@camstack/system 1.2.386 → 1.2.388

package/dist/kernel/index.d.ts

@@ -69,6 +69,8 @@ export type { MeshJoinAuthenticateParams, MeshJoinAuthenticateResult, MeshJoinCh
 export { getProcessMeshAuthMode, getProcessMeshAuthStatus, isMeshAuthMode, MESH_AUTH_MODE_FIELD, parseMeshAuthMode, requestProcessMeshEnforcement, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshEnforcer, } from './moleculer/mesh-auth-mode.js';
 export { decideMeshAutoEnforce, MESH_AUTO_ENFORCE_GRACE_MS, } from './moleculer/mesh-auto-enforce.js';
 export type { MeshAutoEnforceDecision, MeshAutoEnforceInput, } from './moleculer/mesh-auto-enforce.js';
+export { AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, isAllowedAgentDashboardReturnTo, mintAgentUiUnlockTicket, parseAgentDashboardOrigins, UnlockTicketJtiStore, verifyAgentUiUnlockTicket, } from './moleculer/agent-ui-unlock.js';
+export type { AgentUiUnlockPayload, MintAgentUiUnlockTicketInput, VerifyAgentUiUnlockTicketOptions, } from './moleculer/agent-ui-unlock.js';
 export type { MeshAuthMode, MeshAuthStatus, MeshEnforcer, MeshNodeAuthEntry, MeshNodeAuthState, } from './moleculer/mesh-auth-mode.js';
 export { serializeTypedArrays } from './moleculer/typed-array-serde.js';
 export { createReadinessService, createReadinessServiceForRegistry, AGENT_READINESS_SERVICE_NAME, } from './moleculer/readiness-service.js';

package/dist/kernel/moleculer/agent-ui-unlock.d.ts

@@ -0,0 +1,52 @@
+export declare const AGENT_UI_UNLOCK_DOMAIN = "camstack-agent-ui-unlock/v1";
+export declare const AGENT_UI_UNLOCK_VERSION: 1;
+/** Ticket lifetime — long enough for a redirect hop, short enough to steal poorly. */
+export declare const AGENT_UI_UNLOCK_TTL_MS: number;
+/**
+ * Cluster settings key: extra origins allowed as `returnTo` for Continue-with-hub
+ * (NPM hostnames that are not `:4444` on a LAN IP). Comma-separated origins.
+ */
+export declare const AGENT_DASHBOARD_ORIGINS_FIELD = "agentDashboardOrigins";
+export interface AgentUiUnlockPayload {
+    readonly v: typeof AGENT_UI_UNLOCK_VERSION;
+    readonly nodeId: string;
+    /** Epoch ms. */
+    readonly exp: number;
+    readonly jti: string;
+}
+/** In-memory spent `jti` until `exp` (ms). */
+export declare class UnlockTicketJtiStore {
+    private readonly spent;
+    isSpent(jti: string, nowMs?: number): boolean;
+    /** Record a jti as used until `exp`. Returns false if already spent. */
+    consume(jti: string, exp: number, nowMs?: number): boolean;
+    /** Test helper. */
+    size(): number;
+    private gc;
+}
+export interface MintAgentUiUnlockTicketInput {
+    /** `hashClusterSecret(secret)` — never the raw secret. */
+    readonly secretHash: string;
+    readonly nodeId: string;
+    readonly ttlMs?: number;
+    readonly nowMs?: number;
+    readonly jti?: string;
+}
+export declare function mintAgentUiUnlockTicket(input: MintAgentUiUnlockTicketInput): string;
+export interface VerifyAgentUiUnlockTicketOptions {
+    readonly expectedNodeId: string;
+    readonly nowMs?: number;
+}
+/**
+ * Verify a ticket under `secretHash`. Returns the payload, or `null` when the
+ * signature, shape, expiry or nodeId fails (no reason string — refuse quietly).
+ */
+export declare function verifyAgentUiUnlockTicket(secretHash: string, ticket: string, options: VerifyAgentUiUnlockTicketOptions): AgentUiUnlockPayload | null;
+/**
+ * True when `returnTo` may receive a ticket redirect. Default: any http(s)
+ * origin whose port is 4444. Extra origins come from
+ * {@link AGENT_DASHBOARD_ORIGINS_FIELD} (exact origin match).
+ */
+export declare function isAllowedAgentDashboardReturnTo(returnTo: string, extraOrigins?: readonly string[]): boolean;
+/** Parse a stored comma/whitespace-separated origins list. */
+export declare function parseAgentDashboardOrigins(stored: unknown): readonly string[];

package/dist/kernel/moleculer/mesh-mtls/tls-tcp-transporter.d.ts

@@ -77,17 +77,30 @@ export declare class TlsTcpTransporter extends TlsTcpTransporter_base {
     /** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
     private readonly tlsPeers;
     private clearDisabled;
+    /** Clear-text `TcpWriter.connect` captured once before the TLS wrap (A→B). */
+    private clearWriterConnect;
+    private writerTlsPatched;
     constructor(opts?: TlsTcpTransporterOptions);
     startTcpServer(): Promise<number>;
     connect(): Promise<void>;
     /**
-     * Agent / outbound: wrap `TcpWriter.connect` so peers are dialed with
-     * mutual TLS and the peer CN must match the expected node id.
+     * Outbound dial uses mTLS when the peer is already known on TLS (inbound
+     * handshake), or when dialling the hub node id (agent → hub). Everyone else
+     * (runners, unenrolled agents) stays on the clear writer — the hub must not
+     * TLS-wrap every `connect` after deferred `enableMeshTls`.
+     */
+    private shouldDialPeerWithTls;
+    private peerTlsDialPort;
+    /**
+     * Wrap `TcpWriter.connect` so TLS peers are dialed with mutual TLS on the
+     * well-known mesh TLS port (default 6443). Idempotent: the clear connect is
+     * captured once; material refresh rebinds the wrapper.
      */
     private patchWriterForTlsClient;
     /**
      * Enable (or refresh) the TLS listener once the mesh CA / hub leaf are ready.
-     * Safe to call after connect — starts listening on `tlsPort` alongside clear.
+     * Safe to call after connect — starts listening on `tlsPort` alongside clear
+     * and patches the writer so hub→agent dials use mTLS (Release A→B).
      */
     enableMeshTls(material: MeshTlsMaterial): Promise<void>;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.386",
+  "version": "1.2.388",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",