@camstack/server 1.2.578 → 1.2.580

package/dist/core/moleculer/moleculer.service.js

@@ -26,9 +26,9 @@ class MoleculerService {
     }
     logger;
     /**
-     * D802 — who may talk to the hub over the mesh: the challenge–response join,
-     * the broker middleware that refuses / tolerates unauthenticated nodes and
-     * strips forged identities, and the automatic end of `transition`.
+     * D802, D857 — who may talk to the hub over the mesh: the broker middleware
+     * that admits a node by its CERTIFICATE (verified at the TLS handshake),
+     * refuses the rest and strips forged identities.
      */
     meshGuard;
     /**
@@ -191,15 +191,13 @@ class MoleculerService {
         // moleculer→eventemitter2 whose types are unresolvable at this
         // boundary, so the inference falls to `error` and trips
         // `no-unsafe-assignment`. Going via `unknown` documents the boundary.
-        // No cluster secret here (D797): the broker is created before the keychain
-        // can answer, and the Moleculer namespace was never authentication (TCP
-        // ignores it). The secret gates
-        // `$hub.registerNode`, read from the keychain at call time.
+        // No shared secret (D857): the Moleculer namespace was never authentication (TCP
+        // ignores it); a node is admitted by the certificate it presented at the TLS handshake.
         this.meshGuard = new hub_mesh_guard_js_1.HubMeshGuard('hub', this.logging.createLogger('mesh-auth'));
         const broker = (0, system_1.createBroker)({
             nodeID: 'hub',
             mode: 'hub',
-            // D802: every action and event another node sends passes the mesh gate.
+            // D802, D857: every action and event another node sends passes the certificate gate.
             middlewares: [this.meshGuard.middleware()],
             logLevel: this.config.get('moleculer.logLevel') ?? 'warn',
             ...(tcpPort && !Number.isNaN(tcpPort) ? { tcpPort } : {}),
@@ -224,23 +222,6 @@ class MoleculerService {
     setOnAgentRegistered(cb) {
         this.onAgentRegisteredCb = cb;
     }
-    /**
-     * D802: the cluster-node history, for the automatic end of the mesh
-     * `transition` — wired by `AgentRegistryService`, which owns the history.
-     */
-    setKnownAgentsProvider(provider) {
-        this.meshGuard.setKnownAgentsProvider(provider);
-    }
-    /** Every node Moleculer currently lists as available (this hub included). */
-    listAvailableNodeIds() {
-        const registry = this.broker.registry;
-        try {
-            return (registry?.getNodeList?.({ onlyAvailable: true }) ?? []).map((n) => n.id);
-        }
-        catch {
-            return [];
-        }
-    }
     async onModuleInit() {
         const logger = this.logging.createLogger('moleculer');
         const hubDeps = {
@@ -292,10 +273,8 @@ class MoleculerService {
             onUnregisterNode: (nodeId) => {
                 this.removeNodeFromRegistry(nodeId);
             },
-            // System → Cluster, from the keychain (D797): off / on / unknown.
-            clusterSecretGate: system_1.getProcessClusterSecretGate,
-            // D802: challenge–response join + who may register.
-            meshAuth: this.meshGuard.authenticator,
+            // D857: a node registers only itself, and only with a certificate identity.
+            meshIdentity: this.meshGuard.gate,
         };
         const hubService = (0, system_1.createHubService)(hubDeps);
         this.brokerSafe.createService(hubService);
@@ -639,7 +618,6 @@ class MoleculerService {
             // the incarnation) and this call is refused if the id has been reclaimed;
             // remote nodes register no owner at all, so they clean up as before.
             this.removeNodeFromRegistry(node.id);
-            // D802: a node authenticates again on its next connection.
             this.meshGuard.forget(node.id);
             // Release A: its next connection decides again whether it is `tls` or `clear`.
