@camstack/system 1.2.418 → 1.2.420

package/dist/builtins/system-config/system-config.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVUg8e1T.js");
+const require_dist = require("../../dist-DLHPmdoV.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
-const require_constants$8 = require("../../constants-Aj0OBqlt.js");
+const require_constants$8 = require("../../constants-ik5xtasS.js");
 const require_x509_es = require("../../x509.es-Dzl0BbmG.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");
@@ -86720,15 +86720,66 @@ import_moleculer.default.Validators;
 //#endregion
 //#region src/kernel/moleculer/mesh-mtls/tls-tcp-transporter.ts
 /**
-* Moleculer TCP transporter with a mutual-TLS listener (D826).
+* Moleculer TCP transporter with a mutual-TLS listener (D826, D848).
 *
 * Hub: `hubTlsOnly` — no clear TCP reader and no UDP discovery; TLS 1.3 on
-* `tlsPort` (default 6443) once mesh material is ready. Agents without mesh
-* material use clear TCP on their own listen port and dial the hub on TLS when
-* enrolled. On a TLS socket, any packet whose `sender` ≠ the peer certificate CN
-* is dropped.
+* `tlsPort` (default 6443) once mesh material is ready, and every peer is
+* dialled on mutual TLS too (a TLS-only hub has no clear peer to talk to).
+*
+* Enrolled agent: `hubOnlyPeers` (D848) — the hub is its ONLY mesh peer. No
+* clear TCP reader; the TLS listener accepts the hub's certificate only; the
+* writer dials the hub only; and the nodes the hub's gossip names are not
+* adopted, so the agent never learns, dials or broadcasts to another agent.
+* An agent without mesh material keeps clear TCP (it can reach only a
+* pre-D826 hub).
+*
+* On a TLS socket, any packet whose `sender` ≠ the peer certificate CN is
+* dropped. A TLS-listening node advertises its listen port in the gossip
+* HELLO it sends on every connection (`meshTlsPort`,
+* {@link MESH_TLS_PORT_HELLO_FIELD}); a peer dials it there, else on the
+* cluster-wide default (6443) — so two nodes on one host need not collide.
 */
+/** Field of the gossip HELLO payload carrying the sender's mesh-TLS listen port. */
+var MESH_TLS_PORT_HELLO_FIELD = "meshTlsPort";
+/** Moleculer packet types (`packets.PACKET_GOSSIP_*`). */
+var PACKET_GOSSIP_RES = "GOSSIP_RES";
+var PACKET_GOSSIP_HELLO = "GOSSIP_HELLO";
+/** The hub's node id — the only peer of a `hubOnlyPeers` agent. */
+var DEFAULT_HUB_NODE_ID = "hub";
 var TcpTransporterBase = Transporters.TCP;
+/** The mesh-TLS port a gossip HELLO payload advertises, or null. */
+function helloMeshTlsPort(payload) {
+	if (payload === null || typeof payload !== "object") return null;
+	const port = Reflect.get(payload, MESH_TLS_PORT_HELLO_FIELD);
+	return typeof port === "number" && Number.isInteger(port) && port > 0 && port < 65536 ? port : null;
+}
+/**
+* A gossip response with every node but `keep` removed. With nothing to
+* remove the payload is returned unchanged.
+*/
+function keepOnlyGossipNodes(payload, keep) {
+	if (payload === null || typeof payload !== "object") return {
+		payload,
+		removed: []
+	};
+	const removed = [];
+	const filtered = { ...payload };
+	for (const section of ["online", "offline"]) {
+		const entries = Reflect.get(payload, section);
+		if (entries === null || typeof entries !== "object") continue;
+		const kept = {};
+		for (const [nodeId, value] of Object.entries(entries)) if (keep.has(nodeId)) kept[nodeId] = value;
+		else removed.push(nodeId);
+		filtered[section] = kept;
+	}
+	return removed.length === 0 ? {
+		payload,
+		removed
+	} : {
+		payload: filtered,
+		removed
+	};
+}
 /**
 * Extract `sender` from a Moleculer TCP packet without fully trusting it —
 * used only to compare against the TLS peer CN.
