@camstack/server 1.2.488 → 1.2.490

package/dist/agent/agent-config.js

@@ -81,6 +81,20 @@ function ensurePersistedNodeId(configPath, dataDir) {
     }
     return id;
 }
+function parseMeshTls(value) {
+    if (value === null || typeof value !== 'object')
+        return undefined;
+    const certPem = Reflect.get(value, 'certPem');
+    const keyPem = Reflect.get(value, 'keyPem');
+    const caCertPem = Reflect.get(value, 'caCertPem');
+    if (typeof certPem !== 'string' || certPem.length === 0)
+        return undefined;
+    if (typeof keyPem !== 'string' || keyPem.length === 0)
+        return undefined;
+    if (typeof caCertPem !== 'string' || caCertPem.length === 0)
+        return undefined;
+    return { certPem, keyPem, caCertPem };
+}
 function loadAgentConfig(configPath, dataDirOverride) {
     const filePath = configPath ?? 'agent.json';
     const dataDir = dataDirOverride ?? process.env.CAMSTACK_DATA ?? './camstack-data';
@@ -100,12 +114,17 @@ function loadAgentConfig(configPath, dataDirOverride) {
     let fileHubAddress;
     let fileName;
     let fileSecret;
+    let fileMeshTls;
+    let filePendingJoinToken;
     if (fs.existsSync(configFullPath)) {
         try {
             const raw = JSON.parse(fs.readFileSync(configFullPath, 'utf-8'));
             fileHubAddress = typeof raw.hubAddress === 'string' ? raw.hubAddress : undefined;
             fileName = typeof raw.name === 'string' ? raw.name : undefined;
             fileSecret = typeof raw.secret === 'string' ? raw.secret : undefined;
+            fileMeshTls = parseMeshTls(raw.meshTls);
+            filePendingJoinToken =
+                typeof raw.joinToken === 'string' && raw.joinToken.length > 0 ? raw.joinToken : undefined;
         }
         catch {
             /* corrupt config */
@@ -123,6 +142,8 @@ function loadAgentConfig(configPath, dataDirOverride) {
         addonsDir: path.resolve(resolvedDataDir, 'addons'),
         logLevel: process.env.CAMSTACK_LOG_LEVEL ?? 'info',
         secret: effectiveSecret,
+        ...(fileMeshTls !== undefined ? { meshTls: fileMeshTls } : {}),
+        ...(filePendingJoinToken !== undefined ? { pendingJoinToken: filePendingJoinToken } : {}),
         configPath: configFullPath,
         statusPort: Number(process.env.CAMSTACK_STATUS_PORT) || 4444,
     };

