@camstack/server 1.2.577 → 1.2.579

package/dist/agent/agent-mesh-gate.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAgentMeshGate = createAgentMeshGate;
+/**
+ * The agent's mesh gate (D802, D857): only the hub may call this agent, and the
+ * hub is recognised by its CERTIFICATE — the agent's own TLS listener accepted
+ * it only because its leaf chains to the mesh CA this agent was paired with
+ * (`TlsTcpTransporter.verifiedPeer`).
+ *
+ * There is no join to run and nothing to hold: a verdict is a function of what
+ * the transport already knows, so the hub's very first packet on a new
+ * connection is judged correctly. An agent that is not paired holds no
+ * certificate, so it admits no one.
+ *
+ * Also here: the agent's outbound event scope (D848) — its events go to the hub only.
+ */
+const system_1 = require("@camstack/system");
+const HUB_NODE_ID = 'hub';
+/** At most one "refused" line per sender per this long. */
+const REFUSED_LOG_INTERVAL_MS = 60_000;
+function createAgentMeshGate(opts) {
+    const lastLoggedAt = new Map();
+    const gate = new system_1.AgentMeshIdentityGate({
+        ownNodeId: opts.nodeId,
+        hubNodeId: HUB_NODE_ID,
+        isVerifiedPeer: opts.isVerifiedPeer,
+        onRefused: (nodeId, what) => {
+            const at = Date.now();
+            const last = lastLoggedAt.get(nodeId);
+            if (last !== undefined && at - last < REFUSED_LOG_INTERVAL_MS)
+                return;
+            if (lastLoggedAt.size >= 64)
+                lastLoggedAt.clear();
+            lastLoggedAt.set(nodeId, at);
+            opts.log?.(`mesh inbound: "${nodeId}" is not the certified hub — refused (first call: ${what})`);
+        },
+    });
+    const eventScope = (0, system_1.createAgentEventScope)({
+        hubNodeId: HUB_NODE_ID,
+        ...(opts.log !== undefined ? { log: opts.log } : {}),
+    });
+    const inbound = (0, system_1.createMeshAccessMiddleware)({
+        ownNodeId: opts.nodeId,
+        gate,
+        logger: {
+            warn: (message, meta) => {
+                const detail = meta === undefined
+                    ? ''
+                    : ` ${Object.entries(meta)
+                        .map(([k, v]) => `${k}=${String(v)}`)
+                        .join(' ')}`;
+                opts.log?.(`${message}${detail}`);
+            },
+        },
+    });
+    return { gate, eventScope, middlewares: [inbound, eventScope.middleware] };
+}

