@camstack/server 1.2.592 → 1.2.594

package/dist/agent/agent-json-file.js

@@ -1,47 +1,10 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.readJsonFile = readJsonFile;
-exports.writeJsonFile0600 = writeJsonFile0600;
 /**
  * `agent.json` read/write helpers. The file is owner-only on every OS (an owner+SYSTEM ACL on
  * Windows, where 0600 is a no-op) because it holds the mesh private key.
  */
-const fs = __importStar(require("node:fs"));
-const node_1 = require("@camstack/types/node");
-function readJsonFile(file) {
+import * as fs from 'node:fs';
+import { writeOwnerOnlyFileSync } from '@camstack/types/node';
+export function readJsonFile(file) {
     if (!fs.existsSync(file))
         return {};
     try {
@@ -54,6 +17,6 @@ function readJsonFile(file) {
         return {};
     }
 }
-function writeJsonFile0600(file, data) {
-    (0, node_1.writeOwnerOnlyFileSync)(file, JSON.stringify(data, null, 2));
+export function writeJsonFile0600(file, data) {
+    writeOwnerOnlyFileSync(file, JSON.stringify(data, null, 2));
 }

package/dist/agent/agent-mesh-gate.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createAgentMeshGate = createAgentMeshGate;
 /**
  * The agent's mesh gate (D802, D857): only the hub may call this agent, and the
  * hub is recognised by its CERTIFICATE — the agent's own TLS listener accepted
@@ -14,13 +11,13 @@ exports.createAgentMeshGate = createAgentMeshGate;
  *
  * Also here: the agent's outbound event scope (D848) — its events go to the hub only.
  */
-const system_1 = require("@camstack/system");
+import { AgentMeshIdentityGate, createAgentEventScope, createMeshAccessMiddleware, } from '@camstack/system';
 const HUB_NODE_ID = 'hub';
 /** At most one "refused" line per sender per this long. */
 const REFUSED_LOG_INTERVAL_MS = 60_000;
-function createAgentMeshGate(opts) {
+export function createAgentMeshGate(opts) {
     const lastLoggedAt = new Map();
-    const gate = new system_1.AgentMeshIdentityGate({
+    const gate = new AgentMeshIdentityGate({
         ownNodeId: opts.nodeId,
         hubNodeId: HUB_NODE_ID,
         isVerifiedPeer: opts.isVerifiedPeer,
@@ -35,11 +32,11 @@ function createAgentMeshGate(opts) {
             opts.log?.(`mesh inbound: "${nodeId}" is not the certified hub — refused (first call: ${what})`);
         },
     });
-    const eventScope = (0, system_1.createAgentEventScope)({
+    const eventScope = createAgentEventScope({
         hubNodeId: HUB_NODE_ID,
         ...(opts.log !== undefined ? { log: opts.log } : {}),
     });
-    const inbound = (0, system_1.createMeshAccessMiddleware)({
+    const inbound = createMeshAccessMiddleware({
         ownNodeId: opts.nodeId,
         gate,
         logger: {

