@camstack/system 1.2.395 → 1.2.397

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,5 +1,5 @@
 import { Ln as storageOccupancyCapability, Vr as nodePin, X as backupCapability, dr as BaseAddon, ei as toNodeId, ri as EventCategory, rn as mayWriteToLocation } from "../../dist-0P1gm4Gd.mjs";
-import { a as BackupSnapshotRefusedError, c as BackupKeyFormatError, d as generateBackupKeyPair, f as parseBackupPublicKey, i as BackupCancelledError, n as precheckRestoreKey, o as SystemBackupService, p as parseBackupSecretKey, r as prepareRestoreArchive, u as ENCRYPTED_BACKUP_SUFFIX } from "../../restore-archive-KnMS8Uta.mjs";
+import { a as BackupSnapshotRefusedError, c as BackupKeyFormatError, d as generateBackupKeyPair, f as parseBackupPublicKey, i as BackupCancelledError, n as precheckRestoreKey, o as SystemBackupService, p as parseBackupSecretKey, r as prepareRestoreArchive, u as ENCRYPTED_BACKUP_SUFFIX } from "../../restore-archive-DQ2NuwD1.mjs";
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/keychain/index.js

@@ -5,7 +5,7 @@ Object.defineProperties(exports, {
 const require_chunk = require("../../chunk-Cek0wNdY.js");
 const require_dist = require("../../dist-CME5sVBJ.js");
 const require_jwt_signing_key = require("../../jwt-signing-key-CyoJaT3C.js");
-const require_constants = require("../../constants-Bz9gKWe8.js");
+const require_constants = require("../../constants-Dcecs0Ks.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/keychain/index.mjs

@@ -1,6 +1,6 @@
 import { E as KEYCHAIN_RESET_TRIGGER_ACTOR, Gr as parseSecretRef, Gt as keychainAdminCapability, Hr as normalizeSecretOwner, Kt as keychainCapability, Mr as formatSecretScope, dr as BaseAddon, ri as EventCategory } from "../../dist-0P1gm4Gd.mjs";
 import { r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-DK-IFI9j.mjs";
-import { m as CLUSTER_SECRET_SETTINGS_KEY, o as MESH_CA_KEY_REF } from "../../constants-C1WoQ0E8.mjs";
+import { a as MESH_CA_KEY_REF, p as CLUSTER_SECRET_SETTINGS_KEY } from "../../constants-5vADty9I.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/system-config/system-config.addon.d.ts

@@ -10,12 +10,6 @@ export declare class SystemConfigAddon extends BaseAddon {
 	constructor();
 	protected onInitialize(): Promise<AddonInitResult<typeof systemConfigMeshActions>>;
 	protected onShutdown(): Promise<void>;
-	/**
-	* Boot: a stored `meshClearPort: off` is the operator's standing choice, so it
-	* is applied WITHOUT the agents gate (nobody is connected yet to be checked).
-	* Default `on` changes nothing.
-	*/
-	private applyStoredClearPort;
 	private onMeshCaReady;
 	private mintJoinToken;
 	/** D821 — short-lived ticket for the agent's `:4444` unlock session. */
@@ -30,7 +24,7 @@ export declare class SystemConfigAddon extends BaseAddon {
 	/**
 	* The admin UI / `addonSettings` cap prefer {@link BaseAddon.updateGlobalSettingsAsOperator}.
 	* That BaseAddon path writes the generic addon store and never reaches
-	* {@link writeClusterSection} / {@link writeMeshClearPort}. Route the operator
+	* {@link writeClusterSection}. Route the operator
 	* write through the same section-aware path as {@link updateGlobalSettings}.
 	*/
 	override updateGlobalSettingsAsOperator(patch: Record<string, unknown>, _nodeId?: string): Promise<void>;
@@ -43,12 +37,6 @@ export declare class SystemConfigAddon extends BaseAddon {
 	* enforced (D821) — a legacy `meshAuth` in the patch is ignored.
 	*/
 	private writeClusterSection;
-	/**
-	* `cluster.meshClearPort`: `off` is REFUSED while any online agent still
-	* connects in clear (or the TLS listener is not up); the refusal names them.
-	* Persist, then apply — an `on` save always passes.
-	*/
-	private writeMeshClearPort;
 	/** Persist + publish mesh auth mode (always `enforced` after D821). */
 	private writeMeshAuthMode;
 	/**

