@camstack/system 1.2.434 → 1.2.436

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CCH3XPqO.js");
-const require_device_ca = require("./device-ca-D21ZP00q.js");
+const require_dist = require("./dist-DVe0Nsp8.js");
+const require_device_ca = require("./device-ca-CuWuRW9N.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -22,13 +22,13 @@ require("./builtins/local-auth/index.js");
 const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-LZYd8iT-.js");
+const require_wal_maintenance = require("./wal-maintenance-Br60onAQ.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
 const require_agent_https = require("./agent-https-BZIwS4xF.js");
-const require_constants = require("./constants-CuOfMdYe.js");
+const require_constants = require("./constants-GENKqk9k.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
@@ -36,7 +36,7 @@ const require_custom_action_registry = require("./custom-action-registry-Bf_Ynag
 const require_hub_mdns_ciao = require("./hub-mdns-ciao-CBLvq2oj.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-Do0QwAik.js");
+const require_restore_archive = require("./restore-archive-D4h904rb.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -15183,11 +15183,10 @@ function createBroker(config) {
 		},
 		metrics: metricsConfig
 	});
-	const transport = createAgentTransport(config);
 	return new require_builtins_system_config_system_config_addon.ServiceBroker({
 		nodeID,
 		serializer: "MsgPack",
-		transporter: transport.kind === "tls" ? transport.transporter : transport.descriptor,
+		transporter: createAgentTransport(config).transporter,
 		...config.middlewares !== void 0 ? { middlewares: [...config.middlewares] } : {},
 		logger: {
 			type: "Console",
@@ -15222,37 +15221,21 @@ function createAgentTransport(config) {
 	const useHostname = resolveUseHostname();
 	const agentListenPort = config.agentListenPort ?? deriveAgentListenPort(nodeID);
 	const hubDialPort = config.meshTls !== void 0 ? config.tlsPort ?? 6443 : tcpPort;
-	if (config.meshTls !== void 0) {
-		const urls = hubAddress !== void 0 ? normalizeHubUrl(hubAddress, hubDialPort) : void 0;
-		return {
-			kind: "tls",
-			transporter: new require_builtins_system_config_system_config_addon.TlsTcpTransporter({
-				port: agentListenPort,
-				tlsPort: config.agentTlsListenPort ?? 6443,
-				peerTlsPort: hubDialPort,
-				hubOnlyPeers: true,
-				maxPacketSize: 10 * 1024 * 1024,
-				useHostname,
-				debug: false,
-				meshTls: config.meshTls,
-				udpDiscovery: false,
-				...urls !== void 0 ? { urls } : {}
-			})
-		};
-	}
+	const urls = hubAddress !== void 0 ? normalizeHubUrl(hubAddress, hubDialPort) : void 0;
 	return {
-		kind: "tcp",
-		descriptor: {
-			type: "TCP",
-			options: {
-				maxPacketSize: 10 * 1024 * 1024,
-				port: agentListenPort,
-				useHostname,
-				debug: false,
-				udpDiscovery: false,
-				...hubAddress ? { urls: normalizeHubUrl(hubAddress, tcpPort) } : {}
-			}
-		}
+		kind: "tls",
+		transporter: new require_builtins_system_config_system_config_addon.TlsTcpTransporter({
+			port: agentListenPort,
+			tlsPort: config.agentTlsListenPort ?? 6443,
+			peerTlsPort: hubDialPort,
+			hubOnlyPeers: true,
+			maxPacketSize: 10 * 1024 * 1024,
+			useHostname,
+			debug: false,
+			...config.meshTls !== void 0 ? { meshTls: config.meshTls } : {},
+			udpDiscovery: false,
+			...urls !== void 0 ? { urls } : {}
+		})
 	};
 }
 function normalizeHubUrl(raw, defaultPort) {
@@ -15271,23 +15254,6 @@ function getBrokerTlsTransporter(broker) {
 }
 //#endregion
 //#region src/kernel/moleculer/broker-transport-swap.ts
-/**
-* Reconnecting a broker's TRANSPORT in place, without rebuilding the broker (D856 amendment).
-*
-* An agent changes how it dials the hub (a new hub address, a new cluster secret, a mesh leaf
-* swap or its rollback) by replacing its transporter. It used to stop the whole `ServiceBroker`
-* and build another. That threw away everything bound to the old one: the `$process` service
-* (whose `stopped()` SIGTERMs every runner - the "child gone" lines), `$agent-cap-fwd`,
-* `$agent`, the event bus, the addon services and every closure that captured the broker. The
-* node came back ONLINE and capless, and the hub's confirm step then failed with
-* "`$agent-cap-fwd.forward` is not found".
-*
-* The broker, its services, its registries and its child runners are all independent of the
-* wire. So only the wire is replaced: disconnect the transit, forget the remote nodes (their
-* connection is gone, and the next `$node.connected` is what re-runs the mesh join), install a
-* new transporter on the SAME transit and connect it. Children never notice; the join's settle
-* re-sends the full manifest (D3), which still carries every child.
-*/
 function isObject(value) {
 	return typeof value === "object" && value !== null;
 }
@@ -15322,7 +15288,7 @@ function currentBrokerTransporter(broker) {
 }
 /** Build the transporter an {@link AgentTransport} describes (nothing is bound or dialled yet). */
 function buildTransporter(transport) {
-	const tx = transport.kind === "tls" ? transport.transporter : require_builtins_system_config_system_config_addon.Transporters.resolve(transport.descriptor);
+	const tx = transport.transporter;
 	if (!isTransporterLike(tx)) throw new Error("the agent transport is not a Moleculer transporter");
 	return { tx };
 }
@@ -23740,23 +23706,8 @@ function createHubService(deps) {
 				deps.onSetLogLevel?.(ctx.params.level);
 				return true;
 			} },
-			joinChallenge: { handler(ctx) {
-				if (deps.meshAuth === void 0) throw new require_builtins_system_config_system_config_addon.Errors.MoleculerClientError("mesh join is not enabled on this node", 404);
-				return deps.meshAuth.issueChallenge(senderOf$1(ctx));
-			} },
-			authenticateNode: { handler(ctx) {
-				if (deps.meshAuth === void 0) throw new require_builtins_system_config_system_config_addon.Errors.MoleculerClientError("mesh join is not enabled on this node", 404);
-				return deps.meshAuth.authenticate(senderOf$1(ctx), ctx.params);
-			} },
 			registerNode: { handler(ctx) {
-				if (deps.meshAuth !== void 0) {
-					deps.meshAuth.admitRegistration(senderOf$1(ctx), ctx.params);
-					deps.onRegisterNode?.(ctx.params);
-					return { ok: true };
-				}
-				const verdict = require_constants.checkClusterSecret(deps.clusterSecretGate?.() ?? { kind: "off" }, ctx.params.clusterSecretHash);
-				if (verdict === "mismatch") throw new require_builtins_system_config_system_config_addon.Errors.MoleculerError(`cluster secret mismatch — node "${ctx.params.nodeId}" rejected`, 403, require_constants.CLUSTER_SECRET_MISMATCH_TYPE);
-				if (verdict === "unavailable") throw new require_builtins_system_config_system_config_addon.Errors.MoleculerRetryableError(`the hub cannot read its cluster secret yet — node "${ctx.params.nodeId}" must retry`, 503, require_constants.CLUSTER_SECRET_UNAVAILABLE_TYPE);
+				deps.meshIdentity?.admitRegistration(senderOf$1(ctx), ctx.params.nodeId);
 				deps.onRegisterNode?.(ctx.params);
 				return { ok: true };
 			} },
@@ -23903,14 +23854,14 @@ var HubNodeRegistry = class {
 //#region src/kernel/moleculer/register-node-client.ts
 /**
 * Build a `RegisterNodeParams` from a node id, its per-addon manifests,
-* optionally its device-scoped native caps, optionally the SHA-256 hash
-* of the cluster secret, and optionally the node's root-package identity
-* (runtime-updatable node packages: version visibility). `nativeCaps` is
-* omitted entirely on the first handshake; `clusterSecretHash` is omitted
-* when no secret is configured; `rootPackage` is omitted by nodes that do
-* not run the root-package model (UDS children).
-*/
-function buildNodeManifest(nodeId, addons, nativeCaps, clusterSecretHash, rootPackage) {
+* optionally its device-scoped native caps, and optionally the node's
+* root-package identity (runtime-updatable node packages: version
+* visibility). `nativeCaps` is omitted entirely on the first handshake;
+* `rootPackage` is omitted by nodes that do not run the root-package model
+* (UDS children). Who the sender is comes from its certificate (D857), not
+* from the payload.
