@camstack/system 1.2.396 → 1.2.397

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,5 +1,5 @@
 import { Ln as storageOccupancyCapability, Vr as nodePin, X as backupCapability, dr as BaseAddon, ei as toNodeId, ri as EventCategory, rn as mayWriteToLocation } from "../../dist-0P1gm4Gd.mjs";
-import { a as BackupSnapshotRefusedError, c as BackupKeyFormatError, d as generateBackupKeyPair, f as parseBackupPublicKey, i as BackupCancelledError, n as precheckRestoreKey, o as SystemBackupService, p as parseBackupSecretKey, r as prepareRestoreArchive, u as ENCRYPTED_BACKUP_SUFFIX } from "../../restore-archive-0g91qMVF.mjs";
+import { a as BackupSnapshotRefusedError, c as BackupKeyFormatError, d as generateBackupKeyPair, f as parseBackupPublicKey, i as BackupCancelledError, n as precheckRestoreKey, o as SystemBackupService, p as parseBackupSecretKey, r as prepareRestoreArchive, u as ENCRYPTED_BACKUP_SUFFIX } from "../../restore-archive-DQ2NuwD1.mjs";
 import { randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/keychain/index.js

@@ -5,7 +5,7 @@ Object.defineProperties(exports, {
 const require_chunk = require("../../chunk-Cek0wNdY.js");
 const require_dist = require("../../dist-CME5sVBJ.js");
 const require_jwt_signing_key = require("../../jwt-signing-key-CyoJaT3C.js");
-const require_constants = require("../../constants-Bz9gKWe8.js");
+const require_constants = require("../../constants-Dcecs0Ks.js");
 const require_platform_key_source = require("../../platform-key-source-Di7HrlGR.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/keychain/index.mjs

@@ -1,6 +1,6 @@
 import { E as KEYCHAIN_RESET_TRIGGER_ACTOR, Gr as parseSecretRef, Gt as keychainAdminCapability, Hr as normalizeSecretOwner, Kt as keychainCapability, Mr as formatSecretScope, dr as BaseAddon, ri as EventCategory } from "../../dist-0P1gm4Gd.mjs";
 import { r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "../../jwt-signing-key-DK-IFI9j.mjs";
-import { m as CLUSTER_SECRET_SETTINGS_KEY, o as MESH_CA_KEY_REF } from "../../constants-C1WoQ0E8.mjs";
+import { a as MESH_CA_KEY_REF, p as CLUSTER_SECRET_SETTINGS_KEY } from "../../constants-5vADty9I.mjs";
 import { n as getPlatformKeychainKey } from "../../platform-key-source-BWlq0jjn.mjs";
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/system-config/system-config.addon.d.ts

@@ -7,17 +7,9 @@ export declare class SystemConfigAddon extends BaseAddon {
 	readonly id = "system-config";
 	private clusterSecretKeeper;
 	private meshCaKeeper;
-	/** One warn per process when a retired cutover key is posted with a cluster save. */
-	private retiredClusterCutoverPatchWarned;
 	constructor();
 	protected onInitialize(): Promise<AddonInitResult<typeof systemConfigMeshActions>>;
 	protected onShutdown(): Promise<void>;
-	/**
-	* Boot: a stored `meshClearPort: off` is the operator's standing choice, so it
-	* is applied WITHOUT the agents gate (nobody is connected yet to be checked).
-	* Default `on` changes nothing.
-	*/
-	private applyStoredClearPort;
 	private onMeshCaReady;
 	private mintJoinToken;
 	/** D821 — short-lived ticket for the agent's `:4444` unlock session. */
@@ -45,8 +37,6 @@ export declare class SystemConfigAddon extends BaseAddon {
 	* enforced (D821) — a legacy `meshAuth` in the patch is ignored.