package/dist/agent/agent-node-certificates.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createAgentNodeCertificates = createAgentNodeCertificates;
 /**
  * The agent's side of certificate management (D856): the `node-certificates`
  * capability, provided by the agent runtime and called by the hub through the
@@ -24,9 +21,9 @@ exports.createAgentNodeCertificates = createAgentNodeCertificates;
  * HTTPS leaf. Same shape: key pair + CSR here, signed public key back, ONE atomic file
  * under `<dataDir>/tls`, hot-swapped into the sniffing listener.
  */
-const node_crypto_1 = require("node:crypto");
-const system_1 = require("@camstack/system");
-const agent_json_file_js_1 = require("./agent-json-file.js");
+import { createPrivateKey, X509Certificate } from 'node:crypto';
+import { collectAgentNames, createAgentHttpsRequest, createMeshCsrPem, describeHttpsLeaf, describeMeshLeaf, exportMeshPrivateKeyPem, generateMeshKeyPair, installAgentHttps, loadAgentHttps, pinnedHttpsCaFingerprint, } from '@camstack/system';
+import { readJsonFile, writeJsonFile0600 } from './agent-json-file.js';
 /** Let the capability answer before the broker is torn down and rebuilt. */
 const RECONNECT_DELAY_MS = 400;
 /** A swap found pending at boot gets at least this long for the hub to confirm. */
@@ -49,7 +46,7 @@ function defaultSchedule(fn, ms) {
     timer.unref?.();
     return { cancel: () => clearTimeout(timer) };
 }
-function createAgentNodeCertificates(deps) {
+export function createAgentNodeCertificates(deps) {
     const { nodeId, log } = deps;
     const tags = { nodeId };
     const schedule = deps.schedule ?? defaultSchedule;
@@ -57,7 +54,7 @@ function createAgentNodeCertificates(deps) {
     let pendingKeyPem = null;
     let rollbackTimer = null;
     const readMesh = () => {
-        const raw = (0, agent_json_file_js_1.readJsonFile)(deps.configPath);
+        const raw = readJsonFile(deps.configPath);
         return {
             current: isMeshMaterial(raw['meshTls']) ? raw['meshTls'] : null,
             previous: isMeshMaterial(raw['meshTlsPrevious']) ? raw['meshTlsPrevious'] : null,
@@ -66,7 +63,7 @@ function createAgentNodeCertificates(deps) {
     };
     const stillValid = (material) => {
         try {
-            return (0, system_1.describeMeshLeaf)(material.certPem).notAfter > now();
+            return describeMeshLeaf(material.certPem).notAfter > now();
         }
         catch {
             return false;
@@ -74,9 +71,9 @@ function createAgentNodeCertificates(deps) {
     };
     /** Write `agent.json` with the swap leftovers removed and `meshTls` optionally replaced. */
     const writeSettled = (replaceCurrent) => {
-        const raw = (0, agent_json_file_js_1.readJsonFile)(deps.configPath);
+        const raw = readJsonFile(deps.configPath);
         const { meshTlsPrevious: _p, meshSwap: _s, ...rest } = raw;
-        (0, agent_json_file_js_1.writeJsonFile0600)(deps.configPath, {
+        writeJsonFile0600(deps.configPath, {
             ...rest,
             ...(replaceCurrent !== undefined ? { meshTls: replaceCurrent } : {}),
         });
@@ -159,13 +156,13 @@ function createAgentNodeCertificates(deps) {
     return {
         getCertificates: async () => {
             const { current } = readMesh();
-            const https = (0, system_1.loadAgentHttps)(deps.dataDir, (reason) => log.error('The HTTPS bundle on disk is unusable - serving plain HTTP only', {
+            const https = loadAgentHttps(deps.dataDir, (reason) => log.error('The HTTPS bundle on disk is unusable - serving plain HTTP only', {
                 tags,
                 meta: { reason },
             }));
             let mesh = null;
             if (current !== null) {
-                const leaf = (0, system_1.describeMeshLeaf)(current.certPem);
+                const leaf = describeMeshLeaf(current.certPem);
                 mesh = {
                     cn: leaf.cn,
                     serial: leaf.serial,
@@ -182,7 +179,7 @@ function createAgentNodeCertificates(deps) {
                         state: 'not-issued',
                         reason: 'No hub-issued HTTPS certificate has been installed on this node yet.',
                     }
-                    : { state: 'served', leaf: (0, system_1.describeHttpsLeaf)(https.certPem) },
+                    : { state: 'served', leaf: describeHttpsLeaf(https.certPem) },
             };
         },
         prepareMeshRenewal: async () => {
@@ -195,9 +192,9 @@ function createAgentNodeCertificates(deps) {
             }
