@camstack/system 1.2.390 → 1.2.391

package/dist/kernel/moleculer/event-bus.d.ts

@@ -1,95 +1,95 @@
-import { IEventBus, SystemEvent } from '@camstack/types';
-import { ServiceBroker } from 'moleculer';
+import type { IEventBus, SystemEvent } from "@camstack/types";
+import type { ServiceBroker } from "moleculer";
 /**
- * Narrow interface for the Moleculer ServiceBroker surface used in this file.
- * moleculer's index.d.ts chains through eventemitter2 whose package.json has
- * no `types` field; typescript-eslint's no-unsafe-* rules flag every
- * broker.X access. Cast once per function: `const bkr = broker as unknown as BrokerLike`.
- */
+* Narrow interface for the Moleculer ServiceBroker surface used in this file.
+* moleculer's index.d.ts chains through eventemitter2 whose package.json has
+* no `types` field; typescript-eslint's no-unsafe-* rules flag every
+* broker.X access. Cast once per function: `const bkr = broker as unknown as BrokerLike`.
+*/
 export interface BrokerLike {
-    readonly nodeID: string;
-    call<T = unknown>(action: string, params?: unknown, opts?: unknown): Promise<T>;
-    createService(schema: unknown): void;
-    waitForServices(service: unknown, timeout?: number): Promise<unknown>;
-    broadcast(event: string, data: unknown): void;
-    localBus: {
-        on(event: string, handler: (data: unknown) => void): void;
-    };
-    logger: {
-        warn?: (msg: string) => void;
-    };
+	readonly nodeID: string;
+	call<T = unknown>(action: string, params?: unknown, opts?: unknown): Promise<T>;
+	createService(schema: unknown): void;
+	waitForServices(service: unknown, timeout?: number): Promise<unknown>;
+	broadcast(event: string, data: unknown): void;
+	localBus: {
+		on(event: string, handler: (data: unknown) => void): void;
+	};
+	logger: {
+		warn?: (msg: string) => void;
+	};
 }
 /**
- * Topic prefix for clustered EventBus broadcasts. The `camstack.evt.`
- * namespace keeps our events disjoint from Moleculer internal events
- * (`$node.*`, `$services.*`) — the `$event-bus` service's
- * `camstack.evt.**` wildcard handler therefore never sees them.
- */
+* Topic prefix for clustered EventBus broadcasts. The `camstack.evt.`
+* namespace keeps our events disjoint from Moleculer internal events
+* (`$node.*`, `$services.*`) — the `$event-bus` service's
+* `camstack.evt.**` wildcard handler therefore never sees them.
+*/
 export declare const EVENT_TOPIC_PREFIX = "camstack.evt.";
 /** Build the Moleculer broadcast topic for an event category. */
 export declare function clusterEventTopic(category: string): string;
 /**
- * Subscribe a PASS-THROUGH relay handler to the broker's shared bus WITHOUT
- * registering it in the local-interest surface. Used exclusively by the UDS
- * event bridge for its cluster/parent-local → children fan-out subscription:
- * the bridge must receive every event the gate lets through so it can relay to
- * forked children, but it is not itself a terminal consumer, so it must not
- * count toward this node's interest (a counted `*` would defeat the filter).
- * Returns an unsubscribe function.
- */
+* Subscribe a PASS-THROUGH relay handler to the broker's shared bus WITHOUT
+* registering it in the local-interest surface. Used exclusively by the UDS
+* event bridge for its cluster/parent-local → children fan-out subscription:
+* the bridge must receive every event the gate lets through so it can relay to
+* forked children, but it is not itself a terminal consumer, so it must not
+* count toward this node's interest (a counted `*` would defeat the filter).
+* Returns an unsubscribe function.
+*/
 export declare function subscribePassthrough(broker: ServiceBroker, handler: (event: SystemEvent) => void): () => void;
 /** Cross-node inbound fan-out counters for a broker, `{ delivered, suppressed }`. */
 export interface MoleculerEventStats {
-    readonly delivered: number;
-    readonly suppressed: number;
+	readonly delivered: number;
+	readonly suppressed: number;
 }
 /**
- * Install (or clear, with `null`) the per-node interest oracle consulted by the
- * `$event-bus` inbound handler to decide whether an inbound cross-node event is
- * wanted by any local subscriber on this node. The oracle is read PER-EVENT so a
- * child (un)subscribing takes effect immediately with no re-registration.
