@camstack/system 1.2.383 → 1.2.385

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CUNGH0fs.js");
+const require_dist = require("../../dist-8LQ4lDEB.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Qt as logDestinationCapability, ur as BaseAddon } from "../../dist-osl3bkF0.mjs";
+import { Qt as logDestinationCapability, ur as BaseAddon } from "../../dist-Biqn3TEn.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{child-cap-dispatch-C68N2a6Y.mjs → child-cap-dispatch-B1gyE35b.mjs}

@@ -1,4 +1,4 @@
-import { Tr as createEvent, Yr as scrubKnownSecrets, ni as EventCategory$1, tn as maskUrlCredentials } from "./dist-osl3bkF0.mjs";
+import { Tr as createEvent, Yr as scrubKnownSecrets, ni as EventCategory$1, tn as maskUrlCredentials } from "./dist-Biqn3TEn.mjs";
 import { a as parseProcStat, i as nodeProcReader } from "./proc-stat-CbC55Kqi.mjs";
 import "./hub-cap-forward-CDiN1p98.mjs";
 import * as crypto$1 from "node:crypto";

package/dist/{child-cap-dispatch-BD8fhJ1b.js → child-cap-dispatch-nURMuVTX.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CUNGH0fs.js");
+const require_dist = require("./dist-8LQ4lDEB.js");
 const require_proc_stat = require("./proc-stat-DL-WUOhl.js");
 require("./hub-cap-forward-W8oEm4ME.js");
 let node_crypto = require("node:crypto");

package/dist/{composition-sources-ChpT_Yw4.js → composition-sources-wdAxs-uY.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CUNGH0fs.js");
+const require_dist = require("./dist-8LQ4lDEB.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-DM7Ft_tp.mjs → composition-sources-xqhm2Ygr.mjs}

@@ -1,4 +1,4 @@
-import { lr as errMsg, nr as compositionSourceKey } from "./dist-osl3bkF0.mjs";
+import { lr as errMsg, nr as compositionSourceKey } from "./dist-Biqn3TEn.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-CDpry1_T.js → constants-Ca-Sgcl8.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CUNGH0fs.js");
+const require_dist = require("./dist-8LQ4lDEB.js");
 let node_crypto = require("node:crypto");
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{constants-e3mCa1jG.mjs → constants-D5z4EwY8.mjs}

@@ -1,4 +1,4 @@
-import { Sr as buildSecretRef } from "./dist-osl3bkF0.mjs";
+import { Sr as buildSecretRef } from "./dist-Biqn3TEn.mjs";
 import { createHash, timingSafeEqual } from "node:crypto";
 //#region src/kernel/moleculer/cluster-secret.ts
 /**

package/dist/{dist-CUNGH0fs.js → dist-8LQ4lDEB.js}

@@ -41879,7 +41879,13 @@ var TopologyNodeSchema = zod.z.object({
 	})).readonly(),
 	processes: zod.z.array(TopologyProcessSchema).readonly(),
 	categories: zod.z.array(TopologyCategorySchema).readonly(),
-	rootPackage: TopologyRootPackageSchema.nullable()
+	rootPackage: TopologyRootPackageSchema.nullable(),
+	/**
+	* How an online AGENT reaches the hub (mesh mTLS Release A): `tls` once it has
+	* completed a mutual-TLS handshake, `clear` otherwise. Absent for the hub,
+	* for offline rows and when the hub cannot tell.
+	*/
+	meshTransport: zod.z.enum(["tls", "clear"]).optional()
 });
 var CapUsageEdgeSchema = zod.z.object({
 	callerAddonId: zod.z.string(),
@@ -63892,6 +63898,8 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
 	([...RULE_TEXT], [...UPDATES]),
 	([...RULE_TEXT], [...PACKAGE_UPDATES]),
 	([...RULE_TEXT], [...PACKAGE_UPDATES]),

package/dist/{dist-osl3bkF0.mjs → dist-Biqn3TEn.mjs}

@@ -41879,7 +41879,13 @@ var TopologyNodeSchema = z.object({
 	})).readonly(),
 	processes: z.array(TopologyProcessSchema).readonly(),
 	categories: z.array(TopologyCategorySchema).readonly(),
-	rootPackage: TopologyRootPackageSchema.nullable()
+	rootPackage: TopologyRootPackageSchema.nullable(),
+	/**
+	* How an online AGENT reaches the hub (mesh mTLS Release A): `tls` once it has
+	* completed a mutual-TLS handshake, `clear` otherwise. Absent for the hub,
+	* for offline rows and when the hub cannot tell.
+	*/
+	meshTransport: z.enum(["tls", "clear"]).optional()
 });
 var CapUsageEdgeSchema = z.object({
 	callerAddonId: z.string(),
@@ -63892,6 +63898,8 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
+	[...RULE_TEXT],
+	[...RULE_TEXT],
 	([...RULE_TEXT], [...UPDATES]),
 	([...RULE_TEXT], [...PACKAGE_UPDATES]),
 	([...RULE_TEXT], [...PACKAGE_UPDATES]),

package/dist/{event-loop-stall-monitor-BeeWMnyT.mjs → event-loop-stall-monitor-BtK_0Pjc.mjs}

