@camstack/system 1.2.383 → 1.2.385

package/dist/builtins/system-config/system-config.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CUNGH0fs.js");
+const require_dist = require("../../dist-8LQ4lDEB.js");
 const require_ms$1 = require("../../ms-t68_FaqE.js");
-const require_constants$8 = require("../../constants-CDpry1_T.js");
+const require_constants$8 = require("../../constants-Ca-Sgcl8.js");
 const require_x509_es = require("../../x509.es-BhTzcFhZ.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -280,6 +280,9 @@ async function createMeshCsrPem(keys, commonName) {
 async function generateMeshKeyPair() {
 	return node_crypto.webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
 }
+async function exportMeshPrivateKeyPem(key) {
+	return exportKeyPem(key);
+}
 //#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-ca-keeper.ts
 var SLOT$2 = Symbol.for("camstack.mesh.ca");
@@ -465,6 +468,69 @@ function processMeshCrl() {
 	return crl;
 }
 //#endregion
+//#region src/kernel/moleculer/mesh-mtls/mesh-clear-port.ts
+/** The field key inside the `cluster` section. */
+var MESH_CLEAR_PORT_FIELD = "meshClearPort";
+function isMeshClearPortMode(value) {
+	return value === "on" || value === "off";
+}
+/** A stored value that is not a mode reads as `on`: never cut the mesh on a typo. */
+function parseMeshClearPortMode(value) {
+	return isMeshClearPortMode(value) ? value : "on";
+}
+/** Pure: may the clear port be switched off right now? */
+function decideMeshClearPortOff(control) {
+	if (control === null) return {
+		allowed: false,
+		blocking: [],
+		error: "The clear mesh port can only be switched off on the hub (no mesh transport here)."
+	};
+	if (!control.isTlsListening()) return {
+		allowed: false,
+		blocking: [],
+		error: "Refusing to close the clear mesh port: the TLS listener (:6443) is not up yet, so no node could reach the hub."
+	};
+	const blocking = control.listOnlineAgents().filter((agent) => agent.transport !== "tls").map((agent) => agent.nodeId).toSorted();
+	if (blocking.length > 0) return {
+		allowed: false,
+		blocking,
+		error: `Refusing to close the clear mesh port: ${blocking.join(", ")} still ${blocking.length === 1 ? "connects" : "connect"} in clear. Enroll ${blocking.length === 1 ? "it" : "each"} with a join token first (System → Cluster → Add agent).`
+	};
+	return { allowed: true };
+}
+var CONTROL_SLOT = Symbol.for("camstack.cluster.mesh-clear-port-control");
+/** Published by the hub's broker owner; cleared on shutdown. */
+function setProcessMeshClearPortControl(control) {
+	if (control === null) Reflect.deleteProperty(globalThis, CONTROL_SLOT);
+	else Reflect.set(globalThis, CONTROL_SLOT, control);
+}
+function isMeshClearPortControl(value) {
+	return value !== null && typeof value === "object" && typeof Reflect.get(value, "listOnlineAgents") === "function" && typeof Reflect.get(value, "isTlsListening") === "function" && typeof Reflect.get(value, "apply") === "function" && typeof Reflect.get(value, "transportOf") === "function";
+}
+function getProcessMeshClearPortControl() {
+	const value = Reflect.get(globalThis, CONTROL_SLOT);
+	return isMeshClearPortControl(value) ? value : null;
+}
+/** `tls` / `clear` for an agent as the hub sees it; `undefined` off the hub. */
+function getProcessNodeMeshTransport(nodeId) {
+	return getProcessMeshClearPortControl()?.transportOf(nodeId);
+}
+/**
+* Validate a requested mode against the live mesh. `on` is always allowed; `off`
+* only when {@link decideMeshClearPortOff} allows. Does NOT apply it.
+*/
+function checkProcessMeshClearPort(mode) {
+	if (mode === "on") return { allowed: true };
+	return decideMeshClearPortOff(getProcessMeshClearPortControl());
+}
+/** Apply a mode that {@link checkProcessMeshClearPort} allowed. No-op where nobody can. */
+async function applyProcessMeshClearPort(mode) {
+	const control = getProcessMeshClearPortControl();
+	if (control === null) return false;
+	await control.apply(mode);
+	return true;
+}
+//#endregion
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder("utf-8", { fatal: !0 });
 function concat(...buffers) {
@@ -87309,6 +87375,9 @@ var TlsTcpTransporter = class extends TcpTransporter {
 	meshTls;
 	crl;
 	tlsSockets = /* @__PURE__ */ new Set();
+	/** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
+	tlsPeers = /* @__PURE__ */ new Map();
+	clearDisabled = false;
 	constructor(opts = {}) {
 		super({ ...opts });
 		this.meshTls = opts.meshTls ?? null;
@@ -87401,6 +87470,54 @@ var TlsTcpTransporter = class extends TcpTransporter {
 		this.meshTls = material;
 		await this.startTlsServerIfReady();
 	}
+	/**
+	* How `nodeId` reaches this transporter: `tls` once it completed a mutual-TLS
+	* handshake (certificate CN = node id, issued by the mesh CA — so this cannot
+	* be claimed by a clear-text peer), otherwise `clear`. Sticky until
+	* {@link forgetPeer}: Moleculer closes idle sockets while the node is still
+	* connected, and a closed socket is not a downgrade.