package/dist/agent/agent-node-certificates.js

@@ -26,7 +26,7 @@ exports.createAgentNodeCertificates = createAgentNodeCertificates;
  */
 const node_crypto_1 = require("node:crypto");
 const system_1 = require("@camstack/system");
-const agent_mesh_enroll_js_1 = require("./agent-mesh-enroll.js");
+const agent_json_file_js_1 = require("./agent-json-file.js");
 /** Let the capability answer before the broker is torn down and rebuilt. */
 const RECONNECT_DELAY_MS = 400;
 /** A swap found pending at boot gets at least this long for the hub to confirm. */
@@ -57,7 +57,7 @@ function createAgentNodeCertificates(deps) {
     let pendingKeyPem = null;
     let rollbackTimer = null;
     const readMesh = () => {
-        const raw = (0, agent_mesh_enroll_js_1.readJsonFile)(deps.configPath);
+        const raw = (0, agent_json_file_js_1.readJsonFile)(deps.configPath);
         return {
             current: isMeshMaterial(raw['meshTls']) ? raw['meshTls'] : null,
             previous: isMeshMaterial(raw['meshTlsPrevious']) ? raw['meshTlsPrevious'] : null,
@@ -74,9 +74,9 @@ function createAgentNodeCertificates(deps) {
     };
     /** Write `agent.json` with the swap leftovers removed and `meshTls` optionally replaced. */
     const writeSettled = (replaceCurrent) => {
-        const raw = (0, agent_mesh_enroll_js_1.readJsonFile)(deps.configPath);
+        const raw = (0, agent_json_file_js_1.readJsonFile)(deps.configPath);
         const { meshTlsPrevious: _p, meshSwap: _s, ...rest } = raw;
-        (0, agent_mesh_enroll_js_1.writeJsonFile0600)(deps.configPath, {
+        (0, agent_json_file_js_1.writeJsonFile0600)(deps.configPath, {
             ...rest,
             ...(replaceCurrent !== undefined ? { meshTls: replaceCurrent } : {}),
         });
@@ -151,7 +151,7 @@ function createAgentNodeCertificates(deps) {
             return;
         }
         writeSettled();
-        log.error('No valid mesh leaf on this node: renew it from the hub or re-join with a join token', {
+        log.error('No valid mesh leaf on this node: renew it from the hub or pair it again', {
             tags,
         });
     };
@@ -222,12 +222,12 @@ function createAgentNodeCertificates(deps) {
             if (!leaf.checkPrivateKey((0, node_crypto_1.createPrivateKey)(pendingKeyPem))) {
                 throw new Error('the new leaf does not match the key this node generated');
             }
-            const raw = (0, agent_mesh_enroll_js_1.readJsonFile)(deps.configPath);
+            const raw = (0, agent_json_file_js_1.readJsonFile)(deps.configPath);
             const swap = {
                 fingerprint: leaf.fingerprint256,
                 deadline: now() + input.confirmWithinMs,
             };
-            (0, agent_mesh_enroll_js_1.writeJsonFile0600)(deps.configPath, {
+            (0, agent_json_file_js_1.writeJsonFile0600)(deps.configPath, {
                 ...raw,
                 meshTls: { certPem: input.certPem, keyPem: pendingKeyPem, caCertPem: current.caCertPem },
                 meshTlsPrevious: current,

package/dist/agent/agent-pairing-routes.js

@@ -9,10 +9,7 @@ const DEFAULT_OFFERS_PER_MINUTE = 10;
 const MAX_TRACKED_SOURCES = 512;
 /** True for a request from this machine itself: loopback peer, no forwarding header. */
 function isLocalRequest(req) {
-    return (0, agent_http_auth_js_1.isGenuineLoopback)({
-        remoteAddress: req.socket.remoteAddress ?? undefined,
-        forwarded: (0, agent_http_auth_js_1.hasForwardingHeader)(req.headers),
-    });
+    return (0, agent_http_auth_js_1.isGenuineLoopback)((0, agent_http_auth_js_1.authInputOf)(req));
 }
 function send(reply, result) {
     if (result.ok)