package/dist/builtins/system-config/system-config.addon.js

@@ -5,7 +5,7 @@ Object.defineProperties(exports, {
 const require_chunk = require("../../chunk-Cek0wNdY.js");
 const require_dist = require("../../dist-CME5sVBJ.js");
 const require_ms$1 = require("../../ms-t68_FaqE.js");
-const require_constants$8 = require("../../constants-Bz9gKWe8.js");
+const require_constants$8 = require("../../constants-Dcecs0Ks.js");
 const require_x509_es = require("../../x509.es-BhTzcFhZ.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -607,67 +607,23 @@ function processMeshCrl() {
 	return crl;
 }
 //#endregion
-//#region src/kernel/moleculer/mesh-mtls/mesh-clear-port.ts
-/** The field key inside the `cluster` section. */
-var MESH_CLEAR_PORT_FIELD = "meshClearPort";
-function isMeshClearPortMode(value) {
-	return value === "on" || value === "off";
-}
-/** A stored value that is not a mode reads as `on`: never cut the mesh on a typo. */
-function parseMeshClearPortMode(value) {
-	return isMeshClearPortMode(value) ? value : "on";
-}
-/** Pure: may the clear port be switched off right now? */
-function decideMeshClearPortOff(control) {
-	if (control === null) return {
-		allowed: false,
-		blocking: [],
-		error: "The clear mesh port can only be switched off on the hub (no mesh transport here)."
-	};
-	if (!control.isTlsListening()) return {
-		allowed: false,
-		blocking: [],
-		error: "Refusing to close the clear mesh port: the TLS listener (:6443) is not up yet, so no node could reach the hub."
-	};
-	const blocking = control.listOnlineAgents().filter((agent) => agent.transport !== "tls").map((agent) => agent.nodeId).toSorted();
-	if (blocking.length > 0) return {
-		allowed: false,
-		blocking,
-		error: `Refusing to close the clear mesh port: ${blocking.join(", ")} still ${blocking.length === 1 ? "connects" : "connect"} in clear. Enroll ${blocking.length === 1 ? "it" : "each"} with a join token first (System → Cluster → Add agent).`
-	};
-	return { allowed: true };
+//#region src/kernel/moleculer/mesh-mtls/mesh-peer-transport.ts
+var LOOKUP_SLOT = Symbol.for("camstack.cluster.mesh-peer-transport-lookup");
+/** Published by the hub broker owner; cleared on shutdown. */
+function setProcessMeshPeerTransportLookup(lookup) {
+	if (lookup === null) Reflect.deleteProperty(globalThis, LOOKUP_SLOT);
+	else Reflect.set(globalThis, LOOKUP_SLOT, lookup);
 }
-var CONTROL_SLOT = Symbol.for("camstack.cluster.mesh-clear-port-control");
-/** Published by the hub's broker owner; cleared on shutdown. */
-function setProcessMeshClearPortControl(control) {
-	if (control === null) Reflect.deleteProperty(globalThis, CONTROL_SLOT);
-	else Reflect.set(globalThis, CONTROL_SLOT, control);
+function isMeshPeerTransportLookup(value) {
+	return value !== null && typeof value === "object" && typeof Reflect.get(value, "transportOf") === "function";
 }
-function isMeshClearPortControl(value) {
-	return value !== null && typeof value === "object" && typeof Reflect.get(value, "listOnlineAgents") === "function" && typeof Reflect.get(value, "isTlsListening") === "function" && typeof Reflect.get(value, "apply") === "function" && typeof Reflect.get(value, "transportOf") === "function";
-}
-function getProcessMeshClearPortControl() {
-	const value = Reflect.get(globalThis, CONTROL_SLOT);
-	return isMeshClearPortControl(value) ? value : null;
+function getProcessMeshPeerTransportLookup() {
+	const value = Reflect.get(globalThis, LOOKUP_SLOT);
+	return isMeshPeerTransportLookup(value) ? value : null;
 }
 /** `tls` / `clear` for an agent as the hub sees it; `undefined` off the hub. */
 function getProcessNodeMeshTransport(nodeId) {
-	return getProcessMeshClearPortControl()?.transportOf(nodeId);
-}
-/**
-* Validate a requested mode against the live mesh. `on` is always allowed; `off`
-* only when {@link decideMeshClearPortOff} allows. Does NOT apply it.
-*/
-function checkProcessMeshClearPort(mode) {
-	if (mode === "on") return { allowed: true };
-	return decideMeshClearPortOff(getProcessMeshClearPortControl());
-}
-/** Apply a mode that {@link checkProcessMeshClearPort} allowed. No-op where nobody can. */
-async function applyProcessMeshClearPort(mode) {
-	const control = getProcessMeshClearPortControl();
-	if (control === null) return false;
-	await control.apply(mode);
-	return true;
+	return getProcessMeshPeerTransportLookup()?.transportOf(nodeId);
 }
 //#endregion
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -87469,11 +87425,12 @@ import_moleculer.default.Validators;
 //#endregion
 //#region src/kernel/moleculer/mesh-mtls/tls-tcp-transporter.ts
 /**
-* Moleculer TCP transporter with a second mTLS listener (Release A).
+* Moleculer TCP transporter with a mutual-TLS listener (D826).
 *
-* Hub rollout: clear TCP stays on `port` (default 6000); TLS 1.3 mutual auth
-* listens on `tlsPort` (default 6443). Agents without a certificate keep using
-* 6000. On a TLS socket, any packet whose `sender` ≠ the peer certificate CN
+* Hub: `hubTlsOnly` — no clear TCP reader and no UDP discovery; TLS 1.3 on
+* `tlsPort` (default 6443) once mesh material is ready. Agents without mesh
+* material use clear TCP on their own listen port and dial the hub on TLS when
+* enrolled. On a TLS socket, any packet whose `sender` ≠ the peer certificate CN
 * is dropped.
 */
 var TcpTransporterBase = Transporters.TCP;
@@ -87517,6 +87474,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	/** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
 	tlsPeers = /* @__PURE__ */ new Map();
 	clearDisabled = false;
+	hubTlsOnly;
 	/** Clear-text `TcpWriter.connect` captured once before the TLS wrap (A→B). */
 	clearWriterConnect = null;
 	writerTlsPatched = false;
@@ -87524,6 +87482,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		super({ ...opts });
 		this.meshTls = opts.meshTls ?? null;
 		this.crl = opts.crl ?? processMeshCrl();
+		this.hubTlsOnly = opts.hubTlsOnly === true;
 		if (this.opts.tlsPort === void 0) this.opts.tlsPort = require_constants$8.DEFAULT_HUB_TLS_TCP_PORT;
 	}
 	startTcpServer() {
@@ -87534,7 +87493,9 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	connect() {
 		return this.Promise.resolve().then(() => {
 			if (this.opts.urls) return this.loadUrls();
-		}).then(() => this.startTcpServer()).then(() => this.startTlsServerIfReady()).then(() => this.startUdpServer()).then(() => this.startTimers()).then(() => {
+		}).then(() => this.startTcpServer()).then(() => {
+			if (this.hubTlsOnly) this.disableClearTransport();
+		}).then(() => this.startTlsServerIfReady()).then(() => this.hubTlsOnly ? this.Promise.resolve() : this.startUdpServer()).then(() => this.startTimers()).then(() => {
 			this.logger.info("TCP Transporter started.");
 			this.connected = true;
 			this.nodes.localNode.port = this.opts.port;
@@ -87684,6 +87645,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	}
 	/** The switch back: listen on the clear port again and restart UDP discovery. Idempotent. */
 	async enableClearTransport() {
+		if (this.hubTlsOnly) return;
 		if (!this.clearDisabled) return;
 		this.clearDisabled = false;
 		if (this.reader !== null && this.reader.server?.listening !== true) await this.reader.listen();
@@ -87971,7 +87933,7 @@ var mintJoinTokenInputSchema = zod.z.object({
 	nodeId: zod.z.string().min(1).optional(),
 	/** Override hub HTTPS base (default: local-network publicEndpoint). */
 	hubUrl: zod.z.string().url().optional(),
-	/** Override `host:6000` clear mesh address carried in the token. */
+	/** Override `host:6443` TLS mesh address carried in the token. */
 	hubMeshAddress: zod.z.string().min(3).optional(),
 	/** Seconds until expiry; capped at 1 h. */
 	ttlSec: zod.z.number().int().positive().max(3600).optional()
@@ -88072,9 +88034,7 @@ var KEY_TO_SECTION = {
 	trustedProxies: "auth",
 	trustedNetworks: "auth",
 	[CLUSTER_SECRET_FIELD]: "cluster",
-	[MESH_AUTH_MODE_FIELD]: "cluster",
-	[MESH_CLEAR_PORT_FIELD]: "cluster",
-	[AGENT_DASHBOARD_ORIGINS_FIELD]: "cluster"
+	[MESH_AUTH_MODE_FIELD]: "cluster"
 };
 /** Bytes of a generated cluster secret (D802) — 256 bits, base64url (43 chars). */
 var GENERATED_SECRET_BYTES = 32;
@@ -88130,7 +88090,6 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			onReady: (ca) => this.onMeshCaReady(ca)
 		});
 		await this.meshCaKeeper.start();
-		await this.applyStoredClearPort();
 		this.ctx.logger.info("Initialized — exposes yml-backed sections via getGlobalSettings");
 		return {
 			customActions: systemConfigMeshActions,
@@ -88147,20 +88106,6 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		this.clusterSecretKeeper?.stop();
 		this.clusterSecretKeeper = null;
 	}
-	/**
-	* Boot: a stored `meshClearPort: off` is the operator's standing choice, so it
-	* is applied WITHOUT the agents gate (nobody is connected yet to be checked).
-	* Default `on` changes nothing.
-	*/
-	async applyStoredClearPort() {
-		try {
-			const stored = (await this.ctx.settings?.getSection("cluster"))?.[MESH_CLEAR_PORT_FIELD];
-			if (parseMeshClearPortMode(stored) !== "off") return;
-			if (await applyProcessMeshClearPort("off")) this.ctx.logger.info("Mesh clear port is OFF (cluster.meshClearPort)");
-		} catch (err) {
-			this.ctx.logger.warn("could not apply cluster.meshClearPort at boot", { meta: { error: require_dist.errMsg(err) } });
-		}
-	}
 	async onMeshCaReady(ca) {