package/dist/agent/agent-http.js

@@ -54,6 +54,7 @@ const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const fastify_1 = __importDefault(require("fastify"));
 const agent_http_auth_js_1 = require("./agent-http-auth.js");
+const agent_mesh_enroll_js_1 = require("./agent-mesh-enroll.js");
 const agent_update_routes_js_1 = require("./agent-update-routes.js");
 const derive_hub_url_js_1 = require("./derive-hub-url.js");
 Object.defineProperty(exports, "pickIpv4", { enumerable: true, get: function () { return derive_hub_url_js_1.pickIpv4; } });
@@ -211,8 +212,12 @@ function getEffectiveConfig(configPath, nodeId) {
         name: typeof raw.name === 'string' ? raw.name : nodeId,
         hubAddress: typeof raw.hubAddress === 'string' ? raw.hubAddress : null,
         hasSecret: typeof raw.secret === 'string' && raw.secret.length > 0,
+        hasMeshTls: raw.meshTls !== null && typeof raw.meshTls === 'object',
     };
 }
+/** Persisted fields that are credentials: never echoed by `GET /api/agent/config`. */
+const NEVER_ECHOED_CONFIG_KEYS = new Set(['secret', 'meshTls', 'joinToken']);
+const defaultRedeemJoinToken = (token, nodeId) => (0, agent_mesh_enroll_js_1.enrollAgentMesh)({ token, nodeId });
 // ---------------------------------------------------------------------------
 // Factory
 // ---------------------------------------------------------------------------
@@ -288,6 +293,11 @@ async function createAgentHttpServer(getBroker, config) {
         const hubConnectionState = config.getHubConnectionState
             ? config.getHubConnectionState()
             : deriveHubConnectionState(nodes, discoveryMode);
+        const meshTransport = config.getMeshTransport
+            ? config.getMeshTransport()
+            : eff.hasMeshTls
+                ? 'tls'
+                : 'clear';
         // The address the agent actually reaches the hub at (from the Moleculer
         // registry) — lets the UI show the real endpoint even under UDP discovery
         // where `eff.hubAddress` is null.
@@ -308,6 +318,7 @@ async function createAgentHttpServer(getBroker, config) {
                 hubConnectionState,
                 discoveryMode,
                 hasSecret: eff.hasSecret,
+                meshTransport,
                 discoveredNodes,
             };
         }
@@ -322,6 +333,7 @@ async function createAgentHttpServer(getBroker, config) {
                 hubConnectionState,
                 discoveryMode,
                 hasSecret: eff.hasSecret,
+                meshTransport,
                 discoveredNodes,
                 addons: [],
                 localIps: [],
@@ -360,21 +372,54 @@ async function createAgentHttpServer(getBroker, config) {
             name: eff.name,
             hubAddress: eff.hubAddress,
             hasSecret: eff.hasSecret,
+            hasMeshTls: eff.hasMeshTls,
             configPath: config.configPath,
             dataDir: config.dataDir,
-            // Include all persisted fields except raw secret
-            ...Object.fromEntries(Object.entries(persisted).filter(([k]) => k !== 'secret')),
+            // Include all persisted fields except credentials (secret, mesh key, pending token)
+            ...Object.fromEntries(Object.entries(persisted).filter(([k]) => !NEVER_ECHOED_CONFIG_KEYS.has(k))),
         };
     });
     // -- Config write (merge-patch + persist) ---------------------------
     // Fastify (not Express) natively awaits async route handlers and serializes
     // the returned value / catches rejections, so an async handler is correct here.
     // eslint-disable-next-line oxc/no-async-endpoint-handlers
-    app.post('/api/agent/config', async (req) => {
-        const patch = req.body ?? {};
+    app.post('/api/agent/config', async (req, reply) => {
+        // `joinToken` is redeemed, never stored; `meshTls` only ever comes from an
+        // enrollment (or is cleared via `clearMeshTls`), never pasted as PEM.
+        const body = req.body ?? {};
+        const joinToken = body['joinToken'];
+        const clearMeshTls = body['clearMeshTls'] === true;
+        const patch = Object.fromEntries(Object.entries(body).filter(([k]) => k !== 'joinToken' && k !== 'meshTls' && k !== 'clearMeshTls'));
         const existing = readConfigFile(config.configPath);
+        // Join-token enrollment (mesh mTLS Release A): the hub address comes from
+        // the token and wins over a `hubAddress` posted in the same form. Nothing is
+        // written unless the whole enrollment verified.
+        let enrolled = null;
+        if (typeof joinToken === 'string' && joinToken.trim().length > 0) {
+            try {
+                enrolled = await (config.redeemJoinToken ?? defaultRedeemJoinToken)(joinToken, config.nodeId);
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                console.error(`[Agent] join-token enrollment failed: ${message}`);
+                return reply
+                    .status(err instanceof agent_mesh_enroll_js_1.MeshEnrollError ? 400 : 502)
+                    .send({ success: false, error: message });
+            }
+        }
         const merged = { ...existing, ...patch };
+        if (enrolled !== null) {
+            merged['hubAddress'] = enrolled.hubAddress;
+            merged['meshTls'] = enrolled.meshTls;
+        }
+        else if (clearMeshTls) {
+            delete merged['meshTls'];
+        }
         writeConfigFile(config.configPath, merged);
+        if (enrolled !== null) {
+            console.log(`[Agent] Enrolled in the mesh CA via join token — hub ${enrolled.hubAddress}, ` +
+                'mutual TLS on next reconnect');
+        }
         // Apply name change immediately (no reconnect needed)
         if (typeof patch.name === 'string' && patch.name.trim()) {
             try {
@@ -390,10 +435,14 @@ async function createAgentHttpServer(getBroker, config) {
         // `patch.hubAddress !== undefined` was always true and produced
         // false-positive "Restart required" prompts on no-op saves.
         const reconnectRelevant = ['hubAddress', 'secret'];
-        const needsReconnect = reconnectRelevant.some((k) => Object.prototype.hasOwnProperty.call(patch, k) && patch[k] !== existing[k]);
+        const needsReconnect = enrolled !== null ||
+            clearMeshTls ||
+            reconnectRelevant.some((k) => Object.prototype.hasOwnProperty.call(patch, k) && patch[k] !== existing[k]);
         return {
             success: true,
             restartRequired: needsReconnect,
+            ...(enrolled !== null ? { enrolled: true } : {}),
+            ...(clearMeshTls ? { clearedMeshTls: true } : {}),
         };
     });
     // -- Agent reconnect (applies new hub/secret config) ----------------

