@camstack/system 1.2.419 → 1.2.421

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DLHPmdoV.js");
-const require_jwt_signing_key = require("./jwt-signing-key-CWmNKLQi.js");
+const require_dist = require("./dist-Df7s77se.js");
+const require_jwt_signing_key = require("./jwt-signing-key-BmyvxlDJ.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -26,7 +26,7 @@ const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtin
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_constants = require("./constants-ik5xtasS.js");
+const require_constants = require("./constants-GXZQRcjB.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
@@ -34,7 +34,7 @@ const require_custom_action_registry = require("./custom-action-registry-Bf_Ynag
 const require_tls = require("./tls-BgImdxCO.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-DZeFVS2l.js");
+const require_restore_archive = require("./restore-archive-W1Cg5y6C.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -15109,6 +15109,9 @@ function createBroker(config) {
 			serializer: "MsgPack",
 			transporter: new require_builtins_system_config_system_config_addon.TlsTcpTransporter({
 				port: agentListenPort,
+				tlsPort: config.agentTlsListenPort ?? 6443,
+				peerTlsPort: hubDialPort,
+				hubOnlyPeers: true,
 				maxPacketSize: 10 * 1024 * 1024,
 				useHostname,
 				debug: false,
@@ -24111,6 +24114,10 @@ function createMeshAccessMiddleware(options) {
 				const sender = senderOf(ctx);
 				if (sender === null || sender === ownNodeId) return next.call(this, ctx);
 				const verdict = authenticator.admitCall(sender, name);
+				if (verdict.verdict === "hold") return verdict.settled.then((settled) => runAdmitted.call(this, ctx, sender, settled));
+				return runAdmitted.call(this, ctx, sender, verdict);
+			};
+			function runAdmitted(ctx, sender, verdict) {
 				if (verdict.verdict === "deny") {
 					logger?.warn("mesh call refused", {
 						sender,
@@ -24122,23 +24129,119 @@ function createMeshAccessMiddleware(options) {
 				if (name === "$hub.unregisterNode" && paramNodeId(ctx.params) !== sender) return Promise.reject(new require_builtins_system_config_system_config_addon.Errors.MoleculerClientError(`node "${sender}" may unregister only itself`, 403, MESH_ACTION_FORBIDDEN_TYPE));
 				ctx.params = stripForgedIdentity(name, ctx.params);
 				return next.call(this, ctx);
-			};
+			}
 		},
 		localEvent(next, event) {
 			const name = event.name ?? "";
 			return function meshGatedEvent(ctx) {
 				const sender = senderOf(ctx);
 				if (sender === null || sender === ownNodeId) return Promise.resolve(next.call(this, ctx));
-				if (authenticator.admitEvent(sender, name).verdict === "deny") {
-					noteDroppedEvent(sender, name);
-					return Promise.resolve();
-				}
-				return Promise.resolve(next.call(this, ctx));
+				const verdict = authenticator.admitEvent(sender, name);
+				const deliver = (settled) => {
+					if (settled.verdict === "deny") {
+						noteDroppedEvent(sender, name);
+						return Promise.resolve();
+					}
+					return Promise.resolve(next.call(this, ctx));
+				};
+				return verdict.verdict === "hold" ? verdict.settled.then(deliver) : deliver(verdict);
 			};
 		}
 	};
 }
 //#endregion
+//#region src/kernel/moleculer/mesh-join-hold.ts
+var DEFAULT_MESH_JOIN_MAX_HELD = 1e3;
+var DEFAULT_MESH_JOIN_MAX_HOLD_MS = 15e3;
+var MeshJoinHold = class {
+	opts;