+	*/
+	peerTransport(nodeId) {
+		return this.tlsPeers.has(nodeId) ? "tls" : "clear";
+	}
+	/**
+	* The node disconnected: its next connection decides its transport again —
+	* unless it already re-handshook (the disconnect can be noticed after the
+	* restarted node is back), in which case its live TLS socket keeps it `tls`.
+	*/
+	forgetPeer(nodeId) {
+		for (const socket of this.tlsSockets) if (socket.meshPeerCn === nodeId && !socket.destroyed) return;
+		this.tlsPeers.delete(nodeId);
+	}
+	/** True once the mutual-TLS listener is bound. */
+	isTlsListening() {
+		return this.tlsServer !== null;
+	}
+	isClearTransportEnabled() {
+		return !this.clearDisabled;
+	}
+	/**
+	* Cutover: stop listening on the clear TCP port, drop the clear-text sockets
+	* already open on it and stop UDP discovery. TLS sockets (own listener, own
+	* port) are untouched. Idempotent.
+	*/
+	disableClearTransport() {
+		this.clearDisabled = true;
+		const reader = this.reader;
+		if (reader?.server?.listening) reader.server.close();
+		for (const socket of [...reader?.sockets ?? []]) if (!isTlsSocket(socket)) socket.destroy();
+		this.udpServer?.close();
+		this.udpServer = null;
+		this.logger.info("Mesh clear transport disabled (clear TCP reader and UDP discovery stopped).");
+	}
+	/** The switch back: listen on the clear port again and restart UDP discovery. Idempotent. */
+	async enableClearTransport() {
+		if (!this.clearDisabled) return;
+		this.clearDisabled = false;
+		if (this.reader !== null && this.reader.server?.listening !== true) await this.reader.listen();
+		if (this.udpServer === null) await this.startUdpServer();
+		this.logger.info("Mesh clear transport re-enabled.");
+	}
 	/** Close sockets whose peer serial was just revoked. */
 	dropRevokedSockets() {
 		for (const socket of [...this.tlsSockets]) {
@@ -87423,6 +87540,7 @@ var TlsTcpTransporter = class extends TcpTransporter {
 			s.destroy();
 		} catch {}
 		this.tlsSockets.clear();
+		this.tlsPeers.clear();
 		return super.disconnect();
 	}
 	onIncomingMessage(type, message, socket) {
@@ -87499,6 +87617,7 @@ var TlsTcpTransporter = class extends TcpTransporter {
 		socket.meshPeerCn = identity.cn;
 		socket.meshPeerSerial = identity.serial;
 		this.tlsSockets.add(socket);
+		this.tlsPeers.set(identity.cn, identity.serial);
 		const reader = this.reader;
 		socket.on("close", () => {
 			this.tlsSockets.delete(socket);
@@ -87757,7 +87876,8 @@ var KEY_TO_SECTION = {
 	trustedProxies: "auth",
 	trustedNetworks: "auth",
 	[CLUSTER_SECRET_FIELD]: "cluster",
-	[MESH_AUTH_MODE_FIELD]: "cluster"
+	[MESH_AUTH_MODE_FIELD]: "cluster",
+	[MESH_CLEAR_PORT_FIELD]: "cluster"
 };
 /** Bytes of a generated cluster secret (D802) — 256 bits, base64url (43 chars). */
 var GENERATED_SECRET_BYTES = 32;
@@ -87810,10 +87930,11 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			onReady: (ca) => this.onMeshCaReady(ca)
 		});
 		await this.meshCaKeeper.start();
+		await this.applyStoredClearPort();
 		this.ctx.logger.info("Initialized — exposes yml-backed sections via getGlobalSettings");
 		return {
 			customActions: systemConfigMeshActions,
-			actionHandlers: { mintJoinToken: async (input) => this.mintJoinToken(input ?? {}) }
+			actionHandlers: { mintJoinToken: async (input) => this.mintJoinToken(parseMintJoinTokenInput(input)) }
 		};
 	}
 	async onShutdown() {
@@ -87823,6 +87944,20 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		this.clusterSecretKeeper?.stop();
 		this.clusterSecretKeeper = null;
 	}
+	/**
+	* Boot: a stored `meshClearPort: off` is the operator's standing choice, so it
+	* is applied WITHOUT the agents gate (nobody is connected yet to be checked).
+	* Default `on` changes nothing.
