@camstack/server 1.2.577 → 1.2.579

package/dist/agent/agent-http.js

@@ -57,24 +57,27 @@ const node_crypto_1 = require("node:crypto");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const fastify_1 = __importDefault(require("fastify"));
+const zod_1 = require("zod");
 const system_1 = require("@camstack/system");
 const agent_sniffing_listener_js_1 = require("./agent-sniffing-listener.js");
 const agent_http_auth_js_1 = require("./agent-http-auth.js");
+const agent_pairing_routes_js_1 = require("./agent-pairing-routes.js");
+const agent_pairing_store_js_1 = require("./agent-pairing-store.js");
 const node_1 = require("@camstack/types/node");
-const agent_mesh_enroll_js_1 = require("./agent-mesh-enroll.js");
 const agent_update_routes_js_1 = require("./agent-update-routes.js");
 const derive_hub_url_js_1 = require("./derive-hub-url.js");
 Object.defineProperty(exports, "pickIpv4", { enumerable: true, get: function () { return derive_hub_url_js_1.pickIpv4; } });
 const agent_addon_runtime_js_1 = require("./agent-addon-runtime.js");
 const hubs_found_js_1 = require("./hubs-found.js");
-const agent_pairing_routes_js_1 = require("./agent-pairing-routes.js");
-const agent_pairing_store_js_1 = require("./agent-pairing-store.js");
 /** The pinned CA's fingerprint, or `null` when none is pinned or the PEM cannot be read. */
 function describePairedHub(pinnedCa, hubHttpsOrigin) {
     if (pinnedCa === null)
         return null;
     try {
-        return { url: hubHttpsOrigin, caFingerprint: (0, system_1.caFingerprintCompact)(pinnedCa) };
+        return {
+            url: hubHttpsOrigin,
+            caFingerprint: (0, system_1.caFingerprintCompact)(pinnedCa),
+        };
     }
     catch {
         return null;
@@ -174,7 +177,7 @@ function readConfigFile(configPath) {
         return {};
     }
 }
-/** agent.json holds the cluster secret (D797): owner-only on every OS. */
+/** agent.json holds the agent's private mesh key (D857): owner-only on every OS. */
 function writeConfigFile(configPath, data) {
     (0, node_1.writeOwnerOnlyFileSync)(configPath, JSON.stringify(data, null, 2));
 }
@@ -235,13 +238,15 @@ function mapDiscoveredNodes(nodes, selfId) {
 }
 /**
  * Derive the hub connection state from broker registry + config when no
- * external getter is wired. Does NOT detect `secret-mismatch` — that
+ * external getter is wired. Does NOT detect `certificate-rejected` — that
  * requires the bootstrap to inject `getHubConnectionState`.
  */
-function deriveHubConnectionState(nodes, hubAddressConfigured) {
+function deriveHubConnectionState(nodes, hubAddressConfigured, paired) {
     const hubInRegistry = nodes.some((n) => n.id === 'hub');
     if (hubInRegistry)
         return 'connected';
+    if (!paired)
+        return 'unpaired';
     if (!hubAddressConfigured)
         return 'unconfigured';
     return 'disconnected';
@@ -255,54 +260,51 @@ function getEffectiveConfig(configPath, nodeId) {
     return {
         name: typeof raw.name === 'string' ? raw.name : nodeId,
         hubAddress: typeof raw.hubAddress === 'string' ? raw.hubAddress : null,
-        hasSecret: typeof raw.secret === 'string' && raw.secret.length > 0,
+        paired: (0, agent_pairing_store_js_1.isAgentPaired)(configPath),
         hasMeshTls: raw.meshTls !== null && typeof raw.meshTls === 'object',
     };
 }
-/** Persisted fields that are credentials: never echoed by `GET /api/agent/config`. */
-const NEVER_ECHOED_CONFIG_KEYS = new Set([
-    'secret',
-    'meshTls',
-    'meshTlsPrevious',
-    'joinToken',
-]);
+/**
+ * The only keys `POST /api/agent/config` writes and `GET /api/agent/config` echoes. Everything
+ * else in `agent.json` (the mesh key and chain, a swap in progress, the node id, an old `secret`)
+ * is not reachable through this API, in either direction (D857).
