@camstack/agent 1.1.43 → 1.1.45

package/dist/cli.js

@@ -60,6 +60,9 @@ var require_dist = __commonJS({
     var src_exports = {};
     __export(src_exports, {
       AGENT_ROOT_SPEC: () => AGENT_ROOT_SPEC2,
+      DEV_UPLOADS_DIRNAME: () => DEV_UPLOADS_DIRNAME,
+      DEV_UPLOADS_KEEP_COUNT: () => DEV_UPLOADS_KEEP_COUNT,
+      DEV_UPLOAD_MANIFEST_FILE: () => DEV_UPLOAD_MANIFEST_FILE,
       HOST_EXTERNAL_SPECIFIERS: () => HOST_EXTERNAL_SPECIFIERS,
       HUB_ROOT_SPEC: () => HUB_ROOT_SPEC,
       RESTART_INTENT_FILE: () => RESTART_INTENT_FILE,
@@ -69,11 +72,17 @@ var require_dist = __commonJS({
       clearRestartIntentMarker: () => clearRestartIntentMarker,
       compareSemver: () => compareSemver,
       detectWorkspaceRoot: () => detectWorkspaceRoot,
+      devChannelEpoch: () => devChannelEpoch,
+      devUploadManifestPath: () => devUploadManifestPath,
+      devUploadVersionDir: () => devUploadVersionDir,
+      devUploadsDir: () => devUploadsDir,
       emptyServerRootState: () => emptyServerRootState,
+      isDevChannelVersion: () => isDevChannelVersion,
       isHostExternal: () => isHostExternal,
       isServerRootState: () => isServerRootState,
       minNodeMajorOf: () => minNodeMajorOf,
       planBoot: () => planBoot,
+      readDevUploadManifest: () => readDevUploadManifest,
       readRestartIntentMarker: () => readRestartIntentMarker,
       readServerRootState: () => readServerRootState,
       registerActiveRootResolver: () => registerActiveRootResolver,
@@ -86,10 +95,58 @@ var require_dist = __commonJS({
       validateVersionDir: () => validateVersionDir,
       versionDir: () => versionDir,
       versionsDir: () => versionsDir,
+      writeDevUploadManifest: () => writeDevUploadManifest,
       writeRestartIntentMarker: () => writeRestartIntentMarker2,
       writeServerRootState: () => writeServerRootState
     });
     module2.exports = __toCommonJS(src_exports);
+    var fs8 = __toESM2(require("fs"));
+    var path9 = __toESM2(require("path"));
+    var DEV_UPLOADS_DIRNAME = "dev-uploads";
+    var DEV_UPLOAD_MANIFEST_FILE = "manifest.json";
+    var DEV_UPLOADS_KEEP_COUNT = 3;
+    var DEV_CHANNEL_VERSION_RE = /-dev\.\d+$/;
+    function isDevChannelVersion(version) {
+      return DEV_CHANNEL_VERSION_RE.test(version);
+    }
+    function devChannelEpoch(version) {
+      const match = /-dev\.(\d+)$/.exec(version);
+      if (match === null) return null;
+      const epoch = Number.parseInt(match[1] ?? "", 10);
+      return Number.isNaN(epoch) ? null : epoch;
+    }
+    function devUploadsDir(rootDir) {
+      return path9.join(rootDir, DEV_UPLOADS_DIRNAME);
+    }
+    function devUploadVersionDir(rootDir, version) {
+      return path9.join(devUploadsDir(rootDir), version);
+    }
+    function devUploadManifestPath(versionDirPath) {
+      return path9.join(versionDirPath, DEV_UPLOAD_MANIFEST_FILE);
+    }
+    function isDevUploadManifest(v) {
+      if (typeof v !== "object" || v === null) return false;
+      const m = v;
+      if (typeof m["version"] !== "string") return false;
+      const packages = m["packages"];
+      if (typeof packages !== "object" || packages === null || Array.isArray(packages)) return false;
+      return Object.values(packages).every((filename) => typeof filename === "string");
+    }
+    function readDevUploadManifest(versionDirPath) {
+      try {
+        const raw = JSON.parse(fs8.readFileSync(devUploadManifestPath(versionDirPath), "utf-8"));
+        return isDevUploadManifest(raw) ? raw : null;
+      } catch {
+        return null;
+      }
+    }
+    function writeDevUploadManifest(versionDirPath, manifest) {
+      fs8.mkdirSync(versionDirPath, { recursive: true });
+      const target = devUploadManifestPath(versionDirPath);
+      const tmp = `${target}.tmp`;
+      fs8.writeFileSync(tmp, JSON.stringify(manifest, null, 2), "utf-8");
+      fs8.renameSync(tmp, target);
+    }
     var HUB_ROOT_SPEC = {
       packageName: "@camstack/server",
       entryRelPath: ["dist", "launcher.js"]
@@ -98,8 +155,8 @@ var require_dist = __commonJS({
