@camstack/system 1.2.385 → 1.2.387

package/dist/builtins/system-config/mesh-actions.d.ts

@@ -15,5 +15,17 @@ export declare const systemConfigMeshActions: {
     }, z.core.$strip>, "mutation", "admin", {
         readonly kind: "system";
     }>;
+    /** Hub admin → short-lived ticket the agent redeems for a tab session (D821). */
+    mintAgentUiUnlockTicket: import('@camstack/types').CustomActionSpec<z.ZodObject<{
+        nodeId: z.ZodString;
+        dashboardBaseUrl: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        ticket: z.ZodString;
+        exp: z.ZodNumber;
+        nodeId: z.ZodString;
+        dashboardUrl: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, "mutation", "admin", {
+        readonly kind: "system";
+    }>;
 };
 export type SystemConfigMeshActions = typeof systemConfigMeshActions;

package/dist/builtins/system-config/system-config.addon.d.ts

@@ -23,6 +23,17 @@ export declare class SystemConfigAddon extends BaseAddon {
             }, import('zod/v4/core').$strip>, "mutation", "admin", {
                 readonly kind: "system";
             }>;
+            mintAgentUiUnlockTicket: import('@camstack/types').CustomActionSpec<import('zod').ZodObject<{
+                nodeId: import('zod').ZodString;
+                dashboardBaseUrl: import('zod').ZodOptional<import('zod').ZodString>;
+            }, import('zod/v4/core').$strip>, import('zod').ZodObject<{
+                ticket: import('zod').ZodString;
+                exp: import('zod').ZodNumber;
+                nodeId: import('zod').ZodString;
+                dashboardUrl: import('zod').ZodOptional<import('zod').ZodString>;
+            }, import('zod/v4/core').$strip>, "mutation", "admin", {
+                readonly kind: "system";
+            }>;
         };
         actionHandlers: {
             mintJoinToken: (input: unknown) => Promise<{
@@ -33,6 +44,12 @@ export declare class SystemConfigAddon extends BaseAddon {
                 caFingerprint: string;
                 nodeId?: string;
             }>;
+            mintAgentUiUnlockTicket: (input: unknown) => Promise<{
+                ticket: string;
+                exp: number;
+                nodeId: string;
+                dashboardUrl?: string;
+            }>;
         };
     }>;
     protected onShutdown(): Promise<void>;
@@ -44,6 +61,9 @@ export declare class SystemConfigAddon extends BaseAddon {
     private applyStoredClearPort;
     private onMeshCaReady;
     private mintJoinToken;
+    /** D821 — short-lived ticket for the agent's `:4444` unlock session. */
+    private mintAgentUiUnlock;
+    private readAgentDashboardOrigins;
     private resolveHubUrl;
     private resolveHubMeshAddress;
     /** The keychain handle for owner `system`; `null` where there is no door. */
@@ -55,7 +75,8 @@ export declare class SystemConfigAddon extends BaseAddon {
      * The cluster secret's save path: the value goes to the keychain (owner
      * `system`), the row gets the marker; `''` / a view keeps. `$secretClear` is
      * REFUSED: the secret is mandatory (D802). A value the keychain cannot store
-     * is REFUSED — never written inline (D787, P5). `meshAuth` is a plain value.
+     * is REFUSED — never written inline (D787, P5). Mesh auth mode is always
+     * enforced (D821) — a legacy `meshAuth` in the patch is ignored.
      */
     private writeClusterSection;
     /**
@@ -64,13 +85,12 @@ export declare class SystemConfigAddon extends BaseAddon {
      * Persist, then apply — an `on` save always passes.
      */
     private writeMeshClearPort;
-    /** `cluster.meshAuth` (D802), then republish it. */
+    /** Persist + publish mesh auth mode (always `enforced` after D821). */
     private writeMeshAuthMode;
     /**
      * First boot, or a keychain reset that cleared the marker (D802): a fresh
-     * random secret, stored like an operator save. A NEW secret means every
-     * agent must be given it, so the mesh goes (back) to `transition`; on a hub
-     * with no agent yet, the hub's auto-enforce ends it at once.
+     * random secret, stored like an operator save. Mesh auth stays enforced
+     * (D821) — every agent must present the secret; there is no transition window.
      */
     private generateClusterSecret;
     private storeClusterSecret;