+ */
+const EDITABLE_CONFIG_KEYS = ['name', 'hubAddress', 'logLevel'];
+/** Value types of the editable keys; unknown keys pass through to the allow-list refusal above. */
+const ConfigPatchSchema = zod_1.z.looseObject({
+    name: zod_1.z.string().max(100).nullable().optional(),
+    hubAddress: zod_1.z.string().max(300).nullable().optional(),
+    logLevel: zod_1.z.enum(['debug', 'info', 'warn', 'error']).optional(),
+});
 /** Clock skew allowed between the hub that issued a ticket and this agent's boot instant. */
 const TICKET_BOOT_SKEW_MS = 2 * 60_000;
-const defaultRedeemJoinToken = (token, nodeId) => (0, agent_mesh_enroll_js_1.enrollAgentMesh)({ token, nodeId });
 // ---------------------------------------------------------------------------
 // Factory
 // ---------------------------------------------------------------------------
 async function createAgentHttpServer(getBroker, config) {
     const app = (0, fastify_1.default)({ logger: false });
-    const cors = await Promise.resolve().then(() => __importStar(require('@fastify/cors')));
-    await app.register(cors.default);
+    // No CORS: the agent's page is served by the agent itself, so every legitimate caller is
+    // same-origin. `Access-Control-Allow-Origin: *` would let any web page read this API (D857).
     // -- Auth gate (port-4444 hardening, mirrors the hub's /health work) --
-    // Loopback (Electron renderer, in-container probes) always passes;
-    // remote callers need Bearer cluster secret OR a hub unlock session
-    // (D821). While UNPAIRED only the pairing surface is reachable remotely.
-    // `POST /api/agent/session` redeems an unlock ticket without a prior Bearer.
-    const currentSecret = () => {
-        const raw = readConfigFile(config.configPath);
-        return typeof raw.secret === 'string' && raw.secret.length > 0 ? raw.secret : null;
-    };
+    // Loopback (the agent's own page, the Electron renderer, in-container probes) always passes - a
+    // loopback peer behind a proxy does not (forwarding header). A remote caller needs a session minted
+    // from a hub unlock ticket (D821, D857). The pairing protocol routes are reachable by anyone, each
+    // authorized by what it carries. `POST /api/agent/session` redeems an unlock ticket without a prior
+    // session.
     /**
-     * Tab sessions from hub unlock tickets. A session is bound to what vouched for it - the mesh CA
-     * (by fingerprint) or the cluster secret - and dies the moment that changes: forgetting the hub
-     * or pairing with another one ends every session, not just the old Bearer (D857).
+     * Tab sessions from hub unlock tickets. A session is bound to the mesh CA that vouched for it (by
+     * fingerprint) and dies the moment that changes: forgetting the hub or pairing with another one
+     * ends every session (D857).
      */
     const unlockSessions = new Map();
     let unlockJtis = new system_1.UnlockTicketJtiStore();
     let jtiBinding = null;
     const bootMs = Date.now();
-    /** What would vouch for a session now: the pinned CA, else the secret, else nothing. */
+    /** What vouches for a session now: the pinned CA, else nothing. */
     const caBinding = () => {
         const ca = (0, agent_pairing_store_js_1.pinnedMeshCaCert)(config.configPath);
         return ca === null ? null : `ca:${(0, system_1.caFingerprintCompact)(ca)}`;
     };
-    const secretBinding = () => {
-        const secret = currentSecret();
-        return secret === null ? null : `secret:${(0, system_1.hashClusterSecret)(secret)}`;
-    };
     const sessionOk = (token) => {
         const entry = unlockSessions.get(token);
         if (entry === undefined)
@@ -311,37 +313,33 @@ async function createAgentHttpServer(getBroker, config) {
             unlockSessions.delete(token);
             return false;
         }
-        const current = entry.binding.startsWith('ca:') ? caBinding() : secretBinding();
-        if (current !== entry.binding) {
+        if (caBinding() !== entry.binding) {
             unlockSessions.delete(token);
             return false;
         }
         return true;
     };
+    // The gate decides on the route the ROUTER matched (`routeOptions.url`, the pattern), never on the
+    // raw URL: Fastify percent-decodes the path before matching, so `/%61pi/agent/restart` reaches the
+    // `/api/agent/restart` handler. Deny by default: only an explicit public route, a static UI asset
+    // (marked below) or a 404 (served by the not-found handler, which exposes nothing) skips the check.
