@fonoster/common 0.27.0 → 0.30.0

package/dist/protos/identity.proto

@@ -56,6 +56,8 @@ service Identity {
   rpc ExchangeApiKey (ExchangeApiKeyRequest) returns (ExchangeApiKeyResponse) {}
   rpc ExchangeOauth2Code (ExchangeOauth2CodeRequest) returns (ExchangeOauth2CodeResponse) {}
   rpc ExchangeRefreshToken (ExchangeRefreshTokenRequest) returns (ExchangeRefreshTokenResponse) {}
+  // Trade an emailed sign-in code for tokens (passwordless sign-in)
+  rpc ExchangeVerificationCode (ExchangeVerificationCodeRequest) returns (ExchangeVerificationCodeResponse) {}
   rpc RevokeToken (RevokeTokenRequest) returns (RevokeTokenResponse) {}
 
   // Get the public key for verifying JWTs
@@ -78,14 +80,22 @@ message Workspace {
   int32 created_at = 5;
   int32 updated_at = 6;
   Owner owner = 7;
+  // A public region id (default, us-east-1) or a private region ref (rg_...). Immutable.
+  string region = 8;
 }
 
 message CreateWorkspaceRequest {
   string name = 1;
+  // A public region id, or one of the caller's private regions (id or rg_ ref). Empty means "default".
+  string region = 2;
 }
 
 message CreateWorkspaceResponse {
   string ref = 1;
+  string region = 2;
+  // Unused since PR-15 (regions are created at the user level, POST /api/regions); kept reserved.
+  string enrollment_token = 3;
+  string expires_at = 4;
 }
 
 message DeleteWorkspaceRequest {
@@ -113,6 +123,8 @@ message ListWorkspacesResponse {
 message UpdateWorkspaceRequest {
   string ref = 1;
   string name = 2;
+  // Accepted only when unchanged (the region is immutable).
+  string region = 3;
 }
 
 message UpdateWorkspaceResponse {
@@ -204,10 +216,12 @@ message User {
 
 message UpdateUserRequest {
   string ref = 1;
+  // A new password; current_password must be the account's password.
   string password = 2;
   string name = 3;
   string avatar = 4;
   string phone = 5;
+  string current_password = 6;
 }
 
 message UpdateUserResponse {
@@ -356,4 +370,15 @@ message RevokeTokenResponse {
 // Message with response with the public key
 message GetPublicKeyResponse {
   string public_key = 1;
-}
+}
+
+message ExchangeVerificationCodeRequest {
+  string email = 1;
+  string code = 2;
+}
+
+message ExchangeVerificationCodeResponse {
+  string id_token = 1;
+  string access_token = 2;
+  string refresh_token = 3;
+}

