@camstack/system 1.2.377 → 1.2.379

package/dist/builtins/keychain/index.mjs

@@ -1,4 +1,6 @@
-import { Er as formatSecretScope, Fr as parseSecretRef, Gr as EventCategory, Gt as keychainCapability, Mr as normalizeSecretOwner, Wt as keychainAdminCapability, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
+import { Dr as formatSecretScope, Gt as keychainCapability, Ir as parseSecretRef, Nr as normalizeSecretOwner, Wt as keychainAdminCapability, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-Qhde8r82.mjs";
+import { i as CLUSTER_SECRET_SETTINGS_KEY } from "../../cluster-secret-BDue-uJj.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import * as path$1 from "node:path";
@@ -197,6 +199,13 @@ function buildKeySourceCandidates(opts) {
 */
 async function writeDefaultKeyFile(dataDir, key, opts) {
 	const file = defaultKeyFilePath(dataDir);
+	try {
+		return await writeKeyFileAt(file, key, opts);
+	} catch (err) {
+		throw new Error(`could not write the master key at ${file}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+	}
+}
+async function writeKeyFileAt(file, key, opts) {
 	const dir = path$1.dirname(file);
 	await promises.mkdir(dir, {
 		recursive: true,
@@ -217,6 +226,8 @@ async function writeDefaultKeyFile(dataDir, key, opts) {
 	await promises.writeFile(tmp, `${encodeKeyMaterial(key)}\n`, { mode: 384 });
 	await promises.rename(tmp, file);
 	await promises.chmod(file, 384);
+	const back = await loadKeyFile(file);
+	if (back.kind !== "loaded" || !back.key.equals(key)) throw new Error("the written key file does not read back as the generated key");
 	return movedAside;
 }
 //#endregion
@@ -620,6 +631,14 @@ var KeychainRepository = class {
 		return rows.length;
 	}
 };
+//#endregion
+//#region src/builtins/keychain/system-held-secrets.ts
+/** The refs `keychain-admin.setSystemSecret` may write, by name. */
+var SYSTEM_HELD_SECRET_REFS = { "jwt-signing-key": JWT_SIGNING_KEY_REF };
+/** System refs no blob points at — in use for as long as they exist. */
+var PROCESS_HELD_SECRET_REFS = new Set([JWT_SIGNING_KEY_REF]);
+/** `system-settings` keys that may hold a system-owned secret's marker. */
+var SYSTEM_SECRET_SETTINGS_KEYS = [CLUSTER_SECRET_SETTINGS_KEY];
 var KeychainLockedError = class extends Error {
 	reason;
 	constructor(reason) {
@@ -664,10 +683,14 @@ var KeychainService = class {
 		this.unlock = await this.computeUnlock();
 		if (this.unlock.state === "ready") this.deps.logger.info("keychain unlocked", {
 			source: this.unlock.source.kind,
+			path: this.unlock.source.path,
 			fingerprint: shortFingerprint(this.unlock.fingerprint),
 			rotationPending: this.unlock.rotationPending
 		});
-		else this.deps.logger.error("keychain LOCKED — every secret resolves unavailable", { reason: this.unlock.reason });
+		else this.deps.logger.error("keychain LOCKED — every secret resolves unavailable", {
+			reason: this.unlock.reason,
+			path: this.configuredSource?.path
+		});
 		try {
 			await this.deps.repo.pruneAudit(this.now());
 		} catch (err) {
@@ -759,10 +782,19 @@ var KeychainService = class {
 		};
 		else if (primary.source.kind === "default-file") {
 			kek = generateKey();
-			await writeDefaultKeyFile(this.deps.dataDir, kek, {
-				replace: false,
-				nowMs: this.now()
-			});
+			try {
+				await writeDefaultKeyFile(this.deps.dataDir, kek, {
+					replace: false,
+					nowMs: this.now()
+				});
+			} catch (err) {
+				this.deps.logger.error("keychain master key could NOT be generated — no key stored", {
+					path: primary.source.path,
+					error: errMsg(err)
+				});
+				throw err;
+			}
+			this.deps.logger.info("keychain master key generated", { path: primary.source.path });
