@camstack/system 1.2.387 → 1.2.389

package/dist/builtins/system-config/system-config.addon.js

@@ -87517,6 +87517,9 @@ var TlsTcpTransporter = class extends TcpTransporter {
 	/** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
 	tlsPeers = /* @__PURE__ */ new Map();
 	clearDisabled = false;
+	/** Clear-text `TcpWriter.connect` captured once before the TLS wrap (A→B). */
+	clearWriterConnect = null;
+	writerTlsPatched = false;
 	constructor(opts = {}) {
 		super({ ...opts });
 		this.meshTls = opts.meshTls ?? null;
@@ -87539,20 +87542,43 @@ var TlsTcpTransporter = class extends TcpTransporter {
 		}).then(() => this.onConnected());
 	}
 	/**
-	* Agent / outbound: wrap `TcpWriter.connect` so peers are dialed with
-	* mutual TLS and the peer CN must match the expected node id.
+	* Outbound dial uses mTLS when the peer is already known on TLS (inbound
+	* handshake), or when dialling the hub node id (agent → hub). Everyone else
+	* (runners, unenrolled agents) stays on the clear writer — the hub must not
+	* TLS-wrap every `connect` after deferred `enableMeshTls`.
+	*/
+	shouldDialPeerWithTls(nodeID) {
+		if (nodeID === "hub") return true;
+		return this.tlsPeers.has(nodeID);
+	}
+	peerTlsDialPort() {
+		return this.opts.tlsPort ?? 6443;
+	}
+	/**
+	* Wrap `TcpWriter.connect` so TLS peers are dialed with mutual TLS on the
+	* well-known mesh TLS port (default 6443). Idempotent: the clear connect is
+	* captured once; material refresh rebinds the wrapper.
 	*/
 	patchWriterForTlsClient() {
-		const material = this.meshTls;
-		if (material === null) return;
+		if (this.meshTls === null) return;
 		const writer = this.writer;
 		if (writer === null || typeof writer.connect !== "function") return;
+		if (!this.writerTlsPatched) {
+			this.clearWriterConnect = writer.connect.bind(writer);
+			this.writerTlsPatched = true;
+		}
+		const clearConnect = this.clearWriterConnect;
+		if (clearConnect === null) return;
 		const crl = this.crl;
+		const self = this;
 		writer.connect = (nodeID) => {
+			if (!self.shouldDialPeerWithTls(nodeID)) return clearConnect(nodeID);
+			const material = self.meshTls;
+			if (material === null) return clearConnect(nodeID);
 			const node = writer.transporter.getNode(nodeID);
 			if (!node) return writer.Promise.reject(/* @__PURE__ */ new Error(`Missing node info for '${nodeID}'!`));
 			const host = writer.transporter.getNodeAddress(node);
-			const port = node.port;
+			const port = self.peerTlsDialPort();
 			writer.logger.debug(`Connecting (TLS) to '${nodeID}' via ${host}:${port}`);
 			return new writer.Promise((resolve, reject) => {
 				const socket = node_tls.connect({
@@ -87581,6 +87607,11 @@ var TlsTcpTransporter = class extends TcpTransporter {
 					if (identity) {
 						tlsSock.meshPeerCn = identity.cn;
 						tlsSock.meshPeerSerial = identity.serial;
+						self.tlsPeers.set(identity.cn, identity.serial);
+						self.tlsSockets.add(tlsSock);
+						tlsSock.on("close", () => {
+							self.tlsSockets.delete(tlsSock);
+						});
 					}
 					writer.addSocket(nodeID, tlsSock, true);
 					writer.logger.debug(`Connected successfully (TLS) to '${nodeID}'.`);
@@ -87603,11 +87634,13 @@ var TlsTcpTransporter = class extends TcpTransporter {
 	}
 	/**
 	* Enable (or refresh) the TLS listener once the mesh CA / hub leaf are ready.
-	* Safe to call after connect — starts listening on `tlsPort` alongside clear.
+	* Safe to call after connect — starts listening on `tlsPort` alongside clear
+	* and patches the writer so hub→agent dials use mTLS (Release A→B).
 	*/
 	async enableMeshTls(material) {
 		this.meshTls = material;
 		await this.startTlsServerIfReady();
+		this.patchWriterForTlsClient();
 	}
 	/**
 	* How `nodeId` reaches this transporter: `tls` once it completed a mutual-TLS

