@camstack/system 1.2.428 → 1.2.429

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BQG3QFg7.js");
+const require_dist = require("../../dist-Bgy_AmwX.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Zt as logDestinationCapability, lr as BaseAddon } from "../../dist-DHSJV4Qc.mjs";
+import { _r as BaseAddon, an as logDestinationCapability } from "../../dist-CSSfTM18.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{composition-sources-DvCGZEUI.js → composition-sources-C2VNX6tF.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BQG3QFg7.js");
+const require_dist = require("./dist-Bgy_AmwX.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-BQNxXQZG.mjs → composition-sources-SYtYuAgh.mjs}

@@ -1,4 +1,4 @@
-import { cr as errMsg, tr as compositionSourceKey } from "./dist-DHSJV4Qc.mjs";
+import { gr as errMsg, lr as compositionSourceKey } from "./dist-CSSfTM18.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-CR4If_lP.mjs → constants-CKuWoWvc.mjs}

@@ -1,4 +1,4 @@
-import { Sr as buildSecretRef } from "./dist-DHSJV4Qc.mjs";
+import { Ar as buildSecretRef } from "./dist-CSSfTM18.mjs";
 import { createHash, timingSafeEqual } from "node:crypto";
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{constants-CCSJGnjs.js → constants-RI-hGP5S.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BQG3QFg7.js");
+const require_dist = require("./dist-Bgy_AmwX.js");
 let node_crypto = require("node:crypto");
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/device-ca-BWfdDB3k.js

@@ -0,0 +1,462 @@
+const require_dist = require("./dist-Bgy_AmwX.js");
+const require_x509_es = require("./x509.es-Dzl0BbmG.js");
+let node_crypto = require("node:crypto");
+//#region src/auth/jwt-signing-key.ts
+/**
+* The hub's session signing key — the HMAC key every JWT this hub mints
+* (sessions, SSO bridge, TOTP challenges, service tokens) is signed with.
+*
+* It lives in the keychain, owner `system` ({@link JWT_SIGNING_KEY_REF}), and
+* nowhere else: no environment variable, no `config.yaml` key (D797). The
+* hub's `local-auth` builtin loads it after the keychain booted and registers
+* it here; every `AuthManager` in the process asks this slot on every mint and
+* every verify, so a key that arrives (or changes) after construction is used
+* from the next call on.
+*
+* ## A locked keychain fails closed, visibly
+*
+* While the key cannot be read, sessions can be neither minted nor verified:
+* {@link JwtSigningKeySource.current} throws {@link JwtSigningKeyUnavailableError}
+* (a login answers that error, a bearer check reads it as "not authenticated").
+* There is deliberately NO fallback — not an env var, and not a fresh random
+* key, which would invalidate every session and every app token without
+* anyone having asked for it. A key is generated ONLY when the keychain
+* answers that none is stored (`missing`), i.e. on a fresh hub.
+*
+* Process-global through a registered symbol, like the desktop platform key,
+* so a second copy of this module (an addon bundle) sees the same key.
