@camstack/system 1.2.428 → 1.2.430

package/dist/{tls-CaOLZ09W.mjs → tls-CpcGkeJV.mjs}

@@ -1,11 +1,11 @@
-import { a as KeyUsagesExtension, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CAjSsrkk.mjs";
-import { X509Certificate, createPrivateKey, randomBytes, webcrypto } from "node:crypto";
+import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CAjSsrkk.mjs";
+import { X509Certificate, createHash, createPrivateKey, randomBytes, webcrypto } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { isIP } from "node:net";
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import * as os from "node:os";
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { createServer as createServer$1 } from "node:http";
 //#region src/http/lan-http-bind.ts
 /**
@@ -457,6 +457,35 @@ async function issueLeaf(ca, identity, commonName, validDays, now) {
 		keyPem: await exportKeyPem(keys.privateKey)
 	};
 }
+/**
+* A server leaf for a key pair the CALLER holds (D856): an agent sends a CSR, the
+* hub signs its public key under the local root. Same extensions as
+* {@link issueLeaf} - `CA:FALSE`, serverAuth only - so a device that trusts the
+* hub root trusts the agent. The private key never exists on the hub.
+*/
+async function issueLeafFromCsr(ca, csrPem, identity, commonName, validDays, now) {
+	const csr = new Pkcs10CertificateRequest(csrPem);
+	if (!await csr.verify(webcrypto)) throw new Error("CSR signature is invalid");
+	const extensions = [
+		new BasicConstraintsExtension(false, void 0, true),
+		new KeyUsagesExtension(KeyUsageFlags.digitalSignature | KeyUsageFlags.keyEncipherment, true),
+		new ExtendedKeyUsageExtension([SERVER_AUTH_OID]),
+		await SubjectKeyIdentifierExtension.create(csr.publicKey),
+		await AuthorityKeyIdentifierExtension.create(ca.cert),
+		new SubjectAlternativeNameExtension(subjectAltNames(identity))
+	];
+	return toCertPem(await X509CertificateGenerator.create({
+		serialNumber: freshSerial(),
+		subject: `CN=${commonName}`,
+		issuer: ca.cert.subject,
+		notBefore: now,
+		notAfter: new Date(now.getTime() + validDays * MS_PER_DAY),
+		publicKey: csr.publicKey,
+		signingKey: ca.privateKey,
+		signingAlgorithm: SIGNING_ALGORITHM,
+		extensions
+	}));
+}
 //#endregion
 //#region src/tls/cert-manager.ts
 var DEFAULT_COMMON_NAME = "camstack.local";
@@ -939,4 +968,285 @@ function applyCertificateToListener(dataDir) {
 	return reloadHttpsListener(loadTlsCert(certPath, keyPath));
 }
 //#endregion
-export { allFamiliesListenHost as A, collectCertIdentity as C, SERVER_AUTH_OID as D, MAX_LEAF_VALIDITY_DAYS as E, registerLanHttpHandler as F, bindPendingLanHttp as M, closeLanHttp as N, evaluateExistingCert as O, readLanHttpState as P, CA_COMMON_NAME as S, LEAF_RENEWAL_WINDOW_DAYS as T, writeExtraSans as _, validateUploadedTls as a, loadTlsCert as b, registerHttpsListener as c, prepareBootTls as d, UPLOADED_CA_FILE as f, splitPemCertificates as g, readTlsMode as h, storeUploadedCertificate as i, applyLanHttp as j, DEFAULT_LAN_HTTP_PORT as k, reloadHttpsListener as l, readTlsAccessStatus as m, regenerateCertificate as n, clearHttpsListener as o, readExtraSans as p, revertToGeneratedCertificate as r, leafFingerprintOf as s, applyCertificateToListener as t, servedHttpsLeafFingerprint as u, writeTlsMode as v, CA_VALIDITY_DAYS as w, reissueTlsLeaf as x, ensureTlsCert as y };
+//#region src/tls/agent-https.ts
+/**
+* HTTPS for agents (D856): a leaf from the hub's LOCAL CA, so a device that
+* trusts the hub root trusts the agents too.