@@ -1,4 +1,4 @@
-import { It as hfModelUrl, M as MODEL_FORMATS, T as HF_REPO } from "./dist-osl3bkF0.mjs";
+import { It as hfModelUrl, M as MODEL_FORMATS, T as HF_REPO } from "./dist-Biqn3TEn.mjs";
 import { createHash } from "node:crypto";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{event-loop-stall-monitor-Dk28EF8B.js → event-loop-stall-monitor-CNj73d4D.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CUNGH0fs.js");
+const require_dist = require("./dist-8LQ4lDEB.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CUNGH0fs.js");
-const require_jwt_signing_key = require("./jwt-signing-key-WI6z7JBo.js");
+const require_dist = require("./dist-8LQ4lDEB.js");
+const require_jwt_signing_key = require("./jwt-signing-key-DxV2ucvJ.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -27,17 +27,17 @@ const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage
 const require_hub_cap_forward = require("./hub-cap-forward-W8oEm4ME.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_constants = require("./constants-CDpry1_T.js");
+const require_constants = require("./constants-Ca-Sgcl8.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
-const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-Dk28EF8B.js");
+const require_event_loop_stall_monitor = require("./event-loop-stall-monitor-CNj73d4D.js");
 const require_tls = require("./tls-BWpwU-d5.js");
-const require_child_cap_dispatch = require("./child-cap-dispatch-BD8fhJ1b.js");
+const require_child_cap_dispatch = require("./child-cap-dispatch-nURMuVTX.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-BgWGRxN5.js");
 const require_custom_action_registry = require("./custom-action-registry-acBY3mHA.js");
-const require_restore_archive = require("./restore-archive-C5f9yX90.js");
+const require_restore_archive = require("./restore-archive-Do_Yu5rC.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
@@ -13984,6 +13984,7 @@ exports.MESH_AUTO_ENFORCE_GRACE_MS = MESH_AUTO_ENFORCE_GRACE_MS;
 exports.MESH_CA_FIELD = require_constants.MESH_CA_FIELD;
 exports.MESH_CA_KEY_REF = require_constants.MESH_CA_KEY_REF;
 exports.MESH_CA_SETTINGS_KEY = require_constants.MESH_CA_SETTINGS_KEY;
+exports.MESH_CLEAR_PORT_FIELD = require_builtins_system_config_system_config_addon.MESH_CLEAR_PORT_FIELD;
 exports.MESH_JOIN_AUTHENTICATE_ACTION = MESH_JOIN_AUTHENTICATE_ACTION;
 exports.MESH_JOIN_CHALLENGE_ACTION = MESH_JOIN_CHALLENGE_ACTION;
 exports.MESH_JOIN_CHALLENGE_INVALID_TYPE = MESH_JOIN_CHALLENGE_INVALID_TYPE;
@@ -14073,6 +14074,7 @@ exports.allFamiliesListenHost = require_tls.allFamiliesListenHost;
 exports.answerClaimedGetStatus = require_child_cap_dispatch.answerClaimedGetStatus;
 exports.applyCertificateToListener = require_tls.applyCertificateToListener;
 exports.applyLanHttp = require_tls.applyLanHttp;
+exports.applyProcessMeshClearPort = require_builtins_system_config_system_config_addon.applyProcessMeshClearPort;
 exports.attachUserManagementInternal = require_builtins_local_auth_local_auth_addon.attachUserManagementInternal;
 exports.attributeStall = require_event_loop_stall_monitor.attributeStall;
 exports.bindPendingLanHttp = require_tls.bindPendingLanHttp;
@@ -14104,6 +14106,7 @@ exports.capActionSuffix = require_child_cap_dispatch.capActionSuffix;
 exports.capBareAction = require_child_cap_dispatch.capBareAction;
 exports.capServiceName = require_child_cap_dispatch.capServiceName;
 exports.checkClusterSecret = require_constants.checkClusterSecret;
+exports.checkProcessMeshClearPort = require_builtins_system_config_system_config_addon.checkProcessMeshClearPort;
 exports.classifyAddonDir = classifyAddonDir;
 exports.classifyCapRoute = require_child_cap_dispatch.classifyCapRoute;
 exports.clearHttpsListener = require_tls.clearHttpsListener;
@@ -14161,6 +14164,7 @@ exports.createUdsLogger = require_child_cap_dispatch.createUdsLogger;
 exports.createUdsLoggerWithControl = require_child_cap_dispatch.createUdsLoggerWithControl;
 exports.createV8Reclaimer = require_child_cap_dispatch.createV8Reclaimer;
 exports.decideMeshAutoEnforce = decideMeshAutoEnforce;
+exports.decideMeshClearPortOff = require_builtins_system_config_system_config_addon.decideMeshClearPortOff;
 exports.deleteModelFromDisk = require_event_loop_stall_monitor.deleteModelFromDisk;
 exports.deriveAgentListenPort = deriveAgentListenPort;
 exports.describeProviderKindDrift = describeProviderKindDrift;
@@ -14209,6 +14213,7 @@ Object.defineProperty(exports, "ensurePython", {
 exports.ensureTlsCert = require_tls.ensureTlsCert;
 exports.evaluateExistingCert = require_tls.evaluateExistingCert;
 exports.expandCapMethods = require_dist.expandCapMethods;
+exports.exportMeshPrivateKeyPem = require_builtins_system_config_system_config_addon.exportMeshPrivateKeyPem;
 exports.fetchJson = require_event_loop_stall_monitor.fetchJson;
 Object.defineProperty(exports, "findInPath", {
 	enumerable: true,
@@ -14253,6 +14258,7 @@ exports.getProcessJwtSigningKeyState = require_jwt_signing_key.getProcessJwtSign
 exports.getProcessMeshAuthMode = require_builtins_system_config_system_config_addon.getProcessMeshAuthMode;
 exports.getProcessMeshAuthStatus = require_builtins_system_config_system_config_addon.getProcessMeshAuthStatus;
 exports.getProcessMeshCaState = require_builtins_system_config_system_config_addon.getProcessMeshCaState;
+exports.getProcessNodeMeshTransport = require_builtins_system_config_system_config_addon.getProcessNodeMeshTransport;
 Object.defineProperty(exports, "getPythonDownloadUrl", {
 	enumerable: true,
 	get: function() {
@@ -14374,6 +14380,7 @@ exports.setPlatformKeychainKey = require_platform_key_source.setPlatformKeychain
 exports.setProcessClusterSecretGate = require_constants.setProcessClusterSecretGate;
 exports.setProcessMeshAuthMode = require_builtins_system_config_system_config_addon.setProcessMeshAuthMode;
 exports.setProcessMeshAuthStatusSource = require_builtins_system_config_system_config_addon.setProcessMeshAuthStatusSource;
+exports.setProcessMeshClearPortControl = require_builtins_system_config_system_config_addon.setProcessMeshClearPortControl;
 exports.setProcessMeshEnforcer = require_builtins_system_config_system_config_addon.setProcessMeshEnforcer;
 exports.setProcessMeshTlsEnabler = require_builtins_system_config_system_config_addon.setProcessMeshTlsEnabler;
 exports.setWrapperActive = require_builtins_device_manager_device_manager_addon.setWrapperActive;

