@camstack/system 1.2.396 → 1.2.397

package/dist/{constants-C1WoQ0E8.mjs → constants-5vADty9I.mjs}

@@ -92,8 +92,6 @@ var MESH_CA_FIELD = "meshCa";
 /** Join-token / leaf lifetimes. */
 var MESH_JOIN_TOKEN_MAX_TTL_SEC = 3600;
 var MESH_CA_VALIDITY_DAYS = 3650;
-/** Hub clear TCP (existing) and TLS dual-listen port (Release A). */
-var DEFAULT_HUB_TCP_PORT = 6e3;
 var DEFAULT_HUB_TLS_TCP_PORT = 6443;
 /** Subject of the mesh root. Distinct from the HTTPS local CA. */
 var MESH_CA_COMMON_NAME = "CamStack Mesh CA";
@@ -101,4 +99,4 @@ var MESH_CA_COMMON_NAME = "CamStack Mesh CA";
 var SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
 var CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
 //#endregion
-export { clusterSecretMatches as _, MESH_CA_FIELD as a, isClusterSecretMismatchError as b, MESH_CA_VALIDITY_DAYS as c, CLUSTER_SECRET_MISMATCH_TYPE as d, CLUSTER_SECRET_REF as f, checkClusterSecret as g, CLUSTER_SECRET_UNAVAILABLE_TYPE as h, MESH_CA_COMMON_NAME as i, MESH_JOIN_TOKEN_MAX_TTL_SEC as l, CLUSTER_SECRET_SETTINGS_KEY as m, DEFAULT_HUB_TCP_PORT as n, MESH_CA_KEY_REF as o, CLUSTER_SECRET_REJECTED_EXIT_CODE as p, DEFAULT_HUB_TLS_TCP_PORT as r, MESH_CA_SETTINGS_KEY as s, CLIENT_AUTH_OID as t, SERVER_AUTH_OID as u, getProcessClusterSecretGate as v, setProcessClusterSecretGate as x, hashClusterSecret as y };
+export { getProcessClusterSecretGate as _, MESH_CA_KEY_REF as a, setProcessClusterSecretGate as b, MESH_JOIN_TOKEN_MAX_TTL_SEC as c, CLUSTER_SECRET_REF as d, CLUSTER_SECRET_REJECTED_EXIT_CODE as f, clusterSecretMatches as g, checkClusterSecret as h, MESH_CA_FIELD as i, SERVER_AUTH_OID as l, CLUSTER_SECRET_UNAVAILABLE_TYPE as m, DEFAULT_HUB_TLS_TCP_PORT as n, MESH_CA_SETTINGS_KEY as o, CLUSTER_SECRET_SETTINGS_KEY as p, MESH_CA_COMMON_NAME as r, MESH_CA_VALIDITY_DAYS as s, CLIENT_AUTH_OID as t, CLUSTER_SECRET_MISMATCH_TYPE as u, hashClusterSecret as v, isClusterSecretMismatchError as y };

package/dist/{constants-Bz9gKWe8.js → constants-Dcecs0Ks.js}

@@ -92,8 +92,6 @@ var MESH_CA_FIELD = "meshCa";
 /** Join-token / leaf lifetimes. */
 var MESH_JOIN_TOKEN_MAX_TTL_SEC = 3600;
 var MESH_CA_VALIDITY_DAYS = 3650;
-/** Hub clear TCP (existing) and TLS dual-listen port (Release A). */
-var DEFAULT_HUB_TCP_PORT = 6e3;
 var DEFAULT_HUB_TLS_TCP_PORT = 6443;
 /** Subject of the mesh root. Distinct from the HTTPS local CA. */
 var MESH_CA_COMMON_NAME = "CamStack Mesh CA";
@@ -137,12 +135,6 @@ Object.defineProperty(exports, "CLUSTER_SECRET_UNAVAILABLE_TYPE", {
 		return CLUSTER_SECRET_UNAVAILABLE_TYPE;
 	}
 });
-Object.defineProperty(exports, "DEFAULT_HUB_TCP_PORT", {
-	enumerable: true,
-	get: function() {
-		return DEFAULT_HUB_TCP_PORT;
-	}
-});
 Object.defineProperty(exports, "DEFAULT_HUB_TLS_TCP_PORT", {
 	enumerable: true,
 	get: function() {