+	waiters = [];
+	firstHeldAt = null;
+	overflow = 0;
+	timer = null;
+	/** Holding is open while a join is in flight; closed after a decision or the bound. */
+	open = true;
+	now;
+	constructor(opts) {
+		this.opts = opts;
+		this.now = opts.now ?? Date.now;
+	}
+	/** Whether a request arriving now would be held (a join is in flight). */
+	get holding() {
+		return this.open;
+	}
+	/** How many requests wait right now. */
+	get size() {
+		return this.waiters.length;
+	}
+	/** A join started: hold again. */
+	reopen() {
+		this.open = true;
+	}
+	/** Hold one request; `null` when holding is closed (the caller refuses it). */
+	hold(kind) {
+		if (!this.open) return null;
+		if (this.waiters.length >= (this.opts.maxHeld ?? 1e3)) {
+			this.overflow++;
+			return {
+				verdict: "hold",
+				settled: Promise.resolve(this.refusal("the hold before the mesh join is full"))
+			};
+		}
+		if (this.firstHeldAt === null) {
+			this.firstHeldAt = this.now();
+			this.timer = setTimeout(() => this.refuse("bound"), this.opts.maxHoldMs ?? 15e3);
+			this.timer.unref?.();
+		}
+		return {
+			verdict: "hold",
+			settled: new Promise((resolve) => {
+				this.waiters.push({
+					kind,
+					resolve
+				});
+			})
+		};
+	}
+	/** The join proved the hub: deliver everything held, in order. */
+	release() {
+		this.open = false;
+		this.settle({ verdict: "allow" }, "delivered", "authenticated");
+	}
+	/** The join failed, or the bound ran out: refuse everything held. */
+	refuse(reason) {
+		this.open = false;
+		this.settle(this.refusal(`the join ended "${reason}"`), "refused", reason);
+	}
+	refusal(why) {
+		return {
+			verdict: "deny",
+			errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
+			message: `"${this.opts.hubNodeId}" sent this before the mesh join settled, and ${why}`
+		};
+	}
+	settle(verdict, outcome, reason) {
+		if (this.timer !== null) clearTimeout(this.timer);
+		this.timer = null;
+		const waiters = this.waiters;
+		const overflow = this.overflow;
+		const firstHeldAt = this.firstHeldAt;
+		this.waiters = [];
+		this.overflow = 0;
+		this.firstHeldAt = null;
+		if (waiters.length === 0 && overflow === 0) return;
+		for (const w of waiters) w.resolve(verdict);
+		this.opts.onReport?.({
+			outcome,
+			reason,
+			events: waiters.filter((w) => w.kind === "event").length,
+			calls: waiters.filter((w) => w.kind === "call").length,
+			overflow,
+			heldForMs: firstHeldAt === null ? 0 : this.now() - firstHeldAt
+		});
+	}
+};
+//#endregion
 //#region src/kernel/moleculer/agent-mesh-authenticator.ts
 /** The child's register action on its parent agent. */
 var AGENT_REGISTER_NODE_ACTION = "$agent.registerNode";
@@ -24158,10 +24261,22 @@ var AgentMeshAuthenticator = class {
 	nodes = /* @__PURE__ */ new Map();
 	hubNodeId;
 	now;
+	hold;
 	constructor(deps) {
 		this.deps = deps;
 		this.hubNodeId = deps.hubNodeId ?? DEFAULT_HUB_NODE_ID;
 		this.now = deps.now ?? Date.now;
+		this.hold = new MeshJoinHold({
+			hubNodeId: this.hubNodeId,
+			now: this.now,
+			...deps.maxHeld !== void 0 ? { maxHeld: deps.maxHeld } : {},
+			...deps.maxHoldMs !== void 0 ? { maxHoldMs: deps.maxHoldMs } : {},
+			...deps.onHoldReport !== void 0 ? { onReport: deps.onHoldReport } : {}
+		});
+	}
+	/** How many of the hub's requests wait for the join right now. */
+	heldCount() {
+		return this.hold.size;
 	}
