@camstack/server 1.2.578 → 1.2.580

package/dist/auth/app-passkey-page.js

@@ -19,13 +19,15 @@ exports.appPasskeyRefusalPage = appPasskeyRefusalPage;
  * specific is ever placed in the script; the only server-rendered value is the
  * (allow-listed, HTML-escaped) cancel link.
  */
-const node_crypto_1 = require("node:crypto");
+const app_page_shell_js_1 = require("./app-page-shell.js");
+const app_page_strings_js_1 = require("./app-page-strings.js");
 const PAGE_SCRIPT = `(function () {
   var q = new URLSearchParams(location.search);
   var base = location.pathname.replace(/\\/+$/, '');
   var btn = document.getElementById('go');
   var msg = document.getElementById('msg');
-  var KEYS = ['code_challenge', 'code_challenge_method', 'state', 'purpose', 'redirect'];
+  var S = function (k) { return document.body.getAttribute('data-s-' + k) || ''; };
+  var KEYS = ['code_challenge', 'code_challenge_method', 'state', 'purpose', 'redirect', 'lang'];
   var APP_CALLBACK = /^camstack(\\.dev)?:\\/\\/auth-callback(\\?|$)/;
   function fromB64u(s) {
     s = s.replace(/-/g, '+').replace(/_/g, '/');
@@ -58,10 +60,10 @@ const PAGE_SCRIPT = `(function () {
     btn.disabled = true;
     msg.textContent = '';
     if (!window.PublicKeyCredential || !navigator.credentials) {
-      return fail('This browser cannot use passkeys.');
+      return fail(S('passkey-unsupported'));
     }
     post('/begin', flow()).then(function (begin) {
-      if (!begin.ok) throw new Error(begin.body.error || 'Passkeys are not available.');
+      if (!begin.ok) throw new Error('unavailable');
       var opts = begin.body.optionsJSON;
       var pk = {
         challenge: fromB64u(opts.challenge),
@@ -98,38 +100,57 @@ const PAGE_SCRIPT = `(function () {
       }
       var target = done.body && done.body.location;
       if (typeof target !== 'string' || !APP_CALLBACK.test(target)) {
-        throw new Error((done.body && done.body.error) || 'Sign-in failed.');
+        throw new Error('failed');
       }
       location.assign(target);
     }).catch(function (e) {
-      fail(e && e.name === 'NotAllowedError' ? 'The passkey request was cancelled.' : 'Sign-in failed. Try again.');
+      fail(
+        e && e.name === 'NotAllowedError' ? S('passkey-cancelled')
+          : e && e.message === 'unavailable' ? S('passkey-unavailable')
+          : S('sign-in-failed')
+      );
     });
   }
   btn.addEventListener('click', go);
 })();`;
-const PAGE_STYLE = `body{font-family:system-ui,sans-serif;max-width:26rem;margin:4rem auto;padding:0 1rem;text-align:center}button{font:inherit;padding:.75rem 1.25rem;border-radius:.5rem;border:1px solid #888;cursor:pointer}p#msg{color:#b00020;min-height:1.5em}a{display:inline-block;margin-top:1rem}`;
-const sha256 = (text) => `'sha256-${(0, node_crypto_1.createHash)('sha256').update(text).digest('base64')}'`;
 /**
- * The page's CSP: the one script and one style by hash, same-origin requests
- * only, no framing, no base rewrite, no form posts, no plugins.
+ * The page's CSP: the shell's style and the one script by hash, same-origin