+*/
+/** The keychain owner of every system-held secret. */
+var SYSTEM_SECRET_OWNER = "system";
+/** `secret://system/global/jwtSigningKey`. */
+var JWT_SIGNING_KEY_REF = require_dist.buildSecretRef({
+	owner: SYSTEM_SECRET_OWNER,
+	scope: { kind: "global" },
+	fieldPath: "jwtSigningKey"
+});
+/** Sessions cannot be minted or verified: the signing key is not loaded. */
+var JwtSigningKeyUnavailableError = class extends Error {
+	reason;
+	constructor(reason) {
+		super(`sessions are unavailable: the session signing key could not be read from the keychain (${reason}). Unlock the keychain (System → Secrets, or fix keychain.keyFile and restart).`);
+		this.reason = reason;
+		this.name = "JwtSigningKeyUnavailableError";
+	}
+};
+var SLOT = Symbol.for("camstack.auth.jwt-signing-key");
+var NOT_LOADED = {
+	state: "unavailable",
+	reason: "not-loaded"
+};
+function isState(value) {
+	if (value === null || typeof value !== "object") return false;
+	const state = Reflect.get(value, "state");
+	if (state === "ready") return typeof Reflect.get(value, "key") === "string";
+	return state === "unavailable" && typeof Reflect.get(value, "reason") === "string";
+}
+/** Register the loaded (or unloadable) key. Called by the hub's `local-auth`. */
+function setProcessJwtSigningKey(state) {
+	Reflect.set(globalThis, SLOT, state);
+}
+function getProcessJwtSigningKeyState() {
+	const value = Reflect.get(globalThis, SLOT);
+	return isState(value) ? value : NOT_LOADED;
+}
+/** The process slot — the default source of every `AuthManager`. */
+var processJwtSigningKey = { current() {
+	const state = getProcessJwtSigningKeyState();
+	if (state.state === "ready") return state.key;
+	throw new JwtSigningKeyUnavailableError(state.reason);
+} };
+/** A fixed key — tests, and nothing else. */
+function staticJwtSigningKey(key) {
+	return { current: () => key };
+}
+/** 32 random bytes, hex. */
+function generateJwtSigningKey() {
+	return (0, node_crypto.randomBytes)(32).toString("hex");
+}
+/**
+* Read the key from the keychain; generate and store one ONLY when the
+* keychain answers that none exists. Never throws.
+*/
+async function loadJwtSigningKey(deps) {
+	let entry;
+	try {
+		entry = (await deps.secrets.resolve([JWT_SIGNING_KEY_REF]))[JWT_SIGNING_KEY_REF];
+	} catch (err) {
+		return {
+			state: "unavailable",
+			reason: err instanceof Error ? err.message : String(err)
+		};
+	}
+	if (entry === void 0) return {
+		state: "unavailable",
+		reason: "no-answer"
+	};
+	switch (entry.kind) {
+		case "value": return {
+			state: "ready",
+			key: entry.value
+		};
+		case "unavailable": return {
+			state: "unavailable",
+			reason: entry.reason
+		};
+		case "forbidden": return {
+			state: "unavailable",
+			reason: "forbidden"
+		};
+		case "missing": {
+			const key = (deps.generate ?? generateJwtSigningKey)();
+			try {
+				await deps.secrets.put(JWT_SIGNING_KEY_REF, key);
+			} catch (err) {
+				return {
+					state: "unavailable",
+					reason: `could not store a new key: ${err instanceof Error ? err.message : String(err)}`
+				};
+			}
+			return {
+				state: "ready",
+				key
+			};
+		}
+	}
+}
+//#endregion
+//#region src/auth/device-ca.ts
+require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
+var MS_PER_DAY = 864e5;
+var CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
+/** `secret://system/global/deviceCaKey` — EC P-256 PKCS#8 PEM of the device CA. */
+var DEVICE_CA_KEY_REF = require_dist.buildSecretRef({
+	owner: "system",
+	scope: { kind: "global" },
+	fieldPath: "deviceCaKey"
+});
+/** Settings section / field holding the public CA certificate PEM (beside `cluster.meshCa`). */