- *
- * Only non-retaining nodes (agents) meaningfully filter — a retaining bus (hub
- * main) always accepts every category (it serves `getRecent` + the admin-ui live
- * stream). Installing the oracle on the hub too is therefore harmless and keeps
- * the wiring uniform.
- */
+* Install (or clear, with `null`) the per-node interest oracle consulted by the
+* `$event-bus` inbound handler to decide whether an inbound cross-node event is
+* wanted by any local subscriber on this node. The oracle is read PER-EVENT so a
+* child (un)subscribing takes effect immediately with no re-registration.
+*
+* Only non-retaining nodes (agents) meaningfully filter — a retaining bus (hub
+* main) always accepts every category (it serves `getRecent` + the admin-ui live
+* stream). Installing the oracle on the hub too is therefore harmless and keeps
+* the wiring uniform.
+*/
 export declare function setNodeEventInterest(broker: ServiceBroker, oracle: (() => readonly string[] | null) | null): void;
 /**
- * Cross-node inbound counters for `broker`, or `null` if no cross-node event has
- * been processed yet. Exposed for the D2 shadow burn-in + operator debug —
- * mirror of `LocalChildRegistry.getChildEventStats`.
- */
+* Cross-node inbound counters for `broker`, or `null` if no cross-node event has
+* been processed yet. Exposed for the D2 shadow burn-in + operator debug —
+* mirror of `LocalChildRegistry.getChildEventStats`.
+*/
 export declare function getMoleculerEventStats(broker: ServiceBroker): MoleculerEventStats | null;
 /**
- * Register the `$event-bus` service on a broker. MUST be called BEFORE
- * `broker.start()` — Moleculer announces a service's event
- * subscriptions to remote nodes only during the discovery handshake;
- * a post-start `createService` propagates via the ~10s heartbeat and
- * makes cross-node delivery unreliable in the meantime.
- *
- * The service's single wildcard handler (`camstack.evt.**`) is the
- * inbound bridge: every `broker.broadcast('camstack.evt.<cat>', event)`
- * from any node lands here. Self-origin echoes are dropped (the
- * emitting node already delivered synchronously in `emit`).
- *
- * Idempotent. Internal service (`$`-prefixed) — hidden from the
- * capability graph.
- *
- * Callers:
- *  - hub backend (`MoleculerService.onModuleInit`), before `broker.start()`
- *  - agent bootstrap, before `broker.start()`
- *  - forkable process / group runner, before `broker.start()`
- */
+* Register the `$event-bus` service on a broker. MUST be called BEFORE
+* `broker.start()` — Moleculer announces a service's event
+* subscriptions to remote nodes only during the discovery handshake;
+* a post-start `createService` propagates via the ~10s heartbeat and
+* makes cross-node delivery unreliable in the meantime.
+*
+* The service's single wildcard handler (`camstack.evt.**`) is the
+* inbound bridge: every `broker.broadcast('camstack.evt.<cat>', event)`
+* from any node lands here. Self-origin echoes are dropped (the
+* emitting node already delivered synchronously in `emit`).
+*
+* Idempotent. Internal service (`$`-prefixed) — hidden from the
+* capability graph.
+*
+* Callers:
+*  - hub backend (`MoleculerService.onModuleInit`), before `broker.start()`
+*  - agent bootstrap, before `broker.start()`
+*  - forkable process / group runner, before `broker.start()`
+*/
 export declare function registerEventBusService(broker: ServiceBroker): void;
 /**
- * @param options.retainRecent - Pass `true` ONLY from the hub main process
- *   (`EventBusService.attachBroker`), the single process that serves the
- *   `getRecent`/audit capability. Every other caller (agents, child runners,
- *   the per-addon wrapper, the `$event-bus` handler) omits it → the bus retains
- *   nothing and `getRecent` returns `[]`. Events are one-shot everywhere else.
- */
+* @param options.retainRecent - Pass `true` ONLY from the hub main process
+*   (`EventBusService.attachBroker`), the single process that serves the
+*   `getRecent`/audit capability. Every other caller (agents, child runners,
+*   the per-addon wrapper, the `$event-bus` handler) omits it → the bus retains
+*   nothing and `getRecent` returns `[]`. Events are one-shot everywhere else.