 	/** Current mode: secret configured → enforce; else tolerate (upgrade path). */
 	mode() {
@@ -24175,9 +24290,16 @@ var AgentMeshAuthenticator = class {
 	noteHubJoinState(state) {
 		if (state === "authenticated") {
 			this.record(this.hubNodeId, "authenticated");
+			this.hold.release();
+			return;
+		}
+		if (state === "pending") {
+			this.forget(this.hubNodeId);
+			this.hold.reopen();
 			return;
 		}
-		if (state === "secret-mismatch" || state === "hub-unverified" || state === "pending") this.forget(this.hubNodeId);
+		if (state === "secret-mismatch" || state === "hub-unverified") this.forget(this.hubNodeId);
+		this.hold.refuse(state);
 	}
 	/** A child's `$agent.registerNode` was accepted (secret hash matched or none required). */
 	noteChildRegistered(sender, proof = "authenticated") {
@@ -24196,11 +24318,11 @@ var AgentMeshAuthenticator = class {
 			message: `"${action}" is not callable from another node (caller "${sender}")`
 		};
 		if (action === "$agent.registerNode" && isOwnChildNodeId(this.deps.ownNodeId, sender)) return { verdict: "allow" };
-		return this.admitSender(sender, action);
+		return this.admitSender(sender, action, "call");
 	}
 	admitEvent(sender, eventName) {
 		if (sender === this.deps.ownNodeId) return { verdict: "allow" };
-		return this.admitSender(sender, `event:${eventName}`);
+		return this.admitSender(sender, `event:${eventName}`, "event");
 	}
 	stateOf(nodeId) {
 		return this.nodes.get(nodeId)?.state ?? "unauthenticated";
@@ -24208,14 +24330,20 @@ var AgentMeshAuthenticator = class {
 	authenticatedNodeIds() {
 		return [...this.nodes].filter(([, r]) => r.state === "authenticated").map(([id]) => id);
 	}
-	admitSender(sender, what) {
+	admitSender(sender, what, kind) {
 		const state = this.stateOf(sender);
 		if (state === "authenticated" || state === "legacy") return { verdict: "allow" };
-		if (this.mode() === "enforced") return {
-			verdict: "deny",
-			errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
-			message: `node "${sender}" has not authenticated to this agent — only the hub (after mutual mesh join) and this agent's own children may call it`
-		};
+		if (this.mode() === "enforced") {
+			if (sender === this.hubNodeId) {
+				const held = this.hold.hold(kind);
+				if (held !== null) return held;
+			}
+			return {
+				verdict: "deny",
+				errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
+				message: `node "${sender}" has not authenticated to this agent — only the hub (after mutual mesh join) and this agent's own children may call it`
+			};
+		}
 		if (!this.nodes.has(sender)) {
 			this.record(sender, "unauthenticated");
 			this.deps.onTolerated?.(sender, what);
@@ -24235,6 +24363,40 @@ var AgentMeshAuthenticator = class {
 	}
 };
 //#endregion
+//#region src/kernel/moleculer/agent-event-scope.ts
+/** Moleculer's EVENT packet type (`packets.PACKET_EVENT`). */
+var PACKET_EVENT = "EVENT";
+/** Is this an event packet addressed to a node other than the hub? */
+function isPeerEventPacket(packet, hubNodeId) {
+	return packet.type === PACKET_EVENT && packet.target !== null && packet.target !== hubNodeId;
+}
+function createAgentEventScope(opts) {
+	let toHub = 0;
+	const withheld = /* @__PURE__ */ new Map();
+	const gate = (next) => function agentEventScoped(packet) {
+		if (packet.type !== PACKET_EVENT) return next(packet);
+		if (!isPeerEventPacket(packet, opts.hubNodeId)) {