             (0, system_1.getBrokerTlsTransporter)(this.broker)?.forgetPeer(node.id);
@@ -717,7 +695,6 @@ class MoleculerService {
         });
         await this.brokerSafe.start();
         logger.info('Moleculer broker started (TCP transport)');
-        this.meshGuard.start(() => this.listAvailableNodeIds());
         // Construct the CapRouteResolver now that both the broker and
         // localChildRegistry are ready. The resolver reads live registry state
         // via closure accessors on every call (not a frozen snapshot), so new
@@ -1392,7 +1369,6 @@ class MoleculerService {
     async onModuleDestroy() {
         (0, system_1.setProcessMeshTlsEnabler)(null);
         (0, system_1.setProcessMeshPeerTransportLookup)(null);
-        this.meshGuard.stop();
         if (this.agentReadinessPullTimer !== null) {
             clearInterval(this.agentReadinessPullTimer);
             this.agentReadinessPullTimer = null;

package/dist/main.js

@@ -59,7 +59,6 @@ const ws_1 = require("@trpc/server/adapters/ws");
 const ws_2 = require("ws");
 const addon_upload_1 = require("./api/addon-upload");
 const auth_whoami_1 = require("./api/auth-whoami");
-const enroll_routes_js_1 = require("./api/mesh/enroll.routes.js");
 const backup_download_js_1 = require("./api/backup-download.js");
 const cap_providers_1 = require("./api/core/cap-providers");
 const logging_settings_1 = require("./api/core/logging-settings");
@@ -81,6 +80,7 @@ const core_cap_bridge_1 = require("./api/trpc/core-cap-bridge");
 const http_request_census_singleton_1 = require("./api/trpc/http-request-census.singleton");
 const http_request_census_hook_1 = require("./api/trpc/http-request-census-hook");
 const trpc_context_1 = require("./api/trpc/trpc.context");
+const session_connections_js_1 = require("./auth/session-connections.js");
 const trpc_router_1 = require("./api/trpc/trpc.router");
 const trpc_error_device_tags_1 = require("./api/trpc/trpc-error-device-tags");
 const trpc_error_principal_1 = require("./api/trpc/trpc-error-principal");
@@ -99,6 +99,7 @@ const sso_finish_deps_js_1 = require("./auth/sso-finish-deps.js");
 const app_confirmations_js_1 = require("./auth/app-confirmations.js");
 const app_confirm_routes_js_1 = require("./auth/app-confirm-routes.js");
 const app_passkey_routes_js_1 = require("./auth/app-passkey-routes.js");
+const app_refused_route_js_1 = require("./auth/app-refused-route.js");
 const passkey_provider_js_1 = require("./auth/passkey-provider.js");
 const second_factors_js_1 = require("./auth/second-factors.js");
 const sso_routes_js_1 = require("./auth/sso-routes.js");
@@ -474,7 +475,6 @@ async function bootstrap() {
         // Mirrors the addon-upload auth chain so the CLI can ping for
         // token-still-valid without consuming a real cap.
         await (0, auth_whoami_1.registerAuthWhoamiRoute)(fastify, uploadAuthService, uploadAddonRegistry);
-        (0, enroll_routes_js_1.registerMeshEnrollRoute)(fastify);
         console.log('[bootstrap] Auth whoami route registered at GET /api/auth/whoami');
     }
     catch (err) {
@@ -981,6 +981,7 @@ async function bootstrap() {
             limiter: authRouteLimiter,
             logger: app.get(logging_service_1.LoggingService).createLogger('app-passkey'),
         });
+        (0, app_refused_route_js_1.registerAppRefusedRoute)(fastify);
         // The last step of both app flows: "Sign in the app as <user>?" - the
         // handoff code is minted only when the person presses Continue (D858).
         (0, app_confirm_routes_js_1.registerAppConfirmRoutes)(fastify, {
@@ -1356,6 +1357,19 @@ async function bootstrap() {
             (0, ws_request_census_1.attachWsCensusSession)(httpRequestCensus, client, req, app.get(logging_service_1.LoggingService).createLogger('tRPC:ws'));
             wsSlowConsumerGuard.attach(client, (0, ws_slow_consumer_guard_js_1.wsConnectionFacts)(req));
         });
+        // Revoking a login session ends what it holds: its sockets (close 4401
+        // `session-ended`) and its live media. See `auth/session-connections.ts`.