package/dist/builtins/system-config/system-config.addon.js

@@ -150,6 +150,145 @@ function getProcessMeshAuthStatus() {
 	return typeof source === "function" ? source() : null;
 }
 //#endregion
+//#region src/kernel/moleculer/agent-ui-unlock.ts
+/**
+* Agent UI remote unlock tickets (D821).
+*
+* A hub admin mints a short-lived HMAC ticket bound to one agent `nodeId`.
+* The agent redeems it once for a tab session Bearer — the cluster secret
+* stays a mesh / pairing credential and is not pasted into the browser for
+* daily unlock.
+*
+*   K       = SHA-256(cluster secret)   — same as mesh join (D802)
+*   ticket  = base64url(JSON payload) + '.' + base64url(HMAC-SHA256(K, DOMAIN|payloadB64))
+*   payload = { v: 1, nodeId, exp (ms), jti }
+*/
+var AGENT_UI_UNLOCK_DOMAIN = "camstack-agent-ui-unlock/v1";
+var AGENT_UI_UNLOCK_VERSION = 1;
+/** Ticket lifetime — long enough for a redirect hop, short enough to steal poorly. */
+var AGENT_UI_UNLOCK_TTL_MS = 5 * 6e4;
+/**
+* Cluster settings key: extra origins allowed as `returnTo` for Continue-with-hub
+* (NPM hostnames that are not `:4444` on a LAN IP). Comma-separated origins.
+*/
+var AGENT_DASHBOARD_ORIGINS_FIELD = "agentDashboardOrigins";
+/** In-memory spent `jti` until `exp` (ms). */
+var UnlockTicketJtiStore = class {
+	spent = /* @__PURE__ */ new Map();
+	isSpent(jti, nowMs = Date.now()) {
+		this.gc(nowMs);
+		return this.spent.has(jti);
+	}
+	/** Record a jti as used until `exp`. Returns false if already spent. */
+	consume(jti, exp, nowMs = Date.now()) {
+		this.gc(nowMs);
+		if (this.spent.has(jti)) return false;
+		this.spent.set(jti, exp);
+		return true;
+	}
+	/** Test helper. */
+	size() {
+		return this.spent.size;
+	}
+	gc(nowMs) {
+		for (const [jti, exp] of this.spent) if (exp <= nowMs) this.spent.delete(jti);
+	}
+};
+function mintAgentUiUnlockTicket(input) {
+	const nowMs = input.nowMs ?? Date.now();
+	const ttl = Math.min(Math.max(1e3, input.ttlMs ?? 3e5), AGENT_UI_UNLOCK_TTL_MS);
+	const payload = {
+		v: 1,
+		nodeId: input.nodeId,
+		exp: nowMs + ttl,
+		jti: input.jti ?? (0, node_crypto.randomBytes)(16).toString("base64url")
+	};
+	const payloadB64 = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+	return `${payloadB64}.${sign(input.secretHash, payloadB64)}`;
+}
+/**
+* Verify a ticket under `secretHash`. Returns the payload, or `null` when the
+* signature, shape, expiry or nodeId fails (no reason string — refuse quietly).
+*/
+function verifyAgentUiUnlockTicket(secretHash, ticket, options) {
+	const nowMs = options.nowMs ?? Date.now();
+	const dot = ticket.indexOf(".");
+	if (dot <= 0 || dot === ticket.length - 1) return null;
+	const payloadB64 = ticket.slice(0, dot);
+	const sig = ticket.slice(dot + 1);
+	if (!sigsEqual(sign(secretHash, payloadB64), sig)) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
+	} catch {
+		return null;
+	}
+	const payload = parsePayload(parsed);
+	if (payload === null) return null;
+	if (payload.exp <= nowMs) return null;
+	if (payload.nodeId !== options.expectedNodeId) return null;
+	return payload;
+}
+/**
+* True when `returnTo` may receive a ticket redirect. Default: any http(s)
+* origin whose port is 4444. Extra origins come from
+* {@link AGENT_DASHBOARD_ORIGINS_FIELD} (exact origin match).
+*/
+function isAllowedAgentDashboardReturnTo(returnTo, extraOrigins = []) {
+	let url;
+	try {
+		url = new URL(returnTo);
+	} catch {
+		return false;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+	if (url.username !== "" || url.password !== "") return false;
+	if (url.pathname !== "/" && url.pathname !== "") return false;
+	if (url.port === "4444") return true;
+	const origin = url.origin;
+	return extraOrigins.some((o) => o === origin);
+}
+/** Parse a stored comma/whitespace-separated origins list. */
+function parseAgentDashboardOrigins(stored) {
+	if (typeof stored !== "string" || stored.trim().length === 0) return [];
+	const out = [];
+	for (const part of stored.split(/[,\s]+/)) {
+		const t = part.trim();
+		if (t.length === 0) continue;
+		try {
+			const u = new URL(t);
+			if (u.protocol === "http:" || u.protocol === "https:") out.push(u.origin);
+		} catch {}
+	}
+	return out;
+}
+function sign(secretHash, payloadB64) {
+	return (0, node_crypto.createHmac)("sha256", Buffer.from(secretHash, "utf8")).update(`${AGENT_UI_UNLOCK_DOMAIN}|${payloadB64}`, "utf8").digest("base64url");
+}
+function sigsEqual(expected, presented) {
+	const a = Buffer.from(expected, "utf8");
+	const b = Buffer.from(presented, "utf8");
+	if (a.length !== b.length) return false;
+	return (0, node_crypto.timingSafeEqual)(a, b);
+}
+function parsePayload(value) {
+	if (typeof value !== "object" || value === null) return null;
+	const rec = value;
+	if (rec["v"] !== 1) return null;
+	const nodeId = rec["nodeId"];
+	const exp = rec["exp"];
+	const jti = rec["jti"];
+	if (typeof nodeId !== "string" || nodeId.length === 0) return null;
+	if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
+	if (typeof jti !== "string" || jti.length === 0) return null;
+	return {
+		v: 1,
+		nodeId,
+		exp,
+		jti
+	};
+}
+//#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-ca.ts
 require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
 var MS_PER_DAY = 864e5;
@@ -87660,7 +87799,7 @@ function isTlsSocket(socket) {
 *  - no marker            → the secret is MANDATORY (D802): the keeper asks
 *                           its owner to generate one (`generateSecret`), and
 *                           until that succeeds the gate is `off` — no node can
-*                           authenticate, and only `transition` lets them in;
+*                           authenticate (mesh auth is always enforced, D821);
 *  - marker + value       → `on`  — nodes prove the secret;
 *  - marker, no answer    → `unknown` — refused, retryably, and retried here.
 *    A locked keychain or a value lost to a reset NEVER opens the gate, and
@@ -87723,7 +87862,7 @@ var ClusterSecretKeeper = class {
 				reason: `settings unreadable: ${errText(err)}`
 			};
 		}
-		setProcessMeshAuthMode(parseMeshAuthMode(section[MESH_AUTH_MODE_FIELD]));
+		setProcessMeshAuthMode("enforced");
 		const stored = section[CLUSTER_SECRET_FIELD];
 		if (stored === void 0 || stored === null || stored === "") return { kind: "off" };
 		if (!require_dist.isSecretMarker(stored)) return {
@@ -87791,28 +87930,48 @@ function errText(err) {
 //#endregion
 //#region src/builtins/system-config/mesh-actions.ts
 /**
-* System → Cluster — mint a single-use mesh join token (Release A).
+* System → Cluster — mint a single-use mesh join token (Release A) and
+* agent-ui unlock tickets (D821).
 */
-var systemConfigMeshActions = require_dist.defineCustomActions({ mintJoinToken: require_dist.customAction(zod.z.object({
-	/** Optional pinned node id for the CSR CN. */
-	nodeId: zod.z.string().min(1).optional(),
-	/** Override hub HTTPS base (default: local-network publicEndpoint). */
-	hubUrl: zod.z.string().url().optional(),
-	/** Override `host:6000` clear mesh address carried in the token. */
-	hubMeshAddress: zod.z.string().min(3).optional(),
-	/** Seconds until expiry; capped at 1 h. */
-	ttlSec: zod.z.number().int().positive().max(3600).optional()
-}).optional(), zod.z.object({
-	token: zod.z.string().min(1),
-	exp: zod.z.number().int(),
-	hubUrl: zod.z.string(),
-	hubMeshAddress: zod.z.string(),
-	caFingerprint: zod.z.string(),
-	nodeId: zod.z.string().optional()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}) });
+var systemConfigMeshActions = require_dist.defineCustomActions({
+	mintJoinToken: require_dist.customAction(zod.z.object({
+		/** Optional pinned node id for the CSR CN. */
+		nodeId: zod.z.string().min(1).optional(),
+		/** Override hub HTTPS base (default: local-network publicEndpoint). */
+		hubUrl: zod.z.string().url().optional(),
+		/** Override `host:6000` clear mesh address carried in the token. */
+		hubMeshAddress: zod.z.string().min(3).optional(),
+		/** Seconds until expiry; capped at 1 h. */
+		ttlSec: zod.z.number().int().positive().max(3600).optional()
+	}).optional(), zod.z.object({
+		token: zod.z.string().min(1),
+		exp: zod.z.number().int(),
+		hubUrl: zod.z.string(),
+		hubMeshAddress: zod.z.string(),
+		caFingerprint: zod.z.string(),
+		nodeId: zod.z.string().optional()
+	}), {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	/** Hub admin → short-lived ticket the agent redeems for a tab session (D821). */
+	mintAgentUiUnlockTicket: require_dist.customAction(zod.z.object({
+		nodeId: zod.z.string().min(1),
+		/**
+		* Preferred agent dashboard base (`http://host:4444`). When set, the
+		* answer includes `dashboardUrl` with `?ticket=` already attached.
+		*/
+		dashboardBaseUrl: zod.z.string().url().optional()
+	}), zod.z.object({
+		ticket: zod.z.string().min(1),
+		exp: zod.z.number().int(),
+		nodeId: zod.z.string().min(1),
+		dashboardUrl: zod.z.string().url().optional()
+	}), {
+		kind: "mutation",
+		auth: "admin"
+	})
+});
 //#endregion
 //#region src/builtins/system-config/system-config.addon.ts
 /**
@@ -87877,7 +88036,8 @@ var KEY_TO_SECTION = {
 	trustedNetworks: "auth",
 	[CLUSTER_SECRET_FIELD]: "cluster",
 	[MESH_AUTH_MODE_FIELD]: "cluster",
-	[MESH_CLEAR_PORT_FIELD]: "cluster"
+	[MESH_CLEAR_PORT_FIELD]: "cluster",
+	[AGENT_DASHBOARD_ORIGINS_FIELD]: "cluster"
 };
 /** Bytes of a generated cluster secret (D802) — 256 bits, base64url (43 chars). */
 var GENERATED_SECRET_BYTES = 32;
@@ -87886,10 +88046,10 @@ var STATE_LABELS = {
 	legacy: "legacy hash only — update the agent",
 	unauthenticated: "not authenticated — enter the cluster secret in this agent"
 };
-/** The Cluster page's live line per node (D802). */
+/** The Cluster page's live line per node (D802). Mode is always enforced (D821). */
 function describeMeshStatus(status) {
 	if (status === null) return "The mesh status is available on the hub only.";
-	const head = status.mode === "enforced" ? "Enforced: a node that has not authenticated is refused." : "Transition: nodes without the secret are still let in (with a warning). The hub switches to Enforced by itself once every known agent has authenticated.";
+	const head = "Enforced: a node that has not authenticated is refused.";
 	if (status.nodes.length === 0) return `${head}\nNo other node is connected.`;
 	return `${head}\n${status.nodes.map((n) => `• ${n.nodeId}: ${STATE_LABELS[n.state] ?? n.state}`).join("\n")}`;
 }
@@ -87920,6 +88080,9 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			this.ctx.logger.info("Mesh authentication is now ENFORCED", { meta: { reason } });
 		});
