@camstack/system 1.2.378 → 1.2.380

package/dist/index.mjs

@@ -1,5 +1,6 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $t as looseSchema, At as extractNestedAddonId, Cr as emitDownForOwnedCaps, E as LOG_LEVEL_RANK, G as addonSettingsCapability, Gr as EventCategory$1, Ht as isVoidInput, Ir as readinessKey, Jt as lifecycleJobSchema, Lr as resolveCapMount, Lt as isArrayOutputSchema, Nr as parseJsonObject, On as scopesAllowAddon, P as RUNTIME_DEFAULTS, Pr as parseJsonUnknown, Qt as logLevelAtMost, Rt as isCollectionArrayMethod, Sr as createEvent, Tn as resolveMethodAuth, Tr as expandCapMethods, Ut as kebabToCamel, Vt as isObjectInput, _r as asJsonObject$1, cr as errMsg$1, dr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, fr as DEVICE_STATUS_METHOD, hn as procedureAuthKey, hr as ReadinessTimeoutError, k as METHOD_ACCESS_MAP, kn as scopesAllowDeviceCap, ln as objectInputDeclaresAddonId, mr as ReadinessRegistry, t as ALL_CAPABILITY_DEFINITIONS, un as objectInputDeclaresRequiredDeviceId, ur as DATAPLANE_SECRET_HEADER$1, vr as asNumber, yr as asString$1, zr as scopeKey } from "./dist-Bvl5JgNt.mjs";
+import { $t as looseSchema, At as extractNestedAddonId, Br as scopeKey, Cr as createEvent, E as LOG_LEVEL_RANK, Er as expandCapMethods, Fr as parseJsonUnknown, G as addonSettingsCapability, Ht as isVoidInput, Jt as lifecycleJobSchema, Lr as readinessKey, Lt as isArrayOutputSchema, On as scopesAllowAddon, P as RUNTIME_DEFAULTS, Pr as parseJsonObject, Qt as logLevelAtMost, Rr as resolveCapMount, Rt as isCollectionArrayMethod, Tn as resolveMethodAuth, Ut as kebabToCamel, Vt as isObjectInput, _r as asJsonObject$1, cr as errMsg$1, dr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, fr as DEVICE_STATUS_METHOD, hn as procedureAuthKey, hr as ReadinessTimeoutError, k as METHOD_ACCESS_MAP, kn as scopesAllowDeviceCap, ln as objectInputDeclaresAddonId, mr as ReadinessRegistry, qr as EventCategory$1, t as ALL_CAPABILITY_DEFINITIONS, un as objectInputDeclaresRequiredDeviceId, ur as DATAPLANE_SECRET_HEADER$1, vr as asNumber, wr as emitDownForOwnedCaps, yr as asString$1 } from "./dist-B9oFw2jh.mjs";
+import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-Qhde8r82.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -15,7 +16,7 @@ import "./builtins/device-manager/index.mjs";
 import { HubForwarderAddon, HubForwarderDestination } from "./builtins/hub-forwarder/index.mjs";
 import { LivenessMonitorAddon } from "./builtins/liveness-monitor/liveness-monitor.addon.mjs";
 import "./builtins/liveness-monitor/index.mjs";
-import { LocalAuthAddon, a as AuthManager, c as require_ms, i as ScopedTokenManager, l as require_safe_buffer, n as bootstrapSchema, o as SettingsReadUnavailableError, r as UserManager, s as isSettingsReadUnavailable, t as DEFAULT_DATA_PATH, u as ApiKeyManager } from "./builtins/local-auth/local-auth.addon.mjs";
+import { LocalAuthAddon, a as AuthManager, c as require_ms, i as ScopedTokenManager, l as require_safe_buffer, n as FIRST_BOOT_ADMIN_USERNAME, o as SettingsReadUnavailableError, r as UserManager, s as isSettingsReadUnavailable, t as FIRST_BOOT_ADMIN_PASSWORD, u as ApiKeyManager } from "./builtins/local-auth/local-auth.addon.mjs";
 import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { t as NativeMetricsProvider } from "./builtins/native-metrics/native-metrics.addon.mjs";
@@ -25,17 +26,18 @@ import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { n as HUB_CAP_FWD_SERVICE, r as createHubCapForwardService, t as HUB_CAP_FWD_ACTION } from "./hub-cap-forward-CH6_VWVO.mjs";
 import { StorageOrchestratorAddon, n as buildStorageLocationRegistry, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
+import { a as CLUSTER_SECRET_UNAVAILABLE_TYPE, c as getProcessClusterSecretGate, d as setProcessClusterSecretGate, i as CLUSTER_SECRET_SETTINGS_KEY, l as hashClusterSecret, n as CLUSTER_SECRET_REF, o as checkClusterSecret, r as CLUSTER_SECRET_REJECTED_EXIT_CODE, s as clusterSecretMatches, t as CLUSTER_SECRET_MISMATCH_TYPE, u as isClusterSecretMismatchError } from "./cluster-secret-BDue-uJj.mjs";