package/dist/protos/providers.proto

@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+syntax = "proto3";
+
+package fonoster.providers.v1beta2;
+
+// The provider catalog (read-only) and the workspace's own vendor keys (add-provider-registry)
+service Providers {
+  // Catalog entries this workspace can use: providers, models and voices (not retired)
+  rpc ListCatalog(ListCatalogRequest) returns (ListCatalogResponse) {}
+  // Store or replace the workspace's key for a provider (kept in a write-only Secret)
+  rpc SetProviderKey(SetProviderKeyRequest) returns (ProviderKey) {}
+  // The workspace's provider keys (never the key itself)
+  rpc ListProviderKeys(ListProviderKeysRequest) returns (ListProviderKeysResponse) {}
+  // Remove the workspace's key for a provider (and its Secret)
+  rpc DeleteProviderKey(DeleteProviderKeyRequest) returns (DeleteProviderKeyResponse) {}
+  // Deprecated or retired items this workspace uses, with where they are used
+  rpc ListWarnings(ListWarningsRequest) returns (ListWarningsResponse) {}
+}
+
+message CatalogItem {
+  // Catalog id, e.g. deepgram/nova-3 or elevenlabs/rachel; a provider's id has no slash
+  string id = 1;
+  // provider, model or voice
+  string kind = 2;
+  // active or deprecated
+  string state = 3;
+  // The provider id (the item's own id for providers)
+  string provider_id = 4;
+  // Models: stt, tts or llm
+  string type = 5;
+  // Providers: capabilities (stt, tts, llm)
+  repeated string capabilities = 6;
+  // Models: languages; voices: their language
+  repeated string languages = 7;
+  // Models: features
+  repeated string features = 8;
+  // Voices: the models they work on
+  repeated string models = 9;
+  // Voices: gender, when known
+  string gender = 10;
+  // Deprecated items: the suggested replacement and the retirement date (YYYY-MM-DD)
+  string replacement = 11;
+  string retire_on = 12;
+}
+
+message ListCatalogRequest {
+  // Optional: provider, model or voice
+  string kind = 1;
+  // Optional: stt, tts or llm (models and providers)
+  string type = 2;
+}
+
+message ListCatalogResponse {
+  repeated CatalogItem items = 1;
+}
+
+message ProviderKey {
+  string ref = 1;
+  string provider_id = 2;
+  // The Secret holding the key
+  string secret_ref = 3;
+  int32 created_at = 4;
+  int32 updated_at = 5;
+}
+
+message SetProviderKeyRequest {
+  string provider_id = 1;
+  // The vendor key; write-only
+  string key = 2;
+}
+
+message ListProviderKeysRequest {}
+
+message ListProviderKeysResponse {
+  repeated ProviderKey items = 1;
+}
+
+message DeleteProviderKeyRequest {
+  string provider_id = 1;
+}
+
+message DeleteProviderKeyResponse {
+  string provider_id = 1;
+}
+
+message WarningUse {
+  // app or assistant
+  string kind = 1;
+  string ref = 2;
+  string name = 3;
+  // The config field naming the item: voice, ttsModel, sttModel or llm
+  string field = 4;
+  // For a TTS model: the voice the config uses with it (e.g. the workspace's cloned voice)
+  string voice = 5;
+}
+
+message Warning {
+  string id = 1;
+  // provider, model or voice
+  string kind = 2;
+  // deprecated or retired
+  string state = 3;
+  string replacement = 4;
+  string retire_on = 5;
+  // Saved configs that reference the item
+  repeated WarningUse used_by = 6;
+  // Apps whose sessions used it in the last days, including ids no saved config names
+  repeated string runtime_apps = 7;
+  int32 runtime_sessions = 8;
+  // ISO 8601; empty without recent runtime use
+  string last_used_at = 9;
+}
+
+message ListWarningsRequest {}
+
+message ListWarningsResponse {
+  repeated Warning items = 1;
+}

package/dist/protos/webhooks.proto

@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+syntax = "proto3";
+
+package fonoster.webhooks.v1beta2;
+
+// Workspace webhooks (add-workspace-webhooks): endpoints, secret rotation and the delivery log
+service Webhooks {
+  // Create an endpoint; the response carries its signing secret (shown once)
+  rpc CreateWebhook(CreateWebhookRequest) returns (CreateWebhookResponse) {}
+  // List the workspace's endpoints
+  rpc ListWebhooks(ListWebhooksRequest) returns (ListWebhooksResponse) {}
+  // Get one endpoint
+  rpc GetWebhook(GetWebhookRequest) returns (Webhook) {}
+  // Change an endpoint's URL or events
+  rpc UpdateWebhook(UpdateWebhookRequest) returns (UpdateWebhookResponse) {}
+  // Delete an endpoint
+  rpc DeleteWebhook(DeleteWebhookRequest) returns (DeleteWebhookResponse) {}
+  // New signing secret; the previous one keeps verifying for 24 hours
+  rpc RotateWebhookSecret(RotateWebhookSecretRequest) returns (RotateWebhookSecretResponse) {}
+  // The delivery log, newest first
+  rpc ListWebhookDeliveries(ListWebhookDeliveriesRequest) returns (ListWebhookDeliveriesResponse) {}
+  // Send a delivery again now (same event id, fresh signature)
+  rpc ResendWebhookDelivery(ResendWebhookDeliveryRequest) returns (WebhookDelivery) {}
+}
+
+message Webhook {
+  string ref = 1;
+  string url = 2;
+  // Subscribed event types, e.g. call.ended
+  repeated string events = 3;
+  // The last characters of the current secret
+  string secret_hint = 4;
+  // Seconds since the epoch until which the previous secret still verifies (0: none)
+  int32 previous_secret_until = 5;
+  int32 created_at = 6;
+  int32 updated_at = 7;
+}
+
+message CreateWebhookRequest {
+  string url = 1;
+  repeated string events = 2;
+}
+
+message CreateWebhookResponse {
+  string ref = 1;
+  // Shown only here and on rotation
+  string secret = 2;
+}
+
+message ListWebhooksRequest {
+  int32 page_size = 1;
+  string page_token = 2;
+}
+
+message ListWebhooksResponse {
+  repeated Webhook items = 1;
+  string next_page_token = 2;
+}
+
+message GetWebhookRequest {
+  string ref = 1;
+}
+
+message UpdateWebhookRequest {
+  string ref = 1;
+  // Empty keeps the URL
+  string url = 2;
+  // Empty keeps the events
+  repeated string events = 3;
+}
+
+message UpdateWebhookResponse {
+  string ref = 1;
+}
+
+message DeleteWebhookRequest {
+  string ref = 1;
+}
+
+message DeleteWebhookResponse {
+  string ref = 1;
+}
+
+message RotateWebhookSecretRequest {
+  string ref = 1;
+}
+
+message RotateWebhookSecretResponse {
+  string ref = 1;
+  string secret = 2;
+  // Seconds since the epoch until which the previous secret still verifies
+  int32 previous_secret_until = 3;
+}
+
+message WebhookDelivery {
+  string ref = 1;
+  string webhook_ref = 2;
+  string event_id = 3;
+  string event_type = 4;
+  // pending, succeeded or failed
+  string status = 5;
+  int32 attempts = 6;
+  // HTTP status of the last attempt (0: no response)
+  int32 last_status = 7;
+  int32 last_attempt_at = 8;
+  int32 next_attempt_at = 9;
+  int32 created_at = 10;
+}
+
+message ListWebhookDeliveriesRequest {
+  // Optional: one endpoint's deliveries
+  string webhook_ref = 1;
+  // At most this many (default 50, up to 200)
+  int32 page_size = 2;
+}
+
+message ListWebhookDeliveriesResponse {
+  repeated WebhookDelivery items = 1;
+}
+
+message ResendWebhookDeliveryRequest {
+  string ref = 1;
+}