       packageName: "@camstack/agent",
       entryRelPath: ["dist", "cli.js"]
     };
-    var fs8 = __toESM2(require("fs"));
-    var path9 = __toESM2(require("path"));
+    var fs22 = __toESM2(require("fs"));
+    var path22 = __toESM2(require("path"));
     var SERVER_ROOT_DIRNAME = "server-root";
     var SERVER_ROOT_STATE_FILE = "state.json";
     var RESTART_INTENT_FILE = ".restart-intent";
@@ -113,22 +170,22 @@ var require_dist = __commonJS({
       };
     }
     function serverRootDir2(dataDir) {
-      return path9.join(dataDir, SERVER_ROOT_DIRNAME);
+      return path22.join(dataDir, SERVER_ROOT_DIRNAME);
     }
     function versionsDir(rootDir) {
-      return path9.join(rootDir, "versions");
+      return path22.join(rootDir, "versions");
     }
     function versionDir(rootDir, version) {
-      return path9.join(versionsDir(rootDir), version);
+      return path22.join(versionsDir(rootDir), version);
     }
     function rootPackageDir(versionDirPath, spec) {
-      return path9.join(versionDirPath, "node_modules", ...spec.packageName.split("/"));
+      return path22.join(versionDirPath, "node_modules", ...spec.packageName.split("/"));
     }
     function rootEntryPath(versionDirPath, spec) {
-      return path9.join(rootPackageDir(versionDirPath, spec), ...spec.entryRelPath);
+      return path22.join(rootPackageDir(versionDirPath, spec), ...spec.entryRelPath);
     }
     function stateFilePath(rootDir) {
-      return path9.join(rootDir, SERVER_ROOT_STATE_FILE);
+      return path22.join(rootDir, SERVER_ROOT_STATE_FILE);
     }
     function isNullableString(v) {
       return v === null || typeof v === "string";
@@ -155,21 +212,21 @@ var require_dist = __commonJS({
     }
     function readServerRootState(rootDir) {
       try {
-        const raw = JSON.parse(fs8.readFileSync(stateFilePath(rootDir), "utf-8"));
+        const raw = JSON.parse(fs22.readFileSync(stateFilePath(rootDir), "utf-8"));
         return isServerRootState(raw) ? raw : null;
       } catch {
         return null;
       }
     }
     function writeServerRootState(rootDir, state) {
-      fs8.mkdirSync(rootDir, { recursive: true });
+      fs22.mkdirSync(rootDir, { recursive: true });
       const target = stateFilePath(rootDir);
       const tmp = `${target}.tmp`;
-      fs8.writeFileSync(tmp, JSON.stringify(state, null, 2), "utf-8");
-      fs8.renameSync(tmp, target);
+      fs22.writeFileSync(tmp, JSON.stringify(state, null, 2), "utf-8");
+      fs22.renameSync(tmp, target);
     }
     function restartIntentMarkerPath(rootDir) {
-      return path9.join(rootDir, RESTART_INTENT_FILE);
+      return path22.join(rootDir, RESTART_INTENT_FILE);
     }
     function isRestartIntentMarker(v) {
       if (typeof v !== "object" || v === null) return false;
@@ -177,15 +234,15 @@ var require_dist = __commonJS({
       return typeof m["requestedAtMs"] === "number" && typeof m["reason"] === "string";
     }
     function writeRestartIntentMarker2(rootDir, marker) {
-      fs8.mkdirSync(rootDir, { recursive: true });
+      fs22.mkdirSync(rootDir, { recursive: true });
       const target = restartIntentMarkerPath(rootDir);
       const tmp = `${target}.tmp`;
-      fs8.writeFileSync(tmp, JSON.stringify(marker, null, 2), "utf-8");
-      fs8.renameSync(tmp, target);
+      fs22.writeFileSync(tmp, JSON.stringify(marker, null, 2), "utf-8");
+      fs22.renameSync(tmp, target);
     }
     function readRestartIntentMarker(rootDir) {
       try {
-        const raw = JSON.parse(fs8.readFileSync(restartIntentMarkerPath(rootDir), "utf-8"));
+        const raw = JSON.parse(fs22.readFileSync(restartIntentMarkerPath(rootDir), "utf-8"));
         return isRestartIntentMarker(raw) ? raw : null;
       } catch {
         return null;
@@ -193,7 +250,7 @@ var require_dist = __commonJS({
     }
     function clearRestartIntentMarker(rootDir) {
       try {
-        fs8.rmSync(restartIntentMarkerPath(rootDir), { force: true });
+        fs22.rmSync(restartIntentMarkerPath(rootDir), { force: true });
       } catch {
       }
     }
