@camstack/system 1.2.434 → 1.2.436

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,12 +1,12 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Jr as isSecretMarker, Lr as customAction, Rr as defineCustomActions, Ur as hydrateSchema, Xr as makeSecretMarker, br as BaseAddon, di as transformSecretWrite, qr as isSecretClear, si as secretTreeFromSchema, yr as errMsg } from "../../dist-CYcBqnXk.mjs";
+import { Rr as customAction, Wr as hydrateSchema, br as errMsg, xr as BaseAddon, zr as defineCustomActions } from "../../dist-DjD2M79P.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, g as backdatedNotBefore, i as KeyUsageFlags, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "../../x509.es-CDvj67p1.mjs";
 import { A as AgentHttpsNames, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, d as isPrivateAddress, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, u as isLocalOnlyHostname } from "../../agent-https-B8lKYVtU.mjs";
-import { a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, c as MESH_JOIN_TOKEN_MAX_TTL_SEC, d as CLUSTER_SECRET_REF, i as MESH_CA_FIELD, l as SERVER_AUTH_OID, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID, v as hashClusterSecret } from "../../constants-CrMPWOug.mjs";
+import { a as MESH_CA_KEY_REF, c as SERVER_AUTH_OID, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "../../constants-BFpowodq.mjs";
 import { t as require_src } from "../../src-hG4grMU4.mjs";
 import { z } from "zod";
-import { X509Certificate, createHash, createHmac, createPrivateKey, randomBytes, randomInt, sign, timingSafeEqual, verify, webcrypto } from "node:crypto";
+import { X509Certificate, createHash, createPrivateKey, randomBytes, randomInt, sign, timingSafeEqual, verify, webcrypto } from "node:crypto";
 import { BlockList, isIP } from "node:net";
 import { lstat, readdir, readlink, realpath } from "node:fs/promises";
 import { posix, win32 } from "node:path";
@@ -97,73 +97,27 @@ function createCidrMatcher(entries) {
 	};
 }
 //#endregion
-//#region src/kernel/moleculer/mesh-auth-mode.ts
-/** The field key inside the `cluster` section. */
-var MESH_AUTH_MODE_FIELD = "meshAuth";
-function isMeshAuthMode(value) {
-	return value === "transition" || value === "enforced";
-}
-/** A stored value that is not a mode reads as `transition`: never refuse on a typo. */
-function parseMeshAuthMode(value) {
-	return isMeshAuthMode(value) ? value : "transition";
-}
-var MODE_SLOT = Symbol.for("camstack.cluster.mesh-auth-mode");
-var ENFORCER_SLOT = Symbol.for("camstack.cluster.mesh-auth-enforcer");
-var STATUS_SLOT = Symbol.for("camstack.cluster.mesh-auth-status");
-/** Published by `system-config` whenever the stored mode is (re)read. */
-function setProcessMeshAuthMode(mode) {
-	Reflect.set(globalThis, MODE_SLOT, mode);
-}
-/**
-* The hub's mode. Until `system-config` has read it: `transition` — the safe
-* side for an upgrading cluster (nothing that worked before is refused), and
-* exactly what an unread setting means.
-*/
-function getProcessMeshAuthMode() {
-	return parseMeshAuthMode(Reflect.get(globalThis, MODE_SLOT));
-}
-function setProcessMeshEnforcer(enforcer) {
-	if (enforcer === null) Reflect.deleteProperty(globalThis, ENFORCER_SLOT);
-	else Reflect.set(globalThis, ENFORCER_SLOT, enforcer);
-}
-/** Ask the owner of the setting to switch to `enforced`. `false` when nobody can. */
-async function requestProcessMeshEnforcement(reason) {
-	const enforcer = Reflect.get(globalThis, ENFORCER_SLOT);
-	if (typeof enforcer !== "function") return false;
-	await enforcer(reason);
-	return true;
-}
-/** Published by the hub's broker; read by System → Cluster. */
-function setProcessMeshAuthStatusSource(source) {
-	if (source === null) Reflect.deleteProperty(globalThis, STATUS_SLOT);
-	else Reflect.set(globalThis, STATUS_SLOT, source);
-}
-function getProcessMeshAuthStatus() {
-	const source = Reflect.get(globalThis, STATUS_SLOT);
-	return typeof source === "function" ? source() : null;
-}
-//#endregion
 //#region src/kernel/moleculer/agent-ui-unlock.ts
 /**
-* Agent UI remote unlock tickets (D821).
+* Agent UI remote unlock tickets (D821, re-keyed by D857).
 *
-* A hub admin mints a short-lived HMAC ticket bound to one agent `nodeId`.
-* The agent redeems it once for a tab session Bearer — the cluster secret
-* stays a mesh / pairing credential and is not pasted into the browser for
-* daily unlock.
+* A hub admin mints a short-lived ticket bound to one agent `nodeId`, signed
+* with the MESH CA key (ES256 JWS). The agent verifies it
+* with the CA certificate it pinned at pairing and redeems it once for a tab
+* session Bearer. There is no shared secret: a ticket is worth exactly as much
+* as the CA key that signed it, and the agent trusts exactly the CA its
+* operator confirmed during pairing.
 *
-*   K       = SHA-256(cluster secret)   — same as mesh join (D802)
-*   ticket  = base64url(JSON payload) + '.' + base64url(HMAC-SHA256(K, DOMAIN|payloadB64))
-*   payload = { v: 1, nodeId, exp (ms), jti }
-*/
-var AGENT_UI_UNLOCK_DOMAIN = "camstack-agent-ui-unlock/v1";
-var AGENT_UI_UNLOCK_VERSION = 1;
-/**
-* D857 (transition release): a ticket signed by the MESH CA key (ES256 JWS) is accepted by an agent
-* IN ADDITION to the HMAC ticket. The removal release mints only this form.
+*   ticket  = b64url(header) '.' b64url(payload) '.' b64url(ES256 signature)
+*   header  = { alg: 'ES256', typ: 'camstack-agent-ui-unlock+jwt' }
+*   payload = { v: 1, use: 'agent-ui-unlock', nodeId, iat (ms), exp (ms), jti }
+*
+* The `typ` and `use` pins keep a join token or a pairing proof (also signed
+* by the CA key) from ever being accepted here, and the reverse.
 */
 var AGENT_UI_UNLOCK_TYP = "camstack-agent-ui-unlock+jwt";
 var AGENT_UI_UNLOCK_USE = "agent-ui-unlock";
+var AGENT_UI_UNLOCK_VERSION = 1;
 /** Ticket lifetime — long enough for a redirect hop, short enough to steal poorly. */
 var AGENT_UI_UNLOCK_TTL_MS = 5 * 6e4;
 /**
@@ -193,18 +147,28 @@ var UnlockTicketJtiStore = class {
 		for (const [jti, exp] of this.spent) if (exp <= nowMs) this.spent.delete(jti);
 	}
 };
+function b64urlJson$1(value) {
+	return Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
+}
 function mintAgentUiUnlockTicket(input) {
 	const nowMs = input.nowMs ?? Date.now();
 	const ttl = Math.min(Math.max(1e3, input.ttlMs ?? 3e5), AGENT_UI_UNLOCK_TTL_MS);
 	const payload = {
 		v: 1,
+		use: AGENT_UI_UNLOCK_USE,
 		nodeId: input.nodeId,
 		iat: nowMs,
 		exp: nowMs + ttl,
 		jti: input.jti ?? randomBytes(16).toString("base64url")
 	};
-	const payloadB64 = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
-	return `${payloadB64}.${sign$1(input.secretHash, payloadB64)}`;
+	const signingInput = `${b64urlJson$1({
+		alg: "ES256",
+		typ: AGENT_UI_UNLOCK_TYP
+	})}.${b64urlJson$1(payload)}`;
+	return `${signingInput}.${sign("sha256", Buffer.from(signingInput, "utf8"), {
+		key: createPrivateKey(input.caKeyPem),
+		dsaEncoding: "ieee-p1363"
+	}).toString("base64url")}`;
 }
 /** A ticket is issued now-ish, lives at most the TTL, and not before `notBeforeMs`. */
 function issuedSanely(payload, nowMs, notBeforeMs) {
@@ -213,22 +177,36 @@ function issuedSanely(payload, nowMs, notBeforeMs) {
 	return notBeforeMs === void 0 || payload.iat >= notBeforeMs;
 }
 /**
-* Verify a ticket under `secretHash`. Returns the payload, or `null` when the
-* signature, shape, expiry or nodeId fails (no reason string — refuse quietly).
+* Verify a ticket against the mesh CA certificate the agent pinned. Returns the
+* payload, or `null` when the signature, header, shape, expiry or nodeId fails
+* (no reason string — refuse quietly).
 */
-function verifyAgentUiUnlockTicket(secretHash, ticket, options) {
+function verifyAgentUiUnlockTicket(caCertPem, ticket, options) {
 	const nowMs = options.nowMs ?? Date.now();
-	const dot = ticket.indexOf(".");
-	if (dot <= 0 || dot === ticket.length - 1) return null;
-	const payloadB64 = ticket.slice(0, dot);
-	const sig = ticket.slice(dot + 1);
-	if (!sigsEqual(sign$1(secretHash, payloadB64), sig)) return null;
+	const parts = ticket.split(".");
+	if (parts.length !== 3) return null;
+	const [headerB64, payloadB64, signatureB64] = parts;
+	if (headerB64 === void 0 || payloadB64 === void 0 || signatureB64 === void 0) return null;
+	let header;
 	let parsed;
 	try {
+		header = JSON.parse(Buffer.from(headerB64, "base64url").toString("utf8"));
 		parsed = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
 	} catch {
 		return null;
 	}
+	if (typeof header !== "object" || header === null) return null;
+	if (Reflect.get(header, "alg") !== "ES256" || Reflect.get(header, "typ") !== "camstack-agent-ui-unlock+jwt") return null;
+	let valid = false;
+	try {
+		valid = verify("sha256", Buffer.from(`${headerB64}.${payloadB64}`, "utf8"), {
+			key: new X509Certificate(caCertPem).publicKey,
+			dsaEncoding: "ieee-p1363"
+		}, Buffer.from(signatureB64, "base64url"));
+	} catch {
+		return null;
+	}
+	if (!valid) return null;
 	const payload = parsePayload(parsed);
 	if (payload === null) return null;
 	if (payload.exp <= nowMs) return null;
@@ -287,96 +265,7 @@ function parseAgentDashboardOrigins(stored) {
 	}
 	return out;
 }
-function sign$1(secretHash, payloadB64) {
-	return createHmac("sha256", Buffer.from(secretHash, "utf8")).update(`${AGENT_UI_UNLOCK_DOMAIN}|${payloadB64}`, "utf8").digest("base64url");
-}
-function sigsEqual(expected, presented) {
-	const a = Buffer.from(expected, "utf8");
-	const b = Buffer.from(presented, "utf8");
-	if (a.length !== b.length) return false;
-	return timingSafeEqual(a, b);
-}
 function parsePayload(value) {
-	if (typeof value !== "object" || value === null) return null;
-	const rec = value;
-	if (rec["v"] !== 1) return null;
-	const nodeId = rec["nodeId"];
-	const exp = rec["exp"];
-	const jti = rec["jti"];
-	if (typeof nodeId !== "string" || nodeId.length === 0) return null;
-	if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
-	if (typeof jti !== "string" || jti.length === 0) return null;
-	const iat = rec["iat"];
-	return {
-		v: 1,
-		nodeId,
-		iat: typeof iat === "number" && Number.isFinite(iat) ? iat : exp - AGENT_UI_UNLOCK_TTL_MS,
-		exp,
-		jti
-	};
-}
-function b64urlJsonEs256(value) {
-	return Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
-}
-function mintAgentUiUnlockTicketEs256(input) {
-	const nowMs = input.nowMs ?? Date.now();
-	const ttl = Math.min(Math.max(1e3, input.ttlMs ?? 3e5), AGENT_UI_UNLOCK_TTL_MS);
-	const payload = {
-		v: 1,
-		use: AGENT_UI_UNLOCK_USE,
-		nodeId: input.nodeId,
-		iat: nowMs,
-		exp: nowMs + ttl,
-		jti: input.jti ?? randomBytes(16).toString("base64url")
-	};
-	const signingInput = `${b64urlJsonEs256({
-		alg: "ES256",
-		typ: AGENT_UI_UNLOCK_TYP
-	})}.${b64urlJsonEs256(payload)}`;
-	return `${signingInput}.${sign("sha256", Buffer.from(signingInput, "utf8"), {
-		key: createPrivateKey(input.caKeyPem),
-		dsaEncoding: "ieee-p1363"
-	}).toString("base64url")}`;
-}
-/**
-* Verify a ticket against the mesh CA certificate the agent pinned. Returns the
-* payload, or `null` when the signature, header, shape, expiry or nodeId fails
-* (no reason string — refuse quietly).
