@camstack/system 1.2.390 → 1.2.392

package/dist/kernel/moleculer/mesh-authenticator.d.ts

@@ -1,71 +1,71 @@
-import { ClusterSecretGate } from './cluster-secret.js';
-import { MeshAuthMode, MeshAuthStatus, MeshNodeAuthState } from './mesh-auth-mode.js';
-import { MeshJoinAuthenticateParams, MeshJoinAuthenticateResult, MeshJoinChallenge } from './mesh-join-proof.js';
+import { type ClusterSecretGate } from "./cluster-secret.js";
+import type { MeshAuthMode, MeshAuthStatus, MeshNodeAuthState } from "./mesh-auth-mode.js";
+import { type MeshJoinAuthenticateParams, type MeshJoinAuthenticateResult, type MeshJoinChallenge } from "./mesh-join-proof.js";
 /** A challenge is answered within this window or not at all. */
-export declare const MESH_JOIN_CHALLENGE_TTL_MS = 60000;
+export declare const MESH_JOIN_CHALLENGE_TTL_MS = 6e4;
 export declare function isRemoteForbiddenAction(action: string): boolean;
 export type MeshCallVerdict = {
-    readonly verdict: 'allow';
-    readonly errorType?: undefined;
+	readonly verdict: "allow";
+	readonly errorType?: undefined;
 } | {
-    readonly verdict: 'tolerate';
-    readonly errorType?: undefined;
+	readonly verdict: "tolerate";
+	readonly errorType?: undefined;
 } | {
-    readonly verdict: 'deny';
-    readonly errorType: string;
-    readonly message: string;
+	readonly verdict: "deny";
+	readonly errorType: string;
+	readonly message: string;
 };
 export interface MeshAuthenticatorDeps {
-    /** The hub's own node id — its local calls never pass through here. */
-    readonly ownNodeId: string;
-    /** The cluster secret as the keychain answers it now (D797). */
-    readonly gate: () => ClusterSecretGate;
-    readonly mode: () => MeshAuthMode;
-    readonly now?: () => number;
-    /** A node completed the challenge–response. */
-    readonly onAuthenticated?: (nodeId: string) => void;
-    /** First time a node is tolerated without proof on this connection. */
-    readonly onTolerated?: (nodeId: string, action: string) => void;
+	/** The hub's own node id — its local calls never pass through here. */
+	readonly ownNodeId: string;
+	/** The cluster secret as the keychain answers it now (D797). */
+	readonly gate: () => ClusterSecretGate;
+	readonly mode: () => MeshAuthMode;
+	readonly now?: () => number;
+	/** A node completed the challenge–response. */
+	readonly onAuthenticated?: (nodeId: string) => void;
+	/** First time a node is tolerated without proof on this connection. */
+	readonly onTolerated?: (nodeId: string, action: string) => void;
 }
 interface RegistrationLike {
-    readonly nodeId: string;
-    readonly clusterSecretHash?: string;
+	readonly nodeId: string;
+	readonly clusterSecretHash?: string;
 }
 export declare class MeshAuthenticator {
-    private readonly deps;
-    private readonly challenges;
-    private readonly nodes;
-    /** Completed the challenge–response at least once since the hub started. */
-    private readonly everAuthenticated;
-    /** Let in WITHOUT the challenge–response at least once since the hub started. */
-    private readonly everTolerated;
-    private readonly now;
-    constructor(deps: MeshAuthenticatorDeps);
-    issueChallenge(sender: string): MeshJoinChallenge;
-    authenticate(sender: string, params: MeshJoinAuthenticateParams): MeshJoinAuthenticateResult;
-    /** The node's connection dropped: it authenticates again when it returns. */
-    forget(nodeId: string): void;
-    admitCall(sender: string, action: string): MeshCallVerdict;
-    /** Same rule as a call, for an inbound event. */
-    admitEvent(sender: string, eventName: string): MeshCallVerdict;
-    private admitSender;
-    /** Throws when `sender` may not register `params`; returns when it may. */
-    admitRegistration(sender: string, params: RegistrationLike): void;
-    private noteTolerated;
-    stateOf(nodeId: string): MeshNodeAuthState;
-    /** Node ids that completed the challenge–response on their current connection. */
-    authenticatedNodeIds(): readonly string[];
-    /** Node ids that ever completed the challenge–response since the hub started. */
-    everAuthenticatedNodeIds(): ReadonlySet<string>;
-    /**
-     * Node ids let in without the challenge–response since the hub started.
-     * Bounded: past {@link MAX_TRACKED_NODES} a flood of fake ids stops adding,
-     * and the ones already here keep the transition open (the operator can still
-     * switch to `enforced` by hand).
-     */
-    everToleratedNodeIds(): readonly string[];
-    snapshot(): MeshAuthStatus;
-    private record;
-    private secretHashOrThrow;
+	private readonly deps;
+	private readonly challenges;
+	private readonly nodes;
+	/** Completed the challenge–response at least once since the hub started. */
+	private readonly everAuthenticated;
+	/** Let in WITHOUT the challenge–response at least once since the hub started. */
+	private readonly everTolerated;
+	private readonly now;
+	constructor(deps: MeshAuthenticatorDeps);
+	issueChallenge(sender: string): MeshJoinChallenge;
+	authenticate(sender: string, params: MeshJoinAuthenticateParams): MeshJoinAuthenticateResult;
+	/** The node's connection dropped: it authenticates again when it returns. */
+	forget(nodeId: string): void;
+	admitCall(sender: string, action: string): MeshCallVerdict;
+	/** Same rule as a call, for an inbound event. */
+	admitEvent(sender: string, eventName: string): MeshCallVerdict;
+	private admitSender;
+	/** Throws when `sender` may not register `params`; returns when it may. */
+	admitRegistration(sender: string, params: RegistrationLike): void;
+	private noteTolerated;
+	stateOf(nodeId: string): MeshNodeAuthState;
+	/** Node ids that completed the challenge–response on their current connection. */
+	authenticatedNodeIds(): readonly string[];
+	/** Node ids that ever completed the challenge–response since the hub started. */
+	everAuthenticatedNodeIds(): ReadonlySet<string>;
+	/**
+	* Node ids let in without the challenge–response since the hub started.
+	* Bounded: past {@link MAX_TRACKED_NODES} a flood of fake ids stops adding,
+	* and the ones already here keep the transition open (the operator can still
+	* switch to `enforced` by hand).
+	*/
+	everToleratedNodeIds(): readonly string[];
+	snapshot(): MeshAuthStatus;
+	private record;
+	private secretHashOrThrow;
 }
 export {};

