@camstack/system 1.2.378 → 1.2.380

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { $ as buildStreamParamsConfigSchema, A as MINUTES_PER_DAY, C as FieldClaimModeSchema, Dn as runtimeStatePolicyFor, Gr as EventCategory, Hr as sleep$1, Kt as legacyAutoLinkIds, L as STREAM_PROFILE_META, Mn as siteZoneKey, Nt as formatMinutes, O as LocationIconIdSchema, Or as isDeviceConfigCap, Ot as expandContainer, Rr as resolveSecretMarkers, St as deviceStatusCapability, Tt as enumerateSchemaFields, Vr as secretTreeFromPaths, Wr as transformSecretWrite, Xt as locationIconKey, ar as DeviceFeature, bt as deviceManagerCapability, c as CAP_NAMES_WITH_STATUS, cn as normalizeUnit, cr as errMsg, dn as parseStreamParamsFormPatch, dt as createDeviceExtensionProvider, gr as WELL_KNOWN_TAB_MAP, gt as defineExtensionSlotProvider, lr as BaseAddon, o as CAMERA_SWITCH_ORDER, or as DeviceRole, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, v as DAY_NAMES, w as FieldClaimSchema, wt as enumerateItemArrayFields, x as DeviceStatusSchema, xr as collectZodSecretPaths, xt as deviceStateCapability, yt as deviceExtensionCapability } from "../../dist-Bvl5JgNt.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-BAcfvFtm.mjs";
+import { $ as buildStreamParamsConfigSchema, A as MINUTES_PER_DAY, C as FieldClaimModeSchema, Dn as runtimeStatePolicyFor, Hr as secretTreeFromPaths, Kr as transformSecretWrite, Kt as legacyAutoLinkIds, L as STREAM_PROFILE_META, Mn as siteZoneKey, Nt as formatMinutes, O as LocationIconIdSchema, Ot as expandContainer, Sr as collectZodSecretPaths, St as deviceStatusCapability, Tt as enumerateSchemaFields, Wr as sleep$1, Xt as locationIconKey, ar as DeviceFeature, bt as deviceManagerCapability, c as CAP_NAMES_WITH_STATUS, cn as normalizeUnit, cr as errMsg, dn as parseStreamParamsFormPatch, dt as createDeviceExtensionProvider, gr as WELL_KNOWN_TAB_MAP, gt as defineExtensionSlotProvider, kr as isDeviceConfigCap, lr as BaseAddon, o as CAMERA_SWITCH_ORDER, or as DeviceRole, qr as EventCategory, sr as DeviceType, t as ALL_CAPABILITY_DEFINITIONS, v as DAY_NAMES, w as FieldClaimSchema, wt as enumerateItemArrayFields, x as DeviceStatusSchema, xt as deviceStateCapability, yt as deviceExtensionCapability, zr as resolveSecretMarkers } from "../../dist-B9oFw2jh.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-DlZ3VV6x.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-Bvl5JgNt.mjs";
+import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-B9oFw2jh.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/keychain/index.js