 		} else return {
 			state: "locked",
 			reason: "key-missing"
@@ -817,7 +849,11 @@ var KeychainService = class {
 		if (parts === null || !this.owns(caller, parts.owner)) throw new KeychainForbiddenError(ref, caller);
 		return parts.owner;
 	}
-	async put(caller, ref, value) {
+	/**
+	* @param actor who the audit names — the owner addon by default; the
+	*   operator (`user:<id>`) for {@link setSystemSecret}.
+	*/
+	async put(caller, ref, value, actor = actorOfAddon(caller)) {
 		const owner = this.ownerOf(ref, caller);
 		const unlocked = this.requireReady();
 		if (value.length === 0) throw new Error("keychain.put: an empty value is not stored — delete the ref");
@@ -843,10 +879,10 @@ var KeychainService = class {
 			version,
 			createdAt: existing?.createdAt ?? t,
 			updatedAt: t,
-			updatedBy: actorOfAddon(caller),
+			updatedBy: actor,
 			lastReadAt: existing?.lastReadAt ?? null
 		});
-		await this.audit("put", actorOfAddon(caller), ref, `version=${version}`);
+		await this.audit("put", actor, ref, `version=${version}`);
 		this.deps.events.emit({
 			ref,
 			owner,
@@ -976,6 +1012,14 @@ var KeychainService = class {
 			usage: usage.get(row.ref) ?? "unknown"
 		}));
 	}
+	/**
+	* The operator replaces a system-held secret no form edits (D797) — the
+	* session signing key. Stored under owner `system`, audited as the user.
+	*/
+	async setSystemSecret(userId, name, value) {
+		const ref = SYSTEM_HELD_SECRET_REFS[name];
+		return this.put(SYSTEM_SECRET_OWNER, ref, value, `user:${userId}`);
+	}
 	async listAudit(limit) {
 		return this.deps.repo.listAudit(limit);
 	}
@@ -1215,6 +1259,13 @@ async function prefixRows(door, collection, prefix) {
 }
 /** The blobs that may hold the marker of a ref in `scope`; `null` = cannot tell. */
 async function blobsFor(door, owner, scope) {
+	if (owner === "system" && scope.kind === "global") return [[...PROCESS_HELD_SECRET_REFS].map((ref) => ({
+		$secret: ref,
+		v: 1
+	})), ...await Promise.all(SYSTEM_SECRET_SETTINGS_KEYS.map((key) => door.get({
+		collection: "system-settings",
+		key
+	})))];
 	switch (scope.kind) {
 		case "global":
 		case "node": {
@@ -1303,8 +1354,12 @@ function createKeychainUsageCheck(door) {
 *    orphans, rotation, recovery key, reset. Every method admin; the four
 *    that change or hand out material take the session's user for the audit.
 *
-* It does not run on agents: the manifest places it `hub-only`, and an agent
-* addon reaches it through `$hub-cap-fwd` like every other hub cap.
+* It does not run on agents: an agent's Phase 1 drops `keychain` from its infra
+* list (`server/backend/src/agent/agent-infra-capabilities.ts`), and an agent
+* addon reaches it through `$hub-cap-fwd` like every other hub cap. Until
+* 2026-10-08 agents DID boot it — their store door forwards to the hub, so an
+* agent wrote the hub's `keychain:keys` row with a key file on its own disk.
+* Booting first, it left the hub locked `key-missing`.
 */
 var DAY_MS = 1440 * 6e4;
 /** The caller the transport stamped (or an in-process caller stated). */
@@ -1392,6 +1447,7 @@ var KeychainAddon = class extends BaseAddon {
 				listSecrets: () => service.listSecrets(),
 				listAudit: (input) => service.listAudit(input.limit ?? 100),
 				reveal: (input) => service.reveal(input.caller.userId, input.ref),
+				setSystemSecret: (input) => service.setSystemSecret(input.caller.userId, input.name, input.value),
 				deleteOrphans: (input) => service.deleteOrphans(input.caller.userId, input.refs),
 				rotateMasterKey: (input) => service.rotateMasterKey(input.caller.userId),
 				purgeRetiredKeys: async (input) => ({ purged: await service.purgeRetiredKeys(input.caller.userId) }),