package/dist/kernel/moleculer/mesh-auto-enforce.d.ts

@@ -1,26 +1,46 @@
-import { ClusterSecretGate } from './cluster-secret.js';
-import { MeshAuthMode } from './mesh-auth-mode.js';
+/**
+* When `transition` may end by itself (D802).
+*
+* The rule the operator chose: enforce once EVERY known agent has presented
+* the secret. "Known" is deliberately wide, so the switch can never cut off an
+* agent the hub merely forgot about:
+*  - every node in the durable cluster-node history (offline ones included —
+*    an agent that is down today still holds no secret tomorrow);
+*  - every node connected right now;
+*  - every node tolerated without proof since the hub started.
+*
+* and it waits:
+*  - for the history to ANSWER (an unanswered read is never "no agents");
+*  - for a grace period after boot, so agents restarting with the hub are
+*    back before an empty roster is taken at its word;
+*  - for the secret to exist (`on`) — nothing can authenticate without it.
+*
+* "Presented" means completed the challenge–response at least once since the
+* hub started. The D797 hash does not count: it is what `enforced` refuses.
+*/
+import type { ClusterSecretGate } from "./cluster-secret.js";
+import type { MeshAuthMode } from "./mesh-auth-mode.js";
 /** Boot grace before an empty or partial roster can end the transition. */
 export declare const MESH_AUTO_ENFORCE_GRACE_MS: number;
 export interface MeshAutoEnforceInput {
-    readonly mode: MeshAuthMode;
-    readonly gate: ClusterSecretGate['kind'];
-    readonly uptimeMs: number;
-    readonly graceMs?: number;
-    /** Agent node ids from the cluster-node history; `null` = the store did not answer. */
-    readonly knownAgents: readonly string[] | null;
-    readonly connected: readonly string[];
-    readonly toleratedEver: readonly string[];
-    readonly authenticatedEver: ReadonlySet<string>;
-    /** The hub's own id and its local children (`hub/<runner>`) are not agents. */
-    readonly ownNodeId: string;
+	readonly mode: MeshAuthMode;
+	readonly gate: ClusterSecretGate["kind"];
+	readonly uptimeMs: number;
+	readonly graceMs?: number;
+	/** Agent node ids from the cluster-node history; `null` = the store did not answer. */
+	readonly knownAgents: readonly string[] | null;
+	readonly connected: readonly string[];
+	readonly toleratedEver: readonly string[];
+	readonly authenticatedEver: ReadonlySet<string>;
+	/** The hub's own id and its local children (`hub/<runner>`) are not agents. */
+	readonly ownNodeId: string;
 }
 export type MeshAutoEnforceDecision = {
-    readonly enforce: true;
-    readonly reason: string;
+	readonly enforce: true;
+	readonly reason: string;
 } | {
-    readonly enforce: false;
-    readonly waitingFor: readonly string[];
-    readonly why: string;
+	readonly enforce: false;
+	readonly waitingFor: readonly string[];
+	readonly why: string;
 };
 export declare function decideMeshAutoEnforce(input: MeshAutoEnforceInput): MeshAutoEnforceDecision;

