@camstack/system 1.2.378 → 1.2.379

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,126 @@
-import { Dr as hydrateSchema, cr as errMsg, lr as BaseAddon } from "../../dist-Bvl5JgNt.mjs";
+import { Kr as transformSecretWrite, Or as hydrateSchema, Ur as secretTreeFromSchema, cr as errMsg, jr as isSecretMarker, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
+import { d as setProcessClusterSecretGate, l as hashClusterSecret, n as CLUSTER_SECRET_REF } from "../../cluster-secret-BDue-uJj.mjs";
+//#region src/builtins/system-config/cluster-secret-keeper.ts
+/**
+* Keeps the hub's cluster-secret gate in step with System → Cluster (D797).
+*
+* The field is a `password` of `system-config`: its `system-settings` row
+* (`cluster.clusterSecret`) holds a keychain marker, the value lives in the
+* keychain (owner `system`). The gate the `$hub.registerNode` handler reads:
+*
+*  - no marker            → `off` — every node may register, exactly as a hub
+*                           that never had a secret;
+*  - marker + value       → `on`  — nodes present the matching hash;
+*  - marker, no answer    → `unknown` — refused, retryably, and retried here.
+*    A locked keychain or a value lost to a reset NEVER opens the gate.
+*/
+/** The field key inside the `cluster` section. */
+var CLUSTER_SECRET_FIELD = "clusterSecret";
+var ClusterSecretKeeper = class {
+	deps;
+	retryTimer = null;
+	unsubscribe = null;
+	stopped = false;
+	last = null;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	async start() {
+		this.unsubscribe = this.deps.secrets?.onChange((ref) => {
+			if (ref === CLUSTER_SECRET_REF) this.reload();
+		}) ?? null;
+		await this.reload();
+	}
+	stop() {
+		this.stopped = true;
+		if (this.retryTimer !== null) clearTimeout(this.retryTimer);
+		this.retryTimer = null;
+		this.unsubscribe?.();
+		this.unsubscribe = null;
+	}
+	/** Re-read the row and the keychain; publish the gate. */
+	async reload() {
+		if (this.stopped) return;
+		const gate = await this.compute();
+		if (this.stopped) return;
+		setProcessClusterSecretGate(gate);
+		this.report(gate);
+		if (gate.kind === "unknown") this.scheduleRetry();
+	}
+	async compute() {
+		let stored;
+		try {
+			stored = (await this.deps.readSection())[CLUSTER_SECRET_FIELD];
+		} catch (err) {
+			return {
+				kind: "unknown",
+				reason: `settings unreadable: ${errText(err)}`
+			};
+		}
+		if (stored === void 0 || stored === null || stored === "") return { kind: "off" };
+		if (!isSecretMarker(stored)) return {
+			kind: "unknown",
+			reason: "stored inline, not in the keychain — set it again in System → Cluster"
+		};
+		const secrets = this.deps.secrets;
+		if (secrets === null) return {
+			kind: "unknown",
+			reason: "no keychain door in this process"
+		};
+		let entry;
+		try {
+			entry = (await secrets.resolve([CLUSTER_SECRET_REF]))[CLUSTER_SECRET_REF];
+		} catch (err) {
+			return {
+				kind: "unknown",
+				reason: errText(err)
+			};
+		}
+		if (entry === void 0) return {
+			kind: "unknown",
+			reason: "no-answer"
+		};
+		switch (entry.kind) {
+			case "value": return {
+				kind: "on",
+				hash: hashClusterSecret(entry.value)
+			};
+			case "unavailable": return {
+				kind: "unknown",
+				reason: entry.reason
+			};
+			case "missing": return {
+				kind: "unknown",
+				reason: "the stored value is gone — set it again in System → Cluster"
+			};
+			case "forbidden": return {
+				kind: "unknown",
+				reason: "forbidden"
+			};
+		}
+	}
+	report(gate) {
+		const changed = this.last !== gate.kind;
+		this.last = gate.kind;
+		if (gate.kind === "unknown") {
+			this.deps.logger.error("Agents cannot register: a cluster secret is set but cannot be read from the keychain. Registrations are refused until it can (no fallback).", { meta: { reason: gate.reason } });
+			return;
+		}
+		if (changed) this.deps.logger.info(gate.kind === "on" ? "Cluster secret set — agents must present it to register" : "No cluster secret set — any node may register");
+	}
+	scheduleRetry() {
+		if (this.stopped || this.retryTimer !== null) return;
+		this.retryTimer = setTimeout(() => {
+			this.retryTimer = null;
+			this.reload();
+		}, this.deps.retryMs ?? 3e4);
+		this.retryTimer.unref?.();
+	}
+};
+function errText(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.
