@camstack/system 1.2.390 → 1.2.391

package/dist/kernel/moleculer/mesh-mtls/mesh-clear-port.d.ts

@@ -1,56 +1,56 @@
 /**
- * Cutover switch for the hub's clear mesh port (Release A, rollout step 3).
- *
- * `cluster.meshClearPort` = `on` (default — clear :6000 + UDP discovery run next
- * to the TLS :6443 listener) or `off` (the hub stops listening on :6000 and
- * stops UDP discovery). Turning it off is REFUSED while any online agent still
- * reaches the hub in clear — the same spirit as D803's auto-enforce: the switch
- * must never cut off an agent that has not enrolled.
- *
- * The setting is owned by `system-config`; the transporter lives in the hub's
- * broker. They meet through this process slot (same pattern as
- * `mesh-auth-mode.ts` / `mesh-tls-enabler.ts`).
- */
+* Cutover switch for the hub's clear mesh port (Release A, rollout step 3).
+*
+* `cluster.meshClearPort` = `on` (default — clear :6000 + UDP discovery run next
+* to the TLS :6443 listener) or `off` (the hub stops listening on :6000 and
+* stops UDP discovery). Turning it off is REFUSED while any online agent still
+* reaches the hub in clear — the same spirit as D803's auto-enforce: the switch
+* must never cut off an agent that has not enrolled.
+*
+* The setting is owned by `system-config`; the transporter lives in the hub's
+* broker. They meet through this process slot (same pattern as
+* `mesh-auth-mode.ts` / `mesh-tls-enabler.ts`).
+*/
 /** How a node reaches the hub. */
-export type MeshTransport = 'tls' | 'clear';
-export type MeshClearPortMode = 'on' | 'off';
+export type MeshTransport = "tls" | "clear";
+export type MeshClearPortMode = "on" | "off";
 /** The field key inside the `cluster` section. */
 export declare const MESH_CLEAR_PORT_FIELD = "meshClearPort";
 export declare function isMeshClearPortMode(value: unknown): value is MeshClearPortMode;
 /** A stored value that is not a mode reads as `on`: never cut the mesh on a typo. */
 export declare function parseMeshClearPortMode(value: unknown): MeshClearPortMode;
 export interface MeshClearPortAgent {
-    readonly nodeId: string;
-    readonly transport: MeshTransport;
+	readonly nodeId: string;
+	readonly transport: MeshTransport;
 }
 export interface MeshClearPortControl {
-    /** Agents connected right now (never the hub, never `hub/<runner>` children). */
-    listOnlineAgents(): readonly MeshClearPortAgent[];
-    /** Whether the TLS listener is up — without it, closing the clear port cuts everyone. */
-    isTlsListening(): boolean;
-    /** Close (`off`) or reopen (`on`) the clear TCP reader and UDP discovery. */
-    apply(mode: MeshClearPortMode): Promise<void>;
-    /** How one node reaches the hub, `undefined` when the hub cannot tell. */
-    transportOf(nodeId: string): MeshTransport | undefined;
+	/** Agents connected right now (never the hub, never `hub/<runner>` children). */
+	listOnlineAgents(): readonly MeshClearPortAgent[];
+	/** Whether the TLS listener is up — without it, closing the clear port cuts everyone. */
+	isTlsListening(): boolean;
+	/** Close (`off`) or reopen (`on`) the clear TCP reader and UDP discovery. */
+	apply(mode: MeshClearPortMode): Promise<void>;
+	/** How one node reaches the hub, `undefined` when the hub cannot tell. */
+	transportOf(nodeId: string): MeshTransport | undefined;
 }
 export type MeshClearPortDecision = {
-    readonly allowed: true;
+	readonly allowed: true;
 } | {
-    readonly allowed: false;
-    readonly blocking: readonly string[];
-    readonly error: string;
+	readonly allowed: false;
+	readonly blocking: readonly string[];
+	readonly error: string;
 };
 /** Pure: may the clear port be switched off right now? */
-export declare function decideMeshClearPortOff(control: Pick<MeshClearPortControl, 'listOnlineAgents' | 'isTlsListening'> | null): MeshClearPortDecision;
+export declare function decideMeshClearPortOff(control: Pick<MeshClearPortControl, "listOnlineAgents" | "isTlsListening"> | null): MeshClearPortDecision;
 /** Published by the hub's broker owner; cleared on shutdown. */
 export declare function setProcessMeshClearPortControl(control: MeshClearPortControl | null): void;
 export declare function getProcessMeshClearPortControl(): MeshClearPortControl | null;
 /** `tls` / `clear` for an agent as the hub sees it; `undefined` off the hub. */
 export declare function getProcessNodeMeshTransport(nodeId: string): MeshTransport | undefined;
 /**
- * Validate a requested mode against the live mesh. `on` is always allowed; `off`
- * only when {@link decideMeshClearPortOff} allows. Does NOT apply it.
- */
+* Validate a requested mode against the live mesh. `on` is always allowed; `off`
+* only when {@link decideMeshClearPortOff} allows. Does NOT apply it.
+*/
 export declare function checkProcessMeshClearPort(mode: MeshClearPortMode): MeshClearPortDecision;
 /** Apply a mode that {@link checkProcessMeshClearPort} allowed. No-op where nobody can. */
 export declare function applyProcessMeshClearPort(mode: MeshClearPortMode): Promise<boolean>;