+*
+* The agent generates its key and a CSR; the hub signs only the PUBLIC key under
+* the local CA and returns the certificate - no private key ever crosses the mesh.
+* The agent keeps ONE file, `tls/agent-https.json` (0600: key + leaf + the pinned CA),
+* written atomically (temp file + rename) so a crash can never leave a key that does
+* not match its certificate. It persists no database.
+*
+* What the hub is willing to certify (the smaller safe option). The local CA is trusted
+* by every device that trusts the hub, so a compromised agent must not obtain a name it
+* does not own. The hub signs ONLY what it knows by itself:
+*   - the agent's node id (unique in the cluster), when it is a local-only name;
+*   - the remote address of the agent's LIVE mesh socket as the hub sees it, when it is
+*     a private address - never an address the agent reports.
+* Anything the agent reports (host names, interface addresses) is DROPPED and logged:
+* extra self-reported names would need an explicit operator approval flow, which does
+* not exist, so they are not certified. A name the hub's own certificate holds, or one
+* already certified to another node, is never signed (a NAT'd pair of agents would
+* otherwise share an address).
+*/
+cryptoProvider.set(webcrypto);
+function agentHttpsPaths(dataDir) {
+	const dir = join(dataDir, "tls");
+	return {
+		dir,
+		bundlePath: join(dir, "agent-https.json"),
+		certPath: join(dir, "agent.crt"),
+		pendingKeyPath: join(dir, "agent.key.pending")
+	};
+}
+/**
+* The material on disk, or `null` while no hub-issued leaf is installed. A bundle that
+* cannot be parsed is reported through `onCorrupt` and treated as absent: a bad file must
+* never take the agent API down.
+*/
+function loadAgentHttps(dataDir, onCorrupt) {
+	const { bundlePath } = agentHttpsPaths(dataDir);
+	if (!existsSync(bundlePath)) return null;
+	try {
+		const parsed = JSON.parse(readFileSync(bundlePath, "utf8"));
+		const field = (name) => {
+			const v = parsed !== null && typeof parsed === "object" ? Reflect.get(parsed, name) : null;
+			return typeof v === "string" && v.length > 0 ? v : null;
+		};
+		const keyPem = field("keyPem");
+		const certPem = field("certPem");
+		const caCertPem = field("caCertPem");
+		if (keyPem === null || certPem === null || caCertPem === null) {
+			onCorrupt?.("the bundle is missing a field");
+			return null;
+		}
+		if (!new X509Certificate(certPem).checkPrivateKey(createPrivateKey(keyPem))) {
+			onCorrupt?.("the certificate does not match the key");
+			return null;
+		}
+		return {
+			keyPem,
+			certPem,
+			caCertPem
+		};
+	} catch (error) {
+		onCorrupt?.(error instanceof Error ? error.message : String(error));
+		return null;
+	}
+}
+function collectAgentNames(nodeId, hostFacts) {
+	const identity = collectCertIdentity({
+		commonName: nodeId,
+		extraSans: [],
+		hostFacts
+	});
+	return {
+		hostnames: identity.dnsNames,
+		addresses: identity.ipAddresses
+	};
+}
+/** SHA-256 of the hub local CA this agent pinned, or `null` while none is. */
+function pinnedHttpsCaFingerprint(dataDir) {
+	const material = loadAgentHttps(dataDir);
+	return material === null ? null : new X509Certificate(material.caCertPem).fingerprint256;
+}
+/**
+* A fresh key pair (EC P-256, kept in `agent.key.pending`, 0600) and its CSR. The
+* key becomes `agent.key` only when the matching certificate is installed, so a
+* request that is never answered changes nothing that is being served.