+	*/
+	async applyStoredClearPort() {
+		try {
+			const stored = (await this.ctx.settings?.getSection("cluster"))?.[MESH_CLEAR_PORT_FIELD];
+			if (parseMeshClearPortMode(stored) !== "off") return;
+			if (await applyProcessMeshClearPort("off")) this.ctx.logger.info("Mesh clear port is OFF (cluster.meshClearPort)");
+		} catch (err) {
+			this.ctx.logger.warn("could not apply cluster.meshClearPort at boot", { meta: { error: require_dist.errMsg(err) } });
+		}
+	}
 	async onMeshCaReady(ca) {
 		const hubLeaf = await issueMeshLeafForNode(ca, "hub");
 		await requestProcessMeshTlsEnable({
@@ -87854,7 +87989,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 	}
 	async resolveHubUrl() {
 		try {
-			const book = await this.ctx.api?.localNetwork?.getAddresses?.({ scheme: "https" });
+			const book = await this.ctx.api?.localNetwork?.getAddresses?.query({ scheme: "https" });
 			const url = book?.roles?.publicEndpoint?.resolved ?? book?.roles?.internal?.resolved ?? null;
 			if (typeof url === "string" && url.length > 0) return url;
 		} catch {}
@@ -87864,7 +87999,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 	}
 	async resolveHubMeshAddress() {
 		try {
-			const base = (await this.ctx.api?.localNetwork?.getAddresses?.({}))?.roles?.internal?.resolved;
+			const base = (await this.ctx.api?.localNetwork?.getAddresses?.query({}))?.roles?.internal?.resolved;
 			if (typeof base === "string" && base.length > 0) return `${new URL(base).hostname}:${require_constants$8.DEFAULT_HUB_TCP_PORT}`;
 		} catch {}
 		const host = (await this.ctx.settings?.getSection("server"))?.["host"];
@@ -87985,6 +88120,20 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 							label: "Enforced — refuse"
 						}]
 					},
+					{
+						type: "select",
+						key: MESH_CLEAR_PORT_FIELD,
+						label: "Clear mesh port (:6000)",
+						description: "On keeps the clear TCP port and UDP discovery next to the TLS port (:6443). Off closes both — refused while any connected agent has not enrolled with a join token (the Cluster page shows TLS / clear per node).",
+						default: "on",
+						options: [{
+							value: "on",
+							label: "On — accept clear agents"
+						}, {
+							value: "off",
+							label: "Off — mutual TLS only"
+						}]
+					},
 					{
 						type: "info",
 						key: "meshAuthStatus",
@@ -88067,7 +88216,8 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 	* is REFUSED — never written inline (D787, P5). `meshAuth` is a plain value.
 	*/
 	async writeClusterSection(patch) {
-		const { [MESH_AUTH_MODE_FIELD]: mode, ...secretPatch } = patch;
+		const { [MESH_AUTH_MODE_FIELD]: mode, [MESH_CLEAR_PORT_FIELD]: clearPort, ...secretPatch } = patch;
+		if (clearPort !== void 0) await this.writeMeshClearPort(clearPort);
 		if (mode !== void 0) {
 			if (!isMeshAuthMode(mode)) throw new Error(`system-config: meshAuth must be 'transition' or 'enforced'`);
 			await this.writeMeshAuthMode(mode);
@@ -88078,6 +88228,27 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		this.ctx.logger.info("Cluster secret updated");
 		await this.clusterSecretKeeper?.reload();
 	}
+	/**
+	* `cluster.meshClearPort`: `off` is REFUSED while any online agent still
+	* connects in clear (or the TLS listener is not up); the refusal names them.
+	* Persist, then apply — an `on` save always passes.
+	*/
+	async writeMeshClearPort(value) {
+		if (!isMeshClearPortMode(value)) throw new Error(`system-config: meshClearPort must be 'on' or 'off'`);
+		const stored = (await this.ctx.settings.getSection("cluster"))[MESH_CLEAR_PORT_FIELD];
+		if (parseMeshClearPortMode(stored) === value) return;
+		const decision = checkProcessMeshClearPort(value);
+		if (!decision.allowed) {
+			this.ctx.logger.warn("mesh clear port switch-off refused", { meta: {
+				blocking: decision.blocking,
+				error: decision.error
+			} });
+			throw new Error(decision.error);
+		}
+		await this.ctx.settings.setSection("cluster", { [MESH_CLEAR_PORT_FIELD]: value });
+		await applyProcessMeshClearPort(value);
+		this.ctx.logger.info("Mesh clear port switched", { meta: { mode: value } });
+	}
 	/** `cluster.meshAuth` (D802), then republish it. */