+ * requests only, no framing, no base rewrite, no form posts, no plugins.
  */
-exports.APP_PASSKEY_CSP = [
-    "default-src 'none'",
-    `script-src ${sha256(PAGE_SCRIPT)}`,
-    `style-src ${sha256(PAGE_STYLE)}`,
-    "connect-src 'self'",
-    "base-uri 'none'",
-    "form-action 'none'",
-    "frame-ancestors 'none'",
-].join('; ');
-const escapeHtml = (text) => text.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+exports.APP_PASSKEY_CSP = (0, app_page_shell_js_1.appPageCsp)({ script: PAGE_SCRIPT });
 /** The page; `cancelHref` is the app callback carrying `error=cancelled`. */
-function appPasskeyPage(cancelHref) {
-    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="referrer" content="no-referrer"><title>Sign in with a passkey</title><style>${PAGE_STYLE}</style></head><body><h1>CamStack</h1><button id="go" type="button">Sign in with a passkey</button><p id="msg" role="alert"></p><a href="${escapeHtml(cancelHref)}">Cancel</a><noscript><p>JavaScript is required to use a passkey.</p></noscript><script>${PAGE_SCRIPT}</script></body></html>`;
+function appPasskeyPage(cancelHref, lang) {
+    const t = (0, app_page_strings_js_1.appStrings)(lang);
+    return (0, app_page_shell_js_1.renderAppPage)({
+        lang,
+        title: t.passkey.title,
+        heading: t.passkey.heading,
+        noReferrer: true,
+        script: PAGE_SCRIPT,
+        scriptStrings: {
+            'passkey-unsupported': t.script.passkeyUnsupported,
+            'passkey-unavailable': t.script.passkeyUnavailable,
+            'passkey-cancelled': t.script.passkeyCancelled,
+            'sign-in-failed': t.script.signInFailed,
+        },
+        body: [
+            (0, app_page_shell_js_1.appParagraph)(t.passkey.body),
+            (0, app_page_shell_js_1.appButton)(t.passkey.button, 'id="go"'),
+            (0, app_page_shell_js_1.appErrorLine)('msg'),
+            (0, app_page_shell_js_1.appCancelLink)(cancelHref, t.passkey.cancel),
+            `<noscript><p class="error">${(0, app_page_shell_js_1.escapeHtml)(t.passkey.noscript)}</p></noscript>`,
+        ].join(''),
+    });
 }
 /** The page for a request the hub refuses to serve: a sentence, no script, no assets. */
-function appPasskeyRefusalPage(message) {
-    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sign-in request refused</title></head><body><h1>Sign-in request refused</h1><p>${escapeHtml(message)}</p><p>Close this window and try again from the app.</p></body></html>`;
+function appPasskeyRefusalPage(message, lang) {
+    const t = (0, app_page_strings_js_1.appStrings)(lang).refused;
+    return (0, app_page_shell_js_1.renderAppPage)({
+        lang,
+        title: t.title,
+        heading: t.title,
+        body: (0, app_page_shell_js_1.appParagraph)(message) + (0, app_page_shell_js_1.appHint)(t.hint),
+    });
 }
-/** CSP of the refusal page: nothing runs, nothing loads. */
-exports.APP_PASSKEY_REFUSAL_CSP = "default-src 'none'; frame-ancestors 'none'";
+/** CSP of the refusal page: the shell's style only, nothing runs. */
+exports.APP_PASSKEY_REFUSAL_CSP = (0, app_page_shell_js_1.appPageCsp)();

