@camstack/system 1.2.381 → 1.2.383

package/dist/{jwt-signing-key-CsuVKA1W.mjs → jwt-signing-key-MQLxLfgF.mjs}

@@ -1,4 +1,4 @@
-import { xr as buildSecretRef } from "./dist-BC0GnGeg.mjs";
+import { Sr as buildSecretRef } from "./dist-osl3bkF0.mjs";
 import { randomBytes } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{jwt-signing-key-CjoZcol8.js → jwt-signing-key-WI6z7JBo.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BugrtARh.js");
+const require_dist = require("./dist-CUNGH0fs.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/kernel/index.d.ts

@@ -37,8 +37,10 @@ export type { AddonSettingsView } from './config-manager.js';
 export { DeviceRegistry } from './device-registry.js';
 export { buildStorageLocationRegistry } from './storage-location-registry.js';
 export type { StorageLocationRegistry } from './storage-location-registry.js';
-export { createBroker, deriveAgentListenPort } from './moleculer/broker-factory.js';
+export { createBroker, deriveAgentListenPort, getBrokerTlsTransporter, } from './moleculer/broker-factory.js';
 export type { BrokerConfig } from './moleculer/broker-factory.js';
+export { caFingerprint, caFingerprintCompact, createMeshCsrPem, enrollMeshNode, generateMeshCa, generateMeshKeyPair, getProcessMeshCaState, issueMeshLeafForNode, issueMeshLeafFromCsr, JoinTokenJtiStore, loadMeshCa, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MeshCaKeeper, MeshCrl, mintMeshJoinToken, processMeshCrl, processJoinTokenJtiStore, requireProcessMeshCa, setProcessMeshTlsEnabler, TlsTcpTransporter, verifyMeshJoinToken, DEFAULT_HUB_TLS_TCP_PORT, } from './moleculer/mesh-mtls/index.js';
+export type { MeshCaSigner, MeshEnrollResult, MeshJoinTokenClaims, MeshTlsMaterial, } from './moleculer/mesh-mtls/index.js';
 export { type AddonDeploySource, isAddonDeploySource } from './moleculer/addon-deploy-source.js';
 export { createAddonService, validateProviderRegistrations, } from './moleculer/addon-service-factory.js';
 export { createCoreCapService, CORE_CAP_SERVICE_NAME } from './moleculer/core-cap-service.js';
@@ -54,6 +56,20 @@ export { callRegisterNodeWithRetry, buildNodeManifest } from './moleculer/regist
 export type { RegisterNodeBroker, CallRegisterNodeOptions, } from './moleculer/register-node-client.js';
 export { hashClusterSecret, clusterSecretMatches, isClusterSecretMismatchError, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_REF, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, checkClusterSecret, getProcessClusterSecretGate, setProcessClusterSecretGate, } from './moleculer/cluster-secret.js';
 export type { ClusterSecretGate, ClusterSecretVerdict } from './moleculer/cluster-secret.js';
+export { MeshAuthenticator, isRemoteForbiddenAction, MESH_JOIN_CHALLENGE_TTL_MS, } from './moleculer/mesh-authenticator.js';
+export type { MeshAuthenticatorDeps, MeshCallVerdict, } from './moleculer/mesh-authenticator.js';
+export { createMeshAccessMiddleware, stripForgedIdentity, } from './moleculer/mesh-access-middleware.js';
+export type { MeshAccessMiddlewareOptions, MeshCallGate, } from './moleculer/mesh-access-middleware.js';
+export { AgentMeshAuthenticator, AGENT_REGISTER_NODE_ACTION, isOwnChildNodeId, isRemoteForbiddenOnAgent, } from './moleculer/agent-mesh-authenticator.js';
+export type { AgentMeshAuthenticatorDeps } from './moleculer/agent-mesh-authenticator.js';
+export { MeshJoinClient } from './moleculer/mesh-join-client.js';
+export type { MeshJoinCall, MeshJoinClientOptions, MeshJoinState, } from './moleculer/mesh-join-client.js';
+export { computeHubJoinProof, computeNodeJoinProof, meshErrorType, MESH_ACTION_FORBIDDEN_TYPE, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_PROTOCOL, MESH_NODE_UNAUTHENTICATED_TYPE, } from './moleculer/mesh-join-proof.js';
+export type { MeshJoinAuthenticateParams, MeshJoinAuthenticateResult, MeshJoinChallenge, } from './moleculer/mesh-join-proof.js';
+export { getProcessMeshAuthMode, getProcessMeshAuthStatus, isMeshAuthMode, MESH_AUTH_MODE_FIELD, parseMeshAuthMode, requestProcessMeshEnforcement, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshEnforcer, } from './moleculer/mesh-auth-mode.js';
+export { decideMeshAutoEnforce, MESH_AUTO_ENFORCE_GRACE_MS, } from './moleculer/mesh-auto-enforce.js';
+export type { MeshAutoEnforceDecision, MeshAutoEnforceInput, } from './moleculer/mesh-auto-enforce.js';
+export type { MeshAuthMode, MeshAuthStatus, MeshEnforcer, MeshNodeAuthEntry, MeshNodeAuthState, } from './moleculer/mesh-auth-mode.js';
 export { serializeTypedArrays } from './moleculer/typed-array-serde.js';
 export { createReadinessService, createReadinessServiceForRegistry, AGENT_READINESS_SERVICE_NAME, } from './moleculer/readiness-service.js';
 export type { ReadinessServiceDeps } from './moleculer/readiness-service.js';