@@ -206,13 +263,13 @@ var require_dist = __commonJS({
     function validateVersionDir(rootDir, version, nodeMajor, spec) {
       const vDir = versionDir(rootDir, version);
       const entry = rootEntryPath(vDir, spec);
-      if (!fs8.existsSync(entry)) {
+      if (!fs22.existsSync(entry)) {
         return `root entry missing: ${entry}`;
       }
-      const pkgJsonPath = path9.join(rootPackageDir(vDir, spec), "package.json");
+      const pkgJsonPath = path22.join(rootPackageDir(vDir, spec), "package.json");
       let pkg;
       try {
-        const raw = JSON.parse(fs8.readFileSync(pkgJsonPath, "utf-8"));
+        const raw = JSON.parse(fs22.readFileSync(pkgJsonPath, "utf-8"));
         if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
           return `package.json malformed: ${pkgJsonPath}`;
         }
@@ -359,25 +416,25 @@ var require_dist = __commonJS({
       if (pa.prerelease > pb.prerelease) return 1;
       return 0;
     }
-    var fs22 = __toESM2(require("fs"));
-    var path22 = __toESM2(require("path"));
+    var fs32 = __toESM2(require("fs"));
+    var path32 = __toESM2(require("path"));
     function detectWorkspaceRoot(fromDir) {
-      let dir = path22.resolve(fromDir);
+      let dir = path32.resolve(fromDir);
       for (; ; ) {
-        const pkgPath = path22.join(dir, "package.json");
+        const pkgPath = path32.join(dir, "package.json");
         try {
-          const raw = JSON.parse(fs22.readFileSync(pkgPath, "utf-8"));
+          const raw = JSON.parse(fs32.readFileSync(pkgPath, "utf-8"));
           if (typeof raw === "object" && raw !== null && raw["workspaces"] !== void 0) {
             return dir;
           }
         } catch {
         }
-        const parent = path22.dirname(dir);
+        const parent = path32.dirname(dir);
         if (parent === dir) return null;
         dir = parent;
       }
     }
-    var path32 = __toESM2(require("path"));
+    var path42 = __toESM2(require("path"));
     var import_node_url = require("url");
     var HOST_EXTERNAL_SPECIFIERS = [
       "@camstack/system",
@@ -405,7 +462,7 @@ var require_dist = __commonJS({
         return;
       }
       const anchorURL = (0, import_node_url.pathToFileURL)(
-        path32.join(activeRootDir, "node_modules", "__camstack_starter_anchor__.js")
+        path42.join(activeRootDir, "node_modules", "__camstack_starter_anchor__.js")
       ).href;
       const hooks = {
         resolve: (specifier, context, nextResolve) => {
@@ -483,8 +540,8 @@ var require_dist = __commonJS({
       options.loadEntry(options.seedEntry);
     }
     var import_node_child_process = require("child_process");
-    var fs32 = __toESM2(require("fs"));
-    var path42 = __toESM2(require("path"));
+    var fs42 = __toESM2(require("fs"));
+    var path52 = __toESM2(require("path"));
     var import_node_util = require("util");
     var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
     function buildNpmRegistryArgs(registry) {
@@ -496,7 +553,7 @@ var require_dist = __commonJS({
     var RESTART_REASON_PREFIX = "server-update";
     function readPackageVersion(pkgJsonPath) {
       try {
-        const raw = JSON.parse(fs32.readFileSync(pkgJsonPath, "utf-8"));
+        const raw = JSON.parse(fs42.readFileSync(pkgJsonPath, "utf-8"));
         if (typeof raw === "object" && raw !== null) {
           const version = raw["version"];
           if (typeof version === "string") return version;
@@ -523,7 +580,7 @@ var require_dist = __commonJS({
         this.envNames = options.envNames;
         this.logger = options.logger;
         this.restartServerFn = options.restartServer;
-        this.dataDir = path42.resolve(options.dataDir);
+        this.dataDir = path52.resolve(options.dataDir);
         this.execNpm = options.execNpm ?? (async (args2, opts) => {
           const { stdout } = await execFileAsync("npm", [...args2], {
             cwd: opts.cwd,
@@ -552,7 +609,7 @@ var require_dist = __commonJS({
       seedVersion() {
         const seedDir = this.env[this.envNames.seedDir];
