@camstack/system 1.2.381 → 1.2.383

package/dist/kernel/moleculer/mesh-mtls/mesh-join-token.d.ts

@@ -0,0 +1,55 @@
+import { MESH_JOIN_TOKEN_VERSION } from './constants.js';
+import { MeshCaSigner } from './mesh-ca.js';
+export interface MeshJoinTokenClaims {
+    readonly v: typeof MESH_JOIN_TOKEN_VERSION;
+    readonly hubUrl: string;
+    readonly hubMeshAddress: string;
+    readonly caFingerprint: string;
+    readonly nodeId?: string;
+    readonly jti: string;
+    readonly exp: number;
+}
+export type MeshJoinTokenVerifyResult = {
+    readonly ok: true;
+    readonly claims: MeshJoinTokenClaims;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/** In-memory + optional persist of spent `jti` until `exp`. */
+export declare class JoinTokenJtiStore {
+    private readonly spent;
+    /** True when `jti` was already consumed (and not yet expired). */
+    isSpent(jti: string, nowSec?: number): boolean;
+    /** Record a jti as used until `exp`. Returns false if already spent. */
+    consume(jti: string, exp: number, nowSec?: number): boolean;
+    /** Test helper. */
+    size(): number;
+    private gc;
+}
+export declare function processJoinTokenJtiStore(): JoinTokenJtiStore;
+export interface MintJoinTokenInput {
+    readonly ca: MeshCaSigner;
+    readonly hubUrl: string;
+    readonly hubMeshAddress: string;
+    readonly nodeId?: string;
+    /** Seconds from now; capped at {@link MESH_JOIN_TOKEN_MAX_TTL_SEC}. */
+    readonly ttlSec?: number;
+    readonly now?: Date;
+    readonly jti?: string;
+}
+export declare function mintMeshJoinToken(input: MintJoinTokenInput): Promise<string>;
+export interface VerifyJoinTokenInput {
+    readonly token: string;
+    readonly ca: MeshCaSigner;
+    readonly jtiStore?: JoinTokenJtiStore;
+    readonly now?: Date;
+    /** When true (enroll), consume the jti. Mint-path verify may skip. */
+    readonly consume?: boolean;
+    /**
+     * Expected CA fingerprint pin. When set, must match the token's
+     * `caFingerprint` (and therefore this CA) — a MITM with another CA fails.
+     */
+    readonly expectedCaFingerprint?: string;
+}
+export declare function verifyMeshJoinToken(input: VerifyJoinTokenInput): Promise<MeshJoinTokenVerifyResult>;

package/dist/kernel/moleculer/mesh-mtls/mesh-tls-enabler.d.ts

@@ -0,0 +1,5 @@
+import { MeshTlsMaterial } from './tls-tcp-transporter.js';
+export type MeshTlsEnabler = (material: MeshTlsMaterial) => void | Promise<void>;
+export declare function setProcessMeshTlsEnabler(enabler: MeshTlsEnabler | null): void;
+export declare function getProcessMeshTlsEnabler(): MeshTlsEnabler | null;
+export declare function requestProcessMeshTlsEnable(material: MeshTlsMaterial): Promise<void>;