+var DEVICE_CA_SETTINGS_SECTION = "cluster";
+var DEVICE_CA_FIELD = "deviceCa";
+var DEVICE_CA_COMMON_NAME = "CamStack Device CA";
+var DEVICE_CA_VALIDITY_DAYS = 3650;
+var KEY_ALGORITHM = {
+	name: "ECDSA",
+	namedCurve: "P-256"
+};
+var SIGNING_ALGORITHM = {
+	name: "ECDSA",
+	hash: "SHA-256"
+};
+function freshSerial() {
+	return `00${(0, node_crypto.randomBytes)(16).toString("hex")}`;
+}
+function certPemOf(cert) {
+	return `${cert.toString("pem")}\n`;
+}
+async function generateDeviceCa(now = /* @__PURE__ */ new Date()) {
+	const keys = await node_crypto.webcrypto.subtle.generateKey(KEY_ALGORITHM, true, ["sign", "verify"]);
+	const extensions = [
+		new require_x509_es.BasicConstraintsExtension(true, 0, true),
+		new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.keyCertSign | require_x509_es.KeyUsageFlags.cRLSign, true),
+		await require_x509_es.SubjectKeyIdentifierExtension.create(keys.publicKey)
+	];
+	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
+		serialNumber: freshSerial(),
+		name: `CN=${DEVICE_CA_COMMON_NAME}`,
+		notBefore: now,
+		notAfter: new Date(now.getTime() + DEVICE_CA_VALIDITY_DAYS * MS_PER_DAY),
+		keys,
+		signingAlgorithm: SIGNING_ALGORITHM,
+		extensions
+	});
+	const pkcs8 = await node_crypto.webcrypto.subtle.exportKey("pkcs8", keys.privateKey);
+	return {
+		certPem: certPemOf(cert),
+		keyPem: `${require_x509_es.PemConverter.encode(pkcs8, "PRIVATE KEY")}\n`,
+		cert,
+		privateKey: keys.privateKey
+	};
+}
+async function loadDeviceCa(certPem, keyPem) {
+	return {
+		certPem,
+		keyPem,
+		cert: new require_x509_es.X509Certificate(certPem),
+		privateKey: await node_crypto.webcrypto.subtle.importKey("pkcs8", require_x509_es.PemConverter.decodeFirst(keyPem), KEY_ALGORITHM, true, ["sign"])
+	};
+}
+/**
+* A new self-signed certificate for the SAME key pair as `keyPem` (same
+* subject, so leaves already issued still verify): completes a CA creation that
+* died between its key write and its certificate write.
+*/
+async function rebuildDeviceCaCertificate(keyPem) {
+	const privateKey = await node_crypto.webcrypto.subtle.importKey("pkcs8", require_x509_es.PemConverter.decodeFirst(keyPem), KEY_ALGORITHM, true, ["sign"]);
+	const jwk = await node_crypto.webcrypto.subtle.exportKey("jwk", privateKey);
+	const publicKey = await node_crypto.webcrypto.subtle.importKey("jwk", {
+		kty: jwk.kty,
+		crv: jwk.crv,
+		x: jwk.x,
+		y: jwk.y
+	}, KEY_ALGORITHM, true, ["verify"]);
+	const now = /* @__PURE__ */ new Date();
+	const cert = await require_x509_es.X509CertificateGenerator.createSelfSigned({
+		serialNumber: freshSerial(),
+		name: `CN=${DEVICE_CA_COMMON_NAME}`,
+		notBefore: now,
+		notAfter: new Date(now.getTime() + DEVICE_CA_VALIDITY_DAYS * MS_PER_DAY),
+		keys: {
+			privateKey,
+			publicKey
+		},
+		signingAlgorithm: SIGNING_ALGORITHM,
+		extensions: [
+			new require_x509_es.BasicConstraintsExtension(true, 0, true),
+			new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.keyCertSign | require_x509_es.KeyUsageFlags.cRLSign, true),
+			await require_x509_es.SubjectKeyIdentifierExtension.create(publicKey)
+		]
+	});
+	return {
+		certPem: certPemOf(cert),
+		keyPem,
+		cert,
+		privateKey
+	};
+}
+/** Import (and thereby validate) a device public key: SPKI DER, ECDSA P-256. */
+async function importDevicePublicKey(spki) {
+	return node_crypto.webcrypto.subtle.importKey("spki", spki, KEY_ALGORITHM, true, ["verify"]);
+}
+/**
+* Sign a device leaf: CN = credential id; SAN URIs `camstack:credential:<id>`
+* and `camstack:user:<userId>`; EKU clientAuth; 365 days by default.