package/dist/agent/agent-pairing-store.js

@@ -46,12 +46,12 @@ exports.pairedLeafFingerprint = pairedLeafFingerprint;
 const node_crypto_1 = require("node:crypto");
 const fs = __importStar(require("node:fs"));
 const system_1 = require("@camstack/system");
-const agent_mesh_enroll_js_1 = require("./agent-mesh-enroll.js");
+const agent_json_file_js_1 = require("./agent-json-file.js");
 /** Keys that exist only while this agent is paired. */
 const PAIRED_KEYS = ['meshTls', 'meshTlsPrevious', 'meshSwap', 'hubAddress'];
 /** `agent.json` holds mesh material: the agent is paired. */
 function isAgentPaired(configPath) {
-    const meshTls = (0, agent_mesh_enroll_js_1.readJsonFile)(configPath)['meshTls'];
+    const meshTls = (0, agent_json_file_js_1.readJsonFile)(configPath)['meshTls'];
     return (meshTls !== null &&
         typeof meshTls === 'object' &&
         typeof Reflect.get(meshTls, 'certPem') === 'string' &&
@@ -60,7 +60,7 @@ function isAgentPaired(configPath) {
 }
 /** The CA certificate this agent pinned at pairing, or `null` while unpaired. */
 function pinnedMeshCaCert(configPath) {
-    const meshTls = (0, agent_mesh_enroll_js_1.readJsonFile)(configPath)['meshTls'];
+    const meshTls = (0, agent_json_file_js_1.readJsonFile)(configPath)['meshTls'];
     if (meshTls === null || typeof meshTls !== 'object')
         return null;
     const ca = Reflect.get(meshTls, 'caCertPem');
@@ -68,8 +68,8 @@ function pinnedMeshCaCert(configPath) {
 }
 /** Persist a completed pairing: the leaf, its key, the pinned CA and the hub's host. */
 function persistPairing(configPath, pairing) {
-    const { joinToken: _joinToken, meshTlsPrevious: _previous, meshSwap: _swap, ...existing } = (0, agent_mesh_enroll_js_1.readJsonFile)(configPath);
-    (0, agent_mesh_enroll_js_1.writeJsonFile0600)(configPath, {
+    const { meshTlsPrevious: _previous, meshSwap: _swap, ...existing } = (0, agent_json_file_js_1.readJsonFile)(configPath);
+    (0, agent_json_file_js_1.writeJsonFile0600)(configPath, {
         ...existing,
         hubAddress: pairing.hubAddress,
         meshTls: pairing.meshTls,
@@ -80,8 +80,8 @@ function persistPairing(configPath, pairing) {
  * the hub issued. The agent is unpaired afterwards and accepts offers again.
  */
 function forgetPairing(configPath, dataDir) {
-    const existing = (0, agent_mesh_enroll_js_1.readJsonFile)(configPath);
-    (0, agent_mesh_enroll_js_1.writeJsonFile0600)(configPath, Object.fromEntries(Object.entries(existing).filter(([key]) => !PAIRED_KEYS.includes(key))));
+    const existing = (0, agent_json_file_js_1.readJsonFile)(configPath);
+    (0, agent_json_file_js_1.writeJsonFile0600)(configPath, Object.fromEntries(Object.entries(existing).filter(([key]) => !PAIRED_KEYS.includes(key))));
     const https = (0, system_1.agentHttpsPaths)(dataDir);
     for (const file of [https.bundlePath, https.certPath, https.pendingKeyPath]) {
         fs.rmSync(file, { force: true });
@@ -89,7 +89,7 @@ function forgetPairing(configPath, dataDir) {
 }
 /** First 16 hex chars of the SHA-256 of the agent's mesh leaf, `null` while unpaired. */
 function pairedLeafFingerprint(configPath) {
-    const meshTls = (0, agent_mesh_enroll_js_1.readJsonFile)(configPath)['meshTls'];
+    const meshTls = (0, agent_json_file_js_1.readJsonFile)(configPath)['meshTls'];
     const certPem = meshTls !== null && typeof meshTls === 'object' ? Reflect.get(meshTls, 'certPem') : null;
     if (typeof certPem !== 'string')
         return null;

package/dist/agent/agent-service.js

@@ -607,15 +607,6 @@ function createAgentService(deps) {
             registerNode: {
                 handler(ctx) {
                     const { params } = ctx;
-                    // Cluster-secret gate: when the agent has a secret configured, a child
-                    // runner must present a matching hash or the registration is rejected.
-                    if (!(0, system_1.clusterSecretMatches)(deps.expectedClusterSecretHash, params.clusterSecretHash)) {
-                        throw new moleculer_1.Errors.MoleculerError(`cluster secret mismatch — node "${params.nodeId}" rejected`, 403, system_1.CLUSTER_SECRET_MISMATCH_TYPE);
-                    }
-                    const sender = typeof ctx.nodeID === 'string' ? ctx.nodeID : '';
-                    if (sender.length > 0) {
-                        deps.meshAuth?.noteChildRegistered(sender, deps.expectedClusterSecretHash !== undefined ? 'authenticated' : 'legacy');
-                    }
                     deps.onChildRegistered?.(params);
                     return { ok: true };
                 },