         if (seedDir === void 0 || seedDir.length === 0) return null;
-        return readPackageVersion(path42.join(seedDir, "package.json"));
+        return readPackageVersion(path52.join(seedDir, "package.json"));
       }
       rootDir() {
         return serverRootDir2(this.dataDir);
@@ -570,7 +627,7 @@ var require_dist = __commonJS({
         const rootDir = this.rootDir();
         const raw = readServerRootState(rootDir);
         if (raw !== null) return { state: raw, corrupt: false };
-        return { state: emptyServerRootState(), corrupt: fs32.existsSync(stateFilePath(rootDir)) };
+        return { state: emptyServerRootState(), corrupt: fs42.existsSync(stateFilePath(rootDir)) };
       }
       updateState(state) {
         if (this.inFlight === "checking") return "checking";
@@ -710,6 +767,17 @@ var require_dist = __commonJS({
             message: `Refused: ${this.spec.packageName}@${target} is already running.`
           };
         }
+        if (isDevChannelVersion(target)) {
+          const uploadsDir = devUploadVersionDir(this.rootDir(), target);
+          if (!fs42.existsSync(uploadsDir)) {
+            return {
+              accepted: false,
+              targetVersion: target,
+              restarting: false,
+              message: `Refused: dev-channel version ${target} has no uploaded tarballs on this node (${uploadsDir} is missing). Dev server deploys are hub-only in this phase \u2014 upload via \`camstack deploy-server\` against this node first.`
+            };
+          }
+        }
         this.inFlight = "staging";
         try {
           await this.stageAndActivate(target);
@@ -756,34 +824,40 @@ var require_dist = __commonJS({
       async stageAndActivate(target) {
         const rootDir = this.rootDir();
         const vDir = versionsDir(rootDir);
-        fs32.mkdirSync(vDir, { recursive: true });
-        const stagingDir = path42.join(vDir, `.staging-${target}-${process.pid}-${this.now()}`);
-        fs32.mkdirSync(stagingDir, { recursive: true });
+        fs42.mkdirSync(vDir, { recursive: true });
+        const stagingDir = path52.join(vDir, `.staging-${target}-${process.pid}-${this.now()}`);
+        fs42.mkdirSync(stagingDir, { recursive: true });
         try {
-          fs32.writeFileSync(
-            path42.join(stagingDir, "package.json"),
-            JSON.stringify({ name: "camstack-node-root", private: true }, null, 2),
-            "utf-8"
-          );
+          const devDir = devUploadVersionDir(rootDir, target);
           const registry = this.env["CAMSTACK_NPM_REGISTRY"];
-          await this.execNpm(
-            [
-              "install",
-              "--omit=dev",
-              "--no-audit",
-              "--no-fund",
-              "--loglevel=error",
-              `${this.spec.packageName}@${target}`,
-              ...buildNpmRegistryArgs(registry)
-            ],
-            { cwd: stagingDir, timeoutMs: NPM_INSTALL_TIMEOUT_MS }
-          );
+          const installArgs = ["install", "--omit=dev", "--no-audit", "--no-fund", "--loglevel=error"];
+          if (fs42.existsSync(devDir)) {
+            fs42.writeFileSync(
+              path52.join(stagingDir, "package.json"),
+              JSON.stringify(this.buildDevUploadsPackageJson(devDir, target), null, 2),
+              "utf-8"
+            );
+            await this.execNpm([...installArgs, ...buildNpmRegistryArgs(registry)], {
+              cwd: stagingDir,
+              timeoutMs: NPM_INSTALL_TIMEOUT_MS
+            });
+          } else {
+            fs42.writeFileSync(
+              path52.join(stagingDir, "package.json"),
+              JSON.stringify({ name: "camstack-node-root", private: true }, null, 2),
+              "utf-8"
+            );
+            await this.execNpm(
+              [...installArgs, `${this.spec.packageName}@${target}`, ...buildNpmRegistryArgs(registry)],
+              { cwd: stagingDir, timeoutMs: NPM_INSTALL_TIMEOUT_MS }
+            );
+          }
           const entry = rootEntryPath(stagingDir, this.spec);
-          if (!fs32.existsSync(entry)) {