+*/
+async function createAgentHttpsRequest(dataDir, nodeId, names) {
+	const paths = agentHttpsPaths(dataDir);
+	mkdirSync(paths.dir, { recursive: true });
+	const keys = await webcrypto.subtle.generateKey({
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, true, ["sign", "verify"]);
+	const csr = await Pkcs10CertificateRequestGenerator.create({
+		name: `CN=${nodeId}`,
+		keys,
+		signingAlgorithm: {
+			name: "ECDSA",
+			hash: "SHA-256"
+		}
+	});
+	const pkcs8 = await webcrypto.subtle.exportKey("pkcs8", keys.privateKey);
+	writeOwnerOnlyFileSync(paths.pendingKeyPath, `${PemConverter.encode(pkcs8, "PRIVATE KEY")}\n`);
+	return {
+		csrPem: `${csr.toString("pem")}\n`,
+		...names
+	};
+}
+var AgentHttpsInstallError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "AgentHttpsInstallError";
+	}
+};
+/**
+* Install the hub-signed leaf for the pending key. Refused when it is not for that key, when
+* it is not signed by the CA it came with, or - once a CA is pinned - when that CA is not the
+* one this agent already pinned (the CA that arrives with a later leaf is never trusted on its
+* own say: the first one came over the authenticated mesh, every later leaf must chain to it).
+* Key, leaf and CA are written as ONE file, atomically.
+*/
+function installAgentHttps(dataDir, input) {
+	const paths = agentHttpsPaths(dataDir);
+	if (!existsSync(paths.pendingKeyPath)) throw new AgentHttpsInstallError("no pending key: prepareHttpsCertificate was not called");
+	const keyPem = readFileSync(paths.pendingKeyPath, "utf8");
+	let leaf;
+	let ca;
+	try {
+		leaf = new X509Certificate(input.certPem);
+		ca = new X509Certificate(input.caCertPem);
+	} catch {
+		throw new AgentHttpsInstallError("the certificate or the CA is not a valid PEM certificate");
+	}
+	if (!leaf.checkPrivateKey(createPrivateKey(keyPem))) throw new AgentHttpsInstallError("the certificate is not for this node's pending key");
+	const pinned = loadAgentHttps(dataDir);
+	if (pinned !== null && input.caRotation !== true) {
+		const pinnedCa = new X509Certificate(pinned.caCertPem);
+		if (pinnedCa.fingerprint256 !== ca.fingerprint256 || !leaf.verify(pinnedCa.publicKey)) throw new AgentHttpsInstallError("the leaf does not chain to the hub local CA this agent pinned at its first install (if the hub rotated its local CA, renew HTTPS from the hub - it signals the rotation)");
+	}
+	if (!leaf.verify(ca.publicKey)) throw new AgentHttpsInstallError("the certificate is not signed by the CA that came with it");
+	if (new Date(leaf.validTo).getTime() <= Date.now()) throw new AgentHttpsInstallError("the certificate is already expired");
+	mkdirSync(paths.dir, { recursive: true });
+	const tmp = `${paths.bundlePath}.tmp`;
+	writeOwnerOnlyFileSync(tmp, JSON.stringify({
+		keyPem,
+		certPem: input.certPem,
+		caCertPem: input.caCertPem
+	}));
+	renameSync(tmp, paths.bundlePath);
+	chmodSync(paths.bundlePath, 384);
+	writeFileAtomic(paths.certPath, input.certPem.endsWith("\n") ? input.certPem : `${input.certPem}\n`);
+	return {
+		keyPem,
+		certPem: input.certPem,
+		caCertPem: input.caCertPem
+	};
+}
+function writeFileAtomic(path, content) {
+	const tmp = `${path}.tmp`;
+	writeFileSync(tmp, content);
+	renameSync(tmp, path);
+}
+/** Fingerprint, issuer, SANs and validity of a served leaf. */
+function describeHttpsLeaf(certPem) {
+	const x509 = new X509Certificate(certPem);
+	return {
+		fingerprintSha256: x509.fingerprint256,
+		issuer: x509.issuer.replaceAll("\n", ", "),