package/dist/agent/main.js

@@ -45,11 +45,10 @@ const single_copy_cleanup_runner_js_1 = require("../single-copy-cleanup-runner.j
 const addon_scan_js_1 = require("./addon-scan.js");
 const agent_addon_updates_js_1 = require("./agent-addon-updates.js");
 const agent_hub_registration_js_1 = require("./agent-hub-registration.js");
-const agent_mesh_join_js_1 = require("./agent-mesh-join.js");
+const agent_mesh_gate_js_1 = require("./agent-mesh-gate.js");
 const agent_pairing_local_js_1 = require("./agent-pairing-local.js");
 const agent_pairing_store_js_1 = require("./agent-pairing-store.js");
 const agent_config_js_1 = require("./agent-config.js");
-const agent_mesh_enroll_js_1 = require("./agent-mesh-enroll.js");
 const agent_group_runner_js_1 = require("./agent-group-runner.js");
 const agent_http_js_1 = require("./agent-http.js");
 const agent_node_certificates_js_1 = require("./agent-node-certificates.js");
@@ -88,32 +87,8 @@ const DATA_NODEID_CAPS = new Set(types_1.ALL_CAPABILITY_DEFINITIONS.filter((c) =
 // ---------------------------------------------------------------------------
 // Main
 // ---------------------------------------------------------------------------
-/**
- * Load `agent.json`, first redeeming a join token the setup window left there
- * (mesh mTLS Release A — the desktop setup runs before the agent does). A token
- * is single-use, so it is dropped whether or not the hub accepted it; a refusal
- * is logged loudly and the agent still boots (clear, or with the cluster secret).
- */
-async function loadAgentConfigRedeemingJoinToken(configPath) {
-    const loaded = (0, agent_config_js_1.loadAgentConfig)(configPath);
-    if (loaded.pendingJoinToken === undefined)
-        return loaded;
-    try {
-        const enrolled = await (0, agent_mesh_enroll_js_1.enrollAndPersist)({
-            token: loaded.pendingJoinToken,
-            nodeId: loaded.nodeId,
-            configPath: loaded.configPath,
-        });
-        console.log(`[Agent] Enrolled in the mesh CA (hub ${enrolled.hubAddress}) — dialing over mutual TLS`);
-    }
-    catch (err) {
-        console.error(`[Agent] Join-token enrollment failed — staying on the previous transport: ${(0, types_1.errMsg)(err)}`);
-        (0, agent_mesh_enroll_js_1.discardPendingJoinToken)(loaded.configPath);
-    }
-    return (0, agent_config_js_1.loadAgentConfig)(configPath, loaded.dataDir);
-}
 async function startAgent(configPath) {
-    const config = await loadAgentConfigRedeemingJoinToken(configPath);
+    const config = (0, agent_config_js_1.loadAgentConfig)(configPath);
     // Derive CAMSTACK_HUB_URL from the configured hub address so remote agents
     // no longer need a second, redundant env var set by hand (the cross-node
     // source trap). An explicit operator value ALWAYS wins — capture whether it
@@ -179,58 +154,31 @@ async function startAgent(configPath) {
         }
     }
     console.log(`[Agent] Addon packages ready in ${config.addonsDir}`);
-    // D802: the mesh join. Every call to the hub waits for the challenge–response
-    // (and the hub's own proof) on each connection. The secret comes from
-    // `agent.json`; a secret saved on the status page / desktop Setup takes
-    // effect through `reconnect()` below, which re-reads the file.
-    let currentSecret = config.secret ?? null;
-    let joinState = 'pending';
-    const meshJoin = (0, agent_mesh_join_js_1.createAgentMeshJoin)({
+    // D802, D857: the inbound mesh gate. Only the hub may call this agent, and the hub is
+    // recognised by the certificate the agent's own TLS listener verified. The transport is
+    // read at call time because a reconnect replaces it.
+    const meshGate = (0, agent_mesh_gate_js_1.createAgentMeshGate)({
         nodeId: config.nodeId,
-        secret: () => currentSecret,
-        // D857 (transition release): the hub is also accepted by its certificate, verified by this
-        // agent's own TLS listener, so a hub that stops answering the join still reaches this agent.
-        isPaired: () => (0, agent_pairing_store_js_1.isAgentPaired)(config.configPath),
         isVerifiedPeer: (nodeId) => {