@@ -3,7 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
+const require_jwt_signing_key = require("../../jwt-signing-key-C2rE3wH6.js");
+const require_cluster_secret = require("../../cluster-secret-Dg0OOOSr.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");
@@ -635,6 +637,14 @@ var KeychainRepository = class {
 		return rows.length;
 	}
 };
+//#endregion
+//#region src/builtins/keychain/system-held-secrets.ts
+/** The refs `keychain-admin.setSystemSecret` may write, by name. */
+var SYSTEM_HELD_SECRET_REFS = { "jwt-signing-key": require_jwt_signing_key.JWT_SIGNING_KEY_REF };
+/** System refs no blob points at — in use for as long as they exist. */
+var PROCESS_HELD_SECRET_REFS = new Set([require_jwt_signing_key.JWT_SIGNING_KEY_REF]);
+/** `system-settings` keys that may hold a system-owned secret's marker. */
+var SYSTEM_SECRET_SETTINGS_KEYS = [require_cluster_secret.CLUSTER_SECRET_SETTINGS_KEY];
 var KeychainLockedError = class extends Error {
 	reason;
 	constructor(reason) {
@@ -845,7 +855,11 @@ var KeychainService = class {
 		if (parts === null || !this.owns(caller, parts.owner)) throw new KeychainForbiddenError(ref, caller);
 		return parts.owner;
 	}
-	async put(caller, ref, value) {
+	/**
+	* @param actor who the audit names — the owner addon by default; the
+	*   operator (`user:<id>`) for {@link setSystemSecret}.
+	*/
+	async put(caller, ref, value, actor = actorOfAddon(caller)) {
 		const owner = this.ownerOf(ref, caller);
 		const unlocked = this.requireReady();
 		if (value.length === 0) throw new Error("keychain.put: an empty value is not stored — delete the ref");
@@ -871,10 +885,10 @@ var KeychainService = class {
 			version,
 			createdAt: existing?.createdAt ?? t,
 			updatedAt: t,
-			updatedBy: actorOfAddon(caller),
+			updatedBy: actor,
 			lastReadAt: existing?.lastReadAt ?? null
 		});
-		await this.audit("put", actorOfAddon(caller), ref, `version=${version}`);
+		await this.audit("put", actor, ref, `version=${version}`);
 		this.deps.events.emit({
 			ref,
 			owner,
@@ -1004,6 +1018,14 @@ var KeychainService = class {
 			usage: usage.get(row.ref) ?? "unknown"
 		}));
 	}
+	/**
+	* The operator replaces a system-held secret no form edits (D797) — the
+	* session signing key. Stored under owner `system`, audited as the user.
+	*/
+	async setSystemSecret(userId, name, value) {
+		const ref = SYSTEM_HELD_SECRET_REFS[name];
+		return this.put(require_jwt_signing_key.SYSTEM_SECRET_OWNER, ref, value, `user:${userId}`);
+	}
 	async listAudit(limit) {
 		return this.deps.repo.listAudit(limit);
 	}
@@ -1243,6 +1265,13 @@ async function prefixRows(door, collection, prefix) {
 }
 /** The blobs that may hold the marker of a ref in `scope`; `null` = cannot tell. */
 async function blobsFor(door, owner, scope) {
+	if (owner === "system" && scope.kind === "global") return [[...PROCESS_HELD_SECRET_REFS].map((ref) => ({
+		$secret: ref,
+		v: 1
+	})), ...await Promise.all(SYSTEM_SECRET_SETTINGS_KEYS.map((key) => door.get({
+		collection: "system-settings",
+		key
+	})))];
 	switch (scope.kind) {
 		case "global":
 		case "node": {
@@ -1424,6 +1453,7 @@ var KeychainAddon = class extends require_dist.BaseAddon {
 				listSecrets: () => service.listSecrets(),
 				listAudit: (input) => service.listAudit(input.limit ?? 100),
 				reveal: (input) => service.reveal(input.caller.userId, input.ref),
+				setSystemSecret: (input) => service.setSystemSecret(input.caller.userId, input.name, input.value),
 				deleteOrphans: (input) => service.deleteOrphans(input.caller.userId, input.refs),
 				rotateMasterKey: (input) => service.rotateMasterKey(input.caller.userId),
 				purgeRetiredKeys: async (input) => ({ purged: await service.purgeRetiredKeys(input.caller.userId) }),

