@camstack/system 1.2.380 → 1.2.382

package/dist/{jwt-signing-key-Qhde8r82.mjs → jwt-signing-key-CAbozwvF.mjs}

@@ -1,4 +1,4 @@
-import { br as buildSecretRef } from "./dist-B9oFw2jh.mjs";
+import { Sr as buildSecretRef } from "./dist-CP5TTjwd.mjs";
 import { randomBytes } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{jwt-signing-key-C2rE3wH6.js → jwt-signing-key-Dgf8sIXY.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-Cc6KOdY-.js");
+const require_dist = require("./dist-tnAO12ak.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/kernel/index.d.ts

@@ -54,6 +54,18 @@ export { callRegisterNodeWithRetry, buildNodeManifest } from './moleculer/regist
 export type { RegisterNodeBroker, CallRegisterNodeOptions, } from './moleculer/register-node-client.js';
 export { hashClusterSecret, clusterSecretMatches, isClusterSecretMismatchError, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_REF, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, checkClusterSecret, getProcessClusterSecretGate, setProcessClusterSecretGate, } from './moleculer/cluster-secret.js';
 export type { ClusterSecretGate, ClusterSecretVerdict } from './moleculer/cluster-secret.js';
+export { MeshAuthenticator, isRemoteForbiddenAction, MESH_JOIN_CHALLENGE_TTL_MS, } from './moleculer/mesh-authenticator.js';
+export type { MeshAuthenticatorDeps, MeshCallVerdict, } from './moleculer/mesh-authenticator.js';
+export { createMeshAccessMiddleware, stripForgedIdentity, } from './moleculer/mesh-access-middleware.js';
+export type { MeshAccessMiddlewareOptions } from './moleculer/mesh-access-middleware.js';
+export { MeshJoinClient } from './moleculer/mesh-join-client.js';
+export type { MeshJoinCall, MeshJoinClientOptions, MeshJoinState, } from './moleculer/mesh-join-client.js';
+export { computeHubJoinProof, computeNodeJoinProof, meshErrorType, MESH_ACTION_FORBIDDEN_TYPE, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_PROTOCOL, MESH_NODE_UNAUTHENTICATED_TYPE, } from './moleculer/mesh-join-proof.js';
+export type { MeshJoinAuthenticateParams, MeshJoinAuthenticateResult, MeshJoinChallenge, } from './moleculer/mesh-join-proof.js';
+export { getProcessMeshAuthMode, getProcessMeshAuthStatus, isMeshAuthMode, MESH_AUTH_MODE_FIELD, parseMeshAuthMode, requestProcessMeshEnforcement, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshEnforcer, } from './moleculer/mesh-auth-mode.js';
+export { decideMeshAutoEnforce, MESH_AUTO_ENFORCE_GRACE_MS, } from './moleculer/mesh-auto-enforce.js';
+export type { MeshAutoEnforceDecision, MeshAutoEnforceInput, } from './moleculer/mesh-auto-enforce.js';
+export type { MeshAuthMode, MeshAuthStatus, MeshEnforcer, MeshNodeAuthEntry, MeshNodeAuthState, } from './moleculer/mesh-auth-mode.js';
 export { serializeTypedArrays } from './moleculer/typed-array-serde.js';
 export { createReadinessService, createReadinessServiceForRegistry, AGENT_READINESS_SERVICE_NAME, } from './moleculer/readiness-service.js';
 export type { ReadinessServiceDeps } from './moleculer/readiness-service.js';

package/dist/kernel/moleculer/broker-factory.d.ts

@@ -1,4 +1,4 @@
-import { ServiceBroker } from 'moleculer';
+import { ServiceBroker, Middleware } from 'moleculer';
 interface BrokerConfig {
     readonly nodeID: string;
     readonly mode: 'hub' | 'agent' | 'test';
@@ -20,6 +20,13 @@ interface BrokerConfig {
      * on one host.
      */
     readonly agentListenPort?: number;
+    /**
+     * Broker middlewares (D802): the hub passes its mesh gate
+     * (`createMeshAccessMiddleware`), an agent its join gate
+     * (`MeshJoinClient.middleware`). They must be given at construction —
+     * Moleculer wraps action handlers when services register.
+     */
+    readonly middlewares?: readonly Middleware[];
 }
 /**
  * Derive a STABLE Moleculer reader port for an agent from its nodeID.