             const tx = (0, system_1.currentBrokerTransporter)(broker).tx;
             return tx instanceof system_1.TlsTcpTransporter && tx.verifiedPeer(nodeId) !== undefined;
         },
-        call: (action, params, opts) => broker.call(action, params, opts),
         log: (msg) => console.log(`[Agent] ${msg}`),
-        onState: (state) => {
-            joinState = state;
-            if (state === 'secret-mismatch' || state === 'hub-unverified') {
-                hubConnectionStateOverride = 'secret-mismatch';
-                consoleLogger.error(state === 'secret-mismatch'
-                    ? "mesh join refused: cluster secret mismatch — copy the cluster secret from the hub's System → Cluster page into this agent's setup"
-                    : 'mesh join refused: the node answering as the hub could not prove the cluster secret — check the hub address and the secret');
-            }
-            else if (hubConnectionStateOverride === 'secret-mismatch') {
-                hubConnectionStateOverride = null;
-            }
-            // Every settled join re-sends the full manifest (D3, 2026-10-14): a join
-            // runs exactly when the hub's view of this node was reset.
-            registration.onJoinSettled(state);
-            if (state === 'no-secret') {
-                consoleLogger.warn("no cluster secret configured — the hub tolerates this agent only while its System → Cluster is in Transition. Copy the hub's cluster secret into this agent's setup");
-            }
-        },
     });
-    // Mesh mTLS (Release A): with a certificate the broker dials the hub's TLS
-    // port; without one it keeps dialing clear 6000.
+    // Mesh mTLS: with a certificate (pairing, D857) the broker dials the hub's TLS
+    // port; an unpaired agent has none and admits no mesh peer at all.
     let currentMeshTls = config.meshTls ?? null;
     // The HTTP/HTTPS listener on the agent port (D856); set once it is up.
     let agentHttpListener = null;
-    console.log(`[Agent] Mesh transport: ${currentMeshTls !== null ? 'tls' : 'clear'}`);
+    console.log(`[Agent] Mesh transport: ${currentMeshTls !== null ? 'tls (paired)' : 'none (unpaired)'}`);
     const broker = (0, system_1.createBroker)({
         nodeID: config.nodeId,
         mode: 'agent',
         hubAddress: config.hubAddress,
         logLevel: config.logLevel,
-        middlewares: meshJoin.middlewares,
+        middlewares: meshGate.middlewares,
         ...(currentMeshTls !== null ? { meshTls: currentMeshTls } : {}),
     });
-    meshJoin.attach(broker);
     /**
      * Reconnect: reload the config from file and replace the broker's TRANSPORT (the new hub
      * address, secret or mesh leaf) IN PLACE. The broker itself is never rebuilt: its services
@@ -268,11 +216,11 @@ async function startAgent(configPath) {
         },
         prepare: () => {
             console.log('[Agent] Reconnecting with updated config...');
-            // Reload config from file (UI may have written new hubAddress/secret)
+            // Reload config from file (pairing, the UI or a local call may have written it)
             const fresh = (0, agent_config_js_1.loadAgentConfig)(undefined, config.dataDir);
             pendingConfig = fresh;
-            console.log(`[Agent] New config: hub=${fresh.hubAddress ?? 'none'}, secret=${fresh.secret ? 'yes' : 'none'}, ` +
-                `mesh=${fresh.meshTls !== undefined ? 'tls' : 'clear'}`);
+            console.log(`[Agent] New config: hub=${fresh.hubAddress ?? 'none'}, ` +
+                `mesh=${fresh.meshTls !== undefined ? 'tls (paired)' : 'none (unpaired)'}`);
             // Re-derive CAMSTACK_HUB_URL when the dashboard has just written a hubAddress. Explicit operator values
             // still win via the boot-captured `hubUrlWasExplicit` flag.
             // KNOWN LIMITATION (Stage-0): runners already spawned before this reconnect
@@ -284,7 +232,6 @@ async function startAgent(configPath) {
                 process.env['CAMSTACK_HUB_URL'] = freshHubUrl;
                 console.log(`[Agent] Derived CAMSTACK_HUB_URL=${freshHubUrl} from hub address "${fresh.hubAddress}"`);