@@ -86770,6 +86821,13 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	tlsPeers = /* @__PURE__ */ new Map();
 	clearDisabled = false;
 	hubTlsOnly;
+	hubOnlyPeers;
+	hubNodeId;
+	peerTlsPortOption;
+	/** Peers already reported as not adopted (D848) — one line each. */
+	ignoredPeers = /* @__PURE__ */ new Set();
+	/** Node id → the mesh-TLS port its last HELLO advertised. */
+	helloTlsPorts = /* @__PURE__ */ new Map();
 	/** Clear-text `TcpWriter.connect` captured once before the TLS wrap (A→B). */
 	clearWriterConnect = null;
 	writerTlsPatched = false;
@@ -86778,8 +86836,15 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		this.meshTls = opts.meshTls ?? null;
 		this.crl = opts.crl ?? processMeshCrl();
 		this.hubTlsOnly = opts.hubTlsOnly === true;
+		this.hubOnlyPeers = opts.hubOnlyPeers === true;
+		this.hubNodeId = opts.hubNodeId ?? DEFAULT_HUB_NODE_ID;
+		this.peerTlsPortOption = opts.peerTlsPort;
 		if (this.opts.tlsPort === void 0) this.opts.tlsPort = require_constants$8.DEFAULT_HUB_TLS_TCP_PORT;
 	}
+	/** Clear TCP is never served: the TLS-only hub, or an agent whose only peer is the hub. */
+	get tlsOnly() {
+		return this.hubTlsOnly || this.hubOnlyPeers;
+	}
 	startTcpServer() {
 		const started = super.startTcpServer();
 		if (this.meshTls !== null) this.patchWriterForTlsClient();
@@ -86789,8 +86854,8 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		return this.Promise.resolve().then(() => {
 			if (this.opts.urls) return this.loadUrls();
 		}).then(() => this.startTcpServer()).then(() => {
-			if (this.hubTlsOnly) this.disableClearTransport();
-		}).then(() => this.startTlsServerIfReady()).then(() => this.hubTlsOnly ? this.Promise.resolve() : this.startUdpServer()).then(() => this.startTimers()).then(() => {
+			if (this.tlsOnly) this.disableClearTransport();
+		}).then(() => this.startTlsServerIfReady()).then(() => this.tlsOnly ? this.Promise.resolve() : this.startUdpServer()).then(() => this.startTimers()).then(() => {
 			this.logger.info("TCP Transporter started.");
 			this.connected = true;
 			this.nodes.localNode.port = this.opts.port;
@@ -86798,17 +86863,19 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		}).then(() => this.onConnected());
 	}
 	/**
-	* Outbound dial uses mTLS when the peer is already known on TLS (inbound
-	* handshake), or when dialling the hub node id (agent → hub). Everyone else
-	* (runners, unenrolled agents) stays on the clear writer — the hub must not
-	* TLS-wrap every `connect` after deferred `enableMeshTls`.
+	* Outbound dial uses mTLS when dialling the hub node id (agent → hub), on a
+	* TLS-only hub (it has no clear listener, so no clear peer exists to dial —
+	* D848 closes the hub → agent clear leg), or when the peer is already known
+	* on TLS (inbound handshake).
 	*/
 	shouldDialPeerWithTls(nodeID) {
-		if (nodeID === "hub") return true;
+		if (nodeID === this.hubNodeId) return true;
+		if (this.hubTlsOnly) return true;
 		return this.tlsPeers.has(nodeID);
 	}
-	peerTlsDialPort() {
-		return this.opts.tlsPort ?? 6443;
+	/** The peer's advertised mesh-TLS port, else the configured dial port, else 6443. */
+	peerTlsDialPort(nodeID) {
+		return this.helloTlsPorts.get(nodeID) ?? this.peerTlsPortOption ?? this.opts.tlsPort ?? 6443;
 	}
 	/**
 	* Wrap `TcpWriter.connect` so TLS peers are dialed with mutual TLS on the
@@ -86828,13 +86895,14 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		const crl = this.crl;
 		const self = this;
 		writer.connect = (nodeID) => {
+			if (self.hubOnlyPeers && nodeID !== self.hubNodeId) return writer.Promise.reject(/* @__PURE__ */ new Error(`mesh: an enrolled agent dials only "${self.hubNodeId}", not "${nodeID}"`));
 			if (!self.shouldDialPeerWithTls(nodeID)) return clearConnect(nodeID);
 			const material = self.meshTls;
 			if (material === null) return clearConnect(nodeID);