package/dist/kernel/moleculer/mesh-mtls/mesh-crl.d.ts

@@ -1,16 +1,16 @@
 /**
- * Mesh certificate revocation list — in-memory + optional persist hook.
- *
- * Release A can stub persistence; the reader checks serials at handshake and
- * a later "Forget node" closes open sockets (Release A+).
- */
+* Mesh certificate revocation list — in-memory + optional persist hook.
+*
+* Release A can stub persistence; the reader checks serials at handshake and
+* a later "Forget node" closes open sockets (Release A+).
+*/
 export declare class MeshCrl {
-    private readonly serials;
-    revoke(serialNumber: string): void;
-    isRevoked(serialNumber: string): boolean;
-    list(): readonly string[];
-    /** Restore from persisted serials (system-settings). */
-    replaceAll(serials: readonly string[]): void;
+	private readonly serials;
+	revoke(serialNumber: string): void;
+	isRevoked(serialNumber: string): boolean;
+	list(): readonly string[];
+	/** Restore from persisted serials (system-settings). */
+	replaceAll(serials: readonly string[]): void;
 }
 export declare function processMeshCrl(): MeshCrl;
 export declare function clearProcessMeshCrl(): void;

package/dist/kernel/moleculer/mesh-mtls/mesh-enroll.d.ts

@@ -1,27 +1,30 @@
-import { MeshCaSigner } from './mesh-ca.js';
-import { JoinTokenJtiStore, MeshJoinTokenClaims } from './mesh-join-token.js';
+/**
+* `POST /api/mesh/enroll` — verify join token, issue a 30-day leaf from CSR.
+*/
+import { type MeshCaSigner } from "./mesh-ca.js";
+import { type JoinTokenJtiStore, type MeshJoinTokenClaims } from "./mesh-join-token.js";
 export interface MeshEnrollRequest {
-    readonly token: string;
-    readonly csr: string;
+	readonly token: string;
+	readonly csr: string;
 }
 export interface MeshEnrollSuccess {
-    readonly ok: true;
-    readonly cert: string;
-    readonly caCert: string;
-    readonly nodeId: string;
-    readonly notAfter: string;
-    readonly serialNumber: string;
+	readonly ok: true;
+	readonly cert: string;
+	readonly caCert: string;
+	readonly nodeId: string;
+	readonly notAfter: string;
+	readonly serialNumber: string;
 }
 export interface MeshEnrollFailure {
-    readonly ok: false;
-    readonly error: string;
-    readonly status: number;
+	readonly ok: false;
+	readonly error: string;
+	readonly status: number;
 }
 export type MeshEnrollResult = MeshEnrollSuccess | MeshEnrollFailure;
 export interface EnrollMeshNodeDeps {
-    readonly ca: MeshCaSigner;
-    readonly jtiStore?: JoinTokenJtiStore;
-    readonly now?: Date;
+	readonly ca: MeshCaSigner;
+	readonly jtiStore?: JoinTokenJtiStore;
+	readonly now?: Date;
 }
 export declare function enrollMeshNode(body: MeshEnrollRequest, deps: EnrollMeshNodeDeps): Promise<MeshEnrollResult>;
 export type { MeshJoinTokenClaims };