@@ -12,6 +134,9 @@ import { Dr as hydrateSchema, cr as errMsg, lr as BaseAddon } from "../../dist-B
 * Sections exposed — this list is the whole of it:
 *   - server     (port, host, dataPath — READ-ONLY, loaded from config.yaml at bootstrap)
 *   - auth       (tokenExpiry)
+*   - cluster    (clusterSecret — a `password` field: the value goes to the
+*                 keychain, owner `system`; the row keeps a marker. Also drawn
+*                 on System → Cluster. D797)
 *
 * Sections NOT exposed (each owned by the addon that implements them):
 *   - logging    → `winston-logging` addon (level + retention)
@@ -40,75 +165,112 @@ import { Dr as hydrateSchema, cr as errMsg, lr as BaseAddon } from "../../dist-B
 /** Section key → user-facing section title. */
 var SECTION_TITLES = {
 	server: "Server",
-	auth: "Authentication"
+	auth: "Authentication",
+	cluster: "Cluster"
 };
+/** The keychain owner of the hub's own secrets (D797). */
+var SYSTEM_SECRET_OWNER = "system";
 /** Keys that map 1:1 to a given yml section — used by `updateGlobalSettings`
 *  to figure out which section owns each key in the incoming patch. */
 var KEY_TO_SECTION = {
 	port: "server",
 	host: "server",
 	dataPath: "server",
-	tokenExpiry: "auth"
+	tokenExpiry: "auth",
+	[CLUSTER_SECRET_FIELD]: "cluster"
 };
+/** The section id of the cluster form — System → Cluster renders only this one. */
+var SYSTEM_CONFIG_CLUSTER_SECTION_ID = "system-config-cluster";
 var SystemConfigAddon = class extends BaseAddon {
 	id = "system-config";
+	clusterSecretKeeper = null;
 	constructor() {
 		super({});
 	}
 	async onInitialize() {
+		this.clusterSecretKeeper = new ClusterSecretKeeper({
+			secrets: this.systemSecrets(),
+			readSection: async () => await this.ctx.settings?.getSection("cluster") ?? {},
+			logger: this.ctx.logger
+		});
+		await this.clusterSecretKeeper.start();
 		this.ctx.logger.info("Initialized — exposes yml-backed sections via getGlobalSettings");
 	}
+	async onShutdown() {
+		this.clusterSecretKeeper?.stop();
+		this.clusterSecretKeeper = null;
+	}
+	/** The keychain handle for owner `system`; `null` where there is no door. */
+	systemSecrets() {
+		const forOwner = this.ctx.secrets?.forOwner ?? null;
+		return forOwner === null ? null : forOwner(SYSTEM_SECRET_OWNER);
+	}
 	buildGlobalSchema() {
-		return { sections: [{
-			id: "system-config-server",
-			title: SECTION_TITLES["server"],
-			description: "Core server connection settings — read-only, loaded from config.yaml at bootstrap.",
-			columns: 2,
-			fields: [
-				{
-					type: "info",
-					key: "server-restart-note",
-					label: "Restart required",
-					content: "Server settings are read-only. Change them in config.yaml and restart.",
-					variant: "warning"
-				},
-				{
+		return { sections: [
+			{
+				id: "system-config-server",
+				title: SECTION_TITLES["server"],
+				description: "Core server connection settings — read-only, loaded from config.yaml at bootstrap.",
+				columns: 2,
+				fields: [
+					{
+						type: "info",
+						key: "server-restart-note",
+						label: "Restart required",
+						content: "Server settings are read-only. Change them in config.yaml and restart.",
+						variant: "warning"
+					},
+					{
+						type: "text",
+						key: "port",
+						label: "Port",
+						description: "Listening port",
+						disabled: true
+					},
+					{
+						type: "text",
+						key: "host",
+						label: "Host",
+						description: "Bind address",
+						disabled: true
+					},
+					{
+						type: "text",