+        const sessionConnections = (0, session_connections_js_1.getSessionConnections)();
+        sessionConnections.setLogger(app.get(logging_service_1.LoggingService).createLogger('session-revocation'));
+        (0, system_1.onSessionsRevoked)((event) => {
+            sessionConnections.endSessions({
+                sessionIds: event.sessionIds,
+                userId: event.userId,
+                allOfUser: event.allOfUser,
+                exceptSessionId: event.exceptSessionId,
+                reason: event.reason,
+            });
+        });
         (0, ws_1.applyWSSHandler)({
             wss,
             router: appRouter,
@@ -1376,6 +1390,23 @@ async function bootstrap() {
                 const principal = (0, trpc_error_principal_1.describeTrpcPrincipal)(wsCtx.user);
                 (0, ws_request_census_1.identifyWsCensusSession)(opts.res, principal);
                 wsSlowConsumerGuard.identify(opts.res, principal);
+                const connectionLogger = app.get(logging_service_1.LoggingService).createLogger('tRPC:ws');
+                if (wsCtx.credentialRejected === true) {
+                    // A bearer that resolves to nobody (revoked, expired): say so with
+                    // the close code the client recognises, instead of leaving an
+                    // anonymous socket open for the client to poll.
+                    connectionLogger.info('Closing a socket whose credential was refused', {
+                        meta: { principal, code: session_connections_js_1.SESSION_ENDED_CLOSE_CODE },
+                    });
+                    opts.res.close(session_connections_js_1.SESSION_ENDED_CLOSE_CODE, session_connections_js_1.SESSION_ENDED_CLOSE_REASON);
+                }
+                else if (wsCtx.user !== null) {
+                    const untrack = sessionConnections.trackSocket(opts.res, {
+                        userId: wsCtx.user.id,
+                        sessionId: wsCtx.user.sessionId,
+                    });
+                    opts.res.once('close', untrack);
+                }
                 return wsCtx;
             },
             onError: ({ path: trpcPath, error, ctx, input, }) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.578",
+  "version": "1.2.580",
   "license": "MIT",
   "private": false,
   "files": [
@@ -38,19 +38,19 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.426",
-    "@camstack/addon-agent-ui": "1.2.233",
-    "@camstack/addon-auth": "1.2.145",
+    "@camstack/addon-admin-ui": "1.2.428",
+    "@camstack/addon-agent-ui": "1.2.235",
+    "@camstack/addon-auth": "1.2.147",
     "@camstack/addon-decoder-nodeav": "1.2.123",
     "@camstack/addon-notifiers": "1.2.134",
-    "@camstack/addon-pipeline": "1.2.369",
+    "@camstack/addon-pipeline": "1.2.370",
     "@camstack/addon-pipeline-orchestrator": "1.2.323",
     "@camstack/addon-post-analysis": "1.2.369",
-    "@camstack/develop": "0.1.10",
+    "@camstack/develop": "0.1.11",
     "@camstack/sdk": "1.2.131",
-    "@camstack/system": "1.2.435",
-    "@camstack/types": "1.2.371",
-    "@camstack/ui-library": "1.2.289",
+    "@camstack/system": "1.2.437",
+    "@camstack/types": "1.2.373",
+    "@camstack/ui-library": "1.2.291",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",

package/dist/agent/agent-mesh-enroll.js

@@ -1,317 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MeshEnrollError = void 0;
-exports.decodeJoinTokenClaims = decodeJoinTokenClaims;
-exports.hubHostFromMeshAddress = hubHostFromMeshAddress;
-exports.enrollAgentMesh = enrollAgentMesh;
-exports.readJsonFile = readJsonFile;
-exports.writeJsonFile0600 = writeJsonFile0600;
-exports.persistEnrollment = persistEnrollment;
-exports.discardPendingJoinToken = discardPendingJoinToken;
-exports.enrollAndPersist = enrollAndPersist;
-/**
- * The agent's side of mesh mTLS enrollment (Release A).
- *
- * The operator mints a single-use join token on the hub (System → Cluster →
- * Add agent) and pastes it into this agent's setup. Redeeming it:
- *
- *   1. decode the token's claims WITHOUT trusting them (the agent holds no CA
- *      key yet): `hubUrl`, `hubMeshAddress`, `caFingerprint`, optional `nodeId`;
- *   2. a token pinned to another node id is refused before anything is sent;
- *   3. generate this node's own key pair; the private key never leaves it;
- *   4. `POST <hubUrl>/api/mesh/enroll` with `{ token, csr }`. The hub's HTTPS
- *      certificate is NOT the mesh CA, so the TLS peer is not what is pinned:
- *   5. the answer is trusted only if its CA certificate hashes to the token's
- *      `caFingerprint` (a MITM with another CA fails here), the token's ES256
- *      signature verifies against that CA, and the issued leaf is signed by it,
- *      carries this node id as CN and matches the private key;
- *   6. only then are the material and the hub address persisted (`agent.json`,
- *      0600) — the dial port is NOT stored: with a certificate the broker dials
- *      the TLS port, so the address keeps the host only.