+		sans: (x509.subjectAltName ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0),
+		notBefore: Date.parse(x509.validFrom),
+		notAfter: Date.parse(x509.validTo)
+	};
+}
+var LOCAL_SUFFIXES = [
+	".local",
+	".lan",
+	".home.arpa",
+	".internal",
+	".localdomain"
+];
+var LABEL_RE = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/i;
+/** Private-network IPv4/IPv6: RFC 1918, CGNAT (Tailscale), link-local, ULA. */
+function isPrivateAddress(address) {
+	const family = isIP(address);
+	if (family === 4) {
+		const [a, b] = address.split(".").map(Number);
+		return a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254;
+	}
+	if (family === 6) {
+		const lower = address.toLowerCase();
+		return lower.startsWith("fc") || lower.startsWith("fd") || lower.startsWith("fe80:");
+	}
+	return false;
+}
+/** The default docker bridge network (172.17.0.0/16): identical on every host, so it names nothing. */
+function isContainerBridgeAddress(address) {
+	return /^172\.17\.\d{1,3}\.\d{1,3}$/.test(address);
+}
+/** A name that cannot collide with public DNS. */
+function isLocalOnlyHostname(name) {
+	const lower = name.toLowerCase();
+	if (lower.length === 0 || lower.length > 253) return false;
+	if (!lower.includes(".")) return LABEL_RE.test(lower);
+	if (!LOCAL_SUFFIXES.some((suffix) => lower.endsWith(suffix))) return false;
+	return lower.split(".").every((label) => LABEL_RE.test(label));
+}
+/**
+* The names the hub will sign for `nodeId`: its node id and the address of its live mesh
+* socket - nothing the agent says about itself. `excluded` holds every name already taken
+* (the hub's own certificate, other nodes' leaves); `reported` is what the agent claimed,
+* listed only so it can be logged as dropped.
+*/
+function acceptAgentSans(input) {
+	const excluded = input.excluded ?? /* @__PURE__ */ new Set();
+	const taken = (name) => excluded.has(name.toLowerCase());
+	const rejected = (input.reported ?? []).map((n) => `${n} (self-reported, not certified)`);
+	const dns = [];
+	const ips = [];
+	const id = input.nodeId.toLowerCase();
+	if (id !== "hub" && isLocalOnlyHostname(id) && !taken(id)) dns.push(id);
+	else rejected.push(`${input.nodeId} (node id: not a usable name)`);
+	const address = input.observedAddress?.replace(/^::ffff:/, "");
+	if (address !== void 0) if (address.includes("%")) rejected.push(`${address} (observed address: zone-scoped, only the node id is certified)`);
+	else if (isContainerBridgeAddress(address)) rejected.push(`${address} (observed address: a container bridge address, only the node id is certified)`);
+	else if (isIP(address) !== 0 && isPrivateAddress(address) && !taken(address)) ips.push(address);
+	else rejected.push(`${address} (observed address: not private or already certified)`);
+	return {
+		identity: {
+			dnsNames: dns,
+			ipAddresses: ips,
+			requiredDnsNames: dns,
+			requiredIpAddresses: ips
+		},
+		accepted: [...dns, ...ips],
+		rejected
+	};
+}
+/** The SAN values (lower-cased) of a certificate PEM: DNS names and IP addresses. */
+function certificateNames(certPem) {
+	const names = /* @__PURE__ */ new Set();
+	const san = new X509Certificate(certPem).subjectAltName ?? "";
+	for (const part of san.split(",")) {
+		const [, value] = part.trim().split(/:(.*)/s);
+		if (value !== void 0 && value.length > 0) names.add(value.toLowerCase());
+	}
+	return names;
+}
+/**
+* Hub side: sign an agent's CSR under the local CA in `<hubDataDir>/tls`. Throws when
+* there is no local CA to sign with or no name survives the policy.