package/dist/agent/agent-mesh-enroll.js

@@ -0,0 +1,318 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MeshEnrollError = void 0;
+exports.decodeJoinTokenClaims = decodeJoinTokenClaims;
+exports.hubHostFromMeshAddress = hubHostFromMeshAddress;
+exports.enrollAgentMesh = enrollAgentMesh;
+exports.persistEnrollment = persistEnrollment;
+exports.discardPendingJoinToken = discardPendingJoinToken;
+exports.enrollAndPersist = enrollAndPersist;
+/**
+ * The agent's side of mesh mTLS enrollment (Release A).
+ *
+ * The operator mints a single-use join token on the hub (System → Cluster →
+ * Add agent) and pastes it into this agent's setup. Redeeming it:
+ *
+ *   1. decode the token's claims WITHOUT trusting them (the agent holds no CA
+ *      key yet): `hubUrl`, `hubMeshAddress`, `caFingerprint`, optional `nodeId`;
+ *   2. a token pinned to another node id is refused before anything is sent;
+ *   3. generate this node's own key pair; the private key never leaves it;
+ *   4. `POST <hubUrl>/api/mesh/enroll` with `{ token, csr }`. The hub's HTTPS
+ *      certificate is NOT the mesh CA, so the TLS peer is not what is pinned:
+ *   5. the answer is trusted only if its CA certificate hashes to the token's
+ *      `caFingerprint` (a MITM with another CA fails here), the token's ES256
+ *      signature verifies against that CA, and the issued leaf is signed by it,
+ *      carries this node id as CN and matches the private key;
+ *   6. only then are the material and the hub address persisted (`agent.json`,
+ *      0600) — the dial port is NOT stored: with a certificate the broker dials
+ *      the TLS port, so the address keeps the host only.
+ */
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const http = __importStar(require("node:http"));
+const https = __importStar(require("node:https"));
+const path = __importStar(require("node:path"));
+const system_1 = require("@camstack/system");
+class MeshEnrollError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'MeshEnrollError';
+    }
+}
+exports.MeshEnrollError = MeshEnrollError;
+const ENROLL_PATH = '/api/mesh/enroll';
+const ENROLL_TIMEOUT_MS = 15_000;
+function base64urlJson(segment) {
+    return JSON.parse(Buffer.from(segment, 'base64url').toString('utf8'));
+}
+/** Decode the payload of a compact JWS. Untrusted: nothing here is verified. */
+function decodeJoinTokenClaims(token) {
+    const parts = token.trim().split('.');
+    if (parts.length !== 3 || parts[1] === undefined) {
+        throw new MeshEnrollError('join token is malformed (expected a compact JWT)');
+    }
+    let payload;
+    try {
+        payload = base64urlJson(parts[1]);
+    }
+    catch {
+        throw new MeshEnrollError('join token payload is not valid JSON');
+    }
+    if (payload === null || typeof payload !== 'object') {
+        throw new MeshEnrollError('join token payload is not an object');
+    }
+    const hubUrl = Reflect.get(payload, 'hubUrl');
+    const hubMeshAddress = Reflect.get(payload, 'hubMeshAddress');
+    const caFingerprint = Reflect.get(payload, 'caFingerprint');
+    const nodeId = Reflect.get(payload, 'nodeId');
+    const exp = Reflect.get(payload, 'exp');
+    if (typeof hubUrl !== 'string' || hubUrl.length === 0) {
+        throw new MeshEnrollError('join token carries no hubUrl');
+    }
+    if (typeof hubMeshAddress !== 'string' || hubMeshAddress.length === 0) {
+        throw new MeshEnrollError('join token carries no hubMeshAddress');
+    }
+    if (typeof caFingerprint !== 'string' || caFingerprint.length === 0) {
+        throw new MeshEnrollError('join token carries no caFingerprint');
+    }
+    if (typeof exp !== 'number')
+        throw new MeshEnrollError('join token carries no expiry');
+    return {
+        hubUrl,
+        hubMeshAddress,
+        caFingerprint: normalizeFingerprint(caFingerprint),
+        ...(typeof nodeId === 'string' && nodeId.length > 0 ? { nodeId } : {}),
+        exp,
+    };
+}
+function normalizeFingerprint(fp) {
+    return fp.replace(/:/g, '').toLowerCase();
+}
+/** `host:6000` / `[::1]:6000` / `host` → the host, port dropped. */
+function hubHostFromMeshAddress(address) {
+    const trimmed = address.trim();
+    const bracketed = /^(\[[^\]]+\])(?::\d+)?$/.exec(trimmed);
+    if (bracketed?.[1] !== undefined)
+        return bracketed[1];
+    const hostPort = /^([^:]+):\d+$/.exec(trimmed);
+    return hostPort?.[1] ?? trimmed;
+}
+function compactFingerprint(certPem) {
+    return (0, node_crypto_1.createHash)('sha256').update(new node_crypto_1.X509Certificate(certPem).raw).digest('hex');
+}
+/** ES256 compact-JWS signature check against the CA certificate's public key. */
+function tokenSignatureValid(token, caCertPem) {
+    const parts = token.trim().split('.');
+    if (parts.length !== 3)
+        return false;
+    const [header, payload, signature] = parts;
+    if (header === undefined || payload === undefined || signature === undefined)
+        return false;
+    try {
+        return (0, node_crypto_1.verify)('sha256', Buffer.from(`${header}.${payload}`), { key: new node_crypto_1.X509Certificate(caCertPem).publicKey, dsaEncoding: 'ieee-p1363' }, Buffer.from(signature, 'base64url'));
+    }
+    catch {
+        return false;
+    }
+}
+/** Node `http(s)` POST. The hub's HTTPS leaf is not the mesh CA, so the CA pin below is the trust. */
+const nodeEnrollFetch = (url, init) => new Promise((resolve, reject) => {
+    const target = new URL(url);
+    const request = (target.protocol === 'http:' ? http : https).request(target, {
+        method: init.method,
+        headers: { ...init.headers, 'content-length': Buffer.byteLength(init.body) },
+        timeout: ENROLL_TIMEOUT_MS,
+        ...(target.protocol === 'https:' ? { rejectUnauthorized: false } : {}),
+    }, (res) => {
+        const chunks = [];
+        res.on('data', (chunk) => chunks.push(chunk));
+        res.on('end', () => {
+            const raw = Buffer.concat(chunks).toString('utf8');