 			const node = writer.transporter.getNode(nodeID);
 			if (!node) return writer.Promise.reject(/* @__PURE__ */ new Error(`Missing node info for '${nodeID}'!`));
 			const host = writer.transporter.getNodeAddress(node);
-			const port = self.peerTlsDialPort();
+			const port = self.peerTlsDialPort(nodeID);
 			writer.logger.debug(`Connecting (TLS) to '${nodeID}' via ${host}:${port}`);
 			return new writer.Promise((resolve, reject) => {
 				const socket = node_tls.connect({
@@ -86940,7 +87008,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	}
 	/** The switch back: listen on the clear port again and restart UDP discovery. Idempotent. */
 	async enableClearTransport() {
-		if (this.hubTlsOnly) return;
+		if (this.tlsOnly) return;
 		if (!this.clearDisabled) return;
 		this.clearDisabled = false;
 		if (this.reader !== null && this.reader.server?.listening !== true) await this.reader.listen();
@@ -86972,7 +87040,53 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		this.tlsPeers.clear();
 		return super.disconnect();
 	}
+	/**
+	* D848: an enrolled agent adopts no node from the hub's gossip but the hub
+	* itself, so it never learns — and therefore never dials or broadcasts to —
+	* another agent. Everything else is Moleculer's own handling.
+	*/
+	receive(cmd, data, socket) {
+		if (cmd === PACKET_GOSSIP_HELLO) this.noteHelloTlsPort(data);
+		if (!this.hubOnlyPeers || cmd !== PACKET_GOSSIP_RES) return super.receive(cmd, data, socket);
+		let payload;
+		try {
+			payload = this.broker.serializer.deserialize(data, cmd);
+		} catch {
+			return super.receive(cmd, data, socket);
+		}
+		const filtered = keepOnlyGossipNodes(payload, new Set([this.hubNodeId, this.nodeID]));
+		if (filtered.removed.length === 0) return super.receive(cmd, data, socket);
+		for (const nodeId of filtered.removed) {
+			if (this.ignoredPeers.has(nodeId)) continue;
+			this.ignoredPeers.add(nodeId);
+			this.logger.info(`Mesh: not adopting node '${nodeId}' from the hub's gossip — an enrolled agent's only peer is the hub (D848)`);
+		}
+		return super.receive(cmd, this.broker.serializer.serialize(filtered.payload, cmd), socket);
+	}
+	/** Remember the TLS port a peer's HELLO advertises (absent: an older node → the default). */
+	noteHelloTlsPort(data) {
+		let payload;
+		try {
+			payload = this.broker.serializer.deserialize(data, PACKET_GOSSIP_HELLO);
+		} catch {
+			return;
+		}
+		const sender = payload !== null && typeof payload === "object" ? Reflect.get(payload, "sender") : null;
+		if (typeof sender !== "string") return;
+		const port = helloMeshTlsPort(payload);
+		if (port === null) this.helloTlsPorts.delete(sender);
+		else this.helloTlsPorts.set(sender, port);
+	}
+	/** A TLS-listening node says where in every HELLO it sends. */
+	publish(packet) {
+		if (packet.type === PACKET_GOSSIP_HELLO && this.tlsServer !== null) packet.payload[MESH_TLS_PORT_HELLO_FIELD] = this.opts.tlsPort;
+		return super.publish(packet);
+	}
 	onIncomingMessage(type, message, socket) {
+		if (this.hubOnlyPeers && (socket === void 0 || !isTlsSocket(socket))) {
+			this.logger.warn("Dropping mesh packet — an enrolled agent accepts TLS from the hub only");
+			return;
+		}
 		if (socket !== void 0 && isTlsSocket(socket)) {
 			const tlsSock = socket;
 			const identity = tlsSock.meshPeerCn ? {
@@ -87043,6 +87157,11 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 			socket.destroy();
 			return;
 		}
+		if (this.hubOnlyPeers && identity.cn !== this.hubNodeId) {
+			this.logger.warn(`Mesh TLS client rejected — an enrolled agent accepts only '${this.hubNodeId}', not CN=${identity.cn} (D848)`);
+			socket.destroy();
+			return;
+		}
 		socket.meshPeerCn = identity.cn;
 		socket.meshPeerSerial = identity.serial;
 		this.tlsSockets.add(socket);
@@ -87745,6 +87864,7 @@ exports.AGENT_UI_UNLOCK_VERSION = AGENT_UI_UNLOCK_VERSION;