 	async writeMeshAuthMode(mode) {
 		await this.ctx.settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: mode });
@@ -88122,18 +88293,34 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		if (orphaned.length > 0) this.ctx.logger.warn("an old cluster secret value could not be deleted from the keychain", { meta: { refs: orphaned } });
 	}
 };
+function parseMintJoinTokenInput(input) {
+	if (input === null || input === void 0 || typeof input !== "object") return {};
+	const out = {};
+	const nodeId = Reflect.get(input, "nodeId");
+	const hubUrl = Reflect.get(input, "hubUrl");
+	const hubMeshAddress = Reflect.get(input, "hubMeshAddress");
+	const ttlSec = Reflect.get(input, "ttlSec");
+	if (typeof nodeId === "string") out.nodeId = nodeId;
+	if (typeof hubUrl === "string") out.hubUrl = hubUrl;
+	if (typeof hubMeshAddress === "string") out.hubMeshAddress = hubMeshAddress;
+	if (typeof ttlSec === "number") out.ttlSec = ttlSec;
+	return out;
+}
 /** Read `exp` from an unencrypted JWT payload (no verify — already minted here). */
 function readJwtExp(token) {
 	const parts = token.split(".");
 	if (parts.length < 2 || parts[1] === void 0) return 0;
 	const json = Buffer.from(parts[1], "base64url").toString("utf8");
 	const payload = JSON.parse(json);
-	return typeof payload.exp === "number" ? payload.exp : 0;
+	if (payload === null || typeof payload !== "object") return 0;
+	const exp = Reflect.get(payload, "exp");
+	return typeof exp === "number" ? exp : 0;
 }
 //#endregion
 exports.Errors = Errors;
 exports.JoinTokenJtiStore = JoinTokenJtiStore;
 exports.MESH_AUTH_MODE_FIELD = MESH_AUTH_MODE_FIELD;
+exports.MESH_CLEAR_PORT_FIELD = MESH_CLEAR_PORT_FIELD;
 exports.MeshCaKeeper = MeshCaKeeper;
 exports.MeshCrl = MeshCrl;
 exports.SYSTEM_CONFIG_CLUSTER_SECTION_ID = SYSTEM_CONFIG_CLUSTER_SECTION_ID;
@@ -88141,16 +88328,21 @@ exports.ServiceBroker = ServiceBroker;
 exports.SystemConfigAddon = SystemConfigAddon;
 exports.default = SystemConfigAddon;
 exports.TlsTcpTransporter = TlsTcpTransporter;
+exports.applyProcessMeshClearPort = applyProcessMeshClearPort;
 exports.caFingerprint = caFingerprint;
 exports.caFingerprintCompact = caFingerprintCompact;
+exports.checkProcessMeshClearPort = checkProcessMeshClearPort;
 exports.createCidrMatcher = createCidrMatcher;
 exports.createMeshCsrPem = createMeshCsrPem;
+exports.decideMeshClearPortOff = decideMeshClearPortOff;
 exports.enrollMeshNode = enrollMeshNode;
+exports.exportMeshPrivateKeyPem = exportMeshPrivateKeyPem;
 exports.generateMeshCa = generateMeshCa;
 exports.generateMeshKeyPair = generateMeshKeyPair;
 exports.getProcessMeshAuthMode = getProcessMeshAuthMode;
 exports.getProcessMeshAuthStatus = getProcessMeshAuthStatus;
 exports.getProcessMeshCaState = getProcessMeshCaState;
+exports.getProcessNodeMeshTransport = getProcessNodeMeshTransport;
 exports.isMeshAuthMode = isMeshAuthMode;
 exports.issueMeshLeafForNode = issueMeshLeafForNode;
 exports.issueMeshLeafFromCsr = issueMeshLeafFromCsr;
@@ -88166,6 +88358,7 @@ exports.requestProcessMeshEnforcement = requestProcessMeshEnforcement;
 exports.requireProcessMeshCa = requireProcessMeshCa;
 exports.setProcessMeshAuthMode = setProcessMeshAuthMode;
 exports.setProcessMeshAuthStatusSource = setProcessMeshAuthStatusSource;
+exports.setProcessMeshClearPortControl = setProcessMeshClearPortControl;
 exports.setProcessMeshEnforcer = setProcessMeshEnforcer;
 exports.setProcessMeshTlsEnabler = setProcessMeshTlsEnabler;
 exports.systemConfigMeshActions = systemConfigMeshActions;

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,7 +1,7 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Dr as defineCustomActions, Er as customAction, Ir as isSecretClear, Lr as isSecretMarker, Mr as hydrateSchema, Zr as secretTreeFromSchema, lr as errMsg, ti as transformSecretWrite, ur as BaseAddon, zr as makeSecretMarker } from "../../dist-osl3bkF0.mjs";
+import { Dr as defineCustomActions, Er as customAction, Ir as isSecretClear, Lr as isSecretMarker, Mr as hydrateSchema, Zr as secretTreeFromSchema, lr as errMsg, ti as transformSecretWrite, ur as BaseAddon, zr as makeSecretMarker } from "../../dist-Biqn3TEn.mjs";