             }
-            currentSecret = fresh.secret ?? null;
             currentMeshTls = fresh.meshTls ?? null;
         },
         build: () => {
@@ -299,8 +246,8 @@ async function startAgent(configPath) {
                 ...(currentMeshTls !== null ? { meshTls: currentMeshTls } : {}),
             }));
         },
-        // The new wire's hub connection runs a join, and its settle re-sends the manifest
-        // (`registration.onJoinSettled`): the subtree union, every child included (D3).
+        // The new wire's hub connection re-sends the manifest (`registration.onHubConnected`):
+        // the subtree union, every child included (D3).
         start: async () => {
             await (0, system_1.connectBrokerTransport)(broker);
             console.log('[Agent] Reconnected successfully');
@@ -318,12 +265,12 @@ async function startAgent(configPath) {
     // Hub connection state tracking (for richer UI status)
     // ---------------------------------------------------------------------------
     // Tracks the last known discriminated state so the HTTP status endpoint
-    // can surface `secret-mismatch` which is not observable from the broker
+    // can surface `certificate-rejected` which is not observable from the broker
     // registry alone. All mutations are synchronous/single-threaded (Node.js
     // event loop) so no locking is needed.
     let hubConnectionStateOverride = null;
     function getHubConnectionState() {
-        // If a definitive override is set (e.g. secret-mismatch), return it
+        // If a definitive override is set (e.g. certificate-rejected), return it
         // regardless of registry state.
         if (hubConnectionStateOverride !== null)
             return hubConnectionStateOverride;
@@ -338,6 +285,8 @@ async function startAgent(configPath) {
         catch {
             /* fall through */
         }
+        if (!(0, agent_pairing_store_js_1.isAgentPaired)(config.configPath))
+            return 'unpaired';
         const configNow = readConfigFile(config.configPath);
         const hubAddressConfigured = typeof configNow.hubAddress === 'string' && configNow.hubAddress.length > 0;
         return hubAddressConfigured ? 'disconnected' : 'unconfigured';
@@ -423,12 +372,7 @@ async function startAgent(configPath) {
         // carries the agent's root-package identity so the hub's HubNodeRegistry
         // (and the Server management UI) sees every node's exact version.
         const rootPackage = agentUpdateService.getRunningRootPackage();
-        return (0, system_1.buildNodeManifest)(config.nodeId, allAddons, allNativeCaps.length > 0 ? allNativeCaps : undefined, 
-        // D802: the replayable D797 hash goes out ONLY to a hub that predates the
-        // challenge–response join. After a successful join nothing is sent.
-        joinState === 'unsupported' && currentSecret !== null && currentSecret.length > 0
-            ? (0, system_1.hashClusterSecret)(currentSecret)
-            : undefined, rootPackage.version === null
+        return (0, system_1.buildNodeManifest)(config.nodeId, allAddons, allNativeCaps.length > 0 ? allNativeCaps : undefined, rootPackage.version === null
             ? undefined
             : { name: rootPackage.name, version: rootPackage.version });
     }
@@ -437,26 +381,29 @@ async function startAgent(configPath) {
      * subtree union (`agent-hub-registration.ts`). Sent:
      *   - once boot has loaded every addon (`registration.ready()`);
      *   - on every `$agent.registerNode` from a child, and on `$agent.reload`;
-     *   - on every mesh join that settles — a new hub connection, or the hub
-     *     saying it lost this node — and when the hub asks for it
+     *   - every time the hub node connects, and when the hub asks for it
      *     (`$agent.requestRegistration`, on the hub's own `$node.connected`).
-     * D802: never before the join lets calls to the hub through, and the
-     * manifest is built AFTER the join, so it carries the legacy hash only for a
-     * hub that needs it.
+     * D857: no join to wait for and no secret in the manifest — the hub knows