package/dist/kernel/moleculer/mesh-mtls/mesh-join-token.d.ts

@@ -1,55 +1,55 @@
-import { MESH_JOIN_TOKEN_VERSION } from './constants.js';
-import { MeshCaSigner } from './mesh-ca.js';
+import { MESH_JOIN_TOKEN_VERSION } from "./constants.js";
+import { type MeshCaSigner } from "./mesh-ca.js";
 export interface MeshJoinTokenClaims {
-    readonly v: typeof MESH_JOIN_TOKEN_VERSION;
-    readonly hubUrl: string;
-    readonly hubMeshAddress: string;
-    readonly caFingerprint: string;
-    readonly nodeId?: string;
-    readonly jti: string;
-    readonly exp: number;
+	readonly v: typeof MESH_JOIN_TOKEN_VERSION;
+	readonly hubUrl: string;
+	readonly hubMeshAddress: string;
+	readonly caFingerprint: string;
+	readonly nodeId?: string;
+	readonly jti: string;
+	readonly exp: number;
 }
 export type MeshJoinTokenVerifyResult = {
-    readonly ok: true;
-    readonly claims: MeshJoinTokenClaims;
+	readonly ok: true;
+	readonly claims: MeshJoinTokenClaims;
 } | {
-    readonly ok: false;
-    readonly reason: string;
+	readonly ok: false;
+	readonly reason: string;
 };
 /** In-memory + optional persist of spent `jti` until `exp`. */
 export declare class JoinTokenJtiStore {
-    private readonly spent;
-    /** True when `jti` was already consumed (and not yet expired). */
-    isSpent(jti: string, nowSec?: number): boolean;
-    /** Record a jti as used until `exp`. Returns false if already spent. */
-    consume(jti: string, exp: number, nowSec?: number): boolean;
-    /** Test helper. */
-    size(): number;
-    private gc;
+	private readonly spent;
+	/** True when `jti` was already consumed (and not yet expired). */
+	isSpent(jti: string, nowSec?: number): boolean;
+	/** Record a jti as used until `exp`. Returns false if already spent. */
+	consume(jti: string, exp: number, nowSec?: number): boolean;
+	/** Test helper. */
+	size(): number;
+	private gc;
 }
 export declare function processJoinTokenJtiStore(): JoinTokenJtiStore;
 export interface MintJoinTokenInput {
-    readonly ca: MeshCaSigner;
-    readonly hubUrl: string;
-    readonly hubMeshAddress: string;
-    readonly nodeId?: string;
-    /** Seconds from now; capped at {@link MESH_JOIN_TOKEN_MAX_TTL_SEC}. */
-    readonly ttlSec?: number;
-    readonly now?: Date;
-    readonly jti?: string;
+	readonly ca: MeshCaSigner;
+	readonly hubUrl: string;
+	readonly hubMeshAddress: string;
+	readonly nodeId?: string;
+	/** Seconds from now; capped at {@link MESH_JOIN_TOKEN_MAX_TTL_SEC}. */
+	readonly ttlSec?: number;
+	readonly now?: Date;
+	readonly jti?: string;
 }
 export declare function mintMeshJoinToken(input: MintJoinTokenInput): Promise<string>;
 export interface VerifyJoinTokenInput {
-    readonly token: string;
-    readonly ca: MeshCaSigner;
-    readonly jtiStore?: JoinTokenJtiStore;
-    readonly now?: Date;
-    /** When true (enroll), consume the jti. Mint-path verify may skip. */
-    readonly consume?: boolean;
-    /**
-     * Expected CA fingerprint pin. When set, must match the token's
-     * `caFingerprint` (and therefore this CA) — a MITM with another CA fails.
-     */
-    readonly expectedCaFingerprint?: string;
+	readonly token: string;
+	readonly ca: MeshCaSigner;
+	readonly jtiStore?: JoinTokenJtiStore;
+	readonly now?: Date;
+	/** When true (enroll), consume the jti. Mint-path verify may skip. */
+	readonly consume?: boolean;
+	/**
+	* Expected CA fingerprint pin. When set, must match the token's
+	* `caFingerprint` (and therefore this CA) — a MITM with another CA fails.
+	*/
+	readonly expectedCaFingerprint?: string;
 }
 export declare function verifyMeshJoinToken(input: VerifyJoinTokenInput): Promise<MeshJoinTokenVerifyResult>;