package/dist/auth/app-passkey-routes.js

@@ -22,6 +22,7 @@ const types_1 = require("@camstack/types");
 const zod_1 = require("zod");
 const app_confirm_routes_js_1 = require("./app-confirm-routes.js");
 const app_passkey_page_js_1 = require("./app-passkey-page.js");
+const app_page_strings_js_1 = require("./app-page-strings.js");
 const auth_rate_limit_js_1 = require("./auth-rate-limit.js");
 const session_mint_js_1 = require("./session-mint.js");
 exports.APP_PASSKEY_PATH = '/auth/app/passkey';
@@ -32,6 +33,7 @@ const FinishBodySchema = zod_1.z.object({
     state: zod_1.z.string().optional(),
     purpose: zod_1.z.string().optional(),
     redirect: zod_1.z.string().optional(),
+    lang: zod_1.z.string().optional(),
 });
 function noStore(reply) {
     reply.header('Cache-Control', 'no-store');
@@ -53,6 +55,10 @@ function registerAppPasskeyRoutes(fastify, deps) {
         noStore(reply);
         reply.type('text/html; charset=utf-8');
         const parsed = (0, types_1.parseAppFlowRequest)(request.query);
+        const lang = (0, app_page_strings_js_1.resolveAppPageLang)({
+            lang: parsed.ok ? parsed.request.lang : request.query['lang'],
+            acceptLanguage: request.headers['accept-language'],
+        });
         if (!parsed.ok) {
             deps.logger.warn('Passkey app sign-in refused at the page', {
                 meta: { reason: parsed.reason },
@@ -60,11 +66,11 @@ function registerAppPasskeyRoutes(fastify, deps) {
             reply.header('Content-Security-Policy', app_passkey_page_js_1.APP_PASSKEY_REFUSAL_CSP);
             return reply
                 .status(400)
-                .send((0, app_passkey_page_js_1.appPasskeyRefusalPage)(types_1.APP_FLOW_REFUSAL_MESSAGES[parsed.reason]));
+                .send((0, app_passkey_page_js_1.appPasskeyRefusalPage)((0, app_page_strings_js_1.appStrings)(lang).refused.reasons[parsed.reason], lang));
         }
         reply.header('Content-Security-Policy', app_passkey_page_js_1.APP_PASSKEY_CSP);
         const cancel = (0, types_1.appFlowLocation)(parsed.request.redirect, { error: 'cancelled' }, parsed.request.state);
-        return reply.send((0, app_passkey_page_js_1.appPasskeyPage)(cancel));
+        return reply.send((0, app_passkey_page_js_1.appPasskeyPage)(cancel, lang));
     });
     fastify.post(`${exports.APP_PASSKEY_PATH}/begin`, async (request, reply) => {
         noStore(reply);
@@ -103,6 +109,7 @@ function registerAppPasskeyRoutes(fastify, deps) {
             state: body.data.state,
             purpose: body.data.purpose,
             redirect: body.data.redirect,
+            lang: body.data.lang,
         });
         if (!parsed.ok)
             return reply.status(400).send({ error: types_1.APP_FLOW_REFUSAL_MESSAGES[parsed.reason] });

package/dist/auth/app-refused-route.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APP_REFUSED_CSP = void 0;
+exports.appRefusedPage = appRefusedPage;
+exports.registerAppRefusedRoute = registerAppRefusedRoute;
+/**
+ * `GET /auth/app/refused?reason=<code>` - the page that says why a native app
+ * sign-in could not start (D858).
+ *
+ * The OIDC start lives in an addon, which cannot reach the hub's theme; it
+ * redirects here with a reason CODE (and the app's optional `lang`) and the hub renders the
+ * sentence, in the language of `lang`/`Accept-Language`, in the same shell as every other app page. The query is never echoed: an unknown or
+ * absent code gets a generic sentence, a known one its fixed words.
+ */
+const types_1 = require("@camstack/types");
+const app_page_shell_js_1 = require("./app-page-shell.js");
+const app_page_strings_js_1 = require("./app-page-strings.js");
+/** The refusal page for `reason` (a known code, or anything: unknown renders the generic sentence). */
+function appRefusedPage(reason, lang) {
+    const t = (0, app_page_strings_js_1.appStrings)(lang).refused;
+    const message = (0, types_1.isAppStartRefusal)(reason) ? t.reasons[reason] : t.generic;
+    return (0, app_page_shell_js_1.renderAppPage)({
+        lang,
+        title: t.title,
+        heading: t.title,
+        body: (0, app_page_shell_js_1.appParagraph)(message) + (0, app_page_shell_js_1.appHint)(t.hint),
+    });
+}
+/** CSP of the refusal page: the shell's style only, nothing runs. */
+exports.APP_REFUSED_CSP = (0, app_page_shell_js_1.appPageCsp)();
+function registerAppRefusedRoute(fastify) {
+    fastify.get(types_1.APP_REFUSED_PATH, async (request, reply) => {
+        reply.header('Cache-Control', 'no-store');
+        reply.header('Referrer-Policy', 'no-referrer');
+        reply.header('Content-Security-Policy', exports.APP_REFUSED_CSP);
+        reply.type('text/html; charset=utf-8');
+        const lang = (0, app_page_strings_js_1.resolveAppPageLang)({
+            lang: request.query['lang'],
+            acceptLanguage: request.headers['accept-language'],
+        });
+        return reply.status(400).send(appRefusedPage(request.query['reason'], lang));
+    });
+}