 import { n as require_safe_buffer, t as require_ms } from "../../ms-DlIWNkkk.mjs";
-import { a as MESH_CA_FIELD, c as MESH_CA_VALIDITY_DAYS, f as CLUSTER_SECRET_REF, i as MESH_CA_COMMON_NAME, l as MESH_JOIN_TOKEN_MAX_TTL_SEC, n as DEFAULT_HUB_TCP_PORT, o as MESH_CA_KEY_REF, r as DEFAULT_HUB_TLS_TCP_PORT, s as MESH_CA_SETTINGS_KEY, t as CLIENT_AUTH_OID, u as SERVER_AUTH_OID, x as setProcessClusterSecretGate, y as hashClusterSecret } from "../../constants-e3mCa1jG.mjs";
+import { a as MESH_CA_FIELD, c as MESH_CA_VALIDITY_DAYS, f as CLUSTER_SECRET_REF, i as MESH_CA_COMMON_NAME, l as MESH_JOIN_TOKEN_MAX_TTL_SEC, n as DEFAULT_HUB_TCP_PORT, o as MESH_CA_KEY_REF, r as DEFAULT_HUB_TLS_TCP_PORT, s as MESH_CA_SETTINGS_KEY, t as CLIENT_AUTH_OID, u as SERVER_AUTH_OID, x as setProcessClusterSecretGate, y as hashClusterSecret } from "../../constants-D5z4EwY8.mjs";
 import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "../../x509.es-Xf3K_brW.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, randomBytes, webcrypto } from "node:crypto";
@@ -271,6 +271,9 @@ async function createMeshCsrPem(keys, commonName) {
 async function generateMeshKeyPair() {
 	return webcrypto.subtle.generateKey(MESH_KEY_ALGORITHM, true, ["sign", "verify"]);
 }
+async function exportMeshPrivateKeyPem(key) {
+	return exportKeyPem(key);
+}
 //#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-ca-keeper.ts
 var SLOT$2 = Symbol.for("camstack.mesh.ca");
@@ -456,6 +459,69 @@ function processMeshCrl() {
 	return crl;
 }
 //#endregion
+//#region src/kernel/moleculer/mesh-mtls/mesh-clear-port.ts
+/** The field key inside the `cluster` section. */
+var MESH_CLEAR_PORT_FIELD = "meshClearPort";
+function isMeshClearPortMode(value) {
+	return value === "on" || value === "off";
+}
+/** A stored value that is not a mode reads as `on`: never cut the mesh on a typo. */
+function parseMeshClearPortMode(value) {
+	return isMeshClearPortMode(value) ? value : "on";
+}
+/** Pure: may the clear port be switched off right now? */
+function decideMeshClearPortOff(control) {
+	if (control === null) return {
+		allowed: false,
+		blocking: [],
+		error: "The clear mesh port can only be switched off on the hub (no mesh transport here)."
+	};
+	if (!control.isTlsListening()) return {
+		allowed: false,
+		blocking: [],
+		error: "Refusing to close the clear mesh port: the TLS listener (:6443) is not up yet, so no node could reach the hub."
+	};
+	const blocking = control.listOnlineAgents().filter((agent) => agent.transport !== "tls").map((agent) => agent.nodeId).toSorted();
+	if (blocking.length > 0) return {
+		allowed: false,
+		blocking,
+		error: `Refusing to close the clear mesh port: ${blocking.join(", ")} still ${blocking.length === 1 ? "connects" : "connect"} in clear. Enroll ${blocking.length === 1 ? "it" : "each"} with a join token first (System → Cluster → Add agent).`
+	};
+	return { allowed: true };
+}
+var CONTROL_SLOT = Symbol.for("camstack.cluster.mesh-clear-port-control");
+/** Published by the hub's broker owner; cleared on shutdown. */
+function setProcessMeshClearPortControl(control) {
+	if (control === null) Reflect.deleteProperty(globalThis, CONTROL_SLOT);
+	else Reflect.set(globalThis, CONTROL_SLOT, control);
+}
+function isMeshClearPortControl(value) {
+	return value !== null && typeof value === "object" && typeof Reflect.get(value, "listOnlineAgents") === "function" && typeof Reflect.get(value, "isTlsListening") === "function" && typeof Reflect.get(value, "apply") === "function" && typeof Reflect.get(value, "transportOf") === "function";
+}
+function getProcessMeshClearPortControl() {
+	const value = Reflect.get(globalThis, CONTROL_SLOT);
+	return isMeshClearPortControl(value) ? value : null;
+}
+/** `tls` / `clear` for an agent as the hub sees it; `undefined` off the hub. */
+function getProcessNodeMeshTransport(nodeId) {
+	return getProcessMeshClearPortControl()?.transportOf(nodeId);
+}
+/**
+* Validate a requested mode against the live mesh. `on` is always allowed; `off`
+* only when {@link decideMeshClearPortOff} allows. Does NOT apply it.