package/dist/index.js

@@ -27,7 +27,7 @@ const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage
 const require_hub_cap_forward = require("./hub-cap-forward-W8oEm4ME.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_constants = require("./constants-Bz9gKWe8.js");
+const require_constants = require("./constants-Dcecs0Ks.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
@@ -11132,9 +11132,8 @@ function createBroker(config) {
 			tlsPort: config.tlsPort ?? 6443,
 			maxPacketSize: 10 * 1024 * 1024,
 			useHostname,
-			udpDiscovery: true,
-			udpPort,
-			udpPeriod: 5,
+			hubTlsOnly: true,
+			udpDiscovery: false,
 			debug: false,
 			...config.meshTls !== void 0 ? { meshTls: config.meshTls } : {}
 		}),
@@ -14033,7 +14032,6 @@ exports.MESH_AUTO_ENFORCE_GRACE_MS = MESH_AUTO_ENFORCE_GRACE_MS;
 exports.MESH_CA_FIELD = require_constants.MESH_CA_FIELD;
 exports.MESH_CA_KEY_REF = require_constants.MESH_CA_KEY_REF;
 exports.MESH_CA_SETTINGS_KEY = require_constants.MESH_CA_SETTINGS_KEY;
-exports.MESH_CLEAR_PORT_FIELD = require_builtins_system_config_system_config_addon.MESH_CLEAR_PORT_FIELD;
 exports.MESH_JOIN_AUTHENTICATE_ACTION = MESH_JOIN_AUTHENTICATE_ACTION;
 exports.MESH_JOIN_CHALLENGE_ACTION = MESH_JOIN_CHALLENGE_ACTION;
 exports.MESH_JOIN_CHALLENGE_INVALID_TYPE = MESH_JOIN_CHALLENGE_INVALID_TYPE;
@@ -14124,7 +14122,6 @@ exports.allFamiliesListenHost = require_tls.allFamiliesListenHost;
 exports.answerClaimedGetStatus = require_child_cap_dispatch.answerClaimedGetStatus;
 exports.applyCertificateToListener = require_tls.applyCertificateToListener;
 exports.applyLanHttp = require_tls.applyLanHttp;
-exports.applyProcessMeshClearPort = require_builtins_system_config_system_config_addon.applyProcessMeshClearPort;
 exports.attachUserManagementInternal = require_builtins_local_auth_local_auth_addon.attachUserManagementInternal;
 exports.attributeStall = require_event_loop_stall_monitor.attributeStall;
 exports.bindPendingLanHttp = require_tls.bindPendingLanHttp;
@@ -14156,7 +14153,6 @@ exports.capActionSuffix = require_child_cap_dispatch.capActionSuffix;
 exports.capBareAction = require_child_cap_dispatch.capBareAction;
 exports.capServiceName = require_child_cap_dispatch.capServiceName;
 exports.checkClusterSecret = require_constants.checkClusterSecret;
-exports.checkProcessMeshClearPort = require_builtins_system_config_system_config_addon.checkProcessMeshClearPort;
 exports.classifyAddonDir = classifyAddonDir;
 exports.classifyCapRoute = require_child_cap_dispatch.classifyCapRoute;
 exports.clearHttpsListener = require_tls.clearHttpsListener;
@@ -14215,7 +14211,6 @@ exports.createUdsLogger = require_child_cap_dispatch.createUdsLogger;
 exports.createUdsLoggerWithControl = require_child_cap_dispatch.createUdsLoggerWithControl;
 exports.createV8Reclaimer = require_child_cap_dispatch.createV8Reclaimer;
 exports.decideMeshAutoEnforce = decideMeshAutoEnforce;
-exports.decideMeshClearPortOff = require_builtins_system_config_system_config_addon.decideMeshClearPortOff;
 exports.deleteModelFromDisk = require_event_loop_stall_monitor.deleteModelFromDisk;
 exports.deriveAgentListenPort = deriveAgentListenPort;
 exports.describeProviderKindDrift = describeProviderKindDrift;
@@ -14437,8 +14432,8 @@ exports.setPlatformKeychainKey = require_platform_key_source.setPlatformKeychain
 exports.setProcessClusterSecretGate = require_constants.setProcessClusterSecretGate;
 exports.setProcessMeshAuthMode = require_builtins_system_config_system_config_addon.setProcessMeshAuthMode;
 exports.setProcessMeshAuthStatusSource = require_builtins_system_config_system_config_addon.setProcessMeshAuthStatusSource;
-exports.setProcessMeshClearPortControl = require_builtins_system_config_system_config_addon.setProcessMeshClearPortControl;
 exports.setProcessMeshEnforcer = require_builtins_system_config_system_config_addon.setProcessMeshEnforcer;
+exports.setProcessMeshPeerTransportLookup = require_builtins_system_config_system_config_addon.setProcessMeshPeerTransportLookup;
 exports.setProcessMeshTlsEnabler = require_builtins_system_config_system_config_addon.setProcessMeshTlsEnabler;
 exports.setWrapperActive = require_builtins_device_manager_device_manager_addon.setWrapperActive;
 exports.shouldReclaim = require_child_cap_dispatch.shouldReclaim;