+          if (!fs42.existsSync(entry)) {
             throw new Error(`staged closure is missing the root entry (${entry})`);
           }
           const stagedVersion = readPackageVersion(
-            path42.join(rootPackageDir(stagingDir, this.spec), "package.json")
+            path52.join(rootPackageDir(stagingDir, this.spec), "package.json")
           );
           if (stagedVersion !== target) {
             throw new Error(
@@ -791,17 +865,61 @@ var require_dist = __commonJS({
             );
           }
           const dest = versionDir(rootDir, target);
-          if (fs32.existsSync(dest)) {
+          if (fs42.existsSync(dest)) {
             const aside = `${dest}.evicted-${this.now()}`;
-            await fs32.promises.rename(dest, aside);
-            await fs32.promises.rm(aside, { recursive: true, force: true }).catch(() => void 0);
+            await fs42.promises.rename(dest, aside);
+            await fs42.promises.rm(aside, { recursive: true, force: true }).catch(() => void 0);
           }
-          await fs32.promises.rename(stagingDir, dest);
+          await fs42.promises.rename(stagingDir, dest);
         } catch (err) {
-          await fs32.promises.rm(stagingDir, { recursive: true, force: true }).catch(() => void 0);
+          await fs42.promises.rm(stagingDir, { recursive: true, force: true }).catch(() => void 0);
           throw err;
         }
       }
+      /**
+       * Synthetic staging package.json for the dev server-deploy channel:
+       * `dependencies` carries the root package as a `file:` ref to its uploaded
+       * tgz; `overrides` maps EVERY OTHER uploaded `@camstack/<name>` to its tgz
+       * so any transitive occurrence resolves to the uploaded copy, never npm.
+       * Fail-closed: a missing/invalid manifest, a manifest for a different
+       * version, a missing root package, or a listed-but-absent tgz all throw
+       * (surfaced by `applyServerUpdate` as a staging failure).
+       */
+      buildDevUploadsPackageJson(devDir, target) {
+        const manifest = readDevUploadManifest(devDir);
+        if (manifest === null) {
+          throw new Error(`dev-uploads manifest missing or invalid in ${devDir}`);
+        }
+        if (manifest.version !== target) {
+          throw new Error(
+            `dev-uploads manifest version mismatch: dir is for ${target}, manifest says ${manifest.version}`
+          );
+        }
+        const rootTgz = manifest.packages[this.spec.packageName];
+        if (rootTgz === void 0) {
+          throw new Error(
+            `dev-uploads for ${target} do not include the root package ${this.spec.packageName}`
+          );
+        }
+        const fileRef = (filename) => {
+          const abs = path52.join(devDir, filename);
+          if (!fs42.existsSync(abs)) {
+            throw new Error(`dev-uploads tarball listed in the manifest is missing: ${abs}`);
+          }
+          return `file:${abs}`;
+        };
+        const overrides = {};
+        for (const [pkgName, filename] of Object.entries(manifest.packages)) {
+          if (pkgName === this.spec.packageName) continue;
+          overrides[pkgName] = fileRef(filename);
+        }
+        return {
+          name: "camstack-node-root",
+          private: true,
+          dependencies: { [this.spec.packageName]: fileRef(rootTgz) },
+          ...Object.keys(overrides).length > 0 ? { overrides } : {}
+        };
+      }
       // ── Rollback ──────────────────────────────────────────────────────────
       async rollbackServerUpdate() {
         if (this.inFlight !== "idle") {
@@ -931,6 +1049,7 @@ var require_dist = __commonJS({
             (v) => typeof v === "string"
           )
         );
+        this.sweepDevUploads(DEV_UPLOADS_KEEP_COUNT);
         this.logger.info("root package update confirmed healthy", {
           meta: {
             version: promoted.currentVersion,
@@ -954,23 +1073,23 @@ var require_dist = __commonJS({
         const vDir = versionsDir(this.rootDir());
         let entries;
         try {