package/dist/kernel/moleculer/agent-mesh-authenticator.d.ts

@@ -0,0 +1,41 @@
+import { MeshAuthMode, MeshNodeAuthState } from './mesh-auth-mode.js';
+import { MeshCallVerdict } from './mesh-authenticator.js';
+import { MeshJoinState } from './mesh-join-client.js';
+/** The child's register action on its parent agent. */
+export declare const AGENT_REGISTER_NODE_ACTION = "$agent.registerNode";
+export declare function isRemoteForbiddenOnAgent(action: string): boolean;
+export declare function isOwnChildNodeId(ownNodeId: string, sender: string): boolean;
+export interface AgentMeshAuthenticatorDeps {
+    readonly ownNodeId: string;
+    readonly hubNodeId?: string;
+    /** True when `agent.json` holds a cluster secret. */
+    readonly hasSecret: () => boolean;
+    readonly now?: () => number;
+    /** First time a peer is tolerated without proof on this connection. */
+    readonly onTolerated?: (nodeId: string, action: string) => void;
+}
+export declare class AgentMeshAuthenticator {
+    private readonly deps;
+    private readonly nodes;
+    private readonly hubNodeId;
+    private readonly now;
+    constructor(deps: AgentMeshAuthenticatorDeps);
+    /** Current mode: secret configured → enforce; else tolerate (upgrade path). */
+    mode(): MeshAuthMode;
+    /**
+     * Reflect a settled mesh join. `authenticated` stamps the hub; a blocking
+     * failure forgets it so an impostor cannot call in; transitional states
+     * leave the hub unmarked (calls are tolerated while mode is `transition`).
+     */
+    noteHubJoinState(state: MeshJoinState): void;
+    /** A child's `$agent.registerNode` was accepted (secret hash matched or none required). */
+    noteChildRegistered(sender: string, proof?: 'authenticated' | 'legacy'): void;
+    /** The peer's connection dropped. */
+    forget(nodeId: string): void;
+    admitCall(sender: string, action: string): MeshCallVerdict;
+    admitEvent(sender: string, eventName: string): MeshCallVerdict;
+    stateOf(nodeId: string): MeshNodeAuthState;
+    authenticatedNodeIds(): readonly string[];
+    private admitSender;
+    private record;
+}

package/dist/kernel/moleculer/broker-factory.d.ts

@@ -1,4 +1,5 @@
-import { ServiceBroker } from 'moleculer';
+import { ServiceBroker, Middleware } from 'moleculer';
+import { MeshTlsMaterial, TlsTcpTransporter } from './mesh-mtls/index.js';
 interface BrokerConfig {
     readonly nodeID: string;
     readonly mode: 'hub' | 'agent' | 'test';
@@ -10,6 +11,11 @@ interface BrokerConfig {
      * when UDP multicast discovery is disabled.
      */
     readonly tcpPort?: number;
+    /**
+     * Second hub listen port for mesh mTLS (Release A). Default 6443.
+     * Clear traffic stays on {@link tcpPort}; enrolled agents dial this.
+     */
+    readonly tlsPort?: number;
     /** UDP port for cluster discovery (default: 4445). */
     readonly udpPort?: number;
     /**
@@ -20,6 +26,20 @@ interface BrokerConfig {
      * on one host.
      */
     readonly agentListenPort?: number;
+    /**
+     * Broker middlewares (D802): the hub passes its mesh gate
+     * (`createMeshAccessMiddleware`); an agent passes inbound access
+     * (`AgentMeshAuthenticator` + the same middleware) and its outbound join
+     * gate (`MeshJoinClient.middleware`). They must be given at construction —
+     * Moleculer wraps action handlers when services register.
+     */
+    readonly middlewares?: readonly Middleware[];
+    /**
+     * Mesh mTLS material. On the hub, enables the TLS listener (may also be
+     * attached later via {@link getBrokerTlsTransporter}). On an agent, dials
+     * the hub's TLS port (6443) instead of clear 6000.
+     */
+    readonly meshTls?: MeshTlsMaterial;
 }
 /**
  * Derive a STABLE Moleculer reader port for an agent from its nodeID.
@@ -44,5 +64,8 @@ interface BrokerConfig {
  */
 declare function deriveAgentListenPort(nodeID: string): number;
 declare function createBroker(config: BrokerConfig): ServiceBroker;
-export { createBroker, deriveAgentListenPort };
+declare function normalizeHubUrl(raw: string, defaultPort: number): string;
+/** The hub's {@link TlsTcpTransporter}, or null when the broker is not mesh-TLS. */
+declare function getBrokerTlsTransporter(broker: ServiceBroker): TlsTcpTransporter | null;
+export { createBroker, deriveAgentListenPort, getBrokerTlsTransporter, normalizeHubUrl };
 export type { BrokerConfig };