package/dist/builtins/system-config/system-config.addon.mjs

@@ -87508,6 +87508,9 @@ var TlsTcpTransporter = class extends TcpTransporter {
 	/** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
 	tlsPeers = /* @__PURE__ */ new Map();
 	clearDisabled = false;
+	/** Clear-text `TcpWriter.connect` captured once before the TLS wrap (A→B). */
+	clearWriterConnect = null;
+	writerTlsPatched = false;
 	constructor(opts = {}) {
 		super({ ...opts });
 		this.meshTls = opts.meshTls ?? null;
@@ -87530,20 +87533,43 @@ var TlsTcpTransporter = class extends TcpTransporter {
 		}).then(() => this.onConnected());
 	}
 	/**
-	* Agent / outbound: wrap `TcpWriter.connect` so peers are dialed with
-	* mutual TLS and the peer CN must match the expected node id.
+	* Outbound dial uses mTLS when the peer is already known on TLS (inbound
+	* handshake), or when dialling the hub node id (agent → hub). Everyone else
+	* (runners, unenrolled agents) stays on the clear writer — the hub must not
+	* TLS-wrap every `connect` after deferred `enableMeshTls`.
+	*/
+	shouldDialPeerWithTls(nodeID) {
+		if (nodeID === "hub") return true;
+		return this.tlsPeers.has(nodeID);
+	}
+	peerTlsDialPort() {
+		return this.opts.tlsPort ?? 6443;
+	}
+	/**
+	* Wrap `TcpWriter.connect` so TLS peers are dialed with mutual TLS on the
+	* well-known mesh TLS port (default 6443). Idempotent: the clear connect is
+	* captured once; material refresh rebinds the wrapper.
 	*/
 	patchWriterForTlsClient() {
-		const material = this.meshTls;
-		if (material === null) return;
+		if (this.meshTls === null) return;
 		const writer = this.writer;
 		if (writer === null || typeof writer.connect !== "function") return;
+		if (!this.writerTlsPatched) {
+			this.clearWriterConnect = writer.connect.bind(writer);
+			this.writerTlsPatched = true;
+		}
+		const clearConnect = this.clearWriterConnect;
+		if (clearConnect === null) return;
 		const crl = this.crl;
+		const self = this;
 		writer.connect = (nodeID) => {
+			if (!self.shouldDialPeerWithTls(nodeID)) return clearConnect(nodeID);
+			const material = self.meshTls;
+			if (material === null) return clearConnect(nodeID);
 			const node = writer.transporter.getNode(nodeID);
 			if (!node) return writer.Promise.reject(/* @__PURE__ */ new Error(`Missing node info for '${nodeID}'!`));
 			const host = writer.transporter.getNodeAddress(node);
-			const port = node.port;
+			const port = self.peerTlsDialPort();
 			writer.logger.debug(`Connecting (TLS) to '${nodeID}' via ${host}:${port}`);
 			return new writer.Promise((resolve, reject) => {
 				const socket = tls.connect({
@@ -87572,6 +87598,11 @@ var TlsTcpTransporter = class extends TcpTransporter {
 					if (identity) {
 						tlsSock.meshPeerCn = identity.cn;
 						tlsSock.meshPeerSerial = identity.serial;
+						self.tlsPeers.set(identity.cn, identity.serial);
+						self.tlsSockets.add(tlsSock);
+						tlsSock.on("close", () => {
+							self.tlsSockets.delete(tlsSock);
+						});
 					}
 					writer.addSocket(nodeID, tlsSock, true);
 					writer.logger.debug(`Connected successfully (TLS) to '${nodeID}'.`);
@@ -87594,11 +87625,13 @@ var TlsTcpTransporter = class extends TcpTransporter {
 	}
 	/**
 	* Enable (or refresh) the TLS listener once the mesh CA / hub leaf are ready.
-	* Safe to call after connect — starts listening on `tlsPort` alongside clear.
+	* Safe to call after connect — starts listening on `tlsPort` alongside clear
+	* and patches the writer so hub→agent dials use mTLS (Release A→B).
 	*/
 	async enableMeshTls(material) {
 		this.meshTls = material;
 		await this.startTlsServerIfReady();
+		this.patchWriterForTlsClient();
 	}
 	/**
 	* How `nodeId` reaches this transporter: `tls` once it completed a mutual-TLS

