@camstack/server 1.2.577 → 1.2.579

package/dist/auth/app-confirm-page.js

@@ -7,15 +7,16 @@ exports.appConfirmRefusalPage = appConfirmRefusalPage;
  * The hub-rendered confirmation page of a native app sign-in (D858):
  * "Sign in the CamStack app as <username>?".
  *
- * Same discipline as the passkey page (`app-passkey-page.ts`): plain HTML, one
- * inline script and one style pinned by SHA-256 in the CSP, same-origin
- * requests only, no framing, no third-party asset. The page carries the
+ * Same discipline as the passkey page (`app-passkey-page.ts`): plain HTML on the
+ * shared shell (`app-page-shell.ts`, which owns the look and the style hash),
+ * one inline script pinned by SHA-256 in the CSP, same-origin requests only, no
+ * framing, no third-party asset. The page carries the
  * one-shot token in a `data-` attribute (never in the script), so the script
  * hash is a constant. Continue POSTs the token and navigates to the
  * `location` the hub answers; Cancel is a plain link to the app with
  * `error=cancelled`.
  */
-const node_crypto_1 = require("node:crypto");
+const app_page_shell_js_1 = require("./app-page-shell.js");
 const PAGE_SCRIPT = `(function () {
   var btn = document.getElementById('go');
   var msg = document.getElementById('msg');
@@ -39,26 +40,33 @@ const PAGE_SCRIPT = `(function () {
     });
   });
 })();`;
-const PAGE_STYLE = `body{font-family:system-ui,sans-serif;max-width:26rem;margin:4rem auto;padding:0 1rem;text-align:center}button{font:inherit;padding:.75rem 1.25rem;border-radius:.5rem;border:1px solid #888;cursor:pointer}p#msg{color:#b00020;min-height:1.5em}a{display:inline-block;margin-top:1rem}`;
-const sha256 = (text) => `'sha256-${(0, node_crypto_1.createHash)('sha256').update(text).digest('base64')}'`;
-/** The CSP: the one script and style by hash, same-origin requests, no framing, no form posts. */
-exports.APP_CONFIRM_CSP = [
-    "default-src 'none'",
-    `script-src ${sha256(PAGE_SCRIPT)}`,
-    `style-src ${sha256(PAGE_STYLE)}`,
-    "connect-src 'self'",
-    "base-uri 'none'",
-    "form-action 'none'",
-    "frame-ancestors 'none'",
-].join('; ');
-/** CSP of the refusal page: nothing runs, nothing loads. */
-exports.APP_CONFIRM_REFUSAL_CSP = "default-src 'none'; frame-ancestors 'none'";
-const escapeHtml = (text) => text.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+/** The CSP: the shell's style and this page's one script by hash, same-origin requests, no framing, no form posts. */
+exports.APP_CONFIRM_CSP = (0, app_page_shell_js_1.appPageCsp)({ script: PAGE_SCRIPT });
+/** CSP of the refusal page: the shell's style only, nothing runs. */
+exports.APP_CONFIRM_REFUSAL_CSP = (0, app_page_shell_js_1.appPageCsp)();
 /** The confirmation page for `username`; `cancelHref` is the app callback carrying `error=cancelled`. */
 function appConfirmPage(input) {
-    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="referrer" content="no-referrer"><title>Sign in the CamStack app</title><style>${PAGE_STYLE}</style></head><body><h1>Sign in the CamStack app?</h1><p>The CamStack app on this device will be signed in as <strong>${escapeHtml(input.username)}</strong>.</p><p>Continue only if you just started this from the CamStack app.</p><button id="go" type="button" data-confirm="${escapeHtml(input.token)}">Continue</button><p id="msg" role="alert"></p><a href="${escapeHtml(input.cancelHref)}">Cancel</a><noscript><p>JavaScript is required to continue.</p></noscript><script>${PAGE_SCRIPT}</script></body></html>`;
+    return (0, app_page_shell_js_1.renderAppPage)({
+        title: 'Sign in the CamStack app',
+        heading: 'Sign in the CamStack app?',
+        noReferrer: true,
+        script: PAGE_SCRIPT,
+        body: [
+            `<p>The CamStack app on this device will be signed in as <strong>${(0, app_page_shell_js_1.escapeHtml)(input.username)}</strong>.</p>`,
+            (0, app_page_shell_js_1.appHint)('Continue only if you just started this from the CamStack app.'),
+            (0, app_page_shell_js_1.appButton)('Continue', `id="go" data-confirm="${(0, app_page_shell_js_1.escapeHtml)(input.token)}"`),
+            (0, app_page_shell_js_1.appErrorLine)('msg'),
+            (0, app_page_shell_js_1.appCancelLink)(input.cancelHref, 'Cancel'),
+            '<noscript><p class="error">JavaScript is required to continue.</p></noscript>',
+        ].join(''),
+    });
 }
 /** A confirmation that is gone (expired, used, or opened in another browser): a sentence, nothing runs. */
 function appConfirmRefusalPage() {
-    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Confirmation expired</title></head><body><h1>Confirmation expired</h1><p>This sign-in confirmation is no longer valid.</p><p>Close this window and start the sign-in again from the app.</p></body></html>`;
+    return (0, app_page_shell_js_1.renderAppPage)({
+        title: 'Confirmation expired',
+        heading: 'Confirmation expired',
+        body: (0, app_page_shell_js_1.appParagraph)('This sign-in confirmation is no longer valid.') +
+            (0, app_page_shell_js_1.appHint)('Close this window and start the sign-in again from the app.'),
+    });
 }

package/dist/auth/app-page-shell.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.appCancelLink = exports.appHiddenField = exports.appSubmitButton = exports.appErrorLine = exports.appButton = exports.appHint = exports.appParagraph = exports.APP_PAGE_STYLE = exports.APP_PAGE_LOGOS = void 0;
+exports.appPageCsp = appPageCsp;
+exports.escapeHtml = escapeHtml;
+exports.renderAppPage = renderAppPage;
+/**
+ * The one shell of every standalone page the hub renders for a native app
+ * sign-in (D858): the passkey page, the confirmation page, the refusal pages.