-*/
-function verifyAgentUiUnlockTicketEs256(caCertPem, ticket, options) {
-	const nowMs = options.nowMs ?? Date.now();
-	const parts = ticket.split(".");
-	if (parts.length !== 3) return null;
-	const [headerB64, payloadB64, signatureB64] = parts;
-	if (headerB64 === void 0 || payloadB64 === void 0 || signatureB64 === void 0) return null;
-	let header;
-	let parsed;
-	try {
-		header = JSON.parse(Buffer.from(headerB64, "base64url").toString("utf8"));
-		parsed = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
-	} catch {
-		return null;
-	}
-	if (typeof header !== "object" || header === null) return null;
-	if (Reflect.get(header, "alg") !== "ES256" || Reflect.get(header, "typ") !== "camstack-agent-ui-unlock+jwt") return null;
-	let valid = false;
-	try {
-		valid = verify("sha256", Buffer.from(`${headerB64}.${payloadB64}`, "utf8"), {
-			key: new X509Certificate(caCertPem).publicKey,
-			dsaEncoding: "ieee-p1363"
-		}, Buffer.from(signatureB64, "base64url"));
-	} catch {
-		return null;
-	}
-	if (!valid) return null;
-	const payload = parsePayloadEs256(parsed);
-	if (payload === null) return null;
-	if (payload.exp <= nowMs) return null;
-	if (payload.nodeId !== options.expectedNodeId) return null;
-	if (!issuedSanely(payload, nowMs, options.notBeforeMs)) return null;
-	return payload;
-}
-function parsePayloadEs256(value) {
 	if (typeof value !== "object" || value === null) return null;
 	const rec = value;
 	if (rec["v"] !== 1) return null;
@@ -384,10 +273,10 @@ function parsePayloadEs256(value) {
 	const nodeId = rec["nodeId"];
 	const exp = rec["exp"];
 	const jti = rec["jti"];
+	const iat = rec["iat"];
 	if (typeof nodeId !== "string" || nodeId.length === 0) return null;
 	if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
 	if (typeof jti !== "string" || jti.length === 0) return null;
-	const iat = rec["iat"];
 	if (typeof iat !== "number" || !Number.isFinite(iat)) return null;
 	return {
 		v: 1,
@@ -403,7 +292,7 @@ function parsePayloadEs256(value) {
 * Hub mesh CA — EC P-256, key in the keychain, cert in `cluster.meshCa`.
 *
 * Distinct from the HTTPS local CA (`tls/cert-issue.ts`, RSA): the mesh CA
-* signs node leaves (CN = nodeID) and join-token JWS (ES256). Issuance uses
+* signs node leaves (CN = nodeID) and unlock-ticket JWS (ES256). Issuance uses
 * `@peculiar/x509` over WebCrypto — same library the HTTPS path already uses
 * (installed `1.14.3`; registry latest at adoption time was `2.1.0` — stay on
 * the pinned range already shipping).
@@ -444,7 +333,7 @@ async function exportKeyPem(key) {
 function caFingerprint(certPem) {
 	return new X509Certificate(certPem).fingerprint256;
 }
-/** Compact fingerprint (lowercase hex, no colons) for join-token payloads. */
+/** Compact fingerprint (lowercase hex, no colons). */
 function caFingerprintCompact(certPem) {
 	return createHash("sha256").update(new X509Certificate(certPem).raw).digest("hex");
 }
@@ -1210,7 +1099,7 @@ function defaultSetTimer(fn, ms) {
 function defaultSleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function message$1(error) {
+function message(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 async function renewMeshCertificate(deps) {
@@ -1276,7 +1165,7 @@ async function runRenewal(deps, inFlight) {
 		csrPem = (await deps.client.prepareMeshRenewal()).csrPem;
 		log.info("Mesh renewal: the node generated a new key and sent its CSR", { tags });
 	} catch (error) {
-		return fail("prepare", message$1(error), true);
+		return fail("prepare", message(error), true);
 	}
 	let issued;
 	try {
@@ -1290,7 +1179,7 @@ async function runRenewal(deps, inFlight) {
 			}
 		});
 	} catch (error) {
-		return fail("issue", message$1(error), true);
+		return fail("issue", message(error), true);
 	}
 	const newLeaf = describeMeshLeaf(issued.certPem);
 	deps.registry.beginRenewal(newLeaf.fingerprint);
@@ -1330,7 +1219,7 @@ async function runRenewal(deps, inFlight) {
 		deadlineTimer.cancel();
 		await deps.client.rollbackMeshLeaf().catch(() => void 0);
 		await deps.registry.abandon(newLeaf.fingerprint);
-		return fail("install", message$1(error), true);
+		return fail("install", message(error), true);
 	}
 	const deadline = now() + timeoutMs;
 	const registered = await registeredPromise;
@@ -1359,7 +1248,7 @@ async function runRenewal(deps, inFlight) {
 			}
 			confirmError = "the node did not confirm the new leaf";
 		} catch (error) {
-			confirmError = message$1(error);
+			confirmError = message(error);
 			log.warn("Mesh renewal: confirm not accepted yet", {
 				tags,
 				meta: { error: confirmError }
@@ -1393,7 +1282,7 @@ async function runRenewal(deps, inFlight) {
 }
 /**
 * Revoke every live mesh leaf of `nodeId` and cut its connection. The node cannot
-* reconnect: it must re-join with a new join token. The node is NOT forgotten
+* reconnect: it must be paired again. The node is NOT forgotten
 * (that stays `clusterNodes.forgetNode`).
 */
 async function revokeMeshCertificate(deps) {
@@ -1420,7 +1309,7 @@ async function revokeMeshCertificate(deps) {
 		nodeId,
 		revokedSerials: serials,
 		disconnected,
-		next: "The node can no longer connect. Re-join it with a new join token (System -> Cluster -> Add agent); to remove it from the cluster use Forget node."
+		next: "The node can no longer connect. Pair it again from the hub (System -> Cluster -> Agents); to remove it from the cluster use Forget node."