package/dist/auth/session-connections.js

@@ -0,0 +1,136 @@
+"use strict";
+/**
+ * What a login session still HOLDS on the hub — its open WebSockets and its
+ * live media sessions — so that revoking the session ends them.
+ *
+ * A revoked `sid` is refused on the NEXT call (`ctx.sessionLive`), which is not
+ * the same as ending anything: the socket stayed open, the client kept polling
+ * as an anonymous principal and its stream kept playing until the app was
+ * killed (2026-10-16, "Sign out all my sessions"). The login-session table
+ * announces every revocation (`onSessionsRevoked`); this registry turns that
+ * into closed sockets and closed media, touching ONLY the sessions named.
+ *
+ * - A socket closes with {@link SESSION_ENDED_CLOSE_CODE} / {@link SESSION_ENDED_CLOSE_REASON}
+ *   so the client can tell "your session ended" from a network drop.
+ * - A media hold is whatever the creating call registered as its way to end
+ *   the session (the WebRTC `closeSession`); recorded playback rides the same
+ *   cap, so the same hold covers it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionConnections = exports.SESSION_ENDED_CLOSE_REASON = exports.SESSION_ENDED_CLOSE_CODE = void 0;
+exports.getSessionConnections = getSessionConnections;
+exports.__resetSessionConnectionsForTests = __resetSessionConnectionsForTests;
+/** WebSocket close code a client recognises as "the hub ended this session". */
+exports.SESSION_ENDED_CLOSE_CODE = 4401;
+exports.SESSION_ENDED_CLOSE_REASON = 'session-ended';
+/** Bound on live media holds kept per login session (oldest dropped past it). */
+const MAX_MEDIA_HOLDS_PER_SESSION = 256;
+class SessionConnections {
+    sockets = new Set();
+    media = new Map();
+    logger = null;
+    setLogger(logger) {
+        this.logger = logger;
+    }
+    /** Track an authenticated socket; returns the untrack (call on socket close). */
+    trackSocket(socket, identity) {
+        const tracked = { socket, identity };
+        this.sockets.add(tracked);
+        return () => {
+            this.sockets.delete(tracked);
+        };
+    }
+    /** Track a live media session opened under `sessionId`; returns the untrack. */
+    trackMedia(sessionId, hold) {
+        const holds = this.media.get(sessionId) ?? new Map();
+        holds.set(hold.mediaSessionId, hold);
+        if (holds.size > MAX_MEDIA_HOLDS_PER_SESSION) {
+            const oldest = holds.keys().next();
+            if (!oldest.done)
+                holds.delete(oldest.value);
+        }
+        this.media.set(sessionId, holds);
+        return () => {
+            const current = this.media.get(sessionId);
+            current?.delete(hold.mediaSessionId);
+            if (current?.size === 0)
+                this.media.delete(sessionId);
+        };
+    }
+    /** A media session the client closed itself: nothing left to end. */
+    forgetMedia(sessionId, mediaSessionId) {
+        const current = this.media.get(sessionId);
+        current?.delete(mediaSessionId);
+        if (current?.size === 0)
+            this.media.delete(sessionId);
+    }
+    /** End what the revoked sessions hold. Sessions not named are never touched. */
+    endSessions(input) {
+        const named = new Set(input.sessionIds);
+        let sockets = 0;
+        for (const tracked of [...this.sockets]) {
+            const { sessionId, userId } = tracked.identity;
+            const hit = sessionId !== undefined
+                ? named.has(sessionId)
+                : input.allOfUser && input.userId !== null && userId === input.userId;
+            if (!hit)
+                continue;
+            this.sockets.delete(tracked);
+            try {
+                tracked.socket.close(exports.SESSION_ENDED_CLOSE_CODE, exports.SESSION_ENDED_CLOSE_REASON);
+                sockets += 1;
+            }
+            catch (error) {
+                this.logger?.warn('Closing a socket of an ended session failed', {
+                    meta: { error: error instanceof Error ? error.message : String(error) },
+                });
+            }
+        }
+        let mediaSessions = 0;
+        for (const sessionId of named) {
+            const holds = this.media.get(sessionId);
+            if (holds === undefined)
+                continue;
+            this.media.delete(sessionId);
+            for (const hold of holds.values()) {
+                mediaSessions += 1;
+                void this.closeMedia(hold, input.reason);
+            }
+        }
+        if (sockets > 0 || mediaSessions > 0) {
+            this.logger?.info('Revoked sessions ended their connections', {
+                meta: { reason: input.reason, sessions: input.sessionIds.length, sockets, mediaSessions },
+            });
+        }
+        return { sockets, mediaSessions };
+    }
+    async closeMedia(hold, reason) {
+        try {
+            await hold.close();
+            this.logger?.info('Media session closed by session revocation', {
+                tags: { deviceId: hold.deviceId },
+                meta: { mediaSessionId: hold.mediaSessionId, reason },
+            });
+        }
+        catch (error) {
+            this.logger?.warn('Closing a media session of an ended session failed', {
+                tags: { deviceId: hold.deviceId },
+                meta: {
+                    mediaSessionId: hold.mediaSessionId,
+                    error: error instanceof Error ? error.message : String(error),
+                },
+            });
+        }
+    }
+}
+exports.SessionConnections = SessionConnections;
+let instance = null;
+/** The process-wide registry (the WS factory, the WebRTC wrapper and the revoke listener share it). */
+function getSessionConnections() {
+    instance ??= new SessionConnections();
+    return instance;
+}
+/** Test-only. */
+function __resetSessionConnectionsForTests() {
+    instance = null;
+}