-          entries = fs32.readdirSync(vDir);
+          entries = fs42.readdirSync(vDir);
         } catch {
           return;
         }
         for (const entry of entries) {
           if (keep.includes(entry)) continue;
-          const full = path42.join(vDir, entry);
+          const full = path52.join(vDir, entry);
           if (entry.startsWith(".")) {
             try {
-              const ageMs = this.now() - fs32.statSync(full).mtimeMs;
+              const ageMs = this.now() - fs42.statSync(full).mtimeMs;
               if (ageMs < _RootUpdateService.STALE_TRANSIENT_MS) continue;
             } catch {
               continue;
             }
           }
           try {
-            fs32.rmSync(full, { recursive: true, force: true });
+            fs42.rmSync(full, { recursive: true, force: true });
             this.logger.debug("pruned server-root version dir", { meta: { entry } });
           } catch (err) {
             this.logger.warn("failed to prune server-root version dir", {
@@ -979,6 +1098,56 @@ var require_dist = __commonJS({
           }
         }
       }
+      /**
+       * Promote-time sweep of `server-root/dev-uploads/`: keep only the
+       * `keepCount` most recent entries (ordered by the self-describing
+       * `-dev.<epochSeconds>` suffix; non-dev-shaped residue counts as oldest).
+       * Uses the same rename-aside graveyard pattern as the addon installer —
+       * a rename is a metadata op that succeeds even when a tarball is held
+       * open, and residue in the graveyard is re-swept on the next promote.
+       */
+      sweepDevUploads(keepCount) {
+        const dir = devUploadsDir(this.rootDir());
+        let entries;
+        try {
+          entries = fs42.readdirSync(dir);
+        } catch {
+          return;
+        }
+        const graveyard = path52.join(dir, ".sweeping");
+        try {
+          for (const residue of fs42.readdirSync(graveyard)) {
+            try {
+              fs42.rmSync(path52.join(graveyard, residue), { recursive: true, force: true });
+            } catch {
+            }
+          }
+        } catch {
+        }
+        const versions = entries.filter((name) => !name.startsWith("."));
+        const byNewestFirst = [...versions].sort(
+          (a, b) => (devChannelEpoch(b) ?? -1) - (devChannelEpoch(a) ?? -1)
+        );
+        const doomed = byNewestFirst.slice(keepCount);
+        if (doomed.length === 0) return;
+        fs42.mkdirSync(graveyard, { recursive: true });
+        for (const entry of doomed) {
+          const aside = path52.join(graveyard, `${entry}-${this.now()}`);
+          try {
+            fs42.renameSync(path52.join(dir, entry), aside);
+          } catch (err) {
+            this.logger.warn("failed to move dev-uploads entry aside for sweep", {
+              meta: { entry, error: err instanceof Error ? err.message : String(err) }
+            });
+            continue;
+          }
+          try {
+            fs42.rmSync(aside, { recursive: true, force: true });
+            this.logger.debug("swept dev-uploads entry", { meta: { entry } });
+          } catch {
+          }
+        }
+      }
       /** Transient (.staging- / .evicted-) dirs younger than this are never pruned. */
       static STALE_TRANSIENT_MS = 24 * 60 * 60 * 1e3;
     };
@@ -1059,6 +1228,39 @@ function deriveHubUrlFromRegistry(nodes) {
   return `https://${host}:${HUB_API_PORT}`;
 }
 
+// src/agent-http-auth.ts
+var import_node_crypto = require("crypto");
+function isLoopbackAddress(addr) {
+  if (!addr) return false;
+  if (addr === "::1") return true;
+  const v4 = addr.startsWith("::ffff:") ? addr.slice("::ffff:".length) : addr;
+  const parts = v4.split(".");
+  if (parts.length !== 4 || parts[0] !== "127") return false;
+  return parts.every((p) => /^\d{1,3}$/.test(p));
+}
+function bearerMatchesSecret(authorization, secret) {
+  if (secret.length === 0) return false;
+  if (!authorization?.startsWith("Bearer ")) return false;
+  const token = Buffer.from(authorization.slice("Bearer ".length));
+  const expected = Buffer.from(secret);
