@fonoster/common 0.27.0 → 0.31.0

package/dist/protos/session.proto

@@ -0,0 +1,194 @@
+// Session: the per-call control stream the Roomr node opens to the session endpoint (in Fonoster,
+// AppBridge behind a Kubernetes Service). The node is the client: one new connection per call,
+// `Start` first, then commands from the app and events from the node, in order. Audio never
+// travels here; it is RTP between the two MediaEndpoints.
+// Spec: openspec/changes/redesign-roomr/specs/media-control ("Each call opens one control stream
+// to the session endpoint", "App audio is RTP negotiated on the control stream", "Transfer modes",
+// "Hold silences the app and plays hold audio", "Listeners fork audio by track", "Endings carry a
+// reason", "The app sends DTMF on the caller's leg"). Messages only grow: add fields, never
+// renumber or reuse them, and receivers ignore fields they do not know.
+//
+// Regenerate the Go code with go/roomr/api/generate.sh.
+syntax = "proto3";
+
+package session.v1;
+
+option go_package = "github.com/fonoster/roomr/api/session/v1;sessionv1";
+
+service Session {
+  rpc Connect(stream NodeMessage) returns (stream AppMessage);
+}
+
+// An RTP endpoint: `codec` is "L16/16000" on app legs; `srtp_key` (SDES, base64) when encrypted.
+message MediaEndpoint {
+  string ip = 1;
+  uint32 port = 2;
+  string codec = 3;
+  string srtp_key = 4;
+}
+
+message SipAuth {
+  string username = 1;
+  string password = 2;
+}
+
+// A SIP destination: `proxy` carries the transport in its URI (sip:host:port;transport=tcp).
+message SipTarget {
+  string uri = 1;
+  string proxy = 2;
+  map<string, string> headers = 3;
+  SipAuth auth = 4;
+}
+
+// ---- node to app
+
+message NodeMessage {
+  oneof msg {
+    Start start = 1;
+    Dtmf dtmf = 2;
+    Event event = 3;
+  }
+}
+
+message Start {
+  enum Direction {
+    INBOUND = 0;
+    OUTBOUND = 1;
+  }
+  string call_ref = 1;
+  Direction direction = 2;
+  string from = 3;
+  string to = 4;
+  // Every INVITE header, as received (inbound) or as sent (outbound).
+  map<string, string> headers = 5;
+  // Opaque to the node: CreateCall's metadata, passed through untouched.
+  map<string, string> metadata = 6;
+  string room_ref = 7;
+  // The node's RTP endpoint for this call's app leg.
+  MediaEndpoint media = 8;
+  string node_ref = 9;
+}
+
+message Dtmf {
+  string digit = 1;
+  // rfc4733, sip_info or inband
+  string source = 2;
+}
+
+message Event {
+  // 3 was operation_done (Play and Record left the node).
+  reserved 3;
+  reserved "operation_done";
+  oneof event {
+    ParticipantJoined participant_joined = 1;
+    ParticipantLeft participant_left = 2;
+    TransferResult transfer_result = 4;
+    Ended ended = 5;
+  }
+}
+
+message ParticipantJoined {
+  string participant_ref = 1;
+  uint32 track_id = 2;
+}
+
+message ParticipantLeft {
+  string participant_ref = 1;
+  string cause = 2;
+}
+
+message TransferResult {
+  // completed, referred or failed
+  string status = 1;
+  string cause = 2;
+  uint32 sip_status = 3;
+}
+
+// The call ended: `cause` is one of caller_hangup, callee_hangup, busy, no_answer, rejected,
+// media_timeout, node_error, max_duration, removed, app_gone; `sip_status` when SIP gave one.
+message Ended {
+  string cause = 1;
+  uint32 sip_status = 2;
+}
+
+// ---- app to node
+
+message AppMessage {
+  // 4, 5 and 13 were play, stop and record: the node is the SIP and media edge, not an app server
+  // (an app plays its own audio on its RTP leg; recording is a listener).
+  reserved 4, 5, 13;
+  reserved "play", "stop", "record";
+  oneof msg {
+    Answer answer = 1;
+    Ready ready = 2;
+    Reject reject = 3;
+    Transfer transfer = 6;
+    TransferComplete transfer_complete = 7;
+    Hold hold = 8;
+    Resume resume = 9;
+    SendDtmf send_dtmf = 10;
+    AddListener add_listener = 11;
+    RemoveListener remove_listener = 12;
+    Hangup hangup = 14;
+  }
+}
+
+// Inbound: the app takes the call; the node answers 200 OK.
+message Answer {
+  MediaEndpoint media = 1;
+  // Lowers the node's maximum call duration for this call (0: the node's).
+  uint32 max_duration_s = 2;
+}
+
+// Outbound: the app is ready for the answered call.
+message Ready {
+  MediaEndpoint media = 1;
+}
+
+// Inbound: the app refuses the call with this SIP status (4xx to 6xx).
+message Reject {
+  uint32 sip_status = 1;
+  string reason = 2;
+}
+
+message Transfer {
+  SipTarget to = 1;
+  // cold, warm or refer
+  string mode = 2;
+  // Warm: music for the caller while the new party is dialed.
+  string music = 3;
+  uint32 ring_timeout_s = 4;
+}
+
+message TransferComplete {}
+
+message Hold {
+  string music = 1;
+}
+
+message Resume {}
+
+// RFC 4733 events on the caller's leg, in order.
+message SendDtmf {
+  // 0-9, *, #, A-D.
+  string digits = 1;
+}
+
+message ListenTrack {
+  uint32 track_id = 1;
+  MediaEndpoint rtp = 2;
+}
+
+message AddListener {
+  string listener_ref = 1;
+  repeated ListenTrack listen = 2;
+}
+
+message RemoveListener {
+  string listener_ref = 1;
+}
+
+message Hangup {
+  uint32 sip_status = 1;
+  string reason = 2;
+}