+*/
+async function issueDeviceLeaf(ca, input) {
+	const publicKey = await importDevicePublicKey(input.publicKeySpki);
+	const notBefore = input.now ?? /* @__PURE__ */ new Date();
+	const notAfter = new Date(notBefore.getTime() + (input.validDays ?? 365) * MS_PER_DAY);
+	const serialNumber = freshSerial();
+	const extensions = [
+		new require_x509_es.BasicConstraintsExtension(false, void 0, true),
+		new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.digitalSignature, true),
+		new require_x509_es.ExtendedKeyUsageExtension([CLIENT_AUTH_OID]),
+		new require_x509_es.SubjectAlternativeNameExtension([{
+			type: "url",
+			value: `${require_dist.DEVICE_SAN_CREDENTIAL_PREFIX}${input.credentialId}`
+		}, {
+			type: "url",
+			value: `${require_dist.DEVICE_SAN_USER_PREFIX}${input.userId}`
+		}]),
+		await require_x509_es.SubjectKeyIdentifierExtension.create(publicKey),
+		await require_x509_es.AuthorityKeyIdentifierExtension.create(ca.cert)
+	];
+	const pem = certPemOf(await require_x509_es.X509CertificateGenerator.create({
+		serialNumber,
+		subject: `CN=${input.credentialId}`,
+		issuer: ca.cert.subject,
+		notBefore,
+		notAfter,
+		publicKey,
+		signingKey: ca.privateKey,
+		signingAlgorithm: SIGNING_ALGORITHM,
+		extensions
+	}));
+	return {
+		certPem: pem,
+		serialNumber,
+		notBefore,
+		notAfter,
+		fingerprint: new node_crypto.X509Certificate(pem).fingerprint256
+	};
+}
+function sanValues(cert) {
+	const san = cert.getExtension(require_x509_es.SubjectAlternativeNameExtension);
+	if (san === null) return [];
+	return san.names.items.filter((n) => n.type === "url").map((n) => n.value);
+}
+/** Chain (signature by the device CA), validity window, EKU and identity of a presented leaf. */
+async function verifyDeviceLeaf(caCertPem, leafPem, now = /* @__PURE__ */ new Date()) {
+	let leaf;
+	let ca;
+	try {
+		leaf = new require_x509_es.X509Certificate(leafPem);
+		ca = new require_x509_es.X509Certificate(caCertPem);
+	} catch {
+		return {
+			ok: false,
+			reason: "malformed-certificate"
+		};
+	}
+	if (!await leaf.verify({
+		publicKey: ca,
+		signatureOnly: true
+	}, node_crypto.webcrypto) || leaf.issuer !== ca.subject) return {
+		ok: false,
+		reason: "not-issued-by-device-ca"
+	};
+	if (now < leaf.notBefore) return {
+		ok: false,
+		reason: "not-yet-valid"
+	};
+	if (now > leaf.notAfter) return {
+		ok: false,
+		reason: "expired"
+	};
+	const eku = leaf.getExtension(require_x509_es.ExtendedKeyUsageExtension);
+	if (eku === null || !eku.usages.includes(CLIENT_AUTH_OID)) return {
+		ok: false,
+		reason: "missing-client-auth"
+	};
+	const sans = sanValues(leaf);
+	const credentialId = sans.find((v) => v.startsWith(require_dist.DEVICE_SAN_CREDENTIAL_PREFIX))?.slice(require_dist.DEVICE_SAN_CREDENTIAL_PREFIX.length);
+	if (credentialId === void 0 || credentialId === "") return {
+		ok: false,
+		reason: "missing-credential-san"
+	};
+	return {
+		ok: true,
+		credentialId,
+		userId: sans.find((v) => v.startsWith("camstack:user:"))?.slice(14) ?? null,
+		publicKeySpki: Buffer.from(leaf.publicKey.rawData),
+		serialNumber: leaf.serialNumber,
+		fingerprint: new node_crypto.X509Certificate(leafPem).fingerprint256,
+		notAfter: leaf.notAfter
+	};
+}
+/**
+* ECDSA P-256 / SHA-256 over `message`. Accepts the raw `r||s` form WebCrypto
+* and Android emit (64 bytes) and the DER form the Secure Enclave emits.