+            resolve({
+                status: res.statusCode ?? 0,
+                json: () => Promise.resolve(JSON.parse(raw)),
+            });
+        });
+        res.on('error', reject);
+    });
+    request.on('timeout', () => request.destroy(new Error(`enroll request timed out`)));
+    request.on('error', reject);
+    request.end(init.body);
+});
+function readAnswer(status, body) {
+    const record = body !== null && typeof body === 'object' ? body : {};
+    if (status !== 200 || Reflect.get(record, 'ok') !== true) {
+        const error = Reflect.get(record, 'error');
+        throw new MeshEnrollError(`hub refused the enrollment (HTTP ${status}): ${typeof error === 'string' ? error : 'no reason given'}`);
+    }
+    const cert = Reflect.get(record, 'cert');
+    const caCert = Reflect.get(record, 'caCert');
+    if (typeof cert !== 'string' || typeof caCert !== 'string') {
+        throw new MeshEnrollError('hub answered without a certificate and CA certificate');
+    }
+    return { cert, caCert };
+}
+/**
+ * Redeem a join token. Throws {@link MeshEnrollError} with an operator-readable
+ * reason; nothing is persisted here.
+ */
+async function enrollAgentMesh(input) {
+    const token = input.token.trim();
+    const claims = decodeJoinTokenClaims(token);
+    const nowSec = input.nowSec ?? Math.floor(Date.now() / 1000);
+    if (claims.exp <= nowSec) {
+        throw new MeshEnrollError('join token has expired — mint a new one on the hub');
+    }
+    if (claims.nodeId !== undefined && claims.nodeId !== input.nodeId) {
+        throw new MeshEnrollError(`join token is for node "${claims.nodeId}", but this agent is "${input.nodeId}"`);
+    }
+    const keys = await (0, system_1.generateMeshKeyPair)();
+    const csr = await (0, system_1.createMeshCsrPem)(keys, input.nodeId);
+    const keyPem = await (0, system_1.exportMeshPrivateKeyPem)(keys.privateKey);
+    const url = `${claims.hubUrl.replace(/\/+$/, '')}${ENROLL_PATH}`;
+    const fetchFn = input.fetchFn ?? nodeEnrollFetch;
+    let response;
+    try {
+        response = await fetchFn(url, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ token, csr }),
+        });
+    }
+    catch (err) {
+        throw new MeshEnrollError(`could not reach the hub at ${claims.hubUrl}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        body = null;
+    }
+    const answer = readAnswer(response.status, body);
+    // Trust nothing the hub said until it proves it holds the CA the token names.
+    let fingerprint;
+    try {
+        fingerprint = compactFingerprint(answer.caCert);
+    }
+    catch {
+        throw new MeshEnrollError('hub returned an unreadable CA certificate');
+    }
+    if (fingerprint !== claims.caFingerprint) {
+        throw new MeshEnrollError('the CA certificate returned by the hub does not match the token fingerprint — ' +
+            'enrollment aborted (is something between this agent and the hub?)');
+    }
+    if (!tokenSignatureValid(token, answer.caCert)) {
+        throw new MeshEnrollError('join token signature does not verify against the hub CA');
+    }
+    assertLeafIsOurs(answer, keyPem, input.nodeId);
+    return {
+        meshTls: { certPem: answer.cert, keyPem, caCertPem: answer.caCert },
+        hubAddress: hubHostFromMeshAddress(claims.hubMeshAddress),
+        claims,
+    };
+}
+function assertLeafIsOurs(answer, keyPem, nodeId) {
+    let leaf;
+    try {
+        leaf = new node_crypto_1.X509Certificate(answer.cert);
+    }
+    catch {
+        throw new MeshEnrollError('hub returned an unreadable node certificate');
+    }
+    const ca = new node_crypto_1.X509Certificate(answer.caCert);
+    if (!leaf.verify(ca.publicKey)) {
+        throw new MeshEnrollError('the node certificate is not signed by the hub CA');
+    }
+    if (!new RegExp(`(?:^|\\n)CN=${escapeRegExp(nodeId)}(?:\\n|$)`).test(leaf.subject)) {
+        throw new MeshEnrollError(`the node certificate is not issued for "${nodeId}"`);
+    }
+    if (!leaf.checkPrivateKey((0, node_crypto_1.createPrivateKey)(keyPem))) {
+        throw new MeshEnrollError('the node certificate does not match this agent’s private key');
+    }
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function readJsonFile(file) {
+    if (!fs.existsSync(file))
+        return {};
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? Object.fromEntries(Object.entries(parsed))
+            : {};
+    }
+    catch {
+        return {};
+    }
+}
+function withoutJoinToken(record) {
+    return Object.fromEntries(Object.entries(record).filter(([key]) => key !== 'joinToken'));
+}
+function writeJsonFile0600(file, data) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const tmp = `${file}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(data, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    fs.renameSync(tmp, file);
+    fs.chmodSync(file, 0o600);
+}
+/**
+ * Write the enrollment into `agent.json` (0600): `meshTls` + the host-only
+ * `hubAddress`; a pending `joinToken` is removed. The cluster secret, if any,
+ * stays — it is still a valid join proof for one release.
+ */
+function persistEnrollment(configPath, enrolled) {
+    const next = {
+        ...withoutJoinToken(readJsonFile(configPath)),
+        hubAddress: enrolled.hubAddress,
+        meshTls: enrolled.meshTls,
+    };
+    writeJsonFile0600(configPath, next);
+}
+/** Drop a pending `joinToken` from `agent.json` (consumed — or dead). */
+function discardPendingJoinToken(configPath) {
+    const existing = readJsonFile(configPath);
+    if (!('joinToken' in existing))
+        return;
+    writeJsonFile0600(configPath, withoutJoinToken(existing));
+}
+/** Redeem `token` and persist the result. Throws {@link MeshEnrollError}. */
+async function enrollAndPersist(input) {
+    const enrolled = await enrollAgentMesh(input);
+    persistEnrollment(input.configPath, enrolled);
+    return enrolled;
+}