package/dist/kernel/moleculer/child-addon-call-dispatch.d.ts

@@ -13,6 +13,7 @@ export interface SerializableRouteDescriptor {
     readonly path: string;
     readonly access?: string;
     readonly description?: string;
+    readonly rateLimit?: string;
 }
 /**
  * Resolved `addon-routes` provider lookup — the live provider object the addon

package/dist/kernel/moleculer/hub-service.d.ts

@@ -2,6 +2,7 @@ import { ServiceSchema } from 'moleculer';
 import { LogTags } from '@camstack/types';
 import { RegisterNodeParams } from './node-registry.js';
 import { ClusterSecretGate } from './cluster-secret.js';
+import { MeshAuthenticator } from './mesh-authenticator.js';
 interface HubServiceDeps {
     readonly getAddonConfig: (addonId: string) => unknown;
     readonly getSettings: (scope: string, key?: string) => unknown;
@@ -32,6 +33,14 @@ interface HubServiceDeps {
      * Absent → `off` (test brokers); the hub always passes the keychain's gate.
      */
     readonly clusterSecretGate?: () => ClusterSecretGate;
+    /**
+     * The hub's per-node mesh identity (D802). When present, `joinChallenge` /
+     * `authenticateNode` run the challenge–response and `registerNode` asks it
+     * whether the SENDER may register (`MeshAuthenticator.admitRegistration`);
+     * `clusterSecretGate` is then read through it. Absent → the D797 hash gate
+     * alone (test brokers).
+     */
+    readonly meshAuth?: MeshAuthenticator;
 }
 declare function createHubService(deps: HubServiceDeps): ServiceSchema;
 export { createHubService };

package/dist/kernel/moleculer/mesh-access-middleware.d.ts

@@ -0,0 +1,33 @@
+import { Middleware } from 'moleculer';
+import { MeshCallVerdict } from './mesh-authenticator.js';
+/** Minimal surface the middleware needs — hub and agent authenticators both fit. */
+export interface MeshCallGate {
+    admitCall(sender: string, action: string): MeshCallVerdict;
+    admitEvent(sender: string, eventName: string): MeshCallVerdict;
+}
+/**
+ * The params of a request from another node, with every identity it claimed
+ * removed:
+ *  - a cap action's input loses `caller` (the user identity the hub's tRPC
+ *    router injects for `caller: 'required'` methods — `keychainAdmin.reveal`
+ *    reads it) and `callerAddonId` (the transport's addon stamp the keychain
+ *    owner-checks);
+ *  - `$hub-cap-fwd.forward` keeps its envelope `callerAddonId` — the forward
+ *    service checks it against the sender's registered manifest — but the
+ *    forwarded `args` lose both.
+ */
+export declare function stripForgedIdentity(action: string, params: unknown): unknown;
+interface GateLogger {
+    warn(message: string, meta?: Record<string, unknown>): void;
+}
+export interface MeshAccessMiddlewareOptions {
+    readonly ownNodeId: string;
+    readonly authenticator: MeshCallGate;
+    readonly logger?: GateLogger;
+}
+/**
+ * Build the middleware. Pass it in `ServiceBroker({ middlewares: [...] })`
+ * so it wraps every service, including the ones Moleculer creates itself.
+ */
+export declare function createMeshAccessMiddleware(options: MeshAccessMiddlewareOptions): Middleware;
+export {};

package/dist/kernel/moleculer/mesh-auth-mode.d.ts

@@ -0,0 +1,64 @@
+/**
+ * How strictly the hub holds other nodes to the mesh join (D802).
+ *
+ *  - `transition`: a node that has not authenticated is TOLERATED — its calls
+ *    run, a warning names it, and System → Cluster lists it as "not
+ *    authenticated". This is how an existing cluster upgrades without
+ *    splitting: the hub generates its secret, the operator copies it into each
+ *    agent, and nothing is refused meanwhile.
+ *  - `enforced`: a node that has not authenticated is refused on every action
+ *    and its events are dropped. The D797 hash in `registerNode` is no longer
+ *    accepted either — only the challenge–response.
+ *
+ * `transition` ends by itself once EVERY node the hub has ever seen (the
+ * cluster-node history) has authenticated with the challenge–response
+ * (`MeshAuthenticator.onAuthenticated` → `requestProcessMeshEnforcement`).
+ * The operator can also switch it in System → Cluster, in both directions.
+ *
+ * The mode lives in the `cluster` section of `system-settings`
+ * (`cluster.meshAuth`), owned by `system-config`, published here as a process
+ * slot the hub's broker reads on every call — the same pattern as the cluster
+ * secret gate (`cluster-secret.ts`).
+ */
+export type MeshAuthMode = 'transition' | 'enforced';
+/** The field key inside the `cluster` section. */
+export declare const MESH_AUTH_MODE_FIELD = "meshAuth";
+export declare function isMeshAuthMode(value: unknown): value is MeshAuthMode;
+/** A stored value that is not a mode reads as `transition`: never refuse on a typo. */
+export declare function parseMeshAuthMode(value: unknown): MeshAuthMode;
+/** How a node stands with the hub right now. */
+export type MeshNodeAuthState = 
+/** Answered the challenge–response on its current connection. */
+'authenticated'
+/** Registered with the D797 hash (replayable) — accepted in `transition` only. */
+ | 'legacy'
+/** Presented nothing: tolerated in `transition`, refused in `enforced`. */
+ | 'unauthenticated';
+export interface MeshNodeAuthEntry {
+    readonly nodeId: string;
+    readonly state: MeshNodeAuthState;
+    /** Epoch ms of the last change. */
+    readonly since: number;
+}
+/** What System → Cluster shows. */
+export interface MeshAuthStatus {
+    readonly mode: MeshAuthMode;
+    readonly nodes: readonly MeshNodeAuthEntry[];
+}
+/** Published by `system-config` whenever the stored mode is (re)read. */
+export declare function setProcessMeshAuthMode(mode: MeshAuthMode): void;
+/**
+ * The hub's mode. Until `system-config` has read it: `transition` — the safe
+ * side for an upgrading cluster (nothing that worked before is refused), and
+ * exactly what an unread setting means.
+ */
+export declare function getProcessMeshAuthMode(): MeshAuthMode;
+export declare function clearProcessMeshAuthMode(): void;
+/** Persists `enforced`; installed by `system-config`, which owns the setting. */
+export type MeshEnforcer = (reason: string) => Promise<void>;
+export declare function setProcessMeshEnforcer(enforcer: MeshEnforcer | null): void;
+/** Ask the owner of the setting to switch to `enforced`. `false` when nobody can. */
+export declare function requestProcessMeshEnforcement(reason: string): Promise<boolean>;
+/** Published by the hub's broker; read by System → Cluster. */
+export declare function setProcessMeshAuthStatusSource(source: (() => MeshAuthStatus) | null): void;
+export declare function getProcessMeshAuthStatus(): MeshAuthStatus | null;

package/dist/kernel/moleculer/mesh-authenticator.d.ts

@@ -0,0 +1,71 @@
+import { ClusterSecretGate } from './cluster-secret.js';
+import { MeshAuthMode, MeshAuthStatus, MeshNodeAuthState } from './mesh-auth-mode.js';
+import { MeshJoinAuthenticateParams, MeshJoinAuthenticateResult, MeshJoinChallenge } from './mesh-join-proof.js';
+/** A challenge is answered within this window or not at all. */
+export declare const MESH_JOIN_CHALLENGE_TTL_MS = 60000;
+export declare function isRemoteForbiddenAction(action: string): boolean;
+export type MeshCallVerdict = {
+    readonly verdict: 'allow';
+    readonly errorType?: undefined;
+} | {
+    readonly verdict: 'tolerate';
+    readonly errorType?: undefined;
+} | {
+    readonly verdict: 'deny';
+    readonly errorType: string;
+    readonly message: string;
+};
+export interface MeshAuthenticatorDeps {
+    /** The hub's own node id — its local calls never pass through here. */
+    readonly ownNodeId: string;
+    /** The cluster secret as the keychain answers it now (D797). */
+    readonly gate: () => ClusterSecretGate;
+    readonly mode: () => MeshAuthMode;
+    readonly now?: () => number;
+    /** A node completed the challenge–response. */
+    readonly onAuthenticated?: (nodeId: string) => void;
+    /** First time a node is tolerated without proof on this connection. */
+    readonly onTolerated?: (nodeId: string, action: string) => void;
+}
+interface RegistrationLike {
+    readonly nodeId: string;
+    readonly clusterSecretHash?: string;
+}
+export declare class MeshAuthenticator {
+    private readonly deps;
+    private readonly challenges;
+    private readonly nodes;
+    /** Completed the challenge–response at least once since the hub started. */
+    private readonly everAuthenticated;
+    /** Let in WITHOUT the challenge–response at least once since the hub started. */
+    private readonly everTolerated;
+    private readonly now;
+    constructor(deps: MeshAuthenticatorDeps);
+    issueChallenge(sender: string): MeshJoinChallenge;
+    authenticate(sender: string, params: MeshJoinAuthenticateParams): MeshJoinAuthenticateResult;
+    /** The node's connection dropped: it authenticates again when it returns. */
+    forget(nodeId: string): void;
+    admitCall(sender: string, action: string): MeshCallVerdict;
+    /** Same rule as a call, for an inbound event. */
+    admitEvent(sender: string, eventName: string): MeshCallVerdict;
+    private admitSender;
+    /** Throws when `sender` may not register `params`; returns when it may. */
+    admitRegistration(sender: string, params: RegistrationLike): void;
+    private noteTolerated;
+    stateOf(nodeId: string): MeshNodeAuthState;
+    /** Node ids that completed the challenge–response on their current connection. */
+    authenticatedNodeIds(): readonly string[];
+    /** Node ids that ever completed the challenge–response since the hub started. */
+    everAuthenticatedNodeIds(): ReadonlySet<string>;
+    /**
+     * Node ids let in without the challenge–response since the hub started.
+     * Bounded: past {@link MAX_TRACKED_NODES} a flood of fake ids stops adding,
+     * and the ones already here keep the transition open (the operator can still
+     * switch to `enforced` by hand).
+     */
+    everToleratedNodeIds(): readonly string[];
+    snapshot(): MeshAuthStatus;
+    private record;
+    private secretHashOrThrow;
+}
+export {};

package/dist/kernel/moleculer/mesh-auto-enforce.d.ts

@@ -0,0 +1,26 @@
+import { ClusterSecretGate } from './cluster-secret.js';
+import { MeshAuthMode } from './mesh-auth-mode.js';
+/** Boot grace before an empty or partial roster can end the transition. */
+export declare const MESH_AUTO_ENFORCE_GRACE_MS: number;
+export interface MeshAutoEnforceInput {
+    readonly mode: MeshAuthMode;
+    readonly gate: ClusterSecretGate['kind'];
+    readonly uptimeMs: number;
+    readonly graceMs?: number;
+    /** Agent node ids from the cluster-node history; `null` = the store did not answer. */
+    readonly knownAgents: readonly string[] | null;
+    readonly connected: readonly string[];
+    readonly toleratedEver: readonly string[];
+    readonly authenticatedEver: ReadonlySet<string>;
+    /** The hub's own id and its local children (`hub/<runner>`) are not agents. */
+    readonly ownNodeId: string;
+}
+export type MeshAutoEnforceDecision = {
+    readonly enforce: true;
+    readonly reason: string;
+} | {
+    readonly enforce: false;
+    readonly waitingFor: readonly string[];
+    readonly why: string;
+};
+export declare function decideMeshAutoEnforce(input: MeshAutoEnforceInput): MeshAutoEnforceDecision;

package/dist/kernel/moleculer/mesh-join-client.d.ts

@@ -0,0 +1,51 @@
+import { Middleware } from 'moleculer';
+export type MeshJoinState = 'pending' | 'authenticated' | 'no-secret' | 'unsupported' | 'unavailable' | 'secret-mismatch' | 'hub-unverified';
+export type MeshJoinCall = (action: string, params: unknown, opts?: {
+    nodeID?: string;
+    timeout?: number;
+}) => Promise<unknown>;
+export interface MeshJoinClientOptions {
+    readonly nodeId: string;
+    /** The agent's cluster secret, read at each join (the operator may enter it at runtime). */
+    readonly secret: () => string | null;
+    readonly call: MeshJoinCall;
+    readonly hubNodeId?: string;
+    readonly maxAttempts?: number;
+    readonly retryDelayMs?: number;
+    readonly callTimeoutMs?: number;
+    /** How long a call waits for a pending join before it fails (default 30 s). */
+    readonly pendingWaitMs?: number;
+    readonly log?: (message: string) => void;
+    /** Told about every settled state. */
+    readonly onSettled?: (state: MeshJoinState) => void;
+}
+export declare class MeshJoinClient {
+    private readonly opts;
+    private current;
+    private settledWaiters;
+    private inFlight;
+    private readonly hubNodeId;
+    constructor(opts: MeshJoinClientOptions);
+    get state(): MeshJoinState;
+    /** Did this agent prove itself on the current connection? */
+    get authenticated(): boolean;
+    /**
+     * Run the join. Concurrent callers share one attempt. Resolves with the
+     * settled state; never rejects.
+     */
+    join(): Promise<MeshJoinState>;
+    /** The hub connection dropped: the next connection authenticates again. */
+    reset(): void;
+    /** Resolves when a call to the hub may go out; rejects when it must not. */
+    whenCallable(): Promise<void>;
+    /**
+     * Moleculer middleware for the AGENT broker: every call to the hub node waits
+     * for the join; a hub answer "not authenticated" (the hub restarted and lost
+     * us) triggers a new join.
+     */
+    middleware(onUnauthenticated?: () => void): Middleware;
+    private secretPresent;
+    private settle;
+    private runJoin;
+    private attempt;
+}

