@camstack/server 1.2.563 → 1.2.565

package/dist/api/trpc/trpc.router.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.enrichInputWithUserAgent = enrichInputWithUserAgent;
 exports.enrichInputWithRelayClass = enrichInputWithRelayClass;
@@ -6,7 +39,10 @@ exports.stripTalkbackFromRequest = stripTalkbackFromRequest;
 exports.enrichHintsWithClientClass = enrichHintsWithClientClass;
 exports.wrapWebrtcSessionProviderWithRelay = wrapWebrtcSessionProviderWithRelay;
 exports.buildAppRouter = buildAppRouter;
+const path = __importStar(require("node:path"));
 const addon_settings_router_js_1 = require("../core/addon-settings.router.js");
+const certificates_router_js_1 = require("../core/certificates.router.js");
+const node_certificates_client_js_1 = require("../../core/agent/node-certificates-client.js");
 const auth_router_js_1 = require("../core/auth.router.js");
 const cap_providers_js_1 = require("../core/cap-providers.js");
 const capabilities_router_js_1 = require("../core/capabilities.router.js");
@@ -269,11 +305,20 @@ function buildCapabilityRouters(services) {
         // clusterNodes — fixed core API. Write-side purge for the durable
         // offline-node history (Track A "Forget node"); read side is push-only.
         clusterNodes: (0, cluster_nodes_router_js_1.createClusterNodesRouter)(services.agentRegistry),
+        // certificates - Identity -> Certificates inventory (HTTPS per node, mesh CA). D855.
+        certificates: (0, certificates_router_js_1.createCertificatesRouter)({
+            registry: services.capabilityRegistry,
+            agentRegistry: services.agentRegistry,
+            nodeClient: (nodeId) => (0, node_certificates_client_js_1.createNodeCertificatesClient)(services.moleculer, nodeId),
+            hubDataDir: path.resolve(services.configService.get('server.dataPath') ?? 'camstack-data'),
+            log: services.loggingService.createLogger('certificates'),
+        }),
         auth: (0, auth_router_js_1.createAuthRouter)(services.authService, services.capabilityRegistry, services.moleculer, services.shareTokenService, services.handoffCodeService, services.externalLinkIntents, services.nativeLink ?? null, {
             ...(services.authNetworkPolicy !== undefined
                 ? { network: services.authNetworkPolicy }
                 : {}),
             ...(services.sessionBacking !== undefined ? { sessions: services.sessionBacking } : {}),
+            logger: services.loggingService.createLogger('auth'),
         }),
         // NOT MOUNTED — `mount: { kind: 'skip' }` legacy provider shapes
         // (positional args / sync returns) that don't match the codegen

