@camstack/system 1.2.378 → 1.2.380

package/dist/index.js

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-KxsOMQik.js");
+const require_dist = require("./dist-Cc6KOdY-.js");
+const require_jwt_signing_key = require("./jwt-signing-key-C2rE3wH6.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -26,12 +27,13 @@ const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage
 const require_hub_cap_forward = require("./hub-cap-forward-COCmYaup.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
+const require_cluster_secret = require("./cluster-secret-Dg0OOOSr.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
-const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-CbSmCWkp.js");
+const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-mk6WGxir.js");
 const require_tls$1 = require("./tls-CCMX7MjX.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-C9lmrWFT.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-CZeRUgYF.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-BgWGRxN5.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
@@ -7769,6 +7771,157 @@ function createDoorSettingsView(addonId, door, sections) {
 	};
 }
 //#endregion
+//#region src/kernel/config-schema.ts
+/** Default data directory — used when CAMSTACK_DATA env var is not set */
+var DEFAULT_DATA_PATH = "camstack-data";
+/**
+* A list of browser origins from config.yaml (a YAML list) or from the
+* `CAMSTACK_CORS_ORIGINS` env var (one comma-separated string — env carries
+* only strings). Validation of each entry is the CORS policy's job
+* (`server/backend/src/api/cors/cors-policy.ts`), which logs what it rejects;
+* the schema only fixes the SHAPE so a typo cannot stop the hub from booting.
+*/
+var originListSchema = zod.z.preprocess((value) => typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) : value, zod.z.array(zod.z.string()));
+var serverSchema = zod.z.object({
+	port: zod.z.number().default(4443),
+	host: zod.z.string().default("0.0.0.0"),
+	dataPath: zod.z.string().default(DEFAULT_DATA_PATH),
+	/**
+	* EXTRA browser origins allowed to call this hub cross-origin (D707), on
+	* top of the built-ins: the hub's own origin, the hosted viewer PWA and the
+	* native app's opaque `null` origin. Bootstrap-owned on purpose — widening
+	* who may read hub responses in a browser is a security decision, and the
+	* policy is live from the first request, before the settings store exists.
+	*/
+	corsOrigins: originListSchema.default([])
+});
+/**
+* The bootstrap `auth` section holds NO credential (D797): the session signing
+* key lives in the keychain, and a fresh hub seeds `admin` / `changeme`
+* (`FIRST_BOOT_ADMIN_*`). The retired keys `jwtSecret`, `adminUsername` and
+* `adminPassword` are stripped when a legacy config.yaml still carries them —
+* the boot warns so the operator removes them (the one-off ops script imports
+* a `jwtSecret` into the keychain first).
+*/
+var authSchema = zod.z.object({});
+var hubSchema = zod.z.object({
+	url: zod.z.string().default("ws://localhost:4443/agent"),
+	token: zod.z.string().default("")
+});
+var agentSchema = zod.z.object({
+	name: zod.z.string().default(""),
+	/** Port for the agent status page (minimal HTML) */
+	statusPort: zod.z.number().default(4444)
+});
+var tlsSchema = zod.z.object({ 
+/**
+* Enable HTTPS (default: true). The certificate itself is never configured
+* here: the admin UI (Network → Local access) generates or uploads it
+* (D726), and boot serves whatever `tls/mode` says.
+*/
+enabled: zod.z.boolean().default(true) });
+/**
+* Bootstrap-time addon configuration — read PURELY from YAML, before the
+* kernel can talk to the settings-store. This breaks the chicken-and-egg
+* where the settings store itself is implemented by an addon: the kernel
+* needs to know WHICH addon to load first to provide the store, and that
+* decision can't itself live in the store.
+*
+* Backward-compatible: every field is optional + defaults reproduce the
+* current hard-coded behavior. Existing config.yaml files keep working.
+*/
+var bootstrapAddonsSchema = zod.z.object({
+	/**
+	* Addon implementing the `settings-store` capability. Loaded FIRST,
+	* before any other addon is enabled — every other addon's enable
+	* state, settings, and ordering lives in the store it provides.
+	*
+	* Default: '@camstack/addon-sqlite-storage' (the workspace's
+	* default SQLite-backed store). Future alternatives could swap this
+	* for postgres/redis without touching kernel code.