+ *
+ * These pages are server-rendered HTML with no admin-ui bundle and a strict
+ * CSP, so they cannot borrow the admin login's React components - but they must
+ * not look like a different product either. Everything visual lives HERE and
+ * nowhere else:
+ *
+ *  - the colours, radii, spacing and font stack are GENERATED from the theme
+ *    the admin UI is built on (`@camstack/ui-library/theme/tokens`) - no hex is
+ *    typed in this file, so a theme change reaches these pages by itself;
+ *  - the card, primary button, cancel link, error line and muted hint repeat the
+ *    admin login page's look (`Login.tsx`: `rounded-xl border bg-surface p-6`,
+ *    `bg-primary rounded-lg` button, `bg-danger/10` error);
+ *  - the stylesheet is ONE inline `<style>` and the CSP pins it by the SHA-256
+ *    of the very string that is served, computed at module load - there is no
+ *    hand-pasted hash that can fall out of step with the CSS.
+ */
+const node_crypto_1 = require("node:crypto");
+const tokens_1 = require("@camstack/ui-library/theme/tokens");
+/** The brand mark and wordmark, one per colour scheme (the files under `addon-admin-ui/public/brand`). */
+const LOGO_DARK = '<svg class="logo logo-dark" role="img" aria-label="CamStack" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 48" fill="none"><g transform="translate(4, 2) scale(0.68)"><rect x="8" y="28" width="48" height="28" rx="6" fill="#292524"/><rect x="12" y="16" width="40" height="28" rx="6" fill="#44403c"/><rect x="16" y="4" width="32" height="28" rx="6" fill="#f59e42"/><circle cx="32" cy="18" r="8" fill="#0c0a09" opacity="0.3"/><circle cx="32" cy="18" r="5" fill="#0c0a09" opacity="0.2"/><circle cx="32" cy="18" r="2.5" fill="#fafaf9" opacity="0.8"/></g><text x="52" y="31" font-family="system-ui, -apple-system, sans-serif" font-size="26" font-weight="700" letter-spacing="-0.5" fill="#fafaf9">Cam<tspan fill="#f59e42">Stack</tspan></text></svg>';
+const LOGO_LIGHT = '<svg class="logo logo-light" role="img" aria-label="CamStack" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 48" fill="none"><g transform="translate(4, 2) scale(0.68)"><rect x="8" y="28" width="48" height="28" rx="6" fill="#d6d3d1"/><rect x="12" y="16" width="40" height="28" rx="6" fill="#a8a29e"/><rect x="16" y="4" width="32" height="28" rx="6" fill="#e67e22"/><circle cx="32" cy="18" r="8" fill="#fafaf9" opacity="0.3"/><circle cx="32" cy="18" r="5" fill="#fafaf9" opacity="0.2"/><circle cx="32" cy="18" r="2.5" fill="#1c1917" opacity="0.7"/></g><text x="52" y="31" font-family="system-ui, -apple-system, sans-serif" font-size="26" font-weight="700" letter-spacing="-0.5" fill="#1c1917">Cam<tspan fill="#e67e22">Stack</tspan></text></svg>';
+/** The logo markup, exposed so a spec can hold it against the brand files. */
+exports.APP_PAGE_LOGOS = {
+    dark: LOGO_DARK,
+    light: LOGO_LIGHT,
+};
+/**
+ * Component rules, written against the token variables. Sizes mirror the admin
+ * login page (Tailwind `text-sm`/`text-xs`, `rounded-xl`, `p-6`, `py-2.5`),
+ * with a 44 px touch target for the phone this opens on.