 exports.Errors = Errors;
 exports.JoinTokenJtiStore = JoinTokenJtiStore;
 exports.MESH_AUTH_MODE_FIELD = MESH_AUTH_MODE_FIELD;
+exports.MESH_TLS_PORT_HELLO_FIELD = MESH_TLS_PORT_HELLO_FIELD;
 exports.MeshCaKeeper = MeshCaKeeper;
 exports.MeshCrl = MeshCrl;
 exports.SYSTEM_CONFIG_CLUSTER_SECTION_ID = SYSTEM_CONFIG_CLUSTER_SECTION_ID;

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,7 +1,7 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { $r as transformSecretWrite, Er as defineCustomActions, Fr as isSecretClear, Ir as isSecretMarker, Rr as makeSecretMarker, Tr as customAction, Yr as secretTreeFromSchema, cr as BaseAddon, jr as hydrateSchema, sr as errMsg } from "../../dist-DlmdESNT.mjs";
+import { $r as transformSecretWrite, Er as defineCustomActions, Fr as isSecretClear, Ir as isSecretMarker, Rr as makeSecretMarker, Tr as customAction, Yr as secretTreeFromSchema, cr as BaseAddon, jr as hydrateSchema, sr as errMsg } from "../../dist-C0wYvAHC.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
-import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-C8T7u1_Z.mjs";
+import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-BeQWXybC.mjs";
 import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, i as KeyUsageFlags, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "../../x509.es-CAjSsrkk.mjs";
 import { t as require_src } from "../../src-hG4grMU4.mjs";
 import { z } from "zod";
@@ -86711,15 +86711,66 @@ import_moleculer.default.Validators;
 //#endregion
 //#region src/kernel/moleculer/mesh-mtls/tls-tcp-transporter.ts
 /**
-* Moleculer TCP transporter with a mutual-TLS listener (D826).
+* Moleculer TCP transporter with a mutual-TLS listener (D826, D848).
 *
 * Hub: `hubTlsOnly` — no clear TCP reader and no UDP discovery; TLS 1.3 on
-* `tlsPort` (default 6443) once mesh material is ready. Agents without mesh
-* material use clear TCP on their own listen port and dial the hub on TLS when
-* enrolled. On a TLS socket, any packet whose `sender` ≠ the peer certificate CN
-* is dropped.
+* `tlsPort` (default 6443) once mesh material is ready, and every peer is
+* dialled on mutual TLS too (a TLS-only hub has no clear peer to talk to).
+*
+* Enrolled agent: `hubOnlyPeers` (D848) — the hub is its ONLY mesh peer. No
+* clear TCP reader; the TLS listener accepts the hub's certificate only; the
+* writer dials the hub only; and the nodes the hub's gossip names are not
+* adopted, so the agent never learns, dials or broadcasts to another agent.
+* An agent without mesh material keeps clear TCP (it can reach only a
+* pre-D826 hub).
+*
+* On a TLS socket, any packet whose `sender` ≠ the peer certificate CN is
+* dropped. A TLS-listening node advertises its listen port in the gossip
+* HELLO it sends on every connection (`meshTlsPort`,
+* {@link MESH_TLS_PORT_HELLO_FIELD}); a peer dials it there, else on the
+* cluster-wide default (6443) — so two nodes on one host need not collide.
 */
+/** Field of the gossip HELLO payload carrying the sender's mesh-TLS listen port. */
+var MESH_TLS_PORT_HELLO_FIELD = "meshTlsPort";
+/** Moleculer packet types (`packets.PACKET_GOSSIP_*`). */
+var PACKET_GOSSIP_RES = "GOSSIP_RES";
+var PACKET_GOSSIP_HELLO = "GOSSIP_HELLO";
+/** The hub's node id — the only peer of a `hubOnlyPeers` agent. */
+var DEFAULT_HUB_NODE_ID = "hub";
 var TcpTransporterBase = Transporters.TCP;
+/** The mesh-TLS port a gossip HELLO payload advertises, or null. */
+function helloMeshTlsPort(payload) {
+	if (payload === null || typeof payload !== "object") return null;
+	const port = Reflect.get(payload, MESH_TLS_PORT_HELLO_FIELD);
+	return typeof port === "number" && Number.isInteger(port) && port > 0 && port < 65536 ? port : null;
+}
+/**
+* A gossip response with every node but `keep` removed. With nothing to
+* remove the payload is returned unchanged.
