | 'agent' | 'test';
     readonly hubAddress?: string;
     readonly logLevel?: string;
-    /** Shared secret — used as Moleculer namespace to isolate the cluster on the network */
-    readonly secret?: string;
     /**
      * TCP port the hub listens on for cluster traffic.
      * Agents need a deterministic port to connect via `urls: 'hub@host:port'`

package/dist/kernel/moleculer/cluster-secret.d.ts

@@ -1,3 +1,7 @@
+/** The keychain ref of the hub's cluster secret: `secret://system/global/clusterSecret`. */
+export declare const CLUSTER_SECRET_REF: string;
+/** The `system-settings` key whose value is the cluster secret's keychain marker. */
+export declare const CLUSTER_SECRET_SETTINGS_KEY = "cluster.clusterSecret";
 /** Moleculer error `type` marking a registration rejected for a bad cluster secret. */
 export declare const CLUSTER_SECRET_MISMATCH_TYPE = "CLUSTER_SECRET_MISMATCH";
 /** Process exit code a runner uses when its registration is rejected for a bad secret. */
@@ -13,3 +17,30 @@ export declare function hashClusterSecret(secret: string): string;
 export declare function clusterSecretMatches(expectedHash: string | undefined, presentedHash: string | undefined): boolean;
 /** Recognises a cluster-secret rejection, including after a Moleculer RPC round-trip. */
 export declare function isClusterSecretMismatchError(err: unknown): boolean;
+/** Moleculer error `type` of a registration refused because the hub cannot read its own secret yet. */
+export declare const CLUSTER_SECRET_UNAVAILABLE_TYPE = "CLUSTER_SECRET_UNAVAILABLE";
+/**
+ * What the hub knows about its own cluster secret:
+ *  - `off`: none is set — every node may register (the behaviour of a hub
+ *    that never had a secret);
+ *  - `on`: set — a node must present the matching hash;
+ *  - `unknown`: one is set (the marker exists) but the keychain cannot answer
+ *    yet — registrations are refused with a RETRYABLE error until it does.
+ *    Fail closed: a locked keychain never opens the gate.
+ */
+export type ClusterSecretGate = {
+    readonly kind: 'off';
+} | {
+    readonly kind: 'on';
+    readonly hash: string;
+} | {
+    readonly kind: 'unknown';
+    readonly reason: string;
+};
+export type ClusterSecretVerdict = 'allow' | 'mismatch' | 'unavailable';
+export declare function checkClusterSecret(gate: ClusterSecretGate, presentedHash: string | undefined): ClusterSecretVerdict;
+/** Register the hub's gate. Called by `system-config`, which owns the field. */
+export declare function setProcessClusterSecretGate(gate: ClusterSecretGate): void;
+export declare function clearProcessClusterSecretGate(): void;
+/** The hub's gate; `unknown` until `system-config` loaded it. */
+export declare function getProcessClusterSecretGate(): ClusterSecretGate;

package/dist/kernel/moleculer/hub-service.d.ts

@@ -1,6 +1,7 @@
 import { ServiceSchema } from 'moleculer';
 import { LogTags } from '@camstack/types';
 import { RegisterNodeParams } from './node-registry.js';
+import { ClusterSecretGate } from './cluster-secret.js';
 interface HubServiceDeps {
     readonly getAddonConfig: (addonId: string) => unknown;
     readonly getSettings: (scope: string, key?: string) => unknown;
@@ -24,11 +25,13 @@ interface HubServiceDeps {
     /** Explicit deregistration (graceful shutdown). `$node.disconnected` covers crashes. */
     readonly onUnregisterNode?: (nodeId: string) => void;
     /**
-     * SHA-256 hash of the hub's own `CAMSTACK_CLUSTER_SECRET`, or `undefined`
-     * when no secret is configured. When set, `$hub.registerNode` rejects any
-     * node not presenting a matching `clusterSecretHash`. (Cluster-secret gate.)
+     * The hub's cluster-secret gate, read on EVERY registration (the secret
+     * lives in the keychain and may be set or changed at runtime — D797):
+     * `off` lets every node in, `on` requires the matching `clusterSecretHash`,
+     * `unknown` (the keychain cannot answer yet) refuses with a retryable error.
+     * Absent → `off` (test brokers); the hub always passes the keychain's gate.
      */
-    readonly expectedClusterSecretHash?: string;
+    readonly clusterSecretGate?: () => ClusterSecretGate;
 }
 declare function createHubService(deps: HubServiceDeps): ServiceSchema;
 export { createHubService };

package/dist/kernel/moleculer/node-registry.d.ts

@@ -56,7 +56,7 @@ interface RegisterNodeParams {
      */
     readonly nativeCaps?: readonly RegisteredNativeCap[];
     /**
-     * SHA-256 hash of the node's `CAMSTACK_CLUSTER_SECRET`. Optional — absent
+     * SHA-256 hash of the node's cluster secret. Optional — absent
      * when the node has no secret configured. Verified by the `registerNode`
      * receiver; never carries the raw secret. (Cluster-secret registration gate.)
      */

package/dist/kernel/system-settings-policy.d.ts

@@ -2,16 +2,14 @@
  * Which `system-settings` keys the STORE may answer, and which the kernel
  * loads from the door into memory at boot — D675.
  *
- * ## The store never outranks env + config.yaml for a bootstrap section
+ * ## The store never answers for a bootstrap section
  *
- * `system-settings` holds, among other things, `auth.jwtSecret`,
- * `auth.adminUsername` and `auth.adminPassword` — written there by
- * `local-auth` (and by older builds) next to `auth.tokenExpiry`. The live
- * container supplies the same three from env (`CAMSTACK_JWT_SECRET`,
- * `CAMSTACK_ADMIN_USER`, `CAMSTACK_ADMIN_PASS`). While the store layer was
- * skipped (every read since D231) env won by accident. Merging the store back
- * in "highest priority" would let a stale DB copy replace the JWT secret —
- * invalidating every token — and change the login password.
+ * `system-settings` may still hold `auth.jwtSecret`, `auth.adminUsername` and
+ * `auth.adminPassword` — written there by `local-auth` (and by older builds)
+ * next to `auth.tokenExpiry`. Since D797 none of the three is a setting at
+ * all (the signing key is the keychain's, the first-boot admin is fixed), and
+ * the stale rows must still never answer: merging them back in would let a
+ * stale DB copy stand in for a credential. The one-off ops script deletes them.
  *
  * So a bootstrap-owned section is answered from env + config.yaml ONLY, and
  * the store may add exactly the keys in {@link STORE_READABLE_BOOTSTRAP_KEYS}:

package/dist/{retired-settings-keys-iGcmzwLV.mjs → retired-settings-keys-DlZ3VV6x.mjs}

@@ -1,4 +1,4 @@
-import { _r as asJsonObject } from "./dist-BWNoS-1S.mjs";
+import { _r as asJsonObject } from "./dist-B9oFw2jh.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-CDyOGAje.js → retired-settings-keys-YOOKLA3v.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-D_a9mUiM.js");
+const require_dist = require("./dist-Cc6KOdY-.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.377",
+  "version": "1.2.379",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",