+ */
+const COMPONENT_CSS = [
+    '*,*::before,*::after{box-sizing:border-box}',
+    `html{background:var(--color-background)}`,
+    `body{margin:0;min-height:100vh;min-height:100dvh;display:flex;align-items:center;justify-content:center;padding:max(var(--spacing-xl),env(safe-area-inset-top)) max(var(--spacing-xl),env(safe-area-inset-right)) max(var(--spacing-xl),env(safe-area-inset-bottom)) max(var(--spacing-xl),env(safe-area-inset-left));background:var(--color-background);color:var(--color-foreground);font-family:var(--font-family);font-size:14px;line-height:20px;-webkit-text-size-adjust:100%}`,
+    `main{width:100%;max-width:24rem}`,
+    `.brand{display:flex;justify-content:center;margin-bottom:var(--spacing-3xl)}`,
+    `.logo{height:3rem;width:auto}`,
+    `.logo-dark{display:none}`,
+    `@media (prefers-color-scheme:dark){.logo-dark{display:block}.logo-light{display:none}}`,
+    `.card{display:flex;flex-direction:column;gap:var(--spacing-xl);padding:var(--spacing-2xl);border:1px solid var(--color-border);border-radius:var(--radius-xl);background:var(--color-surface);box-shadow:0 20px 25px -5px rgb(0 0 0/.1),0 8px 10px -6px rgb(0 0 0/.1)}`,
+    `.card h1{margin:0;font-size:16px;line-height:22px;font-weight:600;text-align:center;color:var(--color-foreground)}`,
+    `.card p{margin:0;color:var(--color-foreground-muted)}`,
+    `.card strong{color:var(--color-foreground);font-weight:600;overflow-wrap:anywhere}`,
+    `.card .hint{font-size:12px;line-height:16px;color:var(--color-foreground-subtle)}`,
+    `.btn{display:flex;align-items:center;justify-content:center;width:100%;min-height:44px;padding:10px 16px;border:1px solid transparent;border-radius:var(--radius-lg);background:var(--color-primary);color:var(--color-primary-foreground);font:inherit;font-weight:600;text-decoration:none;cursor:pointer;box-shadow:0 4px 6px -1px color-mix(in srgb,var(--color-primary) 20%,transparent)}`,
+    `.btn:hover{background:color-mix(in srgb,var(--color-primary) 90%,transparent)}`,
+    `.btn:disabled{opacity:.5;cursor:not-allowed;box-shadow:none}`,
+    `.btn.secondary{background:var(--color-background);color:var(--color-foreground);border-color:var(--color-border);box-shadow:none}`,
+    `.btn.secondary:hover{background:var(--color-surface-hover)}`,
+    `.link{display:block;text-align:center;padding:var(--spacing-md);font-size:12px;line-height:16px;color:var(--color-foreground-subtle);text-decoration:none}`,
+    `.link:hover{color:var(--color-foreground)}`,
+    `.error{padding:8px 12px;border:1px solid color-mix(in srgb,var(--color-danger) 20%,transparent);border-radius:var(--radius-md);background:color-mix(in srgb,var(--color-danger) 10%,transparent);color:var(--color-danger);font-size:12px;line-height:16px}`,
+    `.card p.error{color:var(--color-danger)}`,
+    `.error:empty{display:none}`,
+    `.btn:focus-visible,.link:focus-visible{outline:2px solid var(--color-primary);outline-offset:2px}`,
+    `code{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:12px;overflow-wrap:anywhere}`,
+    `form{display:contents}`,
+    `.actions{display:flex;flex-direction:column;gap:var(--spacing-md)}`,
+].join('');
+/** The one stylesheet, as served: the generated tokens followed by the component rules. */
+exports.APP_PAGE_STYLE = `${(0, tokens_1.themeToRootCss)(tokens_1.defaultTheme)}${COMPONENT_CSS}`;
+const sha256Source = (text) => `'sha256-${(0, node_crypto_1.createHash)('sha256').update(text).digest('base64')}'`;
+/**
+ * The CSP for a page rendered by {@link renderAppPage}: the inline style and
+ * (when there is one) the inline script by hash, same-origin requests only, no
+ * framing, no base rewrite. The hashes are computed from the strings the page
+ * is built from, so they cannot disagree with it.