package/dist/builtins/keychain/index.mjs

@@ -1,4 +1,6 @@
-import { Er as formatSecretScope, Fr as parseSecretRef, Gr as EventCategory, Gt as keychainCapability, Mr as normalizeSecretOwner, Wt as keychainAdminCapability, lr as BaseAddon } from "../../dist-Bvl5JgNt.mjs";
+import { Dr as formatSecretScope, Gt as keychainCapability, Ir as parseSecretRef, Nr as normalizeSecretOwner, Wt as keychainAdminCapability, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
+import { r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-Qhde8r82.mjs";
+import { i as CLUSTER_SECRET_SETTINGS_KEY } from "../../cluster-secret-BDue-uJj.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import * as path$1 from "node:path";
@@ -629,6 +631,14 @@ var KeychainRepository = class {
 		return rows.length;
 	}
 };
+//#endregion
+//#region src/builtins/keychain/system-held-secrets.ts
+/** The refs `keychain-admin.setSystemSecret` may write, by name. */
+var SYSTEM_HELD_SECRET_REFS = { "jwt-signing-key": JWT_SIGNING_KEY_REF };
+/** System refs no blob points at — in use for as long as they exist. */
+var PROCESS_HELD_SECRET_REFS = new Set([JWT_SIGNING_KEY_REF]);
+/** `system-settings` keys that may hold a system-owned secret's marker. */
+var SYSTEM_SECRET_SETTINGS_KEYS = [CLUSTER_SECRET_SETTINGS_KEY];
 var KeychainLockedError = class extends Error {
 	reason;
 	constructor(reason) {
@@ -839,7 +849,11 @@ var KeychainService = class {
 		if (parts === null || !this.owns(caller, parts.owner)) throw new KeychainForbiddenError(ref, caller);
 		return parts.owner;
 	}
-	async put(caller, ref, value) {
+	/**
+	* @param actor who the audit names — the owner addon by default; the
+	*   operator (`user:<id>`) for {@link setSystemSecret}.
+	*/
+	async put(caller, ref, value, actor = actorOfAddon(caller)) {
 		const owner = this.ownerOf(ref, caller);
 		const unlocked = this.requireReady();
 		if (value.length === 0) throw new Error("keychain.put: an empty value is not stored — delete the ref");
@@ -865,10 +879,10 @@ var KeychainService = class {
 			version,
 			createdAt: existing?.createdAt ?? t,
 			updatedAt: t,
-			updatedBy: actorOfAddon(caller),
+			updatedBy: actor,
 			lastReadAt: existing?.lastReadAt ?? null
 		});
-		await this.audit("put", actorOfAddon(caller), ref, `version=${version}`);
+		await this.audit("put", actor, ref, `version=${version}`);
 		this.deps.events.emit({
 			ref,
 			owner,
@@ -998,6 +1012,14 @@ var KeychainService = class {
 			usage: usage.get(row.ref) ?? "unknown"
 		}));
 	}
+	/**
+	* The operator replaces a system-held secret no form edits (D797) — the
+	* session signing key. Stored under owner `system`, audited as the user.
+	*/
+	async setSystemSecret(userId, name, value) {
+		const ref = SYSTEM_HELD_SECRET_REFS[name];
+		return this.put(SYSTEM_SECRET_OWNER, ref, value, `user:${userId}`);
+	}
 	async listAudit(limit) {
 		return this.deps.repo.listAudit(limit);
 	}
@@ -1237,6 +1259,13 @@ async function prefixRows(door, collection, prefix) {
 }
 /** The blobs that may hold the marker of a ref in `scope`; `null` = cannot tell. */
 async function blobsFor(door, owner, scope) {
+	if (owner === "system" && scope.kind === "global") return [[...PROCESS_HELD_SECRET_REFS].map((ref) => ({
+		$secret: ref,
+		v: 1
+	})), ...await Promise.all(SYSTEM_SECRET_SETTINGS_KEYS.map((key) => door.get({
+		collection: "system-settings",
+		key
+	})))];
 	switch (scope.kind) {
 		case "global":
 		case "node": {
@@ -1418,6 +1447,7 @@ var KeychainAddon = class extends BaseAddon {
 				listSecrets: () => service.listSecrets(),
 				listAudit: (input) => service.listAudit(input.limit ?? 100),
 				reveal: (input) => service.reveal(input.caller.userId, input.ref),
+				setSystemSecret: (input) => service.setSystemSecret(input.caller.userId, input.name, input.value),
 				deleteOrphans: (input) => service.deleteOrphans(input.caller.userId, input.refs),
 				rotateMasterKey: (input) => service.rotateMasterKey(input.caller.userId),
 				purgeRetiredKeys: async (input) => ({ purged: await service.purgeRetiredKeys(input.caller.userId) }),