+*/
+function verifyDeviceSignature(publicKeySpki, message, signatureBase64Url) {
+	let signature;
+	try {
+		signature = Buffer.from(signatureBase64Url, "base64url");
+	} catch {
+		return false;
+	}
+	if (signature.length === 0) return false;
+	try {
+		const key = (0, node_crypto.createPublicKey)({
+			key: Buffer.from(publicKeySpki),
+			format: "der",
+			type: "spki"
+		});
+		const dsaEncoding = signature.length === 64 ? "ieee-p1363" : "der";
+		return (0, node_crypto.verify)("sha256", Buffer.from(message, "utf8"), {
+			key,
+			dsaEncoding
+		}, signature);
+	} catch {
+		return false;
+	}
+}
+//#endregion
+Object.defineProperty(exports, "DEVICE_CA_FIELD", {
+	enumerable: true,
+	get: function() {
+		return DEVICE_CA_FIELD;
+	}
+});
+Object.defineProperty(exports, "DEVICE_CA_KEY_REF", {
+	enumerable: true,
+	get: function() {
+		return DEVICE_CA_KEY_REF;
+	}
+});
+Object.defineProperty(exports, "DEVICE_CA_SETTINGS_SECTION", {
+	enumerable: true,
+	get: function() {
+		return DEVICE_CA_SETTINGS_SECTION;
+	}
+});
+Object.defineProperty(exports, "JWT_SIGNING_KEY_REF", {
+	enumerable: true,
+	get: function() {
+		return JWT_SIGNING_KEY_REF;
+	}
+});
+Object.defineProperty(exports, "JwtSigningKeyUnavailableError", {
+	enumerable: true,
+	get: function() {
+		return JwtSigningKeyUnavailableError;
+	}
+});
+Object.defineProperty(exports, "SYSTEM_SECRET_OWNER", {
+	enumerable: true,
+	get: function() {
+		return SYSTEM_SECRET_OWNER;
+	}
+});
+Object.defineProperty(exports, "generateDeviceCa", {
+	enumerable: true,
+	get: function() {
+		return generateDeviceCa;
+	}
+});
+Object.defineProperty(exports, "getProcessJwtSigningKeyState", {
+	enumerable: true,
+	get: function() {
+		return getProcessJwtSigningKeyState;
+	}
+});
+Object.defineProperty(exports, "importDevicePublicKey", {
+	enumerable: true,
+	get: function() {
+		return importDevicePublicKey;
+	}
+});
+Object.defineProperty(exports, "issueDeviceLeaf", {
+	enumerable: true,
+	get: function() {
+		return issueDeviceLeaf;
+	}
+});
+Object.defineProperty(exports, "loadDeviceCa", {
+	enumerable: true,
+	get: function() {
+		return loadDeviceCa;
+	}
+});
+Object.defineProperty(exports, "loadJwtSigningKey", {
+	enumerable: true,
+	get: function() {
+		return loadJwtSigningKey;
+	}
+});
+Object.defineProperty(exports, "processJwtSigningKey", {
+	enumerable: true,
+	get: function() {
+		return processJwtSigningKey;
+	}
+});
+Object.defineProperty(exports, "rebuildDeviceCaCertificate", {
+	enumerable: true,
+	get: function() {
+		return rebuildDeviceCaCertificate;
+	}
+});
+Object.defineProperty(exports, "setProcessJwtSigningKey", {
+	enumerable: true,
+	get: function() {
+		return setProcessJwtSigningKey;
+	}
+});
+Object.defineProperty(exports, "staticJwtSigningKey", {
+	enumerable: true,
+	get: function() {
+		return staticJwtSigningKey;
+	}
+});
+Object.defineProperty(exports, "verifyDeviceLeaf", {
+	enumerable: true,
+	get: function() {
+		return verifyDeviceLeaf;
+	}
+});
+Object.defineProperty(exports, "verifyDeviceSignature", {
+	enumerable: true,
+	get: function() {
+		return verifyDeviceSignature;
+	}
+});