+ */
+function appPageCsp(options = {}) {
+    return [
+        "default-src 'none'",
+        ...(options.script === undefined ? [] : [`script-src ${sha256Source(options.script)}`]),
+        `style-src ${sha256Source(exports.APP_PAGE_STYLE)}`,
+        ...(options.script === undefined ? [] : ["connect-src 'self'"]),
+        "base-uri 'none'",
+        `form-action ${options.formToSelf === true ? "'self'" : "'none'"}`,
+        "frame-ancestors 'none'",
+    ].join('; ');
+}
+/** Escapes text for an HTML text node or a double-quoted attribute. */
+function escapeHtml(text) {
+    return text.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+}
+/** A full page: doctype, viewport (with safe-area fit), tokens, logo, a card holding `body`. */
+function renderAppPage(input) {
+    const referrer = input.noReferrer === true ? '<meta name="referrer" content="no-referrer">' : '';
+    const script = input.script === undefined ? '' : `<script>${input.script}</script>`;
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover"><meta name="color-scheme" content="light dark">${referrer}<title>${escapeHtml(input.title)}</title><style>${exports.APP_PAGE_STYLE}</style></head><body><main><div class="brand">${LOGO_DARK}${LOGO_LIGHT}</div><div class="card"><h1>${escapeHtml(input.heading)}</h1>${input.body}</div></main>${script}</body></html>`;
+}
+/** A paragraph of the card (`text` is escaped). */
+const appParagraph = (text) => `<p>${escapeHtml(text)}</p>`;
+exports.appParagraph = appParagraph;
+/** A smaller, muted paragraph (`text` is escaped). */
+const appHint = (text) => `<p class="hint">${escapeHtml(text)}</p>`;
+exports.appHint = appHint;
+/** The primary button; `attributes` is trusted markup (already escaped), `label` is escaped. */
+const appButton = (label, attributes) => `<button class="btn" type="button" ${attributes}>${escapeHtml(label)}</button>`;
+exports.appButton = appButton;
+/** The error line a script fills in; empty it renders nothing. */
+const appErrorLine = (id) => `<p class="error" id="${id}" role="alert"></p>`;
+exports.appErrorLine = appErrorLine;
+/** A submit button of a form (`name`/`value` are escaped); `secondary` is the outlined, non-default choice. */
+const appSubmitButton = (label, name, value, secondary = false) => `<button class="${secondary ? 'btn secondary' : 'btn'}" type="submit" name="${escapeHtml(name)}" value="${escapeHtml(value)}">${escapeHtml(label)}</button>`;
+exports.appSubmitButton = appSubmitButton;
+/** A hidden form field (`name`/`value` are escaped). */
+const appHiddenField = (name, value) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`;
+exports.appHiddenField = appHiddenField;
+/** The quiet link under the actions (Cancel); `href` is escaped here. */
+const appCancelLink = (href, label) => `<a class="link" href="${escapeHtml(href)}">${escapeHtml(label)}</a>`;
+exports.appCancelLink = appCancelLink;

package/dist/auth/app-passkey-page.js

@@ -19,7 +19,7 @@ exports.appPasskeyRefusalPage = appPasskeyRefusalPage;
  * specific is ever placed in the script; the only server-rendered value is the
  * (allow-listed, HTML-escaped) cancel link.
  */
-const node_crypto_1 = require("node:crypto");
+const app_page_shell_js_1 = require("./app-page-shell.js");
 const PAGE_SCRIPT = `(function () {
   var q = new URLSearchParams(location.search);
   var base = location.pathname.replace(/\\/+$/, '');
@@ -107,29 +107,34 @@ const PAGE_SCRIPT = `(function () {
   }
   btn.addEventListener('click', go);
 })();`;
-const PAGE_STYLE = `body{font-family:system-ui,sans-serif;max-width:26rem;margin:4rem auto;padding:0 1rem;text-align:center}button{font:inherit;padding:.75rem 1.25rem;border-radius:.5rem;border:1px solid #888;cursor:pointer}p#msg{color:#b00020;min-height:1.5em}a{display:inline-block;margin-top:1rem}`;
-const sha256 = (text) => `'sha256-${(0, node_crypto_1.createHash)('sha256').update(text).digest('base64')}'`;
 /**
- * The page's CSP: the one script and one style by hash, same-origin requests
- * only, no framing, no base rewrite, no form posts, no plugins.
+ * The page's CSP: the shell's style and the one script by hash, same-origin
+ * requests only, no framing, no base rewrite, no form posts, no plugins.