package/dist/kernel/moleculer/mesh-mtls/mesh-tls-enabler.d.ts

@@ -1,4 +1,8 @@
-import { MeshTlsMaterial } from './tls-tcp-transporter.js';
+/**
+* Process slot: when the mesh CA becomes ready, the hub enables its TLS
+* listener (issues a CN=hub leaf and calls TlsTcpTransporter.enableMeshTls).
+*/
+import type { MeshTlsMaterial } from "./tls-tcp-transporter.js";
 export type MeshTlsEnabler = (material: MeshTlsMaterial) => void | Promise<void>;
 export declare function setProcessMeshTlsEnabler(enabler: MeshTlsEnabler | null): void;
 export declare function getProcessMeshTlsEnabler(): MeshTlsEnabler | null;

package/dist/kernel/moleculer/mesh-mtls/tls-tcp-transporter.d.ts

@@ -1,138 +1,139 @@
-import { Server as NetServer, Socket as NetSocket } from 'node:net';
-import { MeshCrl } from './mesh-crl.js';
+import type { Server as NetServer, Socket as NetSocket } from "node:net";
+import { type MeshCrl } from "./mesh-crl.js";
+type TcpTransporterConstructor = new (opts?: Record<string, unknown>) => TlsTcpTransporterBase;
+declare const TcpTransporterBase: TcpTransporterConstructor;
 interface TlsTcpTransporterBase {
-    opts: Record<string, unknown> & {
-        port?: number;
-        tlsPort?: number;
-        maxPacketSize?: number;
-    };
-    logger: {
-        info(msg: string, ...args: unknown[]): void;
-        warn(msg: string, ...args: unknown[]): void;
-        debug(msg: string, ...args: unknown[]): void;
-        error(msg: string, ...args: unknown[]): void;
-    };
-    reader: {
-        listen(): Promise<number>;
-        close(): void;
-        server: NetServer | null;
-        sockets: NetSocket[];
-    } | null;
-    udpServer: {
-        close(): void;
-    } | null;
-    writer: unknown;
-    Promise: PromiseConstructor;
-    connected: boolean;
-    nodes: {
-        localNode: {
-            port: number;
-        };
-    };
-    registry: {
-        regenerateLocalRawInfo(force: boolean): void;
-    };
-    startTcpServer(): Promise<number>;
-    startUdpServer(): Promise<void>;
-    startTimers(): void;
-    onConnected(): Promise<void>;
-    loadUrls(): Promise<void>;
-    connect(): Promise<void>;
-    disconnect(): Promise<void>;
-    onIncomingMessage(type: string, message: Buffer, socket?: NetSocket): unknown;
-    receive(cmd: string, data: Buffer, socket?: NetSocket): unknown;
-    deserialize(type: string, data: Buffer): {
-        payload: {
-            sender?: string;
-        };
-    };
-    incomingMessage(cmd: string, data: Buffer): unknown;
+	opts: Record<string, unknown> & {
+		port?: number;
+		tlsPort?: number;
+		maxPacketSize?: number;
+	};
+	logger: {
+		info(msg: string, ...args: unknown[]): void;
+		warn(msg: string, ...args: unknown[]): void;
+		debug(msg: string, ...args: unknown[]): void;
+		error(msg: string, ...args: unknown[]): void;
+	};
+	reader: {
+		listen(): Promise<number>;
+		close(): void;
+		server: NetServer | null;
+		sockets: NetSocket[];
+	} | null;
+	udpServer: {
+		close(): void;
+	} | null;
+	writer: unknown;
+	Promise: PromiseConstructor;
+	connected: boolean;
+	nodes: {
+		localNode: {
+			port: number;
+		};
+	};
+	registry: {
+		regenerateLocalRawInfo(force: boolean): void;
+	};
+	startTcpServer(): Promise<number>;
+	startUdpServer(): Promise<void>;
+	startTimers(): void;
+	onConnected(): Promise<void>;
+	loadUrls(): Promise<void>;
+	connect(): Promise<void>;
+	disconnect(): Promise<void>;
+	onIncomingMessage(type: string, message: Buffer, socket?: NetSocket): unknown;
+	receive(cmd: string, data: Buffer, socket?: NetSocket): unknown;
+	deserialize(type: string, data: Buffer): {
+		payload: {
+			sender?: string;
+		};
+	};
+	incomingMessage(cmd: string, data: Buffer): unknown;