             // A leftover from a finished or failed swap is never a rollback target.
             writeSettled();
-            const keys = await (0, system_1.generateMeshKeyPair)();
-            pendingKeyPem = await (0, system_1.exportMeshPrivateKeyPem)(keys.privateKey);
-            const csrPem = await (0, system_1.createMeshCsrPem)(keys, nodeId);
+            const keys = await generateMeshKeyPair();
+            pendingKeyPem = await exportMeshPrivateKeyPem(keys.privateKey);
+            const csrPem = await createMeshCsrPem(keys, nodeId);
             log.info('Mesh leaf renewal: new key and CSR generated', { tags });
             return { csrPem };
         },
@@ -208,9 +205,9 @@ function createAgentNodeCertificates(deps) {
             if (pendingKeyPem === null) {
                 throw new Error('no pending key: prepareMeshRenewal was not called (or the node restarted)');
             }
-            const leaf = new node_crypto_1.X509Certificate(input.certPem);
-            const ca = new node_crypto_1.X509Certificate(input.caCertPem);
-            const currentCa = new node_crypto_1.X509Certificate(current.caCertPem);
+            const leaf = new X509Certificate(input.certPem);
+            const ca = new X509Certificate(input.caCertPem);
+            const currentCa = new X509Certificate(current.caCertPem);
             if (ca.fingerprint256 !== currentCa.fingerprint256) {
                 throw new Error('the CA that came with the new leaf is not the CA this node trusts');
             }
@@ -219,15 +216,15 @@ function createAgentNodeCertificates(deps) {
             if (!new RegExp(`(?:^|\\n)CN=${nodeId.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?:\\n|$)`).test(leaf.subject)) {
                 throw new Error(`the new leaf is not issued for "${nodeId}"`);
             }
-            if (!leaf.checkPrivateKey((0, node_crypto_1.createPrivateKey)(pendingKeyPem))) {
+            if (!leaf.checkPrivateKey(createPrivateKey(pendingKeyPem))) {
                 throw new Error('the new leaf does not match the key this node generated');
             }
-            const raw = (0, agent_json_file_js_1.readJsonFile)(deps.configPath);
+            const raw = readJsonFile(deps.configPath);
             const swap = {
                 fingerprint: leaf.fingerprint256,
                 deadline: now() + input.confirmWithinMs,
             };
-            (0, agent_json_file_js_1.writeJsonFile0600)(deps.configPath, {
+            writeJsonFile0600(deps.configPath, {
                 ...raw,
                 meshTls: { certPem: input.certPem, keyPem: pendingKeyPem, caCertPem: current.caCertPem },
                 meshTlsPrevious: current,
@@ -260,8 +257,8 @@ function createAgentNodeCertificates(deps) {
             return { ok: true };
         },
         prepareHttpsCertificate: async () => {
-            const names = (0, system_1.collectAgentNames)(nodeId, deps.hostFacts);
-            const request = await (0, system_1.createAgentHttpsRequest)(deps.dataDir, nodeId, names);
+            const names = collectAgentNames(nodeId, deps.hostFacts);
+            const request = await createAgentHttpsRequest(deps.dataDir, nodeId, names);
             log.info('HTTPS certificate: new key and CSR generated', {
                 tags,
                 meta: { hostnames: names.hostnames.length, addresses: names.addresses.length },
@@ -270,11 +267,11 @@ function createAgentNodeCertificates(deps) {
                 csrPem: request.csrPem,
                 hostnames: [...names.hostnames],
                 addresses: [...names.addresses],
-                pinnedCaFingerprintSha256: (0, system_1.pinnedHttpsCaFingerprint)(deps.dataDir),
+                pinnedCaFingerprintSha256: pinnedHttpsCaFingerprint(deps.dataDir),
             };
         },
         installHttpsCertificate: async (input) => {
-            const material = (0, system_1.installAgentHttps)(deps.dataDir, input);
+            const material = installAgentHttps(deps.dataDir, input);
             const listener = deps.getHttpsListener();
             if (listener === null) {
                 log.warn('HTTPS certificate installed on disk but the agent HTTP listener is not up', {
@@ -286,7 +283,7 @@ function createAgentNodeCertificates(deps) {
                     tags,
                 });
             }
-            const leaf = (0, system_1.describeHttpsLeaf)(material.certPem);
+            const leaf = describeHttpsLeaf(material.certPem);
             log.info('HTTPS certificate installed and hot-swapped', {
                 tags,
                 meta: {