 		await this.clusterSecretKeeper.start();
+		try {
+			await this.writeMeshAuthMode("enforced");
+		} catch {}
 		this.meshCaKeeper = new MeshCaKeeper({
 			secrets: this.systemSecrets(),
 			readClusterSection: async () => await this.ctx.settings?.getSection("cluster") ?? {},
@@ -87934,7 +88097,10 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		this.ctx.logger.info("Initialized — exposes yml-backed sections via getGlobalSettings");
 		return {
 			customActions: systemConfigMeshActions,
-			actionHandlers: { mintJoinToken: async (input) => this.mintJoinToken(parseMintJoinTokenInput(input)) }
+			actionHandlers: {
+				mintJoinToken: async (input) => this.mintJoinToken(parseMintJoinTokenInput(input)),
+				mintAgentUiUnlockTicket: async (input) => this.mintAgentUiUnlock(parseMintUnlockInput(input))
+			}
 		};
 	}
 	async onShutdown() {
@@ -87987,6 +88153,41 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {}
 		};
 	}
+	/** D821 — short-lived ticket for the agent's `:4444` unlock session. */
+	async mintAgentUiUnlock(input) {
+		const secrets = this.systemSecrets();
+		if (secrets === null) throw new Error("system-config: no keychain door — cannot mint an unlock ticket");
+		const entry = (await secrets.resolve([require_constants$8.CLUSTER_SECRET_REF]))[require_constants$8.CLUSTER_SECRET_REF];
+		if (entry?.kind !== "value") throw new Error("system-config: cluster secret is not available — cannot mint an unlock ticket");
+		if (input.dashboardBaseUrl !== void 0) {
+			const origins = await this.readAgentDashboardOrigins();
+			if (!isAllowedAgentDashboardReturnTo(input.dashboardBaseUrl, origins)) throw new Error("dashboardBaseUrl is not an allowed agent dashboard origin (:4444 or agentDashboardOrigins)");
+		}
+		const ticket = mintAgentUiUnlockTicket({
+			secretHash: require_constants$8.hashClusterSecret(entry.value),
+			nodeId: input.nodeId
+		});
+		const payloadJson = Buffer.from(ticket.split(".")[0] ?? "", "base64url").toString("utf8");
+		const exp = JSON.parse(payloadJson).exp ?? 0;
+		const dashboardUrl = input.dashboardBaseUrl === void 0 ? void 0 : (() => {
+			const u = new URL(input.dashboardBaseUrl);
+			u.searchParams.set("ticket", ticket);
+			return u.toString();
+		})();
+		return {
+			ticket,
+			exp,
+			nodeId: input.nodeId,
+			...dashboardUrl !== void 0 ? { dashboardUrl } : {}
+		};
+	}
+	async readAgentDashboardOrigins() {
+		try {
+			return parseAgentDashboardOrigins((await this.ctx.settings?.getSection("cluster"))?.[AGENT_DASHBOARD_ORIGINS_FIELD]);
+		} catch {
+			return [];
+		}
+	}
 	async resolveHubUrl() {
 		try {
 			const book = await this.ctx.api?.localNetwork?.getAddresses?.query({ scheme: "https" });
@@ -88106,20 +88307,6 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 						label: "Cluster secret",
 						description: "Mandatory — generated by the hub at first boot and stored in the keychain. To pair an agent: Reveal and copy it here, then enter it in the agent (its status page, or the desktop setup window). Saving a new value rotates it: every agent must then be given the new one."
 					},
-					{
-						type: "select",
-						key: MESH_AUTH_MODE_FIELD,
-						label: "Agents without the secret",
-						description: "Transition lets an agent that has not authenticated keep working (with a warning) while you give each agent the secret; it ends by itself once every known agent has authenticated. Enforced refuses it.",
-						default: "transition",
-						options: [{
-							value: "transition",
-							label: "Transition — allow, warn"
-						}, {
-							value: "enforced",
-							label: "Enforced — refuse"
-						}]
-					},
 					{
 						type: "select",
 						key: MESH_CLEAR_PORT_FIELD,
@@ -88141,6 +88328,12 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 						content: describeMeshStatus(getProcessMeshAuthStatus()),
 						variant: "info"
 					},
+					{
+						type: "string",
+						key: AGENT_DASHBOARD_ORIGINS_FIELD,
+						label: "Agent dashboard origins (NPM)",
+						description: "Extra origins allowed for Continue-with-hub unlock redirects (comma-separated), e.g. https://agent.example.com. LAN agents on :4444 are always allowed."
+					},
 					{
 						type: "addon-action-button",
 						key: "mintJoinTokenAction",
@@ -88213,15 +88406,14 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 	* The cluster secret's save path: the value goes to the keychain (owner
 	* `system`), the row gets the marker; `''` / a view keeps. `$secretClear` is
 	* REFUSED: the secret is mandatory (D802). A value the keychain cannot store
-	* is REFUSED — never written inline (D787, P5). `meshAuth` is a plain value.
+	* is REFUSED — never written inline (D787, P5). Mesh auth mode is always
+	* enforced (D821) — a legacy `meshAuth` in the patch is ignored.
 	*/
 	async writeClusterSection(patch) {
-		const { [MESH_AUTH_MODE_FIELD]: mode, [MESH_CLEAR_PORT_FIELD]: clearPort, ...secretPatch } = patch;
+		const { [MESH_AUTH_MODE_FIELD]: _legacyMode, [MESH_CLEAR_PORT_FIELD]: clearPort, [AGENT_DASHBOARD_ORIGINS_FIELD]: dashboardOrigins, ...secretPatch } = patch;
 		if (clearPort !== void 0) await this.writeMeshClearPort(clearPort);
-		if (mode !== void 0) {
-			if (!isMeshAuthMode(mode)) throw new Error(`system-config: meshAuth must be 'transition' or 'enforced'`);
-			await this.writeMeshAuthMode(mode);
-		}
+		if (dashboardOrigins !== void 0) await this.ctx.settings.setSection("cluster", { [AGENT_DASHBOARD_ORIGINS_FIELD]: typeof dashboardOrigins === "string" ? dashboardOrigins : "" });
+		await this.writeMeshAuthMode("enforced");
 		if (Object.keys(secretPatch).length === 0) return;
 		if (require_dist.isSecretClear(secretPatch["clusterSecret"])) throw new Error("The cluster secret is mandatory and cannot be cleared — save a new value to rotate it");
 		await this.storeClusterSecret(secretPatch);
@@ -88249,16 +88441,15 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		await applyProcessMeshClearPort(value);
 		this.ctx.logger.info("Mesh clear port switched", { meta: { mode: value } });
 	}
-	/** `cluster.meshAuth` (D802), then republish it. */
+	/** Persist + publish mesh auth mode (always `enforced` after D821). */
 	async writeMeshAuthMode(mode) {
 		await this.ctx.settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: mode });
-		await this.clusterSecretKeeper?.reload();
+		setProcessMeshAuthMode(mode);
 	}
 	/**
 	* First boot, or a keychain reset that cleared the marker (D802): a fresh
-	* random secret, stored like an operator save. A NEW secret means every
-	* agent must be given it, so the mesh goes (back) to `transition`; on a hub
-	* with no agent yet, the hub's auto-enforce ends it at once.
+	* random secret, stored like an operator save. Mesh auth stays enforced
+	* (D821) — every agent must present the secret; there is no transition window.
 	*/
 	async generateClusterSecret() {
 		const settings = this.ctx.settings;
@@ -88273,7 +88464,8 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		if (existing?.kind !== "missing") throw new Error(`the keychain cannot answer for the cluster secret (${existing?.kind ?? "no answer"})`);
 		const value = (0, node_crypto.randomBytes)(GENERATED_SECRET_BYTES).toString("base64url");
 		await this.storeClusterSecret({ [CLUSTER_SECRET_FIELD]: value });
-		await settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: "transition" });
+		await settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: "enforced" });
+		setProcessMeshAuthMode("enforced");
 	}
 	async storeClusterSecret(patch) {
 		const settings = this.ctx.settings;
@@ -88306,6 +88498,16 @@ function parseMintJoinTokenInput(input) {
 	if (typeof ttlSec === "number") out.ttlSec = ttlSec;
 	return out;
 }
+function parseMintUnlockInput(input) {
+	if (input === null || typeof input !== "object") throw new Error("system-config: mintAgentUiUnlockTicket requires { nodeId }");
+	const nodeId = Reflect.get(input, "nodeId");
+	if (typeof nodeId !== "string" || nodeId.length === 0) throw new Error("system-config: mintAgentUiUnlockTicket requires { nodeId }");
+	const dashboardBaseUrl = Reflect.get(input, "dashboardBaseUrl");
+	return {
+		nodeId,
+		...typeof dashboardBaseUrl === "string" ? { dashboardBaseUrl } : {}
+	};
+}
 /** Read `exp` from an unencrypted JWT payload (no verify — already minted here). */
 function readJwtExp(token) {
 	const parts = token.split(".");
@@ -88317,6 +88519,10 @@ function readJwtExp(token) {
 	return typeof exp === "number" ? exp : 0;
 }
 //#endregion
+exports.AGENT_DASHBOARD_ORIGINS_FIELD = AGENT_DASHBOARD_ORIGINS_FIELD;
+exports.AGENT_UI_UNLOCK_DOMAIN = AGENT_UI_UNLOCK_DOMAIN;
+exports.AGENT_UI_UNLOCK_TTL_MS = AGENT_UI_UNLOCK_TTL_MS;
+exports.AGENT_UI_UNLOCK_VERSION = AGENT_UI_UNLOCK_VERSION;
 exports.Errors = Errors;
 exports.JoinTokenJtiStore = JoinTokenJtiStore;
 exports.MESH_AUTH_MODE_FIELD = MESH_AUTH_MODE_FIELD;
@@ -88328,6 +88534,7 @@ exports.ServiceBroker = ServiceBroker;
 exports.SystemConfigAddon = SystemConfigAddon;
 exports.default = SystemConfigAddon;
 exports.TlsTcpTransporter = TlsTcpTransporter;
+exports.UnlockTicketJtiStore = UnlockTicketJtiStore;
 exports.applyProcessMeshClearPort = applyProcessMeshClearPort;
 exports.caFingerprint = caFingerprint;
 exports.caFingerprintCompact = caFingerprintCompact;
@@ -88343,12 +88550,15 @@ exports.getProcessMeshAuthMode = getProcessMeshAuthMode;
 exports.getProcessMeshAuthStatus = getProcessMeshAuthStatus;
 exports.getProcessMeshCaState = getProcessMeshCaState;
 exports.getProcessNodeMeshTransport = getProcessNodeMeshTransport;
+exports.isAllowedAgentDashboardReturnTo = isAllowedAgentDashboardReturnTo;
 exports.isMeshAuthMode = isMeshAuthMode;
 exports.issueMeshLeafForNode = issueMeshLeafForNode;
 exports.issueMeshLeafFromCsr = issueMeshLeafFromCsr;
 exports.loadMeshCa = loadMeshCa;
+exports.mintAgentUiUnlockTicket = mintAgentUiUnlockTicket;
 exports.mintMeshJoinToken = mintMeshJoinToken;
 exports.normalizeIp = normalizeIp;
+exports.parseAgentDashboardOrigins = parseAgentDashboardOrigins;
 exports.parseCidrList = parseCidrList;
 exports.parseMeshAuthMode = parseMeshAuthMode;
 exports.processJoinTokenJtiStore = processJoinTokenJtiStore;
@@ -88362,4 +88572,5 @@ exports.setProcessMeshClearPortControl = setProcessMeshClearPortControl;
 exports.setProcessMeshEnforcer = setProcessMeshEnforcer;
 exports.setProcessMeshTlsEnabler = setProcessMeshTlsEnabler;
 exports.systemConfigMeshActions = systemConfigMeshActions;
+exports.verifyAgentUiUnlockTicket = verifyAgentUiUnlockTicket;
 exports.verifyMeshJoinToken = verifyMeshJoinToken;