+*/
+async function issueAgentHttpsLeaf(input) {
+	const caCertPath = join(input.hubDataDir, "tls", "camstack-ca.crt");
+	const caKeyPath = join(input.hubDataDir, "tls", "camstack-ca.key");
+	const hubLeafPath = join(input.hubDataDir, "tls", "camstack.crt");
+	if (!existsSync(caCertPath) || !existsSync(caKeyPath)) throw new Error("the hub has no local CA to sign with (no tls/camstack-ca.crt + key)");
+	const excluded = new Set(input.takenByOthers ?? []);
+	if (existsSync(hubLeafPath)) for (const name of certificateNames(readFileSync(hubLeafPath, "utf8"))) excluded.add(name);
+	const sans = acceptAgentSans({
+		nodeId: input.nodeId,
+		observedAddress: input.observedAddress,
+		excluded,
+		...input.reportedNames !== void 0 ? { reported: input.reportedNames } : {}
+	});
+	if (sans.accepted.length === 0) throw new Error(`no name of node '${input.nodeId}' can be certified (${sans.rejected.join("; ") || "nothing offered"})`);
+	const ca = await loadCa(readFileSync(caCertPath, "utf8"), readFileSync(caKeyPath, "utf8"));
+	return {
+		certPem: await issueLeafFromCsr(ca, input.csrPem, sans.identity, input.nodeId, 397, input.now ?? /* @__PURE__ */ new Date()),
+		caCertPem: ca.certPem,
+		accepted: sans.accepted,
+		rejected: sans.rejected
+	};
+}
+/** SHA-256 of a PEM (for logs that must not print a certificate). */
+function pemDigest(pem) {
+	return createHash("sha256").update(pem).digest("hex").slice(0, 16);
+}
+//#endregion
+export { readTlsMode as A, CA_VALIDITY_DAYS as B, registerHttpsListener as C, UPLOADED_CA_FILE as D, prepareBootTls as E, loadTlsCert as F, DEFAULT_LAN_HTTP_PORT as G, MAX_LEAF_VALIDITY_DAYS as H, reissueTlsLeaf as I, bindPendingLanHttp as J, allFamiliesListenHost as K, CA_COMMON_NAME as L, writeExtraSans as M, writeTlsMode as N, readExtraSans as O, ensureTlsCert as P, collectCertIdentity as R, leafFingerprintOf as S, servedHttpsLeafFingerprint as T, SERVER_AUTH_OID as U, LEAF_RENEWAL_WINDOW_DAYS as V, evaluateExistingCert as W, readLanHttpState as X, closeLanHttp as Y, registerLanHttpHandler as Z, regenerateCertificate as _, collectAgentNames as a, validateUploadedTls as b, installAgentHttps as c, isPrivateAddress as d, issueAgentHttpsLeaf as f, applyCertificateToListener as g, pinnedHttpsCaFingerprint as h, certificateNames as i, splitPemCertificates as j, readTlsAccessStatus as k, isContainerBridgeAddress as l, pemDigest as m, acceptAgentSans as n, createAgentHttpsRequest as o, loadAgentHttps as p, applyLanHttp as q, agentHttpsPaths as r, describeHttpsLeaf as s, AgentHttpsInstallError as t, isLocalOnlyHostname as u, revertToGeneratedCertificate as v, reloadHttpsListener as w, clearHttpsListener as x, storeUploadedCertificate as y, systemHostFacts as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.428",
+  "version": "1.2.430",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",
@@ -357,6 +357,9 @@
           },
           {
             "name": "user-management"
+          },
+          {
+            "name": "device-credentials"
           }
         ]
       },

package/dist/jwt-signing-key-BZm055IP.js

@@ -1,174 +0,0 @@
-const require_dist = require("./dist-BQG3QFg7.js");
-let node_crypto = require("node:crypto");
-//#region src/auth/jwt-signing-key.ts
-/**
-* The hub's session signing key — the HMAC key every JWT this hub mints
-* (sessions, SSO bridge, TOTP challenges, service tokens) is signed with.