package/dist/auth/device-enroll-proofs.js

@@ -0,0 +1,148 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceEnrollProofs = exports.DEVICE_ENROLL_PROOF_TTL_MS = void 0;
+/**
+ * Step-up proofs for `auth.enrollSelf` (D855).
+ *
+ * A signed-in user may request a device certificate for their own device, but
+ * only after signing in AGAIN at that moment — however recent their session
+ * is, and however many hours it has been refreshed for. The re-sign-in (a
+ * password / passkey re-authentication, or the app login handoff run in
+ * `step-up` purpose for any web method) yields ONE proof: purpose
+ * `device-enroll`, bound to the user, 5 minutes, single use, kept only as a
+ * hash. It replaces no session.
+ */
+const crypto = __importStar(require("node:crypto"));
+exports.DEVICE_ENROLL_PROOF_TTL_MS = 5 * 60_000;
+const MAX_PENDING = 1_000;
+function hash(proof) {
+    return crypto.createHash('sha256').update(proof).digest('hex');
+}
+/** How long a spent reauth token / claimed session is remembered (past the token's own 5 min). */
+const SPENT_MEMORY_MS = 6 * 60_000;
+class DeviceEnrollProofs {
+    now;
+    logger;
+    pending = new Map();
+    spentReauth = new Map();
+    claimedSessions = new Map();
+    /**
+     * `claimedSessions` lives in memory, so a restart forgets which sign-ins already started a
+     * step-up. To keep "once per sign-in" true across a restart, a session OPENED BEFORE this
+     * process started is refused (it simply signs in again): the window is 120 s, so the cost
+     * is one re-login right after a hub restart.
+     */
+    bootedAt;
+    constructor(now = Date.now, logger = null) {
+        this.now = now;
+        this.logger = logger;
+        this.bootedAt = now();
+    }
+    mint(userId) {
+        this.prune();
+        if (this.pending.size >= MAX_PENDING)
+            throw new Error('Too many pending step-up proofs');
+        const proof = `cdp_${crypto.randomBytes(32).toString('base64url')}`;
+        const expiresAt = this.now() + exports.DEVICE_ENROLL_PROOF_TTL_MS;
+        this.pending.set(hash(proof), { userId, expiresAt });
+        return { proof, expiresAt };
+    }
+    /** Consume `proof` for `userId`. Burned on the first attempt whatever the verdict. */
+    consume(proof, userId) {
+        if (proof === undefined || proof === '')
+            return this.refuse('missing', userId);
+        const key = hash(proof);
+        const entry = this.pending.get(key);
+        if (entry === undefined)
+            return this.refuse('unknown-or-used', userId);
+        this.pending.delete(key);
+        if (this.now() > entry.expiresAt)
+            return this.refuse('expired', userId);
+        if (entry.userId !== userId)
+            return this.refuse('other-user', userId);
+        return 'ok';
+    }
+    refuse(verdict, userId) {
+        this.logger?.warn(`Device enrollment step-up proof refused: ${verdict}`, {
+            tags: { userId },
+            meta: { reason: verdict },
+        });
+        return verdict;
+    }
+    /**
+     * A reauth token feeds ONE step-up (a proof or a step-up handoff code):
+     * `true` the first time, `false` for every later presentation.
+     */
+    consumeReauth(reauthToken) {
+        this.prune();
+        const key = hash(reauthToken);
+        if (this.spentReauth.has(key)) {
+            this.logger?.warn('Reauth token already used for a step-up', {
+                meta: { reason: 'reauth-reused' },
+            });
+            return false;
+        }
+        this.spentReauth.set(key, this.now() + SPENT_MEMORY_MS);
+        return true;
+    }
+    /** A freshly authenticated session may start ONE step-up: `true` the first time. */
+    claimFreshSession(sessionId, sessionCreatedAt) {
+        this.prune();
+        if (sessionCreatedAt < this.bootedAt) {
+            this.logger?.warn('Step-up refused: the sign-in predates this process, so a prior claim cannot be ruled out', {
+                meta: { reason: 'predates-boot' },
+            });
+            return false;
+        }
+        if (this.claimedSessions.has(sessionId))
+            return false;
+        this.claimedSessions.set(sessionId, this.now() + SPENT_MEMORY_MS);
+        return true;
+    }
+    prune() {
+        const at = this.now();
+        for (const [k, exp] of this.spentReauth)
+            if (at > exp)
+                this.spentReauth.delete(k);
+        for (const [k, exp] of this.claimedSessions)
+            if (at > exp)
+                this.claimedSessions.delete(k);
+        for (const [k, v] of this.pending)
+            if (at > v.expiresAt)
+                this.pending.delete(k);
+    }
+}
+exports.DeviceEnrollProofs = DeviceEnrollProofs;

package/dist/auth/hub-sessions.js

@@ -30,6 +30,8 @@ function createSessionBacking(sessions, lifetimes) {
             });
             return { session, refreshToken };
         },
+        revoke: (sessionId, reason) => sessions.revoke(sessionId, reason),
+        peek: (refreshToken) => sessions.peekByRefreshToken(refreshToken),
         extend: async (sessionId) => sessions.extend(sessionId, lifetimes().sessionMs),
         rotate: async (refreshToken) => {
             const result = await sessions.refresh(refreshToken, lifetimes().sessionMs);