 	};
 }
 //#endregion
@@ -1481,872 +1370,6 @@ function emitProcessNodeRegistered(nodeId, addonIds) {
 	} catch {}
 }
 //#endregion
-//#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
-var encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder("utf-8", { fatal: !0 });
-function concat(...buffers) {
-	const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
-	let i = 0;
-	for (const buffer of buffers) buf.set(buffer, i), i += buffer.length;
-	return buf;
-}
-var NON_ASCII = /[^\x00-\x7f]/;
-function encode$1(string) {
-	if (typeof string == "string" && string.length >= 128) {
-		if (NON_ASCII.test(string)) throw new TypeError("non-ASCII string encountered in encode()");
-		return encoder.encode(string);
-	}
-	const bytes = new Uint8Array(string.length);
-	for (let i = 0; i < string.length; i++) {
-		const code = string.charCodeAt(i);
-		if (code > 127) throw new TypeError("non-ASCII string encountered in encode()");
-		bytes[i] = code;
-	}
-	return bytes;
-}
-function encodeBase64(input, url = !1) {
-	if (Uint8Array.prototype.toBase64) return input.toBase64({
-		alphabet: url ? "base64url" : "base64",
-		omitPadding: url
-	});
-	const CHUNK_SIZE = 32768, arr = [];
-	for (let i = 0; i < input.length; i += CHUNK_SIZE) arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
-	const encoded = btoa(arr.join(""));
-	return url ? encoded.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : encoded;
-}
-function decodeBase64(encoded, url = !1) {
-	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(encoded, { alphabet: url ? "base64url" : "base64" });
-	if (url) {
-		if (encoded.includes("+") || encoded.includes("/")) throw new TypeError("Invalid base64url");
-		encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
-	}
-	const binary = atob(encoded), bytes = new Uint8Array(binary.length);
-	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-	return bytes;
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/util/errors.js
-var JOSEError = class extends Error {
-	static code = "ERR_JOSE_GENERIC";
-	code = "ERR_JOSE_GENERIC";
-	constructor(message, options) {
-		super(message, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
-	}
-};
-var JWTClaimValidationFailed = class extends JOSEError {
-	static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
-	code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
-	claim;
-	reason;
-	payload;
-	constructor(message, payload, claim = "unspecified", reason = "unspecified") {
-		super(message, { cause: {
-			claim,
-			reason,
-			payload
-		} }), this.claim = claim, this.reason = reason, this.payload = payload;
-	}
-};
-var JWTExpired = class extends JOSEError {
-	static code = "ERR_JWT_EXPIRED";
-	code = "ERR_JWT_EXPIRED";
-	claim;
-	reason;
-	payload;
-	constructor(message, payload, claim = "unspecified", reason = "unspecified") {
-		super(message, { cause: {
-			claim,
-			reason,
-			payload
-		} }), this.claim = claim, this.reason = reason, this.payload = payload;
-	}
-};
-var JOSEAlgNotAllowed = class extends JOSEError {
-	static code = "ERR_JOSE_ALG_NOT_ALLOWED";
-	code = "ERR_JOSE_ALG_NOT_ALLOWED";
-};
-var JOSENotSupported = class extends JOSEError {
-	static code = "ERR_JOSE_NOT_SUPPORTED";
-	code = "ERR_JOSE_NOT_SUPPORTED";
-};
-var JWSInvalid = class extends JOSEError {
-	static code = "ERR_JWS_INVALID";
-	code = "ERR_JWS_INVALID";
-};
-var JWTInvalid = class extends JOSEError {
-	static code = "ERR_JWT_INVALID";
-	code = "ERR_JWT_INVALID";
-};
-var JWSSignatureVerificationFailed = class extends JOSEError {
-	static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
-	code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
-	constructor(message = "signature verification failed", options) {
-		super(message, options);
-	}
-};
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/util/base64url.js
-var invalid = "The input to be decoded is not correctly encoded.";
-function decode(input) {
-	try {
-		return decodeBase64(typeof input == "string" ? input : decoder.decode(input), !0);
-	} catch (cause) {
-		throw new TypeError(invalid, { cause });
-	}
-}
-function encode(input) {
-	return encodeBase64(typeof input == "string" ? encoder.encode(input) : input, !0);
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/lib/validate.js
-function isObject$1(input) {
-	if (typeof input != "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]") return !1;
-	const prototype = Object.getPrototypeOf(input);
-	return prototype === null || Object.getPrototypeOf(prototype) === null;
-}
-function isDisjoint(...headers) {
-	const parameters = /* @__PURE__ */ new Set();
-	for (const header of headers) if (header) for (const parameter of Object.keys(header)) {
-		if (parameters.has(parameter)) return !1;
-		parameters.add(parameter);
-	}
-	return !0;
-}
-function assertNotSet(value, name) {
-	if (value !== void 0) throw new TypeError(`${name} can only be called once`);
-}
-function decodeBase64url(value, label, ErrorClass) {
-	try {
-		return decode(value);
-	} catch {
-		throw new ErrorClass(`Failed to base64url decode the ${label}`);
-	}
-}
-function encodeBase64url(value, label, ErrorClass) {
-	try {
-		return encode$1(value);
-	} catch {
-		throw new ErrorClass(`The ${label} is not a valid base64url string`);
-	}
-}
-function parseJoseHeader(b64, ErrorClass, message) {
-	let parsed;
-	try {
-		parsed = JSON.parse(strictDecoder.decode(decode(b64)));
-	} catch {
-		throw new ErrorClass(message);
-	}
-	if (!isObject$1(parsed)) throw new ErrorClass(message);
-	return parsed;
-}
-var JWS_RECOGNIZED = {
-	__proto__: null,
-	b64: !0
-};
-function validateAlgorithms(option, algorithms) {
-	if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != "string"))) throw new TypeError(`"${option}" option must be an array of strings`);
-	return algorithms === void 0 ? void 0 : new Set(algorithms);
-}
-function validateCritDuplicates(Err, protectedHeader) {
-	const { crit } = protectedHeader ?? {};
-	if (Array.isArray(crit) && new Set(crit).size !== crit.length) throw new Err("\"crit\" (Critical) Header Parameter MUST NOT contain duplicate values");
-}
-function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
-	if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) throw new Err("\"crit\" (Critical) Header Parameter MUST be integrity protected");
-	if (!protectedHeader || protectedHeader.crit === void 0) return [];
-	if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != "string" || input.length === 0)) throw new Err("\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present");
-	const recognized = recognizedOption === void 0 ? recognizedDefault : {
-		__proto__: null,
-		...recognizedOption,
-		...recognizedDefault
-	};
-	for (const parameter of protectedHeader.crit) {
-		if (!(parameter in recognized)) throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
-		if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0) throw new Err(`Extension Header Parameter "${parameter}" is missing`);
-		if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0)) throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
-	}
-	return protectedHeader.crit;
-}
-function validateB64(protectedHeader, extensions) {
-	if (extensions.includes("b64")) {
-		const b64 = protectedHeader.b64;
-		if (typeof b64 != "boolean") throw new JWSInvalid("The \"b64\" (base64url-encode payload) Header Parameter must be a boolean");
-		return b64;
-	}
-	return !0;
-}
-function serializeJoseHeader(Err, header) {
-	let serialized, parsed;
-	try {
-		serialized = JSON.stringify(header), parsed = JSON.parse(serialized);
-	} catch (cause) {
-		throw new Err("JOSE Header is not valid JSON", { cause });
-	}
-	if (!isObject$1(parsed)) throw new Err("JOSE Header is not a JSON object");
-	return [parsed, serialized];
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/lib/key.js
-var tag = (key) => key[Symbol.toStringTag], jwkMatchesOp = (entry, key, usage) => {
-	const { alg } = entry;
-	if (key.use !== void 0) {
-		const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
-		if (key.use !== expected) throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
-	}
-	if (key.alg !== void 0 && key.alg !== alg) throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
-	if (Array.isArray(key.key_ops)) {
-		const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
-		if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp)) throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
-	}
-};
-async function prepareKey(entry, key, usage) {
-	const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
-	if (secret && key instanceof Uint8Array) return key;
-	let normalized, keyObject;
-	if (isObject$1(key)) {
-		if (normalized = normalizeJwk(key), typeof normalized.kty != "string") throw invalidKeyType(alg, key, secret);
-		if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0))) throw new TypeError(secret ? "JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present" : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
-		if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct") return decode(normalized.k);
-		if (!Object.isFrozen(key)) {
-			const { key_ops } = key;
-			Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
-		}
-	} else {
-		if (!isKeyLike(key)) throw invalidKeyType(alg, key, secret);
-		const expectedType = secret ? "secret" : privateKey ? "private" : "public";
-		if (key.type !== expectedType && (secret || [
-			"secret",
-			"public",
-			"private"
-		].includes(key.type))) throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
-		if (isCryptoKey(key)) return key;
-		if (keyObject = key, keyObject.type === "secret") return keyObject.export();
-	}
-	cache ||= /* @__PURE__ */ new WeakMap();
-	const cacheKey = key;
-	let cached = cache.get(cacheKey);
-	if (cached?.[alg]) return cached[alg];
-	if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
-		const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({
-			crv,
-			asymmetricKeyType: keyObject.asymmetricKeyType
-		}) ?? entry.subtle;
-		return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
-	}
-	return normalized ??= keyObject.export({ format: "jwk" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);
-}
-var cache;
-var nist = {
-	__proto__: null,
-	prime256v1: "P-256",
-	secp384r1: "P-384",
-	secp521r1: "P-521"
-};
-var isCryptoKey = (key) => {
-	if (key?.[Symbol.toStringTag] === "CryptoKey") return !0;
-	try {
-		return key instanceof CryptoKey;
-	} catch {
-		return !1;
-	}
-}, isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject", isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
-function message(msg, actual, ...types) {
-	if (types.length > 2) {
-		const last = types.pop();
-		msg += `one of type ${types.join(", ")}, or ${last}.`;
-	} else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
-	return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
-}
-function invalidKeyType(alg, actual, secret) {
-	const types = [
-		"CryptoKey",
-		"KeyObject",
-		"JSON Web Key"
-	];
-	return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
-}
-var unusable = (name, prop = "algorithm.name") => /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-function checkUsage(key, usage) {
-	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-}
-function checkModulusLength(alg, key) {
-	const { modulusLength } = key.algorithm;
-	if (typeof modulusLength != "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
-}
-function checkCryptoKey(key, expected, usage) {
-	const algorithm = key.algorithm;
-	if (algorithm.name !== expected.name) throw unusable(expected.name);
-	if (expected.hash && algorithm.hash?.name !== expected.hash) throw unusable(expected.hash, "algorithm.hash");
-	if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve) throw unusable(expected.namedCurve, "algorithm.namedCurve");
-	if (expected.length !== void 0 && algorithm.length !== expected.length) throw unusable(expected.length, "algorithm.length");
-	checkUsage(key, usage);
-}
-function snapshotJwk(jwk) {
-	return {
-		__proto__: null,
-		...jwk
-	};
-}
-function normalizeJwk(jwk) {
-	const normalized = snapshotJwk(jwk);
-	if (normalized.ext !== void 0 && typeof normalized.ext != "boolean") throw new TypeError("\"ext\" (Extractable) Parameter must be a boolean");
-	if (normalized.key_ops !== void 0) {
-		const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
-		if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length) throw new TypeError("\"key_ops\" (Key Operations) Parameter must be an array of unique strings");
-		normalized.key_ops = keyOps;
-	}
-	return normalized;
-}
-async function jwkToKey(entry, jwk, extractable) {
-	if (!entry.kty.includes(jwk.kty)) throw new JOSENotSupported("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
-	const algorithm = entry.resolve?.({
-		kty: jwk.kty,
-		crv: jwk.crv
-	}) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = {
-		...jwk,
-		ext: extractable ?? jwk.ext
-	};
-	return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
-}
-async function rawKey(key, expected, usage, extractable = !1) {