+*/
 export declare function getBrokerEventBus(broker: ServiceBroker, options?: {
-    retainRecent?: boolean;
+	retainRecent?: boolean;
 }): IEventBus;
 export declare function createBrokerEventBus(broker: ServiceBroker, addonId: string): IEventBus;

package/dist/kernel/moleculer/hub-log-forwarder.d.ts

@@ -1,36 +1,36 @@
-import { LogTags } from '@camstack/types';
-import { ServiceBroker } from 'moleculer';
+import type { LogTags } from "@camstack/types";
+import type { ServiceBroker } from "moleculer";
 interface LogEntry {
-    timestamp: Date;
-    level: string;
-    scope?: string;
-    message: string;
-    meta?: Record<string, unknown>;
-    tags?: LogTags;
+	timestamp: Date;
+	level: string;
+	scope?: string;
+	message: string;
+	meta?: Record<string, unknown>;
+	tags?: LogTags;
 }
 /**
- * Hub Log Forwarder — forwards log entries to the hub via $hub.log.
- *
- * Listens for Moleculer node discovery events. When the hub node
- * connects, forwarding activates. When it disconnects, forwarding
- * pauses and resumes on reconnect. No timeouts — fully event-driven.
- *
- * NOTE on `console.*` below: this class IS the log transport. Its own
- * lifecycle messages (connected / disconnected / call-failed) must NOT
- * be routed through a hub-forwarding logger — that would recurse (the
- * log transport logging about itself through itself). The reference
- * `HubForwarderDestination` in `@camstack/system` solves the same problem
- * with an injected `statusLogger` that is wired to a non-forwarding
- * destination. `HubLogForwarder` has no such injection point and is
- * currently unused in the tree (exported only), so its status writes
- * stay on raw `console.*` as a deliberate, documented residual.
- */
+* Hub Log Forwarder — forwards log entries to the hub via $hub.log.
+*
+* Listens for Moleculer node discovery events. When the hub node
+* connects, forwarding activates. When it disconnects, forwarding
+* pauses and resumes on reconnect. No timeouts — fully event-driven.
+*
+* NOTE on `console.*` below: this class IS the log transport. Its own
+* lifecycle messages (connected / disconnected / call-failed) must NOT
+* be routed through a hub-forwarding logger — that would recurse (the
+* log transport logging about itself through itself). The reference
+* `HubForwarderDestination` in `@camstack/system` solves the same problem
+* with an injected `statusLogger` that is wired to a non-forwarding
+* destination. `HubLogForwarder` has no such injection point and is
+* currently unused in the tree (exported only), so its status writes
+* stay on raw `console.*` as a deliberate, documented residual.
+*/
 declare class HubLogForwarder {
-    private readonly broker;
-    private connected;
-    constructor(broker: ServiceBroker);
-    initialize(): Promise<void>;
-    write(entry: LogEntry): void;
-    shutdown(): Promise<void>;
+	private readonly broker;
+	private connected;
+	constructor(broker: ServiceBroker);
+	initialize(): Promise<void>;
+	write(entry: LogEntry): void;
+	shutdown(): Promise<void>;
 }
 export { HubLogForwarder };

package/dist/kernel/moleculer/hub-service.d.ts

@@ -1,46 +1,46 @@
-import { ServiceSchema } from 'moleculer';
-import { LogTags } from '@camstack/types';
-import { RegisterNodeParams } from './node-registry.js';
-import { ClusterSecretGate } from './cluster-secret.js';
-import { MeshAuthenticator } from './mesh-authenticator.js';
+import type { ServiceSchema } from "moleculer";
+import type { LogTags } from "@camstack/types";
+import type { RegisterNodeParams } from "./node-registry.js";
+import { type ClusterSecretGate } from "./cluster-secret.js";
+import type { MeshAuthenticator } from "./mesh-authenticator.js";
 interface HubServiceDeps {
-    readonly getAddonConfig: (addonId: string) => unknown;
-    readonly getSettings: (scope: string, key?: string) => unknown;
-    readonly getRecentEvents: (category?: string, limit?: number) => readonly unknown[];
-    readonly onLog: (entry: {
-        level: string;
-        message: string;
-        addonId: string;
-        nodeId: string;
-        scope?: string;
-        tags?: LogTags;
-        meta?: Record<string, unknown>;
-    }) => void;
-    readonly onSetLogLevel?: (level: string) => void;
-    /**
-     * D3 registration handshake. A node calls `$hub.registerNode` once it
-     * has finished mounting EVERY service; the payload is its complete cap
-     * manifest. Idempotent — replaces the node's prior manifest entirely.