     app.addHook('onRequest', async (req, reply) => {
-        const pathOnly = req.url.split('?')[0] ?? req.url;
-        const isProtected = pathOnly.startsWith('/api/') || pathOnly.startsWith('/health/');
-        if (!isProtected)
+        if (req.is404)
             return;
-        if ((0, agent_http_auth_js_1.isPairingProtocolRequest)(req.method, pathOnly))
+        if (req.routeOptions.config?.publicAsset === true)
             return;
-        const secret = currentSecret();
-        // Paired = holds the cluster secret OR a mesh certificate (D857): either closes the open surface.
-        const locked = secret !== null || (0, agent_pairing_store_js_1.isAgentPaired)(config.configPath);
-        if (locked && (0, agent_http_auth_js_1.isUnlockSessionRequest)(req.method, pathOnly))
+        const method = req.method === 'HEAD' ? 'GET' : req.method;
+        const matched = req.routeOptions.url ?? '';
+        if (method === 'GET' && matched === '/health')
             return;
-        if ((0, agent_http_auth_js_1.isUnlockInfoRequest)(req.method, pathOnly))
+        if ((0, agent_http_auth_js_1.isPairingProtocolRequest)(method, matched))
             return;
-        const authInput = {
-            remoteAddress: req.socket.remoteAddress ?? undefined,
-            forwarded: (0, agent_http_auth_js_1.hasForwardingHeader)(req.headers),
-            ...(typeof req.headers.authorization === 'string'
-                ? { authorization: req.headers.authorization }
-                : {}),
-        };
-        if ((0, agent_http_auth_js_1.isAuthorizedAgentRequest)(authInput, secret, sessionOk))
+        if ((0, agent_http_auth_js_1.isUnlockSessionRequest)(method, matched))
+            return;
+        if ((0, agent_http_auth_js_1.isUnlockInfoRequest)(method, matched))
             return;
-        if (!locked && (0, agent_http_auth_js_1.isPairingRequest)(req.method, pathOnly, config.pairing !== undefined))
+        const authInput = (0, agent_http_auth_js_1.authInputOf)(req);
+        if ((0, agent_http_auth_js_1.isAuthorizedAgentRequest)(authInput, sessionOk))
             return;
         return reply.status(401).send({ ok: false, error: 'unauthorized' });
     });
@@ -390,7 +388,7 @@ async function createAgentHttpServer(getBroker, config) {
         const hubConnected = nodes.some((n) => n.id === 'hub');
         const hubConnectionState = config.getHubConnectionState
             ? config.getHubConnectionState()
-            : deriveHubConnectionState(nodes, Boolean(eff.hubAddress));
+            : deriveHubConnectionState(nodes, Boolean(eff.hubAddress), eff.paired);
         const meshTransport = config.getMeshTransport
             ? config.getMeshTransport()
             : eff.hasMeshTls
@@ -421,8 +419,7 @@ async function createAgentHttpServer(getBroker, config) {
                 appVersion,
                 hubConnected,
                 hubConnectionState,
-                hasSecret: eff.hasSecret,
-                paired: (0, agent_pairing_store_js_1.isAgentPaired)(config.configPath),
+                paired: eff.paired,
                 pairedHub,
                 meshTransport,
                 discoveredNodes,
@@ -438,8 +435,7 @@ async function createAgentHttpServer(getBroker, config) {
                 appVersion,
                 hubConnected,
                 hubConnectionState,
-                hasSecret: eff.hasSecret,
-                paired: (0, agent_pairing_store_js_1.isAgentPaired)(config.configPath),
+                paired: eff.paired,
                 pairedHub,
                 meshTransport,
                 discoveredNodes,
@@ -450,7 +446,6 @@ async function createAgentHttpServer(getBroker, config) {
     });
     // -- Unlock info (public; Continue-with-hub needs hub origin while locked) --
     app.get('/api/agent/unlock-info', async () => {
-        const secret = currentSecret();
         const eff = getEffectiveConfig(config.configPath, config.nodeId);
         const nodes = getRegistryNodes(getBroker());
         const resolvedHubAddress = resolveHubEndpoint(nodes);
@@ -458,35 +453,28 @@ async function createAgentHttpServer(getBroker, config) {
             (resolvedHubAddress !== null ? (0, derive_hub_url_js_1.deriveHubUrlFromHubAddress)(resolvedHubAddress) : undefined) ??