package/dist/builtins/keychain/keychain-service.d.ts

@@ -1,4 +1,4 @@
-import { EventCategory, KeychainAuditEntry, KeychainKeySource, KeychainResolveResult, KeychainSecretMeta, KeychainSecretUsage, KeychainState, KeychainStatus, KeychainUnavailableReason } from '@camstack/types';
+import { EventCategory, KeychainAuditEntry, KeychainKeySource, KeychainResolveResult, KeychainSecretMeta, KeychainSecretUsage, KeychainState, KeychainStatus, KeychainUnavailableReason, SystemHeldSecretName } from '@camstack/types';
 import { KeychainRepository, KeychainSecretRow } from './keychain-store.js';
 import { KeySourceCandidate } from './key-sources.js';
 /** `lastReadAt` is written at most this often per ref (hub I/O is the bottleneck). */
@@ -54,7 +54,11 @@ export declare class KeychainService {
     /** May `caller` touch values owned by `owner`? */
     owns(caller: string | null, owner: string): boolean;
     private ownerOf;
-    put(caller: string | null, ref: string, value: string): Promise<{
+    /**
+     * @param actor who the audit names — the owner addon by default; the
+     *   operator (`user:<id>`) for {@link setSystemSecret}.
+     */
+    put(caller: string | null, ref: string, value: string, actor?: string): Promise<{
         ref: string;
         version: number;
     }>;
@@ -66,6 +70,14 @@ export declare class KeychainService {
     listSecrets(): Promise<readonly (KeychainSecretMeta & {
         usage: KeychainSecretUsage;
     })[]>;
+    /**
+     * The operator replaces a system-held secret no form edits (D797) — the
+     * session signing key. Stored under owner `system`, audited as the user.
+     */
+    setSystemSecret(userId: string, name: SystemHeldSecretName, value: string): Promise<{
+        ref: string;
+        version: number;
+    }>;
     listAudit(limit: number): Promise<readonly KeychainAuditEntry[]>;
     reveal(userId: string, ref: string): Promise<{
         value: string;

package/dist/builtins/keychain/system-held-secrets.d.ts

@@ -0,0 +1,11 @@
+import { SystemHeldSecretName } from '@camstack/types';
+import { SYSTEM_SECRET_OWNER } from '../../auth/jwt-signing-key.js';
+import { CLUSTER_SECRET_REF } from '../../kernel/moleculer/cluster-secret.js';
+export { SYSTEM_SECRET_OWNER };
+/** The refs `keychain-admin.setSystemSecret` may write, by name. */
+export declare const SYSTEM_HELD_SECRET_REFS: Readonly<Record<SystemHeldSecretName, string>>;
+/** System refs no blob points at — in use for as long as they exist. */
+export declare const PROCESS_HELD_SECRET_REFS: ReadonlySet<string>;
+/** `system-settings` keys that may hold a system-owned secret's marker. */
+export declare const SYSTEM_SECRET_SETTINGS_KEYS: readonly string[];
+export { CLUSTER_SECRET_REF };

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D_a9mUiM.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { F as RecordingStatusSchema, Gr as EventCategory, N as RECORDING_SOURCE_CAMSTACK_ADDON, Sr as createEvent, cr as errMsg, lr as BaseAddon } from "../../dist-BWNoS-1S.mjs";
+import { Cr as createEvent, F as RecordingStatusSchema, N as RECORDING_SOURCE_CAMSTACK_ADDON, cr as errMsg, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/admin-account-boot.d.ts