 }
 export interface MeshTlsMaterial {
-    readonly caCertPem: string;
-    readonly certPem: string;
-    readonly keyPem: string;
+	readonly caCertPem: string;
+	readonly certPem: string;
+	readonly keyPem: string;
 }
 export interface TlsTcpTransporterOptions {
-    readonly port?: number;
-    readonly tlsPort?: number;
-    readonly maxPacketSize?: number;
-    readonly useHostname?: boolean;
-    readonly udpDiscovery?: boolean;
-    readonly udpPort?: number;
-    readonly udpPeriod?: number;
-    readonly debug?: boolean;
-    readonly urls?: string;
-    readonly udpMaxDiscovery?: number;
-    /** When set at construction, TLS starts with the clear reader. */
-    readonly meshTls?: MeshTlsMaterial;
-    readonly crl?: MeshCrl;
+	readonly port?: number;
+	readonly tlsPort?: number;
+	readonly maxPacketSize?: number;
+	readonly useHostname?: boolean;
+	readonly udpDiscovery?: boolean;
+	readonly udpPort?: number;
+	readonly udpPeriod?: number;
+	readonly debug?: boolean;
+	readonly urls?: string;
+	readonly udpMaxDiscovery?: number;
+	/** When set at construction, TLS starts with the clear reader. */
+	readonly meshTls?: MeshTlsMaterial;
+	readonly crl?: MeshCrl;
 }
-declare const TlsTcpTransporter_base: new (opts?: Record<string, unknown>) => TlsTcpTransporterBase;
-export declare class TlsTcpTransporter extends TlsTcpTransporter_base {
-    private tlsServer;
-    private meshTls;
-    private readonly crl;
-    private readonly tlsSockets;
-    /** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
-    private readonly tlsPeers;
-    private clearDisabled;
-    /** Clear-text `TcpWriter.connect` captured once before the TLS wrap (A→B). */
-    private clearWriterConnect;
-    private writerTlsPatched;
-    constructor(opts?: TlsTcpTransporterOptions);
-    startTcpServer(): Promise<number>;
-    connect(): Promise<void>;
-    /**
-     * Outbound dial uses mTLS when the peer is already known on TLS (inbound
-     * handshake), or when dialling the hub node id (agent → hub). Everyone else
-     * (runners, unenrolled agents) stays on the clear writer — the hub must not
-     * TLS-wrap every `connect` after deferred `enableMeshTls`.
-     */
-    private shouldDialPeerWithTls;
-    private peerTlsDialPort;
-    /**
-     * Wrap `TcpWriter.connect` so TLS peers are dialed with mutual TLS on the
-     * well-known mesh TLS port (default 6443). Idempotent: the clear connect is
-     * captured once; material refresh rebinds the wrapper.
-     */
-    private patchWriterForTlsClient;
-    /**
-     * Enable (or refresh) the TLS listener once the mesh CA / hub leaf are ready.
-     * Safe to call after connect — starts listening on `tlsPort` alongside clear
-     * and patches the writer so hub→agent dials use mTLS (Release A→B).
-     */
-    enableMeshTls(material: MeshTlsMaterial): Promise<void>;
-    /**
-     * How `nodeId` reaches this transporter: `tls` once it completed a mutual-TLS
-     * handshake (certificate CN = node id, issued by the mesh CA — so this cannot
-     * be claimed by a clear-text peer), otherwise `clear`. Sticky until
-     * {@link forgetPeer}: Moleculer closes idle sockets while the node is still
-     * connected, and a closed socket is not a downgrade.
-     */
-    peerTransport(nodeId: string): 'tls' | 'clear';
-    /**
-     * The node disconnected: its next connection decides its transport again —
-     * unless it already re-handshook (the disconnect can be noticed after the
-     * restarted node is back), in which case its live TLS socket keeps it `tls`.
-     */
-    forgetPeer(nodeId: string): void;
-    /** True once the mutual-TLS listener is bound. */
-    isTlsListening(): boolean;