+	*/
+	settingsStoreAddon: zod.z.string().default("@camstack/addon-sqlite-storage"),
+	/**
+	* How the launcher provisions REQUIRED_PACKAGES into `data/addons/`
+	* on startup.
+	*
+	*   - `'npm'`     — pull from the npm registry (production default).
+	*   - `'local'`   — copy `packages/<X>/` from the workspace into
+	*                   `data/addons/<X>/`. Use for the Electron-
+	*                   packaged bundle and the e2e harness.
+	*   - `'symlink'` — point `data/addons/<X>` at the workspace source
+	*                   dir via a directory symlink. Dev-only: a
+	*                   workspace rebuild (`npm run build -w <X>`) is
+	*                   immediately reflected at the next addon load,
+	*                   no copy step. Falls back to `'local'` on
+	*                   platforms that reject symlink creation (Windows
+	*                   without developer-mode).
+	*
+	* The `CAMSTACK_INSTALL_SOURCE` env var, when set, wins over this
+	* field. Leave undefined to keep the launcher's default behaviour
+	* (npm when no workspace, local when a bundled addons dir is
+	* present, …).
+	*/
+	installSource: zod.z.enum([
+		"npm",
+		"local",
+		"symlink"
+	]).optional(),
+	/**
+	* Override the kernel's hard-coded `AddonInstaller.REQUIRED_PACKAGES`.
+	* Passing an array here REPLACES the default list entirely — useful
+	* for stripped-down deployments (only the bundle of addons the
+	* operator actually wants) and for forcing a different storage
+	* backend at first boot.
+	*
+	* Leave undefined to use the kernel-shipped defaults.
+	*/
+	requiredAddons: zod.z.array(zod.z.string()).optional(),
+	/**
+	* Disable list applied AFTER the settings-store reports the enabled
+	* set. Operator escape hatch — boot without a known-broken addon
+	* without having to mutate the store.
+	*/
+	forceDisable: zod.z.array(zod.z.string()).default([])
+});
+/**
+* Where the keychain's master key lives (D788). config.yaml ONLY: no env var
+* maps here, and the settings store may not answer it
+* (`BOOTSTRAP_OWNED_SECTIONS`). Absent → the desktop OS keychain when the hub
+* runs inside the desktop app, else `<dataDir>/.keychain/master.key`.
+*/
+var keychainSchema = zod.z.object({
+	/** A file holding 32 random bytes, base64 (or hex). Keep it OFF the data volume. */
+	keyFile: zod.z.string().min(1).optional(),
+	/**
+	* The key being rotated away from — consulted only to UNLOCK, so a move to a
+	* new key file is: new file, old one here, restart, rotate, remove this.
+	*/
+	previousKeyFile: zod.z.string().min(1).optional()
+});
+/** Bootstrap config -- loaded from config.yaml ONLY at startup.
+*  All other settings live in SQL (system_settings table). */
+var bootstrapSchema = zod.z.object({
+	/** Server mode: 'hub' (full server) or 'agent' (worker node) */
+	mode: zod.z.enum(["hub", "agent"]).default("hub"),
+	server: serverSchema.default(serverSchema.parse({})),
+	auth: authSchema.default(authSchema.parse({})),
+	/** Hub connection config — only used when mode='agent' */
+	hub: hubSchema.default(hubSchema.parse({})),
+	/** Agent-specific config — only used when mode='agent' */
+	agent: agentSchema.default(agentSchema.parse({})),
+	/** TLS configuration */
+	tls: tlsSchema.default(tlsSchema.parse({})),
+	/**
+	* Addon bootstrap directives — minimum addon set needed before the
+	* kernel can reach the settings-store. See bootstrapAddonsSchema.