package/dist/kernel/moleculer/child-addon-call-dispatch.d.ts

@@ -13,6 +13,7 @@ export interface SerializableRouteDescriptor {
     readonly path: string;
     readonly access?: string;
     readonly description?: string;
+    readonly rateLimit?: string;
 }
 /**
  * Resolved `addon-routes` provider lookup — the live provider object the addon

package/dist/kernel/moleculer/hub-service.d.ts

@@ -2,6 +2,7 @@ import { ServiceSchema } from 'moleculer';
 import { LogTags } from '@camstack/types';
 import { RegisterNodeParams } from './node-registry.js';
 import { ClusterSecretGate } from './cluster-secret.js';
+import { MeshAuthenticator } from './mesh-authenticator.js';
 interface HubServiceDeps {
     readonly getAddonConfig: (addonId: string) => unknown;
     readonly getSettings: (scope: string, key?: string) => unknown;
@@ -32,6 +33,14 @@ interface HubServiceDeps {
      * Absent → `off` (test brokers); the hub always passes the keychain's gate.
      */
     readonly clusterSecretGate?: () => ClusterSecretGate;
+    /**
+     * The hub's per-node mesh identity (D802). When present, `joinChallenge` /
+     * `authenticateNode` run the challenge–response and `registerNode` asks it
+     * whether the SENDER may register (`MeshAuthenticator.admitRegistration`);
+     * `clusterSecretGate` is then read through it. Absent → the D797 hash gate
+     * alone (test brokers).
+     */
+    readonly meshAuth?: MeshAuthenticator;
 }
 declare function createHubService(deps: HubServiceDeps): ServiceSchema;
 export { createHubService };

package/dist/kernel/moleculer/mesh-access-middleware.d.ts

@@ -0,0 +1,28 @@
+import { Middleware } from 'moleculer';
+import { MeshAuthenticator } from './mesh-authenticator.js';
+/**
+ * The params of a request from another node, with every identity it claimed
+ * removed:
+ *  - a cap action's input loses `caller` (the user identity the hub's tRPC
+ *    router injects for `caller: 'required'` methods — `keychainAdmin.reveal`
+ *    reads it) and `callerAddonId` (the transport's addon stamp the keychain
+ *    owner-checks);
+ *  - `$hub-cap-fwd.forward` keeps its envelope `callerAddonId` — the forward
+ *    service checks it against the sender's registered manifest — but the
+ *    forwarded `args` lose both.
+ */
+export declare function stripForgedIdentity(action: string, params: unknown): unknown;
+interface GateLogger {
+    warn(message: string, meta?: Record<string, unknown>): void;
+}
+export interface MeshAccessMiddlewareOptions {
+    readonly ownNodeId: string;
+    readonly authenticator: MeshAuthenticator;
+    readonly logger?: GateLogger;
+}
+/**
+ * Build the middleware. Pass it in `ServiceBroker({ middlewares: [...] })`
+ * so it wraps every service, including the ones Moleculer creates itself.
+ */
+export declare function createMeshAccessMiddleware(options: MeshAccessMiddlewareOptions): Middleware;
+export {};