package/dist/agent/agent-pairing-local.js

@@ -1,40 +1,3 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PAIRING_RESET_FILE = exports.PAIRING_PIN_FILE = void 0;
-exports.createLocalPairingAnnouncer = createLocalPairingAnnouncer;
 /**
  * Where a pairing's one-time PIN, the agent's own code and the reset code are shown: ONLY on the
  * agent's machine (D857).
@@ -45,11 +8,11 @@ exports.createLocalPairingAnnouncer = createLocalPairingAnnouncer;
  * desktop window (which asks the agent's loopback `status`) - and types the hub's code and the PIN
  * into the page.
  */
-const fs = __importStar(require("node:fs"));
-const path = __importStar(require("node:path"));
-const node_1 = require("@camstack/types/node");
-exports.PAIRING_PIN_FILE = 'pairing-pin.txt';
-exports.PAIRING_RESET_FILE = 'pairing-reset.txt';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { writeOwnerOnlyFileSync } from '@camstack/types/node';
+export const PAIRING_PIN_FILE = 'pairing-pin.txt';
+export const PAIRING_RESET_FILE = 'pairing-reset.txt';
 function describe(s) {
     const fp = s.hub.caFingerprint.slice(0, 16);
     return [
@@ -64,9 +27,9 @@ function describe(s) {
  * holds exactly the live ones and is removed when none is left - and a stale one left by a previous
  * run is removed here, at boot. A PIN is never logged anywhere else.
  */
-function createLocalPairingAnnouncer(dataDir, log) {
-    const file = path.join(dataDir, exports.PAIRING_PIN_FILE);
-    const resetFile = path.join(dataDir, exports.PAIRING_RESET_FILE);
+export function createLocalPairingAnnouncer(dataDir, log) {
+    const file = path.join(dataDir, PAIRING_PIN_FILE);
+    const resetFile = path.join(dataDir, PAIRING_RESET_FILE);
     const live = new Map();
     const flush = () => {
         try {
@@ -75,7 +38,7 @@ function createLocalPairingAnnouncer(dataDir, log) {
                 return;
             }
             fs.mkdirSync(dataDir, { recursive: true });
-            (0, node_1.writeOwnerOnlyFileSync)(file, `${[...live.values()].map(describe).join('\n\n')}\n`);
+            writeOwnerOnlyFileSync(file, `${[...live.values()].map(describe).join('\n\n')}\n`);
         }
         catch (err) {
             log.warn(`could not write ${file}: ${err instanceof Error ? err.message : String(err)} - the PIN is in the console above`);
@@ -98,7 +61,7 @@ function createLocalPairingAnnouncer(dataDir, log) {
             log.warn(`\nPairing reset code: ${code}\n  (clears pairing lockouts and pending offers: POST /api/agent/pairing/reset {"code": ...}; also in ${resetFile})`);
             try {
                 fs.mkdirSync(dataDir, { recursive: true });
-                (0, node_1.writeOwnerOnlyFileSync)(resetFile, `${code}\n`);
+                writeOwnerOnlyFileSync(resetFile, `${code}\n`);
             }
             catch (err) {
                 log.warn(`could not write ${resetFile}: ${err instanceof Error ? err.message : String(err)} - the code is in the console above`);