+	* Spec: docs/superpowers/specs/2026-05-15-yaml-bootstrap-expansion.md
+	*/
+	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({})),
+	/** Keychain master-key location (config.yaml only). */
+	keychain: keychainSchema.default({})
+});
+//#endregion
 //#region ../../node_modules/js-yaml/dist/js-yaml.mjs
 /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */
 var __create = Object.create;
@@ -10123,15 +10276,12 @@ var ENV_VAR_MAP = {
 	CAMSTACK_PORT: "server.port",
 	CAMSTACK_HOST: "server.host",
 	CAMSTACK_DATA: "server.dataPath",
-	CAMSTACK_JWT_SECRET: "auth.jwtSecret",
-	CAMSTACK_ADMIN_USER: "auth.adminUsername",
-	CAMSTACK_ADMIN_PASS: "auth.adminPassword",
 	CAMSTACK_CORS_ORIGINS: "server.corsOrigins"
 };
 /** config.yaml, env overrides applied, parsed. */
 function loadBootstrapConfig(configPath) {
 	const merged = applyEnvOverrides((0, _camstack_types_addon.asJsonObject)(loadYaml(configPath)) ?? {});
-	return require_builtins_local_auth_local_auth_addon.bootstrapSchema.parse(merged);
+	return bootstrapSchema.parse(merged);
 }
 function writeBootstrapSection(configPath, section, data) {
 	if (!BOOTSTRAP_SECTIONS.has(section)) throw new Error(`[ConfigManager] Section "${section}" is a runtime setting — use setSection() to persist via the settings-store, not update() which writes to config.yaml`);
@@ -10142,7 +10292,7 @@ function writeBootstrapSection(configPath, section, data) {
 		...existing,
 		...data
 	};
-	const validation = require_builtins_local_auth_local_auth_addon.bootstrapSchema.safeParse(raw);
+	const validation = bootstrapSchema.safeParse(raw);
 	if (!validation.success) throw new Error(`[ConfigManager] Invalid config update for section "${section}": ${validation.error.message}`);
 	const tmpPath = `${configPath}.tmp`;
 	node_fs.writeFileSync(tmpPath, dump(raw, {
@@ -10315,16 +10465,14 @@ function createStoreSettingsView(addonId, cm) {
 * Which `system-settings` keys the STORE may answer, and which the kernel
 * loads from the door into memory at boot — D675.
 *
-* ## The store never outranks env + config.yaml for a bootstrap section
+* ## The store never answers for a bootstrap section
 *
-* `system-settings` holds, among other things, `auth.jwtSecret`,
-* `auth.adminUsername` and `auth.adminPassword` — written there by
-* `local-auth` (and by older builds) next to `auth.tokenExpiry`. The live
-* container supplies the same three from env (`CAMSTACK_JWT_SECRET`,
-* `CAMSTACK_ADMIN_USER`, `CAMSTACK_ADMIN_PASS`). While the store layer was
-* skipped (every read since D231) env won by accident. Merging the store back
-* in "highest priority" would let a stale DB copy replace the JWT secret —
-* invalidating every token — and change the login password.
+* `system-settings` may still hold `auth.jwtSecret`, `auth.adminUsername` and
+* `auth.adminPassword` — written there by `local-auth` (and by older builds)
+* next to `auth.tokenExpiry`. Since D797 none of the three is a setting at
+* all (the signing key is the keychain's, the first-boot admin is fixed), and
+* the stale rows must still never answer: merging them back in would let a
+* stale DB copy stand in for a credential. The one-off ops script deletes them.
 *
 * So a bootstrap-owned section is answered from env + config.yaml ONLY, and
 * the store may add exactly the keys in {@link STORE_READABLE_BOOTSTRAP_KEYS}:
@@ -10583,7 +10731,7 @@ var ConfigManager = class {
 	* implementation (sqlite, redis, in-memory, …) behaves identically here.
 	*
 	* D675: a bootstrap-owned section takes ONLY allow-listed keys from the
-	* store (a stored `auth.jwtSecret` never replaces env), and with only the
+	* store (a stale stored `auth.jwtSecret` never answers), and with only the
 	* door wired this sync read THROWS — the settings view's `getSection` reads
 	* the door.