-	return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/lib/key_descriptor.js
-function table(entries) {
-	const out = { __proto__: null };
-	for (const alg in entries) out[alg] = {
-		...entries[alg],
-		alg
-	};
-	return out;
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/lib/jws_algorithms.js
-var sig = [["verify"], ["sign"]];
-function hmac(bits) {
-	const subtle = {
-		name: "HMAC",
-		hash: `SHA-${bits}`
-	};
-	return {
-		kty: ["oct"],
-		secret: !0,
-		subtle,
-		signing: subtle,
-		usages: sig
-	};
-}
-function rsa(bits, saltLength) {
-	const subtle = {
-		name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
-		hash: `SHA-${bits}`
-	};
-	return {
-		kty: ["RSA"],
-		subtle,
-		signing: saltLength ? {
-			...subtle,
-			saltLength
-		} : subtle,
-		usages: sig,
-		minRsaBits: 2048
-	};
-}
-function ecdsa(crv, bits) {
-	return {
-		kty: ["EC"],
-		crv,
-		subtle: {
-			name: "ECDSA",
-			namedCurve: crv
-		},
-		signing: {
-			name: "ECDSA",
-			hash: `SHA-${bits}`
-		},
-		usages: sig
-	};
-}
-function eddsa() {
-	const subtle = { name: "Ed25519" };
-	return {
-		kty: ["OKP"],
-		crv: "Ed25519",
-		subtle,
-		signing: subtle,
-		usages: sig
-	};
-}
-function mldsa(bits) {
-	const subtle = { name: `ML-DSA-${bits}` };
-	return {
-		kty: ["AKP"],
-		subtle,
-		signing: subtle,
-		usages: sig
-	};
-}
-var JWS = table({
-	HS256: hmac(256),
-	HS384: hmac(384),
-	HS512: hmac(512),
-	RS256: rsa(256),
-	RS384: rsa(384),
-	RS512: rsa(512),
-	PS256: rsa(256, 32),
-	PS384: rsa(384, 48),
-	PS512: rsa(512, 64),
-	ES256: ecdsa("P-256", 256),
-	ES384: ecdsa("P-384", 384),
-	ES512: ecdsa("P-521", 512),
-	EdDSA: eddsa(),
-	Ed25519: eddsa(),
-	"ML-DSA-44": mldsa(44),
-	"ML-DSA-65": mldsa(65),
-	"ML-DSA-87": mldsa(87)
-});
-function jwsAlgorithm(alg) {
-	const entry = typeof alg == "string" ? JWS[alg] : void 0;
-	if (!entry) throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-	return entry;
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/lib/jws_verify.js
-function prepareVerify(options) {
-	return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
-}
-function parseProtectedHeader(encodedProtected) {
-	return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
-}
-function encodeCompactUnencodedPayload(payload) {
-	try {
-		return encode$1(payload);
-	} catch {
-		throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
-	}
-}
-async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
-	const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
-	if (!isDisjoint(parsedProt, header)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-	const joseHeader = {
-		...parsedProt,
-		...header
-	}, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
-	if (typeof alg != "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
-	if (shared[0] && !shared[0].has(alg)) throw new JOSEAlgNotAllowed("\"alg\" (Algorithm) Header Parameter value not allowed");
-	if (b64) {
-		if (typeof inputPayload != "string") throw new JWSInvalid("JWS Payload must be a string");
-	} else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array)) throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
-	const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
-	let resolvedKey = !1;
-	typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = !0);
-	const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode$1(encodedProtected) : new Uint8Array(), encode$1("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
-	entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
-	let verified = !1;
-	try {
-		verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
-	} catch {}
-	if (!verified) throw new JWSSignatureVerificationFailed();
-	const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
-	return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{
-		...result,
-		key: k
-	}, b64] : [result, b64];
-}
-async function verifyCompact(jws, shared, key) {
-	if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != "string") throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
-	const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
-	if (length !== 3) throw new JWSInvalid("Invalid Compact JWS");
-	return verifySignature({
-		payload,
-		protected: protectedHeader,
-		signature
-	}, shared, key, encodeCompactUnencodedPayload);
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/lib/jwt_claims_set.js
-var epoch = (date) => Math.floor(date.getTime() / 1e3), multipliers = {
-	s: 1,
-	m: 60,
-	h: 3600,
-	d: 86400,
-	w: 604800,
-	y: 31557600
-}, REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i, checkFailed = "check_failed";
-function invalidDuration() {
-	throw new TypeError("Invalid time period format");
-}
-function secs(str) {
-	typeof str != "string" && invalidDuration();
-	const matched = REGEX.exec(str);
-	(!matched || matched[4] && matched[1]) && invalidDuration();
-	const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
-	return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
-}
-function validateInput(label, input) {
-	if (!Number.isFinite(input)) throw new TypeError(`Invalid ${label} input`);
-	return input;
-}
-function validateStringClaim(claim, value) {
-	if (typeof value != "string") throw new TypeError(`"${claim}" claim must be a string`);
-}
-function validateAudienceClaim(value) {
-	if (typeof value != "string" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != "string"))) throw new TypeError("\"aud\" claim must be a string or an array of strings");
-}
-function numericDate(value, label) {
-	return typeof value == "number" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date()) + secs(value);
-}
-var normalizeTyp = (value) => {
-	const normalized = value.toLowerCase();
-	return value.includes("/") ? normalized : `application/${normalized}`;
-}, checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : !1;
-function validateNumericDate(payload, claim, required = !1) {
-	const value = payload[claim];
-	if (!(value === void 0 && !required)) {
-		if (typeof value != "number") throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
-		return value;
-	}
-}
-function unexpectedClaim(payload, claim) {
-	throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
-}
-function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
-	let payload;
-	try {
-		payload = JSON.parse(strictDecoder.decode(encodedPayload));
-	} catch {}
-	if (!isObject$1(payload)) throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
-	const { typ } = options;
-	if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) throw new JWTClaimValidationFailed("unexpected \"typ\" JWT header value", payload, "typ", checkFailed);
-	const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
-	maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
-	for (const claim of new Set(presenceCheck.reverse())) if (!Object.hasOwn(payload, claim)) throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
-	issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
-	const { clockTolerance } = options;
-	let tolerance = 0;
-	if (typeof clockTolerance == "string") tolerance = secs(clockTolerance);
-	else if (clockTolerance !== void 0) {
-		if (typeof clockTolerance != "number") throw new TypeError("Invalid clockTolerance option type");
-		tolerance = clockTolerance;
-	}
-	validateInput("clockTolerance option", tolerance);
-	const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
-	if (nbf !== void 0 && nbf > now + tolerance) throw new JWTClaimValidationFailed("\"nbf\" claim timestamp check failed", payload, "nbf", checkFailed);
-	const exp = validateNumericDate(payload, "exp");
-	if (exp !== void 0 && exp <= now - tolerance) throw new JWTExpired("\"exp\" claim timestamp check failed", payload, "exp", checkFailed);
-	if (maxTokenAge !== void 0) {
-		const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
-		if (age - tolerance > max) throw new JWTExpired("\"iat\" claim timestamp check failed (too far in the past)", payload, "iat", checkFailed);
-		if (age < -tolerance) throw new JWTClaimValidationFailed("\"iat\" claim timestamp check failed (it should be in the past)", payload, "iat", checkFailed);
-	}
-	return payload;
-}
-var producerPayloads;
-function producerPayload(producer) {
-	return producerPayloads.get(producer);
-}
-function jwtData(producer) {
-	const payload = producerPayload(producer);
-	for (const claim of [
-		"iat",
-		"nbf",
-		"exp"
-	]) {
-		const value = payload[claim];
-		if (typeof value == "number" && !Number.isFinite(value)) throw new TypeError(`"${claim}" claim must be a finite number`);
-	}
-	return encoder.encode(JSON.stringify(payload));
-}
-var JWTClaimsBuilder = class {
-	constructor(payload = {}) {
-		if (!isObject$1(payload)) throw new TypeError("JWT Claims Set MUST be an object");
-		(producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));
-	}
-	setIssuer(value) {
-		return validateStringClaim("iss", value), producerPayload(this).iss = value, this;
-	}
-	setSubject(value) {
-		return validateStringClaim("sub", value), producerPayload(this).sub = value, this;
-	}
-	setAudience(value) {
-		return validateAudienceClaim(value), producerPayload(this).aud = value, this;
-	}
-	setJti(value) {
-		return validateStringClaim("jti", value), producerPayload(this).jti = value, this;
-	}
-	setNotBefore(value) {
-		return producerPayload(this).nbf = numericDate(value, "setNotBefore"), this;
-	}
-	setExpirationTime(value) {
-		return producerPayload(this).exp = numericDate(value, "setExpirationTime"), this;
-	}
-	setIssuedAt(value) {
-		const payload = producerPayload(this);
-		return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == "string" ? payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, "setIssuedAt"), this;
-	}
-};
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/jwt/verify.js
-async function jwtVerify(jwt, key, options) {
-	const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
-	if (!b64) throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-	const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
-	return {
-		...verified,
-		payload
-	};
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/lib/jws_sign.js
-async function createSignature(input, key, rejectUnencoded) {
-	let [payload, protectedHeader, unprotectedHeader, crit] = input, protectedHeaderString = "";
-	if (protectedHeader !== void 0) {
-		const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
-		protectedHeader = normalized[0], protectedHeaderString = encode(normalized[1]);
-	}
-	if (unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0]), !protectedHeader && !unprotectedHeader) throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
-	if (!isDisjoint(protectedHeader, unprotectedHeader)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-	const joseHeader = {
-		...protectedHeader,
-		...unprotectedHeader
-	};
-	validateCritDuplicates(JWSInvalid, protectedHeader);
-	const b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
-	b64 || rejectUnencoded?.();
-	const { alg } = joseHeader;
-	if (typeof alg != "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
-	const entry = jwsAlgorithm(alg);
-	let payloadS = "", payloadB = payload, data;
-	if (b64) {
-		const encoded = input[4];
-		encoded ? (payloadS = encoded[0] ??= encode(payload), payloadB = encoded[1] ??= encode$1(payloadS)) : (payloadS = encode(payload), data = encoder.encode(`${protectedHeaderString}.${payloadS}`));
-	}
-	data ??= concat(encode$1(protectedHeaderString), encode$1("."), payloadB);
-	const k = await rawKey(await prepareKey(entry, key, "sign"), entry.subtle, "sign");
-	entry.minRsaBits && checkModulusLength(entry.alg, k);
-	const jws = {
-		signature: encode(new Uint8Array(await crypto.subtle.sign(entry.signing, k, data))),
-		payload: payloadS
-	};
-	return protectedHeader && (jws.protected = protectedHeaderString), unprotectedHeader && (jws.header = unprotectedHeader), [jws, b64];
-}
-async function createCompactSignature(payload, protectedHeader, crit, key, rejectUnencoded) {
-	const [jws] = await createSignature([
-		payload,
-		protectedHeader,
-		void 0,
-		crit
-	], key, rejectUnencoded);
-	return `${jws.protected}.${jws.payload}.${jws.signature}`;
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/jwt/sign.js
-var SignJWT_base = JWTClaimsBuilder;
-var SignJWT = class extends SignJWT_base {
-	#protectedHeader;
-	setProtectedHeader(protectedHeader) {
-		return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
-	}
-	async sign(key, options) {
-		return createCompactSignature(jwtData(this), this.#protectedHeader, options?.crit, key, () => {
-			throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-		});
-	}
-};
-//#endregion
-//#region src/kernel/moleculer/mesh-mtls/mesh-join-token.ts
-/**
-* Mesh join tokens — single-use JWS ES256 signed with the hub mesh CA key.
-*
-* Payload: `{ v, hubUrl, hubMeshAddress, caFingerprint, nodeId, jti, exp }`. The node id is MANDATORY
-* (D857): a token that does not name the node it is for would let its holder pick any id, `hub` included.
-* `exp` ≤ now + 1 h. `jti` is recorded until expiry so a token cannot be reused.