package/dist/protos/usage.proto

@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+syntax = "proto3";
+
+package fonoster.usage.v1beta2;
+
+// What the workspace consumed: quantities only, never money (usage-metering spec).
+service Usage {
+  // Gets usage totals for a range of days, grouped as requested
+  rpc GetUsage (GetUsageRequest) returns (GetUsageResponse) {}
+}
+
+message GetUsageRequest {
+  // First day of the range, YYYY-MM-DD (UTC), inclusive
+  string from_day = 1;
+  // Last day of the range, YYYY-MM-DD (UTC), inclusive
+  string to_day = 2;
+  // Dimensions to group by: day | workspace | meter | provider | model | key_source | origin.
+  // Totals are always split by meter, so meter is implied.
+  repeated string group_by = 3;
+  // Owners only: every workspace the caller owns, instead of the caller's workspace
+  bool all_owned = 4;
+}
+
+message UsageRow {
+  // Set only for the dimensions requested in group_by
+  string day = 1;
+  string workspace_ref = 2;
+  string meter = 3;
+  // second | character | token | count | byte
+  string unit = 4;
+  string provider = 5;
+  string model = 6;
+  // platform | workspace; empty for meters that call no vendor
+  string key_source = 7;
+  // call | browser_test | eval | api
+  string origin = 8;
+  double quantity = 9;
+}
+
+message GetUsageResponse {
+  repeated UsageRow rows = 1;
+}