+*/
+function buildNodeManifest(nodeId, addons, nativeCaps, rootPackage) {
 	return {
 		nodeId,
 		addons: addons.map((a) => ({
@@ -23922,7 +23873,6 @@ function buildNodeManifest(nodeId, addons, nativeCaps, clusterSecretHash, rootPa
 			addonId: n.addonId,
 			deviceIds: [...n.deviceIds]
 		})) },
-		...clusterSecretHash === void 0 ? {} : { clusterSecretHash },
 		...rootPackage === void 0 ? {} : { rootPackage: {
 			name: rootPackage.name,
 			version: rootPackage.version
@@ -23960,10 +23910,7 @@ async function callRegisterNodeWithRetry(broker, params, opts) {
 			if (attempt > 0) opts.log?.(`[register-node] ${action} acked after ${attempt + 1} attempt(s)`);
 			return;
 		} catch (err) {
-			if (require_constants.isClusterSecretMismatchError(err)) {
-				opts.log?.(`[register-node] ${action} REJECTED — cluster secret mismatch; not retrying`);
-				throw err;
-			}
+			opts.onAttemptFailed?.(err);
 			attempt++;
 			const wait = Math.min(base * 2 ** (attempt - 1), 5e3);
 			opts.log?.(`[register-node] ${action} failed (attempt ${attempt}) — retrying in ${wait}ms: ${err instanceof Error ? err.message : String(err)}`);
@@ -23972,180 +23919,64 @@ async function callRegisterNodeWithRetry(broker, params, opts) {
 	}
 }
 //#endregion
-//#region src/kernel/moleculer/mesh-join-proof.ts
-/**
-* Mesh join — the challenge–response that authenticates a node to the hub
-* (D802). Shared by the hub (`$hub.joinChallenge` / `$hub.authenticateNode`)
-* and the agent (`MeshJoinClient`).
-*
-* The exchange, over the clear-text Moleculer transport:
-*
-*   agent → hub   `$hub.joinChallenge {}`                        → { nonce }
-*   agent → hub   `$hub.authenticateNode { nodeId, nonce,
-*                                          clientNonce, proof }`  → { hubProof }
-*
-*   proof    = HMAC-SHA256(K, "camstack-mesh-join/v1|node|<nodeId>|<nonce>")
-*   hubProof = HMAC-SHA256(K, "camstack-mesh-join/v1|hub|<nodeId>|<nonce>|<clientNonce>")
-*   K        = SHA-256(cluster secret)   — the value each side already holds
-*
-* What it buys over the D797 hash (`clusterSecretHash` in `registerNode`):
-*  - nothing reusable crosses the wire: the nonce is the hub's, single use,
-*    short-lived and bound to the SENDER node id, so a sniffed proof answers a
-*    challenge that no longer exists;
-*  - the agent authenticates the HUB too (`hubProof` over the agent's own
-*    nonce): a rogue node answering to `hub` on the LAN — found through UDP
-*    discovery — cannot prove it knows the secret, and the agent refuses it.
-*
-* What it does NOT buy: the transport stays clear text, and the sender node id
-* of every later packet is self-declared. A LAN host that watches a node join
-* can still spoof that node id afterwards. Only mutual TLS (the next step,
-* `docs/design/2026-10-09-mesh-mtls-plan.md`) closes that.
-*/
-/** Protocol version carried by the challenge; the agent refuses one it does not speak. */
-var MESH_JOIN_PROTOCOL = 1;
-var DOMAIN = "camstack-mesh-join/v1";
-/** The hub's action that hands out a single-use nonce. */
-var MESH_JOIN_CHALLENGE_ACTION = "$hub.joinChallenge";
-/** The hub's action that verifies a node's proof and answers with its own. */
-var MESH_JOIN_AUTHENTICATE_ACTION = "$hub.authenticateNode";
-/** Moleculer error `type`: the sender has not authenticated and the hub enforces it. */
+//#region src/kernel/moleculer/mesh-identity.ts
+/**
+* Mesh identity (D857) — who is calling a node, decided by the CERTIFICATE.
+*
+* There is no shared secret. A node is admitted by the mesh when its mutual-TLS
+* handshake chained to the mesh CA, its leaf CN is the node id it speaks as, and
+* the leaf is not revoked (D856). The transport enforces the first two on every
+* packet (`TlsTcpTransporter.onIncomingMessage` drops a `sender` that is not the
+* peer CN), and answers the third through `verifiedPeer`. These gates do one
+* thing: turn "is this sender a verified peer" into allow or deny, and keep a
+* short list of actions no other node may ever call.
+*
+* Hub gate:   every other node must be a verified peer.
+* Agent gate: only the verified hub may call an agent; an agent's mesh has no
+*             other peer (D848).
+*
+* Nothing here reads a credential, mints a nonce or remembers a node's state:
+* a verdict is a pure function of the transport's current knowledge, so a
+* revocation takes effect on the next packet.
+*/
+/** Moleculer error `type`: the sender has no certificate identity this node accepts. */
 var MESH_NODE_UNAUTHENTICATED_TYPE = "MESH_NODE_UNAUTHENTICATED";
 /** Moleculer error `type`: the action is never callable from another node. */
 var MESH_ACTION_FORBIDDEN_TYPE = "MESH_ACTION_FORBIDDEN";
-/** Moleculer error `type`: the challenge is unknown, used or expired — ask for a new one. */
-var MESH_JOIN_CHALLENGE_INVALID_TYPE = "MESH_JOIN_CHALLENGE_INVALID";
-/** A fresh 32-byte nonce, hex. */
-function createMeshNonce() {
-	return (0, node_crypto.randomBytes)(32).toString("hex");
-}
-function hmacHex(secretHash, message) {
-	return (0, node_crypto.createHmac)("sha256", Buffer.from(secretHash, "utf8")).update(message, "utf8").digest("hex");
-}
-/** The node's answer to the hub's nonce. `secretHash` is `hashClusterSecret(secret)`. */
-function computeNodeJoinProof(secretHash, nodeId, nonce) {
-	return hmacHex(secretHash, `${DOMAIN}|node|${nodeId}|${nonce}`);
-}
-/** The hub's answer to the node's nonce — proves the hub holds the same secret. */
-function computeHubJoinProof(secretHash, nodeId, nonce, clientNonce) {
-	return hmacHex(secretHash, `${DOMAIN}|hub|${nodeId}|${nonce}|${clientNonce}`);
-}
-/** Constant-time comparison of two hex proofs; any shape mismatch is `false`. */
-function proofsEqual(expected, presented) {
-	if (typeof presented !== "string" || presented.length !== expected.length) return false;
-	return (0, node_crypto.timingSafeEqual)(Buffer.from(expected, "utf8"), Buffer.from(presented, "utf8"));
-}
 /** Reads a Moleculer error's `type`, including after an RPC round-trip. */
 function meshErrorType(err) {
 	if (typeof err !== "object" || err === null || !("type" in err)) return null;
 	const { type } = err;
 	return typeof type === "string" ? type : null;
 }
-//#endregion
-//#region src/kernel/moleculer/mesh-authenticator.ts
-/**
-* MeshAuthenticator — the hub's record of WHICH node is calling, and whether
-* it proved it (D802).
-*
-* Every remote Moleculer action and event reaching the hub passes through
-* {@link MeshAuthenticator.admitCall} (wired as a broker middleware,
-* `mesh-access-middleware.ts`). The sender node id Moleculer reports is
-* self-declared; this class binds it to a proof:
-*
-*  - `$hub.joinChallenge` → a single-use nonce bound to the sender;
-*  - `$hub.authenticateNode` → the node's HMAC over that nonce and its own id
-*    (`mesh-join-proof.ts`). Success marks the node `authenticated` until its
-*    connection drops (`forget`, on `$node.disconnected`).
-*
-* Policy, per remote action:
-*  - the join actions and `registerNode` are open (they ARE the
-*    authentication; `registerNode` applies its own rule below);
-*  - {@link isRemoteForbiddenAction}: never from another node, whoever it is;
-*  - otherwise an authenticated (or, in `transition`, legacy) node is allowed;
-*    an unauthenticated one is refused in `enforced` and tolerated — with a
-*    warning and a row on System → Cluster — in `transition`.
-*
-* `registerNode` (`admitRegistration`): a node registers only itself; an
-* authenticated node always may; the D797 hash is accepted as `legacy` in
-* `transition` only; no proof at all is tolerated in `transition` only.
-*/
-/** A challenge is answered within this window or not at all. */
-var MESH_JOIN_CHALLENGE_TTL_MS = 6e4;
-/** Outstanding challenges kept at most — a flood of fake node ids evicts the oldest. */
-var MAX_PENDING_CHALLENGES = 256;
-/** Unauthenticated senders remembered for the status page — bounded the same way. */
-var MAX_TRACKED_NODES$1 = 256;
-/** Actions any node may call before it has authenticated. */
-var PRE_AUTH_ACTIONS = new Set([
-	MESH_JOIN_CHALLENGE_ACTION,
-	MESH_JOIN_AUTHENTICATE_ACTION,
-	"$hub.registerNode"
-]);
 /**
 * Services and actions no other node ever calls on the hub. `$process` spawns
 * runners with an arbitrary environment (code execution); `$node` is
 * Moleculer's introspection; `setLogLevel` is an operator action the hub
-* issues itself. Nothing in the cluster calls them remotely, so refusing them
-* costs nothing and closes the cheapest routes to the hub.
+* issues itself.
 */
-var REMOTE_FORBIDDEN_SERVICES$1 = new Set(["$process", "$node"]);
-var REMOTE_FORBIDDEN_ACTIONS = new Set(["$hub.setLogLevel"]);
+var HUB_FORBIDDEN_SERVICES = new Set(["$process", "$node"]);
+var HUB_FORBIDDEN_ACTIONS = new Set(["$hub.setLogLevel"]);
 function isRemoteForbiddenAction(action) {
-	if (REMOTE_FORBIDDEN_ACTIONS.has(action)) return true;
+	if (HUB_FORBIDDEN_ACTIONS.has(action)) return true;
+	const dot = action.indexOf(".");
+	return dot > 0 && HUB_FORBIDDEN_SERVICES.has(action.slice(0, dot));
+}
+/** Moleculer introspection — never from another node, on an agent either. */
+var AGENT_FORBIDDEN_SERVICES = new Set(["$node"]);
+function isRemoteForbiddenOnAgent(action) {
 	const dot = action.indexOf(".");
-	return dot > 0 && REMOTE_FORBIDDEN_SERVICES$1.has(action.slice(0, dot));
+	return dot > 0 && AGENT_FORBIDDEN_SERVICES.has(action.slice(0, dot));
 }
 function refuse(message, type, code = 403) {
 	return new require_builtins_system_config_system_config_addon.Errors.MoleculerClientError(message, code, type);
 }
-var MeshAuthenticator = class {
+var NOT_PAIRED_HINT = "pair it with this hub (System → Cluster → Agents) so it holds a certificate from the mesh CA";
+/** The hub's gate: every other node must hold a verified certificate identity. */
+var MeshIdentityGate = class {
 	deps;
-	challenges = /* @__PURE__ */ new Map();
-	nodes = /* @__PURE__ */ new Map();
-	/** Completed the challenge–response at least once since the hub started. */
-	everAuthenticated = /* @__PURE__ */ new Set();
-	/** Let in WITHOUT the challenge–response at least once since the hub started. */
-	everTolerated = /* @__PURE__ */ new Set();
-	now;
 	constructor(deps) {
 		this.deps = deps;
-		this.now = deps.now ?? Date.now;
-	}
-	issueChallenge(sender) {
-		const nonce = createMeshNonce();
-		this.challenges.delete(sender);
-		if (this.challenges.size >= MAX_PENDING_CHALLENGES) {
-			const oldest = this.challenges.keys().next().value;
-			if (oldest !== void 0) this.challenges.delete(oldest);
-		}
-		this.challenges.set(sender, {
-			nonce,
-			expiresAt: this.now() + MESH_JOIN_CHALLENGE_TTL_MS
-		});
-		return {
-			protocol: 1,
-			nonce
-		};
-	}
-	authenticate(sender, params) {
-		if (params.nodeId !== sender) throw refuse(`mesh join refused: node "${sender}" presented a proof for "${String(params.nodeId)}"`, MESH_NODE_UNAUTHENTICATED_TYPE);
-		const pending = this.challenges.get(sender);
-		this.challenges.delete(sender);
-		if (pending === void 0 || pending.expiresAt < this.now() || typeof params.nonce !== "string" || !proofsEqual(pending.nonce, params.nonce)) throw refuse(`mesh join refused: no live challenge for node "${sender}" — ask for a new one`, MESH_JOIN_CHALLENGE_INVALID_TYPE);
-		const hash = this.secretHashOrThrow(sender);
-		if (!proofsEqual(computeNodeJoinProof(hash, sender, pending.nonce), params.proof)) throw refuse(`cluster secret mismatch — node "${sender}" rejected`, require_constants.CLUSTER_SECRET_MISMATCH_TYPE);
-		this.record(sender, "authenticated");
-		this.everAuthenticated.add(sender);
-		this.deps.onAuthenticated?.(sender);
-		const clientNonce = typeof params.clientNonce === "string" ? params.clientNonce : "";
-		return {
-			ok: true,
-			hubProof: computeHubJoinProof(hash, sender, pending.nonce, clientNonce)
-		};
-	}
-	/** The node's connection dropped: it authenticates again when it returns. */
-	forget(nodeId) {
-		this.nodes.delete(nodeId);
-		this.challenges.delete(nodeId);
 	}
 	admitCall(sender, action) {
 		if (sender === this.deps.ownNodeId) return { verdict: "allow" };
@@ -24154,7 +23985,6 @@ var MeshAuthenticator = class {
 			errorType: MESH_ACTION_FORBIDDEN_TYPE,
 			message: `"${action}" is not callable from another node (caller "${sender}")`
 		};
-		if (PRE_AUTH_ACTIONS.has(action)) return { verdict: "allow" };
 		return this.admitSender(sender, action);
 	}
 	/** Same rule as a call, for an inbound event. */
@@ -24162,103 +23992,72 @@ var MeshAuthenticator = class {
 		if (sender === this.deps.ownNodeId) return { verdict: "allow" };
 		return this.admitSender(sender, `event:${eventName}`);
 	}
+	/** Throws when `sender` may not register `nodeId`: a node registers only itself. */
+	admitRegistration(sender, nodeId) {
+		if (sender === this.deps.ownNodeId) return;
+		if (nodeId !== sender) throw refuse(`registration refused: node "${sender}" may register only itself, not "${nodeId}"`, MESH_NODE_UNAUTHENTICATED_TYPE);
+		if (!this.deps.isVerifiedPeer(sender)) {
+			this.deps.onRefused?.(sender, "$hub.registerNode");
+			throw refuse(`node "${sender}" holds no valid mesh certificate — ${NOT_PAIRED_HINT}`, MESH_NODE_UNAUTHENTICATED_TYPE);
+		}
+	}
 	admitSender(sender, what) {
-		const state = this.stateOf(sender);
-		if (state === "authenticated" || this.deps.isVerifiedPeer?.(sender) === true) return { verdict: "allow" };
-		if (this.deps.mode() === "enforced") return {
+		if (this.deps.isVerifiedPeer(sender)) return { verdict: "allow" };
+		this.deps.onRefused?.(sender, what);
+		return {
 			verdict: "deny",
 			errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
-			message: `node "${sender}" has not authenticated to this hub — enter the hub cluster secret (System → Cluster) in the agent and restart it`
+			message: `node "${sender}" holds no valid mesh certificate — ${NOT_PAIRED_HINT}`
 		};
-		if (state === "legacy") return { verdict: "allow" };
-		if (!this.nodes.has(sender)) {
-			this.record(sender, "unauthenticated");
-			this.noteTolerated(sender);
-			this.deps.onTolerated?.(sender, what);
-		}
-		return { verdict: "tolerate" };
-	}
-	/** Throws when `sender` may not register `params`; returns when it may. */
-	admitRegistration(sender, params) {
-		if (sender === this.deps.ownNodeId) return;
-		if (params.nodeId !== sender) throw refuse(`registration refused: node "${sender}" may register only itself, not "${params.nodeId}"`, MESH_NODE_UNAUTHENTICATED_TYPE);
-		if (this.stateOf(sender) === "authenticated" || this.deps.isVerifiedPeer?.(sender) === true) return;
-		if (this.deps.mode() === "enforced") throw refuse(`cluster secret mismatch — node "${sender}" rejected: this hub requires agents to authenticate with the cluster secret (System → Cluster); update the agent and enter it`, require_constants.CLUSTER_SECRET_MISMATCH_TYPE);
-		if (params.clusterSecretHash === void 0) {
-			this.admitSender(sender, "$hub.registerNode");
-			return;
-		}
-		const verdict = require_constants.checkClusterSecret(this.deps.gate(), params.clusterSecretHash);
-		if (verdict === "mismatch") throw refuse(`cluster secret mismatch — node "${sender}" rejected`, require_constants.CLUSTER_SECRET_MISMATCH_TYPE);
-		if (verdict === "unavailable") throw new require_builtins_system_config_system_config_addon.Errors.MoleculerRetryableError(`the hub cannot read its cluster secret yet — node "${sender}" must retry`, 503, require_constants.CLUSTER_SECRET_UNAVAILABLE_TYPE);
-		this.record(sender, this.deps.gate().kind === "on" ? "legacy" : "unauthenticated");
-		this.noteTolerated(sender);
-	}
-	noteTolerated(nodeId) {
-		if (this.everTolerated.size >= MAX_TRACKED_NODES$1) return;
-		this.everTolerated.add(nodeId);
 	}
-	stateOf(nodeId) {
-		return this.nodes.get(nodeId)?.state ?? "unauthenticated";
-	}
-	/** Node ids that completed the challenge–response on their current connection. */
-	authenticatedNodeIds() {
-		return [...this.nodes].filter(([, r]) => r.state === "authenticated").map(([id]) => id);
+};
+/**
+* An agent's inbound gate: the hub, proven by the certificate the agent's TLS
+* listener already verified, and nobody else. An agent that is not paired holds
+* no certificate, so it admits no one.
+*/
+var AgentMeshIdentityGate = class {
+	deps;
+	hubNodeId;
+	constructor(deps) {
+		this.deps = deps;
+		this.hubNodeId = deps.hubNodeId ?? "hub";
 	}
-	/** Node ids that ever completed the challenge–response since the hub started. */
-	everAuthenticatedNodeIds() {
-		return this.everAuthenticated;
+	admitCall(sender, action) {
+		if (sender === this.deps.ownNodeId) return { verdict: "allow" };
+		if (isRemoteForbiddenOnAgent(action)) return {
+			verdict: "deny",
+			errorType: MESH_ACTION_FORBIDDEN_TYPE,
+			message: `"${action}" is not callable from another node (caller "${sender}")`
+		};
+		return this.admitSender(sender, action);
 	}
-	/**
-	* Node ids let in without the challenge–response since the hub started.
-	* Bounded: past {@link MAX_TRACKED_NODES} a flood of fake ids stops adding,
-	* and the ones already here keep the transition open (the operator can still
-	* switch to `enforced` by hand).
-	*/
-	everToleratedNodeIds() {
-		return [...this.everTolerated];
+	admitEvent(sender, eventName) {
+		if (sender === this.deps.ownNodeId) return { verdict: "allow" };
+		return this.admitSender(sender, `event:${eventName}`);
 	}
-	snapshot() {
-		const nodes = [...this.nodes].map(([nodeId, r]) => ({
-			nodeId,
-			state: r.state,
-			since: r.since
-		})).toSorted((a, b) => a.nodeId.localeCompare(b.nodeId));
+	admitSender(sender, what) {
+		if (sender === this.hubNodeId && this.deps.isVerifiedPeer(sender)) return { verdict: "allow" };
+		this.deps.onRefused?.(sender, what);
 		return {
-			mode: this.deps.mode(),
-			nodes
+			verdict: "deny",
+			errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
+			message: `node "${sender}" is not accepted by this agent — only the hub, proven by the certificate this agent's TLS listener verified, may call it`
 		};
 	}
-	record(nodeId, state) {
-		this.nodes.delete(nodeId);
-		if (this.nodes.size >= MAX_TRACKED_NODES$1) {
-			const oldestTolerated = [...this.nodes].find(([, r]) => r.state === "unauthenticated");
-			if (oldestTolerated !== void 0) this.nodes.delete(oldestTolerated[0]);
-		}
-		this.nodes.set(nodeId, {
-			state,
-			since: this.now()
-		});
-	}
-	secretHashOrThrow(sender) {
-		const gate = this.deps.gate();
-		if (gate.kind === "on") return gate.hash;
-		throw new require_builtins_system_config_system_config_addon.Errors.MoleculerRetryableError(gate.kind === "off" ? `the hub has no cluster secret yet — node "${sender}" must retry` : `the hub cannot read its cluster secret yet — node "${sender}" must retry`, 503, require_constants.CLUSTER_SECRET_UNAVAILABLE_TYPE);
-	}
 };
 //#endregion
 //#region src/kernel/moleculer/mesh-access-middleware.ts
 /**
-* Mesh gate middleware (D802): wraps every LOCAL action and event handler so
-* it sees each request another node sends with `ctx.nodeID` = the sender.
+* Mesh gate middleware (D802, D857): wraps every LOCAL action and event handler
+* so it sees each request another node sends with `ctx.nodeID` = the sender.
 *
 * Used on both sides of the mesh:
-*  - hub: {@link MeshAuthenticator} (challenge–response join);
-*  - agent: {@link AgentMeshAuthenticator} (hub proven by mutual join + own
-*    children via `$agent.registerNode`).
+*  - hub: {@link MeshIdentityGate} (the sender holds a verified certificate);
+*  - agent: {@link AgentMeshIdentityGate} (the sender is the certified hub).
 *
 * For a request from another node it:
-*  1. asks the gate's `admitCall` — refuse, tolerate or allow;
+*  1. asks the gate's `admitCall` — refuse or allow;
 *  2. strips a forged identity from the params ({@link stripForgedIdentity}).
 *
 * Calls a node makes to itself (`ctx.nodeID` = own) pass untouched.
@@ -24301,6 +24100,9 @@ function senderOf(ctx) {
 	const nodeID = ctx.nodeID;
 	return typeof nodeID === "string" && nodeID.length > 0 ? nodeID : null;
 }
+function noSenderError(action) {
+	return new require_builtins_system_config_system_config_addon.Errors.MoleculerClientError(`"${action}" refused: the call names no sender node`, 403, MESH_NODE_UNAUTHENTICATED_TYPE);
+}
 function paramNodeId(params) {
 	return params !== null && typeof params === "object" ? Reflect.get(params, "nodeId") : void 0;
 }
@@ -24309,7 +24111,7 @@ function paramNodeId(params) {
 * so it wraps every service, including the ones Moleculer creates itself.
 */
 function createMeshAccessMiddleware(options) {
-	const { ownNodeId, authenticator, logger } = options;
+	const { ownNodeId, gate, logger } = options;
 	const dropped = /* @__PURE__ */ new Map();
 	const noteDroppedEvent = (sender, eventName) => {
 		const now = Date.now();
@@ -24339,10 +24141,9 @@ function createMeshAccessMiddleware(options) {
 			const name = action.name ?? "";
 			return function meshGatedAction(ctx) {
 				const sender = senderOf(ctx);
-				if (sender === null || sender === ownNodeId) return next.call(this, ctx);
-				const verdict = authenticator.admitCall(sender, name);
-				if (verdict.verdict === "hold") return verdict.settled.then((settled) => runAdmitted.call(this, ctx, sender, settled));
-				return runAdmitted.call(this, ctx, sender, verdict);
+				if (sender === null) return Promise.reject(noSenderError(name));
+				if (sender === ownNodeId) return next.call(this, ctx);
+				return runAdmitted.call(this, ctx, sender, gate.admitCall(sender, name));
 			};
 			function runAdmitted(ctx, sender, verdict) {
 				if (verdict.verdict === "deny") {
@@ -24362,235 +24163,21 @@ function createMeshAccessMiddleware(options) {
 			const name = event.name ?? "";
 			return function meshGatedEvent(ctx) {
 				const sender = senderOf(ctx);
-				if (sender === null || sender === ownNodeId) return Promise.resolve(next.call(this, ctx));
-				const verdict = authenticator.admitEvent(sender, name);
-				const deliver = (settled) => {
-					if (settled.verdict === "deny") {
-						noteDroppedEvent(sender, name);
-						return Promise.resolve();
-					}
-					return Promise.resolve(next.call(this, ctx));
-				};
-				return verdict.verdict === "hold" ? verdict.settled.then(deliver) : deliver(verdict);
+				if (sender === null) {
+					noteDroppedEvent("(no sender)", name);
+					return Promise.resolve();
+				}
+				if (sender === ownNodeId) return Promise.resolve(next.call(this, ctx));
+				if (gate.admitEvent(sender, name).verdict === "deny") {
+					noteDroppedEvent(sender, name);
+					return Promise.resolve();
+				}
+				return Promise.resolve(next.call(this, ctx));
 			};
 		}
 	};
 }
 //#endregion
-//#region src/kernel/moleculer/mesh-join-hold.ts
-var DEFAULT_MESH_JOIN_MAX_HELD = 1e3;
-var DEFAULT_MESH_JOIN_MAX_HOLD_MS = 15e3;
-var MeshJoinHold = class {
-	opts;
-	waiters = [];
-	firstHeldAt = null;
-	overflow = 0;
-	timer = null;
-	/** Holding is open while a join is in flight; closed after a decision or the bound. */
-	open = true;
-	now;
-	constructor(opts) {
-		this.opts = opts;
-		this.now = opts.now ?? Date.now;
-	}
-	/** Whether a request arriving now would be held (a join is in flight). */
-	get holding() {
-		return this.open;
-	}
-	/** How many requests wait right now. */
-	get size() {
-		return this.waiters.length;
-	}
-	/** A join started: hold again. */
-	reopen() {
-		this.open = true;
-	}
-	/** Hold one request; `null` when holding is closed (the caller refuses it). */
-	hold(kind) {
-		if (!this.open) return null;
-		if (this.waiters.length >= (this.opts.maxHeld ?? 1e3)) {
-			this.overflow++;
-			return {
-				verdict: "hold",
-				settled: Promise.resolve(this.refusal("the hold before the mesh join is full"))
-			};
-		}
-		if (this.firstHeldAt === null) {
-			this.firstHeldAt = this.now();
-			this.timer = setTimeout(() => this.refuse("bound"), this.opts.maxHoldMs ?? 15e3);
-			this.timer.unref?.();
-		}
-		return {
-			verdict: "hold",
-			settled: new Promise((resolve) => {
-				this.waiters.push({
-					kind,
-					resolve
-				});
-			})
-		};
-	}
-	/** The join proved the hub: deliver everything held, in order. */
-	release() {
-		this.open = false;
-		this.settle({ verdict: "allow" }, "delivered", "authenticated");
-	}
-	/** The join failed, or the bound ran out: refuse everything held. */
-	refuse(reason) {
-		this.open = false;
-		this.settle(this.refusal(`the join ended "${reason}"`), "refused", reason);
-	}
-	refusal(why) {
-		return {
-			verdict: "deny",
-			errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
-			message: `"${this.opts.hubNodeId}" sent this before the mesh join settled, and ${why}`
-		};
-	}
-	settle(verdict, outcome, reason) {
-		if (this.timer !== null) clearTimeout(this.timer);
-		this.timer = null;
-		const waiters = this.waiters;
-		const overflow = this.overflow;
-		const firstHeldAt = this.firstHeldAt;
-		this.waiters = [];
-		this.overflow = 0;
-		this.firstHeldAt = null;
-		if (waiters.length === 0 && overflow === 0) return;
-		for (const w of waiters) w.resolve(verdict);
-		this.opts.onReport?.({
-			outcome,
-			reason,
-			events: waiters.filter((w) => w.kind === "event").length,
-			calls: waiters.filter((w) => w.kind === "call").length,
-			overflow,
-			heldForMs: firstHeldAt === null ? 0 : this.now() - firstHeldAt
-		});
-	}
-};
-//#endregion
-//#region src/kernel/moleculer/agent-mesh-authenticator.ts
-/** The child's register action on its parent agent. */
-var AGENT_REGISTER_NODE_ACTION = "$agent.registerNode";
-var DEFAULT_HUB_NODE_ID = "hub";
-var MAX_TRACKED_NODES = 256;
-/** Moleculer introspection — never from another node, on an agent either. */
-var REMOTE_FORBIDDEN_SERVICES = new Set(["$node"]);
-function isRemoteForbiddenOnAgent(action) {
-	const dot = action.indexOf(".");
-	return dot > 0 && REMOTE_FORBIDDEN_SERVICES.has(action.slice(0, dot));
-}
-function isOwnChildNodeId(ownNodeId, sender) {
-	return sender.startsWith(`${ownNodeId}/`);
-}
-var AgentMeshAuthenticator = class {
-	deps;
-	nodes = /* @__PURE__ */ new Map();
-	hubNodeId;
-	now;
-	hold;
-	constructor(deps) {
-		this.deps = deps;
-		this.hubNodeId = deps.hubNodeId ?? DEFAULT_HUB_NODE_ID;
-		this.now = deps.now ?? Date.now;
-		this.hold = new MeshJoinHold({
-			hubNodeId: this.hubNodeId,
-			now: this.now,
-			...deps.maxHeld !== void 0 ? { maxHeld: deps.maxHeld } : {},
-			...deps.maxHoldMs !== void 0 ? { maxHoldMs: deps.maxHoldMs } : {},
-			...deps.onHoldReport !== void 0 ? { onReport: deps.onHoldReport } : {}
-		});
-	}
-	/** How many of the hub's requests wait for the join right now. */
-	heldCount() {
-		return this.hold.size;
-	}
-	/** Current mode: a secret OR a certificate → enforce; else tolerate (upgrade path). */
-	mode() {
-		return this.deps.hasSecret() || this.deps.isPaired?.() === true ? "enforced" : "transition";
-	}
-	/**
-	* Reflect a settled mesh join. `authenticated` stamps the hub; a blocking
-	* failure forgets it so an impostor cannot call in; transitional states
-	* leave the hub unmarked (calls are tolerated while mode is `transition`).
-	*/
-	noteHubJoinState(state) {
-		if (state === "authenticated") {
-			this.record(this.hubNodeId, "authenticated");
-			this.hold.release();
-			return;
-		}
-		if (state === "pending") {
-			this.forget(this.hubNodeId);
-			this.hold.reopen();
-			return;
-		}
-		if (state === "secret-mismatch" || state === "hub-unverified") this.forget(this.hubNodeId);
-		this.hold.refuse(state);
-	}
-	/** A child's `$agent.registerNode` was accepted (secret hash matched or none required). */
-	noteChildRegistered(sender, proof = "authenticated") {
-		if (!isOwnChildNodeId(this.deps.ownNodeId, sender)) return;
-		this.record(sender, proof);
-	}
-	/** The peer's connection dropped. */
-	forget(nodeId) {
-		this.nodes.delete(nodeId);
-	}
-	admitCall(sender, action) {
-		if (sender === this.deps.ownNodeId) return { verdict: "allow" };
-		if (isRemoteForbiddenOnAgent(action)) return {
-			verdict: "deny",
-			errorType: MESH_ACTION_FORBIDDEN_TYPE,
-			message: `"${action}" is not callable from another node (caller "${sender}")`
-		};
-		if (action === "$agent.registerNode" && isOwnChildNodeId(this.deps.ownNodeId, sender)) return { verdict: "allow" };
-		return this.admitSender(sender, action, "call");
-	}
-	admitEvent(sender, eventName) {
-		if (sender === this.deps.ownNodeId) return { verdict: "allow" };
-		return this.admitSender(sender, `event:${eventName}`, "event");
-	}
-	stateOf(nodeId) {
-		return this.nodes.get(nodeId)?.state ?? "unauthenticated";
-	}
-	authenticatedNodeIds() {
-		return [...this.nodes].filter(([, r]) => r.state === "authenticated").map(([id]) => id);
-	}
-	admitSender(sender, what, kind) {
-		const state = this.stateOf(sender);
-		if (state === "authenticated" || state === "legacy") return { verdict: "allow" };
-		if (sender === this.hubNodeId && this.deps.isVerifiedPeer?.(sender) === true) return { verdict: "allow" };
-		if (this.mode() === "enforced") {
-			if (sender === this.hubNodeId) {
-				const held = this.hold.hold(kind);
-				if (held !== null) return held;
-			}
-			return {
-				verdict: "deny",
-				errorType: MESH_NODE_UNAUTHENTICATED_TYPE,
-				message: `node "${sender}" has not authenticated to this agent — only the hub (after mutual mesh join) and this agent's own children may call it`
-			};
-		}
-		if (!this.nodes.has(sender)) {
-			this.record(sender, "unauthenticated");
-			this.deps.onTolerated?.(sender, what);
-		}
-		return { verdict: "tolerate" };
-	}
-	record(nodeId, state) {
-		this.nodes.delete(nodeId);
-		if (this.nodes.size >= MAX_TRACKED_NODES) {
-			const oldest = this.nodes.keys().next().value;
-			if (oldest !== void 0) this.nodes.delete(oldest);
-		}
-		this.nodes.set(nodeId, {
-			state,
-			since: this.now()
-		});
-	}
-};
-//#endregion
 //#region src/kernel/moleculer/agent-event-scope.ts
 /** Moleculer's EVENT packet type (`packets.PACKET_EVENT`). */
 var PACKET_EVENT = "EVENT";
@@ -24625,213 +24212,6 @@ function createAgentEventScope(opts) {
 	};
 }
 //#endregion
-//#region src/kernel/moleculer/mesh-join-client.ts
-/** States in which a call to the hub is refused locally. */
-var BLOCKING = new Set(["secret-mismatch", "hub-unverified"]);
-/** Error `type`s meaning "the hub has no such action": it predates D802. */
-var UNSUPPORTED = new Set(["SERVICE_NOT_FOUND", "SERVICE_NOT_AVAILABLE"]);
-function errText(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-function errCode(err) {
-	if (typeof err !== "object" || err === null || !("code" in err)) return null;
-	const { code } = err;
-	return typeof code === "number" ? code : null;
-}
-function readString(value, key) {
-	if (value === null || typeof value !== "object") return null;
-	const v = Reflect.get(value, key);
-	return typeof v === "string" ? v : null;
-}
-var MeshJoinClient = class {
-	opts;
-	current = "pending";
-	settledWaiters = [];
-	inFlight = null;
-	hubNodeId;
-	constructor(opts) {
-		this.opts = opts;
-		this.hubNodeId = opts.hubNodeId ?? "hub";
-	}
-	get state() {
-		return this.current;
-	}
-	/** Did this agent prove itself on the current connection? */
-	get authenticated() {
-		return this.current === "authenticated";
-	}
-	/**
-	* Run the join. Concurrent callers share one attempt. Resolves with the
-	* settled state; never rejects.
-	*/
-	join() {
-		if (this.inFlight !== null) return this.inFlight;
-		const attempt = this.runJoin().then((state) => {
-			this.inFlight = null;
-			this.settle(state);
-			return state;
-		});
-		this.inFlight = attempt;
-		return attempt;
-	}
-	/** The hub connection dropped: the next connection authenticates again. */
-	reset() {
-		this.current = "pending";
-	}
-	/** Resolves when a call to the hub may go out; rejects when it must not. */
-	async whenCallable() {
-		if (this.current === "pending") {
-			let timer;
-			const settled = await Promise.race([new Promise((resolve) => this.settledWaiters.push(() => resolve(true))), new Promise((resolve) => {
-				timer = setTimeout(() => resolve(false), this.opts.pendingWaitMs ?? 3e4);
-				timer.unref?.();
-			})]);
-			if (timer !== void 0) clearTimeout(timer);
-			if (!settled) throw new Error(`the mesh join with "${this.hubNodeId}" has not completed — the call was not sent`);
-		}
-		if (!BLOCKING.has(this.current)) return;
-		if (this.current === "secret-mismatch") throw new Error("the hub refused this agent: cluster secret mismatch — copy the cluster secret from the hub's System → Cluster page into this agent's setup");
-		throw new Error(`the node answering as "${this.hubNodeId}" could not prove it holds the cluster secret — refusing to talk to it (check the hub address and the secret)`);
-	}
-	/**
-	* Moleculer middleware for the AGENT broker: every call to the hub node waits
-	* for the join; a hub answer "not authenticated" (the hub restarted and lost
-	* us) triggers a new join.
-	*/
-	middleware(onUnauthenticated) {
-		const hubNodeId = this.hubNodeId;
-		const whenCallable = () => this.whenCallable();
-		const secretPresent = () => this.secretPresent();
-		return {
-			name: "CamstackMeshJoin",
-			remoteAction(next, action) {
-				const name = action.name ?? "";
-				if (name === "$hub.joinChallenge" || name === "$hub.authenticateNode") return next;
-				return async function meshJoinGated(ctx) {
-					if (ctx.nodeID !== hubNodeId) return next.call(this, ctx);
-					await whenCallable();
-					try {
-						return await next.call(this, ctx);
-					} catch (err) {
-						if (meshErrorType(err) === "MESH_NODE_UNAUTHENTICATED" && secretPresent()) onUnauthenticated?.();
-						throw err;
-					}
-				};
-			}
-		};
-	}
-	secretPresent() {
-		const s = this.opts.secret();
-		return s !== null && s.length > 0;
-	}
-	settle(state) {
-		this.current = state;
-		this.opts.onSettled?.(state);
-		const waiters = this.settledWaiters;
-		this.settledWaiters = [];
-		for (const w of waiters) w();
-	}
-	async runJoin() {
-		const secret = this.opts.secret();
-		if (secret === null || secret.length === 0) return "no-secret";
-		const hash = require_constants.hashClusterSecret(secret);
-		const maxAttempts = this.opts.maxAttempts ?? 5;
-		let last = "unavailable";
-		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-			const outcome = await this.attempt(hash);
-			if (outcome !== "retry") return outcome;
-			last = "unavailable";
-			await new Promise((r) => setTimeout(r, (this.opts.retryDelayMs ?? 1e3) * attempt));
-		}
-		return last;
-	}
-	async attempt(hash) {
-		const callOpts = {
-			nodeID: this.hubNodeId,
-			timeout: this.opts.callTimeoutMs ?? 1e4
-		};
-		const nodeId = this.opts.nodeId;
-		try {
-			const challenge = await this.opts.call(MESH_JOIN_CHALLENGE_ACTION, {}, callOpts);
-			const nonce = readString(challenge, "nonce");
-			const protocol = challenge !== null && typeof challenge === "object" ? Reflect.get(challenge, "protocol") : void 0;
-			if (nonce === null || protocol !== 1) {
-				this.opts.log?.(`[mesh-join] the hub sent a challenge this agent does not speak`);
-				return "unsupported";
-			}
-			const clientNonce = createMeshNonce();
-			const answer = await this.opts.call(MESH_JOIN_AUTHENTICATE_ACTION, {
-				nodeId,
-				nonce,
-				clientNonce,
-				proof: computeNodeJoinProof(hash, nodeId, nonce)
-			}, callOpts);
-			if (!proofsEqual(computeHubJoinProof(hash, nodeId, nonce, clientNonce), readString(answer, "hubProof"))) {
-				this.opts.log?.(`[mesh-join] the hub could not prove it holds the cluster secret — refused`);
-				return "hub-unverified";
-			}
-			this.opts.log?.(`[mesh-join] authenticated to the hub (mutual)`);
-			return "authenticated";
-		} catch (err) {
-			const type = meshErrorType(err);
-			if (type === "CLUSTER_SECRET_MISMATCH") {
-				this.opts.log?.(`[mesh-join] the hub refused our proof: cluster secret mismatch`);
-				return "secret-mismatch";
-			}
-			if (type !== null && UNSUPPORTED.has(type) || errCode(err) === 404) {
-				this.opts.log?.(`[mesh-join] the hub predates the mesh join — legacy registration`);
-				return "unsupported";
-			}
-			this.opts.log?.(`[mesh-join] join attempt failed (${type ?? "error"}): ${errText(err)}`);
-			return "retry";
-		}
-	}
-};
-//#endregion
-//#region src/kernel/moleculer/mesh-auto-enforce.ts
-/** Boot grace before an empty or partial roster can end the transition. */
-var MESH_AUTO_ENFORCE_GRACE_MS = 5 * 6e4;
-function isAgentId(id, ownNodeId) {
-	return id !== ownNodeId && !id.includes("/");
-}
-function decideMeshAutoEnforce(input) {
-	if (input.mode !== "transition") return {
-		enforce: false,
-		waitingFor: [],
-		why: "not in transition"
-	};
-	if (input.gate !== "on") return {
-		enforce: false,
-		waitingFor: [],
-		why: "no readable cluster secret"
-	};
-	if (input.knownAgents === null) return {
-		enforce: false,
-		waitingFor: [],
-		why: "the cluster-node history has not answered"
-	};
-	if (input.uptimeMs < (input.graceMs ?? 3e5)) return {
-		enforce: false,
-		waitingFor: [],
-		why: "boot grace period"
-	};
-	const known = new Set([
-		...input.knownAgents,
-		...input.connected,
-		...input.toleratedEver
-	].filter((id) => isAgentId(id, input.ownNodeId)));
-	const waitingFor = [...known].filter((id) => !input.authenticatedEver.has(id)).toSorted();
-	if (waitingFor.length > 0) return {
-		enforce: false,
-		waitingFor,
-		why: "agents have not authenticated yet"
-	};
-	return {
-		enforce: true,
-		reason: known.size === 0 ? "no agent has ever joined this hub" : `every known agent has authenticated (${[...known].toSorted().join(", ")})`
-	};
-}
-//#endregion
 //#region src/kernel/moleculer/readiness-service.ts
 /**
 * Service name AGENTS register their own readiness snapshot under.
@@ -27122,8 +26502,6 @@ exports.AGENT_DASHBOARD_ORIGINS_FIELD = require_builtins_system_config_system_co
 exports.AGENT_HTTPS_NAMES_COLLECTION = require_agent_https.AGENT_HTTPS_NAMES_COLLECTION;
 exports.AGENT_HTTPS_NAMES_COLUMNS = require_agent_https.AGENT_HTTPS_NAMES_COLUMNS;
 exports.AGENT_READINESS_SERVICE_NAME = AGENT_READINESS_SERVICE_NAME;
-exports.AGENT_REGISTER_NODE_ACTION = AGENT_REGISTER_NODE_ACTION;
-exports.AGENT_UI_UNLOCK_DOMAIN = require_builtins_system_config_system_config_addon.AGENT_UI_UNLOCK_DOMAIN;
 exports.AGENT_UI_UNLOCK_TTL_MS = require_builtins_system_config_system_config_addon.AGENT_UI_UNLOCK_TTL_MS;
 exports.AGENT_UI_UNLOCK_TYP = require_builtins_system_config_system_config_addon.AGENT_UI_UNLOCK_TYP;
 exports.AGENT_UI_UNLOCK_USE = require_builtins_system_config_system_config_addon.AGENT_UI_UNLOCK_USE;
@@ -27145,7 +26523,7 @@ exports.AdminTokenManager = require_builtins_local_auth_local_auth_addon.AdminTo
 exports.AgentHttpsInstallError = require_agent_https.AgentHttpsInstallError;
 exports.AgentHttpsNames = require_agent_https.AgentHttpsNames;
 exports.AgentMdnsAdvertiser = AgentMdnsAdvertiser;
-exports.AgentMeshAuthenticator = AgentMeshAuthenticator;
+exports.AgentMeshIdentityGate = AgentMeshIdentityGate;
 exports.AgentPairing = require_builtins_system_config_system_config_addon.AgentPairing;
 exports.AlertCenterAddon = require_builtins_alerts_alerts_addon.AlertCenterAddon;
 exports.ApiKeyManager = require_builtins_local_auth_local_auth_addon.ApiKeyManager;
@@ -27160,11 +26538,6 @@ exports.CAP_ACTION_UNLABELLED = CAP_ACTION_UNLABELLED;
 exports.CAP_METHOD_NOT_IMPLEMENTED = CAP_METHOD_NOT_IMPLEMENTED;
 exports.CA_COMMON_NAME = require_agent_https.CA_COMMON_NAME;
 exports.CA_VALIDITY_DAYS = require_agent_https.CA_VALIDITY_DAYS;
-exports.CLUSTER_SECRET_MISMATCH_TYPE = require_constants.CLUSTER_SECRET_MISMATCH_TYPE;
-exports.CLUSTER_SECRET_REF = require_constants.CLUSTER_SECRET_REF;
-exports.CLUSTER_SECRET_REJECTED_EXIT_CODE = require_constants.CLUSTER_SECRET_REJECTED_EXIT_CODE;
-exports.CLUSTER_SECRET_SETTINGS_KEY = require_constants.CLUSTER_SECRET_SETTINGS_KEY;
-exports.CLUSTER_SECRET_UNAVAILABLE_TYPE = require_constants.CLUSTER_SECRET_UNAVAILABLE_TYPE;
 exports.CORE_CAP_SERVICE_NAME = CORE_CAP_SERVICE_NAME;
 exports.CalendarsAddon = require_builtins_calendars_calendars_addon.CalendarsAddon;
 exports.CapRouteError = CapRouteError;
@@ -27185,8 +26558,6 @@ exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
 exports.DEFAULT_HUB_TLS_TCP_PORT = require_constants.DEFAULT_HUB_TLS_TCP_PORT;
 exports.DEFAULT_LAN_HTTP_PORT = require_hub_mdns_ciao.DEFAULT_LAN_HTTP_PORT;
 exports.DEFAULT_LOG_LEVEL = DEFAULT_LOG_LEVEL;
-exports.DEFAULT_MESH_JOIN_MAX_HELD = DEFAULT_MESH_JOIN_MAX_HELD;
-exports.DEFAULT_MESH_JOIN_MAX_HOLD_MS = DEFAULT_MESH_JOIN_MAX_HOLD_MS;
 exports.DEVICE_CA_KEY_REF = require_device_ca.DEVICE_CA_KEY_REF;
 exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = require_dist.DEVICE_SETTINGS_CONTRIBUTION_METHODS;
 exports.DEVICE_STATUS_METHOD = require_dist.DEVICE_STATUS_METHOD;
@@ -27234,7 +26605,6 @@ exports.INFRA_CAPABILITIES = INFRA_CAPABILITIES;
 exports.IntegrationRegistry = IntegrationRegistry;
 exports.JWT_SIGNING_KEY_REF = require_device_ca.JWT_SIGNING_KEY_REF;
 exports.JobJournal = JobJournal;
-exports.JoinTokenJtiStore = require_builtins_system_config_system_config_addon.JoinTokenJtiStore;
 exports.JwtSigningKeyUnavailableError = require_device_ca.JwtSigningKeyUnavailableError;
 exports.LEAF_RENEWAL_WINDOW_DAYS = require_agent_https.LEAF_RENEWAL_WINDOW_DAYS;
 exports.LifecycleJobEngine = LifecycleJobEngine;
@@ -27252,28 +26622,19 @@ exports.LokiLoggingAddon = require_builtins_loki_logging_index.LokiLoggingAddon$
 exports.MAX_CAP_ACTIONS_PER_PEER = MAX_CAP_ACTIONS_PER_PEER;
 exports.MAX_LEAF_VALIDITY_DAYS = require_agent_https.MAX_LEAF_VALIDITY_DAYS;
 exports.MESH_ACTION_FORBIDDEN_TYPE = MESH_ACTION_FORBIDDEN_TYPE;
-exports.MESH_AUTH_MODE_FIELD = require_builtins_system_config_system_config_addon.MESH_AUTH_MODE_FIELD;
-exports.MESH_AUTO_ENFORCE_GRACE_MS = MESH_AUTO_ENFORCE_GRACE_MS;
 exports.MESH_CA_FIELD = require_constants.MESH_CA_FIELD;
 exports.MESH_CA_KEY_REF = require_constants.MESH_CA_KEY_REF;
 exports.MESH_CA_SETTINGS_KEY = require_constants.MESH_CA_SETTINGS_KEY;
-exports.MESH_JOIN_AUTHENTICATE_ACTION = MESH_JOIN_AUTHENTICATE_ACTION;
-exports.MESH_JOIN_CHALLENGE_ACTION = MESH_JOIN_CHALLENGE_ACTION;
-exports.MESH_JOIN_CHALLENGE_INVALID_TYPE = MESH_JOIN_CHALLENGE_INVALID_TYPE;
-exports.MESH_JOIN_CHALLENGE_TTL_MS = MESH_JOIN_CHALLENGE_TTL_MS;
-exports.MESH_JOIN_PROTOCOL = MESH_JOIN_PROTOCOL;
 exports.MESH_NODE_CERTIFICATES_COLLECTION = require_builtins_system_config_system_config_addon.MESH_NODE_CERTIFICATES_COLLECTION;
 exports.MESH_NODE_CERTIFICATES_COLUMNS = require_builtins_system_config_system_config_addon.MESH_NODE_CERTIFICATES_COLUMNS;
 exports.MESH_NODE_UNAUTHENTICATED_TYPE = MESH_NODE_UNAUTHENTICATED_TYPE;
 exports.MESH_QUEUE_TOP_N = MESH_QUEUE_TOP_N;
 exports.MESH_TLS_PORT_HELLO_FIELD = require_builtins_system_config_system_config_addon.MESH_TLS_PORT_HELLO_FIELD;
 exports.METHOD_ACCESS_MAP = require_dist.METHOD_ACCESS_MAP;
-exports.MeshAuthenticator = MeshAuthenticator;
 exports.MeshCaKeeper = require_builtins_system_config_system_config_addon.MeshCaKeeper;
 exports.MeshCertificateRegistry = require_builtins_system_config_system_config_addon.MeshCertificateRegistry;
 exports.MeshCrl = require_builtins_system_config_system_config_addon.MeshCrl;
-exports.MeshJoinClient = MeshJoinClient;
-exports.MeshJoinHold = MeshJoinHold;
+exports.MeshIdentityGate = MeshIdentityGate;
 exports.ModelDownloadService = require_custom_action_registry.ModelDownloadService;
 exports.NATIVE_PROVIDER_SERVICE_INFIX = NATIVE_PROVIDER_SERVICE_INFIX;
 exports.NATIVE_SCAN_DEPTH = NATIVE_SCAN_DEPTH;
@@ -27397,7 +26758,6 @@ exports.capActionSuffix = capActionSuffix;
 exports.capBareAction = capBareAction;
 exports.capServiceName = capServiceName;
 exports.certificateNames = require_agent_https.certificateNames;
-exports.checkClusterSecret = require_constants.checkClusterSecret;
 exports.classifyAddonDir = classifyAddonDir;
 exports.classifyCapRoute = classifyCapRoute;
 exports.clearHttpsListener = require_hub_mdns_ciao.clearHttpsListener;
@@ -27405,12 +26765,9 @@ exports.clearPendingRestart = clearPendingRestart;
 exports.clearPlatformKeychainKey = require_platform_key_source.clearPlatformKeychainKey;
 exports.closeLanHttp = require_hub_mdns_ciao.closeLanHttp;
 exports.clusterEventTopic = clusterEventTopic;
-exports.clusterSecretMatches = require_constants.clusterSecretMatches;
 exports.collectAgentNames = require_agent_https.collectAgentNames;
 exports.collectCertIdentity = require_agent_https.collectCertIdentity;
 exports.collectModelFiles = require_custom_action_registry.collectModelFiles;
-exports.computeHubJoinProof = computeHubJoinProof;
-exports.computeNodeJoinProof = computeNodeJoinProof;
 exports.computePairingCommitment = require_builtins_system_config_system_config_addon.computePairingCommitment;
 exports.computePairingSas = require_builtins_system_config_system_config_addon.computePairingSas;
 exports.connectBrokerTransport = connectBrokerTransport;
@@ -27464,7 +26821,6 @@ exports.createUdsLogger = createUdsLogger;
 exports.createUdsLoggerWithControl = createUdsLoggerWithControl;
 exports.createV8Reclaimer = createV8Reclaimer;
 exports.currentBrokerTransporter = currentBrokerTransporter;
-exports.decideMeshAutoEnforce = decideMeshAutoEnforce;
 exports.deleteModelFromDisk = require_custom_action_registry.deleteModelFromDisk;
 exports.deriveAgentListenPort = deriveAgentListenPort;
 exports.describeCsr = require_builtins_system_config_system_config_addon.describeCsr;
@@ -27492,7 +26848,6 @@ exports.emitDownForOwnedCaps = require_dist.emitDownForOwnedCaps;
 exports.emitHeapDiagnosticReport = emitHeapDiagnosticReport;
 exports.emitProcessNodeRegistered = require_builtins_system_config_system_config_addon.emitProcessNodeRegistered;
 exports.encodeFrame = encodeFrame;
-exports.enrollMeshNode = require_builtins_system_config_system_config_addon.enrollMeshNode;
 exports.ensureAddonNativePrebuilds = ensureAddonNativePrebuilds;
 Object.defineProperty(exports, "ensureBinary", {
 	enumerable: true,
@@ -27561,10 +26916,7 @@ Object.defineProperty(exports, "getPlatformInfo", {
 });
 exports.getPlatformKeychainKey = require_platform_key_source.getPlatformKeychainKey;
 exports.getProcessAgentHttpsNames = require_agent_https.getProcessAgentHttpsNames;
-exports.getProcessClusterSecretGate = require_constants.getProcessClusterSecretGate;
 exports.getProcessJwtSigningKeyState = require_device_ca.getProcessJwtSigningKeyState;
-exports.getProcessMeshAuthMode = require_builtins_system_config_system_config_addon.getProcessMeshAuthMode;
-exports.getProcessMeshAuthStatus = require_builtins_system_config_system_config_addon.getProcessMeshAuthStatus;
 exports.getProcessMeshCaState = require_builtins_system_config_system_config_addon.getProcessMeshCaState;
 exports.getProcessMeshCertificateRegistry = require_builtins_system_config_system_config_addon.getProcessMeshCertificateRegistry;
 exports.getProcessMeshTlsListenerState = require_builtins_system_config_system_config_addon.getProcessMeshTlsListenerState;
@@ -27581,7 +26933,6 @@ exports.getSinglePidStats = require_resource_monitor.getSinglePidStats;
 exports.getUserManagementInternal = require_builtins_local_auth_local_auth_addon.getUserManagementInternal;
 exports.getWorkerDeviceRegistry = getWorkerDeviceRegistry;
 exports.hasDotNode = hasDotNode;
-exports.hashClusterSecret = require_constants.hashClusterSecret;
 exports.heapSpaceField = heapSpaceField;
 exports.hostNodeIdOf = hostNodeIdOf;
 exports.hubHostFromMeshAddress = require_builtins_system_config_system_config_addon.hubHostFromMeshAddress;
@@ -27609,16 +26960,13 @@ exports.isAddonDeploySource = isAddonDeploySource;
 exports.isAllowedAgentDashboardReturnTo = require_builtins_system_config_system_config_addon.isAllowedAgentDashboardReturnTo;
 exports.isArrayBufferCensusReport = isArrayBufferCensusReport;
 exports.isArrayOutputSchema = require_dist.isArrayOutputSchema;
-exports.isClusterSecretMismatchError = require_constants.isClusterSecretMismatchError;
 exports.isCollectionArrayMethod = require_dist.isCollectionArrayMethod;
 exports.isContainerBridgeAddress = require_agent_https.isContainerBridgeAddress;
 exports.isCredentialKeyName = isCredentialKeyName;
 exports.isInfraCapability = isInfraCapability;
 exports.isInstalledTransporter = isInstalledTransporter;
 exports.isLocalOnlyHostname = require_agent_https.isLocalOnlyHostname;
-exports.isMeshAuthMode = require_builtins_system_config_system_config_addon.isMeshAuthMode;
 exports.isModelDownloaded = require_custom_action_registry.isModelDownloaded;
-exports.isOwnChildNodeId = isOwnChildNodeId;
 exports.isPeerEventPacket = isPeerEventPacket;
 exports.isPrivateAddress = require_agent_https.isPrivateAddress;
 exports.isProcessVerifiedMeshPeer = require_builtins_system_config_system_config_addon.isProcessVerifiedMeshPeer;
@@ -27644,8 +26992,6 @@ exports.localSupportedPythonRuntimes = localSupportedPythonRuntimes;
 exports.mapSignalsToInferenceHardware = mapSignalsToInferenceHardware;
 exports.meshErrorType = meshErrorType;
 exports.mintAgentUiUnlockTicket = require_builtins_system_config_system_config_addon.mintAgentUiUnlockTicket;
-exports.mintAgentUiUnlockTicketEs256 = require_builtins_system_config_system_config_addon.mintAgentUiUnlockTicketEs256;
-exports.mintMeshJoinToken = require_builtins_system_config_system_config_addon.mintMeshJoinToken;
 exports.mountNativeCapService = mountNativeCapService;
 exports.nextRssBudgetState = nextRssBudgetState;
 exports.normalizeIp = require_builtins_system_config_system_config_addon.normalizeIp;
@@ -27655,7 +27001,6 @@ exports.overlayGetStatus = overlayGetStatus;
 exports.parseAgentDashboardOrigins = require_builtins_system_config_system_config_addon.parseAgentDashboardOrigins;
 exports.parseCapAction = parseCapAction;
 exports.parseCidrList = require_builtins_system_config_system_config_addon.parseCidrList;
-exports.parseMeshAuthMode = require_builtins_system_config_system_config_addon.parseMeshAuthMode;
 exports.parseRangeHeader = require_custom_action_registry.parseRangeHeader;
 exports.parseRssBudgetMb = parseRssBudgetMb;
 exports.parseTokenExpiry = require_builtins_local_auth_local_auth_addon.parseTokenExpiry;
@@ -27666,7 +27011,6 @@ exports.pinnedHttpsCaFingerprint = require_agent_https.pinnedHttpsCaFingerprint;
 exports.prepareBootTls = require_hub_mdns_ciao.prepareBootTls;
 exports.prepareRestoreArchive = require_restore_archive.prepareRestoreArchive;
 exports.probePlatform = probePlatform;
-exports.processJoinTokenJtiStore = require_builtins_system_config_system_config_addon.processJoinTokenJtiStore;
 exports.processJwtSigningKey = require_device_ca.processJwtSigningKey;
 exports.processMeshCrl = require_builtins_system_config_system_config_addon.processMeshCrl;
 exports.proxyToUpstream = proxyToUpstream;
@@ -27693,7 +27037,6 @@ exports.registerLanHttpHandler = require_hub_mdns_ciao.registerLanHttpHandler;
 exports.reissueTlsLeaf = require_hub_mdns_ciao.reissueTlsLeaf;
 exports.reloadHttpsListener = require_hub_mdns_ciao.reloadHttpsListener;
 exports.renewMeshCertificate = require_builtins_system_config_system_config_addon.renewMeshCertificate;
-exports.requestProcessMeshEnforcement = require_builtins_system_config_system_config_addon.requestProcessMeshEnforcement;
 exports.requireProcessMeshCa = require_builtins_system_config_system_config_addon.requireProcessMeshCa;
 exports.resolveFilePath = require_custom_action_registry.resolveFilePath;
 exports.resolveFormatRevision = require_custom_action_registry.resolveFormatRevision;
@@ -27717,11 +27060,7 @@ exports.setHubConnected = setHubConnected;
 exports.setNodeEventInterest = setNodeEventInterest;
 exports.setPlatformKeychainKey = require_platform_key_source.setPlatformKeychainKey;
 exports.setProcessAgentHttpsNames = require_agent_https.setProcessAgentHttpsNames;
-exports.setProcessClusterSecretGate = require_constants.setProcessClusterSecretGate;
-exports.setProcessMeshAuthMode = require_builtins_system_config_system_config_addon.setProcessMeshAuthMode;
-exports.setProcessMeshAuthStatusSource = require_builtins_system_config_system_config_addon.setProcessMeshAuthStatusSource;
 exports.setProcessMeshCertificateRegistry = require_builtins_system_config_system_config_addon.setProcessMeshCertificateRegistry;
-exports.setProcessMeshEnforcer = require_builtins_system_config_system_config_addon.setProcessMeshEnforcer;
 exports.setProcessMeshPeerTransportLookup = require_builtins_system_config_system_config_addon.setProcessMeshPeerTransportLookup;
 exports.setProcessMeshTlsEnabler = require_builtins_system_config_system_config_addon.setProcessMeshTlsEnabler;
 exports.setProcessMeshTlsListenerState = require_builtins_system_config_system_config_addon.setProcessMeshTlsListenerState;
@@ -27749,10 +27088,8 @@ exports.udsChildLogToWorkerEntry = udsChildLogToWorkerEntry;
 exports.validateProviderRegistrations = validateProviderRegistrations;
 exports.validateUploadedTls = require_hub_mdns_ciao.validateUploadedTls;
 exports.verifyAgentUiUnlockTicket = require_builtins_system_config_system_config_addon.verifyAgentUiUnlockTicket;
-exports.verifyAgentUiUnlockTicketEs256 = require_builtins_system_config_system_config_addon.verifyAgentUiUnlockTicketEs256;
 exports.verifyDeviceLeaf = require_device_ca.verifyDeviceLeaf;
 exports.verifyDeviceSignature = require_device_ca.verifyDeviceSignature;
-exports.verifyMeshJoinToken = require_builtins_system_config_system_config_addon.verifyMeshJoinToken;
 exports.verifyPairingProof = require_builtins_system_config_system_config_addon.verifyPairingProof;
 exports.waitUntilReady = waitUntilReady;
 exports.writeExtraSans = require_hub_mdns_ciao.writeExtraSans;