 import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
-import { C as resolveFormatRevision, S as isModelDownloaded, _ as downloadModel, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as ensureModel, w as revisionWeightUrl, y as fetchJson } from "./event-loop-stall-monitor-D8rqSWfW.mjs";
+import { C as resolveFormatRevision, S as isModelDownloaded, _ as downloadModel, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as ensureModel, w as revisionWeightUrl, y as fetchJson } from "./event-loop-stall-monitor-anUH2IE1.mjs";
 import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-CJHogwTl.mjs";
-import { $ as stampCallerAddonId, $n as sampleSocketDirection, $t as HUB_MAIN_RSS_BUDGET_MB, A as resolveHwAccel, An as formatHeapSpaces, At as serializeTypedArrays, B as udsChildLogToWorkerEntry, Bn as createMeshQueueReader, Bt as isCredentialKeyName, C as getBrokerEventBus, Cn as createArrayBufferCensusGate, Ct as NATIVE_PROVIDER_SERVICE_INFIX, D as subscribePassthrough, Dn as DECISIVE_HEAP_SPACES, Dt as capServiceName, E as setNodeEventInterest, En as isArrayBufferCensusReport, Et as capBareAction, F as ipcParentLink, Fn as OUTBOUND_QUEUE_SUSTAIN_MS, Ft as installManifestNativeDeps, G as UDS_NO_ROUTE_PREFIX, Gn as createSocketPlaneMeter, Gt as hostNodeIdOf, H as createUdsLoggerWithControl, Hn as EMPTY_SOCKET_PLANE_BASELINE, Ht as redactLogMeta, I as localProviderLink, In as OUTBOUND_QUEUE_THRESHOLD_BYTES, It as resolveAddonClass, J as answerClaimedGetStatus, Jn as formatSocketPlane, Jt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, K as afterWorkerOnlineAnnounce, Kn as createSocketPlaneReader, Kt as createAddonDataPlaneFacility, L as createParentUnownedCallHandler, Ln as createOutboundQueueGate, Lt as buildNpmChildEnv, M as brokerTransportLink, Mn as readHeapSpaces, Mt as CapabilityHandle, N as buildLinkChain, Nn as selectReportedSpaces, Nt as CapabilityUnavailableError, O as AddonDepsManager, On as HEAP_SPACE_REPORT_MIN_MB, Ot as parseCapAction, P as deviceCapResolverLink, Pn as OUTBOUND_QUEUE_COOLDOWN_MS, Pt as copyBundledNativeModules, Q as CapRouteResolver, Qn as recordSocketFrame, Qt as HUB_MAIN_HEAP_WATCH_LABEL, R as createUdsEventBridge, Rn as formatOutboundQueueVerdict, Rt as resolveNpmInvocation, S as clusterEventTopic, Sn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, St as validateProviderRegistrations, T as registerEventBusService, Tn as formatArrayBufferCensus, Tt as capActionSuffix, U as LocalChildClient, Un as SOCKET_PLANE_TOP_N, Ut as redactLogText, V as createUdsLogger, Vn as formatMeshQueue, Vt as redactLogEntry, W as LocalChildRegistry, Wn as SOCKET_QUEUE_TOP_N, Wt as createAddonPeerBytesFacility, X as AGENT_CAP_FWD_ACTION, Xn as EMPTY_SOCKET_DIRECTION, Xt as HEAP_WATCH_INTERVAL_MS, Y as deviceOfGetStatus, Yn as readSocketQueues, Yt as HEAP_RECLAIM_TRIGGER_MB, Z as AGENT_CAP_FWD_SERVICE, Zn as createSocketDirectionCounters, Zt as HEAP_WATCH_WARN_RATIO, _ as getWorkerDeviceRegistry, _n as startRunnerHeapWatch, a as reapProcessGroup, an as ZERO_LOOP_DELAY, ar as MAX_CAP_ACTIONS_PER_PEER, at as __resetCapUsageRegistryForTests, b as setHubConnected, bn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, c as runnerOwnsProcessGroup, cn as createLoopDelayMeter, cr as diffCapActionCensus, ct as UdsLocalTransportClient, d as summarizeMembers, dn as hubMainRssBudget, dr as createEventPlaneReader, dt as PeerAnsweredError, en as HUB_RSS_BUDGET_ENV, er as socketDirectionBytes, et as CapRouteError, f as installManifestSystemDeps, fn as nextRssBudgetState, fr as diffEventPlane, ft as localEndpointPath, g as createUdsAddonContext, gn as startHeapWatch, gt as createBrokerDeviceManagerApi, h as createAddonContext, hn as shouldReclaim, ht as buildNativeCapProxy, in as RUNNER_RSS_BUDGET_ENV, ir as EMPTY_CAP_ACTION_READING, it as PARENT_ROUTED_PROVIDER_ADDON_ID, j as brokerCallForCap, jn as heapSpaceField, jt as DeviceRegistry, k as createKernelHwAccel, kn as