 	*/
@@ -94272,7 +94420,7 @@ function resolveUseHostname() {
 	return process.env["CAMSTACK_MOLECULER_USE_HOSTNAME"] !== "false";
 }
 function createBroker(config) {
-	const { nodeID, mode, hubAddress, logLevel = "warn", secret, tcpPort = DEFAULT_HUB_TCP_PORT, udpPort = DEFAULT_UDP_PORT } = config;
+	const { nodeID, mode, hubAddress, logLevel = "warn", tcpPort = DEFAULT_HUB_TCP_PORT, udpPort = DEFAULT_UDP_PORT } = config;
 	const useHostname = resolveUseHostname();
 	const infraLevel = "error";
 	const wildcardLevel = logLevel;
@@ -94294,7 +94442,6 @@ function createBroker(config) {
 	};
 	if (mode === "hub") return new ServiceBroker({
 		nodeID,
-		namespace: secret || void 0,
 		serializer: "MsgPack",
 		transporter: {
 			type: "TCP",
@@ -94337,7 +94484,6 @@ function createBroker(config) {
 	}
 	return new ServiceBroker({
 		nodeID,
-		namespace: secret || void 0,
 		serializer: "MsgPack",
 		transporter: {
 			type: "TCP",
@@ -94495,38 +94641,6 @@ var HubLogForwarder = class {
 	}
 };
 //#endregion
-//#region src/kernel/moleculer/cluster-secret.ts
-/**
-* Cluster-secret registration gate (opt-in). A registering node sends a
-* SHA-256 hash of its `CAMSTACK_CLUSTER_SECRET`; the receiver of a
-* `registerNode` RPC verifies it. The raw secret is never transmitted.
-*/
-/** Moleculer error `type` marking a registration rejected for a bad cluster secret. */
-var CLUSTER_SECRET_MISMATCH_TYPE = "CLUSTER_SECRET_MISMATCH";
-/** Process exit code a runner uses when its registration is rejected for a bad secret. */
-var CLUSTER_SECRET_REJECTED_EXIT_CODE = 78;
-/** SHA-256 hex digest of a cluster secret. Never transmit or log the raw secret. */
-function hashClusterSecret(secret) {
-	return (0, node_crypto.createHash)("sha256").update(secret, "utf8").digest("hex");
-}
-/**
-* True if a registration carrying `presentedHash` is allowed against a
-* receiver whose own secret hashes to `expectedHash`.
-* - `expectedHash` undefined → the gate is OFF; everything is allowed.
-* - otherwise `presentedHash` must be present and equal (constant-time).
-*/
-function clusterSecretMatches(expectedHash, presentedHash) {
-	if (expectedHash === void 0) return true;
-	if (presentedHash === void 0 || presentedHash.length !== expectedHash.length) return false;
-	return (0, node_crypto.timingSafeEqual)(Buffer.from(expectedHash), Buffer.from(presentedHash));
-}
-/** Recognises a cluster-secret rejection, including after a Moleculer RPC round-trip. */
-function isClusterSecretMismatchError(err) {
-	if (typeof err !== "object" || err === null || !("type" in err)) return false;
-	const { type } = err;
-	return type === CLUSTER_SECRET_MISMATCH_TYPE;
-}
-//#endregion
 //#region src/kernel/moleculer/hub-service.ts
 function createHubService(deps) {
 	return {
@@ -94550,7 +94664,9 @@ function createHubService(deps) {
 				return true;
 			} },
 			registerNode: { handler(ctx) {
-				if (!clusterSecretMatches(deps.expectedClusterSecretHash, ctx.params.clusterSecretHash)) throw new Errors.MoleculerError(`cluster secret mismatch — node "${ctx.params.nodeId}" rejected`, 403, CLUSTER_SECRET_MISMATCH_TYPE);
+				const verdict = require_cluster_secret.checkClusterSecret(deps.clusterSecretGate?.() ?? { kind: "off" }, ctx.params.clusterSecretHash);