+*/
+function checkProcessMeshClearPort(mode) {
+	if (mode === "on") return { allowed: true };
+	return decideMeshClearPortOff(getProcessMeshClearPortControl());
+}
+/** Apply a mode that {@link checkProcessMeshClearPort} allowed. No-op where nobody can. */
+async function applyProcessMeshClearPort(mode) {
+	const control = getProcessMeshClearPortControl();
+	if (control === null) return false;
+	await control.apply(mode);
+	return true;
+}
+//#endregion
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder("utf-8", { fatal: !0 });
 function concat(...buffers) {
@@ -87300,6 +87366,9 @@ var TlsTcpTransporter = class extends TcpTransporter {
 	meshTls;
 	crl;
 	tlsSockets = /* @__PURE__ */ new Set();
+	/** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
+	tlsPeers = /* @__PURE__ */ new Map();
+	clearDisabled = false;
 	constructor(opts = {}) {
 		super({ ...opts });
 		this.meshTls = opts.meshTls ?? null;
@@ -87392,6 +87461,54 @@ var TlsTcpTransporter = class extends TcpTransporter {
 		this.meshTls = material;
 		await this.startTlsServerIfReady();
 	}
+	/**
+	* How `nodeId` reaches this transporter: `tls` once it completed a mutual-TLS
+	* handshake (certificate CN = node id, issued by the mesh CA — so this cannot
+	* be claimed by a clear-text peer), otherwise `clear`. Sticky until
+	* {@link forgetPeer}: Moleculer closes idle sockets while the node is still
+	* connected, and a closed socket is not a downgrade.
+	*/
+	peerTransport(nodeId) {
+		return this.tlsPeers.has(nodeId) ? "tls" : "clear";
+	}
+	/**
+	* The node disconnected: its next connection decides its transport again —
+	* unless it already re-handshook (the disconnect can be noticed after the
+	* restarted node is back), in which case its live TLS socket keeps it `tls`.
+	*/
+	forgetPeer(nodeId) {
+		for (const socket of this.tlsSockets) if (socket.meshPeerCn === nodeId && !socket.destroyed) return;
+		this.tlsPeers.delete(nodeId);
+	}
+	/** True once the mutual-TLS listener is bound. */
+	isTlsListening() {
+		return this.tlsServer !== null;
+	}
+	isClearTransportEnabled() {
+		return !this.clearDisabled;
+	}
+	/**
+	* Cutover: stop listening on the clear TCP port, drop the clear-text sockets
+	* already open on it and stop UDP discovery. TLS sockets (own listener, own
+	* port) are untouched. Idempotent.
+	*/
+	disableClearTransport() {
+		this.clearDisabled = true;
+		const reader = this.reader;
+		if (reader?.server?.listening) reader.server.close();
+		for (const socket of [...reader?.sockets ?? []]) if (!isTlsSocket(socket)) socket.destroy();
+		this.udpServer?.close();
+		this.udpServer = null;
+		this.logger.info("Mesh clear transport disabled (clear TCP reader and UDP discovery stopped).");
+	}
+	/** The switch back: listen on the clear port again and restart UDP discovery. Idempotent. */
+	async enableClearTransport() {
+		if (!this.clearDisabled) return;
+		this.clearDisabled = false;
+		if (this.reader !== null && this.reader.server?.listening !== true) await this.reader.listen();
+		if (this.udpServer === null) await this.startUdpServer();
+		this.logger.info("Mesh clear transport re-enabled.");
+	}
 	/** Close sockets whose peer serial was just revoked. */
 	dropRevokedSockets() {
 		for (const socket of [...this.tlsSockets]) {
@@ -87414,6 +87531,7 @@ var TlsTcpTransporter = class extends TcpTransporter {
 			s.destroy();
 		} catch {}
 		this.tlsSockets.clear();
+		this.tlsPeers.clear();
 		return super.disconnect();
 	}
 	onIncomingMessage(type, message, socket) {
@@ -87490,6 +87608,7 @@ var TlsTcpTransporter = class extends TcpTransporter {
 		socket.meshPeerCn = identity.cn;
 		socket.meshPeerSerial = identity.serial;
 		this.tlsSockets.add(socket);
+		this.tlsPeers.set(identity.cn, identity.serial);
 		const reader = this.reader;
 		socket.on("close", () => {
 			this.tlsSockets.delete(socket);
@@ -87747,7 +87866,8 @@ var KEY_TO_SECTION = {
 	trustedProxies: "auth",
 	trustedNetworks: "auth",
 	[CLUSTER_SECRET_FIELD]: "cluster",
-	[MESH_AUTH_MODE_FIELD]: "cluster"
+	[MESH_AUTH_MODE_FIELD]: "cluster",
+	[MESH_CLEAR_PORT_FIELD]: "cluster"
 };
 /** Bytes of a generated cluster secret (D802) — 256 bits, base64url (43 chars). */
 var GENERATED_SECRET_BYTES = 32;
@@ -87800,10 +87920,11 @@ var SystemConfigAddon = class extends BaseAddon {
 			onReady: (ca) => this.onMeshCaReady(ca)
 		});
 		await this.meshCaKeeper.start();
+		await this.applyStoredClearPort();
 		this.ctx.logger.info("Initialized — exposes yml-backed sections via getGlobalSettings");
 		return {
 			customActions: systemConfigMeshActions,
-			actionHandlers: { mintJoinToken: async (input) => this.mintJoinToken(input ?? {}) }
+			actionHandlers: { mintJoinToken: async (input) => this.mintJoinToken(parseMintJoinTokenInput(input)) }
 		};
 	}
 	async onShutdown() {
@@ -87813,6 +87934,20 @@ var SystemConfigAddon = class extends BaseAddon {
 		this.clusterSecretKeeper?.stop();
 		this.clusterSecretKeeper = null;
 	}
+	/**
+	* Boot: a stored `meshClearPort: off` is the operator's standing choice, so it
+	* is applied WITHOUT the agents gate (nobody is connected yet to be checked).