package/dist/agent/main.js

@@ -46,6 +46,7 @@ const addon_scan_js_1 = require("./addon-scan.js");
 const agent_addon_updates_js_1 = require("./agent-addon-updates.js");
 const agent_mesh_join_js_1 = require("./agent-mesh-join.js");
 const agent_config_js_1 = require("./agent-config.js");
+const agent_mesh_enroll_js_1 = require("./agent-mesh-enroll.js");
 const agent_group_runner_js_1 = require("./agent-group-runner.js");
 const agent_http_js_1 = require("./agent-http.js");
 const agent_infra_capabilities_js_1 = require("./agent-infra-capabilities.js");
@@ -78,8 +79,32 @@ const DATA_NODEID_CAPS = new Set(types_1.ALL_CAPABILITY_DEFINITIONS.filter((c) =
 // ---------------------------------------------------------------------------
 // Main
 // ---------------------------------------------------------------------------
+/**
+ * Load `agent.json`, first redeeming a join token the setup window left there
+ * (mesh mTLS Release A — the desktop setup runs before the agent does). A token
+ * is single-use, so it is dropped whether or not the hub accepted it; a refusal
+ * is logged loudly and the agent still boots (clear, or with the cluster secret).
+ */
+async function loadAgentConfigRedeemingJoinToken(configPath) {
+    const loaded = (0, agent_config_js_1.loadAgentConfig)(configPath);
+    if (loaded.pendingJoinToken === undefined)
+        return loaded;
+    try {
+        const enrolled = await (0, agent_mesh_enroll_js_1.enrollAndPersist)({
+            token: loaded.pendingJoinToken,
+            nodeId: loaded.nodeId,
+            configPath: loaded.configPath,
+        });
+        console.log(`[Agent] Enrolled in the mesh CA (hub ${enrolled.hubAddress}) — dialing over mutual TLS`);
+    }
+    catch (err) {
+        console.error(`[Agent] Join-token enrollment failed — staying on the previous transport: ${(0, types_1.errMsg)(err)}`);
+        (0, agent_mesh_enroll_js_1.discardPendingJoinToken)(loaded.configPath);
+    }
+    return (0, agent_config_js_1.loadAgentConfig)(configPath, loaded.dataDir);
+}
 async function startAgent(configPath) {
-    const config = (0, agent_config_js_1.loadAgentConfig)(configPath);
+    const config = await loadAgentConfigRedeemingJoinToken(configPath);
     // Derive CAMSTACK_HUB_URL from the configured hub address so remote agents
     // no longer need a second, redundant env var set by hand (the cross-node
     // source trap). An explicit operator value ALWAYS wins — capture whether it
@@ -177,12 +202,17 @@ async function startAgent(configPath) {
             }
         },
     });
+    // Mesh mTLS (Release A): with a certificate the broker dials the hub's TLS
+    // port; without one it keeps dialing clear 6000.
+    let currentMeshTls = config.meshTls ?? null;
+    console.log(`[Agent] Mesh transport: ${currentMeshTls !== null ? 'tls' : 'clear'}`);
     let broker = (0, system_1.createBroker)({
         nodeID: config.nodeId,
         mode: 'agent',
         hubAddress: config.hubAddress,
         logLevel: config.logLevel,
         middlewares: meshJoin.middlewares,
+        ...(currentMeshTls !== null ? { meshTls: currentMeshTls } : {}),
     });
     meshJoin.attach(broker);
     /**
@@ -200,7 +230,8 @@ async function startAgent(configPath) {
         }
         // Reload config from file (UI may have written new hubAddress/secret)
         const fresh = (0, agent_config_js_1.loadAgentConfig)(undefined, config.dataDir);
-        console.log(`[Agent] New config: hub=${fresh.hubAddress ?? 'discovery'}, secret=${fresh.secret ? 'yes' : 'none'}`);
+        console.log(`[Agent] New config: hub=${fresh.hubAddress ?? 'discovery'}, secret=${fresh.secret ? 'yes' : 'none'}, ` +
+            `mesh=${fresh.meshTls !== undefined ? 'tls' : 'clear'}`);
         // Re-derive CAMSTACK_HUB_URL for the discovery-mode → dashboard-configured
         // flow (config file freshly written a hubAddress). Explicit operator values
         // still win via the boot-captured `hubUrlWasExplicit` flag.
@@ -214,12 +245,14 @@ async function startAgent(configPath) {
             console.log(`[Agent] Derived CAMSTACK_HUB_URL=${freshHubUrl} from hub address "${fresh.hubAddress}"`);
         }
         currentSecret = fresh.secret ?? null;
+        currentMeshTls = fresh.meshTls ?? null;
         broker = (0, system_1.createBroker)({
             nodeID: config.nodeId,
             mode: 'agent',
             hubAddress: fresh.hubAddress,
             logLevel: fresh.logLevel,
             middlewares: meshJoin.middlewares,
+            ...(currentMeshTls !== null ? { meshTls: currentMeshTls } : {}),
         });
         meshJoin.attach(broker);
         // The boot-time `$node.connected` listeners belong to the old broker: let
@@ -854,6 +887,7 @@ async function startAgent(configPath) {
         configPath: config.configPath,
         onReconnect: reconnect,
         getHubConnectionState,
+        getMeshTransport: () => (currentMeshTls !== null ? 'tls' : 'clear'),
         updateControls,
     });
     // ── Phase 1: Load core infrastructure addons (in-process) ──