-    isClearTransportEnabled(): boolean;
-    /**
-     * Cutover: stop listening on the clear TCP port, drop the clear-text sockets
-     * already open on it and stop UDP discovery. TLS sockets (own listener, own
-     * port) are untouched. Idempotent.
-     */
-    disableClearTransport(): void;
-    /** The switch back: listen on the clear port again and restart UDP discovery. Idempotent. */
-    enableClearTransport(): Promise<void>;
-    /** Close sockets whose peer serial was just revoked. */
-    dropRevokedSockets(): void;
-    disconnect(): Promise<void>;
-    onIncomingMessage(type: string, message: Buffer, socket?: NetSocket): unknown;
-    private startTlsServerIfReady;
-    private onTlsClientConnected;
+export declare class TlsTcpTransporter extends TcpTransporterBase {
+	private tlsServer;
+	private meshTls;
+	private readonly crl;
+	private readonly tlsSockets;
+	/** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
+	private readonly tlsPeers;
+	private clearDisabled;
+	/** Clear-text `TcpWriter.connect` captured once before the TLS wrap (A→B). */
+	private clearWriterConnect;
+	private writerTlsPatched;
+	constructor(opts?: TlsTcpTransporterOptions);
+	override startTcpServer(): Promise<number>;
+	override connect(): Promise<void>;
+	/**
+	* Outbound dial uses mTLS when the peer is already known on TLS (inbound
+	* handshake), or when dialling the hub node id (agent → hub). Everyone else
+	* (runners, unenrolled agents) stays on the clear writer — the hub must not
+	* TLS-wrap every `connect` after deferred `enableMeshTls`.
+	*/
+	private shouldDialPeerWithTls;
+	private peerTlsDialPort;
+	/**
+	* Wrap `TcpWriter.connect` so TLS peers are dialed with mutual TLS on the
+	* well-known mesh TLS port (default 6443). Idempotent: the clear connect is
+	* captured once; material refresh rebinds the wrapper.
+	*/
+	private patchWriterForTlsClient;
+	/**
+	* Enable (or refresh) the TLS listener once the mesh CA / hub leaf are ready.
+	* Safe to call after connect — starts listening on `tlsPort` alongside clear
+	* and patches the writer so hub→agent dials use mTLS (Release A→B).
+	*/
+	enableMeshTls(material: MeshTlsMaterial): Promise<void>;
+	/**
+	* How `nodeId` reaches this transporter: `tls` once it completed a mutual-TLS
+	* handshake (certificate CN = node id, issued by the mesh CA — so this cannot
+	* be claimed by a clear-text peer), otherwise `clear`. Sticky until
+	* {@link forgetPeer}: Moleculer closes idle sockets while the node is still
+	* connected, and a closed socket is not a downgrade.
+	*/
+	peerTransport(nodeId: string): "tls" | "clear";
+	/**
+	* The node disconnected: its next connection decides its transport again —
+	* unless it already re-handshook (the disconnect can be noticed after the
+	* restarted node is back), in which case its live TLS socket keeps it `tls`.
+	*/
+	forgetPeer(nodeId: string): void;
+	/** True once the mutual-TLS listener is bound. */
+	isTlsListening(): boolean;
+	isClearTransportEnabled(): boolean;
+	/**
+	* Cutover: stop listening on the clear TCP port, drop the clear-text sockets
+	* already open on it and stop UDP discovery. TLS sockets (own listener, own
+	* port) are untouched. Idempotent.
+	*/
+	disableClearTransport(): void;
+	/** The switch back: listen on the clear port again and restart UDP discovery. Idempotent. */
+	enableClearTransport(): Promise<void>;
+	/** Close sockets whose peer serial was just revoked. */
+	dropRevokedSockets(): void;
+	override disconnect(): Promise<void>;
+	override onIncomingMessage(type: string, message: Buffer, socket?: NetSocket): unknown;
+	private startTlsServerIfReady;
+	private onTlsClientConnected;
 }
 export type { NetServer };