 	*/
 	private writeClusterSection;
-	/** Cutover keys were removed from the Cluster form; ignore stray posts from stale clients. */
-	private warnRetiredClusterCutoverPatch;
 	/** Persist + publish mesh auth mode (always `enforced` after D821). */
 	private writeMeshAuthMode;
 	/**

package/dist/builtins/system-config/system-config.addon.js

@@ -5,7 +5,7 @@ Object.defineProperties(exports, {
 const require_chunk = require("../../chunk-Cek0wNdY.js");
 const require_dist = require("../../dist-CME5sVBJ.js");
 const require_ms$1 = require("../../ms-t68_FaqE.js");
-const require_constants$8 = require("../../constants-Bz9gKWe8.js");
+const require_constants$8 = require("../../constants-Dcecs0Ks.js");
 const require_x509_es = require("../../x509.es-BhTzcFhZ.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -607,67 +607,23 @@ function processMeshCrl() {
 	return crl;
 }
 //#endregion
-//#region src/kernel/moleculer/mesh-mtls/mesh-clear-port.ts
-/** The field key inside the `cluster` section. */
-var MESH_CLEAR_PORT_FIELD = "meshClearPort";
-function isMeshClearPortMode(value) {
-	return value === "on" || value === "off";
-}
-/** A stored value that is not a mode reads as `on`: never cut the mesh on a typo. */
-function parseMeshClearPortMode(value) {
-	return isMeshClearPortMode(value) ? value : "on";
-}
-/** Pure: may the clear port be switched off right now? */
-function decideMeshClearPortOff(control) {
-	if (control === null) return {
-		allowed: false,
-		blocking: [],
-		error: "The clear mesh port can only be switched off on the hub (no mesh transport here)."
-	};
-	if (!control.isTlsListening()) return {
-		allowed: false,
-		blocking: [],
-		error: "Refusing to close the clear mesh port: the TLS listener (:6443) is not up yet, so no node could reach the hub."
-	};
-	const blocking = control.listOnlineAgents().filter((agent) => agent.transport !== "tls").map((agent) => agent.nodeId).toSorted();
-	if (blocking.length > 0) return {
-		allowed: false,
-		blocking,
-		error: `Refusing to close the clear mesh port: ${blocking.join(", ")} still ${blocking.length === 1 ? "connects" : "connect"} in clear. Enroll ${blocking.length === 1 ? "it" : "each"} with a join token first (System → Cluster → Add agent).`
-	};
-	return { allowed: true };
+//#region src/kernel/moleculer/mesh-mtls/mesh-peer-transport.ts
+var LOOKUP_SLOT = Symbol.for("camstack.cluster.mesh-peer-transport-lookup");
+/** Published by the hub broker owner; cleared on shutdown. */
+function setProcessMeshPeerTransportLookup(lookup) {
+	if (lookup === null) Reflect.deleteProperty(globalThis, LOOKUP_SLOT);
+	else Reflect.set(globalThis, LOOKUP_SLOT, lookup);
 }
-var CONTROL_SLOT = Symbol.for("camstack.cluster.mesh-clear-port-control");
-/** Published by the hub's broker owner; cleared on shutdown. */
-function setProcessMeshClearPortControl(control) {
-	if (control === null) Reflect.deleteProperty(globalThis, CONTROL_SLOT);
-	else Reflect.set(globalThis, CONTROL_SLOT, control);
+function isMeshPeerTransportLookup(value) {
+	return value !== null && typeof value === "object" && typeof Reflect.get(value, "transportOf") === "function";
 }
-function isMeshClearPortControl(value) {
-	return value !== null && typeof value === "object" && typeof Reflect.get(value, "listOnlineAgents") === "function" && typeof Reflect.get(value, "isTlsListening") === "function" && typeof Reflect.get(value, "apply") === "function" && typeof Reflect.get(value, "transportOf") === "function";
-}
-function getProcessMeshClearPortControl() {
-	const value = Reflect.get(globalThis, CONTROL_SLOT);
-	return isMeshClearPortControl(value) ? value : null;
+function getProcessMeshPeerTransportLookup() {
+	const value = Reflect.get(globalThis, LOOKUP_SLOT);
+	return isMeshPeerTransportLookup(value) ? value : null;
 }
 /** `tls` / `clear` for an agent as the hub sees it; `undefined` off the hub. */
 function getProcessNodeMeshTransport(nodeId) {
-	return getProcessMeshClearPortControl()?.transportOf(nodeId);
-}
-/**
-* Validate a requested mode against the live mesh. `on` is always allowed; `off`
-* only when {@link decideMeshClearPortOff} allows. Does NOT apply it.