package/dist/agent/agent-pairing-routes.js

@@ -1,15 +1,11 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isLocalRequest = isLocalRequest;
-exports.registerAgentPairingRoutes = registerAgentPairingRoutes;
-const system_1 = require("@camstack/system");
-const agent_http_auth_js_1 = require("./agent-http-auth.js");
+import { PAIRING_PATHS, } from '@camstack/system';
+import { authInputOf, isGenuineLoopback } from './agent-http-auth.js';
 const OFFER_WINDOW_MS = 60_000;
 const DEFAULT_OFFERS_PER_MINUTE = 10;
 const MAX_TRACKED_SOURCES = 512;
 /** True for a request from this machine itself: loopback peer, no forwarding header. */
-function isLocalRequest(req) {
-    return (0, agent_http_auth_js_1.isGenuineLoopback)((0, agent_http_auth_js_1.authInputOf)(req));
+export function isLocalRequest(req) {
+    return isGenuineLoopback(authInputOf(req));
 }
 function send(reply, result) {
     if (result.ok)
@@ -25,7 +21,7 @@ function send(reply, result) {
         ...(failure.retryAfterMs !== undefined ? { retryAfterMs: failure.retryAfterMs } : {}),
     });
 }
-function registerAgentPairingRoutes(app, deps) {
+export function registerAgentPairingRoutes(app, deps) {
     const { pairing } = deps;
     const now = deps.now ?? Date.now;
     const limit = deps.offersPerMinute ?? DEFAULT_OFFERS_PER_MINUTE;
@@ -44,10 +40,10 @@ function registerAgentPairingRoutes(app, deps) {
         offersBySource.set(source, [...recent, at]);
         return false;
     };
-    app.get(system_1.PAIRING_PATHS.hello, async () => pairing.hello());
+    app.get(PAIRING_PATHS.hello, async () => pairing.hello());
     // The network sees who asks; the agent's own machine sees the secrets.
-    app.get(system_1.PAIRING_PATHS.status, async (req) => isLocalRequest(req) ? pairing.localView() : pairing.publicView());
-    app.post(system_1.PAIRING_PATHS.offer, async (req, reply) => {
+    app.get(PAIRING_PATHS.status, async (req) => isLocalRequest(req) ? pairing.localView() : pairing.publicView());
+    app.post(PAIRING_PATHS.offer, async (req, reply) => {
         if (rateLimited(req.socket.remoteAddress ?? 'unknown')) {
             deps.log(`pairing offers from ${req.socket.remoteAddress ?? 'unknown'} are rate limited`);
             return reply.status(429).header('retry-after', '60').send({
@@ -58,20 +54,20 @@ function registerAgentPairingRoutes(app, deps) {
         }
         return send(reply, await pairing.offer(req.body));
     });
-    app.post(system_1.PAIRING_PATHS.reveal, async (req, reply) => send(reply, pairing.reveal(req.body)));
-    app.post(system_1.PAIRING_PATHS.poll, async (req, reply) => send(reply, pairing.poll(req.body)));
-    app.post(system_1.PAIRING_PATHS.cancel, async (req, reply) => send(reply, pairing.cancel(req.body)));
-    app.post(system_1.PAIRING_PATHS.complete, async (req, reply) => send(reply, await pairing.complete(req.body)));
+    app.post(PAIRING_PATHS.reveal, async (req, reply) => send(reply, pairing.reveal(req.body)));
+    app.post(PAIRING_PATHS.poll, async (req, reply) => send(reply, pairing.poll(req.body)));
+    app.post(PAIRING_PATHS.cancel, async (req, reply) => send(reply, pairing.cancel(req.body)));
+    app.post(PAIRING_PATHS.complete, async (req, reply) => send(reply, await pairing.complete(req.body)));
     const contextOf = (req) => ({
         local: isLocalRequest(req),
         source: req.socket.remoteAddress ?? 'unknown',
     });
-    app.post(system_1.PAIRING_PATHS.confirm, async (req, reply) => send(reply, pairing.confirm(req.body, contextOf(req))));
-    app.post(system_1.PAIRING_PATHS.reject, async (req, reply) => send(reply, pairing.reject(req.body, contextOf(req))));
+    app.post(PAIRING_PATHS.confirm, async (req, reply) => send(reply, pairing.confirm(req.body, contextOf(req))));
+    app.post(PAIRING_PATHS.reject, async (req, reply) => send(reply, pairing.reject(req.body, contextOf(req))));
     // Clears the offer lockouts and pending offers: this machine, or the reset code printed at boot.
-    app.post(system_1.PAIRING_PATHS.reset, async (req, reply) => send(reply, pairing.reset(req.body, contextOf(req))));
+    app.post(PAIRING_PATHS.reset, async (req, reply) => send(reply, pairing.reset(req.body, contextOf(req))));
     // Authenticated by the onRequest hook (not a protocol path): this machine or a hub session.
-    app.post(system_1.PAIRING_PATHS.forget, async (_req, reply) => {
+    app.post(PAIRING_PATHS.forget, async (_req, reply) => {
         if (pairing.state() !== 'paired') {
             return reply
                 .status(409)