             null;
         return {
-            paired: secret !== null || (0, agent_pairing_store_js_1.isAgentPaired)(config.configPath),
+            paired: eff.paired,
             nodeId: config.nodeId,
             hubHttpsOrigin,
         };
     });
     // -- Unlock session (hub admin ticket → tab Bearer; D821) -----------
     app.post('/api/agent/session', async (req, reply) => {
-        const secret = currentSecret();
+        // The ticket is signed by the mesh CA this agent pinned at pairing (D857).
         const pinnedCa = (0, agent_pairing_store_js_1.pinnedMeshCaCert)(config.configPath);
-        if (secret === null && pinnedCa === null) {
+        if (pinnedCa === null) {
             return reply.status(400).send({ ok: false, error: 'agent is not paired' });
         }
         const ticket = typeof req.body?.ticket === 'string' ? req.body.ticket.trim() : '';
         if (ticket.length === 0) {
             return reply.status(400).send({ ok: false, error: 'ticket required' });
         }
-        // Two forms are accepted in the transition release (D857): signed by the mesh CA this agent
-        // pinned (ES256), or the older HMAC under the cluster secret.
         // Nothing issued before this process started is accepted: the one-use ledger is in memory.
-        const options = {
+        const payload = (0, system_1.verifyAgentUiUnlockTicket)(pinnedCa, ticket, {
             expectedNodeId: config.nodeId,
             notBeforeMs: bootMs - TICKET_BOOT_SKEW_MS,
-        };
-        const es256 = pinnedCa !== null ? (0, system_1.verifyAgentUiUnlockTicketEs256)(pinnedCa, ticket, options) : null;
-        const hmac = es256 === null && secret !== null
-            ? (0, system_1.verifyAgentUiUnlockTicket)((0, system_1.hashClusterSecret)(secret), ticket, options)
-            : null;
-        const payload = es256 ?? hmac;
-        const binding = es256 !== null ? caBinding() : secretBinding();
+        });
+        const binding = caBinding();
         if (payload === null || binding === null) {
             return reply.status(401).send({ ok: false, error: 'invalid or expired unlock ticket' });
         }
@@ -544,12 +532,9 @@ async function createAgentHttpServer(getBroker, config) {
             nodeId: config.nodeId,
             name: eff.name,
             hubAddress: eff.hubAddress,
-            hasSecret: eff.hasSecret,
+            paired: eff.paired,
             hasMeshTls: eff.hasMeshTls,
-            configPath: config.configPath,
-            dataDir: config.dataDir,
-            // Include all persisted fields except credentials (secret, mesh key, pending token)
-            ...Object.fromEntries(Object.entries(persisted).filter(([k]) => !NEVER_ECHOED_CONFIG_KEYS.has(k))),
+            ...Object.fromEntries(Object.entries(persisted).filter(([k]) => EDITABLE_CONFIG_KEYS.includes(k))),
         };
     });
     // -- Config write (merge-patch + persist) ---------------------------
@@ -557,56 +542,23 @@ async function createAgentHttpServer(getBroker, config) {
     // the returned value / catches rejections, so an async handler is correct here.
     // eslint-disable-next-line oxc/no-async-endpoint-handlers
     app.post('/api/agent/config', async (req, reply) => {
-        // `joinToken` is redeemed, never stored; `meshTls` only ever comes from an
-        // enrollment (or is cleared via `clearMeshTls`), never pasted as PEM.