package/dist/builtins/system-config/system-config.addon.mjs

@@ -4,7 +4,7 @@ import { n as require_safe_buffer, t as require_ms } from "../../ms-DlIWNkkk.mjs
 import { a as MESH_CA_FIELD, c as MESH_CA_VALIDITY_DAYS, f as CLUSTER_SECRET_REF, i as MESH_CA_COMMON_NAME, l as MESH_JOIN_TOKEN_MAX_TTL_SEC, n as DEFAULT_HUB_TCP_PORT, o as MESH_CA_KEY_REF, r as DEFAULT_HUB_TLS_TCP_PORT, s as MESH_CA_SETTINGS_KEY, t as CLIENT_AUTH_OID, u as SERVER_AUTH_OID, x as setProcessClusterSecretGate, y as hashClusterSecret } from "../../constants-D5z4EwY8.mjs";
 import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "../../x509.es-Xf3K_brW.mjs";
 import { z } from "zod";
-import { X509Certificate, createHash, randomBytes, webcrypto } from "node:crypto";
+import { X509Certificate, createHash, createHmac, randomBytes, timingSafeEqual, webcrypto } from "node:crypto";
 import { BlockList, isIP } from "node:net";
 import { lstat, readdir, readlink, realpath } from "node:fs/promises";
 import { posix, win32 } from "node:path";
@@ -141,6 +141,145 @@ function getProcessMeshAuthStatus() {
 	return typeof source === "function" ? source() : null;
 }
 //#endregion
+//#region src/kernel/moleculer/agent-ui-unlock.ts
+/**
+* Agent UI remote unlock tickets (D821).
+*
+* A hub admin mints a short-lived HMAC ticket bound to one agent `nodeId`.
+* The agent redeems it once for a tab session Bearer — the cluster secret
+* stays a mesh / pairing credential and is not pasted into the browser for
+* daily unlock.
+*
+*   K       = SHA-256(cluster secret)   — same as mesh join (D802)
+*   ticket  = base64url(JSON payload) + '.' + base64url(HMAC-SHA256(K, DOMAIN|payloadB64))
+*   payload = { v: 1, nodeId, exp (ms), jti }
+*/
+var AGENT_UI_UNLOCK_DOMAIN = "camstack-agent-ui-unlock/v1";
+var AGENT_UI_UNLOCK_VERSION = 1;
+/** Ticket lifetime — long enough for a redirect hop, short enough to steal poorly. */
+var AGENT_UI_UNLOCK_TTL_MS = 5 * 6e4;
+/**
+* Cluster settings key: extra origins allowed as `returnTo` for Continue-with-hub
+* (NPM hostnames that are not `:4444` on a LAN IP). Comma-separated origins.
+*/
+var AGENT_DASHBOARD_ORIGINS_FIELD = "agentDashboardOrigins";
+/** In-memory spent `jti` until `exp` (ms). */
+var UnlockTicketJtiStore = class {
+	spent = /* @__PURE__ */ new Map();
+	isSpent(jti, nowMs = Date.now()) {
+		this.gc(nowMs);
+		return this.spent.has(jti);
+	}
+	/** Record a jti as used until `exp`. Returns false if already spent. */
+	consume(jti, exp, nowMs = Date.now()) {
+		this.gc(nowMs);
+		if (this.spent.has(jti)) return false;
+		this.spent.set(jti, exp);
+		return true;
+	}
+	/** Test helper. */
+	size() {
+		return this.spent.size;
+	}
+	gc(nowMs) {
+		for (const [jti, exp] of this.spent) if (exp <= nowMs) this.spent.delete(jti);
+	}
+};
+function mintAgentUiUnlockTicket(input) {
+	const nowMs = input.nowMs ?? Date.now();
+	const ttl = Math.min(Math.max(1e3, input.ttlMs ?? 3e5), AGENT_UI_UNLOCK_TTL_MS);
+	const payload = {
+		v: 1,
+		nodeId: input.nodeId,
+		exp: nowMs + ttl,
+		jti: input.jti ?? randomBytes(16).toString("base64url")
+	};
+	const payloadB64 = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+	return `${payloadB64}.${sign(input.secretHash, payloadB64)}`;
+}
+/**
+* Verify a ticket under `secretHash`. Returns the payload, or `null` when the
+* signature, shape, expiry or nodeId fails (no reason string — refuse quietly).
+*/
+function verifyAgentUiUnlockTicket(secretHash, ticket, options) {
+	const nowMs = options.nowMs ?? Date.now();
+	const dot = ticket.indexOf(".");
+	if (dot <= 0 || dot === ticket.length - 1) return null;
+	const payloadB64 = ticket.slice(0, dot);
+	const sig = ticket.slice(dot + 1);
+	if (!sigsEqual(sign(secretHash, payloadB64), sig)) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
+	} catch {
+		return null;
+	}
+	const payload = parsePayload(parsed);
+	if (payload === null) return null;
+	if (payload.exp <= nowMs) return null;
+	if (payload.nodeId !== options.expectedNodeId) return null;
+	return payload;
+}
+/**
+* True when `returnTo` may receive a ticket redirect. Default: any http(s)
+* origin whose port is 4444. Extra origins come from
+* {@link AGENT_DASHBOARD_ORIGINS_FIELD} (exact origin match).
+*/
+function isAllowedAgentDashboardReturnTo(returnTo, extraOrigins = []) {
+	let url;
+	try {
+		url = new URL(returnTo);
+	} catch {
+		return false;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+	if (url.username !== "" || url.password !== "") return false;
+	if (url.pathname !== "/" && url.pathname !== "") return false;
+	if (url.port === "4444") return true;
+	const origin = url.origin;
+	return extraOrigins.some((o) => o === origin);
+}
+/** Parse a stored comma/whitespace-separated origins list. */
+function parseAgentDashboardOrigins(stored) {
+	if (typeof stored !== "string" || stored.trim().length === 0) return [];
+	const out = [];
+	for (const part of stored.split(/[,\s]+/)) {
+		const t = part.trim();
+		if (t.length === 0) continue;
+		try {
+			const u = new URL(t);
+			if (u.protocol === "http:" || u.protocol === "https:") out.push(u.origin);
+		} catch {}
+	}
+	return out;
+}
+function sign(secretHash, payloadB64) {
+	return createHmac("sha256", Buffer.from(secretHash, "utf8")).update(`${AGENT_UI_UNLOCK_DOMAIN}|${payloadB64}`, "utf8").digest("base64url");
+}
+function sigsEqual(expected, presented) {
+	const a = Buffer.from(expected, "utf8");
+	const b = Buffer.from(presented, "utf8");
+	if (a.length !== b.length) return false;
+	return timingSafeEqual(a, b);
+}
+function parsePayload(value) {
+	if (typeof value !== "object" || value === null) return null;
+	const rec = value;
+	if (rec["v"] !== 1) return null;
+	const nodeId = rec["nodeId"];
+	const exp = rec["exp"];
+	const jti = rec["jti"];
+	if (typeof nodeId !== "string" || nodeId.length === 0) return null;
+	if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
+	if (typeof jti !== "string" || jti.length === 0) return null;
+	return {
+		v: 1,
+		nodeId,
+		exp,
+		jti
+	};
+}
+//#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-ca.ts
 cryptoProvider.set(webcrypto);
 var MS_PER_DAY = 864e5;
@@ -87650,7 +87789,7 @@ function isTlsSocket(socket) {
 *  - no marker            → the secret is MANDATORY (D802): the keeper asks
 *                           its owner to generate one (`generateSecret`), and
 *                           until that succeeds the gate is `off` — no node can
-*                           authenticate, and only `transition` lets them in;
+*                           authenticate (mesh auth is always enforced, D821);
 *  - marker + value       → `on`  — nodes prove the secret;
 *  - marker, no answer    → `unknown` — refused, retryably, and retried here.
 *    A locked keychain or a value lost to a reset NEVER opens the gate, and
@@ -87713,7 +87852,7 @@ var ClusterSecretKeeper = class {
 				reason: `settings unreadable: ${errText(err)}`
 			};
 		}
-		setProcessMeshAuthMode(parseMeshAuthMode(section[MESH_AUTH_MODE_FIELD]));
+		setProcessMeshAuthMode("enforced");
 		const stored = section[CLUSTER_SECRET_FIELD];
 		if (stored === void 0 || stored === null || stored === "") return { kind: "off" };
 		if (!isSecretMarker(stored)) return {
@@ -87781,28 +87920,48 @@ function errText(err) {
 //#endregion
 //#region src/builtins/system-config/mesh-actions.ts
 /**
-* System → Cluster — mint a single-use mesh join token (Release A).
+* System → Cluster — mint a single-use mesh join token (Release A) and