 		const hubLeaf = await issueMeshLeafForNode(ca, "hub");
 		await requestProcessMeshTlsEnable({
@@ -88238,10 +88183,10 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 	async resolveHubMeshAddress() {
 		try {
 			const base = (await this.ctx.api?.localNetwork?.getAddresses?.query({}))?.roles?.internal?.resolved;
-			if (typeof base === "string" && base.length > 0) return `${new URL(base).hostname}:${require_constants$8.DEFAULT_HUB_TCP_PORT}`;
+			if (typeof base === "string" && base.length > 0) return `${new URL(base).hostname}:${require_constants$8.DEFAULT_HUB_TLS_TCP_PORT}`;
 		} catch {}
 		const host = (await this.ctx.settings?.getSection("server"))?.["host"];
-		return `${typeof host === "string" && host.length > 0 && host !== "0.0.0.0" ? host : "127.0.0.1"}:${require_constants$8.DEFAULT_HUB_TCP_PORT}`;
+		return `${typeof host === "string" && host.length > 0 && host !== "0.0.0.0" ? host : "127.0.0.1"}:${require_constants$8.DEFAULT_HUB_TLS_TCP_PORT}`;
 	}
 	/** The keychain handle for owner `system`; `null` where there is no door. */
 	systemSecrets() {
@@ -88337,52 +88282,18 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 				title: SECTION_TITLES["cluster"],
 				description: "Agents joining this hub. Every agent proves the cluster secret when it connects (challenge–response; the secret never crosses the network).",
 				columns: 1,
-				fields: [
-					{
-						type: "password",
-						key: CLUSTER_SECRET_FIELD,
-						label: "Cluster secret",
-						description: "Mandatory — generated by the hub at first boot and stored in the keychain. To pair an agent: Reveal and copy it here, then enter it in the agent (its status page, or the desktop setup window). Saving a new value rotates it: every agent must then be given the new one."
-					},
-					{
-						type: "select",
-						key: MESH_CLEAR_PORT_FIELD,
-						label: "Clear mesh port (:6000)",
-						description: "On keeps the clear TCP port and UDP discovery next to the TLS port (:6443). Off closes both — refused while any connected agent has not enrolled with a join token (the Cluster page shows TLS / clear per node).",
-						default: "on",
-						options: [{
-							value: "on",
-							label: "On — accept clear agents"
-						}, {
-							value: "off",
-							label: "Off — mutual TLS only"
-						}]
-					},
-					{
-						type: "info",
-						key: "meshAuthStatus",
-						label: "Mesh authentication",
-						content: describeMeshStatus(getProcessMeshAuthStatus()),
-						variant: "info"
-					},
-					{
-						type: "text",
-						key: AGENT_DASHBOARD_ORIGINS_FIELD,
-						label: "Agent dashboard origins (NPM)",
-						description: "Extra origins allowed for Continue-with-hub unlock redirects (comma-separated), e.g. https://agent.example.com. LAN agents on :4444 are always allowed."
-					},
-					{
-						type: "addon-action-button",
-						key: "mintJoinTokenAction",
-						label: "Add agent",
-						description: "Mint a single-use join token (≤ 1 hour). Paste it into the agent setup instead of copying the cluster secret. The token is shown once in the result.",
-						addonId: "system-config",
-						action: "mintJoinToken",
-						buttonLabel: "Add agent",
-						variant: "primary",
-						successMessage: "Join token (copy now): {token}"
-					}
-				]
+				fields: [{
+					type: "password",
+					key: CLUSTER_SECRET_FIELD,
+					label: "Cluster secret",
+					description: "Mandatory — generated by the hub at first boot and stored in the keychain. To pair an agent: Reveal and copy it here, then enter it in the agent (its status page, or the desktop setup window). Saving a new value rotates it: every agent must then be given the new one."
+				}, {
+					type: "info",
+					key: "meshAuthStatus",
+					label: "Mesh authentication",
+					content: describeMeshStatus(getProcessMeshAuthStatus()),
+					variant: "info"
+				}]
 			}
 		] };
 	}
@@ -88406,7 +88317,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 	/**
 	* The admin UI / `addonSettings` cap prefer {@link BaseAddon.updateGlobalSettingsAsOperator}.
 	* That BaseAddon path writes the generic addon store and never reaches
-	* {@link writeClusterSection} / {@link writeMeshClearPort}. Route the operator
+	* {@link writeClusterSection}. Route the operator
 	* write through the same section-aware path as {@link updateGlobalSettings}.
 	*/
 	async updateGlobalSettingsAsOperator(patch, _nodeId) {
@@ -88416,6 +88327,14 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		if (!this.ctx.settings) throw new Error("system-config: ctx.settings not available — cannot write sections");
 		const perSection = /* @__PURE__ */ new Map();
 		for (const [key, value] of Object.entries(patch)) {
+			if (key === "meshClearPort") {
+				this.ctx.logger.warn("cluster.meshClearPort is retired (D826) — the hub mesh is TLS-only; ignoring this patch");
+				continue;
+			}
+			if (key === "agentDashboardOrigins") {
+				this.ctx.logger.warn("cluster.agentDashboardOrigins is no longer writable from settings — ignoring this patch");
+				continue;
+			}
 			const section = KEY_TO_SECTION[key];
 			if (section === void 0) {
 				this.ctx.logger.warn("update ignored unknown key (not mapped to any section)", { meta: { key } });
@@ -88456,9 +88375,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 	* enforced (D821) — a legacy `meshAuth` in the patch is ignored.
 	*/
 	async writeClusterSection(patch) {
-		const { [MESH_AUTH_MODE_FIELD]: _legacyMode, [MESH_CLEAR_PORT_FIELD]: clearPort, [AGENT_DASHBOARD_ORIGINS_FIELD]: dashboardOrigins, ...secretPatch } = patch;
-		if (clearPort !== void 0) await this.writeMeshClearPort(clearPort);
-		if (dashboardOrigins !== void 0) await this.ctx.settings.setSection("cluster", { [AGENT_DASHBOARD_ORIGINS_FIELD]: typeof dashboardOrigins === "string" ? dashboardOrigins : "" });
+		const { [MESH_AUTH_MODE_FIELD]: _legacyMode, ...secretPatch } = patch;
 		await this.writeMeshAuthMode("enforced");
 		if (Object.keys(secretPatch).length === 0) return;
 		if (require_dist.isSecretClear(secretPatch["clusterSecret"])) throw new Error("The cluster secret is mandatory and cannot be cleared — save a new value to rotate it");
@@ -88466,27 +88383,6 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		this.ctx.logger.info("Cluster secret updated");
 		await this.clusterSecretKeeper?.reload();
 	}
-	/**
-	* `cluster.meshClearPort`: `off` is REFUSED while any online agent still
-	* connects in clear (or the TLS listener is not up); the refusal names them.
-	* Persist, then apply — an `on` save always passes.
-	*/
-	async writeMeshClearPort(value) {
-		if (!isMeshClearPortMode(value)) throw new Error(`system-config: meshClearPort must be 'on' or 'off'`);
-		const stored = (await this.ctx.settings.getSection("cluster"))[MESH_CLEAR_PORT_FIELD];
-		if (parseMeshClearPortMode(stored) === value) return;
-		const decision = checkProcessMeshClearPort(value);
-		if (!decision.allowed) {
-			this.ctx.logger.warn("mesh clear port switch-off refused", { meta: {
-				blocking: decision.blocking,
-				error: decision.error
-			} });
-			throw new Error(decision.error);
-		}
-		await this.ctx.settings.setSection("cluster", { [MESH_CLEAR_PORT_FIELD]: value });
-		await applyProcessMeshClearPort(value);
-		this.ctx.logger.info("Mesh clear port switched", { meta: { mode: value } });
-	}
 	/** Persist + publish mesh auth mode (always `enforced` after D821). */
 	async writeMeshAuthMode(mode) {
 		await this.ctx.settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: mode });
@@ -88572,7 +88468,6 @@ exports.AGENT_UI_UNLOCK_VERSION = AGENT_UI_UNLOCK_VERSION;
 exports.Errors = Errors;
 exports.JoinTokenJtiStore = JoinTokenJtiStore;
 exports.MESH_AUTH_MODE_FIELD = MESH_AUTH_MODE_FIELD;
-exports.MESH_CLEAR_PORT_FIELD = MESH_CLEAR_PORT_FIELD;
 exports.MeshCaKeeper = MeshCaKeeper;
 exports.MeshCrl = MeshCrl;
 exports.SYSTEM_CONFIG_CLUSTER_SECTION_ID = SYSTEM_CONFIG_CLUSTER_SECTION_ID;
@@ -88581,13 +88476,10 @@ exports.SystemConfigAddon = SystemConfigAddon;
 exports.default = SystemConfigAddon;
 exports.TlsTcpTransporter = TlsTcpTransporter;
 exports.UnlockTicketJtiStore = UnlockTicketJtiStore;
-exports.applyProcessMeshClearPort = applyProcessMeshClearPort;
 exports.caFingerprint = caFingerprint;
 exports.caFingerprintCompact = caFingerprintCompact;
-exports.checkProcessMeshClearPort = checkProcessMeshClearPort;
 exports.createCidrMatcher = createCidrMatcher;
 exports.createMeshCsrPem = createMeshCsrPem;
-exports.decideMeshClearPortOff = decideMeshClearPortOff;
 exports.enrollMeshNode = enrollMeshNode;
 exports.exportMeshPrivateKeyPem = exportMeshPrivateKeyPem;
 exports.generateMeshCa = generateMeshCa;
@@ -88614,8 +88506,8 @@ exports.requestProcessMeshEnforcement = requestProcessMeshEnforcement;
 exports.requireProcessMeshCa = requireProcessMeshCa;
 exports.setProcessMeshAuthMode = setProcessMeshAuthMode;
 exports.setProcessMeshAuthStatusSource = setProcessMeshAuthStatusSource;
-exports.setProcessMeshClearPortControl = setProcessMeshClearPortControl;
 exports.setProcessMeshEnforcer = setProcessMeshEnforcer;
+exports.setProcessMeshPeerTransportLookup = setProcessMeshPeerTransportLookup;
 exports.setProcessMeshTlsEnabler = setProcessMeshTlsEnabler;
 exports.systemConfigMeshActions = systemConfigMeshActions;
 exports.verifyAgentUiUnlockTicket = verifyAgentUiUnlockTicket;