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { $t as logLevelAtMost, A as METHOD_ACCESS_MAP, An as scopesAllowDeviceCap, Ar as expandCapMethods, D as LOG_LEVEL_RANK, En as resolveMethodAuth, F as RUNTIME_DEFAULTS, Gr as readinessKey, Hr as parseJsonObject, Ht as isObjectInput, Jr as scopeKey, K as addonSettingsCapability, Kr as resolveCapMount, Or as emitDownForOwnedCaps, Rt as isArrayOutputSchema, Tr as createEvent, Ur as parseJsonUnknown, Ut as isVoidInput, Wt as kebabToCamel, Yt as lifecycleJobSchema, br as asNumber, dn as objectInputDeclaresRequiredDeviceId, dr as DATAPLANE_SECRET_HEADER$1, en as looseSchema, fr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, gn as procedureAuthKey, gr as ReadinessTimeoutError, hr as ReadinessRegistry, jt as extractNestedAddonId, kn as scopesAllowAddon, lr as errMsg$1, ni as EventCategory$1, pr as DEVICE_STATUS_METHOD, t as ALL_CAPABILITY_DEFINITIONS, un as objectInputDeclaresAddonId, xr as asString$1, yr as asJsonObject$1, zt as isCollectionArrayMethod } from "./dist-osl3bkF0.mjs";
-import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-MQLxLfgF.mjs";
+import { $t as logLevelAtMost, A as METHOD_ACCESS_MAP, An as scopesAllowDeviceCap, Ar as expandCapMethods, D as LOG_LEVEL_RANK, En as resolveMethodAuth, F as RUNTIME_DEFAULTS, Gr as readinessKey, Hr as parseJsonObject, Ht as isObjectInput, Jr as scopeKey, K as addonSettingsCapability, Kr as resolveCapMount, Or as emitDownForOwnedCaps, Rt as isArrayOutputSchema, Tr as createEvent, Ur as parseJsonUnknown, Ut as isVoidInput, Wt as kebabToCamel, Yt as lifecycleJobSchema, br as asNumber, dn as objectInputDeclaresRequiredDeviceId, dr as DATAPLANE_SECRET_HEADER$1, en as looseSchema, fr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, gn as procedureAuthKey, gr as ReadinessTimeoutError, hr as ReadinessRegistry, jt as extractNestedAddonId, kn as scopesAllowAddon, lr as errMsg$1, ni as EventCategory$1, pr as DEVICE_STATUS_METHOD, t as ALL_CAPABILITY_DEFINITIONS, un as objectInputDeclaresAddonId, xr as asString$1, yr as asJsonObject$1, zt as isCollectionArrayMethod } from "./dist-Biqn3TEn.mjs";
+import { c as staticJwtSigningKey, i as getProcessJwtSigningKeyState, n as JwtSigningKeyUnavailableError, o as processJwtSigningKey, r as SYSTEM_SECRET_OWNER, t as JWT_SIGNING_KEY_REF } from "./jwt-signing-key-SnDgvVUQ.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -26,17 +26,17 @@ import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { i as stripForwardedCaller, n as HUB_CAP_FWD_SERVICE, r as createHubCapForwardService, t as HUB_CAP_FWD_ACTION } from "./hub-cap-forward-CDiN1p98.mjs";
 import { StorageOrchestratorAddon, n as buildStorageLocationRegistry, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { _ as clusterSecretMatches, a as MESH_CA_FIELD, b as isClusterSecretMismatchError, d as CLUSTER_SECRET_MISMATCH_TYPE, f as CLUSTER_SECRET_REF, g as checkClusterSecret, h as CLUSTER_SECRET_UNAVAILABLE_TYPE, m as CLUSTER_SECRET_SETTINGS_KEY, o as MESH_CA_KEY_REF, p as CLUSTER_SECRET_REJECTED_EXIT_CODE, r as DEFAULT_HUB_TLS_TCP_PORT, s as MESH_CA_SETTINGS_KEY, v as getProcessClusterSecretGate, x as setProcessClusterSecretGate, y as hashClusterSecret } from "./constants-e3mCa1jG.mjs";
-import { A as setProcessMeshAuthMode, C as loadMeshCa, D as isMeshAuthMode, E as getProcessMeshAuthStatus, F as parseCidrList, I as readCidrSetting, M as setProcessMeshEnforcer, N as createCidrMatcher, O as parseMeshAuthMode, P as normalizeIp, S as issueMeshLeafFromCsr, SystemConfigAddon, T as getProcessMeshAuthMode, _ as caFingerprintCompact, a as setProcessMeshTlsEnabler, b as generateMeshKeyPair, c as mintMeshJoinToken, d as MeshCrl, f as processMeshCrl, g as caFingerprint, h as requireProcessMeshCa, i as ServiceBroker, j as setProcessMeshAuthStatusSource, k as requestProcessMeshEnforcement, l as processJoinTokenJtiStore, m as getProcessMeshCaState, n as TlsTcpTransporter, o as enrollMeshNode, p as MeshCaKeeper, r as Errors, s as JoinTokenJtiStore, u as verifyMeshJoinToken, v as createMeshCsrPem, w as MESH_AUTH_MODE_FIELD, x as issueMeshLeafForNode, y as generateMeshCa } from "./builtins/system-config/system-config.addon.mjs";
+import { _ as clusterSecretMatches, a as MESH_CA_FIELD, b as isClusterSecretMismatchError, d as CLUSTER_SECRET_MISMATCH_TYPE, f as CLUSTER_SECRET_REF, g as checkClusterSecret, h as CLUSTER_SECRET_UNAVAILABLE_TYPE, m as CLUSTER_SECRET_SETTINGS_KEY, o as MESH_CA_KEY_REF, p as CLUSTER_SECRET_REJECTED_EXIT_CODE, r as DEFAULT_HUB_TLS_TCP_PORT, s as MESH_CA_SETTINGS_KEY, v as getProcessClusterSecretGate, x as setProcessClusterSecretGate, y as hashClusterSecret } from "./constants-D5z4EwY8.mjs";