+* agent-ui unlock tickets (D821).
 */
-var systemConfigMeshActions = defineCustomActions({ mintJoinToken: customAction(z.object({
-	/** Optional pinned node id for the CSR CN. */
-	nodeId: z.string().min(1).optional(),
-	/** Override hub HTTPS base (default: local-network publicEndpoint). */
-	hubUrl: z.string().url().optional(),
-	/** Override `host:6000` clear mesh address carried in the token. */
-	hubMeshAddress: z.string().min(3).optional(),
-	/** Seconds until expiry; capped at 1 h. */
-	ttlSec: z.number().int().positive().max(3600).optional()
-}).optional(), z.object({
-	token: z.string().min(1),
-	exp: z.number().int(),
-	hubUrl: z.string(),
-	hubMeshAddress: z.string(),
-	caFingerprint: z.string(),
-	nodeId: z.string().optional()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}) });
+var systemConfigMeshActions = defineCustomActions({
+	mintJoinToken: customAction(z.object({
+		/** Optional pinned node id for the CSR CN. */
+		nodeId: z.string().min(1).optional(),
+		/** Override hub HTTPS base (default: local-network publicEndpoint). */
+		hubUrl: z.string().url().optional(),
+		/** Override `host:6000` clear mesh address carried in the token. */
+		hubMeshAddress: z.string().min(3).optional(),
+		/** Seconds until expiry; capped at 1 h. */
+		ttlSec: z.number().int().positive().max(3600).optional()
+	}).optional(), z.object({
+		token: z.string().min(1),
+		exp: z.number().int(),
+		hubUrl: z.string(),
+		hubMeshAddress: z.string(),
+		caFingerprint: z.string(),
+		nodeId: z.string().optional()
+	}), {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	/** Hub admin → short-lived ticket the agent redeems for a tab session (D821). */
+	mintAgentUiUnlockTicket: customAction(z.object({
+		nodeId: z.string().min(1),
+		/**
+		* Preferred agent dashboard base (`http://host:4444`). When set, the
+		* answer includes `dashboardUrl` with `?ticket=` already attached.
+		*/
+		dashboardBaseUrl: z.string().url().optional()
+	}), z.object({
+		ticket: z.string().min(1),
+		exp: z.number().int(),
+		nodeId: z.string().min(1),
+		dashboardUrl: z.string().url().optional()
+	}), {
+		kind: "mutation",
+		auth: "admin"
+	})
+});
 //#endregion
 //#region src/builtins/system-config/system-config.addon.ts
 /**
@@ -87867,7 +88026,8 @@ var KEY_TO_SECTION = {
 	trustedNetworks: "auth",
 	[CLUSTER_SECRET_FIELD]: "cluster",
 	[MESH_AUTH_MODE_FIELD]: "cluster",
-	[MESH_CLEAR_PORT_FIELD]: "cluster"
+	[MESH_CLEAR_PORT_FIELD]: "cluster",
+	[AGENT_DASHBOARD_ORIGINS_FIELD]: "cluster"
 };
 /** Bytes of a generated cluster secret (D802) — 256 bits, base64url (43 chars). */
 var GENERATED_SECRET_BYTES = 32;
@@ -87876,10 +88036,10 @@ var STATE_LABELS = {
 	legacy: "legacy hash only — update the agent",
 	unauthenticated: "not authenticated — enter the cluster secret in this agent"
 };
-/** The Cluster page's live line per node (D802). */
+/** The Cluster page's live line per node (D802). Mode is always enforced (D821). */
 function describeMeshStatus(status) {
 	if (status === null) return "The mesh status is available on the hub only.";
-	const head = status.mode === "enforced" ? "Enforced: a node that has not authenticated is refused." : "Transition: nodes without the secret are still let in (with a warning). The hub switches to Enforced by itself once every known agent has authenticated.";
+	const head = "Enforced: a node that has not authenticated is refused.";
 	if (status.nodes.length === 0) return `${head}\nNo other node is connected.`;
 	return `${head}\n${status.nodes.map((n) => `• ${n.nodeId}: ${STATE_LABELS[n.state] ?? n.state}`).join("\n")}`;
 }
@@ -87910,6 +88070,9 @@ var SystemConfigAddon = class extends BaseAddon {
 			this.ctx.logger.info("Mesh authentication is now ENFORCED", { meta: { reason } });
 		});
 		await this.clusterSecretKeeper.start();
+		try {
+			await this.writeMeshAuthMode("enforced");
+		} catch {}
 		this.meshCaKeeper = new MeshCaKeeper({
 			secrets: this.systemSecrets(),
 			readClusterSection: async () => await this.ctx.settings?.getSection("cluster") ?? {},
@@ -87924,7 +88087,10 @@ var SystemConfigAddon = class extends BaseAddon {
 		this.ctx.logger.info("Initialized — exposes yml-backed sections via getGlobalSettings");
 		return {
 			customActions: systemConfigMeshActions,
-			actionHandlers: { mintJoinToken: async (input) => this.mintJoinToken(parseMintJoinTokenInput(input)) }
+			actionHandlers: {
+				mintJoinToken: async (input) => this.mintJoinToken(parseMintJoinTokenInput(input)),
+				mintAgentUiUnlockTicket: async (input) => this.mintAgentUiUnlock(parseMintUnlockInput(input))
+			}
 		};
 	}
 	async onShutdown() {
@@ -87977,6 +88143,41 @@ var SystemConfigAddon = class extends BaseAddon {
 			...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {}
 		};
 	}
+	/** D821 — short-lived ticket for the agent's `:4444` unlock session. */
+	async mintAgentUiUnlock(input) {
+		const secrets = this.systemSecrets();
+		if (secrets === null) throw new Error("system-config: no keychain door — cannot mint an unlock ticket");
+		const entry = (await secrets.resolve([CLUSTER_SECRET_REF]))[CLUSTER_SECRET_REF];
+		if (entry?.kind !== "value") throw new Error("system-config: cluster secret is not available — cannot mint an unlock ticket");
+		if (input.dashboardBaseUrl !== void 0) {
+			const origins = await this.readAgentDashboardOrigins();
+			if (!isAllowedAgentDashboardReturnTo(input.dashboardBaseUrl, origins)) throw new Error("dashboardBaseUrl is not an allowed agent dashboard origin (:4444 or agentDashboardOrigins)");
+		}
+		const ticket = mintAgentUiUnlockTicket({
+			secretHash: hashClusterSecret(entry.value),
+			nodeId: input.nodeId
+		});
+		const payloadJson = Buffer.from(ticket.split(".")[0] ?? "", "base64url").toString("utf8");
+		const exp = JSON.parse(payloadJson).exp ?? 0;
+		const dashboardUrl = input.dashboardBaseUrl === void 0 ? void 0 : (() => {
+			const u = new URL(input.dashboardBaseUrl);
+			u.searchParams.set("ticket", ticket);
+			return u.toString();
+		})();
+		return {
+			ticket,
+			exp,
+			nodeId: input.nodeId,
+			...dashboardUrl !== void 0 ? { dashboardUrl } : {}
+		};
+	}
+	async readAgentDashboardOrigins() {
+		try {
+			return parseAgentDashboardOrigins((await this.ctx.settings?.getSection("cluster"))?.[AGENT_DASHBOARD_ORIGINS_FIELD]);
+		} catch {
+			return [];
+		}
+	}
 	async resolveHubUrl() {
 		try {
 			const book = await this.ctx.api?.localNetwork?.getAddresses?.query({ scheme: "https" });
@@ -88096,20 +88297,6 @@ var SystemConfigAddon = class extends BaseAddon {
 						label: "Cluster secret",
 						description: "Mandatory — generated by the hub at first boot and stored in the keychain. To pair an agent: Reveal and copy it here, then enter it in the agent (its status page, or the desktop setup window). Saving a new value rotates it: every agent must then be given the new one."
 					},
-					{
-						type: "select",
-						key: MESH_AUTH_MODE_FIELD,
-						label: "Agents without the secret",
-						description: "Transition lets an agent that has not authenticated keep working (with a warning) while you give each agent the secret; it ends by itself once every known agent has authenticated. Enforced refuses it.",
-						default: "transition",
-						options: [{
-							value: "transition",
-							label: "Transition — allow, warn"
-						}, {
-							value: "enforced",
-							label: "Enforced — refuse"
-						}]
-					},
 					{