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,7 +1,7 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
 import { Br as makeSecretMarker, Dr as customAction, Lr as isSecretClear, Nr as hydrateSchema, Or as defineCustomActions, Qr as secretTreeFromSchema, Rr as isSecretMarker, dr as BaseAddon, ni as transformSecretWrite, ur as errMsg } from "../../dist-0P1gm4Gd.mjs";
 import { n as require_safe_buffer, t as require_ms } from "../../ms-DlIWNkkk.mjs";
-import { a as MESH_CA_FIELD, c as MESH_CA_VALIDITY_DAYS, f as CLUSTER_SECRET_REF, i as MESH_CA_COMMON_NAME, l as MESH_JOIN_TOKEN_MAX_TTL_SEC, n as DEFAULT_HUB_TCP_PORT, o as MESH_CA_KEY_REF, r as DEFAULT_HUB_TLS_TCP_PORT, s as MESH_CA_SETTINGS_KEY, t as CLIENT_AUTH_OID, u as SERVER_AUTH_OID, x as setProcessClusterSecretGate, y as hashClusterSecret } from "../../constants-C1WoQ0E8.mjs";
+import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-5vADty9I.mjs";
 import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "../../x509.es-Xf3K_brW.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createHmac, randomBytes, timingSafeEqual, webcrypto } from "node:crypto";
@@ -12,7 +12,7 @@ import { fileURLToPath } from "node:url";
 import * as xi from "node:fs";
 import * as tls from "node:tls";
 import { EventEmitter } from "node:events";
-import Pe from "node:stream";
+import As from "node:stream";
 import { StringDecoder } from "node:string_decoder";
 import { lstatSync, readdir as readdir$1, readdirSync as readdirSync$1, readlinkSync, realpathSync } from "fs";
 import "path";
@@ -598,67 +598,23 @@ function processMeshCrl() {
 	return crl;
 }
 //#endregion
-//#region src/kernel/moleculer/mesh-mtls/mesh-clear-port.ts
-/** The field key inside the `cluster` section. */
-var MESH_CLEAR_PORT_FIELD = "meshClearPort";
-function isMeshClearPortMode(value) {
-	return value === "on" || value === "off";
-}
-/** A stored value that is not a mode reads as `on`: never cut the mesh on a typo. */
-function parseMeshClearPortMode(value) {
-	return isMeshClearPortMode(value) ? value : "on";
-}
-/** Pure: may the clear port be switched off right now? */
-function decideMeshClearPortOff(control) {
-	if (control === null) return {
-		allowed: false,
-		blocking: [],
-		error: "The clear mesh port can only be switched off on the hub (no mesh transport here)."
-	};
-	if (!control.isTlsListening()) return {
-		allowed: false,
-		blocking: [],
-		error: "Refusing to close the clear mesh port: the TLS listener (:6443) is not up yet, so no node could reach the hub."
-	};
-	const blocking = control.listOnlineAgents().filter((agent) => agent.transport !== "tls").map((agent) => agent.nodeId).toSorted();
-	if (blocking.length > 0) return {
-		allowed: false,
-		blocking,
-		error: `Refusing to close the clear mesh port: ${blocking.join(", ")} still ${blocking.length === 1 ? "connects" : "connect"} in clear. Enroll ${blocking.length === 1 ? "it" : "each"} with a join token first (System → Cluster → Add agent).`
-	};
-	return { allowed: true };
+//#region src/kernel/moleculer/mesh-mtls/mesh-peer-transport.ts
+var LOOKUP_SLOT = Symbol.for("camstack.cluster.mesh-peer-transport-lookup");
+/** Published by the hub broker owner; cleared on shutdown. */
+function setProcessMeshPeerTransportLookup(lookup) {
+	if (lookup === null) Reflect.deleteProperty(globalThis, LOOKUP_SLOT);
+	else Reflect.set(globalThis, LOOKUP_SLOT, lookup);
 }
-var CONTROL_SLOT = Symbol.for("camstack.cluster.mesh-clear-port-control");
-/** Published by the hub's broker owner; cleared on shutdown. */
-function setProcessMeshClearPortControl(control) {
-	if (control === null) Reflect.deleteProperty(globalThis, CONTROL_SLOT);
-	else Reflect.set(globalThis, CONTROL_SLOT, control);
+function isMeshPeerTransportLookup(value) {
+	return value !== null && typeof value === "object" && typeof Reflect.get(value, "transportOf") === "function";
 }
-function isMeshClearPortControl(value) {
-	return value !== null && typeof value === "object" && typeof Reflect.get(value, "listOnlineAgents") === "function" && typeof Reflect.get(value, "isTlsListening") === "function" && typeof Reflect.get(value, "apply") === "function" && typeof Reflect.get(value, "transportOf") === "function";
-}
-function getProcessMeshClearPortControl() {
-	const value = Reflect.get(globalThis, CONTROL_SLOT);
-	return isMeshClearPortControl(value) ? value : null;
+function getProcessMeshPeerTransportLookup() {
+	const value = Reflect.get(globalThis, LOOKUP_SLOT);
+	return isMeshPeerTransportLookup(value) ? value : null;
 }
 /** `tls` / `clear` for an agent as the hub sees it; `undefined` off the hub. */
 function getProcessNodeMeshTransport(nodeId) {
-	return getProcessMeshClearPortControl()?.transportOf(nodeId);
-}
-/**
-* Validate a requested mode against the live mesh. `on` is always allowed; `off`
-* only when {@link decideMeshClearPortOff} allows. Does NOT apply it.
-*/
-function checkProcessMeshClearPort(mode) {
-	if (mode === "on") return { allowed: true };
-	return decideMeshClearPortOff(getProcessMeshClearPortControl());
-}
-/** Apply a mode that {@link checkProcessMeshClearPort} allowed. No-op where nobody can. */
-async function applyProcessMeshClearPort(mode) {
-	const control = getProcessMeshClearPortControl();
-	if (control === null) return false;
-	await control.apply(mode);
-	return true;
+	return getProcessMeshPeerTransportLookup()?.transportOf(nodeId);
 }
 //#endregion
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -84424,7 +84380,7 @@ var xs = new Set([
 	"+",
 	"*",
 	"@"
-]), be = (n) => xs.has(n), vs = "(?!(?:^|/)\\.\\.?(?:$|/))", Ct = "(?!\\.)", Cs = new Set(["[", "."]), Ts = new Set(["..", "."]), As = /* @__PURE__ */ new Set("().*{}+?[]^$\\!"), ks = (n) => n.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&"), Kt$1 = "[^/]", Se = Kt$1 + "*?", Ee = Kt$1 + "+?", Q = class n {
+]), be = (n) => xs.has(n), vs = "(?!(?:^|/)\\.\\.?(?:$|/))", Ct = "(?!\\.)", Cs = new Set(["[", "."]), Ts = new Set(["..", "."]), As$1 = /* @__PURE__ */ new Set("().*{}+?[]^$\\!"), ks = (n) => n.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&"), Kt$1 = "[^/]", Se = Kt$1 + "*?", Ee = Kt$1 + "+?", Q = class n {
 	type;
 	#t;
 	#s;
@@ -84631,7 +84587,7 @@ var xs = new Set([
 		for (let a = 0; a < t.length; a++) {
 			let l = t.charAt(a);
 			if (i) {
-				i = !1, r += (As.has(l) ? "\\" : "") + l;
+				i = !1, r += (As$1.has(l) ? "\\" : "") + l;
 				continue;
 			}
 			if (l === "*") {
@@ -85615,7 +85571,7 @@ var q = (n) => n && n === Math.floor(n) && n > 0 && isFinite(n), De = (n) => q(n
 var Ne = typeof process == "object" && process ? process : {
 	stdout: null,
 	stderr: null
-}, oi = (n) => !!n && typeof n == "object" && (n instanceof V || n instanceof Pe || hi(n) || ai(n)), hi = (n) => !!n && typeof n == "object" && n instanceof EventEmitter && typeof n.pipe == "function" && n.pipe !== Pe.Writable.prototype.pipe, ai = (n) => !!n && typeof n == "object" && n instanceof EventEmitter && typeof n.write == "function" && typeof n.end == "function", G = Symbol("EOF"), H = Symbol("maybeEmitEnd"), K = Symbol("emittedEnd"), kt = Symbol("emittingEnd"), ut = Symbol("emittedError"), Rt = Symbol("closed"), _e = Symbol("read"), Ot = Symbol("flush"), Le = Symbol("flushChunk"), P = Symbol("encoding"), et = Symbol("decoder"), v = Symbol("flowing"), dt = Symbol("paused"), st = Symbol("resume"), C = Symbol("buffer"), F = Symbol("pipes"), T = Symbol("bufferLength"), Yt = Symbol("bufferPush"), Ft = Symbol("bufferShift"), k = Symbol("objectMode"), x = Symbol("destroyed"), Xt = Symbol("error"), Jt = Symbol("emitData"), We = Symbol("emitEnd"), Zt = Symbol("emitEnd2"), B = Symbol("async"), Qt = Symbol("abort"), Dt = Symbol("aborted"), pt = Symbol("signal"), Y = Symbol("dataListeners"), M = Symbol("discarded"), mt = (n) => Promise.resolve().then(n), li = (n) => n(), ci = (n) => n === "end" || n === "finish" || n === "prefinish", fi = (n) => n instanceof ArrayBuffer || !!n && typeof n == "object" && n.constructor && n.constructor.name === "ArrayBuffer" && n.byteLength >= 0, ui = (n) => !Buffer.isBuffer(n) && ArrayBuffer.isView(n), Mt = class {
+}, oi = (n) => !!n && typeof n == "object" && (n instanceof V || n instanceof As || hi(n) || ai(n)), hi = (n) => !!n && typeof n == "object" && n instanceof EventEmitter && typeof n.pipe == "function" && n.pipe !== As.Writable.prototype.pipe, ai = (n) => !!n && typeof n == "object" && n instanceof EventEmitter && typeof n.write == "function" && typeof n.end == "function", G = Symbol("EOF"), H = Symbol("maybeEmitEnd"), K = Symbol("emittedEnd"), kt = Symbol("emittingEnd"), ut = Symbol("emittedError"), Rt = Symbol("closed"), _e = Symbol("read"), Ot = Symbol("flush"), Le = Symbol("flushChunk"), P = Symbol("encoding"), et = Symbol("decoder"), v = Symbol("flowing"), dt = Symbol("paused"), st = Symbol("resume"), C = Symbol("buffer"), F = Symbol("pipes"), T = Symbol("bufferLength"), Yt = Symbol("bufferPush"), Ft = Symbol("bufferShift"), k = Symbol("objectMode"), x = Symbol("destroyed"), Xt = Symbol("error"), Jt = Symbol("emitData"), We = Symbol("emitEnd"), Zt = Symbol("emitEnd2"), B = Symbol("async"), Qt = Symbol("abort"), Dt = Symbol("aborted"), pt = Symbol("signal"), Y = Symbol("dataListeners"), M = Symbol("discarded"), mt = (n) => Promise.resolve().then(n), li = (n) => n(), ci = (n) => n === "end" || n === "finish" || n === "prefinish", fi = (n) => n instanceof ArrayBuffer || !!n && typeof n == "object" && n.constructor && n.constructor.name === "ArrayBuffer" && n.byteLength >= 0, ui = (n) => !Buffer.isBuffer(n) && ArrayBuffer.isView(n), Mt = class {
 	src;
 	dest;
 	opts;
@@ -87460,11 +87416,12 @@ import_moleculer.default.Validators;
 //#endregion
 //#region src/kernel/moleculer/mesh-mtls/tls-tcp-transporter.ts
 /**
-* Moleculer TCP transporter with a second mTLS listener (Release A).
+* Moleculer TCP transporter with a mutual-TLS listener (D826).
 *
-* Hub rollout: clear TCP stays on `port` (default 6000); TLS 1.3 mutual auth
-* listens on `tlsPort` (default 6443). Agents without a certificate keep using
-* 6000. On a TLS socket, any packet whose `sender` ≠ the peer certificate CN
+* Hub: `hubTlsOnly` — no clear TCP reader and no UDP discovery; TLS 1.3 on
+* `tlsPort` (default 6443) once mesh material is ready. Agents without mesh
+* material use clear TCP on their own listen port and dial the hub on TLS when
+* enrolled. On a TLS socket, any packet whose `sender` ≠ the peer certificate CN
 * is dropped.
 */
 var TcpTransporterBase = Transporters.TCP;
@@ -87508,6 +87465,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	/** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
 	tlsPeers = /* @__PURE__ */ new Map();
 	clearDisabled = false;
+	hubTlsOnly;
 	/** Clear-text `TcpWriter.connect` captured once before the TLS wrap (A→B). */
 	clearWriterConnect = null;
 	writerTlsPatched = false;
@@ -87515,6 +87473,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		super({ ...opts });
 		this.meshTls = opts.meshTls ?? null;
 		this.crl = opts.crl ?? processMeshCrl();
+		this.hubTlsOnly = opts.hubTlsOnly === true;
 		if (this.opts.tlsPort === void 0) this.opts.tlsPort = DEFAULT_HUB_TLS_TCP_PORT;
 	}
 	startTcpServer() {
@@ -87525,7 +87484,9 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	connect() {
 		return this.Promise.resolve().then(() => {
 			if (this.opts.urls) return this.loadUrls();
-		}).then(() => this.startTcpServer()).then(() => this.startTlsServerIfReady()).then(() => this.startUdpServer()).then(() => this.startTimers()).then(() => {
+		}).then(() => this.startTcpServer()).then(() => {
+			if (this.hubTlsOnly) this.disableClearTransport();
+		}).then(() => this.startTlsServerIfReady()).then(() => this.hubTlsOnly ? this.Promise.resolve() : this.startUdpServer()).then(() => this.startTimers()).then(() => {
 			this.logger.info("TCP Transporter started.");
 			this.connected = true;
 			this.nodes.localNode.port = this.opts.port;
@@ -87675,6 +87636,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	}
 	/** The switch back: listen on the clear port again and restart UDP discovery. Idempotent. */
 	async enableClearTransport() {
+		if (this.hubTlsOnly) return;
 		if (!this.clearDisabled) return;
 		this.clearDisabled = false;
 		if (this.reader !== null && this.reader.server?.listening !== true) await this.reader.listen();
@@ -87961,7 +87923,7 @@ var mintJoinTokenInputSchema = z.object({