+				if (verdict === "mismatch") throw new Errors.MoleculerError(`cluster secret mismatch — node "${ctx.params.nodeId}" rejected`, 403, require_cluster_secret.CLUSTER_SECRET_MISMATCH_TYPE);
+				if (verdict === "unavailable") throw new Errors.MoleculerRetryableError(`the hub cannot read its cluster secret yet — node "${ctx.params.nodeId}" must retry`, 503, require_cluster_secret.CLUSTER_SECRET_UNAVAILABLE_TYPE);
 				deps.onRegisterNode?.(ctx.params);
 				return { ok: true };
 			} },
@@ -94754,7 +94870,7 @@ async function callRegisterNodeWithRetry(broker, params, opts) {
 			if (attempt > 0) opts.log?.(`[register-node] ${action} acked after ${attempt + 1} attempt(s)`);
 			return;
 		} catch (err) {
-			if (isClusterSecretMismatchError(err)) {
+			if (require_cluster_secret.isClusterSecretMismatchError(err)) {
 				opts.log?.(`[register-node] ${action} REJECTED — cluster secret mismatch; not retrying`);
 				throw err;
 			}
@@ -96347,8 +96463,11 @@ exports.CAP_ACTION_UNLABELLED = require_child_cap_dispatch.CAP_ACTION_UNLABELLED
 exports.CAP_METHOD_NOT_IMPLEMENTED = require_child_cap_dispatch.CAP_METHOD_NOT_IMPLEMENTED;
 exports.CA_COMMON_NAME = require_tls$1.CA_COMMON_NAME;
 exports.CA_VALIDITY_DAYS = require_tls$1.CA_VALIDITY_DAYS;
-exports.CLUSTER_SECRET_MISMATCH_TYPE = CLUSTER_SECRET_MISMATCH_TYPE;
-exports.CLUSTER_SECRET_REJECTED_EXIT_CODE = CLUSTER_SECRET_REJECTED_EXIT_CODE;
+exports.CLUSTER_SECRET_MISMATCH_TYPE = require_cluster_secret.CLUSTER_SECRET_MISMATCH_TYPE;
+exports.CLUSTER_SECRET_REF = require_cluster_secret.CLUSTER_SECRET_REF;
+exports.CLUSTER_SECRET_REJECTED_EXIT_CODE = require_cluster_secret.CLUSTER_SECRET_REJECTED_EXIT_CODE;
+exports.CLUSTER_SECRET_SETTINGS_KEY = require_cluster_secret.CLUSTER_SECRET_SETTINGS_KEY;
+exports.CLUSTER_SECRET_UNAVAILABLE_TYPE = require_cluster_secret.CLUSTER_SECRET_UNAVAILABLE_TYPE;
 exports.CORE_CAP_SERVICE_NAME = CORE_CAP_SERVICE_NAME;
 exports.CalendarsAddon = require_builtins_calendars_calendars_addon.CalendarsAddon;
 exports.CapRouteError = require_child_cap_dispatch.CapRouteError;
@@ -96365,7 +96484,7 @@ exports.ConsoleLoggingAddon = require_builtins_console_logging_index.ConsoleLogg
 exports.CoreBlocksAddon = require_builtins_core_blocks_core_blocks_addon.CoreBlocksAddon;
 exports.CustomActionRegistry = require_custom_action_registry.CustomActionRegistry;
 exports.DECISIVE_HEAP_SPACES = require_child_cap_dispatch.DECISIVE_HEAP_SPACES;
-exports.DEFAULT_DATA_PATH = require_builtins_local_auth_local_auth_addon.DEFAULT_DATA_PATH;
+exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
 exports.DEFAULT_LAN_HTTP_PORT = require_tls$1.DEFAULT_LAN_HTTP_PORT;
 exports.DEFAULT_LOG_LEVEL = DEFAULT_LOG_LEVEL;
 exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = require_dist.DEVICE_SETTINGS_CONTRIBUTION_METHODS;
@@ -96381,6 +96500,8 @@ exports.EVENT_PLANE_TOP_N = require_child_cap_dispatch.EVENT_PLANE_TOP_N;
 exports.EVENT_TOPIC_PREFIX = require_child_cap_dispatch.EVENT_TOPIC_PREFIX;
 exports.EngineManagerResolver = EngineManagerResolver;
 exports.EventBus = EventBus;
+exports.FIRST_BOOT_ADMIN_PASSWORD = require_builtins_local_auth_local_auth_addon.FIRST_BOOT_ADMIN_PASSWORD;
+exports.FIRST_BOOT_ADMIN_USERNAME = require_builtins_local_auth_local_auth_addon.FIRST_BOOT_ADMIN_USERNAME;
 exports.FeatureManager = FeatureManager;
 exports.FilesystemStorageAddon = require_builtins_sqlite_storage_filesystem_storage_addon.FilesystemStorageAddon;