  */
-exports.APP_PASSKEY_CSP = [
-    "default-src 'none'",
-    `script-src ${sha256(PAGE_SCRIPT)}`,
-    `style-src ${sha256(PAGE_STYLE)}`,
-    "connect-src 'self'",
-    "base-uri 'none'",
-    "form-action 'none'",
-    "frame-ancestors 'none'",
-].join('; ');
-const escapeHtml = (text) => text.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+exports.APP_PASSKEY_CSP = (0, app_page_shell_js_1.appPageCsp)({ script: PAGE_SCRIPT });
 /** The page; `cancelHref` is the app callback carrying `error=cancelled`. */
 function appPasskeyPage(cancelHref) {
-    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="referrer" content="no-referrer"><title>Sign in with a passkey</title><style>${PAGE_STYLE}</style></head><body><h1>CamStack</h1><button id="go" type="button">Sign in with a passkey</button><p id="msg" role="alert"></p><a href="${escapeHtml(cancelHref)}">Cancel</a><noscript><p>JavaScript is required to use a passkey.</p></noscript><script>${PAGE_SCRIPT}</script></body></html>`;
+    return (0, app_page_shell_js_1.renderAppPage)({
+        title: 'Sign in with a passkey',
+        heading: 'Sign in to CamStack',
+        noReferrer: true,
+        script: PAGE_SCRIPT,
+        body: [
+            (0, app_page_shell_js_1.appParagraph)('Use a passkey saved on this device to sign in to the CamStack app.'),
+            (0, app_page_shell_js_1.appButton)('Sign in with a passkey', 'id="go"'),
+            (0, app_page_shell_js_1.appErrorLine)('msg'),
+            (0, app_page_shell_js_1.appCancelLink)(cancelHref, 'Cancel'),
+            '<noscript><p class="error">JavaScript is required to use a passkey.</p></noscript>',
+        ].join(''),
+    });
 }
 /** The page for a request the hub refuses to serve: a sentence, no script, no assets. */
 function appPasskeyRefusalPage(message) {
-    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sign-in request refused</title></head><body><h1>Sign-in request refused</h1><p>${escapeHtml(message)}</p><p>Close this window and try again from the app.</p></body></html>`;
+    return (0, app_page_shell_js_1.renderAppPage)({
+        title: 'Sign-in request refused',
+        heading: 'Sign-in request refused',
+        body: (0, app_page_shell_js_1.appParagraph)(message) + (0, app_page_shell_js_1.appHint)('Close this window and try again from the app.'),
+    });
 }
-/** CSP of the refusal page: nothing runs, nothing loads. */
-exports.APP_PASSKEY_REFUSAL_CSP = "default-src 'none'; frame-ancestors 'none'";
+/** CSP of the refusal page: the shell's style only, nothing runs. */
+exports.APP_PASSKEY_REFUSAL_CSP = (0, app_page_shell_js_1.appPageCsp)();

package/dist/auth/app-refused-route.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APP_REFUSED_CSP = void 0;
+exports.appRefusedPage = appRefusedPage;
+exports.registerAppRefusedRoute = registerAppRefusedRoute;
+/**
+ * `GET /auth/app/refused?reason=<code>` - the page that says why a native app
+ * sign-in could not start (D858).
+ *
+ * The OIDC start lives in an addon, which cannot reach the hub's theme; it
+ * redirects here with a reason CODE and the hub renders the sentence in the
+ * same shell as every other app page. The query is never echoed: an unknown or
+ * absent code gets a generic sentence, a known one its fixed words.
+ */
+const types_1 = require("@camstack/types");
+const app_page_shell_js_1 = require("./app-page-shell.js");
+const GENERIC_REFUSAL = 'The sign-in request was refused.';
+/** The refusal page for `reason` (a known code, or anything: unknown renders the generic sentence). */
+function appRefusedPage(reason) {
+    const message = (0, types_1.isAppStartRefusal)(reason) ? types_1.APP_START_REFUSAL_MESSAGES[reason] : GENERIC_REFUSAL;
+    return (0, app_page_shell_js_1.renderAppPage)({
+        title: 'Sign-in request refused',
+        heading: 'Sign-in request refused',
+        body: (0, app_page_shell_js_1.appParagraph)(message) + (0, app_page_shell_js_1.appHint)('Close this window and try again from the app.'),
+    });
+}
+/** CSP of the refusal page: the shell's style only, nothing runs. */
+exports.APP_REFUSED_CSP = (0, app_page_shell_js_1.appPageCsp)();
+function registerAppRefusedRoute(fastify) {
+    fastify.get(types_1.APP_REFUSED_PATH, async (request, reply) => {
+        reply.header('Cache-Control', 'no-store');
+        reply.header('Referrer-Policy', 'no-referrer');
+        reply.header('Content-Security-Policy', exports.APP_REFUSED_CSP);
+        reply.type('text/html; charset=utf-8');
+        return reply.status(400).send(appRefusedPage(request.query['reason']));
+    });
+}

package/dist/boot/boot-config.js

@@ -56,8 +56,9 @@ const CONFIG_DEFAULTS = {
 };
 /**
  * Bootstrap env overrides. No SECRET is among them (D783, D797): the session
- * signing key and the cluster secret live in the keychain, and the first-boot
- * admin is fixed (`admin` / `changeme`).