 	nodeId: z.string().min(1).optional(),
 	/** Override hub HTTPS base (default: local-network publicEndpoint). */
 	hubUrl: z.string().url().optional(),
-	/** Override `host:6000` clear mesh address carried in the token. */
+	/** Override `host:6443` TLS mesh address carried in the token. */
 	hubMeshAddress: z.string().min(3).optional(),
 	/** Seconds until expiry; capped at 1 h. */
 	ttlSec: z.number().int().positive().max(3600).optional()
@@ -88062,9 +88024,7 @@ var KEY_TO_SECTION = {
 	trustedProxies: "auth",
 	trustedNetworks: "auth",
 	[CLUSTER_SECRET_FIELD]: "cluster",
-	[MESH_AUTH_MODE_FIELD]: "cluster",
-	[MESH_CLEAR_PORT_FIELD]: "cluster",
-	[AGENT_DASHBOARD_ORIGINS_FIELD]: "cluster"
+	[MESH_AUTH_MODE_FIELD]: "cluster"
 };
 /** Bytes of a generated cluster secret (D802) — 256 bits, base64url (43 chars). */
 var GENERATED_SECRET_BYTES = 32;
@@ -88120,7 +88080,6 @@ var SystemConfigAddon = class extends BaseAddon {
 			onReady: (ca) => this.onMeshCaReady(ca)
 		});
 		await this.meshCaKeeper.start();
-		await this.applyStoredClearPort();
 		this.ctx.logger.info("Initialized — exposes yml-backed sections via getGlobalSettings");
 		return {
 			customActions: systemConfigMeshActions,
@@ -88137,20 +88096,6 @@ var SystemConfigAddon = class extends BaseAddon {
 		this.clusterSecretKeeper?.stop();
 		this.clusterSecretKeeper = null;
 	}
-	/**
-	* Boot: a stored `meshClearPort: off` is the operator's standing choice, so it
-	* is applied WITHOUT the agents gate (nobody is connected yet to be checked).
-	* Default `on` changes nothing.
-	*/
-	async applyStoredClearPort() {
-		try {
-			const stored = (await this.ctx.settings?.getSection("cluster"))?.[MESH_CLEAR_PORT_FIELD];
-			if (parseMeshClearPortMode(stored) !== "off") return;
-			if (await applyProcessMeshClearPort("off")) this.ctx.logger.info("Mesh clear port is OFF (cluster.meshClearPort)");
-		} catch (err) {
-			this.ctx.logger.warn("could not apply cluster.meshClearPort at boot", { meta: { error: errMsg(err) } });
-		}
-	}
 	async onMeshCaReady(ca) {
 		const hubLeaf = await issueMeshLeafForNode(ca, "hub");
 		await requestProcessMeshTlsEnable({
@@ -88228,10 +88173,10 @@ var SystemConfigAddon = class extends BaseAddon {
 	async resolveHubMeshAddress() {
 		try {
 			const base = (await this.ctx.api?.localNetwork?.getAddresses?.query({}))?.roles?.internal?.resolved;
-			if (typeof base === "string" && base.length > 0) return `${new URL(base).hostname}:${DEFAULT_HUB_TCP_PORT}`;
+			if (typeof base === "string" && base.length > 0) return `${new URL(base).hostname}:${DEFAULT_HUB_TLS_TCP_PORT}`;
 		} catch {}
 		const host = (await this.ctx.settings?.getSection("server"))?.["host"];
-		return `${typeof host === "string" && host.length > 0 && host !== "0.0.0.0" ? host : "127.0.0.1"}:${DEFAULT_HUB_TCP_PORT}`;
+		return `${typeof host === "string" && host.length > 0 && host !== "0.0.0.0" ? host : "127.0.0.1"}:${DEFAULT_HUB_TLS_TCP_PORT}`;
 	}
 	/** The keychain handle for owner `system`; `null` where there is no door. */
 	systemSecrets() {
@@ -88327,52 +88272,18 @@ var SystemConfigAddon = class extends BaseAddon {
 				title: SECTION_TITLES["cluster"],
 				description: "Agents joining this hub. Every agent proves the cluster secret when it connects (challenge–response; the secret never crosses the network).",
 				columns: 1,
-				fields: [
-					{
-						type: "password",
-						key: CLUSTER_SECRET_FIELD,
-						label: "Cluster secret",
-						description: "Mandatory — generated by the hub at first boot and stored in the keychain. To pair an agent: Reveal and copy it here, then enter it in the agent (its status page, or the desktop setup window). Saving a new value rotates it: every agent must then be given the new one."
-					},
-					{
-						type: "select",
-						key: MESH_CLEAR_PORT_FIELD,
-						label: "Clear mesh port (:6000)",
-						description: "On keeps the clear TCP port and UDP discovery next to the TLS port (:6443). Off closes both — refused while any connected agent has not enrolled with a join token (the Cluster page shows TLS / clear per node).",
-						default: "on",
-						options: [{
-							value: "on",
-							label: "On — accept clear agents"
-						}, {
-							value: "off",
-							label: "Off — mutual TLS only"
-						}]
-					},
-					{
-						type: "info",
-						key: "meshAuthStatus",
-						label: "Mesh authentication",
-						content: describeMeshStatus(getProcessMeshAuthStatus()),
-						variant: "info"
-					},
-					{
-						type: "text",
-						key: AGENT_DASHBOARD_ORIGINS_FIELD,
-						label: "Agent dashboard origins (NPM)",
-						description: "Extra origins allowed for Continue-with-hub unlock redirects (comma-separated), e.g. https://agent.example.com. LAN agents on :4444 are always allowed."
-					},
-					{
-						type: "addon-action-button",
-						key: "mintJoinTokenAction",
-						label: "Add agent",
-						description: "Mint a single-use join token (≤ 1 hour). Paste it into the agent setup instead of copying the cluster secret. The token is shown once in the result.",
-						addonId: "system-config",
-						action: "mintJoinToken",
-						buttonLabel: "Add agent",
-						variant: "primary",
-						successMessage: "Join token (copy now): {token}"
-					}
-				]
+				fields: [{
+					type: "password",
+					key: CLUSTER_SECRET_FIELD,
+					label: "Cluster secret",
+					description: "Mandatory — generated by the hub at first boot and stored in the keychain. To pair an agent: Reveal and copy it here, then enter it in the agent (its status page, or the desktop setup window). Saving a new value rotates it: every agent must then be given the new one."
+				}, {
+					type: "info",
+					key: "meshAuthStatus",
+					label: "Mesh authentication",
+					content: describeMeshStatus(getProcessMeshAuthStatus()),
+					variant: "info"
+				}]
 			}
 		] };
 	}
@@ -88396,7 +88307,7 @@ var SystemConfigAddon = class extends BaseAddon {
 	/**
 	* The admin UI / `addonSettings` cap prefer {@link BaseAddon.updateGlobalSettingsAsOperator}.
 	* That BaseAddon path writes the generic addon store and never reaches
-	* {@link writeClusterSection} / {@link writeMeshClearPort}. Route the operator
+	* {@link writeClusterSection}. Route the operator
 	* write through the same section-aware path as {@link updateGlobalSettings}.
 	*/
 	async updateGlobalSettingsAsOperator(patch, _nodeId) {
@@ -88406,6 +88317,14 @@ var SystemConfigAddon = class extends BaseAddon {
 		if (!this.ctx.settings) throw new Error("system-config: ctx.settings not available — cannot write sections");
 		const perSection = /* @__PURE__ */ new Map();
 		for (const [key, value] of Object.entries(patch)) {
+			if (key === "meshClearPort") {
+				this.ctx.logger.warn("cluster.meshClearPort is retired (D826) — the hub mesh is TLS-only; ignoring this patch");
+				continue;
+			}
+			if (key === "agentDashboardOrigins") {
+				this.ctx.logger.warn("cluster.agentDashboardOrigins is no longer writable from settings — ignoring this patch");
+				continue;
+			}
 			const section = KEY_TO_SECTION[key];
 			if (section === void 0) {
 				this.ctx.logger.warn("update ignored unknown key (not mapped to any section)", { meta: { key } });
@@ -88446,9 +88365,7 @@ var SystemConfigAddon = class extends BaseAddon {
 	* enforced (D821) — a legacy `meshAuth` in the patch is ignored.
 	*/
 	async writeClusterSection(patch) {
-		const { [MESH_AUTH_MODE_FIELD]: _legacyMode, [MESH_CLEAR_PORT_FIELD]: clearPort, [AGENT_DASHBOARD_ORIGINS_FIELD]: dashboardOrigins, ...secretPatch } = patch;
-		if (clearPort !== void 0) await this.writeMeshClearPort(clearPort);
-		if (dashboardOrigins !== void 0) await this.ctx.settings.setSection("cluster", { [AGENT_DASHBOARD_ORIGINS_FIELD]: typeof dashboardOrigins === "string" ? dashboardOrigins : "" });
+		const { [MESH_AUTH_MODE_FIELD]: _legacyMode, ...secretPatch } = patch;
 		await this.writeMeshAuthMode("enforced");
 		if (Object.keys(secretPatch).length === 0) return;
 		if (isSecretClear(secretPatch["clusterSecret"])) throw new Error("The cluster secret is mandatory and cannot be cleared — save a new value to rotate it");
@@ -88456,27 +88373,6 @@ var SystemConfigAddon = class extends BaseAddon {
 		this.ctx.logger.info("Cluster secret updated");
 		await this.clusterSecretKeeper?.reload();
 	}
-	/**
-	* `cluster.meshClearPort`: `off` is REFUSED while any online agent still
-	* connects in clear (or the TLS listener is not up); the refusal names them.
-	* Persist, then apply — an `on` save always passes.
-	*/
-	async writeMeshClearPort(value) {
-		if (!isMeshClearPortMode(value)) throw new Error(`system-config: meshClearPort must be 'on' or 'off'`);
-		const stored = (await this.ctx.settings.getSection("cluster"))[MESH_CLEAR_PORT_FIELD];
-		if (parseMeshClearPortMode(stored) === value) return;
-		const decision = checkProcessMeshClearPort(value);
-		if (!decision.allowed) {
-			this.ctx.logger.warn("mesh clear port switch-off refused", { meta: {
-				blocking: decision.blocking,
-				error: decision.error
-			} });
-			throw new Error(decision.error);
-		}
-		await this.ctx.settings.setSection("cluster", { [MESH_CLEAR_PORT_FIELD]: value });
-		await applyProcessMeshClearPort(value);
-		this.ctx.logger.info("Mesh clear port switched", { meta: { mode: value } });
-	}
 	/** Persist + publish mesh auth mode (always `enforced` after D821). */
 	async writeMeshAuthMode(mode) {
 		await this.ctx.settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: mode });
@@ -88555,4 +88451,4 @@ function readJwtExp(token) {
 	return typeof exp === "number" ? exp : 0;
 }
 //#endregion
-export { loadMeshCa as A, MESH_AUTH_MODE_FIELD as B, caFingerprintCompact as C, generateMeshKeyPair as D, generateMeshCa as E, UnlockTicketJtiStore as F, requestProcessMeshEnforcement as G, getProcessMeshAuthStatus as H, isAllowedAgentDashboardReturnTo as I, setProcessMeshEnforcer as J, setProcessMeshAuthMode as K, mintAgentUiUnlockTicket as L, AGENT_UI_UNLOCK_DOMAIN as M, AGENT_UI_UNLOCK_TTL_MS as N, issueMeshLeafForNode as O, AGENT_UI_UNLOCK_VERSION as P, readCidrSetting as Q, parseAgentDashboardOrigins as R, caFingerprint as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, exportMeshPrivateKeyPem as T, isMeshAuthMode as U, getProcessMeshAuthMode as V, parseMeshAuthMode as W, normalizeIp as X, createCidrMatcher as Y, parseCidrList as Z, MeshCrl as _, setProcessMeshTlsEnabler as a, getProcessMeshCaState as b, mintMeshJoinToken as c, MESH_CLEAR_PORT_FIELD as d, applyProcessMeshClearPort as f, setProcessMeshClearPortControl as g, getProcessNodeMeshTransport as h, ServiceBroker as i, AGENT_DASHBOARD_ORIGINS_FIELD as j, issueMeshLeafFromCsr as k, processJoinTokenJtiStore as l, decideMeshClearPortOff as m, TlsTcpTransporter as n, enrollMeshNode as o, checkProcessMeshClearPort as p, setProcessMeshAuthStatusSource as q, Errors as r, JoinTokenJtiStore as s, systemConfigMeshActions as t, verifyMeshJoinToken as u, processMeshCrl as v, createMeshCsrPem as w, requireProcessMeshCa as x, MeshCaKeeper as y, verifyAgentUiUnlockTicket as z };
+export { AGENT_UI_UNLOCK_VERSION as A, parseMeshAuthMode as B, generateMeshKeyPair as C, AGENT_DASHBOARD_ORIGINS_FIELD as D, loadMeshCa as E, verifyAgentUiUnlockTicket as F, createCidrMatcher as G, setProcessMeshAuthMode as H, MESH_AUTH_MODE_FIELD as I, readCidrSetting as J, normalizeIp as K, getProcessMeshAuthMode as L, isAllowedAgentDashboardReturnTo as M, mintAgentUiUnlockTicket as N, AGENT_UI_UNLOCK_DOMAIN as O, parseAgentDashboardOrigins as P, getProcessMeshAuthStatus as R, generateMeshCa as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, issueMeshLeafFromCsr as T, setProcessMeshAuthStatusSource as U, requestProcessMeshEnforcement as V, setProcessMeshEnforcer as W, requireProcessMeshCa as _, setProcessMeshTlsEnabler as a, createMeshCsrPem as b, mintMeshJoinToken as c, getProcessNodeMeshTransport as d, setProcessMeshPeerTransportLookup as f, getProcessMeshCaState as g, MeshCaKeeper as h, ServiceBroker as i, UnlockTicketJtiStore as j, AGENT_UI_UNLOCK_TTL_MS as k, processJoinTokenJtiStore as l, processMeshCrl as m, TlsTcpTransporter as n, enrollMeshNode as o, MeshCrl as p, parseCidrList as q, Errors as r, JoinTokenJtiStore as s, systemConfigMeshActions as t, verifyMeshJoinToken as u, caFingerprint as v, issueMeshLeafForNode as w, exportMeshPrivateKeyPem as x, caFingerprintCompact as y, isMeshAuthMode as z };