package/dist/{voice/StopSay.d.ts → regions/hub/index.d.ts}

@@ -16,9 +16,4 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { VerbRequest } from "./Verb";
-type StopSayRequest = VerbRequest;
-type StopSayResponse = {
-    mediaSessionRef: string;
-};
-export { StopSayRequest, StopSayResponse };
+export * from "./natsJwt";

package/dist/regions/hub/index.js

@@ -0,0 +1,35 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+__exportStar(require("./natsJwt"), exports);

package/dist/regions/hub/natsJwt.d.ts

@@ -0,0 +1,63 @@
+import { createAccount, createOperator, createUser, KeyPair } from "nkeys.js";
+export type NatsClaims = {
+    jti?: string;
+    iat: number;
+    iss: string;
+    name?: string;
+    sub: string;
+    exp?: number;
+    nats: Record<string, unknown>;
+};
+/** Signs claims with an nkey pair (operator signs accounts, accounts sign users). */
+export declare function encodeNatsJwt(claims: NatsClaims, signer: KeyPair): string;
+/** The claims of a NATS JWT (no verification; for tests and diagnostics). */
+export declare function decodeNatsJwt(jwt: string): NatsClaims;
+export declare function operatorJwt(operator: KeyPair, systemAccount: string): string;
+/**
+ * An account JWT. `revocations` maps user public keys to the unix time before which their JWTs
+ * are revoked; re-publishing the account with a new entry disconnects that user.
+ */
+export declare function accountJwt(operator: KeyPair, account: string, name: string, revocations?: Record<string, number>, extra?: Record<string, unknown>): string;
+export type UserPermissions = {
+    pub: string[];
+    sub: string[];
+};
+export declare function userJwt(account: KeyPair, user: string, name: string, permissions?: UserPermissions): string;
+/** A NATS credentials file (the user JWT and its seed), as `nsc` writes it. */
+export declare function formatCreds(jwt: string, seed: string): string;
+/** Issues a fresh user (new nkey) under an account and returns its credentials file. */
+export declare function issueUserCreds(account: KeyPair, name: string, permissions?: UserPermissions): {
+    publicKey: string;
+    jwt: string;
+    creds: string;
+};
+export declare const seedOf: (kp: KeyPair) => string;
+export declare const keyPairFromSeed: (seed: string) => KeyPair;
+export declare const REGIONS_ACCOUNT_NAME = "REGIONS";
+/** Claims of the REGIONS account; the hub preloads it and the control plane re-signs it. */
+export declare function regionsAccountJwt(operator: KeyPair, account: string, revocations?: Record<string, number>): string;
+/**
+ * Everything a region hub needs, generated once by `fonoster-region-hub-setup`:
+ * the hub's nats.conf, the control plane's seeds and two credentials files (the control plane's
+ * REGIONS user, unrestricted, and a system-account user to push account updates).
+ */
+export declare function generateRegionHub(options: {
+    clientPort?: number;
+    leafPort?: number;
+    httpPort?: number;
+    /** TLS for the leaf listener (production); omitted only for local stacks. */
+    leafTls?: {
+        certFile: string;
+        keyFile: string;
+    };
+    resolverDir?: string;
+}): {
+    conf: string;
+    operatorSeed: string;
+    accountSeed: string;
+    accountPublicKey: string;
+    systemAccountPublicKey: string;
+    controlPlaneCreds: string;
+    systemCreds: string;
+};
+export { createAccount, createOperator, createUser, KeyPair };