+ * signing key lives in the keychain, the first-boot admin is fixed
+ * (`admin` / `changeme`), and there is no cluster secret at all (D857 — a
+ * node's identity is its mesh certificate).
  */
 const ENV_VAR_MAP = {
     CAMSTACK_PORT: 'server.port',
@@ -66,7 +67,8 @@ const ENV_VAR_MAP = {
     CAMSTACK_TLS_ENABLED: 'tls.enabled',
 };
 /**
- * Env variables that once carried a secret into the hub. Ignored since D797 —
+ * Env variables that once carried a secret into the hub. Ignored since D797
+ * (`CAMSTACK_CLUSTER_SECRET`: the secret itself was removed by D857) —
  * still named so a container template that sets them is told, not silently
  * obeyed or silently dropped. Only their PRESENCE is read, never the value.
  */
@@ -194,8 +196,8 @@ function loadBootstrapConfig(configPath) {
     const retired = retiredSecretSources(process.env, raw);
     if (retired.length > 0) {
         console.warn(`[Phase1] WARN ${retired.join(', ')} ignored — no secret is read from the environment or ` +
-            'config.yaml any more (D797). The session signing key and the cluster secret live in the ' +
-            'keychain (System → Cluster for the cluster secret); a fresh hub seeds admin / changeme. ' +
+            'config.yaml any more (D797). The session signing key lives in the ' +
+            'keychain; a fresh hub seeds admin / changeme. ' +
             'Remove these entries — after importing their values with scripts/ops/keychain-migrate-hub.mjs.');
     }
     const ignored = ignoredTlsCertSources(process.env, raw);

package/dist/core/agent/agent-registry.service.js

@@ -469,16 +469,6 @@ class AgentRegistryService {
         this.moleculer.setOnAgentRegistered((agentId) => {
             void this.reconcileAgentAddons(agentId, 'node-registration');
         });
-        // D802: the mesh `transition` ends only once every agent this hub has
-        // EVER seen has authenticated — offline ones included. `null` (store not
-        // wired or not answering) never counts as "no agents".
-        this.moleculer.setKnownAgentsProvider(async () => {
-            const store = this.historyStore;
-            if (!store)
-                return null;
-            const rows = await store.tryGetAll();
-            return rows === null ? null : rows.filter((r) => !r.isHub).map((r) => r.id);
-        });
         this.broker.localBus.on('$node.connected', ({ node }) => {
             const kind = classifyNode(node.id);
             if (!kind)

package/dist/core/moleculer/hub-mesh-guard.js

@@ -2,132 +2,61 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HubMeshGuard = void 0;
 /**
- * The hub's mesh guard (D802) — one object owning everything that decides
- * whether another node may talk to the hub:
+ * The hub's mesh guard (D802, D857) — the one object that decides whether
+ * another node may talk to the hub.
  *
- *  - the {@link MeshAuthenticator} (who proved what, on which connection);
- *  - the broker middleware built on it (installed at broker construction);
- *  - the System → Cluster status slot;
- *  - the automatic end of `transition` ({@link decideMeshAutoEnforce}), checked
- *    after every successful join and once a minute.
+ * A node is admitted by its CERTIFICATE: the mutual-TLS handshake chained to
+ * the mesh CA, the leaf CN is the node id it speaks as, and the serial is not
+ * revoked. The transport answers that (`TlsTcpTransporter.verifiedPeer`,
+ * published through the process peer lookup); this class turns the answer
+ * into the broker middleware and says, once per node and minute, who was
+ * turned away and why. There is no shared secret, no mode and no transition.
  *
  * Kept out of `moleculer.service.ts` so that file only wires it.