package/dist/protos/webhooks.proto

@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+syntax = "proto3";
+
+package fonoster.webhooks.v1beta2;
+
+// Workspace webhooks (add-workspace-webhooks): endpoints, secret rotation and the delivery log
+service Webhooks {
+  // Create an endpoint; the response carries its signing secret (shown once)
+  rpc CreateWebhook(CreateWebhookRequest) returns (CreateWebhookResponse) {}
+  // List the workspace's endpoints
+  rpc ListWebhooks(ListWebhooksRequest) returns (ListWebhooksResponse) {}
+  // Get one endpoint
+  rpc GetWebhook(GetWebhookRequest) returns (Webhook) {}
+  // Change an endpoint's URL or events
+  rpc UpdateWebhook(UpdateWebhookRequest) returns (UpdateWebhookResponse) {}
+  // Delete an endpoint
+  rpc DeleteWebhook(DeleteWebhookRequest) returns (DeleteWebhookResponse) {}
+  // New signing secret; the previous one keeps verifying for 24 hours
+  rpc RotateWebhookSecret(RotateWebhookSecretRequest) returns (RotateWebhookSecretResponse) {}
+  // The delivery log, newest first
+  rpc ListWebhookDeliveries(ListWebhookDeliveriesRequest) returns (ListWebhookDeliveriesResponse) {}
+  // Send a delivery again now (same event id, fresh signature)
+  rpc ResendWebhookDelivery(ResendWebhookDeliveryRequest) returns (WebhookDelivery) {}
+}
+
+message Webhook {
+  string ref = 1;
+  string url = 2;
+  // Subscribed event types, e.g. call.ended
+  repeated string events = 3;
+  // The last characters of the current secret
+  string secret_hint = 4;
+  // Seconds since the epoch until which the previous secret still verifies (0: none)
+  int32 previous_secret_until = 5;
+  int32 created_at = 6;
+  int32 updated_at = 7;
+}
+
+message CreateWebhookRequest {
+  string url = 1;
+  repeated string events = 2;
+}
+
+message CreateWebhookResponse {
+  string ref = 1;
+  // Shown only here and on rotation
+  string secret = 2;
+}
+
+message ListWebhooksRequest {
+  int32 page_size = 1;
+  string page_token = 2;
+}
+
+message ListWebhooksResponse {
+  repeated Webhook items = 1;
+  string next_page_token = 2;
+}
+
+message GetWebhookRequest {
+  string ref = 1;
+}
+
+message UpdateWebhookRequest {
+  string ref = 1;
+  // Empty keeps the URL
+  string url = 2;
+  // Empty keeps the events
+  repeated string events = 3;
+}
+
+message UpdateWebhookResponse {
+  string ref = 1;
+}
+
+message DeleteWebhookRequest {
+  string ref = 1;
+}
+
+message DeleteWebhookResponse {
+  string ref = 1;
+}
+
+message RotateWebhookSecretRequest {
+  string ref = 1;
+}
+
+message RotateWebhookSecretResponse {
+  string ref = 1;
+  string secret = 2;
+  // Seconds since the epoch until which the previous secret still verifies
+  int32 previous_secret_until = 3;
+}
+
+message WebhookDelivery {
+  string ref = 1;
+  string webhook_ref = 2;
+  string event_id = 3;
+  string event_type = 4;
+  // pending, succeeded or failed
+  string status = 5;
+  int32 attempts = 6;
+  // HTTP status of the last attempt (0: no response)
+  int32 last_status = 7;
+  int32 last_attempt_at = 8;
+  int32 next_attempt_at = 9;
+  int32 created_at = 10;
+}
+
+message ListWebhookDeliveriesRequest {
+  // Optional: one endpoint's deliveries
+  string webhook_ref = 1;
+  // At most this many (default 50, up to 200)
+  int32 page_size = 2;
+}
+
+message ListWebhookDeliveriesResponse {
+  repeated WebhookDelivery items = 1;
+}
+
+message ResendWebhookDeliveryRequest {
+  string ref = 1;
+}

package/dist/{utils/types.d.ts → regions/hub/index.d.ts}

@@ -16,8 +16,4 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { ParameterizedQuery } from "@influxdata/influxdb-client";
-type InfluxDBClient = {
-    collectRows(query: ParameterizedQuery): Promise<unknown[]>;
-};
-export { InfluxDBClient };
+export * from "./natsJwt";