package/dist/kernel/moleculer/mesh-join-client.d.ts

@@ -1,51 +1,73 @@
-import { Middleware } from 'moleculer';
-export type MeshJoinState = 'pending' | 'authenticated' | 'no-secret' | 'unsupported' | 'unavailable' | 'secret-mismatch' | 'hub-unverified';
+/**
+* MeshJoinClient — the agent half of the mesh join (D802).
+*
+* On every connection to the hub the agent runs the challenge–response
+* (`mesh-join-proof.ts`) BEFORE anything else reaches the hub: the broker
+* middleware from {@link MeshJoinClient.middleware} holds every call to the
+* hub node until the join has settled. The agent also checks the hub's proof,
+* so a node answering to `hub` without the secret is refused.
+*
+* Settled states, and what a call to the hub does in each:
+*  - `authenticated` — mutual proof done → calls flow;
+*  - `no-secret`     — this agent holds no secret → calls flow and the hub
+*                      decides (tolerated in `transition`, refused in
+*                      `enforced`);
+*  - `unsupported`   — the hub predates D802 → calls flow; the agent falls
+*                      back to the D797 hash in `registerNode` (one release);
+*  - `unavailable`   — the hub cannot read its secret yet, or did not answer
+*                      → calls flow (the hub decides) and the owner retries
+*                      the join;
+*  - `secret-mismatch` — the hub refused our proof → calls are REJECTED;
+*  - `hub-unverified`  — the hub could not prove the secret → REJECTED.
+*/
+import type { Middleware } from "moleculer";
+export type MeshJoinState = "pending" | "authenticated" | "no-secret" | "unsupported" | "unavailable" | "secret-mismatch" | "hub-unverified";
 export type MeshJoinCall = (action: string, params: unknown, opts?: {
-    nodeID?: string;
-    timeout?: number;
+	nodeID?: string;
+	timeout?: number;
 }) => Promise<unknown>;
 export interface MeshJoinClientOptions {
-    readonly nodeId: string;
-    /** The agent's cluster secret, read at each join (the operator may enter it at runtime). */
-    readonly secret: () => string | null;
-    readonly call: MeshJoinCall;
-    readonly hubNodeId?: string;
-    readonly maxAttempts?: number;
-    readonly retryDelayMs?: number;
-    readonly callTimeoutMs?: number;
-    /** How long a call waits for a pending join before it fails (default 30 s). */
-    readonly pendingWaitMs?: number;
-    readonly log?: (message: string) => void;
-    /** Told about every settled state. */
-    readonly onSettled?: (state: MeshJoinState) => void;
+	readonly nodeId: string;
+	/** The agent's cluster secret, read at each join (the operator may enter it at runtime). */
+	readonly secret: () => string | null;
+	readonly call: MeshJoinCall;
+	readonly hubNodeId?: string;
+	readonly maxAttempts?: number;
+	readonly retryDelayMs?: number;
+	readonly callTimeoutMs?: number;
+	/** How long a call waits for a pending join before it fails (default 30 s). */
+	readonly pendingWaitMs?: number;
+	readonly log?: (message: string) => void;
+	/** Told about every settled state. */
+	readonly onSettled?: (state: MeshJoinState) => void;
 }
 export declare class MeshJoinClient {
-    private readonly opts;
-    private current;
-    private settledWaiters;
-    private inFlight;
-    private readonly hubNodeId;
-    constructor(opts: MeshJoinClientOptions);
-    get state(): MeshJoinState;
-    /** Did this agent prove itself on the current connection? */
-    get authenticated(): boolean;
-    /**
-     * Run the join. Concurrent callers share one attempt. Resolves with the
-     * settled state; never rejects.
-     */
-    join(): Promise<MeshJoinState>;
-    /** The hub connection dropped: the next connection authenticates again. */
-    reset(): void;
-    /** Resolves when a call to the hub may go out; rejects when it must not. */
-    whenCallable(): Promise<void>;
-    /**
-     * Moleculer middleware for the AGENT broker: every call to the hub node waits
-     * for the join; a hub answer "not authenticated" (the hub restarted and lost
-     * us) triggers a new join.
-     */
-    middleware(onUnauthenticated?: () => void): Middleware;
-    private secretPresent;
-    private settle;
-    private runJoin;
-    private attempt;
+	private readonly opts;
+	private current;
+	private settledWaiters;
+	private inFlight;
+	private readonly hubNodeId;
+	constructor(opts: MeshJoinClientOptions);
+	get state(): MeshJoinState;
+	/** Did this agent prove itself on the current connection? */
+	get authenticated(): boolean;
+	/**
+	* Run the join. Concurrent callers share one attempt. Resolves with the
+	* settled state; never rejects.
+	*/
+	join(): Promise<MeshJoinState>;
+	/** The hub connection dropped: the next connection authenticates again. */
+	reset(): void;
+	/** Resolves when a call to the hub may go out; rejects when it must not. */
+	whenCallable(): Promise<void>;
+	/**
+	* Moleculer middleware for the AGENT broker: every call to the hub node waits
+	* for the join; a hub answer "not authenticated" (the hub restarted and lost
+	* us) triggers a new join.
+	*/
+	middleware(onUnauthenticated?: () => void): Middleware;
+	private secretPresent;
+	private settle;
+	private runJoin;
+	private attempt;
 }