package/dist/regions/hub/natsJwt.js

@@ -0,0 +1,195 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createUser = exports.createOperator = exports.createAccount = exports.REGIONS_ACCOUNT_NAME = exports.keyPairFromSeed = exports.seedOf = void 0;
+exports.encodeNatsJwt = encodeNatsJwt;
+exports.decodeNatsJwt = decodeNatsJwt;
+exports.operatorJwt = operatorJwt;
+exports.accountJwt = accountJwt;
+exports.userJwt = userJwt;
+exports.formatCreds = formatCreds;
+exports.issueUserCreds = issueUserCreds;
+exports.regionsAccountJwt = regionsAccountJwt;
+exports.generateRegionHub = generateRegionHub;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const crypto_1 = require("crypto");
+const nkeys_js_1 = require("nkeys.js");
+Object.defineProperty(exports, "createAccount", { enumerable: true, get: function () { return nkeys_js_1.createAccount; } });
+Object.defineProperty(exports, "createOperator", { enumerable: true, get: function () { return nkeys_js_1.createOperator; } });
+Object.defineProperty(exports, "createUser", { enumerable: true, get: function () { return nkeys_js_1.createUser; } });
+/**
+ * Minimal NATS decentralized-auth JWTs (v2), enough for the region hub (RG-B2): an operator, the
+ * system account, the REGIONS account (with its user revocations) and per-region users whose
+ * permissions are `region.<ref>.>` only. Same encoding as nats-io/jwt: header
+ * `{"typ":"JWT","alg":"ed25519-nkey"}`, base64url parts, `jti` = base32(sha512/256(claims)).
+ */
+const HEADER = { typ: "JWT", alg: "ed25519-nkey" };
+const B32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+const b64url = (buf) => Buffer.from(buf).toString("base64url");
+function base32(buf) {
+    let bits = 0;
+    let value = 0;
+    let out = "";
+    for (const byte of buf) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            out += B32[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0)
+        out += B32[(value << (5 - bits)) & 31];
+    return out;
+}
+/** Signs claims with an nkey pair (operator signs accounts, accounts sign users). */
+function encodeNatsJwt(claims, signer) {
+    const body = Object.assign(Object.assign({}, claims), { jti: "" });
+    body.jti = base32((0, crypto_1.createHash)("sha512-256").update(JSON.stringify(body)).digest());
+    const head = b64url(Buffer.from(JSON.stringify(HEADER)));
+    const payload = b64url(Buffer.from(JSON.stringify(body)));
+    const sig = signer.sign(Buffer.from(`${head}.${payload}`));
+    return `${head}.${payload}.${b64url(sig)}`;
+}
+/** The claims of a NATS JWT (no verification; for tests and diagnostics). */
+function decodeNatsJwt(jwt) {
+    return JSON.parse(Buffer.from(jwt.split(".")[1], "base64url").toString());
+}
+const now = () => Math.floor(Date.now() / 1000);
+const pub = (kp) => kp.getPublicKey();
+const NO_LIMITS = { subs: -1, data: -1, payload: -1 };
+function operatorJwt(operator, systemAccount) {
+    return encodeNatsJwt({
+        iat: now(),
+        iss: pub(operator),
+        sub: pub(operator),
+        name: "fonoster-regions",
+        nats: { system_account: systemAccount, type: "operator", version: 2 }
+    }, operator);
+}
+/**
+ * An account JWT. `revocations` maps user public keys to the unix time before which their JWTs
+ * are revoked; re-publishing the account with a new entry disconnects that user.
+ */
+function accountJwt(operator, account, name, revocations = {}, extra = {}) {
+    return encodeNatsJwt({
+        iat: now(),
+        iss: pub(operator),
+        sub: account,
+        name,
+        nats: Object.assign(Object.assign(Object.assign({ limits: Object.assign(Object.assign({}, NO_LIMITS), { imports: -1, exports: -1, wildcards: true, conn: -1, leaf: -1 }), default_permissions: { pub: {}, sub: {} } }, (Object.keys(revocations).length ? { revocations } : {})), extra), { type: "account", version: 2 })
+    }, operator);
+}