package/dist/regions/hub/index.js

@@ -0,0 +1,35 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+__exportStar(require("./natsJwt"), exports);

package/dist/regions/hub/natsJwt.d.ts

@@ -0,0 +1,63 @@
+import { createAccount, createOperator, createUser, KeyPair } from "nkeys.js";
+export type NatsClaims = {
+    jti?: string;
+    iat: number;
+    iss: string;
+    name?: string;
+    sub: string;
+    exp?: number;
+    nats: Record<string, unknown>;
+};
+/** Signs claims with an nkey pair (operator signs accounts, accounts sign users). */
+export declare function encodeNatsJwt(claims: NatsClaims, signer: KeyPair): string;
+/** The claims of a NATS JWT (no verification; for tests and diagnostics). */
+export declare function decodeNatsJwt(jwt: string): NatsClaims;
+export declare function operatorJwt(operator: KeyPair, systemAccount: string): string;
+/**
+ * An account JWT. `revocations` maps user public keys to the unix time before which their JWTs
+ * are revoked; re-publishing the account with a new entry disconnects that user.
+ */
+export declare function accountJwt(operator: KeyPair, account: string, name: string, revocations?: Record<string, number>, extra?: Record<string, unknown>): string;
+export type UserPermissions = {
+    pub: string[];
+    sub: string[];
+};
+export declare function userJwt(account: KeyPair, user: string, name: string, permissions?: UserPermissions): string;
+/** A NATS credentials file (the user JWT and its seed), as `nsc` writes it. */
+export declare function formatCreds(jwt: string, seed: string): string;
+/** Issues a fresh user (new nkey) under an account and returns its credentials file. */
+export declare function issueUserCreds(account: KeyPair, name: string, permissions?: UserPermissions): {
+    publicKey: string;
+    jwt: string;
+    creds: string;
+};
+export declare const seedOf: (kp: KeyPair) => string;
+export declare const keyPairFromSeed: (seed: string) => KeyPair;
+export declare const REGIONS_ACCOUNT_NAME = "REGIONS";
+/** Claims of the REGIONS account; the hub preloads it and the control plane re-signs it. */
+export declare function regionsAccountJwt(operator: KeyPair, account: string, revocations?: Record<string, number>): string;
+/**
+ * Everything a region hub needs, generated once by `fonoster-region-hub-setup`:
+ * the hub's nats.conf, the control plane's seeds and two credentials files (the control plane's
+ * REGIONS user, unrestricted, and a system-account user to push account updates).
+ */
+export declare function generateRegionHub(options: {
+    clientPort?: number;
+    leafPort?: number;
+    httpPort?: number;
+    /** TLS for the leaf listener (production); omitted only for local stacks. */
+    leafTls?: {
+        certFile: string;
+        keyFile: string;
+    };
+    resolverDir?: string;
+}): {
+    conf: string;
+    operatorSeed: string;
+    accountSeed: string;
+    accountPublicKey: string;
+    systemAccountPublicKey: string;
+    controlPlaneCreds: string;
+    systemCreds: string;
+};
+export { createAccount, createOperator, createUser, KeyPair };