emitHeapDiagnosticReport, kt as deserializeTypedArrays, l as signalAllRunnerGroups, ln as createV8Reclaimer, lr as EVENT_PLANE_TOP_N, lt as UdsLocalTransportServer, m as adaptBrokerToCluster, mn as reclaimIntervalMs, mt as encodeFrame, nn as RSS_BUDGET_RELEASE_RATIO, nr as CAP_ACTION_OVERFLOW_LABEL, nt as callWithServiceDiscovery, o as registerRunnerGroup, on as buildHeapSample, or as capActionLabel, ot as getCapUsageRegistry, p as installManifestPythonDeps, pn as parseRssBudgetMb, pr as formatEventPlane, pt as FrameDecoder, q as GET_STATUS_METHOD, qn as diffSocketPlane, qt as HEAP_RECLAIM_MIN_INTERVAL_MS, r as defaultProcessGroupOps, rn as RUNNER_HEAP_WATCH_INTERVAL_MS, rr as CAP_ACTION_UNLABELLED, rt as CapUsageRegistry, s as releaseRunnerGroup, sn as createDeferredHeapWatchSink, sr as createCapActionCensus, st as createLocalTransport, t as CAP_METHOD_NOT_IMPLEMENTED, tn as RSS_BUDGET_REANNOUNCE_MIN_MS, tr as socketDirectionMessages, tt as classifyCapRoute, un as describeRss, ur as createEventPlaneMeter, ut as SocketChannel, v as getOrInitReadinessRegistry, vn as strandedMb, w as getMoleculerEventStats, wn as createInspectorArrayBufferCensus, wt as capActionName, x as EVENT_TOPIC_PREFIX, xn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, xt as createAddonService, y as getOrInitReadinessRegistryForClient, yn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, yt as mountNativeCapService, z as createUdsEventBus, zn as MESH_QUEUE_TOP_N, zt as runNpm } from "./child-cap-dispatch-DpHovtQd.mjs";
+import { $ as stampCallerAddonId, $n as sampleSocketDirection, $t as HUB_MAIN_RSS_BUDGET_MB, A as resolveHwAccel, An as formatHeapSpaces, At as serializeTypedArrays, B as udsChildLogToWorkerEntry, Bn as createMeshQueueReader, Bt as isCredentialKeyName, C as getBrokerEventBus, Cn as createArrayBufferCensusGate, Ct as NATIVE_PROVIDER_SERVICE_INFIX, D as subscribePassthrough, Dn as DECISIVE_HEAP_SPACES, Dt as capServiceName, E as setNodeEventInterest, En as isArrayBufferCensusReport, Et as capBareAction, F as ipcParentLink, Fn as OUTBOUND_QUEUE_SUSTAIN_MS, Ft as installManifestNativeDeps, G as UDS_NO_ROUTE_PREFIX, Gn as createSocketPlaneMeter, Gt as hostNodeIdOf, H as createUdsLoggerWithControl, Hn as EMPTY_SOCKET_PLANE_BASELINE, Ht as redactLogMeta, I as localProviderLink, In as OUTBOUND_QUEUE_THRESHOLD_BYTES, It as resolveAddonClass, J as answerClaimedGetStatus, Jn as formatSocketPlane, Jt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, K as afterWorkerOnlineAnnounce, Kn as createSocketPlaneReader, Kt as createAddonDataPlaneFacility, L as createParentUnownedCallHandler, Ln as createOutboundQueueGate, Lt as buildNpmChildEnv, M as brokerTransportLink, Mn as readHeapSpaces, Mt as CapabilityHandle, N as buildLinkChain, Nn as selectReportedSpaces, Nt as CapabilityUnavailableError, O as AddonDepsManager, On as HEAP_SPACE_REPORT_MIN_MB, Ot as parseCapAction, P as deviceCapResolverLink, Pn as OUTBOUND_QUEUE_COOLDOWN_MS, Pt as copyBundledNativeModules, Q as CapRouteResolver, Qn as recordSocketFrame, Qt as HUB_MAIN_HEAP_WATCH_LABEL, R as createUdsEventBridge, Rn as formatOutboundQueueVerdict, Rt as resolveNpmInvocation, S as clusterEventTopic, Sn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, St as validateProviderRegistrations, T as registerEventBusService, Tn as formatArrayBufferCensus, Tt as capActionSuffix, U as LocalChildClient, Un as SOCKET_PLANE_TOP_N, Ut as redactLogText, V as createUdsLogger, Vn as formatMeshQueue, Vt as redactLogEntry, W as LocalChildRegistry, Wn as SOCKET_QUEUE_TOP_N, Wt as createAddonPeerBytesFacility, X as AGENT_CAP_FWD_ACTION, Xn as EMPTY_SOCKET_DIRECTION, Xt as HEAP_WATCH_INTERVAL_MS, Y as deviceOfGetStatus, Yn as readSocketQueues, Yt as HEAP_RECLAIM_TRIGGER_MB, Z as AGENT_CAP_FWD_SERVICE, Zn as createSocketDirectionCounters, Zt as HEAP_WATCH_WARN_RATIO, _ as getWorkerDeviceRegistry, _n as startRunnerHeapWatch, a as reapProcessGroup, an as ZERO_LOOP_DELAY, ar as MAX_CAP_ACTIONS_PER_PEER, at as __resetCapUsageRegistryForTests, b