package/dist/index.mjs

@@ -26,8 +26,8 @@ import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { i as stripForwardedCaller, n as HUB_CAP_FWD_SERVICE, r as createHubCapForwardService, t as HUB_CAP_FWD_ACTION } from "./hub-cap-forward-CDiN1p98.mjs";
 import { StorageOrchestratorAddon, n as buildStorageLocationRegistry, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { _ as clusterSecretMatches, a as MESH_CA_FIELD, b as isClusterSecretMismatchError, d as CLUSTER_SECRET_MISMATCH_TYPE, f as CLUSTER_SECRET_REF, g as checkClusterSecret, h as CLUSTER_SECRET_UNAVAILABLE_TYPE, m as CLUSTER_SECRET_SETTINGS_KEY, o as MESH_CA_KEY_REF, p as CLUSTER_SECRET_REJECTED_EXIT_CODE, r as DEFAULT_HUB_TLS_TCP_PORT, s as MESH_CA_SETTINGS_KEY, v as getProcessClusterSecretGate, x as setProcessClusterSecretGate, y as hashClusterSecret } from "./constants-C1WoQ0E8.mjs";
-import { A as loadMeshCa, B as MESH_AUTH_MODE_FIELD, C as caFingerprintCompact, D as generateMeshKeyPair, E as generateMeshCa, F as UnlockTicketJtiStore, G as requestProcessMeshEnforcement, H as getProcessMeshAuthStatus, I as isAllowedAgentDashboardReturnTo, J as setProcessMeshEnforcer, K as setProcessMeshAuthMode, L as mintAgentUiUnlockTicket, M as AGENT_UI_UNLOCK_DOMAIN, N as AGENT_UI_UNLOCK_TTL_MS, O as issueMeshLeafForNode, P as AGENT_UI_UNLOCK_VERSION, Q as readCidrSetting, R as parseAgentDashboardOrigins, S as caFingerprint, SystemConfigAddon, T as exportMeshPrivateKeyPem, U as isMeshAuthMode, V as getProcessMeshAuthMode, W as parseMeshAuthMode, X as normalizeIp, Y as createCidrMatcher, Z as parseCidrList, _ as MeshCrl, a as setProcessMeshTlsEnabler, b as getProcessMeshCaState, c as mintMeshJoinToken, d as MESH_CLEAR_PORT_FIELD, f as applyProcessMeshClearPort, g as setProcessMeshClearPortControl, h as getProcessNodeMeshTransport, i as ServiceBroker, j as AGENT_DASHBOARD_ORIGINS_FIELD, k as issueMeshLeafFromCsr, l as processJoinTokenJtiStore, m as decideMeshClearPortOff, n as TlsTcpTransporter, o as enrollMeshNode, p as checkProcessMeshClearPort, q as setProcessMeshAuthStatusSource, r as Errors, s as JoinTokenJtiStore, u as verifyMeshJoinToken, v as processMeshCrl, w as createMeshCsrPem, x as requireProcessMeshCa, y as MeshCaKeeper, z as verifyAgentUiUnlockTicket } from "./builtins/system-config/system-config.addon.mjs";
+import { _ as getProcessClusterSecretGate, a as MESH_CA_KEY_REF, b as setProcessClusterSecretGate, d as CLUSTER_SECRET_REF, f as CLUSTER_SECRET_REJECTED_EXIT_CODE, g as clusterSecretMatches, h as checkClusterSecret, i as MESH_CA_FIELD, m as CLUSTER_SECRET_UNAVAILABLE_TYPE, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, p as CLUSTER_SECRET_SETTINGS_KEY, u as CLUSTER_SECRET_MISMATCH_TYPE, v as hashClusterSecret, y as isClusterSecretMismatchError } from "./constants-5vADty9I.mjs";