package/dist/kernel/moleculer/mesh-join-proof.d.ts

@@ -12,20 +12,20 @@ export declare const MESH_ACTION_FORBIDDEN_TYPE = "MESH_ACTION_FORBIDDEN";
 export declare const MESH_JOIN_CHALLENGE_INVALID_TYPE = "MESH_JOIN_CHALLENGE_INVALID";
 /** Answer of `$hub.joinChallenge`. */
 export interface MeshJoinChallenge {
-    readonly protocol: number;
-    readonly nonce: string;
+	readonly protocol: number;
+	readonly nonce: string;
 }
 /** Params of `$hub.authenticateNode`. */
 export interface MeshJoinAuthenticateParams {
-    readonly nodeId: string;
-    readonly nonce: string;
-    readonly clientNonce: string;
-    readonly proof: string;
+	readonly nodeId: string;
+	readonly nonce: string;
+	readonly clientNonce: string;
+	readonly proof: string;
 }
 /** Answer of `$hub.authenticateNode`. */
 export interface MeshJoinAuthenticateResult {
-    readonly ok: true;
-    readonly hubProof: string;
+	readonly ok: true;
+	readonly hubProof: string;
 }
 /** A fresh 32-byte nonce, hex. */
 export declare function createMeshNonce(): string;

package/dist/kernel/moleculer/mesh-mtls/constants.d.ts

@@ -9,7 +9,7 @@ export declare const MESH_JOIN_TOKEN_MAX_TTL_SEC: number;
 export declare const MESH_LEAF_VALIDITY_DAYS = 30;
 export declare const MESH_CA_VALIDITY_DAYS = 3650;
 /** Hub clear TCP (existing) and TLS dual-listen port (Release A). */
-export declare const DEFAULT_HUB_TCP_PORT = 6000;
+export declare const DEFAULT_HUB_TCP_PORT = 6e3;
 export declare const DEFAULT_HUB_TLS_TCP_PORT = 6443;
 /** Join token payload version. */
 export declare const MESH_JOIN_TOKEN_VERSION: 1;