+*/
+function keepOnlyGossipNodes(payload, keep) {
+	if (payload === null || typeof payload !== "object") return {
+		payload,
+		removed: []
+	};
+	const removed = [];
+	const filtered = { ...payload };
+	for (const section of ["online", "offline"]) {
+		const entries = Reflect.get(payload, section);
+		if (entries === null || typeof entries !== "object") continue;
+		const kept = {};
+		for (const [nodeId, value] of Object.entries(entries)) if (keep.has(nodeId)) kept[nodeId] = value;
+		else removed.push(nodeId);
+		filtered[section] = kept;
+	}
+	return removed.length === 0 ? {
+		payload,
+		removed
+	} : {
+		payload: filtered,
+		removed
+	};
+}
 /**
 * Extract `sender` from a Moleculer TCP packet without fully trusting it —
 * used only to compare against the TLS peer CN.
@@ -86761,6 +86812,13 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	tlsPeers = /* @__PURE__ */ new Map();
 	clearDisabled = false;
 	hubTlsOnly;
+	hubOnlyPeers;
+	hubNodeId;
+	peerTlsPortOption;
+	/** Peers already reported as not adopted (D848) — one line each. */
+	ignoredPeers = /* @__PURE__ */ new Set();
+	/** Node id → the mesh-TLS port its last HELLO advertised. */
+	helloTlsPorts = /* @__PURE__ */ new Map();
 	/** Clear-text `TcpWriter.connect` captured once before the TLS wrap (A→B). */
 	clearWriterConnect = null;
 	writerTlsPatched = false;
@@ -86769,8 +86827,15 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		this.meshTls = opts.meshTls ?? null;
 		this.crl = opts.crl ?? processMeshCrl();
 		this.hubTlsOnly = opts.hubTlsOnly === true;
+		this.hubOnlyPeers = opts.hubOnlyPeers === true;
+		this.hubNodeId = opts.hubNodeId ?? DEFAULT_HUB_NODE_ID;
+		this.peerTlsPortOption = opts.peerTlsPort;
 		if (this.opts.tlsPort === void 0) this.opts.tlsPort = DEFAULT_HUB_TLS_TCP_PORT;
 	}
+	/** Clear TCP is never served: the TLS-only hub, or an agent whose only peer is the hub. */
+	get tlsOnly() {
+		return this.hubTlsOnly || this.hubOnlyPeers;
+	}
 	startTcpServer() {
 		const started = super.startTcpServer();
 		if (this.meshTls !== null) this.patchWriterForTlsClient();
@@ -86780,8 +86845,8 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		return this.Promise.resolve().then(() => {
 			if (this.opts.urls) return this.loadUrls();
 		}).then(() => this.startTcpServer()).then(() => {
-			if (this.hubTlsOnly) this.disableClearTransport();
-		}).then(() => this.startTlsServerIfReady()).then(() => this.hubTlsOnly ? this.Promise.resolve() : this.startUdpServer()).then(() => this.startTimers()).then(() => {
+			if (this.tlsOnly) this.disableClearTransport();
+		}).then(() => this.startTlsServerIfReady()).then(() => this.tlsOnly ? this.Promise.resolve() : this.startUdpServer()).then(() => this.startTimers()).then(() => {
 			this.logger.info("TCP Transporter started.");
 			this.connected = true;
 			this.nodes.localNode.port = this.opts.port;
@@ -86789,17 +86854,19 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		}).then(() => this.onConnected());
 	}
 	/**
-	* Outbound dial uses mTLS when the peer is already known on TLS (inbound
-	* handshake), or when dialling the hub node id (agent → hub). Everyone else
-	* (runners, unenrolled agents) stays on the clear writer — the hub must not
-	* TLS-wrap every `connect` after deferred `enableMeshTls`.
+	* Outbound dial uses mTLS when dialling the hub node id (agent → hub), on a
+	* TLS-only hub (it has no clear listener, so no clear peer exists to dial —
+	* D848 closes the hub → agent clear leg), or when the peer is already known
+	* on TLS (inbound handshake).
 	*/
 	shouldDialPeerWithTls(nodeID) {
-		if (nodeID === "hub") return true;
+		if (nodeID === this.hubNodeId) return true;
+		if (this.hubTlsOnly) return true;
 		return this.tlsPeers.has(nodeID);
 	}
-	peerTlsDialPort() {
-		return this.opts.tlsPort ?? 6443;
+	/** The peer's advertised mesh-TLS port, else the configured dial port, else 6443. */
+	peerTlsDialPort(nodeID) {
+		return this.helloTlsPorts.get(nodeID) ?? this.peerTlsPortOption ?? this.opts.tlsPort ?? 6443;
 	}
 	/**
 	* Wrap `TcpWriter.connect` so TLS peers are dialed with mutual TLS on the
@@ -86819,13 +86886,14 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		const crl = this.crl;
 		const self = this;
 		writer.connect = (nodeID) => {
+			if (self.hubOnlyPeers && nodeID !== self.hubNodeId) return writer.Promise.reject(/* @__PURE__ */ new Error(`mesh: an enrolled agent dials only "${self.hubNodeId}", not "${nodeID}"`));
 			if (!self.shouldDialPeerWithTls(nodeID)) return clearConnect(nodeID);
 			const material = self.meshTls;
 			if (material === null) return clearConnect(nodeID);
 			const node = writer.transporter.getNode(nodeID);
 			if (!node) return writer.Promise.reject(/* @__PURE__ */ new Error(`Missing node info for '${nodeID}'!`));
 			const host = writer.transporter.getNodeAddress(node);
-			const port = self.peerTlsDialPort();
+			const port = self.peerTlsDialPort(nodeID);
 			writer.logger.debug(`Connecting (TLS) to '${nodeID}' via ${host}:${port}`);
 			return new writer.Promise((resolve, reject) => {
 				const socket = tls.connect({
@@ -86931,7 +86999,7 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 	}
 	/** The switch back: listen on the clear port again and restart UDP discovery. Idempotent. */
 	async enableClearTransport() {
-		if (this.hubTlsOnly) return;
+		if (this.tlsOnly) return;
 		if (!this.clearDisabled) return;
 		this.clearDisabled = false;
 		if (this.reader !== null && this.reader.server?.listening !== true) await this.reader.listen();
@@ -86963,7 +87031,53 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 		this.tlsPeers.clear();
 		return super.disconnect();
 	}
+	/**
+	* D848: an enrolled agent adopts no node from the hub's gossip but the hub
+	* itself, so it never learns — and therefore never dials or broadcasts to —
+	* another agent. Everything else is Moleculer's own handling.
+	*/
+	receive(cmd, data, socket) {
+		if (cmd === PACKET_GOSSIP_HELLO) this.noteHelloTlsPort(data);
+		if (!this.hubOnlyPeers || cmd !== PACKET_GOSSIP_RES) return super.receive(cmd, data, socket);
+		let payload;
+		try {
+			payload = this.broker.serializer.deserialize(data, cmd);
+		} catch {
+			return super.receive(cmd, data, socket);
+		}
+		const filtered = keepOnlyGossipNodes(payload, new Set([this.hubNodeId, this.nodeID]));
+		if (filtered.removed.length === 0) return super.receive(cmd, data, socket);
+		for (const nodeId of filtered.removed) {
+			if (this.ignoredPeers.has(nodeId)) continue;
+			this.ignoredPeers.add(nodeId);
+			this.logger.info(`Mesh: not adopting node '${nodeId}' from the hub's gossip — an enrolled agent's only peer is the hub (D848)`);
+		}
+		return super.receive(cmd, this.broker.serializer.serialize(filtered.payload, cmd), socket);
+	}
+	/** Remember the TLS port a peer's HELLO advertises (absent: an older node → the default). */
+	noteHelloTlsPort(data) {
+		let payload;
+		try {
+			payload = this.broker.serializer.deserialize(data, PACKET_GOSSIP_HELLO);
+		} catch {
+			return;
+		}
+		const sender = payload !== null && typeof payload === "object" ? Reflect.get(payload, "sender") : null;
+		if (typeof sender !== "string") return;
+		const port = helloMeshTlsPort(payload);
+		if (port === null) this.helloTlsPorts.delete(sender);