-*/
-function checkProcessMeshClearPort(mode) {
-	if (mode === "on") return { allowed: true };
-	return decideMeshClearPortOff(getProcessMeshClearPortControl());
-}
-/** Apply a mode that {@link checkProcessMeshClearPort} allowed. No-op where nobody can. */
-async function applyProcessMeshClearPort(mode) {
-	const control = getProcessMeshClearPortControl();
-	if (control === null) return false;
-	await control.apply(mode);
-	return true;
+	return getProcessMeshPeerTransportLookup()?.transportOf(nodeId);
 }
 //#endregion
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -87469,11 +87425,12 @@ import_moleculer.default.Validators;
 //#endregion
 //#region src/kernel/moleculer/mesh-mtls/tls-tcp-transporter.ts
 /**
-* Moleculer TCP transporter with a second mTLS listener (Release A).
+* Moleculer TCP transporter with a mutual-TLS listener (D826).
 *
-* Hub rollout: clear TCP stays on `port` (default 6000); TLS 1.3 mutual auth
-* listens on `tlsPort` (default 6443). Agents without a certificate keep using
-* 6000. On a TLS socket, any packet whose `sender` ≠ the peer certificate CN
+* Hub: `hubTlsOnly` — no clear TCP reader and no UDP discovery; TLS 1.3 on
+* `tlsPort` (default 6443) once mesh material is ready. Agents without mesh
+* material use clear TCP on their own listen port and dial the hub on TLS when
+* enrolled. On a TLS socket, any packet whose `sender` ≠ the peer certificate CN
 * is dropped.
 */
 var TcpTransporterBase = Transporters.TCP;
@@ -87517,6 +87474,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	/** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
 	tlsPeers = /* @__PURE__ */ new Map();
 	clearDisabled = false;
+	hubTlsOnly;
 	/** Clear-text `TcpWriter.connect` captured once before the TLS wrap (A→B). */
 	clearWriterConnect = null;
 	writerTlsPatched = false;
@@ -87524,6 +87482,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		super({ ...opts });
 		this.meshTls = opts.meshTls ?? null;
 		this.crl = opts.crl ?? processMeshCrl();
+		this.hubTlsOnly = opts.hubTlsOnly === true;
 		if (this.opts.tlsPort === void 0) this.opts.tlsPort = require_constants$8.DEFAULT_HUB_TLS_TCP_PORT;
 	}
 	startTcpServer() {
@@ -87534,7 +87493,9 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	connect() {
 		return this.Promise.resolve().then(() => {
 			if (this.opts.urls) return this.loadUrls();
-		}).then(() => this.startTcpServer()).then(() => this.startTlsServerIfReady()).then(() => this.startUdpServer()).then(() => this.startTimers()).then(() => {
+		}).then(() => this.startTcpServer()).then(() => {
+			if (this.hubTlsOnly) this.disableClearTransport();
+		}).then(() => this.startTlsServerIfReady()).then(() => this.hubTlsOnly ? this.Promise.resolve() : this.startUdpServer()).then(() => this.startTimers()).then(() => {
 			this.logger.info("TCP Transporter started.");
 			this.connected = true;
 			this.nodes.localNode.port = this.opts.port;
@@ -87684,6 +87645,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	}
 	/** The switch back: listen on the clear port again and restart UDP discovery. Idempotent. */
 	async enableClearTransport() {
+		if (this.hubTlsOnly) return;
 		if (!this.clearDisabled) return;
 		this.clearDisabled = false;
 		if (this.reader !== null && this.reader.server?.listening !== true) await this.reader.listen();
@@ -87971,7 +87933,7 @@ var mintJoinTokenInputSchema = zod.z.object({
 	nodeId: zod.z.string().min(1).optional(),
 	/** Override hub HTTPS base (default: local-network publicEndpoint). */
 	hubUrl: zod.z.string().url().optional(),
-	/** Override `host:6000` clear mesh address carried in the token. */
+	/** Override `host:6443` TLS mesh address carried in the token. */
 	hubMeshAddress: zod.z.string().min(3).optional(),
 	/** Seconds until expiry; capped at 1 h. */
 	ttlSec: zod.z.number().int().positive().max(3600).optional()
@@ -88072,9 +88034,7 @@ var KEY_TO_SECTION = {
 	trustedProxies: "auth",