as setHubConnected, bn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, c as runnerOwnsProcessGroup, cn as createLoopDelayMeter, cr as diffCapActionCensus, ct as UdsLocalTransportClient, d as summarizeMembers, dn as hubMainRssBudget, dr as createEventPlaneReader, dt as PeerAnsweredError, en as HUB_RSS_BUDGET_ENV, er as socketDirectionBytes, et as CapRouteError, f as installManifestSystemDeps, fn as nextRssBudgetState, fr as diffEventPlane, ft as localEndpointPath, g as createUdsAddonContext, gn as startHeapWatch, gt as createBrokerDeviceManagerApi, h as createAddonContext, hn as shouldReclaim, ht as buildNativeCapProxy, in as RUNNER_RSS_BUDGET_ENV, ir as EMPTY_CAP_ACTION_READING, it as PARENT_ROUTED_PROVIDER_ADDON_ID, j as brokerCallForCap, jn as heapSpaceField, jt as DeviceRegistry, k as createKernelHwAccel, kn as emitHeapDiagnosticReport, kt as deserializeTypedArrays, l as signalAllRunnerGroups, ln as createV8Reclaimer, lr as EVENT_PLANE_TOP_N, lt as UdsLocalTransportServer, m as adaptBrokerToCluster, mn as reclaimIntervalMs, mt as encodeFrame, nn as RSS_BUDGET_RELEASE_RATIO, nr as CAP_ACTION_OVERFLOW_LABEL, nt as callWithServiceDiscovery, o as registerRunnerGroup, on as buildHeapSample, or as capActionLabel, ot as getCapUsageRegistry, p as installManifestPythonDeps, pn as parseRssBudgetMb, pr as formatEventPlane, pt as FrameDecoder, q as GET_STATUS_METHOD, qn as diffSocketPlane, qt as HEAP_RECLAIM_MIN_INTERVAL_MS, r as defaultProcessGroupOps, rn as RUNNER_HEAP_WATCH_INTERVAL_MS, rr as CAP_ACTION_UNLABELLED, rt as CapUsageRegistry, s as releaseRunnerGroup, sn as createDeferredHeapWatchSink, sr as createCapActionCensus, st as createLocalTransport, t as CAP_METHOD_NOT_IMPLEMENTED, tn as RSS_BUDGET_REANNOUNCE_MIN_MS, tr as socketDirectionMessages, tt as classifyCapRoute, un as describeRss, ur as createEventPlaneMeter, ut as SocketChannel, v as getOrInitReadinessRegistry, vn as strandedMb, w as getMoleculerEventStats, wn as createInspectorArrayBufferCensus, wt as capActionName, x as EVENT_TOPIC_PREFIX, xn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, xt as createAddonService, y as getOrInitReadinessRegistryForClient, yn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, yt as mountNativeCapService, z as createUdsEventBus, zn as MESH_QUEUE_TOP_N, zt as runNpm } from "./child-cap-dispatch-CpjohToR.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B2WZ8_q9.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
 import { z } from "zod";
-import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
 import { lstat, readdir, readlink, realpath } from "node:fs/promises";
 import * as path$39 from "node:path";
@@ -7762,6 +7764,157 @@ function createDoorSettingsView(addonId, door, sections) {
 	};
 }
 //#endregion
+//#region src/kernel/config-schema.ts
+/** Default data directory — used when CAMSTACK_DATA env var is not set */
+var DEFAULT_DATA_PATH = "camstack-data";
+/**
+* A list of browser origins from config.yaml (a YAML list) or from the
+* `CAMSTACK_CORS_ORIGINS` env var (one comma-separated string — env carries
+* only strings). Validation of each entry is the CORS policy's job
+* (`server/backend/src/api/cors/cors-policy.ts`), which logs what it rejects;
+* the schema only fixes the SHAPE so a typo cannot stop the hub from booting.
+*/
+var originListSchema = z.preprocess((value) => typeof value === "string" ? value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) : value, z.array(z.string()));
+var serverSchema = z.object({
+	port: z.number().default(4443),
+	host: z.string().default("0.0.0.0"),
+	dataPath: z.string().default(DEFAULT_DATA_PATH),
+	/**
+	* EXTRA browser origins allowed to call this hub cross-origin (D707), on
+	* top of the built-ins: the hub's own origin, the hosted viewer PWA and the
+	* native app's opaque `null` origin. Bootstrap-owned on purpose — widening
+	* who may read hub responses in a browser is a security decision, and the
+	* policy is live from the first request, before the settings store exists.