+import { A as AGENT_UI_UNLOCK_VERSION, B as parseMeshAuthMode, C as generateMeshKeyPair, D as AGENT_DASHBOARD_ORIGINS_FIELD, E as loadMeshCa, F as verifyAgentUiUnlockTicket, G as createCidrMatcher, H as setProcessMeshAuthMode, I as MESH_AUTH_MODE_FIELD, J as readCidrSetting, K as normalizeIp, L as getProcessMeshAuthMode, M as isAllowedAgentDashboardReturnTo, N as mintAgentUiUnlockTicket, O as AGENT_UI_UNLOCK_DOMAIN, P as parseAgentDashboardOrigins, R as getProcessMeshAuthStatus, S as generateMeshCa, SystemConfigAddon, T as issueMeshLeafFromCsr, U as setProcessMeshAuthStatusSource, V as requestProcessMeshEnforcement, W as setProcessMeshEnforcer, _ as requireProcessMeshCa, a as setProcessMeshTlsEnabler, b as createMeshCsrPem, c as mintMeshJoinToken, d as getProcessNodeMeshTransport, f as setProcessMeshPeerTransportLookup, g as getProcessMeshCaState, h as MeshCaKeeper, i as ServiceBroker, j as UnlockTicketJtiStore, k as AGENT_UI_UNLOCK_TTL_MS, l as processJoinTokenJtiStore, m as processMeshCrl, n as TlsTcpTransporter, o as enrollMeshNode, p as MeshCrl, q as parseCidrList, r as Errors, s as JoinTokenJtiStore, u as verifyMeshJoinToken, v as caFingerprint, w as issueMeshLeafForNode, x as exportMeshPrivateKeyPem, y as caFingerprintCompact, z as isMeshAuthMode } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as resolveFormatRevision, S as isModelDownloaded, _ as downloadModel, a as createFileDataPlaneHandler, b as getModelFilePath, c as parseRangeHeader, d as ModelDownloadService, g as downloadFile, h as deleteModelFromDisk, i as startEventLoopStallMonitor, l as parseTokenizedUrl, m as collectModelFiles, n as STALL_TICK_MS, o as contentTypeFor, p as adoptModelRevisions, r as attributeStall, s as createAuthenticatedFileServer, t as STALL_REPORT_MS, u as resolveFilePath, v as ensureModel, w as revisionWeightUrl, y as fetchJson } from "./event-loop-stall-monitor-BHtIKJY2.mjs";
@@ -36,7 +36,7 @@ import { $ as AGENT_CAP_FWD_ACTION, $n as EMPTY_SOCKET_DIRECTION, $t as HEAP_WAT
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-B2WZ8_q9.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-B4Cf4O_X.mjs";
-import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-0g91qMVF.mjs";
+import { c as BackupKeyFormatError, d as generateBackupKeyPair, l as BackupKeyMismatchError, m as readBackupEncryptionHeader, o as SystemBackupService, r as prepareRestoreArchive, s as BackupDecryptError, t as BackupKeyRequiredError } from "./restore-archive-DQ2NuwD1.mjs";
 import { z } from "zod";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
@@ -11129,9 +11129,8 @@ function createBroker(config) {
 			tlsPort: config.tlsPort ?? 6443,
 			maxPacketSize: 10 * 1024 * 1024,
 			useHostname,
-			udpDiscovery: true,
-			udpPort,
-			udpPeriod: 5,
+			hubTlsOnly: true,
+			udpDiscovery: false,
 			debug: false,
 			...config.meshTls !== void 0 ? { meshTls: config.meshTls } : {}
 		}),
@@ -13901,4 +13900,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentMeshAuthenticator, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_CLEAR_PORT_FIELD, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCrl, MeshJoinClient, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, applyProcessMeshClearPort, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, checkClusterSecret, checkProcessMeshClearPort, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, decideMeshAutoEnforce, decideMeshClearPortOff, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessNodeMeshTransport, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isCredentialKeyName, isInfraCapability, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, issueMeshLeafForNode, issueMeshLeafFromCsr, leafFingerprintOf, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, prepareRestoreArchive, probePlatform, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshClearPortControl, setProcessMeshEnforcer, setProcessMeshTlsEnabler, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyMeshJoinToken, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_READINESS_SERVICE_NAME, AGENT_REGISTER_NODE_ACTION, AGENT_UI_UNLOCK_DOMAIN, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentMeshAuthenticator, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REF, CLUSTER_SECRET_REJECTED_EXIT_CODE, CLUSTER_SECRET_SETTINGS_KEY, CLUSTER_SECRET_UNAVAILABLE_TYPE, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JoinTokenJtiStore, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_AUTH_MODE_FIELD, MESH_AUTO_ENFORCE_GRACE_MS, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_JOIN_AUTHENTICATE_ACTION, MESH_JOIN_CHALLENGE_ACTION, MESH_JOIN_CHALLENGE_INVALID_TYPE, MESH_JOIN_CHALLENGE_TTL_MS, MESH_JOIN_PROTOCOL, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, MeshAuthenticator, MeshCaKeeper, MeshCrl, MeshJoinClient, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, checkClusterSecret, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, computeHubJoinProof, computeNodeJoinProof, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, decideMeshAutoEnforce, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, enrollMeshNode, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessClusterSecretGate, getProcessJwtSigningKeyState, getProcessMeshAuthMode, getProcessMeshAuthStatus, getProcessMeshCaState, getProcessNodeMeshTransport, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hostNodeIdOf, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isCredentialKeyName, isInfraCapability, isMeshAuthMode, isModelDownloaded, isOwnChildNodeId, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isolatedBuiltinPhase, issueMeshLeafForNode, issueMeshLeafFromCsr, leafFingerprintOf, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mintMeshJoinToken, mountNativeCapService, nextRssBudgetState, normalizeIp, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseMeshAuthMode, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, prepareBootTls, prepareRestoreArchive, probePlatform, processJoinTokenJtiStore, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, requestProcessMeshEnforcement, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessClusterSecretGate, setProcessMeshAuthMode, setProcessMeshAuthStatusSource, setProcessMeshEnforcer, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setWrapperActive, shouldReclaim, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyMeshJoinToken, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/index.d.ts