package/dist/auth/sso-finish-app.js

@@ -82,7 +82,13 @@ async function finishSsoApp(bridge, deps) {
         const parked = deps.confirmations.create({
             userId: record.id,
             username: record.username,
-            app: { codeChallenge: app.codeChallenge, state: app.state, purpose: app.purpose, redirect },
+            app: {
+                codeChallenge: app.codeChallenge,
+                state: app.state,
+                purpose: app.purpose,
+                redirect,
+                ...(app.lang !== undefined ? { lang: app.lang } : {}),
+            },
             authMethod: 'sso',
         });
         return { kind: 'confirm', ...parked };

package/dist/boot/boot-config.js

@@ -56,8 +56,9 @@ const CONFIG_DEFAULTS = {
 };
 /**
  * Bootstrap env overrides. No SECRET is among them (D783, D797): the session
- * signing key and the cluster secret live in the keychain, and the first-boot
- * admin is fixed (`admin` / `changeme`).
+ * signing key lives in the keychain, the first-boot admin is fixed
+ * (`admin` / `changeme`), and there is no cluster secret at all (D857 — a
+ * node's identity is its mesh certificate).
  */
 const ENV_VAR_MAP = {
     CAMSTACK_PORT: 'server.port',
@@ -66,7 +67,8 @@ const ENV_VAR_MAP = {
     CAMSTACK_TLS_ENABLED: 'tls.enabled',
 };
 /**
- * Env variables that once carried a secret into the hub. Ignored since D797 —
+ * Env variables that once carried a secret into the hub. Ignored since D797
+ * (`CAMSTACK_CLUSTER_SECRET`: the secret itself was removed by D857) —
  * still named so a container template that sets them is told, not silently
  * obeyed or silently dropped. Only their PRESENCE is read, never the value.
  */
@@ -194,8 +196,8 @@ function loadBootstrapConfig(configPath) {
     const retired = retiredSecretSources(process.env, raw);
     if (retired.length > 0) {
         console.warn(`[Phase1] WARN ${retired.join(', ')} ignored — no secret is read from the environment or ` +
-            'config.yaml any more (D797). The session signing key and the cluster secret live in the ' +
-            'keychain (System → Cluster for the cluster secret); a fresh hub seeds admin / changeme. ' +
+            'config.yaml any more (D797). The session signing key lives in the ' +
+            'keychain; a fresh hub seeds admin / changeme. ' +
             'Remove these entries — after importing their values with scripts/ops/keychain-migrate-hub.mjs.');
     }
     const ignored = ignoredTlsCertSources(process.env, raw);