package/dist/api/core/auth-revoke-credentials.procedures.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RevokeSkipReasonSchema = exports.RevocableCredentialKindSchema = exports.REVOKE_CREDENTIALS_MAX = void 0;
+exports.createRevokeCredentialsProcedures = createRevokeCredentialsProcedures;
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+/** Upper bound of one bulk call — a page of a table, several times over. */
+exports.REVOKE_CREDENTIALS_MAX = 500;
+/** What a bulk revoke can target. Each has a per-row revoke on the server. */
+exports.RevocableCredentialKindSchema = zod_1.z.enum(['share-link', 'admin-token', 'login-session']);
+exports.RevokeSkipReasonSchema = zod_1.z.enum(['current-session', 'not-active']);
+const RevokeCredentialsInputSchema = zod_1.z
+    .object({
+    kind: exports.RevocableCredentialKindSchema,
+    ids: zod_1.z.array(zod_1.z.string().min(1)).min(1).max(exports.REVOKE_CREDENTIALS_MAX),
+    /** The count the operator confirmed. Must equal `ids.length`. */
+    confirmCount: zod_1.z.number().int().min(1),
+})
+    .refine((input) => new Set(input.ids).size === input.ids.length, {
+    message: 'Each id may be listed once',
+    path: ['ids'],
+});
+const RevokeCredentialsOutputSchema = zod_1.z.object({
+    revoked: zod_1.z.array(zod_1.z.string()),
+    skipped: zod_1.z.array(zod_1.z.object({ id: zod_1.z.string(), reason: exports.RevokeSkipReasonSchema })),
+});
+/** Keep the audit row bounded; the ids beyond this are counted, not listed. */
+const AUDIT_IDS_MAX_CHARS = 4000;
+function assertSignedInAdminSession(user) {
+    if (user.isScoped === true ||
+        user.shareView !== undefined ||
+        user.credential !== undefined ||
+        user.adminTokenId !== undefined) {
+        throw new server_1.TRPCError({
+            code: 'FORBIDDEN',
+            message: 'Revoking credentials in bulk needs a signed-in admin session',
+        });
+    }
+}
+function requireInternal(registry) {
+    const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
+    if (internal === null) {
+        throw new server_1.TRPCError({
+            code: 'PRECONDITION_FAILED',
+            message: 'User management is not available',
+        });
+    }
+    return internal;
+}
+/** The per-row revoke for `kind`, bound to the caller. `null` = revoked. */
+function revokerFor(kind, caller, deps) {
+    if (kind === 'share-link') {
+        const service = deps.shareTokens;
+        if (service === null) {
+            throw new server_1.TRPCError({ code: 'PRECONDITION_FAILED', message: 'Share links are not available' });
+        }
+        return async (id) => (await service.revoke({ id, callerUserId: caller.id, callerIsAdmin: true }))
+            ? null
+            : 'not-active';
+    }
+    const internal = requireInternal(deps.registry);
+    if (kind === 'admin-token') {
+        return async (id) => ((await internal.adminTokens.revoke(id)) ? null : 'not-active');
+    }
+    return async (id) => {
+        if (id === caller.sessionId)
+            return 'current-session';
+        if (internal.sessions.check(id).state !== 'active')
+            return 'not-active';
+        return (await internal.sessions.revoke(id, 'revoked-by-admin')) ? null : 'not-active';
+    };
+}
+function auditIds(ids) {
+    const joined = ids.join(',');
+    return joined.length <= AUDIT_IDS_MAX_CHARS ? joined : `${joined.slice(0, AUDIT_IDS_MAX_CHARS)}…`;
+}
+function createRevokeCredentialsProcedures(deps) {
+    return {
+        /** ADMIN — revoke exactly `ids` of one kind; see the module header. */
+        revokeCredentials: trpc_middleware_js_1.adminProcedure
+            .input(RevokeCredentialsInputSchema)
+            .output(RevokeCredentialsOutputSchema)
+            .mutation(async ({ ctx, input }) => {
+            assertSignedInAdminSession(ctx.user);
+            if (input.confirmCount !== input.ids.length) {
+                throw new server_1.TRPCError({
+                    code: 'BAD_REQUEST',
+                    message: `Confirmed ${input.confirmCount} but ${input.ids.length} were listed — nothing was revoked`,
+                });
+            }
+            const revokeOne = revokerFor(input.kind, ctx.user, deps);
+            const revoked = [];
+            const skipped = [];
+            // Sequential on purpose: the stores are single-writer, and a partial
+            // failure must leave an exact account of what already happened.
+            for (const id of input.ids) {
+                const reason = await revokeOne(id);
+                if (reason === null)
+                    revoked.push(id);
+                else
+                    skipped.push({ id, reason });
+            }
+            const internal = deps.registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(deps.registry);
+            if (internal !== null) {
+                const ip = deps.network.clientAddress(ctx.req).ip;
+                await internal.audit.record({
+                    action: 'credentials-revoked',
+                    userId: ctx.user.id,
+                    ...(ip !== null ? { ip } : {}),
+                    detail: {
+                        kind: input.kind,
+                        requested: input.ids.length,
+                        revoked: revoked.length,
+                        skipped: skipped.length,
+                        ids: auditIds(revoked),
+                    },
+                });
+            }
+            return { revoked, skipped };
+        }),
+    };
+}

package/dist/api/core/auth.router.js

@@ -35,6 +35,7 @@ const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 const auth_limits_js_1 = require("./auth-limits.js");
 const auth_admin_tokens_procedures_js_1 = require("./auth-admin-tokens.procedures.js");
+const auth_revoke_credentials_procedures_js_1 = require("./auth-revoke-credentials.procedures.js");
 const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
 const auth_sessions_procedures_js_1 = require("./auth-sessions.procedures.js");
 /**
@@ -1080,6 +1081,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         ...(0, auth_sessions_procedures_js_1.createSessionProcedures)({ registry, minter, credentialProcedure }),
         ...(0, auth_reauth_procedures_js_1.createReauthProcedures)({ auth, registry, moleculer, limiters }),
         ...(0, auth_admin_tokens_procedures_js_1.createAdminTokenProcedures)({ auth, registry, network }),
+        ...(0, auth_revoke_credentials_procedures_js_1.createRevokeCredentialsProcedures)({ registry, shareTokens, network }),
         // ── External sign-in identities (D782) ────────────────────────
         //
         // A signed-in user links an OIDC identity to THEIR OWN account. The