 exports.FilesystemStorageProvider = require_builtins_sqlite_storage_filesystem_storage_addon.FilesystemStorageProvider;
@@ -96407,7 +96528,9 @@ exports.HubLogForwarder = HubLogForwarder;
 exports.HubNodeRegistry = HubNodeRegistry;
 exports.INFRA_CAPABILITIES = INFRA_CAPABILITIES;
 exports.IntegrationRegistry = IntegrationRegistry;
+exports.JWT_SIGNING_KEY_REF = require_jwt_signing_key.JWT_SIGNING_KEY_REF;
 exports.JobJournal = JobJournal;
+exports.JwtSigningKeyUnavailableError = require_jwt_signing_key.JwtSigningKeyUnavailableError;
 exports.LEAF_RENEWAL_WINDOW_DAYS = require_tls$1.LEAF_RENEWAL_WINDOW_DAYS;
 exports.LifecycleJobEngine = LifecycleJobEngine;
 exports.LifecycleStateMachine = LifecycleStateMachine;
@@ -96462,6 +96585,7 @@ exports.SOCKET_QUEUE_TOP_N = require_child_cap_dispatch.SOCKET_QUEUE_TOP_N;
 exports.STALL_REPORT_MS = require_event_loop_stall_monitor.STALL_REPORT_MS;
 exports.STALL_TICK_MS = require_event_loop_stall_monitor.STALL_TICK_MS;
 exports.STORE_READABLE_BOOTSTRAP_KEYS = STORE_READABLE_BOOTSTRAP_KEYS;
+exports.SYSTEM_SECRET_OWNER = require_jwt_signing_key.SYSTEM_SECRET_OWNER;
 exports.ScopedLogger = ScopedLogger;
 exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.ScopedTokenManager;
 exports.SettingsReadUnavailableError = require_builtins_local_auth_local_auth_addon.SettingsReadUnavailableError;
@@ -96498,7 +96622,7 @@ exports.applyCertificateToListener = require_tls$1.applyCertificateToListener;
 exports.applyLanHttp = require_tls$1.applyLanHttp;
 exports.attributeStall = require_event_loop_stall_monitor.attributeStall;
 exports.bindPendingLanHttp = require_tls$1.bindPendingLanHttp;
-exports.bootstrapSchema = require_builtins_local_auth_local_auth_addon.bootstrapSchema;
+exports.bootstrapSchema = bootstrapSchema;
 exports.brokerCallForCap = require_child_cap_dispatch.brokerCallForCap;
 exports.brokerTransportLink = require_child_cap_dispatch.brokerTransportLink;
 Object.defineProperty(exports, "buildBinaryPath", {
@@ -96523,6 +96647,7 @@ exports.capActionName = require_child_cap_dispatch.capActionName;
 exports.capActionSuffix = require_child_cap_dispatch.capActionSuffix;
 exports.capBareAction = require_child_cap_dispatch.capBareAction;
 exports.capServiceName = require_child_cap_dispatch.capServiceName;
+exports.checkClusterSecret = require_cluster_secret.checkClusterSecret;
 exports.classifyAddonDir = classifyAddonDir;
 exports.classifyCapRoute = require_child_cap_dispatch.classifyCapRoute;
 exports.clearHttpsListener = require_tls$1.clearHttpsListener;
@@ -96530,7 +96655,7 @@ exports.clearPendingRestart = clearPendingRestart;
 exports.clearPlatformKeychainKey = require_platform_key_source.clearPlatformKeychainKey;
 exports.closeLanHttp = require_tls$1.closeLanHttp;
 exports.clusterEventTopic = require_child_cap_dispatch.clusterEventTopic;
-exports.clusterSecretMatches = clusterSecretMatches;
+exports.clusterSecretMatches = require_cluster_secret.clusterSecretMatches;
 exports.collectCertIdentity = require_tls$1.collectCertIdentity;
 exports.collectModelFiles = require_event_loop_stall_monitor.collectModelFiles;
 exports.contentTypeFor = require_event_loop_stall_monitor.contentTypeFor;
@@ -96656,6 +96781,8 @@ Object.defineProperty(exports, "getPlatformInfo", {
 	}
 });
 exports.getPlatformKeychainKey = require_platform_key_source.getPlatformKeychainKey;