+     * who this agent is from its certificate.
      */
     const registration = (0, agent_hub_registration_js_1.createAgentHubRegistration)({
-        join: meshJoin,
         buildManifest: () => aggregateManifest(),
         broker: () => broker,
         signal: registerAbortController.signal,
         log: (msg) => console.log(`[Agent] ${msg}`),
         // The hub acked the manifest — the agent reached its registered state.
         // Run the single-copy GC sweep once (first ack only; no-op after).
-        onAcked: () => confirmAgentBootHealthy(),
-        onSecretRefused: () => {
-            consoleLogger.error("hub registration rejected: cluster secret mismatch — enter the hub's cluster secret (System → Cluster) in this agent's setup (agent.json) and restart the agent");
-            // Surface the mismatch in the UI status.
-            hubConnectionStateOverride = 'secret-mismatch';
+        onAcked: () => {
+            if (hubConnectionStateOverride === 'certificate-rejected')
+                hubConnectionStateOverride = null;
+            confirmAgentBootHealthy();
+        },
+        onCertificateRefused: () => {
+            if (hubConnectionStateOverride === 'certificate-rejected')
+                return;
+            consoleLogger.error("the hub does not accept this agent's certificate (revoked, or issued by another CA) — pair it again: unpair it here, then pair it from the hub (System → Cluster → Agents)");
+            // Surface it in the UI status.
+            hubConnectionStateOverride = 'certificate-rejected';
         },
     });
     const consoleLogger = {
@@ -615,8 +562,6 @@ async function startAgent(configPath) {
             subtree.registerNode(params);
             registration.trigger(`child ${params.nodeId} registered`);
         },
-        expectedClusterSecretHash: config.secret ? (0, system_1.hashClusterSecret)(config.secret) : undefined,
-        meshAuth: meshJoin.authenticator,
         installFromNpm: async (pkg, version) => {
             await installer.install(pkg, version);
         },
@@ -1003,8 +948,8 @@ async function startAgent(configPath) {
     // ── D3: Fire the initial upward hub registration carrying the agent's
     // complete in-process manifest (+ any children that already registered).
     // Group-runner children call `$agent.registerNode` and trigger a re-fire
-    // via `onChildRegistered`; every settled mesh join re-fires it
-    // (`registration.onJoinSettled`), and so does the hub's ask.
+    // via `onChildRegistered`; every hub connection re-fires it
+    // (`registration.onHubConnected`), and so does the hub's ask.
     registration.trigger('boot');
     // Fire `onHubReachable()` on every in-process addon as soon as the hub
     // node connects to our broker — this is the safe point for ctx.api.* calls
@@ -1015,13 +960,9 @@ async function startAgent(configPath) {
         const node = data.node;
         if (node?.id !== 'hub')
             return;
-        // Hub connected — clear any stale secret-mismatch override so the
-        // status endpoint reflects the live state again.
-        if (hubConnectionStateOverride === 'secret-mismatch') {
-            hubConnectionStateOverride = null;
-        }
-        // No re-registration here: this connection runs a mesh join, and the
-        // join's settle re-sends the manifest (`registration.onJoinSettled`).
+        // Hub connected — its view of this agent was reset, so the full manifest goes again.
+        // (A stale `certificate-rejected` clears on the registration's ack.)
+        registration.onHubConnected();
         if (hubReachableFired)
             return;
         hubReachableFired = true;
@@ -1053,7 +994,8 @@ async function startAgent(configPath) {
                 }
             }
         }
-        // Stop accepting new HTTP/HTTPS connections before the broker goes away.
+        // Withdraw the mDNS advertisement, then stop accepting new HTTP/HTTPS connections before
+        // the broker goes away.
         await agentMdns.stop().catch(() => undefined);
         await agentHttpListener?.close().catch(() => undefined);
         await broker.stop();