+			if (packet.target === opts.hubNodeId) toHub++;
+			return next(packet);
+		}
+		const peer = packet.target ?? "";
+		const prev = withheld.get(peer) ?? 0;
+		withheld.set(peer, prev + 1);
+		if (prev === 0) opts.log?.(`mesh events: not sending events to node "${peer}" — an agent's events go to the hub only (D848)`);
+		return Promise.resolve();
+	};
+	return {
+		middleware: {
+			name: "CamstackAgentEventScope",
+			transitPublish: gate
+		},
+		stats: () => ({
+			toHub,
+			withheld: Object.fromEntries(withheld)
+		})
+	};
+}
+//#endregion
 //#region src/kernel/moleculer/mesh-join-client.ts
 /** States in which a call to the hub is refused locally. */
 var BLOCKING = new Set(["secret-mismatch", "hub-unverified"]);
@@ -26713,6 +26875,8 @@ exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
 exports.DEFAULT_HUB_TLS_TCP_PORT = require_constants.DEFAULT_HUB_TLS_TCP_PORT;
 exports.DEFAULT_LAN_HTTP_PORT = require_tls.DEFAULT_LAN_HTTP_PORT;
 exports.DEFAULT_LOG_LEVEL = DEFAULT_LOG_LEVEL;
+exports.DEFAULT_MESH_JOIN_MAX_HELD = DEFAULT_MESH_JOIN_MAX_HELD;
+exports.DEFAULT_MESH_JOIN_MAX_HOLD_MS = DEFAULT_MESH_JOIN_MAX_HOLD_MS;
 exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = require_dist.DEVICE_SETTINGS_CONTRIBUTION_METHODS;
 exports.DEVICE_STATUS_METHOD = require_dist.DEVICE_STATUS_METHOD;
 exports.DataPlaneRegistry = DataPlaneRegistry;
@@ -26786,11 +26950,13 @@ exports.MESH_JOIN_CHALLENGE_TTL_MS = MESH_JOIN_CHALLENGE_TTL_MS;
 exports.MESH_JOIN_PROTOCOL = MESH_JOIN_PROTOCOL;
 exports.MESH_NODE_UNAUTHENTICATED_TYPE = MESH_NODE_UNAUTHENTICATED_TYPE;
 exports.MESH_QUEUE_TOP_N = MESH_QUEUE_TOP_N;
+exports.MESH_TLS_PORT_HELLO_FIELD = require_builtins_system_config_system_config_addon.MESH_TLS_PORT_HELLO_FIELD;
 exports.METHOD_ACCESS_MAP = require_dist.METHOD_ACCESS_MAP;
 exports.MeshAuthenticator = MeshAuthenticator;
 exports.MeshCaKeeper = require_builtins_system_config_system_config_addon.MeshCaKeeper;
 exports.MeshCrl = require_builtins_system_config_system_config_addon.MeshCrl;
 exports.MeshJoinClient = MeshJoinClient;
+exports.MeshJoinHold = MeshJoinHold;
 exports.ModelDownloadService = require_custom_action_registry.ModelDownloadService;
 exports.NATIVE_PROVIDER_SERVICE_INFIX = NATIVE_PROVIDER_SERVICE_INFIX;
 exports.NATIVE_SCAN_DEPTH = NATIVE_SCAN_DEPTH;
@@ -26919,6 +27085,7 @@ exports.createAddonContext = createAddonContext;
 exports.createAddonDataPlaneFacility = createAddonDataPlaneFacility;
 exports.createAddonPeerBytesFacility = createAddonPeerBytesFacility;
 exports.createAddonService = createAddonService;
+exports.createAgentEventScope = createAgentEventScope;
 exports.createArrayBufferCensusGate = createArrayBufferCensusGate;
 exports.createAuthenticatedFileServer = require_custom_action_registry.createAuthenticatedFileServer;
 exports.createBroker = createBroker;
@@ -27095,6 +27262,7 @@ exports.isInfraCapability = isInfraCapability;
 exports.isMeshAuthMode = require_builtins_system_config_system_config_addon.isMeshAuthMode;
 exports.isModelDownloaded = require_custom_action_registry.isModelDownloaded;
 exports.isOwnChildNodeId = isOwnChildNodeId;
+exports.isPeerEventPacket = isPeerEventPacket;
 exports.isRemoteForbiddenAction = isRemoteForbiddenAction;
 exports.isRemoteForbiddenOnAgent = isRemoteForbiddenOnAgent;
 exports.isSettingsReadUnavailable = require_builtins_local_auth_local_auth_addon.isSettingsReadUnavailable;