-     */
-    readonly onRegisterNode?: (params: RegisterNodeParams) => void;
-    /** Explicit deregistration (graceful shutdown). `$node.disconnected` covers crashes. */
-    readonly onUnregisterNode?: (nodeId: string) => void;
-    /**
-     * The hub's cluster-secret gate, read on EVERY registration (the secret
-     * lives in the keychain and may be set or changed at runtime — D797):
-     * `off` lets every node in, `on` requires the matching `clusterSecretHash`,
-     * `unknown` (the keychain cannot answer yet) refuses with a retryable error.
-     * Absent → `off` (test brokers); the hub always passes the keychain's gate.
-     */
-    readonly clusterSecretGate?: () => ClusterSecretGate;
-    /**
-     * The hub's per-node mesh identity (D802). When present, `joinChallenge` /
-     * `authenticateNode` run the challenge–response and `registerNode` asks it
-     * whether the SENDER may register (`MeshAuthenticator.admitRegistration`);
-     * `clusterSecretGate` is then read through it. Absent → the D797 hash gate
-     * alone (test brokers).
-     */
-    readonly meshAuth?: MeshAuthenticator;
+	readonly getAddonConfig: (addonId: string) => unknown;
+	readonly getSettings: (scope: string, key?: string) => unknown;
+	readonly getRecentEvents: (category?: string, limit?: number) => readonly unknown[];
+	readonly onLog: (entry: {
+		level: string;
+		message: string;
+		addonId: string;
+		nodeId: string;
+		scope?: string;
+		tags?: LogTags;
+		meta?: Record<string, unknown>;
+	}) => void;
+	readonly onSetLogLevel?: (level: string) => void;
+	/**
+	* D3 registration handshake. A node calls `$hub.registerNode` once it
+	* has finished mounting EVERY service; the payload is its complete cap
+	* manifest. Idempotent — replaces the node's prior manifest entirely.
+	*/
+	readonly onRegisterNode?: (params: RegisterNodeParams) => void;
+	/** Explicit deregistration (graceful shutdown). `$node.disconnected` covers crashes. */
+	readonly onUnregisterNode?: (nodeId: string) => void;
+	/**
+	* The hub's cluster-secret gate, read on EVERY registration (the secret
+	* lives in the keychain and may be set or changed at runtime — D797):
+	* `off` lets every node in, `on` requires the matching `clusterSecretHash`,
+	* `unknown` (the keychain cannot answer yet) refuses with a retryable error.
+	* Absent → `off` (test brokers); the hub always passes the keychain's gate.
+	*/
+	readonly clusterSecretGate?: () => ClusterSecretGate;
+	/**
+	* The hub's per-node mesh identity (D802). When present, `joinChallenge` /
+	* `authenticateNode` run the challenge–response and `registerNode` asks it
+	* whether the SENDER may register (`MeshAuthenticator.admitRegistration`);
+	* `clusterSecretGate` is then read through it. Absent → the D797 hash gate
+	* alone (test brokers).
+	*/
+	readonly meshAuth?: MeshAuthenticator;
 }
 declare function createHubService(deps: HubServiceDeps): ServiceSchema;
 export { createHubService };

package/dist/kernel/moleculer/init-watchdog.d.ts

@@ -1,60 +1,60 @@
 /**
- * The initialize() stall watchdog.
- *
- * ## What it is guarding
- *
- * A runner publishes its capability manifest ONLY once every hosted addon's
- * `initialize()` has returned: `addon-runner.ts` appends to `runnerManifest`
- * AFTER the await, and `refreshChildCaps('post-init')` runs after the whole
- * loop. So an `initialize()` that does not return is not a slow feature — it
- * takes every capability that addon owns OFF the cluster. Callers get
- * `no provider registered for cap "…"`, and the admin UI renders "provider not
- * available".