 	trustedNetworks: "auth",
 	[CLUSTER_SECRET_FIELD]: "cluster",
-	[MESH_AUTH_MODE_FIELD]: "cluster",
-	[MESH_CLEAR_PORT_FIELD]: "cluster",
-	[AGENT_DASHBOARD_ORIGINS_FIELD]: "cluster"
+	[MESH_AUTH_MODE_FIELD]: "cluster"
 };
 /** Bytes of a generated cluster secret (D802) — 256 bits, base64url (43 chars). */
 var GENERATED_SECRET_BYTES = 32;
@@ -88102,8 +88062,6 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 	id = "system-config";
 	clusterSecretKeeper = null;
 	meshCaKeeper = null;
-	/** One warn per process when a retired cutover key is posted with a cluster save. */
-	retiredClusterCutoverPatchWarned = false;
 	constructor() {
 		super({});
 	}
@@ -88132,7 +88090,6 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			onReady: (ca) => this.onMeshCaReady(ca)
 		});
 		await this.meshCaKeeper.start();
-		await this.applyStoredClearPort();
 		this.ctx.logger.info("Initialized — exposes yml-backed sections via getGlobalSettings");
 		return {
 			customActions: systemConfigMeshActions,
@@ -88149,20 +88106,6 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		this.clusterSecretKeeper?.stop();
 		this.clusterSecretKeeper = null;
 	}
-	/**
-	* Boot: a stored `meshClearPort: off` is the operator's standing choice, so it
-	* is applied WITHOUT the agents gate (nobody is connected yet to be checked).
-	* Default `on` changes nothing.
-	*/
-	async applyStoredClearPort() {
-		try {
-			const stored = (await this.ctx.settings?.getSection("cluster"))?.[MESH_CLEAR_PORT_FIELD];
-			if (parseMeshClearPortMode(stored) !== "off") return;
-			if (await applyProcessMeshClearPort("off")) this.ctx.logger.info("Mesh clear port is OFF (cluster.meshClearPort)");
-		} catch (err) {
-			this.ctx.logger.warn("could not apply cluster.meshClearPort at boot", { meta: { error: require_dist.errMsg(err) } });
-		}
-	}
 	async onMeshCaReady(ca) {
 		const hubLeaf = await issueMeshLeafForNode(ca, "hub");
 		await requestProcessMeshTlsEnable({
@@ -88240,10 +88183,10 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 	async resolveHubMeshAddress() {
 		try {
 			const base = (await this.ctx.api?.localNetwork?.getAddresses?.query({}))?.roles?.internal?.resolved;
-			if (typeof base === "string" && base.length > 0) return `${new URL(base).hostname}:${require_constants$8.DEFAULT_HUB_TCP_PORT}`;
+			if (typeof base === "string" && base.length > 0) return `${new URL(base).hostname}:${require_constants$8.DEFAULT_HUB_TLS_TCP_PORT}`;
 		} catch {}
 		const host = (await this.ctx.settings?.getSection("server"))?.["host"];
-		return `${typeof host === "string" && host.length > 0 && host !== "0.0.0.0" ? host : "127.0.0.1"}:${require_constants$8.DEFAULT_HUB_TCP_PORT}`;
+		return `${typeof host === "string" && host.length > 0 && host !== "0.0.0.0" ? host : "127.0.0.1"}:${require_constants$8.DEFAULT_HUB_TLS_TCP_PORT}`;
 	}
 	/** The keychain handle for owner `system`; `null` where there is no door. */
 	systemSecrets() {
@@ -88384,6 +88327,14 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		if (!this.ctx.settings) throw new Error("system-config: ctx.settings not available — cannot write sections");
 		const perSection = /* @__PURE__ */ new Map();
 		for (const [key, value] of Object.entries(patch)) {
+			if (key === "meshClearPort") {
+				this.ctx.logger.warn("cluster.meshClearPort is retired (D826) — the hub mesh is TLS-only; ignoring this patch");
+				continue;
+			}
+			if (key === "agentDashboardOrigins") {
+				this.ctx.logger.warn("cluster.agentDashboardOrigins is no longer writable from settings — ignoring this patch");
+				continue;
+			}
 			const section = KEY_TO_SECTION[key];
 			if (section === void 0) {
 				this.ctx.logger.warn("update ignored unknown key (not mapped to any section)", { meta: { key } });
@@ -88424,8 +88375,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 	* enforced (D821) — a legacy `meshAuth` in the patch is ignored.