package/dist/regions/hub/natsJwt.js

@@ -0,0 +1,195 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createUser = exports.createOperator = exports.createAccount = exports.REGIONS_ACCOUNT_NAME = exports.keyPairFromSeed = exports.seedOf = void 0;
+exports.encodeNatsJwt = encodeNatsJwt;
+exports.decodeNatsJwt = decodeNatsJwt;
+exports.operatorJwt = operatorJwt;
+exports.accountJwt = accountJwt;
+exports.userJwt = userJwt;
+exports.formatCreds = formatCreds;
+exports.issueUserCreds = issueUserCreds;
+exports.regionsAccountJwt = regionsAccountJwt;
+exports.generateRegionHub = generateRegionHub;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const crypto_1 = require("crypto");
+const nkeys_js_1 = require("nkeys.js");
+Object.defineProperty(exports, "createAccount", { enumerable: true, get: function () { return nkeys_js_1.createAccount; } });
+Object.defineProperty(exports, "createOperator", { enumerable: true, get: function () { return nkeys_js_1.createOperator; } });
+Object.defineProperty(exports, "createUser", { enumerable: true, get: function () { return nkeys_js_1.createUser; } });
+/**
+ * Minimal NATS decentralized-auth JWTs (v2), enough for the region hub (RG-B2): an operator, the
+ * system account, the REGIONS account (with its user revocations) and per-region users whose
+ * permissions are `region.<ref>.>` only. Same encoding as nats-io/jwt: header
+ * `{"typ":"JWT","alg":"ed25519-nkey"}`, base64url parts, `jti` = base32(sha512/256(claims)).
+ */
+const HEADER = { typ: "JWT", alg: "ed25519-nkey" };
+const B32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+const b64url = (buf) => Buffer.from(buf).toString("base64url");
+function base32(buf) {
+    let bits = 0;
+    let value = 0;
+    let out = "";
+    for (const byte of buf) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            out += B32[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0)
+        out += B32[(value << (5 - bits)) & 31];
+    return out;
+}
+/** Signs claims with an nkey pair (operator signs accounts, accounts sign users). */
+function encodeNatsJwt(claims, signer) {
+    const body = Object.assign(Object.assign({}, claims), { jti: "" });
+    body.jti = base32((0, crypto_1.createHash)("sha512-256").update(JSON.stringify(body)).digest());
+    const head = b64url(Buffer.from(JSON.stringify(HEADER)));
+    const payload = b64url(Buffer.from(JSON.stringify(body)));
+    const sig = signer.sign(Buffer.from(`${head}.${payload}`));
+    return `${head}.${payload}.${b64url(sig)}`;
+}
+/** The claims of a NATS JWT (no verification; for tests and diagnostics). */
+function decodeNatsJwt(jwt) {
+    return JSON.parse(Buffer.from(jwt.split(".")[1], "base64url").toString());
+}
+const now = () => Math.floor(Date.now() / 1000);
+const pub = (kp) => kp.getPublicKey();
+const NO_LIMITS = { subs: -1, data: -1, payload: -1 };
+function operatorJwt(operator, systemAccount) {
+    return encodeNatsJwt({
+        iat: now(),
+        iss: pub(operator),
+        sub: pub(operator),
+        name: "fonoster-regions",
+        nats: { system_account: systemAccount, type: "operator", version: 2 }
+    }, operator);
+}
+/**
+ * An account JWT. `revocations` maps user public keys to the unix time before which their JWTs
+ * are revoked; re-publishing the account with a new entry disconnects that user.
+ */
+function accountJwt(operator, account, name, revocations = {}, extra = {}) {
+    return encodeNatsJwt({
+        iat: now(),
+        iss: pub(operator),
+        sub: account,
+        name,
+        nats: Object.assign(Object.assign(Object.assign({ limits: Object.assign(Object.assign({}, NO_LIMITS), { imports: -1, exports: -1, wildcards: true, conn: -1, leaf: -1 }), default_permissions: { pub: {}, sub: {} } }, (Object.keys(revocations).length ? { revocations } : {})), extra), { type: "account", version: 2 })
+    }, operator);
+}