-*
-* It lives in the keychain, owner `system` ({@link JWT_SIGNING_KEY_REF}), and
-* nowhere else: no environment variable, no `config.yaml` key (D797). The
-* hub's `local-auth` builtin loads it after the keychain booted and registers
-* it here; every `AuthManager` in the process asks this slot on every mint and
-* every verify, so a key that arrives (or changes) after construction is used
-* from the next call on.
-*
-* ## A locked keychain fails closed, visibly
-*
-* While the key cannot be read, sessions can be neither minted nor verified:
-* {@link JwtSigningKeySource.current} throws {@link JwtSigningKeyUnavailableError}
-* (a login answers that error, a bearer check reads it as "not authenticated").
-* There is deliberately NO fallback — not an env var, and not a fresh random
-* key, which would invalidate every session and every app token without
-* anyone having asked for it. A key is generated ONLY when the keychain
-* answers that none is stored (`missing`), i.e. on a fresh hub.
-*
-* Process-global through a registered symbol, like the desktop platform key,
-* so a second copy of this module (an addon bundle) sees the same key.
-*/
-/** The keychain owner of every system-held secret. */
-var SYSTEM_SECRET_OWNER = "system";
-/** `secret://system/global/jwtSigningKey`. */
-var JWT_SIGNING_KEY_REF = require_dist.buildSecretRef({
-	owner: SYSTEM_SECRET_OWNER,
-	scope: { kind: "global" },
-	fieldPath: "jwtSigningKey"
-});
-/** Sessions cannot be minted or verified: the signing key is not loaded. */
-var JwtSigningKeyUnavailableError = class extends Error {
-	reason;
-	constructor(reason) {
-		super(`sessions are unavailable: the session signing key could not be read from the keychain (${reason}). Unlock the keychain (System → Secrets, or fix keychain.keyFile and restart).`);
-		this.reason = reason;
-		this.name = "JwtSigningKeyUnavailableError";
-	}
-};
-var SLOT = Symbol.for("camstack.auth.jwt-signing-key");
-var NOT_LOADED = {
-	state: "unavailable",
-	reason: "not-loaded"
-};
-function isState(value) {
-	if (value === null || typeof value !== "object") return false;
-	const state = Reflect.get(value, "state");
-	if (state === "ready") return typeof Reflect.get(value, "key") === "string";
-	return state === "unavailable" && typeof Reflect.get(value, "reason") === "string";
-}
-/** Register the loaded (or unloadable) key. Called by the hub's `local-auth`. */
-function setProcessJwtSigningKey(state) {
-	Reflect.set(globalThis, SLOT, state);
-}
-function getProcessJwtSigningKeyState() {
-	const value = Reflect.get(globalThis, SLOT);
-	return isState(value) ? value : NOT_LOADED;
-}
-/** The process slot — the default source of every `AuthManager`. */
-var processJwtSigningKey = { current() {
-	const state = getProcessJwtSigningKeyState();
-	if (state.state === "ready") return state.key;
-	throw new JwtSigningKeyUnavailableError(state.reason);
-} };
-/** A fixed key — tests, and nothing else. */
-function staticJwtSigningKey(key) {
-	return { current: () => key };
-}
-/** 32 random bytes, hex. */
-function generateJwtSigningKey() {
-	return (0, node_crypto.randomBytes)(32).toString("hex");
-}
-/**
-* Read the key from the keychain; generate and store one ONLY when the
-* keychain answers that none exists. Never throws.