- *
- * ## Why a log line and not a bound
- *
- * 2026-08-14: `pipeline-analytics` awaited a timelapse back-fill render inside
- * `initialize()`. The window was 19:00→05:00, the export rendered for over half
- * an hour, and for that whole time `notification-rules`, `pipeline-analytics`,
- * `zone-analytics`, `audio-metrics`, `videoclips`, `face-gallery`,
- * `plate-gallery` and `addon-widgets-source` had ZERO providers cluster-wide.
- * The runner was healthy and chatty throughout — its 30 s tick kept logging —
- * which is exactly why nothing looked wrong. Not one line said the manifest had
- * never been published, and the diagnosis cost hours of log correlation.
- *
- * Killing the runner mid-init would be worse than the stall (a half-initialised
- * addon respawning in a loop), so this does not bound anything. It makes the
- * stall NAMED, periodic, and attributable to the addon and the exact
- * capabilities it is holding hostage — which is the one thing that was missing.
- */
+* The initialize() stall watchdog.
+*
+* ## What it is guarding
+*
+* A runner publishes its capability manifest ONLY once every hosted addon's
+* `initialize()` has returned: `addon-runner.ts` appends to `runnerManifest`
+* AFTER the await, and `refreshChildCaps('post-init')` runs after the whole
+* loop. So an `initialize()` that does not return is not a slow feature — it
+* takes every capability that addon owns OFF the cluster. Callers get
+* `no provider registered for cap "…"`, and the admin UI renders "provider not
+* available".
+*
+* ## Why a log line and not a bound
+*
+* 2026-08-14: `pipeline-analytics` awaited a timelapse back-fill render inside
+* `initialize()`. The window was 19:00→05:00, the export rendered for over half
+* an hour, and for that whole time `notification-rules`, `pipeline-analytics`,
+* `zone-analytics`, `audio-metrics`, `videoclips`, `face-gallery`,
+* `plate-gallery` and `addon-widgets-source` had ZERO providers cluster-wide.
+* The runner was healthy and chatty throughout — its 30 s tick kept logging —
+* which is exactly why nothing looked wrong. Not one line said the manifest had
+* never been published, and the diagnosis cost hours of log correlation.
+*
+* Killing the runner mid-init would be worse than the stall (a half-initialised
+* addon respawning in a loop), so this does not bound anything. It makes the
+* stall NAMED, periodic, and attributable to the addon and the exact
+* capabilities it is holding hostage — which is the one thing that was missing.
+*/
 /** First warning after this long without `initialize()` returning. */
-export declare const INIT_WATCHDOG_FIRST_MS = 60000;
+export declare const INIT_WATCHDOG_FIRST_MS = 6e4;
 /** And every this often afterwards, for as long as it stays stuck. */
-export declare const INIT_WATCHDOG_REPEAT_MS = 300000;
+export declare const INIT_WATCHDOG_REPEAT_MS = 3e5;
 /** The warn sink — narrow on purpose, so this module needs no logger type. */
 export type InitWatchdogWarn = (message: string, meta: Record<string, unknown>) => void;
 export interface InitWatchdogOptions {
-    /** The addon whose `initialize()` is being awaited. */
-    readonly addonId: string;
-    /**
-     * The capability names the addon's manifest declares. They are what the
-     * cluster is missing while the stall lasts, so they belong in the line — a
-     * reader must not have to open the manifest to learn what is offline.
-     */
-    readonly declaredCapabilities: readonly string[];
-    readonly warn: InitWatchdogWarn;
-    readonly now?: () => number;
-    readonly firstMs?: number;
-    readonly repeatMs?: number;
+	/** The addon whose `initialize()` is being awaited. */
+	readonly addonId: string;
+	/**
+	* The capability names the addon's manifest declares. They are what the
+	* cluster is missing while the stall lasts, so they belong in the line — a
+	* reader must not have to open the manifest to learn what is offline.
+	*/
+	readonly declaredCapabilities: readonly string[];
+	readonly warn: InitWatchdogWarn;
+	readonly now?: () => number;
+	readonly firstMs?: number;
+	readonly repeatMs?: number;
 }
 export interface InitWatchdogHandle {
-    /** Stop warning. Safe to call more than once, and after the last warning. */
-    clear(): void;
+	/** Stop warning. Safe to call more than once, and after the last warning. */
+	clear(): void;
 }
 /**
- * Start warning if `initialize()` has not returned within `firstMs`.
- *
- * The caller MUST `clear()` in a `finally`, so a throwing initialize (which the
- * runner turns into `process.exit(1)`) does not keep the timer alive.
- */
+* Start warning if `initialize()` has not returned within `firstMs`.
+*
+* The caller MUST `clear()` in a `finally`, so a throwing initialize (which the
+* runner turns into `process.exit(1)`) does not keep the timer alive.
+*/
 export declare function startInitWatchdog(options: InitWatchdogOptions): InitWatchdogHandle;

package/dist/kernel/moleculer/mesh-access-middleware.d.ts

@@ -1,33 +1,48 @@
-import { Middleware } from 'moleculer';
-import { MeshCallVerdict } from './mesh-authenticator.js';
+/**
+* Mesh gate middleware (D802): wraps every LOCAL action and event handler so
+* it sees each request another node sends with `ctx.nodeID` = the sender.
+*
+* Used on both sides of the mesh:
+*  - hub: {@link MeshAuthenticator} (challenge–response join);
+*  - agent: {@link AgentMeshAuthenticator} (hub proven by mutual join + own
+*    children via `$agent.registerNode`).
+*
+* For a request from another node it:
+*  1. asks the gate's `admitCall` — refuse, tolerate or allow;
+*  2. strips a forged identity from the params ({@link stripForgedIdentity}).
+*
+* Calls a node makes to itself (`ctx.nodeID` = own) pass untouched.
+*/
+import { type Middleware } from "moleculer";
+import type { MeshCallVerdict } from "./mesh-authenticator.js";
 /** Minimal surface the middleware needs — hub and agent authenticators both fit. */
 export interface MeshCallGate {
-    admitCall(sender: string, action: string): MeshCallVerdict;
-    admitEvent(sender: string, eventName: string): MeshCallVerdict;
+	admitCall(sender: string, action: string): MeshCallVerdict;
+	admitEvent(sender: string, eventName: string): MeshCallVerdict;
 }
 /**
- * The params of a request from another node, with every identity it claimed
- * removed:
- *  - a cap action's input loses `caller` (the user identity the hub's tRPC
- *    router injects for `caller: 'required'` methods — `keychainAdmin.reveal`
- *    reads it) and `callerAddonId` (the transport's addon stamp the keychain
- *    owner-checks);
- *  - `$hub-cap-fwd.forward` keeps its envelope `callerAddonId` — the forward
- *    service checks it against the sender's registered manifest — but the
- *    forwarded `args` lose both.
- */
+* The params of a request from another node, with every identity it claimed
+* removed:
+*  - a cap action's input loses `caller` (the user identity the hub's tRPC
+*    router injects for `caller: 'required'` methods — `keychainAdmin.reveal`
+*    reads it) and `callerAddonId` (the transport's addon stamp the keychain
+*    owner-checks);
+*  - `$hub-cap-fwd.forward` keeps its envelope `callerAddonId` — the forward
+*    service checks it against the sender's registered manifest — but the
+*    forwarded `args` lose both.
+*/
 export declare function stripForgedIdentity(action: string, params: unknown): unknown;
 interface GateLogger {
-    warn(message: string, meta?: Record<string, unknown>): void;
+	warn(message: string, meta?: Record<string, unknown>): void;
 }
 export interface MeshAccessMiddlewareOptions {
-    readonly ownNodeId: string;
-    readonly authenticator: MeshCallGate;
-    readonly logger?: GateLogger;
+	readonly ownNodeId: string;
+	readonly authenticator: MeshCallGate;
+	readonly logger?: GateLogger;
 }
 /**
- * Build the middleware. Pass it in `ServiceBroker({ middlewares: [...] })`
- * so it wraps every service, including the ones Moleculer creates itself.
- */
+* Build the middleware. Pass it in `ServiceBroker({ middlewares: [...] })`
+* so it wraps every service, including the ones Moleculer creates itself.
+*/
 export declare function createMeshAccessMiddleware(options: MeshAccessMiddlewareOptions): Middleware;
 export {};

package/dist/kernel/moleculer/mesh-auth-mode.d.ts

@@ -1,57 +1,51 @@
 /**
- * How strictly the hub holds other nodes to the mesh join (D802).
- *
- *  - `transition`: a node that has not authenticated is TOLERATED — its calls
- *    run, a warning names it, and System → Cluster lists it as "not
- *    authenticated". This is how an existing cluster upgrades without
- *    splitting: the hub generates its secret, the operator copies it into each
- *    agent, and nothing is refused meanwhile.