+						key: "dataPath",
+						label: "Data Path",
+						description: "Root data directory",
+						disabled: true,
+						span: 2
+					}
+				]
+			},
+			{
+				id: "system-config-auth",
+				title: SECTION_TITLES["auth"],
+				description: "Token and session settings.",
+				columns: 1,
+				fields: [{
 					type: "text",
-					key: "port",
-					label: "Port",
-					description: "Listening port",
-					disabled: true
-				},
-				{
-					type: "text",
-					key: "host",
-					label: "Host",
-					description: "Bind address",
-					disabled: true
-				},
-				{
-					type: "text",
-					key: "dataPath",
-					label: "Data Path",
-					description: "Root data directory",
-					disabled: true,
-					span: 2
-				}
-			]
-		}, {
-			id: "system-config-auth",
-			title: SECTION_TITLES["auth"],
-			description: "Token and session settings.",
-			columns: 1,
-			fields: [{
-				type: "text",
-				key: "tokenExpiry",
-				label: "Token Expiry",
-				description: "Lifetime of a session token, as a duration string (e.g. 24h, 7d, 30d). A bare number is rejected — it would be read as milliseconds. Applies to tokens issued from the next login or silent refresh; tokens already handed out keep the lifetime they were signed with.",
-				placeholder: "30d",
-				default: "30d"
-			}]
-		}] };
+					key: "tokenExpiry",
+					label: "Token Expiry",
+					description: "Lifetime of a session token, as a duration string (e.g. 24h, 7d, 30d). A bare number is rejected — it would be read as milliseconds. Applies to tokens issued from the next login or silent refresh; tokens already handed out keep the lifetime they were signed with.",
+					placeholder: "30d",
+					default: "30d"
+				}]
+			},
+			{
+				id: SYSTEM_CONFIG_CLUSTER_SECTION_ID,
+				title: SECTION_TITLES["cluster"],
+				description: "Agents joining this hub. Optional: with no cluster secret, any node that reaches the hub may register.",
+				columns: 1,
+				fields: [{
+					type: "password",
+					key: CLUSTER_SECRET_FIELD,
+					label: "Cluster secret",
+					description: "When set, an agent must present it to register. Stored in the keychain. To pair an agent: Reveal and copy it here, then enter it in the agent at first run (its status page or the desktop setup window). Changing it disconnects agents that still hold the old one at their next registration."
+				}]
+			}
+		] };
 	}
 	async getGlobalSettings() {
 		const schema = this.buildGlobalSchema();
@@ -125,7 +287,7 @@ var SystemConfigAddon = class extends BaseAddon {
 			} });
 			throw err;
 		}
-		return hydrateSchema(schema, merged);
+		return hydrateSchema(schema, merged, { inlineSecretsAsViews: true });
 	}
 	async updateGlobalSettings(patch) {
 		if (!this.ctx.settings) throw new Error("system-config: ctx.settings not available — cannot write sections");
@@ -148,6 +310,10 @@ var SystemConfigAddon = class extends BaseAddon {
 			bucket[key] = value;
 		}
 		for (const [section, sectionPatch] of perSection) {
+			if (section === "cluster") {
+				await this.writeClusterSection(sectionPatch);
+				continue;
+			}
 			await this.ctx.settings.setSection(section, sectionPatch);
 			this.ctx.logger.info("Wrote keys to section", { meta: {
 				section,
@@ -155,6 +321,30 @@ var SystemConfigAddon = class extends BaseAddon {
 			} });
 		}
 	}
+	/**
+	* The cluster secret's save path: the value goes to the keychain (owner
+	* `system`), the row gets the marker; `''` / a view keeps, `$secretClear`
+	* clears. A value the keychain cannot store is REFUSED — never written
+	* inline (D787, P5).