package/dist/api/core/cap-providers.js

@@ -245,6 +245,11 @@ function buildToastProvider(toastService, ctx) {
         },
     };
 }
+/** `{ meshTransport }` for an online agent, `{}` when the hub cannot tell. */
+function meshTransportField(nodeId) {
+    const meshTransport = (0, system_1.getProcessNodeMeshTransport)(nodeId);
+    return meshTransport === undefined ? {} : { meshTransport };
+}
 function getLocalIps() {
     const interfaces = os.networkInterfaces();
     const ips = [];
@@ -411,6 +416,9 @@ async function computeTopologyInternal(agentRegistry, addonRegistry, getNodeRoot
             // (hub: the running @camstack/server; agents: their registerNode
             // manifest via HubNodeRegistry). Null when unknown.
             rootPackage: getNodeRootPackage?.(node.info.id, node.isHub) ?? null,
+            // Mesh mTLS Release A: observed by the hub's transporter (certificate CN),
+            // never self-reported by the agent. Hub row and unknown: no badge.
+            ...(node.isHub ? {} : meshTransportField(node.info.id)),
         };
     });
     // A2: union in OFFLINE rows for every persisted node no longer present in the

package/dist/api/trpc/core-cap-bridge.js

@@ -18,10 +18,11 @@
  * routes the call exactly like any addon-provided cap.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.REMOTE_PRIVILEGE_LOG_ONLY = exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE = exports.REMOTE_DENIED_NAMESPACES = void 0;
+exports.REMOTE_PRIVILEGE_LOG_ONLY = exports.REMOTE_PRIVILEGE_ALLOWLIST = exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE = exports.REMOTE_DENIED_NAMESPACES = void 0;
 exports.setRemotePrivilegeLogSink = setRemotePrivilegeLogSink;
 exports.__resetRemotePrivilegeObservationForTests = __resetRemotePrivilegeObservationForTests;
 exports.observeRemotePrivilege = observeRemotePrivilege;
+exports.observeRemotePrivilegeRefused = observeRemotePrivilegeRefused;
 exports.isCoreServiceCapName = isCoreServiceCapName;
 exports.describeMeshOrigin = describeMeshOrigin;
 exports.buildCoreCapService = buildCoreCapService;
@@ -76,11 +77,24 @@ exports.REMOTE_DENIED_NAMESPACES = new Set([
 /** Moleculer error `type` of a bridged call another node may not make. */
 exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE = 'CORE_CAP_REMOTE_FORBIDDEN';
 /**
- * When true, a remote node's allowed bridged calls are logged once per
- * `(nodeId, path)` per process — still admin, not refused. Granting least
- * privilege waits on census; this is the log-only week before that.
+ * Hub-core procedure paths another node may call after {@link REMOTE_DENIED_NAMESPACES}.
+ * Seeded from armed transport census on the live hub (2026-10): remote agents
+ * (`mesh:<agent>`) called none of these; hub runners used this surface only.
  */
-exports.REMOTE_PRIVILEGE_LOG_ONLY = true;
+exports.REMOTE_PRIVILEGE_ALLOWLIST = new Set([
+    'addons.listCapabilityProviders',
+    'nodes.topology',
+    'integrations.getByAddonId',
+    'addons.list',
+    'system.getLoggingSettings',
+    'addons.setCapabilityProviderEnabled',
+    'system.getSiteLocation',
+]);
+/**
+ * When true, remote bridged calls outside {@link REMOTE_PRIVILEGE_ALLOWLIST} are
+ * logged once per `(nodeId, path)` per process — still admin, not refused.
+ */
+exports.REMOTE_PRIVILEGE_LOG_ONLY = false;
 let remotePrivilegeLogSink = null;
 /** Attach the warn sink used by {@link observeRemotePrivilege}. */
 function setRemotePrivilegeLogSink(sink) {
@@ -95,22 +109,31 @@ function __resetRemotePrivilegeObservationForTests() {
 function remotePrivilegeKey(nodeId, path) {
     return `${nodeId}\0${path}`;
 }
-/**
- * One warn per `(nodeId, path)` while {@link REMOTE_PRIVILEGE_LOG_ONLY} is on.
- * Call only after {@link REMOTE_DENIED_NAMESPACES} has passed.
- */
-function observeRemotePrivilege(nodeId, path) {
-    if (!exports.REMOTE_PRIVILEGE_LOG_ONLY)
-        return;
+function warnRemotePrivilegeOnce(nodeId, path, message) {
     const key = remotePrivilegeKey(nodeId, path);
     if (remotePrivilegeObserved.has(key))
         return;
     remotePrivilegeObserved.add(key);
-    const message = `mesh privilege: node:${nodeId} called ${path} (log-only; still allowed)`;
     remotePrivilegeLogSink?.warn(message, {
         meta: { nodeId, path, principal: `node:${nodeId}` },
     });
 }
+/**
+ * One warn per `(nodeId, path)` while {@link REMOTE_PRIVILEGE_LOG_ONLY} is on.
+ * Call only after {@link REMOTE_DENIED_NAMESPACES} has passed.
+ */
+function observeRemotePrivilege(nodeId, path) {
+    if (!exports.REMOTE_PRIVILEGE_LOG_ONLY)
+        return;
+    warnRemotePrivilegeOnce(nodeId, path, `mesh privilege: node:${nodeId} called ${path} (log-only; still allowed)`);
+}
+/**
+ * One warn per `(nodeId, path)` when enforcement refuses a path not on
+ * {@link REMOTE_PRIVILEGE_ALLOWLIST}. Call immediately before throwing.
+ */
+function observeRemotePrivilegeRefused(nodeId, path) {
+    warnRemotePrivilegeOnce(nodeId, path, `mesh privilege: node:${nodeId} called ${path} (refused; not on grant)`);
+}
 /**
  * camelCase → kebab-case. Mirrors `toKebab` in `trpc-links.ts` so the
  * action name matches what `brokerTransportLink` derives from `op.path`.
@@ -259,8 +282,15 @@ function buildCoreCapService(appRouter, census = (0, http_request_census_singlet
                 if (remoteNode !== null && exports.REMOTE_DENIED_NAMESPACES.has(namespace)) {
                     throw new moleculer_1.Errors.MoleculerClientError(`"${path}" is not callable from another node (caller "${remoteNode}")`, 403, exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE);
                 }
-                if (remoteNode !== null)
-                    observeRemotePrivilege(remoteNode, path);
+                if (remoteNode !== null) {
+                    if (exports.REMOTE_PRIVILEGE_LOG_ONLY) {
+                        observeRemotePrivilege(remoteNode, path);
+                    }
+                    else if (!exports.REMOTE_PRIVILEGE_ALLOWLIST.has(path)) {
+                        observeRemotePrivilegeRefused(remoteNode, path);
+                        throw new moleculer_1.Errors.MoleculerClientError(`"${path}" is not on the remote privilege grant (caller "${remoteNode}")`, 403, exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE);
+                    }
+                }
                 const invoke = resolveInvoker(callerFor(remoteNode === null ? 'mesh' : `node:${remoteNode}`), path);
                 if (invoke === null)
                     throw new Error(`$core-caps: "${path}" is not invocable`);