package/dist/{constants-C1WoQ0E8.mjs → constants-5vADty9I.mjs}

@@ -92,8 +92,6 @@ var MESH_CA_FIELD = "meshCa";
 /** Join-token / leaf lifetimes. */
 var MESH_JOIN_TOKEN_MAX_TTL_SEC = 3600;
 var MESH_CA_VALIDITY_DAYS = 3650;
-/** Hub clear TCP (existing) and TLS dual-listen port (Release A). */
-var DEFAULT_HUB_TCP_PORT = 6e3;
 var DEFAULT_HUB_TLS_TCP_PORT = 6443;
 /** Subject of the mesh root. Distinct from the HTTPS local CA. */
 var MESH_CA_COMMON_NAME = "CamStack Mesh CA";
@@ -101,4 +99,4 @@ var MESH_CA_COMMON_NAME = "CamStack Mesh CA";
 var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
 var CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
 //#endregion
-export { clusterSecretMatches as _, MESH_CA_FIELD as a, isClusterSecretMismatchError as b, MESH_CA_VALIDITY_DAYS as c, CLUSTER_SECRET_MISMATCH_TYPE as d, CLUSTER_SECRET_REF as f, checkClusterSecret as g, CLUSTER_SECRET_UNAVAILABLE_TYPE as h, MESH_CA_COMMON_NAME as i, MESH_JOIN_TOKEN_MAX_TTL_SEC as l, CLUSTER_SECRET_SETTINGS_KEY as m, DEFAULT_HUB_TCP_PORT as n, MESH_CA_KEY_REF as o, CLUSTER_SECRET_REJECTED_EXIT_CODE as p, DEFAULT_HUB_TLS_TCP_PORT as r, MESH_CA_SETTINGS_KEY as s, CLIENT_AUTH_OID as t, SERVER_AUTH_OID as u, getProcessClusterSecretGate as v, setProcessClusterSecretGate as x, hashClusterSecret as y };
+export { getProcessClusterSecretGate as _, MESH_CA_KEY_REF as a, setProcessClusterSecretGate as b, MESH_JOIN_TOKEN_MAX_TTL_SEC as c, CLUSTER_SECRET_REF as d, CLUSTER_SECRET_REJECTED_EXIT_CODE as f, clusterSecretMatches as g, checkClusterSecret as h, MESH_CA_FIELD as i, SERVER_AUTH_OID as l, CLUSTER_SECRET_UNAVAILABLE_TYPE as m, DEFAULT_HUB_TLS_TCP_PORT as n, MESH_CA_SETTINGS_KEY as o, CLUSTER_SECRET_SETTINGS_KEY as p, MESH_CA_COMMON_NAME as r, MESH_CA_VALIDITY_DAYS as s, CLIENT_AUTH_OID as t, CLUSTER_SECRET_MISMATCH_TYPE as u, hashClusterSecret as v, isClusterSecretMismatchError as y };

package/dist/{constants-Bz9gKWe8.js → constants-Dcecs0Ks.js}

@@ -92,8 +92,6 @@ var MESH_CA_FIELD = "meshCa";
 /** Join-token / leaf lifetimes. */
 var MESH_JOIN_TOKEN_MAX_TTL_SEC = 3600;
 var MESH_CA_VALIDITY_DAYS = 3650;
-/** Hub clear TCP (existing) and TLS dual-listen port (Release A). */
-var DEFAULT_HUB_TCP_PORT = 6e3;
 var DEFAULT_HUB_TLS_TCP_PORT = 6443;
 /** Subject of the mesh root. Distinct from the HTTPS local CA. */
 var MESH_CA_COMMON_NAME = "CamStack Mesh CA";
@@ -137,12 +135,6 @@ Object.defineProperty(exports, "CLUSTER_SECRET_UNAVAILABLE_TYPE", {
 		return CLUSTER_SECRET_UNAVAILABLE_TYPE;
 	}
 });
-Object.defineProperty(exports, "DEFAULT_HUB_TCP_PORT", {
-	enumerable: true,
-	get: function() {
-		return DEFAULT_HUB_TCP_PORT;
-	}
-});
 Object.defineProperty(exports, "DEFAULT_HUB_TLS_TCP_PORT", {
 	enumerable: true,
 	get: function() {

package/dist/index.js

@@ -27,7 +27,7 @@ const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage
 const require_hub_cap_forward = require("./hub-cap-forward-W8oEm4ME.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_constants = require("./constants-Bz9gKWe8.js");
+const require_constants = require("./constants-Dcecs0Ks.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
@@ -11132,9 +11132,8 @@ function createBroker(config) {
 			tlsPort: config.tlsPort ?? 6443,
 			maxPacketSize: 10 * 1024 * 1024,
 			useHostname,
-			udpDiscovery: true,
-			udpPort,
-			udpPeriod: 5,
+			hubTlsOnly: true,
+			udpDiscovery: false,
 			debug: false,
 			...config.meshTls !== void 0 ? { meshTls: config.meshTls } : {}
 		}),
@@ -14033,7 +14032,6 @@ exports.MESH_AUTO_ENFORCE_GRACE_MS = MESH_AUTO_ENFORCE_GRACE_MS;
 exports.MESH_CA_FIELD = require_constants.MESH_CA_FIELD;
 exports.MESH_CA_KEY_REF = require_constants.MESH_CA_KEY_REF;
 exports.MESH_CA_SETTINGS_KEY = require_constants.MESH_CA_SETTINGS_KEY;
-exports.MESH_CLEAR_PORT_FIELD = require_builtins_system_config_system_config_addon.MESH_CLEAR_PORT_FIELD;
 exports.MESH_JOIN_AUTHENTICATE_ACTION = MESH_JOIN_AUTHENTICATE_ACTION;
 exports.MESH_JOIN_CHALLENGE_ACTION = MESH_JOIN_CHALLENGE_ACTION;
 exports.MESH_JOIN_CHALLENGE_INVALID_TYPE = MESH_JOIN_CHALLENGE_INVALID_TYPE;
@@ -14124,7 +14122,6 @@ exports.allFamiliesListenHost = require_tls.allFamiliesListenHost;
 exports.answerClaimedGetStatus = require_child_cap_dispatch.answerClaimedGetStatus;
 exports.applyCertificateToListener = require_tls.applyCertificateToListener;
 exports.applyLanHttp = require_tls.applyLanHttp;
-exports.applyProcessMeshClearPort = require_builtins_system_config_system_config_addon.applyProcessMeshClearPort;
 exports.attachUserManagementInternal = require_builtins_local_auth_local_auth_addon.attachUserManagementInternal;
 exports.attributeStall = require_event_loop_stall_monitor.attributeStall;
 exports.bindPendingLanHttp = require_tls.bindPendingLanHttp;
@@ -14156,7 +14153,6 @@ exports.capActionSuffix = require_child_cap_dispatch.capActionSuffix;
 exports.capBareAction = require_child_cap_dispatch.capBareAction;
 exports.capServiceName = require_child_cap_dispatch.capServiceName;
 exports.checkClusterSecret = require_constants.checkClusterSecret;
-exports.checkProcessMeshClearPort = require_builtins_system_config_system_config_addon.checkProcessMeshClearPort;
 exports.classifyAddonDir = classifyAddonDir;
 exports.classifyCapRoute = require_child_cap_dispatch.classifyCapRoute;
 exports.clearHttpsListener = require_tls.clearHttpsListener;
@@ -14215,7 +14211,6 @@ exports.createUdsLogger = require_child_cap_dispatch.createUdsLogger;
 exports.createUdsLoggerWithControl = require_child_cap_dispatch.createUdsLoggerWithControl;
 exports.createV8Reclaimer = require_child_cap_dispatch.createV8Reclaimer;
 exports.decideMeshAutoEnforce = decideMeshAutoEnforce;
-exports.decideMeshClearPortOff = require_builtins_system_config_system_config_addon.decideMeshClearPortOff;
 exports.deleteModelFromDisk = require_event_loop_stall_monitor.deleteModelFromDisk;
 exports.deriveAgentListenPort = deriveAgentListenPort;
 exports.describeProviderKindDrift = describeProviderKindDrift;
@@ -14437,8 +14432,8 @@ exports.setPlatformKeychainKey = require_platform_key_source.setPlatformKeychain
 exports.setProcessClusterSecretGate = require_constants.setProcessClusterSecretGate;
 exports.setProcessMeshAuthMode = require_builtins_system_config_system_config_addon.setProcessMeshAuthMode;
 exports.setProcessMeshAuthStatusSource = require_builtins_system_config_system_config_addon.setProcessMeshAuthStatusSource;
-exports.setProcessMeshClearPortControl = require_builtins_system_config_system_config_addon.setProcessMeshClearPortControl;
 exports.setProcessMeshEnforcer = require_builtins_system_config_system_config_addon.setProcessMeshEnforcer;
+exports.setProcessMeshPeerTransportLookup = require_builtins_system_config_system_config_addon.setProcessMeshPeerTransportLookup;
 exports.setProcessMeshTlsEnabler = require_builtins_system_config_system_config_addon.setProcessMeshTlsEnabler;
 exports.setWrapperActive = require_builtins_device_manager_device_manager_addon.setWrapperActive;
 exports.shouldReclaim = require_child_cap_dispatch.shouldReclaim;