+import { A as loadMeshCa, B as createCidrMatcher, C as caFingerprintCompact, D as generateMeshKeyPair, E as generateMeshCa, F as parseMeshAuthMode, H as parseCidrList, I as requestProcessMeshEnforcement, L as setProcessMeshAuthMode, M as getProcessMeshAuthMode, N as getProcessMeshAuthStatus, O as issueMeshLeafForNode, P as isMeshAuthMode, R as setProcessMeshAuthStatusSource, S as caFingerprint, SystemConfigAddon, T as exportMeshPrivateKeyPem, U as readCidrSetting, V as normalizeIp, _ as MeshCrl, a as setProcessMeshTlsEnabler, b as getProcessMeshCaState, c as mintMeshJoinToken, d as MESH_CLEAR_PORT_FIELD, f as applyProcessMeshClearPort, g as setProcessMeshClearPortControl, h as getProcessNodeMeshTransport, i as ServiceBroker, j as MESH_AUTH_MODE_FIELD, k as issueMeshLeafFromCsr, l as processJoinTokenJtiStore, m as decideMeshClearPortOff, n as TlsTcpTransporter, o as enrollMeshNode, p as checkProcessMeshClearPort, r as Errors, s as JoinTokenJtiStore, u as verifyMeshJoinToken, v as processMeshCrl, w as createMeshCsrPem, x as requireProcessMeshCa, y as MeshCaKeeper, z as setProcessMeshEnforcer } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
-import { C as resolveFormatRevision, S as isModelDownloaded, _ as downloadModel, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as ensureModel, w as revisionWeightUrl, y as fetchJson } from "./event-loop-stall-monitor-BeeWMnyT.mjs";
+import { C as resolveFormatRevision, S as isModelDownloaded, _ as downloadModel, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as ensureModel, w as revisionWeightUrl, y as fetchJson } from "./event-loop-stall-monitor-BtK_0Pjc.mjs";
 import { A as allFamiliesListenHost, C as collectCertIdentity, D as SERVER_AUTH_OID, E as MAX_LEAF_VALIDITY_DAYS, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as evaluateExistingCert, P as readLanHttpState, S as CA_COMMON_NAME, T as LEAF_RENEWAL_WINDOW_DAYS, _ as writeExtraSans, a as validateUploadedTls, b as loadTlsCert, c as registerHttpsListener, d as prepareBootTls, f as UPLOADED_CA_FILE, g as splitPemCertificates, h as readTlsMode, i as storeUploadedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as reloadHttpsListener, m as readTlsAccessStatus, n as regenerateCertificate, o as clearHttpsListener, p as readExtraSans, r as revertToGeneratedCertificate, s as leafFingerprintOf, t as applyCertificateToListener, u as servedHttpsLeafFingerprint, v as writeTlsMode, w as CA_VALIDITY_DAYS, x as reissueTlsLeaf, y as ensureTlsCert } from "./tls-C2NT-Orr.mjs";
-import { $ as stampCallerAddonId, $n as sampleSocketDirection, $t as HUB_MAIN_RSS_BUDGET_MB, A as resolveHwAccel, An as formatHeapSpaces, At as serializeTypedArrays, B as udsChildLogToWorkerEntry, Bn as createMeshQueueReader, Bt as isCredentialKeyName, C as getBrokerEventBus, Cn as createArrayBufferCensusGate, Ct as NATIVE_PROVIDER_SERVICE_INFIX, D as subscribePassthrough, Dn as DECISIVE_HEAP_SPACES, Dt as capServiceName, E as setNodeEventInterest, En as isArrayBufferCensusReport, Et as capBareAction, F as ipcParentLink, Fn as OUTBOUND_QUEUE_SUSTAIN_MS, Ft as installManifestNativeDeps, G as UDS_NO_ROUTE_PREFIX, Gn as createSocketPlaneMeter, Gt as hostNodeIdOf, H as createUdsLoggerWithControl, Hn as EMPTY_SOCKET_PLANE_BASELINE, Ht as redactLogMeta, I as localProviderLink, In as OUTBOUND_QUEUE_THRESHOLD_BYTES, It as resolveAddonClass, J as answerClaimedGetStatus, Jn as formatSocketPlane, Jt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, K as afterWorkerOnlineAnnounce, Kn as createSocketPlaneReader, Kt as createAddonDataPlaneFacility, L as createParentUnownedCallHandler, Ln as createOutboundQueueGate, Lt as buildNpmChildEnv, M as brokerTransportLink, Mn as readHeapSpaces, Mt as CapabilityHandle, N as buildLinkChain, Nn as selectReportedSpaces, Nt as CapabilityUnavailableError, O as AddonDepsManager, On as HEAP_SPACE_REPORT_MIN_MB, Ot as parseCapAction, P as deviceCapResolverLink, Pn as OUTBOUND_QUEUE_COOLDOWN_MS, Pt as copyBundledNativeModules, Q as CapRouteResolver, Qn as recordSocketFrame, Qt as HUB_MAIN_HEAP_WATCH_LABEL, R as createUdsEventBridge, Rn as formatOutboundQueueVerdict, Rt as resolveNpmInvocation, S as clusterEventTopic, Sn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, St as validateProviderRegistrations, T as registerEventBusService, Tn as formatArrayBufferCensus, Tt as capActionSuffix, U as LocalChildClient, Un as SOCKET_PLANE_TOP_N, Ut as redactLogText, V as createUdsLogger, Vn as formatMeshQueue, Vt as redactLogEntry, W as LocalChildRegistry, Wn as SOCKET_QUEUE_TOP_N, Wt as createAddonPeerBytesFacility, X as AGENT_CAP_FWD_ACTION, Xn as EMPTY_SOCKET_DIRECTION, Xt as HEAP_WATCH_INTERVAL_MS, Y as deviceOfGetStatus, Yn as readSocketQueues, Yt as HEAP_RECLAIM_TRIGGER_MB, Z as AGENT_CAP_FWD_SERVICE, Zn as createSocketDirectionCounters, Zt as HEAP_WATCH_WARN_RATIO, _ as getWorkerDeviceRegistry, _n as startRunnerHeapWatch, a as reapProcessGroup, an as ZERO_LOOP_DELAY, ar as MAX_CAP_ACTIONS_PER_PEER, at as __resetCapUsageRegistryForTests, b as setHubConnected, bn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, c as runnerOwnsProcessGroup, cn as createLoopDelayMeter, cr as diffCapActionCensus, ct as UdsLocalTransportClient, d as summarizeMembers, dn as hubMainRssBudget, dr as createEventPlaneReader, dt as PeerAnsweredError, en as HUB_RSS_BUDGET_ENV, er as socketDirectionBytes, et as CapRouteError, f as installManifestSystemDeps, fn as nextRssBudgetState, fr as diffEventPlane, ft as localEndpointPath, g as createUdsAddonContext, gn as startHeapWatch, gt as createBrokerDeviceManagerApi, h as createAddonContext, hn as shouldReclaim, ht as buildNativeCapProxy, in as RUNNER_RSS_BUDGET_ENV, ir as EMPTY_CAP_ACTION_READING, it as PARENT_ROUTED_PROVIDER_ADDON_ID, j as brokerCallForCap, jn as heapSpaceField, jt as DeviceRegistry, k as createKernelHwAccel, kn as emitHeapDiagnosticReport, kt as deserializeTypedArrays, l as signalAllRunnerGroups, ln as createV8Reclaimer, lr as EVENT_PLANE_TOP_N, lt as UdsLocalTransportServer, m as adaptBrokerToCluster, mn as reclaimIntervalMs, mt as encodeFrame, nn as RSS_BUDGET_RELEASE_RATIO, nr as CAP_ACTION_OVERFLOW_LABEL, nt as callWithServiceDiscovery, o as registerRunnerGroup, on as buildHeapSample, or as capActionLabel, ot as getCapUsageRegistry, p as installManifestPythonDeps, pn as parseRssBudgetMb, pr as formatEventPlane, pt as FrameDecoder, q as GET_STATUS_METHOD, qn as diffSocketPlane, qt as HEAP_RECLAIM_MIN_INTERVAL_MS, r as defaultProcessGroupOps, rn as RUNNER_HEAP_WATCH_INTERVAL_MS, rr as CAP_ACTION_UNLABELLED, rt as CapUsageRegistry, s as releaseRunnerGroup, sn as createDeferredHeapWatchSink, sr as createCapActionCensus, st as createLocalTransport, t as CAP_METHOD_NOT_IMPLEMENTED, tn as RSS_BUDGET_REANNOUNCE_MIN_MS, tr as socketDirectionMessages, tt as classifyCapRoute, un as describeRss, ur as createEventPlaneMeter, ut as SocketChannel, v as getOrInitReadinessRegistry, vn as strandedMb, w as getMoleculerEventStats, wn as createInspectorArrayBufferCensus, wt as capActionName, x as EVENT_TOPIC_PREFIX, xn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, xt as createAddonService, y as getOrInitReadinessRegistryForClient, yn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, yt as mountNativeCapService, z as createUdsEventBus, zn as MESH_QUEUE_TOP_N, zt as runNpm } from "./child-cap-dispatch-C68N2a6Y.mjs";
+import { $ as stampCallerAddonId, $n as sampleSocketDirection, $t as HUB_MAIN_RSS_BUDGET_MB, A as resolveHwAccel, An as formatHeapSpaces, At as serializeTypedArrays, B as udsChildLogToWorkerEntry, Bn as createMeshQueueReader, Bt as isCredentialKeyName, C as getBrokerEventBus, Cn as createArrayBufferCensusGate, Ct as NATIVE_PROVIDER_SERVICE_INFIX, D as subscribePassthrough, Dn as DECISIVE_HEAP_SPACES, Dt as capServiceName, E as setNodeEventInterest, En as isArrayBufferCensusReport, Et as capBareAction, F as ipcParentLink, Fn as OUTBOUND_QUEUE_SUSTAIN_MS, Ft as installManifestNativeDeps, G as UDS_NO_ROUTE_PREFIX, Gn as createSocketPlaneMeter, Gt as hostNodeIdOf, H as createUdsLoggerWithControl, Hn as EMPTY_SOCKET_PLANE_BASELINE, Ht as redactLogMeta, I as localProviderLink, In as OUTBOUND_QUEUE_THRESHOLD_BYTES, It as resolveAddonClass, J as answerClaimedGetStatus, Jn as formatSocketPlane, Jt as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, K as afterWorkerOnlineAnnounce, Kn as createSocketPlaneReader, Kt as createAddonDataPlaneFacility, L as createParentUnownedCallHandler, Ln as createOutboundQueueGate, Lt as buildNpmChildEnv, M as brokerTransportLink, Mn as readHeapSpaces, Mt as CapabilityHandle, N as buildLinkChain, Nn as selectReportedSpaces, Nt as CapabilityUnavailableError, O as AddonDepsManager, On as HEAP_SPACE_REPORT_MIN_MB, Ot as parseCapAction, P as deviceCapResolverLink, Pn as OUTBOUND_QUEUE_COOLDOWN_MS, Pt as copyBundledNativeModules, Q as CapRouteResolver, Qn as recordSocketFrame, Qt as HUB_MAIN_HEAP_WATCH_LABEL, R as createUdsEventBridge, Rn as formatOutboundQueueVerdict, Rt as resolveNpmInvocation, S as clusterEventTopic, Sn as ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, St as validateProviderRegistrations, T as registerEventBusService, Tn as formatArrayBufferCensus, Tt as capActionSuffix, U as LocalChildClient, Un as SOCKET_PLANE_TOP_N, Ut as redactLogText, V as createUdsLogger, Vn as formatMeshQueue, Vt as redactLogEntry, W as LocalChildRegistry, Wn as SOCKET_QUEUE_TOP_N, Wt as createAddonPeerBytesFacility, X as AGENT_CAP_FWD_ACTION, Xn as EMPTY_SOCKET_DIRECTION, Xt as HEAP_WATCH_INTERVAL_MS, Y as deviceOfGetStatus, Yn as readSocketQueues, Yt as HEAP_RECLAIM_TRIGGER_MB, Z as AGENT_CAP_FWD_SERVICE, Zn as createSocketDirectionCounters, Zt as HEAP_WATCH_WARN_RATIO, _ as getWorkerDeviceRegistry, _n as startRunnerHeapWatch, a as reapProcessGroup, an as ZERO_LOOP_DELAY, ar as MAX_CAP_ACTIONS_PER_PEER, at as __resetCapUsageRegistryForTests, b as setHubConnected, bn as ARRAY_BUFFER_CENSUS_SUSTAIN_MS, c as runnerOwnsProcessGroup, cn as createLoopDelayMeter, cr as diffCapActionCensus, ct as UdsLocalTransportClient, d as summarizeMembers, dn as hubMainRssBudget, dr as createEventPlaneReader, dt as PeerAnsweredError, en as HUB_RSS_BUDGET_ENV, er as socketDirectionBytes, et as CapRouteError, f as installManifestSystemDeps, fn as nextRssBudgetState, fr as diffEventPlane, ft as localEndpointPath, g as createUdsAddonContext, gn as startHeapWatch, gt as createBrokerDeviceManagerApi, h as createAddonContext, hn as shouldReclaim, ht as buildNativeCapProxy, in as RUNNER_RSS_BUDGET_ENV, ir as EMPTY_CAP_ACTION_READING, it as PARENT_ROUTED_PROVIDER_ADDON_ID, j as brokerCallForCap, jn as heapSpaceField, jt as DeviceRegistry, k as createKernelHwAccel, kn as emitHeapDiagnosticReport, kt as deserializeTypedArrays, l as signalAllRunnerGroups, ln as createV8Reclaimer, lr as EVENT_PLANE_TOP_N, lt as UdsLocalTransportServer, m as adaptBrokerToCluster, mn as reclaimIntervalMs, mt as encodeFrame, nn as RSS_BUDGET_RELEASE_RATIO, nr as CAP_ACTION_OVERFLOW_LABEL, nt as callWithServiceDiscovery, o as registerRunnerGroup, on as buildHeapSample, or as capActionLabel, ot as getCapUsageRegistry, p as installManifestPythonDeps, pn as parseRssBudgetMb, pr as formatEventPlane, pt as FrameDecoder, q as GET_STATUS_METHOD, qn as diffSocketPlane, qt as HEAP_RECLAIM_MIN_INTERVAL_MS, r as defaultProcessGroupOps, rn as RUNNER_HEAP_WATCH_INTERVAL_MS, rr as CAP_ACTION_UNLABELLED, rt as CapUsageRegistry, s as releaseRunnerGroup, sn as createDeferredHeapWatchSink, sr as createCapActionCensus, st as createLocalTransport, t as CAP_METHOD_NOT_IMPLEMENTED, tn as RSS_BUDGET_REANNOUNCE_MIN_MS, tr as socketDirectionMessages, tt as classifyCapRoute, un as describeRss, ur as createEventPlaneMeter, ut as SocketChannel, v as getOrInitReadinessRegistry, vn as strandedMb, w as getMoleculerEventStats, wn as createInspectorArrayBufferCensus, wt as capActionName, x as EVENT_TOPIC_PREFIX, xn as ARRAY_BUFFER_CENSUS_THRESHOLD_MB, xt as createAddonService, y as getOrInitReadinessRegistryForClient, yn as ARRAY_BUFFER_CENSUS_COOLDOWN_MS, yt as mountNativeCapService, z as createUdsEventBus, zn as MESH_QUEUE_TOP_N, zt as runNpm } from "./child-cap-dispatch-B1gyE35b.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B2WZ8_q9.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
-import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-CZRtI1k9.mjs";
+import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-D4cmLoNe.mjs";
 import { z } from "zod";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
@@ -13856,4 +13856,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentMeshAuthenticator, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCrl, MeshJoinClient, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, checkClusterSecret, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, decideMeshAutoEnforce, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isCredentialKeyName, isInfraCapability, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, issueMeshLeafForNode, issueMeshLeafFromCsr, leafFingerprintOf, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, meshErrorType, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, overlayGetStatus, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, prepareRestoreArchive, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshEnforcer, setProcessMeshTlsEnabler, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyMeshJoinToken, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentMeshAuthenticator, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_CLEAR_PORT_FIELD, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCrl, MeshJoinClient, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, applyProcessMeshClearPort, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, checkClusterSecret, checkProcessMeshClearPort, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, decideMeshAutoEnforce, decideMeshClearPortOff, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessNodeMeshTransport, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isCredentialKeyName, isInfraCapability, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, issueMeshLeafForNode, issueMeshLeafFromCsr, leafFingerprintOf, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, meshErrorType, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, overlayGetStatus, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, prepareRestoreArchive, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshClearPortControl, setProcessMeshEnforcer, setProcessMeshTlsEnabler, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyMeshJoinToken, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/{jwt-signing-key-WI6z7JBo.js → jwt-signing-key-DxV2ucvJ.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CUNGH0fs.js");
+const require_dist = require("./dist-8LQ4lDEB.js");
 let node_crypto = require("node:crypto");
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/{jwt-signing-key-MQLxLfgF.mjs → jwt-signing-key-SnDgvVUQ.mjs}

@@ -1,4 +1,4 @@
-import { Sr as buildSecretRef } from "./dist-osl3bkF0.mjs";
+import { Sr as buildSecretRef } from "./dist-Biqn3TEn.mjs";
 import { randomBytes } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**

package/dist/kernel/index.d.ts

@@ -39,8 +39,8 @@ export { buildStorageLocationRegistry } from './storage-location-registry.js';
 export type { StorageLocationRegistry } from './storage-location-registry.js';
 export { createBroker, deriveAgentListenPort, getBrokerTlsTransporter, } from './moleculer/broker-factory.js';
 export type { BrokerConfig } from './moleculer/broker-factory.js';
-export { caFingerprint, caFingerprintCompact, createMeshCsrPem, enrollMeshNode, generateMeshCa, generateMeshKeyPair, getProcessMeshCaState, issueMeshLeafForNode, issueMeshLeafFromCsr, JoinTokenJtiStore, loadMeshCa, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MeshCaKeeper, MeshCrl, mintMeshJoinToken, processMeshCrl, processJoinTokenJtiStore, requireProcessMeshCa, setProcessMeshTlsEnabler, TlsTcpTransporter, verifyMeshJoinToken, DEFAULT_HUB_TLS_TCP_PORT, } from './moleculer/mesh-mtls/index.js';
-export type { MeshCaSigner, MeshEnrollResult, MeshJoinTokenClaims, MeshTlsMaterial, } from './moleculer/mesh-mtls/index.js';
+export { applyProcessMeshClearPort, caFingerprint, caFingerprintCompact, checkProcessMeshClearPort, createMeshCsrPem, decideMeshClearPortOff, enrollMeshNode, exportMeshPrivateKeyPem, getProcessNodeMeshTransport, MESH_CLEAR_PORT_FIELD, setProcessMeshClearPortControl, generateMeshCa, generateMeshKeyPair, getProcessMeshCaState, issueMeshLeafForNode, issueMeshLeafFromCsr, JoinTokenJtiStore, loadMeshCa, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MeshCaKeeper, MeshCrl, mintMeshJoinToken, processMeshCrl, processJoinTokenJtiStore, requireProcessMeshCa, setProcessMeshTlsEnabler, TlsTcpTransporter, verifyMeshJoinToken, DEFAULT_HUB_TLS_TCP_PORT, } from './moleculer/mesh-mtls/index.js';
+export type { MeshCaSigner, MeshClearPortAgent, MeshClearPortControl, MeshClearPortDecision, MeshClearPortMode, MeshEnrollResult, MeshTransport, MeshJoinTokenClaims, MeshTlsMaterial, } from './moleculer/mesh-mtls/index.js';
 export { type AddonDeploySource, isAddonDeploySource } from './moleculer/addon-deploy-source.js';
 export { createAddonService, validateProviderRegistrations, } from './moleculer/addon-service-factory.js';
 export { createCoreCapService, CORE_CAP_SERVICE_NAME } from './moleculer/core-cap-service.js';

package/dist/kernel/moleculer/mesh-mtls/index.d.ts

@@ -2,6 +2,7 @@ export { CLIENT_AUTH_OID, DEFAULT_HUB_TCP_PORT, DEFAULT_HUB_TLS_TCP_PORT, MESH_C
 export { caFingerprint, caFingerprintCompact, createMeshCsrPem, exportMeshPrivateKeyPem, generateMeshCa, generateMeshKeyPair, issueMeshLeafForNode, issueMeshLeafFromCsr, loadMeshCa, MESH_KEY_ALGORITHM, MESH_SIGNING_ALGORITHM, subjectCn, type MeshCaSigner, type MeshLeafMaterial, } from './mesh-ca.js';
 export { clearProcessMeshCa, getProcessMeshCaState, loadOrGenerateMeshCa, MESH_CA_RETRY_MS, MeshCaKeeper, requireProcessMeshCa, setProcessMeshCa, type MeshCaKeeperDeps, type MeshCaState, } from './mesh-ca-keeper.js';
 export { clearProcessMeshCrl, MeshCrl, processMeshCrl, } from './mesh-crl.js';
+export { applyProcessMeshClearPort, checkProcessMeshClearPort, decideMeshClearPortOff, getProcessMeshClearPortControl, getProcessNodeMeshTransport, isMeshClearPortMode, MESH_CLEAR_PORT_FIELD, parseMeshClearPortMode, setProcessMeshClearPortControl, type MeshClearPortAgent, type MeshClearPortControl, type MeshClearPortDecision, type MeshClearPortMode, type MeshTransport, } from './mesh-clear-port.js';
 export { enrollMeshNode } from './mesh-enroll.js';
 export type { EnrollMeshNodeDeps, MeshEnrollRequest, MeshEnrollResult, } from './mesh-enroll.js';
 export { JoinTokenJtiStore, mintMeshJoinToken, processJoinTokenJtiStore, verifyMeshJoinToken, type MeshJoinTokenClaims, type MintJoinTokenInput, } from './mesh-join-token.js';

package/dist/kernel/moleculer/mesh-mtls/mesh-clear-port.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Cutover switch for the hub's clear mesh port (Release A, rollout step 3).
+ *
+ * `cluster.meshClearPort` = `on` (default — clear :6000 + UDP discovery run next
+ * to the TLS :6443 listener) or `off` (the hub stops listening on :6000 and
+ * stops UDP discovery). Turning it off is REFUSED while any online agent still
+ * reaches the hub in clear — the same spirit as D803's auto-enforce: the switch
+ * must never cut off an agent that has not enrolled.
+ *
+ * The setting is owned by `system-config`; the transporter lives in the hub's
+ * broker. They meet through this process slot (same pattern as
+ * `mesh-auth-mode.ts` / `mesh-tls-enabler.ts`).
+ */
+/** How a node reaches the hub. */
+export type MeshTransport = 'tls' | 'clear';
+export type MeshClearPortMode = 'on' | 'off';
+/** The field key inside the `cluster` section. */
+export declare const MESH_CLEAR_PORT_FIELD = "meshClearPort";
+export declare function isMeshClearPortMode(value: unknown): value is MeshClearPortMode;
+/** A stored value that is not a mode reads as `on`: never cut the mesh on a typo. */
+export declare function parseMeshClearPortMode(value: unknown): MeshClearPortMode;
+export interface MeshClearPortAgent {
+    readonly nodeId: string;
+    readonly transport: MeshTransport;
+}
+export interface MeshClearPortControl {
+    /** Agents connected right now (never the hub, never `hub/<runner>` children). */
+    listOnlineAgents(): readonly MeshClearPortAgent[];
+    /** Whether the TLS listener is up — without it, closing the clear port cuts everyone. */
+    isTlsListening(): boolean;
+    /** Close (`off`) or reopen (`on`) the clear TCP reader and UDP discovery. */
+    apply(mode: MeshClearPortMode): Promise<void>;
+    /** How one node reaches the hub, `undefined` when the hub cannot tell. */
+    transportOf(nodeId: string): MeshTransport | undefined;
+}
+export type MeshClearPortDecision = {
+    readonly allowed: true;
+} | {
+    readonly allowed: false;
+    readonly blocking: readonly string[];
+    readonly error: string;
+};
+/** Pure: may the clear port be switched off right now? */
+export declare function decideMeshClearPortOff(control: Pick<MeshClearPortControl, 'listOnlineAgents' | 'isTlsListening'> | null): MeshClearPortDecision;
+/** Published by the hub's broker owner; cleared on shutdown. */
+export declare function setProcessMeshClearPortControl(control: MeshClearPortControl | null): void;
+export declare function getProcessMeshClearPortControl(): MeshClearPortControl | null;
+/** `tls` / `clear` for an agent as the hub sees it; `undefined` off the hub. */
+export declare function getProcessNodeMeshTransport(nodeId: string): MeshTransport | undefined;
+/**
+ * Validate a requested mode against the live mesh. `on` is always allowed; `off`
+ * only when {@link decideMeshClearPortOff} allows. Does NOT apply it.
+ */
+export declare function checkProcessMeshClearPort(mode: MeshClearPortMode): MeshClearPortDecision;
+/** Apply a mode that {@link checkProcessMeshClearPort} allowed. No-op where nobody can. */
+export declare function applyProcessMeshClearPort(mode: MeshClearPortMode): Promise<boolean>;

package/dist/kernel/moleculer/mesh-mtls/tls-tcp-transporter.d.ts

@@ -15,6 +15,11 @@ interface TlsTcpTransporterBase {
     reader: {
         listen(): Promise<number>;
         close(): void;
+        server: NetServer | null;
+        sockets: NetSocket[];
+    } | null;
+    udpServer: {
+        close(): void;
     } | null;
     writer: unknown;
     Promise: PromiseConstructor;
@@ -69,6 +74,9 @@ export declare class TlsTcpTransporter extends TlsTcpTransporter_base {
     private meshTls;
     private readonly crl;
     private readonly tlsSockets;
+    /** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
+    private readonly tlsPeers;
+    private clearDisabled;
     constructor(opts?: TlsTcpTransporterOptions);
     startTcpServer(): Promise<number>;
     connect(): Promise<void>;
@@ -82,6 +90,31 @@ export declare class TlsTcpTransporter extends TlsTcpTransporter_base {
      * Safe to call after connect — starts listening on `tlsPort` alongside clear.
      */
     enableMeshTls(material: MeshTlsMaterial): Promise<void>;
+    /**
+     * How `nodeId` reaches this transporter: `tls` once it completed a mutual-TLS
+     * handshake (certificate CN = node id, issued by the mesh CA — so this cannot
+     * be claimed by a clear-text peer), otherwise `clear`. Sticky until
+     * {@link forgetPeer}: Moleculer closes idle sockets while the node is still
+     * connected, and a closed socket is not a downgrade.
+     */
+    peerTransport(nodeId: string): 'tls' | 'clear';
+    /**
+     * The node disconnected: its next connection decides its transport again —
+     * unless it already re-handshook (the disconnect can be noticed after the
+     * restarted node is back), in which case its live TLS socket keeps it `tls`.
+     */
+    forgetPeer(nodeId: string): void;
+    /** True once the mutual-TLS listener is bound. */
+    isTlsListening(): boolean;
+    isClearTransportEnabled(): boolean;
+    /**
+     * Cutover: stop listening on the clear TCP port, drop the clear-text sockets
+     * already open on it and stop UDP discovery. TLS sockets (own listener, own
+     * port) are untouched. Idempotent.
+     */
+    disableClearTransport(): void;
+    /** The switch back: listen on the clear port again and restart UDP discovery. Idempotent. */
+    enableClearTransport(): Promise<void>;
     /** Close sockets whose peer serial was just revoked. */
     dropRevokedSockets(): void;
     disconnect(): Promise<void>;

package/dist/{restore-archive-CZRtI1k9.mjs → restore-archive-D4cmLoNe.mjs}

@@ -1,4 +1,4 @@
-import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-osl3bkF0.mjs";
+import { g as DATABASE_SNAPSHOT_SUFFIX } from "./dist-Biqn3TEn.mjs";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/{restore-archive-C5f9yX90.js → restore-archive-Do_Yu5rC.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CUNGH0fs.js");
+const require_dist = require("./dist-8LQ4lDEB.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/{retired-settings-keys-LuDd4y3M.mjs → retired-settings-keys-BsgVxh8-.mjs}

@@ -1,4 +1,4 @@
-import { yr as asJsonObject } from "./dist-osl3bkF0.mjs";
+import { yr as asJsonObject } from "./dist-Biqn3TEn.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-WLrbzdPR.js → retired-settings-keys-Cyn3OD0K.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CUNGH0fs.js");
+const require_dist = require("./dist-8LQ4lDEB.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.383",
+  "version": "1.2.385",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",