 						type: "select",
 						key: MESH_CLEAR_PORT_FIELD,
@@ -88131,6 +88318,12 @@ var SystemConfigAddon = class extends BaseAddon {
 						content: describeMeshStatus(getProcessMeshAuthStatus()),
 						variant: "info"
 					},
+					{
+						type: "string",
+						key: AGENT_DASHBOARD_ORIGINS_FIELD,
+						label: "Agent dashboard origins (NPM)",
+						description: "Extra origins allowed for Continue-with-hub unlock redirects (comma-separated), e.g. https://agent.example.com. LAN agents on :4444 are always allowed."
+					},
 					{
 						type: "addon-action-button",
 						key: "mintJoinTokenAction",
@@ -88203,15 +88396,14 @@ var SystemConfigAddon = class extends BaseAddon {
 	* The cluster secret's save path: the value goes to the keychain (owner
 	* `system`), the row gets the marker; `''` / a view keeps. `$secretClear` is
 	* REFUSED: the secret is mandatory (D802). A value the keychain cannot store
-	* is REFUSED — never written inline (D787, P5). `meshAuth` is a plain value.
+	* is REFUSED — never written inline (D787, P5). Mesh auth mode is always
+	* enforced (D821) — a legacy `meshAuth` in the patch is ignored.
 	*/
 	async writeClusterSection(patch) {
-		const { [MESH_AUTH_MODE_FIELD]: mode, [MESH_CLEAR_PORT_FIELD]: clearPort, ...secretPatch } = patch;
+		const { [MESH_AUTH_MODE_FIELD]: _legacyMode, [MESH_CLEAR_PORT_FIELD]: clearPort, [AGENT_DASHBOARD_ORIGINS_FIELD]: dashboardOrigins, ...secretPatch } = patch;
 		if (clearPort !== void 0) await this.writeMeshClearPort(clearPort);
-		if (mode !== void 0) {
-			if (!isMeshAuthMode(mode)) throw new Error(`system-config: meshAuth must be 'transition' or 'enforced'`);
-			await this.writeMeshAuthMode(mode);
-		}
+		if (dashboardOrigins !== void 0) await this.ctx.settings.setSection("cluster", { [AGENT_DASHBOARD_ORIGINS_FIELD]: typeof dashboardOrigins === "string" ? dashboardOrigins : "" });
+		await this.writeMeshAuthMode("enforced");
 		if (Object.keys(secretPatch).length === 0) return;
 		if (isSecretClear(secretPatch["clusterSecret"])) throw new Error("The cluster secret is mandatory and cannot be cleared — save a new value to rotate it");
 		await this.storeClusterSecret(secretPatch);
@@ -88239,16 +88431,15 @@ var SystemConfigAddon = class extends BaseAddon {
 		await applyProcessMeshClearPort(value);
 		this.ctx.logger.info("Mesh clear port switched", { meta: { mode: value } });
 	}
-	/** `cluster.meshAuth` (D802), then republish it. */
+	/** Persist + publish mesh auth mode (always `enforced` after D821). */
 	async writeMeshAuthMode(mode) {
 		await this.ctx.settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: mode });
-		await this.clusterSecretKeeper?.reload();
+		setProcessMeshAuthMode(mode);
 	}
 	/**
 	* First boot, or a keychain reset that cleared the marker (D802): a fresh
-	* random secret, stored like an operator save. A NEW secret means every
-	* agent must be given it, so the mesh goes (back) to `transition`; on a hub
-	* with no agent yet, the hub's auto-enforce ends it at once.
+	* random secret, stored like an operator save. Mesh auth stays enforced
+	* (D821) — every agent must present the secret; there is no transition window.
 	*/
 	async generateClusterSecret() {
 		const settings = this.ctx.settings;
@@ -88263,7 +88454,8 @@ var SystemConfigAddon = class extends BaseAddon {
 		if (existing?.kind !== "missing") throw new Error(`the keychain cannot answer for the cluster secret (${existing?.kind ?? "no answer"})`);
 		const value = randomBytes(GENERATED_SECRET_BYTES).toString("base64url");
 		await this.storeClusterSecret({ [CLUSTER_SECRET_FIELD]: value });
-		await settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: "transition" });
+		await settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: "enforced" });
+		setProcessMeshAuthMode("enforced");
 	}
 	async storeClusterSecret(patch) {
 		const settings = this.ctx.settings;
@@ -88296,6 +88488,16 @@ function parseMintJoinTokenInput(input) {
 	if (typeof ttlSec === "number") out.ttlSec = ttlSec;
 	return out;
 }
+function parseMintUnlockInput(input) {
+	if (input === null || typeof input !== "object") throw new Error("system-config: mintAgentUiUnlockTicket requires { nodeId }");
+	const nodeId = Reflect.get(input, "nodeId");
+	if (typeof nodeId !== "string" || nodeId.length === 0) throw new Error("system-config: mintAgentUiUnlockTicket requires { nodeId }");
+	const dashboardBaseUrl = Reflect.get(input, "dashboardBaseUrl");
+	return {
+		nodeId,
+		...typeof dashboardBaseUrl === "string" ? { dashboardBaseUrl } : {}
+	};
+}
 /** Read `exp` from an unencrypted JWT payload (no verify — already minted here). */
 function readJwtExp(token) {
 	const parts = token.split(".");
@@ -88307,4 +88509,4 @@ function readJwtExp(token) {
 	return typeof exp === "number" ? exp : 0;
 }
 //#endregion
-export { loadMeshCa as A, createCidrMatcher as B, caFingerprintCompact as C, generateMeshKeyPair as D, generateMeshCa as E, parseMeshAuthMode as F, parseCidrList as H, requestProcessMeshEnforcement as I, setProcessMeshAuthMode as L, getProcessMeshAuthMode as M, getProcessMeshAuthStatus as N, issueMeshLeafForNode as O, isMeshAuthMode as P, setProcessMeshAuthStatusSource as R, caFingerprint as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, exportMeshPrivateKeyPem as T, readCidrSetting as U, normalizeIp as V, MeshCrl as _, setProcessMeshTlsEnabler as a, getProcessMeshCaState as b, mintMeshJoinToken as c, MESH_CLEAR_PORT_FIELD as d, applyProcessMeshClearPort as f, setProcessMeshClearPortControl as g, getProcessNodeMeshTransport as h, ServiceBroker as i, MESH_AUTH_MODE_FIELD as j, issueMeshLeafFromCsr as k, processJoinTokenJtiStore as l, decideMeshClearPortOff as m, TlsTcpTransporter as n, enrollMeshNode as o, checkProcessMeshClearPort as p, Errors as r, JoinTokenJtiStore as s, systemConfigMeshActions as t, verifyMeshJoinToken as u, processMeshCrl as v, createMeshCsrPem as w, requireProcessMeshCa as x, MeshCaKeeper as y, setProcessMeshEnforcer as z };
+export { loadMeshCa as A, MESH_AUTH_MODE_FIELD as B, caFingerprintCompact as C, generateMeshKeyPair as D, generateMeshCa as E, UnlockTicketJtiStore as F, requestProcessMeshEnforcement as G, getProcessMeshAuthStatus as H, isAllowedAgentDashboardReturnTo as I, setProcessMeshEnforcer as J, setProcessMeshAuthMode as K, mintAgentUiUnlockTicket as L, AGENT_UI_UNLOCK_DOMAIN as M, AGENT_UI_UNLOCK_TTL_MS as N, issueMeshLeafForNode as O, AGENT_UI_UNLOCK_VERSION as P, readCidrSetting as Q, parseAgentDashboardOrigins as R, caFingerprint as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, exportMeshPrivateKeyPem as T, isMeshAuthMode as U, getProcessMeshAuthMode as V, parseMeshAuthMode as W, normalizeIp as X, createCidrMatcher as Y, parseCidrList as Z, MeshCrl as _, setProcessMeshTlsEnabler as a, getProcessMeshCaState as b, mintMeshJoinToken as c, MESH_CLEAR_PORT_FIELD as d, applyProcessMeshClearPort as f, setProcessMeshClearPortControl as g, getProcessNodeMeshTransport as h, ServiceBroker as i, AGENT_DASHBOARD_ORIGINS_FIELD as j, issueMeshLeafFromCsr as k, processJoinTokenJtiStore as l, decideMeshClearPortOff as m, TlsTcpTransporter as n, enrollMeshNode as o, checkProcessMeshClearPort as p, setProcessMeshAuthStatusSource as q, Errors as r, JoinTokenJtiStore as s, systemConfigMeshActions as t, verifyMeshJoinToken as u, processMeshCrl as v, createMeshCsrPem as w, requireProcessMeshCa as x, MeshCaKeeper as y, verifyAgentUiUnlockTicket as z };