package/dist/kernel/moleculer/mesh-mtls/index.d.ts

@@ -1,10 +1,10 @@
-export { CLIENT_AUTH_OID, DEFAULT_HUB_TCP_PORT, DEFAULT_HUB_TLS_TCP_PORT, MESH_CA_COMMON_NAME, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_CA_VALIDITY_DAYS, MESH_JOIN_TOKEN_MAX_TTL_SEC, MESH_JOIN_TOKEN_VERSION, MESH_LEAF_VALIDITY_DAYS, SERVER_AUTH_OID, } from './constants.js';
-export { caFingerprint, caFingerprintCompact, createMeshCsrPem, exportMeshPrivateKeyPem, generateMeshCa, generateMeshKeyPair, issueMeshLeafForNode, issueMeshLeafFromCsr, loadMeshCa, MESH_KEY_ALGORITHM, MESH_SIGNING_ALGORITHM, subjectCn, type MeshCaSigner, type MeshLeafMaterial, } from './mesh-ca.js';
-export { clearProcessMeshCa, getProcessMeshCaState, loadOrGenerateMeshCa, MESH_CA_RETRY_MS, MeshCaKeeper, requireProcessMeshCa, setProcessMeshCa, type MeshCaKeeperDeps, type MeshCaState, } from './mesh-ca-keeper.js';
-export { clearProcessMeshCrl, MeshCrl, processMeshCrl, } from './mesh-crl.js';
-export { applyProcessMeshClearPort, checkProcessMeshClearPort, decideMeshClearPortOff, getProcessMeshClearPortControl, getProcessNodeMeshTransport, isMeshClearPortMode, MESH_CLEAR_PORT_FIELD, parseMeshClearPortMode, setProcessMeshClearPortControl, type MeshClearPortAgent, type MeshClearPortControl, type MeshClearPortDecision, type MeshClearPortMode, type MeshTransport, } from './mesh-clear-port.js';
-export { enrollMeshNode } from './mesh-enroll.js';
-export type { EnrollMeshNodeDeps, MeshEnrollRequest, MeshEnrollResult, } from './mesh-enroll.js';
-export { JoinTokenJtiStore, mintMeshJoinToken, processJoinTokenJtiStore, verifyMeshJoinToken, type MeshJoinTokenClaims, type MintJoinTokenInput, } from './mesh-join-token.js';
-export { getProcessMeshTlsEnabler, requestProcessMeshTlsEnable, setProcessMeshTlsEnabler, type MeshTlsEnabler, } from './mesh-tls-enabler.js';
-export { TlsTcpTransporter, type MeshTlsMaterial, type TlsTcpTransporterOptions, } from './tls-tcp-transporter.js';
+export { CLIENT_AUTH_OID, DEFAULT_HUB_TCP_PORT, DEFAULT_HUB_TLS_TCP_PORT, MESH_CA_COMMON_NAME, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_CA_VALIDITY_DAYS, MESH_JOIN_TOKEN_MAX_TTL_SEC, MESH_JOIN_TOKEN_VERSION, MESH_LEAF_VALIDITY_DAYS, SERVER_AUTH_OID } from "./constants.js";
+export { caFingerprint, caFingerprintCompact, createMeshCsrPem, exportMeshPrivateKeyPem, generateMeshCa, generateMeshKeyPair, issueMeshLeafForNode, issueMeshLeafFromCsr, loadMeshCa, MESH_KEY_ALGORITHM, MESH_SIGNING_ALGORITHM, subjectCn, type MeshCaSigner, type MeshLeafMaterial } from "./mesh-ca.js";
+export { clearProcessMeshCa, getProcessMeshCaState, loadOrGenerateMeshCa, MESH_CA_RETRY_MS, MeshCaKeeper, requireProcessMeshCa, setProcessMeshCa, type MeshCaKeeperDeps, type MeshCaState } from "./mesh-ca-keeper.js";
+export { clearProcessMeshCrl, MeshCrl, processMeshCrl } from "./mesh-crl.js";
+export { applyProcessMeshClearPort, checkProcessMeshClearPort, decideMeshClearPortOff, getProcessMeshClearPortControl, getProcessNodeMeshTransport, isMeshClearPortMode, MESH_CLEAR_PORT_FIELD, parseMeshClearPortMode, setProcessMeshClearPortControl, type MeshClearPortAgent, type MeshClearPortControl, type MeshClearPortDecision, type MeshClearPortMode, type MeshTransport } from "./mesh-clear-port.js";
+export { enrollMeshNode } from "./mesh-enroll.js";
+export type { EnrollMeshNodeDeps, MeshEnrollRequest, MeshEnrollResult } from "./mesh-enroll.js";
+export { JoinTokenJtiStore, mintMeshJoinToken, processJoinTokenJtiStore, verifyMeshJoinToken, type MeshJoinTokenClaims, type MintJoinTokenInput } from "./mesh-join-token.js";
+export { getProcessMeshTlsEnabler, requestProcessMeshTlsEnable, setProcessMeshTlsEnabler, type MeshTlsEnabler } from "./mesh-tls-enabler.js";
+export { TlsTcpTransporter, type MeshTlsMaterial, type TlsTcpTransporterOptions } from "./tls-tcp-transporter.js";