package/dist/core/moleculer/moleculer.service.js

@@ -644,6 +644,8 @@ class MoleculerService {
             this.removeNodeFromRegistry(node.id);
             // D802: a node authenticates again on its next connection.
             this.meshGuard.forget(node.id);
+            // Release A: its next connection decides again whether it is `tls` or `clear`.
+            (0, system_1.getBrokerTlsTransporter)(this.broker)?.forgetPeer(node.id);
         });
         // D8 reverse-leg snapshot-reconcile: on every agent (re)connect, pull
         // the agent's own readiness snapshot (`$agent-readiness.getSnapshot`)
@@ -702,6 +704,27 @@ class MoleculerService {
             await tx.enableMeshTls(material);
             logger.info('Mesh mTLS listener enabled (dual-port with clear TCP)');
         });
+        // Release A cutover: System → Cluster reads each agent's transport and may
+        // close the clear port through this slot (never flipped by this wiring).
+        (0, system_1.setProcessMeshClearPortControl)({
+            listOnlineAgents: () => this.listAvailableNodeIds()
+                .filter((id) => id !== this.brokerSafe.nodeID && !id.includes('/'))
+                .map((nodeId) => ({
+                nodeId,
+                transport: (0, system_1.getBrokerTlsTransporter)(this.broker)?.peerTransport(nodeId) ?? 'clear',
+            })),
+            isTlsListening: () => (0, system_1.getBrokerTlsTransporter)(this.broker)?.isTlsListening() === true,
+            transportOf: (nodeId) => (0, system_1.getBrokerTlsTransporter)(this.broker)?.peerTransport(nodeId),
+            apply: async (mode) => {
+                const tx = (0, system_1.getBrokerTlsTransporter)(this.broker);
+                if (tx === null)
+                    return;
+                if (mode === 'off')
+                    tx.disableClearTransport();
+                else
+                    await tx.enableClearTransport();
+            },
+        });
         await this.brokerSafe.start();
         logger.info('Moleculer broker started (TCP transport)');
         this.meshGuard.start(() => this.listAvailableNodeIds());
@@ -1335,6 +1358,7 @@ class MoleculerService {
     }
     async onModuleDestroy() {
         (0, system_1.setProcessMeshTlsEnabler)(null);
+        (0, system_1.setProcessMeshClearPortControl)(null);
         this.meshGuard.stop();
         if (this.agentReadinessPullTimer !== null) {
             clearInterval(this.agentReadinessPullTimer);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.488",
+  "version": "1.2.490",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.361",
-    "@camstack/addon-agent-ui": "1.2.196",
+    "@camstack/addon-admin-ui": "1.2.363",
+    "@camstack/addon-agent-ui": "1.2.198",
     "@camstack/addon-auth": "1.2.135",
     "@camstack/addon-decoder-nodeav": "1.2.122",
     "@camstack/addon-notifiers": "1.2.129",
     "@camstack/addon-pipeline": "1.2.347",
-    "@camstack/addon-pipeline-orchestrator": "1.2.300",
+    "@camstack/addon-pipeline-orchestrator": "1.2.301",
     "@camstack/addon-post-analysis": "1.2.348",
     "@camstack/sdk": "1.2.128",
-    "@camstack/system": "1.2.383",
-    "@camstack/types": "1.2.333",
-    "@camstack/ui-library": "1.2.254",
+    "@camstack/system": "1.2.384",
+    "@camstack/types": "1.2.334",
+    "@camstack/ui-library": "1.2.256",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",