package/dist/kernel/moleculer/mesh-mtls/tls-tcp-transporter.d.ts

@@ -0,0 +1,92 @@
+import { Server as NetServer, Socket as NetSocket } from 'node:net';
+import { MeshCrl } from './mesh-crl.js';
+interface TlsTcpTransporterBase {
+    opts: Record<string, unknown> & {
+        port?: number;
+        tlsPort?: number;
+        maxPacketSize?: number;
+    };
+    logger: {
+        info(msg: string, ...args: unknown[]): void;
+        warn(msg: string, ...args: unknown[]): void;
+        debug(msg: string, ...args: unknown[]): void;
+        error(msg: string, ...args: unknown[]): void;
+    };
+    reader: {
+        listen(): Promise<number>;
+        close(): void;
+    } | null;
+    writer: unknown;
+    Promise: PromiseConstructor;
+    connected: boolean;
+    nodes: {
+        localNode: {
+            port: number;
+        };
+    };
+    registry: {
+        regenerateLocalRawInfo(force: boolean): void;
+    };
+    startTcpServer(): Promise<number>;
+    startUdpServer(): Promise<void>;
+    startTimers(): void;
+    onConnected(): Promise<void>;
+    loadUrls(): Promise<void>;
+    connect(): Promise<void>;
+    disconnect(): Promise<void>;
+    onIncomingMessage(type: string, message: Buffer, socket?: NetSocket): unknown;
+    receive(cmd: string, data: Buffer, socket?: NetSocket): unknown;
+    deserialize(type: string, data: Buffer): {
+        payload: {
+            sender?: string;
+        };
+    };
+    incomingMessage(cmd: string, data: Buffer): unknown;
+}
+export interface MeshTlsMaterial {
+    readonly caCertPem: string;
+    readonly certPem: string;
+    readonly keyPem: string;
+}
+export interface TlsTcpTransporterOptions {
+    readonly port?: number;
+    readonly tlsPort?: number;
+    readonly maxPacketSize?: number;
+    readonly useHostname?: boolean;
+    readonly udpDiscovery?: boolean;
+    readonly udpPort?: number;
+    readonly udpPeriod?: number;
+    readonly debug?: boolean;
+    readonly urls?: string;
+    readonly udpMaxDiscovery?: number;
+    /** When set at construction, TLS starts with the clear reader. */
+    readonly meshTls?: MeshTlsMaterial;
+    readonly crl?: MeshCrl;
+}
+declare const TlsTcpTransporter_base: new (opts?: Record<string, unknown>) => TlsTcpTransporterBase;
+export declare class TlsTcpTransporter extends TlsTcpTransporter_base {
+    private tlsServer;
+    private meshTls;
+    private readonly crl;
+    private readonly tlsSockets;
+    constructor(opts?: TlsTcpTransporterOptions);
+    startTcpServer(): Promise<number>;
+    connect(): Promise<void>;
+    /**
+     * Agent / outbound: wrap `TcpWriter.connect` so peers are dialed with
+     * mutual TLS and the peer CN must match the expected node id.
+     */
+    private patchWriterForTlsClient;
+    /**
+     * Enable (or refresh) the TLS listener once the mesh CA / hub leaf are ready.
+     * Safe to call after connect — starts listening on `tlsPort` alongside clear.
+     */
+    enableMeshTls(material: MeshTlsMaterial): Promise<void>;
+    /** Close sockets whose peer serial was just revoked. */
+    dropRevokedSockets(): void;
+    disconnect(): Promise<void>;
+    onIncomingMessage(type: string, message: Buffer, socket?: NetSocket): unknown;
+    private startTlsServerIfReady;
+    private onTlsClientConnected;
+}
+export type { NetServer };

package/dist/kernel/system-settings-policy.d.ts

@@ -13,8 +13,8 @@
  *
  * So a bootstrap-owned section is answered from env + config.yaml ONLY, and
  * the store may add exactly the keys in {@link STORE_READABLE_BOOTSTRAP_KEYS}:
- * today `auth.tokenExpiry`, the one value the operator edits in the UI
- * (System → Authentication). Widening this list is a security decision, not a
+ * the values the operator edits on System → Authentication (`auth.tokenExpiry`,
+ * `auth.accessTokenExpiry`, `auth.trustedProxies`). Widening this list is a security decision, not a
  * convenience.
  */
 /** The only keys under a bootstrap-owned section the store may answer. */
@@ -32,7 +32,8 @@ export declare function storeMayAnswer(key: string): boolean;
 export declare const PRELOADED_SYSTEM_PREFIXES: readonly string[];
 /**
  * Single keys loaded the same way. `auth.tokenExpiry` is read synchronously on
- * every mint by the hub's `AuthService` (`AuthManager.signToken`).
+ * every mint by the hub's `AuthService` (`AuthManager.signToken`), and
+ * `auth.trustedProxies` on every public auth request (`auth-network-policy.ts`).
  */
 export declare const PRELOADED_SYSTEM_KEYS: readonly string[];
 /** Is `key` served from the boot-time mirror when the engine is isolated? */