- */
-const node_crypto_1 = require("node:crypto");
-const fs = __importStar(require("node:fs"));
-const http = __importStar(require("node:http"));
-const https = __importStar(require("node:https"));
-const system_1 = require("@camstack/system");
-const node_1 = require("@camstack/types/node");
-class MeshEnrollError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = 'MeshEnrollError';
-    }
-}
-exports.MeshEnrollError = MeshEnrollError;
-const ENROLL_PATH = '/api/mesh/enroll';
-const ENROLL_TIMEOUT_MS = 15_000;
-function base64urlJson(segment) {
-    return JSON.parse(Buffer.from(segment, 'base64url').toString('utf8'));
-}
-/** Decode the payload of a compact JWS. Untrusted: nothing here is verified. */
-function decodeJoinTokenClaims(token) {
-    const parts = token.trim().split('.');
-    if (parts.length !== 3 || parts[1] === undefined) {
-        throw new MeshEnrollError('join token is malformed (expected a compact JWT)');
-    }
-    let payload;
-    try {
-        payload = base64urlJson(parts[1]);
-    }
-    catch {
-        throw new MeshEnrollError('join token payload is not valid JSON');
-    }
-    if (payload === null || typeof payload !== 'object') {
-        throw new MeshEnrollError('join token payload is not an object');
-    }
-    const hubUrl = Reflect.get(payload, 'hubUrl');
-    const hubMeshAddress = Reflect.get(payload, 'hubMeshAddress');
-    const caFingerprint = Reflect.get(payload, 'caFingerprint');
-    const nodeId = Reflect.get(payload, 'nodeId');
-    const exp = Reflect.get(payload, 'exp');
-    if (typeof hubUrl !== 'string' || hubUrl.length === 0) {
-        throw new MeshEnrollError('join token carries no hubUrl');
-    }
-    if (typeof hubMeshAddress !== 'string' || hubMeshAddress.length === 0) {
-        throw new MeshEnrollError('join token carries no hubMeshAddress');
-    }
-    if (typeof caFingerprint !== 'string' || caFingerprint.length === 0) {
-        throw new MeshEnrollError('join token carries no caFingerprint');
-    }
-    if (typeof exp !== 'number')
-        throw new MeshEnrollError('join token carries no expiry');
-    return {
-        hubUrl,
-        hubMeshAddress,
-        caFingerprint: normalizeFingerprint(caFingerprint),
-        ...(typeof nodeId === 'string' && nodeId.length > 0 ? { nodeId } : {}),
-        exp,
-    };
-}
-function normalizeFingerprint(fp) {
-    return fp.replace(/:/g, '').toLowerCase();
-}
-/** `host:6000` / `[::1]:6000` / `host` → the host, port dropped. */
-function hubHostFromMeshAddress(address) {
-    const trimmed = address.trim();
-    const bracketed = /^(\[[^\]]+\])(?::\d+)?$/.exec(trimmed);
-    if (bracketed?.[1] !== undefined)
-        return bracketed[1];
-    const hostPort = /^([^:]+):\d+$/.exec(trimmed);
-    return hostPort?.[1] ?? trimmed;
-}
-function compactFingerprint(certPem) {
-    return (0, node_crypto_1.createHash)('sha256').update(new node_crypto_1.X509Certificate(certPem).raw).digest('hex');
-}
-/** ES256 compact-JWS signature check against the CA certificate's public key. */
-function tokenSignatureValid(token, caCertPem) {
-    const parts = token.trim().split('.');
-    if (parts.length !== 3)
-        return false;
-    const [header, payload, signature] = parts;
-    if (header === undefined || payload === undefined || signature === undefined)
-        return false;
-    try {
-        return (0, node_crypto_1.verify)('sha256', Buffer.from(`${header}.${payload}`), { key: new node_crypto_1.X509Certificate(caCertPem).publicKey, dsaEncoding: 'ieee-p1363' }, Buffer.from(signature, 'base64url'));