+	*/
+	async writeClusterSection(patch) {
+		const settings = this.ctx.settings;
+		const secrets = this.systemSecrets();
+		if (secrets === null) throw new Error("system-config: no keychain door — the cluster secret cannot be stored");
+		const stored = await settings.getSection("cluster");
+		const result = await transformSecretWrite({
+			tree: secretTreeFromSchema(this.buildGlobalSchema()),
+			secrets,
+			patch,
+			stored,
+			operatorWrite: true
+		});
+		if (Object.keys(result.patch).length > 0) await settings.setSection("cluster", result.patch);
+		const { orphaned } = await result.afterWrite();
+		if (orphaned.length > 0) this.ctx.logger.warn("cluster secret cleared, but its old keychain value could not be deleted", { meta: { refs: orphaned } });
+		this.ctx.logger.info("Cluster secret updated");
+		await this.clusterSecretKeeper?.reload();
+	}
 };
 //#endregion
-export { SystemConfigAddon, SystemConfigAddon as default };
+export { SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default };

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-Bvl5JgNt.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{child-cap-dispatch-C9lmrWFT.js → child-cap-dispatch-CZeRUgYF.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-KxsOMQik.js");
+const require_dist = require("./dist-Cc6KOdY-.js");
 const require_proc_stat = require("./proc-stat-DL-WUOhl.js");
 require("./hub-cap-forward-COCmYaup.js");
 let node_crypto = require("node:crypto");

package/dist/{child-cap-dispatch-DpHovtQd.mjs → child-cap-dispatch-CpjohToR.mjs}

@@ -1,4 +1,4 @@
-import { Br as scrubKnownSecrets, Gr as EventCategory$1, Sr as createEvent, en as maskUrlCredentials } from "./dist-Bvl5JgNt.mjs";
+import { Cr as createEvent, Vr as scrubKnownSecrets, en as maskUrlCredentials, qr as EventCategory$1 } from "./dist-B9oFw2jh.mjs";
 import { a as parseProcStat, i as nodeProcReader } from "./proc-stat-CbC55Kqi.mjs";
 import "./hub-cap-forward-CH6_VWVO.mjs";
 import * as crypto$1 from "node:crypto";

package/dist/cluster-secret-BDue-uJj.mjs

@@ -0,0 +1,83 @@
+import { br as buildSecretRef } from "./dist-B9oFw2jh.mjs";
+import { createHash, timingSafeEqual } from "node:crypto";
+//#region src/kernel/moleculer/cluster-secret.ts
+/**
+* Cluster-secret registration gate (opt-in). A registering node sends a
+* SHA-256 hash of its cluster secret; the receiver of a `registerNode` RPC
+* verifies it. The raw secret is never transmitted.
+*
+* Where the secret lives (D797) — never in an environment variable:
+*  - the HUB: the keychain, owner `system` ({@link CLUSTER_SECRET_REF}), set
+*    from System → Cluster (a `password` field of `system-config`, whose
+*    `system-settings` row {@link CLUSTER_SECRET_SETTINGS_KEY} holds the
+*    marker). Empty = the gate is off, exactly as a hub without a secret
+*    always was;
+*  - an AGENT: its bootstrap credential, entered at pairing / first run and
+*    kept in its own `agent.json` (0600) — or, in the desktop app, in the OS
+*    keychain — because it needs it before it can reach the hub.
+*/
+/** The keychain ref of the hub's cluster secret: `secret://system/global/clusterSecret`. */
+var CLUSTER_SECRET_REF = buildSecretRef({
+	owner: "system",
+	scope: { kind: "global" },
+	fieldPath: "clusterSecret"
+});
+/** The `system-settings` key whose value is the cluster secret's keychain marker. */
+var CLUSTER_SECRET_SETTINGS_KEY = "cluster.clusterSecret";
+/** Moleculer error `type` marking a registration rejected for a bad cluster secret. */
+var CLUSTER_SECRET_MISMATCH_TYPE = "CLUSTER_SECRET_MISMATCH";
+/** Process exit code a runner uses when its registration is rejected for a bad secret. */
+var CLUSTER_SECRET_REJECTED_EXIT_CODE = 78;
+/** SHA-256 hex digest of a cluster secret. Never transmit or log the raw secret. */
+function hashClusterSecret(secret) {
+	return createHash("sha256").update(secret, "utf8").digest("hex");
+}
+/**
+* True if a registration carrying `presentedHash` is allowed against a
+* receiver whose own secret hashes to `expectedHash`.
+* - `expectedHash` undefined → the gate is OFF; everything is allowed.
+* - otherwise `presentedHash` must be present and equal (constant-time).