-        const body = req.body ?? {};
-        const joinToken = body['joinToken'];
-        const clearMeshTls = body['clearMeshTls'] === true;
-        const patch = Object.fromEntries(Object.entries(body).filter(([k]) => k !== 'joinToken' && k !== 'meshTls' && k !== 'clearMeshTls'));
-        const existing = readConfigFile(config.configPath);
-        const alreadyPaired = (typeof existing.secret === 'string' && existing.secret.length > 0) ||
-            (0, agent_pairing_store_js_1.isAgentPaired)(config.configPath);
-        const patchSecret = typeof patch['secret'] === 'string' && patch['secret'].trim().length > 0;
-        const hasJoinToken = typeof joinToken === 'string' && joinToken.trim().length > 0;
-        // First pairing (D803 / D821): hub always has a secret — require secret or
-        // join token. Later edits may omit secret to keep the stored value.
-        // A rename alone is not a pairing: it is allowed before the agent is paired (D857).
-        const renameOnly = Object.keys(patch).every((k) => k === 'name');
-        if (!alreadyPaired && !patchSecret && !hasJoinToken && !renameOnly) {
+        // Allow-list (D857): the mesh material only ever comes from a pairing, and the node id never
+        // changes. Any other key is refused whole - nothing is written.
+        const parsed = ConfigPatchSchema.safeParse(req.body ?? {});
+        if (!parsed.success) {
+            return reply.status(400).send({ success: false, error: 'Invalid config values' });
+        }
+        const body = parsed.data;
+        const refused = Object.keys(body).filter((k) => !EDITABLE_CONFIG_KEYS.includes(k));
+        if (refused.length > 0) {
             return reply.status(400).send({
                 success: false,
-                error: 'Cluster secret is required — copy it from the hub System → Cluster page, or paste a join token',
+                error: `Not editable here: ${refused.join(', ')}. Editable: ${EDITABLE_CONFIG_KEYS.join(', ')}`,
             });
         }
-        // Join-token enrollment (mesh mTLS Release A): the hub address comes from
-        // the token and wins over a `hubAddress` posted in the same form. Nothing is
-        // written unless the whole enrollment verified.
-        let enrolled = null;
-        if (hasJoinToken) {
-            try {
-                enrolled = await (config.redeemJoinToken ?? defaultRedeemJoinToken)(joinToken, config.nodeId);
-            }
-            catch (err) {
-                const message = err instanceof Error ? err.message : String(err);
-                console.error(`[Agent] join-token enrollment failed: ${message}`);
-                return reply
-                    .status(err instanceof agent_mesh_enroll_js_1.MeshEnrollError ? 400 : 502)
-                    .send({ success: false, error: message });
-            }
-        }
-        const merged = { ...existing, ...patch };
-        if (enrolled !== null) {
-            merged['hubAddress'] = enrolled.hubAddress;
-            merged['meshTls'] = enrolled.meshTls;
-        }
-        else if (clearMeshTls) {
-            delete merged['meshTls'];
-        }
-        writeConfigFile(config.configPath, merged);
-        if (enrolled !== null) {
-            console.log(`[Agent] Enrolled in the mesh CA via join token — hub ${enrolled.hubAddress}, ` +
-                'mutual TLS on next reconnect');
-        }
+        const patch = Object.fromEntries(Object.entries(body));
+        const existing = readConfigFile(config.configPath);
+        writeConfigFile(config.configPath, { ...existing, ...patch });
         // Apply name change immediately (no reconnect needed)
         if (typeof patch.name === 'string' && patch.name.trim()) {
             try {
@@ -617,22 +569,13 @@ async function createAgentHttpServer(getBroker, config) {
                 /* best-effort */
             }
         }
-        // Only flag reconnect when a connection-affecting field actually
-        // CHANGED. The form posts every visible field on every Save, so
-        // `patch.hubAddress !== undefined` was always true and produced
-        // false-positive "Restart required" prompts on no-op saves.
-        const reconnectRelevant = ['hubAddress', 'secret'];
-        const needsReconnect = enrolled !== null ||
-            clearMeshTls ||
-            reconnectRelevant.some((k) => Object.prototype.hasOwnProperty.call(patch, k) && patch[k] !== existing[k]);
-        return {
-            success: true,
-            restartRequired: needsReconnect,
-            ...(enrolled !== null ? { enrolled: true } : {}),
-            ...(clearMeshTls ? { clearedMeshTls: true } : {}),
-        };
+        // Only flag reconnect when a connection-affecting field actually CHANGED. The form posts
+        // every visible field on every Save, so a present `hubAddress` alone is not a change.