- *  - `enforced`: a node that has not authenticated is refused on every action
- *    and its events are dropped. The D797 hash in `registerNode` is no longer
- *    accepted either — only the challenge–response.
- *
- * `transition` ends by itself once EVERY node the hub has ever seen (the
- * cluster-node history) has authenticated with the challenge–response
- * (`MeshAuthenticator.onAuthenticated` → `requestProcessMeshEnforcement`).
- * The operator can also switch it in System → Cluster, in both directions.
- *
- * The mode lives in the `cluster` section of `system-settings`
- * (`cluster.meshAuth`), owned by `system-config`, published here as a process
- * slot the hub's broker reads on every call — the same pattern as the cluster
- * secret gate (`cluster-secret.ts`).
- */
-export type MeshAuthMode = 'transition' | 'enforced';
+* How strictly the hub holds other nodes to the mesh join (D802).
+*
+*  - `transition`: a node that has not authenticated is TOLERATED — its calls
+*    run, a warning names it, and System → Cluster lists it as "not
+*    authenticated". This is how an existing cluster upgrades without
+*    splitting: the hub generates its secret, the operator copies it into each
+*    agent, and nothing is refused meanwhile.
+*  - `enforced`: a node that has not authenticated is refused on every action
+*    and its events are dropped. The D797 hash in `registerNode` is no longer
+*    accepted either — only the challenge–response.
+*
+* `transition` ends by itself once EVERY node the hub has ever seen (the
+* cluster-node history) has authenticated with the challenge–response
+* (`MeshAuthenticator.onAuthenticated` → `requestProcessMeshEnforcement`).
+* The operator can also switch it in System → Cluster, in both directions.
+*
+* The mode lives in the `cluster` section of `system-settings`
+* (`cluster.meshAuth`), owned by `system-config`, published here as a process
+* slot the hub's broker reads on every call — the same pattern as the cluster
+* secret gate (`cluster-secret.ts`).
+*/
+export type MeshAuthMode = "transition" | "enforced";
 /** The field key inside the `cluster` section. */
 export declare const MESH_AUTH_MODE_FIELD = "meshAuth";
 export declare function isMeshAuthMode(value: unknown): value is MeshAuthMode;
 /** A stored value that is not a mode reads as `transition`: never refuse on a typo. */
 export declare function parseMeshAuthMode(value: unknown): MeshAuthMode;
 /** How a node stands with the hub right now. */
-export type MeshNodeAuthState = 
-/** Answered the challenge–response on its current connection. */
-'authenticated'
-/** Registered with the D797 hash (replayable) — accepted in `transition` only. */
- | 'legacy'
-/** Presented nothing: tolerated in `transition`, refused in `enforced`. */
- | 'unauthenticated';
+export type MeshNodeAuthState = "authenticated" | "legacy" | "unauthenticated";
 export interface MeshNodeAuthEntry {
-    readonly nodeId: string;
-    readonly state: MeshNodeAuthState;
-    /** Epoch ms of the last change. */
-    readonly since: number;
+	readonly nodeId: string;
+	readonly state: MeshNodeAuthState;
+	/** Epoch ms of the last change. */
+	readonly since: number;
 }
 /** What System → Cluster shows. */
 export interface MeshAuthStatus {
-    readonly mode: MeshAuthMode;
-    readonly nodes: readonly MeshNodeAuthEntry[];
+	readonly mode: MeshAuthMode;
+	readonly nodes: readonly MeshNodeAuthEntry[];
 }
 /** Published by `system-config` whenever the stored mode is (re)read. */
 export declare function setProcessMeshAuthMode(mode: MeshAuthMode): void;
 /**
- * The hub's mode. Until `system-config` has read it: `transition` — the safe
- * side for an upgrading cluster (nothing that worked before is refused), and
- * exactly what an unread setting means.
- */
+* The hub's mode. Until `system-config` has read it: `transition` — the safe
+* side for an upgrading cluster (nothing that worked before is refused), and
+* exactly what an unread setting means.
+*/
 export declare function getProcessMeshAuthMode(): MeshAuthMode;
 export declare function clearProcessMeshAuthMode(): void;
 /** Persists `enforced`; installed by `system-config`, which owns the setting. */