-*/
-async function loadJwtSigningKey(deps) {
-	let entry;
-	try {
-		entry = (await deps.secrets.resolve([JWT_SIGNING_KEY_REF]))[JWT_SIGNING_KEY_REF];
-	} catch (err) {
-		return {
-			state: "unavailable",
-			reason: err instanceof Error ? err.message : String(err)
-		};
-	}
-	if (entry === void 0) return {
-		state: "unavailable",
-		reason: "no-answer"
-	};
-	switch (entry.kind) {
-		case "value": return {
-			state: "ready",
-			key: entry.value
-		};
-		case "unavailable": return {
-			state: "unavailable",
-			reason: entry.reason
-		};
-		case "forbidden": return {
-			state: "unavailable",
-			reason: "forbidden"
-		};
-		case "missing": {
-			const key = (deps.generate ?? generateJwtSigningKey)();
-			try {
-				await deps.secrets.put(JWT_SIGNING_KEY_REF, key);
-			} catch (err) {
-				return {
-					state: "unavailable",
-					reason: `could not store a new key: ${err instanceof Error ? err.message : String(err)}`
-				};
-			}
-			return {
-				state: "ready",
-				key
-			};
-		}
-	}
-}
-//#endregion
-Object.defineProperty(exports, "JWT_SIGNING_KEY_REF", {
-	enumerable: true,
-	get: function() {
-		return JWT_SIGNING_KEY_REF;
-	}
-});
-Object.defineProperty(exports, "JwtSigningKeyUnavailableError", {
-	enumerable: true,
-	get: function() {
-		return JwtSigningKeyUnavailableError;
-	}
-});
-Object.defineProperty(exports, "SYSTEM_SECRET_OWNER", {
-	enumerable: true,
-	get: function() {
-		return SYSTEM_SECRET_OWNER;
-	}
-});
-Object.defineProperty(exports, "getProcessJwtSigningKeyState", {
-	enumerable: true,
-	get: function() {
-		return getProcessJwtSigningKeyState;
-	}
-});
-Object.defineProperty(exports, "loadJwtSigningKey", {
-	enumerable: true,
-	get: function() {
-		return loadJwtSigningKey;
-	}
-});
-Object.defineProperty(exports, "processJwtSigningKey", {
-	enumerable: true,
-	get: function() {
-		return processJwtSigningKey;
-	}
-});
-Object.defineProperty(exports, "setProcessJwtSigningKey", {
-	enumerable: true,
-	get: function() {
-		return setProcessJwtSigningKey;
-	}
-});
-Object.defineProperty(exports, "staticJwtSigningKey", {
-	enumerable: true,
-	get: function() {
-		return staticJwtSigningKey;
-	}
-});

package/dist/jwt-signing-key-DL-qk1SM.mjs

@@ -1,127 +0,0 @@
-import { Sr as buildSecretRef } from "./dist-DHSJV4Qc.mjs";
-import { randomBytes } from "node:crypto";
-//#region src/auth/jwt-signing-key.ts
-/**
-* The hub's session signing key — the HMAC key every JWT this hub mints
-* (sessions, SSO bridge, TOTP challenges, service tokens) is signed with.
-*
-* It lives in the keychain, owner `system` ({@link JWT_SIGNING_KEY_REF}), and
-* nowhere else: no environment variable, no `config.yaml` key (D797). The
-* hub's `local-auth` builtin loads it after the keychain booted and registers
-* it here; every `AuthManager` in the process asks this slot on every mint and
-* every verify, so a key that arrives (or changes) after construction is used
-* from the next call on.
-*
-* ## A locked keychain fails closed, visibly
-*
-* While the key cannot be read, sessions can be neither minted nor verified:
-* {@link JwtSigningKeySource.current} throws {@link JwtSigningKeyUnavailableError}
-* (a login answers that error, a bearer check reads it as "not authenticated").
-* There is deliberately NO fallback — not an env var, and not a fresh random
-* key, which would invalidate every session and every app token without
-* anyone having asked for it. A key is generated ONLY when the keychain
-* answers that none is stored (`missing`), i.e. on a fresh hub.
-*
-* Process-global through a registered symbol, like the desktop platform key,
-* so a second copy of this module (an addon bundle) sees the same key.