+        const needsReconnect = Object.prototype.hasOwnProperty.call(patch, 'hubAddress') &&
+            patch['hubAddress'] !== existing['hubAddress'];
+        return { success: true, restartRequired: needsReconnect };
     });
-    // -- Agent reconnect (applies new hub/secret config) ----------------
+    // -- Agent reconnect (applies a new hub address / mesh material) -----
     app.post('/api/agent/restart', async () => {
         if (!config.onReconnect) {
             return { success: false, message: 'Reconnect not available' };
@@ -668,6 +611,12 @@ async function createAgentHttpServer(getBroker, config) {
     const uiDir = resolveUiDistDir(config.dataDir, process.env['CAMSTACK_BUNDLED_ADDONS_DIR']);
     if (uiDir) {
         const fastifyStatic = await Promise.resolve().then(() => __importStar(require('@fastify/static')));
+        // Every route the static plugin mounts is the public UI bundle: tag them for the auth gate.
+        let mountingAssets = true;
+        app.addHook('onRoute', (route) => {
+            if (mountingAssets)
+                route.config = { ...route.config, publicAsset: true };
+        });
         await app.register(fastifyStatic.default, {
             root: uiDir,
             prefix: '/',
@@ -677,6 +626,7 @@ async function createAgentHttpServer(getBroker, config) {
             // fallback request 500'd with "reply.sendFile is not a function".
             decorateReply: true,
         });
+        mountingAssets = false;
         app.setNotFoundHandler(async (req, reply) => {
             if (req.url.startsWith('/api/') || req.url.startsWith('/health')) {
                 return reply.status(404).send({ error: 'Not found' });

package/dist/agent/agent-hub-registration.js

@@ -2,59 +2,37 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createAgentHubRegistration = createAgentHubRegistration;
 /**
- * The agent's upward capability registration (D3), bound to the mesh join.
+ * The agent's upward capability registration (D3).
  *
- * The hub forgets an agent — its join AND its registration — on every
- * `$node.disconnected` the HUB sees. That event is not symmetric: Moleculer
- * marks a node offline on gossip from a third node, on a failed write, on a
- * heartbeat timeout, and the agent, whose own view of the hub never broke,
- * sees none of it. On 2026-10-14 (the D848 rollout) the hub flapped
- * little-unraid and the Mac offline/online every 2–6 s for ~35 min while older
- * agents still gossiped about them; each flap wiped the agent's capabilities
- * on the hub, the agent re-joined (its next call came back "not
- * authenticated") but never re-registered, and both stayed online with ZERO
- * capabilities until a manual restart.
+ * The hub forgets an agent's registration on every `$node.disconnected` the HUB
+ * sees. That event is not symmetric: Moleculer marks a node offline on gossip
+ * from a third node, on a failed write, on a heartbeat timeout, and the agent,
+ * whose own view of the hub never broke, sees none of it. On 2026-10-14 the hub
+ * flapped two agents offline/online every 2–6 s for ~35 min; each flap wiped the
+ * agent's capabilities on the hub and nothing told the agent to send them again.
  *
- * So the registration follows the JOIN, not the agent's own `$node.connected`:
- *  - every join that settles in a state that lets calls through re-sends the
- *    complete manifest — a join runs exactly when the hub's view of this agent
- *    was reset (a new connection, or the hub said it lost us);
- *  - a registration the hub refuses as "cluster secret mismatch" while THIS
- *    connection's join proved the secret is not a mismatch: the hub forgot the
- *    join. The agent joins again, and that join re-registers;
+ * So the registration follows the HUB'S CONNECTION and the hub's own ask, not
+ * the agent's view of itself:
+ *  - every time the hub node connects, the complete manifest is sent again;
  *  - the hub may ask for it (`$agent.requestRegistration`, sent on the hub's
- *    own `$node.connected`), which closes the window in which the agent makes
- *    no call that could tell it the hub forgot.
+ *    own `$node.connected`);
+ *  - a child runner registering, an addon reload and boot send it too.
+ *
+ * Who the agent is comes from its certificate (D857): there is no join to wait
+ * for and no secret to prove. If the hub refuses the registration because it
+ * does not accept this agent's certificate (revoked, or issued by another CA),
+ * `onCertificateRefused` says so and the retry loop keeps trying — the operator
+ * re-pairs, and the next attempt succeeds.