package/dist/kernel/moleculer/mesh-mtls/mesh-ca-keeper.d.ts

@@ -1,55 +1,60 @@
-import { SecretsAccess } from '@camstack/types';
-import { MeshCaSigner } from './mesh-ca.js';
+/**
+* Keeps the hub mesh CA loaded (keychain + `cluster.meshCa`), like the JWT
+* signing-key keeper (D797). Generates at first boot; locked keychain → no
+* issuance (existing certs keep working until expiry).
+*/
+import type { SecretsAccess } from "@camstack/types";
+import { type MeshCaSigner } from "./mesh-ca.js";
 export type MeshCaState = {
-    readonly state: 'ready';
-    readonly ca: MeshCaSigner;
+	readonly state: "ready";
+	readonly ca: MeshCaSigner;
 } | {
-    readonly state: 'unavailable';
-    readonly reason: string;
+	readonly state: "unavailable";
+	readonly reason: string;
 };
 export declare function setProcessMeshCa(state: MeshCaState): void;
 export declare function clearProcessMeshCa(): void;
 export declare function getProcessMeshCaState(): MeshCaState;
 export declare function requireProcessMeshCa(): MeshCaSigner;
-export declare const MESH_CA_RETRY_MS = 30000;
+export declare const MESH_CA_RETRY_MS = 3e4;
 interface KeeperLogger {
-    info(message: string, meta?: {
-        meta?: Record<string, unknown>;
-    }): void;
-    error(message: string, meta?: {
-        meta?: Record<string, unknown>;
-    }): void;
-    warn?(message: string, meta?: {
-        meta?: Record<string, unknown>;
-    }): void;
+	info(message: string, meta?: {
+		meta?: Record<string, unknown>;
+	}): void;
+	error(message: string, meta?: {
+		meta?: Record<string, unknown>;
+	}): void;
+	warn?(message: string, meta?: {
+		meta?: Record<string, unknown>;
+	}): void;
 }
 export interface MeshCaKeeperDeps {
-    readonly secrets: SecretsAccess | null;
-    /** Read `cluster` section (may contain `meshCa` PEM). */
-    readonly readClusterSection: () => Promise<Record<string, unknown>>;
-    /** Persist the CA cert PEM under `cluster.meshCa`. */
-    readonly writeMeshCaCert: (certPem: string) => Promise<void>;
-    readonly logger: KeeperLogger;
-    readonly retryMs?: number;
-    /** Fired when the CA becomes ready (start TLS listener, etc.). */
-    readonly onReady?: (ca: MeshCaSigner) => void | Promise<void>;
+	readonly secrets: SecretsAccess | null;
+	/** Read `cluster` section (may contain `meshCa` PEM). */
+	readonly readClusterSection: () => Promise<Record<string, unknown>>;
+	/** Persist the CA cert PEM under `cluster.meshCa`. */
+	readonly writeMeshCaCert: (certPem: string) => Promise<void>;
+	readonly logger: KeeperLogger;
+	readonly retryMs?: number;
+	/** Fired when the CA becomes ready (start TLS listener, etc.). */
+	readonly onReady?: (ca: MeshCaSigner) => void | Promise<void>;
 }
 export declare class MeshCaKeeper {
-    private readonly deps;
-    private retryTimer;
-    private unsubscribe;
-    private stopped;
-    constructor(deps: MeshCaKeeperDeps);
-    start(): Promise<void>;
-    stop(): void;
-    private load;
-    private apply;
-    private scheduleRetry;
+	private readonly deps;
+	private retryTimer;
+	private unsubscribe;
+	private stopped;
+	constructor(deps: MeshCaKeeperDeps);
+	start(): Promise<void>;
+	stop(): void;
+	private load;
+	private apply;
+	private scheduleRetry;
 }
 export interface LoadOrGenerateMeshCaDeps {
-    readonly secrets: SecretsAccess;
-    readonly readClusterSection: () => Promise<Record<string, unknown>>;
-    readonly writeMeshCaCert: (certPem: string) => Promise<void>;
+	readonly secrets: SecretsAccess;
+	readonly readClusterSection: () => Promise<Record<string, unknown>>;
+	readonly writeMeshCaCert: (certPem: string) => Promise<void>;
 }
 export declare function loadOrGenerateMeshCa(deps: LoadOrGenerateMeshCaDeps): Promise<MeshCaState>;
 export {};