+exports.getProcessClusterSecretGate = require_cluster_secret.getProcessClusterSecretGate;
+exports.getProcessJwtSigningKeyState = require_jwt_signing_key.getProcessJwtSigningKeyState;
 Object.defineProperty(exports, "getPythonDownloadUrl", {
 	enumerable: true,
 	get: function() {
@@ -96666,7 +96793,7 @@ exports.getRestartMarkerPath = getRestartMarkerPath;
 exports.getSinglePidStats = require_resource_monitor.getSinglePidStats;
 exports.getWorkerDeviceRegistry = require_child_cap_dispatch.getWorkerDeviceRegistry;
 exports.hasDotNode = hasDotNode;
-exports.hashClusterSecret = hashClusterSecret;
+exports.hashClusterSecret = require_cluster_secret.hashClusterSecret;
 exports.heapSpaceField = require_child_cap_dispatch.heapSpaceField;
 exports.hostNodeIdOf = require_child_cap_dispatch.hostNodeIdOf;
 exports.hubMainRssBudget = require_child_cap_dispatch.hubMainRssBudget;
@@ -96690,7 +96817,7 @@ exports.ipcParentLink = require_child_cap_dispatch.ipcParentLink;
 exports.isAddonDeploySource = isAddonDeploySource;
 exports.isArrayBufferCensusReport = require_child_cap_dispatch.isArrayBufferCensusReport;
 exports.isArrayOutputSchema = require_dist.isArrayOutputSchema;
-exports.isClusterSecretMismatchError = isClusterSecretMismatchError;
+exports.isClusterSecretMismatchError = require_cluster_secret.isClusterSecretMismatchError;
 exports.isCollectionArrayMethod = require_dist.isCollectionArrayMethod;
 exports.isCredentialKeyName = require_child_cap_dispatch.isCredentialKeyName;
 exports.isInfraCapability = isInfraCapability;
@@ -96711,6 +96838,7 @@ exports.parseRssBudgetMb = require_child_cap_dispatch.parseRssBudgetMb;
 exports.parseTokenizedUrl = require_event_loop_stall_monitor.parseTokenizedUrl;
 exports.partitionIsolatedBuiltinIds = partitionIsolatedBuiltinIds;
 exports.prepareBootTls = require_tls$1.prepareBootTls;
+exports.processJwtSigningKey = require_jwt_signing_key.processJwtSigningKey;
 exports.proxyToUpstream = proxyToUpstream;
 exports.quarantineAddonResidue = quarantineAddonResidue;
 exports.readExtraSans = require_tls$1.readExtraSans;
@@ -96752,6 +96880,7 @@ exports.servedHttpsLeafFingerprint = require_tls$1.servedHttpsLeafFingerprint;
 exports.setHubConnected = require_child_cap_dispatch.setHubConnected;
 exports.setNodeEventInterest = require_child_cap_dispatch.setNodeEventInterest;
 exports.setPlatformKeychainKey = require_platform_key_source.setPlatformKeychainKey;
+exports.setProcessClusterSecretGate = require_cluster_secret.setProcessClusterSecretGate;
 exports.setWrapperActive = require_builtins_device_manager_device_manager_addon.setWrapperActive;
 exports.shouldReclaim = require_child_cap_dispatch.shouldReclaim;
 exports.signalAllRunnerGroups = require_child_cap_dispatch.signalAllRunnerGroups;
@@ -96762,6 +96891,7 @@ exports.stampCallerAddonId = require_child_cap_dispatch.stampCallerAddonId;
 exports.startEventLoopStallMonitor = require_event_loop_stall_monitor.startEventLoopStallMonitor;
 exports.startHeapWatch = require_child_cap_dispatch.startHeapWatch;
 exports.startRunnerHeapWatch = require_child_cap_dispatch.startRunnerHeapWatch;
+exports.staticJwtSigningKey = require_jwt_signing_key.staticJwtSigningKey;
 exports.storeMayAnswer = storeMayAnswer;
 exports.storeUploadedCertificate = require_tls$1.storeUploadedCertificate;
 exports.strandedMb = require_child_cap_dispatch.strandedMb;