package/dist/kernel/moleculer/mesh-join-proof.d.ts

@@ -0,0 +1,39 @@
+/** Protocol version carried by the challenge; the agent refuses one it does not speak. */
+export declare const MESH_JOIN_PROTOCOL = 1;
+/** The hub's action that hands out a single-use nonce. */
+export declare const MESH_JOIN_CHALLENGE_ACTION = "$hub.joinChallenge";
+/** The hub's action that verifies a node's proof and answers with its own. */
+export declare const MESH_JOIN_AUTHENTICATE_ACTION = "$hub.authenticateNode";
+/** Moleculer error `type`: the sender has not authenticated and the hub enforces it. */
+export declare const MESH_NODE_UNAUTHENTICATED_TYPE = "MESH_NODE_UNAUTHENTICATED";
+/** Moleculer error `type`: the action is never callable from another node. */
+export declare const MESH_ACTION_FORBIDDEN_TYPE = "MESH_ACTION_FORBIDDEN";
+/** Moleculer error `type`: the challenge is unknown, used or expired — ask for a new one. */
+export declare const MESH_JOIN_CHALLENGE_INVALID_TYPE = "MESH_JOIN_CHALLENGE_INVALID";
+/** Answer of `$hub.joinChallenge`. */
+export interface MeshJoinChallenge {
+    readonly protocol: number;
+    readonly nonce: string;
+}
+/** Params of `$hub.authenticateNode`. */
+export interface MeshJoinAuthenticateParams {
+    readonly nodeId: string;
+    readonly nonce: string;
+    readonly clientNonce: string;
+    readonly proof: string;
+}
+/** Answer of `$hub.authenticateNode`. */
+export interface MeshJoinAuthenticateResult {
+    readonly ok: true;
+    readonly hubProof: string;
+}
+/** A fresh 32-byte nonce, hex. */
+export declare function createMeshNonce(): string;
+/** The node's answer to the hub's nonce. `secretHash` is `hashClusterSecret(secret)`. */
+export declare function computeNodeJoinProof(secretHash: string, nodeId: string, nonce: string): string;
+/** The hub's answer to the node's nonce — proves the hub holds the same secret. */
+export declare function computeHubJoinProof(secretHash: string, nodeId: string, nonce: string, clientNonce: string): string;
+/** Constant-time comparison of two hex proofs; any shape mismatch is `false`. */
+export declare function proofsEqual(expected: string, presented: unknown): boolean;
+/** Reads a Moleculer error's `type`, including after an RPC round-trip. */
+export declare function meshErrorType(err: unknown): string | null;

package/dist/kernel/moleculer/mesh-mtls/constants.d.ts

@@ -0,0 +1,20 @@
+/** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
+export declare const MESH_CA_KEY_REF: string;
+/** `system-settings` key holding the public CA certificate PEM. */
+export declare const MESH_CA_SETTINGS_KEY = "cluster.meshCa";
+/** Field inside the `cluster` section (same row as the secret). */
+export declare const MESH_CA_FIELD = "meshCa";
+/** Join-token / leaf lifetimes. */
+export declare const MESH_JOIN_TOKEN_MAX_TTL_SEC: number;
+export declare const MESH_LEAF_VALIDITY_DAYS = 30;
+export declare const MESH_CA_VALIDITY_DAYS = 3650;
+/** Hub clear TCP (existing) and TLS dual-listen port (Release A). */
+export declare const DEFAULT_HUB_TCP_PORT = 6000;
+export declare const DEFAULT_HUB_TLS_TCP_PORT = 6443;
+/** Join token payload version. */
+export declare const MESH_JOIN_TOKEN_VERSION: 1;
+/** Subject of the mesh root. Distinct from the HTTPS local CA. */
+export declare const MESH_CA_COMMON_NAME = "CamStack Mesh CA";
+/** Client + server auth EKU OIDs (mutual TLS). */
+export declare const SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
+export declare const CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";