  */
 const system_1 = require("@camstack/system");
-const types_1 = require("@camstack/types");
-/** How often `transition` is re-checked when nothing joins. */
-const AUTO_ENFORCE_INTERVAL_MS = 60_000;
+/** At most one "refused" line per node per this long. */
+const REFUSED_LOG_INTERVAL_MS = 60_000;
 class HubMeshGuard {
     ownNodeId;
     logger;
-    authenticator;
-    startedAt = Date.now();
-    knownAgents = null;
-    listConnected = () => [];
-    timer = null;
-    evaluating = false;
-    lastWaitingFor = '';
-    constructor(ownNodeId, logger) {
+    now;
+    gate;
+    lastLoggedAt = new Map();
+    constructor(ownNodeId, logger, now = Date.now, isVerifiedPeer = system_1.isProcessVerifiedMeshPeer) {
         this.ownNodeId = ownNodeId;
         this.logger = logger;
-        this.authenticator = new system_1.MeshAuthenticator({
+        this.now = now;
+        this.gate = new system_1.MeshIdentityGate({
             ownNodeId,
-            gate: system_1.getProcessClusterSecretGate,
-            mode: system_1.getProcessMeshAuthMode,
-            isVerifiedPeer: system_1.isProcessVerifiedMeshPeer,
-            onAuthenticated: (nodeId) => {
-                this.logger.info('node authenticated to the mesh (challenge–response)', {
-                    meta: { nodeId },
-                });
-                void this.evaluateAutoEnforce();
-            },
-            onTolerated: (nodeId, action) => {
-                this.logger.warn('node is calling the hub WITHOUT having authenticated — tolerated while System → ' +
-                    'Cluster is in Transition. Enter the cluster secret in this agent.', { meta: { nodeId, firstCall: action } });
-            },
+            isVerifiedPeer,
+            onRefused: (nodeId, what) => this.noteRefused(nodeId, what),
         });
-        (0, system_1.setProcessMeshAuthStatusSource)(() => this.authenticator.snapshot());
     }
     /** The middleware the hub broker must be constructed with. */
     middleware() {
         return (0, system_1.createMeshAccessMiddleware)({
             ownNodeId: this.ownNodeId,
-            authenticator: this.authenticator,
+            gate: this.gate,
             logger: {
                 warn: (message, meta) => this.logger.warn(message, meta ? { meta } : undefined),
             },
         });
     }
-    /** Start the periodic auto-enforce check; `listConnected` reads the live node list. */
-    start(listConnected) {
-        this.listConnected = listConnected;
-        if (this.timer !== null)
-            return;
-        this.timer = setInterval(() => void this.evaluateAutoEnforce(), AUTO_ENFORCE_INTERVAL_MS);
-        this.timer.unref?.();
-    }
-    /** Wired by `AgentRegistryService`, which owns the cluster-node history. */
-    setKnownAgentsProvider(provider) {
-        this.knownAgents = provider;
-    }
-    /** A node's connection dropped. */
+    /** A node's connection dropped: forget the throttle, not an identity (there is none to forget). */
     forget(nodeId) {
-        this.authenticator.forget(nodeId);
-    }
-    stop() {
-        if (this.timer !== null)
-            clearInterval(this.timer);
-        this.timer = null;
-        (0, system_1.setProcessMeshAuthStatusSource)(null);
+        this.lastLoggedAt.delete(nodeId);
     }
-    /** Public for the spec; the timer and every join call it. */
-    async evaluateAutoEnforce() {
-        if (this.evaluating || (0, system_1.getProcessMeshAuthMode)() !== 'transition')
+    noteRefused(nodeId, what) {
+        const at = this.now();
+        const last = this.lastLoggedAt.get(nodeId);
+        if (last !== undefined && at - last < REFUSED_LOG_INTERVAL_MS)
             return;
-        this.evaluating = true;
-        try {
-            let knownAgents = null;
-            if (this.knownAgents !== null) {
-                try {
-                    knownAgents = await this.knownAgents();
-                }
-                catch {
-                    knownAgents = null;
-                }
-            }
-            const decision = (0, system_1.decideMeshAutoEnforce)({
-                mode: (0, system_1.getProcessMeshAuthMode)(),
-                gate: (0, system_1.getProcessClusterSecretGate)().kind,
-                uptimeMs: Date.now() - this.startedAt,
-                knownAgents,
-                connected: this.listConnected(),
-                toleratedEver: this.authenticator.everToleratedNodeIds(),
-                authenticatedEver: this.authenticator.everAuthenticatedNodeIds(),
-                ownNodeId: this.ownNodeId,
-            });
-            if (!decision.enforce) {
-                const waiting = decision.waitingFor.join(',');
-                if (waiting.length > 0 && waiting !== this.lastWaitingFor) {
-                    this.logger.info('mesh transition: still waiting for agents to authenticate', {
-                        meta: { waitingFor: decision.waitingFor },
-                    });
-                }
-                this.lastWaitingFor = waiting;
-                return;
-            }
-            const done = await (0, system_1.requestProcessMeshEnforcement)(decision.reason);
-            if (done) {
-                this.logger.info('mesh authentication switched to ENFORCED', {
-                    meta: { reason: decision.reason },
-                });
-            }
-        }
-        catch (err) {
-            this.logger.warn('mesh auto-enforce check failed', { meta: { error: (0, types_1.errMsg)(err) } });
-        }
-        finally {
-            this.evaluating = false;
-        }
+        if (this.lastLoggedAt.size >= 256)
+            this.lastLoggedAt.clear();
+        this.lastLoggedAt.set(nodeId, at);
+        this.logger.warn('a node without a valid mesh certificate called the hub — refused. Pair it from ' +
+            'System → Cluster → Agents', { tags: { nodeId }, meta: { firstCall: what } });
     }
 }
 exports.HubMeshGuard = HubMeshGuard;

package/dist/core/moleculer/moleculer.service.js

@@ -26,9 +26,9 @@ class MoleculerService {
     }
     logger;
     /**
-     * D802 — who may talk to the hub over the mesh: the challenge–response join,
-     * the broker middleware that refuses / tolerates unauthenticated nodes and
-     * strips forged identities, and the automatic end of `transition`.
