@camstack/system 1.2.386 → 1.2.388

package/dist/builtins/system-config/mesh-actions.d.ts

@@ -15,5 +15,17 @@ export declare const systemConfigMeshActions: {
     }, z.core.$strip>, "mutation", "admin", {
         readonly kind: "system";
     }>;
+    /** Hub admin → short-lived ticket the agent redeems for a tab session (D821). */
+    mintAgentUiUnlockTicket: import('@camstack/types').CustomActionSpec<z.ZodObject<{
+        nodeId: z.ZodString;
+        dashboardBaseUrl: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        ticket: z.ZodString;
+        exp: z.ZodNumber;
+        nodeId: z.ZodString;
+        dashboardUrl: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, "mutation", "admin", {
+        readonly kind: "system";
+    }>;
 };
 export type SystemConfigMeshActions = typeof systemConfigMeshActions;

package/dist/builtins/system-config/system-config.addon.d.ts

@@ -23,6 +23,17 @@ export declare class SystemConfigAddon extends BaseAddon {
             }, import('zod/v4/core').$strip>, "mutation", "admin", {
                 readonly kind: "system";
             }>;
+            mintAgentUiUnlockTicket: import('@camstack/types').CustomActionSpec<import('zod').ZodObject<{
+                nodeId: import('zod').ZodString;
+                dashboardBaseUrl: import('zod').ZodOptional<import('zod').ZodString>;
+            }, import('zod/v4/core').$strip>, import('zod').ZodObject<{
+                ticket: import('zod').ZodString;
+                exp: import('zod').ZodNumber;
+                nodeId: import('zod').ZodString;
+                dashboardUrl: import('zod').ZodOptional<import('zod').ZodString>;
+            }, import('zod/v4/core').$strip>, "mutation", "admin", {
+                readonly kind: "system";
+            }>;
         };
         actionHandlers: {
             mintJoinToken: (input: unknown) => Promise<{
@@ -33,6 +44,12 @@ export declare class SystemConfigAddon extends BaseAddon {
                 caFingerprint: string;
                 nodeId?: string;
             }>;
+            mintAgentUiUnlockTicket: (input: unknown) => Promise<{
+                ticket: string;
+                exp: number;
+                nodeId: string;
+                dashboardUrl?: string;
+            }>;
         };
     }>;
     protected onShutdown(): Promise<void>;
@@ -44,6 +61,9 @@ export declare class SystemConfigAddon extends BaseAddon {
     private applyStoredClearPort;
     private onMeshCaReady;
     private mintJoinToken;
+    /** D821 — short-lived ticket for the agent's `:4444` unlock session. */
+    private mintAgentUiUnlock;
+    private readAgentDashboardOrigins;
     private resolveHubUrl;
     private resolveHubMeshAddress;
     /** The keychain handle for owner `system`; `null` where there is no door. */
@@ -55,7 +75,8 @@ export declare class SystemConfigAddon extends BaseAddon {
      * The cluster secret's save path: the value goes to the keychain (owner
      * `system`), the row gets the marker; `''` / a view keeps. `$secretClear` is
      * REFUSED: the secret is mandatory (D802). A value the keychain cannot store
-     * is REFUSED — never written inline (D787, P5). `meshAuth` is a plain value.
+     * is REFUSED — never written inline (D787, P5). Mesh auth mode is always
+     * enforced (D821) — a legacy `meshAuth` in the patch is ignored.
      */
     private writeClusterSection;
     /**
@@ -64,13 +85,12 @@ export declare class SystemConfigAddon extends BaseAddon {
      * Persist, then apply — an `on` save always passes.
      */
     private writeMeshClearPort;
-    /** `cluster.meshAuth` (D802), then republish it. */
+    /** Persist + publish mesh auth mode (always `enforced` after D821). */
     private writeMeshAuthMode;
     /**
      * First boot, or a keychain reset that cleared the marker (D802): a fresh
-     * random secret, stored like an operator save. A NEW secret means every
-     * agent must be given it, so the mesh goes (back) to `transition`; on a hub
-     * with no agent yet, the hub's auto-enforce ends it at once.
+     * random secret, stored like an operator save. Mesh auth stays enforced
+     * (D821) — every agent must present the secret; there is no transition window.
      */
     private generateClusterSecret;
     private storeClusterSecret;

package/dist/builtins/system-config/system-config.addon.js

@@ -150,6 +150,145 @@ function getProcessMeshAuthStatus() {
 	return typeof source === "function" ? source() : null;
 }
 //#endregion
+//#region src/kernel/moleculer/agent-ui-unlock.ts
+/**
+* Agent UI remote unlock tickets (D821).
+*
+* A hub admin mints a short-lived HMAC ticket bound to one agent `nodeId`.
+* The agent redeems it once for a tab session Bearer — the cluster secret
+* stays a mesh / pairing credential and is not pasted into the browser for
+* daily unlock.
+*
+*   K       = SHA-256(cluster secret)   — same as mesh join (D802)
+*   ticket  = base64url(JSON payload) + '.' + base64url(HMAC-SHA256(K, DOMAIN|payloadB64))
+*   payload = { v: 1, nodeId, exp (ms), jti }
+*/
+var AGENT_UI_UNLOCK_DOMAIN = "camstack-agent-ui-unlock/v1";
+var AGENT_UI_UNLOCK_VERSION = 1;
+/** Ticket lifetime — long enough for a redirect hop, short enough to steal poorly. */
+var AGENT_UI_UNLOCK_TTL_MS = 5 * 6e4;
+/**
+* Cluster settings key: extra origins allowed as `returnTo` for Continue-with-hub
+* (NPM hostnames that are not `:4444` on a LAN IP). Comma-separated origins.
+*/
+var AGENT_DASHBOARD_ORIGINS_FIELD = "agentDashboardOrigins";
+/** In-memory spent `jti` until `exp` (ms). */
+var UnlockTicketJtiStore = class {
+	spent = /* @__PURE__ */ new Map();
+	isSpent(jti, nowMs = Date.now()) {
+		this.gc(nowMs);
+		return this.spent.has(jti);
+	}
+	/** Record a jti as used until `exp`. Returns false if already spent. */
+	consume(jti, exp, nowMs = Date.now()) {
+		this.gc(nowMs);
+		if (this.spent.has(jti)) return false;
+		this.spent.set(jti, exp);
+		return true;
+	}
+	/** Test helper. */
+	size() {
+		return this.spent.size;
+	}
+	gc(nowMs) {
+		for (const [jti, exp] of this.spent) if (exp <= nowMs) this.spent.delete(jti);
+	}
+};
+function mintAgentUiUnlockTicket(input) {
+	const nowMs = input.nowMs ?? Date.now();
+	const ttl = Math.min(Math.max(1e3, input.ttlMs ?? 3e5), AGENT_UI_UNLOCK_TTL_MS);
+	const payload = {
+		v: 1,
+		nodeId: input.nodeId,
+		exp: nowMs + ttl,
+		jti: input.jti ?? (0, node_crypto.randomBytes)(16).toString("base64url")
+	};
+	const payloadB64 = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+	return `${payloadB64}.${sign(input.secretHash, payloadB64)}`;
+}
+/**
+* Verify a ticket under `secretHash`. Returns the payload, or `null` when the
+* signature, shape, expiry or nodeId fails (no reason string — refuse quietly).
+*/
+function verifyAgentUiUnlockTicket(secretHash, ticket, options) {
+	const nowMs = options.nowMs ?? Date.now();
+	const dot = ticket.indexOf(".");
+	if (dot <= 0 || dot === ticket.length - 1) return null;
+	const payloadB64 = ticket.slice(0, dot);
+	const sig = ticket.slice(dot + 1);
+	if (!sigsEqual(sign(secretHash, payloadB64), sig)) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
+	} catch {
+		return null;
+	}
+	const payload = parsePayload(parsed);
+	if (payload === null) return null;
+	if (payload.exp <= nowMs) return null;
+	if (payload.nodeId !== options.expectedNodeId) return null;
+	return payload;
+}
+/**
+* True when `returnTo` may receive a ticket redirect. Default: any http(s)
+* origin whose port is 4444. Extra origins come from
+* {@link AGENT_DASHBOARD_ORIGINS_FIELD} (exact origin match).
+*/
+function isAllowedAgentDashboardReturnTo(returnTo, extraOrigins = []) {
+	let url;
+	try {
+		url = new URL(returnTo);
+	} catch {
+		return false;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+	if (url.username !== "" || url.password !== "") return false;
+	if (url.pathname !== "/" && url.pathname !== "") return false;
+	if (url.port === "4444") return true;
+	const origin = url.origin;
+	return extraOrigins.some((o) => o === origin);
+}
+/** Parse a stored comma/whitespace-separated origins list. */
+function parseAgentDashboardOrigins(stored) {
+	if (typeof stored !== "string" || stored.trim().length === 0) return [];
+	const out = [];
+	for (const part of stored.split(/[,\s]+/)) {
+		const t = part.trim();
+		if (t.length === 0) continue;
+		try {
+			const u = new URL(t);
+			if (u.protocol === "http:" || u.protocol === "https:") out.push(u.origin);
+		} catch {}
+	}
+	return out;
+}
+function sign(secretHash, payloadB64) {
+	return (0, node_crypto.createHmac)("sha256", Buffer.from(secretHash, "utf8")).update(`${AGENT_UI_UNLOCK_DOMAIN}|${payloadB64}`, "utf8").digest("base64url");
+}
+function sigsEqual(expected, presented) {
+	const a = Buffer.from(expected, "utf8");
+	const b = Buffer.from(presented, "utf8");
+	if (a.length !== b.length) return false;
+	return (0, node_crypto.timingSafeEqual)(a, b);
+}
+function parsePayload(value) {
+	if (typeof value !== "object" || value === null) return null;
+	const rec = value;
+	if (rec["v"] !== 1) return null;
+	const nodeId = rec["nodeId"];
+	const exp = rec["exp"];
+	const jti = rec["jti"];
+	if (typeof nodeId !== "string" || nodeId.length === 0) return null;
+	if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
+	if (typeof jti !== "string" || jti.length === 0) return null;
+	return {
+		v: 1,
+		nodeId,
+		exp,
+		jti
+	};
+}
+//#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-ca.ts
 require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
 var MS_PER_DAY = 864e5;
@@ -87378,6 +87517,9 @@ var TlsTcpTransporter = class extends TcpTransporter {
 	/** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
 	tlsPeers = /* @__PURE__ */ new Map();
 	clearDisabled = false;
+	/** Clear-text `TcpWriter.connect` captured once before the TLS wrap (A→B). */
+	clearWriterConnect = null;
+	writerTlsPatched = false;
 	constructor(opts = {}) {
 		super({ ...opts });
 		this.meshTls = opts.meshTls ?? null;
@@ -87400,20 +87542,43 @@ var TlsTcpTransporter = class extends TcpTransporter {
 		}).then(() => this.onConnected());
 	}
 	/**
-	* Agent / outbound: wrap `TcpWriter.connect` so peers are dialed with
-	* mutual TLS and the peer CN must match the expected node id.
+	* Outbound dial uses mTLS when the peer is already known on TLS (inbound
+	* handshake), or when dialling the hub node id (agent → hub). Everyone else
+	* (runners, unenrolled agents) stays on the clear writer — the hub must not
+	* TLS-wrap every `connect` after deferred `enableMeshTls`.
+	*/
+	shouldDialPeerWithTls(nodeID) {
+		if (nodeID === "hub") return true;
+		return this.tlsPeers.has(nodeID);
+	}
+	peerTlsDialPort() {
+		return this.opts.tlsPort ?? 6443;
+	}
+	/**
+	* Wrap `TcpWriter.connect` so TLS peers are dialed with mutual TLS on the
+	* well-known mesh TLS port (default 6443). Idempotent: the clear connect is
+	* captured once; material refresh rebinds the wrapper.
 	*/
 	patchWriterForTlsClient() {
-		const material = this.meshTls;
-		if (material === null) return;
+		if (this.meshTls === null) return;
 		const writer = this.writer;
 		if (writer === null || typeof writer.connect !== "function") return;
+		if (!this.writerTlsPatched) {
+			this.clearWriterConnect = writer.connect.bind(writer);
+			this.writerTlsPatched = true;
+		}
+		const clearConnect = this.clearWriterConnect;
+		if (clearConnect === null) return;
 		const crl = this.crl;
+		const self = this;
 		writer.connect = (nodeID) => {
+			if (!self.shouldDialPeerWithTls(nodeID)) return clearConnect(nodeID);
+			const material = self.meshTls;
+			if (material === null) return clearConnect(nodeID);
 			const node = writer.transporter.getNode(nodeID);
 			if (!node) return writer.Promise.reject(/* @__PURE__ */ new Error(`Missing node info for '${nodeID}'!`));
 			const host = writer.transporter.getNodeAddress(node);
-			const port = node.port;
+			const port = self.peerTlsDialPort();
 			writer.logger.debug(`Connecting (TLS) to '${nodeID}' via ${host}:${port}`);
 			return new writer.Promise((resolve, reject) => {
 				const socket = node_tls.connect({
@@ -87442,6 +87607,11 @@ var TlsTcpTransporter = class extends TcpTransporter {
 					if (identity) {
 						tlsSock.meshPeerCn = identity.cn;
 						tlsSock.meshPeerSerial = identity.serial;
+						self.tlsPeers.set(identity.cn, identity.serial);
+						self.tlsSockets.add(tlsSock);
+						tlsSock.on("close", () => {
+							self.tlsSockets.delete(tlsSock);
+						});
 					}
 					writer.addSocket(nodeID, tlsSock, true);
 					writer.logger.debug(`Connected successfully (TLS) to '${nodeID}'.`);
@@ -87464,11 +87634,13 @@ var TlsTcpTransporter = class extends TcpTransporter {
 	}
 	/**
 	* Enable (or refresh) the TLS listener once the mesh CA / hub leaf are ready.
-	* Safe to call after connect — starts listening on `tlsPort` alongside clear.
+	* Safe to call after connect — starts listening on `tlsPort` alongside clear
+	* and patches the writer so hub→agent dials use mTLS (Release A→B).
 	*/
 	async enableMeshTls(material) {
 		this.meshTls = material;
 		await this.startTlsServerIfReady();
+		this.patchWriterForTlsClient();
 	}
 	/**
 	* How `nodeId` reaches this transporter: `tls` once it completed a mutual-TLS
@@ -87660,7 +87832,7 @@ function isTlsSocket(socket) {
 *  - no marker            → the secret is MANDATORY (D802): the keeper asks
 *                           its owner to generate one (`generateSecret`), and
 *                           until that succeeds the gate is `off` — no node can
-*                           authenticate, and only `transition` lets them in;
+*                           authenticate (mesh auth is always enforced, D821);
 *  - marker + value       → `on`  — nodes prove the secret;
 *  - marker, no answer    → `unknown` — refused, retryably, and retried here.
 *    A locked keychain or a value lost to a reset NEVER opens the gate, and
@@ -87723,7 +87895,7 @@ var ClusterSecretKeeper = class {
 				reason: `settings unreadable: ${errText(err)}`
 			};
 		}
-		setProcessMeshAuthMode(parseMeshAuthMode(section[MESH_AUTH_MODE_FIELD]));
+		setProcessMeshAuthMode("enforced");
 		const stored = section[CLUSTER_SECRET_FIELD];
 		if (stored === void 0 || stored === null || stored === "") return { kind: "off" };
 		if (!require_dist.isSecretMarker(stored)) return {
@@ -87791,28 +87963,48 @@ function errText(err) {
 //#endregion
 //#region src/builtins/system-config/mesh-actions.ts
 /**
-* System → Cluster — mint a single-use mesh join token (Release A).
+* System → Cluster — mint a single-use mesh join token (Release A) and
+* agent-ui unlock tickets (D821).
 */
-var systemConfigMeshActions = require_dist.defineCustomActions({ mintJoinToken: require_dist.customAction(zod.z.object({
-	/** Optional pinned node id for the CSR CN. */
-	nodeId: zod.z.string().min(1).optional(),
-	/** Override hub HTTPS base (default: local-network publicEndpoint). */
-	hubUrl: zod.z.string().url().optional(),
-	/** Override `host:6000` clear mesh address carried in the token. */
-	hubMeshAddress: zod.z.string().min(3).optional(),
-	/** Seconds until expiry; capped at 1 h. */
-	ttlSec: zod.z.number().int().positive().max(3600).optional()
-}).optional(), zod.z.object({
-	token: zod.z.string().min(1),
-	exp: zod.z.number().int(),
-	hubUrl: zod.z.string(),
-	hubMeshAddress: zod.z.string(),
-	caFingerprint: zod.z.string(),
-	nodeId: zod.z.string().optional()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}) });
+var systemConfigMeshActions = require_dist.defineCustomActions({
+	mintJoinToken: require_dist.customAction(zod.z.object({
+		/** Optional pinned node id for the CSR CN. */
+		nodeId: zod.z.string().min(1).optional(),
+		/** Override hub HTTPS base (default: local-network publicEndpoint). */
+		hubUrl: zod.z.string().url().optional(),
+		/** Override `host:6000` clear mesh address carried in the token. */
+		hubMeshAddress: zod.z.string().min(3).optional(),
+		/** Seconds until expiry; capped at 1 h. */
+		ttlSec: zod.z.number().int().positive().max(3600).optional()
+	}).optional(), zod.z.object({
+		token: zod.z.string().min(1),
+		exp: zod.z.number().int(),
+		hubUrl: zod.z.string(),
+		hubMeshAddress: zod.z.string(),
+		caFingerprint: zod.z.string(),
+		nodeId: zod.z.string().optional()
+	}), {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	/** Hub admin → short-lived ticket the agent redeems for a tab session (D821). */
+	mintAgentUiUnlockTicket: require_dist.customAction(zod.z.object({
+		nodeId: zod.z.string().min(1),
+		/**
+		* Preferred agent dashboard base (`http://host:4444`). When set, the
+		* answer includes `dashboardUrl` with `?ticket=` already attached.
+		*/
+		dashboardBaseUrl: zod.z.string().url().optional()
+	}), zod.z.object({
+		ticket: zod.z.string().min(1),
+		exp: zod.z.number().int(),
+		nodeId: zod.z.string().min(1),
+		dashboardUrl: zod.z.string().url().optional()
+	}), {
+		kind: "mutation",
+		auth: "admin"
+	})
+});
 //#endregion
 //#region src/builtins/system-config/system-config.addon.ts
 /**
@@ -87877,7 +88069,8 @@ var KEY_TO_SECTION = {
 	trustedNetworks: "auth",
 	[CLUSTER_SECRET_FIELD]: "cluster",
 	[MESH_AUTH_MODE_FIELD]: "cluster",
-	[MESH_CLEAR_PORT_FIELD]: "cluster"
+	[MESH_CLEAR_PORT_FIELD]: "cluster",
+	[AGENT_DASHBOARD_ORIGINS_FIELD]: "cluster"
 };
 /** Bytes of a generated cluster secret (D802) — 256 bits, base64url (43 chars). */
 var GENERATED_SECRET_BYTES = 32;
@@ -87886,10 +88079,10 @@ var STATE_LABELS = {
 	legacy: "legacy hash only — update the agent",
 	unauthenticated: "not authenticated — enter the cluster secret in this agent"
 };
-/** The Cluster page's live line per node (D802). */
+/** The Cluster page's live line per node (D802). Mode is always enforced (D821). */
 function describeMeshStatus(status) {
 	if (status === null) return "The mesh status is available on the hub only.";
-	const head = status.mode === "enforced" ? "Enforced: a node that has not authenticated is refused." : "Transition: nodes without the secret are still let in (with a warning). The hub switches to Enforced by itself once every known agent has authenticated.";
+	const head = "Enforced: a node that has not authenticated is refused.";
 	if (status.nodes.length === 0) return `${head}\nNo other node is connected.`;
 	return `${head}\n${status.nodes.map((n) => `• ${n.nodeId}: ${STATE_LABELS[n.state] ?? n.state}`).join("\n")}`;
 }
@@ -87920,6 +88113,9 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			this.ctx.logger.info("Mesh authentication is now ENFORCED", { meta: { reason } });
 		});
 		await this.clusterSecretKeeper.start();
+		try {
+			await this.writeMeshAuthMode("enforced");
+		} catch {}
 		this.meshCaKeeper = new MeshCaKeeper({
 			secrets: this.systemSecrets(),
 			readClusterSection: async () => await this.ctx.settings?.getSection("cluster") ?? {},
@@ -87934,7 +88130,10 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		this.ctx.logger.info("Initialized — exposes yml-backed sections via getGlobalSettings");
 		return {
 			customActions: systemConfigMeshActions,
-			actionHandlers: { mintJoinToken: async (input) => this.mintJoinToken(parseMintJoinTokenInput(input)) }
+			actionHandlers: {
+				mintJoinToken: async (input) => this.mintJoinToken(parseMintJoinTokenInput(input)),
+				mintAgentUiUnlockTicket: async (input) => this.mintAgentUiUnlock(parseMintUnlockInput(input))
+			}
 		};
 	}
 	async onShutdown() {
@@ -87987,6 +88186,41 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {}
 		};
 	}
+	/** D821 — short-lived ticket for the agent's `:4444` unlock session. */
+	async mintAgentUiUnlock(input) {
+		const secrets = this.systemSecrets();
+		if (secrets === null) throw new Error("system-config: no keychain door — cannot mint an unlock ticket");
+		const entry = (await secrets.resolve([require_constants$8.CLUSTER_SECRET_REF]))[require_constants$8.CLUSTER_SECRET_REF];
+		if (entry?.kind !== "value") throw new Error("system-config: cluster secret is not available — cannot mint an unlock ticket");
+		if (input.dashboardBaseUrl !== void 0) {
+			const origins = await this.readAgentDashboardOrigins();
+			if (!isAllowedAgentDashboardReturnTo(input.dashboardBaseUrl, origins)) throw new Error("dashboardBaseUrl is not an allowed agent dashboard origin (:4444 or agentDashboardOrigins)");
+		}
+		const ticket = mintAgentUiUnlockTicket({
+			secretHash: require_constants$8.hashClusterSecret(entry.value),
+			nodeId: input.nodeId
+		});
+		const payloadJson = Buffer.from(ticket.split(".")[0] ?? "", "base64url").toString("utf8");
+		const exp = JSON.parse(payloadJson).exp ?? 0;
+		const dashboardUrl = input.dashboardBaseUrl === void 0 ? void 0 : (() => {
+			const u = new URL(input.dashboardBaseUrl);
+			u.searchParams.set("ticket", ticket);
+			return u.toString();
+		})();
+		return {
+			ticket,
+			exp,
+			nodeId: input.nodeId,
+			...dashboardUrl !== void 0 ? { dashboardUrl } : {}
+		};
+	}
+	async readAgentDashboardOrigins() {
+		try {
+			return parseAgentDashboardOrigins((await this.ctx.settings?.getSection("cluster"))?.[AGENT_DASHBOARD_ORIGINS_FIELD]);
+		} catch {
+			return [];
+		}
+	}
 	async resolveHubUrl() {
 		try {
 			const book = await this.ctx.api?.localNetwork?.getAddresses?.query({ scheme: "https" });
@@ -88106,20 +88340,6 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 						label: "Cluster secret",
 						description: "Mandatory — generated by the hub at first boot and stored in the keychain. To pair an agent: Reveal and copy it here, then enter it in the agent (its status page, or the desktop setup window). Saving a new value rotates it: every agent must then be given the new one."
 					},
-					{
-						type: "select",
-						key: MESH_AUTH_MODE_FIELD,
-						label: "Agents without the secret",
-						description: "Transition lets an agent that has not authenticated keep working (with a warning) while you give each agent the secret; it ends by itself once every known agent has authenticated. Enforced refuses it.",
-						default: "transition",
-						options: [{
-							value: "transition",
-							label: "Transition — allow, warn"
-						}, {
-							value: "enforced",
-							label: "Enforced — refuse"
-						}]
-					},
 					{
 						type: "select",
 						key: MESH_CLEAR_PORT_FIELD,
@@ -88141,6 +88361,12 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 						content: describeMeshStatus(getProcessMeshAuthStatus()),
 						variant: "info"
 					},
+					{
+						type: "string",
+						key: AGENT_DASHBOARD_ORIGINS_FIELD,
+						label: "Agent dashboard origins (NPM)",
+						description: "Extra origins allowed for Continue-with-hub unlock redirects (comma-separated), e.g. https://agent.example.com. LAN agents on :4444 are always allowed."
+					},
 					{
 						type: "addon-action-button",
 						key: "mintJoinTokenAction",
@@ -88213,15 +88439,14 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 	* The cluster secret's save path: the value goes to the keychain (owner
 	* `system`), the row gets the marker; `''` / a view keeps. `$secretClear` is
 	* REFUSED: the secret is mandatory (D802). A value the keychain cannot store
-	* is REFUSED — never written inline (D787, P5). `meshAuth` is a plain value.
+	* is REFUSED — never written inline (D787, P5). Mesh auth mode is always
+	* enforced (D821) — a legacy `meshAuth` in the patch is ignored.
 	*/
 	async writeClusterSection(patch) {
-		const { [MESH_AUTH_MODE_FIELD]: mode, [MESH_CLEAR_PORT_FIELD]: clearPort, ...secretPatch } = patch;
+		const { [MESH_AUTH_MODE_FIELD]: _legacyMode, [MESH_CLEAR_PORT_FIELD]: clearPort, [AGENT_DASHBOARD_ORIGINS_FIELD]: dashboardOrigins, ...secretPatch } = patch;
 		if (clearPort !== void 0) await this.writeMeshClearPort(clearPort);
-		if (mode !== void 0) {
-			if (!isMeshAuthMode(mode)) throw new Error(`system-config: meshAuth must be 'transition' or 'enforced'`);
-			await this.writeMeshAuthMode(mode);
-		}
+		if (dashboardOrigins !== void 0) await this.ctx.settings.setSection("cluster", { [AGENT_DASHBOARD_ORIGINS_FIELD]: typeof dashboardOrigins === "string" ? dashboardOrigins : "" });
+		await this.writeMeshAuthMode("enforced");
 		if (Object.keys(secretPatch).length === 0) return;
 		if (require_dist.isSecretClear(secretPatch["clusterSecret"])) throw new Error("The cluster secret is mandatory and cannot be cleared — save a new value to rotate it");
 		await this.storeClusterSecret(secretPatch);
@@ -88249,16 +88474,15 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		await applyProcessMeshClearPort(value);
 		this.ctx.logger.info("Mesh clear port switched", { meta: { mode: value } });
 	}
-	/** `cluster.meshAuth` (D802), then republish it. */
+	/** Persist + publish mesh auth mode (always `enforced` after D821). */
 	async writeMeshAuthMode(mode) {
 		await this.ctx.settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: mode });
-		await this.clusterSecretKeeper?.reload();
+		setProcessMeshAuthMode(mode);
 	}
 	/**
 	* First boot, or a keychain reset that cleared the marker (D802): a fresh
-	* random secret, stored like an operator save. A NEW secret means every
-	* agent must be given it, so the mesh goes (back) to `transition`; on a hub
-	* with no agent yet, the hub's auto-enforce ends it at once.
+	* random secret, stored like an operator save. Mesh auth stays enforced
+	* (D821) — every agent must present the secret; there is no transition window.
 	*/
 	async generateClusterSecret() {
 		const settings = this.ctx.settings;
@@ -88273,7 +88497,8 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		if (existing?.kind !== "missing") throw new Error(`the keychain cannot answer for the cluster secret (${existing?.kind ?? "no answer"})`);
 		const value = (0, node_crypto.randomBytes)(GENERATED_SECRET_BYTES).toString("base64url");
 		await this.storeClusterSecret({ [CLUSTER_SECRET_FIELD]: value });
-		await settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: "transition" });
+		await settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: "enforced" });
+		setProcessMeshAuthMode("enforced");
 	}
 	async storeClusterSecret(patch) {
 		const settings = this.ctx.settings;
@@ -88306,6 +88531,16 @@ function parseMintJoinTokenInput(input) {
 	if (typeof ttlSec === "number") out.ttlSec = ttlSec;
 	return out;
 }
+function parseMintUnlockInput(input) {
+	if (input === null || typeof input !== "object") throw new Error("system-config: mintAgentUiUnlockTicket requires { nodeId }");
+	const nodeId = Reflect.get(input, "nodeId");
+	if (typeof nodeId !== "string" || nodeId.length === 0) throw new Error("system-config: mintAgentUiUnlockTicket requires { nodeId }");
+	const dashboardBaseUrl = Reflect.get(input, "dashboardBaseUrl");
+	return {
+		nodeId,
+		...typeof dashboardBaseUrl === "string" ? { dashboardBaseUrl } : {}
+	};
+}
 /** Read `exp` from an unencrypted JWT payload (no verify — already minted here). */
 function readJwtExp(token) {
 	const parts = token.split(".");
@@ -88317,6 +88552,10 @@ function readJwtExp(token) {
 	return typeof exp === "number" ? exp : 0;
 }
 //#endregion
+exports.AGENT_DASHBOARD_ORIGINS_FIELD = AGENT_DASHBOARD_ORIGINS_FIELD;
+exports.AGENT_UI_UNLOCK_DOMAIN = AGENT_UI_UNLOCK_DOMAIN;
+exports.AGENT_UI_UNLOCK_TTL_MS = AGENT_UI_UNLOCK_TTL_MS;
+exports.AGENT_UI_UNLOCK_VERSION = AGENT_UI_UNLOCK_VERSION;
 exports.Errors = Errors;
 exports.JoinTokenJtiStore = JoinTokenJtiStore;
 exports.MESH_AUTH_MODE_FIELD = MESH_AUTH_MODE_FIELD;
@@ -88328,6 +88567,7 @@ exports.ServiceBroker = ServiceBroker;
 exports.SystemConfigAddon = SystemConfigAddon;
 exports.default = SystemConfigAddon;
 exports.TlsTcpTransporter = TlsTcpTransporter;
+exports.UnlockTicketJtiStore = UnlockTicketJtiStore;
 exports.applyProcessMeshClearPort = applyProcessMeshClearPort;
 exports.caFingerprint = caFingerprint;
 exports.caFingerprintCompact = caFingerprintCompact;
@@ -88343,12 +88583,15 @@ exports.getProcessMeshAuthMode = getProcessMeshAuthMode;
 exports.getProcessMeshAuthStatus = getProcessMeshAuthStatus;
 exports.getProcessMeshCaState = getProcessMeshCaState;
 exports.getProcessNodeMeshTransport = getProcessNodeMeshTransport;
+exports.isAllowedAgentDashboardReturnTo = isAllowedAgentDashboardReturnTo;
 exports.isMeshAuthMode = isMeshAuthMode;
 exports.issueMeshLeafForNode = issueMeshLeafForNode;
 exports.issueMeshLeafFromCsr = issueMeshLeafFromCsr;
 exports.loadMeshCa = loadMeshCa;
+exports.mintAgentUiUnlockTicket = mintAgentUiUnlockTicket;
 exports.mintMeshJoinToken = mintMeshJoinToken;
 exports.normalizeIp = normalizeIp;
+exports.parseAgentDashboardOrigins = parseAgentDashboardOrigins;
 exports.parseCidrList = parseCidrList;
 exports.parseMeshAuthMode = parseMeshAuthMode;
 exports.processJoinTokenJtiStore = processJoinTokenJtiStore;
@@ -88362,4 +88605,5 @@ exports.setProcessMeshClearPortControl = setProcessMeshClearPortControl;
 exports.setProcessMeshEnforcer = setProcessMeshEnforcer;
 exports.setProcessMeshTlsEnabler = setProcessMeshTlsEnabler;
 exports.systemConfigMeshActions = systemConfigMeshActions;
+exports.verifyAgentUiUnlockTicket = verifyAgentUiUnlockTicket;
 exports.verifyMeshJoinToken = verifyMeshJoinToken;