+  return token.length === expected.length && (0, import_node_crypto.timingSafeEqual)(token, expected);
+}
+function isAuthorizedAgentRequest(input, clusterSecret) {
+  if (isLoopbackAddress(input.remoteAddress)) return true;
+  if (clusterSecret === null || clusterSecret.length === 0) return false;
+  return bearerMatchesSecret(input.authorization, clusterSecret);
+}
+function isPairingRequest(method, urlPath) {
+  const pathOnly = urlPath.split("?")[0] ?? urlPath;
+  if (method === "GET") {
+    return pathOnly === "/api/agent/status" || pathOnly === "/api/agent/config" || pathOnly === "/api/agent/discovered-nodes";
+  }
+  if (method === "POST") {
+    return pathOnly === "/api/agent/config" || pathOnly === "/api/agent/restart";
+  }
+  return false;
+}
+
 // src/agent-http.ts
 function compareVersions(a, b) {
   if (a === null && b === null) return 0;
@@ -1147,7 +1349,32 @@ async function createAgentHttpServer(getBroker, config) {
   const app = (0, import_fastify.default)({ logger: false });
   const cors = await import("@fastify/cors");
   await app.register(cors.default);
+  const currentSecret = () => {
+    const raw = readConfigFile(config.configPath);
+    return typeof raw.secret === "string" && raw.secret.length > 0 ? raw.secret : null;
+  };
+  app.addHook("onRequest", async (req, reply) => {
+    const pathOnly = req.url.split("?")[0] ?? req.url;
+    const isProtected = pathOnly.startsWith("/api/") || pathOnly.startsWith("/health/");
+    if (!isProtected) return;
+    const secret = currentSecret();
+    const authInput = {
+      remoteAddress: req.socket.remoteAddress ?? void 0,
+      ...typeof req.headers.authorization === "string" ? { authorization: req.headers.authorization } : {}
+    };
+    if (isAuthorizedAgentRequest(authInput, secret)) return;
+    if (secret === null && isPairingRequest(req.method, pathOnly)) return;
+    return reply.status(401).send({ ok: false, error: "unauthorized" });
+  });
   app.get("/health", async (_req, reply) => {
+    try {
+      await getBroker().call("$agent.health");
+      return { ok: true };
+    } catch {
+      return reply.status(503).send({ ok: false });
+    }
+  });
+  app.get("/health/details", async (_req, reply) => {
     try {
       const result = await getBroker().call("$agent.health");
       return result;
@@ -1466,7 +1693,7 @@ var import_moleculer = require("moleculer");
 // src/agent-deploy-swap.ts
 var fs4 = __toESM(require("fs"));
 var path4 = __toESM(require("path"));
-var import_node_crypto = require("crypto");
+var import_node_crypto2 = require("crypto");
 function rmrf(target) {
   fs4.rmSync(target, { recursive: true, force: true });
 }
@@ -1490,7 +1717,7 @@ async function applyDeployedBundle(input) {
   const liveParent = path4.dirname(liveDir);
   const liveBase = path4.basename(liveDir);
   fs4.mkdirSync(liveParent, { recursive: true });
-  const token = (0, import_node_crypto.randomBytes)(6).toString("hex");
+  const token = (0, import_node_crypto2.randomBytes)(6).toString("hex");
   const nextDir = path4.join(liveParent, `.${liveBase}.next.${token}`);
   const backupDir = path4.join(liveParent, `.${liveBase}.backup.${token}`);
   fs4.mkdirSync(nextDir, { recursive: true });
@@ -1539,7 +1766,7 @@ async function applyModelDistribution(seam, params) {
 }
 
 // src/fetch-bundle-from-hub.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 var import_undici = require("undici");
 async function fetchBundleFromHub(opts) {
   const authHeader = { Authorization: `Bearer ${opts.token}`, "accept-encoding": "identity" };
@@ -1554,7 +1781,7 @@ async function fetchBundleFromHub(opts) {
   if (buffer.length !== opts.bytes) {
     throw new Error(`bundle bytes mismatch: expected ${opts.bytes}, got ${buffer.length}`);
   }
-  const sha = (0, import_node_crypto2.createHash)("sha256").update(buffer).digest("hex");
+  const sha = (0, import_node_crypto3.createHash)("sha256").update(buffer).digest("hex");
   if (sha !== opts.sha256) {
     throw new Error(`bundle sha256 mismatch: expected ${opts.sha256}, got ${sha}`);
   }