@camstack/system 1.2.434 → 1.2.436

package/dist/kernel/index.d.ts

@@ -41,8 +41,8 @@ export { createAgentTransport, createBroker, deriveAgentListenPort, getBrokerTls
 export type { AgentTransport, BrokerConfig } from "./moleculer/broker-factory.js";
 export { buildTransporter, connectBrokerTransport, currentBrokerTransporter, disconnectBrokerTransport, installBrokerTransporter, isInstalledTransporter } from "./moleculer/broker-transport-swap.js";
 export type { PendingTransporter } from "./moleculer/broker-transport-swap.js";
-export { caFingerprint, caFingerprintCompact, describeMeshLeaf, dropProcessPeer, emitProcessNodeRegistered, onProcessNodeRegistered, getProcessMeshCertificateRegistry, getProcessPeerLeaf, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MeshCertificateRegistry, getProcessMeshTlsListenerState, openMeshTlsWhenRevocationsLoaded, RENEWAL_ABANDONED, setProcessMeshTlsListenerState, renewMeshCertificate, revokeMeshCertificate, setProcessMeshCertificateRegistry, createMeshCsrPem, enrollMeshNode, exportMeshPrivateKeyPem, getProcessNodeMeshTransport, isProcessVerifiedMeshPeer, setProcessMeshPeerTransportLookup, generateMeshCa, generateMeshKeyPair, getProcessMeshCaState, issueMeshLeafForNode, issueMeshLeafFromCsr, JoinTokenJtiStore, loadMeshCa, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MeshCaKeeper, MeshCrl, mintMeshJoinToken, processMeshCrl, processJoinTokenJtiStore, requireProcessMeshCa, setProcessMeshTlsEnabler, TlsTcpTransporter, verifyMeshJoinToken, DEFAULT_HUB_TLS_TCP_PORT, MESH_TLS_PORT_HELLO_FIELD } from "./moleculer/mesh-mtls/index.js";
-export type { MeshCertificateRecord, MeshLeafDescription, MeshLog, MeshPeerLeaf, MeshPeers, MeshRegistrations, MeshTlsListenerState, NodeMeshClient, RenewMeshResult, RevokeMeshResult, MeshCaSigner, MeshEnrollResult, MeshPeerTransportLookup, MeshTransport, MeshJoinTokenClaims, MeshTlsMaterial, VerifiedMeshPeer } from "./moleculer/mesh-mtls/index.js";
+export { caFingerprint, caFingerprintCompact, describeMeshLeaf, dropProcessPeer, emitProcessNodeRegistered, onProcessNodeRegistered, getProcessMeshCertificateRegistry, getProcessPeerLeaf, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MeshCertificateRegistry, getProcessMeshTlsListenerState, openMeshTlsWhenRevocationsLoaded, RENEWAL_ABANDONED, setProcessMeshTlsListenerState, renewMeshCertificate, revokeMeshCertificate, setProcessMeshCertificateRegistry, createMeshCsrPem, exportMeshPrivateKeyPem, getProcessNodeMeshTransport, isProcessVerifiedMeshPeer, setProcessMeshPeerTransportLookup, generateMeshCa, generateMeshKeyPair, getProcessMeshCaState, issueMeshLeafForNode, issueMeshLeafFromCsr, loadMeshCa, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MeshCaKeeper, MeshCrl, processMeshCrl, requireProcessMeshCa, setProcessMeshTlsEnabler, TlsTcpTransporter, DEFAULT_HUB_TLS_TCP_PORT, MESH_TLS_PORT_HELLO_FIELD } from "./moleculer/mesh-mtls/index.js";
+export type { MeshCertificateRecord, MeshLeafDescription, MeshLog, MeshPeerLeaf, MeshPeers, MeshRegistrations, MeshTlsListenerState, NodeMeshClient, RenewMeshResult, RevokeMeshResult, MeshCaSigner, MeshPeerTransportLookup, MeshTransport, MeshTlsMaterial, VerifiedMeshPeer } from "./moleculer/mesh-mtls/index.js";
 export * from "./moleculer/mesh-mtls/pairing/index.js";
 export { type AddonDeploySource, isAddonDeploySource } from "./moleculer/addon-deploy-source.js";
 export { createAddonService, validateProviderRegistrations } from "./moleculer/addon-service-factory.js";
@@ -57,28 +57,14 @@ export { HubNodeRegistry } from "./moleculer/node-registry.js";
 export type { CallFn, NodeRootPackageInfo, RegisteredAddonManifest, RegisteredNativeCap, RegisterNodeParams, RegisterNodeResult, NodeCapEntry, NodeNativeCapEntry } from "./moleculer/node-registry.js";
 export { callRegisterNodeWithRetry, buildNodeManifest } from "./moleculer/register-node-client.js";
 export type { RegisterNodeBroker, CallRegisterNodeOptions } from "./moleculer/register-node-client.js";
-export { hashClusterSecret, clusterSecretMatches, isClusterSecretMismatchError, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_REF, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, checkClusterSecret, getProcessClusterSecretGate, setProcessClusterSecretGate } from "./moleculer/cluster-secret.js";
-export type { ClusterSecretGate, ClusterSecretVerdict } from "./moleculer/cluster-secret.js";
-export { MeshAuthenticator, isRemoteForbiddenAction, MESH_JOIN_CHALLENGE_TTL_MS } from "./moleculer/mesh-authenticator.js";
-export type { MeshAuthenticatorDeps, MeshCallVerdict } from "./moleculer/mesh-authenticator.js";
+export { AgentMeshIdentityGate, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, MeshIdentityGate, meshErrorType, MESH_ACTION_FORBIDDEN_TYPE, MESH_NODE_UNAUTHENTICATED_TYPE } from "./moleculer/mesh-identity.js";
+export type { AgentMeshIdentityGateDeps, MeshCallGate, MeshCallVerdict, MeshIdentityGateDeps, PeerVerifier } from "./moleculer/mesh-identity.js";
 export { createMeshAccessMiddleware, stripForgedIdentity } from "./moleculer/mesh-access-middleware.js";
-export type { MeshAccessMiddlewareOptions, MeshCallGate } from "./moleculer/mesh-access-middleware.js";
-export { AgentMeshAuthenticator, AGENT_REGISTER_NODE_ACTION, isOwnChildNodeId, isRemoteForbiddenOnAgent } from "./moleculer/agent-mesh-authenticator.js";
-export type { AgentMeshAuthenticatorDeps } from "./moleculer/agent-mesh-authenticator.js";
-export { DEFAULT_MESH_JOIN_MAX_HELD, DEFAULT_MESH_JOIN_MAX_HOLD_MS, MeshJoinHold } from "./moleculer/mesh-join-hold.js";
-export type { MeshGateVerdict, MeshHeldKind, MeshHeldVerdict, MeshJoinHoldOptions, MeshJoinHoldReport } from "./moleculer/mesh-join-hold.js";
+export type { MeshAccessMiddlewareOptions } from "./moleculer/mesh-access-middleware.js";
 export { createAgentEventScope, isPeerEventPacket } from "./moleculer/agent-event-scope.js";
 export type { AgentEventScope, AgentEventScopeOptions, AgentEventScopeStats, OutboundPacket, TransitPublish } from "./moleculer/agent-event-scope.js";
-export { MeshJoinClient } from "./moleculer/mesh-join-client.js";
-export type { MeshJoinCall, MeshJoinClientOptions, MeshJoinState } from "./moleculer/mesh-join-client.js";
-export { computeHubJoinProof, computeNodeJoinProof, meshErrorType, MESH_ACTION_FORBIDDEN_TYPE, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_PROTOCOL, MESH_NODE_UNAUTHENTICATED_TYPE } from "./moleculer/mesh-join-proof.js";
-export type { MeshJoinAuthenticateParams, MeshJoinAuthenticateResult, MeshJoinChallenge } from "./moleculer/mesh-join-proof.js";
-export { getProcessMeshAuthMode, getProcessMeshAuthStatus, isMeshAuthMode, MESH_AUTH_MODE_FIELD, parseMeshAuthMode, requestProcessMeshEnforcement, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshEnforcer } from "./moleculer/mesh-auth-mode.js";
-export { decideMeshAutoEnforce, MESH_AUTO_ENFORCE_GRACE_MS } from "./moleculer/mesh-auto-enforce.js";
-export type { MeshAutoEnforceDecision, MeshAutoEnforceInput } from "./moleculer/mesh-auto-enforce.js";
-export { AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, mintAgentUiUnlockTicketEs256, verifyAgentUiUnlockTicketEs256, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, isAllowedAgentDashboardReturnTo, mintAgentUiUnlockTicket, parseAgentDashboardOrigins, UnlockTicketJtiStore, verifyAgentUiUnlockTicket } from "./moleculer/agent-ui-unlock.js";
-export type { AgentUiUnlockPayload, MintAgentUiUnlockTicketEs256Input, MintAgentUiUnlockTicketInput, VerifyAgentUiUnlockTicketEs256Options, VerifyAgentUiUnlockTicketOptions } from "./moleculer/agent-ui-unlock.js";
-export type { MeshAuthMode, MeshAuthStatus, MeshEnforcer, MeshNodeAuthEntry, MeshNodeAuthState } from "./moleculer/mesh-auth-mode.js";
+export { AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, isAllowedAgentDashboardReturnTo, mintAgentUiUnlockTicket, parseAgentDashboardOrigins, UnlockTicketJtiStore, verifyAgentUiUnlockTicket } from "./moleculer/agent-ui-unlock.js";
+export type { AgentUiUnlockPayload, MintAgentUiUnlockTicketInput, VerifyAgentUiUnlockTicketOptions } from "./moleculer/agent-ui-unlock.js";
 export { serializeTypedArrays } from "./moleculer/typed-array-serde.js";
 export { createReadinessService, createReadinessServiceForRegistry, AGENT_READINESS_SERVICE_NAME } from "./moleculer/readiness-service.js";
 export type { ReadinessServiceDeps } from "./moleculer/readiness-service.js";

package/dist/kernel/moleculer/agent-ui-unlock.d.ts

@@ -1,11 +1,6 @@
-export declare const AGENT_UI_UNLOCK_DOMAIN = "camstack-agent-ui-unlock/v1";
-export declare const AGENT_UI_UNLOCK_VERSION: 1;
-/**
-* D857 (transition release): a ticket signed by the MESH CA key (ES256 JWS) is accepted by an agent
-* IN ADDITION to the HMAC ticket. The removal release mints only this form.
-*/
 export declare const AGENT_UI_UNLOCK_TYP = "camstack-agent-ui-unlock+jwt";
 export declare const AGENT_UI_UNLOCK_USE = "agent-ui-unlock";
+export declare const AGENT_UI_UNLOCK_VERSION: 1;
 /** Ticket lifetime — long enough for a redirect hop, short enough to steal poorly. */
 export declare const AGENT_UI_UNLOCK_TTL_MS: number;
 /**
@@ -33,8 +28,8 @@ export declare class UnlockTicketJtiStore {
 	private gc;
 }
 export interface MintAgentUiUnlockTicketInput {
-	/** `hashClusterSecret(secret)` — never the raw secret. */
-	readonly secretHash: string;
+	/** The mesh CA's private key, PKCS#8 PEM (`MeshCaSigner.keyPem`). */
+	readonly caKeyPem: string;
 	readonly nodeId: string;
 	readonly ttlMs?: number;
 	readonly nowMs?: number;
@@ -51,10 +46,11 @@ export interface VerifyAgentUiUnlockTicketOptions {
 	readonly notBeforeMs?: number;
 }
 /**
-* Verify a ticket under `secretHash`. Returns the payload, or `null` when the
-* signature, shape, expiry or nodeId fails (no reason string — refuse quietly).
+* Verify a ticket against the mesh CA certificate the agent pinned. Returns the
+* payload, or `null` when the signature, header, shape, expiry or nodeId fails
+* (no reason string — refuse quietly).
 */
-export declare function verifyAgentUiUnlockTicket(secretHash: string, ticket: string, options: VerifyAgentUiUnlockTicketOptions): AgentUiUnlockPayload | null;
+export declare function verifyAgentUiUnlockTicket(caCertPem: string, ticket: string, options: VerifyAgentUiUnlockTicketOptions): AgentUiUnlockPayload | null;
 /**
 * True when `returnTo` may receive a ticket redirect. Default: any http(s)
 * origin whose port is 4444. Extra origins come from
@@ -69,24 +65,3 @@ export declare function isAllowedAgentDashboardReturnTo(returnTo: string, extraO
 */
 export declare function isKnownAgentAddress(returnTo: string, knownNames: readonly string[] | null, listedOrigins?: readonly string[]): boolean;
 export declare function parseAgentDashboardOrigins(stored: unknown): readonly string[];
-export interface MintAgentUiUnlockTicketEs256Input {
-	/** The mesh CA's private key, PKCS#8 PEM (`MeshCaSigner.keyPem`). */
-	readonly caKeyPem: string;
-	readonly nodeId: string;
-	readonly ttlMs?: number;
-	readonly nowMs?: number;
-	readonly jti?: string;
-}
-export declare function mintAgentUiUnlockTicketEs256(input: MintAgentUiUnlockTicketEs256Input): string;
-export interface VerifyAgentUiUnlockTicketEs256Options {
-	readonly expectedNodeId: string;
-	readonly nowMs?: number;
-	/** Refuse a ticket issued before this instant (the agent's boot). */
-	readonly notBeforeMs?: number;
-}
-/**
-* Verify a ticket against the mesh CA certificate the agent pinned. Returns the
-* payload, or `null` when the signature, header, shape, expiry or nodeId fails
-* (no reason string — refuse quietly).
-*/
-export declare function verifyAgentUiUnlockTicketEs256(caCertPem: string, ticket: string, options: VerifyAgentUiUnlockTicketEs256Options): AgentUiUnlockPayload | null;

package/dist/kernel/moleculer/broker-factory.d.ts

@@ -68,17 +68,11 @@ interface BrokerConfig {
 */
 declare function deriveAgentListenPort(nodeID: string): number;
 declare function createBroker(config: BrokerConfig): ServiceBroker;
-/** What an agent's transport is made of: an mTLS transporter, or the clear TCP descriptor. */
-type AgentTransport = {
+/** What an agent's transport is made of: always the mTLS transporter (D857). */
+interface AgentTransport {
 	readonly kind: "tls";
 	readonly transporter: TlsTcpTransporter;
-} | {
-	readonly kind: "tcp";
-	readonly descriptor: {
-		readonly type: "TCP";
-		readonly options: Record<string, unknown>;
-	};
-};
+}
 /**
 * The transport of an agent broker, from its config. An agent with no hub address dials nobody
 * and stays `unconfigured` until one is set (the agent UI lists the hubs found over mDNS, D839).

package/dist/kernel/moleculer/broker-transport-swap.d.ts

@@ -1,3 +1,20 @@
+/**
+* Reconnecting a broker's TRANSPORT in place, without rebuilding the broker (D856 amendment).
+*
+* An agent changes how it dials the hub (a new hub address, a new cluster secret, a mesh leaf
+* swap or its rollback) by replacing its transporter. It used to stop the whole `ServiceBroker`
+* and build another. That threw away everything bound to the old one: the `$process` service
+* (whose `stopped()` SIGTERMs every runner - the "child gone" lines), `$agent-cap-fwd`,
+* `$agent`, the event bus, the addon services and every closure that captured the broker. The
+* node came back ONLINE and capless, and the hub's confirm step then failed with
+* "`$agent-cap-fwd.forward` is not found".
+*
+* The broker, its services, its registries and its child runners are all independent of the
+* wire. So only the wire is replaced: disconnect the transit, forget the remote nodes (their
+* connection is gone, and the next `$node.connected` is what re-runs the mesh join), install a
+* new transporter on the SAME transit and connect it. Children never notice; the join's settle
+* re-sends the full manifest (D3), which still carries every child.
+*/
 import type { AgentTransport } from "./broker-factory.js";
 /** The slice of a Moleculer transporter this module drives. */
 interface TransporterLike {

package/dist/kernel/moleculer/hub-service.d.ts

@@ -1,8 +1,7 @@
 import type { ServiceSchema } from "moleculer";
 import type { LogTags } from "@camstack/types";
 import type { RegisterNodeParams } from "./node-registry.js";
-import { type ClusterSecretGate } from "./cluster-secret.js";
-import type { MeshAuthenticator } from "./mesh-authenticator.js";
+import type { MeshIdentityGate } from "./mesh-identity.js";
 interface HubServiceDeps {
 	readonly getAddonConfig: (addonId: string) => unknown;
 	readonly getSettings: (scope: string, key?: string) => unknown;
@@ -26,21 +25,12 @@ interface HubServiceDeps {
 	/** Explicit deregistration (graceful shutdown). `$node.disconnected` covers crashes. */
 	readonly onUnregisterNode?: (nodeId: string) => void;
 	/**
-	* The hub's cluster-secret gate, read on EVERY registration (the secret
-	* lives in the keychain and may be set or changed at runtime — D797):
-	* `off` lets every node in, `on` requires the matching `clusterSecretHash`,
-	* `unknown` (the keychain cannot answer yet) refuses with a retryable error.
-	* Absent → `off` (test brokers); the hub always passes the keychain's gate.
+	* The hub's mesh identity gate (D857). When present, `registerNode` asks it
+	* whether the SENDER may register: a node registers only itself, and only
+	* while it holds a certificate identity. Absent → no sender check (test
+	* brokers); the hub always passes its gate.
 	*/
-	readonly clusterSecretGate?: () => ClusterSecretGate;
-	/**
-	* The hub's per-node mesh identity (D802). When present, `joinChallenge` /
-	* `authenticateNode` run the challenge–response and `registerNode` asks it
-	* whether the SENDER may register (`MeshAuthenticator.admitRegistration`);
-	* `clusterSecretGate` is then read through it. Absent → the D797 hash gate
-	* alone (test brokers).
-	*/
-	readonly meshAuth?: MeshAuthenticator;
+	readonly meshIdentity?: MeshIdentityGate;
 }
 declare function createHubService(deps: HubServiceDeps): ServiceSchema;
 export { createHubService };

package/dist/kernel/moleculer/mesh-access-middleware.d.ts

@@ -1,29 +1,19 @@
 /**
-* Mesh gate middleware (D802): wraps every LOCAL action and event handler so
-* it sees each request another node sends with `ctx.nodeID` = the sender.
+* Mesh gate middleware (D802, D857): wraps every LOCAL action and event handler
+* so it sees each request another node sends with `ctx.nodeID` = the sender.
 *
 * Used on both sides of the mesh:
-*  - hub: {@link MeshAuthenticator} (challenge–response join);
-*  - agent: {@link AgentMeshAuthenticator} (hub proven by mutual join + own
-*    children via `$agent.registerNode`).
+*  - hub: {@link MeshIdentityGate} (the sender holds a verified certificate);
+*  - agent: {@link AgentMeshIdentityGate} (the sender is the certified hub).
 *
 * For a request from another node it:
-*  1. asks the gate's `admitCall` — refuse, tolerate or allow;
+*  1. asks the gate's `admitCall` — refuse or allow;
 *  2. strips a forged identity from the params ({@link stripForgedIdentity}).
 *
 * Calls a node makes to itself (`ctx.nodeID` = own) pass untouched.
 */
 import { type Middleware } from "moleculer";
-import type { MeshGateVerdict } from "./mesh-join-hold.js";
-/**
-* Minimal surface the middleware needs — hub and agent authenticators both fit.
-* Only the agent's ever answers `hold` (its hub's requests before the join
-* settles, D848): the request waits for that verdict, then runs or is refused.
-*/
-export interface MeshCallGate {
-	admitCall(sender: string, action: string): MeshGateVerdict;
-	admitEvent(sender: string, eventName: string): MeshGateVerdict;
-}
+import { type MeshCallGate } from "./mesh-identity.js";
 /**
 * The params of a request from another node, with every identity it claimed
 * removed:
@@ -41,7 +31,7 @@ interface GateLogger {
 }
 export interface MeshAccessMiddlewareOptions {
 	readonly ownNodeId: string;
-	readonly authenticator: MeshCallGate;
+	readonly gate: MeshCallGate;
 	readonly logger?: GateLogger;
 }
 /**

package/dist/kernel/moleculer/mesh-identity.d.ts

@@ -0,0 +1,57 @@
+/** Moleculer error `type`: the sender has no certificate identity this node accepts. */
+export declare const MESH_NODE_UNAUTHENTICATED_TYPE = "MESH_NODE_UNAUTHENTICATED";
+/** Moleculer error `type`: the action is never callable from another node. */
+export declare const MESH_ACTION_FORBIDDEN_TYPE = "MESH_ACTION_FORBIDDEN";
+/** Reads a Moleculer error's `type`, including after an RPC round-trip. */
+export declare function meshErrorType(err: unknown): string | null;
+export type MeshCallVerdict = {
+	readonly verdict: "allow";
+	readonly errorType?: undefined;
+} | {
+	readonly verdict: "deny";
+	readonly errorType: string;
+	readonly message: string;
+};
+/** A gate the broker middleware asks about every inbound action and event. */
+export interface MeshCallGate {
+	admitCall(sender: string, action: string): MeshCallVerdict;
+	admitEvent(sender: string, eventName: string): MeshCallVerdict;
+}
+export declare function isRemoteForbiddenAction(action: string): boolean;
+export declare function isRemoteForbiddenOnAgent(action: string): boolean;
+/** `true` when `nodeId` is a certificate-verified mesh peer right now. */
+export type PeerVerifier = (nodeId: string) => boolean;
+export interface MeshIdentityGateDeps {
+	/** The node's own id — its local calls never pass through here. */
+	readonly ownNodeId: string;
+	readonly isVerifiedPeer: PeerVerifier;
+	/** A sender was refused for lack of a certificate identity (rate-limit in the caller). */
+	readonly onRefused?: (nodeId: string, what: string) => void;
+}
+/** The hub's gate: every other node must hold a verified certificate identity. */
+export declare class MeshIdentityGate implements MeshCallGate {
+	private readonly deps;
+	constructor(deps: MeshIdentityGateDeps);
+	admitCall(sender: string, action: string): MeshCallVerdict;
+	/** Same rule as a call, for an inbound event. */
+	admitEvent(sender: string, eventName: string): MeshCallVerdict;
+	/** Throws when `sender` may not register `nodeId`: a node registers only itself. */
+	admitRegistration(sender: string, nodeId: string): void;
+	private admitSender;
+}
+export interface AgentMeshIdentityGateDeps extends MeshIdentityGateDeps {
+	readonly hubNodeId?: string;
+}
+/**
+* An agent's inbound gate: the hub, proven by the certificate the agent's TLS
+* listener already verified, and nobody else. An agent that is not paired holds
+* no certificate, so it admits no one.
+*/
+export declare class AgentMeshIdentityGate implements MeshCallGate {
+	private readonly deps;
+	private readonly hubNodeId;
+	constructor(deps: AgentMeshIdentityGateDeps);
+	admitCall(sender: string, action: string): MeshCallVerdict;
+	admitEvent(sender: string, eventName: string): MeshCallVerdict;
+	private admitSender;
+}

package/dist/kernel/moleculer/mesh-mtls/constants.d.ts

@@ -4,15 +4,12 @@ export declare const MESH_CA_KEY_REF: string;
 export declare const MESH_CA_SETTINGS_KEY = "cluster.meshCa";
 /** Field inside the `cluster` section. */
 export declare const MESH_CA_FIELD = "meshCa";
-/** Join-token / leaf lifetimes. */
-export declare const MESH_JOIN_TOKEN_MAX_TTL_SEC: number;
+/** Leaf lifetimes. */
 export declare const MESH_LEAF_VALIDITY_DAYS = 30;
 export declare const MESH_CA_VALIDITY_DAYS = 3650;
 /** Hub legacy clear TCP (retired on hub — D826) and TLS listen port. */
 export declare const DEFAULT_HUB_TCP_PORT = 6e3;
 export declare const DEFAULT_HUB_TLS_TCP_PORT = 6443;
-/** Join token payload version. */
-export declare const MESH_JOIN_TOKEN_VERSION: 1;
 /** Subject of the mesh root. Distinct from the HTTPS local CA. */
 export declare const MESH_CA_COMMON_NAME = "CamStack Mesh CA";
 /** Client + server auth EKU OIDs (mutual TLS). */

package/dist/kernel/moleculer/mesh-mtls/index.d.ts

@@ -1,4 +1,4 @@
-export { CLIENT_AUTH_OID, DEFAULT_HUB_TCP_PORT, DEFAULT_HUB_TLS_TCP_PORT, MESH_CA_COMMON_NAME, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_CA_VALIDITY_DAYS, MESH_JOIN_TOKEN_MAX_TTL_SEC, MESH_JOIN_TOKEN_VERSION, MESH_LEAF_VALIDITY_DAYS, SERVER_AUTH_OID } from "./constants.js";
+export { CLIENT_AUTH_OID, DEFAULT_HUB_TCP_PORT, DEFAULT_HUB_TLS_TCP_PORT, MESH_CA_COMMON_NAME, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_CA_VALIDITY_DAYS, MESH_LEAF_VALIDITY_DAYS, SERVER_AUTH_OID } from "./constants.js";
 export { caFingerprint, caFingerprintCompact, createMeshCsrPem, exportMeshPrivateKeyPem, generateMeshCa, generateMeshKeyPair, issueMeshLeafForNode, issueMeshLeafFromCsr, loadMeshCa, MESH_KEY_ALGORITHM, MESH_SIGNING_ALGORITHM, subjectCn, type MeshCaSigner, type MeshLeafMaterial } from "./mesh-ca.js";
 export { clearProcessMeshCa, getProcessMeshCaState, loadOrGenerateMeshCa, MESH_CA_RETRY_MS, MeshCaKeeper, requireProcessMeshCa, setProcessMeshCa, type MeshCaKeeperDeps, type MeshCaState } from "./mesh-ca-keeper.js";
 export { clearProcessMeshCrl, MeshCrl, processMeshCrl } from "./mesh-crl.js";
@@ -6,9 +6,6 @@ export { describeMeshLeaf, getProcessMeshCertificateRegistry, MESH_NODE_CERTIFIC
 export { getProcessMeshTlsListenerState, type MeshTlsGateDeps, type MeshTlsListenerState, openMeshTlsWhenRevocationsLoaded, setProcessMeshTlsListenerState } from "./mesh-tls-gate.js";
 export { renewMeshCertificate, revokeMeshCertificate, type MeshLog, type MeshPeers, type MeshRegistrations, type NodeMeshClient, type RenewMeshDeps, type RenewMeshResult, type RevokeMeshResult } from "./mesh-renewal.js";
 export { dropProcessPeer, emitProcessNodeRegistered, getProcessPeerLeaf, onProcessNodeRegistered, getProcessNodeMeshTransport, isProcessVerifiedMeshPeer, setProcessMeshPeerTransportLookup, type MeshPeerLeaf, type MeshPeerTransportLookup, type MeshTransport } from "./mesh-peer-transport.js";
-export { enrollMeshNode } from "./mesh-enroll.js";
-export type { EnrollMeshNodeDeps, MeshEnrollRequest, MeshEnrollResult } from "./mesh-enroll.js";
-export { JoinTokenJtiStore, mintMeshJoinToken, processJoinTokenJtiStore, verifyMeshJoinToken, type MeshJoinTokenClaims, type MintJoinTokenInput } from "./mesh-join-token.js";
 export { getProcessMeshTlsEnabler, requestProcessMeshTlsEnable, setProcessMeshTlsEnabler, type MeshTlsEnabler } from "./mesh-tls-enabler.js";
 export { helloMeshTlsPort, keepOnlyGossipNodes, MESH_TLS_PORT_HELLO_FIELD, TlsTcpTransporter, type FilteredGossip, type MeshTlsMaterial, type TlsTcpTransporterOptions, type VerifiedMeshPeer } from "./tls-tcp-transporter.js";
 export * from "./pairing/index.js";

package/dist/kernel/moleculer/mesh-mtls/mesh-ca.d.ts

@@ -21,7 +21,7 @@ export interface MeshLeafMaterial {
 }
 /** SHA-256 fingerprint of the DER cert, colon-hex uppercase (Node style). */
 export declare function caFingerprint(certPem: string): string;
-/** Compact fingerprint (lowercase hex, no colons) for join-token payloads. */
+/** Compact fingerprint (lowercase hex, no colons). */
 export declare function caFingerprintCompact(certPem: string): string;
 export declare function generateMeshCa(now?: Date): Promise<MeshCaSigner>;
 export declare function loadMeshCa(certPem: string, keyPem: string): Promise<MeshCaSigner>;

package/dist/kernel/moleculer/mesh-mtls/mesh-renewal.d.ts

@@ -121,7 +121,7 @@ export interface RevokeMeshResult {
 }
 /**
 * Revoke every live mesh leaf of `nodeId` and cut its connection. The node cannot
-* reconnect: it must re-join with a new join token. The node is NOT forgotten
+* reconnect: it must be paired again. The node is NOT forgotten
 * (that stays `clusterNodes.forgetNode`).
 */
 export declare function revokeMeshCertificate(deps: {

package/dist/kernel/moleculer/node-registry.d.ts

@@ -56,12 +56,6 @@ interface RegisterNodeParams {
 	*/
 	readonly nativeCaps?: readonly RegisteredNativeCap[];
 	/**
-	* SHA-256 hash of the node's cluster secret. Optional — absent
-	* when the node has no secret configured. Verified by the `registerNode`
-	* receiver; never carries the raw secret. (Cluster-secret registration gate.)
-	*/
-	readonly clusterSecretHash?: string;
-	/**
 	* The node's root-package identity. Optional — absent from UDS child
 	* manifests and pre-phase-2 agents; present on agents running the
 	* runtime-updatable root model.

package/dist/kernel/moleculer/register-node-client.d.ts

@@ -23,17 +23,19 @@ interface CallRegisterNodeOptions {
 	readonly signal?: AbortSignal;
 	/** Optional logger for retry diagnostics. */
 	readonly log?: (msg: string) => void;
+	/** Told about every failed attempt (the loop keeps going); lets the caller surface a cause. */
+	readonly onAttemptFailed?: (err: unknown) => void;
 }
 /**
 * Build a `RegisterNodeParams` from a node id, its per-addon manifests,
-* optionally its device-scoped native caps, optionally the SHA-256 hash
-* of the cluster secret, and optionally the node's root-package identity
-* (runtime-updatable node packages: version visibility). `nativeCaps` is
-* omitted entirely on the first handshake; `clusterSecretHash` is omitted
-* when no secret is configured; `rootPackage` is omitted by nodes that do
-* not run the root-package model (UDS children).
+* optionally its device-scoped native caps, and optionally the node's
+* root-package identity (runtime-updatable node packages: version
+* visibility). `nativeCaps` is omitted entirely on the first handshake;
+* `rootPackage` is omitted by nodes that do not run the root-package model
+* (UDS children). Who the sender is comes from its certificate (D857), not
+* from the payload.
 */
-declare function buildNodeManifest(nodeId: string, addons: readonly RegisteredAddonManifest[], nativeCaps?: readonly RegisteredNativeCap[], clusterSecretHash?: string, rootPackage?: NodeRootPackageInfo): RegisterNodeParams;
+declare function buildNodeManifest(nodeId: string, addons: readonly RegisteredAddonManifest[], nativeCaps?: readonly RegisteredNativeCap[], rootPackage?: NodeRootPackageInfo): RegisterNodeParams;
 /**
 * Call `<target>.registerNode` and retry until the parent acks. The loop
 * terminates ONLY on a successful ack or an abort — there is no fixed

package/dist/{restore-archive-5ml7uYMf.mjs → restore-archive-BxmP1ChO.mjs}

@@ -1,4 +1,4 @@
-import { v as DATABASE_SNAPSHOT_SUFFIX } from "./dist-CYcBqnXk.mjs";
+import { v as DATABASE_SNAPSHOT_SUFFIX } from "./dist-DjD2M79P.mjs";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/{restore-archive-Do0QwAik.js → restore-archive-D4h904rb.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CCH3XPqO.js");
+const require_dist = require("./dist-DVe0Nsp8.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/{retired-settings-keys-CyDdyjLP.mjs → retired-settings-keys-CQaknvx1.mjs}

@@ -1,4 +1,4 @@
-import { Ar as asJsonObject } from "./dist-CYcBqnXk.mjs";
+import { jr as asJsonObject } from "./dist-DjD2M79P.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-CEiCaI_j.js → retired-settings-keys-CYP5IZJ5.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CCH3XPqO.js");
+const require_dist = require("./dist-DVe0Nsp8.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.434",
+  "version": "1.2.436",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",

package/dist/builtins/system-config/cluster-secret-keeper.d.ts

@@ -1,63 +0,0 @@
-/**
-* Keeps the hub's cluster-secret gate in step with System → Cluster (D797,
-* D802).
-*
-* The field is a `password` of `system-config`: its `system-settings` row
-* (`cluster.clusterSecret`) holds a keychain marker, the value lives in the
-* keychain (owner `system`). The gate the mesh join reads:
-*
-*  - no marker            → the secret is MANDATORY (D802): the keeper asks
-*                           its owner to generate one (`generateSecret`), and
-*                           until that succeeds the gate is `off` — no node can
-*                           authenticate (mesh auth is always enforced, D821);
-*  - marker + value       → `on`  — nodes prove the secret;
-*  - marker, no answer    → `unknown` — refused, retryably, and retried here.
-*    A locked keychain or a value lost to a reset NEVER opens the gate, and
-*    never triggers a generation (the operator decides what replaces a value
-*    the keychain lost).
-*
-* It also publishes the mesh mode (`cluster.meshAuth`, `mesh-auth-mode.ts`).
-*/
-import { type SecretsAccess } from "@camstack/types";
-/** The field key inside the `cluster` section. */
-export declare const CLUSTER_SECRET_FIELD = "clusterSecret";
-export declare const CLUSTER_SECRET_RETRY_MS = 3e4;
-interface KeeperLogger {
-	info(message: string, meta?: {
-		meta?: Record<string, unknown>;
-	}): void;
-	error(message: string, meta?: {
-		meta?: Record<string, unknown>;
-	}): void;
-}
-export interface ClusterSecretKeeperDeps {
-	/** Keychain handle for owner `system`; `null` without a keychain door. */
-	readonly secrets: SecretsAccess | null;
-	/** The stored `cluster` section (markers, never values). Throws when unreadable. */
-	readonly readSection: () => Promise<Record<string, unknown>>;
-	readonly logger: KeeperLogger;
-	readonly retryMs?: number;
-	/**
-	* Generate and store a new secret (D802). Called when no marker is stored.
-	* Throws when it cannot (no keychain, locked): the keeper retries on its
-	* timer. Absent → nothing is generated (tests of the D797 states).
-	*/
-	readonly generateSecret?: () => Promise<void>;
-}
-export declare class ClusterSecretKeeper {
-	private readonly deps;
-	private retryTimer;
-	private unsubscribe;
-	private stopped;
-	private last;
-	constructor(deps: ClusterSecretKeeperDeps);
-	start(): Promise<void>;
-	stop(): void;
-	/** Re-read the row and the keychain; publish the gate. */
-	reload(): Promise<void>;
-	private generate;
-	private compute;
-	private report;
-	private scheduleRetry;
-}
-export {};

package/dist/constants-CrMPWOug.mjs

@@ -1,102 +0,0 @@
-import { Nr as buildSecretRef } from "./dist-CYcBqnXk.mjs";
-import { createHash, timingSafeEqual } from "node:crypto";
-//#region src/kernel/moleculer/cluster-secret.ts
-/**
-* Cluster-secret registration gate (opt-in). A registering node sends a
-* SHA-256 hash of its cluster secret; the receiver of a `registerNode` RPC
-* verifies it. The raw secret is never transmitted.
-*
-* Where the secret lives (D797) — never in an environment variable:
-*  - the HUB: the keychain, owner `system` ({@link CLUSTER_SECRET_REF}), set
-*    from System → Cluster (a `password` field of `system-config`, whose
-*    `system-settings` row {@link CLUSTER_SECRET_SETTINGS_KEY} holds the
-*    marker). Empty = the gate is off, exactly as a hub without a secret
-*    always was;
-*  - an AGENT: its bootstrap credential, entered at pairing / first run and
-*    kept in its own `agent.json` (0600) — or, in the desktop app, in the OS
-*    keychain — because it needs it before it can reach the hub.
-*/
-/** The keychain ref of the hub's cluster secret: `secret://system/global/clusterSecret`. */
-var CLUSTER_SECRET_REF = buildSecretRef({
-	owner: "system",
-	scope: { kind: "global" },
-	fieldPath: "clusterSecret"
-});
-/** The `system-settings` key whose value is the cluster secret's keychain marker. */
-var CLUSTER_SECRET_SETTINGS_KEY = "cluster.clusterSecret";
-/** Moleculer error `type` marking a registration rejected for a bad cluster secret. */
-var CLUSTER_SECRET_MISMATCH_TYPE = "CLUSTER_SECRET_MISMATCH";
-/** Process exit code a runner uses when its registration is rejected for a bad secret. */
-var CLUSTER_SECRET_REJECTED_EXIT_CODE = 78;
-/** SHA-256 hex digest of a cluster secret. Never transmit or log the raw secret. */
-function hashClusterSecret(secret) {
-	return createHash("sha256").update(secret, "utf8").digest("hex");
-}
-/**
-* True if a registration carrying `presentedHash` is allowed against a
-* receiver whose own secret hashes to `expectedHash`.
-* - `expectedHash` undefined → the gate is OFF; everything is allowed.
-* - otherwise `presentedHash` must be present and equal (constant-time).
-*/
-function clusterSecretMatches(expectedHash, presentedHash) {
-	if (expectedHash === void 0) return true;
-	if (presentedHash === void 0 || presentedHash.length !== expectedHash.length) return false;
-	return timingSafeEqual(Buffer.from(expectedHash), Buffer.from(presentedHash));
-}
-/** Recognises a cluster-secret rejection, including after a Moleculer RPC round-trip. */
-function isClusterSecretMismatchError(err) {
-	if (typeof err !== "object" || err === null || !("type" in err)) return false;
-	const { type } = err;
-	return type === CLUSTER_SECRET_MISMATCH_TYPE;
-}
-/** Moleculer error `type` of a registration refused because the hub cannot read its own secret yet. */
-var CLUSTER_SECRET_UNAVAILABLE_TYPE = "CLUSTER_SECRET_UNAVAILABLE";
-function checkClusterSecret(gate, presentedHash) {
-	switch (gate.kind) {
-		case "off": return "allow";
-		case "unknown": return "unavailable";
-		case "on": return clusterSecretMatches(gate.hash, presentedHash) ? "allow" : "mismatch";
-	}
-}
-var GATE_SLOT = Symbol.for("camstack.cluster.secret-gate");
-var NOT_LOADED = {
-	kind: "unknown",
-	reason: "not-loaded"
-};
-function isGate(value) {
-	if (value === null || typeof value !== "object") return false;
-	const kind = Reflect.get(value, "kind");
-	if (kind === "off") return true;
-	if (kind === "on") return typeof Reflect.get(value, "hash") === "string";
-	return kind === "unknown" && typeof Reflect.get(value, "reason") === "string";
-}
-/** Register the hub's gate. Called by `system-config`, which owns the field. */
-function setProcessClusterSecretGate(gate) {
-	Reflect.set(globalThis, GATE_SLOT, gate);
-}
-/** The hub's gate; `unknown` until `system-config` loaded it. */
-function getProcessClusterSecretGate() {
-	const value = Reflect.get(globalThis, GATE_SLOT);
-	return isGate(value) ? value : NOT_LOADED;
-}
-/** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
-var MESH_CA_KEY_REF = buildSecretRef({
-	owner: "system",
-	scope: { kind: "global" },
-	fieldPath: "meshCaKey"
-});
-/** `system-settings` key holding the public CA certificate PEM. */
-var MESH_CA_SETTINGS_KEY = "cluster.meshCa";
-/** Field inside the `cluster` section. */
-var MESH_CA_FIELD = "meshCa";
-/** Join-token / leaf lifetimes. */
-var MESH_JOIN_TOKEN_MAX_TTL_SEC = 3600;
-var MESH_CA_VALIDITY_DAYS = 3650;
-var DEFAULT_HUB_TLS_TCP_PORT = 6443;
-/** Subject of the mesh root. Distinct from the HTTPS local CA. */
-var MESH_CA_COMMON_NAME = "CamStack Mesh CA";
-/** Client + server auth EKU OIDs (mutual TLS). */
-var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
-var CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
-//#endregion
-export { getProcessClusterSecretGate as _, MESH_CA_KEY_REF as a, setProcessClusterSecretGate as b, MESH_JOIN_TOKEN_MAX_TTL_SEC as c, CLUSTER_SECRET_REF as d, CLUSTER_SECRET_REJECTED_EXIT_CODE as f, clusterSecretMatches as g, checkClusterSecret as h, MESH_CA_FIELD as i, SERVER_AUTH_OID as l, CLUSTER_SECRET_UNAVAILABLE_TYPE as m, DEFAULT_HUB_TLS_TCP_PORT as n, MESH_CA_SETTINGS_KEY as o, CLUSTER_SECRET_SETTINGS_KEY as p, MESH_CA_COMMON_NAME as r, MESH_CA_VALIDITY_DAYS as s, CLIENT_AUTH_OID as t, CLUSTER_SECRET_MISMATCH_TYPE as u, hashClusterSecret as v, isClusterSecretMismatchError as y };