 	*/
 	async writeClusterSection(patch) {
-		const { [MESH_AUTH_MODE_FIELD]: _legacyMode, [MESH_CLEAR_PORT_FIELD]: clearPort, [AGENT_DASHBOARD_ORIGINS_FIELD]: dashboardOrigins, ...secretPatch } = patch;
-		if (clearPort !== void 0 || dashboardOrigins !== void 0) this.warnRetiredClusterCutoverPatch(clearPort !== void 0, dashboardOrigins !== void 0);
+		const { [MESH_AUTH_MODE_FIELD]: _legacyMode, ...secretPatch } = patch;
 		await this.writeMeshAuthMode("enforced");
 		if (Object.keys(secretPatch).length === 0) return;
 		if (require_dist.isSecretClear(secretPatch["clusterSecret"])) throw new Error("The cluster secret is mandatory and cannot be cleared — save a new value to rotate it");
@@ -88433,15 +88383,6 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		this.ctx.logger.info("Cluster secret updated");
 		await this.clusterSecretKeeper?.reload();
 	}
-	/** Cutover keys were removed from the Cluster form; ignore stray posts from stale clients. */
-	warnRetiredClusterCutoverPatch(hadMeshClearPort, hadAgentDashboardOrigins) {
-		if (this.retiredClusterCutoverPatchWarned) return;
-		this.retiredClusterCutoverPatchWarned = true;
-		this.ctx.logger.warn("cluster save ignored retired cutover field(s) — use Pipeline → Cluster / Nodes", { meta: {
-			meshClearPort: hadMeshClearPort,
-			agentDashboardOrigins: hadAgentDashboardOrigins
-		} });
-	}
 	/** Persist + publish mesh auth mode (always `enforced` after D821). */
 	async writeMeshAuthMode(mode) {
 		await this.ctx.settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: mode });
@@ -88527,7 +88468,6 @@ exports.AGENT_UI_UNLOCK_VERSION = AGENT_UI_UNLOCK_VERSION;
 exports.Errors = Errors;
 exports.JoinTokenJtiStore = JoinTokenJtiStore;
 exports.MESH_AUTH_MODE_FIELD = MESH_AUTH_MODE_FIELD;
-exports.MESH_CLEAR_PORT_FIELD = MESH_CLEAR_PORT_FIELD;
 exports.MeshCaKeeper = MeshCaKeeper;
 exports.MeshCrl = MeshCrl;
 exports.SYSTEM_CONFIG_CLUSTER_SECTION_ID = SYSTEM_CONFIG_CLUSTER_SECTION_ID;
@@ -88536,13 +88476,10 @@ exports.SystemConfigAddon = SystemConfigAddon;
 exports.default = SystemConfigAddon;
 exports.TlsTcpTransporter = TlsTcpTransporter;
 exports.UnlockTicketJtiStore = UnlockTicketJtiStore;
-exports.applyProcessMeshClearPort = applyProcessMeshClearPort;
 exports.caFingerprint = caFingerprint;
 exports.caFingerprintCompact = caFingerprintCompact;
-exports.checkProcessMeshClearPort = checkProcessMeshClearPort;
 exports.createCidrMatcher = createCidrMatcher;
 exports.createMeshCsrPem = createMeshCsrPem;
-exports.decideMeshClearPortOff = decideMeshClearPortOff;
 exports.enrollMeshNode = enrollMeshNode;
 exports.exportMeshPrivateKeyPem = exportMeshPrivateKeyPem;
 exports.generateMeshCa = generateMeshCa;
@@ -88569,8 +88506,8 @@ exports.requestProcessMeshEnforcement = requestProcessMeshEnforcement;
 exports.requireProcessMeshCa = requireProcessMeshCa;
 exports.setProcessMeshAuthMode = setProcessMeshAuthMode;
 exports.setProcessMeshAuthStatusSource = setProcessMeshAuthStatusSource;
-exports.setProcessMeshClearPortControl = setProcessMeshClearPortControl;
 exports.setProcessMeshEnforcer = setProcessMeshEnforcer;
+exports.setProcessMeshPeerTransportLookup = setProcessMeshPeerTransportLookup;
 exports.setProcessMeshTlsEnabler = setProcessMeshTlsEnabler;
 exports.systemConfigMeshActions = systemConfigMeshActions;
 exports.verifyAgentUiUnlockTicket = verifyAgentUiUnlockTicket;