package/dist/builtins/keychain/keychain-service.d.ts

@@ -1,4 +1,4 @@
-import { EventCategory, KeychainAuditEntry, KeychainKeySource, KeychainResolveResult, KeychainSecretMeta, KeychainSecretUsage, KeychainState, KeychainStatus, KeychainUnavailableReason } from '@camstack/types';
+import { EventCategory, KeychainAuditEntry, KeychainKeySource, KeychainResolveResult, KeychainSecretMeta, KeychainSecretUsage, KeychainState, KeychainStatus, KeychainUnavailableReason, SystemHeldSecretName } from '@camstack/types';
 import { KeychainRepository, KeychainSecretRow } from './keychain-store.js';
 import { KeySourceCandidate } from './key-sources.js';
 /** `lastReadAt` is written at most this often per ref (hub I/O is the bottleneck). */
@@ -54,7 +54,11 @@ export declare class KeychainService {
     /** May `caller` touch values owned by `owner`? */
     owns(caller: string | null, owner: string): boolean;
     private ownerOf;
-    put(caller: string | null, ref: string, value: string): Promise<{
+    /**
+     * @param actor who the audit names — the owner addon by default; the
+     *   operator (`user:<id>`) for {@link setSystemSecret}.
+     */
+    put(caller: string | null, ref: string, value: string, actor?: string): Promise<{
         ref: string;
         version: number;
     }>;
@@ -66,6 +70,14 @@ export declare class KeychainService {
     listSecrets(): Promise<readonly (KeychainSecretMeta & {
         usage: KeychainSecretUsage;
     })[]>;
+    /**
+     * The operator replaces a system-held secret no form edits (D797) — the
+     * session signing key. Stored under owner `system`, audited as the user.
+     */
+    setSystemSecret(userId: string, name: SystemHeldSecretName, value: string): Promise<{
+        ref: string;
+        version: number;
+    }>;
     listAudit(limit: number): Promise<readonly KeychainAuditEntry[]>;
     reveal(userId: string, ref: string): Promise<{
         value: string;

package/dist/builtins/keychain/system-held-secrets.d.ts

@@ -0,0 +1,11 @@
+import { SystemHeldSecretName } from '@camstack/types';
+import { SYSTEM_SECRET_OWNER } from '../../auth/jwt-signing-key.js';
+import { CLUSTER_SECRET_REF } from '../../kernel/moleculer/cluster-secret.js';
+export { SYSTEM_SECRET_OWNER };
+/** The refs `keychain-admin.setSystemSecret` may write, by name. */
+export declare const SYSTEM_HELD_SECRET_REFS: Readonly<Record<SystemHeldSecretName, string>>;
+/** System refs no blob points at — in use for as long as they exist. */
+export declare const PROCESS_HELD_SECRET_REFS: ReadonlySet<string>;
+/** `system-settings` keys that may hold a system-owned secret's marker. */
+export declare const SYSTEM_SECRET_SETTINGS_KEYS: readonly string[];
+export { CLUSTER_SECRET_REF };

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-KxsOMQik.js");
+const require_dist = require("../../dist-Cc6KOdY-.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { F as RecordingStatusSchema, Gr as EventCategory, N as RECORDING_SOURCE_CAMSTACK_ADDON, Sr as createEvent, cr as errMsg, lr as BaseAddon } from "../../dist-Bvl5JgNt.mjs";
+import { Cr as createEvent, F as RecordingStatusSchema, N as RECORDING_SOURCE_CAMSTACK_ADDON, cr as errMsg, lr as BaseAddon, qr as EventCategory } from "../../dist-B9oFw2jh.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/admin-account-boot.d.ts