+*/
+function clusterSecretMatches(expectedHash, presentedHash) {
+	if (expectedHash === void 0) return true;
+	if (presentedHash === void 0 || presentedHash.length !== expectedHash.length) return false;
+	return timingSafeEqual(Buffer.from(expectedHash), Buffer.from(presentedHash));
+}
+/** Recognises a cluster-secret rejection, including after a Moleculer RPC round-trip. */
+function isClusterSecretMismatchError(err) {
+	if (typeof err !== "object" || err === null || !("type" in err)) return false;
+	const { type } = err;
+	return type === CLUSTER_SECRET_MISMATCH_TYPE;
+}
+/** Moleculer error `type` of a registration refused because the hub cannot read its own secret yet. */
+var CLUSTER_SECRET_UNAVAILABLE_TYPE = "CLUSTER_SECRET_UNAVAILABLE";
+function checkClusterSecret(gate, presentedHash) {
+	switch (gate.kind) {
+		case "off": return "allow";
+		case "unknown": return "unavailable";
+		case "on": return clusterSecretMatches(gate.hash, presentedHash) ? "allow" : "mismatch";
+	}
+}
+var GATE_SLOT = Symbol.for("camstack.cluster.secret-gate");
+var NOT_LOADED = {
+	kind: "unknown",
+	reason: "not-loaded"
+};
+function isGate(value) {
+	if (value === null || typeof value !== "object") return false;
+	const kind = Reflect.get(value, "kind");
+	if (kind === "off") return true;
+	if (kind === "on") return typeof Reflect.get(value, "hash") === "string";
+	return kind === "unknown" && typeof Reflect.get(value, "reason") === "string";
+}
+/** Register the hub's gate. Called by `system-config`, which owns the field. */
+function setProcessClusterSecretGate(gate) {
+	Reflect.set(globalThis, GATE_SLOT, gate);
+}
+/** The hub's gate; `unknown` until `system-config` loaded it. */
+function getProcessClusterSecretGate() {
+	const value = Reflect.get(globalThis, GATE_SLOT);
+	return isGate(value) ? value : NOT_LOADED;
+}
+//#endregion
+export { CLUSTER_SECRET_UNAVAILABLE_TYPE as a, getProcessClusterSecretGate as c, setProcessClusterSecretGate as d, CLUSTER_SECRET_SETTINGS_KEY as i, hashClusterSecret as l, CLUSTER_SECRET_REF as n, checkClusterSecret as o, CLUSTER_SECRET_REJECTED_EXIT_CODE as r, clusterSecretMatches as s, CLUSTER_SECRET_MISMATCH_TYPE as t, isClusterSecretMismatchError as u };

package/dist/cluster-secret-Dg0OOOSr.js

@@ -0,0 +1,148 @@
+const require_dist = require("./dist-Cc6KOdY-.js");
+let node_crypto = require("node:crypto");
+//#region src/kernel/moleculer/cluster-secret.ts
+/**
+* Cluster-secret registration gate (opt-in). A registering node sends a
+* SHA-256 hash of its cluster secret; the receiver of a `registerNode` RPC
+* verifies it. The raw secret is never transmitted.
+*
+* Where the secret lives (D797) — never in an environment variable:
+*  - the HUB: the keychain, owner `system` ({@link CLUSTER_SECRET_REF}), set
+*    from System → Cluster (a `password` field of `system-config`, whose
+*    `system-settings` row {@link CLUSTER_SECRET_SETTINGS_KEY} holds the
+*    marker). Empty = the gate is off, exactly as a hub without a secret
+*    always was;
+*  - an AGENT: its bootstrap credential, entered at pairing / first run and
+*    kept in its own `agent.json` (0600) — or, in the desktop app, in the OS
+*    keychain — because it needs it before it can reach the hub.
+*/
+/** The keychain ref of the hub's cluster secret: `secret://system/global/clusterSecret`. */
+var CLUSTER_SECRET_REF = require_dist.buildSecretRef({
+	owner: "system",
+	scope: { kind: "global" },
+	fieldPath: "clusterSecret"
+});
+/** The `system-settings` key whose value is the cluster secret's keychain marker. */
+var CLUSTER_SECRET_SETTINGS_KEY = "cluster.clusterSecret";
+/** Moleculer error `type` marking a registration rejected for a bad cluster secret. */
+var CLUSTER_SECRET_MISMATCH_TYPE = "CLUSTER_SECRET_MISMATCH";
+/** Process exit code a runner uses when its registration is rejected for a bad secret. */
+var CLUSTER_SECRET_REJECTED_EXIT_CODE = 78;
+/** SHA-256 hex digest of a cluster secret. Never transmit or log the raw secret. */
+function hashClusterSecret(secret) {
+	return (0, node_crypto.createHash)("sha256").update(secret, "utf8").digest("hex");
+}
+/**
+* True if a registration carrying `presentedHash` is allowed against a
+* receiver whose own secret hashes to `expectedHash`.
+* - `expectedHash` undefined → the gate is OFF; everything is allowed.
+* - otherwise `presentedHash` must be present and equal (constant-time).
+*/
+function clusterSecretMatches(expectedHash, presentedHash) {
+	if (expectedHash === void 0) return true;
+	if (presentedHash === void 0 || presentedHash.length !== expectedHash.length) return false;
+	return (0, node_crypto.timingSafeEqual)(Buffer.from(expectedHash), Buffer.from(presentedHash));
+}
+/** Recognises a cluster-secret rejection, including after a Moleculer RPC round-trip. */
+function isClusterSecretMismatchError(err) {
+	if (typeof err !== "object" || err === null || !("type" in err)) return false;
+	const { type } = err;
+	return type === CLUSTER_SECRET_MISMATCH_TYPE;
+}
+/** Moleculer error `type` of a registration refused because the hub cannot read its own secret yet. */
+var CLUSTER_SECRET_UNAVAILABLE_TYPE = "CLUSTER_SECRET_UNAVAILABLE";
+function checkClusterSecret(gate, presentedHash) {
+	switch (gate.kind) {
+		case "off": return "allow";
+		case "unknown": return "unavailable";
+		case "on": return clusterSecretMatches(gate.hash, presentedHash) ? "allow" : "mismatch";
+	}
+}
+var GATE_SLOT = Symbol.for("camstack.cluster.secret-gate");
+var NOT_LOADED = {
+	kind: "unknown",
+	reason: "not-loaded"
+};
+function isGate(value) {
+	if (value === null || typeof value !== "object") return false;
+	const kind = Reflect.get(value, "kind");
+	if (kind === "off") return true;
+	if (kind === "on") return typeof Reflect.get(value, "hash") === "string";
+	return kind === "unknown" && typeof Reflect.get(value, "reason") === "string";
+}
+/** Register the hub's gate. Called by `system-config`, which owns the field. */
+function setProcessClusterSecretGate(gate) {
+	Reflect.set(globalThis, GATE_SLOT, gate);
+}
+/** The hub's gate; `unknown` until `system-config` loaded it. */
+function getProcessClusterSecretGate() {
+	const value = Reflect.get(globalThis, GATE_SLOT);
+	return isGate(value) ? value : NOT_LOADED;
+}
+//#endregion
+Object.defineProperty(exports, "CLUSTER_SECRET_MISMATCH_TYPE", {
+	enumerable: true,
+	get: function() {
+		return CLUSTER_SECRET_MISMATCH_TYPE;
+	}
+});
+Object.defineProperty(exports, "CLUSTER_SECRET_REF", {
+	enumerable: true,
+	get: function() {
+		return CLUSTER_SECRET_REF;
+	}
+});
+Object.defineProperty(exports, "CLUSTER_SECRET_REJECTED_EXIT_CODE", {
+	enumerable: true,
+	get: function() {
+		return CLUSTER_SECRET_REJECTED_EXIT_CODE;
+	}
+});
+Object.defineProperty(exports, "CLUSTER_SECRET_SETTINGS_KEY", {
+	enumerable: true,
+	get: function() {
+		return CLUSTER_SECRET_SETTINGS_KEY;
+	}
+});
+Object.defineProperty(exports, "CLUSTER_SECRET_UNAVAILABLE_TYPE", {
+	enumerable: true,
+	get: function() {
+		return CLUSTER_SECRET_UNAVAILABLE_TYPE;
+	}
+});
+Object.defineProperty(exports, "checkClusterSecret", {
+	enumerable: true,
+	get: function() {
+		return checkClusterSecret;
+	}
+});
+Object.defineProperty(exports, "clusterSecretMatches", {
+	enumerable: true,
+	get: function() {
+		return clusterSecretMatches;
+	}
+});
+Object.defineProperty(exports, "getProcessClusterSecretGate", {
+	enumerable: true,
+	get: function() {
+		return getProcessClusterSecretGate;
+	}
+});
+Object.defineProperty(exports, "hashClusterSecret", {
+	enumerable: true,
+	get: function() {
+		return hashClusterSecret;
+	}
+});
+Object.defineProperty(exports, "isClusterSecretMismatchError", {
+	enumerable: true,
+	get: function() {
+		return isClusterSecretMismatchError;
+	}
+});
+Object.defineProperty(exports, "setProcessClusterSecretGate", {
+	enumerable: true,
+	get: function() {
+		return setProcessClusterSecretGate;
+	}
+});

package/dist/{composition-sources-CxhGdtdh.js → composition-sources-CHvLMrFI.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-KxsOMQik.js");
+const require_dist = require("./dist-Cc6KOdY-.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-BLBd338N.mjs → composition-sources-DT_uJwI3.mjs}

@@ -1,4 +1,4 @@
-import { cr as errMsg, tr as compositionSourceKey } from "./dist-Bvl5JgNt.mjs";
+import { cr as errMsg, tr as compositionSourceKey } from "./dist-B9oFw2jh.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation