@camstack/system 1.2.386 → 1.2.388

package/dist/builtins/system-config/system-config.addon.mjs

@@ -4,7 +4,7 @@ import { n as require_safe_buffer, t as require_ms } from "../../ms-DlIWNkkk.mjs
 import { a as MESH_CA_FIELD, c as MESH_CA_VALIDITY_DAYS, f as CLUSTER_SECRET_REF, i as MESH_CA_COMMON_NAME, l as MESH_JOIN_TOKEN_MAX_TTL_SEC, n as DEFAULT_HUB_TCP_PORT, o as MESH_CA_KEY_REF, r as DEFAULT_HUB_TLS_TCP_PORT, s as MESH_CA_SETTINGS_KEY, t as CLIENT_AUTH_OID, u as SERVER_AUTH_OID, x as setProcessClusterSecretGate, y as hashClusterSecret } from "../../constants-D5z4EwY8.mjs";
 import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "../../x509.es-Xf3K_brW.mjs";
 import { z } from "zod";
-import { X509Certificate, createHash, randomBytes, webcrypto } from "node:crypto";
+import { X509Certificate, createHash, createHmac, randomBytes, timingSafeEqual, webcrypto } from "node:crypto";
 import { BlockList, isIP } from "node:net";
 import { lstat, readdir, readlink, realpath } from "node:fs/promises";
 import { posix, win32 } from "node:path";
@@ -141,6 +141,145 @@ function getProcessMeshAuthStatus() {
 	return typeof source === "function" ? source() : null;
 }
 //#endregion
+//#region src/kernel/moleculer/agent-ui-unlock.ts
+/**
+* Agent UI remote unlock tickets (D821).
+*
+* A hub admin mints a short-lived HMAC ticket bound to one agent `nodeId`.
+* The agent redeems it once for a tab session Bearer — the cluster secret
+* stays a mesh / pairing credential and is not pasted into the browser for
+* daily unlock.
+*
+*   K       = SHA-256(cluster secret)   — same as mesh join (D802)
+*   ticket  = base64url(JSON payload) + '.' + base64url(HMAC-SHA256(K, DOMAIN|payloadB64))
+*   payload = { v: 1, nodeId, exp (ms), jti }
+*/
+var AGENT_UI_UNLOCK_DOMAIN = "camstack-agent-ui-unlock/v1";
+var AGENT_UI_UNLOCK_VERSION = 1;
+/** Ticket lifetime — long enough for a redirect hop, short enough to steal poorly. */
+var AGENT_UI_UNLOCK_TTL_MS = 5 * 6e4;
+/**
+* Cluster settings key: extra origins allowed as `returnTo` for Continue-with-hub
+* (NPM hostnames that are not `:4444` on a LAN IP). Comma-separated origins.
+*/
+var AGENT_DASHBOARD_ORIGINS_FIELD = "agentDashboardOrigins";
+/** In-memory spent `jti` until `exp` (ms). */
+var UnlockTicketJtiStore = class {
+	spent = /* @__PURE__ */ new Map();
+	isSpent(jti, nowMs = Date.now()) {
+		this.gc(nowMs);
+		return this.spent.has(jti);
+	}
+	/** Record a jti as used until `exp`. Returns false if already spent. */
+	consume(jti, exp, nowMs = Date.now()) {
+		this.gc(nowMs);
+		if (this.spent.has(jti)) return false;
+		this.spent.set(jti, exp);
+		return true;
+	}
+	/** Test helper. */
+	size() {
+		return this.spent.size;
+	}
+	gc(nowMs) {
+		for (const [jti, exp] of this.spent) if (exp <= nowMs) this.spent.delete(jti);
+	}
+};
+function mintAgentUiUnlockTicket(input) {
+	const nowMs = input.nowMs ?? Date.now();
+	const ttl = Math.min(Math.max(1e3, input.ttlMs ?? 3e5), AGENT_UI_UNLOCK_TTL_MS);
+	const payload = {
+		v: 1,
+		nodeId: input.nodeId,
+		exp: nowMs + ttl,
+		jti: input.jti ?? randomBytes(16).toString("base64url")
+	};
+	const payloadB64 = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+	return `${payloadB64}.${sign(input.secretHash, payloadB64)}`;
+}
+/**
+* Verify a ticket under `secretHash`. Returns the payload, or `null` when the
+* signature, shape, expiry or nodeId fails (no reason string — refuse quietly).
+*/
+function verifyAgentUiUnlockTicket(secretHash, ticket, options) {
+	const nowMs = options.nowMs ?? Date.now();
+	const dot = ticket.indexOf(".");
+	if (dot <= 0 || dot === ticket.length - 1) return null;
+	const payloadB64 = ticket.slice(0, dot);
+	const sig = ticket.slice(dot + 1);
+	if (!sigsEqual(sign(secretHash, payloadB64), sig)) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
+	} catch {
+		return null;
+	}
+	const payload = parsePayload(parsed);
+	if (payload === null) return null;
+	if (payload.exp <= nowMs) return null;
+	if (payload.nodeId !== options.expectedNodeId) return null;
+	return payload;
+}
+/**
+* True when `returnTo` may receive a ticket redirect. Default: any http(s)
+* origin whose port is 4444. Extra origins come from
+* {@link AGENT_DASHBOARD_ORIGINS_FIELD} (exact origin match).
+*/
+function isAllowedAgentDashboardReturnTo(returnTo, extraOrigins = []) {
+	let url;
+	try {
+		url = new URL(returnTo);
+	} catch {
+		return false;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+	if (url.username !== "" || url.password !== "") return false;
+	if (url.pathname !== "/" && url.pathname !== "") return false;
+	if (url.port === "4444") return true;
+	const origin = url.origin;
+	return extraOrigins.some((o) => o === origin);
+}
+/** Parse a stored comma/whitespace-separated origins list. */
+function parseAgentDashboardOrigins(stored) {
+	if (typeof stored !== "string" || stored.trim().length === 0) return [];
+	const out = [];
+	for (const part of stored.split(/[,\s]+/)) {
+		const t = part.trim();
+		if (t.length === 0) continue;
+		try {
+			const u = new URL(t);
+			if (u.protocol === "http:" || u.protocol === "https:") out.push(u.origin);
+		} catch {}
+	}
+	return out;
+}
+function sign(secretHash, payloadB64) {
+	return createHmac("sha256", Buffer.from(secretHash, "utf8")).update(`${AGENT_UI_UNLOCK_DOMAIN}|${payloadB64}`, "utf8").digest("base64url");
+}
+function sigsEqual(expected, presented) {
+	const a = Buffer.from(expected, "utf8");
+	const b = Buffer.from(presented, "utf8");
+	if (a.length !== b.length) return false;
+	return timingSafeEqual(a, b);
+}
+function parsePayload(value) {
+	if (typeof value !== "object" || value === null) return null;
+	const rec = value;
+	if (rec["v"] !== 1) return null;
+	const nodeId = rec["nodeId"];
+	const exp = rec["exp"];
+	const jti = rec["jti"];
+	if (typeof nodeId !== "string" || nodeId.length === 0) return null;
+	if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
+	if (typeof jti !== "string" || jti.length === 0) return null;
+	return {
+		v: 1,
+		nodeId,
+		exp,
+		jti
+	};
+}
+//#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-ca.ts
 cryptoProvider.set(webcrypto);
 var MS_PER_DAY = 864e5;
@@ -87369,6 +87508,9 @@ var TlsTcpTransporter = class extends TcpTransporter {
 	/** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
 	tlsPeers = /* @__PURE__ */ new Map();
 	clearDisabled = false;
+	/** Clear-text `TcpWriter.connect` captured once before the TLS wrap (A→B). */
+	clearWriterConnect = null;
+	writerTlsPatched = false;
 	constructor(opts = {}) {
 		super({ ...opts });
 		this.meshTls = opts.meshTls ?? null;
@@ -87391,20 +87533,43 @@ var TlsTcpTransporter = class extends TcpTransporter {
 		}).then(() => this.onConnected());
 	}
 	/**
-	* Agent / outbound: wrap `TcpWriter.connect` so peers are dialed with
-	* mutual TLS and the peer CN must match the expected node id.
+	* Outbound dial uses mTLS when the peer is already known on TLS (inbound
+	* handshake), or when dialling the hub node id (agent → hub). Everyone else
+	* (runners, unenrolled agents) stays on the clear writer — the hub must not
+	* TLS-wrap every `connect` after deferred `enableMeshTls`.
+	*/
+	shouldDialPeerWithTls(nodeID) {
+		if (nodeID === "hub") return true;
+		return this.tlsPeers.has(nodeID);
+	}
+	peerTlsDialPort() {
+		return this.opts.tlsPort ?? 6443;
+	}
+	/**
+	* Wrap `TcpWriter.connect` so TLS peers are dialed with mutual TLS on the
+	* well-known mesh TLS port (default 6443). Idempotent: the clear connect is
+	* captured once; material refresh rebinds the wrapper.
 	*/
 	patchWriterForTlsClient() {
-		const material = this.meshTls;
-		if (material === null) return;
+		if (this.meshTls === null) return;
 		const writer = this.writer;
 		if (writer === null || typeof writer.connect !== "function") return;
+		if (!this.writerTlsPatched) {
+			this.clearWriterConnect = writer.connect.bind(writer);
+			this.writerTlsPatched = true;
+		}
+		const clearConnect = this.clearWriterConnect;
+		if (clearConnect === null) return;
 		const crl = this.crl;
+		const self = this;
 		writer.connect = (nodeID) => {
+			if (!self.shouldDialPeerWithTls(nodeID)) return clearConnect(nodeID);
+			const material = self.meshTls;
+			if (material === null) return clearConnect(nodeID);
 			const node = writer.transporter.getNode(nodeID);
 			if (!node) return writer.Promise.reject(/* @__PURE__ */ new Error(`Missing node info for '${nodeID}'!`));
 			const host = writer.transporter.getNodeAddress(node);
-			const port = node.port;
+			const port = self.peerTlsDialPort();
 			writer.logger.debug(`Connecting (TLS) to '${nodeID}' via ${host}:${port}`);
 			return new writer.Promise((resolve, reject) => {
 				const socket = tls.connect({
@@ -87433,6 +87598,11 @@ var TlsTcpTransporter = class extends TcpTransporter {
 					if (identity) {
 						tlsSock.meshPeerCn = identity.cn;
 						tlsSock.meshPeerSerial = identity.serial;
+						self.tlsPeers.set(identity.cn, identity.serial);
+						self.tlsSockets.add(tlsSock);
+						tlsSock.on("close", () => {
+							self.tlsSockets.delete(tlsSock);
+						});
 					}
 					writer.addSocket(nodeID, tlsSock, true);
 					writer.logger.debug(`Connected successfully (TLS) to '${nodeID}'.`);
@@ -87455,11 +87625,13 @@ var TlsTcpTransporter = class extends TcpTransporter {
 	}
 	/**
 	* Enable (or refresh) the TLS listener once the mesh CA / hub leaf are ready.
-	* Safe to call after connect — starts listening on `tlsPort` alongside clear.
+	* Safe to call after connect — starts listening on `tlsPort` alongside clear
+	* and patches the writer so hub→agent dials use mTLS (Release A→B).
 	*/
 	async enableMeshTls(material) {
 		this.meshTls = material;
 		await this.startTlsServerIfReady();
+		this.patchWriterForTlsClient();
 	}
 	/**
 	* How `nodeId` reaches this transporter: `tls` once it completed a mutual-TLS
@@ -87650,7 +87822,7 @@ function isTlsSocket(socket) {
 *  - no marker            → the secret is MANDATORY (D802): the keeper asks
 *                           its owner to generate one (`generateSecret`), and
 *                           until that succeeds the gate is `off` — no node can
-*                           authenticate, and only `transition` lets them in;
+*                           authenticate (mesh auth is always enforced, D821);
 *  - marker + value       → `on`  — nodes prove the secret;
 *  - marker, no answer    → `unknown` — refused, retryably, and retried here.
 *    A locked keychain or a value lost to a reset NEVER opens the gate, and
@@ -87713,7 +87885,7 @@ var ClusterSecretKeeper = class {
 				reason: `settings unreadable: ${errText(err)}`
 			};
 		}
-		setProcessMeshAuthMode(parseMeshAuthMode(section[MESH_AUTH_MODE_FIELD]));
+		setProcessMeshAuthMode("enforced");
 		const stored = section[CLUSTER_SECRET_FIELD];
 		if (stored === void 0 || stored === null || stored === "") return { kind: "off" };
 		if (!isSecretMarker(stored)) return {
@@ -87781,28 +87953,48 @@ function errText(err) {
 //#endregion
 //#region src/builtins/system-config/mesh-actions.ts
 /**
-* System → Cluster — mint a single-use mesh join token (Release A).
+* System → Cluster — mint a single-use mesh join token (Release A) and
+* agent-ui unlock tickets (D821).
 */
-var systemConfigMeshActions = defineCustomActions({ mintJoinToken: customAction(z.object({
-	/** Optional pinned node id for the CSR CN. */
-	nodeId: z.string().min(1).optional(),
-	/** Override hub HTTPS base (default: local-network publicEndpoint). */
-	hubUrl: z.string().url().optional(),
-	/** Override `host:6000` clear mesh address carried in the token. */
-	hubMeshAddress: z.string().min(3).optional(),
-	/** Seconds until expiry; capped at 1 h. */
-	ttlSec: z.number().int().positive().max(3600).optional()
-}).optional(), z.object({
-	token: z.string().min(1),
-	exp: z.number().int(),
-	hubUrl: z.string(),
-	hubMeshAddress: z.string(),
-	caFingerprint: z.string(),
-	nodeId: z.string().optional()
-}), {
-	kind: "mutation",
-	auth: "admin"
-}) });
+var systemConfigMeshActions = defineCustomActions({
+	mintJoinToken: customAction(z.object({
+		/** Optional pinned node id for the CSR CN. */
+		nodeId: z.string().min(1).optional(),
+		/** Override hub HTTPS base (default: local-network publicEndpoint). */
+		hubUrl: z.string().url().optional(),
+		/** Override `host:6000` clear mesh address carried in the token. */
+		hubMeshAddress: z.string().min(3).optional(),
+		/** Seconds until expiry; capped at 1 h. */
+		ttlSec: z.number().int().positive().max(3600).optional()
+	}).optional(), z.object({
+		token: z.string().min(1),
+		exp: z.number().int(),
+		hubUrl: z.string(),
+		hubMeshAddress: z.string(),
+		caFingerprint: z.string(),
+		nodeId: z.string().optional()
+	}), {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	/** Hub admin → short-lived ticket the agent redeems for a tab session (D821). */
+	mintAgentUiUnlockTicket: customAction(z.object({
+		nodeId: z.string().min(1),
+		/**
+		* Preferred agent dashboard base (`http://host:4444`). When set, the
+		* answer includes `dashboardUrl` with `?ticket=` already attached.
+		*/
+		dashboardBaseUrl: z.string().url().optional()
+	}), z.object({
+		ticket: z.string().min(1),
+		exp: z.number().int(),
+		nodeId: z.string().min(1),
+		dashboardUrl: z.string().url().optional()
+	}), {
+		kind: "mutation",
+		auth: "admin"
+	})
+});
 //#endregion
 //#region src/builtins/system-config/system-config.addon.ts
 /**
@@ -87867,7 +88059,8 @@ var KEY_TO_SECTION = {
 	trustedNetworks: "auth",
 	[CLUSTER_SECRET_FIELD]: "cluster",
 	[MESH_AUTH_MODE_FIELD]: "cluster",
-	[MESH_CLEAR_PORT_FIELD]: "cluster"
+	[MESH_CLEAR_PORT_FIELD]: "cluster",
+	[AGENT_DASHBOARD_ORIGINS_FIELD]: "cluster"
 };
 /** Bytes of a generated cluster secret (D802) — 256 bits, base64url (43 chars). */
 var GENERATED_SECRET_BYTES = 32;
@@ -87876,10 +88069,10 @@ var STATE_LABELS = {
 	legacy: "legacy hash only — update the agent",
 	unauthenticated: "not authenticated — enter the cluster secret in this agent"
 };
-/** The Cluster page's live line per node (D802). */
+/** The Cluster page's live line per node (D802). Mode is always enforced (D821). */
 function describeMeshStatus(status) {
 	if (status === null) return "The mesh status is available on the hub only.";
-	const head = status.mode === "enforced" ? "Enforced: a node that has not authenticated is refused." : "Transition: nodes without the secret are still let in (with a warning). The hub switches to Enforced by itself once every known agent has authenticated.";
+	const head = "Enforced: a node that has not authenticated is refused.";
 	if (status.nodes.length === 0) return `${head}\nNo other node is connected.`;
 	return `${head}\n${status.nodes.map((n) => `• ${n.nodeId}: ${STATE_LABELS[n.state] ?? n.state}`).join("\n")}`;
 }
@@ -87910,6 +88103,9 @@ var SystemConfigAddon = class extends BaseAddon {
 			this.ctx.logger.info("Mesh authentication is now ENFORCED", { meta: { reason } });
 		});
 		await this.clusterSecretKeeper.start();
+		try {
+			await this.writeMeshAuthMode("enforced");
+		} catch {}
 		this.meshCaKeeper = new MeshCaKeeper({
 			secrets: this.systemSecrets(),
 			readClusterSection: async () => await this.ctx.settings?.getSection("cluster") ?? {},
@@ -87924,7 +88120,10 @@ var SystemConfigAddon = class extends BaseAddon {
 		this.ctx.logger.info("Initialized — exposes yml-backed sections via getGlobalSettings");
 		return {
 			customActions: systemConfigMeshActions,
-			actionHandlers: { mintJoinToken: async (input) => this.mintJoinToken(parseMintJoinTokenInput(input)) }
+			actionHandlers: {
+				mintJoinToken: async (input) => this.mintJoinToken(parseMintJoinTokenInput(input)),
+				mintAgentUiUnlockTicket: async (input) => this.mintAgentUiUnlock(parseMintUnlockInput(input))
+			}
 		};
 	}
 	async onShutdown() {
@@ -87977,6 +88176,41 @@ var SystemConfigAddon = class extends BaseAddon {
 			...input.nodeId !== void 0 ? { nodeId: input.nodeId } : {}
 		};
 	}
+	/** D821 — short-lived ticket for the agent's `:4444` unlock session. */
+	async mintAgentUiUnlock(input) {
+		const secrets = this.systemSecrets();
+		if (secrets === null) throw new Error("system-config: no keychain door — cannot mint an unlock ticket");
+		const entry = (await secrets.resolve([CLUSTER_SECRET_REF]))[CLUSTER_SECRET_REF];
+		if (entry?.kind !== "value") throw new Error("system-config: cluster secret is not available — cannot mint an unlock ticket");
+		if (input.dashboardBaseUrl !== void 0) {
+			const origins = await this.readAgentDashboardOrigins();
+			if (!isAllowedAgentDashboardReturnTo(input.dashboardBaseUrl, origins)) throw new Error("dashboardBaseUrl is not an allowed agent dashboard origin (:4444 or agentDashboardOrigins)");
+		}
+		const ticket = mintAgentUiUnlockTicket({
+			secretHash: hashClusterSecret(entry.value),
+			nodeId: input.nodeId
+		});
+		const payloadJson = Buffer.from(ticket.split(".")[0] ?? "", "base64url").toString("utf8");
+		const exp = JSON.parse(payloadJson).exp ?? 0;
+		const dashboardUrl = input.dashboardBaseUrl === void 0 ? void 0 : (() => {
+			const u = new URL(input.dashboardBaseUrl);
+			u.searchParams.set("ticket", ticket);
+			return u.toString();
+		})();
+		return {
+			ticket,
+			exp,
+			nodeId: input.nodeId,
+			...dashboardUrl !== void 0 ? { dashboardUrl } : {}
+		};
+	}
+	async readAgentDashboardOrigins() {
+		try {
+			return parseAgentDashboardOrigins((await this.ctx.settings?.getSection("cluster"))?.[AGENT_DASHBOARD_ORIGINS_FIELD]);
+		} catch {
+			return [];
+		}
+	}
 	async resolveHubUrl() {
 		try {
 			const book = await this.ctx.api?.localNetwork?.getAddresses?.query({ scheme: "https" });
@@ -88096,20 +88330,6 @@ var SystemConfigAddon = class extends BaseAddon {
 						label: "Cluster secret",
 						description: "Mandatory — generated by the hub at first boot and stored in the keychain. To pair an agent: Reveal and copy it here, then enter it in the agent (its status page, or the desktop setup window). Saving a new value rotates it: every agent must then be given the new one."
 					},
-					{
-						type: "select",
-						key: MESH_AUTH_MODE_FIELD,
-						label: "Agents without the secret",
-						description: "Transition lets an agent that has not authenticated keep working (with a warning) while you give each agent the secret; it ends by itself once every known agent has authenticated. Enforced refuses it.",
-						default: "transition",
-						options: [{
-							value: "transition",
-							label: "Transition — allow, warn"
-						}, {
-							value: "enforced",
-							label: "Enforced — refuse"
-						}]
-					},
 					{
 						type: "select",
 						key: MESH_CLEAR_PORT_FIELD,
@@ -88131,6 +88351,12 @@ var SystemConfigAddon = class extends BaseAddon {
 						content: describeMeshStatus(getProcessMeshAuthStatus()),
 						variant: "info"
 					},
+					{
+						type: "string",
+						key: AGENT_DASHBOARD_ORIGINS_FIELD,
+						label: "Agent dashboard origins (NPM)",
+						description: "Extra origins allowed for Continue-with-hub unlock redirects (comma-separated), e.g. https://agent.example.com. LAN agents on :4444 are always allowed."
+					},
 					{
 						type: "addon-action-button",
 						key: "mintJoinTokenAction",
@@ -88203,15 +88429,14 @@ var SystemConfigAddon = class extends BaseAddon {
 	* The cluster secret's save path: the value goes to the keychain (owner
 	* `system`), the row gets the marker; `''` / a view keeps. `$secretClear` is
 	* REFUSED: the secret is mandatory (D802). A value the keychain cannot store
-	* is REFUSED — never written inline (D787, P5). `meshAuth` is a plain value.
+	* is REFUSED — never written inline (D787, P5). Mesh auth mode is always
+	* enforced (D821) — a legacy `meshAuth` in the patch is ignored.
 	*/
 	async writeClusterSection(patch) {
-		const { [MESH_AUTH_MODE_FIELD]: mode, [MESH_CLEAR_PORT_FIELD]: clearPort, ...secretPatch } = patch;
+		const { [MESH_AUTH_MODE_FIELD]: _legacyMode, [MESH_CLEAR_PORT_FIELD]: clearPort, [AGENT_DASHBOARD_ORIGINS_FIELD]: dashboardOrigins, ...secretPatch } = patch;
 		if (clearPort !== void 0) await this.writeMeshClearPort(clearPort);
-		if (mode !== void 0) {
-			if (!isMeshAuthMode(mode)) throw new Error(`system-config: meshAuth must be 'transition' or 'enforced'`);
-			await this.writeMeshAuthMode(mode);
-		}
+		if (dashboardOrigins !== void 0) await this.ctx.settings.setSection("cluster", { [AGENT_DASHBOARD_ORIGINS_FIELD]: typeof dashboardOrigins === "string" ? dashboardOrigins : "" });
+		await this.writeMeshAuthMode("enforced");
 		if (Object.keys(secretPatch).length === 0) return;
 		if (isSecretClear(secretPatch["clusterSecret"])) throw new Error("The cluster secret is mandatory and cannot be cleared — save a new value to rotate it");
 		await this.storeClusterSecret(secretPatch);
@@ -88239,16 +88464,15 @@ var SystemConfigAddon = class extends BaseAddon {
 		await applyProcessMeshClearPort(value);
 		this.ctx.logger.info("Mesh clear port switched", { meta: { mode: value } });
 	}
-	/** `cluster.meshAuth` (D802), then republish it. */
+	/** Persist + publish mesh auth mode (always `enforced` after D821). */
 	async writeMeshAuthMode(mode) {
 		await this.ctx.settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: mode });
-		await this.clusterSecretKeeper?.reload();
+		setProcessMeshAuthMode(mode);
 	}
 	/**
 	* First boot, or a keychain reset that cleared the marker (D802): a fresh
-	* random secret, stored like an operator save. A NEW secret means every
-	* agent must be given it, so the mesh goes (back) to `transition`; on a hub
-	* with no agent yet, the hub's auto-enforce ends it at once.
+	* random secret, stored like an operator save. Mesh auth stays enforced
+	* (D821) — every agent must present the secret; there is no transition window.
 	*/
 	async generateClusterSecret() {
 		const settings = this.ctx.settings;
@@ -88263,7 +88487,8 @@ var SystemConfigAddon = class extends BaseAddon {
 		if (existing?.kind !== "missing") throw new Error(`the keychain cannot answer for the cluster secret (${existing?.kind ?? "no answer"})`);
 		const value = randomBytes(GENERATED_SECRET_BYTES).toString("base64url");
 		await this.storeClusterSecret({ [CLUSTER_SECRET_FIELD]: value });
-		await settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: "transition" });
+		await settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: "enforced" });
+		setProcessMeshAuthMode("enforced");
 	}
 	async storeClusterSecret(patch) {
 		const settings = this.ctx.settings;
@@ -88296,6 +88521,16 @@ function parseMintJoinTokenInput(input) {
 	if (typeof ttlSec === "number") out.ttlSec = ttlSec;
 	return out;
 }
+function parseMintUnlockInput(input) {
+	if (input === null || typeof input !== "object") throw new Error("system-config: mintAgentUiUnlockTicket requires { nodeId }");
+	const nodeId = Reflect.get(input, "nodeId");
+	if (typeof nodeId !== "string" || nodeId.length === 0) throw new Error("system-config: mintAgentUiUnlockTicket requires { nodeId }");
+	const dashboardBaseUrl = Reflect.get(input, "dashboardBaseUrl");
+	return {
+		nodeId,
+		...typeof dashboardBaseUrl === "string" ? { dashboardBaseUrl } : {}
+	};
+}
 /** Read `exp` from an unencrypted JWT payload (no verify — already minted here). */
 function readJwtExp(token) {
 	const parts = token.split(".");
@@ -88307,4 +88542,4 @@ function readJwtExp(token) {
 	return typeof exp === "number" ? exp : 0;
 }
 //#endregion
-export { loadMeshCa as A, createCidrMatcher as B, caFingerprintCompact as C, generateMeshKeyPair as D, generateMeshCa as E, parseMeshAuthMode as F, parseCidrList as H, requestProcessMeshEnforcement as I, setProcessMeshAuthMode as L, getProcessMeshAuthMode as M, getProcessMeshAuthStatus as N, issueMeshLeafForNode as O, isMeshAuthMode as P, setProcessMeshAuthStatusSource as R, caFingerprint as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, exportMeshPrivateKeyPem as T, readCidrSetting as U, normalizeIp as V, MeshCrl as _, setProcessMeshTlsEnabler as a, getProcessMeshCaState as b, mintMeshJoinToken as c, MESH_CLEAR_PORT_FIELD as d, applyProcessMeshClearPort as f, setProcessMeshClearPortControl as g, getProcessNodeMeshTransport as h, ServiceBroker as i, MESH_AUTH_MODE_FIELD as j, issueMeshLeafFromCsr as k, processJoinTokenJtiStore as l, decideMeshClearPortOff as m, TlsTcpTransporter as n, enrollMeshNode as o, checkProcessMeshClearPort as p, Errors as r, JoinTokenJtiStore as s, systemConfigMeshActions as t, verifyMeshJoinToken as u, processMeshCrl as v, createMeshCsrPem as w, requireProcessMeshCa as x, MeshCaKeeper as y, setProcessMeshEnforcer as z };
+export { loadMeshCa as A, MESH_AUTH_MODE_FIELD as B, caFingerprintCompact as C, generateMeshKeyPair as D, generateMeshCa as E, UnlockTicketJtiStore as F, requestProcessMeshEnforcement as G, getProcessMeshAuthStatus as H, isAllowedAgentDashboardReturnTo as I, setProcessMeshEnforcer as J, setProcessMeshAuthMode as K, mintAgentUiUnlockTicket as L, AGENT_UI_UNLOCK_DOMAIN as M, AGENT_UI_UNLOCK_TTL_MS as N, issueMeshLeafForNode as O, AGENT_UI_UNLOCK_VERSION as P, readCidrSetting as Q, parseAgentDashboardOrigins as R, caFingerprint as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, exportMeshPrivateKeyPem as T, isMeshAuthMode as U, getProcessMeshAuthMode as V, parseMeshAuthMode as W, normalizeIp as X, createCidrMatcher as Y, parseCidrList as Z, MeshCrl as _, setProcessMeshTlsEnabler as a, getProcessMeshCaState as b, mintMeshJoinToken as c, MESH_CLEAR_PORT_FIELD as d, applyProcessMeshClearPort as f, setProcessMeshClearPortControl as g, getProcessNodeMeshTransport as h, ServiceBroker as i, AGENT_DASHBOARD_ORIGINS_FIELD as j, issueMeshLeafFromCsr as k, processJoinTokenJtiStore as l, decideMeshClearPortOff as m, TlsTcpTransporter as n, enrollMeshNode as o, checkProcessMeshClearPort as p, setProcessMeshAuthStatusSource as q, Errors as r, JoinTokenJtiStore as s, systemConfigMeshActions as t, verifyMeshJoinToken as u, processMeshCrl as v, createMeshCsrPem as w, requireProcessMeshCa as x, MeshCaKeeper as y, verifyAgentUiUnlockTicket as z };

package/dist/index.js

@@ -13863,8 +13863,12 @@ exports.ADMIN_TOKEN_MAX_LIFETIME_MS = require_builtins_local_auth_local_auth_add
 exports.ADMIN_TOKEN_PREFIX = require_builtins_local_auth_local_auth_addon.ADMIN_TOKEN_PREFIX;
 exports.AGENT_CAP_FWD_ACTION = require_child_cap_dispatch.AGENT_CAP_FWD_ACTION;
 exports.AGENT_CAP_FWD_SERVICE = require_child_cap_dispatch.AGENT_CAP_FWD_SERVICE;
+exports.AGENT_DASHBOARD_ORIGINS_FIELD = require_builtins_system_config_system_config_addon.AGENT_DASHBOARD_ORIGINS_FIELD;
 exports.AGENT_READINESS_SERVICE_NAME = AGENT_READINESS_SERVICE_NAME;
 exports.AGENT_REGISTER_NODE_ACTION = AGENT_REGISTER_NODE_ACTION;
+exports.AGENT_UI_UNLOCK_DOMAIN = require_builtins_system_config_system_config_addon.AGENT_UI_UNLOCK_DOMAIN;
+exports.AGENT_UI_UNLOCK_TTL_MS = require_builtins_system_config_system_config_addon.AGENT_UI_UNLOCK_TTL_MS;
+exports.AGENT_UI_UNLOCK_VERSION = require_builtins_system_config_system_config_addon.AGENT_UI_UNLOCK_VERSION;
 exports.ALL_CAPABILITY_DEFINITIONS = require_dist.ALL_CAPABILITY_DEFINITIONS;
 exports.ARRAY_BUFFER_CENSUS_COOLDOWN_MS = require_child_cap_dispatch.ARRAY_BUFFER_CENSUS_COOLDOWN_MS;
 exports.ARRAY_BUFFER_CENSUS_SUSTAIN_MS = require_child_cap_dispatch.ARRAY_BUFFER_CENSUS_SUSTAIN_MS;
@@ -14060,6 +14064,7 @@ exports.UPLOADED_CA_FILE = require_tls.UPLOADED_CA_FILE;
 exports.USER_MANAGEMENT_INTERNAL = require_builtins_local_auth_local_auth_addon.USER_MANAGEMENT_INTERNAL;
 exports.UdsLocalTransportClient = require_child_cap_dispatch.UdsLocalTransportClient;
 exports.UdsLocalTransportServer = require_child_cap_dispatch.UdsLocalTransportServer;
+exports.UnlockTicketJtiStore = require_builtins_system_config_system_config_addon.UnlockTicketJtiStore;
 exports.UserManager = require_builtins_local_auth_local_auth_addon.UserManager;
 exports.WinstonDestination = require_builtins_winston_logging_index.WinstonDestination$1;
 exports.WinstonLoggingAddon = require_builtins_winston_logging_index.WinstonLoggingAddon$1;
@@ -14292,6 +14297,7 @@ Object.defineProperty(exports, "installPythonRequirements", {
 });
 exports.ipcParentLink = require_child_cap_dispatch.ipcParentLink;
 exports.isAddonDeploySource = isAddonDeploySource;
+exports.isAllowedAgentDashboardReturnTo = require_builtins_system_config_system_config_addon.isAllowedAgentDashboardReturnTo;
 exports.isArrayBufferCensusReport = require_child_cap_dispatch.isArrayBufferCensusReport;
 exports.isArrayOutputSchema = require_dist.isArrayOutputSchema;
 exports.isClusterSecretMismatchError = require_constants.isClusterSecretMismatchError;
@@ -14314,11 +14320,13 @@ exports.loadTlsCert = require_tls.loadTlsCert;
 exports.localEndpointPath = require_child_cap_dispatch.localEndpointPath;
 exports.localProviderLink = require_child_cap_dispatch.localProviderLink;
 exports.meshErrorType = meshErrorType;
+exports.mintAgentUiUnlockTicket = require_builtins_system_config_system_config_addon.mintAgentUiUnlockTicket;
 exports.mintMeshJoinToken = require_builtins_system_config_system_config_addon.mintMeshJoinToken;
 exports.mountNativeCapService = require_child_cap_dispatch.mountNativeCapService;
 exports.nextRssBudgetState = require_child_cap_dispatch.nextRssBudgetState;
 exports.normalizeIp = require_builtins_system_config_system_config_addon.normalizeIp;
 exports.overlayGetStatus = overlayGetStatus;
+exports.parseAgentDashboardOrigins = require_builtins_system_config_system_config_addon.parseAgentDashboardOrigins;
 exports.parseCapAction = require_child_cap_dispatch.parseCapAction;
 exports.parseCidrList = require_builtins_system_config_system_config_addon.parseCidrList;
 exports.parseMeshAuthMode = require_builtins_system_config_system_config_addon.parseMeshAuthMode;
@@ -14404,6 +14412,7 @@ exports.subscribePassthrough = require_child_cap_dispatch.subscribePassthrough;
 exports.udsChildLogToWorkerEntry = require_child_cap_dispatch.udsChildLogToWorkerEntry;
 exports.validateProviderRegistrations = require_child_cap_dispatch.validateProviderRegistrations;
 exports.validateUploadedTls = require_tls.validateUploadedTls;
+exports.verifyAgentUiUnlockTicket = require_builtins_system_config_system_config_addon.verifyAgentUiUnlockTicket;
 exports.verifyMeshJoinToken = require_builtins_system_config_system_config_addon.verifyMeshJoinToken;
 exports.waitUntilReady = waitUntilReady;
 exports.writeExtraSans = require_tls.writeExtraSans;

package/dist/index.mjs

@@ -27,7 +27,7 @@ import { i as stripForwardedCaller, n as HUB_CAP_FWD_SERVICE, r as createHubCapF
 import { StorageOrchestratorAddon, n as buildStorageLocationRegistry, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
 import { _ as clusterSecretMatches, a as MESH_CA_FIELD, b as isClusterSecretMismatchError, d as CLUSTER_SECRET_MISMATCH_TYPE, f as CLUSTER_SECRET_REF, g as checkClusterSecret, h as CLUSTER_SECRET_UNAVAILABLE_TYPE, m as CLUSTER_SECRET_SETTINGS_KEY, o as MESH_CA_KEY_REF, p as CLUSTER_SECRET_REJECTED_EXIT_CODE, r as DEFAULT_HUB_TLS_TCP_PORT, s as MESH_CA_SETTINGS_KEY, v as getProcessClusterSecretGate, x as setProcessClusterSecretGate, y as hashClusterSecret } from "./constants-D5z4EwY8.mjs";
-import { A as loadMeshCa, B as createCidrMatcher, C as caFingerprintCompact, D as generateMeshKeyPair, E as generateMeshCa, F as parseMeshAuthMode, H as parseCidrList, I as requestProcessMeshEnforcement, L as setProcessMeshAuthMode, M as getProcessMeshAuthMode, N as getProcessMeshAuthStatus, O as issueMeshLeafForNode, P as isMeshAuthMode, R as setProcessMeshAuthStatusSource, S as caFingerprint, SystemConfigAddon, T as exportMeshPrivateKeyPem, U as readCidrSetting, V as normalizeIp, _ as MeshCrl, a as setProcessMeshTlsEnabler, b as getProcessMeshCaState, c as mintMeshJoinToken, d as MESH_CLEAR_PORT_FIELD, f as applyProcessMeshClearPort, g as setProcessMeshClearPortControl, h as getProcessNodeMeshTransport, i as ServiceBroker, j as MESH_AUTH_MODE_FIELD, k as issueMeshLeafFromCsr, l as processJoinTokenJtiStore, m as decideMeshClearPortOff, n as TlsTcpTransporter, o as enrollMeshNode, p as checkProcessMeshClearPort, r as Errors, s as JoinTokenJtiStore, u as verifyMeshJoinToken, v as processMeshCrl, w as createMeshCsrPem, x as requireProcessMeshCa, y as MeshCaKeeper, z as setProcessMeshEnforcer } from "./builtins/system-config/system-config.addon.mjs";
+import { A as loadMeshCa, B as MESH_AUTH_MODE_FIELD, C as caFingerprintCompact, D as generateMeshKeyPair, E as generateMeshCa, F as UnlockTicketJtiStore, G as requestProcessMeshEnforcement, H as getProcessMeshAuthStatus, I as isAllowedAgentDashboardReturnTo, J as setProcessMeshEnforcer, K as setProcessMeshAuthMode, L as mintAgentUiUnlockTicket, M as AGENT_UI_UNLOCK_DOMAIN, N as AGENT_UI_UNLOCK_TTL_MS, O as issueMeshLeafForNode, P as AGENT_UI_UNLOCK_VERSION, Q as readCidrSetting, R as parseAgentDashboardOrigins, S as caFingerprint, SystemConfigAddon, T as exportMeshPrivateKeyPem, U as isMeshAuthMode, V as getProcessMeshAuthMode, W as parseMeshAuthMode, X as normalizeIp, Y as createCidrMatcher, Z as parseCidrList, _ as MeshCrl, a as setProcessMeshTlsEnabler, b as getProcessMeshCaState, c as mintMeshJoinToken, d as MESH_CLEAR_PORT_FIELD, f as applyProcessMeshClearPort, g as setProcessMeshClearPortControl, h as getProcessNodeMeshTransport, i as ServiceBroker, j as AGENT_DASHBOARD_ORIGINS_FIELD, k as issueMeshLeafFromCsr, l as processJoinTokenJtiStore, m as decideMeshClearPortOff, n as TlsTcpTransporter, o as enrollMeshNode, p as checkProcessMeshClearPort, q as setProcessMeshAuthStatusSource, r as Errors, s as JoinTokenJtiStore, u as verifyMeshJoinToken, v as processMeshCrl, w as createMeshCsrPem, x as requireProcessMeshCa, y as MeshCaKeeper, z as verifyAgentUiUnlockTicket } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as resolveFormatRevision, S as isModelDownloaded, _ as downloadModel, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as ensureModel, w as revisionWeightUrl, y as fetchJson } from "./event-loop-stall-monitor-BtK_0Pjc.mjs";
@@ -13856,4 +13856,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentMeshAuthenticator, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_CLEAR_PORT_FIELD, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCrl, MeshJoinClient, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, applyProcessMeshClearPort, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, checkClusterSecret, checkProcessMeshClearPort, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, decideMeshAutoEnforce, decideMeshClearPortOff, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessNodeMeshTransport, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isCredentialKeyName, isInfraCapability, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, issueMeshLeafForNode, issueMeshLeafFromCsr, leafFingerprintOf, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, meshErrorType, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, overlayGetStatus, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, prepareRestoreArchive, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshClearPortControl, setProcessMeshEnforcer, setProcessMeshTlsEnabler, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyMeshJoinToken, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentMeshAuthenticator, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_CLEAR_PORT_FIELD, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCrl, MeshJoinClient, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, applyProcessMeshClearPort, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, checkClusterSecret, checkProcessMeshClearPort, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, decideMeshAutoEnforce, decideMeshClearPortOff, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessNodeMeshTransport, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isCredentialKeyName, isInfraCapability, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, issueMeshLeafForNode, issueMeshLeafFromCsr, leafFingerprintOf, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, meshErrorType, mintAgentUiUnlockTicket, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, prepareRestoreArchive, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshClearPortControl, setProcessMeshEnforcer, setProcessMeshTlsEnabler, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyMeshJoinToken, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };