@camstack/system 1.2.435 → 1.2.436

package/dist/builtins/system-config/system-config.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CnUtkSwN.js");
+const require_dist = require("../../dist-DVe0Nsp8.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_x509_es = require("../../x509.es-r7Ht1thA.js");
 const require_agent_https = require("../../agent-https-BZIwS4xF.js");
-const require_constants$8 = require("../../constants-DL87WgeN.js");
+const require_constants$8 = require("../../constants-GENKqk9k.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -106,73 +106,27 @@ function createCidrMatcher(entries) {
 	};
 }
 //#endregion
-//#region src/kernel/moleculer/mesh-auth-mode.ts
-/** The field key inside the `cluster` section. */
-var MESH_AUTH_MODE_FIELD = "meshAuth";
-function isMeshAuthMode(value) {
-	return value === "transition" || value === "enforced";
-}
-/** A stored value that is not a mode reads as `transition`: never refuse on a typo. */
-function parseMeshAuthMode(value) {
-	return isMeshAuthMode(value) ? value : "transition";
-}
-var MODE_SLOT = Symbol.for("camstack.cluster.mesh-auth-mode");
-var ENFORCER_SLOT = Symbol.for("camstack.cluster.mesh-auth-enforcer");
-var STATUS_SLOT = Symbol.for("camstack.cluster.mesh-auth-status");
-/** Published by `system-config` whenever the stored mode is (re)read. */
-function setProcessMeshAuthMode(mode) {
-	Reflect.set(globalThis, MODE_SLOT, mode);
-}
-/**
-* The hub's mode. Until `system-config` has read it: `transition` — the safe
-* side for an upgrading cluster (nothing that worked before is refused), and
-* exactly what an unread setting means.
-*/
-function getProcessMeshAuthMode() {
-	return parseMeshAuthMode(Reflect.get(globalThis, MODE_SLOT));
-}
-function setProcessMeshEnforcer(enforcer) {
-	if (enforcer === null) Reflect.deleteProperty(globalThis, ENFORCER_SLOT);
-	else Reflect.set(globalThis, ENFORCER_SLOT, enforcer);
-}
-/** Ask the owner of the setting to switch to `enforced`. `false` when nobody can. */
-async function requestProcessMeshEnforcement(reason) {
-	const enforcer = Reflect.get(globalThis, ENFORCER_SLOT);
-	if (typeof enforcer !== "function") return false;
-	await enforcer(reason);
-	return true;
-}
-/** Published by the hub's broker; read by System → Cluster. */
-function setProcessMeshAuthStatusSource(source) {
-	if (source === null) Reflect.deleteProperty(globalThis, STATUS_SLOT);
-	else Reflect.set(globalThis, STATUS_SLOT, source);
-}
-function getProcessMeshAuthStatus() {
-	const source = Reflect.get(globalThis, STATUS_SLOT);
-	return typeof source === "function" ? source() : null;
-}
-//#endregion
 //#region src/kernel/moleculer/agent-ui-unlock.ts
 /**
-* Agent UI remote unlock tickets (D821).
+* Agent UI remote unlock tickets (D821, re-keyed by D857).
 *
-* A hub admin mints a short-lived HMAC ticket bound to one agent `nodeId`.
-* The agent redeems it once for a tab session Bearer — the cluster secret
-* stays a mesh / pairing credential and is not pasted into the browser for
-* daily unlock.
+* A hub admin mints a short-lived ticket bound to one agent `nodeId`, signed
+* with the MESH CA key (ES256 JWS). The agent verifies it
+* with the CA certificate it pinned at pairing and redeems it once for a tab
+* session Bearer. There is no shared secret: a ticket is worth exactly as much
+* as the CA key that signed it, and the agent trusts exactly the CA its
+* operator confirmed during pairing.
 *
-*   K       = SHA-256(cluster secret)   — same as mesh join (D802)
-*   ticket  = base64url(JSON payload) + '.' + base64url(HMAC-SHA256(K, DOMAIN|payloadB64))
-*   payload = { v: 1, nodeId, exp (ms), jti }
-*/
-var AGENT_UI_UNLOCK_DOMAIN = "camstack-agent-ui-unlock/v1";
-var AGENT_UI_UNLOCK_VERSION = 1;
-/**
-* D857 (transition release): a ticket signed by the MESH CA key (ES256 JWS) is accepted by an agent
-* IN ADDITION to the HMAC ticket. The removal release mints only this form.
+*   ticket  = b64url(header) '.' b64url(payload) '.' b64url(ES256 signature)
+*   header  = { alg: 'ES256', typ: 'camstack-agent-ui-unlock+jwt' }
+*   payload = { v: 1, use: 'agent-ui-unlock', nodeId, iat (ms), exp (ms), jti }
+*
+* The `typ` and `use` pins keep a join token or a pairing proof (also signed
+* by the CA key) from ever being accepted here, and the reverse.
 */
 var AGENT_UI_UNLOCK_TYP = "camstack-agent-ui-unlock+jwt";
 var AGENT_UI_UNLOCK_USE = "agent-ui-unlock";
+var AGENT_UI_UNLOCK_VERSION = 1;
 /** Ticket lifetime — long enough for a redirect hop, short enough to steal poorly. */
 var AGENT_UI_UNLOCK_TTL_MS = 5 * 6e4;
 /**
@@ -202,18 +156,28 @@ var UnlockTicketJtiStore = class {
 		for (const [jti, exp] of this.spent) if (exp <= nowMs) this.spent.delete(jti);
 	}
 };
+function b64urlJson$1(value) {
+	return Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
+}
 function mintAgentUiUnlockTicket(input) {
 	const nowMs = input.nowMs ?? Date.now();
 	const ttl = Math.min(Math.max(1e3, input.ttlMs ?? 3e5), AGENT_UI_UNLOCK_TTL_MS);
 	const payload = {
 		v: 1,
+		use: AGENT_UI_UNLOCK_USE,
 		nodeId: input.nodeId,
 		iat: nowMs,
 		exp: nowMs + ttl,
 		jti: input.jti ?? (0, node_crypto.randomBytes)(16).toString("base64url")
 	};
-	const payloadB64 = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
-	return `${payloadB64}.${sign$1(input.secretHash, payloadB64)}`;
+	const signingInput = `${b64urlJson$1({
+		alg: "ES256",
+		typ: AGENT_UI_UNLOCK_TYP
+	})}.${b64urlJson$1(payload)}`;
+	return `${signingInput}.${(0, node_crypto.sign)("sha256", Buffer.from(signingInput, "utf8"), {
+		key: (0, node_crypto.createPrivateKey)(input.caKeyPem),
+		dsaEncoding: "ieee-p1363"
+	}).toString("base64url")}`;
 }
 /** A ticket is issued now-ish, lives at most the TTL, and not before `notBeforeMs`. */
 function issuedSanely(payload, nowMs, notBeforeMs) {
@@ -222,22 +186,36 @@ function issuedSanely(payload, nowMs, notBeforeMs) {
 	return notBeforeMs === void 0 || payload.iat >= notBeforeMs;
 }
 /**
-* Verify a ticket under `secretHash`. Returns the payload, or `null` when the
-* signature, shape, expiry or nodeId fails (no reason string — refuse quietly).
+* Verify a ticket against the mesh CA certificate the agent pinned. Returns the
+* payload, or `null` when the signature, header, shape, expiry or nodeId fails
+* (no reason string — refuse quietly).
 */
-function verifyAgentUiUnlockTicket(secretHash, ticket, options) {
+function verifyAgentUiUnlockTicket(caCertPem, ticket, options) {
 	const nowMs = options.nowMs ?? Date.now();
-	const dot = ticket.indexOf(".");
-	if (dot <= 0 || dot === ticket.length - 1) return null;
-	const payloadB64 = ticket.slice(0, dot);
-	const sig = ticket.slice(dot + 1);
-	if (!sigsEqual(sign$1(secretHash, payloadB64), sig)) return null;
+	const parts = ticket.split(".");
+	if (parts.length !== 3) return null;
+	const [headerB64, payloadB64, signatureB64] = parts;
+	if (headerB64 === void 0 || payloadB64 === void 0 || signatureB64 === void 0) return null;
+	let header;
 	let parsed;
 	try {
+		header = JSON.parse(Buffer.from(headerB64, "base64url").toString("utf8"));
 		parsed = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
 	} catch {
 		return null;
 	}
+	if (typeof header !== "object" || header === null) return null;
+	if (Reflect.get(header, "alg") !== "ES256" || Reflect.get(header, "typ") !== "camstack-agent-ui-unlock+jwt") return null;
+	let valid = false;
+	try {
+		valid = (0, node_crypto.verify)("sha256", Buffer.from(`${headerB64}.${payloadB64}`, "utf8"), {
+			key: new node_crypto.X509Certificate(caCertPem).publicKey,
+			dsaEncoding: "ieee-p1363"
+		}, Buffer.from(signatureB64, "base64url"));
+	} catch {
+		return null;
+	}
+	if (!valid) return null;
 	const payload = parsePayload(parsed);
 	if (payload === null) return null;
 	if (payload.exp <= nowMs) return null;
@@ -296,96 +274,7 @@ function parseAgentDashboardOrigins(stored) {
 	}
 	return out;
 }
-function sign$1(secretHash, payloadB64) {
-	return (0, node_crypto.createHmac)("sha256", Buffer.from(secretHash, "utf8")).update(`${AGENT_UI_UNLOCK_DOMAIN}|${payloadB64}`, "utf8").digest("base64url");
-}
-function sigsEqual(expected, presented) {
-	const a = Buffer.from(expected, "utf8");
-	const b = Buffer.from(presented, "utf8");
-	if (a.length !== b.length) return false;
-	return (0, node_crypto.timingSafeEqual)(a, b);
-}
 function parsePayload(value) {
-	if (typeof value !== "object" || value === null) return null;
-	const rec = value;
-	if (rec["v"] !== 1) return null;
-	const nodeId = rec["nodeId"];
-	const exp = rec["exp"];
-	const jti = rec["jti"];
-	if (typeof nodeId !== "string" || nodeId.length === 0) return null;
-	if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
-	if (typeof jti !== "string" || jti.length === 0) return null;
-	const iat = rec["iat"];
-	return {
-		v: 1,
-		nodeId,
-		iat: typeof iat === "number" && Number.isFinite(iat) ? iat : exp - AGENT_UI_UNLOCK_TTL_MS,
-		exp,
-		jti
-	};
-}
-function b64urlJsonEs256(value) {
-	return Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
-}
-function mintAgentUiUnlockTicketEs256(input) {
-	const nowMs = input.nowMs ?? Date.now();
-	const ttl = Math.min(Math.max(1e3, input.ttlMs ?? 3e5), AGENT_UI_UNLOCK_TTL_MS);
-	const payload = {
-		v: 1,
-		use: AGENT_UI_UNLOCK_USE,
-		nodeId: input.nodeId,
-		iat: nowMs,
-		exp: nowMs + ttl,
-		jti: input.jti ?? (0, node_crypto.randomBytes)(16).toString("base64url")
-	};
-	const signingInput = `${b64urlJsonEs256({
-		alg: "ES256",
-		typ: AGENT_UI_UNLOCK_TYP
-	})}.${b64urlJsonEs256(payload)}`;
-	return `${signingInput}.${(0, node_crypto.sign)("sha256", Buffer.from(signingInput, "utf8"), {
-		key: (0, node_crypto.createPrivateKey)(input.caKeyPem),
-		dsaEncoding: "ieee-p1363"
-	}).toString("base64url")}`;
-}
-/**
-* Verify a ticket against the mesh CA certificate the agent pinned. Returns the
-* payload, or `null` when the signature, header, shape, expiry or nodeId fails
-* (no reason string — refuse quietly).
-*/
-function verifyAgentUiUnlockTicketEs256(caCertPem, ticket, options) {
-	const nowMs = options.nowMs ?? Date.now();
-	const parts = ticket.split(".");
-	if (parts.length !== 3) return null;
-	const [headerB64, payloadB64, signatureB64] = parts;
-	if (headerB64 === void 0 || payloadB64 === void 0 || signatureB64 === void 0) return null;
-	let header;
-	let parsed;
-	try {
-		header = JSON.parse(Buffer.from(headerB64, "base64url").toString("utf8"));
-		parsed = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
-	} catch {
-		return null;
-	}
-	if (typeof header !== "object" || header === null) return null;
-	if (Reflect.get(header, "alg") !== "ES256" || Reflect.get(header, "typ") !== "camstack-agent-ui-unlock+jwt") return null;
-	let valid = false;
-	try {
-		valid = (0, node_crypto.verify)("sha256", Buffer.from(`${headerB64}.${payloadB64}`, "utf8"), {
-			key: new node_crypto.X509Certificate(caCertPem).publicKey,
-			dsaEncoding: "ieee-p1363"
-		}, Buffer.from(signatureB64, "base64url"));
-	} catch {
-		return null;
-	}
-	if (!valid) return null;
-	const payload = parsePayloadEs256(parsed);
-	if (payload === null) return null;
-	if (payload.exp <= nowMs) return null;
-	if (payload.nodeId !== options.expectedNodeId) return null;
-	if (!issuedSanely(payload, nowMs, options.notBeforeMs)) return null;
-	return payload;
-}
-function parsePayloadEs256(value) {
 	if (typeof value !== "object" || value === null) return null;
 	const rec = value;
 	if (rec["v"] !== 1) return null;
@@ -393,10 +282,10 @@ function parsePayloadEs256(value) {
 	const nodeId = rec["nodeId"];
 	const exp = rec["exp"];
 	const jti = rec["jti"];
+	const iat = rec["iat"];
 	if (typeof nodeId !== "string" || nodeId.length === 0) return null;
 	if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
 	if (typeof jti !== "string" || jti.length === 0) return null;
-	const iat = rec["iat"];
 	if (typeof iat !== "number" || !Number.isFinite(iat)) return null;
 	return {
 		v: 1,
@@ -412,7 +301,7 @@ function parsePayloadEs256(value) {
 * Hub mesh CA — EC P-256, key in the keychain, cert in `cluster.meshCa`.
 *
 * Distinct from the HTTPS local CA (`tls/cert-issue.ts`, RSA): the mesh CA
-* signs node leaves (CN = nodeID) and join-token JWS (ES256). Issuance uses
+* signs node leaves (CN = nodeID) and unlock-ticket JWS (ES256). Issuance uses
 * `@peculiar/x509` over WebCrypto — same library the HTTPS path already uses
 * (installed `1.14.3`; registry latest at adoption time was `2.1.0` — stay on
 * the pinned range already shipping).
@@ -453,7 +342,7 @@ async function exportKeyPem(key) {
 function caFingerprint(certPem) {
 	return new node_crypto.X509Certificate(certPem).fingerprint256;
 }
-/** Compact fingerprint (lowercase hex, no colons) for join-token payloads. */
+/** Compact fingerprint (lowercase hex, no colons). */
 function caFingerprintCompact(certPem) {
 	return (0, node_crypto.createHash)("sha256").update(new node_crypto.X509Certificate(certPem).raw).digest("hex");
 }
@@ -1219,7 +1108,7 @@ function defaultSetTimer(fn, ms) {
 function defaultSleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function message$1(error) {
+function message(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 async function renewMeshCertificate(deps) {
@@ -1285,7 +1174,7 @@ async function runRenewal(deps, inFlight) {
 		csrPem = (await deps.client.prepareMeshRenewal()).csrPem;
 		log.info("Mesh renewal: the node generated a new key and sent its CSR", { tags });
 	} catch (error) {
-		return fail("prepare", message$1(error), true);
+		return fail("prepare", message(error), true);
 	}
 	let issued;
 	try {
@@ -1299,7 +1188,7 @@ async function runRenewal(deps, inFlight) {
 			}
 		});
 	} catch (error) {
-		return fail("issue", message$1(error), true);
+		return fail("issue", message(error), true);
 	}
 	const newLeaf = describeMeshLeaf(issued.certPem);
 	deps.registry.beginRenewal(newLeaf.fingerprint);
@@ -1339,7 +1228,7 @@ async function runRenewal(deps, inFlight) {
 		deadlineTimer.cancel();
 		await deps.client.rollbackMeshLeaf().catch(() => void 0);
 		await deps.registry.abandon(newLeaf.fingerprint);
-		return fail("install", message$1(error), true);
+		return fail("install", message(error), true);
 	}
 	const deadline = now() + timeoutMs;
 	const registered = await registeredPromise;
@@ -1368,7 +1257,7 @@ async function runRenewal(deps, inFlight) {
 			}
 			confirmError = "the node did not confirm the new leaf";
 		} catch (error) {
-			confirmError = message$1(error);
+			confirmError = message(error);
 			log.warn("Mesh renewal: confirm not accepted yet", {
 				tags,
 				meta: { error: confirmError }
@@ -1402,7 +1291,7 @@ async function runRenewal(deps, inFlight) {
 }
 /**
 * Revoke every live mesh leaf of `nodeId` and cut its connection. The node cannot
-* reconnect: it must re-join with a new join token. The node is NOT forgotten
+* reconnect: it must be paired again. The node is NOT forgotten
 * (that stays `clusterNodes.forgetNode`).
 */
 async function revokeMeshCertificate(deps) {
@@ -1429,7 +1318,7 @@ async function revokeMeshCertificate(deps) {
 		nodeId,
 		revokedSerials: serials,
 		disconnected,
-		next: "The node can no longer connect. Re-join it with a new join token (System -> Cluster -> Add agent); to remove it from the cluster use Forget node."
+		next: "The node can no longer connect. Pair it again from the hub (System -> Cluster -> Agents); to remove it from the cluster use Forget node."
 	};
 }
 //#endregion
@@ -1490,872 +1379,6 @@ function emitProcessNodeRegistered(nodeId, addonIds) {
 	} catch {}
 }
 //#endregion
-//#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
-var encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder("utf-8", { fatal: !0 });
-function concat(...buffers) {
-	const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
-	let i = 0;
-	for (const buffer of buffers) buf.set(buffer, i), i += buffer.length;
-	return buf;
-}
-var NON_ASCII = /[^\x00-\x7f]/;
-function encode$1(string) {
-	if (typeof string == "string" && string.length >= 128) {
-		if (NON_ASCII.test(string)) throw new TypeError("non-ASCII string encountered in encode()");
-		return encoder.encode(string);
-	}
-	const bytes = new Uint8Array(string.length);
-	for (let i = 0; i < string.length; i++) {
-		const code = string.charCodeAt(i);
-		if (code > 127) throw new TypeError("non-ASCII string encountered in encode()");
-		bytes[i] = code;
-	}
-	return bytes;
-}
-function encodeBase64(input, url = !1) {
-	if (Uint8Array.prototype.toBase64) return input.toBase64({
-		alphabet: url ? "base64url" : "base64",
-		omitPadding: url
-	});
-	const CHUNK_SIZE = 32768, arr = [];
-	for (let i = 0; i < input.length; i += CHUNK_SIZE) arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
-	const encoded = btoa(arr.join(""));
-	return url ? encoded.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : encoded;
-}
-function decodeBase64(encoded, url = !1) {
-	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(encoded, { alphabet: url ? "base64url" : "base64" });
-	if (url) {
-		if (encoded.includes("+") || encoded.includes("/")) throw new TypeError("Invalid base64url");
-		encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
-	}
-	const binary = atob(encoded), bytes = new Uint8Array(binary.length);
-	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-	return bytes;
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/util/errors.js
-var JOSEError = class extends Error {
-	static code = "ERR_JOSE_GENERIC";
-	code = "ERR_JOSE_GENERIC";
-	constructor(message, options) {
-		super(message, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
-	}
-};
-var JWTClaimValidationFailed = class extends JOSEError {
-	static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
-	code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
-	claim;
-	reason;
-	payload;
-	constructor(message, payload, claim = "unspecified", reason = "unspecified") {
-		super(message, { cause: {
-			claim,
-			reason,
-			payload
-		} }), this.claim = claim, this.reason = reason, this.payload = payload;
-	}
-};
-var JWTExpired = class extends JOSEError {
-	static code = "ERR_JWT_EXPIRED";
-	code = "ERR_JWT_EXPIRED";
-	claim;
-	reason;
-	payload;
-	constructor(message, payload, claim = "unspecified", reason = "unspecified") {
-		super(message, { cause: {
-			claim,
-			reason,
-			payload
-		} }), this.claim = claim, this.reason = reason, this.payload = payload;
-	}
-};
-var JOSEAlgNotAllowed = class extends JOSEError {
-	static code = "ERR_JOSE_ALG_NOT_ALLOWED";
-	code = "ERR_JOSE_ALG_NOT_ALLOWED";
-};
-var JOSENotSupported = class extends JOSEError {
-	static code = "ERR_JOSE_NOT_SUPPORTED";
-	code = "ERR_JOSE_NOT_SUPPORTED";
-};
-var JWSInvalid = class extends JOSEError {
-	static code = "ERR_JWS_INVALID";
-	code = "ERR_JWS_INVALID";
-};
-var JWTInvalid = class extends JOSEError {
-	static code = "ERR_JWT_INVALID";
-	code = "ERR_JWT_INVALID";
-};
-var JWSSignatureVerificationFailed = class extends JOSEError {
-	static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
-	code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
-	constructor(message = "signature verification failed", options) {
-		super(message, options);
-	}
-};
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/util/base64url.js
-var invalid = "The input to be decoded is not correctly encoded.";
-function decode(input) {
-	try {
-		return decodeBase64(typeof input == "string" ? input : decoder.decode(input), !0);
-	} catch (cause) {
-		throw new TypeError(invalid, { cause });
-	}
-}
-function encode(input) {
-	return encodeBase64(typeof input == "string" ? encoder.encode(input) : input, !0);
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/lib/validate.js
-function isObject$1(input) {
-	if (typeof input != "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]") return !1;
-	const prototype = Object.getPrototypeOf(input);
-	return prototype === null || Object.getPrototypeOf(prototype) === null;
-}
-function isDisjoint(...headers) {
-	const parameters = /* @__PURE__ */ new Set();
-	for (const header of headers) if (header) for (const parameter of Object.keys(header)) {
-		if (parameters.has(parameter)) return !1;
-		parameters.add(parameter);
-	}
-	return !0;
-}
-function assertNotSet(value, name) {
-	if (value !== void 0) throw new TypeError(`${name} can only be called once`);
-}
-function decodeBase64url(value, label, ErrorClass) {
-	try {
-		return decode(value);
-	} catch {
-		throw new ErrorClass(`Failed to base64url decode the ${label}`);
-	}
-}
-function encodeBase64url(value, label, ErrorClass) {
-	try {
-		return encode$1(value);
-	} catch {
-		throw new ErrorClass(`The ${label} is not a valid base64url string`);
-	}
-}
-function parseJoseHeader(b64, ErrorClass, message) {
-	let parsed;
-	try {
-		parsed = JSON.parse(strictDecoder.decode(decode(b64)));
-	} catch {
-		throw new ErrorClass(message);
-	}
-	if (!isObject$1(parsed)) throw new ErrorClass(message);
-	return parsed;
-}
-var JWS_RECOGNIZED = {
-	__proto__: null,
-	b64: !0
-};
-function validateAlgorithms(option, algorithms) {
-	if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != "string"))) throw new TypeError(`"${option}" option must be an array of strings`);
-	return algorithms === void 0 ? void 0 : new Set(algorithms);
-}
-function validateCritDuplicates(Err, protectedHeader) {
-	const { crit } = protectedHeader ?? {};
-	if (Array.isArray(crit) && new Set(crit).size !== crit.length) throw new Err("\"crit\" (Critical) Header Parameter MUST NOT contain duplicate values");
-}
-function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
-	if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) throw new Err("\"crit\" (Critical) Header Parameter MUST be integrity protected");
-	if (!protectedHeader || protectedHeader.crit === void 0) return [];
-	if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != "string" || input.length === 0)) throw new Err("\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present");
-	const recognized = recognizedOption === void 0 ? recognizedDefault : {
-		__proto__: null,
-		...recognizedOption,
-		...recognizedDefault
-	};
-	for (const parameter of protectedHeader.crit) {
-		if (!(parameter in recognized)) throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
-		if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0) throw new Err(`Extension Header Parameter "${parameter}" is missing`);
-		if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0)) throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
-	}
-	return protectedHeader.crit;
-}
-function validateB64(protectedHeader, extensions) {
-	if (extensions.includes("b64")) {
-		const b64 = protectedHeader.b64;
-		if (typeof b64 != "boolean") throw new JWSInvalid("The \"b64\" (base64url-encode payload) Header Parameter must be a boolean");
-		return b64;
-	}
-	return !0;
-}
-function serializeJoseHeader(Err, header) {
-	let serialized, parsed;
-	try {
-		serialized = JSON.stringify(header), parsed = JSON.parse(serialized);
-	} catch (cause) {
-		throw new Err("JOSE Header is not valid JSON", { cause });
-	}
-	if (!isObject$1(parsed)) throw new Err("JOSE Header is not a JSON object");
-	return [parsed, serialized];
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/lib/key.js
-var tag = (key) => key[Symbol.toStringTag], jwkMatchesOp = (entry, key, usage) => {
-	const { alg } = entry;
-	if (key.use !== void 0) {
-		const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
-		if (key.use !== expected) throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
-	}
-	if (key.alg !== void 0 && key.alg !== alg) throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
-	if (Array.isArray(key.key_ops)) {
-		const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
-		if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp)) throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
-	}
-};
-async function prepareKey(entry, key, usage) {
-	const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
-	if (secret && key instanceof Uint8Array) return key;
-	let normalized, keyObject;
-	if (isObject$1(key)) {
-		if (normalized = normalizeJwk(key), typeof normalized.kty != "string") throw invalidKeyType(alg, key, secret);
-		if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0))) throw new TypeError(secret ? "JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present" : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
-		if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct") return decode(normalized.k);
-		if (!Object.isFrozen(key)) {
-			const { key_ops } = key;
-			Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
-		}
-	} else {
-		if (!isKeyLike(key)) throw invalidKeyType(alg, key, secret);
-		const expectedType = secret ? "secret" : privateKey ? "private" : "public";
-		if (key.type !== expectedType && (secret || [
-			"secret",
-			"public",
-			"private"
-		].includes(key.type))) throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
-		if (isCryptoKey(key)) return key;
-		if (keyObject = key, keyObject.type === "secret") return keyObject.export();
-	}
-	cache ||= /* @__PURE__ */ new WeakMap();
-	const cacheKey = key;
-	let cached = cache.get(cacheKey);
-	if (cached?.[alg]) return cached[alg];
-	if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
-		const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({
-			crv,
-			asymmetricKeyType: keyObject.asymmetricKeyType
-		}) ?? entry.subtle;
-		return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
-	}
-	return normalized ??= keyObject.export({ format: "jwk" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);
-}
-var cache;
-var nist = {
-	__proto__: null,
-	prime256v1: "P-256",
-	secp384r1: "P-384",
-	secp521r1: "P-521"
-};
-var isCryptoKey = (key) => {
-	if (key?.[Symbol.toStringTag] === "CryptoKey") return !0;
-	try {
-		return key instanceof CryptoKey;
-	} catch {
-		return !1;
-	}
-}, isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject", isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
-function message(msg, actual, ...types) {
-	if (types.length > 2) {
-		const last = types.pop();
-		msg += `one of type ${types.join(", ")}, or ${last}.`;
-	} else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
-	return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
-}
-function invalidKeyType(alg, actual, secret) {
-	const types = [
-		"CryptoKey",
-		"KeyObject",
-		"JSON Web Key"
-	];
-	return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
-}
-var unusable = (name, prop = "algorithm.name") => /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-function checkUsage(key, usage) {
-	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-}
-function checkModulusLength(alg, key) {
-	const { modulusLength } = key.algorithm;
-	if (typeof modulusLength != "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
-}
-function checkCryptoKey(key, expected, usage) {
-	const algorithm = key.algorithm;
-	if (algorithm.name !== expected.name) throw unusable(expected.name);
-	if (expected.hash && algorithm.hash?.name !== expected.hash) throw unusable(expected.hash, "algorithm.hash");
-	if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve) throw unusable(expected.namedCurve, "algorithm.namedCurve");
-	if (expected.length !== void 0 && algorithm.length !== expected.length) throw unusable(expected.length, "algorithm.length");
-	checkUsage(key, usage);
-}
-function snapshotJwk(jwk) {
-	return {
-		__proto__: null,
-		...jwk
-	};
-}
-function normalizeJwk(jwk) {
-	const normalized = snapshotJwk(jwk);
-	if (normalized.ext !== void 0 && typeof normalized.ext != "boolean") throw new TypeError("\"ext\" (Extractable) Parameter must be a boolean");
-	if (normalized.key_ops !== void 0) {
-		const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
-		if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length) throw new TypeError("\"key_ops\" (Key Operations) Parameter must be an array of unique strings");
-		normalized.key_ops = keyOps;
-	}
-	return normalized;
-}
-async function jwkToKey(entry, jwk, extractable) {
-	if (!entry.kty.includes(jwk.kty)) throw new JOSENotSupported("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
-	const algorithm = entry.resolve?.({
-		kty: jwk.kty,
-		crv: jwk.crv
-	}) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = {
-		...jwk,
-		ext: extractable ?? jwk.ext
-	};
-	return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
-}
-async function rawKey(key, expected, usage, extractable = !1) {
-	return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/lib/key_descriptor.js
-function table(entries) {
-	const out = { __proto__: null };
-	for (const alg in entries) out[alg] = {
-		...entries[alg],
-		alg
-	};
-	return out;
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/lib/jws_algorithms.js
-var sig = [["verify"], ["sign"]];
-function hmac(bits) {
-	const subtle = {
-		name: "HMAC",
-		hash: `SHA-${bits}`
-	};
-	return {
-		kty: ["oct"],
-		secret: !0,
-		subtle,
-		signing: subtle,
-		usages: sig
-	};
-}
-function rsa(bits, saltLength) {
-	const subtle = {
-		name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
-		hash: `SHA-${bits}`
-	};
-	return {
-		kty: ["RSA"],
-		subtle,
-		signing: saltLength ? {
-			...subtle,
-			saltLength
-		} : subtle,
-		usages: sig,
-		minRsaBits: 2048
-	};
-}
-function ecdsa(crv, bits) {
-	return {
-		kty: ["EC"],
-		crv,
-		subtle: {
-			name: "ECDSA",
-			namedCurve: crv
-		},
-		signing: {
-			name: "ECDSA",
-			hash: `SHA-${bits}`
-		},
-		usages: sig
-	};
-}
-function eddsa() {
-	const subtle = { name: "Ed25519" };
-	return {
-		kty: ["OKP"],
-		crv: "Ed25519",
-		subtle,
-		signing: subtle,
-		usages: sig
-	};
-}
-function mldsa(bits) {
-	const subtle = { name: `ML-DSA-${bits}` };
-	return {
-		kty: ["AKP"],
-		subtle,
-		signing: subtle,
-		usages: sig
-	};
-}
-var JWS = table({
-	HS256: hmac(256),
-	HS384: hmac(384),
-	HS512: hmac(512),
-	RS256: rsa(256),
-	RS384: rsa(384),
-	RS512: rsa(512),
-	PS256: rsa(256, 32),
-	PS384: rsa(384, 48),
-	PS512: rsa(512, 64),
-	ES256: ecdsa("P-256", 256),
-	ES384: ecdsa("P-384", 384),
-	ES512: ecdsa("P-521", 512),
-	EdDSA: eddsa(),
-	Ed25519: eddsa(),
-	"ML-DSA-44": mldsa(44),
-	"ML-DSA-65": mldsa(65),
-	"ML-DSA-87": mldsa(87)
-});
-function jwsAlgorithm(alg) {
-	const entry = typeof alg == "string" ? JWS[alg] : void 0;
-	if (!entry) throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-	return entry;
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/lib/jws_verify.js
-function prepareVerify(options) {
-	return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
-}
-function parseProtectedHeader(encodedProtected) {
-	return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
-}
-function encodeCompactUnencodedPayload(payload) {
-	try {
-		return encode$1(payload);
-	} catch {
-		throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
-	}
-}
-async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
-	const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
-	if (!isDisjoint(parsedProt, header)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-	const joseHeader = {
-		...parsedProt,
-		...header
-	}, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
-	if (typeof alg != "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
-	if (shared[0] && !shared[0].has(alg)) throw new JOSEAlgNotAllowed("\"alg\" (Algorithm) Header Parameter value not allowed");
-	if (b64) {
-		if (typeof inputPayload != "string") throw new JWSInvalid("JWS Payload must be a string");
-	} else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array)) throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
-	const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
-	let resolvedKey = !1;
-	typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = !0);
-	const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode$1(encodedProtected) : new Uint8Array(), encode$1("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
-	entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
-	let verified = !1;
-	try {
-		verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
-	} catch {}
-	if (!verified) throw new JWSSignatureVerificationFailed();
-	const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
-	return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{
-		...result,
-		key: k
-	}, b64] : [result, b64];
-}
-async function verifyCompact(jws, shared, key) {
-	if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != "string") throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
-	const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
-	if (length !== 3) throw new JWSInvalid("Invalid Compact JWS");
-	return verifySignature({
-		payload,
-		protected: protectedHeader,
-		signature
-	}, shared, key, encodeCompactUnencodedPayload);
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/lib/jwt_claims_set.js
-var epoch = (date) => Math.floor(date.getTime() / 1e3), multipliers = {
-	s: 1,
-	m: 60,
-	h: 3600,
-	d: 86400,
-	w: 604800,
-	y: 31557600
-}, REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i, checkFailed = "check_failed";
-function invalidDuration() {
-	throw new TypeError("Invalid time period format");
-}
-function secs(str) {
-	typeof str != "string" && invalidDuration();
-	const matched = REGEX.exec(str);
-	(!matched || matched[4] && matched[1]) && invalidDuration();
-	const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
-	return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
-}
-function validateInput(label, input) {
-	if (!Number.isFinite(input)) throw new TypeError(`Invalid ${label} input`);
-	return input;
-}
-function validateStringClaim(claim, value) {
-	if (typeof value != "string") throw new TypeError(`"${claim}" claim must be a string`);
-}
-function validateAudienceClaim(value) {
-	if (typeof value != "string" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != "string"))) throw new TypeError("\"aud\" claim must be a string or an array of strings");
-}
-function numericDate(value, label) {
-	return typeof value == "number" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date()) + secs(value);
-}
-var normalizeTyp = (value) => {
-	const normalized = value.toLowerCase();
-	return value.includes("/") ? normalized : `application/${normalized}`;
-}, checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : !1;
-function validateNumericDate(payload, claim, required = !1) {
-	const value = payload[claim];
-	if (!(value === void 0 && !required)) {
-		if (typeof value != "number") throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
-		return value;
-	}
-}
-function unexpectedClaim(payload, claim) {
-	throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
-}
-function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
-	let payload;
-	try {
-		payload = JSON.parse(strictDecoder.decode(encodedPayload));
-	} catch {}
-	if (!isObject$1(payload)) throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
-	const { typ } = options;
-	if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) throw new JWTClaimValidationFailed("unexpected \"typ\" JWT header value", payload, "typ", checkFailed);
-	const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
-	maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
-	for (const claim of new Set(presenceCheck.reverse())) if (!Object.hasOwn(payload, claim)) throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
-	issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
-	const { clockTolerance } = options;
-	let tolerance = 0;
-	if (typeof clockTolerance == "string") tolerance = secs(clockTolerance);
-	else if (clockTolerance !== void 0) {
-		if (typeof clockTolerance != "number") throw new TypeError("Invalid clockTolerance option type");
-		tolerance = clockTolerance;
-	}
-	validateInput("clockTolerance option", tolerance);
-	const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
-	if (nbf !== void 0 && nbf > now + tolerance) throw new JWTClaimValidationFailed("\"nbf\" claim timestamp check failed", payload, "nbf", checkFailed);
-	const exp = validateNumericDate(payload, "exp");
-	if (exp !== void 0 && exp <= now - tolerance) throw new JWTExpired("\"exp\" claim timestamp check failed", payload, "exp", checkFailed);
-	if (maxTokenAge !== void 0) {
-		const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
-		if (age - tolerance > max) throw new JWTExpired("\"iat\" claim timestamp check failed (too far in the past)", payload, "iat", checkFailed);
-		if (age < -tolerance) throw new JWTClaimValidationFailed("\"iat\" claim timestamp check failed (it should be in the past)", payload, "iat", checkFailed);
-	}
-	return payload;
-}
-var producerPayloads;
-function producerPayload(producer) {
-	return producerPayloads.get(producer);
-}
-function jwtData(producer) {
-	const payload = producerPayload(producer);
-	for (const claim of [
-		"iat",
-		"nbf",
-		"exp"
-	]) {
-		const value = payload[claim];
-		if (typeof value == "number" && !Number.isFinite(value)) throw new TypeError(`"${claim}" claim must be a finite number`);
-	}
-	return encoder.encode(JSON.stringify(payload));
-}
-var JWTClaimsBuilder = class {
-	constructor(payload = {}) {
-		if (!isObject$1(payload)) throw new TypeError("JWT Claims Set MUST be an object");
-		(producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));
-	}
-	setIssuer(value) {
-		return validateStringClaim("iss", value), producerPayload(this).iss = value, this;
-	}
-	setSubject(value) {
-		return validateStringClaim("sub", value), producerPayload(this).sub = value, this;
-	}
-	setAudience(value) {
-		return validateAudienceClaim(value), producerPayload(this).aud = value, this;
-	}
-	setJti(value) {
-		return validateStringClaim("jti", value), producerPayload(this).jti = value, this;
-	}
-	setNotBefore(value) {
-		return producerPayload(this).nbf = numericDate(value, "setNotBefore"), this;
-	}
-	setExpirationTime(value) {
-		return producerPayload(this).exp = numericDate(value, "setExpirationTime"), this;
-	}
-	setIssuedAt(value) {
-		const payload = producerPayload(this);
-		return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == "string" ? payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, "setIssuedAt"), this;
-	}
-};
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/jwt/verify.js
-async function jwtVerify(jwt, key, options) {
-	const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
-	if (!b64) throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-	const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
-	return {
-		...verified,
-		payload
-	};
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/lib/jws_sign.js
-async function createSignature(input, key, rejectUnencoded) {
-	let [payload, protectedHeader, unprotectedHeader, crit] = input, protectedHeaderString = "";
-	if (protectedHeader !== void 0) {
-		const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
-		protectedHeader = normalized[0], protectedHeaderString = encode(normalized[1]);
-	}
-	if (unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0]), !protectedHeader && !unprotectedHeader) throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
-	if (!isDisjoint(protectedHeader, unprotectedHeader)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-	const joseHeader = {
-		...protectedHeader,
-		...unprotectedHeader
-	};
-	validateCritDuplicates(JWSInvalid, protectedHeader);
-	const b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
-	b64 || rejectUnencoded?.();
-	const { alg } = joseHeader;
-	if (typeof alg != "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
-	const entry = jwsAlgorithm(alg);
-	let payloadS = "", payloadB = payload, data;
-	if (b64) {
-		const encoded = input[4];
-		encoded ? (payloadS = encoded[0] ??= encode(payload), payloadB = encoded[1] ??= encode$1(payloadS)) : (payloadS = encode(payload), data = encoder.encode(`${protectedHeaderString}.${payloadS}`));
-	}
-	data ??= concat(encode$1(protectedHeaderString), encode$1("."), payloadB);
-	const k = await rawKey(await prepareKey(entry, key, "sign"), entry.subtle, "sign");
-	entry.minRsaBits && checkModulusLength(entry.alg, k);
-	const jws = {
-		signature: encode(new Uint8Array(await crypto.subtle.sign(entry.signing, k, data))),
-		payload: payloadS
-	};
-	return protectedHeader && (jws.protected = protectedHeaderString), unprotectedHeader && (jws.header = unprotectedHeader), [jws, b64];
-}
-async function createCompactSignature(payload, protectedHeader, crit, key, rejectUnencoded) {
-	const [jws] = await createSignature([
-		payload,
-		protectedHeader,
-		void 0,
-		crit
-	], key, rejectUnencoded);
-	return `${jws.protected}.${jws.payload}.${jws.signature}`;
-}
-//#endregion
-//#region ../../node_modules/jose/dist/webapi/jwt/sign.js
-var SignJWT_base = JWTClaimsBuilder;
-var SignJWT = class extends SignJWT_base {
-	#protectedHeader;
-	setProtectedHeader(protectedHeader) {
-		return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
-	}
-	async sign(key, options) {
-		return createCompactSignature(jwtData(this), this.#protectedHeader, options?.crit, key, () => {
-			throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-		});
-	}
-};
-//#endregion
-//#region src/kernel/moleculer/mesh-mtls/mesh-join-token.ts
-/**
-* Mesh join tokens — single-use JWS ES256 signed with the hub mesh CA key.
-*
-* Payload: `{ v, hubUrl, hubMeshAddress, caFingerprint, nodeId, jti, exp }`. The node id is MANDATORY
-* (D857): a token that does not name the node it is for would let its holder pick any id, `hub` included.
-* `exp` ≤ now + 1 h. `jti` is recorded until expiry so a token cannot be reused.
-*/
-/** In-memory + optional persist of spent `jti` until `exp`. */
-var JoinTokenJtiStore = class {
-	spent = /* @__PURE__ */ new Map();
-	/** True when `jti` was already consumed (and not yet expired). */
-	isSpent(jti, nowSec = Math.floor(Date.now() / 1e3)) {
-		this.gc(nowSec);
-		return this.spent.has(jti);
-	}
-	/** Record a jti as used until `exp`. Returns false if already spent. */
-	consume(jti, exp, nowSec = Math.floor(Date.now() / 1e3)) {
-		this.gc(nowSec);
-		if (this.spent.has(jti)) return false;
-		this.spent.set(jti, exp);
-		return true;
-	}
-	/** Test helper. */
-	size() {
-		return this.spent.size;
-	}
-	gc(nowSec) {
-		for (const [jti, exp] of this.spent) if (exp <= nowSec) this.spent.delete(jti);
-	}
-};
-var processJtiStore = new JoinTokenJtiStore();
-function processJoinTokenJtiStore() {
-	return processJtiStore;
-}
-async function mintMeshJoinToken(input) {
-	if (!isValidAgentNodeId(input.nodeId)) throw new Error(`a join token needs the node id it is for; "${input.nodeId}" is not one an agent may carry`);
-	const now = input.now ?? /* @__PURE__ */ new Date();
-	const nowSec = Math.floor(now.getTime() / 1e3);
-	const exp = nowSec + Math.min(Math.max(1, input.ttlSec ?? 3600), require_constants$8.MESH_JOIN_TOKEN_MAX_TTL_SEC);
-	const jti = input.jti ?? (0, node_crypto.randomBytes)(16).toString("base64url");
-	return new SignJWT({
-		v: 1,
-		hubUrl: input.hubUrl,
-		hubMeshAddress: input.hubMeshAddress,
-		caFingerprint: caFingerprintCompact(input.ca.certPem),
-		nodeId: input.nodeId,
-		jti,
-		exp
-	}).setProtectedHeader({
-		alg: "ES256",
-		typ: "JWT"
-	}).setIssuedAt(nowSec).setExpirationTime(exp).setJti(jti).sign(input.ca.privateKey);
-}
-async function verifyMeshJoinToken(input) {
-	const now = input.now ?? /* @__PURE__ */ new Date();
-	const nowSec = Math.floor(now.getTime() / 1e3);
-	let payload;
-	try {
-		payload = (await jwtVerify(input.token, input.ca.publicKey, {
-			algorithms: ["ES256"],
-			currentDate: now
-		})).payload;
-	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
-		if (/exp/i.test(msg) || /timestamp/i.test(msg)) return {
-			ok: false,
-			reason: "token expired"
-		};
-		return {
-			ok: false,
-			reason: `token signature invalid: ${msg}`
-		};
-	}
-	const claims = parseClaims$1(payload);
-	if (claims === null) return {
-		ok: false,
-		reason: "token claims malformed"
-	};
-	if (claims.exp <= nowSec) return {
-		ok: false,
-		reason: "token expired"
-	};
-	const expectedFp = caFingerprintCompact(input.ca.certPem);
-	if (claims.caFingerprint !== expectedFp) return {
-		ok: false,
-		reason: "token caFingerprint does not match this hub CA"
-	};
-	if (input.expectedCaFingerprint !== void 0 && claims.caFingerprint !== normalizeFp(input.expectedCaFingerprint)) return {
-		ok: false,
-		reason: "token caFingerprint pin mismatch"
-	};
-	const store = input.jtiStore ?? processJtiStore;
-	if (input.consume !== false) {
-		if (!store.consume(claims.jti, claims.exp, nowSec)) return {
-			ok: false,
-			reason: "token already used"
-		};
-	} else if (store.isSpent(claims.jti, nowSec)) return {
-		ok: false,
-		reason: "token already used"
-	};
-	return {
-		ok: true,
-		claims
-	};
-}
-function normalizeFp(fp) {
-	return fp.replace(/:/g, "").toLowerCase();
-}
-function parseClaims$1(payload) {
-	if (payload["v"] !== 1) return null;
-	const hubUrl = payload["hubUrl"];
-	const hubMeshAddress = payload["hubMeshAddress"];
-	const caFingerprint = payload["caFingerprint"];
-	const jti = typeof payload.jti === "string" ? payload.jti : payload["jti"];
-	const exp = typeof payload.exp === "number" ? payload.exp : null;
-	if (typeof hubUrl !== "string" || hubUrl.length === 0) return null;
-	if (typeof hubMeshAddress !== "string" || hubMeshAddress.length === 0) return null;
-	if (typeof caFingerprint !== "string" || caFingerprint.length === 0) return null;
-	if (typeof jti !== "string" || jti.length === 0) return null;
-	if (exp === null) return null;
-	const nodeId = payload["nodeId"];
-	if (typeof nodeId !== "string" || !isValidAgentNodeId(nodeId)) return null;
-	return {
-		v: 1,
-		hubUrl,
-		hubMeshAddress,
-		caFingerprint: normalizeFp(caFingerprint),
-		nodeId,
-		jti,
-		exp
-	};
-}
-//#endregion
-//#region src/kernel/moleculer/mesh-mtls/mesh-enroll.ts
-/**
-* `POST /api/mesh/enroll` — verify join token, issue a 30-day leaf from CSR.
-*/
-async function enrollMeshNode(body, deps) {
-	if (typeof body.token !== "string" || body.token.length === 0) return {
-		ok: false,
-		error: "token is required",
-		status: 400
-	};
-	if (typeof body.csr !== "string" || !body.csr.includes("BEGIN CERTIFICATE REQUEST")) return {
-		ok: false,
-		error: "csr PEM is required",
-		status: 400
-	};
-	const verified = await verifyMeshJoinToken({
-		token: body.token,
-		ca: deps.ca,
-		jtiStore: deps.jtiStore ?? processJoinTokenJtiStore(),
-		now: deps.now,
-		consume: true
-	});
-	if (!verified.ok) {
-		const status = verified.reason.includes("expired") ? 401 : verified.reason.includes("already used") ? 409 : 401;
-		return {
-			ok: false,
-			error: verified.reason,
-			status
-		};
-	}
-	let leaf;
-	try {
-		leaf = await issueMeshLeafFromCsr(deps.ca, body.csr, {
-			expectedNodeId: verified.claims.nodeId,
-			now: deps.now
-		});
-	} catch (err) {
-		return {
-			ok: false,
-			error: err instanceof Error ? err.message : String(err),
-			status: 400
-		};
-	}
-	try {
-		await deps.onIssued?.(leaf.commonName, leaf.certPem);
-	} catch (err) {
-		deps.onRecordFailed?.(leaf.commonName, err);
-	}
-	return {
-		ok: true,
-		cert: leaf.certPem,
-		caCert: deps.ca.certPem,
-		nodeId: leaf.commonName,
-		notAfter: leaf.notAfter.toISOString(),
-		serialNumber: leaf.serialNumber
-	};
-}
-//#endregion
 //#region src/kernel/moleculer/mesh-mtls/mesh-tls-enabler.ts
 var SLOT = Symbol.for("camstack.mesh.tls-enabler");
 function setProcessMeshTlsEnabler(enabler) {
@@ -27751,7 +26774,7 @@ var require_index_min = /* @__PURE__ */ require_chunk.__commonJSMin(((exports) =
 var require_shard = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, module) => {
 	var _ = require_lodash();
 	var BaseStrategy = require_base$7();
-	var crypto$4 = require("crypto");
+	var crypto$3 = require("crypto");
 	var { LRUCache } = require_index_min();
 	var { isFunction, randomInt } = require_utils$3();
 	/**
@@ -27857,7 +26880,7 @@ var require_shard = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, modul
 		* @memberof ShardStrategy
 		*/
 		getHash(key) {
-			const hash = crypto$4.createHash("md5").update(key).digest("hex");
+			const hash = crypto$3.createHash("md5").update(key).digest("hex");
 			const hashNum = parseInt(hash.substring(0, 8), 16);
 			return this.opts.ringSize ? hashNum % this.opts.ringSize : hashNum;
 		}
@@ -49115,7 +48138,7 @@ var require_validators$1 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports
 //#region ../../node_modules/moleculer/src/cachers/base.js
 var require_base$2 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, module) => {
 	var _ = require_lodash();
-	var crypto$3 = require("crypto");
+	var crypto$2 = require("crypto");
 	var { METRIC } = require_metrics$1();
 	var { isObject, isFunction, isDate } = require_utils$3();
 	/**
@@ -49379,7 +48402,7 @@ var require_base$2 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, modu
 			const maxParamsLength = this.opts.maxParamsLength;
 			if (!maxParamsLength || maxParamsLength < 44 || key.length <= maxParamsLength) return key;
 			const prefixLength = maxParamsLength - 44;
-			const base64Hash = crypto$3.createHash("sha256").update(key).digest("base64");
+			const base64Hash = crypto$2.createHash("sha256").update(key).digest("base64");
 			if (prefixLength < 1) return base64Hash;
 			return key.substring(0, prefixLength) + base64Hash;
 		}
@@ -76127,7 +75150,7 @@ var require_hot_reload = /* @__PURE__ */ require_chunk.__commonJSMin(((exports,
 //#endregion
 //#region ../../node_modules/moleculer/src/middlewares/transmit/encryption.js
 var require_encryption = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, module) => {
-	var crypto$2 = require("crypto");
+	var crypto$1 = require("crypto");
 	/**
 	* This is a AES encryption middleware to protect the whole
 	* Moleculer transporter communication with AES.
@@ -76150,14 +75173,14 @@ var require_encryption = /* @__PURE__ */ require_chunk.__commonJSMin(((exports,
 			},
 			transporterSend(next) {
 				return (topic, data, meta) => {
-					const encrypter = iv ? crypto$2.createCipheriv(algorithm, password, iv) : crypto$2.createCipher(algorithm, password);
+					const encrypter = iv ? crypto$1.createCipheriv(algorithm, password, iv) : crypto$1.createCipher(algorithm, password);
 					return next(topic, Buffer.concat([encrypter.update(data), encrypter.final()]), meta);
 				};
 			},
 			transporterReceive(next) {
 				return (cmd, data, s) => {
 					try {
-						const decrypter = iv ? crypto$2.createDecipheriv(algorithm, password, iv) : crypto$2.createDecipher(algorithm, password);
+						const decrypter = iv ? crypto$1.createDecipheriv(algorithm, password, iv) : crypto$1.createDecipher(algorithm, password);
 						return next(cmd, Buffer.concat([decrypter.update(data), decrypter.final()]), s);
 					} catch (err) {
 						logger.error("Received packet decryption error.", err);
@@ -83652,7 +82675,7 @@ var require_main = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, module
 	var fs$4 = require("fs");
 	var path$3 = require("path");
 	var os$4 = require("os");
-	var crypto$1 = require("crypto");
+	var crypto = require("crypto");
 	var TIPS = [
 		"◈ encrypted .env [www.dotenvx.com]",
 		"◈ secrets for agents [www.dotenvx.com]",
@@ -83857,7 +82880,7 @@ var require_main = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, module
 		const authTag = ciphertext.subarray(-16);
 		ciphertext = ciphertext.subarray(12, -16);
 		try {
-			const aesgcm = crypto$1.createDecipheriv("aes-256-gcm", key, nonce);
+			const aesgcm = crypto.createDecipheriv("aes-256-gcm", key, nonce);
 			aesgcm.setAuthTag(authTag);
 			return `${aesgcm.update(ciphertext)}${aesgcm.final()}`;
 		} catch (error) {
@@ -88018,6 +87041,11 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 			this.logger.warn("Dropping mesh packet — an enrolled agent accepts TLS from the hub only");
 			return;
 		}
+		const wireSender = peekSender(this, type, message);
+		if (wireSender === null || wireSender === this.nodeID) {
+			this.logger.warn(wireSender === null ? "Dropping mesh packet - it names no sender" : "Dropping mesh packet - it claims this node as its sender");
+			return;
+		}
 		if (socket !== void 0 && isTlsSocket(socket)) {
 			const tlsSock = socket;
 			const identity = tlsSock.meshPeerCn ? {
@@ -88033,9 +87061,8 @@ var TlsTcpTransporter = class extends TcpTransporterBase {
 				tlsSock.destroy();
 				return;
 			}
-			const sender = peekSender(this, type, message);
-			if (sender !== null && sender !== identity.cn) {
-				this.logger.warn(`Dropping forged mesh packet — sender=${sender} peerCN=${identity.cn}`);
+			if (wireSender !== identity.cn) {
+				this.logger.warn(`Dropping forged mesh packet — sender=${wireSender} peerCN=${identity.cn}`);
 				return;
 			}
 			tlsSock.meshPeerCn = identity.cn;
@@ -89297,170 +88324,10 @@ var HubPairing = class {
 	}
 };
 //#endregion
-//#region src/builtins/system-config/cluster-secret-keeper.ts
-/**
-* Keeps the hub's cluster-secret gate in step with System → Cluster (D797,
-* D802).
-*
-* The field is a `password` of `system-config`: its `system-settings` row
-* (`cluster.clusterSecret`) holds a keychain marker, the value lives in the
-* keychain (owner `system`). The gate the mesh join reads:
-*
-*  - no marker            → the secret is MANDATORY (D802): the keeper asks
-*                           its owner to generate one (`generateSecret`), and
-*                           until that succeeds the gate is `off` — no node can
-*                           authenticate (mesh auth is always enforced, D821);
-*  - marker + value       → `on`  — nodes prove the secret;
-*  - marker, no answer    → `unknown` — refused, retryably, and retried here.
-*    A locked keychain or a value lost to a reset NEVER opens the gate, and
-*    never triggers a generation (the operator decides what replaces a value
-*    the keychain lost).
-*
-* It also publishes the mesh mode (`cluster.meshAuth`, `mesh-auth-mode.ts`).
-*/
-/** The field key inside the `cluster` section. */
-var CLUSTER_SECRET_FIELD = "clusterSecret";
-var ClusterSecretKeeper = class {
-	deps;
-	retryTimer = null;
-	unsubscribe = null;
-	stopped = false;
-	last = null;
-	constructor(deps) {
-		this.deps = deps;
-	}
-	async start() {
-		this.unsubscribe = this.deps.secrets?.onChange((ref) => {
-			if (ref === require_constants$8.CLUSTER_SECRET_REF) this.reload();
-		}) ?? null;
-		await this.reload();
-	}
-	stop() {
-		this.stopped = true;
-		if (this.retryTimer !== null) clearTimeout(this.retryTimer);
-		this.retryTimer = null;
-		this.unsubscribe?.();
-		this.unsubscribe = null;
-	}
-	/** Re-read the row and the keychain; publish the gate. */
-	async reload() {
-		if (this.stopped) return;
-		let gate = await this.compute();
-		if (gate.kind === "off" && this.deps.generateSecret !== void 0 && !this.stopped) gate = await this.generate();
-		if (this.stopped) return;
-		require_constants$8.setProcessClusterSecretGate(gate);
-		this.report(gate);
-		if (gate.kind === "unknown" || gate.kind === "off" && this.deps.generateSecret !== void 0) this.scheduleRetry();
-	}
-	async generate() {
-		try {
-			await this.deps.generateSecret?.();
-		} catch (err) {
-			this.deps.logger.error("The cluster secret is mandatory but could not be generated yet — retrying. Agents cannot authenticate until it exists.", { meta: { error: errText(err) } });
-			return { kind: "off" };
-		}
-		this.deps.logger.info("Generated the cluster secret (none was stored). Reveal it on System → Cluster and enter it in each agent.");
-		return this.compute();
-	}
-	async compute() {
-		let section;
-		try {
-			section = await this.deps.readSection();
-		} catch (err) {
-			return {
-				kind: "unknown",
-				reason: `settings unreadable: ${errText(err)}`
-			};
-		}
-		setProcessMeshAuthMode("enforced");
-		const stored = section[CLUSTER_SECRET_FIELD];
-		if (stored === void 0 || stored === null || stored === "") return { kind: "off" };
-		if (!require_dist.isSecretMarker(stored)) return {
-			kind: "unknown",
-			reason: "stored inline, not in the keychain — set it again in System → Cluster"
-		};
-		const secrets = this.deps.secrets;
-		if (secrets === null) return {
-			kind: "unknown",
-			reason: "no keychain door in this process"
-		};
-		let entry;
-		try {
-			entry = (await secrets.resolve([require_constants$8.CLUSTER_SECRET_REF]))[require_constants$8.CLUSTER_SECRET_REF];
-		} catch (err) {
-			return {
-				kind: "unknown",
-				reason: errText(err)
-			};
-		}
-		if (entry === void 0) return {
-			kind: "unknown",
-			reason: "no-answer"
-		};
-		switch (entry.kind) {
-			case "value": return {
-				kind: "on",
-				hash: require_constants$8.hashClusterSecret(entry.value)
-			};
-			case "unavailable": return {
-				kind: "unknown",
-				reason: entry.reason
-			};
-			case "missing": return {
-				kind: "unknown",
-				reason: "the stored value is gone — set it again in System → Cluster"
-			};
-			case "forbidden": return {
-				kind: "unknown",
-				reason: "forbidden"
-			};
-		}
-	}
-	report(gate) {
-		const changed = this.last !== gate.kind;
-		this.last = gate.kind;
-		if (gate.kind === "unknown") {
-			this.deps.logger.error("Agents cannot register: a cluster secret is set but cannot be read from the keychain. Registrations are refused until it can (no fallback).", { meta: { reason: gate.reason } });
-			return;
-		}
-		if (changed) this.deps.logger.info(gate.kind === "on" ? "Cluster secret set — agents prove it to join the mesh" : "No cluster secret yet — no node can authenticate to the mesh");
-	}
-	scheduleRetry() {
-		if (this.stopped || this.retryTimer !== null) return;
-		this.retryTimer = setTimeout(() => {
-			this.retryTimer = null;
-			this.reload();
-		}, this.deps.retryMs ?? 3e4);
-		this.retryTimer.unref?.();
-	}
-};
-function errText(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-//#endregion
 //#region src/builtins/system-config/mesh-actions.ts
 /**
-* System → Cluster — mint a single-use mesh join token (Release A) and
-* agent-ui unlock tickets (D821).
+* System → Cluster — agent-ui unlock tickets (D821).
 */
-var mintJoinTokenInputSchema = zod.z.object({
-	/** The node id the token is for - mandatory: the CSR CN must be exactly this. */
-	nodeId: zod.z.string().min(1),
-	/** Override hub HTTPS base (default: local-network publicEndpoint). */
-	hubUrl: zod.z.string().url().optional(),
-	/** Override `host:6443` TLS mesh address carried in the token. */
-	hubMeshAddress: zod.z.string().min(3).optional(),
-	/** Seconds until expiry; capped at 1 h. */
-	ttlSec: zod.z.number().int().positive().max(3600).optional()
-});
-var mintJoinTokenOutputSchema = zod.z.object({
-	token: zod.z.string().min(1),
-	exp: zod.z.number().int(),
-	hubUrl: zod.z.string(),
-	hubMeshAddress: zod.z.string(),
-	caFingerprint: zod.z.string(),
-	nodeId: zod.z.string()
-});
 var mintAgentUiUnlockInputSchema = zod.z.object({
 	nodeId: zod.z.string().min(1),
 	/**
@@ -89475,17 +88342,12 @@ var mintAgentUiUnlockOutputSchema = zod.z.object({
 	nodeId: zod.z.string().min(1),
 	dashboardUrl: zod.z.string().url().optional()
 });
-var systemConfigMeshActions = require_dist.defineCustomActions({
-	mintJoinToken: require_dist.customAction(mintJoinTokenInputSchema, mintJoinTokenOutputSchema, {
-		kind: "mutation",
-		auth: "admin"
-	}),
-	/** Hub admin → short-lived ticket the agent redeems for a tab session (D821). */
-	mintAgentUiUnlockTicket: require_dist.customAction(mintAgentUiUnlockInputSchema, mintAgentUiUnlockOutputSchema, {
-		kind: "mutation",
-		auth: "admin"
-	})
-});
+var systemConfigMeshActions = require_dist.defineCustomActions({ 
+/** Hub admin → short-lived ticket the agent redeems for a tab session (D821). */
+mintAgentUiUnlockTicket: require_dist.customAction(mintAgentUiUnlockInputSchema, mintAgentUiUnlockOutputSchema, {
+	kind: "mutation",
+	auth: "admin"
+}) });
 //#endregion
 //#region src/builtins/system-config/system-config.addon.ts
 /** How often superseded and expired mesh certificate rows are reaped. */
@@ -89503,10 +88365,9 @@ var MESH_REAP_MS = 24 * 36e5;
 *   - server     (port, host, dataPath — READ-ONLY, loaded from config.yaml at bootstrap)
 *   - auth       (tokenExpiry = session lifetime, accessTokenExpiry, trustedProxies,
 *                 trustedNetworks)
-*   - cluster    (clusterSecret — a `password` field: the value goes to the
-*                 keychain, owner `system`; the row keeps a marker. Also drawn
-*                 on System → Cluster. D797. MANDATORY and generated at first
-*                 boot; `meshAuth` — transition / enforced. D802)
+*   - cluster    (no operator field remains: the cluster secret and the mesh auth
+*                 mode were removed by D857 — a node's identity is its mesh
+*                 certificate, and agents are paired, not given a secret)
 *
 * Sections NOT exposed (each owned by the addon that implements them):
 *   - logging    → `winston-logging` addon (level + retention)
@@ -89549,12 +88410,13 @@ var KEY_TO_SECTION = {
 	tokenExpiry: "auth",
 	accessTokenExpiry: "auth",
 	trustedProxies: "auth",
-	trustedNetworks: "auth",
-	[CLUSTER_SECRET_FIELD]: "cluster",
-	[MESH_AUTH_MODE_FIELD]: "cluster"
+	trustedNetworks: "auth"
 };
-/** Bytes of a generated cluster secret (D802) — 256 bits, base64url (43 chars). */
-var GENERATED_SECRET_BYTES = 32;
+/**
+* Keys a pre-D857 form may still send. They are dropped with a line, never
+* written: the cluster secret and the mesh auth mode no longer exist.
+*/
+var RETIRED_CLUSTER_KEYS = new Set(["clusterSecret", "meshAuth"]);
 /**
 * Auth keys holding a list of networks (CIDR or single address). A save with
 * an entry that does not parse is REFUSED whole: dropping it would trust less
@@ -89565,7 +88427,6 @@ var CIDR_LIST_KEYS = new Set(["trustedProxies", "trustedNetworks"]);
 var SYSTEM_CONFIG_CLUSTER_SECTION_ID = "system-config-cluster";
 var SystemConfigAddon = class extends require_dist.BaseAddon {
 	id = "system-config";
-	clusterSecretKeeper = null;
 	meshCaKeeper = null;
 	meshReapTimer = null;
 	meshGateTimers = /* @__PURE__ */ new Set();
@@ -89575,20 +88436,6 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		super({});
 	}
 	async onInitialize() {
-		this.clusterSecretKeeper = new ClusterSecretKeeper({
-			secrets: this.systemSecrets(),
-			readSection: async () => await this.ctx.settings?.getSection("cluster") ?? {},
-			logger: this.ctx.logger,
-			generateSecret: () => this.generateClusterSecret()
-		});
-		setProcessMeshEnforcer(async (reason) => {
-			await this.writeMeshAuthMode("enforced");
-			this.ctx.logger.info("Mesh authentication is now ENFORCED", { meta: { reason } });
-		});
-		await this.clusterSecretKeeper.start();
-		try {
-			await this.writeMeshAuthMode("enforced");
-		} catch {}
 		this.meshCaKeeper = new MeshCaKeeper({
 			secrets: this.systemSecrets(),
 			readClusterSection: async () => await this.ctx.settings?.getSection("cluster") ?? {},
@@ -89602,14 +88449,10 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		this.ctx.logger.info("Initialized — exposes yml-backed sections via getGlobalSettings");
 		return {
 			customActions: systemConfigMeshActions,
-			actionHandlers: {
-				mintJoinToken: async (input) => this.mintJoinToken(parseMintJoinTokenInput(input)),
-				mintAgentUiUnlockTicket: async (input) => this.mintAgentUiUnlock(parseMintUnlockInput(input))
-			}
+			actionHandlers: { mintAgentUiUnlockTicket: async (input) => this.mintAgentUiUnlock(parseMintUnlockInput(input)) }
 		};
 	}
 	async onShutdown() {
-		setProcessMeshEnforcer(null);
 		setProcessMeshCertificateRegistry(null);
 		setProcessMeshTlsListenerState(null);
 		require_agent_https.setProcessAgentHttpsNames(null);
@@ -89620,8 +88463,6 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 		this.meshGateTimers.clear();
 		this.meshCaKeeper?.stop();
 		this.meshCaKeeper = null;
-		this.clusterSecretKeeper?.stop();
-		this.clusterSecretKeeper = null;
 	}
 	/**
 	* The hub's record of mesh leaves (D856): declared and loaded BEFORE the TLS
@@ -89712,32 +88553,9 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			onError: (err) => this.ctx.logger.error("Mesh certificate registry failed to load", { meta: { error: err instanceof Error ? err.message : String(err) } })
 		});
 	}
-	async mintJoinToken(input) {
-		const ca = requireProcessMeshCa();
-		const hubUrl = input.hubUrl ?? await this.resolveHubUrl();
-		const hubMeshAddress = input.hubMeshAddress ?? await this.resolveHubMeshAddress();
-		const token = await mintMeshJoinToken({
-			ca,
-			hubUrl,
-			hubMeshAddress,
-			nodeId: input.nodeId,
-			...input.ttlSec !== void 0 ? { ttlSec: input.ttlSec } : {}
-		});
-		return {
-			token,
-			exp: readJwtExp(token),
-			hubUrl,
-			hubMeshAddress,
-			caFingerprint: caFingerprintCompact(ca.certPem),
-			nodeId: input.nodeId
-		};
-	}
 	/** D821 — short-lived ticket for the agent's `:4444` unlock session. */
 	async mintAgentUiUnlock(input) {
-		const secrets = this.systemSecrets();
-		if (secrets === null) throw new Error("system-config: no keychain door — cannot mint an unlock ticket");
-		const entry = (await secrets.resolve([require_constants$8.CLUSTER_SECRET_REF]))[require_constants$8.CLUSTER_SECRET_REF];
-		if (entry?.kind !== "value") throw new Error("system-config: cluster secret is not available — cannot mint an unlock ticket");
+		const ca = requireProcessMeshCa();
 		if (input.dashboardBaseUrl !== void 0) {
 			const origins = await this.readAgentDashboardOrigins();
 			if (!isAllowedAgentDashboardReturnTo(input.dashboardBaseUrl, origins)) throw new Error("dashboardBaseUrl is not an allowed agent dashboard origin (:4444 or agentDashboardOrigins)");
@@ -89745,10 +88563,10 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			if (!isKnownAgentAddress(input.dashboardBaseUrl, known, origins)) throw new Error(`dashboardBaseUrl is not an address this hub knows for "${input.nodeId}" - open the agent at its own address`);
 		}
 		const ticket = mintAgentUiUnlockTicket({
-			secretHash: require_constants$8.hashClusterSecret(entry.value),
+			caKeyPem: ca.keyPem,
 			nodeId: input.nodeId
 		});
-		const payloadJson = Buffer.from(ticket.split(".")[0] ?? "", "base64url").toString("utf8");
+		const payloadJson = Buffer.from(ticket.split(".")[1] ?? "", "base64url").toString("utf8");
 		const exp = JSON.parse(payloadJson).exp ?? 0;
 		const dashboardUrl = input.dashboardBaseUrl === void 0 ? void 0 : (() => {
 			const u = new URL(input.dashboardBaseUrl);
@@ -89769,24 +88587,6 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			return [];
 		}
 	}
-	async resolveHubUrl() {
-		try {
-			const book = await this.ctx.api?.localNetwork?.getAddresses?.query({ scheme: "https" });
-			const url = book?.roles?.publicEndpoint?.resolved ?? book?.roles?.internal?.resolved ?? null;
-			if (typeof url === "string" && url.length > 0) return url;
-		} catch {}
-		const host = (await this.ctx.settings?.getSection("server"))?.["host"];
-		const port = (await this.ctx.settings?.getSection("server"))?.["port"];
-		return `https://${typeof host === "string" && host.length > 0 && host !== "0.0.0.0" ? host : "127.0.0.1"}:${typeof port === "number" ? port : Number(port) || 4443}`;
-	}
-	async resolveHubMeshAddress() {
-		try {
-			const base = (await this.ctx.api?.localNetwork?.getAddresses?.query({}))?.roles?.internal?.resolved;
-			if (typeof base === "string" && base.length > 0) return `${new URL(base).hostname}:${require_constants$8.DEFAULT_HUB_TLS_TCP_PORT}`;
-		} catch {}
-		const host = (await this.ctx.settings?.getSection("server"))?.["host"];
-		return `${typeof host === "string" && host.length > 0 && host !== "0.0.0.0" ? host : "127.0.0.1"}:${require_constants$8.DEFAULT_HUB_TLS_TCP_PORT}`;
-	}
 	/** The keychain handle for owner `system`; `null` where there is no door. */
 	systemSecrets() {
 		const forOwner = this.ctx.secrets?.forOwner ?? null;
@@ -89879,14 +88679,9 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			{
 				id: SYSTEM_CONFIG_CLUSTER_SECTION_ID,
 				title: SECTION_TITLES["cluster"],
-				description: "Agents joining this hub. Every agent proves the cluster secret when it connects (challenge–response; the secret never crosses the network).",
+				description: "Agents join this hub by pairing (System → Cluster → Agents): the hub signs a certificate for the agent after the operator confirms the same 6-digit code on the hub and in the agent's own page. There is no shared cluster secret.",
 				columns: 1,
-				fields: [{
-					type: "password",
-					key: CLUSTER_SECRET_FIELD,
-					label: "Cluster secret",
-					description: "Reveal and copy into each agent to pair. Saving a new value rotates it for every agent."
-				}]
+				fields: []
 			}
 		] };
 	}
@@ -89909,9 +88704,9 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 	}
 	/**
 	* The admin UI / `addonSettings` cap prefer {@link BaseAddon.updateGlobalSettingsAsOperator}.
-	* That BaseAddon path writes the generic addon store and never reaches
-	* {@link writeClusterSection}. Route the operator write through the same
-	* section-aware path as {@link updateGlobalSettings}.
+	* That BaseAddon path writes the generic addon store and never reaches the
+	* yml sections. Route the operator write through the same section-aware path
+	* as {@link updateGlobalSettings}.
 	*/
 	async updateGlobalSettingsAsOperator(patch, _nodeId) {
 		await this.updateGlobalSettings(patch);
@@ -89928,6 +88723,10 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 				this.ctx.logger.warn("cluster.agentDashboardOrigins is no longer writable from settings — ignoring this patch");
 				continue;
 			}
+			if (RETIRED_CLUSTER_KEYS.has(key)) {
+				this.ctx.logger.warn(`cluster.${key} is retired (D857) — agents are paired by certificate; ignoring this patch`);
+				continue;
+			}
 			const section = KEY_TO_SECTION[key];
 			if (section === void 0) {
 				this.ctx.logger.warn("update ignored unknown key (not mapped to any section)", { meta: { key } });
@@ -89949,10 +88748,6 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			bucket[key] = value;
 		}
 		for (const [section, sectionPatch] of perSection) {
-			if (section === "cluster") {
-				await this.writeClusterSection(sectionPatch);
-				continue;
-			}
 			await this.ctx.settings.setSection(section, sectionPatch);
 			this.ctx.logger.info("Wrote keys to section", { meta: {
 				section,
@@ -89960,79 +88755,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 			} });
 		}
 	}
-	/**
-	* The cluster secret's save path: the value goes to the keychain (owner
-	* `system`), the row gets the marker; `''` / a view keeps. `$secretClear` is
-	* REFUSED: the secret is mandatory (D802). A value the keychain cannot store
-	* is REFUSED — never written inline (D787, P5). Mesh auth mode is always
-	* enforced (D821) — a legacy `meshAuth` in the patch is ignored.