+	*/
+	corsOrigins: originListSchema.default([])
+});
+/**
+* The bootstrap `auth` section holds NO credential (D797): the session signing
+* key lives in the keychain, and a fresh hub seeds `admin` / `changeme`
+* (`FIRST_BOOT_ADMIN_*`). The retired keys `jwtSecret`, `adminUsername` and
+* `adminPassword` are stripped when a legacy config.yaml still carries them —
+* the boot warns so the operator removes them (the one-off ops script imports
+* a `jwtSecret` into the keychain first).
+*/
+var authSchema = z.object({});
+var hubSchema = z.object({
+	url: z.string().default("ws://localhost:4443/agent"),
+	token: z.string().default("")
+});
+var agentSchema = z.object({
+	name: z.string().default(""),
+	/** Port for the agent status page (minimal HTML) */
+	statusPort: z.number().default(4444)
+});
+var tlsSchema = z.object({ 
+/**
+* Enable HTTPS (default: true). The certificate itself is never configured
+* here: the admin UI (Network → Local access) generates or uploads it
+* (D726), and boot serves whatever `tls/mode` says.
+*/
+enabled: z.boolean().default(true) });
+/**
+* Bootstrap-time addon configuration — read PURELY from YAML, before the
+* kernel can talk to the settings-store. This breaks the chicken-and-egg
+* where the settings store itself is implemented by an addon: the kernel
+* needs to know WHICH addon to load first to provide the store, and that
+* decision can't itself live in the store.
+*
+* Backward-compatible: every field is optional + defaults reproduce the
+* current hard-coded behavior. Existing config.yaml files keep working.
+*/
+var bootstrapAddonsSchema = z.object({
+	/**
+	* Addon implementing the `settings-store` capability. Loaded FIRST,
+	* before any other addon is enabled — every other addon's enable
+	* state, settings, and ordering lives in the store it provides.
+	*
+	* Default: '@camstack/addon-sqlite-storage' (the workspace's
+	* default SQLite-backed store). Future alternatives could swap this
+	* for postgres/redis without touching kernel code.
+	*/
+	settingsStoreAddon: z.string().default("@camstack/addon-sqlite-storage"),
+	/**
+	* How the launcher provisions REQUIRED_PACKAGES into `data/addons/`
+	* on startup.
+	*
+	*   - `'npm'`     — pull from the npm registry (production default).
+	*   - `'local'`   — copy `packages/<X>/` from the workspace into
+	*                   `data/addons/<X>/`. Use for the Electron-
+	*                   packaged bundle and the e2e harness.
+	*   - `'symlink'` — point `data/addons/<X>` at the workspace source
+	*                   dir via a directory symlink. Dev-only: a
+	*                   workspace rebuild (`npm run build -w <X>`) is
+	*                   immediately reflected at the next addon load,
+	*                   no copy step. Falls back to `'local'` on
+	*                   platforms that reject symlink creation (Windows
+	*                   without developer-mode).
+	*
+	* The `CAMSTACK_INSTALL_SOURCE` env var, when set, wins over this
+	* field. Leave undefined to keep the launcher's default behaviour
+	* (npm when no workspace, local when a bundled addons dir is
+	* present, …).
+	*/
+	installSource: z.enum([
+		"npm",
+		"local",
+		"symlink"
+	]).optional(),
+	/**
+	* Override the kernel's hard-coded `AddonInstaller.REQUIRED_PACKAGES`.
+	* Passing an array here REPLACES the default list entirely — useful
+	* for stripped-down deployments (only the bundle of addons the
+	* operator actually wants) and for forcing a different storage
+	* backend at first boot.
+	*
+	* Leave undefined to use the kernel-shipped defaults.
+	*/
+	requiredAddons: z.array(z.string()).optional(),
+	/**
+	* Disable list applied AFTER the settings-store reports the enabled
+	* set. Operator escape hatch — boot without a known-broken addon
+	* without having to mutate the store.
+	*/
+	forceDisable: z.array(z.string()).default([])
+});
+/**
+* Where the keychain's master key lives (D788). config.yaml ONLY: no env var
+* maps here, and the settings store may not answer it
+* (`BOOTSTRAP_OWNED_SECTIONS`). Absent → the desktop OS keychain when the hub
+* runs inside the desktop app, else `<dataDir>/.keychain/master.key`.
+*/
+var keychainSchema = z.object({
+	/** A file holding 32 random bytes, base64 (or hex). Keep it OFF the data volume. */
+	keyFile: z.string().min(1).optional(),
+	/**
+	* The key being rotated away from — consulted only to UNLOCK, so a move to a
+	* new key file is: new file, old one here, restart, rotate, remove this.
+	*/
+	previousKeyFile: z.string().min(1).optional()
+});
+/** Bootstrap config -- loaded from config.yaml ONLY at startup.