+     * D802, D857 — who may talk to the hub over the mesh: the broker middleware
+     * that admits a node by its CERTIFICATE (verified at the TLS handshake),
+     * refuses the rest and strips forged identities.
      */
     meshGuard;
     /**
@@ -191,15 +191,13 @@ class MoleculerService {
         // moleculer→eventemitter2 whose types are unresolvable at this
         // boundary, so the inference falls to `error` and trips
         // `no-unsafe-assignment`. Going via `unknown` documents the boundary.
-        // No cluster secret here (D797): the broker is created before the keychain
-        // can answer, and the Moleculer namespace was never authentication (TCP
-        // ignores it). The secret gates
-        // `$hub.registerNode`, read from the keychain at call time.
+        // No shared secret (D857): the Moleculer namespace was never authentication (TCP
+        // ignores it); a node is admitted by the certificate it presented at the TLS handshake.
         this.meshGuard = new hub_mesh_guard_js_1.HubMeshGuard('hub', this.logging.createLogger('mesh-auth'));
         const broker = (0, system_1.createBroker)({
             nodeID: 'hub',
             mode: 'hub',
-            // D802: every action and event another node sends passes the mesh gate.
+            // D802, D857: every action and event another node sends passes the certificate gate.
             middlewares: [this.meshGuard.middleware()],
             logLevel: this.config.get('moleculer.logLevel') ?? 'warn',
             ...(tcpPort && !Number.isNaN(tcpPort) ? { tcpPort } : {}),
@@ -224,23 +222,6 @@ class MoleculerService {
     setOnAgentRegistered(cb) {
         this.onAgentRegisteredCb = cb;
     }
-    /**
-     * D802: the cluster-node history, for the automatic end of the mesh
-     * `transition` — wired by `AgentRegistryService`, which owns the history.
-     */
-    setKnownAgentsProvider(provider) {
-        this.meshGuard.setKnownAgentsProvider(provider);
-    }
-    /** Every node Moleculer currently lists as available (this hub included). */
-    listAvailableNodeIds() {
-        const registry = this.broker.registry;
-        try {
-            return (registry?.getNodeList?.({ onlyAvailable: true }) ?? []).map((n) => n.id);
-        }
-        catch {
-            return [];
-        }
-    }
     async onModuleInit() {
         const logger = this.logging.createLogger('moleculer');
         const hubDeps = {
@@ -292,10 +273,8 @@ class MoleculerService {
             onUnregisterNode: (nodeId) => {
                 this.removeNodeFromRegistry(nodeId);
             },
-            // System → Cluster, from the keychain (D797): off / on / unknown.
-            clusterSecretGate: system_1.getProcessClusterSecretGate,
-            // D802: challenge–response join + who may register.
-            meshAuth: this.meshGuard.authenticator,
+            // D857: a node registers only itself, and only with a certificate identity.
+            meshIdentity: this.meshGuard.gate,
         };
         const hubService = (0, system_1.createHubService)(hubDeps);
         this.brokerSafe.createService(hubService);
@@ -639,7 +618,6 @@ class MoleculerService {
             // the incarnation) and this call is refused if the id has been reclaimed;
             // remote nodes register no owner at all, so they clean up as before.
             this.removeNodeFromRegistry(node.id);
-            // D802: a node authenticates again on its next connection.
             this.meshGuard.forget(node.id);
             // Release A: its next connection decides again whether it is `tls` or `clear`.
             (0, system_1.getBrokerTlsTransporter)(this.broker)?.forgetPeer(node.id);
@@ -717,7 +695,6 @@ class MoleculerService {
         });
         await this.brokerSafe.start();
         logger.info('Moleculer broker started (TCP transport)');
-        this.meshGuard.start(() => this.listAvailableNodeIds());
         // Construct the CapRouteResolver now that both the broker and
         // localChildRegistry are ready. The resolver reads live registry state
         // via closure accessors on every call (not a frozen snapshot), so new
@@ -1392,7 +1369,6 @@ class MoleculerService {
     async onModuleDestroy() {
         (0, system_1.setProcessMeshTlsEnabler)(null);
         (0, system_1.setProcessMeshPeerTransportLookup)(null);
-        this.meshGuard.stop();
         if (this.agentReadinessPullTimer !== null) {
             clearInterval(this.agentReadinessPullTimer);
             this.agentReadinessPullTimer = null;