package/dist/kernel/moleculer/mesh-queue-report.d.ts

@@ -1,51 +1,51 @@
 /**
- * mesh-queue-report — the write queue of every Moleculer TCP socket this
- * process holds to a peer node, on the `[mem]` line (D446).
- *
- * ## Why a separate reader
- *
- * The UDS plane is measured on the channel (`SocketChannel.queuedBytes`). The
- * mesh plane is Moleculer's: `TcpTransporter.writer` is a `TcpWriter` whose
- * `sockets` map holds one `net.Socket` per peer node, opened lazily on the
- * first send and — this is the point — `unref()`'d at connect
- * (`transporters/tcp/tcp-writer.js`). An unref'd handle is not in
- * `process._getActiveHandles()`, so the 2026-09-10 census that summed
- * `writableLength` over that list and excluded "every socket queue" could not
- * have seen a backlog to an agent, however large.
- *
- * ## What is read, and how carefully
- *
- * `broker.transit.tx.writer.sockets` — an internal path, walked with type
- * guards and never a cast. Every step that is not the expected shape yields
- * `undefined` for the WHOLE reading: a test broker (`Fake` transporter), a
- * broker that does not exist yet, a Moleculer whose internals moved. `undefined`
- * is "this process has no mesh writer to report", never "the mesh is quiet".
- * A socket entry without numeric `writableLength`/`bytesWritten` is skipped
- * on its own.
- */
+* mesh-queue-report — the write queue of every Moleculer TCP socket this
+* process holds to a peer node, on the `[mem]` line (D446).
+*
+* ## Why a separate reader
+*
+* The UDS plane is measured on the channel (`SocketChannel.queuedBytes`). The
+* mesh plane is Moleculer's: `TcpTransporter.writer` is a `TcpWriter` whose
+* `sockets` map holds one `net.Socket` per peer node, opened lazily on the
+* first send and — this is the point — `unref()`'d at connect
+* (`transporters/tcp/tcp-writer.js`). An unref'd handle is not in
+* `process._getActiveHandles()`, so the 2026-09-10 census that summed
+* `writableLength` over that list and excluded "every socket queue" could not
+* have seen a backlog to an agent, however large.
+*
+* ## What is read, and how carefully
+*
+* `broker.transit.tx.writer.sockets` — an internal path, walked with type
+* guards and never a cast. Every step that is not the expected shape yields
+* `undefined` for the WHOLE reading: a test broker (`Fake` transporter), a
+* broker that does not exist yet, a Moleculer whose internals moved. `undefined`
+* is "this process has no mesh writer to report", never "the mesh is quiet".
+* A socket entry without numeric `writableLength`/`bytesWritten` is skipped
+* on its own.
+*/
 /** One peer node's outbound socket, as the writer holds it. */
 export interface MeshPeerQueue {
-    readonly nodeId: string;
-    /** Bytes handed to the socket that the kernel has not taken yet. */
-    readonly queuedBytes: number;
-    /** Lifetime bytes written on this socket — so a stalled queue can be read
-     *  against the peer's normal rate. */
-    readonly bytesWritten: number;
+	readonly nodeId: string;
+	/** Bytes handed to the socket that the kernel has not taken yet. */
+	readonly queuedBytes: number;
+	/** Lifetime bytes written on this socket — so a stalled queue can be read
+	*  against the peer's normal rate. */
+	readonly bytesWritten: number;
 }
 /** `undefined` = no mesh writer to report (no broker, `Fake` transporter). */
 export type MeshQueueReader = () => readonly MeshPeerQueue[] | undefined;
 /**
- * Build a reader over a lazily-resolved broker. Wrapped: a broker mid-teardown
- * may throw, and a diagnostic that can crash the process it watches is worse
- * than none.
- */
+* Build a reader over a lazily-resolved broker. Wrapped: a broker mid-teardown
+* may throw, and a diagnostic that can crash the process it watches is worse
+* than none.
+*/
 export declare function createMeshQueueReader(getBroker: () => unknown): MeshQueueReader;
 /** At most this many nodes named. A cluster has a handful. */
 export declare const MESH_QUEUE_TOP_N = 3;
 /**
- * The suffix appended to a `[mem]` line — leading space included, empty when
- * this process has no mesh writer. `meshQueued` is printed always, at zero
- * included: a quiet mesh is a reading. `meshQueuedTop` names only nodes with
- * a queue, largest first — a ranked list of zeros is noise.
- */
+* The suffix appended to a `[mem]` line — leading space included, empty when
+* this process has no mesh writer. `meshQueued` is printed always, at zero
+* included: a quiet mesh is a reading. `meshQueuedTop` names only nodes with
+* a queue, largest first — a ranked list of zeros is noise.
+*/
 export declare function formatMeshQueue(peers: readonly MeshPeerQueue[] | undefined): string;