-*/
-/** In-memory + optional persist of spent `jti` until `exp`. */
-var JoinTokenJtiStore = class {
-	spent = /* @__PURE__ */ new Map();
-	/** True when `jti` was already consumed (and not yet expired). */
-	isSpent(jti, nowSec = Math.floor(Date.now() / 1e3)) {
-		this.gc(nowSec);
-		return this.spent.has(jti);
-	}
-	/** Record a jti as used until `exp`. Returns false if already spent. */
-	consume(jti, exp, nowSec = Math.floor(Date.now() / 1e3)) {
-		this.gc(nowSec);
-		if (this.spent.has(jti)) return false;
-		this.spent.set(jti, exp);
-		return true;
-	}
-	/** Test helper. */
-	size() {
-		return this.spent.size;
-	}
-	gc(nowSec) {
-		for (const [jti, exp] of this.spent) if (exp <= nowSec) this.spent.delete(jti);
-	}
-};
-var processJtiStore = new JoinTokenJtiStore();
-function processJoinTokenJtiStore() {
-	return processJtiStore;
-}
-async function mintMeshJoinToken(input) {
-	if (!isValidAgentNodeId(input.nodeId)) throw new Error(`a join token needs the node id it is for; "${input.nodeId}" is not one an agent may carry`);
-	const now = input.now ?? /* @__PURE__ */ new Date();
-	const nowSec = Math.floor(now.getTime() / 1e3);
-	const exp = nowSec + Math.min(Math.max(1, input.ttlSec ?? 3600), MESH_JOIN_TOKEN_MAX_TTL_SEC);
-	const jti = input.jti ?? randomBytes(16).toString("base64url");
-	return new SignJWT({
-		v: 1,
-		hubUrl: input.hubUrl,
-		hubMeshAddress: input.hubMeshAddress,
-		caFingerprint: caFingerprintCompact(input.ca.certPem),
-		nodeId: input.nodeId,
-		jti,
-		exp
-	}).setProtectedHeader({
-		alg: "ES256",
-		typ: "JWT"
-	}).setIssuedAt(nowSec).setExpirationTime(exp).setJti(jti).sign(input.ca.privateKey);
-}
-async function verifyMeshJoinToken(input) {
-	const now = input.now ?? /* @__PURE__ */ new Date();
-	const nowSec = Math.floor(now.getTime() / 1e3);
-	let payload;
-	try {
-		payload = (await jwtVerify(input.token, input.ca.publicKey, {
-			algorithms: ["ES256"],
-			currentDate: now
-		})).payload;
-	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
-		if (/exp/i.test(msg) || /timestamp/i.test(msg)) return {
-			ok: false,
-			reason: "token expired"
-		};
-		return {
-			ok: false,
-			reason: `token signature invalid: ${msg}`
-		};
-	}
-	const claims = parseClaims$1(payload);
-	if (claims === null) return {
-		ok: false,
-		reason: "token claims malformed"
-	};
-	if (claims.exp <= nowSec) return {
-		ok: false,
-		reason: "token expired"
-	};
-	const expectedFp = caFingerprintCompact(input.ca.certPem);
-	if (claims.caFingerprint !== expectedFp) return {
-		ok: false,
-		reason: "token caFingerprint does not match this hub CA"
-	};
-	if (input.expectedCaFingerprint !== void 0 && claims.caFingerprint !== normalizeFp(input.expectedCaFingerprint)) return {
-		ok: false,
-		reason: "token caFingerprint pin mismatch"
-	};
-	const store = input.jtiStore ?? processJtiStore;
-	if (input.consume !== false) {
-		if (!store.consume(claims.jti, claims.exp, nowSec)) return {
-			ok: false,
-			reason: "token already used"
-		};
-	} else if (store.isSpent(claims.jti, nowSec)) return {
-		ok: false,
-		reason: "token already used"
-	};
-	return {
-		ok: true,
-		claims
-	};
-}
-function normalizeFp(fp) {
-	return fp.replace(/:/g, "").toLowerCase();
-}
-function parseClaims$1(payload) {
-	if (payload["v"] !== 1) return null;
-	const hubUrl = payload["hubUrl"];
-	const hubMeshAddress = payload["hubMeshAddress"];
-	const caFingerprint = payload["caFingerprint"];
-	const jti = typeof payload.jti === "string" ? payload.jti : payload["jti"];
-	const exp = typeof payload.exp === "number" ? payload.exp : null;
-	if (typeof hubUrl !== "string" || hubUrl.length === 0) return null;
-	if (typeof hubMeshAddress !== "string" || hubMeshAddress.length === 0) return null;
-	if (typeof caFingerprint !== "string" || caFingerprint.length === 0) return null;
-	if (typeof jti !== "string" || jti.length === 0) return null;
-	if (exp === null) return null;
-	const nodeId = payload["nodeId"];
-	if (typeof nodeId !== "string" || !isValidAgentNodeId(nodeId)) return null;
-	return {
-		v: 1,
-		hubUrl,
-		hubMeshAddress,
-		caFingerprint: normalizeFp(caFingerprint),
-		nodeId,
-		jti,
-		exp
-	};
-}
-//#endregion
-//#region src/kernel/moleculer/mesh-mtls/mesh-enroll.ts
-/**
-* `POST /api/mesh/enroll` — verify join token, issue a 30-day leaf from CSR.
-*/
-async function enrollMeshNode(body, deps) {
-	if (typeof body.token !== "string" || body.token.length === 0) return {
-		ok: false,
-		error: "token is required",
-		status: 400
-	};
-	if (typeof body.csr !== "string" || !body.csr.includes("BEGIN CERTIFICATE REQUEST")) return {
-		ok: false,
-		error: "csr PEM is required",
-		status: 400
-	};
-	const verified = await verifyMeshJoinToken({
-		token: body.token,
-		ca: deps.ca,
-		jtiStore: deps.jtiStore ?? processJoinTokenJtiStore(),
-		now: deps.now,
-		consume: true
-	});
-	if (!verified.ok) {
-		const status = verified.reason.includes("expired") ? 401 : verified.reason.includes("already used") ? 409 : 401;
-		return {
-			ok: false,
-			error: verified.reason,
-			status
-		};
-	}
-	let leaf;
-	try {
-		leaf = await issueMeshLeafFromCsr(deps.ca, body.csr, {
-			expectedNodeId: verified.claims.nodeId,
-			now: deps.now
-		});
-	} catch (err) {
-		return {
-			ok: false,
-			error: err instanceof Error ? err.message : String(err),
-			status: 400
-		};
-	}
-	try {
-		await deps.onIssued?.(leaf.commonName, leaf.certPem);
-	} catch (err) {
-		deps.onRecordFailed?.(leaf.commonName, err);
-	}
-	return {
-		ok: true,
-		cert: leaf.certPem,
-		caCert: deps.ca.certPem,
-		nodeId: leaf.commonName,
-		notAfter: leaf.notAfter.toISOString(),
-		serialNumber: leaf.serialNumber
-	};
-}
-//#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-tls-enabler.ts
 var SLOT = Symbol.for("camstack.mesh.tls-enabler");
 function setProcessMeshTlsEnabler(enabler) {
@@ -27742,7 +26765,7 @@ var require_index_min = /* @__PURE__ */ __commonJSMin(((exports) => {
 var require_shard = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var _ = require_lodash();
 	var BaseStrategy = require_base$7();
-	var crypto$4 = __require("crypto");
+	var crypto$3 = __require("crypto");
 	var { LRUCache } = require_index_min();
 	var { isFunction, randomInt } = require_utils$3();
 	/**
@@ -27848,7 +26871,7 @@ var require_shard = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		* @memberof ShardStrategy
 		*/
 		getHash(key) {
-			const hash = crypto$4.createHash("md5").update(key).digest("hex");
+			const hash = crypto$3.createHash("md5").update(key).digest("hex");
 			const hashNum = parseInt(hash.substring(0, 8), 16);
 			return this.opts.ringSize ? hashNum % this.opts.ringSize : hashNum;
 		}
@@ -49106,7 +48129,7 @@ var require_validators$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#region ../../node_modules/moleculer/src/cachers/base.js
 var require_base$2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var _ = require_lodash();
-	var crypto$3 = __require("crypto");
+	var crypto$2 = __require("crypto");
 	var { METRIC } = require_metrics$1();
 	var { isObject, isFunction, isDate } = require_utils$3();
 	/**
@@ -49370,7 +48393,7 @@ var require_base$2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			const maxParamsLength = this.opts.maxParamsLength;
 			if (!maxParamsLength || maxParamsLength < 44 || key.length <= maxParamsLength) return key;
 			const prefixLength = maxParamsLength - 44;
-			const base64Hash = crypto$3.createHash("sha256").update(key).digest("base64");
+			const base64Hash = crypto$2.createHash("sha256").update(key).digest("base64");
 			if (prefixLength < 1) return base64Hash;
 			return key.substring(0, prefixLength) + base64Hash;
 		}
@@ -76118,7 +75141,7 @@ var require_hot_reload = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/moleculer/src/middlewares/transmit/encryption.js
 var require_encryption = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var crypto$2 = __require("crypto");
+	var crypto$1 = __require("crypto");
 	/**
 	* This is a AES encryption middleware to protect the whole
 	* Moleculer transporter communication with AES.
@@ -76141,14 +75164,14 @@ var require_encryption = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			},
 			transporterSend(next) {
 				return (topic, data, meta) => {
-					const encrypter = iv ? crypto$2.createCipheriv(algorithm, password, iv) : crypto$2.createCipher(algorithm, password);
+					const encrypter = iv ? crypto$1.createCipheriv(algorithm, password, iv) : crypto$1.createCipher(algorithm, password);
 					return next(topic, Buffer.concat([encrypter.update(data), encrypter.final()]), meta);
 				};
 			},
 			transporterReceive(next) {
 				return (cmd, data, s) => {
 					try {
-						const decrypter = iv ? crypto$2.createDecipheriv(algorithm, password, iv) : crypto$2.createDecipher(algorithm, password);
+						const decrypter = iv ? crypto$1.createDecipheriv(algorithm, password, iv) : crypto$1.createDecipher(algorithm, password);
 						return next(cmd, Buffer.concat([decrypter.update(data), decrypter.final()]), s);
 					} catch (err) {
 						logger.error("Received packet decryption error.", err);
@@ -83643,7 +82666,7 @@ var require_main = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var fs$2 = __require("fs");
 	var path$2 = __require("path");
 	var os$2 = __require("os");
-	var crypto$1 = __require("crypto");
+	var crypto = __require("crypto");
 	var TIPS = [
 		"◈ encrypted .env [www.dotenvx.com]",
 		"◈ secrets for agents [www.dotenvx.com]",
@@ -83848,7 +82871,7 @@ var require_main = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		const authTag = ciphertext.subarray(-16);
 		ciphertext = ciphertext.subarray(12, -16);
 		try {
-			const aesgcm = crypto$1.createDecipheriv("aes-256-gcm", key, nonce);
+			const aesgcm = crypto.createDecipheriv("aes-256-gcm", key, nonce);
 			aesgcm.setAuthTag(authTag);
 			return `${aesgcm.update(ciphertext)}${aesgcm.final()}`;
 		} catch (error) {
@@ -88009,6 +87032,11 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 			this.logger.warn("Dropping mesh packet — an enrolled agent accepts TLS from the hub only");
 			return;
 		}
+		const wireSender = peekSender(this, type, message);
+		if (wireSender === null || wireSender === this.nodeID) {
+			this.logger.warn(wireSender === null ? "Dropping mesh packet - it names no sender" : "Dropping mesh packet - it claims this node as its sender");
+			return;
+		}
 		if (socket !== void 0 && isTlsSocket(socket)) {
 			const tlsSock = socket;
 			const identity = tlsSock.meshPeerCn ? {
@@ -88024,9 +87052,8 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 				tlsSock.destroy();
 				return;
 			}
-			const sender = peekSender(this, type, message);
-			if (sender !== null && sender !== identity.cn) {
-				this.logger.warn(`Dropping forged mesh packet — sender=${sender} peerCN=${identity.cn}`);
+			if (wireSender !== identity.cn) {
+				this.logger.warn(`Dropping forged mesh packet — sender=${wireSender} peerCN=${identity.cn}`);
 				return;
 			}
 			tlsSock.meshPeerCn = identity.cn;
@@ -89286,196 +88313,24 @@ var HubPairing = class {
 		};
 	}
 };
-//#endregion
-//#region src/builtins/system-config/cluster-secret-keeper.ts
-/**
-* Keeps the hub's cluster-secret gate in step with System → Cluster (D797,
-* D802).