  *
  * Each send is ONE atomic `$hub.registerNode` carrying the full set; sends are
  * coalesced (one in flight, at most one queued, the manifest built when it
  * goes). Nothing waits on a timer: the triggers are events, the retry is the ack.
  */
 const system_1 = require("@camstack/system");
-/** States in which a call to the hub is refused locally — nothing to send. */
-const BLOCKING = new Set(['secret-mismatch', 'hub-unverified']);
 function createAgentHubRegistration(opts) {
-    let waiting = false;
     let sending = false;
     let queuedReason = null;
-    const onRefused = (err) => {
-        if (!(0, system_1.isClusterSecretMismatchError)(err))
-            return; // aborted: shutting down
-        if (opts.join.client.state === 'authenticated') {
-            // This connection's join PROVED the secret, so the hub did not refuse
-            // the secret — it forgot the join (it saw this node disconnect). Join
-            // again; the settled join re-registers.
-            opts.log('[register-node] the hub refused the registration although this connection proved the cluster secret — it has forgotten the join; joining again');
-            opts.join.rejoin();
-            return;
-        }
-        opts.onSecretRefused?.(err);
-    };
     const send = (reason) => {
-        if (sending) {
-            queuedReason = reason;
-            return;
-        }
         sending = true;
         const manifest = opts.buildManifest();
         const bindings = manifest.addons.reduce((n, a) => n + a.capabilities.length, 0);
@@ -67,12 +45,18 @@ function createAgentHubRegistration(opts) {
             target: 'hub',
             ...(opts.signal !== undefined ? { signal: opts.signal } : {}),
             log: opts.log,
+            onAttemptFailed: (err) => {
+                if ((0, system_1.meshErrorType)(err) === system_1.MESH_NODE_UNAUTHENTICATED_TYPE)
+                    opts.onCertificateRefused?.(err);
+            },
         })
             .then(() => {
             opts.log(`[register-node] the hub acked this node's capabilities: ${manifest.addons.length} addon(s), ${bindings} binding(s) (${reason})`);
             opts.onAcked?.();
         })
-            .catch(onRefused)
+            .catch(() => {
+            // Aborted: shutting down.
+        })
             .finally(() => {
             sending = false;
             const next = queuedReason;
@@ -82,27 +66,16 @@ function createAgentHubRegistration(opts) {
         });
     };
     const trigger = (reason) => {
-        // A send already waiting for the join builds its manifest when it goes.
-        if (waiting)
+        if (sending) {
+            queuedReason = reason;
             return;
-        waiting = true;
-        opts.join.client.whenCallable().then(() => {
-            waiting = false;
-            send(reason);
-        }, () => {
-            // Blocked (mismatch / unverified hub) or the join is still pending:
-            // the next settled join sends it (`onJoinSettled`).
-            waiting = false;
-        });
+        }
+        send(reason);
     };
     return {
         trigger,
-        onJoinSettled(state) {
-            if (BLOCKING.has(state))
-                return;
-            // Every settled join means the hub's view of this node was reset (a new
-            // connection, or the hub said it lost us): the full set goes again.
-            trigger(`join settled: ${state}`);
+        onHubConnected() {
+            trigger('hub connected');
         },
     };
 }

package/dist/agent/agent-json-file.js

@@ -0,0 +1,59 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readJsonFile = readJsonFile;
+exports.writeJsonFile0600 = writeJsonFile0600;
+/**
+ * `agent.json` read/write helpers. The file is owner-only on every OS (an owner+SYSTEM ACL on
+ * Windows, where 0600 is a no-op) because it holds the mesh private key.
+ */
+const fs = __importStar(require("node:fs"));
+const node_1 = require("@camstack/types/node");
+function readJsonFile(file) {
+    if (!fs.existsSync(file))
+        return {};
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? Object.fromEntries(Object.entries(parsed))
+            : {};
+    }
+    catch {
+        return {};
+    }
+}
+function writeJsonFile0600(file, data) {
+    (0, node_1.writeOwnerOnlyFileSync)(file, JSON.stringify(data, null, 2));
+}