@@ -21,7 +21,7 @@ export interface AdminAccountBootInput {
 }
 export interface AdminAccountBootResult {
     readonly outcome: AdminSeedOutcome;
-    /** The admin still signs in with {@link DEFAULT_ADMIN_PASSWORD}. */
+    /** The admin still signs in with {@link FIRST_BOOT_ADMIN_PASSWORD}. */
     readonly usesDefaultPassword: boolean;
 }
 export declare function reconcileAdminAccountAtBoot(input: AdminAccountBootInput): Promise<AdminAccountBootResult>;

package/dist/builtins/local-auth/auth-config-reader.d.ts

@@ -1,9 +1,13 @@
 import { AuthConfigReader } from '../../auth/auth-manager.js';
-/** The values `local-auth` pre-resolves before constructing its AuthManager. */
+/**
+ * The values `local-auth` pre-resolves before constructing its AuthManager.
+ *
+ * No credential is among them (D797): the session signing key lives in the
+ * keychain (`jwt-signing-key.ts`) and the first-boot admin is fixed
+ * (`admin` / `changeme`), so `auth.jwtSecret`, `auth.adminUsername` and
+ * `auth.adminPassword` are answered by nothing.
+ */
 export interface ResolvedAuthConfig {
-    readonly jwtSecret: string;
-    readonly adminUsername: string;
-    readonly adminPassword: string;
     /**
      * Operator-configured session lifetime. `undefined` when the `auth` section
      * carries no value — the signer then applies `DEFAULT_TOKEN_EXPIRY`, which
@@ -11,10 +15,8 @@ export interface ResolvedAuthConfig {
      */
     readonly tokenExpiry: string | undefined;
 }
-/** Persist the generated JWT secret. Called by AuthManager on first boot. */
-export type AuthSectionWriter = (patch: Record<string, unknown>) => void;
 /**
  * Every config path this reader can answer. Anything else resolves to
  * `undefined` by construction — see the module docblock.
  */
-export declare function createAuthConfigReader(resolved: ResolvedAuthConfig, writeAuthSection: AuthSectionWriter): AuthConfigReader;
+export declare function createAuthConfigReader(resolved: ResolvedAuthConfig): AuthConfigReader;

package/dist/builtins/local-auth/jwt-signing-key-keeper.d.ts

@@ -0,0 +1,30 @@
+import { SecretsAccess } from '@camstack/types';
+/** How often a locked keychain is asked again. */
+export declare const SIGNING_KEY_RETRY_MS = 30000;
+interface KeeperLogger {
+    info(message: string, meta?: {
+        meta?: Record<string, unknown>;
+    }): void;
+    error(message: string, meta?: {
+        meta?: Record<string, unknown>;
+    }): void;
+}
+export interface JwtSigningKeyKeeperDeps {
+    /** A keychain handle for owner `system`; `null` when this process has no keychain door. */
+    readonly secrets: SecretsAccess | null;
+    readonly logger: KeeperLogger;
+    readonly retryMs?: number;
+}
+export declare class JwtSigningKeyKeeper {
+    private readonly deps;
+    private retryTimer;
+    private unsubscribe;
+    private stopped;
+    constructor(deps: JwtSigningKeyKeeperDeps);
+    start(): Promise<void>;
+    stop(): void;
+    private load;
+    private apply;
+    private scheduleRetry;
+}
+export {};

package/dist/builtins/local-auth/local-auth.addon.d.ts

@@ -1,10 +1,5 @@
 import { ProviderRegistration, BaseAddon } from '@camstack/types';
-interface LocalAuthConfig {
-    jwtSecret?: string;
-    adminUsername?: string;
-    adminPassword?: string;
-}
-export declare class LocalAuthAddon extends BaseAddon<LocalAuthConfig> {
+export declare class LocalAuthAddon extends BaseAddon {
     private authManager;
     private userManager;
     private apiKeyManager;
@@ -13,6 +8,7 @@ export declare class LocalAuthAddon extends BaseAddon<LocalAuthConfig> {
     private reapTimer;
     private totpManager;
     private externalIdentities;
+    private signingKeyKeeper;
     constructor();
     protected onInitialize(): Promise<ProviderRegistration[]>;
     /**