package/dist/kernel/moleculer/mesh-auth-mode.d.ts

@@ -0,0 +1,64 @@
+/**
+ * How strictly the hub holds other nodes to the mesh join (D802).
+ *
+ *  - `transition`: a node that has not authenticated is TOLERATED — its calls
+ *    run, a warning names it, and System → Cluster lists it as "not
+ *    authenticated". This is how an existing cluster upgrades without
+ *    splitting: the hub generates its secret, the operator copies it into each
+ *    agent, and nothing is refused meanwhile.
+ *  - `enforced`: a node that has not authenticated is refused on every action
+ *    and its events are dropped. The D797 hash in `registerNode` is no longer
+ *    accepted either — only the challenge–response.
+ *
+ * `transition` ends by itself once EVERY node the hub has ever seen (the
+ * cluster-node history) has authenticated with the challenge–response
+ * (`MeshAuthenticator.onAuthenticated` → `requestProcessMeshEnforcement`).
+ * The operator can also switch it in System → Cluster, in both directions.
+ *
+ * The mode lives in the `cluster` section of `system-settings`
+ * (`cluster.meshAuth`), owned by `system-config`, published here as a process
+ * slot the hub's broker reads on every call — the same pattern as the cluster
+ * secret gate (`cluster-secret.ts`).
+ */
+export type MeshAuthMode = 'transition' | 'enforced';
+/** The field key inside the `cluster` section. */
+export declare const MESH_AUTH_MODE_FIELD = "meshAuth";
+export declare function isMeshAuthMode(value: unknown): value is MeshAuthMode;
+/** A stored value that is not a mode reads as `transition`: never refuse on a typo. */
+export declare function parseMeshAuthMode(value: unknown): MeshAuthMode;
+/** How a node stands with the hub right now. */
+export type MeshNodeAuthState = 
+/** Answered the challenge–response on its current connection. */
+'authenticated'
+/** Registered with the D797 hash (replayable) — accepted in `transition` only. */
+ | 'legacy'
+/** Presented nothing: tolerated in `transition`, refused in `enforced`. */
+ | 'unauthenticated';
+export interface MeshNodeAuthEntry {
+    readonly nodeId: string;
+    readonly state: MeshNodeAuthState;
+    /** Epoch ms of the last change. */
+    readonly since: number;
+}
+/** What System → Cluster shows. */
+export interface MeshAuthStatus {
+    readonly mode: MeshAuthMode;
+    readonly nodes: readonly MeshNodeAuthEntry[];
+}
+/** Published by `system-config` whenever the stored mode is (re)read. */
+export declare function setProcessMeshAuthMode(mode: MeshAuthMode): void;
+/**
+ * The hub's mode. Until `system-config` has read it: `transition` — the safe
+ * side for an upgrading cluster (nothing that worked before is refused), and
+ * exactly what an unread setting means.
+ */
+export declare function getProcessMeshAuthMode(): MeshAuthMode;
+export declare function clearProcessMeshAuthMode(): void;
+/** Persists `enforced`; installed by `system-config`, which owns the setting. */
+export type MeshEnforcer = (reason: string) => Promise<void>;
+export declare function setProcessMeshEnforcer(enforcer: MeshEnforcer | null): void;
+/** Ask the owner of the setting to switch to `enforced`. `false` when nobody can. */
+export declare function requestProcessMeshEnforcement(reason: string): Promise<boolean>;
+/** Published by the hub's broker; read by System → Cluster. */
+export declare function setProcessMeshAuthStatusSource(source: (() => MeshAuthStatus) | null): void;
+export declare function getProcessMeshAuthStatus(): MeshAuthStatus | null;