package/dist/kernel/moleculer/mesh-mtls/index.d.ts

@@ -0,0 +1,9 @@
+export { CLIENT_AUTH_OID, DEFAULT_HUB_TCP_PORT, DEFAULT_HUB_TLS_TCP_PORT, MESH_CA_COMMON_NAME, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_CA_VALIDITY_DAYS, MESH_JOIN_TOKEN_MAX_TTL_SEC, MESH_JOIN_TOKEN_VERSION, MESH_LEAF_VALIDITY_DAYS, SERVER_AUTH_OID, } from './constants.js';
+export { caFingerprint, caFingerprintCompact, createMeshCsrPem, exportMeshPrivateKeyPem, generateMeshCa, generateMeshKeyPair, issueMeshLeafForNode, issueMeshLeafFromCsr, loadMeshCa, MESH_KEY_ALGORITHM, MESH_SIGNING_ALGORITHM, subjectCn, type MeshCaSigner, type MeshLeafMaterial, } from './mesh-ca.js';
+export { clearProcessMeshCa, getProcessMeshCaState, loadOrGenerateMeshCa, MESH_CA_RETRY_MS, MeshCaKeeper, requireProcessMeshCa, setProcessMeshCa, type MeshCaKeeperDeps, type MeshCaState, } from './mesh-ca-keeper.js';
+export { clearProcessMeshCrl, MeshCrl, processMeshCrl, } from './mesh-crl.js';
+export { enrollMeshNode } from './mesh-enroll.js';
+export type { EnrollMeshNodeDeps, MeshEnrollRequest, MeshEnrollResult, } from './mesh-enroll.js';
+export { JoinTokenJtiStore, mintMeshJoinToken, processJoinTokenJtiStore, verifyMeshJoinToken, type MeshJoinTokenClaims, type MintJoinTokenInput, } from './mesh-join-token.js';
+export { getProcessMeshTlsEnabler, requestProcessMeshTlsEnable, setProcessMeshTlsEnabler, type MeshTlsEnabler, } from './mesh-tls-enabler.js';
+export { TlsTcpTransporter, type MeshTlsMaterial, type TlsTcpTransporterOptions, } from './tls-tcp-transporter.js';

package/dist/kernel/moleculer/mesh-mtls/mesh-ca-keeper.d.ts

@@ -0,0 +1,55 @@
+import { SecretsAccess } from '@camstack/types';
+import { MeshCaSigner } from './mesh-ca.js';
+export type MeshCaState = {
+    readonly state: 'ready';
+    readonly ca: MeshCaSigner;
+} | {
+    readonly state: 'unavailable';
+    readonly reason: string;
+};
+export declare function setProcessMeshCa(state: MeshCaState): void;
+export declare function clearProcessMeshCa(): void;
+export declare function getProcessMeshCaState(): MeshCaState;
+export declare function requireProcessMeshCa(): MeshCaSigner;
+export declare const MESH_CA_RETRY_MS = 30000;
+interface KeeperLogger {
+    info(message: string, meta?: {
+        meta?: Record<string, unknown>;
+    }): void;
+    error(message: string, meta?: {
+        meta?: Record<string, unknown>;
+    }): void;
+    warn?(message: string, meta?: {
+        meta?: Record<string, unknown>;
+    }): void;
+}
+export interface MeshCaKeeperDeps {
+    readonly secrets: SecretsAccess | null;
+    /** Read `cluster` section (may contain `meshCa` PEM). */
+    readonly readClusterSection: () => Promise<Record<string, unknown>>;
+    /** Persist the CA cert PEM under `cluster.meshCa`. */
+    readonly writeMeshCaCert: (certPem: string) => Promise<void>;
+    readonly logger: KeeperLogger;
+    readonly retryMs?: number;
+    /** Fired when the CA becomes ready (start TLS listener, etc.). */
+    readonly onReady?: (ca: MeshCaSigner) => void | Promise<void>;
+}
+export declare class MeshCaKeeper {
+    private readonly deps;
+    private retryTimer;
+    private unsubscribe;
+    private stopped;
+    constructor(deps: MeshCaKeeperDeps);
+    start(): Promise<void>;
+    stop(): void;
+    private load;
+    private apply;
+    private scheduleRetry;
+}
+export interface LoadOrGenerateMeshCaDeps {
+    readonly secrets: SecretsAccess;
+    readonly readClusterSection: () => Promise<Record<string, unknown>>;
+    readonly writeMeshCaCert: (certPem: string) => Promise<void>;
+}
+export declare function loadOrGenerateMeshCa(deps: LoadOrGenerateMeshCaDeps): Promise<MeshCaState>;
+export {};