package/dist/core/agent/agent-registry.service.js

@@ -469,16 +469,6 @@ class AgentRegistryService {
         this.moleculer.setOnAgentRegistered((agentId) => {
             void this.reconcileAgentAddons(agentId, 'node-registration');
         });
-        // D802: the mesh `transition` ends only once every agent this hub has
-        // EVER seen has authenticated — offline ones included. `null` (store not
-        // wired or not answering) never counts as "no agents".
-        this.moleculer.setKnownAgentsProvider(async () => {
-            const store = this.historyStore;
-            if (!store)
-                return null;
-            const rows = await store.tryGetAll();
-            return rows === null ? null : rows.filter((r) => !r.isHub).map((r) => r.id);
-        });
         this.broker.localBus.on('$node.connected', ({ node }) => {
             const kind = classifyNode(node.id);
             if (!kind)

package/dist/core/moleculer/hub-mesh-guard.js

@@ -2,132 +2,61 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HubMeshGuard = void 0;
 /**
- * The hub's mesh guard (D802) — one object owning everything that decides
- * whether another node may talk to the hub:
+ * The hub's mesh guard (D802, D857) — the one object that decides whether
+ * another node may talk to the hub.
  *
- *  - the {@link MeshAuthenticator} (who proved what, on which connection);
- *  - the broker middleware built on it (installed at broker construction);
- *  - the System → Cluster status slot;
- *  - the automatic end of `transition` ({@link decideMeshAutoEnforce}), checked
- *    after every successful join and once a minute.
+ * A node is admitted by its CERTIFICATE: the mutual-TLS handshake chained to
+ * the mesh CA, the leaf CN is the node id it speaks as, and the serial is not
+ * revoked. The transport answers that (`TlsTcpTransporter.verifiedPeer`,
+ * published through the process peer lookup); this class turns the answer
+ * into the broker middleware and says, once per node and minute, who was
+ * turned away and why. There is no shared secret, no mode and no transition.
  *
  * Kept out of `moleculer.service.ts` so that file only wires it.
  */
 const system_1 = require("@camstack/system");
-const types_1 = require("@camstack/types");
-/** How often `transition` is re-checked when nothing joins. */
-const AUTO_ENFORCE_INTERVAL_MS = 60_000;
+/** At most one "refused" line per node per this long. */
+const REFUSED_LOG_INTERVAL_MS = 60_000;
 class HubMeshGuard {
     ownNodeId;
     logger;
-    authenticator;
-    startedAt = Date.now();
-    knownAgents = null;
-    listConnected = () => [];
-    timer = null;
-    evaluating = false;
-    lastWaitingFor = '';
-    constructor(ownNodeId, logger) {
+    now;
+    gate;
+    lastLoggedAt = new Map();
+    constructor(ownNodeId, logger, now = Date.now, isVerifiedPeer = system_1.isProcessVerifiedMeshPeer) {
         this.ownNodeId = ownNodeId;
         this.logger = logger;
-        this.authenticator = new system_1.MeshAuthenticator({
+        this.now = now;
+        this.gate = new system_1.MeshIdentityGate({
             ownNodeId,
-            gate: system_1.getProcessClusterSecretGate,
-            mode: system_1.getProcessMeshAuthMode,
-            isVerifiedPeer: system_1.isProcessVerifiedMeshPeer,
-            onAuthenticated: (nodeId) => {
-                this.logger.info('node authenticated to the mesh (challenge–response)', {
-                    meta: { nodeId },
-                });
-                void this.evaluateAutoEnforce();
-            },
-            onTolerated: (nodeId, action) => {
-                this.logger.warn('node is calling the hub WITHOUT having authenticated — tolerated while System → ' +
-                    'Cluster is in Transition. Enter the cluster secret in this agent.', { meta: { nodeId, firstCall: action } });
-            },
+            isVerifiedPeer,
+            onRefused: (nodeId, what) => this.noteRefused(nodeId, what),
         });
-        (0, system_1.setProcessMeshAuthStatusSource)(() => this.authenticator.snapshot());