package/dist/kernel/moleculer/mesh-mtls/mesh-ca.d.ts

@@ -1,21 +1,30 @@
-import { webcrypto as WebCrypto } from 'node:crypto';
-import { X509Certificate as PeculiarCertificate } from '@peculiar/x509';
+/**
+* Hub mesh CA — EC P-256, key in the keychain, cert in `cluster.meshCa`.
+*
+* Distinct from the HTTPS local CA (`tls/cert-issue.ts`, RSA): the mesh CA
+* signs node leaves (CN = nodeID) and join-token JWS (ES256). Issuance uses
+* `@peculiar/x509` over WebCrypto — same library the HTTPS path already uses
+* (installed `1.14.3`; registry latest at adoption time was `2.1.0` — stay on
+* the pinned range already shipping).
+*/
+import type { webcrypto as WebCrypto } from "node:crypto";
+import { X509Certificate as PeculiarCertificate } from "@peculiar/x509";
 /** Key generation — EC P-256 (plan). WebCrypto DOM names are not in @types/node. */
 export declare const MESH_KEY_ALGORITHM: WebCrypto.EcKeyGenParams;
 /** Signing — ECDSA with SHA-256. */
 export declare const MESH_SIGNING_ALGORITHM: WebCrypto.EcdsaParams;
 export interface MeshCaSigner {
-    readonly certPem: string;
-    readonly keyPem: string;
-    readonly cert: PeculiarCertificate;
-    readonly privateKey: WebCrypto.CryptoKey;
-    readonly publicKey: WebCrypto.CryptoKey;
+	readonly certPem: string;
+	readonly keyPem: string;
+	readonly cert: PeculiarCertificate;
+	readonly privateKey: WebCrypto.CryptoKey;
+	readonly publicKey: WebCrypto.CryptoKey;
 }
 export interface MeshLeafMaterial {
-    readonly certPem: string;
-    readonly serialNumber: string;
-    readonly notAfter: Date;
-    readonly commonName: string;
+	readonly certPem: string;
+	readonly serialNumber: string;
+	readonly notAfter: Date;
+	readonly commonName: string;
 }
 /** SHA-256 fingerprint of the DER cert, colon-hex uppercase (Node style). */
 export declare function caFingerprint(certPem: string): string;
@@ -24,20 +33,20 @@ export declare function caFingerprintCompact(certPem: string): string;
 export declare function generateMeshCa(now?: Date): Promise<MeshCaSigner>;
 export declare function loadMeshCa(certPem: string, keyPem: string): Promise<MeshCaSigner>;
 /**
- * Issue a leaf from a CSR. CN must be present; when `expectedNodeId` is set
- * it must match. Validity: 30 days.
- */
+* Issue a leaf from a CSR. CN must be present; when `expectedNodeId` is set
+* it must match. Validity: 30 days.
+*/
 export declare function issueMeshLeafFromCsr(ca: MeshCaSigner, csrPem: string, opts?: {
-    readonly expectedNodeId?: string;
-    readonly now?: Date;
-    readonly validDays?: number;
+	readonly expectedNodeId?: string;
+	readonly now?: Date;
+	readonly validDays?: number;
 }): Promise<MeshLeafMaterial>;
 /** Issue a leaf for a known nodeID with a freshly generated key pair (tests / hub self). */
 export declare function issueMeshLeafForNode(ca: MeshCaSigner, nodeId: string, opts?: {
-    readonly now?: Date;
-    readonly validDays?: number;
+	readonly now?: Date;
+	readonly validDays?: number;
 }): Promise<MeshLeafMaterial & {
-    readonly keyPem: string;
+	readonly keyPem: string;
 }>;
 export declare function subjectCn(subject: string): string | null;
 export declare function createMeshCsrPem(keys: WebCrypto.CryptoKeyPair, commonName: string): Promise<string>;