-    }
-    catch {
-        return false;
-    }
-}
-/** Node `http(s)` POST. The hub's HTTPS leaf is not the mesh CA, so the CA pin below is the trust. */
-const nodeEnrollFetch = (url, init) => new Promise((resolve, reject) => {
-    const target = new URL(url);
-    const request = (target.protocol === 'http:' ? http : https).request(target, {
-        method: init.method,
-        headers: { ...init.headers, 'content-length': Buffer.byteLength(init.body) },
-        timeout: ENROLL_TIMEOUT_MS,
-        ...(target.protocol === 'https:' ? { rejectUnauthorized: false } : {}),
-    }, (res) => {
-        const chunks = [];
-        res.on('data', (chunk) => chunks.push(chunk));
-        res.on('end', () => {
-            const raw = Buffer.concat(chunks).toString('utf8');
-            resolve({
-                status: res.statusCode ?? 0,
-                json: () => Promise.resolve(JSON.parse(raw)),
-            });
-        });
-        res.on('error', reject);
-    });
-    request.on('timeout', () => request.destroy(new Error(`enroll request timed out`)));
-    request.on('error', reject);
-    request.end(init.body);
-});
-function readAnswer(status, body) {
-    const record = body !== null && typeof body === 'object' ? body : {};
-    if (status !== 200 || Reflect.get(record, 'ok') !== true) {
-        const error = Reflect.get(record, 'error');
-        throw new MeshEnrollError(`hub refused the enrollment (HTTP ${status}): ${typeof error === 'string' ? error : 'no reason given'}`);
-    }
-    const cert = Reflect.get(record, 'cert');
-    const caCert = Reflect.get(record, 'caCert');
-    if (typeof cert !== 'string' || typeof caCert !== 'string') {
-        throw new MeshEnrollError('hub answered without a certificate and CA certificate');
-    }
-    return { cert, caCert };
-}
-/**
- * Redeem a join token. Throws {@link MeshEnrollError} with an operator-readable
- * reason; nothing is persisted here.
- */
-async function enrollAgentMesh(input) {
-    const token = input.token.trim();
-    const claims = decodeJoinTokenClaims(token);
-    const nowSec = input.nowSec ?? Math.floor(Date.now() / 1000);
-    if (claims.exp <= nowSec) {
-        throw new MeshEnrollError('join token has expired — mint a new one on the hub');
-    }
-    if (claims.nodeId !== undefined && claims.nodeId !== input.nodeId) {
-        throw new MeshEnrollError(`join token is for node "${claims.nodeId}", but this agent is "${input.nodeId}"`);
-    }
-    const keys = await (0, system_1.generateMeshKeyPair)();
-    const csr = await (0, system_1.createMeshCsrPem)(keys, input.nodeId);
-    const keyPem = await (0, system_1.exportMeshPrivateKeyPem)(keys.privateKey);
-    const url = `${claims.hubUrl.replace(/\/+$/, '')}${ENROLL_PATH}`;
-    const fetchFn = input.fetchFn ?? nodeEnrollFetch;
-    let response;
-    try {
-        response = await fetchFn(url, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ token, csr }),
-        });
-    }
-    catch (err) {
-        throw new MeshEnrollError(`could not reach the hub at ${claims.hubUrl}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    let body;
-    try {
-        body = await response.json();
-    }
-    catch {
-        body = null;
-    }
-    const answer = readAnswer(response.status, body);
-    // Trust nothing the hub said until it proves it holds the CA the token names.