+	* Default `on` changes nothing.
+	*/
+	async applyStoredClearPort() {
+		try {
+			const stored = (await this.ctx.settings?.getSection("cluster"))?.[MESH_CLEAR_PORT_FIELD];
+			if (parseMeshClearPortMode(stored) !== "off") return;
+			if (await applyProcessMeshClearPort("off")) this.ctx.logger.info("Mesh clear port is OFF (cluster.meshClearPort)");
+		} catch (err) {
+			this.ctx.logger.warn("could not apply cluster.meshClearPort at boot", { meta: { error: errMsg(err) } });
+		}
+	}
 	async onMeshCaReady(ca) {
 		const hubLeaf = await issueMeshLeafForNode(ca, "hub");
 		await requestProcessMeshTlsEnable({
@@ -87844,7 +87979,7 @@ var SystemConfigAddon = class extends BaseAddon {
 	}
 	async resolveHubUrl() {
 		try {
-			const book = await this.ctx.api?.localNetwork?.getAddresses?.({ scheme: "https" });
+			const book = await this.ctx.api?.localNetwork?.getAddresses?.query({ scheme: "https" });
 			const url = book?.roles?.publicEndpoint?.resolved ?? book?.roles?.internal?.resolved ?? null;
 			if (typeof url === "string" && url.length > 0) return url;
 		} catch {}
@@ -87854,7 +87989,7 @@ var SystemConfigAddon = class extends BaseAddon {
 	}
 	async resolveHubMeshAddress() {
 		try {
-			const base = (await this.ctx.api?.localNetwork?.getAddresses?.({}))?.roles?.internal?.resolved;
+			const base = (await this.ctx.api?.localNetwork?.getAddresses?.query({}))?.roles?.internal?.resolved;
 			if (typeof base === "string" && base.length > 0) return `${new URL(base).hostname}:${DEFAULT_HUB_TCP_PORT}`;
 		} catch {}
 		const host = (await this.ctx.settings?.getSection("server"))?.["host"];
@@ -87975,6 +88110,20 @@ var SystemConfigAddon = class extends BaseAddon {
 							label: "Enforced — refuse"
 						}]
 					},
+					{
+						type: "select",
+						key: MESH_CLEAR_PORT_FIELD,
+						label: "Clear mesh port (:6000)",
+						description: "On keeps the clear TCP port and UDP discovery next to the TLS port (:6443). Off closes both — refused while any connected agent has not enrolled with a join token (the Cluster page shows TLS / clear per node).",
+						default: "on",
+						options: [{
+							value: "on",
+							label: "On — accept clear agents"
+						}, {
+							value: "off",
+							label: "Off — mutual TLS only"
+						}]
+					},
 					{
 						type: "info",
 						key: "meshAuthStatus",
@@ -88057,7 +88206,8 @@ var SystemConfigAddon = class extends BaseAddon {
 	* is REFUSED — never written inline (D787, P5). `meshAuth` is a plain value.
 	*/
 	async writeClusterSection(patch) {
-		const { [MESH_AUTH_MODE_FIELD]: mode, ...secretPatch } = patch;
+		const { [MESH_AUTH_MODE_FIELD]: mode, [MESH_CLEAR_PORT_FIELD]: clearPort, ...secretPatch } = patch;
+		if (clearPort !== void 0) await this.writeMeshClearPort(clearPort);
 		if (mode !== void 0) {
 			if (!isMeshAuthMode(mode)) throw new Error(`system-config: meshAuth must be 'transition' or 'enforced'`);
 			await this.writeMeshAuthMode(mode);
@@ -88068,6 +88218,27 @@ var SystemConfigAddon = class extends BaseAddon {
 		this.ctx.logger.info("Cluster secret updated");
 		await this.clusterSecretKeeper?.reload();
 	}
+	/**
+	* `cluster.meshClearPort`: `off` is REFUSED while any online agent still
+	* connects in clear (or the TLS listener is not up); the refusal names them.
+	* Persist, then apply — an `on` save always passes.