+*  All other settings live in SQL (system_settings table). */
+var bootstrapSchema = z.object({
+	/** Server mode: 'hub' (full server) or 'agent' (worker node) */
+	mode: z.enum(["hub", "agent"]).default("hub"),
+	server: serverSchema.default(serverSchema.parse({})),
+	auth: authSchema.default(authSchema.parse({})),
+	/** Hub connection config — only used when mode='agent' */
+	hub: hubSchema.default(hubSchema.parse({})),
+	/** Agent-specific config — only used when mode='agent' */
+	agent: agentSchema.default(agentSchema.parse({})),
+	/** TLS configuration */
+	tls: tlsSchema.default(tlsSchema.parse({})),
+	/**
+	* Addon bootstrap directives — minimum addon set needed before the
+	* kernel can reach the settings-store. See bootstrapAddonsSchema.
+	* Spec: docs/superpowers/specs/2026-05-15-yaml-bootstrap-expansion.md
+	*/
+	bootstrap: bootstrapAddonsSchema.default(bootstrapAddonsSchema.parse({})),
+	/** Keychain master-key location (config.yaml only). */
+	keychain: keychainSchema.default({})
+});
+//#endregion
 //#region ../../node_modules/js-yaml/dist/js-yaml.mjs
 /*! js-yaml 4.2.0 https://github.com/nodeca/js-yaml @license MIT */
 var __create = Object.create;
@@ -10116,9 +10269,6 @@ var ENV_VAR_MAP = {
 	CAMSTACK_PORT: "server.port",
 	CAMSTACK_HOST: "server.host",
 	CAMSTACK_DATA: "server.dataPath",
-	CAMSTACK_JWT_SECRET: "auth.jwtSecret",
-	CAMSTACK_ADMIN_USER: "auth.adminUsername",
-	CAMSTACK_ADMIN_PASS: "auth.adminPassword",
 	CAMSTACK_CORS_ORIGINS: "server.corsOrigins"
 };
 /** config.yaml, env overrides applied, parsed. */
@@ -10308,16 +10458,14 @@ function createStoreSettingsView(addonId, cm) {
 * Which `system-settings` keys the STORE may answer, and which the kernel
 * loads from the door into memory at boot — D675.
 *
-* ## The store never outranks env + config.yaml for a bootstrap section
+* ## The store never answers for a bootstrap section
 *
-* `system-settings` holds, among other things, `auth.jwtSecret`,
-* `auth.adminUsername` and `auth.adminPassword` — written there by
-* `local-auth` (and by older builds) next to `auth.tokenExpiry`. The live
-* container supplies the same three from env (`CAMSTACK_JWT_SECRET`,
-* `CAMSTACK_ADMIN_USER`, `CAMSTACK_ADMIN_PASS`). While the store layer was
-* skipped (every read since D231) env won by accident. Merging the store back
-* in "highest priority" would let a stale DB copy replace the JWT secret —
-* invalidating every token — and change the login password.
+* `system-settings` may still hold `auth.jwtSecret`, `auth.adminUsername` and
+* `auth.adminPassword` — written there by `local-auth` (and by older builds)
+* next to `auth.tokenExpiry`. Since D797 none of the three is a setting at
+* all (the signing key is the keychain's, the first-boot admin is fixed), and
+* the stale rows must still never answer: merging them back in would let a
+* stale DB copy stand in for a credential. The one-off ops script deletes them.
 *
 * So a bootstrap-owned section is answered from env + config.yaml ONLY, and
 * the store may add exactly the keys in {@link STORE_READABLE_BOOTSTRAP_KEYS}:
@@ -10576,7 +10724,7 @@ var ConfigManager = class {
 	* implementation (sqlite, redis, in-memory, …) behaves identically here.
 	*
 	* D675: a bootstrap-owned section takes ONLY allow-listed keys from the
-	* store (a stored `auth.jwtSecret` never replaces env), and with only the
+	* store (a stale stored `auth.jwtSecret` never answers), and with only the
 	* door wired this sync read THROWS — the settings view's `getSection` reads
 	* the door.
 	*/
@@ -94265,7 +94413,7 @@ function resolveUseHostname() {
 	return process.env["CAMSTACK_MOLECULER_USE_HOSTNAME"] !== "false";
 }
 function createBroker(config) {
-	const { nodeID, mode, hubAddress, logLevel = "warn", secret, tcpPort = DEFAULT_HUB_TCP_PORT, udpPort = DEFAULT_UDP_PORT } = config;
+	const { nodeID, mode, hubAddress, logLevel = "warn", tcpPort = DEFAULT_HUB_TCP_PORT, udpPort = DEFAULT_UDP_PORT } = config;
 	const useHostname = resolveUseHostname();
 	const infraLevel = "error";
 	const wildcardLevel = logLevel;
@@ -94287,7 +94435,6 @@ function createBroker(config) {
 	};
 	if (mode === "hub") return new ServiceBroker({
 		nodeID,
-		namespace: secret || void 0,
 		serializer: "MsgPack",
 		transporter: {
 			type: "TCP",
@@ -94330,7 +94477,6 @@ function createBroker(config) {
 	}
 	return new ServiceBroker({
 		nodeID,
-		namespace: secret || void 0,
 		serializer: "MsgPack",
 		transporter: {
 			type: "TCP",
@@ -94488,38 +94634,6 @@ var HubLogForwarder = class {
 	}
 };
 //#endregion
-//#region src/kernel/moleculer/cluster-secret.ts
-/**
-* Cluster-secret registration gate (opt-in). A registering node sends a
-* SHA-256 hash of its `CAMSTACK_CLUSTER_SECRET`; the receiver of a
-* `registerNode` RPC verifies it. The raw secret is never transmitted.