-	*/
-	async writeClusterSection(patch) {
-		const { [MESH_AUTH_MODE_FIELD]: _legacyMode, ...secretPatch } = patch;
-		await this.writeMeshAuthMode("enforced");
-		if (Object.keys(secretPatch).length === 0) return;
-		if (require_dist.isSecretClear(secretPatch["clusterSecret"])) throw new Error("The cluster secret is mandatory and cannot be cleared — save a new value to rotate it");
-		await this.storeClusterSecret(secretPatch);
-		this.ctx.logger.info("Cluster secret updated");
-		await this.clusterSecretKeeper?.reload();
-	}
-	/** Persist + publish mesh auth mode (always `enforced` after D821). */
-	async writeMeshAuthMode(mode) {
-		await this.ctx.settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: mode });
-		setProcessMeshAuthMode(mode);
-	}
-	/**
-	* First boot, or a keychain reset that cleared the marker (D802): a fresh
-	* random secret, stored like an operator save. Mesh auth stays enforced
-	* (D821) — every agent must present the secret; there is no transition window.
-	*/
-	async generateClusterSecret() {
-		const settings = this.ctx.settings;
-		const secrets = this.systemSecrets();
-		if (!settings || secrets === null) throw new Error("system-config: no keychain door — the cluster secret cannot be generated");
-		const existing = (await secrets.resolve([require_constants$8.CLUSTER_SECRET_REF]))[require_constants$8.CLUSTER_SECRET_REF];
-		if (existing?.kind === "value") {
-			await settings.setSection("cluster", { [CLUSTER_SECRET_FIELD]: require_dist.makeSecretMarker(require_constants$8.CLUSTER_SECRET_REF) });
-			this.ctx.logger.warn("The cluster secret row was empty but the keychain holds a value — re-adopted it");
-			return;
-		}
-		if (existing?.kind !== "missing") throw new Error(`the keychain cannot answer for the cluster secret (${existing?.kind ?? "no answer"})`);
-		const value = (0, node_crypto.randomBytes)(GENERATED_SECRET_BYTES).toString("base64url");
-		await this.storeClusterSecret({ [CLUSTER_SECRET_FIELD]: value });
-		await settings.setSection("cluster", { [MESH_AUTH_MODE_FIELD]: "enforced" });
-		setProcessMeshAuthMode("enforced");
-	}
-	async storeClusterSecret(patch) {
-		const settings = this.ctx.settings;
-		if (!settings) throw new Error("system-config: ctx.settings not available");
-		const secrets = this.systemSecrets();
-		if (secrets === null) throw new Error("system-config: no keychain door — the cluster secret cannot be stored");
-		const stored = await settings.getSection("cluster");
-		const result = await require_dist.transformSecretWrite({
-			tree: require_dist.secretTreeFromSchema(this.buildGlobalSchema()),
-			secrets,
-			patch,
-			stored,
-			operatorWrite: true
-		});
-		if (Object.keys(result.patch).length > 0) await settings.setSection("cluster", result.patch);
-		const { orphaned } = await result.afterWrite();
-		if (orphaned.length > 0) this.ctx.logger.warn("an old cluster secret value could not be deleted from the keychain", { meta: { refs: orphaned } });
-	}
 };
-function parseMintJoinTokenInput(input) {
-	if (input === null || input === void 0 || typeof input !== "object") throw new Error("system-config: mintJoinToken requires { nodeId }");
-	const nodeId = Reflect.get(input, "nodeId");
-	if (typeof nodeId !== "string" || nodeId.length === 0) throw new Error("system-config: mintJoinToken requires { nodeId } - the node the token is for");
-	const out = { nodeId };
-	const hubUrl = Reflect.get(input, "hubUrl");
-	const hubMeshAddress = Reflect.get(input, "hubMeshAddress");
-	const ttlSec = Reflect.get(input, "ttlSec");
-	if (typeof hubUrl === "string") out.hubUrl = hubUrl;
-	if (typeof hubMeshAddress === "string") out.hubMeshAddress = hubMeshAddress;
-	if (typeof ttlSec === "number") out.ttlSec = ttlSec;
-	return out;
-}
 function parseMintUnlockInput(input) {
 	if (input === null || typeof input !== "object") throw new Error("system-config: mintAgentUiUnlockTicket requires { nodeId }");
 	const nodeId = Reflect.get(input, "nodeId");
@@ -90043,19 +88766,8 @@ function parseMintUnlockInput(input) {
 		...typeof dashboardBaseUrl === "string" ? { dashboardBaseUrl } : {}
 	};
 }
-/** Read `exp` from an unencrypted JWT payload (no verify — already minted here). */
-function readJwtExp(token) {
-	const parts = token.split(".");
-	if (parts.length < 2 || parts[1] === void 0) return 0;
-	const json = Buffer.from(parts[1], "base64url").toString("utf8");
-	const payload = JSON.parse(json);
-	if (payload === null || typeof payload !== "object") return 0;
-	const exp = Reflect.get(payload, "exp");
-	return typeof exp === "number" ? exp : 0;
-}
 //#endregion
 exports.AGENT_DASHBOARD_ORIGINS_FIELD = AGENT_DASHBOARD_ORIGINS_FIELD;
-exports.AGENT_UI_UNLOCK_DOMAIN = AGENT_UI_UNLOCK_DOMAIN;
 exports.AGENT_UI_UNLOCK_TTL_MS = AGENT_UI_UNLOCK_TTL_MS;
 exports.AGENT_UI_UNLOCK_TYP = AGENT_UI_UNLOCK_TYP;
 exports.AGENT_UI_UNLOCK_USE = AGENT_UI_UNLOCK_USE;
@@ -90063,8 +88775,6 @@ exports.AGENT_UI_UNLOCK_VERSION = AGENT_UI_UNLOCK_VERSION;
 exports.AgentPairing = AgentPairing;
 exports.Errors = Errors;
 exports.HubPairing = HubPairing;
-exports.JoinTokenJtiStore = JoinTokenJtiStore;
-exports.MESH_AUTH_MODE_FIELD = MESH_AUTH_MODE_FIELD;
 exports.MESH_NODE_CERTIFICATES_COLLECTION = MESH_NODE_CERTIFICATES_COLLECTION;
 exports.MESH_NODE_CERTIFICATES_COLUMNS = MESH_NODE_CERTIFICATES_COLUMNS;
 exports.MESH_TLS_PORT_HELLO_FIELD = MESH_TLS_PORT_HELLO_FIELD;
@@ -90085,7 +88795,6 @@ exports.ServiceBroker = ServiceBroker;
 exports.SystemConfigAddon = SystemConfigAddon;
 exports.default = SystemConfigAddon;
 exports.TlsTcpTransporter = TlsTcpTransporter;
-exports.Transporters = Transporters;
 exports.UnlockTicketJtiStore = UnlockTicketJtiStore;
 exports.caFingerprint = caFingerprint;
 exports.caFingerprintCompact = caFingerprintCompact;
@@ -90097,12 +88806,9 @@ exports.describeCsr = describeCsr;
 exports.describeMeshLeaf = describeMeshLeaf;
 exports.dropProcessPeer = dropProcessPeer;
 exports.emitProcessNodeRegistered = emitProcessNodeRegistered;
-exports.enrollMeshNode = enrollMeshNode;
 exports.exportMeshPrivateKeyPem = exportMeshPrivateKeyPem;
 exports.generateMeshCa = generateMeshCa;
 exports.generateMeshKeyPair = generateMeshKeyPair;
-exports.getProcessMeshAuthMode = getProcessMeshAuthMode;
-exports.getProcessMeshAuthStatus = getProcessMeshAuthStatus;
 exports.getProcessMeshCaState = getProcessMeshCaState;
 exports.getProcessMeshCertificateRegistry = getProcessMeshCertificateRegistry;
 exports.getProcessMeshTlsListenerState = getProcessMeshTlsListenerState;
@@ -90110,7 +88816,6 @@ exports.getProcessNodeMeshTransport = getProcessNodeMeshTransport;
 exports.getProcessPeerLeaf = getProcessPeerLeaf;
 exports.hubHostFromMeshAddress = hubHostFromMeshAddress;
 exports.isAllowedAgentDashboardReturnTo = isAllowedAgentDashboardReturnTo;
-exports.isMeshAuthMode = isMeshAuthMode;
 exports.isProcessVerifiedMeshPeer = isProcessVerifiedMeshPeer;
 exports.isValidAgentNodeId = isValidAgentNodeId;
 exports.issueMeshLeafForNode = issueMeshLeafForNode;
@@ -90118,31 +88823,21 @@ exports.issueMeshLeafFromCsr = issueMeshLeafFromCsr;
 exports.keyFingerprintShort = keyFingerprintShort;
 exports.loadMeshCa = loadMeshCa;
 exports.mintAgentUiUnlockTicket = mintAgentUiUnlockTicket;
-exports.mintAgentUiUnlockTicketEs256 = mintAgentUiUnlockTicketEs256;
-exports.mintMeshJoinToken = mintMeshJoinToken;
 exports.normalizeIp = normalizeIp;
 exports.onProcessNodeRegistered = onProcessNodeRegistered;
 exports.openMeshTlsWhenRevocationsLoaded = openMeshTlsWhenRevocationsLoaded;
 exports.parseAgentDashboardOrigins = parseAgentDashboardOrigins;
 exports.parseCidrList = parseCidrList;
-exports.parseMeshAuthMode = parseMeshAuthMode;
-exports.processJoinTokenJtiStore = processJoinTokenJtiStore;
 exports.processMeshCrl = processMeshCrl;
 exports.readCidrSetting = readCidrSetting;
 exports.renewMeshCertificate = renewMeshCertificate;
-exports.requestProcessMeshEnforcement = requestProcessMeshEnforcement;
 exports.requireProcessMeshCa = requireProcessMeshCa;
 exports.revokeMeshCertificate = revokeMeshCertificate;
-exports.setProcessMeshAuthMode = setProcessMeshAuthMode;
-exports.setProcessMeshAuthStatusSource = setProcessMeshAuthStatusSource;
 exports.setProcessMeshCertificateRegistry = setProcessMeshCertificateRegistry;
-exports.setProcessMeshEnforcer = setProcessMeshEnforcer;
 exports.setProcessMeshPeerTransportLookup = setProcessMeshPeerTransportLookup;
 exports.setProcessMeshTlsEnabler = setProcessMeshTlsEnabler;
 exports.setProcessMeshTlsListenerState = setProcessMeshTlsListenerState;
 exports.signPairingProof = signPairingProof;
 exports.systemConfigMeshActions = systemConfigMeshActions;
 exports.verifyAgentUiUnlockTicket = verifyAgentUiUnlockTicket;
-exports.verifyAgentUiUnlockTicketEs256 = verifyAgentUiUnlockTicketEs256;
-exports.verifyMeshJoinToken = verifyMeshJoinToken;
 exports.verifyPairingProof = verifyPairingProof;