package/dist/index.mjs

@@ -26,8 +26,8 @@ import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { i as stripForwardedCaller, n as HUB_CAP_FWD_SERVICE, r as createHubCapForwardService, t as HUB_CAP_FWD_ACTION } from "./hub-cap-forward-CDiN1p98.mjs";
 import { StorageOrchestratorAddon, n as buildStorageLocationRegistry, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { _ as clusterSecretMatches, a as MESH_CA_FIELD, b as isClusterSecretMismatchError, d as CLUSTER_SECRET_MISMATCH_TYPE, f as CLUSTER_SECRET_REF, g as checkClusterSecret, h as CLUSTER_SECRET_UNAVAILABLE_TYPE, m as CLUSTER_SECRET_SETTINGS_KEY, o as MESH_CA_KEY_REF, p as CLUSTER_SECRET_REJECTED_EXIT_CODE, r as DEFAULT_HUB_TLS_TCP_PORT, s as MESH_CA_SETTINGS_KEY, v as getProcessClusterSecretGate, x as setProcessClusterSecretGate, y as hashClusterSecret } from "./constants-C1WoQ0E8.mjs";
-import { A as loadMeshCa, B as MESH_AUTH_MODE_FIELD, C as caFingerprintCompact, D as generateMeshKeyPair, E as generateMeshCa, F as UnlockTicketJtiStore, G as requestProcessMeshEnforcement, H as getProcessMeshAuthStatus, I as isAllowedAgentDashboardReturnTo, J as setProcessMeshEnforcer, K as setProcessMeshAuthMode, L as mintAgentUiUnlockTicket, M as AGENT_UI_UNLOCK_DOMAIN, N as AGENT_UI_UNLOCK_TTL_MS, O as issueMeshLeafForNode, P as AGENT_UI_UNLOCK_VERSION, Q as readCidrSetting, R as parseAgentDashboardOrigins, S as caFingerprint, SystemConfigAddon, T as exportMeshPrivateKeyPem, U as isMeshAuthMode, V as getProcessMeshAuthMode, W as parseMeshAuthMode, X as normalizeIp, Y as createCidrMatcher, Z as parseCidrList, _ as MeshCrl, a as setProcessMeshTlsEnabler, b as getProcessMeshCaState, c as mintMeshJoinToken, d as MESH_CLEAR_PORT_FIELD, f as applyProcessMeshClearPort, g as setProcessMeshClearPortControl, h as getProcessNodeMeshTransport, i as ServiceBroker, j as AGENT_DASHBOARD_ORIGINS_FIELD, k as issueMeshLeafFromCsr, l as processJoinTokenJtiStore, m as decideMeshClearPortOff, n as TlsTcpTransporter, o as enrollMeshNode, p as checkProcessMeshClearPort, q as setProcessMeshAuthStatusSource, r as Errors, s as JoinTokenJtiStore, u as verifyMeshJoinToken, v as processMeshCrl, w as createMeshCsrPem, x as requireProcessMeshCa, y as MeshCaKeeper, z as verifyAgentUiUnlockTicket } from "./builtins/system-config/system-config.addon.mjs";
+import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-5vADty9I.mjs";
+import { A as AGENT_UI_UNLOCK_VERSION, B as parseMeshAuthMode, C as generateMeshKeyPair, D as AGENT_DASHBOARD_ORIGINS_FIELD, E as loadMeshCa, F as verifyAgentUiUnlockTicket, G as createCidrMatcher, H as setProcessMeshAuthMode, I as MESH_AUTH_MODE_FIELD, J as readCidrSetting, K as normalizeIp, L as getProcessMeshAuthMode, M as isAllowedAgentDashboardReturnTo, N as mintAgentUiUnlockTicket, O as AGENT_UI_UNLOCK_DOMAIN, P as parseAgentDashboardOrigins, R as getProcessMeshAuthStatus, S as generateMeshCa, SystemConfigAddon, T as issueMeshLeafFromCsr, U as setProcessMeshAuthStatusSource, V as requestProcessMeshEnforcement, W as setProcessMeshEnforcer, _ as requireProcessMeshCa, a as setProcessMeshTlsEnabler, b as createMeshCsrPem, c as mintMeshJoinToken, d as getProcessNodeMeshTransport, f as setProcessMeshPeerTransportLookup, g as getProcessMeshCaState, h as MeshCaKeeper, i as ServiceBroker, j as UnlockTicketJtiStore, k as AGENT_UI_UNLOCK_TTL_MS, l as processJoinTokenJtiStore, m as processMeshCrl, n as TlsTcpTransporter, o as enrollMeshNode, p as MeshCrl, q as parseCidrList, r as Errors, s as JoinTokenJtiStore, u as verifyMeshJoinToken, v as caFingerprint, w as issueMeshLeafForNode, x as exportMeshPrivateKeyPem, y as caFingerprintCompact, z as isMeshAuthMode } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as resolveFormatRevision, S as isModelDownloaded, _ as downloadModel, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as ensureModel, w as revisionWeightUrl, y as fetchJson } from "./event-loop-stall-monitor-BHtIKJY2.mjs";
@@ -36,7 +36,7 @@ import { $ as AGENT_CAP_FWD_ACTION, $n as EMPTY_SOCKET_DIRECTION, $t as HEAP_WAT
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B2WZ8_q9.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
-import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-KnMS8Uta.mjs";
+import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-DQ2NuwD1.mjs";
 import { z } from "zod";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
@@ -11129,9 +11129,8 @@ function createBroker(config) {
 			tlsPort: config.tlsPort ?? 6443,
 			maxPacketSize: 10 * 1024 * 1024,
 			useHostname,
-			udpDiscovery: true,
-			udpPort,
-			udpPeriod: 5,
+			hubTlsOnly: true,
+			udpDiscovery: false,
 			debug: false,
 			...config.meshTls !== void 0 ? { meshTls: config.meshTls } : {}
 		}),
@@ -13901,4 +13900,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentMeshAuthenticator, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_CLEAR_PORT_FIELD, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCrl, MeshJoinClient, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, applyProcessMeshClearPort, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, checkClusterSecret, checkProcessMeshClearPort, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, decideMeshAutoEnforce, decideMeshClearPortOff, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessNodeMeshTransport, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isCredentialKeyName, isInfraCapability, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, issueMeshLeafForNode, issueMeshLeafFromCsr, leafFingerprintOf, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, prepareRestoreArchive, probePlatform, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshClearPortControl, setProcessMeshEnforcer, setProcessMeshTlsEnabler, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyMeshJoinToken, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentMeshAuthenticator, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCrl, MeshJoinClient, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, checkClusterSecret, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, decideMeshAutoEnforce, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessNodeMeshTransport, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isCredentialKeyName, isInfraCapability, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, issueMeshLeafForNode, issueMeshLeafFromCsr, leafFingerprintOf, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, prepareRestoreArchive, probePlatform, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshEnforcer, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyMeshJoinToken, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/index.d.ts

@@ -39,8 +39,8 @@ export { buildStorageLocationRegistry } from "./storage-location-registry.js";
 export type { StorageLocationRegistry } from "./storage-location-registry.js";
 export { createBroker, deriveAgentListenPort, getBrokerTlsTransporter } from "./moleculer/broker-factory.js";
 export type { BrokerConfig } from "./moleculer/broker-factory.js";
-export { applyProcessMeshClearPort, caFingerprint, caFingerprintCompact, checkProcessMeshClearPort, createMeshCsrPem, decideMeshClearPortOff, enrollMeshNode, exportMeshPrivateKeyPem, getProcessNodeMeshTransport, MESH_CLEAR_PORT_FIELD, setProcessMeshClearPortControl, generateMeshCa, generateMeshKeyPair, getProcessMeshCaState, issueMeshLeafForNode, issueMeshLeafFromCsr, JoinTokenJtiStore, loadMeshCa, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MeshCaKeeper, MeshCrl, mintMeshJoinToken, processMeshCrl, processJoinTokenJtiStore, requireProcessMeshCa, setProcessMeshTlsEnabler, TlsTcpTransporter, verifyMeshJoinToken, DEFAULT_HUB_TLS_TCP_PORT } from "./moleculer/mesh-mtls/index.js";
-export type { MeshCaSigner, MeshClearPortAgent, MeshClearPortControl, MeshClearPortDecision, MeshClearPortMode, MeshEnrollResult, MeshTransport, MeshJoinTokenClaims, MeshTlsMaterial } from "./moleculer/mesh-mtls/index.js";
+export { caFingerprint, caFingerprintCompact, createMeshCsrPem, enrollMeshNode, exportMeshPrivateKeyPem, getProcessNodeMeshTransport, setProcessMeshPeerTransportLookup, generateMeshCa, generateMeshKeyPair, getProcessMeshCaState, issueMeshLeafForNode, issueMeshLeafFromCsr, JoinTokenJtiStore, loadMeshCa, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MeshCaKeeper, MeshCrl, mintMeshJoinToken, processMeshCrl, processJoinTokenJtiStore, requireProcessMeshCa, setProcessMeshTlsEnabler, TlsTcpTransporter, verifyMeshJoinToken, DEFAULT_HUB_TLS_TCP_PORT } from "./moleculer/mesh-mtls/index.js";
+export type { MeshCaSigner, MeshEnrollResult, MeshPeerTransportLookup, MeshTransport, MeshJoinTokenClaims, MeshTlsMaterial } from "./moleculer/mesh-mtls/index.js";
 export { type AddonDeploySource, isAddonDeploySource } from "./moleculer/addon-deploy-source.js";
 export { createAddonService, validateProviderRegistrations } from "./moleculer/addon-service-factory.js";
 export { createCoreCapService, CORE_CAP_SERVICE_NAME } from "./moleculer/core-cap-service.js";

package/dist/kernel/moleculer/mesh-mtls/constants.d.ts

@@ -8,7 +8,7 @@ export declare const MESH_CA_FIELD = "meshCa";
 export declare const MESH_JOIN_TOKEN_MAX_TTL_SEC: number;
 export declare const MESH_LEAF_VALIDITY_DAYS = 30;
 export declare const MESH_CA_VALIDITY_DAYS = 3650;
-/** Hub clear TCP (existing) and TLS dual-listen port (Release A). */
+/** Hub legacy clear TCP (retired on hub — D826) and TLS listen port. */
 export declare const DEFAULT_HUB_TCP_PORT = 6e3;
 export declare const DEFAULT_HUB_TLS_TCP_PORT = 6443;
 /** Join token payload version. */

package/dist/kernel/moleculer/mesh-mtls/index.d.ts

@@ -2,7 +2,7 @@ export { CLIENT_AUTH_OID, DEFAULT_HUB_TCP_PORT, DEFAULT_HUB_TLS_TCP_PORT, MESH_C
 export { caFingerprint, caFingerprintCompact, createMeshCsrPem, exportMeshPrivateKeyPem, generateMeshCa, generateMeshKeyPair, issueMeshLeafForNode, issueMeshLeafFromCsr, loadMeshCa, MESH_KEY_ALGORITHM, MESH_SIGNING_ALGORITHM, subjectCn, type MeshCaSigner, type MeshLeafMaterial } from "./mesh-ca.js";
 export { clearProcessMeshCa, getProcessMeshCaState, loadOrGenerateMeshCa, MESH_CA_RETRY_MS, MeshCaKeeper, requireProcessMeshCa, setProcessMeshCa, type MeshCaKeeperDeps, type MeshCaState } from "./mesh-ca-keeper.js";
 export { clearProcessMeshCrl, MeshCrl, processMeshCrl } from "./mesh-crl.js";
-export { applyProcessMeshClearPort, checkProcessMeshClearPort, decideMeshClearPortOff, getProcessMeshClearPortControl, getProcessNodeMeshTransport, isMeshClearPortMode, MESH_CLEAR_PORT_FIELD, parseMeshClearPortMode, setProcessMeshClearPortControl, type MeshClearPortAgent, type MeshClearPortControl, type MeshClearPortDecision, type MeshClearPortMode, type MeshTransport } from "./mesh-clear-port.js";
+export { getProcessNodeMeshTransport, setProcessMeshPeerTransportLookup, type MeshPeerTransportLookup, type MeshTransport } from "./mesh-peer-transport.js";
 export { enrollMeshNode } from "./mesh-enroll.js";
 export type { EnrollMeshNodeDeps, MeshEnrollRequest, MeshEnrollResult } from "./mesh-enroll.js";
 export { JoinTokenJtiStore, mintMeshJoinToken, processJoinTokenJtiStore, verifyMeshJoinToken, type MeshJoinTokenClaims, type MintJoinTokenInput } from "./mesh-join-token.js";

package/dist/kernel/moleculer/mesh-mtls/mesh-peer-transport.d.ts

@@ -0,0 +1,13 @@
+/**
+* Hub-side telemetry: how an agent node reached the mesh transporter.
+* The clear mesh port is retired — only mutual TLS is offered on the hub.
+*/
+/** How a node reaches the hub (badge / topology). */
+export type MeshTransport = "tls" | "clear";
+export interface MeshPeerTransportLookup {
+	transportOf(nodeId: string): MeshTransport | undefined;
+}
+/** Published by the hub broker owner; cleared on shutdown. */
+export declare function setProcessMeshPeerTransportLookup(lookup: MeshPeerTransportLookup | null): void;
+/** `tls` / `clear` for an agent as the hub sees it; `undefined` off the hub. */
+export declare function getProcessNodeMeshTransport(nodeId: string): MeshTransport | undefined;