-*
-* The field is a `password` of `system-config`: its `system-settings` row
-* (`cluster.clusterSecret`) holds a keychain marker, the value lives in the
-* keychain (owner `system`). The gate the mesh join reads:
-*
-*  - no marker            → the secret is MANDATORY (D802): the keeper asks
-*                           its owner to generate one (`generateSecret`), and
-*                           until that succeeds the gate is `off` — no node can
-*                           authenticate (mesh auth is always enforced, D821);
-*  - marker + value       → `on`  — nodes prove the secret;
-*  - marker, no answer    → `unknown` — refused, retryably, and retried here.
-*    A locked keychain or a value lost to a reset NEVER opens the gate, and
-*    never triggers a generation (the operator decides what replaces a value
-*    the keychain lost).
-*
-* It also publishes the mesh mode (`cluster.meshAuth`, `mesh-auth-mode.ts`).
-*/
-/** The field key inside the `cluster` section. */
-var CLUSTER_SECRET_FIELD = "clusterSecret";
-var ClusterSecretKeeper = class {
-	deps;
-	retryTimer = null;
-	unsubscribe = null;
-	stopped = false;
-	last = null;
-	constructor(deps) {
-		this.deps = deps;
-	}
-	async start() {
-		this.unsubscribe = this.deps.secrets?.onChange((ref) => {
-			if (ref === CLUSTER_SECRET_REF) this.reload();
-		}) ?? null;
-		await this.reload();
-	}
-	stop() {
-		this.stopped = true;
-		if (this.retryTimer !== null) clearTimeout(this.retryTimer);
-		this.retryTimer = null;
-		this.unsubscribe?.();
-		this.unsubscribe = null;
-	}
-	/** Re-read the row and the keychain; publish the gate. */
-	async reload() {
-		if (this.stopped) return;
-		let gate = await this.compute();
-		if (gate.kind === "off" && this.deps.generateSecret !== void 0 && !this.stopped) gate = await this.generate();
-		if (this.stopped) return;
-		setProcessClusterSecretGate(gate);
-		this.report(gate);
-		if (gate.kind === "unknown" || gate.kind === "off" && this.deps.generateSecret !== void 0) this.scheduleRetry();
-	}
-	async generate() {
-		try {
-			await this.deps.generateSecret?.();
-		} catch (err) {
-			this.deps.logger.error("The cluster secret is mandatory but could not be generated yet — retrying. Agents cannot authenticate until it exists.", { meta: { error: errText(err) } });
-			return { kind: "off" };
-		}
-		this.deps.logger.info("Generated the cluster secret (none was stored). Reveal it on System → Cluster and enter it in each agent.");
-		return this.compute();
-	}
-	async compute() {
-		let section;
-		try {
-			section = await this.deps.readSection();
-		} catch (err) {
-			return {
-				kind: "unknown",
-				reason: `settings unreadable: ${errText(err)}`
-			};
-		}
-		setProcessMeshAuthMode("enforced");
-		const stored = section[CLUSTER_SECRET_FIELD];
-		if (stored === void 0 || stored === null || stored === "") return { kind: "off" };
-		if (!isSecretMarker(stored)) return {
-			kind: "unknown",
-			reason: "stored inline, not in the keychain — set it again in System → Cluster"
-		};
-		const secrets = this.deps.secrets;
-		if (secrets === null) return {
-			kind: "unknown",
-			reason: "no keychain door in this process"
-		};
-		let entry;
-		try {
-			entry = (await secrets.resolve([CLUSTER_SECRET_REF]))[CLUSTER_SECRET_REF];
-		} catch (err) {
-			return {
-				kind: "unknown",
-				reason: errText(err)
-			};
-		}
-		if (entry === void 0) return {
-			kind: "unknown",
-			reason: "no-answer"
-		};
-		switch (entry.kind) {
-			case "value": return {
-				kind: "on",
-				hash: hashClusterSecret(entry.value)
-			};
-			case "unavailable": return {
-				kind: "unknown",
-				reason: entry.reason
-			};
-			case "missing": return {
-				kind: "unknown",
-				reason: "the stored value is gone — set it again in System → Cluster"
-			};
-			case "forbidden": return {
-				kind: "unknown",
-				reason: "forbidden"
-			};
-		}
-	}
-	report(gate) {
-		const changed = this.last !== gate.kind;
-		this.last = gate.kind;
-		if (gate.kind === "unknown") {
-			this.deps.logger.error("Agents cannot register: a cluster secret is set but cannot be read from the keychain. Registrations are refused until it can (no fallback).", { meta: { reason: gate.reason } });
-			return;
-		}
-		if (changed) this.deps.logger.info(gate.kind === "on" ? "Cluster secret set — agents prove it to join the mesh" : "No cluster secret yet — no node can authenticate to the mesh");
-	}
-	scheduleRetry() {
-		if (this.stopped || this.retryTimer !== null) return;
-		this.retryTimer = setTimeout(() => {
-			this.retryTimer = null;
-			this.reload();
-		}, this.deps.retryMs ?? 3e4);
-		this.retryTimer.unref?.();
-	}
-};
-function errText(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-//#endregion
-//#region src/builtins/system-config/mesh-actions.ts
-/**
-* System → Cluster — mint a single-use mesh join token (Release A) and
-* agent-ui unlock tickets (D821).
-*/
-var mintJoinTokenInputSchema = z.object({
-	/** The node id the token is for - mandatory: the CSR CN must be exactly this. */
-	nodeId: z.string().min(1),
-	/** Override hub HTTPS base (default: local-network publicEndpoint). */
-	hubUrl: z.string().url().optional(),
-	/** Override `host:6443` TLS mesh address carried in the token. */
-	hubMeshAddress: z.string().min(3).optional(),
-	/** Seconds until expiry; capped at 1 h. */
-	ttlSec: z.number().int().positive().max(3600).optional()
-});
-var mintJoinTokenOutputSchema = z.object({
-	token: z.string().min(1),
-	exp: z.number().int(),
-	hubUrl: z.string(),
-	hubMeshAddress: z.string(),
-	caFingerprint: z.string(),
-	nodeId: z.string()
-});
-var mintAgentUiUnlockInputSchema = z.object({
+var systemConfigMeshActions = defineCustomActions({ 
+/** Hub admin → short-lived ticket the agent redeems for a tab session (D821). */
+mintAgentUiUnlockTicket: customAction(z.object({
 	nodeId: z.string().min(1),
 	/**
 	* Preferred agent dashboard base (`http://host:4444`). When set, the
 	* answer includes `dashboardUrl` with `?ticket=` already attached.
 	*/
 	dashboardBaseUrl: z.string().url().optional()
-});
-var mintAgentUiUnlockOutputSchema = z.object({
+}), z.object({
 	ticket: z.string().min(1),
 	exp: z.number().int(),
 	nodeId: z.string().min(1),
 	dashboardUrl: z.string().url().optional()
-});
-var systemConfigMeshActions = defineCustomActions({
-	mintJoinToken: customAction(mintJoinTokenInputSchema, mintJoinTokenOutputSchema, {
-		kind: "mutation",
-		auth: "admin"
-	}),
-	/** Hub admin → short-lived ticket the agent redeems for a tab session (D821). */
-	mintAgentUiUnlockTicket: customAction(mintAgentUiUnlockInputSchema, mintAgentUiUnlockOutputSchema, {
-		kind: "mutation",
-		auth: "admin"
-	})
-});
+}), {
+	kind: "mutation",
+	auth: "admin"
+}) });
 //#endregion
 //#region src/builtins/system-config/system-config.addon.ts
 /** How often superseded and expired mesh certificate rows are reaped. */
@@ -89493,10 +88348,9 @@ var MESH_REAP_MS = 24 * 36e5;
 *   - server     (port, host, dataPath — READ-ONLY, loaded from config.yaml at bootstrap)
 *   - auth       (tokenExpiry = session lifetime, accessTokenExpiry, trustedProxies,
 *                 trustedNetworks)
-*   - cluster    (clusterSecret — a `password` field: the value goes to the
-*                 keychain, owner `system`; the row keeps a marker. Also drawn
-*                 on System → Cluster. D797. MANDATORY and generated at first
-*                 boot; `meshAuth` — transition / enforced. D802)
+*   - cluster    (no operator field remains: the cluster secret and the mesh auth
+*                 mode were removed by D857 — a node's identity is its mesh
+*                 certificate, and agents are paired, not given a secret)
 *
 * Sections NOT exposed (each owned by the addon that implements them):
 *   - logging    → `winston-logging` addon (level + retention)
@@ -89539,12 +88393,13 @@ var KEY_TO_SECTION = {
 	tokenExpiry: "auth",
 	accessTokenExpiry: "auth",
 	trustedProxies: "auth",
-	trustedNetworks: "auth",
-	[CLUSTER_SECRET_FIELD]: "cluster",
-	[MESH_AUTH_MODE_FIELD]: "cluster"
+	trustedNetworks: "auth"
 };
-/** Bytes of a generated cluster secret (D802) — 256 bits, base64url (43 chars). */
-var GENERATED_SECRET_BYTES = 32;
+/**
+* Keys a pre-D857 form may still send. They are dropped with a line, never
+* written: the cluster secret and the mesh auth mode no longer exist.