package/dist/auth/session-mint.js

@@ -53,8 +53,9 @@ function createSessionMinter(deps) {
             throw new SessionDirectoryUnavailableError();
         return live;
     };
-    const claims = (record, sid) => ({
+    const claims = (record, sid, cid) => ({
         ...(sid !== undefined ? { sid } : {}),
+        ...(cid !== undefined && cid !== null ? { cid } : {}),
         userId: record.id,
         username: record.username,
         isAdmin: record.isAdmin,
@@ -72,7 +73,9 @@ function createSessionMinter(deps) {
         const remainingSec = Math.max(60, Math.floor((session.expiresAt - Date.now()) / 1000));
         const expiresInSec = refreshable ? Math.min(live.accessSec(), remainingSec) : remainingSec;
         return {
-            token: deps.signer.signToken(claims(record, session.id), { expiresInSec }),
+            token: deps.signer.signToken(claims(record, session.id, session.credentialId), {
+                expiresInSec,
+            }),
             expiresAt: Date.now() + expiresInSec * 1000,
         };
     };
@@ -92,6 +95,7 @@ function createSessionMinter(deps) {
             method: issue.method,
             ...(issue.client !== undefined ? { client: issue.client } : {}),
             ...(issue.ip !== undefined ? { ip: issue.ip } : {}),
+            ...(issue.credentialId !== undefined ? { credentialId: issue.credentialId } : {}),
         });
         const access = signFor(record, opened.session, refreshable, live);
         return {
@@ -132,6 +136,24 @@ function createSessionMinter(deps) {
             const live = backing();
             if (live === null)
                 throw new SessionRefreshRefusedError('unknown');
+            // A session opened by a device certificate lives only while that
+            // credential does (D855). The credential is judged BEFORE the refresh
+            // token is spent: a refusal here leaves the token untouched, so a transient
+            // `unavailable` can never turn into a "rotated-out token presented"
+            // refresh-reuse revocation on the retry. A revoked / expired credential
+            // revokes the session, so nothing is left to refresh.
+            const peeked = live.peek(refreshToken);
+            const credentialId = peeked?.credentialId ?? null;
+            if (peeked !== null && credentialId !== null) {
+                const gate = deps.credentials?.() ?? null;
+                const state = gate === null ? 'unavailable' : gate.check(credentialId);
+                if (state !== 'active') {
+                    if (state === 'revoked' || state === 'expired') {
+                        await live.revoke(peeked.id, `credential-${state}`);
+                    }
+                    throw new SessionRefreshRefusedError(`credential-${state}`);
+                }
+            }
             const rotated = await live.rotate(refreshToken);
             if (!rotated.ok)
                 throw new SessionRefreshRefusedError(rotated.reason);

package/dist/auth/sso-routes.js

@@ -77,6 +77,7 @@ function registerSsoRoutes(fastify, deps) {
                 session = await deps.minter.mintForUserId(grant.userId, {
                     method: 'handoff',
                     refreshable: true,
+                    ...(grant.credentialId !== undefined ? { credentialId: grant.credentialId } : {}),
                     ...(ip !== null ? { ip } : {}),
                     ...clientOf(request.headers['user-agent']),
                 });

package/dist/core/agent/agent-registry.service.js

@@ -379,6 +379,13 @@ class AgentRegistryService {
         // of failed deliveries to it is meaningless — drop it too.
         this.backfillTracker.forget(nodeId);
         this.deliveryLedger.forget(nodeId);
+        // The names the hub certified to this node are free again (a forgotten node cannot hold them).
+        await (0, system_1.getProcessAgentHttpsNames)()
+            ?.release(nodeId)
+            .catch((err) => this.logger?.warn("forget cluster node: could not release the node's certified names", {
+            tags: { nodeId },
+            meta: { error: err instanceof Error ? err.message : String(err) },
+        }));
         const historyRemoved = historyOutcome === 'removed';
         const stillListed = this.isNodeKnown(nodeId);
         const message = describeForgetOutcome(nodeId, historyOutcome, registryRemoved, stillListed);