package/dist/index.js

@@ -13863,8 +13863,12 @@ exports.ADMIN_TOKEN_MAX_LIFETIME_MS = require_builtins_local_auth_local_auth_add
 exports.ADMIN_TOKEN_PREFIX = require_builtins_local_auth_local_auth_addon.ADMIN_TOKEN_PREFIX;
 exports.AGENT_CAP_FWD_ACTION = require_child_cap_dispatch.AGENT_CAP_FWD_ACTION;
 exports.AGENT_CAP_FWD_SERVICE = require_child_cap_dispatch.AGENT_CAP_FWD_SERVICE;
+exports.AGENT_DASHBOARD_ORIGINS_FIELD = require_builtins_system_config_system_config_addon.AGENT_DASHBOARD_ORIGINS_FIELD;
 exports.AGENT_READINESS_SERVICE_NAME = AGENT_READINESS_SERVICE_NAME;
 exports.AGENT_REGISTER_NODE_ACTION = AGENT_REGISTER_NODE_ACTION;
+exports.AGENT_UI_UNLOCK_DOMAIN = require_builtins_system_config_system_config_addon.AGENT_UI_UNLOCK_DOMAIN;
+exports.AGENT_UI_UNLOCK_TTL_MS = require_builtins_system_config_system_config_addon.AGENT_UI_UNLOCK_TTL_MS;
+exports.AGENT_UI_UNLOCK_VERSION = require_builtins_system_config_system_config_addon.AGENT_UI_UNLOCK_VERSION;
 exports.ALL_CAPABILITY_DEFINITIONS = require_dist.ALL_CAPABILITY_DEFINITIONS;
 exports.ARRAY_BUFFER_CENSUS_COOLDOWN_MS = require_child_cap_dispatch.ARRAY_BUFFER_CENSUS_COOLDOWN_MS;
 exports.ARRAY_BUFFER_CENSUS_SUSTAIN_MS = require_child_cap_dispatch.ARRAY_BUFFER_CENSUS_SUSTAIN_MS;
@@ -14060,6 +14064,7 @@ exports.UPLOADED_CA_FILE = require_tls.UPLOADED_CA_FILE;
 exports.USER_MANAGEMENT_INTERNAL = require_builtins_local_auth_local_auth_addon.USER_MANAGEMENT_INTERNAL;
 exports.UdsLocalTransportClient = require_child_cap_dispatch.UdsLocalTransportClient;
 exports.UdsLocalTransportServer = require_child_cap_dispatch.UdsLocalTransportServer;
+exports.UnlockTicketJtiStore = require_builtins_system_config_system_config_addon.UnlockTicketJtiStore;
 exports.UserManager = require_builtins_local_auth_local_auth_addon.UserManager;
 exports.WinstonDestination = require_builtins_winston_logging_index.WinstonDestination$1;
 exports.WinstonLoggingAddon = require_builtins_winston_logging_index.WinstonLoggingAddon$1;
@@ -14292,6 +14297,7 @@ Object.defineProperty(exports, "installPythonRequirements", {
 });
 exports.ipcParentLink = require_child_cap_dispatch.ipcParentLink;
 exports.isAddonDeploySource = isAddonDeploySource;
+exports.isAllowedAgentDashboardReturnTo = require_builtins_system_config_system_config_addon.isAllowedAgentDashboardReturnTo;
 exports.isArrayBufferCensusReport = require_child_cap_dispatch.isArrayBufferCensusReport;
 exports.isArrayOutputSchema = require_dist.isArrayOutputSchema;
 exports.isClusterSecretMismatchError = require_constants.isClusterSecretMismatchError;
@@ -14314,11 +14320,13 @@ exports.loadTlsCert = require_tls.loadTlsCert;
 exports.localEndpointPath = require_child_cap_dispatch.localEndpointPath;
 exports.localProviderLink = require_child_cap_dispatch.localProviderLink;
 exports.meshErrorType = meshErrorType;
+exports.mintAgentUiUnlockTicket = require_builtins_system_config_system_config_addon.mintAgentUiUnlockTicket;
 exports.mintMeshJoinToken = require_builtins_system_config_system_config_addon.mintMeshJoinToken;
 exports.mountNativeCapService = require_child_cap_dispatch.mountNativeCapService;
 exports.nextRssBudgetState = require_child_cap_dispatch.nextRssBudgetState;
 exports.normalizeIp = require_builtins_system_config_system_config_addon.normalizeIp;
 exports.overlayGetStatus = overlayGetStatus;
+exports.parseAgentDashboardOrigins = require_builtins_system_config_system_config_addon.parseAgentDashboardOrigins;
 exports.parseCapAction = require_child_cap_dispatch.parseCapAction;
 exports.parseCidrList = require_builtins_system_config_system_config_addon.parseCidrList;
 exports.parseMeshAuthMode = require_builtins_system_config_system_config_addon.parseMeshAuthMode;
@@ -14404,6 +14412,7 @@ exports.subscribePassthrough = require_child_cap_dispatch.subscribePassthrough;
 exports.udsChildLogToWorkerEntry = require_child_cap_dispatch.udsChildLogToWorkerEntry;
 exports.validateProviderRegistrations = require_child_cap_dispatch.validateProviderRegistrations;
 exports.validateUploadedTls = require_tls.validateUploadedTls;
+exports.verifyAgentUiUnlockTicket = require_builtins_system_config_system_config_addon.verifyAgentUiUnlockTicket;
 exports.verifyMeshJoinToken = require_builtins_system_config_system_config_addon.verifyMeshJoinToken;
 exports.waitUntilReady = waitUntilReady;
 exports.writeExtraSans = require_tls.writeExtraSans;