+*/
+var RETIRED_CLUSTER_KEYS = new Set(["clusterSecret", "meshAuth"]);
 /**
 * Auth keys holding a list of networks (CIDR or single address). A save with
 * an entry that does not parse is REFUSED whole: dropping it would trust less
@@ -89555,7 +88410,6 @@ var CIDR_LIST_KEYS = new Set(["trustedProxies", "trustedNetworks"]);
 var SYSTEM_CONFIG_CLUSTER_SECTION_ID = "system-config-cluster";
 var SystemConfigAddon = class extends BaseAddon {
 	id = "system-config";
-	clusterSecretKeeper = null;
 	meshCaKeeper = null;
 	meshReapTimer = null;
 	meshGateTimers = /* @__PURE__ */ new Set();
@@ -89565,20 +88419,6 @@ var SystemConfigAddon = class extends BaseAddon {
 		super({});
 	}
 	async onInitialize() {
-		this.clusterSecretKeeper = new ClusterSecretKeeper({
-			secrets: this.systemSecrets(),
-			readSection: async () => await this.ctx.settings?.getSection("cluster") ?? {},
-			logger: this.ctx.logger,
-			generateSecret: () => this.generateClusterSecret()
-		});
-		setProcessMeshEnforcer(async (reason) => {
-			await this.writeMeshAuthMode("enforced");
-			this.ctx.logger.info("Mesh authentication is now ENFORCED", { meta: { reason } });
-		});
-		await this.clusterSecretKeeper.start();
-		try {
-			await this.writeMeshAuthMode("enforced");
-		} catch {}
 		this.meshCaKeeper = new MeshCaKeeper({
 			secrets: this.systemSecrets(),
 			readClusterSection: async () => await this.ctx.settings?.getSection("cluster") ?? {},
@@ -89592,14 +88432,10 @@ var SystemConfigAddon = class extends BaseAddon {
 		this.ctx.logger.info("Initialized — exposes yml-backed sections via getGlobalSettings");
 		return {
 			customActions: systemConfigMeshActions,
-			actionHandlers: {
-				mintJoinToken: async (input) => this.mintJoinToken(parseMintJoinTokenInput(input)),
-				mintAgentUiUnlockTicket: async (input) => this.mintAgentUiUnlock(parseMintUnlockInput(input))
-			}
+			actionHandlers: { mintAgentUiUnlockTicket: async (input) => this.mintAgentUiUnlock(parseMintUnlockInput(input)) }
 		};
 	}
 	async onShutdown() {
-		setProcessMeshEnforcer(null);
 		setProcessMeshCertificateRegistry(null);
 		setProcessMeshTlsListenerState(null);
 		setProcessAgentHttpsNames(null);
@@ -89610,8 +88446,6 @@ var SystemConfigAddon = class extends BaseAddon {
 		this.meshGateTimers.clear();
 		this.meshCaKeeper?.stop();
 		this.meshCaKeeper = null;
-		this.clusterSecretKeeper?.stop();
-		this.clusterSecretKeeper = null;
 	}
 	/**
 	* The hub's record of mesh leaves (D856): declared and loaded BEFORE the TLS
@@ -89702,32 +88536,9 @@ var SystemConfigAddon = class extends BaseAddon {
 			onError: (err) => this.ctx.logger.error("Mesh certificate registry failed to load", { meta: { error: err instanceof Error ? err.message : String(err) } })
 		});
 	}
-	async mintJoinToken(input) {
-		const ca = requireProcessMeshCa();
-		const hubUrl = input.hubUrl ?? await this.resolveHubUrl();
-		const hubMeshAddress = input.hubMeshAddress ?? await this.resolveHubMeshAddress();
-		const token = await mintMeshJoinToken({
-			ca,
-			hubUrl,
-			hubMeshAddress,
-			nodeId: input.nodeId,
-			...input.ttlSec !== void 0 ? { ttlSec: input.ttlSec } : {}
-		});
-		return {
-			token,
-			exp: readJwtExp(token),
-			hubUrl,
-			hubMeshAddress,
-			caFingerprint: caFingerprintCompact(ca.certPem),
-			nodeId: input.nodeId
-		};
-	}
 	/** D821 — short-lived ticket for the agent's `:4444` unlock session. */
 	async mintAgentUiUnlock(input) {
-		const secrets = this.systemSecrets();
-		if (secrets === null) throw new Error("system-config: no keychain door — cannot mint an unlock ticket");
-		const entry = (await secrets.resolve([CLUSTER_SECRET_REF]))[CLUSTER_SECRET_REF];
-		if (entry?.kind !== "value") throw new Error("system-config: cluster secret is not available — cannot mint an unlock ticket");
+		const ca = requireProcessMeshCa();
 		if (input.dashboardBaseUrl !== void 0) {
 			const origins = await this.readAgentDashboardOrigins();
 			if (!isAllowedAgentDashboardReturnTo(input.dashboardBaseUrl, origins)) throw new Error("dashboardBaseUrl is not an allowed agent dashboard origin (:4444 or agentDashboardOrigins)");
@@ -89735,10 +88546,10 @@ var SystemConfigAddon = class extends BaseAddon {
 			if (!isKnownAgentAddress(input.dashboardBaseUrl, known, origins)) throw new Error(`dashboardBaseUrl is not an address this hub knows for "${input.nodeId}" - open the agent at its own address`);
 		}
 		const ticket = mintAgentUiUnlockTicket({
-			secretHash: hashClusterSecret(entry.value),
+			caKeyPem: ca.keyPem,
 			nodeId: input.nodeId
 		});
-		const payloadJson = Buffer.from(ticket.split(".")[0] ?? "", "base64url").toString("utf8");
+		const payloadJson = Buffer.from(ticket.split(".")[1] ?? "", "base64url").toString("utf8");
 		const exp = JSON.parse(payloadJson).exp ?? 0;
 		const dashboardUrl = input.dashboardBaseUrl === void 0 ? void 0 : (() => {
 			const u = new URL(input.dashboardBaseUrl);
@@ -89759,24 +88570,6 @@ var SystemConfigAddon = class extends BaseAddon {
 			return [];
 		}
 	}
-	async resolveHubUrl() {
-		try {
-			const book = await this.ctx.api?.localNetwork?.getAddresses?.query({ scheme: "https" });
-			const url = book?.roles?.publicEndpoint?.resolved ?? book?.roles?.internal?.resolved ?? null;
-			if (typeof url === "string" && url.length > 0) return url;
-		} catch {}
-		const host = (await this.ctx.settings?.getSection("server"))?.["host"];
-		const port = (await this.ctx.settings?.getSection("server"))?.["port"];
-		return `https://${typeof host === "string" && host.length > 0 && host !== "0.0.0.0" ? host : "127.0.0.1"}:${typeof port === "number" ? port : Number(port) || 4443}`;
-	}
-	async resolveHubMeshAddress() {
-		try {
-			const base = (await this.ctx.api?.localNetwork?.getAddresses?.query({}))?.roles?.internal?.resolved;
-			if (typeof base === "string" && base.length > 0) return `${new URL(base).hostname}:${DEFAULT_HUB_TLS_TCP_PORT}`;
-		} catch {}
-		const host = (await this.ctx.settings?.getSection("server"))?.["host"];
-		return `${typeof host === "string" && host.length > 0 && host !== "0.0.0.0" ? host : "127.0.0.1"}:${DEFAULT_HUB_TLS_TCP_PORT}`;
-	}
 	/** The keychain handle for owner `system`; `null` where there is no door. */
 	systemSecrets() {
 		const forOwner = this.ctx.secrets?.forOwner ?? null;
@@ -89869,14 +88662,9 @@ var SystemConfigAddon = class extends BaseAddon {
 			{
 				id: SYSTEM_CONFIG_CLUSTER_SECTION_ID,
 				title: SECTION_TITLES["cluster"],
-				description: "Agents joining this hub. Every agent proves the cluster secret when it connects (challenge–response; the secret never crosses the network).",
+				description: "Agents join this hub by pairing (System → Cluster → Agents): the hub signs a certificate for the agent after the operator confirms the same 6-digit code on the hub and in the agent's own page. There is no shared cluster secret.",
 				columns: 1,
-				fields: [{
-					type: "password",
-					key: CLUSTER_SECRET_FIELD,
-					label: "Cluster secret",
-					description: "Reveal and copy into each agent to pair. Saving a new value rotates it for every agent."
-				}]
+				fields: []
 			}
 		] };
 	}
@@ -89899,9 +88687,9 @@ var SystemConfigAddon = class extends BaseAddon {
 	}
 	/**
 	* The admin UI / `addonSettings` cap prefer {@link BaseAddon.updateGlobalSettingsAsOperator}.
-	* That BaseAddon path writes the generic addon store and never reaches
-	* {@link writeClusterSection}. Route the operator write through the same
-	* section-aware path as {@link updateGlobalSettings}.
+	* That BaseAddon path writes the generic addon store and never reaches the
+	* yml sections. Route the operator write through the same section-aware path
+	* as {@link updateGlobalSettings}.
 	*/
 	async updateGlobalSettingsAsOperator(patch, _nodeId) {
 		await this.updateGlobalSettings(patch);
@@ -89918,6 +88706,10 @@ var SystemConfigAddon = class extends BaseAddon {
 				this.ctx.logger.warn("cluster.agentDashboardOrigins is no longer writable from settings — ignoring this patch");
 				continue;
 			}
+			if (RETIRED_CLUSTER_KEYS.has(key)) {
+				this.ctx.logger.warn(`cluster.${key} is retired (D857) — agents are paired by certificate; ignoring this patch`);
+				continue;
+			}
 			const section = KEY_TO_SECTION[key];
 			if (section === void 0) {
 				this.ctx.logger.warn("update ignored unknown key (not mapped to any section)", { meta: { key } });
@@ -89939,10 +88731,6 @@ var SystemConfigAddon = class extends BaseAddon {
 			bucket[key] = value;
 		}
 		for (const [section, sectionPatch] of perSection) {
-			if (section === "cluster") {
-				await this.writeClusterSection(sectionPatch);
-				continue;
-			}
 			await this.ctx.settings.setSection(section, sectionPatch);
 			this.ctx.logger.info("Wrote keys to section", { meta: {
 				section,
@@ -89950,79 +88738,7 @@ var SystemConfigAddon = class extends BaseAddon {
 			} });
 		}
 	}
-	/**
-	* The cluster secret's save path: the value goes to the keychain (owner
-	* `system`), the row gets the marker; `''` / a view keeps. `$secretClear` is
-	* REFUSED: the secret is mandatory (D802). A value the keychain cannot store
-	* is REFUSED — never written inline (D787, P5). Mesh auth mode is always
-	* enforced (D821) — a legacy `meshAuth` in the patch is ignored.