package/dist/kernel/transport/hub-cap-forward.d.ts

@@ -27,9 +27,10 @@ export interface HubCapForwardParams {
     /**
      * The ORIGINATING addon, stamped by the AGENT's `LocalChildRegistry` off the
      * child connection the call arrived on (D787) — the agent-side equivalent of
-     * what the hub's own registry stamps for a hub-local child. The hub trusts it
-     * because the agent node is authenticated by the cluster secret, and checks
-     * it against the node the request came from ({@link HubCapForwardOptions}).
+     * what the hub's own registry stamps for a hub-local child. The hub believes
+     * it only from a node that joined the mesh (D802: challenge–response; in
+     * `transition` an unauthenticated node is tolerated) and only when that
+     * node's registered manifest hosts the runner ({@link HubCapForwardOptions}).
      * Absent → the call is anonymous, and an owner-checked cap refuses it.
      */
     readonly callerAddonId?: string;
@@ -46,6 +47,16 @@ export interface HubCapForwardOptions {
     /** Told about a dropped stamp — a misrouted or lying runner deserves a line. */
     readonly onRejectedCaller?: (nodeId: string, callerAddonId: string) => void;
 }
+/**
+ * Drop a `caller` the forwarded args carry. `caller` is the USER identity the
+ * hub's tRPC router injects for `caller: 'required'` methods
+ * (`cap-router-builder.ts`), and providers trust it — `keychainAdmin.reveal`
+ * reads `input.caller.userId`. A call that arrives over the mesh has no user
+ * session behind it, so whatever `caller` it carries is forged (D802). The
+ * args' `callerAddonId` is overwritten or stripped further down by
+ * `stampCallerAddonId`; `caller` had no such guard.
+ */
+export declare function stripForwardedCaller(args: unknown): unknown;
 /**
  * Handler that routes an agent-originated cap call through the hub's own
  * unowned-call routing. Structurally the hub's `onUnownedCall`.

package/dist/kernel/transport/index.d.ts

@@ -32,5 +32,5 @@ export { createParentUnownedCallHandler } from './parent-unowned-call.js';
 export { answerClaimedGetStatus, deviceOfGetStatus, GET_STATUS_METHOD, } from './claimed-get-status.js';
 export type { ClaimedGetStatusAnswer, ClaimedGetStatusCall } from './claimed-get-status.js';
 export type { ParentUnownedCallDeps, ParentUnownedCallLogger } from './parent-unowned-call.js';
-export { createHubCapForwardService, HUB_CAP_FWD_SERVICE, HUB_CAP_FWD_ACTION, } from './hub-cap-forward.js';
+export { createHubCapForwardService, HUB_CAP_FWD_SERVICE, HUB_CAP_FWD_ACTION, stripForwardedCaller, } from './hub-cap-forward.js';
 export type { HubCapForwardOptions, HubCapForwardParams, HubUnownedCallHandler, } from './hub-cap-forward.js';