@@ -39,8 +39,8 @@ export { buildStorageLocationRegistry } from "./storage-location-registry.js";
 export type { StorageLocationRegistry } from "./storage-location-registry.js";
 export { createBroker, deriveAgentListenPort, getBrokerTlsTransporter } from "./moleculer/broker-factory.js";
 export type { BrokerConfig } from "./moleculer/broker-factory.js";
-export { applyProcessMeshClearPort, caFingerprint, caFingerprintCompact, checkProcessMeshClearPort, createMeshCsrPem, decideMeshClearPortOff, enrollMeshNode, exportMeshPrivateKeyPem, getProcessNodeMeshTransport, MESH_CLEAR_PORT_FIELD, setProcessMeshClearPortControl, generateMeshCa, generateMeshKeyPair, getProcessMeshCaState, issueMeshLeafForNode, issueMeshLeafFromCsr, JoinTokenJtiStore, loadMeshCa, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MeshCaKeeper, MeshCrl, mintMeshJoinToken, processMeshCrl, processJoinTokenJtiStore, requireProcessMeshCa, setProcessMeshTlsEnabler, TlsTcpTransporter, verifyMeshJoinToken, DEFAULT_HUB_TLS_TCP_PORT } from "./moleculer/mesh-mtls/index.js";
-export type { MeshCaSigner, MeshClearPortAgent, MeshClearPortControl, MeshClearPortDecision, MeshClearPortMode, MeshEnrollResult, MeshTransport, MeshJoinTokenClaims, MeshTlsMaterial } from "./moleculer/mesh-mtls/index.js";
+export { caFingerprint, caFingerprintCompact, createMeshCsrPem, enrollMeshNode, exportMeshPrivateKeyPem, getProcessNodeMeshTransport, setProcessMeshPeerTransportLookup, generateMeshCa, generateMeshKeyPair, getProcessMeshCaState, issueMeshLeafForNode, issueMeshLeafFromCsr, JoinTokenJtiStore, loadMeshCa, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MeshCaKeeper, MeshCrl, mintMeshJoinToken, processMeshCrl, processJoinTokenJtiStore, requireProcessMeshCa, setProcessMeshTlsEnabler, TlsTcpTransporter, verifyMeshJoinToken, DEFAULT_HUB_TLS_TCP_PORT } from "./moleculer/mesh-mtls/index.js";
+export type { MeshCaSigner, MeshEnrollResult, MeshPeerTransportLookup, MeshTransport, MeshJoinTokenClaims, MeshTlsMaterial } from "./moleculer/mesh-mtls/index.js";
 export { type AddonDeploySource, isAddonDeploySource } from "./moleculer/addon-deploy-source.js";
 export { createAddonService, validateProviderRegistrations } from "./moleculer/addon-service-factory.js";
 export { createCoreCapService, CORE_CAP_SERVICE_NAME } from "./moleculer/core-cap-service.js";