-	*/
-	async writeClusterSection(patch) {
-		const { [MESH_AUTH_MODE_FIELD]: _legacyMode, ...secretPatch } = patch;
-		await this.writeMeshAuthMode("enforced");
-		if (Object.keys(secretPatch).length === 0) return;
-		if (isSecretClear(secretPatch["clusterSecret"])) throw new Error("The cluster secret is mandatory and cannot be cleared — save a new value to rotate it");
-		await this.storeClusterSecret(secretPatch);
-		this.ctx.logger.info("Cluster secret updated");
-		await this.clusterSecretKeeper?.reload();
-	}
-	/** Persist + publish mesh auth mode (always `enforced` after D821). */
-	async writeMeshAuthMode(mode) {
-		await this.ctx.settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: mode });
-		setProcessMeshAuthMode(mode);
-	}
-	/**
-	* First boot, or a keychain reset that cleared the marker (D802): a fresh
-	* random secret, stored like an operator save. Mesh auth stays enforced
-	* (D821) — every agent must present the secret; there is no transition window.
-	*/
-	async generateClusterSecret() {
-		const settings = this.ctx.settings;
-		const secrets = this.systemSecrets();
-		if (!settings || secrets === null) throw new Error("system-config: no keychain door — the cluster secret cannot be generated");
-		const existing = (await secrets.resolve([CLUSTER_SECRET_REF]))[CLUSTER_SECRET_REF];
-		if (existing?.kind === "value") {
-			await settings.setSection("cluster", { [CLUSTER_SECRET_FIELD]: makeSecretMarker(CLUSTER_SECRET_REF) });
-			this.ctx.logger.warn("The cluster secret row was empty but the keychain holds a value — re-adopted it");
-			return;
-		}
-		if (existing?.kind !== "missing") throw new Error(`the keychain cannot answer for the cluster secret (${existing?.kind ?? "no answer"})`);
-		const value = randomBytes(GENERATED_SECRET_BYTES).toString("base64url");
-		await this.storeClusterSecret({ [CLUSTER_SECRET_FIELD]: value });
-		await settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: "enforced" });
-		setProcessMeshAuthMode("enforced");
-	}
-	async storeClusterSecret(patch) {
-		const settings = this.ctx.settings;
-		if (!settings) throw new Error("system-config: ctx.settings not available");
-		const secrets = this.systemSecrets();
-		if (secrets === null) throw new Error("system-config: no keychain door — the cluster secret cannot be stored");
-		const stored = await settings.getSection("cluster");
-		const result = await transformSecretWrite({
-			tree: secretTreeFromSchema(this.buildGlobalSchema()),
-			secrets,
-			patch,
-			stored,
-			operatorWrite: true
-		});
-		if (Object.keys(result.patch).length > 0) await settings.setSection("cluster", result.patch);
-		const { orphaned } = await result.afterWrite();
-		if (orphaned.length > 0) this.ctx.logger.warn("an old cluster secret value could not be deleted from the keychain", { meta: { refs: orphaned } });
-	}
 };
-function parseMintJoinTokenInput(input) {
-	if (input === null || input === void 0 || typeof input !== "object") throw new Error("system-config: mintJoinToken requires { nodeId }");
-	const nodeId = Reflect.get(input, "nodeId");
-	if (typeof nodeId !== "string" || nodeId.length === 0) throw new Error("system-config: mintJoinToken requires { nodeId } - the node the token is for");
-	const out = { nodeId };
-	const hubUrl = Reflect.get(input, "hubUrl");
-	const hubMeshAddress = Reflect.get(input, "hubMeshAddress");
-	const ttlSec = Reflect.get(input, "ttlSec");
-	if (typeof hubUrl === "string") out.hubUrl = hubUrl;
-	if (typeof hubMeshAddress === "string") out.hubMeshAddress = hubMeshAddress;
-	if (typeof ttlSec === "number") out.ttlSec = ttlSec;
-	return out;
-}
 function parseMintUnlockInput(input) {
 	if (input === null || typeof input !== "object") throw new Error("system-config: mintAgentUiUnlockTicket requires { nodeId }");
 	const nodeId = Reflect.get(input, "nodeId");
@@ -90033,15 +88749,5 @@ function parseMintUnlockInput(input) {
 		...typeof dashboardBaseUrl === "string" ? { dashboardBaseUrl } : {}
 	};
 }
-/** Read `exp` from an unencrypted JWT payload (no verify — already minted here). */
-function readJwtExp(token) {
-	const parts = token.split(".");
-	if (parts.length < 2 || parts[1] === void 0) return 0;
-	const json = Buffer.from(parts[1], "base64url").toString("utf8");
-	const payload = JSON.parse(json);
-	if (payload === null || typeof payload !== "object") return 0;
-	const exp = Reflect.get(payload, "exp");
-	return typeof exp === "number" ? exp : 0;
-}
 //#endregion
-export { requireProcessMeshCa as $, dropProcessPeer as A, setProcessMeshAuthStatusSource as At, openMeshTlsWhenRevocationsLoaded as B, Transporters as C, MESH_AUTH_MODE_FIELD as Ct, mintMeshJoinToken as D, parseMeshAuthMode as Dt, JoinTokenJtiStore as E, isMeshAuthMode as Et, onProcessNodeRegistered as F, readCidrSetting as Ft, RENEWAL_ABANDONED as G, MESH_NODE_CERTIFICATES_COLLECTION as H, setProcessMeshPeerTransportLookup as I, setProcessMeshCertificateRegistry as J, describeMeshLeaf as K, renewMeshCertificate as L, getProcessNodeMeshTransport as M, createCidrMatcher as Mt, getProcessPeerLeaf as N, normalizeIp as Nt, processJoinTokenJtiStore as O, requestProcessMeshEnforcement as Ot, isProcessVerifiedMeshPeer as P, parseCidrList as Pt, getProcessMeshCaState as Q, revokeMeshCertificate as R, ServiceBroker as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, verifyAgentUiUnlockTicketEs256 as St, SystemConfigAddon, SystemConfigAddon as default, enrollMeshNode as T, getProcessMeshAuthStatus as Tt, MESH_NODE_CERTIFICATES_COLUMNS as U, setProcessMeshTlsListenerState as V, MeshCertificateRegistry as W, processMeshCrl as X, MeshCrl as Y, MeshCaKeeper as Z, signPairingProof as _, isAllowedAgentDashboardReturnTo as _t, hubHostFromMeshAddress as a, generateMeshKeyPair as at, TlsTcpTransporter as b, parseAgentDashboardOrigins as bt, PAIRING_MAX_SESSIONS as c, issueMeshLeafFromCsr as ct, PAIRING_PROTOCOL as d, AGENT_UI_UNLOCK_DOMAIN as dt, caFingerprint as et, PAIRING_TTL_MS as f, AGENT_UI_UNLOCK_TTL_MS as ft, keyFingerprintShort as g, UnlockTicketJtiStore as gt, describeCsr as h, AGENT_UI_UNLOCK_VERSION as ht, AgentPairing as i, generateMeshCa as it, emitProcessNodeRegistered as j, setProcessMeshEnforcer as jt, verifyMeshJoinToken as k, setProcessMeshAuthMode as kt, PAIRING_PATHS as l, loadMeshCa as lt, computePairingSas as m, AGENT_UI_UNLOCK_USE as mt, HubPairing as n, createMeshCsrPem as nt, PAIRING_CODE_DIGITS as o, isValidAgentNodeId as ot, computePairingCommitment as p, AGENT_UI_UNLOCK_TYP as pt, getProcessMeshCertificateRegistry as q, PairingHttpError as r, exportMeshPrivateKeyPem as rt, PAIRING_MAX_CODE_ATTEMPTS as s, issueMeshLeafForNode as st, systemConfigMeshActions as t, caFingerprintCompact as tt, PAIRING_PIN_DIGITS as u, AGENT_DASHBOARD_ORIGINS_FIELD as ut, verifyPairingProof as v, mintAgentUiUnlockTicket as vt, setProcessMeshTlsEnabler as w, getProcessMeshAuthMode as wt, Errors as x, verifyAgentUiUnlockTicket as xt, MESH_TLS_PORT_HELLO_FIELD as y, mintAgentUiUnlockTicketEs256 as yt, getProcessMeshTlsListenerState as z };
+export { generateMeshKeyPair as $, setProcessMeshPeerTransportLookup as A, describeMeshLeaf as B, setProcessMeshTlsEnabler as C, getProcessPeerLeaf as D, getProcessNodeMeshTransport as E, setProcessMeshTlsListenerState as F, MeshCaKeeper as G, setProcessMeshCertificateRegistry as H, MESH_NODE_CERTIFICATES_COLLECTION as I, caFingerprint as J, getProcessMeshCaState as K, MESH_NODE_CERTIFICATES_COLUMNS as L, revokeMeshCertificate as M, getProcessMeshTlsListenerState as N, isProcessVerifiedMeshPeer as O, openMeshTlsWhenRevocationsLoaded as P, generateMeshCa as Q, MeshCertificateRegistry as R, ServiceBroker as S, SYSTEM_CONFIG_CLUSTER_SECTION_ID, SystemConfigAddon, SystemConfigAddon as default, emitProcessNodeRegistered as T, MeshCrl as U, getProcessMeshCertificateRegistry as V, processMeshCrl as W, createMeshCsrPem as X, caFingerprintCompact as Y, exportMeshPrivateKeyPem as Z, signPairingProof as _, readCidrSetting as _t, hubHostFromMeshAddress as a, AGENT_UI_UNLOCK_TTL_MS as at, TlsTcpTransporter as b, PAIRING_MAX_SESSIONS as c, AGENT_UI_UNLOCK_VERSION as ct, PAIRING_PROTOCOL as d, mintAgentUiUnlockTicket as dt, isValidAgentNodeId as et, PAIRING_TTL_MS as f, parseAgentDashboardOrigins as ft, keyFingerprintShort as g, parseCidrList as gt, describeCsr as h, normalizeIp as ht, AgentPairing as i, AGENT_DASHBOARD_ORIGINS_FIELD as it, renewMeshCertificate as j, onProcessNodeRegistered as k, PAIRING_PATHS as l, UnlockTicketJtiStore as lt, computePairingSas as m, createCidrMatcher as mt, HubPairing as n, issueMeshLeafFromCsr as nt, PAIRING_CODE_DIGITS as o, AGENT_UI_UNLOCK_TYP as ot, computePairingCommitment as p, verifyAgentUiUnlockTicket as pt, requireProcessMeshCa as q, PairingHttpError as r, loadMeshCa as rt, PAIRING_MAX_CODE_ATTEMPTS as s, AGENT_UI_UNLOCK_USE as st, systemConfigMeshActions as t, issueMeshLeafForNode as tt, PAIRING_PIN_DIGITS as u, isAllowedAgentDashboardReturnTo as ut, verifyPairingProof as v, dropProcessPeer as w, Errors as x, MESH_TLS_PORT_HELLO_FIELD as y, RENEWAL_ABANDONED as z };