+	*/
+	async writeMeshClearPort(value) {
+		if (!isMeshClearPortMode(value)) throw new Error(`system-config: meshClearPort must be 'on' or 'off'`);
+		const stored = (await this.ctx.settings.getSection("cluster"))[MESH_CLEAR_PORT_FIELD];
+		if (parseMeshClearPortMode(stored) === value) return;
+		const decision = checkProcessMeshClearPort(value);
+		if (!decision.allowed) {
+			this.ctx.logger.warn("mesh clear port switch-off refused", { meta: {
+				blocking: decision.blocking,
+				error: decision.error
+			} });
+			throw new Error(decision.error);
+		}
+		await this.ctx.settings.setSection("cluster", { [MESH_CLEAR_PORT_FIELD]: value });
+		await applyProcessMeshClearPort(value);
+		this.ctx.logger.info("Mesh clear port switched", { meta: { mode: value } });
+	}
 	/** `cluster.meshAuth` (D802), then republish it. */
 	async writeMeshAuthMode(mode) {
 		await this.ctx.settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: mode });
@@ -88112,13 +88283,28 @@ var SystemConfigAddon = class extends BaseAddon {
 		if (orphaned.length > 0) this.ctx.logger.warn("an old cluster secret value could not be deleted from the keychain", { meta: { refs: orphaned } });
 	}
 };
+function parseMintJoinTokenInput(input) {
+	if (input === null || input === void 0 || typeof input !== "object") return {};
+	const out = {};
+	const nodeId = Reflect.get(input, "nodeId");
+	const hubUrl = Reflect.get(input, "hubUrl");
+	const hubMeshAddress = Reflect.get(input, "hubMeshAddress");
+	const ttlSec = Reflect.get(input, "ttlSec");
+	if (typeof nodeId === "string") out.nodeId = nodeId;
+	if (typeof hubUrl === "string") out.hubUrl = hubUrl;
+	if (typeof hubMeshAddress === "string") out.hubMeshAddress = hubMeshAddress;
+	if (typeof ttlSec === "number") out.ttlSec = ttlSec;
+	return out;
+}
 /** Read `exp` from an unencrypted JWT payload (no verify — already minted here). */
 function readJwtExp(token) {
 	const parts = token.split(".");
 	if (parts.length < 2 || parts[1] === void 0) return 0;
 	const json = Buffer.from(parts[1], "base64url").toString("utf8");
 	const payload = JSON.parse(json);
-	return typeof payload.exp === "number" ? payload.exp : 0;
+	if (payload === null || typeof payload !== "object") return 0;
+	const exp = Reflect.get(payload, "exp");
+	return typeof exp === "number" ? exp : 0;
 }
 //#endregion
-export { setProcessMeshAuthMode as A, loadMeshCa as C, isMeshAuthMode as D, getProcessMeshAuthStatus as E, parseCidrList as F, readCidrSetting as I, setProcessMeshEnforcer as M, createCidrMatcher as N, parseMeshAuthMode as O, normalizeIp as P, issueMeshLeafFromCsr as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, getProcessMeshAuthMode as T, caFingerprintCompact as _, setProcessMeshTlsEnabler as a, generateMeshKeyPair as b, mintMeshJoinToken as c, MeshCrl as d, processMeshCrl as f, caFingerprint as g, requireProcessMeshCa as h, ServiceBroker as i, setProcessMeshAuthStatusSource as j, requestProcessMeshEnforcement as k, processJoinTokenJtiStore as l, getProcessMeshCaState as m, TlsTcpTransporter as n, enrollMeshNode as o, MeshCaKeeper as p, Errors as r, JoinTokenJtiStore as s, systemConfigMeshActions as t, verifyMeshJoinToken as u, createMeshCsrPem as v, MESH_AUTH_MODE_FIELD as w, issueMeshLeafForNode as x, generateMeshCa as y };
+export { loadMeshCa as A, createCidrMatcher as B, caFingerprintCompact as C, generateMeshKeyPair as D, generateMeshCa as E, parseMeshAuthMode as F, parseCidrList as H, requestProcessMeshEnforcement as I, setProcessMeshAuthMode as L, getProcessMeshAuthMode as M, getProcessMeshAuthStatus as N, issueMeshLeafForNode as O, isMeshAuthMode as P, setProcessMeshAuthStatusSource as R, caFingerprint as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, exportMeshPrivateKeyPem as T, readCidrSetting as U, normalizeIp as V, MeshCrl as _, setProcessMeshTlsEnabler as a, getProcessMeshCaState as b, mintMeshJoinToken as c, MESH_CLEAR_PORT_FIELD as d, applyProcessMeshClearPort as f, setProcessMeshClearPortControl as g, getProcessNodeMeshTransport as h, ServiceBroker as i, MESH_AUTH_MODE_FIELD as j, issueMeshLeafFromCsr as k, processJoinTokenJtiStore as l, decideMeshClearPortOff as m, TlsTcpTransporter as n, enrollMeshNode as o, checkProcessMeshClearPort as p, Errors as r, JoinTokenJtiStore as s, systemConfigMeshActions as t, verifyMeshJoinToken as u, processMeshCrl as v, createMeshCsrPem as w, requireProcessMeshCa as x, MeshCaKeeper as y, setProcessMeshEnforcer as z };