package/dist/kernel/moleculer/mesh-authenticator.d.ts

@@ -0,0 +1,71 @@
+import { ClusterSecretGate } from './cluster-secret.js';
+import { MeshAuthMode, MeshAuthStatus, MeshNodeAuthState } from './mesh-auth-mode.js';
+import { MeshJoinAuthenticateParams, MeshJoinAuthenticateResult, MeshJoinChallenge } from './mesh-join-proof.js';
+/** A challenge is answered within this window or not at all. */
+export declare const MESH_JOIN_CHALLENGE_TTL_MS = 60000;
+export declare function isRemoteForbiddenAction(action: string): boolean;
+export type MeshCallVerdict = {
+    readonly verdict: 'allow';
+    readonly errorType?: undefined;
+} | {
+    readonly verdict: 'tolerate';
+    readonly errorType?: undefined;
+} | {
+    readonly verdict: 'deny';
+    readonly errorType: string;
+    readonly message: string;
+};
+export interface MeshAuthenticatorDeps {
+    /** The hub's own node id — its local calls never pass through here. */
+    readonly ownNodeId: string;
+    /** The cluster secret as the keychain answers it now (D797). */
+    readonly gate: () => ClusterSecretGate;
+    readonly mode: () => MeshAuthMode;
+    readonly now?: () => number;
+    /** A node completed the challenge–response. */
+    readonly onAuthenticated?: (nodeId: string) => void;
+    /** First time a node is tolerated without proof on this connection. */
+    readonly onTolerated?: (nodeId: string, action: string) => void;
+}
+interface RegistrationLike {
+    readonly nodeId: string;
+    readonly clusterSecretHash?: string;
+}
+export declare class MeshAuthenticator {
+    private readonly deps;
+    private readonly challenges;
+    private readonly nodes;
+    /** Completed the challenge–response at least once since the hub started. */
+    private readonly everAuthenticated;
+    /** Let in WITHOUT the challenge–response at least once since the hub started. */
+    private readonly everTolerated;
+    private readonly now;
+    constructor(deps: MeshAuthenticatorDeps);
+    issueChallenge(sender: string): MeshJoinChallenge;
+    authenticate(sender: string, params: MeshJoinAuthenticateParams): MeshJoinAuthenticateResult;
+    /** The node's connection dropped: it authenticates again when it returns. */
+    forget(nodeId: string): void;
+    admitCall(sender: string, action: string): MeshCallVerdict;
+    /** Same rule as a call, for an inbound event. */
+    admitEvent(sender: string, eventName: string): MeshCallVerdict;
+    private admitSender;
+    /** Throws when `sender` may not register `params`; returns when it may. */
+    admitRegistration(sender: string, params: RegistrationLike): void;
+    private noteTolerated;
+    stateOf(nodeId: string): MeshNodeAuthState;
+    /** Node ids that completed the challenge–response on their current connection. */
+    authenticatedNodeIds(): readonly string[];
+    /** Node ids that ever completed the challenge–response since the hub started. */
+    everAuthenticatedNodeIds(): ReadonlySet<string>;
+    /**
+     * Node ids let in without the challenge–response since the hub started.
+     * Bounded: past {@link MAX_TRACKED_NODES} a flood of fake ids stops adding,
+     * and the ones already here keep the transition open (the operator can still
+     * switch to `enforced` by hand).
+     */
+    everToleratedNodeIds(): readonly string[];
+    snapshot(): MeshAuthStatus;
+    private record;
+    private secretHashOrThrow;
+}
+export {};

package/dist/kernel/moleculer/mesh-auto-enforce.d.ts

@@ -0,0 +1,26 @@
+import { ClusterSecretGate } from './cluster-secret.js';
+import { MeshAuthMode } from './mesh-auth-mode.js';
+/** Boot grace before an empty or partial roster can end the transition. */
+export declare const MESH_AUTO_ENFORCE_GRACE_MS: number;
+export interface MeshAutoEnforceInput {
+    readonly mode: MeshAuthMode;
+    readonly gate: ClusterSecretGate['kind'];
+    readonly uptimeMs: number;
+    readonly graceMs?: number;
+    /** Agent node ids from the cluster-node history; `null` = the store did not answer. */
+    readonly knownAgents: readonly string[] | null;
+    readonly connected: readonly string[];
+    readonly toleratedEver: readonly string[];
+    readonly authenticatedEver: ReadonlySet<string>;
+    /** The hub's own id and its local children (`hub/<runner>`) are not agents. */
+    readonly ownNodeId: string;
+}
+export type MeshAutoEnforceDecision = {
+    readonly enforce: true;
+    readonly reason: string;
+} | {
+    readonly enforce: false;
+    readonly waitingFor: readonly string[];
+    readonly why: string;
+};
+export declare function decideMeshAutoEnforce(input: MeshAutoEnforceInput): MeshAutoEnforceDecision;