package/dist/index.mjs

@@ -27,7 +27,7 @@ import { i as stripForwardedCaller, n as HUB_CAP_FWD_SERVICE, r as createHubCapF
 import { StorageOrchestratorAddon, n as buildStorageLocationRegistry, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
 import { _ as clusterSecretMatches, a as MESH_CA_FIELD, b as isClusterSecretMismatchError, d as CLUSTER_SECRET_MISMATCH_TYPE, f as CLUSTER_SECRET_REF, g as checkClusterSecret, h as CLUSTER_SECRET_UNAVAILABLE_TYPE, m as CLUSTER_SECRET_SETTINGS_KEY, o as MESH_CA_KEY_REF, p as CLUSTER_SECRET_REJECTED_EXIT_CODE, r as DEFAULT_HUB_TLS_TCP_PORT, s as MESH_CA_SETTINGS_KEY, v as getProcessClusterSecretGate, x as setProcessClusterSecretGate, y as hashClusterSecret } from "./constants-D5z4EwY8.mjs";
-import { A as loadMeshCa, B as createCidrMatcher, C as caFingerprintCompact, D as generateMeshKeyPair, E as generateMeshCa, F as parseMeshAuthMode, H as parseCidrList, I as requestProcessMeshEnforcement, L as setProcessMeshAuthMode, M as getProcessMeshAuthMode, N as getProcessMeshAuthStatus, O as issueMeshLeafForNode, P as isMeshAuthMode, R as setProcessMeshAuthStatusSource, S as caFingerprint, SystemConfigAddon, T as exportMeshPrivateKeyPem, U as readCidrSetting, V as normalizeIp, _ as MeshCrl, a as setProcessMeshTlsEnabler, b as getProcessMeshCaState, c as mintMeshJoinToken, d as MESH_CLEAR_PORT_FIELD, f as applyProcessMeshClearPort, g as setProcessMeshClearPortControl, h as getProcessNodeMeshTransport, i as ServiceBroker, j as MESH_AUTH_MODE_FIELD, k as issueMeshLeafFromCsr, l as processJoinTokenJtiStore, m as decideMeshClearPortOff, n as TlsTcpTransporter, o as enrollMeshNode, p as checkProcessMeshClearPort, r as Errors, s as JoinTokenJtiStore, u as verifyMeshJoinToken, v as processMeshCrl, w as createMeshCsrPem, x as requireProcessMeshCa, y as MeshCaKeeper, z as setProcessMeshEnforcer } from "./builtins/system-config/system-config.addon.mjs";
+import { A as loadMeshCa, B as MESH_AUTH_MODE_FIELD, C as caFingerprintCompact, D as generateMeshKeyPair, E as generateMeshCa, F as UnlockTicketJtiStore, G as requestProcessMeshEnforcement, H as getProcessMeshAuthStatus, I as isAllowedAgentDashboardReturnTo, J as setProcessMeshEnforcer, K as setProcessMeshAuthMode, L as mintAgentUiUnlockTicket, M as AGENT_UI_UNLOCK_DOMAIN, N as AGENT_UI_UNLOCK_TTL_MS, O as issueMeshLeafForNode, P as AGENT_UI_UNLOCK_VERSION, Q as readCidrSetting, R as parseAgentDashboardOrigins, S as caFingerprint, SystemConfigAddon, T as exportMeshPrivateKeyPem, U as isMeshAuthMode, V as getProcessMeshAuthMode, W as parseMeshAuthMode, X as normalizeIp, Y as createCidrMatcher, Z as parseCidrList, _ as MeshCrl, a as setProcessMeshTlsEnabler, b as getProcessMeshCaState, c as mintMeshJoinToken, d as MESH_CLEAR_PORT_FIELD, f as applyProcessMeshClearPort, g as setProcessMeshClearPortControl, h as getProcessNodeMeshTransport, i as ServiceBroker, j as AGENT_DASHBOARD_ORIGINS_FIELD, k as issueMeshLeafFromCsr, l as processJoinTokenJtiStore, m as decideMeshClearPortOff, n as TlsTcpTransporter, o as enrollMeshNode, p as checkProcessMeshClearPort, q as setProcessMeshAuthStatusSource, r as Errors, s as JoinTokenJtiStore, u as verifyMeshJoinToken, v as processMeshCrl, w as createMeshCsrPem, x as requireProcessMeshCa, y as MeshCaKeeper, z as verifyAgentUiUnlockTicket } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as resolveFormatRevision, S as isModelDownloaded, _ as downloadModel, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as ensureModel, w as revisionWeightUrl, y as fetchJson } from "./event-loop-stall-monitor-BtK_0Pjc.mjs";
@@ -13856,4 +13856,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentMeshAuthenticator, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_CLEAR_PORT_FIELD, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCrl, MeshJoinClient, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, applyProcessMeshClearPort, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, checkClusterSecret, checkProcessMeshClearPort, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, decideMeshAutoEnforce, decideMeshClearPortOff, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessNodeMeshTransport, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isCredentialKeyName, isInfraCapability, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, issueMeshLeafForNode, issueMeshLeafFromCsr, leafFingerprintOf, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, meshErrorType, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, overlayGetStatus, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, prepareRestoreArchive, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshClearPortControl, setProcessMeshEnforcer, setProcessMeshTlsEnabler, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyMeshJoinToken, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentMeshAuthenticator, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_CLEAR_PORT_FIELD, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCrl, MeshJoinClient, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, applyProcessMeshClearPort, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, checkClusterSecret, checkProcessMeshClearPort, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, decideMeshAutoEnforce, decideMeshClearPortOff, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessNodeMeshTransport, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isCredentialKeyName, isInfraCapability, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, issueMeshLeafForNode, issueMeshLeafFromCsr, leafFingerprintOf, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, meshErrorType, mintAgentUiUnlockTicket, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, prepareRestoreArchive, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshClearPortControl, setProcessMeshEnforcer, setProcessMeshTlsEnabler, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyMeshJoinToken, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/index.d.ts

@@ -69,6 +69,8 @@ export type { MeshJoinAuthenticateParams, MeshJoinAuthenticateResult, MeshJoinCh
 export { getProcessMeshAuthMode, getProcessMeshAuthStatus, isMeshAuthMode, MESH_AUTH_MODE_FIELD, parseMeshAuthMode, requestProcessMeshEnforcement, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshEnforcer, } from './moleculer/mesh-auth-mode.js';
 export { decideMeshAutoEnforce, MESH_AUTO_ENFORCE_GRACE_MS, } from './moleculer/mesh-auto-enforce.js';
 export type { MeshAutoEnforceDecision, MeshAutoEnforceInput, } from './moleculer/mesh-auto-enforce.js';
+export { AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, isAllowedAgentDashboardReturnTo, mintAgentUiUnlockTicket, parseAgentDashboardOrigins, UnlockTicketJtiStore, verifyAgentUiUnlockTicket, } from './moleculer/agent-ui-unlock.js';
+export type { AgentUiUnlockPayload, MintAgentUiUnlockTicketInput, VerifyAgentUiUnlockTicketOptions, } from './moleculer/agent-ui-unlock.js';
 export type { MeshAuthMode, MeshAuthStatus, MeshEnforcer, MeshNodeAuthEntry, MeshNodeAuthState, } from './moleculer/mesh-auth-mode.js';
 export { serializeTypedArrays } from './moleculer/typed-array-serde.js';
 export { createReadinessService, createReadinessServiceForRegistry, AGENT_READINESS_SERVICE_NAME, } from './moleculer/readiness-service.js';

package/dist/kernel/moleculer/agent-ui-unlock.d.ts

@@ -0,0 +1,52 @@
+export declare const AGENT_UI_UNLOCK_DOMAIN = "camstack-agent-ui-unlock/v1";
+export declare const AGENT_UI_UNLOCK_VERSION: 1;
+/** Ticket lifetime — long enough for a redirect hop, short enough to steal poorly. */
+export declare const AGENT_UI_UNLOCK_TTL_MS: number;
+/**
+ * Cluster settings key: extra origins allowed as `returnTo` for Continue-with-hub
+ * (NPM hostnames that are not `:4444` on a LAN IP). Comma-separated origins.
+ */
+export declare const AGENT_DASHBOARD_ORIGINS_FIELD = "agentDashboardOrigins";
+export interface AgentUiUnlockPayload {
+    readonly v: typeof AGENT_UI_UNLOCK_VERSION;
+    readonly nodeId: string;
+    /** Epoch ms. */
+    readonly exp: number;
+    readonly jti: string;
+}
+/** In-memory spent `jti` until `exp` (ms). */
+export declare class UnlockTicketJtiStore {
+    private readonly spent;
+    isSpent(jti: string, nowMs?: number): boolean;
+    /** Record a jti as used until `exp`. Returns false if already spent. */
+    consume(jti: string, exp: number, nowMs?: number): boolean;
+    /** Test helper. */
+    size(): number;
+    private gc;
+}
+export interface MintAgentUiUnlockTicketInput {
+    /** `hashClusterSecret(secret)` — never the raw secret. */
+    readonly secretHash: string;
+    readonly nodeId: string;
+    readonly ttlMs?: number;
+    readonly nowMs?: number;
+    readonly jti?: string;
+}
+export declare function mintAgentUiUnlockTicket(input: MintAgentUiUnlockTicketInput): string;
+export interface VerifyAgentUiUnlockTicketOptions {
+    readonly expectedNodeId: string;
+    readonly nowMs?: number;
+}
+/**
+ * Verify a ticket under `secretHash`. Returns the payload, or `null` when the
+ * signature, shape, expiry or nodeId fails (no reason string — refuse quietly).
+ */
+export declare function verifyAgentUiUnlockTicket(secretHash: string, ticket: string, options: VerifyAgentUiUnlockTicketOptions): AgentUiUnlockPayload | null;
+/**
+ * True when `returnTo` may receive a ticket redirect. Default: any http(s)
+ * origin whose port is 4444. Extra origins come from
+ * {@link AGENT_DASHBOARD_ORIGINS_FIELD} (exact origin match).
+ */
+export declare function isAllowedAgentDashboardReturnTo(returnTo: string, extraOrigins?: readonly string[]): boolean;
+/** Parse a stored comma/whitespace-separated origins list. */
+export declare function parseAgentDashboardOrigins(stored: unknown): readonly string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.385",
+  "version": "1.2.387",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",