package/dist/kernel/moleculer/mesh-mtls/tls-tcp-transporter.d.ts

@@ -69,6 +69,8 @@ export interface TlsTcpTransporterOptions {
 	/** When set at construction, TLS starts with the clear reader. */
 	readonly meshTls?: MeshTlsMaterial;
 	readonly crl?: MeshCrl;
+	/** Hub only (D826): never bind clear TCP or UDP discovery. */
+	readonly hubTlsOnly?: boolean;
 }
 export declare class TlsTcpTransporter extends TcpTransporterBase {
 	private tlsServer;
@@ -78,6 +80,7 @@ export declare class TlsTcpTransporter extends TcpTransporterBase {
 	/** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
 	private readonly tlsPeers;
 	private clearDisabled;
+	private readonly hubTlsOnly;
 	/** Clear-text `TcpWriter.connect` captured once before the TLS wrap (A→B). */
 	private clearWriterConnect;
 	private writerTlsPatched;

package/dist/{restore-archive-KnMS8Uta.mjs → restore-archive-DQ2NuwD1.mjs}

@@ -8,7 +8,7 @@ import path, { basename, join, posix, win32 } from "node:path";
 import * as fs$2 from "node:fs";
 import Kt from "node:fs";
 import { EventEmitter } from "node:events";
-import Pe, { Transform } from "node:stream";
+import As, { Transform } from "node:stream";
 import { StringDecoder } from "node:string_decoder";
 import fs from "fs";
 import path$1, { dirname as dirname$1, parse } from "path";
@@ -394,7 +394,7 @@ var Br = (s, t) => {
 var xs = typeof process == "object" && process ? process : {
 	stdout: null,
 	stderr: null
-}, zr = (s) => !!s && typeof s == "object" && (s instanceof A || s instanceof Pe || Ur(s) || Hr(s)), Ur = (s) => !!s && typeof s == "object" && s instanceof EventEmitter && typeof s.pipe == "function" && s.pipe !== Pe.Writable.prototype.pipe, Hr = (s) => !!s && typeof s == "object" && s instanceof EventEmitter && typeof s.write == "function" && typeof s.end == "function", q = Symbol("EOF"), Q = Symbol("maybeEmitEnd"), rt = Symbol("emittedEnd"), Le = Symbol("emittingEnd"), qt = Symbol("emittedError"), Ne = Symbol("closed"), Ls = Symbol("read"), De = Symbol("flush"), Ns = Symbol("flushChunk"), z = Symbol("encoding"), Mt = Symbol("decoder"), g = Symbol("flowing"), Qt = Symbol("paused"), Bt = Symbol("resume"), b = Symbol("buffer"), D = Symbol("pipes"), _ = Symbol("bufferLength"), gi = Symbol("bufferPush"), Ae = Symbol("bufferShift"), L = Symbol("objectMode"), w = Symbol("destroyed"), bi = Symbol("error"), _i = Symbol("emitData"), Ds = Symbol("emitEnd"), Oi = Symbol("emitEnd2"), Z = Symbol("async"), Ti = Symbol("abort"), Ie = Symbol("aborted"), Jt = Symbol("signal"), Rt = Symbol("dataListeners"), F = Symbol("discarded"), jt = (s) => Promise.resolve().then(s), Wr = (s) => s(), Gr = (s) => s === "end" || s === "finish" || s === "prefinish", Zr = (s) => s instanceof ArrayBuffer || !!s && typeof s == "object" && s.constructor && s.constructor.name === "ArrayBuffer" && s.byteLength >= 0, Yr = (s) => !Buffer.isBuffer(s) && ArrayBuffer.isView(s), Fe = class {
+}, zr = (s) => !!s && typeof s == "object" && (s instanceof A || s instanceof As || Ur(s) || Hr(s)), Ur = (s) => !!s && typeof s == "object" && s instanceof EventEmitter && typeof s.pipe == "function" && s.pipe !== As.Writable.prototype.pipe, Hr = (s) => !!s && typeof s == "object" && s instanceof EventEmitter && typeof s.write == "function" && typeof s.end == "function", q = Symbol("EOF"), Q = Symbol("maybeEmitEnd"), rt = Symbol("emittedEnd"), Le = Symbol("emittingEnd"), qt = Symbol("emittedError"), Ne = Symbol("closed"), Ls = Symbol("read"), De = Symbol("flush"), Ns = Symbol("flushChunk"), z = Symbol("encoding"), Mt = Symbol("decoder"), g = Symbol("flowing"), Qt = Symbol("paused"), Bt = Symbol("resume"), b = Symbol("buffer"), D = Symbol("pipes"), _ = Symbol("bufferLength"), gi = Symbol("bufferPush"), Ae = Symbol("bufferShift"), L = Symbol("objectMode"), w = Symbol("destroyed"), bi = Symbol("error"), _i = Symbol("emitData"), Ds = Symbol("emitEnd"), Oi = Symbol("emitEnd2"), Z = Symbol("async"), Ti = Symbol("abort"), Ie = Symbol("aborted"), Jt = Symbol("signal"), Rt = Symbol("dataListeners"), F = Symbol("discarded"), jt = (s) => Promise.resolve().then(s), Wr = (s) => s(), Gr = (s) => s === "end" || s === "finish" || s === "prefinish", Zr = (s) => s instanceof ArrayBuffer || !!s && typeof s == "object" && s.constructor && s.constructor.name === "ArrayBuffer" && s.byteLength >= 0, Yr = (s) => !Buffer.isBuffer(s) && ArrayBuffer.isView(s), Fe = class {
 	src;
 	dest;
 	opts;
@@ -1185,7 +1185,7 @@ var tn = Buffer$1.concat, Bs = Object.getOwnPropertyDescriptor(Buffer$1, "concat
 		}
 	}
 };
-var Pe$1 = class extends Be {
+var Pe = class extends Be {
 	#t;
 	constructor(t) {
 		super(t, "Gzip"), this.#t = t && !!t.portable;
@@ -2345,7 +2345,7 @@ var mi = class {
 	constructor(t = {}) {
 		if (super(), this.opt = t, this.file = t.file || "", this.cwd = t.cwd || process.cwd(), this.maxReadSize = t.maxReadSize, this.preservePaths = !!t.preservePaths, this.strict = !!t.strict, this.noPax = !!t.noPax, this.prefix = f(t.prefix || ""), this.linkCache = t.linkCache || /* @__PURE__ */ new Map(), this.statCache = t.statCache || /* @__PURE__ */ new Map(), this.readdirCache = t.readdirCache || /* @__PURE__ */ new Map(), this.onWriteEntry = t.onWriteEntry, this[di] = fe, typeof t.onwarn == "function" && this.on("warn", t.onwarn), this.portable = !!t.portable, t.gzip || t.brotli || t.zstd) {
 			if ((t.gzip ? 1 : 0) + (t.brotli ? 1 : 0) + (t.zstd ? 1 : 0) > 1) throw new TypeError("gzip, brotli, zstd are mutually exclusive");
-			if (t.gzip && (typeof t.gzip != "object" && (t.gzip = {}), this.portable && (t.gzip.portable = !0), this.zip = new Pe$1(t.gzip)), t.brotli && (typeof t.brotli != "object" && (t.brotli = {}), this.zip = new He(t.brotli)), t.zstd && (typeof t.zstd != "object" && (t.zstd = {}), this.zip = new Ze(t.zstd)), !this.zip) throw new Error("impossible");
+			if (t.gzip && (typeof t.gzip != "object" && (t.gzip = {}), this.portable && (t.gzip.portable = !0), this.zip = new Pe(t.gzip)), t.brotli && (typeof t.brotli != "object" && (t.brotli = {}), this.zip = new He(t.brotli)), t.zstd && (typeof t.zstd != "object" && (t.zstd = {}), this.zip = new Ze(t.zstd)), !this.zip) throw new Error("impossible");
 			let e = this.zip;
 			e.on("data", (i) => super.write(i)), e.on("end", () => super.end()), e.on("drain", () => this[ls]()), this.on("resume", () => e.resume());
 		} else this.on("drain", this[ls]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.395",
+  "version": "1.2.397",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",

package/dist/kernel/moleculer/mesh-mtls/mesh-clear-port.d.ts

@@ -1,56 +0,0 @@
-/**
-* Cutover switch for the hub's clear mesh port (Release A, rollout step 3).
-*
-* `cluster.meshClearPort` = `on` (default — clear :6000 + UDP discovery run next
-* to the TLS :6443 listener) or `off` (the hub stops listening on :6000 and
-* stops UDP discovery). Turning it off is REFUSED while any online agent still
-* reaches the hub in clear — the same spirit as D803's auto-enforce: the switch
-* must never cut off an agent that has not enrolled.
-*
-* The setting is owned by `system-config`; the transporter lives in the hub's
-* broker. They meet through this process slot (same pattern as
-* `mesh-auth-mode.ts` / `mesh-tls-enabler.ts`).
-*/
-/** How a node reaches the hub. */
-export type MeshTransport = "tls" | "clear";
-export type MeshClearPortMode = "on" | "off";
-/** The field key inside the `cluster` section. */
-export declare const MESH_CLEAR_PORT_FIELD = "meshClearPort";
-export declare function isMeshClearPortMode(value: unknown): value is MeshClearPortMode;
-/** A stored value that is not a mode reads as `on`: never cut the mesh on a typo. */
-export declare function parseMeshClearPortMode(value: unknown): MeshClearPortMode;
-export interface MeshClearPortAgent {
-	readonly nodeId: string;
-	readonly transport: MeshTransport;
-}
-export interface MeshClearPortControl {
-	/** Agents connected right now (never the hub, never `hub/<runner>` children). */
-	listOnlineAgents(): readonly MeshClearPortAgent[];
-	/** Whether the TLS listener is up — without it, closing the clear port cuts everyone. */
-	isTlsListening(): boolean;
-	/** Close (`off`) or reopen (`on`) the clear TCP reader and UDP discovery. */
-	apply(mode: MeshClearPortMode): Promise<void>;
-	/** How one node reaches the hub, `undefined` when the hub cannot tell. */
-	transportOf(nodeId: string): MeshTransport | undefined;
-}
-export type MeshClearPortDecision = {
-	readonly allowed: true;
-} | {
-	readonly allowed: false;
-	readonly blocking: readonly string[];
-	readonly error: string;
-};
-/** Pure: may the clear port be switched off right now? */
-export declare function decideMeshClearPortOff(control: Pick<MeshClearPortControl, "listOnlineAgents" | "isTlsListening"> | null): MeshClearPortDecision;
-/** Published by the hub's broker owner; cleared on shutdown. */
-export declare function setProcessMeshClearPortControl(control: MeshClearPortControl | null): void;
-export declare function getProcessMeshClearPortControl(): MeshClearPortControl | null;
-/** `tls` / `clear` for an agent as the hub sees it; `undefined` off the hub. */
-export declare function getProcessNodeMeshTransport(nodeId: string): MeshTransport | undefined;
-/**
-* Validate a requested mode against the live mesh. `on` is always allowed; `off`
-* only when {@link decideMeshClearPortOff} allows. Does NOT apply it.
-*/
-export declare function checkProcessMeshClearPort(mode: MeshClearPortMode): MeshClearPortDecision;
-/** Apply a mode that {@link checkProcessMeshClearPort} allowed. No-op where nobody can. */
-export declare function applyProcessMeshClearPort(mode: MeshClearPortMode): Promise<boolean>;