@camstack/system 1.2.378 → 1.2.379

package/dist/builtins/keychain/system-held-secrets.d.ts

@@ -0,0 +1,11 @@
+import { SystemHeldSecretName } from '@camstack/types';
+import { SYSTEM_SECRET_OWNER } from '../../auth/jwt-signing-key.js';
+import { CLUSTER_SECRET_REF } from '../../kernel/moleculer/cluster-secret.js';
+export { SYSTEM_SECRET_OWNER };
+/** The refs `keychain-admin.setSystemSecret` may write, by name. */
+export declare const SYSTEM_HELD_SECRET_REFS: Readonly<Record<SystemHeldSecretName, string>>;
+/** System refs no blob points at — in use for as long as they exist. */
+export declare const PROCESS_HELD_SECRET_REFS: ReadonlySet<string>;
+/** `system-settings` keys that may hold a system-owned secret's marker. */
+export declare const SYSTEM_SECRET_SETTINGS_KEYS: readonly string[];
+export { CLUSTER_SECRET_REF };

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { F as RecordingStatusSchema, Gr as EventCategory, N as RECORDING_SOURCE_CAMSTACK_ADDON, Sr as createEvent, cr as errMsg, lr as BaseAddon } from "../../dist-Bvl5JgNt.mjs";
+import { Cr as createEvent, F as RecordingStatusSchema, N as RECORDING_SOURCE_CAMSTACK_ADDON, cr as errMsg, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/admin-account-boot.d.ts

@@ -21,7 +21,7 @@ export interface AdminAccountBootInput {
 }
 export interface AdminAccountBootResult {
     readonly outcome: AdminSeedOutcome;
-    /** The admin still signs in with {@link DEFAULT_ADMIN_PASSWORD}. */
+    /** The admin still signs in with {@link FIRST_BOOT_ADMIN_PASSWORD}. */
     readonly usesDefaultPassword: boolean;
 }
 export declare function reconcileAdminAccountAtBoot(input: AdminAccountBootInput): Promise<AdminAccountBootResult>;

package/dist/builtins/local-auth/auth-config-reader.d.ts

@@ -1,9 +1,13 @@
 import { AuthConfigReader } from '../../auth/auth-manager.js';
-/** The values `local-auth` pre-resolves before constructing its AuthManager. */
+/**
+ * The values `local-auth` pre-resolves before constructing its AuthManager.
+ *
+ * No credential is among them (D797): the session signing key lives in the
+ * keychain (`jwt-signing-key.ts`) and the first-boot admin is fixed
+ * (`admin` / `changeme`), so `auth.jwtSecret`, `auth.adminUsername` and
+ * `auth.adminPassword` are answered by nothing.
+ */
 export interface ResolvedAuthConfig {
-    readonly jwtSecret: string;
-    readonly adminUsername: string;
-    readonly adminPassword: string;
     /**
      * Operator-configured session lifetime. `undefined` when the `auth` section
      * carries no value — the signer then applies `DEFAULT_TOKEN_EXPIRY`, which
@@ -11,10 +15,8 @@ export interface ResolvedAuthConfig {
      */
     readonly tokenExpiry: string | undefined;
 }
-/** Persist the generated JWT secret. Called by AuthManager on first boot. */
-export type AuthSectionWriter = (patch: Record<string, unknown>) => void;
 /**
  * Every config path this reader can answer. Anything else resolves to
  * `undefined` by construction — see the module docblock.
  */
-export declare function createAuthConfigReader(resolved: ResolvedAuthConfig, writeAuthSection: AuthSectionWriter): AuthConfigReader;
+export declare function createAuthConfigReader(resolved: ResolvedAuthConfig): AuthConfigReader;

package/dist/builtins/local-auth/jwt-signing-key-keeper.d.ts

@@ -0,0 +1,30 @@
+import { SecretsAccess } from '@camstack/types';
+/** How often a locked keychain is asked again. */
+export declare const SIGNING_KEY_RETRY_MS = 30000;
+interface KeeperLogger {
+    info(message: string, meta?: {
+        meta?: Record<string, unknown>;
+    }): void;
+    error(message: string, meta?: {
+        meta?: Record<string, unknown>;
+    }): void;
+}
+export interface JwtSigningKeyKeeperDeps {
+    /** A keychain handle for owner `system`; `null` when this process has no keychain door. */
+    readonly secrets: SecretsAccess | null;
+    readonly logger: KeeperLogger;
+    readonly retryMs?: number;
+}
+export declare class JwtSigningKeyKeeper {
+    private readonly deps;
+    private retryTimer;
+    private unsubscribe;
+    private stopped;
+    constructor(deps: JwtSigningKeyKeeperDeps);
+    start(): Promise<void>;
+    stop(): void;
+    private load;
+    private apply;
+    private scheduleRetry;
+}
+export {};

package/dist/builtins/local-auth/local-auth.addon.d.ts

@@ -1,10 +1,5 @@
 import { ProviderRegistration, BaseAddon } from '@camstack/types';
-interface LocalAuthConfig {
-    jwtSecret?: string;
-    adminUsername?: string;
-    adminPassword?: string;
-}
-export declare class LocalAuthAddon extends BaseAddon<LocalAuthConfig> {
+export declare class LocalAuthAddon extends BaseAddon {
     private authManager;
     private userManager;
     private apiKeyManager;
@@ -13,6 +8,7 @@ export declare class LocalAuthAddon extends BaseAddon<LocalAuthConfig> {
     private reapTimer;
     private totpManager;
     private externalIdentities;
+    private signingKeyKeeper;
     constructor();
     protected onInitialize(): Promise<ProviderRegistration[]>;
     /**

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
-let zod = require("zod");
+const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_jwt_signing_key = require("../../jwt-signing-key-C2rE3wH6.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");
@@ -6205,7 +6205,7 @@ var noopLogger = {
 };
 var AuthManager = class {
 	config;
-	jwtSecret;
+	signingKey;
 	logger;
 	/**
 	* Offending `auth.tokenExpiry` values already reported by this instance.
@@ -6217,17 +6217,19 @@ var AuthManager = class {
 	* rest resolve silently to the same default until the value changes.
 	*/
 	reportedInvalidExpiries = /* @__PURE__ */ new Set();
-	constructor(config, logger = noopLogger) {
+	/**
+	* @param signingKey where the session signing key comes from — the process
+	*   slot `local-auth` fills from the keychain (D797). Never config, never
+	*   env; read on every mint and verify, and it THROWS while unavailable.
+	*/
+	constructor(config, logger = noopLogger, signingKey = require_jwt_signing_key.processJwtSigningKey) {
 		this.config = config;
+		this.signingKey = signingKey;
 		this.logger = logger;
-		const configured = this.config.get("auth.jwtSecret");
-		if (configured) this.jwtSecret = configured;
-		else {
-			const secret = node_crypto.randomBytes(32).toString("hex");
-			this.config.update("auth", { jwtSecret: secret });
-			this.logger.info("Generated JWT secret and saved to config.yaml (auth.jwtSecret)");
-			this.jwtSecret = secret;
-		}
+	}
+	/** The current signing key; throws `JwtSigningKeyUnavailableError` while there is none. */
+	get jwtSecret() {
+		return this.signingKey.current();
 	}
 	signToken(payload) {
 		const configured = this.readConfiguredExpiry();
@@ -6620,17 +6622,23 @@ var ScopedTokenManager = class {
 //#endregion
 //#region src/auth/user-manager.ts
 var USERS_COLLECTION$1 = "users";
+/**
+* The account a fresh hub seeds on its first boot (D797). Not configurable —
+* no env variable, no config.yaml key: the first sign-in with this password
+* forces a change (admin-ui `mustChangePassword`), and an existing user is
+* never overwritten (D728).
+*/
+var FIRST_BOOT_ADMIN_USERNAME = "admin";
+var FIRST_BOOT_ADMIN_PASSWORD = "changeme";
 function parseUser(data) {
 	return parseRecord("user", require_dist.UserRecordSchema, data);
 }
 var UserManager = class {
 	storageAccess;
 	auth;
-	config;
-	constructor(storageAccess, auth, config) {
+	constructor(storageAccess, auth) {
 		this.storageAccess = storageAccess;
 		this.auth = auth;
-		this.config = config;
 	}
 	get store() {
 		return this.storageAccess.getStore();
@@ -6720,53 +6728,50 @@ var UserManager = class {
 		});
 	}
 	/**
-	* Seed the configured admin (`auth.adminUsername` / `auth.adminPassword`,
-	* i.e. `CAMSTACK_ADMIN_USER` / `CAMSTACK_ADMIN_PASS`) — on FIRST boot only.
+	* Seed {@link FIRST_BOOT_ADMIN_USERNAME} / {@link FIRST_BOOT_ADMIN_PASSWORD}
+	* — on FIRST boot only, i.e. when no admin account exists.
 	*
-	* The configured password is a seed, never an authority. Once any admin
-	* exists, this never writes a password: the operator's own change in the
-	* admin UI is the truth from then on. This method used to compare the stored
-	* hash with the configured password on every boot and rewrite it when they
-	* differed, so a password changed in the UI went back to the configured one
-	* (`changeme` on a Mac hub and on any container without `CAMSTACK_ADMIN_PASS`)
-	* at the next restart.
+	* The seed is never an authority. Once any admin exists, this never writes a
+	* password: the operator's own change in the admin UI is the truth from then
+	* on (D728). This method once compared the stored hash with a configured
+	* password on every boot and rewrote it when they differed, so a password
+	* changed in the UI went back at the next restart.
 	*
 	* `resetPassword: true` is the one explicit exception — the operator's
-	* one-shot recovery request (see `admin-password-reset.ts`): the configured
-	* admin's password is set back to the configured one.
+	* one-shot recovery request (`RESET_ADMIN_PASSWORD`, see
+	* `admin-account-boot.ts`): the `admin` user's password goes back to
+	* `changeme`, and the next sign-in forces a change again.
 	*/
 	async ensureAdminExists(options = {}) {
-		const adminUsername = this.config.get("auth.adminUsername");
-		const adminPassword = this.config.get("auth.adminPassword");
-		if (!adminUsername || !adminPassword) return { kind: "not-configured" };
-		const existing = await this.findByUsername(adminUsername);
+		const username = FIRST_BOOT_ADMIN_USERNAME;
+		const existing = await this.findByUsername(username);
 		if (existing) {
 			if (options.resetPassword === true) {
-				await this.resetPassword(existing.id, adminPassword);
+				await this.resetPassword(existing.id, FIRST_BOOT_ADMIN_PASSWORD);
 				return {
 					kind: "reset",
-					username: adminUsername
+					username
 				};
 			}
 			return {
 				kind: "exists",
-				username: adminUsername
+				username
 			};
 		}
 		if ((await this.listAll()).some((u) => u.isAdmin)) return {
 			kind: "other-admin-exists",
-			username: adminUsername
+			username
 		};
 		await this.create({
-			username: adminUsername,
-			password: adminPassword,
+			username,
+			password: FIRST_BOOT_ADMIN_PASSWORD,
 			isAdmin: true,
 			allowedProviders: "*",
 			allowedDevices: {}
 		});
 		return {
 			kind: "seeded",
-			username: adminUsername
+			username
 		};
 	}
 	/**
@@ -6779,6 +6784,65 @@ var UserManager = class {
 		return this.auth.comparePassword(password, user.passwordHash);
 	}
 };
+var JwtSigningKeyKeeper = class {
+	deps;
+	retryTimer = null;
+	unsubscribe = null;
+	stopped = false;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	async start() {
+		const secrets = this.deps.secrets;
+		if (secrets === null) {
+			this.apply({
+				state: "unavailable",
+				reason: "no keychain door in this process"
+			});
+			return;
+		}
+		this.unsubscribe = secrets.onChange((ref) => {
+			if (ref === require_jwt_signing_key.JWT_SIGNING_KEY_REF) this.load(secrets);
+		});
+		await this.load(secrets);
+	}
+	stop() {
+		this.stopped = true;
+		if (this.retryTimer !== null) clearTimeout(this.retryTimer);
+		this.retryTimer = null;
+		this.unsubscribe?.();
+		this.unsubscribe = null;
+	}
+	async load(secrets) {
+		if (this.stopped) return;
+		const next = await require_jwt_signing_key.loadJwtSigningKey({ secrets });
+		if (this.stopped) return;
+		this.apply(next);
+		if (next.state === "unavailable" && require_jwt_signing_key.getProcessJwtSigningKeyState().state !== "ready") this.scheduleRetry(secrets);
+	}
+	apply(next) {
+		const previous = require_jwt_signing_key.getProcessJwtSigningKeyState();
+		if (next.state === "ready") {
+			if (previous.state !== "ready") this.deps.logger.info("Session signing key loaded from the keychain");
+			require_jwt_signing_key.setProcessJwtSigningKey(next);
+			return;
+		}
+		if (previous.state === "ready") return;
+		require_jwt_signing_key.setProcessJwtSigningKey(next);
+		this.deps.logger.error("Sessions are UNAVAILABLE: the session signing key cannot be read from the keychain. No one can sign in and no session token verifies until the keychain unlocks (System → Secrets; or fix keychain.keyFile in config.yaml and restart). No fallback key is used.", { meta: {
+			reason: next.reason,
+			ref: require_jwt_signing_key.JWT_SIGNING_KEY_REF
+		} });
+	}
+	scheduleRetry(secrets) {
+		if (this.stopped || this.retryTimer !== null) return;
+		this.retryTimer = setTimeout(() => {
+			this.retryTimer = null;
+			this.load(secrets);
+		}, this.deps.retryMs ?? 3e4);
+		this.retryTimer.unref?.();
+	}
+};
 //#endregion
 //#region src/builtins/local-auth/auth-schema.ts
 /**
@@ -9568,153 +9632,6 @@ var TotpManager = class {
 	}
 };
 //#endregion
-//#region src/kernel/config-schema.ts
-/** Default data directory — used when CAMSTACK_DATA env var is not set */
-var DEFAULT_DATA_PATH = "camstack-data";
-/**
-* A list of browser origins from config.yaml (a YAML list) or from the
-* `CAMSTACK_CORS_ORIGINS` env var (one comma-separated string — env carries
-* only strings). Validation of each entry is the CORS policy's job
-* (`server/backend/src/api/cors/cors-policy.ts`), which logs what it rejects;
-* the schema only fixes the SHAPE so a typo cannot stop the hub from booting.
-*/
-var originListSchema = zod.z.preprocess((value) => typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) : value, zod.z.array(zod.z.string()));
-var serverSchema = zod.z.object({
-	port: zod.z.number().default(4443),
-	host: zod.z.string().default("0.0.0.0"),
-	dataPath: zod.z.string().default(DEFAULT_DATA_PATH),
-	/**
-	* EXTRA browser origins allowed to call this hub cross-origin (D707), on
-	* top of the built-ins: the hub's own origin, the hosted viewer PWA and the
-	* native app's opaque `null` origin. Bootstrap-owned on purpose — widening
-	* who may read hub responses in a browser is a security decision, and the
-	* policy is live from the first request, before the settings store exists.
-	*/
-	corsOrigins: originListSchema.default([])
-});
-var authSchema = zod.z.object({
-	jwtSecret: zod.z.string().nullable().default(null),
-	adminUsername: zod.z.string().default("admin"),
-	adminPassword: zod.z.string().default("changeme")
-});
-var hubSchema = zod.z.object({
-	url: zod.z.string().default("ws://localhost:4443/agent"),
-	token: zod.z.string().default("")
-});
-var agentSchema = zod.z.object({
-	name: zod.z.string().default(""),
-	/** Port for the agent status page (minimal HTML) */
-	statusPort: zod.z.number().default(4444)
-});
-var tlsSchema = zod.z.object({ 
-/**
-* Enable HTTPS (default: true). The certificate itself is never configured
-* here: the admin UI (Network → Local access) generates or uploads it
-* (D726), and boot serves whatever `tls/mode` says.
-*/
-enabled: zod.z.boolean().default(true) });
-/**
-* Bootstrap-time addon configuration — read PURELY from YAML, before the
-* kernel can talk to the settings-store. This breaks the chicken-and-egg
-* where the settings store itself is implemented by an addon: the kernel
-* needs to know WHICH addon to load first to provide the store, and that
-* decision can't itself live in the store.
-*
-* Backward-compatible: every field is optional + defaults reproduce the
-* current hard-coded behavior. Existing config.yaml files keep working.
-*/
-var bootstrapAddonsSchema = zod.z.object({
-	/**
-	* Addon implementing the `settings-store` capability. Loaded FIRST,
-	* before any other addon is enabled — every other addon's enable
-	* state, settings, and ordering lives in the store it provides.
-	*
-	* Default: '@camstack/addon-sqlite-storage' (the workspace's
-	* default SQLite-backed store). Future alternatives could swap this
-	* for postgres/redis without touching kernel code.
-	*/
-	settingsStoreAddon: zod.z.string().default("@camstack/addon-sqlite-storage"),
-	/**
-	* How the launcher provisions REQUIRED_PACKAGES into `data/addons/`
-	* on startup.
-	*
-	*   - `'npm'`     — pull from the npm registry (production default).
-	*   - `'local'`   — copy `packages/<X>/` from the workspace into
-	*                   `data/addons/<X>/`. Use for the Electron-
-	*                   packaged bundle and the e2e harness.
-	*   - `'symlink'` — point `data/addons/<X>` at the workspace source
-	*                   dir via a directory symlink. Dev-only: a
-	*                   workspace rebuild (`npm run build -w <X>`) is
-	*                   immediately reflected at the next addon load,
-	*                   no copy step. Falls back to `'local'` on
-	*                   platforms that reject symlink creation (Windows
-	*                   without developer-mode).
-	*
-	* The `CAMSTACK_INSTALL_SOURCE` env var, when set, wins over this
-	* field. Leave undefined to keep the launcher's default behaviour
-	* (npm when no workspace, local when a bundled addons dir is
-	* present, …).
-	*/
-	installSource: zod.z.enum([
-		"npm",
-		"local",
-		"symlink"
-	]).optional(),
-	/**
-	* Override the kernel's hard-coded `AddonInstaller.REQUIRED_PACKAGES`.
-	* Passing an array here REPLACES the default list entirely — useful
-	* for stripped-down deployments (only the bundle of addons the
-	* operator actually wants) and for forcing a different storage
-	* backend at first boot.
-	*
-	* Leave undefined to use the kernel-shipped defaults.
-	*/
-	requiredAddons: zod.z.array(zod.z.string()).optional(),
-	/**
-	* Disable list applied AFTER the settings-store reports the enabled
-	* set. Operator escape hatch — boot without a known-broken addon
-	* without having to mutate the store.
-	*/
-	forceDisable: zod.z.array(zod.z.string()).default([])
-});
-/**
-* Where the keychain's master key lives (D788). config.yaml ONLY: no env var
-* maps here, and the settings store may not answer it
-* (`BOOTSTRAP_OWNED_SECTIONS`). Absent → the desktop OS keychain when the hub
-* runs inside the desktop app, else `<dataDir>/.keychain/master.key`.
-*/
-var keychainSchema = zod.z.object({
-	/** A file holding 32 random bytes, base64 (or hex). Keep it OFF the data volume. */
-	keyFile: zod.z.string().min(1).optional(),
-	/**
-	* The key being rotated away from — consulted only to UNLOCK, so a move to a
-	* new key file is: new file, old one here, restart, rotate, remove this.
-	*/
-	previousKeyFile: zod.z.string().min(1).optional()
-});
-/** Bootstrap config -- loaded from config.yaml ONLY at startup.
-*  All other settings live in SQL (system_settings table). */
-var bootstrapSchema = zod.z.object({
-	/** Server mode: 'hub' (full server) or 'agent' (worker node) */
-	mode: zod.z.enum(["hub", "agent"]).default("hub"),
-	server: serverSchema.default(serverSchema.parse({})),
-	auth: authSchema.default(authSchema.parse({})),
-	/** Hub connection config — only used when mode='agent' */
-	hub: hubSchema.default(hubSchema.parse({})),
-	/** Agent-specific config — only used when mode='agent' */
-	agent: agentSchema.default(agentSchema.parse({})),
-	/** TLS configuration */
-	tls: tlsSchema.default(tlsSchema.parse({})),
-	/**
-	* Addon bootstrap directives — minimum addon set needed before the
-	* kernel can reach the settings-store. See bootstrapAddonsSchema.
-	* Spec: docs/superpowers/specs/2026-05-15-yaml-bootstrap-expansion.md
-	*/
-	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({})),
-	/** Keychain master-key location (config.yaml only). */
-	keychain: keychainSchema.default({})
-});
-//#endregion
 //#region src/builtins/local-auth/admin-account-boot.ts
 /**
 * The admin account at boot: seed it once, reset it only on the operator's
@@ -9722,16 +9639,16 @@ var bootstrapSchema = zod.z.object({
 *
 * ## Why a trigger FILE, not a variable
 *
-* The configured password (`CAMSTACK_ADMIN_PASS` / `auth.adminPassword`) seeds
-* the admin on first boot and is never applied again — a password the operator
-* changes in the admin UI survives every restart. Recovering a forgotten
+* A fresh hub seeds `admin` / `changeme` on its first boot (D797) and never
+* applies it again — a password the operator changes in the admin UI survives
+* every restart. Recovering a forgotten
 * password therefore needs an explicit request, and that request must be
 * ONE-SHOT: an environment flag stays set in a container template until someone
 * remembers to remove it, and while it is set it reverts the password on every
 * boot — the very defect this replaced. A file the hub DELETES after acting on
 * it cannot be left armed: create `RESET_ADMIN_PASSWORD` in the node's data
-* directory (`/data` in the container), restart, and the configured admin's
-* password is set back to the configured one, once.
+* directory (`/data` in the container), restart, and the `admin` user's
+* password is set back to `changeme`, once — the next sign-in forces a change.
 */
 /** The trigger's name, at the root of the node's data directory. */
 var ADMIN_PASSWORD_RESET_TRIGGER = "RESET_ADMIN_PASSWORD";
@@ -9753,23 +9670,20 @@ async function reconcileAdminAccountAtBoot(input) {
 function logOutcome(outcome, logger) {
 	switch (outcome.kind) {
 		case "seeded":
-			logger.info("Admin account seeded from the configured credentials (first boot)", { meta: { username: outcome.username } });
+			logger.info("Admin account seeded (first boot) — sign in as admin / changeme and set a password", { meta: { username: outcome.username } });
 			return;
 		case "reset":
-			logger.warn("Admin password reset to the configured password, as requested", { meta: { username: outcome.username } });
+			logger.warn("Admin password reset to the first-boot password, as requested", { meta: { username: outcome.username } });
 			return;
 		case "other-admin-exists":
-			logger.info("Configured admin username not seeded: another admin account already exists", { meta: { username: outcome.username } });
-			return;
-		case "not-configured":
-			logger.warn("No admin username/password configured — no admin account seeded");
+			logger.info("First-boot admin not seeded: another admin account already exists", { meta: { username: outcome.username } });
 			return;
 		case "exists": return;
 	}
 }
 /** Delete the trigger after acting on it — a reset must never repeat by itself. */
 function consumeTrigger(triggerPath, outcome, input) {
-	if (outcome.kind !== "reset") input.logger.warn("Admin password reset requested, but no configured admin account to reset", { meta: {
+	if (outcome.kind !== "reset") input.logger.warn("Admin password reset requested, but there is no `admin` user to reset", { meta: {
 		trigger: triggerPath,
 		outcome: outcome.kind
 	} });
@@ -9788,28 +9702,22 @@ function consumeTrigger(triggerPath, outcome, input) {
 * Every config path this reader can answer. Anything else resolves to
 * `undefined` by construction — see the module docblock.
 */
-function createAuthConfigReader(resolved, writeAuthSection) {
+function createAuthConfigReader(resolved) {
 	return {
 		get(path) {
 			switch (path) {
-				case "auth.jwtSecret": return narrow(resolved.jwtSecret);
-				case "auth.adminUsername": return narrow(resolved.adminUsername);
-				case "auth.adminPassword": return narrow(resolved.adminPassword);
 				case "auth.tokenExpiry": return narrow(resolved.tokenExpiry);
 				default: return;
 			}
 		},
-		update(_section, data) {
-			if (typeof data["jwtSecret"] === "string") writeAuthSection({ jwtSecret: data["jwtSecret"] });
-		}
+		update() {}
 	};
 }
 /**
 * The one documented type boundary in this module. `AuthConfigReader.get` is
 * the legacy `get<T>(path)` shape shared with `ConfigManager.get`, which is
 * likewise unchecked at runtime — every value returned here is a `string |
-* undefined` the caller immediately re-validates (`parseTokenExpiry`, the
-* truthiness gate on `jwtSecret`).
+* undefined` the caller immediately re-validates (`parseTokenExpiry`).
 */
 function narrow(value) {
 	return value;
@@ -10169,23 +10077,19 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 	reapTimer = null;
 	totpManager = null;
 	externalIdentities = null;
+	signingKeyKeeper = null;
 	constructor() {
-		super({
-			jwtSecret: "",
-			adminUsername: "",
-			adminPassword: ""
-		});
+		super({});
 	}
 	async onInitialize() {
-		const authSection = await this.ctx.settings?.getSection("auth") ?? {};
-		const reader = createAuthConfigReader({
-			jwtSecret: typeof authSection["jwtSecret"] === "string" ? authSection["jwtSecret"] : this.config.jwtSecret ?? "",
-			adminUsername: typeof authSection["adminUsername"] === "string" && authSection["adminUsername"] ? authSection["adminUsername"] : this.config.adminUsername ?? "",
-			adminPassword: typeof authSection["adminPassword"] === "string" && authSection["adminPassword"] ? authSection["adminPassword"] : this.config.adminPassword ?? "",
-			tokenExpiry: typeof authSection["tokenExpiry"] === "string" && authSection["tokenExpiry"] ? authSection["tokenExpiry"] : void 0
-		}, (patch) => {
-			this.ctx.settings?.setSection("auth", patch);
+		const forOwner = this.ctx.secrets?.forOwner ?? null;
+		this.signingKeyKeeper = new JwtSigningKeyKeeper({
+			secrets: forOwner === null ? null : forOwner("system"),
+			logger: this.ctx.logger
 		});
+		await this.signingKeyKeeper.start();
+		const authSection = await this.ctx.settings?.getSection("auth") ?? {};
+		const reader = createAuthConfigReader({ tokenExpiry: typeof authSection["tokenExpiry"] === "string" && authSection["tokenExpiry"] ? authSection["tokenExpiry"] : void 0 });
 		this.authManager = new AuthManager(reader, this.ctx.logger);
 		const store = this.ctx.api?.settingsStore;
 		if (store) {
@@ -10193,7 +10097,7 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 			const storageAccess = { getStore() {
 				return store;
 			} };
-			this.userManager = new UserManager(storageAccess, this.authManager, reader);
+			this.userManager = new UserManager(storageAccess, this.authManager);
 			this.apiKeyManager = new ApiKeyManager(storageAccess, this.authManager);
 			this.scopedTokenManager = new ScopedTokenManager(store);
 			this.oauthSessionManager = new OauthSessionManager(store);
@@ -10471,6 +10375,8 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 		}
 	}
 	async onShutdown() {
+		this.signingKeyKeeper?.stop();
+		this.signingKeyKeeper = null;
 		if (this.reapTimer !== null) {
 			clearInterval(this.reapTimer);
 			this.reapTimer = null;
@@ -10486,13 +10392,13 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 //#endregion
 exports.ApiKeyManager = ApiKeyManager;
 exports.AuthManager = AuthManager;
-exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
+exports.FIRST_BOOT_ADMIN_PASSWORD = FIRST_BOOT_ADMIN_PASSWORD;
+exports.FIRST_BOOT_ADMIN_USERNAME = FIRST_BOOT_ADMIN_USERNAME;
 exports.LocalAuthAddon = LocalAuthAddon;
 exports.default = LocalAuthAddon;
 exports.ScopedTokenManager = ScopedTokenManager;
 exports.SettingsReadUnavailableError = SettingsReadUnavailableError;
 exports.UserManager = UserManager;
-exports.bootstrapSchema = bootstrapSchema;
 exports.isSettingsReadUnavailable = isSettingsReadUnavailable;
 Object.defineProperty(exports, "require_ms", {
 	enumerable: true,