package/dist/kernel/moleculer/mesh-mtls/mesh-ca.d.ts

@@ -0,0 +1,45 @@
+import { webcrypto as WebCrypto } from 'node:crypto';
+import { X509Certificate as PeculiarCertificate } from '@peculiar/x509';
+/** Key generation — EC P-256 (plan). WebCrypto DOM names are not in @types/node. */
+export declare const MESH_KEY_ALGORITHM: WebCrypto.EcKeyGenParams;
+/** Signing — ECDSA with SHA-256. */
+export declare const MESH_SIGNING_ALGORITHM: WebCrypto.EcdsaParams;
+export interface MeshCaSigner {
+    readonly certPem: string;
+    readonly keyPem: string;
+    readonly cert: PeculiarCertificate;
+    readonly privateKey: WebCrypto.CryptoKey;
+    readonly publicKey: WebCrypto.CryptoKey;
+}
+export interface MeshLeafMaterial {
+    readonly certPem: string;
+    readonly serialNumber: string;
+    readonly notAfter: Date;
+    readonly commonName: string;
+}
+/** SHA-256 fingerprint of the DER cert, colon-hex uppercase (Node style). */
+export declare function caFingerprint(certPem: string): string;
+/** Compact fingerprint (lowercase hex, no colons) for join-token payloads. */
+export declare function caFingerprintCompact(certPem: string): string;
+export declare function generateMeshCa(now?: Date): Promise<MeshCaSigner>;
+export declare function loadMeshCa(certPem: string, keyPem: string): Promise<MeshCaSigner>;
+/**
+ * Issue a leaf from a CSR. CN must be present; when `expectedNodeId` is set
+ * it must match. Validity: 30 days.
+ */
+export declare function issueMeshLeafFromCsr(ca: MeshCaSigner, csrPem: string, opts?: {
+    readonly expectedNodeId?: string;
+    readonly now?: Date;
+    readonly validDays?: number;
+}): Promise<MeshLeafMaterial>;
+/** Issue a leaf for a known nodeID with a freshly generated key pair (tests / hub self). */
+export declare function issueMeshLeafForNode(ca: MeshCaSigner, nodeId: string, opts?: {
+    readonly now?: Date;
+    readonly validDays?: number;
+}): Promise<MeshLeafMaterial & {
+    readonly keyPem: string;
+}>;
+export declare function subjectCn(subject: string): string | null;
+export declare function createMeshCsrPem(keys: WebCrypto.CryptoKeyPair, commonName: string): Promise<string>;
+export declare function generateMeshKeyPair(): Promise<WebCrypto.CryptoKeyPair>;
+export declare function exportMeshPrivateKeyPem(key: WebCrypto.CryptoKey): Promise<string>;

package/dist/kernel/moleculer/mesh-mtls/mesh-crl.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Mesh certificate revocation list — in-memory + optional persist hook.
+ *
+ * Release A can stub persistence; the reader checks serials at handshake and
+ * a later "Forget node" closes open sockets (Release A+).
+ */
+export declare class MeshCrl {
+    private readonly serials;
+    revoke(serialNumber: string): void;
+    isRevoked(serialNumber: string): boolean;
+    list(): readonly string[];
+    /** Restore from persisted serials (system-settings). */
+    replaceAll(serials: readonly string[]): void;
+}
+export declare function processMeshCrl(): MeshCrl;
+export declare function clearProcessMeshCrl(): void;

package/dist/kernel/moleculer/mesh-mtls/mesh-enroll.d.ts

@@ -0,0 +1,27 @@
+import { MeshCaSigner } from './mesh-ca.js';
+import { JoinTokenJtiStore, MeshJoinTokenClaims } from './mesh-join-token.js';
+export interface MeshEnrollRequest {
+    readonly token: string;
+    readonly csr: string;
+}
+export interface MeshEnrollSuccess {
+    readonly ok: true;
+    readonly cert: string;
+    readonly caCert: string;
+    readonly nodeId: string;
+    readonly notAfter: string;
+    readonly serialNumber: string;
+}
+export interface MeshEnrollFailure {
+    readonly ok: false;
+    readonly error: string;
+    readonly status: number;
+}
+export type MeshEnrollResult = MeshEnrollSuccess | MeshEnrollFailure;
+export interface EnrollMeshNodeDeps {
+    readonly ca: MeshCaSigner;
+    readonly jtiStore?: JoinTokenJtiStore;
+    readonly now?: Date;
+}
+export declare function enrollMeshNode(body: MeshEnrollRequest, deps: EnrollMeshNodeDeps): Promise<MeshEnrollResult>;
+export type { MeshJoinTokenClaims };