package/dist/core/agent/node-certificates-client.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createNodeCertificatesClient = createNodeCertificatesClient;
+/**
+ * The hub's typed handle on a node's `node-certificates` capability (D856).
+ *
+ * `createCapabilityProxy` hands back untyped functions; every answer is narrowed
+ * through the capability's own Zod output schema, and a missing proxy (node
+ * offline, capability not declared by an old agent) or a malformed answer becomes
+ * a plain error naming the node - never a cast.
+ */
+const types_1 = require("@camstack/types");
+function createNodeCertificatesClient(moleculer, nodeId) {
+    const proxy = moleculer?.createCapabilityProxy('node-certificates', nodeId) ?? null;
+    if (proxy === null)
+        return null;
+    const call = async (method, schema, params) => {
+        const fn = proxy[method];
+        if (typeof fn !== 'function') {
+            throw new Error(`node ${nodeId} does not provide node-certificates.${method} (update the agent)`);
+        }
+        const parsed = schema.safeParse(await fn(params));
+        if (!parsed.success) {
+            throw new Error(`node ${nodeId} answered node-certificates.${method} with an unexpected shape`);
+        }
+        return parsed.data;
+    };
+    const m = types_1.nodeCertificatesCapability.methods;
+    return {
+        getCertificates: () => call('getCertificates', m.getCertificates.output, {}),
+        prepareMeshRenewal: () => call('prepareMeshRenewal', m.prepareMeshRenewal.output, {}),
+        installMeshLeaf: (input) => call('installMeshLeaf', m.installMeshLeaf.output, input),
+        confirmMeshLeaf: (input) => call('confirmMeshLeaf', m.confirmMeshLeaf.output, input),
+        rollbackMeshLeaf: () => call('rollbackMeshLeaf', m.rollbackMeshLeaf.output, {}),
+        prepareHttpsCertificate: () => call('prepareHttpsCertificate', m.prepareHttpsCertificate.output, {}),
+        installHttpsCertificate: (input) => call('installHttpsCertificate', m.installHttpsCertificate.output, input),
+    };
+}

package/dist/core/auth/handoff-code.service.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HandoffCodeService = exports.HANDOFF_CODE_MAX_PENDING = exports.HANDOFF_CODE_TTL_MS = exports.HANDOFF_CODE_PREFIX = void 0;
+exports.pkceChallenge = pkceChallenge;
 /**
  * HandoffCodeService — one-time login handoff codes for the native-app
  * auth handoff (viewer "Sign in with CamStack").
@@ -64,6 +65,10 @@ exports.HANDOFF_CODE_TTL_MS = 60_000;
 /** Hard bound on concurrently-pending codes (mint is auth-gated, so this
  *  only guards against a runaway authenticated client). */
 exports.HANDOFF_CODE_MAX_PENDING = 1_000;
+/** RFC 7636 S256: `base64url(sha256(verifier))`. */
+function pkceChallenge(verifier) {
+    return crypto.createHash('sha256').update(verifier).digest('base64url');
+}
 function hashCode(code) {
     return crypto.createHash('sha256').update(code).digest('hex');
 }
@@ -90,6 +95,9 @@ class HandoffCodeService {
             userId,
             ...(options.sessionId !== undefined ? { sessionId: options.sessionId } : {}),
             purpose: options.purpose ?? 'renew',
+            ...(options.codeChallenge !== undefined ? { codeChallenge: options.codeChallenge } : {}),
+            ...(options.state !== undefined ? { state: options.state } : {}),
+            ...(options.credentialId !== undefined ? { credentialId: options.credentialId } : {}),
             expiresAt,
         });
         return { code, expiresAt };
@@ -97,15 +105,30 @@ class HandoffCodeService {
     /** Redeem a raw code. Consumes the entry on the FIRST attempt no
      *  matter the outcome (single-use); returns `null` for unknown,
      *  already-used, or expired codes — the router maps that to 401. */
-    redeem(code) {
+    redeem(code, proof = {}) {
+        return this.redeemWithReason(code, proof).grant;
+    }
+    /** Like {@link redeem}, but says why a code was refused (for the log line). */
+    redeemWithReason(code, proof = {}) {
         const entry = this.pending.get(hashCode(code));
         if (!entry)
-            return null;
+            return { grant: null, reason: 'unknown-or-used' };
         this.pending.delete(hashCode(code));
         if (this.now() > entry.expiresAt)
-            return null;
+            return { grant: null, reason: 'expired' };
+        // PKCE: a code minted with a challenge redeems only with its verifier.
+        // The entry is already burned, so a wrong guess cannot be retried.
+        if (entry.codeChallenge !== undefined) {
+            if (proof.codeVerifier === undefined ||
+                pkceChallenge(proof.codeVerifier) !== entry.codeChallenge) {
+                return { grant: null, reason: 'pkce-mismatch' };
+            }
+        }
+        if (entry.state !== undefined && proof.state !== entry.state) {
+            return { grant: null, reason: 'state-mismatch' };
+        }
         const { expiresAt: _expiresAt, ...grant } = entry;
-        return grant;
+        return { grant, reason: null };
     }
     /** Number of not-yet-redeemed (possibly expired) codes. Test/diag aid. */
     get pendingCount() {