-*/
-/** The keychain owner of every system-held secret. */
-var SYSTEM_SECRET_OWNER = "system";
-/** `secret://system/global/jwtSigningKey`. */
-var JWT_SIGNING_KEY_REF = buildSecretRef({
-	owner: SYSTEM_SECRET_OWNER,
-	scope: { kind: "global" },
-	fieldPath: "jwtSigningKey"
-});
-/** Sessions cannot be minted or verified: the signing key is not loaded. */
-var JwtSigningKeyUnavailableError = class extends Error {
-	reason;
-	constructor(reason) {
-		super(`sessions are unavailable: the session signing key could not be read from the keychain (${reason}). Unlock the keychain (System → Secrets, or fix keychain.keyFile and restart).`);
-		this.reason = reason;
-		this.name = "JwtSigningKeyUnavailableError";
-	}
-};
-var SLOT = Symbol.for("camstack.auth.jwt-signing-key");
-var NOT_LOADED = {
-	state: "unavailable",
-	reason: "not-loaded"
-};
-function isState(value) {
-	if (value === null || typeof value !== "object") return false;
-	const state = Reflect.get(value, "state");
-	if (state === "ready") return typeof Reflect.get(value, "key") === "string";
-	return state === "unavailable" && typeof Reflect.get(value, "reason") === "string";
-}
-/** Register the loaded (or unloadable) key. Called by the hub's `local-auth`. */
-function setProcessJwtSigningKey(state) {
-	Reflect.set(globalThis, SLOT, state);
-}
-function getProcessJwtSigningKeyState() {
-	const value = Reflect.get(globalThis, SLOT);
-	return isState(value) ? value : NOT_LOADED;
-}
-/** The process slot — the default source of every `AuthManager`. */
-var processJwtSigningKey = { current() {
-	const state = getProcessJwtSigningKeyState();
-	if (state.state === "ready") return state.key;
-	throw new JwtSigningKeyUnavailableError(state.reason);
-} };
-/** A fixed key — tests, and nothing else. */
-function staticJwtSigningKey(key) {
-	return { current: () => key };
-}
-/** 32 random bytes, hex. */
-function generateJwtSigningKey() {
-	return randomBytes(32).toString("hex");
-}
-/**
-* Read the key from the keychain; generate and store one ONLY when the
-* keychain answers that none exists. Never throws.
-*/
-async function loadJwtSigningKey(deps) {
-	let entry;
-	try {
-		entry = (await deps.secrets.resolve([JWT_SIGNING_KEY_REF]))[JWT_SIGNING_KEY_REF];
-	} catch (err) {
-		return {
-			state: "unavailable",
-			reason: err instanceof Error ? err.message : String(err)
-		};
-	}
-	if (entry === void 0) return {
-		state: "unavailable",
-		reason: "no-answer"
-	};
-	switch (entry.kind) {
-		case "value": return {
-			state: "ready",
-			key: entry.value
-		};
-		case "unavailable": return {
-			state: "unavailable",
-			reason: entry.reason
-		};
-		case "forbidden": return {
-			state: "unavailable",
-			reason: "forbidden"
-		};
-		case "missing": {
-			const key = (deps.generate ?? generateJwtSigningKey)();
-			try {
-				await deps.secrets.put(JWT_SIGNING_KEY_REF, key);
-			} catch (err) {
-				return {
-					state: "unavailable",
-					reason: `could not store a new key: ${err instanceof Error ? err.message : String(err)}`
-				};
-			}
-			return {
-				state: "ready",
-				key
-			};
-		}
-	}
-}
-//#endregion
-export { loadJwtSigningKey as a, staticJwtSigningKey as c, getProcessJwtSigningKeyState as i, JwtSigningKeyUnavailableError as n, processJwtSigningKey as o, SYSTEM_SECRET_OWNER as r, setProcessJwtSigningKey as s, JWT_SIGNING_KEY_REF as t };