package/dist/index.js

@@ -11608,7 +11608,7 @@ function delay(ms, signal) {
 */
 async function callRegisterNodeWithRetry(broker, params, opts) {
 	const action = opts.target === "hub" ? "$hub.registerNode" : "$agent.registerNode";
-	const callOpts = opts.target === "agent" && opts.targetNodeId ? { nodeID: opts.targetNodeId } : void 0;
+	const callOpts = opts.target === "hub" ? { nodeID: "hub" } : opts.target === "agent" && opts.targetNodeId ? { nodeID: opts.targetNodeId } : void 0;
 	const base = opts.baseDelayMs ?? 250;
 	let attempt = 0;
 	for (;;) {

package/dist/index.mjs

@@ -11605,7 +11605,7 @@ function delay(ms, signal) {
 */
 async function callRegisterNodeWithRetry(broker, params, opts) {
 	const action = opts.target === "hub" ? "$hub.registerNode" : "$agent.registerNode";
-	const callOpts = opts.target === "agent" && opts.targetNodeId ? { nodeID: opts.targetNodeId } : void 0;
+	const callOpts = opts.target === "hub" ? { nodeID: "hub" } : opts.target === "agent" && opts.targetNodeId ? { nodeID: opts.targetNodeId } : void 0;
 	const base = opts.baseDelayMs ?? 250;
 	let attempt = 0;
 	for (;;) {

package/dist/kernel/moleculer/mesh-mtls/tls-tcp-transporter.d.ts

@@ -77,17 +77,30 @@ export declare class TlsTcpTransporter extends TlsTcpTransporter_base {
     /** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
     private readonly tlsPeers;
     private clearDisabled;
+    /** Clear-text `TcpWriter.connect` captured once before the TLS wrap (A→B). */
+    private clearWriterConnect;
+    private writerTlsPatched;
     constructor(opts?: TlsTcpTransporterOptions);
     startTcpServer(): Promise<number>;
     connect(): Promise<void>;
     /**
-     * Agent / outbound: wrap `TcpWriter.connect` so peers are dialed with
-     * mutual TLS and the peer CN must match the expected node id.
+     * Outbound dial uses mTLS when the peer is already known on TLS (inbound
+     * handshake), or when dialling the hub node id (agent → hub). Everyone else
+     * (runners, unenrolled agents) stays on the clear writer — the hub must not
+     * TLS-wrap every `connect` after deferred `enableMeshTls`.
+     */
+    private shouldDialPeerWithTls;
+    private peerTlsDialPort;
+    /**
+     * Wrap `TcpWriter.connect` so TLS peers are dialed with mutual TLS on the
+     * well-known mesh TLS port (default 6443). Idempotent: the clear connect is
+     * captured once; material refresh rebinds the wrapper.
      */
     private patchWriterForTlsClient;
     /**
      * Enable (or refresh) the TLS listener once the mesh CA / hub leaf are ready.
-     * Safe to call after connect — starts listening on `tlsPort` alongside clear.
+     * Safe to call after connect — starts listening on `tlsPort` alongside clear
+     * and patches the writer so hub→agent dials use mTLS (Release A→B).
      */
     enableMeshTls(material: MeshTlsMaterial): Promise<void>;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.387",
+  "version": "1.2.389",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",