package/dist/kernel/moleculer/mesh-join-client.d.ts

@@ -0,0 +1,51 @@
+import { Middleware } from 'moleculer';
+export type MeshJoinState = 'pending' | 'authenticated' | 'no-secret' | 'unsupported' | 'unavailable' | 'secret-mismatch' | 'hub-unverified';
+export type MeshJoinCall = (action: string, params: unknown, opts?: {
+    nodeID?: string;
+    timeout?: number;
+}) => Promise<unknown>;
+export interface MeshJoinClientOptions {
+    readonly nodeId: string;
+    /** The agent's cluster secret, read at each join (the operator may enter it at runtime). */
+    readonly secret: () => string | null;
+    readonly call: MeshJoinCall;
+    readonly hubNodeId?: string;
+    readonly maxAttempts?: number;
+    readonly retryDelayMs?: number;
+    readonly callTimeoutMs?: number;
+    /** How long a call waits for a pending join before it fails (default 30 s). */
+    readonly pendingWaitMs?: number;
+    readonly log?: (message: string) => void;
+    /** Told about every settled state. */
+    readonly onSettled?: (state: MeshJoinState) => void;
+}
+export declare class MeshJoinClient {
+    private readonly opts;
+    private current;
+    private settledWaiters;
+    private inFlight;
+    private readonly hubNodeId;
+    constructor(opts: MeshJoinClientOptions);
+    get state(): MeshJoinState;
+    /** Did this agent prove itself on the current connection? */
+    get authenticated(): boolean;
+    /**
+     * Run the join. Concurrent callers share one attempt. Resolves with the
+     * settled state; never rejects.
+     */
+    join(): Promise<MeshJoinState>;
+    /** The hub connection dropped: the next connection authenticates again. */
+    reset(): void;
+    /** Resolves when a call to the hub may go out; rejects when it must not. */
+    whenCallable(): Promise<void>;
+    /**
+     * Moleculer middleware for the AGENT broker: every call to the hub node waits
+     * for the join; a hub answer "not authenticated" (the hub restarted and lost
+     * us) triggers a new join.
+     */
+    middleware(onUnauthenticated?: () => void): Middleware;
+    private secretPresent;
+    private settle;
+    private runJoin;
+    private attempt;
+}

package/dist/kernel/moleculer/mesh-join-proof.d.ts

@@ -0,0 +1,39 @@
+/** Protocol version carried by the challenge; the agent refuses one it does not speak. */
+export declare const MESH_JOIN_PROTOCOL = 1;
+/** The hub's action that hands out a single-use nonce. */
+export declare const MESH_JOIN_CHALLENGE_ACTION = "$hub.joinChallenge";
+/** The hub's action that verifies a node's proof and answers with its own. */
+export declare const MESH_JOIN_AUTHENTICATE_ACTION = "$hub.authenticateNode";
+/** Moleculer error `type`: the sender has not authenticated and the hub enforces it. */
+export declare const MESH_NODE_UNAUTHENTICATED_TYPE = "MESH_NODE_UNAUTHENTICATED";
+/** Moleculer error `type`: the action is never callable from another node. */
+export declare const MESH_ACTION_FORBIDDEN_TYPE = "MESH_ACTION_FORBIDDEN";
+/** Moleculer error `type`: the challenge is unknown, used or expired — ask for a new one. */
+export declare const MESH_JOIN_CHALLENGE_INVALID_TYPE = "MESH_JOIN_CHALLENGE_INVALID";
+/** Answer of `$hub.joinChallenge`. */
+export interface MeshJoinChallenge {
+    readonly protocol: number;
+    readonly nonce: string;
+}
+/** Params of `$hub.authenticateNode`. */
+export interface MeshJoinAuthenticateParams {
+    readonly nodeId: string;
+    readonly nonce: string;
+    readonly clientNonce: string;
+    readonly proof: string;
+}
+/** Answer of `$hub.authenticateNode`. */
+export interface MeshJoinAuthenticateResult {
+    readonly ok: true;
+    readonly hubProof: string;
+}
+/** A fresh 32-byte nonce, hex. */
+export declare function createMeshNonce(): string;
+/** The node's answer to the hub's nonce. `secretHash` is `hashClusterSecret(secret)`. */
+export declare function computeNodeJoinProof(secretHash: string, nodeId: string, nonce: string): string;
+/** The hub's answer to the node's nonce — proves the hub holds the same secret. */
+export declare function computeHubJoinProof(secretHash: string, nodeId: string, nonce: string, clientNonce: string): string;
+/** Constant-time comparison of two hex proofs; any shape mismatch is `false`. */
+export declare function proofsEqual(expected: string, presented: unknown): boolean;
+/** Reads a Moleculer error's `type`, including after an RPC round-trip. */
+export declare function meshErrorType(err: unknown): string | null;