-*/
-/** Moleculer error `type` marking a registration rejected for a bad cluster secret. */
-var CLUSTER_SECRET_MISMATCH_TYPE = "CLUSTER_SECRET_MISMATCH";
-/** Process exit code a runner uses when its registration is rejected for a bad secret. */
-var CLUSTER_SECRET_REJECTED_EXIT_CODE = 78;
-/** SHA-256 hex digest of a cluster secret. Never transmit or log the raw secret. */
-function hashClusterSecret(secret) {
-	return createHash("sha256").update(secret, "utf8").digest("hex");
-}
-/**
-* True if a registration carrying `presentedHash` is allowed against a
-* receiver whose own secret hashes to `expectedHash`.
-* - `expectedHash` undefined → the gate is OFF; everything is allowed.
-* - otherwise `presentedHash` must be present and equal (constant-time).
-*/
-function clusterSecretMatches(expectedHash, presentedHash) {
-	if (expectedHash === void 0) return true;
-	if (presentedHash === void 0 || presentedHash.length !== expectedHash.length) return false;
-	return timingSafeEqual(Buffer.from(expectedHash), Buffer.from(presentedHash));
-}
-/** Recognises a cluster-secret rejection, including after a Moleculer RPC round-trip. */
-function isClusterSecretMismatchError(err) {
-	if (typeof err !== "object" || err === null || !("type" in err)) return false;
-	const { type } = err;
-	return type === CLUSTER_SECRET_MISMATCH_TYPE;
-}
-//#endregion
 //#region src/kernel/moleculer/hub-service.ts
 function createHubService(deps) {
 	return {
@@ -94543,7 +94657,9 @@ function createHubService(deps) {
 				return true;
 			} },
 			registerNode: { handler(ctx) {
-				if (!clusterSecretMatches(deps.expectedClusterSecretHash, ctx.params.clusterSecretHash)) throw new Errors.MoleculerError(`cluster secret mismatch — node "${ctx.params.nodeId}" rejected`, 403, CLUSTER_SECRET_MISMATCH_TYPE);
+				const verdict = checkClusterSecret(deps.clusterSecretGate?.() ?? { kind: "off" }, ctx.params.clusterSecretHash);
+				if (verdict === "mismatch") throw new Errors.MoleculerError(`cluster secret mismatch — node "${ctx.params.nodeId}" rejected`, 403, CLUSTER_SECRET_MISMATCH_TYPE);
+				if (verdict === "unavailable") throw new Errors.MoleculerRetryableError(`the hub cannot read its cluster secret yet — node "${ctx.params.nodeId}" must retry`, 503, CLUSTER_SECRET_UNAVAILABLE_TYPE);
 				deps.onRegisterNode?.(ctx.params);
 				return { ok: true };
 			} },
@@ -96316,4 +96432,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isCredentialKeyName, isInfraCapability, isModelDownloaded, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, leafFingerprintOf, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, overlayGetStatus, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, checkClusterSecret, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isCredentialKeyName, isInfraCapability, isModelDownloaded, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, leafFingerprintOf, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, overlayGetStatus, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, processJwtSigningKey, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessClusterSecretGate, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/jwt-signing-key-C2rE3wH6.js

@@ -0,0 +1,174 @@
+const require_dist = require("./dist-Cc6KOdY-.js");
+let node_crypto = require("node:crypto");
+//#region src/auth/jwt-signing-key.ts
+/**
+* The hub's session signing key — the HMAC key every JWT this hub mints
+* (sessions, SSO bridge, TOTP challenges, service tokens) is signed with.
+*
+* It lives in the keychain, owner `system` ({@link JWT_SIGNING_KEY_REF}), and
+* nowhere else: no environment variable, no `config.yaml` key (D797). The
+* hub's `local-auth` builtin loads it after the keychain booted and registers
+* it here; every `AuthManager` in the process asks this slot on every mint and
+* every verify, so a key that arrives (or changes) after construction is used
+* from the next call on.
+*
+* ## A locked keychain fails closed, visibly
+*
+* While the key cannot be read, sessions can be neither minted nor verified:
+* {@link JwtSigningKeySource.current} throws {@link JwtSigningKeyUnavailableError}
+* (a login answers that error, a bearer check reads it as "not authenticated").
+* There is deliberately NO fallback — not an env var, and not a fresh random
+* key, which would invalidate every session and every app token without
+* anyone having asked for it. A key is generated ONLY when the keychain
+* answers that none is stored (`missing`), i.e. on a fresh hub.
+*
+* Process-global through a registered symbol, like the desktop platform key,
+* so a second copy of this module (an addon bundle) sees the same key.