package/dist/api/core/certificates.router.js

@@ -19,7 +19,7 @@ exports.createCertificatesRouter = createCertificatesRouter;
  *    recorded from the leaf it presents on its live connection (`observed`).
  *    Renewal is a handover that never leaves a node without a working leaf
  *    (`mesh-renewal.ts`); revocation puts the serial on the CRL and disconnects
- *    the node, which must re-join with a new join token. Neither forgets a node:
+ *    the node, which must be paired again. Neither forgets a node:
  *    that stays `clusterNodes.forgetNode`.
  */
 const node_crypto_1 = require("node:crypto");
@@ -473,7 +473,7 @@ function createCertificatesRouter(deps) {
         }),
         /**
          * Put the node's mesh leaf on the CRL and disconnect it. The node can no longer
-         * connect: it must re-join with a new join token. It is NOT forgotten - that stays
+         * connect: it must be paired again. It is NOT forgotten - that stays
          * `clusterNodes.forgetNode`.
          */
         revokeMeshOnNode: trpc_middleware_js_1.adminProcedure

package/dist/api/oauth2/consent-page.js

@@ -1,37 +1,25 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderConsentPage = renderConsentPage;
-function escapeHtml(s) {
-    return s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
-}
-/** Allow/Deny consent screen. Submitting POSTs to the same path with the
- *  hidden query fields + `consent=allow|deny`. */
+const app_page_shell_js_1 = require("../../auth/app-page-shell.js");
+/** Allow/Deny consent screen on the hub's shared page shell (the look of the
+ *  app sign-in pages). Submitting POSTs to the same path with the hidden query
+ *  fields + `consent=allow|deny`. */
 function renderConsentPage(input) {
     const hidden = Object.entries(input.hidden)
-        .map(([k, v]) => `<input type="hidden" name="${escapeHtml(k)}" value="${escapeHtml(v)}">`)
-        .join('\n      ');
-    return `<!doctype html>
-<html lang="en"><head><meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>CamStack · Authorize ${escapeHtml(input.displayName)}</title>
-<style>
- body{font-family:system-ui,sans-serif;max-width:480px;margin:4rem auto;padding:0 1rem;color:#1f2937}
- .card{border:1px solid #e5e7eb;border-radius:.5rem;padding:1.5rem}
- .meta{font-size:.85rem;color:#6b7280;margin:.5rem 0}
- button{font-size:1rem;padding:.5rem 1.25rem;border-radius:.375rem;cursor:pointer;border:1px solid transparent}
- .allow{background:#2563eb;color:#fff}.deny{background:#f3f4f6;color:#1f2937;border-color:#d1d5db;margin-left:.5rem}
-</style></head><body>
-  <div class="card">
-    <h1>Authorize ${escapeHtml(input.displayName)}</h1>
-    <p class="meta">Signed in as <strong>${escapeHtml(input.username)}</strong></p>
-    <p class="meta">This will grant: ${escapeHtml(input.scopeSummary)}</p>${input.redirectUri
-        ? `\n    <p class="meta">Sending the authorization to <code>${escapeHtml(input.redirectUri)}</code></p>`
-        : ''}
-    <form method="POST">
-      ${hidden}
-      <button class="allow" name="consent" value="allow" type="submit">Allow</button>
-      <button class="deny" name="consent" value="deny" type="submit">Deny</button>
-    </form>
-  </div>
-</body></html>`;
+        .map(([name, value]) => (0, app_page_shell_js_1.appHiddenField)(name, value))
+        .join('');
+    const destination = input.redirectUri
+        ? `<p class="hint">Sending the authorization to <code>${(0, app_page_shell_js_1.escapeHtml)(input.redirectUri)}</code></p>`
+        : '';
+    return (0, app_page_shell_js_1.renderAppPage)({
+        title: `CamStack · Authorize ${input.displayName}`,
+        heading: `Authorize ${input.displayName}`,
+        body: [
+            `<p>Signed in as <strong>${(0, app_page_shell_js_1.escapeHtml)(input.username)}</strong></p>`,
+            (0, app_page_shell_js_1.appHint)(`This will grant: ${input.scopeSummary}`),
+            destination,
+            `<form method="POST">${hidden}<div class="actions">${(0, app_page_shell_js_1.appSubmitButton)('Allow', 'consent', 'allow')}${(0, app_page_shell_js_1.appSubmitButton)('Deny', 'consent', 'deny', true)}</div></form>`,
+        ].join(''),
+    });
 }

package/dist/api/trpc/trpc.context.js

@@ -320,9 +320,8 @@ function makeDeviceScopeLookup(addonRegistry) {
  * `principal` names WHO is calling (D802): `mesh` for the hub's own runners
  * (they reach the bridge over UDS, inside the hub's trust boundary), and
  * `node:<nodeId>` for another node — whose id the hub's mesh gate has bound
- * to a challenge–response proof before the call got here
- * (`createMeshAccessMiddleware`; in `transition` mode an unauthenticated node
- * is tolerated and its id is only what it claims).
+ * to its CERTIFICATE before the call got here (`createMeshAccessMiddleware`:
+ * the TLS handshake chained to the mesh CA, the leaf CN is that id, D857).
  *
  * Both principals are still admins: that keeps every `adminProcedure` an
  * agent's addons call working. What is NOT reachable from another node is