package/dist/kernel/moleculer/mesh-mtls/constants.d.ts

@@ -8,7 +8,7 @@ export declare const MESH_CA_FIELD = "meshCa";
 export declare const MESH_JOIN_TOKEN_MAX_TTL_SEC: number;
 export declare const MESH_LEAF_VALIDITY_DAYS = 30;
 export declare const MESH_CA_VALIDITY_DAYS = 3650;
-/** Hub clear TCP (existing) and TLS dual-listen port (Release A). */
+/** Hub legacy clear TCP (retired on hub — D826) and TLS listen port. */
 export declare const DEFAULT_HUB_TCP_PORT = 6e3;
 export declare const DEFAULT_HUB_TLS_TCP_PORT = 6443;
 /** Join token payload version. */

package/dist/kernel/moleculer/mesh-mtls/index.d.ts

@@ -2,7 +2,7 @@ export { CLIENT_AUTH_OID, DEFAULT_HUB_TCP_PORT, DEFAULT_HUB_TLS_TCP_PORT, MESH_C
 export { caFingerprint, caFingerprintCompact, createMeshCsrPem, exportMeshPrivateKeyPem, generateMeshCa, generateMeshKeyPair, issueMeshLeafForNode, issueMeshLeafFromCsr, loadMeshCa, MESH_KEY_ALGORITHM, MESH_SIGNING_ALGORITHM, subjectCn, type MeshCaSigner, type MeshLeafMaterial } from "./mesh-ca.js";
 export { clearProcessMeshCa, getProcessMeshCaState, loadOrGenerateMeshCa, MESH_CA_RETRY_MS, MeshCaKeeper, requireProcessMeshCa, setProcessMeshCa, type MeshCaKeeperDeps, type MeshCaState } from "./mesh-ca-keeper.js";
 export { clearProcessMeshCrl, MeshCrl, processMeshCrl } from "./mesh-crl.js";
-export { applyProcessMeshClearPort, checkProcessMeshClearPort, decideMeshClearPortOff, getProcessMeshClearPortControl, getProcessNodeMeshTransport, isMeshClearPortMode, MESH_CLEAR_PORT_FIELD, parseMeshClearPortMode, setProcessMeshClearPortControl, type MeshClearPortAgent, type MeshClearPortControl, type MeshClearPortDecision, type MeshClearPortMode, type MeshTransport } from "./mesh-clear-port.js";
+export { getProcessNodeMeshTransport, setProcessMeshPeerTransportLookup, type MeshPeerTransportLookup, type MeshTransport } from "./mesh-peer-transport.js";
 export { enrollMeshNode } from "./mesh-enroll.js";
 export type { EnrollMeshNodeDeps, MeshEnrollRequest, MeshEnrollResult } from "./mesh-enroll.js";
 export { JoinTokenJtiStore, mintMeshJoinToken, processJoinTokenJtiStore, verifyMeshJoinToken, type MeshJoinTokenClaims, type MintJoinTokenInput } from "./mesh-join-token.js";

package/dist/kernel/moleculer/mesh-mtls/mesh-peer-transport.d.ts

@@ -0,0 +1,13 @@
+/**
+* Hub-side telemetry: how an agent node reached the mesh transporter.
+* The clear mesh port is retired — only mutual TLS is offered on the hub.
+*/
+/** How a node reaches the hub (badge / topology). */
+export type MeshTransport = "tls" | "clear";
+export interface MeshPeerTransportLookup {
+	transportOf(nodeId: string): MeshTransport | undefined;
+}
+/** Published by the hub broker owner; cleared on shutdown. */
+export declare function setProcessMeshPeerTransportLookup(lookup: MeshPeerTransportLookup | null): void;
+/** `tls` / `clear` for an agent as the hub sees it; `undefined` off the hub. */
+export declare function getProcessNodeMeshTransport(nodeId: string): MeshTransport | undefined;

package/dist/kernel/moleculer/mesh-mtls/tls-tcp-transporter.d.ts

@@ -69,6 +69,8 @@ export interface TlsTcpTransporterOptions {
 	/** When set at construction, TLS starts with the clear reader. */
 	readonly meshTls?: MeshTlsMaterial;
 	readonly crl?: MeshCrl;
+	/** Hub only (D826): never bind clear TCP or UDP discovery. */
+	readonly hubTlsOnly?: boolean;
 }
 export declare class TlsTcpTransporter extends TcpTransporterBase {
 	private tlsServer;
@@ -78,6 +80,7 @@ export declare class TlsTcpTransporter extends TcpTransporterBase {
 	/** Node id (certificate CN) → serial of every peer that completed a mutual-TLS handshake. */
 	private readonly tlsPeers;
 	private clearDisabled;
+	private readonly hubTlsOnly;
 	/** Clear-text `TcpWriter.connect` captured once before the TLS wrap (A→B). */
 	private clearWriterConnect;
 	private writerTlsPatched;