package/dist/kernel/system-settings-policy.d.ts

@@ -13,8 +13,8 @@
  *
  * So a bootstrap-owned section is answered from env + config.yaml ONLY, and
  * the store may add exactly the keys in {@link STORE_READABLE_BOOTSTRAP_KEYS}:
- * today `auth.tokenExpiry`, the one value the operator edits in the UI
- * (System → Authentication). Widening this list is a security decision, not a
+ * the values the operator edits on System → Authentication (`auth.tokenExpiry`,
+ * `auth.accessTokenExpiry`, `auth.trustedProxies`). Widening this list is a security decision, not a
  * convenience.
  */
 /** The only keys under a bootstrap-owned section the store may answer. */
@@ -32,7 +32,8 @@ export declare function storeMayAnswer(key: string): boolean;
 export declare const PRELOADED_SYSTEM_PREFIXES: readonly string[];
 /**
  * Single keys loaded the same way. `auth.tokenExpiry` is read synchronously on
- * every mint by the hub's `AuthService` (`AuthManager.signToken`).
+ * every mint by the hub's `AuthService` (`AuthManager.signToken`), and
+ * `auth.trustedProxies` on every public auth request (`auth-network-policy.ts`).
  */
 export declare const PRELOADED_SYSTEM_KEYS: readonly string[];
 /** Is `key` served from the boot-time mirror when the engine is isolated? */

package/dist/kernel/transport/hub-cap-forward.d.ts

@@ -27,9 +27,10 @@ export interface HubCapForwardParams {
     /**
      * The ORIGINATING addon, stamped by the AGENT's `LocalChildRegistry` off the
      * child connection the call arrived on (D787) — the agent-side equivalent of
-     * what the hub's own registry stamps for a hub-local child. The hub trusts it
-     * because the agent node is authenticated by the cluster secret, and checks
-     * it against the node the request came from ({@link HubCapForwardOptions}).
+     * what the hub's own registry stamps for a hub-local child. The hub believes
+     * it only from a node that joined the mesh (D802: challenge–response; in
+     * `transition` an unauthenticated node is tolerated) and only when that
+     * node's registered manifest hosts the runner ({@link HubCapForwardOptions}).
      * Absent → the call is anonymous, and an owner-checked cap refuses it.
      */
     readonly callerAddonId?: string;
@@ -46,6 +47,16 @@ export interface HubCapForwardOptions {
     /** Told about a dropped stamp — a misrouted or lying runner deserves a line. */
     readonly onRejectedCaller?: (nodeId: string, callerAddonId: string) => void;
 }
+/**
+ * Drop a `caller` the forwarded args carry. `caller` is the USER identity the
+ * hub's tRPC router injects for `caller: 'required'` methods
+ * (`cap-router-builder.ts`), and providers trust it — `keychainAdmin.reveal`
+ * reads `input.caller.userId`. A call that arrives over the mesh has no user
+ * session behind it, so whatever `caller` it carries is forged (D802). The
+ * args' `callerAddonId` is overwritten or stripped further down by
+ * `stampCallerAddonId`; `caller` had no such guard.
+ */
+export declare function stripForwardedCaller(args: unknown): unknown;
 /**
  * Handler that routes an agent-originated cap call through the hub's own
  * unowned-call routing. Structurally the hub's `onUnownedCall`.

package/dist/kernel/transport/index.d.ts

@@ -32,5 +32,5 @@ export { createParentUnownedCallHandler } from './parent-unowned-call.js';
 export { answerClaimedGetStatus, deviceOfGetStatus, GET_STATUS_METHOD, } from './claimed-get-status.js';
 export type { ClaimedGetStatusAnswer, ClaimedGetStatusCall } from './claimed-get-status.js';
 export type { ParentUnownedCallDeps, ParentUnownedCallLogger } from './parent-unowned-call.js';
-export { createHubCapForwardService, HUB_CAP_FWD_SERVICE, HUB_CAP_FWD_ACTION, } from './hub-cap-forward.js';
+export { createHubCapForwardService, HUB_CAP_FWD_SERVICE, HUB_CAP_FWD_ACTION, stripForwardedCaller, } from './hub-cap-forward.js';
 export type { HubCapForwardOptions, HubCapForwardParams, HubUnownedCallHandler, } from './hub-cap-forward.js';