+		else this.helloTlsPorts.set(sender, port);
+	}
+	/** A TLS-listening node says where in every HELLO it sends. */
+	publish(packet) {
+		if (packet.type === PACKET_GOSSIP_HELLO && this.tlsServer !== null) packet.payload[MESH_TLS_PORT_HELLO_FIELD] = this.opts.tlsPort;
+		return super.publish(packet);
+	}
 	onIncomingMessage(type, message, socket) {
+		if (this.hubOnlyPeers && (socket === void 0 || !isTlsSocket(socket))) {
+			this.logger.warn("Dropping mesh packet — an enrolled agent accepts TLS from the hub only");
+			return;
+		}
 		if (socket !== void 0 && isTlsSocket(socket)) {
 			const tlsSock = socket;
 			const identity = tlsSock.meshPeerCn ? {
@@ -87034,6 +87148,11 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 			socket.destroy();
 			return;
 		}
+		if (this.hubOnlyPeers && identity.cn !== this.hubNodeId) {
+			this.logger.warn(`Mesh TLS client rejected — an enrolled agent accepts only '${this.hubNodeId}', not CN=${identity.cn} (D848)`);
+			socket.destroy();
+			return;
+		}
 		socket.meshPeerCn = identity.cn;
 		socket.meshPeerSerial = identity.serial;
 		this.tlsSockets.add(socket);
@@ -87728,4 +87847,4 @@ function readJwtExp(token) {
 	return typeof exp === "number" ? exp : 0;
 }
 //#endregion
-export { AGENT_UI_UNLOCK_VERSION as A, parseMeshAuthMode as B, generateMeshKeyPair as C, AGENT_DASHBOARD_ORIGINS_FIELD as D, loadMeshCa as E, verifyAgentUiUnlockTicket as F, createCidrMatcher as G, setProcessMeshAuthMode as H, MESH_AUTH_MODE_FIELD as I, readCidrSetting as J, normalizeIp as K, getProcessMeshAuthMode as L, isAllowedAgentDashboardReturnTo as M, mintAgentUiUnlockTicket as N, AGENT_UI_UNLOCK_DOMAIN as O, parseAgentDashboardOrigins as P, getProcessMeshAuthStatus as R, generateMeshCa as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, issueMeshLeafFromCsr as T, setProcessMeshAuthStatusSource as U, requestProcessMeshEnforcement as V, setProcessMeshEnforcer as W, requireProcessMeshCa as _, setProcessMeshTlsEnabler as a, createMeshCsrPem as b, mintMeshJoinToken as c, getProcessNodeMeshTransport as d, setProcessMeshPeerTransportLookup as f, getProcessMeshCaState as g, MeshCaKeeper as h, ServiceBroker as i, UnlockTicketJtiStore as j, AGENT_UI_UNLOCK_TTL_MS as k, processJoinTokenJtiStore as l, processMeshCrl as m, TlsTcpTransporter as n, enrollMeshNode as o, MeshCrl as p, parseCidrList as q, Errors as r, JoinTokenJtiStore as s, systemConfigMeshActions as t, verifyMeshJoinToken as u, caFingerprint as v, issueMeshLeafForNode as w, exportMeshPrivateKeyPem as x, caFingerprintCompact as y, isMeshAuthMode as z };
+export { AGENT_UI_UNLOCK_TTL_MS as A, isMeshAuthMode as B, generateMeshCa as C, loadMeshCa as D, issueMeshLeafFromCsr as E, parseAgentDashboardOrigins as F, setProcessMeshEnforcer as G, requestProcessMeshEnforcement as H, verifyAgentUiUnlockTicket as I, parseCidrList as J, createCidrMatcher as K, MESH_AUTH_MODE_FIELD as L, UnlockTicketJtiStore as M, isAllowedAgentDashboardReturnTo as N, AGENT_DASHBOARD_ORIGINS_FIELD as O, mintAgentUiUnlockTicket as P, getProcessMeshAuthMode as R, exportMeshPrivateKeyPem as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, issueMeshLeafForNode as T, setProcessMeshAuthMode as U, parseMeshAuthMode as V, setProcessMeshAuthStatusSource as W, readCidrSetting as Y, getProcessMeshCaState as _, ServiceBroker as a, caFingerprintCompact as b, JoinTokenJtiStore as c, verifyMeshJoinToken as d, getProcessNodeMeshTransport as f, MeshCaKeeper as g, processMeshCrl as h, Errors as i, AGENT_UI_UNLOCK_VERSION as j, AGENT_UI_UNLOCK_DOMAIN as k, mintMeshJoinToken as l, MeshCrl as m, MESH_TLS_PORT_HELLO_FIELD as n, setProcessMeshTlsEnabler as o, setProcessMeshPeerTransportLookup as p, normalizeIp as q, TlsTcpTransporter as r, enrollMeshNode as s, systemConfigMeshActions as t, processJoinTokenJtiStore as u, requireProcessMeshCa as v, generateMeshKeyPair as w, createMeshCsrPem as x, caFingerprint as y, getProcessMeshAuthStatus as z };