-    let fingerprint;
-    try {
-        fingerprint = compactFingerprint(answer.caCert);
-    }
-    catch {
-        throw new MeshEnrollError('hub returned an unreadable CA certificate');
-    }
-    if (fingerprint !== claims.caFingerprint) {
-        throw new MeshEnrollError('the CA certificate returned by the hub does not match the token fingerprint — ' +
-            'enrollment aborted (is something between this agent and the hub?)');
-    }
-    if (!tokenSignatureValid(token, answer.caCert)) {
-        throw new MeshEnrollError('join token signature does not verify against the hub CA');
-    }
-    assertLeafIsOurs(answer, keyPem, input.nodeId);
-    return {
-        meshTls: { certPem: answer.cert, keyPem, caCertPem: answer.caCert },
-        hubAddress: hubHostFromMeshAddress(claims.hubMeshAddress),
-        claims,
-    };
-}
-function assertLeafIsOurs(answer, keyPem, nodeId) {
-    let leaf;
-    try {
-        leaf = new node_crypto_1.X509Certificate(answer.cert);
-    }
-    catch {
-        throw new MeshEnrollError('hub returned an unreadable node certificate');
-    }
-    const ca = new node_crypto_1.X509Certificate(answer.caCert);
-    if (!leaf.verify(ca.publicKey)) {
-        throw new MeshEnrollError('the node certificate is not signed by the hub CA');
-    }
-    if (!new RegExp(`(?:^|\\n)CN=${escapeRegExp(nodeId)}(?:\\n|$)`).test(leaf.subject)) {
-        throw new MeshEnrollError(`the node certificate is not issued for "${nodeId}"`);
-    }
-    if (!leaf.checkPrivateKey((0, node_crypto_1.createPrivateKey)(keyPem))) {
-        throw new MeshEnrollError('the node certificate does not match this agent’s private key');
-    }
-}
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-function readJsonFile(file) {
-    if (!fs.existsSync(file))
-        return {};
-    try {
-        const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'));
-        return parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
-            ? Object.fromEntries(Object.entries(parsed))
-            : {};
-    }
-    catch {
-        return {};
-    }
-}
-function withoutJoinToken(record) {
-    return Object.fromEntries(Object.entries(record).filter(([key]) => key !== 'joinToken'));
-}
-/** Owner-only on every OS (an owner+SYSTEM ACL on Windows, where 0600 is a no-op). */
-function writeJsonFile0600(file, data) {
-    (0, node_1.writeOwnerOnlyFileSync)(file, JSON.stringify(data, null, 2));
-}
-/**
- * Write the enrollment into `agent.json` (0600): `meshTls` + the host-only
- * `hubAddress`; a pending `joinToken` is removed. The cluster secret, if any,
- * stays — it is still a valid join proof for one release.
- */
-function persistEnrollment(configPath, enrolled) {
-    const next = {
-        ...withoutJoinToken(readJsonFile(configPath)),
-        hubAddress: enrolled.hubAddress,
-        meshTls: enrolled.meshTls,
-    };
-    writeJsonFile0600(configPath, next);
-}
-/** Drop a pending `joinToken` from `agent.json` (consumed — or dead). */
-function discardPendingJoinToken(configPath) {
-    const existing = readJsonFile(configPath);
-    if (!('joinToken' in existing))
-        return;
-    writeJsonFile0600(configPath, withoutJoinToken(existing));
-}
-/** Redeem `token` and persist the result. Throws {@link MeshEnrollError}. */
-async function enrollAndPersist(input) {
-    const enrolled = await enrollAgentMesh(input);
-    persistEnrollment(input.configPath, enrolled);
-    return enrolled;
-}

package/dist/agent/agent-mesh-join.js

@@ -1,140 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createAgentMeshJoin = createAgentMeshJoin;
-/**
- * The agent's mesh join (D802): authenticate to the hub on every connection,
- * before anything else reaches it, and check that the hub is the hub — plus
- * the agent's inbound mesh gate so only that proven hub (and this agent's own
- * registered children) may call it.
- *
- * `MeshJoinClient` (in `@camstack/system`) holds the outbound protocol and the
- * call gate; `AgentMeshAuthenticator` + `createMeshAccessMiddleware` hold the
- * inbound side. This file binds both to the agent's broker lifecycle:
- *  - the hub connects → a join runs; a settled mutual proof stamps the hub;
- *  - the hub disconnects → back to `pending` (calls wait for the next join)
- *    and the hub is forgotten on the inbound gate;
- *  - any other node disconnects → forgotten on the inbound gate;
- *  - the hub says "not authenticated" (it restarted and lost us) → join again;
- *  - the join settles `unavailable` (the hub cannot read its secret yet) →
- *    retried every {@link REJOIN_INTERVAL_MS} while connected.