     }
     /** The middleware the hub broker must be constructed with. */
     middleware() {
         return (0, system_1.createMeshAccessMiddleware)({
             ownNodeId: this.ownNodeId,
-            authenticator: this.authenticator,
+            gate: this.gate,
             logger: {
                 warn: (message, meta) => this.logger.warn(message, meta ? { meta } : undefined),
             },
         });
     }
-    /** Start the periodic auto-enforce check; `listConnected` reads the live node list. */
-    start(listConnected) {
-        this.listConnected = listConnected;
-        if (this.timer !== null)
-            return;
-        this.timer = setInterval(() => void this.evaluateAutoEnforce(), AUTO_ENFORCE_INTERVAL_MS);
-        this.timer.unref?.();
-    }
-    /** Wired by `AgentRegistryService`, which owns the cluster-node history. */
-    setKnownAgentsProvider(provider) {
-        this.knownAgents = provider;
-    }
-    /** A node's connection dropped. */
+    /** A node's connection dropped: forget the throttle, not an identity (there is none to forget). */
     forget(nodeId) {
-        this.authenticator.forget(nodeId);
-    }
-    stop() {
-        if (this.timer !== null)
-            clearInterval(this.timer);
-        this.timer = null;
-        (0, system_1.setProcessMeshAuthStatusSource)(null);
+        this.lastLoggedAt.delete(nodeId);
     }
-    /** Public for the spec; the timer and every join call it. */
-    async evaluateAutoEnforce() {
-        if (this.evaluating || (0, system_1.getProcessMeshAuthMode)() !== 'transition')
+    noteRefused(nodeId, what) {
+        const at = this.now();
+        const last = this.lastLoggedAt.get(nodeId);
+        if (last !== undefined && at - last < REFUSED_LOG_INTERVAL_MS)
             return;
-        this.evaluating = true;
-        try {
-            let knownAgents = null;
-            if (this.knownAgents !== null) {
-                try {
-                    knownAgents = await this.knownAgents();
-                }
-                catch {
-                    knownAgents = null;
-                }
-            }
-            const decision = (0, system_1.decideMeshAutoEnforce)({
-                mode: (0, system_1.getProcessMeshAuthMode)(),
-                gate: (0, system_1.getProcessClusterSecretGate)().kind,
-                uptimeMs: Date.now() - this.startedAt,
-                knownAgents,
-                connected: this.listConnected(),
-                toleratedEver: this.authenticator.everToleratedNodeIds(),
-                authenticatedEver: this.authenticator.everAuthenticatedNodeIds(),
-                ownNodeId: this.ownNodeId,
-            });
-            if (!decision.enforce) {
-                const waiting = decision.waitingFor.join(',');
-                if (waiting.length > 0 && waiting !== this.lastWaitingFor) {
-                    this.logger.info('mesh transition: still waiting for agents to authenticate', {
-                        meta: { waitingFor: decision.waitingFor },
-                    });
-                }
-                this.lastWaitingFor = waiting;
-                return;
-            }
-            const done = await (0, system_1.requestProcessMeshEnforcement)(decision.reason);
-            if (done) {
-                this.logger.info('mesh authentication switched to ENFORCED', {
-                    meta: { reason: decision.reason },
-                });
-            }
-        }
-        catch (err) {
-            this.logger.warn('mesh auto-enforce check failed', { meta: { error: (0, types_1.errMsg)(err) } });
-        }
-        finally {
-            this.evaluating = false;
-        }
+        if (this.lastLoggedAt.size >= 256)
+            this.lastLoggedAt.clear();
+        this.lastLoggedAt.set(nodeId, at);
+        this.logger.warn('a node without a valid mesh certificate called the hub — refused. Pair it from ' +
+            'System → Cluster → Agents', { tags: { nodeId }, meta: { firstCall: what } });
     }
 }
 exports.HubMeshGuard = HubMeshGuard;