+function userJwt(account, user, name, permissions) {
+    return encodeNatsJwt({
+        iat: now(),
+        iss: pub(account),
+        sub: user,
+        name,
+        nats: Object.assign(Object.assign(Object.assign({}, (permissions
+            ? {
+                pub: { allow: permissions.pub },
+                sub: { allow: permissions.sub }
+            }
+            : { pub: {}, sub: {} })), NO_LIMITS), { type: "user", version: 2 })
+    }, account);
+}
+/** A NATS credentials file (the user JWT and its seed), as `nsc` writes it. */
+function formatCreds(jwt, seed) {
+    return `-----BEGIN NATS USER JWT-----
+${jwt}
+------END NATS USER JWT------
+
+************************* IMPORTANT *************************
+NKEY Seed printed below can be used to sign and prove identity.
+NKEYs are sensitive and should be treated as secrets.
+
+-----BEGIN USER NKEY SEED-----
+${seed}
+------END USER NKEY SEED------
+
+*************************************************************
+`;
+}
+/** Issues a fresh user (new nkey) under an account and returns its credentials file. */
+function issueUserCreds(account, name, permissions) {
+    const user = (0, nkeys_js_1.createUser)();
+    const jwt = userJwt(account, pub(user), name, permissions);
+    return {
+        publicKey: pub(user),
+        jwt,
+        creds: formatCreds(jwt, Buffer.from(user.getSeed()).toString())
+    };
+}
+const seedOf = (kp) => Buffer.from(kp.getSeed()).toString();
+exports.seedOf = seedOf;
+const keyPairFromSeed = (seed) => (0, nkeys_js_1.fromSeed)(Buffer.from(seed.trim()));
+exports.keyPairFromSeed = keyPairFromSeed;
+exports.REGIONS_ACCOUNT_NAME = "REGIONS";
+/** Claims of the REGIONS account; the hub preloads it and the control plane re-signs it. */
+function regionsAccountJwt(operator, account, revocations = {}) {
+    return accountJwt(operator, account, exports.REGIONS_ACCOUNT_NAME, revocations);
+}
+/**
+ * Everything a region hub needs, generated once by `fonoster-region-hub-setup`:
+ * the hub's nats.conf, the control plane's seeds and two credentials files (the control plane's
+ * REGIONS user, unrestricted, and a system-account user to push account updates).
+ */
+function generateRegionHub(options) {
+    var _a, _b, _c, _d;
+    const operator = (0, nkeys_js_1.createOperator)();
+    const sys = (0, nkeys_js_1.createAccount)();
+    const regions = (0, nkeys_js_1.createAccount)();
+    const opJwt = operatorJwt(operator, pub(sys));
+    const sysJwt = accountJwt(operator, pub(sys), "SYS");
+    const regJwt = regionsAccountJwt(operator, pub(regions));
+    const cpUser = issueUserCreds(regions, "control-plane");
+    const sysUser = issueUserCreds(sys, "control-plane-sys");
+    const leafTls = options.leafTls
+        ? `\n  tls { cert_file: "${options.leafTls.certFile}", key_file: "${options.leafTls.keyFile}" }`
+        : "";
+    const conf = `# Region hub (add-private-regions, RG-B2): cells link here over an outbound leaf node.
+# Generated by fonoster-region-hub-setup; operator mode, accounts pushed by the control plane.
+port: ${(_a = options.clientPort) !== null && _a !== void 0 ? _a : 4222}
+http_port: ${(_b = options.httpPort) !== null && _b !== void 0 ? _b : 8222}
+operator: ${opJwt}
+system_account: ${pub(sys)}
+resolver: {
+  type: full
+  dir: "${(_c = options.resolverDir) !== null && _c !== void 0 ? _c : "/data/jwt"}"
+  allow_delete: false
+}
+resolver_preload: {
+  ${pub(sys)}: ${sysJwt}
+  ${pub(regions)}: ${regJwt}
+}
+leafnodes {
+  port: ${(_d = options.leafPort) !== null && _d !== void 0 ? _d : 7422}${leafTls}
+}
+`;
+    return {
+        conf,
+        operatorSeed: (0, exports.seedOf)(operator),
+        accountSeed: (0, exports.seedOf)(regions),
+        accountPublicKey: pub(regions),
+        systemAccountPublicKey: pub(sys),
+        controlPlaneCreds: cpUser.creds,
+        systemCreds: sysUser.creds
+    };
+}