package/dist/agent/agent-pairing-store.js

@@ -1,57 +1,17 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isAgentPaired = isAgentPaired;
-exports.pinnedMeshCaCert = pinnedMeshCaCert;
-exports.persistPairing = persistPairing;
-exports.forgetPairing = forgetPairing;
-exports.pairedLeafFingerprint = pairedLeafFingerprint;
 /**
  * What pairing writes to, and removes from, `agent.json` (D857). The file is
  * 0600 on every OS; this module only ever touches the keys named below. An older
  * `secret` field is neither read nor removed here — the operator deletes it.
  */
-const node_crypto_1 = require("node:crypto");
-const fs = __importStar(require("node:fs"));
-const system_1 = require("@camstack/system");
-const agent_json_file_js_1 = require("./agent-json-file.js");
+import { X509Certificate } from 'node:crypto';
+import * as fs from 'node:fs';
+import { agentHttpsPaths } from '@camstack/system';
+import { readJsonFile, writeJsonFile0600 } from './agent-json-file.js';
 /** Keys that exist only while this agent is paired. */
 const PAIRED_KEYS = ['meshTls', 'meshTlsPrevious', 'meshSwap', 'hubAddress'];
 /** `agent.json` holds mesh material: the agent is paired. */
-function isAgentPaired(configPath) {
-    const meshTls = (0, agent_json_file_js_1.readJsonFile)(configPath)['meshTls'];
+export function isAgentPaired(configPath) {
+    const meshTls = readJsonFile(configPath)['meshTls'];
     return (meshTls !== null &&
         typeof meshTls === 'object' &&
         typeof Reflect.get(meshTls, 'certPem') === 'string' &&
@@ -59,17 +19,17 @@ function isAgentPaired(configPath) {
         typeof Reflect.get(meshTls, 'caCertPem') === 'string');
 }
 /** The CA certificate this agent pinned at pairing, or `null` while unpaired. */
-function pinnedMeshCaCert(configPath) {
-    const meshTls = (0, agent_json_file_js_1.readJsonFile)(configPath)['meshTls'];
+export function pinnedMeshCaCert(configPath) {
+    const meshTls = readJsonFile(configPath)['meshTls'];
     if (meshTls === null || typeof meshTls !== 'object')
         return null;
     const ca = Reflect.get(meshTls, 'caCertPem');
     return typeof ca === 'string' && ca.length > 0 ? ca : null;
 }
 /** Persist a completed pairing: the leaf, its key, the pinned CA and the hub's host. */
-function persistPairing(configPath, pairing) {
-    const { meshTlsPrevious: _previous, meshSwap: _swap, ...existing } = (0, agent_json_file_js_1.readJsonFile)(configPath);
-    (0, agent_json_file_js_1.writeJsonFile0600)(configPath, {
+export function persistPairing(configPath, pairing) {
+    const { meshTlsPrevious: _previous, meshSwap: _swap, ...existing } = readJsonFile(configPath);
+    writeJsonFile0600(configPath, {
         ...existing,
         hubAddress: pairing.hubAddress,
         meshTls: pairing.meshTls,
@@ -79,22 +39,22 @@ function persistPairing(configPath, pairing) {
  * Leave the hub: erase the mesh material, the hub address and the HTTPS bundle
  * the hub issued. The agent is unpaired afterwards and accepts offers again.
  */
-function forgetPairing(configPath, dataDir) {
-    const existing = (0, agent_json_file_js_1.readJsonFile)(configPath);
-    (0, agent_json_file_js_1.writeJsonFile0600)(configPath, Object.fromEntries(Object.entries(existing).filter(([key]) => !PAIRED_KEYS.includes(key))));
-    const https = (0, system_1.agentHttpsPaths)(dataDir);
+export function forgetPairing(configPath, dataDir) {
+    const existing = readJsonFile(configPath);
+    writeJsonFile0600(configPath, Object.fromEntries(Object.entries(existing).filter(([key]) => !PAIRED_KEYS.includes(key))));
+    const https = agentHttpsPaths(dataDir);
     for (const file of [https.bundlePath, https.certPath, https.pendingKeyPath]) {
         fs.rmSync(file, { force: true });
     }
 }
 /** First 16 hex chars of the SHA-256 of the agent's mesh leaf, `null` while unpaired. */
-function pairedLeafFingerprint(configPath) {
-    const meshTls = (0, agent_json_file_js_1.readJsonFile)(configPath)['meshTls'];
+export function pairedLeafFingerprint(configPath) {
+    const meshTls = readJsonFile(configPath)['meshTls'];
     const certPem = meshTls !== null && typeof meshTls === 'object' ? Reflect.get(meshTls, 'certPem') : null;
     if (typeof certPem !== 'string')
         return null;
     try {
-        return new node_crypto_1.X509Certificate(certPem).fingerprint256
+        return new X509Certificate(certPem).fingerprint256
             .replaceAll(':', '')
             .toLowerCase()
             .slice(0, 16);

package/dist/agent/agent-reconnect.js

@@ -1,7 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createReconnectRunner = createReconnectRunner;
-function createReconnectRunner(deps) {
+export function createReconnectRunner(deps) {
     let generation = 0;
     return async () => {
         const mine = ++generation;