+function userJwt(account, user, name, permissions) {
+    return encodeNatsJwt({
+        iat: now(),
+        iss: pub(account),
+        sub: user,
+        name,
+        nats: Object.assign(Object.assign(Object.assign({}, (permissions
+            ? {
+                pub: { allow: permissions.pub },
+                sub: { allow: permissions.sub }
+            }
+            : { pub: {}, sub: {} })), NO_LIMITS), { type: "user", version: 2 })
+    }, account);
+}
+/** A NATS credentials file (the user JWT and its seed), as `nsc` writes it. */
+function formatCreds(jwt, seed) {
+    return `-----BEGIN NATS USER JWT-----
+${jwt}
+------END NATS USER JWT------
+
+************************* IMPORTANT *************************
+NKEY Seed printed below can be used to sign and prove identity.
+NKEYs are sensitive and should be treated as secrets.
+
+-----BEGIN USER NKEY SEED-----
+${seed}
+------END USER NKEY SEED------
+
+*************************************************************
+`;
+}
+/** Issues a fresh user (new nkey) under an account and returns its credentials file. */
+function issueUserCreds(account, name, permissions) {
+    const user = (0, nkeys_js_1.createUser)();
+    const jwt = userJwt(account, pub(user), name, permissions);
+    return {
+        publicKey: pub(user),
+        jwt,
+        creds: formatCreds(jwt, Buffer.from(user.getSeed()).toString())
+    };
+}
+const seedOf = (kp) => Buffer.from(kp.getSeed()).toString();
+exports.seedOf = seedOf;
+const keyPairFromSeed = (seed) => (0, nkeys_js_1.fromSeed)(Buffer.from(seed.trim()));
+exports.keyPairFromSeed = keyPairFromSeed;
+exports.REGIONS_ACCOUNT_NAME = "REGIONS";
+/** Claims of the REGIONS account; the hub preloads it and the control plane re-signs it. */
+function regionsAccountJwt(operator, account, revocations = {}) {
+    return accountJwt(operator, account, exports.REGIONS_ACCOUNT_NAME, revocations);
+}
+/**
+ * Everything a region hub needs, generated once by `fonoster-region-hub-setup`:
+ * the hub's nats.conf, the control plane's seeds and two credentials files (the control plane's
+ * REGIONS user, unrestricted, and a system-account user to push account updates).
+ */
+function generateRegionHub(options) {
+    var _a, _b, _c, _d;
+    const operator = (0, nkeys_js_1.createOperator)();
+    const sys = (0, nkeys_js_1.createAccount)();
+    const regions = (0, nkeys_js_1.createAccount)();
+    const opJwt = operatorJwt(operator, pub(sys));
+    const sysJwt = accountJwt(operator, pub(sys), "SYS");
+    const regJwt = regionsAccountJwt(operator, pub(regions));
+    const cpUser = issueUserCreds(regions, "control-plane");
+    const sysUser = issueUserCreds(sys, "control-plane-sys");
+    const leafTls = options.leafTls
+        ? `\n  tls { cert_file: "${options.leafTls.certFile}", key_file: "${options.leafTls.keyFile}" }`
+        : "";
+    const conf = `# Region hub (add-private-regions, RG-B2): cells link here over an outbound leaf node.
+# Generated by fonoster-region-hub-setup; operator mode, accounts pushed by the control plane.
+port: ${(_a = options.clientPort) !== null && _a !== void 0 ? _a : 4222}
+http_port: ${(_b = options.httpPort) !== null && _b !== void 0 ? _b : 8222}
+operator: ${opJwt}
+system_account: ${pub(sys)}
+resolver: {
+  type: full
+  dir: "${(_c = options.resolverDir) !== null && _c !== void 0 ? _c : "/data/jwt"}"
+  allow_delete: false
+}
+resolver_preload: {
+  ${pub(sys)}: ${sysJwt}
+  ${pub(regions)}: ${regJwt}
+}
+leafnodes {
+  port: ${(_d = options.leafPort) !== null && _d !== void 0 ? _d : 7422}${leafTls}
+}
+`;
+    return {
+        conf,
+        operatorSeed: (0, exports.seedOf)(operator),
+        accountSeed: (0, exports.seedOf)(regions),
+        accountPublicKey: pub(regions),
+        systemAccountPublicKey: pub(sys),
+        controlPlaneCreds: cpUser.creds,
+        systemCreds: sysUser.creds
+    };
+}