+*/
+/** The keychain owner of every system-held secret. */
+var SYSTEM_SECRET_OWNER = "system";
+/** `secret://system/global/jwtSigningKey`. */
+var JWT_SIGNING_KEY_REF = require_dist.buildSecretRef({
+	owner: SYSTEM_SECRET_OWNER,
+	scope: { kind: "global" },
+	fieldPath: "jwtSigningKey"
+});
+/** Sessions cannot be minted or verified: the signing key is not loaded. */
+var JwtSigningKeyUnavailableError = class extends Error {
+	reason;
+	constructor(reason) {
+		super(`sessions are unavailable: the session signing key could not be read from the keychain (${reason}). Unlock the keychain (System → Secrets, or fix keychain.keyFile and restart).`);
+		this.reason = reason;
+		this.name = "JwtSigningKeyUnavailableError";
+	}
+};
+var SLOT = Symbol.for("camstack.auth.jwt-signing-key");
+var NOT_LOADED = {
+	state: "unavailable",
+	reason: "not-loaded"
+};
+function isState(value) {
+	if (value === null || typeof value !== "object") return false;
+	const state = Reflect.get(value, "state");
+	if (state === "ready") return typeof Reflect.get(value, "key") === "string";
+	return state === "unavailable" && typeof Reflect.get(value, "reason") === "string";
+}
+/** Register the loaded (or unloadable) key. Called by the hub's `local-auth`. */
+function setProcessJwtSigningKey(state) {
+	Reflect.set(globalThis, SLOT, state);
+}
+function getProcessJwtSigningKeyState() {
+	const value = Reflect.get(globalThis, SLOT);
+	return isState(value) ? value : NOT_LOADED;
+}
+/** The process slot — the default source of every `AuthManager`. */
+var processJwtSigningKey = { current() {
+	const state = getProcessJwtSigningKeyState();
+	if (state.state === "ready") return state.key;
+	throw new JwtSigningKeyUnavailableError(state.reason);
+} };
+/** A fixed key — tests, and nothing else. */
+function staticJwtSigningKey(key) {
+	return { current: () => key };
+}
+/** 32 random bytes, hex. */
+function generateJwtSigningKey() {
+	return (0, node_crypto.randomBytes)(32).toString("hex");
+}
+/**
+* Read the key from the keychain; generate and store one ONLY when the
+* keychain answers that none exists. Never throws.
+*/
+async function loadJwtSigningKey(deps) {
+	let entry;
+	try {
+		entry = (await deps.secrets.resolve([JWT_SIGNING_KEY_REF]))[JWT_SIGNING_KEY_REF];
+	} catch (err) {
+		return {
+			state: "unavailable",
+			reason: err instanceof Error ? err.message : String(err)
+		};
+	}
+	if (entry === void 0) return {
+		state: "unavailable",
+		reason: "no-answer"
+	};
+	switch (entry.kind) {
+		case "value": return {
+			state: "ready",
+			key: entry.value
+		};
+		case "unavailable": return {
+			state: "unavailable",
+			reason: entry.reason
+		};
+		case "forbidden": return {
+			state: "unavailable",
+			reason: "forbidden"
+		};
+		case "missing": {
+			const key = (deps.generate ?? generateJwtSigningKey)();
+			try {
+				await deps.secrets.put(JWT_SIGNING_KEY_REF, key);
+			} catch (err) {
+				return {
+					state: "unavailable",
+					reason: `could not store a new key: ${err instanceof Error ? err.message : String(err)}`
+				};
+			}
+			return {
+				state: "ready",
+				key
+			};
+		}
+	}
+}
+//#endregion
+Object.defineProperty(exports, "JWT_SIGNING_KEY_REF", {
+	enumerable: true,
+	get: function() {
+		return JWT_SIGNING_KEY_REF;
+	}
+});
+Object.defineProperty(exports, "JwtSigningKeyUnavailableError", {
+	enumerable: true,
+	get: function() {
+		return JwtSigningKeyUnavailableError;
+	}
+});
+Object.defineProperty(exports, "SYSTEM_SECRET_OWNER", {
+	enumerable: true,
+	get: function() {
+		return SYSTEM_SECRET_OWNER;
+	}
+});
+Object.defineProperty(exports, "getProcessJwtSigningKeyState", {
+	enumerable: true,
+	get: function() {
+		return getProcessJwtSigningKeyState;
+	}
+});
+Object.defineProperty(exports, "loadJwtSigningKey", {
+	enumerable: true,
+	get: function() {
+		return loadJwtSigningKey;
+	}
+});
+Object.defineProperty(exports, "processJwtSigningKey", {
+	enumerable: true,
+	get: function() {
+		return processJwtSigningKey;
+	}
+});
+Object.defineProperty(exports, "setProcessJwtSigningKey", {
+	enumerable: true,
+	get: function() {
+		return setProcessJwtSigningKey;
+	}
+});
+Object.defineProperty(exports, "staticJwtSigningKey", {
+	enumerable: true,
+	get: function() {
+		return staticJwtSigningKey;
+	}
+});