package/dist/ms-DlIWNkkk.mjs

@@ -0,0 +1,160 @@
+import { i as __require, t as __commonJSMin } from "./chunk-CNf5ZN-e.mjs";
+//#region ../../node_modules/safe-buffer/index.js
+var require_safe_buffer = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	/*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
+	var buffer = __require("buffer");
+	var Buffer = buffer.Buffer;
+	function copyProps(src, dst) {
+		for (var key in src) dst[key] = src[key];
+	}
+	if (Buffer.from && Buffer.alloc && Buffer.allocUnsafe && Buffer.allocUnsafeSlow) module.exports = buffer;
+	else {
+		copyProps(buffer, exports);
+		exports.Buffer = SafeBuffer;
+	}
+	function SafeBuffer(arg, encodingOrOffset, length) {
+		return Buffer(arg, encodingOrOffset, length);
+	}
+	SafeBuffer.prototype = Object.create(Buffer.prototype);
+	copyProps(Buffer, SafeBuffer);
+	SafeBuffer.from = function(arg, encodingOrOffset, length) {
+		if (typeof arg === "number") throw new TypeError("Argument must not be a number");
+		return Buffer(arg, encodingOrOffset, length);
+	};
+	SafeBuffer.alloc = function(size, fill, encoding) {
+		if (typeof size !== "number") throw new TypeError("Argument must be a number");
+		var buf = Buffer(size);
+		if (fill !== void 0) if (typeof encoding === "string") buf.fill(fill, encoding);
+		else buf.fill(fill);
+		else buf.fill(0);
+		return buf;
+	};
+	SafeBuffer.allocUnsafe = function(size) {
+		if (typeof size !== "number") throw new TypeError("Argument must be a number");
+		return Buffer(size);
+	};
+	SafeBuffer.allocUnsafeSlow = function(size) {
+		if (typeof size !== "number") throw new TypeError("Argument must be a number");
+		return buffer.SlowBuffer(size);
+	};
+}));
+//#endregion
+//#region ../../node_modules/ms/index.js
+var require_ms = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	/**
+	* Helpers.
+	*/
+	var s = 1e3;
+	var m = s * 60;
+	var h = m * 60;
+	var d = h * 24;
+	var w = d * 7;
+	var y = d * 365.25;
+	/**
+	* Parse or format the given `val`.
+	*
+	* Options:
+	*
+	*  - `long` verbose formatting [false]
+	*
+	* @param {String|Number} val
+	* @param {Object} [options]
+	* @throws {Error} throw an error if val is not a non-empty string or a number
+	* @return {String|Number}
+	* @api public
+	*/
+	module.exports = function(val, options) {
+		options = options || {};
+		var type = typeof val;
+		if (type === "string" && val.length > 0) return parse(val);
+		else if (type === "number" && isFinite(val)) return options.long ? fmtLong(val) : fmtShort(val);
+		throw new Error("val is not a non-empty string or a valid number. val=" + JSON.stringify(val));
+	};
+	/**
+	* Parse the given `str` and return milliseconds.
+	*
+	* @param {String} str
+	* @return {Number}
+	* @api private
+	*/
+	function parse(str) {
+		str = String(str);
+		if (str.length > 100) return;
+		var match = /^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(str);
+		if (!match) return;
+		var n = parseFloat(match[1]);
+		switch ((match[2] || "ms").toLowerCase()) {
+			case "years":
+			case "year":
+			case "yrs":
+			case "yr":
+			case "y": return n * y;
+			case "weeks":
+			case "week":
+			case "w": return n * w;
+			case "days":
+			case "day":
+			case "d": return n * d;
+			case "hours":
+			case "hour":
+			case "hrs":
+			case "hr":
+			case "h": return n * h;
+			case "minutes":
+			case "minute":
+			case "mins":
+			case "min":
+			case "m": return n * m;
+			case "seconds":
+			case "second":
+			case "secs":
+			case "sec":
+			case "s": return n * s;
+			case "milliseconds":
+			case "millisecond":
+			case "msecs":
+			case "msec":
+			case "ms": return n;
+			default: return;
+		}
+	}
+	/**
+	* Short format for `ms`.
+	*
+	* @param {Number} ms
+	* @return {String}
+	* @api private
+	*/
+	function fmtShort(ms) {
+		var msAbs = Math.abs(ms);
+		if (msAbs >= d) return Math.round(ms / d) + "d";
+		if (msAbs >= h) return Math.round(ms / h) + "h";
+		if (msAbs >= m) return Math.round(ms / m) + "m";
+		if (msAbs >= s) return Math.round(ms / s) + "s";
+		return ms + "ms";
+	}
+	/**
+	* Long format for `ms`.
+	*
+	* @param {Number} ms
+	* @return {String}
+	* @api private
+	*/
+	function fmtLong(ms) {
+		var msAbs = Math.abs(ms);
+		if (msAbs >= d) return plural(ms, msAbs, d, "day");
+		if (msAbs >= h) return plural(ms, msAbs, h, "hour");
+		if (msAbs >= m) return plural(ms, msAbs, m, "minute");
+		if (msAbs >= s) return plural(ms, msAbs, s, "second");
+		return ms + " ms";
+	}
+	/**
+	* Pluralization helper.
+	*/
+	function plural(ms, msAbs, n, name) {
+		var isPlural = msAbs >= n * 1.5;
+		return Math.round(ms / n) + " " + name + (isPlural ? "s" : "");
+	}
+}));
+//#endregion
+export { require_safe_buffer as n, require_ms as t };