package/dist/core/moleculer/moleculer.service.js

@@ -711,6 +711,8 @@ class MoleculerService {
         });
         (0, system_1.setProcessMeshPeerTransportLookup)({
             transportOf: (nodeId) => (0, system_1.getBrokerTlsTransporter)(this.broker)?.peerTransport(nodeId),
+            peerLeaf: (nodeId) => (0, system_1.getBrokerTlsTransporter)(this.broker)?.peerLeaf(nodeId),
+            dropPeer: (nodeId) => (0, system_1.getBrokerTlsTransporter)(this.broker)?.dropPeer(nodeId) ?? 0,
         });
         await this.brokerSafe.start();
         logger.info('Moleculer broker started (TCP transport)');
@@ -927,6 +929,9 @@ class MoleculerService {
         else
             this.nodeOwners.set(params.nodeId, owner);
         this.applyNodeManifest(params, previousManifest, owner, previousOwner);
+        // The node's capabilities are routable now: whoever waits for this registration (a mesh
+        // leaf renewal confirming the node came back WITH the new leaf) is told, with no polling.
+        (0, system_1.emitProcessNodeRegistered)(params.nodeId);
         // Notify AgentRegistryService to reconcile placement for bare-ID
         // agent nodes (no '/' = not a hub child worker, not the hub itself).
         // The handshake is the authoritative completeness signal — the full

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.563",
+  "version": "1.2.565",
   "license": "MIT",
   "private": false,
   "files": [
@@ -38,19 +38,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.418",
-    "@camstack/addon-agent-ui": "1.2.230",
-    "@camstack/addon-auth": "1.2.143",
+    "@camstack/addon-admin-ui": "1.2.419",
+    "@camstack/addon-agent-ui": "1.2.231",
+    "@camstack/addon-auth": "1.2.144",
     "@camstack/addon-decoder-nodeav": "1.2.123",
     "@camstack/addon-notifiers": "1.2.134",
-    "@camstack/addon-pipeline": "1.2.367",
-    "@camstack/addon-pipeline-orchestrator": "1.2.317",
+    "@camstack/addon-pipeline": "1.2.368",
+    "@camstack/addon-pipeline-orchestrator": "1.2.318",
     "@camstack/addon-post-analysis": "1.2.369",
     "@camstack/develop": "0.1.8",
     "@camstack/sdk": "1.2.131",
-    "@camstack/system": "1.2.428",
-    "@camstack/types": "1.2.364",
-    "@camstack/ui-library": "1.2.287",
+    "@camstack/system": "1.2.429",
+    "@camstack/types": "1.2.365",
+    "@camstack/ui-library": "1.2.288",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",