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVUg8e1T.js");
+const require_dist = require("../../dist-DLHPmdoV.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Xt as logDestinationCapability, cr as BaseAddon } from "../../dist-DlmdESNT.mjs";
+import { Xt as logDestinationCapability, cr as BaseAddon } from "../../dist-C0wYvAHC.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{composition-sources-0cPw9E0M.mjs → composition-sources-562ib2dL.mjs}

@@ -1,4 +1,4 @@
-import { er as compositionSourceKey, sr as errMsg } from "./dist-DlmdESNT.mjs";
+import { er as compositionSourceKey, sr as errMsg } from "./dist-C0wYvAHC.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-BVjuMvpb.js → composition-sources-OaDYklhR.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DVUg8e1T.js");
+const require_dist = require("./dist-DLHPmdoV.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-C8T7u1_Z.mjs → constants-BeQWXybC.mjs}

@@ -1,4 +1,4 @@
-import { xr as buildSecretRef } from "./dist-DlmdESNT.mjs";
+import { xr as buildSecretRef } from "./dist-C0wYvAHC.mjs";
 import { createHash, timingSafeEqual } from "node:crypto";
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{constants-Aj0OBqlt.js → constants-ik5xtasS.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DVUg8e1T.js");
+const require_dist = require("./dist-DLHPmdoV.js");
 let node_crypto = require("node:crypto");
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{dist-DlmdESNT.mjs → dist-C0wYvAHC.mjs}

@@ -36989,6 +36989,17 @@ var BatteryStatusSchema = z.object({
 	*/
 	lastContactAt: z.number().optional(),
 	/**
+	* Ms epoch of the last COMPLETE scheduled refresh — every fact the provider
+	* holds for the device (level, charging, link, device info, state slices) and
+	* its cached snapshot, read together. Absent = never since this slice was
+	* born. Unlike `lastUpdated` (any write, even a push of one field) this is
+	* the staleness an operator can trust: the provider owns the device fact and
+	* so owns the window on its age (D224, D847). Not a clock in the
+	* runtime-state-durability sense: it moves once per window and must survive
+	* a restart, or every restart would owe the camera a wake.
+	*/
+	lastFullRefreshAt: z.number().optional(),
+	/**
 	* True when the source is a BINARY low-battery indicator (HA
 	* `binary_sensor` device_class=battery / `LOW_BAT`) that has no real
 	* charge level — `percentage` is then a coarse stand-in (100 = normal,

package/dist/{dist-DVUg8e1T.js → dist-DLHPmdoV.js}

@@ -36989,6 +36989,17 @@ var BatteryStatusSchema = zod.z.object({
 	*/
 	lastContactAt: zod.z.number().optional(),
 	/**
+	* Ms epoch of the last COMPLETE scheduled refresh — every fact the provider
+	* holds for the device (level, charging, link, device info, state slices) and
+	* its cached snapshot, read together. Absent = never since this slice was
+	* born. Unlike `lastUpdated` (any write, even a push of one field) this is
+	* the staleness an operator can trust: the provider owns the device fact and
+	* so owns the window on its age (D224, D847). Not a clock in the
+	* runtime-state-durability sense: it moves once per window and must survive
+	* a restart, or every restart would owe the camera a wake.
+	*/
+	lastFullRefreshAt: zod.z.number().optional(),
+	/**
 	* True when the source is a BINARY low-battery indicator (HA
 	* `binary_sensor` device_class=battery / `LOW_BAT`) that has no real
 	* charge level — `percentage` is then a coarse stand-in (100 = normal,