@@ -21,7 +21,7 @@ export interface AdminAccountBootInput {
 }
 export interface AdminAccountBootResult {
     readonly outcome: AdminSeedOutcome;
-    /** The admin still signs in with {@link DEFAULT_ADMIN_PASSWORD}. */
+    /** The admin still signs in with {@link FIRST_BOOT_ADMIN_PASSWORD}. */
     readonly usesDefaultPassword: boolean;
 }
 export declare function reconcileAdminAccountAtBoot(input: AdminAccountBootInput): Promise<AdminAccountBootResult>;

package/dist/builtins/local-auth/auth-config-reader.d.ts

@@ -1,9 +1,13 @@
 import { AuthConfigReader } from '../../auth/auth-manager.js';
-/** The values `local-auth` pre-resolves before constructing its AuthManager. */
+/**
+ * The values `local-auth` pre-resolves before constructing its AuthManager.
+ *
+ * No credential is among them (D797): the session signing key lives in the
+ * keychain (`jwt-signing-key.ts`) and the first-boot admin is fixed
+ * (`admin` / `changeme`), so `auth.jwtSecret`, `auth.adminUsername` and
+ * `auth.adminPassword` are answered by nothing.
+ */
 export interface ResolvedAuthConfig {
-    readonly jwtSecret: string;
-    readonly adminUsername: string;
-    readonly adminPassword: string;
     /**
      * Operator-configured session lifetime. `undefined` when the `auth` section
      * carries no value — the signer then applies `DEFAULT_TOKEN_EXPIRY`, which
@@ -11,10 +15,8 @@ export interface ResolvedAuthConfig {
      */
     readonly tokenExpiry: string | undefined;
 }
-/** Persist the generated JWT secret. Called by AuthManager on first boot. */
-export type AuthSectionWriter = (patch: Record<string, unknown>) => void;
 /**
  * Every config path this reader can answer. Anything else resolves to
  * `undefined` by construction — see the module docblock.
  */
-export declare function createAuthConfigReader(resolved: ResolvedAuthConfig, writeAuthSection: AuthSectionWriter): AuthConfigReader;
+export declare function createAuthConfigReader(resolved: ResolvedAuthConfig): AuthConfigReader;

package/dist/builtins/local-auth/jwt-signing-key-keeper.d.ts

@@ -0,0 +1,30 @@
+import { SecretsAccess } from '@camstack/types';
+/** How often a locked keychain is asked again. */
+export declare const SIGNING_KEY_RETRY_MS = 30000;
+interface KeeperLogger {
+    info(message: string, meta?: {
+        meta?: Record<string, unknown>;
+    }): void;
+    error(message: string, meta?: {
+        meta?: Record<string, unknown>;
+    }): void;
+}
+export interface JwtSigningKeyKeeperDeps {
+    /** A keychain handle for owner `system`; `null` when this process has no keychain door. */
+    readonly secrets: SecretsAccess | null;
+    readonly logger: KeeperLogger;
+    readonly retryMs?: number;
+}
+export declare class JwtSigningKeyKeeper {
+    private readonly deps;
+    private retryTimer;
+    private unsubscribe;
+    private stopped;
+    constructor(deps: JwtSigningKeyKeeperDeps);
+    start(): Promise<void>;
+    stop(): void;
+    private load;
+    private apply;
+    private scheduleRetry;
+}
+export {};

package/dist/builtins/local-auth/local-auth.addon.d.ts

@@ -1,10 +1,5 @@
 import { ProviderRegistration, BaseAddon } from '@camstack/types';
-interface LocalAuthConfig {
-    jwtSecret?: string;
-    adminUsername?: string;
-    adminPassword?: string;
-}
-export declare class LocalAuthAddon extends BaseAddon<LocalAuthConfig> {
+export declare class LocalAuthAddon extends BaseAddon {
     private authManager;
     private userManager;
     private apiKeyManager;
@@ -13,6 +8,7 @@ export declare class LocalAuthAddon extends BaseAddon<LocalAuthConfig> {
     private reapTimer;
     private totpManager;
     private externalIdentities;
+    private signingKeyKeeper;
     constructor();
     protected onInitialize(): Promise<ProviderRegistration[]>;
     /**