package/dist/ms-t68_FaqE.js

@@ -0,0 +1,171 @@
+const require_chunk = require("./chunk-Cek0wNdY.js");
+//#region ../../node_modules/safe-buffer/index.js
+var require_safe_buffer = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, module) => {
+	/*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
+	var buffer = require("buffer");
+	var Buffer = buffer.Buffer;
+	function copyProps(src, dst) {
+		for (var key in src) dst[key] = src[key];
+	}
+	if (Buffer.from && Buffer.alloc && Buffer.allocUnsafe && Buffer.allocUnsafeSlow) module.exports = buffer;
+	else {
+		copyProps(buffer, exports);
+		exports.Buffer = SafeBuffer;
+	}
+	function SafeBuffer(arg, encodingOrOffset, length) {
+		return Buffer(arg, encodingOrOffset, length);
+	}
+	SafeBuffer.prototype = Object.create(Buffer.prototype);
+	copyProps(Buffer, SafeBuffer);
+	SafeBuffer.from = function(arg, encodingOrOffset, length) {
+		if (typeof arg === "number") throw new TypeError("Argument must not be a number");
+		return Buffer(arg, encodingOrOffset, length);
+	};
+	SafeBuffer.alloc = function(size, fill, encoding) {
+		if (typeof size !== "number") throw new TypeError("Argument must be a number");
+		var buf = Buffer(size);
+		if (fill !== void 0) if (typeof encoding === "string") buf.fill(fill, encoding);
+		else buf.fill(fill);
+		else buf.fill(0);
+		return buf;
+	};
+	SafeBuffer.allocUnsafe = function(size) {
+		if (typeof size !== "number") throw new TypeError("Argument must be a number");
+		return Buffer(size);
+	};
+	SafeBuffer.allocUnsafeSlow = function(size) {
+		if (typeof size !== "number") throw new TypeError("Argument must be a number");
+		return buffer.SlowBuffer(size);
+	};
+}));
+//#endregion
+//#region ../../node_modules/ms/index.js
+var require_ms = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, module) => {
+	/**
+	* Helpers.
+	*/
+	var s = 1e3;
+	var m = s * 60;
+	var h = m * 60;
+	var d = h * 24;
+	var w = d * 7;
+	var y = d * 365.25;
+	/**
+	* Parse or format the given `val`.
+	*
+	* Options:
+	*
+	*  - `long` verbose formatting [false]
+	*
+	* @param {String|Number} val
+	* @param {Object} [options]
+	* @throws {Error} throw an error if val is not a non-empty string or a number
+	* @return {String|Number}
+	* @api public
+	*/
+	module.exports = function(val, options) {
+		options = options || {};
+		var type = typeof val;
+		if (type === "string" && val.length > 0) return parse(val);
+		else if (type === "number" && isFinite(val)) return options.long ? fmtLong(val) : fmtShort(val);
+		throw new Error("val is not a non-empty string or a valid number. val=" + JSON.stringify(val));
+	};
+	/**
+	* Parse the given `str` and return milliseconds.
+	*
+	* @param {String} str
+	* @return {Number}
+	* @api private
+	*/
+	function parse(str) {
+		str = String(str);
+		if (str.length > 100) return;
+		var match = /^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(str);
+		if (!match) return;
+		var n = parseFloat(match[1]);
+		switch ((match[2] || "ms").toLowerCase()) {
+			case "years":
+			case "year":
+			case "yrs":
+			case "yr":
+			case "y": return n * y;
+			case "weeks":
+			case "week":
+			case "w": return n * w;
+			case "days":
+			case "day":
+			case "d": return n * d;
+			case "hours":
+			case "hour":
+			case "hrs":
+			case "hr":
+			case "h": return n * h;
+			case "minutes":
+			case "minute":
+			case "mins":
+			case "min":
+			case "m": return n * m;
+			case "seconds":
+			case "second":
+			case "secs":
+			case "sec":
+			case "s": return n * s;
+			case "milliseconds":
+			case "millisecond":
+			case "msecs":
+			case "msec":
+			case "ms": return n;
+			default: return;
+		}
+	}
+	/**
+	* Short format for `ms`.
+	*
+	* @param {Number} ms
+	* @return {String}
+	* @api private
+	*/
+	function fmtShort(ms) {
+		var msAbs = Math.abs(ms);
+		if (msAbs >= d) return Math.round(ms / d) + "d";
+		if (msAbs >= h) return Math.round(ms / h) + "h";
+		if (msAbs >= m) return Math.round(ms / m) + "m";
+		if (msAbs >= s) return Math.round(ms / s) + "s";
+		return ms + "ms";
+	}
+	/**
+	* Long format for `ms`.
+	*
+	* @param {Number} ms
+	* @return {String}
+	* @api private
+	*/
+	function fmtLong(ms) {
+		var msAbs = Math.abs(ms);
+		if (msAbs >= d) return plural(ms, msAbs, d, "day");
+		if (msAbs >= h) return plural(ms, msAbs, h, "hour");
+		if (msAbs >= m) return plural(ms, msAbs, m, "minute");
+		if (msAbs >= s) return plural(ms, msAbs, s, "second");
+		return ms + " ms";
+	}
+	/**
+	* Pluralization helper.
+	*/
+	function plural(ms, msAbs, n, name) {
+		var isPlural = msAbs >= n * 1.5;
+		return Math.round(ms / n) + " " + name + (isPlural ? "s" : "");
+	}
+}));
+//#endregion
+Object.defineProperty(exports, "require_ms", {
+	enumerable: true,
+	get: function() {
+		return require_ms;
+	}
+});
+Object.defineProperty(exports, "require_safe_buffer", {
+	enumerable: true,
+	get: function() {
+		return require_safe_buffer;
+	}
+});