- */
-const system_1 = require("@camstack/system");
-const REJOIN_INTERVAL_MS = 15_000;
-const HUB_NODE_ID = 'hub';
-function nodeIdOf(data) {
-    if (data === null || typeof data !== 'object')
-        return undefined;
-    const node = Reflect.get(data, 'node');
-    if (node === null || typeof node !== 'object')
-        return undefined;
-    const id = Reflect.get(node, 'id');
-    return typeof id === 'string' ? id : undefined;
-}
-function createAgentMeshJoin(opts) {
-    let connected = false;
-    let rejoinTimer = null;
-    const clearRejoin = () => {
-        if (rejoinTimer !== null)
-            clearTimeout(rejoinTimer);
-        rejoinTimer = null;
-    };
-    const authenticator = new system_1.AgentMeshAuthenticator({
-        ownNodeId: opts.nodeId,
-        hubNodeId: HUB_NODE_ID,
-        ...(opts.isVerifiedPeer !== undefined ? { isVerifiedPeer: opts.isVerifiedPeer } : {}),
-        ...(opts.isPaired !== undefined ? { isPaired: opts.isPaired } : {}),
-        hasSecret: () => {
-            const s = opts.secret();
-            return s !== null && s.length > 0;
-        },
-        onTolerated: (nodeId, action) => {
-            opts.log?.(`mesh inbound: node "${nodeId}" is calling without having authenticated — ` +
-                `tolerated while this agent has no cluster secret (first call: ${action})`);
-        },
-        // D848: what the hub sent before the join settled is held, then decided — said here.
-        onHoldReport: (r) => {
-            const what = `${r.events} hub event(s) and ${r.calls} hub call(s) held ${r.heldForMs} ms before the mesh join settled`;
-            const overflow = r.overflow > 0 ? `; ${r.overflow} more refused because the hold was full` : '';
-            opts.log?.(r.outcome === 'delivered'
-                ? `[mesh-join] ${what}: delivered${overflow}`
-                : `[mesh-join] ${what}: REFUSED (join ${r.reason})${overflow}`);
-        },
-    });
-    const client = new system_1.MeshJoinClient({
-        nodeId: opts.nodeId,
-        secret: opts.secret,
-        call: opts.call,
-        hubNodeId: HUB_NODE_ID,
-        ...(opts.log !== undefined ? { log: opts.log } : {}),
-        onSettled: (state) => {
-            authenticator.noteHubJoinState(state);
-            opts.onState?.(state);
-            clearRejoin();
-            if (state === 'unavailable' && connected) {
-                rejoinTimer = setTimeout(() => void runJoin(), REJOIN_INTERVAL_MS);
-                rejoinTimer.unref?.();
-            }
-        },
-    });
-    const runJoin = async () => {
-        if (!connected)
-            return;
-        await client.join();
-    };
-    const rejoin = () => {
-        client.reset();
-        authenticator.noteHubJoinState('pending');
-        void runJoin();
-    };
-    const joinMiddleware = client.middleware(rejoin);
-    const eventScope = (0, system_1.createAgentEventScope)({
-        hubNodeId: HUB_NODE_ID,
-        ...(opts.log !== undefined ? { log: opts.log } : {}),
-    });
-    const inboundMiddleware = (0, system_1.createMeshAccessMiddleware)({
-        ownNodeId: opts.nodeId,
-        authenticator,
-        logger: {
-            warn: (message, meta) => {
-                const detail = meta === undefined
-                    ? ''
-                    : ` ${Object.entries(meta)
-                        .map(([k, v]) => `${k}=${String(v)}`)
-                        .join(' ')}`;
-                opts.log?.(`${message}${detail}`);
-            },
-        },
-    });
-    return {
-        client,
-        authenticator,
-        middleware: joinMiddleware,
-        eventScope,
-        middlewares: [inboundMiddleware, joinMiddleware, eventScope.middleware],
-        rejoin() {
-            if (connected)
-                rejoin();
-        },
-        attach(broker) {
-            broker.localBus.on('$node.connected', (data) => {
-                if (nodeIdOf(data) !== HUB_NODE_ID)
-                    return;
-                connected = true;
-                rejoin();
-            });
-            broker.localBus.on('$node.disconnected', (data) => {
-                const id = nodeIdOf(data);
-                if (id === undefined)
-                    return;
-                authenticator.forget(id);
-                if (id !== HUB_NODE_ID)
-                    return;
-                connected = false;
-                clearRejoin();
-                client.reset();
-                authenticator.noteHubJoinState('pending');
-            });
-        },
-        stop: clearRejoin,
-    };
-}